mqueue.c revision a70ea994a0d83fd0151a070be72b87d014ef0a7e 
1/*
2 * POSIX message queues filesystem for Linux.
3 *
4 * Copyright (C) 2003,2004  Krzysztof Benedyczak    (golbi@mat.uni.torun.pl)
5 *                          Michal Wronski          (Michal.Wronski@motorola.com)
6 *
7 * Spinlocks:               Mohamed Abbas           (abbas.mohamed@intel.com)
8 * Lockless receive & send, fd based notify:
9 * 			    Manfred Spraul	    (manfred@colorfullife.com)
10 *
11 * This file is released under the GPL.
12 */
13
14#include <linux/capability.h>
15#include <linux/init.h>
16#include <linux/pagemap.h>
17#include <linux/file.h>
18#include <linux/mount.h>
19#include <linux/namei.h>
20#include <linux/sysctl.h>
21#include <linux/poll.h>
22#include <linux/mqueue.h>
23#include <linux/msg.h>
24#include <linux/skbuff.h>
25#include <linux/netlink.h>
26#include <linux/syscalls.h>
27#include <linux/signal.h>
28#include <net/sock.h>
29#include "util.h"
30
31#define MQUEUE_MAGIC	0x19800202
32#define DIRENT_SIZE	20
33#define FILENT_SIZE	80
34
35#define SEND		0
36#define RECV		1
37
38#define STATE_NONE	0
39#define STATE_PENDING	1
40#define STATE_READY	2
41
42/* used by sysctl */
43#define FS_MQUEUE 	1
44#define CTL_QUEUESMAX 	2
45#define CTL_MSGMAX 	3
46#define CTL_MSGSIZEMAX 	4
47
48/* default values */
49#define DFLT_QUEUESMAX	256	/* max number of message queues */
50#define DFLT_MSGMAX 	10	/* max number of messages in each queue */
51#define HARD_MSGMAX 	(131072/sizeof(void*))
52#define DFLT_MSGSIZEMAX 8192	/* max message size */
53
54#define NOTIFY_COOKIE_LEN	32
55
56struct ext_wait_queue {		/* queue of sleeping tasks */
57	struct task_struct *task;
58	struct list_head list;
59	struct msg_msg *msg;	/* ptr of loaded message */
60	int state;		/* one of STATE_* values */
61};
62
63struct mqueue_inode_info {
64	spinlock_t lock;
65	struct inode vfs_inode;
66	wait_queue_head_t wait_q;
67
68	struct msg_msg **messages;
69	struct mq_attr attr;
70
71	struct sigevent notify;
72	pid_t notify_owner;
73	struct user_struct *user;	/* user who created, for accounting */
74	struct sock *notify_sock;
75	struct sk_buff *notify_cookie;
76
77	/* for tasks waiting for free space and messages, respectively */
78	struct ext_wait_queue e_wait_q[2];
79
80	unsigned long qsize; /* size of queue in memory (sum of all msgs) */
81};
82
83static struct inode_operations mqueue_dir_inode_operations;
84static struct file_operations mqueue_file_operations;
85static struct super_operations mqueue_super_ops;
86static void remove_notification(struct mqueue_inode_info *info);
87
88static spinlock_t mq_lock;
89static kmem_cache_t *mqueue_inode_cachep;
90static struct vfsmount *mqueue_mnt;
91
92static unsigned int queues_count;
93static unsigned int queues_max 	= DFLT_QUEUESMAX;
94static unsigned int msg_max 	= DFLT_MSGMAX;
95static unsigned int msgsize_max = DFLT_MSGSIZEMAX;
96
97static struct ctl_table_header * mq_sysctl_table;
98
99static inline struct mqueue_inode_info *MQUEUE_I(struct inode *inode)
100{
101	return container_of(inode, struct mqueue_inode_info, vfs_inode);
102}
103
104static struct inode *mqueue_get_inode(struct super_block *sb, int mode,
105							struct mq_attr *attr)
106{
107	struct inode *inode;
108
109	inode = new_inode(sb);
110	if (inode) {
111		inode->i_mode = mode;
112		inode->i_uid = current->fsuid;
113		inode->i_gid = current->fsgid;
114		inode->i_blksize = PAGE_CACHE_SIZE;
115		inode->i_blocks = 0;
116		inode->i_mtime = inode->i_ctime = inode->i_atime =
117				CURRENT_TIME;
118
119		if (S_ISREG(mode)) {
120			struct mqueue_inode_info *info;
121			struct task_struct *p = current;
122			struct user_struct *u = p->user;
123			unsigned long mq_bytes, mq_msg_tblsz;
124
125			inode->i_fop = &mqueue_file_operations;
126			inode->i_size = FILENT_SIZE;
127			/* mqueue specific info */
128			info = MQUEUE_I(inode);
129			spin_lock_init(&info->lock);
130			init_waitqueue_head(&info->wait_q);
131			INIT_LIST_HEAD(&info->e_wait_q[0].list);
132			INIT_LIST_HEAD(&info->e_wait_q[1].list);
133			info->messages = NULL;
134			info->notify_owner = 0;
135			info->qsize = 0;
136			info->user = NULL;	/* set when all is ok */
137			memset(&info->attr, 0, sizeof(info->attr));
138			info->attr.mq_maxmsg = DFLT_MSGMAX;
139			info->attr.mq_msgsize = DFLT_MSGSIZEMAX;
140			if (attr) {
141				info->attr.mq_maxmsg = attr->mq_maxmsg;
142				info->attr.mq_msgsize = attr->mq_msgsize;
143			}
144			mq_msg_tblsz = info->attr.mq_maxmsg * sizeof(struct msg_msg *);
145			mq_bytes = (mq_msg_tblsz +
146				(info->attr.mq_maxmsg * info->attr.mq_msgsize));
147
148			spin_lock(&mq_lock);
149			if (u->mq_bytes + mq_bytes < u->mq_bytes ||
150		 	    u->mq_bytes + mq_bytes >
151			    p->signal->rlim[RLIMIT_MSGQUEUE].rlim_cur) {
152				spin_unlock(&mq_lock);
153				goto out_inode;
154			}
155			u->mq_bytes += mq_bytes;
156			spin_unlock(&mq_lock);
157
158			info->messages = kmalloc(mq_msg_tblsz, GFP_KERNEL);
159			if (!info->messages) {
160				spin_lock(&mq_lock);
161				u->mq_bytes -= mq_bytes;
162				spin_unlock(&mq_lock);
163				goto out_inode;
164			}
165			/* all is ok */
166			info->user = get_uid(u);
167		} else if (S_ISDIR(mode)) {
168			inode->i_nlink++;
169			/* Some things misbehave if size == 0 on a directory */
170			inode->i_size = 2 * DIRENT_SIZE;
171			inode->i_op = &mqueue_dir_inode_operations;
172			inode->i_fop = &simple_dir_operations;
173		}
174	}
175	return inode;
176out_inode:
177	make_bad_inode(inode);
178	iput(inode);
179	return NULL;
180}
181
182static int mqueue_fill_super(struct super_block *sb, void *data, int silent)
183{
184	struct inode *inode;
185
186	sb->s_blocksize = PAGE_CACHE_SIZE;
187	sb->s_blocksize_bits = PAGE_CACHE_SHIFT;
188	sb->s_magic = MQUEUE_MAGIC;
189	sb->s_op = &mqueue_super_ops;
190
191	inode = mqueue_get_inode(sb, S_IFDIR | S_ISVTX | S_IRWXUGO, NULL);
192	if (!inode)
193		return -ENOMEM;
194
195	sb->s_root = d_alloc_root(inode);
196	if (!sb->s_root) {
197		iput(inode);
198		return -ENOMEM;
199	}
200
201	return 0;
202}
203
204static struct super_block *mqueue_get_sb(struct file_system_type *fs_type,
205					 int flags, const char *dev_name,
206					 void *data)
207{
208	return get_sb_single(fs_type, flags, data, mqueue_fill_super);
209}
210
211static void init_once(void *foo, kmem_cache_t * cachep, unsigned long flags)
212{
213	struct mqueue_inode_info *p = (struct mqueue_inode_info *) foo;
214
215	if ((flags & (SLAB_CTOR_VERIFY | SLAB_CTOR_CONSTRUCTOR)) ==
216		SLAB_CTOR_CONSTRUCTOR)
217		inode_init_once(&p->vfs_inode);
218}
219
220static struct inode *mqueue_alloc_inode(struct super_block *sb)
221{
222	struct mqueue_inode_info *ei;
223
224	ei = kmem_cache_alloc(mqueue_inode_cachep, SLAB_KERNEL);
225	if (!ei)
226		return NULL;
227	return &ei->vfs_inode;
228}
229
230static void mqueue_destroy_inode(struct inode *inode)
231{
232	kmem_cache_free(mqueue_inode_cachep, MQUEUE_I(inode));
233}
234
235static void mqueue_delete_inode(struct inode *inode)
236{
237	struct mqueue_inode_info *info;
238	struct user_struct *user;
239	unsigned long mq_bytes;
240	int i;
241
242	if (S_ISDIR(inode->i_mode)) {
243		clear_inode(inode);
244		return;
245	}
246	info = MQUEUE_I(inode);
247	spin_lock(&info->lock);
248	for (i = 0; i < info->attr.mq_curmsgs; i++)
249		free_msg(info->messages[i]);
250	kfree(info->messages);
251	spin_unlock(&info->lock);
252
253	clear_inode(inode);
254
255	mq_bytes = (info->attr.mq_maxmsg * sizeof(struct msg_msg *) +
256		   (info->attr.mq_maxmsg * info->attr.mq_msgsize));
257	user = info->user;
258	if (user) {
259		spin_lock(&mq_lock);
260		user->mq_bytes -= mq_bytes;
261		queues_count--;
262		spin_unlock(&mq_lock);
263		free_uid(user);
264	}
265}
266
267static int mqueue_create(struct inode *dir, struct dentry *dentry,
268				int mode, struct nameidata *nd)
269{
270	struct inode *inode;
271	struct mq_attr *attr = dentry->d_fsdata;
272	int error;
273
274	spin_lock(&mq_lock);
275	if (queues_count >= queues_max && !capable(CAP_SYS_RESOURCE)) {
276		error = -ENOSPC;
277		goto out_lock;
278	}
279	queues_count++;
280	spin_unlock(&mq_lock);
281
282	inode = mqueue_get_inode(dir->i_sb, mode, attr);
283	if (!inode) {
284		error = -ENOMEM;
285		spin_lock(&mq_lock);
286		queues_count--;
287		goto out_lock;
288	}
289
290	dir->i_size += DIRENT_SIZE;
291	dir->i_ctime = dir->i_mtime = dir->i_atime = CURRENT_TIME;
292
293	d_instantiate(dentry, inode);
294	dget(dentry);
295	return 0;
296out_lock:
297	spin_unlock(&mq_lock);
298	return error;
299}
300
301static int mqueue_unlink(struct inode *dir, struct dentry *dentry)
302{
303  	struct inode *inode = dentry->d_inode;
304
305	dir->i_ctime = dir->i_mtime = dir->i_atime = CURRENT_TIME;
306	dir->i_size -= DIRENT_SIZE;
307  	inode->i_nlink--;
308  	dput(dentry);
309  	return 0;
310}
311
312/*
313*	This is routine for system read from queue file.
314*	To avoid mess with doing here some sort of mq_receive we allow
315*	to read only queue size & notification info (the only values
316*	that are interesting from user point of view and aren't accessible
317*	through std routines)
318*/
319static ssize_t mqueue_read_file(struct file *filp, char __user *u_data,
320				size_t count, loff_t * off)
321{
322	struct mqueue_inode_info *info = MQUEUE_I(filp->f_dentry->d_inode);
323	char buffer[FILENT_SIZE];
324	size_t slen;
325	loff_t o;
326
327	if (!count)
328		return 0;
329
330	spin_lock(&info->lock);
331	snprintf(buffer, sizeof(buffer),
332			"QSIZE:%-10lu NOTIFY:%-5d SIGNO:%-5d NOTIFY_PID:%-6d\n",
333			info->qsize,
334			info->notify_owner ? info->notify.sigev_notify : 0,
335			(info->notify_owner &&
336			 info->notify.sigev_notify == SIGEV_SIGNAL) ?
337				info->notify.sigev_signo : 0,
338			info->notify_owner);
339	spin_unlock(&info->lock);
340	buffer[sizeof(buffer)-1] = '\0';
341	slen = strlen(buffer)+1;
342
343	o = *off;
344	if (o > slen)
345		return 0;
346
347	if (o + count > slen)
348		count = slen - o;
349
350	if (copy_to_user(u_data, buffer + o, count))
351		return -EFAULT;
352
353	*off = o + count;
354	filp->f_dentry->d_inode->i_atime = filp->f_dentry->d_inode->i_ctime = CURRENT_TIME;
355	return count;
356}
357
358static int mqueue_flush_file(struct file *filp)
359{
360	struct mqueue_inode_info *info = MQUEUE_I(filp->f_dentry->d_inode);
361
362	spin_lock(&info->lock);
363	if (current->tgid == info->notify_owner)
364		remove_notification(info);
365
366	spin_unlock(&info->lock);
367	return 0;
368}
369
370static unsigned int mqueue_poll_file(struct file *filp, struct poll_table_struct *poll_tab)
371{
372	struct mqueue_inode_info *info = MQUEUE_I(filp->f_dentry->d_inode);
373	int retval = 0;
374
375	poll_wait(filp, &info->wait_q, poll_tab);
376
377	spin_lock(&info->lock);
378	if (info->attr.mq_curmsgs)
379		retval = POLLIN | POLLRDNORM;
380
381	if (info->attr.mq_curmsgs < info->attr.mq_maxmsg)
382		retval |= POLLOUT | POLLWRNORM;
383	spin_unlock(&info->lock);
384
385	return retval;
386}
387
388/* Adds current to info->e_wait_q[sr] before element with smaller prio */
389static void wq_add(struct mqueue_inode_info *info, int sr,
390			struct ext_wait_queue *ewp)
391{
392	struct ext_wait_queue *walk;
393
394	ewp->task = current;
395
396	list_for_each_entry(walk, &info->e_wait_q[sr].list, list) {
397		if (walk->task->static_prio <= current->static_prio) {
398			list_add_tail(&ewp->list, &walk->list);
399			return;
400		}
401	}
402	list_add_tail(&ewp->list, &info->e_wait_q[sr].list);
403}
404
405/*
406 * Puts current task to sleep. Caller must hold queue lock. After return
407 * lock isn't held.
408 * sr: SEND or RECV
409 */
410static int wq_sleep(struct mqueue_inode_info *info, int sr,
411			long timeout, struct ext_wait_queue *ewp)
412{
413	int retval;
414	signed long time;
415
416	wq_add(info, sr, ewp);
417
418	for (;;) {
419		set_current_state(TASK_INTERRUPTIBLE);
420
421		spin_unlock(&info->lock);
422		time = schedule_timeout(timeout);
423
424		while (ewp->state == STATE_PENDING)
425			cpu_relax();
426
427		if (ewp->state == STATE_READY) {
428			retval = 0;
429			goto out;
430		}
431		spin_lock(&info->lock);
432		if (ewp->state == STATE_READY) {
433			retval = 0;
434			goto out_unlock;
435		}
436		if (signal_pending(current)) {
437			retval = -ERESTARTSYS;
438			break;
439		}
440		if (time == 0) {
441			retval = -ETIMEDOUT;
442			break;
443		}
444	}
445	list_del(&ewp->list);
446out_unlock:
447	spin_unlock(&info->lock);
448out:
449	return retval;
450}
451
452/*
453 * Returns waiting task that should be serviced first or NULL if none exists
454 */
455static struct ext_wait_queue *wq_get_first_waiter(
456		struct mqueue_inode_info *info, int sr)
457{
458	struct list_head *ptr;
459
460	ptr = info->e_wait_q[sr].list.prev;
461	if (ptr == &info->e_wait_q[sr].list)
462		return NULL;
463	return list_entry(ptr, struct ext_wait_queue, list);
464}
465
466/* Auxiliary functions to manipulate messages' list */
467static void msg_insert(struct msg_msg *ptr, struct mqueue_inode_info *info)
468{
469	int k;
470
471	k = info->attr.mq_curmsgs - 1;
472	while (k >= 0 && info->messages[k]->m_type >= ptr->m_type) {
473		info->messages[k + 1] = info->messages[k];
474		k--;
475	}
476	info->attr.mq_curmsgs++;
477	info->qsize += ptr->m_ts;
478	info->messages[k + 1] = ptr;
479}
480
481static inline struct msg_msg *msg_get(struct mqueue_inode_info *info)
482{
483	info->qsize -= info->messages[--info->attr.mq_curmsgs]->m_ts;
484	return info->messages[info->attr.mq_curmsgs];
485}
486
487static inline void set_cookie(struct sk_buff *skb, char code)
488{
489	((char*)skb->data)[NOTIFY_COOKIE_LEN-1] = code;
490}
491
492/*
493 * The next function is only to split too long sys_mq_timedsend
494 */
495static void __do_notify(struct mqueue_inode_info *info)
496{
497	/* notification
498	 * invoked when there is registered process and there isn't process
499	 * waiting synchronously for message AND state of queue changed from
500	 * empty to not empty. Here we are sure that no one is waiting
501	 * synchronously. */
502	if (info->notify_owner &&
503	    info->attr.mq_curmsgs == 1) {
504		struct siginfo sig_i;
505		switch (info->notify.sigev_notify) {
506		case SIGEV_NONE:
507			break;
508		case SIGEV_SIGNAL:
509			/* sends signal */
510
511			sig_i.si_signo = info->notify.sigev_signo;
512			sig_i.si_errno = 0;
513			sig_i.si_code = SI_MESGQ;
514			sig_i.si_value = info->notify.sigev_value;
515			sig_i.si_pid = current->tgid;
516			sig_i.si_uid = current->uid;
517
518			kill_proc_info(info->notify.sigev_signo,
519				       &sig_i, info->notify_owner);
520			break;
521		case SIGEV_THREAD:
522			set_cookie(info->notify_cookie, NOTIFY_WOKENUP);
523			netlink_sendskb(info->notify_sock,
524					info->notify_cookie, 0);
525			break;
526		}
527		/* after notification unregisters process */
528		info->notify_owner = 0;
529	}
530	wake_up(&info->wait_q);
531}
532
533static long prepare_timeout(const struct timespec __user *u_arg)
534{
535	struct timespec ts, nowts;
536	long timeout;
537
538	if (u_arg) {
539		if (unlikely(copy_from_user(&ts, u_arg,
540					sizeof(struct timespec))))
541			return -EFAULT;
542
543		if (unlikely(ts.tv_nsec < 0 || ts.tv_sec < 0
544			|| ts.tv_nsec >= NSEC_PER_SEC))
545			return -EINVAL;
546		nowts = CURRENT_TIME;
547		/* first subtract as jiffies can't be too big */
548		ts.tv_sec -= nowts.tv_sec;
549		if (ts.tv_nsec < nowts.tv_nsec) {
550			ts.tv_nsec += NSEC_PER_SEC;
551			ts.tv_sec--;
552		}
553		ts.tv_nsec -= nowts.tv_nsec;
554		if (ts.tv_sec < 0)
555			return 0;
556
557		timeout = timespec_to_jiffies(&ts) + 1;
558	} else
559		return MAX_SCHEDULE_TIMEOUT;
560
561	return timeout;
562}
563
564static void remove_notification(struct mqueue_inode_info *info)
565{
566	if (info->notify_owner != 0 &&
567	    info->notify.sigev_notify == SIGEV_THREAD) {
568		set_cookie(info->notify_cookie, NOTIFY_REMOVED);
569		netlink_sendskb(info->notify_sock, info->notify_cookie, 0);
570	}
571	info->notify_owner = 0;
572}
573
574static int mq_attr_ok(struct mq_attr *attr)
575{
576	if (attr->mq_maxmsg <= 0 || attr->mq_msgsize <= 0)
577		return 0;
578	if (capable(CAP_SYS_RESOURCE)) {
579		if (attr->mq_maxmsg > HARD_MSGMAX)
580			return 0;
581	} else {
582		if (attr->mq_maxmsg > msg_max ||
583				attr->mq_msgsize > msgsize_max)
584			return 0;
585	}
586	/* check for overflow */
587	if (attr->mq_msgsize > ULONG_MAX/attr->mq_maxmsg)
588		return 0;
589	if ((unsigned long)(attr->mq_maxmsg * attr->mq_msgsize) +
590	    (attr->mq_maxmsg * sizeof (struct msg_msg *)) <
591	    (unsigned long)(attr->mq_maxmsg * attr->mq_msgsize))
592		return 0;
593	return 1;
594}
595
596/*
597 * Invoked when creating a new queue via sys_mq_open
598 */
599static struct file *do_create(struct dentry *dir, struct dentry *dentry,
600			int oflag, mode_t mode, struct mq_attr __user *u_attr)
601{
602	struct mq_attr attr;
603	int ret;
604
605	if (u_attr) {
606		ret = -EFAULT;
607		if (copy_from_user(&attr, u_attr, sizeof(attr)))
608			goto out;
609		ret = -EINVAL;
610		if (!mq_attr_ok(&attr))
611			goto out;
612		/* store for use during create */
613		dentry->d_fsdata = &attr;
614	}
615
616	mode &= ~current->fs->umask;
617	ret = vfs_create(dir->d_inode, dentry, mode, NULL);
618	dentry->d_fsdata = NULL;
619	if (ret)
620		goto out;
621
622	return dentry_open(dentry, mqueue_mnt, oflag);
623
624out:
625	dput(dentry);
626	mntput(mqueue_mnt);
627	return ERR_PTR(ret);
628}
629
630/* Opens existing queue */
631static struct file *do_open(struct dentry *dentry, int oflag)
632{
633static int oflag2acc[O_ACCMODE] = { MAY_READ, MAY_WRITE,
634					MAY_READ | MAY_WRITE };
635
636	if ((oflag & O_ACCMODE) == (O_RDWR | O_WRONLY)) {
637		dput(dentry);
638		mntput(mqueue_mnt);
639		return ERR_PTR(-EINVAL);
640	}
641
642	if (permission(dentry->d_inode, oflag2acc[oflag & O_ACCMODE], NULL)) {
643		dput(dentry);
644		mntput(mqueue_mnt);
645		return ERR_PTR(-EACCES);
646	}
647
648	return dentry_open(dentry, mqueue_mnt, oflag);
649}
650
651asmlinkage long sys_mq_open(const char __user *u_name, int oflag, mode_t mode,
652				struct mq_attr __user *u_attr)
653{
654	struct dentry *dentry;
655	struct file *filp;
656	char *name;
657	int fd, error;
658
659	if (IS_ERR(name = getname(u_name)))
660		return PTR_ERR(name);
661
662	fd = get_unused_fd();
663	if (fd < 0)
664		goto out_putname;
665
666	mutex_lock(&mqueue_mnt->mnt_root->d_inode->i_mutex);
667	dentry = lookup_one_len(name, mqueue_mnt->mnt_root, strlen(name));
668	if (IS_ERR(dentry)) {
669		error = PTR_ERR(dentry);
670		goto out_err;
671	}
672	mntget(mqueue_mnt);
673
674	if (oflag & O_CREAT) {
675		if (dentry->d_inode) {	/* entry already exists */
676			error = -EEXIST;
677			if (oflag & O_EXCL)
678				goto out;
679			filp = do_open(dentry, oflag);
680		} else {
681			filp = do_create(mqueue_mnt->mnt_root, dentry,
682						oflag, mode, u_attr);
683		}
684	} else {
685		error = -ENOENT;
686		if (!dentry->d_inode)
687			goto out;
688		filp = do_open(dentry, oflag);
689	}
690
691	if (IS_ERR(filp)) {
692		error = PTR_ERR(filp);
693		goto out_putfd;
694	}
695
696	set_close_on_exec(fd, 1);
697	fd_install(fd, filp);
698	goto out_upsem;
699
700out:
701	dput(dentry);
702	mntput(mqueue_mnt);
703out_putfd:
704	put_unused_fd(fd);
705out_err:
706	fd = error;
707out_upsem:
708	mutex_unlock(&mqueue_mnt->mnt_root->d_inode->i_mutex);
709out_putname:
710	putname(name);
711	return fd;
712}
713
714asmlinkage long sys_mq_unlink(const char __user *u_name)
715{
716	int err;
717	char *name;
718	struct dentry *dentry;
719	struct inode *inode = NULL;
720
721	name = getname(u_name);
722	if (IS_ERR(name))
723		return PTR_ERR(name);
724
725	mutex_lock(&mqueue_mnt->mnt_root->d_inode->i_mutex);
726	dentry = lookup_one_len(name, mqueue_mnt->mnt_root, strlen(name));
727	if (IS_ERR(dentry)) {
728		err = PTR_ERR(dentry);
729		goto out_unlock;
730	}
731
732	if (!dentry->d_inode) {
733		err = -ENOENT;
734		goto out_err;
735	}
736
737	inode = dentry->d_inode;
738	if (inode)
739		atomic_inc(&inode->i_count);
740
741	err = vfs_unlink(dentry->d_parent->d_inode, dentry);
742out_err:
743	dput(dentry);
744
745out_unlock:
746	mutex_unlock(&mqueue_mnt->mnt_root->d_inode->i_mutex);
747	putname(name);
748	if (inode)
749		iput(inode);
750
751	return err;
752}
753
754/* Pipelined send and receive functions.
755 *
756 * If a receiver finds no waiting message, then it registers itself in the
757 * list of waiting receivers. A sender checks that list before adding the new
758 * message into the message array. If there is a waiting receiver, then it
759 * bypasses the message array and directly hands the message over to the
760 * receiver.
761 * The receiver accepts the message and returns without grabbing the queue
762 * spinlock. Therefore an intermediate STATE_PENDING state and memory barriers
763 * are necessary. The same algorithm is used for sysv semaphores, see
764 * ipc/sem.c fore more details.
765 *
766 * The same algorithm is used for senders.
767 */
768
769/* pipelined_send() - send a message directly to the task waiting in
770 * sys_mq_timedreceive() (without inserting message into a queue).
771 */
772static inline void pipelined_send(struct mqueue_inode_info *info,
773				  struct msg_msg *message,
774				  struct ext_wait_queue *receiver)
775{
776	receiver->msg = message;
777	list_del(&receiver->list);
778	receiver->state = STATE_PENDING;
779	wake_up_process(receiver->task);
780	smp_wmb();
781	receiver->state = STATE_READY;
782}
783
784/* pipelined_receive() - if there is task waiting in sys_mq_timedsend()
785 * gets its message and put to the queue (we have one free place for sure). */
786static inline void pipelined_receive(struct mqueue_inode_info *info)
787{
788	struct ext_wait_queue *sender = wq_get_first_waiter(info, SEND);
789
790	if (!sender) {
791		/* for poll */
792		wake_up_interruptible(&info->wait_q);
793		return;
794	}
795	msg_insert(sender->msg, info);
796	list_del(&sender->list);
797	sender->state = STATE_PENDING;
798	wake_up_process(sender->task);
799	smp_wmb();
800	sender->state = STATE_READY;
801}
802
803asmlinkage long sys_mq_timedsend(mqd_t mqdes, const char __user *u_msg_ptr,
804	size_t msg_len, unsigned int msg_prio,
805	const struct timespec __user *u_abs_timeout)
806{
807	struct file *filp;
808	struct inode *inode;
809	struct ext_wait_queue wait;
810	struct ext_wait_queue *receiver;
811	struct msg_msg *msg_ptr;
812	struct mqueue_inode_info *info;
813	long timeout;
814	int ret;
815
816	if (unlikely(msg_prio >= (unsigned long) MQ_PRIO_MAX))
817		return -EINVAL;
818
819	timeout = prepare_timeout(u_abs_timeout);
820
821	ret = -EBADF;
822	filp = fget(mqdes);
823	if (unlikely(!filp))
824		goto out;
825
826	inode = filp->f_dentry->d_inode;
827	if (unlikely(filp->f_op != &mqueue_file_operations))
828		goto out_fput;
829	info = MQUEUE_I(inode);
830
831	if (unlikely(!(filp->f_mode & FMODE_WRITE)))
832		goto out_fput;
833
834	if (unlikely(msg_len > info->attr.mq_msgsize)) {
835		ret = -EMSGSIZE;
836		goto out_fput;
837	}
838
839	/* First try to allocate memory, before doing anything with
840	 * existing queues. */
841	msg_ptr = load_msg(u_msg_ptr, msg_len);
842	if (IS_ERR(msg_ptr)) {
843		ret = PTR_ERR(msg_ptr);
844		goto out_fput;
845	}
846	msg_ptr->m_ts = msg_len;
847	msg_ptr->m_type = msg_prio;
848
849	spin_lock(&info->lock);
850
851	if (info->attr.mq_curmsgs == info->attr.mq_maxmsg) {
852		if (filp->f_flags & O_NONBLOCK) {
853			spin_unlock(&info->lock);
854			ret = -EAGAIN;
855		} else if (unlikely(timeout < 0)) {
856			spin_unlock(&info->lock);
857			ret = timeout;
858		} else {
859			wait.task = current;
860			wait.msg = (void *) msg_ptr;
861			wait.state = STATE_NONE;
862			ret = wq_sleep(info, SEND, timeout, &wait);
863		}
864		if (ret < 0)
865			free_msg(msg_ptr);
866	} else {
867		receiver = wq_get_first_waiter(info, RECV);
868		if (receiver) {
869			pipelined_send(info, msg_ptr, receiver);
870		} else {
871			/* adds message to the queue */
872			msg_insert(msg_ptr, info);
873			__do_notify(info);
874		}
875		inode->i_atime = inode->i_mtime = inode->i_ctime =
876				CURRENT_TIME;
877		spin_unlock(&info->lock);
878		ret = 0;
879	}
880out_fput:
881	fput(filp);
882out:
883	return ret;
884}
885
886asmlinkage ssize_t sys_mq_timedreceive(mqd_t mqdes, char __user *u_msg_ptr,
887	size_t msg_len, unsigned int __user *u_msg_prio,
888	const struct timespec __user *u_abs_timeout)
889{
890	long timeout;
891	ssize_t ret;
892	struct msg_msg *msg_ptr;
893	struct file *filp;
894	struct inode *inode;
895	struct mqueue_inode_info *info;
896	struct ext_wait_queue wait;
897
898	timeout = prepare_timeout(u_abs_timeout);
899
900	ret = -EBADF;
901	filp = fget(mqdes);
902	if (unlikely(!filp))
903		goto out;
904
905	inode = filp->f_dentry->d_inode;
906	if (unlikely(filp->f_op != &mqueue_file_operations))
907		goto out_fput;
908	info = MQUEUE_I(inode);
909
910	if (unlikely(!(filp->f_mode & FMODE_READ)))
911		goto out_fput;
912
913	/* checks if buffer is big enough */
914	if (unlikely(msg_len < info->attr.mq_msgsize)) {
915		ret = -EMSGSIZE;
916		goto out_fput;
917	}
918
919	spin_lock(&info->lock);
920	if (info->attr.mq_curmsgs == 0) {
921		if (filp->f_flags & O_NONBLOCK) {
922			spin_unlock(&info->lock);
923			ret = -EAGAIN;
924			msg_ptr = NULL;
925		} else if (unlikely(timeout < 0)) {
926			spin_unlock(&info->lock);
927			ret = timeout;
928			msg_ptr = NULL;
929		} else {
930			wait.task = current;
931			wait.state = STATE_NONE;
932			ret = wq_sleep(info, RECV, timeout, &wait);
933			msg_ptr = wait.msg;
934		}
935	} else {
936		msg_ptr = msg_get(info);
937
938		inode->i_atime = inode->i_mtime = inode->i_ctime =
939				CURRENT_TIME;
940
941		/* There is now free space in queue. */
942		pipelined_receive(info);
943		spin_unlock(&info->lock);
944		ret = 0;
945	}
946	if (ret == 0) {
947		ret = msg_ptr->m_ts;
948
949		if ((u_msg_prio && put_user(msg_ptr->m_type, u_msg_prio)) ||
950			store_msg(u_msg_ptr, msg_ptr, msg_ptr->m_ts)) {
951			ret = -EFAULT;
952		}
953		free_msg(msg_ptr);
954	}
955out_fput:
956	fput(filp);
957out:
958	return ret;
959}
960
961/*
962 * Notes: the case when user wants us to deregister (with NULL as pointer)
963 * and he isn't currently owner of notification, will be silently discarded.
964 * It isn't explicitly defined in the POSIX.
965 */
966asmlinkage long sys_mq_notify(mqd_t mqdes,
967				const struct sigevent __user *u_notification)
968{
969	int ret;
970	struct file *filp;
971	struct sock *sock;
972	struct inode *inode;
973	struct sigevent notification;
974	struct mqueue_inode_info *info;
975	struct sk_buff *nc;
976
977	nc = NULL;
978	sock = NULL;
979	if (u_notification != NULL) {
980		if (copy_from_user(&notification, u_notification,
981					sizeof(struct sigevent)))
982			return -EFAULT;
983
984		if (unlikely(notification.sigev_notify != SIGEV_NONE &&
985			     notification.sigev_notify != SIGEV_SIGNAL &&
986			     notification.sigev_notify != SIGEV_THREAD))
987			return -EINVAL;
988		if (notification.sigev_notify == SIGEV_SIGNAL &&
989			!valid_signal(notification.sigev_signo)) {
990			return -EINVAL;
991		}
992		if (notification.sigev_notify == SIGEV_THREAD) {
993			/* create the notify skb */
994			nc = alloc_skb(NOTIFY_COOKIE_LEN, GFP_KERNEL);
995			ret = -ENOMEM;
996			if (!nc)
997				goto out;
998			ret = -EFAULT;
999			if (copy_from_user(nc->data,
1000					notification.sigev_value.sival_ptr,
1001					NOTIFY_COOKIE_LEN)) {
1002				goto out;
1003			}
1004
1005			/* TODO: add a header? */
1006			skb_put(nc, NOTIFY_COOKIE_LEN);
1007			/* and attach it to the socket */
1008retry:
1009			filp = fget(notification.sigev_signo);
1010			ret = -EBADF;
1011			if (!filp)
1012				goto out;
1013			sock = netlink_getsockbyfilp(filp);
1014			fput(filp);
1015			if (IS_ERR(sock)) {
1016				ret = PTR_ERR(sock);
1017				sock = NULL;
1018				goto out;
1019			}
1020
1021			ret = netlink_attachskb(sock, nc, 0,
1022					MAX_SCHEDULE_TIMEOUT, NULL);
1023			if (ret == 1)
1024		       		goto retry;
1025			if (ret) {
1026				sock = NULL;
1027				nc = NULL;
1028				goto out;
1029			}
1030		}
1031	}
1032
1033	ret = -EBADF;
1034	filp = fget(mqdes);
1035	if (!filp)
1036		goto out;
1037
1038	inode = filp->f_dentry->d_inode;
1039	if (unlikely(filp->f_op != &mqueue_file_operations))
1040		goto out_fput;
1041	info = MQUEUE_I(inode);
1042
1043	ret = 0;
1044	spin_lock(&info->lock);
1045	if (u_notification == NULL) {
1046		if (info->notify_owner == current->tgid) {
1047			remove_notification(info);
1048			inode->i_atime = inode->i_ctime = CURRENT_TIME;
1049		}
1050	} else if (info->notify_owner != 0) {
1051		ret = -EBUSY;
1052	} else {
1053		switch (notification.sigev_notify) {
1054		case SIGEV_NONE:
1055			info->notify.sigev_notify = SIGEV_NONE;
1056			break;
1057		case SIGEV_THREAD:
1058			info->notify_sock = sock;
1059			info->notify_cookie = nc;
1060			sock = NULL;
1061			nc = NULL;
1062			info->notify.sigev_notify = SIGEV_THREAD;
1063			break;
1064		case SIGEV_SIGNAL:
1065			info->notify.sigev_signo = notification.sigev_signo;
1066			info->notify.sigev_value = notification.sigev_value;
1067			info->notify.sigev_notify = SIGEV_SIGNAL;
1068			break;
1069		}
1070		info->notify_owner = current->tgid;
1071		inode->i_atime = inode->i_ctime = CURRENT_TIME;
1072	}
1073	spin_unlock(&info->lock);
1074out_fput:
1075	fput(filp);
1076out:
1077	if (sock) {
1078		netlink_detachskb(sock, nc);
1079	} else if (nc) {
1080		dev_kfree_skb(nc);
1081	}
1082	return ret;
1083}
1084
1085asmlinkage long sys_mq_getsetattr(mqd_t mqdes,
1086			const struct mq_attr __user *u_mqstat,
1087			struct mq_attr __user *u_omqstat)
1088{
1089	int ret;
1090	struct mq_attr mqstat, omqstat;
1091	struct file *filp;
1092	struct inode *inode;
1093	struct mqueue_inode_info *info;
1094
1095	if (u_mqstat != NULL) {
1096		if (copy_from_user(&mqstat, u_mqstat, sizeof(struct mq_attr)))
1097			return -EFAULT;
1098		if (mqstat.mq_flags & (~O_NONBLOCK))
1099			return -EINVAL;
1100	}
1101
1102	ret = -EBADF;
1103	filp = fget(mqdes);
1104	if (!filp)
1105		goto out;
1106
1107	inode = filp->f_dentry->d_inode;
1108	if (unlikely(filp->f_op != &mqueue_file_operations))
1109		goto out_fput;
1110	info = MQUEUE_I(inode);
1111
1112	spin_lock(&info->lock);
1113
1114	omqstat = info->attr;
1115	omqstat.mq_flags = filp->f_flags & O_NONBLOCK;
1116	if (u_mqstat) {
1117		if (mqstat.mq_flags & O_NONBLOCK)
1118			filp->f_flags |= O_NONBLOCK;
1119		else
1120			filp->f_flags &= ~O_NONBLOCK;
1121
1122		inode->i_atime = inode->i_ctime = CURRENT_TIME;
1123	}
1124
1125	spin_unlock(&info->lock);
1126
1127	ret = 0;
1128	if (u_omqstat != NULL && copy_to_user(u_omqstat, &omqstat,
1129						sizeof(struct mq_attr)))
1130		ret = -EFAULT;
1131
1132out_fput:
1133	fput(filp);
1134out:
1135	return ret;
1136}
1137
1138static struct inode_operations mqueue_dir_inode_operations = {
1139	.lookup = simple_lookup,
1140	.create = mqueue_create,
1141	.unlink = mqueue_unlink,
1142};
1143
1144static struct file_operations mqueue_file_operations = {
1145	.flush = mqueue_flush_file,
1146	.poll = mqueue_poll_file,
1147	.read = mqueue_read_file,
1148};
1149
1150static struct super_operations mqueue_super_ops = {
1151	.alloc_inode = mqueue_alloc_inode,
1152	.destroy_inode = mqueue_destroy_inode,
1153	.statfs = simple_statfs,
1154	.delete_inode = mqueue_delete_inode,
1155	.drop_inode = generic_delete_inode,
1156};
1157
1158static struct file_system_type mqueue_fs_type = {
1159	.name = "mqueue",
1160	.get_sb = mqueue_get_sb,
1161	.kill_sb = kill_litter_super,
1162};
1163
1164static int msg_max_limit_min = DFLT_MSGMAX;
1165static int msg_max_limit_max = HARD_MSGMAX;
1166
1167static int msg_maxsize_limit_min = DFLT_MSGSIZEMAX;
1168static int msg_maxsize_limit_max = INT_MAX;
1169
1170static ctl_table mq_sysctls[] = {
1171	{
1172		.ctl_name	= CTL_QUEUESMAX,
1173		.procname	= "queues_max",
1174		.data		= &queues_max,
1175		.maxlen		= sizeof(int),
1176		.mode		= 0644,
1177		.proc_handler	= &proc_dointvec,
1178	},
1179	{
1180		.ctl_name	= CTL_MSGMAX,
1181		.procname	= "msg_max",
1182		.data		= &msg_max,
1183		.maxlen		= sizeof(int),
1184		.mode		= 0644,
1185		.proc_handler	= &proc_dointvec_minmax,
1186		.extra1		= &msg_max_limit_min,
1187		.extra2		= &msg_max_limit_max,
1188	},
1189	{
1190		.ctl_name	= CTL_MSGSIZEMAX,
1191		.procname	= "msgsize_max",
1192		.data		= &msgsize_max,
1193		.maxlen		= sizeof(int),
1194		.mode		= 0644,
1195		.proc_handler	= &proc_dointvec_minmax,
1196		.extra1		= &msg_maxsize_limit_min,
1197		.extra2		= &msg_maxsize_limit_max,
1198	},
1199	{ .ctl_name = 0 }
1200};
1201
1202static ctl_table mq_sysctl_dir[] = {
1203	{
1204		.ctl_name	= FS_MQUEUE,
1205		.procname	= "mqueue",
1206		.mode		= 0555,
1207		.child		= mq_sysctls,
1208	},
1209	{ .ctl_name = 0 }
1210};
1211
1212static ctl_table mq_sysctl_root[] = {
1213	{
1214		.ctl_name	= CTL_FS,
1215		.procname	= "fs",
1216		.mode		= 0555,
1217		.child		= mq_sysctl_dir,
1218	},
1219	{ .ctl_name = 0 }
1220};
1221
1222static int __init init_mqueue_fs(void)
1223{
1224	int error;
1225
1226	mqueue_inode_cachep = kmem_cache_create("mqueue_inode_cache",
1227				sizeof(struct mqueue_inode_info), 0,
1228				SLAB_HWCACHE_ALIGN, init_once, NULL);
1229	if (mqueue_inode_cachep == NULL)
1230		return -ENOMEM;
1231
1232	/* ignore failues - they are not fatal */
1233	mq_sysctl_table = register_sysctl_table(mq_sysctl_root, 0);
1234
1235	error = register_filesystem(&mqueue_fs_type);
1236	if (error)
1237		goto out_sysctl;
1238
1239	if (IS_ERR(mqueue_mnt = kern_mount(&mqueue_fs_type))) {
1240		error = PTR_ERR(mqueue_mnt);
1241		goto out_filesystem;
1242	}
1243
1244	/* internal initialization - not common for vfs */
1245	queues_count = 0;
1246	spin_lock_init(&mq_lock);
1247
1248	return 0;
1249
1250out_filesystem:
1251	unregister_filesystem(&mqueue_fs_type);
1252out_sysctl:
1253	if (mq_sysctl_table)
1254		unregister_sysctl_table(mq_sysctl_table);
1255	if (kmem_cache_destroy(mqueue_inode_cachep)) {
1256		printk(KERN_INFO
1257			"mqueue_inode_cache: not all structures were freed\n");
1258	}
1259	return error;
1260}
1261
1262__initcall(init_mqueue_fs);
1263