xref: /freebsd/sys/kern/uipc_mqueue.c (revision 2008043f386721d58158e37e0d7e50df8095942d)
1 /*-
2  * SPDX-License-Identifier: BSD-2-Clause
3  *
4  * Copyright (c) 2005 David Xu <davidxu@freebsd.org>
5  * Copyright (c) 2016-2017 Robert N. M. Watson
6  * All rights reserved.
7  *
8  * Portions of this software were developed by BAE Systems, the University of
9  * Cambridge Computer Laboratory, and Memorial University under DARPA/AFRL
10  * contract FA8650-15-C-7558 ("CADETS"), as part of the DARPA Transparent
11  * Computing (TC) research program.
12  *
13  * Redistribution and use in source and binary forms, with or without
14  * modification, are permitted provided that the following conditions
15  * are met:
16  * 1. Redistributions of source code must retain the above copyright
17  *    notice, this list of conditions and the following disclaimer.
18  * 2. Redistributions in binary form must reproduce the above copyright
19  *    notice, this list of conditions and the following disclaimer in the
20  *    documentation and/or other materials provided with the distribution.
21  *
22  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
23  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
24  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
25  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
26  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
27  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
28  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
29  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
30  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
31  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
32  * SUCH DAMAGE.
33  *
34  */
35 
36 /*
37  * POSIX message queue implementation.
38  *
39  * 1) A mqueue filesystem can be mounted, each message queue appears
40  *    in mounted directory, user can change queue's permission and
41  *    ownership, or remove a queue. Manually creating a file in the
42  *    directory causes a message queue to be created in the kernel with
43  *    default message queue attributes applied and same name used, this
44  *    method is not advocated since mq_open syscall allows user to specify
45  *    different attributes. Also the file system can be mounted multiple
46  *    times at different mount points but shows same contents.
47  *
48  * 2) Standard POSIX message queue API. The syscalls do not use vfs layer,
49  *    but directly operate on internal data structure, this allows user to
50  *    use the IPC facility without having to mount mqueue file system.
51  */
52 
53 #include <sys/cdefs.h>
54 #include "opt_capsicum.h"
55 
56 #include <sys/param.h>
57 #include <sys/kernel.h>
58 #include <sys/systm.h>
59 #include <sys/limits.h>
60 #include <sys/malloc.h>
61 #include <sys/buf.h>
62 #include <sys/capsicum.h>
63 #include <sys/dirent.h>
64 #include <sys/event.h>
65 #include <sys/eventhandler.h>
66 #include <sys/fcntl.h>
67 #include <sys/file.h>
68 #include <sys/filedesc.h>
69 #include <sys/jail.h>
70 #include <sys/lock.h>
71 #include <sys/module.h>
72 #include <sys/mount.h>
73 #include <sys/mqueue.h>
74 #include <sys/mutex.h>
75 #include <sys/namei.h>
76 #include <sys/posix4.h>
77 #include <sys/poll.h>
78 #include <sys/priv.h>
79 #include <sys/proc.h>
80 #include <sys/queue.h>
81 #include <sys/sysproto.h>
82 #include <sys/stat.h>
83 #include <sys/syscall.h>
84 #include <sys/syscallsubr.h>
85 #include <sys/sysent.h>
86 #include <sys/sx.h>
87 #include <sys/sysctl.h>
88 #include <sys/taskqueue.h>
89 #include <sys/unistd.h>
90 #include <sys/user.h>
91 #include <sys/vnode.h>
92 #include <machine/atomic.h>
93 
94 #include <security/audit/audit.h>
95 
96 FEATURE(p1003_1b_mqueue, "POSIX P1003.1B message queues support");
97 
98 /*
99  * Limits and constants
100  */
101 #define	MQFS_NAMELEN		NAME_MAX
102 #define MQFS_DELEN		(8 + MQFS_NAMELEN)
103 
104 /* node types */
105 typedef enum {
106 	mqfstype_none = 0,
107 	mqfstype_root,
108 	mqfstype_dir,
109 	mqfstype_this,
110 	mqfstype_parent,
111 	mqfstype_file,
112 	mqfstype_symlink,
113 } mqfs_type_t;
114 
115 struct mqfs_node;
116 
117 /*
118  * mqfs_info: describes a mqfs instance
119  */
120 struct mqfs_info {
121 	struct sx		mi_lock;
122 	struct mqfs_node	*mi_root;
123 	struct unrhdr		*mi_unrhdr;
124 };
125 
126 struct mqfs_vdata {
127 	LIST_ENTRY(mqfs_vdata)	mv_link;
128 	struct mqfs_node	*mv_node;
129 	struct vnode		*mv_vnode;
130 	struct task		mv_task;
131 };
132 
133 /*
134  * mqfs_node: describes a node (file or directory) within a mqfs
135  */
136 struct mqfs_node {
137 	char			mn_name[MQFS_NAMELEN+1];
138 	struct mqfs_info	*mn_info;
139 	struct mqfs_node	*mn_parent;
140 	LIST_HEAD(,mqfs_node)	mn_children;
141 	LIST_ENTRY(mqfs_node)	mn_sibling;
142 	LIST_HEAD(,mqfs_vdata)	mn_vnodes;
143 	const void		*mn_pr_root;
144 	int			mn_refcount;
145 	mqfs_type_t		mn_type;
146 	int			mn_deleted;
147 	uint32_t		mn_fileno;
148 	void			*mn_data;
149 	struct timespec		mn_birth;
150 	struct timespec		mn_ctime;
151 	struct timespec		mn_atime;
152 	struct timespec		mn_mtime;
153 	uid_t			mn_uid;
154 	gid_t			mn_gid;
155 	int			mn_mode;
156 };
157 
158 #define	VTON(vp)	(((struct mqfs_vdata *)((vp)->v_data))->mv_node)
159 #define VTOMQ(vp) 	((struct mqueue *)(VTON(vp)->mn_data))
160 #define	VFSTOMQFS(m)	((struct mqfs_info *)((m)->mnt_data))
161 #define	FPTOMQ(fp)	((struct mqueue *)(((struct mqfs_node *) \
162 				(fp)->f_data)->mn_data))
163 
164 TAILQ_HEAD(msgq, mqueue_msg);
165 
166 struct mqueue;
167 
168 struct mqueue_notifier {
169 	LIST_ENTRY(mqueue_notifier)	nt_link;
170 	struct sigevent			nt_sigev;
171 	ksiginfo_t			nt_ksi;
172 	struct proc			*nt_proc;
173 };
174 
175 struct mqueue {
176 	struct mtx	mq_mutex;
177 	int		mq_flags;
178 	long		mq_maxmsg;
179 	long		mq_msgsize;
180 	long		mq_curmsgs;
181 	long		mq_totalbytes;
182 	struct msgq	mq_msgq;
183 	int		mq_receivers;
184 	int		mq_senders;
185 	struct selinfo	mq_rsel;
186 	struct selinfo	mq_wsel;
187 	struct mqueue_notifier	*mq_notifier;
188 };
189 
190 #define	MQ_RSEL		0x01
191 #define	MQ_WSEL		0x02
192 
193 struct mqueue_msg {
194 	TAILQ_ENTRY(mqueue_msg)	msg_link;
195 	unsigned int	msg_prio;
196 	unsigned int	msg_size;
197 	/* following real data... */
198 };
199 
200 static SYSCTL_NODE(_kern, OID_AUTO, mqueue, CTLFLAG_RW | CTLFLAG_MPSAFE, 0,
201 	"POSIX real time message queue");
202 
203 static int	default_maxmsg  = 10;
204 static int	default_msgsize = 1024;
205 
206 static int	maxmsg = 100;
207 SYSCTL_INT(_kern_mqueue, OID_AUTO, maxmsg, CTLFLAG_RW,
208     &maxmsg, 0, "Default maximum messages in queue");
209 static int	maxmsgsize = 16384;
210 SYSCTL_INT(_kern_mqueue, OID_AUTO, maxmsgsize, CTLFLAG_RW,
211     &maxmsgsize, 0, "Default maximum message size");
212 static int	maxmq = 100;
213 SYSCTL_INT(_kern_mqueue, OID_AUTO, maxmq, CTLFLAG_RW,
214     &maxmq, 0, "maximum message queues");
215 static int	curmq = 0;
216 SYSCTL_INT(_kern_mqueue, OID_AUTO, curmq, CTLFLAG_RW,
217     &curmq, 0, "current message queue number");
218 static int	unloadable = 0;
219 static MALLOC_DEFINE(M_MQUEUEDATA, "mqdata", "mqueue data");
220 
221 static eventhandler_tag exit_tag;
222 
223 /* Only one instance per-system */
224 static struct mqfs_info		mqfs_data;
225 static uma_zone_t		mqnode_zone;
226 static uma_zone_t		mqueue_zone;
227 static uma_zone_t		mvdata_zone;
228 static uma_zone_t		mqnoti_zone;
229 static struct vop_vector	mqfs_vnodeops;
230 static struct fileops		mqueueops;
231 static unsigned			mqfs_osd_jail_slot;
232 
233 /*
234  * Directory structure construction and manipulation
235  */
236 #ifdef notyet
237 static struct mqfs_node	*mqfs_create_dir(struct mqfs_node *parent,
238 	const char *name, int namelen, struct ucred *cred, int mode);
239 static struct mqfs_node	*mqfs_create_link(struct mqfs_node *parent,
240 	const char *name, int namelen, struct ucred *cred, int mode);
241 #endif
242 
243 static struct mqfs_node	*mqfs_create_file(struct mqfs_node *parent,
244 	const char *name, int namelen, struct ucred *cred, int mode);
245 static int	mqfs_destroy(struct mqfs_node *mn);
246 static void	mqfs_fileno_alloc(struct mqfs_info *mi, struct mqfs_node *mn);
247 static void	mqfs_fileno_free(struct mqfs_info *mi, struct mqfs_node *mn);
248 static int	mqfs_allocv(struct mount *mp, struct vnode **vpp, struct mqfs_node *pn);
249 static int	mqfs_prison_remove(void *obj, void *data);
250 
251 /*
252  * Message queue construction and maniplation
253  */
254 static struct mqueue	*mqueue_alloc(const struct mq_attr *attr);
255 static void	mqueue_free(struct mqueue *mq);
256 static int	mqueue_send(struct mqueue *mq, const char *msg_ptr,
257 			size_t msg_len, unsigned msg_prio, int waitok,
258 			const struct timespec *abs_timeout);
259 static int	mqueue_receive(struct mqueue *mq, char *msg_ptr,
260 			size_t msg_len, unsigned *msg_prio, int waitok,
261 			const struct timespec *abs_timeout);
262 static int	_mqueue_send(struct mqueue *mq, struct mqueue_msg *msg,
263 			int timo);
264 static int	_mqueue_recv(struct mqueue *mq, struct mqueue_msg **msg,
265 			int timo);
266 static void	mqueue_send_notification(struct mqueue *mq);
267 static void	mqueue_fdclose(struct thread *td, int fd, struct file *fp);
268 static void	mq_proc_exit(void *arg, struct proc *p);
269 
270 /*
271  * kqueue filters
272  */
273 static void	filt_mqdetach(struct knote *kn);
274 static int	filt_mqread(struct knote *kn, long hint);
275 static int	filt_mqwrite(struct knote *kn, long hint);
276 
277 struct filterops mq_rfiltops = {
278 	.f_isfd = 1,
279 	.f_detach = filt_mqdetach,
280 	.f_event = filt_mqread,
281 };
282 struct filterops mq_wfiltops = {
283 	.f_isfd = 1,
284 	.f_detach = filt_mqdetach,
285 	.f_event = filt_mqwrite,
286 };
287 
288 /*
289  * Initialize fileno bitmap
290  */
291 static void
292 mqfs_fileno_init(struct mqfs_info *mi)
293 {
294 	struct unrhdr *up;
295 
296 	up = new_unrhdr(1, INT_MAX, NULL);
297 	mi->mi_unrhdr = up;
298 }
299 
300 /*
301  * Tear down fileno bitmap
302  */
303 static void
304 mqfs_fileno_uninit(struct mqfs_info *mi)
305 {
306 	struct unrhdr *up;
307 
308 	up = mi->mi_unrhdr;
309 	mi->mi_unrhdr = NULL;
310 	delete_unrhdr(up);
311 }
312 
313 /*
314  * Allocate a file number
315  */
316 static void
317 mqfs_fileno_alloc(struct mqfs_info *mi, struct mqfs_node *mn)
318 {
319 	/* make sure our parent has a file number */
320 	if (mn->mn_parent && !mn->mn_parent->mn_fileno)
321 		mqfs_fileno_alloc(mi, mn->mn_parent);
322 
323 	switch (mn->mn_type) {
324 	case mqfstype_root:
325 	case mqfstype_dir:
326 	case mqfstype_file:
327 	case mqfstype_symlink:
328 		mn->mn_fileno = alloc_unr(mi->mi_unrhdr);
329 		break;
330 	case mqfstype_this:
331 		KASSERT(mn->mn_parent != NULL,
332 		    ("mqfstype_this node has no parent"));
333 		mn->mn_fileno = mn->mn_parent->mn_fileno;
334 		break;
335 	case mqfstype_parent:
336 		KASSERT(mn->mn_parent != NULL,
337 		    ("mqfstype_parent node has no parent"));
338 		if (mn->mn_parent == mi->mi_root) {
339 			mn->mn_fileno = mn->mn_parent->mn_fileno;
340 			break;
341 		}
342 		KASSERT(mn->mn_parent->mn_parent != NULL,
343 		    ("mqfstype_parent node has no grandparent"));
344 		mn->mn_fileno = mn->mn_parent->mn_parent->mn_fileno;
345 		break;
346 	default:
347 		KASSERT(0,
348 		    ("mqfs_fileno_alloc() called for unknown type node: %d",
349 			mn->mn_type));
350 		break;
351 	}
352 }
353 
354 /*
355  * Release a file number
356  */
357 static void
358 mqfs_fileno_free(struct mqfs_info *mi, struct mqfs_node *mn)
359 {
360 	switch (mn->mn_type) {
361 	case mqfstype_root:
362 	case mqfstype_dir:
363 	case mqfstype_file:
364 	case mqfstype_symlink:
365 		free_unr(mi->mi_unrhdr, mn->mn_fileno);
366 		break;
367 	case mqfstype_this:
368 	case mqfstype_parent:
369 		/* ignore these, as they don't "own" their file number */
370 		break;
371 	default:
372 		KASSERT(0,
373 		    ("mqfs_fileno_free() called for unknown type node: %d",
374 			mn->mn_type));
375 		break;
376 	}
377 }
378 
379 static __inline struct mqfs_node *
380 mqnode_alloc(void)
381 {
382 	return uma_zalloc(mqnode_zone, M_WAITOK | M_ZERO);
383 }
384 
385 static __inline void
386 mqnode_free(struct mqfs_node *node)
387 {
388 	uma_zfree(mqnode_zone, node);
389 }
390 
391 static __inline void
392 mqnode_addref(struct mqfs_node *node)
393 {
394 	atomic_add_int(&node->mn_refcount, 1);
395 }
396 
397 static __inline void
398 mqnode_release(struct mqfs_node *node)
399 {
400 	struct mqfs_info *mqfs;
401 	int old, exp;
402 
403 	mqfs = node->mn_info;
404 	old = atomic_fetchadd_int(&node->mn_refcount, -1);
405 	if (node->mn_type == mqfstype_dir ||
406 	    node->mn_type == mqfstype_root)
407 		exp = 3; /* include . and .. */
408 	else
409 		exp = 1;
410 	if (old == exp) {
411 		int locked = sx_xlocked(&mqfs->mi_lock);
412 		if (!locked)
413 			sx_xlock(&mqfs->mi_lock);
414 		mqfs_destroy(node);
415 		if (!locked)
416 			sx_xunlock(&mqfs->mi_lock);
417 	}
418 }
419 
420 /*
421  * Add a node to a directory
422  */
423 static int
424 mqfs_add_node(struct mqfs_node *parent, struct mqfs_node *node)
425 {
426 	KASSERT(parent != NULL, ("%s(): parent is NULL", __func__));
427 	KASSERT(parent->mn_info != NULL,
428 	    ("%s(): parent has no mn_info", __func__));
429 	KASSERT(parent->mn_type == mqfstype_dir ||
430 	    parent->mn_type == mqfstype_root,
431 	    ("%s(): parent is not a directory", __func__));
432 
433 	node->mn_info = parent->mn_info;
434 	node->mn_parent = parent;
435 	LIST_INIT(&node->mn_children);
436 	LIST_INIT(&node->mn_vnodes);
437 	LIST_INSERT_HEAD(&parent->mn_children, node, mn_sibling);
438 	mqnode_addref(parent);
439 	return (0);
440 }
441 
442 static struct mqfs_node *
443 mqfs_create_node(const char *name, int namelen, struct ucred *cred, int mode,
444 	int nodetype)
445 {
446 	struct mqfs_node *node;
447 
448 	node = mqnode_alloc();
449 	strncpy(node->mn_name, name, namelen);
450 	node->mn_pr_root = cred->cr_prison->pr_root;
451 	node->mn_type = nodetype;
452 	node->mn_refcount = 1;
453 	vfs_timestamp(&node->mn_birth);
454 	node->mn_ctime = node->mn_atime = node->mn_mtime
455 		= node->mn_birth;
456 	node->mn_uid = cred->cr_uid;
457 	node->mn_gid = cred->cr_gid;
458 	node->mn_mode = mode;
459 	return (node);
460 }
461 
462 /*
463  * Create a file
464  */
465 static struct mqfs_node *
466 mqfs_create_file(struct mqfs_node *parent, const char *name, int namelen,
467 	struct ucred *cred, int mode)
468 {
469 	struct mqfs_node *node;
470 
471 	node = mqfs_create_node(name, namelen, cred, mode, mqfstype_file);
472 	if (mqfs_add_node(parent, node) != 0) {
473 		mqnode_free(node);
474 		return (NULL);
475 	}
476 	return (node);
477 }
478 
479 /*
480  * Add . and .. to a directory
481  */
482 static int
483 mqfs_fixup_dir(struct mqfs_node *parent)
484 {
485 	struct mqfs_node *dir;
486 
487 	dir = mqnode_alloc();
488 	dir->mn_name[0] = '.';
489 	dir->mn_type = mqfstype_this;
490 	dir->mn_refcount = 1;
491 	if (mqfs_add_node(parent, dir) != 0) {
492 		mqnode_free(dir);
493 		return (-1);
494 	}
495 
496 	dir = mqnode_alloc();
497 	dir->mn_name[0] = dir->mn_name[1] = '.';
498 	dir->mn_type = mqfstype_parent;
499 	dir->mn_refcount = 1;
500 
501 	if (mqfs_add_node(parent, dir) != 0) {
502 		mqnode_free(dir);
503 		return (-1);
504 	}
505 
506 	return (0);
507 }
508 
509 #ifdef notyet
510 
511 /*
512  * Create a directory
513  */
514 static struct mqfs_node *
515 mqfs_create_dir(struct mqfs_node *parent, const char *name, int namelen,
516 	struct ucred *cred, int mode)
517 {
518 	struct mqfs_node *node;
519 
520 	node = mqfs_create_node(name, namelen, cred, mode, mqfstype_dir);
521 	if (mqfs_add_node(parent, node) != 0) {
522 		mqnode_free(node);
523 		return (NULL);
524 	}
525 
526 	if (mqfs_fixup_dir(node) != 0) {
527 		mqfs_destroy(node);
528 		return (NULL);
529 	}
530 	return (node);
531 }
532 
533 /*
534  * Create a symlink
535  */
536 static struct mqfs_node *
537 mqfs_create_link(struct mqfs_node *parent, const char *name, int namelen,
538 	struct ucred *cred, int mode)
539 {
540 	struct mqfs_node *node;
541 
542 	node = mqfs_create_node(name, namelen, cred, mode, mqfstype_symlink);
543 	if (mqfs_add_node(parent, node) != 0) {
544 		mqnode_free(node);
545 		return (NULL);
546 	}
547 	return (node);
548 }
549 
550 #endif
551 
552 /*
553  * Destroy a node or a tree of nodes
554  */
555 static int
556 mqfs_destroy(struct mqfs_node *node)
557 {
558 	struct mqfs_node *parent;
559 
560 	KASSERT(node != NULL,
561 	    ("%s(): node is NULL", __func__));
562 	KASSERT(node->mn_info != NULL,
563 	    ("%s(): node has no mn_info", __func__));
564 
565 	/* destroy children */
566 	if (node->mn_type == mqfstype_dir || node->mn_type == mqfstype_root)
567 		while (! LIST_EMPTY(&node->mn_children))
568 			mqfs_destroy(LIST_FIRST(&node->mn_children));
569 
570 	/* unlink from parent */
571 	if ((parent = node->mn_parent) != NULL) {
572 		KASSERT(parent->mn_info == node->mn_info,
573 		    ("%s(): parent has different mn_info", __func__));
574 		LIST_REMOVE(node, mn_sibling);
575 	}
576 
577 	if (node->mn_fileno != 0)
578 		mqfs_fileno_free(node->mn_info, node);
579 	if (node->mn_data != NULL)
580 		mqueue_free(node->mn_data);
581 	mqnode_free(node);
582 	return (0);
583 }
584 
585 /*
586  * Mount a mqfs instance
587  */
588 static int
589 mqfs_mount(struct mount *mp)
590 {
591 	struct statfs *sbp;
592 
593 	if (mp->mnt_flag & MNT_UPDATE)
594 		return (EOPNOTSUPP);
595 
596 	mp->mnt_data = &mqfs_data;
597 	MNT_ILOCK(mp);
598 	mp->mnt_flag |= MNT_LOCAL;
599 	MNT_IUNLOCK(mp);
600 	vfs_getnewfsid(mp);
601 
602 	sbp = &mp->mnt_stat;
603 	vfs_mountedfrom(mp, "mqueue");
604 	sbp->f_bsize = PAGE_SIZE;
605 	sbp->f_iosize = PAGE_SIZE;
606 	sbp->f_blocks = 1;
607 	sbp->f_bfree = 0;
608 	sbp->f_bavail = 0;
609 	sbp->f_files = 1;
610 	sbp->f_ffree = 0;
611 	return (0);
612 }
613 
614 /*
615  * Unmount a mqfs instance
616  */
617 static int
618 mqfs_unmount(struct mount *mp, int mntflags)
619 {
620 	int error;
621 
622 	error = vflush(mp, 0, (mntflags & MNT_FORCE) ?  FORCECLOSE : 0,
623 	    curthread);
624 	return (error);
625 }
626 
627 /*
628  * Return a root vnode
629  */
630 static int
631 mqfs_root(struct mount *mp, int flags, struct vnode **vpp)
632 {
633 	struct mqfs_info *mqfs;
634 	int ret;
635 
636 	mqfs = VFSTOMQFS(mp);
637 	ret = mqfs_allocv(mp, vpp, mqfs->mi_root);
638 	return (ret);
639 }
640 
641 /*
642  * Return filesystem stats
643  */
644 static int
645 mqfs_statfs(struct mount *mp, struct statfs *sbp)
646 {
647 	/* XXX update statistics */
648 	return (0);
649 }
650 
651 /*
652  * Initialize a mqfs instance
653  */
654 static int
655 mqfs_init(struct vfsconf *vfc)
656 {
657 	struct mqfs_node *root;
658 	struct mqfs_info *mi;
659 	osd_method_t methods[PR_MAXMETHOD] = {
660 	    [PR_METHOD_REMOVE] = mqfs_prison_remove,
661 	};
662 
663 	mqnode_zone = uma_zcreate("mqnode", sizeof(struct mqfs_node),
664 		NULL, NULL, NULL, NULL, UMA_ALIGN_PTR, 0);
665 	mqueue_zone = uma_zcreate("mqueue", sizeof(struct mqueue),
666 		NULL, NULL, NULL, NULL, UMA_ALIGN_PTR, 0);
667 	mvdata_zone = uma_zcreate("mvdata",
668 		sizeof(struct mqfs_vdata), NULL, NULL, NULL,
669 		NULL, UMA_ALIGN_PTR, 0);
670 	mqnoti_zone = uma_zcreate("mqnotifier", sizeof(struct mqueue_notifier),
671 		NULL, NULL, NULL, NULL, UMA_ALIGN_PTR, 0);
672 	mi = &mqfs_data;
673 	sx_init(&mi->mi_lock, "mqfs lock");
674 	/* set up the root diretory */
675 	root = mqfs_create_node("/", 1, curthread->td_ucred, 01777,
676 		mqfstype_root);
677 	root->mn_info = mi;
678 	LIST_INIT(&root->mn_children);
679 	LIST_INIT(&root->mn_vnodes);
680 	mi->mi_root = root;
681 	mqfs_fileno_init(mi);
682 	mqfs_fileno_alloc(mi, root);
683 	mqfs_fixup_dir(root);
684 	exit_tag = EVENTHANDLER_REGISTER(process_exit, mq_proc_exit, NULL,
685 	    EVENTHANDLER_PRI_ANY);
686 	mq_fdclose = mqueue_fdclose;
687 	p31b_setcfg(CTL_P1003_1B_MESSAGE_PASSING, _POSIX_MESSAGE_PASSING);
688 	mqfs_osd_jail_slot = osd_jail_register(NULL, methods);
689 	return (0);
690 }
691 
692 /*
693  * Destroy a mqfs instance
694  */
695 static int
696 mqfs_uninit(struct vfsconf *vfc)
697 {
698 	struct mqfs_info *mi;
699 
700 	if (!unloadable)
701 		return (EOPNOTSUPP);
702 	osd_jail_deregister(mqfs_osd_jail_slot);
703 	EVENTHANDLER_DEREGISTER(process_exit, exit_tag);
704 	mi = &mqfs_data;
705 	mqfs_destroy(mi->mi_root);
706 	mi->mi_root = NULL;
707 	mqfs_fileno_uninit(mi);
708 	sx_destroy(&mi->mi_lock);
709 	uma_zdestroy(mqnode_zone);
710 	uma_zdestroy(mqueue_zone);
711 	uma_zdestroy(mvdata_zone);
712 	uma_zdestroy(mqnoti_zone);
713 	return (0);
714 }
715 
716 /*
717  * task routine
718  */
719 static void
720 do_recycle(void *context, int pending __unused)
721 {
722 	struct vnode *vp = (struct vnode *)context;
723 
724 	vn_lock(vp, LK_EXCLUSIVE | LK_RETRY);
725 	vrecycle(vp);
726 	VOP_UNLOCK(vp);
727 	vdrop(vp);
728 }
729 
730 /*
731  * Allocate a vnode
732  */
733 static int
734 mqfs_allocv(struct mount *mp, struct vnode **vpp, struct mqfs_node *pn)
735 {
736 	struct mqfs_vdata *vd;
737 	struct mqfs_info  *mqfs;
738 	struct vnode *newvpp;
739 	int error;
740 
741 	mqfs = pn->mn_info;
742 	*vpp = NULL;
743 	sx_xlock(&mqfs->mi_lock);
744 	LIST_FOREACH(vd, &pn->mn_vnodes, mv_link) {
745 		if (vd->mv_vnode->v_mount == mp) {
746 			vhold(vd->mv_vnode);
747 			break;
748 		}
749 	}
750 
751 	if (vd != NULL) {
752 found:
753 		*vpp = vd->mv_vnode;
754 		sx_xunlock(&mqfs->mi_lock);
755 		error = vget(*vpp, LK_RETRY | LK_EXCLUSIVE);
756 		vdrop(*vpp);
757 		return (error);
758 	}
759 	sx_xunlock(&mqfs->mi_lock);
760 
761 	error = getnewvnode("mqueue", mp, &mqfs_vnodeops, &newvpp);
762 	if (error)
763 		return (error);
764 	vn_lock(newvpp, LK_EXCLUSIVE | LK_RETRY);
765 	error = insmntque(newvpp, mp);
766 	if (error != 0)
767 		return (error);
768 
769 	sx_xlock(&mqfs->mi_lock);
770 	/*
771 	 * Check if it has already been allocated
772 	 * while we were blocked.
773 	 */
774 	LIST_FOREACH(vd, &pn->mn_vnodes, mv_link) {
775 		if (vd->mv_vnode->v_mount == mp) {
776 			vhold(vd->mv_vnode);
777 			sx_xunlock(&mqfs->mi_lock);
778 
779 			vgone(newvpp);
780 			vput(newvpp);
781 			goto found;
782 		}
783 	}
784 
785 	*vpp = newvpp;
786 
787 	vd = uma_zalloc(mvdata_zone, M_WAITOK);
788 	(*vpp)->v_data = vd;
789 	vd->mv_vnode = *vpp;
790 	vd->mv_node = pn;
791 	TASK_INIT(&vd->mv_task, 0, do_recycle, *vpp);
792 	LIST_INSERT_HEAD(&pn->mn_vnodes, vd, mv_link);
793 	mqnode_addref(pn);
794 	switch (pn->mn_type) {
795 	case mqfstype_root:
796 		(*vpp)->v_vflag = VV_ROOT;
797 		/* fall through */
798 	case mqfstype_dir:
799 	case mqfstype_this:
800 	case mqfstype_parent:
801 		(*vpp)->v_type = VDIR;
802 		break;
803 	case mqfstype_file:
804 		(*vpp)->v_type = VREG;
805 		break;
806 	case mqfstype_symlink:
807 		(*vpp)->v_type = VLNK;
808 		break;
809 	case mqfstype_none:
810 		KASSERT(0, ("mqfs_allocf called for null node\n"));
811 	default:
812 		panic("%s has unexpected type: %d", pn->mn_name, pn->mn_type);
813 	}
814 	sx_xunlock(&mqfs->mi_lock);
815 	return (0);
816 }
817 
818 /*
819  * Search a directory entry
820  */
821 static struct mqfs_node *
822 mqfs_search(struct mqfs_node *pd, const char *name, int len, struct ucred *cred)
823 {
824 	struct mqfs_node *pn;
825 	const void *pr_root;
826 
827 	sx_assert(&pd->mn_info->mi_lock, SX_LOCKED);
828 	pr_root = cred->cr_prison->pr_root;
829 	LIST_FOREACH(pn, &pd->mn_children, mn_sibling) {
830 		/* Only match names within the same prison root directory */
831 		if ((pn->mn_pr_root == NULL || pn->mn_pr_root == pr_root) &&
832 		    strncmp(pn->mn_name, name, len) == 0 &&
833 		    pn->mn_name[len] == '\0')
834 			return (pn);
835 	}
836 	return (NULL);
837 }
838 
839 /*
840  * Look up a file or directory.
841  */
842 static int
843 mqfs_lookupx(struct vop_cachedlookup_args *ap)
844 {
845 	struct componentname *cnp;
846 	struct vnode *dvp, **vpp;
847 	struct mqfs_node *pd;
848 	struct mqfs_node *pn;
849 	struct mqfs_info *mqfs;
850 	int nameiop, flags, error, namelen;
851 	char *pname;
852 	struct thread *td;
853 
854 	td = curthread;
855 	cnp = ap->a_cnp;
856 	vpp = ap->a_vpp;
857 	dvp = ap->a_dvp;
858 	pname = cnp->cn_nameptr;
859 	namelen = cnp->cn_namelen;
860 	flags = cnp->cn_flags;
861 	nameiop = cnp->cn_nameiop;
862 	pd = VTON(dvp);
863 	pn = NULL;
864 	mqfs = pd->mn_info;
865 	*vpp = NULLVP;
866 
867 	if (dvp->v_type != VDIR)
868 		return (ENOTDIR);
869 
870 	error = VOP_ACCESS(dvp, VEXEC, cnp->cn_cred, td);
871 	if (error)
872 		return (error);
873 
874 	/* shortcut: check if the name is too long */
875 	if (cnp->cn_namelen >= MQFS_NAMELEN)
876 		return (ENOENT);
877 
878 	/* self */
879 	if (namelen == 1 && pname[0] == '.') {
880 		if ((flags & ISLASTCN) && nameiop != LOOKUP)
881 			return (EINVAL);
882 		pn = pd;
883 		*vpp = dvp;
884 		VREF(dvp);
885 		return (0);
886 	}
887 
888 	/* parent */
889 	if (cnp->cn_flags & ISDOTDOT) {
890 		if (dvp->v_vflag & VV_ROOT)
891 			return (EIO);
892 		if ((flags & ISLASTCN) && nameiop != LOOKUP)
893 			return (EINVAL);
894 		VOP_UNLOCK(dvp);
895 		KASSERT(pd->mn_parent, ("non-root directory has no parent"));
896 		pn = pd->mn_parent;
897 		error = mqfs_allocv(dvp->v_mount, vpp, pn);
898 		vn_lock(dvp, LK_EXCLUSIVE | LK_RETRY);
899 		return (error);
900 	}
901 
902 	/* named node */
903 	sx_xlock(&mqfs->mi_lock);
904 	pn = mqfs_search(pd, pname, namelen, cnp->cn_cred);
905 	if (pn != NULL)
906 		mqnode_addref(pn);
907 	sx_xunlock(&mqfs->mi_lock);
908 
909 	/* found */
910 	if (pn != NULL) {
911 		/* DELETE */
912 		if (nameiop == DELETE && (flags & ISLASTCN)) {
913 			error = VOP_ACCESS(dvp, VWRITE, cnp->cn_cred, td);
914 			if (error) {
915 				mqnode_release(pn);
916 				return (error);
917 			}
918 			if (*vpp == dvp) {
919 				VREF(dvp);
920 				*vpp = dvp;
921 				mqnode_release(pn);
922 				return (0);
923 			}
924 		}
925 
926 		/* allocate vnode */
927 		error = mqfs_allocv(dvp->v_mount, vpp, pn);
928 		mqnode_release(pn);
929 		if (error == 0 && cnp->cn_flags & MAKEENTRY)
930 			cache_enter(dvp, *vpp, cnp);
931 		return (error);
932 	}
933 
934 	/* not found */
935 
936 	/* will create a new entry in the directory ? */
937 	if ((nameiop == CREATE || nameiop == RENAME) && (flags & LOCKPARENT)
938 	    && (flags & ISLASTCN)) {
939 		error = VOP_ACCESS(dvp, VWRITE, cnp->cn_cred, td);
940 		if (error)
941 			return (error);
942 		return (EJUSTRETURN);
943 	}
944 	return (ENOENT);
945 }
946 
947 #if 0
948 struct vop_lookup_args {
949 	struct vop_generic_args a_gen;
950 	struct vnode *a_dvp;
951 	struct vnode **a_vpp;
952 	struct componentname *a_cnp;
953 };
954 #endif
955 
956 /*
957  * vnode lookup operation
958  */
959 static int
960 mqfs_lookup(struct vop_cachedlookup_args *ap)
961 {
962 	int rc;
963 
964 	rc = mqfs_lookupx(ap);
965 	return (rc);
966 }
967 
968 #if 0
969 struct vop_create_args {
970 	struct vnode *a_dvp;
971 	struct vnode **a_vpp;
972 	struct componentname *a_cnp;
973 	struct vattr *a_vap;
974 };
975 #endif
976 
977 /*
978  * vnode creation operation
979  */
980 static int
981 mqfs_create(struct vop_create_args *ap)
982 {
983 	struct mqfs_info *mqfs = VFSTOMQFS(ap->a_dvp->v_mount);
984 	struct componentname *cnp = ap->a_cnp;
985 	struct mqfs_node *pd;
986 	struct mqfs_node *pn;
987 	struct mqueue *mq;
988 	int error;
989 
990 	pd = VTON(ap->a_dvp);
991 	if (pd->mn_type != mqfstype_root && pd->mn_type != mqfstype_dir)
992 		return (ENOTDIR);
993 	mq = mqueue_alloc(NULL);
994 	if (mq == NULL)
995 		return (EAGAIN);
996 	sx_xlock(&mqfs->mi_lock);
997 	pn = mqfs_create_file(pd, cnp->cn_nameptr, cnp->cn_namelen,
998 		cnp->cn_cred, ap->a_vap->va_mode);
999 	if (pn == NULL) {
1000 		sx_xunlock(&mqfs->mi_lock);
1001 		error = ENOSPC;
1002 	} else {
1003 		mqnode_addref(pn);
1004 		sx_xunlock(&mqfs->mi_lock);
1005 		error = mqfs_allocv(ap->a_dvp->v_mount, ap->a_vpp, pn);
1006 		mqnode_release(pn);
1007 		if (error)
1008 			mqfs_destroy(pn);
1009 		else
1010 			pn->mn_data = mq;
1011 	}
1012 	if (error)
1013 		mqueue_free(mq);
1014 	return (error);
1015 }
1016 
1017 /*
1018  * Remove an entry
1019  */
1020 static
1021 int do_unlink(struct mqfs_node *pn, struct ucred *ucred)
1022 {
1023 	struct mqfs_node *parent;
1024 	struct mqfs_vdata *vd;
1025 	int error = 0;
1026 
1027 	sx_assert(&pn->mn_info->mi_lock, SX_LOCKED);
1028 
1029 	if (ucred->cr_uid != pn->mn_uid &&
1030 	    (error = priv_check_cred(ucred, PRIV_MQ_ADMIN)) != 0)
1031 		error = EACCES;
1032 	else if (!pn->mn_deleted) {
1033 		parent = pn->mn_parent;
1034 		pn->mn_parent = NULL;
1035 		pn->mn_deleted = 1;
1036 		LIST_REMOVE(pn, mn_sibling);
1037 		LIST_FOREACH(vd, &pn->mn_vnodes, mv_link) {
1038 			cache_purge(vd->mv_vnode);
1039 			vhold(vd->mv_vnode);
1040 			taskqueue_enqueue(taskqueue_thread, &vd->mv_task);
1041 		}
1042 		mqnode_release(pn);
1043 		mqnode_release(parent);
1044 	} else
1045 		error = ENOENT;
1046 	return (error);
1047 }
1048 
1049 #if 0
1050 struct vop_remove_args {
1051 	struct vnode *a_dvp;
1052 	struct vnode *a_vp;
1053 	struct componentname *a_cnp;
1054 };
1055 #endif
1056 
1057 /*
1058  * vnode removal operation
1059  */
1060 static int
1061 mqfs_remove(struct vop_remove_args *ap)
1062 {
1063 	struct mqfs_info *mqfs = VFSTOMQFS(ap->a_dvp->v_mount);
1064 	struct mqfs_node *pn;
1065 	int error;
1066 
1067 	if (ap->a_vp->v_type == VDIR)
1068                 return (EPERM);
1069 	pn = VTON(ap->a_vp);
1070 	sx_xlock(&mqfs->mi_lock);
1071 	error = do_unlink(pn, ap->a_cnp->cn_cred);
1072 	sx_xunlock(&mqfs->mi_lock);
1073 	return (error);
1074 }
1075 
1076 #if 0
1077 struct vop_inactive_args {
1078 	struct vnode *a_vp;
1079 	struct thread *a_td;
1080 };
1081 #endif
1082 
1083 static int
1084 mqfs_inactive(struct vop_inactive_args *ap)
1085 {
1086 	struct mqfs_node *pn = VTON(ap->a_vp);
1087 
1088 	if (pn->mn_deleted)
1089 		vrecycle(ap->a_vp);
1090 	return (0);
1091 }
1092 
1093 #if 0
1094 struct vop_reclaim_args {
1095 	struct vop_generic_args a_gen;
1096 	struct vnode *a_vp;
1097 };
1098 #endif
1099 
1100 static int
1101 mqfs_reclaim(struct vop_reclaim_args *ap)
1102 {
1103 	struct mqfs_info *mqfs = VFSTOMQFS(ap->a_vp->v_mount);
1104 	struct vnode *vp = ap->a_vp;
1105 	struct mqfs_node *pn;
1106 	struct mqfs_vdata *vd;
1107 
1108 	vd = vp->v_data;
1109 	pn = vd->mv_node;
1110 	sx_xlock(&mqfs->mi_lock);
1111 	vp->v_data = NULL;
1112 	LIST_REMOVE(vd, mv_link);
1113 	uma_zfree(mvdata_zone, vd);
1114 	mqnode_release(pn);
1115 	sx_xunlock(&mqfs->mi_lock);
1116 	return (0);
1117 }
1118 
1119 #if 0
1120 struct vop_open_args {
1121 	struct vop_generic_args a_gen;
1122 	struct vnode *a_vp;
1123 	int a_mode;
1124 	struct ucred *a_cred;
1125 	struct thread *a_td;
1126 	struct file *a_fp;
1127 };
1128 #endif
1129 
1130 static int
1131 mqfs_open(struct vop_open_args *ap)
1132 {
1133 	return (0);
1134 }
1135 
1136 #if 0
1137 struct vop_close_args {
1138 	struct vop_generic_args a_gen;
1139 	struct vnode *a_vp;
1140 	int a_fflag;
1141 	struct ucred *a_cred;
1142 	struct thread *a_td;
1143 };
1144 #endif
1145 
1146 static int
1147 mqfs_close(struct vop_close_args *ap)
1148 {
1149 	return (0);
1150 }
1151 
1152 #if 0
1153 struct vop_access_args {
1154 	struct vop_generic_args a_gen;
1155 	struct vnode *a_vp;
1156 	accmode_t a_accmode;
1157 	struct ucred *a_cred;
1158 	struct thread *a_td;
1159 };
1160 #endif
1161 
1162 /*
1163  * Verify permissions
1164  */
1165 static int
1166 mqfs_access(struct vop_access_args *ap)
1167 {
1168 	struct vnode *vp = ap->a_vp;
1169 	struct vattr vattr;
1170 	int error;
1171 
1172 	error = VOP_GETATTR(vp, &vattr, ap->a_cred);
1173 	if (error)
1174 		return (error);
1175 	error = vaccess(vp->v_type, vattr.va_mode, vattr.va_uid, vattr.va_gid,
1176 	    ap->a_accmode, ap->a_cred);
1177 	return (error);
1178 }
1179 
1180 #if 0
1181 struct vop_getattr_args {
1182 	struct vop_generic_args a_gen;
1183 	struct vnode *a_vp;
1184 	struct vattr *a_vap;
1185 	struct ucred *a_cred;
1186 };
1187 #endif
1188 
1189 /*
1190  * Get file attributes
1191  */
1192 static int
1193 mqfs_getattr(struct vop_getattr_args *ap)
1194 {
1195 	struct vnode *vp = ap->a_vp;
1196 	struct mqfs_node *pn = VTON(vp);
1197 	struct vattr *vap = ap->a_vap;
1198 	int error = 0;
1199 
1200 	vap->va_type = vp->v_type;
1201 	vap->va_mode = pn->mn_mode;
1202 	vap->va_nlink = 1;
1203 	vap->va_uid = pn->mn_uid;
1204 	vap->va_gid = pn->mn_gid;
1205 	vap->va_fsid = vp->v_mount->mnt_stat.f_fsid.val[0];
1206 	vap->va_fileid = pn->mn_fileno;
1207 	vap->va_size = 0;
1208 	vap->va_blocksize = PAGE_SIZE;
1209 	vap->va_bytes = vap->va_size = 0;
1210 	vap->va_atime = pn->mn_atime;
1211 	vap->va_mtime = pn->mn_mtime;
1212 	vap->va_ctime = pn->mn_ctime;
1213 	vap->va_birthtime = pn->mn_birth;
1214 	vap->va_gen = 0;
1215 	vap->va_flags = 0;
1216 	vap->va_rdev = NODEV;
1217 	vap->va_bytes = 0;
1218 	vap->va_filerev = 0;
1219 	return (error);
1220 }
1221 
1222 #if 0
1223 struct vop_setattr_args {
1224 	struct vop_generic_args a_gen;
1225 	struct vnode *a_vp;
1226 	struct vattr *a_vap;
1227 	struct ucred *a_cred;
1228 };
1229 #endif
1230 /*
1231  * Set attributes
1232  */
1233 static int
1234 mqfs_setattr(struct vop_setattr_args *ap)
1235 {
1236 	struct mqfs_node *pn;
1237 	struct vattr *vap;
1238 	struct vnode *vp;
1239 	struct thread *td;
1240 	int c, error;
1241 	uid_t uid;
1242 	gid_t gid;
1243 
1244 	td = curthread;
1245 	vap = ap->a_vap;
1246 	vp = ap->a_vp;
1247 	if ((vap->va_type != VNON) ||
1248 	    (vap->va_nlink != VNOVAL) ||
1249 	    (vap->va_fsid != VNOVAL) ||
1250 	    (vap->va_fileid != VNOVAL) ||
1251 	    (vap->va_blocksize != VNOVAL) ||
1252 	    (vap->va_flags != VNOVAL && vap->va_flags != 0) ||
1253 	    (vap->va_rdev != VNOVAL) ||
1254 	    ((int)vap->va_bytes != VNOVAL) ||
1255 	    (vap->va_gen != VNOVAL)) {
1256 		return (EINVAL);
1257 	}
1258 
1259 	pn = VTON(vp);
1260 
1261 	error = c = 0;
1262 	if (vap->va_uid == (uid_t)VNOVAL)
1263 		uid = pn->mn_uid;
1264 	else
1265 		uid = vap->va_uid;
1266 	if (vap->va_gid == (gid_t)VNOVAL)
1267 		gid = pn->mn_gid;
1268 	else
1269 		gid = vap->va_gid;
1270 
1271 	if (uid != pn->mn_uid || gid != pn->mn_gid) {
1272 		/*
1273 		 * To modify the ownership of a file, must possess VADMIN
1274 		 * for that file.
1275 		 */
1276 		if ((error = VOP_ACCESS(vp, VADMIN, ap->a_cred, td)))
1277 			return (error);
1278 
1279 		/*
1280 		 * XXXRW: Why is there a privilege check here: shouldn't the
1281 		 * check in VOP_ACCESS() be enough?  Also, are the group bits
1282 		 * below definitely right?
1283 		 */
1284 		if (((ap->a_cred->cr_uid != pn->mn_uid) || uid != pn->mn_uid ||
1285 		    (gid != pn->mn_gid && !groupmember(gid, ap->a_cred))) &&
1286 		    (error = priv_check(td, PRIV_MQ_ADMIN)) != 0)
1287 			return (error);
1288 		pn->mn_uid = uid;
1289 		pn->mn_gid = gid;
1290 		c = 1;
1291 	}
1292 
1293 	if (vap->va_mode != (mode_t)VNOVAL) {
1294 		if ((ap->a_cred->cr_uid != pn->mn_uid) &&
1295 		    (error = priv_check(td, PRIV_MQ_ADMIN)))
1296 			return (error);
1297 		pn->mn_mode = vap->va_mode;
1298 		c = 1;
1299 	}
1300 
1301 	if (vap->va_atime.tv_sec != VNOVAL || vap->va_mtime.tv_sec != VNOVAL) {
1302 		/* See the comment in ufs_vnops::ufs_setattr(). */
1303 		if ((error = VOP_ACCESS(vp, VADMIN, ap->a_cred, td)) &&
1304 		    ((vap->va_vaflags & VA_UTIMES_NULL) == 0 ||
1305 		    (error = VOP_ACCESS(vp, VWRITE, ap->a_cred, td))))
1306 			return (error);
1307 		if (vap->va_atime.tv_sec != VNOVAL) {
1308 			pn->mn_atime = vap->va_atime;
1309 		}
1310 		if (vap->va_mtime.tv_sec != VNOVAL) {
1311 			pn->mn_mtime = vap->va_mtime;
1312 		}
1313 		c = 1;
1314 	}
1315 	if (c) {
1316 		vfs_timestamp(&pn->mn_ctime);
1317 	}
1318 	return (0);
1319 }
1320 
1321 #if 0
1322 struct vop_read_args {
1323 	struct vop_generic_args a_gen;
1324 	struct vnode *a_vp;
1325 	struct uio *a_uio;
1326 	int a_ioflag;
1327 	struct ucred *a_cred;
1328 };
1329 #endif
1330 
1331 /*
1332  * Read from a file
1333  */
1334 static int
1335 mqfs_read(struct vop_read_args *ap)
1336 {
1337 	char buf[80];
1338 	struct vnode *vp = ap->a_vp;
1339 	struct uio *uio = ap->a_uio;
1340 	struct mqueue *mq;
1341 	int len, error;
1342 
1343 	if (vp->v_type != VREG)
1344 		return (EINVAL);
1345 
1346 	mq = VTOMQ(vp);
1347 	snprintf(buf, sizeof(buf),
1348 		"QSIZE:%-10ld MAXMSG:%-10ld CURMSG:%-10ld MSGSIZE:%-10ld\n",
1349 		mq->mq_totalbytes,
1350 		mq->mq_maxmsg,
1351 		mq->mq_curmsgs,
1352 		mq->mq_msgsize);
1353 	buf[sizeof(buf)-1] = '\0';
1354 	len = strlen(buf);
1355 	error = uiomove_frombuf(buf, len, uio);
1356 	return (error);
1357 }
1358 
1359 #if 0
1360 struct vop_readdir_args {
1361 	struct vop_generic_args a_gen;
1362 	struct vnode *a_vp;
1363 	struct uio *a_uio;
1364 	struct ucred *a_cred;
1365 	int *a_eofflag;
1366 	int *a_ncookies;
1367 	uint64_t **a_cookies;
1368 };
1369 #endif
1370 
1371 /*
1372  * Return directory entries.
1373  */
1374 static int
1375 mqfs_readdir(struct vop_readdir_args *ap)
1376 {
1377 	struct vnode *vp;
1378 	struct mqfs_info *mi;
1379 	struct mqfs_node *pd;
1380 	struct mqfs_node *pn;
1381 	struct dirent entry;
1382 	struct uio *uio;
1383 	const void *pr_root;
1384 	int *tmp_ncookies = NULL;
1385 	off_t offset;
1386 	int error, i;
1387 
1388 	vp = ap->a_vp;
1389 	mi = VFSTOMQFS(vp->v_mount);
1390 	pd = VTON(vp);
1391 	uio = ap->a_uio;
1392 
1393 	if (vp->v_type != VDIR)
1394 		return (ENOTDIR);
1395 
1396 	if (uio->uio_offset < 0)
1397 		return (EINVAL);
1398 
1399 	if (ap->a_ncookies != NULL) {
1400 		tmp_ncookies = ap->a_ncookies;
1401 		*ap->a_ncookies = 0;
1402 		ap->a_ncookies = NULL;
1403         }
1404 
1405 	error = 0;
1406 	offset = 0;
1407 
1408 	pr_root = ap->a_cred->cr_prison->pr_root;
1409 	sx_xlock(&mi->mi_lock);
1410 
1411 	LIST_FOREACH(pn, &pd->mn_children, mn_sibling) {
1412 		entry.d_reclen = sizeof(entry);
1413 
1414 		/*
1415 		 * Only show names within the same prison root directory
1416 		 * (or not associated with a prison, e.g. "." and "..").
1417 		 */
1418 		if (pn->mn_pr_root != NULL && pn->mn_pr_root != pr_root)
1419 			continue;
1420 		if (!pn->mn_fileno)
1421 			mqfs_fileno_alloc(mi, pn);
1422 		entry.d_fileno = pn->mn_fileno;
1423 		entry.d_off = offset + entry.d_reclen;
1424 		for (i = 0; i < MQFS_NAMELEN - 1 && pn->mn_name[i] != '\0'; ++i)
1425 			entry.d_name[i] = pn->mn_name[i];
1426 		entry.d_namlen = i;
1427 		switch (pn->mn_type) {
1428 		case mqfstype_root:
1429 		case mqfstype_dir:
1430 		case mqfstype_this:
1431 		case mqfstype_parent:
1432 			entry.d_type = DT_DIR;
1433 			break;
1434 		case mqfstype_file:
1435 			entry.d_type = DT_REG;
1436 			break;
1437 		case mqfstype_symlink:
1438 			entry.d_type = DT_LNK;
1439 			break;
1440 		default:
1441 			panic("%s has unexpected node type: %d", pn->mn_name,
1442 				pn->mn_type);
1443 		}
1444 		dirent_terminate(&entry);
1445 		if (entry.d_reclen > uio->uio_resid)
1446                         break;
1447 		if (offset >= uio->uio_offset) {
1448 			error = vfs_read_dirent(ap, &entry, offset);
1449                         if (error)
1450                                 break;
1451                 }
1452                 offset += entry.d_reclen;
1453 	}
1454 	sx_xunlock(&mi->mi_lock);
1455 
1456 	uio->uio_offset = offset;
1457 
1458 	if (tmp_ncookies != NULL)
1459 		ap->a_ncookies = tmp_ncookies;
1460 
1461 	return (error);
1462 }
1463 
1464 #ifdef notyet
1465 
1466 #if 0
1467 struct vop_mkdir_args {
1468 	struct vnode *a_dvp;
1469 	struvt vnode **a_vpp;
1470 	struvt componentname *a_cnp;
1471 	struct vattr *a_vap;
1472 };
1473 #endif
1474 
1475 /*
1476  * Create a directory.
1477  */
1478 static int
1479 mqfs_mkdir(struct vop_mkdir_args *ap)
1480 {
1481 	struct mqfs_info *mqfs = VFSTOMQFS(ap->a_dvp->v_mount);
1482 	struct componentname *cnp = ap->a_cnp;
1483 	struct mqfs_node *pd = VTON(ap->a_dvp);
1484 	struct mqfs_node *pn;
1485 	int error;
1486 
1487 	if (pd->mn_type != mqfstype_root && pd->mn_type != mqfstype_dir)
1488 		return (ENOTDIR);
1489 	sx_xlock(&mqfs->mi_lock);
1490 	pn = mqfs_create_dir(pd, cnp->cn_nameptr, cnp->cn_namelen,
1491 		ap->a_vap->cn_cred, ap->a_vap->va_mode);
1492 	if (pn != NULL)
1493 		mqnode_addref(pn);
1494 	sx_xunlock(&mqfs->mi_lock);
1495 	if (pn == NULL) {
1496 		error = ENOSPC;
1497 	} else {
1498 		error = mqfs_allocv(ap->a_dvp->v_mount, ap->a_vpp, pn);
1499 		mqnode_release(pn);
1500 	}
1501 	return (error);
1502 }
1503 
1504 #if 0
1505 struct vop_rmdir_args {
1506 	struct vnode *a_dvp;
1507 	struct vnode *a_vp;
1508 	struct componentname *a_cnp;
1509 };
1510 #endif
1511 
1512 /*
1513  * Remove a directory.
1514  */
1515 static int
1516 mqfs_rmdir(struct vop_rmdir_args *ap)
1517 {
1518 	struct mqfs_info *mqfs = VFSTOMQFS(ap->a_dvp->v_mount);
1519 	struct mqfs_node *pn = VTON(ap->a_vp);
1520 	struct mqfs_node *pt;
1521 
1522 	if (pn->mn_type != mqfstype_dir)
1523 		return (ENOTDIR);
1524 
1525 	sx_xlock(&mqfs->mi_lock);
1526 	if (pn->mn_deleted) {
1527 		sx_xunlock(&mqfs->mi_lock);
1528 		return (ENOENT);
1529 	}
1530 
1531 	pt = LIST_FIRST(&pn->mn_children);
1532 	pt = LIST_NEXT(pt, mn_sibling);
1533 	pt = LIST_NEXT(pt, mn_sibling);
1534 	if (pt != NULL) {
1535 		sx_xunlock(&mqfs->mi_lock);
1536 		return (ENOTEMPTY);
1537 	}
1538 	pt = pn->mn_parent;
1539 	pn->mn_parent = NULL;
1540 	pn->mn_deleted = 1;
1541 	LIST_REMOVE(pn, mn_sibling);
1542 	mqnode_release(pn);
1543 	mqnode_release(pt);
1544 	sx_xunlock(&mqfs->mi_lock);
1545 	cache_purge(ap->a_vp);
1546 	return (0);
1547 }
1548 
1549 #endif /* notyet */
1550 
1551 /*
1552  * See if this prison root is obsolete, and clean up associated queues if it is.
1553  */
1554 static int
1555 mqfs_prison_remove(void *obj, void *data __unused)
1556 {
1557 	const struct prison *pr = obj;
1558 	struct prison *tpr;
1559 	struct mqfs_node *pn, *tpn;
1560 	struct vnode *pr_root;
1561 
1562 	pr_root = pr->pr_root;
1563 	if (pr->pr_parent->pr_root == pr_root)
1564 		return (0);
1565 	TAILQ_FOREACH(tpr, &allprison, pr_list) {
1566 		if (tpr != pr && tpr->pr_root == pr_root)
1567 			return (0);
1568 	}
1569 	/*
1570 	 * No jails are rooted in this directory anymore,
1571 	 * so no queues should be either.
1572 	 */
1573 	sx_xlock(&mqfs_data.mi_lock);
1574 	LIST_FOREACH_SAFE(pn, &mqfs_data.mi_root->mn_children,
1575 	    mn_sibling, tpn) {
1576 		if (pn->mn_pr_root == pr_root)
1577 			(void)do_unlink(pn, curthread->td_ucred);
1578 	}
1579 	sx_xunlock(&mqfs_data.mi_lock);
1580 	return (0);
1581 }
1582 
1583 /*
1584  * Allocate a message queue
1585  */
1586 static struct mqueue *
1587 mqueue_alloc(const struct mq_attr *attr)
1588 {
1589 	struct mqueue *mq;
1590 
1591 	if (curmq >= maxmq)
1592 		return (NULL);
1593 	mq = uma_zalloc(mqueue_zone, M_WAITOK | M_ZERO);
1594 	TAILQ_INIT(&mq->mq_msgq);
1595 	if (attr != NULL) {
1596 		mq->mq_maxmsg = attr->mq_maxmsg;
1597 		mq->mq_msgsize = attr->mq_msgsize;
1598 	} else {
1599 		mq->mq_maxmsg = default_maxmsg;
1600 		mq->mq_msgsize = default_msgsize;
1601 	}
1602 	mtx_init(&mq->mq_mutex, "mqueue lock", NULL, MTX_DEF);
1603 	knlist_init_mtx(&mq->mq_rsel.si_note, &mq->mq_mutex);
1604 	knlist_init_mtx(&mq->mq_wsel.si_note, &mq->mq_mutex);
1605 	atomic_add_int(&curmq, 1);
1606 	return (mq);
1607 }
1608 
1609 /*
1610  * Destroy a message queue
1611  */
1612 static void
1613 mqueue_free(struct mqueue *mq)
1614 {
1615 	struct mqueue_msg *msg;
1616 
1617 	while ((msg = TAILQ_FIRST(&mq->mq_msgq)) != NULL) {
1618 		TAILQ_REMOVE(&mq->mq_msgq, msg, msg_link);
1619 		free(msg, M_MQUEUEDATA);
1620 	}
1621 
1622 	mtx_destroy(&mq->mq_mutex);
1623 	seldrain(&mq->mq_rsel);
1624 	seldrain(&mq->mq_wsel);
1625 	knlist_destroy(&mq->mq_rsel.si_note);
1626 	knlist_destroy(&mq->mq_wsel.si_note);
1627 	uma_zfree(mqueue_zone, mq);
1628 	atomic_add_int(&curmq, -1);
1629 }
1630 
1631 /*
1632  * Load a message from user space
1633  */
1634 static struct mqueue_msg *
1635 mqueue_loadmsg(const char *msg_ptr, size_t msg_size, int msg_prio)
1636 {
1637 	struct mqueue_msg *msg;
1638 	size_t len;
1639 	int error;
1640 
1641 	len = sizeof(struct mqueue_msg) + msg_size;
1642 	msg = malloc(len, M_MQUEUEDATA, M_WAITOK);
1643 	error = copyin(msg_ptr, ((char *)msg) + sizeof(struct mqueue_msg),
1644 	    msg_size);
1645 	if (error) {
1646 		free(msg, M_MQUEUEDATA);
1647 		msg = NULL;
1648 	} else {
1649 		msg->msg_size = msg_size;
1650 		msg->msg_prio = msg_prio;
1651 	}
1652 	return (msg);
1653 }
1654 
1655 /*
1656  * Save a message to user space
1657  */
1658 static int
1659 mqueue_savemsg(struct mqueue_msg *msg, char *msg_ptr, int *msg_prio)
1660 {
1661 	int error;
1662 
1663 	error = copyout(((char *)msg) + sizeof(*msg), msg_ptr,
1664 		msg->msg_size);
1665 	if (error == 0 && msg_prio != NULL)
1666 		error = copyout(&msg->msg_prio, msg_prio, sizeof(int));
1667 	return (error);
1668 }
1669 
1670 /*
1671  * Free a message's memory
1672  */
1673 static __inline void
1674 mqueue_freemsg(struct mqueue_msg *msg)
1675 {
1676 	free(msg, M_MQUEUEDATA);
1677 }
1678 
1679 /*
1680  * Send a message. if waitok is false, thread will not be
1681  * blocked if there is no data in queue, otherwise, absolute
1682  * time will be checked.
1683  */
1684 int
1685 mqueue_send(struct mqueue *mq, const char *msg_ptr,
1686 	size_t msg_len, unsigned msg_prio, int waitok,
1687 	const struct timespec *abs_timeout)
1688 {
1689 	struct mqueue_msg *msg;
1690 	struct timespec ts, ts2;
1691 	struct timeval tv;
1692 	int error;
1693 
1694 	if (msg_prio >= MQ_PRIO_MAX)
1695 		return (EINVAL);
1696 	if (msg_len > mq->mq_msgsize)
1697 		return (EMSGSIZE);
1698 	msg = mqueue_loadmsg(msg_ptr, msg_len, msg_prio);
1699 	if (msg == NULL)
1700 		return (EFAULT);
1701 
1702 	/* O_NONBLOCK case */
1703 	if (!waitok) {
1704 		error = _mqueue_send(mq, msg, -1);
1705 		if (error)
1706 			goto bad;
1707 		return (0);
1708 	}
1709 
1710 	/* we allow a null timeout (wait forever) */
1711 	if (abs_timeout == NULL) {
1712 		error = _mqueue_send(mq, msg, 0);
1713 		if (error)
1714 			goto bad;
1715 		return (0);
1716 	}
1717 
1718 	/* send it before checking time */
1719 	error = _mqueue_send(mq, msg, -1);
1720 	if (error == 0)
1721 		return (0);
1722 
1723 	if (error != EAGAIN)
1724 		goto bad;
1725 
1726 	if (abs_timeout->tv_nsec >= 1000000000 || abs_timeout->tv_nsec < 0) {
1727 		error = EINVAL;
1728 		goto bad;
1729 	}
1730 	for (;;) {
1731 		getnanotime(&ts);
1732 		timespecsub(abs_timeout, &ts, &ts2);
1733 		if (ts2.tv_sec < 0 || (ts2.tv_sec == 0 && ts2.tv_nsec <= 0)) {
1734 			error = ETIMEDOUT;
1735 			break;
1736 		}
1737 		TIMESPEC_TO_TIMEVAL(&tv, &ts2);
1738 		error = _mqueue_send(mq, msg, tvtohz(&tv));
1739 		if (error != ETIMEDOUT)
1740 			break;
1741 	}
1742 	if (error == 0)
1743 		return (0);
1744 bad:
1745 	mqueue_freemsg(msg);
1746 	return (error);
1747 }
1748 
1749 /*
1750  * Common routine to send a message
1751  */
1752 static int
1753 _mqueue_send(struct mqueue *mq, struct mqueue_msg *msg, int timo)
1754 {
1755 	struct mqueue_msg *msg2;
1756 	int error = 0;
1757 
1758 	mtx_lock(&mq->mq_mutex);
1759 	while (mq->mq_curmsgs >= mq->mq_maxmsg && error == 0) {
1760 		if (timo < 0) {
1761 			mtx_unlock(&mq->mq_mutex);
1762 			return (EAGAIN);
1763 		}
1764 		mq->mq_senders++;
1765 		error = msleep(&mq->mq_senders, &mq->mq_mutex,
1766 			    PCATCH, "mqsend", timo);
1767 		mq->mq_senders--;
1768 		if (error == EAGAIN)
1769 			error = ETIMEDOUT;
1770 	}
1771 	if (mq->mq_curmsgs >= mq->mq_maxmsg) {
1772 		mtx_unlock(&mq->mq_mutex);
1773 		return (error);
1774 	}
1775 	error = 0;
1776 	if (TAILQ_EMPTY(&mq->mq_msgq)) {
1777 		TAILQ_INSERT_HEAD(&mq->mq_msgq, msg, msg_link);
1778 	} else {
1779 		if (msg->msg_prio <= TAILQ_LAST(&mq->mq_msgq, msgq)->msg_prio) {
1780 			TAILQ_INSERT_TAIL(&mq->mq_msgq, msg, msg_link);
1781 		} else {
1782 			TAILQ_FOREACH(msg2, &mq->mq_msgq, msg_link) {
1783 				if (msg2->msg_prio < msg->msg_prio)
1784 					break;
1785 			}
1786 			TAILQ_INSERT_BEFORE(msg2, msg, msg_link);
1787 		}
1788 	}
1789 	mq->mq_curmsgs++;
1790 	mq->mq_totalbytes += msg->msg_size;
1791 	if (mq->mq_receivers)
1792 		wakeup_one(&mq->mq_receivers);
1793 	else if (mq->mq_notifier != NULL)
1794 		mqueue_send_notification(mq);
1795 	if (mq->mq_flags & MQ_RSEL) {
1796 		mq->mq_flags &= ~MQ_RSEL;
1797 		selwakeup(&mq->mq_rsel);
1798 	}
1799 	KNOTE_LOCKED(&mq->mq_rsel.si_note, 0);
1800 	mtx_unlock(&mq->mq_mutex);
1801 	return (0);
1802 }
1803 
1804 /*
1805  * Send realtime a signal to process which registered itself
1806  * successfully by mq_notify.
1807  */
1808 static void
1809 mqueue_send_notification(struct mqueue *mq)
1810 {
1811 	struct mqueue_notifier *nt;
1812 	struct thread *td;
1813 	struct proc *p;
1814 	int error;
1815 
1816 	mtx_assert(&mq->mq_mutex, MA_OWNED);
1817 	nt = mq->mq_notifier;
1818 	if (nt->nt_sigev.sigev_notify != SIGEV_NONE) {
1819 		p = nt->nt_proc;
1820 		error = sigev_findtd(p, &nt->nt_sigev, &td);
1821 		if (error) {
1822 			mq->mq_notifier = NULL;
1823 			return;
1824 		}
1825 		if (!KSI_ONQ(&nt->nt_ksi)) {
1826 			ksiginfo_set_sigev(&nt->nt_ksi, &nt->nt_sigev);
1827 			tdsendsignal(p, td, nt->nt_ksi.ksi_signo, &nt->nt_ksi);
1828 		}
1829 		PROC_UNLOCK(p);
1830 	}
1831 	mq->mq_notifier = NULL;
1832 }
1833 
1834 /*
1835  * Get a message. if waitok is false, thread will not be
1836  * blocked if there is no data in queue, otherwise, absolute
1837  * time will be checked.
1838  */
1839 int
1840 mqueue_receive(struct mqueue *mq, char *msg_ptr,
1841 	size_t msg_len, unsigned *msg_prio, int waitok,
1842 	const struct timespec *abs_timeout)
1843 {
1844 	struct mqueue_msg *msg;
1845 	struct timespec ts, ts2;
1846 	struct timeval tv;
1847 	int error;
1848 
1849 	if (msg_len < mq->mq_msgsize)
1850 		return (EMSGSIZE);
1851 
1852 	/* O_NONBLOCK case */
1853 	if (!waitok) {
1854 		error = _mqueue_recv(mq, &msg, -1);
1855 		if (error)
1856 			return (error);
1857 		goto received;
1858 	}
1859 
1860 	/* we allow a null timeout (wait forever). */
1861 	if (abs_timeout == NULL) {
1862 		error = _mqueue_recv(mq, &msg, 0);
1863 		if (error)
1864 			return (error);
1865 		goto received;
1866 	}
1867 
1868 	/* try to get a message before checking time */
1869 	error = _mqueue_recv(mq, &msg, -1);
1870 	if (error == 0)
1871 		goto received;
1872 
1873 	if (error != EAGAIN)
1874 		return (error);
1875 
1876 	if (abs_timeout->tv_nsec >= 1000000000 || abs_timeout->tv_nsec < 0) {
1877 		error = EINVAL;
1878 		return (error);
1879 	}
1880 
1881 	for (;;) {
1882 		getnanotime(&ts);
1883 		timespecsub(abs_timeout, &ts, &ts2);
1884 		if (ts2.tv_sec < 0 || (ts2.tv_sec == 0 && ts2.tv_nsec <= 0)) {
1885 			error = ETIMEDOUT;
1886 			return (error);
1887 		}
1888 		TIMESPEC_TO_TIMEVAL(&tv, &ts2);
1889 		error = _mqueue_recv(mq, &msg, tvtohz(&tv));
1890 		if (error == 0)
1891 			break;
1892 		if (error != ETIMEDOUT)
1893 			return (error);
1894 	}
1895 
1896 received:
1897 	error = mqueue_savemsg(msg, msg_ptr, msg_prio);
1898 	if (error == 0) {
1899 		curthread->td_retval[0] = msg->msg_size;
1900 		curthread->td_retval[1] = 0;
1901 	}
1902 	mqueue_freemsg(msg);
1903 	return (error);
1904 }
1905 
1906 /*
1907  * Common routine to receive a message
1908  */
1909 static int
1910 _mqueue_recv(struct mqueue *mq, struct mqueue_msg **msg, int timo)
1911 {
1912 	int error = 0;
1913 
1914 	mtx_lock(&mq->mq_mutex);
1915 	while ((*msg = TAILQ_FIRST(&mq->mq_msgq)) == NULL && error == 0) {
1916 		if (timo < 0) {
1917 			mtx_unlock(&mq->mq_mutex);
1918 			return (EAGAIN);
1919 		}
1920 		mq->mq_receivers++;
1921 		error = msleep(&mq->mq_receivers, &mq->mq_mutex,
1922 			    PCATCH, "mqrecv", timo);
1923 		mq->mq_receivers--;
1924 		if (error == EAGAIN)
1925 			error = ETIMEDOUT;
1926 	}
1927 	if (*msg != NULL) {
1928 		error = 0;
1929 		TAILQ_REMOVE(&mq->mq_msgq, *msg, msg_link);
1930 		mq->mq_curmsgs--;
1931 		mq->mq_totalbytes -= (*msg)->msg_size;
1932 		if (mq->mq_senders)
1933 			wakeup_one(&mq->mq_senders);
1934 		if (mq->mq_flags & MQ_WSEL) {
1935 			mq->mq_flags &= ~MQ_WSEL;
1936 			selwakeup(&mq->mq_wsel);
1937 		}
1938 		KNOTE_LOCKED(&mq->mq_wsel.si_note, 0);
1939 	}
1940 	if (mq->mq_notifier != NULL && mq->mq_receivers == 0 &&
1941 	    !TAILQ_EMPTY(&mq->mq_msgq)) {
1942 		mqueue_send_notification(mq);
1943 	}
1944 	mtx_unlock(&mq->mq_mutex);
1945 	return (error);
1946 }
1947 
1948 static __inline struct mqueue_notifier *
1949 notifier_alloc(void)
1950 {
1951 	return (uma_zalloc(mqnoti_zone, M_WAITOK | M_ZERO));
1952 }
1953 
1954 static __inline void
1955 notifier_free(struct mqueue_notifier *p)
1956 {
1957 	uma_zfree(mqnoti_zone, p);
1958 }
1959 
1960 static struct mqueue_notifier *
1961 notifier_search(struct proc *p, int fd)
1962 {
1963 	struct mqueue_notifier *nt;
1964 
1965 	LIST_FOREACH(nt, &p->p_mqnotifier, nt_link) {
1966 		if (nt->nt_ksi.ksi_mqd == fd)
1967 			break;
1968 	}
1969 	return (nt);
1970 }
1971 
1972 static __inline void
1973 notifier_insert(struct proc *p, struct mqueue_notifier *nt)
1974 {
1975 	LIST_INSERT_HEAD(&p->p_mqnotifier, nt, nt_link);
1976 }
1977 
1978 static __inline void
1979 notifier_delete(struct proc *p, struct mqueue_notifier *nt)
1980 {
1981 	LIST_REMOVE(nt, nt_link);
1982 	notifier_free(nt);
1983 }
1984 
1985 static void
1986 notifier_remove(struct proc *p, struct mqueue *mq, int fd)
1987 {
1988 	struct mqueue_notifier *nt;
1989 
1990 	mtx_assert(&mq->mq_mutex, MA_OWNED);
1991 	PROC_LOCK(p);
1992 	nt = notifier_search(p, fd);
1993 	if (nt != NULL) {
1994 		if (mq->mq_notifier == nt)
1995 			mq->mq_notifier = NULL;
1996 		sigqueue_take(&nt->nt_ksi);
1997 		notifier_delete(p, nt);
1998 	}
1999 	PROC_UNLOCK(p);
2000 }
2001 
2002 static int
2003 kern_kmq_open(struct thread *td, const char *upath, int flags, mode_t mode,
2004     const struct mq_attr *attr)
2005 {
2006 	char path[MQFS_NAMELEN + 1];
2007 	struct mqfs_node *pn;
2008 	struct pwddesc *pdp;
2009 	struct file *fp;
2010 	struct mqueue *mq;
2011 	int fd, error, len, cmode;
2012 
2013 	AUDIT_ARG_FFLAGS(flags);
2014 	AUDIT_ARG_MODE(mode);
2015 
2016 	pdp = td->td_proc->p_pd;
2017 	cmode = (((mode & ~pdp->pd_cmask) & ALLPERMS) & ~S_ISTXT);
2018 	mq = NULL;
2019 	if ((flags & O_CREAT) != 0 && attr != NULL) {
2020 		if (attr->mq_maxmsg <= 0 || attr->mq_maxmsg > maxmsg)
2021 			return (EINVAL);
2022 		if (attr->mq_msgsize <= 0 || attr->mq_msgsize > maxmsgsize)
2023 			return (EINVAL);
2024 	}
2025 
2026 	error = copyinstr(upath, path, MQFS_NAMELEN + 1, NULL);
2027         if (error)
2028 		return (error);
2029 
2030 	/*
2031 	 * The first character of name must be a slash  (/) character
2032 	 * and the remaining characters of name cannot include any slash
2033 	 * characters.
2034 	 */
2035 	len = strlen(path);
2036 	if (len < 2 || path[0] != '/' || strchr(path + 1, '/') != NULL)
2037 		return (EINVAL);
2038 	/*
2039 	 * "." and ".." are magic directories, populated on the fly, and cannot
2040 	 * be opened as queues.
2041 	 */
2042 	if (strcmp(path, "/.") == 0 || strcmp(path, "/..") == 0)
2043 		return (EINVAL);
2044 	AUDIT_ARG_UPATH1_CANON(path);
2045 
2046 	error = falloc(td, &fp, &fd, O_CLOEXEC);
2047 	if (error)
2048 		return (error);
2049 
2050 	sx_xlock(&mqfs_data.mi_lock);
2051 	pn = mqfs_search(mqfs_data.mi_root, path + 1, len - 1, td->td_ucred);
2052 	if (pn == NULL) {
2053 		if (!(flags & O_CREAT)) {
2054 			error = ENOENT;
2055 		} else {
2056 			mq = mqueue_alloc(attr);
2057 			if (mq == NULL) {
2058 				error = ENFILE;
2059 			} else {
2060 				pn = mqfs_create_file(mqfs_data.mi_root,
2061 				         path + 1, len - 1, td->td_ucred,
2062 					 cmode);
2063 				if (pn == NULL) {
2064 					error = ENOSPC;
2065 					mqueue_free(mq);
2066 				}
2067 			}
2068 		}
2069 
2070 		if (error == 0) {
2071 			pn->mn_data = mq;
2072 		}
2073 	} else {
2074 		if ((flags & (O_CREAT | O_EXCL)) == (O_CREAT | O_EXCL)) {
2075 			error = EEXIST;
2076 		} else {
2077 			accmode_t accmode = 0;
2078 
2079 			if (flags & FREAD)
2080 				accmode |= VREAD;
2081 			if (flags & FWRITE)
2082 				accmode |= VWRITE;
2083 			error = vaccess(VREG, pn->mn_mode, pn->mn_uid,
2084 			    pn->mn_gid, accmode, td->td_ucred);
2085 		}
2086 	}
2087 
2088 	if (error) {
2089 		sx_xunlock(&mqfs_data.mi_lock);
2090 		fdclose(td, fp, fd);
2091 		fdrop(fp, td);
2092 		return (error);
2093 	}
2094 
2095 	mqnode_addref(pn);
2096 	sx_xunlock(&mqfs_data.mi_lock);
2097 
2098 	finit(fp, flags & (FREAD | FWRITE | O_NONBLOCK), DTYPE_MQUEUE, pn,
2099 	    &mqueueops);
2100 
2101 	td->td_retval[0] = fd;
2102 	fdrop(fp, td);
2103 	return (0);
2104 }
2105 
2106 /*
2107  * Syscall to open a message queue.
2108  */
2109 int
2110 sys_kmq_open(struct thread *td, struct kmq_open_args *uap)
2111 {
2112 	struct mq_attr attr;
2113 	int flags, error;
2114 
2115 	if ((uap->flags & O_ACCMODE) == O_ACCMODE || uap->flags & O_EXEC)
2116 		return (EINVAL);
2117 	flags = FFLAGS(uap->flags);
2118 	if ((flags & O_CREAT) != 0 && uap->attr != NULL) {
2119 		error = copyin(uap->attr, &attr, sizeof(attr));
2120 		if (error)
2121 			return (error);
2122 	}
2123 	return (kern_kmq_open(td, uap->path, flags, uap->mode,
2124 	    uap->attr != NULL ? &attr : NULL));
2125 }
2126 
2127 /*
2128  * Syscall to unlink a message queue.
2129  */
2130 int
2131 sys_kmq_unlink(struct thread *td, struct kmq_unlink_args *uap)
2132 {
2133 	char path[MQFS_NAMELEN+1];
2134 	struct mqfs_node *pn;
2135 	int error, len;
2136 
2137 	error = copyinstr(uap->path, path, MQFS_NAMELEN + 1, NULL);
2138         if (error)
2139 		return (error);
2140 
2141 	len = strlen(path);
2142 	if (len < 2 || path[0] != '/' || strchr(path + 1, '/') != NULL)
2143 		return (EINVAL);
2144 	if (strcmp(path, "/.") == 0 || strcmp(path, "/..") == 0)
2145 		return (EINVAL);
2146 	AUDIT_ARG_UPATH1_CANON(path);
2147 
2148 	sx_xlock(&mqfs_data.mi_lock);
2149 	pn = mqfs_search(mqfs_data.mi_root, path + 1, len - 1, td->td_ucred);
2150 	if (pn != NULL)
2151 		error = do_unlink(pn, td->td_ucred);
2152 	else
2153 		error = ENOENT;
2154 	sx_xunlock(&mqfs_data.mi_lock);
2155 	return (error);
2156 }
2157 
2158 typedef int (*_fgetf)(struct thread *, int, cap_rights_t *, struct file **);
2159 
2160 /*
2161  * Get message queue by giving file slot
2162  */
2163 static int
2164 _getmq(struct thread *td, int fd, cap_rights_t *rightsp, _fgetf func,
2165        struct file **fpp, struct mqfs_node **ppn, struct mqueue **pmq)
2166 {
2167 	struct mqfs_node *pn;
2168 	int error;
2169 
2170 	error = func(td, fd, rightsp, fpp);
2171 	if (error)
2172 		return (error);
2173 	if (&mqueueops != (*fpp)->f_ops) {
2174 		fdrop(*fpp, td);
2175 		return (EBADF);
2176 	}
2177 	pn = (*fpp)->f_data;
2178 	if (ppn)
2179 		*ppn = pn;
2180 	if (pmq)
2181 		*pmq = pn->mn_data;
2182 	return (0);
2183 }
2184 
2185 static __inline int
2186 getmq(struct thread *td, int fd, struct file **fpp, struct mqfs_node **ppn,
2187 	struct mqueue **pmq)
2188 {
2189 
2190 	return _getmq(td, fd, &cap_event_rights, fget,
2191 	    fpp, ppn, pmq);
2192 }
2193 
2194 static __inline int
2195 getmq_read(struct thread *td, int fd, struct file **fpp,
2196 	 struct mqfs_node **ppn, struct mqueue **pmq)
2197 {
2198 
2199 	return _getmq(td, fd, &cap_read_rights, fget_read,
2200 	    fpp, ppn, pmq);
2201 }
2202 
2203 static __inline int
2204 getmq_write(struct thread *td, int fd, struct file **fpp,
2205 	struct mqfs_node **ppn, struct mqueue **pmq)
2206 {
2207 
2208 	return _getmq(td, fd, &cap_write_rights, fget_write,
2209 	    fpp, ppn, pmq);
2210 }
2211 
2212 static int
2213 kern_kmq_setattr(struct thread *td, int mqd, const struct mq_attr *attr,
2214     struct mq_attr *oattr)
2215 {
2216 	struct mqueue *mq;
2217 	struct file *fp;
2218 	u_int oflag, flag;
2219 	int error;
2220 
2221 	AUDIT_ARG_FD(mqd);
2222 	if (attr != NULL && (attr->mq_flags & ~O_NONBLOCK) != 0)
2223 		return (EINVAL);
2224 	error = getmq(td, mqd, &fp, NULL, &mq);
2225 	if (error)
2226 		return (error);
2227 	oattr->mq_maxmsg  = mq->mq_maxmsg;
2228 	oattr->mq_msgsize = mq->mq_msgsize;
2229 	oattr->mq_curmsgs = mq->mq_curmsgs;
2230 	if (attr != NULL) {
2231 		do {
2232 			oflag = flag = fp->f_flag;
2233 			flag &= ~O_NONBLOCK;
2234 			flag |= (attr->mq_flags & O_NONBLOCK);
2235 		} while (atomic_cmpset_int(&fp->f_flag, oflag, flag) == 0);
2236 	} else
2237 		oflag = fp->f_flag;
2238 	oattr->mq_flags = (O_NONBLOCK & oflag);
2239 	fdrop(fp, td);
2240 	return (error);
2241 }
2242 
2243 int
2244 sys_kmq_setattr(struct thread *td, struct kmq_setattr_args *uap)
2245 {
2246 	struct mq_attr attr, oattr;
2247 	int error;
2248 
2249 	if (uap->attr != NULL) {
2250 		error = copyin(uap->attr, &attr, sizeof(attr));
2251 		if (error != 0)
2252 			return (error);
2253 	}
2254 	error = kern_kmq_setattr(td, uap->mqd, uap->attr != NULL ? &attr : NULL,
2255 	    &oattr);
2256 	if (error == 0 && uap->oattr != NULL) {
2257 		bzero(oattr.__reserved, sizeof(oattr.__reserved));
2258 		error = copyout(&oattr, uap->oattr, sizeof(oattr));
2259 	}
2260 	return (error);
2261 }
2262 
2263 int
2264 sys_kmq_timedreceive(struct thread *td, struct kmq_timedreceive_args *uap)
2265 {
2266 	struct mqueue *mq;
2267 	struct file *fp;
2268 	struct timespec *abs_timeout, ets;
2269 	int error;
2270 	int waitok;
2271 
2272 	AUDIT_ARG_FD(uap->mqd);
2273 	error = getmq_read(td, uap->mqd, &fp, NULL, &mq);
2274 	if (error)
2275 		return (error);
2276 	if (uap->abs_timeout != NULL) {
2277 		error = copyin(uap->abs_timeout, &ets, sizeof(ets));
2278 		if (error != 0)
2279 			goto out;
2280 		abs_timeout = &ets;
2281 	} else
2282 		abs_timeout = NULL;
2283 	waitok = !(fp->f_flag & O_NONBLOCK);
2284 	error = mqueue_receive(mq, uap->msg_ptr, uap->msg_len,
2285 		uap->msg_prio, waitok, abs_timeout);
2286 out:
2287 	fdrop(fp, td);
2288 	return (error);
2289 }
2290 
2291 int
2292 sys_kmq_timedsend(struct thread *td, struct kmq_timedsend_args *uap)
2293 {
2294 	struct mqueue *mq;
2295 	struct file *fp;
2296 	struct timespec *abs_timeout, ets;
2297 	int error, waitok;
2298 
2299 	AUDIT_ARG_FD(uap->mqd);
2300 	error = getmq_write(td, uap->mqd, &fp, NULL, &mq);
2301 	if (error)
2302 		return (error);
2303 	if (uap->abs_timeout != NULL) {
2304 		error = copyin(uap->abs_timeout, &ets, sizeof(ets));
2305 		if (error != 0)
2306 			goto out;
2307 		abs_timeout = &ets;
2308 	} else
2309 		abs_timeout = NULL;
2310 	waitok = !(fp->f_flag & O_NONBLOCK);
2311 	error = mqueue_send(mq, uap->msg_ptr, uap->msg_len,
2312 		uap->msg_prio, waitok, abs_timeout);
2313 out:
2314 	fdrop(fp, td);
2315 	return (error);
2316 }
2317 
2318 static int
2319 kern_kmq_notify(struct thread *td, int mqd, struct sigevent *sigev)
2320 {
2321 	struct filedesc *fdp;
2322 	struct proc *p;
2323 	struct mqueue *mq;
2324 	struct file *fp, *fp2;
2325 	struct mqueue_notifier *nt, *newnt = NULL;
2326 	int error;
2327 
2328 	AUDIT_ARG_FD(mqd);
2329 	if (sigev != NULL) {
2330 		if (sigev->sigev_notify != SIGEV_SIGNAL &&
2331 		    sigev->sigev_notify != SIGEV_THREAD_ID &&
2332 		    sigev->sigev_notify != SIGEV_NONE)
2333 			return (EINVAL);
2334 		if ((sigev->sigev_notify == SIGEV_SIGNAL ||
2335 		    sigev->sigev_notify == SIGEV_THREAD_ID) &&
2336 		    !_SIG_VALID(sigev->sigev_signo))
2337 			return (EINVAL);
2338 	}
2339 	p = td->td_proc;
2340 	fdp = td->td_proc->p_fd;
2341 	error = getmq(td, mqd, &fp, NULL, &mq);
2342 	if (error)
2343 		return (error);
2344 again:
2345 	FILEDESC_SLOCK(fdp);
2346 	fp2 = fget_noref(fdp, mqd);
2347 	if (fp2 == NULL) {
2348 		FILEDESC_SUNLOCK(fdp);
2349 		error = EBADF;
2350 		goto out;
2351 	}
2352 #ifdef CAPABILITIES
2353 	error = cap_check(cap_rights(fdp, mqd), &cap_event_rights);
2354 	if (error) {
2355 		FILEDESC_SUNLOCK(fdp);
2356 		goto out;
2357 	}
2358 #endif
2359 	if (fp2 != fp) {
2360 		FILEDESC_SUNLOCK(fdp);
2361 		error = EBADF;
2362 		goto out;
2363 	}
2364 	mtx_lock(&mq->mq_mutex);
2365 	FILEDESC_SUNLOCK(fdp);
2366 	if (sigev != NULL) {
2367 		if (mq->mq_notifier != NULL) {
2368 			error = EBUSY;
2369 		} else {
2370 			PROC_LOCK(p);
2371 			nt = notifier_search(p, mqd);
2372 			if (nt == NULL) {
2373 				if (newnt == NULL) {
2374 					PROC_UNLOCK(p);
2375 					mtx_unlock(&mq->mq_mutex);
2376 					newnt = notifier_alloc();
2377 					goto again;
2378 				}
2379 			}
2380 
2381 			if (nt != NULL) {
2382 				sigqueue_take(&nt->nt_ksi);
2383 				if (newnt != NULL) {
2384 					notifier_free(newnt);
2385 					newnt = NULL;
2386 				}
2387 			} else {
2388 				nt = newnt;
2389 				newnt = NULL;
2390 				ksiginfo_init(&nt->nt_ksi);
2391 				nt->nt_ksi.ksi_flags |= KSI_INS | KSI_EXT;
2392 				nt->nt_ksi.ksi_code = SI_MESGQ;
2393 				nt->nt_proc = p;
2394 				nt->nt_ksi.ksi_mqd = mqd;
2395 				notifier_insert(p, nt);
2396 			}
2397 			nt->nt_sigev = *sigev;
2398 			mq->mq_notifier = nt;
2399 			PROC_UNLOCK(p);
2400 			/*
2401 			 * if there is no receivers and message queue
2402 			 * is not empty, we should send notification
2403 			 * as soon as possible.
2404 			 */
2405 			if (mq->mq_receivers == 0 &&
2406 			    !TAILQ_EMPTY(&mq->mq_msgq))
2407 				mqueue_send_notification(mq);
2408 		}
2409 	} else {
2410 		notifier_remove(p, mq, mqd);
2411 	}
2412 	mtx_unlock(&mq->mq_mutex);
2413 
2414 out:
2415 	fdrop(fp, td);
2416 	if (newnt != NULL)
2417 		notifier_free(newnt);
2418 	return (error);
2419 }
2420 
2421 int
2422 sys_kmq_notify(struct thread *td, struct kmq_notify_args *uap)
2423 {
2424 	struct sigevent ev, *evp;
2425 	int error;
2426 
2427 	if (uap->sigev == NULL) {
2428 		evp = NULL;
2429 	} else {
2430 		error = copyin(uap->sigev, &ev, sizeof(ev));
2431 		if (error != 0)
2432 			return (error);
2433 		evp = &ev;
2434 	}
2435 	return (kern_kmq_notify(td, uap->mqd, evp));
2436 }
2437 
2438 static void
2439 mqueue_fdclose(struct thread *td, int fd, struct file *fp)
2440 {
2441 	struct mqueue *mq;
2442 #ifdef INVARIANTS
2443 	struct filedesc *fdp;
2444 
2445 	fdp = td->td_proc->p_fd;
2446 	FILEDESC_LOCK_ASSERT(fdp);
2447 #endif
2448 
2449 	if (fp->f_ops == &mqueueops) {
2450 		mq = FPTOMQ(fp);
2451 		mtx_lock(&mq->mq_mutex);
2452 		notifier_remove(td->td_proc, mq, fd);
2453 
2454 		/* have to wakeup thread in same process */
2455 		if (mq->mq_flags & MQ_RSEL) {
2456 			mq->mq_flags &= ~MQ_RSEL;
2457 			selwakeup(&mq->mq_rsel);
2458 		}
2459 		if (mq->mq_flags & MQ_WSEL) {
2460 			mq->mq_flags &= ~MQ_WSEL;
2461 			selwakeup(&mq->mq_wsel);
2462 		}
2463 		mtx_unlock(&mq->mq_mutex);
2464 	}
2465 }
2466 
2467 static void
2468 mq_proc_exit(void *arg __unused, struct proc *p)
2469 {
2470 	struct filedesc *fdp;
2471 	struct file *fp;
2472 	struct mqueue *mq;
2473 	int i;
2474 
2475 	fdp = p->p_fd;
2476 	FILEDESC_SLOCK(fdp);
2477 	for (i = 0; i < fdp->fd_nfiles; ++i) {
2478 		fp = fget_noref(fdp, i);
2479 		if (fp != NULL && fp->f_ops == &mqueueops) {
2480 			mq = FPTOMQ(fp);
2481 			mtx_lock(&mq->mq_mutex);
2482 			notifier_remove(p, FPTOMQ(fp), i);
2483 			mtx_unlock(&mq->mq_mutex);
2484 		}
2485 	}
2486 	FILEDESC_SUNLOCK(fdp);
2487 	KASSERT(LIST_EMPTY(&p->p_mqnotifier), ("mq notifiers left"));
2488 }
2489 
2490 static int
2491 mqf_poll(struct file *fp, int events, struct ucred *active_cred,
2492 	struct thread *td)
2493 {
2494 	struct mqueue *mq = FPTOMQ(fp);
2495 	int revents = 0;
2496 
2497 	mtx_lock(&mq->mq_mutex);
2498 	if (events & (POLLIN | POLLRDNORM)) {
2499 		if (mq->mq_curmsgs) {
2500 			revents |= events & (POLLIN | POLLRDNORM);
2501 		} else {
2502 			mq->mq_flags |= MQ_RSEL;
2503 			selrecord(td, &mq->mq_rsel);
2504  		}
2505 	}
2506 	if (events & POLLOUT) {
2507 		if (mq->mq_curmsgs < mq->mq_maxmsg)
2508 			revents |= POLLOUT;
2509 		else {
2510 			mq->mq_flags |= MQ_WSEL;
2511 			selrecord(td, &mq->mq_wsel);
2512 		}
2513 	}
2514 	mtx_unlock(&mq->mq_mutex);
2515 	return (revents);
2516 }
2517 
2518 static int
2519 mqf_close(struct file *fp, struct thread *td)
2520 {
2521 	struct mqfs_node *pn;
2522 
2523 	fp->f_ops = &badfileops;
2524 	pn = fp->f_data;
2525 	fp->f_data = NULL;
2526 	sx_xlock(&mqfs_data.mi_lock);
2527 	mqnode_release(pn);
2528 	sx_xunlock(&mqfs_data.mi_lock);
2529 	return (0);
2530 }
2531 
2532 static int
2533 mqf_stat(struct file *fp, struct stat *st, struct ucred *active_cred)
2534 {
2535 	struct mqfs_node *pn = fp->f_data;
2536 
2537 	bzero(st, sizeof *st);
2538 	sx_xlock(&mqfs_data.mi_lock);
2539 	st->st_atim = pn->mn_atime;
2540 	st->st_mtim = pn->mn_mtime;
2541 	st->st_ctim = pn->mn_ctime;
2542 	st->st_birthtim = pn->mn_birth;
2543 	st->st_uid = pn->mn_uid;
2544 	st->st_gid = pn->mn_gid;
2545 	st->st_mode = S_IFIFO | pn->mn_mode;
2546 	sx_xunlock(&mqfs_data.mi_lock);
2547 	return (0);
2548 }
2549 
2550 static int
2551 mqf_chmod(struct file *fp, mode_t mode, struct ucred *active_cred,
2552     struct thread *td)
2553 {
2554 	struct mqfs_node *pn;
2555 	int error;
2556 
2557 	error = 0;
2558 	pn = fp->f_data;
2559 	sx_xlock(&mqfs_data.mi_lock);
2560 	error = vaccess(VREG, pn->mn_mode, pn->mn_uid, pn->mn_gid, VADMIN,
2561 	    active_cred);
2562 	if (error != 0)
2563 		goto out;
2564 	pn->mn_mode = mode & ACCESSPERMS;
2565 out:
2566 	sx_xunlock(&mqfs_data.mi_lock);
2567 	return (error);
2568 }
2569 
2570 static int
2571 mqf_chown(struct file *fp, uid_t uid, gid_t gid, struct ucred *active_cred,
2572     struct thread *td)
2573 {
2574 	struct mqfs_node *pn;
2575 	int error;
2576 
2577 	error = 0;
2578 	pn = fp->f_data;
2579 	sx_xlock(&mqfs_data.mi_lock);
2580 	if (uid == (uid_t)-1)
2581 		uid = pn->mn_uid;
2582 	if (gid == (gid_t)-1)
2583 		gid = pn->mn_gid;
2584 	if (((uid != pn->mn_uid && uid != active_cred->cr_uid) ||
2585 	    (gid != pn->mn_gid && !groupmember(gid, active_cred))) &&
2586 	    (error = priv_check_cred(active_cred, PRIV_VFS_CHOWN)))
2587 		goto out;
2588 	pn->mn_uid = uid;
2589 	pn->mn_gid = gid;
2590 out:
2591 	sx_xunlock(&mqfs_data.mi_lock);
2592 	return (error);
2593 }
2594 
2595 static int
2596 mqf_kqfilter(struct file *fp, struct knote *kn)
2597 {
2598 	struct mqueue *mq = FPTOMQ(fp);
2599 	int error = 0;
2600 
2601 	if (kn->kn_filter == EVFILT_READ) {
2602 		kn->kn_fop = &mq_rfiltops;
2603 		knlist_add(&mq->mq_rsel.si_note, kn, 0);
2604 	} else if (kn->kn_filter == EVFILT_WRITE) {
2605 		kn->kn_fop = &mq_wfiltops;
2606 		knlist_add(&mq->mq_wsel.si_note, kn, 0);
2607 	} else
2608 		error = EINVAL;
2609 	return (error);
2610 }
2611 
2612 static void
2613 filt_mqdetach(struct knote *kn)
2614 {
2615 	struct mqueue *mq = FPTOMQ(kn->kn_fp);
2616 
2617 	if (kn->kn_filter == EVFILT_READ)
2618 		knlist_remove(&mq->mq_rsel.si_note, kn, 0);
2619 	else if (kn->kn_filter == EVFILT_WRITE)
2620 		knlist_remove(&mq->mq_wsel.si_note, kn, 0);
2621 	else
2622 		panic("filt_mqdetach");
2623 }
2624 
2625 static int
2626 filt_mqread(struct knote *kn, long hint)
2627 {
2628 	struct mqueue *mq = FPTOMQ(kn->kn_fp);
2629 
2630 	mtx_assert(&mq->mq_mutex, MA_OWNED);
2631 	return (mq->mq_curmsgs != 0);
2632 }
2633 
2634 static int
2635 filt_mqwrite(struct knote *kn, long hint)
2636 {
2637 	struct mqueue *mq = FPTOMQ(kn->kn_fp);
2638 
2639 	mtx_assert(&mq->mq_mutex, MA_OWNED);
2640 	return (mq->mq_curmsgs < mq->mq_maxmsg);
2641 }
2642 
2643 static int
2644 mqf_fill_kinfo(struct file *fp, struct kinfo_file *kif, struct filedesc *fdp)
2645 {
2646 
2647 	kif->kf_type = KF_TYPE_MQUEUE;
2648 	return (0);
2649 }
2650 
2651 static struct fileops mqueueops = {
2652 	.fo_read		= invfo_rdwr,
2653 	.fo_write		= invfo_rdwr,
2654 	.fo_truncate		= invfo_truncate,
2655 	.fo_ioctl		= invfo_ioctl,
2656 	.fo_poll		= mqf_poll,
2657 	.fo_kqfilter		= mqf_kqfilter,
2658 	.fo_stat		= mqf_stat,
2659 	.fo_close		= mqf_close,
2660 	.fo_chmod		= mqf_chmod,
2661 	.fo_chown		= mqf_chown,
2662 	.fo_sendfile		= invfo_sendfile,
2663 	.fo_fill_kinfo		= mqf_fill_kinfo,
2664 	.fo_flags		= DFLAG_PASSABLE,
2665 };
2666 
2667 static struct vop_vector mqfs_vnodeops = {
2668 	.vop_default 		= &default_vnodeops,
2669 	.vop_access		= mqfs_access,
2670 	.vop_cachedlookup	= mqfs_lookup,
2671 	.vop_lookup		= vfs_cache_lookup,
2672 	.vop_reclaim		= mqfs_reclaim,
2673 	.vop_create		= mqfs_create,
2674 	.vop_remove		= mqfs_remove,
2675 	.vop_inactive		= mqfs_inactive,
2676 	.vop_open		= mqfs_open,
2677 	.vop_close		= mqfs_close,
2678 	.vop_getattr		= mqfs_getattr,
2679 	.vop_setattr		= mqfs_setattr,
2680 	.vop_read		= mqfs_read,
2681 	.vop_write		= VOP_EOPNOTSUPP,
2682 	.vop_readdir		= mqfs_readdir,
2683 	.vop_mkdir		= VOP_EOPNOTSUPP,
2684 	.vop_rmdir		= VOP_EOPNOTSUPP
2685 };
2686 VFS_VOP_VECTOR_REGISTER(mqfs_vnodeops);
2687 
2688 static struct vfsops mqfs_vfsops = {
2689 	.vfs_init 		= mqfs_init,
2690 	.vfs_uninit		= mqfs_uninit,
2691 	.vfs_mount		= mqfs_mount,
2692 	.vfs_unmount		= mqfs_unmount,
2693 	.vfs_root		= mqfs_root,
2694 	.vfs_statfs		= mqfs_statfs,
2695 };
2696 
2697 static struct vfsconf mqueuefs_vfsconf = {
2698 	.vfc_version = VFS_VERSION,
2699 	.vfc_name = "mqueuefs",
2700 	.vfc_vfsops = &mqfs_vfsops,
2701 	.vfc_typenum = -1,
2702 	.vfc_flags = VFCF_SYNTHETIC
2703 };
2704 
2705 static struct syscall_helper_data mq_syscalls[] = {
2706 	SYSCALL_INIT_HELPER(kmq_open),
2707 	SYSCALL_INIT_HELPER_F(kmq_setattr, SYF_CAPENABLED),
2708 	SYSCALL_INIT_HELPER_F(kmq_timedsend, SYF_CAPENABLED),
2709 	SYSCALL_INIT_HELPER_F(kmq_timedreceive, SYF_CAPENABLED),
2710 	SYSCALL_INIT_HELPER_F(kmq_notify, SYF_CAPENABLED),
2711 	SYSCALL_INIT_HELPER(kmq_unlink),
2712 	SYSCALL_INIT_LAST
2713 };
2714 
2715 #ifdef COMPAT_FREEBSD32
2716 #include <compat/freebsd32/freebsd32.h>
2717 #include <compat/freebsd32/freebsd32_proto.h>
2718 #include <compat/freebsd32/freebsd32_signal.h>
2719 #include <compat/freebsd32/freebsd32_syscall.h>
2720 #include <compat/freebsd32/freebsd32_util.h>
2721 
2722 static void
2723 mq_attr_from32(const struct mq_attr32 *from, struct mq_attr *to)
2724 {
2725 
2726 	to->mq_flags = from->mq_flags;
2727 	to->mq_maxmsg = from->mq_maxmsg;
2728 	to->mq_msgsize = from->mq_msgsize;
2729 	to->mq_curmsgs = from->mq_curmsgs;
2730 }
2731 
2732 static void
2733 mq_attr_to32(const struct mq_attr *from, struct mq_attr32 *to)
2734 {
2735 
2736 	to->mq_flags = from->mq_flags;
2737 	to->mq_maxmsg = from->mq_maxmsg;
2738 	to->mq_msgsize = from->mq_msgsize;
2739 	to->mq_curmsgs = from->mq_curmsgs;
2740 }
2741 
2742 int
2743 freebsd32_kmq_open(struct thread *td, struct freebsd32_kmq_open_args *uap)
2744 {
2745 	struct mq_attr attr;
2746 	struct mq_attr32 attr32;
2747 	int flags, error;
2748 
2749 	if ((uap->flags & O_ACCMODE) == O_ACCMODE || uap->flags & O_EXEC)
2750 		return (EINVAL);
2751 	flags = FFLAGS(uap->flags);
2752 	if ((flags & O_CREAT) != 0 && uap->attr != NULL) {
2753 		error = copyin(uap->attr, &attr32, sizeof(attr32));
2754 		if (error)
2755 			return (error);
2756 		mq_attr_from32(&attr32, &attr);
2757 	}
2758 	return (kern_kmq_open(td, uap->path, flags, uap->mode,
2759 	    uap->attr != NULL ? &attr : NULL));
2760 }
2761 
2762 int
2763 freebsd32_kmq_setattr(struct thread *td, struct freebsd32_kmq_setattr_args *uap)
2764 {
2765 	struct mq_attr attr, oattr;
2766 	struct mq_attr32 attr32, oattr32;
2767 	int error;
2768 
2769 	if (uap->attr != NULL) {
2770 		error = copyin(uap->attr, &attr32, sizeof(attr32));
2771 		if (error != 0)
2772 			return (error);
2773 		mq_attr_from32(&attr32, &attr);
2774 	}
2775 	error = kern_kmq_setattr(td, uap->mqd, uap->attr != NULL ? &attr : NULL,
2776 	    &oattr);
2777 	if (error == 0 && uap->oattr != NULL) {
2778 		mq_attr_to32(&oattr, &oattr32);
2779 		bzero(oattr32.__reserved, sizeof(oattr32.__reserved));
2780 		error = copyout(&oattr32, uap->oattr, sizeof(oattr32));
2781 	}
2782 	return (error);
2783 }
2784 
2785 int
2786 freebsd32_kmq_timedsend(struct thread *td,
2787     struct freebsd32_kmq_timedsend_args *uap)
2788 {
2789 	struct mqueue *mq;
2790 	struct file *fp;
2791 	struct timespec32 ets32;
2792 	struct timespec *abs_timeout, ets;
2793 	int error;
2794 	int waitok;
2795 
2796 	AUDIT_ARG_FD(uap->mqd);
2797 	error = getmq_write(td, uap->mqd, &fp, NULL, &mq);
2798 	if (error)
2799 		return (error);
2800 	if (uap->abs_timeout != NULL) {
2801 		error = copyin(uap->abs_timeout, &ets32, sizeof(ets32));
2802 		if (error != 0)
2803 			goto out;
2804 		CP(ets32, ets, tv_sec);
2805 		CP(ets32, ets, tv_nsec);
2806 		abs_timeout = &ets;
2807 	} else
2808 		abs_timeout = NULL;
2809 	waitok = !(fp->f_flag & O_NONBLOCK);
2810 	error = mqueue_send(mq, uap->msg_ptr, uap->msg_len,
2811 		uap->msg_prio, waitok, abs_timeout);
2812 out:
2813 	fdrop(fp, td);
2814 	return (error);
2815 }
2816 
2817 int
2818 freebsd32_kmq_timedreceive(struct thread *td,
2819     struct freebsd32_kmq_timedreceive_args *uap)
2820 {
2821 	struct mqueue *mq;
2822 	struct file *fp;
2823 	struct timespec32 ets32;
2824 	struct timespec *abs_timeout, ets;
2825 	int error, waitok;
2826 
2827 	AUDIT_ARG_FD(uap->mqd);
2828 	error = getmq_read(td, uap->mqd, &fp, NULL, &mq);
2829 	if (error)
2830 		return (error);
2831 	if (uap->abs_timeout != NULL) {
2832 		error = copyin(uap->abs_timeout, &ets32, sizeof(ets32));
2833 		if (error != 0)
2834 			goto out;
2835 		CP(ets32, ets, tv_sec);
2836 		CP(ets32, ets, tv_nsec);
2837 		abs_timeout = &ets;
2838 	} else
2839 		abs_timeout = NULL;
2840 	waitok = !(fp->f_flag & O_NONBLOCK);
2841 	error = mqueue_receive(mq, uap->msg_ptr, uap->msg_len,
2842 		uap->msg_prio, waitok, abs_timeout);
2843 out:
2844 	fdrop(fp, td);
2845 	return (error);
2846 }
2847 
2848 int
2849 freebsd32_kmq_notify(struct thread *td, struct freebsd32_kmq_notify_args *uap)
2850 {
2851 	struct sigevent ev, *evp;
2852 	struct sigevent32 ev32;
2853 	int error;
2854 
2855 	if (uap->sigev == NULL) {
2856 		evp = NULL;
2857 	} else {
2858 		error = copyin(uap->sigev, &ev32, sizeof(ev32));
2859 		if (error != 0)
2860 			return (error);
2861 		error = convert_sigevent32(&ev32, &ev);
2862 		if (error != 0)
2863 			return (error);
2864 		evp = &ev;
2865 	}
2866 	return (kern_kmq_notify(td, uap->mqd, evp));
2867 }
2868 
2869 static struct syscall_helper_data mq32_syscalls[] = {
2870 	SYSCALL32_INIT_HELPER(freebsd32_kmq_open),
2871 	SYSCALL32_INIT_HELPER_F(freebsd32_kmq_setattr, SYF_CAPENABLED),
2872 	SYSCALL32_INIT_HELPER_F(freebsd32_kmq_timedsend, SYF_CAPENABLED),
2873 	SYSCALL32_INIT_HELPER_F(freebsd32_kmq_timedreceive, SYF_CAPENABLED),
2874 	SYSCALL32_INIT_HELPER_F(freebsd32_kmq_notify, SYF_CAPENABLED),
2875 	SYSCALL32_INIT_HELPER_COMPAT(kmq_unlink),
2876 	SYSCALL_INIT_LAST
2877 };
2878 #endif
2879 
2880 static int
2881 mqinit(void)
2882 {
2883 	int error;
2884 
2885 	error = syscall_helper_register(mq_syscalls, SY_THR_STATIC_KLD);
2886 	if (error != 0)
2887 		return (error);
2888 #ifdef COMPAT_FREEBSD32
2889 	error = syscall32_helper_register(mq32_syscalls, SY_THR_STATIC_KLD);
2890 	if (error != 0)
2891 		return (error);
2892 #endif
2893 	return (0);
2894 }
2895 
2896 static int
2897 mqunload(void)
2898 {
2899 
2900 #ifdef COMPAT_FREEBSD32
2901 	syscall32_helper_unregister(mq32_syscalls);
2902 #endif
2903 	syscall_helper_unregister(mq_syscalls);
2904 	return (0);
2905 }
2906 
2907 static int
2908 mq_modload(struct module *module, int cmd, void *arg)
2909 {
2910 	int error = 0;
2911 
2912 	error = vfs_modevent(module, cmd, arg);
2913 	if (error != 0)
2914 		return (error);
2915 
2916 	switch (cmd) {
2917 	case MOD_LOAD:
2918 		error = mqinit();
2919 		if (error != 0)
2920 			mqunload();
2921 		break;
2922 	case MOD_UNLOAD:
2923 		error = mqunload();
2924 		break;
2925 	default:
2926 		break;
2927 	}
2928 	return (error);
2929 }
2930 
2931 static moduledata_t mqueuefs_mod = {
2932 	"mqueuefs",
2933 	mq_modload,
2934 	&mqueuefs_vfsconf
2935 };
2936 DECLARE_MODULE(mqueuefs, mqueuefs_mod, SI_SUB_VFS, SI_ORDER_MIDDLE);
2937 MODULE_VERSION(mqueuefs, 1);
2938