sys_generic.c revision 257122
1/*-
2 * Copyright (c) 1982, 1986, 1989, 1993
3 *	The Regents of the University of California.  All rights reserved.
4 * (c) UNIX System Laboratories, Inc.
5 * All or some portions of this file are derived from material licensed
6 * to the University of California by American Telephone and Telegraph
7 * Co. or Unix System Laboratories, Inc. and are reproduced herein with
8 * the permission of UNIX System Laboratories, Inc.
9 *
10 * Redistribution and use in source and binary forms, with or without
11 * modification, are permitted provided that the following conditions
12 * are met:
13 * 1. Redistributions of source code must retain the above copyright
14 *    notice, this list of conditions and the following disclaimer.
15 * 2. Redistributions in binary form must reproduce the above copyright
16 *    notice, this list of conditions and the following disclaimer in the
17 *    documentation and/or other materials provided with the distribution.
18 * 4. Neither the name of the University nor the names of its contributors
19 *    may be used to endorse or promote products derived from this software
20 *    without specific prior written permission.
21 *
22 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
23 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
24 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
25 * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
26 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
27 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
28 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
29 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
30 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
31 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
32 * SUCH DAMAGE.
33 *
34 *	@(#)sys_generic.c	8.5 (Berkeley) 1/21/94
35 */
36
37#include <sys/cdefs.h>
38__FBSDID("$FreeBSD: stable/10/sys/kern/sys_generic.c 257122 2013-10-25 16:33:24Z kib $");
39
40#include "opt_capsicum.h"
41#include "opt_compat.h"
42#include "opt_ktrace.h"
43
44#include <sys/param.h>
45#include <sys/systm.h>
46#include <sys/sysproto.h>
47#include <sys/capability.h>
48#include <sys/filedesc.h>
49#include <sys/filio.h>
50#include <sys/fcntl.h>
51#include <sys/file.h>
52#include <sys/lock.h>
53#include <sys/proc.h>
54#include <sys/signalvar.h>
55#include <sys/socketvar.h>
56#include <sys/uio.h>
57#include <sys/kernel.h>
58#include <sys/ktr.h>
59#include <sys/limits.h>
60#include <sys/malloc.h>
61#include <sys/poll.h>
62#include <sys/resourcevar.h>
63#include <sys/selinfo.h>
64#include <sys/sleepqueue.h>
65#include <sys/syscallsubr.h>
66#include <sys/sysctl.h>
67#include <sys/sysent.h>
68#include <sys/vnode.h>
69#include <sys/bio.h>
70#include <sys/buf.h>
71#include <sys/condvar.h>
72#ifdef KTRACE
73#include <sys/ktrace.h>
74#endif
75
76#include <security/audit/audit.h>
77
78int iosize_max_clamp = 1;
79SYSCTL_INT(_debug, OID_AUTO, iosize_max_clamp, CTLFLAG_RW,
80    &iosize_max_clamp, 0, "Clamp max i/o size to INT_MAX");
81int devfs_iosize_max_clamp = 1;
82SYSCTL_INT(_debug, OID_AUTO, devfs_iosize_max_clamp, CTLFLAG_RW,
83    &devfs_iosize_max_clamp, 0, "Clamp max i/o size to INT_MAX for devices");
84
85/*
86 * Assert that the return value of read(2) and write(2) syscalls fits
87 * into a register.  If not, an architecture will need to provide the
88 * usermode wrappers to reconstruct the result.
89 */
90CTASSERT(sizeof(register_t) >= sizeof(size_t));
91
92static MALLOC_DEFINE(M_IOCTLOPS, "ioctlops", "ioctl data buffer");
93static MALLOC_DEFINE(M_SELECT, "select", "select() buffer");
94MALLOC_DEFINE(M_IOV, "iov", "large iov's");
95
96static int	pollout(struct thread *, struct pollfd *, struct pollfd *,
97		    u_int);
98static int	pollscan(struct thread *, struct pollfd *, u_int);
99static int	pollrescan(struct thread *);
100static int	selscan(struct thread *, fd_mask **, fd_mask **, int);
101static int	selrescan(struct thread *, fd_mask **, fd_mask **);
102static void	selfdalloc(struct thread *, void *);
103static void	selfdfree(struct seltd *, struct selfd *);
104static int	dofileread(struct thread *, int, struct file *, struct uio *,
105		    off_t, int);
106static int	dofilewrite(struct thread *, int, struct file *, struct uio *,
107		    off_t, int);
108static void	doselwakeup(struct selinfo *, int);
109static void	seltdinit(struct thread *);
110static int	seltdwait(struct thread *, sbintime_t, sbintime_t);
111static void	seltdclear(struct thread *);
112
113/*
114 * One seltd per-thread allocated on demand as needed.
115 *
116 *	t - protected by st_mtx
117 * 	k - Only accessed by curthread or read-only
118 */
119struct seltd {
120	STAILQ_HEAD(, selfd)	st_selq;	/* (k) List of selfds. */
121	struct selfd		*st_free1;	/* (k) free fd for read set. */
122	struct selfd		*st_free2;	/* (k) free fd for write set. */
123	struct mtx		st_mtx;		/* Protects struct seltd */
124	struct cv		st_wait;	/* (t) Wait channel. */
125	int			st_flags;	/* (t) SELTD_ flags. */
126};
127
128#define	SELTD_PENDING	0x0001			/* We have pending events. */
129#define	SELTD_RESCAN	0x0002			/* Doing a rescan. */
130
131/*
132 * One selfd allocated per-thread per-file-descriptor.
133 *	f - protected by sf_mtx
134 */
135struct selfd {
136	STAILQ_ENTRY(selfd)	sf_link;	/* (k) fds owned by this td. */
137	TAILQ_ENTRY(selfd)	sf_threads;	/* (f) fds on this selinfo. */
138	struct selinfo		*sf_si;		/* (f) selinfo when linked. */
139	struct mtx		*sf_mtx;	/* Pointer to selinfo mtx. */
140	struct seltd		*sf_td;		/* (k) owning seltd. */
141	void			*sf_cookie;	/* (k) fd or pollfd. */
142};
143
144static uma_zone_t selfd_zone;
145static struct mtx_pool *mtxpool_select;
146
147#ifndef _SYS_SYSPROTO_H_
148struct read_args {
149	int	fd;
150	void	*buf;
151	size_t	nbyte;
152};
153#endif
154int
155sys_read(td, uap)
156	struct thread *td;
157	struct read_args *uap;
158{
159	struct uio auio;
160	struct iovec aiov;
161	int error;
162
163	if (uap->nbyte > IOSIZE_MAX)
164		return (EINVAL);
165	aiov.iov_base = uap->buf;
166	aiov.iov_len = uap->nbyte;
167	auio.uio_iov = &aiov;
168	auio.uio_iovcnt = 1;
169	auio.uio_resid = uap->nbyte;
170	auio.uio_segflg = UIO_USERSPACE;
171	error = kern_readv(td, uap->fd, &auio);
172	return(error);
173}
174
175/*
176 * Positioned read system call
177 */
178#ifndef _SYS_SYSPROTO_H_
179struct pread_args {
180	int	fd;
181	void	*buf;
182	size_t	nbyte;
183	int	pad;
184	off_t	offset;
185};
186#endif
187int
188sys_pread(td, uap)
189	struct thread *td;
190	struct pread_args *uap;
191{
192	struct uio auio;
193	struct iovec aiov;
194	int error;
195
196	if (uap->nbyte > IOSIZE_MAX)
197		return (EINVAL);
198	aiov.iov_base = uap->buf;
199	aiov.iov_len = uap->nbyte;
200	auio.uio_iov = &aiov;
201	auio.uio_iovcnt = 1;
202	auio.uio_resid = uap->nbyte;
203	auio.uio_segflg = UIO_USERSPACE;
204	error = kern_preadv(td, uap->fd, &auio, uap->offset);
205	return(error);
206}
207
208int
209freebsd6_pread(td, uap)
210	struct thread *td;
211	struct freebsd6_pread_args *uap;
212{
213	struct pread_args oargs;
214
215	oargs.fd = uap->fd;
216	oargs.buf = uap->buf;
217	oargs.nbyte = uap->nbyte;
218	oargs.offset = uap->offset;
219	return (sys_pread(td, &oargs));
220}
221
222/*
223 * Scatter read system call.
224 */
225#ifndef _SYS_SYSPROTO_H_
226struct readv_args {
227	int	fd;
228	struct	iovec *iovp;
229	u_int	iovcnt;
230};
231#endif
232int
233sys_readv(struct thread *td, struct readv_args *uap)
234{
235	struct uio *auio;
236	int error;
237
238	error = copyinuio(uap->iovp, uap->iovcnt, &auio);
239	if (error)
240		return (error);
241	error = kern_readv(td, uap->fd, auio);
242	free(auio, M_IOV);
243	return (error);
244}
245
246int
247kern_readv(struct thread *td, int fd, struct uio *auio)
248{
249	struct file *fp;
250	cap_rights_t rights;
251	int error;
252
253	error = fget_read(td, fd, cap_rights_init(&rights, CAP_READ), &fp);
254	if (error)
255		return (error);
256	error = dofileread(td, fd, fp, auio, (off_t)-1, 0);
257	fdrop(fp, td);
258	return (error);
259}
260
261/*
262 * Scatter positioned read system call.
263 */
264#ifndef _SYS_SYSPROTO_H_
265struct preadv_args {
266	int	fd;
267	struct	iovec *iovp;
268	u_int	iovcnt;
269	off_t	offset;
270};
271#endif
272int
273sys_preadv(struct thread *td, struct preadv_args *uap)
274{
275	struct uio *auio;
276	int error;
277
278	error = copyinuio(uap->iovp, uap->iovcnt, &auio);
279	if (error)
280		return (error);
281	error = kern_preadv(td, uap->fd, auio, uap->offset);
282	free(auio, M_IOV);
283	return (error);
284}
285
286int
287kern_preadv(td, fd, auio, offset)
288	struct thread *td;
289	int fd;
290	struct uio *auio;
291	off_t offset;
292{
293	struct file *fp;
294	cap_rights_t rights;
295	int error;
296
297	error = fget_read(td, fd, cap_rights_init(&rights, CAP_PREAD), &fp);
298	if (error)
299		return (error);
300	if (!(fp->f_ops->fo_flags & DFLAG_SEEKABLE))
301		error = ESPIPE;
302	else if (offset < 0 && fp->f_vnode->v_type != VCHR)
303		error = EINVAL;
304	else
305		error = dofileread(td, fd, fp, auio, offset, FOF_OFFSET);
306	fdrop(fp, td);
307	return (error);
308}
309
310/*
311 * Common code for readv and preadv that reads data in
312 * from a file using the passed in uio, offset, and flags.
313 */
314static int
315dofileread(td, fd, fp, auio, offset, flags)
316	struct thread *td;
317	int fd;
318	struct file *fp;
319	struct uio *auio;
320	off_t offset;
321	int flags;
322{
323	ssize_t cnt;
324	int error;
325#ifdef KTRACE
326	struct uio *ktruio = NULL;
327#endif
328
329	/* Finish zero length reads right here */
330	if (auio->uio_resid == 0) {
331		td->td_retval[0] = 0;
332		return(0);
333	}
334	auio->uio_rw = UIO_READ;
335	auio->uio_offset = offset;
336	auio->uio_td = td;
337#ifdef KTRACE
338	if (KTRPOINT(td, KTR_GENIO))
339		ktruio = cloneuio(auio);
340#endif
341	cnt = auio->uio_resid;
342	if ((error = fo_read(fp, auio, td->td_ucred, flags, td))) {
343		if (auio->uio_resid != cnt && (error == ERESTART ||
344		    error == EINTR || error == EWOULDBLOCK))
345			error = 0;
346	}
347	cnt -= auio->uio_resid;
348#ifdef KTRACE
349	if (ktruio != NULL) {
350		ktruio->uio_resid = cnt;
351		ktrgenio(fd, UIO_READ, ktruio, error);
352	}
353#endif
354	td->td_retval[0] = cnt;
355	return (error);
356}
357
358#ifndef _SYS_SYSPROTO_H_
359struct write_args {
360	int	fd;
361	const void *buf;
362	size_t	nbyte;
363};
364#endif
365int
366sys_write(td, uap)
367	struct thread *td;
368	struct write_args *uap;
369{
370	struct uio auio;
371	struct iovec aiov;
372	int error;
373
374	if (uap->nbyte > IOSIZE_MAX)
375		return (EINVAL);
376	aiov.iov_base = (void *)(uintptr_t)uap->buf;
377	aiov.iov_len = uap->nbyte;
378	auio.uio_iov = &aiov;
379	auio.uio_iovcnt = 1;
380	auio.uio_resid = uap->nbyte;
381	auio.uio_segflg = UIO_USERSPACE;
382	error = kern_writev(td, uap->fd, &auio);
383	return(error);
384}
385
386/*
387 * Positioned write system call.
388 */
389#ifndef _SYS_SYSPROTO_H_
390struct pwrite_args {
391	int	fd;
392	const void *buf;
393	size_t	nbyte;
394	int	pad;
395	off_t	offset;
396};
397#endif
398int
399sys_pwrite(td, uap)
400	struct thread *td;
401	struct pwrite_args *uap;
402{
403	struct uio auio;
404	struct iovec aiov;
405	int error;
406
407	if (uap->nbyte > IOSIZE_MAX)
408		return (EINVAL);
409	aiov.iov_base = (void *)(uintptr_t)uap->buf;
410	aiov.iov_len = uap->nbyte;
411	auio.uio_iov = &aiov;
412	auio.uio_iovcnt = 1;
413	auio.uio_resid = uap->nbyte;
414	auio.uio_segflg = UIO_USERSPACE;
415	error = kern_pwritev(td, uap->fd, &auio, uap->offset);
416	return(error);
417}
418
419int
420freebsd6_pwrite(td, uap)
421	struct thread *td;
422	struct freebsd6_pwrite_args *uap;
423{
424	struct pwrite_args oargs;
425
426	oargs.fd = uap->fd;
427	oargs.buf = uap->buf;
428	oargs.nbyte = uap->nbyte;
429	oargs.offset = uap->offset;
430	return (sys_pwrite(td, &oargs));
431}
432
433/*
434 * Gather write system call.
435 */
436#ifndef _SYS_SYSPROTO_H_
437struct writev_args {
438	int	fd;
439	struct	iovec *iovp;
440	u_int	iovcnt;
441};
442#endif
443int
444sys_writev(struct thread *td, struct writev_args *uap)
445{
446	struct uio *auio;
447	int error;
448
449	error = copyinuio(uap->iovp, uap->iovcnt, &auio);
450	if (error)
451		return (error);
452	error = kern_writev(td, uap->fd, auio);
453	free(auio, M_IOV);
454	return (error);
455}
456
457int
458kern_writev(struct thread *td, int fd, struct uio *auio)
459{
460	struct file *fp;
461	cap_rights_t rights;
462	int error;
463
464	error = fget_write(td, fd, cap_rights_init(&rights, CAP_WRITE), &fp);
465	if (error)
466		return (error);
467	error = dofilewrite(td, fd, fp, auio, (off_t)-1, 0);
468	fdrop(fp, td);
469	return (error);
470}
471
472/*
473 * Gather positioned write system call.
474 */
475#ifndef _SYS_SYSPROTO_H_
476struct pwritev_args {
477	int	fd;
478	struct	iovec *iovp;
479	u_int	iovcnt;
480	off_t	offset;
481};
482#endif
483int
484sys_pwritev(struct thread *td, struct pwritev_args *uap)
485{
486	struct uio *auio;
487	int error;
488
489	error = copyinuio(uap->iovp, uap->iovcnt, &auio);
490	if (error)
491		return (error);
492	error = kern_pwritev(td, uap->fd, auio, uap->offset);
493	free(auio, M_IOV);
494	return (error);
495}
496
497int
498kern_pwritev(td, fd, auio, offset)
499	struct thread *td;
500	struct uio *auio;
501	int fd;
502	off_t offset;
503{
504	struct file *fp;
505	cap_rights_t rights;
506	int error;
507
508	error = fget_write(td, fd, cap_rights_init(&rights, CAP_PWRITE), &fp);
509	if (error)
510		return (error);
511	if (!(fp->f_ops->fo_flags & DFLAG_SEEKABLE))
512		error = ESPIPE;
513	else if (offset < 0 && fp->f_vnode->v_type != VCHR)
514		error = EINVAL;
515	else
516		error = dofilewrite(td, fd, fp, auio, offset, FOF_OFFSET);
517	fdrop(fp, td);
518	return (error);
519}
520
521/*
522 * Common code for writev and pwritev that writes data to
523 * a file using the passed in uio, offset, and flags.
524 */
525static int
526dofilewrite(td, fd, fp, auio, offset, flags)
527	struct thread *td;
528	int fd;
529	struct file *fp;
530	struct uio *auio;
531	off_t offset;
532	int flags;
533{
534	ssize_t cnt;
535	int error;
536#ifdef KTRACE
537	struct uio *ktruio = NULL;
538#endif
539
540	auio->uio_rw = UIO_WRITE;
541	auio->uio_td = td;
542	auio->uio_offset = offset;
543#ifdef KTRACE
544	if (KTRPOINT(td, KTR_GENIO))
545		ktruio = cloneuio(auio);
546#endif
547	cnt = auio->uio_resid;
548	if (fp->f_type == DTYPE_VNODE &&
549	    (fp->f_vnread_flags & FDEVFS_VNODE) == 0)
550		bwillwrite();
551	if ((error = fo_write(fp, auio, td->td_ucred, flags, td))) {
552		if (auio->uio_resid != cnt && (error == ERESTART ||
553		    error == EINTR || error == EWOULDBLOCK))
554			error = 0;
555		/* Socket layer is responsible for issuing SIGPIPE. */
556		if (fp->f_type != DTYPE_SOCKET && error == EPIPE) {
557			PROC_LOCK(td->td_proc);
558			tdsignal(td, SIGPIPE);
559			PROC_UNLOCK(td->td_proc);
560		}
561	}
562	cnt -= auio->uio_resid;
563#ifdef KTRACE
564	if (ktruio != NULL) {
565		ktruio->uio_resid = cnt;
566		ktrgenio(fd, UIO_WRITE, ktruio, error);
567	}
568#endif
569	td->td_retval[0] = cnt;
570	return (error);
571}
572
573/*
574 * Truncate a file given a file descriptor.
575 *
576 * Can't use fget_write() here, since must return EINVAL and not EBADF if the
577 * descriptor isn't writable.
578 */
579int
580kern_ftruncate(td, fd, length)
581	struct thread *td;
582	int fd;
583	off_t length;
584{
585	struct file *fp;
586	cap_rights_t rights;
587	int error;
588
589	AUDIT_ARG_FD(fd);
590	if (length < 0)
591		return (EINVAL);
592	error = fget(td, fd, cap_rights_init(&rights, CAP_FTRUNCATE), &fp);
593	if (error)
594		return (error);
595	AUDIT_ARG_FILE(td->td_proc, fp);
596	if (!(fp->f_flag & FWRITE)) {
597		fdrop(fp, td);
598		return (EINVAL);
599	}
600	error = fo_truncate(fp, length, td->td_ucred, td);
601	fdrop(fp, td);
602	return (error);
603}
604
605#ifndef _SYS_SYSPROTO_H_
606struct ftruncate_args {
607	int	fd;
608	int	pad;
609	off_t	length;
610};
611#endif
612int
613sys_ftruncate(td, uap)
614	struct thread *td;
615	struct ftruncate_args *uap;
616{
617
618	return (kern_ftruncate(td, uap->fd, uap->length));
619}
620
621#if defined(COMPAT_43)
622#ifndef _SYS_SYSPROTO_H_
623struct oftruncate_args {
624	int	fd;
625	long	length;
626};
627#endif
628int
629oftruncate(td, uap)
630	struct thread *td;
631	struct oftruncate_args *uap;
632{
633
634	return (kern_ftruncate(td, uap->fd, uap->length));
635}
636#endif /* COMPAT_43 */
637
638#ifndef _SYS_SYSPROTO_H_
639struct ioctl_args {
640	int	fd;
641	u_long	com;
642	caddr_t	data;
643};
644#endif
645/* ARGSUSED */
646int
647sys_ioctl(struct thread *td, struct ioctl_args *uap)
648{
649	u_long com;
650	int arg, error;
651	u_int size;
652	caddr_t data;
653
654	if (uap->com > 0xffffffff) {
655		printf(
656		    "WARNING pid %d (%s): ioctl sign-extension ioctl %lx\n",
657		    td->td_proc->p_pid, td->td_name, uap->com);
658		uap->com &= 0xffffffff;
659	}
660	com = uap->com;
661
662	/*
663	 * Interpret high order word to find amount of data to be
664	 * copied to/from the user's address space.
665	 */
666	size = IOCPARM_LEN(com);
667	if ((size > IOCPARM_MAX) ||
668	    ((com & (IOC_VOID  | IOC_IN | IOC_OUT)) == 0) ||
669#if defined(COMPAT_FREEBSD5) || defined(COMPAT_FREEBSD4) || defined(COMPAT_43)
670	    ((com & IOC_OUT) && size == 0) ||
671#else
672	    ((com & (IOC_IN | IOC_OUT)) && size == 0) ||
673#endif
674	    ((com & IOC_VOID) && size > 0 && size != sizeof(int)))
675		return (ENOTTY);
676
677	if (size > 0) {
678		if (com & IOC_VOID) {
679			/* Integer argument. */
680			arg = (intptr_t)uap->data;
681			data = (void *)&arg;
682			size = 0;
683		} else
684			data = malloc((u_long)size, M_IOCTLOPS, M_WAITOK);
685	} else
686		data = (void *)&uap->data;
687	if (com & IOC_IN) {
688		error = copyin(uap->data, data, (u_int)size);
689		if (error) {
690			if (size > 0)
691				free(data, M_IOCTLOPS);
692			return (error);
693		}
694	} else if (com & IOC_OUT) {
695		/*
696		 * Zero the buffer so the user always
697		 * gets back something deterministic.
698		 */
699		bzero(data, size);
700	}
701
702	error = kern_ioctl(td, uap->fd, com, data);
703
704	if (error == 0 && (com & IOC_OUT))
705		error = copyout(data, uap->data, (u_int)size);
706
707	if (size > 0)
708		free(data, M_IOCTLOPS);
709	return (error);
710}
711
712int
713kern_ioctl(struct thread *td, int fd, u_long com, caddr_t data)
714{
715	struct file *fp;
716	struct filedesc *fdp;
717#ifndef CAPABILITIES
718	cap_rights_t rights;
719#endif
720	int error, tmp, locked;
721
722	AUDIT_ARG_FD(fd);
723	AUDIT_ARG_CMD(com);
724
725	fdp = td->td_proc->p_fd;
726
727	switch (com) {
728	case FIONCLEX:
729	case FIOCLEX:
730		FILEDESC_XLOCK(fdp);
731		locked = LA_XLOCKED;
732		break;
733	default:
734#ifdef CAPABILITIES
735		FILEDESC_SLOCK(fdp);
736		locked = LA_SLOCKED;
737#else
738		locked = LA_UNLOCKED;
739#endif
740		break;
741	}
742
743#ifdef CAPABILITIES
744	if ((fp = fget_locked(fdp, fd)) == NULL) {
745		error = EBADF;
746		goto out;
747	}
748	if ((error = cap_ioctl_check(fdp, fd, com)) != 0) {
749		fp = NULL;	/* fhold() was not called yet */
750		goto out;
751	}
752	fhold(fp);
753	if (locked == LA_SLOCKED) {
754		FILEDESC_SUNLOCK(fdp);
755		locked = LA_UNLOCKED;
756	}
757#else
758	error = fget(td, fd, cap_rights_init(&rights, CAP_IOCTL), &fp);
759	if (error != 0) {
760		fp = NULL;
761		goto out;
762	}
763#endif
764	if ((fp->f_flag & (FREAD | FWRITE)) == 0) {
765		error = EBADF;
766		goto out;
767	}
768
769	switch (com) {
770	case FIONCLEX:
771		fdp->fd_ofiles[fd].fde_flags &= ~UF_EXCLOSE;
772		goto out;
773	case FIOCLEX:
774		fdp->fd_ofiles[fd].fde_flags |= UF_EXCLOSE;
775		goto out;
776	case FIONBIO:
777		if ((tmp = *(int *)data))
778			atomic_set_int(&fp->f_flag, FNONBLOCK);
779		else
780			atomic_clear_int(&fp->f_flag, FNONBLOCK);
781		data = (void *)&tmp;
782		break;
783	case FIOASYNC:
784		if ((tmp = *(int *)data))
785			atomic_set_int(&fp->f_flag, FASYNC);
786		else
787			atomic_clear_int(&fp->f_flag, FASYNC);
788		data = (void *)&tmp;
789		break;
790	}
791
792	error = fo_ioctl(fp, com, data, td->td_ucred, td);
793out:
794	switch (locked) {
795	case LA_XLOCKED:
796		FILEDESC_XUNLOCK(fdp);
797		break;
798#ifdef CAPABILITIES
799	case LA_SLOCKED:
800		FILEDESC_SUNLOCK(fdp);
801		break;
802#endif
803	default:
804		FILEDESC_UNLOCK_ASSERT(fdp);
805		break;
806	}
807	if (fp != NULL)
808		fdrop(fp, td);
809	return (error);
810}
811
812int
813poll_no_poll(int events)
814{
815	/*
816	 * Return true for read/write.  If the user asked for something
817	 * special, return POLLNVAL, so that clients have a way of
818	 * determining reliably whether or not the extended
819	 * functionality is present without hard-coding knowledge
820	 * of specific filesystem implementations.
821	 */
822	if (events & ~POLLSTANDARD)
823		return (POLLNVAL);
824
825	return (events & (POLLIN | POLLOUT | POLLRDNORM | POLLWRNORM));
826}
827
828int
829sys_pselect(struct thread *td, struct pselect_args *uap)
830{
831	struct timespec ts;
832	struct timeval tv, *tvp;
833	sigset_t set, *uset;
834	int error;
835
836	if (uap->ts != NULL) {
837		error = copyin(uap->ts, &ts, sizeof(ts));
838		if (error != 0)
839		    return (error);
840		TIMESPEC_TO_TIMEVAL(&tv, &ts);
841		tvp = &tv;
842	} else
843		tvp = NULL;
844	if (uap->sm != NULL) {
845		error = copyin(uap->sm, &set, sizeof(set));
846		if (error != 0)
847			return (error);
848		uset = &set;
849	} else
850		uset = NULL;
851	return (kern_pselect(td, uap->nd, uap->in, uap->ou, uap->ex, tvp,
852	    uset, NFDBITS));
853}
854
855int
856kern_pselect(struct thread *td, int nd, fd_set *in, fd_set *ou, fd_set *ex,
857    struct timeval *tvp, sigset_t *uset, int abi_nfdbits)
858{
859	int error;
860
861	if (uset != NULL) {
862		error = kern_sigprocmask(td, SIG_SETMASK, uset,
863		    &td->td_oldsigmask, 0);
864		if (error != 0)
865			return (error);
866		td->td_pflags |= TDP_OLDMASK;
867		/*
868		 * Make sure that ast() is called on return to
869		 * usermode and TDP_OLDMASK is cleared, restoring old
870		 * sigmask.
871		 */
872		thread_lock(td);
873		td->td_flags |= TDF_ASTPENDING;
874		thread_unlock(td);
875	}
876	error = kern_select(td, nd, in, ou, ex, tvp, abi_nfdbits);
877	return (error);
878}
879
880#ifndef _SYS_SYSPROTO_H_
881struct select_args {
882	int	nd;
883	fd_set	*in, *ou, *ex;
884	struct	timeval *tv;
885};
886#endif
887int
888sys_select(struct thread *td, struct select_args *uap)
889{
890	struct timeval tv, *tvp;
891	int error;
892
893	if (uap->tv != NULL) {
894		error = copyin(uap->tv, &tv, sizeof(tv));
895		if (error)
896			return (error);
897		tvp = &tv;
898	} else
899		tvp = NULL;
900
901	return (kern_select(td, uap->nd, uap->in, uap->ou, uap->ex, tvp,
902	    NFDBITS));
903}
904
905/*
906 * In the unlikely case when user specified n greater then the last
907 * open file descriptor, check that no bits are set after the last
908 * valid fd.  We must return EBADF if any is set.
909 *
910 * There are applications that rely on the behaviour.
911 *
912 * nd is fd_lastfile + 1.
913 */
914static int
915select_check_badfd(fd_set *fd_in, int nd, int ndu, int abi_nfdbits)
916{
917	char *addr, *oaddr;
918	int b, i, res;
919	uint8_t bits;
920
921	if (nd >= ndu || fd_in == NULL)
922		return (0);
923
924	oaddr = NULL;
925	bits = 0; /* silence gcc */
926	for (i = nd; i < ndu; i++) {
927		b = i / NBBY;
928#if BYTE_ORDER == LITTLE_ENDIAN
929		addr = (char *)fd_in + b;
930#else
931		addr = (char *)fd_in;
932		if (abi_nfdbits == NFDBITS) {
933			addr += rounddown(b, sizeof(fd_mask)) +
934			    sizeof(fd_mask) - 1 - b % sizeof(fd_mask);
935		} else {
936			addr += rounddown(b, sizeof(uint32_t)) +
937			    sizeof(uint32_t) - 1 - b % sizeof(uint32_t);
938		}
939#endif
940		if (addr != oaddr) {
941			res = fubyte(addr);
942			if (res == -1)
943				return (EFAULT);
944			oaddr = addr;
945			bits = res;
946		}
947		if ((bits & (1 << (i % NBBY))) != 0)
948			return (EBADF);
949	}
950	return (0);
951}
952
953int
954kern_select(struct thread *td, int nd, fd_set *fd_in, fd_set *fd_ou,
955    fd_set *fd_ex, struct timeval *tvp, int abi_nfdbits)
956{
957	struct filedesc *fdp;
958	/*
959	 * The magic 2048 here is chosen to be just enough for FD_SETSIZE
960	 * infds with the new FD_SETSIZE of 1024, and more than enough for
961	 * FD_SETSIZE infds, outfds and exceptfds with the old FD_SETSIZE
962	 * of 256.
963	 */
964	fd_mask s_selbits[howmany(2048, NFDBITS)];
965	fd_mask *ibits[3], *obits[3], *selbits, *sbp;
966	struct timeval rtv;
967	sbintime_t asbt, precision, rsbt;
968	u_int nbufbytes, ncpbytes, ncpubytes, nfdbits;
969	int error, lf, ndu;
970
971	if (nd < 0)
972		return (EINVAL);
973	fdp = td->td_proc->p_fd;
974	ndu = nd;
975	lf = fdp->fd_lastfile;
976	if (nd > lf + 1)
977		nd = lf + 1;
978
979	error = select_check_badfd(fd_in, nd, ndu, abi_nfdbits);
980	if (error != 0)
981		return (error);
982	error = select_check_badfd(fd_ou, nd, ndu, abi_nfdbits);
983	if (error != 0)
984		return (error);
985	error = select_check_badfd(fd_ex, nd, ndu, abi_nfdbits);
986	if (error != 0)
987		return (error);
988
989	/*
990	 * Allocate just enough bits for the non-null fd_sets.  Use the
991	 * preallocated auto buffer if possible.
992	 */
993	nfdbits = roundup(nd, NFDBITS);
994	ncpbytes = nfdbits / NBBY;
995	ncpubytes = roundup(nd, abi_nfdbits) / NBBY;
996	nbufbytes = 0;
997	if (fd_in != NULL)
998		nbufbytes += 2 * ncpbytes;
999	if (fd_ou != NULL)
1000		nbufbytes += 2 * ncpbytes;
1001	if (fd_ex != NULL)
1002		nbufbytes += 2 * ncpbytes;
1003	if (nbufbytes <= sizeof s_selbits)
1004		selbits = &s_selbits[0];
1005	else
1006		selbits = malloc(nbufbytes, M_SELECT, M_WAITOK);
1007
1008	/*
1009	 * Assign pointers into the bit buffers and fetch the input bits.
1010	 * Put the output buffers together so that they can be bzeroed
1011	 * together.
1012	 */
1013	sbp = selbits;
1014#define	getbits(name, x) \
1015	do {								\
1016		if (name == NULL) {					\
1017			ibits[x] = NULL;				\
1018			obits[x] = NULL;				\
1019		} else {						\
1020			ibits[x] = sbp + nbufbytes / 2 / sizeof *sbp;	\
1021			obits[x] = sbp;					\
1022			sbp += ncpbytes / sizeof *sbp;			\
1023			error = copyin(name, ibits[x], ncpubytes);	\
1024			if (error != 0)					\
1025				goto done;				\
1026			bzero((char *)ibits[x] + ncpubytes,		\
1027			    ncpbytes - ncpubytes);			\
1028		}							\
1029	} while (0)
1030	getbits(fd_in, 0);
1031	getbits(fd_ou, 1);
1032	getbits(fd_ex, 2);
1033#undef	getbits
1034
1035#if BYTE_ORDER == BIG_ENDIAN && defined(__LP64__)
1036	/*
1037	 * XXX: swizzle_fdset assumes that if abi_nfdbits != NFDBITS,
1038	 * we are running under 32-bit emulation. This should be more
1039	 * generic.
1040	 */
1041#define swizzle_fdset(bits)						\
1042	if (abi_nfdbits != NFDBITS && bits != NULL) {			\
1043		int i;							\
1044		for (i = 0; i < ncpbytes / sizeof *sbp; i++)		\
1045			bits[i] = (bits[i] >> 32) | (bits[i] << 32);	\
1046	}
1047#else
1048#define swizzle_fdset(bits)
1049#endif
1050
1051	/* Make sure the bit order makes it through an ABI transition */
1052	swizzle_fdset(ibits[0]);
1053	swizzle_fdset(ibits[1]);
1054	swizzle_fdset(ibits[2]);
1055
1056	if (nbufbytes != 0)
1057		bzero(selbits, nbufbytes / 2);
1058
1059	precision = 0;
1060	if (tvp != NULL) {
1061		rtv = *tvp;
1062		if (rtv.tv_sec < 0 || rtv.tv_usec < 0 ||
1063		    rtv.tv_usec >= 1000000) {
1064			error = EINVAL;
1065			goto done;
1066		}
1067		if (!timevalisset(&rtv))
1068			asbt = 0;
1069		else if (rtv.tv_sec <= INT32_MAX) {
1070			rsbt = tvtosbt(rtv);
1071			precision = rsbt;
1072			precision >>= tc_precexp;
1073			if (TIMESEL(&asbt, rsbt))
1074				asbt += tc_tick_sbt;
1075			if (asbt <= INT64_MAX - rsbt)
1076				asbt += rsbt;
1077			else
1078				asbt = -1;
1079		} else
1080			asbt = -1;
1081	} else
1082		asbt = -1;
1083	seltdinit(td);
1084	/* Iterate until the timeout expires or descriptors become ready. */
1085	for (;;) {
1086		error = selscan(td, ibits, obits, nd);
1087		if (error || td->td_retval[0] != 0)
1088			break;
1089		error = seltdwait(td, asbt, precision);
1090		if (error)
1091			break;
1092		error = selrescan(td, ibits, obits);
1093		if (error || td->td_retval[0] != 0)
1094			break;
1095	}
1096	seltdclear(td);
1097
1098done:
1099	/* select is not restarted after signals... */
1100	if (error == ERESTART)
1101		error = EINTR;
1102	if (error == EWOULDBLOCK)
1103		error = 0;
1104
1105	/* swizzle bit order back, if necessary */
1106	swizzle_fdset(obits[0]);
1107	swizzle_fdset(obits[1]);
1108	swizzle_fdset(obits[2]);
1109#undef swizzle_fdset
1110
1111#define	putbits(name, x) \
1112	if (name && (error2 = copyout(obits[x], name, ncpubytes))) \
1113		error = error2;
1114	if (error == 0) {
1115		int error2;
1116
1117		putbits(fd_in, 0);
1118		putbits(fd_ou, 1);
1119		putbits(fd_ex, 2);
1120#undef putbits
1121	}
1122	if (selbits != &s_selbits[0])
1123		free(selbits, M_SELECT);
1124
1125	return (error);
1126}
1127/*
1128 * Convert a select bit set to poll flags.
1129 *
1130 * The backend always returns POLLHUP/POLLERR if appropriate and we
1131 * return this as a set bit in any set.
1132 */
1133static int select_flags[3] = {
1134    POLLRDNORM | POLLHUP | POLLERR,
1135    POLLWRNORM | POLLHUP | POLLERR,
1136    POLLRDBAND | POLLERR
1137};
1138
1139/*
1140 * Compute the fo_poll flags required for a fd given by the index and
1141 * bit position in the fd_mask array.
1142 */
1143static __inline int
1144selflags(fd_mask **ibits, int idx, fd_mask bit)
1145{
1146	int flags;
1147	int msk;
1148
1149	flags = 0;
1150	for (msk = 0; msk < 3; msk++) {
1151		if (ibits[msk] == NULL)
1152			continue;
1153		if ((ibits[msk][idx] & bit) == 0)
1154			continue;
1155		flags |= select_flags[msk];
1156	}
1157	return (flags);
1158}
1159
1160/*
1161 * Set the appropriate output bits given a mask of fired events and the
1162 * input bits originally requested.
1163 */
1164static __inline int
1165selsetbits(fd_mask **ibits, fd_mask **obits, int idx, fd_mask bit, int events)
1166{
1167	int msk;
1168	int n;
1169
1170	n = 0;
1171	for (msk = 0; msk < 3; msk++) {
1172		if ((events & select_flags[msk]) == 0)
1173			continue;
1174		if (ibits[msk] == NULL)
1175			continue;
1176		if ((ibits[msk][idx] & bit) == 0)
1177			continue;
1178		/*
1179		 * XXX Check for a duplicate set.  This can occur because a
1180		 * socket calls selrecord() twice for each poll() call
1181		 * resulting in two selfds per real fd.  selrescan() will
1182		 * call selsetbits twice as a result.
1183		 */
1184		if ((obits[msk][idx] & bit) != 0)
1185			continue;
1186		obits[msk][idx] |= bit;
1187		n++;
1188	}
1189
1190	return (n);
1191}
1192
1193static __inline int
1194getselfd_cap(struct filedesc *fdp, int fd, struct file **fpp)
1195{
1196	cap_rights_t rights;
1197
1198	return (fget_unlocked(fdp, fd, cap_rights_init(&rights, CAP_POLL_EVENT),
1199	    0, fpp, NULL));
1200}
1201
1202/*
1203 * Traverse the list of fds attached to this thread's seltd and check for
1204 * completion.
1205 */
1206static int
1207selrescan(struct thread *td, fd_mask **ibits, fd_mask **obits)
1208{
1209	struct filedesc *fdp;
1210	struct selinfo *si;
1211	struct seltd *stp;
1212	struct selfd *sfp;
1213	struct selfd *sfn;
1214	struct file *fp;
1215	fd_mask bit;
1216	int fd, ev, n, idx;
1217	int error;
1218
1219	fdp = td->td_proc->p_fd;
1220	stp = td->td_sel;
1221	n = 0;
1222	STAILQ_FOREACH_SAFE(sfp, &stp->st_selq, sf_link, sfn) {
1223		fd = (int)(uintptr_t)sfp->sf_cookie;
1224		si = sfp->sf_si;
1225		selfdfree(stp, sfp);
1226		/* If the selinfo wasn't cleared the event didn't fire. */
1227		if (si != NULL)
1228			continue;
1229		error = getselfd_cap(fdp, fd, &fp);
1230		if (error)
1231			return (error);
1232		idx = fd / NFDBITS;
1233		bit = (fd_mask)1 << (fd % NFDBITS);
1234		ev = fo_poll(fp, selflags(ibits, idx, bit), td->td_ucred, td);
1235		fdrop(fp, td);
1236		if (ev != 0)
1237			n += selsetbits(ibits, obits, idx, bit, ev);
1238	}
1239	stp->st_flags = 0;
1240	td->td_retval[0] = n;
1241	return (0);
1242}
1243
1244/*
1245 * Perform the initial filedescriptor scan and register ourselves with
1246 * each selinfo.
1247 */
1248static int
1249selscan(td, ibits, obits, nfd)
1250	struct thread *td;
1251	fd_mask **ibits, **obits;
1252	int nfd;
1253{
1254	struct filedesc *fdp;
1255	struct file *fp;
1256	fd_mask bit;
1257	int ev, flags, end, fd;
1258	int n, idx;
1259	int error;
1260
1261	fdp = td->td_proc->p_fd;
1262	n = 0;
1263	for (idx = 0, fd = 0; fd < nfd; idx++) {
1264		end = imin(fd + NFDBITS, nfd);
1265		for (bit = 1; fd < end; bit <<= 1, fd++) {
1266			/* Compute the list of events we're interested in. */
1267			flags = selflags(ibits, idx, bit);
1268			if (flags == 0)
1269				continue;
1270			error = getselfd_cap(fdp, fd, &fp);
1271			if (error)
1272				return (error);
1273			selfdalloc(td, (void *)(uintptr_t)fd);
1274			ev = fo_poll(fp, flags, td->td_ucred, td);
1275			fdrop(fp, td);
1276			if (ev != 0)
1277				n += selsetbits(ibits, obits, idx, bit, ev);
1278		}
1279	}
1280
1281	td->td_retval[0] = n;
1282	return (0);
1283}
1284
1285#ifndef _SYS_SYSPROTO_H_
1286struct poll_args {
1287	struct pollfd *fds;
1288	u_int	nfds;
1289	int	timeout;
1290};
1291#endif
1292int
1293sys_poll(td, uap)
1294	struct thread *td;
1295	struct poll_args *uap;
1296{
1297	struct pollfd *bits;
1298	struct pollfd smallbits[32];
1299	sbintime_t asbt, precision, rsbt;
1300	u_int nfds;
1301	int error;
1302	size_t ni;
1303
1304	nfds = uap->nfds;
1305	if (nfds > maxfilesperproc && nfds > FD_SETSIZE)
1306		return (EINVAL);
1307	ni = nfds * sizeof(struct pollfd);
1308	if (ni > sizeof(smallbits))
1309		bits = malloc(ni, M_TEMP, M_WAITOK);
1310	else
1311		bits = smallbits;
1312	error = copyin(uap->fds, bits, ni);
1313	if (error)
1314		goto done;
1315	precision = 0;
1316	if (uap->timeout != INFTIM) {
1317		if (uap->timeout < 0) {
1318			error = EINVAL;
1319			goto done;
1320		}
1321		if (uap->timeout == 0)
1322			asbt = 0;
1323		else {
1324			rsbt = SBT_1MS * uap->timeout;
1325			precision = rsbt;
1326			precision >>= tc_precexp;
1327			if (TIMESEL(&asbt, rsbt))
1328				asbt += tc_tick_sbt;
1329			asbt += rsbt;
1330		}
1331	} else
1332		asbt = -1;
1333	seltdinit(td);
1334	/* Iterate until the timeout expires or descriptors become ready. */
1335	for (;;) {
1336		error = pollscan(td, bits, nfds);
1337		if (error || td->td_retval[0] != 0)
1338			break;
1339		error = seltdwait(td, asbt, precision);
1340		if (error)
1341			break;
1342		error = pollrescan(td);
1343		if (error || td->td_retval[0] != 0)
1344			break;
1345	}
1346	seltdclear(td);
1347
1348done:
1349	/* poll is not restarted after signals... */
1350	if (error == ERESTART)
1351		error = EINTR;
1352	if (error == EWOULDBLOCK)
1353		error = 0;
1354	if (error == 0) {
1355		error = pollout(td, bits, uap->fds, nfds);
1356		if (error)
1357			goto out;
1358	}
1359out:
1360	if (ni > sizeof(smallbits))
1361		free(bits, M_TEMP);
1362	return (error);
1363}
1364
1365static int
1366pollrescan(struct thread *td)
1367{
1368	struct seltd *stp;
1369	struct selfd *sfp;
1370	struct selfd *sfn;
1371	struct selinfo *si;
1372	struct filedesc *fdp;
1373	struct file *fp;
1374	struct pollfd *fd;
1375#ifdef CAPABILITIES
1376	cap_rights_t rights;
1377#endif
1378	int n;
1379
1380	n = 0;
1381	fdp = td->td_proc->p_fd;
1382	stp = td->td_sel;
1383	FILEDESC_SLOCK(fdp);
1384	STAILQ_FOREACH_SAFE(sfp, &stp->st_selq, sf_link, sfn) {
1385		fd = (struct pollfd *)sfp->sf_cookie;
1386		si = sfp->sf_si;
1387		selfdfree(stp, sfp);
1388		/* If the selinfo wasn't cleared the event didn't fire. */
1389		if (si != NULL)
1390			continue;
1391		fp = fdp->fd_ofiles[fd->fd].fde_file;
1392#ifdef CAPABILITIES
1393		if (fp == NULL ||
1394		    cap_check(cap_rights(fdp, fd->fd),
1395		    cap_rights_init(&rights, CAP_POLL_EVENT)) != 0)
1396#else
1397		if (fp == NULL)
1398#endif
1399		{
1400			fd->revents = POLLNVAL;
1401			n++;
1402			continue;
1403		}
1404
1405		/*
1406		 * Note: backend also returns POLLHUP and
1407		 * POLLERR if appropriate.
1408		 */
1409		fd->revents = fo_poll(fp, fd->events, td->td_ucred, td);
1410		if (fd->revents != 0)
1411			n++;
1412	}
1413	FILEDESC_SUNLOCK(fdp);
1414	stp->st_flags = 0;
1415	td->td_retval[0] = n;
1416	return (0);
1417}
1418
1419
1420static int
1421pollout(td, fds, ufds, nfd)
1422	struct thread *td;
1423	struct pollfd *fds;
1424	struct pollfd *ufds;
1425	u_int nfd;
1426{
1427	int error = 0;
1428	u_int i = 0;
1429	u_int n = 0;
1430
1431	for (i = 0; i < nfd; i++) {
1432		error = copyout(&fds->revents, &ufds->revents,
1433		    sizeof(ufds->revents));
1434		if (error)
1435			return (error);
1436		if (fds->revents != 0)
1437			n++;
1438		fds++;
1439		ufds++;
1440	}
1441	td->td_retval[0] = n;
1442	return (0);
1443}
1444
1445static int
1446pollscan(td, fds, nfd)
1447	struct thread *td;
1448	struct pollfd *fds;
1449	u_int nfd;
1450{
1451	struct filedesc *fdp = td->td_proc->p_fd;
1452	struct file *fp;
1453#ifdef CAPABILITIES
1454	cap_rights_t rights;
1455#endif
1456	int i, n = 0;
1457
1458	FILEDESC_SLOCK(fdp);
1459	for (i = 0; i < nfd; i++, fds++) {
1460		if (fds->fd >= fdp->fd_nfiles) {
1461			fds->revents = POLLNVAL;
1462			n++;
1463		} else if (fds->fd < 0) {
1464			fds->revents = 0;
1465		} else {
1466			fp = fdp->fd_ofiles[fds->fd].fde_file;
1467#ifdef CAPABILITIES
1468			if (fp == NULL ||
1469			    cap_check(cap_rights(fdp, fds->fd),
1470			    cap_rights_init(&rights, CAP_POLL_EVENT)) != 0)
1471#else
1472			if (fp == NULL)
1473#endif
1474			{
1475				fds->revents = POLLNVAL;
1476				n++;
1477			} else {
1478				/*
1479				 * Note: backend also returns POLLHUP and
1480				 * POLLERR if appropriate.
1481				 */
1482				selfdalloc(td, fds);
1483				fds->revents = fo_poll(fp, fds->events,
1484				    td->td_ucred, td);
1485				/*
1486				 * POSIX requires POLLOUT to be never
1487				 * set simultaneously with POLLHUP.
1488				 */
1489				if ((fds->revents & POLLHUP) != 0)
1490					fds->revents &= ~POLLOUT;
1491
1492				if (fds->revents != 0)
1493					n++;
1494			}
1495		}
1496	}
1497	FILEDESC_SUNLOCK(fdp);
1498	td->td_retval[0] = n;
1499	return (0);
1500}
1501
1502/*
1503 * OpenBSD poll system call.
1504 *
1505 * XXX this isn't quite a true representation..  OpenBSD uses select ops.
1506 */
1507#ifndef _SYS_SYSPROTO_H_
1508struct openbsd_poll_args {
1509	struct pollfd *fds;
1510	u_int	nfds;
1511	int	timeout;
1512};
1513#endif
1514int
1515sys_openbsd_poll(td, uap)
1516	register struct thread *td;
1517	register struct openbsd_poll_args *uap;
1518{
1519	return (sys_poll(td, (struct poll_args *)uap));
1520}
1521
1522/*
1523 * XXX This was created specifically to support netncp and netsmb.  This
1524 * allows the caller to specify a socket to wait for events on.  It returns
1525 * 0 if any events matched and an error otherwise.  There is no way to
1526 * determine which events fired.
1527 */
1528int
1529selsocket(struct socket *so, int events, struct timeval *tvp, struct thread *td)
1530{
1531	struct timeval rtv;
1532	sbintime_t asbt, precision, rsbt;
1533	int error;
1534
1535	precision = 0;	/* stupid gcc! */
1536	if (tvp != NULL) {
1537		rtv = *tvp;
1538		if (rtv.tv_sec < 0 || rtv.tv_usec < 0 ||
1539		    rtv.tv_usec >= 1000000)
1540			return (EINVAL);
1541		if (!timevalisset(&rtv))
1542			asbt = 0;
1543		else if (rtv.tv_sec <= INT32_MAX) {
1544			rsbt = tvtosbt(rtv);
1545			precision = rsbt;
1546			precision >>= tc_precexp;
1547			if (TIMESEL(&asbt, rsbt))
1548				asbt += tc_tick_sbt;
1549			if (asbt <= INT64_MAX - rsbt)
1550				asbt += rsbt;
1551			else
1552				asbt = -1;
1553		} else
1554			asbt = -1;
1555	} else
1556		asbt = -1;
1557	seltdinit(td);
1558	/*
1559	 * Iterate until the timeout expires or the socket becomes ready.
1560	 */
1561	for (;;) {
1562		selfdalloc(td, NULL);
1563		error = sopoll(so, events, NULL, td);
1564		/* error here is actually the ready events. */
1565		if (error)
1566			return (0);
1567		error = seltdwait(td, asbt, precision);
1568		if (error)
1569			break;
1570	}
1571	seltdclear(td);
1572	/* XXX Duplicates ncp/smb behavior. */
1573	if (error == ERESTART)
1574		error = 0;
1575	return (error);
1576}
1577
1578/*
1579 * Preallocate two selfds associated with 'cookie'.  Some fo_poll routines
1580 * have two select sets, one for read and another for write.
1581 */
1582static void
1583selfdalloc(struct thread *td, void *cookie)
1584{
1585	struct seltd *stp;
1586
1587	stp = td->td_sel;
1588	if (stp->st_free1 == NULL)
1589		stp->st_free1 = uma_zalloc(selfd_zone, M_WAITOK|M_ZERO);
1590	stp->st_free1->sf_td = stp;
1591	stp->st_free1->sf_cookie = cookie;
1592	if (stp->st_free2 == NULL)
1593		stp->st_free2 = uma_zalloc(selfd_zone, M_WAITOK|M_ZERO);
1594	stp->st_free2->sf_td = stp;
1595	stp->st_free2->sf_cookie = cookie;
1596}
1597
1598static void
1599selfdfree(struct seltd *stp, struct selfd *sfp)
1600{
1601	STAILQ_REMOVE(&stp->st_selq, sfp, selfd, sf_link);
1602	mtx_lock(sfp->sf_mtx);
1603	if (sfp->sf_si)
1604		TAILQ_REMOVE(&sfp->sf_si->si_tdlist, sfp, sf_threads);
1605	mtx_unlock(sfp->sf_mtx);
1606	uma_zfree(selfd_zone, sfp);
1607}
1608
1609/* Drain the waiters tied to all the selfd belonging the specified selinfo. */
1610void
1611seldrain(sip)
1612        struct selinfo *sip;
1613{
1614
1615	/*
1616	 * This feature is already provided by doselwakeup(), thus it is
1617	 * enough to go for it.
1618	 * Eventually, the context, should take care to avoid races
1619	 * between thread calling select()/poll() and file descriptor
1620	 * detaching, but, again, the races are just the same as
1621	 * selwakeup().
1622	 */
1623        doselwakeup(sip, -1);
1624}
1625
1626/*
1627 * Record a select request.
1628 */
1629void
1630selrecord(selector, sip)
1631	struct thread *selector;
1632	struct selinfo *sip;
1633{
1634	struct selfd *sfp;
1635	struct seltd *stp;
1636	struct mtx *mtxp;
1637
1638	stp = selector->td_sel;
1639	/*
1640	 * Don't record when doing a rescan.
1641	 */
1642	if (stp->st_flags & SELTD_RESCAN)
1643		return;
1644	/*
1645	 * Grab one of the preallocated descriptors.
1646	 */
1647	sfp = NULL;
1648	if ((sfp = stp->st_free1) != NULL)
1649		stp->st_free1 = NULL;
1650	else if ((sfp = stp->st_free2) != NULL)
1651		stp->st_free2 = NULL;
1652	else
1653		panic("selrecord: No free selfd on selq");
1654	mtxp = sip->si_mtx;
1655	if (mtxp == NULL)
1656		mtxp = mtx_pool_find(mtxpool_select, sip);
1657	/*
1658	 * Initialize the sfp and queue it in the thread.
1659	 */
1660	sfp->sf_si = sip;
1661	sfp->sf_mtx = mtxp;
1662	STAILQ_INSERT_TAIL(&stp->st_selq, sfp, sf_link);
1663	/*
1664	 * Now that we've locked the sip, check for initialization.
1665	 */
1666	mtx_lock(mtxp);
1667	if (sip->si_mtx == NULL) {
1668		sip->si_mtx = mtxp;
1669		TAILQ_INIT(&sip->si_tdlist);
1670	}
1671	/*
1672	 * Add this thread to the list of selfds listening on this selinfo.
1673	 */
1674	TAILQ_INSERT_TAIL(&sip->si_tdlist, sfp, sf_threads);
1675	mtx_unlock(sip->si_mtx);
1676}
1677
1678/* Wake up a selecting thread. */
1679void
1680selwakeup(sip)
1681	struct selinfo *sip;
1682{
1683	doselwakeup(sip, -1);
1684}
1685
1686/* Wake up a selecting thread, and set its priority. */
1687void
1688selwakeuppri(sip, pri)
1689	struct selinfo *sip;
1690	int pri;
1691{
1692	doselwakeup(sip, pri);
1693}
1694
1695/*
1696 * Do a wakeup when a selectable event occurs.
1697 */
1698static void
1699doselwakeup(sip, pri)
1700	struct selinfo *sip;
1701	int pri;
1702{
1703	struct selfd *sfp;
1704	struct selfd *sfn;
1705	struct seltd *stp;
1706
1707	/* If it's not initialized there can't be any waiters. */
1708	if (sip->si_mtx == NULL)
1709		return;
1710	/*
1711	 * Locking the selinfo locks all selfds associated with it.
1712	 */
1713	mtx_lock(sip->si_mtx);
1714	TAILQ_FOREACH_SAFE(sfp, &sip->si_tdlist, sf_threads, sfn) {
1715		/*
1716		 * Once we remove this sfp from the list and clear the
1717		 * sf_si seltdclear will know to ignore this si.
1718		 */
1719		TAILQ_REMOVE(&sip->si_tdlist, sfp, sf_threads);
1720		sfp->sf_si = NULL;
1721		stp = sfp->sf_td;
1722		mtx_lock(&stp->st_mtx);
1723		stp->st_flags |= SELTD_PENDING;
1724		cv_broadcastpri(&stp->st_wait, pri);
1725		mtx_unlock(&stp->st_mtx);
1726	}
1727	mtx_unlock(sip->si_mtx);
1728}
1729
1730static void
1731seltdinit(struct thread *td)
1732{
1733	struct seltd *stp;
1734
1735	if ((stp = td->td_sel) != NULL)
1736		goto out;
1737	td->td_sel = stp = malloc(sizeof(*stp), M_SELECT, M_WAITOK|M_ZERO);
1738	mtx_init(&stp->st_mtx, "sellck", NULL, MTX_DEF);
1739	cv_init(&stp->st_wait, "select");
1740out:
1741	stp->st_flags = 0;
1742	STAILQ_INIT(&stp->st_selq);
1743}
1744
1745static int
1746seltdwait(struct thread *td, sbintime_t sbt, sbintime_t precision)
1747{
1748	struct seltd *stp;
1749	int error;
1750
1751	stp = td->td_sel;
1752	/*
1753	 * An event of interest may occur while we do not hold the seltd
1754	 * locked so check the pending flag before we sleep.
1755	 */
1756	mtx_lock(&stp->st_mtx);
1757	/*
1758	 * Any further calls to selrecord will be a rescan.
1759	 */
1760	stp->st_flags |= SELTD_RESCAN;
1761	if (stp->st_flags & SELTD_PENDING) {
1762		mtx_unlock(&stp->st_mtx);
1763		return (0);
1764	}
1765	if (sbt == 0)
1766		error = EWOULDBLOCK;
1767	else if (sbt != -1)
1768		error = cv_timedwait_sig_sbt(&stp->st_wait, &stp->st_mtx,
1769		    sbt, precision, C_ABSOLUTE);
1770	else
1771		error = cv_wait_sig(&stp->st_wait, &stp->st_mtx);
1772	mtx_unlock(&stp->st_mtx);
1773
1774	return (error);
1775}
1776
1777void
1778seltdfini(struct thread *td)
1779{
1780	struct seltd *stp;
1781
1782	stp = td->td_sel;
1783	if (stp == NULL)
1784		return;
1785	if (stp->st_free1)
1786		uma_zfree(selfd_zone, stp->st_free1);
1787	if (stp->st_free2)
1788		uma_zfree(selfd_zone, stp->st_free2);
1789	td->td_sel = NULL;
1790	free(stp, M_SELECT);
1791}
1792
1793/*
1794 * Remove the references to the thread from all of the objects we were
1795 * polling.
1796 */
1797static void
1798seltdclear(struct thread *td)
1799{
1800	struct seltd *stp;
1801	struct selfd *sfp;
1802	struct selfd *sfn;
1803
1804	stp = td->td_sel;
1805	STAILQ_FOREACH_SAFE(sfp, &stp->st_selq, sf_link, sfn)
1806		selfdfree(stp, sfp);
1807	stp->st_flags = 0;
1808}
1809
1810static void selectinit(void *);
1811SYSINIT(select, SI_SUB_SYSCALLS, SI_ORDER_ANY, selectinit, NULL);
1812static void
1813selectinit(void *dummy __unused)
1814{
1815
1816	selfd_zone = uma_zcreate("selfd", sizeof(struct selfd), NULL, NULL,
1817	    NULL, NULL, UMA_ALIGN_PTR, 0);
1818	mtxpool_select = mtx_pool_create("select mtxpool", 128, MTX_DEF);
1819}
1820