FreeBSD/Linux Kernel Cross Reference
sys/kern/uipc_mqueue.c

     /*-
      * SPDX-License-Identifier: BSD-2-Clause-FreeBSD
      *
      * Copyright (c) 2005 David Xu <davidxu@freebsd.org>
      * Copyright (c) 2016-2017 Robert N. M. Watson
      * All rights reserved.
      *
      * Portions of this software were developed by BAE Systems, the University of
      * Cambridge Computer Laboratory, and Memorial University under DARPA/AFRL
     * contract FA8650-15-C-7558 ("CADETS"), as part of the DARPA Transparent
     * Computing (TC) research program.
     *
     * Redistribution and use in source and binary forms, with or without
     * modification, are permitted provided that the following conditions
     * are met:
     * 1. Redistributions of source code must retain the above copyright
     *    notice, this list of conditions and the following disclaimer.
     * 2. Redistributions in binary form must reproduce the above copyright
     *    notice, this list of conditions and the following disclaimer in the
     *    documentation and/or other materials provided with the distribution.
     *
     * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
     * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
     * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
     * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
     * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
     * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
     * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
     * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
     * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
     * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
     * SUCH DAMAGE.
     *
     */
    
    /*
     * POSIX message queue implementation.
     *
     * 1) A mqueue filesystem can be mounted, each message queue appears
     *    in mounted directory, user can change queue's permission and
     *    ownership, or remove a queue. Manually creating a file in the
     *    directory causes a message queue to be created in the kernel with
     *    default message queue attributes applied and same name used, this
     *    method is not advocated since mq_open syscall allows user to specify
     *    different attributes. Also the file system can be mounted multiple
     *    times at different mount points but shows same contents.
     *
     * 2) Standard POSIX message queue API. The syscalls do not use vfs layer,
     *    but directly operate on internal data structure, this allows user to
     *    use the IPC facility without having to mount mqueue file system.
     */
    
    #include <sys/cdefs.h>
    __FBSDID("$FreeBSD$");
    
    #include "opt_capsicum.h"
    
    #include <sys/param.h>
    #include <sys/kernel.h>
    #include <sys/systm.h>
    #include <sys/limits.h>
    #include <sys/malloc.h>
    #include <sys/buf.h>
    #include <sys/capsicum.h>
    #include <sys/dirent.h>
    #include <sys/event.h>
    #include <sys/eventhandler.h>
    #include <sys/fcntl.h>
    #include <sys/file.h>
    #include <sys/filedesc.h>
    #include <sys/jail.h>
    #include <sys/lock.h>
    #include <sys/module.h>
    #include <sys/mount.h>
    #include <sys/mqueue.h>
    #include <sys/mutex.h>
    #include <sys/namei.h>
    #include <sys/posix4.h>
    #include <sys/poll.h>
    #include <sys/priv.h>
    #include <sys/proc.h>
    #include <sys/queue.h>
    #include <sys/sysproto.h>
    #include <sys/stat.h>
    #include <sys/syscall.h>
    #include <sys/syscallsubr.h>
    #include <sys/sysent.h>
    #include <sys/sx.h>
    #include <sys/sysctl.h>
    #include <sys/taskqueue.h>
    #include <sys/unistd.h>
    #include <sys/user.h>
    #include <sys/vnode.h>
    #include <machine/atomic.h>
    
    #include <security/audit/audit.h>
    
    FEATURE(p1003_1b_mqueue, "POSIX P1003.1B message queues support");
    
   /*
    * Limits and constants
    */
   #define MQFS_NAMELEN            NAME_MAX
   #define MQFS_DELEN              (8 + MQFS_NAMELEN)
   
   /* node types */
   typedef enum {
           mqfstype_none = 0,
           mqfstype_root,
           mqfstype_dir,
           mqfstype_this,
           mqfstype_parent,
           mqfstype_file,
           mqfstype_symlink,
   } mqfs_type_t;
   
   struct mqfs_node;
   
   /*
    * mqfs_info: describes a mqfs instance
    */
   struct mqfs_info {
           struct sx               mi_lock;
           struct mqfs_node        *mi_root;
           struct unrhdr           *mi_unrhdr;
   };
   
   struct mqfs_vdata {
           LIST_ENTRY(mqfs_vdata)  mv_link;
           struct mqfs_node        *mv_node;
           struct vnode            *mv_vnode;
           struct task             mv_task;
   };
   
   /*
    * mqfs_node: describes a node (file or directory) within a mqfs
    */
   struct mqfs_node {
           char                    mn_name[MQFS_NAMELEN+1];
           struct mqfs_info        *mn_info;
           struct mqfs_node        *mn_parent;
           LIST_HEAD(,mqfs_node)   mn_children;
           LIST_ENTRY(mqfs_node)   mn_sibling;
           LIST_HEAD(,mqfs_vdata)  mn_vnodes;
           const void              *mn_pr_root;
           int                     mn_refcount;
           mqfs_type_t             mn_type;
           int                     mn_deleted;
           uint32_t                mn_fileno;
           void                    *mn_data;
           struct timespec         mn_birth;
           struct timespec         mn_ctime;
           struct timespec         mn_atime;
           struct timespec         mn_mtime;
           uid_t                   mn_uid;
           gid_t                   mn_gid;
           int                     mn_mode;
   };
   
   #define VTON(vp)        (((struct mqfs_vdata *)((vp)->v_data))->mv_node)
   #define VTOMQ(vp)       ((struct mqueue *)(VTON(vp)->mn_data))
   #define VFSTOMQFS(m)    ((struct mqfs_info *)((m)->mnt_data))
   #define FPTOMQ(fp)      ((struct mqueue *)(((struct mqfs_node *) \
                                   (fp)->f_data)->mn_data))
   
   TAILQ_HEAD(msgq, mqueue_msg);
   
   struct mqueue;
   
   struct mqueue_notifier {
           LIST_ENTRY(mqueue_notifier)     nt_link;
           struct sigevent                 nt_sigev;
           ksiginfo_t                      nt_ksi;
           struct proc                     *nt_proc;
   };
   
   struct mqueue {
           struct mtx      mq_mutex;
           int             mq_flags;
           long            mq_maxmsg;
           long            mq_msgsize;
           long            mq_curmsgs;
           long            mq_totalbytes;
           struct msgq     mq_msgq;
           int             mq_receivers;
           int             mq_senders;
           struct selinfo  mq_rsel;
           struct selinfo  mq_wsel;
           struct mqueue_notifier  *mq_notifier;
   };
   
   #define MQ_RSEL         0x01
   #define MQ_WSEL         0x02
   
   struct mqueue_msg {
           TAILQ_ENTRY(mqueue_msg) msg_link;
           unsigned int    msg_prio;
           unsigned int    msg_size;
           /* following real data... */
   };
   
   static SYSCTL_NODE(_kern, OID_AUTO, mqueue, CTLFLAG_RW | CTLFLAG_MPSAFE, 0,
           "POSIX real time message queue");
   
   static int      default_maxmsg  = 10;
   static int      default_msgsize = 1024;
   
   static int      maxmsg = 100;
   SYSCTL_INT(_kern_mqueue, OID_AUTO, maxmsg, CTLFLAG_RW,
       &maxmsg, 0, "Default maximum messages in queue");
   static int      maxmsgsize = 16384;
   SYSCTL_INT(_kern_mqueue, OID_AUTO, maxmsgsize, CTLFLAG_RW,
       &maxmsgsize, 0, "Default maximum message size");
   static int      maxmq = 100;
   SYSCTL_INT(_kern_mqueue, OID_AUTO, maxmq, CTLFLAG_RW,
       &maxmq, 0, "maximum message queues");
   static int      curmq = 0;
   SYSCTL_INT(_kern_mqueue, OID_AUTO, curmq, CTLFLAG_RW,
       &curmq, 0, "current message queue number");
   static int      unloadable = 0;
   static MALLOC_DEFINE(M_MQUEUEDATA, "mqdata", "mqueue data");
   
   static eventhandler_tag exit_tag;
   
   /* Only one instance per-system */
   static struct mqfs_info         mqfs_data;
   static uma_zone_t               mqnode_zone;
   static uma_zone_t               mqueue_zone;
   static uma_zone_t               mvdata_zone;
   static uma_zone_t               mqnoti_zone;
   static struct vop_vector        mqfs_vnodeops;
   static struct fileops           mqueueops;
   static unsigned                 mqfs_osd_jail_slot;
   
   /*
    * Directory structure construction and manipulation
    */
   #ifdef notyet
   static struct mqfs_node *mqfs_create_dir(struct mqfs_node *parent,
           const char *name, int namelen, struct ucred *cred, int mode);
   static struct mqfs_node *mqfs_create_link(struct mqfs_node *parent,
           const char *name, int namelen, struct ucred *cred, int mode);
   #endif
   
   static struct mqfs_node *mqfs_create_file(struct mqfs_node *parent,
           const char *name, int namelen, struct ucred *cred, int mode);
   static int      mqfs_destroy(struct mqfs_node *mn);
   static void     mqfs_fileno_alloc(struct mqfs_info *mi, struct mqfs_node *mn);
   static void     mqfs_fileno_free(struct mqfs_info *mi, struct mqfs_node *mn);
   static int      mqfs_allocv(struct mount *mp, struct vnode **vpp, struct mqfs_node *pn);
   static int      mqfs_prison_remove(void *obj, void *data);
   
   /*
    * Message queue construction and maniplation
    */
   static struct mqueue    *mqueue_alloc(const struct mq_attr *attr);
   static void     mqueue_free(struct mqueue *mq);
   static int      mqueue_send(struct mqueue *mq, const char *msg_ptr,
                           size_t msg_len, unsigned msg_prio, int waitok,
                           const struct timespec *abs_timeout);
   static int      mqueue_receive(struct mqueue *mq, char *msg_ptr,
                           size_t msg_len, unsigned *msg_prio, int waitok,
                           const struct timespec *abs_timeout);
   static int      _mqueue_send(struct mqueue *mq, struct mqueue_msg *msg,
                           int timo);
   static int      _mqueue_recv(struct mqueue *mq, struct mqueue_msg **msg,
                           int timo);
   static void     mqueue_send_notification(struct mqueue *mq);
   static void     mqueue_fdclose(struct thread *td, int fd, struct file *fp);
   static void     mq_proc_exit(void *arg, struct proc *p);
   
   /*
    * kqueue filters
    */
   static void     filt_mqdetach(struct knote *kn);
   static int      filt_mqread(struct knote *kn, long hint);
   static int      filt_mqwrite(struct knote *kn, long hint);
   
   struct filterops mq_rfiltops = {
           .f_isfd = 1,
           .f_detach = filt_mqdetach,
           .f_event = filt_mqread,
   };
   struct filterops mq_wfiltops = {
           .f_isfd = 1,
           .f_detach = filt_mqdetach,
           .f_event = filt_mqwrite,
   };
   
   /*
    * Initialize fileno bitmap
    */
   static void
   mqfs_fileno_init(struct mqfs_info *mi)
   {
           struct unrhdr *up;
   
           up = new_unrhdr(1, INT_MAX, NULL);
           mi->mi_unrhdr = up;
   }
   
   /*
    * Tear down fileno bitmap
    */
   static void
   mqfs_fileno_uninit(struct mqfs_info *mi)
   {
           struct unrhdr *up;
   
           up = mi->mi_unrhdr;
           mi->mi_unrhdr = NULL;
           delete_unrhdr(up);
   }
   
   /*
    * Allocate a file number
    */
   static void
   mqfs_fileno_alloc(struct mqfs_info *mi, struct mqfs_node *mn)
   {
           /* make sure our parent has a file number */
           if (mn->mn_parent && !mn->mn_parent->mn_fileno)
                   mqfs_fileno_alloc(mi, mn->mn_parent);
   
           switch (mn->mn_type) {
           case mqfstype_root:
           case mqfstype_dir:
           case mqfstype_file:
           case mqfstype_symlink:
                   mn->mn_fileno = alloc_unr(mi->mi_unrhdr);
                   break;
           case mqfstype_this:
                   KASSERT(mn->mn_parent != NULL,
                       ("mqfstype_this node has no parent"));
                   mn->mn_fileno = mn->mn_parent->mn_fileno;
                   break;
           case mqfstype_parent:
                   KASSERT(mn->mn_parent != NULL,
                       ("mqfstype_parent node has no parent"));
                   if (mn->mn_parent == mi->mi_root) {
                           mn->mn_fileno = mn->mn_parent->mn_fileno;
                           break;
                   }
                   KASSERT(mn->mn_parent->mn_parent != NULL,
                       ("mqfstype_parent node has no grandparent"));
                   mn->mn_fileno = mn->mn_parent->mn_parent->mn_fileno;
                   break;
           default:
                   KASSERT(0,
                       ("mqfs_fileno_alloc() called for unknown type node: %d",
                           mn->mn_type));
                   break;
           }
   }
   
   /*
    * Release a file number
    */
   static void
   mqfs_fileno_free(struct mqfs_info *mi, struct mqfs_node *mn)
   {
           switch (mn->mn_type) {
           case mqfstype_root:
           case mqfstype_dir:
           case mqfstype_file:
           case mqfstype_symlink:
                   free_unr(mi->mi_unrhdr, mn->mn_fileno);
                   break;
           case mqfstype_this:
           case mqfstype_parent:
                   /* ignore these, as they don't "own" their file number */
                   break;
           default:
                   KASSERT(0,
                       ("mqfs_fileno_free() called for unknown type node: %d", 
                           mn->mn_type));
                   break;
           }
   }
   
   static __inline struct mqfs_node *
   mqnode_alloc(void)
   {
           return uma_zalloc(mqnode_zone, M_WAITOK | M_ZERO);
   }
   
   static __inline void
   mqnode_free(struct mqfs_node *node)
   {
           uma_zfree(mqnode_zone, node);
   }
   
   static __inline void
   mqnode_addref(struct mqfs_node *node)
   {
           atomic_add_int(&node->mn_refcount, 1);
   }
   
   static __inline void
   mqnode_release(struct mqfs_node *node)
   {
           struct mqfs_info *mqfs;
           int old, exp;
   
           mqfs = node->mn_info;
           old = atomic_fetchadd_int(&node->mn_refcount, -1);
           if (node->mn_type == mqfstype_dir ||
               node->mn_type == mqfstype_root)
                   exp = 3; /* include . and .. */
           else
                   exp = 1;
           if (old == exp) {
                   int locked = sx_xlocked(&mqfs->mi_lock);
                   if (!locked)
                           sx_xlock(&mqfs->mi_lock);
                   mqfs_destroy(node);
                   if (!locked)
                           sx_xunlock(&mqfs->mi_lock);
           }
   }
   
   /*
    * Add a node to a directory
    */
   static int
   mqfs_add_node(struct mqfs_node *parent, struct mqfs_node *node)
   {
           KASSERT(parent != NULL, ("%s(): parent is NULL", __func__));
           KASSERT(parent->mn_info != NULL,
               ("%s(): parent has no mn_info", __func__));
           KASSERT(parent->mn_type == mqfstype_dir ||
               parent->mn_type == mqfstype_root,
               ("%s(): parent is not a directory", __func__));
   
           node->mn_info = parent->mn_info;
           node->mn_parent = parent;
           LIST_INIT(&node->mn_children);
           LIST_INIT(&node->mn_vnodes);
           LIST_INSERT_HEAD(&parent->mn_children, node, mn_sibling);
           mqnode_addref(parent);
           return (0);
   }
   
   static struct mqfs_node *
   mqfs_create_node(const char *name, int namelen, struct ucred *cred, int mode,
           int nodetype)
   {
           struct mqfs_node *node;
   
           node = mqnode_alloc();
           strncpy(node->mn_name, name, namelen);
           node->mn_pr_root = cred->cr_prison->pr_root;
           node->mn_type = nodetype;
           node->mn_refcount = 1;
           vfs_timestamp(&node->mn_birth);
           node->mn_ctime = node->mn_atime = node->mn_mtime
                   = node->mn_birth;
           node->mn_uid = cred->cr_uid;
           node->mn_gid = cred->cr_gid;
           node->mn_mode = mode;
           return (node);
   }
   
   /*
    * Create a file
    */
   static struct mqfs_node *
   mqfs_create_file(struct mqfs_node *parent, const char *name, int namelen,
           struct ucred *cred, int mode)
   {
           struct mqfs_node *node;
   
           node = mqfs_create_node(name, namelen, cred, mode, mqfstype_file);
           if (mqfs_add_node(parent, node) != 0) {
                   mqnode_free(node);
                   return (NULL);
           }
           return (node);
   }
   
   /*
    * Add . and .. to a directory
    */
   static int
   mqfs_fixup_dir(struct mqfs_node *parent)
   {
           struct mqfs_node *dir;
   
           dir = mqnode_alloc();
           dir->mn_name[0] = '.';
           dir->mn_type = mqfstype_this;
           dir->mn_refcount = 1;
           if (mqfs_add_node(parent, dir) != 0) {
                   mqnode_free(dir);
                   return (-1);
           }
   
           dir = mqnode_alloc();
           dir->mn_name[0] = dir->mn_name[1] = '.';
           dir->mn_type = mqfstype_parent;
           dir->mn_refcount = 1;
   
           if (mqfs_add_node(parent, dir) != 0) {
                   mqnode_free(dir);
                   return (-1);
           }
   
           return (0);
   }
   
   #ifdef notyet
   
   /*
    * Create a directory
    */
   static struct mqfs_node *
   mqfs_create_dir(struct mqfs_node *parent, const char *name, int namelen,
           struct ucred *cred, int mode)
   {
           struct mqfs_node *node;
   
           node = mqfs_create_node(name, namelen, cred, mode, mqfstype_dir);
           if (mqfs_add_node(parent, node) != 0) {
                   mqnode_free(node);
                   return (NULL);
           }
   
           if (mqfs_fixup_dir(node) != 0) {
                   mqfs_destroy(node);
                   return (NULL);
           }
           return (node);
   }
   
   /*
    * Create a symlink
    */
   static struct mqfs_node *
   mqfs_create_link(struct mqfs_node *parent, const char *name, int namelen,
           struct ucred *cred, int mode)
   {
           struct mqfs_node *node;
   
           node = mqfs_create_node(name, namelen, cred, mode, mqfstype_symlink);
           if (mqfs_add_node(parent, node) != 0) {
                   mqnode_free(node);
                   return (NULL);
           }
           return (node);
   }
   
   #endif
   
   /*
    * Destroy a node or a tree of nodes
    */
   static int
   mqfs_destroy(struct mqfs_node *node)
   {
           struct mqfs_node *parent;
   
           KASSERT(node != NULL,
               ("%s(): node is NULL", __func__));
           KASSERT(node->mn_info != NULL,
               ("%s(): node has no mn_info", __func__));
   
           /* destroy children */
           if (node->mn_type == mqfstype_dir || node->mn_type == mqfstype_root)
                   while (! LIST_EMPTY(&node->mn_children))
                           mqfs_destroy(LIST_FIRST(&node->mn_children));
   
           /* unlink from parent */
           if ((parent = node->mn_parent) != NULL) {
                   KASSERT(parent->mn_info == node->mn_info,
                       ("%s(): parent has different mn_info", __func__));
                   LIST_REMOVE(node, mn_sibling);
           }
   
           if (node->mn_fileno != 0)
                   mqfs_fileno_free(node->mn_info, node);
           if (node->mn_data != NULL)
                   mqueue_free(node->mn_data);
           mqnode_free(node);
           return (0);
   }
   
   /*
    * Mount a mqfs instance
    */
   static int
   mqfs_mount(struct mount *mp)
   {
           struct statfs *sbp;
   
           if (mp->mnt_flag & MNT_UPDATE)
                   return (EOPNOTSUPP);
   
           mp->mnt_data = &mqfs_data;
           MNT_ILOCK(mp);
           mp->mnt_flag |= MNT_LOCAL;
           MNT_IUNLOCK(mp);
           vfs_getnewfsid(mp);
   
           sbp = &mp->mnt_stat;
           vfs_mountedfrom(mp, "mqueue");
           sbp->f_bsize = PAGE_SIZE;
           sbp->f_iosize = PAGE_SIZE;
           sbp->f_blocks = 1;
           sbp->f_bfree = 0;
           sbp->f_bavail = 0;
           sbp->f_files = 1;
           sbp->f_ffree = 0;
           return (0);
   }
   
   /*
    * Unmount a mqfs instance
    */
   static int
   mqfs_unmount(struct mount *mp, int mntflags)
   {
           int error;
   
           error = vflush(mp, 0, (mntflags & MNT_FORCE) ?  FORCECLOSE : 0,
               curthread);
           return (error);
   }
   
   /*
    * Return a root vnode
    */
   static int
   mqfs_root(struct mount *mp, int flags, struct vnode **vpp)
   {
           struct mqfs_info *mqfs;
           int ret;
   
           mqfs = VFSTOMQFS(mp);
           ret = mqfs_allocv(mp, vpp, mqfs->mi_root);
           return (ret);
   }
   
   /*
    * Return filesystem stats
    */
   static int
   mqfs_statfs(struct mount *mp, struct statfs *sbp)
   {
           /* XXX update statistics */
           return (0);
   }
   
   /*
    * Initialize a mqfs instance
    */
   static int
   mqfs_init(struct vfsconf *vfc)
   {
           struct mqfs_node *root;
           struct mqfs_info *mi;
           osd_method_t methods[PR_MAXMETHOD] = {
               [PR_METHOD_REMOVE] = mqfs_prison_remove,
           };
   
           mqnode_zone = uma_zcreate("mqnode", sizeof(struct mqfs_node),
                   NULL, NULL, NULL, NULL, UMA_ALIGN_PTR, 0);
           mqueue_zone = uma_zcreate("mqueue", sizeof(struct mqueue),
                   NULL, NULL, NULL, NULL, UMA_ALIGN_PTR, 0);
           mvdata_zone = uma_zcreate("mvdata",
                   sizeof(struct mqfs_vdata), NULL, NULL, NULL,
                   NULL, UMA_ALIGN_PTR, 0);
           mqnoti_zone = uma_zcreate("mqnotifier", sizeof(struct mqueue_notifier),
                   NULL, NULL, NULL, NULL, UMA_ALIGN_PTR, 0);
           mi = &mqfs_data;
           sx_init(&mi->mi_lock, "mqfs lock");
           /* set up the root diretory */
           root = mqfs_create_node("/", 1, curthread->td_ucred, 01777,
                   mqfstype_root);
           root->mn_info = mi;
           LIST_INIT(&root->mn_children);
           LIST_INIT(&root->mn_vnodes);
           mi->mi_root = root;
           mqfs_fileno_init(mi);
           mqfs_fileno_alloc(mi, root);
           mqfs_fixup_dir(root);
           exit_tag = EVENTHANDLER_REGISTER(process_exit, mq_proc_exit, NULL,
               EVENTHANDLER_PRI_ANY);
           mq_fdclose = mqueue_fdclose;
           p31b_setcfg(CTL_P1003_1B_MESSAGE_PASSING, _POSIX_MESSAGE_PASSING);
           mqfs_osd_jail_slot = osd_jail_register(NULL, methods);
           return (0);
   }
   
   /*
    * Destroy a mqfs instance
    */
   static int
   mqfs_uninit(struct vfsconf *vfc)
   {
           struct mqfs_info *mi;
   
           if (!unloadable)
                   return (EOPNOTSUPP);
           osd_jail_deregister(mqfs_osd_jail_slot);
           EVENTHANDLER_DEREGISTER(process_exit, exit_tag);
           mi = &mqfs_data;
           mqfs_destroy(mi->mi_root);
           mi->mi_root = NULL;
           mqfs_fileno_uninit(mi);
           sx_destroy(&mi->mi_lock);
           uma_zdestroy(mqnode_zone);
           uma_zdestroy(mqueue_zone);
           uma_zdestroy(mvdata_zone);
           uma_zdestroy(mqnoti_zone);
           return (0);
   }
   
   /*
    * task routine
    */
   static void
   do_recycle(void *context, int pending __unused)
   {
           struct vnode *vp = (struct vnode *)context;
   
           vn_lock(vp, LK_EXCLUSIVE | LK_RETRY);
           vrecycle(vp);
           VOP_UNLOCK(vp);
           vdrop(vp);
   }
   
   /*
    * Allocate a vnode
    */
   static int
   mqfs_allocv(struct mount *mp, struct vnode **vpp, struct mqfs_node *pn)
   {
           struct mqfs_vdata *vd;
           struct mqfs_info  *mqfs;
           struct vnode *newvpp;
           int error;
   
           mqfs = pn->mn_info;
           *vpp = NULL;
           sx_xlock(&mqfs->mi_lock);
           LIST_FOREACH(vd, &pn->mn_vnodes, mv_link) {
                   if (vd->mv_vnode->v_mount == mp) {
                           vhold(vd->mv_vnode);
                           break;
                   }
           }
   
           if (vd != NULL) {
   found:
                   *vpp = vd->mv_vnode;
                   sx_xunlock(&mqfs->mi_lock);
                   error = vget(*vpp, LK_RETRY | LK_EXCLUSIVE);
                   vdrop(*vpp);
                   return (error);
           }
           sx_xunlock(&mqfs->mi_lock);
   
           error = getnewvnode("mqueue", mp, &mqfs_vnodeops, &newvpp);
           if (error)
                   return (error);
           vn_lock(newvpp, LK_EXCLUSIVE | LK_RETRY);
           error = insmntque(newvpp, mp);
           if (error != 0)
                   return (error);
   
           sx_xlock(&mqfs->mi_lock);
           /*
            * Check if it has already been allocated
            * while we were blocked.
            */
           LIST_FOREACH(vd, &pn->mn_vnodes, mv_link) {
                   if (vd->mv_vnode->v_mount == mp) {
                           vhold(vd->mv_vnode);
                           sx_xunlock(&mqfs->mi_lock);
   
                           vgone(newvpp);
                           vput(newvpp);
                           goto found;
                   }
           }
   
           *vpp = newvpp;
   
           vd = uma_zalloc(mvdata_zone, M_WAITOK);
           (*vpp)->v_data = vd;
           vd->mv_vnode = *vpp;
           vd->mv_node = pn;
           TASK_INIT(&vd->mv_task, 0, do_recycle, *vpp);
           LIST_INSERT_HEAD(&pn->mn_vnodes, vd, mv_link);
           mqnode_addref(pn);
           switch (pn->mn_type) {
           case mqfstype_root:
                   (*vpp)->v_vflag = VV_ROOT;
                   /* fall through */
           case mqfstype_dir:
           case mqfstype_this:
           case mqfstype_parent:
                   (*vpp)->v_type = VDIR;
                   break;
           case mqfstype_file:
                   (*vpp)->v_type = VREG;
                   break;
           case mqfstype_symlink:
                   (*vpp)->v_type = VLNK;
                   break;
           case mqfstype_none:
                   KASSERT(0, ("mqfs_allocf called for null node\n"));
           default:
                   panic("%s has unexpected type: %d", pn->mn_name, pn->mn_type);
           }
           sx_xunlock(&mqfs->mi_lock);
           return (0);
   }
   
   /* 
    * Search a directory entry
    */
   static struct mqfs_node *
   mqfs_search(struct mqfs_node *pd, const char *name, int len, struct ucred *cred)
   {
           struct mqfs_node *pn;
           const void *pr_root;
   
           sx_assert(&pd->mn_info->mi_lock, SX_LOCKED);
           pr_root = cred->cr_prison->pr_root;
           LIST_FOREACH(pn, &pd->mn_children, mn_sibling) {
                   /* Only match names within the same prison root directory */
                   if ((pn->mn_pr_root == NULL || pn->mn_pr_root == pr_root) &&
                       strncmp(pn->mn_name, name, len) == 0 &&
                       pn->mn_name[len] == '\0')
                           return (pn);
           }
           return (NULL);
   }
   
   /*
    * Look up a file or directory.
    */
   static int
   mqfs_lookupx(struct vop_cachedlookup_args *ap)
   {
           struct componentname *cnp;
           struct vnode *dvp, **vpp;
           struct mqfs_node *pd;
           struct mqfs_node *pn;
           struct mqfs_info *mqfs;
           int nameiop, flags, error, namelen;
           char *pname;
           struct thread *td;
   
           cnp = ap->a_cnp;
           vpp = ap->a_vpp;
           dvp = ap->a_dvp;
           pname = cnp->cn_nameptr;
           namelen = cnp->cn_namelen;
           td = cnp->cn_thread;
           flags = cnp->cn_flags;
           nameiop = cnp->cn_nameiop;
           pd = VTON(dvp);
           pn = NULL;
           mqfs = pd->mn_info;
           *vpp = NULLVP;
   
           if (dvp->v_type != VDIR)
                   return (ENOTDIR);
   
           error = VOP_ACCESS(dvp, VEXEC, cnp->cn_cred, cnp->cn_thread);
           if (error)
                   return (error);
   
           /* shortcut: check if the name is too long */
           if (cnp->cn_namelen >= MQFS_NAMELEN)
                   return (ENOENT);
   
           /* self */
           if (namelen == 1 && pname[0] == '.') {
                   if ((flags & ISLASTCN) && nameiop != LOOKUP)
                           return (EINVAL);
                   pn = pd;
                   *vpp = dvp;
                   VREF(dvp);
                   return (0);
           }
   
           /* parent */
           if (cnp->cn_flags & ISDOTDOT) {
                   if (dvp->v_vflag & VV_ROOT)
                           return (EIO);
                   if ((flags & ISLASTCN) && nameiop != LOOKUP)
                           return (EINVAL);
                   VOP_UNLOCK(dvp);
                   KASSERT(pd->mn_parent, ("non-root directory has no parent"));
                   pn = pd->mn_parent;
                   error = mqfs_allocv(dvp->v_mount, vpp, pn);
                   vn_lock(dvp, LK_EXCLUSIVE | LK_RETRY);
                   return (error);
           }
   
           /* named node */
           sx_xlock(&mqfs->mi_lock);
           pn = mqfs_search(pd, pname, namelen, cnp->cn_cred);
           if (pn != NULL)
                   mqnode_addref(pn);
           sx_xunlock(&mqfs->mi_lock);
   
           /* found */
           if (pn != NULL) {
                   /* DELETE */
                   if (nameiop == DELETE && (flags & ISLASTCN)) {
                           error = VOP_ACCESS(dvp, VWRITE, cnp->cn_cred, td);
                           if (error) {
                                   mqnode_release(pn);
                                   return (error);
                           }
                           if (*vpp == dvp) {
                                   VREF(dvp);
                                   *vpp = dvp;
                                   mqnode_release(pn);
                                   return (0);
                           }
                   }
   
                   /* allocate vnode */
                   error = mqfs_allocv(dvp->v_mount, vpp, pn);
                   mqnode_release(pn);
                   if (error == 0 && cnp->cn_flags & MAKEENTRY)
                           cache_enter(dvp, *vpp, cnp);
                   return (error);
           }
   
           /* not found */
   
           /* will create a new entry in the directory ? */
           if ((nameiop == CREATE || nameiop == RENAME) && (flags & LOCKPARENT)
               && (flags & ISLASTCN)) {
                   error = VOP_ACCESS(dvp, VWRITE, cnp->cn_cred, td);
                   if (error)
                           return (error);
                   cnp->cn_flags |= SAVENAME;
                   return (EJUSTRETURN);
           }
           return (ENOENT);
   }
   
   #if 0
   struct vop_lookup_args {
           struct vop_generic_args a_gen;
           struct vnode *a_dvp;
           struct vnode **a_vpp;
           struct componentname *a_cnp;
   };
   #endif
   
   /*
    * vnode lookup operation
    */
   static int
   mqfs_lookup(struct vop_cachedlookup_args *ap)
   {
           int rc;
   
           rc = mqfs_lookupx(ap);
           return (rc);
   }
   
   #if 0
   struct vop_create_args {
           struct vnode *a_dvp;
           struct vnode **a_vpp;
           struct componentname *a_cnp;
           struct vattr *a_vap;
   };
   #endif
   
   /*
    * vnode creation operation
    */
   static int
   mqfs_create(struct vop_create_args *ap)
   {
           struct mqfs_info *mqfs = VFSTOMQFS(ap->a_dvp->v_mount);
           struct componentname *cnp = ap->a_cnp;
           struct mqfs_node *pd;
           struct mqfs_node *pn;
           struct mqueue *mq;
           int error;
   
           pd = VTON(ap->a_dvp);
           if (pd->mn_type != mqfstype_root && pd->mn_type != mqfstype_dir)
                   return (ENOTDIR);
           mq = mqueue_alloc(NULL);
           if (mq == NULL)
                   return (EAGAIN);
           sx_xlock(&mqfs->mi_lock);
          if ((cnp->cn_flags & HASBUF) == 0)
                  panic("%s: no name", __func__);
          pn = mqfs_create_file(pd, cnp->cn_nameptr, cnp->cn_namelen,
                  cnp->cn_cred, ap->a_vap->va_mode);
          if (pn == NULL) {
                  sx_xunlock(&mqfs->mi_lock);
                  error = ENOSPC;
          } else {
                  mqnode_addref(pn);
                  sx_xunlock(&mqfs->mi_lock);
                  error = mqfs_allocv(ap->a_dvp->v_mount, ap->a_vpp, pn);
                  mqnode_release(pn);
                  if (error)
                          mqfs_destroy(pn);
                  else
                          pn->mn_data = mq;
          }
          if (error)
                  mqueue_free(mq);
          return (error);
  }
  
  /*
   * Remove an entry
   */
  static
  int do_unlink(struct mqfs_node *pn, struct ucred *ucred)
  {
          struct mqfs_node *parent;
          struct mqfs_vdata *vd;
          int error = 0;
  
          sx_assert(&pn->mn_info->mi_lock, SX_LOCKED);
  
          if (ucred->cr_uid != pn->mn_uid &&
              (error = priv_check_cred(ucred, PRIV_MQ_ADMIN)) != 0)
                  error = EACCES;
          else if (!pn->mn_deleted) {
                  parent = pn->mn_parent;
                  pn->mn_parent = NULL;
                  pn->mn_deleted = 1;
                  LIST_REMOVE(pn, mn_sibling);
                  LIST_FOREACH(vd, &pn->mn_vnodes, mv_link) {
                          cache_purge(vd->mv_vnode);
                          vhold(vd->mv_vnode);
                          taskqueue_enqueue(taskqueue_thread, &vd->mv_task);
                  }
                  mqnode_release(pn);
                  mqnode_release(parent);
          } else
                  error = ENOENT;
          return (error);
  }
  
  #if 0
  struct vop_remove_args {
          struct vnode *a_dvp;
          struct vnode *a_vp;
          struct componentname *a_cnp;
  };
  #endif
  
  /*
   * vnode removal operation
   */
  static int
  mqfs_remove(struct vop_remove_args *ap)
  {
          struct mqfs_info *mqfs = VFSTOMQFS(ap->a_dvp->v_mount);
          struct mqfs_node *pn;
          int error;
  
          if (ap->a_vp->v_type == VDIR)
                  return (EPERM);
          pn = VTON(ap->a_vp);
          sx_xlock(&mqfs->mi_lock);
          error = do_unlink(pn, ap->a_cnp->cn_cred);
          sx_xunlock(&mqfs->mi_lock);
          return (error);
  }
  
  #if 0
  struct vop_inactive_args {
          struct vnode *a_vp;
          struct thread *a_td;
  };
  #endif
  
  static int
  mqfs_inactive(struct vop_inactive_args *ap)
  {
          struct mqfs_node *pn = VTON(ap->a_vp);
  
          if (pn->mn_deleted)
                  vrecycle(ap->a_vp);
          return (0);
  }
  
  #if 0
  struct vop_reclaim_args {
          struct vop_generic_args a_gen;
          struct vnode *a_vp;
  };
  #endif
  
  static int
  mqfs_reclaim(struct vop_reclaim_args *ap)
  {
          struct mqfs_info *mqfs = VFSTOMQFS(ap->a_vp->v_mount);
          struct vnode *vp = ap->a_vp;
          struct mqfs_node *pn;
          struct mqfs_vdata *vd;
  
          vd = vp->v_data;
          pn = vd->mv_node;
          sx_xlock(&mqfs->mi_lock);
          vp->v_data = NULL;
          LIST_REMOVE(vd, mv_link);
          uma_zfree(mvdata_zone, vd);
          mqnode_release(pn);
          sx_xunlock(&mqfs->mi_lock);
          return (0);
  }
  
  #if 0
  struct vop_open_args {
          struct vop_generic_args a_gen;
          struct vnode *a_vp;
          int a_mode;
          struct ucred *a_cred;
          struct thread *a_td;
          struct file *a_fp;
  };
  #endif
  
  static int
  mqfs_open(struct vop_open_args *ap)
  {
          return (0);
  }
  
  #if 0
  struct vop_close_args {
          struct vop_generic_args a_gen;
          struct vnode *a_vp;
          int a_fflag;
          struct ucred *a_cred;
          struct thread *a_td;
  };
  #endif
  
  static int
  mqfs_close(struct vop_close_args *ap)
  {
          return (0);
  }
  
  #if 0
  struct vop_access_args {
          struct vop_generic_args a_gen;
          struct vnode *a_vp;
          accmode_t a_accmode;
          struct ucred *a_cred;
          struct thread *a_td;
  };
  #endif
  
  /*
   * Verify permissions
   */
  static int
  mqfs_access(struct vop_access_args *ap)
  {
          struct vnode *vp = ap->a_vp;
          struct vattr vattr;
          int error;
  
          error = VOP_GETATTR(vp, &vattr, ap->a_cred);
          if (error)
                  return (error);
          error = vaccess(vp->v_type, vattr.va_mode, vattr.va_uid, vattr.va_gid,
              ap->a_accmode, ap->a_cred);
          return (error);
  }
  
  #if 0
  struct vop_getattr_args {
          struct vop_generic_args a_gen;
          struct vnode *a_vp;
          struct vattr *a_vap;
          struct ucred *a_cred;
  };
  #endif
  
  /*
   * Get file attributes
   */
  static int
  mqfs_getattr(struct vop_getattr_args *ap)
  {
          struct vnode *vp = ap->a_vp;
          struct mqfs_node *pn = VTON(vp);
          struct vattr *vap = ap->a_vap;
          int error = 0;
  
          vap->va_type = vp->v_type;
          vap->va_mode = pn->mn_mode;
          vap->va_nlink = 1;
          vap->va_uid = pn->mn_uid;
          vap->va_gid = pn->mn_gid;
          vap->va_fsid = vp->v_mount->mnt_stat.f_fsid.val[0];
          vap->va_fileid = pn->mn_fileno;
          vap->va_size = 0;
          vap->va_blocksize = PAGE_SIZE;
          vap->va_bytes = vap->va_size = 0;
          vap->va_atime = pn->mn_atime;
          vap->va_mtime = pn->mn_mtime;
          vap->va_ctime = pn->mn_ctime;
          vap->va_birthtime = pn->mn_birth;
          vap->va_gen = 0;
          vap->va_flags = 0;
          vap->va_rdev = NODEV;
          vap->va_bytes = 0;
          vap->va_filerev = 0;
          return (error);
  }
  
  #if 0
  struct vop_setattr_args {
          struct vop_generic_args a_gen;
          struct vnode *a_vp;
          struct vattr *a_vap;
          struct ucred *a_cred;
  };
  #endif
  /*
   * Set attributes
   */
  static int
  mqfs_setattr(struct vop_setattr_args *ap)
  {
          struct mqfs_node *pn;
          struct vattr *vap;
          struct vnode *vp;
          struct thread *td;
          int c, error;
          uid_t uid;
          gid_t gid;
  
          td = curthread;
          vap = ap->a_vap;
          vp = ap->a_vp;
          if ((vap->va_type != VNON) ||
              (vap->va_nlink != VNOVAL) ||
              (vap->va_fsid != VNOVAL) ||
              (vap->va_fileid != VNOVAL) ||
              (vap->va_blocksize != VNOVAL) ||
              (vap->va_flags != VNOVAL && vap->va_flags != 0) ||
              (vap->va_rdev != VNOVAL) ||
              ((int)vap->va_bytes != VNOVAL) ||
              (vap->va_gen != VNOVAL)) {
                  return (EINVAL);
          }
  
          pn = VTON(vp);
  
          error = c = 0;
          if (vap->va_uid == (uid_t)VNOVAL)
                  uid = pn->mn_uid;
          else
                  uid = vap->va_uid;
          if (vap->va_gid == (gid_t)VNOVAL)
                  gid = pn->mn_gid;
          else
                  gid = vap->va_gid;
  
          if (uid != pn->mn_uid || gid != pn->mn_gid) {
                  /*
                   * To modify the ownership of a file, must possess VADMIN
                   * for that file.
                   */
                  if ((error = VOP_ACCESS(vp, VADMIN, ap->a_cred, td)))
                          return (error);
  
                  /*
                   * XXXRW: Why is there a privilege check here: shouldn't the
                   * check in VOP_ACCESS() be enough?  Also, are the group bits
                   * below definitely right?
                   */
                  if (((ap->a_cred->cr_uid != pn->mn_uid) || uid != pn->mn_uid ||
                      (gid != pn->mn_gid && !groupmember(gid, ap->a_cred))) &&
                      (error = priv_check(td, PRIV_MQ_ADMIN)) != 0)
                          return (error);
                  pn->mn_uid = uid;
                  pn->mn_gid = gid;
                  c = 1;
          }
  
          if (vap->va_mode != (mode_t)VNOVAL) {
                  if ((ap->a_cred->cr_uid != pn->mn_uid) &&
                      (error = priv_check(td, PRIV_MQ_ADMIN)))
                          return (error);
                  pn->mn_mode = vap->va_mode;
                  c = 1;
          }
  
          if (vap->va_atime.tv_sec != VNOVAL || vap->va_mtime.tv_sec != VNOVAL) {
                  /* See the comment in ufs_vnops::ufs_setattr(). */
                  if ((error = VOP_ACCESS(vp, VADMIN, ap->a_cred, td)) &&
                      ((vap->va_vaflags & VA_UTIMES_NULL) == 0 ||
                      (error = VOP_ACCESS(vp, VWRITE, ap->a_cred, td))))
                          return (error);
                  if (vap->va_atime.tv_sec != VNOVAL) {
                          pn->mn_atime = vap->va_atime;
                  }
                  if (vap->va_mtime.tv_sec != VNOVAL) {
                          pn->mn_mtime = vap->va_mtime;
                  }
                  c = 1;
          }
          if (c) {
                  vfs_timestamp(&pn->mn_ctime);
          }
          return (0);
  }
  
  #if 0
  struct vop_read_args {
          struct vop_generic_args a_gen;
          struct vnode *a_vp;
          struct uio *a_uio;
          int a_ioflag;
          struct ucred *a_cred;
  };
  #endif
  
  /*
   * Read from a file
   */
  static int
  mqfs_read(struct vop_read_args *ap)
  {
          char buf[80];
          struct vnode *vp = ap->a_vp;
          struct uio *uio = ap->a_uio;
          struct mqueue *mq;
          int len, error;
  
          if (vp->v_type != VREG)
                  return (EINVAL);
  
          mq = VTOMQ(vp);
          snprintf(buf, sizeof(buf),
                  "QSIZE:%-10ld MAXMSG:%-10ld CURMSG:%-10ld MSGSIZE:%-10ld\n",
                  mq->mq_totalbytes,
                  mq->mq_maxmsg,
                  mq->mq_curmsgs,
                  mq->mq_msgsize);
          buf[sizeof(buf)-1] = '\0';
          len = strlen(buf);
          error = uiomove_frombuf(buf, len, uio);
          return (error);
  }
  
  #if 0
  struct vop_readdir_args {
          struct vop_generic_args a_gen;
          struct vnode *a_vp;
          struct uio *a_uio;
          struct ucred *a_cred;
          int *a_eofflag;
          int *a_ncookies;
          u_long **a_cookies;
  };
  #endif
  
  /*
   * Return directory entries.
   */
  static int
  mqfs_readdir(struct vop_readdir_args *ap)
  {
          struct vnode *vp;
          struct mqfs_info *mi;
          struct mqfs_node *pd;
          struct mqfs_node *pn;
          struct dirent entry;
          struct uio *uio;
          const void *pr_root;
          int *tmp_ncookies = NULL;
          off_t offset;
          int error, i;
  
          vp = ap->a_vp;
          mi = VFSTOMQFS(vp->v_mount);
          pd = VTON(vp);
          uio = ap->a_uio;
  
          if (vp->v_type != VDIR)
                  return (ENOTDIR);
  
          if (uio->uio_offset < 0)
                  return (EINVAL);
  
          if (ap->a_ncookies != NULL) {
                  tmp_ncookies = ap->a_ncookies;
                  *ap->a_ncookies = 0;
                  ap->a_ncookies = NULL;
          }
  
          error = 0;
          offset = 0;
  
          pr_root = ap->a_cred->cr_prison->pr_root;
          sx_xlock(&mi->mi_lock);
  
          LIST_FOREACH(pn, &pd->mn_children, mn_sibling) {
                  entry.d_reclen = sizeof(entry);
  
                  /*
                   * Only show names within the same prison root directory
                   * (or not associated with a prison, e.g. "." and "..").
                   */
                  if (pn->mn_pr_root != NULL && pn->mn_pr_root != pr_root)
                          continue;
                  if (!pn->mn_fileno)
                          mqfs_fileno_alloc(mi, pn);
                  entry.d_fileno = pn->mn_fileno;
                  entry.d_off = offset + entry.d_reclen;
                  for (i = 0; i < MQFS_NAMELEN - 1 && pn->mn_name[i] != '\0'; ++i)
                          entry.d_name[i] = pn->mn_name[i];
                  entry.d_namlen = i;
                  switch (pn->mn_type) {
                  case mqfstype_root:
                  case mqfstype_dir:
                  case mqfstype_this:
                  case mqfstype_parent:
                          entry.d_type = DT_DIR;
                          break;
                  case mqfstype_file:
                          entry.d_type = DT_REG;
                          break;
                  case mqfstype_symlink:
                          entry.d_type = DT_LNK;
                          break;
                  default:
                          panic("%s has unexpected node type: %d", pn->mn_name,
                                  pn->mn_type);
                  }
                  dirent_terminate(&entry);
                  if (entry.d_reclen > uio->uio_resid)
                          break;
                  if (offset >= uio->uio_offset) {
                          error = vfs_read_dirent(ap, &entry, offset);
                          if (error)
                                  break;
                  }
                  offset += entry.d_reclen;
          }
          sx_xunlock(&mi->mi_lock);
  
          uio->uio_offset = offset;
  
          if (tmp_ncookies != NULL)
                  ap->a_ncookies = tmp_ncookies;
  
          return (error);
  }
  
  #ifdef notyet
  
  #if 0
  struct vop_mkdir_args {
          struct vnode *a_dvp;
          struvt vnode **a_vpp;
          struvt componentname *a_cnp;
          struct vattr *a_vap;
  };
  #endif
  
  /*
   * Create a directory.
   */
  static int
  mqfs_mkdir(struct vop_mkdir_args *ap)
  {
          struct mqfs_info *mqfs = VFSTOMQFS(ap->a_dvp->v_mount);
          struct componentname *cnp = ap->a_cnp;
          struct mqfs_node *pd = VTON(ap->a_dvp);
          struct mqfs_node *pn;
          int error;
  
          if (pd->mn_type != mqfstype_root && pd->mn_type != mqfstype_dir)
                  return (ENOTDIR);
          sx_xlock(&mqfs->mi_lock);
          if ((cnp->cn_flags & HASBUF) == 0)
                  panic("%s: no name", __func__);
          pn = mqfs_create_dir(pd, cnp->cn_nameptr, cnp->cn_namelen,
                  ap->a_vap->cn_cred, ap->a_vap->va_mode);
          if (pn != NULL)
                  mqnode_addref(pn);
          sx_xunlock(&mqfs->mi_lock);
          if (pn == NULL) {
                  error = ENOSPC;
          } else {
                  error = mqfs_allocv(ap->a_dvp->v_mount, ap->a_vpp, pn);
                  mqnode_release(pn);
          }
          return (error);
  }
  
  #if 0
  struct vop_rmdir_args {
          struct vnode *a_dvp;
          struct vnode *a_vp;
          struct componentname *a_cnp;
  };
  #endif
  
  /*
   * Remove a directory.
   */
  static int
  mqfs_rmdir(struct vop_rmdir_args *ap)
  {
          struct mqfs_info *mqfs = VFSTOMQFS(ap->a_dvp->v_mount);
          struct mqfs_node *pn = VTON(ap->a_vp);
          struct mqfs_node *pt;
  
          if (pn->mn_type != mqfstype_dir)
                  return (ENOTDIR);
  
          sx_xlock(&mqfs->mi_lock);
          if (pn->mn_deleted) {
                  sx_xunlock(&mqfs->mi_lock);
                  return (ENOENT);
          }
  
          pt = LIST_FIRST(&pn->mn_children);
          pt = LIST_NEXT(pt, mn_sibling);
          pt = LIST_NEXT(pt, mn_sibling);
          if (pt != NULL) {
                  sx_xunlock(&mqfs->mi_lock);
                  return (ENOTEMPTY);
          }
          pt = pn->mn_parent;
          pn->mn_parent = NULL;
          pn->mn_deleted = 1;
          LIST_REMOVE(pn, mn_sibling);
          mqnode_release(pn);
          mqnode_release(pt);
          sx_xunlock(&mqfs->mi_lock);
          cache_purge(ap->a_vp);
          return (0);
  }
  
  #endif /* notyet */
  
  /*
   * See if this prison root is obsolete, and clean up associated queues if it is.
   */
  static int
  mqfs_prison_remove(void *obj, void *data __unused)
  {
          const struct prison *pr = obj;
          struct prison *tpr;
          struct mqfs_node *pn, *tpn;
          int found;
  
          found = 0;
          TAILQ_FOREACH(tpr, &allprison, pr_list) {
                  prison_lock(tpr);
                  if (tpr != pr && prison_isvalid(tpr) &&
                      tpr->pr_root == pr->pr_root)
                          found = 1;
                  prison_unlock(tpr);
          }
          if (!found) {
                  /*
                   * No jails are rooted in this directory anymore,
                   * so no queues should be either.
                   */
                  sx_xlock(&mqfs_data.mi_lock);
                  LIST_FOREACH_SAFE(pn, &mqfs_data.mi_root->mn_children,
                      mn_sibling, tpn) {
                          if (pn->mn_pr_root == pr->pr_root)
                                  (void)do_unlink(pn, curthread->td_ucred);
                  }
                  sx_xunlock(&mqfs_data.mi_lock);
          }
          return (0);
  }
  
  /*
   * Allocate a message queue
   */
  static struct mqueue *
  mqueue_alloc(const struct mq_attr *attr)
  {
          struct mqueue *mq;
  
          if (curmq >= maxmq)
                  return (NULL);
          mq = uma_zalloc(mqueue_zone, M_WAITOK | M_ZERO);
          TAILQ_INIT(&mq->mq_msgq);
          if (attr != NULL) {
                  mq->mq_maxmsg = attr->mq_maxmsg;
                  mq->mq_msgsize = attr->mq_msgsize;
          } else {
                  mq->mq_maxmsg = default_maxmsg;
                  mq->mq_msgsize = default_msgsize;
          }
          mtx_init(&mq->mq_mutex, "mqueue lock", NULL, MTX_DEF);
          knlist_init_mtx(&mq->mq_rsel.si_note, &mq->mq_mutex);
          knlist_init_mtx(&mq->mq_wsel.si_note, &mq->mq_mutex);
          atomic_add_int(&curmq, 1);
          return (mq);
  }
  
  /*
   * Destroy a message queue
   */
  static void
  mqueue_free(struct mqueue *mq)
  {
          struct mqueue_msg *msg;
  
          while ((msg = TAILQ_FIRST(&mq->mq_msgq)) != NULL) {
                  TAILQ_REMOVE(&mq->mq_msgq, msg, msg_link);
                  free(msg, M_MQUEUEDATA);
          }
  
          mtx_destroy(&mq->mq_mutex);
          seldrain(&mq->mq_rsel);
          seldrain(&mq->mq_wsel);
          knlist_destroy(&mq->mq_rsel.si_note);
          knlist_destroy(&mq->mq_wsel.si_note);
          uma_zfree(mqueue_zone, mq);
          atomic_add_int(&curmq, -1);
  }
  
  /*
   * Load a message from user space
   */
  static struct mqueue_msg *
  mqueue_loadmsg(const char *msg_ptr, size_t msg_size, int msg_prio)
  {
          struct mqueue_msg *msg;
          size_t len;
          int error;
  
          len = sizeof(struct mqueue_msg) + msg_size;
          msg = malloc(len, M_MQUEUEDATA, M_WAITOK);
          error = copyin(msg_ptr, ((char *)msg) + sizeof(struct mqueue_msg),
              msg_size);
          if (error) {
                  free(msg, M_MQUEUEDATA);
                  msg = NULL;
          } else {
                  msg->msg_size = msg_size;
                  msg->msg_prio = msg_prio;
          }
          return (msg);
  }
  
  /*
   * Save a message to user space
   */
  static int
  mqueue_savemsg(struct mqueue_msg *msg, char *msg_ptr, int *msg_prio)
  {
          int error;
  
          error = copyout(((char *)msg) + sizeof(*msg), msg_ptr,
                  msg->msg_size);
          if (error == 0 && msg_prio != NULL)
                  error = copyout(&msg->msg_prio, msg_prio, sizeof(int));
          return (error);
  }
  
  /*
   * Free a message's memory
   */
  static __inline void
  mqueue_freemsg(struct mqueue_msg *msg)
  {
          free(msg, M_MQUEUEDATA);
  }
  
  /*
   * Send a message. if waitok is false, thread will not be
   * blocked if there is no data in queue, otherwise, absolute
   * time will be checked.
   */
  int
  mqueue_send(struct mqueue *mq, const char *msg_ptr,
          size_t msg_len, unsigned msg_prio, int waitok,
          const struct timespec *abs_timeout)
  {
          struct mqueue_msg *msg;
          struct timespec ts, ts2;
          struct timeval tv;
          int error;
  
          if (msg_prio >= MQ_PRIO_MAX)
                  return (EINVAL);
          if (msg_len > mq->mq_msgsize)
                  return (EMSGSIZE);
          msg = mqueue_loadmsg(msg_ptr, msg_len, msg_prio);
          if (msg == NULL)
                  return (EFAULT);
  
          /* O_NONBLOCK case */
          if (!waitok) {
                  error = _mqueue_send(mq, msg, -1);
                  if (error)
                          goto bad;
                  return (0);
          }
  
          /* we allow a null timeout (wait forever) */
          if (abs_timeout == NULL) {
                  error = _mqueue_send(mq, msg, 0);
                  if (error)
                          goto bad;
                  return (0);
          }
  
          /* send it before checking time */
          error = _mqueue_send(mq, msg, -1);
          if (error == 0)
                  return (0);
  
          if (error != EAGAIN)
                  goto bad;
  
          if (abs_timeout->tv_nsec >= 1000000000 || abs_timeout->tv_nsec < 0) {
                  error = EINVAL;
                  goto bad;
          }
          for (;;) {
                  getnanotime(&ts);
                  timespecsub(abs_timeout, &ts, &ts2);
                  if (ts2.tv_sec < 0 || (ts2.tv_sec == 0 && ts2.tv_nsec <= 0)) {
                          error = ETIMEDOUT;
                          break;
                  }
                  TIMESPEC_TO_TIMEVAL(&tv, &ts2);
                  error = _mqueue_send(mq, msg, tvtohz(&tv));
                  if (error != ETIMEDOUT)
                          break;
          }
          if (error == 0)
                  return (0);
  bad:
          mqueue_freemsg(msg);
          return (error);
  }
  
  /*
   * Common routine to send a message
   */
  static int
  _mqueue_send(struct mqueue *mq, struct mqueue_msg *msg, int timo)
  {       
          struct mqueue_msg *msg2;
          int error = 0;
  
          mtx_lock(&mq->mq_mutex);
          while (mq->mq_curmsgs >= mq->mq_maxmsg && error == 0) {
                  if (timo < 0) {
                          mtx_unlock(&mq->mq_mutex);
                          return (EAGAIN);
                  }
                  mq->mq_senders++;
                  error = msleep(&mq->mq_senders, &mq->mq_mutex,
                              PCATCH, "mqsend", timo);
                  mq->mq_senders--;
                  if (error == EAGAIN)
                          error = ETIMEDOUT;
          }
          if (mq->mq_curmsgs >= mq->mq_maxmsg) {
                  mtx_unlock(&mq->mq_mutex);
                  return (error);
          }
          error = 0;
          if (TAILQ_EMPTY(&mq->mq_msgq)) {
                  TAILQ_INSERT_HEAD(&mq->mq_msgq, msg, msg_link);
          } else {
                  if (msg->msg_prio <= TAILQ_LAST(&mq->mq_msgq, msgq)->msg_prio) {
                          TAILQ_INSERT_TAIL(&mq->mq_msgq, msg, msg_link);
                  } else {
                          TAILQ_FOREACH(msg2, &mq->mq_msgq, msg_link) {
                                  if (msg2->msg_prio < msg->msg_prio)
                                          break;
                          }
                          TAILQ_INSERT_BEFORE(msg2, msg, msg_link);
                  }
          }
          mq->mq_curmsgs++;
          mq->mq_totalbytes += msg->msg_size;
          if (mq->mq_receivers)
                  wakeup_one(&mq->mq_receivers);
          else if (mq->mq_notifier != NULL)
                  mqueue_send_notification(mq);
          if (mq->mq_flags & MQ_RSEL) {
                  mq->mq_flags &= ~MQ_RSEL;
                  selwakeup(&mq->mq_rsel);
          }
          KNOTE_LOCKED(&mq->mq_rsel.si_note, 0);
          mtx_unlock(&mq->mq_mutex);
          return (0);
  }
  
  /*
   * Send realtime a signal to process which registered itself
   * successfully by mq_notify.
   */
  static void
  mqueue_send_notification(struct mqueue *mq)
  {
          struct mqueue_notifier *nt;
          struct thread *td;
          struct proc *p;
          int error;
  
          mtx_assert(&mq->mq_mutex, MA_OWNED);
          nt = mq->mq_notifier;
          if (nt->nt_sigev.sigev_notify != SIGEV_NONE) {
                  p = nt->nt_proc;
                  error = sigev_findtd(p, &nt->nt_sigev, &td);
                  if (error) {
                          mq->mq_notifier = NULL;
                          return;
                  }
                  if (!KSI_ONQ(&nt->nt_ksi)) {
                          ksiginfo_set_sigev(&nt->nt_ksi, &nt->nt_sigev);
                          tdsendsignal(p, td, nt->nt_ksi.ksi_signo, &nt->nt_ksi);
                  }
                  PROC_UNLOCK(p);
          }
          mq->mq_notifier = NULL;
  }
  
  /*
   * Get a message. if waitok is false, thread will not be
   * blocked if there is no data in queue, otherwise, absolute
   * time will be checked.
   */
  int
  mqueue_receive(struct mqueue *mq, char *msg_ptr,
          size_t msg_len, unsigned *msg_prio, int waitok,
          const struct timespec *abs_timeout)
  {
          struct mqueue_msg *msg;
          struct timespec ts, ts2;
          struct timeval tv;
          int error;
  
          if (msg_len < mq->mq_msgsize)
                  return (EMSGSIZE);
  
          /* O_NONBLOCK case */
          if (!waitok) {
                  error = _mqueue_recv(mq, &msg, -1);
                  if (error)
                          return (error);
                  goto received;
          }
  
          /* we allow a null timeout (wait forever). */
          if (abs_timeout == NULL) {
                  error = _mqueue_recv(mq, &msg, 0);
                  if (error)
                          return (error);
                  goto received;
          }
  
          /* try to get a message before checking time */
          error = _mqueue_recv(mq, &msg, -1);
          if (error == 0)
                  goto received;
  
          if (error != EAGAIN)
                  return (error);
  
          if (abs_timeout->tv_nsec >= 1000000000 || abs_timeout->tv_nsec < 0) {
                  error = EINVAL;
                  return (error);
          }
  
          for (;;) {
                  getnanotime(&ts);
                  timespecsub(abs_timeout, &ts, &ts2);
                  if (ts2.tv_sec < 0 || (ts2.tv_sec == 0 && ts2.tv_nsec <= 0)) {
                          error = ETIMEDOUT;
                          return (error);
                  }
                  TIMESPEC_TO_TIMEVAL(&tv, &ts2);
                  error = _mqueue_recv(mq, &msg, tvtohz(&tv));
                  if (error == 0)
                          break;
                  if (error != ETIMEDOUT)
                          return (error);
          }
  
  received:
          error = mqueue_savemsg(msg, msg_ptr, msg_prio);
          if (error == 0) {
                  curthread->td_retval[0] = msg->msg_size;
                  curthread->td_retval[1] = 0;
          }
          mqueue_freemsg(msg);
          return (error);
  }
  
  /*
   * Common routine to receive a message
   */
  static int
  _mqueue_recv(struct mqueue *mq, struct mqueue_msg **msg, int timo)
  {       
          int error = 0;
  
          mtx_lock(&mq->mq_mutex);
          while ((*msg = TAILQ_FIRST(&mq->mq_msgq)) == NULL && error == 0) {
                  if (timo < 0) {
                          mtx_unlock(&mq->mq_mutex);
                          return (EAGAIN);
                  }
                  mq->mq_receivers++;
                  error = msleep(&mq->mq_receivers, &mq->mq_mutex,
                              PCATCH, "mqrecv", timo);
                  mq->mq_receivers--;
                  if (error == EAGAIN)
                          error = ETIMEDOUT;
          }
          if (*msg != NULL) {
                  error = 0;
                  TAILQ_REMOVE(&mq->mq_msgq, *msg, msg_link);
                  mq->mq_curmsgs--;
                  mq->mq_totalbytes -= (*msg)->msg_size;
                  if (mq->mq_senders)
                          wakeup_one(&mq->mq_senders);
                  if (mq->mq_flags & MQ_WSEL) {
                          mq->mq_flags &= ~MQ_WSEL;
                          selwakeup(&mq->mq_wsel);
                  }
                  KNOTE_LOCKED(&mq->mq_wsel.si_note, 0);
          }
          if (mq->mq_notifier != NULL && mq->mq_receivers == 0 &&
              !TAILQ_EMPTY(&mq->mq_msgq)) {
                  mqueue_send_notification(mq);
          }
          mtx_unlock(&mq->mq_mutex);
          return (error);
  }
  
  static __inline struct mqueue_notifier *
  notifier_alloc(void)
  {
          return (uma_zalloc(mqnoti_zone, M_WAITOK | M_ZERO));
  }
  
  static __inline void
  notifier_free(struct mqueue_notifier *p)
  {
          uma_zfree(mqnoti_zone, p);
  }
  
  static struct mqueue_notifier *
  notifier_search(struct proc *p, int fd)
  {
          struct mqueue_notifier *nt;
  
          LIST_FOREACH(nt, &p->p_mqnotifier, nt_link) {
                  if (nt->nt_ksi.ksi_mqd == fd)
                          break;
          }
          return (nt);
  }
  
  static __inline void
  notifier_insert(struct proc *p, struct mqueue_notifier *nt)
  {
          LIST_INSERT_HEAD(&p->p_mqnotifier, nt, nt_link);
  }
  
  static __inline void
  notifier_delete(struct proc *p, struct mqueue_notifier *nt)
  {
          LIST_REMOVE(nt, nt_link);
          notifier_free(nt);
  }
  
  static void
  notifier_remove(struct proc *p, struct mqueue *mq, int fd)
  {
          struct mqueue_notifier *nt;
  
          mtx_assert(&mq->mq_mutex, MA_OWNED);
          PROC_LOCK(p);
          nt = notifier_search(p, fd);
          if (nt != NULL) {
                  if (mq->mq_notifier == nt)
                          mq->mq_notifier = NULL;
                  sigqueue_take(&nt->nt_ksi);
                  notifier_delete(p, nt);
          }
          PROC_UNLOCK(p);
  }
  
  static int
  kern_kmq_open(struct thread *td, const char *upath, int flags, mode_t mode,
      const struct mq_attr *attr)
  {
          char path[MQFS_NAMELEN + 1];
          struct mqfs_node *pn;
          struct pwddesc *pdp;
          struct file *fp;
          struct mqueue *mq;
          int fd, error, len, cmode;
  
          AUDIT_ARG_FFLAGS(flags);
          AUDIT_ARG_MODE(mode);
  
          pdp = td->td_proc->p_pd;
          cmode = (((mode & ~pdp->pd_cmask) & ALLPERMS) & ~S_ISTXT);
          mq = NULL;
          if ((flags & O_CREAT) != 0 && attr != NULL) {
                  if (attr->mq_maxmsg <= 0 || attr->mq_maxmsg > maxmsg)
                          return (EINVAL);
                  if (attr->mq_msgsize <= 0 || attr->mq_msgsize > maxmsgsize)
                          return (EINVAL);
          }
  
          error = copyinstr(upath, path, MQFS_NAMELEN + 1, NULL);
          if (error)
                  return (error);
  
          /*
           * The first character of name must be a slash  (/) character
           * and the remaining characters of name cannot include any slash
           * characters. 
           */
          len = strlen(path);
          if (len < 2 || path[0] != '/' || strchr(path + 1, '/') != NULL)
                  return (EINVAL);
          /*
           * "." and ".." are magic directories, populated on the fly, and cannot
           * be opened as queues.
           */
          if (strcmp(path, "/.") == 0 || strcmp(path, "/..") == 0)
                  return (EINVAL);
          AUDIT_ARG_UPATH1_CANON(path);
  
          error = falloc(td, &fp, &fd, O_CLOEXEC);
          if (error)
                  return (error);
  
          sx_xlock(&mqfs_data.mi_lock);
          pn = mqfs_search(mqfs_data.mi_root, path + 1, len - 1, td->td_ucred);
          if (pn == NULL) {
                  if (!(flags & O_CREAT)) {
                          error = ENOENT;
                  } else {
                          mq = mqueue_alloc(attr);
                          if (mq == NULL) {
                                  error = ENFILE;
                          } else {
                                  pn = mqfs_create_file(mqfs_data.mi_root,
                                           path + 1, len - 1, td->td_ucred,
                                           cmode);
                                  if (pn == NULL) {
                                          error = ENOSPC;
                                          mqueue_free(mq);
                                  }
                          }
                  }
  
                  if (error == 0) {
                          pn->mn_data = mq;
                  }
          } else {
                  if ((flags & (O_CREAT | O_EXCL)) == (O_CREAT | O_EXCL)) {
                          error = EEXIST;
                  } else {
                          accmode_t accmode = 0;
  
                          if (flags & FREAD)
                                  accmode |= VREAD;
                          if (flags & FWRITE)
                                  accmode |= VWRITE;
                          error = vaccess(VREG, pn->mn_mode, pn->mn_uid,
                              pn->mn_gid, accmode, td->td_ucred);
                  }
          }
  
          if (error) {
                  sx_xunlock(&mqfs_data.mi_lock);
                  fdclose(td, fp, fd);
                  fdrop(fp, td);
                  return (error);
          }
  
          mqnode_addref(pn);
          sx_xunlock(&mqfs_data.mi_lock);
  
          finit(fp, flags & (FREAD | FWRITE | O_NONBLOCK), DTYPE_MQUEUE, pn,
              &mqueueops);
  
          td->td_retval[0] = fd;
          fdrop(fp, td);
          return (0);
  }
  
  /*
   * Syscall to open a message queue.
   */
  int
  sys_kmq_open(struct thread *td, struct kmq_open_args *uap)
  {
          struct mq_attr attr;
          int flags, error;
  
          if ((uap->flags & O_ACCMODE) == O_ACCMODE || uap->flags & O_EXEC)
                  return (EINVAL);
          flags = FFLAGS(uap->flags);
          if ((flags & O_CREAT) != 0 && uap->attr != NULL) {
                  error = copyin(uap->attr, &attr, sizeof(attr));
                  if (error)
                          return (error);
          }
          return (kern_kmq_open(td, uap->path, flags, uap->mode,
              uap->attr != NULL ? &attr : NULL));
  }
  
  /*
   * Syscall to unlink a message queue.
   */
  int
  sys_kmq_unlink(struct thread *td, struct kmq_unlink_args *uap)
  {
          char path[MQFS_NAMELEN+1];
          struct mqfs_node *pn;
          int error, len;
  
          error = copyinstr(uap->path, path, MQFS_NAMELEN + 1, NULL);
          if (error)
                  return (error);
  
          len = strlen(path);
          if (len < 2 || path[0] != '/' || strchr(path + 1, '/') != NULL)
                  return (EINVAL);
          if (strcmp(path, "/.") == 0 || strcmp(path, "/..") == 0)
                  return (EINVAL);
          AUDIT_ARG_UPATH1_CANON(path);
  
          sx_xlock(&mqfs_data.mi_lock);
          pn = mqfs_search(mqfs_data.mi_root, path + 1, len - 1, td->td_ucred);
          if (pn != NULL)
                  error = do_unlink(pn, td->td_ucred);
          else
                  error = ENOENT;
          sx_xunlock(&mqfs_data.mi_lock);
          return (error);
  }
  
  typedef int (*_fgetf)(struct thread *, int, cap_rights_t *, struct file **);
  
  /*
   * Get message queue by giving file slot
   */
  static int
  _getmq(struct thread *td, int fd, cap_rights_t *rightsp, _fgetf func,
         struct file **fpp, struct mqfs_node **ppn, struct mqueue **pmq)
  {
          struct mqfs_node *pn;
          int error;
  
          error = func(td, fd, rightsp, fpp);
          if (error)
                  return (error);
          if (&mqueueops != (*fpp)->f_ops) {
                  fdrop(*fpp, td);
                  return (EBADF);
          }
          pn = (*fpp)->f_data;
          if (ppn)
                  *ppn = pn;
          if (pmq)
                  *pmq = pn->mn_data;
          return (0);
  }
  
  static __inline int
  getmq(struct thread *td, int fd, struct file **fpp, struct mqfs_node **ppn,
          struct mqueue **pmq)
  {
  
          return _getmq(td, fd, &cap_event_rights, fget,
              fpp, ppn, pmq);
  }
  
  static __inline int
  getmq_read(struct thread *td, int fd, struct file **fpp,
           struct mqfs_node **ppn, struct mqueue **pmq)
  {
  
          return _getmq(td, fd, &cap_read_rights, fget_read,
              fpp, ppn, pmq);
  }
  
  static __inline int
  getmq_write(struct thread *td, int fd, struct file **fpp,
          struct mqfs_node **ppn, struct mqueue **pmq)
  {
  
          return _getmq(td, fd, &cap_write_rights, fget_write,
              fpp, ppn, pmq);
  }
  
  static int
  kern_kmq_setattr(struct thread *td, int mqd, const struct mq_attr *attr,
      struct mq_attr *oattr)
  {
          struct mqueue *mq;
          struct file *fp;
          u_int oflag, flag;
          int error;
  
          AUDIT_ARG_FD(mqd);
          if (attr != NULL && (attr->mq_flags & ~O_NONBLOCK) != 0)
                  return (EINVAL);
          error = getmq(td, mqd, &fp, NULL, &mq);
          if (error)
                  return (error);
          oattr->mq_maxmsg  = mq->mq_maxmsg;
          oattr->mq_msgsize = mq->mq_msgsize;
          oattr->mq_curmsgs = mq->mq_curmsgs;
          if (attr != NULL) {
                  do {
                          oflag = flag = fp->f_flag;
                          flag &= ~O_NONBLOCK;
                          flag |= (attr->mq_flags & O_NONBLOCK);
                  } while (atomic_cmpset_int(&fp->f_flag, oflag, flag) == 0);
          } else
                  oflag = fp->f_flag;
          oattr->mq_flags = (O_NONBLOCK & oflag);
          fdrop(fp, td);
          return (error);
  }
  
  int
  sys_kmq_setattr(struct thread *td, struct kmq_setattr_args *uap)
  {
          struct mq_attr attr, oattr;
          int error;
  
          if (uap->attr != NULL) {
                  error = copyin(uap->attr, &attr, sizeof(attr));
                  if (error != 0)
                          return (error);
          }
          error = kern_kmq_setattr(td, uap->mqd, uap->attr != NULL ? &attr : NULL,
              &oattr);
          if (error == 0 && uap->oattr != NULL) {
                  bzero(oattr.__reserved, sizeof(oattr.__reserved));
                  error = copyout(&oattr, uap->oattr, sizeof(oattr));
          }
          return (error);
  }
  
  int
  sys_kmq_timedreceive(struct thread *td, struct kmq_timedreceive_args *uap)
  {
          struct mqueue *mq;
          struct file *fp;
          struct timespec *abs_timeout, ets;
          int error;
          int waitok;
  
          AUDIT_ARG_FD(uap->mqd);
          error = getmq_read(td, uap->mqd, &fp, NULL, &mq);
          if (error)
                  return (error);
          if (uap->abs_timeout != NULL) {
                  error = copyin(uap->abs_timeout, &ets, sizeof(ets));
                  if (error != 0)
                          goto out;
                  abs_timeout = &ets;
          } else
                  abs_timeout = NULL;
          waitok = !(fp->f_flag & O_NONBLOCK);
          error = mqueue_receive(mq, uap->msg_ptr, uap->msg_len,
                  uap->msg_prio, waitok, abs_timeout);
  out:
          fdrop(fp, td);
          return (error);
  }
  
  int
  sys_kmq_timedsend(struct thread *td, struct kmq_timedsend_args *uap)
  {
          struct mqueue *mq;
          struct file *fp;
          struct timespec *abs_timeout, ets;
          int error, waitok;
  
          AUDIT_ARG_FD(uap->mqd);
          error = getmq_write(td, uap->mqd, &fp, NULL, &mq);
          if (error)
                  return (error);
          if (uap->abs_timeout != NULL) {
                  error = copyin(uap->abs_timeout, &ets, sizeof(ets));
                  if (error != 0)
                          goto out;
                  abs_timeout = &ets;
          } else
                  abs_timeout = NULL;
          waitok = !(fp->f_flag & O_NONBLOCK);
          error = mqueue_send(mq, uap->msg_ptr, uap->msg_len,
                  uap->msg_prio, waitok, abs_timeout);
  out:
          fdrop(fp, td);
          return (error);
  }
  
  static int
  kern_kmq_notify(struct thread *td, int mqd, struct sigevent *sigev)
  {
          struct filedesc *fdp;
          struct proc *p;
          struct mqueue *mq;
          struct file *fp, *fp2;
          struct mqueue_notifier *nt, *newnt = NULL;
          int error;
  
          AUDIT_ARG_FD(mqd);
          if (sigev != NULL) {
                  if (sigev->sigev_notify != SIGEV_SIGNAL &&
                      sigev->sigev_notify != SIGEV_THREAD_ID &&
                      sigev->sigev_notify != SIGEV_NONE)
                          return (EINVAL);
                  if ((sigev->sigev_notify == SIGEV_SIGNAL ||
                      sigev->sigev_notify == SIGEV_THREAD_ID) &&
                      !_SIG_VALID(sigev->sigev_signo))
                          return (EINVAL);
          }
          p = td->td_proc;
          fdp = td->td_proc->p_fd;
          error = getmq(td, mqd, &fp, NULL, &mq);
          if (error)
                  return (error);
  again:
          FILEDESC_SLOCK(fdp);
          fp2 = fget_locked(fdp, mqd);
          if (fp2 == NULL) {
                  FILEDESC_SUNLOCK(fdp);
                  error = EBADF;
                  goto out;
          }
  #ifdef CAPABILITIES
          error = cap_check(cap_rights(fdp, mqd), &cap_event_rights);
          if (error) {
                  FILEDESC_SUNLOCK(fdp);
                  goto out;
          }
  #endif
          if (fp2 != fp) {
                  FILEDESC_SUNLOCK(fdp);
                  error = EBADF;
                  goto out;
          }
          mtx_lock(&mq->mq_mutex);
          FILEDESC_SUNLOCK(fdp);
          if (sigev != NULL) {
                  if (mq->mq_notifier != NULL) {
                          error = EBUSY;
                  } else {
                          PROC_LOCK(p);
                          nt = notifier_search(p, mqd);
                          if (nt == NULL) {
                                  if (newnt == NULL) {
                                          PROC_UNLOCK(p);
                                          mtx_unlock(&mq->mq_mutex);
                                          newnt = notifier_alloc();
                                          goto again;
                                  }
                          }
  
                          if (nt != NULL) {
                                  sigqueue_take(&nt->nt_ksi);
                                  if (newnt != NULL) {
                                          notifier_free(newnt);
                                          newnt = NULL;
                                  }
                          } else {
                                  nt = newnt;
                                  newnt = NULL;
                                  ksiginfo_init(&nt->nt_ksi);
                                  nt->nt_ksi.ksi_flags |= KSI_INS | KSI_EXT;
                                  nt->nt_ksi.ksi_code = SI_MESGQ;
                                  nt->nt_proc = p;
                                  nt->nt_ksi.ksi_mqd = mqd;
                                  notifier_insert(p, nt);
                          }
                          nt->nt_sigev = *sigev;
                          mq->mq_notifier = nt;
                          PROC_UNLOCK(p);
                          /*
                           * if there is no receivers and message queue
                           * is not empty, we should send notification
                           * as soon as possible.
                           */
                          if (mq->mq_receivers == 0 &&
                              !TAILQ_EMPTY(&mq->mq_msgq))
                                  mqueue_send_notification(mq);
                  }
          } else {
                  notifier_remove(p, mq, mqd);
          }
          mtx_unlock(&mq->mq_mutex);
  
  out:
          fdrop(fp, td);
          if (newnt != NULL)
                  notifier_free(newnt);
          return (error);
  }
  
  int
  sys_kmq_notify(struct thread *td, struct kmq_notify_args *uap)
  {
          struct sigevent ev, *evp;
          int error;
  
          if (uap->sigev == NULL) {
                  evp = NULL;
          } else {
                  error = copyin(uap->sigev, &ev, sizeof(ev));
                  if (error != 0)
                          return (error);
                  evp = &ev;
          }
          return (kern_kmq_notify(td, uap->mqd, evp));
  }
  
  static void
  mqueue_fdclose(struct thread *td, int fd, struct file *fp)
  {
          struct mqueue *mq;
  #ifdef INVARIANTS
          struct filedesc *fdp;
  
          fdp = td->td_proc->p_fd;
          FILEDESC_LOCK_ASSERT(fdp);
  #endif
  
          if (fp->f_ops == &mqueueops) {
                  mq = FPTOMQ(fp);
                  mtx_lock(&mq->mq_mutex);
                  notifier_remove(td->td_proc, mq, fd);
  
                  /* have to wakeup thread in same process */
                  if (mq->mq_flags & MQ_RSEL) {
                          mq->mq_flags &= ~MQ_RSEL;
                          selwakeup(&mq->mq_rsel);
                  }
                  if (mq->mq_flags & MQ_WSEL) {
                          mq->mq_flags &= ~MQ_WSEL;
                          selwakeup(&mq->mq_wsel);
                  }
                  mtx_unlock(&mq->mq_mutex);
          }
  }
  
  static void
  mq_proc_exit(void *arg __unused, struct proc *p)
  {
          struct filedesc *fdp;
          struct file *fp;
          struct mqueue *mq;
          int i;
  
          fdp = p->p_fd;
          FILEDESC_SLOCK(fdp);
          for (i = 0; i < fdp->fd_nfiles; ++i) {
                  fp = fget_locked(fdp, i);
                  if (fp != NULL && fp->f_ops == &mqueueops) {
                          mq = FPTOMQ(fp);
                          mtx_lock(&mq->mq_mutex);
                          notifier_remove(p, FPTOMQ(fp), i);
                          mtx_unlock(&mq->mq_mutex);
                  }
          }
          FILEDESC_SUNLOCK(fdp);
          KASSERT(LIST_EMPTY(&p->p_mqnotifier), ("mq notifiers left"));
  }
  
  static int
  mqf_poll(struct file *fp, int events, struct ucred *active_cred,
          struct thread *td)
  {
          struct mqueue *mq = FPTOMQ(fp);
          int revents = 0;
  
          mtx_lock(&mq->mq_mutex);
          if (events & (POLLIN | POLLRDNORM)) {
                  if (mq->mq_curmsgs) {
                          revents |= events & (POLLIN | POLLRDNORM);
                  } else {
                          mq->mq_flags |= MQ_RSEL;
                          selrecord(td, &mq->mq_rsel);
                  }
          }
          if (events & POLLOUT) {
                  if (mq->mq_curmsgs < mq->mq_maxmsg)
                          revents |= POLLOUT;
                  else {
                          mq->mq_flags |= MQ_WSEL;
                          selrecord(td, &mq->mq_wsel);
                  }
          }
          mtx_unlock(&mq->mq_mutex);
          return (revents);
  }
  
  static int
  mqf_close(struct file *fp, struct thread *td)
  {
          struct mqfs_node *pn;
  
          fp->f_ops = &badfileops;
          pn = fp->f_data;
          fp->f_data = NULL;
          sx_xlock(&mqfs_data.mi_lock);
          mqnode_release(pn);
          sx_xunlock(&mqfs_data.mi_lock);
          return (0);
  }
  
  static int
  mqf_stat(struct file *fp, struct stat *st, struct ucred *active_cred,
          struct thread *td)
  {
          struct mqfs_node *pn = fp->f_data;
  
          bzero(st, sizeof *st);
          sx_xlock(&mqfs_data.mi_lock);
          st->st_atim = pn->mn_atime;
          st->st_mtim = pn->mn_mtime;
          st->st_ctim = pn->mn_ctime;
          st->st_birthtim = pn->mn_birth;
          st->st_uid = pn->mn_uid;
          st->st_gid = pn->mn_gid;
          st->st_mode = S_IFIFO | pn->mn_mode;
          sx_xunlock(&mqfs_data.mi_lock);
          return (0);
  }
  
  static int
  mqf_chmod(struct file *fp, mode_t mode, struct ucred *active_cred,
      struct thread *td)
  {
          struct mqfs_node *pn;
          int error;
  
          error = 0;
          pn = fp->f_data;
          sx_xlock(&mqfs_data.mi_lock);
          error = vaccess(VREG, pn->mn_mode, pn->mn_uid, pn->mn_gid, VADMIN,
              active_cred);
          if (error != 0)
                  goto out;
          pn->mn_mode = mode & ACCESSPERMS;
  out:
          sx_xunlock(&mqfs_data.mi_lock);
          return (error);
  }
  
  static int
  mqf_chown(struct file *fp, uid_t uid, gid_t gid, struct ucred *active_cred,
      struct thread *td)
  {
          struct mqfs_node *pn;
          int error;
  
          error = 0;
          pn = fp->f_data;
          sx_xlock(&mqfs_data.mi_lock);
          if (uid == (uid_t)-1)
                  uid = pn->mn_uid;
          if (gid == (gid_t)-1)
                  gid = pn->mn_gid;
          if (((uid != pn->mn_uid && uid != active_cred->cr_uid) ||
              (gid != pn->mn_gid && !groupmember(gid, active_cred))) &&
              (error = priv_check_cred(active_cred, PRIV_VFS_CHOWN)))
                  goto out;
          pn->mn_uid = uid;
          pn->mn_gid = gid;
  out:
          sx_xunlock(&mqfs_data.mi_lock);
          return (error);
  }
  
  static int
  mqf_kqfilter(struct file *fp, struct knote *kn)
  {
          struct mqueue *mq = FPTOMQ(fp);
          int error = 0;
  
          if (kn->kn_filter == EVFILT_READ) {
                  kn->kn_fop = &mq_rfiltops;
                  knlist_add(&mq->mq_rsel.si_note, kn, 0);
          } else if (kn->kn_filter == EVFILT_WRITE) {
                  kn->kn_fop = &mq_wfiltops;
                  knlist_add(&mq->mq_wsel.si_note, kn, 0);
          } else
                  error = EINVAL;
          return (error);
  }
  
  static void
  filt_mqdetach(struct knote *kn)
  {
          struct mqueue *mq = FPTOMQ(kn->kn_fp);
  
          if (kn->kn_filter == EVFILT_READ)
                  knlist_remove(&mq->mq_rsel.si_note, kn, 0);
          else if (kn->kn_filter == EVFILT_WRITE)
                  knlist_remove(&mq->mq_wsel.si_note, kn, 0);
          else
                  panic("filt_mqdetach");
  }
  
  static int
  filt_mqread(struct knote *kn, long hint)
  {
          struct mqueue *mq = FPTOMQ(kn->kn_fp);
  
          mtx_assert(&mq->mq_mutex, MA_OWNED);
          return (mq->mq_curmsgs != 0);
  }
  
  static int
  filt_mqwrite(struct knote *kn, long hint)
  {
          struct mqueue *mq = FPTOMQ(kn->kn_fp);
  
          mtx_assert(&mq->mq_mutex, MA_OWNED);
          return (mq->mq_curmsgs < mq->mq_maxmsg);
  }
  
  static int
  mqf_fill_kinfo(struct file *fp, struct kinfo_file *kif, struct filedesc *fdp)
  {
  
          kif->kf_type = KF_TYPE_MQUEUE;
          return (0);
  }
  
  static struct fileops mqueueops = {
          .fo_read                = invfo_rdwr,
          .fo_write               = invfo_rdwr,
          .fo_truncate            = invfo_truncate,
          .fo_ioctl               = invfo_ioctl,
          .fo_poll                = mqf_poll,
          .fo_kqfilter            = mqf_kqfilter,
          .fo_stat                = mqf_stat,
          .fo_close               = mqf_close,
          .fo_chmod               = mqf_chmod,
          .fo_chown               = mqf_chown,
          .fo_sendfile            = invfo_sendfile,
          .fo_fill_kinfo          = mqf_fill_kinfo,
          .fo_flags               = DFLAG_PASSABLE,
  };
  
  static struct vop_vector mqfs_vnodeops = {
          .vop_default            = &default_vnodeops,
          .vop_access             = mqfs_access,
          .vop_cachedlookup       = mqfs_lookup,
          .vop_lookup             = vfs_cache_lookup,
          .vop_reclaim            = mqfs_reclaim,
          .vop_create             = mqfs_create,
          .vop_remove             = mqfs_remove,
          .vop_inactive           = mqfs_inactive,
          .vop_open               = mqfs_open,
          .vop_close              = mqfs_close,
          .vop_getattr            = mqfs_getattr,
          .vop_setattr            = mqfs_setattr,
          .vop_read               = mqfs_read,
          .vop_write              = VOP_EOPNOTSUPP,
          .vop_readdir            = mqfs_readdir,
          .vop_mkdir              = VOP_EOPNOTSUPP,
          .vop_rmdir              = VOP_EOPNOTSUPP
  };
  VFS_VOP_VECTOR_REGISTER(mqfs_vnodeops);
  
  static struct vfsops mqfs_vfsops = {
          .vfs_init               = mqfs_init,
          .vfs_uninit             = mqfs_uninit,
          .vfs_mount              = mqfs_mount,
          .vfs_unmount            = mqfs_unmount,
          .vfs_root               = mqfs_root,
          .vfs_statfs             = mqfs_statfs,
  };
  
  static struct vfsconf mqueuefs_vfsconf = {
          .vfc_version = VFS_VERSION,
          .vfc_name = "mqueuefs",
          .vfc_vfsops = &mqfs_vfsops,
          .vfc_typenum = -1,
          .vfc_flags = VFCF_SYNTHETIC
  };
  
  static struct syscall_helper_data mq_syscalls[] = {
          SYSCALL_INIT_HELPER(kmq_open),
          SYSCALL_INIT_HELPER_F(kmq_setattr, SYF_CAPENABLED),
          SYSCALL_INIT_HELPER_F(kmq_timedsend, SYF_CAPENABLED),
          SYSCALL_INIT_HELPER_F(kmq_timedreceive, SYF_CAPENABLED),
          SYSCALL_INIT_HELPER_F(kmq_notify, SYF_CAPENABLED),
          SYSCALL_INIT_HELPER(kmq_unlink),
          SYSCALL_INIT_LAST
  };
  
  #ifdef COMPAT_FREEBSD32
  #include <compat/freebsd32/freebsd32.h>
  #include <compat/freebsd32/freebsd32_proto.h>
  #include <compat/freebsd32/freebsd32_signal.h>
  #include <compat/freebsd32/freebsd32_syscall.h>
  #include <compat/freebsd32/freebsd32_util.h>
  
  static void
  mq_attr_from32(const struct mq_attr32 *from, struct mq_attr *to)
  {
  
          to->mq_flags = from->mq_flags;
          to->mq_maxmsg = from->mq_maxmsg;
          to->mq_msgsize = from->mq_msgsize;
          to->mq_curmsgs = from->mq_curmsgs;
  }
  
  static void
  mq_attr_to32(const struct mq_attr *from, struct mq_attr32 *to)
  {
  
          to->mq_flags = from->mq_flags;
          to->mq_maxmsg = from->mq_maxmsg;
          to->mq_msgsize = from->mq_msgsize;
          to->mq_curmsgs = from->mq_curmsgs;
  }
  
  int
  freebsd32_kmq_open(struct thread *td, struct freebsd32_kmq_open_args *uap)
  {
          struct mq_attr attr;
          struct mq_attr32 attr32;
          int flags, error;
  
          if ((uap->flags & O_ACCMODE) == O_ACCMODE || uap->flags & O_EXEC)
                  return (EINVAL);
          flags = FFLAGS(uap->flags);
          if ((flags & O_CREAT) != 0 && uap->attr != NULL) {
                  error = copyin(uap->attr, &attr32, sizeof(attr32));
                  if (error)
                          return (error);
                  mq_attr_from32(&attr32, &attr);
          }
          return (kern_kmq_open(td, uap->path, flags, uap->mode,
              uap->attr != NULL ? &attr : NULL));
  }
  
  int
  freebsd32_kmq_setattr(struct thread *td, struct freebsd32_kmq_setattr_args *uap)
  {
          struct mq_attr attr, oattr;
          struct mq_attr32 attr32, oattr32;
          int error;
  
          if (uap->attr != NULL) {
                  error = copyin(uap->attr, &attr32, sizeof(attr32));
                  if (error != 0)
                          return (error);
                  mq_attr_from32(&attr32, &attr);
          }
          error = kern_kmq_setattr(td, uap->mqd, uap->attr != NULL ? &attr : NULL,
              &oattr);
          if (error == 0 && uap->oattr != NULL) {
                  mq_attr_to32(&oattr, &oattr32);
                  bzero(oattr32.__reserved, sizeof(oattr32.__reserved));
                  error = copyout(&oattr32, uap->oattr, sizeof(oattr32));
          }
          return (error);
  }
  
  int
  freebsd32_kmq_timedsend(struct thread *td,
      struct freebsd32_kmq_timedsend_args *uap)
  {
          struct mqueue *mq;
          struct file *fp;
          struct timespec32 ets32;
          struct timespec *abs_timeout, ets;
          int error;
          int waitok;
  
          AUDIT_ARG_FD(uap->mqd);
          error = getmq_write(td, uap->mqd, &fp, NULL, &mq);
          if (error)
                  return (error);
          if (uap->abs_timeout != NULL) {
                  error = copyin(uap->abs_timeout, &ets32, sizeof(ets32));
                  if (error != 0)
                          goto out;
                  CP(ets32, ets, tv_sec);
                  CP(ets32, ets, tv_nsec);
                  abs_timeout = &ets;
          } else
                  abs_timeout = NULL;
          waitok = !(fp->f_flag & O_NONBLOCK);
          error = mqueue_send(mq, uap->msg_ptr, uap->msg_len,
                  uap->msg_prio, waitok, abs_timeout);
  out:
          fdrop(fp, td);
          return (error);
  }
  
  int
  freebsd32_kmq_timedreceive(struct thread *td,
      struct freebsd32_kmq_timedreceive_args *uap)
  {
          struct mqueue *mq;
          struct file *fp;
          struct timespec32 ets32;
          struct timespec *abs_timeout, ets;
          int error, waitok;
  
          AUDIT_ARG_FD(uap->mqd);
          error = getmq_read(td, uap->mqd, &fp, NULL, &mq);
          if (error)
                  return (error);
          if (uap->abs_timeout != NULL) {
                  error = copyin(uap->abs_timeout, &ets32, sizeof(ets32));
                  if (error != 0)
                          goto out;
                  CP(ets32, ets, tv_sec);
                  CP(ets32, ets, tv_nsec);
                  abs_timeout = &ets;
          } else
                  abs_timeout = NULL;
          waitok = !(fp->f_flag & O_NONBLOCK);
          error = mqueue_receive(mq, uap->msg_ptr, uap->msg_len,
                  uap->msg_prio, waitok, abs_timeout);
  out:
          fdrop(fp, td);
          return (error);
  }
  
  int
  freebsd32_kmq_notify(struct thread *td, struct freebsd32_kmq_notify_args *uap)
  {
          struct sigevent ev, *evp;
          struct sigevent32 ev32;
          int error;
  
          if (uap->sigev == NULL) {
                  evp = NULL;
          } else {
                  error = copyin(uap->sigev, &ev32, sizeof(ev32));
                  if (error != 0)
                          return (error);
                  error = convert_sigevent32(&ev32, &ev);
                  if (error != 0)
                          return (error);
                  evp = &ev;
          }
          return (kern_kmq_notify(td, uap->mqd, evp));
  }
  
  static struct syscall_helper_data mq32_syscalls[] = {
          SYSCALL32_INIT_HELPER(freebsd32_kmq_open),
          SYSCALL32_INIT_HELPER_F(freebsd32_kmq_setattr, SYF_CAPENABLED),
          SYSCALL32_INIT_HELPER_F(freebsd32_kmq_timedsend, SYF_CAPENABLED),
          SYSCALL32_INIT_HELPER_F(freebsd32_kmq_timedreceive, SYF_CAPENABLED),
          SYSCALL32_INIT_HELPER_F(freebsd32_kmq_notify, SYF_CAPENABLED),
          SYSCALL32_INIT_HELPER_COMPAT(kmq_unlink),
          SYSCALL_INIT_LAST
  };
  #endif
  
  static int
  mqinit(void)
  {
          int error;
  
          error = syscall_helper_register(mq_syscalls, SY_THR_STATIC_KLD);
          if (error != 0)
                  return (error);
  #ifdef COMPAT_FREEBSD32
          error = syscall32_helper_register(mq32_syscalls, SY_THR_STATIC_KLD);
          if (error != 0)
                  return (error);
  #endif
          return (0);
  }
  
  static int
  mqunload(void)
  {
  
  #ifdef COMPAT_FREEBSD32
          syscall32_helper_unregister(mq32_syscalls);
  #endif
          syscall_helper_unregister(mq_syscalls);
          return (0);
  }
  
  static int
  mq_modload(struct module *module, int cmd, void *arg)
  {
          int error = 0;
  
          error = vfs_modevent(module, cmd, arg);
          if (error != 0)
                  return (error);
  
          switch (cmd) {
          case MOD_LOAD:
                  error = mqinit();
                  if (error != 0)
                          mqunload();
                  break;
          case MOD_UNLOAD:
                  error = mqunload();
                  break;
          default:
                  break;
          }
          return (error);
  }
  
  static moduledata_t mqueuefs_mod = {
          "mqueuefs",
          mq_modload,
          &mqueuefs_vfsconf
  };
  DECLARE_MODULE(mqueuefs, mqueuefs_mod, SI_SUB_VFS, SI_ORDER_MIDDLE);
  MODULE_VERSION(mqueuefs, 1);

Cache object: 3945dd3670c5a8fae9c20f2775e1e801