xref: /dragonfly/sys/vfs/devfs/devfs_core.c (revision 81c11cd3)
1 /*
2  * Copyright (c) 2009 The DragonFly Project.  All rights reserved.
3  *
4  * This code is derived from software contributed to The DragonFly Project
5  * by Alex Hornung <ahornung@gmail.com>
6  *
7  * Redistribution and use in source and binary forms, with or without
8  * modification, are permitted provided that the following conditions
9  * are met:
10  *
11  * 1. Redistributions of source code must retain the above copyright
12  *    notice, this list of conditions and the following disclaimer.
13  * 2. Redistributions in binary form must reproduce the above copyright
14  *    notice, this list of conditions and the following disclaimer in
15  *    the documentation and/or other materials provided with the
16  *    distribution.
17  * 3. Neither the name of The DragonFly Project nor the names of its
18  *    contributors may be used to endorse or promote products derived
19  *    from this software without specific, prior written permission.
20  *
21  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
22  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
23  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
24  * FOR A PARTICULAR PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE
25  * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
26  * INCIDENTAL, SPECIAL, EXEMPLARY OR CONSEQUENTIAL DAMAGES (INCLUDING,
27  * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
28  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
29  * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
30  * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
31  * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
32  * SUCH DAMAGE.
33  */
34 #include <sys/param.h>
35 #include <sys/systm.h>
36 #include <sys/kernel.h>
37 #include <sys/mount.h>
38 #include <sys/vnode.h>
39 #include <sys/types.h>
40 #include <sys/lock.h>
41 #include <sys/msgport.h>
42 #include <sys/sysctl.h>
43 #include <sys/ucred.h>
44 #include <sys/param.h>
45 #include <sys/systm.h>
46 #include <sys/devfs.h>
47 #include <sys/devfs_rules.h>
48 #include <sys/udev.h>
49 
50 #include <sys/msgport2.h>
51 #include <sys/spinlock2.h>
52 #include <sys/mplock2.h>
53 #include <sys/sysref2.h>
54 
55 MALLOC_DEFINE(M_DEVFS, "devfs", "Device File System (devfs) allocations");
56 DEVFS_DECLARE_CLONE_BITMAP(ops_id);
57 /*
58  * SYSREF Integration - reference counting, allocation,
59  * sysid and syslink integration.
60  */
61 static void devfs_cdev_terminate(cdev_t dev);
62 static void devfs_cdev_lock(cdev_t dev);
63 static void devfs_cdev_unlock(cdev_t dev);
64 static struct sysref_class     cdev_sysref_class = {
65 	.name =         "cdev",
66 	.mtype =        M_DEVFS,
67 	.proto =        SYSREF_PROTO_DEV,
68 	.offset =       offsetof(struct cdev, si_sysref),
69 	.objsize =      sizeof(struct cdev),
70 	.mag_capacity = 32,
71 	.flags =        0,
72 	.ops =  {
73 		.terminate = (sysref_terminate_func_t)devfs_cdev_terminate,
74 		.lock = (sysref_lock_func_t)devfs_cdev_lock,
75 		.unlock = (sysref_unlock_func_t)devfs_cdev_unlock
76 	}
77 };
78 
79 static struct objcache	*devfs_node_cache;
80 static struct objcache 	*devfs_msg_cache;
81 static struct objcache	*devfs_dev_cache;
82 
83 static struct objcache_malloc_args devfs_node_malloc_args = {
84 	sizeof(struct devfs_node), M_DEVFS };
85 struct objcache_malloc_args devfs_msg_malloc_args = {
86 	sizeof(struct devfs_msg), M_DEVFS };
87 struct objcache_malloc_args devfs_dev_malloc_args = {
88 	sizeof(struct cdev), M_DEVFS };
89 
90 static struct devfs_dev_head devfs_dev_list =
91 		TAILQ_HEAD_INITIALIZER(devfs_dev_list);
92 static struct devfs_mnt_head devfs_mnt_list =
93 		TAILQ_HEAD_INITIALIZER(devfs_mnt_list);
94 static struct devfs_chandler_head devfs_chandler_list =
95 		TAILQ_HEAD_INITIALIZER(devfs_chandler_list);
96 static struct devfs_alias_head devfs_alias_list =
97 		TAILQ_HEAD_INITIALIZER(devfs_alias_list);
98 static struct devfs_dev_ops_head devfs_dev_ops_list =
99 		TAILQ_HEAD_INITIALIZER(devfs_dev_ops_list);
100 
101 struct lock 		devfs_lock;
102 static struct lwkt_port devfs_dispose_port;
103 static struct lwkt_port devfs_msg_port;
104 static struct thread 	*td_core;
105 
106 static struct spinlock  ino_lock;
107 static ino_t 	d_ino;
108 static int	devfs_debug_enable;
109 static int	devfs_run;
110 
111 static ino_t devfs_fetch_ino(void);
112 static int devfs_create_all_dev_worker(struct devfs_node *);
113 static int devfs_create_dev_worker(cdev_t, uid_t, gid_t, int);
114 static int devfs_destroy_dev_worker(cdev_t);
115 static int devfs_destroy_subnames_worker(char *);
116 static int devfs_destroy_dev_by_ops_worker(struct dev_ops *, int);
117 static int devfs_propagate_dev(cdev_t, int);
118 static int devfs_unlink_dev(cdev_t dev);
119 static void devfs_msg_exec(devfs_msg_t msg);
120 
121 static int devfs_chandler_add_worker(const char *, d_clone_t *);
122 static int devfs_chandler_del_worker(const char *);
123 
124 static void devfs_msg_autofree_reply(lwkt_port_t, lwkt_msg_t);
125 static void devfs_msg_core(void *);
126 
127 static int devfs_find_device_by_name_worker(devfs_msg_t);
128 static int devfs_find_device_by_udev_worker(devfs_msg_t);
129 
130 static int devfs_apply_reset_rules_caller(char *, int);
131 
132 static int devfs_scan_callback_worker(devfs_scan_t *, void *);
133 
134 static struct devfs_node *devfs_resolve_or_create_dir(struct devfs_node *,
135 		char *, size_t, int);
136 
137 static int devfs_make_alias_worker(struct devfs_alias *);
138 static int devfs_destroy_alias_worker(struct devfs_alias *);
139 static int devfs_alias_remove(cdev_t);
140 static int devfs_alias_reap(void);
141 static int devfs_alias_propagate(struct devfs_alias *, int);
142 static int devfs_alias_apply(struct devfs_node *, struct devfs_alias *);
143 static int devfs_alias_check_create(struct devfs_node *);
144 
145 static int devfs_clr_subnames_flag_worker(char *, uint32_t);
146 static int devfs_destroy_subnames_without_flag_worker(char *, uint32_t);
147 
148 static void *devfs_reaperp_callback(struct devfs_node *, void *);
149 static void *devfs_gc_dirs_callback(struct devfs_node *, void *);
150 static void *devfs_gc_links_callback(struct devfs_node *, struct devfs_node *);
151 static void *
152 devfs_inode_to_vnode_worker_callback(struct devfs_node *, ino_t *);
153 
154 /*
155  * devfs_debug() is a SYSCTL and TUNABLE controlled debug output function
156  * using kvprintf
157  */
158 int
159 devfs_debug(int level, char *fmt, ...)
160 {
161 	__va_list ap;
162 
163 	__va_start(ap, fmt);
164 	if (level <= devfs_debug_enable)
165 		kvprintf(fmt, ap);
166 	__va_end(ap);
167 
168 	return 0;
169 }
170 
171 /*
172  * devfs_allocp() Allocates a new devfs node with the specified
173  * parameters. The node is also automatically linked into the topology
174  * if a parent is specified. It also calls the rule and alias stuff to
175  * be applied on the new node
176  */
177 struct devfs_node *
178 devfs_allocp(devfs_nodetype devfsnodetype, char *name,
179 	     struct devfs_node *parent, struct mount *mp, cdev_t dev)
180 {
181 	struct devfs_node *node = NULL;
182 	size_t namlen = strlen(name);
183 
184 	node = objcache_get(devfs_node_cache, M_WAITOK);
185 	bzero(node, sizeof(*node));
186 
187 	atomic_add_long(&DEVFS_MNTDATA(mp)->leak_count, 1);
188 
189 	node->d_dev = NULL;
190 	node->nchildren = 1;
191 	node->mp = mp;
192 	node->d_dir.d_ino = devfs_fetch_ino();
193 
194 	/*
195 	 * Cookie jar for children. Leave 0 and 1 for '.' and '..' entries
196 	 * respectively.
197 	 */
198 	node->cookie_jar = 2;
199 
200 	/*
201 	 * Access Control members
202 	 */
203 	node->mode = DEVFS_DEFAULT_MODE;
204 	node->uid = DEVFS_DEFAULT_UID;
205 	node->gid = DEVFS_DEFAULT_GID;
206 
207 	switch (devfsnodetype) {
208 	case Proot:
209 		/*
210 		 * Ensure that we don't recycle the root vnode by marking it as
211 		 * linked into the topology.
212 		 */
213 		node->flags |= DEVFS_NODE_LINKED;
214 	case Pdir:
215 		TAILQ_INIT(DEVFS_DENODE_HEAD(node));
216 		node->d_dir.d_type = DT_DIR;
217 		node->nchildren = 2;
218 		break;
219 
220 	case Plink:
221 		node->d_dir.d_type = DT_LNK;
222 		break;
223 
224 	case Preg:
225 		node->d_dir.d_type = DT_REG;
226 		break;
227 
228 	case Pdev:
229 		if (dev != NULL) {
230 			node->d_dir.d_type = DT_CHR;
231 			node->d_dev = dev;
232 
233 			node->mode = dev->si_perms;
234 			node->uid = dev->si_uid;
235 			node->gid = dev->si_gid;
236 
237 			devfs_alias_check_create(node);
238 		}
239 		break;
240 
241 	default:
242 		panic("devfs_allocp: unknown node type");
243 	}
244 
245 	node->v_node = NULL;
246 	node->node_type = devfsnodetype;
247 
248 	/* Initialize the dirent structure of each devfs vnode */
249 	node->d_dir.d_namlen = namlen;
250 	node->d_dir.d_name = kmalloc(namlen+1, M_DEVFS, M_WAITOK);
251 	memcpy(node->d_dir.d_name, name, namlen);
252 	node->d_dir.d_name[namlen] = '\0';
253 
254 	/* Initialize the parent node element */
255 	node->parent = parent;
256 
257 	/* Initialize *time members */
258 	nanotime(&node->atime);
259 	node->mtime = node->ctime = node->atime;
260 
261 	/*
262 	 * Associate with parent as last step, clean out namecache
263 	 * reference.
264 	 */
265 	if ((parent != NULL) &&
266 	    ((parent->node_type == Proot) || (parent->node_type == Pdir))) {
267 		parent->nchildren++;
268 		node->cookie = parent->cookie_jar++;
269 		node->flags |= DEVFS_NODE_LINKED;
270 		TAILQ_INSERT_TAIL(DEVFS_DENODE_HEAD(parent), node, link);
271 
272 		/* This forces negative namecache lookups to clear */
273 		++mp->mnt_namecache_gen;
274 	}
275 
276 	/* Apply rules */
277 	devfs_rule_check_apply(node, NULL);
278 
279 	atomic_add_long(&DEVFS_MNTDATA(mp)->file_count, 1);
280 
281 	return node;
282 }
283 
284 /*
285  * devfs_allocv() allocates a new vnode based on a devfs node.
286  */
287 int
288 devfs_allocv(struct vnode **vpp, struct devfs_node *node)
289 {
290 	struct vnode *vp;
291 	int error = 0;
292 
293 	KKASSERT(node);
294 
295 try_again:
296 	while ((vp = node->v_node) != NULL) {
297 		error = vget(vp, LK_EXCLUSIVE);
298 		if (error != ENOENT) {
299 			*vpp = vp;
300 			goto out;
301 		}
302 	}
303 
304 	if ((error = getnewvnode(VT_DEVFS, node->mp, vpp, 0, 0)) != 0)
305 		goto out;
306 
307 	vp = *vpp;
308 
309 	if (node->v_node != NULL) {
310 		vp->v_type = VBAD;
311 		vx_put(vp);
312 		goto try_again;
313 	}
314 
315 	vp->v_data = node;
316 	node->v_node = vp;
317 
318 	switch (node->node_type) {
319 	case Proot:
320 		vsetflags(vp, VROOT);
321 		/* fall through */
322 	case Pdir:
323 		vp->v_type = VDIR;
324 		break;
325 
326 	case Plink:
327 		vp->v_type = VLNK;
328 		break;
329 
330 	case Preg:
331 		vp->v_type = VREG;
332 		break;
333 
334 	case Pdev:
335 		vp->v_type = VCHR;
336 		KKASSERT(node->d_dev);
337 
338 		vp->v_uminor = node->d_dev->si_uminor;
339 		vp->v_umajor = 0;
340 
341 		v_associate_rdev(vp, node->d_dev);
342 		vp->v_ops = &node->mp->mnt_vn_spec_ops;
343 		break;
344 
345 	default:
346 		panic("devfs_allocv: unknown node type");
347 	}
348 
349 out:
350 	return error;
351 }
352 
353 /*
354  * devfs_allocvp allocates both a devfs node (with the given settings) and a vnode
355  * based on the newly created devfs node.
356  */
357 int
358 devfs_allocvp(struct mount *mp, struct vnode **vpp, devfs_nodetype devfsnodetype,
359 		char *name, struct devfs_node *parent, cdev_t dev)
360 {
361 	struct devfs_node *node;
362 
363 	node = devfs_allocp(devfsnodetype, name, parent, mp, dev);
364 
365 	if (node != NULL)
366 		devfs_allocv(vpp, node);
367 	else
368 		*vpp = NULL;
369 
370 	return 0;
371 }
372 
373 /*
374  * Destroy the devfs_node.  The node must be unlinked from the topology.
375  *
376  * This function will also destroy any vnode association with the node
377  * and device.
378  *
379  * The cdev_t itself remains intact.
380  *
381  * The core lock is not necessarily held on call and must be temporarily
382  * released if it is to avoid a deadlock.
383  */
384 int
385 devfs_freep(struct devfs_node *node)
386 {
387 	struct vnode *vp;
388 	int relock;
389 
390 	KKASSERT(node);
391 	KKASSERT(((node->flags & DEVFS_NODE_LINKED) == 0) ||
392 		 (node->node_type == Proot));
393 
394 	/*
395 	 * Protect against double frees
396 	 */
397 	KKASSERT((node->flags & DEVFS_DESTROYED) == 0);
398 	node->flags |= DEVFS_DESTROYED;
399 
400 	/*
401 	 * Avoid deadlocks between devfs_lock and the vnode lock when
402 	 * disassociating the vnode (stress2 pty vs ls -la /dev/pts).
403 	 *
404 	 * This also prevents the vnode reclaim code from double-freeing
405 	 * the node.  The vget() is required to safely modified the vp
406 	 * and cycle the refs to terminate an inactive vp.
407 	 */
408 	if (lockstatus(&devfs_lock, curthread) == LK_EXCLUSIVE) {
409 		lockmgr(&devfs_lock, LK_RELEASE);
410 		relock = 1;
411 	} else {
412 		relock = 0;
413 	}
414 
415 	while ((vp = node->v_node) != NULL) {
416 		if (vget(vp, LK_EXCLUSIVE | LK_RETRY) != 0)
417 			break;
418 		v_release_rdev(vp);
419 		vp->v_data = NULL;
420 		node->v_node = NULL;
421 		cache_inval_vp(vp, CINV_DESTROY);
422 		vput(vp);
423 	}
424 
425 	/*
426 	 * Remaining cleanup
427 	 */
428 	atomic_subtract_long(&DEVFS_MNTDATA(node->mp)->leak_count, 1);
429 	if (node->symlink_name)	{
430 		kfree(node->symlink_name, M_DEVFS);
431 		node->symlink_name = NULL;
432 	}
433 
434 	/*
435 	 * Remove the node from the orphan list if it is still on it.
436 	 */
437 	if (node->flags & DEVFS_ORPHANED)
438 		devfs_tracer_del_orphan(node);
439 
440 	if (node->d_dir.d_name) {
441 		kfree(node->d_dir.d_name, M_DEVFS);
442 		node->d_dir.d_name = NULL;
443 	}
444 	atomic_subtract_long(&DEVFS_MNTDATA(node->mp)->file_count, 1);
445 	objcache_put(devfs_node_cache, node);
446 
447 	if (relock)
448 		lockmgr(&devfs_lock, LK_EXCLUSIVE);
449 
450 	return 0;
451 }
452 
453 /*
454  * Unlink the devfs node from the topology and add it to the orphan list.
455  * The node will later be destroyed by freep.
456  *
457  * Any vnode association, including the v_rdev and v_data, remains intact
458  * until the freep.
459  */
460 int
461 devfs_unlinkp(struct devfs_node *node)
462 {
463 	struct devfs_node *parent;
464 	KKASSERT(node);
465 
466 	/*
467 	 * Add the node to the orphan list, so it is referenced somewhere, to
468 	 * so we don't leak it.
469 	 */
470 	devfs_tracer_add_orphan(node);
471 
472 	parent = node->parent;
473 
474 	/*
475 	 * If the parent is known we can unlink the node out of the topology
476 	 */
477 	if (parent)	{
478 		TAILQ_REMOVE(DEVFS_DENODE_HEAD(parent), node, link);
479 		parent->nchildren--;
480 		node->flags &= ~DEVFS_NODE_LINKED;
481 	}
482 
483 	node->parent = NULL;
484 	return 0;
485 }
486 
487 void *
488 devfs_iterate_topology(struct devfs_node *node,
489 		devfs_iterate_callback_t *callback, void *arg1)
490 {
491 	struct devfs_node *node1, *node2;
492 	void *ret = NULL;
493 
494 	if ((node->node_type == Proot) || (node->node_type == Pdir)) {
495 		if (node->nchildren > 2) {
496 			TAILQ_FOREACH_MUTABLE(node1, DEVFS_DENODE_HEAD(node),
497 							link, node2) {
498 				if ((ret = devfs_iterate_topology(node1, callback, arg1)))
499 					return ret;
500 			}
501 		}
502 	}
503 
504 	ret = callback(node, arg1);
505 	return ret;
506 }
507 
508 /*
509  * devfs_reaperp() is a recursive function that iterates through all the
510  * topology, unlinking and freeing all devfs nodes.
511  */
512 static void *
513 devfs_reaperp_callback(struct devfs_node *node, void *unused)
514 {
515 	devfs_unlinkp(node);
516 	devfs_freep(node);
517 
518 	return NULL;
519 }
520 
521 static void *
522 devfs_gc_dirs_callback(struct devfs_node *node, void *unused)
523 {
524 	if (node->node_type == Pdir) {
525 		if ((node->nchildren == 2) &&
526 		    !(node->flags & DEVFS_USER_CREATED)) {
527 			devfs_unlinkp(node);
528 			devfs_freep(node);
529 		}
530 	}
531 
532 	return NULL;
533 }
534 
535 static void *
536 devfs_gc_links_callback(struct devfs_node *node, struct devfs_node *target)
537 {
538 	if ((node->node_type == Plink) && (node->link_target == target)) {
539 		devfs_unlinkp(node);
540 		devfs_freep(node);
541 	}
542 
543 	return NULL;
544 }
545 
546 /*
547  * devfs_gc() is devfs garbage collector. It takes care of unlinking and
548  * freeing a node, but also removes empty directories and links that link
549  * via devfs auto-link mechanism to the node being deleted.
550  */
551 int
552 devfs_gc(struct devfs_node *node)
553 {
554 	struct devfs_node *root_node = DEVFS_MNTDATA(node->mp)->root_node;
555 
556 	if (node->nlinks > 0)
557 		devfs_iterate_topology(root_node,
558 				(devfs_iterate_callback_t *)devfs_gc_links_callback, node);
559 
560 	devfs_unlinkp(node);
561 	devfs_iterate_topology(root_node,
562 			(devfs_iterate_callback_t *)devfs_gc_dirs_callback, NULL);
563 
564 	devfs_freep(node);
565 
566 	return 0;
567 }
568 
569 /*
570  * devfs_create_dev() is the asynchronous entry point for device creation.
571  * It just sends a message with the relevant details to the devfs core.
572  *
573  * This function will reference the passed device.  The reference is owned
574  * by devfs and represents all of the device's node associations.
575  */
576 int
577 devfs_create_dev(cdev_t dev, uid_t uid, gid_t gid, int perms)
578 {
579 	reference_dev(dev);
580 	devfs_msg_send_dev(DEVFS_DEVICE_CREATE, dev, uid, gid, perms);
581 
582 	return 0;
583 }
584 
585 /*
586  * devfs_destroy_dev() is the asynchronous entry point for device destruction.
587  * It just sends a message with the relevant details to the devfs core.
588  */
589 int
590 devfs_destroy_dev(cdev_t dev)
591 {
592 	devfs_msg_send_dev(DEVFS_DEVICE_DESTROY, dev, 0, 0, 0);
593 	return 0;
594 }
595 
596 /*
597  * devfs_mount_add() is the synchronous entry point for adding a new devfs
598  * mount.  It sends a synchronous message with the relevant details to the
599  * devfs core.
600  */
601 int
602 devfs_mount_add(struct devfs_mnt_data *mnt)
603 {
604 	devfs_msg_t msg;
605 
606 	msg = devfs_msg_get();
607 	msg->mdv_mnt = mnt;
608 	msg = devfs_msg_send_sync(DEVFS_MOUNT_ADD, msg);
609 	devfs_msg_put(msg);
610 
611 	return 0;
612 }
613 
614 /*
615  * devfs_mount_del() is the synchronous entry point for removing a devfs mount.
616  * It sends a synchronous message with the relevant details to the devfs core.
617  */
618 int
619 devfs_mount_del(struct devfs_mnt_data *mnt)
620 {
621 	devfs_msg_t msg;
622 
623 	msg = devfs_msg_get();
624 	msg->mdv_mnt = mnt;
625 	msg = devfs_msg_send_sync(DEVFS_MOUNT_DEL, msg);
626 	devfs_msg_put(msg);
627 
628 	return 0;
629 }
630 
631 /*
632  * devfs_destroy_subnames() is the synchronous entry point for device
633  * destruction by subname. It just sends a message with the relevant details to
634  * the devfs core.
635  */
636 int
637 devfs_destroy_subnames(char *name)
638 {
639 	devfs_msg_t msg;
640 
641 	msg = devfs_msg_get();
642 	msg->mdv_load = name;
643 	msg = devfs_msg_send_sync(DEVFS_DESTROY_SUBNAMES, msg);
644 	devfs_msg_put(msg);
645 	return 0;
646 }
647 
648 int
649 devfs_clr_subnames_flag(char *name, uint32_t flag)
650 {
651 	devfs_msg_t msg;
652 
653 	msg = devfs_msg_get();
654 	msg->mdv_flags.name = name;
655 	msg->mdv_flags.flag = flag;
656 	msg = devfs_msg_send_sync(DEVFS_CLR_SUBNAMES_FLAG, msg);
657 	devfs_msg_put(msg);
658 
659 	return 0;
660 }
661 
662 int
663 devfs_destroy_subnames_without_flag(char *name, uint32_t flag)
664 {
665 	devfs_msg_t msg;
666 
667 	msg = devfs_msg_get();
668 	msg->mdv_flags.name = name;
669 	msg->mdv_flags.flag = flag;
670 	msg = devfs_msg_send_sync(DEVFS_DESTROY_SUBNAMES_WO_FLAG, msg);
671 	devfs_msg_put(msg);
672 
673 	return 0;
674 }
675 
676 /*
677  * devfs_create_all_dev is the asynchronous entry point to trigger device
678  * node creation.  It just sends a message with the relevant details to
679  * the devfs core.
680  */
681 int
682 devfs_create_all_dev(struct devfs_node *root)
683 {
684 	devfs_msg_send_generic(DEVFS_CREATE_ALL_DEV, root);
685 	return 0;
686 }
687 
688 /*
689  * devfs_destroy_dev_by_ops is the asynchronous entry point to destroy all
690  * devices with a specific set of dev_ops and minor.  It just sends a
691  * message with the relevant details to the devfs core.
692  */
693 int
694 devfs_destroy_dev_by_ops(struct dev_ops *ops, int minor)
695 {
696 	devfs_msg_send_ops(DEVFS_DESTROY_DEV_BY_OPS, ops, minor);
697 	return 0;
698 }
699 
700 /*
701  * devfs_clone_handler_add is the synchronous entry point to add a new
702  * clone handler.  It just sends a message with the relevant details to
703  * the devfs core.
704  */
705 int
706 devfs_clone_handler_add(const char *name, d_clone_t *nhandler)
707 {
708 	devfs_msg_t msg;
709 
710 	msg = devfs_msg_get();
711 	msg->mdv_chandler.name = name;
712 	msg->mdv_chandler.nhandler = nhandler;
713 	msg = devfs_msg_send_sync(DEVFS_CHANDLER_ADD, msg);
714 	devfs_msg_put(msg);
715 	return 0;
716 }
717 
718 /*
719  * devfs_clone_handler_del is the synchronous entry point to remove a
720  * clone handler.  It just sends a message with the relevant details to
721  * the devfs core.
722  */
723 int
724 devfs_clone_handler_del(const char *name)
725 {
726 	devfs_msg_t msg;
727 
728 	msg = devfs_msg_get();
729 	msg->mdv_chandler.name = name;
730 	msg->mdv_chandler.nhandler = NULL;
731 	msg = devfs_msg_send_sync(DEVFS_CHANDLER_DEL, msg);
732 	devfs_msg_put(msg);
733 	return 0;
734 }
735 
736 /*
737  * devfs_find_device_by_name is the synchronous entry point to find a
738  * device given its name.  It sends a synchronous message with the
739  * relevant details to the devfs core and returns the answer.
740  */
741 cdev_t
742 devfs_find_device_by_name(const char *fmt, ...)
743 {
744 	cdev_t found = NULL;
745 	devfs_msg_t msg;
746 	char *target;
747 	__va_list ap;
748 
749 	if (fmt == NULL)
750 		return NULL;
751 
752 	__va_start(ap, fmt);
753 	kvasnrprintf(&target, PATH_MAX, 10, fmt, ap);
754 	__va_end(ap);
755 
756 	msg = devfs_msg_get();
757 	msg->mdv_name = target;
758 	msg = devfs_msg_send_sync(DEVFS_FIND_DEVICE_BY_NAME, msg);
759 	found = msg->mdv_cdev;
760 	devfs_msg_put(msg);
761 	kvasfree(&target);
762 
763 	return found;
764 }
765 
766 /*
767  * devfs_find_device_by_udev is the synchronous entry point to find a
768  * device given its udev number.  It sends a synchronous message with
769  * the relevant details to the devfs core and returns the answer.
770  */
771 cdev_t
772 devfs_find_device_by_udev(udev_t udev)
773 {
774 	cdev_t found = NULL;
775 	devfs_msg_t msg;
776 
777 	msg = devfs_msg_get();
778 	msg->mdv_udev = udev;
779 	msg = devfs_msg_send_sync(DEVFS_FIND_DEVICE_BY_UDEV, msg);
780 	found = msg->mdv_cdev;
781 	devfs_msg_put(msg);
782 
783 	devfs_debug(DEVFS_DEBUG_DEBUG,
784 		    "devfs_find_device_by_udev found? %s  -end:3-\n",
785 		    ((found) ? found->si_name:"NO"));
786 	return found;
787 }
788 
789 struct vnode *
790 devfs_inode_to_vnode(struct mount *mp, ino_t target)
791 {
792 	struct vnode *vp = NULL;
793 	devfs_msg_t msg;
794 
795 	if (mp == NULL)
796 		return NULL;
797 
798 	msg = devfs_msg_get();
799 	msg->mdv_ino.mp = mp;
800 	msg->mdv_ino.ino = target;
801 	msg = devfs_msg_send_sync(DEVFS_INODE_TO_VNODE, msg);
802 	vp = msg->mdv_ino.vp;
803 	vn_lock(vp, LK_EXCLUSIVE | LK_RETRY);
804 	devfs_msg_put(msg);
805 
806 	return vp;
807 }
808 
809 /*
810  * devfs_make_alias is the asynchronous entry point to register an alias
811  * for a device.  It just sends a message with the relevant details to the
812  * devfs core.
813  */
814 int
815 devfs_make_alias(const char *name, cdev_t dev_target)
816 {
817 	struct devfs_alias *alias;
818 	size_t len;
819 
820 	len = strlen(name);
821 
822 	alias = kmalloc(sizeof(struct devfs_alias), M_DEVFS, M_WAITOK);
823 	alias->name = kstrdup(name, M_DEVFS);
824 	alias->namlen = len;
825 	alias->dev_target = dev_target;
826 
827 	devfs_msg_send_generic(DEVFS_MAKE_ALIAS, alias);
828 	return 0;
829 }
830 
831 /*
832  * devfs_destroy_alias is the asynchronous entry point to deregister an alias
833  * for a device.  It just sends a message with the relevant details to the
834  * devfs core.
835  */
836 int
837 devfs_destroy_alias(const char *name, cdev_t dev_target)
838 {
839 	struct devfs_alias *alias;
840 	size_t len;
841 
842 	len = strlen(name);
843 
844 	alias = kmalloc(sizeof(struct devfs_alias), M_DEVFS, M_WAITOK);
845 	alias->name = kstrdup(name, M_DEVFS);
846 	alias->namlen = len;
847 	alias->dev_target = dev_target;
848 
849 	devfs_msg_send_generic(DEVFS_DESTROY_ALIAS, alias);
850 	return 0;
851 }
852 
853 /*
854  * devfs_apply_rules is the asynchronous entry point to trigger application
855  * of all rules.  It just sends a message with the relevant details to the
856  * devfs core.
857  */
858 int
859 devfs_apply_rules(char *mntto)
860 {
861 	char *new_name;
862 
863 	new_name = kstrdup(mntto, M_DEVFS);
864 	devfs_msg_send_name(DEVFS_APPLY_RULES, new_name);
865 
866 	return 0;
867 }
868 
869 /*
870  * devfs_reset_rules is the asynchronous entry point to trigger reset of all
871  * rules. It just sends a message with the relevant details to the devfs core.
872  */
873 int
874 devfs_reset_rules(char *mntto)
875 {
876 	char *new_name;
877 
878 	new_name = kstrdup(mntto, M_DEVFS);
879 	devfs_msg_send_name(DEVFS_RESET_RULES, new_name);
880 
881 	return 0;
882 }
883 
884 
885 /*
886  * devfs_scan_callback is the asynchronous entry point to call a callback
887  * on all cdevs.
888  * It just sends a message with the relevant details to the devfs core.
889  */
890 int
891 devfs_scan_callback(devfs_scan_t *callback, void *arg)
892 {
893 	devfs_msg_t msg;
894 
895 	KKASSERT(sizeof(callback) == sizeof(void *));
896 
897 	msg = devfs_msg_get();
898 	msg->mdv_load = callback;
899 	msg->mdv_load2 = arg;
900 	msg = devfs_msg_send_sync(DEVFS_SCAN_CALLBACK, msg);
901 	devfs_msg_put(msg);
902 
903 	return 0;
904 }
905 
906 
907 /*
908  * Acts as a message drain. Any message that is replied to here gets destroyed
909  * and the memory freed.
910  */
911 static void
912 devfs_msg_autofree_reply(lwkt_port_t port, lwkt_msg_t msg)
913 {
914 	devfs_msg_put((devfs_msg_t)msg);
915 }
916 
917 /*
918  * devfs_msg_get allocates a new devfs msg and returns it.
919  */
920 devfs_msg_t
921 devfs_msg_get(void)
922 {
923 	return objcache_get(devfs_msg_cache, M_WAITOK);
924 }
925 
926 /*
927  * devfs_msg_put deallocates a given devfs msg.
928  */
929 int
930 devfs_msg_put(devfs_msg_t msg)
931 {
932 	objcache_put(devfs_msg_cache, msg);
933 	return 0;
934 }
935 
936 /*
937  * devfs_msg_send is the generic asynchronous message sending facility
938  * for devfs. By default the reply port is the automatic disposal port.
939  *
940  * If the current thread is the devfs_msg_port thread we execute the
941  * operation synchronously.
942  */
943 void
944 devfs_msg_send(uint32_t cmd, devfs_msg_t devfs_msg)
945 {
946 	lwkt_port_t port = &devfs_msg_port;
947 
948 	lwkt_initmsg(&devfs_msg->hdr, &devfs_dispose_port, 0);
949 
950 	devfs_msg->hdr.u.ms_result = cmd;
951 
952 	if (port->mpu_td == curthread) {
953 		devfs_msg_exec(devfs_msg);
954 		lwkt_replymsg(&devfs_msg->hdr, 0);
955 	} else {
956 		lwkt_sendmsg(port, (lwkt_msg_t)devfs_msg);
957 	}
958 }
959 
960 /*
961  * devfs_msg_send_sync is the generic synchronous message sending
962  * facility for devfs. It initializes a local reply port and waits
963  * for the core's answer. This answer is then returned.
964  */
965 devfs_msg_t
966 devfs_msg_send_sync(uint32_t cmd, devfs_msg_t devfs_msg)
967 {
968 	struct lwkt_port rep_port;
969 	devfs_msg_t	msg_incoming;
970 	lwkt_port_t port = &devfs_msg_port;
971 
972 	lwkt_initport_thread(&rep_port, curthread);
973 	lwkt_initmsg(&devfs_msg->hdr, &rep_port, 0);
974 
975 	devfs_msg->hdr.u.ms_result = cmd;
976 
977 	lwkt_sendmsg(port, (lwkt_msg_t)devfs_msg);
978 	msg_incoming = lwkt_waitport(&rep_port, 0);
979 
980 	return msg_incoming;
981 }
982 
983 /*
984  * sends a message with a generic argument.
985  */
986 void
987 devfs_msg_send_generic(uint32_t cmd, void *load)
988 {
989 	devfs_msg_t devfs_msg = devfs_msg_get();
990 
991 	devfs_msg->mdv_load = load;
992 	devfs_msg_send(cmd, devfs_msg);
993 }
994 
995 /*
996  * sends a message with a name argument.
997  */
998 void
999 devfs_msg_send_name(uint32_t cmd, char *name)
1000 {
1001 	devfs_msg_t devfs_msg = devfs_msg_get();
1002 
1003 	devfs_msg->mdv_name = name;
1004 	devfs_msg_send(cmd, devfs_msg);
1005 }
1006 
1007 /*
1008  * sends a message with a mount argument.
1009  */
1010 void
1011 devfs_msg_send_mount(uint32_t cmd, struct devfs_mnt_data *mnt)
1012 {
1013 	devfs_msg_t devfs_msg = devfs_msg_get();
1014 
1015 	devfs_msg->mdv_mnt = mnt;
1016 	devfs_msg_send(cmd, devfs_msg);
1017 }
1018 
1019 /*
1020  * sends a message with an ops argument.
1021  */
1022 void
1023 devfs_msg_send_ops(uint32_t cmd, struct dev_ops *ops, int minor)
1024 {
1025 	devfs_msg_t devfs_msg = devfs_msg_get();
1026 
1027 	devfs_msg->mdv_ops.ops = ops;
1028 	devfs_msg->mdv_ops.minor = minor;
1029 	devfs_msg_send(cmd, devfs_msg);
1030 }
1031 
1032 /*
1033  * sends a message with a clone handler argument.
1034  */
1035 void
1036 devfs_msg_send_chandler(uint32_t cmd, char *name, d_clone_t handler)
1037 {
1038 	devfs_msg_t devfs_msg = devfs_msg_get();
1039 
1040 	devfs_msg->mdv_chandler.name = name;
1041 	devfs_msg->mdv_chandler.nhandler = handler;
1042 	devfs_msg_send(cmd, devfs_msg);
1043 }
1044 
1045 /*
1046  * sends a message with a device argument.
1047  */
1048 void
1049 devfs_msg_send_dev(uint32_t cmd, cdev_t dev, uid_t uid, gid_t gid, int perms)
1050 {
1051 	devfs_msg_t devfs_msg = devfs_msg_get();
1052 
1053 	devfs_msg->mdv_dev.dev = dev;
1054 	devfs_msg->mdv_dev.uid = uid;
1055 	devfs_msg->mdv_dev.gid = gid;
1056 	devfs_msg->mdv_dev.perms = perms;
1057 
1058 	devfs_msg_send(cmd, devfs_msg);
1059 }
1060 
1061 /*
1062  * sends a message with a link argument.
1063  */
1064 void
1065 devfs_msg_send_link(uint32_t cmd, char *name, char *target, struct mount *mp)
1066 {
1067 	devfs_msg_t devfs_msg = devfs_msg_get();
1068 
1069 	devfs_msg->mdv_link.name = name;
1070 	devfs_msg->mdv_link.target = target;
1071 	devfs_msg->mdv_link.mp = mp;
1072 	devfs_msg_send(cmd, devfs_msg);
1073 }
1074 
1075 /*
1076  * devfs_msg_core is the main devfs thread. It handles all incoming messages
1077  * and calls the relevant worker functions. By using messages it's assured
1078  * that events occur in the correct order.
1079  */
1080 static void
1081 devfs_msg_core(void *arg)
1082 {
1083 	devfs_msg_t msg;
1084 
1085 	lwkt_initport_thread(&devfs_msg_port, curthread);
1086 
1087 	lockmgr(&devfs_lock, LK_EXCLUSIVE);
1088 	devfs_run = 1;
1089 	wakeup(td_core);
1090 	lockmgr(&devfs_lock, LK_RELEASE);
1091 
1092 	get_mplock();	/* mpsafe yet? */
1093 
1094 	while (devfs_run) {
1095 		msg = (devfs_msg_t)lwkt_waitport(&devfs_msg_port, 0);
1096 		devfs_debug(DEVFS_DEBUG_DEBUG,
1097 				"devfs_msg_core, new msg: %x\n",
1098 				(unsigned int)msg->hdr.u.ms_result);
1099 		devfs_msg_exec(msg);
1100 		lwkt_replymsg(&msg->hdr, 0);
1101 	}
1102 
1103 	rel_mplock();
1104 	wakeup(td_core);
1105 
1106 	lwkt_exit();
1107 }
1108 
1109 static void
1110 devfs_msg_exec(devfs_msg_t msg)
1111 {
1112 	struct devfs_mnt_data *mnt;
1113 	struct devfs_node *node;
1114 	cdev_t	dev;
1115 
1116 	/*
1117 	 * Acquire the devfs lock to ensure safety of all called functions
1118 	 */
1119 	lockmgr(&devfs_lock, LK_EXCLUSIVE);
1120 
1121 	switch (msg->hdr.u.ms_result) {
1122 	case DEVFS_DEVICE_CREATE:
1123 		dev = msg->mdv_dev.dev;
1124 		devfs_create_dev_worker(dev,
1125 					msg->mdv_dev.uid,
1126 					msg->mdv_dev.gid,
1127 					msg->mdv_dev.perms);
1128 		break;
1129 	case DEVFS_DEVICE_DESTROY:
1130 		dev = msg->mdv_dev.dev;
1131 		devfs_destroy_dev_worker(dev);
1132 		break;
1133 	case DEVFS_DESTROY_SUBNAMES:
1134 		devfs_destroy_subnames_worker(msg->mdv_load);
1135 		break;
1136 	case DEVFS_DESTROY_DEV_BY_OPS:
1137 		devfs_destroy_dev_by_ops_worker(msg->mdv_ops.ops,
1138 						msg->mdv_ops.minor);
1139 		break;
1140 	case DEVFS_CREATE_ALL_DEV:
1141 		node = (struct devfs_node *)msg->mdv_load;
1142 		devfs_create_all_dev_worker(node);
1143 		break;
1144 	case DEVFS_MOUNT_ADD:
1145 		mnt = msg->mdv_mnt;
1146 		TAILQ_INSERT_TAIL(&devfs_mnt_list, mnt, link);
1147 		devfs_create_all_dev_worker(mnt->root_node);
1148 		break;
1149 	case DEVFS_MOUNT_DEL:
1150 		mnt = msg->mdv_mnt;
1151 		TAILQ_REMOVE(&devfs_mnt_list, mnt, link);
1152 		devfs_iterate_topology(mnt->root_node, devfs_reaperp_callback,
1153 				       NULL);
1154 		if (mnt->leak_count) {
1155 			devfs_debug(DEVFS_DEBUG_SHOW,
1156 				    "Leaked %ld devfs_node elements!\n",
1157 				    mnt->leak_count);
1158 		}
1159 		break;
1160 	case DEVFS_CHANDLER_ADD:
1161 		devfs_chandler_add_worker(msg->mdv_chandler.name,
1162 				msg->mdv_chandler.nhandler);
1163 		break;
1164 	case DEVFS_CHANDLER_DEL:
1165 		devfs_chandler_del_worker(msg->mdv_chandler.name);
1166 		break;
1167 	case DEVFS_FIND_DEVICE_BY_NAME:
1168 		devfs_find_device_by_name_worker(msg);
1169 		break;
1170 	case DEVFS_FIND_DEVICE_BY_UDEV:
1171 		devfs_find_device_by_udev_worker(msg);
1172 		break;
1173 	case DEVFS_MAKE_ALIAS:
1174 		devfs_make_alias_worker((struct devfs_alias *)msg->mdv_load);
1175 		break;
1176 	case DEVFS_DESTROY_ALIAS:
1177 		devfs_destroy_alias_worker((struct devfs_alias *)msg->mdv_load);
1178 		break;
1179 	case DEVFS_APPLY_RULES:
1180 		devfs_apply_reset_rules_caller(msg->mdv_name, 1);
1181 		break;
1182 	case DEVFS_RESET_RULES:
1183 		devfs_apply_reset_rules_caller(msg->mdv_name, 0);
1184 		break;
1185 	case DEVFS_SCAN_CALLBACK:
1186 		devfs_scan_callback_worker((devfs_scan_t *)msg->mdv_load,
1187 			msg->mdv_load2);
1188 		break;
1189 	case DEVFS_CLR_SUBNAMES_FLAG:
1190 		devfs_clr_subnames_flag_worker(msg->mdv_flags.name,
1191 				msg->mdv_flags.flag);
1192 		break;
1193 	case DEVFS_DESTROY_SUBNAMES_WO_FLAG:
1194 		devfs_destroy_subnames_without_flag_worker(msg->mdv_flags.name,
1195 				msg->mdv_flags.flag);
1196 		break;
1197 	case DEVFS_INODE_TO_VNODE:
1198 		msg->mdv_ino.vp = devfs_iterate_topology(
1199 			DEVFS_MNTDATA(msg->mdv_ino.mp)->root_node,
1200 			(devfs_iterate_callback_t *)devfs_inode_to_vnode_worker_callback,
1201 			&msg->mdv_ino.ino);
1202 		break;
1203 	case DEVFS_TERMINATE_CORE:
1204 		devfs_run = 0;
1205 		break;
1206 	case DEVFS_SYNC:
1207 		break;
1208 	default:
1209 		devfs_debug(DEVFS_DEBUG_WARNING,
1210 			    "devfs_msg_core: unknown message "
1211 			    "received at core\n");
1212 		break;
1213 	}
1214 	lockmgr(&devfs_lock, LK_RELEASE);
1215 }
1216 
1217 /*
1218  * Worker function to insert a new dev into the dev list and initialize its
1219  * permissions. It also calls devfs_propagate_dev which in turn propagates
1220  * the change to all mount points.
1221  *
1222  * The passed dev is already referenced.  This reference is eaten by this
1223  * function and represents the dev's linkage into devfs_dev_list.
1224  */
1225 static int
1226 devfs_create_dev_worker(cdev_t dev, uid_t uid, gid_t gid, int perms)
1227 {
1228 	KKASSERT(dev);
1229 
1230 	dev->si_uid = uid;
1231 	dev->si_gid = gid;
1232 	dev->si_perms = perms;
1233 
1234 	devfs_link_dev(dev);
1235 	devfs_propagate_dev(dev, 1);
1236 
1237 	udev_event_attach(dev, NULL, 0);
1238 
1239 	return 0;
1240 }
1241 
1242 /*
1243  * Worker function to delete a dev from the dev list and free the cdev.
1244  * It also calls devfs_propagate_dev which in turn propagates the change
1245  * to all mount points.
1246  */
1247 static int
1248 devfs_destroy_dev_worker(cdev_t dev)
1249 {
1250 	int error;
1251 
1252 	KKASSERT(dev);
1253 	KKASSERT((lockstatus(&devfs_lock, curthread)) == LK_EXCLUSIVE);
1254 
1255 	error = devfs_unlink_dev(dev);
1256 	devfs_propagate_dev(dev, 0);
1257 
1258 	udev_event_detach(dev, NULL, 0);
1259 
1260 	if (error == 0)
1261 		release_dev(dev);	/* link ref */
1262 	release_dev(dev);
1263 	release_dev(dev);
1264 
1265 	return 0;
1266 }
1267 
1268 /*
1269  * Worker function to destroy all devices with a certain basename.
1270  * Calls devfs_destroy_dev_worker for the actual destruction.
1271  */
1272 static int
1273 devfs_destroy_subnames_worker(char *name)
1274 {
1275 	cdev_t dev, dev1;
1276 	size_t len = strlen(name);
1277 
1278 	TAILQ_FOREACH_MUTABLE(dev, &devfs_dev_list, link, dev1) {
1279 		if ((!strncmp(dev->si_name, name, len)) &&
1280 				(dev->si_name[len] != '\0')) {
1281 			devfs_destroy_dev_worker(dev);
1282 		}
1283 	}
1284 	return 0;
1285 }
1286 
1287 static int
1288 devfs_clr_subnames_flag_worker(char *name, uint32_t flag)
1289 {
1290 	cdev_t dev, dev1;
1291 	size_t len = strlen(name);
1292 
1293 	TAILQ_FOREACH_MUTABLE(dev, &devfs_dev_list, link, dev1) {
1294 		if ((!strncmp(dev->si_name, name, len)) &&
1295 				(dev->si_name[len] != '\0')) {
1296 			dev->si_flags &= ~flag;
1297 		}
1298 	}
1299 
1300 	return 0;
1301 }
1302 
1303 static int
1304 devfs_destroy_subnames_without_flag_worker(char *name, uint32_t flag)
1305 {
1306 	cdev_t dev, dev1;
1307 	size_t len = strlen(name);
1308 
1309 	TAILQ_FOREACH_MUTABLE(dev, &devfs_dev_list, link, dev1) {
1310 		if ((!strncmp(dev->si_name, name, len)) &&
1311 				(dev->si_name[len] != '\0')) {
1312 			if (!(dev->si_flags & flag)) {
1313 				devfs_destroy_dev_worker(dev);
1314 			}
1315 		}
1316 	}
1317 
1318 	return 0;
1319 }
1320 
1321 /*
1322  * Worker function that creates all device nodes on top of a devfs
1323  * root node.
1324  */
1325 static int
1326 devfs_create_all_dev_worker(struct devfs_node *root)
1327 {
1328 	cdev_t dev;
1329 
1330 	KKASSERT(root);
1331 
1332 	TAILQ_FOREACH(dev, &devfs_dev_list, link) {
1333 		devfs_create_device_node(root, dev, NULL, NULL);
1334 	}
1335 
1336 	return 0;
1337 }
1338 
1339 /*
1340  * Worker function that destroys all devices that match a specific
1341  * dev_ops and/or minor. If minor is less than 0, it is not matched
1342  * against. It also propagates all changes.
1343  */
1344 static int
1345 devfs_destroy_dev_by_ops_worker(struct dev_ops *ops, int minor)
1346 {
1347 	cdev_t dev, dev1;
1348 
1349 	KKASSERT(ops);
1350 
1351 	TAILQ_FOREACH_MUTABLE(dev, &devfs_dev_list, link, dev1) {
1352 		if (dev->si_ops != ops)
1353 			continue;
1354 		if ((minor < 0) || (dev->si_uminor == minor)) {
1355 			devfs_destroy_dev_worker(dev);
1356 		}
1357 	}
1358 
1359 	return 0;
1360 }
1361 
1362 /*
1363  * Worker function that registers a new clone handler in devfs.
1364  */
1365 static int
1366 devfs_chandler_add_worker(const char *name, d_clone_t *nhandler)
1367 {
1368 	struct devfs_clone_handler *chandler = NULL;
1369 	u_char len = strlen(name);
1370 
1371 	if (len == 0)
1372 		return 1;
1373 
1374 	TAILQ_FOREACH(chandler, &devfs_chandler_list, link) {
1375 		if (chandler->namlen != len)
1376 			continue;
1377 
1378 		if (!memcmp(chandler->name, name, len)) {
1379 			/* Clonable basename already exists */
1380 			return 1;
1381 		}
1382 	}
1383 
1384 	chandler = kmalloc(sizeof(*chandler), M_DEVFS, M_WAITOK | M_ZERO);
1385 	chandler->name = kstrdup(name, M_DEVFS);
1386 	chandler->namlen = len;
1387 	chandler->nhandler = nhandler;
1388 
1389 	TAILQ_INSERT_TAIL(&devfs_chandler_list, chandler, link);
1390 	return 0;
1391 }
1392 
1393 /*
1394  * Worker function that removes a given clone handler from the
1395  * clone handler list.
1396  */
1397 static int
1398 devfs_chandler_del_worker(const char *name)
1399 {
1400 	struct devfs_clone_handler *chandler, *chandler2;
1401 	u_char len = strlen(name);
1402 
1403 	if (len == 0)
1404 		return 1;
1405 
1406 	TAILQ_FOREACH_MUTABLE(chandler, &devfs_chandler_list, link, chandler2) {
1407 		if (chandler->namlen != len)
1408 			continue;
1409 		if (memcmp(chandler->name, name, len))
1410 			continue;
1411 
1412 		TAILQ_REMOVE(&devfs_chandler_list, chandler, link);
1413 		kfree(chandler->name, M_DEVFS);
1414 		kfree(chandler, M_DEVFS);
1415 		break;
1416 	}
1417 
1418 	return 0;
1419 }
1420 
1421 /*
1422  * Worker function that finds a given device name and changes
1423  * the message received accordingly so that when replied to,
1424  * the answer is returned to the caller.
1425  */
1426 static int
1427 devfs_find_device_by_name_worker(devfs_msg_t devfs_msg)
1428 {
1429 	struct devfs_alias *alias;
1430 	cdev_t dev;
1431 	cdev_t found = NULL;
1432 
1433 	TAILQ_FOREACH(dev, &devfs_dev_list, link) {
1434 		if (strcmp(devfs_msg->mdv_name, dev->si_name) == 0) {
1435 			found = dev;
1436 			break;
1437 		}
1438 	}
1439 	if (found == NULL) {
1440 		TAILQ_FOREACH(alias, &devfs_alias_list, link) {
1441 			if (strcmp(devfs_msg->mdv_name, alias->name) == 0) {
1442 				found = alias->dev_target;
1443 				break;
1444 			}
1445 		}
1446 	}
1447 	devfs_msg->mdv_cdev = found;
1448 
1449 	return 0;
1450 }
1451 
1452 /*
1453  * Worker function that finds a given device udev and changes
1454  * the message received accordingly so that when replied to,
1455  * the answer is returned to the caller.
1456  */
1457 static int
1458 devfs_find_device_by_udev_worker(devfs_msg_t devfs_msg)
1459 {
1460 	cdev_t dev, dev1;
1461 	cdev_t found = NULL;
1462 
1463 	TAILQ_FOREACH_MUTABLE(dev, &devfs_dev_list, link, dev1) {
1464 		if (((udev_t)dev->si_inode) == devfs_msg->mdv_udev) {
1465 			found = dev;
1466 			break;
1467 		}
1468 	}
1469 	devfs_msg->mdv_cdev = found;
1470 
1471 	return 0;
1472 }
1473 
1474 /*
1475  * Worker function that inserts a given alias into the
1476  * alias list, and propagates the alias to all mount
1477  * points.
1478  */
1479 static int
1480 devfs_make_alias_worker(struct devfs_alias *alias)
1481 {
1482 	struct devfs_alias *alias2;
1483 	size_t len = strlen(alias->name);
1484 	int found = 0;
1485 
1486 	TAILQ_FOREACH(alias2, &devfs_alias_list, link) {
1487 		if (len != alias2->namlen)
1488 			continue;
1489 
1490 		if (!memcmp(alias->name, alias2->name, len)) {
1491 			found = 1;
1492 			break;
1493 		}
1494 	}
1495 
1496 	if (!found) {
1497 		/*
1498 		 * The alias doesn't exist yet, so we add it to the alias list
1499 		 */
1500 		TAILQ_INSERT_TAIL(&devfs_alias_list, alias, link);
1501 		devfs_alias_propagate(alias, 0);
1502 		udev_event_attach(alias->dev_target, alias->name, 1);
1503 	} else {
1504 		devfs_debug(DEVFS_DEBUG_WARNING,
1505 			    "Warning: duplicate devfs_make_alias for %s\n",
1506 			    alias->name);
1507 		kfree(alias->name, M_DEVFS);
1508 		kfree(alias, M_DEVFS);
1509 	}
1510 
1511 	return 0;
1512 }
1513 
1514 /*
1515  * Worker function that delete a given alias from the
1516  * alias list, and propagates the removal to all mount
1517  * points.
1518  */
1519 static int
1520 devfs_destroy_alias_worker(struct devfs_alias *alias)
1521 {
1522 	struct devfs_alias *alias2;
1523 	int found = 0;
1524 
1525 	TAILQ_FOREACH(alias2, &devfs_alias_list, link) {
1526 		if (alias->dev_target != alias2->dev_target)
1527 			continue;
1528 
1529 		if (devfs_WildCmp(alias->name, alias2->name) == 0) {
1530 			found = 1;
1531 			break;
1532 		}
1533 	}
1534 
1535 	if (!found) {
1536 		devfs_debug(DEVFS_DEBUG_WARNING,
1537 		    "Warning: devfs_destroy_alias for inexistant alias: %s\n",
1538 		    alias->name);
1539 		kfree(alias->name, M_DEVFS);
1540 		kfree(alias, M_DEVFS);
1541 	} else {
1542 		/*
1543 		 * The alias exists, so we delete it from the alias list
1544 		 */
1545 		TAILQ_REMOVE(&devfs_alias_list, alias2, link);
1546 		devfs_alias_propagate(alias2, 1);
1547 		udev_event_detach(alias2->dev_target, alias2->name, 1);
1548 		kfree(alias->name, M_DEVFS);
1549 		kfree(alias, M_DEVFS);
1550 		kfree(alias2->name, M_DEVFS);
1551 		kfree(alias2, M_DEVFS);
1552 	}
1553 
1554 	return 0;
1555 }
1556 
1557 /*
1558  * Function that removes and frees all aliases.
1559  */
1560 static int
1561 devfs_alias_reap(void)
1562 {
1563 	struct devfs_alias *alias, *alias2;
1564 
1565 	TAILQ_FOREACH_MUTABLE(alias, &devfs_alias_list, link, alias2) {
1566 		TAILQ_REMOVE(&devfs_alias_list, alias, link);
1567 		kfree(alias->name, M_DEVFS);
1568 		kfree(alias, M_DEVFS);
1569 	}
1570 	return 0;
1571 }
1572 
1573 /*
1574  * Function that removes an alias matching a specific cdev and frees
1575  * it accordingly.
1576  */
1577 static int
1578 devfs_alias_remove(cdev_t dev)
1579 {
1580 	struct devfs_alias *alias, *alias2;
1581 
1582 	TAILQ_FOREACH_MUTABLE(alias, &devfs_alias_list, link, alias2) {
1583 		if (alias->dev_target == dev) {
1584 			TAILQ_REMOVE(&devfs_alias_list, alias, link);
1585 			udev_event_detach(alias->dev_target, alias->name, 1);
1586 			kfree(alias->name, M_DEVFS);
1587 			kfree(alias, M_DEVFS);
1588 		}
1589 	}
1590 	return 0;
1591 }
1592 
1593 /*
1594  * This function propagates an alias addition or removal to
1595  * all mount points.
1596  */
1597 static int
1598 devfs_alias_propagate(struct devfs_alias *alias, int remove)
1599 {
1600 	struct devfs_mnt_data *mnt;
1601 
1602 	TAILQ_FOREACH(mnt, &devfs_mnt_list, link) {
1603 		if (remove) {
1604 			devfs_destroy_node(mnt->root_node, alias->name);
1605 		} else {
1606 			devfs_alias_apply(mnt->root_node, alias);
1607 		}
1608 	}
1609 	return 0;
1610 }
1611 
1612 /*
1613  * This function is a recursive function iterating through
1614  * all device nodes in the topology and, if applicable,
1615  * creating the relevant alias for a device node.
1616  */
1617 static int
1618 devfs_alias_apply(struct devfs_node *node, struct devfs_alias *alias)
1619 {
1620 	struct devfs_node *node1, *node2;
1621 
1622 	KKASSERT(alias != NULL);
1623 
1624 	if ((node->node_type == Proot) || (node->node_type == Pdir)) {
1625 		if (node->nchildren > 2) {
1626 			TAILQ_FOREACH_MUTABLE(node1, DEVFS_DENODE_HEAD(node), link, node2) {
1627 				devfs_alias_apply(node1, alias);
1628 			}
1629 		}
1630 	} else {
1631 		if (node->d_dev == alias->dev_target)
1632 			devfs_alias_create(alias->name, node, 0);
1633 	}
1634 	return 0;
1635 }
1636 
1637 /*
1638  * This function checks if any alias possibly is applicable
1639  * to the given node. If so, the alias is created.
1640  */
1641 static int
1642 devfs_alias_check_create(struct devfs_node *node)
1643 {
1644 	struct devfs_alias *alias;
1645 
1646 	TAILQ_FOREACH(alias, &devfs_alias_list, link) {
1647 		if (node->d_dev == alias->dev_target)
1648 			devfs_alias_create(alias->name, node, 0);
1649 	}
1650 	return 0;
1651 }
1652 
1653 /*
1654  * This function creates an alias with a given name
1655  * linking to a given devfs node. It also increments
1656  * the link count on the target node.
1657  */
1658 int
1659 devfs_alias_create(char *name_orig, struct devfs_node *target, int rule_based)
1660 {
1661 	struct mount *mp = target->mp;
1662 	struct devfs_node *parent = DEVFS_MNTDATA(mp)->root_node;
1663 	struct devfs_node *linknode;
1664 	char *create_path = NULL;
1665 	char *name;
1666 	char *name_buf;
1667 	int result = 0;
1668 
1669 	KKASSERT((lockstatus(&devfs_lock, curthread)) == LK_EXCLUSIVE);
1670 
1671 	name_buf = kmalloc(PATH_MAX, M_TEMP, M_WAITOK);
1672 	devfs_resolve_name_path(name_orig, name_buf, &create_path, &name);
1673 
1674 	if (create_path)
1675 		parent = devfs_resolve_or_create_path(parent, create_path, 1);
1676 
1677 
1678 	if (devfs_find_device_node_by_name(parent, name)) {
1679 		devfs_debug(DEVFS_DEBUG_WARNING,
1680 			    "Node already exists: %s "
1681 			    "(devfs_make_alias_worker)!\n",
1682 			    name);
1683 		result = 1;
1684 		goto done;
1685 	}
1686 
1687 	linknode = devfs_allocp(Plink, name, parent, mp, NULL);
1688 	if (linknode == NULL) {
1689 		result = 1;
1690 		goto done;
1691 	}
1692 
1693 	linknode->link_target = target;
1694 	target->nlinks++;
1695 
1696 	if (rule_based)
1697 		linknode->flags |= DEVFS_RULE_CREATED;
1698 
1699 done:
1700 	kfree(name_buf, M_TEMP);
1701 	return (result);
1702 }
1703 
1704 /*
1705  * This function is called by the core and handles mount point
1706  * strings. It either calls the relevant worker (devfs_apply_
1707  * reset_rules_worker) on all mountpoints or only a specific
1708  * one.
1709  */
1710 static int
1711 devfs_apply_reset_rules_caller(char *mountto, int apply)
1712 {
1713 	struct devfs_mnt_data *mnt;
1714 
1715 	if (mountto[0] == '*') {
1716 		TAILQ_FOREACH(mnt, &devfs_mnt_list, link) {
1717 			devfs_iterate_topology(mnt->root_node,
1718 					(apply)?(devfs_rule_check_apply):(devfs_rule_reset_node),
1719 					NULL);
1720 		}
1721 	} else {
1722 		TAILQ_FOREACH(mnt, &devfs_mnt_list, link) {
1723 			if (!strcmp(mnt->mp->mnt_stat.f_mntonname, mountto)) {
1724 				devfs_iterate_topology(mnt->root_node,
1725 					(apply)?(devfs_rule_check_apply):(devfs_rule_reset_node),
1726 					NULL);
1727 				break;
1728 			}
1729 		}
1730 	}
1731 
1732 	kfree(mountto, M_DEVFS);
1733 	return 0;
1734 }
1735 
1736 /*
1737  * This function calls a given callback function for
1738  * every dev node in the devfs dev list.
1739  */
1740 static int
1741 devfs_scan_callback_worker(devfs_scan_t *callback, void *arg)
1742 {
1743 	cdev_t dev, dev1;
1744 
1745 	TAILQ_FOREACH_MUTABLE(dev, &devfs_dev_list, link, dev1) {
1746 		callback(dev, arg);
1747 	}
1748 
1749 	return 0;
1750 }
1751 
1752 /*
1753  * This function tries to resolve a given directory, or if not
1754  * found and creation requested, creates the given directory.
1755  */
1756 static struct devfs_node *
1757 devfs_resolve_or_create_dir(struct devfs_node *parent, char *dir_name,
1758 			    size_t name_len, int create)
1759 {
1760 	struct devfs_node *node, *found = NULL;
1761 
1762 	TAILQ_FOREACH(node, DEVFS_DENODE_HEAD(parent), link) {
1763 		if (name_len != node->d_dir.d_namlen)
1764 			continue;
1765 
1766 		if (!memcmp(dir_name, node->d_dir.d_name, name_len)) {
1767 			found = node;
1768 			break;
1769 		}
1770 	}
1771 
1772 	if ((found == NULL) && (create)) {
1773 		found = devfs_allocp(Pdir, dir_name, parent, parent->mp, NULL);
1774 	}
1775 
1776 	return found;
1777 }
1778 
1779 /*
1780  * This function tries to resolve a complete path. If creation is requested,
1781  * if a given part of the path cannot be resolved (because it doesn't exist),
1782  * it is created.
1783  */
1784 struct devfs_node *
1785 devfs_resolve_or_create_path(struct devfs_node *parent, char *path, int create)
1786 {
1787 	struct devfs_node *node = parent;
1788 	char *buf;
1789 	size_t idx = 0;
1790 
1791 	if (path == NULL)
1792 		return parent;
1793 
1794 	buf = kmalloc(PATH_MAX, M_TEMP, M_WAITOK);
1795 
1796 	while (*path && idx < PATH_MAX - 1) {
1797 		if (*path != '/') {
1798 			buf[idx++] = *path;
1799 		} else {
1800 			buf[idx] = '\0';
1801 			node = devfs_resolve_or_create_dir(node, buf, idx, create);
1802 			if (node == NULL) {
1803 				kfree(buf, M_TEMP);
1804 				return NULL;
1805 			}
1806 			idx = 0;
1807 		}
1808 		++path;
1809 	}
1810 	buf[idx] = '\0';
1811 	node = devfs_resolve_or_create_dir(node, buf, idx, create);
1812 	kfree (buf, M_TEMP);
1813 	return (node);
1814 }
1815 
1816 /*
1817  * Takes a full path and strips it into a directory path and a name.
1818  * For a/b/c/foo, it returns foo in namep and a/b/c in pathp. It
1819  * requires a working buffer with enough size to keep the whole
1820  * fullpath.
1821  */
1822 int
1823 devfs_resolve_name_path(char *fullpath, char *buf, char **pathp, char **namep)
1824 {
1825 	char *name = NULL;
1826 	char *path = NULL;
1827 	size_t len = strlen(fullpath) + 1;
1828 	int i;
1829 
1830 	KKASSERT((fullpath != NULL) && (buf != NULL));
1831 	KKASSERT((pathp != NULL) && (namep != NULL));
1832 
1833 	memcpy(buf, fullpath, len);
1834 
1835 	for (i = len-1; i>= 0; i--) {
1836 		if (buf[i] == '/') {
1837 			buf[i] = '\0';
1838 			name = &(buf[i+1]);
1839 			path = buf;
1840 			break;
1841 		}
1842 	}
1843 
1844 	*pathp = path;
1845 
1846 	if (name) {
1847 		*namep = name;
1848 	} else {
1849 		*namep = buf;
1850 	}
1851 
1852 	return 0;
1853 }
1854 
1855 /*
1856  * This function creates a new devfs node for a given device.  It can
1857  * handle a complete path as device name, and accordingly creates
1858  * the path and the final device node.
1859  *
1860  * The reference count on the passed dev remains unchanged.
1861  */
1862 struct devfs_node *
1863 devfs_create_device_node(struct devfs_node *root, cdev_t dev,
1864 			 char *dev_name, char *path_fmt, ...)
1865 {
1866 	struct devfs_node *parent, *node = NULL;
1867 	char *path = NULL;
1868 	char *name;
1869 	char *name_buf;
1870 	__va_list ap;
1871 	int i, found;
1872 	char *create_path = NULL;
1873 	char *names = "pqrsPQRS";
1874 
1875 	name_buf = kmalloc(PATH_MAX, M_TEMP, M_WAITOK);
1876 
1877 	if (path_fmt != NULL) {
1878 		__va_start(ap, path_fmt);
1879 		kvasnrprintf(&path, PATH_MAX, 10, path_fmt, ap);
1880 		__va_end(ap);
1881 	}
1882 
1883 	parent = devfs_resolve_or_create_path(root, path, 1);
1884 	KKASSERT(parent);
1885 
1886 	devfs_resolve_name_path(
1887 			((dev_name == NULL) && (dev))?(dev->si_name):(dev_name),
1888 			name_buf, &create_path, &name);
1889 
1890 	if (create_path)
1891 		parent = devfs_resolve_or_create_path(parent, create_path, 1);
1892 
1893 
1894 	if (devfs_find_device_node_by_name(parent, name)) {
1895 		devfs_debug(DEVFS_DEBUG_WARNING, "devfs_create_device_node: "
1896 			"DEVICE %s ALREADY EXISTS!!! Ignoring creation request.\n", name);
1897 		goto out;
1898 	}
1899 
1900 	node = devfs_allocp(Pdev, name, parent, parent->mp, dev);
1901 	nanotime(&parent->mtime);
1902 
1903 	/*
1904 	 * Ugly unix98 pty magic, to hide pty master (ptm) devices and their
1905 	 * directory
1906 	 */
1907 	if ((dev) && (strlen(dev->si_name) >= 4) &&
1908 			(!memcmp(dev->si_name, "ptm/", 4))) {
1909 		node->parent->flags |= DEVFS_HIDDEN;
1910 		node->flags |= DEVFS_HIDDEN;
1911 	}
1912 
1913 	/*
1914 	 * Ugly pty magic, to tag pty devices as such and hide them if needed.
1915 	 */
1916 	if ((strlen(name) >= 3) && (!memcmp(name, "pty", 3)))
1917 		node->flags |= (DEVFS_PTY | DEVFS_INVISIBLE);
1918 
1919 	if ((strlen(name) >= 3) && (!memcmp(name, "tty", 3))) {
1920 		found = 0;
1921 		for (i = 0; i < strlen(names); i++) {
1922 			if (name[3] == names[i]) {
1923 				found = 1;
1924 				break;
1925 			}
1926 		}
1927 		if (found)
1928 			node->flags |= (DEVFS_PTY | DEVFS_INVISIBLE);
1929 	}
1930 
1931 out:
1932 	kfree(name_buf, M_TEMP);
1933 	kvasfree(&path);
1934 	return node;
1935 }
1936 
1937 /*
1938  * This function finds a given device node in the topology with a given
1939  * cdev.
1940  */
1941 void *
1942 devfs_find_device_node_callback(struct devfs_node *node, cdev_t target)
1943 {
1944 	if ((node->node_type == Pdev) && (node->d_dev == target)) {
1945 		return node;
1946 	}
1947 
1948 	return NULL;
1949 }
1950 
1951 /*
1952  * This function finds a device node in the given parent directory by its
1953  * name and returns it.
1954  */
1955 struct devfs_node *
1956 devfs_find_device_node_by_name(struct devfs_node *parent, char *target)
1957 {
1958 	struct devfs_node *node, *found = NULL;
1959 	size_t len = strlen(target);
1960 
1961 	TAILQ_FOREACH(node, DEVFS_DENODE_HEAD(parent), link) {
1962 		if (len != node->d_dir.d_namlen)
1963 			continue;
1964 
1965 		if (!memcmp(node->d_dir.d_name, target, len)) {
1966 			found = node;
1967 			break;
1968 		}
1969 	}
1970 
1971 	return found;
1972 }
1973 
1974 static void *
1975 devfs_inode_to_vnode_worker_callback(struct devfs_node *node, ino_t *inop)
1976 {
1977 	struct vnode *vp = NULL;
1978 	ino_t target = *inop;
1979 
1980 	if (node->d_dir.d_ino == target) {
1981 		if (node->v_node) {
1982 			vp = node->v_node;
1983 			vget(vp, LK_EXCLUSIVE | LK_RETRY);
1984 			vn_unlock(vp);
1985 		} else {
1986 			devfs_allocv(&vp, node);
1987 			vn_unlock(vp);
1988 		}
1989 	}
1990 
1991 	return vp;
1992 }
1993 
1994 /*
1995  * This function takes a cdev and removes its devfs node in the
1996  * given topology.  The cdev remains intact.
1997  */
1998 int
1999 devfs_destroy_device_node(struct devfs_node *root, cdev_t target)
2000 {
2001 	KKASSERT(target != NULL);
2002 	return devfs_destroy_node(root, target->si_name);
2003 }
2004 
2005 /*
2006  * This function takes a path to a devfs node, resolves it and
2007  * removes the devfs node from the given topology.
2008  */
2009 int
2010 devfs_destroy_node(struct devfs_node *root, char *target)
2011 {
2012 	struct devfs_node *node, *parent;
2013 	char *name;
2014 	char *name_buf;
2015 	char *create_path = NULL;
2016 
2017 	KKASSERT(target);
2018 
2019 	name_buf = kmalloc(PATH_MAX, M_TEMP, M_WAITOK);
2020 	ksnprintf(name_buf, PATH_MAX, "%s", target);
2021 
2022 	devfs_resolve_name_path(target, name_buf, &create_path, &name);
2023 
2024 	if (create_path)
2025 		parent = devfs_resolve_or_create_path(root, create_path, 0);
2026 	else
2027 		parent = root;
2028 
2029 	if (parent == NULL) {
2030 		kfree(name_buf, M_TEMP);
2031 		return 1;
2032 	}
2033 
2034 	node = devfs_find_device_node_by_name(parent, name);
2035 
2036 	if (node) {
2037 		nanotime(&node->parent->mtime);
2038 		devfs_gc(node);
2039 	}
2040 
2041 	kfree(name_buf, M_TEMP);
2042 
2043 	return 0;
2044 }
2045 
2046 /*
2047  * Just set perms and ownership for given node.
2048  */
2049 int
2050 devfs_set_perms(struct devfs_node *node, uid_t uid, gid_t gid,
2051 		u_short mode, u_long flags)
2052 {
2053 	node->mode = mode;
2054 	node->uid = uid;
2055 	node->gid = gid;
2056 
2057 	return 0;
2058 }
2059 
2060 /*
2061  * Propagates a device attach/detach to all mount
2062  * points. Also takes care of automatic alias removal
2063  * for a deleted cdev.
2064  */
2065 static int
2066 devfs_propagate_dev(cdev_t dev, int attach)
2067 {
2068 	struct devfs_mnt_data *mnt;
2069 
2070 	TAILQ_FOREACH(mnt, &devfs_mnt_list, link) {
2071 		if (attach) {
2072 			/* Device is being attached */
2073 			devfs_create_device_node(mnt->root_node, dev,
2074 						 NULL, NULL );
2075 		} else {
2076 			/* Device is being detached */
2077 			devfs_alias_remove(dev);
2078 			devfs_destroy_device_node(mnt->root_node, dev);
2079 		}
2080 	}
2081 	return 0;
2082 }
2083 
2084 /*
2085  * devfs_clone either returns a basename from a complete name by
2086  * returning the length of the name without trailing digits, or,
2087  * if clone != 0, calls the device's clone handler to get a new
2088  * device, which in turn is returned in devp.
2089  */
2090 cdev_t
2091 devfs_clone(cdev_t dev, const char *name, size_t len, int mode,
2092 		struct ucred *cred)
2093 {
2094 	int error;
2095 	struct devfs_clone_handler *chandler;
2096 	struct dev_clone_args ap;
2097 
2098 	TAILQ_FOREACH(chandler, &devfs_chandler_list, link) {
2099 		if (chandler->namlen != len)
2100 			continue;
2101 		if ((!memcmp(chandler->name, name, len)) && (chandler->nhandler)) {
2102 			lockmgr(&devfs_lock, LK_RELEASE);
2103 			devfs_config();
2104 			lockmgr(&devfs_lock, LK_EXCLUSIVE);
2105 
2106 			ap.a_head.a_dev = dev;
2107 			ap.a_dev = NULL;
2108 			ap.a_name = name;
2109 			ap.a_namelen = len;
2110 			ap.a_mode = mode;
2111 			ap.a_cred = cred;
2112 			error = (chandler->nhandler)(&ap);
2113 			if (error)
2114 				continue;
2115 
2116 			return ap.a_dev;
2117 		}
2118 	}
2119 
2120 	return NULL;
2121 }
2122 
2123 
2124 /*
2125  * Registers a new orphan in the orphan list.
2126  */
2127 void
2128 devfs_tracer_add_orphan(struct devfs_node *node)
2129 {
2130 	struct devfs_orphan *orphan;
2131 
2132 	KKASSERT(node);
2133 	orphan = kmalloc(sizeof(struct devfs_orphan), M_DEVFS, M_WAITOK);
2134 	orphan->node = node;
2135 
2136 	KKASSERT((node->flags & DEVFS_ORPHANED) == 0);
2137 	node->flags |= DEVFS_ORPHANED;
2138 	TAILQ_INSERT_TAIL(DEVFS_ORPHANLIST(node->mp), orphan, link);
2139 }
2140 
2141 /*
2142  * Removes an orphan from the orphan list.
2143  */
2144 void
2145 devfs_tracer_del_orphan(struct devfs_node *node)
2146 {
2147 	struct devfs_orphan *orphan;
2148 
2149 	KKASSERT(node);
2150 
2151 	TAILQ_FOREACH(orphan, DEVFS_ORPHANLIST(node->mp), link)	{
2152 		if (orphan->node == node) {
2153 			node->flags &= ~DEVFS_ORPHANED;
2154 			TAILQ_REMOVE(DEVFS_ORPHANLIST(node->mp), orphan, link);
2155 			kfree(orphan, M_DEVFS);
2156 			break;
2157 		}
2158 	}
2159 }
2160 
2161 /*
2162  * Counts the orphans in the orphan list, and if cleanup
2163  * is specified, also frees the orphan and removes it from
2164  * the list.
2165  */
2166 size_t
2167 devfs_tracer_orphan_count(struct mount *mp, int cleanup)
2168 {
2169 	struct devfs_orphan *orphan, *orphan2;
2170 	size_t count = 0;
2171 
2172 	TAILQ_FOREACH_MUTABLE(orphan, DEVFS_ORPHANLIST(mp), link, orphan2)	{
2173 		count++;
2174 		/*
2175 		 * If we are instructed to clean up, we do so.
2176 		 */
2177 		if (cleanup) {
2178 			TAILQ_REMOVE(DEVFS_ORPHANLIST(mp), orphan, link);
2179 			orphan->node->flags &= ~DEVFS_ORPHANED;
2180 			devfs_freep(orphan->node);
2181 			kfree(orphan, M_DEVFS);
2182 		}
2183 	}
2184 
2185 	return count;
2186 }
2187 
2188 /*
2189  * Fetch an ino_t from the global d_ino by increasing it
2190  * while spinlocked.
2191  */
2192 static ino_t
2193 devfs_fetch_ino(void)
2194 {
2195 	ino_t	ret;
2196 
2197 	spin_lock(&ino_lock);
2198 	ret = d_ino++;
2199 	spin_unlock(&ino_lock);
2200 
2201 	return ret;
2202 }
2203 
2204 /*
2205  * Allocates a new cdev and initializes it's most basic
2206  * fields.
2207  */
2208 cdev_t
2209 devfs_new_cdev(struct dev_ops *ops, int minor, struct dev_ops *bops)
2210 {
2211 	cdev_t dev = sysref_alloc(&cdev_sysref_class);
2212 
2213 	sysref_activate(&dev->si_sysref);
2214 	reference_dev(dev);
2215 	bzero(dev, offsetof(struct cdev, si_sysref));
2216 
2217 	dev->si_uid = 0;
2218 	dev->si_gid = 0;
2219 	dev->si_perms = 0;
2220 	dev->si_drv1 = NULL;
2221 	dev->si_drv2 = NULL;
2222 	dev->si_lastread = 0;		/* time_second */
2223 	dev->si_lastwrite = 0;		/* time_second */
2224 
2225 	dev->si_dict = NULL;
2226 	dev->si_ops = ops;
2227 	dev->si_flags = 0;
2228 	dev->si_umajor = 0;
2229 	dev->si_uminor = minor;
2230 	dev->si_bops = bops;
2231 
2232 	/*
2233 	 * Since the disk subsystem is in the way, we need to
2234 	 * propagate the D_CANFREE from bops (and ops) to
2235 	 * si_flags.
2236 	 */
2237 	if (bops && (bops->head.flags & D_CANFREE)) {
2238 		dev->si_flags |= SI_CANFREE;
2239 	} else if (ops->head.flags & D_CANFREE) {
2240 		dev->si_flags |= SI_CANFREE;
2241 	}
2242 
2243 	/* If there is a backing device, we reference its ops */
2244 	dev->si_inode = makeudev(
2245 		    devfs_reference_ops((bops)?(bops):(ops)),
2246 		    minor );
2247 
2248 	return dev;
2249 }
2250 
2251 static void
2252 devfs_cdev_terminate(cdev_t dev)
2253 {
2254 	int locked = 0;
2255 
2256 	/* Check if it is locked already. if not, we acquire the devfs lock */
2257 	if (!(lockstatus(&devfs_lock, curthread)) == LK_EXCLUSIVE) {
2258 		lockmgr(&devfs_lock, LK_EXCLUSIVE);
2259 		locked = 1;
2260 	}
2261 
2262 	/*
2263 	 * Make sure the node isn't linked anymore. Otherwise we've screwed
2264 	 * up somewhere, since normal devs are unlinked on the call to
2265 	 * destroy_dev and only-cdevs that have not been used for cloning
2266 	 * are not linked in the first place. only-cdevs used for cloning
2267 	 * will be linked in, too, and should only be destroyed via
2268 	 * destroy_dev, not destroy_only_dev, so we catch that problem, too.
2269 	 */
2270 	KKASSERT((dev->si_flags & SI_DEVFS_LINKED) == 0);
2271 
2272 	/* If we acquired the lock, we also get rid of it */
2273 	if (locked)
2274 		lockmgr(&devfs_lock, LK_RELEASE);
2275 
2276 	/* If there is a backing device, we release the backing device's ops */
2277 	devfs_release_ops((dev->si_bops)?(dev->si_bops):(dev->si_ops));
2278 
2279 	/* Finally destroy the device */
2280 	sysref_put(&dev->si_sysref);
2281 }
2282 
2283 /*
2284  * Dummies for now (individual locks for MPSAFE)
2285  */
2286 static void
2287 devfs_cdev_lock(cdev_t dev)
2288 {
2289 }
2290 
2291 static void
2292 devfs_cdev_unlock(cdev_t dev)
2293 {
2294 }
2295 
2296 static int
2297 devfs_detached_filter_eof(struct knote *kn, long hint)
2298 {
2299 	kn->kn_flags |= EV_EOF;
2300 	return (1);
2301 }
2302 
2303 static void
2304 devfs_detached_filter_detach(struct knote *kn)
2305 {
2306 	cdev_t dev = (cdev_t)kn->kn_hook;
2307 
2308 	knote_remove(&dev->si_kqinfo.ki_note, kn);
2309 }
2310 
2311 static struct filterops devfs_detached_filterops =
2312 	{ FILTEROP_ISFD, NULL,
2313 	  devfs_detached_filter_detach,
2314 	  devfs_detached_filter_eof };
2315 
2316 /*
2317  * Delegates knote filter handling responsibility to devfs
2318  *
2319  * Any device that implements kqfilter event handling and could be detached
2320  * or shut down out from under the kevent subsystem must allow devfs to
2321  * assume responsibility for any knotes it may hold.
2322  */
2323 void
2324 devfs_assume_knotes(cdev_t dev, struct kqinfo *kqi)
2325 {
2326 	/*
2327 	 * Let kern/kern_event.c do the heavy lifting.
2328 	 */
2329 	knote_assume_knotes(kqi, &dev->si_kqinfo,
2330 			    &devfs_detached_filterops, (void *)dev);
2331 
2332 	/*
2333 	 * These should probably be activated individually, but doing so
2334 	 * would require refactoring kq's public in-kernel interface.
2335 	 */
2336 	KNOTE(&dev->si_kqinfo.ki_note, 0);
2337 }
2338 
2339 /*
2340  * Links a given cdev into the dev list.
2341  */
2342 int
2343 devfs_link_dev(cdev_t dev)
2344 {
2345 	KKASSERT((dev->si_flags & SI_DEVFS_LINKED) == 0);
2346 	dev->si_flags |= SI_DEVFS_LINKED;
2347 	TAILQ_INSERT_TAIL(&devfs_dev_list, dev, link);
2348 
2349 	return 0;
2350 }
2351 
2352 /*
2353  * Removes a given cdev from the dev list.  The caller is responsible for
2354  * releasing the reference on the device associated with the linkage.
2355  *
2356  * Returns EALREADY if the dev has already been unlinked.
2357  */
2358 static int
2359 devfs_unlink_dev(cdev_t dev)
2360 {
2361 	if ((dev->si_flags & SI_DEVFS_LINKED)) {
2362 		TAILQ_REMOVE(&devfs_dev_list, dev, link);
2363 		dev->si_flags &= ~SI_DEVFS_LINKED;
2364 		return (0);
2365 	}
2366 	return (EALREADY);
2367 }
2368 
2369 int
2370 devfs_node_is_accessible(struct devfs_node *node)
2371 {
2372 	if ((node) && (!(node->flags & DEVFS_HIDDEN)))
2373 		return 1;
2374 	else
2375 		return 0;
2376 }
2377 
2378 int
2379 devfs_reference_ops(struct dev_ops *ops)
2380 {
2381 	int unit;
2382 	struct devfs_dev_ops *found = NULL;
2383 	struct devfs_dev_ops *devops;
2384 
2385 	TAILQ_FOREACH(devops, &devfs_dev_ops_list, link) {
2386 		if (devops->ops == ops) {
2387 			found = devops;
2388 			break;
2389 		}
2390 	}
2391 
2392 	if (!found) {
2393 		found = kmalloc(sizeof(struct devfs_dev_ops), M_DEVFS, M_WAITOK);
2394 		found->ops = ops;
2395 		found->ref_count = 0;
2396 		TAILQ_INSERT_TAIL(&devfs_dev_ops_list, found, link);
2397 	}
2398 
2399 	KKASSERT(found);
2400 
2401 	if (found->ref_count == 0) {
2402 		found->id = devfs_clone_bitmap_get(&DEVFS_CLONE_BITMAP(ops_id), 255);
2403 		if (found->id == -1) {
2404 			/* Ran out of unique ids */
2405 			devfs_debug(DEVFS_DEBUG_WARNING,
2406 					"devfs_reference_ops: WARNING: ran out of unique ids\n");
2407 		}
2408 	}
2409 	unit = found->id;
2410 	++found->ref_count;
2411 
2412 	return unit;
2413 }
2414 
2415 void
2416 devfs_release_ops(struct dev_ops *ops)
2417 {
2418 	struct devfs_dev_ops *found = NULL;
2419 	struct devfs_dev_ops *devops;
2420 
2421 	TAILQ_FOREACH(devops, &devfs_dev_ops_list, link) {
2422 		if (devops->ops == ops) {
2423 			found = devops;
2424 			break;
2425 		}
2426 	}
2427 
2428 	KKASSERT(found);
2429 
2430 	--found->ref_count;
2431 
2432 	if (found->ref_count == 0) {
2433 		TAILQ_REMOVE(&devfs_dev_ops_list, found, link);
2434 		devfs_clone_bitmap_put(&DEVFS_CLONE_BITMAP(ops_id), found->id);
2435 		kfree(found, M_DEVFS);
2436 	}
2437 }
2438 
2439 /*
2440  * Wait for asynchronous messages to complete in the devfs helper
2441  * thread, then return.  Do nothing if the helper thread is dead
2442  * or we are being indirectly called from the helper thread itself.
2443  */
2444 void
2445 devfs_config(void)
2446 {
2447 	devfs_msg_t msg;
2448 
2449 	if (devfs_run && curthread != td_core) {
2450 		msg = devfs_msg_get();
2451 		msg = devfs_msg_send_sync(DEVFS_SYNC, msg);
2452 		devfs_msg_put(msg);
2453 	}
2454 }
2455 
2456 /*
2457  * Called on init of devfs; creates the objcaches and
2458  * spawns off the devfs core thread. Also initializes
2459  * locks.
2460  */
2461 static void
2462 devfs_init(void)
2463 {
2464 	devfs_debug(DEVFS_DEBUG_DEBUG, "devfs_init() called\n");
2465 	/* Create objcaches for nodes, msgs and devs */
2466 	devfs_node_cache = objcache_create("devfs-node-cache", 0, 0,
2467 					   NULL, NULL, NULL,
2468 					   objcache_malloc_alloc,
2469 					   objcache_malloc_free,
2470 					   &devfs_node_malloc_args );
2471 
2472 	devfs_msg_cache = objcache_create("devfs-msg-cache", 0, 0,
2473 					  NULL, NULL, NULL,
2474 					  objcache_malloc_alloc,
2475 					  objcache_malloc_free,
2476 					  &devfs_msg_malloc_args );
2477 
2478 	devfs_dev_cache = objcache_create("devfs-dev-cache", 0, 0,
2479 					  NULL, NULL, NULL,
2480 					  objcache_malloc_alloc,
2481 					  objcache_malloc_free,
2482 					  &devfs_dev_malloc_args );
2483 
2484 	devfs_clone_bitmap_init(&DEVFS_CLONE_BITMAP(ops_id));
2485 
2486 	/* Initialize the reply-only port which acts as a message drain */
2487 	lwkt_initport_replyonly(&devfs_dispose_port, devfs_msg_autofree_reply);
2488 
2489 	/* Initialize *THE* devfs lock */
2490 	lockinit(&devfs_lock, "devfs_core lock", 0, 0);
2491 
2492 	lockmgr(&devfs_lock, LK_EXCLUSIVE);
2493 	lwkt_create(devfs_msg_core, /*args*/NULL, &td_core, NULL,
2494 		    0, 0, "devfs_msg_core");
2495 	while (devfs_run == 0)
2496 		lksleep(td_core, &devfs_lock, 0, "devfsc", 0);
2497 	lockmgr(&devfs_lock, LK_RELEASE);
2498 
2499 	devfs_debug(DEVFS_DEBUG_DEBUG, "devfs_init finished\n");
2500 }
2501 
2502 /*
2503  * Called on unload of devfs; takes care of destroying the core
2504  * and the objcaches. Also removes aliases that are no longer needed.
2505  */
2506 static void
2507 devfs_uninit(void)
2508 {
2509 	devfs_debug(DEVFS_DEBUG_DEBUG, "devfs_uninit() called\n");
2510 
2511 	devfs_msg_send(DEVFS_TERMINATE_CORE, NULL);
2512 	while (devfs_run)
2513 		tsleep(td_core, 0, "devfsc", hz*10);
2514 	tsleep(td_core, 0, "devfsc", hz);
2515 
2516 	devfs_clone_bitmap_uninit(&DEVFS_CLONE_BITMAP(ops_id));
2517 
2518 	/* Destroy the objcaches */
2519 	objcache_destroy(devfs_msg_cache);
2520 	objcache_destroy(devfs_node_cache);
2521 	objcache_destroy(devfs_dev_cache);
2522 
2523 	devfs_alias_reap();
2524 }
2525 
2526 /*
2527  * This is a sysctl handler to assist userland devname(3) to
2528  * find the device name for a given udev.
2529  */
2530 static int
2531 devfs_sysctl_devname_helper(SYSCTL_HANDLER_ARGS)
2532 {
2533 	udev_t 	udev;
2534 	cdev_t	found;
2535 	int		error;
2536 
2537 
2538 	if ((error = SYSCTL_IN(req, &udev, sizeof(udev_t))))
2539 		return (error);
2540 
2541 	devfs_debug(DEVFS_DEBUG_DEBUG, "devfs sysctl, received udev: %d\n", udev);
2542 
2543 	if (udev == NOUDEV)
2544 		return(EINVAL);
2545 
2546 	if ((found = devfs_find_device_by_udev(udev)) == NULL)
2547 		return(ENOENT);
2548 
2549 	return(SYSCTL_OUT(req, found->si_name, strlen(found->si_name) + 1));
2550 }
2551 
2552 
2553 SYSCTL_PROC(_kern, OID_AUTO, devname, CTLTYPE_OPAQUE|CTLFLAG_RW|CTLFLAG_ANYBODY,
2554 			NULL, 0, devfs_sysctl_devname_helper, "", "helper for devname(3)");
2555 
2556 SYSCTL_NODE(_vfs, OID_AUTO, devfs, CTLFLAG_RW, 0, "devfs");
2557 TUNABLE_INT("vfs.devfs.debug", &devfs_debug_enable);
2558 SYSCTL_INT(_vfs_devfs, OID_AUTO, debug, CTLFLAG_RW, &devfs_debug_enable,
2559 		0, "Enable DevFS debugging");
2560 
2561 SYSINIT(vfs_devfs_register, SI_SUB_PRE_DRIVERS, SI_ORDER_FIRST,
2562 		devfs_init, NULL);
2563 SYSUNINIT(vfs_devfs_register, SI_SUB_PRE_DRIVERS, SI_ORDER_ANY,
2564 		devfs_uninit, NULL);
2565 
2566 /*
2567  * WildCmp() - compare wild string to sane string
2568  *
2569  *	Returns 0 on success, -1 on failure.
2570  */
2571 static int
2572 wildCmp(const char **mary, int d, const char *w, const char *s)
2573 {
2574     int i;
2575 
2576     /*
2577      * skip fixed portion
2578      */
2579     for (;;) {
2580 	switch(*w) {
2581 	case '*':
2582 	    /*
2583 	     * optimize terminator
2584 	     */
2585 	    if (w[1] == 0)
2586 		return(0);
2587 	    if (w[1] != '?' && w[1] != '*') {
2588 		/*
2589 		 * optimize * followed by non-wild
2590 		 */
2591 		for (i = 0; s + i < mary[d]; ++i) {
2592 		    if (s[i] == w[1] && wildCmp(mary, d + 1, w + 1, s + i) == 0)
2593 			return(0);
2594 		}
2595 	    } else {
2596 		/*
2597 		 * less-optimal
2598 		 */
2599 		for (i = 0; s + i < mary[d]; ++i) {
2600 		    if (wildCmp(mary, d + 1, w + 1, s + i) == 0)
2601 			return(0);
2602 		}
2603 	    }
2604 	    mary[d] = s;
2605 	    return(-1);
2606 	case '?':
2607 	    if (*s == 0)
2608 		return(-1);
2609 	    ++w;
2610 	    ++s;
2611 	    break;
2612 	default:
2613 	    if (*w != *s)
2614 		return(-1);
2615 	    if (*w == 0)	/* terminator */
2616 		return(0);
2617 	    ++w;
2618 	    ++s;
2619 	    break;
2620 	}
2621     }
2622     /* not reached */
2623     return(-1);
2624 }
2625 
2626 
2627 /*
2628  * WildCaseCmp() - compare wild string to sane string, case insensitive
2629  *
2630  *	Returns 0 on success, -1 on failure.
2631  */
2632 static int
2633 wildCaseCmp(const char **mary, int d, const char *w, const char *s)
2634 {
2635     int i;
2636 
2637     /*
2638      * skip fixed portion
2639      */
2640     for (;;) {
2641 	switch(*w) {
2642 	case '*':
2643 	    /*
2644 	     * optimize terminator
2645 	     */
2646 	    if (w[1] == 0)
2647 		return(0);
2648 	    if (w[1] != '?' && w[1] != '*') {
2649 		/*
2650 		 * optimize * followed by non-wild
2651 		 */
2652 		for (i = 0; s + i < mary[d]; ++i) {
2653 		    if (s[i] == w[1] && wildCaseCmp(mary, d + 1, w + 1, s + i) == 0)
2654 			return(0);
2655 		}
2656 	    } else {
2657 		/*
2658 		 * less-optimal
2659 		 */
2660 		for (i = 0; s + i < mary[d]; ++i) {
2661 		    if (wildCaseCmp(mary, d + 1, w + 1, s + i) == 0)
2662 			return(0);
2663 		}
2664 	    }
2665 	    mary[d] = s;
2666 	    return(-1);
2667 	case '?':
2668 	    if (*s == 0)
2669 		return(-1);
2670 	    ++w;
2671 	    ++s;
2672 	    break;
2673 	default:
2674 	    if (*w != *s) {
2675 #define tolower(x)	((x >= 'A' && x <= 'Z')?(x+('a'-'A')):(x))
2676 		if (tolower(*w) != tolower(*s))
2677 		    return(-1);
2678 	    }
2679 	    if (*w == 0)	/* terminator */
2680 		return(0);
2681 	    ++w;
2682 	    ++s;
2683 	    break;
2684 	}
2685     }
2686     /* not reached */
2687     return(-1);
2688 }
2689 
2690 int
2691 devfs_WildCmp(const char *w, const char *s)
2692 {
2693     int i;
2694     int c;
2695     int slen = strlen(s);
2696     const char **mary;
2697 
2698     for (i = c = 0; w[i]; ++i) {
2699 	if (w[i] == '*')
2700 	    ++c;
2701     }
2702     mary = kmalloc(sizeof(char *) * (c + 1), M_DEVFS, M_WAITOK);
2703     for (i = 0; i < c; ++i)
2704 	mary[i] = s + slen;
2705     i = wildCmp(mary, 0, w, s);
2706     kfree(mary, M_DEVFS);
2707     return(i);
2708 }
2709 
2710 int
2711 devfs_WildCaseCmp(const char *w, const char *s)
2712 {
2713     int i;
2714     int c;
2715     int slen = strlen(s);
2716     const char **mary;
2717 
2718     for (i = c = 0; w[i]; ++i) {
2719 	if (w[i] == '*')
2720 	    ++c;
2721     }
2722     mary = kmalloc(sizeof(char *) * (c + 1), M_DEVFS, M_WAITOK);
2723     for (i = 0; i < c; ++i)
2724 	mary[i] = s + slen;
2725     i = wildCaseCmp(mary, 0, w, s);
2726     kfree(mary, M_DEVFS);
2727     return(i);
2728 }
2729 
2730