1 /* $NetBSD: spec_vnops.c,v 1.215 2022/09/21 10:59:10 riastradh Exp $ */ 2 3 /*- 4 * Copyright (c) 2008 The NetBSD Foundation, Inc. 5 * All rights reserved. 6 * 7 * Redistribution and use in source and binary forms, with or without 8 * modification, are permitted provided that the following conditions 9 * are met: 10 * 1. Redistributions of source code must retain the above copyright 11 * notice, this list of conditions and the following disclaimer. 12 * 2. Redistributions in binary form must reproduce the above copyright 13 * notice, this list of conditions and the following disclaimer in the 14 * documentation and/or other materials provided with the distribution. 15 * 16 * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS 17 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED 18 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 19 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS 20 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 21 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 22 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 23 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 24 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 25 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 26 * POSSIBILITY OF SUCH DAMAGE. 27 */ 28 29 /* 30 * Copyright (c) 1989, 1993 31 * The Regents of the University of California. All rights reserved. 32 * 33 * Redistribution and use in source and binary forms, with or without 34 * modification, are permitted provided that the following conditions 35 * are met: 36 * 1. Redistributions of source code must retain the above copyright 37 * notice, this list of conditions and the following disclaimer. 38 * 2. Redistributions in binary form must reproduce the above copyright 39 * notice, this list of conditions and the following disclaimer in the 40 * documentation and/or other materials provided with the distribution. 41 * 3. Neither the name of the University nor the names of its contributors 42 * may be used to endorse or promote products derived from this software 43 * without specific prior written permission. 44 * 45 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 46 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 47 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 48 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 49 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 50 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 51 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 52 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 53 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 54 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 55 * SUCH DAMAGE. 56 * 57 * @(#)spec_vnops.c 8.15 (Berkeley) 7/14/95 58 */ 59 60 #include <sys/cdefs.h> 61 __KERNEL_RCSID(0, "$NetBSD: spec_vnops.c,v 1.215 2022/09/21 10:59:10 riastradh Exp $"); 62 63 #include <sys/param.h> 64 #include <sys/proc.h> 65 #include <sys/systm.h> 66 #include <sys/kernel.h> 67 #include <sys/conf.h> 68 #include <sys/buf.h> 69 #include <sys/mount.h> 70 #include <sys/namei.h> 71 #include <sys/vnode_impl.h> 72 #include <sys/stat.h> 73 #include <sys/errno.h> 74 #include <sys/ioctl.h> 75 #include <sys/poll.h> 76 #include <sys/file.h> 77 #include <sys/disklabel.h> 78 #include <sys/disk.h> 79 #include <sys/lockf.h> 80 #include <sys/tty.h> 81 #include <sys/kauth.h> 82 #include <sys/fstrans.h> 83 #include <sys/module.h> 84 #include <sys/atomic.h> 85 86 #include <miscfs/genfs/genfs.h> 87 #include <miscfs/specfs/specdev.h> 88 89 /* 90 * Lock order: 91 * 92 * vnode lock 93 * -> device_lock 94 * -> struct vnode::v_interlock 95 */ 96 97 /* symbolic sleep message strings for devices */ 98 const char devopn[] = "devopn"; 99 const char devio[] = "devio"; 100 const char devwait[] = "devwait"; 101 const char devin[] = "devin"; 102 const char devout[] = "devout"; 103 const char devioc[] = "devioc"; 104 const char devcls[] = "devcls"; 105 106 #define SPECHSZ 64 107 #if ((SPECHSZ&(SPECHSZ-1)) == 0) 108 #define SPECHASH(rdev) (((rdev>>5)+(rdev))&(SPECHSZ-1)) 109 #else 110 #define SPECHASH(rdev) (((unsigned)((rdev>>5)+(rdev)))%SPECHSZ) 111 #endif 112 113 static vnode_t *specfs_hash[SPECHSZ]; 114 extern struct mount *dead_rootmount; 115 116 /* 117 * This vnode operations vector is used for special device nodes 118 * created from whole cloth by the kernel. For the ops vector for 119 * vnodes built from special devices found in a filesystem, see (e.g) 120 * ffs_specop_entries[] in ffs_vnops.c or the equivalent for other 121 * filesystems. 122 */ 123 124 int (**spec_vnodeop_p)(void *); 125 const struct vnodeopv_entry_desc spec_vnodeop_entries[] = { 126 { &vop_default_desc, vn_default_error }, 127 { &vop_parsepath_desc, genfs_parsepath }, /* parsepath */ 128 { &vop_lookup_desc, spec_lookup }, /* lookup */ 129 { &vop_create_desc, genfs_badop }, /* create */ 130 { &vop_mknod_desc, genfs_badop }, /* mknod */ 131 { &vop_open_desc, spec_open }, /* open */ 132 { &vop_close_desc, spec_close }, /* close */ 133 { &vop_access_desc, genfs_ebadf }, /* access */ 134 { &vop_accessx_desc, genfs_ebadf }, /* accessx */ 135 { &vop_getattr_desc, genfs_ebadf }, /* getattr */ 136 { &vop_setattr_desc, genfs_ebadf }, /* setattr */ 137 { &vop_read_desc, spec_read }, /* read */ 138 { &vop_write_desc, spec_write }, /* write */ 139 { &vop_fallocate_desc, genfs_eopnotsupp }, /* fallocate */ 140 { &vop_fdiscard_desc, spec_fdiscard }, /* fdiscard */ 141 { &vop_fcntl_desc, genfs_fcntl }, /* fcntl */ 142 { &vop_ioctl_desc, spec_ioctl }, /* ioctl */ 143 { &vop_poll_desc, spec_poll }, /* poll */ 144 { &vop_kqfilter_desc, spec_kqfilter }, /* kqfilter */ 145 { &vop_revoke_desc, genfs_revoke }, /* revoke */ 146 { &vop_mmap_desc, spec_mmap }, /* mmap */ 147 { &vop_fsync_desc, spec_fsync }, /* fsync */ 148 { &vop_seek_desc, spec_seek }, /* seek */ 149 { &vop_remove_desc, genfs_badop }, /* remove */ 150 { &vop_link_desc, genfs_badop }, /* link */ 151 { &vop_rename_desc, genfs_badop }, /* rename */ 152 { &vop_mkdir_desc, genfs_badop }, /* mkdir */ 153 { &vop_rmdir_desc, genfs_badop }, /* rmdir */ 154 { &vop_symlink_desc, genfs_badop }, /* symlink */ 155 { &vop_readdir_desc, genfs_badop }, /* readdir */ 156 { &vop_readlink_desc, genfs_badop }, /* readlink */ 157 { &vop_abortop_desc, genfs_badop }, /* abortop */ 158 { &vop_inactive_desc, spec_inactive }, /* inactive */ 159 { &vop_reclaim_desc, spec_reclaim }, /* reclaim */ 160 { &vop_lock_desc, genfs_lock }, /* lock */ 161 { &vop_unlock_desc, genfs_unlock }, /* unlock */ 162 { &vop_bmap_desc, spec_bmap }, /* bmap */ 163 { &vop_strategy_desc, spec_strategy }, /* strategy */ 164 { &vop_print_desc, spec_print }, /* print */ 165 { &vop_islocked_desc, genfs_islocked }, /* islocked */ 166 { &vop_pathconf_desc, spec_pathconf }, /* pathconf */ 167 { &vop_advlock_desc, spec_advlock }, /* advlock */ 168 { &vop_bwrite_desc, vn_bwrite }, /* bwrite */ 169 { &vop_getpages_desc, genfs_getpages }, /* getpages */ 170 { &vop_putpages_desc, genfs_putpages }, /* putpages */ 171 { NULL, NULL } 172 }; 173 const struct vnodeopv_desc spec_vnodeop_opv_desc = 174 { &spec_vnodeop_p, spec_vnodeop_entries }; 175 176 static kauth_listener_t rawio_listener; 177 static struct kcondvar specfs_iocv; 178 179 /* Returns true if vnode is /dev/mem or /dev/kmem. */ 180 bool 181 iskmemvp(struct vnode *vp) 182 { 183 return ((vp->v_type == VCHR) && iskmemdev(vp->v_rdev)); 184 } 185 186 /* 187 * Returns true if dev is /dev/mem or /dev/kmem. 188 */ 189 int 190 iskmemdev(dev_t dev) 191 { 192 /* mem_no is emitted by config(8) to generated devsw.c */ 193 extern const int mem_no; 194 195 /* minor 14 is /dev/io on i386 with COMPAT_10 */ 196 return (major(dev) == mem_no && (minor(dev) < 2 || minor(dev) == 14)); 197 } 198 199 static int 200 rawio_listener_cb(kauth_cred_t cred, kauth_action_t action, void *cookie, 201 void *arg0, void *arg1, void *arg2, void *arg3) 202 { 203 int result; 204 205 result = KAUTH_RESULT_DEFER; 206 207 if ((action != KAUTH_DEVICE_RAWIO_SPEC) && 208 (action != KAUTH_DEVICE_RAWIO_PASSTHRU)) 209 return result; 210 211 /* Access is mandated by permissions. */ 212 result = KAUTH_RESULT_ALLOW; 213 214 return result; 215 } 216 217 void 218 spec_init(void) 219 { 220 221 rawio_listener = kauth_listen_scope(KAUTH_SCOPE_DEVICE, 222 rawio_listener_cb, NULL); 223 cv_init(&specfs_iocv, "specio"); 224 } 225 226 /* 227 * spec_io_enter(vp, &sn, &dev) 228 * 229 * Enter an operation that may not hold vp's vnode lock or an 230 * fstrans on vp's mount. Until spec_io_exit, the vnode will not 231 * be revoked. 232 * 233 * On success, set sn to the specnode pointer and dev to the dev_t 234 * number and return zero. Caller must later call spec_io_exit 235 * when done. 236 * 237 * On failure, return ENXIO -- the device has been revoked and no 238 * longer exists. 239 */ 240 static int 241 spec_io_enter(struct vnode *vp, struct specnode **snp, dev_t *devp) 242 { 243 dev_t dev; 244 struct specnode *sn; 245 unsigned iocnt; 246 int error = 0; 247 248 mutex_enter(vp->v_interlock); 249 250 /* 251 * Extract all the info we need from the vnode, unless the 252 * vnode has already been reclaimed. This can happen if the 253 * underlying device has been removed and all the device nodes 254 * for it have been revoked. The caller may not hold a vnode 255 * lock or fstrans to prevent this from happening before it has 256 * had an opportunity to notice the vnode is dead. 257 */ 258 if (vdead_check(vp, VDEAD_NOWAIT) != 0 || 259 (sn = vp->v_specnode) == NULL || 260 (dev = vp->v_rdev) == NODEV) { 261 error = ENXIO; 262 goto out; 263 } 264 265 /* 266 * Notify spec_close that we are doing an I/O operation which 267 * may not be not bracketed by fstrans(9) and thus is not 268 * blocked by vfs suspension. 269 * 270 * We could hold this reference with psref(9) instead, but we 271 * already have to take the interlock for vdead_check, so 272 * there's not much more cost here to another atomic operation. 273 */ 274 do { 275 iocnt = atomic_load_relaxed(&sn->sn_dev->sd_iocnt); 276 if (__predict_false(iocnt == UINT_MAX)) { 277 /* 278 * The I/O count is limited by the number of 279 * LWPs (which will never overflow this) -- 280 * unless one driver uses another driver via 281 * specfs, which is rather unusual, but which 282 * could happen via pud(4) userspace drivers. 283 * We could use a 64-bit count, but can't use 284 * atomics for that on all platforms. 285 * (Probably better to switch to psref or 286 * localcount instead.) 287 */ 288 error = EBUSY; 289 goto out; 290 } 291 } while (atomic_cas_uint(&sn->sn_dev->sd_iocnt, iocnt, iocnt + 1) 292 != iocnt); 293 294 /* Success! */ 295 *snp = sn; 296 *devp = dev; 297 error = 0; 298 299 out: mutex_exit(vp->v_interlock); 300 return error; 301 } 302 303 /* 304 * spec_io_exit(vp, sn) 305 * 306 * Exit an operation entered with a successful spec_io_enter -- 307 * allow concurrent spec_node_revoke to proceed. The argument sn 308 * must match the struct specnode pointer returned by spec_io_exit 309 * for vp. 310 */ 311 static void 312 spec_io_exit(struct vnode *vp, struct specnode *sn) 313 { 314 struct specdev *sd = sn->sn_dev; 315 unsigned iocnt; 316 317 KASSERT(vp->v_specnode == sn); 318 319 /* 320 * We are done. Notify spec_close if appropriate. The 321 * transition of 1 -> 0 must happen under device_lock so 322 * spec_close doesn't miss a wakeup. 323 */ 324 do { 325 iocnt = atomic_load_relaxed(&sd->sd_iocnt); 326 KASSERT(iocnt > 0); 327 if (iocnt == 1) { 328 mutex_enter(&device_lock); 329 if (atomic_dec_uint_nv(&sd->sd_iocnt) == 0) 330 cv_broadcast(&specfs_iocv); 331 mutex_exit(&device_lock); 332 break; 333 } 334 } while (atomic_cas_uint(&sd->sd_iocnt, iocnt, iocnt - 1) != iocnt); 335 } 336 337 /* 338 * spec_io_drain(sd) 339 * 340 * Wait for all existing spec_io_enter/exit sections to complete. 341 * Caller must ensure spec_io_enter will fail at this point. 342 */ 343 static void 344 spec_io_drain(struct specdev *sd) 345 { 346 347 /* 348 * I/O at the same time as closing is unlikely -- it often 349 * indicates an application bug. 350 */ 351 if (__predict_true(atomic_load_relaxed(&sd->sd_iocnt) == 0)) 352 return; 353 354 mutex_enter(&device_lock); 355 while (atomic_load_relaxed(&sd->sd_iocnt) > 0) 356 cv_wait(&specfs_iocv, &device_lock); 357 mutex_exit(&device_lock); 358 } 359 360 /* 361 * Initialize a vnode that represents a device. 362 */ 363 void 364 spec_node_init(vnode_t *vp, dev_t rdev) 365 { 366 specnode_t *sn; 367 specdev_t *sd; 368 vnode_t *vp2; 369 vnode_t **vpp; 370 371 KASSERT(vp->v_type == VBLK || vp->v_type == VCHR); 372 KASSERT(vp->v_specnode == NULL); 373 374 /* 375 * Search the hash table for this device. If known, add a 376 * reference to the device structure. If not known, create 377 * a new entry to represent the device. In all cases add 378 * the vnode to the hash table. 379 */ 380 sn = kmem_alloc(sizeof(*sn), KM_SLEEP); 381 sd = kmem_alloc(sizeof(*sd), KM_SLEEP); 382 mutex_enter(&device_lock); 383 vpp = &specfs_hash[SPECHASH(rdev)]; 384 for (vp2 = *vpp; vp2 != NULL; vp2 = vp2->v_specnext) { 385 KASSERT(vp2->v_specnode != NULL); 386 if (rdev == vp2->v_rdev && vp->v_type == vp2->v_type) { 387 break; 388 } 389 } 390 if (vp2 == NULL) { 391 /* No existing record, create a new one. */ 392 sd->sd_rdev = rdev; 393 sd->sd_mountpoint = NULL; 394 sd->sd_lockf = NULL; 395 sd->sd_refcnt = 1; 396 sd->sd_opencnt = 0; 397 sd->sd_bdevvp = NULL; 398 sd->sd_iocnt = 0; 399 sd->sd_opened = false; 400 sd->sd_closing = false; 401 sn->sn_dev = sd; 402 sd = NULL; 403 } else { 404 /* Use the existing record. */ 405 sn->sn_dev = vp2->v_specnode->sn_dev; 406 sn->sn_dev->sd_refcnt++; 407 } 408 /* Insert vnode into the hash chain. */ 409 sn->sn_opencnt = 0; 410 sn->sn_rdev = rdev; 411 sn->sn_gone = false; 412 vp->v_specnode = sn; 413 vp->v_specnext = *vpp; 414 *vpp = vp; 415 mutex_exit(&device_lock); 416 417 /* Free the record we allocated if unused. */ 418 if (sd != NULL) { 419 kmem_free(sd, sizeof(*sd)); 420 } 421 } 422 423 /* 424 * Lookup a vnode by device number and return it referenced. 425 */ 426 int 427 spec_node_lookup_by_dev(enum vtype type, dev_t dev, int flags, vnode_t **vpp) 428 { 429 int error; 430 vnode_t *vp; 431 432 top: mutex_enter(&device_lock); 433 for (vp = specfs_hash[SPECHASH(dev)]; vp; vp = vp->v_specnext) { 434 if (type == vp->v_type && dev == vp->v_rdev) { 435 mutex_enter(vp->v_interlock); 436 /* If clean or being cleaned, then ignore it. */ 437 if (vdead_check(vp, VDEAD_NOWAIT) == 0) 438 break; 439 if ((flags & VDEAD_NOWAIT) == 0) { 440 mutex_exit(&device_lock); 441 /* 442 * It may be being revoked as we speak, 443 * and the caller wants to wait until 444 * all revocation has completed. Let 445 * vcache_vget wait for it to finish 446 * dying; as a side effect, vcache_vget 447 * releases vp->v_interlock. Note that 448 * vcache_vget cannot succeed at this 449 * point because vdead_check already 450 * failed. 451 */ 452 error = vcache_vget(vp); 453 KASSERT(error); 454 goto top; 455 } 456 mutex_exit(vp->v_interlock); 457 } 458 } 459 KASSERT(vp == NULL || mutex_owned(vp->v_interlock)); 460 if (vp == NULL) { 461 mutex_exit(&device_lock); 462 return ENOENT; 463 } 464 /* 465 * If it is an opened block device return the opened vnode. 466 */ 467 if (type == VBLK && vp->v_specnode->sn_dev->sd_bdevvp != NULL) { 468 mutex_exit(vp->v_interlock); 469 vp = vp->v_specnode->sn_dev->sd_bdevvp; 470 mutex_enter(vp->v_interlock); 471 } 472 mutex_exit(&device_lock); 473 error = vcache_vget(vp); 474 if (error != 0) 475 return error; 476 *vpp = vp; 477 478 return 0; 479 } 480 481 /* 482 * Lookup a vnode by file system mounted on and return it referenced. 483 */ 484 int 485 spec_node_lookup_by_mount(struct mount *mp, vnode_t **vpp) 486 { 487 int i, error; 488 vnode_t *vp, *vq; 489 490 mutex_enter(&device_lock); 491 for (i = 0, vq = NULL; i < SPECHSZ && vq == NULL; i++) { 492 for (vp = specfs_hash[i]; vp; vp = vp->v_specnext) { 493 if (vp->v_type != VBLK) 494 continue; 495 vq = vp->v_specnode->sn_dev->sd_bdevvp; 496 if (vq != NULL && 497 vq->v_specnode->sn_dev->sd_mountpoint == mp) 498 break; 499 vq = NULL; 500 } 501 } 502 if (vq == NULL) { 503 mutex_exit(&device_lock); 504 return ENOENT; 505 } 506 mutex_enter(vq->v_interlock); 507 mutex_exit(&device_lock); 508 error = vcache_vget(vq); 509 if (error != 0) 510 return error; 511 *vpp = vq; 512 513 return 0; 514 515 } 516 517 /* 518 * Get the file system mounted on this block device. 519 * 520 * XXX Caller should hold the vnode lock -- shared or exclusive -- so 521 * that this can't changed, and the vnode can't be revoked while we 522 * examine it. But not all callers do, and they're scattered through a 523 * lot of file systems, so we can't assert this yet. 524 */ 525 struct mount * 526 spec_node_getmountedfs(vnode_t *devvp) 527 { 528 struct mount *mp; 529 530 KASSERT(devvp->v_type == VBLK); 531 mp = devvp->v_specnode->sn_dev->sd_mountpoint; 532 533 return mp; 534 } 535 536 /* 537 * Set the file system mounted on this block device. 538 * 539 * XXX Caller should hold the vnode lock exclusively so this can't be 540 * changed or assumed by spec_node_getmountedfs while we change it, and 541 * the vnode can't be revoked while we handle it. But not all callers 542 * do, and they're scattered through a lot of file systems, so we can't 543 * assert this yet. Instead, for now, we'll take an I/O reference so 544 * at least the ioctl doesn't race with revoke/detach. 545 * 546 * If you do change this to assert an exclusive vnode lock, you must 547 * also do vdead_check before trying bdev_ioctl, because the vnode may 548 * have been revoked by the time the caller locked it, and this is 549 * _not_ a vop -- calls to spec_node_setmountedfs don't go through 550 * v_op, so revoking the vnode doesn't prevent further calls. 551 * 552 * XXX Caller should additionally have the vnode open, at least if mp 553 * is nonnull, but I'm not sure all callers do that -- need to audit. 554 * Currently udf closes the vnode before clearing the mount. 555 */ 556 void 557 spec_node_setmountedfs(vnode_t *devvp, struct mount *mp) 558 { 559 struct dkwedge_info dkw; 560 struct specnode *sn; 561 dev_t dev; 562 int error; 563 564 KASSERT(devvp->v_type == VBLK); 565 566 error = spec_io_enter(devvp, &sn, &dev); 567 if (error) 568 return; 569 570 KASSERT(sn->sn_dev->sd_mountpoint == NULL || mp == NULL); 571 sn->sn_dev->sd_mountpoint = mp; 572 if (mp == NULL) 573 goto out; 574 575 error = bdev_ioctl(dev, DIOCGWEDGEINFO, &dkw, FREAD, curlwp); 576 if (error) 577 goto out; 578 579 strlcpy(mp->mnt_stat.f_mntfromlabel, dkw.dkw_wname, 580 sizeof(mp->mnt_stat.f_mntfromlabel)); 581 582 out: spec_io_exit(devvp, sn); 583 } 584 585 /* 586 * A vnode representing a special device is going away. Close 587 * the device if the vnode holds it open. 588 */ 589 void 590 spec_node_revoke(vnode_t *vp) 591 { 592 specnode_t *sn; 593 specdev_t *sd; 594 struct vnode **vpp; 595 596 KASSERT(VOP_ISLOCKED(vp) == LK_EXCLUSIVE); 597 598 sn = vp->v_specnode; 599 sd = sn->sn_dev; 600 601 KASSERT(vp->v_type == VBLK || vp->v_type == VCHR); 602 KASSERT(vp->v_specnode != NULL); 603 KASSERT(sn->sn_gone == false); 604 605 mutex_enter(&device_lock); 606 KASSERTMSG(sn->sn_opencnt <= sd->sd_opencnt, 607 "sn_opencnt=%u > sd_opencnt=%u", 608 sn->sn_opencnt, sd->sd_opencnt); 609 sn->sn_gone = true; 610 if (sn->sn_opencnt != 0) { 611 sd->sd_opencnt -= (sn->sn_opencnt - 1); 612 sn->sn_opencnt = 1; 613 mutex_exit(&device_lock); 614 615 VOP_CLOSE(vp, FNONBLOCK, NOCRED); 616 617 mutex_enter(&device_lock); 618 KASSERT(sn->sn_opencnt == 0); 619 } 620 621 /* 622 * We may have revoked the vnode in this thread while another 623 * thread was in the middle of spec_close, in the window when 624 * spec_close releases the vnode lock to call .d_close for the 625 * last close. In that case, wait for the concurrent 626 * spec_close to complete. 627 */ 628 while (sd->sd_closing) 629 cv_wait(&specfs_iocv, &device_lock); 630 631 /* 632 * Remove from the hash so lookups stop returning this 633 * specnode. We will dissociate it from the specdev -- and 634 * possibly free the specdev -- in spec_node_destroy. 635 */ 636 KASSERT(sn->sn_gone); 637 KASSERT(sn->sn_opencnt == 0); 638 for (vpp = &specfs_hash[SPECHASH(vp->v_rdev)];; 639 vpp = &(*vpp)->v_specnext) { 640 if (*vpp == vp) { 641 *vpp = vp->v_specnext; 642 vp->v_specnext = NULL; 643 break; 644 } 645 } 646 mutex_exit(&device_lock); 647 } 648 649 /* 650 * A vnode representing a special device is being recycled. 651 * Destroy the specfs component. 652 */ 653 void 654 spec_node_destroy(vnode_t *vp) 655 { 656 specnode_t *sn; 657 specdev_t *sd; 658 int refcnt; 659 660 sn = vp->v_specnode; 661 sd = sn->sn_dev; 662 663 KASSERT(vp->v_type == VBLK || vp->v_type == VCHR); 664 KASSERT(vp->v_specnode != NULL); 665 KASSERT(sn->sn_opencnt == 0); 666 667 mutex_enter(&device_lock); 668 sn = vp->v_specnode; 669 vp->v_specnode = NULL; 670 refcnt = sd->sd_refcnt--; 671 KASSERT(refcnt > 0); 672 mutex_exit(&device_lock); 673 674 /* If the device is no longer in use, destroy our record. */ 675 if (refcnt == 1) { 676 KASSERT(sd->sd_iocnt == 0); 677 KASSERT(sd->sd_opencnt == 0); 678 KASSERT(sd->sd_bdevvp == NULL); 679 kmem_free(sd, sizeof(*sd)); 680 } 681 kmem_free(sn, sizeof(*sn)); 682 } 683 684 /* 685 * Trivial lookup routine that always fails. 686 */ 687 int 688 spec_lookup(void *v) 689 { 690 struct vop_lookup_v2_args /* { 691 struct vnode *a_dvp; 692 struct vnode **a_vpp; 693 struct componentname *a_cnp; 694 } */ *ap = v; 695 696 *ap->a_vpp = NULL; 697 return (ENOTDIR); 698 } 699 700 typedef int (*spec_ioctl_t)(dev_t, u_long, void *, int, struct lwp *); 701 702 /* 703 * Open a special file. 704 */ 705 /* ARGSUSED */ 706 int 707 spec_open(void *v) 708 { 709 struct vop_open_args /* { 710 struct vnode *a_vp; 711 int a_mode; 712 kauth_cred_t a_cred; 713 } */ *ap = v; 714 struct lwp *l = curlwp; 715 struct vnode *vp = ap->a_vp; 716 dev_t dev, dev1; 717 int error; 718 enum kauth_device_req req; 719 specnode_t *sn, *sn1; 720 specdev_t *sd; 721 spec_ioctl_t ioctl; 722 u_int gen = 0; 723 const char *name = NULL; 724 bool needclose = false; 725 struct partinfo pi; 726 727 KASSERT(VOP_ISLOCKED(vp) == LK_EXCLUSIVE); 728 KASSERTMSG(vp->v_type == VBLK || vp->v_type == VCHR, "type=%d", 729 vp->v_type); 730 731 dev = vp->v_rdev; 732 sn = vp->v_specnode; 733 sd = sn->sn_dev; 734 735 /* 736 * Don't allow open if fs is mounted -nodev. 737 */ 738 if (vp->v_mount && (vp->v_mount->mnt_flag & MNT_NODEV)) 739 return (ENXIO); 740 741 switch (ap->a_mode & (FREAD | FWRITE)) { 742 case FREAD | FWRITE: 743 req = KAUTH_REQ_DEVICE_RAWIO_SPEC_RW; 744 break; 745 case FWRITE: 746 req = KAUTH_REQ_DEVICE_RAWIO_SPEC_WRITE; 747 break; 748 default: 749 req = KAUTH_REQ_DEVICE_RAWIO_SPEC_READ; 750 break; 751 } 752 error = kauth_authorize_device_spec(ap->a_cred, req, vp); 753 if (error != 0) 754 return (error); 755 756 /* 757 * Acquire an open reference -- as long as we hold onto it, and 758 * the vnode isn't revoked, it can't be closed, and the vnode 759 * can't be revoked until we release the vnode lock. 760 */ 761 mutex_enter(&device_lock); 762 KASSERT(!sn->sn_gone); 763 switch (vp->v_type) { 764 case VCHR: 765 /* 766 * Character devices can accept opens from multiple 767 * vnodes. But first, wait for any close to finish. 768 * Wait under the vnode lock so we don't have to worry 769 * about the vnode being revoked while we wait. 770 */ 771 while (sd->sd_closing) { 772 error = cv_wait_sig(&specfs_iocv, &device_lock); 773 if (error) 774 break; 775 } 776 if (error) 777 break; 778 sd->sd_opencnt++; 779 sn->sn_opencnt++; 780 KASSERTMSG(sn->sn_opencnt <= sd->sd_opencnt, 781 "sn_opencnt=%u > sd_opencnt=%u", 782 sn->sn_opencnt, sd->sd_opencnt); 783 break; 784 case VBLK: 785 /* 786 * For block devices, permit only one open. The buffer 787 * cache cannot remain self-consistent with multiple 788 * vnodes holding a block device open. 789 * 790 * Treat zero opencnt with non-NULL mountpoint as open. 791 * This may happen after forced detach of a mounted device. 792 * 793 * Also treat sd_closing, meaning there is a concurrent 794 * close in progress, as still open. 795 */ 796 if (sd->sd_opencnt != 0 || 797 sd->sd_mountpoint != NULL || 798 sd->sd_closing) { 799 error = EBUSY; 800 break; 801 } 802 KASSERTMSG(sn->sn_opencnt == 0, "sn_opencnt=%u", 803 sn->sn_opencnt); 804 sn->sn_opencnt = 1; 805 sd->sd_opencnt = 1; 806 sd->sd_bdevvp = vp; 807 break; 808 default: 809 panic("invalid specfs vnode type: %d", vp->v_type); 810 } 811 mutex_exit(&device_lock); 812 if (error) 813 return error; 814 815 /* 816 * Set VV_ISTTY if this is a tty cdev. 817 * 818 * XXX This does the wrong thing if the module has to be 819 * autoloaded. We should maybe set this after autoloading 820 * modules and calling .d_open successfully, except (a) we need 821 * the vnode lock to touch it, and (b) once we acquire the 822 * vnode lock again, the vnode may have been revoked, and 823 * deadfs's dead_read needs VV_ISTTY to be already set in order 824 * to return the right answer. So this needs some additional 825 * synchronization to be made to work correctly with tty driver 826 * module autoload. For now, let's just hope it doesn't cause 827 * too much trouble for a tty from an autoloaded driver module 828 * to fail with EIO instead of returning EOF. 829 */ 830 if (vp->v_type == VCHR) { 831 if (cdev_type(dev) == D_TTY) 832 vp->v_vflag |= VV_ISTTY; 833 } 834 835 /* 836 * Because opening the device may block indefinitely, e.g. when 837 * opening a tty, and loading a module may cross into many 838 * other subsystems, we must not hold the vnode lock while 839 * calling .d_open, so release it now and reacquire it when 840 * done. 841 * 842 * Take an I/O reference so that any concurrent spec_close via 843 * spec_node_revoke will wait for us to finish calling .d_open. 844 * The vnode can't be dead at this point because we have it 845 * locked. Note that if revoked, the driver must interrupt 846 * .d_open before spec_close starts waiting for I/O to drain so 847 * this doesn't deadlock. 848 */ 849 VOP_UNLOCK(vp); 850 error = spec_io_enter(vp, &sn1, &dev1); 851 if (error) { 852 vn_lock(vp, LK_EXCLUSIVE | LK_RETRY); 853 return error; 854 } 855 KASSERT(sn1 == sn); 856 KASSERT(dev1 == dev); 857 858 /* 859 * Open the device. If .d_open returns ENXIO (device not 860 * configured), the driver may not be loaded, so try 861 * autoloading a module and then try .d_open again if anything 862 * got loaded. 863 */ 864 switch (vp->v_type) { 865 case VCHR: 866 do { 867 const struct cdevsw *cdev; 868 869 gen = module_gen; 870 error = cdev_open(dev, ap->a_mode, S_IFCHR, l); 871 if (error != ENXIO) 872 break; 873 874 /* Check if we already have a valid driver */ 875 mutex_enter(&device_lock); 876 cdev = cdevsw_lookup(dev); 877 mutex_exit(&device_lock); 878 if (cdev != NULL) 879 break; 880 881 /* Get device name from devsw_conv array */ 882 if ((name = cdevsw_getname(major(dev))) == NULL) 883 break; 884 885 /* Try to autoload device module */ 886 (void) module_autoload(name, MODULE_CLASS_DRIVER); 887 } while (gen != module_gen); 888 break; 889 890 case VBLK: 891 do { 892 const struct bdevsw *bdev; 893 894 gen = module_gen; 895 error = bdev_open(dev, ap->a_mode, S_IFBLK, l); 896 if (error != ENXIO) 897 break; 898 899 /* Check if we already have a valid driver */ 900 mutex_enter(&device_lock); 901 bdev = bdevsw_lookup(dev); 902 mutex_exit(&device_lock); 903 if (bdev != NULL) 904 break; 905 906 /* Get device name from devsw_conv array */ 907 if ((name = bdevsw_getname(major(dev))) == NULL) 908 break; 909 910 /* Try to autoload device module */ 911 (void) module_autoload(name, MODULE_CLASS_DRIVER); 912 } while (gen != module_gen); 913 break; 914 915 default: 916 __unreachable(); 917 } 918 919 /* 920 * Release the I/O reference now that we have called .d_open, 921 * and reacquire the vnode lock. At this point, the device may 922 * have been revoked, so we must tread carefully. However, sn 923 * and sd remain valid pointers until we drop our reference. 924 */ 925 spec_io_exit(vp, sn); 926 vn_lock(vp, LK_EXCLUSIVE | LK_RETRY); 927 KASSERT(vp->v_specnode == sn); 928 929 /* 930 * If it has been revoked since we released the vnode lock and 931 * reacquired it, then spec_node_revoke has closed it, and we 932 * must fail with EBADF. 933 * 934 * Otherwise, if opening it failed, back out and release the 935 * open reference. If it was ever successfully opened and we 936 * got the last reference this way, it's now our job to close 937 * it. This might happen in the following scenario: 938 * 939 * Thread 1 Thread 2 940 * VOP_OPEN 941 * ... 942 * .d_open -> 0 (success) 943 * acquire vnode lock 944 * do stuff VOP_OPEN 945 * release vnode lock ... 946 * .d_open -> EBUSY 947 * VOP_CLOSE 948 * acquire vnode lock 949 * --sd_opencnt != 0 950 * => no .d_close 951 * release vnode lock 952 * acquire vnode lock 953 * --sd_opencnt == 0 954 * 955 * We can't resolve this by making spec_close wait for .d_open 956 * to complete before examining sd_opencnt, because .d_open can 957 * hang indefinitely, e.g. for a tty. 958 */ 959 mutex_enter(&device_lock); 960 if (sn->sn_gone) { 961 if (error == 0) 962 error = EBADF; 963 } else if (error == 0) { 964 /* 965 * Device has not been revoked, so our opencnt can't 966 * have gone away at this point -- transition to 967 * sn_gone=true happens before transition to 968 * sn_opencnt=0 in spec_node_revoke. 969 */ 970 KASSERT(sd->sd_opencnt); 971 KASSERT(sn->sn_opencnt); 972 KASSERTMSG(sn->sn_opencnt <= sd->sd_opencnt, 973 "sn_opencnt=%u > sd_opencnt=%u", 974 sn->sn_opencnt, sd->sd_opencnt); 975 KASSERT(!sd->sd_closing); 976 sd->sd_opened = true; 977 } else if (sd->sd_opencnt == 1 && sd->sd_opened) { 978 /* 979 * We're the last reference to a _previous_ open even 980 * though this one failed, so we have to close it. 981 * Don't decrement the reference count here -- 982 * spec_close will do that. 983 */ 984 KASSERT(sn->sn_opencnt == 1); 985 needclose = true; 986 } else { 987 KASSERT(sd->sd_opencnt); 988 KASSERT(sn->sn_opencnt); 989 KASSERTMSG(sn->sn_opencnt <= sd->sd_opencnt, 990 "sn_opencnt=%u > sd_opencnt=%u", 991 sn->sn_opencnt, sd->sd_opencnt); 992 sd->sd_opencnt--; 993 sn->sn_opencnt--; 994 if (vp->v_type == VBLK) 995 sd->sd_bdevvp = NULL; 996 } 997 mutex_exit(&device_lock); 998 999 /* 1000 * If this open failed, but the device was previously opened, 1001 * and another thread concurrently closed the vnode while we 1002 * were in the middle of reopening it, the other thread will 1003 * see sd_opencnt > 0 and thus decide not to call .d_close -- 1004 * it is now our responsibility to do so. 1005 * 1006 * XXX The flags passed to VOP_CLOSE here are wrong, but 1007 * drivers can't rely on FREAD|FWRITE anyway -- e.g., consider 1008 * a device opened by thread 0 with O_READ, then opened by 1009 * thread 1 with O_WRITE, then closed by thread 0, and finally 1010 * closed by thread 1; the last .d_close call will have FWRITE 1011 * but not FREAD. We should just eliminate the FREAD/FWRITE 1012 * parameter to .d_close altogether. 1013 */ 1014 if (needclose) { 1015 KASSERT(error); 1016 VOP_CLOSE(vp, FNONBLOCK, NOCRED); 1017 } 1018 1019 /* If anything went wrong, we're done. */ 1020 if (error) 1021 return error; 1022 1023 /* 1024 * For disk devices, automagically set the vnode size to the 1025 * partition size, if we can. This applies to block devices 1026 * and character devices alike -- every block device must have 1027 * a corresponding character device. And if the module is 1028 * loaded it will remain loaded until we're done here (it is 1029 * forbidden to devsw_detach until closed). So it is safe to 1030 * query cdev_type unconditionally here. 1031 */ 1032 if (cdev_type(dev) == D_DISK) { 1033 ioctl = vp->v_type == VCHR ? cdev_ioctl : bdev_ioctl; 1034 if ((*ioctl)(dev, DIOCGPARTINFO, &pi, FREAD, curlwp) == 0) 1035 uvm_vnp_setsize(vp, 1036 (voff_t)pi.pi_secsize * pi.pi_size); 1037 } 1038 1039 /* Success! */ 1040 return 0; 1041 } 1042 1043 /* 1044 * Vnode op for read 1045 */ 1046 /* ARGSUSED */ 1047 int 1048 spec_read(void *v) 1049 { 1050 struct vop_read_args /* { 1051 struct vnode *a_vp; 1052 struct uio *a_uio; 1053 int a_ioflag; 1054 kauth_cred_t a_cred; 1055 } */ *ap = v; 1056 struct vnode *vp = ap->a_vp; 1057 struct uio *uio = ap->a_uio; 1058 struct lwp *l = curlwp; 1059 struct specnode *sn; 1060 dev_t dev; 1061 struct buf *bp; 1062 daddr_t bn; 1063 int bsize, bscale; 1064 struct partinfo pi; 1065 int n, on; 1066 int error = 0; 1067 int i, nra; 1068 daddr_t lastbn, *rablks; 1069 int *rasizes; 1070 int nrablks, ratogo; 1071 1072 KASSERT(uio->uio_rw == UIO_READ); 1073 KASSERTMSG(VMSPACE_IS_KERNEL_P(uio->uio_vmspace) || 1074 uio->uio_vmspace == curproc->p_vmspace, 1075 "vmspace belongs to neither kernel nor curproc"); 1076 1077 if (uio->uio_resid == 0) 1078 return (0); 1079 1080 switch (vp->v_type) { 1081 1082 case VCHR: 1083 /* 1084 * Release the lock while we sleep -- possibly 1085 * indefinitely, if this is, e.g., a tty -- in 1086 * cdev_read, so we don't hold up everything else that 1087 * might want access to the vnode. 1088 * 1089 * But before we issue the read, take an I/O reference 1090 * to the specnode so close will know when we're done 1091 * reading. Note that the moment we release the lock, 1092 * the vnode's identity may change; hence spec_io_enter 1093 * may fail, and the caller may have a dead vnode on 1094 * their hands, if the file system on which vp lived 1095 * has been unmounted. 1096 */ 1097 VOP_UNLOCK(vp); 1098 error = spec_io_enter(vp, &sn, &dev); 1099 if (error) 1100 goto out; 1101 error = cdev_read(dev, uio, ap->a_ioflag); 1102 spec_io_exit(vp, sn); 1103 out: /* XXX What if the caller held an exclusive lock? */ 1104 vn_lock(vp, LK_SHARED | LK_RETRY); 1105 return (error); 1106 1107 case VBLK: 1108 KASSERT(vp == vp->v_specnode->sn_dev->sd_bdevvp); 1109 if (uio->uio_offset < 0) 1110 return (EINVAL); 1111 1112 if (bdev_ioctl(vp->v_rdev, DIOCGPARTINFO, &pi, FREAD, l) == 0) 1113 bsize = imin(imax(pi.pi_bsize, DEV_BSIZE), MAXBSIZE); 1114 else 1115 bsize = BLKDEV_IOSIZE; 1116 1117 bscale = bsize >> DEV_BSHIFT; 1118 1119 nra = uimax(16 * MAXPHYS / bsize - 1, 511); 1120 rablks = kmem_alloc(nra * sizeof(*rablks), KM_SLEEP); 1121 rasizes = kmem_alloc(nra * sizeof(*rasizes), KM_SLEEP); 1122 lastbn = ((uio->uio_offset + uio->uio_resid - 1) >> DEV_BSHIFT) 1123 &~ (bscale - 1); 1124 nrablks = ratogo = 0; 1125 do { 1126 bn = (uio->uio_offset >> DEV_BSHIFT) &~ (bscale - 1); 1127 on = uio->uio_offset % bsize; 1128 n = uimin((unsigned)(bsize - on), uio->uio_resid); 1129 1130 if (ratogo == 0) { 1131 nrablks = uimin((lastbn - bn) / bscale, nra); 1132 ratogo = nrablks; 1133 1134 for (i = 0; i < nrablks; ++i) { 1135 rablks[i] = bn + (i+1) * bscale; 1136 rasizes[i] = bsize; 1137 } 1138 1139 error = breadn(vp, bn, bsize, 1140 rablks, rasizes, nrablks, 1141 0, &bp); 1142 } else { 1143 if (ratogo > 0) 1144 --ratogo; 1145 error = bread(vp, bn, bsize, 0, &bp); 1146 } 1147 if (error) 1148 break; 1149 n = uimin(n, bsize - bp->b_resid); 1150 error = uiomove((char *)bp->b_data + on, n, uio); 1151 brelse(bp, 0); 1152 } while (error == 0 && uio->uio_resid > 0 && n != 0); 1153 1154 kmem_free(rablks, nra * sizeof(*rablks)); 1155 kmem_free(rasizes, nra * sizeof(*rasizes)); 1156 1157 return (error); 1158 1159 default: 1160 panic("spec_read type"); 1161 } 1162 /* NOTREACHED */ 1163 } 1164 1165 /* 1166 * Vnode op for write 1167 */ 1168 /* ARGSUSED */ 1169 int 1170 spec_write(void *v) 1171 { 1172 struct vop_write_args /* { 1173 struct vnode *a_vp; 1174 struct uio *a_uio; 1175 int a_ioflag; 1176 kauth_cred_t a_cred; 1177 } */ *ap = v; 1178 struct vnode *vp = ap->a_vp; 1179 struct uio *uio = ap->a_uio; 1180 struct lwp *l = curlwp; 1181 struct specnode *sn; 1182 dev_t dev; 1183 struct buf *bp; 1184 daddr_t bn; 1185 int bsize, bscale; 1186 struct partinfo pi; 1187 int n, on; 1188 int error = 0; 1189 1190 KASSERT(uio->uio_rw == UIO_WRITE); 1191 KASSERTMSG(VMSPACE_IS_KERNEL_P(uio->uio_vmspace) || 1192 uio->uio_vmspace == curproc->p_vmspace, 1193 "vmspace belongs to neither kernel nor curproc"); 1194 1195 switch (vp->v_type) { 1196 1197 case VCHR: 1198 /* 1199 * Release the lock while we sleep -- possibly 1200 * indefinitely, if this is, e.g., a tty -- in 1201 * cdev_write, so we don't hold up everything else that 1202 * might want access to the vnode. 1203 * 1204 * But before we issue the write, take an I/O reference 1205 * to the specnode so close will know when we're done 1206 * writing. Note that the moment we release the lock, 1207 * the vnode's identity may change; hence spec_io_enter 1208 * may fail, and the caller may have a dead vnode on 1209 * their hands, if the file system on which vp lived 1210 * has been unmounted. 1211 */ 1212 VOP_UNLOCK(vp); 1213 error = spec_io_enter(vp, &sn, &dev); 1214 if (error) 1215 goto out; 1216 error = cdev_write(dev, uio, ap->a_ioflag); 1217 spec_io_exit(vp, sn); 1218 out: vn_lock(vp, LK_EXCLUSIVE | LK_RETRY); 1219 return (error); 1220 1221 case VBLK: 1222 KASSERT(vp == vp->v_specnode->sn_dev->sd_bdevvp); 1223 if (uio->uio_resid == 0) 1224 return (0); 1225 if (uio->uio_offset < 0) 1226 return (EINVAL); 1227 1228 if (bdev_ioctl(vp->v_rdev, DIOCGPARTINFO, &pi, FREAD, l) == 0) 1229 bsize = imin(imax(pi.pi_bsize, DEV_BSIZE), MAXBSIZE); 1230 else 1231 bsize = BLKDEV_IOSIZE; 1232 1233 bscale = bsize >> DEV_BSHIFT; 1234 do { 1235 bn = (uio->uio_offset >> DEV_BSHIFT) &~ (bscale - 1); 1236 on = uio->uio_offset % bsize; 1237 n = uimin((unsigned)(bsize - on), uio->uio_resid); 1238 if (n == bsize) 1239 bp = getblk(vp, bn, bsize, 0, 0); 1240 else 1241 error = bread(vp, bn, bsize, B_MODIFY, &bp); 1242 if (error) { 1243 return (error); 1244 } 1245 n = uimin(n, bsize - bp->b_resid); 1246 error = uiomove((char *)bp->b_data + on, n, uio); 1247 if (error) 1248 brelse(bp, 0); 1249 else { 1250 if (n + on == bsize) 1251 bawrite(bp); 1252 else 1253 bdwrite(bp); 1254 error = bp->b_error; 1255 } 1256 } while (error == 0 && uio->uio_resid > 0 && n != 0); 1257 return (error); 1258 1259 default: 1260 panic("spec_write type"); 1261 } 1262 /* NOTREACHED */ 1263 } 1264 1265 /* 1266 * fdiscard, which on disk devices becomes TRIM. 1267 */ 1268 int 1269 spec_fdiscard(void *v) 1270 { 1271 struct vop_fdiscard_args /* { 1272 struct vnode *a_vp; 1273 off_t a_pos; 1274 off_t a_len; 1275 } */ *ap = v; 1276 struct vnode *vp = ap->a_vp; 1277 dev_t dev; 1278 1279 KASSERT(VOP_ISLOCKED(vp) == LK_EXCLUSIVE); 1280 1281 dev = vp->v_rdev; 1282 1283 switch (vp->v_type) { 1284 case VCHR: 1285 // this is not stored for character devices 1286 //KASSERT(vp == vp->v_specnode->sn_dev->sd_cdevvp); 1287 return cdev_discard(dev, ap->a_pos, ap->a_len); 1288 case VBLK: 1289 KASSERT(vp == vp->v_specnode->sn_dev->sd_bdevvp); 1290 return bdev_discard(dev, ap->a_pos, ap->a_len); 1291 default: 1292 panic("spec_fdiscard: not a device\n"); 1293 } 1294 } 1295 1296 /* 1297 * Device ioctl operation. 1298 */ 1299 /* ARGSUSED */ 1300 int 1301 spec_ioctl(void *v) 1302 { 1303 struct vop_ioctl_args /* { 1304 struct vnode *a_vp; 1305 u_long a_command; 1306 void *a_data; 1307 int a_fflag; 1308 kauth_cred_t a_cred; 1309 } */ *ap = v; 1310 struct vnode *vp = ap->a_vp; 1311 struct specnode *sn; 1312 dev_t dev; 1313 int error; 1314 1315 error = spec_io_enter(vp, &sn, &dev); 1316 if (error) 1317 return error; 1318 1319 switch (vp->v_type) { 1320 case VCHR: 1321 error = cdev_ioctl(dev, ap->a_command, ap->a_data, 1322 ap->a_fflag, curlwp); 1323 break; 1324 case VBLK: 1325 KASSERT(vp == vp->v_specnode->sn_dev->sd_bdevvp); 1326 error = bdev_ioctl(dev, ap->a_command, ap->a_data, 1327 ap->a_fflag, curlwp); 1328 break; 1329 default: 1330 panic("spec_ioctl"); 1331 /* NOTREACHED */ 1332 } 1333 1334 spec_io_exit(vp, sn); 1335 return error; 1336 } 1337 1338 /* ARGSUSED */ 1339 int 1340 spec_poll(void *v) 1341 { 1342 struct vop_poll_args /* { 1343 struct vnode *a_vp; 1344 int a_events; 1345 } */ *ap = v; 1346 struct vnode *vp = ap->a_vp; 1347 struct specnode *sn; 1348 dev_t dev; 1349 int revents; 1350 1351 if (spec_io_enter(vp, &sn, &dev) != 0) 1352 return POLLERR; 1353 1354 switch (vp->v_type) { 1355 case VCHR: 1356 revents = cdev_poll(dev, ap->a_events, curlwp); 1357 break; 1358 default: 1359 revents = genfs_poll(v); 1360 break; 1361 } 1362 1363 spec_io_exit(vp, sn); 1364 return revents; 1365 } 1366 1367 /* ARGSUSED */ 1368 int 1369 spec_kqfilter(void *v) 1370 { 1371 struct vop_kqfilter_args /* { 1372 struct vnode *a_vp; 1373 struct proc *a_kn; 1374 } */ *ap = v; 1375 struct vnode *vp = ap->a_vp; 1376 struct specnode *sn; 1377 dev_t dev; 1378 int error; 1379 1380 error = spec_io_enter(vp, &sn, &dev); 1381 if (error) 1382 return error; 1383 1384 switch (vp->v_type) { 1385 case VCHR: 1386 error = cdev_kqfilter(dev, ap->a_kn); 1387 break; 1388 default: 1389 /* 1390 * Block devices don't support kqfilter, and refuse it 1391 * for any other files (like those vflush()ed) too. 1392 */ 1393 error = EOPNOTSUPP; 1394 break; 1395 } 1396 1397 spec_io_exit(vp, sn); 1398 return error; 1399 } 1400 1401 /* 1402 * Allow mapping of only D_DISK. This is called only for VBLK. 1403 */ 1404 int 1405 spec_mmap(void *v) 1406 { 1407 struct vop_mmap_args /* { 1408 struct vnode *a_vp; 1409 vm_prot_t a_prot; 1410 kauth_cred_t a_cred; 1411 } */ *ap = v; 1412 struct vnode *vp = ap->a_vp; 1413 struct specnode *sn; 1414 dev_t dev; 1415 int error; 1416 1417 KASSERT(vp->v_type == VBLK); 1418 1419 error = spec_io_enter(vp, &sn, &dev); 1420 if (error) 1421 return error; 1422 1423 error = bdev_type(dev) == D_DISK ? 0 : EINVAL; 1424 1425 spec_io_exit(vp, sn); 1426 return 0; 1427 } 1428 1429 /* 1430 * Synch buffers associated with a block device 1431 */ 1432 /* ARGSUSED */ 1433 int 1434 spec_fsync(void *v) 1435 { 1436 struct vop_fsync_args /* { 1437 struct vnode *a_vp; 1438 kauth_cred_t a_cred; 1439 int a_flags; 1440 off_t offlo; 1441 off_t offhi; 1442 } */ *ap = v; 1443 struct vnode *vp = ap->a_vp; 1444 struct mount *mp; 1445 int error; 1446 1447 if (vp->v_type == VBLK) { 1448 if ((mp = spec_node_getmountedfs(vp)) != NULL) { 1449 error = VFS_FSYNC(mp, vp, ap->a_flags); 1450 if (error != EOPNOTSUPP) 1451 return error; 1452 } 1453 return vflushbuf(vp, ap->a_flags); 1454 } 1455 return (0); 1456 } 1457 1458 /* 1459 * Just call the device strategy routine 1460 */ 1461 int 1462 spec_strategy(void *v) 1463 { 1464 struct vop_strategy_args /* { 1465 struct vnode *a_vp; 1466 struct buf *a_bp; 1467 } */ *ap = v; 1468 struct vnode *vp = ap->a_vp; 1469 struct buf *bp = ap->a_bp; 1470 struct specnode *sn = NULL; 1471 dev_t dev; 1472 int error; 1473 1474 error = spec_io_enter(vp, &sn, &dev); 1475 if (error) 1476 goto out; 1477 1478 bp->b_dev = dev; 1479 1480 if (!(bp->b_flags & B_READ)) { 1481 #ifdef DIAGNOSTIC 1482 if (bp->b_vp && bp->b_vp->v_type == VBLK) { 1483 struct mount *mp = spec_node_getmountedfs(bp->b_vp); 1484 1485 if (mp && (mp->mnt_flag & MNT_RDONLY)) { 1486 printf("%s blk %"PRId64" written while ro!\n", 1487 mp->mnt_stat.f_mntonname, bp->b_blkno); 1488 } 1489 } 1490 #endif /* DIAGNOSTIC */ 1491 error = fscow_run(bp, false); 1492 if (error) 1493 goto out; 1494 } 1495 bdev_strategy(bp); 1496 1497 error = 0; 1498 1499 out: if (sn) 1500 spec_io_exit(vp, sn); 1501 if (error) { 1502 bp->b_error = error; 1503 bp->b_resid = bp->b_bcount; 1504 biodone(bp); 1505 } 1506 return error; 1507 } 1508 1509 int 1510 spec_inactive(void *v) 1511 { 1512 struct vop_inactive_v2_args /* { 1513 struct vnode *a_vp; 1514 struct bool *a_recycle; 1515 } */ *ap = v; 1516 1517 KASSERT(ap->a_vp->v_mount == dead_rootmount); 1518 *ap->a_recycle = true; 1519 1520 return 0; 1521 } 1522 1523 int 1524 spec_reclaim(void *v) 1525 { 1526 struct vop_reclaim_v2_args /* { 1527 struct vnode *a_vp; 1528 } */ *ap = v; 1529 struct vnode *vp = ap->a_vp; 1530 1531 KASSERT(vp->v_specnode->sn_opencnt == 0); 1532 1533 VOP_UNLOCK(vp); 1534 1535 KASSERT(vp->v_mount == dead_rootmount); 1536 return 0; 1537 } 1538 1539 /* 1540 * This is a noop, simply returning what one has been given. 1541 */ 1542 int 1543 spec_bmap(void *v) 1544 { 1545 struct vop_bmap_args /* { 1546 struct vnode *a_vp; 1547 daddr_t a_bn; 1548 struct vnode **a_vpp; 1549 daddr_t *a_bnp; 1550 int *a_runp; 1551 } */ *ap = v; 1552 1553 if (ap->a_vpp != NULL) 1554 *ap->a_vpp = ap->a_vp; 1555 if (ap->a_bnp != NULL) 1556 *ap->a_bnp = ap->a_bn; 1557 if (ap->a_runp != NULL) 1558 *ap->a_runp = (MAXBSIZE >> DEV_BSHIFT) - 1; 1559 return (0); 1560 } 1561 1562 /* 1563 * Device close routine 1564 */ 1565 /* ARGSUSED */ 1566 int 1567 spec_close(void *v) 1568 { 1569 struct vop_close_args /* { 1570 struct vnode *a_vp; 1571 int a_fflag; 1572 kauth_cred_t a_cred; 1573 } */ *ap = v; 1574 struct vnode *vp = ap->a_vp; 1575 struct session *sess; 1576 dev_t dev; 1577 int flags = ap->a_fflag; 1578 int mode, error, count; 1579 specnode_t *sn; 1580 specdev_t *sd; 1581 1582 KASSERT(VOP_ISLOCKED(vp) == LK_EXCLUSIVE); 1583 1584 mutex_enter(vp->v_interlock); 1585 sn = vp->v_specnode; 1586 dev = vp->v_rdev; 1587 sd = sn->sn_dev; 1588 /* 1589 * If we're going away soon, make this non-blocking. 1590 * Also ensures that we won't wedge in vn_lock below. 1591 */ 1592 if (vdead_check(vp, VDEAD_NOWAIT) != 0) 1593 flags |= FNONBLOCK; 1594 mutex_exit(vp->v_interlock); 1595 1596 switch (vp->v_type) { 1597 1598 case VCHR: 1599 /* 1600 * Hack: a tty device that is a controlling terminal 1601 * has a reference from the session structure. We 1602 * cannot easily tell that a character device is a 1603 * controlling terminal, unless it is the closing 1604 * process' controlling terminal. In that case, if the 1605 * open count is 1 release the reference from the 1606 * session. Also, remove the link from the tty back to 1607 * the session and pgrp. 1608 * 1609 * XXX V. fishy. 1610 */ 1611 mutex_enter(&proc_lock); 1612 sess = curlwp->l_proc->p_session; 1613 if (sn->sn_opencnt == 1 && vp == sess->s_ttyvp) { 1614 mutex_spin_enter(&tty_lock); 1615 sess->s_ttyvp = NULL; 1616 if (sess->s_ttyp->t_session != NULL) { 1617 sess->s_ttyp->t_pgrp = NULL; 1618 sess->s_ttyp->t_session = NULL; 1619 mutex_spin_exit(&tty_lock); 1620 /* Releases proc_lock. */ 1621 proc_sessrele(sess); 1622 } else { 1623 mutex_spin_exit(&tty_lock); 1624 if (sess->s_ttyp->t_pgrp != NULL) 1625 panic("spec_close: spurious pgrp ref"); 1626 mutex_exit(&proc_lock); 1627 } 1628 vrele(vp); 1629 } else 1630 mutex_exit(&proc_lock); 1631 1632 /* 1633 * If the vnode is locked, then we are in the midst 1634 * of forcably closing the device, otherwise we only 1635 * close on last reference. 1636 */ 1637 mode = S_IFCHR; 1638 break; 1639 1640 case VBLK: 1641 KASSERT(vp == vp->v_specnode->sn_dev->sd_bdevvp); 1642 /* 1643 * On last close of a block device (that isn't mounted) 1644 * we must invalidate any in core blocks, so that 1645 * we can, for instance, change floppy disks. 1646 */ 1647 error = vinvalbuf(vp, V_SAVE, ap->a_cred, curlwp, 0, 0); 1648 if (error) 1649 return (error); 1650 /* 1651 * We do not want to really close the device if it 1652 * is still in use unless we are trying to close it 1653 * forcibly. Since every use (buffer, vnode, swap, cmap) 1654 * holds a reference to the vnode, and because we mark 1655 * any other vnodes that alias this device, when the 1656 * sum of the reference counts on all the aliased 1657 * vnodes descends to one, we are on last close. 1658 */ 1659 mode = S_IFBLK; 1660 break; 1661 1662 default: 1663 panic("spec_close: not special"); 1664 } 1665 1666 /* 1667 * Decrement the open reference count of this node and the 1668 * device. For block devices, the open reference count must be 1669 * 1 at this point. If the device's open reference count goes 1670 * to zero, we're the last one out so get the lights. 1671 * 1672 * We may find --sd->sd_opencnt gives zero, and yet 1673 * sd->sd_opened is false. This happens if the vnode is 1674 * revoked at the same time as it is being opened, which can 1675 * happen when opening a tty blocks indefinitely. In that 1676 * case, we still must call close -- it is the job of close to 1677 * interrupt the open. Either way, the device will be no 1678 * longer opened, so we have to clear sd->sd_opened; subsequent 1679 * opens will have responsibility for issuing close. 1680 * 1681 * This has the side effect that the sequence of opens might 1682 * happen out of order -- we might end up doing open, open, 1683 * close, close, instead of open, close, open, close. This is 1684 * unavoidable with the current devsw API, where open is 1685 * allowed to block and close must be able to run concurrently 1686 * to interrupt it. It is the driver's responsibility to 1687 * ensure that close is idempotent so that this works. Drivers 1688 * requiring per-open state and exact 1:1 correspondence 1689 * between open and close can use fd_clone. 1690 */ 1691 mutex_enter(&device_lock); 1692 KASSERT(sn->sn_opencnt); 1693 KASSERT(sd->sd_opencnt); 1694 KASSERTMSG(sn->sn_opencnt <= sd->sd_opencnt, 1695 "sn_opencnt=%u > sd_opencnt=%u", 1696 sn->sn_opencnt, sd->sd_opencnt); 1697 sn->sn_opencnt--; 1698 count = --sd->sd_opencnt; 1699 if (vp->v_type == VBLK) { 1700 KASSERTMSG(count == 0, "block device with %u opens", 1701 count + 1); 1702 sd->sd_bdevvp = NULL; 1703 } 1704 if (count == 0) { 1705 KASSERTMSG(sn->sn_opencnt == 0, "sn_opencnt=%u", 1706 sn->sn_opencnt); 1707 KASSERT(!sd->sd_closing); 1708 sd->sd_opened = false; 1709 sd->sd_closing = true; 1710 } 1711 mutex_exit(&device_lock); 1712 1713 if (count != 0) 1714 return 0; 1715 1716 /* 1717 * If we're able to block, release the vnode lock & reacquire. We 1718 * might end up sleeping for someone else who wants our queues. They 1719 * won't get them if we hold the vnode locked. 1720 */ 1721 if (!(flags & FNONBLOCK)) 1722 VOP_UNLOCK(vp); 1723 1724 /* 1725 * If we can cancel all outstanding I/O, then wait for it to 1726 * drain before we call .d_close. Drivers that split up 1727 * .d_cancel and .d_close this way need not have any internal 1728 * mechanism for waiting in .d_close for I/O to drain. 1729 */ 1730 if (vp->v_type == VBLK) 1731 error = bdev_cancel(dev, flags, mode, curlwp); 1732 else 1733 error = cdev_cancel(dev, flags, mode, curlwp); 1734 if (error == 0) 1735 spec_io_drain(sd); 1736 else 1737 KASSERTMSG(error == ENODEV, "cancel dev=0x%lx failed with %d", 1738 (unsigned long)dev, error); 1739 1740 if (vp->v_type == VBLK) 1741 error = bdev_close(dev, flags, mode, curlwp); 1742 else 1743 error = cdev_close(dev, flags, mode, curlwp); 1744 1745 /* 1746 * Wait for all other devsw operations to drain. After this 1747 * point, no bdev/cdev_* can be active for this specdev. 1748 */ 1749 spec_io_drain(sd); 1750 1751 /* 1752 * Wake any spec_open calls waiting for close to finish -- do 1753 * this before reacquiring the vnode lock, because spec_open 1754 * holds the vnode lock while waiting, so doing this after 1755 * reacquiring the lock would deadlock. 1756 */ 1757 mutex_enter(&device_lock); 1758 KASSERT(!sd->sd_opened); 1759 KASSERT(sd->sd_closing); 1760 sd->sd_closing = false; 1761 cv_broadcast(&specfs_iocv); 1762 mutex_exit(&device_lock); 1763 1764 if (!(flags & FNONBLOCK)) 1765 vn_lock(vp, LK_EXCLUSIVE | LK_RETRY); 1766 1767 return (error); 1768 } 1769 1770 /* 1771 * Print out the contents of a special device vnode. 1772 */ 1773 int 1774 spec_print(void *v) 1775 { 1776 struct vop_print_args /* { 1777 struct vnode *a_vp; 1778 } */ *ap = v; 1779 1780 printf("dev %llu, %llu\n", (unsigned long long)major(ap->a_vp->v_rdev), 1781 (unsigned long long)minor(ap->a_vp->v_rdev)); 1782 return 0; 1783 } 1784 1785 /* 1786 * Return POSIX pathconf information applicable to special devices. 1787 */ 1788 int 1789 spec_pathconf(void *v) 1790 { 1791 struct vop_pathconf_args /* { 1792 struct vnode *a_vp; 1793 int a_name; 1794 register_t *a_retval; 1795 } */ *ap = v; 1796 1797 switch (ap->a_name) { 1798 case _PC_LINK_MAX: 1799 *ap->a_retval = LINK_MAX; 1800 return (0); 1801 case _PC_MAX_CANON: 1802 *ap->a_retval = MAX_CANON; 1803 return (0); 1804 case _PC_MAX_INPUT: 1805 *ap->a_retval = MAX_INPUT; 1806 return (0); 1807 case _PC_PIPE_BUF: 1808 *ap->a_retval = PIPE_BUF; 1809 return (0); 1810 case _PC_CHOWN_RESTRICTED: 1811 *ap->a_retval = 1; 1812 return (0); 1813 case _PC_VDISABLE: 1814 *ap->a_retval = _POSIX_VDISABLE; 1815 return (0); 1816 case _PC_SYNC_IO: 1817 *ap->a_retval = 1; 1818 return (0); 1819 default: 1820 return genfs_pathconf(ap); 1821 } 1822 /* NOTREACHED */ 1823 } 1824 1825 /* 1826 * Advisory record locking support. 1827 */ 1828 int 1829 spec_advlock(void *v) 1830 { 1831 struct vop_advlock_args /* { 1832 struct vnode *a_vp; 1833 void *a_id; 1834 int a_op; 1835 struct flock *a_fl; 1836 int a_flags; 1837 } */ *ap = v; 1838 struct vnode *vp = ap->a_vp; 1839 1840 return lf_advlock(ap, &vp->v_speclockf, (off_t)0); 1841 } 1842