/*

 * CDDL HEADER START

 *

 * The contents of this file are subject to the terms of the

 * Common Development and Distribution License, Version 1.0 only

 * (the "License").  You may not use this file except in compliance

 * with the License.

 *

 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE

 * or http://www.opensolaris.org/os/licensing.

 * See the License for the specific language governing permissions

 * and limitations under the License.

 *

 * When distributing Covered Code, include this CDDL HEADER in each

 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.

 * If applicable, add the following below this CDDL HEADER, with the

 * fields enclosed by brackets "[]" replaced with your own identifying

 * information: Portions Copyright [yyyy] [name of copyright owner]

 *

 * CDDL HEADER END

 */

/*

 * Copyright 2004 Sun Microsystems, Inc.  All rights reserved.

 * Use is subject to license terms.

 */

/*	Copyright (c) 1984, 1986, 1987, 1988, 1989 AT&T	*/

/*	  All Rights Reserved  	*/

#pragma ident	"%Z%%M%	%I%	%E% SMI"

/*

 * Inter-Process Communication Message Facility.

 *

 * See os/ipc.c for a description of common IPC functionality.

 *

 * Resource controls

 * -----------------

 *

 * Control:      project.max-msg-ids (rc_project_msgmni)

 * Description:  Maximum number of message queue ids allowed a project.

 *

 *   When msgget() is used to allocate a message queue, one id is

 *   allocated.  If the id allocation doesn't succeed, msgget() fails

 *   and errno is set to ENOSPC.  Upon successful msgctl(, IPC_RMID)

 *   the id is deallocated.

 *

 * Control:      process.max-msg-qbytes (rc_process_msgmnb)

 * Description:  Maximum number of bytes of messages on a message queue.

 *

 *   When msgget() successfully allocates a message queue, the minimum

 *   enforced value of this limit is used to initialize msg_qbytes.

 *

 * Control:      process.max-msg-messages (rc_process_msgtql)

 * Description:  Maximum number of messages on a message queue.

 *

 *   When msgget() successfully allocates a message queue, the minimum

 *   enforced value of this limit is used to initialize a per-queue

 *   limit on the number of messages.

 */

#include <sys/types.h>

#include <sys/t_lock.h>

#include <sys/param.h>

#include <sys/cred.h>

#include <sys/user.h>

#include <sys/proc.h>

#include <sys/time.h>

#include <sys/ipc.h>

#include <sys/ipc_impl.h>

#include <sys/msg.h>

#include <sys/msg_impl.h>

#include <sys/list.h>

#include <sys/systm.h>

#include <sys/sysmacros.h>

#include <sys/cpuvar.h>

#include <sys/kmem.h>

#include <sys/ddi.h>

#include <sys/errno.h>

#include <sys/cmn_err.h>

#include <sys/debug.h>

#include <sys/project.h>

#include <sys/modctl.h>

#include <sys/syscall.h>

#include <sys/policy.h>

#include <sys/zone.h>

#include <c2/audit.h>

/*

 * The following tunables are obsolete.  Though for compatibility we

 * still read and interpret msginfo_msgmnb, msginfo_msgmni, and

 * msginfo_msgtql (see os/project.c and os/rctl_proc.c), the preferred

 * mechanism for administrating the IPC Message facility is through the

 * resource controls described at the top of this file.

 */

size_t	msginfo_msgmax = 2048;	/* (obsolete) */

size_t	msginfo_msgmnb = 4096;	/* (obsolete) */

int	msginfo_msgmni = 50;	/* (obsolete) */

int	msginfo_msgtql = 40;	/* (obsolete) */

int	msginfo_msgssz = 8;	/* (obsolete) */

int	msginfo_msgmap = 0;	/* (obsolete) */

ushort_t msginfo_msgseg = 1024;	/* (obsolete) */

extern rctl_hndl_t rc_project_msgmni;

extern rctl_hndl_t rc_process_msgmnb;

extern rctl_hndl_t rc_process_msgtql;

static ipc_service_t *msq_svc;

static zone_key_t msg_zone_key;

static void msg_dtor(kipc_perm_t *);

static void msg_rmid(kipc_perm_t *);

static void msg_remove_zone(zoneid_t, void *);

/*

 * Module linkage information for the kernel.

 */

static ssize_t msgsys(int opcode, uintptr_t a0, uintptr_t a1, uintptr_t a2,

	uintptr_t a4, uintptr_t a5);

static struct sysent ipcmsg_sysent = {

	6,

#ifdef	_LP64

	SE_ARGC | SE_NOUNLOAD | SE_64RVAL,

#else

	SE_ARGC | SE_NOUNLOAD | SE_32RVAL1,

#endif

	(int (*)())msgsys

};

#ifdef	_SYSCALL32_IMPL

static ssize32_t msgsys32(int opcode, uint32_t a0, uint32_t a1, uint32_t a2,

	uint32_t a4, uint32_t a5);

static struct sysent ipcmsg_sysent32 = {

	6,

	SE_ARGC | SE_NOUNLOAD | SE_32RVAL1,

	(int (*)())msgsys32

};

#endif	/* _SYSCALL32_IMPL */

static struct modlsys modlsys = {

	&mod_syscallops, "System V message facility", &ipcmsg_sysent

};

#ifdef _SYSCALL32_IMPL

static struct modlsys modlsys32 = {

	&mod_syscallops32, "32-bit System V message facility", &ipcmsg_sysent32

};

#endif

static struct modlinkage modlinkage = {

	MODREV_1,

	&modlsys,

#ifdef _SYSCALL32_IMPL

	&modlsys32,

#endif

	NULL

};

int

_init(void)

{

	int result;

	msq_svc = ipcs_create("msqids", rc_project_msgmni, sizeof (kmsqid_t),

	    msg_dtor, msg_rmid, AT_IPC_MSG,

	    offsetof(kproject_data_t, kpd_msgmni));

	zone_key_create(&msg_zone_key, NULL, msg_remove_zone, NULL);

	if ((result = mod_install(&modlinkage)) == 0)

		return (0);

	(void) zone_key_delete(msg_zone_key);

	ipcs_destroy(msq_svc);

	return (result);

}

int

_fini(void)

{

	return (EBUSY);

}

int

_info(struct modinfo *modinfop)

{

	return (mod_info(&modlinkage, modinfop));

}

static void

msg_dtor(kipc_perm_t *perm)

{

	kmsqid_t *qp = (kmsqid_t *)perm;

	ASSERT(qp->msg_rcv_cnt == 0);

	ASSERT(qp->msg_snd_cnt == 0);

	ASSERT(qp->msg_cbytes == 0);

	list_destroy(&qp->msg_list);

}

#define	msg_hold(mp)	(mp)->msg_copycnt++

/*

 * msg_rele - decrement the reference count on the message.  When count

 * reaches zero, free message header and contents.

 */

static void

msg_rele(struct msg *mp)

{

	ASSERT(mp->msg_copycnt > 0);

	if (mp->msg_copycnt-- == 1) {

		if (mp->msg_addr)

			kmem_free(mp->msg_addr, mp->msg_size);

		kmem_free(mp, sizeof (struct msg));

	}

}

/*

 * msgunlink - Unlink msg from queue, decrement byte count and wake up anyone

 * waiting for free bytes on queue.

 *

 * Called with queue locked.

 */

static void

msgunlink(kmsqid_t *qp, struct msg *mp)

{

	list_remove(&qp->msg_list, mp);

	qp->msg_qnum--;

	qp->msg_cbytes -= mp->msg_size;

	msg_rele(mp);

	/* Wake up waiting writers */

	if (qp->msg_snd_cnt)

		cv_broadcast(&qp->msg_snd_cv);

}

static void

msg_rmid(kipc_perm_t *perm)

{

	kmsqid_t *qp = (kmsqid_t *)perm;

	struct msg *mp;

	while ((mp = list_head(&qp->msg_list)) != NULL)

		msgunlink(qp, mp);

	ASSERT(qp->msg_cbytes == 0);

	if (qp->msg_rcv_cnt)

		cv_broadcast(&qp->msg_rcv_cv);

	if (qp->msg_snd_cnt)

		cv_broadcast(&qp->msg_snd_cv);

}

/*

 * msgctl system call.

 *

 * gets q lock (via ipc_lookup), releases before return.

 * may call users of msg_lock

 */

static int

msgctl(int msgid, int cmd, void *arg)

{

	STRUCT_DECL(msqid_ds, ds);		/* SVR4 queue work area */

	kmsqid_t		*qp;		/* ptr to associated q */

	int			error;

	struct	cred		*cr;

	model_t	mdl = get_udatamodel();

	struct msqid_ds64	ds64;

	kmutex_t		*lock;

	proc_t			*pp = curproc;

	STRUCT_INIT(ds, mdl);

	cr = CRED();

	/*

	 * Perform pre- or non-lookup actions (e.g. copyins, RMID).

	 */

	switch (cmd) {

	case IPC_SET:

		if (copyin(arg, STRUCT_BUF(ds), STRUCT_SIZE(ds)))

			return (set_errno(EFAULT));

		break;

	case IPC_SET64:

		if (copyin(arg, &ds64, sizeof (struct msqid_ds64)))

			return (set_errno(EFAULT));

		break;

	case IPC_RMID:

		if (error = ipc_rmid(msq_svc, msgid, cr))

			return (set_errno(error));

		return (0);

	}

	/*

	 * get msqid_ds for this msgid

	 */

	if ((lock = ipc_lookup(msq_svc, msgid, (kipc_perm_t **)&qp)) == NULL)

		return (set_errno(EINVAL));

	switch (cmd) {

	case IPC_SET:

		if (STRUCT_FGET(ds, msg_qbytes) > qp->msg_qbytes &&

		    secpolicy_ipc_config(cr) != 0) {

			mutex_exit(lock);

			return (set_errno(EPERM));

		}

		if (error = ipcperm_set(msq_svc, cr, &qp->msg_perm,

		    &STRUCT_BUF(ds)->msg_perm, mdl)) {

			mutex_exit(lock);

			return (set_errno(error));

		}

		qp->msg_qbytes = STRUCT_FGET(ds, msg_qbytes);

		qp->msg_ctime = gethrestime_sec();

		break;

	case IPC_STAT:

		if (error = ipcperm_access(&qp->msg_perm, MSG_R, cr)) {

			mutex_exit(lock);

			return (set_errno(error));

		}

		if (qp->msg_rcv_cnt)

			qp->msg_perm.ipc_mode |= MSG_RWAIT;

		if (qp->msg_snd_cnt)

			qp->msg_perm.ipc_mode |= MSG_WWAIT;

		ipcperm_stat(&STRUCT_BUF(ds)->msg_perm, &qp->msg_perm, mdl);

		qp->msg_perm.ipc_mode &= ~(MSG_RWAIT|MSG_WWAIT);

		STRUCT_FSETP(ds, msg_first, NULL); 	/* kernel addr */

		STRUCT_FSETP(ds, msg_last, NULL);

		STRUCT_FSET(ds, msg_cbytes, qp->msg_cbytes);

		STRUCT_FSET(ds, msg_qnum, qp->msg_qnum);

		STRUCT_FSET(ds, msg_qbytes, qp->msg_qbytes);

		STRUCT_FSET(ds, msg_lspid, qp->msg_lspid);

		STRUCT_FSET(ds, msg_lrpid, qp->msg_lrpid);

		STRUCT_FSET(ds, msg_stime, qp->msg_stime);

		STRUCT_FSET(ds, msg_rtime, qp->msg_rtime);

		STRUCT_FSET(ds, msg_ctime, qp->msg_ctime);

		break;

	case IPC_SET64:

		mutex_enter(&pp->p_lock);

		if ((ds64.msgx_qbytes > qp->msg_qbytes) &&

		    secpolicy_ipc_config(cr) != 0 &&

		    rctl_test(rc_process_msgmnb, pp->p_rctls, pp,

		    ds64.msgx_qbytes, RCA_SAFE) & RCT_DENY) {

			mutex_exit(&pp->p_lock);

			mutex_exit(lock);

			return (set_errno(EPERM));

		}

		mutex_exit(&pp->p_lock);

		if (error = ipcperm_set64(msq_svc, cr, &qp->msg_perm,

		    &ds64.msgx_perm)) {

			mutex_exit(lock);

			return (set_errno(error));

		}

		qp->msg_qbytes = ds64.msgx_qbytes;

		qp->msg_ctime = gethrestime_sec();

		break;

	case IPC_STAT64:

		if (qp->msg_rcv_cnt)

			qp->msg_perm.ipc_mode |= MSG_RWAIT;

		if (qp->msg_snd_cnt)

			qp->msg_perm.ipc_mode |= MSG_WWAIT;

		ipcperm_stat64(&ds64.msgx_perm, &qp->msg_perm);

		qp->msg_perm.ipc_mode &= ~(MSG_RWAIT|MSG_WWAIT);

		ds64.msgx_cbytes = qp->msg_cbytes;

		ds64.msgx_qnum = qp->msg_qnum;

		ds64.msgx_qbytes = qp->msg_qbytes;

		ds64.msgx_lspid = qp->msg_lspid;

		ds64.msgx_lrpid = qp->msg_lrpid;

		ds64.msgx_stime = qp->msg_stime;

		ds64.msgx_rtime = qp->msg_rtime;

		ds64.msgx_ctime = qp->msg_ctime;

		break;

	default:

		mutex_exit(lock);

		return (set_errno(EINVAL));

	}

	mutex_exit(lock);

	/*

	 * Do copyout last (after releasing mutex).

	 */

	switch (cmd) {

	case IPC_STAT:

		if (copyout(STRUCT_BUF(ds), arg, STRUCT_SIZE(ds)))

			return (set_errno(EFAULT));

		break;

	case IPC_STAT64:

		if (copyout(&ds64, arg, sizeof (struct msqid_ds64)))

			return (set_errno(EFAULT));

		break;

	}

	return (0);

}

/*

 * Remove all message queues associated with a given zone.  Called by

 * zone_shutdown when the zone is halted.

 */

/*ARGSUSED1*/

static void

msg_remove_zone(zoneid_t zoneid, void *arg)

{

	ipc_remove_zone(msq_svc, zoneid);

}

/*

 * msgget system call.

 */

static int

msgget(key_t key, int msgflg)

{

	kmsqid_t	*qp;

	kmutex_t	*lock;

	int		id, error;

	proc_t		*pp = curproc;

top:

	if (error = ipc_get(msq_svc, key, msgflg, (kipc_perm_t **)&qp, &lock))

		return (set_errno(error));

	if (IPC_FREE(&qp->msg_perm)) {

		mutex_exit(lock);

		mutex_exit(&pp->p_lock);

		list_create(&qp->msg_list, sizeof (struct msg),

		    offsetof(struct msg, msg_node));

		qp->msg_qnum = 0;

		qp->msg_lspid = qp->msg_lrpid = 0;

		qp->msg_stime = qp->msg_rtime = 0;

		qp->msg_ctime = gethrestime_sec();

		qp->msg_rcv_cnt = qp->msg_snd_cnt = 0;

		if (error = ipc_commit_begin(msq_svc, key, msgflg,

		    (kipc_perm_t *)qp)) {

			if (error == EAGAIN)

				goto top;

			return (set_errno(error));

		}

		qp->msg_qbytes = rctl_enforced_value(rc_process_msgmnb,

		    pp->p_rctls, pp);

		qp->msg_qmax = rctl_enforced_value(rc_process_msgtql,

		    pp->p_rctls, pp);

		lock = ipc_commit_end(msq_svc, &qp->msg_perm);

	}

#ifdef C2_AUDIT

	if (audit_active)

		audit_ipcget(AT_IPC_MSG, (void *)qp);

#endif

	id = qp->msg_perm.ipc_id;

	mutex_exit(lock);

	return (id);

}

/*

 * msgrcv system call.

 */

static ssize_t

msgrcv(int msqid, struct ipcmsgbuf *msgp, size_t msgsz, long msgtyp, int msgflg)

{

	struct msg	*mp;	/* ptr to msg on q */

	struct msg	*smp;	/* ptr to best msg on q */

	kmsqid_t	*qp;	/* ptr to associated q */

	kmutex_t	*lock;

	size_t		xtsz;	/* transfer byte count */

	int		error = 0, copyerror = 0;

	int		cvres;

	STRUCT_HANDLE(ipcmsgbuf, umsgp);

	model_t		mdl = get_udatamodel();

	CPU_STATS_ADDQ(CPU, sys, msg, 1);	/* bump msg send/rcv count */

	STRUCT_SET_HANDLE(umsgp, mdl, msgp);

	if ((lock = ipc_lookup(msq_svc, msqid, (kipc_perm_t **)&qp)) == NULL)

		return ((ssize_t)set_errno(EINVAL));

	ipc_hold(msq_svc, (kipc_perm_t *)qp);

	if (error = ipcperm_access(&qp->msg_perm, MSG_R, CRED()))

		goto msgrcv_out;

findmsg:

	smp = NULL;

	mp = list_head(&qp->msg_list);

	if (msgtyp == 0) {

		smp = mp;

	} else {

		for (; mp; mp = list_next(&qp->msg_list, mp)) {

			if (msgtyp > 0) {

				if (msgtyp != mp->msg_type)

					continue;

				smp = mp;

				break;

			}

			if (mp->msg_type <= -msgtyp) {

				if (smp && smp->msg_type <= mp->msg_type)

					continue;

				smp = mp;

			}

		}

	}

	if (smp) {

		/*

		 * Message found.

		 */

		if ((smp->msg_flags & MSG_RCVCOPY) == 0) {

			/*

			 * No one else is copying this message. Copy it.

			 */

			if (msgsz < smp->msg_size) {

				if ((msgflg & MSG_NOERROR) == 0) {

					error = E2BIG;

					goto msgrcv_out;

				} else {

					xtsz = msgsz;

				}