1/*
2 *  fs/eventfd.c
3 *
4 *  Copyright (C) 2007  Davide Libenzi <davidel@xmailserver.org>
5 *
6 */
7
8#include <linux/file.h>
9#include <linux/poll.h>
10#include <linux/init.h>
11#include <linux/fs.h>
12#include <linux/sched.h>
13#include <linux/kernel.h>
14#include <linux/slab.h>
15#include <linux/list.h>
16#include <linux/spinlock.h>
17#include <linux/anon_inodes.h>
18#include <linux/syscalls.h>
19#include <linux/export.h>
20#include <linux/kref.h>
21#include <linux/eventfd.h>
22#include <linux/proc_fs.h>
23#include <linux/seq_file.h>
24
25struct eventfd_ctx {
26	struct kref kref;
27	wait_queue_head_t wqh;
28	/*
29	 * Every time that a write(2) is performed on an eventfd, the
30	 * value of the __u64 being written is added to "count" and a
31	 * wakeup is performed on "wqh". A read(2) will return the "count"
32	 * value to userspace, and will reset "count" to zero. The kernel
33	 * side eventfd_signal() also, adds to the "count" counter and
34	 * issue a wakeup.
35	 */
36	__u64 count;
37	unsigned int flags;
38};
39
40/**
41 * eventfd_signal - Adds @n to the eventfd counter.
42 * @ctx: [in] Pointer to the eventfd context.
43 * @n: [in] Value of the counter to be added to the eventfd internal counter.
44 *          The value cannot be negative.
45 *
46 * This function is supposed to be called by the kernel in paths that do not
47 * allow sleeping. In this function we allow the counter to reach the ULLONG_MAX
48 * value, and we signal this as overflow condition by returining a POLLERR
49 * to poll(2).
50 *
51 * Returns the amount by which the counter was incrememnted.  This will be less
52 * than @n if the counter has overflowed.
53 */
54__u64 eventfd_signal(struct eventfd_ctx *ctx, __u64 n)
55{
56	unsigned long flags;
57
58	spin_lock_irqsave(&ctx->wqh.lock, flags);
59	if (ULLONG_MAX - ctx->count < n)
60		n = ULLONG_MAX - ctx->count;
61	ctx->count += n;
62	if (waitqueue_active(&ctx->wqh))
63		wake_up_locked_poll(&ctx->wqh, POLLIN);
64	spin_unlock_irqrestore(&ctx->wqh.lock, flags);
65
66	return n;
67}
68EXPORT_SYMBOL_GPL(eventfd_signal);
69
70static void eventfd_free_ctx(struct eventfd_ctx *ctx)
71{
72	kfree(ctx);
73}
74
75static void eventfd_free(struct kref *kref)
76{
77	struct eventfd_ctx *ctx = container_of(kref, struct eventfd_ctx, kref);
78
79	eventfd_free_ctx(ctx);
80}
81
82/**
83 * eventfd_ctx_get - Acquires a reference to the internal eventfd context.
84 * @ctx: [in] Pointer to the eventfd context.
85 *
86 * Returns: In case of success, returns a pointer to the eventfd context.
87 */
88struct eventfd_ctx *eventfd_ctx_get(struct eventfd_ctx *ctx)
89{
90	kref_get(&ctx->kref);
91	return ctx;
92}
93EXPORT_SYMBOL_GPL(eventfd_ctx_get);
94
95/**
96 * eventfd_ctx_put - Releases a reference to the internal eventfd context.
97 * @ctx: [in] Pointer to eventfd context.
98 *
99 * The eventfd context reference must have been previously acquired either
100 * with eventfd_ctx_get() or eventfd_ctx_fdget().
101 */
102void eventfd_ctx_put(struct eventfd_ctx *ctx)
103{
104	kref_put(&ctx->kref, eventfd_free);
105}
106EXPORT_SYMBOL_GPL(eventfd_ctx_put);
107
108static int eventfd_release(struct inode *inode, struct file *file)
109{
110	struct eventfd_ctx *ctx = file->private_data;
111
112	wake_up_poll(&ctx->wqh, POLLHUP);
113	eventfd_ctx_put(ctx);
114	return 0;
115}
116
117static unsigned int eventfd_poll(struct file *file, poll_table *wait)
118{
119	struct eventfd_ctx *ctx = file->private_data;
120	unsigned int events = 0;
121	u64 count;
122
123	poll_wait(file, &ctx->wqh, wait);
124	smp_rmb();
125	count = ctx->count;
126
127	if (count > 0)
128		events |= POLLIN;
129	if (count == ULLONG_MAX)
130		events |= POLLERR;
131	if (ULLONG_MAX - 1 > count)
132		events |= POLLOUT;
133
134	return events;
135}
136
137static void eventfd_ctx_do_read(struct eventfd_ctx *ctx, __u64 *cnt)
138{
139	*cnt = (ctx->flags & EFD_SEMAPHORE) ? 1 : ctx->count;
140	ctx->count -= *cnt;
141}
142
143/**
144 * eventfd_ctx_remove_wait_queue - Read the current counter and removes wait queue.
145 * @ctx: [in] Pointer to eventfd context.
146 * @wait: [in] Wait queue to be removed.
147 * @cnt: [out] Pointer to the 64-bit counter value.
148 *
149 * Returns %0 if successful, or the following error codes:
150 *
151 * -EAGAIN      : The operation would have blocked.
152 *
153 * This is used to atomically remove a wait queue entry from the eventfd wait
154 * queue head, and read/reset the counter value.
155 */
156int eventfd_ctx_remove_wait_queue(struct eventfd_ctx *ctx, wait_queue_t *wait,
157				  __u64 *cnt)
158{
159	unsigned long flags;
160
161	spin_lock_irqsave(&ctx->wqh.lock, flags);
162	eventfd_ctx_do_read(ctx, cnt);
163	__remove_wait_queue(&ctx->wqh, wait);
164	if (*cnt != 0 && waitqueue_active(&ctx->wqh))
165		wake_up_locked_poll(&ctx->wqh, POLLOUT);
166	spin_unlock_irqrestore(&ctx->wqh.lock, flags);
167
168	return *cnt != 0 ? 0 : -EAGAIN;
169}
170EXPORT_SYMBOL_GPL(eventfd_ctx_remove_wait_queue);
171
172/**
173 * eventfd_ctx_read - Reads the eventfd counter or wait if it is zero.
174 * @ctx: [in] Pointer to eventfd context.
175 * @no_wait: [in] Different from zero if the operation should not block.
176 * @cnt: [out] Pointer to the 64-bit counter value.
177 *
178 * Returns %0 if successful, or the following error codes:
179 *
180 * -EAGAIN      : The operation would have blocked but @no_wait was non-zero.
181 * -ERESTARTSYS : A signal interrupted the wait operation.
182 *
183 * If @no_wait is zero, the function might sleep until the eventfd internal
184 * counter becomes greater than zero.
185 */
186ssize_t eventfd_ctx_read(struct eventfd_ctx *ctx, int no_wait, __u64 *cnt)
187{
188	ssize_t res;
189	DECLARE_WAITQUEUE(wait, current);
190
191	spin_lock_irq(&ctx->wqh.lock);
192	*cnt = 0;
193	res = -EAGAIN;
194	if (ctx->count > 0)
195		res = 0;
196	else if (!no_wait) {
197		__add_wait_queue(&ctx->wqh, &wait);
198		for (;;) {
199			set_current_state(TASK_INTERRUPTIBLE);
200			if (ctx->count > 0) {
201				res = 0;
202				break;
203			}
204			if (signal_pending(current)) {
205				res = -ERESTARTSYS;
206				break;
207			}
208			spin_unlock_irq(&ctx->wqh.lock);
209			schedule();
210			spin_lock_irq(&ctx->wqh.lock);
211		}
212		__remove_wait_queue(&ctx->wqh, &wait);
213		__set_current_state(TASK_RUNNING);
214	}
215	if (likely(res == 0)) {
216		eventfd_ctx_do_read(ctx, cnt);
217		if (waitqueue_active(&ctx->wqh))
218			wake_up_locked_poll(&ctx->wqh, POLLOUT);
219	}
220	spin_unlock_irq(&ctx->wqh.lock);
221
222	return res;
223}
224EXPORT_SYMBOL_GPL(eventfd_ctx_read);
225
226static ssize_t eventfd_read(struct file *file, char __user *buf, size_t count,
227			    loff_t *ppos)
228{
229	struct eventfd_ctx *ctx = file->private_data;
230	ssize_t res;
231	__u64 cnt;
232
233	if (count < sizeof(cnt))
234		return -EINVAL;
235	res = eventfd_ctx_read(ctx, file->f_flags & O_NONBLOCK, &cnt);
236	if (res < 0)
237		return res;
238
239	return put_user(cnt, (__u64 __user *) buf) ? -EFAULT : sizeof(cnt);
240}
241
242static ssize_t eventfd_write(struct file *file, const char __user *buf, size_t count,
243			     loff_t *ppos)
244{
245	struct eventfd_ctx *ctx = file->private_data;
246	ssize_t res;
247	__u64 ucnt;
248	DECLARE_WAITQUEUE(wait, current);
249
250	if (count < sizeof(ucnt))
251		return -EINVAL;
252	if (copy_from_user(&ucnt, buf, sizeof(ucnt)))
253		return -EFAULT;
254	if (ucnt == ULLONG_MAX)
255		return -EINVAL;
256	spin_lock_irq(&ctx->wqh.lock);
257	res = -EAGAIN;
258	if (ULLONG_MAX - ctx->count > ucnt)
259		res = sizeof(ucnt);
260	else if (!(file->f_flags & O_NONBLOCK)) {
261		__add_wait_queue(&ctx->wqh, &wait);
262		for (res = 0;;) {
263			set_current_state(TASK_INTERRUPTIBLE);
264			if (ULLONG_MAX - ctx->count > ucnt) {
265				res = sizeof(ucnt);
266				break;
267			}
268			if (signal_pending(current)) {
269				res = -ERESTARTSYS;
270				break;
271			}
272			spin_unlock_irq(&ctx->wqh.lock);
273			schedule();
274			spin_lock_irq(&ctx->wqh.lock);
275		}
276		__remove_wait_queue(&ctx->wqh, &wait);
277		__set_current_state(TASK_RUNNING);
278	}
279	if (likely(res > 0)) {
280		ctx->count += ucnt;
281		if (waitqueue_active(&ctx->wqh))
282			wake_up_locked_poll(&ctx->wqh, POLLIN);
283	}
284	spin_unlock_irq(&ctx->wqh.lock);
285
286	return res;
287}
288
289#ifdef CONFIG_PROC_FS
290static void eventfd_show_fdinfo(struct seq_file *m, struct file *f)
291{
292	struct eventfd_ctx *ctx = f->private_data;
293
294	spin_lock_irq(&ctx->wqh.lock);
295	seq_printf(m, "eventfd-count: %16llx\n",
296		   (unsigned long long)ctx->count);
297	spin_unlock_irq(&ctx->wqh.lock);
298}
299#endif
300
301static const struct file_operations eventfd_fops = {
302#ifdef CONFIG_PROC_FS
303	.show_fdinfo	= eventfd_show_fdinfo,
304#endif
305	.release	= eventfd_release,
306	.poll		= eventfd_poll,
307	.read		= eventfd_read,
308	.write		= eventfd_write,
309	.llseek		= noop_llseek,
310};
311
312/**
313 * eventfd_fget - Acquire a reference of an eventfd file descriptor.
314 * @fd: [in] Eventfd file descriptor.
315 *
316 * Returns a pointer to the eventfd file structure in case of success, or the
317 * following error pointer:
318 *
319 * -EBADF    : Invalid @fd file descriptor.
320 * -EINVAL   : The @fd file descriptor is not an eventfd file.
321 */
322struct file *eventfd_fget(int fd)
323{
324	struct file *file;
325
326	file = fget(fd);
327	if (!file)
328		return ERR_PTR(-EBADF);
329	if (file->f_op != &eventfd_fops) {
330		fput(file);
331		return ERR_PTR(-EINVAL);
332	}
333
334	return file;
335}
336EXPORT_SYMBOL_GPL(eventfd_fget);
337
338/**
339 * eventfd_ctx_fdget - Acquires a reference to the internal eventfd context.
340 * @fd: [in] Eventfd file descriptor.
341 *
342 * Returns a pointer to the internal eventfd context, otherwise the error
343 * pointers returned by the following functions:
344 *
345 * eventfd_fget
346 */
347struct eventfd_ctx *eventfd_ctx_fdget(int fd)
348{
349	struct eventfd_ctx *ctx;
350	struct fd f = fdget(fd);
351	if (!f.file)
352		return ERR_PTR(-EBADF);
353	ctx = eventfd_ctx_fileget(f.file);
354	fdput(f);
355	return ctx;
356}
357EXPORT_SYMBOL_GPL(eventfd_ctx_fdget);
358
359/**
360 * eventfd_ctx_fileget - Acquires a reference to the internal eventfd context.
361 * @file: [in] Eventfd file pointer.
362 *
363 * Returns a pointer to the internal eventfd context, otherwise the error
364 * pointer:
365 *
366 * -EINVAL   : The @fd file descriptor is not an eventfd file.
367 */
368struct eventfd_ctx *eventfd_ctx_fileget(struct file *file)
369{
370	if (file->f_op != &eventfd_fops)
371		return ERR_PTR(-EINVAL);
372
373	return eventfd_ctx_get(file->private_data);
374}
375EXPORT_SYMBOL_GPL(eventfd_ctx_fileget);
376
377/**
378 * eventfd_file_create - Creates an eventfd file pointer.
379 * @count: Initial eventfd counter value.
380 * @flags: Flags for the eventfd file.
381 *
382 * This function creates an eventfd file pointer, w/out installing it into
383 * the fd table. This is useful when the eventfd file is used during the
384 * initialization of data structures that require extra setup after the eventfd
385 * creation. So the eventfd creation is split into the file pointer creation
386 * phase, and the file descriptor installation phase.
387 * In this way races with userspace closing the newly installed file descriptor
388 * can be avoided.
389 * Returns an eventfd file pointer, or a proper error pointer.
390 */
391struct file *eventfd_file_create(unsigned int count, int flags)
392{
393	struct file *file;
394	struct eventfd_ctx *ctx;
395
396	/* Check the EFD_* constants for consistency.  */
397	BUILD_BUG_ON(EFD_CLOEXEC != O_CLOEXEC);
398	BUILD_BUG_ON(EFD_NONBLOCK != O_NONBLOCK);
399
400	if (flags & ~EFD_FLAGS_SET)
401		return ERR_PTR(-EINVAL);
402
403	ctx = kmalloc(sizeof(*ctx), GFP_KERNEL);
404	if (!ctx)
405		return ERR_PTR(-ENOMEM);
406
407	kref_init(&ctx->kref);
408	init_waitqueue_head(&ctx->wqh);
409	ctx->count = count;
410	ctx->flags = flags;
411
412	file = anon_inode_getfile("[eventfd]", &eventfd_fops, ctx,
413				  O_RDWR | (flags & EFD_SHARED_FCNTL_FLAGS));
414	if (IS_ERR(file))
415		eventfd_free_ctx(ctx);
416
417	return file;
418}
419
420SYSCALL_DEFINE2(eventfd2, unsigned int, count, int, flags)
421{
422	int fd, error;
423	struct file *file;
424
425	error = get_unused_fd_flags(flags & EFD_SHARED_FCNTL_FLAGS);
426	if (error < 0)
427		return error;
428	fd = error;
429
430	file = eventfd_file_create(count, flags);
431	if (IS_ERR(file)) {
432		error = PTR_ERR(file);
433		goto err_put_unused_fd;
434	}
435	fd_install(fd, file);
436
437	return fd;
438
439err_put_unused_fd:
440	put_unused_fd(fd);
441
442	return error;
443}
444
445SYSCALL_DEFINE1(eventfd, unsigned int, count)
446{
447	return sys_eventfd2(count, 0);
448}
449
450