This is what was "fdfix2.patch," a fix for fd sharing. It's pretty

far-reaching in fd-land, so you'll want to consult the code for
changes.  The biggest change is that now, you don't use
	fp->f_ops->fo_foo(fp, bar)
but instead
	fo_foo(fp, bar),
which increments and decrements the fp refcount upon entry and exit.
Two new calls, fhold() and fdrop(), are provided.  Each does what it
seems like it should, and if fdrop() brings the refcount to zero, the
fd is freed as well.

Thanks to peter ("to hell with it, it looks ok to me.") for his review.
Thanks to msmith for keeping me from putting locks everywhere :)

Reviewed by:	peter

8 files changed, 41 insertions, 55 deletions

diff --git a/sys/compat/linux/linux_file.c b/sys/compat/linux/linux_file.c
index 66e9312..6a33e68 100644
--- a/sys/compat/linux/linux_file.c
+++ b/sys/compat/linux/linux_file.c
@@ -128,7 +128,7 @@ linux_open(struct proc *p, struct linux_open_args *args)
 	struct file *fp = fdp->fd_ofiles[p->p_retval[0]];
 
 	if (fp->f_type == DTYPE_VNODE)
-	    (fp->f_ops->fo_ioctl)(fp, TIOCSCTTY, (caddr_t) 0, p);
+	    fo_ioctl(fp, TIOCSCTTY, (caddr_t) 0, p);
     }
 #ifdef DEBUG
     printf("Linux-emul(%d): open returns error %d\n", 
diff --git a/sys/compat/linux/linux_ioctl.c b/sys/compat/linux/linux_ioctl.c
index 8507ade..d071bcd 100644
--- a/sys/compat/linux/linux_ioctl.c
+++ b/sys/compat/linux/linux_ioctl.c
@@ -539,7 +539,6 @@ linux_ioctl(struct proc *p, struct linux_ioctl_args *args)
     struct linux_termio linux_termio;
     struct filedesc *fdp = p->p_fd;
     struct file *fp;
-    int (*func)(struct file *fp, u_long com, caddr_t data, struct proc *p);
     int bsd_line, linux_line;
     int error;
 
@@ -555,11 +554,10 @@ linux_ioctl(struct proc *p, struct linux_ioctl_args *args)
 	return EBADF;
     }
 
-    func = fp->f_ops->fo_ioctl;
     switch (args->cmd & 0xffff) {
 
     case LINUX_TCGETA:
-	if ((error = (*func)(fp, TIOCGETA, (caddr_t)&bsd_termios, p)) != 0)
+	if ((error = fo_ioctl(fp, TIOCGETA, (caddr_t)&bsd_termios, p)) != 0)
 	    return error;
 	bsd_to_linux_termio(&bsd_termios, &linux_termio);
 	return copyout((caddr_t)&linux_termio, (caddr_t)args->arg,
@@ -570,24 +568,24 @@ linux_ioctl(struct proc *p, struct linux_ioctl_args *args)
 	if (error)
 	    return error;
 	linux_to_bsd_termio(&linux_termio, &bsd_termios);
-	return (*func)(fp, TIOCSETA, (caddr_t)&bsd_termios, p);
+	return fo_ioctl(fp, TIOCSETA, (caddr_t)&bsd_termios, p);
 
     case LINUX_TCSETAW:
 	error = copyin((caddr_t)args->arg, &linux_termio, sizeof(linux_termio));
 	if (error)
 	    return error;
 	linux_to_bsd_termio(&linux_termio, &bsd_termios);
-	return (*func)(fp, TIOCSETAW, (caddr_t)&bsd_termios, p);
+	return fo_ioctl(fp, TIOCSETAW, (caddr_t)&bsd_termios, p);
 
     case LINUX_TCSETAF:
 	error = copyin((caddr_t)args->arg, &linux_termio, sizeof(linux_termio));
 	if (error)
 	    return error;
 	linux_to_bsd_termio(&linux_termio, &bsd_termios);
-	return (*func)(fp, TIOCSETAF, (caddr_t)&bsd_termios, p);
+	return fo_ioctl(fp, TIOCSETAF, (caddr_t)&bsd_termios, p);
 
     case LINUX_TCGETS:
-	if ((error = (*func)(fp, TIOCGETA, (caddr_t)&bsd_termios, p)) != 0)
+	if ((error = fo_ioctl(fp, TIOCGETA, (caddr_t)&bsd_termios, p)) != 0)
 	    return error;
 	bsd_to_linux_termios(&bsd_termios, &linux_termios);
 	return copyout((caddr_t)&linux_termios, (caddr_t)args->arg,
@@ -599,7 +597,7 @@ linux_ioctl(struct proc *p, struct linux_ioctl_args *args)
 	if (error)
 	    return error;
 	linux_to_bsd_termios(&linux_termios, &bsd_termios);
-	return (*func)(fp, TIOCSETA, (caddr_t)&bsd_termios, p);
+	return fo_ioctl(fp, TIOCSETA, (caddr_t)&bsd_termios, p);
 
     case LINUX_TCSETSW:
 	error = copyin((caddr_t)args->arg, &linux_termios,
@@ -607,7 +605,7 @@ linux_ioctl(struct proc *p, struct linux_ioctl_args *args)
 	if (error)
 	    return error;
 	linux_to_bsd_termios(&linux_termios, &bsd_termios);
-	return (*func)(fp, TIOCSETAW, (caddr_t)&bsd_termios, p);
+	return fo_ioctl(fp, TIOCSETAW, (caddr_t)&bsd_termios, p);
 
     case LINUX_TCSETSF:
 	error = copyin((caddr_t)args->arg, &linux_termios,
@@ -615,7 +613,7 @@ linux_ioctl(struct proc *p, struct linux_ioctl_args *args)
 	if (error)
 	    return error;
 	linux_to_bsd_termios(&linux_termios, &bsd_termios);
-	return (*func)(fp, TIOCSETAF, (caddr_t)&bsd_termios, p);
+	return fo_ioctl(fp, TIOCSETAF, (caddr_t)&bsd_termios, p);
 	    
     case LINUX_TIOCGPGRP:
 	args->cmd = TIOCGPGRP;
@@ -773,20 +771,20 @@ linux_ioctl(struct proc *p, struct linux_ioctl_args *args)
 	switch (args->arg) {
 	case LINUX_N_TTY:
 	    bsd_line = TTYDISC;
-	    return (*func)(fp, TIOCSETD, (caddr_t)&bsd_line, p);
+	    return fo_ioctl(fp, TIOCSETD, (caddr_t)&bsd_line, p);
 	case LINUX_N_SLIP:
 	    bsd_line = SLIPDISC;
-	    return (*func)(fp, TIOCSETD, (caddr_t)&bsd_line, p);
+	    return fo_ioctl(fp, TIOCSETD, (caddr_t)&bsd_line, p);
 	case LINUX_N_PPP:
 	    bsd_line = PPPDISC;
-	    return (*func)(fp, TIOCSETD, (caddr_t)&bsd_line, p);
+	    return fo_ioctl(fp, TIOCSETD, (caddr_t)&bsd_line, p);
 	default:
 	    return EINVAL;
 	}
 
     case LINUX_TIOCGETD:
 	bsd_line = TTYDISC;
-	error =(*func)(fp, TIOCGETD, (caddr_t)&bsd_line, p);
+	error = fo_ioctl(fp, TIOCGETD, (caddr_t)&bsd_line, p);
 	if (error)
 	    return error;
 	switch (bsd_line) {
@@ -1048,7 +1046,7 @@ linux_ioctl(struct proc *p, struct linux_ioctl_args *args)
       case LINUX_TCION: {
 	      u_char c;
 	      struct write_args wr;
-	      error = (*func)(fp, TIOCGETA, (caddr_t)&bsd_termios, p);
+	      error = fo_ioctl(fp, TIOCGETA, (caddr_t)&bsd_termios, p);
               if (error != 0)
 		      return error;
 	      c = bsd_termios.c_cc[args->arg == LINUX_TCIOFF ? VSTOP : VSTART];
@@ -1135,13 +1133,13 @@ linux_ioctl(struct proc *p, struct linux_ioctl_args *args)
 	switch (args->arg) {
 	case LINUX_KBD_RAW:
 	    kbdmode = K_RAW;
-	    return (*func)(fp, KDSKBMODE, (caddr_t)&kbdmode, p);
+	    return fo_ioctl(fp, KDSKBMODE, (caddr_t)&kbdmode, p);
 	case LINUX_KBD_XLATE:  
 	    kbdmode = K_XLATE;
-	    return (*func)(fp, KDSKBMODE , (caddr_t)&kbdmode, p);
+	    return fo_ioctl(fp, KDSKBMODE , (caddr_t)&kbdmode, p);
 	case LINUX_KBD_MEDIUMRAW:
 	    kbdmode = K_RAW;
-	    return (*func)(fp, KDSKBMODE , (caddr_t)&kbdmode, p);
+	    return fo_ioctl(fp, KDSKBMODE , (caddr_t)&kbdmode, p);
 	default:
 	    return EINVAL;
 	}
@@ -1207,7 +1205,7 @@ linux_ioctl(struct proc *p, struct linux_ioctl_args *args)
     case LINUX_CDROMREADTOCHDR: {
 	struct ioc_toc_header th;
 	struct linux_cdrom_tochdr lth;
-	error = (*func)(fp, CDIOREADTOCHEADER, (caddr_t)&th, p);
+	error = fo_ioctl(fp, CDIOREADTOCHEADER, (caddr_t)&th, p);
 	if (!error) {
 	    lth.cdth_trk0 = th.starting_track;
 	    lth.cdth_trk1 = th.ending_track;
@@ -1222,7 +1220,7 @@ linux_ioctl(struct proc *p, struct linux_ioctl_args *args)
 	struct ioc_read_toc_single_entry irtse;
 	irtse.address_format = ltep->cdte_format;
 	irtse.track = ltep->cdte_track;
-	error = (*func)(fp, CDIOREADTOCENTRY, (caddr_t)&irtse, p);
+	error = fo_ioctl(fp, CDIOREADTOCENTRY, (caddr_t)&irtse, p);
 	if (!error) {
 	    lte = *ltep;
 	    lte.cdte_ctrl = irtse.entry.control;
@@ -1248,7 +1246,7 @@ linux_ioctl(struct proc *p, struct linux_ioctl_args *args)
 	bsdsc.data_format = CD_CURRENT_POSITION;
 	bsdsc.data_len = sizeof(struct cd_sub_channel_info);
 	bsdsc.data = bsdinfo;
-	error = (*func)(fp, CDIOCREADSUBCHANNEL, (caddr_t)&bsdsc, p);
+	error = fo_ioctl(fp, CDIOCREADSUBCHANNEL, (caddr_t)&bsdsc, p);
 	if (error)
 	    return error;
 
diff --git a/sys/compat/svr4/svr4_fcntl.c b/sys/compat/svr4/svr4_fcntl.c
index 60b9759..a0b4e39 100644
--- a/sys/compat/svr4/svr4_fcntl.c
+++ b/sys/compat/svr4/svr4_fcntl.c
@@ -379,7 +379,7 @@ svr4_sys_open(p, uap)
 
 		/* ignore any error, just give it a try */
 		if (fp->f_type == DTYPE_VNODE)
-			(fp->f_ops->fo_ioctl) (fp, TIOCSCTTY, (caddr_t) 0, p);
+			fo_ioctl(fp, TIOCSCTTY, (caddr_t) 0, p);
 #endif
 	}
 	return error;
diff --git a/sys/compat/svr4/svr4_filio.c b/sys/compat/svr4/svr4_filio.c
index 0be9f22..9d404c7 100644
--- a/sys/compat/svr4/svr4_filio.c
+++ b/sys/compat/svr4/svr4_filio.c
@@ -196,8 +196,6 @@ svr4_fil_ioctl(fp, p, retval, fd, cmd, data)
 	int error;
 	int num;
 	struct filedesc *fdp = p->p_fd;
-	int (*ctl) __P((struct file *, u_long,  caddr_t, struct proc *)) =
-			fp->f_ops->fo_ioctl;
 
 	*retval = 0;
 
@@ -229,7 +227,7 @@ svr4_fil_ioctl(fp, p, retval, fd, cmd, data)
 #ifdef SVR4_DEBUG
 		if (cmd == FIOASYNC) DPRINTF(("FIOASYNC\n"));
 #endif
-		error = (*ctl)(fp, cmd, (caddr_t) &num, p);
+		error = fo_ioctl(fp, cmd, (caddr_t) &num, p);
 
 		if (error)
 			return error;
diff --git a/sys/compat/svr4/svr4_sockio.c b/sys/compat/svr4/svr4_sockio.c
index 7d61846..8fe8099 100644
--- a/sys/compat/svr4/svr4_sockio.c
+++ b/sys/compat/svr4/svr4_sockio.c
@@ -88,8 +88,6 @@ svr4_sock_ioctl(fp, p, retval, fd, cmd, data)
 	caddr_t data;
 {
 	int error;
-	int (*ctl) __P((struct file *, u_long,  caddr_t, struct proc *)) =
-			fp->f_ops->fo_ioctl;
 
 	*retval = 0;
 
@@ -136,7 +134,7 @@ svr4_sock_ioctl(fp, p, retval, fd, cmd, data)
 
 			(void) strncpy(br.ifr_name, sr.svr4_ifr_name,
 			    sizeof(br.ifr_name));
-			if ((error = (*ctl)(fp, SIOCGIFFLAGS, 
+			if ((error = fo_ioctl(fp, SIOCGIFFLAGS, 
 					    (caddr_t) &br, p)) != 0) {
 				DPRINTF(("SIOCGIFFLAGS (%s) %s: error %d\n", 
 					 br.ifr_name, sr.svr4_ifr_name, error));
@@ -160,7 +158,7 @@ svr4_sock_ioctl(fp, p, retval, fd, cmd, data)
 				sizeof(struct ifreq), sizeof(struct svr4_ifreq),
 				sc.svr4_ifc_len));
 
-			if ((error = (*ctl)(fp, OSIOCGIFCONF,
+			if ((error = fo_ioctl(fp, OSIOCGIFCONF,
 					    (caddr_t) &sc, p)) != 0)
 				return error;
 
diff --git a/sys/compat/svr4/svr4_stream.c b/sys/compat/svr4/svr4_stream.c
index 4ced1bc..873b57a 100644
--- a/sys/compat/svr4/svr4_stream.c
+++ b/sys/compat/svr4/svr4_stream.c
@@ -1255,8 +1255,7 @@ i_nread(fp, p, retval, fd, cmd, dat)
 	 * for us, and if we do, then we assume that we have at least one
 	 * message waiting for us.
 	 */
-	if ((error = (*fp->f_ops->fo_ioctl)(fp, FIONREAD,
-	    (caddr_t) &nread, p)) != 0)
+	if ((error = fo_ioctl(fp, FIONREAD, (caddr_t) &nread, p)) != 0)
 		return error;
 
 	if (nread != 0)
diff --git a/sys/compat/svr4/svr4_termios.c b/sys/compat/svr4/svr4_termios.c
index 450c084..12d533b 100644
--- a/sys/compat/svr4/svr4_termios.c
+++ b/sys/compat/svr4/svr4_termios.c
@@ -502,8 +502,6 @@ svr4_term_ioctl(fp, p, retval, fd, cmd, data)
 	struct svr4_termios	st;
 	struct svr4_termio	t;
 	int			error, new;
-	int (*ctl) __P((struct file *, u_long,  caddr_t, struct proc *)) =
-			fp->f_ops->fo_ioctl;
 
 	*retval = 0;
 
@@ -513,7 +511,7 @@ svr4_term_ioctl(fp, p, retval, fd, cmd, data)
 	case SVR4_TCGETA:
 	case SVR4_TCGETS:
 		DPRINTF(("ioctl(TCGET%c);\n", cmd == SVR4_TCGETA ? 'A' : 'S'));
-		if ((error = (*ctl)(fp, TIOCGETA, (caddr_t) &bt, p)) != 0)
+		if ((error = fo_ioctl(fp, TIOCGETA, (caddr_t) &bt, p)) != 0)
 			return error;
 
 		memset(&st, 0, sizeof(st));
@@ -540,7 +538,7 @@ svr4_term_ioctl(fp, p, retval, fd, cmd, data)
 	case SVR4_TCSETSF:
 	        DPRINTF(("TCSET{A,S,AW,SW,AF,SF}\n"));
 		/* get full BSD termios so we don't lose information */
-		if ((error = (*ctl)(fp, TIOCGETA, (caddr_t) &bt, p)) != 0)
+		if ((error = fo_ioctl(fp, TIOCGETA, (caddr_t) &bt, p)) != 0)
 			return error;
 
 		switch (cmd) {
@@ -591,14 +589,14 @@ svr4_term_ioctl(fp, p, retval, fd, cmd, data)
 		print_svr4_termios(&st);
 #endif /* DEBUG_SVR4 */
 
-		return (*ctl)(fp, cmd, (caddr_t) &bt, p);
+		return fo_ioctl(fp, cmd, (caddr_t) &bt, p);
 
 	case SVR4_TIOCGWINSZ:
 	        DPRINTF(("TIOCGWINSZ\n"));
 		{
 			struct svr4_winsize ws;
 
-			error = (*ctl)(fp, TIOCGWINSZ, (caddr_t) &ws, p);
+			error = fo_ioctl(fp, TIOCGWINSZ, (caddr_t) &ws, p);
 			if (error)
 				return error;
 			return copyout(&ws, data, sizeof(ws));
@@ -611,7 +609,7 @@ svr4_term_ioctl(fp, p, retval, fd, cmd, data)
 
 			if ((error = copyin(data, &ws, sizeof(ws))) != 0)
 				return error;
-			return (*ctl)(fp, TIOCSWINSZ, (caddr_t) &ws, p);
+			return fo_ioctl(fp, TIOCSWINSZ, (caddr_t) &ws, p);
 		}
 
 	default:
diff --git a/sys/compat/svr4/svr4_ttold.c b/sys/compat/svr4/svr4_ttold.c
index d597691..699d44d 100644
--- a/sys/compat/svr4/svr4_ttold.c
+++ b/sys/compat/svr4/svr4_ttold.c
@@ -196,8 +196,6 @@ svr4_ttold_ioctl(fp, p, retval, fd, cmd, data)
 	caddr_t data;
 {
 	int			error;
-	int (*ctl) __P((struct file *, u_long,  caddr_t, struct proc *)) =
-			fp->f_ops->fo_ioctl;
 
 	*retval = 0;
 
@@ -206,8 +204,7 @@ svr4_ttold_ioctl(fp, p, retval, fd, cmd, data)
 		{
 			pid_t pid;
 
-			if ((error = (*ctl)(fp, TIOCGPGRP,
-					    (caddr_t) &pid, p)) != 0)
+			if ((error = fo_ioctl(fp, TIOCGPGRP, (caddr_t) &pid, p)) != 0)
 			    return error;
 
 			DPRINTF(("TIOCGPGRP %d\n", pid));
@@ -226,15 +223,14 @@ svr4_ttold_ioctl(fp, p, retval, fd, cmd, data)
 
 			DPRINTF(("TIOCSPGRP %d\n", pid));
 
-			return (*ctl)(fp, TIOCSPGRP, (caddr_t) &pid, p);
+			return fo_ioctl(fp, TIOCSPGRP, (caddr_t) &pid, p);
 		}
 
 	case SVR4_TIOCGSID:
 		{
 #if defined(TIOCGSID)
 			pid_t pid;
-			if ((error = (*ctl)(fp, TIOCGSID,
-					    (caddr_t) &pid, p)) != 0)
+			if ((error = fo_ioctl(fp, TIOCGSID, (caddr_t) &pid, p)) != 0)
 				return error;
 
 			DPRINTF(("TIOCGSID %d\n", pid));
@@ -251,7 +247,7 @@ svr4_ttold_ioctl(fp, p, retval, fd, cmd, data)
 			struct sgttyb bs;
 			struct svr4_sgttyb ss;
 
-			error = (*ctl)(fp, TIOCGETP, (caddr_t) &bs, p);
+			error = fo_ioctl(fp, TIOCGETP, (caddr_t) &bs, p);
 			if (error)
 				return error;
 
@@ -276,7 +272,7 @@ svr4_ttold_ioctl(fp, p, retval, fd, cmd, data)
 			print_svr4_sgttyb("SVR4_TIOCSET{P,N}", &ss);
 #endif /* DEBUG_SVR4 */
 			cmd = (cmd == SVR4_TIOCSETP) ? TIOCSETP : TIOCSETN;
-			return (*ctl)(fp, cmd, (caddr_t) &bs, p);
+			return fo_ioctl(fp, cmd, (caddr_t) &bs, p);
 		}
 
 	case SVR4_TIOCGETC:
@@ -284,7 +280,7 @@ svr4_ttold_ioctl(fp, p, retval, fd, cmd, data)
 			struct tchars bt;
 			struct svr4_tchars st;
 
-			error = (*ctl)(fp, TIOCGETC, (caddr_t) &bt, p);
+			error = fo_ioctl(fp, TIOCGETC, (caddr_t) &bt, p);
 			if (error)
 				return error;
 
@@ -307,7 +303,7 @@ svr4_ttold_ioctl(fp, p, retval, fd, cmd, data)
 #ifdef DEBUG_SVR4
 			print_svr4_tchars("SVR4_TIOCSETC", &st);
 #endif /* DEBUG_SVR4 */
-			return (*ctl)(fp, TIOCSETC, (caddr_t) &bt, p);
+			return fo_ioctl(fp, TIOCSETC, (caddr_t) &bt, p);
 		}
 
 	case SVR4_TIOCGLTC:
@@ -315,7 +311,7 @@ svr4_ttold_ioctl(fp, p, retval, fd, cmd, data)
 			struct ltchars bl;
 			struct svr4_ltchars sl;
 
-			error = (*ctl)(fp, TIOCGLTC, (caddr_t) &bl, p);
+			error = fo_ioctl(fp, TIOCGLTC, (caddr_t) &bl, p);
 			if (error)
 				return error;
 
@@ -338,14 +334,13 @@ svr4_ttold_ioctl(fp, p, retval, fd, cmd, data)
 #ifdef DEBUG_SVR4
 			print_svr4_ltchars("SVR4_TIOCSLTC", &sl);
 #endif /* DEBUG_SVR4 */
-			return (*ctl)(fp, TIOCSLTC, (caddr_t) &bl, p);
+			return fo_ioctl(fp, TIOCSLTC, (caddr_t) &bl, p);
 		}
 
 	case SVR4_TIOCLGET:
 		{
 			int flags;
-			if ((error = (*ctl)(fp, TIOCLGET,
-					    (caddr_t) &flags, p)) != 0)
+			if ((error = fo_ioctl(fp, TIOCLGET, (caddr_t) &flags, p)) != 0)
 				return error;
 			DPRINTF(("SVR4_TIOCLGET %o\n", flags));
 			return copyout(&flags, data, sizeof(flags));
@@ -373,7 +368,7 @@ svr4_ttold_ioctl(fp, p, retval, fd, cmd, data)
 			}
 
 			DPRINTF(("SVR4_TIOCL{SET,BIS,BIC} %o\n", flags));
-			return (*ctl)(fp, cmd, (caddr_t) &flags, p);
+			return fo_ioctl(fp, cmd, (caddr_t) &flags, p);
 		}
 
 	default: