xref: /freebsd/sys/kern/uipc_mqueue.c (revision a6de716d7ec7b937956f665e24a30df964c0c245)
1 /*-
2  * Copyright (c) 2005 David Xu <davidxu@freebsd.org>
3  * All rights reserved.
4  *
5  * Redistribution and use in source and binary forms, with or without
6  * modification, are permitted provided that the following conditions
7  * are met:
8  * 1. Redistributions of source code must retain the above copyright
9  *    notice, this list of conditions and the following disclaimer.
10  * 2. Redistributions in binary form must reproduce the above copyright
11  *    notice, this list of conditions and the following disclaimer in the
12  *    documentation and/or other materials provided with the distribution.
13  *
14  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
15  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
16  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
17  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
18  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
19  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
20  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
21  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
22  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
23  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
24  * SUCH DAMAGE.
25  *
26  */
27 
28 /*
29  * POSIX message queue implementation.
30  *
31  * 1) A mqueue filesystem can be mounted, each message queue appears
32  *    in mounted directory, user can change queue's permission and
33  *    ownership, or remove a queue. Manually creating a file in the
34  *    directory causes a message queue to be created in the kernel with
35  *    default message queue attributes applied and same name used, this
36  *    method is not advocated since mq_open syscall allows user to specify
37  *    different attributes. Also the file system can be mounted multiple
38  *    times at different mount points but shows same contents.
39  *
40  * 2) Standard POSIX message queue API. The syscalls do not use vfs layer,
41  *    but directly operate on internal data structure, this allows user to
42  *    use the IPC facility without having to mount mqueue file system.
43  */
44 
45 #include <sys/cdefs.h>
46 __FBSDID("$FreeBSD$");
47 
48 #include <sys/param.h>
49 #include <sys/kernel.h>
50 #include <sys/systm.h>
51 #include <sys/limits.h>
52 #include <sys/buf.h>
53 #include <sys/dirent.h>
54 #include <sys/event.h>
55 #include <sys/eventhandler.h>
56 #include <sys/fcntl.h>
57 #include <sys/filedesc.h>
58 #include <sys/file.h>
59 #include <sys/limits.h>
60 #include <sys/lock.h>
61 #include <sys/malloc.h>
62 #include <sys/module.h>
63 #include <sys/mount.h>
64 #include <sys/mqueue.h>
65 #include <sys/mutex.h>
66 #include <sys/namei.h>
67 #include <sys/poll.h>
68 #include <sys/proc.h>
69 #include <sys/queue.h>
70 #include <sys/sysproto.h>
71 #include <sys/stat.h>
72 #include <sys/sysent.h>
73 #include <sys/syscall.h>
74 #include <sys/syscallsubr.h>
75 #include <sys/sx.h>
76 #include <sys/sysctl.h>
77 #include <sys/sysctl.h>
78 #include <sys/vnode.h>
79 #include <sys/sysctl.h>
80 #include <sys/taskqueue.h>
81 #include <sys/unistd.h>
82 #include <sys/vnode.h>
83 #include <machine/atomic.h>
84 
85 /*
86  * Limits and constants
87  */
88 #define	MQFS_NAMELEN		NAME_MAX
89 #define MQFS_DELEN		(8 + MQFS_NAMELEN)
90 
91 /* node types */
92 typedef enum {
93 	mqfstype_none = 0,
94 	mqfstype_root,
95 	mqfstype_dir,
96 	mqfstype_this,
97 	mqfstype_parent,
98 	mqfstype_file,
99 	mqfstype_symlink,
100 } mqfs_type_t;
101 
102 struct mqfs_node;
103 
104 /*
105  * mqfs_info: describes a mqfs instance
106  */
107 struct mqfs_info {
108 	struct sx		mi_lock;
109 	struct mqfs_node	*mi_root;
110 	struct unrhdr		*mi_unrhdr;
111 };
112 
113 struct mqfs_vdata {
114 	LIST_ENTRY(mqfs_vdata)	mv_link;
115 	struct mqfs_node	*mv_node;
116 	struct vnode		*mv_vnode;
117 	struct task		mv_task;
118 };
119 
120 /*
121  * mqfs_node: describes a node (file or directory) within a mqfs
122  */
123 struct mqfs_node {
124 	char			mn_name[MQFS_NAMELEN+1];
125 	struct mqfs_info	*mn_info;
126 	struct mqfs_node	*mn_parent;
127 	LIST_HEAD(,mqfs_node)	mn_children;
128 	LIST_ENTRY(mqfs_node)	mn_sibling;
129 	LIST_HEAD(,mqfs_vdata)	mn_vnodes;
130 	int			mn_refcount;
131 	mqfs_type_t		mn_type;
132 	int			mn_deleted;
133 	u_int32_t		mn_fileno;
134 	void			*mn_data;
135 	struct timespec		mn_birth;
136 	struct timespec		mn_ctime;
137 	struct timespec		mn_atime;
138 	struct timespec		mn_mtime;
139 	uid_t			mn_uid;
140 	gid_t			mn_gid;
141 	int			mn_mode;
142 };
143 
144 #define	VTON(vp)	(((struct mqfs_vdata *)((vp)->v_data))->mv_node)
145 #define VTOMQ(vp) 	((struct mqueue *)(VTON(vp)->mn_data))
146 #define	VFSTOMQFS(m)	((struct mqfs_info *)((m)->mnt_data))
147 #define	FPTOMQ(fp)	((struct mqueue *)(((struct mqfs_node *) \
148 				(fp)->f_data)->mn_data))
149 
150 TAILQ_HEAD(msgq, mqueue_msg);
151 
152 struct mqueue;
153 
154 struct mqueue_notifier {
155 	LIST_ENTRY(mqueue_notifier)	nt_link;
156 	struct sigevent			nt_sigev;
157 	ksiginfo_t			nt_ksi;
158 	struct proc			*nt_proc;
159 	int				nt_fd;
160 };
161 
162 struct mqueue {
163 	struct mtx	mq_mutex;
164 	int		mq_flags;
165 	long		mq_maxmsg;
166 	long		mq_msgsize;
167 	long		mq_curmsgs;
168 	long		mq_totalbytes;
169 	struct msgq	mq_msgq;
170 	int		mq_receivers;
171 	int		mq_senders;
172 	struct selinfo	mq_rsel;
173 	struct selinfo	mq_wsel;
174 	struct mqueue_notifier	*mq_notifier;
175 };
176 
177 #define	MQ_RSEL		0x01
178 #define	MQ_WSEL		0x02
179 
180 struct mqueue_msg {
181 	TAILQ_ENTRY(mqueue_msg)	msg_link;
182 	unsigned int	msg_prio;
183 	unsigned int	msg_size;
184 	/* following real data... */
185 };
186 
187 SYSCTL_NODE(_kern, OID_AUTO, mqueue, CTLFLAG_RW, 0,
188 	"POSIX real time message queue");
189 
190 static int	default_maxmsg  = 10;
191 static int	default_msgsize = 1024;
192 
193 static int	maxmsg = 20;
194 SYSCTL_INT(_kern_mqueue, OID_AUTO, maxmsg, CTLFLAG_RW,
195     &maxmsg, 0, "Default maximum messages in queue");
196 static int	maxmsgsize = 16384;
197 SYSCTL_INT(_kern_mqueue, OID_AUTO, maxmsgsize, CTLFLAG_RW,
198     &maxmsgsize, 0, "Default maximum message size");
199 static int	maxmq = 100;
200 SYSCTL_INT(_kern_mqueue, OID_AUTO, maxmq, CTLFLAG_RW,
201     &maxmq, 0, "maximum message queues");
202 static int	curmq = 0;
203 SYSCTL_INT(_kern_mqueue, OID_AUTO, curmq, CTLFLAG_RW,
204     &curmq, 0, "current message queue number");
205 static int	unloadable = 0;
206 static MALLOC_DEFINE(M_MQUEUEDATA, "mqdata", "mqueue data");
207 
208 static eventhandler_tag exit_tag;
209 
210 /* Only one instance per-system */
211 static struct mqfs_info		mqfs_data;
212 static uma_zone_t		mqnode_zone;
213 static uma_zone_t		mqueue_zone;
214 static uma_zone_t		mvdata_zone;
215 static uma_zone_t		mqnoti_zone;
216 static struct vop_vector	mqfs_vnodeops;
217 static struct fileops		mqueueops;
218 
219 /*
220  * Directory structure construction and manipulation
221  */
222 #ifdef notyet
223 static struct mqfs_node	*mqfs_create_dir(struct mqfs_node *parent,
224 	const char *name, int namelen);
225 #endif
226 
227 static struct mqfs_node	*mqfs_create_file(struct mqfs_node *parent,
228 	const char *name, int namelen);
229 struct mqfs_node	*mqfs_create_link(struct mqfs_node *parent,
230 	const char *name, int namelen);
231 static int	mqfs_destroy(struct mqfs_node *mn);
232 static void	mqfs_fileno_alloc(struct mqfs_info *mi, struct mqfs_node *mn);
233 static void	mqfs_fileno_free(struct mqfs_info *mi, struct mqfs_node *mn);
234 static int	mqfs_allocv(struct mount *mp, struct vnode **vpp, struct mqfs_node *pn);
235 
236 /*
237  * Message queue construction and maniplation
238  */
239 static struct mqueue	*mqueue_alloc(const struct mq_attr *attr);
240 static void	mqueue_free(struct mqueue *mq);
241 static int	mqueue_send(struct mqueue *mq, const char *msg_ptr,
242 			size_t msg_len, unsigned msg_prio, int waitok,
243 			const struct timespec *abs_timeout);
244 static int	mqueue_receive(struct mqueue *mq, char *msg_ptr,
245 			size_t msg_len, unsigned *msg_prio, int waitok,
246 			const struct timespec *abs_timeout);
247 static int	_mqueue_send(struct mqueue *mq, struct mqueue_msg *msg,
248 			int timo);
249 static int	_mqueue_recv(struct mqueue *mq, struct mqueue_msg **msg,
250 			int timo);
251 static void	mqueue_send_notification(struct mqueue *mq);
252 static void	mqueue_fdclose(struct thread *td, int fd, struct file *fp);
253 static void	mq_proc_exit(void *arg, struct proc *p);
254 
255 /*
256  * kqueue filters
257  */
258 static void	filt_mqdetach(struct knote *kn);
259 static int	filt_mqread(struct knote *kn, long hint);
260 static int	filt_mqwrite(struct knote *kn, long hint);
261 
262 struct filterops mq_rfiltops =
263 	{ 1, NULL, filt_mqdetach, filt_mqread };
264 struct filterops mq_wfiltops =
265 	{ 1, NULL, filt_mqdetach, filt_mqwrite };
266 
267 /*
268  * Initialize fileno bitmap
269  */
270 static void
271 mqfs_fileno_init(struct mqfs_info *mi)
272 {
273 	struct unrhdr *up;
274 
275 	up = new_unrhdr(1, INT_MAX, NULL);
276 	mi->mi_unrhdr = up;
277 }
278 
279 /*
280  * Tear down fileno bitmap
281  */
282 static void
283 mqfs_fileno_uninit(struct mqfs_info *mi)
284 {
285 	struct unrhdr *up;
286 
287 	up = mi->mi_unrhdr;
288 	mi->mi_unrhdr = NULL;
289 	delete_unrhdr(up);
290 }
291 
292 /*
293  * Allocate a file number
294  */
295 static void
296 mqfs_fileno_alloc(struct mqfs_info *mi, struct mqfs_node *mn)
297 {
298 	/* make sure our parent has a file number */
299 	if (mn->mn_parent && !mn->mn_parent->mn_fileno)
300 		mqfs_fileno_alloc(mi, mn->mn_parent);
301 
302 	switch (mn->mn_type) {
303 	case mqfstype_root:
304 	case mqfstype_dir:
305 	case mqfstype_file:
306 	case mqfstype_symlink:
307 		mn->mn_fileno = alloc_unr(mi->mi_unrhdr);
308 		break;
309 	case mqfstype_this:
310 		KASSERT(mn->mn_parent != NULL,
311 		    ("mqfstype_this node has no parent"));
312 		mn->mn_fileno = mn->mn_parent->mn_fileno;
313 		break;
314 	case mqfstype_parent:
315 		KASSERT(mn->mn_parent != NULL,
316 		    ("mqfstype_parent node has no parent"));
317 		if (mn->mn_parent == mi->mi_root) {
318 			mn->mn_fileno = mn->mn_parent->mn_fileno;
319 			break;
320 		}
321 		KASSERT(mn->mn_parent->mn_parent != NULL,
322 		    ("mqfstype_parent node has no grandparent"));
323 		mn->mn_fileno = mn->mn_parent->mn_parent->mn_fileno;
324 		break;
325 	default:
326 		KASSERT(0,
327 		    ("mqfs_fileno_alloc() called for unknown type node: %d",
328 			mn->mn_type));
329 		break;
330 	}
331 }
332 
333 /*
334  * Release a file number
335  */
336 static void
337 mqfs_fileno_free(struct mqfs_info *mi, struct mqfs_node *mn)
338 {
339 	switch (mn->mn_type) {
340 	case mqfstype_root:
341 	case mqfstype_dir:
342 	case mqfstype_file:
343 	case mqfstype_symlink:
344 		free_unr(mi->mi_unrhdr, mn->mn_fileno);
345 		break;
346 	case mqfstype_this:
347 	case mqfstype_parent:
348 		/* ignore these, as they don't "own" their file number */
349 		break;
350 	default:
351 		KASSERT(0,
352 		    ("mqfs_fileno_free() called for unknown type node: %d",
353 			mn->mn_type));
354 		break;
355 	}
356 }
357 
358 static __inline struct mqfs_node *
359 mqnode_alloc(void)
360 {
361 	return uma_zalloc(mqnode_zone, M_WAITOK | M_ZERO);
362 }
363 
364 static __inline void
365 mqnode_free(struct mqfs_node *node)
366 {
367 	uma_zfree(mqnode_zone, node);
368 }
369 
370 static __inline void
371 mqnode_addref(struct mqfs_node *node)
372 {
373 	atomic_fetchadd_int(&node->mn_refcount, 1);
374 }
375 
376 static __inline void
377 mqnode_release(struct mqfs_node *node)
378 {
379 	int old, exp;
380 
381 	old = atomic_fetchadd_int(&node->mn_refcount, -1);
382 	if (node->mn_type == mqfstype_dir ||
383 	    node->mn_type == mqfstype_root)
384 		exp = 3; /* include . and .. */
385 	else
386 		exp = 1;
387 	if (old == exp)
388 		mqfs_destroy(node);
389 }
390 
391 /*
392  * Add a node to a directory
393  */
394 static int
395 mqfs_add_node(struct mqfs_node *parent, struct mqfs_node *node)
396 {
397 	KASSERT(parent != NULL, ("%s(): parent is NULL", __func__));
398 	KASSERT(parent->mn_info != NULL,
399 	    ("%s(): parent has no mn_info", __func__));
400 	KASSERT(parent->mn_type == mqfstype_dir ||
401 	    parent->mn_type == mqfstype_root,
402 	    ("%s(): parent is not a directory", __func__));
403 
404 	node->mn_info = parent->mn_info;
405 	node->mn_parent = parent;
406 	LIST_INIT(&node->mn_children);
407 	LIST_INIT(&node->mn_vnodes);
408 	LIST_INSERT_HEAD(&parent->mn_children, node, mn_sibling);
409 	mqnode_addref(parent);
410 	return (0);
411 }
412 
413 /*
414  * Add . and .. to a directory
415  */
416 static int
417 mqfs_fixup_dir(struct mqfs_node *parent)
418 {
419 	struct mqfs_node *dir;
420 
421 	dir = mqnode_alloc();
422 	dir->mn_name[0] = '.';
423 	dir->mn_type = mqfstype_this;
424 	dir->mn_refcount = 1;
425 	if (mqfs_add_node(parent, dir) != 0) {
426 		mqnode_free(dir);
427 		return (-1);
428 	}
429 
430 	dir = mqnode_alloc();
431 	dir->mn_name[0] = dir->mn_name[1] = '.';
432 	dir->mn_type = mqfstype_parent;
433 	dir->mn_refcount = 1;
434 
435 	if (mqfs_add_node(parent, dir) != 0) {
436 		mqnode_free(dir);
437 		return (-1);
438 	}
439 
440 	return (0);
441 }
442 
443 #ifdef notyet
444 
445 /*
446  * Create a directory
447  */
448 static struct mqfs_node *
449 mqfs_create_dir(struct mqfs_node *parent, const char *name, int namelen)
450 {
451 	struct mqfs_node *dir;
452 
453 	dir = mqnode_alloc();
454 	strncpy(dir->mn_name, name, namelen);
455 	dir->mn_type = mqfstype_dir;
456 	dir->mn_refcount = 1;
457 	if (mqfs_add_node(parent, dir) != 0) {
458 		mqnode_free(dir);
459 		return (NULL);
460 	}
461 
462 	if (mqfs_fixup_dir(dir) != 0) {
463 		mqfs_destroy(dir);
464 		return (NULL);
465 	}
466 
467 	return (dir);
468 }
469 
470 /*
471  * Create a symlink
472  */
473 static struct mqfs_node *
474 mqfs_create_link(struct mqfs_node *parent, const char *name, int namelen)
475 {
476 	struct mqfs_node *node;
477 
478 	node = mqfs_create_file(parent, name, namelen);
479 	if (node == NULL)
480 		return (NULL);
481 	node->mn_type = mqfstype_symlink;
482 	return (node);
483 }
484 
485 #endif
486 
487 /*
488  * Create a file
489  */
490 static struct mqfs_node *
491 mqfs_create_file(struct mqfs_node *parent, const char *name, int namelen)
492 {
493 	struct mqfs_node *node;
494 
495 	node = mqnode_alloc();
496 	strncpy(node->mn_name, name, namelen);
497 	node->mn_type = mqfstype_file;
498 	node->mn_refcount = 1;
499 
500 	if (mqfs_add_node(parent, node) != 0) {
501 		mqnode_free(node);
502 		return (NULL);
503 	}
504 	return (node);
505 }
506 
507 /*
508  * Destroy a node or a tree of nodes
509  */
510 static int
511 mqfs_destroy(struct mqfs_node *node)
512 {
513 	struct mqfs_node *parent;
514 
515 	KASSERT(node != NULL,
516 	    ("%s(): node is NULL", __func__));
517 	KASSERT(node->mn_info != NULL,
518 	    ("%s(): node has no mn_info", __func__));
519 
520 	/* destroy children */
521 	if (node->mn_type == mqfstype_dir || node->mn_type == mqfstype_root)
522 		while (! LIST_EMPTY(&node->mn_children))
523 			mqfs_destroy(LIST_FIRST(&node->mn_children));
524 
525 	/* unlink from parent */
526 	if ((parent = node->mn_parent) != NULL) {
527 		KASSERT(parent->mn_info == node->mn_info,
528 		    ("%s(): parent has different mn_info", __func__));
529 		LIST_REMOVE(node, mn_sibling);
530 	}
531 
532 	if (node->mn_fileno != 0)
533 		mqfs_fileno_free(node->mn_info, node);
534 	if (node->mn_data != NULL)
535 		mqueue_free(node->mn_data);
536 	mqnode_free(node);
537 	return (0);
538 }
539 
540 /*
541  * Mount a mqfs instance
542  */
543 static int
544 mqfs_mount(struct mount *mp, struct thread *td)
545 {
546 	struct statfs *sbp;
547 
548 	if (mp->mnt_flag & MNT_UPDATE)
549 		return (EOPNOTSUPP);
550 
551 	mp->mnt_data = &mqfs_data;
552 	mp->mnt_flag |= MNT_LOCAL;
553 	/* mp->mnt_kern_flag |= MNTK_MPSAFE; */
554 	vfs_getnewfsid(mp);
555 
556 	sbp = &mp->mnt_stat;
557 	vfs_mountedfrom(mp, "mqueue");
558 	sbp->f_bsize = PAGE_SIZE;
559 	sbp->f_iosize = PAGE_SIZE;
560 	sbp->f_blocks = 1;
561 	sbp->f_bfree = 0;
562 	sbp->f_bavail = 0;
563 	sbp->f_files = 1;
564 	sbp->f_ffree = 0;
565 	return (0);
566 }
567 
568 /*
569  * Unmount a mqfs instance
570  */
571 static int
572 mqfs_unmount(struct mount *mp, int mntflags, struct thread *td)
573 {
574 	int error;
575 
576 	error = vflush(mp, 0, (mntflags & MNT_FORCE) ?  FORCECLOSE : 0, td);
577 	return (error);
578 }
579 
580 /*
581  * Return a root vnode
582  */
583 static int
584 mqfs_root(struct mount *mp, int flags, struct vnode **vpp, struct thread *td)
585 {
586 	struct mqfs_info *mqfs;
587 	int ret;
588 
589 	mqfs = VFSTOMQFS(mp);
590 	sx_xlock(&mqfs->mi_lock);
591 	ret = mqfs_allocv(mp, vpp, mqfs->mi_root);
592 	sx_xunlock(&mqfs->mi_lock);
593 	return (ret);
594 }
595 
596 /*
597  * Return filesystem stats
598  */
599 static int
600 mqfs_statfs(struct mount *mp, struct statfs *sbp, struct thread *td)
601 {
602 	/* XXX update statistics */
603 	return (0);
604 }
605 
606 /*
607  * Initialize a mqfs instance
608  */
609 static int
610 mqfs_init(struct vfsconf *vfc)
611 {
612 	struct mqfs_node *root;
613 	struct mqfs_info *mi;
614 
615 	mqnode_zone = uma_zcreate("mqnode", sizeof(struct mqfs_node),
616 		NULL, NULL, NULL, NULL, UMA_ALIGN_PTR, 0);
617 	mqueue_zone = uma_zcreate("mqueue", sizeof(struct mqueue),
618 		NULL, NULL, NULL, NULL, UMA_ALIGN_PTR, 0);
619 	mvdata_zone = uma_zcreate("mvdata",
620 		sizeof(struct mqfs_vdata), NULL, NULL, NULL,
621 		NULL, UMA_ALIGN_PTR, 0);
622 	mqnoti_zone = uma_zcreate("mqnotifier", sizeof(struct mqueue_notifier),
623 		NULL, NULL, NULL, NULL, UMA_ALIGN_PTR, 0);
624 	mi = &mqfs_data;
625 	sx_init(&mi->mi_lock, "mqfs lock");
626 	/* set up the root diretory */
627 	root = mqnode_alloc();
628 	root->mn_type = mqfstype_root;
629 	root->mn_refcount = 1;
630 	root->mn_name[0] = '/';
631 	root->mn_info = mi;
632 	LIST_INIT(&root->mn_children);
633 	LIST_INIT(&root->mn_vnodes);
634 	root->mn_mode = 01777;
635 	mi->mi_root = root;
636 	mqfs_fileno_init(mi);
637 	mqfs_fileno_alloc(mi, root);
638 	mqfs_fixup_dir(root);
639 	exit_tag = EVENTHANDLER_REGISTER(process_exit, mq_proc_exit, NULL,
640 	    EVENTHANDLER_PRI_ANY);
641 	mq_fdclose = mqueue_fdclose;
642 	return (0);
643 }
644 
645 /*
646  * Destroy a mqfs instance
647  */
648 static int
649 mqfs_uninit(struct vfsconf *vfc)
650 {
651 	struct mqfs_info *mi;
652 
653 	if (!unloadable)
654 		return (EOPNOTSUPP);
655 	EVENTHANDLER_DEREGISTER(process_exit, exit_tag);
656 	mi = &mqfs_data;
657 	mqfs_destroy(mi->mi_root);
658 	mi->mi_root = NULL;
659 	mqfs_fileno_uninit(mi);
660 	sx_destroy(&mi->mi_lock);
661 	uma_zdestroy(mqnode_zone);
662 	uma_zdestroy(mqueue_zone);
663 	uma_zdestroy(mvdata_zone);
664 	uma_zdestroy(mqnoti_zone);
665 	return (0);
666 }
667 
668 /*
669  * task routine
670  */
671 static void
672 do_recycle(void *context, int pending __unused)
673 {
674 	struct vnode *vp = (struct vnode *)context;
675 
676 	vrecycle(vp, curthread);
677 	vdrop(vp);
678 }
679 
680 /*
681  * Allocate a vnode
682  */
683 static int
684 mqfs_allocv(struct mount *mp, struct vnode **vpp, struct mqfs_node *pn)
685 {
686 	struct mqfs_vdata *vd;
687 	int error;
688 
689 	LIST_FOREACH(vd, &pn->mn_vnodes, mv_link) {
690 		if (vd->mv_vnode->v_mount == mp)
691 			break;
692 	}
693 
694 	if (vd != NULL) {
695 		if (vget(vd->mv_vnode, 0, curthread) == 0) {
696 			*vpp = vd->mv_vnode;
697 			vn_lock(*vpp, LK_RETRY | LK_EXCLUSIVE,
698 			    curthread);
699 			return (0);
700 		}
701 		/* XXX if this can happen, we're in trouble */
702 	}
703 
704 	error = getnewvnode("mqueue", mp, &mqfs_vnodeops, vpp);
705 	if (error)
706 		return (error);
707 	vd = uma_zalloc(mvdata_zone, M_WAITOK);
708 	(*vpp)->v_data = vd;
709 	vd->mv_vnode = *vpp;
710 	vd->mv_node = pn;
711 	TASK_INIT(&vd->mv_task, 0, do_recycle, *vpp);
712 	LIST_INSERT_HEAD(&pn->mn_vnodes, vd, mv_link);
713 	mqnode_addref(pn);
714 	switch (pn->mn_type) {
715 	case mqfstype_root:
716 		(*vpp)->v_vflag = VV_ROOT;
717 		/* fall through */
718 	case mqfstype_dir:
719 	case mqfstype_this:
720 	case mqfstype_parent:
721 		(*vpp)->v_type = VDIR;
722 		break;
723 	case mqfstype_file:
724 		(*vpp)->v_type = VREG;
725 		break;
726 	case mqfstype_symlink:
727 		(*vpp)->v_type = VLNK;
728 		break;
729 	case mqfstype_none:
730 		KASSERT(0, ("mqfs_allocf called for null node\n"));
731 	default:
732 		panic("%s has unexpected type: %d", pn->mn_name, pn->mn_type);
733 	}
734 	vn_lock(*vpp, LK_RETRY | LK_EXCLUSIVE, curthread);
735 	return (0);
736 }
737 
738 /*
739  * Search a directory entry
740  */
741 static struct mqfs_node *
742 mqfs_search(struct mqfs_node *pd, const char *name, int len)
743 {
744 	struct mqfs_node *pn;
745 
746 	LIST_FOREACH(pn, &pd->mn_children, mn_sibling) {
747 		if (strncmp(pn->mn_name, name, len) == 0)
748 			return (pn);
749 	}
750 	return (NULL);
751 }
752 
753 /*
754  * Look up a file or directory
755  */
756 static int
757 mqfs_lookupx(struct vop_cachedlookup_args *ap)
758 {
759 	struct componentname *cnp;
760 	struct vnode *dvp, **vpp;
761 	struct mqfs_node *pd;
762 	struct mqfs_node *pn;
763 	int nameiop, flags, error, namelen;
764 	char *pname;
765 	struct thread *td;
766 
767 	cnp = ap->a_cnp;
768 	vpp = ap->a_vpp;
769 	dvp = ap->a_dvp;
770 	pname = cnp->cn_nameptr;
771 	namelen = cnp->cn_namelen;
772 	td = cnp->cn_thread;
773 	flags = cnp->cn_flags;
774 	nameiop = cnp->cn_nameiop;
775 	pd = VTON(dvp);
776 	pn = NULL;
777 	*vpp = NULLVP;
778 
779 	if (dvp->v_type != VDIR)
780 		return (ENOTDIR);
781 
782 	error = VOP_ACCESS(dvp, VEXEC, cnp->cn_cred, cnp->cn_thread);
783 	if (error)
784 		return (error);
785 
786 	/* shortcut: check if the name is too long */
787 	if (cnp->cn_namelen >= MQFS_NAMELEN)
788 		return (ENOENT);
789 
790 	/* self */
791 	if (namelen == 1 && pname[0] == '.') {
792 		if ((flags & ISLASTCN) && nameiop != LOOKUP)
793 			return (EINVAL);
794 		pn = pd;
795 		*vpp = dvp;
796 		VREF(dvp);
797 		return (0);
798 	}
799 
800 	/* parent */
801 	if (cnp->cn_flags & ISDOTDOT) {
802 		if (dvp->v_vflag & VV_ROOT)
803 			return (EIO);
804 		if ((flags & ISLASTCN) && nameiop != LOOKUP)
805 			return (EINVAL);
806 		VOP_UNLOCK(dvp, 0, cnp->cn_thread);
807 		KASSERT(pd->mn_parent, ("non-root directory has no parent"));
808 		pn = pd->mn_parent;
809 		error = mqfs_allocv(dvp->v_mount, vpp, pn);
810 		vn_lock(dvp, LK_EXCLUSIVE | LK_RETRY, td);
811 		return (error);
812 	}
813 
814 	/* named node */
815 	pn = mqfs_search(pd, pname, namelen);
816 
817 	/* found */
818 	if (pn != NULL) {
819 		/* DELETE */
820 		if (nameiop == DELETE && (flags & ISLASTCN)) {
821 			error = VOP_ACCESS(dvp, VWRITE, cnp->cn_cred, td);
822 			if (error)
823 				return (error);
824 			if (*vpp == dvp) {
825 				VREF(dvp);
826 				*vpp = dvp;
827 				return (0);
828 			}
829 		}
830 
831 		/* allocate vnode */
832 		error = mqfs_allocv(dvp->v_mount, vpp, pn);
833 		if (error == 0 && cnp->cn_flags & MAKEENTRY)
834 			cache_enter(dvp, *vpp, cnp);
835 		return (error);
836 	}
837 
838 	/* not found */
839 
840 	/* will create a new entry in the directory ? */
841 	if ((nameiop == CREATE || nameiop == RENAME) && (flags & LOCKPARENT)
842 	    && (flags & ISLASTCN)) {
843 		error = VOP_ACCESS(dvp, VWRITE, cnp->cn_cred, td);
844 		if (error)
845 			return (error);
846 		cnp->cn_flags |= SAVENAME;
847 		return (EJUSTRETURN);
848 	}
849 	return (ENOENT);
850 }
851 
852 #if 0
853 struct vop_lookup_args {
854 	struct vop_generic_args a_gen;
855 	struct vnode *a_dvp;
856 	struct vnode **a_vpp;
857 	struct componentname *a_cnp;
858 };
859 #endif
860 
861 /*
862  * vnode lookup operation
863  */
864 static int
865 mqfs_lookup(struct vop_cachedlookup_args *ap)
866 {
867 	struct mqfs_info *mqfs = VFSTOMQFS(ap->a_dvp->v_mount);
868 	int rc;
869 
870 	sx_xlock(&mqfs->mi_lock);
871 	rc = mqfs_lookupx(ap);
872 	sx_xunlock(&mqfs->mi_lock);
873 	return (rc);
874 }
875 
876 #if 0
877 struct vop_create_args {
878 	struct vnode *a_dvp;
879 	struct vnode **a_vpp;
880 	struct componentname *a_cnp;
881 	struct vattr *a_vap;
882 };
883 #endif
884 
885 /*
886  * vnode creation operation
887  */
888 static int
889 mqfs_create(struct vop_create_args *ap)
890 {
891 	struct mqfs_info *mqfs = VFSTOMQFS(ap->a_dvp->v_mount);
892 	struct componentname *cnp = ap->a_cnp;
893 	struct mqfs_node *pd;
894 	struct mqfs_node *pn;
895 	struct mqueue *mq;
896 	int error;
897 
898 	pd = VTON(ap->a_dvp);
899 	if (pd->mn_type != mqfstype_root && pd->mn_type != mqfstype_dir)
900 		return (ENOTDIR);
901 	mq = mqueue_alloc(NULL);
902 	if (mq == NULL)
903 		return (EAGAIN);
904 	sx_xlock(&mqfs->mi_lock);
905 #if 0
906 	/* named node */
907 	pn = mqfs_search(pd, cnp->cn_nameptr, cnp->cn_namelen);
908 	if (pn != NULL) {
909 		mqueue_free(mq);
910 		sx_xunlock(&mqfs->mi_lock);
911 		return (EEXIST);
912 	}
913 #else
914 	if ((cnp->cn_flags & HASBUF) == 0)
915 		panic("%s: no name", __func__);
916 #endif
917 	pn = mqfs_create_file(pd, cnp->cn_nameptr, cnp->cn_namelen);
918 	pn->mn_mode = ap->a_vap->va_mode;
919 	pn->mn_uid = cnp->cn_cred->cr_uid;
920 	pn->mn_gid = cnp->cn_cred->cr_gid;
921 	pn->mn_data = mq;
922 	getnanotime(&pn->mn_birth);
923 	pn->mn_ctime = pn->mn_atime = pn->mn_mtime = pn->mn_birth;
924 	/* node attribute */
925 	error = mqfs_allocv(ap->a_dvp->v_mount, ap->a_vpp, pn);
926 	sx_xunlock(&mqfs->mi_lock);
927 	return (error);
928 }
929 
930 /*
931  * Remove an entry
932  */
933 static
934 int do_unlink(struct mqfs_node *pn, struct ucred *ucred)
935 {
936 	struct mqfs_node *parent;
937 	struct mqfs_vdata *vd;
938 	int error = 0;
939 
940 	sx_assert(&pn->mn_info->mi_lock, SX_LOCKED);
941 
942 	if (ucred->cr_uid != pn->mn_uid &&
943 	    (error = suser_cred(ucred, 0)) != 0)
944 		error = EACCES;
945 	else if (!pn->mn_deleted) {
946 		parent = pn->mn_parent;
947 		pn->mn_parent = NULL;
948 		pn->mn_deleted = 1;
949 		LIST_REMOVE(pn, mn_sibling);
950 		LIST_FOREACH(vd, &pn->mn_vnodes, mv_link) {
951 			cache_purge(vd->mv_vnode);
952 			vhold(vd->mv_vnode);
953 			taskqueue_enqueue(taskqueue_thread, &vd->mv_task);
954 		}
955 		mqnode_release(pn);
956 		mqnode_release(parent);
957 	} else
958 		error = ENOENT;
959 	return (error);
960 }
961 
962 #if 0
963 struct vop_remove_args {
964 	struct vnode *a_dvp;
965 	struct vnode *a_vp;
966 	struct componentname *a_cnp;
967 };
968 #endif
969 
970 /*
971  * vnode removal operation
972  */
973 static int
974 mqfs_remove(struct vop_remove_args *ap)
975 {
976 	struct mqfs_info *mqfs = VFSTOMQFS(ap->a_dvp->v_mount);
977 	struct mqfs_node *pn;
978 	int error;
979 
980 	if (ap->a_vp->v_type == VDIR)
981                 return (EPERM);
982 	pn = VTON(ap->a_vp);
983 	sx_xlock(&mqfs->mi_lock);
984 	error = do_unlink(pn, ap->a_cnp->cn_cred);
985 	sx_xunlock(&mqfs->mi_lock);
986 	return (error);
987 }
988 
989 #if 0
990 struct vop_inactive_args {
991 	struct vnode *a_vp;
992 	struct thread *a_td;
993 };
994 #endif
995 
996 static int
997 mqfs_inactive(struct vop_inactive_args *ap)
998 {
999 	struct mqfs_node *pn = VTON(ap->a_vp);
1000 
1001 	if (pn->mn_deleted)
1002 		vrecycle(ap->a_vp, ap->a_td);
1003 	return (0);
1004 }
1005 
1006 #if 0
1007 struct vop_reclaim_args {
1008 	struct vop_generic_args a_gen;
1009 	struct vnode *a_vp;
1010 	struct thread *a_td;
1011 };
1012 #endif
1013 
1014 static int
1015 mqfs_reclaim(struct vop_reclaim_args *ap)
1016 {
1017 	struct mqfs_info *mqfs = VFSTOMQFS(ap->a_vp->v_mount);
1018 	struct vnode *vp = ap->a_vp;
1019 	struct mqfs_node *pn;
1020 	struct mqfs_vdata *vd;
1021 
1022 	vd = vp->v_data;
1023 	pn = vd->mv_node;
1024 	sx_xlock(&mqfs->mi_lock);
1025 	vp->v_data = NULL;
1026 	LIST_REMOVE(vd, mv_link);
1027 	uma_zfree(mvdata_zone, vd);
1028 	mqnode_release(pn);
1029 	sx_xunlock(&mqfs->mi_lock);
1030 	return (0);
1031 }
1032 
1033 #if 0
1034 struct vop_open_args {
1035 	struct vop_generic_args a_gen;
1036 	struct vnode *a_vp;
1037 	int a_mode;
1038 	struct ucred *a_cred;
1039 	struct thread *a_td;
1040 	int a_fdidx;
1041 };
1042 #endif
1043 
1044 static int
1045 mqfs_open(struct vop_open_args *ap)
1046 {
1047 	return (0);
1048 }
1049 
1050 #if 0
1051 struct vop_close_args {
1052 	struct vop_generic_args a_gen;
1053 	struct vnode *a_vp;
1054 	int a_fflag;
1055 	struct ucred *a_cred;
1056 	struct thread *a_td;
1057 };
1058 #endif
1059 
1060 static int
1061 mqfs_close(struct vop_close_args *ap)
1062 {
1063 	return (0);
1064 }
1065 
1066 #if 0
1067 struct vop_access_args {
1068 	struct vop_generic_args a_gen;
1069 	struct vnode *a_vp;
1070 	int a_mode;
1071 	struct ucred *a_cred;
1072 	struct thread *a_td;
1073 };
1074 #endif
1075 
1076 /*
1077  * Verify permissions
1078  */
1079 static int
1080 mqfs_access(struct vop_access_args *ap)
1081 {
1082 	struct vnode *vp = ap->a_vp;
1083 	struct vattr vattr;
1084 	int error;
1085 
1086 	error = VOP_GETATTR(vp, &vattr, ap->a_cred, ap->a_td);
1087 	if (error)
1088 		return (error);
1089 	error = vaccess(vp->v_type, vattr.va_mode, vattr.va_uid,
1090 	    vattr.va_gid, ap->a_mode, ap->a_cred, NULL);
1091 	return (error);
1092 }
1093 
1094 #if 0
1095 struct vop_getattr_args {
1096 	struct vop_generic_args a_gen;
1097 	struct vnode *a_vp;
1098 	struct vattr *a_vap;
1099 	struct ucred *a_cred;
1100 	struct thread *a_td;
1101 };
1102 #endif
1103 
1104 /*
1105  * Get file attributes
1106  */
1107 static int
1108 mqfs_getattr(struct vop_getattr_args *ap)
1109 {
1110 	struct vnode *vp = ap->a_vp;
1111 	struct mqfs_node *pn = VTON(vp);
1112 	struct vattr *vap = ap->a_vap;
1113 	int error = 0;
1114 
1115 	VATTR_NULL(vap);
1116 	vap->va_type = vp->v_type;
1117 	vap->va_mode = pn->mn_mode;
1118 	vap->va_nlink = 1;
1119 	vap->va_uid = pn->mn_uid;
1120 	vap->va_gid = pn->mn_gid;
1121 	vap->va_fsid = vp->v_mount->mnt_stat.f_fsid.val[0];
1122 	vap->va_fileid = pn->mn_fileno;
1123 	vap->va_size = 0;
1124 	vap->va_blocksize = PAGE_SIZE;
1125 	vap->va_bytes = vap->va_size = 0;
1126 	vap->va_atime = pn->mn_atime;
1127 	vap->va_mtime = pn->mn_mtime;
1128 	vap->va_ctime = pn->mn_ctime;
1129 	vap->va_birthtime = pn->mn_birth;
1130 	vap->va_gen = 0;
1131 	vap->va_flags = 0;
1132 	vap->va_rdev = 0;
1133 	vap->va_bytes = 0;
1134 	vap->va_filerev = 0;
1135 	vap->va_vaflags = 0;
1136 	return (error);
1137 }
1138 
1139 #if 0
1140 struct vop_setattr_args {
1141 	struct vop_generic_args a_gen;
1142 	struct vnode *a_vp;
1143 	struct vattr *a_vap;
1144 	struct ucred *a_cred;
1145 	struct thread *a_td;
1146 };
1147 #endif
1148 /*
1149  * Set attributes
1150  */
1151 static int
1152 mqfs_setattr(struct vop_setattr_args *ap)
1153 {
1154 	struct mqfs_node *pn;
1155 	struct vattr *vap;
1156 	struct vnode *vp;
1157 	int c, error;
1158 	uid_t uid;
1159 	gid_t gid;
1160 
1161 	vap = ap->a_vap;
1162 	vp = ap->a_vp;
1163 	if ((vap->va_type != VNON) ||
1164 	    (vap->va_nlink != VNOVAL) ||
1165 	    (vap->va_fsid != VNOVAL) ||
1166 	    (vap->va_fileid != VNOVAL) ||
1167 	    (vap->va_blocksize != VNOVAL) ||
1168 	    (vap->va_flags != VNOVAL && vap->va_flags != 0) ||
1169 	    (vap->va_rdev != VNOVAL) ||
1170 	    ((int)vap->va_bytes != VNOVAL) ||
1171 	    (vap->va_gen != VNOVAL)) {
1172 		return (EINVAL);
1173 	}
1174 
1175 	pn = VTON(vp);
1176 
1177 	error = c = 0;
1178 	if (vap->va_uid == (uid_t)VNOVAL)
1179 		uid = pn->mn_uid;
1180 	else
1181 		uid = vap->va_uid;
1182 	if (vap->va_gid == (gid_t)VNOVAL)
1183 		gid = pn->mn_gid;
1184 	else
1185 		gid = vap->va_gid;
1186 
1187 	if (uid != pn->mn_uid || gid != pn->mn_gid) {
1188 		/*
1189 		 * To modify the ownership of a file, must possess VADMIN
1190 		 * for that file.
1191 		 */
1192 		if ((error = VOP_ACCESS(vp, VADMIN, ap->a_cred, ap->a_td)))
1193 			return (error);
1194 		if (((ap->a_cred->cr_uid != pn->mn_uid) || uid != pn->mn_uid ||
1195 		    (gid != pn->mn_gid && !groupmember(gid, ap->a_cred))) &&
1196 		    (error = suser_cred(ap->a_td->td_ucred, SUSER_ALLOWJAIL))
1197                        != 0)
1198 			return (error);
1199 		pn->mn_uid = uid;
1200 		pn->mn_gid = gid;
1201 		c = 1;
1202 	}
1203 
1204 	if (vap->va_mode != (mode_t)VNOVAL) {
1205 		if ((ap->a_cred->cr_uid != pn->mn_uid) &&
1206 		    (error = suser_cred(ap->a_td->td_ucred, SUSER_ALLOWJAIL)))
1207 			return (error);
1208 		pn->mn_mode = vap->va_mode;
1209 		c = 1;
1210 	}
1211 
1212 	if (vap->va_atime.tv_sec != VNOVAL || vap->va_mtime.tv_sec != VNOVAL) {
1213 		/* See the comment in ufs_vnops::ufs_setattr(). */
1214 		if ((error = VOP_ACCESS(vp, VADMIN, ap->a_cred, ap->a_td)) &&
1215 		    ((vap->va_vaflags & VA_UTIMES_NULL) == 0 ||
1216 		    (error = VOP_ACCESS(vp, VWRITE, ap->a_cred, ap->a_td))))
1217 			return (error);
1218 		if (vap->va_atime.tv_sec != VNOVAL) {
1219 			pn->mn_atime = vap->va_atime;
1220 		}
1221 		if (vap->va_mtime.tv_sec != VNOVAL) {
1222 			pn->mn_mtime = vap->va_mtime;
1223 		}
1224 		c = 1;
1225 	}
1226 	if (c) {
1227 		vfs_timestamp(&pn->mn_ctime);
1228 	}
1229 	return (0);
1230 }
1231 
1232 #if 0
1233 struct vop_read_args {
1234 	struct vop_generic_args a_gen;
1235 	struct vnode *a_vp;
1236 	struct uio *a_uio;
1237 	int a_ioflag;
1238 	struct ucred *a_cred;
1239 };
1240 #endif
1241 
1242 /*
1243  * Read from a file
1244  */
1245 static int
1246 mqfs_read(struct vop_read_args *ap)
1247 {
1248 	char buf[80];
1249 	struct vnode *vp = ap->a_vp;
1250 	struct uio *uio = ap->a_uio;
1251 	struct mqfs_node *pn;
1252 	struct mqueue *mq;
1253 	int len, error;
1254 
1255 	if (vp->v_type != VREG)
1256 		return (EINVAL);
1257 
1258 	pn = VTON(vp);
1259 	mq = VTOMQ(vp);
1260 	snprintf(buf, sizeof(buf),
1261 		"QSIZE:%-10ld MAXMSG:%-10ld CURMSG:%-10ld MSGSIZE:%-10ld\n",
1262 		mq->mq_totalbytes,
1263 		mq->mq_maxmsg,
1264 		mq->mq_curmsgs,
1265 		mq->mq_msgsize);
1266 	buf[sizeof(buf)-1] = '\0';
1267 	len = strlen(buf);
1268 	error = uiomove_frombuf(buf, len, uio);
1269 	return (error);
1270 }
1271 
1272 #if 0
1273 struct vop_readdir_args {
1274 	struct vop_generic_args a_gen;
1275 	struct vnode *a_vp;
1276 	struct uio *a_uio;
1277 	struct ucred *a_cred;
1278 	int *a_eofflag;
1279 	int *a_ncookies;
1280 	u_long **a_cookies;
1281 };
1282 #endif
1283 
1284 /*
1285  * Return directory entries.
1286  */
1287 static int
1288 mqfs_readdir(struct vop_readdir_args *ap)
1289 {
1290 	struct vnode *vp;
1291 	struct mqfs_info *mi;
1292 	struct mqfs_node *pd;
1293 	struct mqfs_node *pn;
1294 	struct dirent entry;
1295 	struct uio *uio;
1296 	int *tmp_ncookies = NULL;
1297 	off_t offset;
1298 	int error, i;
1299 
1300 	vp = ap->a_vp;
1301 	mi = VFSTOMQFS(vp->v_mount);
1302 	pd = VTON(vp);
1303 	uio = ap->a_uio;
1304 
1305 	if (vp->v_type != VDIR)
1306 		return (ENOTDIR);
1307 
1308 	if (uio->uio_offset < 0)
1309 		return (EINVAL);
1310 
1311 	if (ap->a_ncookies != NULL) {
1312 		tmp_ncookies = ap->a_ncookies;
1313 		*ap->a_ncookies = 0;
1314 		ap->a_ncookies = NULL;
1315         }
1316 
1317 	error = 0;
1318 	offset = 0;
1319 
1320 	sx_xlock(&mi->mi_lock);
1321 
1322 	LIST_FOREACH(pn, &pd->mn_children, mn_sibling) {
1323 		entry.d_reclen = sizeof(entry);
1324 		if (!pn->mn_fileno)
1325 			mqfs_fileno_alloc(mi, pn);
1326 		entry.d_fileno = pn->mn_fileno;
1327 		for (i = 0; i < MQFS_NAMELEN - 1 && pn->mn_name[i] != '\0'; ++i)
1328 			entry.d_name[i] = pn->mn_name[i];
1329 		entry.d_name[i] = 0;
1330 		entry.d_namlen = i;
1331 		switch (pn->mn_type) {
1332 		case mqfstype_root:
1333 		case mqfstype_dir:
1334 		case mqfstype_this:
1335 		case mqfstype_parent:
1336 			entry.d_type = DT_DIR;
1337 			break;
1338 		case mqfstype_file:
1339 			entry.d_type = DT_REG;
1340 			break;
1341 		case mqfstype_symlink:
1342 			entry.d_type = DT_LNK;
1343 			break;
1344 		default:
1345 			panic("%s has unexpected node type: %d", pn->mn_name,
1346 				pn->mn_type);
1347 		}
1348 		if (entry.d_reclen > uio->uio_resid)
1349                         break;
1350 		if (offset >= uio->uio_offset) {
1351 			error = vfs_read_dirent(ap, &entry, offset);
1352                         if (error)
1353                                 break;
1354                 }
1355                 offset += entry.d_reclen;
1356 	}
1357 	sx_xunlock(&mi->mi_lock);
1358 
1359 	uio->uio_offset = offset;
1360 
1361 	if (tmp_ncookies != NULL)
1362 		ap->a_ncookies = tmp_ncookies;
1363 
1364 	return (error);
1365 }
1366 
1367 #ifdef notyet
1368 
1369 #if 0
1370 struct vop_mkdir_args {
1371 	struct vnode *a_dvp;
1372 	struvt vnode **a_vpp;
1373 	struvt componentname *a_cnp;
1374 	struct vattr *a_vap;
1375 };
1376 #endif
1377 
1378 /*
1379  * Create a directory.
1380  */
1381 static int
1382 mqfs_mkdir(struct vop_mkdir_args *ap)
1383 {
1384 	struct mqfs_info *mqfs = VFSTOMQFS(ap->a_dvp->v_mount);
1385 	struct componentname *cnp = ap->a_cnp;
1386 	struct mqfs_node *pd = VTON(ap->a_dvp);
1387 	struct mqfs_node *pn;
1388 	int error;
1389 
1390 	if (pd->mn_type != mqfstype_root && pd->mn_type != mqfstype_dir)
1391 		return (ENOTDIR);
1392 	sx_xlock(&mqfs->mi_lock);
1393 #if 0
1394 	/* named node */
1395 	pn = mqfs_search(pd, cnp->cn_nameptr, cnp->cn_namelen);
1396 	if (pn != NULL) {
1397 		sx_xunlock(&mqfs->mi_lock);
1398 		return (EEXIST);
1399 	}
1400 #else
1401 	if ((cnp->cn_flags & HASBUF) == 0)
1402 		panic("%s: no name", __func__);
1403 #endif
1404 	pn = mqfs_create_dir(pd, cnp->cn_nameptr, cnp->cn_namelen);
1405 	pn->mn_mode = ap->a_vap->va_mode;
1406 	pn->mn_uid = cnp->cn_cred->cr_uid;
1407 	pn->mn_gid = cnp->cn_cred->cr_gid;
1408 	getnanotime(&pn->mn_birth);
1409 	pn->mn_ctime = pn->mn_atime = pn->mn_mtime = pn->mn_birth;
1410 	/* node attribute */
1411 	error = mqfs_allocv(ap->a_dvp->v_mount, ap->a_vpp, pn);
1412 	sx_xunlock(&mqfs->mi_lock);
1413 	return (error);
1414 }
1415 
1416 #if 0
1417 struct vop_rmdir_args {
1418 	struct vnode *a_dvp;
1419 	struct vnode *a_vp;
1420 	struct componentname *a_cnp;
1421 };
1422 #endif
1423 
1424 /*
1425  * Remove a directory.
1426  */
1427 static int
1428 mqfs_rmdir(struct vop_rmdir_args *ap)
1429 {
1430 	struct mqfs_info *mqfs = VFSTOMQFS(ap->a_dvp->v_mount);
1431 	struct mqfs_node *pn = VTON(ap->a_vp);
1432 	struct mqfs_node *pt;
1433 
1434 	if (pn->mn_type != mqfstype_dir)
1435 		return (ENOTDIR);
1436 
1437 	sx_xlock(&mqfs->mi_lock);
1438 	if (pn->mn_deleted) {
1439 		sx_xunlock(&mqfs->mi_lock);
1440 		return (ENOENT);
1441 	}
1442 
1443 	pt = LIST_FIRST(&pn->mn_children);
1444 	pt = LIST_NEXT(pt, mn_sibling);
1445 	pt = LIST_NEXT(pt, mn_sibling);
1446 	if (pt != NULL) {
1447 		sx_xunlock(&mqfs->mi_lock);
1448 		return (ENOTEMPTY);
1449 	}
1450 	pt = pn->mn_parent;
1451 	pn->mn_parent = NULL;
1452 	pn->mn_deleted = 1;
1453 	LIST_REMOVE(pn, mn_sibling);
1454 	mqnode_release(pn);
1455 	mqnode_release(pt);
1456 	sx_xunlock(&mqfs->mi_lock);
1457 	cache_purge(ap->a_vp);
1458 	return (0);
1459 }
1460 
1461 #endif /* notyet */
1462 
1463 /*
1464  * Allocate a message queue
1465  */
1466 static struct mqueue *
1467 mqueue_alloc(const struct mq_attr *attr)
1468 {
1469 	struct mqueue *mq;
1470 
1471 	if (curmq >= maxmq)
1472 		return (NULL);
1473 	mq = uma_zalloc(mqueue_zone, M_WAITOK | M_ZERO);
1474 	TAILQ_INIT(&mq->mq_msgq);
1475 	if (attr != NULL) {
1476 		mq->mq_maxmsg = attr->mq_maxmsg;
1477 		mq->mq_msgsize = attr->mq_msgsize;
1478 	} else {
1479 		mq->mq_maxmsg = default_maxmsg;
1480 		mq->mq_msgsize = default_msgsize;
1481 	}
1482 	mtx_init(&mq->mq_mutex, "mqueue", NULL, MTX_DEF);
1483 	knlist_init(&mq->mq_rsel.si_note, &mq->mq_mutex, NULL, NULL, NULL);
1484 	knlist_init(&mq->mq_wsel.si_note, &mq->mq_mutex, NULL, NULL, NULL);
1485 	atomic_add_int(&curmq, 1);
1486 	return (mq);
1487 }
1488 
1489 /*
1490  * Destroy a message queue
1491  */
1492 static void
1493 mqueue_free(struct mqueue *mq)
1494 {
1495 	struct mqueue_msg *msg;
1496 
1497 	while ((msg = TAILQ_FIRST(&mq->mq_msgq)) != NULL) {
1498 		TAILQ_REMOVE(&mq->mq_msgq, msg, msg_link);
1499 		FREE(msg, M_MQUEUEDATA);
1500 	}
1501 
1502 	mtx_destroy(&mq->mq_mutex);
1503 	knlist_destroy(&mq->mq_rsel.si_note);
1504 	knlist_destroy(&mq->mq_wsel.si_note);
1505 	uma_zfree(mqueue_zone, mq);
1506 	atomic_add_int(&curmq, -1);
1507 }
1508 
1509 /*
1510  * Load a message from user space
1511  */
1512 static struct mqueue_msg *
1513 mqueue_loadmsg(const char *msg_ptr, size_t msg_size, int msg_prio)
1514 {
1515 	struct mqueue_msg *msg;
1516 	size_t len;
1517 	int error;
1518 
1519 	len = sizeof(struct mqueue_msg) + msg_size;
1520 	MALLOC(msg, struct mqueue_msg *, len, M_MQUEUEDATA, M_WAITOK);
1521 	error = copyin(msg_ptr, ((char *)msg) + sizeof(struct mqueue_msg),
1522 	    msg_size);
1523 	if (error) {
1524 		FREE(msg, M_MQUEUEDATA);
1525 		msg = NULL;
1526 	} else {
1527 		msg->msg_size = msg_size;
1528 		msg->msg_prio = msg_prio;
1529 	}
1530 	return (msg);
1531 }
1532 
1533 /*
1534  * Save a message to user space
1535  */
1536 static int
1537 mqueue_savemsg(struct mqueue_msg *msg, char *msg_ptr, int *msg_prio)
1538 {
1539 	int error;
1540 
1541 	error = copyout(((char *)msg) + sizeof(*msg), msg_ptr,
1542 		msg->msg_size);
1543 	if (error == 0 && msg_prio != NULL)
1544 		error = copyout(&msg->msg_prio, msg_prio, sizeof(int));
1545 	return (error);
1546 }
1547 
1548 /*
1549  * Free a message's memory
1550  */
1551 static __inline void
1552 mqueue_freemsg(struct mqueue_msg *msg)
1553 {
1554 	FREE(msg, M_MQUEUEDATA);
1555 }
1556 
1557 /*
1558  * Send a message. if waitok is false, thread will not be
1559  * blocked if there is no data in queue, otherwise, absolute
1560  * time will be checked.
1561  */
1562 int
1563 mqueue_send(struct mqueue *mq, const char *msg_ptr,
1564 	size_t msg_len, unsigned msg_prio, int waitok,
1565 	const struct timespec *abs_timeout)
1566 {
1567 	struct mqueue_msg *msg;
1568 	struct timespec ets, ts, ts2;
1569 	struct timeval tv;
1570 	int error;
1571 
1572 	if (msg_prio >= MQ_PRIO_MAX)
1573 		return (EINVAL);
1574 	if (msg_len > mq->mq_msgsize)
1575 		return (EMSGSIZE);
1576 	msg = mqueue_loadmsg(msg_ptr, msg_len, msg_prio);
1577 	if (msg == NULL)
1578 		return (EFAULT);
1579 
1580 	/* O_NONBLOCK case */
1581 	if (!waitok) {
1582 		error = _mqueue_send(mq, msg, -1);
1583 		if (error)
1584 			goto bad;
1585 		return (0);
1586 	}
1587 
1588 	/* we allow a null timeout (wait forever) */
1589 	if (abs_timeout == NULL) {
1590 		error = _mqueue_send(mq, msg, 0);
1591 		if (error)
1592 			goto bad;
1593 		return (0);
1594 	}
1595 
1596 	/* send it before checking time */
1597 	error = _mqueue_send(mq, msg, -1);
1598 	if (error == 0)
1599 		return (0);
1600 
1601 	if (error != EAGAIN)
1602 		goto bad;
1603 
1604 	error = copyin(abs_timeout, &ets, sizeof(ets));
1605 	if (error != 0)
1606 		goto bad;
1607 	if (ets.tv_nsec >= 1000000000 || ets.tv_nsec < 0) {
1608 		error = EINVAL;
1609 		goto bad;
1610 	}
1611 	for (;;) {
1612 		ts2 = ets;
1613 		getnanotime(&ts);
1614 		timespecsub(&ts2, &ts);
1615 		if (ts2.tv_sec < 0 || (ts2.tv_sec == 0 && ts2.tv_nsec <= 0)) {
1616 			error = ETIMEDOUT;
1617 			break;
1618 		}
1619 		TIMESPEC_TO_TIMEVAL(&tv, &ts2);
1620 		error = _mqueue_send(mq, msg, tvtohz(&tv));
1621 		if (error != ETIMEDOUT)
1622 			break;
1623 	}
1624 	if (error == 0)
1625 		return (0);
1626 bad:
1627 	mqueue_freemsg(msg);
1628 	return (error);
1629 }
1630 
1631 /*
1632  * Common routine to send a message
1633  */
1634 static int
1635 _mqueue_send(struct mqueue *mq, struct mqueue_msg *msg, int timo)
1636 {
1637 	struct mqueue_msg *msg2;
1638 	int error = 0;
1639 
1640 	mtx_lock(&mq->mq_mutex);
1641 	while (mq->mq_curmsgs >= mq->mq_maxmsg && error == 0) {
1642 		if (timo < 0) {
1643 			mtx_unlock(&mq->mq_mutex);
1644 			return (EAGAIN);
1645 		}
1646 		mq->mq_senders++;
1647 		error = msleep(&mq->mq_senders, &mq->mq_mutex,
1648 			    PSOCK | PCATCH, "mqsend", timo);
1649 		mq->mq_senders--;
1650 		if (error == EAGAIN)
1651 			error = ETIMEDOUT;
1652 	}
1653 	if (mq->mq_curmsgs >= mq->mq_maxmsg) {
1654 		mtx_unlock(&mq->mq_mutex);
1655 		return (error);
1656 	}
1657 	error = 0;
1658 	if (TAILQ_EMPTY(&mq->mq_msgq)) {
1659 		TAILQ_INSERT_HEAD(&mq->mq_msgq, msg, msg_link);
1660 	} else {
1661 		if (msg->msg_prio <= TAILQ_LAST(&mq->mq_msgq, msgq)->msg_prio) {
1662 			TAILQ_INSERT_TAIL(&mq->mq_msgq, msg, msg_link);
1663 		} else {
1664 			TAILQ_FOREACH(msg2, &mq->mq_msgq, msg_link) {
1665 				if (msg2->msg_prio < msg->msg_prio)
1666 					break;
1667 			}
1668 			TAILQ_INSERT_BEFORE(msg2, msg, msg_link);
1669 		}
1670 	}
1671 	mq->mq_curmsgs++;
1672 	mq->mq_totalbytes += msg->msg_size;
1673 	if (mq->mq_receivers)
1674 		wakeup_one(&mq->mq_receivers);
1675 	else if (mq->mq_notifier != NULL)
1676 		mqueue_send_notification(mq);
1677 	if (mq->mq_flags & MQ_RSEL) {
1678 		mq->mq_flags &= ~MQ_RSEL;
1679 		selwakeuppri(&mq->mq_rsel, PSOCK);
1680 	}
1681 	KNOTE_LOCKED(&mq->mq_rsel.si_note, 0);
1682 	mtx_unlock(&mq->mq_mutex);
1683 	return (0);
1684 }
1685 
1686 /*
1687  * Send realtime a signal to process which registered itself
1688  * successfully by mq_notify.
1689  */
1690 static void
1691 mqueue_send_notification(struct mqueue *mq)
1692 {
1693 	struct mqueue_notifier *nt;
1694 	struct proc *p;
1695 
1696 	mtx_assert(&mq->mq_mutex, MA_OWNED);
1697 	nt = mq->mq_notifier;
1698 	p = nt->nt_proc;
1699 	PROC_LOCK(p);
1700 	if (!KSI_ONQ(&nt->nt_ksi))
1701 		psignal_event(p, &nt->nt_sigev, &nt->nt_ksi);
1702 	PROC_UNLOCK(p);
1703 	mq->mq_notifier = NULL;
1704 }
1705 
1706 /*
1707  * Get a message. if waitok is false, thread will not be
1708  * blocked if there is no data in queue, otherwise, absolute
1709  * time will be checked.
1710  */
1711 int
1712 mqueue_receive(struct mqueue *mq, char *msg_ptr,
1713 	size_t msg_len, unsigned *msg_prio, int waitok,
1714 	const struct timespec *abs_timeout)
1715 {
1716 	struct mqueue_msg *msg;
1717 	struct timespec ets, ts, ts2;
1718 	struct timeval tv;
1719 	int error;
1720 
1721 	if (msg_len < mq->mq_msgsize)
1722 		return (EMSGSIZE);
1723 
1724 	/* O_NONBLOCK case */
1725 	if (!waitok) {
1726 		error = _mqueue_recv(mq, &msg, -1);
1727 		if (error)
1728 			return (error);
1729 		goto received;
1730 	}
1731 
1732 	/* we allow a null timeout (wait forever). */
1733 	if (abs_timeout == NULL) {
1734 		error = _mqueue_recv(mq, &msg, 0);
1735 		if (error)
1736 			return (error);
1737 		goto received;
1738 	}
1739 
1740 	/* try to get a message before checking time */
1741 	error = _mqueue_recv(mq, &msg, -1);
1742 	if (error == 0)
1743 		goto received;
1744 
1745 	if (error != EAGAIN)
1746 		return (error);
1747 
1748 	error = copyin(abs_timeout, &ets, sizeof(ets));
1749 	if (error != 0)
1750 		return (error);
1751 	if (ets.tv_nsec >= 1000000000 || ets.tv_nsec < 0) {
1752 		error = EINVAL;
1753 		return (error);
1754 	}
1755 
1756 	for (;;) {
1757 		ts2 = ets;
1758 		getnanotime(&ts);
1759 		timespecsub(&ts2, &ts);
1760 		if (ts2.tv_sec < 0 || (ts2.tv_sec == 0 && ts2.tv_nsec <= 0)) {
1761 			error = ETIMEDOUT;
1762 			return (error);
1763 		}
1764 		TIMESPEC_TO_TIMEVAL(&tv, &ts2);
1765 		error = _mqueue_recv(mq, &msg, tvtohz(&tv));
1766 		if (error == 0)
1767 			break;
1768 		if (error != ETIMEDOUT)
1769 			return (error);
1770 	}
1771 
1772 received:
1773 	error = mqueue_savemsg(msg, msg_ptr, msg_prio);
1774 	if (error == 0) {
1775 		curthread->td_retval[0] = msg->msg_size;
1776 		curthread->td_retval[1] = 0;
1777 	}
1778 	mqueue_freemsg(msg);
1779 	return (error);
1780 }
1781 
1782 /*
1783  * Common routine to receive a message
1784  */
1785 static int
1786 _mqueue_recv(struct mqueue *mq, struct mqueue_msg **msg, int timo)
1787 {
1788 	int error = 0;
1789 
1790 	mtx_lock(&mq->mq_mutex);
1791 	while ((*msg = TAILQ_FIRST(&mq->mq_msgq)) == NULL && error == 0) {
1792 		if (timo < 0) {
1793 			mtx_unlock(&mq->mq_mutex);
1794 			return (EAGAIN);
1795 		}
1796 		mq->mq_receivers++;
1797 		error = msleep(&mq->mq_receivers, &mq->mq_mutex,
1798 			    PSOCK | PCATCH, "mqrecv", timo);
1799 		mq->mq_receivers--;
1800 		if (error == EAGAIN)
1801 			error = ETIMEDOUT;
1802 	}
1803 	if (*msg != NULL) {
1804 		error = 0;
1805 		TAILQ_REMOVE(&mq->mq_msgq, *msg, msg_link);
1806 		mq->mq_curmsgs--;
1807 		mq->mq_totalbytes -= (*msg)->msg_size;
1808 		if (mq->mq_senders)
1809 			wakeup_one(&mq->mq_senders);
1810 		if (mq->mq_flags & MQ_WSEL) {
1811 			mq->mq_flags &= ~MQ_WSEL;
1812 			selwakeuppri(&mq->mq_wsel, PSOCK);
1813 		}
1814 		KNOTE_LOCKED(&mq->mq_wsel.si_note, 0);
1815 	}
1816 	if (mq->mq_notifier != NULL && mq->mq_receivers == 0 &&
1817 	    !TAILQ_EMPTY(&mq->mq_msgq)) {
1818 		mqueue_send_notification(mq);
1819 	}
1820 	mtx_unlock(&mq->mq_mutex);
1821 	return (error);
1822 }
1823 
1824 static __inline struct mqueue_notifier *
1825 notifier_alloc(void)
1826 {
1827 	return (uma_zalloc(mqnoti_zone, M_WAITOK | M_ZERO));
1828 }
1829 
1830 static __inline void
1831 notifier_free(struct mqueue_notifier *p)
1832 {
1833 	uma_zfree(mqnoti_zone, p);
1834 }
1835 
1836 static struct mqueue_notifier *
1837 notifier_search(struct proc *p, int fd)
1838 {
1839 	struct mqueue_notifier *nt;
1840 
1841 	LIST_FOREACH(nt, &p->p_mqnotifier, nt_link) {
1842 		if (nt->nt_fd == fd)
1843 			break;
1844 	}
1845 	return (nt);
1846 }
1847 
1848 static void
1849 notifier_insert(struct proc *p, struct mqueue_notifier *nt)
1850 {
1851 	LIST_INSERT_HEAD(&p->p_mqnotifier, nt, nt_link);
1852 }
1853 
1854 static void
1855 notifier_delete(struct proc *p, struct mqueue_notifier *nt)
1856 {
1857 	LIST_REMOVE(nt, nt_link);
1858 	notifier_free(nt);
1859 }
1860 
1861 static void
1862 notifier_remove(struct proc *p, struct mqueue *mq, int fd)
1863 {
1864 	struct mqueue_notifier *nt;
1865 
1866 	mtx_assert(&mq->mq_mutex, MA_OWNED);
1867 	PROC_LOCK(p);
1868 	nt = notifier_search(p, fd);
1869 	if (nt != NULL) {
1870 		if (mq->mq_notifier == nt)
1871 			mq->mq_notifier = NULL;
1872 		sigqueue_take(&nt->nt_ksi);
1873 		notifier_delete(p, nt);
1874 	}
1875 	PROC_UNLOCK(p);
1876 }
1877 
1878 /*
1879  * Syscall to open a message queue
1880  */
1881 int
1882 mq_open(struct thread *td, struct mq_open_args *uap)
1883 {
1884 	char path[MQFS_NAMELEN + 1];
1885 	struct mq_attr attr, *pattr;
1886 	struct mqfs_node *pn;
1887 	struct filedesc *fdp;
1888 	struct file *fp;
1889 	struct mqueue *mq;
1890 	int fd, error, len, flags, cmode;
1891 
1892 	if ((uap->flags & O_ACCMODE) == O_ACCMODE)
1893 		return (EINVAL);
1894 
1895 	fdp = td->td_proc->p_fd;
1896 	flags = FFLAGS(uap->flags);
1897 	cmode = (((uap->mode & ~fdp->fd_cmask) & ALLPERMS) & ~S_ISTXT);
1898 	mq = NULL;
1899 	if ((flags & O_CREAT) && (uap->attr != NULL)) {
1900 		error = copyin(uap->attr, &attr, sizeof(attr));
1901 		if (error)
1902 			return (error);
1903 		if (attr.mq_maxmsg <= 0 || attr.mq_maxmsg > maxmsg)
1904 			return (EINVAL);
1905 		if (attr.mq_msgsize <= 0 || attr.mq_msgsize > maxmsgsize)
1906 			return (EINVAL);
1907 		pattr = &attr;
1908 	} else
1909 		pattr = NULL;
1910 
1911 	error = copyinstr(uap->path, path, MQFS_NAMELEN + 1, NULL);
1912         if (error)
1913 		return (error);
1914 
1915 	/*
1916 	 * The first character of name must be a slash  (/) character
1917 	 * and the remaining characters of name cannot include any slash
1918 	 * characters.
1919 	 */
1920 	len = strlen(path);
1921 	if (len < 2  || path[0] != '/' || index(path + 1, '/') != NULL)
1922 		return (EINVAL);
1923 
1924 	error = falloc(td, &fp, &fd);
1925 	if (error)
1926 		return (error);
1927 
1928 	sx_xlock(&mqfs_data.mi_lock);
1929 	pn = mqfs_search(mqfs_data.mi_root, path + 1, len - 1);
1930 	if (pn == NULL) {
1931 		if (!(flags & O_CREAT)) {
1932 			error = ENOENT;
1933 		} else {
1934 			mq = mqueue_alloc(pattr);
1935 			if (mq == NULL) {
1936 				error = ENFILE;
1937 			} else {
1938 				pn = mqfs_create_file(mqfs_data.mi_root,
1939 				         path + 1, len - 1);
1940 				if (pn == NULL) {
1941 					error = ENOSPC;
1942 					mqueue_free(mq);
1943 				}
1944 			}
1945 		}
1946 
1947 		if (error == 0) {
1948 			pn->mn_data = mq;
1949 			getnanotime(&pn->mn_birth);
1950 			pn->mn_ctime = pn->mn_atime = pn->mn_mtime
1951 			  = pn->mn_birth;
1952 			pn->mn_uid = td->td_ucred->cr_uid;
1953 			pn->mn_gid = td->td_ucred->cr_gid;
1954 			pn->mn_mode = cmode;
1955 		}
1956 	} else {
1957 		if ((flags & (O_CREAT | O_EXCL)) == (O_CREAT | O_EXCL)) {
1958 			error = EEXIST;
1959 		} else {
1960 			int acc_mode = 0;
1961 
1962 			if (flags & FREAD)
1963 				acc_mode |= VREAD;
1964 			if (flags & FWRITE)
1965 				acc_mode |= VWRITE;
1966 			error = vaccess(VREG, pn->mn_mode, pn->mn_uid,
1967 				    pn->mn_gid, acc_mode, td->td_ucred, NULL);
1968 		}
1969 	}
1970 
1971 	if (error) {
1972 		sx_xunlock(&mqfs_data.mi_lock);
1973 		fdclose(fdp, fp, fd, td);
1974 		fdrop(fp, td);
1975 		return (error);
1976 	}
1977 
1978 	mqnode_addref(pn);
1979 	sx_xunlock(&mqfs_data.mi_lock);
1980 
1981 	FILE_LOCK(fp);
1982 	fp->f_flag = (flags & (FREAD | FWRITE | O_NONBLOCK));
1983 	fp->f_type = DTYPE_MQUEUE;
1984 	fp->f_ops = &mqueueops;
1985 	fp->f_data = pn;
1986 	FILE_UNLOCK(fp);
1987 
1988 	FILEDESC_LOCK_FAST(fdp);
1989 	if (fdp->fd_ofiles[fd] == fp)
1990 		fdp->fd_ofileflags[fd] |= UF_EXCLOSE;
1991 	FILEDESC_UNLOCK_FAST(fdp);
1992 	td->td_retval[0] = fd;
1993 	fdrop(fp, td);
1994 	return (0);
1995 }
1996 
1997 /*
1998  * Syscall to unlink a message queue
1999  */
2000 int
2001 mq_unlink(struct thread *td, struct mq_unlink_args *uap)
2002 {
2003 	char path[MQFS_NAMELEN+1];
2004 	struct mqfs_node *pn;
2005 	int error, len;
2006 
2007 	error = copyinstr(uap->path, path, MQFS_NAMELEN + 1, NULL);
2008         if (error)
2009 		return (error);
2010 
2011 	len = strlen(path);
2012 	if (len < 2  || path[0] != '/' || index(path + 1, '/') != NULL)
2013 		return (EINVAL);
2014 
2015 	sx_xlock(&mqfs_data.mi_lock);
2016 	pn = mqfs_search(mqfs_data.mi_root, path + 1, len - 1);
2017 	if (pn != NULL)
2018 		error = do_unlink(pn, td->td_ucred);
2019 	else
2020 		error = ENOENT;
2021 	sx_xunlock(&mqfs_data.mi_lock);
2022 	return (error);
2023 }
2024 
2025 typedef int (*_fgetf)(struct thread *, int, struct file **);
2026 
2027 /*
2028  * Get message queue by giving file slot
2029  */
2030 static int
2031 _getmq(struct thread *td, int fd, _fgetf func,
2032        struct file **fpp, struct mqfs_node **ppn, struct mqueue **pmq)
2033 {
2034 	struct mqfs_node *pn;
2035 	int error;
2036 
2037 	error = func(td, fd, fpp);
2038 	if (error)
2039 		return (error);
2040 	if (&mqueueops != (*fpp)->f_ops) {
2041 		fdrop(*fpp, td);
2042 		return (EBADF);
2043 	}
2044 	pn = (*fpp)->f_data;
2045 	if (ppn)
2046 		*ppn = pn;
2047 	if (pmq)
2048 		*pmq = pn->mn_data;
2049 	return (0);
2050 }
2051 
2052 static __inline int
2053 getmq(struct thread *td, int fd, struct file **fpp, struct mqfs_node **ppn,
2054 	struct mqueue **pmq)
2055 {
2056 	return _getmq(td, fd, fget, fpp, ppn, pmq);
2057 }
2058 
2059 static __inline int
2060 getmq_read(struct thread *td, int fd, struct file **fpp,
2061 	 struct mqfs_node **ppn, struct mqueue **pmq)
2062 {
2063 	return _getmq(td, fd, fget_read, fpp, ppn, pmq);
2064 }
2065 
2066 static __inline int
2067 getmq_write(struct thread *td, int fd, struct file **fpp,
2068 	struct mqfs_node **ppn, struct mqueue **pmq)
2069 {
2070 	return _getmq(td, fd, fget_write, fpp, ppn, pmq);
2071 }
2072 
2073 /*
2074  * Syscall
2075  */
2076 int
2077 mq_setattr(struct thread *td, struct mq_setattr_args *uap)
2078 {
2079 	struct mqueue *mq;
2080 	struct file *fp;
2081 	struct mq_attr attr, oattr;
2082 	int error;
2083 
2084 	if (uap->attr) {
2085 		error = copyin(uap->attr, &attr, sizeof(attr));
2086 		if (error)
2087 			return (error);
2088 		if (attr.mq_flags & ~O_NONBLOCK)
2089 			return (EINVAL);
2090 	}
2091 	error = getmq(td, uap->mqd, &fp, NULL, &mq);
2092 	if (error)
2093 		return (error);
2094 	oattr.mq_maxmsg  = mq->mq_maxmsg;
2095 	oattr.mq_msgsize = mq->mq_msgsize;
2096 	oattr.mq_curmsgs = mq->mq_curmsgs;
2097 	FILE_LOCK(fp);
2098 	oattr.mq_flags = (O_NONBLOCK & fp->f_flag);
2099 	if (uap->attr) {
2100 		fp->f_flag &= ~O_NONBLOCK;
2101 		fp->f_flag |= (attr.mq_flags & O_NONBLOCK);
2102 	}
2103 	FILE_UNLOCK(fp);
2104 	fdrop(fp, td);
2105 	if (uap->oattr)
2106 		error = copyout(&oattr, uap->oattr, sizeof(oattr));
2107 	return (error);
2108 }
2109 
2110 /*
2111  * Syscall
2112  */
2113 int
2114 mq_timedreceive(struct thread *td, struct mq_timedreceive_args *uap)
2115 {
2116 	struct mqueue *mq;
2117 	struct file *fp;
2118 	int error;
2119 	int waitok;
2120 
2121 	error = getmq_read(td, uap->mqd, &fp, NULL, &mq);
2122 	if (error)
2123 		return (error);
2124 	waitok = !(fp->f_flag & O_NONBLOCK);
2125 	error = mqueue_receive(mq, uap->msg_ptr, uap->msg_len,
2126 		uap->msg_prio, waitok, uap->abs_timeout);
2127 	fdrop(fp, td);
2128 	return (error);
2129 }
2130 
2131 /*
2132  * Syscall
2133  */
2134 int
2135 mq_timedsend(struct thread *td, struct mq_timedsend_args *uap)
2136 {
2137 	struct mqueue *mq;
2138 	struct file *fp;
2139 	int error, waitok;
2140 
2141 	error = getmq_write(td, uap->mqd, &fp, NULL, &mq);
2142 	if (error)
2143 		return (error);
2144 	waitok = !(fp->f_flag & O_NONBLOCK);
2145 	error = mqueue_send(mq, uap->msg_ptr, uap->msg_len,
2146 		uap->msg_prio, waitok, uap->abs_timeout);
2147 	fdrop(fp, td);
2148 	return (error);
2149 }
2150 
2151 /*
2152  * Syscall
2153  */
2154 int
2155 mq_notify(struct thread *td, struct mq_notify_args *uap)
2156 {
2157 	struct sigevent ev;
2158 	struct filedesc *fdp;
2159 	struct proc *p;
2160 	struct mqueue *mq;
2161 	struct file *fp;
2162 	struct mqueue_notifier *nt, *newnt = NULL;
2163 	int error;
2164 
2165 	p = td->td_proc;
2166 	fdp = td->td_proc->p_fd;
2167 	if (uap->sigev) {
2168 		error = copyin(uap->sigev, &ev, sizeof(ev));
2169 		if (error)
2170 			return (error);
2171 		if (ev.sigev_notify != SIGEV_SIGNAL &&
2172 		    ev.sigev_notify != SIGEV_THREAD_ID)
2173 			return (EINVAL);
2174 		if ((ev.sigev_notify == SIGEV_SIGNAL ||
2175 		     ev.sigev_notify == SIGEV_THREAD_ID) &&
2176 			!_SIG_VALID(ev.sigev_signo))
2177 			return (EINVAL);
2178 	}
2179 	error = getmq(td, uap->mqd, &fp, NULL, &mq);
2180 	if (error)
2181 		return (error);
2182 again:
2183 	FILEDESC_LOCK_FAST(fdp);
2184 	if (fget_locked(fdp, uap->mqd) != fp) {
2185 		FILEDESC_UNLOCK_FAST(fdp);
2186 		error = EBADF;
2187 		goto out;
2188 	}
2189 	mtx_lock(&mq->mq_mutex);
2190 	FILEDESC_UNLOCK_FAST(fdp);
2191 	if (uap->sigev != NULL) {
2192 		if (mq->mq_notifier != NULL) {
2193 			error = EBUSY;
2194 		} else {
2195 			PROC_LOCK(p);
2196 			nt = notifier_search(p, uap->mqd);
2197 			if (nt == NULL) {
2198 				if (newnt == NULL) {
2199 					PROC_UNLOCK(p);
2200 					mtx_unlock(&mq->mq_mutex);
2201 					newnt = notifier_alloc();
2202 					goto again;
2203 				}
2204 			}
2205 
2206 			if (nt != NULL) {
2207 				sigqueue_take(&nt->nt_ksi);
2208 				if (newnt != NULL) {
2209 					notifier_free(newnt);
2210 					newnt = NULL;
2211 				}
2212 			} else {
2213 				nt = newnt;
2214 				newnt = NULL;
2215 				ksiginfo_init(&nt->nt_ksi);
2216 				nt->nt_ksi.ksi_flags |= KSI_INS | KSI_EXT;
2217 				nt->nt_ksi.ksi_code = SI_MESGQ;
2218 				nt->nt_proc = p;
2219 				nt->nt_fd = uap->mqd;
2220 				notifier_insert(p, nt);
2221 			}
2222 			nt->nt_sigev = ev;
2223 			mq->mq_notifier = nt;
2224 			PROC_UNLOCK(p);
2225 			/*
2226 			 * if there is no receivers and message queue
2227 			 * is not empty, we should send notification
2228 			 * as soon as possible.
2229 			 */
2230 			if (mq->mq_receivers == 0 &&
2231 			    !TAILQ_EMPTY(&mq->mq_msgq))
2232 				mqueue_send_notification(mq);
2233 		}
2234 	} else {
2235 		notifier_remove(p, mq, uap->mqd);
2236 	}
2237 	mtx_unlock(&mq->mq_mutex);
2238 
2239 out:
2240 	fdrop(fp, td);
2241 	if (newnt != NULL)
2242 		notifier_free(newnt);
2243 	return (error);
2244 }
2245 
2246 static void
2247 mqueue_fdclose(struct thread *td, int fd, struct file *fp)
2248 {
2249 	struct filedesc *fdp;
2250 	struct mqueue *mq;
2251 
2252 	fdp = td->td_proc->p_fd;
2253 	FILEDESC_LOCK_ASSERT(fdp, MA_OWNED);
2254 	if (fp->f_ops == &mqueueops) {
2255 		mq = FPTOMQ(fp);
2256 		mtx_lock(&mq->mq_mutex);
2257 		notifier_remove(td->td_proc, mq, fd);
2258 
2259 		/* have to wakeup thread in same process */
2260 		if (mq->mq_flags & MQ_RSEL) {
2261 			mq->mq_flags &= ~MQ_RSEL;
2262 			selwakeuppri(&mq->mq_rsel, PSOCK);
2263 		}
2264 		if (mq->mq_flags & MQ_WSEL) {
2265 			mq->mq_flags &= ~MQ_WSEL;
2266 			selwakeuppri(&mq->mq_wsel, PSOCK);
2267 		}
2268 		mtx_unlock(&mq->mq_mutex);
2269 	}
2270 }
2271 
2272 static void
2273 mq_proc_exit(void *arg __unused, struct proc *p)
2274 {
2275 	struct filedesc *fdp;
2276 	struct file *fp;
2277 	struct mqueue *mq;
2278 	int i;
2279 
2280 	fdp = p->p_fd;
2281 	FILEDESC_LOCK_FAST(fdp);
2282 	for (i = 0; i < fdp->fd_nfiles; ++i) {
2283 		fp = fget_locked(fdp, i);
2284 		if (fp != NULL && fp->f_ops == &mqueueops) {
2285 			mq = FPTOMQ(fp);
2286 			mtx_lock(&mq->mq_mutex);
2287 			notifier_remove(p, FPTOMQ(fp), i);
2288 			mtx_unlock(&mq->mq_mutex);
2289 		}
2290 	}
2291 	FILEDESC_UNLOCK_FAST(fdp);
2292 	KASSERT(LIST_EMPTY(&p->p_mqnotifier), ("mq notifiers left"));
2293 }
2294 
2295 static int
2296 mqf_read(struct file *fp, struct uio *uio, struct ucred *active_cred,
2297 	int flags, struct thread *td)
2298 {
2299 	return (EOPNOTSUPP);
2300 }
2301 
2302 static int
2303 mqf_write(struct file *fp, struct uio *uio, struct ucred *active_cred,
2304 	int flags, struct thread *td)
2305 {
2306 	return (EOPNOTSUPP);
2307 }
2308 
2309 static int
2310 mqf_ioctl(struct file *fp, u_long cmd, void *data,
2311 	struct ucred *active_cred, struct thread *td)
2312 {
2313 	return (ENOTTY);
2314 }
2315 
2316 static int
2317 mqf_poll(struct file *fp, int events, struct ucred *active_cred,
2318 	struct thread *td)
2319 {
2320 	struct mqueue *mq = FPTOMQ(fp);
2321 	int revents = 0;
2322 
2323 	mtx_lock(&mq->mq_mutex);
2324 	if (events & (POLLIN | POLLRDNORM)) {
2325 		if (mq->mq_curmsgs) {
2326 			revents |= events & (POLLIN | POLLRDNORM);
2327 		} else {
2328 			mq->mq_flags |= MQ_RSEL;
2329 			selrecord(td, &mq->mq_rsel);
2330  		}
2331 	}
2332 	if (events & POLLOUT) {
2333 		if (mq->mq_curmsgs < mq->mq_maxmsg)
2334 			revents |= POLLOUT;
2335 		else {
2336 			mq->mq_flags |= MQ_WSEL;
2337 			selrecord(td, &mq->mq_wsel);
2338 		}
2339 	}
2340 	mtx_unlock(&mq->mq_mutex);
2341 	return (revents);
2342 }
2343 
2344 static int
2345 mqf_close(struct file *fp, struct thread *td)
2346 {
2347 	struct mqfs_node *pn;
2348 
2349 	FILE_LOCK(fp);
2350 	fp->f_ops = &badfileops;
2351 	FILE_UNLOCK(fp);
2352 	pn = fp->f_data;
2353 	fp->f_data = NULL;
2354 	sx_xlock(&mqfs_data.mi_lock);
2355 	mqnode_release(pn);
2356 	sx_xunlock(&mqfs_data.mi_lock);
2357 	return (0);
2358 }
2359 
2360 static int
2361 mqf_stat(struct file *fp, struct stat *st, struct ucred *active_cred,
2362 	struct thread *td)
2363 {
2364 	struct mqfs_node *pn = fp->f_data;
2365 
2366 	bzero(st, sizeof *st);
2367 	st->st_atimespec = pn->mn_atime;
2368 	st->st_mtimespec = pn->mn_mtime;
2369 	st->st_ctimespec = pn->mn_ctime;
2370 	st->st_birthtimespec = pn->mn_birth;
2371 	st->st_uid = pn->mn_uid;
2372 	st->st_gid = pn->mn_gid;
2373 	st->st_mode = S_IFIFO | pn->mn_mode;
2374 	return (0);
2375 }
2376 
2377 static int
2378 mqf_kqfilter(struct file *fp, struct knote *kn)
2379 {
2380 	struct mqueue *mq = FPTOMQ(fp);
2381 	int error = 0;
2382 
2383 	if (kn->kn_filter == EVFILT_READ) {
2384 		kn->kn_fop = &mq_rfiltops;
2385 		knlist_add(&mq->mq_rsel.si_note, kn, 0);
2386 	} else if (kn->kn_filter == EVFILT_WRITE) {
2387 		kn->kn_fop = &mq_wfiltops;
2388 		knlist_add(&mq->mq_wsel.si_note, kn, 0);
2389 	} else
2390 		error = EINVAL;
2391 	return (error);
2392 }
2393 
2394 static void
2395 filt_mqdetach(struct knote *kn)
2396 {
2397 	struct mqueue *mq = FPTOMQ(kn->kn_fp);
2398 
2399 	if (kn->kn_filter == EVFILT_READ)
2400 		knlist_remove(&mq->mq_rsel.si_note, kn, 0);
2401 	else if (kn->kn_filter == EVFILT_WRITE)
2402 		knlist_remove(&mq->mq_wsel.si_note, kn, 0);
2403 	else
2404 		panic("filt_mqdetach");
2405 }
2406 
2407 static int
2408 filt_mqread(struct knote *kn, long hint)
2409 {
2410 	struct mqueue *mq = FPTOMQ(kn->kn_fp);
2411 
2412 	mtx_assert(&mq->mq_mutex, MA_OWNED);
2413 	return (mq->mq_curmsgs != 0);
2414 }
2415 
2416 static int
2417 filt_mqwrite(struct knote *kn, long hint)
2418 {
2419 	struct mqueue *mq = FPTOMQ(kn->kn_fp);
2420 
2421 	mtx_assert(&mq->mq_mutex, MA_OWNED);
2422 	return (mq->mq_curmsgs < mq->mq_maxmsg);
2423 }
2424 
2425 static struct fileops mqueueops = {
2426 	.fo_read		= mqf_read,
2427 	.fo_write		= mqf_write,
2428 	.fo_ioctl		= mqf_ioctl,
2429 	.fo_poll		= mqf_poll,
2430 	.fo_kqfilter		= mqf_kqfilter,
2431 	.fo_stat		= mqf_stat,
2432 	.fo_close		= mqf_close
2433 };
2434 
2435 static struct vop_vector mqfs_vnodeops = {
2436 	.vop_default 		= &default_vnodeops,
2437 	.vop_access		= mqfs_access,
2438 	.vop_cachedlookup	= mqfs_lookup,
2439 	.vop_lookup		= vfs_cache_lookup,
2440 	.vop_reclaim		= mqfs_reclaim,
2441 	.vop_create		= mqfs_create,
2442 	.vop_remove		= mqfs_remove,
2443 	.vop_inactive		= mqfs_inactive,
2444 	.vop_open		= mqfs_open,
2445 	.vop_close		= mqfs_close,
2446 	.vop_getattr		= mqfs_getattr,
2447 	.vop_setattr		= mqfs_setattr,
2448 	.vop_read		= mqfs_read,
2449 	.vop_write		= VOP_EOPNOTSUPP,
2450 	.vop_readdir		= mqfs_readdir,
2451 	.vop_mkdir		= VOP_EOPNOTSUPP,
2452 	.vop_rmdir		= VOP_EOPNOTSUPP
2453 };
2454 
2455 static struct vfsops mqfs_vfsops = {
2456 	.vfs_init 		= mqfs_init,
2457 	.vfs_uninit		= mqfs_uninit,
2458 	.vfs_mount		= mqfs_mount,
2459 	.vfs_unmount		= mqfs_unmount,
2460 	.vfs_root		= mqfs_root,
2461 	.vfs_statfs		= mqfs_statfs,
2462 };
2463 
2464 SYSCALL_MODULE_HELPER(mq_open);
2465 SYSCALL_MODULE_HELPER(mq_setattr);
2466 SYSCALL_MODULE_HELPER(mq_timedsend);
2467 SYSCALL_MODULE_HELPER(mq_timedreceive);
2468 SYSCALL_MODULE_HELPER(mq_notify);
2469 SYSCALL_MODULE_HELPER(mq_unlink);
2470 
2471 VFS_SET(mqfs_vfsops, mqueuefs, VFCF_SYNTHETIC);
2472 MODULE_VERSION(mqueuefs, 1);
2473