Commit | Line | Data |
---|---|---|
e1ad7468 DL |
1 | /* |
2 | * fs/eventfd.c | |
3 | * | |
4 | * Copyright (C) 2007 Davide Libenzi <davidel@xmailserver.org> | |
5 | * | |
6 | */ | |
7 | ||
8 | #include <linux/file.h> | |
9 | #include <linux/poll.h> | |
10 | #include <linux/init.h> | |
11 | #include <linux/fs.h> | |
174cd4b1 | 12 | #include <linux/sched/signal.h> |
e1ad7468 | 13 | #include <linux/kernel.h> |
5a0e3ad6 | 14 | #include <linux/slab.h> |
e1ad7468 DL |
15 | #include <linux/list.h> |
16 | #include <linux/spinlock.h> | |
17 | #include <linux/anon_inodes.h> | |
7747cdb2 | 18 | #include <linux/syscalls.h> |
630d9c47 | 19 | #include <linux/export.h> |
13389010 DL |
20 | #include <linux/kref.h> |
21 | #include <linux/eventfd.h> | |
cbac5542 CG |
22 | #include <linux/proc_fs.h> |
23 | #include <linux/seq_file.h> | |
e1ad7468 DL |
24 | |
25 | struct eventfd_ctx { | |
13389010 | 26 | struct kref kref; |
e1ad7468 DL |
27 | wait_queue_head_t wqh; |
28 | /* | |
29 | * Every time that a write(2) is performed on an eventfd, the | |
30 | * value of the __u64 being written is added to "count" and a | |
31 | * wakeup is performed on "wqh". A read(2) will return the "count" | |
32 | * value to userspace, and will reset "count" to zero. The kernel | |
13389010 | 33 | * side eventfd_signal() also, adds to the "count" counter and |
e1ad7468 DL |
34 | * issue a wakeup. |
35 | */ | |
36 | __u64 count; | |
bcd0b235 | 37 | unsigned int flags; |
e1ad7468 DL |
38 | }; |
39 | ||
13389010 DL |
40 | /** |
41 | * eventfd_signal - Adds @n to the eventfd counter. | |
42 | * @ctx: [in] Pointer to the eventfd context. | |
43 | * @n: [in] Value of the counter to be added to the eventfd internal counter. | |
44 | * The value cannot be negative. | |
45 | * | |
46 | * This function is supposed to be called by the kernel in paths that do not | |
47 | * allow sleeping. In this function we allow the counter to reach the ULLONG_MAX | |
20d5a865 | 48 | * value, and we signal this as overflow condition by returning a POLLERR |
13389010 DL |
49 | * to poll(2). |
50 | * | |
20d5a865 | 51 | * Returns the amount by which the counter was incremented. This will be less |
ee62c6b2 | 52 | * than @n if the counter has overflowed. |
e1ad7468 | 53 | */ |
ee62c6b2 | 54 | __u64 eventfd_signal(struct eventfd_ctx *ctx, __u64 n) |
e1ad7468 | 55 | { |
e1ad7468 DL |
56 | unsigned long flags; |
57 | ||
d48eb233 | 58 | spin_lock_irqsave(&ctx->wqh.lock, flags); |
e1ad7468 | 59 | if (ULLONG_MAX - ctx->count < n) |
ee62c6b2 | 60 | n = ULLONG_MAX - ctx->count; |
e1ad7468 DL |
61 | ctx->count += n; |
62 | if (waitqueue_active(&ctx->wqh)) | |
39510888 | 63 | wake_up_locked_poll(&ctx->wqh, POLLIN); |
d48eb233 | 64 | spin_unlock_irqrestore(&ctx->wqh.lock, flags); |
e1ad7468 DL |
65 | |
66 | return n; | |
67 | } | |
5718607b | 68 | EXPORT_SYMBOL_GPL(eventfd_signal); |
e1ad7468 | 69 | |
562787a5 DL |
70 | static void eventfd_free_ctx(struct eventfd_ctx *ctx) |
71 | { | |
72 | kfree(ctx); | |
73 | } | |
74 | ||
13389010 DL |
75 | static void eventfd_free(struct kref *kref) |
76 | { | |
77 | struct eventfd_ctx *ctx = container_of(kref, struct eventfd_ctx, kref); | |
78 | ||
562787a5 | 79 | eventfd_free_ctx(ctx); |
13389010 DL |
80 | } |
81 | ||
82 | /** | |
83 | * eventfd_ctx_get - Acquires a reference to the internal eventfd context. | |
84 | * @ctx: [in] Pointer to the eventfd context. | |
85 | * | |
86 | * Returns: In case of success, returns a pointer to the eventfd context. | |
87 | */ | |
88 | struct eventfd_ctx *eventfd_ctx_get(struct eventfd_ctx *ctx) | |
89 | { | |
90 | kref_get(&ctx->kref); | |
91 | return ctx; | |
92 | } | |
93 | EXPORT_SYMBOL_GPL(eventfd_ctx_get); | |
94 | ||
95 | /** | |
96 | * eventfd_ctx_put - Releases a reference to the internal eventfd context. | |
97 | * @ctx: [in] Pointer to eventfd context. | |
98 | * | |
99 | * The eventfd context reference must have been previously acquired either | |
36182185 | 100 | * with eventfd_ctx_get() or eventfd_ctx_fdget(). |
13389010 DL |
101 | */ |
102 | void eventfd_ctx_put(struct eventfd_ctx *ctx) | |
103 | { | |
104 | kref_put(&ctx->kref, eventfd_free); | |
105 | } | |
106 | EXPORT_SYMBOL_GPL(eventfd_ctx_put); | |
107 | ||
e1ad7468 DL |
108 | static int eventfd_release(struct inode *inode, struct file *file) |
109 | { | |
13389010 DL |
110 | struct eventfd_ctx *ctx = file->private_data; |
111 | ||
112 | wake_up_poll(&ctx->wqh, POLLHUP); | |
113 | eventfd_ctx_put(ctx); | |
e1ad7468 DL |
114 | return 0; |
115 | } | |
116 | ||
117 | static unsigned int eventfd_poll(struct file *file, poll_table *wait) | |
118 | { | |
119 | struct eventfd_ctx *ctx = file->private_data; | |
120 | unsigned int events = 0; | |
e22553e2 | 121 | u64 count; |
e1ad7468 DL |
122 | |
123 | poll_wait(file, &ctx->wqh, wait); | |
a484c3dd PB |
124 | |
125 | /* | |
126 | * All writes to ctx->count occur within ctx->wqh.lock. This read | |
127 | * can be done outside ctx->wqh.lock because we know that poll_wait | |
128 | * takes that lock (through add_wait_queue) if our caller will sleep. | |
129 | * | |
130 | * The read _can_ therefore seep into add_wait_queue's critical | |
131 | * section, but cannot move above it! add_wait_queue's spin_lock acts | |
132 | * as an acquire barrier and ensures that the read be ordered properly | |
133 | * against the writes. The following CAN happen and is safe: | |
134 | * | |
135 | * poll write | |
136 | * ----------------- ------------ | |
137 | * lock ctx->wqh.lock (in poll_wait) | |
138 | * count = ctx->count | |
139 | * __add_wait_queue | |
140 | * unlock ctx->wqh.lock | |
141 | * lock ctx->qwh.lock | |
142 | * ctx->count += n | |
143 | * if (waitqueue_active) | |
144 | * wake_up_locked_poll | |
145 | * unlock ctx->qwh.lock | |
146 | * eventfd_poll returns 0 | |
147 | * | |
148 | * but the following, which would miss a wakeup, cannot happen: | |
149 | * | |
150 | * poll write | |
151 | * ----------------- ------------ | |
152 | * count = ctx->count (INVALID!) | |
153 | * lock ctx->qwh.lock | |
154 | * ctx->count += n | |
155 | * **waitqueue_active is false** | |
156 | * **no wake_up_locked_poll!** | |
157 | * unlock ctx->qwh.lock | |
158 | * lock ctx->wqh.lock (in poll_wait) | |
159 | * __add_wait_queue | |
160 | * unlock ctx->wqh.lock | |
161 | * eventfd_poll returns 0 | |
162 | */ | |
163 | count = READ_ONCE(ctx->count); | |
e1ad7468 | 164 | |
e22553e2 | 165 | if (count > 0) |
e1ad7468 | 166 | events |= POLLIN; |
e22553e2 | 167 | if (count == ULLONG_MAX) |
e1ad7468 | 168 | events |= POLLERR; |
e22553e2 | 169 | if (ULLONG_MAX - 1 > count) |
e1ad7468 | 170 | events |= POLLOUT; |
e1ad7468 DL |
171 | |
172 | return events; | |
173 | } | |
174 | ||
cb289d62 DL |
175 | static void eventfd_ctx_do_read(struct eventfd_ctx *ctx, __u64 *cnt) |
176 | { | |
177 | *cnt = (ctx->flags & EFD_SEMAPHORE) ? 1 : ctx->count; | |
178 | ctx->count -= *cnt; | |
179 | } | |
180 | ||
181 | /** | |
182 | * eventfd_ctx_remove_wait_queue - Read the current counter and removes wait queue. | |
183 | * @ctx: [in] Pointer to eventfd context. | |
184 | * @wait: [in] Wait queue to be removed. | |
36182185 | 185 | * @cnt: [out] Pointer to the 64-bit counter value. |
cb289d62 | 186 | * |
36182185 | 187 | * Returns %0 if successful, or the following error codes: |
cb289d62 DL |
188 | * |
189 | * -EAGAIN : The operation would have blocked. | |
190 | * | |
191 | * This is used to atomically remove a wait queue entry from the eventfd wait | |
192 | * queue head, and read/reset the counter value. | |
193 | */ | |
ac6424b9 | 194 | int eventfd_ctx_remove_wait_queue(struct eventfd_ctx *ctx, wait_queue_entry_t *wait, |
cb289d62 DL |
195 | __u64 *cnt) |
196 | { | |
197 | unsigned long flags; | |
198 | ||
199 | spin_lock_irqsave(&ctx->wqh.lock, flags); | |
200 | eventfd_ctx_do_read(ctx, cnt); | |
201 | __remove_wait_queue(&ctx->wqh, wait); | |
202 | if (*cnt != 0 && waitqueue_active(&ctx->wqh)) | |
203 | wake_up_locked_poll(&ctx->wqh, POLLOUT); | |
204 | spin_unlock_irqrestore(&ctx->wqh.lock, flags); | |
205 | ||
206 | return *cnt != 0 ? 0 : -EAGAIN; | |
207 | } | |
208 | EXPORT_SYMBOL_GPL(eventfd_ctx_remove_wait_queue); | |
209 | ||
b6364572 EB |
210 | static ssize_t eventfd_read(struct file *file, char __user *buf, size_t count, |
211 | loff_t *ppos) | |
e1ad7468 | 212 | { |
b6364572 | 213 | struct eventfd_ctx *ctx = file->private_data; |
e1ad7468 | 214 | ssize_t res; |
b6364572 | 215 | __u64 ucnt = 0; |
e1ad7468 DL |
216 | DECLARE_WAITQUEUE(wait, current); |
217 | ||
b6364572 EB |
218 | if (count < sizeof(ucnt)) |
219 | return -EINVAL; | |
220 | ||
d48eb233 | 221 | spin_lock_irq(&ctx->wqh.lock); |
e1ad7468 | 222 | res = -EAGAIN; |
bcd0b235 | 223 | if (ctx->count > 0) |
b6364572 EB |
224 | res = sizeof(ucnt); |
225 | else if (!(file->f_flags & O_NONBLOCK)) { | |
e1ad7468 | 226 | __add_wait_queue(&ctx->wqh, &wait); |
cb289d62 | 227 | for (;;) { |
e1ad7468 DL |
228 | set_current_state(TASK_INTERRUPTIBLE); |
229 | if (ctx->count > 0) { | |
b6364572 | 230 | res = sizeof(ucnt); |
e1ad7468 DL |
231 | break; |
232 | } | |
233 | if (signal_pending(current)) { | |
234 | res = -ERESTARTSYS; | |
235 | break; | |
236 | } | |
d48eb233 | 237 | spin_unlock_irq(&ctx->wqh.lock); |
e1ad7468 | 238 | schedule(); |
d48eb233 | 239 | spin_lock_irq(&ctx->wqh.lock); |
e1ad7468 DL |
240 | } |
241 | __remove_wait_queue(&ctx->wqh, &wait); | |
242 | __set_current_state(TASK_RUNNING); | |
243 | } | |
b6364572 EB |
244 | if (likely(res > 0)) { |
245 | eventfd_ctx_do_read(ctx, &ucnt); | |
e1ad7468 | 246 | if (waitqueue_active(&ctx->wqh)) |
39510888 | 247 | wake_up_locked_poll(&ctx->wqh, POLLOUT); |
e1ad7468 | 248 | } |
d48eb233 | 249 | spin_unlock_irq(&ctx->wqh.lock); |
e1ad7468 | 250 | |
b6364572 EB |
251 | if (res > 0 && put_user(ucnt, (__u64 __user *)buf)) |
252 | return -EFAULT; | |
cb289d62 | 253 | |
b6364572 | 254 | return res; |
cb289d62 | 255 | } |
e1ad7468 DL |
256 | |
257 | static ssize_t eventfd_write(struct file *file, const char __user *buf, size_t count, | |
258 | loff_t *ppos) | |
259 | { | |
260 | struct eventfd_ctx *ctx = file->private_data; | |
261 | ssize_t res; | |
262 | __u64 ucnt; | |
263 | DECLARE_WAITQUEUE(wait, current); | |
264 | ||
265 | if (count < sizeof(ucnt)) | |
266 | return -EINVAL; | |
267 | if (copy_from_user(&ucnt, buf, sizeof(ucnt))) | |
268 | return -EFAULT; | |
269 | if (ucnt == ULLONG_MAX) | |
270 | return -EINVAL; | |
d48eb233 | 271 | spin_lock_irq(&ctx->wqh.lock); |
e1ad7468 DL |
272 | res = -EAGAIN; |
273 | if (ULLONG_MAX - ctx->count > ucnt) | |
274 | res = sizeof(ucnt); | |
275 | else if (!(file->f_flags & O_NONBLOCK)) { | |
276 | __add_wait_queue(&ctx->wqh, &wait); | |
277 | for (res = 0;;) { | |
278 | set_current_state(TASK_INTERRUPTIBLE); | |
279 | if (ULLONG_MAX - ctx->count > ucnt) { | |
280 | res = sizeof(ucnt); | |
281 | break; | |
282 | } | |
283 | if (signal_pending(current)) { | |
284 | res = -ERESTARTSYS; | |
285 | break; | |
286 | } | |
d48eb233 | 287 | spin_unlock_irq(&ctx->wqh.lock); |
e1ad7468 | 288 | schedule(); |
d48eb233 | 289 | spin_lock_irq(&ctx->wqh.lock); |
e1ad7468 DL |
290 | } |
291 | __remove_wait_queue(&ctx->wqh, &wait); | |
292 | __set_current_state(TASK_RUNNING); | |
293 | } | |
bcd0b235 | 294 | if (likely(res > 0)) { |
e1ad7468 DL |
295 | ctx->count += ucnt; |
296 | if (waitqueue_active(&ctx->wqh)) | |
39510888 | 297 | wake_up_locked_poll(&ctx->wqh, POLLIN); |
e1ad7468 | 298 | } |
d48eb233 | 299 | spin_unlock_irq(&ctx->wqh.lock); |
e1ad7468 DL |
300 | |
301 | return res; | |
302 | } | |
303 | ||
cbac5542 | 304 | #ifdef CONFIG_PROC_FS |
a3816ab0 | 305 | static void eventfd_show_fdinfo(struct seq_file *m, struct file *f) |
cbac5542 CG |
306 | { |
307 | struct eventfd_ctx *ctx = f->private_data; | |
cbac5542 CG |
308 | |
309 | spin_lock_irq(&ctx->wqh.lock); | |
a3816ab0 JP |
310 | seq_printf(m, "eventfd-count: %16llx\n", |
311 | (unsigned long long)ctx->count); | |
cbac5542 | 312 | spin_unlock_irq(&ctx->wqh.lock); |
cbac5542 CG |
313 | } |
314 | #endif | |
315 | ||
e1ad7468 | 316 | static const struct file_operations eventfd_fops = { |
cbac5542 CG |
317 | #ifdef CONFIG_PROC_FS |
318 | .show_fdinfo = eventfd_show_fdinfo, | |
319 | #endif | |
e1ad7468 DL |
320 | .release = eventfd_release, |
321 | .poll = eventfd_poll, | |
322 | .read = eventfd_read, | |
323 | .write = eventfd_write, | |
6038f373 | 324 | .llseek = noop_llseek, |
e1ad7468 DL |
325 | }; |
326 | ||
13389010 DL |
327 | /** |
328 | * eventfd_fget - Acquire a reference of an eventfd file descriptor. | |
329 | * @fd: [in] Eventfd file descriptor. | |
330 | * | |
331 | * Returns a pointer to the eventfd file structure in case of success, or the | |
332 | * following error pointer: | |
333 | * | |
334 | * -EBADF : Invalid @fd file descriptor. | |
335 | * -EINVAL : The @fd file descriptor is not an eventfd file. | |
336 | */ | |
e1ad7468 DL |
337 | struct file *eventfd_fget(int fd) |
338 | { | |
339 | struct file *file; | |
340 | ||
341 | file = fget(fd); | |
342 | if (!file) | |
343 | return ERR_PTR(-EBADF); | |
344 | if (file->f_op != &eventfd_fops) { | |
345 | fput(file); | |
346 | return ERR_PTR(-EINVAL); | |
347 | } | |
348 | ||
349 | return file; | |
350 | } | |
5718607b | 351 | EXPORT_SYMBOL_GPL(eventfd_fget); |
e1ad7468 | 352 | |
13389010 DL |
353 | /** |
354 | * eventfd_ctx_fdget - Acquires a reference to the internal eventfd context. | |
355 | * @fd: [in] Eventfd file descriptor. | |
356 | * | |
357 | * Returns a pointer to the internal eventfd context, otherwise the error | |
358 | * pointers returned by the following functions: | |
359 | * | |
360 | * eventfd_fget | |
361 | */ | |
362 | struct eventfd_ctx *eventfd_ctx_fdget(int fd) | |
363 | { | |
13389010 | 364 | struct eventfd_ctx *ctx; |
36a74117 AV |
365 | struct fd f = fdget(fd); |
366 | if (!f.file) | |
367 | return ERR_PTR(-EBADF); | |
368 | ctx = eventfd_ctx_fileget(f.file); | |
369 | fdput(f); | |
13389010 DL |
370 | return ctx; |
371 | } | |
372 | EXPORT_SYMBOL_GPL(eventfd_ctx_fdget); | |
373 | ||
374 | /** | |
375 | * eventfd_ctx_fileget - Acquires a reference to the internal eventfd context. | |
376 | * @file: [in] Eventfd file pointer. | |
377 | * | |
378 | * Returns a pointer to the internal eventfd context, otherwise the error | |
379 | * pointer: | |
380 | * | |
381 | * -EINVAL : The @fd file descriptor is not an eventfd file. | |
382 | */ | |
383 | struct eventfd_ctx *eventfd_ctx_fileget(struct file *file) | |
384 | { | |
385 | if (file->f_op != &eventfd_fops) | |
386 | return ERR_PTR(-EINVAL); | |
387 | ||
388 | return eventfd_ctx_get(file->private_data); | |
389 | } | |
390 | EXPORT_SYMBOL_GPL(eventfd_ctx_fileget); | |
391 | ||
7d815165 | 392 | SYSCALL_DEFINE2(eventfd2, unsigned int, count, int, flags) |
e1ad7468 | 393 | { |
e1ad7468 | 394 | struct eventfd_ctx *ctx; |
7d815165 | 395 | int fd; |
e1ad7468 | 396 | |
e38b36f3 UD |
397 | /* Check the EFD_* constants for consistency. */ |
398 | BUILD_BUG_ON(EFD_CLOEXEC != O_CLOEXEC); | |
399 | BUILD_BUG_ON(EFD_NONBLOCK != O_NONBLOCK); | |
400 | ||
bcd0b235 | 401 | if (flags & ~EFD_FLAGS_SET) |
7d815165 | 402 | return -EINVAL; |
b087498e | 403 | |
e1ad7468 DL |
404 | ctx = kmalloc(sizeof(*ctx), GFP_KERNEL); |
405 | if (!ctx) | |
7d815165 | 406 | return -ENOMEM; |
e1ad7468 | 407 | |
13389010 | 408 | kref_init(&ctx->kref); |
e1ad7468 | 409 | init_waitqueue_head(&ctx->wqh); |
e1ad7468 | 410 | ctx->count = count; |
bcd0b235 | 411 | ctx->flags = flags; |
e1ad7468 | 412 | |
7d815165 EB |
413 | fd = anon_inode_getfd("[eventfd]", &eventfd_fops, ctx, |
414 | O_RDWR | (flags & EFD_SHARED_FCNTL_FLAGS)); | |
415 | if (fd < 0) | |
562787a5 DL |
416 | eventfd_free_ctx(ctx); |
417 | ||
2030a42c | 418 | return fd; |
e1ad7468 DL |
419 | } |
420 | ||
d4e82042 | 421 | SYSCALL_DEFINE1(eventfd, unsigned int, count) |
b087498e UD |
422 | { |
423 | return sys_eventfd2(count, 0); | |
424 | } | |
bcd0b235 | 425 |