xref: /freebsd-src/sys/fs/devfs/devfs_vnops.c (revision 2b15cb3d0922bd70ea592f0da9b4a5b167f4d53f)
1 /*-
2  * Copyright (c) 2000-2004
3  *	Poul-Henning Kamp.  All rights reserved.
4  * Copyright (c) 1989, 1992-1993, 1995
5  *	The Regents of the University of California.  All rights reserved.
6  *
7  * This code is derived from software donated to Berkeley by
8  * Jan-Simon Pendry.
9  *
10  * Redistribution and use in source and binary forms, with or without
11  * modification, are permitted provided that the following conditions
12  * are met:
13  * 1. Redistributions of source code must retain the above copyright
14  *    notice, this list of conditions and the following disclaimer.
15  * 2. Neither the name of the University nor the names of its contributors
16  *    may be used to endorse or promote products derived from this software
17  *    without specific prior written permission.
18  *
19  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
20  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
21  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
22  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
23  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
24  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
25  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
26  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
27  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
28  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
29  * SUCH DAMAGE.
30  *
31  *	@(#)kernfs_vnops.c	8.15 (Berkeley) 5/21/95
32  * From: FreeBSD: src/sys/miscfs/kernfs/kernfs_vnops.c 1.43
33  *
34  * $FreeBSD$
35  */
36 
37 /*
38  * TODO:
39  *	mkdir: want it ?
40  */
41 
42 #include <sys/param.h>
43 #include <sys/systm.h>
44 #include <sys/conf.h>
45 #include <sys/dirent.h>
46 #include <sys/fcntl.h>
47 #include <sys/file.h>
48 #include <sys/filedesc.h>
49 #include <sys/filio.h>
50 #include <sys/jail.h>
51 #include <sys/kernel.h>
52 #include <sys/lock.h>
53 #include <sys/malloc.h>
54 #include <sys/mount.h>
55 #include <sys/namei.h>
56 #include <sys/priv.h>
57 #include <sys/proc.h>
58 #include <sys/stat.h>
59 #include <sys/sx.h>
60 #include <sys/sysctl.h>
61 #include <sys/time.h>
62 #include <sys/ttycom.h>
63 #include <sys/unistd.h>
64 #include <sys/vnode.h>
65 
66 static struct vop_vector devfs_vnodeops;
67 static struct fileops devfs_ops_f;
68 
69 #include <fs/devfs/devfs.h>
70 #include <fs/devfs/devfs_int.h>
71 
72 #include <security/mac/mac_framework.h>
73 
74 static MALLOC_DEFINE(M_CDEVPDATA, "DEVFSP", "Metainfo for cdev-fp data");
75 
76 struct mtx	devfs_de_interlock;
77 MTX_SYSINIT(devfs_de_interlock, &devfs_de_interlock, "devfs interlock", MTX_DEF);
78 struct sx	clone_drain_lock;
79 SX_SYSINIT(clone_drain_lock, &clone_drain_lock, "clone events drain lock");
80 struct mtx	cdevpriv_mtx;
81 MTX_SYSINIT(cdevpriv_mtx, &cdevpriv_mtx, "cdevpriv lock", MTX_DEF);
82 
83 SYSCTL_DECL(_vfs_devfs);
84 
85 static int devfs_dotimes;
86 SYSCTL_INT(_vfs_devfs, OID_AUTO, dotimes, CTLFLAG_RW,
87         &devfs_dotimes, 0, "Update timestamps on DEVFS");
88 
89 static int
90 devfs_fp_check(struct file *fp, struct cdev **devp, struct cdevsw **dswp,
91     int *ref)
92 {
93 
94 	*dswp = devvn_refthread(fp->f_vnode, devp, ref);
95 	if (*devp != fp->f_data) {
96 		if (*dswp != NULL)
97 			dev_relthread(*devp, *ref);
98 		return (ENXIO);
99 	}
100 	KASSERT((*devp)->si_refcount > 0,
101 	    ("devfs: un-referenced struct cdev *(%s)", devtoname(*devp)));
102 	if (*dswp == NULL)
103 		return (ENXIO);
104 	curthread->td_fpop = fp;
105 	return (0);
106 }
107 
108 int
109 devfs_get_cdevpriv(void **datap)
110 {
111 	struct file *fp;
112 	struct cdev_privdata *p;
113 	int error;
114 
115 	fp = curthread->td_fpop;
116 	if (fp == NULL)
117 		return (EBADF);
118 	p = fp->f_cdevpriv;
119 	if (p != NULL) {
120 		error = 0;
121 		*datap = p->cdpd_data;
122 	} else
123 		error = ENOENT;
124 	return (error);
125 }
126 
127 int
128 devfs_set_cdevpriv(void *priv, cdevpriv_dtr_t priv_dtr)
129 {
130 	struct file *fp;
131 	struct cdev_priv *cdp;
132 	struct cdev_privdata *p;
133 	int error;
134 
135 	fp = curthread->td_fpop;
136 	if (fp == NULL)
137 		return (ENOENT);
138 	cdp = cdev2priv((struct cdev *)fp->f_data);
139 	p = malloc(sizeof(struct cdev_privdata), M_CDEVPDATA, M_WAITOK);
140 	p->cdpd_data = priv;
141 	p->cdpd_dtr = priv_dtr;
142 	p->cdpd_fp = fp;
143 	mtx_lock(&cdevpriv_mtx);
144 	if (fp->f_cdevpriv == NULL) {
145 		LIST_INSERT_HEAD(&cdp->cdp_fdpriv, p, cdpd_list);
146 		fp->f_cdevpriv = p;
147 		mtx_unlock(&cdevpriv_mtx);
148 		error = 0;
149 	} else {
150 		mtx_unlock(&cdevpriv_mtx);
151 		free(p, M_CDEVPDATA);
152 		error = EBUSY;
153 	}
154 	return (error);
155 }
156 
157 void
158 devfs_destroy_cdevpriv(struct cdev_privdata *p)
159 {
160 
161 	mtx_assert(&cdevpriv_mtx, MA_OWNED);
162 	p->cdpd_fp->f_cdevpriv = NULL;
163 	LIST_REMOVE(p, cdpd_list);
164 	mtx_unlock(&cdevpriv_mtx);
165 	(p->cdpd_dtr)(p->cdpd_data);
166 	free(p, M_CDEVPDATA);
167 }
168 
169 void
170 devfs_fpdrop(struct file *fp)
171 {
172 	struct cdev_privdata *p;
173 
174 	mtx_lock(&cdevpriv_mtx);
175 	if ((p = fp->f_cdevpriv) == NULL) {
176 		mtx_unlock(&cdevpriv_mtx);
177 		return;
178 	}
179 	devfs_destroy_cdevpriv(p);
180 }
181 
182 void
183 devfs_clear_cdevpriv(void)
184 {
185 	struct file *fp;
186 
187 	fp = curthread->td_fpop;
188 	if (fp == NULL)
189 		return;
190 	devfs_fpdrop(fp);
191 }
192 
193 /*
194  * On success devfs_populate_vp() returns with dmp->dm_lock held.
195  */
196 static int
197 devfs_populate_vp(struct vnode *vp)
198 {
199 	struct devfs_dirent *de;
200 	struct devfs_mount *dmp;
201 	int locked;
202 
203 	ASSERT_VOP_LOCKED(vp, "devfs_populate_vp");
204 
205 	dmp = VFSTODEVFS(vp->v_mount);
206 	locked = VOP_ISLOCKED(vp);
207 
208 	sx_xlock(&dmp->dm_lock);
209 	DEVFS_DMP_HOLD(dmp);
210 
211 	/* Can't call devfs_populate() with the vnode lock held. */
212 	VOP_UNLOCK(vp, 0);
213 	devfs_populate(dmp);
214 
215 	sx_xunlock(&dmp->dm_lock);
216 	vn_lock(vp, locked | LK_RETRY);
217 	sx_xlock(&dmp->dm_lock);
218 	if (DEVFS_DMP_DROP(dmp)) {
219 		sx_xunlock(&dmp->dm_lock);
220 		devfs_unmount_final(dmp);
221 		return (EBADF);
222 	}
223 	if ((vp->v_iflag & VI_DOOMED) != 0) {
224 		sx_xunlock(&dmp->dm_lock);
225 		return (EBADF);
226 	}
227 	de = vp->v_data;
228 	KASSERT(de != NULL,
229 	    ("devfs_populate_vp: vp->v_data == NULL but vnode not doomed"));
230 	if ((de->de_flags & DE_DOOMED) != 0) {
231 		sx_xunlock(&dmp->dm_lock);
232 		return (EBADF);
233 	}
234 
235 	return (0);
236 }
237 
238 static int
239 devfs_vptocnp(struct vop_vptocnp_args *ap)
240 {
241 	struct vnode *vp = ap->a_vp;
242 	struct vnode **dvp = ap->a_vpp;
243 	struct devfs_mount *dmp;
244 	char *buf = ap->a_buf;
245 	int *buflen = ap->a_buflen;
246 	struct devfs_dirent *dd, *de;
247 	int i, error;
248 
249 	dmp = VFSTODEVFS(vp->v_mount);
250 
251 	error = devfs_populate_vp(vp);
252 	if (error != 0)
253 		return (error);
254 
255 	i = *buflen;
256 	dd = vp->v_data;
257 
258 	if (vp->v_type == VCHR) {
259 		i -= strlen(dd->de_cdp->cdp_c.si_name);
260 		if (i < 0) {
261 			error = ENOMEM;
262 			goto finished;
263 		}
264 		bcopy(dd->de_cdp->cdp_c.si_name, buf + i,
265 		    strlen(dd->de_cdp->cdp_c.si_name));
266 		de = dd->de_dir;
267 	} else if (vp->v_type == VDIR) {
268 		if (dd == dmp->dm_rootdir) {
269 			*dvp = vp;
270 			vref(*dvp);
271 			goto finished;
272 		}
273 		i -= dd->de_dirent->d_namlen;
274 		if (i < 0) {
275 			error = ENOMEM;
276 			goto finished;
277 		}
278 		bcopy(dd->de_dirent->d_name, buf + i,
279 		    dd->de_dirent->d_namlen);
280 		de = dd;
281 	} else {
282 		error = ENOENT;
283 		goto finished;
284 	}
285 	*buflen = i;
286 	de = devfs_parent_dirent(de);
287 	if (de == NULL) {
288 		error = ENOENT;
289 		goto finished;
290 	}
291 	mtx_lock(&devfs_de_interlock);
292 	*dvp = de->de_vnode;
293 	if (*dvp != NULL) {
294 		VI_LOCK(*dvp);
295 		mtx_unlock(&devfs_de_interlock);
296 		vholdl(*dvp);
297 		VI_UNLOCK(*dvp);
298 		vref(*dvp);
299 		vdrop(*dvp);
300 	} else {
301 		mtx_unlock(&devfs_de_interlock);
302 		error = ENOENT;
303 	}
304 finished:
305 	sx_xunlock(&dmp->dm_lock);
306 	return (error);
307 }
308 
309 /*
310  * Construct the fully qualified path name relative to the mountpoint.
311  * If a NULL cnp is provided, no '/' is appended to the resulting path.
312  */
313 char *
314 devfs_fqpn(char *buf, struct devfs_mount *dmp, struct devfs_dirent *dd,
315     struct componentname *cnp)
316 {
317 	int i;
318 	struct devfs_dirent *de;
319 
320 	sx_assert(&dmp->dm_lock, SA_LOCKED);
321 
322 	i = SPECNAMELEN;
323 	buf[i] = '\0';
324 	if (cnp != NULL)
325 		i -= cnp->cn_namelen;
326 	if (i < 0)
327 		 return (NULL);
328 	if (cnp != NULL)
329 		bcopy(cnp->cn_nameptr, buf + i, cnp->cn_namelen);
330 	de = dd;
331 	while (de != dmp->dm_rootdir) {
332 		if (cnp != NULL || i < SPECNAMELEN) {
333 			i--;
334 			if (i < 0)
335 				 return (NULL);
336 			buf[i] = '/';
337 		}
338 		i -= de->de_dirent->d_namlen;
339 		if (i < 0)
340 			 return (NULL);
341 		bcopy(de->de_dirent->d_name, buf + i,
342 		    de->de_dirent->d_namlen);
343 		de = devfs_parent_dirent(de);
344 		if (de == NULL)
345 			return (NULL);
346 	}
347 	return (buf + i);
348 }
349 
350 static int
351 devfs_allocv_drop_refs(int drop_dm_lock, struct devfs_mount *dmp,
352 	struct devfs_dirent *de)
353 {
354 	int not_found;
355 
356 	not_found = 0;
357 	if (de->de_flags & DE_DOOMED)
358 		not_found = 1;
359 	if (DEVFS_DE_DROP(de)) {
360 		KASSERT(not_found == 1, ("DEVFS de dropped but not doomed"));
361 		devfs_dirent_free(de);
362 	}
363 	if (DEVFS_DMP_DROP(dmp)) {
364 		KASSERT(not_found == 1,
365 			("DEVFS mount struct freed before dirent"));
366 		not_found = 2;
367 		sx_xunlock(&dmp->dm_lock);
368 		devfs_unmount_final(dmp);
369 	}
370 	if (not_found == 1 || (drop_dm_lock && not_found != 2))
371 		sx_unlock(&dmp->dm_lock);
372 	return (not_found);
373 }
374 
375 static void
376 devfs_insmntque_dtr(struct vnode *vp, void *arg)
377 {
378 	struct devfs_dirent *de;
379 
380 	de = (struct devfs_dirent *)arg;
381 	mtx_lock(&devfs_de_interlock);
382 	vp->v_data = NULL;
383 	de->de_vnode = NULL;
384 	mtx_unlock(&devfs_de_interlock);
385 	vgone(vp);
386 	vput(vp);
387 }
388 
389 /*
390  * devfs_allocv shall be entered with dmp->dm_lock held, and it drops
391  * it on return.
392  */
393 int
394 devfs_allocv(struct devfs_dirent *de, struct mount *mp, int lockmode,
395     struct vnode **vpp)
396 {
397 	int error;
398 	struct vnode *vp;
399 	struct cdev *dev;
400 	struct devfs_mount *dmp;
401 	struct cdevsw *dsw;
402 
403 	dmp = VFSTODEVFS(mp);
404 	if (de->de_flags & DE_DOOMED) {
405 		sx_xunlock(&dmp->dm_lock);
406 		return (ENOENT);
407 	}
408 loop:
409 	DEVFS_DE_HOLD(de);
410 	DEVFS_DMP_HOLD(dmp);
411 	mtx_lock(&devfs_de_interlock);
412 	vp = de->de_vnode;
413 	if (vp != NULL) {
414 		VI_LOCK(vp);
415 		mtx_unlock(&devfs_de_interlock);
416 		sx_xunlock(&dmp->dm_lock);
417 		vget(vp, lockmode | LK_INTERLOCK | LK_RETRY, curthread);
418 		sx_xlock(&dmp->dm_lock);
419 		if (devfs_allocv_drop_refs(0, dmp, de)) {
420 			vput(vp);
421 			return (ENOENT);
422 		}
423 		else if ((vp->v_iflag & VI_DOOMED) != 0) {
424 			mtx_lock(&devfs_de_interlock);
425 			if (de->de_vnode == vp) {
426 				de->de_vnode = NULL;
427 				vp->v_data = NULL;
428 			}
429 			mtx_unlock(&devfs_de_interlock);
430 			vput(vp);
431 			goto loop;
432 		}
433 		sx_xunlock(&dmp->dm_lock);
434 		*vpp = vp;
435 		return (0);
436 	}
437 	mtx_unlock(&devfs_de_interlock);
438 	if (de->de_dirent->d_type == DT_CHR) {
439 		if (!(de->de_cdp->cdp_flags & CDP_ACTIVE)) {
440 			devfs_allocv_drop_refs(1, dmp, de);
441 			return (ENOENT);
442 		}
443 		dev = &de->de_cdp->cdp_c;
444 	} else {
445 		dev = NULL;
446 	}
447 	error = getnewvnode("devfs", mp, &devfs_vnodeops, &vp);
448 	if (error != 0) {
449 		devfs_allocv_drop_refs(1, dmp, de);
450 		printf("devfs_allocv: failed to allocate new vnode\n");
451 		return (error);
452 	}
453 
454 	if (de->de_dirent->d_type == DT_CHR) {
455 		vp->v_type = VCHR;
456 		VI_LOCK(vp);
457 		dev_lock();
458 		dev_refl(dev);
459 		/* XXX: v_rdev should be protect by vnode lock */
460 		vp->v_rdev = dev;
461 		KASSERT(vp->v_usecount == 1,
462 		    ("%s %d (%d)\n", __func__, __LINE__, vp->v_usecount));
463 		dev->si_usecount += vp->v_usecount;
464 		/* Special casing of ttys for deadfs.  Probably redundant. */
465 		dsw = dev->si_devsw;
466 		if (dsw != NULL && (dsw->d_flags & D_TTY) != 0)
467 			vp->v_vflag |= VV_ISTTY;
468 		dev_unlock();
469 		VI_UNLOCK(vp);
470 		if ((dev->si_flags & SI_ETERNAL) != 0)
471 			vp->v_vflag |= VV_ETERNALDEV;
472 		vp->v_op = &devfs_specops;
473 	} else if (de->de_dirent->d_type == DT_DIR) {
474 		vp->v_type = VDIR;
475 	} else if (de->de_dirent->d_type == DT_LNK) {
476 		vp->v_type = VLNK;
477 	} else {
478 		vp->v_type = VBAD;
479 	}
480 	vn_lock(vp, LK_EXCLUSIVE | LK_RETRY | LK_NOWITNESS);
481 	VN_LOCK_ASHARE(vp);
482 	mtx_lock(&devfs_de_interlock);
483 	vp->v_data = de;
484 	de->de_vnode = vp;
485 	mtx_unlock(&devfs_de_interlock);
486 	error = insmntque1(vp, mp, devfs_insmntque_dtr, de);
487 	if (error != 0) {
488 		(void) devfs_allocv_drop_refs(1, dmp, de);
489 		return (error);
490 	}
491 	if (devfs_allocv_drop_refs(0, dmp, de)) {
492 		vput(vp);
493 		return (ENOENT);
494 	}
495 #ifdef MAC
496 	mac_devfs_vnode_associate(mp, de, vp);
497 #endif
498 	sx_xunlock(&dmp->dm_lock);
499 	*vpp = vp;
500 	return (0);
501 }
502 
503 static int
504 devfs_access(struct vop_access_args *ap)
505 {
506 	struct vnode *vp = ap->a_vp;
507 	struct devfs_dirent *de;
508 	struct proc *p;
509 	int error;
510 
511 	de = vp->v_data;
512 	if (vp->v_type == VDIR)
513 		de = de->de_dir;
514 
515 	error = vaccess(vp->v_type, de->de_mode, de->de_uid, de->de_gid,
516 	    ap->a_accmode, ap->a_cred, NULL);
517 	if (error == 0)
518 		return (0);
519 	if (error != EACCES)
520 		return (error);
521 	p = ap->a_td->td_proc;
522 	/* We do, however, allow access to the controlling terminal */
523 	PROC_LOCK(p);
524 	if (!(p->p_flag & P_CONTROLT)) {
525 		PROC_UNLOCK(p);
526 		return (error);
527 	}
528 	if (p->p_session->s_ttydp == de->de_cdp)
529 		error = 0;
530 	PROC_UNLOCK(p);
531 	return (error);
532 }
533 
534 /* ARGSUSED */
535 static int
536 devfs_close(struct vop_close_args *ap)
537 {
538 	struct vnode *vp = ap->a_vp, *oldvp;
539 	struct thread *td = ap->a_td;
540 	struct proc *p;
541 	struct cdev *dev = vp->v_rdev;
542 	struct cdevsw *dsw;
543 	int vp_locked, error, ref;
544 
545 	/*
546 	 * XXX: Don't call d_close() if we were called because of
547 	 * XXX: insmntque1() failure.
548 	 */
549 	if (vp->v_data == NULL)
550 		return (0);
551 
552 	/*
553 	 * Hack: a tty device that is a controlling terminal
554 	 * has a reference from the session structure.
555 	 * We cannot easily tell that a character device is
556 	 * a controlling terminal, unless it is the closing
557 	 * process' controlling terminal.  In that case,
558 	 * if the reference count is 2 (this last descriptor
559 	 * plus the session), release the reference from the session.
560 	 */
561 	if (td != NULL) {
562 		p = td->td_proc;
563 		PROC_LOCK(p);
564 		if (vp == p->p_session->s_ttyvp) {
565 			PROC_UNLOCK(p);
566 			oldvp = NULL;
567 			sx_xlock(&proctree_lock);
568 			if (vp == p->p_session->s_ttyvp) {
569 				SESS_LOCK(p->p_session);
570 				VI_LOCK(vp);
571 				if (count_dev(dev) == 2 &&
572 				    (vp->v_iflag & VI_DOOMED) == 0) {
573 					p->p_session->s_ttyvp = NULL;
574 					p->p_session->s_ttydp = NULL;
575 					oldvp = vp;
576 				}
577 				VI_UNLOCK(vp);
578 				SESS_UNLOCK(p->p_session);
579 			}
580 			sx_xunlock(&proctree_lock);
581 			if (oldvp != NULL)
582 				vrele(oldvp);
583 		} else
584 			PROC_UNLOCK(p);
585 	}
586 	/*
587 	 * We do not want to really close the device if it
588 	 * is still in use unless we are trying to close it
589 	 * forcibly. Since every use (buffer, vnode, swap, cmap)
590 	 * holds a reference to the vnode, and because we mark
591 	 * any other vnodes that alias this device, when the
592 	 * sum of the reference counts on all the aliased
593 	 * vnodes descends to one, we are on last close.
594 	 */
595 	dsw = dev_refthread(dev, &ref);
596 	if (dsw == NULL)
597 		return (ENXIO);
598 	VI_LOCK(vp);
599 	if (vp->v_iflag & VI_DOOMED) {
600 		/* Forced close. */
601 	} else if (dsw->d_flags & D_TRACKCLOSE) {
602 		/* Keep device updated on status. */
603 	} else if (count_dev(dev) > 1) {
604 		VI_UNLOCK(vp);
605 		dev_relthread(dev, ref);
606 		return (0);
607 	}
608 	vholdl(vp);
609 	VI_UNLOCK(vp);
610 	vp_locked = VOP_ISLOCKED(vp);
611 	VOP_UNLOCK(vp, 0);
612 	KASSERT(dev->si_refcount > 0,
613 	    ("devfs_close() on un-referenced struct cdev *(%s)", devtoname(dev)));
614 	error = dsw->d_close(dev, ap->a_fflag, S_IFCHR, td);
615 	dev_relthread(dev, ref);
616 	vn_lock(vp, vp_locked | LK_RETRY);
617 	vdrop(vp);
618 	return (error);
619 }
620 
621 static int
622 devfs_close_f(struct file *fp, struct thread *td)
623 {
624 	int error;
625 	struct file *fpop;
626 
627 	/*
628 	 * NB: td may be NULL if this descriptor is closed due to
629 	 * garbage collection from a closed UNIX domain socket.
630 	 */
631 	fpop = curthread->td_fpop;
632 	curthread->td_fpop = fp;
633 	error = vnops.fo_close(fp, td);
634 	curthread->td_fpop = fpop;
635 
636 	/*
637 	 * The f_cdevpriv cannot be assigned non-NULL value while we
638 	 * are destroying the file.
639 	 */
640 	if (fp->f_cdevpriv != NULL)
641 		devfs_fpdrop(fp);
642 	return (error);
643 }
644 
645 static int
646 devfs_fsync(struct vop_fsync_args *ap)
647 {
648 	int error;
649 	struct bufobj *bo;
650 	struct devfs_dirent *de;
651 
652 	if (!vn_isdisk(ap->a_vp, &error)) {
653 		bo = &ap->a_vp->v_bufobj;
654 		de = ap->a_vp->v_data;
655 		if (error == ENXIO && bo->bo_dirty.bv_cnt > 0) {
656 			printf("Device %s went missing before all of the data "
657 			    "could be written to it; expect data loss.\n",
658 			    de->de_dirent->d_name);
659 
660 			error = vop_stdfsync(ap);
661 			if (bo->bo_dirty.bv_cnt != 0 || error != 0)
662 				panic("devfs_fsync: vop_stdfsync failed.");
663 		}
664 
665 		return (0);
666 	}
667 
668 	return (vop_stdfsync(ap));
669 }
670 
671 static int
672 devfs_getattr(struct vop_getattr_args *ap)
673 {
674 	struct vnode *vp = ap->a_vp;
675 	struct vattr *vap = ap->a_vap;
676 	int error;
677 	struct devfs_dirent *de;
678 	struct devfs_mount *dmp;
679 	struct cdev *dev;
680 
681 	error = devfs_populate_vp(vp);
682 	if (error != 0)
683 		return (error);
684 
685 	dmp = VFSTODEVFS(vp->v_mount);
686 	sx_xunlock(&dmp->dm_lock);
687 
688 	de = vp->v_data;
689 	KASSERT(de != NULL, ("Null dirent in devfs_getattr vp=%p", vp));
690 	if (vp->v_type == VDIR) {
691 		de = de->de_dir;
692 		KASSERT(de != NULL,
693 		    ("Null dir dirent in devfs_getattr vp=%p", vp));
694 	}
695 	vap->va_uid = de->de_uid;
696 	vap->va_gid = de->de_gid;
697 	vap->va_mode = de->de_mode;
698 	if (vp->v_type == VLNK)
699 		vap->va_size = strlen(de->de_symlink);
700 	else if (vp->v_type == VDIR)
701 		vap->va_size = vap->va_bytes = DEV_BSIZE;
702 	else
703 		vap->va_size = 0;
704 	if (vp->v_type != VDIR)
705 		vap->va_bytes = 0;
706 	vap->va_blocksize = DEV_BSIZE;
707 	vap->va_type = vp->v_type;
708 
709 #define fix(aa)							\
710 	do {							\
711 		if ((aa).tv_sec <= 3600) {			\
712 			(aa).tv_sec = boottime.tv_sec;		\
713 			(aa).tv_nsec = boottime.tv_usec * 1000; \
714 		}						\
715 	} while (0)
716 
717 	if (vp->v_type != VCHR)  {
718 		fix(de->de_atime);
719 		vap->va_atime = de->de_atime;
720 		fix(de->de_mtime);
721 		vap->va_mtime = de->de_mtime;
722 		fix(de->de_ctime);
723 		vap->va_ctime = de->de_ctime;
724 	} else {
725 		dev = vp->v_rdev;
726 		fix(dev->si_atime);
727 		vap->va_atime = dev->si_atime;
728 		fix(dev->si_mtime);
729 		vap->va_mtime = dev->si_mtime;
730 		fix(dev->si_ctime);
731 		vap->va_ctime = dev->si_ctime;
732 
733 		vap->va_rdev = cdev2priv(dev)->cdp_inode;
734 	}
735 	vap->va_gen = 0;
736 	vap->va_flags = 0;
737 	vap->va_filerev = 0;
738 	vap->va_nlink = de->de_links;
739 	vap->va_fileid = de->de_inode;
740 
741 	return (error);
742 }
743 
744 /* ARGSUSED */
745 static int
746 devfs_ioctl_f(struct file *fp, u_long com, void *data, struct ucred *cred, struct thread *td)
747 {
748 	struct cdev *dev;
749 	struct cdevsw *dsw;
750 	struct vnode *vp;
751 	struct vnode *vpold;
752 	int error, i, ref;
753 	const char *p;
754 	struct fiodgname_arg *fgn;
755 	struct file *fpop;
756 
757 	fpop = td->td_fpop;
758 	error = devfs_fp_check(fp, &dev, &dsw, &ref);
759 	if (error != 0) {
760 		error = vnops.fo_ioctl(fp, com, data, cred, td);
761 		return (error);
762 	}
763 
764 	if (com == FIODTYPE) {
765 		*(int *)data = dsw->d_flags & D_TYPEMASK;
766 		td->td_fpop = fpop;
767 		dev_relthread(dev, ref);
768 		return (0);
769 	} else if (com == FIODGNAME) {
770 		fgn = data;
771 		p = devtoname(dev);
772 		i = strlen(p) + 1;
773 		if (i > fgn->len)
774 			error = EINVAL;
775 		else
776 			error = copyout(p, fgn->buf, i);
777 		td->td_fpop = fpop;
778 		dev_relthread(dev, ref);
779 		return (error);
780 	}
781 	error = dsw->d_ioctl(dev, com, data, fp->f_flag, td);
782 	td->td_fpop = NULL;
783 	dev_relthread(dev, ref);
784 	if (error == ENOIOCTL)
785 		error = ENOTTY;
786 	if (error == 0 && com == TIOCSCTTY) {
787 		vp = fp->f_vnode;
788 
789 		/* Do nothing if reassigning same control tty */
790 		sx_slock(&proctree_lock);
791 		if (td->td_proc->p_session->s_ttyvp == vp) {
792 			sx_sunlock(&proctree_lock);
793 			return (0);
794 		}
795 
796 		vpold = td->td_proc->p_session->s_ttyvp;
797 		VREF(vp);
798 		SESS_LOCK(td->td_proc->p_session);
799 		td->td_proc->p_session->s_ttyvp = vp;
800 		td->td_proc->p_session->s_ttydp = cdev2priv(dev);
801 		SESS_UNLOCK(td->td_proc->p_session);
802 
803 		sx_sunlock(&proctree_lock);
804 
805 		/* Get rid of reference to old control tty */
806 		if (vpold)
807 			vrele(vpold);
808 	}
809 	return (error);
810 }
811 
812 /* ARGSUSED */
813 static int
814 devfs_kqfilter_f(struct file *fp, struct knote *kn)
815 {
816 	struct cdev *dev;
817 	struct cdevsw *dsw;
818 	int error, ref;
819 	struct file *fpop;
820 	struct thread *td;
821 
822 	td = curthread;
823 	fpop = td->td_fpop;
824 	error = devfs_fp_check(fp, &dev, &dsw, &ref);
825 	if (error)
826 		return (error);
827 	error = dsw->d_kqfilter(dev, kn);
828 	td->td_fpop = fpop;
829 	dev_relthread(dev, ref);
830 	return (error);
831 }
832 
833 static inline int
834 devfs_prison_check(struct devfs_dirent *de, struct thread *td)
835 {
836 	struct cdev_priv *cdp;
837 	struct ucred *dcr;
838 	struct proc *p;
839 	int error;
840 
841 	cdp = de->de_cdp;
842 	if (cdp == NULL)
843 		return (0);
844 	dcr = cdp->cdp_c.si_cred;
845 	if (dcr == NULL)
846 		return (0);
847 
848 	error = prison_check(td->td_ucred, dcr);
849 	if (error == 0)
850 		return (0);
851 	/* We do, however, allow access to the controlling terminal */
852 	p = td->td_proc;
853 	PROC_LOCK(p);
854 	if (!(p->p_flag & P_CONTROLT)) {
855 		PROC_UNLOCK(p);
856 		return (error);
857 	}
858 	if (p->p_session->s_ttydp == cdp)
859 		error = 0;
860 	PROC_UNLOCK(p);
861 	return (error);
862 }
863 
864 static int
865 devfs_lookupx(struct vop_lookup_args *ap, int *dm_unlock)
866 {
867 	struct componentname *cnp;
868 	struct vnode *dvp, **vpp;
869 	struct thread *td;
870 	struct devfs_dirent *de, *dd;
871 	struct devfs_dirent **dde;
872 	struct devfs_mount *dmp;
873 	struct cdev *cdev;
874 	int error, flags, nameiop, dvplocked;
875 	char specname[SPECNAMELEN + 1], *pname;
876 
877 	cnp = ap->a_cnp;
878 	vpp = ap->a_vpp;
879 	dvp = ap->a_dvp;
880 	pname = cnp->cn_nameptr;
881 	td = cnp->cn_thread;
882 	flags = cnp->cn_flags;
883 	nameiop = cnp->cn_nameiop;
884 	dmp = VFSTODEVFS(dvp->v_mount);
885 	dd = dvp->v_data;
886 	*vpp = NULLVP;
887 
888 	if ((flags & ISLASTCN) && nameiop == RENAME)
889 		return (EOPNOTSUPP);
890 
891 	if (dvp->v_type != VDIR)
892 		return (ENOTDIR);
893 
894 	if ((flags & ISDOTDOT) && (dvp->v_vflag & VV_ROOT))
895 		return (EIO);
896 
897 	error = VOP_ACCESS(dvp, VEXEC, cnp->cn_cred, td);
898 	if (error)
899 		return (error);
900 
901 	if (cnp->cn_namelen == 1 && *pname == '.') {
902 		if ((flags & ISLASTCN) && nameiop != LOOKUP)
903 			return (EINVAL);
904 		*vpp = dvp;
905 		VREF(dvp);
906 		return (0);
907 	}
908 
909 	if (flags & ISDOTDOT) {
910 		if ((flags & ISLASTCN) && nameiop != LOOKUP)
911 			return (EINVAL);
912 		de = devfs_parent_dirent(dd);
913 		if (de == NULL)
914 			return (ENOENT);
915 		dvplocked = VOP_ISLOCKED(dvp);
916 		VOP_UNLOCK(dvp, 0);
917 		error = devfs_allocv(de, dvp->v_mount,
918 		    cnp->cn_lkflags & LK_TYPE_MASK, vpp);
919 		*dm_unlock = 0;
920 		vn_lock(dvp, dvplocked | LK_RETRY);
921 		return (error);
922 	}
923 
924 	dd = dvp->v_data;
925 	de = devfs_find(dd, cnp->cn_nameptr, cnp->cn_namelen, 0);
926 	while (de == NULL) {	/* While(...) so we can use break */
927 
928 		if (nameiop == DELETE)
929 			return (ENOENT);
930 
931 		/*
932 		 * OK, we didn't have an entry for the name we were asked for
933 		 * so we try to see if anybody can create it on demand.
934 		 */
935 		pname = devfs_fqpn(specname, dmp, dd, cnp);
936 		if (pname == NULL)
937 			break;
938 
939 		cdev = NULL;
940 		DEVFS_DMP_HOLD(dmp);
941 		sx_xunlock(&dmp->dm_lock);
942 		sx_slock(&clone_drain_lock);
943 		EVENTHANDLER_INVOKE(dev_clone,
944 		    td->td_ucred, pname, strlen(pname), &cdev);
945 		sx_sunlock(&clone_drain_lock);
946 
947 		if (cdev == NULL)
948 			sx_xlock(&dmp->dm_lock);
949 		else if (devfs_populate_vp(dvp) != 0) {
950 			*dm_unlock = 0;
951 			sx_xlock(&dmp->dm_lock);
952 			if (DEVFS_DMP_DROP(dmp)) {
953 				sx_xunlock(&dmp->dm_lock);
954 				devfs_unmount_final(dmp);
955 			} else
956 				sx_xunlock(&dmp->dm_lock);
957 			dev_rel(cdev);
958 			return (ENOENT);
959 		}
960 		if (DEVFS_DMP_DROP(dmp)) {
961 			*dm_unlock = 0;
962 			sx_xunlock(&dmp->dm_lock);
963 			devfs_unmount_final(dmp);
964 			if (cdev != NULL)
965 				dev_rel(cdev);
966 			return (ENOENT);
967 		}
968 
969 		if (cdev == NULL)
970 			break;
971 
972 		dev_lock();
973 		dde = &cdev2priv(cdev)->cdp_dirents[dmp->dm_idx];
974 		if (dde != NULL && *dde != NULL)
975 			de = *dde;
976 		dev_unlock();
977 		dev_rel(cdev);
978 		break;
979 	}
980 
981 	if (de == NULL || de->de_flags & DE_WHITEOUT) {
982 		if ((nameiop == CREATE || nameiop == RENAME) &&
983 		    (flags & (LOCKPARENT | WANTPARENT)) && (flags & ISLASTCN)) {
984 			cnp->cn_flags |= SAVENAME;
985 			return (EJUSTRETURN);
986 		}
987 		return (ENOENT);
988 	}
989 
990 	if (devfs_prison_check(de, td))
991 		return (ENOENT);
992 
993 	if ((cnp->cn_nameiop == DELETE) && (flags & ISLASTCN)) {
994 		error = VOP_ACCESS(dvp, VWRITE, cnp->cn_cred, td);
995 		if (error)
996 			return (error);
997 		if (*vpp == dvp) {
998 			VREF(dvp);
999 			*vpp = dvp;
1000 			return (0);
1001 		}
1002 	}
1003 	error = devfs_allocv(de, dvp->v_mount, cnp->cn_lkflags & LK_TYPE_MASK,
1004 	    vpp);
1005 	*dm_unlock = 0;
1006 	return (error);
1007 }
1008 
1009 static int
1010 devfs_lookup(struct vop_lookup_args *ap)
1011 {
1012 	int j;
1013 	struct devfs_mount *dmp;
1014 	int dm_unlock;
1015 
1016 	if (devfs_populate_vp(ap->a_dvp) != 0)
1017 		return (ENOTDIR);
1018 
1019 	dmp = VFSTODEVFS(ap->a_dvp->v_mount);
1020 	dm_unlock = 1;
1021 	j = devfs_lookupx(ap, &dm_unlock);
1022 	if (dm_unlock == 1)
1023 		sx_xunlock(&dmp->dm_lock);
1024 	return (j);
1025 }
1026 
1027 static int
1028 devfs_mknod(struct vop_mknod_args *ap)
1029 {
1030 	struct componentname *cnp;
1031 	struct vnode *dvp, **vpp;
1032 	struct devfs_dirent *dd, *de;
1033 	struct devfs_mount *dmp;
1034 	int error;
1035 
1036 	/*
1037 	 * The only type of node we should be creating here is a
1038 	 * character device, for anything else return EOPNOTSUPP.
1039 	 */
1040 	if (ap->a_vap->va_type != VCHR)
1041 		return (EOPNOTSUPP);
1042 	dvp = ap->a_dvp;
1043 	dmp = VFSTODEVFS(dvp->v_mount);
1044 
1045 	cnp = ap->a_cnp;
1046 	vpp = ap->a_vpp;
1047 	dd = dvp->v_data;
1048 
1049 	error = ENOENT;
1050 	sx_xlock(&dmp->dm_lock);
1051 	TAILQ_FOREACH(de, &dd->de_dlist, de_list) {
1052 		if (cnp->cn_namelen != de->de_dirent->d_namlen)
1053 			continue;
1054 		if (de->de_dirent->d_type == DT_CHR &&
1055 		    (de->de_cdp->cdp_flags & CDP_ACTIVE) == 0)
1056 			continue;
1057 		if (bcmp(cnp->cn_nameptr, de->de_dirent->d_name,
1058 		    de->de_dirent->d_namlen) != 0)
1059 			continue;
1060 		if (de->de_flags & DE_WHITEOUT)
1061 			break;
1062 		goto notfound;
1063 	}
1064 	if (de == NULL)
1065 		goto notfound;
1066 	de->de_flags &= ~DE_WHITEOUT;
1067 	error = devfs_allocv(de, dvp->v_mount, LK_EXCLUSIVE, vpp);
1068 	return (error);
1069 notfound:
1070 	sx_xunlock(&dmp->dm_lock);
1071 	return (error);
1072 }
1073 
1074 /* ARGSUSED */
1075 static int
1076 devfs_open(struct vop_open_args *ap)
1077 {
1078 	struct thread *td = ap->a_td;
1079 	struct vnode *vp = ap->a_vp;
1080 	struct cdev *dev = vp->v_rdev;
1081 	struct file *fp = ap->a_fp;
1082 	int error, ref, vlocked;
1083 	struct cdevsw *dsw;
1084 	struct file *fpop;
1085 	struct mtx *mtxp;
1086 
1087 	if (vp->v_type == VBLK)
1088 		return (ENXIO);
1089 
1090 	if (dev == NULL)
1091 		return (ENXIO);
1092 
1093 	/* Make this field valid before any I/O in d_open. */
1094 	if (dev->si_iosize_max == 0)
1095 		dev->si_iosize_max = DFLTPHYS;
1096 
1097 	dsw = dev_refthread(dev, &ref);
1098 	if (dsw == NULL)
1099 		return (ENXIO);
1100 	if (fp == NULL && dsw->d_fdopen != NULL) {
1101 		dev_relthread(dev, ref);
1102 		return (ENXIO);
1103 	}
1104 
1105 	vlocked = VOP_ISLOCKED(vp);
1106 	VOP_UNLOCK(vp, 0);
1107 
1108 	fpop = td->td_fpop;
1109 	td->td_fpop = fp;
1110 	if (fp != NULL) {
1111 		fp->f_data = dev;
1112 		fp->f_vnode = vp;
1113 	}
1114 	if (dsw->d_fdopen != NULL)
1115 		error = dsw->d_fdopen(dev, ap->a_mode, td, fp);
1116 	else
1117 		error = dsw->d_open(dev, ap->a_mode, S_IFCHR, td);
1118 	/* cleanup any cdevpriv upon error */
1119 	if (error != 0)
1120 		devfs_clear_cdevpriv();
1121 	td->td_fpop = fpop;
1122 
1123 	vn_lock(vp, vlocked | LK_RETRY);
1124 	dev_relthread(dev, ref);
1125 	if (error != 0) {
1126 		if (error == ERESTART)
1127 			error = EINTR;
1128 		return (error);
1129 	}
1130 
1131 #if 0	/* /dev/console */
1132 	KASSERT(fp != NULL, ("Could not vnode bypass device on NULL fp"));
1133 #else
1134 	if (fp == NULL)
1135 		return (error);
1136 #endif
1137 	if (fp->f_ops == &badfileops)
1138 		finit(fp, fp->f_flag, DTYPE_VNODE, dev, &devfs_ops_f);
1139 	mtxp = mtx_pool_find(mtxpool_sleep, fp);
1140 
1141 	/*
1142 	 * Hint to the dofilewrite() to not force the buffer draining
1143 	 * on the writer to the file.  Most likely, the write would
1144 	 * not need normal buffers.
1145 	 */
1146 	mtx_lock(mtxp);
1147 	fp->f_vnread_flags |= FDEVFS_VNODE;
1148 	mtx_unlock(mtxp);
1149 	return (error);
1150 }
1151 
1152 static int
1153 devfs_pathconf(struct vop_pathconf_args *ap)
1154 {
1155 
1156 	switch (ap->a_name) {
1157 	case _PC_MAC_PRESENT:
1158 #ifdef MAC
1159 		/*
1160 		 * If MAC is enabled, devfs automatically supports
1161 		 * trivial non-persistant label storage.
1162 		 */
1163 		*ap->a_retval = 1;
1164 #else
1165 		*ap->a_retval = 0;
1166 #endif
1167 		return (0);
1168 	default:
1169 		return (vop_stdpathconf(ap));
1170 	}
1171 	/* NOTREACHED */
1172 }
1173 
1174 /* ARGSUSED */
1175 static int
1176 devfs_poll_f(struct file *fp, int events, struct ucred *cred, struct thread *td)
1177 {
1178 	struct cdev *dev;
1179 	struct cdevsw *dsw;
1180 	int error, ref;
1181 	struct file *fpop;
1182 
1183 	fpop = td->td_fpop;
1184 	error = devfs_fp_check(fp, &dev, &dsw, &ref);
1185 	if (error != 0) {
1186 		error = vnops.fo_poll(fp, events, cred, td);
1187 		return (error);
1188 	}
1189 	error = dsw->d_poll(dev, events, td);
1190 	td->td_fpop = fpop;
1191 	dev_relthread(dev, ref);
1192 	return(error);
1193 }
1194 
1195 /*
1196  * Print out the contents of a special device vnode.
1197  */
1198 static int
1199 devfs_print(struct vop_print_args *ap)
1200 {
1201 
1202 	printf("\tdev %s\n", devtoname(ap->a_vp->v_rdev));
1203 	return (0);
1204 }
1205 
1206 static int
1207 devfs_read_f(struct file *fp, struct uio *uio, struct ucred *cred,
1208     int flags, struct thread *td)
1209 {
1210 	struct cdev *dev;
1211 	int ioflag, error, ref;
1212 	ssize_t resid;
1213 	struct cdevsw *dsw;
1214 	struct file *fpop;
1215 
1216 	if (uio->uio_resid > DEVFS_IOSIZE_MAX)
1217 		return (EINVAL);
1218 	fpop = td->td_fpop;
1219 	error = devfs_fp_check(fp, &dev, &dsw, &ref);
1220 	if (error != 0) {
1221 		error = vnops.fo_read(fp, uio, cred, flags, td);
1222 		return (error);
1223 	}
1224 	resid = uio->uio_resid;
1225 	ioflag = fp->f_flag & (O_NONBLOCK | O_DIRECT);
1226 	if (ioflag & O_DIRECT)
1227 		ioflag |= IO_DIRECT;
1228 
1229 	foffset_lock_uio(fp, uio, flags | FOF_NOLOCK);
1230 	error = dsw->d_read(dev, uio, ioflag);
1231 	if (devfs_dotimes &&
1232 	    (uio->uio_resid != resid || (error == 0 && resid != 0)))
1233 		vfs_timestamp(&dev->si_atime);
1234 	td->td_fpop = fpop;
1235 	dev_relthread(dev, ref);
1236 
1237 	foffset_unlock_uio(fp, uio, flags | FOF_NOLOCK | FOF_NEXTOFF);
1238 	return (error);
1239 }
1240 
1241 static int
1242 devfs_readdir(struct vop_readdir_args *ap)
1243 {
1244 	int error;
1245 	struct uio *uio;
1246 	struct dirent *dp;
1247 	struct devfs_dirent *dd;
1248 	struct devfs_dirent *de;
1249 	struct devfs_mount *dmp;
1250 	off_t off;
1251 	int *tmp_ncookies = NULL;
1252 
1253 	if (ap->a_vp->v_type != VDIR)
1254 		return (ENOTDIR);
1255 
1256 	uio = ap->a_uio;
1257 	if (uio->uio_offset < 0)
1258 		return (EINVAL);
1259 
1260 	/*
1261 	 * XXX: This is a temporary hack to get around this filesystem not
1262 	 * supporting cookies. We store the location of the ncookies pointer
1263 	 * in a temporary variable before calling vfs_subr.c:vfs_read_dirent()
1264 	 * and set the number of cookies to 0. We then set the pointer to
1265 	 * NULL so that vfs_read_dirent doesn't try to call realloc() on
1266 	 * ap->a_cookies. Later in this function, we restore the ap->a_ncookies
1267 	 * pointer to its original location before returning to the caller.
1268 	 */
1269 	if (ap->a_ncookies != NULL) {
1270 		tmp_ncookies = ap->a_ncookies;
1271 		*ap->a_ncookies = 0;
1272 		ap->a_ncookies = NULL;
1273 	}
1274 
1275 	dmp = VFSTODEVFS(ap->a_vp->v_mount);
1276 	if (devfs_populate_vp(ap->a_vp) != 0) {
1277 		if (tmp_ncookies != NULL)
1278 			ap->a_ncookies = tmp_ncookies;
1279 		return (EIO);
1280 	}
1281 	error = 0;
1282 	de = ap->a_vp->v_data;
1283 	off = 0;
1284 	TAILQ_FOREACH(dd, &de->de_dlist, de_list) {
1285 		KASSERT(dd->de_cdp != (void *)0xdeadc0de, ("%s %d\n", __func__, __LINE__));
1286 		if (dd->de_flags & (DE_COVERED | DE_WHITEOUT))
1287 			continue;
1288 		if (devfs_prison_check(dd, uio->uio_td))
1289 			continue;
1290 		if (dd->de_dirent->d_type == DT_DIR)
1291 			de = dd->de_dir;
1292 		else
1293 			de = dd;
1294 		dp = dd->de_dirent;
1295 		if (dp->d_reclen > uio->uio_resid)
1296 			break;
1297 		dp->d_fileno = de->de_inode;
1298 		if (off >= uio->uio_offset) {
1299 			error = vfs_read_dirent(ap, dp, off);
1300 			if (error)
1301 				break;
1302 		}
1303 		off += dp->d_reclen;
1304 	}
1305 	sx_xunlock(&dmp->dm_lock);
1306 	uio->uio_offset = off;
1307 
1308 	/*
1309 	 * Restore ap->a_ncookies if it wasn't originally NULL in the first
1310 	 * place.
1311 	 */
1312 	if (tmp_ncookies != NULL)
1313 		ap->a_ncookies = tmp_ncookies;
1314 
1315 	return (error);
1316 }
1317 
1318 static int
1319 devfs_readlink(struct vop_readlink_args *ap)
1320 {
1321 	struct devfs_dirent *de;
1322 
1323 	de = ap->a_vp->v_data;
1324 	return (uiomove(de->de_symlink, strlen(de->de_symlink), ap->a_uio));
1325 }
1326 
1327 static int
1328 devfs_reclaim(struct vop_reclaim_args *ap)
1329 {
1330 	struct vnode *vp = ap->a_vp;
1331 	struct devfs_dirent *de;
1332 	struct cdev *dev;
1333 
1334 	mtx_lock(&devfs_de_interlock);
1335 	de = vp->v_data;
1336 	if (de != NULL) {
1337 		de->de_vnode = NULL;
1338 		vp->v_data = NULL;
1339 	}
1340 	mtx_unlock(&devfs_de_interlock);
1341 
1342 	vnode_destroy_vobject(vp);
1343 
1344 	VI_LOCK(vp);
1345 	dev_lock();
1346 	dev = vp->v_rdev;
1347 	vp->v_rdev = NULL;
1348 
1349 	if (dev == NULL) {
1350 		dev_unlock();
1351 		VI_UNLOCK(vp);
1352 		return (0);
1353 	}
1354 
1355 	dev->si_usecount -= vp->v_usecount;
1356 	dev_unlock();
1357 	VI_UNLOCK(vp);
1358 	dev_rel(dev);
1359 	return (0);
1360 }
1361 
1362 static int
1363 devfs_remove(struct vop_remove_args *ap)
1364 {
1365 	struct vnode *dvp = ap->a_dvp;
1366 	struct vnode *vp = ap->a_vp;
1367 	struct devfs_dirent *dd;
1368 	struct devfs_dirent *de, *de_covered;
1369 	struct devfs_mount *dmp = VFSTODEVFS(vp->v_mount);
1370 
1371 	ASSERT_VOP_ELOCKED(dvp, "devfs_remove");
1372 	ASSERT_VOP_ELOCKED(vp, "devfs_remove");
1373 
1374 	sx_xlock(&dmp->dm_lock);
1375 	dd = ap->a_dvp->v_data;
1376 	de = vp->v_data;
1377 	if (de->de_cdp == NULL) {
1378 		TAILQ_REMOVE(&dd->de_dlist, de, de_list);
1379 		if (de->de_dirent->d_type == DT_LNK) {
1380 			de_covered = devfs_find(dd, de->de_dirent->d_name,
1381 			    de->de_dirent->d_namlen, 0);
1382 			if (de_covered != NULL)
1383 				de_covered->de_flags &= ~DE_COVERED;
1384 		}
1385 		/* We need to unlock dvp because devfs_delete() may lock it. */
1386 		VOP_UNLOCK(vp, 0);
1387 		if (dvp != vp)
1388 			VOP_UNLOCK(dvp, 0);
1389 		devfs_delete(dmp, de, 0);
1390 		sx_xunlock(&dmp->dm_lock);
1391 		if (dvp != vp)
1392 			vn_lock(dvp, LK_EXCLUSIVE | LK_RETRY);
1393 		vn_lock(vp, LK_EXCLUSIVE | LK_RETRY);
1394 	} else {
1395 		de->de_flags |= DE_WHITEOUT;
1396 		sx_xunlock(&dmp->dm_lock);
1397 	}
1398 	return (0);
1399 }
1400 
1401 /*
1402  * Revoke is called on a tty when a terminal session ends.  The vnode
1403  * is orphaned by setting v_op to deadfs so we need to let go of it
1404  * as well so that we create a new one next time around.
1405  *
1406  */
1407 static int
1408 devfs_revoke(struct vop_revoke_args *ap)
1409 {
1410 	struct vnode *vp = ap->a_vp, *vp2;
1411 	struct cdev *dev;
1412 	struct cdev_priv *cdp;
1413 	struct devfs_dirent *de;
1414 	int i;
1415 
1416 	KASSERT((ap->a_flags & REVOKEALL) != 0, ("devfs_revoke !REVOKEALL"));
1417 
1418 	dev = vp->v_rdev;
1419 	cdp = cdev2priv(dev);
1420 
1421 	dev_lock();
1422 	cdp->cdp_inuse++;
1423 	dev_unlock();
1424 
1425 	vhold(vp);
1426 	vgone(vp);
1427 	vdrop(vp);
1428 
1429 	VOP_UNLOCK(vp,0);
1430  loop:
1431 	for (;;) {
1432 		mtx_lock(&devfs_de_interlock);
1433 		dev_lock();
1434 		vp2 = NULL;
1435 		for (i = 0; i <= cdp->cdp_maxdirent; i++) {
1436 			de = cdp->cdp_dirents[i];
1437 			if (de == NULL)
1438 				continue;
1439 
1440 			vp2 = de->de_vnode;
1441 			if (vp2 != NULL) {
1442 				dev_unlock();
1443 				VI_LOCK(vp2);
1444 				mtx_unlock(&devfs_de_interlock);
1445 				if (vget(vp2, LK_EXCLUSIVE | LK_INTERLOCK,
1446 				    curthread))
1447 					goto loop;
1448 				vhold(vp2);
1449 				vgone(vp2);
1450 				vdrop(vp2);
1451 				vput(vp2);
1452 				break;
1453 			}
1454 		}
1455 		if (vp2 != NULL) {
1456 			continue;
1457 		}
1458 		dev_unlock();
1459 		mtx_unlock(&devfs_de_interlock);
1460 		break;
1461 	}
1462 	dev_lock();
1463 	cdp->cdp_inuse--;
1464 	if (!(cdp->cdp_flags & CDP_ACTIVE) && cdp->cdp_inuse == 0) {
1465 		TAILQ_REMOVE(&cdevp_list, cdp, cdp_list);
1466 		dev_unlock();
1467 		dev_rel(&cdp->cdp_c);
1468 	} else
1469 		dev_unlock();
1470 
1471 	vn_lock(vp, LK_EXCLUSIVE | LK_RETRY);
1472 	return (0);
1473 }
1474 
1475 static int
1476 devfs_rioctl(struct vop_ioctl_args *ap)
1477 {
1478 	struct vnode *vp;
1479 	struct devfs_mount *dmp;
1480 	int error;
1481 
1482 	vp = ap->a_vp;
1483 	vn_lock(vp, LK_SHARED | LK_RETRY);
1484 	if (vp->v_iflag & VI_DOOMED) {
1485 		VOP_UNLOCK(vp, 0);
1486 		return (EBADF);
1487 	}
1488 	dmp = VFSTODEVFS(vp->v_mount);
1489 	sx_xlock(&dmp->dm_lock);
1490 	VOP_UNLOCK(vp, 0);
1491 	DEVFS_DMP_HOLD(dmp);
1492 	devfs_populate(dmp);
1493 	if (DEVFS_DMP_DROP(dmp)) {
1494 		sx_xunlock(&dmp->dm_lock);
1495 		devfs_unmount_final(dmp);
1496 		return (ENOENT);
1497 	}
1498 	error = devfs_rules_ioctl(dmp, ap->a_command, ap->a_data, ap->a_td);
1499 	sx_xunlock(&dmp->dm_lock);
1500 	return (error);
1501 }
1502 
1503 static int
1504 devfs_rread(struct vop_read_args *ap)
1505 {
1506 
1507 	if (ap->a_vp->v_type != VDIR)
1508 		return (EINVAL);
1509 	return (VOP_READDIR(ap->a_vp, ap->a_uio, ap->a_cred, NULL, NULL, NULL));
1510 }
1511 
1512 static int
1513 devfs_setattr(struct vop_setattr_args *ap)
1514 {
1515 	struct devfs_dirent *de;
1516 	struct vattr *vap;
1517 	struct vnode *vp;
1518 	struct thread *td;
1519 	int c, error;
1520 	uid_t uid;
1521 	gid_t gid;
1522 
1523 	vap = ap->a_vap;
1524 	vp = ap->a_vp;
1525 	td = curthread;
1526 	if ((vap->va_type != VNON) ||
1527 	    (vap->va_nlink != VNOVAL) ||
1528 	    (vap->va_fsid != VNOVAL) ||
1529 	    (vap->va_fileid != VNOVAL) ||
1530 	    (vap->va_blocksize != VNOVAL) ||
1531 	    (vap->va_flags != VNOVAL && vap->va_flags != 0) ||
1532 	    (vap->va_rdev != VNOVAL) ||
1533 	    ((int)vap->va_bytes != VNOVAL) ||
1534 	    (vap->va_gen != VNOVAL)) {
1535 		return (EINVAL);
1536 	}
1537 
1538 	de = vp->v_data;
1539 	if (vp->v_type == VDIR)
1540 		de = de->de_dir;
1541 
1542 	error = c = 0;
1543 	if (vap->va_uid == (uid_t)VNOVAL)
1544 		uid = de->de_uid;
1545 	else
1546 		uid = vap->va_uid;
1547 	if (vap->va_gid == (gid_t)VNOVAL)
1548 		gid = de->de_gid;
1549 	else
1550 		gid = vap->va_gid;
1551 	if (uid != de->de_uid || gid != de->de_gid) {
1552 		if ((ap->a_cred->cr_uid != de->de_uid) || uid != de->de_uid ||
1553 		    (gid != de->de_gid && !groupmember(gid, ap->a_cred))) {
1554 			error = priv_check(td, PRIV_VFS_CHOWN);
1555 			if (error)
1556 				return (error);
1557 		}
1558 		de->de_uid = uid;
1559 		de->de_gid = gid;
1560 		c = 1;
1561 	}
1562 
1563 	if (vap->va_mode != (mode_t)VNOVAL) {
1564 		if (ap->a_cred->cr_uid != de->de_uid) {
1565 			error = priv_check(td, PRIV_VFS_ADMIN);
1566 			if (error)
1567 				return (error);
1568 		}
1569 		de->de_mode = vap->va_mode;
1570 		c = 1;
1571 	}
1572 
1573 	if (vap->va_atime.tv_sec != VNOVAL || vap->va_mtime.tv_sec != VNOVAL) {
1574 		error = vn_utimes_perm(vp, vap, ap->a_cred, td);
1575 		if (error != 0)
1576 			return (error);
1577 		if (vap->va_atime.tv_sec != VNOVAL) {
1578 			if (vp->v_type == VCHR)
1579 				vp->v_rdev->si_atime = vap->va_atime;
1580 			else
1581 				de->de_atime = vap->va_atime;
1582 		}
1583 		if (vap->va_mtime.tv_sec != VNOVAL) {
1584 			if (vp->v_type == VCHR)
1585 				vp->v_rdev->si_mtime = vap->va_mtime;
1586 			else
1587 				de->de_mtime = vap->va_mtime;
1588 		}
1589 		c = 1;
1590 	}
1591 
1592 	if (c) {
1593 		if (vp->v_type == VCHR)
1594 			vfs_timestamp(&vp->v_rdev->si_ctime);
1595 		else
1596 			vfs_timestamp(&de->de_mtime);
1597 	}
1598 	return (0);
1599 }
1600 
1601 #ifdef MAC
1602 static int
1603 devfs_setlabel(struct vop_setlabel_args *ap)
1604 {
1605 	struct vnode *vp;
1606 	struct devfs_dirent *de;
1607 
1608 	vp = ap->a_vp;
1609 	de = vp->v_data;
1610 
1611 	mac_vnode_relabel(ap->a_cred, vp, ap->a_label);
1612 	mac_devfs_update(vp->v_mount, de, vp);
1613 
1614 	return (0);
1615 }
1616 #endif
1617 
1618 static int
1619 devfs_stat_f(struct file *fp, struct stat *sb, struct ucred *cred, struct thread *td)
1620 {
1621 
1622 	return (vnops.fo_stat(fp, sb, cred, td));
1623 }
1624 
1625 static int
1626 devfs_symlink(struct vop_symlink_args *ap)
1627 {
1628 	int i, error;
1629 	struct devfs_dirent *dd;
1630 	struct devfs_dirent *de, *de_covered, *de_dotdot;
1631 	struct devfs_mount *dmp;
1632 
1633 	error = priv_check(curthread, PRIV_DEVFS_SYMLINK);
1634 	if (error)
1635 		return(error);
1636 	dmp = VFSTODEVFS(ap->a_dvp->v_mount);
1637 	if (devfs_populate_vp(ap->a_dvp) != 0)
1638 		return (ENOENT);
1639 
1640 	dd = ap->a_dvp->v_data;
1641 	de = devfs_newdirent(ap->a_cnp->cn_nameptr, ap->a_cnp->cn_namelen);
1642 	de->de_flags = DE_USER;
1643 	de->de_uid = 0;
1644 	de->de_gid = 0;
1645 	de->de_mode = 0755;
1646 	de->de_inode = alloc_unr(devfs_inos);
1647 	de->de_dir = dd;
1648 	de->de_dirent->d_type = DT_LNK;
1649 	i = strlen(ap->a_target) + 1;
1650 	de->de_symlink = malloc(i, M_DEVFS, M_WAITOK);
1651 	bcopy(ap->a_target, de->de_symlink, i);
1652 #ifdef MAC
1653 	mac_devfs_create_symlink(ap->a_cnp->cn_cred, dmp->dm_mount, dd, de);
1654 #endif
1655 	de_covered = devfs_find(dd, de->de_dirent->d_name,
1656 	    de->de_dirent->d_namlen, 0);
1657 	if (de_covered != NULL) {
1658 		if ((de_covered->de_flags & DE_USER) != 0) {
1659 			devfs_delete(dmp, de, DEVFS_DEL_NORECURSE);
1660 			sx_xunlock(&dmp->dm_lock);
1661 			return (EEXIST);
1662 		}
1663 		KASSERT((de_covered->de_flags & DE_COVERED) == 0,
1664 		    ("devfs_symlink: entry %p already covered", de_covered));
1665 		de_covered->de_flags |= DE_COVERED;
1666 	}
1667 
1668 	de_dotdot = TAILQ_FIRST(&dd->de_dlist);		/* "." */
1669 	de_dotdot = TAILQ_NEXT(de_dotdot, de_list);	/* ".." */
1670 	TAILQ_INSERT_AFTER(&dd->de_dlist, de_dotdot, de, de_list);
1671 	devfs_dir_ref_de(dmp, dd);
1672 	devfs_rules_apply(dmp, de);
1673 
1674 	return (devfs_allocv(de, ap->a_dvp->v_mount, LK_EXCLUSIVE, ap->a_vpp));
1675 }
1676 
1677 static int
1678 devfs_truncate_f(struct file *fp, off_t length, struct ucred *cred, struct thread *td)
1679 {
1680 
1681 	return (vnops.fo_truncate(fp, length, cred, td));
1682 }
1683 
1684 static int
1685 devfs_write_f(struct file *fp, struct uio *uio, struct ucred *cred,
1686     int flags, struct thread *td)
1687 {
1688 	struct cdev *dev;
1689 	int error, ioflag, ref;
1690 	ssize_t resid;
1691 	struct cdevsw *dsw;
1692 	struct file *fpop;
1693 
1694 	if (uio->uio_resid > DEVFS_IOSIZE_MAX)
1695 		return (EINVAL);
1696 	fpop = td->td_fpop;
1697 	error = devfs_fp_check(fp, &dev, &dsw, &ref);
1698 	if (error != 0) {
1699 		error = vnops.fo_write(fp, uio, cred, flags, td);
1700 		return (error);
1701 	}
1702 	KASSERT(uio->uio_td == td, ("uio_td %p is not td %p", uio->uio_td, td));
1703 	ioflag = fp->f_flag & (O_NONBLOCK | O_DIRECT | O_FSYNC);
1704 	if (ioflag & O_DIRECT)
1705 		ioflag |= IO_DIRECT;
1706 	foffset_lock_uio(fp, uio, flags | FOF_NOLOCK);
1707 
1708 	resid = uio->uio_resid;
1709 
1710 	error = dsw->d_write(dev, uio, ioflag);
1711 	if (devfs_dotimes &&
1712 	    (uio->uio_resid != resid || (error == 0 && resid != 0))) {
1713 		vfs_timestamp(&dev->si_ctime);
1714 		dev->si_mtime = dev->si_ctime;
1715 	}
1716 	td->td_fpop = fpop;
1717 	dev_relthread(dev, ref);
1718 
1719 	foffset_unlock_uio(fp, uio, flags | FOF_NOLOCK | FOF_NEXTOFF);
1720 	return (error);
1721 }
1722 
1723 dev_t
1724 dev2udev(struct cdev *x)
1725 {
1726 	if (x == NULL)
1727 		return (NODEV);
1728 	return (cdev2priv(x)->cdp_inode);
1729 }
1730 
1731 static struct fileops devfs_ops_f = {
1732 	.fo_read =	devfs_read_f,
1733 	.fo_write =	devfs_write_f,
1734 	.fo_truncate =	devfs_truncate_f,
1735 	.fo_ioctl =	devfs_ioctl_f,
1736 	.fo_poll =	devfs_poll_f,
1737 	.fo_kqfilter =	devfs_kqfilter_f,
1738 	.fo_stat =	devfs_stat_f,
1739 	.fo_close =	devfs_close_f,
1740 	.fo_chmod =	vn_chmod,
1741 	.fo_chown =	vn_chown,
1742 	.fo_sendfile =	vn_sendfile,
1743 	.fo_seek =	vn_seek,
1744 	.fo_fill_kinfo = vn_fill_kinfo,
1745 	.fo_flags =	DFLAG_PASSABLE | DFLAG_SEEKABLE
1746 };
1747 
1748 static struct vop_vector devfs_vnodeops = {
1749 	.vop_default =		&default_vnodeops,
1750 
1751 	.vop_access =		devfs_access,
1752 	.vop_getattr =		devfs_getattr,
1753 	.vop_ioctl =		devfs_rioctl,
1754 	.vop_lookup =		devfs_lookup,
1755 	.vop_mknod =		devfs_mknod,
1756 	.vop_pathconf =		devfs_pathconf,
1757 	.vop_read =		devfs_rread,
1758 	.vop_readdir =		devfs_readdir,
1759 	.vop_readlink =		devfs_readlink,
1760 	.vop_reclaim =		devfs_reclaim,
1761 	.vop_remove =		devfs_remove,
1762 	.vop_revoke =		devfs_revoke,
1763 	.vop_setattr =		devfs_setattr,
1764 #ifdef MAC
1765 	.vop_setlabel =		devfs_setlabel,
1766 #endif
1767 	.vop_symlink =		devfs_symlink,
1768 	.vop_vptocnp =		devfs_vptocnp,
1769 };
1770 
1771 struct vop_vector devfs_specops = {
1772 	.vop_default =		&default_vnodeops,
1773 
1774 	.vop_access =		devfs_access,
1775 	.vop_bmap =		VOP_PANIC,
1776 	.vop_close =		devfs_close,
1777 	.vop_create =		VOP_PANIC,
1778 	.vop_fsync =		devfs_fsync,
1779 	.vop_getattr =		devfs_getattr,
1780 	.vop_link =		VOP_PANIC,
1781 	.vop_mkdir =		VOP_PANIC,
1782 	.vop_mknod =		VOP_PANIC,
1783 	.vop_open =		devfs_open,
1784 	.vop_pathconf =		devfs_pathconf,
1785 	.vop_poll =		dead_poll,
1786 	.vop_print =		devfs_print,
1787 	.vop_read =		dead_read,
1788 	.vop_readdir =		VOP_PANIC,
1789 	.vop_readlink =		VOP_PANIC,
1790 	.vop_reallocblks =	VOP_PANIC,
1791 	.vop_reclaim =		devfs_reclaim,
1792 	.vop_remove =		devfs_remove,
1793 	.vop_rename =		VOP_PANIC,
1794 	.vop_revoke =		devfs_revoke,
1795 	.vop_rmdir =		VOP_PANIC,
1796 	.vop_setattr =		devfs_setattr,
1797 #ifdef MAC
1798 	.vop_setlabel =		devfs_setlabel,
1799 #endif
1800 	.vop_strategy =		VOP_PANIC,
1801 	.vop_symlink =		VOP_PANIC,
1802 	.vop_vptocnp =		devfs_vptocnp,
1803 	.vop_write =		dead_write,
1804 };
1805 
1806 /*
1807  * Our calling convention to the device drivers used to be that we passed
1808  * vnode.h IO_* flags to read()/write(), but we're moving to fcntl.h O_
1809  * flags instead since that's what open(), close() and ioctl() takes and
1810  * we don't really want vnode.h in device drivers.
1811  * We solved the source compatibility by redefining some vnode flags to
1812  * be the same as the fcntl ones and by sending down the bitwise OR of
1813  * the respective fcntl/vnode flags.  These CTASSERTS make sure nobody
1814  * pulls the rug out under this.
1815  */
1816 CTASSERT(O_NONBLOCK == IO_NDELAY);
1817 CTASSERT(O_FSYNC == IO_SYNC);
1818