xref: /dflybsd-src/sys/kern/kern_descrip.c (revision c01f27eb865fd879f1ee80f5eeace159d26c9251)
1 /*
2  * Copyright (c) 2005 The DragonFly Project.  All rights reserved.
3  *
4  * This code is derived from software contributed to The DragonFly Project
5  * by Jeffrey Hsu.
6  *
7  * Redistribution and use in source and binary forms, with or without
8  * modification, are permitted provided that the following conditions
9  * are met:
10  *
11  * 1. Redistributions of source code must retain the above copyright
12  *    notice, this list of conditions and the following disclaimer.
13  * 2. Redistributions in binary form must reproduce the above copyright
14  *    notice, this list of conditions and the following disclaimer in
15  *    the documentation and/or other materials provided with the
16  *    distribution.
17  * 3. Neither the name of The DragonFly Project nor the names of its
18  *    contributors may be used to endorse or promote products derived
19  *    from this software without specific, prior written permission.
20  *
21  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
22  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
23  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
24  * FOR A PARTICULAR PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE
25  * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
26  * INCIDENTAL, SPECIAL, EXEMPLARY OR CONSEQUENTIAL DAMAGES (INCLUDING,
27  * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
28  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
29  * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
30  * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
31  * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
32  * SUCH DAMAGE.
33  *
34  *
35  * Copyright (c) 1982, 1986, 1989, 1991, 1993
36  *	The Regents of the University of California.  All rights reserved.
37  * (c) UNIX System Laboratories, Inc.
38  * All or some portions of this file are derived from material licensed
39  * to the University of California by American Telephone and Telegraph
40  * Co. or Unix System Laboratories, Inc. and are reproduced herein with
41  * the permission of UNIX System Laboratories, Inc.
42  *
43  * Redistribution and use in source and binary forms, with or without
44  * modification, are permitted provided that the following conditions
45  * are met:
46  * 1. Redistributions of source code must retain the above copyright
47  *    notice, this list of conditions and the following disclaimer.
48  * 2. Redistributions in binary form must reproduce the above copyright
49  *    notice, this list of conditions and the following disclaimer in the
50  *    documentation and/or other materials provided with the distribution.
51  * 3. All advertising materials mentioning features or use of this software
52  *    must display the following acknowledgement:
53  *	This product includes software developed by the University of
54  *	California, Berkeley and its contributors.
55  * 4. Neither the name of the University nor the names of its contributors
56  *    may be used to endorse or promote products derived from this software
57  *    without specific prior written permission.
58  *
59  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
60  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
61  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
62  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
63  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
64  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
65  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
66  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
67  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
68  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
69  * SUCH DAMAGE.
70  *
71  *	@(#)kern_descrip.c	8.6 (Berkeley) 4/19/94
72  * $FreeBSD: src/sys/kern/kern_descrip.c,v 1.81.2.19 2004/02/28 00:43:31 tegge Exp $
73  * $DragonFly: src/sys/kern/kern_descrip.c,v 1.79 2008/08/31 13:18:28 aggelos Exp $
74  */
75 
76 #include "opt_compat.h"
77 #include <sys/param.h>
78 #include <sys/systm.h>
79 #include <sys/malloc.h>
80 #include <sys/sysproto.h>
81 #include <sys/conf.h>
82 #include <sys/device.h>
83 #include <sys/file.h>
84 #include <sys/filedesc.h>
85 #include <sys/kernel.h>
86 #include <sys/sysctl.h>
87 #include <sys/vnode.h>
88 #include <sys/proc.h>
89 #include <sys/nlookup.h>
90 #include <sys/file.h>
91 #include <sys/stat.h>
92 #include <sys/filio.h>
93 #include <sys/fcntl.h>
94 #include <sys/unistd.h>
95 #include <sys/resourcevar.h>
96 #include <sys/event.h>
97 #include <sys/kern_syscall.h>
98 #include <sys/kcore.h>
99 #include <sys/kinfo.h>
100 #include <sys/un.h>
101 
102 #include <vm/vm.h>
103 #include <vm/vm_extern.h>
104 
105 #include <sys/thread2.h>
106 #include <sys/file2.h>
107 #include <sys/spinlock2.h>
108 #include <sys/mplock2.h>
109 
110 static void fsetfd_locked(struct filedesc *fdp, struct file *fp, int fd);
111 static void fdreserve_locked (struct filedesc *fdp, int fd0, int incr);
112 static struct file *funsetfd_locked (struct filedesc *fdp, int fd);
113 static void ffree(struct file *fp);
114 
115 static MALLOC_DEFINE(M_FILEDESC, "file desc", "Open file descriptor table");
116 static MALLOC_DEFINE(M_FILEDESC_TO_LEADER, "file desc to leader",
117 		     "file desc to leader structures");
118 MALLOC_DEFINE(M_FILE, "file", "Open file structure");
119 static MALLOC_DEFINE(M_SIGIO, "sigio", "sigio structures");
120 
121 static struct krate krate_uidinfo = { .freq = 1 };
122 
123 static	 d_open_t  fdopen;
124 #define NUMFDESC 64
125 
126 #define CDEV_MAJOR 22
127 static struct dev_ops fildesc_ops = {
128 	{ "FD", CDEV_MAJOR, 0 },
129 	.d_open =	fdopen,
130 };
131 
132 /*
133  * Descriptor management.
134  */
135 static struct filelist filehead = LIST_HEAD_INITIALIZER(&filehead);
136 static struct spinlock filehead_spin = SPINLOCK_INITIALIZER(&filehead_spin);
137 static int nfiles;		/* actual number of open files */
138 extern int cmask;
139 
140 /*
141  * Fixup fd_freefile and fd_lastfile after a descriptor has been cleared.
142  *
143  * MPSAFE - must be called with fdp->fd_spin exclusively held
144  */
145 static __inline
146 void
147 fdfixup_locked(struct filedesc *fdp, int fd)
148 {
149 	if (fd < fdp->fd_freefile) {
150 	       fdp->fd_freefile = fd;
151 	}
152 	while (fdp->fd_lastfile >= 0 &&
153 	       fdp->fd_files[fdp->fd_lastfile].fp == NULL &&
154 	       fdp->fd_files[fdp->fd_lastfile].reserved == 0
155 	) {
156 		--fdp->fd_lastfile;
157 	}
158 }
159 
160 /*
161  * System calls on descriptors.
162  *
163  * MPSAFE
164  */
165 int
166 sys_getdtablesize(struct getdtablesize_args *uap)
167 {
168 	struct proc *p = curproc;
169 	struct plimit *limit = p->p_limit;
170 	int dtsize;
171 
172 	spin_lock_rd(&limit->p_spin);
173 	if (limit->pl_rlimit[RLIMIT_NOFILE].rlim_cur > INT_MAX)
174 		dtsize = INT_MAX;
175 	else
176 		dtsize = (int)limit->pl_rlimit[RLIMIT_NOFILE].rlim_cur;
177 	spin_unlock_rd(&limit->p_spin);
178 	if (dtsize > maxfilesperproc)
179 		dtsize = maxfilesperproc;
180 	if (dtsize < minfilesperproc)
181 		dtsize = minfilesperproc;
182 	if (p->p_ucred->cr_uid && dtsize > maxfilesperuser)
183 		dtsize = maxfilesperuser;
184 	uap->sysmsg_result = dtsize;
185 	return (0);
186 }
187 
188 /*
189  * Duplicate a file descriptor to a particular value.
190  *
191  * note: keep in mind that a potential race condition exists when closing
192  * descriptors from a shared descriptor table (via rfork).
193  *
194  * MPSAFE
195  */
196 int
197 sys_dup2(struct dup2_args *uap)
198 {
199 	int error;
200 	int fd = 0;
201 
202 	error = kern_dup(DUP_FIXED, uap->from, uap->to, &fd);
203 	uap->sysmsg_fds[0] = fd;
204 
205 	return (error);
206 }
207 
208 /*
209  * Duplicate a file descriptor.
210  *
211  * MPSAFE
212  */
213 int
214 sys_dup(struct dup_args *uap)
215 {
216 	int error;
217 	int fd = 0;
218 
219 	error = kern_dup(DUP_VARIABLE, uap->fd, 0, &fd);
220 	uap->sysmsg_fds[0] = fd;
221 
222 	return (error);
223 }
224 
225 /*
226  * MPALMOSTSAFE - acquires mplock for fp operations
227  */
228 int
229 kern_fcntl(int fd, int cmd, union fcntl_dat *dat, struct ucred *cred)
230 {
231 	struct thread *td = curthread;
232 	struct proc *p = td->td_proc;
233 	struct file *fp;
234 	struct vnode *vp;
235 	u_int newmin;
236 	u_int oflags;
237 	u_int nflags;
238 	int tmp, error, flg = F_POSIX;
239 
240 	KKASSERT(p);
241 
242 	/*
243 	 * Operations on file descriptors that do not require a file pointer.
244 	 */
245 	switch (cmd) {
246 	case F_GETFD:
247 		error = fgetfdflags(p->p_fd, fd, &tmp);
248 		if (error == 0)
249 			dat->fc_cloexec = (tmp & UF_EXCLOSE) ? FD_CLOEXEC : 0;
250 		return (error);
251 
252 	case F_SETFD:
253 		if (dat->fc_cloexec & FD_CLOEXEC)
254 			error = fsetfdflags(p->p_fd, fd, UF_EXCLOSE);
255 		else
256 			error = fclrfdflags(p->p_fd, fd, UF_EXCLOSE);
257 		return (error);
258 	case F_DUPFD:
259 		newmin = dat->fc_fd;
260 		error = kern_dup(DUP_VARIABLE, fd, newmin, &dat->fc_fd);
261 		return (error);
262 	default:
263 		break;
264 	}
265 
266 	/*
267 	 * Operations on file pointers
268 	 */
269 	if ((fp = holdfp(p->p_fd, fd, -1)) == NULL)
270 		return (EBADF);
271 
272 	get_mplock();
273 	switch (cmd) {
274 	case F_GETFL:
275 		dat->fc_flags = OFLAGS(fp->f_flag);
276 		error = 0;
277 		break;
278 
279 	case F_SETFL:
280 		oflags = fp->f_flag;
281 		nflags = FFLAGS(dat->fc_flags & ~O_ACCMODE) & FCNTLFLAGS;
282 		nflags |= oflags & ~FCNTLFLAGS;
283 
284 		error = 0;
285 		if (((nflags ^ oflags) & O_APPEND) && (oflags & FAPPENDONLY))
286 			error = EINVAL;
287 		if (error == 0 && ((nflags ^ oflags) & FASYNC)) {
288 			tmp = nflags & FASYNC;
289 			error = fo_ioctl(fp, FIOASYNC, (caddr_t)&tmp,
290 					 cred, NULL);
291 		}
292 		if (error == 0)
293 			fp->f_flag = nflags;
294 		break;
295 
296 	case F_GETOWN:
297 		error = fo_ioctl(fp, FIOGETOWN, (caddr_t)&dat->fc_owner,
298 				 cred, NULL);
299 		break;
300 
301 	case F_SETOWN:
302 		error = fo_ioctl(fp, FIOSETOWN, (caddr_t)&dat->fc_owner,
303 				 cred, NULL);
304 		break;
305 
306 	case F_SETLKW:
307 		flg |= F_WAIT;
308 		/* Fall into F_SETLK */
309 
310 	case F_SETLK:
311 		if (fp->f_type != DTYPE_VNODE) {
312 			error = EBADF;
313 			break;
314 		}
315 		vp = (struct vnode *)fp->f_data;
316 
317 		/*
318 		 * copyin/lockop may block
319 		 */
320 		if (dat->fc_flock.l_whence == SEEK_CUR)
321 			dat->fc_flock.l_start += fp->f_offset;
322 
323 		switch (dat->fc_flock.l_type) {
324 		case F_RDLCK:
325 			if ((fp->f_flag & FREAD) == 0) {
326 				error = EBADF;
327 				break;
328 			}
329 			p->p_leader->p_flag |= P_ADVLOCK;
330 			error = VOP_ADVLOCK(vp, (caddr_t)p->p_leader, F_SETLK,
331 			    &dat->fc_flock, flg);
332 			break;
333 		case F_WRLCK:
334 			if ((fp->f_flag & FWRITE) == 0) {
335 				error = EBADF;
336 				break;
337 			}
338 			p->p_leader->p_flag |= P_ADVLOCK;
339 			error = VOP_ADVLOCK(vp, (caddr_t)p->p_leader, F_SETLK,
340 			    &dat->fc_flock, flg);
341 			break;
342 		case F_UNLCK:
343 			error = VOP_ADVLOCK(vp, (caddr_t)p->p_leader, F_UNLCK,
344 				&dat->fc_flock, F_POSIX);
345 			break;
346 		default:
347 			error = EINVAL;
348 			break;
349 		}
350 
351 		/*
352 		 * It is possible to race a close() on the descriptor while
353 		 * we were blocked getting the lock.  If this occurs the
354 		 * close might not have caught the lock.
355 		 */
356 		if (checkfdclosed(p->p_fd, fd, fp)) {
357 			dat->fc_flock.l_whence = SEEK_SET;
358 			dat->fc_flock.l_start = 0;
359 			dat->fc_flock.l_len = 0;
360 			dat->fc_flock.l_type = F_UNLCK;
361 			(void) VOP_ADVLOCK(vp, (caddr_t)p->p_leader,
362 					   F_UNLCK, &dat->fc_flock, F_POSIX);
363 		}
364 		break;
365 
366 	case F_GETLK:
367 		if (fp->f_type != DTYPE_VNODE) {
368 			error = EBADF;
369 			break;
370 		}
371 		vp = (struct vnode *)fp->f_data;
372 		/*
373 		 * copyin/lockop may block
374 		 */
375 		if (dat->fc_flock.l_type != F_RDLCK &&
376 		    dat->fc_flock.l_type != F_WRLCK &&
377 		    dat->fc_flock.l_type != F_UNLCK) {
378 			error = EINVAL;
379 			break;
380 		}
381 		if (dat->fc_flock.l_whence == SEEK_CUR)
382 			dat->fc_flock.l_start += fp->f_offset;
383 		error = VOP_ADVLOCK(vp, (caddr_t)p->p_leader, F_GETLK,
384 			    &dat->fc_flock, F_POSIX);
385 		break;
386 	default:
387 		error = EINVAL;
388 		break;
389 	}
390 	rel_mplock();
391 
392 	fdrop(fp);
393 	return (error);
394 }
395 
396 /*
397  * The file control system call.
398  *
399  * MPSAFE
400  */
401 int
402 sys_fcntl(struct fcntl_args *uap)
403 {
404 	union fcntl_dat dat;
405 	int error;
406 
407 	switch (uap->cmd) {
408 	case F_DUPFD:
409 		dat.fc_fd = uap->arg;
410 		break;
411 	case F_SETFD:
412 		dat.fc_cloexec = uap->arg;
413 		break;
414 	case F_SETFL:
415 		dat.fc_flags = uap->arg;
416 		break;
417 	case F_SETOWN:
418 		dat.fc_owner = uap->arg;
419 		break;
420 	case F_SETLKW:
421 	case F_SETLK:
422 	case F_GETLK:
423 		error = copyin((caddr_t)uap->arg, &dat.fc_flock,
424 			       sizeof(struct flock));
425 		if (error)
426 			return (error);
427 		break;
428 	}
429 
430 	error = kern_fcntl(uap->fd, uap->cmd, &dat, curthread->td_ucred);
431 
432 	if (error == 0) {
433 		switch (uap->cmd) {
434 		case F_DUPFD:
435 			uap->sysmsg_result = dat.fc_fd;
436 			break;
437 		case F_GETFD:
438 			uap->sysmsg_result = dat.fc_cloexec;
439 			break;
440 		case F_GETFL:
441 			uap->sysmsg_result = dat.fc_flags;
442 			break;
443 		case F_GETOWN:
444 			uap->sysmsg_result = dat.fc_owner;
445 		case F_GETLK:
446 			error = copyout(&dat.fc_flock, (caddr_t)uap->arg,
447 			    sizeof(struct flock));
448 			break;
449 		}
450 	}
451 
452 	return (error);
453 }
454 
455 /*
456  * Common code for dup, dup2, and fcntl(F_DUPFD).
457  *
458  * The type flag can be either DUP_FIXED or DUP_VARIABLE.  DUP_FIXED tells
459  * kern_dup() to destructively dup over an existing file descriptor if new
460  * is already open.  DUP_VARIABLE tells kern_dup() to find the lowest
461  * unused file descriptor that is greater than or equal to new.
462  *
463  * MPSAFE
464  */
465 int
466 kern_dup(enum dup_type type, int old, int new, int *res)
467 {
468 	struct thread *td = curthread;
469 	struct proc *p = td->td_proc;
470 	struct filedesc *fdp = p->p_fd;
471 	struct file *fp;
472 	struct file *delfp;
473 	int oldflags;
474 	int holdleaders;
475 	int dtsize;
476 	int error, newfd;
477 
478 	/*
479 	 * Verify that we have a valid descriptor to dup from and
480 	 * possibly to dup to.
481 	 *
482 	 * NOTE: maxfilesperuser is not applicable to dup()
483 	 */
484 retry:
485 	if (p->p_rlimit[RLIMIT_NOFILE].rlim_cur > INT_MAX)
486 		dtsize = INT_MAX;
487 	else
488 		dtsize = (int)p->p_rlimit[RLIMIT_NOFILE].rlim_cur;
489 	if (dtsize > maxfilesperproc)
490 		dtsize = maxfilesperproc;
491 	if (dtsize < minfilesperproc)
492 		dtsize = minfilesperproc;
493 
494 	if (new < 0 || new > dtsize)
495 		return (EINVAL);
496 
497 	spin_lock_wr(&fdp->fd_spin);
498 	if ((unsigned)old >= fdp->fd_nfiles || fdp->fd_files[old].fp == NULL) {
499 		spin_unlock_wr(&fdp->fd_spin);
500 		return (EBADF);
501 	}
502 	if (type == DUP_FIXED && old == new) {
503 		*res = new;
504 		spin_unlock_wr(&fdp->fd_spin);
505 		return (0);
506 	}
507 	fp = fdp->fd_files[old].fp;
508 	oldflags = fdp->fd_files[old].fileflags;
509 	fhold(fp);	/* MPSAFE - can be called with a spinlock held */
510 
511 	/*
512 	 * Allocate a new descriptor if DUP_VARIABLE, or expand the table
513 	 * if the requested descriptor is beyond the current table size.
514 	 *
515 	 * This can block.  Retry if the source descriptor no longer matches
516 	 * or if our expectation in the expansion case races.
517 	 *
518 	 * If we are not expanding or allocating a new decriptor, then reset
519 	 * the target descriptor to a reserved state so we have a uniform
520 	 * setup for the next code block.
521 	 */
522 	if (type == DUP_VARIABLE || new >= fdp->fd_nfiles) {
523 		spin_unlock_wr(&fdp->fd_spin);
524 		error = fdalloc(p, new, &newfd);
525 		spin_lock_wr(&fdp->fd_spin);
526 		if (error) {
527 			spin_unlock_wr(&fdp->fd_spin);
528 			fdrop(fp);
529 			return (error);
530 		}
531 		/*
532 		 * Check for ripout
533 		 */
534 		if (old >= fdp->fd_nfiles || fdp->fd_files[old].fp != fp) {
535 			fsetfd_locked(fdp, NULL, newfd);
536 			spin_unlock_wr(&fdp->fd_spin);
537 			fdrop(fp);
538 			goto retry;
539 		}
540 		/*
541 		 * Check for expansion race
542 		 */
543 		if (type != DUP_VARIABLE && new != newfd) {
544 			fsetfd_locked(fdp, NULL, newfd);
545 			spin_unlock_wr(&fdp->fd_spin);
546 			fdrop(fp);
547 			goto retry;
548 		}
549 		/*
550 		 * Check for ripout, newfd reused old (this case probably
551 		 * can't occur).
552 		 */
553 		if (old == newfd) {
554 			fsetfd_locked(fdp, NULL, newfd);
555 			spin_unlock_wr(&fdp->fd_spin);
556 			fdrop(fp);
557 			goto retry;
558 		}
559 		new = newfd;
560 		delfp = NULL;
561 	} else {
562 		if (fdp->fd_files[new].reserved) {
563 			spin_unlock_wr(&fdp->fd_spin);
564 			fdrop(fp);
565 			kprintf("Warning: dup(): target descriptor %d is reserved, waiting for it to be resolved\n", new);
566 			tsleep(fdp, 0, "fdres", hz);
567 			goto retry;
568 		}
569 
570 		/*
571 		 * If the target descriptor was never allocated we have
572 		 * to allocate it.  If it was we have to clean out the
573 		 * old descriptor.  delfp inherits the ref from the
574 		 * descriptor table.
575 		 */
576 		delfp = fdp->fd_files[new].fp;
577 		fdp->fd_files[new].fp = NULL;
578 		fdp->fd_files[new].reserved = 1;
579 		if (delfp == NULL) {
580 			fdreserve_locked(fdp, new, 1);
581 			if (new > fdp->fd_lastfile)
582 				fdp->fd_lastfile = new;
583 		}
584 
585 	}
586 
587 	/*
588 	 * NOTE: still holding an exclusive spinlock
589 	 */
590 
591 	/*
592 	 * If a descriptor is being overwritten we may hve to tell
593 	 * fdfree() to sleep to ensure that all relevant process
594 	 * leaders can be traversed in closef().
595 	 */
596 	if (delfp != NULL && p->p_fdtol != NULL) {
597 		fdp->fd_holdleaderscount++;
598 		holdleaders = 1;
599 	} else {
600 		holdleaders = 0;
601 	}
602 	KASSERT(delfp == NULL || type == DUP_FIXED,
603 		("dup() picked an open file"));
604 
605 	/*
606 	 * Duplicate the source descriptor, update lastfile.  If the new
607 	 * descriptor was not allocated and we aren't replacing an existing
608 	 * descriptor we have to mark the descriptor as being in use.
609 	 *
610 	 * The fd_files[] array inherits fp's hold reference.
611 	 */
612 	fsetfd_locked(fdp, fp, new);
613 	fdp->fd_files[new].fileflags = oldflags & ~UF_EXCLOSE;
614 	spin_unlock_wr(&fdp->fd_spin);
615 	fdrop(fp);
616 	*res = new;
617 
618 	/*
619 	 * If we dup'd over a valid file, we now own the reference to it
620 	 * and must dispose of it using closef() semantics (as if a
621 	 * close() were performed on it).
622 	 */
623 	if (delfp) {
624 		if (SLIST_FIRST(&delfp->f_klist)) {
625 			get_mplock();
626 			knote_fdclose(delfp, fdp, new);
627 			rel_mplock();
628 		}
629 		closef(delfp, p);
630 		if (holdleaders) {
631 			spin_lock_wr(&fdp->fd_spin);
632 			fdp->fd_holdleaderscount--;
633 			if (fdp->fd_holdleaderscount == 0 &&
634 			    fdp->fd_holdleaderswakeup != 0) {
635 				fdp->fd_holdleaderswakeup = 0;
636 				spin_unlock_wr(&fdp->fd_spin);
637 				wakeup(&fdp->fd_holdleaderscount);
638 			} else {
639 				spin_unlock_wr(&fdp->fd_spin);
640 			}
641 		}
642 	}
643 	return (0);
644 }
645 
646 /*
647  * If sigio is on the list associated with a process or process group,
648  * disable signalling from the device, remove sigio from the list and
649  * free sigio.
650  */
651 void
652 funsetown(struct sigio *sigio)
653 {
654 	if (sigio == NULL)
655 		return;
656 	crit_enter();
657 	*(sigio->sio_myref) = NULL;
658 	crit_exit();
659 	if (sigio->sio_pgid < 0) {
660 		SLIST_REMOVE(&sigio->sio_pgrp->pg_sigiolst, sigio,
661 			     sigio, sio_pgsigio);
662 	} else /* if ((*sigiop)->sio_pgid > 0) */ {
663 		SLIST_REMOVE(&sigio->sio_proc->p_sigiolst, sigio,
664 			     sigio, sio_pgsigio);
665 	}
666 	crfree(sigio->sio_ucred);
667 	kfree(sigio, M_SIGIO);
668 }
669 
670 /* Free a list of sigio structures. */
671 void
672 funsetownlst(struct sigiolst *sigiolst)
673 {
674 	struct sigio *sigio;
675 
676 	while ((sigio = SLIST_FIRST(sigiolst)) != NULL)
677 		funsetown(sigio);
678 }
679 
680 /*
681  * This is common code for FIOSETOWN ioctl called by fcntl(fd, F_SETOWN, arg).
682  *
683  * After permission checking, add a sigio structure to the sigio list for
684  * the process or process group.
685  */
686 int
687 fsetown(pid_t pgid, struct sigio **sigiop)
688 {
689 	struct proc *proc;
690 	struct pgrp *pgrp;
691 	struct sigio *sigio;
692 
693 	if (pgid == 0) {
694 		funsetown(*sigiop);
695 		return (0);
696 	}
697 	if (pgid > 0) {
698 		proc = pfind(pgid);
699 		if (proc == NULL)
700 			return (ESRCH);
701 
702 		/*
703 		 * Policy - Don't allow a process to FSETOWN a process
704 		 * in another session.
705 		 *
706 		 * Remove this test to allow maximum flexibility or
707 		 * restrict FSETOWN to the current process or process
708 		 * group for maximum safety.
709 		 */
710 		if (proc->p_session != curproc->p_session)
711 			return (EPERM);
712 
713 		pgrp = NULL;
714 	} else /* if (pgid < 0) */ {
715 		pgrp = pgfind(-pgid);
716 		if (pgrp == NULL)
717 			return (ESRCH);
718 
719 		/*
720 		 * Policy - Don't allow a process to FSETOWN a process
721 		 * in another session.
722 		 *
723 		 * Remove this test to allow maximum flexibility or
724 		 * restrict FSETOWN to the current process or process
725 		 * group for maximum safety.
726 		 */
727 		if (pgrp->pg_session != curproc->p_session)
728 			return (EPERM);
729 
730 		proc = NULL;
731 	}
732 	funsetown(*sigiop);
733 	sigio = kmalloc(sizeof(struct sigio), M_SIGIO, M_WAITOK);
734 	if (pgid > 0) {
735 		SLIST_INSERT_HEAD(&proc->p_sigiolst, sigio, sio_pgsigio);
736 		sigio->sio_proc = proc;
737 	} else {
738 		SLIST_INSERT_HEAD(&pgrp->pg_sigiolst, sigio, sio_pgsigio);
739 		sigio->sio_pgrp = pgrp;
740 	}
741 	sigio->sio_pgid = pgid;
742 	sigio->sio_ucred = crhold(curthread->td_ucred);
743 	/* It would be convenient if p_ruid was in ucred. */
744 	sigio->sio_ruid = sigio->sio_ucred->cr_ruid;
745 	sigio->sio_myref = sigiop;
746 	crit_enter();
747 	*sigiop = sigio;
748 	crit_exit();
749 	return (0);
750 }
751 
752 /*
753  * This is common code for FIOGETOWN ioctl called by fcntl(fd, F_GETOWN, arg).
754  */
755 pid_t
756 fgetown(struct sigio *sigio)
757 {
758 	return (sigio != NULL ? sigio->sio_pgid : 0);
759 }
760 
761 /*
762  * Close many file descriptors.
763  *
764  * MPSAFE
765  */
766 int
767 sys_closefrom(struct closefrom_args *uap)
768 {
769 	return(kern_closefrom(uap->fd));
770 }
771 
772 /*
773  * Close all file descriptors greater then or equal to fd
774  *
775  * MPSAFE
776  */
777 int
778 kern_closefrom(int fd)
779 {
780 	struct thread *td = curthread;
781 	struct proc *p = td->td_proc;
782 	struct filedesc *fdp;
783 
784 	KKASSERT(p);
785 	fdp = p->p_fd;
786 
787 	if (fd < 0)
788 		return (EINVAL);
789 
790 	/*
791 	 * NOTE: This function will skip unassociated descriptors and
792 	 * reserved descriptors that have not yet been assigned.
793 	 * fd_lastfile can change as a side effect of kern_close().
794 	 */
795 	spin_lock_wr(&fdp->fd_spin);
796 	while (fd <= fdp->fd_lastfile) {
797 		if (fdp->fd_files[fd].fp != NULL) {
798 			spin_unlock_wr(&fdp->fd_spin);
799 			/* ok if this races another close */
800 			if (kern_close(fd) == EINTR)
801 				return (EINTR);
802 			spin_lock_wr(&fdp->fd_spin);
803 		}
804 		++fd;
805 	}
806 	spin_unlock_wr(&fdp->fd_spin);
807 	return (0);
808 }
809 
810 /*
811  * Close a file descriptor.
812  *
813  * MPSAFE
814  */
815 int
816 sys_close(struct close_args *uap)
817 {
818 	return(kern_close(uap->fd));
819 }
820 
821 /*
822  * MPALMOSTSAFE - acquires mplock around knote_fdclose() calls
823  */
824 int
825 kern_close(int fd)
826 {
827 	struct thread *td = curthread;
828 	struct proc *p = td->td_proc;
829 	struct filedesc *fdp;
830 	struct file *fp;
831 	int error;
832 	int holdleaders;
833 
834 	KKASSERT(p);
835 	fdp = p->p_fd;
836 
837 	spin_lock_wr(&fdp->fd_spin);
838 	if ((fp = funsetfd_locked(fdp, fd)) == NULL) {
839 		spin_unlock_wr(&fdp->fd_spin);
840 		return (EBADF);
841 	}
842 	holdleaders = 0;
843 	if (p->p_fdtol != NULL) {
844 		/*
845 		 * Ask fdfree() to sleep to ensure that all relevant
846 		 * process leaders can be traversed in closef().
847 		 */
848 		fdp->fd_holdleaderscount++;
849 		holdleaders = 1;
850 	}
851 
852 	/*
853 	 * we now hold the fp reference that used to be owned by the descriptor
854 	 * array.
855 	 */
856 	spin_unlock_wr(&fdp->fd_spin);
857 	if (SLIST_FIRST(&fp->f_klist)) {
858 		get_mplock();
859 		knote_fdclose(fp, fdp, fd);
860 		rel_mplock();
861 	}
862 	error = closef(fp, p);
863 	if (holdleaders) {
864 		spin_lock_wr(&fdp->fd_spin);
865 		fdp->fd_holdleaderscount--;
866 		if (fdp->fd_holdleaderscount == 0 &&
867 		    fdp->fd_holdleaderswakeup != 0) {
868 			fdp->fd_holdleaderswakeup = 0;
869 			spin_unlock_wr(&fdp->fd_spin);
870 			wakeup(&fdp->fd_holdleaderscount);
871 		} else {
872 			spin_unlock_wr(&fdp->fd_spin);
873 		}
874 	}
875 	return (error);
876 }
877 
878 /*
879  * shutdown_args(int fd, int how)
880  */
881 int
882 kern_shutdown(int fd, int how)
883 {
884 	struct thread *td = curthread;
885 	struct proc *p = td->td_proc;
886 	struct file *fp;
887 	int error;
888 
889 	KKASSERT(p);
890 
891 	if ((fp = holdfp(p->p_fd, fd, -1)) == NULL)
892 		return (EBADF);
893 	error = fo_shutdown(fp, how);
894 	fdrop(fp);
895 
896 	return (error);
897 }
898 
899 /*
900  * MPALMOSTSAFE
901  */
902 int
903 sys_shutdown(struct shutdown_args *uap)
904 {
905 	int error;
906 
907 	get_mplock();
908 	error = kern_shutdown(uap->s, uap->how);
909 	rel_mplock();
910 
911 	return (error);
912 }
913 
914 /*
915  * MPSAFE
916  */
917 int
918 kern_fstat(int fd, struct stat *ub)
919 {
920 	struct thread *td = curthread;
921 	struct proc *p = td->td_proc;
922 	struct file *fp;
923 	int error;
924 
925 	KKASSERT(p);
926 
927 	if ((fp = holdfp(p->p_fd, fd, -1)) == NULL)
928 		return (EBADF);
929 	error = fo_stat(fp, ub, td->td_ucred);
930 	fdrop(fp);
931 
932 	return (error);
933 }
934 
935 /*
936  * Return status information about a file descriptor.
937  *
938  * MPSAFE
939  */
940 int
941 sys_fstat(struct fstat_args *uap)
942 {
943 	struct stat st;
944 	int error;
945 
946 	error = kern_fstat(uap->fd, &st);
947 
948 	if (error == 0)
949 		error = copyout(&st, uap->sb, sizeof(st));
950 	return (error);
951 }
952 
953 /*
954  * Return pathconf information about a file descriptor.
955  *
956  * MPALMOSTSAFE
957  */
958 int
959 sys_fpathconf(struct fpathconf_args *uap)
960 {
961 	struct thread *td = curthread;
962 	struct proc *p = td->td_proc;
963 	struct file *fp;
964 	struct vnode *vp;
965 	int error = 0;
966 
967 	if ((fp = holdfp(p->p_fd, uap->fd, -1)) == NULL)
968 		return (EBADF);
969 
970 	switch (fp->f_type) {
971 	case DTYPE_PIPE:
972 	case DTYPE_SOCKET:
973 		if (uap->name != _PC_PIPE_BUF) {
974 			error = EINVAL;
975 		} else {
976 			uap->sysmsg_result = PIPE_BUF;
977 			error = 0;
978 		}
979 		break;
980 	case DTYPE_FIFO:
981 	case DTYPE_VNODE:
982 		vp = (struct vnode *)fp->f_data;
983 		get_mplock();
984 		error = VOP_PATHCONF(vp, uap->name, &uap->sysmsg_reg);
985 		rel_mplock();
986 		break;
987 	default:
988 		error = EOPNOTSUPP;
989 		break;
990 	}
991 	fdrop(fp);
992 	return(error);
993 }
994 
995 static int fdexpand;
996 SYSCTL_INT(_debug, OID_AUTO, fdexpand, CTLFLAG_RD, &fdexpand,
997 	   0, "");
998 
999 /*
1000  * Grow the file table so it can hold through descriptor (want).
1001  *
1002  * The fdp's spinlock must be held exclusively on entry and may be held
1003  * exclusively on return.  The spinlock may be cycled by the routine.
1004  *
1005  * MPSAFE
1006  */
1007 static void
1008 fdgrow_locked(struct filedesc *fdp, int want)
1009 {
1010 	struct fdnode *newfiles;
1011 	struct fdnode *oldfiles;
1012 	int nf, extra;
1013 
1014 	nf = fdp->fd_nfiles;
1015 	do {
1016 		/* nf has to be of the form 2^n - 1 */
1017 		nf = 2 * nf + 1;
1018 	} while (nf <= want);
1019 
1020 	spin_unlock_wr(&fdp->fd_spin);
1021 	newfiles = kmalloc(nf * sizeof(struct fdnode), M_FILEDESC, M_WAITOK);
1022 	spin_lock_wr(&fdp->fd_spin);
1023 
1024 	/*
1025 	 * We could have raced another extend while we were not holding
1026 	 * the spinlock.
1027 	 */
1028 	if (fdp->fd_nfiles >= nf) {
1029 		spin_unlock_wr(&fdp->fd_spin);
1030 		kfree(newfiles, M_FILEDESC);
1031 		spin_lock_wr(&fdp->fd_spin);
1032 		return;
1033 	}
1034 	/*
1035 	 * Copy the existing ofile and ofileflags arrays
1036 	 * and zero the new portion of each array.
1037 	 */
1038 	extra = nf - fdp->fd_nfiles;
1039 	bcopy(fdp->fd_files, newfiles, fdp->fd_nfiles * sizeof(struct fdnode));
1040 	bzero(&newfiles[fdp->fd_nfiles], extra * sizeof(struct fdnode));
1041 
1042 	oldfiles = fdp->fd_files;
1043 	fdp->fd_files = newfiles;
1044 	fdp->fd_nfiles = nf;
1045 
1046 	if (oldfiles != fdp->fd_builtin_files) {
1047 		spin_unlock_wr(&fdp->fd_spin);
1048 		kfree(oldfiles, M_FILEDESC);
1049 		spin_lock_wr(&fdp->fd_spin);
1050 	}
1051 	fdexpand++;
1052 }
1053 
1054 /*
1055  * Number of nodes in right subtree, including the root.
1056  */
1057 static __inline int
1058 right_subtree_size(int n)
1059 {
1060 	return (n ^ (n | (n + 1)));
1061 }
1062 
1063 /*
1064  * Bigger ancestor.
1065  */
1066 static __inline int
1067 right_ancestor(int n)
1068 {
1069 	return (n | (n + 1));
1070 }
1071 
1072 /*
1073  * Smaller ancestor.
1074  */
1075 static __inline int
1076 left_ancestor(int n)
1077 {
1078 	return ((n & (n + 1)) - 1);
1079 }
1080 
1081 /*
1082  * Traverse the in-place binary tree buttom-up adjusting the allocation
1083  * count so scans can determine where free descriptors are located.
1084  *
1085  * MPSAFE - caller must be holding an exclusive spinlock on fdp
1086  */
1087 static
1088 void
1089 fdreserve_locked(struct filedesc *fdp, int fd, int incr)
1090 {
1091 	while (fd >= 0) {
1092 		fdp->fd_files[fd].allocated += incr;
1093 		KKASSERT(fdp->fd_files[fd].allocated >= 0);
1094 		fd = left_ancestor(fd);
1095 	}
1096 }
1097 
1098 /*
1099  * Reserve a file descriptor for the process.  If no error occurs, the
1100  * caller MUST at some point call fsetfd() or assign a file pointer
1101  * or dispose of the reservation.
1102  *
1103  * MPSAFE
1104  */
1105 int
1106 fdalloc(struct proc *p, int want, int *result)
1107 {
1108 	struct filedesc *fdp = p->p_fd;
1109 	struct uidinfo *uip;
1110 	int fd, rsize, rsum, node, lim;
1111 
1112 	/*
1113 	 * Check dtable size limit
1114 	 */
1115 	spin_lock_rd(&p->p_limit->p_spin);
1116 	if (p->p_rlimit[RLIMIT_NOFILE].rlim_cur > INT_MAX)
1117 		lim = INT_MAX;
1118 	else
1119 		lim = (int)p->p_rlimit[RLIMIT_NOFILE].rlim_cur;
1120 	spin_unlock_rd(&p->p_limit->p_spin);
1121 	if (lim > maxfilesperproc)
1122 		lim = maxfilesperproc;
1123 	if (lim < minfilesperproc)
1124 		lim = minfilesperproc;
1125 	if (want >= lim)
1126 		return (EMFILE);
1127 
1128 	/*
1129 	 * Check that the user has not run out of descriptors (non-root only).
1130 	 * As a safety measure the dtable is allowed to have at least
1131 	 * minfilesperproc open fds regardless of the maxfilesperuser limit.
1132 	 */
1133 	if (p->p_ucred->cr_uid && fdp->fd_nfiles >= minfilesperproc) {
1134 		uip = p->p_ucred->cr_uidinfo;
1135 		if (uip->ui_openfiles > maxfilesperuser) {
1136 			krateprintf(&krate_uidinfo,
1137 				    "Warning: user %d pid %d (%s) ran out of "
1138 				    "file descriptors (%d/%d)\n",
1139 				    p->p_ucred->cr_uid, (int)p->p_pid,
1140 				    p->p_comm,
1141 				    uip->ui_openfiles, maxfilesperuser);
1142 			return(ENFILE);
1143 		}
1144 	}
1145 
1146 	/*
1147 	 * Grow the dtable if necessary
1148 	 */
1149 	spin_lock_wr(&fdp->fd_spin);
1150 	if (want >= fdp->fd_nfiles)
1151 		fdgrow_locked(fdp, want);
1152 
1153 	/*
1154 	 * Search for a free descriptor starting at the higher
1155 	 * of want or fd_freefile.  If that fails, consider
1156 	 * expanding the ofile array.
1157 	 *
1158 	 * NOTE! the 'allocated' field is a cumulative recursive allocation
1159 	 * count.  If we happen to see a value of 0 then we can shortcut
1160 	 * our search.  Otherwise we run through through the tree going
1161 	 * down branches we know have free descriptor(s) until we hit a
1162 	 * leaf node.  The leaf node will be free but will not necessarily
1163 	 * have an allocated field of 0.
1164 	 */
1165 retry:
1166 	/* move up the tree looking for a subtree with a free node */
1167 	for (fd = max(want, fdp->fd_freefile); fd < min(fdp->fd_nfiles, lim);
1168 	     fd = right_ancestor(fd)) {
1169 		if (fdp->fd_files[fd].allocated == 0)
1170 			goto found;
1171 
1172 		rsize = right_subtree_size(fd);
1173 		if (fdp->fd_files[fd].allocated == rsize)
1174 			continue;	/* right subtree full */
1175 
1176 		/*
1177 		 * Free fd is in the right subtree of the tree rooted at fd.
1178 		 * Call that subtree R.  Look for the smallest (leftmost)
1179 		 * subtree of R with an unallocated fd: continue moving
1180 		 * down the left branch until encountering a full left
1181 		 * subtree, then move to the right.
1182 		 */
1183 		for (rsum = 0, rsize /= 2; rsize > 0; rsize /= 2) {
1184 			node = fd + rsize;
1185 			rsum += fdp->fd_files[node].allocated;
1186 			if (fdp->fd_files[fd].allocated == rsum + rsize) {
1187 				fd = node;	/* move to the right */
1188 				if (fdp->fd_files[node].allocated == 0)
1189 					goto found;
1190 				rsum = 0;
1191 			}
1192 		}
1193 		goto found;
1194 	}
1195 
1196 	/*
1197 	 * No space in current array.  Expand?
1198 	 */
1199 	if (fdp->fd_nfiles >= lim) {
1200 		spin_unlock_wr(&fdp->fd_spin);
1201 		return (EMFILE);
1202 	}
1203 	fdgrow_locked(fdp, want);
1204 	goto retry;
1205 
1206 found:
1207 	KKASSERT(fd < fdp->fd_nfiles);
1208 	if (fd > fdp->fd_lastfile)
1209 		fdp->fd_lastfile = fd;
1210 	if (want <= fdp->fd_freefile)
1211 		fdp->fd_freefile = fd;
1212 	*result = fd;
1213 	KKASSERT(fdp->fd_files[fd].fp == NULL);
1214 	KKASSERT(fdp->fd_files[fd].reserved == 0);
1215 	fdp->fd_files[fd].fileflags = 0;
1216 	fdp->fd_files[fd].reserved = 1;
1217 	fdreserve_locked(fdp, fd, 1);
1218 	spin_unlock_wr(&fdp->fd_spin);
1219 	return (0);
1220 }
1221 
1222 /*
1223  * Check to see whether n user file descriptors
1224  * are available to the process p.
1225  *
1226  * MPSAFE
1227  */
1228 int
1229 fdavail(struct proc *p, int n)
1230 {
1231 	struct filedesc *fdp = p->p_fd;
1232 	struct fdnode *fdnode;
1233 	int i, lim, last;
1234 
1235 	spin_lock_rd(&p->p_limit->p_spin);
1236 	if (p->p_rlimit[RLIMIT_NOFILE].rlim_cur > INT_MAX)
1237 		lim = INT_MAX;
1238 	else
1239 		lim = (int)p->p_rlimit[RLIMIT_NOFILE].rlim_cur;
1240 	spin_unlock_rd(&p->p_limit->p_spin);
1241 	if (lim > maxfilesperproc)
1242 		lim = maxfilesperproc;
1243 	if (lim < minfilesperproc)
1244 		lim = minfilesperproc;
1245 
1246 	spin_lock_rd(&fdp->fd_spin);
1247 	if ((i = lim - fdp->fd_nfiles) > 0 && (n -= i) <= 0) {
1248 		spin_unlock_rd(&fdp->fd_spin);
1249 		return (1);
1250 	}
1251 	last = min(fdp->fd_nfiles, lim);
1252 	fdnode = &fdp->fd_files[fdp->fd_freefile];
1253 	for (i = last - fdp->fd_freefile; --i >= 0; ++fdnode) {
1254 		if (fdnode->fp == NULL && --n <= 0) {
1255 			spin_unlock_rd(&fdp->fd_spin);
1256 			return (1);
1257 		}
1258 	}
1259 	spin_unlock_rd(&fdp->fd_spin);
1260 	return (0);
1261 }
1262 
1263 /*
1264  * Revoke open descriptors referencing (f_data, f_type)
1265  *
1266  * Any revoke executed within a prison is only able to
1267  * revoke descriptors for processes within that prison.
1268  *
1269  * Returns 0 on success or an error code.
1270  */
1271 struct fdrevoke_info {
1272 	void *data;
1273 	short type;
1274 	short unused;
1275 	int count;
1276 	int intransit;
1277 	struct ucred *cred;
1278 	struct file *nfp;
1279 };
1280 
1281 static int fdrevoke_check_callback(struct file *fp, void *vinfo);
1282 static int fdrevoke_proc_callback(struct proc *p, void *vinfo);
1283 
1284 int
1285 fdrevoke(void *f_data, short f_type, struct ucred *cred)
1286 {
1287 	struct fdrevoke_info info;
1288 	int error;
1289 
1290 	bzero(&info, sizeof(info));
1291 	info.data = f_data;
1292 	info.type = f_type;
1293 	info.cred = cred;
1294 	error = falloc(NULL, &info.nfp, NULL);
1295 	if (error)
1296 		return (error);
1297 
1298 	/*
1299 	 * Scan the file pointer table once.  dups do not dup file pointers,
1300 	 * only descriptors, so there is no leak.  Set FREVOKED on the fps
1301 	 * being revoked.
1302 	 */
1303 	allfiles_scan_exclusive(fdrevoke_check_callback, &info);
1304 
1305 	/*
1306 	 * If any fps were marked track down the related descriptors
1307 	 * and close them.  Any dup()s at this point will notice
1308 	 * the FREVOKED already set in the fp and do the right thing.
1309 	 *
1310 	 * Any fps with non-zero msgcounts (aka sent over a unix-domain
1311 	 * socket) bumped the intransit counter and will require a
1312 	 * scan.  Races against fps leaving the socket are closed by
1313 	 * the socket code checking for FREVOKED.
1314 	 */
1315 	if (info.count)
1316 		allproc_scan(fdrevoke_proc_callback, &info);
1317 	if (info.intransit)
1318 		unp_revoke_gc(info.nfp);
1319 	fdrop(info.nfp);
1320 	return(0);
1321 }
1322 
1323 /*
1324  * Locate matching file pointers directly.
1325  */
1326 static int
1327 fdrevoke_check_callback(struct file *fp, void *vinfo)
1328 {
1329 	struct fdrevoke_info *info = vinfo;
1330 
1331 	/*
1332 	 * File pointers already flagged for revokation are skipped.
1333 	 */
1334 	if (fp->f_flag & FREVOKED)
1335 		return(0);
1336 
1337 	/*
1338 	 * If revoking from a prison file pointers created outside of
1339 	 * that prison, or file pointers without creds, cannot be revoked.
1340 	 */
1341 	if (info->cred->cr_prison &&
1342 	    (fp->f_cred == NULL ||
1343 	     info->cred->cr_prison != fp->f_cred->cr_prison)) {
1344 		return(0);
1345 	}
1346 
1347 	/*
1348 	 * If the file pointer matches then mark it for revocation.  The
1349 	 * flag is currently only used by unp_revoke_gc().
1350 	 *
1351 	 * info->count is a heuristic and can race in a SMP environment.
1352 	 */
1353 	if (info->data == fp->f_data && info->type == fp->f_type) {
1354 		atomic_set_int(&fp->f_flag, FREVOKED);
1355 		info->count += fp->f_count;
1356 		if (fp->f_msgcount)
1357 			++info->intransit;
1358 	}
1359 	return(0);
1360 }
1361 
1362 /*
1363  * Locate matching file pointers via process descriptor tables.
1364  */
1365 static int
1366 fdrevoke_proc_callback(struct proc *p, void *vinfo)
1367 {
1368 	struct fdrevoke_info *info = vinfo;
1369 	struct filedesc *fdp;
1370 	struct file *fp;
1371 	int n;
1372 
1373 	if (p->p_stat == SIDL || p->p_stat == SZOMB)
1374 		return(0);
1375 	if (info->cred->cr_prison &&
1376 	    info->cred->cr_prison != p->p_ucred->cr_prison) {
1377 		return(0);
1378 	}
1379 
1380 	/*
1381 	 * If the controlling terminal of the process matches the
1382 	 * vnode being revoked we clear the controlling terminal.
1383 	 *
1384 	 * The normal spec_close() may not catch this because it
1385 	 * uses curproc instead of p.
1386 	 */
1387 	if (p->p_session && info->type == DTYPE_VNODE &&
1388 	    info->data == p->p_session->s_ttyvp) {
1389 		p->p_session->s_ttyvp = NULL;
1390 		vrele(info->data);
1391 	}
1392 
1393 	/*
1394 	 * Softref the fdp to prevent it from being destroyed
1395 	 */
1396 	spin_lock_wr(&p->p_spin);
1397 	if ((fdp = p->p_fd) == NULL) {
1398 		spin_unlock_wr(&p->p_spin);
1399 		return(0);
1400 	}
1401 	atomic_add_int(&fdp->fd_softrefs, 1);
1402 	spin_unlock_wr(&p->p_spin);
1403 
1404 	/*
1405 	 * Locate and close any matching file descriptors.
1406 	 */
1407 	spin_lock_wr(&fdp->fd_spin);
1408 	for (n = 0; n < fdp->fd_nfiles; ++n) {
1409 		if ((fp = fdp->fd_files[n].fp) == NULL)
1410 			continue;
1411 		if (fp->f_flag & FREVOKED) {
1412 			fhold(info->nfp);
1413 			fdp->fd_files[n].fp = info->nfp;
1414 			spin_unlock_wr(&fdp->fd_spin);
1415 			knote_fdclose(fp, fdp, n);	/* XXX */
1416 			closef(fp, p);
1417 			spin_lock_wr(&fdp->fd_spin);
1418 			--info->count;
1419 		}
1420 	}
1421 	spin_unlock_wr(&fdp->fd_spin);
1422 	atomic_subtract_int(&fdp->fd_softrefs, 1);
1423 	return(0);
1424 }
1425 
1426 /*
1427  * falloc:
1428  *	Create a new open file structure and reserve a file decriptor
1429  *	for the process that refers to it.
1430  *
1431  *	Root creds are checked using lp, or assumed if lp is NULL.  If
1432  *	resultfd is non-NULL then lp must also be non-NULL.  No file
1433  *	descriptor is reserved (and no process context is needed) if
1434  *	resultfd is NULL.
1435  *
1436  *	A file pointer with a refcount of 1 is returned.  Note that the
1437  *	file pointer is NOT associated with the descriptor.  If falloc
1438  *	returns success, fsetfd() MUST be called to either associate the
1439  *	file pointer or clear the reservation.
1440  *
1441  * MPSAFE
1442  */
1443 int
1444 falloc(struct lwp *lp, struct file **resultfp, int *resultfd)
1445 {
1446 	static struct timeval lastfail;
1447 	static int curfail;
1448 	struct file *fp;
1449 	struct ucred *cred = lp ? lp->lwp_thread->td_ucred : proc0.p_ucred;
1450 	int error;
1451 
1452 	fp = NULL;
1453 
1454 	/*
1455 	 * Handle filetable full issues and root overfill.
1456 	 */
1457 	if (nfiles >= maxfiles - maxfilesrootres &&
1458 	    (cred->cr_ruid != 0 || nfiles >= maxfiles)) {
1459 		if (ppsratecheck(&lastfail, &curfail, 1)) {
1460 			kprintf("kern.maxfiles limit exceeded by uid %d, "
1461 				"please see tuning(7).\n",
1462 				cred->cr_ruid);
1463 		}
1464 		error = ENFILE;
1465 		goto done;
1466 	}
1467 
1468 	/*
1469 	 * Allocate a new file descriptor.
1470 	 */
1471 	fp = kmalloc(sizeof(struct file), M_FILE, M_WAITOK | M_ZERO);
1472 	spin_init(&fp->f_spin);
1473 	SLIST_INIT(&fp->f_klist);
1474 	fp->f_count = 1;
1475 	fp->f_ops = &badfileops;
1476 	fp->f_seqcount = 1;
1477 	fsetcred(fp, cred);
1478 	spin_lock_wr(&filehead_spin);
1479 	nfiles++;
1480 	LIST_INSERT_HEAD(&filehead, fp, f_list);
1481 	spin_unlock_wr(&filehead_spin);
1482 	if (resultfd) {
1483 		if ((error = fdalloc(lp->lwp_proc, 0, resultfd)) != 0) {
1484 			fdrop(fp);
1485 			fp = NULL;
1486 		}
1487 	} else {
1488 		error = 0;
1489 	}
1490 done:
1491 	*resultfp = fp;
1492 	return (error);
1493 }
1494 
1495 /*
1496  * Check for races against a file descriptor by determining that the
1497  * file pointer is still associated with the specified file descriptor,
1498  * and a close is not currently in progress.
1499  *
1500  * MPSAFE
1501  */
1502 int
1503 checkfdclosed(struct filedesc *fdp, int fd, struct file *fp)
1504 {
1505 	int error;
1506 
1507 	spin_lock_rd(&fdp->fd_spin);
1508 	if ((unsigned)fd >= fdp->fd_nfiles || fp != fdp->fd_files[fd].fp)
1509 		error = EBADF;
1510 	else
1511 		error = 0;
1512 	spin_unlock_rd(&fdp->fd_spin);
1513 	return (error);
1514 }
1515 
1516 /*
1517  * Associate a file pointer with a previously reserved file descriptor.
1518  * This function always succeeds.
1519  *
1520  * If fp is NULL, the file descriptor is returned to the pool.
1521  */
1522 
1523 /*
1524  * MPSAFE (exclusive spinlock must be held on call)
1525  */
1526 static void
1527 fsetfd_locked(struct filedesc *fdp, struct file *fp, int fd)
1528 {
1529 	KKASSERT((unsigned)fd < fdp->fd_nfiles);
1530 	KKASSERT(fdp->fd_files[fd].reserved != 0);
1531 	if (fp) {
1532 		fhold(fp);
1533 		fdp->fd_files[fd].fp = fp;
1534 		fdp->fd_files[fd].reserved = 0;
1535 	} else {
1536 		fdp->fd_files[fd].reserved = 0;
1537 		fdreserve_locked(fdp, fd, -1);
1538 		fdfixup_locked(fdp, fd);
1539 	}
1540 }
1541 
1542 /*
1543  * MPSAFE
1544  */
1545 void
1546 fsetfd(struct filedesc *fdp, struct file *fp, int fd)
1547 {
1548 	spin_lock_wr(&fdp->fd_spin);
1549 	fsetfd_locked(fdp, fp, fd);
1550 	spin_unlock_wr(&fdp->fd_spin);
1551 }
1552 
1553 /*
1554  * MPSAFE (exclusive spinlock must be held on call)
1555  */
1556 static
1557 struct file *
1558 funsetfd_locked(struct filedesc *fdp, int fd)
1559 {
1560 	struct file *fp;
1561 
1562 	if ((unsigned)fd >= fdp->fd_nfiles)
1563 		return (NULL);
1564 	if ((fp = fdp->fd_files[fd].fp) == NULL)
1565 		return (NULL);
1566 	fdp->fd_files[fd].fp = NULL;
1567 	fdp->fd_files[fd].fileflags = 0;
1568 
1569 	fdreserve_locked(fdp, fd, -1);
1570 	fdfixup_locked(fdp, fd);
1571 	return(fp);
1572 }
1573 
1574 /*
1575  * MPSAFE
1576  */
1577 int
1578 fgetfdflags(struct filedesc *fdp, int fd, int *flagsp)
1579 {
1580 	int error;
1581 
1582 	spin_lock_rd(&fdp->fd_spin);
1583 	if (((u_int)fd) >= fdp->fd_nfiles) {
1584 		error = EBADF;
1585 	} else if (fdp->fd_files[fd].fp == NULL) {
1586 		error = EBADF;
1587 	} else {
1588 		*flagsp = fdp->fd_files[fd].fileflags;
1589 		error = 0;
1590 	}
1591 	spin_unlock_rd(&fdp->fd_spin);
1592 	return (error);
1593 }
1594 
1595 /*
1596  * MPSAFE
1597  */
1598 int
1599 fsetfdflags(struct filedesc *fdp, int fd, int add_flags)
1600 {
1601 	int error;
1602 
1603 	spin_lock_wr(&fdp->fd_spin);
1604 	if (((u_int)fd) >= fdp->fd_nfiles) {
1605 		error = EBADF;
1606 	} else if (fdp->fd_files[fd].fp == NULL) {
1607 		error = EBADF;
1608 	} else {
1609 		fdp->fd_files[fd].fileflags |= add_flags;
1610 		error = 0;
1611 	}
1612 	spin_unlock_wr(&fdp->fd_spin);
1613 	return (error);
1614 }
1615 
1616 /*
1617  * MPSAFE
1618  */
1619 int
1620 fclrfdflags(struct filedesc *fdp, int fd, int rem_flags)
1621 {
1622 	int error;
1623 
1624 	spin_lock_wr(&fdp->fd_spin);
1625 	if (((u_int)fd) >= fdp->fd_nfiles) {
1626 		error = EBADF;
1627 	} else if (fdp->fd_files[fd].fp == NULL) {
1628 		error = EBADF;
1629 	} else {
1630 		fdp->fd_files[fd].fileflags &= ~rem_flags;
1631 		error = 0;
1632 	}
1633 	spin_unlock_wr(&fdp->fd_spin);
1634 	return (error);
1635 }
1636 
1637 /*
1638  * Set/Change/Clear the creds for a fp and synchronize the uidinfo.
1639  */
1640 void
1641 fsetcred(struct file *fp, struct ucred *ncr)
1642 {
1643 	struct ucred *ocr;
1644 	struct uidinfo *uip;
1645 
1646 	ocr = fp->f_cred;
1647 	if (ocr == NULL || ncr == NULL || ocr->cr_uidinfo != ncr->cr_uidinfo) {
1648 		if (ocr) {
1649 			uip = ocr->cr_uidinfo;
1650 			atomic_add_int(&uip->ui_openfiles, -1);
1651 		}
1652 		if (ncr) {
1653 			uip = ncr->cr_uidinfo;
1654 			atomic_add_int(&uip->ui_openfiles, 1);
1655 		}
1656 	}
1657 	if (ncr)
1658 		crhold(ncr);
1659 	fp->f_cred = ncr;
1660 	if (ocr)
1661 		crfree(ocr);
1662 }
1663 
1664 /*
1665  * Free a file descriptor.
1666  */
1667 static
1668 void
1669 ffree(struct file *fp)
1670 {
1671 	KASSERT((fp->f_count == 0), ("ffree: fp_fcount not 0!"));
1672 	spin_lock_wr(&filehead_spin);
1673 	LIST_REMOVE(fp, f_list);
1674 	nfiles--;
1675 	spin_unlock_wr(&filehead_spin);
1676 	fsetcred(fp, NULL);
1677 	if (fp->f_nchandle.ncp)
1678 	    cache_drop(&fp->f_nchandle);
1679 	kfree(fp, M_FILE);
1680 }
1681 
1682 /*
1683  * called from init_main, initialize filedesc0 for proc0.
1684  */
1685 void
1686 fdinit_bootstrap(struct proc *p0, struct filedesc *fdp0, int cmask)
1687 {
1688 	p0->p_fd = fdp0;
1689 	p0->p_fdtol = NULL;
1690 	fdp0->fd_refcnt = 1;
1691 	fdp0->fd_cmask = cmask;
1692 	fdp0->fd_files = fdp0->fd_builtin_files;
1693 	fdp0->fd_nfiles = NDFILE;
1694 	fdp0->fd_lastfile = -1;
1695 	spin_init(&fdp0->fd_spin);
1696 }
1697 
1698 /*
1699  * Build a new filedesc structure.
1700  *
1701  * NOT MPSAFE (vref)
1702  */
1703 struct filedesc *
1704 fdinit(struct proc *p)
1705 {
1706 	struct filedesc *newfdp;
1707 	struct filedesc *fdp = p->p_fd;
1708 
1709 	newfdp = kmalloc(sizeof(struct filedesc), M_FILEDESC, M_WAITOK|M_ZERO);
1710 	spin_lock_rd(&fdp->fd_spin);
1711 	if (fdp->fd_cdir) {
1712 		newfdp->fd_cdir = fdp->fd_cdir;
1713 		vref(newfdp->fd_cdir);
1714 		cache_copy(&fdp->fd_ncdir, &newfdp->fd_ncdir);
1715 	}
1716 
1717 	/*
1718 	 * rdir may not be set in e.g. proc0 or anything vm_fork'd off of
1719 	 * proc0, but should unconditionally exist in other processes.
1720 	 */
1721 	if (fdp->fd_rdir) {
1722 		newfdp->fd_rdir = fdp->fd_rdir;
1723 		vref(newfdp->fd_rdir);
1724 		cache_copy(&fdp->fd_nrdir, &newfdp->fd_nrdir);
1725 	}
1726 	if (fdp->fd_jdir) {
1727 		newfdp->fd_jdir = fdp->fd_jdir;
1728 		vref(newfdp->fd_jdir);
1729 		cache_copy(&fdp->fd_njdir, &newfdp->fd_njdir);
1730 	}
1731 	spin_unlock_rd(&fdp->fd_spin);
1732 
1733 	/* Create the file descriptor table. */
1734 	newfdp->fd_refcnt = 1;
1735 	newfdp->fd_cmask = cmask;
1736 	newfdp->fd_files = newfdp->fd_builtin_files;
1737 	newfdp->fd_nfiles = NDFILE;
1738 	newfdp->fd_lastfile = -1;
1739 	spin_init(&newfdp->fd_spin);
1740 
1741 	return (newfdp);
1742 }
1743 
1744 /*
1745  * Share a filedesc structure.
1746  *
1747  * MPSAFE
1748  */
1749 struct filedesc *
1750 fdshare(struct proc *p)
1751 {
1752 	struct filedesc *fdp;
1753 
1754 	fdp = p->p_fd;
1755 	spin_lock_wr(&fdp->fd_spin);
1756 	fdp->fd_refcnt++;
1757 	spin_unlock_wr(&fdp->fd_spin);
1758 	return (fdp);
1759 }
1760 
1761 /*
1762  * Copy a filedesc structure.
1763  *
1764  * MPSAFE
1765  */
1766 struct filedesc *
1767 fdcopy(struct proc *p)
1768 {
1769 	struct filedesc *fdp = p->p_fd;
1770 	struct filedesc *newfdp;
1771 	struct fdnode *fdnode;
1772 	int i;
1773 	int ni;
1774 
1775 	/*
1776 	 * Certain daemons might not have file descriptors.
1777 	 */
1778 	if (fdp == NULL)
1779 		return (NULL);
1780 
1781 	/*
1782 	 * Allocate the new filedesc and fd_files[] array.  This can race
1783 	 * with operations by other threads on the fdp so we have to be
1784 	 * careful.
1785 	 */
1786 	newfdp = kmalloc(sizeof(struct filedesc), M_FILEDESC, M_WAITOK | M_ZERO);
1787 again:
1788 	spin_lock_rd(&fdp->fd_spin);
1789 	if (fdp->fd_lastfile < NDFILE) {
1790 		newfdp->fd_files = newfdp->fd_builtin_files;
1791 		i = NDFILE;
1792 	} else {
1793 		/*
1794 		 * We have to allocate (N^2-1) entries for our in-place
1795 		 * binary tree.  Allow the table to shrink.
1796 		 */
1797 		i = fdp->fd_nfiles;
1798 		ni = (i - 1) / 2;
1799 		while (ni > fdp->fd_lastfile && ni > NDFILE) {
1800 			i = ni;
1801 			ni = (i - 1) / 2;
1802 		}
1803 		spin_unlock_rd(&fdp->fd_spin);
1804 		newfdp->fd_files = kmalloc(i * sizeof(struct fdnode),
1805 					  M_FILEDESC, M_WAITOK | M_ZERO);
1806 
1807 		/*
1808 		 * Check for race, retry
1809 		 */
1810 		spin_lock_rd(&fdp->fd_spin);
1811 		if (i <= fdp->fd_lastfile) {
1812 			spin_unlock_rd(&fdp->fd_spin);
1813 			kfree(newfdp->fd_files, M_FILEDESC);
1814 			goto again;
1815 		}
1816 	}
1817 
1818 	/*
1819 	 * Dup the remaining fields. vref() and cache_hold() can be
1820 	 * safely called while holding the read spinlock on fdp.
1821 	 *
1822 	 * The read spinlock on fdp is still being held.
1823 	 *
1824 	 * NOTE: vref and cache_hold calls for the case where the vnode
1825 	 * or cache entry already has at least one ref may be called
1826 	 * while holding spin locks.
1827 	 */
1828 	if ((newfdp->fd_cdir = fdp->fd_cdir) != NULL) {
1829 		vref(newfdp->fd_cdir);
1830 		cache_copy(&fdp->fd_ncdir, &newfdp->fd_ncdir);
1831 	}
1832 	/*
1833 	 * We must check for fd_rdir here, at least for now because
1834 	 * the init process is created before we have access to the
1835 	 * rootvode to take a reference to it.
1836 	 */
1837 	if ((newfdp->fd_rdir = fdp->fd_rdir) != NULL) {
1838 		vref(newfdp->fd_rdir);
1839 		cache_copy(&fdp->fd_nrdir, &newfdp->fd_nrdir);
1840 	}
1841 	if ((newfdp->fd_jdir = fdp->fd_jdir) != NULL) {
1842 		vref(newfdp->fd_jdir);
1843 		cache_copy(&fdp->fd_njdir, &newfdp->fd_njdir);
1844 	}
1845 	newfdp->fd_refcnt = 1;
1846 	newfdp->fd_nfiles = i;
1847 	newfdp->fd_lastfile = fdp->fd_lastfile;
1848 	newfdp->fd_freefile = fdp->fd_freefile;
1849 	newfdp->fd_cmask = fdp->fd_cmask;
1850 	spin_init(&newfdp->fd_spin);
1851 
1852 	/*
1853 	 * Copy the descriptor table through (i).  This also copies the
1854 	 * allocation state.   Then go through and ref the file pointers
1855 	 * and clean up any KQ descriptors.
1856 	 *
1857 	 * kq descriptors cannot be copied.  Since we haven't ref'd the
1858 	 * copied files yet we can ignore the return value from funsetfd().
1859 	 *
1860 	 * The read spinlock on fdp is still being held.
1861 	 */
1862 	bcopy(fdp->fd_files, newfdp->fd_files, i * sizeof(struct fdnode));
1863 	for (i = 0 ; i < newfdp->fd_nfiles; ++i) {
1864 		fdnode = &newfdp->fd_files[i];
1865 		if (fdnode->reserved) {
1866 			fdreserve_locked(newfdp, i, -1);
1867 			fdnode->reserved = 0;
1868 			fdfixup_locked(newfdp, i);
1869 		} else if (fdnode->fp) {
1870 			if (fdnode->fp->f_type == DTYPE_KQUEUE) {
1871 				(void)funsetfd_locked(newfdp, i);
1872 			} else {
1873 				fhold(fdnode->fp);
1874 			}
1875 		}
1876 	}
1877 	spin_unlock_rd(&fdp->fd_spin);
1878 	return (newfdp);
1879 }
1880 
1881 /*
1882  * Release a filedesc structure.
1883  *
1884  * NOT MPSAFE (MPSAFE for refs > 1, but the final cleanup code is not MPSAFE)
1885  */
1886 void
1887 fdfree(struct proc *p, struct filedesc *repl)
1888 {
1889 	struct filedesc *fdp;
1890 	struct fdnode *fdnode;
1891 	int i;
1892 	struct filedesc_to_leader *fdtol;
1893 	struct file *fp;
1894 	struct vnode *vp;
1895 	struct flock lf;
1896 
1897 	/*
1898 	 * Certain daemons might not have file descriptors.
1899 	 */
1900 	fdp = p->p_fd;
1901 	if (fdp == NULL) {
1902 		p->p_fd = repl;
1903 		return;
1904 	}
1905 
1906 	/*
1907 	 * Severe messing around to follow.
1908 	 */
1909 	spin_lock_wr(&fdp->fd_spin);
1910 
1911 	/* Check for special need to clear POSIX style locks */
1912 	fdtol = p->p_fdtol;
1913 	if (fdtol != NULL) {
1914 		KASSERT(fdtol->fdl_refcount > 0,
1915 			("filedesc_to_refcount botch: fdl_refcount=%d",
1916 			 fdtol->fdl_refcount));
1917 		if (fdtol->fdl_refcount == 1 &&
1918 		    (p->p_leader->p_flag & P_ADVLOCK) != 0) {
1919 			for (i = 0; i <= fdp->fd_lastfile; ++i) {
1920 				fdnode = &fdp->fd_files[i];
1921 				if (fdnode->fp == NULL ||
1922 				    fdnode->fp->f_type != DTYPE_VNODE) {
1923 					continue;
1924 				}
1925 				fp = fdnode->fp;
1926 				fhold(fp);
1927 				spin_unlock_wr(&fdp->fd_spin);
1928 
1929 				lf.l_whence = SEEK_SET;
1930 				lf.l_start = 0;
1931 				lf.l_len = 0;
1932 				lf.l_type = F_UNLCK;
1933 				vp = (struct vnode *)fp->f_data;
1934 				(void) VOP_ADVLOCK(vp,
1935 						   (caddr_t)p->p_leader,
1936 						   F_UNLCK,
1937 						   &lf,
1938 						   F_POSIX);
1939 				fdrop(fp);
1940 				spin_lock_wr(&fdp->fd_spin);
1941 			}
1942 		}
1943 	retry:
1944 		if (fdtol->fdl_refcount == 1) {
1945 			if (fdp->fd_holdleaderscount > 0 &&
1946 			    (p->p_leader->p_flag & P_ADVLOCK) != 0) {
1947 				/*
1948 				 * close() or do_dup() has cleared a reference
1949 				 * in a shared file descriptor table.
1950 				 */
1951 				fdp->fd_holdleaderswakeup = 1;
1952 				ssleep(&fdp->fd_holdleaderscount,
1953 				       &fdp->fd_spin, 0, "fdlhold", 0);
1954 				goto retry;
1955 			}
1956 			if (fdtol->fdl_holdcount > 0) {
1957 				/*
1958 				 * Ensure that fdtol->fdl_leader
1959 				 * remains valid in closef().
1960 				 */
1961 				fdtol->fdl_wakeup = 1;
1962 				ssleep(fdtol, &fdp->fd_spin, 0, "fdlhold", 0);
1963 				goto retry;
1964 			}
1965 		}
1966 		fdtol->fdl_refcount--;
1967 		if (fdtol->fdl_refcount == 0 &&
1968 		    fdtol->fdl_holdcount == 0) {
1969 			fdtol->fdl_next->fdl_prev = fdtol->fdl_prev;
1970 			fdtol->fdl_prev->fdl_next = fdtol->fdl_next;
1971 		} else {
1972 			fdtol = NULL;
1973 		}
1974 		p->p_fdtol = NULL;
1975 		if (fdtol != NULL) {
1976 			spin_unlock_wr(&fdp->fd_spin);
1977 			kfree(fdtol, M_FILEDESC_TO_LEADER);
1978 			spin_lock_wr(&fdp->fd_spin);
1979 		}
1980 	}
1981 	if (--fdp->fd_refcnt > 0) {
1982 		spin_unlock_wr(&fdp->fd_spin);
1983 		spin_lock_wr(&p->p_spin);
1984 		p->p_fd = repl;
1985 		spin_unlock_wr(&p->p_spin);
1986 		return;
1987 	}
1988 
1989 	/*
1990 	 * Even though we are the last reference to the structure allproc
1991 	 * scans may still reference the structure.  Maintain proper
1992 	 * locks until we can replace p->p_fd.
1993 	 *
1994 	 * Also note that kqueue's closef still needs to reference the
1995 	 * fdp via p->p_fd, so we have to close the descriptors before
1996 	 * we replace p->p_fd.
1997 	 */
1998 	for (i = 0; i <= fdp->fd_lastfile; ++i) {
1999 		if (fdp->fd_files[i].fp) {
2000 			fp = funsetfd_locked(fdp, i);
2001 			if (fp) {
2002 				spin_unlock_wr(&fdp->fd_spin);
2003 				if (SLIST_FIRST(&fp->f_klist)) {
2004 					get_mplock();
2005 					knote_fdclose(fp, fdp, i);
2006 					rel_mplock();
2007 				}
2008 				closef(fp, p);
2009 				spin_lock_wr(&fdp->fd_spin);
2010 			}
2011 		}
2012 	}
2013 	spin_unlock_wr(&fdp->fd_spin);
2014 
2015 	/*
2016 	 * Interlock against an allproc scan operations (typically frevoke).
2017 	 */
2018 	spin_lock_wr(&p->p_spin);
2019 	p->p_fd = repl;
2020 	spin_unlock_wr(&p->p_spin);
2021 
2022 	/*
2023 	 * Wait for any softrefs to go away.  This race rarely occurs so
2024 	 * we can use a non-critical-path style poll/sleep loop.  The
2025 	 * race only occurs against allproc scans.
2026 	 *
2027 	 * No new softrefs can occur with the fdp disconnected from the
2028 	 * process.
2029 	 */
2030 	if (fdp->fd_softrefs) {
2031 		kprintf("pid %d: Warning, fdp race avoided\n", p->p_pid);
2032 		while (fdp->fd_softrefs)
2033 			tsleep(&fdp->fd_softrefs, 0, "fdsoft", 1);
2034 	}
2035 
2036 	if (fdp->fd_files != fdp->fd_builtin_files)
2037 		kfree(fdp->fd_files, M_FILEDESC);
2038 	if (fdp->fd_cdir) {
2039 		cache_drop(&fdp->fd_ncdir);
2040 		vrele(fdp->fd_cdir);
2041 	}
2042 	if (fdp->fd_rdir) {
2043 		cache_drop(&fdp->fd_nrdir);
2044 		vrele(fdp->fd_rdir);
2045 	}
2046 	if (fdp->fd_jdir) {
2047 		cache_drop(&fdp->fd_njdir);
2048 		vrele(fdp->fd_jdir);
2049 	}
2050 	kfree(fdp, M_FILEDESC);
2051 }
2052 
2053 /*
2054  * Retrieve and reference the file pointer associated with a descriptor.
2055  *
2056  * MPSAFE
2057  */
2058 struct file *
2059 holdfp(struct filedesc *fdp, int fd, int flag)
2060 {
2061 	struct file* fp;
2062 
2063 	spin_lock_rd(&fdp->fd_spin);
2064 	if (((u_int)fd) >= fdp->fd_nfiles) {
2065 		fp = NULL;
2066 		goto done;
2067 	}
2068 	if ((fp = fdp->fd_files[fd].fp) == NULL)
2069 		goto done;
2070 	if ((fp->f_flag & flag) == 0 && flag != -1) {
2071 		fp = NULL;
2072 		goto done;
2073 	}
2074 	fhold(fp);
2075 done:
2076 	spin_unlock_rd(&fdp->fd_spin);
2077 	return (fp);
2078 }
2079 
2080 /*
2081  * holdsock() - load the struct file pointer associated
2082  * with a socket into *fpp.  If an error occurs, non-zero
2083  * will be returned and *fpp will be set to NULL.
2084  *
2085  * MPSAFE
2086  */
2087 int
2088 holdsock(struct filedesc *fdp, int fd, struct file **fpp)
2089 {
2090 	struct file *fp;
2091 	int error;
2092 
2093 	spin_lock_rd(&fdp->fd_spin);
2094 	if ((unsigned)fd >= fdp->fd_nfiles) {
2095 		error = EBADF;
2096 		fp = NULL;
2097 		goto done;
2098 	}
2099 	if ((fp = fdp->fd_files[fd].fp) == NULL) {
2100 		error = EBADF;
2101 		goto done;
2102 	}
2103 	if (fp->f_type != DTYPE_SOCKET) {
2104 		error = ENOTSOCK;
2105 		goto done;
2106 	}
2107 	fhold(fp);
2108 	error = 0;
2109 done:
2110 	spin_unlock_rd(&fdp->fd_spin);
2111 	*fpp = fp;
2112 	return (error);
2113 }
2114 
2115 /*
2116  * Convert a user file descriptor to a held file pointer.
2117  *
2118  * MPSAFE
2119  */
2120 int
2121 holdvnode(struct filedesc *fdp, int fd, struct file **fpp)
2122 {
2123 	struct file *fp;
2124 	int error;
2125 
2126 	spin_lock_rd(&fdp->fd_spin);
2127 	if ((unsigned)fd >= fdp->fd_nfiles) {
2128 		error = EBADF;
2129 		fp = NULL;
2130 		goto done;
2131 	}
2132 	if ((fp = fdp->fd_files[fd].fp) == NULL) {
2133 		error = EBADF;
2134 		goto done;
2135 	}
2136 	if (fp->f_type != DTYPE_VNODE && fp->f_type != DTYPE_FIFO) {
2137 		fp = NULL;
2138 		error = EINVAL;
2139 		goto done;
2140 	}
2141 	fhold(fp);
2142 	error = 0;
2143 done:
2144 	spin_unlock_rd(&fdp->fd_spin);
2145 	*fpp = fp;
2146 	return (error);
2147 }
2148 
2149 /*
2150  * For setugid programs, we don't want to people to use that setugidness
2151  * to generate error messages which write to a file which otherwise would
2152  * otherwise be off-limits to the process.
2153  *
2154  * This is a gross hack to plug the hole.  A better solution would involve
2155  * a special vop or other form of generalized access control mechanism.  We
2156  * go ahead and just reject all procfs file systems accesses as dangerous.
2157  *
2158  * Since setugidsafety calls this only for fd 0, 1 and 2, this check is
2159  * sufficient.  We also don't for check setugidness since we know we are.
2160  */
2161 static int
2162 is_unsafe(struct file *fp)
2163 {
2164 	if (fp->f_type == DTYPE_VNODE &&
2165 	    ((struct vnode *)(fp->f_data))->v_tag == VT_PROCFS)
2166 		return (1);
2167 	return (0);
2168 }
2169 
2170 /*
2171  * Make this setguid thing safe, if at all possible.
2172  *
2173  * NOT MPSAFE - scans fdp without spinlocks, calls knote_fdclose()
2174  */
2175 void
2176 setugidsafety(struct proc *p)
2177 {
2178 	struct filedesc *fdp = p->p_fd;
2179 	int i;
2180 
2181 	/* Certain daemons might not have file descriptors. */
2182 	if (fdp == NULL)
2183 		return;
2184 
2185 	/*
2186 	 * note: fdp->fd_files may be reallocated out from under us while
2187 	 * we are blocked in a close.  Be careful!
2188 	 */
2189 	for (i = 0; i <= fdp->fd_lastfile; i++) {
2190 		if (i > 2)
2191 			break;
2192 		if (fdp->fd_files[i].fp && is_unsafe(fdp->fd_files[i].fp)) {
2193 			struct file *fp;
2194 
2195 			/*
2196 			 * NULL-out descriptor prior to close to avoid
2197 			 * a race while close blocks.
2198 			 */
2199 			if ((fp = funsetfd_locked(fdp, i)) != NULL) {
2200 				knote_fdclose(fp, fdp, i);
2201 				closef(fp, p);
2202 			}
2203 		}
2204 	}
2205 }
2206 
2207 /*
2208  * Close any files on exec?
2209  *
2210  * NOT MPSAFE - scans fdp without spinlocks, calls knote_fdclose()
2211  */
2212 void
2213 fdcloseexec(struct proc *p)
2214 {
2215 	struct filedesc *fdp = p->p_fd;
2216 	int i;
2217 
2218 	/* Certain daemons might not have file descriptors. */
2219 	if (fdp == NULL)
2220 		return;
2221 
2222 	/*
2223 	 * We cannot cache fd_files since operations may block and rip
2224 	 * them out from under us.
2225 	 */
2226 	for (i = 0; i <= fdp->fd_lastfile; i++) {
2227 		if (fdp->fd_files[i].fp != NULL &&
2228 		    (fdp->fd_files[i].fileflags & UF_EXCLOSE)) {
2229 			struct file *fp;
2230 
2231 			/*
2232 			 * NULL-out descriptor prior to close to avoid
2233 			 * a race while close blocks.
2234 			 */
2235 			if ((fp = funsetfd_locked(fdp, i)) != NULL) {
2236 				knote_fdclose(fp, fdp, i);
2237 				closef(fp, p);
2238 			}
2239 		}
2240 	}
2241 }
2242 
2243 /*
2244  * It is unsafe for set[ug]id processes to be started with file
2245  * descriptors 0..2 closed, as these descriptors are given implicit
2246  * significance in the Standard C library.  fdcheckstd() will create a
2247  * descriptor referencing /dev/null for each of stdin, stdout, and
2248  * stderr that is not already open.
2249  *
2250  * NOT MPSAFE - calls falloc, vn_open, etc
2251  */
2252 int
2253 fdcheckstd(struct lwp *lp)
2254 {
2255 	struct nlookupdata nd;
2256 	struct filedesc *fdp;
2257 	struct file *fp;
2258 	int retval;
2259 	int i, error, flags, devnull;
2260 
2261 	fdp = lp->lwp_proc->p_fd;
2262 	if (fdp == NULL)
2263 		return (0);
2264 	devnull = -1;
2265 	error = 0;
2266 	for (i = 0; i < 3; i++) {
2267 		if (fdp->fd_files[i].fp != NULL)
2268 			continue;
2269 		if (devnull < 0) {
2270 			if ((error = falloc(lp, &fp, &devnull)) != 0)
2271 				break;
2272 
2273 			error = nlookup_init(&nd, "/dev/null", UIO_SYSSPACE,
2274 						NLC_FOLLOW|NLC_LOCKVP);
2275 			flags = FREAD | FWRITE;
2276 			if (error == 0)
2277 				error = vn_open(&nd, fp, flags, 0);
2278 			if (error == 0)
2279 				fsetfd(fdp, fp, devnull);
2280 			else
2281 				fsetfd(fdp, NULL, devnull);
2282 			fdrop(fp);
2283 			nlookup_done(&nd);
2284 			if (error)
2285 				break;
2286 			KKASSERT(i == devnull);
2287 		} else {
2288 			error = kern_dup(DUP_FIXED, devnull, i, &retval);
2289 			if (error != 0)
2290 				break;
2291 		}
2292 	}
2293 	return (error);
2294 }
2295 
2296 /*
2297  * Internal form of close.
2298  * Decrement reference count on file structure.
2299  * Note: td and/or p may be NULL when closing a file
2300  * that was being passed in a message.
2301  *
2302  * MPALMOSTSAFE - acquires mplock for VOP operations
2303  */
2304 int
2305 closef(struct file *fp, struct proc *p)
2306 {
2307 	struct vnode *vp;
2308 	struct flock lf;
2309 	struct filedesc_to_leader *fdtol;
2310 
2311 	if (fp == NULL)
2312 		return (0);
2313 
2314 	/*
2315 	 * POSIX record locking dictates that any close releases ALL
2316 	 * locks owned by this process.  This is handled by setting
2317 	 * a flag in the unlock to free ONLY locks obeying POSIX
2318 	 * semantics, and not to free BSD-style file locks.
2319 	 * If the descriptor was in a message, POSIX-style locks
2320 	 * aren't passed with the descriptor.
2321 	 */
2322 	if (p != NULL && fp->f_type == DTYPE_VNODE &&
2323 	    (((struct vnode *)fp->f_data)->v_flag & VMAYHAVELOCKS)
2324 	) {
2325 		get_mplock();
2326 		if ((p->p_leader->p_flag & P_ADVLOCK) != 0) {
2327 			lf.l_whence = SEEK_SET;
2328 			lf.l_start = 0;
2329 			lf.l_len = 0;
2330 			lf.l_type = F_UNLCK;
2331 			vp = (struct vnode *)fp->f_data;
2332 			(void) VOP_ADVLOCK(vp, (caddr_t)p->p_leader, F_UNLCK,
2333 					   &lf, F_POSIX);
2334 		}
2335 		fdtol = p->p_fdtol;
2336 		if (fdtol != NULL) {
2337 			/*
2338 			 * Handle special case where file descriptor table
2339 			 * is shared between multiple process leaders.
2340 			 */
2341 			for (fdtol = fdtol->fdl_next;
2342 			     fdtol != p->p_fdtol;
2343 			     fdtol = fdtol->fdl_next) {
2344 				if ((fdtol->fdl_leader->p_flag &
2345 				     P_ADVLOCK) == 0)
2346 					continue;
2347 				fdtol->fdl_holdcount++;
2348 				lf.l_whence = SEEK_SET;
2349 				lf.l_start = 0;
2350 				lf.l_len = 0;
2351 				lf.l_type = F_UNLCK;
2352 				vp = (struct vnode *)fp->f_data;
2353 				(void) VOP_ADVLOCK(vp,
2354 						   (caddr_t)fdtol->fdl_leader,
2355 						   F_UNLCK, &lf, F_POSIX);
2356 				fdtol->fdl_holdcount--;
2357 				if (fdtol->fdl_holdcount == 0 &&
2358 				    fdtol->fdl_wakeup != 0) {
2359 					fdtol->fdl_wakeup = 0;
2360 					wakeup(fdtol);
2361 				}
2362 			}
2363 		}
2364 		rel_mplock();
2365 	}
2366 	return (fdrop(fp));
2367 }
2368 
2369 /*
2370  * MPSAFE
2371  *
2372  * fhold() can only be called if f_count is already at least 1 (i.e. the
2373  * caller of fhold() already has a reference to the file pointer in some
2374  * manner or other).
2375  *
2376  * f_count is not spin-locked.  Instead, atomic ops are used for
2377  * incrementing, decrementing, and handling the 1->0 transition.
2378  */
2379 void
2380 fhold(struct file *fp)
2381 {
2382 	atomic_add_int(&fp->f_count, 1);
2383 }
2384 
2385 /*
2386  * fdrop() - drop a reference to a descriptor
2387  *
2388  * MPALMOSTSAFE - acquires mplock for final close sequence
2389  */
2390 int
2391 fdrop(struct file *fp)
2392 {
2393 	struct flock lf;
2394 	struct vnode *vp;
2395 	int error;
2396 
2397 	/*
2398 	 * A combined fetch and subtract is needed to properly detect
2399 	 * 1->0 transitions, otherwise two cpus dropping from a ref
2400 	 * count of 2 might both try to run the 1->0 code.
2401 	 */
2402 	if (atomic_fetchadd_int(&fp->f_count, -1) > 1)
2403 		return (0);
2404 
2405 	KKASSERT(SLIST_FIRST(&fp->f_klist) == NULL);
2406 	get_mplock();
2407 
2408 	/*
2409 	 * The last reference has gone away, we own the fp structure free
2410 	 * and clear.
2411 	 */
2412 	if (fp->f_count < 0)
2413 		panic("fdrop: count < 0");
2414 	if ((fp->f_flag & FHASLOCK) && fp->f_type == DTYPE_VNODE &&
2415 	    (((struct vnode *)fp->f_data)->v_flag & VMAYHAVELOCKS)
2416 	) {
2417 		lf.l_whence = SEEK_SET;
2418 		lf.l_start = 0;
2419 		lf.l_len = 0;
2420 		lf.l_type = F_UNLCK;
2421 		vp = (struct vnode *)fp->f_data;
2422 		(void) VOP_ADVLOCK(vp, (caddr_t)fp, F_UNLCK, &lf, 0);
2423 	}
2424 	if (fp->f_ops != &badfileops)
2425 		error = fo_close(fp);
2426 	else
2427 		error = 0;
2428 	ffree(fp);
2429 	rel_mplock();
2430 	return (error);
2431 }
2432 
2433 /*
2434  * Apply an advisory lock on a file descriptor.
2435  *
2436  * Just attempt to get a record lock of the requested type on
2437  * the entire file (l_whence = SEEK_SET, l_start = 0, l_len = 0).
2438  *
2439  * MPALMOSTSAFE
2440  */
2441 int
2442 sys_flock(struct flock_args *uap)
2443 {
2444 	struct proc *p = curproc;
2445 	struct file *fp;
2446 	struct vnode *vp;
2447 	struct flock lf;
2448 	int error;
2449 
2450 	if ((fp = holdfp(p->p_fd, uap->fd, -1)) == NULL)
2451 		return (EBADF);
2452 	get_mplock();
2453 	if (fp->f_type != DTYPE_VNODE) {
2454 		error = EOPNOTSUPP;
2455 		goto done;
2456 	}
2457 	vp = (struct vnode *)fp->f_data;
2458 	lf.l_whence = SEEK_SET;
2459 	lf.l_start = 0;
2460 	lf.l_len = 0;
2461 	if (uap->how & LOCK_UN) {
2462 		lf.l_type = F_UNLCK;
2463 		fp->f_flag &= ~FHASLOCK;
2464 		error = VOP_ADVLOCK(vp, (caddr_t)fp, F_UNLCK, &lf, 0);
2465 		goto done;
2466 	}
2467 	if (uap->how & LOCK_EX)
2468 		lf.l_type = F_WRLCK;
2469 	else if (uap->how & LOCK_SH)
2470 		lf.l_type = F_RDLCK;
2471 	else {
2472 		error = EBADF;
2473 		goto done;
2474 	}
2475 	fp->f_flag |= FHASLOCK;
2476 	if (uap->how & LOCK_NB)
2477 		error = VOP_ADVLOCK(vp, (caddr_t)fp, F_SETLK, &lf, 0);
2478 	else
2479 		error = VOP_ADVLOCK(vp, (caddr_t)fp, F_SETLK, &lf, F_WAIT);
2480 done:
2481 	rel_mplock();
2482 	fdrop(fp);
2483 	return (error);
2484 }
2485 
2486 /*
2487  * File Descriptor pseudo-device driver (/dev/fd/).
2488  *
2489  * Opening minor device N dup()s the file (if any) connected to file
2490  * descriptor N belonging to the calling process.  Note that this driver
2491  * consists of only the ``open()'' routine, because all subsequent
2492  * references to this file will be direct to the other driver.
2493  */
2494 static int
2495 fdopen(struct dev_open_args *ap)
2496 {
2497 	thread_t td = curthread;
2498 
2499 	KKASSERT(td->td_lwp != NULL);
2500 
2501 	/*
2502 	 * XXX Kludge: set curlwp->lwp_dupfd to contain the value of the
2503 	 * the file descriptor being sought for duplication. The error
2504 	 * return ensures that the vnode for this device will be released
2505 	 * by vn_open. Open will detect this special error and take the
2506 	 * actions in dupfdopen below. Other callers of vn_open or VOP_OPEN
2507 	 * will simply report the error.
2508 	 */
2509 	td->td_lwp->lwp_dupfd = minor(ap->a_head.a_dev);
2510 	return (ENODEV);
2511 }
2512 
2513 /*
2514  * The caller has reserved the file descriptor dfd for us.  On success we
2515  * must fsetfd() it.  On failure the caller will clean it up.
2516  *
2517  * MPSAFE
2518  */
2519 int
2520 dupfdopen(struct filedesc *fdp, int dfd, int sfd, int mode, int error)
2521 {
2522 	struct file *wfp;
2523 	struct file *xfp;
2524 	int werror;
2525 
2526 	if ((wfp = holdfp(fdp, sfd, -1)) == NULL)
2527 		return (EBADF);
2528 
2529 	/*
2530 	 * Close a revoke/dup race.  Duping a descriptor marked as revoked
2531 	 * will dup a dummy descriptor instead of the real one.
2532 	 */
2533 	if (wfp->f_flag & FREVOKED) {
2534 		kprintf("Warning: attempt to dup() a revoked descriptor\n");
2535 		fdrop(wfp);
2536 		wfp = NULL;
2537 		werror = falloc(NULL, &wfp, NULL);
2538 		if (werror)
2539 			return (werror);
2540 	}
2541 
2542 	/*
2543 	 * There are two cases of interest here.
2544 	 *
2545 	 * For ENODEV simply dup sfd to file descriptor dfd and return.
2546 	 *
2547 	 * For ENXIO steal away the file structure from sfd and store it
2548 	 * dfd.  sfd is effectively closed by this operation.
2549 	 *
2550 	 * Any other error code is just returned.
2551 	 */
2552 	switch (error) {
2553 	case ENODEV:
2554 		/*
2555 		 * Check that the mode the file is being opened for is a
2556 		 * subset of the mode of the existing descriptor.
2557 		 */
2558 		if (((mode & (FREAD|FWRITE)) | wfp->f_flag) != wfp->f_flag) {
2559 			error = EACCES;
2560 			break;
2561 		}
2562 		spin_lock_wr(&fdp->fd_spin);
2563 		fdp->fd_files[dfd].fileflags = fdp->fd_files[sfd].fileflags;
2564 		fsetfd_locked(fdp, wfp, dfd);
2565 		spin_unlock_wr(&fdp->fd_spin);
2566 		error = 0;
2567 		break;
2568 	case ENXIO:
2569 		/*
2570 		 * Steal away the file pointer from dfd, and stuff it into indx.
2571 		 */
2572 		spin_lock_wr(&fdp->fd_spin);
2573 		fdp->fd_files[dfd].fileflags = fdp->fd_files[sfd].fileflags;
2574 		fsetfd(fdp, wfp, dfd);
2575 		if ((xfp = funsetfd_locked(fdp, sfd)) != NULL) {
2576 			spin_unlock_wr(&fdp->fd_spin);
2577 			fdrop(xfp);
2578 		} else {
2579 			spin_unlock_wr(&fdp->fd_spin);
2580 		}
2581 		error = 0;
2582 		break;
2583 	default:
2584 		break;
2585 	}
2586 	fdrop(wfp);
2587 	return (error);
2588 }
2589 
2590 /*
2591  * NOT MPSAFE - I think these refer to a common file descriptor table
2592  * and we need to spinlock that to link fdtol in.
2593  */
2594 struct filedesc_to_leader *
2595 filedesc_to_leader_alloc(struct filedesc_to_leader *old,
2596 			 struct proc *leader)
2597 {
2598 	struct filedesc_to_leader *fdtol;
2599 
2600 	fdtol = kmalloc(sizeof(struct filedesc_to_leader),
2601 			M_FILEDESC_TO_LEADER, M_WAITOK);
2602 	fdtol->fdl_refcount = 1;
2603 	fdtol->fdl_holdcount = 0;
2604 	fdtol->fdl_wakeup = 0;
2605 	fdtol->fdl_leader = leader;
2606 	if (old != NULL) {
2607 		fdtol->fdl_next = old->fdl_next;
2608 		fdtol->fdl_prev = old;
2609 		old->fdl_next = fdtol;
2610 		fdtol->fdl_next->fdl_prev = fdtol;
2611 	} else {
2612 		fdtol->fdl_next = fdtol;
2613 		fdtol->fdl_prev = fdtol;
2614 	}
2615 	return fdtol;
2616 }
2617 
2618 /*
2619  * Scan all file pointers in the system.  The callback is made with
2620  * the master list spinlock held exclusively.
2621  *
2622  * MPSAFE
2623  */
2624 void
2625 allfiles_scan_exclusive(int (*callback)(struct file *, void *), void *data)
2626 {
2627 	struct file *fp;
2628 	int res;
2629 
2630 	spin_lock_wr(&filehead_spin);
2631 	LIST_FOREACH(fp, &filehead, f_list) {
2632 		res = callback(fp, data);
2633 		if (res < 0)
2634 			break;
2635 	}
2636 	spin_unlock_wr(&filehead_spin);
2637 }
2638 
2639 /*
2640  * Get file structures.
2641  *
2642  * NOT MPSAFE - process list scan, SYSCTL_OUT (probably not mpsafe)
2643  */
2644 
2645 struct sysctl_kern_file_info {
2646 	int count;
2647 	int error;
2648 	struct sysctl_req *req;
2649 };
2650 
2651 static int sysctl_kern_file_callback(struct proc *p, void *data);
2652 
2653 static int
2654 sysctl_kern_file(SYSCTL_HANDLER_ARGS)
2655 {
2656 	struct sysctl_kern_file_info info;
2657 
2658 	/*
2659 	 * Note: because the number of file descriptors is calculated
2660 	 * in different ways for sizing vs returning the data,
2661 	 * there is information leakage from the first loop.  However,
2662 	 * it is of a similar order of magnitude to the leakage from
2663 	 * global system statistics such as kern.openfiles.
2664 	 *
2665 	 * When just doing a count, note that we cannot just count
2666 	 * the elements and add f_count via the filehead list because
2667 	 * threaded processes share their descriptor table and f_count might
2668 	 * still be '1' in that case.
2669 	 *
2670 	 * Since the SYSCTL op can block, we must hold the process to
2671 	 * prevent it being ripped out from under us either in the
2672 	 * file descriptor loop or in the greater LIST_FOREACH.  The
2673 	 * process may be in varying states of disrepair.  If the process
2674 	 * is in SZOMB we may have caught it just as it is being removed
2675 	 * from the allproc list, we must skip it in that case to maintain
2676 	 * an unbroken chain through the allproc list.
2677 	 */
2678 	info.count = 0;
2679 	info.error = 0;
2680 	info.req = req;
2681 	allproc_scan(sysctl_kern_file_callback, &info);
2682 
2683 	/*
2684 	 * When just calculating the size, overestimate a bit to try to
2685 	 * prevent system activity from causing the buffer-fill call
2686 	 * to fail later on.
2687 	 */
2688 	if (req->oldptr == NULL) {
2689 		info.count = (info.count + 16) + (info.count / 10);
2690 		info.error = SYSCTL_OUT(req, NULL,
2691 					info.count * sizeof(struct kinfo_file));
2692 	}
2693 	return (info.error);
2694 }
2695 
2696 static int
2697 sysctl_kern_file_callback(struct proc *p, void *data)
2698 {
2699 	struct sysctl_kern_file_info *info = data;
2700 	struct kinfo_file kf;
2701 	struct filedesc *fdp;
2702 	struct file *fp;
2703 	uid_t uid;
2704 	int n;
2705 
2706 	if (p->p_stat == SIDL || p->p_stat == SZOMB)
2707 		return(0);
2708 	if (!PRISON_CHECK(info->req->td->td_ucred, p->p_ucred) != 0)
2709 		return(0);
2710 
2711 	/*
2712 	 * Softref the fdp to prevent it from being destroyed
2713 	 */
2714 	spin_lock_wr(&p->p_spin);
2715 	if ((fdp = p->p_fd) == NULL) {
2716 		spin_unlock_wr(&p->p_spin);
2717 		return(0);
2718 	}
2719 	atomic_add_int(&fdp->fd_softrefs, 1);
2720 	spin_unlock_wr(&p->p_spin);
2721 
2722 	/*
2723 	 * The fdp's own spinlock prevents the contents from being
2724 	 * modified.
2725 	 */
2726 	spin_lock_rd(&fdp->fd_spin);
2727 	for (n = 0; n < fdp->fd_nfiles; ++n) {
2728 		if ((fp = fdp->fd_files[n].fp) == NULL)
2729 			continue;
2730 		if (info->req->oldptr == NULL) {
2731 			++info->count;
2732 		} else {
2733 			uid = p->p_ucred ? p->p_ucred->cr_uid : -1;
2734 			kcore_make_file(&kf, fp, p->p_pid, uid, n);
2735 			spin_unlock_rd(&fdp->fd_spin);
2736 			info->error = SYSCTL_OUT(info->req, &kf, sizeof(kf));
2737 			spin_lock_rd(&fdp->fd_spin);
2738 			if (info->error)
2739 				break;
2740 		}
2741 	}
2742 	spin_unlock_rd(&fdp->fd_spin);
2743 	atomic_subtract_int(&fdp->fd_softrefs, 1);
2744 	if (info->error)
2745 		return(-1);
2746 	return(0);
2747 }
2748 
2749 SYSCTL_PROC(_kern, KERN_FILE, file, CTLTYPE_OPAQUE|CTLFLAG_RD,
2750     0, 0, sysctl_kern_file, "S,file", "Entire file table");
2751 
2752 SYSCTL_INT(_kern, OID_AUTO, minfilesperproc, CTLFLAG_RW,
2753     &minfilesperproc, 0, "Minimum files allowed open per process");
2754 SYSCTL_INT(_kern, KERN_MAXFILESPERPROC, maxfilesperproc, CTLFLAG_RW,
2755     &maxfilesperproc, 0, "Maximum files allowed open per process");
2756 SYSCTL_INT(_kern, OID_AUTO, maxfilesperuser, CTLFLAG_RW,
2757     &maxfilesperuser, 0, "Maximum files allowed open per user");
2758 
2759 SYSCTL_INT(_kern, KERN_MAXFILES, maxfiles, CTLFLAG_RW,
2760     &maxfiles, 0, "Maximum number of files");
2761 
2762 SYSCTL_INT(_kern, OID_AUTO, maxfilesrootres, CTLFLAG_RW,
2763     &maxfilesrootres, 0, "Descriptors reserved for root use");
2764 
2765 SYSCTL_INT(_kern, OID_AUTO, openfiles, CTLFLAG_RD,
2766 	&nfiles, 0, "System-wide number of open files");
2767 
2768 static void
2769 fildesc_drvinit(void *unused)
2770 {
2771 	int fd;
2772 
2773 	for (fd = 0; fd < NUMFDESC; fd++) {
2774 		make_dev(&fildesc_ops, fd,
2775 			 UID_BIN, GID_BIN, 0666, "fd/%d", fd);
2776 	}
2777 
2778 	make_dev(&fildesc_ops, 0, UID_ROOT, GID_WHEEL, 0666, "stdin");
2779 	make_dev(&fildesc_ops, 1, UID_ROOT, GID_WHEEL, 0666, "stdout");
2780 	make_dev(&fildesc_ops, 2, UID_ROOT, GID_WHEEL, 0666, "stderr");
2781 }
2782 
2783 /*
2784  * MPSAFE
2785  */
2786 struct fileops badfileops = {
2787 	.fo_read = badfo_readwrite,
2788 	.fo_write = badfo_readwrite,
2789 	.fo_ioctl = badfo_ioctl,
2790 	.fo_poll = badfo_poll,
2791 	.fo_kqfilter = badfo_kqfilter,
2792 	.fo_stat = badfo_stat,
2793 	.fo_close = badfo_close,
2794 	.fo_shutdown = badfo_shutdown
2795 };
2796 
2797 /*
2798  * MPSAFE
2799  */
2800 int
2801 badfo_readwrite(
2802 	struct file *fp,
2803 	struct uio *uio,
2804 	struct ucred *cred,
2805 	int flags
2806 ) {
2807 	return (EBADF);
2808 }
2809 
2810 /*
2811  * MPSAFE
2812  */
2813 int
2814 badfo_ioctl(struct file *fp, u_long com, caddr_t data,
2815 	    struct ucred *cred, struct sysmsg *msgv)
2816 {
2817 	return (EBADF);
2818 }
2819 
2820 /*
2821  * MPSAFE
2822  */
2823 int
2824 badfo_poll(struct file *fp, int events, struct ucred *cred)
2825 {
2826 	return (0);
2827 }
2828 
2829 /*
2830  * MPSAFE
2831  */
2832 int
2833 badfo_kqfilter(struct file *fp, struct knote *kn)
2834 {
2835 	return (0);
2836 }
2837 
2838 int
2839 badfo_stat(struct file *fp, struct stat *sb, struct ucred *cred)
2840 {
2841 	return (EBADF);
2842 }
2843 
2844 /*
2845  * MPSAFE
2846  */
2847 int
2848 badfo_close(struct file *fp)
2849 {
2850 	return (EBADF);
2851 }
2852 
2853 /*
2854  * MPSAFE
2855  */
2856 int
2857 badfo_shutdown(struct file *fp, int how)
2858 {
2859 	return (EBADF);
2860 }
2861 
2862 /*
2863  * MPSAFE
2864  */
2865 int
2866 nofo_shutdown(struct file *fp, int how)
2867 {
2868 	return (EOPNOTSUPP);
2869 }
2870 
2871 SYSINIT(fildescdev,SI_SUB_DRIVERS,SI_ORDER_MIDDLE+CDEV_MAJOR,
2872 					fildesc_drvinit,NULL)
2873