2 * Copyright (c) 2000-2019 Apple Inc. All rights reserved.
4 * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
6 * This file contains Original Code and/or Modifications of Original Code
7 * as defined in and that are subject to the Apple Public Source License
8 * Version 2.0 (the 'License'). You may not use this file except in
9 * compliance with the License. The rights granted to you under the License
10 * may not be used to create, or enable the creation or redistribution of,
11 * unlawful or unlicensed copies of an Apple operating system, or to
12 * circumvent, violate, or enable the circumvention or violation of, any
13 * terms of an Apple operating system software license agreement.
15 * Please obtain a copy of the License at
16 * http://www.opensource.apple.com/apsl/ and read it before using this file.
18 * The Original Code and all software distributed under the License are
19 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
20 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
21 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
22 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
23 * Please see the License for the specific language governing rights and
24 * limitations under the License.
26 * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
29 * Implementation of SVID messages
31 * Author: Daniel Boulet
33 * Copyright 1993 Daniel Boulet and RTMX Inc.
35 * This system call was implemented by Daniel Boulet under contract from RTMX.
37 * Redistribution and use in source forms, with and without modification,
38 * are permitted provided that this entire comment appears intact.
40 * Redistribution in binary form may occur without any restrictions.
41 * Obviously, it would be nice if you gave credit where credit is due
42 * but requiring it would be too onerous.
44 * This software is provided ``AS IS'' without any warranties of any kind.
47 * NOTICE: This file was modified by SPARTA, Inc. in 2005 to introduce
48 * support for mandatory and extensible security protections. This notice
49 * is included in support of clause 2.2 (b) of the Apple Public License,
53 #include <sys/param.h>
54 #include <sys/systm.h>
55 #include <sys/kernel.h>
56 #include <sys/proc_internal.h>
57 #include <sys/kauth.h>
59 #include <sys/malloc.h>
60 #include <mach/mach_types.h>
62 #include <security/audit/audit.h>
64 #include <sys/filedesc.h>
65 #include <sys/file_internal.h>
66 #include <sys/sysctl.h>
67 #include <sys/sysproto.h>
71 #include <security/mac_framework.h>
76 static int msginit(void *);
81 /* Uncomment this line to see MAC debugging output. */
82 /* #define MAC_DEBUG */
84 #define MPRINTF(a) printf(a)
88 static void msg_freehdr(struct msg
*msghdr
);
90 typedef int sy_call_t(struct proc
*, void *, int *);
92 /* XXX casting to (sy_call_t *) is bogus, as usual. */
93 static sy_call_t
* const msgcalls
[] = {
94 (sy_call_t
*)msgctl
, (sy_call_t
*)msgget
,
95 (sy_call_t
*)msgsnd
, (sy_call_t
*)msgrcv
98 static int nfree_msgmaps
; /* # of free map entries */
99 static short free_msgmaps
; /* free map entries list head */
100 static struct msg
*free_msghdrs
; /* list of free msg headers */
101 char *msgpool
; /* MSGMAX byte long msg buffer pool */
102 struct msgmap
*msgmaps
; /* MSGSEG msgmap structures */
103 struct msg
*msghdrs
; /* MSGTQL msg headers */
104 struct msqid_kernel
*msqids
; /* MSGMNI msqid_kernel structs (wrapping user_msqid_ds structs) */
106 static LCK_GRP_DECLARE(sysv_msg_subsys_lck_grp
, "sysv_msg_subsys_lock");
107 static LCK_MTX_DECLARE(sysv_msg_subsys_mutex
, &sysv_msg_subsys_lck_grp
);
109 #define SYSV_MSG_SUBSYS_LOCK() lck_mtx_lock(&sysv_msg_subsys_mutex)
110 #define SYSV_MSG_SUBSYS_UNLOCK() lck_mtx_unlock(&sysv_msg_subsys_mutex)
112 #ifdef __APPLE_API_PRIVATE
113 int msgmax
, /* max chars in a message */
114 msgmni
, /* max message queue identifiers */
115 msgmnb
, /* max chars in a queue */
116 msgtql
, /* max messages in system */
117 msgssz
, /* size of a message segment (see notes above) */
118 msgseg
; /* number of message segments */
119 struct msginfo msginfo
= {
120 .msgmax
= MSGMAX
, /* = (MSGSSZ*MSGSEG) : max chars in a message */
121 .msgmni
= MSGMNI
, /* = 40 : max message queue identifiers */
122 .msgmnb
= MSGMNB
, /* = 2048 : max chars in a queue */
123 .msgtql
= MSGTQL
, /* = 40 : max messages in system */
124 .msgssz
= MSGSSZ
, /* = 8 : size of a message segment (2^N long) */
125 .msgseg
= MSGSEG
/* = 2048 : number of message segments */
127 #endif /* __APPLE_API_PRIVATE */
129 static __inline__ user_time_t
138 * NOTE: Source and target may *NOT* overlap! (target is smaller)
141 msqid_ds_kerneltouser32(struct user_msqid_ds
*in
, struct user32_msqid_ds
*out
)
143 out
->msg_perm
= in
->msg_perm
;
144 out
->msg_qnum
= in
->msg_qnum
;
145 out
->msg_cbytes
= in
->msg_cbytes
; /* for ipcs */
146 out
->msg_qbytes
= in
->msg_qbytes
;
147 out
->msg_lspid
= in
->msg_lspid
;
148 out
->msg_lrpid
= in
->msg_lrpid
;
149 out
->msg_stime
= in
->msg_stime
; /* XXX loss of range */
150 out
->msg_rtime
= in
->msg_rtime
; /* XXX loss of range */
151 out
->msg_ctime
= in
->msg_ctime
; /* XXX loss of range */
155 msqid_ds_kerneltouser64(struct user_msqid_ds
*in
, struct user64_msqid_ds
*out
)
157 out
->msg_perm
= in
->msg_perm
;
158 out
->msg_qnum
= in
->msg_qnum
;
159 out
->msg_cbytes
= in
->msg_cbytes
; /* for ipcs */
160 out
->msg_qbytes
= in
->msg_qbytes
;
161 out
->msg_lspid
= in
->msg_lspid
;
162 out
->msg_lrpid
= in
->msg_lrpid
;
163 out
->msg_stime
= in
->msg_stime
; /* XXX loss of range */
164 out
->msg_rtime
= in
->msg_rtime
; /* XXX loss of range */
165 out
->msg_ctime
= in
->msg_ctime
; /* XXX loss of range */
169 * NOTE: Source and target may are permitted to overlap! (source is smaller);
170 * this works because we copy fields in order from the end of the struct to
174 msqid_ds_user32tokernel(struct user32_msqid_ds
*in
, struct user_msqid_ds
*out
)
176 out
->msg_ctime
= in
->msg_ctime
;
177 out
->msg_rtime
= in
->msg_rtime
;
178 out
->msg_stime
= in
->msg_stime
;
179 out
->msg_lrpid
= in
->msg_lrpid
;
180 out
->msg_lspid
= in
->msg_lspid
;
181 out
->msg_qbytes
= in
->msg_qbytes
;
182 out
->msg_cbytes
= in
->msg_cbytes
; /* for ipcs */
183 out
->msg_qnum
= in
->msg_qnum
;
184 out
->msg_perm
= in
->msg_perm
;
188 msqid_ds_user64tokernel(struct user64_msqid_ds
*in
, struct user_msqid_ds
*out
)
190 out
->msg_ctime
= in
->msg_ctime
;
191 out
->msg_rtime
= in
->msg_rtime
;
192 out
->msg_stime
= in
->msg_stime
;
193 out
->msg_lrpid
= in
->msg_lrpid
;
194 out
->msg_lspid
= in
->msg_lspid
;
195 out
->msg_qbytes
= in
->msg_qbytes
;
196 out
->msg_cbytes
= in
->msg_cbytes
; /* for ipcs */
197 out
->msg_qnum
= in
->msg_qnum
;
198 out
->msg_perm
= in
->msg_perm
;
201 /* This routine assumes the system is locked prior to calling this routine */
203 msginit(__unused
void *dummy
)
205 static int initted
= 0;
208 /* Lazy initialization on first system call; we don't have SYSINIT(). */
214 * msginfo.msgssz should be a power of two for efficiency reasons.
215 * It is also pretty silly if msginfo.msgssz is less than 8
216 * or greater than about 256 so ...
219 while (i
< 1024 && i
!= msginfo
.msgssz
) {
222 if (i
!= msginfo
.msgssz
) {
223 printf("msginfo.msgssz=%d (0x%x) not a small power of 2; resetting to %d\n", msginfo
.msgssz
, msginfo
.msgssz
, MSGSSZ
);
224 msginfo
.msgssz
= MSGSSZ
;
227 if (msginfo
.msgseg
> 32767) {
228 printf("msginfo.msgseg=%d (> 32767); resetting to %d\n", msginfo
.msgseg
, MSGSEG
);
229 msginfo
.msgseg
= MSGSEG
;
234 * Allocate memory for message pool, maps, headers, and queue IDs;
235 * if this fails, fail safely and leave it uninitialized (related
236 * system calls will fail).
238 msgpool
= kheap_alloc(KHEAP_DATA_BUFFERS
, msginfo
.msgmax
, Z_WAITOK
);
239 if (msgpool
== NULL
) {
240 printf("msginit: can't allocate msgpool");
243 msgmaps
= kheap_alloc(KM_SHM
, sizeof(struct msgmap
) * msginfo
.msgseg
,
245 if (msgmaps
== NULL
) {
246 printf("msginit: can't allocate msgmaps");
250 msghdrs
= kheap_alloc(KM_SHM
, sizeof(struct msg
) * msginfo
.msgtql
,
252 if (msghdrs
== NULL
) {
253 printf("msginit: can't allocate msghdrs");
257 msqids
= kheap_alloc(KM_SHM
,
258 sizeof(struct msqid_kernel
) * msginfo
.msgmni
, Z_WAITOK
);
259 if (msqids
== NULL
) {
260 printf("msginit: can't allocate msqids");
266 for (i
= 0; i
< msginfo
.msgseg
; i
++) {
268 msgmaps
[i
- 1].next
= i
;
270 msgmaps
[i
].next
= -1; /* implies entry is available */
273 nfree_msgmaps
= msginfo
.msgseg
;
277 for (i
= 0; i
< msginfo
.msgtql
; i
++) {
278 msghdrs
[i
].msg_type
= 0;
280 msghdrs
[i
- 1].msg_next
= &msghdrs
[i
];
282 msghdrs
[i
].msg_next
= NULL
;
284 mac_sysvmsg_label_init(&msghdrs
[i
]);
287 free_msghdrs
= &msghdrs
[0];
290 for (i
= 0; i
< msginfo
.msgmni
; i
++) {
291 msqids
[i
].u
.msg_qbytes
= 0; /* implies entry is available */
292 msqids
[i
].u
.msg_perm
._seq
= 0; /* reset to a known value */
293 msqids
[i
].u
.msg_perm
.mode
= 0;
295 mac_sysvmsq_label_init(&msqids
[i
]);
302 kheap_free(KHEAP_DATA_BUFFERS
, msgpool
,
303 sizeof(struct msgmap
) * msginfo
.msgseg
);
304 kheap_free(KM_SHM
, msgmaps
,
305 sizeof(struct msgmap
) * msginfo
.msgseg
);
306 kheap_free(KM_SHM
, msghdrs
,
307 sizeof(struct msg
) * msginfo
.msgtql
);
308 kheap_free(KM_SHM
, msqids
,
309 sizeof(struct msqid_kernel
) * msginfo
.msgmni
);
317 * Entry point for all MSG calls: msgctl, msgget, msgsnd, msgrcv
319 * Parameters: p Process requesting the call
320 * uap User argument descriptor (see below)
321 * retval Return value of the selected msg call
323 * Indirect parameters: uap->which msg call to invoke (index in array of msg calls)
324 * uap->a2 User argument descriptor
329 * Implicit returns: retval Return value of the selected msg call
331 * DEPRECATED: This interface should not be used to call the other MSG
332 * functions (msgctl, msgget, msgsnd, msgrcv). The correct
333 * usage is to call the other MSG functions directly.
337 msgsys(struct proc
*p
, struct msgsys_args
*uap
, int32_t *retval
)
339 if (uap
->which
>= sizeof(msgcalls
) / sizeof(msgcalls
[0])) {
342 return (*msgcalls
[uap
->which
])(p
, &uap
->a2
, retval
);
346 msg_freehdr(struct msg
*msghdr
)
348 while (msghdr
->msg_ts
> 0) {
350 if (msghdr
->msg_spot
< 0 || msghdr
->msg_spot
>= msginfo
.msgseg
) {
351 panic("msghdr->msg_spot out of range");
353 next
= msgmaps
[msghdr
->msg_spot
].next
;
354 msgmaps
[msghdr
->msg_spot
].next
= free_msgmaps
;
355 free_msgmaps
= msghdr
->msg_spot
;
357 msghdr
->msg_spot
= next
;
358 if (msghdr
->msg_ts
>= msginfo
.msgssz
) {
359 msghdr
->msg_ts
-= msginfo
.msgssz
;
364 if (msghdr
->msg_spot
!= -1) {
365 panic("msghdr->msg_spot != -1");
367 msghdr
->msg_next
= free_msghdrs
;
368 free_msghdrs
= msghdr
;
370 mac_sysvmsg_label_recycle(msghdr
);
373 * Notify waiters that there are free message headers and segments
376 wakeup((caddr_t
)&free_msghdrs
);
380 msgctl(struct proc
*p
, struct msgctl_args
*uap
, int32_t *retval
)
382 int msqid
= uap
->msqid
;
384 kauth_cred_t cred
= kauth_cred_get();
386 struct user_msqid_ds msqbuf
;
387 struct msqid_kernel
*msqptr
;
389 SYSV_MSG_SUBSYS_LOCK();
397 printf("call to msgctl(%d, %d, 0x%qx)\n", msqid
, cmd
, uap
->buf
);
400 AUDIT_ARG(svipc_cmd
, cmd
);
401 AUDIT_ARG(svipc_id
, msqid
);
402 msqid
= IPCID_TO_IX(msqid
);
404 if (msqid
< 0 || msqid
>= msginfo
.msgmni
) {
406 printf("msqid (%d) out of range (0<=msqid<%d)\n", msqid
,
413 msqptr
= &msqids
[msqid
];
415 if (msqptr
->u
.msg_qbytes
== 0) {
417 printf("no such msqid\n");
422 if (msqptr
->u
.msg_perm
._seq
!= IPCID_TO_SEQ(uap
->msqid
)) {
424 printf("wrong sequence number\n");
430 eval
= mac_sysvmsq_check_msqctl(kauth_cred_get(), msqptr
, cmd
);
443 if ((eval
= ipcperm(cred
, &msqptr
->u
.msg_perm
, IPC_M
))) {
448 * Check that the thread has MAC access permissions to
449 * individual msghdrs. Note: We need to do this in a
450 * separate loop because the actual loop alters the
451 * msq/msghdr info as it progresses, and there is no going
452 * back if half the way through we discover that the
453 * thread cannot free a certain msghdr. The msq will get
454 * into an inconsistent state.
456 for (msghdr
= msqptr
->u
.msg_first
; msghdr
!= NULL
;
457 msghdr
= msghdr
->msg_next
) {
458 eval
= mac_sysvmsq_check_msgrmid(kauth_cred_get(), msghdr
);
464 /* Free the message headers */
465 msghdr
= msqptr
->u
.msg_first
;
466 while (msghdr
!= NULL
) {
467 struct msg
*msghdr_tmp
;
469 /* Free the segments of each message */
470 msqptr
->u
.msg_cbytes
-= msghdr
->msg_ts
;
471 msqptr
->u
.msg_qnum
--;
473 msghdr
= msghdr
->msg_next
;
474 msg_freehdr(msghdr_tmp
);
477 if (msqptr
->u
.msg_cbytes
!= 0) {
478 panic("msg_cbytes is messed up");
480 if (msqptr
->u
.msg_qnum
!= 0) {
481 panic("msg_qnum is messed up");
484 msqptr
->u
.msg_qbytes
= 0; /* Mark it as free */
486 mac_sysvmsq_label_recycle(msqptr
);
489 wakeup((caddr_t
)msqptr
);
495 if ((eval
= ipcperm(cred
, &msqptr
->u
.msg_perm
, IPC_M
))) {
499 SYSV_MSG_SUBSYS_UNLOCK();
501 if (IS_64BIT_PROCESS(p
)) {
502 struct user64_msqid_ds tmpds
;
503 eval
= copyin(uap
->buf
, &tmpds
, sizeof(tmpds
));
505 msqid_ds_user64tokernel(&tmpds
, &msqbuf
);
507 struct user32_msqid_ds tmpds
;
509 eval
= copyin(uap
->buf
, &tmpds
, sizeof(tmpds
));
511 msqid_ds_user32tokernel(&tmpds
, &msqbuf
);
517 SYSV_MSG_SUBSYS_LOCK();
519 if (msqbuf
.msg_qbytes
> msqptr
->u
.msg_qbytes
) {
520 eval
= suser(cred
, &p
->p_acflag
);
527 /* compare (msglen_t) value against restrict (int) value */
528 if (msqbuf
.msg_qbytes
> (user_msglen_t
)msginfo
.msgmnb
) {
530 printf("can't increase msg_qbytes beyond %d (truncating)\n",
533 msqbuf
.msg_qbytes
= msginfo
.msgmnb
; /* silently restrict qbytes to system limit */
535 if (msqbuf
.msg_qbytes
== 0) {
537 printf("can't reduce msg_qbytes to 0\n");
542 msqptr
->u
.msg_perm
.uid
= msqbuf
.msg_perm
.uid
; /* change the owner */
543 msqptr
->u
.msg_perm
.gid
= msqbuf
.msg_perm
.gid
; /* change the owner */
544 msqptr
->u
.msg_perm
.mode
= (msqptr
->u
.msg_perm
.mode
& ~0777) |
545 (msqbuf
.msg_perm
.mode
& 0777);
546 msqptr
->u
.msg_qbytes
= msqbuf
.msg_qbytes
;
547 msqptr
->u
.msg_ctime
= sysv_msgtime();
551 if ((eval
= ipcperm(cred
, &msqptr
->u
.msg_perm
, IPC_R
))) {
553 printf("requester doesn't have read access\n");
558 SYSV_MSG_SUBSYS_UNLOCK();
559 if (IS_64BIT_PROCESS(p
)) {
560 struct user64_msqid_ds msqid_ds64
= {};
561 msqid_ds_kerneltouser64(&msqptr
->u
, &msqid_ds64
);
562 eval
= copyout(&msqid_ds64
, uap
->buf
, sizeof(msqid_ds64
));
564 struct user32_msqid_ds msqid_ds32
= {};
565 msqid_ds_kerneltouser32(&msqptr
->u
, &msqid_ds32
);
566 eval
= copyout(&msqid_ds32
, uap
->buf
, sizeof(msqid_ds32
));
568 SYSV_MSG_SUBSYS_LOCK();
573 printf("invalid command %d\n", cmd
);
583 SYSV_MSG_SUBSYS_UNLOCK();
588 msgget(__unused
struct proc
*p
, struct msgget_args
*uap
, int32_t *retval
)
592 int msgflg
= uap
->msgflg
;
593 kauth_cred_t cred
= kauth_cred_get();
594 struct msqid_kernel
*msqptr
= NULL
;
596 SYSV_MSG_SUBSYS_LOCK();
604 printf("msgget(0x%x, 0%o)\n", key
, msgflg
);
607 if (key
!= IPC_PRIVATE
) {
608 for (msqid
= 0; msqid
< msginfo
.msgmni
; msqid
++) {
609 msqptr
= &msqids
[msqid
];
610 if (msqptr
->u
.msg_qbytes
!= 0 &&
611 msqptr
->u
.msg_perm
._key
== key
) {
615 if (msqid
< msginfo
.msgmni
) {
617 printf("found public key\n");
619 if ((msgflg
& IPC_CREAT
) && (msgflg
& IPC_EXCL
)) {
621 printf("not exclusive\n");
626 if ((eval
= ipcperm(cred
, &msqptr
->u
.msg_perm
, msgflg
& 0700 ))) {
628 printf("requester doesn't have 0%o access\n",
634 eval
= mac_sysvmsq_check_msqget(cred
, msqptr
);
644 printf("need to allocate the user_msqid_ds\n");
646 if (key
== IPC_PRIVATE
|| (msgflg
& IPC_CREAT
)) {
647 for (msqid
= 0; msqid
< msginfo
.msgmni
; msqid
++) {
649 * Look for an unallocated and unlocked user_msqid_ds.
650 * user_msqid_ds's can be locked by msgsnd or msgrcv
651 * while they are copying the message in/out. We
652 * can't re-use the entry until they release it.
654 msqptr
= &msqids
[msqid
];
655 if (msqptr
->u
.msg_qbytes
== 0 &&
656 (msqptr
->u
.msg_perm
.mode
& MSG_LOCKED
) == 0) {
660 if (msqid
== msginfo
.msgmni
) {
662 printf("no more user_msqid_ds's available\n");
668 printf("msqid %d is available\n", msqid
);
670 msqptr
->u
.msg_perm
._key
= key
;
671 msqptr
->u
.msg_perm
.cuid
= kauth_cred_getuid(cred
);
672 msqptr
->u
.msg_perm
.uid
= kauth_cred_getuid(cred
);
673 msqptr
->u
.msg_perm
.cgid
= kauth_cred_getgid(cred
);
674 msqptr
->u
.msg_perm
.gid
= kauth_cred_getgid(cred
);
675 msqptr
->u
.msg_perm
.mode
= (msgflg
& 0777);
676 /* Make sure that the returned msqid is unique */
677 msqptr
->u
.msg_perm
._seq
++;
678 msqptr
->u
.msg_first
= NULL
;
679 msqptr
->u
.msg_last
= NULL
;
680 msqptr
->u
.msg_cbytes
= 0;
681 msqptr
->u
.msg_qnum
= 0;
682 msqptr
->u
.msg_qbytes
= msginfo
.msgmnb
;
683 msqptr
->u
.msg_lspid
= 0;
684 msqptr
->u
.msg_lrpid
= 0;
685 msqptr
->u
.msg_stime
= 0;
686 msqptr
->u
.msg_rtime
= 0;
687 msqptr
->u
.msg_ctime
= sysv_msgtime();
689 mac_sysvmsq_label_associate(cred
, msqptr
);
693 printf("didn't find it and wasn't asked to create it\n");
700 /* Construct the unique msqid */
701 *retval
= IXSEQ_TO_IPCID(msqid
, msqptr
->u
.msg_perm
);
702 AUDIT_ARG(svipc_id
, *retval
);
705 SYSV_MSG_SUBSYS_UNLOCK();
711 msgsnd(struct proc
*p
, struct msgsnd_args
*uap
, int32_t *retval
)
713 __pthread_testcancel(1);
714 return msgsnd_nocancel(p
, (struct msgsnd_nocancel_args
*)uap
, retval
);
718 msgsnd_nocancel(struct proc
*p
, struct msgsnd_nocancel_args
*uap
, int32_t *retval
)
720 int msqid
= uap
->msqid
;
721 user_addr_t user_msgp
= uap
->msgp
;
722 size_t msgsz
= (size_t)uap
->msgsz
; /* limit to 4G */
723 int msgflg
= uap
->msgflg
;
724 int segs_needed
, eval
;
725 struct msqid_kernel
*msqptr
;
731 SYSV_MSG_SUBSYS_LOCK();
739 printf("call to msgsnd(%d, 0x%qx, %ld, %d)\n", msqid
, user_msgp
, msgsz
,
743 AUDIT_ARG(svipc_id
, msqid
);
744 msqid
= IPCID_TO_IX(msqid
);
746 if (msqid
< 0 || msqid
>= msginfo
.msgmni
) {
748 printf("msqid (%d) out of range (0<=msqid<%d)\n", msqid
,
755 msqptr
= &msqids
[msqid
];
756 if (msqptr
->u
.msg_qbytes
== 0) {
758 printf("no such message queue id\n");
763 if (msqptr
->u
.msg_perm
._seq
!= IPCID_TO_SEQ(uap
->msqid
)) {
765 printf("wrong sequence number\n");
771 if ((eval
= ipcperm(kauth_cred_get(), &msqptr
->u
.msg_perm
, IPC_W
))) {
773 printf("requester doesn't have write access\n");
779 eval
= mac_sysvmsq_check_msqsnd(kauth_cred_get(), msqptr
);
784 segs_needed
= (msgsz
+ msginfo
.msgssz
- 1) / msginfo
.msgssz
;
786 printf("msgsz=%ld, msgssz=%d, segs_needed=%d\n", msgsz
, msginfo
.msgssz
,
791 * If we suffer resource starvation, we will sleep in this loop and
792 * wait for more resources to become available. This is a loop to
793 * ensure reacquisition of the mutex following any sleep, since there
794 * are multiple resources under contention.
797 void *blocking_resource
= NULL
;
800 * Check that we have not had the maximum message size change
801 * out from under us and render our message invalid while we
802 * slept waiting for some resource.
804 if (msgsz
> msqptr
->u
.msg_qbytes
) {
806 printf("msgsz > msqptr->msg_qbytes\n");
813 * If the user_msqid_ds is already locked, we need to sleep on
814 * the queue until it's unlocked.
816 if (msqptr
->u
.msg_perm
.mode
& MSG_LOCKED
) {
818 printf("msqid is locked\n");
820 blocking_resource
= msqptr
;
824 * If our message plus the messages already in the queue would
825 * cause us to exceed the maximum number of bytes wer are
826 * permitted to queue, then block on the queue until it drains.
828 if (msgsz
+ msqptr
->u
.msg_cbytes
> msqptr
->u
.msg_qbytes
) {
830 printf("msgsz + msg_cbytes > msg_qbytes\n");
832 blocking_resource
= msqptr
;
836 * Both message maps and message headers are protected by
837 * sleeping on the address of the pointer to the list of free
838 * message headers, since they are allocated and freed in
841 if (segs_needed
> nfree_msgmaps
) {
843 printf("segs_needed > nfree_msgmaps\n");
845 blocking_resource
= &free_msghdrs
;
847 if (free_msghdrs
== NULL
) {
849 printf("no more msghdrs\n");
851 blocking_resource
= &free_msghdrs
;
854 if (blocking_resource
!= NULL
) {
857 if ((msgflg
& IPC_NOWAIT
) != 0) {
859 printf("need more resources but caller doesn't want to wait\n");
865 if ((msqptr
->u
.msg_perm
.mode
& MSG_LOCKED
) != 0) {
867 printf("we don't own the user_msqid_ds\n");
871 /* Force later arrivals to wait for our
874 printf("we own the user_msqid_ds\n");
876 msqptr
->u
.msg_perm
.mode
|= MSG_LOCKED
;
880 printf("goodnight\n");
882 eval
= msleep(blocking_resource
, &sysv_msg_subsys_mutex
, (PZERO
- 4) | PCATCH
,
885 printf("good morning, eval=%d\n", eval
);
888 msqptr
->u
.msg_perm
.mode
&= ~MSG_LOCKED
;
892 printf("msgsnd: interrupted system call\n");
899 * Make sure that the msq queue still exists
902 if (msqptr
->u
.msg_qbytes
== 0) {
904 printf("msqid deleted\n");
911 printf("got all the resources that we need\n");
918 * We have the resources that we need.
922 if (msqptr
->u
.msg_perm
.mode
& MSG_LOCKED
) {
923 panic("msg_perm.mode & MSG_LOCKED");
925 if (segs_needed
> nfree_msgmaps
) {
926 panic("segs_needed > nfree_msgmaps");
928 if (msgsz
+ msqptr
->u
.msg_cbytes
> msqptr
->u
.msg_qbytes
) {
929 panic("msgsz + msg_cbytes > msg_qbytes");
931 if (free_msghdrs
== NULL
) {
932 panic("no more msghdrs");
936 * Re-lock the user_msqid_ds in case we page-fault when copying in
939 if ((msqptr
->u
.msg_perm
.mode
& MSG_LOCKED
) != 0) {
940 panic("user_msqid_ds is already locked");
942 msqptr
->u
.msg_perm
.mode
|= MSG_LOCKED
;
945 * Allocate a message header
947 msghdr
= free_msghdrs
;
948 free_msghdrs
= msghdr
->msg_next
;
949 msghdr
->msg_spot
= -1;
950 msghdr
->msg_ts
= msgsz
;
953 mac_sysvmsg_label_associate(kauth_cred_get(), msqptr
, msghdr
);
956 * Allocate space for the message
959 while (segs_needed
> 0) {
960 if (nfree_msgmaps
<= 0) {
961 panic("not enough msgmaps");
963 if (free_msgmaps
== -1) {
964 panic("nil free_msgmaps");
968 panic("next too low #1");
970 if (next
>= msginfo
.msgseg
) {
971 panic("next out of range #1");
974 printf("allocating segment %d to message\n", next
);
976 free_msgmaps
= msgmaps
[next
].next
;
978 msgmaps
[next
].next
= msghdr
->msg_spot
;
979 msghdr
->msg_spot
= next
;
984 * Copy in the message type. For a 64 bit process, this is 64 bits,
985 * but we only ever use the low 32 bits, so the cast is OK.
987 if (IS_64BIT_PROCESS(p
)) {
988 SYSV_MSG_SUBSYS_UNLOCK();
989 eval
= copyin(user_msgp
, &msgtype
, sizeof(msgtype
));
990 SYSV_MSG_SUBSYS_LOCK();
991 msghdr
->msg_type
= CAST_DOWN(long, msgtype
);
992 user_msgp
= user_msgp
+ sizeof(msgtype
); /* ptr math */
994 SYSV_MSG_SUBSYS_UNLOCK();
996 eval
= copyin(user_msgp
, &msg_type32
, sizeof(msg_type32
));
997 msghdr
->msg_type
= msg_type32
;
998 SYSV_MSG_SUBSYS_LOCK();
999 user_msgp
= user_msgp
+ sizeof(msg_type32
); /* ptr math */
1004 printf("error %d copying the message type\n", eval
);
1006 msg_freehdr(msghdr
);
1007 msqptr
->u
.msg_perm
.mode
&= ~MSG_LOCKED
;
1008 wakeup((caddr_t
)msqptr
);
1014 * Validate the message type
1016 if (msghdr
->msg_type
< 1) {
1017 msg_freehdr(msghdr
);
1018 msqptr
->u
.msg_perm
.mode
&= ~MSG_LOCKED
;
1019 wakeup((caddr_t
)msqptr
);
1021 printf("mtype (%ld) < 1\n", msghdr
->msg_type
);
1028 * Copy in the message body
1030 next
= msghdr
->msg_spot
;
1033 /* compare input (size_t) value against restrict (int) value */
1034 if (msgsz
> (size_t)msginfo
.msgssz
) {
1035 tlen
= msginfo
.msgssz
;
1040 panic("next too low #2");
1042 if (next
>= msginfo
.msgseg
) {
1043 panic("next out of range #2");
1046 SYSV_MSG_SUBSYS_UNLOCK();
1047 eval
= copyin(user_msgp
, &msgpool
[next
* msginfo
.msgssz
], tlen
);
1048 SYSV_MSG_SUBSYS_LOCK();
1052 printf("error %d copying in message segment\n", eval
);
1054 msg_freehdr(msghdr
);
1055 msqptr
->u
.msg_perm
.mode
&= ~MSG_LOCKED
;
1056 wakeup((caddr_t
)msqptr
);
1061 user_msgp
= user_msgp
+ tlen
; /* ptr math */
1062 next
= msgmaps
[next
].next
;
1065 panic("didn't use all the msg segments");
1069 * We've got the message. Unlock the user_msqid_ds.
1072 msqptr
->u
.msg_perm
.mode
&= ~MSG_LOCKED
;
1075 * Make sure that the user_msqid_ds is still allocated.
1078 if (msqptr
->u
.msg_qbytes
== 0) {
1079 msg_freehdr(msghdr
);
1080 wakeup((caddr_t
)msqptr
);
1081 /* The SVID says to return EIDRM. */
1085 /* Unfortunately, BSD doesn't define that code yet! */
1093 * Note: Since the task/thread allocates the msghdr and usually
1094 * primes it with its own MAC label, for a majority of policies, it
1095 * won't be necessary to check whether the msghdr has access
1096 * permissions to the msgq. The mac_sysvmsq_check_msqsnd check would
1097 * suffice in that case. However, this hook may be required where
1098 * individual policies derive a non-identical label for the msghdr
1099 * from the current thread label and may want to check the msghdr
1100 * enqueue permissions, along with read/write permissions to the
1103 eval
= mac_sysvmsq_check_enqueue(kauth_cred_get(), msghdr
, msqptr
);
1105 msg_freehdr(msghdr
);
1106 wakeup((caddr_t
) msqptr
);
1111 * Put the message into the queue
1114 if (msqptr
->u
.msg_first
== NULL
) {
1115 msqptr
->u
.msg_first
= msghdr
;
1116 msqptr
->u
.msg_last
= msghdr
;
1118 msqptr
->u
.msg_last
->msg_next
= msghdr
;
1119 msqptr
->u
.msg_last
= msghdr
;
1121 msqptr
->u
.msg_last
->msg_next
= NULL
;
1123 msqptr
->u
.msg_cbytes
+= msghdr
->msg_ts
;
1124 msqptr
->u
.msg_qnum
++;
1125 msqptr
->u
.msg_lspid
= p
->p_pid
;
1126 msqptr
->u
.msg_stime
= sysv_msgtime();
1128 wakeup((caddr_t
)msqptr
);
1133 SYSV_MSG_SUBSYS_UNLOCK();
1139 msgrcv(struct proc
*p
, struct msgrcv_args
*uap
, user_ssize_t
*retval
)
1141 __pthread_testcancel(1);
1142 return msgrcv_nocancel(p
, (struct msgrcv_nocancel_args
*)uap
, retval
);
1146 msgrcv_nocancel(struct proc
*p
, struct msgrcv_nocancel_args
*uap
, user_ssize_t
*retval
)
1148 int msqid
= uap
->msqid
;
1149 user_addr_t user_msgp
= uap
->msgp
;
1150 size_t msgsz
= (size_t)uap
->msgsz
; /* limit to 4G */
1151 long msgtyp
= (long)uap
->msgtyp
; /* limit to 32 bits */
1152 int msgflg
= uap
->msgflg
;
1154 struct msqid_kernel
*msqptr
;
1158 user_long_t msgtype
;
1161 SYSV_MSG_SUBSYS_LOCK();
1169 printf("call to msgrcv(%d, 0x%qx, %ld, %ld, %d)\n", msqid
, user_msgp
,
1170 msgsz
, msgtyp
, msgflg
);
1173 AUDIT_ARG(svipc_id
, msqid
);
1174 msqid
= IPCID_TO_IX(msqid
);
1176 if (msqid
< 0 || msqid
>= msginfo
.msgmni
) {
1178 printf("msqid (%d) out of range (0<=msqid<%d)\n", msqid
,
1185 msqptr
= &msqids
[msqid
];
1186 if (msqptr
->u
.msg_qbytes
== 0) {
1188 printf("no such message queue id\n");
1193 if (msqptr
->u
.msg_perm
._seq
!= IPCID_TO_SEQ(uap
->msqid
)) {
1195 printf("wrong sequence number\n");
1201 if ((eval
= ipcperm(kauth_cred_get(), &msqptr
->u
.msg_perm
, IPC_R
))) {
1203 printf("requester doesn't have read access\n");
1209 eval
= mac_sysvmsq_check_msqrcv(kauth_cred_get(), msqptr
);
1215 while (msghdr
== NULL
) {
1217 msghdr
= msqptr
->u
.msg_first
;
1218 if (msghdr
!= NULL
) {
1219 if (msgsz
< msghdr
->msg_ts
&&
1220 (msgflg
& MSG_NOERROR
) == 0) {
1222 printf("first message on the queue is too big (want %ld, got %d)\n",
1223 msgsz
, msghdr
->msg_ts
);
1229 eval
= mac_sysvmsq_check_msgrcv(kauth_cred_get(),
1235 if (msqptr
->u
.msg_first
== msqptr
->u
.msg_last
) {
1236 msqptr
->u
.msg_first
= NULL
;
1237 msqptr
->u
.msg_last
= NULL
;
1239 msqptr
->u
.msg_first
= msghdr
->msg_next
;
1240 if (msqptr
->u
.msg_first
== NULL
) {
1241 panic("msg_first/last messed up #1");
1246 struct msg
*previous
;
1250 prev
= &(msqptr
->u
.msg_first
);
1251 while ((msghdr
= *prev
) != NULL
) {
1253 * Is this message's type an exact match or is
1254 * this message's type less than or equal to
1255 * the absolute value of a negative msgtyp?
1256 * Note that the second half of this test can
1257 * NEVER be true if msgtyp is positive since
1258 * msg_type is always positive!
1261 if (msgtyp
== msghdr
->msg_type
||
1262 msghdr
->msg_type
<= -msgtyp
) {
1264 printf("found message type %ld, requested %ld\n",
1265 msghdr
->msg_type
, msgtyp
);
1267 if (msgsz
< msghdr
->msg_ts
&&
1268 (msgflg
& MSG_NOERROR
) == 0) {
1270 printf("requested message on the queue is too big (want %ld, got %d)\n",
1271 msgsz
, msghdr
->msg_ts
);
1277 eval
= mac_sysvmsq_check_msgrcv(
1278 kauth_cred_get(), msghdr
);
1283 *prev
= msghdr
->msg_next
;
1284 if (msghdr
== msqptr
->u
.msg_last
) {
1285 if (previous
== NULL
) {
1287 &msqptr
->u
.msg_first
) {
1288 panic("msg_first/last messed up #2");
1290 msqptr
->u
.msg_first
=
1292 msqptr
->u
.msg_last
=
1296 &msqptr
->u
.msg_first
) {
1297 panic("msg_first/last messed up #3");
1299 msqptr
->u
.msg_last
=
1306 prev
= &(msghdr
->msg_next
);
1311 * We've either extracted the msghdr for the appropriate
1312 * message or there isn't one.
1313 * If there is one then bail out of this loop.
1316 if (msghdr
!= NULL
) {
1321 * Hmph! No message found. Does the user want to wait?
1324 if ((msgflg
& IPC_NOWAIT
) != 0) {
1326 printf("no appropriate message found (msgtyp=%ld)\n",
1329 /* The SVID says to return ENOMSG. */
1333 /* Unfortunately, BSD doesn't define that code yet! */
1340 * Wait for something to happen
1344 printf("msgrcv: goodnight\n");
1346 eval
= msleep((caddr_t
)msqptr
, &sysv_msg_subsys_mutex
, (PZERO
- 4) | PCATCH
, "msgwait",
1349 printf("msgrcv: good morning (eval=%d)\n", eval
);
1354 printf("msgsnd: interrupted system call\n");
1361 * Make sure that the msq queue still exists
1364 if (msqptr
->u
.msg_qbytes
== 0 ||
1365 msqptr
->u
.msg_perm
._seq
!= IPCID_TO_SEQ(uap
->msqid
)) {
1367 printf("msqid deleted\n");
1369 /* The SVID says to return EIDRM. */
1373 /* Unfortunately, BSD doesn't define that code yet! */
1381 * Return the message to the user.
1383 * First, do the bookkeeping (before we risk being interrupted).
1386 msqptr
->u
.msg_cbytes
-= msghdr
->msg_ts
;
1387 msqptr
->u
.msg_qnum
--;
1388 msqptr
->u
.msg_lrpid
= p
->p_pid
;
1389 msqptr
->u
.msg_rtime
= sysv_msgtime();
1392 * Make msgsz the actual amount that we'll be returning.
1393 * Note that this effectively truncates the message if it is too long
1394 * (since msgsz is never increased).
1398 printf("found a message, msgsz=%ld, msg_ts=%d\n", msgsz
,
1401 if (msgsz
> msghdr
->msg_ts
) {
1402 msgsz
= msghdr
->msg_ts
;
1406 * Return the type to the user.
1410 * Copy out the message type. For a 64 bit process, this is 64 bits,
1411 * but we only ever use the low 32 bits, so the cast is OK.
1413 if (IS_64BIT_PROCESS(p
)) {
1414 msgtype
= msghdr
->msg_type
;
1415 SYSV_MSG_SUBSYS_UNLOCK();
1416 eval
= copyout(&msgtype
, user_msgp
, sizeof(msgtype
));
1417 SYSV_MSG_SUBSYS_LOCK();
1418 user_msgp
= user_msgp
+ sizeof(msgtype
); /* ptr math */
1420 msg_type32
= msghdr
->msg_type
;
1421 SYSV_MSG_SUBSYS_UNLOCK();
1422 eval
= copyout(&msg_type32
, user_msgp
, sizeof(msg_type32
));
1423 SYSV_MSG_SUBSYS_LOCK();
1424 user_msgp
= user_msgp
+ sizeof(msg_type32
); /* ptr math */
1429 printf("error (%d) copying out message type\n", eval
);
1431 msg_freehdr(msghdr
);
1432 wakeup((caddr_t
)msqptr
);
1439 * Return the segments to the user
1442 next
= msghdr
->msg_spot
;
1443 for (len
= 0; len
< msgsz
; len
+= msginfo
.msgssz
) {
1447 * copy the full segment, or less if we're at the end
1450 tlen
= MIN(msgsz
- len
, (size_t)msginfo
.msgssz
);
1452 panic("next too low #3");
1454 if (next
>= msginfo
.msgseg
) {
1455 panic("next out of range #3");
1457 SYSV_MSG_SUBSYS_UNLOCK();
1458 eval
= copyout(&msgpool
[next
* msginfo
.msgssz
],
1460 SYSV_MSG_SUBSYS_LOCK();
1463 printf("error (%d) copying out message segment\n",
1466 msg_freehdr(msghdr
);
1467 wakeup((caddr_t
)msqptr
);
1470 user_msgp
= user_msgp
+ tlen
; /* ptr math */
1471 next
= msgmaps
[next
].next
;
1475 * Done, return the actual number of bytes copied out.
1478 msg_freehdr(msghdr
);
1479 wakeup((caddr_t
)msqptr
);
1483 SYSV_MSG_SUBSYS_UNLOCK();
1488 IPCS_msg_sysctl(__unused
struct sysctl_oid
*oidp
, __unused
void *arg1
,
1489 __unused
int arg2
, struct sysctl_req
*req
)
1494 struct user32_IPCS_command u32
;
1495 struct user_IPCS_command u64
;
1497 struct user32_msqid_ds msqid_ds32
= {}; /* post conversion, 32 bit version */
1498 struct user64_msqid_ds msqid_ds64
= {}; /* post conversion, 64 bit version */
1502 struct proc
*p
= current_proc();
1504 if (IS_64BIT_PROCESS(p
)) {
1505 ipcs_sz
= sizeof(struct user_IPCS_command
);
1506 msqid_ds_sz
= sizeof(struct user64_msqid_ds
);
1508 ipcs_sz
= sizeof(struct user32_IPCS_command
);
1509 msqid_ds_sz
= sizeof(struct user32_msqid_ds
);
1512 /* Copy in the command structure */
1513 if ((error
= SYSCTL_IN(req
, &ipcs
, ipcs_sz
)) != 0) {
1517 if (!IS_64BIT_PROCESS(p
)) { /* convert in place */
1518 ipcs
.u64
.ipcs_data
= CAST_USER_ADDR_T(ipcs
.u32
.ipcs_data
);
1521 /* Let us version this interface... */
1522 if (ipcs
.u64
.ipcs_magic
!= IPCS_MAGIC
) {
1526 SYSV_MSG_SUBSYS_LOCK();
1528 switch (ipcs
.u64
.ipcs_op
) {
1529 case IPCS_MSG_CONF
: /* Obtain global configuration data */
1530 if (ipcs
.u64
.ipcs_datalen
!= sizeof(struct msginfo
)) {
1534 if (ipcs
.u64
.ipcs_cursor
!= 0) { /* fwd. compat. */
1538 SYSV_MSG_SUBSYS_UNLOCK();
1539 error
= copyout(&msginfo
, ipcs
.u64
.ipcs_data
, ipcs
.u64
.ipcs_datalen
);
1540 SYSV_MSG_SUBSYS_LOCK();
1543 case IPCS_MSG_ITER
: /* Iterate over existing segments */
1544 /* Not done up top so we can set limits via sysctl (later) */
1550 cursor
= ipcs
.u64
.ipcs_cursor
;
1551 if (cursor
< 0 || cursor
>= msginfo
.msgmni
) {
1555 if (ipcs
.u64
.ipcs_datalen
!= (int)msqid_ds_sz
) {
1559 for (; cursor
< msginfo
.msgmni
; cursor
++) {
1560 if (msqids
[cursor
].u
.msg_qbytes
!= 0) { /* allocated */
1565 if (cursor
== msginfo
.msgmni
) {
1570 msqid_dsp
= &msqids
[cursor
]; /* default: 64 bit */
1573 * If necessary, convert the 64 bit kernel segment
1574 * descriptor to a 32 bit user one.
1576 if (IS_64BIT_PROCESS(p
)) {
1577 msqid_ds_kerneltouser64(msqid_dsp
, &msqid_ds64
);
1578 msqid_dsp
= &msqid_ds64
;
1580 msqid_ds_kerneltouser32(msqid_dsp
, &msqid_ds32
);
1581 msqid_dsp
= &msqid_ds32
;
1584 SYSV_MSG_SUBSYS_UNLOCK();
1585 error
= copyout(msqid_dsp
, ipcs
.u64
.ipcs_data
, ipcs
.u64
.ipcs_datalen
);
1588 ipcs
.u64
.ipcs_cursor
= cursor
+ 1;
1590 if (!IS_64BIT_PROCESS(p
)) { /* convert in place */
1591 ipcs
.u32
.ipcs_data
= CAST_DOWN_EXPLICIT(user32_addr_t
, ipcs
.u64
.ipcs_data
);
1593 error
= SYSCTL_OUT(req
, &ipcs
, ipcs_sz
);
1595 SYSV_MSG_SUBSYS_LOCK();
1603 SYSV_MSG_SUBSYS_UNLOCK();
1607 SYSCTL_DECL(_kern_sysv_ipcs
);
1608 SYSCTL_PROC(_kern_sysv_ipcs
, OID_AUTO
, msg
, CTLFLAG_RW
| CTLFLAG_ANYBODY
| CTLFLAG_LOCKED
,
1609 0, 0, IPCS_msg_sysctl
,
1610 "S,IPCS_msg_command",
1611 "ipcs msg command interface");
1613 #endif /* SYSV_MSG */