318 	struct msqid_kernel *msqkptr;  in msgunload()  local
330 		msqkptr = &msqids[msqid];  in msgunload()
331 		if (msqkptr->u.msg_qbytes != 0 ||  in msgunload()
332 		    (msqkptr->u.msg_perm.mode & MSG_LOCKED) != 0)  in msgunload()
413 msq_remove(struct msqid_kernel *msqkptr)  in msq_remove()  argument
417 	racct_sub_cred(msqkptr->cred, RACCT_NMSGQ, 1);  in msq_remove()
418 	racct_sub_cred(msqkptr->cred, RACCT_MSGQQUEUED, msqkptr->u.msg_qnum);  in msq_remove()
419 	racct_sub_cred(msqkptr->cred, RACCT_MSGQSIZE, msqkptr->u.msg_cbytes);  in msq_remove()
420 	crfree(msqkptr->cred);  in msq_remove()
421 	msqkptr->cred = NULL;  in msq_remove()
424 	msghdr = msqkptr->u.__msg_first;  in msq_remove()
429 		msqkptr->u.msg_cbytes -= msghdr->msg_ts;  in msq_remove()
430 		msqkptr->u.msg_qnum--;  in msq_remove()
436 	if (msqkptr->u.msg_cbytes != 0)  in msq_remove()
438 	if (msqkptr->u.msg_qnum != 0)  in msq_remove()
441 	msqkptr->u.msg_qbytes = 0;	/* Mark it as free */  in msq_remove()
444 	mac_sysvmsq_cleanup(msqkptr);  in msq_remove()
447 	wakeup(msqkptr);  in msq_remove()
463 msq_prison_cansee(struct prison *rpr, struct msqid_kernel *msqkptr)  in msq_prison_cansee()  argument
466 	if (msqkptr->cred == NULL ||  in msq_prison_cansee()
467 	    !(rpr == msqkptr->cred->cr_prison ||  in msq_prison_cansee()
468 	      prison_ischild(rpr, msqkptr->cred->cr_prison)))  in msq_prison_cansee()
502 	struct msqid_kernel *msqkptr;  in kern_msgctl()  local
519 	msqkptr = &msqids[msqix];  in kern_msgctl()
522 	if (msqkptr->u.msg_qbytes == 0) {  in kern_msgctl()
527 	if (msqkptr->u.msg_perm.seq != IPCID_TO_SEQ(msqid)) {  in kern_msgctl()
533 	error = msq_prison_cansee(rpr, msqkptr);  in kern_msgctl()
540 	error = mac_sysvmsq_check_msqctl(td->td_ucred, msqkptr, cmd);  in kern_msgctl()
554 		if ((error = ipcperm(td, &msqkptr->u.msg_perm, IPC_M)))  in kern_msgctl()
567 		for (msghdr = msqkptr->u.__msg_first; msghdr != NULL;  in kern_msgctl()
575 		msq_remove(msqkptr);  in kern_msgctl()
582 		if ((error = ipcperm(td, &msqkptr->u.msg_perm, IPC_M)))  in kern_msgctl()
584 		if (msqbuf->msg_qbytes > msqkptr->u.msg_qbytes) {  in kern_msgctl()
599 		msqkptr->u.msg_perm.uid = msqbuf->msg_perm.uid;	/* change the owner */  in kern_msgctl()
600 		msqkptr->u.msg_perm.gid = msqbuf->msg_perm.gid;	/* change the owner */  in kern_msgctl()
601 		msqkptr->u.msg_perm.mode = (msqkptr->u.msg_perm.mode & ~0777) |  in kern_msgctl()
603 		msqkptr->u.msg_qbytes = msqbuf->msg_qbytes;  in kern_msgctl()
604 		msqkptr->u.msg_ctime = time_second;  in kern_msgctl()
608 		if ((error = ipcperm(td, &msqkptr->u.msg_perm, IPC_R))) {  in kern_msgctl()
612 		*msqbuf = msqkptr->u;  in kern_msgctl()
613 		if (td->td_ucred->cr_prison != msqkptr->cred->cr_prison)  in kern_msgctl()
651 	struct msqid_kernel *msqkptr = NULL;  in sys_msgget()  local
661 			msqkptr = &msqids[msqid];  in sys_msgget()
662 			if (msqkptr->u.msg_qbytes != 0 &&  in sys_msgget()
663 			    msqkptr->cred != NULL &&  in sys_msgget()
664 			    msqkptr->cred->cr_prison == cred->cr_prison &&  in sys_msgget()
665 			    msqkptr->u.msg_perm.key == key)  in sys_msgget()
676 			    msqkptr->u.msg_perm));  in sys_msgget()
677 			if ((error = ipcperm(td, &msqkptr->u.msg_perm,  in sys_msgget()
684 			error = mac_sysvmsq_check_msqget(cred, msqkptr);  in sys_msgget()
701 			msqkptr = &msqids[msqid];  in sys_msgget()
702 			if (msqkptr->u.msg_qbytes == 0 &&  in sys_msgget()
703 			    (msqkptr->u.msg_perm.mode & MSG_LOCKED) == 0)  in sys_msgget()
723 		msqkptr->u.msg_perm.key = key;  in sys_msgget()
724 		msqkptr->u.msg_perm.cuid = cred->cr_uid;  in sys_msgget()
725 		msqkptr->u.msg_perm.uid = cred->cr_uid;  in sys_msgget()
726 		msqkptr->u.msg_perm.cgid = cred->cr_gid;  in sys_msgget()
727 		msqkptr->u.msg_perm.gid = cred->cr_gid;  in sys_msgget()
728 		msqkptr->u.msg_perm.mode = (msgflg & 0777);  in sys_msgget()
729 		msqkptr->cred = crhold(cred);  in sys_msgget()
731 		msqkptr->u.msg_perm.seq = (msqkptr->u.msg_perm.seq + 1) & 0x7fff;  in sys_msgget()
732 		msqkptr->u.__msg_first = NULL;  in sys_msgget()
733 		msqkptr->u.__msg_last = NULL;  in sys_msgget()
734 		msqkptr->u.msg_cbytes = 0;  in sys_msgget()
735 		msqkptr->u.msg_qnum = 0;  in sys_msgget()
736 		msqkptr->u.msg_qbytes = msginfo.msgmnb;  in sys_msgget()
737 		msqkptr->u.msg_lspid = 0;  in sys_msgget()
738 		msqkptr->u.msg_lrpid = 0;  in sys_msgget()
739 		msqkptr->u.msg_stime = 0;  in sys_msgget()
740 		msqkptr->u.msg_rtime = 0;  in sys_msgget()
741 		msqkptr->u.msg_ctime = time_second;  in sys_msgget()
743 		mac_sysvmsq_create(cred, msqkptr);  in sys_msgget()
745 		AUDIT_ARG_SVIPC_PERM(&msqkptr->u.msg_perm);  in sys_msgget()
754 	td->td_retval[0] = IXSEQ_TO_IPCID(msqid, msqkptr->u.msg_perm);  in sys_msgget()
773 	struct msqid_kernel *msqkptr;  in kern_msgsnd()  local
796 	msqkptr = &msqids[msqix];  in kern_msgsnd()
797 	AUDIT_ARG_SVIPC_PERM(&msqkptr->u.msg_perm);  in kern_msgsnd()
798 	if (msqkptr->u.msg_qbytes == 0) {  in kern_msgsnd()
803 	if (msqkptr->u.msg_perm.seq != IPCID_TO_SEQ(msqid)) {  in kern_msgsnd()
809 	if ((error = msq_prison_cansee(rpr, msqkptr))) {  in kern_msgsnd()
814 	if ((error = ipcperm(td, &msqkptr->u.msg_perm, IPC_W))) {  in kern_msgsnd()
820 	error = mac_sysvmsq_check_msqsnd(td->td_ucred, msqkptr);  in kern_msgsnd()
855 		if (msgsz > msqkptr->u.msg_qbytes) {  in kern_msgsnd()
861 		if (msqkptr->u.msg_perm.mode & MSG_LOCKED) {  in kern_msgsnd()
865 		if (msgsz + msqkptr->u.msg_cbytes > msqkptr->u.msg_qbytes) {  in kern_msgsnd()
888 			if ((msqkptr->u.msg_perm.mode & MSG_LOCKED) != 0) {  in kern_msgsnd()
895 				msqkptr->u.msg_perm.mode |= MSG_LOCKED;  in kern_msgsnd()
899 			error = msleep(msqkptr, &msq_mtx, (PZERO - 4) | PCATCH,  in kern_msgsnd()
903 				msqkptr->u.msg_perm.mode &= ~MSG_LOCKED;  in kern_msgsnd()
918 			if (msqkptr->u.msg_qbytes == 0) {  in kern_msgsnd()
935 	if (msqkptr->u.msg_perm.mode & MSG_LOCKED)  in kern_msgsnd()
939 	if (msgsz + msqkptr->u.msg_cbytes > msqkptr->u.msg_qbytes)  in kern_msgsnd()
949 	if ((msqkptr->u.msg_perm.mode & MSG_LOCKED) != 0)  in kern_msgsnd()
951 	msqkptr->u.msg_perm.mode |= MSG_LOCKED;  in kern_msgsnd()
968 	mac_sysvmsg_create(td->td_ucred, msqkptr, msghdr);  in kern_msgsnd()
999 		msqkptr->u.msg_perm.mode &= ~MSG_LOCKED;  in kern_msgsnd()
1000 		wakeup(msqkptr);  in kern_msgsnd()
1028 			msqkptr->u.msg_perm.mode &= ~MSG_LOCKED;  in kern_msgsnd()
1029 			wakeup(msqkptr);  in kern_msgsnd()
1044 	msqkptr->u.msg_perm.mode &= ~MSG_LOCKED;  in kern_msgsnd()
1050 	if (msqkptr->u.msg_qbytes == 0) {  in kern_msgsnd()
1052 		wakeup(msqkptr);  in kern_msgsnd()
1069 	error = mac_sysvmsq_check_msgmsq(td->td_ucred, msghdr, msqkptr);  in kern_msgsnd()
1072 		wakeup(msqkptr);  in kern_msgsnd()
1080 	if (msqkptr->u.__msg_first == NULL) {  in kern_msgsnd()
1081 		msqkptr->u.__msg_first = msghdr;  in kern_msgsnd()
1082 		msqkptr->u.__msg_last = msghdr;  in kern_msgsnd()
1084 		msqkptr->u.__msg_last->msg_next = msghdr;  in kern_msgsnd()
1085 		msqkptr->u.__msg_last = msghdr;  in kern_msgsnd()
1087 	msqkptr->u.__msg_last->msg_next = NULL;  in kern_msgsnd()
1089 	msqkptr->u.msg_cbytes += msghdr->msg_ts;  in kern_msgsnd()
1090 	msqkptr->u.msg_qnum++;  in kern_msgsnd()
1091 	msqkptr->u.msg_lspid = td->td_proc->p_pid;  in kern_msgsnd()
1092 	msqkptr->u.msg_stime = time_second;  in kern_msgsnd()
1094 	wakeup(msqkptr);  in kern_msgsnd()
1143 	struct msqid_kernel *msqkptr;  in kern_msgrcv()  local
1162 	msqkptr = &msqids[msqix];  in kern_msgrcv()
1164 	AUDIT_ARG_SVIPC_PERM(&msqkptr->u.msg_perm);  in kern_msgrcv()
1165 	if (msqkptr->u.msg_qbytes == 0) {  in kern_msgrcv()
1170 	if (msqkptr->u.msg_perm.seq != IPCID_TO_SEQ(msqid)) {  in kern_msgrcv()
1176 	if ((error = msq_prison_cansee(rpr, msqkptr))) {  in kern_msgrcv()
1181 	if ((error = ipcperm(td, &msqkptr->u.msg_perm, IPC_R))) {  in kern_msgrcv()
1187 	error = mac_sysvmsq_check_msqrcv(td->td_ucred, msqkptr);  in kern_msgrcv()
1195 			msghdr = msqkptr->u.__msg_first;  in kern_msgrcv()
1211 				if (msqkptr->u.__msg_first ==  in kern_msgrcv()
1212 				    msqkptr->u.__msg_last) {  in kern_msgrcv()
1213 					msqkptr->u.__msg_first = NULL;  in kern_msgrcv()
1214 					msqkptr->u.__msg_last = NULL;  in kern_msgrcv()
1216 					msqkptr->u.__msg_first = msghdr->msg_next;  in kern_msgrcv()
1217 					if (msqkptr->u.__msg_first == NULL)  in kern_msgrcv()
1226 			prev = &(msqkptr->u.__msg_first);  in kern_msgrcv()
1258 					if (msghdr == msqkptr->u.__msg_last) {  in kern_msgrcv()
1261 							    &msqkptr->u.__msg_first)  in kern_msgrcv()
1263 							msqkptr->u.__msg_first =  in kern_msgrcv()
1265 							msqkptr->u.__msg_last =  in kern_msgrcv()
1269 							    &msqkptr->u.__msg_first)  in kern_msgrcv()
1271 							msqkptr->u.__msg_last =  in kern_msgrcv()
1308 		error = msleep(msqkptr, &msq_mtx, (PZERO - 4) | PCATCH,  in kern_msgrcv()
1322 		if (msqkptr->u.msg_qbytes == 0 ||  in kern_msgrcv()
1323 		    msqkptr->u.msg_perm.seq != IPCID_TO_SEQ(msqid)) {  in kern_msgrcv()
1336 	msqkptr->u.msg_cbytes -= msghdr->msg_ts;  in kern_msgrcv()
1337 	msqkptr->u.msg_qnum--;  in kern_msgrcv()
1338 	msqkptr->u.msg_lrpid = td->td_proc->p_pid;  in kern_msgrcv()
1339 	msqkptr->u.msg_rtime = time_second;  in kern_msgrcv()
1341 	racct_sub_cred(msqkptr->cred, RACCT_MSGQQUEUED, 1);  in kern_msgrcv()
1342 	racct_sub_cred(msqkptr->cred, RACCT_MSGQSIZE, msghdr->msg_ts);  in kern_msgrcv()
1379 			wakeup(msqkptr);  in kern_msgrcv()
1391 	wakeup(msqkptr);  in kern_msgrcv()
1658 	struct msqid_kernel *msqkptr;  in msg_prison_cleanup()  local
1664 		msqkptr = &msqids[i];  in msg_prison_cleanup()
1665 		if (msqkptr->u.msg_qbytes != 0 &&  in msg_prison_cleanup()
1666 		    msqkptr->cred != NULL && msqkptr->cred->cr_prison == pr)  in msg_prison_cleanup()
1667 			msq_remove(msqkptr);  in msg_prison_cleanup()