xref: /netbsd-src/sys/miscfs/specfs/spec_vnops.c (revision 62a8debe1dc62962e18a1c918def78666141273b)
1 /*	$NetBSD: spec_vnops.c,v 1.127 2009/11/14 18:36:57 elad Exp $	*/
2 
3 /*-
4  * Copyright (c) 2008 The NetBSD Foundation, Inc.
5  * All rights reserved.
6  *
7  * Redistribution and use in source and binary forms, with or without
8  * modification, are permitted provided that the following conditions
9  * are met:
10  * 1. Redistributions of source code must retain the above copyright
11  *    notice, this list of conditions and the following disclaimer.
12  * 2. Redistributions in binary form must reproduce the above copyright
13  *    notice, this list of conditions and the following disclaimer in the
14  *    documentation and/or other materials provided with the distribution.
15  *
16  * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
17  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
18  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
19  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
20  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
21  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
22  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
23  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
24  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
25  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
26  * POSSIBILITY OF SUCH DAMAGE.
27  */
28 
29 /*
30  * Copyright (c) 1989, 1993
31  *	The Regents of the University of California.  All rights reserved.
32  *
33  * Redistribution and use in source and binary forms, with or without
34  * modification, are permitted provided that the following conditions
35  * are met:
36  * 1. Redistributions of source code must retain the above copyright
37  *    notice, this list of conditions and the following disclaimer.
38  * 2. Redistributions in binary form must reproduce the above copyright
39  *    notice, this list of conditions and the following disclaimer in the
40  *    documentation and/or other materials provided with the distribution.
41  * 3. Neither the name of the University nor the names of its contributors
42  *    may be used to endorse or promote products derived from this software
43  *    without specific prior written permission.
44  *
45  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
46  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
47  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
48  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
49  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
50  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
51  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
52  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
53  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
54  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
55  * SUCH DAMAGE.
56  *
57  *	@(#)spec_vnops.c	8.15 (Berkeley) 7/14/95
58  */
59 
60 #include <sys/cdefs.h>
61 __KERNEL_RCSID(0, "$NetBSD: spec_vnops.c,v 1.127 2009/11/14 18:36:57 elad Exp $");
62 
63 #include <sys/param.h>
64 #include <sys/proc.h>
65 #include <sys/systm.h>
66 #include <sys/kernel.h>
67 #include <sys/conf.h>
68 #include <sys/buf.h>
69 #include <sys/mount.h>
70 #include <sys/namei.h>
71 #include <sys/vnode.h>
72 #include <sys/stat.h>
73 #include <sys/errno.h>
74 #include <sys/ioctl.h>
75 #include <sys/poll.h>
76 #include <sys/file.h>
77 #include <sys/disklabel.h>
78 #include <sys/lockf.h>
79 #include <sys/tty.h>
80 #include <sys/kauth.h>
81 #include <sys/fstrans.h>
82 #include <sys/module.h>
83 
84 #include <miscfs/genfs/genfs.h>
85 #include <miscfs/specfs/specdev.h>
86 
87 /* symbolic sleep message strings for devices */
88 const char	devopn[] = "devopn";
89 const char	devio[] = "devio";
90 const char	devwait[] = "devwait";
91 const char	devin[] = "devin";
92 const char	devout[] = "devout";
93 const char	devioc[] = "devioc";
94 const char	devcls[] = "devcls";
95 
96 vnode_t		*specfs_hash[SPECHSZ];
97 
98 /*
99  * This vnode operations vector is used for special device nodes
100  * created from whole cloth by the kernel.  For the ops vector for
101  * vnodes built from special devices found in a filesystem, see (e.g)
102  * ffs_specop_entries[] in ffs_vnops.c or the equivalent for other
103  * filesystems.
104  */
105 
106 int (**spec_vnodeop_p)(void *);
107 const struct vnodeopv_entry_desc spec_vnodeop_entries[] = {
108 	{ &vop_default_desc, vn_default_error },
109 	{ &vop_lookup_desc, spec_lookup },		/* lookup */
110 	{ &vop_create_desc, spec_create },		/* create */
111 	{ &vop_mknod_desc, spec_mknod },		/* mknod */
112 	{ &vop_open_desc, spec_open },			/* open */
113 	{ &vop_close_desc, spec_close },		/* close */
114 	{ &vop_access_desc, spec_access },		/* access */
115 	{ &vop_getattr_desc, spec_getattr },		/* getattr */
116 	{ &vop_setattr_desc, spec_setattr },		/* setattr */
117 	{ &vop_read_desc, spec_read },			/* read */
118 	{ &vop_write_desc, spec_write },		/* write */
119 	{ &vop_fcntl_desc, spec_fcntl },		/* fcntl */
120 	{ &vop_ioctl_desc, spec_ioctl },		/* ioctl */
121 	{ &vop_poll_desc, spec_poll },			/* poll */
122 	{ &vop_kqfilter_desc, spec_kqfilter },		/* kqfilter */
123 	{ &vop_revoke_desc, spec_revoke },		/* revoke */
124 	{ &vop_mmap_desc, spec_mmap },			/* mmap */
125 	{ &vop_fsync_desc, spec_fsync },		/* fsync */
126 	{ &vop_seek_desc, spec_seek },			/* seek */
127 	{ &vop_remove_desc, spec_remove },		/* remove */
128 	{ &vop_link_desc, spec_link },			/* link */
129 	{ &vop_rename_desc, spec_rename },		/* rename */
130 	{ &vop_mkdir_desc, spec_mkdir },		/* mkdir */
131 	{ &vop_rmdir_desc, spec_rmdir },		/* rmdir */
132 	{ &vop_symlink_desc, spec_symlink },		/* symlink */
133 	{ &vop_readdir_desc, spec_readdir },		/* readdir */
134 	{ &vop_readlink_desc, spec_readlink },		/* readlink */
135 	{ &vop_abortop_desc, spec_abortop },		/* abortop */
136 	{ &vop_inactive_desc, spec_inactive },		/* inactive */
137 	{ &vop_reclaim_desc, spec_reclaim },		/* reclaim */
138 	{ &vop_lock_desc, spec_lock },			/* lock */
139 	{ &vop_unlock_desc, spec_unlock },		/* unlock */
140 	{ &vop_bmap_desc, spec_bmap },			/* bmap */
141 	{ &vop_strategy_desc, spec_strategy },		/* strategy */
142 	{ &vop_print_desc, spec_print },		/* print */
143 	{ &vop_islocked_desc, spec_islocked },		/* islocked */
144 	{ &vop_pathconf_desc, spec_pathconf },		/* pathconf */
145 	{ &vop_advlock_desc, spec_advlock },		/* advlock */
146 	{ &vop_bwrite_desc, spec_bwrite },		/* bwrite */
147 	{ &vop_getpages_desc, spec_getpages },		/* getpages */
148 	{ &vop_putpages_desc, spec_putpages },		/* putpages */
149 	{ NULL, NULL }
150 };
151 const struct vnodeopv_desc spec_vnodeop_opv_desc =
152 	{ &spec_vnodeop_p, spec_vnodeop_entries };
153 
154 static kauth_listener_t rawio_listener;
155 
156 /* Returns true if vnode is /dev/mem or /dev/kmem. */
157 bool
158 iskmemvp(struct vnode *vp)
159 {
160 	return ((vp->v_type == VCHR) && iskmemdev(vp->v_rdev));
161 }
162 
163 /*
164  * Returns true if dev is /dev/mem or /dev/kmem.
165  */
166 int
167 iskmemdev(dev_t dev)
168 {
169 	/* mem_no is emitted by config(8) to generated devsw.c */
170 	extern const int mem_no;
171 
172 	/* minor 14 is /dev/io on i386 with COMPAT_10 */
173 	return (major(dev) == mem_no && (minor(dev) < 2 || minor(dev) == 14));
174 }
175 
176 static int
177 rawio_listener_cb(kauth_cred_t cred, kauth_action_t action, void *cookie,
178     void *arg0, void *arg1, void *arg2, void *arg3)
179 {
180 	int result;
181 
182 	result = KAUTH_RESULT_DEFER;
183 
184 	if ((action != KAUTH_DEVICE_RAWIO_SPEC) &&
185 	    (action != KAUTH_DEVICE_RAWIO_PASSTHRU))
186 		return result;
187 
188 	/* Access is mandated by permissions. */
189 	result = KAUTH_RESULT_ALLOW;
190 
191 	return result;
192 }
193 
194 void
195 spec_init(void)
196 {
197 
198 	rawio_listener = kauth_listen_scope(KAUTH_SCOPE_DEVICE,
199 	    rawio_listener_cb, NULL);
200 }
201 
202 /*
203  * Initialize a vnode that represents a device.
204  */
205 void
206 spec_node_init(vnode_t *vp, dev_t rdev)
207 {
208 	specnode_t *sn;
209 	specdev_t *sd;
210 	vnode_t *vp2;
211 	vnode_t **vpp;
212 
213 	KASSERT(vp->v_type == VBLK || vp->v_type == VCHR);
214 	KASSERT(vp->v_specnode == NULL);
215 
216 	/*
217 	 * Search the hash table for this device.  If known, add a
218 	 * reference to the device structure.  If not known, create
219 	 * a new entry to represent the device.  In all cases add
220 	 * the vnode to the hash table.
221 	 */
222 	sn = kmem_alloc(sizeof(*sn), KM_SLEEP);
223 	if (sn == NULL) {
224 		/* XXX */
225 		panic("spec_node_init: unable to allocate memory");
226 	}
227 	sd = kmem_alloc(sizeof(*sd), KM_SLEEP);
228 	if (sd == NULL) {
229 		/* XXX */
230 		panic("spec_node_init: unable to allocate memory");
231 	}
232 	mutex_enter(&device_lock);
233 	vpp = &specfs_hash[SPECHASH(rdev)];
234 	for (vp2 = *vpp; vp2 != NULL; vp2 = vp2->v_specnext) {
235 		KASSERT(vp2->v_specnode != NULL);
236 		if (rdev == vp2->v_rdev && vp->v_type == vp2->v_type) {
237 			break;
238 		}
239 	}
240 	if (vp2 == NULL) {
241 		/* No existing record, create a new one. */
242 		sd->sd_rdev = rdev;
243 		sd->sd_mountpoint = NULL;
244 		sd->sd_lockf = NULL;
245 		sd->sd_refcnt = 1;
246 		sd->sd_opencnt = 0;
247 		sd->sd_bdevvp = NULL;
248 		sn->sn_dev = sd;
249 		sd = NULL;
250 	} else {
251 		/* Use the existing record. */
252 		sn->sn_dev = vp2->v_specnode->sn_dev;
253 		sn->sn_dev->sd_refcnt++;
254 	}
255 	/* Insert vnode into the hash chain. */
256 	sn->sn_opencnt = 0;
257 	sn->sn_rdev = rdev;
258 	sn->sn_gone = false;
259 	vp->v_specnode = sn;
260 	vp->v_specnext = *vpp;
261 	*vpp = vp;
262 	mutex_exit(&device_lock);
263 
264 	/* Free the record we allocated if unused. */
265 	if (sd != NULL) {
266 		kmem_free(sd, sizeof(*sd));
267 	}
268 }
269 
270 /*
271  * A vnode representing a special device is going away.  Close
272  * the device if the vnode holds it open.
273  */
274 void
275 spec_node_revoke(vnode_t *vp)
276 {
277 	specnode_t *sn;
278 	specdev_t *sd;
279 
280 	sn = vp->v_specnode;
281 	sd = sn->sn_dev;
282 
283 	KASSERT(vp->v_type == VBLK || vp->v_type == VCHR);
284 	KASSERT(vp->v_specnode != NULL);
285 	KASSERT((vp->v_iflag & VI_XLOCK) != 0);
286 	KASSERT(sn->sn_gone == false);
287 
288 	mutex_enter(&device_lock);
289 	KASSERT(sn->sn_opencnt <= sd->sd_opencnt);
290 	if (sn->sn_opencnt != 0) {
291 		sd->sd_opencnt -= (sn->sn_opencnt - 1);
292 		sn->sn_opencnt = 1;
293 		sn->sn_gone = true;
294 		mutex_exit(&device_lock);
295 
296 		VOP_CLOSE(vp, FNONBLOCK, NOCRED);
297 
298 		mutex_enter(&device_lock);
299 		KASSERT(sn->sn_opencnt == 0);
300 	}
301 	mutex_exit(&device_lock);
302 }
303 
304 /*
305  * A vnode representing a special device is being recycled.
306  * Destroy the specfs component.
307  */
308 void
309 spec_node_destroy(vnode_t *vp)
310 {
311 	specnode_t *sn;
312 	specdev_t *sd;
313 	vnode_t **vpp, *vp2;
314 	int refcnt;
315 
316 	sn = vp->v_specnode;
317 	sd = sn->sn_dev;
318 
319 	KASSERT(vp->v_type == VBLK || vp->v_type == VCHR);
320 	KASSERT(vp->v_specnode != NULL);
321 	KASSERT(sn->sn_opencnt == 0);
322 
323 	mutex_enter(&device_lock);
324 	/* Remove from the hash and destroy the node. */
325 	vpp = &specfs_hash[SPECHASH(vp->v_rdev)];
326 	for (vp2 = *vpp;; vp2 = vp2->v_specnext) {
327 		if (vp2 == NULL) {
328 			panic("spec_node_destroy: corrupt hash");
329 		}
330 		if (vp2 == vp) {
331 			KASSERT(vp == *vpp);
332 			*vpp = vp->v_specnext;
333 			break;
334 		}
335 		if (vp2->v_specnext == vp) {
336 			vp2->v_specnext = vp->v_specnext;
337 			break;
338 		}
339 	}
340 	sn = vp->v_specnode;
341 	vp->v_specnode = NULL;
342 	refcnt = sd->sd_refcnt--;
343 	KASSERT(refcnt > 0);
344 	mutex_exit(&device_lock);
345 
346 	/* If the device is no longer in use, destroy our record. */
347 	if (refcnt == 1) {
348 		KASSERT(sd->sd_opencnt == 0);
349 		KASSERT(sd->sd_bdevvp == NULL);
350 		kmem_free(sd, sizeof(*sd));
351 	}
352 	kmem_free(sn, sizeof(*sn));
353 }
354 
355 /*
356  * Trivial lookup routine that always fails.
357  */
358 int
359 spec_lookup(void *v)
360 {
361 	struct vop_lookup_args /* {
362 		struct vnode *a_dvp;
363 		struct vnode **a_vpp;
364 		struct componentname *a_cnp;
365 	} */ *ap = v;
366 
367 	*ap->a_vpp = NULL;
368 	return (ENOTDIR);
369 }
370 
371 /*
372  * Open a special file.
373  */
374 /* ARGSUSED */
375 int
376 spec_open(void *v)
377 {
378 	struct vop_open_args /* {
379 		struct vnode *a_vp;
380 		int  a_mode;
381 		kauth_cred_t a_cred;
382 	} */ *ap = v;
383 	struct lwp *l;
384 	struct vnode *vp;
385 	dev_t dev;
386 	int error;
387 	struct partinfo pi;
388 	enum kauth_device_req req;
389 	specnode_t *sn;
390 	specdev_t *sd;
391 
392 	u_int gen;
393 	const char *name;
394 
395 	l = curlwp;
396 	vp = ap->a_vp;
397 	dev = vp->v_rdev;
398 	sn = vp->v_specnode;
399 	sd = sn->sn_dev;
400 	name = NULL;
401 	gen = 0;
402 
403 	/*
404 	 * Don't allow open if fs is mounted -nodev.
405 	 */
406 	if (vp->v_mount && (vp->v_mount->mnt_flag & MNT_NODEV))
407 		return (ENXIO);
408 
409 	switch (ap->a_mode & (FREAD | FWRITE)) {
410 	case FREAD | FWRITE:
411 		req = KAUTH_REQ_DEVICE_RAWIO_SPEC_RW;
412 		break;
413 	case FWRITE:
414 		req = KAUTH_REQ_DEVICE_RAWIO_SPEC_WRITE;
415 		break;
416 	default:
417 		req = KAUTH_REQ_DEVICE_RAWIO_SPEC_READ;
418 		break;
419 	}
420 
421 	switch (vp->v_type) {
422 	case VCHR:
423 		error = kauth_authorize_device_spec(ap->a_cred, req, vp);
424 		if (error != 0)
425 			return (error);
426 
427 		/*
428 		 * Character devices can accept opens from multiple
429 		 * vnodes.
430 		 */
431 		mutex_enter(&device_lock);
432 		if (sn->sn_gone) {
433 			mutex_exit(&device_lock);
434 			return (EBADF);
435 		}
436 		sd->sd_opencnt++;
437 		sn->sn_opencnt++;
438 		mutex_exit(&device_lock);
439 		if (cdev_type(dev) == D_TTY)
440 			vp->v_vflag |= VV_ISTTY;
441 		VOP_UNLOCK(vp, 0);
442 		do {
443 			const struct cdevsw *cdev;
444 
445 			gen = module_gen;
446 			error = cdev_open(dev, ap->a_mode, S_IFCHR, l);
447 			if (error != ENXIO)
448 				break;
449 
450 			/* Check if we already have a valid driver */
451 			mutex_enter(&device_lock);
452 			cdev = cdevsw_lookup(dev);
453 			mutex_exit(&device_lock);
454 			if (cdev != NULL)
455 				break;
456 
457 			/* Get device name from devsw_conv array */
458 			if ((name = cdevsw_getname(major(dev))) == NULL)
459 				break;
460 
461 			/* Try to autoload device module */
462 			mutex_enter(&module_lock);
463 			(void) module_autoload(name, MODULE_CLASS_DRIVER);
464 			mutex_exit(&module_lock);
465 		} while (gen != module_gen);
466 
467 		vn_lock(vp, LK_EXCLUSIVE | LK_RETRY);
468 		break;
469 
470 	case VBLK:
471 		error = kauth_authorize_device_spec(ap->a_cred, req, vp);
472 		if (error != 0)
473 			return (error);
474 
475 		/*
476 		 * For block devices, permit only one open.  The buffer
477 		 * cache cannot remain self-consistent with multiple
478 		 * vnodes holding a block device open.
479 		 */
480 		mutex_enter(&device_lock);
481 		if (sn->sn_gone) {
482 			mutex_exit(&device_lock);
483 			return (EBADF);
484 		}
485 		if (sd->sd_opencnt != 0) {
486 			mutex_exit(&device_lock);
487 			return EBUSY;
488 		}
489 		sn->sn_opencnt = 1;
490 		sd->sd_opencnt = 1;
491 		sd->sd_bdevvp = vp;
492 		mutex_exit(&device_lock);
493 		do {
494 			const struct bdevsw *bdev;
495 
496 			gen = module_gen;
497 			error = bdev_open(dev, ap->a_mode, S_IFBLK, l);
498 			if (error != ENXIO)
499 				break;
500 
501 			/* Check if we already have a valid driver */
502 			mutex_enter(&device_lock);
503 			bdev = bdevsw_lookup(dev);
504 			mutex_exit(&device_lock);
505 			if (bdev != NULL)
506 				break;
507 
508 			/* Get device name from devsw_conv array */
509 			if ((name = bdevsw_getname(major(dev))) == NULL)
510 				break;
511 
512 			VOP_UNLOCK(vp, 0);
513 
514                         /* Try to autoload device module */
515 			mutex_enter(&module_lock);
516 			(void) module_autoload(name, MODULE_CLASS_DRIVER);
517 			mutex_exit(&module_lock);
518 
519 			vn_lock(vp, LK_EXCLUSIVE | LK_RETRY);
520 		} while (gen != module_gen);
521 
522 		break;
523 
524 	case VNON:
525 	case VLNK:
526 	case VDIR:
527 	case VREG:
528 	case VBAD:
529 	case VFIFO:
530 	case VSOCK:
531 	default:
532 		return 0;
533 	}
534 
535 	mutex_enter(&device_lock);
536 	if (sn->sn_gone) {
537 		if (error == 0)
538 			error = EBADF;
539 	} else if (error != 0) {
540 		sd->sd_opencnt--;
541 		sn->sn_opencnt--;
542 		if (vp->v_type == VBLK)
543 			sd->sd_bdevvp = NULL;
544 
545 	}
546 	mutex_exit(&device_lock);
547 
548 	if (cdev_type(dev) != D_DISK || error != 0)
549 		return error;
550 
551 	if (vp->v_type == VCHR)
552 		error = cdev_ioctl(vp->v_rdev, DIOCGPART, &pi, FREAD, curlwp);
553 	else
554 		error = bdev_ioctl(vp->v_rdev, DIOCGPART, &pi, FREAD, curlwp);
555 	if (error == 0)
556 		uvm_vnp_setsize(vp,
557 		    (voff_t)pi.disklab->d_secsize * pi.part->p_size);
558 	return 0;
559 }
560 
561 /*
562  * Vnode op for read
563  */
564 /* ARGSUSED */
565 int
566 spec_read(void *v)
567 {
568 	struct vop_read_args /* {
569 		struct vnode *a_vp;
570 		struct uio *a_uio;
571 		int  a_ioflag;
572 		kauth_cred_t a_cred;
573 	} */ *ap = v;
574 	struct vnode *vp = ap->a_vp;
575 	struct uio *uio = ap->a_uio;
576  	struct lwp *l = curlwp;
577 	struct buf *bp;
578 	daddr_t bn;
579 	int bsize, bscale;
580 	struct partinfo dpart;
581 	int n, on;
582 	int error = 0;
583 
584 #ifdef DIAGNOSTIC
585 	if (uio->uio_rw != UIO_READ)
586 		panic("spec_read mode");
587 	if (&uio->uio_vmspace->vm_map != kernel_map &&
588 	    uio->uio_vmspace != curproc->p_vmspace)
589 		panic("spec_read proc");
590 #endif
591 	if (uio->uio_resid == 0)
592 		return (0);
593 
594 	switch (vp->v_type) {
595 
596 	case VCHR:
597 		VOP_UNLOCK(vp, 0);
598 		error = cdev_read(vp->v_rdev, uio, ap->a_ioflag);
599 		vn_lock(vp, LK_SHARED | LK_RETRY);
600 		return (error);
601 
602 	case VBLK:
603 		KASSERT(vp == vp->v_specnode->sn_dev->sd_bdevvp);
604 		if (uio->uio_offset < 0)
605 			return (EINVAL);
606 		bsize = BLKDEV_IOSIZE;
607 		if (bdev_ioctl(vp->v_rdev, DIOCGPART, &dpart, FREAD, l) == 0) {
608 			if (dpart.part->p_fstype == FS_BSDFFS &&
609 			    dpart.part->p_frag != 0 && dpart.part->p_fsize != 0)
610 				bsize = dpart.part->p_frag *
611 				    dpart.part->p_fsize;
612 		}
613 		bscale = bsize >> DEV_BSHIFT;
614 		do {
615 			bn = (uio->uio_offset >> DEV_BSHIFT) &~ (bscale - 1);
616 			on = uio->uio_offset % bsize;
617 			n = min((unsigned)(bsize - on), uio->uio_resid);
618 			error = bread(vp, bn, bsize, NOCRED, 0, &bp);
619 			n = min(n, bsize - bp->b_resid);
620 			if (error) {
621 				brelse(bp, 0);
622 				return (error);
623 			}
624 			error = uiomove((char *)bp->b_data + on, n, uio);
625 			brelse(bp, 0);
626 		} while (error == 0 && uio->uio_resid > 0 && n != 0);
627 		return (error);
628 
629 	default:
630 		panic("spec_read type");
631 	}
632 	/* NOTREACHED */
633 }
634 
635 /*
636  * Vnode op for write
637  */
638 /* ARGSUSED */
639 int
640 spec_write(void *v)
641 {
642 	struct vop_write_args /* {
643 		struct vnode *a_vp;
644 		struct uio *a_uio;
645 		int  a_ioflag;
646 		kauth_cred_t a_cred;
647 	} */ *ap = v;
648 	struct vnode *vp = ap->a_vp;
649 	struct uio *uio = ap->a_uio;
650 	struct lwp *l = curlwp;
651 	struct buf *bp;
652 	daddr_t bn;
653 	int bsize, bscale;
654 	struct partinfo dpart;
655 	int n, on;
656 	int error = 0;
657 
658 #ifdef DIAGNOSTIC
659 	if (uio->uio_rw != UIO_WRITE)
660 		panic("spec_write mode");
661 	if (&uio->uio_vmspace->vm_map != kernel_map &&
662 	    uio->uio_vmspace != curproc->p_vmspace)
663 		panic("spec_write proc");
664 #endif
665 
666 	switch (vp->v_type) {
667 
668 	case VCHR:
669 		VOP_UNLOCK(vp, 0);
670 		error = cdev_write(vp->v_rdev, uio, ap->a_ioflag);
671 		vn_lock(vp, LK_EXCLUSIVE | LK_RETRY);
672 		return (error);
673 
674 	case VBLK:
675 		KASSERT(vp == vp->v_specnode->sn_dev->sd_bdevvp);
676 		if (uio->uio_resid == 0)
677 			return (0);
678 		if (uio->uio_offset < 0)
679 			return (EINVAL);
680 		bsize = BLKDEV_IOSIZE;
681 		if (bdev_ioctl(vp->v_rdev, DIOCGPART, &dpart, FREAD, l) == 0) {
682 			if (dpart.part->p_fstype == FS_BSDFFS &&
683 			    dpart.part->p_frag != 0 && dpart.part->p_fsize != 0)
684 				bsize = dpart.part->p_frag *
685 				    dpart.part->p_fsize;
686 		}
687 		bscale = bsize >> DEV_BSHIFT;
688 		do {
689 			bn = (uio->uio_offset >> DEV_BSHIFT) &~ (bscale - 1);
690 			on = uio->uio_offset % bsize;
691 			n = min((unsigned)(bsize - on), uio->uio_resid);
692 			if (n == bsize)
693 				bp = getblk(vp, bn, bsize, 0, 0);
694 			else
695 				error = bread(vp, bn, bsize, NOCRED,
696 				    B_MODIFY, &bp);
697 			if (error) {
698 				brelse(bp, 0);
699 				return (error);
700 			}
701 			n = min(n, bsize - bp->b_resid);
702 			error = uiomove((char *)bp->b_data + on, n, uio);
703 			if (error)
704 				brelse(bp, 0);
705 			else {
706 				if (n + on == bsize)
707 					bawrite(bp);
708 				else
709 					bdwrite(bp);
710 				error = bp->b_error;
711 			}
712 		} while (error == 0 && uio->uio_resid > 0 && n != 0);
713 		return (error);
714 
715 	default:
716 		panic("spec_write type");
717 	}
718 	/* NOTREACHED */
719 }
720 
721 /*
722  * Device ioctl operation.
723  */
724 /* ARGSUSED */
725 int
726 spec_ioctl(void *v)
727 {
728 	struct vop_ioctl_args /* {
729 		struct vnode *a_vp;
730 		u_long a_command;
731 		void  *a_data;
732 		int  a_fflag;
733 		kauth_cred_t a_cred;
734 	} */ *ap = v;
735 	struct vnode *vp;
736 	dev_t dev;
737 
738 	/*
739 	 * Extract all the info we need from the vnode, taking care to
740 	 * avoid a race with VOP_REVOKE().
741 	 */
742 
743 	vp = ap->a_vp;
744 	dev = NODEV;
745 	mutex_enter(&vp->v_interlock);
746 	if ((vp->v_iflag & VI_XLOCK) == 0 && vp->v_specnode) {
747 		dev = vp->v_rdev;
748 	}
749 	mutex_exit(&vp->v_interlock);
750 	if (dev == NODEV) {
751 		return ENXIO;
752 	}
753 
754 	switch (vp->v_type) {
755 
756 	case VCHR:
757 		return cdev_ioctl(dev, ap->a_command, ap->a_data,
758 		    ap->a_fflag, curlwp);
759 
760 	case VBLK:
761 		KASSERT(vp == vp->v_specnode->sn_dev->sd_bdevvp);
762 		return bdev_ioctl(dev, ap->a_command, ap->a_data,
763 		   ap->a_fflag, curlwp);
764 
765 	default:
766 		panic("spec_ioctl");
767 		/* NOTREACHED */
768 	}
769 }
770 
771 /* ARGSUSED */
772 int
773 spec_poll(void *v)
774 {
775 	struct vop_poll_args /* {
776 		struct vnode *a_vp;
777 		int a_events;
778 	} */ *ap = v;
779 	struct vnode *vp;
780 	dev_t dev;
781 
782 	/*
783 	 * Extract all the info we need from the vnode, taking care to
784 	 * avoid a race with VOP_REVOKE().
785 	 */
786 
787 	vp = ap->a_vp;
788 	dev = NODEV;
789 	mutex_enter(&vp->v_interlock);
790 	if ((vp->v_iflag & VI_XLOCK) == 0 && vp->v_specnode) {
791 		dev = vp->v_rdev;
792 	}
793 	mutex_exit(&vp->v_interlock);
794 	if (dev == NODEV) {
795 		return POLLERR;
796 	}
797 
798 	switch (vp->v_type) {
799 
800 	case VCHR:
801 		return cdev_poll(dev, ap->a_events, curlwp);
802 
803 	default:
804 		return (genfs_poll(v));
805 	}
806 }
807 
808 /* ARGSUSED */
809 int
810 spec_kqfilter(void *v)
811 {
812 	struct vop_kqfilter_args /* {
813 		struct vnode	*a_vp;
814 		struct proc	*a_kn;
815 	} */ *ap = v;
816 	dev_t dev;
817 
818 	switch (ap->a_vp->v_type) {
819 
820 	case VCHR:
821 		dev = ap->a_vp->v_rdev;
822 		return cdev_kqfilter(dev, ap->a_kn);
823 	default:
824 		/*
825 		 * Block devices don't support kqfilter, and refuse it
826 		 * for any other files (like those vflush()ed) too.
827 		 */
828 		return (EOPNOTSUPP);
829 	}
830 }
831 
832 /*
833  * Allow mapping of only D_DISK.  This is called only for VBLK.
834  */
835 int
836 spec_mmap(void *v)
837 {
838 	struct vop_mmap_args /* {
839 		struct vnode *a_vp;
840 		vm_prot_t a_prot;
841 		kauth_cred_t a_cred;
842 	} */ *ap = v;
843 	struct vnode *vp = ap->a_vp;
844 
845 	KASSERT(vp->v_type == VBLK);
846 	if (bdev_type(vp->v_rdev) != D_DISK)
847 		return EINVAL;
848 
849 	return 0;
850 }
851 
852 /*
853  * Synch buffers associated with a block device
854  */
855 /* ARGSUSED */
856 int
857 spec_fsync(void *v)
858 {
859 	struct vop_fsync_args /* {
860 		struct vnode *a_vp;
861 		kauth_cred_t a_cred;
862 		int  a_flags;
863 		off_t offlo;
864 		off_t offhi;
865 	} */ *ap = v;
866 	struct vnode *vp = ap->a_vp;
867 	struct mount *mp;
868 	int error;
869 
870 	if (vp->v_type == VBLK) {
871 		if ((mp = vp->v_specmountpoint) != NULL) {
872 			error = VFS_FSYNC(mp, vp, ap->a_flags | FSYNC_VFS);
873 			if (error != EOPNOTSUPP)
874 				return error;
875 		}
876 		vflushbuf(vp, (ap->a_flags & FSYNC_WAIT) != 0);
877 	}
878 	return (0);
879 }
880 
881 /*
882  * Just call the device strategy routine
883  */
884 int
885 spec_strategy(void *v)
886 {
887 	struct vop_strategy_args /* {
888 		struct vnode *a_vp;
889 		struct buf *a_bp;
890 	} */ *ap = v;
891 	struct vnode *vp = ap->a_vp;
892 	struct buf *bp = ap->a_bp;
893 	int error;
894 
895 	KASSERT(vp == vp->v_specnode->sn_dev->sd_bdevvp);
896 
897 	error = 0;
898 	bp->b_dev = vp->v_rdev;
899 
900 	if (!(bp->b_flags & B_READ))
901 		error = fscow_run(bp, false);
902 
903 	if (error) {
904 		bp->b_error = error;
905 		biodone(bp);
906 		return (error);
907 	}
908 
909 	bdev_strategy(bp);
910 
911 	return (0);
912 }
913 
914 int
915 spec_inactive(void *v)
916 {
917 	struct vop_inactive_args /* {
918 		struct vnode *a_vp;
919 		struct proc *a_l;
920 	} */ *ap = v;
921 
922 	VOP_UNLOCK(ap->a_vp, 0);
923 	return (0);
924 }
925 
926 /*
927  * This is a noop, simply returning what one has been given.
928  */
929 int
930 spec_bmap(void *v)
931 {
932 	struct vop_bmap_args /* {
933 		struct vnode *a_vp;
934 		daddr_t  a_bn;
935 		struct vnode **a_vpp;
936 		daddr_t *a_bnp;
937 		int *a_runp;
938 	} */ *ap = v;
939 
940 	if (ap->a_vpp != NULL)
941 		*ap->a_vpp = ap->a_vp;
942 	if (ap->a_bnp != NULL)
943 		*ap->a_bnp = ap->a_bn;
944 	if (ap->a_runp != NULL)
945 		*ap->a_runp = (MAXBSIZE >> DEV_BSHIFT) - 1;
946 	return (0);
947 }
948 
949 /*
950  * Device close routine
951  */
952 /* ARGSUSED */
953 int
954 spec_close(void *v)
955 {
956 	struct vop_close_args /* {
957 		struct vnode *a_vp;
958 		int  a_fflag;
959 		kauth_cred_t a_cred;
960 	} */ *ap = v;
961 	struct vnode *vp = ap->a_vp;
962 	struct session *sess;
963 	dev_t dev = vp->v_rdev;
964 	int mode, error, flags, flags1, count;
965 	specnode_t *sn;
966 	specdev_t *sd;
967 
968 	flags = vp->v_iflag;
969 	sn = vp->v_specnode;
970 	sd = sn->sn_dev;
971 
972 	switch (vp->v_type) {
973 
974 	case VCHR:
975 		/*
976 		 * Hack: a tty device that is a controlling terminal
977 		 * has a reference from the session structure.  We
978 		 * cannot easily tell that a character device is a
979 		 * controlling terminal, unless it is the closing
980 		 * process' controlling terminal.  In that case, if the
981 		 * open count is 1 release the reference from the
982 		 * session.  Also, remove the link from the tty back to
983 		 * the session and pgrp.
984 		 *
985 		 * XXX V. fishy.
986 		 */
987 		mutex_enter(proc_lock);
988 		sess = curlwp->l_proc->p_session;
989 		if (sn->sn_opencnt == 1 && vp == sess->s_ttyvp) {
990 			mutex_spin_enter(&tty_lock);
991 			sess->s_ttyvp = NULL;
992 			if (sess->s_ttyp->t_session != NULL) {
993 				sess->s_ttyp->t_pgrp = NULL;
994 				sess->s_ttyp->t_session = NULL;
995 				mutex_spin_exit(&tty_lock);
996 				/* Releases proc_lock. */
997 				proc_sessrele(sess);
998 			} else {
999 				mutex_spin_exit(&tty_lock);
1000 				if (sess->s_ttyp->t_pgrp != NULL)
1001 					panic("spec_close: spurious pgrp ref");
1002 				mutex_exit(proc_lock);
1003 			}
1004 			vrele(vp);
1005 		} else
1006 			mutex_exit(proc_lock);
1007 
1008 		/*
1009 		 * If the vnode is locked, then we are in the midst
1010 		 * of forcably closing the device, otherwise we only
1011 		 * close on last reference.
1012 		 */
1013 		mode = S_IFCHR;
1014 		break;
1015 
1016 	case VBLK:
1017 		KASSERT(vp == vp->v_specnode->sn_dev->sd_bdevvp);
1018 		/*
1019 		 * On last close of a block device (that isn't mounted)
1020 		 * we must invalidate any in core blocks, so that
1021 		 * we can, for instance, change floppy disks.
1022 		 */
1023 		error = vinvalbuf(vp, V_SAVE, ap->a_cred, curlwp, 0, 0);
1024 		if (error)
1025 			return (error);
1026 		/*
1027 		 * We do not want to really close the device if it
1028 		 * is still in use unless we are trying to close it
1029 		 * forcibly. Since every use (buffer, vnode, swap, cmap)
1030 		 * holds a reference to the vnode, and because we mark
1031 		 * any other vnodes that alias this device, when the
1032 		 * sum of the reference counts on all the aliased
1033 		 * vnodes descends to one, we are on last close.
1034 		 */
1035 		mode = S_IFBLK;
1036 		break;
1037 
1038 	default:
1039 		panic("spec_close: not special");
1040 	}
1041 
1042 	mutex_enter(&device_lock);
1043 	sn->sn_opencnt--;
1044 	count = --sd->sd_opencnt;
1045 	if (vp->v_type == VBLK)
1046 		sd->sd_bdevvp = NULL;
1047 	mutex_exit(&device_lock);
1048 
1049 	if (count != 0)
1050 		return 0;
1051 
1052 	flags1 = ap->a_fflag;
1053 
1054 	/*
1055 	 * if VI_XLOCK is set, then we're going away soon, so make this
1056 	 * non-blocking. Also ensures that we won't wedge in vn_lock below.
1057 	 */
1058 	if (flags & VI_XLOCK)
1059 		flags1 |= FNONBLOCK;
1060 
1061 	/*
1062 	 * If we're able to block, release the vnode lock & reacquire. We
1063 	 * might end up sleeping for someone else who wants our queues. They
1064 	 * won't get them if we hold the vnode locked. Also, if VI_XLOCK is
1065 	 * set, don't release the lock as we won't be able to regain it.
1066 	 */
1067 	if (!(flags1 & FNONBLOCK))
1068 		VOP_UNLOCK(vp, 0);
1069 
1070 	if (vp->v_type == VBLK)
1071 		error = bdev_close(dev, flags1, mode, curlwp);
1072 	else
1073 		error = cdev_close(dev, flags1, mode, curlwp);
1074 
1075 	if (!(flags1 & FNONBLOCK))
1076 		vn_lock(vp, LK_EXCLUSIVE | LK_RETRY);
1077 
1078 	return (error);
1079 }
1080 
1081 /*
1082  * Print out the contents of a special device vnode.
1083  */
1084 int
1085 spec_print(void *v)
1086 {
1087 	struct vop_print_args /* {
1088 		struct vnode *a_vp;
1089 	} */ *ap = v;
1090 
1091 	printf("dev %llu, %llu\n", (unsigned long long)major(ap->a_vp->v_rdev),
1092 	    (unsigned long long)minor(ap->a_vp->v_rdev));
1093 	return 0;
1094 }
1095 
1096 /*
1097  * Return POSIX pathconf information applicable to special devices.
1098  */
1099 int
1100 spec_pathconf(void *v)
1101 {
1102 	struct vop_pathconf_args /* {
1103 		struct vnode *a_vp;
1104 		int a_name;
1105 		register_t *a_retval;
1106 	} */ *ap = v;
1107 
1108 	switch (ap->a_name) {
1109 	case _PC_LINK_MAX:
1110 		*ap->a_retval = LINK_MAX;
1111 		return (0);
1112 	case _PC_MAX_CANON:
1113 		*ap->a_retval = MAX_CANON;
1114 		return (0);
1115 	case _PC_MAX_INPUT:
1116 		*ap->a_retval = MAX_INPUT;
1117 		return (0);
1118 	case _PC_PIPE_BUF:
1119 		*ap->a_retval = PIPE_BUF;
1120 		return (0);
1121 	case _PC_CHOWN_RESTRICTED:
1122 		*ap->a_retval = 1;
1123 		return (0);
1124 	case _PC_VDISABLE:
1125 		*ap->a_retval = _POSIX_VDISABLE;
1126 		return (0);
1127 	case _PC_SYNC_IO:
1128 		*ap->a_retval = 1;
1129 		return (0);
1130 	default:
1131 		return (EINVAL);
1132 	}
1133 	/* NOTREACHED */
1134 }
1135 
1136 /*
1137  * Advisory record locking support.
1138  */
1139 int
1140 spec_advlock(void *v)
1141 {
1142 	struct vop_advlock_args /* {
1143 		struct vnode *a_vp;
1144 		void *a_id;
1145 		int a_op;
1146 		struct flock *a_fl;
1147 		int a_flags;
1148 	} */ *ap = v;
1149 	struct vnode *vp = ap->a_vp;
1150 
1151 	return lf_advlock(ap, &vp->v_speclockf, (off_t)0);
1152 }
1153