xref: /dragonfly/sys/kern/sys_generic.c (revision a4c31683)
1 /*
2  * Copyright (c) 1982, 1986, 1989, 1993
3  *	The Regents of the University of California.  All rights reserved.
4  * (c) UNIX System Laboratories, Inc.
5  * All or some portions of this file are derived from material licensed
6  * to the University of California by American Telephone and Telegraph
7  * Co. or Unix System Laboratories, Inc. and are reproduced herein with
8  * the permission of UNIX System Laboratories, Inc.
9  *
10  * Redistribution and use in source and binary forms, with or without
11  * modification, are permitted provided that the following conditions
12  * are met:
13  * 1. Redistributions of source code must retain the above copyright
14  *    notice, this list of conditions and the following disclaimer.
15  * 2. Redistributions in binary form must reproduce the above copyright
16  *    notice, this list of conditions and the following disclaimer in the
17  *    documentation and/or other materials provided with the distribution.
18  * 3. Neither the name of the University nor the names of its contributors
19  *    may be used to endorse or promote products derived from this software
20  *    without specific prior written permission.
21  *
22  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
23  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
24  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
25  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
26  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
27  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
28  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
29  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
30  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
31  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
32  * SUCH DAMAGE.
33  *
34  *	@(#)sys_generic.c	8.5 (Berkeley) 1/21/94
35  * $FreeBSD: src/sys/kern/sys_generic.c,v 1.55.2.10 2001/03/17 10:39:32 peter Exp $
36  */
37 
38 #include "opt_ktrace.h"
39 
40 #include <sys/param.h>
41 #include <sys/systm.h>
42 #include <sys/sysproto.h>
43 #include <sys/event.h>
44 #include <sys/filedesc.h>
45 #include <sys/filio.h>
46 #include <sys/fcntl.h>
47 #include <sys/file.h>
48 #include <sys/proc.h>
49 #include <sys/signalvar.h>
50 #include <sys/socketvar.h>
51 #include <sys/uio.h>
52 #include <sys/kernel.h>
53 #include <sys/kern_syscall.h>
54 #include <sys/malloc.h>
55 #include <sys/mapped_ioctl.h>
56 #include <sys/poll.h>
57 #include <sys/queue.h>
58 #include <sys/resourcevar.h>
59 #include <sys/socketops.h>
60 #include <sys/sysctl.h>
61 #include <sys/sysent.h>
62 #include <sys/buf.h>
63 #ifdef KTRACE
64 #include <sys/ktrace.h>
65 #endif
66 #include <vm/vm.h>
67 #include <vm/vm_page.h>
68 
69 #include <sys/file2.h>
70 #include <sys/spinlock2.h>
71 
72 #include <machine/limits.h>
73 
74 static MALLOC_DEFINE(M_IOCTLOPS, "ioctlops", "ioctl data buffer");
75 static MALLOC_DEFINE(M_IOCTLMAP, "ioctlmap", "mapped ioctl handler buffer");
76 static MALLOC_DEFINE(M_SELECT, "select", "select() buffer");
77 MALLOC_DEFINE(M_IOV, "iov", "large iov's");
78 
79 typedef struct kfd_set {
80         fd_mask	fds_bits[2];
81 } kfd_set;
82 
83 enum select_copyin_states {
84     COPYIN_READ, COPYIN_WRITE, COPYIN_EXCEPT, COPYIN_DONE };
85 
86 struct select_kevent_copyin_args {
87 	kfd_set		*read_set;
88 	kfd_set		*write_set;
89 	kfd_set		*except_set;
90 	int		active_set;	/* One of select_copyin_states */
91 	struct lwp	*lwp;		/* Pointer to our lwp */
92 	int		num_fds;	/* Number of file descriptors (syscall arg) */
93 	int		proc_fds;	/* Processed fd's (wraps) */
94 	int		error;		/* Returned to userland */
95 };
96 
97 struct poll_kevent_copyin_args {
98 	struct lwp	*lwp;
99 	struct pollfd	*fds;
100 	int		nfds;
101 	int		pfds;
102 	int		error;
103 };
104 
105 static struct lwkt_token mioctl_token = LWKT_TOKEN_INITIALIZER(mioctl_token);
106 
107 static int 	doselect(int nd, fd_set *in, fd_set *ou, fd_set *ex,
108 			 struct timespec *ts, int *res);
109 static int	dopoll(int nfds, struct pollfd *fds, struct timespec *ts,
110 		       int *res, int flags);
111 static int	dofileread(int, struct file *, struct uio *, int, size_t *);
112 static int	dofilewrite(int, struct file *, struct uio *, int, size_t *);
113 
114 /*
115  * Read system call.
116  *
117  * MPSAFE
118  */
119 int
120 sys_read(struct read_args *uap)
121 {
122 	struct thread *td = curthread;
123 	struct uio auio;
124 	struct iovec aiov;
125 	int error;
126 
127 	if ((ssize_t)uap->nbyte < 0)
128 		error = EINVAL;
129 
130 	aiov.iov_base = uap->buf;
131 	aiov.iov_len = uap->nbyte;
132 	auio.uio_iov = &aiov;
133 	auio.uio_iovcnt = 1;
134 	auio.uio_offset = -1;
135 	auio.uio_resid = uap->nbyte;
136 	auio.uio_rw = UIO_READ;
137 	auio.uio_segflg = UIO_USERSPACE;
138 	auio.uio_td = td;
139 
140 	error = kern_preadv(uap->fd, &auio, 0, &uap->sysmsg_szresult);
141 	return(error);
142 }
143 
144 /*
145  * Positioned (Pread) read system call
146  *
147  * MPSAFE
148  */
149 int
150 sys_extpread(struct extpread_args *uap)
151 {
152 	struct thread *td = curthread;
153 	struct uio auio;
154 	struct iovec aiov;
155 	int error;
156 	int flags;
157 
158 	if ((ssize_t)uap->nbyte < 0)
159 		return(EINVAL);
160 
161 	aiov.iov_base = uap->buf;
162 	aiov.iov_len = uap->nbyte;
163 	auio.uio_iov = &aiov;
164 	auio.uio_iovcnt = 1;
165 	auio.uio_offset = uap->offset;
166 	auio.uio_resid = uap->nbyte;
167 	auio.uio_rw = UIO_READ;
168 	auio.uio_segflg = UIO_USERSPACE;
169 	auio.uio_td = td;
170 
171 	flags = uap->flags & O_FMASK;
172 	if (uap->offset != (off_t)-1)
173 		flags |= O_FOFFSET;
174 
175 	error = kern_preadv(uap->fd, &auio, flags, &uap->sysmsg_szresult);
176 	return(error);
177 }
178 
179 /*
180  * Scatter read system call.
181  *
182  * MPSAFE
183  */
184 int
185 sys_readv(struct readv_args *uap)
186 {
187 	struct thread *td = curthread;
188 	struct uio auio;
189 	struct iovec aiov[UIO_SMALLIOV], *iov = NULL;
190 	int error;
191 
192 	error = iovec_copyin(uap->iovp, &iov, aiov, uap->iovcnt,
193 			     &auio.uio_resid);
194 	if (error)
195 		return (error);
196 	auio.uio_iov = iov;
197 	auio.uio_iovcnt = uap->iovcnt;
198 	auio.uio_offset = -1;
199 	auio.uio_rw = UIO_READ;
200 	auio.uio_segflg = UIO_USERSPACE;
201 	auio.uio_td = td;
202 
203 	error = kern_preadv(uap->fd, &auio, 0, &uap->sysmsg_szresult);
204 
205 	iovec_free(&iov, aiov);
206 	return (error);
207 }
208 
209 
210 /*
211  * Scatter positioned read system call.
212  *
213  * MPSAFE
214  */
215 int
216 sys_extpreadv(struct extpreadv_args *uap)
217 {
218 	struct thread *td = curthread;
219 	struct uio auio;
220 	struct iovec aiov[UIO_SMALLIOV], *iov = NULL;
221 	int error;
222 	int flags;
223 
224 	error = iovec_copyin(uap->iovp, &iov, aiov, uap->iovcnt,
225 			     &auio.uio_resid);
226 	if (error)
227 		return (error);
228 	auio.uio_iov = iov;
229 	auio.uio_iovcnt = uap->iovcnt;
230 	auio.uio_offset = uap->offset;
231 	auio.uio_rw = UIO_READ;
232 	auio.uio_segflg = UIO_USERSPACE;
233 	auio.uio_td = td;
234 
235 	flags = uap->flags & O_FMASK;
236 	if (uap->offset != (off_t)-1)
237 		flags |= O_FOFFSET;
238 
239 	error = kern_preadv(uap->fd, &auio, flags, &uap->sysmsg_szresult);
240 
241 	iovec_free(&iov, aiov);
242 	return(error);
243 }
244 
245 /*
246  * MPSAFE
247  */
248 int
249 kern_preadv(int fd, struct uio *auio, int flags, size_t *res)
250 {
251 	struct thread *td = curthread;
252 	struct proc *p = td->td_proc;
253 	struct file *fp;
254 	int error;
255 
256 	KKASSERT(p);
257 
258 	fp = holdfp(p->p_fd, fd, FREAD);
259 	if (fp == NULL)
260 		return (EBADF);
261 	if (flags & O_FOFFSET && fp->f_type != DTYPE_VNODE) {
262 		error = ESPIPE;
263 	} else {
264 		error = dofileread(fd, fp, auio, flags, res);
265 	}
266 	fdrop(fp);
267 	return(error);
268 }
269 
270 /*
271  * Common code for readv and preadv that reads data in
272  * from a file using the passed in uio, offset, and flags.
273  *
274  * MPALMOSTSAFE - ktrace needs help
275  */
276 static int
277 dofileread(int fd, struct file *fp, struct uio *auio, int flags, size_t *res)
278 {
279 	int error;
280 	size_t len;
281 #ifdef KTRACE
282 	struct thread *td = curthread;
283 	struct iovec *ktriov = NULL;
284 	struct uio ktruio;
285 #endif
286 
287 #ifdef KTRACE
288 	/*
289 	 * if tracing, save a copy of iovec
290 	 */
291 	if (KTRPOINT(td, KTR_GENIO))  {
292 		int iovlen = auio->uio_iovcnt * sizeof(struct iovec);
293 
294 		ktriov = kmalloc(iovlen, M_TEMP, M_WAITOK);
295 		bcopy((caddr_t)auio->uio_iov, (caddr_t)ktriov, iovlen);
296 		ktruio = *auio;
297 	}
298 #endif
299 	len = auio->uio_resid;
300 	error = fo_read(fp, auio, fp->f_cred, flags);
301 	if (error) {
302 		if (auio->uio_resid != len && (error == ERESTART ||
303 		    error == EINTR || error == EWOULDBLOCK))
304 			error = 0;
305 	}
306 #ifdef KTRACE
307 	if (ktriov != NULL) {
308 		if (error == 0) {
309 			ktruio.uio_iov = ktriov;
310 			ktruio.uio_resid = len - auio->uio_resid;
311 			ktrgenio(td->td_lwp, fd, UIO_READ, &ktruio, error);
312 		}
313 		kfree(ktriov, M_TEMP);
314 	}
315 #endif
316 	if (error == 0)
317 		*res = len - auio->uio_resid;
318 
319 	return(error);
320 }
321 
322 /*
323  * Write system call
324  *
325  * MPSAFE
326  */
327 int
328 sys_write(struct write_args *uap)
329 {
330 	struct thread *td = curthread;
331 	struct uio auio;
332 	struct iovec aiov;
333 	int error;
334 
335 	if ((ssize_t)uap->nbyte < 0)
336 		error = EINVAL;
337 
338 	aiov.iov_base = (void *)(uintptr_t)uap->buf;
339 	aiov.iov_len = uap->nbyte;
340 	auio.uio_iov = &aiov;
341 	auio.uio_iovcnt = 1;
342 	auio.uio_offset = -1;
343 	auio.uio_resid = uap->nbyte;
344 	auio.uio_rw = UIO_WRITE;
345 	auio.uio_segflg = UIO_USERSPACE;
346 	auio.uio_td = td;
347 
348 	error = kern_pwritev(uap->fd, &auio, 0, &uap->sysmsg_szresult);
349 
350 	return(error);
351 }
352 
353 /*
354  * Pwrite system call
355  *
356  * MPSAFE
357  */
358 int
359 sys_extpwrite(struct extpwrite_args *uap)
360 {
361 	struct thread *td = curthread;
362 	struct uio auio;
363 	struct iovec aiov;
364 	int error;
365 	int flags;
366 
367 	if ((ssize_t)uap->nbyte < 0)
368 		error = EINVAL;
369 
370 	aiov.iov_base = (void *)(uintptr_t)uap->buf;
371 	aiov.iov_len = uap->nbyte;
372 	auio.uio_iov = &aiov;
373 	auio.uio_iovcnt = 1;
374 	auio.uio_offset = uap->offset;
375 	auio.uio_resid = uap->nbyte;
376 	auio.uio_rw = UIO_WRITE;
377 	auio.uio_segflg = UIO_USERSPACE;
378 	auio.uio_td = td;
379 
380 	flags = uap->flags & O_FMASK;
381 	if (uap->offset != (off_t)-1)
382 		flags |= O_FOFFSET;
383 	error = kern_pwritev(uap->fd, &auio, flags, &uap->sysmsg_szresult);
384 	return(error);
385 }
386 
387 /*
388  * MPSAFE
389  */
390 int
391 sys_writev(struct writev_args *uap)
392 {
393 	struct thread *td = curthread;
394 	struct uio auio;
395 	struct iovec aiov[UIO_SMALLIOV], *iov = NULL;
396 	int error;
397 
398 	error = iovec_copyin(uap->iovp, &iov, aiov, uap->iovcnt,
399 			     &auio.uio_resid);
400 	if (error)
401 		return (error);
402 	auio.uio_iov = iov;
403 	auio.uio_iovcnt = uap->iovcnt;
404 	auio.uio_offset = -1;
405 	auio.uio_rw = UIO_WRITE;
406 	auio.uio_segflg = UIO_USERSPACE;
407 	auio.uio_td = td;
408 
409 	error = kern_pwritev(uap->fd, &auio, 0, &uap->sysmsg_szresult);
410 
411 	iovec_free(&iov, aiov);
412 	return (error);
413 }
414 
415 
416 /*
417  * Gather positioned write system call
418  *
419  * MPSAFE
420  */
421 int
422 sys_extpwritev(struct extpwritev_args *uap)
423 {
424 	struct thread *td = curthread;
425 	struct uio auio;
426 	struct iovec aiov[UIO_SMALLIOV], *iov = NULL;
427 	int error;
428 	int flags;
429 
430 	error = iovec_copyin(uap->iovp, &iov, aiov, uap->iovcnt,
431 			     &auio.uio_resid);
432 	if (error)
433 		return (error);
434 	auio.uio_iov = iov;
435 	auio.uio_iovcnt = uap->iovcnt;
436 	auio.uio_offset = uap->offset;
437 	auio.uio_rw = UIO_WRITE;
438 	auio.uio_segflg = UIO_USERSPACE;
439 	auio.uio_td = td;
440 
441 	flags = uap->flags & O_FMASK;
442 	if (uap->offset != (off_t)-1)
443 		flags |= O_FOFFSET;
444 
445 	error = kern_pwritev(uap->fd, &auio, flags, &uap->sysmsg_szresult);
446 
447 	iovec_free(&iov, aiov);
448 	return(error);
449 }
450 
451 /*
452  * MPSAFE
453  */
454 int
455 kern_pwritev(int fd, struct uio *auio, int flags, size_t *res)
456 {
457 	struct thread *td = curthread;
458 	struct proc *p = td->td_proc;
459 	struct file *fp;
460 	int error;
461 
462 	KKASSERT(p);
463 
464 	fp = holdfp(p->p_fd, fd, FWRITE);
465 	if (fp == NULL)
466 		return (EBADF);
467 	else if ((flags & O_FOFFSET) && fp->f_type != DTYPE_VNODE) {
468 		error = ESPIPE;
469 	} else {
470 		error = dofilewrite(fd, fp, auio, flags, res);
471 	}
472 
473 	fdrop(fp);
474 	return (error);
475 }
476 
477 /*
478  * Common code for writev and pwritev that writes data to
479  * a file using the passed in uio, offset, and flags.
480  *
481  * MPALMOSTSAFE - ktrace needs help
482  */
483 static int
484 dofilewrite(int fd, struct file *fp, struct uio *auio, int flags, size_t *res)
485 {
486 	struct thread *td = curthread;
487 	struct lwp *lp = td->td_lwp;
488 	int error;
489 	size_t len;
490 #ifdef KTRACE
491 	struct iovec *ktriov = NULL;
492 	struct uio ktruio;
493 #endif
494 
495 #ifdef KTRACE
496 	/*
497 	 * if tracing, save a copy of iovec and uio
498 	 */
499 	if (KTRPOINT(td, KTR_GENIO))  {
500 		int iovlen = auio->uio_iovcnt * sizeof(struct iovec);
501 
502 		ktriov = kmalloc(iovlen, M_TEMP, M_WAITOK);
503 		bcopy((caddr_t)auio->uio_iov, (caddr_t)ktriov, iovlen);
504 		ktruio = *auio;
505 	}
506 #endif
507 	len = auio->uio_resid;
508 	error = fo_write(fp, auio, fp->f_cred, flags);
509 	if (error) {
510 		if (auio->uio_resid != len && (error == ERESTART ||
511 		    error == EINTR || error == EWOULDBLOCK))
512 			error = 0;
513 		/* Socket layer is responsible for issuing SIGPIPE. */
514 		if (error == EPIPE && fp->f_type != DTYPE_SOCKET)
515 			lwpsignal(lp->lwp_proc, lp, SIGPIPE);
516 	}
517 #ifdef KTRACE
518 	if (ktriov != NULL) {
519 		if (error == 0) {
520 			ktruio.uio_iov = ktriov;
521 			ktruio.uio_resid = len - auio->uio_resid;
522 			ktrgenio(lp, fd, UIO_WRITE, &ktruio, error);
523 		}
524 		kfree(ktriov, M_TEMP);
525 	}
526 #endif
527 	if (error == 0)
528 		*res = len - auio->uio_resid;
529 
530 	return(error);
531 }
532 
533 /*
534  * Ioctl system call
535  *
536  * MPSAFE
537  */
538 int
539 sys_ioctl(struct ioctl_args *uap)
540 {
541 	int error;
542 
543 	error = mapped_ioctl(uap->fd, uap->com, uap->data, NULL, &uap->sysmsg);
544 	return (error);
545 }
546 
547 struct ioctl_map_entry {
548 	const char *subsys;
549 	struct ioctl_map_range *cmd_ranges;
550 	LIST_ENTRY(ioctl_map_entry) entries;
551 };
552 
553 /*
554  * The true heart of all ioctl syscall handlers (native, emulation).
555  * If map != NULL, it will be searched for a matching entry for com,
556  * and appropriate conversions/conversion functions will be utilized.
557  *
558  * MPSAFE
559  */
560 int
561 mapped_ioctl(int fd, u_long com, caddr_t uspc_data, struct ioctl_map *map,
562 	     struct sysmsg *msg)
563 {
564 	struct thread *td = curthread;
565 	struct proc *p = td->td_proc;
566 	struct ucred *cred;
567 	struct file *fp;
568 	struct ioctl_map_range *iomc = NULL;
569 	int error;
570 	u_int size;
571 	u_long ocom = com;
572 	caddr_t data, memp;
573 	int tmp;
574 #define STK_PARAMS	128
575 	union {
576 	    char stkbuf[STK_PARAMS];
577 	    long align;
578 	} ubuf;
579 
580 	KKASSERT(p);
581 	cred = td->td_ucred;
582 	memp = NULL;
583 
584 	fp = holdfp(p->p_fd, fd, FREAD|FWRITE);
585 	if (fp == NULL)
586 		return(EBADF);
587 
588 	if (map != NULL) {	/* obey translation map */
589 		u_long maskcmd;
590 		struct ioctl_map_entry *e;
591 
592 		maskcmd = com & map->mask;
593 
594 		lwkt_gettoken(&mioctl_token);
595 		LIST_FOREACH(e, &map->mapping, entries) {
596 			for (iomc = e->cmd_ranges; iomc->start != 0 ||
597 			     iomc->maptocmd != 0 || iomc->wrapfunc != NULL ||
598 			     iomc->mapfunc != NULL;
599 			     iomc++) {
600 				if (maskcmd >= iomc->start &&
601 				    maskcmd <= iomc->end)
602 					break;
603 			}
604 
605 			/* Did we find a match? */
606 			if (iomc->start != 0 || iomc->maptocmd != 0 ||
607 			    iomc->wrapfunc != NULL || iomc->mapfunc != NULL)
608 				break;
609 		}
610 		lwkt_reltoken(&mioctl_token);
611 
612 		if (iomc == NULL ||
613 		    (iomc->start == 0 && iomc->maptocmd == 0
614 		     && iomc->wrapfunc == NULL && iomc->mapfunc == NULL)) {
615 			kprintf("%s: 'ioctl' fd=%d, cmd=0x%lx ('%c',%d) not implemented\n",
616 			       map->sys, fd, maskcmd,
617 			       (int)((maskcmd >> 8) & 0xff),
618 			       (int)(maskcmd & 0xff));
619 			error = EINVAL;
620 			goto done;
621 		}
622 
623 		/*
624 		 * If it's a non-range one to one mapping, maptocmd should be
625 		 * correct. If it's a ranged one to one mapping, we pass the
626 		 * original value of com, and for a range mapped to a different
627 		 * range, we always need a mapping function to translate the
628 		 * ioctl to our native ioctl. Ex. 6500-65ff <-> 9500-95ff
629 		 */
630 		if (iomc->start == iomc->end && iomc->maptocmd == iomc->maptoend) {
631 			com = iomc->maptocmd;
632 		} else if (iomc->start == iomc->maptocmd && iomc->end == iomc->maptoend) {
633 			if (iomc->mapfunc != NULL)
634 				com = iomc->mapfunc(iomc->start, iomc->end,
635 						    iomc->start, iomc->end,
636 						    com, com);
637 		} else {
638 			if (iomc->mapfunc != NULL) {
639 				com = iomc->mapfunc(iomc->start, iomc->end,
640 						    iomc->maptocmd, iomc->maptoend,
641 						    com, ocom);
642 			} else {
643 				kprintf("%s: Invalid mapping for fd=%d, cmd=%#lx ('%c',%d)\n",
644 				       map->sys, fd, maskcmd,
645 				       (int)((maskcmd >> 8) & 0xff),
646 				       (int)(maskcmd & 0xff));
647 				error = EINVAL;
648 				goto done;
649 			}
650 		}
651 	}
652 
653 	switch (com) {
654 	case FIONCLEX:
655 		error = fclrfdflags(p->p_fd, fd, UF_EXCLOSE);
656 		goto done;
657 	case FIOCLEX:
658 		error = fsetfdflags(p->p_fd, fd, UF_EXCLOSE);
659 		goto done;
660 	}
661 
662 	/*
663 	 * Interpret high order word to find amount of data to be
664 	 * copied to/from the user's address space.
665 	 */
666 	size = IOCPARM_LEN(com);
667 	if (size > IOCPARM_MAX) {
668 		error = ENOTTY;
669 		goto done;
670 	}
671 
672 	if ((com & IOC_VOID) == 0 && size > sizeof(ubuf.stkbuf)) {
673 		memp = kmalloc(size, M_IOCTLOPS, M_WAITOK);
674 		data = memp;
675 	} else {
676 		memp = NULL;
677 		data = ubuf.stkbuf;
678 	}
679 	if (com & IOC_VOID) {
680 		*(caddr_t *)data = uspc_data;
681 	} else if (com & IOC_IN) {
682 		if (size != 0) {
683 			error = copyin(uspc_data, data, (size_t)size);
684 			if (error)
685 				goto done;
686 		} else {
687 			*(caddr_t *)data = uspc_data;
688 		}
689 	} else if ((com & IOC_OUT) != 0 && size) {
690 		/*
691 		 * Zero the buffer so the user always
692 		 * gets back something deterministic.
693 		 */
694 		bzero(data, (size_t)size);
695 	}
696 
697 	switch (com) {
698 	case FIONBIO:
699 		if ((tmp = *(int *)data))
700 			atomic_set_int(&fp->f_flag, FNONBLOCK);
701 		else
702 			atomic_clear_int(&fp->f_flag, FNONBLOCK);
703 		error = 0;
704 		break;
705 
706 	case FIOASYNC:
707 		if ((tmp = *(int *)data))
708 			atomic_set_int(&fp->f_flag, FASYNC);
709 		else
710 			atomic_clear_int(&fp->f_flag, FASYNC);
711 		error = fo_ioctl(fp, FIOASYNC, (caddr_t)&tmp, cred, msg);
712 		break;
713 
714 	default:
715 		/*
716 		 *  If there is a override function,
717 		 *  call it instead of directly routing the call
718 		 */
719 		if (map != NULL && iomc->wrapfunc != NULL)
720 			error = iomc->wrapfunc(fp, com, ocom, data, cred);
721 		else
722 			error = fo_ioctl(fp, com, data, cred, msg);
723 		/*
724 		 * Copy any data to user, size was
725 		 * already set and checked above.
726 		 */
727 		if (error == 0 && (com & IOC_OUT) != 0 && size != 0)
728 			error = copyout(data, uspc_data, (size_t)size);
729 		break;
730 	}
731 done:
732 	if (memp != NULL)
733 		kfree(memp, M_IOCTLOPS);
734 	fdrop(fp);
735 	return(error);
736 }
737 
738 /*
739  * MPSAFE
740  */
741 int
742 mapped_ioctl_register_handler(struct ioctl_map_handler *he)
743 {
744 	struct ioctl_map_entry *ne;
745 
746 	KKASSERT(he != NULL && he->map != NULL && he->cmd_ranges != NULL &&
747 		 he->subsys != NULL && *he->subsys != '\0');
748 
749 	ne = kmalloc(sizeof(struct ioctl_map_entry), M_IOCTLMAP,
750 		     M_WAITOK | M_ZERO);
751 
752 	ne->subsys = he->subsys;
753 	ne->cmd_ranges = he->cmd_ranges;
754 
755 	lwkt_gettoken(&mioctl_token);
756 	LIST_INSERT_HEAD(&he->map->mapping, ne, entries);
757 	lwkt_reltoken(&mioctl_token);
758 
759 	return(0);
760 }
761 
762 /*
763  * MPSAFE
764  */
765 int
766 mapped_ioctl_unregister_handler(struct ioctl_map_handler *he)
767 {
768 	struct ioctl_map_entry *ne;
769 	int error = EINVAL;
770 
771 	KKASSERT(he != NULL && he->map != NULL && he->cmd_ranges != NULL);
772 
773 	lwkt_gettoken(&mioctl_token);
774 	LIST_FOREACH(ne, &he->map->mapping, entries) {
775 		if (ne->cmd_ranges == he->cmd_ranges) {
776 			LIST_REMOVE(ne, entries);
777 			kfree(ne, M_IOCTLMAP);
778 			error = 0;
779 			break;
780 		}
781 	}
782 	lwkt_reltoken(&mioctl_token);
783 	return(error);
784 }
785 
786 static int	nselcoll;	/* Select collisions since boot */
787 int	selwait;
788 SYSCTL_INT(_kern, OID_AUTO, nselcoll, CTLFLAG_RD, &nselcoll, 0, "");
789 static int	nseldebug;
790 SYSCTL_INT(_kern, OID_AUTO, nseldebug, CTLFLAG_RW, &nseldebug, 0, "");
791 
792 /*
793  * Select system call.
794  *
795  * MPSAFE
796  */
797 int
798 sys_select(struct select_args *uap)
799 {
800 	struct timeval ktv;
801 	struct timespec *ktsp, kts;
802 	int error;
803 
804 	/*
805 	 * Get timeout if any.
806 	 */
807 	if (uap->tv != NULL) {
808 		error = copyin(uap->tv, &ktv, sizeof (ktv));
809 		if (error)
810 			return (error);
811 		TIMEVAL_TO_TIMESPEC(&ktv, &kts);
812 		ktsp = &kts;
813 	} else {
814 		ktsp = NULL;
815 	}
816 
817 	/*
818 	 * Do real work.
819 	 */
820 	error = doselect(uap->nd, uap->in, uap->ou, uap->ex, ktsp,
821 			 &uap->sysmsg_result);
822 
823 	return (error);
824 }
825 
826 
827 /*
828  * Pselect system call.
829  */
830 int
831 sys_pselect(struct pselect_args *uap)
832 {
833 	struct thread *td = curthread;
834 	struct lwp *lp = td->td_lwp;
835 	struct timespec *ktsp, kts;
836 	sigset_t sigmask;
837 	int error;
838 
839 	/*
840 	 * Get timeout if any.
841 	 */
842 	if (uap->ts != NULL) {
843 		error = copyin(uap->ts, &kts, sizeof (kts));
844 		if (error)
845 			return (error);
846 		ktsp = &kts;
847 	} else {
848 		ktsp = NULL;
849 	}
850 
851 	/*
852 	 * Install temporary signal mask if any provided.
853 	 */
854 	if (uap->sigmask != NULL) {
855 		error = copyin(uap->sigmask, &sigmask, sizeof(sigmask));
856 		if (error)
857 			return (error);
858 		lwkt_gettoken(&lp->lwp_proc->p_token);
859 		lp->lwp_oldsigmask = lp->lwp_sigmask;
860 		SIG_CANTMASK(sigmask);
861 		lp->lwp_sigmask = sigmask;
862 		lwkt_reltoken(&lp->lwp_proc->p_token);
863 	}
864 
865 	/*
866 	 * Do real job.
867 	 */
868 	error = doselect(uap->nd, uap->in, uap->ou, uap->ex, ktsp,
869 			 &uap->sysmsg_result);
870 
871 	if (uap->sigmask != NULL) {
872 		lwkt_gettoken(&lp->lwp_proc->p_token);
873 		/* doselect() responsible for turning ERESTART into EINTR */
874 		KKASSERT(error != ERESTART);
875 		if (error == EINTR) {
876 			/*
877 			 * We can't restore the previous signal mask now
878 			 * because it could block the signal that interrupted
879 			 * us.  So make a note to restore it after executing
880 			 * the handler.
881 			 */
882 			lp->lwp_flags |= LWP_OLDMASK;
883 		} else {
884 			/*
885 			 * No handler to run. Restore previous mask immediately.
886 			 */
887 			lp->lwp_sigmask = lp->lwp_oldsigmask;
888 		}
889 		lwkt_reltoken(&lp->lwp_proc->p_token);
890 	}
891 
892 	return (error);
893 }
894 
895 static int
896 select_copyin(void *arg, struct kevent *kevp, int maxevents, int *events)
897 {
898 	struct select_kevent_copyin_args *skap = NULL;
899 	struct kevent *kev;
900 	int fd;
901 	kfd_set *fdp = NULL;
902 	short filter = 0;
903 	u_int fflags = 0;
904 
905 	skap = (struct select_kevent_copyin_args *)arg;
906 
907 	if (*events == maxevents)
908 		return (0);
909 
910 	while (skap->active_set < COPYIN_DONE) {
911 		switch (skap->active_set) {
912 		case COPYIN_READ:
913 			/*
914 			 * Register descriptors for the read filter
915 			 */
916 			fdp = skap->read_set;
917 			filter = EVFILT_READ;
918 			fflags = NOTE_OLDAPI;
919 			if (fdp)
920 				break;
921 			++skap->active_set;
922 			skap->proc_fds = 0;
923 			/* fall through */
924 		case COPYIN_WRITE:
925 			/*
926 			 * Register descriptors for the write filter
927 			 */
928 			fdp = skap->write_set;
929 			filter = EVFILT_WRITE;
930 			fflags = NOTE_OLDAPI;
931 			if (fdp)
932 				break;
933 			++skap->active_set;
934 			skap->proc_fds = 0;
935 			/* fall through */
936 		case COPYIN_EXCEPT:
937 			/*
938 			 * Register descriptors for the exception filter
939 			 */
940 			fdp = skap->except_set;
941 			filter = EVFILT_EXCEPT;
942 			fflags = NOTE_OLDAPI | NOTE_OOB;
943 			if (fdp)
944 				break;
945 			++skap->active_set;
946 			skap->proc_fds = 0;
947 			/* fall through */
948 		case COPYIN_DONE:
949 			/*
950 			 * Nothing left to register
951 			 */
952 			return(0);
953 			/* NOT REACHED */
954 		}
955 
956 		while (skap->proc_fds < skap->num_fds) {
957 			fd = skap->proc_fds;
958 			if (FD_ISSET(fd, fdp)) {
959 				kev = &kevp[*events];
960 				EV_SET(kev, fd, filter,
961 				       EV_ADD|EV_ENABLE,
962 				       fflags, 0,
963 				       (void *)(uintptr_t)
964 					skap->lwp->lwp_kqueue_serial);
965 				FD_CLR(fd, fdp);
966 				++*events;
967 
968 				if (nseldebug) {
969 					kprintf("select fd %d filter %d "
970 					    "serial %ju\n", fd, filter,
971 					    (uintmax_t)
972 					    skap->lwp->lwp_kqueue_serial);
973 				}
974 			}
975 			++skap->proc_fds;
976 			if (*events == maxevents)
977 				return (0);
978 		}
979 		skap->active_set++;
980 		skap->proc_fds = 0;
981 	}
982 
983 	return (0);
984 }
985 
986 static int
987 select_copyout(void *arg, struct kevent *kevp, int count, int *res)
988 {
989 	struct select_kevent_copyin_args *skap;
990 	struct kevent kev;
991 	int i = 0;
992 
993 	skap = (struct select_kevent_copyin_args *)arg;
994 
995 	for (i = 0; i < count; ++i) {
996 		/*
997 		 * Filter out and delete spurious events
998 		 */
999 		if ((uint64_t)(uintptr_t)kevp[i].udata !=
1000 		    skap->lwp->lwp_kqueue_serial) {
1001 			kev = kevp[i];
1002 			kev.flags = EV_DISABLE|EV_DELETE;
1003 			kqueue_register(&skap->lwp->lwp_kqueue, &kev);
1004 			if (nseldebug) {
1005 				kprintf("select fd %ju mismatched serial %ju\n",
1006 				    (uintmax_t)kevp[i].ident,
1007 				    (uintmax_t)skap->lwp->lwp_kqueue_serial);
1008 			}
1009 			continue;
1010 		}
1011 
1012 		/*
1013 		 * Handle errors
1014 		 */
1015 		if (kevp[i].flags & EV_ERROR) {
1016 			int error = kevp[i].data;
1017 
1018 			switch (error) {
1019 			case EBADF:
1020 				/*
1021 				 * A bad file descriptor is considered a
1022 				 * fatal error for select, bail out.
1023 				 */
1024 				skap->error = error;
1025 				*res = -1;
1026 				return error;
1027 
1028 			default:
1029 				/*
1030 				 * Select silently swallows any unknown errors
1031 				 * for descriptors in the read or write sets.
1032 				 *
1033 				 * ALWAYS filter out EOPNOTSUPP errors from
1034 				 * filters (at least until all filters support
1035 				 * EVFILT_EXCEPT)
1036 				 *
1037 				 * We also filter out ENODEV since dev_dkqfilter
1038 				 * returns ENODEV if EOPNOTSUPP is returned in an
1039 				 * inner call.
1040 				 *
1041 				 * XXX: fix this
1042 				 */
1043 				if (kevp[i].filter != EVFILT_READ &&
1044 				    kevp[i].filter != EVFILT_WRITE &&
1045 				    error != EOPNOTSUPP &&
1046 				    error != ENODEV) {
1047 					skap->error = error;
1048 					*res = -1;
1049 					return error;
1050 				}
1051 				break;
1052 			}
1053 			if (nseldebug)
1054 				kprintf("select fd %ju filter %d error %d\n",
1055 					(uintmax_t)kevp[i].ident,
1056 					kevp[i].filter, error);
1057 			continue;
1058 		}
1059 
1060 		switch (kevp[i].filter) {
1061 		case EVFILT_READ:
1062 			FD_SET(kevp[i].ident, skap->read_set);
1063 			break;
1064 		case EVFILT_WRITE:
1065 			FD_SET(kevp[i].ident, skap->write_set);
1066 			break;
1067 		case EVFILT_EXCEPT:
1068 			FD_SET(kevp[i].ident, skap->except_set);
1069 			break;
1070 		}
1071 
1072 		++*res;
1073 	}
1074 
1075 	return (0);
1076 }
1077 
1078 /*
1079  * Copy select bits in from userland.  Allocate kernel memory if the
1080  * set is large.
1081  */
1082 static int
1083 getbits(int bytes, fd_set *in_set, kfd_set **out_set, kfd_set *tmp_set)
1084 {
1085 	int error;
1086 
1087 	if (in_set) {
1088 		if (bytes < sizeof(*tmp_set))
1089 			*out_set = tmp_set;
1090 		else
1091 			*out_set = kmalloc(bytes, M_SELECT, M_WAITOK);
1092 		error = copyin(in_set, *out_set, bytes);
1093 	} else {
1094 		*out_set = NULL;
1095 		error = 0;
1096 	}
1097 	return (error);
1098 }
1099 
1100 /*
1101  * Copy returned select bits back out to userland.
1102  */
1103 static int
1104 putbits(int bytes, kfd_set *in_set, fd_set *out_set)
1105 {
1106 	int error;
1107 
1108 	if (in_set) {
1109 		error = copyout(in_set, out_set, bytes);
1110 	} else {
1111 		error = 0;
1112 	}
1113 	return (error);
1114 }
1115 
1116 static int
1117 dotimeout_only(struct timespec *ts)
1118 {
1119 	return(nanosleep1(ts, NULL));
1120 }
1121 
1122 /*
1123  * Common code for sys_select() and sys_pselect().
1124  *
1125  * in, out and ex are userland pointers.  ts must point to validated
1126  * kernel-side timeout value or NULL for infinite timeout.  res must
1127  * point to syscall return value.
1128  */
1129 static int
1130 doselect(int nd, fd_set *read, fd_set *write, fd_set *except,
1131 	 struct timespec *ts, int *res)
1132 {
1133 	struct proc *p = curproc;
1134 	struct select_kevent_copyin_args *kap, ka;
1135 	int bytes, error;
1136 	kfd_set read_tmp;
1137 	kfd_set write_tmp;
1138 	kfd_set except_tmp;
1139 
1140 	*res = 0;
1141 	if (nd < 0)
1142 		return (EINVAL);
1143 	if (nd == 0 && ts)
1144 		return (dotimeout_only(ts));
1145 
1146 	if (nd > p->p_fd->fd_nfiles)		/* limit kmalloc */
1147 		nd = p->p_fd->fd_nfiles;
1148 
1149 	kap = &ka;
1150 	kap->lwp = curthread->td_lwp;
1151 	kap->num_fds = nd;
1152 	kap->proc_fds = 0;
1153 	kap->error = 0;
1154 	kap->active_set = COPYIN_READ;
1155 
1156 	/*
1157 	 * Calculate bytes based on the number of __fd_mask[] array entries
1158 	 * multiplied by the size of __fd_mask.
1159 	 */
1160 	bytes = howmany(nd, __NFDBITS) * sizeof(__fd_mask);
1161 
1162 	/* kap->read_set = NULL; not needed */
1163 	kap->write_set = NULL;
1164 	kap->except_set = NULL;
1165 
1166 	error = getbits(bytes, read, &kap->read_set, &read_tmp);
1167 	if (error == 0)
1168 		error = getbits(bytes, write, &kap->write_set, &write_tmp);
1169 	if (error == 0)
1170 		error = getbits(bytes, except, &kap->except_set, &except_tmp);
1171 	if (error)
1172 		goto done;
1173 
1174 	/*
1175 	 * NOTE: Make sure the max events passed to kern_kevent() is
1176 	 *	 effectively unlimited.  (nd * 3) accomplishes this.
1177 	 *
1178 	 *	 (*res) continues to increment as returned events are
1179 	 *	 loaded in.
1180 	 */
1181 	error = kern_kevent(&kap->lwp->lwp_kqueue, 0x7FFFFFFF, res, kap,
1182 			    select_copyin, select_copyout, ts, 0);
1183 	if (error == 0)
1184 		error = putbits(bytes, kap->read_set, read);
1185 	if (error == 0)
1186 		error = putbits(bytes, kap->write_set, write);
1187 	if (error == 0)
1188 		error = putbits(bytes, kap->except_set, except);
1189 
1190 	/*
1191 	 * An error from an individual event that should be passed
1192 	 * back to userland (EBADF)
1193 	 */
1194 	if (kap->error)
1195 		error = kap->error;
1196 
1197 	/*
1198 	 * Clean up.
1199 	 */
1200 done:
1201 	if (kap->read_set && kap->read_set != &read_tmp)
1202 		kfree(kap->read_set, M_SELECT);
1203 	if (kap->write_set && kap->write_set != &write_tmp)
1204 		kfree(kap->write_set, M_SELECT);
1205 	if (kap->except_set && kap->except_set != &except_tmp)
1206 		kfree(kap->except_set, M_SELECT);
1207 
1208 	kap->lwp->lwp_kqueue_serial += kap->num_fds;
1209 
1210 	return (error);
1211 }
1212 
1213 /*
1214  * Poll system call.
1215  *
1216  * MPSAFE
1217  */
1218 int
1219 sys_poll(struct poll_args *uap)
1220 {
1221 	struct timespec ts, *tsp;
1222 	int error;
1223 
1224 	if (uap->timeout != INFTIM) {
1225 		if (uap->timeout < 0)
1226 			return (EINVAL);
1227 		ts.tv_sec = uap->timeout / 1000;
1228 		ts.tv_nsec = (uap->timeout % 1000) * 1000 * 1000;
1229 		tsp = &ts;
1230 	} else {
1231 		tsp = NULL;
1232 	}
1233 
1234 	error = dopoll(uap->nfds, uap->fds, tsp, &uap->sysmsg_result, 0);
1235 
1236 	return (error);
1237 }
1238 
1239 /*
1240  * Ppoll system call.
1241  *
1242  * MPSAFE
1243  */
1244 int
1245 sys_ppoll(struct ppoll_args *uap)
1246 {
1247 	struct thread *td = curthread;
1248 	struct lwp *lp = td->td_lwp;
1249 	struct timespec *ktsp, kts;
1250 	sigset_t sigmask;
1251 	int error;
1252 
1253 	/*
1254 	 * Get timeout if any.
1255 	 */
1256 	if (uap->ts != NULL) {
1257 		error = copyin(uap->ts, &kts, sizeof (kts));
1258 		if (error)
1259 			return (error);
1260 		ktsp = &kts;
1261 	} else {
1262 		ktsp = NULL;
1263 	}
1264 
1265 	/*
1266 	 * Install temporary signal mask if any provided.
1267 	 */
1268 	if (uap->sigmask != NULL) {
1269 		error = copyin(uap->sigmask, &sigmask, sizeof(sigmask));
1270 		if (error)
1271 			return (error);
1272 		lwkt_gettoken(&lp->lwp_proc->p_token);
1273 		lp->lwp_oldsigmask = lp->lwp_sigmask;
1274 		SIG_CANTMASK(sigmask);
1275 		lp->lwp_sigmask = sigmask;
1276 		lwkt_reltoken(&lp->lwp_proc->p_token);
1277 	}
1278 
1279 	error = dopoll(uap->nfds, uap->fds, ktsp, &uap->sysmsg_result,
1280 	    ktsp != NULL ? KEVENT_TIMEOUT_PRECISE : 0);
1281 
1282 	if (uap->sigmask != NULL) {
1283 		lwkt_gettoken(&lp->lwp_proc->p_token);
1284 		/* dopoll() responsible for turning ERESTART into EINTR */
1285 		KKASSERT(error != ERESTART);
1286 		if (error == EINTR) {
1287 			/*
1288 			 * We can't restore the previous signal mask now
1289 			 * because it could block the signal that interrupted
1290 			 * us.  So make a note to restore it after executing
1291 			 * the handler.
1292 			 */
1293 			lp->lwp_flags |= LWP_OLDMASK;
1294 		} else {
1295 			/*
1296 			 * No handler to run. Restore previous mask immediately.
1297 			 */
1298 			lp->lwp_sigmask = lp->lwp_oldsigmask;
1299 		}
1300 		lwkt_reltoken(&lp->lwp_proc->p_token);
1301 	}
1302 
1303 	return (error);
1304 }
1305 
1306 static int
1307 poll_copyin(void *arg, struct kevent *kevp, int maxevents, int *events)
1308 {
1309 	struct poll_kevent_copyin_args *pkap;
1310 	struct pollfd *pfd;
1311 	struct kevent *kev;
1312 	int kev_count;
1313 
1314 	pkap = (struct poll_kevent_copyin_args *)arg;
1315 
1316 	while (pkap->pfds < pkap->nfds) {
1317 		pfd = &pkap->fds[pkap->pfds];
1318 
1319 		/* Clear return events */
1320 		pfd->revents = 0;
1321 
1322 		/* Do not check if fd is equal to -1 */
1323 		if (pfd->fd == -1) {
1324 			++pkap->pfds;
1325 			continue;
1326 		}
1327 
1328 		kev_count = 0;
1329 		if (pfd->events & (POLLIN | POLLRDNORM))
1330 			kev_count++;
1331 		if (pfd->events & (POLLOUT | POLLWRNORM))
1332 			kev_count++;
1333 		if (pfd->events & (POLLPRI | POLLRDBAND))
1334 			kev_count++;
1335 
1336 		if (*events + kev_count > maxevents)
1337 			return (0);
1338 
1339 		/*
1340 		 * NOTE: A combined serial number and poll array index is
1341 		 * stored in kev->udata.
1342 		 */
1343 		kev = &kevp[*events];
1344 		if (pfd->events & (POLLIN | POLLRDNORM)) {
1345 			EV_SET(kev++, pfd->fd, EVFILT_READ, EV_ADD|EV_ENABLE,
1346 			       NOTE_OLDAPI, 0, (void *)(uintptr_t)
1347 				(pkap->lwp->lwp_kqueue_serial + pkap->pfds));
1348 		}
1349 		if (pfd->events & (POLLOUT | POLLWRNORM)) {
1350 			EV_SET(kev++, pfd->fd, EVFILT_WRITE, EV_ADD|EV_ENABLE,
1351 			       NOTE_OLDAPI, 0, (void *)(uintptr_t)
1352 				(pkap->lwp->lwp_kqueue_serial + pkap->pfds));
1353 		}
1354 		if (pfd->events & (POLLPRI | POLLRDBAND)) {
1355 			EV_SET(kev++, pfd->fd, EVFILT_EXCEPT, EV_ADD|EV_ENABLE,
1356 			       NOTE_OLDAPI | NOTE_OOB, 0,
1357 			       (void *)(uintptr_t)
1358 				(pkap->lwp->lwp_kqueue_serial + pkap->pfds));
1359 		}
1360 
1361 		if (nseldebug) {
1362 			kprintf("poll index %d/%d fd %d events %08x "
1363 			    "serial %ju\n", pkap->pfds, pkap->nfds-1,
1364 			    pfd->fd, pfd->events,
1365 			    (uintmax_t)pkap->lwp->lwp_kqueue_serial);
1366 		}
1367 
1368 		++pkap->pfds;
1369 		(*events) += kev_count;
1370 	}
1371 
1372 	return (0);
1373 }
1374 
1375 static int
1376 poll_copyout(void *arg, struct kevent *kevp, int count, int *res)
1377 {
1378 	struct poll_kevent_copyin_args *pkap;
1379 	struct pollfd *pfd;
1380 	struct kevent kev;
1381 	int count_res;
1382 	int i;
1383 	uint64_t pi;
1384 
1385 	pkap = (struct poll_kevent_copyin_args *)arg;
1386 
1387 	for (i = 0; i < count; ++i) {
1388 		/*
1389 		 * Extract the poll array index and delete spurious events.
1390 		 * We can easily tell if the serial number is incorrect
1391 		 * by checking whether the extracted index is out of range.
1392 		 */
1393 		pi = (uint64_t)(uintptr_t)kevp[i].udata -
1394 		    pkap->lwp->lwp_kqueue_serial;
1395 
1396 		if (pi >= pkap->nfds) {
1397 			kev = kevp[i];
1398 			kev.flags = EV_DISABLE|EV_DELETE;
1399 			kqueue_register(&pkap->lwp->lwp_kqueue, &kev);
1400 			if (nseldebug) {
1401 				kprintf("poll index %ju out of range against "
1402 				    "serial %ju\n", (uintmax_t)pi,
1403 				    (uintmax_t)pkap->lwp->lwp_kqueue_serial);
1404 			}
1405 			continue;
1406 		}
1407 		pfd = &pkap->fds[pi];
1408 		if (kevp[i].ident == pfd->fd) {
1409 			/*
1410 			 * A single descriptor may generate an error against
1411 			 * more than one filter, make sure to set the
1412 			 * appropriate flags but do not increment (*res)
1413 			 * more than once.
1414 			 */
1415 			count_res = (pfd->revents == 0);
1416 			if (kevp[i].flags & EV_ERROR) {
1417 				switch(kevp[i].data) {
1418 				case EBADF:
1419 				case POLLNVAL:
1420 					/* Bad file descriptor */
1421 					if (count_res)
1422 						++*res;
1423 					pfd->revents |= POLLNVAL;
1424 					break;
1425 				default:
1426 					/*
1427 					 * Poll silently swallows any unknown
1428 					 * errors except in the case of POLLPRI
1429 					 * (OOB/urgent data).
1430 					 *
1431 					 * ALWAYS filter out EOPNOTSUPP errors
1432 					 * from filters, common applications
1433 					 * set POLLPRI|POLLRDBAND and most
1434 					 * filters do not support EVFILT_EXCEPT.
1435 					 *
1436 					 * We also filter out ENODEV since dev_dkqfilter
1437 					 * returns ENODEV if EOPNOTSUPP is returned in an
1438 					 * inner call.
1439 					 *
1440 					 * XXX: fix this
1441 					 */
1442 					if (kevp[i].filter != EVFILT_READ &&
1443 					    kevp[i].filter != EVFILT_WRITE &&
1444 					    kevp[i].data != EOPNOTSUPP &&
1445 					    kevp[i].data != ENODEV) {
1446 						if (count_res)
1447 							++*res;
1448 						pfd->revents |= POLLERR;
1449 					}
1450 					break;
1451 				}
1452 				if (nseldebug) {
1453 					kprintf("poll index %ju fd %d "
1454 						"filter %d error %jd\n",
1455 						(uintmax_t)pi, pfd->fd,
1456 						kevp[i].filter,
1457 						(intmax_t)kevp[i].data);
1458 				}
1459 				continue;
1460 			}
1461 
1462 			switch (kevp[i].filter) {
1463 			case EVFILT_READ:
1464 #if 0
1465 				/*
1466 				 * NODATA on the read side can indicate a
1467 				 * half-closed situation and not necessarily
1468 				 * a disconnect, so depend on the user
1469 				 * issuing a read() and getting 0 bytes back.
1470 				 */
1471 				if (kevp[i].flags & EV_NODATA)
1472 					pfd->revents |= POLLHUP;
1473 #endif
1474 				if ((kevp[i].flags & EV_EOF) &&
1475 				    kevp[i].fflags != 0)
1476 					pfd->revents |= POLLERR;
1477 				if (pfd->events & POLLIN)
1478 					pfd->revents |= POLLIN;
1479 				if (pfd->events & POLLRDNORM)
1480 					pfd->revents |= POLLRDNORM;
1481 				break;
1482 			case EVFILT_WRITE:
1483 				/*
1484 				 * As per the OpenGroup POLLHUP is mutually
1485 				 * exclusive with the writability flags.  I
1486 				 * consider this a bit broken but...
1487 				 *
1488 				 * In this case a disconnect is implied even
1489 				 * for a half-closed (write side) situation.
1490 				 */
1491 				if (kevp[i].flags & EV_EOF) {
1492 					pfd->revents |= POLLHUP;
1493 					if (kevp[i].fflags != 0)
1494 						pfd->revents |= POLLERR;
1495 				} else {
1496 					if (pfd->events & POLLOUT)
1497 						pfd->revents |= POLLOUT;
1498 					if (pfd->events & POLLWRNORM)
1499 						pfd->revents |= POLLWRNORM;
1500 				}
1501 				break;
1502 			case EVFILT_EXCEPT:
1503 				/*
1504 				 * EV_NODATA should never be tagged for this
1505 				 * filter.
1506 				 */
1507 				if (pfd->events & POLLPRI)
1508 					pfd->revents |= POLLPRI;
1509 				if (pfd->events & POLLRDBAND)
1510 					pfd->revents |= POLLRDBAND;
1511 				break;
1512 			}
1513 
1514 			if (nseldebug) {
1515 				kprintf("poll index %ju/%d fd %d "
1516 				    "revents %08x\n", (uintmax_t)pi, pkap->nfds,
1517 				    pfd->fd, pfd->revents);
1518 			}
1519 
1520 			if (count_res && pfd->revents)
1521 				++*res;
1522 		} else {
1523 			if (nseldebug) {
1524 				kprintf("poll index %ju mismatch %ju/%d\n",
1525 				    (uintmax_t)pi, (uintmax_t)kevp[i].ident,
1526 				    pfd->fd);
1527 			}
1528 		}
1529 	}
1530 
1531 	return (0);
1532 }
1533 
1534 static int
1535 dopoll(int nfds, struct pollfd *fds, struct timespec *ts, int *res, int flags)
1536 {
1537 	struct poll_kevent_copyin_args ka;
1538 	struct pollfd sfds[64];
1539 	int bytes;
1540 	int error;
1541 
1542         *res = 0;
1543         if (nfds < 0)
1544                 return (EINVAL);
1545 
1546 	if (nfds == 0 && ts)
1547 		return (dotimeout_only(ts));
1548 
1549 	/*
1550 	 * This is a bit arbitrary but we need to limit internal kmallocs.
1551 	 */
1552         if (nfds > maxfilesperproc * 2)
1553                 nfds = maxfilesperproc * 2;
1554 	bytes = sizeof(struct pollfd) * nfds;
1555 
1556 	ka.lwp = curthread->td_lwp;
1557 	ka.nfds = nfds;
1558 	ka.pfds = 0;
1559 	ka.error = 0;
1560 
1561 	if (ka.nfds < 64)
1562 		ka.fds = sfds;
1563 	else
1564 		ka.fds = kmalloc(bytes, M_SELECT, M_WAITOK);
1565 
1566 	error = copyin(fds, ka.fds, bytes);
1567 	if (error == 0)
1568 		error = kern_kevent(&ka.lwp->lwp_kqueue, 0x7FFFFFFF, res, &ka,
1569 				    poll_copyin, poll_copyout, ts, flags);
1570 
1571 	if (error == 0)
1572 		error = copyout(ka.fds, fds, bytes);
1573 
1574 	if (ka.fds != sfds)
1575 		kfree(ka.fds, M_SELECT);
1576 
1577 	ka.lwp->lwp_kqueue_serial += nfds;
1578 
1579 	return (error);
1580 }
1581 
1582 static int
1583 socket_wait_copyin(void *arg, struct kevent *kevp, int maxevents, int *events)
1584 {
1585 	return (0);
1586 }
1587 
1588 static int
1589 socket_wait_copyout(void *arg, struct kevent *kevp, int count, int *res)
1590 {
1591 	++*res;
1592 	return (0);
1593 }
1594 
1595 extern	struct fileops socketops;
1596 
1597 /*
1598  * NOTE: Callers of socket_wait() must already have a reference on the
1599  *	 socket.
1600  */
1601 int
1602 socket_wait(struct socket *so, struct timespec *ts, int *res)
1603 {
1604 	struct thread *td = curthread;
1605 	struct file *fp;
1606 	struct kqueue kq;
1607 	struct kevent kev;
1608 	int error, fd;
1609 
1610 	if ((error = falloc(td->td_lwp, &fp, &fd)) != 0)
1611 		return (error);
1612 
1613 	fp->f_type = DTYPE_SOCKET;
1614 	fp->f_flag = FREAD | FWRITE;
1615 	fp->f_ops = &socketops;
1616 	fp->f_data = so;
1617 	fsetfd(td->td_lwp->lwp_proc->p_fd, fp, fd);
1618 	fsetfdflags(td->td_proc->p_fd, fd, UF_EXCLOSE);
1619 
1620 	bzero(&kq, sizeof(kq));
1621 	kqueue_init(&kq, td->td_lwp->lwp_proc->p_fd);
1622 	EV_SET(&kev, fd, EVFILT_READ, EV_ADD|EV_ENABLE, 0, 0, NULL);
1623 	if ((error = kqueue_register(&kq, &kev)) != 0) {
1624 		fdrop(fp);
1625 		return (error);
1626 	}
1627 
1628 	error = kern_kevent(&kq, 1, res, NULL, socket_wait_copyin,
1629 			    socket_wait_copyout, ts, 0);
1630 
1631 	EV_SET(&kev, fd, EVFILT_READ, EV_DELETE|EV_DISABLE, 0, 0, NULL);
1632 	kqueue_register(&kq, &kev);
1633 	fp->f_ops = &badfileops;
1634 	fdrop(fp);
1635 
1636 	return (error);
1637 }
1638 
1639 /*
1640  * OpenBSD poll system call.
1641  * XXX this isn't quite a true representation..  OpenBSD uses select ops.
1642  *
1643  * MPSAFE
1644  */
1645 int
1646 sys_openbsd_poll(struct openbsd_poll_args *uap)
1647 {
1648 	return (sys_poll((struct poll_args *)uap));
1649 }
1650 
1651 /*ARGSUSED*/
1652 int
1653 seltrue(cdev_t dev, int events)
1654 {
1655 	return (events & (POLLIN | POLLOUT | POLLRDNORM | POLLWRNORM));
1656 }
1657