xref: /dragonfly/sys/vfs/devfs/devfs_vnops.c (revision cecb9aae)
1 /*
2  * (MPSAFE)
3  *
4  * Copyright (c) 2009 The DragonFly Project.  All rights reserved.
5  *
6  * This code is derived from software contributed to The DragonFly Project
7  * by Alex Hornung <ahornung@gmail.com>
8  *
9  * Redistribution and use in source and binary forms, with or without
10  * modification, are permitted provided that the following conditions
11  * are met:
12  *
13  * 1. Redistributions of source code must retain the above copyright
14  *    notice, this list of conditions and the following disclaimer.
15  * 2. Redistributions in binary form must reproduce the above copyright
16  *    notice, this list of conditions and the following disclaimer in
17  *    the documentation and/or other materials provided with the
18  *    distribution.
19  * 3. Neither the name of The DragonFly Project nor the names of its
20  *    contributors may be used to endorse or promote products derived
21  *    from this software without specific, prior written permission.
22  *
23  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
24  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
25  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
26  * FOR A PARTICULAR PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE
27  * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
28  * INCIDENTAL, SPECIAL, EXEMPLARY OR CONSEQUENTIAL DAMAGES (INCLUDING,
29  * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
30  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
31  * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
32  * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
33  * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
34  * SUCH DAMAGE.
35  */
36 #include <sys/param.h>
37 #include <sys/systm.h>
38 #include <sys/time.h>
39 #include <sys/kernel.h>
40 #include <sys/lock.h>
41 #include <sys/fcntl.h>
42 #include <sys/proc.h>
43 #include <sys/priv.h>
44 #include <sys/signalvar.h>
45 #include <sys/vnode.h>
46 #include <sys/uio.h>
47 #include <sys/mount.h>
48 #include <sys/file.h>
49 #include <sys/fcntl.h>
50 #include <sys/namei.h>
51 #include <sys/dirent.h>
52 #include <sys/malloc.h>
53 #include <sys/stat.h>
54 #include <sys/reg.h>
55 #include <vm/vm_pager.h>
56 #include <vm/vm_zone.h>
57 #include <vm/vm_object.h>
58 #include <sys/filio.h>
59 #include <sys/ttycom.h>
60 #include <sys/tty.h>
61 #include <sys/diskslice.h>
62 #include <sys/sysctl.h>
63 #include <sys/devfs.h>
64 #include <sys/pioctl.h>
65 #include <vfs/fifofs/fifo.h>
66 
67 #include <machine/limits.h>
68 
69 #include <sys/buf2.h>
70 #include <sys/sysref2.h>
71 #include <sys/mplock2.h>
72 #include <vm/vm_page2.h>
73 
74 #ifndef SPEC_CHAIN_DEBUG
75 #define SPEC_CHAIN_DEBUG 0
76 #endif
77 
78 MALLOC_DECLARE(M_DEVFS);
79 #define DEVFS_BADOP	(void *)devfs_vop_badop
80 
81 static int devfs_vop_badop(struct vop_generic_args *);
82 static int devfs_vop_access(struct vop_access_args *);
83 static int devfs_vop_inactive(struct vop_inactive_args *);
84 static int devfs_vop_reclaim(struct vop_reclaim_args *);
85 static int devfs_vop_readdir(struct vop_readdir_args *);
86 static int devfs_vop_getattr(struct vop_getattr_args *);
87 static int devfs_vop_setattr(struct vop_setattr_args *);
88 static int devfs_vop_readlink(struct vop_readlink_args *);
89 static int devfs_vop_print(struct vop_print_args *);
90 
91 static int devfs_vop_nresolve(struct vop_nresolve_args *);
92 static int devfs_vop_nlookupdotdot(struct vop_nlookupdotdot_args *);
93 static int devfs_vop_nmkdir(struct vop_nmkdir_args *);
94 static int devfs_vop_nsymlink(struct vop_nsymlink_args *);
95 static int devfs_vop_nrmdir(struct vop_nrmdir_args *);
96 static int devfs_vop_nremove(struct vop_nremove_args *);
97 
98 static int devfs_spec_open(struct vop_open_args *);
99 static int devfs_spec_close(struct vop_close_args *);
100 static int devfs_spec_fsync(struct vop_fsync_args *);
101 
102 static int devfs_spec_read(struct vop_read_args *);
103 static int devfs_spec_write(struct vop_write_args *);
104 static int devfs_spec_ioctl(struct vop_ioctl_args *);
105 static int devfs_spec_kqfilter(struct vop_kqfilter_args *);
106 static int devfs_spec_strategy(struct vop_strategy_args *);
107 static void devfs_spec_strategy_done(struct bio *);
108 static int devfs_spec_freeblks(struct vop_freeblks_args *);
109 static int devfs_spec_bmap(struct vop_bmap_args *);
110 static int devfs_spec_advlock(struct vop_advlock_args *);
111 static void devfs_spec_getpages_iodone(struct bio *);
112 static int devfs_spec_getpages(struct vop_getpages_args *);
113 
114 static int devfs_fo_close(struct file *);
115 static int devfs_fo_read(struct file *, struct uio *, struct ucred *, int);
116 static int devfs_fo_write(struct file *, struct uio *, struct ucred *, int);
117 static int devfs_fo_stat(struct file *, struct stat *, struct ucred *);
118 static int devfs_fo_kqfilter(struct file *, struct knote *);
119 static int devfs_fo_ioctl(struct file *, u_long, caddr_t,
120 				struct ucred *, struct sysmsg *);
121 static __inline int sequential_heuristic(struct uio *, struct file *);
122 
123 extern struct lock devfs_lock;
124 
125 /*
126  * devfs vnode operations for regular files.  All vnode ops are MPSAFE.
127  */
128 struct vop_ops devfs_vnode_norm_vops = {
129 	.vop_default =		vop_defaultop,
130 	.vop_access =		devfs_vop_access,
131 	.vop_advlock =		DEVFS_BADOP,
132 	.vop_bmap =		DEVFS_BADOP,
133 	.vop_close =		vop_stdclose,
134 	.vop_getattr =		devfs_vop_getattr,
135 	.vop_inactive =		devfs_vop_inactive,
136 	.vop_ncreate =		DEVFS_BADOP,
137 	.vop_nresolve =		devfs_vop_nresolve,
138 	.vop_nlookupdotdot =	devfs_vop_nlookupdotdot,
139 	.vop_nlink =		DEVFS_BADOP,
140 	.vop_nmkdir =		devfs_vop_nmkdir,
141 	.vop_nmknod =		DEVFS_BADOP,
142 	.vop_nremove =		devfs_vop_nremove,
143 	.vop_nrename =		DEVFS_BADOP,
144 	.vop_nrmdir =		devfs_vop_nrmdir,
145 	.vop_nsymlink =		devfs_vop_nsymlink,
146 	.vop_open =		vop_stdopen,
147 	.vop_pathconf =		vop_stdpathconf,
148 	.vop_print =		devfs_vop_print,
149 	.vop_read =		DEVFS_BADOP,
150 	.vop_readdir =		devfs_vop_readdir,
151 	.vop_readlink =		devfs_vop_readlink,
152 	.vop_reclaim =		devfs_vop_reclaim,
153 	.vop_setattr =		devfs_vop_setattr,
154 	.vop_write =		DEVFS_BADOP,
155 	.vop_ioctl =		DEVFS_BADOP
156 };
157 
158 /*
159  * devfs vnode operations for character devices.  All vnode ops are MPSAFE.
160  */
161 struct vop_ops devfs_vnode_dev_vops = {
162 	.vop_default =		vop_defaultop,
163 	.vop_access =		devfs_vop_access,
164 	.vop_advlock =		devfs_spec_advlock,
165 	.vop_bmap =		devfs_spec_bmap,
166 	.vop_close =		devfs_spec_close,
167 	.vop_freeblks =		devfs_spec_freeblks,
168 	.vop_fsync =		devfs_spec_fsync,
169 	.vop_getattr =		devfs_vop_getattr,
170 	.vop_getpages =		devfs_spec_getpages,
171 	.vop_inactive =		devfs_vop_inactive,
172 	.vop_open =		devfs_spec_open,
173 	.vop_pathconf =		vop_stdpathconf,
174 	.vop_print =		devfs_vop_print,
175 	.vop_kqfilter =		devfs_spec_kqfilter,
176 	.vop_read =		devfs_spec_read,
177 	.vop_readdir =		DEVFS_BADOP,
178 	.vop_readlink =		DEVFS_BADOP,
179 	.vop_reclaim =		devfs_vop_reclaim,
180 	.vop_setattr =		devfs_vop_setattr,
181 	.vop_strategy =		devfs_spec_strategy,
182 	.vop_write =		devfs_spec_write,
183 	.vop_ioctl =		devfs_spec_ioctl
184 };
185 
186 /*
187  * devfs file pointer operations.  All fileops are MPSAFE.
188  */
189 struct vop_ops *devfs_vnode_dev_vops_p = &devfs_vnode_dev_vops;
190 
191 struct fileops devfs_dev_fileops = {
192 	.fo_read	= devfs_fo_read,
193 	.fo_write	= devfs_fo_write,
194 	.fo_ioctl	= devfs_fo_ioctl,
195 	.fo_kqfilter	= devfs_fo_kqfilter,
196 	.fo_stat	= devfs_fo_stat,
197 	.fo_close	= devfs_fo_close,
198 	.fo_shutdown	= nofo_shutdown
199 };
200 
201 /*
202  * These two functions are possibly temporary hacks for devices (aka
203  * the pty code) which want to control the node attributes themselves.
204  *
205  * XXX we may ultimately desire to simply remove the uid/gid/mode
206  * from the node entirely.
207  *
208  * MPSAFE - sorta.  Theoretically the overwrite can compete since they
209  *	    are loading from the same fields.
210  */
211 static __inline void
212 node_sync_dev_get(struct devfs_node *node)
213 {
214 	cdev_t dev;
215 
216 	if ((dev = node->d_dev) && (dev->si_flags & SI_OVERRIDE)) {
217 		node->uid = dev->si_uid;
218 		node->gid = dev->si_gid;
219 		node->mode = dev->si_perms;
220 	}
221 }
222 
223 static __inline void
224 node_sync_dev_set(struct devfs_node *node)
225 {
226 	cdev_t dev;
227 
228 	if ((dev = node->d_dev) && (dev->si_flags & SI_OVERRIDE)) {
229 		dev->si_uid = node->uid;
230 		dev->si_gid = node->gid;
231 		dev->si_perms = node->mode;
232 	}
233 }
234 
235 /*
236  * generic entry point for unsupported operations
237  */
238 static int
239 devfs_vop_badop(struct vop_generic_args *ap)
240 {
241 	return (EIO);
242 }
243 
244 
245 static int
246 devfs_vop_access(struct vop_access_args *ap)
247 {
248 	struct devfs_node *node = DEVFS_NODE(ap->a_vp);
249 	int error;
250 
251 	if (!devfs_node_is_accessible(node))
252 		return ENOENT;
253 	node_sync_dev_get(node);
254 	error = vop_helper_access(ap, node->uid, node->gid,
255 				  node->mode, node->flags);
256 
257 	return error;
258 }
259 
260 
261 static int
262 devfs_vop_inactive(struct vop_inactive_args *ap)
263 {
264 	struct devfs_node *node = DEVFS_NODE(ap->a_vp);
265 
266 	if (node == NULL || (node->flags & DEVFS_NODE_LINKED) == 0)
267 		vrecycle(ap->a_vp);
268 	return 0;
269 }
270 
271 
272 static int
273 devfs_vop_reclaim(struct vop_reclaim_args *ap)
274 {
275 	struct devfs_node *node;
276 	struct vnode *vp;
277 	int locked;
278 
279 	/*
280 	 * Check if it is locked already. if not, we acquire the devfs lock
281 	 */
282 	if (!(lockstatus(&devfs_lock, curthread)) == LK_EXCLUSIVE) {
283 		lockmgr(&devfs_lock, LK_EXCLUSIVE);
284 		locked = 1;
285 	} else {
286 		locked = 0;
287 	}
288 
289 	/*
290 	 * Get rid of the devfs_node if it is no longer linked into the
291 	 * topology.
292 	 */
293 	vp = ap->a_vp;
294 	if ((node = DEVFS_NODE(vp)) != NULL) {
295 		node->v_node = NULL;
296 		if ((node->flags & DEVFS_NODE_LINKED) == 0)
297 			devfs_freep(node);
298 	}
299 
300 	if (locked)
301 		lockmgr(&devfs_lock, LK_RELEASE);
302 
303 	/*
304 	 * v_rdev needs to be properly released using v_release_rdev
305 	 * Make sure v_data is NULL as well.
306 	 */
307 	vp->v_data = NULL;
308 	v_release_rdev(vp);
309 	return 0;
310 }
311 
312 
313 static int
314 devfs_vop_readdir(struct vop_readdir_args *ap)
315 {
316 	struct devfs_node *dnode = DEVFS_NODE(ap->a_vp);
317 	struct devfs_node *node;
318 	int cookie_index;
319 	int ncookies;
320 	int error2;
321 	int error;
322 	int r;
323 	off_t *cookies;
324 	off_t saveoff;
325 
326 	devfs_debug(DEVFS_DEBUG_DEBUG, "devfs_readdir() called!\n");
327 
328 	if (ap->a_uio->uio_offset < 0 || ap->a_uio->uio_offset > INT_MAX)
329 		return (EINVAL);
330 	if ((error = vn_lock(ap->a_vp, LK_EXCLUSIVE | LK_RETRY)) != 0)
331 		return (error);
332 
333 	if (!devfs_node_is_accessible(dnode)) {
334 		vn_unlock(ap->a_vp);
335 		return ENOENT;
336 	}
337 
338 	lockmgr(&devfs_lock, LK_EXCLUSIVE);
339 
340 	saveoff = ap->a_uio->uio_offset;
341 
342 	if (ap->a_ncookies) {
343 		ncookies = ap->a_uio->uio_resid / 16 + 1; /* Why / 16 ?? */
344 		if (ncookies > 256)
345 			ncookies = 256;
346 		cookies = kmalloc(256 * sizeof(off_t), M_TEMP, M_WAITOK);
347 		cookie_index = 0;
348 	} else {
349 		ncookies = -1;
350 		cookies = NULL;
351 		cookie_index = 0;
352 	}
353 
354 	nanotime(&dnode->atime);
355 
356 	if (saveoff == 0) {
357 		r = vop_write_dirent(&error, ap->a_uio, dnode->d_dir.d_ino,
358 				     DT_DIR, 1, ".");
359 		if (r)
360 			goto done;
361 		if (cookies)
362 			cookies[cookie_index] = saveoff;
363 		saveoff++;
364 		cookie_index++;
365 		if (cookie_index == ncookies)
366 			goto done;
367 	}
368 
369 	if (saveoff == 1) {
370 		if (dnode->parent) {
371 			r = vop_write_dirent(&error, ap->a_uio,
372 					     dnode->parent->d_dir.d_ino,
373 					     DT_DIR, 2, "..");
374 		} else {
375 			r = vop_write_dirent(&error, ap->a_uio,
376 					     dnode->d_dir.d_ino,
377 					     DT_DIR, 2, "..");
378 		}
379 		if (r)
380 			goto done;
381 		if (cookies)
382 			cookies[cookie_index] = saveoff;
383 		saveoff++;
384 		cookie_index++;
385 		if (cookie_index == ncookies)
386 			goto done;
387 	}
388 
389 	TAILQ_FOREACH(node, DEVFS_DENODE_HEAD(dnode), link) {
390 		if ((node->flags & DEVFS_HIDDEN) ||
391 		    (node->flags & DEVFS_INVISIBLE)) {
392 			continue;
393 		}
394 
395 		/*
396 		 * If the node type is a valid devfs alias, then we make
397 		 * sure that the target isn't hidden. If it is, we don't
398 		 * show the link in the directory listing.
399 		 */
400 		if ((node->node_type == Nlink) && (node->link_target != NULL) &&
401 			(node->link_target->flags & DEVFS_HIDDEN))
402 			continue;
403 
404 		if (node->cookie < saveoff)
405 			continue;
406 
407 		saveoff = node->cookie;
408 
409 		error2 = vop_write_dirent(&error, ap->a_uio, node->d_dir.d_ino,
410 					  node->d_dir.d_type,
411 					  node->d_dir.d_namlen,
412 					  node->d_dir.d_name);
413 
414 		if (error2)
415 			break;
416 
417 		saveoff++;
418 
419 		if (cookies)
420 			cookies[cookie_index] = node->cookie;
421 		++cookie_index;
422 		if (cookie_index == ncookies)
423 			break;
424 	}
425 
426 done:
427 	lockmgr(&devfs_lock, LK_RELEASE);
428 	vn_unlock(ap->a_vp);
429 
430 	ap->a_uio->uio_offset = saveoff;
431 	if (error && cookie_index == 0) {
432 		if (cookies) {
433 			kfree(cookies, M_TEMP);
434 			*ap->a_ncookies = 0;
435 			*ap->a_cookies = NULL;
436 		}
437 	} else {
438 		if (cookies) {
439 			*ap->a_ncookies = cookie_index;
440 			*ap->a_cookies = cookies;
441 		}
442 	}
443 	return (error);
444 }
445 
446 
447 static int
448 devfs_vop_nresolve(struct vop_nresolve_args *ap)
449 {
450 	struct devfs_node *dnode = DEVFS_NODE(ap->a_dvp);
451 	struct devfs_node *node, *found = NULL;
452 	struct namecache *ncp;
453 	struct vnode *vp = NULL;
454 	int error = 0;
455 	int len;
456 	int depth;
457 
458 	ncp = ap->a_nch->ncp;
459 	len = ncp->nc_nlen;
460 
461 	if (!devfs_node_is_accessible(dnode))
462 		return ENOENT;
463 
464 	lockmgr(&devfs_lock, LK_EXCLUSIVE);
465 
466 	if ((dnode->node_type != Nroot) && (dnode->node_type != Ndir)) {
467 		error = ENOENT;
468 		cache_setvp(ap->a_nch, NULL);
469 		goto out;
470 	}
471 
472 	TAILQ_FOREACH(node, DEVFS_DENODE_HEAD(dnode), link) {
473 		if (len == node->d_dir.d_namlen) {
474 			if (!memcmp(ncp->nc_name, node->d_dir.d_name, len)) {
475 				found = node;
476 				break;
477 			}
478 		}
479 	}
480 
481 	if (found) {
482 		depth = 0;
483 		while ((found->node_type == Nlink) && (found->link_target)) {
484 			if (depth >= 8) {
485 				devfs_debug(DEVFS_DEBUG_SHOW, "Recursive link or depth >= 8");
486 				break;
487 			}
488 
489 			found = found->link_target;
490 			++depth;
491 		}
492 
493 		if (!(found->flags & DEVFS_HIDDEN))
494 			devfs_allocv(/*ap->a_dvp->v_mount, */ &vp, found);
495 	}
496 
497 	if (vp == NULL) {
498 		error = ENOENT;
499 		cache_setvp(ap->a_nch, NULL);
500 		goto out;
501 
502 	}
503 	KKASSERT(vp);
504 	vn_unlock(vp);
505 	cache_setvp(ap->a_nch, vp);
506 	vrele(vp);
507 out:
508 	lockmgr(&devfs_lock, LK_RELEASE);
509 
510 	return error;
511 }
512 
513 
514 static int
515 devfs_vop_nlookupdotdot(struct vop_nlookupdotdot_args *ap)
516 {
517 	struct devfs_node *dnode = DEVFS_NODE(ap->a_dvp);
518 
519 	*ap->a_vpp = NULL;
520 	if (!devfs_node_is_accessible(dnode))
521 		return ENOENT;
522 
523 	lockmgr(&devfs_lock, LK_EXCLUSIVE);
524 	if (dnode->parent != NULL) {
525 		devfs_allocv(ap->a_vpp, dnode->parent);
526 		vn_unlock(*ap->a_vpp);
527 	}
528 	lockmgr(&devfs_lock, LK_RELEASE);
529 
530 	return ((*ap->a_vpp == NULL) ? ENOENT : 0);
531 }
532 
533 
534 static int
535 devfs_vop_getattr(struct vop_getattr_args *ap)
536 {
537 	struct devfs_node *node = DEVFS_NODE(ap->a_vp);
538 	struct vattr *vap = ap->a_vap;
539 	struct partinfo pinfo;
540 	int error = 0;
541 
542 #if 0
543 	if (!devfs_node_is_accessible(node))
544 		return ENOENT;
545 #endif
546 	node_sync_dev_get(node);
547 
548 	lockmgr(&devfs_lock, LK_EXCLUSIVE);
549 
550 	/* start by zeroing out the attributes */
551 	VATTR_NULL(vap);
552 
553 	/* next do all the common fields */
554 	vap->va_type = ap->a_vp->v_type;
555 	vap->va_mode = node->mode;
556 	vap->va_fileid = DEVFS_NODE(ap->a_vp)->d_dir.d_ino ;
557 	vap->va_flags = 0;
558 	vap->va_blocksize = DEV_BSIZE;
559 	vap->va_bytes = vap->va_size = 0;
560 
561 	vap->va_fsid = ap->a_vp->v_mount->mnt_stat.f_fsid.val[0];
562 
563 	vap->va_atime = node->atime;
564 	vap->va_mtime = node->mtime;
565 	vap->va_ctime = node->ctime;
566 
567 	vap->va_nlink = 1; /* number of references to file */
568 
569 	vap->va_uid = node->uid;
570 	vap->va_gid = node->gid;
571 
572 	vap->va_rmajor = 0;
573 	vap->va_rminor = 0;
574 
575 	if ((node->node_type == Ndev) && node->d_dev)  {
576 		reference_dev(node->d_dev);
577 		vap->va_rminor = node->d_dev->si_uminor;
578 		release_dev(node->d_dev);
579 	}
580 
581 	/* For a softlink the va_size is the length of the softlink */
582 	if (node->symlink_name != 0) {
583 		vap->va_bytes = vap->va_size = node->symlink_namelen;
584 	}
585 
586 	/*
587 	 * For a disk-type device, va_size is the size of the underlying
588 	 * device, so that lseek() works properly.
589 	 */
590 	if ((node->d_dev) && (dev_dflags(node->d_dev) & D_DISK)) {
591 		bzero(&pinfo, sizeof(pinfo));
592 		error = dev_dioctl(node->d_dev, DIOCGPART, (void *)&pinfo,
593 				   0, proc0.p_ucred, NULL);
594 		if ((error == 0) && (pinfo.media_blksize != 0)) {
595 			vap->va_size = pinfo.media_size;
596 		} else {
597 			vap->va_size = 0;
598 			error = 0;
599 		}
600 	}
601 
602 	lockmgr(&devfs_lock, LK_RELEASE);
603 
604 	return (error);
605 }
606 
607 
608 static int
609 devfs_vop_setattr(struct vop_setattr_args *ap)
610 {
611 	struct devfs_node *node = DEVFS_NODE(ap->a_vp);
612 	struct vattr *vap;
613 	uid_t cur_uid;
614 	gid_t cur_gid;
615 	mode_t cur_mode;
616 	int error = 0;
617 
618 	if (!devfs_node_is_accessible(node))
619 		return ENOENT;
620 	node_sync_dev_get(node);
621 
622 	lockmgr(&devfs_lock, LK_EXCLUSIVE);
623 
624 	vap = ap->a_vap;
625 
626 	if ((vap->va_uid != (uid_t)VNOVAL) || (vap->va_gid != (gid_t)VNOVAL)) {
627 		cur_uid = node->uid;
628 		cur_gid = node->gid;
629 		cur_mode = node->mode;
630 		error = vop_helper_chown(ap->a_vp, vap->va_uid, vap->va_gid,
631 		    ap->a_cred, &cur_uid, &cur_gid, &cur_mode);
632 		if (error)
633 			goto out;
634 
635 		if (node->uid != cur_uid || node->gid != cur_gid) {
636 			node->uid = cur_uid;
637 			node->gid = cur_gid;
638 			node->mode = cur_mode;
639 		}
640 	}
641 
642 	if (vap->va_mode != (mode_t)VNOVAL) {
643 		cur_mode = node->mode;
644 		error = vop_helper_chmod(ap->a_vp, vap->va_mode, ap->a_cred,
645 		    node->uid, node->gid, &cur_mode);
646 		if (error == 0 && node->mode != cur_mode) {
647 			node->mode = cur_mode;
648 		}
649 	}
650 
651 out:
652 	node_sync_dev_set(node);
653 	nanotime(&node->ctime);
654 	lockmgr(&devfs_lock, LK_RELEASE);
655 
656 	return error;
657 }
658 
659 
660 static int
661 devfs_vop_readlink(struct vop_readlink_args *ap)
662 {
663 	struct devfs_node *node = DEVFS_NODE(ap->a_vp);
664 	int ret;
665 
666 	if (!devfs_node_is_accessible(node))
667 		return ENOENT;
668 
669 	lockmgr(&devfs_lock, LK_EXCLUSIVE);
670 	ret = uiomove(node->symlink_name, node->symlink_namelen, ap->a_uio);
671 	lockmgr(&devfs_lock, LK_RELEASE);
672 
673 	return ret;
674 }
675 
676 
677 static int
678 devfs_vop_print(struct vop_print_args *ap)
679 {
680 	return (0);
681 }
682 
683 static int
684 devfs_vop_nmkdir(struct vop_nmkdir_args *ap)
685 {
686 	struct devfs_node *dnode = DEVFS_NODE(ap->a_dvp);
687 	struct devfs_node *node;
688 
689 	if (!devfs_node_is_accessible(dnode))
690 		return ENOENT;
691 
692 	if ((dnode->node_type != Nroot) && (dnode->node_type != Ndir))
693 		goto out;
694 
695 	lockmgr(&devfs_lock, LK_EXCLUSIVE);
696 	devfs_allocvp(ap->a_dvp->v_mount, ap->a_vpp, Ndir,
697 		      ap->a_nch->ncp->nc_name, dnode, NULL);
698 
699 	if (*ap->a_vpp) {
700 		node = DEVFS_NODE(*ap->a_vpp);
701 		node->flags |= DEVFS_USER_CREATED;
702 		cache_setunresolved(ap->a_nch);
703 		cache_setvp(ap->a_nch, *ap->a_vpp);
704 	}
705 	lockmgr(&devfs_lock, LK_RELEASE);
706 out:
707 	return ((*ap->a_vpp == NULL) ? ENOTDIR : 0);
708 }
709 
710 static int
711 devfs_vop_nsymlink(struct vop_nsymlink_args *ap)
712 {
713 	struct devfs_node *dnode = DEVFS_NODE(ap->a_dvp);
714 	struct devfs_node *node;
715 	size_t targetlen;
716 
717 	if (!devfs_node_is_accessible(dnode))
718 		return ENOENT;
719 
720 	ap->a_vap->va_type = VLNK;
721 
722 	if ((dnode->node_type != Nroot) && (dnode->node_type != Ndir))
723 		goto out;
724 
725 	lockmgr(&devfs_lock, LK_EXCLUSIVE);
726 	devfs_allocvp(ap->a_dvp->v_mount, ap->a_vpp, Nlink,
727 		      ap->a_nch->ncp->nc_name, dnode, NULL);
728 
729 	targetlen = strlen(ap->a_target);
730 	if (*ap->a_vpp) {
731 		node = DEVFS_NODE(*ap->a_vpp);
732 		node->flags |= DEVFS_USER_CREATED;
733 		node->symlink_namelen = targetlen;
734 		node->symlink_name = kmalloc(targetlen + 1, M_DEVFS, M_WAITOK);
735 		memcpy(node->symlink_name, ap->a_target, targetlen);
736 		node->symlink_name[targetlen] = '\0';
737 		cache_setunresolved(ap->a_nch);
738 		cache_setvp(ap->a_nch, *ap->a_vpp);
739 	}
740 	lockmgr(&devfs_lock, LK_RELEASE);
741 out:
742 	return ((*ap->a_vpp == NULL) ? ENOTDIR : 0);
743 }
744 
745 static int
746 devfs_vop_nrmdir(struct vop_nrmdir_args *ap)
747 {
748 	struct devfs_node *dnode = DEVFS_NODE(ap->a_dvp);
749 	struct devfs_node *node;
750 	struct namecache *ncp;
751 	int error = ENOENT;
752 
753 	ncp = ap->a_nch->ncp;
754 
755 	if (!devfs_node_is_accessible(dnode))
756 		return ENOENT;
757 
758 	lockmgr(&devfs_lock, LK_EXCLUSIVE);
759 
760 	if ((dnode->node_type != Nroot) && (dnode->node_type != Ndir))
761 		goto out;
762 
763 	TAILQ_FOREACH(node, DEVFS_DENODE_HEAD(dnode), link) {
764 		if (ncp->nc_nlen != node->d_dir.d_namlen)
765 			continue;
766 		if (memcmp(ncp->nc_name, node->d_dir.d_name, ncp->nc_nlen))
767 			continue;
768 
769 		/*
770 		 * only allow removal of user created dirs
771 		 */
772 		if ((node->flags & DEVFS_USER_CREATED) == 0) {
773 			error = EPERM;
774 			goto out;
775 		} else if (node->node_type != Ndir) {
776 			error = ENOTDIR;
777 			goto out;
778 		} else if (node->nchildren > 2) {
779 			error = ENOTEMPTY;
780 			goto out;
781 		} else {
782 			if (node->v_node)
783 				cache_inval_vp(node->v_node, CINV_DESTROY);
784 			devfs_unlinkp(node);
785 			error = 0;
786 			break;
787 		}
788 	}
789 
790 	cache_unlink(ap->a_nch);
791 out:
792 	lockmgr(&devfs_lock, LK_RELEASE);
793 	return error;
794 }
795 
796 static int
797 devfs_vop_nremove(struct vop_nremove_args *ap)
798 {
799 	struct devfs_node *dnode = DEVFS_NODE(ap->a_dvp);
800 	struct devfs_node *node;
801 	struct namecache *ncp;
802 	int error = ENOENT;
803 
804 	ncp = ap->a_nch->ncp;
805 
806 	if (!devfs_node_is_accessible(dnode))
807 		return ENOENT;
808 
809 	lockmgr(&devfs_lock, LK_EXCLUSIVE);
810 
811 	if ((dnode->node_type != Nroot) && (dnode->node_type != Ndir))
812 		goto out;
813 
814 	TAILQ_FOREACH(node, DEVFS_DENODE_HEAD(dnode), link) {
815 		if (ncp->nc_nlen != node->d_dir.d_namlen)
816 			continue;
817 		if (memcmp(ncp->nc_name, node->d_dir.d_name, ncp->nc_nlen))
818 			continue;
819 
820 		/*
821 		 * only allow removal of user created stuff (e.g. symlinks)
822 		 */
823 		if ((node->flags & DEVFS_USER_CREATED) == 0) {
824 			error = EPERM;
825 			goto out;
826 		} else if (node->node_type == Ndir) {
827 			error = EISDIR;
828 			goto out;
829 		} else {
830 			if (node->v_node)
831 				cache_inval_vp(node->v_node, CINV_DESTROY);
832 			devfs_unlinkp(node);
833 			error = 0;
834 			break;
835 		}
836 	}
837 
838 	cache_unlink(ap->a_nch);
839 out:
840 	lockmgr(&devfs_lock, LK_RELEASE);
841 	return error;
842 }
843 
844 
845 static int
846 devfs_spec_open(struct vop_open_args *ap)
847 {
848 	struct vnode *vp = ap->a_vp;
849 	struct vnode *orig_vp = NULL;
850 	struct devfs_node *node = DEVFS_NODE(vp);
851 	struct devfs_node *newnode;
852 	cdev_t dev, ndev = NULL;
853 	int error = 0;
854 
855 	if (node) {
856 		if (node->d_dev == NULL)
857 			return ENXIO;
858 		if (!devfs_node_is_accessible(node))
859 			return ENOENT;
860 	}
861 
862 	if ((dev = vp->v_rdev) == NULL)
863 		return ENXIO;
864 
865 	if (node && ap->a_fp) {
866 		devfs_debug(DEVFS_DEBUG_DEBUG, "devfs_spec_open: -1.1-\n");
867 		lockmgr(&devfs_lock, LK_EXCLUSIVE);
868 
869 		ndev = devfs_clone(dev, node->d_dir.d_name, node->d_dir.d_namlen,
870 						ap->a_mode, ap->a_cred);
871 		if (ndev != NULL) {
872 			newnode = devfs_create_device_node(
873 					DEVFS_MNTDATA(vp->v_mount)->root_node,
874 					ndev, NULL, NULL);
875 			/* XXX: possibly destroy device if this happens */
876 
877 			if (newnode != NULL) {
878 				dev = ndev;
879 				devfs_link_dev(dev);
880 
881 				devfs_debug(DEVFS_DEBUG_DEBUG,
882 						"parent here is: %s, node is: |%s|\n",
883 						((node->parent->node_type == Nroot) ?
884 						"ROOT!" : node->parent->d_dir.d_name),
885 						newnode->d_dir.d_name);
886 				devfs_debug(DEVFS_DEBUG_DEBUG,
887 						"test: %s\n",
888 						((struct devfs_node *)(TAILQ_LAST(DEVFS_DENODE_HEAD(node->parent), devfs_node_head)))->d_dir.d_name);
889 
890 				/*
891 				 * orig_vp is set to the original vp if we cloned.
892 				 */
893 				/* node->flags |= DEVFS_CLONED; */
894 				devfs_allocv(&vp, newnode);
895 				orig_vp = ap->a_vp;
896 				ap->a_vp = vp;
897 			}
898 		}
899 		lockmgr(&devfs_lock, LK_RELEASE);
900 	}
901 
902 	devfs_debug(DEVFS_DEBUG_DEBUG,
903 		    "devfs_spec_open() called on %s! \n",
904 		    dev->si_name);
905 
906 	/*
907 	 * Make this field valid before any I/O in ->d_open
908 	 */
909 	if (!dev->si_iosize_max)
910 		/* XXX: old DFLTPHYS == 64KB dependency */
911 		dev->si_iosize_max = min(MAXPHYS,64*1024);
912 
913 	if (dev_dflags(dev) & D_TTY)
914 		vsetflags(vp, VISTTY);
915 
916 	/*
917 	 * Open underlying device
918 	 */
919 	vn_unlock(vp);
920 	error = dev_dopen(dev, ap->a_mode, S_IFCHR, ap->a_cred);
921 	vn_lock(vp, LK_EXCLUSIVE | LK_RETRY);
922 
923 	/*
924 	 * Clean up any cloned vp if we error out.
925 	 */
926 	if (error) {
927 		if (orig_vp) {
928 			vput(vp);
929 			ap->a_vp = orig_vp;
930 			/* orig_vp = NULL; */
931 		}
932 		return error;
933 	}
934 
935 	/*
936 	 * This checks if the disk device is going to be opened for writing.
937 	 * It will be only allowed in the cases where securelevel permits it
938 	 * and it's not mounted R/W.
939 	 */
940 	if ((dev_dflags(dev) & D_DISK) && (ap->a_mode & FWRITE) &&
941 	    (ap->a_cred != FSCRED)) {
942 
943 		/* Very secure mode. No open for writing allowed */
944 		if (securelevel >= 2)
945 			return EPERM;
946 
947 		/*
948 		 * If it is mounted R/W, do not allow to open for writing.
949 		 * In the case it's mounted read-only but securelevel
950 		 * is >= 1, then do not allow opening for writing either.
951 		 */
952 		if (vfs_mountedon(vp)) {
953 			if (!(dev->si_mountpoint->mnt_flag & MNT_RDONLY))
954 				return EBUSY;
955 			else if (securelevel >= 1)
956 				return EPERM;
957 		}
958 	}
959 
960 	if (dev_dflags(dev) & D_TTY) {
961 		if (dev->si_tty) {
962 			struct tty *tp;
963 			tp = dev->si_tty;
964 			if (!tp->t_stop) {
965 				devfs_debug(DEVFS_DEBUG_DEBUG,
966 					    "devfs: no t_stop\n");
967 				tp->t_stop = nottystop;
968 			}
969 		}
970 	}
971 
972 
973 	if (vn_isdisk(vp, NULL)) {
974 		if (!dev->si_bsize_phys)
975 			dev->si_bsize_phys = DEV_BSIZE;
976 		vinitvmio(vp, IDX_TO_OFF(INT_MAX), PAGE_SIZE, -1);
977 	}
978 
979 	vop_stdopen(ap);
980 #if 0
981 	if (node)
982 		nanotime(&node->atime);
983 #endif
984 
985 	/*
986 	 * If we replaced the vp the vop_stdopen() call will have loaded
987 	 * it into fp->f_data and vref()d the vp, giving us two refs.  So
988 	 * instead of just unlocking it here we have to vput() it.
989 	 */
990 	if (orig_vp)
991 		vput(vp);
992 
993 	/* Ugly pty magic, to make pty devices appear once they are opened */
994 	if (node && (node->flags & DEVFS_PTY) == DEVFS_PTY)
995 		node->flags &= ~DEVFS_INVISIBLE;
996 
997 	if (ap->a_fp) {
998 		KKASSERT(ap->a_fp->f_type == DTYPE_VNODE);
999 		KKASSERT((ap->a_fp->f_flag & FMASK) == (ap->a_mode & FMASK));
1000 		ap->a_fp->f_ops = &devfs_dev_fileops;
1001 		KKASSERT(ap->a_fp->f_data == (void *)vp);
1002 	}
1003 
1004 	return 0;
1005 }
1006 
1007 
1008 static int
1009 devfs_spec_close(struct vop_close_args *ap)
1010 {
1011 	struct devfs_node *node;
1012 	struct proc *p = curproc;
1013 	struct vnode *vp = ap->a_vp;
1014 	cdev_t dev = vp->v_rdev;
1015 	int error = 0;
1016 	int needrelock;
1017 
1018 	if (dev)
1019 		devfs_debug(DEVFS_DEBUG_DEBUG,
1020 			    "devfs_spec_close() called on %s! \n",
1021 			    dev->si_name);
1022 	else
1023 		devfs_debug(DEVFS_DEBUG_DEBUG,
1024 			    "devfs_spec_close() called, null vode!\n");
1025 
1026 	/*
1027 	 * A couple of hacks for devices and tty devices.  The
1028 	 * vnode ref count cannot be used to figure out the
1029 	 * last close, but we can use v_opencount now that
1030 	 * revoke works properly.
1031 	 *
1032 	 * Detect the last close on a controlling terminal and clear
1033 	 * the session (half-close).
1034 	 */
1035 	if (dev)
1036 		reference_dev(dev);
1037 
1038 	if (p && vp->v_opencount <= 1 && vp == p->p_session->s_ttyvp) {
1039 		p->p_session->s_ttyvp = NULL;
1040 		vrele(vp);
1041 	}
1042 
1043 	/*
1044 	 * Vnodes can be opened and closed multiple times.  Do not really
1045 	 * close the device unless (1) it is being closed forcibly,
1046 	 * (2) the device wants to track closes, or (3) this is the last
1047 	 * vnode doing its last close on the device.
1048 	 *
1049 	 * XXX the VXLOCK (force close) case can leave vnodes referencing
1050 	 * a closed device.  This might not occur now that our revoke is
1051 	 * fixed.
1052 	 */
1053 	devfs_debug(DEVFS_DEBUG_DEBUG, "devfs_spec_close() -1- \n");
1054 	if (dev && ((vp->v_flag & VRECLAIMED) ||
1055 	    (dev_dflags(dev) & D_TRACKCLOSE) ||
1056 	    (vp->v_opencount == 1))) {
1057 		/*
1058 		 * Ugly pty magic, to make pty devices disappear again once
1059 		 * they are closed.
1060 		 */
1061 		node = DEVFS_NODE(ap->a_vp);
1062 		if (node && (node->flags & DEVFS_PTY))
1063 			node->flags |= DEVFS_INVISIBLE;
1064 
1065 		/*
1066 		 * Unlock around dev_dclose(), unless the vnode is
1067 		 * undergoing a vgone/reclaim (during umount).
1068 		 */
1069 		needrelock = 0;
1070 		if ((vp->v_flag & VRECLAIMED) == 0 && vn_islocked(vp)) {
1071 			needrelock = 1;
1072 			vn_unlock(vp);
1073 		}
1074 
1075 		/*
1076 		 * WARNING!  If the device destroys itself the devfs node
1077 		 *	     can disappear here.
1078 		 *
1079 		 * WARNING!  vn_lock() will fail if the vp is in a VRECLAIM,
1080 		 *	     which can occur during umount.
1081 		 */
1082 		error = dev_dclose(dev, ap->a_fflag, S_IFCHR);
1083 		/* node is now stale */
1084 
1085 		if (needrelock) {
1086 			if (vn_lock(vp, LK_EXCLUSIVE | LK_RETRY) != 0) {
1087 				panic("devfs_spec_close: vnode %p "
1088 				      "unexpectedly could not be relocked",
1089 				      vp);
1090 			}
1091 		}
1092 	} else {
1093 		error = 0;
1094 	}
1095 	devfs_debug(DEVFS_DEBUG_DEBUG, "devfs_spec_close() -2- \n");
1096 
1097 	/*
1098 	 * Track the actual opens and closes on the vnode.  The last close
1099 	 * disassociates the rdev.  If the rdev is already disassociated or
1100 	 * the opencount is already 0, the vnode might have been revoked
1101 	 * and no further opencount tracking occurs.
1102 	 */
1103 	if (dev)
1104 		release_dev(dev);
1105 	if (vp->v_opencount > 0)
1106 		vop_stdclose(ap);
1107 	return(error);
1108 
1109 }
1110 
1111 
1112 static int
1113 devfs_fo_close(struct file *fp)
1114 {
1115 	struct vnode *vp = (struct vnode *)fp->f_data;
1116 	int error;
1117 
1118 	fp->f_ops = &badfileops;
1119 	error = vn_close(vp, fp->f_flag);
1120 
1121 	return (error);
1122 }
1123 
1124 
1125 /*
1126  * Device-optimized file table vnode read routine.
1127  *
1128  * This bypasses the VOP table and talks directly to the device.  Most
1129  * filesystems just route to specfs and can make this optimization.
1130  *
1131  * MPALMOSTSAFE - acquires mplock
1132  */
1133 static int
1134 devfs_fo_read(struct file *fp, struct uio *uio,
1135 		 struct ucred *cred, int flags)
1136 {
1137 	struct devfs_node *node;
1138 	struct vnode *vp;
1139 	int ioflag;
1140 	int error;
1141 	cdev_t dev;
1142 
1143 	KASSERT(uio->uio_td == curthread,
1144 		("uio_td %p is not td %p", uio->uio_td, curthread));
1145 
1146 	if (uio->uio_resid == 0)
1147 		return 0;
1148 
1149 	vp = (struct vnode *)fp->f_data;
1150 	if (vp == NULL || vp->v_type == VBAD)
1151 		return EBADF;
1152 
1153 	node = DEVFS_NODE(vp);
1154 
1155 	if ((dev = vp->v_rdev) == NULL)
1156 		return EBADF;
1157 
1158 	reference_dev(dev);
1159 
1160 	if ((flags & O_FOFFSET) == 0)
1161 		uio->uio_offset = fp->f_offset;
1162 
1163 	ioflag = 0;
1164 	if (flags & O_FBLOCKING) {
1165 		/* ioflag &= ~IO_NDELAY; */
1166 	} else if (flags & O_FNONBLOCKING) {
1167 		ioflag |= IO_NDELAY;
1168 	} else if (fp->f_flag & FNONBLOCK) {
1169 		ioflag |= IO_NDELAY;
1170 	}
1171 	if (flags & O_FBUFFERED) {
1172 		/* ioflag &= ~IO_DIRECT; */
1173 	} else if (flags & O_FUNBUFFERED) {
1174 		ioflag |= IO_DIRECT;
1175 	} else if (fp->f_flag & O_DIRECT) {
1176 		ioflag |= IO_DIRECT;
1177 	}
1178 	ioflag |= sequential_heuristic(uio, fp);
1179 
1180 	error = dev_dread(dev, uio, ioflag);
1181 
1182 	release_dev(dev);
1183 	if (node)
1184 		nanotime(&node->atime);
1185 	if ((flags & O_FOFFSET) == 0)
1186 		fp->f_offset = uio->uio_offset;
1187 	fp->f_nextoff = uio->uio_offset;
1188 
1189 	return (error);
1190 }
1191 
1192 
1193 static int
1194 devfs_fo_write(struct file *fp, struct uio *uio,
1195 		  struct ucred *cred, int flags)
1196 {
1197 	struct devfs_node *node;
1198 	struct vnode *vp;
1199 	int ioflag;
1200 	int error;
1201 	cdev_t dev;
1202 
1203 	KASSERT(uio->uio_td == curthread,
1204 		("uio_td %p is not p %p", uio->uio_td, curthread));
1205 
1206 	vp = (struct vnode *)fp->f_data;
1207 	if (vp == NULL || vp->v_type == VBAD)
1208 		return EBADF;
1209 
1210 	node = DEVFS_NODE(vp);
1211 
1212 	if (vp->v_type == VREG)
1213 		bwillwrite(uio->uio_resid);
1214 
1215 	vp = (struct vnode *)fp->f_data;
1216 
1217 	if ((dev = vp->v_rdev) == NULL)
1218 		return EBADF;
1219 
1220 	reference_dev(dev);
1221 
1222 	if ((flags & O_FOFFSET) == 0)
1223 		uio->uio_offset = fp->f_offset;
1224 
1225 	ioflag = IO_UNIT;
1226 	if (vp->v_type == VREG &&
1227 	   ((fp->f_flag & O_APPEND) || (flags & O_FAPPEND))) {
1228 		ioflag |= IO_APPEND;
1229 	}
1230 
1231 	if (flags & O_FBLOCKING) {
1232 		/* ioflag &= ~IO_NDELAY; */
1233 	} else if (flags & O_FNONBLOCKING) {
1234 		ioflag |= IO_NDELAY;
1235 	} else if (fp->f_flag & FNONBLOCK) {
1236 		ioflag |= IO_NDELAY;
1237 	}
1238 	if (flags & O_FBUFFERED) {
1239 		/* ioflag &= ~IO_DIRECT; */
1240 	} else if (flags & O_FUNBUFFERED) {
1241 		ioflag |= IO_DIRECT;
1242 	} else if (fp->f_flag & O_DIRECT) {
1243 		ioflag |= IO_DIRECT;
1244 	}
1245 	if (flags & O_FASYNCWRITE) {
1246 		/* ioflag &= ~IO_SYNC; */
1247 	} else if (flags & O_FSYNCWRITE) {
1248 		ioflag |= IO_SYNC;
1249 	} else if (fp->f_flag & O_FSYNC) {
1250 		ioflag |= IO_SYNC;
1251 	}
1252 
1253 	if (vp->v_mount && (vp->v_mount->mnt_flag & MNT_SYNCHRONOUS))
1254 		ioflag |= IO_SYNC;
1255 	ioflag |= sequential_heuristic(uio, fp);
1256 
1257 	error = dev_dwrite(dev, uio, ioflag);
1258 
1259 	release_dev(dev);
1260 	if (node) {
1261 		nanotime(&node->atime);
1262 		nanotime(&node->mtime);
1263 	}
1264 
1265 	if ((flags & O_FOFFSET) == 0)
1266 		fp->f_offset = uio->uio_offset;
1267 	fp->f_nextoff = uio->uio_offset;
1268 
1269 	return (error);
1270 }
1271 
1272 
1273 static int
1274 devfs_fo_stat(struct file *fp, struct stat *sb, struct ucred *cred)
1275 {
1276 	struct vnode *vp;
1277 	struct vattr vattr;
1278 	struct vattr *vap;
1279 	u_short mode;
1280 	cdev_t dev;
1281 	int error;
1282 
1283 	vp = (struct vnode *)fp->f_data;
1284 	if (vp == NULL || vp->v_type == VBAD)
1285 		return EBADF;
1286 
1287 	error = vn_stat(vp, sb, cred);
1288 	if (error)
1289 		return (error);
1290 
1291 	vap = &vattr;
1292 	error = VOP_GETATTR(vp, vap);
1293 	if (error)
1294 		return (error);
1295 
1296 	/*
1297 	 * Zero the spare stat fields
1298 	 */
1299 	sb->st_lspare = 0;
1300 	sb->st_qspare1 = 0;
1301 	sb->st_qspare2 = 0;
1302 
1303 	/*
1304 	 * Copy from vattr table ... or not in case it's a cloned device
1305 	 */
1306 	if (vap->va_fsid != VNOVAL)
1307 		sb->st_dev = vap->va_fsid;
1308 	else
1309 		sb->st_dev = vp->v_mount->mnt_stat.f_fsid.val[0];
1310 
1311 	sb->st_ino = vap->va_fileid;
1312 
1313 	mode = vap->va_mode;
1314 	mode |= S_IFCHR;
1315 	sb->st_mode = mode;
1316 
1317 	if (vap->va_nlink > (nlink_t)-1)
1318 		sb->st_nlink = (nlink_t)-1;
1319 	else
1320 		sb->st_nlink = vap->va_nlink;
1321 
1322 	sb->st_uid = vap->va_uid;
1323 	sb->st_gid = vap->va_gid;
1324 	sb->st_rdev = dev2udev(DEVFS_NODE(vp)->d_dev);
1325 	sb->st_size = vap->va_bytes;
1326 	sb->st_atimespec = vap->va_atime;
1327 	sb->st_mtimespec = vap->va_mtime;
1328 	sb->st_ctimespec = vap->va_ctime;
1329 
1330 	/*
1331 	 * A VCHR and VBLK device may track the last access and last modified
1332 	 * time independantly of the filesystem.  This is particularly true
1333 	 * because device read and write calls may bypass the filesystem.
1334 	 */
1335 	if (vp->v_type == VCHR || vp->v_type == VBLK) {
1336 		dev = vp->v_rdev;
1337 		if (dev != NULL) {
1338 			if (dev->si_lastread) {
1339 				sb->st_atimespec.tv_sec = dev->si_lastread;
1340 				sb->st_atimespec.tv_nsec = 0;
1341 			}
1342 			if (dev->si_lastwrite) {
1343 				sb->st_atimespec.tv_sec = dev->si_lastwrite;
1344 				sb->st_atimespec.tv_nsec = 0;
1345 			}
1346 		}
1347 	}
1348 
1349         /*
1350 	 * According to www.opengroup.org, the meaning of st_blksize is
1351 	 *   "a filesystem-specific preferred I/O block size for this
1352 	 *    object.  In some filesystem types, this may vary from file
1353 	 *    to file"
1354 	 * Default to PAGE_SIZE after much discussion.
1355 	 */
1356 
1357 	sb->st_blksize = PAGE_SIZE;
1358 
1359 	sb->st_flags = vap->va_flags;
1360 
1361 	error = priv_check_cred(cred, PRIV_VFS_GENERATION, 0);
1362 	if (error)
1363 		sb->st_gen = 0;
1364 	else
1365 		sb->st_gen = (u_int32_t)vap->va_gen;
1366 
1367 	sb->st_blocks = vap->va_bytes / S_BLKSIZE;
1368 
1369 	return (0);
1370 }
1371 
1372 
1373 static int
1374 devfs_fo_kqfilter(struct file *fp, struct knote *kn)
1375 {
1376 	struct vnode *vp;
1377 	int error;
1378 	cdev_t dev;
1379 
1380 	vp = (struct vnode *)fp->f_data;
1381 	if (vp == NULL || vp->v_type == VBAD) {
1382 		error = EBADF;
1383 		goto done;
1384 	}
1385 	if ((dev = vp->v_rdev) == NULL) {
1386 		error = EBADF;
1387 		goto done;
1388 	}
1389 	reference_dev(dev);
1390 
1391 	error = dev_dkqfilter(dev, kn);
1392 
1393 	release_dev(dev);
1394 
1395 done:
1396 	return (error);
1397 }
1398 
1399 /*
1400  * MPALMOSTSAFE - acquires mplock
1401  */
1402 static int
1403 devfs_fo_ioctl(struct file *fp, u_long com, caddr_t data,
1404 		  struct ucred *ucred, struct sysmsg *msg)
1405 {
1406 #if 0
1407 	struct devfs_node *node;
1408 #endif
1409 	struct vnode *vp;
1410 	struct vnode *ovp;
1411 	cdev_t	dev;
1412 	int error;
1413 	struct fiodname_args *name_args;
1414 	size_t namlen;
1415 	const char *name;
1416 
1417 	vp = ((struct vnode *)fp->f_data);
1418 
1419 	if ((dev = vp->v_rdev) == NULL)
1420 		return EBADF;		/* device was revoked */
1421 
1422 	reference_dev(dev);
1423 
1424 #if 0
1425 	node = DEVFS_NODE(vp);
1426 #endif
1427 
1428 	devfs_debug(DEVFS_DEBUG_DEBUG,
1429 		    "devfs_fo_ioctl() called! for dev %s\n",
1430 		    dev->si_name);
1431 
1432 	if (com == FIODTYPE) {
1433 		*(int *)data = dev_dflags(dev) & D_TYPEMASK;
1434 		error = 0;
1435 		goto out;
1436 	} else if (com == FIODNAME) {
1437 		name_args = (struct fiodname_args *)data;
1438 		name = dev->si_name;
1439 		namlen = strlen(name) + 1;
1440 
1441 		devfs_debug(DEVFS_DEBUG_DEBUG,
1442 			    "ioctl, got: FIODNAME for %s\n", name);
1443 
1444 		if (namlen <= name_args->len)
1445 			error = copyout(dev->si_name, name_args->name, namlen);
1446 		else
1447 			error = EINVAL;
1448 
1449 		devfs_debug(DEVFS_DEBUG_DEBUG,
1450 			    "ioctl stuff: error: %d\n", error);
1451 		goto out;
1452 	}
1453 
1454 	error = dev_dioctl(dev, com, data, fp->f_flag, ucred, msg);
1455 
1456 #if 0
1457 	if (node) {
1458 		nanotime(&node->atime);
1459 		nanotime(&node->mtime);
1460 	}
1461 #endif
1462 	if (com == TIOCSCTTY) {
1463 		devfs_debug(DEVFS_DEBUG_DEBUG,
1464 			    "devfs_fo_ioctl: got TIOCSCTTY on %s\n",
1465 			    dev->si_name);
1466 	}
1467 	if (error == 0 && com == TIOCSCTTY) {
1468 		struct proc *p = curthread->td_proc;
1469 		struct session *sess;
1470 
1471 		devfs_debug(DEVFS_DEBUG_DEBUG,
1472 			    "devfs_fo_ioctl: dealing with TIOCSCTTY on %s\n",
1473 			    dev->si_name);
1474 		if (p == NULL) {
1475 			error = ENOTTY;
1476 			goto out;
1477 		}
1478 		sess = p->p_session;
1479 
1480 		/*
1481 		 * Do nothing if reassigning same control tty
1482 		 */
1483 		if (sess->s_ttyvp == vp) {
1484 			error = 0;
1485 			goto out;
1486 		}
1487 
1488 		/*
1489 		 * Get rid of reference to old control tty
1490 		 */
1491 		ovp = sess->s_ttyvp;
1492 		vref(vp);
1493 		sess->s_ttyvp = vp;
1494 		if (ovp)
1495 			vrele(ovp);
1496 	}
1497 
1498 out:
1499 	release_dev(dev);
1500 	devfs_debug(DEVFS_DEBUG_DEBUG, "devfs_fo_ioctl() finished! \n");
1501 	return (error);
1502 }
1503 
1504 
1505 static int
1506 devfs_spec_fsync(struct vop_fsync_args *ap)
1507 {
1508 	struct vnode *vp = ap->a_vp;
1509 	int error;
1510 
1511 	if (!vn_isdisk(vp, NULL))
1512 		return (0);
1513 
1514 	/*
1515 	 * Flush all dirty buffers associated with a block device.
1516 	 */
1517 	error = vfsync(vp, ap->a_waitfor, 10000, NULL, NULL);
1518 	return (error);
1519 }
1520 
1521 static int
1522 devfs_spec_read(struct vop_read_args *ap)
1523 {
1524 	struct devfs_node *node;
1525 	struct vnode *vp;
1526 	struct uio *uio;
1527 	cdev_t dev;
1528 	int error;
1529 
1530 	vp = ap->a_vp;
1531 	dev = vp->v_rdev;
1532 	uio = ap->a_uio;
1533 	node = DEVFS_NODE(vp);
1534 
1535 	if (dev == NULL)		/* device was revoked */
1536 		return (EBADF);
1537 	if (uio->uio_resid == 0)
1538 		return (0);
1539 
1540 	vn_unlock(vp);
1541 	error = dev_dread(dev, uio, ap->a_ioflag);
1542 	vn_lock(vp, LK_EXCLUSIVE | LK_RETRY);
1543 
1544 	if (node)
1545 		nanotime(&node->atime);
1546 
1547 	return (error);
1548 }
1549 
1550 /*
1551  * Vnode op for write
1552  *
1553  * spec_write(struct vnode *a_vp, struct uio *a_uio, int a_ioflag,
1554  *	      struct ucred *a_cred)
1555  */
1556 static int
1557 devfs_spec_write(struct vop_write_args *ap)
1558 {
1559 	struct devfs_node *node;
1560 	struct vnode *vp;
1561 	struct uio *uio;
1562 	cdev_t dev;
1563 	int error;
1564 
1565 	vp = ap->a_vp;
1566 	dev = vp->v_rdev;
1567 	uio = ap->a_uio;
1568 	node = DEVFS_NODE(vp);
1569 
1570 	KKASSERT(uio->uio_segflg != UIO_NOCOPY);
1571 
1572 	if (dev == NULL)		/* device was revoked */
1573 		return (EBADF);
1574 
1575 	vn_unlock(vp);
1576 	error = dev_dwrite(dev, uio, ap->a_ioflag);
1577 	vn_lock(vp, LK_EXCLUSIVE | LK_RETRY);
1578 
1579 	if (node) {
1580 		nanotime(&node->atime);
1581 		nanotime(&node->mtime);
1582 	}
1583 
1584 	return (error);
1585 }
1586 
1587 /*
1588  * Device ioctl operation.
1589  *
1590  * spec_ioctl(struct vnode *a_vp, int a_command, caddr_t a_data,
1591  *	      int a_fflag, struct ucred *a_cred, struct sysmsg *msg)
1592  */
1593 static int
1594 devfs_spec_ioctl(struct vop_ioctl_args *ap)
1595 {
1596 	struct vnode *vp = ap->a_vp;
1597 #if 0
1598 	struct devfs_node *node;
1599 #endif
1600 	cdev_t dev;
1601 
1602 	if ((dev = vp->v_rdev) == NULL)
1603 		return (EBADF);		/* device was revoked */
1604 #if 0
1605 	node = DEVFS_NODE(vp);
1606 
1607 	if (node) {
1608 		nanotime(&node->atime);
1609 		nanotime(&node->mtime);
1610 	}
1611 #endif
1612 
1613 	return (dev_dioctl(dev, ap->a_command, ap->a_data, ap->a_fflag,
1614 			   ap->a_cred, ap->a_sysmsg));
1615 }
1616 
1617 /*
1618  * spec_kqfilter(struct vnode *a_vp, struct knote *a_kn)
1619  */
1620 /* ARGSUSED */
1621 static int
1622 devfs_spec_kqfilter(struct vop_kqfilter_args *ap)
1623 {
1624 	struct vnode *vp = ap->a_vp;
1625 #if 0
1626 	struct devfs_node *node;
1627 #endif
1628 	cdev_t dev;
1629 
1630 	if ((dev = vp->v_rdev) == NULL)
1631 		return (EBADF);		/* device was revoked (EBADF) */
1632 #if 0
1633 	node = DEVFS_NODE(vp);
1634 
1635 	if (node)
1636 		nanotime(&node->atime);
1637 #endif
1638 
1639 	return (dev_dkqfilter(dev, ap->a_kn));
1640 }
1641 
1642 /*
1643  * Convert a vnode strategy call into a device strategy call.  Vnode strategy
1644  * calls are not limited to device DMA limits so we have to deal with the
1645  * case.
1646  *
1647  * spec_strategy(struct vnode *a_vp, struct bio *a_bio)
1648  */
1649 static int
1650 devfs_spec_strategy(struct vop_strategy_args *ap)
1651 {
1652 	struct bio *bio = ap->a_bio;
1653 	struct buf *bp = bio->bio_buf;
1654 	struct buf *nbp;
1655 	struct vnode *vp;
1656 	struct mount *mp;
1657 	int chunksize;
1658 	int maxiosize;
1659 
1660 	if (bp->b_cmd != BUF_CMD_READ && LIST_FIRST(&bp->b_dep) != NULL)
1661 		buf_start(bp);
1662 
1663 	/*
1664 	 * Collect statistics on synchronous and asynchronous read
1665 	 * and write counts for disks that have associated filesystems.
1666 	 */
1667 	vp = ap->a_vp;
1668 	KKASSERT(vp->v_rdev != NULL);	/* XXX */
1669 	if (vn_isdisk(vp, NULL) && (mp = vp->v_rdev->si_mountpoint) != NULL) {
1670 		if (bp->b_cmd == BUF_CMD_READ) {
1671 			if (bp->b_flags & BIO_SYNC)
1672 				mp->mnt_stat.f_syncreads++;
1673 			else
1674 				mp->mnt_stat.f_asyncreads++;
1675 		} else {
1676 			if (bp->b_flags & BIO_SYNC)
1677 				mp->mnt_stat.f_syncwrites++;
1678 			else
1679 				mp->mnt_stat.f_asyncwrites++;
1680 		}
1681 	}
1682 
1683         /*
1684          * Device iosize limitations only apply to read and write.  Shortcut
1685          * the I/O if it fits.
1686          */
1687 	if ((maxiosize = vp->v_rdev->si_iosize_max) == 0) {
1688 		devfs_debug(DEVFS_DEBUG_DEBUG,
1689 			    "%s: si_iosize_max not set!\n",
1690 			    dev_dname(vp->v_rdev));
1691 		maxiosize = MAXPHYS;
1692 	}
1693 #if SPEC_CHAIN_DEBUG & 2
1694 	maxiosize = 4096;
1695 #endif
1696         if (bp->b_bcount <= maxiosize ||
1697             (bp->b_cmd != BUF_CMD_READ && bp->b_cmd != BUF_CMD_WRITE)) {
1698                 dev_dstrategy_chain(vp->v_rdev, bio);
1699                 return (0);
1700         }
1701 
1702 	/*
1703 	 * Clone the buffer and set up an I/O chain to chunk up the I/O.
1704 	 */
1705 	nbp = kmalloc(sizeof(*bp), M_DEVBUF, M_INTWAIT|M_ZERO);
1706 	initbufbio(nbp);
1707 	buf_dep_init(nbp);
1708 	BUF_LOCK(nbp, LK_EXCLUSIVE);
1709 	BUF_KERNPROC(nbp);
1710 	nbp->b_vp = vp;
1711 	nbp->b_flags = B_PAGING | (bp->b_flags & B_BNOCLIP);
1712 	nbp->b_data = bp->b_data;
1713 	nbp->b_bio1.bio_done = devfs_spec_strategy_done;
1714 	nbp->b_bio1.bio_offset = bio->bio_offset;
1715 	nbp->b_bio1.bio_caller_info1.ptr = bio;
1716 
1717 	/*
1718 	 * Start the first transfer
1719 	 */
1720 	if (vn_isdisk(vp, NULL))
1721 		chunksize = vp->v_rdev->si_bsize_phys;
1722 	else
1723 		chunksize = DEV_BSIZE;
1724 	chunksize = maxiosize / chunksize * chunksize;
1725 #if SPEC_CHAIN_DEBUG & 1
1726 	devfs_debug(DEVFS_DEBUG_DEBUG,
1727 		    "spec_strategy chained I/O chunksize=%d\n",
1728 		    chunksize);
1729 #endif
1730 	nbp->b_cmd = bp->b_cmd;
1731 	nbp->b_bcount = chunksize;
1732 	nbp->b_bufsize = chunksize;	/* used to detect a short I/O */
1733 	nbp->b_bio1.bio_caller_info2.index = chunksize;
1734 
1735 #if SPEC_CHAIN_DEBUG & 1
1736 	devfs_debug(DEVFS_DEBUG_DEBUG,
1737 		    "spec_strategy: chain %p offset %d/%d bcount %d\n",
1738 		    bp, 0, bp->b_bcount, nbp->b_bcount);
1739 #endif
1740 
1741 	dev_dstrategy(vp->v_rdev, &nbp->b_bio1);
1742 
1743 	if (DEVFS_NODE(vp)) {
1744 		nanotime(&DEVFS_NODE(vp)->atime);
1745 		nanotime(&DEVFS_NODE(vp)->mtime);
1746 	}
1747 
1748 	return (0);
1749 }
1750 
1751 /*
1752  * Chunked up transfer completion routine - chain transfers until done
1753  *
1754  * NOTE: MPSAFE callback.
1755  */
1756 static
1757 void
1758 devfs_spec_strategy_done(struct bio *nbio)
1759 {
1760 	struct buf *nbp = nbio->bio_buf;
1761 	struct bio *bio = nbio->bio_caller_info1.ptr;	/* original bio */
1762 	struct buf *bp = bio->bio_buf;			/* original bp */
1763 	int chunksize = nbio->bio_caller_info2.index;	/* chunking */
1764 	int boffset = nbp->b_data - bp->b_data;
1765 
1766 	if (nbp->b_flags & B_ERROR) {
1767 		/*
1768 		 * An error terminates the chain, propogate the error back
1769 		 * to the original bp
1770 		 */
1771 		bp->b_flags |= B_ERROR;
1772 		bp->b_error = nbp->b_error;
1773 		bp->b_resid = bp->b_bcount - boffset +
1774 			      (nbp->b_bcount - nbp->b_resid);
1775 #if SPEC_CHAIN_DEBUG & 1
1776 		devfs_debug(DEVFS_DEBUG_DEBUG,
1777 			    "spec_strategy: chain %p error %d bcount %d/%d\n",
1778 			    bp, bp->b_error, bp->b_bcount,
1779 			    bp->b_bcount - bp->b_resid);
1780 #endif
1781 	} else if (nbp->b_resid) {
1782 		/*
1783 		 * A short read or write terminates the chain
1784 		 */
1785 		bp->b_error = nbp->b_error;
1786 		bp->b_resid = bp->b_bcount - boffset +
1787 			      (nbp->b_bcount - nbp->b_resid);
1788 #if SPEC_CHAIN_DEBUG & 1
1789 		devfs_debug(DEVFS_DEBUG_DEBUG,
1790 			    "spec_strategy: chain %p short read(1) "
1791 			    "bcount %d/%d\n",
1792 			    bp, bp->b_bcount - bp->b_resid, bp->b_bcount);
1793 #endif
1794 	} else if (nbp->b_bcount != nbp->b_bufsize) {
1795 		/*
1796 		 * A short read or write can also occur by truncating b_bcount
1797 		 */
1798 #if SPEC_CHAIN_DEBUG & 1
1799 		devfs_debug(DEVFS_DEBUG_DEBUG,
1800 			    "spec_strategy: chain %p short read(2) "
1801 			    "bcount %d/%d\n",
1802 			    bp, nbp->b_bcount + boffset, bp->b_bcount);
1803 #endif
1804 		bp->b_error = 0;
1805 		bp->b_bcount = nbp->b_bcount + boffset;
1806 		bp->b_resid = nbp->b_resid;
1807 	} else if (nbp->b_bcount + boffset == bp->b_bcount) {
1808 		/*
1809 		 * No more data terminates the chain
1810 		 */
1811 #if SPEC_CHAIN_DEBUG & 1
1812 		devfs_debug(DEVFS_DEBUG_DEBUG,
1813 			    "spec_strategy: chain %p finished bcount %d\n",
1814 			    bp, bp->b_bcount);
1815 #endif
1816 		bp->b_error = 0;
1817 		bp->b_resid = 0;
1818 	} else {
1819 		/*
1820 		 * Continue the chain
1821 		 */
1822 		boffset += nbp->b_bcount;
1823 		nbp->b_data = bp->b_data + boffset;
1824 		nbp->b_bcount = bp->b_bcount - boffset;
1825 		if (nbp->b_bcount > chunksize)
1826 			nbp->b_bcount = chunksize;
1827 		nbp->b_bio1.bio_done = devfs_spec_strategy_done;
1828 		nbp->b_bio1.bio_offset = bio->bio_offset + boffset;
1829 
1830 #if SPEC_CHAIN_DEBUG & 1
1831 		devfs_debug(DEVFS_DEBUG_DEBUG,
1832 			    "spec_strategy: chain %p offset %d/%d bcount %d\n",
1833 			    bp, boffset, bp->b_bcount, nbp->b_bcount);
1834 #endif
1835 
1836 		dev_dstrategy(nbp->b_vp->v_rdev, &nbp->b_bio1);
1837 		return;
1838 	}
1839 
1840 	/*
1841 	 * Fall through to here on termination.  biodone(bp) and
1842 	 * clean up and free nbp.
1843 	 */
1844 	biodone(bio);
1845 	BUF_UNLOCK(nbp);
1846 	uninitbufbio(nbp);
1847 	kfree(nbp, M_DEVBUF);
1848 }
1849 
1850 /*
1851  * spec_freeblks(struct vnode *a_vp, daddr_t a_addr, daddr_t a_length)
1852  */
1853 static int
1854 devfs_spec_freeblks(struct vop_freeblks_args *ap)
1855 {
1856 	struct buf *bp;
1857 
1858 	/*
1859 	 * XXX: This assumes that strategy does the deed right away.
1860 	 * XXX: this may not be TRTTD.
1861 	 */
1862 	KKASSERT(ap->a_vp->v_rdev != NULL);
1863 	if ((ap->a_vp->v_rdev->si_flags & SI_CANFREE) == 0)
1864 		return (0);
1865 	bp = geteblk(ap->a_length);
1866 	bp->b_cmd = BUF_CMD_FREEBLKS;
1867 	bp->b_bio1.bio_offset = ap->a_offset;
1868 	bp->b_bcount = ap->a_length;
1869 	dev_dstrategy(ap->a_vp->v_rdev, &bp->b_bio1);
1870 	return (0);
1871 }
1872 
1873 /*
1874  * Implement degenerate case where the block requested is the block
1875  * returned, and assume that the entire device is contiguous in regards
1876  * to the contiguous block range (runp and runb).
1877  *
1878  * spec_bmap(struct vnode *a_vp, off_t a_loffset,
1879  *	     off_t *a_doffsetp, int *a_runp, int *a_runb)
1880  */
1881 static int
1882 devfs_spec_bmap(struct vop_bmap_args *ap)
1883 {
1884 	if (ap->a_doffsetp != NULL)
1885 		*ap->a_doffsetp = ap->a_loffset;
1886 	if (ap->a_runp != NULL)
1887 		*ap->a_runp = MAXBSIZE;
1888 	if (ap->a_runb != NULL) {
1889 		if (ap->a_loffset < MAXBSIZE)
1890 			*ap->a_runb = (int)ap->a_loffset;
1891 		else
1892 			*ap->a_runb = MAXBSIZE;
1893 	}
1894 	return (0);
1895 }
1896 
1897 
1898 /*
1899  * Special device advisory byte-level locks.
1900  *
1901  * spec_advlock(struct vnode *a_vp, caddr_t a_id, int a_op,
1902  *		struct flock *a_fl, int a_flags)
1903  */
1904 /* ARGSUSED */
1905 static int
1906 devfs_spec_advlock(struct vop_advlock_args *ap)
1907 {
1908 	return ((ap->a_flags & F_POSIX) ? EINVAL : EOPNOTSUPP);
1909 }
1910 
1911 /*
1912  * NOTE: MPSAFE callback.
1913  */
1914 static void
1915 devfs_spec_getpages_iodone(struct bio *bio)
1916 {
1917 	bio->bio_buf->b_cmd = BUF_CMD_DONE;
1918 	wakeup(bio->bio_buf);
1919 }
1920 
1921 /*
1922  * spec_getpages() - get pages associated with device vnode.
1923  *
1924  * Note that spec_read and spec_write do not use the buffer cache, so we
1925  * must fully implement getpages here.
1926  */
1927 static int
1928 devfs_spec_getpages(struct vop_getpages_args *ap)
1929 {
1930 	vm_offset_t kva;
1931 	int error;
1932 	int i, pcount, size;
1933 	struct buf *bp;
1934 	vm_page_t m;
1935 	vm_ooffset_t offset;
1936 	int toff, nextoff, nread;
1937 	struct vnode *vp = ap->a_vp;
1938 	int blksiz;
1939 	int gotreqpage;
1940 
1941 	error = 0;
1942 	pcount = round_page(ap->a_count) / PAGE_SIZE;
1943 
1944 	/*
1945 	 * Calculate the offset of the transfer and do sanity check.
1946 	 */
1947 	offset = IDX_TO_OFF(ap->a_m[0]->pindex) + ap->a_offset;
1948 
1949 	/*
1950 	 * Round up physical size for real devices.  We cannot round using
1951 	 * v_mount's block size data because v_mount has nothing to do with
1952 	 * the device.  i.e. it's usually '/dev'.  We need the physical block
1953 	 * size for the device itself.
1954 	 *
1955 	 * We can't use v_rdev->si_mountpoint because it only exists when the
1956 	 * block device is mounted.  However, we can use v_rdev.
1957 	 */
1958 	if (vn_isdisk(vp, NULL))
1959 		blksiz = vp->v_rdev->si_bsize_phys;
1960 	else
1961 		blksiz = DEV_BSIZE;
1962 
1963 	size = (ap->a_count + blksiz - 1) & ~(blksiz - 1);
1964 
1965 	bp = getpbuf_kva(NULL);
1966 	kva = (vm_offset_t)bp->b_data;
1967 
1968 	/*
1969 	 * Map the pages to be read into the kva.
1970 	 */
1971 	pmap_qenter(kva, ap->a_m, pcount);
1972 
1973 	/* Build a minimal buffer header. */
1974 	bp->b_cmd = BUF_CMD_READ;
1975 	bp->b_bcount = size;
1976 	bp->b_resid = 0;
1977 	bsetrunningbufspace(bp, size);
1978 
1979 	bp->b_bio1.bio_offset = offset;
1980 	bp->b_bio1.bio_done = devfs_spec_getpages_iodone;
1981 
1982 	mycpu->gd_cnt.v_vnodein++;
1983 	mycpu->gd_cnt.v_vnodepgsin += pcount;
1984 
1985 	/* Do the input. */
1986 	vn_strategy(ap->a_vp, &bp->b_bio1);
1987 
1988 	crit_enter();
1989 
1990 	/* We definitely need to be at splbio here. */
1991 	while (bp->b_cmd != BUF_CMD_DONE)
1992 		tsleep(bp, 0, "spread", 0);
1993 
1994 	crit_exit();
1995 
1996 	if (bp->b_flags & B_ERROR) {
1997 		if (bp->b_error)
1998 			error = bp->b_error;
1999 		else
2000 			error = EIO;
2001 	}
2002 
2003 	/*
2004 	 * If EOF is encountered we must zero-extend the result in order
2005 	 * to ensure that the page does not contain garabge.  When no
2006 	 * error occurs, an early EOF is indicated if b_bcount got truncated.
2007 	 * b_resid is relative to b_bcount and should be 0, but some devices
2008 	 * might indicate an EOF with b_resid instead of truncating b_bcount.
2009 	 */
2010 	nread = bp->b_bcount - bp->b_resid;
2011 	if (nread < ap->a_count)
2012 		bzero((caddr_t)kva + nread, ap->a_count - nread);
2013 	pmap_qremove(kva, pcount);
2014 
2015 	gotreqpage = 0;
2016 	for (i = 0, toff = 0; i < pcount; i++, toff = nextoff) {
2017 		nextoff = toff + PAGE_SIZE;
2018 		m = ap->a_m[i];
2019 
2020 		m->flags &= ~PG_ZERO;
2021 
2022 		/*
2023 		 * NOTE: vm_page_undirty/clear_dirty etc do not clear the
2024 		 *	 pmap modified bit.  pmap modified bit should have
2025 		 *	 already been cleared.
2026 		 */
2027 		if (nextoff <= nread) {
2028 			m->valid = VM_PAGE_BITS_ALL;
2029 			vm_page_undirty(m);
2030 		} else if (toff < nread) {
2031 			/*
2032 			 * Since this is a VM request, we have to supply the
2033 			 * unaligned offset to allow vm_page_set_valid()
2034 			 * to zero sub-DEV_BSIZE'd portions of the page.
2035 			 */
2036 			vm_page_set_valid(m, 0, nread - toff);
2037 			vm_page_clear_dirty_end_nonincl(m, 0, nread - toff);
2038 		} else {
2039 			m->valid = 0;
2040 			vm_page_undirty(m);
2041 		}
2042 
2043 		if (i != ap->a_reqpage) {
2044 			/*
2045 			 * Just in case someone was asking for this page we
2046 			 * now tell them that it is ok to use.
2047 			 */
2048 			if (!error || (m->valid == VM_PAGE_BITS_ALL)) {
2049 				if (m->valid) {
2050 					if (m->flags & PG_REFERENCED) {
2051 						vm_page_activate(m);
2052 					} else {
2053 						vm_page_deactivate(m);
2054 					}
2055 					vm_page_wakeup(m);
2056 				} else {
2057 					vm_page_free(m);
2058 				}
2059 			} else {
2060 				vm_page_free(m);
2061 			}
2062 		} else if (m->valid) {
2063 			gotreqpage = 1;
2064 			/*
2065 			 * Since this is a VM request, we need to make the
2066 			 * entire page presentable by zeroing invalid sections.
2067 			 */
2068 			if (m->valid != VM_PAGE_BITS_ALL)
2069 			    vm_page_zero_invalid(m, FALSE);
2070 		}
2071 	}
2072 	if (!gotreqpage) {
2073 		m = ap->a_m[ap->a_reqpage];
2074 		devfs_debug(DEVFS_DEBUG_WARNING,
2075 	    "spec_getpages:(%s) I/O read failure: (error=%d) bp %p vp %p\n",
2076 			devtoname(vp->v_rdev), error, bp, bp->b_vp);
2077 		devfs_debug(DEVFS_DEBUG_WARNING,
2078 	    "               size: %d, resid: %d, a_count: %d, valid: 0x%x\n",
2079 		    size, bp->b_resid, ap->a_count, m->valid);
2080 		devfs_debug(DEVFS_DEBUG_WARNING,
2081 	    "               nread: %d, reqpage: %d, pindex: %lu, pcount: %d\n",
2082 		    nread, ap->a_reqpage, (u_long)m->pindex, pcount);
2083 		/*
2084 		 * Free the buffer header back to the swap buffer pool.
2085 		 */
2086 		relpbuf(bp, NULL);
2087 		return VM_PAGER_ERROR;
2088 	}
2089 	/*
2090 	 * Free the buffer header back to the swap buffer pool.
2091 	 */
2092 	relpbuf(bp, NULL);
2093 	if (DEVFS_NODE(ap->a_vp))
2094 		nanotime(&DEVFS_NODE(ap->a_vp)->mtime);
2095 	return VM_PAGER_OK;
2096 }
2097 
2098 static __inline
2099 int
2100 sequential_heuristic(struct uio *uio, struct file *fp)
2101 {
2102 	/*
2103 	 * Sequential heuristic - detect sequential operation
2104 	 */
2105 	if ((uio->uio_offset == 0 && fp->f_seqcount > 0) ||
2106 	    uio->uio_offset == fp->f_nextoff) {
2107 		/*
2108 		 * XXX we assume that the filesystem block size is
2109 		 * the default.  Not true, but still gives us a pretty
2110 		 * good indicator of how sequential the read operations
2111 		 * are.
2112 		 */
2113 		int tmpseq = fp->f_seqcount;
2114 
2115 		tmpseq += (uio->uio_resid + BKVASIZE - 1) / BKVASIZE;
2116 		if (tmpseq > IO_SEQMAX)
2117 			tmpseq = IO_SEQMAX;
2118 		fp->f_seqcount = tmpseq;
2119 		return(fp->f_seqcount << IO_SEQSHIFT);
2120 	}
2121 
2122 	/*
2123 	 * Not sequential, quick draw-down of seqcount
2124 	 */
2125 	if (fp->f_seqcount > 1)
2126 		fp->f_seqcount = 1;
2127 	else
2128 		fp->f_seqcount = 0;
2129 	return(0);
2130 }
2131