1 /*- 2 * SPDX-License-Identifier: BSD-3-Clause 3 * 4 * Copyright (c) 1982, 1986, 1989, 1993 5 * The Regents of the University of California. All rights reserved. 6 * (c) UNIX System Laboratories, Inc. 7 * All or some portions of this file are derived from material licensed 8 * to the University of California by American Telephone and Telegraph 9 * Co. or Unix System Laboratories, Inc. and are reproduced herein with 10 * the permission of UNIX System Laboratories, Inc. 11 * 12 * Redistribution and use in source and binary forms, with or without 13 * modification, are permitted provided that the following conditions 14 * are met: 15 * 1. Redistributions of source code must retain the above copyright 16 * notice, this list of conditions and the following disclaimer. 17 * 2. Redistributions in binary form must reproduce the above copyright 18 * notice, this list of conditions and the following disclaimer in the 19 * documentation and/or other materials provided with the distribution. 20 * 3. Neither the name of the University nor the names of its contributors 21 * may be used to endorse or promote products derived from this software 22 * without specific prior written permission. 23 * 24 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 25 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 26 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 27 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 28 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 29 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 30 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 31 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 32 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 33 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 34 * SUCH DAMAGE. 35 * 36 * @(#)sys_generic.c 8.5 (Berkeley) 1/21/94 37 */ 38 39 #include <sys/cdefs.h> 40 __FBSDID("$FreeBSD$"); 41 42 #include "opt_capsicum.h" 43 #include "opt_compat.h" 44 #include "opt_ktrace.h" 45 46 #include <sys/param.h> 47 #include <sys/systm.h> 48 #include <sys/sysproto.h> 49 #include <sys/capsicum.h> 50 #include <sys/filedesc.h> 51 #include <sys/filio.h> 52 #include <sys/fcntl.h> 53 #include <sys/file.h> 54 #include <sys/lock.h> 55 #include <sys/proc.h> 56 #include <sys/signalvar.h> 57 #include <sys/socketvar.h> 58 #include <sys/uio.h> 59 #include <sys/kernel.h> 60 #include <sys/ktr.h> 61 #include <sys/limits.h> 62 #include <sys/malloc.h> 63 #include <sys/poll.h> 64 #include <sys/resourcevar.h> 65 #include <sys/selinfo.h> 66 #include <sys/sleepqueue.h> 67 #include <sys/syscallsubr.h> 68 #include <sys/sysctl.h> 69 #include <sys/sysent.h> 70 #include <sys/vnode.h> 71 #include <sys/bio.h> 72 #include <sys/buf.h> 73 #include <sys/condvar.h> 74 #ifdef KTRACE 75 #include <sys/ktrace.h> 76 #endif 77 78 #include <security/audit/audit.h> 79 80 /* 81 * The following macro defines how many bytes will be allocated from 82 * the stack instead of memory allocated when passing the IOCTL data 83 * structures from userspace and to the kernel. Some IOCTLs having 84 * small data structures are used very frequently and this small 85 * buffer on the stack gives a significant speedup improvement for 86 * those requests. The value of this define should be greater or equal 87 * to 64 bytes and should also be power of two. The data structure is 88 * currently hard-aligned to a 8-byte boundary on the stack. This 89 * should currently be sufficient for all supported platforms. 90 */ 91 #define SYS_IOCTL_SMALL_SIZE 128 /* bytes */ 92 #define SYS_IOCTL_SMALL_ALIGN 8 /* bytes */ 93 94 #ifdef __LP64__ 95 static int iosize_max_clamp = 0; 96 SYSCTL_INT(_debug, OID_AUTO, iosize_max_clamp, CTLFLAG_RW, 97 &iosize_max_clamp, 0, "Clamp max i/o size to INT_MAX"); 98 static int devfs_iosize_max_clamp = 1; 99 SYSCTL_INT(_debug, OID_AUTO, devfs_iosize_max_clamp, CTLFLAG_RW, 100 &devfs_iosize_max_clamp, 0, "Clamp max i/o size to INT_MAX for devices"); 101 #endif 102 103 /* 104 * Assert that the return value of read(2) and write(2) syscalls fits 105 * into a register. If not, an architecture will need to provide the 106 * usermode wrappers to reconstruct the result. 107 */ 108 CTASSERT(sizeof(register_t) >= sizeof(size_t)); 109 110 static MALLOC_DEFINE(M_IOCTLOPS, "ioctlops", "ioctl data buffer"); 111 static MALLOC_DEFINE(M_SELECT, "select", "select() buffer"); 112 MALLOC_DEFINE(M_IOV, "iov", "large iov's"); 113 114 static int pollout(struct thread *, struct pollfd *, struct pollfd *, 115 u_int); 116 static int pollscan(struct thread *, struct pollfd *, u_int); 117 static int pollrescan(struct thread *); 118 static int selscan(struct thread *, fd_mask **, fd_mask **, int); 119 static int selrescan(struct thread *, fd_mask **, fd_mask **); 120 static void selfdalloc(struct thread *, void *); 121 static void selfdfree(struct seltd *, struct selfd *); 122 static int dofileread(struct thread *, int, struct file *, struct uio *, 123 off_t, int); 124 static int dofilewrite(struct thread *, int, struct file *, struct uio *, 125 off_t, int); 126 static void doselwakeup(struct selinfo *, int); 127 static void seltdinit(struct thread *); 128 static int seltdwait(struct thread *, sbintime_t, sbintime_t); 129 static void seltdclear(struct thread *); 130 131 /* 132 * One seltd per-thread allocated on demand as needed. 133 * 134 * t - protected by st_mtx 135 * k - Only accessed by curthread or read-only 136 */ 137 struct seltd { 138 STAILQ_HEAD(, selfd) st_selq; /* (k) List of selfds. */ 139 struct selfd *st_free1; /* (k) free fd for read set. */ 140 struct selfd *st_free2; /* (k) free fd for write set. */ 141 struct mtx st_mtx; /* Protects struct seltd */ 142 struct cv st_wait; /* (t) Wait channel. */ 143 int st_flags; /* (t) SELTD_ flags. */ 144 }; 145 146 #define SELTD_PENDING 0x0001 /* We have pending events. */ 147 #define SELTD_RESCAN 0x0002 /* Doing a rescan. */ 148 149 /* 150 * One selfd allocated per-thread per-file-descriptor. 151 * f - protected by sf_mtx 152 */ 153 struct selfd { 154 STAILQ_ENTRY(selfd) sf_link; /* (k) fds owned by this td. */ 155 TAILQ_ENTRY(selfd) sf_threads; /* (f) fds on this selinfo. */ 156 struct selinfo *sf_si; /* (f) selinfo when linked. */ 157 struct mtx *sf_mtx; /* Pointer to selinfo mtx. */ 158 struct seltd *sf_td; /* (k) owning seltd. */ 159 void *sf_cookie; /* (k) fd or pollfd. */ 160 u_int sf_refs; 161 }; 162 163 static uma_zone_t selfd_zone; 164 static struct mtx_pool *mtxpool_select; 165 166 #ifdef __LP64__ 167 size_t 168 devfs_iosize_max(void) 169 { 170 171 return (devfs_iosize_max_clamp || SV_CURPROC_FLAG(SV_ILP32) ? 172 INT_MAX : SSIZE_MAX); 173 } 174 175 size_t 176 iosize_max(void) 177 { 178 179 return (iosize_max_clamp || SV_CURPROC_FLAG(SV_ILP32) ? 180 INT_MAX : SSIZE_MAX); 181 } 182 #endif 183 184 #ifndef _SYS_SYSPROTO_H_ 185 struct read_args { 186 int fd; 187 void *buf; 188 size_t nbyte; 189 }; 190 #endif 191 int 192 sys_read(td, uap) 193 struct thread *td; 194 struct read_args *uap; 195 { 196 struct uio auio; 197 struct iovec aiov; 198 int error; 199 200 if (uap->nbyte > IOSIZE_MAX) 201 return (EINVAL); 202 aiov.iov_base = uap->buf; 203 aiov.iov_len = uap->nbyte; 204 auio.uio_iov = &aiov; 205 auio.uio_iovcnt = 1; 206 auio.uio_resid = uap->nbyte; 207 auio.uio_segflg = UIO_USERSPACE; 208 error = kern_readv(td, uap->fd, &auio); 209 return(error); 210 } 211 212 /* 213 * Positioned read system call 214 */ 215 #ifndef _SYS_SYSPROTO_H_ 216 struct pread_args { 217 int fd; 218 void *buf; 219 size_t nbyte; 220 int pad; 221 off_t offset; 222 }; 223 #endif 224 int 225 sys_pread(struct thread *td, struct pread_args *uap) 226 { 227 228 return (kern_pread(td, uap->fd, uap->buf, uap->nbyte, uap->offset)); 229 } 230 231 int 232 kern_pread(struct thread *td, int fd, void *buf, size_t nbyte, off_t offset) 233 { 234 struct uio auio; 235 struct iovec aiov; 236 int error; 237 238 if (nbyte > IOSIZE_MAX) 239 return (EINVAL); 240 aiov.iov_base = buf; 241 aiov.iov_len = nbyte; 242 auio.uio_iov = &aiov; 243 auio.uio_iovcnt = 1; 244 auio.uio_resid = nbyte; 245 auio.uio_segflg = UIO_USERSPACE; 246 error = kern_preadv(td, fd, &auio, offset); 247 return (error); 248 } 249 250 #if defined(COMPAT_FREEBSD6) 251 int 252 freebsd6_pread(struct thread *td, struct freebsd6_pread_args *uap) 253 { 254 255 return (kern_pread(td, uap->fd, uap->buf, uap->nbyte, uap->offset)); 256 } 257 #endif 258 259 /* 260 * Scatter read system call. 261 */ 262 #ifndef _SYS_SYSPROTO_H_ 263 struct readv_args { 264 int fd; 265 struct iovec *iovp; 266 u_int iovcnt; 267 }; 268 #endif 269 int 270 sys_readv(struct thread *td, struct readv_args *uap) 271 { 272 struct uio *auio; 273 int error; 274 275 error = copyinuio(uap->iovp, uap->iovcnt, &auio); 276 if (error) 277 return (error); 278 error = kern_readv(td, uap->fd, auio); 279 free(auio, M_IOV); 280 return (error); 281 } 282 283 int 284 kern_readv(struct thread *td, int fd, struct uio *auio) 285 { 286 struct file *fp; 287 cap_rights_t rights; 288 int error; 289 290 error = fget_read(td, fd, cap_rights_init(&rights, CAP_READ), &fp); 291 if (error) 292 return (error); 293 error = dofileread(td, fd, fp, auio, (off_t)-1, 0); 294 fdrop(fp, td); 295 return (error); 296 } 297 298 /* 299 * Scatter positioned read system call. 300 */ 301 #ifndef _SYS_SYSPROTO_H_ 302 struct preadv_args { 303 int fd; 304 struct iovec *iovp; 305 u_int iovcnt; 306 off_t offset; 307 }; 308 #endif 309 int 310 sys_preadv(struct thread *td, struct preadv_args *uap) 311 { 312 struct uio *auio; 313 int error; 314 315 error = copyinuio(uap->iovp, uap->iovcnt, &auio); 316 if (error) 317 return (error); 318 error = kern_preadv(td, uap->fd, auio, uap->offset); 319 free(auio, M_IOV); 320 return (error); 321 } 322 323 int 324 kern_preadv(td, fd, auio, offset) 325 struct thread *td; 326 int fd; 327 struct uio *auio; 328 off_t offset; 329 { 330 struct file *fp; 331 cap_rights_t rights; 332 int error; 333 334 error = fget_read(td, fd, cap_rights_init(&rights, CAP_PREAD), &fp); 335 if (error) 336 return (error); 337 if (!(fp->f_ops->fo_flags & DFLAG_SEEKABLE)) 338 error = ESPIPE; 339 else if (offset < 0 && 340 (fp->f_vnode == NULL || fp->f_vnode->v_type != VCHR)) 341 error = EINVAL; 342 else 343 error = dofileread(td, fd, fp, auio, offset, FOF_OFFSET); 344 fdrop(fp, td); 345 return (error); 346 } 347 348 /* 349 * Common code for readv and preadv that reads data in 350 * from a file using the passed in uio, offset, and flags. 351 */ 352 static int 353 dofileread(td, fd, fp, auio, offset, flags) 354 struct thread *td; 355 int fd; 356 struct file *fp; 357 struct uio *auio; 358 off_t offset; 359 int flags; 360 { 361 ssize_t cnt; 362 int error; 363 #ifdef KTRACE 364 struct uio *ktruio = NULL; 365 #endif 366 367 AUDIT_ARG_FD(fd); 368 369 /* Finish zero length reads right here */ 370 if (auio->uio_resid == 0) { 371 td->td_retval[0] = 0; 372 return(0); 373 } 374 auio->uio_rw = UIO_READ; 375 auio->uio_offset = offset; 376 auio->uio_td = td; 377 #ifdef KTRACE 378 if (KTRPOINT(td, KTR_GENIO)) 379 ktruio = cloneuio(auio); 380 #endif 381 cnt = auio->uio_resid; 382 if ((error = fo_read(fp, auio, td->td_ucred, flags, td))) { 383 if (auio->uio_resid != cnt && (error == ERESTART || 384 error == EINTR || error == EWOULDBLOCK)) 385 error = 0; 386 } 387 cnt -= auio->uio_resid; 388 #ifdef KTRACE 389 if (ktruio != NULL) { 390 ktruio->uio_resid = cnt; 391 ktrgenio(fd, UIO_READ, ktruio, error); 392 } 393 #endif 394 td->td_retval[0] = cnt; 395 return (error); 396 } 397 398 #ifndef _SYS_SYSPROTO_H_ 399 struct write_args { 400 int fd; 401 const void *buf; 402 size_t nbyte; 403 }; 404 #endif 405 int 406 sys_write(td, uap) 407 struct thread *td; 408 struct write_args *uap; 409 { 410 struct uio auio; 411 struct iovec aiov; 412 int error; 413 414 if (uap->nbyte > IOSIZE_MAX) 415 return (EINVAL); 416 aiov.iov_base = (void *)(uintptr_t)uap->buf; 417 aiov.iov_len = uap->nbyte; 418 auio.uio_iov = &aiov; 419 auio.uio_iovcnt = 1; 420 auio.uio_resid = uap->nbyte; 421 auio.uio_segflg = UIO_USERSPACE; 422 error = kern_writev(td, uap->fd, &auio); 423 return(error); 424 } 425 426 /* 427 * Positioned write system call. 428 */ 429 #ifndef _SYS_SYSPROTO_H_ 430 struct pwrite_args { 431 int fd; 432 const void *buf; 433 size_t nbyte; 434 int pad; 435 off_t offset; 436 }; 437 #endif 438 int 439 sys_pwrite(struct thread *td, struct pwrite_args *uap) 440 { 441 442 return (kern_pwrite(td, uap->fd, uap->buf, uap->nbyte, uap->offset)); 443 } 444 445 int 446 kern_pwrite(struct thread *td, int fd, const void *buf, size_t nbyte, 447 off_t offset) 448 { 449 struct uio auio; 450 struct iovec aiov; 451 int error; 452 453 if (nbyte > IOSIZE_MAX) 454 return (EINVAL); 455 aiov.iov_base = (void *)(uintptr_t)buf; 456 aiov.iov_len = nbyte; 457 auio.uio_iov = &aiov; 458 auio.uio_iovcnt = 1; 459 auio.uio_resid = nbyte; 460 auio.uio_segflg = UIO_USERSPACE; 461 error = kern_pwritev(td, fd, &auio, offset); 462 return(error); 463 } 464 465 #if defined(COMPAT_FREEBSD6) 466 int 467 freebsd6_pwrite(struct thread *td, struct freebsd6_pwrite_args *uap) 468 { 469 470 return (kern_pwrite(td, uap->fd, uap->buf, uap->nbyte, uap->offset)); 471 } 472 #endif 473 474 /* 475 * Gather write system call. 476 */ 477 #ifndef _SYS_SYSPROTO_H_ 478 struct writev_args { 479 int fd; 480 struct iovec *iovp; 481 u_int iovcnt; 482 }; 483 #endif 484 int 485 sys_writev(struct thread *td, struct writev_args *uap) 486 { 487 struct uio *auio; 488 int error; 489 490 error = copyinuio(uap->iovp, uap->iovcnt, &auio); 491 if (error) 492 return (error); 493 error = kern_writev(td, uap->fd, auio); 494 free(auio, M_IOV); 495 return (error); 496 } 497 498 int 499 kern_writev(struct thread *td, int fd, struct uio *auio) 500 { 501 struct file *fp; 502 cap_rights_t rights; 503 int error; 504 505 error = fget_write(td, fd, cap_rights_init(&rights, CAP_WRITE), &fp); 506 if (error) 507 return (error); 508 error = dofilewrite(td, fd, fp, auio, (off_t)-1, 0); 509 fdrop(fp, td); 510 return (error); 511 } 512 513 /* 514 * Gather positioned write system call. 515 */ 516 #ifndef _SYS_SYSPROTO_H_ 517 struct pwritev_args { 518 int fd; 519 struct iovec *iovp; 520 u_int iovcnt; 521 off_t offset; 522 }; 523 #endif 524 int 525 sys_pwritev(struct thread *td, struct pwritev_args *uap) 526 { 527 struct uio *auio; 528 int error; 529 530 error = copyinuio(uap->iovp, uap->iovcnt, &auio); 531 if (error) 532 return (error); 533 error = kern_pwritev(td, uap->fd, auio, uap->offset); 534 free(auio, M_IOV); 535 return (error); 536 } 537 538 int 539 kern_pwritev(td, fd, auio, offset) 540 struct thread *td; 541 struct uio *auio; 542 int fd; 543 off_t offset; 544 { 545 struct file *fp; 546 cap_rights_t rights; 547 int error; 548 549 error = fget_write(td, fd, cap_rights_init(&rights, CAP_PWRITE), &fp); 550 if (error) 551 return (error); 552 if (!(fp->f_ops->fo_flags & DFLAG_SEEKABLE)) 553 error = ESPIPE; 554 else if (offset < 0 && 555 (fp->f_vnode == NULL || fp->f_vnode->v_type != VCHR)) 556 error = EINVAL; 557 else 558 error = dofilewrite(td, fd, fp, auio, offset, FOF_OFFSET); 559 fdrop(fp, td); 560 return (error); 561 } 562 563 /* 564 * Common code for writev and pwritev that writes data to 565 * a file using the passed in uio, offset, and flags. 566 */ 567 static int 568 dofilewrite(td, fd, fp, auio, offset, flags) 569 struct thread *td; 570 int fd; 571 struct file *fp; 572 struct uio *auio; 573 off_t offset; 574 int flags; 575 { 576 ssize_t cnt; 577 int error; 578 #ifdef KTRACE 579 struct uio *ktruio = NULL; 580 #endif 581 582 AUDIT_ARG_FD(fd); 583 auio->uio_rw = UIO_WRITE; 584 auio->uio_td = td; 585 auio->uio_offset = offset; 586 #ifdef KTRACE 587 if (KTRPOINT(td, KTR_GENIO)) 588 ktruio = cloneuio(auio); 589 #endif 590 cnt = auio->uio_resid; 591 if (fp->f_type == DTYPE_VNODE && 592 (fp->f_vnread_flags & FDEVFS_VNODE) == 0) 593 bwillwrite(); 594 if ((error = fo_write(fp, auio, td->td_ucred, flags, td))) { 595 if (auio->uio_resid != cnt && (error == ERESTART || 596 error == EINTR || error == EWOULDBLOCK)) 597 error = 0; 598 /* Socket layer is responsible for issuing SIGPIPE. */ 599 if (fp->f_type != DTYPE_SOCKET && error == EPIPE) { 600 PROC_LOCK(td->td_proc); 601 tdsignal(td, SIGPIPE); 602 PROC_UNLOCK(td->td_proc); 603 } 604 } 605 cnt -= auio->uio_resid; 606 #ifdef KTRACE 607 if (ktruio != NULL) { 608 ktruio->uio_resid = cnt; 609 ktrgenio(fd, UIO_WRITE, ktruio, error); 610 } 611 #endif 612 td->td_retval[0] = cnt; 613 return (error); 614 } 615 616 /* 617 * Truncate a file given a file descriptor. 618 * 619 * Can't use fget_write() here, since must return EINVAL and not EBADF if the 620 * descriptor isn't writable. 621 */ 622 int 623 kern_ftruncate(td, fd, length) 624 struct thread *td; 625 int fd; 626 off_t length; 627 { 628 struct file *fp; 629 cap_rights_t rights; 630 int error; 631 632 AUDIT_ARG_FD(fd); 633 if (length < 0) 634 return (EINVAL); 635 error = fget(td, fd, cap_rights_init(&rights, CAP_FTRUNCATE), &fp); 636 if (error) 637 return (error); 638 AUDIT_ARG_FILE(td->td_proc, fp); 639 if (!(fp->f_flag & FWRITE)) { 640 fdrop(fp, td); 641 return (EINVAL); 642 } 643 error = fo_truncate(fp, length, td->td_ucred, td); 644 fdrop(fp, td); 645 return (error); 646 } 647 648 #ifndef _SYS_SYSPROTO_H_ 649 struct ftruncate_args { 650 int fd; 651 int pad; 652 off_t length; 653 }; 654 #endif 655 int 656 sys_ftruncate(td, uap) 657 struct thread *td; 658 struct ftruncate_args *uap; 659 { 660 661 return (kern_ftruncate(td, uap->fd, uap->length)); 662 } 663 664 #if defined(COMPAT_43) 665 #ifndef _SYS_SYSPROTO_H_ 666 struct oftruncate_args { 667 int fd; 668 long length; 669 }; 670 #endif 671 int 672 oftruncate(td, uap) 673 struct thread *td; 674 struct oftruncate_args *uap; 675 { 676 677 return (kern_ftruncate(td, uap->fd, uap->length)); 678 } 679 #endif /* COMPAT_43 */ 680 681 #ifndef _SYS_SYSPROTO_H_ 682 struct ioctl_args { 683 int fd; 684 u_long com; 685 caddr_t data; 686 }; 687 #endif 688 /* ARGSUSED */ 689 int 690 sys_ioctl(struct thread *td, struct ioctl_args *uap) 691 { 692 u_char smalldata[SYS_IOCTL_SMALL_SIZE] __aligned(SYS_IOCTL_SMALL_ALIGN); 693 u_long com; 694 int arg, error; 695 u_int size; 696 caddr_t data; 697 698 if (uap->com > 0xffffffff) { 699 printf( 700 "WARNING pid %d (%s): ioctl sign-extension ioctl %lx\n", 701 td->td_proc->p_pid, td->td_name, uap->com); 702 uap->com &= 0xffffffff; 703 } 704 com = uap->com; 705 706 /* 707 * Interpret high order word to find amount of data to be 708 * copied to/from the user's address space. 709 */ 710 size = IOCPARM_LEN(com); 711 if ((size > IOCPARM_MAX) || 712 ((com & (IOC_VOID | IOC_IN | IOC_OUT)) == 0) || 713 #if defined(COMPAT_FREEBSD5) || defined(COMPAT_FREEBSD4) || defined(COMPAT_43) 714 ((com & IOC_OUT) && size == 0) || 715 #else 716 ((com & (IOC_IN | IOC_OUT)) && size == 0) || 717 #endif 718 ((com & IOC_VOID) && size > 0 && size != sizeof(int))) 719 return (ENOTTY); 720 721 if (size > 0) { 722 if (com & IOC_VOID) { 723 /* Integer argument. */ 724 arg = (intptr_t)uap->data; 725 data = (void *)&arg; 726 size = 0; 727 } else { 728 if (size > SYS_IOCTL_SMALL_SIZE) 729 data = malloc((u_long)size, M_IOCTLOPS, M_WAITOK); 730 else 731 data = smalldata; 732 } 733 } else 734 data = (void *)&uap->data; 735 if (com & IOC_IN) { 736 error = copyin(uap->data, data, (u_int)size); 737 if (error != 0) 738 goto out; 739 } else if (com & IOC_OUT) { 740 /* 741 * Zero the buffer so the user always 742 * gets back something deterministic. 743 */ 744 bzero(data, size); 745 } 746 747 error = kern_ioctl(td, uap->fd, com, data); 748 749 if (error == 0 && (com & IOC_OUT)) 750 error = copyout(data, uap->data, (u_int)size); 751 752 out: 753 if (size > SYS_IOCTL_SMALL_SIZE) 754 free(data, M_IOCTLOPS); 755 return (error); 756 } 757 758 int 759 kern_ioctl(struct thread *td, int fd, u_long com, caddr_t data) 760 { 761 struct file *fp; 762 struct filedesc *fdp; 763 #ifndef CAPABILITIES 764 cap_rights_t rights; 765 #endif 766 int error, tmp, locked; 767 768 AUDIT_ARG_FD(fd); 769 AUDIT_ARG_CMD(com); 770 771 fdp = td->td_proc->p_fd; 772 773 switch (com) { 774 case FIONCLEX: 775 case FIOCLEX: 776 FILEDESC_XLOCK(fdp); 777 locked = LA_XLOCKED; 778 break; 779 default: 780 #ifdef CAPABILITIES 781 FILEDESC_SLOCK(fdp); 782 locked = LA_SLOCKED; 783 #else 784 locked = LA_UNLOCKED; 785 #endif 786 break; 787 } 788 789 #ifdef CAPABILITIES 790 if ((fp = fget_locked(fdp, fd)) == NULL) { 791 error = EBADF; 792 goto out; 793 } 794 if ((error = cap_ioctl_check(fdp, fd, com)) != 0) { 795 fp = NULL; /* fhold() was not called yet */ 796 goto out; 797 } 798 fhold(fp); 799 if (locked == LA_SLOCKED) { 800 FILEDESC_SUNLOCK(fdp); 801 locked = LA_UNLOCKED; 802 } 803 #else 804 error = fget(td, fd, cap_rights_init(&rights, CAP_IOCTL), &fp); 805 if (error != 0) { 806 fp = NULL; 807 goto out; 808 } 809 #endif 810 if ((fp->f_flag & (FREAD | FWRITE)) == 0) { 811 error = EBADF; 812 goto out; 813 } 814 815 switch (com) { 816 case FIONCLEX: 817 fdp->fd_ofiles[fd].fde_flags &= ~UF_EXCLOSE; 818 goto out; 819 case FIOCLEX: 820 fdp->fd_ofiles[fd].fde_flags |= UF_EXCLOSE; 821 goto out; 822 case FIONBIO: 823 if ((tmp = *(int *)data)) 824 atomic_set_int(&fp->f_flag, FNONBLOCK); 825 else 826 atomic_clear_int(&fp->f_flag, FNONBLOCK); 827 data = (void *)&tmp; 828 break; 829 case FIOASYNC: 830 if ((tmp = *(int *)data)) 831 atomic_set_int(&fp->f_flag, FASYNC); 832 else 833 atomic_clear_int(&fp->f_flag, FASYNC); 834 data = (void *)&tmp; 835 break; 836 } 837 838 error = fo_ioctl(fp, com, data, td->td_ucred, td); 839 out: 840 switch (locked) { 841 case LA_XLOCKED: 842 FILEDESC_XUNLOCK(fdp); 843 break; 844 #ifdef CAPABILITIES 845 case LA_SLOCKED: 846 FILEDESC_SUNLOCK(fdp); 847 break; 848 #endif 849 default: 850 FILEDESC_UNLOCK_ASSERT(fdp); 851 break; 852 } 853 if (fp != NULL) 854 fdrop(fp, td); 855 return (error); 856 } 857 858 int 859 poll_no_poll(int events) 860 { 861 /* 862 * Return true for read/write. If the user asked for something 863 * special, return POLLNVAL, so that clients have a way of 864 * determining reliably whether or not the extended 865 * functionality is present without hard-coding knowledge 866 * of specific filesystem implementations. 867 */ 868 if (events & ~POLLSTANDARD) 869 return (POLLNVAL); 870 871 return (events & (POLLIN | POLLOUT | POLLRDNORM | POLLWRNORM)); 872 } 873 874 int 875 sys_pselect(struct thread *td, struct pselect_args *uap) 876 { 877 struct timespec ts; 878 struct timeval tv, *tvp; 879 sigset_t set, *uset; 880 int error; 881 882 if (uap->ts != NULL) { 883 error = copyin(uap->ts, &ts, sizeof(ts)); 884 if (error != 0) 885 return (error); 886 TIMESPEC_TO_TIMEVAL(&tv, &ts); 887 tvp = &tv; 888 } else 889 tvp = NULL; 890 if (uap->sm != NULL) { 891 error = copyin(uap->sm, &set, sizeof(set)); 892 if (error != 0) 893 return (error); 894 uset = &set; 895 } else 896 uset = NULL; 897 return (kern_pselect(td, uap->nd, uap->in, uap->ou, uap->ex, tvp, 898 uset, NFDBITS)); 899 } 900 901 int 902 kern_pselect(struct thread *td, int nd, fd_set *in, fd_set *ou, fd_set *ex, 903 struct timeval *tvp, sigset_t *uset, int abi_nfdbits) 904 { 905 int error; 906 907 if (uset != NULL) { 908 error = kern_sigprocmask(td, SIG_SETMASK, uset, 909 &td->td_oldsigmask, 0); 910 if (error != 0) 911 return (error); 912 td->td_pflags |= TDP_OLDMASK; 913 /* 914 * Make sure that ast() is called on return to 915 * usermode and TDP_OLDMASK is cleared, restoring old 916 * sigmask. 917 */ 918 thread_lock(td); 919 td->td_flags |= TDF_ASTPENDING; 920 thread_unlock(td); 921 } 922 error = kern_select(td, nd, in, ou, ex, tvp, abi_nfdbits); 923 return (error); 924 } 925 926 #ifndef _SYS_SYSPROTO_H_ 927 struct select_args { 928 int nd; 929 fd_set *in, *ou, *ex; 930 struct timeval *tv; 931 }; 932 #endif 933 int 934 sys_select(struct thread *td, struct select_args *uap) 935 { 936 struct timeval tv, *tvp; 937 int error; 938 939 if (uap->tv != NULL) { 940 error = copyin(uap->tv, &tv, sizeof(tv)); 941 if (error) 942 return (error); 943 tvp = &tv; 944 } else 945 tvp = NULL; 946 947 return (kern_select(td, uap->nd, uap->in, uap->ou, uap->ex, tvp, 948 NFDBITS)); 949 } 950 951 /* 952 * In the unlikely case when user specified n greater then the last 953 * open file descriptor, check that no bits are set after the last 954 * valid fd. We must return EBADF if any is set. 955 * 956 * There are applications that rely on the behaviour. 957 * 958 * nd is fd_lastfile + 1. 959 */ 960 static int 961 select_check_badfd(fd_set *fd_in, int nd, int ndu, int abi_nfdbits) 962 { 963 char *addr, *oaddr; 964 int b, i, res; 965 uint8_t bits; 966 967 if (nd >= ndu || fd_in == NULL) 968 return (0); 969 970 oaddr = NULL; 971 bits = 0; /* silence gcc */ 972 for (i = nd; i < ndu; i++) { 973 b = i / NBBY; 974 #if BYTE_ORDER == LITTLE_ENDIAN 975 addr = (char *)fd_in + b; 976 #else 977 addr = (char *)fd_in; 978 if (abi_nfdbits == NFDBITS) { 979 addr += rounddown(b, sizeof(fd_mask)) + 980 sizeof(fd_mask) - 1 - b % sizeof(fd_mask); 981 } else { 982 addr += rounddown(b, sizeof(uint32_t)) + 983 sizeof(uint32_t) - 1 - b % sizeof(uint32_t); 984 } 985 #endif 986 if (addr != oaddr) { 987 res = fubyte(addr); 988 if (res == -1) 989 return (EFAULT); 990 oaddr = addr; 991 bits = res; 992 } 993 if ((bits & (1 << (i % NBBY))) != 0) 994 return (EBADF); 995 } 996 return (0); 997 } 998 999 int 1000 kern_select(struct thread *td, int nd, fd_set *fd_in, fd_set *fd_ou, 1001 fd_set *fd_ex, struct timeval *tvp, int abi_nfdbits) 1002 { 1003 struct filedesc *fdp; 1004 /* 1005 * The magic 2048 here is chosen to be just enough for FD_SETSIZE 1006 * infds with the new FD_SETSIZE of 1024, and more than enough for 1007 * FD_SETSIZE infds, outfds and exceptfds with the old FD_SETSIZE 1008 * of 256. 1009 */ 1010 fd_mask s_selbits[howmany(2048, NFDBITS)]; 1011 fd_mask *ibits[3], *obits[3], *selbits, *sbp; 1012 struct timeval rtv; 1013 sbintime_t asbt, precision, rsbt; 1014 u_int nbufbytes, ncpbytes, ncpubytes, nfdbits; 1015 int error, lf, ndu; 1016 1017 if (nd < 0) 1018 return (EINVAL); 1019 fdp = td->td_proc->p_fd; 1020 ndu = nd; 1021 lf = fdp->fd_lastfile; 1022 if (nd > lf + 1) 1023 nd = lf + 1; 1024 1025 error = select_check_badfd(fd_in, nd, ndu, abi_nfdbits); 1026 if (error != 0) 1027 return (error); 1028 error = select_check_badfd(fd_ou, nd, ndu, abi_nfdbits); 1029 if (error != 0) 1030 return (error); 1031 error = select_check_badfd(fd_ex, nd, ndu, abi_nfdbits); 1032 if (error != 0) 1033 return (error); 1034 1035 /* 1036 * Allocate just enough bits for the non-null fd_sets. Use the 1037 * preallocated auto buffer if possible. 1038 */ 1039 nfdbits = roundup(nd, NFDBITS); 1040 ncpbytes = nfdbits / NBBY; 1041 ncpubytes = roundup(nd, abi_nfdbits) / NBBY; 1042 nbufbytes = 0; 1043 if (fd_in != NULL) 1044 nbufbytes += 2 * ncpbytes; 1045 if (fd_ou != NULL) 1046 nbufbytes += 2 * ncpbytes; 1047 if (fd_ex != NULL) 1048 nbufbytes += 2 * ncpbytes; 1049 if (nbufbytes <= sizeof s_selbits) 1050 selbits = &s_selbits[0]; 1051 else 1052 selbits = malloc(nbufbytes, M_SELECT, M_WAITOK); 1053 1054 /* 1055 * Assign pointers into the bit buffers and fetch the input bits. 1056 * Put the output buffers together so that they can be bzeroed 1057 * together. 1058 */ 1059 sbp = selbits; 1060 #define getbits(name, x) \ 1061 do { \ 1062 if (name == NULL) { \ 1063 ibits[x] = NULL; \ 1064 obits[x] = NULL; \ 1065 } else { \ 1066 ibits[x] = sbp + nbufbytes / 2 / sizeof *sbp; \ 1067 obits[x] = sbp; \ 1068 sbp += ncpbytes / sizeof *sbp; \ 1069 error = copyin(name, ibits[x], ncpubytes); \ 1070 if (error != 0) \ 1071 goto done; \ 1072 bzero((char *)ibits[x] + ncpubytes, \ 1073 ncpbytes - ncpubytes); \ 1074 } \ 1075 } while (0) 1076 getbits(fd_in, 0); 1077 getbits(fd_ou, 1); 1078 getbits(fd_ex, 2); 1079 #undef getbits 1080 1081 #if BYTE_ORDER == BIG_ENDIAN && defined(__LP64__) 1082 /* 1083 * XXX: swizzle_fdset assumes that if abi_nfdbits != NFDBITS, 1084 * we are running under 32-bit emulation. This should be more 1085 * generic. 1086 */ 1087 #define swizzle_fdset(bits) \ 1088 if (abi_nfdbits != NFDBITS && bits != NULL) { \ 1089 int i; \ 1090 for (i = 0; i < ncpbytes / sizeof *sbp; i++) \ 1091 bits[i] = (bits[i] >> 32) | (bits[i] << 32); \ 1092 } 1093 #else 1094 #define swizzle_fdset(bits) 1095 #endif 1096 1097 /* Make sure the bit order makes it through an ABI transition */ 1098 swizzle_fdset(ibits[0]); 1099 swizzle_fdset(ibits[1]); 1100 swizzle_fdset(ibits[2]); 1101 1102 if (nbufbytes != 0) 1103 bzero(selbits, nbufbytes / 2); 1104 1105 precision = 0; 1106 if (tvp != NULL) { 1107 rtv = *tvp; 1108 if (rtv.tv_sec < 0 || rtv.tv_usec < 0 || 1109 rtv.tv_usec >= 1000000) { 1110 error = EINVAL; 1111 goto done; 1112 } 1113 if (!timevalisset(&rtv)) 1114 asbt = 0; 1115 else if (rtv.tv_sec <= INT32_MAX) { 1116 rsbt = tvtosbt(rtv); 1117 precision = rsbt; 1118 precision >>= tc_precexp; 1119 if (TIMESEL(&asbt, rsbt)) 1120 asbt += tc_tick_sbt; 1121 if (asbt <= SBT_MAX - rsbt) 1122 asbt += rsbt; 1123 else 1124 asbt = -1; 1125 } else 1126 asbt = -1; 1127 } else 1128 asbt = -1; 1129 seltdinit(td); 1130 /* Iterate until the timeout expires or descriptors become ready. */ 1131 for (;;) { 1132 error = selscan(td, ibits, obits, nd); 1133 if (error || td->td_retval[0] != 0) 1134 break; 1135 error = seltdwait(td, asbt, precision); 1136 if (error) 1137 break; 1138 error = selrescan(td, ibits, obits); 1139 if (error || td->td_retval[0] != 0) 1140 break; 1141 } 1142 seltdclear(td); 1143 1144 done: 1145 /* select is not restarted after signals... */ 1146 if (error == ERESTART) 1147 error = EINTR; 1148 if (error == EWOULDBLOCK) 1149 error = 0; 1150 1151 /* swizzle bit order back, if necessary */ 1152 swizzle_fdset(obits[0]); 1153 swizzle_fdset(obits[1]); 1154 swizzle_fdset(obits[2]); 1155 #undef swizzle_fdset 1156 1157 #define putbits(name, x) \ 1158 if (name && (error2 = copyout(obits[x], name, ncpubytes))) \ 1159 error = error2; 1160 if (error == 0) { 1161 int error2; 1162 1163 putbits(fd_in, 0); 1164 putbits(fd_ou, 1); 1165 putbits(fd_ex, 2); 1166 #undef putbits 1167 } 1168 if (selbits != &s_selbits[0]) 1169 free(selbits, M_SELECT); 1170 1171 return (error); 1172 } 1173 /* 1174 * Convert a select bit set to poll flags. 1175 * 1176 * The backend always returns POLLHUP/POLLERR if appropriate and we 1177 * return this as a set bit in any set. 1178 */ 1179 static int select_flags[3] = { 1180 POLLRDNORM | POLLHUP | POLLERR, 1181 POLLWRNORM | POLLHUP | POLLERR, 1182 POLLRDBAND | POLLERR 1183 }; 1184 1185 /* 1186 * Compute the fo_poll flags required for a fd given by the index and 1187 * bit position in the fd_mask array. 1188 */ 1189 static __inline int 1190 selflags(fd_mask **ibits, int idx, fd_mask bit) 1191 { 1192 int flags; 1193 int msk; 1194 1195 flags = 0; 1196 for (msk = 0; msk < 3; msk++) { 1197 if (ibits[msk] == NULL) 1198 continue; 1199 if ((ibits[msk][idx] & bit) == 0) 1200 continue; 1201 flags |= select_flags[msk]; 1202 } 1203 return (flags); 1204 } 1205 1206 /* 1207 * Set the appropriate output bits given a mask of fired events and the 1208 * input bits originally requested. 1209 */ 1210 static __inline int 1211 selsetbits(fd_mask **ibits, fd_mask **obits, int idx, fd_mask bit, int events) 1212 { 1213 int msk; 1214 int n; 1215 1216 n = 0; 1217 for (msk = 0; msk < 3; msk++) { 1218 if ((events & select_flags[msk]) == 0) 1219 continue; 1220 if (ibits[msk] == NULL) 1221 continue; 1222 if ((ibits[msk][idx] & bit) == 0) 1223 continue; 1224 /* 1225 * XXX Check for a duplicate set. This can occur because a 1226 * socket calls selrecord() twice for each poll() call 1227 * resulting in two selfds per real fd. selrescan() will 1228 * call selsetbits twice as a result. 1229 */ 1230 if ((obits[msk][idx] & bit) != 0) 1231 continue; 1232 obits[msk][idx] |= bit; 1233 n++; 1234 } 1235 1236 return (n); 1237 } 1238 1239 static __inline int 1240 getselfd_cap(struct filedesc *fdp, int fd, struct file **fpp) 1241 { 1242 cap_rights_t rights; 1243 1244 cap_rights_init(&rights, CAP_EVENT); 1245 1246 return (fget_unlocked(fdp, fd, &rights, fpp, NULL)); 1247 } 1248 1249 /* 1250 * Traverse the list of fds attached to this thread's seltd and check for 1251 * completion. 1252 */ 1253 static int 1254 selrescan(struct thread *td, fd_mask **ibits, fd_mask **obits) 1255 { 1256 struct filedesc *fdp; 1257 struct selinfo *si; 1258 struct seltd *stp; 1259 struct selfd *sfp; 1260 struct selfd *sfn; 1261 struct file *fp; 1262 fd_mask bit; 1263 int fd, ev, n, idx; 1264 int error; 1265 1266 fdp = td->td_proc->p_fd; 1267 stp = td->td_sel; 1268 n = 0; 1269 STAILQ_FOREACH_SAFE(sfp, &stp->st_selq, sf_link, sfn) { 1270 fd = (int)(uintptr_t)sfp->sf_cookie; 1271 si = sfp->sf_si; 1272 selfdfree(stp, sfp); 1273 /* If the selinfo wasn't cleared the event didn't fire. */ 1274 if (si != NULL) 1275 continue; 1276 error = getselfd_cap(fdp, fd, &fp); 1277 if (error) 1278 return (error); 1279 idx = fd / NFDBITS; 1280 bit = (fd_mask)1 << (fd % NFDBITS); 1281 ev = fo_poll(fp, selflags(ibits, idx, bit), td->td_ucred, td); 1282 fdrop(fp, td); 1283 if (ev != 0) 1284 n += selsetbits(ibits, obits, idx, bit, ev); 1285 } 1286 stp->st_flags = 0; 1287 td->td_retval[0] = n; 1288 return (0); 1289 } 1290 1291 /* 1292 * Perform the initial filedescriptor scan and register ourselves with 1293 * each selinfo. 1294 */ 1295 static int 1296 selscan(td, ibits, obits, nfd) 1297 struct thread *td; 1298 fd_mask **ibits, **obits; 1299 int nfd; 1300 { 1301 struct filedesc *fdp; 1302 struct file *fp; 1303 fd_mask bit; 1304 int ev, flags, end, fd; 1305 int n, idx; 1306 int error; 1307 1308 fdp = td->td_proc->p_fd; 1309 n = 0; 1310 for (idx = 0, fd = 0; fd < nfd; idx++) { 1311 end = imin(fd + NFDBITS, nfd); 1312 for (bit = 1; fd < end; bit <<= 1, fd++) { 1313 /* Compute the list of events we're interested in. */ 1314 flags = selflags(ibits, idx, bit); 1315 if (flags == 0) 1316 continue; 1317 error = getselfd_cap(fdp, fd, &fp); 1318 if (error) 1319 return (error); 1320 selfdalloc(td, (void *)(uintptr_t)fd); 1321 ev = fo_poll(fp, flags, td->td_ucred, td); 1322 fdrop(fp, td); 1323 if (ev != 0) 1324 n += selsetbits(ibits, obits, idx, bit, ev); 1325 } 1326 } 1327 1328 td->td_retval[0] = n; 1329 return (0); 1330 } 1331 1332 int 1333 sys_poll(struct thread *td, struct poll_args *uap) 1334 { 1335 struct timespec ts, *tsp; 1336 1337 if (uap->timeout != INFTIM) { 1338 if (uap->timeout < 0) 1339 return (EINVAL); 1340 ts.tv_sec = uap->timeout / 1000; 1341 ts.tv_nsec = (uap->timeout % 1000) * 1000000; 1342 tsp = &ts; 1343 } else 1344 tsp = NULL; 1345 1346 return (kern_poll(td, uap->fds, uap->nfds, tsp, NULL)); 1347 } 1348 1349 int 1350 kern_poll(struct thread *td, struct pollfd *fds, u_int nfds, 1351 struct timespec *tsp, sigset_t *uset) 1352 { 1353 struct pollfd *bits; 1354 struct pollfd smallbits[32]; 1355 sbintime_t sbt, precision, tmp; 1356 time_t over; 1357 struct timespec ts; 1358 int error; 1359 size_t ni; 1360 1361 precision = 0; 1362 if (tsp != NULL) { 1363 if (tsp->tv_sec < 0) 1364 return (EINVAL); 1365 if (tsp->tv_nsec < 0 || tsp->tv_nsec >= 1000000000) 1366 return (EINVAL); 1367 if (tsp->tv_sec == 0 && tsp->tv_nsec == 0) 1368 sbt = 0; 1369 else { 1370 ts = *tsp; 1371 if (ts.tv_sec > INT32_MAX / 2) { 1372 over = ts.tv_sec - INT32_MAX / 2; 1373 ts.tv_sec -= over; 1374 } else 1375 over = 0; 1376 tmp = tstosbt(ts); 1377 precision = tmp; 1378 precision >>= tc_precexp; 1379 if (TIMESEL(&sbt, tmp)) 1380 sbt += tc_tick_sbt; 1381 sbt += tmp; 1382 } 1383 } else 1384 sbt = -1; 1385 1386 if (nfds > maxfilesperproc && nfds > FD_SETSIZE) 1387 return (EINVAL); 1388 ni = nfds * sizeof(struct pollfd); 1389 if (ni > sizeof(smallbits)) 1390 bits = malloc(ni, M_TEMP, M_WAITOK); 1391 else 1392 bits = smallbits; 1393 error = copyin(fds, bits, ni); 1394 if (error) 1395 goto done; 1396 1397 if (uset != NULL) { 1398 error = kern_sigprocmask(td, SIG_SETMASK, uset, 1399 &td->td_oldsigmask, 0); 1400 if (error) 1401 goto done; 1402 td->td_pflags |= TDP_OLDMASK; 1403 /* 1404 * Make sure that ast() is called on return to 1405 * usermode and TDP_OLDMASK is cleared, restoring old 1406 * sigmask. 1407 */ 1408 thread_lock(td); 1409 td->td_flags |= TDF_ASTPENDING; 1410 thread_unlock(td); 1411 } 1412 1413 seltdinit(td); 1414 /* Iterate until the timeout expires or descriptors become ready. */ 1415 for (;;) { 1416 error = pollscan(td, bits, nfds); 1417 if (error || td->td_retval[0] != 0) 1418 break; 1419 error = seltdwait(td, sbt, precision); 1420 if (error) 1421 break; 1422 error = pollrescan(td); 1423 if (error || td->td_retval[0] != 0) 1424 break; 1425 } 1426 seltdclear(td); 1427 1428 done: 1429 /* poll is not restarted after signals... */ 1430 if (error == ERESTART) 1431 error = EINTR; 1432 if (error == EWOULDBLOCK) 1433 error = 0; 1434 if (error == 0) { 1435 error = pollout(td, bits, fds, nfds); 1436 if (error) 1437 goto out; 1438 } 1439 out: 1440 if (ni > sizeof(smallbits)) 1441 free(bits, M_TEMP); 1442 return (error); 1443 } 1444 1445 int 1446 sys_ppoll(struct thread *td, struct ppoll_args *uap) 1447 { 1448 struct timespec ts, *tsp; 1449 sigset_t set, *ssp; 1450 int error; 1451 1452 if (uap->ts != NULL) { 1453 error = copyin(uap->ts, &ts, sizeof(ts)); 1454 if (error) 1455 return (error); 1456 tsp = &ts; 1457 } else 1458 tsp = NULL; 1459 if (uap->set != NULL) { 1460 error = copyin(uap->set, &set, sizeof(set)); 1461 if (error) 1462 return (error); 1463 ssp = &set; 1464 } else 1465 ssp = NULL; 1466 /* 1467 * fds is still a pointer to user space. kern_poll() will 1468 * take care of copyin that array to the kernel space. 1469 */ 1470 1471 return (kern_poll(td, uap->fds, uap->nfds, tsp, ssp)); 1472 } 1473 1474 static int 1475 pollrescan(struct thread *td) 1476 { 1477 struct seltd *stp; 1478 struct selfd *sfp; 1479 struct selfd *sfn; 1480 struct selinfo *si; 1481 struct filedesc *fdp; 1482 struct file *fp; 1483 struct pollfd *fd; 1484 #ifdef CAPABILITIES 1485 cap_rights_t rights; 1486 #endif 1487 int n; 1488 1489 n = 0; 1490 fdp = td->td_proc->p_fd; 1491 stp = td->td_sel; 1492 FILEDESC_SLOCK(fdp); 1493 STAILQ_FOREACH_SAFE(sfp, &stp->st_selq, sf_link, sfn) { 1494 fd = (struct pollfd *)sfp->sf_cookie; 1495 si = sfp->sf_si; 1496 selfdfree(stp, sfp); 1497 /* If the selinfo wasn't cleared the event didn't fire. */ 1498 if (si != NULL) 1499 continue; 1500 fp = fdp->fd_ofiles[fd->fd].fde_file; 1501 #ifdef CAPABILITIES 1502 if (fp == NULL || 1503 cap_check(cap_rights(fdp, fd->fd), 1504 cap_rights_init(&rights, CAP_EVENT)) != 0) 1505 #else 1506 if (fp == NULL) 1507 #endif 1508 { 1509 fd->revents = POLLNVAL; 1510 n++; 1511 continue; 1512 } 1513 1514 /* 1515 * Note: backend also returns POLLHUP and 1516 * POLLERR if appropriate. 1517 */ 1518 fd->revents = fo_poll(fp, fd->events, td->td_ucred, td); 1519 if (fd->revents != 0) 1520 n++; 1521 } 1522 FILEDESC_SUNLOCK(fdp); 1523 stp->st_flags = 0; 1524 td->td_retval[0] = n; 1525 return (0); 1526 } 1527 1528 1529 static int 1530 pollout(td, fds, ufds, nfd) 1531 struct thread *td; 1532 struct pollfd *fds; 1533 struct pollfd *ufds; 1534 u_int nfd; 1535 { 1536 int error = 0; 1537 u_int i = 0; 1538 u_int n = 0; 1539 1540 for (i = 0; i < nfd; i++) { 1541 error = copyout(&fds->revents, &ufds->revents, 1542 sizeof(ufds->revents)); 1543 if (error) 1544 return (error); 1545 if (fds->revents != 0) 1546 n++; 1547 fds++; 1548 ufds++; 1549 } 1550 td->td_retval[0] = n; 1551 return (0); 1552 } 1553 1554 static int 1555 pollscan(td, fds, nfd) 1556 struct thread *td; 1557 struct pollfd *fds; 1558 u_int nfd; 1559 { 1560 struct filedesc *fdp = td->td_proc->p_fd; 1561 struct file *fp; 1562 #ifdef CAPABILITIES 1563 cap_rights_t rights; 1564 #endif 1565 int i, n = 0; 1566 1567 FILEDESC_SLOCK(fdp); 1568 for (i = 0; i < nfd; i++, fds++) { 1569 if (fds->fd > fdp->fd_lastfile) { 1570 fds->revents = POLLNVAL; 1571 n++; 1572 } else if (fds->fd < 0) { 1573 fds->revents = 0; 1574 } else { 1575 fp = fdp->fd_ofiles[fds->fd].fde_file; 1576 #ifdef CAPABILITIES 1577 if (fp == NULL || 1578 cap_check(cap_rights(fdp, fds->fd), 1579 cap_rights_init(&rights, CAP_EVENT)) != 0) 1580 #else 1581 if (fp == NULL) 1582 #endif 1583 { 1584 fds->revents = POLLNVAL; 1585 n++; 1586 } else { 1587 /* 1588 * Note: backend also returns POLLHUP and 1589 * POLLERR if appropriate. 1590 */ 1591 selfdalloc(td, fds); 1592 fds->revents = fo_poll(fp, fds->events, 1593 td->td_ucred, td); 1594 /* 1595 * POSIX requires POLLOUT to be never 1596 * set simultaneously with POLLHUP. 1597 */ 1598 if ((fds->revents & POLLHUP) != 0) 1599 fds->revents &= ~POLLOUT; 1600 1601 if (fds->revents != 0) 1602 n++; 1603 } 1604 } 1605 } 1606 FILEDESC_SUNLOCK(fdp); 1607 td->td_retval[0] = n; 1608 return (0); 1609 } 1610 1611 /* 1612 * XXX This was created specifically to support netncp and netsmb. This 1613 * allows the caller to specify a socket to wait for events on. It returns 1614 * 0 if any events matched and an error otherwise. There is no way to 1615 * determine which events fired. 1616 */ 1617 int 1618 selsocket(struct socket *so, int events, struct timeval *tvp, struct thread *td) 1619 { 1620 struct timeval rtv; 1621 sbintime_t asbt, precision, rsbt; 1622 int error; 1623 1624 precision = 0; /* stupid gcc! */ 1625 if (tvp != NULL) { 1626 rtv = *tvp; 1627 if (rtv.tv_sec < 0 || rtv.tv_usec < 0 || 1628 rtv.tv_usec >= 1000000) 1629 return (EINVAL); 1630 if (!timevalisset(&rtv)) 1631 asbt = 0; 1632 else if (rtv.tv_sec <= INT32_MAX) { 1633 rsbt = tvtosbt(rtv); 1634 precision = rsbt; 1635 precision >>= tc_precexp; 1636 if (TIMESEL(&asbt, rsbt)) 1637 asbt += tc_tick_sbt; 1638 if (asbt <= SBT_MAX - rsbt) 1639 asbt += rsbt; 1640 else 1641 asbt = -1; 1642 } else 1643 asbt = -1; 1644 } else 1645 asbt = -1; 1646 seltdinit(td); 1647 /* 1648 * Iterate until the timeout expires or the socket becomes ready. 1649 */ 1650 for (;;) { 1651 selfdalloc(td, NULL); 1652 error = sopoll(so, events, NULL, td); 1653 /* error here is actually the ready events. */ 1654 if (error) 1655 return (0); 1656 error = seltdwait(td, asbt, precision); 1657 if (error) 1658 break; 1659 } 1660 seltdclear(td); 1661 /* XXX Duplicates ncp/smb behavior. */ 1662 if (error == ERESTART) 1663 error = 0; 1664 return (error); 1665 } 1666 1667 /* 1668 * Preallocate two selfds associated with 'cookie'. Some fo_poll routines 1669 * have two select sets, one for read and another for write. 1670 */ 1671 static void 1672 selfdalloc(struct thread *td, void *cookie) 1673 { 1674 struct seltd *stp; 1675 1676 stp = td->td_sel; 1677 if (stp->st_free1 == NULL) 1678 stp->st_free1 = uma_zalloc(selfd_zone, M_WAITOK|M_ZERO); 1679 stp->st_free1->sf_td = stp; 1680 stp->st_free1->sf_cookie = cookie; 1681 if (stp->st_free2 == NULL) 1682 stp->st_free2 = uma_zalloc(selfd_zone, M_WAITOK|M_ZERO); 1683 stp->st_free2->sf_td = stp; 1684 stp->st_free2->sf_cookie = cookie; 1685 } 1686 1687 static void 1688 selfdfree(struct seltd *stp, struct selfd *sfp) 1689 { 1690 STAILQ_REMOVE(&stp->st_selq, sfp, selfd, sf_link); 1691 if (sfp->sf_si != NULL) { 1692 mtx_lock(sfp->sf_mtx); 1693 if (sfp->sf_si != NULL) { 1694 TAILQ_REMOVE(&sfp->sf_si->si_tdlist, sfp, sf_threads); 1695 refcount_release(&sfp->sf_refs); 1696 } 1697 mtx_unlock(sfp->sf_mtx); 1698 } 1699 if (refcount_release(&sfp->sf_refs)) 1700 uma_zfree(selfd_zone, sfp); 1701 } 1702 1703 /* Drain the waiters tied to all the selfd belonging the specified selinfo. */ 1704 void 1705 seldrain(sip) 1706 struct selinfo *sip; 1707 { 1708 1709 /* 1710 * This feature is already provided by doselwakeup(), thus it is 1711 * enough to go for it. 1712 * Eventually, the context, should take care to avoid races 1713 * between thread calling select()/poll() and file descriptor 1714 * detaching, but, again, the races are just the same as 1715 * selwakeup(). 1716 */ 1717 doselwakeup(sip, -1); 1718 } 1719 1720 /* 1721 * Record a select request. 1722 */ 1723 void 1724 selrecord(selector, sip) 1725 struct thread *selector; 1726 struct selinfo *sip; 1727 { 1728 struct selfd *sfp; 1729 struct seltd *stp; 1730 struct mtx *mtxp; 1731 1732 stp = selector->td_sel; 1733 /* 1734 * Don't record when doing a rescan. 1735 */ 1736 if (stp->st_flags & SELTD_RESCAN) 1737 return; 1738 /* 1739 * Grab one of the preallocated descriptors. 1740 */ 1741 sfp = NULL; 1742 if ((sfp = stp->st_free1) != NULL) 1743 stp->st_free1 = NULL; 1744 else if ((sfp = stp->st_free2) != NULL) 1745 stp->st_free2 = NULL; 1746 else 1747 panic("selrecord: No free selfd on selq"); 1748 mtxp = sip->si_mtx; 1749 if (mtxp == NULL) 1750 mtxp = mtx_pool_find(mtxpool_select, sip); 1751 /* 1752 * Initialize the sfp and queue it in the thread. 1753 */ 1754 sfp->sf_si = sip; 1755 sfp->sf_mtx = mtxp; 1756 refcount_init(&sfp->sf_refs, 2); 1757 STAILQ_INSERT_TAIL(&stp->st_selq, sfp, sf_link); 1758 /* 1759 * Now that we've locked the sip, check for initialization. 1760 */ 1761 mtx_lock(mtxp); 1762 if (sip->si_mtx == NULL) { 1763 sip->si_mtx = mtxp; 1764 TAILQ_INIT(&sip->si_tdlist); 1765 } 1766 /* 1767 * Add this thread to the list of selfds listening on this selinfo. 1768 */ 1769 TAILQ_INSERT_TAIL(&sip->si_tdlist, sfp, sf_threads); 1770 mtx_unlock(sip->si_mtx); 1771 } 1772 1773 /* Wake up a selecting thread. */ 1774 void 1775 selwakeup(sip) 1776 struct selinfo *sip; 1777 { 1778 doselwakeup(sip, -1); 1779 } 1780 1781 /* Wake up a selecting thread, and set its priority. */ 1782 void 1783 selwakeuppri(sip, pri) 1784 struct selinfo *sip; 1785 int pri; 1786 { 1787 doselwakeup(sip, pri); 1788 } 1789 1790 /* 1791 * Do a wakeup when a selectable event occurs. 1792 */ 1793 static void 1794 doselwakeup(sip, pri) 1795 struct selinfo *sip; 1796 int pri; 1797 { 1798 struct selfd *sfp; 1799 struct selfd *sfn; 1800 struct seltd *stp; 1801 1802 /* If it's not initialized there can't be any waiters. */ 1803 if (sip->si_mtx == NULL) 1804 return; 1805 /* 1806 * Locking the selinfo locks all selfds associated with it. 1807 */ 1808 mtx_lock(sip->si_mtx); 1809 TAILQ_FOREACH_SAFE(sfp, &sip->si_tdlist, sf_threads, sfn) { 1810 /* 1811 * Once we remove this sfp from the list and clear the 1812 * sf_si seltdclear will know to ignore this si. 1813 */ 1814 TAILQ_REMOVE(&sip->si_tdlist, sfp, sf_threads); 1815 sfp->sf_si = NULL; 1816 stp = sfp->sf_td; 1817 mtx_lock(&stp->st_mtx); 1818 stp->st_flags |= SELTD_PENDING; 1819 cv_broadcastpri(&stp->st_wait, pri); 1820 mtx_unlock(&stp->st_mtx); 1821 if (refcount_release(&sfp->sf_refs)) 1822 uma_zfree(selfd_zone, sfp); 1823 } 1824 mtx_unlock(sip->si_mtx); 1825 } 1826 1827 static void 1828 seltdinit(struct thread *td) 1829 { 1830 struct seltd *stp; 1831 1832 if ((stp = td->td_sel) != NULL) 1833 goto out; 1834 td->td_sel = stp = malloc(sizeof(*stp), M_SELECT, M_WAITOK|M_ZERO); 1835 mtx_init(&stp->st_mtx, "sellck", NULL, MTX_DEF); 1836 cv_init(&stp->st_wait, "select"); 1837 out: 1838 stp->st_flags = 0; 1839 STAILQ_INIT(&stp->st_selq); 1840 } 1841 1842 static int 1843 seltdwait(struct thread *td, sbintime_t sbt, sbintime_t precision) 1844 { 1845 struct seltd *stp; 1846 int error; 1847 1848 stp = td->td_sel; 1849 /* 1850 * An event of interest may occur while we do not hold the seltd 1851 * locked so check the pending flag before we sleep. 1852 */ 1853 mtx_lock(&stp->st_mtx); 1854 /* 1855 * Any further calls to selrecord will be a rescan. 1856 */ 1857 stp->st_flags |= SELTD_RESCAN; 1858 if (stp->st_flags & SELTD_PENDING) { 1859 mtx_unlock(&stp->st_mtx); 1860 return (0); 1861 } 1862 if (sbt == 0) 1863 error = EWOULDBLOCK; 1864 else if (sbt != -1) 1865 error = cv_timedwait_sig_sbt(&stp->st_wait, &stp->st_mtx, 1866 sbt, precision, C_ABSOLUTE); 1867 else 1868 error = cv_wait_sig(&stp->st_wait, &stp->st_mtx); 1869 mtx_unlock(&stp->st_mtx); 1870 1871 return (error); 1872 } 1873 1874 void 1875 seltdfini(struct thread *td) 1876 { 1877 struct seltd *stp; 1878 1879 stp = td->td_sel; 1880 if (stp == NULL) 1881 return; 1882 if (stp->st_free1) 1883 uma_zfree(selfd_zone, stp->st_free1); 1884 if (stp->st_free2) 1885 uma_zfree(selfd_zone, stp->st_free2); 1886 td->td_sel = NULL; 1887 cv_destroy(&stp->st_wait); 1888 mtx_destroy(&stp->st_mtx); 1889 free(stp, M_SELECT); 1890 } 1891 1892 /* 1893 * Remove the references to the thread from all of the objects we were 1894 * polling. 1895 */ 1896 static void 1897 seltdclear(struct thread *td) 1898 { 1899 struct seltd *stp; 1900 struct selfd *sfp; 1901 struct selfd *sfn; 1902 1903 stp = td->td_sel; 1904 STAILQ_FOREACH_SAFE(sfp, &stp->st_selq, sf_link, sfn) 1905 selfdfree(stp, sfp); 1906 stp->st_flags = 0; 1907 } 1908 1909 static void selectinit(void *); 1910 SYSINIT(select, SI_SUB_SYSCALLS, SI_ORDER_ANY, selectinit, NULL); 1911 static void 1912 selectinit(void *dummy __unused) 1913 { 1914 1915 selfd_zone = uma_zcreate("selfd", sizeof(struct selfd), NULL, NULL, 1916 NULL, NULL, UMA_ALIGN_PTR, 0); 1917 mtxpool_select = mtx_pool_create("select mtxpool", 128, MTX_DEF); 1918 } 1919 1920 /* 1921 * Set up a syscall return value that follows the convention specified for 1922 * posix_* functions. 1923 */ 1924 int 1925 kern_posix_error(struct thread *td, int error) 1926 { 1927 1928 if (error <= 0) 1929 return (error); 1930 td->td_errno = error; 1931 td->td_pflags |= TDP_NERRNO; 1932 td->td_retval[0] = error; 1933 return (0); 1934 } 1935