/*
       * linux/ipc/msg.c
       * Copyright (C) 1992 Krishna Balasubramanian 
       *
       * Removed all the remaining kerneld mess
       * Catch the -EFAULT stuff properly
       * Use GFP_KERNEL for messages as in 1.2
       * Fixed up the unchecked user space derefs
       * Copyright (C) 1998 Alan Cox & Andi Kleen
       *
       * /proc/sysvipc/msg support (c) 1999 Dragos Acostachioaie <dragos@iname.com>
       *
       * mostly rewritten, threaded and wake-one semantics added
       * MSGMAX limit removed, sysctl's added
       * (c) 1999 Manfred Spraul <manfreds@colorfullife.com>
       */
      
      #include <linux/config.h>
      #include <linux/malloc.h>
      #include <linux/msg.h>
      #include <linux/spinlock.h>
      #include <linux/init.h>
      #include <linux/proc_fs.h>
      #include <linux/list.h>
      #include <asm/uaccess.h>
      #include "util.h"
      
      /* sysctl: */
      int msg_ctlmax = MSGMAX;
      int msg_ctlmnb = MSGMNB;
      int msg_ctlmni = MSGMNI;
      
      /* one msg_receiver structure for each sleeping receiver */
      struct msg_receiver {
      	struct list_head r_list;
      	struct task_struct* r_tsk;
      
      	int r_mode;
      	long r_msgtype;
      	long r_maxsize;
      
      	struct msg_msg* volatile r_msg;
      };
      
      /* one msg_sender for each sleeping sender */
      struct msg_sender {
      	struct list_head list;
      	struct task_struct* tsk;
      };
      
      struct msg_msgseg {
      	struct msg_msgseg* next;
      	/* the next part of the message follows immediately */
      };
      /* one msg_msg structure for each message */
      struct msg_msg {
      	struct list_head m_list; 
      	long  m_type;          
      	int m_ts;           /* message text size */
      	struct msg_msgseg* next;
      	/* the actual message follows immediately */
      };
      
      #define DATALEN_MSG	(PAGE_SIZE-sizeof(struct msg_msg))
      #define DATALEN_SEG	(PAGE_SIZE-sizeof(struct msg_msgseg))
      
      /* one msq_queue structure for each present queue on the system */
      struct msg_queue {
      	struct kern_ipc_perm q_perm;
      	time_t q_stime;			/* last msgsnd time */
      	time_t q_rtime;			/* last msgrcv time */
      	time_t q_ctime;			/* last change time */
      	unsigned long q_cbytes;		/* current number of bytes on queue */
      	unsigned long q_qnum;		/* number of messages in queue */
      	unsigned long q_qbytes;		/* max number of bytes on queue */
      	pid_t q_lspid;			/* pid of last msgsnd */
      	pid_t q_lrpid;			/* last receive pid */
      
      	struct list_head q_messages;
      	struct list_head q_receivers;
      	struct list_head q_senders;
      };
      
      #define SEARCH_ANY		1
      #define SEARCH_EQUAL		2
      #define SEARCH_NOTEQUAL		3
      #define SEARCH_LESSEQUAL	4
      
      static atomic_t msg_bytes = ATOMIC_INIT(0);
      static atomic_t msg_hdrs = ATOMIC_INIT(0);
      
      static struct ipc_ids msg_ids;
      
      #define msg_lock(id)	((struct msg_queue*)ipc_lock(&msg_ids,id))
      #define msg_unlock(id)	ipc_unlock(&msg_ids,id)
      #define msg_rmid(id)	((struct msg_queue*)ipc_rmid(&msg_ids,id))
      #define msg_checkid(msq, msgid)	\
      	ipc_checkid(&msg_ids,&msq->q_perm,msgid)
      #define msg_buildid(id, seq) \
      	ipc_buildid(&msg_ids, id, seq)
      
      static void freeque (int id);
      static int newque (key_t key, int msgflg);
      #ifdef CONFIG_PROC_FS
      static int sysvipc_msg_read_proc(char *buffer, char **start, off_t offset, int length, int *eof, void *data);
      #endif
      
 108  void __init msg_init (void)
      {
      	ipc_init_ids(&msg_ids,msg_ctlmni);
      
      #ifdef CONFIG_PROC_FS
      	create_proc_read_entry("sysvipc/msg", 0, 0, sysvipc_msg_read_proc, NULL);
      #endif
      }
      
 117  static int newque (key_t key, int msgflg)
      {
      	int id;
      	struct msg_queue *msq;
      
      	msq  = (struct msg_queue *) kmalloc (sizeof (*msq), GFP_KERNEL);
 123  	if (!msq) 
 124  		return -ENOMEM;
      	id = ipc_addid(&msg_ids, &msq->q_perm, msg_ctlmni);
 126  	if(id == -1) {
      		kfree(msq);
 128  		return -ENOSPC;
      	}
      	msq->q_perm.mode = (msgflg & S_IRWXUGO);
      	msq->q_perm.key = key;
      
      	msq->q_stime = msq->q_rtime = 0;
      	msq->q_ctime = CURRENT_TIME;
      	msq->q_cbytes = msq->q_qnum = 0;
      	msq->q_qbytes = msg_ctlmnb;
      	msq->q_lspid = msq->q_lrpid = 0;
 138  	INIT_LIST_HEAD(&msq->q_messages);
 139  	INIT_LIST_HEAD(&msq->q_receivers);
 140  	INIT_LIST_HEAD(&msq->q_senders);
      	msg_unlock(id);
      
 143  	return msg_buildid(id,msq->q_perm.seq);
      }
      
 146  static void free_msg(struct msg_msg* msg)
      {
      	struct msg_msgseg* seg;
      	seg = msg->next;
      	kfree(msg);
 151  	while(seg != NULL) {
      		struct msg_msgseg* tmp = seg->next;
      		kfree(seg);
      		seg = tmp;
      	}
      }
      
 158  static struct msg_msg* load_msg(void* src, int len)
      {
      	struct msg_msg* msg;
      	struct msg_msgseg** pseg;
      	int err;
      	int alen;
      
      	alen = len;
 166  	if(alen > DATALEN_MSG)
      		alen = DATALEN_MSG;
      
      	msg = (struct msg_msg *) kmalloc (sizeof(*msg) + alen, GFP_KERNEL);
 170  	if(msg==NULL)
 171  		return ERR_PTR(-ENOMEM);
      
      	msg->next = NULL;
      
 175  	if (copy_from_user(msg+1, src, alen)) {
      		err = -EFAULT;
 177  		goto out_err;
      	}
      
      	len -= alen;
      	src = ((char*)src)+alen;
      	pseg = &msg->next;
 183  	while(len > 0) {
      		struct msg_msgseg* seg;
      		alen = len;
 186  		if(alen > DATALEN_SEG)
      			alen = DATALEN_SEG;
      		seg = (struct msg_msgseg *) kmalloc (sizeof(*seg) + alen, GFP_KERNEL);
 189  		if(seg==NULL) {
      			err=-ENOMEM;
 191  			goto out_err;
      		}
      		*pseg = seg;
      		seg->next = NULL;
 195  		if(copy_from_user (seg+1, src, alen)) {
      			err = -EFAULT;
 197  			goto out_err;
      		}
      		pseg = &seg->next;
      		len -= alen;
      		src = ((char*)src)+alen;
      	}
 203  	return msg;
      
      out_err:
      	free_msg(msg);
 207  	return ERR_PTR(err);
      }
      
 210  static int store_msg(void* dest, struct msg_msg* msg, int len)
      {
      	int alen;
      	struct msg_msgseg *seg;
      
      	alen = len;
 216  	if(alen > DATALEN_MSG)
      		alen = DATALEN_MSG;
 218  	if(copy_to_user (dest, msg+1, alen))
 219  		return -1;
      
      	len -= alen;
      	dest = ((char*)dest)+alen;
      	seg = msg->next;
 224  	while(len > 0) {
      		alen = len;
 226  		if(alen > DATALEN_SEG)
      			alen = DATALEN_SEG;
 228  		if(copy_to_user (dest, seg+1, alen))
 229  			return -1;
      		len -= alen;
      		dest = ((char*)dest)+alen;
      		seg=seg->next;
      	}
 234  	return 0;
      }
      
 237  static inline void ss_add(struct msg_queue* msq, struct msg_sender* mss)
      {
      	mss->tsk=current;
      	current->state=TASK_INTERRUPTIBLE;
      	list_add_tail(&mss->list,&msq->q_senders);
      }
      
 244  static inline void ss_del(struct msg_sender* mss)
      {
 246  	if(mss->list.next != NULL)
      		list_del(&mss->list);
      }
      
 250  static void ss_wakeup(struct list_head* h, int kill)
      {
      	struct list_head *tmp;
      
      	tmp = h->next;
 255  	while (tmp != h) {
      		struct msg_sender* mss;
      		
      		mss = list_entry(tmp,struct msg_sender,list);
      		tmp = tmp->next;
 260  		if(kill)
      			mss->list.next=NULL;
      		wake_up_process(mss->tsk);
      	}
      }
      
 266  static void expunge_all(struct msg_queue* msq, int res)
      {
      	struct list_head *tmp;
      
      	tmp = msq->q_receivers.next;
 271  	while (tmp != &msq->q_receivers) {
      		struct msg_receiver* msr;
      		
      		msr = list_entry(tmp,struct msg_receiver,r_list);
      		tmp = tmp->next;
      		msr->r_msg = ERR_PTR(res);
      		wake_up_process(msr->r_tsk);
      	}
      }
      
 281  static void freeque (int id)
      {
      	struct msg_queue *msq;
      	struct list_head *tmp;
      
      	msq = msg_rmid(id);
      
      	expunge_all(msq,-EIDRM);
      	ss_wakeup(&msq->q_senders,1);
      	msg_unlock(id);
      		
      	tmp = msq->q_messages.next;
 293  	while(tmp != &msq->q_messages) {
      		struct msg_msg* msg = list_entry(tmp,struct msg_msg,m_list);
      		tmp = tmp->next;
      		atomic_dec(&msg_hdrs);
      		free_msg(msg);
      	}
      	atomic_sub(msq->q_cbytes, &msg_bytes);
      	kfree(msq);
      }
      
 303  asmlinkage long sys_msgget (key_t key, int msgflg)
      {
      	int id, ret = -EPERM;
      	struct msg_queue *msq;
      	
      	down(&msg_ids.sem);
 309  	if (key == IPC_PRIVATE) 
      		ret = newque(key, msgflg);
 311  	else if ((id = ipc_findkey(&msg_ids, key)) == -1) { /* key not used */
 312  		if (!(msgflg & IPC_CREAT))
      			ret = -ENOENT;
 314  		else
      			ret = newque(key, msgflg);
 316  	} else if (msgflg & IPC_CREAT && msgflg & IPC_EXCL) {
      		ret = -EEXIST;
 318  	} else {
      		msq = msg_lock(id);
 320  		if(msq==NULL)
 321  			BUG();
 322  		if (ipcperms(&msq->q_perm, msgflg))
      			ret = -EACCES;
 324  		else
      			ret = msg_buildid(id, msq->q_perm.seq);
      		msg_unlock(id);
      	}
      	up(&msg_ids.sem);
 329  	return ret;
      }
      
 332  static inline unsigned long copy_msqid_to_user(void *buf, struct msqid64_ds *in, int version)
      {
 334  	switch(version) {
 335  	case IPC_64:
 336  		return copy_to_user (buf, in, sizeof(*in));
 337  	case IPC_OLD:
      	    {
      		struct msqid_ds out;
      
      		memset(&out,0,sizeof(out));
      
      		ipc64_perm_to_ipc_perm(&in->msg_perm, &out.msg_perm);
      
      		out.msg_stime		= in->msg_stime;
      		out.msg_rtime		= in->msg_rtime;
      		out.msg_ctime		= in->msg_ctime;
      
 349  		if(in->msg_cbytes > USHRT_MAX)
      			out.msg_cbytes	= USHRT_MAX;
 351  		else
      			out.msg_cbytes	= in->msg_cbytes;
      		out.msg_lcbytes		= in->msg_cbytes;
      
 355  		if(in->msg_qnum > USHRT_MAX)
      			out.msg_qnum	= USHRT_MAX;
 357  		else
      			out.msg_qnum	= in->msg_qnum;
      
 360  		if(in->msg_qbytes > USHRT_MAX)
      			out.msg_qbytes	= USHRT_MAX;
 362  		else
      			out.msg_qbytes	= in->msg_qbytes;
      		out.msg_lqbytes		= in->msg_qbytes;
      
      		out.msg_lspid		= in->msg_lspid;
      		out.msg_lrpid		= in->msg_lrpid;
      
 369  		return copy_to_user (buf, &out, sizeof(out));
      	    }
 371  	default:
 372  		return -EINVAL;
      	}
      }
      
      struct msq_setbuf {
      	unsigned long	qbytes;
      	uid_t		uid;
      	gid_t		gid;
      	mode_t		mode;
      };
      
 383  static inline unsigned long copy_msqid_from_user(struct msq_setbuf *out, void *buf, int version)
      {
 385  	switch(version) {
 386  	case IPC_64:
      	    {
      		struct msqid64_ds tbuf;
      
 390  		if (copy_from_user (&tbuf, buf, sizeof (tbuf)))
 391  			return -EFAULT;
      
      		out->qbytes		= tbuf.msg_qbytes;
      		out->uid		= tbuf.msg_perm.uid;
      		out->gid		= tbuf.msg_perm.gid;
      		out->mode		= tbuf.msg_perm.mode;
      
 398  		return 0;
      	    }
 400  	case IPC_OLD:
      	    {
      		struct msqid_ds tbuf_old;
      
 404  		if (copy_from_user (&tbuf_old, buf, sizeof (tbuf_old)))
 405  			return -EFAULT;
      
      		out->uid		= tbuf_old.msg_perm.uid;
      		out->gid		= tbuf_old.msg_perm.gid;
      		out->mode		= tbuf_old.msg_perm.mode;
      
 411  		if(tbuf_old.msg_qbytes == 0)
      			out->qbytes	= tbuf_old.msg_lqbytes;
 413  		else
      			out->qbytes	= tbuf_old.msg_qbytes;
      
 416  		return 0;
      	    }
 418  	default:
 419  		return -EINVAL;
      	}
      }
      
 423  asmlinkage long sys_msgctl (int msqid, int cmd, struct msqid_ds *buf)
      {
      	int err, version;
      	struct msg_queue *msq;
      	struct msq_setbuf setbuf;
      	struct kern_ipc_perm *ipcp;
      	
 430  	if (msqid < 0 || cmd < 0)
 431  		return -EINVAL;
      
      	version = ipc_parse_version(&cmd);
      
 435  	switch (cmd) {
 436  	case IPC_INFO: 
 437  	case MSG_INFO: 
      	{ 
      		struct msginfo msginfo;
      		int max_id;
 441  		if (!buf)
 442  			return -EFAULT;
      		/* We must not return kernel stack data.
      		 * due to padding, it's not enough
      		 * to set all member fields.
      		 */
      		memset(&msginfo,0,sizeof(msginfo));	
      		msginfo.msgmni = msg_ctlmni;
      		msginfo.msgmax = msg_ctlmax;
      		msginfo.msgmnb = msg_ctlmnb;
      		msginfo.msgssz = MSGSSZ;
      		msginfo.msgseg = MSGSEG;
      		down(&msg_ids.sem);
 454  		if (cmd == MSG_INFO) {
      			msginfo.msgpool = msg_ids.in_use;
      			msginfo.msgmap = atomic_read(&msg_hdrs);
      			msginfo.msgtql = atomic_read(&msg_bytes);
 458  		} else {
      			msginfo.msgmap = MSGMAP;
      			msginfo.msgpool = MSGPOOL;
      			msginfo.msgtql = MSGTQL;
      		}
      		max_id = msg_ids.max_id;
      		up(&msg_ids.sem);
 465  		if (copy_to_user (buf, &msginfo, sizeof(struct msginfo)))
 466  			return -EFAULT;
 467  		return (max_id < 0) ? 0: max_id;
      	}
 469  	case MSG_STAT:
 470  	case IPC_STAT:
      	{
      		struct msqid64_ds tbuf;
      		int success_return;
 474  		if (!buf)
 475  			return -EFAULT;
 476  		if(cmd == MSG_STAT && msqid > msg_ids.size)
 477  			return -EINVAL;
      
      		memset(&tbuf,0,sizeof(tbuf));
      
      		msq = msg_lock(msqid);
 482  		if (msq == NULL)
 483  			return -EINVAL;
      
 485  		if(cmd == MSG_STAT) {
      			success_return = msg_buildid(msqid, msq->q_perm.seq);
 487  		} else {
      			err = -EIDRM;
 489  			if (msg_checkid(msq,msqid))
 490  				goto out_unlock;
      			success_return = 0;
      		}
      		err = -EACCES;
 494  		if (ipcperms (&msq->q_perm, S_IRUGO))
 495  			goto out_unlock;
      
      		kernel_to_ipc64_perm(&msq->q_perm, &tbuf.msg_perm);
      		tbuf.msg_stime  = msq->q_stime;
      		tbuf.msg_rtime  = msq->q_rtime;
      		tbuf.msg_ctime  = msq->q_ctime;
      		tbuf.msg_cbytes = msq->q_cbytes;
      		tbuf.msg_qnum   = msq->q_qnum;
      		tbuf.msg_qbytes = msq->q_qbytes;
      		tbuf.msg_lspid  = msq->q_lspid;
      		tbuf.msg_lrpid  = msq->q_lrpid;
      		msg_unlock(msqid);
 507  		if (copy_msqid_to_user(buf, &tbuf, version))
 508  			return -EFAULT;
 509  		return success_return;
      	}
 511  	case IPC_SET:
 512  		if (!buf)
 513  			return -EFAULT;
 514  		if (copy_msqid_from_user (&setbuf, buf, version))
 515  			return -EFAULT;
 516  		break;
 517  	case IPC_RMID:
 518  		break;
 519  	default:
 520  		return  -EINVAL;
      	}
      
      	down(&msg_ids.sem);
      	msq = msg_lock(msqid);
      	err=-EINVAL;
 526  	if (msq == NULL)
 527  		goto out_up;
      
      	err = -EIDRM;
 530  	if (msg_checkid(msq,msqid))
 531  		goto out_unlock_up;
      	ipcp = &msq->q_perm;
      	err = -EPERM;
      	if (current->euid != ipcp->cuid && 
 535  	    current->euid != ipcp->uid && !capable(CAP_SYS_ADMIN))
      	    /* We _could_ check for CAP_CHOWN above, but we don't */
 537  		goto out_unlock_up;
      
 539  	switch (cmd) {
 540  	case IPC_SET:
      	{
 542  		if (setbuf.qbytes > msg_ctlmnb && !capable(CAP_SYS_RESOURCE))
 543  			goto out_unlock_up;
      		msq->q_qbytes = setbuf.qbytes;
      
      		ipcp->uid = setbuf.uid;
      		ipcp->gid = setbuf.gid;
      		ipcp->mode = (ipcp->mode & ~S_IRWXUGO) | 
      			(S_IRWXUGO & setbuf.mode);
      		msq->q_ctime = CURRENT_TIME;
      		/* sleeping receivers might be excluded by
      		 * stricter permissions.
      		 */
      		expunge_all(msq,-EAGAIN);
      		/* sleeping senders might be able to send
      		 * due to a larger queue size.
      		 */
      		ss_wakeup(&msq->q_senders,0);
      		msg_unlock(msqid);
 560  		break;
      	}
 562  	case IPC_RMID:
      		freeque (msqid); 
 564  		break;
      	}
      	err = 0;
      out_up:
      	up(&msg_ids.sem);
 569  	return err;
      out_unlock_up:
      	msg_unlock(msqid);
 572  	goto out_up;
      out_unlock:
      	msg_unlock(msqid);
 575  	return err;
      }
      
 578  static int testmsg(struct msg_msg* msg,long type,int mode)
      {
 580  	switch(mode)
      	{
 582  		case SEARCH_ANY:
 583  			return 1;
 584  		case SEARCH_LESSEQUAL:
 585  			if(msg->m_type <=type)
 586  				return 1;
 587  			break;
 588  		case SEARCH_EQUAL:
 589  			if(msg->m_type == type)
 590  				return 1;
 591  			break;
 592  		case SEARCH_NOTEQUAL:
 593  			if(msg->m_type != type)
 594  				return 1;
 595  			break;
      	}
 597  	return 0;
      }
      
 600  int inline pipelined_send(struct msg_queue* msq, struct msg_msg* msg)
      {
      	struct list_head* tmp;
      
      	tmp = msq->q_receivers.next;
 605  	while (tmp != &msq->q_receivers) {
      		struct msg_receiver* msr;
      		msr = list_entry(tmp,struct msg_receiver,r_list);
      		tmp = tmp->next;
 609  		if(testmsg(msg,msr->r_msgtype,msr->r_mode)) {
      			list_del(&msr->r_list);
 611  			if(msr->r_maxsize < msg->m_ts) {
      				msr->r_msg = ERR_PTR(-E2BIG);
      				wake_up_process(msr->r_tsk);
 614  			} else {
      				msr->r_msg = msg;
      				msq->q_lspid = msr->r_tsk->pid;
      				msq->q_rtime = CURRENT_TIME;
      				wake_up_process(msr->r_tsk);
 619  				return 1;
      			}
      		}
      	}
 623  	return 0;
      }
      
 626  asmlinkage long sys_msgsnd (int msqid, struct msgbuf *msgp, size_t msgsz, int msgflg)
      {
      	struct msg_queue *msq;
      	struct msg_msg *msg;
      	long mtype;
      	int err;
      	
 633  	if (msgsz > msg_ctlmax || (long) msgsz < 0 || msqid < 0)
 634  		return -EINVAL;
 635  	if (get_user(mtype, &msgp->mtype))
 636  		return -EFAULT; 
 637  	if (mtype < 1)
 638  		return -EINVAL;
      
      	msg = load_msg(msgp->mtext, msgsz);
 641  	if(IS_ERR(msg))
 642  		return PTR_ERR(msg);
      
      	msg->m_type = mtype;
      	msg->m_ts = msgsz;
      
      	msq = msg_lock(msqid);
      	err=-EINVAL;
 649  	if(msq==NULL)
 650  		goto out_free;
      retry:
      	err= -EIDRM;
 653  	if (msg_checkid(msq,msqid))
 654  		goto out_unlock_free;
      
      	err=-EACCES;
 657  	if (ipcperms(&msq->q_perm, S_IWUGO)) 
 658  		goto out_unlock_free;
      
      	if(msgsz + msq->q_cbytes > msq->q_qbytes ||
 661  		1 + msq->q_qnum > msq->q_qbytes) {
      		struct msg_sender s;
      
 664  		if(msgflg&IPC_NOWAIT) {
      			err=-EAGAIN;
 666  			goto out_unlock_free;
      		}
      		ss_add(msq, &s);
      		msg_unlock(msqid);
      		schedule();
      		current->state= TASK_RUNNING;
      
      		msq = msg_lock(msqid);
      		err = -EIDRM;
 675  		if(msq==NULL)
 676  			goto out_free;
      		ss_del(&s);
      		
 679  		if (signal_pending(current)) {
      			err=-EINTR;
 681  			goto out_unlock_free;
      		}
 683  		goto retry;
      	}
      
 686  	if(!pipelined_send(msq,msg)) {
      		/* noone is waiting for this message, enqueue it */
      		list_add_tail(&msg->m_list,&msq->q_messages);
      		msq->q_cbytes += msgsz;
      		msq->q_qnum++;
      		atomic_add(msgsz,&msg_bytes);
      		atomic_inc(&msg_hdrs);
      	}
      	
      	err = 0;
      	msg = NULL;
      	msq->q_lspid = current->pid;
      	msq->q_stime = CURRENT_TIME;
      
      out_unlock_free:
      	msg_unlock(msqid);
      out_free:
 703  	if(msg!=NULL)
      		free_msg(msg);
 705  	return err;
      }
      
 708  int inline convert_mode(long* msgtyp, int msgflg)
      {
      	/* 
      	 *  find message of correct type.
      	 *  msgtyp = 0 => get first.
      	 *  msgtyp > 0 => get first message of matching type.
      	 *  msgtyp < 0 => get message with least type must be < abs(msgtype).  
      	 */
 716  	if(*msgtyp==0)
 717  		return SEARCH_ANY;
 718  	if(*msgtyp<0) {
      		*msgtyp=-(*msgtyp);
 720  		return SEARCH_LESSEQUAL;
      	}
 722  	if(msgflg & MSG_EXCEPT)
 723  		return SEARCH_NOTEQUAL;
 724  	return SEARCH_EQUAL;
      }
      
 727  asmlinkage long sys_msgrcv (int msqid, struct msgbuf *msgp, size_t msgsz,
      			    long msgtyp, int msgflg)
      {
      	struct msg_queue *msq;
      	struct msg_receiver msr_d;
      	struct list_head* tmp;
      	struct msg_msg* msg, *found_msg;
      	int err;
      	int mode;
      
 737  	if (msqid < 0 || (long) msgsz < 0)
 738  		return -EINVAL;
      	mode = convert_mode(&msgtyp,msgflg);
      
      	msq = msg_lock(msqid);
 742  	if(msq==NULL)
 743  		return -EINVAL;
      retry:
      	err=-EACCES;
 746  	if (ipcperms (&msq->q_perm, S_IRUGO))
 747  		goto out_unlock;
      
      	tmp = msq->q_messages.next;
      	found_msg=NULL;
 751  	while (tmp != &msq->q_messages) {
      		msg = list_entry(tmp,struct msg_msg,m_list);
 753  		if(testmsg(msg,msgtyp,mode)) {
      			found_msg = msg;
 755  			if(mode == SEARCH_LESSEQUAL && msg->m_type != 1) {
      				found_msg=msg;
      				msgtyp=msg->m_type-1;
 758  			} else {
      				found_msg=msg;
 760  				break;
      			}
      		}
      		tmp = tmp->next;
      	}
 765  	if(found_msg) {
      		msg=found_msg;
 767  		if ((msgsz < msg->m_ts) && !(msgflg & MSG_NOERROR)) {
      			err=-E2BIG;
 769  			goto out_unlock;
      		}
      		list_del(&msg->m_list);
      		msq->q_qnum--;
      		msq->q_rtime = CURRENT_TIME;
      		msq->q_lrpid = current->pid;
      		msq->q_cbytes -= msg->m_ts;
      		atomic_sub(msg->m_ts,&msg_bytes);
      		atomic_dec(&msg_hdrs);
      		ss_wakeup(&msq->q_senders,0);
      		msg_unlock(msqid);
      out_success:
      		msgsz = (msgsz > msg->m_ts) ? msg->m_ts : msgsz;
      		if (put_user (msg->m_type, &msgp->mtype) ||
 783  		    store_msg(msgp->mtext, msg, msgsz)) {
      			    msgsz = -EFAULT;
      		}
      		free_msg(msg);
 787  		return msgsz;
 788  	} else
      	{
      		struct msg_queue *t;
      		/* no message waiting. Prepare for pipelined
      		 * receive.
      		 */
 794  		if (msgflg & IPC_NOWAIT) {
      			err=-ENOMSG;
 796  			goto out_unlock;
      		}
      		list_add_tail(&msr_d.r_list,&msq->q_receivers);
      		msr_d.r_tsk = current;
      		msr_d.r_msgtype = msgtyp;
      		msr_d.r_mode = mode;
 802  		if(msgflg & MSG_NOERROR)
      			msr_d.r_maxsize = INT_MAX;
 804  		 else
      		 	msr_d.r_maxsize = msgsz;
      		msr_d.r_msg = ERR_PTR(-EAGAIN);
      		current->state = TASK_INTERRUPTIBLE;
      		msg_unlock(msqid);
      
      		schedule();
      		current->state = TASK_RUNNING;
      
      		msg = (struct msg_msg*) msr_d.r_msg;
 814  		if(!IS_ERR(msg)) 
 815  			goto out_success;
      
      		t = msg_lock(msqid);
 818  		if(t==NULL)
      			msqid=-1;
      		msg = (struct msg_msg*)msr_d.r_msg;
 821  		if(!IS_ERR(msg)) {
      			/* our message arived while we waited for
      			 * the spinlock. Process it.
      			 */
 825  			if(msqid!=-1)
      				msg_unlock(msqid);
 827  			goto out_success;
      		}
      		err = PTR_ERR(msg);
 830  		if(err == -EAGAIN) {
 831  			if(msqid==-1)
 832  				BUG();
      			list_del(&msr_d.r_list);
 834  			if (signal_pending(current))
      				err=-EINTR;
 836  			 else
 837  				goto retry;
      		}
      	}
      out_unlock:
 841  	if(msqid!=-1)
      		msg_unlock(msqid);
 843  	return err;
      }
      
      #ifdef CONFIG_PROC_FS
 847  static int sysvipc_msg_read_proc(char *buffer, char **start, off_t offset, int length, int *eof, void *data)
      {
      	off_t pos = 0;
      	off_t begin = 0;
      	int i, len = 0;
      
      	down(&msg_ids.sem);
      	len += sprintf(buffer, "       key      msqid perms      cbytes       qnum lspid lrpid   uid   gid  cuid  cgid      stime      rtime      ctime\n");
      
 856  	for(i = 0; i <= msg_ids.max_id; i++) {
      		struct msg_queue * msq;
      		msq = msg_lock(i);
 859  		if(msq != NULL) {
      			len += sprintf(buffer + len, "%10d %10d  %4o  %10lu %10lu %5u %5u %5u %5u %5u %5u %10lu %10lu %10lu\n",
      				msq->q_perm.key,
      				msg_buildid(i,msq->q_perm.seq),
      				msq->q_perm.mode,
      				msq->q_cbytes,
      				msq->q_qnum,
      				msq->q_lspid,
      				msq->q_lrpid,
      				msq->q_perm.uid,
      				msq->q_perm.gid,
      				msq->q_perm.cuid,
      				msq->q_perm.cgid,
      				msq->q_stime,
      				msq->q_rtime,
      				msq->q_ctime);
      			msg_unlock(i);
      
      			pos += len;
 878  			if(pos < offset) {
      				len = 0;
      				begin = pos;
      			}
 882  			if(pos > offset + length)
 883  				goto done;
      		}
      
      	}
      	*eof = 1;
      done:
      	up(&msg_ids.sem);
      	*start = buffer + (offset - begin);
      	len -= (offset - begin);
 892  	if(len > length)
      		len = length;
 894  	if(len < 0)
      		len = 0;
 896  	return len;
      }
      #endif