devfs_vnops.c revision 304843
1/*-
2 * Copyright (c) 2000-2004
3 *	Poul-Henning Kamp.  All rights reserved.
4 * Copyright (c) 1989, 1992-1993, 1995
5 *	The Regents of the University of California.  All rights reserved.
6 *
7 * This code is derived from software donated to Berkeley by
8 * Jan-Simon Pendry.
9 *
10 * Redistribution and use in source and binary forms, with or without
11 * modification, are permitted provided that the following conditions
12 * are met:
13 * 1. Redistributions of source code must retain the above copyright
14 *    notice, this list of conditions and the following disclaimer.
15 * 2. Neither the name of the University nor the names of its contributors
16 *    may be used to endorse or promote products derived from this software
17 *    without specific prior written permission.
18 *
19 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
20 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
21 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
22 * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
23 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
24 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
25 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
26 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
27 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
28 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
29 * SUCH DAMAGE.
30 *
31 *	@(#)kernfs_vnops.c	8.15 (Berkeley) 5/21/95
32 * From: FreeBSD: src/sys/miscfs/kernfs/kernfs_vnops.c 1.43
33 *
34 * $FreeBSD: stable/11/sys/fs/devfs/devfs_vnops.c 304843 2016-08-26 10:04:10Z kib $
35 */
36
37/*
38 * TODO:
39 *	mkdir: want it ?
40 */
41
42#include <sys/param.h>
43#include <sys/systm.h>
44#include <sys/conf.h>
45#include <sys/dirent.h>
46#include <sys/fcntl.h>
47#include <sys/file.h>
48#include <sys/filedesc.h>
49#include <sys/filio.h>
50#include <sys/jail.h>
51#include <sys/kernel.h>
52#include <sys/lock.h>
53#include <sys/malloc.h>
54#include <sys/mman.h>
55#include <sys/mount.h>
56#include <sys/namei.h>
57#include <sys/priv.h>
58#include <sys/proc.h>
59#include <sys/stat.h>
60#include <sys/sx.h>
61#include <sys/sysctl.h>
62#include <sys/time.h>
63#include <sys/ttycom.h>
64#include <sys/unistd.h>
65#include <sys/vnode.h>
66
67static struct vop_vector devfs_vnodeops;
68static struct vop_vector devfs_specops;
69static struct fileops devfs_ops_f;
70
71#include <fs/devfs/devfs.h>
72#include <fs/devfs/devfs_int.h>
73
74#include <security/mac/mac_framework.h>
75
76#include <vm/vm.h>
77#include <vm/vm_extern.h>
78#include <vm/vm_object.h>
79
80static MALLOC_DEFINE(M_CDEVPDATA, "DEVFSP", "Metainfo for cdev-fp data");
81
82struct mtx	devfs_de_interlock;
83MTX_SYSINIT(devfs_de_interlock, &devfs_de_interlock, "devfs interlock", MTX_DEF);
84struct sx	clone_drain_lock;
85SX_SYSINIT(clone_drain_lock, &clone_drain_lock, "clone events drain lock");
86struct mtx	cdevpriv_mtx;
87MTX_SYSINIT(cdevpriv_mtx, &cdevpriv_mtx, "cdevpriv lock", MTX_DEF);
88
89SYSCTL_DECL(_vfs_devfs);
90
91static int devfs_dotimes;
92SYSCTL_INT(_vfs_devfs, OID_AUTO, dotimes, CTLFLAG_RW,
93    &devfs_dotimes, 0, "Update timestamps on DEVFS with default precision");
94
95/*
96 * Update devfs node timestamp.  Note that updates are unlocked and
97 * stat(2) could see partially updated times.
98 */
99static void
100devfs_timestamp(struct timespec *tsp)
101{
102	time_t ts;
103
104	if (devfs_dotimes) {
105		vfs_timestamp(tsp);
106	} else {
107		ts = time_second;
108		if (tsp->tv_sec != ts) {
109			tsp->tv_sec = ts;
110			tsp->tv_nsec = 0;
111		}
112	}
113}
114
115static int
116devfs_fp_check(struct file *fp, struct cdev **devp, struct cdevsw **dswp,
117    int *ref)
118{
119
120	*dswp = devvn_refthread(fp->f_vnode, devp, ref);
121	if (*devp != fp->f_data) {
122		if (*dswp != NULL)
123			dev_relthread(*devp, *ref);
124		return (ENXIO);
125	}
126	KASSERT((*devp)->si_refcount > 0,
127	    ("devfs: un-referenced struct cdev *(%s)", devtoname(*devp)));
128	if (*dswp == NULL)
129		return (ENXIO);
130	curthread->td_fpop = fp;
131	return (0);
132}
133
134int
135devfs_get_cdevpriv(void **datap)
136{
137	struct file *fp;
138	struct cdev_privdata *p;
139	int error;
140
141	fp = curthread->td_fpop;
142	if (fp == NULL)
143		return (EBADF);
144	p = fp->f_cdevpriv;
145	if (p != NULL) {
146		error = 0;
147		*datap = p->cdpd_data;
148	} else
149		error = ENOENT;
150	return (error);
151}
152
153int
154devfs_set_cdevpriv(void *priv, d_priv_dtor_t *priv_dtr)
155{
156	struct file *fp;
157	struct cdev_priv *cdp;
158	struct cdev_privdata *p;
159	int error;
160
161	fp = curthread->td_fpop;
162	if (fp == NULL)
163		return (ENOENT);
164	cdp = cdev2priv((struct cdev *)fp->f_data);
165	p = malloc(sizeof(struct cdev_privdata), M_CDEVPDATA, M_WAITOK);
166	p->cdpd_data = priv;
167	p->cdpd_dtr = priv_dtr;
168	p->cdpd_fp = fp;
169	mtx_lock(&cdevpriv_mtx);
170	if (fp->f_cdevpriv == NULL) {
171		LIST_INSERT_HEAD(&cdp->cdp_fdpriv, p, cdpd_list);
172		fp->f_cdevpriv = p;
173		mtx_unlock(&cdevpriv_mtx);
174		error = 0;
175	} else {
176		mtx_unlock(&cdevpriv_mtx);
177		free(p, M_CDEVPDATA);
178		error = EBUSY;
179	}
180	return (error);
181}
182
183void
184devfs_destroy_cdevpriv(struct cdev_privdata *p)
185{
186
187	mtx_assert(&cdevpriv_mtx, MA_OWNED);
188	KASSERT(p->cdpd_fp->f_cdevpriv == p,
189	    ("devfs_destoy_cdevpriv %p != %p", p->cdpd_fp->f_cdevpriv, p));
190	p->cdpd_fp->f_cdevpriv = NULL;
191	LIST_REMOVE(p, cdpd_list);
192	mtx_unlock(&cdevpriv_mtx);
193	(p->cdpd_dtr)(p->cdpd_data);
194	free(p, M_CDEVPDATA);
195}
196
197static void
198devfs_fpdrop(struct file *fp)
199{
200	struct cdev_privdata *p;
201
202	mtx_lock(&cdevpriv_mtx);
203	if ((p = fp->f_cdevpriv) == NULL) {
204		mtx_unlock(&cdevpriv_mtx);
205		return;
206	}
207	devfs_destroy_cdevpriv(p);
208}
209
210void
211devfs_clear_cdevpriv(void)
212{
213	struct file *fp;
214
215	fp = curthread->td_fpop;
216	if (fp == NULL)
217		return;
218	devfs_fpdrop(fp);
219}
220
221/*
222 * On success devfs_populate_vp() returns with dmp->dm_lock held.
223 */
224static int
225devfs_populate_vp(struct vnode *vp)
226{
227	struct devfs_dirent *de;
228	struct devfs_mount *dmp;
229	int locked;
230
231	ASSERT_VOP_LOCKED(vp, "devfs_populate_vp");
232
233	dmp = VFSTODEVFS(vp->v_mount);
234	locked = VOP_ISLOCKED(vp);
235
236	sx_xlock(&dmp->dm_lock);
237	DEVFS_DMP_HOLD(dmp);
238
239	/* Can't call devfs_populate() with the vnode lock held. */
240	VOP_UNLOCK(vp, 0);
241	devfs_populate(dmp);
242
243	sx_xunlock(&dmp->dm_lock);
244	vn_lock(vp, locked | LK_RETRY);
245	sx_xlock(&dmp->dm_lock);
246	if (DEVFS_DMP_DROP(dmp)) {
247		sx_xunlock(&dmp->dm_lock);
248		devfs_unmount_final(dmp);
249		return (ERESTART);
250	}
251	if ((vp->v_iflag & VI_DOOMED) != 0) {
252		sx_xunlock(&dmp->dm_lock);
253		return (ERESTART);
254	}
255	de = vp->v_data;
256	KASSERT(de != NULL,
257	    ("devfs_populate_vp: vp->v_data == NULL but vnode not doomed"));
258	if ((de->de_flags & DE_DOOMED) != 0) {
259		sx_xunlock(&dmp->dm_lock);
260		return (ERESTART);
261	}
262
263	return (0);
264}
265
266static int
267devfs_vptocnp(struct vop_vptocnp_args *ap)
268{
269	struct vnode *vp = ap->a_vp;
270	struct vnode **dvp = ap->a_vpp;
271	struct devfs_mount *dmp;
272	char *buf = ap->a_buf;
273	int *buflen = ap->a_buflen;
274	struct devfs_dirent *dd, *de;
275	int i, error;
276
277	dmp = VFSTODEVFS(vp->v_mount);
278
279	error = devfs_populate_vp(vp);
280	if (error != 0)
281		return (error);
282
283	i = *buflen;
284	dd = vp->v_data;
285
286	if (vp->v_type == VCHR) {
287		i -= strlen(dd->de_cdp->cdp_c.si_name);
288		if (i < 0) {
289			error = ENOMEM;
290			goto finished;
291		}
292		bcopy(dd->de_cdp->cdp_c.si_name, buf + i,
293		    strlen(dd->de_cdp->cdp_c.si_name));
294		de = dd->de_dir;
295	} else if (vp->v_type == VDIR) {
296		if (dd == dmp->dm_rootdir) {
297			*dvp = vp;
298			vref(*dvp);
299			goto finished;
300		}
301		i -= dd->de_dirent->d_namlen;
302		if (i < 0) {
303			error = ENOMEM;
304			goto finished;
305		}
306		bcopy(dd->de_dirent->d_name, buf + i,
307		    dd->de_dirent->d_namlen);
308		de = dd;
309	} else {
310		error = ENOENT;
311		goto finished;
312	}
313	*buflen = i;
314	de = devfs_parent_dirent(de);
315	if (de == NULL) {
316		error = ENOENT;
317		goto finished;
318	}
319	mtx_lock(&devfs_de_interlock);
320	*dvp = de->de_vnode;
321	if (*dvp != NULL) {
322		VI_LOCK(*dvp);
323		mtx_unlock(&devfs_de_interlock);
324		vholdl(*dvp);
325		VI_UNLOCK(*dvp);
326		vref(*dvp);
327		vdrop(*dvp);
328	} else {
329		mtx_unlock(&devfs_de_interlock);
330		error = ENOENT;
331	}
332finished:
333	sx_xunlock(&dmp->dm_lock);
334	return (error);
335}
336
337/*
338 * Construct the fully qualified path name relative to the mountpoint.
339 * If a NULL cnp is provided, no '/' is appended to the resulting path.
340 */
341char *
342devfs_fqpn(char *buf, struct devfs_mount *dmp, struct devfs_dirent *dd,
343    struct componentname *cnp)
344{
345	int i;
346	struct devfs_dirent *de;
347
348	sx_assert(&dmp->dm_lock, SA_LOCKED);
349
350	i = SPECNAMELEN;
351	buf[i] = '\0';
352	if (cnp != NULL)
353		i -= cnp->cn_namelen;
354	if (i < 0)
355		 return (NULL);
356	if (cnp != NULL)
357		bcopy(cnp->cn_nameptr, buf + i, cnp->cn_namelen);
358	de = dd;
359	while (de != dmp->dm_rootdir) {
360		if (cnp != NULL || i < SPECNAMELEN) {
361			i--;
362			if (i < 0)
363				 return (NULL);
364			buf[i] = '/';
365		}
366		i -= de->de_dirent->d_namlen;
367		if (i < 0)
368			 return (NULL);
369		bcopy(de->de_dirent->d_name, buf + i,
370		    de->de_dirent->d_namlen);
371		de = devfs_parent_dirent(de);
372		if (de == NULL)
373			return (NULL);
374	}
375	return (buf + i);
376}
377
378static int
379devfs_allocv_drop_refs(int drop_dm_lock, struct devfs_mount *dmp,
380	struct devfs_dirent *de)
381{
382	int not_found;
383
384	not_found = 0;
385	if (de->de_flags & DE_DOOMED)
386		not_found = 1;
387	if (DEVFS_DE_DROP(de)) {
388		KASSERT(not_found == 1, ("DEVFS de dropped but not doomed"));
389		devfs_dirent_free(de);
390	}
391	if (DEVFS_DMP_DROP(dmp)) {
392		KASSERT(not_found == 1,
393			("DEVFS mount struct freed before dirent"));
394		not_found = 2;
395		sx_xunlock(&dmp->dm_lock);
396		devfs_unmount_final(dmp);
397	}
398	if (not_found == 1 || (drop_dm_lock && not_found != 2))
399		sx_unlock(&dmp->dm_lock);
400	return (not_found);
401}
402
403static void
404devfs_insmntque_dtr(struct vnode *vp, void *arg)
405{
406	struct devfs_dirent *de;
407
408	de = (struct devfs_dirent *)arg;
409	mtx_lock(&devfs_de_interlock);
410	vp->v_data = NULL;
411	de->de_vnode = NULL;
412	mtx_unlock(&devfs_de_interlock);
413	vgone(vp);
414	vput(vp);
415}
416
417/*
418 * devfs_allocv shall be entered with dmp->dm_lock held, and it drops
419 * it on return.
420 */
421int
422devfs_allocv(struct devfs_dirent *de, struct mount *mp, int lockmode,
423    struct vnode **vpp)
424{
425	int error;
426	struct vnode *vp;
427	struct cdev *dev;
428	struct devfs_mount *dmp;
429	struct cdevsw *dsw;
430
431	dmp = VFSTODEVFS(mp);
432	if (de->de_flags & DE_DOOMED) {
433		sx_xunlock(&dmp->dm_lock);
434		return (ENOENT);
435	}
436loop:
437	DEVFS_DE_HOLD(de);
438	DEVFS_DMP_HOLD(dmp);
439	mtx_lock(&devfs_de_interlock);
440	vp = de->de_vnode;
441	if (vp != NULL) {
442		VI_LOCK(vp);
443		mtx_unlock(&devfs_de_interlock);
444		sx_xunlock(&dmp->dm_lock);
445		vget(vp, lockmode | LK_INTERLOCK | LK_RETRY, curthread);
446		sx_xlock(&dmp->dm_lock);
447		if (devfs_allocv_drop_refs(0, dmp, de)) {
448			vput(vp);
449			return (ENOENT);
450		}
451		else if ((vp->v_iflag & VI_DOOMED) != 0) {
452			mtx_lock(&devfs_de_interlock);
453			if (de->de_vnode == vp) {
454				de->de_vnode = NULL;
455				vp->v_data = NULL;
456			}
457			mtx_unlock(&devfs_de_interlock);
458			vput(vp);
459			goto loop;
460		}
461		sx_xunlock(&dmp->dm_lock);
462		*vpp = vp;
463		return (0);
464	}
465	mtx_unlock(&devfs_de_interlock);
466	if (de->de_dirent->d_type == DT_CHR) {
467		if (!(de->de_cdp->cdp_flags & CDP_ACTIVE)) {
468			devfs_allocv_drop_refs(1, dmp, de);
469			return (ENOENT);
470		}
471		dev = &de->de_cdp->cdp_c;
472	} else {
473		dev = NULL;
474	}
475	error = getnewvnode("devfs", mp, &devfs_vnodeops, &vp);
476	if (error != 0) {
477		devfs_allocv_drop_refs(1, dmp, de);
478		printf("devfs_allocv: failed to allocate new vnode\n");
479		return (error);
480	}
481
482	if (de->de_dirent->d_type == DT_CHR) {
483		vp->v_type = VCHR;
484		VI_LOCK(vp);
485		dev_lock();
486		dev_refl(dev);
487		/* XXX: v_rdev should be protect by vnode lock */
488		vp->v_rdev = dev;
489		KASSERT(vp->v_usecount == 1,
490		    ("%s %d (%d)\n", __func__, __LINE__, vp->v_usecount));
491		dev->si_usecount += vp->v_usecount;
492		/* Special casing of ttys for deadfs.  Probably redundant. */
493		dsw = dev->si_devsw;
494		if (dsw != NULL && (dsw->d_flags & D_TTY) != 0)
495			vp->v_vflag |= VV_ISTTY;
496		dev_unlock();
497		VI_UNLOCK(vp);
498		if ((dev->si_flags & SI_ETERNAL) != 0)
499			vp->v_vflag |= VV_ETERNALDEV;
500		vp->v_op = &devfs_specops;
501	} else if (de->de_dirent->d_type == DT_DIR) {
502		vp->v_type = VDIR;
503	} else if (de->de_dirent->d_type == DT_LNK) {
504		vp->v_type = VLNK;
505	} else {
506		vp->v_type = VBAD;
507	}
508	vn_lock(vp, LK_EXCLUSIVE | LK_RETRY | LK_NOWITNESS);
509	VN_LOCK_ASHARE(vp);
510	mtx_lock(&devfs_de_interlock);
511	vp->v_data = de;
512	de->de_vnode = vp;
513	mtx_unlock(&devfs_de_interlock);
514	error = insmntque1(vp, mp, devfs_insmntque_dtr, de);
515	if (error != 0) {
516		(void) devfs_allocv_drop_refs(1, dmp, de);
517		return (error);
518	}
519	if (devfs_allocv_drop_refs(0, dmp, de)) {
520		vput(vp);
521		return (ENOENT);
522	}
523#ifdef MAC
524	mac_devfs_vnode_associate(mp, de, vp);
525#endif
526	sx_xunlock(&dmp->dm_lock);
527	*vpp = vp;
528	return (0);
529}
530
531static int
532devfs_access(struct vop_access_args *ap)
533{
534	struct vnode *vp = ap->a_vp;
535	struct devfs_dirent *de;
536	struct proc *p;
537	int error;
538
539	de = vp->v_data;
540	if (vp->v_type == VDIR)
541		de = de->de_dir;
542
543	error = vaccess(vp->v_type, de->de_mode, de->de_uid, de->de_gid,
544	    ap->a_accmode, ap->a_cred, NULL);
545	if (error == 0)
546		return (0);
547	if (error != EACCES)
548		return (error);
549	p = ap->a_td->td_proc;
550	/* We do, however, allow access to the controlling terminal */
551	PROC_LOCK(p);
552	if (!(p->p_flag & P_CONTROLT)) {
553		PROC_UNLOCK(p);
554		return (error);
555	}
556	if (p->p_session->s_ttydp == de->de_cdp)
557		error = 0;
558	PROC_UNLOCK(p);
559	return (error);
560}
561
562_Static_assert(((FMASK | FCNTLFLAGS) & (FLASTCLOSE | FREVOKE)) == 0,
563    "devfs-only flag reuse failed");
564
565static int
566devfs_close(struct vop_close_args *ap)
567{
568	struct vnode *vp = ap->a_vp, *oldvp;
569	struct thread *td = ap->a_td;
570	struct proc *p;
571	struct cdev *dev = vp->v_rdev;
572	struct cdevsw *dsw;
573	int dflags, error, ref, vp_locked;
574
575	/*
576	 * XXX: Don't call d_close() if we were called because of
577	 * XXX: insmntque1() failure.
578	 */
579	if (vp->v_data == NULL)
580		return (0);
581
582	/*
583	 * Hack: a tty device that is a controlling terminal
584	 * has a reference from the session structure.
585	 * We cannot easily tell that a character device is
586	 * a controlling terminal, unless it is the closing
587	 * process' controlling terminal.  In that case,
588	 * if the reference count is 2 (this last descriptor
589	 * plus the session), release the reference from the session.
590	 */
591	if (td != NULL) {
592		p = td->td_proc;
593		PROC_LOCK(p);
594		if (vp == p->p_session->s_ttyvp) {
595			PROC_UNLOCK(p);
596			oldvp = NULL;
597			sx_xlock(&proctree_lock);
598			if (vp == p->p_session->s_ttyvp) {
599				SESS_LOCK(p->p_session);
600				VI_LOCK(vp);
601				if (count_dev(dev) == 2 &&
602				    (vp->v_iflag & VI_DOOMED) == 0) {
603					p->p_session->s_ttyvp = NULL;
604					p->p_session->s_ttydp = NULL;
605					oldvp = vp;
606				}
607				VI_UNLOCK(vp);
608				SESS_UNLOCK(p->p_session);
609			}
610			sx_xunlock(&proctree_lock);
611			if (oldvp != NULL)
612				vrele(oldvp);
613		} else
614			PROC_UNLOCK(p);
615	}
616	/*
617	 * We do not want to really close the device if it
618	 * is still in use unless we are trying to close it
619	 * forcibly. Since every use (buffer, vnode, swap, cmap)
620	 * holds a reference to the vnode, and because we mark
621	 * any other vnodes that alias this device, when the
622	 * sum of the reference counts on all the aliased
623	 * vnodes descends to one, we are on last close.
624	 */
625	dsw = dev_refthread(dev, &ref);
626	if (dsw == NULL)
627		return (ENXIO);
628	dflags = 0;
629	VI_LOCK(vp);
630	if (vp->v_iflag & VI_DOOMED) {
631		/* Forced close. */
632		dflags |= FREVOKE | FNONBLOCK;
633	} else if (dsw->d_flags & D_TRACKCLOSE) {
634		/* Keep device updated on status. */
635	} else if (count_dev(dev) > 1) {
636		VI_UNLOCK(vp);
637		dev_relthread(dev, ref);
638		return (0);
639	}
640	if (count_dev(dev) == 1)
641		dflags |= FLASTCLOSE;
642	vholdl(vp);
643	VI_UNLOCK(vp);
644	vp_locked = VOP_ISLOCKED(vp);
645	VOP_UNLOCK(vp, 0);
646	KASSERT(dev->si_refcount > 0,
647	    ("devfs_close() on un-referenced struct cdev *(%s)", devtoname(dev)));
648	error = dsw->d_close(dev, ap->a_fflag | dflags, S_IFCHR, td);
649	dev_relthread(dev, ref);
650	vn_lock(vp, vp_locked | LK_RETRY);
651	vdrop(vp);
652	return (error);
653}
654
655static int
656devfs_close_f(struct file *fp, struct thread *td)
657{
658	int error;
659	struct file *fpop;
660
661	/*
662	 * NB: td may be NULL if this descriptor is closed due to
663	 * garbage collection from a closed UNIX domain socket.
664	 */
665	fpop = curthread->td_fpop;
666	curthread->td_fpop = fp;
667	error = vnops.fo_close(fp, td);
668	curthread->td_fpop = fpop;
669
670	/*
671	 * The f_cdevpriv cannot be assigned non-NULL value while we
672	 * are destroying the file.
673	 */
674	if (fp->f_cdevpriv != NULL)
675		devfs_fpdrop(fp);
676	return (error);
677}
678
679static int
680devfs_fsync(struct vop_fsync_args *ap)
681{
682	int error;
683	struct bufobj *bo;
684	struct devfs_dirent *de;
685
686	if (!vn_isdisk(ap->a_vp, &error)) {
687		bo = &ap->a_vp->v_bufobj;
688		de = ap->a_vp->v_data;
689		if (error == ENXIO && bo->bo_dirty.bv_cnt > 0) {
690			printf("Device %s went missing before all of the data "
691			    "could be written to it; expect data loss.\n",
692			    de->de_dirent->d_name);
693
694			error = vop_stdfsync(ap);
695			if (bo->bo_dirty.bv_cnt != 0 || error != 0)
696				panic("devfs_fsync: vop_stdfsync failed.");
697		}
698
699		return (0);
700	}
701
702	return (vop_stdfsync(ap));
703}
704
705static int
706devfs_getattr(struct vop_getattr_args *ap)
707{
708	struct vnode *vp = ap->a_vp;
709	struct vattr *vap = ap->a_vap;
710	struct devfs_dirent *de;
711	struct devfs_mount *dmp;
712	struct cdev *dev;
713	struct timeval boottime;
714	int error;
715
716	error = devfs_populate_vp(vp);
717	if (error != 0)
718		return (error);
719
720	dmp = VFSTODEVFS(vp->v_mount);
721	sx_xunlock(&dmp->dm_lock);
722
723	de = vp->v_data;
724	KASSERT(de != NULL, ("Null dirent in devfs_getattr vp=%p", vp));
725	if (vp->v_type == VDIR) {
726		de = de->de_dir;
727		KASSERT(de != NULL,
728		    ("Null dir dirent in devfs_getattr vp=%p", vp));
729	}
730	vap->va_uid = de->de_uid;
731	vap->va_gid = de->de_gid;
732	vap->va_mode = de->de_mode;
733	if (vp->v_type == VLNK)
734		vap->va_size = strlen(de->de_symlink);
735	else if (vp->v_type == VDIR)
736		vap->va_size = vap->va_bytes = DEV_BSIZE;
737	else
738		vap->va_size = 0;
739	if (vp->v_type != VDIR)
740		vap->va_bytes = 0;
741	vap->va_blocksize = DEV_BSIZE;
742	vap->va_type = vp->v_type;
743
744	getboottime(&boottime);
745#define fix(aa)							\
746	do {							\
747		if ((aa).tv_sec <= 3600) {			\
748			(aa).tv_sec = boottime.tv_sec;		\
749			(aa).tv_nsec = boottime.tv_usec * 1000; \
750		}						\
751	} while (0)
752
753	if (vp->v_type != VCHR)  {
754		fix(de->de_atime);
755		vap->va_atime = de->de_atime;
756		fix(de->de_mtime);
757		vap->va_mtime = de->de_mtime;
758		fix(de->de_ctime);
759		vap->va_ctime = de->de_ctime;
760	} else {
761		dev = vp->v_rdev;
762		fix(dev->si_atime);
763		vap->va_atime = dev->si_atime;
764		fix(dev->si_mtime);
765		vap->va_mtime = dev->si_mtime;
766		fix(dev->si_ctime);
767		vap->va_ctime = dev->si_ctime;
768
769		vap->va_rdev = cdev2priv(dev)->cdp_inode;
770	}
771	vap->va_gen = 0;
772	vap->va_flags = 0;
773	vap->va_filerev = 0;
774	vap->va_nlink = de->de_links;
775	vap->va_fileid = de->de_inode;
776
777	return (error);
778}
779
780/* ARGSUSED */
781static int
782devfs_ioctl_f(struct file *fp, u_long com, void *data, struct ucred *cred, struct thread *td)
783{
784	struct cdev *dev;
785	struct cdevsw *dsw;
786	struct vnode *vp;
787	struct vnode *vpold;
788	int error, i, ref;
789	const char *p;
790	struct fiodgname_arg *fgn;
791	struct file *fpop;
792
793	fpop = td->td_fpop;
794	error = devfs_fp_check(fp, &dev, &dsw, &ref);
795	if (error != 0) {
796		error = vnops.fo_ioctl(fp, com, data, cred, td);
797		return (error);
798	}
799
800	if (com == FIODTYPE) {
801		*(int *)data = dsw->d_flags & D_TYPEMASK;
802		td->td_fpop = fpop;
803		dev_relthread(dev, ref);
804		return (0);
805	} else if (com == FIODGNAME) {
806		fgn = data;
807		p = devtoname(dev);
808		i = strlen(p) + 1;
809		if (i > fgn->len)
810			error = EINVAL;
811		else
812			error = copyout(p, fgn->buf, i);
813		td->td_fpop = fpop;
814		dev_relthread(dev, ref);
815		return (error);
816	}
817	error = dsw->d_ioctl(dev, com, data, fp->f_flag, td);
818	td->td_fpop = NULL;
819	dev_relthread(dev, ref);
820	if (error == ENOIOCTL)
821		error = ENOTTY;
822	if (error == 0 && com == TIOCSCTTY) {
823		vp = fp->f_vnode;
824
825		/* Do nothing if reassigning same control tty */
826		sx_slock(&proctree_lock);
827		if (td->td_proc->p_session->s_ttyvp == vp) {
828			sx_sunlock(&proctree_lock);
829			return (0);
830		}
831
832		vpold = td->td_proc->p_session->s_ttyvp;
833		VREF(vp);
834		SESS_LOCK(td->td_proc->p_session);
835		td->td_proc->p_session->s_ttyvp = vp;
836		td->td_proc->p_session->s_ttydp = cdev2priv(dev);
837		SESS_UNLOCK(td->td_proc->p_session);
838
839		sx_sunlock(&proctree_lock);
840
841		/* Get rid of reference to old control tty */
842		if (vpold)
843			vrele(vpold);
844	}
845	return (error);
846}
847
848/* ARGSUSED */
849static int
850devfs_kqfilter_f(struct file *fp, struct knote *kn)
851{
852	struct cdev *dev;
853	struct cdevsw *dsw;
854	int error, ref;
855	struct file *fpop;
856	struct thread *td;
857
858	td = curthread;
859	fpop = td->td_fpop;
860	error = devfs_fp_check(fp, &dev, &dsw, &ref);
861	if (error)
862		return (error);
863	error = dsw->d_kqfilter(dev, kn);
864	td->td_fpop = fpop;
865	dev_relthread(dev, ref);
866	return (error);
867}
868
869static inline int
870devfs_prison_check(struct devfs_dirent *de, struct thread *td)
871{
872	struct cdev_priv *cdp;
873	struct ucred *dcr;
874	struct proc *p;
875	int error;
876
877	cdp = de->de_cdp;
878	if (cdp == NULL)
879		return (0);
880	dcr = cdp->cdp_c.si_cred;
881	if (dcr == NULL)
882		return (0);
883
884	error = prison_check(td->td_ucred, dcr);
885	if (error == 0)
886		return (0);
887	/* We do, however, allow access to the controlling terminal */
888	p = td->td_proc;
889	PROC_LOCK(p);
890	if (!(p->p_flag & P_CONTROLT)) {
891		PROC_UNLOCK(p);
892		return (error);
893	}
894	if (p->p_session->s_ttydp == cdp)
895		error = 0;
896	PROC_UNLOCK(p);
897	return (error);
898}
899
900static int
901devfs_lookupx(struct vop_lookup_args *ap, int *dm_unlock)
902{
903	struct componentname *cnp;
904	struct vnode *dvp, **vpp;
905	struct thread *td;
906	struct devfs_dirent *de, *dd;
907	struct devfs_dirent **dde;
908	struct devfs_mount *dmp;
909	struct cdev *cdev;
910	int error, flags, nameiop, dvplocked;
911	char specname[SPECNAMELEN + 1], *pname;
912
913	cnp = ap->a_cnp;
914	vpp = ap->a_vpp;
915	dvp = ap->a_dvp;
916	pname = cnp->cn_nameptr;
917	td = cnp->cn_thread;
918	flags = cnp->cn_flags;
919	nameiop = cnp->cn_nameiop;
920	dmp = VFSTODEVFS(dvp->v_mount);
921	dd = dvp->v_data;
922	*vpp = NULLVP;
923
924	if ((flags & ISLASTCN) && nameiop == RENAME)
925		return (EOPNOTSUPP);
926
927	if (dvp->v_type != VDIR)
928		return (ENOTDIR);
929
930	if ((flags & ISDOTDOT) && (dvp->v_vflag & VV_ROOT))
931		return (EIO);
932
933	error = VOP_ACCESS(dvp, VEXEC, cnp->cn_cred, td);
934	if (error)
935		return (error);
936
937	if (cnp->cn_namelen == 1 && *pname == '.') {
938		if ((flags & ISLASTCN) && nameiop != LOOKUP)
939			return (EINVAL);
940		*vpp = dvp;
941		VREF(dvp);
942		return (0);
943	}
944
945	if (flags & ISDOTDOT) {
946		if ((flags & ISLASTCN) && nameiop != LOOKUP)
947			return (EINVAL);
948		de = devfs_parent_dirent(dd);
949		if (de == NULL)
950			return (ENOENT);
951		dvplocked = VOP_ISLOCKED(dvp);
952		VOP_UNLOCK(dvp, 0);
953		error = devfs_allocv(de, dvp->v_mount,
954		    cnp->cn_lkflags & LK_TYPE_MASK, vpp);
955		*dm_unlock = 0;
956		vn_lock(dvp, dvplocked | LK_RETRY);
957		return (error);
958	}
959
960	dd = dvp->v_data;
961	de = devfs_find(dd, cnp->cn_nameptr, cnp->cn_namelen, 0);
962	while (de == NULL) {	/* While(...) so we can use break */
963
964		if (nameiop == DELETE)
965			return (ENOENT);
966
967		/*
968		 * OK, we didn't have an entry for the name we were asked for
969		 * so we try to see if anybody can create it on demand.
970		 */
971		pname = devfs_fqpn(specname, dmp, dd, cnp);
972		if (pname == NULL)
973			break;
974
975		cdev = NULL;
976		DEVFS_DMP_HOLD(dmp);
977		sx_xunlock(&dmp->dm_lock);
978		sx_slock(&clone_drain_lock);
979		EVENTHANDLER_INVOKE(dev_clone,
980		    td->td_ucred, pname, strlen(pname), &cdev);
981		sx_sunlock(&clone_drain_lock);
982
983		if (cdev == NULL)
984			sx_xlock(&dmp->dm_lock);
985		else if (devfs_populate_vp(dvp) != 0) {
986			*dm_unlock = 0;
987			sx_xlock(&dmp->dm_lock);
988			if (DEVFS_DMP_DROP(dmp)) {
989				sx_xunlock(&dmp->dm_lock);
990				devfs_unmount_final(dmp);
991			} else
992				sx_xunlock(&dmp->dm_lock);
993			dev_rel(cdev);
994			return (ENOENT);
995		}
996		if (DEVFS_DMP_DROP(dmp)) {
997			*dm_unlock = 0;
998			sx_xunlock(&dmp->dm_lock);
999			devfs_unmount_final(dmp);
1000			if (cdev != NULL)
1001				dev_rel(cdev);
1002			return (ENOENT);
1003		}
1004
1005		if (cdev == NULL)
1006			break;
1007
1008		dev_lock();
1009		dde = &cdev2priv(cdev)->cdp_dirents[dmp->dm_idx];
1010		if (dde != NULL && *dde != NULL)
1011			de = *dde;
1012		dev_unlock();
1013		dev_rel(cdev);
1014		break;
1015	}
1016
1017	if (de == NULL || de->de_flags & DE_WHITEOUT) {
1018		if ((nameiop == CREATE || nameiop == RENAME) &&
1019		    (flags & (LOCKPARENT | WANTPARENT)) && (flags & ISLASTCN)) {
1020			cnp->cn_flags |= SAVENAME;
1021			return (EJUSTRETURN);
1022		}
1023		return (ENOENT);
1024	}
1025
1026	if (devfs_prison_check(de, td))
1027		return (ENOENT);
1028
1029	if ((cnp->cn_nameiop == DELETE) && (flags & ISLASTCN)) {
1030		error = VOP_ACCESS(dvp, VWRITE, cnp->cn_cred, td);
1031		if (error)
1032			return (error);
1033		if (*vpp == dvp) {
1034			VREF(dvp);
1035			*vpp = dvp;
1036			return (0);
1037		}
1038	}
1039	error = devfs_allocv(de, dvp->v_mount, cnp->cn_lkflags & LK_TYPE_MASK,
1040	    vpp);
1041	*dm_unlock = 0;
1042	return (error);
1043}
1044
1045static int
1046devfs_lookup(struct vop_lookup_args *ap)
1047{
1048	int j;
1049	struct devfs_mount *dmp;
1050	int dm_unlock;
1051
1052	if (devfs_populate_vp(ap->a_dvp) != 0)
1053		return (ENOTDIR);
1054
1055	dmp = VFSTODEVFS(ap->a_dvp->v_mount);
1056	dm_unlock = 1;
1057	j = devfs_lookupx(ap, &dm_unlock);
1058	if (dm_unlock == 1)
1059		sx_xunlock(&dmp->dm_lock);
1060	return (j);
1061}
1062
1063static int
1064devfs_mknod(struct vop_mknod_args *ap)
1065{
1066	struct componentname *cnp;
1067	struct vnode *dvp, **vpp;
1068	struct devfs_dirent *dd, *de;
1069	struct devfs_mount *dmp;
1070	int error;
1071
1072	/*
1073	 * The only type of node we should be creating here is a
1074	 * character device, for anything else return EOPNOTSUPP.
1075	 */
1076	if (ap->a_vap->va_type != VCHR)
1077		return (EOPNOTSUPP);
1078	dvp = ap->a_dvp;
1079	dmp = VFSTODEVFS(dvp->v_mount);
1080
1081	cnp = ap->a_cnp;
1082	vpp = ap->a_vpp;
1083	dd = dvp->v_data;
1084
1085	error = ENOENT;
1086	sx_xlock(&dmp->dm_lock);
1087	TAILQ_FOREACH(de, &dd->de_dlist, de_list) {
1088		if (cnp->cn_namelen != de->de_dirent->d_namlen)
1089			continue;
1090		if (de->de_dirent->d_type == DT_CHR &&
1091		    (de->de_cdp->cdp_flags & CDP_ACTIVE) == 0)
1092			continue;
1093		if (bcmp(cnp->cn_nameptr, de->de_dirent->d_name,
1094		    de->de_dirent->d_namlen) != 0)
1095			continue;
1096		if (de->de_flags & DE_WHITEOUT)
1097			break;
1098		goto notfound;
1099	}
1100	if (de == NULL)
1101		goto notfound;
1102	de->de_flags &= ~DE_WHITEOUT;
1103	error = devfs_allocv(de, dvp->v_mount, LK_EXCLUSIVE, vpp);
1104	return (error);
1105notfound:
1106	sx_xunlock(&dmp->dm_lock);
1107	return (error);
1108}
1109
1110/* ARGSUSED */
1111static int
1112devfs_open(struct vop_open_args *ap)
1113{
1114	struct thread *td = ap->a_td;
1115	struct vnode *vp = ap->a_vp;
1116	struct cdev *dev = vp->v_rdev;
1117	struct file *fp = ap->a_fp;
1118	int error, ref, vlocked;
1119	struct cdevsw *dsw;
1120	struct file *fpop;
1121	struct mtx *mtxp;
1122
1123	if (vp->v_type == VBLK)
1124		return (ENXIO);
1125
1126	if (dev == NULL)
1127		return (ENXIO);
1128
1129	/* Make this field valid before any I/O in d_open. */
1130	if (dev->si_iosize_max == 0)
1131		dev->si_iosize_max = DFLTPHYS;
1132
1133	dsw = dev_refthread(dev, &ref);
1134	if (dsw == NULL)
1135		return (ENXIO);
1136	if (fp == NULL && dsw->d_fdopen != NULL) {
1137		dev_relthread(dev, ref);
1138		return (ENXIO);
1139	}
1140
1141	vlocked = VOP_ISLOCKED(vp);
1142	VOP_UNLOCK(vp, 0);
1143
1144	fpop = td->td_fpop;
1145	td->td_fpop = fp;
1146	if (fp != NULL) {
1147		fp->f_data = dev;
1148		fp->f_vnode = vp;
1149	}
1150	if (dsw->d_fdopen != NULL)
1151		error = dsw->d_fdopen(dev, ap->a_mode, td, fp);
1152	else
1153		error = dsw->d_open(dev, ap->a_mode, S_IFCHR, td);
1154	/* Clean up any cdevpriv upon error. */
1155	if (error != 0)
1156		devfs_clear_cdevpriv();
1157	td->td_fpop = fpop;
1158
1159	vn_lock(vp, vlocked | LK_RETRY);
1160	dev_relthread(dev, ref);
1161	if (error != 0) {
1162		if (error == ERESTART)
1163			error = EINTR;
1164		return (error);
1165	}
1166
1167#if 0	/* /dev/console */
1168	KASSERT(fp != NULL, ("Could not vnode bypass device on NULL fp"));
1169#else
1170	if (fp == NULL)
1171		return (error);
1172#endif
1173	if (fp->f_ops == &badfileops)
1174		finit(fp, fp->f_flag, DTYPE_VNODE, dev, &devfs_ops_f);
1175	mtxp = mtx_pool_find(mtxpool_sleep, fp);
1176
1177	/*
1178	 * Hint to the dofilewrite() to not force the buffer draining
1179	 * on the writer to the file.  Most likely, the write would
1180	 * not need normal buffers.
1181	 */
1182	mtx_lock(mtxp);
1183	fp->f_vnread_flags |= FDEVFS_VNODE;
1184	mtx_unlock(mtxp);
1185	return (error);
1186}
1187
1188static int
1189devfs_pathconf(struct vop_pathconf_args *ap)
1190{
1191
1192	switch (ap->a_name) {
1193	case _PC_MAC_PRESENT:
1194#ifdef MAC
1195		/*
1196		 * If MAC is enabled, devfs automatically supports
1197		 * trivial non-persistant label storage.
1198		 */
1199		*ap->a_retval = 1;
1200#else
1201		*ap->a_retval = 0;
1202#endif
1203		return (0);
1204	default:
1205		return (vop_stdpathconf(ap));
1206	}
1207	/* NOTREACHED */
1208}
1209
1210/* ARGSUSED */
1211static int
1212devfs_poll_f(struct file *fp, int events, struct ucred *cred, struct thread *td)
1213{
1214	struct cdev *dev;
1215	struct cdevsw *dsw;
1216	int error, ref;
1217	struct file *fpop;
1218
1219	fpop = td->td_fpop;
1220	error = devfs_fp_check(fp, &dev, &dsw, &ref);
1221	if (error != 0) {
1222		error = vnops.fo_poll(fp, events, cred, td);
1223		return (error);
1224	}
1225	error = dsw->d_poll(dev, events, td);
1226	td->td_fpop = fpop;
1227	dev_relthread(dev, ref);
1228	return(error);
1229}
1230
1231/*
1232 * Print out the contents of a special device vnode.
1233 */
1234static int
1235devfs_print(struct vop_print_args *ap)
1236{
1237
1238	printf("\tdev %s\n", devtoname(ap->a_vp->v_rdev));
1239	return (0);
1240}
1241
1242static int
1243devfs_read_f(struct file *fp, struct uio *uio, struct ucred *cred,
1244    int flags, struct thread *td)
1245{
1246	struct cdev *dev;
1247	int ioflag, error, ref;
1248	ssize_t resid;
1249	struct cdevsw *dsw;
1250	struct file *fpop;
1251
1252	if (uio->uio_resid > DEVFS_IOSIZE_MAX)
1253		return (EINVAL);
1254	fpop = td->td_fpop;
1255	error = devfs_fp_check(fp, &dev, &dsw, &ref);
1256	if (error != 0) {
1257		error = vnops.fo_read(fp, uio, cred, flags, td);
1258		return (error);
1259	}
1260	resid = uio->uio_resid;
1261	ioflag = fp->f_flag & (O_NONBLOCK | O_DIRECT);
1262	if (ioflag & O_DIRECT)
1263		ioflag |= IO_DIRECT;
1264
1265	foffset_lock_uio(fp, uio, flags | FOF_NOLOCK);
1266	error = dsw->d_read(dev, uio, ioflag);
1267	if (uio->uio_resid != resid || (error == 0 && resid != 0))
1268		devfs_timestamp(&dev->si_atime);
1269	td->td_fpop = fpop;
1270	dev_relthread(dev, ref);
1271
1272	foffset_unlock_uio(fp, uio, flags | FOF_NOLOCK | FOF_NEXTOFF);
1273	return (error);
1274}
1275
1276static int
1277devfs_readdir(struct vop_readdir_args *ap)
1278{
1279	int error;
1280	struct uio *uio;
1281	struct dirent *dp;
1282	struct devfs_dirent *dd;
1283	struct devfs_dirent *de;
1284	struct devfs_mount *dmp;
1285	off_t off;
1286	int *tmp_ncookies = NULL;
1287
1288	if (ap->a_vp->v_type != VDIR)
1289		return (ENOTDIR);
1290
1291	uio = ap->a_uio;
1292	if (uio->uio_offset < 0)
1293		return (EINVAL);
1294
1295	/*
1296	 * XXX: This is a temporary hack to get around this filesystem not
1297	 * supporting cookies. We store the location of the ncookies pointer
1298	 * in a temporary variable before calling vfs_subr.c:vfs_read_dirent()
1299	 * and set the number of cookies to 0. We then set the pointer to
1300	 * NULL so that vfs_read_dirent doesn't try to call realloc() on
1301	 * ap->a_cookies. Later in this function, we restore the ap->a_ncookies
1302	 * pointer to its original location before returning to the caller.
1303	 */
1304	if (ap->a_ncookies != NULL) {
1305		tmp_ncookies = ap->a_ncookies;
1306		*ap->a_ncookies = 0;
1307		ap->a_ncookies = NULL;
1308	}
1309
1310	dmp = VFSTODEVFS(ap->a_vp->v_mount);
1311	if (devfs_populate_vp(ap->a_vp) != 0) {
1312		if (tmp_ncookies != NULL)
1313			ap->a_ncookies = tmp_ncookies;
1314		return (EIO);
1315	}
1316	error = 0;
1317	de = ap->a_vp->v_data;
1318	off = 0;
1319	TAILQ_FOREACH(dd, &de->de_dlist, de_list) {
1320		KASSERT(dd->de_cdp != (void *)0xdeadc0de, ("%s %d\n", __func__, __LINE__));
1321		if (dd->de_flags & (DE_COVERED | DE_WHITEOUT))
1322			continue;
1323		if (devfs_prison_check(dd, uio->uio_td))
1324			continue;
1325		if (dd->de_dirent->d_type == DT_DIR)
1326			de = dd->de_dir;
1327		else
1328			de = dd;
1329		dp = dd->de_dirent;
1330		if (dp->d_reclen > uio->uio_resid)
1331			break;
1332		dp->d_fileno = de->de_inode;
1333		if (off >= uio->uio_offset) {
1334			error = vfs_read_dirent(ap, dp, off);
1335			if (error)
1336				break;
1337		}
1338		off += dp->d_reclen;
1339	}
1340	sx_xunlock(&dmp->dm_lock);
1341	uio->uio_offset = off;
1342
1343	/*
1344	 * Restore ap->a_ncookies if it wasn't originally NULL in the first
1345	 * place.
1346	 */
1347	if (tmp_ncookies != NULL)
1348		ap->a_ncookies = tmp_ncookies;
1349
1350	return (error);
1351}
1352
1353static int
1354devfs_readlink(struct vop_readlink_args *ap)
1355{
1356	struct devfs_dirent *de;
1357
1358	de = ap->a_vp->v_data;
1359	return (uiomove(de->de_symlink, strlen(de->de_symlink), ap->a_uio));
1360}
1361
1362static int
1363devfs_reclaim(struct vop_reclaim_args *ap)
1364{
1365	struct vnode *vp;
1366	struct devfs_dirent *de;
1367
1368	vp = ap->a_vp;
1369	mtx_lock(&devfs_de_interlock);
1370	de = vp->v_data;
1371	if (de != NULL) {
1372		de->de_vnode = NULL;
1373		vp->v_data = NULL;
1374	}
1375	mtx_unlock(&devfs_de_interlock);
1376	vnode_destroy_vobject(vp);
1377	return (0);
1378}
1379
1380static int
1381devfs_reclaim_vchr(struct vop_reclaim_args *ap)
1382{
1383	struct vnode *vp;
1384	struct cdev *dev;
1385
1386	vp = ap->a_vp;
1387	MPASS(vp->v_type == VCHR);
1388
1389	devfs_reclaim(ap);
1390
1391	VI_LOCK(vp);
1392	dev_lock();
1393	dev = vp->v_rdev;
1394	vp->v_rdev = NULL;
1395	if (dev != NULL)
1396		dev->si_usecount -= vp->v_usecount;
1397	dev_unlock();
1398	VI_UNLOCK(vp);
1399	if (dev != NULL)
1400		dev_rel(dev);
1401	return (0);
1402}
1403
1404static int
1405devfs_remove(struct vop_remove_args *ap)
1406{
1407	struct vnode *dvp = ap->a_dvp;
1408	struct vnode *vp = ap->a_vp;
1409	struct devfs_dirent *dd;
1410	struct devfs_dirent *de, *de_covered;
1411	struct devfs_mount *dmp = VFSTODEVFS(vp->v_mount);
1412
1413	ASSERT_VOP_ELOCKED(dvp, "devfs_remove");
1414	ASSERT_VOP_ELOCKED(vp, "devfs_remove");
1415
1416	sx_xlock(&dmp->dm_lock);
1417	dd = ap->a_dvp->v_data;
1418	de = vp->v_data;
1419	if (de->de_cdp == NULL) {
1420		TAILQ_REMOVE(&dd->de_dlist, de, de_list);
1421		if (de->de_dirent->d_type == DT_LNK) {
1422			de_covered = devfs_find(dd, de->de_dirent->d_name,
1423			    de->de_dirent->d_namlen, 0);
1424			if (de_covered != NULL)
1425				de_covered->de_flags &= ~DE_COVERED;
1426		}
1427		/* We need to unlock dvp because devfs_delete() may lock it. */
1428		VOP_UNLOCK(vp, 0);
1429		if (dvp != vp)
1430			VOP_UNLOCK(dvp, 0);
1431		devfs_delete(dmp, de, 0);
1432		sx_xunlock(&dmp->dm_lock);
1433		if (dvp != vp)
1434			vn_lock(dvp, LK_EXCLUSIVE | LK_RETRY);
1435		vn_lock(vp, LK_EXCLUSIVE | LK_RETRY);
1436	} else {
1437		de->de_flags |= DE_WHITEOUT;
1438		sx_xunlock(&dmp->dm_lock);
1439	}
1440	return (0);
1441}
1442
1443/*
1444 * Revoke is called on a tty when a terminal session ends.  The vnode
1445 * is orphaned by setting v_op to deadfs so we need to let go of it
1446 * as well so that we create a new one next time around.
1447 *
1448 */
1449static int
1450devfs_revoke(struct vop_revoke_args *ap)
1451{
1452	struct vnode *vp = ap->a_vp, *vp2;
1453	struct cdev *dev;
1454	struct cdev_priv *cdp;
1455	struct devfs_dirent *de;
1456	u_int i;
1457
1458	KASSERT((ap->a_flags & REVOKEALL) != 0, ("devfs_revoke !REVOKEALL"));
1459
1460	dev = vp->v_rdev;
1461	cdp = cdev2priv(dev);
1462
1463	dev_lock();
1464	cdp->cdp_inuse++;
1465	dev_unlock();
1466
1467	vhold(vp);
1468	vgone(vp);
1469	vdrop(vp);
1470
1471	VOP_UNLOCK(vp,0);
1472 loop:
1473	for (;;) {
1474		mtx_lock(&devfs_de_interlock);
1475		dev_lock();
1476		vp2 = NULL;
1477		for (i = 0; i <= cdp->cdp_maxdirent; i++) {
1478			de = cdp->cdp_dirents[i];
1479			if (de == NULL)
1480				continue;
1481
1482			vp2 = de->de_vnode;
1483			if (vp2 != NULL) {
1484				dev_unlock();
1485				VI_LOCK(vp2);
1486				mtx_unlock(&devfs_de_interlock);
1487				if (vget(vp2, LK_EXCLUSIVE | LK_INTERLOCK,
1488				    curthread))
1489					goto loop;
1490				vhold(vp2);
1491				vgone(vp2);
1492				vdrop(vp2);
1493				vput(vp2);
1494				break;
1495			}
1496		}
1497		if (vp2 != NULL) {
1498			continue;
1499		}
1500		dev_unlock();
1501		mtx_unlock(&devfs_de_interlock);
1502		break;
1503	}
1504	dev_lock();
1505	cdp->cdp_inuse--;
1506	if (!(cdp->cdp_flags & CDP_ACTIVE) && cdp->cdp_inuse == 0) {
1507		TAILQ_REMOVE(&cdevp_list, cdp, cdp_list);
1508		dev_unlock();
1509		dev_rel(&cdp->cdp_c);
1510	} else
1511		dev_unlock();
1512
1513	vn_lock(vp, LK_EXCLUSIVE | LK_RETRY);
1514	return (0);
1515}
1516
1517static int
1518devfs_rioctl(struct vop_ioctl_args *ap)
1519{
1520	struct vnode *vp;
1521	struct devfs_mount *dmp;
1522	int error;
1523
1524	vp = ap->a_vp;
1525	vn_lock(vp, LK_SHARED | LK_RETRY);
1526	if (vp->v_iflag & VI_DOOMED) {
1527		VOP_UNLOCK(vp, 0);
1528		return (EBADF);
1529	}
1530	dmp = VFSTODEVFS(vp->v_mount);
1531	sx_xlock(&dmp->dm_lock);
1532	VOP_UNLOCK(vp, 0);
1533	DEVFS_DMP_HOLD(dmp);
1534	devfs_populate(dmp);
1535	if (DEVFS_DMP_DROP(dmp)) {
1536		sx_xunlock(&dmp->dm_lock);
1537		devfs_unmount_final(dmp);
1538		return (ENOENT);
1539	}
1540	error = devfs_rules_ioctl(dmp, ap->a_command, ap->a_data, ap->a_td);
1541	sx_xunlock(&dmp->dm_lock);
1542	return (error);
1543}
1544
1545static int
1546devfs_rread(struct vop_read_args *ap)
1547{
1548
1549	if (ap->a_vp->v_type != VDIR)
1550		return (EINVAL);
1551	return (VOP_READDIR(ap->a_vp, ap->a_uio, ap->a_cred, NULL, NULL, NULL));
1552}
1553
1554static int
1555devfs_setattr(struct vop_setattr_args *ap)
1556{
1557	struct devfs_dirent *de;
1558	struct vattr *vap;
1559	struct vnode *vp;
1560	struct thread *td;
1561	int c, error;
1562	uid_t uid;
1563	gid_t gid;
1564
1565	vap = ap->a_vap;
1566	vp = ap->a_vp;
1567	td = curthread;
1568	if ((vap->va_type != VNON) ||
1569	    (vap->va_nlink != VNOVAL) ||
1570	    (vap->va_fsid != VNOVAL) ||
1571	    (vap->va_fileid != VNOVAL) ||
1572	    (vap->va_blocksize != VNOVAL) ||
1573	    (vap->va_flags != VNOVAL && vap->va_flags != 0) ||
1574	    (vap->va_rdev != VNOVAL) ||
1575	    ((int)vap->va_bytes != VNOVAL) ||
1576	    (vap->va_gen != VNOVAL)) {
1577		return (EINVAL);
1578	}
1579
1580	error = devfs_populate_vp(vp);
1581	if (error != 0)
1582		return (error);
1583
1584	de = vp->v_data;
1585	if (vp->v_type == VDIR)
1586		de = de->de_dir;
1587
1588	c = 0;
1589	if (vap->va_uid == (uid_t)VNOVAL)
1590		uid = de->de_uid;
1591	else
1592		uid = vap->va_uid;
1593	if (vap->va_gid == (gid_t)VNOVAL)
1594		gid = de->de_gid;
1595	else
1596		gid = vap->va_gid;
1597	if (uid != de->de_uid || gid != de->de_gid) {
1598		if ((ap->a_cred->cr_uid != de->de_uid) || uid != de->de_uid ||
1599		    (gid != de->de_gid && !groupmember(gid, ap->a_cred))) {
1600			error = priv_check(td, PRIV_VFS_CHOWN);
1601			if (error != 0)
1602				goto ret;
1603		}
1604		de->de_uid = uid;
1605		de->de_gid = gid;
1606		c = 1;
1607	}
1608
1609	if (vap->va_mode != (mode_t)VNOVAL) {
1610		if (ap->a_cred->cr_uid != de->de_uid) {
1611			error = priv_check(td, PRIV_VFS_ADMIN);
1612			if (error != 0)
1613				goto ret;
1614		}
1615		de->de_mode = vap->va_mode;
1616		c = 1;
1617	}
1618
1619	if (vap->va_atime.tv_sec != VNOVAL || vap->va_mtime.tv_sec != VNOVAL) {
1620		error = vn_utimes_perm(vp, vap, ap->a_cred, td);
1621		if (error != 0)
1622			goto ret;
1623		if (vap->va_atime.tv_sec != VNOVAL) {
1624			if (vp->v_type == VCHR)
1625				vp->v_rdev->si_atime = vap->va_atime;
1626			else
1627				de->de_atime = vap->va_atime;
1628		}
1629		if (vap->va_mtime.tv_sec != VNOVAL) {
1630			if (vp->v_type == VCHR)
1631				vp->v_rdev->si_mtime = vap->va_mtime;
1632			else
1633				de->de_mtime = vap->va_mtime;
1634		}
1635		c = 1;
1636	}
1637
1638	if (c) {
1639		if (vp->v_type == VCHR)
1640			vfs_timestamp(&vp->v_rdev->si_ctime);
1641		else
1642			vfs_timestamp(&de->de_mtime);
1643	}
1644
1645ret:
1646	sx_xunlock(&VFSTODEVFS(vp->v_mount)->dm_lock);
1647	return (error);
1648}
1649
1650#ifdef MAC
1651static int
1652devfs_setlabel(struct vop_setlabel_args *ap)
1653{
1654	struct vnode *vp;
1655	struct devfs_dirent *de;
1656
1657	vp = ap->a_vp;
1658	de = vp->v_data;
1659
1660	mac_vnode_relabel(ap->a_cred, vp, ap->a_label);
1661	mac_devfs_update(vp->v_mount, de, vp);
1662
1663	return (0);
1664}
1665#endif
1666
1667static int
1668devfs_stat_f(struct file *fp, struct stat *sb, struct ucred *cred, struct thread *td)
1669{
1670
1671	return (vnops.fo_stat(fp, sb, cred, td));
1672}
1673
1674static int
1675devfs_symlink(struct vop_symlink_args *ap)
1676{
1677	int i, error;
1678	struct devfs_dirent *dd;
1679	struct devfs_dirent *de, *de_covered, *de_dotdot;
1680	struct devfs_mount *dmp;
1681
1682	error = priv_check(curthread, PRIV_DEVFS_SYMLINK);
1683	if (error)
1684		return(error);
1685	dmp = VFSTODEVFS(ap->a_dvp->v_mount);
1686	if (devfs_populate_vp(ap->a_dvp) != 0)
1687		return (ENOENT);
1688
1689	dd = ap->a_dvp->v_data;
1690	de = devfs_newdirent(ap->a_cnp->cn_nameptr, ap->a_cnp->cn_namelen);
1691	de->de_flags = DE_USER;
1692	de->de_uid = 0;
1693	de->de_gid = 0;
1694	de->de_mode = 0755;
1695	de->de_inode = alloc_unr(devfs_inos);
1696	de->de_dir = dd;
1697	de->de_dirent->d_type = DT_LNK;
1698	i = strlen(ap->a_target) + 1;
1699	de->de_symlink = malloc(i, M_DEVFS, M_WAITOK);
1700	bcopy(ap->a_target, de->de_symlink, i);
1701#ifdef MAC
1702	mac_devfs_create_symlink(ap->a_cnp->cn_cred, dmp->dm_mount, dd, de);
1703#endif
1704	de_covered = devfs_find(dd, de->de_dirent->d_name,
1705	    de->de_dirent->d_namlen, 0);
1706	if (de_covered != NULL) {
1707		if ((de_covered->de_flags & DE_USER) != 0) {
1708			devfs_delete(dmp, de, DEVFS_DEL_NORECURSE);
1709			sx_xunlock(&dmp->dm_lock);
1710			return (EEXIST);
1711		}
1712		KASSERT((de_covered->de_flags & DE_COVERED) == 0,
1713		    ("devfs_symlink: entry %p already covered", de_covered));
1714		de_covered->de_flags |= DE_COVERED;
1715	}
1716
1717	de_dotdot = TAILQ_FIRST(&dd->de_dlist);		/* "." */
1718	de_dotdot = TAILQ_NEXT(de_dotdot, de_list);	/* ".." */
1719	TAILQ_INSERT_AFTER(&dd->de_dlist, de_dotdot, de, de_list);
1720	devfs_dir_ref_de(dmp, dd);
1721	devfs_rules_apply(dmp, de);
1722
1723	return (devfs_allocv(de, ap->a_dvp->v_mount, LK_EXCLUSIVE, ap->a_vpp));
1724}
1725
1726static int
1727devfs_truncate_f(struct file *fp, off_t length, struct ucred *cred, struct thread *td)
1728{
1729
1730	return (vnops.fo_truncate(fp, length, cred, td));
1731}
1732
1733static int
1734devfs_write_f(struct file *fp, struct uio *uio, struct ucred *cred,
1735    int flags, struct thread *td)
1736{
1737	struct cdev *dev;
1738	int error, ioflag, ref;
1739	ssize_t resid;
1740	struct cdevsw *dsw;
1741	struct file *fpop;
1742
1743	if (uio->uio_resid > DEVFS_IOSIZE_MAX)
1744		return (EINVAL);
1745	fpop = td->td_fpop;
1746	error = devfs_fp_check(fp, &dev, &dsw, &ref);
1747	if (error != 0) {
1748		error = vnops.fo_write(fp, uio, cred, flags, td);
1749		return (error);
1750	}
1751	KASSERT(uio->uio_td == td, ("uio_td %p is not td %p", uio->uio_td, td));
1752	ioflag = fp->f_flag & (O_NONBLOCK | O_DIRECT | O_FSYNC);
1753	if (ioflag & O_DIRECT)
1754		ioflag |= IO_DIRECT;
1755	foffset_lock_uio(fp, uio, flags | FOF_NOLOCK);
1756
1757	resid = uio->uio_resid;
1758
1759	error = dsw->d_write(dev, uio, ioflag);
1760	if (uio->uio_resid != resid || (error == 0 && resid != 0)) {
1761		devfs_timestamp(&dev->si_ctime);
1762		dev->si_mtime = dev->si_ctime;
1763	}
1764	td->td_fpop = fpop;
1765	dev_relthread(dev, ref);
1766
1767	foffset_unlock_uio(fp, uio, flags | FOF_NOLOCK | FOF_NEXTOFF);
1768	return (error);
1769}
1770
1771static int
1772devfs_mmap_f(struct file *fp, vm_map_t map, vm_offset_t *addr, vm_size_t size,
1773    vm_prot_t prot, vm_prot_t cap_maxprot, int flags, vm_ooffset_t foff,
1774    struct thread *td)
1775{
1776	struct cdev *dev;
1777	struct cdevsw *dsw;
1778	struct mount *mp;
1779	struct vnode *vp;
1780	struct file *fpop;
1781	vm_object_t object;
1782	vm_prot_t maxprot;
1783	int error, ref;
1784
1785	vp = fp->f_vnode;
1786
1787	/*
1788	 * Ensure that file and memory protections are
1789	 * compatible.
1790	 */
1791	mp = vp->v_mount;
1792	if (mp != NULL && (mp->mnt_flag & MNT_NOEXEC) != 0)
1793		maxprot = VM_PROT_NONE;
1794	else
1795		maxprot = VM_PROT_EXECUTE;
1796	if ((fp->f_flag & FREAD) != 0)
1797		maxprot |= VM_PROT_READ;
1798	else if ((prot & VM_PROT_READ) != 0)
1799		return (EACCES);
1800
1801	/*
1802	 * If we are sharing potential changes via MAP_SHARED and we
1803	 * are trying to get write permission although we opened it
1804	 * without asking for it, bail out.
1805	 *
1806	 * Note that most character devices always share mappings.
1807	 * The one exception is that D_MMAP_ANON devices
1808	 * (i.e. /dev/zero) permit private writable mappings.
1809	 *
1810	 * Rely on vm_mmap_cdev() to fail invalid MAP_PRIVATE requests
1811	 * as well as updating maxprot to permit writing for
1812	 * D_MMAP_ANON devices rather than doing that here.
1813	 */
1814	if ((flags & MAP_SHARED) != 0) {
1815		if ((fp->f_flag & FWRITE) != 0)
1816			maxprot |= VM_PROT_WRITE;
1817		else if ((prot & VM_PROT_WRITE) != 0)
1818			return (EACCES);
1819	}
1820	maxprot &= cap_maxprot;
1821
1822	fpop = td->td_fpop;
1823	error = devfs_fp_check(fp, &dev, &dsw, &ref);
1824	if (error != 0)
1825		return (error);
1826
1827	error = vm_mmap_cdev(td, size, prot, &maxprot, &flags, dev, dsw, &foff,
1828	    &object);
1829	td->td_fpop = fpop;
1830	dev_relthread(dev, ref);
1831	if (error != 0)
1832		return (error);
1833
1834	error = vm_mmap_object(map, addr, size, prot, maxprot, flags, object,
1835	    foff, FALSE, td);
1836	if (error != 0)
1837		vm_object_deallocate(object);
1838	return (error);
1839}
1840
1841dev_t
1842dev2udev(struct cdev *x)
1843{
1844	if (x == NULL)
1845		return (NODEV);
1846	return (cdev2priv(x)->cdp_inode);
1847}
1848
1849static struct fileops devfs_ops_f = {
1850	.fo_read =	devfs_read_f,
1851	.fo_write =	devfs_write_f,
1852	.fo_truncate =	devfs_truncate_f,
1853	.fo_ioctl =	devfs_ioctl_f,
1854	.fo_poll =	devfs_poll_f,
1855	.fo_kqfilter =	devfs_kqfilter_f,
1856	.fo_stat =	devfs_stat_f,
1857	.fo_close =	devfs_close_f,
1858	.fo_chmod =	vn_chmod,
1859	.fo_chown =	vn_chown,
1860	.fo_sendfile =	vn_sendfile,
1861	.fo_seek =	vn_seek,
1862	.fo_fill_kinfo = vn_fill_kinfo,
1863	.fo_mmap =	devfs_mmap_f,
1864	.fo_flags =	DFLAG_PASSABLE | DFLAG_SEEKABLE
1865};
1866
1867static struct vop_vector devfs_vnodeops = {
1868	.vop_default =		&default_vnodeops,
1869
1870	.vop_access =		devfs_access,
1871	.vop_getattr =		devfs_getattr,
1872	.vop_ioctl =		devfs_rioctl,
1873	.vop_lookup =		devfs_lookup,
1874	.vop_mknod =		devfs_mknod,
1875	.vop_pathconf =		devfs_pathconf,
1876	.vop_read =		devfs_rread,
1877	.vop_readdir =		devfs_readdir,
1878	.vop_readlink =		devfs_readlink,
1879	.vop_reclaim =		devfs_reclaim,
1880	.vop_remove =		devfs_remove,
1881	.vop_revoke =		devfs_revoke,
1882	.vop_setattr =		devfs_setattr,
1883#ifdef MAC
1884	.vop_setlabel =		devfs_setlabel,
1885#endif
1886	.vop_symlink =		devfs_symlink,
1887	.vop_vptocnp =		devfs_vptocnp,
1888};
1889
1890static struct vop_vector devfs_specops = {
1891	.vop_default =		&default_vnodeops,
1892
1893	.vop_access =		devfs_access,
1894	.vop_bmap =		VOP_PANIC,
1895	.vop_close =		devfs_close,
1896	.vop_create =		VOP_PANIC,
1897	.vop_fsync =		devfs_fsync,
1898	.vop_getattr =		devfs_getattr,
1899	.vop_link =		VOP_PANIC,
1900	.vop_mkdir =		VOP_PANIC,
1901	.vop_mknod =		VOP_PANIC,
1902	.vop_open =		devfs_open,
1903	.vop_pathconf =		devfs_pathconf,
1904	.vop_poll =		dead_poll,
1905	.vop_print =		devfs_print,
1906	.vop_read =		dead_read,
1907	.vop_readdir =		VOP_PANIC,
1908	.vop_readlink =		VOP_PANIC,
1909	.vop_reallocblks =	VOP_PANIC,
1910	.vop_reclaim =		devfs_reclaim_vchr,
1911	.vop_remove =		devfs_remove,
1912	.vop_rename =		VOP_PANIC,
1913	.vop_revoke =		devfs_revoke,
1914	.vop_rmdir =		VOP_PANIC,
1915	.vop_setattr =		devfs_setattr,
1916#ifdef MAC
1917	.vop_setlabel =		devfs_setlabel,
1918#endif
1919	.vop_strategy =		VOP_PANIC,
1920	.vop_symlink =		VOP_PANIC,
1921	.vop_vptocnp =		devfs_vptocnp,
1922	.vop_write =		dead_write,
1923};
1924
1925/*
1926 * Our calling convention to the device drivers used to be that we passed
1927 * vnode.h IO_* flags to read()/write(), but we're moving to fcntl.h O_
1928 * flags instead since that's what open(), close() and ioctl() takes and
1929 * we don't really want vnode.h in device drivers.
1930 * We solved the source compatibility by redefining some vnode flags to
1931 * be the same as the fcntl ones and by sending down the bitwise OR of
1932 * the respective fcntl/vnode flags.  These CTASSERTS make sure nobody
1933 * pulls the rug out under this.
1934 */
1935CTASSERT(O_NONBLOCK == IO_NDELAY);
1936CTASSERT(O_FSYNC == IO_SYNC);
1937