1 /*- 2 * SPDX-License-Identifier: BSD-3-Clause 3 * 4 * Copyright (c) 1982, 1986, 1989, 1993 5 * The Regents of the University of California. All rights reserved. 6 * (c) UNIX System Laboratories, Inc. 7 * All or some portions of this file are derived from material licensed 8 * to the University of California by American Telephone and Telegraph 9 * Co. or Unix System Laboratories, Inc. and are reproduced herein with 10 * the permission of UNIX System Laboratories, Inc. 11 * 12 * Redistribution and use in source and binary forms, with or without 13 * modification, are permitted provided that the following conditions 14 * are met: 15 * 1. Redistributions of source code must retain the above copyright 16 * notice, this list of conditions and the following disclaimer. 17 * 2. Redistributions in binary form must reproduce the above copyright 18 * notice, this list of conditions and the following disclaimer in the 19 * documentation and/or other materials provided with the distribution. 20 * 3. Neither the name of the University nor the names of its contributors 21 * may be used to endorse or promote products derived from this software 22 * without specific prior written permission. 23 * 24 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 25 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 26 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 27 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 28 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 29 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 30 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 31 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 32 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 33 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 34 * SUCH DAMAGE. 35 * 36 * @(#)sys_generic.c 8.5 (Berkeley) 1/21/94 37 */ 38 39 #include <sys/cdefs.h> 40 __FBSDID("$FreeBSD$"); 41 42 #include "opt_capsicum.h" 43 #include "opt_ktrace.h" 44 45 #include <sys/param.h> 46 #include <sys/systm.h> 47 #include <sys/sysproto.h> 48 #include <sys/capsicum.h> 49 #include <sys/filedesc.h> 50 #include <sys/filio.h> 51 #include <sys/fcntl.h> 52 #include <sys/file.h> 53 #include <sys/lock.h> 54 #include <sys/proc.h> 55 #include <sys/signalvar.h> 56 #include <sys/socketvar.h> 57 #include <sys/uio.h> 58 #include <sys/kernel.h> 59 #include <sys/ktr.h> 60 #include <sys/limits.h> 61 #include <sys/malloc.h> 62 #include <sys/poll.h> 63 #include <sys/resourcevar.h> 64 #include <sys/selinfo.h> 65 #include <sys/sleepqueue.h> 66 #include <sys/syscallsubr.h> 67 #include <sys/sysctl.h> 68 #include <sys/sysent.h> 69 #include <sys/vnode.h> 70 #include <sys/bio.h> 71 #include <sys/buf.h> 72 #include <sys/condvar.h> 73 #ifdef KTRACE 74 #include <sys/ktrace.h> 75 #endif 76 77 #include <security/audit/audit.h> 78 79 /* 80 * The following macro defines how many bytes will be allocated from 81 * the stack instead of memory allocated when passing the IOCTL data 82 * structures from userspace and to the kernel. Some IOCTLs having 83 * small data structures are used very frequently and this small 84 * buffer on the stack gives a significant speedup improvement for 85 * those requests. The value of this define should be greater or equal 86 * to 64 bytes and should also be power of two. The data structure is 87 * currently hard-aligned to a 8-byte boundary on the stack. This 88 * should currently be sufficient for all supported platforms. 89 */ 90 #define SYS_IOCTL_SMALL_SIZE 128 /* bytes */ 91 #define SYS_IOCTL_SMALL_ALIGN 8 /* bytes */ 92 93 #ifdef __LP64__ 94 static int iosize_max_clamp = 0; 95 SYSCTL_INT(_debug, OID_AUTO, iosize_max_clamp, CTLFLAG_RW, 96 &iosize_max_clamp, 0, "Clamp max i/o size to INT_MAX"); 97 static int devfs_iosize_max_clamp = 1; 98 SYSCTL_INT(_debug, OID_AUTO, devfs_iosize_max_clamp, CTLFLAG_RW, 99 &devfs_iosize_max_clamp, 0, "Clamp max i/o size to INT_MAX for devices"); 100 #endif 101 102 /* 103 * Assert that the return value of read(2) and write(2) syscalls fits 104 * into a register. If not, an architecture will need to provide the 105 * usermode wrappers to reconstruct the result. 106 */ 107 CTASSERT(sizeof(register_t) >= sizeof(size_t)); 108 109 static MALLOC_DEFINE(M_IOCTLOPS, "ioctlops", "ioctl data buffer"); 110 static MALLOC_DEFINE(M_SELECT, "select", "select() buffer"); 111 MALLOC_DEFINE(M_IOV, "iov", "large iov's"); 112 113 static int pollout(struct thread *, struct pollfd *, struct pollfd *, 114 u_int); 115 static int pollscan(struct thread *, struct pollfd *, u_int); 116 static int pollrescan(struct thread *); 117 static int selscan(struct thread *, fd_mask **, fd_mask **, int); 118 static int selrescan(struct thread *, fd_mask **, fd_mask **); 119 static void selfdalloc(struct thread *, void *); 120 static void selfdfree(struct seltd *, struct selfd *); 121 static int dofileread(struct thread *, int, struct file *, struct uio *, 122 off_t, int); 123 static int dofilewrite(struct thread *, int, struct file *, struct uio *, 124 off_t, int); 125 static void doselwakeup(struct selinfo *, int); 126 static void seltdinit(struct thread *); 127 static int seltdwait(struct thread *, sbintime_t, sbintime_t); 128 static void seltdclear(struct thread *); 129 130 /* 131 * One seltd per-thread allocated on demand as needed. 132 * 133 * t - protected by st_mtx 134 * k - Only accessed by curthread or read-only 135 */ 136 struct seltd { 137 STAILQ_HEAD(, selfd) st_selq; /* (k) List of selfds. */ 138 struct selfd *st_free1; /* (k) free fd for read set. */ 139 struct selfd *st_free2; /* (k) free fd for write set. */ 140 struct mtx st_mtx; /* Protects struct seltd */ 141 struct cv st_wait; /* (t) Wait channel. */ 142 int st_flags; /* (t) SELTD_ flags. */ 143 }; 144 145 #define SELTD_PENDING 0x0001 /* We have pending events. */ 146 #define SELTD_RESCAN 0x0002 /* Doing a rescan. */ 147 148 /* 149 * One selfd allocated per-thread per-file-descriptor. 150 * f - protected by sf_mtx 151 */ 152 struct selfd { 153 STAILQ_ENTRY(selfd) sf_link; /* (k) fds owned by this td. */ 154 TAILQ_ENTRY(selfd) sf_threads; /* (f) fds on this selinfo. */ 155 struct selinfo *sf_si; /* (f) selinfo when linked. */ 156 struct mtx *sf_mtx; /* Pointer to selinfo mtx. */ 157 struct seltd *sf_td; /* (k) owning seltd. */ 158 void *sf_cookie; /* (k) fd or pollfd. */ 159 u_int sf_refs; 160 }; 161 162 static uma_zone_t selfd_zone; 163 static struct mtx_pool *mtxpool_select; 164 165 #ifdef __LP64__ 166 size_t 167 devfs_iosize_max(void) 168 { 169 170 return (devfs_iosize_max_clamp || SV_CURPROC_FLAG(SV_ILP32) ? 171 INT_MAX : SSIZE_MAX); 172 } 173 174 size_t 175 iosize_max(void) 176 { 177 178 return (iosize_max_clamp || SV_CURPROC_FLAG(SV_ILP32) ? 179 INT_MAX : SSIZE_MAX); 180 } 181 #endif 182 183 #ifndef _SYS_SYSPROTO_H_ 184 struct read_args { 185 int fd; 186 void *buf; 187 size_t nbyte; 188 }; 189 #endif 190 int 191 sys_read(struct thread *td, struct read_args *uap) 192 { 193 struct uio auio; 194 struct iovec aiov; 195 int error; 196 197 if (uap->nbyte > IOSIZE_MAX) 198 return (EINVAL); 199 aiov.iov_base = uap->buf; 200 aiov.iov_len = uap->nbyte; 201 auio.uio_iov = &aiov; 202 auio.uio_iovcnt = 1; 203 auio.uio_resid = uap->nbyte; 204 auio.uio_segflg = UIO_USERSPACE; 205 error = kern_readv(td, uap->fd, &auio); 206 return (error); 207 } 208 209 /* 210 * Positioned read system call 211 */ 212 #ifndef _SYS_SYSPROTO_H_ 213 struct pread_args { 214 int fd; 215 void *buf; 216 size_t nbyte; 217 int pad; 218 off_t offset; 219 }; 220 #endif 221 int 222 sys_pread(struct thread *td, struct pread_args *uap) 223 { 224 225 return (kern_pread(td, uap->fd, uap->buf, uap->nbyte, uap->offset)); 226 } 227 228 int 229 kern_pread(struct thread *td, int fd, void *buf, size_t nbyte, off_t offset) 230 { 231 struct uio auio; 232 struct iovec aiov; 233 int error; 234 235 if (nbyte > IOSIZE_MAX) 236 return (EINVAL); 237 aiov.iov_base = buf; 238 aiov.iov_len = nbyte; 239 auio.uio_iov = &aiov; 240 auio.uio_iovcnt = 1; 241 auio.uio_resid = nbyte; 242 auio.uio_segflg = UIO_USERSPACE; 243 error = kern_preadv(td, fd, &auio, offset); 244 return (error); 245 } 246 247 #if defined(COMPAT_FREEBSD6) 248 int 249 freebsd6_pread(struct thread *td, struct freebsd6_pread_args *uap) 250 { 251 252 return (kern_pread(td, uap->fd, uap->buf, uap->nbyte, uap->offset)); 253 } 254 #endif 255 256 /* 257 * Scatter read system call. 258 */ 259 #ifndef _SYS_SYSPROTO_H_ 260 struct readv_args { 261 int fd; 262 struct iovec *iovp; 263 u_int iovcnt; 264 }; 265 #endif 266 int 267 sys_readv(struct thread *td, struct readv_args *uap) 268 { 269 struct uio *auio; 270 int error; 271 272 error = copyinuio(uap->iovp, uap->iovcnt, &auio); 273 if (error) 274 return (error); 275 error = kern_readv(td, uap->fd, auio); 276 free(auio, M_IOV); 277 return (error); 278 } 279 280 int 281 kern_readv(struct thread *td, int fd, struct uio *auio) 282 { 283 struct file *fp; 284 int error; 285 286 error = fget_read(td, fd, &cap_read_rights, &fp); 287 if (error) 288 return (error); 289 error = dofileread(td, fd, fp, auio, (off_t)-1, 0); 290 fdrop(fp, td); 291 return (error); 292 } 293 294 /* 295 * Scatter positioned read system call. 296 */ 297 #ifndef _SYS_SYSPROTO_H_ 298 struct preadv_args { 299 int fd; 300 struct iovec *iovp; 301 u_int iovcnt; 302 off_t offset; 303 }; 304 #endif 305 int 306 sys_preadv(struct thread *td, struct preadv_args *uap) 307 { 308 struct uio *auio; 309 int error; 310 311 error = copyinuio(uap->iovp, uap->iovcnt, &auio); 312 if (error) 313 return (error); 314 error = kern_preadv(td, uap->fd, auio, uap->offset); 315 free(auio, M_IOV); 316 return (error); 317 } 318 319 int 320 kern_preadv(struct thread *td, int fd, struct uio *auio, off_t offset) 321 { 322 struct file *fp; 323 int error; 324 325 error = fget_read(td, fd, &cap_pread_rights, &fp); 326 if (error) 327 return (error); 328 if (!(fp->f_ops->fo_flags & DFLAG_SEEKABLE)) 329 error = ESPIPE; 330 else if (offset < 0 && 331 (fp->f_vnode == NULL || fp->f_vnode->v_type != VCHR)) 332 error = EINVAL; 333 else 334 error = dofileread(td, fd, fp, auio, offset, FOF_OFFSET); 335 fdrop(fp, td); 336 return (error); 337 } 338 339 /* 340 * Common code for readv and preadv that reads data in 341 * from a file using the passed in uio, offset, and flags. 342 */ 343 static int 344 dofileread(struct thread *td, int fd, struct file *fp, struct uio *auio, 345 off_t offset, int flags) 346 { 347 ssize_t cnt; 348 int error; 349 #ifdef KTRACE 350 struct uio *ktruio = NULL; 351 #endif 352 353 AUDIT_ARG_FD(fd); 354 355 /* Finish zero length reads right here */ 356 if (auio->uio_resid == 0) { 357 td->td_retval[0] = 0; 358 return (0); 359 } 360 auio->uio_rw = UIO_READ; 361 auio->uio_offset = offset; 362 auio->uio_td = td; 363 #ifdef KTRACE 364 if (KTRPOINT(td, KTR_GENIO)) 365 ktruio = cloneuio(auio); 366 #endif 367 cnt = auio->uio_resid; 368 if ((error = fo_read(fp, auio, td->td_ucred, flags, td))) { 369 if (auio->uio_resid != cnt && (error == ERESTART || 370 error == EINTR || error == EWOULDBLOCK)) 371 error = 0; 372 } 373 cnt -= auio->uio_resid; 374 #ifdef KTRACE 375 if (ktruio != NULL) { 376 ktruio->uio_resid = cnt; 377 ktrgenio(fd, UIO_READ, ktruio, error); 378 } 379 #endif 380 td->td_retval[0] = cnt; 381 return (error); 382 } 383 384 #ifndef _SYS_SYSPROTO_H_ 385 struct write_args { 386 int fd; 387 const void *buf; 388 size_t nbyte; 389 }; 390 #endif 391 int 392 sys_write(struct thread *td, struct write_args *uap) 393 { 394 struct uio auio; 395 struct iovec aiov; 396 int error; 397 398 if (uap->nbyte > IOSIZE_MAX) 399 return (EINVAL); 400 aiov.iov_base = (void *)(uintptr_t)uap->buf; 401 aiov.iov_len = uap->nbyte; 402 auio.uio_iov = &aiov; 403 auio.uio_iovcnt = 1; 404 auio.uio_resid = uap->nbyte; 405 auio.uio_segflg = UIO_USERSPACE; 406 error = kern_writev(td, uap->fd, &auio); 407 return (error); 408 } 409 410 /* 411 * Positioned write system call. 412 */ 413 #ifndef _SYS_SYSPROTO_H_ 414 struct pwrite_args { 415 int fd; 416 const void *buf; 417 size_t nbyte; 418 int pad; 419 off_t offset; 420 }; 421 #endif 422 int 423 sys_pwrite(struct thread *td, struct pwrite_args *uap) 424 { 425 426 return (kern_pwrite(td, uap->fd, uap->buf, uap->nbyte, uap->offset)); 427 } 428 429 int 430 kern_pwrite(struct thread *td, int fd, const void *buf, size_t nbyte, 431 off_t offset) 432 { 433 struct uio auio; 434 struct iovec aiov; 435 int error; 436 437 if (nbyte > IOSIZE_MAX) 438 return (EINVAL); 439 aiov.iov_base = (void *)(uintptr_t)buf; 440 aiov.iov_len = nbyte; 441 auio.uio_iov = &aiov; 442 auio.uio_iovcnt = 1; 443 auio.uio_resid = nbyte; 444 auio.uio_segflg = UIO_USERSPACE; 445 error = kern_pwritev(td, fd, &auio, offset); 446 return (error); 447 } 448 449 #if defined(COMPAT_FREEBSD6) 450 int 451 freebsd6_pwrite(struct thread *td, struct freebsd6_pwrite_args *uap) 452 { 453 454 return (kern_pwrite(td, uap->fd, uap->buf, uap->nbyte, uap->offset)); 455 } 456 #endif 457 458 /* 459 * Gather write system call. 460 */ 461 #ifndef _SYS_SYSPROTO_H_ 462 struct writev_args { 463 int fd; 464 struct iovec *iovp; 465 u_int iovcnt; 466 }; 467 #endif 468 int 469 sys_writev(struct thread *td, struct writev_args *uap) 470 { 471 struct uio *auio; 472 int error; 473 474 error = copyinuio(uap->iovp, uap->iovcnt, &auio); 475 if (error) 476 return (error); 477 error = kern_writev(td, uap->fd, auio); 478 free(auio, M_IOV); 479 return (error); 480 } 481 482 int 483 kern_writev(struct thread *td, int fd, struct uio *auio) 484 { 485 struct file *fp; 486 int error; 487 488 error = fget_write(td, fd, &cap_write_rights, &fp); 489 if (error) 490 return (error); 491 error = dofilewrite(td, fd, fp, auio, (off_t)-1, 0); 492 fdrop(fp, td); 493 return (error); 494 } 495 496 /* 497 * Gather positioned write system call. 498 */ 499 #ifndef _SYS_SYSPROTO_H_ 500 struct pwritev_args { 501 int fd; 502 struct iovec *iovp; 503 u_int iovcnt; 504 off_t offset; 505 }; 506 #endif 507 int 508 sys_pwritev(struct thread *td, struct pwritev_args *uap) 509 { 510 struct uio *auio; 511 int error; 512 513 error = copyinuio(uap->iovp, uap->iovcnt, &auio); 514 if (error) 515 return (error); 516 error = kern_pwritev(td, uap->fd, auio, uap->offset); 517 free(auio, M_IOV); 518 return (error); 519 } 520 521 int 522 kern_pwritev(struct thread *td, int fd, struct uio *auio, off_t offset) 523 { 524 struct file *fp; 525 int error; 526 527 error = fget_write(td, fd, &cap_pwrite_rights, &fp); 528 if (error) 529 return (error); 530 if (!(fp->f_ops->fo_flags & DFLAG_SEEKABLE)) 531 error = ESPIPE; 532 else if (offset < 0 && 533 (fp->f_vnode == NULL || fp->f_vnode->v_type != VCHR)) 534 error = EINVAL; 535 else 536 error = dofilewrite(td, fd, fp, auio, offset, FOF_OFFSET); 537 fdrop(fp, td); 538 return (error); 539 } 540 541 /* 542 * Common code for writev and pwritev that writes data to 543 * a file using the passed in uio, offset, and flags. 544 */ 545 static int 546 dofilewrite(struct thread *td, int fd, struct file *fp, struct uio *auio, 547 off_t offset, int flags) 548 { 549 ssize_t cnt; 550 int error; 551 #ifdef KTRACE 552 struct uio *ktruio = NULL; 553 #endif 554 555 AUDIT_ARG_FD(fd); 556 auio->uio_rw = UIO_WRITE; 557 auio->uio_td = td; 558 auio->uio_offset = offset; 559 #ifdef KTRACE 560 if (KTRPOINT(td, KTR_GENIO)) 561 ktruio = cloneuio(auio); 562 #endif 563 cnt = auio->uio_resid; 564 if (fp->f_type == DTYPE_VNODE && 565 (fp->f_vnread_flags & FDEVFS_VNODE) == 0) 566 bwillwrite(); 567 if ((error = fo_write(fp, auio, td->td_ucred, flags, td))) { 568 if (auio->uio_resid != cnt && (error == ERESTART || 569 error == EINTR || error == EWOULDBLOCK)) 570 error = 0; 571 /* Socket layer is responsible for issuing SIGPIPE. */ 572 if (fp->f_type != DTYPE_SOCKET && error == EPIPE) { 573 PROC_LOCK(td->td_proc); 574 tdsignal(td, SIGPIPE); 575 PROC_UNLOCK(td->td_proc); 576 } 577 } 578 cnt -= auio->uio_resid; 579 #ifdef KTRACE 580 if (ktruio != NULL) { 581 ktruio->uio_resid = cnt; 582 ktrgenio(fd, UIO_WRITE, ktruio, error); 583 } 584 #endif 585 td->td_retval[0] = cnt; 586 return (error); 587 } 588 589 /* 590 * Truncate a file given a file descriptor. 591 * 592 * Can't use fget_write() here, since must return EINVAL and not EBADF if the 593 * descriptor isn't writable. 594 */ 595 int 596 kern_ftruncate(struct thread *td, int fd, off_t length) 597 { 598 struct file *fp; 599 int error; 600 601 AUDIT_ARG_FD(fd); 602 if (length < 0) 603 return (EINVAL); 604 error = fget(td, fd, &cap_ftruncate_rights, &fp); 605 if (error) 606 return (error); 607 AUDIT_ARG_FILE(td->td_proc, fp); 608 if (!(fp->f_flag & FWRITE)) { 609 fdrop(fp, td); 610 return (EINVAL); 611 } 612 error = fo_truncate(fp, length, td->td_ucred, td); 613 fdrop(fp, td); 614 return (error); 615 } 616 617 #ifndef _SYS_SYSPROTO_H_ 618 struct ftruncate_args { 619 int fd; 620 int pad; 621 off_t length; 622 }; 623 #endif 624 int 625 sys_ftruncate(struct thread *td, struct ftruncate_args *uap) 626 { 627 628 return (kern_ftruncate(td, uap->fd, uap->length)); 629 } 630 631 #if defined(COMPAT_43) 632 #ifndef _SYS_SYSPROTO_H_ 633 struct oftruncate_args { 634 int fd; 635 long length; 636 }; 637 #endif 638 int 639 oftruncate(struct thread *td, struct oftruncate_args *uap) 640 { 641 642 return (kern_ftruncate(td, uap->fd, uap->length)); 643 } 644 #endif /* COMPAT_43 */ 645 646 #ifndef _SYS_SYSPROTO_H_ 647 struct ioctl_args { 648 int fd; 649 u_long com; 650 caddr_t data; 651 }; 652 #endif 653 /* ARGSUSED */ 654 int 655 sys_ioctl(struct thread *td, struct ioctl_args *uap) 656 { 657 u_char smalldata[SYS_IOCTL_SMALL_SIZE] __aligned(SYS_IOCTL_SMALL_ALIGN); 658 u_long com; 659 int arg, error; 660 u_int size; 661 caddr_t data; 662 663 if (uap->com > 0xffffffff) { 664 printf( 665 "WARNING pid %d (%s): ioctl sign-extension ioctl %lx\n", 666 td->td_proc->p_pid, td->td_name, uap->com); 667 uap->com &= 0xffffffff; 668 } 669 com = uap->com; 670 671 /* 672 * Interpret high order word to find amount of data to be 673 * copied to/from the user's address space. 674 */ 675 size = IOCPARM_LEN(com); 676 if ((size > IOCPARM_MAX) || 677 ((com & (IOC_VOID | IOC_IN | IOC_OUT)) == 0) || 678 #if defined(COMPAT_FREEBSD5) || defined(COMPAT_FREEBSD4) || defined(COMPAT_43) 679 ((com & IOC_OUT) && size == 0) || 680 #else 681 ((com & (IOC_IN | IOC_OUT)) && size == 0) || 682 #endif 683 ((com & IOC_VOID) && size > 0 && size != sizeof(int))) 684 return (ENOTTY); 685 686 if (size > 0) { 687 if (com & IOC_VOID) { 688 /* Integer argument. */ 689 arg = (intptr_t)uap->data; 690 data = (void *)&arg; 691 size = 0; 692 } else { 693 if (size > SYS_IOCTL_SMALL_SIZE) 694 data = malloc((u_long)size, M_IOCTLOPS, M_WAITOK); 695 else 696 data = smalldata; 697 } 698 } else 699 data = (void *)&uap->data; 700 if (com & IOC_IN) { 701 error = copyin(uap->data, data, (u_int)size); 702 if (error != 0) 703 goto out; 704 } else if (com & IOC_OUT) { 705 /* 706 * Zero the buffer so the user always 707 * gets back something deterministic. 708 */ 709 bzero(data, size); 710 } 711 712 error = kern_ioctl(td, uap->fd, com, data); 713 714 if (error == 0 && (com & IOC_OUT)) 715 error = copyout(data, uap->data, (u_int)size); 716 717 out: 718 if (size > SYS_IOCTL_SMALL_SIZE) 719 free(data, M_IOCTLOPS); 720 return (error); 721 } 722 723 int 724 kern_ioctl(struct thread *td, int fd, u_long com, caddr_t data) 725 { 726 struct file *fp; 727 struct filedesc *fdp; 728 int error, tmp, locked; 729 730 AUDIT_ARG_FD(fd); 731 AUDIT_ARG_CMD(com); 732 733 fdp = td->td_proc->p_fd; 734 735 switch (com) { 736 case FIONCLEX: 737 case FIOCLEX: 738 FILEDESC_XLOCK(fdp); 739 locked = LA_XLOCKED; 740 break; 741 default: 742 #ifdef CAPABILITIES 743 FILEDESC_SLOCK(fdp); 744 locked = LA_SLOCKED; 745 #else 746 locked = LA_UNLOCKED; 747 #endif 748 break; 749 } 750 751 #ifdef CAPABILITIES 752 if ((fp = fget_locked(fdp, fd)) == NULL) { 753 error = EBADF; 754 goto out; 755 } 756 if ((error = cap_ioctl_check(fdp, fd, com)) != 0) { 757 fp = NULL; /* fhold() was not called yet */ 758 goto out; 759 } 760 fhold(fp); 761 if (locked == LA_SLOCKED) { 762 FILEDESC_SUNLOCK(fdp); 763 locked = LA_UNLOCKED; 764 } 765 #else 766 error = fget(td, fd, &cap_ioctl_rights, &fp); 767 if (error != 0) { 768 fp = NULL; 769 goto out; 770 } 771 #endif 772 if ((fp->f_flag & (FREAD | FWRITE)) == 0) { 773 error = EBADF; 774 goto out; 775 } 776 777 switch (com) { 778 case FIONCLEX: 779 fdp->fd_ofiles[fd].fde_flags &= ~UF_EXCLOSE; 780 goto out; 781 case FIOCLEX: 782 fdp->fd_ofiles[fd].fde_flags |= UF_EXCLOSE; 783 goto out; 784 case FIONBIO: 785 if ((tmp = *(int *)data)) 786 atomic_set_int(&fp->f_flag, FNONBLOCK); 787 else 788 atomic_clear_int(&fp->f_flag, FNONBLOCK); 789 data = (void *)&tmp; 790 break; 791 case FIOASYNC: 792 if ((tmp = *(int *)data)) 793 atomic_set_int(&fp->f_flag, FASYNC); 794 else 795 atomic_clear_int(&fp->f_flag, FASYNC); 796 data = (void *)&tmp; 797 break; 798 } 799 800 error = fo_ioctl(fp, com, data, td->td_ucred, td); 801 out: 802 switch (locked) { 803 case LA_XLOCKED: 804 FILEDESC_XUNLOCK(fdp); 805 break; 806 #ifdef CAPABILITIES 807 case LA_SLOCKED: 808 FILEDESC_SUNLOCK(fdp); 809 break; 810 #endif 811 default: 812 FILEDESC_UNLOCK_ASSERT(fdp); 813 break; 814 } 815 if (fp != NULL) 816 fdrop(fp, td); 817 return (error); 818 } 819 820 int 821 poll_no_poll(int events) 822 { 823 /* 824 * Return true for read/write. If the user asked for something 825 * special, return POLLNVAL, so that clients have a way of 826 * determining reliably whether or not the extended 827 * functionality is present without hard-coding knowledge 828 * of specific filesystem implementations. 829 */ 830 if (events & ~POLLSTANDARD) 831 return (POLLNVAL); 832 833 return (events & (POLLIN | POLLOUT | POLLRDNORM | POLLWRNORM)); 834 } 835 836 int 837 sys_pselect(struct thread *td, struct pselect_args *uap) 838 { 839 struct timespec ts; 840 struct timeval tv, *tvp; 841 sigset_t set, *uset; 842 int error; 843 844 if (uap->ts != NULL) { 845 error = copyin(uap->ts, &ts, sizeof(ts)); 846 if (error != 0) 847 return (error); 848 TIMESPEC_TO_TIMEVAL(&tv, &ts); 849 tvp = &tv; 850 } else 851 tvp = NULL; 852 if (uap->sm != NULL) { 853 error = copyin(uap->sm, &set, sizeof(set)); 854 if (error != 0) 855 return (error); 856 uset = &set; 857 } else 858 uset = NULL; 859 return (kern_pselect(td, uap->nd, uap->in, uap->ou, uap->ex, tvp, 860 uset, NFDBITS)); 861 } 862 863 int 864 kern_pselect(struct thread *td, int nd, fd_set *in, fd_set *ou, fd_set *ex, 865 struct timeval *tvp, sigset_t *uset, int abi_nfdbits) 866 { 867 int error; 868 869 if (uset != NULL) { 870 error = kern_sigprocmask(td, SIG_SETMASK, uset, 871 &td->td_oldsigmask, 0); 872 if (error != 0) 873 return (error); 874 td->td_pflags |= TDP_OLDMASK; 875 /* 876 * Make sure that ast() is called on return to 877 * usermode and TDP_OLDMASK is cleared, restoring old 878 * sigmask. 879 */ 880 thread_lock(td); 881 td->td_flags |= TDF_ASTPENDING; 882 thread_unlock(td); 883 } 884 error = kern_select(td, nd, in, ou, ex, tvp, abi_nfdbits); 885 return (error); 886 } 887 888 #ifndef _SYS_SYSPROTO_H_ 889 struct select_args { 890 int nd; 891 fd_set *in, *ou, *ex; 892 struct timeval *tv; 893 }; 894 #endif 895 int 896 sys_select(struct thread *td, struct select_args *uap) 897 { 898 struct timeval tv, *tvp; 899 int error; 900 901 if (uap->tv != NULL) { 902 error = copyin(uap->tv, &tv, sizeof(tv)); 903 if (error) 904 return (error); 905 tvp = &tv; 906 } else 907 tvp = NULL; 908 909 return (kern_select(td, uap->nd, uap->in, uap->ou, uap->ex, tvp, 910 NFDBITS)); 911 } 912 913 /* 914 * In the unlikely case when user specified n greater then the last 915 * open file descriptor, check that no bits are set after the last 916 * valid fd. We must return EBADF if any is set. 917 * 918 * There are applications that rely on the behaviour. 919 * 920 * nd is fd_lastfile + 1. 921 */ 922 static int 923 select_check_badfd(fd_set *fd_in, int nd, int ndu, int abi_nfdbits) 924 { 925 char *addr, *oaddr; 926 int b, i, res; 927 uint8_t bits; 928 929 if (nd >= ndu || fd_in == NULL) 930 return (0); 931 932 oaddr = NULL; 933 bits = 0; /* silence gcc */ 934 for (i = nd; i < ndu; i++) { 935 b = i / NBBY; 936 #if BYTE_ORDER == LITTLE_ENDIAN 937 addr = (char *)fd_in + b; 938 #else 939 addr = (char *)fd_in; 940 if (abi_nfdbits == NFDBITS) { 941 addr += rounddown(b, sizeof(fd_mask)) + 942 sizeof(fd_mask) - 1 - b % sizeof(fd_mask); 943 } else { 944 addr += rounddown(b, sizeof(uint32_t)) + 945 sizeof(uint32_t) - 1 - b % sizeof(uint32_t); 946 } 947 #endif 948 if (addr != oaddr) { 949 res = fubyte(addr); 950 if (res == -1) 951 return (EFAULT); 952 oaddr = addr; 953 bits = res; 954 } 955 if ((bits & (1 << (i % NBBY))) != 0) 956 return (EBADF); 957 } 958 return (0); 959 } 960 961 int 962 kern_select(struct thread *td, int nd, fd_set *fd_in, fd_set *fd_ou, 963 fd_set *fd_ex, struct timeval *tvp, int abi_nfdbits) 964 { 965 struct filedesc *fdp; 966 /* 967 * The magic 2048 here is chosen to be just enough for FD_SETSIZE 968 * infds with the new FD_SETSIZE of 1024, and more than enough for 969 * FD_SETSIZE infds, outfds and exceptfds with the old FD_SETSIZE 970 * of 256. 971 */ 972 fd_mask s_selbits[howmany(2048, NFDBITS)]; 973 fd_mask *ibits[3], *obits[3], *selbits, *sbp; 974 struct timeval rtv; 975 sbintime_t asbt, precision, rsbt; 976 u_int nbufbytes, ncpbytes, ncpubytes, nfdbits; 977 int error, lf, ndu; 978 979 if (nd < 0) 980 return (EINVAL); 981 fdp = td->td_proc->p_fd; 982 ndu = nd; 983 lf = fdp->fd_lastfile; 984 if (nd > lf + 1) 985 nd = lf + 1; 986 987 error = select_check_badfd(fd_in, nd, ndu, abi_nfdbits); 988 if (error != 0) 989 return (error); 990 error = select_check_badfd(fd_ou, nd, ndu, abi_nfdbits); 991 if (error != 0) 992 return (error); 993 error = select_check_badfd(fd_ex, nd, ndu, abi_nfdbits); 994 if (error != 0) 995 return (error); 996 997 /* 998 * Allocate just enough bits for the non-null fd_sets. Use the 999 * preallocated auto buffer if possible. 1000 */ 1001 nfdbits = roundup(nd, NFDBITS); 1002 ncpbytes = nfdbits / NBBY; 1003 ncpubytes = roundup(nd, abi_nfdbits) / NBBY; 1004 nbufbytes = 0; 1005 if (fd_in != NULL) 1006 nbufbytes += 2 * ncpbytes; 1007 if (fd_ou != NULL) 1008 nbufbytes += 2 * ncpbytes; 1009 if (fd_ex != NULL) 1010 nbufbytes += 2 * ncpbytes; 1011 if (nbufbytes <= sizeof s_selbits) 1012 selbits = &s_selbits[0]; 1013 else 1014 selbits = malloc(nbufbytes, M_SELECT, M_WAITOK); 1015 1016 /* 1017 * Assign pointers into the bit buffers and fetch the input bits. 1018 * Put the output buffers together so that they can be bzeroed 1019 * together. 1020 */ 1021 sbp = selbits; 1022 #define getbits(name, x) \ 1023 do { \ 1024 if (name == NULL) { \ 1025 ibits[x] = NULL; \ 1026 obits[x] = NULL; \ 1027 } else { \ 1028 ibits[x] = sbp + nbufbytes / 2 / sizeof *sbp; \ 1029 obits[x] = sbp; \ 1030 sbp += ncpbytes / sizeof *sbp; \ 1031 error = copyin(name, ibits[x], ncpubytes); \ 1032 if (error != 0) \ 1033 goto done; \ 1034 bzero((char *)ibits[x] + ncpubytes, \ 1035 ncpbytes - ncpubytes); \ 1036 } \ 1037 } while (0) 1038 getbits(fd_in, 0); 1039 getbits(fd_ou, 1); 1040 getbits(fd_ex, 2); 1041 #undef getbits 1042 1043 #if BYTE_ORDER == BIG_ENDIAN && defined(__LP64__) 1044 /* 1045 * XXX: swizzle_fdset assumes that if abi_nfdbits != NFDBITS, 1046 * we are running under 32-bit emulation. This should be more 1047 * generic. 1048 */ 1049 #define swizzle_fdset(bits) \ 1050 if (abi_nfdbits != NFDBITS && bits != NULL) { \ 1051 int i; \ 1052 for (i = 0; i < ncpbytes / sizeof *sbp; i++) \ 1053 bits[i] = (bits[i] >> 32) | (bits[i] << 32); \ 1054 } 1055 #else 1056 #define swizzle_fdset(bits) 1057 #endif 1058 1059 /* Make sure the bit order makes it through an ABI transition */ 1060 swizzle_fdset(ibits[0]); 1061 swizzle_fdset(ibits[1]); 1062 swizzle_fdset(ibits[2]); 1063 1064 if (nbufbytes != 0) 1065 bzero(selbits, nbufbytes / 2); 1066 1067 precision = 0; 1068 if (tvp != NULL) { 1069 rtv = *tvp; 1070 if (rtv.tv_sec < 0 || rtv.tv_usec < 0 || 1071 rtv.tv_usec >= 1000000) { 1072 error = EINVAL; 1073 goto done; 1074 } 1075 if (!timevalisset(&rtv)) 1076 asbt = 0; 1077 else if (rtv.tv_sec <= INT32_MAX) { 1078 rsbt = tvtosbt(rtv); 1079 precision = rsbt; 1080 precision >>= tc_precexp; 1081 if (TIMESEL(&asbt, rsbt)) 1082 asbt += tc_tick_sbt; 1083 if (asbt <= SBT_MAX - rsbt) 1084 asbt += rsbt; 1085 else 1086 asbt = -1; 1087 } else 1088 asbt = -1; 1089 } else 1090 asbt = -1; 1091 seltdinit(td); 1092 /* Iterate until the timeout expires or descriptors become ready. */ 1093 for (;;) { 1094 error = selscan(td, ibits, obits, nd); 1095 if (error || td->td_retval[0] != 0) 1096 break; 1097 error = seltdwait(td, asbt, precision); 1098 if (error) 1099 break; 1100 error = selrescan(td, ibits, obits); 1101 if (error || td->td_retval[0] != 0) 1102 break; 1103 } 1104 seltdclear(td); 1105 1106 done: 1107 /* select is not restarted after signals... */ 1108 if (error == ERESTART) 1109 error = EINTR; 1110 if (error == EWOULDBLOCK) 1111 error = 0; 1112 1113 /* swizzle bit order back, if necessary */ 1114 swizzle_fdset(obits[0]); 1115 swizzle_fdset(obits[1]); 1116 swizzle_fdset(obits[2]); 1117 #undef swizzle_fdset 1118 1119 #define putbits(name, x) \ 1120 if (name && (error2 = copyout(obits[x], name, ncpubytes))) \ 1121 error = error2; 1122 if (error == 0) { 1123 int error2; 1124 1125 putbits(fd_in, 0); 1126 putbits(fd_ou, 1); 1127 putbits(fd_ex, 2); 1128 #undef putbits 1129 } 1130 if (selbits != &s_selbits[0]) 1131 free(selbits, M_SELECT); 1132 1133 return (error); 1134 } 1135 /* 1136 * Convert a select bit set to poll flags. 1137 * 1138 * The backend always returns POLLHUP/POLLERR if appropriate and we 1139 * return this as a set bit in any set. 1140 */ 1141 static int select_flags[3] = { 1142 POLLRDNORM | POLLHUP | POLLERR, 1143 POLLWRNORM | POLLHUP | POLLERR, 1144 POLLRDBAND | POLLERR 1145 }; 1146 1147 /* 1148 * Compute the fo_poll flags required for a fd given by the index and 1149 * bit position in the fd_mask array. 1150 */ 1151 static __inline int 1152 selflags(fd_mask **ibits, int idx, fd_mask bit) 1153 { 1154 int flags; 1155 int msk; 1156 1157 flags = 0; 1158 for (msk = 0; msk < 3; msk++) { 1159 if (ibits[msk] == NULL) 1160 continue; 1161 if ((ibits[msk][idx] & bit) == 0) 1162 continue; 1163 flags |= select_flags[msk]; 1164 } 1165 return (flags); 1166 } 1167 1168 /* 1169 * Set the appropriate output bits given a mask of fired events and the 1170 * input bits originally requested. 1171 */ 1172 static __inline int 1173 selsetbits(fd_mask **ibits, fd_mask **obits, int idx, fd_mask bit, int events) 1174 { 1175 int msk; 1176 int n; 1177 1178 n = 0; 1179 for (msk = 0; msk < 3; msk++) { 1180 if ((events & select_flags[msk]) == 0) 1181 continue; 1182 if (ibits[msk] == NULL) 1183 continue; 1184 if ((ibits[msk][idx] & bit) == 0) 1185 continue; 1186 /* 1187 * XXX Check for a duplicate set. This can occur because a 1188 * socket calls selrecord() twice for each poll() call 1189 * resulting in two selfds per real fd. selrescan() will 1190 * call selsetbits twice as a result. 1191 */ 1192 if ((obits[msk][idx] & bit) != 0) 1193 continue; 1194 obits[msk][idx] |= bit; 1195 n++; 1196 } 1197 1198 return (n); 1199 } 1200 1201 static __inline int 1202 getselfd_cap(struct filedesc *fdp, int fd, struct file **fpp) 1203 { 1204 1205 return (fget_unlocked(fdp, fd, &cap_event_rights, fpp, NULL)); 1206 } 1207 1208 /* 1209 * Traverse the list of fds attached to this thread's seltd and check for 1210 * completion. 1211 */ 1212 static int 1213 selrescan(struct thread *td, fd_mask **ibits, fd_mask **obits) 1214 { 1215 struct filedesc *fdp; 1216 struct selinfo *si; 1217 struct seltd *stp; 1218 struct selfd *sfp; 1219 struct selfd *sfn; 1220 struct file *fp; 1221 fd_mask bit; 1222 int fd, ev, n, idx; 1223 int error; 1224 1225 fdp = td->td_proc->p_fd; 1226 stp = td->td_sel; 1227 n = 0; 1228 STAILQ_FOREACH_SAFE(sfp, &stp->st_selq, sf_link, sfn) { 1229 fd = (int)(uintptr_t)sfp->sf_cookie; 1230 si = sfp->sf_si; 1231 selfdfree(stp, sfp); 1232 /* If the selinfo wasn't cleared the event didn't fire. */ 1233 if (si != NULL) 1234 continue; 1235 error = getselfd_cap(fdp, fd, &fp); 1236 if (error) 1237 return (error); 1238 idx = fd / NFDBITS; 1239 bit = (fd_mask)1 << (fd % NFDBITS); 1240 ev = fo_poll(fp, selflags(ibits, idx, bit), td->td_ucred, td); 1241 fdrop(fp, td); 1242 if (ev != 0) 1243 n += selsetbits(ibits, obits, idx, bit, ev); 1244 } 1245 stp->st_flags = 0; 1246 td->td_retval[0] = n; 1247 return (0); 1248 } 1249 1250 /* 1251 * Perform the initial filedescriptor scan and register ourselves with 1252 * each selinfo. 1253 */ 1254 static int 1255 selscan(struct thread *td, fd_mask **ibits, fd_mask **obits, int nfd) 1256 { 1257 struct filedesc *fdp; 1258 struct file *fp; 1259 fd_mask bit; 1260 int ev, flags, end, fd; 1261 int n, idx; 1262 int error; 1263 1264 fdp = td->td_proc->p_fd; 1265 n = 0; 1266 for (idx = 0, fd = 0; fd < nfd; idx++) { 1267 end = imin(fd + NFDBITS, nfd); 1268 for (bit = 1; fd < end; bit <<= 1, fd++) { 1269 /* Compute the list of events we're interested in. */ 1270 flags = selflags(ibits, idx, bit); 1271 if (flags == 0) 1272 continue; 1273 error = getselfd_cap(fdp, fd, &fp); 1274 if (error) 1275 return (error); 1276 selfdalloc(td, (void *)(uintptr_t)fd); 1277 ev = fo_poll(fp, flags, td->td_ucred, td); 1278 fdrop(fp, td); 1279 if (ev != 0) 1280 n += selsetbits(ibits, obits, idx, bit, ev); 1281 } 1282 } 1283 1284 td->td_retval[0] = n; 1285 return (0); 1286 } 1287 1288 int 1289 sys_poll(struct thread *td, struct poll_args *uap) 1290 { 1291 struct timespec ts, *tsp; 1292 1293 if (uap->timeout != INFTIM) { 1294 if (uap->timeout < 0) 1295 return (EINVAL); 1296 ts.tv_sec = uap->timeout / 1000; 1297 ts.tv_nsec = (uap->timeout % 1000) * 1000000; 1298 tsp = &ts; 1299 } else 1300 tsp = NULL; 1301 1302 return (kern_poll(td, uap->fds, uap->nfds, tsp, NULL)); 1303 } 1304 1305 int 1306 kern_poll(struct thread *td, struct pollfd *fds, u_int nfds, 1307 struct timespec *tsp, sigset_t *uset) 1308 { 1309 struct pollfd *bits; 1310 struct pollfd smallbits[32]; 1311 sbintime_t sbt, precision, tmp; 1312 time_t over; 1313 struct timespec ts; 1314 int error; 1315 size_t ni; 1316 1317 precision = 0; 1318 if (tsp != NULL) { 1319 if (tsp->tv_sec < 0) 1320 return (EINVAL); 1321 if (tsp->tv_nsec < 0 || tsp->tv_nsec >= 1000000000) 1322 return (EINVAL); 1323 if (tsp->tv_sec == 0 && tsp->tv_nsec == 0) 1324 sbt = 0; 1325 else { 1326 ts = *tsp; 1327 if (ts.tv_sec > INT32_MAX / 2) { 1328 over = ts.tv_sec - INT32_MAX / 2; 1329 ts.tv_sec -= over; 1330 } else 1331 over = 0; 1332 tmp = tstosbt(ts); 1333 precision = tmp; 1334 precision >>= tc_precexp; 1335 if (TIMESEL(&sbt, tmp)) 1336 sbt += tc_tick_sbt; 1337 sbt += tmp; 1338 } 1339 } else 1340 sbt = -1; 1341 1342 if (nfds > maxfilesperproc && nfds > FD_SETSIZE) 1343 return (EINVAL); 1344 ni = nfds * sizeof(struct pollfd); 1345 if (ni > sizeof(smallbits)) 1346 bits = malloc(ni, M_TEMP, M_WAITOK); 1347 else 1348 bits = smallbits; 1349 error = copyin(fds, bits, ni); 1350 if (error) 1351 goto done; 1352 1353 if (uset != NULL) { 1354 error = kern_sigprocmask(td, SIG_SETMASK, uset, 1355 &td->td_oldsigmask, 0); 1356 if (error) 1357 goto done; 1358 td->td_pflags |= TDP_OLDMASK; 1359 /* 1360 * Make sure that ast() is called on return to 1361 * usermode and TDP_OLDMASK is cleared, restoring old 1362 * sigmask. 1363 */ 1364 thread_lock(td); 1365 td->td_flags |= TDF_ASTPENDING; 1366 thread_unlock(td); 1367 } 1368 1369 seltdinit(td); 1370 /* Iterate until the timeout expires or descriptors become ready. */ 1371 for (;;) { 1372 error = pollscan(td, bits, nfds); 1373 if (error || td->td_retval[0] != 0) 1374 break; 1375 error = seltdwait(td, sbt, precision); 1376 if (error) 1377 break; 1378 error = pollrescan(td); 1379 if (error || td->td_retval[0] != 0) 1380 break; 1381 } 1382 seltdclear(td); 1383 1384 done: 1385 /* poll is not restarted after signals... */ 1386 if (error == ERESTART) 1387 error = EINTR; 1388 if (error == EWOULDBLOCK) 1389 error = 0; 1390 if (error == 0) { 1391 error = pollout(td, bits, fds, nfds); 1392 if (error) 1393 goto out; 1394 } 1395 out: 1396 if (ni > sizeof(smallbits)) 1397 free(bits, M_TEMP); 1398 return (error); 1399 } 1400 1401 int 1402 sys_ppoll(struct thread *td, struct ppoll_args *uap) 1403 { 1404 struct timespec ts, *tsp; 1405 sigset_t set, *ssp; 1406 int error; 1407 1408 if (uap->ts != NULL) { 1409 error = copyin(uap->ts, &ts, sizeof(ts)); 1410 if (error) 1411 return (error); 1412 tsp = &ts; 1413 } else 1414 tsp = NULL; 1415 if (uap->set != NULL) { 1416 error = copyin(uap->set, &set, sizeof(set)); 1417 if (error) 1418 return (error); 1419 ssp = &set; 1420 } else 1421 ssp = NULL; 1422 /* 1423 * fds is still a pointer to user space. kern_poll() will 1424 * take care of copyin that array to the kernel space. 1425 */ 1426 1427 return (kern_poll(td, uap->fds, uap->nfds, tsp, ssp)); 1428 } 1429 1430 static int 1431 pollrescan(struct thread *td) 1432 { 1433 struct seltd *stp; 1434 struct selfd *sfp; 1435 struct selfd *sfn; 1436 struct selinfo *si; 1437 struct filedesc *fdp; 1438 struct file *fp; 1439 struct pollfd *fd; 1440 int n; 1441 1442 n = 0; 1443 fdp = td->td_proc->p_fd; 1444 stp = td->td_sel; 1445 FILEDESC_SLOCK(fdp); 1446 STAILQ_FOREACH_SAFE(sfp, &stp->st_selq, sf_link, sfn) { 1447 fd = (struct pollfd *)sfp->sf_cookie; 1448 si = sfp->sf_si; 1449 selfdfree(stp, sfp); 1450 /* If the selinfo wasn't cleared the event didn't fire. */ 1451 if (si != NULL) 1452 continue; 1453 fp = fdp->fd_ofiles[fd->fd].fde_file; 1454 #ifdef CAPABILITIES 1455 if (fp == NULL || 1456 cap_check(cap_rights(fdp, fd->fd), &cap_event_rights) != 0) 1457 #else 1458 if (fp == NULL) 1459 #endif 1460 { 1461 fd->revents = POLLNVAL; 1462 n++; 1463 continue; 1464 } 1465 1466 /* 1467 * Note: backend also returns POLLHUP and 1468 * POLLERR if appropriate. 1469 */ 1470 fd->revents = fo_poll(fp, fd->events, td->td_ucred, td); 1471 if (fd->revents != 0) 1472 n++; 1473 } 1474 FILEDESC_SUNLOCK(fdp); 1475 stp->st_flags = 0; 1476 td->td_retval[0] = n; 1477 return (0); 1478 } 1479 1480 1481 static int 1482 pollout(struct thread *td, struct pollfd *fds, struct pollfd *ufds, u_int nfd) 1483 { 1484 int error = 0; 1485 u_int i = 0; 1486 u_int n = 0; 1487 1488 for (i = 0; i < nfd; i++) { 1489 error = copyout(&fds->revents, &ufds->revents, 1490 sizeof(ufds->revents)); 1491 if (error) 1492 return (error); 1493 if (fds->revents != 0) 1494 n++; 1495 fds++; 1496 ufds++; 1497 } 1498 td->td_retval[0] = n; 1499 return (0); 1500 } 1501 1502 static int 1503 pollscan(struct thread *td, struct pollfd *fds, u_int nfd) 1504 { 1505 struct filedesc *fdp = td->td_proc->p_fd; 1506 struct file *fp; 1507 int i, n = 0; 1508 1509 FILEDESC_SLOCK(fdp); 1510 for (i = 0; i < nfd; i++, fds++) { 1511 if (fds->fd > fdp->fd_lastfile) { 1512 fds->revents = POLLNVAL; 1513 n++; 1514 } else if (fds->fd < 0) { 1515 fds->revents = 0; 1516 } else { 1517 fp = fdp->fd_ofiles[fds->fd].fde_file; 1518 #ifdef CAPABILITIES 1519 if (fp == NULL || 1520 cap_check(cap_rights(fdp, fds->fd), &cap_event_rights) != 0) 1521 #else 1522 if (fp == NULL) 1523 #endif 1524 { 1525 fds->revents = POLLNVAL; 1526 n++; 1527 } else { 1528 /* 1529 * Note: backend also returns POLLHUP and 1530 * POLLERR if appropriate. 1531 */ 1532 selfdalloc(td, fds); 1533 fds->revents = fo_poll(fp, fds->events, 1534 td->td_ucred, td); 1535 /* 1536 * POSIX requires POLLOUT to be never 1537 * set simultaneously with POLLHUP. 1538 */ 1539 if ((fds->revents & POLLHUP) != 0) 1540 fds->revents &= ~POLLOUT; 1541 1542 if (fds->revents != 0) 1543 n++; 1544 } 1545 } 1546 } 1547 FILEDESC_SUNLOCK(fdp); 1548 td->td_retval[0] = n; 1549 return (0); 1550 } 1551 1552 /* 1553 * XXX This was created specifically to support netncp and netsmb. This 1554 * allows the caller to specify a socket to wait for events on. It returns 1555 * 0 if any events matched and an error otherwise. There is no way to 1556 * determine which events fired. 1557 */ 1558 int 1559 selsocket(struct socket *so, int events, struct timeval *tvp, struct thread *td) 1560 { 1561 struct timeval rtv; 1562 sbintime_t asbt, precision, rsbt; 1563 int error; 1564 1565 precision = 0; /* stupid gcc! */ 1566 if (tvp != NULL) { 1567 rtv = *tvp; 1568 if (rtv.tv_sec < 0 || rtv.tv_usec < 0 || 1569 rtv.tv_usec >= 1000000) 1570 return (EINVAL); 1571 if (!timevalisset(&rtv)) 1572 asbt = 0; 1573 else if (rtv.tv_sec <= INT32_MAX) { 1574 rsbt = tvtosbt(rtv); 1575 precision = rsbt; 1576 precision >>= tc_precexp; 1577 if (TIMESEL(&asbt, rsbt)) 1578 asbt += tc_tick_sbt; 1579 if (asbt <= SBT_MAX - rsbt) 1580 asbt += rsbt; 1581 else 1582 asbt = -1; 1583 } else 1584 asbt = -1; 1585 } else 1586 asbt = -1; 1587 seltdinit(td); 1588 /* 1589 * Iterate until the timeout expires or the socket becomes ready. 1590 */ 1591 for (;;) { 1592 selfdalloc(td, NULL); 1593 error = sopoll(so, events, NULL, td); 1594 /* error here is actually the ready events. */ 1595 if (error) 1596 return (0); 1597 error = seltdwait(td, asbt, precision); 1598 if (error) 1599 break; 1600 } 1601 seltdclear(td); 1602 /* XXX Duplicates ncp/smb behavior. */ 1603 if (error == ERESTART) 1604 error = 0; 1605 return (error); 1606 } 1607 1608 /* 1609 * Preallocate two selfds associated with 'cookie'. Some fo_poll routines 1610 * have two select sets, one for read and another for write. 1611 */ 1612 static void 1613 selfdalloc(struct thread *td, void *cookie) 1614 { 1615 struct seltd *stp; 1616 1617 stp = td->td_sel; 1618 if (stp->st_free1 == NULL) 1619 stp->st_free1 = uma_zalloc(selfd_zone, M_WAITOK|M_ZERO); 1620 stp->st_free1->sf_td = stp; 1621 stp->st_free1->sf_cookie = cookie; 1622 if (stp->st_free2 == NULL) 1623 stp->st_free2 = uma_zalloc(selfd_zone, M_WAITOK|M_ZERO); 1624 stp->st_free2->sf_td = stp; 1625 stp->st_free2->sf_cookie = cookie; 1626 } 1627 1628 static void 1629 selfdfree(struct seltd *stp, struct selfd *sfp) 1630 { 1631 STAILQ_REMOVE(&stp->st_selq, sfp, selfd, sf_link); 1632 if (sfp->sf_si != NULL) { 1633 mtx_lock(sfp->sf_mtx); 1634 if (sfp->sf_si != NULL) { 1635 TAILQ_REMOVE(&sfp->sf_si->si_tdlist, sfp, sf_threads); 1636 refcount_release(&sfp->sf_refs); 1637 } 1638 mtx_unlock(sfp->sf_mtx); 1639 } 1640 if (refcount_release(&sfp->sf_refs)) 1641 uma_zfree(selfd_zone, sfp); 1642 } 1643 1644 /* Drain the waiters tied to all the selfd belonging the specified selinfo. */ 1645 void 1646 seldrain(struct selinfo *sip) 1647 { 1648 1649 /* 1650 * This feature is already provided by doselwakeup(), thus it is 1651 * enough to go for it. 1652 * Eventually, the context, should take care to avoid races 1653 * between thread calling select()/poll() and file descriptor 1654 * detaching, but, again, the races are just the same as 1655 * selwakeup(). 1656 */ 1657 doselwakeup(sip, -1); 1658 } 1659 1660 /* 1661 * Record a select request. 1662 */ 1663 void 1664 selrecord(struct thread *selector, struct selinfo *sip) 1665 { 1666 struct selfd *sfp; 1667 struct seltd *stp; 1668 struct mtx *mtxp; 1669 1670 stp = selector->td_sel; 1671 /* 1672 * Don't record when doing a rescan. 1673 */ 1674 if (stp->st_flags & SELTD_RESCAN) 1675 return; 1676 /* 1677 * Grab one of the preallocated descriptors. 1678 */ 1679 sfp = NULL; 1680 if ((sfp = stp->st_free1) != NULL) 1681 stp->st_free1 = NULL; 1682 else if ((sfp = stp->st_free2) != NULL) 1683 stp->st_free2 = NULL; 1684 else 1685 panic("selrecord: No free selfd on selq"); 1686 mtxp = sip->si_mtx; 1687 if (mtxp == NULL) 1688 mtxp = mtx_pool_find(mtxpool_select, sip); 1689 /* 1690 * Initialize the sfp and queue it in the thread. 1691 */ 1692 sfp->sf_si = sip; 1693 sfp->sf_mtx = mtxp; 1694 refcount_init(&sfp->sf_refs, 2); 1695 STAILQ_INSERT_TAIL(&stp->st_selq, sfp, sf_link); 1696 /* 1697 * Now that we've locked the sip, check for initialization. 1698 */ 1699 mtx_lock(mtxp); 1700 if (sip->si_mtx == NULL) { 1701 sip->si_mtx = mtxp; 1702 TAILQ_INIT(&sip->si_tdlist); 1703 } 1704 /* 1705 * Add this thread to the list of selfds listening on this selinfo. 1706 */ 1707 TAILQ_INSERT_TAIL(&sip->si_tdlist, sfp, sf_threads); 1708 mtx_unlock(sip->si_mtx); 1709 } 1710 1711 /* Wake up a selecting thread. */ 1712 void 1713 selwakeup(struct selinfo *sip) 1714 { 1715 doselwakeup(sip, -1); 1716 } 1717 1718 /* Wake up a selecting thread, and set its priority. */ 1719 void 1720 selwakeuppri(struct selinfo *sip, int pri) 1721 { 1722 doselwakeup(sip, pri); 1723 } 1724 1725 /* 1726 * Do a wakeup when a selectable event occurs. 1727 */ 1728 static void 1729 doselwakeup(struct selinfo *sip, int pri) 1730 { 1731 struct selfd *sfp; 1732 struct selfd *sfn; 1733 struct seltd *stp; 1734 1735 /* If it's not initialized there can't be any waiters. */ 1736 if (sip->si_mtx == NULL) 1737 return; 1738 /* 1739 * Locking the selinfo locks all selfds associated with it. 1740 */ 1741 mtx_lock(sip->si_mtx); 1742 TAILQ_FOREACH_SAFE(sfp, &sip->si_tdlist, sf_threads, sfn) { 1743 /* 1744 * Once we remove this sfp from the list and clear the 1745 * sf_si seltdclear will know to ignore this si. 1746 */ 1747 TAILQ_REMOVE(&sip->si_tdlist, sfp, sf_threads); 1748 sfp->sf_si = NULL; 1749 stp = sfp->sf_td; 1750 mtx_lock(&stp->st_mtx); 1751 stp->st_flags |= SELTD_PENDING; 1752 cv_broadcastpri(&stp->st_wait, pri); 1753 mtx_unlock(&stp->st_mtx); 1754 if (refcount_release(&sfp->sf_refs)) 1755 uma_zfree(selfd_zone, sfp); 1756 } 1757 mtx_unlock(sip->si_mtx); 1758 } 1759 1760 static void 1761 seltdinit(struct thread *td) 1762 { 1763 struct seltd *stp; 1764 1765 if ((stp = td->td_sel) != NULL) 1766 goto out; 1767 td->td_sel = stp = malloc(sizeof(*stp), M_SELECT, M_WAITOK|M_ZERO); 1768 mtx_init(&stp->st_mtx, "sellck", NULL, MTX_DEF); 1769 cv_init(&stp->st_wait, "select"); 1770 out: 1771 stp->st_flags = 0; 1772 STAILQ_INIT(&stp->st_selq); 1773 } 1774 1775 static int 1776 seltdwait(struct thread *td, sbintime_t sbt, sbintime_t precision) 1777 { 1778 struct seltd *stp; 1779 int error; 1780 1781 stp = td->td_sel; 1782 /* 1783 * An event of interest may occur while we do not hold the seltd 1784 * locked so check the pending flag before we sleep. 1785 */ 1786 mtx_lock(&stp->st_mtx); 1787 /* 1788 * Any further calls to selrecord will be a rescan. 1789 */ 1790 stp->st_flags |= SELTD_RESCAN; 1791 if (stp->st_flags & SELTD_PENDING) { 1792 mtx_unlock(&stp->st_mtx); 1793 return (0); 1794 } 1795 if (sbt == 0) 1796 error = EWOULDBLOCK; 1797 else if (sbt != -1) 1798 error = cv_timedwait_sig_sbt(&stp->st_wait, &stp->st_mtx, 1799 sbt, precision, C_ABSOLUTE); 1800 else 1801 error = cv_wait_sig(&stp->st_wait, &stp->st_mtx); 1802 mtx_unlock(&stp->st_mtx); 1803 1804 return (error); 1805 } 1806 1807 void 1808 seltdfini(struct thread *td) 1809 { 1810 struct seltd *stp; 1811 1812 stp = td->td_sel; 1813 if (stp == NULL) 1814 return; 1815 if (stp->st_free1) 1816 uma_zfree(selfd_zone, stp->st_free1); 1817 if (stp->st_free2) 1818 uma_zfree(selfd_zone, stp->st_free2); 1819 td->td_sel = NULL; 1820 cv_destroy(&stp->st_wait); 1821 mtx_destroy(&stp->st_mtx); 1822 free(stp, M_SELECT); 1823 } 1824 1825 /* 1826 * Remove the references to the thread from all of the objects we were 1827 * polling. 1828 */ 1829 static void 1830 seltdclear(struct thread *td) 1831 { 1832 struct seltd *stp; 1833 struct selfd *sfp; 1834 struct selfd *sfn; 1835 1836 stp = td->td_sel; 1837 STAILQ_FOREACH_SAFE(sfp, &stp->st_selq, sf_link, sfn) 1838 selfdfree(stp, sfp); 1839 stp->st_flags = 0; 1840 } 1841 1842 static void selectinit(void *); 1843 SYSINIT(select, SI_SUB_SYSCALLS, SI_ORDER_ANY, selectinit, NULL); 1844 static void 1845 selectinit(void *dummy __unused) 1846 { 1847 1848 selfd_zone = uma_zcreate("selfd", sizeof(struct selfd), NULL, NULL, 1849 NULL, NULL, UMA_ALIGN_PTR, 0); 1850 mtxpool_select = mtx_pool_create("select mtxpool", 128, MTX_DEF); 1851 } 1852 1853 /* 1854 * Set up a syscall return value that follows the convention specified for 1855 * posix_* functions. 1856 */ 1857 int 1858 kern_posix_error(struct thread *td, int error) 1859 { 1860 1861 if (error <= 0) 1862 return (error); 1863 td->td_errno = error; 1864 td->td_pflags |= TDP_NERRNO; 1865 td->td_retval[0] = error; 1866 return (0); 1867 } 1868