xref: /dragonfly/sys/kern/sys_generic.c (revision 55f88487)
1 /*
2  * Copyright (c) 1982, 1986, 1989, 1993
3  *	The Regents of the University of California.  All rights reserved.
4  * (c) UNIX System Laboratories, Inc.
5  * All or some portions of this file are derived from material licensed
6  * to the University of California by American Telephone and Telegraph
7  * Co. or Unix System Laboratories, Inc. and are reproduced herein with
8  * the permission of UNIX System Laboratories, Inc.
9  *
10  * Redistribution and use in source and binary forms, with or without
11  * modification, are permitted provided that the following conditions
12  * are met:
13  * 1. Redistributions of source code must retain the above copyright
14  *    notice, this list of conditions and the following disclaimer.
15  * 2. Redistributions in binary form must reproduce the above copyright
16  *    notice, this list of conditions and the following disclaimer in the
17  *    documentation and/or other materials provided with the distribution.
18  * 3. Neither the name of the University nor the names of its contributors
19  *    may be used to endorse or promote products derived from this software
20  *    without specific prior written permission.
21  *
22  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
23  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
24  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
25  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
26  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
27  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
28  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
29  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
30  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
31  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
32  * SUCH DAMAGE.
33  *
34  *	@(#)sys_generic.c	8.5 (Berkeley) 1/21/94
35  * $FreeBSD: src/sys/kern/sys_generic.c,v 1.55.2.10 2001/03/17 10:39:32 peter Exp $
36  */
37 
38 #include "opt_ktrace.h"
39 
40 #include <sys/param.h>
41 #include <sys/systm.h>
42 #include <sys/sysmsg.h>
43 #include <sys/event.h>
44 #include <sys/filedesc.h>
45 #include <sys/filio.h>
46 #include <sys/fcntl.h>
47 #include <sys/file.h>
48 #include <sys/proc.h>
49 #include <sys/signalvar.h>
50 #include <sys/socketvar.h>
51 #include <sys/malloc.h>
52 #include <sys/uio.h>
53 #include <sys/kernel.h>
54 #include <sys/kern_syscall.h>
55 #include <sys/mapped_ioctl.h>
56 #include <sys/poll.h>
57 #include <sys/queue.h>
58 #include <sys/resourcevar.h>
59 #include <sys/socketops.h>
60 #include <sys/sysctl.h>
61 #include <sys/sysent.h>
62 #include <sys/buf.h>
63 #ifdef KTRACE
64 #include <sys/ktrace.h>
65 #endif
66 #include <vm/vm.h>
67 #include <vm/vm_page.h>
68 
69 #include <sys/file2.h>
70 #include <sys/spinlock2.h>
71 
72 #include <machine/limits.h>
73 
74 static MALLOC_DEFINE(M_IOCTLOPS, "ioctlops", "ioctl data buffer");
75 static MALLOC_DEFINE(M_IOCTLMAP, "ioctlmap", "mapped ioctl handler buffer");
76 static MALLOC_DEFINE(M_SELECT, "select", "select() buffer");
77 MALLOC_DEFINE(M_IOV, "iov", "large iov's");
78 
79 typedef struct kfd_set {
80         fd_mask	fds_bits[2];
81 } kfd_set;
82 
83 enum select_copyin_states {
84     COPYIN_READ, COPYIN_WRITE, COPYIN_EXCEPT, COPYIN_DONE };
85 
86 struct select_kevent_copyin_args {
87 	kfd_set		*read_set;
88 	kfd_set		*write_set;
89 	kfd_set		*except_set;
90 	int		active_set;	/* One of select_copyin_states */
91 	struct lwp	*lwp;		/* Pointer to our lwp */
92 	int		num_fds;	/* Number of file descriptors (syscall arg) */
93 	int		proc_fds;	/* Processed fd's (wraps) */
94 	int		error;		/* Returned to userland */
95 };
96 
97 struct poll_kevent_copyin_args {
98 	struct lwp	*lwp;
99 	struct pollfd	*fds;
100 	int		nfds;
101 	int		pfds;
102 	int		error;
103 };
104 
105 static struct lwkt_token mioctl_token = LWKT_TOKEN_INITIALIZER(mioctl_token);
106 
107 static int 	doselect(int nd, fd_set *in, fd_set *ou, fd_set *ex,
108 			 struct timespec *ts, int *res);
109 static int	dopoll(int nfds, struct pollfd *fds, struct timespec *ts,
110 		       int *res, int flags);
111 static int	dofileread(int, struct file *, struct uio *, int, size_t *);
112 static int	dofilewrite(int, struct file *, struct uio *, int, size_t *);
113 
114 /*
115  * Read system call.
116  *
117  * MPSAFE
118  */
119 int
120 sys_read(struct sysmsg *sysmsg, const struct read_args *uap)
121 {
122 	struct thread *td = curthread;
123 	struct uio auio;
124 	struct iovec aiov;
125 	int error;
126 
127 	if ((ssize_t)uap->nbyte < 0)
128 		error = EINVAL;
129 
130 	aiov.iov_base = uap->buf;
131 	aiov.iov_len = uap->nbyte;
132 	auio.uio_iov = &aiov;
133 	auio.uio_iovcnt = 1;
134 	auio.uio_offset = -1;
135 	auio.uio_resid = uap->nbyte;
136 	auio.uio_rw = UIO_READ;
137 	auio.uio_segflg = UIO_USERSPACE;
138 	auio.uio_td = td;
139 
140 	error = kern_preadv(uap->fd, &auio, 0, &sysmsg->sysmsg_szresult);
141 	return(error);
142 }
143 
144 /*
145  * Positioned (Pread) read system call
146  *
147  * MPSAFE
148  */
149 int
150 sys_extpread(struct sysmsg *sysmsg, const struct extpread_args *uap)
151 {
152 	struct thread *td = curthread;
153 	struct uio auio;
154 	struct iovec aiov;
155 	int error;
156 	int flags;
157 
158 	if ((ssize_t)uap->nbyte < 0)
159 		return(EINVAL);
160 
161 	aiov.iov_base = uap->buf;
162 	aiov.iov_len = uap->nbyte;
163 	auio.uio_iov = &aiov;
164 	auio.uio_iovcnt = 1;
165 	auio.uio_offset = uap->offset;
166 	auio.uio_resid = uap->nbyte;
167 	auio.uio_rw = UIO_READ;
168 	auio.uio_segflg = UIO_USERSPACE;
169 	auio.uio_td = td;
170 
171 	flags = uap->flags & O_FMASK;
172 	if (uap->offset != (off_t)-1)
173 		flags |= O_FOFFSET;
174 
175 	error = kern_preadv(uap->fd, &auio, flags, &sysmsg->sysmsg_szresult);
176 	return(error);
177 }
178 
179 /*
180  * Scatter read system call.
181  *
182  * MPSAFE
183  */
184 int
185 sys_readv(struct sysmsg *sysmsg, const struct readv_args *uap)
186 {
187 	struct thread *td = curthread;
188 	struct uio auio;
189 	struct iovec aiov[UIO_SMALLIOV], *iov = NULL;
190 	int error;
191 
192 	error = iovec_copyin(uap->iovp, &iov, aiov, uap->iovcnt,
193 			     &auio.uio_resid);
194 	if (error)
195 		return (error);
196 	auio.uio_iov = iov;
197 	auio.uio_iovcnt = uap->iovcnt;
198 	auio.uio_offset = -1;
199 	auio.uio_rw = UIO_READ;
200 	auio.uio_segflg = UIO_USERSPACE;
201 	auio.uio_td = td;
202 
203 	error = kern_preadv(uap->fd, &auio, 0, &sysmsg->sysmsg_szresult);
204 
205 	iovec_free(&iov, aiov);
206 	return (error);
207 }
208 
209 
210 /*
211  * Scatter positioned read system call.
212  *
213  * MPSAFE
214  */
215 int
216 sys_extpreadv(struct sysmsg *sysmsg, const struct extpreadv_args *uap)
217 {
218 	struct thread *td = curthread;
219 	struct uio auio;
220 	struct iovec aiov[UIO_SMALLIOV], *iov = NULL;
221 	int error;
222 	int flags;
223 
224 	error = iovec_copyin(uap->iovp, &iov, aiov, uap->iovcnt,
225 			     &auio.uio_resid);
226 	if (error)
227 		return (error);
228 	auio.uio_iov = iov;
229 	auio.uio_iovcnt = uap->iovcnt;
230 	auio.uio_offset = uap->offset;
231 	auio.uio_rw = UIO_READ;
232 	auio.uio_segflg = UIO_USERSPACE;
233 	auio.uio_td = td;
234 
235 	flags = uap->flags & O_FMASK;
236 	if (uap->offset != (off_t)-1)
237 		flags |= O_FOFFSET;
238 
239 	error = kern_preadv(uap->fd, &auio, flags, &sysmsg->sysmsg_szresult);
240 
241 	iovec_free(&iov, aiov);
242 	return(error);
243 }
244 
245 /*
246  * MPSAFE
247  */
248 int
249 kern_preadv(int fd, struct uio *auio, int flags, size_t *res)
250 {
251 	struct thread *td = curthread;
252 	struct file *fp;
253 	int error;
254 
255 	fp = holdfp(td, fd, FREAD);
256 	if (fp == NULL)
257 		return (EBADF);
258 	if (flags & O_FOFFSET && fp->f_type != DTYPE_VNODE) {
259 		error = ESPIPE;
260 	} else {
261 		error = dofileread(fd, fp, auio, flags, res);
262 	}
263 	dropfp(td, fd, fp);
264 
265 	return(error);
266 }
267 
268 /*
269  * Common code for readv and preadv that reads data in
270  * from a file using the passed in uio, offset, and flags.
271  *
272  * MPALMOSTSAFE - ktrace needs help
273  */
274 static int
275 dofileread(int fd, struct file *fp, struct uio *auio, int flags, size_t *res)
276 {
277 	int error;
278 	size_t len;
279 #ifdef KTRACE
280 	struct thread *td = curthread;
281 	struct iovec *ktriov = NULL;
282 	struct uio ktruio;
283 #endif
284 
285 #ifdef KTRACE
286 	/*
287 	 * if tracing, save a copy of iovec
288 	 */
289 	if (KTRPOINT(td, KTR_GENIO))  {
290 		int iovlen = auio->uio_iovcnt * sizeof(struct iovec);
291 
292 		ktriov = kmalloc(iovlen, M_TEMP, M_WAITOK);
293 		bcopy((caddr_t)auio->uio_iov, (caddr_t)ktriov, iovlen);
294 		ktruio = *auio;
295 	}
296 #endif
297 	len = auio->uio_resid;
298 	error = fo_read(fp, auio, fp->f_cred, flags);
299 	if (error) {
300 		if (auio->uio_resid != len && (error == ERESTART ||
301 		    error == EINTR || error == EWOULDBLOCK))
302 			error = 0;
303 	}
304 #ifdef KTRACE
305 	if (ktriov != NULL) {
306 		if (error == 0) {
307 			ktruio.uio_iov = ktriov;
308 			ktruio.uio_resid = len - auio->uio_resid;
309 			ktrgenio(td->td_lwp, fd, UIO_READ, &ktruio, error);
310 		}
311 		kfree(ktriov, M_TEMP);
312 	}
313 #endif
314 	if (error == 0)
315 		*res = len - auio->uio_resid;
316 
317 	return(error);
318 }
319 
320 /*
321  * Write system call
322  *
323  * MPSAFE
324  */
325 int
326 sys_write(struct sysmsg *sysmsg, const struct write_args *uap)
327 {
328 	struct thread *td = curthread;
329 	struct uio auio;
330 	struct iovec aiov;
331 	int error;
332 
333 	if ((ssize_t)uap->nbyte < 0)
334 		error = EINVAL;
335 
336 	aiov.iov_base = (void *)(uintptr_t)uap->buf;
337 	aiov.iov_len = uap->nbyte;
338 	auio.uio_iov = &aiov;
339 	auio.uio_iovcnt = 1;
340 	auio.uio_offset = -1;
341 	auio.uio_resid = uap->nbyte;
342 	auio.uio_rw = UIO_WRITE;
343 	auio.uio_segflg = UIO_USERSPACE;
344 	auio.uio_td = td;
345 
346 	error = kern_pwritev(uap->fd, &auio, 0, &sysmsg->sysmsg_szresult);
347 
348 	return(error);
349 }
350 
351 /*
352  * Pwrite system call
353  *
354  * MPSAFE
355  */
356 int
357 sys_extpwrite(struct sysmsg *sysmsg, const struct extpwrite_args *uap)
358 {
359 	struct thread *td = curthread;
360 	struct uio auio;
361 	struct iovec aiov;
362 	int error;
363 	int flags;
364 
365 	if ((ssize_t)uap->nbyte < 0)
366 		error = EINVAL;
367 
368 	aiov.iov_base = (void *)(uintptr_t)uap->buf;
369 	aiov.iov_len = uap->nbyte;
370 	auio.uio_iov = &aiov;
371 	auio.uio_iovcnt = 1;
372 	auio.uio_offset = uap->offset;
373 	auio.uio_resid = uap->nbyte;
374 	auio.uio_rw = UIO_WRITE;
375 	auio.uio_segflg = UIO_USERSPACE;
376 	auio.uio_td = td;
377 
378 	flags = uap->flags & O_FMASK;
379 	if (uap->offset != (off_t)-1)
380 		flags |= O_FOFFSET;
381 	error = kern_pwritev(uap->fd, &auio, flags, &sysmsg->sysmsg_szresult);
382 	return(error);
383 }
384 
385 /*
386  * MPSAFE
387  */
388 int
389 sys_writev(struct sysmsg *sysmsg, const struct writev_args *uap)
390 {
391 	struct thread *td = curthread;
392 	struct uio auio;
393 	struct iovec aiov[UIO_SMALLIOV], *iov = NULL;
394 	int error;
395 
396 	error = iovec_copyin(uap->iovp, &iov, aiov, uap->iovcnt,
397 			     &auio.uio_resid);
398 	if (error)
399 		return (error);
400 	auio.uio_iov = iov;
401 	auio.uio_iovcnt = uap->iovcnt;
402 	auio.uio_offset = -1;
403 	auio.uio_rw = UIO_WRITE;
404 	auio.uio_segflg = UIO_USERSPACE;
405 	auio.uio_td = td;
406 
407 	error = kern_pwritev(uap->fd, &auio, 0, &sysmsg->sysmsg_szresult);
408 
409 	iovec_free(&iov, aiov);
410 	return (error);
411 }
412 
413 
414 /*
415  * Gather positioned write system call
416  *
417  * MPSAFE
418  */
419 int
420 sys_extpwritev(struct sysmsg *sysmsg, const struct extpwritev_args *uap)
421 {
422 	struct thread *td = curthread;
423 	struct uio auio;
424 	struct iovec aiov[UIO_SMALLIOV], *iov = NULL;
425 	int error;
426 	int flags;
427 
428 	error = iovec_copyin(uap->iovp, &iov, aiov, uap->iovcnt,
429 			     &auio.uio_resid);
430 	if (error)
431 		return (error);
432 	auio.uio_iov = iov;
433 	auio.uio_iovcnt = uap->iovcnt;
434 	auio.uio_offset = uap->offset;
435 	auio.uio_rw = UIO_WRITE;
436 	auio.uio_segflg = UIO_USERSPACE;
437 	auio.uio_td = td;
438 
439 	flags = uap->flags & O_FMASK;
440 	if (uap->offset != (off_t)-1)
441 		flags |= O_FOFFSET;
442 
443 	error = kern_pwritev(uap->fd, &auio, flags, &sysmsg->sysmsg_szresult);
444 
445 	iovec_free(&iov, aiov);
446 	return(error);
447 }
448 
449 /*
450  * MPSAFE
451  */
452 int
453 kern_pwritev(int fd, struct uio *auio, int flags, size_t *res)
454 {
455 	struct thread *td = curthread;
456 	struct file *fp;
457 	int error;
458 
459 	fp = holdfp(td, fd, FWRITE);
460 	if (fp == NULL)
461 		return (EBADF);
462 	else if ((flags & O_FOFFSET) && fp->f_type != DTYPE_VNODE) {
463 		error = ESPIPE;
464 	} else {
465 		error = dofilewrite(fd, fp, auio, flags, res);
466 	}
467 	dropfp(td, fd, fp);
468 
469 	return(error);
470 }
471 
472 /*
473  * Common code for writev and pwritev that writes data to
474  * a file using the passed in uio, offset, and flags.
475  *
476  * MPALMOSTSAFE - ktrace needs help
477  */
478 static int
479 dofilewrite(int fd, struct file *fp, struct uio *auio, int flags, size_t *res)
480 {
481 	struct thread *td = curthread;
482 	struct lwp *lp = td->td_lwp;
483 	int error;
484 	size_t len;
485 #ifdef KTRACE
486 	struct iovec *ktriov = NULL;
487 	struct uio ktruio;
488 #endif
489 
490 #ifdef KTRACE
491 	/*
492 	 * if tracing, save a copy of iovec and uio
493 	 */
494 	if (KTRPOINT(td, KTR_GENIO))  {
495 		int iovlen = auio->uio_iovcnt * sizeof(struct iovec);
496 
497 		ktriov = kmalloc(iovlen, M_TEMP, M_WAITOK);
498 		bcopy((caddr_t)auio->uio_iov, (caddr_t)ktriov, iovlen);
499 		ktruio = *auio;
500 	}
501 #endif
502 	len = auio->uio_resid;
503 	error = fo_write(fp, auio, fp->f_cred, flags);
504 	if (error) {
505 		if (auio->uio_resid != len && (error == ERESTART ||
506 		    error == EINTR || error == EWOULDBLOCK))
507 			error = 0;
508 		/* Socket layer is responsible for issuing SIGPIPE. */
509 		if (error == EPIPE && fp->f_type != DTYPE_SOCKET)
510 			lwpsignal(lp->lwp_proc, lp, SIGPIPE);
511 	}
512 #ifdef KTRACE
513 	if (ktriov != NULL) {
514 		if (error == 0) {
515 			ktruio.uio_iov = ktriov;
516 			ktruio.uio_resid = len - auio->uio_resid;
517 			ktrgenio(lp, fd, UIO_WRITE, &ktruio, error);
518 		}
519 		kfree(ktriov, M_TEMP);
520 	}
521 #endif
522 	if (error == 0)
523 		*res = len - auio->uio_resid;
524 
525 	return(error);
526 }
527 
528 /*
529  * Ioctl system call
530  *
531  * MPSAFE
532  */
533 int
534 sys_ioctl(struct sysmsg *sysmsg, const struct ioctl_args *uap)
535 {
536 	int error;
537 
538 	error = mapped_ioctl(uap->fd, uap->com, uap->data, NULL, sysmsg);
539 	return (error);
540 }
541 
542 struct ioctl_map_entry {
543 	const char *subsys;
544 	struct ioctl_map_range *cmd_ranges;
545 	LIST_ENTRY(ioctl_map_entry) entries;
546 };
547 
548 /*
549  * The true heart of all ioctl syscall handlers (native, emulation).
550  * If map != NULL, it will be searched for a matching entry for com,
551  * and appropriate conversions/conversion functions will be utilized.
552  *
553  * MPSAFE
554  */
555 int
556 mapped_ioctl(int fd, u_long com, caddr_t uspc_data, struct ioctl_map *map,
557 	     struct sysmsg *msg)
558 {
559 	struct thread *td = curthread;
560 	struct proc *p = td->td_proc;
561 	struct ucred *cred;
562 	struct file *fp;
563 	struct ioctl_map_range *iomc = NULL;
564 	int error;
565 	u_int size;
566 	u_long ocom = com;
567 	caddr_t data, memp;
568 	int tmp;
569 #define STK_PARAMS	128
570 	union {
571 	    char stkbuf[STK_PARAMS];
572 	    long align;
573 	} ubuf;
574 
575 	KKASSERT(p);
576 	cred = td->td_ucred;
577 	memp = NULL;
578 
579 	fp = holdfp(td, fd, FREAD|FWRITE);
580 	if (fp == NULL)
581 		return(EBADF);
582 
583 	if (map != NULL) {	/* obey translation map */
584 		u_long maskcmd;
585 		struct ioctl_map_entry *e;
586 
587 		maskcmd = com & map->mask;
588 
589 		lwkt_gettoken(&mioctl_token);
590 		LIST_FOREACH(e, &map->mapping, entries) {
591 			for (iomc = e->cmd_ranges; iomc->start != 0 ||
592 			     iomc->maptocmd != 0 || iomc->wrapfunc != NULL ||
593 			     iomc->mapfunc != NULL;
594 			     iomc++) {
595 				if (maskcmd >= iomc->start &&
596 				    maskcmd <= iomc->end)
597 					break;
598 			}
599 
600 			/* Did we find a match? */
601 			if (iomc->start != 0 || iomc->maptocmd != 0 ||
602 			    iomc->wrapfunc != NULL || iomc->mapfunc != NULL)
603 				break;
604 		}
605 		lwkt_reltoken(&mioctl_token);
606 
607 		if (iomc == NULL ||
608 		    (iomc->start == 0 && iomc->maptocmd == 0
609 		     && iomc->wrapfunc == NULL && iomc->mapfunc == NULL)) {
610 			kprintf("%s: 'ioctl' fd=%d, cmd=0x%lx ('%c',%d) not implemented\n",
611 			       map->sys, fd, maskcmd,
612 			       (int)((maskcmd >> 8) & 0xff),
613 			       (int)(maskcmd & 0xff));
614 			error = EINVAL;
615 			goto done;
616 		}
617 
618 		/*
619 		 * If it's a non-range one to one mapping, maptocmd should be
620 		 * correct. If it's a ranged one to one mapping, we pass the
621 		 * original value of com, and for a range mapped to a different
622 		 * range, we always need a mapping function to translate the
623 		 * ioctl to our native ioctl. Ex. 6500-65ff <-> 9500-95ff
624 		 */
625 		if (iomc->start == iomc->end && iomc->maptocmd == iomc->maptoend) {
626 			com = iomc->maptocmd;
627 		} else if (iomc->start == iomc->maptocmd && iomc->end == iomc->maptoend) {
628 			if (iomc->mapfunc != NULL)
629 				com = iomc->mapfunc(iomc->start, iomc->end,
630 						    iomc->start, iomc->end,
631 						    com, com);
632 		} else {
633 			if (iomc->mapfunc != NULL) {
634 				com = iomc->mapfunc(iomc->start, iomc->end,
635 						    iomc->maptocmd, iomc->maptoend,
636 						    com, ocom);
637 			} else {
638 				kprintf("%s: Invalid mapping for fd=%d, cmd=%#lx ('%c',%d)\n",
639 				       map->sys, fd, maskcmd,
640 				       (int)((maskcmd >> 8) & 0xff),
641 				       (int)(maskcmd & 0xff));
642 				error = EINVAL;
643 				goto done;
644 			}
645 		}
646 	}
647 
648 	switch (com) {
649 	case FIONCLEX:
650 		error = fclrfdflags(p->p_fd, fd, UF_EXCLOSE);
651 		goto done;
652 	case FIOCLEX:
653 		error = fsetfdflags(p->p_fd, fd, UF_EXCLOSE);
654 		goto done;
655 	}
656 
657 	/*
658 	 * Interpret high order word to find amount of data to be
659 	 * copied to/from the user's address space.
660 	 */
661 	size = IOCPARM_LEN(com);
662 	if (size > IOCPARM_MAX) {
663 		error = ENOTTY;
664 		goto done;
665 	}
666 
667 	if ((com & IOC_VOID) == 0 && size > sizeof(ubuf.stkbuf)) {
668 		memp = kmalloc(size, M_IOCTLOPS, M_WAITOK);
669 		data = memp;
670 	} else {
671 		memp = NULL;
672 		data = ubuf.stkbuf;
673 	}
674 	if (com & IOC_VOID) {
675 		*(caddr_t *)data = uspc_data;
676 	} else if (com & IOC_IN) {
677 		if (size != 0) {
678 			error = copyin(uspc_data, data, (size_t)size);
679 			if (error)
680 				goto done;
681 		} else {
682 			*(caddr_t *)data = uspc_data;
683 		}
684 	} else if ((com & IOC_OUT) != 0 && size) {
685 		/*
686 		 * Zero the buffer so the user always
687 		 * gets back something deterministic.
688 		 */
689 		bzero(data, (size_t)size);
690 	}
691 
692 	switch (com) {
693 	case FIONBIO:
694 		if ((tmp = *(int *)data))
695 			atomic_set_int(&fp->f_flag, FNONBLOCK);
696 		else
697 			atomic_clear_int(&fp->f_flag, FNONBLOCK);
698 		error = 0;
699 		break;
700 
701 	case FIOASYNC:
702 		if ((tmp = *(int *)data))
703 			atomic_set_int(&fp->f_flag, FASYNC);
704 		else
705 			atomic_clear_int(&fp->f_flag, FASYNC);
706 		error = fo_ioctl(fp, FIOASYNC, (caddr_t)&tmp, cred, msg);
707 		break;
708 
709 	default:
710 		/*
711 		 *  If there is a override function,
712 		 *  call it instead of directly routing the call
713 		 */
714 		if (map != NULL && iomc->wrapfunc != NULL)
715 			error = iomc->wrapfunc(fp, com, ocom, data, cred);
716 		else
717 			error = fo_ioctl(fp, com, data, cred, msg);
718 		/*
719 		 * Copy any data to user, size was
720 		 * already set and checked above.
721 		 */
722 		if (error == 0 && (com & IOC_OUT) != 0 && size != 0)
723 			error = copyout(data, uspc_data, (size_t)size);
724 		break;
725 	}
726 done:
727 	if (memp != NULL)
728 		kfree(memp, M_IOCTLOPS);
729 	dropfp(td, fd, fp);
730 
731 	return(error);
732 }
733 
734 /*
735  * MPSAFE
736  */
737 int
738 mapped_ioctl_register_handler(struct ioctl_map_handler *he)
739 {
740 	struct ioctl_map_entry *ne;
741 
742 	KKASSERT(he != NULL && he->map != NULL && he->cmd_ranges != NULL &&
743 		 he->subsys != NULL && *he->subsys != '\0');
744 
745 	ne = kmalloc(sizeof(struct ioctl_map_entry), M_IOCTLMAP,
746 		     M_WAITOK | M_ZERO);
747 
748 	ne->subsys = he->subsys;
749 	ne->cmd_ranges = he->cmd_ranges;
750 
751 	lwkt_gettoken(&mioctl_token);
752 	LIST_INSERT_HEAD(&he->map->mapping, ne, entries);
753 	lwkt_reltoken(&mioctl_token);
754 
755 	return(0);
756 }
757 
758 /*
759  * MPSAFE
760  */
761 int
762 mapped_ioctl_unregister_handler(struct ioctl_map_handler *he)
763 {
764 	struct ioctl_map_entry *ne;
765 	int error = EINVAL;
766 
767 	KKASSERT(he != NULL && he->map != NULL && he->cmd_ranges != NULL);
768 
769 	lwkt_gettoken(&mioctl_token);
770 	LIST_FOREACH(ne, &he->map->mapping, entries) {
771 		if (ne->cmd_ranges == he->cmd_ranges) {
772 			LIST_REMOVE(ne, entries);
773 			kfree(ne, M_IOCTLMAP);
774 			error = 0;
775 			break;
776 		}
777 	}
778 	lwkt_reltoken(&mioctl_token);
779 	return(error);
780 }
781 
782 static int	nseldebug;
783 SYSCTL_INT(_kern, OID_AUTO, nseldebug, CTLFLAG_RW, &nseldebug, 0, "");
784 
785 /*
786  * Select system call.
787  *
788  * MPSAFE
789  */
790 int
791 sys_select(struct sysmsg *sysmsg, const struct select_args *uap)
792 {
793 	struct timeval ktv;
794 	struct timespec *ktsp, kts;
795 	int error;
796 
797 	/*
798 	 * Get timeout if any.
799 	 */
800 	if (uap->tv != NULL) {
801 		error = copyin(uap->tv, &ktv, sizeof (ktv));
802 		if (error)
803 			return (error);
804 		TIMEVAL_TO_TIMESPEC(&ktv, &kts);
805 		ktsp = &kts;
806 	} else {
807 		ktsp = NULL;
808 	}
809 
810 	/*
811 	 * Do real work.
812 	 */
813 	error = doselect(uap->nd, uap->in, uap->ou, uap->ex, ktsp,
814 			 &sysmsg->sysmsg_result);
815 
816 	return (error);
817 }
818 
819 
820 /*
821  * Pselect system call.
822  */
823 int
824 sys_pselect(struct sysmsg *sysmsg, const struct pselect_args *uap)
825 {
826 	struct thread *td = curthread;
827 	struct lwp *lp = td->td_lwp;
828 	struct timespec *ktsp, kts;
829 	sigset_t sigmask;
830 	int error;
831 
832 	/*
833 	 * Get timeout if any.
834 	 */
835 	if (uap->ts != NULL) {
836 		error = copyin(uap->ts, &kts, sizeof (kts));
837 		if (error)
838 			return (error);
839 		ktsp = &kts;
840 	} else {
841 		ktsp = NULL;
842 	}
843 
844 	/*
845 	 * Install temporary signal mask if any provided.
846 	 */
847 	if (uap->sigmask != NULL) {
848 		error = copyin(uap->sigmask, &sigmask, sizeof(sigmask));
849 		if (error)
850 			return (error);
851 		lwkt_gettoken(&lp->lwp_proc->p_token);
852 		lp->lwp_oldsigmask = lp->lwp_sigmask;
853 		SIG_CANTMASK(sigmask);
854 		lp->lwp_sigmask = sigmask;
855 		lwkt_reltoken(&lp->lwp_proc->p_token);
856 	}
857 
858 	/*
859 	 * Do real job.
860 	 */
861 	error = doselect(uap->nd, uap->in, uap->ou, uap->ex, ktsp,
862 			 &sysmsg->sysmsg_result);
863 
864 	if (uap->sigmask != NULL) {
865 		lwkt_gettoken(&lp->lwp_proc->p_token);
866 		/* doselect() responsible for turning ERESTART into EINTR */
867 		KKASSERT(error != ERESTART);
868 		if (error == EINTR) {
869 			/*
870 			 * We can't restore the previous signal mask now
871 			 * because it could block the signal that interrupted
872 			 * us.  So make a note to restore it after executing
873 			 * the handler.
874 			 */
875 			lp->lwp_flags |= LWP_OLDMASK;
876 		} else {
877 			/*
878 			 * No handler to run. Restore previous mask immediately.
879 			 */
880 			lp->lwp_sigmask = lp->lwp_oldsigmask;
881 		}
882 		lwkt_reltoken(&lp->lwp_proc->p_token);
883 	}
884 
885 	return (error);
886 }
887 
888 static int
889 select_copyin(void *arg, struct kevent *kevp, int maxevents, int *events)
890 {
891 	struct select_kevent_copyin_args *skap = NULL;
892 	struct kevent *kev;
893 	int fd;
894 	kfd_set *fdp = NULL;
895 	short filter = 0;
896 	u_int fflags = 0;
897 
898 	skap = (struct select_kevent_copyin_args *)arg;
899 
900 	if (*events == maxevents)
901 		return (0);
902 
903 	while (skap->active_set < COPYIN_DONE) {
904 		switch (skap->active_set) {
905 		case COPYIN_READ:
906 			/*
907 			 * Register descriptors for the read filter
908 			 */
909 			fdp = skap->read_set;
910 			filter = EVFILT_READ;
911 			fflags = NOTE_OLDAPI;
912 			if (fdp)
913 				break;
914 			++skap->active_set;
915 			skap->proc_fds = 0;
916 			/* fall through */
917 		case COPYIN_WRITE:
918 			/*
919 			 * Register descriptors for the write filter
920 			 */
921 			fdp = skap->write_set;
922 			filter = EVFILT_WRITE;
923 			fflags = NOTE_OLDAPI;
924 			if (fdp)
925 				break;
926 			++skap->active_set;
927 			skap->proc_fds = 0;
928 			/* fall through */
929 		case COPYIN_EXCEPT:
930 			/*
931 			 * Register descriptors for the exception filter
932 			 */
933 			fdp = skap->except_set;
934 			filter = EVFILT_EXCEPT;
935 			fflags = NOTE_OLDAPI | NOTE_OOB;
936 			if (fdp)
937 				break;
938 			++skap->active_set;
939 			skap->proc_fds = 0;
940 			/* fall through */
941 		case COPYIN_DONE:
942 			/*
943 			 * Nothing left to register
944 			 */
945 			return(0);
946 			/* NOT REACHED */
947 		}
948 
949 		while (skap->proc_fds < skap->num_fds) {
950 			fd = skap->proc_fds;
951 			if (FD_ISSET(fd, fdp)) {
952 				kev = &kevp[*events];
953 				EV_SET(kev, fd, filter,
954 				       EV_ADD|EV_ENABLE,
955 				       fflags, 0,
956 				       (void *)(uintptr_t)
957 					skap->lwp->lwp_kqueue_serial);
958 				FD_CLR(fd, fdp);
959 				++*events;
960 
961 				if (nseldebug) {
962 					kprintf("select fd %d filter %d "
963 					    "serial %ju\n", fd, filter,
964 					    (uintmax_t)
965 					    skap->lwp->lwp_kqueue_serial);
966 				}
967 			}
968 			++skap->proc_fds;
969 			if (*events == maxevents)
970 				return (0);
971 		}
972 		skap->active_set++;
973 		skap->proc_fds = 0;
974 	}
975 
976 	return (0);
977 }
978 
979 static int
980 select_copyout(void *arg, struct kevent *kevp, int count, int *res)
981 {
982 	struct select_kevent_copyin_args *skap;
983 	struct kevent kev;
984 	int i;
985 	int n;
986 
987 	skap = (struct select_kevent_copyin_args *)arg;
988 
989 	for (i = 0; i < count; ++i) {
990 		/*
991 		 * Filter out and delete spurious events
992 		 */
993 		if ((uint64_t)(uintptr_t)kevp[i].udata !=
994 		    skap->lwp->lwp_kqueue_serial)
995 		{
996 			panic("select_copyout: unexpected udata");
997 deregister:
998 			kev = kevp[i];
999 			kev.flags = EV_DISABLE|EV_DELETE;
1000 			n = 1;
1001 			kqueue_register(&skap->lwp->lwp_kqueue, &kev, &n);
1002 			if (nseldebug) {
1003 				kprintf("select fd %ju mismatched serial %ju\n",
1004 				    (uintmax_t)kevp[i].ident,
1005 				    (uintmax_t)skap->lwp->lwp_kqueue_serial);
1006 			}
1007 			continue;
1008 		}
1009 
1010 		/*
1011 		 * Handle errors
1012 		 */
1013 		if (kevp[i].flags & EV_ERROR) {
1014 			int error = kevp[i].data;
1015 
1016 			switch (error) {
1017 			case EBADF:
1018 				/*
1019 				 * A bad file descriptor is considered a
1020 				 * fatal error for select, bail out.
1021 				 */
1022 				skap->error = error;
1023 				*res = -1;
1024 				return error;
1025 
1026 			default:
1027 				/*
1028 				 * Select silently swallows any unknown errors
1029 				 * for descriptors in the read or write sets.
1030 				 *
1031 				 * ALWAYS filter out EOPNOTSUPP errors from
1032 				 * filters (at least until all filters support
1033 				 * EVFILT_EXCEPT)
1034 				 *
1035 				 * We also filter out ENODEV since dev_dkqfilter
1036 				 * returns ENODEV if EOPNOTSUPP is returned in an
1037 				 * inner call.
1038 				 *
1039 				 * XXX: fix this
1040 				 */
1041 				if (kevp[i].filter != EVFILT_READ &&
1042 				    kevp[i].filter != EVFILT_WRITE &&
1043 				    error != EOPNOTSUPP &&
1044 				    error != ENODEV) {
1045 					skap->error = error;
1046 					*res = -1;
1047 					return error;
1048 				}
1049 				break;
1050 			}
1051 
1052 			/*
1053 			 * We must deregister any unsupported select events
1054 			 * to avoid a live-lock.
1055 			 */
1056 			if (nseldebug) {
1057 				kprintf("select fd %ju filter %d error %d\n",
1058 					(uintmax_t)kevp[i].ident,
1059 					kevp[i].filter, error);
1060 			}
1061 			goto deregister;
1062 		}
1063 
1064 		switch (kevp[i].filter) {
1065 		case EVFILT_READ:
1066 			FD_SET(kevp[i].ident, skap->read_set);
1067 			break;
1068 		case EVFILT_WRITE:
1069 			FD_SET(kevp[i].ident, skap->write_set);
1070 			break;
1071 		case EVFILT_EXCEPT:
1072 			FD_SET(kevp[i].ident, skap->except_set);
1073 			break;
1074 		}
1075 
1076 		++*res;
1077 	}
1078 
1079 	return (0);
1080 }
1081 
1082 /*
1083  * Copy select bits in from userland.  Allocate kernel memory if the
1084  * set is large.
1085  */
1086 static int
1087 getbits(int bytes, fd_set *in_set, kfd_set **out_set, kfd_set *tmp_set)
1088 {
1089 	int error;
1090 
1091 	if (in_set) {
1092 		if (bytes < sizeof(*tmp_set))
1093 			*out_set = tmp_set;
1094 		else
1095 			*out_set = kmalloc(bytes, M_SELECT, M_WAITOK);
1096 		error = copyin(in_set, *out_set, bytes);
1097 	} else {
1098 		*out_set = NULL;
1099 		error = 0;
1100 	}
1101 	return (error);
1102 }
1103 
1104 /*
1105  * Copy returned select bits back out to userland.
1106  */
1107 static int
1108 putbits(int bytes, kfd_set *in_set, fd_set *out_set)
1109 {
1110 	int error;
1111 
1112 	if (in_set) {
1113 		error = copyout(in_set, out_set, bytes);
1114 	} else {
1115 		error = 0;
1116 	}
1117 	return (error);
1118 }
1119 
1120 static int
1121 dotimeout_only(struct timespec *ts)
1122 {
1123 	return(nanosleep1(ts, NULL));
1124 }
1125 
1126 /*
1127  * Common code for sys_select() and sys_pselect().
1128  *
1129  * in, out and ex are userland pointers.  ts must point to validated
1130  * kernel-side timeout value or NULL for infinite timeout.  res must
1131  * point to syscall return value.
1132  */
1133 static int
1134 doselect(int nd, fd_set *read, fd_set *write, fd_set *except,
1135 	 struct timespec *ts, int *res)
1136 {
1137 	struct proc *p = curproc;
1138 	struct select_kevent_copyin_args *kap, ka;
1139 	int bytes, error;
1140 	kfd_set read_tmp;
1141 	kfd_set write_tmp;
1142 	kfd_set except_tmp;
1143 
1144 	*res = 0;
1145 	if (nd < 0)
1146 		return (EINVAL);
1147 	if (nd == 0 && ts)
1148 		return (dotimeout_only(ts));
1149 
1150 	if (nd > p->p_fd->fd_nfiles)		/* limit kmalloc */
1151 		nd = p->p_fd->fd_nfiles;
1152 
1153 	kap = &ka;
1154 	kap->lwp = curthread->td_lwp;
1155 	kap->num_fds = nd;
1156 	kap->proc_fds = 0;
1157 	kap->error = 0;
1158 	kap->active_set = COPYIN_READ;
1159 
1160 	/*
1161 	 * Calculate bytes based on the number of __fd_mask[] array entries
1162 	 * multiplied by the size of __fd_mask.
1163 	 */
1164 	bytes = howmany(nd, __NFDBITS) * sizeof(__fd_mask);
1165 
1166 	/* kap->read_set = NULL; not needed */
1167 	kap->write_set = NULL;
1168 	kap->except_set = NULL;
1169 
1170 	error = getbits(bytes, read, &kap->read_set, &read_tmp);
1171 	if (error == 0)
1172 		error = getbits(bytes, write, &kap->write_set, &write_tmp);
1173 	if (error == 0)
1174 		error = getbits(bytes, except, &kap->except_set, &except_tmp);
1175 	if (error)
1176 		goto done;
1177 
1178 	/*
1179 	 * NOTE: Make sure the max events passed to kern_kevent() is
1180 	 *	 effectively unlimited.  (nd * 3) accomplishes this.
1181 	 *
1182 	 *	 (*res) continues to increment as returned events are
1183 	 *	 loaded in.
1184 	 */
1185 	error = kern_kevent(&kap->lwp->lwp_kqueue, 0x7FFFFFFF, res, kap,
1186 			    select_copyin, select_copyout, ts,
1187 			    KEVENT_AUTO_STALE);
1188 	if (error == 0)
1189 		error = putbits(bytes, kap->read_set, read);
1190 	if (error == 0)
1191 		error = putbits(bytes, kap->write_set, write);
1192 	if (error == 0)
1193 		error = putbits(bytes, kap->except_set, except);
1194 
1195 	/*
1196 	 * An error from an individual event that should be passed
1197 	 * back to userland (EBADF)
1198 	 */
1199 	if (kap->error)
1200 		error = kap->error;
1201 
1202 	/*
1203 	 * Clean up.
1204 	 */
1205 done:
1206 	if (kap->read_set && kap->read_set != &read_tmp)
1207 		kfree(kap->read_set, M_SELECT);
1208 	if (kap->write_set && kap->write_set != &write_tmp)
1209 		kfree(kap->write_set, M_SELECT);
1210 	if (kap->except_set && kap->except_set != &except_tmp)
1211 		kfree(kap->except_set, M_SELECT);
1212 
1213 	kap->lwp->lwp_kqueue_serial += kap->num_fds;
1214 
1215 	return (error);
1216 }
1217 
1218 /*
1219  * Poll system call.
1220  *
1221  * MPSAFE
1222  */
1223 int
1224 sys_poll(struct sysmsg *sysmsg, const struct poll_args *uap)
1225 {
1226 	struct timespec ts, *tsp;
1227 	int error;
1228 
1229 	if (uap->timeout != INFTIM) {
1230 		if (uap->timeout < 0)
1231 			return (EINVAL);
1232 		ts.tv_sec = uap->timeout / 1000;
1233 		ts.tv_nsec = (uap->timeout % 1000) * 1000 * 1000;
1234 		tsp = &ts;
1235 	} else {
1236 		tsp = NULL;
1237 	}
1238 
1239 	error = dopoll(uap->nfds, uap->fds, tsp, &sysmsg->sysmsg_result, 0);
1240 
1241 	return (error);
1242 }
1243 
1244 /*
1245  * Ppoll system call.
1246  *
1247  * MPSAFE
1248  */
1249 int
1250 sys_ppoll(struct sysmsg *sysmsg, const struct ppoll_args *uap)
1251 {
1252 	struct thread *td = curthread;
1253 	struct lwp *lp = td->td_lwp;
1254 	struct timespec *ktsp, kts;
1255 	sigset_t sigmask;
1256 	int error;
1257 
1258 	/*
1259 	 * Get timeout if any.
1260 	 */
1261 	if (uap->ts != NULL) {
1262 		error = copyin(uap->ts, &kts, sizeof (kts));
1263 		if (error)
1264 			return (error);
1265 		ktsp = &kts;
1266 	} else {
1267 		ktsp = NULL;
1268 	}
1269 
1270 	/*
1271 	 * Install temporary signal mask if any provided.
1272 	 */
1273 	if (uap->sigmask != NULL) {
1274 		error = copyin(uap->sigmask, &sigmask, sizeof(sigmask));
1275 		if (error)
1276 			return (error);
1277 		lwkt_gettoken(&lp->lwp_proc->p_token);
1278 		lp->lwp_oldsigmask = lp->lwp_sigmask;
1279 		SIG_CANTMASK(sigmask);
1280 		lp->lwp_sigmask = sigmask;
1281 		lwkt_reltoken(&lp->lwp_proc->p_token);
1282 	}
1283 
1284 	error = dopoll(uap->nfds, uap->fds, ktsp, &sysmsg->sysmsg_result,
1285 	    ktsp != NULL ? KEVENT_TIMEOUT_PRECISE : 0);
1286 
1287 	if (uap->sigmask != NULL) {
1288 		lwkt_gettoken(&lp->lwp_proc->p_token);
1289 		/* dopoll() responsible for turning ERESTART into EINTR */
1290 		KKASSERT(error != ERESTART);
1291 		if (error == EINTR) {
1292 			/*
1293 			 * We can't restore the previous signal mask now
1294 			 * because it could block the signal that interrupted
1295 			 * us.  So make a note to restore it after executing
1296 			 * the handler.
1297 			 */
1298 			lp->lwp_flags |= LWP_OLDMASK;
1299 		} else {
1300 			/*
1301 			 * No handler to run. Restore previous mask immediately.
1302 			 */
1303 			lp->lwp_sigmask = lp->lwp_oldsigmask;
1304 		}
1305 		lwkt_reltoken(&lp->lwp_proc->p_token);
1306 	}
1307 
1308 	return (error);
1309 }
1310 
1311 static int
1312 poll_copyin(void *arg, struct kevent *kevp, int maxevents, int *events)
1313 {
1314 	struct poll_kevent_copyin_args *pkap;
1315 	struct pollfd *pfd;
1316 	struct kevent *kev;
1317 	int kev_count;
1318 
1319 	pkap = (struct poll_kevent_copyin_args *)arg;
1320 
1321 	while (pkap->pfds < pkap->nfds) {
1322 		pfd = &pkap->fds[pkap->pfds];
1323 
1324 		/* Clear return events */
1325 		pfd->revents = 0;
1326 
1327 		/* Do not check if fd is equal to -1 */
1328 		if (pfd->fd == -1) {
1329 			++pkap->pfds;
1330 			continue;
1331 		}
1332 
1333 		kev_count = 0;
1334 		if (pfd->events & (POLLIN | POLLHUP | POLLRDNORM))
1335 			kev_count++;
1336 		if (pfd->events & (POLLOUT | POLLWRNORM))
1337 			kev_count++;
1338 		if (pfd->events & (POLLPRI | POLLRDBAND))
1339 			kev_count++;
1340 
1341 		if (*events + kev_count > maxevents)
1342 			return (0);
1343 
1344 		/*
1345 		 * NOTE: A combined serial number and poll array index is
1346 		 * stored in kev->udata.
1347 		 */
1348 		kev = &kevp[*events];
1349 		if (pfd->events & (POLLIN | POLLHUP | POLLRDNORM)) {
1350 			int notes = NOTE_OLDAPI;
1351 			if ((pfd->events & (POLLIN | POLLRDNORM)) == 0)
1352 				notes |= NOTE_HUPONLY;
1353 
1354 			EV_SET(kev++, pfd->fd, EVFILT_READ, EV_ADD|EV_ENABLE,
1355 			       notes, 0, (void *)(uintptr_t)
1356 				(pkap->lwp->lwp_kqueue_serial + pkap->pfds));
1357 		}
1358 		if (pfd->events & (POLLOUT | POLLWRNORM)) {
1359 			EV_SET(kev++, pfd->fd, EVFILT_WRITE, EV_ADD|EV_ENABLE,
1360 			       NOTE_OLDAPI, 0, (void *)(uintptr_t)
1361 				(pkap->lwp->lwp_kqueue_serial + pkap->pfds));
1362 		}
1363 		if (pfd->events & (POLLPRI | POLLRDBAND)) {
1364 			EV_SET(kev++, pfd->fd, EVFILT_EXCEPT, EV_ADD|EV_ENABLE,
1365 			       NOTE_OLDAPI | NOTE_OOB, 0,
1366 			       (void *)(uintptr_t)
1367 				(pkap->lwp->lwp_kqueue_serial + pkap->pfds));
1368 		}
1369 
1370 		if (nseldebug) {
1371 			kprintf("poll index %d/%d fd %d events %08x "
1372 			    "serial %ju\n", pkap->pfds, pkap->nfds-1,
1373 			    pfd->fd, pfd->events,
1374 			    (uintmax_t)pkap->lwp->lwp_kqueue_serial);
1375 		}
1376 
1377 		++pkap->pfds;
1378 		(*events) += kev_count;
1379 	}
1380 
1381 	return (0);
1382 }
1383 
1384 static int
1385 poll_copyout(void *arg, struct kevent *kevp, int count, int *res)
1386 {
1387 	struct poll_kevent_copyin_args *pkap;
1388 	struct pollfd *pfd;
1389 	struct kevent kev;
1390 	int count_res;
1391 	int i;
1392 	int n;
1393 	uint64_t pi;
1394 
1395 	pkap = (struct poll_kevent_copyin_args *)arg;
1396 
1397 	for (i = 0; i < count; ++i) {
1398 		/*
1399 		 * Extract the poll array index and delete spurious events.
1400 		 * We can easily tell if the serial number is incorrect
1401 		 * by checking whether the extracted index is out of range.
1402 		 */
1403 		pi = (uint64_t)(uintptr_t)kevp[i].udata -
1404 		     pkap->lwp->lwp_kqueue_serial;
1405 		if (pi >= pkap->nfds) {
1406 			panic("poll_copyout: unexpected udata");
1407 deregister:
1408 			kev = kevp[i];
1409 			kev.flags = EV_DISABLE|EV_DELETE;
1410 			n = 1;
1411 			kqueue_register(&pkap->lwp->lwp_kqueue, &kev, &n);
1412 			if (nseldebug) {
1413 				kprintf("poll index %ju out of range against "
1414 				    "serial %ju\n", (uintmax_t)pi,
1415 				    (uintmax_t)pkap->lwp->lwp_kqueue_serial);
1416 			}
1417 			continue;
1418 		}
1419 
1420 		/*
1421 		 * Locate the pollfd and process events
1422 		 */
1423 		pfd = &pkap->fds[pi];
1424 		if (kevp[i].ident == pfd->fd) {
1425 			/*
1426 			 * A single descriptor may generate an error against
1427 			 * more than one filter, make sure to set the
1428 			 * appropriate flags but do not increment (*res)
1429 			 * more than once.
1430 			 */
1431 			count_res = (pfd->revents == 0);
1432 			if (kevp[i].flags & EV_ERROR) {
1433 				switch(kevp[i].data) {
1434 				case EBADF:
1435 				case POLLNVAL:
1436 					/* Bad file descriptor */
1437 					if (count_res)
1438 						++*res;
1439 					pfd->revents |= POLLNVAL;
1440 					break;
1441 				default:
1442 					/*
1443 					 * Poll silently swallows any unknown
1444 					 * errors except in the case of POLLPRI
1445 					 * (OOB/urgent data).
1446 					 *
1447 					 * ALWAYS filter out EOPNOTSUPP errors
1448 					 * from filters, common applications
1449 					 * set POLLPRI|POLLRDBAND and most
1450 					 * filters do not support EVFILT_EXCEPT.
1451 					 *
1452 					 * We also filter out ENODEV since
1453 					 * dev_dkqfilter returns ENODEV if
1454 					 * EOPNOTSUPP is returned in an
1455 					 * inner call.
1456 					 *
1457 					 * XXX: fix this
1458 					 */
1459 					if (kevp[i].filter != EVFILT_READ &&
1460 					    kevp[i].filter != EVFILT_WRITE &&
1461 					    kevp[i].data != EOPNOTSUPP &&
1462 					    kevp[i].data != ENODEV) {
1463 						if (count_res)
1464 							++*res;
1465 						pfd->revents |= POLLERR;
1466 					}
1467 					break;
1468 				}
1469 				if (pfd->revents == 0 && nseldebug) {
1470 					kprintf("poll index EV_ERROR %ju fd %d "
1471 						"filter %d error %jd\n",
1472 						(uintmax_t)pi, pfd->fd,
1473 						kevp[i].filter,
1474 						(intmax_t)kevp[i].data);
1475 				}
1476 
1477 				/*
1478 				 * Silently deregister any unhandled EV_ERROR
1479 				 * condition (usually EOPNOTSUPP).
1480 				 */
1481 				if (pfd->revents == 0)
1482 					goto deregister;
1483 				continue;
1484 			}
1485 
1486 			switch (kevp[i].filter) {
1487 			case EVFILT_READ:
1488 				/*
1489 				 * NODATA on the read side can indicate a
1490 				 * half-closed situation and not necessarily
1491 				 * a disconnect, so depend on the user
1492 				 * issuing a read() and getting 0 bytes back.
1493 				 *
1494 				 * If EV_HUP is set the peer completely
1495 				 * disconnected and we can set POLLHUP.
1496 				 * Linux can return POLLHUP even if read
1497 				 * data has not been drained, so we should
1498 				 * too.
1499 				 */
1500 				/* if (kevp[i].flags & EV_NODATA) */ {
1501 					if (kevp[i].flags & EV_HUP)
1502 						pfd->revents |= POLLHUP;
1503 				}
1504 				if ((kevp[i].flags & EV_EOF) &&
1505 				    kevp[i].fflags != 0)
1506 					pfd->revents |= POLLERR;
1507 				if (pfd->events & POLLIN)
1508 					pfd->revents |= POLLIN;
1509 				if (pfd->events & POLLRDNORM)
1510 					pfd->revents |= POLLRDNORM;
1511 				break;
1512 			case EVFILT_WRITE:
1513 				/*
1514 				 * As per the OpenGroup POLLHUP is mutually
1515 				 * exclusive with the writability flags.  I
1516 				 * consider this a bit broken but...
1517 				 *
1518 				 * In this case a disconnect is implied even
1519 				 * for a half-closed (write side) situation.
1520 				 */
1521 				if (kevp[i].flags & EV_EOF) {
1522 					pfd->revents |= POLLHUP;
1523 					if (kevp[i].fflags != 0)
1524 						pfd->revents |= POLLERR;
1525 				} else {
1526 					if (pfd->events & POLLOUT)
1527 						pfd->revents |= POLLOUT;
1528 					if (pfd->events & POLLWRNORM)
1529 						pfd->revents |= POLLWRNORM;
1530 				}
1531 				break;
1532 			case EVFILT_EXCEPT:
1533 				/*
1534 				 * EV_NODATA should never be tagged for this
1535 				 * filter.
1536 				 */
1537 				if (pfd->events & POLLPRI)
1538 					pfd->revents |= POLLPRI;
1539 				if (pfd->events & POLLRDBAND)
1540 					pfd->revents |= POLLRDBAND;
1541 				break;
1542 			}
1543 
1544 			if (nseldebug) {
1545 				kprintf("poll index %ju/%d fd %d "
1546 				    "revents %08x\n", (uintmax_t)pi, pkap->nfds,
1547 				    pfd->fd, pfd->revents);
1548 			}
1549 
1550 			if (count_res && pfd->revents)
1551 				++*res;
1552 		}
1553 
1554 		/*
1555 		 * We must deregister any kqueue poll event that does not
1556 		 * set poll return bits to prevent a live-lock.
1557 		 */
1558 		if (pfd->revents == 0) {
1559 			kprintf("poll index %ju no-action %ju/%d "
1560 				"events=%08x kevpfilt=%d/%08x\n",
1561 			    (uintmax_t)pi, (uintmax_t)kevp[i].ident,
1562 			    pfd->fd, pfd->events,
1563 			    kevp[i].filter, kevp[i].flags);
1564 			goto deregister;
1565 		}
1566 	}
1567 
1568 	return (0);
1569 }
1570 
1571 static int
1572 dopoll(int nfds, struct pollfd *fds, struct timespec *ts, int *res, int flags)
1573 {
1574 	struct poll_kevent_copyin_args ka;
1575 	struct pollfd sfds[64];
1576 	int bytes;
1577 	int error;
1578 
1579 	flags |= KEVENT_AUTO_STALE;
1580 
1581         *res = 0;
1582         if (nfds < 0)
1583                 return (EINVAL);
1584 
1585 	if (nfds == 0 && ts)
1586 		return (dotimeout_only(ts));
1587 
1588 	/*
1589 	 * This is a bit arbitrary but we need to limit internal kmallocs.
1590 	 */
1591         if (nfds > maxfilesperproc * 2)
1592                 nfds = maxfilesperproc * 2;
1593 	bytes = sizeof(struct pollfd) * nfds;
1594 
1595 	ka.lwp = curthread->td_lwp;
1596 	ka.nfds = nfds;
1597 	ka.pfds = 0;
1598 	ka.error = 0;
1599 
1600 	if (ka.nfds < 64)
1601 		ka.fds = sfds;
1602 	else
1603 		ka.fds = kmalloc(bytes, M_SELECT, M_WAITOK);
1604 
1605 	error = copyin(fds, ka.fds, bytes);
1606 	if (error == 0)
1607 		error = kern_kevent(&ka.lwp->lwp_kqueue, 0x7FFFFFFF, res, &ka,
1608 				    poll_copyin, poll_copyout, ts, flags);
1609 
1610 	if (error == 0)
1611 		error = copyout(ka.fds, fds, bytes);
1612 
1613 	if (ka.fds != sfds)
1614 		kfree(ka.fds, M_SELECT);
1615 
1616 	ka.lwp->lwp_kqueue_serial += nfds;
1617 
1618 	return (error);
1619 }
1620 
1621 static int
1622 socket_wait_copyin(void *arg, struct kevent *kevp, int maxevents, int *events)
1623 {
1624 	return (0);
1625 }
1626 
1627 static int
1628 socket_wait_copyout(void *arg, struct kevent *kevp, int count, int *res)
1629 {
1630 	++*res;
1631 	return (0);
1632 }
1633 
1634 extern	struct fileops socketops;
1635 
1636 /*
1637  * NOTE: Callers of socket_wait() must already have a reference on the
1638  *	 socket.
1639  */
1640 int
1641 socket_wait(struct socket *so, struct timespec *ts, int *res)
1642 {
1643 	struct thread *td = curthread;
1644 	struct file *fp;
1645 	struct kqueue kq;
1646 	struct kevent kev;
1647 	int error, fd;
1648 	int n;
1649 
1650 	if ((error = falloc(td->td_lwp, &fp, &fd)) != 0)
1651 		return (error);
1652 
1653 	fp->f_type = DTYPE_SOCKET;
1654 	fp->f_flag = FREAD | FWRITE;
1655 	fp->f_ops = &socketops;
1656 	fp->f_data = so;
1657 	fsetfd(td->td_lwp->lwp_proc->p_fd, fp, fd);
1658 	fsetfdflags(td->td_proc->p_fd, fd, UF_EXCLOSE);
1659 
1660 	bzero(&kq, sizeof(kq));
1661 	kqueue_init(&kq, td->td_lwp->lwp_proc->p_fd);
1662 	EV_SET(&kev, fd, EVFILT_READ, EV_ADD|EV_ENABLE, 0, 0, NULL);
1663 	n = 1;
1664 	if ((error = kqueue_register(&kq, &kev, &n)) != 0) {
1665 		fdrop(fp);
1666 		return (error);
1667 	}
1668 
1669 	error = kern_kevent(&kq, 1, res, NULL, socket_wait_copyin,
1670 			    socket_wait_copyout, ts, 0);
1671 
1672 	EV_SET(&kev, fd, EVFILT_READ, EV_DELETE|EV_DISABLE, 0, 0, NULL);
1673 	n = 1;
1674 	kqueue_register(&kq, &kev, &n);
1675 	fp->f_ops = &badfileops;
1676 	fdrop(fp);
1677 
1678 	return (error);
1679 }
1680 
1681 /*
1682  * OpenBSD poll system call.
1683  * XXX this isn't quite a true representation..  OpenBSD uses select ops.
1684  *
1685  * MPSAFE
1686  */
1687 int
1688 sys_openbsd_poll(struct sysmsg *sysmsg, const struct openbsd_poll_args *uap)
1689 {
1690 	return (sys_poll(sysmsg, (const struct poll_args *)uap));
1691 }
1692 
1693 /*ARGSUSED*/
1694 int
1695 seltrue(cdev_t dev, int events)
1696 {
1697 	return (events & (POLLIN | POLLOUT | POLLRDNORM | POLLWRNORM));
1698 }
1699