xref: /freebsd/sys/kern/uipc_mqueue.c (revision 1ee774f614e70c52baafdf8b7e9013b545d36f2b)
1 /*-
2  * Copyright (c) 2005 David Xu <davidxu@freebsd.org>
3  * All rights reserved.
4  *
5  * Redistribution and use in source and binary forms, with or without
6  * modification, are permitted provided that the following conditions
7  * are met:
8  * 1. Redistributions of source code must retain the above copyright
9  *    notice, this list of conditions and the following disclaimer.
10  * 2. Redistributions in binary form must reproduce the above copyright
11  *    notice, this list of conditions and the following disclaimer in the
12  *    documentation and/or other materials provided with the distribution.
13  *
14  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
15  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
16  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
17  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
18  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
19  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
20  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
21  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
22  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
23  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
24  * SUCH DAMAGE.
25  *
26  */
27 
28 /*
29  * POSIX message queue implementation.
30  *
31  * 1) A mqueue filesystem can be mounted, each message queue appears
32  *    in mounted directory, user can change queue's permission and
33  *    ownership, or remove a queue. Manually creating a file in the
34  *    directory causes a message queue to be created in the kernel with
35  *    default message queue attributes applied and same name used, this
36  *    method is not advocated since mq_open syscall allows user to specify
37  *    different attributes. Also the file system can be mounted multiple
38  *    times at different mount points but shows same contents.
39  *
40  * 2) Standard POSIX message queue API. The syscalls do not use vfs layer,
41  *    but directly operate on internal data structure, this allows user to
42  *    use the IPC facility without having to mount mqueue file system.
43  */
44 
45 #include <sys/cdefs.h>
46 __FBSDID("$FreeBSD$");
47 
48 #include <sys/param.h>
49 #include <sys/kernel.h>
50 #include <sys/systm.h>
51 #include <sys/limits.h>
52 #include <sys/buf.h>
53 #include <sys/dirent.h>
54 #include <sys/event.h>
55 #include <sys/eventhandler.h>
56 #include <sys/fcntl.h>
57 #include <sys/file.h>
58 #include <sys/filedesc.h>
59 #include <sys/lock.h>
60 #include <sys/malloc.h>
61 #include <sys/module.h>
62 #include <sys/mount.h>
63 #include <sys/mqueue.h>
64 #include <sys/mutex.h>
65 #include <sys/namei.h>
66 #include <sys/posix4.h>
67 #include <sys/poll.h>
68 #include <sys/priv.h>
69 #include <sys/proc.h>
70 #include <sys/queue.h>
71 #include <sys/sysproto.h>
72 #include <sys/stat.h>
73 #include <sys/syscall.h>
74 #include <sys/syscallsubr.h>
75 #include <sys/sysent.h>
76 #include <sys/sx.h>
77 #include <sys/sysctl.h>
78 #include <sys/taskqueue.h>
79 #include <sys/unistd.h>
80 #include <sys/vnode.h>
81 #include <machine/atomic.h>
82 
83 /*
84  * Limits and constants
85  */
86 #define	MQFS_NAMELEN		NAME_MAX
87 #define MQFS_DELEN		(8 + MQFS_NAMELEN)
88 
89 /* node types */
90 typedef enum {
91 	mqfstype_none = 0,
92 	mqfstype_root,
93 	mqfstype_dir,
94 	mqfstype_this,
95 	mqfstype_parent,
96 	mqfstype_file,
97 	mqfstype_symlink,
98 } mqfs_type_t;
99 
100 struct mqfs_node;
101 
102 /*
103  * mqfs_info: describes a mqfs instance
104  */
105 struct mqfs_info {
106 	struct sx		mi_lock;
107 	struct mqfs_node	*mi_root;
108 	struct unrhdr		*mi_unrhdr;
109 };
110 
111 struct mqfs_vdata {
112 	LIST_ENTRY(mqfs_vdata)	mv_link;
113 	struct mqfs_node	*mv_node;
114 	struct vnode		*mv_vnode;
115 	struct task		mv_task;
116 };
117 
118 /*
119  * mqfs_node: describes a node (file or directory) within a mqfs
120  */
121 struct mqfs_node {
122 	char			mn_name[MQFS_NAMELEN+1];
123 	struct mqfs_info	*mn_info;
124 	struct mqfs_node	*mn_parent;
125 	LIST_HEAD(,mqfs_node)	mn_children;
126 	LIST_ENTRY(mqfs_node)	mn_sibling;
127 	LIST_HEAD(,mqfs_vdata)	mn_vnodes;
128 	int			mn_refcount;
129 	mqfs_type_t		mn_type;
130 	int			mn_deleted;
131 	u_int32_t		mn_fileno;
132 	void			*mn_data;
133 	struct timespec		mn_birth;
134 	struct timespec		mn_ctime;
135 	struct timespec		mn_atime;
136 	struct timespec		mn_mtime;
137 	uid_t			mn_uid;
138 	gid_t			mn_gid;
139 	int			mn_mode;
140 };
141 
142 #define	VTON(vp)	(((struct mqfs_vdata *)((vp)->v_data))->mv_node)
143 #define VTOMQ(vp) 	((struct mqueue *)(VTON(vp)->mn_data))
144 #define	VFSTOMQFS(m)	((struct mqfs_info *)((m)->mnt_data))
145 #define	FPTOMQ(fp)	((struct mqueue *)(((struct mqfs_node *) \
146 				(fp)->f_data)->mn_data))
147 
148 TAILQ_HEAD(msgq, mqueue_msg);
149 
150 struct mqueue;
151 
152 struct mqueue_notifier {
153 	LIST_ENTRY(mqueue_notifier)	nt_link;
154 	struct sigevent			nt_sigev;
155 	ksiginfo_t			nt_ksi;
156 	struct proc			*nt_proc;
157 };
158 
159 struct mqueue {
160 	struct mtx	mq_mutex;
161 	int		mq_flags;
162 	long		mq_maxmsg;
163 	long		mq_msgsize;
164 	long		mq_curmsgs;
165 	long		mq_totalbytes;
166 	struct msgq	mq_msgq;
167 	int		mq_receivers;
168 	int		mq_senders;
169 	struct selinfo	mq_rsel;
170 	struct selinfo	mq_wsel;
171 	struct mqueue_notifier	*mq_notifier;
172 };
173 
174 #define	MQ_RSEL		0x01
175 #define	MQ_WSEL		0x02
176 
177 struct mqueue_msg {
178 	TAILQ_ENTRY(mqueue_msg)	msg_link;
179 	unsigned int	msg_prio;
180 	unsigned int	msg_size;
181 	/* following real data... */
182 };
183 
184 SYSCTL_NODE(_kern, OID_AUTO, mqueue, CTLFLAG_RW, 0,
185 	"POSIX real time message queue");
186 
187 static int	default_maxmsg  = 10;
188 static int	default_msgsize = 1024;
189 
190 static int	maxmsg = 100;
191 SYSCTL_INT(_kern_mqueue, OID_AUTO, maxmsg, CTLFLAG_RW,
192     &maxmsg, 0, "Default maximum messages in queue");
193 static int	maxmsgsize = 16384;
194 SYSCTL_INT(_kern_mqueue, OID_AUTO, maxmsgsize, CTLFLAG_RW,
195     &maxmsgsize, 0, "Default maximum message size");
196 static int	maxmq = 100;
197 SYSCTL_INT(_kern_mqueue, OID_AUTO, maxmq, CTLFLAG_RW,
198     &maxmq, 0, "maximum message queues");
199 static int	curmq = 0;
200 SYSCTL_INT(_kern_mqueue, OID_AUTO, curmq, CTLFLAG_RW,
201     &curmq, 0, "current message queue number");
202 static int	unloadable = 0;
203 static MALLOC_DEFINE(M_MQUEUEDATA, "mqdata", "mqueue data");
204 
205 static eventhandler_tag exit_tag;
206 
207 /* Only one instance per-system */
208 static struct mqfs_info		mqfs_data;
209 static uma_zone_t		mqnode_zone;
210 static uma_zone_t		mqueue_zone;
211 static uma_zone_t		mvdata_zone;
212 static uma_zone_t		mqnoti_zone;
213 static struct vop_vector	mqfs_vnodeops;
214 static struct fileops		mqueueops;
215 
216 /*
217  * Directory structure construction and manipulation
218  */
219 #ifdef notyet
220 static struct mqfs_node	*mqfs_create_dir(struct mqfs_node *parent,
221 	const char *name, int namelen, struct ucred *cred, int mode);
222 static struct mqfs_node	*mqfs_create_link(struct mqfs_node *parent,
223 	const char *name, int namelen, struct ucred *cred, int mode);
224 #endif
225 
226 static struct mqfs_node	*mqfs_create_file(struct mqfs_node *parent,
227 	const char *name, int namelen, struct ucred *cred, int mode);
228 static int	mqfs_destroy(struct mqfs_node *mn);
229 static void	mqfs_fileno_alloc(struct mqfs_info *mi, struct mqfs_node *mn);
230 static void	mqfs_fileno_free(struct mqfs_info *mi, struct mqfs_node *mn);
231 static int	mqfs_allocv(struct mount *mp, struct vnode **vpp, struct mqfs_node *pn);
232 
233 /*
234  * Message queue construction and maniplation
235  */
236 static struct mqueue	*mqueue_alloc(const struct mq_attr *attr);
237 static void	mqueue_free(struct mqueue *mq);
238 static int	mqueue_send(struct mqueue *mq, const char *msg_ptr,
239 			size_t msg_len, unsigned msg_prio, int waitok,
240 			const struct timespec *abs_timeout);
241 static int	mqueue_receive(struct mqueue *mq, char *msg_ptr,
242 			size_t msg_len, unsigned *msg_prio, int waitok,
243 			const struct timespec *abs_timeout);
244 static int	_mqueue_send(struct mqueue *mq, struct mqueue_msg *msg,
245 			int timo);
246 static int	_mqueue_recv(struct mqueue *mq, struct mqueue_msg **msg,
247 			int timo);
248 static void	mqueue_send_notification(struct mqueue *mq);
249 static void	mqueue_fdclose(struct thread *td, int fd, struct file *fp);
250 static void	mq_proc_exit(void *arg, struct proc *p);
251 
252 /*
253  * kqueue filters
254  */
255 static void	filt_mqdetach(struct knote *kn);
256 static int	filt_mqread(struct knote *kn, long hint);
257 static int	filt_mqwrite(struct knote *kn, long hint);
258 
259 struct filterops mq_rfiltops = {
260 	.f_isfd = 1,
261 	.f_detach = filt_mqdetach,
262 	.f_event = filt_mqread,
263 };
264 struct filterops mq_wfiltops = {
265 	.f_isfd = 1,
266 	.f_detach = filt_mqdetach,
267 	.f_event = filt_mqwrite,
268 };
269 
270 /*
271  * Initialize fileno bitmap
272  */
273 static void
274 mqfs_fileno_init(struct mqfs_info *mi)
275 {
276 	struct unrhdr *up;
277 
278 	up = new_unrhdr(1, INT_MAX, NULL);
279 	mi->mi_unrhdr = up;
280 }
281 
282 /*
283  * Tear down fileno bitmap
284  */
285 static void
286 mqfs_fileno_uninit(struct mqfs_info *mi)
287 {
288 	struct unrhdr *up;
289 
290 	up = mi->mi_unrhdr;
291 	mi->mi_unrhdr = NULL;
292 	delete_unrhdr(up);
293 }
294 
295 /*
296  * Allocate a file number
297  */
298 static void
299 mqfs_fileno_alloc(struct mqfs_info *mi, struct mqfs_node *mn)
300 {
301 	/* make sure our parent has a file number */
302 	if (mn->mn_parent && !mn->mn_parent->mn_fileno)
303 		mqfs_fileno_alloc(mi, mn->mn_parent);
304 
305 	switch (mn->mn_type) {
306 	case mqfstype_root:
307 	case mqfstype_dir:
308 	case mqfstype_file:
309 	case mqfstype_symlink:
310 		mn->mn_fileno = alloc_unr(mi->mi_unrhdr);
311 		break;
312 	case mqfstype_this:
313 		KASSERT(mn->mn_parent != NULL,
314 		    ("mqfstype_this node has no parent"));
315 		mn->mn_fileno = mn->mn_parent->mn_fileno;
316 		break;
317 	case mqfstype_parent:
318 		KASSERT(mn->mn_parent != NULL,
319 		    ("mqfstype_parent node has no parent"));
320 		if (mn->mn_parent == mi->mi_root) {
321 			mn->mn_fileno = mn->mn_parent->mn_fileno;
322 			break;
323 		}
324 		KASSERT(mn->mn_parent->mn_parent != NULL,
325 		    ("mqfstype_parent node has no grandparent"));
326 		mn->mn_fileno = mn->mn_parent->mn_parent->mn_fileno;
327 		break;
328 	default:
329 		KASSERT(0,
330 		    ("mqfs_fileno_alloc() called for unknown type node: %d",
331 			mn->mn_type));
332 		break;
333 	}
334 }
335 
336 /*
337  * Release a file number
338  */
339 static void
340 mqfs_fileno_free(struct mqfs_info *mi, struct mqfs_node *mn)
341 {
342 	switch (mn->mn_type) {
343 	case mqfstype_root:
344 	case mqfstype_dir:
345 	case mqfstype_file:
346 	case mqfstype_symlink:
347 		free_unr(mi->mi_unrhdr, mn->mn_fileno);
348 		break;
349 	case mqfstype_this:
350 	case mqfstype_parent:
351 		/* ignore these, as they don't "own" their file number */
352 		break;
353 	default:
354 		KASSERT(0,
355 		    ("mqfs_fileno_free() called for unknown type node: %d",
356 			mn->mn_type));
357 		break;
358 	}
359 }
360 
361 static __inline struct mqfs_node *
362 mqnode_alloc(void)
363 {
364 	return uma_zalloc(mqnode_zone, M_WAITOK | M_ZERO);
365 }
366 
367 static __inline void
368 mqnode_free(struct mqfs_node *node)
369 {
370 	uma_zfree(mqnode_zone, node);
371 }
372 
373 static __inline void
374 mqnode_addref(struct mqfs_node *node)
375 {
376 	atomic_fetchadd_int(&node->mn_refcount, 1);
377 }
378 
379 static __inline void
380 mqnode_release(struct mqfs_node *node)
381 {
382 	struct mqfs_info *mqfs;
383 	int old, exp;
384 
385 	mqfs = node->mn_info;
386 	old = atomic_fetchadd_int(&node->mn_refcount, -1);
387 	if (node->mn_type == mqfstype_dir ||
388 	    node->mn_type == mqfstype_root)
389 		exp = 3; /* include . and .. */
390 	else
391 		exp = 1;
392 	if (old == exp) {
393 		int locked = sx_xlocked(&mqfs->mi_lock);
394 		if (!locked)
395 			sx_xlock(&mqfs->mi_lock);
396 		mqfs_destroy(node);
397 		if (!locked)
398 			sx_xunlock(&mqfs->mi_lock);
399 	}
400 }
401 
402 /*
403  * Add a node to a directory
404  */
405 static int
406 mqfs_add_node(struct mqfs_node *parent, struct mqfs_node *node)
407 {
408 	KASSERT(parent != NULL, ("%s(): parent is NULL", __func__));
409 	KASSERT(parent->mn_info != NULL,
410 	    ("%s(): parent has no mn_info", __func__));
411 	KASSERT(parent->mn_type == mqfstype_dir ||
412 	    parent->mn_type == mqfstype_root,
413 	    ("%s(): parent is not a directory", __func__));
414 
415 	node->mn_info = parent->mn_info;
416 	node->mn_parent = parent;
417 	LIST_INIT(&node->mn_children);
418 	LIST_INIT(&node->mn_vnodes);
419 	LIST_INSERT_HEAD(&parent->mn_children, node, mn_sibling);
420 	mqnode_addref(parent);
421 	return (0);
422 }
423 
424 static struct mqfs_node *
425 mqfs_create_node(const char *name, int namelen, struct ucred *cred, int mode,
426 	int nodetype)
427 {
428 	struct mqfs_node *node;
429 
430 	node = mqnode_alloc();
431 	strncpy(node->mn_name, name, namelen);
432 	node->mn_type = nodetype;
433 	node->mn_refcount = 1;
434 	vfs_timestamp(&node->mn_birth);
435 	node->mn_ctime = node->mn_atime = node->mn_mtime
436 		= node->mn_birth;
437 	node->mn_uid = cred->cr_uid;
438 	node->mn_gid = cred->cr_gid;
439 	node->mn_mode = mode;
440 	return (node);
441 }
442 
443 /*
444  * Create a file
445  */
446 static struct mqfs_node *
447 mqfs_create_file(struct mqfs_node *parent, const char *name, int namelen,
448 	struct ucred *cred, int mode)
449 {
450 	struct mqfs_node *node;
451 
452 	node = mqfs_create_node(name, namelen, cred, mode, mqfstype_file);
453 	if (mqfs_add_node(parent, node) != 0) {
454 		mqnode_free(node);
455 		return (NULL);
456 	}
457 	return (node);
458 }
459 
460 /*
461  * Add . and .. to a directory
462  */
463 static int
464 mqfs_fixup_dir(struct mqfs_node *parent)
465 {
466 	struct mqfs_node *dir;
467 
468 	dir = mqnode_alloc();
469 	dir->mn_name[0] = '.';
470 	dir->mn_type = mqfstype_this;
471 	dir->mn_refcount = 1;
472 	if (mqfs_add_node(parent, dir) != 0) {
473 		mqnode_free(dir);
474 		return (-1);
475 	}
476 
477 	dir = mqnode_alloc();
478 	dir->mn_name[0] = dir->mn_name[1] = '.';
479 	dir->mn_type = mqfstype_parent;
480 	dir->mn_refcount = 1;
481 
482 	if (mqfs_add_node(parent, dir) != 0) {
483 		mqnode_free(dir);
484 		return (-1);
485 	}
486 
487 	return (0);
488 }
489 
490 #ifdef notyet
491 
492 /*
493  * Create a directory
494  */
495 static struct mqfs_node *
496 mqfs_create_dir(struct mqfs_node *parent, const char *name, int namelen,
497 	struct ucred *cred, int mode)
498 {
499 	struct mqfs_node *node;
500 
501 	node = mqfs_create_node(name, namelen, cred, mode, mqfstype_dir);
502 	if (mqfs_add_node(parent, node) != 0) {
503 		mqnode_free(node);
504 		return (NULL);
505 	}
506 
507 	if (mqfs_fixup_dir(node) != 0) {
508 		mqfs_destroy(node);
509 		return (NULL);
510 	}
511 	return (node);
512 }
513 
514 /*
515  * Create a symlink
516  */
517 static struct mqfs_node *
518 mqfs_create_link(struct mqfs_node *parent, const char *name, int namelen,
519 	struct ucred *cred, int mode)
520 {
521 	struct mqfs_node *node;
522 
523 	node = mqfs_create_node(name, namelen, cred, mode, mqfstype_symlink);
524 	if (mqfs_add_node(parent, node) != 0) {
525 		mqnode_free(node);
526 		return (NULL);
527 	}
528 	return (node);
529 }
530 
531 #endif
532 
533 /*
534  * Destroy a node or a tree of nodes
535  */
536 static int
537 mqfs_destroy(struct mqfs_node *node)
538 {
539 	struct mqfs_node *parent;
540 
541 	KASSERT(node != NULL,
542 	    ("%s(): node is NULL", __func__));
543 	KASSERT(node->mn_info != NULL,
544 	    ("%s(): node has no mn_info", __func__));
545 
546 	/* destroy children */
547 	if (node->mn_type == mqfstype_dir || node->mn_type == mqfstype_root)
548 		while (! LIST_EMPTY(&node->mn_children))
549 			mqfs_destroy(LIST_FIRST(&node->mn_children));
550 
551 	/* unlink from parent */
552 	if ((parent = node->mn_parent) != NULL) {
553 		KASSERT(parent->mn_info == node->mn_info,
554 		    ("%s(): parent has different mn_info", __func__));
555 		LIST_REMOVE(node, mn_sibling);
556 	}
557 
558 	if (node->mn_fileno != 0)
559 		mqfs_fileno_free(node->mn_info, node);
560 	if (node->mn_data != NULL)
561 		mqueue_free(node->mn_data);
562 	mqnode_free(node);
563 	return (0);
564 }
565 
566 /*
567  * Mount a mqfs instance
568  */
569 static int
570 mqfs_mount(struct mount *mp)
571 {
572 	struct statfs *sbp;
573 
574 	if (mp->mnt_flag & MNT_UPDATE)
575 		return (EOPNOTSUPP);
576 
577 	mp->mnt_data = &mqfs_data;
578 	MNT_ILOCK(mp);
579 	mp->mnt_flag |= MNT_LOCAL;
580 	mp->mnt_kern_flag |= MNTK_MPSAFE;
581 	MNT_IUNLOCK(mp);
582 	vfs_getnewfsid(mp);
583 
584 	sbp = &mp->mnt_stat;
585 	vfs_mountedfrom(mp, "mqueue");
586 	sbp->f_bsize = PAGE_SIZE;
587 	sbp->f_iosize = PAGE_SIZE;
588 	sbp->f_blocks = 1;
589 	sbp->f_bfree = 0;
590 	sbp->f_bavail = 0;
591 	sbp->f_files = 1;
592 	sbp->f_ffree = 0;
593 	return (0);
594 }
595 
596 /*
597  * Unmount a mqfs instance
598  */
599 static int
600 mqfs_unmount(struct mount *mp, int mntflags)
601 {
602 	int error;
603 
604 	error = vflush(mp, 0, (mntflags & MNT_FORCE) ?  FORCECLOSE : 0,
605 	    curthread);
606 	return (error);
607 }
608 
609 /*
610  * Return a root vnode
611  */
612 static int
613 mqfs_root(struct mount *mp, int flags, struct vnode **vpp)
614 {
615 	struct mqfs_info *mqfs;
616 	int ret;
617 
618 	mqfs = VFSTOMQFS(mp);
619 	ret = mqfs_allocv(mp, vpp, mqfs->mi_root);
620 	return (ret);
621 }
622 
623 /*
624  * Return filesystem stats
625  */
626 static int
627 mqfs_statfs(struct mount *mp, struct statfs *sbp)
628 {
629 	/* XXX update statistics */
630 	return (0);
631 }
632 
633 /*
634  * Initialize a mqfs instance
635  */
636 static int
637 mqfs_init(struct vfsconf *vfc)
638 {
639 	struct mqfs_node *root;
640 	struct mqfs_info *mi;
641 
642 	mqnode_zone = uma_zcreate("mqnode", sizeof(struct mqfs_node),
643 		NULL, NULL, NULL, NULL, UMA_ALIGN_PTR, 0);
644 	mqueue_zone = uma_zcreate("mqueue", sizeof(struct mqueue),
645 		NULL, NULL, NULL, NULL, UMA_ALIGN_PTR, 0);
646 	mvdata_zone = uma_zcreate("mvdata",
647 		sizeof(struct mqfs_vdata), NULL, NULL, NULL,
648 		NULL, UMA_ALIGN_PTR, 0);
649 	mqnoti_zone = uma_zcreate("mqnotifier", sizeof(struct mqueue_notifier),
650 		NULL, NULL, NULL, NULL, UMA_ALIGN_PTR, 0);
651 	mi = &mqfs_data;
652 	sx_init(&mi->mi_lock, "mqfs lock");
653 	/* set up the root diretory */
654 	root = mqfs_create_node("/", 1, curthread->td_ucred, 01777,
655 		mqfstype_root);
656 	root->mn_info = mi;
657 	LIST_INIT(&root->mn_children);
658 	LIST_INIT(&root->mn_vnodes);
659 	mi->mi_root = root;
660 	mqfs_fileno_init(mi);
661 	mqfs_fileno_alloc(mi, root);
662 	mqfs_fixup_dir(root);
663 	exit_tag = EVENTHANDLER_REGISTER(process_exit, mq_proc_exit, NULL,
664 	    EVENTHANDLER_PRI_ANY);
665 	mq_fdclose = mqueue_fdclose;
666 	p31b_setcfg(CTL_P1003_1B_MESSAGE_PASSING, _POSIX_MESSAGE_PASSING);
667 	return (0);
668 }
669 
670 /*
671  * Destroy a mqfs instance
672  */
673 static int
674 mqfs_uninit(struct vfsconf *vfc)
675 {
676 	struct mqfs_info *mi;
677 
678 	if (!unloadable)
679 		return (EOPNOTSUPP);
680 	EVENTHANDLER_DEREGISTER(process_exit, exit_tag);
681 	mi = &mqfs_data;
682 	mqfs_destroy(mi->mi_root);
683 	mi->mi_root = NULL;
684 	mqfs_fileno_uninit(mi);
685 	sx_destroy(&mi->mi_lock);
686 	uma_zdestroy(mqnode_zone);
687 	uma_zdestroy(mqueue_zone);
688 	uma_zdestroy(mvdata_zone);
689 	uma_zdestroy(mqnoti_zone);
690 	return (0);
691 }
692 
693 /*
694  * task routine
695  */
696 static void
697 do_recycle(void *context, int pending __unused)
698 {
699 	struct vnode *vp = (struct vnode *)context;
700 
701 	vrecycle(vp, curthread);
702 	vdrop(vp);
703 }
704 
705 /*
706  * Allocate a vnode
707  */
708 static int
709 mqfs_allocv(struct mount *mp, struct vnode **vpp, struct mqfs_node *pn)
710 {
711 	struct mqfs_vdata *vd;
712 	struct mqfs_info  *mqfs;
713 	struct vnode *newvpp;
714 	int error;
715 
716 	mqfs = pn->mn_info;
717 	*vpp = NULL;
718 	sx_xlock(&mqfs->mi_lock);
719 	LIST_FOREACH(vd, &pn->mn_vnodes, mv_link) {
720 		if (vd->mv_vnode->v_mount == mp) {
721 			vhold(vd->mv_vnode);
722 			break;
723 		}
724 	}
725 
726 	if (vd != NULL) {
727 found:
728 		*vpp = vd->mv_vnode;
729 		sx_xunlock(&mqfs->mi_lock);
730 		error = vget(*vpp, LK_RETRY | LK_EXCLUSIVE, curthread);
731 		vdrop(*vpp);
732 		return (error);
733 	}
734 	sx_xunlock(&mqfs->mi_lock);
735 
736 	error = getnewvnode("mqueue", mp, &mqfs_vnodeops, &newvpp);
737 	if (error)
738 		return (error);
739 	vn_lock(newvpp, LK_EXCLUSIVE | LK_RETRY);
740 	error = insmntque(newvpp, mp);
741 	if (error != 0)
742 		return (error);
743 
744 	sx_xlock(&mqfs->mi_lock);
745 	/*
746 	 * Check if it has already been allocated
747 	 * while we were blocked.
748 	 */
749 	LIST_FOREACH(vd, &pn->mn_vnodes, mv_link) {
750 		if (vd->mv_vnode->v_mount == mp) {
751 			vhold(vd->mv_vnode);
752 			sx_xunlock(&mqfs->mi_lock);
753 
754 			vgone(newvpp);
755 			vput(newvpp);
756 			goto found;
757 		}
758 	}
759 
760 	*vpp = newvpp;
761 
762 	vd = uma_zalloc(mvdata_zone, M_WAITOK);
763 	(*vpp)->v_data = vd;
764 	vd->mv_vnode = *vpp;
765 	vd->mv_node = pn;
766 	TASK_INIT(&vd->mv_task, 0, do_recycle, *vpp);
767 	LIST_INSERT_HEAD(&pn->mn_vnodes, vd, mv_link);
768 	mqnode_addref(pn);
769 	switch (pn->mn_type) {
770 	case mqfstype_root:
771 		(*vpp)->v_vflag = VV_ROOT;
772 		/* fall through */
773 	case mqfstype_dir:
774 	case mqfstype_this:
775 	case mqfstype_parent:
776 		(*vpp)->v_type = VDIR;
777 		break;
778 	case mqfstype_file:
779 		(*vpp)->v_type = VREG;
780 		break;
781 	case mqfstype_symlink:
782 		(*vpp)->v_type = VLNK;
783 		break;
784 	case mqfstype_none:
785 		KASSERT(0, ("mqfs_allocf called for null node\n"));
786 	default:
787 		panic("%s has unexpected type: %d", pn->mn_name, pn->mn_type);
788 	}
789 	sx_xunlock(&mqfs->mi_lock);
790 	return (0);
791 }
792 
793 /*
794  * Search a directory entry
795  */
796 static struct mqfs_node *
797 mqfs_search(struct mqfs_node *pd, const char *name, int len)
798 {
799 	struct mqfs_node *pn;
800 
801 	sx_assert(&pd->mn_info->mi_lock, SX_LOCKED);
802 	LIST_FOREACH(pn, &pd->mn_children, mn_sibling) {
803 		if (strncmp(pn->mn_name, name, len) == 0 &&
804 		    pn->mn_name[len] == '\0')
805 			return (pn);
806 	}
807 	return (NULL);
808 }
809 
810 /*
811  * Look up a file or directory.
812  */
813 static int
814 mqfs_lookupx(struct vop_cachedlookup_args *ap)
815 {
816 	struct componentname *cnp;
817 	struct vnode *dvp, **vpp;
818 	struct mqfs_node *pd;
819 	struct mqfs_node *pn;
820 	struct mqfs_info *mqfs;
821 	int nameiop, flags, error, namelen;
822 	char *pname;
823 	struct thread *td;
824 
825 	cnp = ap->a_cnp;
826 	vpp = ap->a_vpp;
827 	dvp = ap->a_dvp;
828 	pname = cnp->cn_nameptr;
829 	namelen = cnp->cn_namelen;
830 	td = cnp->cn_thread;
831 	flags = cnp->cn_flags;
832 	nameiop = cnp->cn_nameiop;
833 	pd = VTON(dvp);
834 	pn = NULL;
835 	mqfs = pd->mn_info;
836 	*vpp = NULLVP;
837 
838 	if (dvp->v_type != VDIR)
839 		return (ENOTDIR);
840 
841 	error = VOP_ACCESS(dvp, VEXEC, cnp->cn_cred, cnp->cn_thread);
842 	if (error)
843 		return (error);
844 
845 	/* shortcut: check if the name is too long */
846 	if (cnp->cn_namelen >= MQFS_NAMELEN)
847 		return (ENOENT);
848 
849 	/* self */
850 	if (namelen == 1 && pname[0] == '.') {
851 		if ((flags & ISLASTCN) && nameiop != LOOKUP)
852 			return (EINVAL);
853 		pn = pd;
854 		*vpp = dvp;
855 		VREF(dvp);
856 		return (0);
857 	}
858 
859 	/* parent */
860 	if (cnp->cn_flags & ISDOTDOT) {
861 		if (dvp->v_vflag & VV_ROOT)
862 			return (EIO);
863 		if ((flags & ISLASTCN) && nameiop != LOOKUP)
864 			return (EINVAL);
865 		VOP_UNLOCK(dvp, 0);
866 		KASSERT(pd->mn_parent, ("non-root directory has no parent"));
867 		pn = pd->mn_parent;
868 		error = mqfs_allocv(dvp->v_mount, vpp, pn);
869 		vn_lock(dvp, LK_EXCLUSIVE | LK_RETRY);
870 		return (error);
871 	}
872 
873 	/* named node */
874 	sx_xlock(&mqfs->mi_lock);
875 	pn = mqfs_search(pd, pname, namelen);
876 	if (pn != NULL)
877 		mqnode_addref(pn);
878 	sx_xunlock(&mqfs->mi_lock);
879 
880 	/* found */
881 	if (pn != NULL) {
882 		/* DELETE */
883 		if (nameiop == DELETE && (flags & ISLASTCN)) {
884 			error = VOP_ACCESS(dvp, VWRITE, cnp->cn_cred, td);
885 			if (error) {
886 				mqnode_release(pn);
887 				return (error);
888 			}
889 			if (*vpp == dvp) {
890 				VREF(dvp);
891 				*vpp = dvp;
892 				mqnode_release(pn);
893 				return (0);
894 			}
895 		}
896 
897 		/* allocate vnode */
898 		error = mqfs_allocv(dvp->v_mount, vpp, pn);
899 		mqnode_release(pn);
900 		if (error == 0 && cnp->cn_flags & MAKEENTRY)
901 			cache_enter(dvp, *vpp, cnp);
902 		return (error);
903 	}
904 
905 	/* not found */
906 
907 	/* will create a new entry in the directory ? */
908 	if ((nameiop == CREATE || nameiop == RENAME) && (flags & LOCKPARENT)
909 	    && (flags & ISLASTCN)) {
910 		error = VOP_ACCESS(dvp, VWRITE, cnp->cn_cred, td);
911 		if (error)
912 			return (error);
913 		cnp->cn_flags |= SAVENAME;
914 		return (EJUSTRETURN);
915 	}
916 	return (ENOENT);
917 }
918 
919 #if 0
920 struct vop_lookup_args {
921 	struct vop_generic_args a_gen;
922 	struct vnode *a_dvp;
923 	struct vnode **a_vpp;
924 	struct componentname *a_cnp;
925 };
926 #endif
927 
928 /*
929  * vnode lookup operation
930  */
931 static int
932 mqfs_lookup(struct vop_cachedlookup_args *ap)
933 {
934 	int rc;
935 
936 	rc = mqfs_lookupx(ap);
937 	return (rc);
938 }
939 
940 #if 0
941 struct vop_create_args {
942 	struct vnode *a_dvp;
943 	struct vnode **a_vpp;
944 	struct componentname *a_cnp;
945 	struct vattr *a_vap;
946 };
947 #endif
948 
949 /*
950  * vnode creation operation
951  */
952 static int
953 mqfs_create(struct vop_create_args *ap)
954 {
955 	struct mqfs_info *mqfs = VFSTOMQFS(ap->a_dvp->v_mount);
956 	struct componentname *cnp = ap->a_cnp;
957 	struct mqfs_node *pd;
958 	struct mqfs_node *pn;
959 	struct mqueue *mq;
960 	int error;
961 
962 	pd = VTON(ap->a_dvp);
963 	if (pd->mn_type != mqfstype_root && pd->mn_type != mqfstype_dir)
964 		return (ENOTDIR);
965 	mq = mqueue_alloc(NULL);
966 	if (mq == NULL)
967 		return (EAGAIN);
968 	sx_xlock(&mqfs->mi_lock);
969 	if ((cnp->cn_flags & HASBUF) == 0)
970 		panic("%s: no name", __func__);
971 	pn = mqfs_create_file(pd, cnp->cn_nameptr, cnp->cn_namelen,
972 		cnp->cn_cred, ap->a_vap->va_mode);
973 	if (pn == NULL) {
974 		sx_xunlock(&mqfs->mi_lock);
975 		error = ENOSPC;
976 	} else {
977 		mqnode_addref(pn);
978 		sx_xunlock(&mqfs->mi_lock);
979 		error = mqfs_allocv(ap->a_dvp->v_mount, ap->a_vpp, pn);
980 		mqnode_release(pn);
981 		if (error)
982 			mqfs_destroy(pn);
983 		else
984 			pn->mn_data = mq;
985 	}
986 	if (error)
987 		mqueue_free(mq);
988 	return (error);
989 }
990 
991 /*
992  * Remove an entry
993  */
994 static
995 int do_unlink(struct mqfs_node *pn, struct ucred *ucred)
996 {
997 	struct mqfs_node *parent;
998 	struct mqfs_vdata *vd;
999 	int error = 0;
1000 
1001 	sx_assert(&pn->mn_info->mi_lock, SX_LOCKED);
1002 
1003 	if (ucred->cr_uid != pn->mn_uid &&
1004 	    (error = priv_check_cred(ucred, PRIV_MQ_ADMIN, 0)) != 0)
1005 		error = EACCES;
1006 	else if (!pn->mn_deleted) {
1007 		parent = pn->mn_parent;
1008 		pn->mn_parent = NULL;
1009 		pn->mn_deleted = 1;
1010 		LIST_REMOVE(pn, mn_sibling);
1011 		LIST_FOREACH(vd, &pn->mn_vnodes, mv_link) {
1012 			cache_purge(vd->mv_vnode);
1013 			vhold(vd->mv_vnode);
1014 			taskqueue_enqueue(taskqueue_thread, &vd->mv_task);
1015 		}
1016 		mqnode_release(pn);
1017 		mqnode_release(parent);
1018 	} else
1019 		error = ENOENT;
1020 	return (error);
1021 }
1022 
1023 #if 0
1024 struct vop_remove_args {
1025 	struct vnode *a_dvp;
1026 	struct vnode *a_vp;
1027 	struct componentname *a_cnp;
1028 };
1029 #endif
1030 
1031 /*
1032  * vnode removal operation
1033  */
1034 static int
1035 mqfs_remove(struct vop_remove_args *ap)
1036 {
1037 	struct mqfs_info *mqfs = VFSTOMQFS(ap->a_dvp->v_mount);
1038 	struct mqfs_node *pn;
1039 	int error;
1040 
1041 	if (ap->a_vp->v_type == VDIR)
1042                 return (EPERM);
1043 	pn = VTON(ap->a_vp);
1044 	sx_xlock(&mqfs->mi_lock);
1045 	error = do_unlink(pn, ap->a_cnp->cn_cred);
1046 	sx_xunlock(&mqfs->mi_lock);
1047 	return (error);
1048 }
1049 
1050 #if 0
1051 struct vop_inactive_args {
1052 	struct vnode *a_vp;
1053 	struct thread *a_td;
1054 };
1055 #endif
1056 
1057 static int
1058 mqfs_inactive(struct vop_inactive_args *ap)
1059 {
1060 	struct mqfs_node *pn = VTON(ap->a_vp);
1061 
1062 	if (pn->mn_deleted)
1063 		vrecycle(ap->a_vp, ap->a_td);
1064 	return (0);
1065 }
1066 
1067 #if 0
1068 struct vop_reclaim_args {
1069 	struct vop_generic_args a_gen;
1070 	struct vnode *a_vp;
1071 	struct thread *a_td;
1072 };
1073 #endif
1074 
1075 static int
1076 mqfs_reclaim(struct vop_reclaim_args *ap)
1077 {
1078 	struct mqfs_info *mqfs = VFSTOMQFS(ap->a_vp->v_mount);
1079 	struct vnode *vp = ap->a_vp;
1080 	struct mqfs_node *pn;
1081 	struct mqfs_vdata *vd;
1082 
1083 	vd = vp->v_data;
1084 	pn = vd->mv_node;
1085 	sx_xlock(&mqfs->mi_lock);
1086 	vp->v_data = NULL;
1087 	LIST_REMOVE(vd, mv_link);
1088 	uma_zfree(mvdata_zone, vd);
1089 	mqnode_release(pn);
1090 	sx_xunlock(&mqfs->mi_lock);
1091 	return (0);
1092 }
1093 
1094 #if 0
1095 struct vop_open_args {
1096 	struct vop_generic_args a_gen;
1097 	struct vnode *a_vp;
1098 	int a_mode;
1099 	struct ucred *a_cred;
1100 	struct thread *a_td;
1101 	struct file *a_fp;
1102 };
1103 #endif
1104 
1105 static int
1106 mqfs_open(struct vop_open_args *ap)
1107 {
1108 	return (0);
1109 }
1110 
1111 #if 0
1112 struct vop_close_args {
1113 	struct vop_generic_args a_gen;
1114 	struct vnode *a_vp;
1115 	int a_fflag;
1116 	struct ucred *a_cred;
1117 	struct thread *a_td;
1118 };
1119 #endif
1120 
1121 static int
1122 mqfs_close(struct vop_close_args *ap)
1123 {
1124 	return (0);
1125 }
1126 
1127 #if 0
1128 struct vop_access_args {
1129 	struct vop_generic_args a_gen;
1130 	struct vnode *a_vp;
1131 	accmode_t a_accmode;
1132 	struct ucred *a_cred;
1133 	struct thread *a_td;
1134 };
1135 #endif
1136 
1137 /*
1138  * Verify permissions
1139  */
1140 static int
1141 mqfs_access(struct vop_access_args *ap)
1142 {
1143 	struct vnode *vp = ap->a_vp;
1144 	struct vattr vattr;
1145 	int error;
1146 
1147 	error = VOP_GETATTR(vp, &vattr, ap->a_cred);
1148 	if (error)
1149 		return (error);
1150 	error = vaccess(vp->v_type, vattr.va_mode, vattr.va_uid,
1151 	    vattr.va_gid, ap->a_accmode, ap->a_cred, NULL);
1152 	return (error);
1153 }
1154 
1155 #if 0
1156 struct vop_getattr_args {
1157 	struct vop_generic_args a_gen;
1158 	struct vnode *a_vp;
1159 	struct vattr *a_vap;
1160 	struct ucred *a_cred;
1161 };
1162 #endif
1163 
1164 /*
1165  * Get file attributes
1166  */
1167 static int
1168 mqfs_getattr(struct vop_getattr_args *ap)
1169 {
1170 	struct vnode *vp = ap->a_vp;
1171 	struct mqfs_node *pn = VTON(vp);
1172 	struct vattr *vap = ap->a_vap;
1173 	int error = 0;
1174 
1175 	vap->va_type = vp->v_type;
1176 	vap->va_mode = pn->mn_mode;
1177 	vap->va_nlink = 1;
1178 	vap->va_uid = pn->mn_uid;
1179 	vap->va_gid = pn->mn_gid;
1180 	vap->va_fsid = vp->v_mount->mnt_stat.f_fsid.val[0];
1181 	vap->va_fileid = pn->mn_fileno;
1182 	vap->va_size = 0;
1183 	vap->va_blocksize = PAGE_SIZE;
1184 	vap->va_bytes = vap->va_size = 0;
1185 	vap->va_atime = pn->mn_atime;
1186 	vap->va_mtime = pn->mn_mtime;
1187 	vap->va_ctime = pn->mn_ctime;
1188 	vap->va_birthtime = pn->mn_birth;
1189 	vap->va_gen = 0;
1190 	vap->va_flags = 0;
1191 	vap->va_rdev = NODEV;
1192 	vap->va_bytes = 0;
1193 	vap->va_filerev = 0;
1194 	return (error);
1195 }
1196 
1197 #if 0
1198 struct vop_setattr_args {
1199 	struct vop_generic_args a_gen;
1200 	struct vnode *a_vp;
1201 	struct vattr *a_vap;
1202 	struct ucred *a_cred;
1203 };
1204 #endif
1205 /*
1206  * Set attributes
1207  */
1208 static int
1209 mqfs_setattr(struct vop_setattr_args *ap)
1210 {
1211 	struct mqfs_node *pn;
1212 	struct vattr *vap;
1213 	struct vnode *vp;
1214 	struct thread *td;
1215 	int c, error;
1216 	uid_t uid;
1217 	gid_t gid;
1218 
1219 	td = curthread;
1220 	vap = ap->a_vap;
1221 	vp = ap->a_vp;
1222 	if ((vap->va_type != VNON) ||
1223 	    (vap->va_nlink != VNOVAL) ||
1224 	    (vap->va_fsid != VNOVAL) ||
1225 	    (vap->va_fileid != VNOVAL) ||
1226 	    (vap->va_blocksize != VNOVAL) ||
1227 	    (vap->va_flags != VNOVAL && vap->va_flags != 0) ||
1228 	    (vap->va_rdev != VNOVAL) ||
1229 	    ((int)vap->va_bytes != VNOVAL) ||
1230 	    (vap->va_gen != VNOVAL)) {
1231 		return (EINVAL);
1232 	}
1233 
1234 	pn = VTON(vp);
1235 
1236 	error = c = 0;
1237 	if (vap->va_uid == (uid_t)VNOVAL)
1238 		uid = pn->mn_uid;
1239 	else
1240 		uid = vap->va_uid;
1241 	if (vap->va_gid == (gid_t)VNOVAL)
1242 		gid = pn->mn_gid;
1243 	else
1244 		gid = vap->va_gid;
1245 
1246 	if (uid != pn->mn_uid || gid != pn->mn_gid) {
1247 		/*
1248 		 * To modify the ownership of a file, must possess VADMIN
1249 		 * for that file.
1250 		 */
1251 		if ((error = VOP_ACCESS(vp, VADMIN, ap->a_cred, td)))
1252 			return (error);
1253 
1254 		/*
1255 		 * XXXRW: Why is there a privilege check here: shouldn't the
1256 		 * check in VOP_ACCESS() be enough?  Also, are the group bits
1257 		 * below definitely right?
1258 		 */
1259 		if (((ap->a_cred->cr_uid != pn->mn_uid) || uid != pn->mn_uid ||
1260 		    (gid != pn->mn_gid && !groupmember(gid, ap->a_cred))) &&
1261 		    (error = priv_check(td, PRIV_MQ_ADMIN)) != 0)
1262 			return (error);
1263 		pn->mn_uid = uid;
1264 		pn->mn_gid = gid;
1265 		c = 1;
1266 	}
1267 
1268 	if (vap->va_mode != (mode_t)VNOVAL) {
1269 		if ((ap->a_cred->cr_uid != pn->mn_uid) &&
1270 		    (error = priv_check(td, PRIV_MQ_ADMIN)))
1271 			return (error);
1272 		pn->mn_mode = vap->va_mode;
1273 		c = 1;
1274 	}
1275 
1276 	if (vap->va_atime.tv_sec != VNOVAL || vap->va_mtime.tv_sec != VNOVAL) {
1277 		/* See the comment in ufs_vnops::ufs_setattr(). */
1278 		if ((error = VOP_ACCESS(vp, VADMIN, ap->a_cred, td)) &&
1279 		    ((vap->va_vaflags & VA_UTIMES_NULL) == 0 ||
1280 		    (error = VOP_ACCESS(vp, VWRITE, ap->a_cred, td))))
1281 			return (error);
1282 		if (vap->va_atime.tv_sec != VNOVAL) {
1283 			pn->mn_atime = vap->va_atime;
1284 		}
1285 		if (vap->va_mtime.tv_sec != VNOVAL) {
1286 			pn->mn_mtime = vap->va_mtime;
1287 		}
1288 		c = 1;
1289 	}
1290 	if (c) {
1291 		vfs_timestamp(&pn->mn_ctime);
1292 	}
1293 	return (0);
1294 }
1295 
1296 #if 0
1297 struct vop_read_args {
1298 	struct vop_generic_args a_gen;
1299 	struct vnode *a_vp;
1300 	struct uio *a_uio;
1301 	int a_ioflag;
1302 	struct ucred *a_cred;
1303 };
1304 #endif
1305 
1306 /*
1307  * Read from a file
1308  */
1309 static int
1310 mqfs_read(struct vop_read_args *ap)
1311 {
1312 	char buf[80];
1313 	struct vnode *vp = ap->a_vp;
1314 	struct uio *uio = ap->a_uio;
1315 	struct mqfs_node *pn;
1316 	struct mqueue *mq;
1317 	int len, error;
1318 
1319 	if (vp->v_type != VREG)
1320 		return (EINVAL);
1321 
1322 	pn = VTON(vp);
1323 	mq = VTOMQ(vp);
1324 	snprintf(buf, sizeof(buf),
1325 		"QSIZE:%-10ld MAXMSG:%-10ld CURMSG:%-10ld MSGSIZE:%-10ld\n",
1326 		mq->mq_totalbytes,
1327 		mq->mq_maxmsg,
1328 		mq->mq_curmsgs,
1329 		mq->mq_msgsize);
1330 	buf[sizeof(buf)-1] = '\0';
1331 	len = strlen(buf);
1332 	error = uiomove_frombuf(buf, len, uio);
1333 	return (error);
1334 }
1335 
1336 #if 0
1337 struct vop_readdir_args {
1338 	struct vop_generic_args a_gen;
1339 	struct vnode *a_vp;
1340 	struct uio *a_uio;
1341 	struct ucred *a_cred;
1342 	int *a_eofflag;
1343 	int *a_ncookies;
1344 	u_long **a_cookies;
1345 };
1346 #endif
1347 
1348 /*
1349  * Return directory entries.
1350  */
1351 static int
1352 mqfs_readdir(struct vop_readdir_args *ap)
1353 {
1354 	struct vnode *vp;
1355 	struct mqfs_info *mi;
1356 	struct mqfs_node *pd;
1357 	struct mqfs_node *pn;
1358 	struct dirent entry;
1359 	struct uio *uio;
1360 	int *tmp_ncookies = NULL;
1361 	off_t offset;
1362 	int error, i;
1363 
1364 	vp = ap->a_vp;
1365 	mi = VFSTOMQFS(vp->v_mount);
1366 	pd = VTON(vp);
1367 	uio = ap->a_uio;
1368 
1369 	if (vp->v_type != VDIR)
1370 		return (ENOTDIR);
1371 
1372 	if (uio->uio_offset < 0)
1373 		return (EINVAL);
1374 
1375 	if (ap->a_ncookies != NULL) {
1376 		tmp_ncookies = ap->a_ncookies;
1377 		*ap->a_ncookies = 0;
1378 		ap->a_ncookies = NULL;
1379         }
1380 
1381 	error = 0;
1382 	offset = 0;
1383 
1384 	sx_xlock(&mi->mi_lock);
1385 
1386 	LIST_FOREACH(pn, &pd->mn_children, mn_sibling) {
1387 		entry.d_reclen = sizeof(entry);
1388 		if (!pn->mn_fileno)
1389 			mqfs_fileno_alloc(mi, pn);
1390 		entry.d_fileno = pn->mn_fileno;
1391 		for (i = 0; i < MQFS_NAMELEN - 1 && pn->mn_name[i] != '\0'; ++i)
1392 			entry.d_name[i] = pn->mn_name[i];
1393 		entry.d_name[i] = 0;
1394 		entry.d_namlen = i;
1395 		switch (pn->mn_type) {
1396 		case mqfstype_root:
1397 		case mqfstype_dir:
1398 		case mqfstype_this:
1399 		case mqfstype_parent:
1400 			entry.d_type = DT_DIR;
1401 			break;
1402 		case mqfstype_file:
1403 			entry.d_type = DT_REG;
1404 			break;
1405 		case mqfstype_symlink:
1406 			entry.d_type = DT_LNK;
1407 			break;
1408 		default:
1409 			panic("%s has unexpected node type: %d", pn->mn_name,
1410 				pn->mn_type);
1411 		}
1412 		if (entry.d_reclen > uio->uio_resid)
1413                         break;
1414 		if (offset >= uio->uio_offset) {
1415 			error = vfs_read_dirent(ap, &entry, offset);
1416                         if (error)
1417                                 break;
1418                 }
1419                 offset += entry.d_reclen;
1420 	}
1421 	sx_xunlock(&mi->mi_lock);
1422 
1423 	uio->uio_offset = offset;
1424 
1425 	if (tmp_ncookies != NULL)
1426 		ap->a_ncookies = tmp_ncookies;
1427 
1428 	return (error);
1429 }
1430 
1431 #ifdef notyet
1432 
1433 #if 0
1434 struct vop_mkdir_args {
1435 	struct vnode *a_dvp;
1436 	struvt vnode **a_vpp;
1437 	struvt componentname *a_cnp;
1438 	struct vattr *a_vap;
1439 };
1440 #endif
1441 
1442 /*
1443  * Create a directory.
1444  */
1445 static int
1446 mqfs_mkdir(struct vop_mkdir_args *ap)
1447 {
1448 	struct mqfs_info *mqfs = VFSTOMQFS(ap->a_dvp->v_mount);
1449 	struct componentname *cnp = ap->a_cnp;
1450 	struct mqfs_node *pd = VTON(ap->a_dvp);
1451 	struct mqfs_node *pn;
1452 	int error;
1453 
1454 	if (pd->mn_type != mqfstype_root && pd->mn_type != mqfstype_dir)
1455 		return (ENOTDIR);
1456 	sx_xlock(&mqfs->mi_lock);
1457 	if ((cnp->cn_flags & HASBUF) == 0)
1458 		panic("%s: no name", __func__);
1459 	pn = mqfs_create_dir(pd, cnp->cn_nameptr, cnp->cn_namelen,
1460 		ap->a_vap->cn_cred, ap->a_vap->va_mode);
1461 	if (pn != NULL)
1462 		mqnode_addref(pn);
1463 	sx_xunlock(&mqfs->mi_lock);
1464 	if (pn == NULL) {
1465 		error = ENOSPC;
1466 	} else {
1467 		error = mqfs_allocv(ap->a_dvp->v_mount, ap->a_vpp, pn);
1468 		mqnode_release(pn);
1469 	}
1470 	return (error);
1471 }
1472 
1473 #if 0
1474 struct vop_rmdir_args {
1475 	struct vnode *a_dvp;
1476 	struct vnode *a_vp;
1477 	struct componentname *a_cnp;
1478 };
1479 #endif
1480 
1481 /*
1482  * Remove a directory.
1483  */
1484 static int
1485 mqfs_rmdir(struct vop_rmdir_args *ap)
1486 {
1487 	struct mqfs_info *mqfs = VFSTOMQFS(ap->a_dvp->v_mount);
1488 	struct mqfs_node *pn = VTON(ap->a_vp);
1489 	struct mqfs_node *pt;
1490 
1491 	if (pn->mn_type != mqfstype_dir)
1492 		return (ENOTDIR);
1493 
1494 	sx_xlock(&mqfs->mi_lock);
1495 	if (pn->mn_deleted) {
1496 		sx_xunlock(&mqfs->mi_lock);
1497 		return (ENOENT);
1498 	}
1499 
1500 	pt = LIST_FIRST(&pn->mn_children);
1501 	pt = LIST_NEXT(pt, mn_sibling);
1502 	pt = LIST_NEXT(pt, mn_sibling);
1503 	if (pt != NULL) {
1504 		sx_xunlock(&mqfs->mi_lock);
1505 		return (ENOTEMPTY);
1506 	}
1507 	pt = pn->mn_parent;
1508 	pn->mn_parent = NULL;
1509 	pn->mn_deleted = 1;
1510 	LIST_REMOVE(pn, mn_sibling);
1511 	mqnode_release(pn);
1512 	mqnode_release(pt);
1513 	sx_xunlock(&mqfs->mi_lock);
1514 	cache_purge(ap->a_vp);
1515 	return (0);
1516 }
1517 
1518 #endif /* notyet */
1519 
1520 /*
1521  * Allocate a message queue
1522  */
1523 static struct mqueue *
1524 mqueue_alloc(const struct mq_attr *attr)
1525 {
1526 	struct mqueue *mq;
1527 
1528 	if (curmq >= maxmq)
1529 		return (NULL);
1530 	mq = uma_zalloc(mqueue_zone, M_WAITOK | M_ZERO);
1531 	TAILQ_INIT(&mq->mq_msgq);
1532 	if (attr != NULL) {
1533 		mq->mq_maxmsg = attr->mq_maxmsg;
1534 		mq->mq_msgsize = attr->mq_msgsize;
1535 	} else {
1536 		mq->mq_maxmsg = default_maxmsg;
1537 		mq->mq_msgsize = default_msgsize;
1538 	}
1539 	mtx_init(&mq->mq_mutex, "mqueue lock", NULL, MTX_DEF);
1540 	knlist_init_mtx(&mq->mq_rsel.si_note, &mq->mq_mutex);
1541 	knlist_init_mtx(&mq->mq_wsel.si_note, &mq->mq_mutex);
1542 	atomic_add_int(&curmq, 1);
1543 	return (mq);
1544 }
1545 
1546 /*
1547  * Destroy a message queue
1548  */
1549 static void
1550 mqueue_free(struct mqueue *mq)
1551 {
1552 	struct mqueue_msg *msg;
1553 
1554 	while ((msg = TAILQ_FIRST(&mq->mq_msgq)) != NULL) {
1555 		TAILQ_REMOVE(&mq->mq_msgq, msg, msg_link);
1556 		free(msg, M_MQUEUEDATA);
1557 	}
1558 
1559 	mtx_destroy(&mq->mq_mutex);
1560 	knlist_destroy(&mq->mq_rsel.si_note);
1561 	knlist_destroy(&mq->mq_wsel.si_note);
1562 	uma_zfree(mqueue_zone, mq);
1563 	atomic_add_int(&curmq, -1);
1564 }
1565 
1566 /*
1567  * Load a message from user space
1568  */
1569 static struct mqueue_msg *
1570 mqueue_loadmsg(const char *msg_ptr, size_t msg_size, int msg_prio)
1571 {
1572 	struct mqueue_msg *msg;
1573 	size_t len;
1574 	int error;
1575 
1576 	len = sizeof(struct mqueue_msg) + msg_size;
1577 	msg = malloc(len, M_MQUEUEDATA, M_WAITOK);
1578 	error = copyin(msg_ptr, ((char *)msg) + sizeof(struct mqueue_msg),
1579 	    msg_size);
1580 	if (error) {
1581 		free(msg, M_MQUEUEDATA);
1582 		msg = NULL;
1583 	} else {
1584 		msg->msg_size = msg_size;
1585 		msg->msg_prio = msg_prio;
1586 	}
1587 	return (msg);
1588 }
1589 
1590 /*
1591  * Save a message to user space
1592  */
1593 static int
1594 mqueue_savemsg(struct mqueue_msg *msg, char *msg_ptr, int *msg_prio)
1595 {
1596 	int error;
1597 
1598 	error = copyout(((char *)msg) + sizeof(*msg), msg_ptr,
1599 		msg->msg_size);
1600 	if (error == 0 && msg_prio != NULL)
1601 		error = copyout(&msg->msg_prio, msg_prio, sizeof(int));
1602 	return (error);
1603 }
1604 
1605 /*
1606  * Free a message's memory
1607  */
1608 static __inline void
1609 mqueue_freemsg(struct mqueue_msg *msg)
1610 {
1611 	free(msg, M_MQUEUEDATA);
1612 }
1613 
1614 /*
1615  * Send a message. if waitok is false, thread will not be
1616  * blocked if there is no data in queue, otherwise, absolute
1617  * time will be checked.
1618  */
1619 int
1620 mqueue_send(struct mqueue *mq, const char *msg_ptr,
1621 	size_t msg_len, unsigned msg_prio, int waitok,
1622 	const struct timespec *abs_timeout)
1623 {
1624 	struct mqueue_msg *msg;
1625 	struct timespec ets, ts, ts2;
1626 	struct timeval tv;
1627 	int error;
1628 
1629 	if (msg_prio >= MQ_PRIO_MAX)
1630 		return (EINVAL);
1631 	if (msg_len > mq->mq_msgsize)
1632 		return (EMSGSIZE);
1633 	msg = mqueue_loadmsg(msg_ptr, msg_len, msg_prio);
1634 	if (msg == NULL)
1635 		return (EFAULT);
1636 
1637 	/* O_NONBLOCK case */
1638 	if (!waitok) {
1639 		error = _mqueue_send(mq, msg, -1);
1640 		if (error)
1641 			goto bad;
1642 		return (0);
1643 	}
1644 
1645 	/* we allow a null timeout (wait forever) */
1646 	if (abs_timeout == NULL) {
1647 		error = _mqueue_send(mq, msg, 0);
1648 		if (error)
1649 			goto bad;
1650 		return (0);
1651 	}
1652 
1653 	/* send it before checking time */
1654 	error = _mqueue_send(mq, msg, -1);
1655 	if (error == 0)
1656 		return (0);
1657 
1658 	if (error != EAGAIN)
1659 		goto bad;
1660 
1661 	error = copyin(abs_timeout, &ets, sizeof(ets));
1662 	if (error != 0)
1663 		goto bad;
1664 	if (ets.tv_nsec >= 1000000000 || ets.tv_nsec < 0) {
1665 		error = EINVAL;
1666 		goto bad;
1667 	}
1668 	for (;;) {
1669 		ts2 = ets;
1670 		getnanotime(&ts);
1671 		timespecsub(&ts2, &ts);
1672 		if (ts2.tv_sec < 0 || (ts2.tv_sec == 0 && ts2.tv_nsec <= 0)) {
1673 			error = ETIMEDOUT;
1674 			break;
1675 		}
1676 		TIMESPEC_TO_TIMEVAL(&tv, &ts2);
1677 		error = _mqueue_send(mq, msg, tvtohz(&tv));
1678 		if (error != ETIMEDOUT)
1679 			break;
1680 	}
1681 	if (error == 0)
1682 		return (0);
1683 bad:
1684 	mqueue_freemsg(msg);
1685 	return (error);
1686 }
1687 
1688 /*
1689  * Common routine to send a message
1690  */
1691 static int
1692 _mqueue_send(struct mqueue *mq, struct mqueue_msg *msg, int timo)
1693 {
1694 	struct mqueue_msg *msg2;
1695 	int error = 0;
1696 
1697 	mtx_lock(&mq->mq_mutex);
1698 	while (mq->mq_curmsgs >= mq->mq_maxmsg && error == 0) {
1699 		if (timo < 0) {
1700 			mtx_unlock(&mq->mq_mutex);
1701 			return (EAGAIN);
1702 		}
1703 		mq->mq_senders++;
1704 		error = msleep(&mq->mq_senders, &mq->mq_mutex,
1705 			    PCATCH, "mqsend", timo);
1706 		mq->mq_senders--;
1707 		if (error == EAGAIN)
1708 			error = ETIMEDOUT;
1709 	}
1710 	if (mq->mq_curmsgs >= mq->mq_maxmsg) {
1711 		mtx_unlock(&mq->mq_mutex);
1712 		return (error);
1713 	}
1714 	error = 0;
1715 	if (TAILQ_EMPTY(&mq->mq_msgq)) {
1716 		TAILQ_INSERT_HEAD(&mq->mq_msgq, msg, msg_link);
1717 	} else {
1718 		if (msg->msg_prio <= TAILQ_LAST(&mq->mq_msgq, msgq)->msg_prio) {
1719 			TAILQ_INSERT_TAIL(&mq->mq_msgq, msg, msg_link);
1720 		} else {
1721 			TAILQ_FOREACH(msg2, &mq->mq_msgq, msg_link) {
1722 				if (msg2->msg_prio < msg->msg_prio)
1723 					break;
1724 			}
1725 			TAILQ_INSERT_BEFORE(msg2, msg, msg_link);
1726 		}
1727 	}
1728 	mq->mq_curmsgs++;
1729 	mq->mq_totalbytes += msg->msg_size;
1730 	if (mq->mq_receivers)
1731 		wakeup_one(&mq->mq_receivers);
1732 	else if (mq->mq_notifier != NULL)
1733 		mqueue_send_notification(mq);
1734 	if (mq->mq_flags & MQ_RSEL) {
1735 		mq->mq_flags &= ~MQ_RSEL;
1736 		selwakeup(&mq->mq_rsel);
1737 	}
1738 	KNOTE_LOCKED(&mq->mq_rsel.si_note, 0);
1739 	mtx_unlock(&mq->mq_mutex);
1740 	return (0);
1741 }
1742 
1743 /*
1744  * Send realtime a signal to process which registered itself
1745  * successfully by mq_notify.
1746  */
1747 static void
1748 mqueue_send_notification(struct mqueue *mq)
1749 {
1750 	struct mqueue_notifier *nt;
1751 	struct proc *p;
1752 
1753 	mtx_assert(&mq->mq_mutex, MA_OWNED);
1754 	nt = mq->mq_notifier;
1755 	if (nt->nt_sigev.sigev_notify != SIGEV_NONE) {
1756 		p = nt->nt_proc;
1757 		PROC_LOCK(p);
1758 		if (!KSI_ONQ(&nt->nt_ksi))
1759 			psignal_event(p, &nt->nt_sigev, &nt->nt_ksi);
1760 		PROC_UNLOCK(p);
1761 	}
1762 	mq->mq_notifier = NULL;
1763 }
1764 
1765 /*
1766  * Get a message. if waitok is false, thread will not be
1767  * blocked if there is no data in queue, otherwise, absolute
1768  * time will be checked.
1769  */
1770 int
1771 mqueue_receive(struct mqueue *mq, char *msg_ptr,
1772 	size_t msg_len, unsigned *msg_prio, int waitok,
1773 	const struct timespec *abs_timeout)
1774 {
1775 	struct mqueue_msg *msg;
1776 	struct timespec ets, ts, ts2;
1777 	struct timeval tv;
1778 	int error;
1779 
1780 	if (msg_len < mq->mq_msgsize)
1781 		return (EMSGSIZE);
1782 
1783 	/* O_NONBLOCK case */
1784 	if (!waitok) {
1785 		error = _mqueue_recv(mq, &msg, -1);
1786 		if (error)
1787 			return (error);
1788 		goto received;
1789 	}
1790 
1791 	/* we allow a null timeout (wait forever). */
1792 	if (abs_timeout == NULL) {
1793 		error = _mqueue_recv(mq, &msg, 0);
1794 		if (error)
1795 			return (error);
1796 		goto received;
1797 	}
1798 
1799 	/* try to get a message before checking time */
1800 	error = _mqueue_recv(mq, &msg, -1);
1801 	if (error == 0)
1802 		goto received;
1803 
1804 	if (error != EAGAIN)
1805 		return (error);
1806 
1807 	error = copyin(abs_timeout, &ets, sizeof(ets));
1808 	if (error != 0)
1809 		return (error);
1810 	if (ets.tv_nsec >= 1000000000 || ets.tv_nsec < 0) {
1811 		error = EINVAL;
1812 		return (error);
1813 	}
1814 
1815 	for (;;) {
1816 		ts2 = ets;
1817 		getnanotime(&ts);
1818 		timespecsub(&ts2, &ts);
1819 		if (ts2.tv_sec < 0 || (ts2.tv_sec == 0 && ts2.tv_nsec <= 0)) {
1820 			error = ETIMEDOUT;
1821 			return (error);
1822 		}
1823 		TIMESPEC_TO_TIMEVAL(&tv, &ts2);
1824 		error = _mqueue_recv(mq, &msg, tvtohz(&tv));
1825 		if (error == 0)
1826 			break;
1827 		if (error != ETIMEDOUT)
1828 			return (error);
1829 	}
1830 
1831 received:
1832 	error = mqueue_savemsg(msg, msg_ptr, msg_prio);
1833 	if (error == 0) {
1834 		curthread->td_retval[0] = msg->msg_size;
1835 		curthread->td_retval[1] = 0;
1836 	}
1837 	mqueue_freemsg(msg);
1838 	return (error);
1839 }
1840 
1841 /*
1842  * Common routine to receive a message
1843  */
1844 static int
1845 _mqueue_recv(struct mqueue *mq, struct mqueue_msg **msg, int timo)
1846 {
1847 	int error = 0;
1848 
1849 	mtx_lock(&mq->mq_mutex);
1850 	while ((*msg = TAILQ_FIRST(&mq->mq_msgq)) == NULL && error == 0) {
1851 		if (timo < 0) {
1852 			mtx_unlock(&mq->mq_mutex);
1853 			return (EAGAIN);
1854 		}
1855 		mq->mq_receivers++;
1856 		error = msleep(&mq->mq_receivers, &mq->mq_mutex,
1857 			    PCATCH, "mqrecv", timo);
1858 		mq->mq_receivers--;
1859 		if (error == EAGAIN)
1860 			error = ETIMEDOUT;
1861 	}
1862 	if (*msg != NULL) {
1863 		error = 0;
1864 		TAILQ_REMOVE(&mq->mq_msgq, *msg, msg_link);
1865 		mq->mq_curmsgs--;
1866 		mq->mq_totalbytes -= (*msg)->msg_size;
1867 		if (mq->mq_senders)
1868 			wakeup_one(&mq->mq_senders);
1869 		if (mq->mq_flags & MQ_WSEL) {
1870 			mq->mq_flags &= ~MQ_WSEL;
1871 			selwakeup(&mq->mq_wsel);
1872 		}
1873 		KNOTE_LOCKED(&mq->mq_wsel.si_note, 0);
1874 	}
1875 	if (mq->mq_notifier != NULL && mq->mq_receivers == 0 &&
1876 	    !TAILQ_EMPTY(&mq->mq_msgq)) {
1877 		mqueue_send_notification(mq);
1878 	}
1879 	mtx_unlock(&mq->mq_mutex);
1880 	return (error);
1881 }
1882 
1883 static __inline struct mqueue_notifier *
1884 notifier_alloc(void)
1885 {
1886 	return (uma_zalloc(mqnoti_zone, M_WAITOK | M_ZERO));
1887 }
1888 
1889 static __inline void
1890 notifier_free(struct mqueue_notifier *p)
1891 {
1892 	uma_zfree(mqnoti_zone, p);
1893 }
1894 
1895 static struct mqueue_notifier *
1896 notifier_search(struct proc *p, int fd)
1897 {
1898 	struct mqueue_notifier *nt;
1899 
1900 	LIST_FOREACH(nt, &p->p_mqnotifier, nt_link) {
1901 		if (nt->nt_ksi.ksi_mqd == fd)
1902 			break;
1903 	}
1904 	return (nt);
1905 }
1906 
1907 static __inline void
1908 notifier_insert(struct proc *p, struct mqueue_notifier *nt)
1909 {
1910 	LIST_INSERT_HEAD(&p->p_mqnotifier, nt, nt_link);
1911 }
1912 
1913 static __inline void
1914 notifier_delete(struct proc *p, struct mqueue_notifier *nt)
1915 {
1916 	LIST_REMOVE(nt, nt_link);
1917 	notifier_free(nt);
1918 }
1919 
1920 static void
1921 notifier_remove(struct proc *p, struct mqueue *mq, int fd)
1922 {
1923 	struct mqueue_notifier *nt;
1924 
1925 	mtx_assert(&mq->mq_mutex, MA_OWNED);
1926 	PROC_LOCK(p);
1927 	nt = notifier_search(p, fd);
1928 	if (nt != NULL) {
1929 		if (mq->mq_notifier == nt)
1930 			mq->mq_notifier = NULL;
1931 		sigqueue_take(&nt->nt_ksi);
1932 		notifier_delete(p, nt);
1933 	}
1934 	PROC_UNLOCK(p);
1935 }
1936 
1937 /*
1938  * Syscall to open a message queue.
1939  */
1940 int
1941 kmq_open(struct thread *td, struct kmq_open_args *uap)
1942 {
1943 	char path[MQFS_NAMELEN + 1];
1944 	struct mq_attr attr, *pattr;
1945 	struct mqfs_node *pn;
1946 	struct filedesc *fdp;
1947 	struct file *fp;
1948 	struct mqueue *mq;
1949 	int fd, error, len, flags, cmode;
1950 
1951 	if ((uap->flags & O_ACCMODE) == O_ACCMODE)
1952 		return (EINVAL);
1953 
1954 	fdp = td->td_proc->p_fd;
1955 	flags = FFLAGS(uap->flags);
1956 	cmode = (((uap->mode & ~fdp->fd_cmask) & ALLPERMS) & ~S_ISTXT);
1957 	mq = NULL;
1958 	if ((flags & O_CREAT) && (uap->attr != NULL)) {
1959 		error = copyin(uap->attr, &attr, sizeof(attr));
1960 		if (error)
1961 			return (error);
1962 		if (attr.mq_maxmsg <= 0 || attr.mq_maxmsg > maxmsg)
1963 			return (EINVAL);
1964 		if (attr.mq_msgsize <= 0 || attr.mq_msgsize > maxmsgsize)
1965 			return (EINVAL);
1966 		pattr = &attr;
1967 	} else
1968 		pattr = NULL;
1969 
1970 	error = copyinstr(uap->path, path, MQFS_NAMELEN + 1, NULL);
1971         if (error)
1972 		return (error);
1973 
1974 	/*
1975 	 * The first character of name must be a slash  (/) character
1976 	 * and the remaining characters of name cannot include any slash
1977 	 * characters.
1978 	 */
1979 	len = strlen(path);
1980 	if (len < 2  || path[0] != '/' || index(path + 1, '/') != NULL)
1981 		return (EINVAL);
1982 
1983 	error = falloc(td, &fp, &fd);
1984 	if (error)
1985 		return (error);
1986 
1987 	sx_xlock(&mqfs_data.mi_lock);
1988 	pn = mqfs_search(mqfs_data.mi_root, path + 1, len - 1);
1989 	if (pn == NULL) {
1990 		if (!(flags & O_CREAT)) {
1991 			error = ENOENT;
1992 		} else {
1993 			mq = mqueue_alloc(pattr);
1994 			if (mq == NULL) {
1995 				error = ENFILE;
1996 			} else {
1997 				pn = mqfs_create_file(mqfs_data.mi_root,
1998 				         path + 1, len - 1, td->td_ucred,
1999 					 cmode);
2000 				if (pn == NULL) {
2001 					error = ENOSPC;
2002 					mqueue_free(mq);
2003 				}
2004 			}
2005 		}
2006 
2007 		if (error == 0) {
2008 			pn->mn_data = mq;
2009 		}
2010 	} else {
2011 		if ((flags & (O_CREAT | O_EXCL)) == (O_CREAT | O_EXCL)) {
2012 			error = EEXIST;
2013 		} else {
2014 			accmode_t accmode = 0;
2015 
2016 			if (flags & FREAD)
2017 				accmode |= VREAD;
2018 			if (flags & FWRITE)
2019 				accmode |= VWRITE;
2020 			error = vaccess(VREG, pn->mn_mode, pn->mn_uid,
2021 				    pn->mn_gid, accmode, td->td_ucred, NULL);
2022 		}
2023 	}
2024 
2025 	if (error) {
2026 		sx_xunlock(&mqfs_data.mi_lock);
2027 		fdclose(fdp, fp, fd, td);
2028 		fdrop(fp, td);
2029 		return (error);
2030 	}
2031 
2032 	mqnode_addref(pn);
2033 	sx_xunlock(&mqfs_data.mi_lock);
2034 
2035 	finit(fp, flags & (FREAD | FWRITE | O_NONBLOCK), DTYPE_MQUEUE, pn,
2036 	    &mqueueops);
2037 
2038 	FILEDESC_XLOCK(fdp);
2039 	if (fdp->fd_ofiles[fd] == fp)
2040 		fdp->fd_ofileflags[fd] |= UF_EXCLOSE;
2041 	FILEDESC_XUNLOCK(fdp);
2042 	td->td_retval[0] = fd;
2043 	fdrop(fp, td);
2044 	return (0);
2045 }
2046 
2047 /*
2048  * Syscall to unlink a message queue.
2049  */
2050 int
2051 kmq_unlink(struct thread *td, struct kmq_unlink_args *uap)
2052 {
2053 	char path[MQFS_NAMELEN+1];
2054 	struct mqfs_node *pn;
2055 	int error, len;
2056 
2057 	error = copyinstr(uap->path, path, MQFS_NAMELEN + 1, NULL);
2058         if (error)
2059 		return (error);
2060 
2061 	len = strlen(path);
2062 	if (len < 2  || path[0] != '/' || index(path + 1, '/') != NULL)
2063 		return (EINVAL);
2064 
2065 	sx_xlock(&mqfs_data.mi_lock);
2066 	pn = mqfs_search(mqfs_data.mi_root, path + 1, len - 1);
2067 	if (pn != NULL)
2068 		error = do_unlink(pn, td->td_ucred);
2069 	else
2070 		error = ENOENT;
2071 	sx_xunlock(&mqfs_data.mi_lock);
2072 	return (error);
2073 }
2074 
2075 typedef int (*_fgetf)(struct thread *, int, struct file **);
2076 
2077 /*
2078  * Get message queue by giving file slot
2079  */
2080 static int
2081 _getmq(struct thread *td, int fd, _fgetf func,
2082        struct file **fpp, struct mqfs_node **ppn, struct mqueue **pmq)
2083 {
2084 	struct mqfs_node *pn;
2085 	int error;
2086 
2087 	error = func(td, fd, fpp);
2088 	if (error)
2089 		return (error);
2090 	if (&mqueueops != (*fpp)->f_ops) {
2091 		fdrop(*fpp, td);
2092 		return (EBADF);
2093 	}
2094 	pn = (*fpp)->f_data;
2095 	if (ppn)
2096 		*ppn = pn;
2097 	if (pmq)
2098 		*pmq = pn->mn_data;
2099 	return (0);
2100 }
2101 
2102 static __inline int
2103 getmq(struct thread *td, int fd, struct file **fpp, struct mqfs_node **ppn,
2104 	struct mqueue **pmq)
2105 {
2106 	return _getmq(td, fd, fget, fpp, ppn, pmq);
2107 }
2108 
2109 static __inline int
2110 getmq_read(struct thread *td, int fd, struct file **fpp,
2111 	 struct mqfs_node **ppn, struct mqueue **pmq)
2112 {
2113 	return _getmq(td, fd, fget_read, fpp, ppn, pmq);
2114 }
2115 
2116 static __inline int
2117 getmq_write(struct thread *td, int fd, struct file **fpp,
2118 	struct mqfs_node **ppn, struct mqueue **pmq)
2119 {
2120 	return _getmq(td, fd, fget_write, fpp, ppn, pmq);
2121 }
2122 
2123 int
2124 kmq_setattr(struct thread *td, struct kmq_setattr_args *uap)
2125 {
2126 	struct mqueue *mq;
2127 	struct file *fp;
2128 	struct mq_attr attr, oattr;
2129 	u_int oflag, flag;
2130 	int error;
2131 
2132 	if (uap->attr) {
2133 		error = copyin(uap->attr, &attr, sizeof(attr));
2134 		if (error)
2135 			return (error);
2136 		if (attr.mq_flags & ~O_NONBLOCK)
2137 			return (EINVAL);
2138 	}
2139 	error = getmq(td, uap->mqd, &fp, NULL, &mq);
2140 	if (error)
2141 		return (error);
2142 	oattr.mq_maxmsg  = mq->mq_maxmsg;
2143 	oattr.mq_msgsize = mq->mq_msgsize;
2144 	oattr.mq_curmsgs = mq->mq_curmsgs;
2145 	if (uap->attr) {
2146 		do {
2147 			oflag = flag = fp->f_flag;
2148 			flag &= ~O_NONBLOCK;
2149 			flag |= (attr.mq_flags & O_NONBLOCK);
2150 		} while (atomic_cmpset_int(&fp->f_flag, oflag, flag) == 0);
2151 	} else
2152 		oflag = fp->f_flag;
2153 	oattr.mq_flags = (O_NONBLOCK & oflag);
2154 	fdrop(fp, td);
2155 	if (uap->oattr)
2156 		error = copyout(&oattr, uap->oattr, sizeof(oattr));
2157 	return (error);
2158 }
2159 
2160 int
2161 kmq_timedreceive(struct thread *td, struct kmq_timedreceive_args *uap)
2162 {
2163 	struct mqueue *mq;
2164 	struct file *fp;
2165 	int error;
2166 	int waitok;
2167 
2168 	error = getmq_read(td, uap->mqd, &fp, NULL, &mq);
2169 	if (error)
2170 		return (error);
2171 	waitok = !(fp->f_flag & O_NONBLOCK);
2172 	error = mqueue_receive(mq, uap->msg_ptr, uap->msg_len,
2173 		uap->msg_prio, waitok, uap->abs_timeout);
2174 	fdrop(fp, td);
2175 	return (error);
2176 }
2177 
2178 int
2179 kmq_timedsend(struct thread *td, struct kmq_timedsend_args *uap)
2180 {
2181 	struct mqueue *mq;
2182 	struct file *fp;
2183 	int error, waitok;
2184 
2185 	error = getmq_write(td, uap->mqd, &fp, NULL, &mq);
2186 	if (error)
2187 		return (error);
2188 	waitok = !(fp->f_flag & O_NONBLOCK);
2189 	error = mqueue_send(mq, uap->msg_ptr, uap->msg_len,
2190 		uap->msg_prio, waitok, uap->abs_timeout);
2191 	fdrop(fp, td);
2192 	return (error);
2193 }
2194 
2195 int
2196 kmq_notify(struct thread *td, struct kmq_notify_args *uap)
2197 {
2198 	struct sigevent ev;
2199 	struct filedesc *fdp;
2200 	struct proc *p;
2201 	struct mqueue *mq;
2202 	struct file *fp;
2203 	struct mqueue_notifier *nt, *newnt = NULL;
2204 	int error;
2205 
2206 	p = td->td_proc;
2207 	fdp = td->td_proc->p_fd;
2208 	if (uap->sigev) {
2209 		error = copyin(uap->sigev, &ev, sizeof(ev));
2210 		if (error)
2211 			return (error);
2212 		if (ev.sigev_notify != SIGEV_SIGNAL &&
2213 		    ev.sigev_notify != SIGEV_THREAD_ID &&
2214 		    ev.sigev_notify != SIGEV_NONE)
2215 			return (EINVAL);
2216 		if ((ev.sigev_notify == SIGEV_SIGNAL ||
2217 		     ev.sigev_notify == SIGEV_THREAD_ID) &&
2218 			!_SIG_VALID(ev.sigev_signo))
2219 			return (EINVAL);
2220 	}
2221 	error = getmq(td, uap->mqd, &fp, NULL, &mq);
2222 	if (error)
2223 		return (error);
2224 again:
2225 	FILEDESC_SLOCK(fdp);
2226 	if (fget_locked(fdp, uap->mqd) != fp) {
2227 		FILEDESC_SUNLOCK(fdp);
2228 		error = EBADF;
2229 		goto out;
2230 	}
2231 	mtx_lock(&mq->mq_mutex);
2232 	FILEDESC_SUNLOCK(fdp);
2233 	if (uap->sigev != NULL) {
2234 		if (mq->mq_notifier != NULL) {
2235 			error = EBUSY;
2236 		} else {
2237 			PROC_LOCK(p);
2238 			nt = notifier_search(p, uap->mqd);
2239 			if (nt == NULL) {
2240 				if (newnt == NULL) {
2241 					PROC_UNLOCK(p);
2242 					mtx_unlock(&mq->mq_mutex);
2243 					newnt = notifier_alloc();
2244 					goto again;
2245 				}
2246 			}
2247 
2248 			if (nt != NULL) {
2249 				sigqueue_take(&nt->nt_ksi);
2250 				if (newnt != NULL) {
2251 					notifier_free(newnt);
2252 					newnt = NULL;
2253 				}
2254 			} else {
2255 				nt = newnt;
2256 				newnt = NULL;
2257 				ksiginfo_init(&nt->nt_ksi);
2258 				nt->nt_ksi.ksi_flags |= KSI_INS | KSI_EXT;
2259 				nt->nt_ksi.ksi_code = SI_MESGQ;
2260 				nt->nt_proc = p;
2261 				nt->nt_ksi.ksi_mqd = uap->mqd;
2262 				notifier_insert(p, nt);
2263 			}
2264 			nt->nt_sigev = ev;
2265 			mq->mq_notifier = nt;
2266 			PROC_UNLOCK(p);
2267 			/*
2268 			 * if there is no receivers and message queue
2269 			 * is not empty, we should send notification
2270 			 * as soon as possible.
2271 			 */
2272 			if (mq->mq_receivers == 0 &&
2273 			    !TAILQ_EMPTY(&mq->mq_msgq))
2274 				mqueue_send_notification(mq);
2275 		}
2276 	} else {
2277 		notifier_remove(p, mq, uap->mqd);
2278 	}
2279 	mtx_unlock(&mq->mq_mutex);
2280 
2281 out:
2282 	fdrop(fp, td);
2283 	if (newnt != NULL)
2284 		notifier_free(newnt);
2285 	return (error);
2286 }
2287 
2288 static void
2289 mqueue_fdclose(struct thread *td, int fd, struct file *fp)
2290 {
2291 	struct filedesc *fdp;
2292 	struct mqueue *mq;
2293 
2294 	fdp = td->td_proc->p_fd;
2295 	FILEDESC_LOCK_ASSERT(fdp);
2296 
2297 	if (fp->f_ops == &mqueueops) {
2298 		mq = FPTOMQ(fp);
2299 		mtx_lock(&mq->mq_mutex);
2300 		notifier_remove(td->td_proc, mq, fd);
2301 
2302 		/* have to wakeup thread in same process */
2303 		if (mq->mq_flags & MQ_RSEL) {
2304 			mq->mq_flags &= ~MQ_RSEL;
2305 			selwakeup(&mq->mq_rsel);
2306 		}
2307 		if (mq->mq_flags & MQ_WSEL) {
2308 			mq->mq_flags &= ~MQ_WSEL;
2309 			selwakeup(&mq->mq_wsel);
2310 		}
2311 		mtx_unlock(&mq->mq_mutex);
2312 	}
2313 }
2314 
2315 static void
2316 mq_proc_exit(void *arg __unused, struct proc *p)
2317 {
2318 	struct filedesc *fdp;
2319 	struct file *fp;
2320 	struct mqueue *mq;
2321 	int i;
2322 
2323 	fdp = p->p_fd;
2324 	FILEDESC_SLOCK(fdp);
2325 	for (i = 0; i < fdp->fd_nfiles; ++i) {
2326 		fp = fget_locked(fdp, i);
2327 		if (fp != NULL && fp->f_ops == &mqueueops) {
2328 			mq = FPTOMQ(fp);
2329 			mtx_lock(&mq->mq_mutex);
2330 			notifier_remove(p, FPTOMQ(fp), i);
2331 			mtx_unlock(&mq->mq_mutex);
2332 		}
2333 	}
2334 	FILEDESC_SUNLOCK(fdp);
2335 	KASSERT(LIST_EMPTY(&p->p_mqnotifier), ("mq notifiers left"));
2336 }
2337 
2338 static int
2339 mqf_read(struct file *fp, struct uio *uio, struct ucred *active_cred,
2340 	int flags, struct thread *td)
2341 {
2342 	return (EOPNOTSUPP);
2343 }
2344 
2345 static int
2346 mqf_write(struct file *fp, struct uio *uio, struct ucred *active_cred,
2347 	int flags, struct thread *td)
2348 {
2349 	return (EOPNOTSUPP);
2350 }
2351 
2352 static int
2353 mqf_truncate(struct file *fp, off_t length, struct ucred *active_cred,
2354     struct thread *td)
2355 {
2356 
2357 	return (EINVAL);
2358 }
2359 
2360 static int
2361 mqf_ioctl(struct file *fp, u_long cmd, void *data,
2362 	struct ucred *active_cred, struct thread *td)
2363 {
2364 	return (ENOTTY);
2365 }
2366 
2367 static int
2368 mqf_poll(struct file *fp, int events, struct ucred *active_cred,
2369 	struct thread *td)
2370 {
2371 	struct mqueue *mq = FPTOMQ(fp);
2372 	int revents = 0;
2373 
2374 	mtx_lock(&mq->mq_mutex);
2375 	if (events & (POLLIN | POLLRDNORM)) {
2376 		if (mq->mq_curmsgs) {
2377 			revents |= events & (POLLIN | POLLRDNORM);
2378 		} else {
2379 			mq->mq_flags |= MQ_RSEL;
2380 			selrecord(td, &mq->mq_rsel);
2381  		}
2382 	}
2383 	if (events & POLLOUT) {
2384 		if (mq->mq_curmsgs < mq->mq_maxmsg)
2385 			revents |= POLLOUT;
2386 		else {
2387 			mq->mq_flags |= MQ_WSEL;
2388 			selrecord(td, &mq->mq_wsel);
2389 		}
2390 	}
2391 	mtx_unlock(&mq->mq_mutex);
2392 	return (revents);
2393 }
2394 
2395 static int
2396 mqf_close(struct file *fp, struct thread *td)
2397 {
2398 	struct mqfs_node *pn;
2399 
2400 	fp->f_ops = &badfileops;
2401 	pn = fp->f_data;
2402 	fp->f_data = NULL;
2403 	sx_xlock(&mqfs_data.mi_lock);
2404 	mqnode_release(pn);
2405 	sx_xunlock(&mqfs_data.mi_lock);
2406 	return (0);
2407 }
2408 
2409 static int
2410 mqf_stat(struct file *fp, struct stat *st, struct ucred *active_cred,
2411 	struct thread *td)
2412 {
2413 	struct mqfs_node *pn = fp->f_data;
2414 
2415 	bzero(st, sizeof *st);
2416 	st->st_atimespec = pn->mn_atime;
2417 	st->st_mtimespec = pn->mn_mtime;
2418 	st->st_ctimespec = pn->mn_ctime;
2419 	st->st_birthtimespec = pn->mn_birth;
2420 	st->st_uid = pn->mn_uid;
2421 	st->st_gid = pn->mn_gid;
2422 	st->st_mode = S_IFIFO | pn->mn_mode;
2423 	return (0);
2424 }
2425 
2426 static int
2427 mqf_kqfilter(struct file *fp, struct knote *kn)
2428 {
2429 	struct mqueue *mq = FPTOMQ(fp);
2430 	int error = 0;
2431 
2432 	if (kn->kn_filter == EVFILT_READ) {
2433 		kn->kn_fop = &mq_rfiltops;
2434 		knlist_add(&mq->mq_rsel.si_note, kn, 0);
2435 	} else if (kn->kn_filter == EVFILT_WRITE) {
2436 		kn->kn_fop = &mq_wfiltops;
2437 		knlist_add(&mq->mq_wsel.si_note, kn, 0);
2438 	} else
2439 		error = EINVAL;
2440 	return (error);
2441 }
2442 
2443 static void
2444 filt_mqdetach(struct knote *kn)
2445 {
2446 	struct mqueue *mq = FPTOMQ(kn->kn_fp);
2447 
2448 	if (kn->kn_filter == EVFILT_READ)
2449 		knlist_remove(&mq->mq_rsel.si_note, kn, 0);
2450 	else if (kn->kn_filter == EVFILT_WRITE)
2451 		knlist_remove(&mq->mq_wsel.si_note, kn, 0);
2452 	else
2453 		panic("filt_mqdetach");
2454 }
2455 
2456 static int
2457 filt_mqread(struct knote *kn, long hint)
2458 {
2459 	struct mqueue *mq = FPTOMQ(kn->kn_fp);
2460 
2461 	mtx_assert(&mq->mq_mutex, MA_OWNED);
2462 	return (mq->mq_curmsgs != 0);
2463 }
2464 
2465 static int
2466 filt_mqwrite(struct knote *kn, long hint)
2467 {
2468 	struct mqueue *mq = FPTOMQ(kn->kn_fp);
2469 
2470 	mtx_assert(&mq->mq_mutex, MA_OWNED);
2471 	return (mq->mq_curmsgs < mq->mq_maxmsg);
2472 }
2473 
2474 static struct fileops mqueueops = {
2475 	.fo_read		= mqf_read,
2476 	.fo_write		= mqf_write,
2477 	.fo_truncate		= mqf_truncate,
2478 	.fo_ioctl		= mqf_ioctl,
2479 	.fo_poll		= mqf_poll,
2480 	.fo_kqfilter		= mqf_kqfilter,
2481 	.fo_stat		= mqf_stat,
2482 	.fo_close		= mqf_close
2483 };
2484 
2485 static struct vop_vector mqfs_vnodeops = {
2486 	.vop_default 		= &default_vnodeops,
2487 	.vop_access		= mqfs_access,
2488 	.vop_cachedlookup	= mqfs_lookup,
2489 	.vop_lookup		= vfs_cache_lookup,
2490 	.vop_reclaim		= mqfs_reclaim,
2491 	.vop_create		= mqfs_create,
2492 	.vop_remove		= mqfs_remove,
2493 	.vop_inactive		= mqfs_inactive,
2494 	.vop_open		= mqfs_open,
2495 	.vop_close		= mqfs_close,
2496 	.vop_getattr		= mqfs_getattr,
2497 	.vop_setattr		= mqfs_setattr,
2498 	.vop_read		= mqfs_read,
2499 	.vop_write		= VOP_EOPNOTSUPP,
2500 	.vop_readdir		= mqfs_readdir,
2501 	.vop_mkdir		= VOP_EOPNOTSUPP,
2502 	.vop_rmdir		= VOP_EOPNOTSUPP
2503 };
2504 
2505 static struct vfsops mqfs_vfsops = {
2506 	.vfs_init 		= mqfs_init,
2507 	.vfs_uninit		= mqfs_uninit,
2508 	.vfs_mount		= mqfs_mount,
2509 	.vfs_unmount		= mqfs_unmount,
2510 	.vfs_root		= mqfs_root,
2511 	.vfs_statfs		= mqfs_statfs,
2512 };
2513 
2514 SYSCALL_MODULE_HELPER(kmq_open);
2515 SYSCALL_MODULE_HELPER(kmq_setattr);
2516 SYSCALL_MODULE_HELPER(kmq_timedsend);
2517 SYSCALL_MODULE_HELPER(kmq_timedreceive);
2518 SYSCALL_MODULE_HELPER(kmq_notify);
2519 SYSCALL_MODULE_HELPER(kmq_unlink);
2520 
2521 VFS_SET(mqfs_vfsops, mqueuefs, VFCF_SYNTHETIC);
2522 MODULE_VERSION(mqueuefs, 1);
2523