This is what was "fdfix2.patch," a fix for fd sharing. It's pretty

far-reaching in fd-land, so you'll want to consult the code for
changes.  The biggest change is that now, you don't use
	fp->f_ops->fo_foo(fp, bar)
but instead
	fo_foo(fp, bar),
which increments and decrements the fp refcount upon entry and exit.
Two new calls, fhold() and fdrop(), are provided.  Each does what it
seems like it should, and if fdrop() brings the refcount to zero, the
fd is freed as well.

Thanks to peter ("to hell with it, it looks ok to me.") for his review.
Thanks to msmith for keeping me from putting locks everywhere :)

Reviewed by:	peter

27 files changed, 257 insertions, 173 deletions

diff --git a/sys/compat/linux/linux_file.c b/sys/compat/linux/linux_file.c
index 66e9312..6a33e68 100644
--- a/sys/compat/linux/linux_file.c
+++ b/sys/compat/linux/linux_file.c
@@ -128,7 +128,7 @@ linux_open(struct proc *p, struct linux_open_args *args)
 	struct file *fp = fdp->fd_ofiles[p->p_retval[0]];
 
 	if (fp->f_type == DTYPE_VNODE)
-	    (fp->f_ops->fo_ioctl)(fp, TIOCSCTTY, (caddr_t) 0, p);
+	    fo_ioctl(fp, TIOCSCTTY, (caddr_t) 0, p);
     }
 #ifdef DEBUG
     printf("Linux-emul(%d): open returns error %d\n", 
diff --git a/sys/compat/linux/linux_ioctl.c b/sys/compat/linux/linux_ioctl.c
index 8507ade..d071bcd 100644
--- a/sys/compat/linux/linux_ioctl.c
+++ b/sys/compat/linux/linux_ioctl.c
@@ -539,7 +539,6 @@ linux_ioctl(struct proc *p, struct linux_ioctl_args *args)
     struct linux_termio linux_termio;
     struct filedesc *fdp = p->p_fd;
     struct file *fp;
-    int (*func)(struct file *fp, u_long com, caddr_t data, struct proc *p);
     int bsd_line, linux_line;
     int error;
 
@@ -555,11 +554,10 @@ linux_ioctl(struct proc *p, struct linux_ioctl_args *args)
 	return EBADF;
     }
 
-    func = fp->f_ops->fo_ioctl;
     switch (args->cmd & 0xffff) {
 
     case LINUX_TCGETA:
-	if ((error = (*func)(fp, TIOCGETA, (caddr_t)&bsd_termios, p)) != 0)
+	if ((error = fo_ioctl(fp, TIOCGETA, (caddr_t)&bsd_termios, p)) != 0)
 	    return error;
 	bsd_to_linux_termio(&bsd_termios, &linux_termio);
 	return copyout((caddr_t)&linux_termio, (caddr_t)args->arg,
@@ -570,24 +568,24 @@ linux_ioctl(struct proc *p, struct linux_ioctl_args *args)
 	if (error)
 	    return error;
 	linux_to_bsd_termio(&linux_termio, &bsd_termios);
-	return (*func)(fp, TIOCSETA, (caddr_t)&bsd_termios, p);
+	return fo_ioctl(fp, TIOCSETA, (caddr_t)&bsd_termios, p);
 
     case LINUX_TCSETAW:
 	error = copyin((caddr_t)args->arg, &linux_termio, sizeof(linux_termio));
 	if (error)
 	    return error;
 	linux_to_bsd_termio(&linux_termio, &bsd_termios);
-	return (*func)(fp, TIOCSETAW, (caddr_t)&bsd_termios, p);
+	return fo_ioctl(fp, TIOCSETAW, (caddr_t)&bsd_termios, p);
 
     case LINUX_TCSETAF:
 	error = copyin((caddr_t)args->arg, &linux_termio, sizeof(linux_termio));
 	if (error)
 	    return error;
 	linux_to_bsd_termio(&linux_termio, &bsd_termios);
-	return (*func)(fp, TIOCSETAF, (caddr_t)&bsd_termios, p);
+	return fo_ioctl(fp, TIOCSETAF, (caddr_t)&bsd_termios, p);
 
     case LINUX_TCGETS:
-	if ((error = (*func)(fp, TIOCGETA, (caddr_t)&bsd_termios, p)) != 0)
+	if ((error = fo_ioctl(fp, TIOCGETA, (caddr_t)&bsd_termios, p)) != 0)
 	    return error;
 	bsd_to_linux_termios(&bsd_termios, &linux_termios);
 	return copyout((caddr_t)&linux_termios, (caddr_t)args->arg,
@@ -599,7 +597,7 @@ linux_ioctl(struct proc *p, struct linux_ioctl_args *args)
 	if (error)
 	    return error;
 	linux_to_bsd_termios(&linux_termios, &bsd_termios);
-	return (*func)(fp, TIOCSETA, (caddr_t)&bsd_termios, p);
+	return fo_ioctl(fp, TIOCSETA, (caddr_t)&bsd_termios, p);
 
     case LINUX_TCSETSW:
 	error = copyin((caddr_t)args->arg, &linux_termios,
@@ -607,7 +605,7 @@ linux_ioctl(struct proc *p, struct linux_ioctl_args *args)
 	if (error)
 	    return error;
 	linux_to_bsd_termios(&linux_termios, &bsd_termios);
-	return (*func)(fp, TIOCSETAW, (caddr_t)&bsd_termios, p);
+	return fo_ioctl(fp, TIOCSETAW, (caddr_t)&bsd_termios, p);
 
     case LINUX_TCSETSF:
 	error = copyin((caddr_t)args->arg, &linux_termios,
@@ -615,7 +613,7 @@ linux_ioctl(struct proc *p, struct linux_ioctl_args *args)
 	if (error)
 	    return error;
 	linux_to_bsd_termios(&linux_termios, &bsd_termios);
-	return (*func)(fp, TIOCSETAF, (caddr_t)&bsd_termios, p);
+	return fo_ioctl(fp, TIOCSETAF, (caddr_t)&bsd_termios, p);
 	    
     case LINUX_TIOCGPGRP:
 	args->cmd = TIOCGPGRP;
@@ -773,20 +771,20 @@ linux_ioctl(struct proc *p, struct linux_ioctl_args *args)
 	switch (args->arg) {
 	case LINUX_N_TTY:
 	    bsd_line = TTYDISC;
-	    return (*func)(fp, TIOCSETD, (caddr_t)&bsd_line, p);
+	    return fo_ioctl(fp, TIOCSETD, (caddr_t)&bsd_line, p);
 	case LINUX_N_SLIP:
 	    bsd_line = SLIPDISC;
-	    return (*func)(fp, TIOCSETD, (caddr_t)&bsd_line, p);
+	    return fo_ioctl(fp, TIOCSETD, (caddr_t)&bsd_line, p);
 	case LINUX_N_PPP:
 	    bsd_line = PPPDISC;
-	    return (*func)(fp, TIOCSETD, (caddr_t)&bsd_line, p);
+	    return fo_ioctl(fp, TIOCSETD, (caddr_t)&bsd_line, p);
 	default:
 	    return EINVAL;
 	}
 
     case LINUX_TIOCGETD:
 	bsd_line = TTYDISC;
-	error =(*func)(fp, TIOCGETD, (caddr_t)&bsd_line, p);
+	error = fo_ioctl(fp, TIOCGETD, (caddr_t)&bsd_line, p);
 	if (error)
 	    return error;
 	switch (bsd_line) {
@@ -1048,7 +1046,7 @@ linux_ioctl(struct proc *p, struct linux_ioctl_args *args)
       case LINUX_TCION: {
 	      u_char c;
 	      struct write_args wr;
-	      error = (*func)(fp, TIOCGETA, (caddr_t)&bsd_termios, p);
+	      error = fo_ioctl(fp, TIOCGETA, (caddr_t)&bsd_termios, p);
               if (error != 0)
 		      return error;
 	      c = bsd_termios.c_cc[args->arg == LINUX_TCIOFF ? VSTOP : VSTART];
@@ -1135,13 +1133,13 @@ linux_ioctl(struct proc *p, struct linux_ioctl_args *args)
 	switch (args->arg) {
 	case LINUX_KBD_RAW:
 	    kbdmode = K_RAW;
-	    return (*func)(fp, KDSKBMODE, (caddr_t)&kbdmode, p);
+	    return fo_ioctl(fp, KDSKBMODE, (caddr_t)&kbdmode, p);
 	case LINUX_KBD_XLATE:  
 	    kbdmode = K_XLATE;
-	    return (*func)(fp, KDSKBMODE , (caddr_t)&kbdmode, p);
+	    return fo_ioctl(fp, KDSKBMODE , (caddr_t)&kbdmode, p);
 	case LINUX_KBD_MEDIUMRAW:
 	    kbdmode = K_RAW;
-	    return (*func)(fp, KDSKBMODE , (caddr_t)&kbdmode, p);
+	    return fo_ioctl(fp, KDSKBMODE , (caddr_t)&kbdmode, p);
 	default:
 	    return EINVAL;
 	}
@@ -1207,7 +1205,7 @@ linux_ioctl(struct proc *p, struct linux_ioctl_args *args)
     case LINUX_CDROMREADTOCHDR: {
 	struct ioc_toc_header th;
 	struct linux_cdrom_tochdr lth;
-	error = (*func)(fp, CDIOREADTOCHEADER, (caddr_t)&th, p);
+	error = fo_ioctl(fp, CDIOREADTOCHEADER, (caddr_t)&th, p);
 	if (!error) {
 	    lth.cdth_trk0 = th.starting_track;
 	    lth.cdth_trk1 = th.ending_track;
@@ -1222,7 +1220,7 @@ linux_ioctl(struct proc *p, struct linux_ioctl_args *args)
 	struct ioc_read_toc_single_entry irtse;
 	irtse.address_format = ltep->cdte_format;
 	irtse.track = ltep->cdte_track;
-	error = (*func)(fp, CDIOREADTOCENTRY, (caddr_t)&irtse, p);
+	error = fo_ioctl(fp, CDIOREADTOCENTRY, (caddr_t)&irtse, p);
 	if (!error) {
 	    lte = *ltep;
 	    lte.cdte_ctrl = irtse.entry.control;
@@ -1248,7 +1246,7 @@ linux_ioctl(struct proc *p, struct linux_ioctl_args *args)
 	bsdsc.data_format = CD_CURRENT_POSITION;
 	bsdsc.data_len = sizeof(struct cd_sub_channel_info);
 	bsdsc.data = bsdinfo;
-	error = (*func)(fp, CDIOCREADSUBCHANNEL, (caddr_t)&bsdsc, p);
+	error = fo_ioctl(fp, CDIOCREADSUBCHANNEL, (caddr_t)&bsdsc, p);
 	if (error)
 	    return error;
 
diff --git a/sys/compat/svr4/svr4_fcntl.c b/sys/compat/svr4/svr4_fcntl.c
index 60b9759..a0b4e39 100644
--- a/sys/compat/svr4/svr4_fcntl.c
+++ b/sys/compat/svr4/svr4_fcntl.c
@@ -379,7 +379,7 @@ svr4_sys_open(p, uap)
 
 		/* ignore any error, just give it a try */
 		if (fp->f_type == DTYPE_VNODE)
-			(fp->f_ops->fo_ioctl) (fp, TIOCSCTTY, (caddr_t) 0, p);
+			fo_ioctl(fp, TIOCSCTTY, (caddr_t) 0, p);
 #endif
 	}
 	return error;
diff --git a/sys/compat/svr4/svr4_filio.c b/sys/compat/svr4/svr4_filio.c
index 0be9f22..9d404c7 100644
--- a/sys/compat/svr4/svr4_filio.c
+++ b/sys/compat/svr4/svr4_filio.c
@@ -196,8 +196,6 @@ svr4_fil_ioctl(fp, p, retval, fd, cmd, data)
 	int error;
 	int num;
 	struct filedesc *fdp = p->p_fd;
-	int (*ctl) __P((struct file *, u_long,  caddr_t, struct proc *)) =
-			fp->f_ops->fo_ioctl;
 
 	*retval = 0;
 
@@ -229,7 +227,7 @@ svr4_fil_ioctl(fp, p, retval, fd, cmd, data)
 #ifdef SVR4_DEBUG
 		if (cmd == FIOASYNC) DPRINTF(("FIOASYNC\n"));
 #endif
-		error = (*ctl)(fp, cmd, (caddr_t) &num, p);
+		error = fo_ioctl(fp, cmd, (caddr_t) &num, p);
 
 		if (error)
 			return error;
diff --git a/sys/compat/svr4/svr4_sockio.c b/sys/compat/svr4/svr4_sockio.c
index 7d61846..8fe8099 100644
--- a/sys/compat/svr4/svr4_sockio.c
+++ b/sys/compat/svr4/svr4_sockio.c
@@ -88,8 +88,6 @@ svr4_sock_ioctl(fp, p, retval, fd, cmd, data)
 	caddr_t data;
 {
 	int error;
-	int (*ctl) __P((struct file *, u_long,  caddr_t, struct proc *)) =
-			fp->f_ops->fo_ioctl;
 
 	*retval = 0;
 
@@ -136,7 +134,7 @@ svr4_sock_ioctl(fp, p, retval, fd, cmd, data)
 
 			(void) strncpy(br.ifr_name, sr.svr4_ifr_name,
 			    sizeof(br.ifr_name));
-			if ((error = (*ctl)(fp, SIOCGIFFLAGS, 
+			if ((error = fo_ioctl(fp, SIOCGIFFLAGS, 
 					    (caddr_t) &br, p)) != 0) {
 				DPRINTF(("SIOCGIFFLAGS (%s) %s: error %d\n", 
 					 br.ifr_name, sr.svr4_ifr_name, error));
@@ -160,7 +158,7 @@ svr4_sock_ioctl(fp, p, retval, fd, cmd, data)
 				sizeof(struct ifreq), sizeof(struct svr4_ifreq),
 				sc.svr4_ifc_len));
 
-			if ((error = (*ctl)(fp, OSIOCGIFCONF,
+			if ((error = fo_ioctl(fp, OSIOCGIFCONF,
 					    (caddr_t) &sc, p)) != 0)
 				return error;
 
diff --git a/sys/compat/svr4/svr4_stream.c b/sys/compat/svr4/svr4_stream.c
index 4ced1bc..873b57a 100644
--- a/sys/compat/svr4/svr4_stream.c
+++ b/sys/compat/svr4/svr4_stream.c
@@ -1255,8 +1255,7 @@ i_nread(fp, p, retval, fd, cmd, dat)
 	 * for us, and if we do, then we assume that we have at least one
 	 * message waiting for us.
 	 */
-	if ((error = (*fp->f_ops->fo_ioctl)(fp, FIONREAD,
-	    (caddr_t) &nread, p)) != 0)
+	if ((error = fo_ioctl(fp, FIONREAD, (caddr_t) &nread, p)) != 0)
 		return error;
 
 	if (nread != 0)
diff --git a/sys/compat/svr4/svr4_termios.c b/sys/compat/svr4/svr4_termios.c
index 450c084..12d533b 100644
--- a/sys/compat/svr4/svr4_termios.c
+++ b/sys/compat/svr4/svr4_termios.c
@@ -502,8 +502,6 @@ svr4_term_ioctl(fp, p, retval, fd, cmd, data)
 	struct svr4_termios	st;
 	struct svr4_termio	t;
 	int			error, new;
-	int (*ctl) __P((struct file *, u_long,  caddr_t, struct proc *)) =
-			fp->f_ops->fo_ioctl;
 
 	*retval = 0;
 
@@ -513,7 +511,7 @@ svr4_term_ioctl(fp, p, retval, fd, cmd, data)
 	case SVR4_TCGETA:
 	case SVR4_TCGETS:
 		DPRINTF(("ioctl(TCGET%c);\n", cmd == SVR4_TCGETA ? 'A' : 'S'));
-		if ((error = (*ctl)(fp, TIOCGETA, (caddr_t) &bt, p)) != 0)
+		if ((error = fo_ioctl(fp, TIOCGETA, (caddr_t) &bt, p)) != 0)
 			return error;
 
 		memset(&st, 0, sizeof(st));
@@ -540,7 +538,7 @@ svr4_term_ioctl(fp, p, retval, fd, cmd, data)
 	case SVR4_TCSETSF:
 	        DPRINTF(("TCSET{A,S,AW,SW,AF,SF}\n"));
 		/* get full BSD termios so we don't lose information */
-		if ((error = (*ctl)(fp, TIOCGETA, (caddr_t) &bt, p)) != 0)
+		if ((error = fo_ioctl(fp, TIOCGETA, (caddr_t) &bt, p)) != 0)
 			return error;
 
 		switch (cmd) {
@@ -591,14 +589,14 @@ svr4_term_ioctl(fp, p, retval, fd, cmd, data)
 		print_svr4_termios(&st);
 #endif /* DEBUG_SVR4 */
 
-		return (*ctl)(fp, cmd, (caddr_t) &bt, p);
+		return fo_ioctl(fp, cmd, (caddr_t) &bt, p);
 
 	case SVR4_TIOCGWINSZ:
 	        DPRINTF(("TIOCGWINSZ\n"));
 		{
 			struct svr4_winsize ws;
 
-			error = (*ctl)(fp, TIOCGWINSZ, (caddr_t) &ws, p);
+			error = fo_ioctl(fp, TIOCGWINSZ, (caddr_t) &ws, p);
 			if (error)
 				return error;
 			return copyout(&ws, data, sizeof(ws));
@@ -611,7 +609,7 @@ svr4_term_ioctl(fp, p, retval, fd, cmd, data)
 
 			if ((error = copyin(data, &ws, sizeof(ws))) != 0)
 				return error;
-			return (*ctl)(fp, TIOCSWINSZ, (caddr_t) &ws, p);
+			return fo_ioctl(fp, TIOCSWINSZ, (caddr_t) &ws, p);
 		}
 
 	default:
diff --git a/sys/compat/svr4/svr4_ttold.c b/sys/compat/svr4/svr4_ttold.c
index d597691..699d44d 100644
--- a/sys/compat/svr4/svr4_ttold.c
+++ b/sys/compat/svr4/svr4_ttold.c
@@ -196,8 +196,6 @@ svr4_ttold_ioctl(fp, p, retval, fd, cmd, data)
 	caddr_t data;
 {
 	int			error;
-	int (*ctl) __P((struct file *, u_long,  caddr_t, struct proc *)) =
-			fp->f_ops->fo_ioctl;
 
 	*retval = 0;
 
@@ -206,8 +204,7 @@ svr4_ttold_ioctl(fp, p, retval, fd, cmd, data)
 		{
 			pid_t pid;
 
-			if ((error = (*ctl)(fp, TIOCGPGRP,
-					    (caddr_t) &pid, p)) != 0)
+			if ((error = fo_ioctl(fp, TIOCGPGRP, (caddr_t) &pid, p)) != 0)
 			    return error;
 
 			DPRINTF(("TIOCGPGRP %d\n", pid));
@@ -226,15 +223,14 @@ svr4_ttold_ioctl(fp, p, retval, fd, cmd, data)
 
 			DPRINTF(("TIOCSPGRP %d\n", pid));
 
-			return (*ctl)(fp, TIOCSPGRP, (caddr_t) &pid, p);
+			return fo_ioctl(fp, TIOCSPGRP, (caddr_t) &pid, p);
 		}
 
 	case SVR4_TIOCGSID:
 		{
 #if defined(TIOCGSID)
 			pid_t pid;
-			if ((error = (*ctl)(fp, TIOCGSID,
-					    (caddr_t) &pid, p)) != 0)
+			if ((error = fo_ioctl(fp, TIOCGSID, (caddr_t) &pid, p)) != 0)
 				return error;
 
 			DPRINTF(("TIOCGSID %d\n", pid));
@@ -251,7 +247,7 @@ svr4_ttold_ioctl(fp, p, retval, fd, cmd, data)
 			struct sgttyb bs;
 			struct svr4_sgttyb ss;
 
-			error = (*ctl)(fp, TIOCGETP, (caddr_t) &bs, p);
+			error = fo_ioctl(fp, TIOCGETP, (caddr_t) &bs, p);
 			if (error)
 				return error;
 
@@ -276,7 +272,7 @@ svr4_ttold_ioctl(fp, p, retval, fd, cmd, data)
 			print_svr4_sgttyb("SVR4_TIOCSET{P,N}", &ss);
 #endif /* DEBUG_SVR4 */
 			cmd = (cmd == SVR4_TIOCSETP) ? TIOCSETP : TIOCSETN;
-			return (*ctl)(fp, cmd, (caddr_t) &bs, p);
+			return fo_ioctl(fp, cmd, (caddr_t) &bs, p);
 		}
 
 	case SVR4_TIOCGETC:
@@ -284,7 +280,7 @@ svr4_ttold_ioctl(fp, p, retval, fd, cmd, data)
 			struct tchars bt;
 			struct svr4_tchars st;
 
-			error = (*ctl)(fp, TIOCGETC, (caddr_t) &bt, p);
+			error = fo_ioctl(fp, TIOCGETC, (caddr_t) &bt, p);
 			if (error)
 				return error;
 
@@ -307,7 +303,7 @@ svr4_ttold_ioctl(fp, p, retval, fd, cmd, data)
 #ifdef DEBUG_SVR4
 			print_svr4_tchars("SVR4_TIOCSETC", &st);
 #endif /* DEBUG_SVR4 */
-			return (*ctl)(fp, TIOCSETC, (caddr_t) &bt, p);
+			return fo_ioctl(fp, TIOCSETC, (caddr_t) &bt, p);
 		}
 
 	case SVR4_TIOCGLTC:
@@ -315,7 +311,7 @@ svr4_ttold_ioctl(fp, p, retval, fd, cmd, data)
 			struct ltchars bl;
 			struct svr4_ltchars sl;
 
-			error = (*ctl)(fp, TIOCGLTC, (caddr_t) &bl, p);
+			error = fo_ioctl(fp, TIOCGLTC, (caddr_t) &bl, p);
 			if (error)
 				return error;
 
@@ -338,14 +334,13 @@ svr4_ttold_ioctl(fp, p, retval, fd, cmd, data)
 #ifdef DEBUG_SVR4
 			print_svr4_ltchars("SVR4_TIOCSLTC", &sl);
 #endif /* DEBUG_SVR4 */
-			return (*ctl)(fp, TIOCSLTC, (caddr_t) &bl, p);
+			return fo_ioctl(fp, TIOCSLTC, (caddr_t) &bl, p);
 		}
 
 	case SVR4_TIOCLGET:
 		{
 			int flags;
-			if ((error = (*ctl)(fp, TIOCLGET,
-					    (caddr_t) &flags, p)) != 0)
+			if ((error = fo_ioctl(fp, TIOCLGET, (caddr_t) &flags, p)) != 0)
 				return error;
 			DPRINTF(("SVR4_TIOCLGET %o\n", flags));
 			return copyout(&flags, data, sizeof(flags));
@@ -373,7 +368,7 @@ svr4_ttold_ioctl(fp, p, retval, fd, cmd, data)
 			}
 
 			DPRINTF(("SVR4_TIOCL{SET,BIS,BIC} %o\n", flags));
-			return (*ctl)(fp, cmd, (caddr_t) &flags, p);
+			return fo_ioctl(fp, cmd, (caddr_t) &flags, p);
 		}
 
 	default:
diff --git a/sys/i386/ibcs2/ibcs2_fcntl.c b/sys/i386/ibcs2/ibcs2_fcntl.c
index 5cc637a..88c9c1d 100644
--- a/sys/i386/ibcs2/ibcs2_fcntl.c
+++ b/sys/i386/ibcs2/ibcs2_fcntl.c
@@ -194,7 +194,7 @@ ibcs2_open(p, uap)
 
 		/* ignore any error, just give it a try */
 		if (fp->f_type == DTYPE_VNODE)
-			(fp->f_ops->fo_ioctl)(fp, TIOCSCTTY, (caddr_t) 0, p);
+			fo_ioctl(fp, TIOCSCTTY, (caddr_t) 0, p);
 	}
 	return ret;
 }
diff --git a/sys/i386/ibcs2/ibcs2_ioctl.c b/sys/i386/ibcs2/ibcs2_ioctl.c
index e0f3824..9ea3386 100644
--- a/sys/i386/ibcs2/ibcs2_ioctl.c
+++ b/sys/i386/ibcs2/ibcs2_ioctl.c
@@ -24,6 +24,8 @@
  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ * $FreeBSD$
  */
 
 #include <sys/param.h>
@@ -338,7 +340,6 @@ ibcs2_ioctl(p, uap)
 {
 	struct filedesc *fdp = p->p_fd;
 	struct file *fp;
-	int (*ctl) __P((struct file *, u_long, caddr_t, struct proc *));
 	int error;
 
 	if (SCARG(uap, fd) < 0 || SCARG(uap, fd) >= fdp->fd_nfiles ||
@@ -353,8 +354,6 @@ ibcs2_ioctl(p, uap)
 		return EBADF;
 	}
 
-	ctl = fp->f_ops->fo_ioctl;
-
 	switch (SCARG(uap, cmd)) {
 	case IBCS2_TCGETA:
 	case IBCS2_XCGETA:
@@ -364,7 +363,7 @@ ibcs2_ioctl(p, uap)
 		struct ibcs2_termios sts;
 		struct ibcs2_termio st;
 	
-		if ((error = (*ctl)(fp, TIOCGETA, (caddr_t)&bts, p)) != 0)
+		if ((error = fo_ioctl(fp, TIOCGETA, (caddr_t)&bts, p)) != 0)
 			return error;
 	
 		btios2stios (&bts, &sts);
@@ -400,7 +399,7 @@ ibcs2_ioctl(p, uap)
 		}
 
 		/* get full BSD termios so we don't lose information */
-		if ((error = (*ctl)(fp, TIOCGETA, (caddr_t)&bts, p)) != 0) {
+		if ((error = fo_ioctl(fp, TIOCGETA, (caddr_t)&bts, p)) != 0) {
 			DPRINTF(("ibcs2_ioctl(%d): TCSET ctl failed fd %d ",
 				 p->p_pid, SCARG(uap, fd)));
 			return error;
@@ -414,7 +413,7 @@ ibcs2_ioctl(p, uap)
 		stio2stios(&st, &sts);
 		stios2btios(&sts, &bts);
 
-		return (*ctl)(fp, SCARG(uap, cmd) - IBCS2_TCSETA + TIOCSETA,
+		return fo_ioctl(fp, SCARG(uap, cmd) - IBCS2_TCSETA + TIOCSETA,
 			      (caddr_t)&bts, p);
 	    }
 
@@ -430,7 +429,7 @@ ibcs2_ioctl(p, uap)
 			return error;
 		}
 		stios2btios (&sts, &bts);
-		return (*ctl)(fp, SCARG(uap, cmd) - IBCS2_XCSETA + TIOCSETA,
+		return fo_ioctl(fp, SCARG(uap, cmd) - IBCS2_XCSETA + TIOCSETA,
 			      (caddr_t)&bts, p);
 	    }
 
@@ -446,7 +445,7 @@ ibcs2_ioctl(p, uap)
 			return error;
 		}
 		stios2btios (&sts, &bts);
-		return (*ctl)(fp, SCARG(uap, cmd) - IBCS2_OXCSETA + TIOCSETA,
+		return fo_ioctl(fp, SCARG(uap, cmd) - IBCS2_OXCSETA + TIOCSETA,
 			      (caddr_t)&bts, p);
 	    }
 
@@ -462,9 +461,9 @@ ibcs2_ioctl(p, uap)
 			DPRINTF(("ibcs2_ioctl(%d): TCXONC ", p->p_pid));
 			return ENOSYS;
 		case 2:
-			return (*ctl)(fp, TIOCSTOP, (caddr_t)0, p);
+			return fo_ioctl(fp, TIOCSTOP, (caddr_t)0, p);
 		case 3:
-			return (*ctl)(fp, TIOCSTART, (caddr_t)1, p);
+			return fo_ioctl(fp, TIOCSTART, (caddr_t)1, p);
 		default:
 			return EINVAL;
 		}
@@ -487,7 +486,7 @@ ibcs2_ioctl(p, uap)
 		default:
 			return EINVAL;
 		}
-		return (*ctl)(fp, TIOCFLUSH, (caddr_t)&arg, p);
+		return fo_ioctl(fp, TIOCFLUSH, (caddr_t)&arg, p);
 	    }
 
 	case IBCS2_TIOCGWINSZ:
diff --git a/sys/i386/linux/linux_file.c b/sys/i386/linux/linux_file.c
index 66e9312..6a33e68 100644
--- a/sys/i386/linux/linux_file.c
+++ b/sys/i386/linux/linux_file.c
@@ -128,7 +128,7 @@ linux_open(struct proc *p, struct linux_open_args *args)
 	struct file *fp = fdp->fd_ofiles[p->p_retval[0]];
 
 	if (fp->f_type == DTYPE_VNODE)
-	    (fp->f_ops->fo_ioctl)(fp, TIOCSCTTY, (caddr_t) 0, p);
+	    fo_ioctl(fp, TIOCSCTTY, (caddr_t) 0, p);
     }
 #ifdef DEBUG
     printf("Linux-emul(%d): open returns error %d\n", 
diff --git a/sys/i386/linux/linux_ioctl.c b/sys/i386/linux/linux_ioctl.c
index 8507ade..d071bcd 100644
--- a/sys/i386/linux/linux_ioctl.c
+++ b/sys/i386/linux/linux_ioctl.c
@@ -539,7 +539,6 @@ linux_ioctl(struct proc *p, struct linux_ioctl_args *args)
     struct linux_termio linux_termio;
     struct filedesc *fdp = p->p_fd;
     struct file *fp;
-    int (*func)(struct file *fp, u_long com, caddr_t data, struct proc *p);
     int bsd_line, linux_line;
     int error;
 
@@ -555,11 +554,10 @@ linux_ioctl(struct proc *p, struct linux_ioctl_args *args)
 	return EBADF;
     }
 
-    func = fp->f_ops->fo_ioctl;
     switch (args->cmd & 0xffff) {
 
     case LINUX_TCGETA:
-	if ((error = (*func)(fp, TIOCGETA, (caddr_t)&bsd_termios, p)) != 0)
+	if ((error = fo_ioctl(fp, TIOCGETA, (caddr_t)&bsd_termios, p)) != 0)
 	    return error;
 	bsd_to_linux_termio(&bsd_termios, &linux_termio);
 	return copyout((caddr_t)&linux_termio, (caddr_t)args->arg,
@@ -570,24 +568,24 @@ linux_ioctl(struct proc *p, struct linux_ioctl_args *args)
 	if (error)
 	    return error;
 	linux_to_bsd_termio(&linux_termio, &bsd_termios);
-	return (*func)(fp, TIOCSETA, (caddr_t)&bsd_termios, p);
+	return fo_ioctl(fp, TIOCSETA, (caddr_t)&bsd_termios, p);
 
     case LINUX_TCSETAW:
 	error = copyin((caddr_t)args->arg, &linux_termio, sizeof(linux_termio));
 	if (error)
 	    return error;
 	linux_to_bsd_termio(&linux_termio, &bsd_termios);
-	return (*func)(fp, TIOCSETAW, (caddr_t)&bsd_termios, p);
+	return fo_ioctl(fp, TIOCSETAW, (caddr_t)&bsd_termios, p);
 
     case LINUX_TCSETAF:
 	error = copyin((caddr_t)args->arg, &linux_termio, sizeof(linux_termio));
 	if (error)
 	    return error;
 	linux_to_bsd_termio(&linux_termio, &bsd_termios);
-	return (*func)(fp, TIOCSETAF, (caddr_t)&bsd_termios, p);
+	return fo_ioctl(fp, TIOCSETAF, (caddr_t)&bsd_termios, p);
 
     case LINUX_TCGETS:
-	if ((error = (*func)(fp, TIOCGETA, (caddr_t)&bsd_termios, p)) != 0)
+	if ((error = fo_ioctl(fp, TIOCGETA, (caddr_t)&bsd_termios, p)) != 0)
 	    return error;
 	bsd_to_linux_termios(&bsd_termios, &linux_termios);
 	return copyout((caddr_t)&linux_termios, (caddr_t)args->arg,
@@ -599,7 +597,7 @@ linux_ioctl(struct proc *p, struct linux_ioctl_args *args)
 	if (error)
 	    return error;
 	linux_to_bsd_termios(&linux_termios, &bsd_termios);
-	return (*func)(fp, TIOCSETA, (caddr_t)&bsd_termios, p);
+	return fo_ioctl(fp, TIOCSETA, (caddr_t)&bsd_termios, p);
 
     case LINUX_TCSETSW:
 	error = copyin((caddr_t)args->arg, &linux_termios,
@@ -607,7 +605,7 @@ linux_ioctl(struct proc *p, struct linux_ioctl_args *args)
 	if (error)
 	    return error;
 	linux_to_bsd_termios(&linux_termios, &bsd_termios);
-	return (*func)(fp, TIOCSETAW, (caddr_t)&bsd_termios, p);
+	return fo_ioctl(fp, TIOCSETAW, (caddr_t)&bsd_termios, p);
 
     case LINUX_TCSETSF:
 	error = copyin((caddr_t)args->arg, &linux_termios,
@@ -615,7 +613,7 @@ linux_ioctl(struct proc *p, struct linux_ioctl_args *args)
 	if (error)
 	    return error;
 	linux_to_bsd_termios(&linux_termios, &bsd_termios);
-	return (*func)(fp, TIOCSETAF, (caddr_t)&bsd_termios, p);
+	return fo_ioctl(fp, TIOCSETAF, (caddr_t)&bsd_termios, p);
 	    
     case LINUX_TIOCGPGRP:
 	args->cmd = TIOCGPGRP;
@@ -773,20 +771,20 @@ linux_ioctl(struct proc *p, struct linux_ioctl_args *args)
 	switch (args->arg) {
 	case LINUX_N_TTY:
 	    bsd_line = TTYDISC;
-	    return (*func)(fp, TIOCSETD, (caddr_t)&bsd_line, p);
+	    return fo_ioctl(fp, TIOCSETD, (caddr_t)&bsd_line, p);
 	case LINUX_N_SLIP:
 	    bsd_line = SLIPDISC;
-	    return (*func)(fp, TIOCSETD, (caddr_t)&bsd_line, p);
+	    return fo_ioctl(fp, TIOCSETD, (caddr_t)&bsd_line, p);
 	case LINUX_N_PPP:
 	    bsd_line = PPPDISC;
-	    return (*func)(fp, TIOCSETD, (caddr_t)&bsd_line, p);
+	    return fo_ioctl(fp, TIOCSETD, (caddr_t)&bsd_line, p);
 	default:
 	    return EINVAL;
 	}
 
     case LINUX_TIOCGETD:
 	bsd_line = TTYDISC;
-	error =(*func)(fp, TIOCGETD, (caddr_t)&bsd_line, p);
+	error = fo_ioctl(fp, TIOCGETD, (caddr_t)&bsd_line, p);
 	if (error)
 	    return error;
 	switch (bsd_line) {
@@ -1048,7 +1046,7 @@ linux_ioctl(struct proc *p, struct linux_ioctl_args *args)
       case LINUX_TCION: {
 	      u_char c;
 	      struct write_args wr;
-	      error = (*func)(fp, TIOCGETA, (caddr_t)&bsd_termios, p);
+	      error = fo_ioctl(fp, TIOCGETA, (caddr_t)&bsd_termios, p);
               if (error != 0)
 		      return error;
 	      c = bsd_termios.c_cc[args->arg == LINUX_TCIOFF ? VSTOP : VSTART];
@@ -1135,13 +1133,13 @@ linux_ioctl(struct proc *p, struct linux_ioctl_args *args)
 	switch (args->arg) {
 	case LINUX_KBD_RAW:
 	    kbdmode = K_RAW;
-	    return (*func)(fp, KDSKBMODE, (caddr_t)&kbdmode, p);
+	    return fo_ioctl(fp, KDSKBMODE, (caddr_t)&kbdmode, p);
 	case LINUX_KBD_XLATE:  
 	    kbdmode = K_XLATE;
-	    return (*func)(fp, KDSKBMODE , (caddr_t)&kbdmode, p);
+	    return fo_ioctl(fp, KDSKBMODE , (caddr_t)&kbdmode, p);
 	case LINUX_KBD_MEDIUMRAW:
 	    kbdmode = K_RAW;
-	    return (*func)(fp, KDSKBMODE , (caddr_t)&kbdmode, p);
+	    return fo_ioctl(fp, KDSKBMODE , (caddr_t)&kbdmode, p);
 	default:
 	    return EINVAL;
 	}
@@ -1207,7 +1205,7 @@ linux_ioctl(struct proc *p, struct linux_ioctl_args *args)
     case LINUX_CDROMREADTOCHDR: {
 	struct ioc_toc_header th;
 	struct linux_cdrom_tochdr lth;
-	error = (*func)(fp, CDIOREADTOCHEADER, (caddr_t)&th, p);
+	error = fo_ioctl(fp, CDIOREADTOCHEADER, (caddr_t)&th, p);
 	if (!error) {
 	    lth.cdth_trk0 = th.starting_track;
 	    lth.cdth_trk1 = th.ending_track;
@@ -1222,7 +1220,7 @@ linux_ioctl(struct proc *p, struct linux_ioctl_args *args)
 	struct ioc_read_toc_single_entry irtse;
 	irtse.address_format = ltep->cdte_format;
 	irtse.track = ltep->cdte_track;
-	error = (*func)(fp, CDIOREADTOCENTRY, (caddr_t)&irtse, p);
+	error = fo_ioctl(fp, CDIOREADTOCENTRY, (caddr_t)&irtse, p);
 	if (!error) {
 	    lte = *ltep;
 	    lte.cdte_ctrl = irtse.entry.control;
@@ -1248,7 +1246,7 @@ linux_ioctl(struct proc *p, struct linux_ioctl_args *args)
 	bsdsc.data_format = CD_CURRENT_POSITION;
 	bsdsc.data_len = sizeof(struct cd_sub_channel_info);
 	bsdsc.data = bsdinfo;
-	error = (*func)(fp, CDIOCREADSUBCHANNEL, (caddr_t)&bsdsc, p);
+	error = fo_ioctl(fp, CDIOCREADSUBCHANNEL, (caddr_t)&bsdsc, p);
 	if (error)
 	    return error;
 
diff --git a/sys/kern/kern_descrip.c b/sys/kern/kern_descrip.c
index 7e718a2..45f0945 100644
--- a/sys/kern/kern_descrip.c
+++ b/sys/kern/kern_descrip.c
@@ -96,7 +96,7 @@ static struct cdevsw fildesc_cdevsw = {
 
 static int finishdup __P((struct filedesc *fdp, int old, int new, register_t *retval));
 static int badfo_readwrite __P((struct file *fp, struct uio *uio,
-    struct ucred *cred, int flags));
+    struct ucred *cred, int flags, struct proc *p));
 static int badfo_ioctl __P((struct file *fp, u_long com, caddr_t data,
     struct proc *p));
 static int badfo_poll __P((struct file *fp, int events,
@@ -263,26 +263,23 @@ fcntl(p, uap)
 		fp->f_flag &= ~FCNTLFLAGS;
 		fp->f_flag |= FFLAGS(uap->arg & ~O_ACCMODE) & FCNTLFLAGS;
 		tmp = fp->f_flag & FNONBLOCK;
-		error = (*fp->f_ops->fo_ioctl)(fp, FIONBIO, (caddr_t)&tmp, p);
+		error = fo_ioctl(fp, FIONBIO, (caddr_t)&tmp, p);
 		if (error)
 			return (error);
 		tmp = fp->f_flag & FASYNC;
-		error = (*fp->f_ops->fo_ioctl)(fp, FIOASYNC, (caddr_t)&tmp, p);
+		error = fo_ioctl(fp, FIOASYNC, (caddr_t)&tmp, p);
 		if (!error)
 			return (0);
 		fp->f_flag &= ~FNONBLOCK;
 		tmp = 0;
-		(void) (*fp->f_ops->fo_ioctl)(fp, FIONBIO, (caddr_t)&tmp, p);
+		(void)fo_ioctl(fp, FIONBIO, (caddr_t)&tmp, p);
 		return (error);
 
 	case F_GETOWN:
-		error = (*fp->f_ops->fo_ioctl)
-			(fp, FIOGETOWN, (caddr_t)p->p_retval, p);
-		return (error);
+		return (fo_ioctl(fp, FIOGETOWN, (caddr_t)p->p_retval, p));
 
 	case F_SETOWN:
-		return ((*fp->f_ops->fo_ioctl)
-			(fp, FIOSETOWN, (caddr_t)&uap->arg, p));
+		return (fo_ioctl(fp, FIOSETOWN, (caddr_t)&uap->arg, p));
 
 	case F_SETLKW:
 		flg |= F_WAIT;
@@ -360,7 +357,7 @@ finishdup(fdp, old, new, retval)
 	fp = fdp->fd_ofiles[old];
 	fdp->fd_ofiles[new] = fp;
 	fdp->fd_ofileflags[new] = fdp->fd_ofileflags[old] &~ UF_EXCLOSE;
-	fp->f_count++;
+	fhold(fp);
 	if (new > fdp->fd_lastfile)
 		fdp->fd_lastfile = new;
 	*retval = new;
@@ -967,7 +964,7 @@ fdcopy(p)
 	fpp = newfdp->fd_ofiles;
 	for (i = newfdp->fd_lastfile; i-- >= 0; fpp++)
 		if (*fpp != NULL)
-			(*fpp)->f_count++;
+			fhold(*fpp);
 	return (newfdp);
 }
 
@@ -1048,7 +1045,6 @@ closef(fp, p)
 {
 	struct vnode *vp;
 	struct flock lf;
-	int error;
 
 	if (fp == NULL)
 		return (0);
@@ -1068,10 +1064,6 @@ closef(fp, p)
 		vp = (struct vnode *)fp->f_data;
 		(void) VOP_ADVLOCK(vp, (caddr_t)p->p_leader, F_UNLCK, &lf, F_POSIX);
 	}
-	if (--fp->f_count > 0)
-		return (0);
-	if (fp->f_count < 0)
-		panic("closef: count < 0");
 	if ((fp->f_flag & FHASLOCK) && fp->f_type == DTYPE_VNODE) {
 		lf.l_whence = SEEK_SET;
 		lf.l_start = 0;
@@ -1080,8 +1072,22 @@ closef(fp, p)
 		vp = (struct vnode *)fp->f_data;
 		(void) VOP_ADVLOCK(vp, (caddr_t)fp, F_UNLCK, &lf, F_FLOCK);
 	}
+	return (fdrop(fp, p));
+}
+
+int
+fdrop(fp, p)
+	struct file *fp;
+	struct proc *p;
+{
+	int error;
+
+	if (--fp->f_count > 0)
+		return (0);
+	if (fp->f_count < 0)
+		panic("fdrop: count < 0");
 	if (fp->f_ops != &badfileops)
-		error = (*fp->f_ops->fo_close)(fp, p);
+		error = fo_close(fp, p);
 	else
 		error = 0;
 	ffree(fp);
@@ -1212,7 +1218,7 @@ dupfdopen(fdp, indx, dfd, mode, error)
 			return (EACCES);
 		fdp->fd_ofiles[indx] = wfp;
 		fdp->fd_ofileflags[indx] = fdp->fd_ofileflags[dfd];
-		wfp->f_count++;
+		fhold(wfp);
 		if (indx > fdp->fd_lastfile)
 			fdp->fd_lastfile = indx;
 		return (0);
@@ -1309,10 +1315,11 @@ struct fileops badfileops = {
 };
 
 static int
-badfo_readwrite(fp, uio, cred, flags)
+badfo_readwrite(fp, uio, cred, flags, p)
 	struct file *fp;
 	struct uio *uio;
 	struct ucred *cred;
+	struct proc *p;
 	int flags;
 {
 
diff --git a/sys/kern/sys_generic.c b/sys/kern/sys_generic.c
index e187c21..1371f44 100644
--- a/sys/kern/sys_generic.c
+++ b/sys/kern/sys_generic.c
@@ -176,7 +176,7 @@ dofileread(p, fp, fd, buf, nbyte, offset, flags)
 		ktriov = aiov;
 #endif
 	cnt = nbyte;
-	if ((error = (*fp->f_ops->fo_read)(fp, &auio, fp->f_cred, flags)))
+	if ((error = fo_read(fp, &auio, fp->f_cred, flags, p)))
 		if (auio.uio_resid != cnt && (error == ERESTART ||
 		    error == EINTR || error == EWOULDBLOCK))
 			error = 0;
@@ -256,7 +256,7 @@ readv(p, uap)
 	}
 #endif
 	cnt = auio.uio_resid;
-	if ((error = (*fp->f_ops->fo_read)(fp, &auio, fp->f_cred, 0)))
+	if ((error = fo_read(fp, &auio, fp->f_cred, 0, p)))
 		if (auio.uio_resid != cnt && (error == ERESTART ||
 		    error == EINTR || error == EWOULDBLOCK))
 			error = 0;
@@ -360,7 +360,7 @@ dofilewrite(p, fp, fd, buf, nbyte, offset, flags)
 		ktriov = aiov;
 #endif
 	cnt = nbyte;
-	if ((error = (*fp->f_ops->fo_write)(fp, &auio, fp->f_cred, flags))) {
+	if ((error = fo_write(fp, &auio, fp->f_cred, flags, p))) {
 		if (auio.uio_resid != cnt && (error == ERESTART ||
 		    error == EINTR || error == EWOULDBLOCK))
 			error = 0;
@@ -444,7 +444,7 @@ writev(p, uap)
 	}
 #endif
 	cnt = auio.uio_resid;
-	if ((error = (*fp->f_ops->fo_write)(fp, &auio, fp->f_cred, 0))) {
+	if ((error = fo_write(fp, &auio, fp->f_cred, 0, p))) {
 		if (auio.uio_resid != cnt && (error == ERESTART ||
 		    error == EINTR || error == EWOULDBLOCK))
 			error = 0;
@@ -549,7 +549,7 @@ ioctl(p, uap)
 			fp->f_flag |= FNONBLOCK;
 		else
 			fp->f_flag &= ~FNONBLOCK;
-		error = (*fp->f_ops->fo_ioctl)(fp, FIONBIO, (caddr_t)&tmp, p);
+		error = fo_ioctl(fp, FIONBIO, (caddr_t)&tmp, p);
 		break;
 
 	case FIOASYNC:
@@ -557,11 +557,11 @@ ioctl(p, uap)
 			fp->f_flag |= FASYNC;
 		else
 			fp->f_flag &= ~FASYNC;
-		error = (*fp->f_ops->fo_ioctl)(fp, FIOASYNC, (caddr_t)&tmp, p);
+		error = fo_ioctl(fp, FIOASYNC, (caddr_t)&tmp, p);
 		break;
 
 	default:
-		error = (*fp->f_ops->fo_ioctl)(fp, com, data, p);
+		error = fo_ioctl(fp, com, data, p);
 		/*
 		 * Copy any data to user, size was
 		 * already set and checked above.
@@ -740,8 +740,7 @@ selscan(p, ibits, obits, nfd)
 				fp = fdp->fd_ofiles[fd];
 				if (fp == NULL)
 					return (EBADF);
-				if ((*fp->f_ops->fo_poll)(fp, flag[msk],
-				    fp->f_cred, p)) {
+				if (fo_poll(fp, flag[msk], fp->f_cred, p)) {
 					obits[msk][(fd)/NFDBITS] |=
 						(1 << ((fd) % NFDBITS));
 					n++;
@@ -868,8 +867,8 @@ pollscan(p, fds, nfd)
 				 * Note: backend also returns POLLHUP and
 				 * POLLERR if appropriate.
 				 */
-				fds->revents = (*fp->f_ops->fo_poll)(fp,
-				    fds->events, fp->f_cred, p);
+				fds->revents = fo_poll(fp, fds->events,
+				    fp->f_cred, p);
 				if (fds->revents != 0)
 					n++;
 			}
diff --git a/sys/kern/sys_pipe.c b/sys/kern/sys_pipe.c
index e4f6d50..c8f8e35 100644
--- a/sys/kern/sys_pipe.c
+++ b/sys/kern/sys_pipe.c
@@ -88,9 +88,9 @@
  * interfaces to the outside world
  */
 static int pipe_read __P((struct file *fp, struct uio *uio, 
-		struct ucred *cred, int flags));
+		struct ucred *cred, int flags, struct proc *p));
 static int pipe_write __P((struct file *fp, struct uio *uio, 
-		struct ucred *cred, int flags));
+		struct ucred *cred, int flags, struct proc *p));
 static int pipe_close __P((struct file *fp, struct proc *p));
 static int pipe_poll __P((struct file *fp, int events, struct ucred *cred,
 		struct proc *p));
@@ -319,10 +319,11 @@ pipeselwakeup(cpipe)
 
 /* ARGSUSED */
 static int
-pipe_read(fp, uio, cred, flags)
+pipe_read(fp, uio, cred, flags, p)
 	struct file *fp;
 	struct uio *uio;
 	struct ucred *cred;
+	struct proc *p;
 	int flags;
 {
 
@@ -681,10 +682,11 @@ error1:
 #endif
 	
 static int
-pipe_write(fp, uio, cred, flags)
+pipe_write(fp, uio, cred, flags, p)
 	struct file *fp;
 	struct uio *uio;
 	struct ucred *cred;
+	struct proc *p;
 	int flags;
 {
 	int error = 0;
diff --git a/sys/kern/sys_socket.c b/sys/kern/sys_socket.c
index 6ad4383..aa892e3 100644
--- a/sys/kern/sys_socket.c
+++ b/sys/kern/sys_socket.c
@@ -54,10 +54,11 @@ struct	fileops socketops =
 
 /* ARGSUSED */
 int
-soo_read(fp, uio, cred, flags)
+soo_read(fp, uio, cred, flags, p)
 	struct file *fp;
 	struct uio *uio;
 	struct ucred *cred;
+	struct proc *p;
 	int flags;
 {
 	struct socket *so = (struct socket *)fp->f_data;
@@ -66,10 +67,11 @@ soo_read(fp, uio, cred, flags)
 
 /* ARGSUSED */
 int
-soo_write(fp, uio, cred, flags)
+soo_write(fp, uio, cred, flags, p)
 	struct file *fp;
 	struct uio *uio;
 	struct ucred *cred;
+	struct proc *p;
 	int flags;
 {
 	struct socket *so = (struct socket *)fp->f_data;
diff --git a/sys/kern/uipc_syscalls.c b/sys/kern/uipc_syscalls.c
index 05fb328..b87114d 100644
--- a/sys/kern/uipc_syscalls.c
+++ b/sys/kern/uipc_syscalls.c
@@ -1420,6 +1420,7 @@ sendfile(struct proc *p, struct sendfile_args *uap)
 	off_t off, xfsize, sbytes = 0;
 	int error = 0, s;
 
+	vp = NULL;
 	/*
 	 * Do argument checking. Must be a regular file in, stream
 	 * type and connected socket out, positive offset.
@@ -1435,6 +1436,7 @@ sendfile(struct proc *p, struct sendfile_args *uap)
 		goto done;
 	}
 	vp = (struct vnode *)fp->f_data;
+	vref(vp);
 	obj = vp->v_object;
 	if (vp->v_type != VREG || obj == NULL) {
 		error = EINVAL;
@@ -1698,5 +1700,7 @@ done:
 	if (uap->sbytes != NULL) {
 		copyout(&sbytes, uap->sbytes, sizeof(off_t));
 	}
+	if (vp)
+		vrele(vp);
 	return (error);
 }
diff --git a/sys/kern/vfs_aio.c b/sys/kern/vfs_aio.c
index 7caf954..f5a0d58 100644
--- a/sys/kern/vfs_aio.c
+++ b/sys/kern/vfs_aio.c
@@ -564,10 +564,10 @@ aio_process(struct aiocblist *aiocbe)
 	oublock_st = mycp->p_stats->p_ru.ru_oublock;
 	if (cb->aio_lio_opcode == LIO_READ) {
 		auio.uio_rw = UIO_READ;
-		error = (*fp->f_ops->fo_read)(fp, &auio, fp->f_cred, FOF_OFFSET);
+		error = fo_read(fp, &auio, fp->f_cred, FOF_OFFSET, mycp);
 	} else {
 		auio.uio_rw = UIO_WRITE;
-		error = (*fp->f_ops->fo_write)(fp, &auio, fp->f_cred, FOF_OFFSET);
+		error = fo_write(fp, &auio, fp->f_cred, FOF_OFFSET, mycp);
 	}
 	inblock_end = mycp->p_stats->p_ru.ru_inblock;
 	oublock_end = mycp->p_stats->p_ru.ru_oublock;
@@ -1661,7 +1661,7 @@ aio_read(struct proc *p, struct aio_read_args *uap)
 	auio.uio_procp = p;
 
 	cnt = iocb.aio_nbytes;
-	error = (*fp->f_ops->fo_read)(fp, &auio, fp->f_cred, FOF_OFFSET);
+	error = fo_read(fp, &auio, fp->f_cred, FOF_OFFSET, p);
 	if (error &&
 		(auio.uio_resid != cnt) &&
 		(error == ERESTART || error == EINTR || error == EWOULDBLOCK))
@@ -1727,7 +1727,7 @@ aio_write(struct proc *p, struct aio_write_args *uap)
 	auio.uio_procp = p;
 
 	cnt = iocb.aio_nbytes;
-	error = (*fp->f_ops->fo_write)(fp, &auio, fp->f_cred, FOF_OFFSET);
+	error = fo_write(fp, &auio, fp->f_cred, FOF_OFFSET, p);
 	if (error) {
 		if (auio.uio_resid != cnt) {
 			if (error == ERESTART || error == EINTR || error == EWOULDBLOCK)
diff --git a/sys/kern/vfs_vnops.c b/sys/kern/vfs_vnops.c
index c42ebf6..242c696 100644
--- a/sys/kern/vfs_vnops.c
+++ b/sys/kern/vfs_vnops.c
@@ -57,11 +57,11 @@ static int vn_closefile __P((struct file *fp, struct proc *p));
 static int vn_ioctl __P((struct file *fp, u_long com, caddr_t data, 
 		struct proc *p));
 static int vn_read __P((struct file *fp, struct uio *uio, 
-		struct ucred *cred, int flags));
+		struct ucred *cred, int flags, struct proc *p));
 static int vn_poll __P((struct file *fp, int events, struct ucred *cred,
 		struct proc *p));
 static int vn_write __P((struct file *fp, struct uio *uio, 
-		struct ucred *cred, int flags));
+		struct ucred *cred, int flags, struct proc *p));
 
 struct 	fileops vnops =
 	{ vn_read, vn_write, vn_ioctl, vn_poll, vn_closefile };
@@ -274,16 +274,19 @@ vn_rdwr(rw, vp, base, len, offset, segflg, ioflg, cred, aresid, p)
  * File table vnode read routine.
  */
 static int
-vn_read(fp, uio, cred, flags)
+vn_read(fp, uio, cred, flags, p)
 	struct file *fp;
 	struct uio *uio;
 	struct ucred *cred;
+	struct proc *p;
 	int flags;
 {
-	struct vnode *vp = (struct vnode *)fp->f_data;
-	struct proc *p = uio->uio_procp;
+	struct vnode *vp;
 	int error, ioflag;
 
+	KASSERT(uio->uio_procp == p, ("uio_procp %p is not p %p",
+	    uio->uio_procp, p));
+	vp = (struct vnode *)fp->f_data;
 	ioflag = 0;
 	if (fp->f_flag & FNONBLOCK)
 		ioflag |= IO_NDELAY;
@@ -330,16 +333,18 @@ vn_read(fp, uio, cred, flags)
  * File table vnode write routine.
  */
 static int
-vn_write(fp, uio, cred, flags)
+vn_write(fp, uio, cred, flags, p)
 	struct file *fp;
 	struct uio *uio;
 	struct ucred *cred;
+	struct proc *p;
 	int flags;
 {
 	struct vnode *vp;
-	struct proc *p = uio->uio_procp;
 	int error, ioflag;
 
+	KASSERT(uio->uio_procp == p, ("uio_procp %p is not p %p",
+	    uio->uio_procp, p));
 	vp = (struct vnode *)fp->f_data;
 	if (vp->v_type == VREG)
 		bwillwrite();
diff --git a/sys/svr4/svr4_fcntl.c b/sys/svr4/svr4_fcntl.c
index 60b9759..a0b4e39 100644
--- a/sys/svr4/svr4_fcntl.c
+++ b/sys/svr4/svr4_fcntl.c
@@ -379,7 +379,7 @@ svr4_sys_open(p, uap)
 
 		/* ignore any error, just give it a try */
 		if (fp->f_type == DTYPE_VNODE)
-			(fp->f_ops->fo_ioctl) (fp, TIOCSCTTY, (caddr_t) 0, p);
+			fo_ioctl(fp, TIOCSCTTY, (caddr_t) 0, p);
 #endif
 	}
 	return error;
diff --git a/sys/svr4/svr4_filio.c b/sys/svr4/svr4_filio.c
index 0be9f22..9d404c7 100644
--- a/sys/svr4/svr4_filio.c
+++ b/sys/svr4/svr4_filio.c
@@ -196,8 +196,6 @@ svr4_fil_ioctl(fp, p, retval, fd, cmd, data)
 	int error;
 	int num;
 	struct filedesc *fdp = p->p_fd;
-	int (*ctl) __P((struct file *, u_long,  caddr_t, struct proc *)) =
-			fp->f_ops->fo_ioctl;
 
 	*retval = 0;
 
@@ -229,7 +227,7 @@ svr4_fil_ioctl(fp, p, retval, fd, cmd, data)
 #ifdef SVR4_DEBUG
 		if (cmd == FIOASYNC) DPRINTF(("FIOASYNC\n"));
 #endif
-		error = (*ctl)(fp, cmd, (caddr_t) &num, p);
+		error = fo_ioctl(fp, cmd, (caddr_t) &num, p);
 
 		if (error)
 			return error;
diff --git a/sys/svr4/svr4_sockio.c b/sys/svr4/svr4_sockio.c
index 7d61846..8fe8099 100644
--- a/sys/svr4/svr4_sockio.c
+++ b/sys/svr4/svr4_sockio.c
@@ -88,8 +88,6 @@ svr4_sock_ioctl(fp, p, retval, fd, cmd, data)
 	caddr_t data;
 {
 	int error;
-	int (*ctl) __P((struct file *, u_long,  caddr_t, struct proc *)) =
-			fp->f_ops->fo_ioctl;
 
 	*retval = 0;
 
@@ -136,7 +134,7 @@ svr4_sock_ioctl(fp, p, retval, fd, cmd, data)
 
 			(void) strncpy(br.ifr_name, sr.svr4_ifr_name,
 			    sizeof(br.ifr_name));
-			if ((error = (*ctl)(fp, SIOCGIFFLAGS, 
+			if ((error = fo_ioctl(fp, SIOCGIFFLAGS, 
 					    (caddr_t) &br, p)) != 0) {
 				DPRINTF(("SIOCGIFFLAGS (%s) %s: error %d\n", 
 					 br.ifr_name, sr.svr4_ifr_name, error));
@@ -160,7 +158,7 @@ svr4_sock_ioctl(fp, p, retval, fd, cmd, data)
 				sizeof(struct ifreq), sizeof(struct svr4_ifreq),
 				sc.svr4_ifc_len));
 
-			if ((error = (*ctl)(fp, OSIOCGIFCONF,
+			if ((error = fo_ioctl(fp, OSIOCGIFCONF,
 					    (caddr_t) &sc, p)) != 0)
 				return error;
 
diff --git a/sys/svr4/svr4_stream.c b/sys/svr4/svr4_stream.c
index 4ced1bc..873b57a 100644
--- a/sys/svr4/svr4_stream.c
+++ b/sys/svr4/svr4_stream.c
@@ -1255,8 +1255,7 @@ i_nread(fp, p, retval, fd, cmd, dat)
 	 * for us, and if we do, then we assume that we have at least one
 	 * message waiting for us.
 	 */
-	if ((error = (*fp->f_ops->fo_ioctl)(fp, FIONREAD,
-	    (caddr_t) &nread, p)) != 0)
+	if ((error = fo_ioctl(fp, FIONREAD, (caddr_t) &nread, p)) != 0)
 		return error;
 
 	if (nread != 0)
diff --git a/sys/svr4/svr4_termios.c b/sys/svr4/svr4_termios.c
index 450c084..12d533b 100644
--- a/sys/svr4/svr4_termios.c
+++ b/sys/svr4/svr4_termios.c
@@ -502,8 +502,6 @@ svr4_term_ioctl(fp, p, retval, fd, cmd, data)
 	struct svr4_termios	st;
 	struct svr4_termio	t;
 	int			error, new;
-	int (*ctl) __P((struct file *, u_long,  caddr_t, struct proc *)) =
-			fp->f_ops->fo_ioctl;
 
 	*retval = 0;
 
@@ -513,7 +511,7 @@ svr4_term_ioctl(fp, p, retval, fd, cmd, data)
 	case SVR4_TCGETA:
 	case SVR4_TCGETS:
 		DPRINTF(("ioctl(TCGET%c);\n", cmd == SVR4_TCGETA ? 'A' : 'S'));
-		if ((error = (*ctl)(fp, TIOCGETA, (caddr_t) &bt, p)) != 0)
+		if ((error = fo_ioctl(fp, TIOCGETA, (caddr_t) &bt, p)) != 0)
 			return error;
 
 		memset(&st, 0, sizeof(st));
@@ -540,7 +538,7 @@ svr4_term_ioctl(fp, p, retval, fd, cmd, data)
 	case SVR4_TCSETSF:
 	        DPRINTF(("TCSET{A,S,AW,SW,AF,SF}\n"));
 		/* get full BSD termios so we don't lose information */
-		if ((error = (*ctl)(fp, TIOCGETA, (caddr_t) &bt, p)) != 0)
+		if ((error = fo_ioctl(fp, TIOCGETA, (caddr_t) &bt, p)) != 0)
 			return error;
 
 		switch (cmd) {
@@ -591,14 +589,14 @@ svr4_term_ioctl(fp, p, retval, fd, cmd, data)
 		print_svr4_termios(&st);
 #endif /* DEBUG_SVR4 */
 
-		return (*ctl)(fp, cmd, (caddr_t) &bt, p);
+		return fo_ioctl(fp, cmd, (caddr_t) &bt, p);
 
 	case SVR4_TIOCGWINSZ:
 	        DPRINTF(("TIOCGWINSZ\n"));
 		{
 			struct svr4_winsize ws;
 
-			error = (*ctl)(fp, TIOCGWINSZ, (caddr_t) &ws, p);
+			error = fo_ioctl(fp, TIOCGWINSZ, (caddr_t) &ws, p);
 			if (error)
 				return error;
 			return copyout(&ws, data, sizeof(ws));
@@ -611,7 +609,7 @@ svr4_term_ioctl(fp, p, retval, fd, cmd, data)
 
 			if ((error = copyin(data, &ws, sizeof(ws))) != 0)
 				return error;
-			return (*ctl)(fp, TIOCSWINSZ, (caddr_t) &ws, p);
+			return fo_ioctl(fp, TIOCSWINSZ, (caddr_t) &ws, p);
 		}
 
 	default:
diff --git a/sys/svr4/svr4_ttold.c b/sys/svr4/svr4_ttold.c
index d597691..699d44d 100644
--- a/sys/svr4/svr4_ttold.c
+++ b/sys/svr4/svr4_ttold.c
@@ -196,8 +196,6 @@ svr4_ttold_ioctl(fp, p, retval, fd, cmd, data)
 	caddr_t data;
 {
 	int			error;
-	int (*ctl) __P((struct file *, u_long,  caddr_t, struct proc *)) =
-			fp->f_ops->fo_ioctl;
 
 	*retval = 0;
 
@@ -206,8 +204,7 @@ svr4_ttold_ioctl(fp, p, retval, fd, cmd, data)
 		{
 			pid_t pid;
 
-			if ((error = (*ctl)(fp, TIOCGPGRP,
-					    (caddr_t) &pid, p)) != 0)
+			if ((error = fo_ioctl(fp, TIOCGPGRP, (caddr_t) &pid, p)) != 0)
 			    return error;
 
 			DPRINTF(("TIOCGPGRP %d\n", pid));
@@ -226,15 +223,14 @@ svr4_ttold_ioctl(fp, p, retval, fd, cmd, data)
 
 			DPRINTF(("TIOCSPGRP %d\n", pid));
 
-			return (*ctl)(fp, TIOCSPGRP, (caddr_t) &pid, p);
+			return fo_ioctl(fp, TIOCSPGRP, (caddr_t) &pid, p);
 		}
 
 	case SVR4_TIOCGSID:
 		{
 #if defined(TIOCGSID)
 			pid_t pid;
-			if ((error = (*ctl)(fp, TIOCGSID,
-					    (caddr_t) &pid, p)) != 0)
+			if ((error = fo_ioctl(fp, TIOCGSID, (caddr_t) &pid, p)) != 0)
 				return error;
 
 			DPRINTF(("TIOCGSID %d\n", pid));
@@ -251,7 +247,7 @@ svr4_ttold_ioctl(fp, p, retval, fd, cmd, data)
 			struct sgttyb bs;
 			struct svr4_sgttyb ss;
 
-			error = (*ctl)(fp, TIOCGETP, (caddr_t) &bs, p);
+			error = fo_ioctl(fp, TIOCGETP, (caddr_t) &bs, p);
 			if (error)
 				return error;
 
@@ -276,7 +272,7 @@ svr4_ttold_ioctl(fp, p, retval, fd, cmd, data)
 			print_svr4_sgttyb("SVR4_TIOCSET{P,N}", &ss);
 #endif /* DEBUG_SVR4 */
 			cmd = (cmd == SVR4_TIOCSETP) ? TIOCSETP : TIOCSETN;
-			return (*ctl)(fp, cmd, (caddr_t) &bs, p);
+			return fo_ioctl(fp, cmd, (caddr_t) &bs, p);
 		}
 
 	case SVR4_TIOCGETC:
@@ -284,7 +280,7 @@ svr4_ttold_ioctl(fp, p, retval, fd, cmd, data)
 			struct tchars bt;
 			struct svr4_tchars st;
 
-			error = (*ctl)(fp, TIOCGETC, (caddr_t) &bt, p);
+			error = fo_ioctl(fp, TIOCGETC, (caddr_t) &bt, p);
 			if (error)
 				return error;
 
@@ -307,7 +303,7 @@ svr4_ttold_ioctl(fp, p, retval, fd, cmd, data)
 #ifdef DEBUG_SVR4
 			print_svr4_tchars("SVR4_TIOCSETC", &st);
 #endif /* DEBUG_SVR4 */
-			return (*ctl)(fp, TIOCSETC, (caddr_t) &bt, p);
+			return fo_ioctl(fp, TIOCSETC, (caddr_t) &bt, p);
 		}
 
 	case SVR4_TIOCGLTC:
@@ -315,7 +311,7 @@ svr4_ttold_ioctl(fp, p, retval, fd, cmd, data)
 			struct ltchars bl;
 			struct svr4_ltchars sl;
 
-			error = (*ctl)(fp, TIOCGLTC, (caddr_t) &bl, p);
+			error = fo_ioctl(fp, TIOCGLTC, (caddr_t) &bl, p);
 			if (error)
 				return error;
 
@@ -338,14 +334,13 @@ svr4_ttold_ioctl(fp, p, retval, fd, cmd, data)
 #ifdef DEBUG_SVR4
 			print_svr4_ltchars("SVR4_TIOCSLTC", &sl);
 #endif /* DEBUG_SVR4 */
-			return (*ctl)(fp, TIOCSLTC, (caddr_t) &bl, p);
+			return fo_ioctl(fp, TIOCSLTC, (caddr_t) &bl, p);
 		}
 
 	case SVR4_TIOCLGET:
 		{
 			int flags;
-			if ((error = (*ctl)(fp, TIOCLGET,
-					    (caddr_t) &flags, p)) != 0)
+			if ((error = fo_ioctl(fp, TIOCLGET, (caddr_t) &flags, p)) != 0)
 				return error;
 			DPRINTF(("SVR4_TIOCLGET %o\n", flags));
 			return copyout(&flags, data, sizeof(flags));
@@ -373,7 +368,7 @@ svr4_ttold_ioctl(fp, p, retval, fd, cmd, data)
 			}
 
 			DPRINTF(("SVR4_TIOCL{SET,BIS,BIC} %o\n", flags));
-			return (*ctl)(fp, cmd, (caddr_t) &flags, p);
+			return fo_ioctl(fp, cmd, (caddr_t) &flags, p);
 		}
 
 	default:
diff --git a/sys/sys/file.h b/sys/sys/file.h
index 072a765..47557d4 100644
--- a/sys/sys/file.h
+++ b/sys/sys/file.h
@@ -65,9 +65,11 @@ struct file {
 	struct	ucred *f_cred;	/* credentials associated with descriptor */
 	struct	fileops {
 		int	(*fo_read)	__P((struct file *fp, struct uio *uio,
-					    struct ucred *cred, int flags));
+					    struct ucred *cred, int flags,
+					    struct proc *p));
 		int	(*fo_write)	__P((struct file *fp, struct uio *uio,
-					    struct ucred *cred, int flags));
+					    struct ucred *cred, int flags,
+					    struct proc *p));
 #define	FOF_OFFSET	1
 		int	(*fo_ioctl)	__P((struct file *fp, u_long com,
 					    caddr_t data, struct proc *p));
@@ -98,6 +100,98 @@ extern int maxfiles;		/* kernel limit on number of open files */
 extern int maxfilesperproc;	/* per process limit on number of open files */
 extern int nfiles;		/* actual number of open files */
 
+static __inline void fhold __P((struct file *fp));
+int fdrop __P((struct file *fp, struct proc *p));
+
+static __inline void
+fhold(fp)
+	struct file *fp;
+{
+
+	fp->f_count++;
+}
+
+static __inline int fo_read __P((struct file *fp, struct uio *uio,
+    struct ucred *cred, int flags, struct proc *p));
+static __inline int fo_write __P((struct file *fp, struct uio *uio,
+    struct ucred *cred, int flags, struct proc *p));
+static __inline int fo_ioctl __P((struct file *fp, u_long com, caddr_t data,
+    struct proc *p));
+static __inline int fo_poll __P((struct file *fp, int events,
+    struct ucred *cred, struct proc *p));
+static __inline int fo_close __P((struct file *fp, struct proc *p));
+
+static __inline int
+fo_read(fp, uio, cred, flags, p)
+	struct file *fp;
+	struct uio *uio;
+	struct ucred *cred;
+	struct proc *p;
+	int flags;
+{
+	int error;
+
+	fhold(fp);
+	error = (*fp->f_ops->fo_read)(fp, uio, cred, flags, p);
+	fdrop(fp, p);
+	return (error);
+}
+
+static __inline int
+fo_write(fp, uio, cred, flags, p)
+	struct file *fp;
+	struct uio *uio;
+	struct ucred *cred;
+	struct proc *p;
+	int flags;
+{
+	int error;
+
+	fhold(fp);
+	error = (*fp->f_ops->fo_write)(fp, uio, cred, flags, p);
+	fdrop(fp, p);
+	return (error);
+}
+
+static __inline int
+fo_ioctl(fp, com, data, p)
+	struct file *fp;
+	u_long com;
+	caddr_t data;
+	struct proc *p;
+{
+	int error;
+
+	fhold(fp);
+	error = (*fp->f_ops->fo_ioctl)(fp, com, data, p);
+	fdrop(fp, p);
+	return (error);
+}
+
+static __inline int
+fo_poll(fp, events, cred, p)
+	struct file *fp;
+	int events;
+	struct ucred *cred;
+	struct proc *p;
+{
+	int error;
+
+	fhold(fp);
+	error = (*fp->f_ops->fo_poll)(fp, events, cred, p);
+	fdrop(fp, p);
+	return (error);
+}
+
+static __inline int
+fo_close(fp, p)
+	struct file *fp;
+	struct proc *p;
+{
+
+	return ((*fp->f_ops->fo_close)(fp, p));
+}
+
 #endif /* KERNEL */
 
 #endif /* !SYS_FILE_H */
diff --git a/sys/sys/socketvar.h b/sys/sys/socketvar.h
index 25123fb..b9539ca 100644
--- a/sys/sys/socketvar.h
+++ b/sys/sys/socketvar.h
@@ -288,9 +288,9 @@ struct uio;
  * File operations on sockets.
  */
 int	soo_read __P((struct file *fp, struct uio *uio, struct ucred *cred,
-	    int flags));
+	    int flags, struct proc *p));
 int	soo_write __P((struct file *fp, struct uio *uio, struct ucred *cred,
-	    int flags));
+	    int flags, struct proc *p));
 int	soo_close __P((struct file *fp, struct proc *p));
 int	soo_ioctl __P((struct file *fp, u_long cmd, caddr_t data,
 	    struct proc *p));