xref: /freebsd/sys/fs/devfs/devfs_vnops.c (revision aa0a1e58)
1 /*-
2  * Copyright (c) 2000-2004
3  *	Poul-Henning Kamp.  All rights reserved.
4  * Copyright (c) 1989, 1992-1993, 1995
5  *	The Regents of the University of California.  All rights reserved.
6  *
7  * This code is derived from software donated to Berkeley by
8  * Jan-Simon Pendry.
9  *
10  * Redistribution and use in source and binary forms, with or without
11  * modification, are permitted provided that the following conditions
12  * are met:
13  * 1. Redistributions of source code must retain the above copyright
14  *    notice, this list of conditions and the following disclaimer.
15  * 2. Neither the name of the University nor the names of its contributors
16  *    may be used to endorse or promote products derived from this software
17  *    without specific prior written permission.
18  *
19  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
20  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
21  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
22  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
23  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
24  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
25  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
26  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
27  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
28  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
29  * SUCH DAMAGE.
30  *
31  *	@(#)kernfs_vnops.c	8.15 (Berkeley) 5/21/95
32  * From: FreeBSD: src/sys/miscfs/kernfs/kernfs_vnops.c 1.43
33  *
34  * $FreeBSD$
35  */
36 
37 /*
38  * TODO:
39  *	mkdir: want it ?
40  */
41 
42 #include <sys/param.h>
43 #include <sys/systm.h>
44 #include <sys/conf.h>
45 #include <sys/dirent.h>
46 #include <sys/fcntl.h>
47 #include <sys/file.h>
48 #include <sys/filedesc.h>
49 #include <sys/filio.h>
50 #include <sys/jail.h>
51 #include <sys/kernel.h>
52 #include <sys/lock.h>
53 #include <sys/malloc.h>
54 #include <sys/mount.h>
55 #include <sys/namei.h>
56 #include <sys/priv.h>
57 #include <sys/proc.h>
58 #include <sys/stat.h>
59 #include <sys/sx.h>
60 #include <sys/time.h>
61 #include <sys/ttycom.h>
62 #include <sys/unistd.h>
63 #include <sys/vnode.h>
64 
65 static struct vop_vector devfs_vnodeops;
66 static struct vop_vector devfs_specops;
67 static struct fileops devfs_ops_f;
68 
69 #include <fs/devfs/devfs.h>
70 #include <fs/devfs/devfs_int.h>
71 
72 #include <security/mac/mac_framework.h>
73 
74 static MALLOC_DEFINE(M_CDEVPDATA, "DEVFSP", "Metainfo for cdev-fp data");
75 
76 struct mtx	devfs_de_interlock;
77 MTX_SYSINIT(devfs_de_interlock, &devfs_de_interlock, "devfs interlock", MTX_DEF);
78 struct sx	clone_drain_lock;
79 SX_SYSINIT(clone_drain_lock, &clone_drain_lock, "clone events drain lock");
80 struct mtx	cdevpriv_mtx;
81 MTX_SYSINIT(cdevpriv_mtx, &cdevpriv_mtx, "cdevpriv lock", MTX_DEF);
82 
83 static int
84 devfs_fp_check(struct file *fp, struct cdev **devp, struct cdevsw **dswp,
85     int *ref)
86 {
87 
88 	*dswp = devvn_refthread(fp->f_vnode, devp, ref);
89 	if (*devp != fp->f_data) {
90 		if (*dswp != NULL)
91 			dev_relthread(*devp, *ref);
92 		return (ENXIO);
93 	}
94 	KASSERT((*devp)->si_refcount > 0,
95 	    ("devfs: un-referenced struct cdev *(%s)", devtoname(*devp)));
96 	if (*dswp == NULL)
97 		return (ENXIO);
98 	curthread->td_fpop = fp;
99 	return (0);
100 }
101 
102 int
103 devfs_get_cdevpriv(void **datap)
104 {
105 	struct file *fp;
106 	struct cdev_privdata *p;
107 	int error;
108 
109 	fp = curthread->td_fpop;
110 	if (fp == NULL)
111 		return (EBADF);
112 	p = fp->f_cdevpriv;
113 	if (p != NULL) {
114 		error = 0;
115 		*datap = p->cdpd_data;
116 	} else
117 		error = ENOENT;
118 	return (error);
119 }
120 
121 int
122 devfs_set_cdevpriv(void *priv, cdevpriv_dtr_t priv_dtr)
123 {
124 	struct file *fp;
125 	struct cdev_priv *cdp;
126 	struct cdev_privdata *p;
127 	int error;
128 
129 	fp = curthread->td_fpop;
130 	if (fp == NULL)
131 		return (ENOENT);
132 	cdp = cdev2priv((struct cdev *)fp->f_data);
133 	p = malloc(sizeof(struct cdev_privdata), M_CDEVPDATA, M_WAITOK);
134 	p->cdpd_data = priv;
135 	p->cdpd_dtr = priv_dtr;
136 	p->cdpd_fp = fp;
137 	mtx_lock(&cdevpriv_mtx);
138 	if (fp->f_cdevpriv == NULL) {
139 		LIST_INSERT_HEAD(&cdp->cdp_fdpriv, p, cdpd_list);
140 		fp->f_cdevpriv = p;
141 		mtx_unlock(&cdevpriv_mtx);
142 		error = 0;
143 	} else {
144 		mtx_unlock(&cdevpriv_mtx);
145 		free(p, M_CDEVPDATA);
146 		error = EBUSY;
147 	}
148 	return (error);
149 }
150 
151 void
152 devfs_destroy_cdevpriv(struct cdev_privdata *p)
153 {
154 
155 	mtx_assert(&cdevpriv_mtx, MA_OWNED);
156 	p->cdpd_fp->f_cdevpriv = NULL;
157 	LIST_REMOVE(p, cdpd_list);
158 	mtx_unlock(&cdevpriv_mtx);
159 	(p->cdpd_dtr)(p->cdpd_data);
160 	free(p, M_CDEVPDATA);
161 }
162 
163 void
164 devfs_fpdrop(struct file *fp)
165 {
166 	struct cdev_privdata *p;
167 
168 	mtx_lock(&cdevpriv_mtx);
169 	if ((p = fp->f_cdevpriv) == NULL) {
170 		mtx_unlock(&cdevpriv_mtx);
171 		return;
172 	}
173 	devfs_destroy_cdevpriv(p);
174 }
175 
176 void
177 devfs_clear_cdevpriv(void)
178 {
179 	struct file *fp;
180 
181 	fp = curthread->td_fpop;
182 	if (fp == NULL)
183 		return;
184 	devfs_fpdrop(fp);
185 }
186 
187 /*
188  * On success devfs_populate_vp() returns with dmp->dm_lock held.
189  */
190 static int
191 devfs_populate_vp(struct vnode *vp)
192 {
193 	struct devfs_dirent *de;
194 	struct devfs_mount *dmp;
195 	int locked;
196 
197 	ASSERT_VOP_LOCKED(vp, "devfs_populate_vp");
198 
199 	dmp = VFSTODEVFS(vp->v_mount);
200 	locked = VOP_ISLOCKED(vp);
201 
202 	sx_xlock(&dmp->dm_lock);
203 	DEVFS_DMP_HOLD(dmp);
204 
205 	/* Can't call devfs_populate() with the vnode lock held. */
206 	VOP_UNLOCK(vp, 0);
207 	devfs_populate(dmp);
208 
209 	sx_xunlock(&dmp->dm_lock);
210 	vn_lock(vp, locked | LK_RETRY);
211 	sx_xlock(&dmp->dm_lock);
212 	if (DEVFS_DMP_DROP(dmp)) {
213 		sx_xunlock(&dmp->dm_lock);
214 		devfs_unmount_final(dmp);
215 		return (EBADF);
216 	}
217 	if ((vp->v_iflag & VI_DOOMED) != 0) {
218 		sx_xunlock(&dmp->dm_lock);
219 		return (EBADF);
220 	}
221 	de = vp->v_data;
222 	KASSERT(de != NULL,
223 	    ("devfs_populate_vp: vp->v_data == NULL but vnode not doomed"));
224 	if ((de->de_flags & DE_DOOMED) != 0) {
225 		sx_xunlock(&dmp->dm_lock);
226 		return (EBADF);
227 	}
228 
229 	return (0);
230 }
231 
232 static int
233 devfs_vptocnp(struct vop_vptocnp_args *ap)
234 {
235 	struct vnode *vp = ap->a_vp;
236 	struct vnode **dvp = ap->a_vpp;
237 	struct devfs_mount *dmp;
238 	char *buf = ap->a_buf;
239 	int *buflen = ap->a_buflen;
240 	struct devfs_dirent *dd, *de;
241 	int i, error;
242 
243 	dmp = VFSTODEVFS(vp->v_mount);
244 
245 	error = devfs_populate_vp(vp);
246 	if (error != 0)
247 		return (error);
248 
249 	i = *buflen;
250 	dd = vp->v_data;
251 
252 	if (vp->v_type == VCHR) {
253 		i -= strlen(dd->de_cdp->cdp_c.si_name);
254 		if (i < 0) {
255 			error = ENOMEM;
256 			goto finished;
257 		}
258 		bcopy(dd->de_cdp->cdp_c.si_name, buf + i,
259 		    strlen(dd->de_cdp->cdp_c.si_name));
260 		de = dd->de_dir;
261 	} else if (vp->v_type == VDIR) {
262 		if (dd == dmp->dm_rootdir) {
263 			*dvp = vp;
264 			vhold(*dvp);
265 			goto finished;
266 		}
267 		i -= dd->de_dirent->d_namlen;
268 		if (i < 0) {
269 			error = ENOMEM;
270 			goto finished;
271 		}
272 		bcopy(dd->de_dirent->d_name, buf + i,
273 		    dd->de_dirent->d_namlen);
274 		de = dd;
275 	} else {
276 		error = ENOENT;
277 		goto finished;
278 	}
279 	*buflen = i;
280 	de = devfs_parent_dirent(de);
281 	if (de == NULL) {
282 		error = ENOENT;
283 		goto finished;
284 	}
285 	mtx_lock(&devfs_de_interlock);
286 	*dvp = de->de_vnode;
287 	if (*dvp != NULL) {
288 		VI_LOCK(*dvp);
289 		mtx_unlock(&devfs_de_interlock);
290 		vholdl(*dvp);
291 		VI_UNLOCK(*dvp);
292 	} else {
293 		mtx_unlock(&devfs_de_interlock);
294 		error = ENOENT;
295 	}
296 finished:
297 	sx_xunlock(&dmp->dm_lock);
298 	return (error);
299 }
300 
301 /*
302  * Construct the fully qualified path name relative to the mountpoint.
303  * If a NULL cnp is provided, no '/' is appended to the resulting path.
304  */
305 char *
306 devfs_fqpn(char *buf, struct devfs_mount *dmp, struct devfs_dirent *dd,
307     struct componentname *cnp)
308 {
309 	int i;
310 	struct devfs_dirent *de;
311 
312 	sx_assert(&dmp->dm_lock, SA_LOCKED);
313 
314 	i = SPECNAMELEN;
315 	buf[i] = '\0';
316 	if (cnp != NULL)
317 		i -= cnp->cn_namelen;
318 	if (i < 0)
319 		 return (NULL);
320 	if (cnp != NULL)
321 		bcopy(cnp->cn_nameptr, buf + i, cnp->cn_namelen);
322 	de = dd;
323 	while (de != dmp->dm_rootdir) {
324 		if (cnp != NULL || i < SPECNAMELEN) {
325 			i--;
326 			if (i < 0)
327 				 return (NULL);
328 			buf[i] = '/';
329 		}
330 		i -= de->de_dirent->d_namlen;
331 		if (i < 0)
332 			 return (NULL);
333 		bcopy(de->de_dirent->d_name, buf + i,
334 		    de->de_dirent->d_namlen);
335 		de = devfs_parent_dirent(de);
336 		if (de == NULL)
337 			return (NULL);
338 	}
339 	return (buf + i);
340 }
341 
342 static int
343 devfs_allocv_drop_refs(int drop_dm_lock, struct devfs_mount *dmp,
344 	struct devfs_dirent *de)
345 {
346 	int not_found;
347 
348 	not_found = 0;
349 	if (de->de_flags & DE_DOOMED)
350 		not_found = 1;
351 	if (DEVFS_DE_DROP(de)) {
352 		KASSERT(not_found == 1, ("DEVFS de dropped but not doomed"));
353 		devfs_dirent_free(de);
354 	}
355 	if (DEVFS_DMP_DROP(dmp)) {
356 		KASSERT(not_found == 1,
357 			("DEVFS mount struct freed before dirent"));
358 		not_found = 2;
359 		sx_xunlock(&dmp->dm_lock);
360 		devfs_unmount_final(dmp);
361 	}
362 	if (not_found == 1 || (drop_dm_lock && not_found != 2))
363 		sx_unlock(&dmp->dm_lock);
364 	return (not_found);
365 }
366 
367 static void
368 devfs_insmntque_dtr(struct vnode *vp, void *arg)
369 {
370 	struct devfs_dirent *de;
371 
372 	de = (struct devfs_dirent *)arg;
373 	mtx_lock(&devfs_de_interlock);
374 	vp->v_data = NULL;
375 	de->de_vnode = NULL;
376 	mtx_unlock(&devfs_de_interlock);
377 	vgone(vp);
378 	vput(vp);
379 }
380 
381 /*
382  * devfs_allocv shall be entered with dmp->dm_lock held, and it drops
383  * it on return.
384  */
385 int
386 devfs_allocv(struct devfs_dirent *de, struct mount *mp, int lockmode,
387     struct vnode **vpp)
388 {
389 	int error;
390 	struct vnode *vp;
391 	struct cdev *dev;
392 	struct devfs_mount *dmp;
393 	struct cdevsw *dsw;
394 
395 	dmp = VFSTODEVFS(mp);
396 	if (de->de_flags & DE_DOOMED) {
397 		sx_xunlock(&dmp->dm_lock);
398 		return (ENOENT);
399 	}
400 	DEVFS_DE_HOLD(de);
401 	DEVFS_DMP_HOLD(dmp);
402 	mtx_lock(&devfs_de_interlock);
403 	vp = de->de_vnode;
404 	if (vp != NULL) {
405 		VI_LOCK(vp);
406 		mtx_unlock(&devfs_de_interlock);
407 		sx_xunlock(&dmp->dm_lock);
408 		error = vget(vp, lockmode | LK_INTERLOCK, curthread);
409 		sx_xlock(&dmp->dm_lock);
410 		if (devfs_allocv_drop_refs(0, dmp, de)) {
411 			if (error == 0)
412 				vput(vp);
413 			return (ENOENT);
414 		}
415 		else if (error) {
416 			sx_xunlock(&dmp->dm_lock);
417 			return (error);
418 		}
419 		sx_xunlock(&dmp->dm_lock);
420 		*vpp = vp;
421 		return (0);
422 	}
423 	mtx_unlock(&devfs_de_interlock);
424 	if (de->de_dirent->d_type == DT_CHR) {
425 		if (!(de->de_cdp->cdp_flags & CDP_ACTIVE)) {
426 			devfs_allocv_drop_refs(1, dmp, de);
427 			return (ENOENT);
428 		}
429 		dev = &de->de_cdp->cdp_c;
430 	} else {
431 		dev = NULL;
432 	}
433 	error = getnewvnode("devfs", mp, &devfs_vnodeops, &vp);
434 	if (error != 0) {
435 		devfs_allocv_drop_refs(1, dmp, de);
436 		printf("devfs_allocv: failed to allocate new vnode\n");
437 		return (error);
438 	}
439 
440 	if (de->de_dirent->d_type == DT_CHR) {
441 		vp->v_type = VCHR;
442 		VI_LOCK(vp);
443 		dev_lock();
444 		dev_refl(dev);
445 		/* XXX: v_rdev should be protect by vnode lock */
446 		vp->v_rdev = dev;
447 		KASSERT(vp->v_usecount == 1,
448 		    ("%s %d (%d)\n", __func__, __LINE__, vp->v_usecount));
449 		dev->si_usecount += vp->v_usecount;
450 		/* Special casing of ttys for deadfs.  Probably redundant. */
451 		dsw = dev->si_devsw;
452 		if (dsw != NULL && (dsw->d_flags & D_TTY) != 0)
453 			vp->v_vflag |= VV_ISTTY;
454 		dev_unlock();
455 		VI_UNLOCK(vp);
456 		if ((dev->si_flags & SI_ETERNAL) != 0)
457 			vp->v_vflag |= VV_ETERNALDEV;
458 		vp->v_op = &devfs_specops;
459 	} else if (de->de_dirent->d_type == DT_DIR) {
460 		vp->v_type = VDIR;
461 	} else if (de->de_dirent->d_type == DT_LNK) {
462 		vp->v_type = VLNK;
463 	} else {
464 		vp->v_type = VBAD;
465 	}
466 	vn_lock(vp, LK_EXCLUSIVE | LK_RETRY | LK_NOWITNESS);
467 	VN_LOCK_ASHARE(vp);
468 	mtx_lock(&devfs_de_interlock);
469 	vp->v_data = de;
470 	de->de_vnode = vp;
471 	mtx_unlock(&devfs_de_interlock);
472 	error = insmntque1(vp, mp, devfs_insmntque_dtr, de);
473 	if (error != 0) {
474 		(void) devfs_allocv_drop_refs(1, dmp, de);
475 		return (error);
476 	}
477 	if (devfs_allocv_drop_refs(0, dmp, de)) {
478 		vput(vp);
479 		return (ENOENT);
480 	}
481 #ifdef MAC
482 	mac_devfs_vnode_associate(mp, de, vp);
483 #endif
484 	sx_xunlock(&dmp->dm_lock);
485 	*vpp = vp;
486 	return (0);
487 }
488 
489 static int
490 devfs_access(struct vop_access_args *ap)
491 {
492 	struct vnode *vp = ap->a_vp;
493 	struct devfs_dirent *de;
494 	int error;
495 
496 	de = vp->v_data;
497 	if (vp->v_type == VDIR)
498 		de = de->de_dir;
499 
500 	error = vaccess(vp->v_type, de->de_mode, de->de_uid, de->de_gid,
501 	    ap->a_accmode, ap->a_cred, NULL);
502 	if (error == 0)
503 		return (0);
504 	if (error != EACCES)
505 		return (error);
506 	/* We do, however, allow access to the controlling terminal */
507 	if (!(ap->a_td->td_proc->p_flag & P_CONTROLT))
508 		return (error);
509 	if (ap->a_td->td_proc->p_session->s_ttydp == de->de_cdp)
510 		return (0);
511 	return (error);
512 }
513 
514 /* ARGSUSED */
515 static int
516 devfs_close(struct vop_close_args *ap)
517 {
518 	struct vnode *vp = ap->a_vp, *oldvp;
519 	struct thread *td = ap->a_td;
520 	struct cdev *dev = vp->v_rdev;
521 	struct cdevsw *dsw;
522 	int vp_locked, error, ref;
523 
524 	/*
525 	 * XXX: Don't call d_close() if we were called because of
526 	 * XXX: insmntque1() failure.
527 	 */
528 	if (vp->v_data == NULL)
529 		return (0);
530 
531 	/*
532 	 * Hack: a tty device that is a controlling terminal
533 	 * has a reference from the session structure.
534 	 * We cannot easily tell that a character device is
535 	 * a controlling terminal, unless it is the closing
536 	 * process' controlling terminal.  In that case,
537 	 * if the reference count is 2 (this last descriptor
538 	 * plus the session), release the reference from the session.
539 	 */
540 	oldvp = NULL;
541 	sx_xlock(&proctree_lock);
542 	if (td && vp == td->td_proc->p_session->s_ttyvp) {
543 		SESS_LOCK(td->td_proc->p_session);
544 		VI_LOCK(vp);
545 		if (count_dev(dev) == 2 && (vp->v_iflag & VI_DOOMED) == 0) {
546 			td->td_proc->p_session->s_ttyvp = NULL;
547 			td->td_proc->p_session->s_ttydp = NULL;
548 			oldvp = vp;
549 		}
550 		VI_UNLOCK(vp);
551 		SESS_UNLOCK(td->td_proc->p_session);
552 	}
553 	sx_xunlock(&proctree_lock);
554 	if (oldvp != NULL)
555 		vrele(oldvp);
556 	/*
557 	 * We do not want to really close the device if it
558 	 * is still in use unless we are trying to close it
559 	 * forcibly. Since every use (buffer, vnode, swap, cmap)
560 	 * holds a reference to the vnode, and because we mark
561 	 * any other vnodes that alias this device, when the
562 	 * sum of the reference counts on all the aliased
563 	 * vnodes descends to one, we are on last close.
564 	 */
565 	dsw = dev_refthread(dev, &ref);
566 	if (dsw == NULL)
567 		return (ENXIO);
568 	VI_LOCK(vp);
569 	if (vp->v_iflag & VI_DOOMED) {
570 		/* Forced close. */
571 	} else if (dsw->d_flags & D_TRACKCLOSE) {
572 		/* Keep device updated on status. */
573 	} else if (count_dev(dev) > 1) {
574 		VI_UNLOCK(vp);
575 		dev_relthread(dev, ref);
576 		return (0);
577 	}
578 	vholdl(vp);
579 	VI_UNLOCK(vp);
580 	vp_locked = VOP_ISLOCKED(vp);
581 	VOP_UNLOCK(vp, 0);
582 	KASSERT(dev->si_refcount > 0,
583 	    ("devfs_close() on un-referenced struct cdev *(%s)", devtoname(dev)));
584 	error = dsw->d_close(dev, ap->a_fflag, S_IFCHR, td);
585 	dev_relthread(dev, ref);
586 	vn_lock(vp, vp_locked | LK_RETRY);
587 	vdrop(vp);
588 	return (error);
589 }
590 
591 static int
592 devfs_close_f(struct file *fp, struct thread *td)
593 {
594 	int error;
595 	struct file *fpop;
596 
597 	fpop = td->td_fpop;
598 	td->td_fpop = fp;
599 	error = vnops.fo_close(fp, td);
600 	td->td_fpop = fpop;
601 	return (error);
602 }
603 
604 static int
605 devfs_fsync(struct vop_fsync_args *ap)
606 {
607 	int error;
608 	struct bufobj *bo;
609 	struct devfs_dirent *de;
610 
611 	if (!vn_isdisk(ap->a_vp, &error)) {
612 		bo = &ap->a_vp->v_bufobj;
613 		de = ap->a_vp->v_data;
614 		if (error == ENXIO && bo->bo_dirty.bv_cnt > 0) {
615 			printf("Device %s went missing before all of the data "
616 			    "could be written to it; expect data loss.\n",
617 			    de->de_dirent->d_name);
618 
619 			error = vop_stdfsync(ap);
620 			if (bo->bo_dirty.bv_cnt != 0 || error != 0)
621 				panic("devfs_fsync: vop_stdfsync failed.");
622 		}
623 
624 		return (0);
625 	}
626 
627 	return (vop_stdfsync(ap));
628 }
629 
630 static int
631 devfs_getattr(struct vop_getattr_args *ap)
632 {
633 	struct vnode *vp = ap->a_vp;
634 	struct vattr *vap = ap->a_vap;
635 	int error;
636 	struct devfs_dirent *de;
637 	struct devfs_mount *dmp;
638 	struct cdev *dev;
639 
640 	error = devfs_populate_vp(vp);
641 	if (error != 0)
642 		return (error);
643 
644 	dmp = VFSTODEVFS(vp->v_mount);
645 	sx_xunlock(&dmp->dm_lock);
646 
647 	de = vp->v_data;
648 	KASSERT(de != NULL, ("Null dirent in devfs_getattr vp=%p", vp));
649 	if (vp->v_type == VDIR) {
650 		de = de->de_dir;
651 		KASSERT(de != NULL,
652 		    ("Null dir dirent in devfs_getattr vp=%p", vp));
653 	}
654 	vap->va_uid = de->de_uid;
655 	vap->va_gid = de->de_gid;
656 	vap->va_mode = de->de_mode;
657 	if (vp->v_type == VLNK)
658 		vap->va_size = strlen(de->de_symlink);
659 	else if (vp->v_type == VDIR)
660 		vap->va_size = vap->va_bytes = DEV_BSIZE;
661 	else
662 		vap->va_size = 0;
663 	if (vp->v_type != VDIR)
664 		vap->va_bytes = 0;
665 	vap->va_blocksize = DEV_BSIZE;
666 	vap->va_type = vp->v_type;
667 
668 #define fix(aa)							\
669 	do {							\
670 		if ((aa).tv_sec <= 3600) {			\
671 			(aa).tv_sec = boottime.tv_sec;		\
672 			(aa).tv_nsec = boottime.tv_usec * 1000; \
673 		}						\
674 	} while (0)
675 
676 	if (vp->v_type != VCHR)  {
677 		fix(de->de_atime);
678 		vap->va_atime = de->de_atime;
679 		fix(de->de_mtime);
680 		vap->va_mtime = de->de_mtime;
681 		fix(de->de_ctime);
682 		vap->va_ctime = de->de_ctime;
683 	} else {
684 		dev = vp->v_rdev;
685 		fix(dev->si_atime);
686 		vap->va_atime = dev->si_atime;
687 		fix(dev->si_mtime);
688 		vap->va_mtime = dev->si_mtime;
689 		fix(dev->si_ctime);
690 		vap->va_ctime = dev->si_ctime;
691 
692 		vap->va_rdev = cdev2priv(dev)->cdp_inode;
693 	}
694 	vap->va_gen = 0;
695 	vap->va_flags = 0;
696 	vap->va_filerev = 0;
697 	vap->va_nlink = de->de_links;
698 	vap->va_fileid = de->de_inode;
699 
700 	return (error);
701 }
702 
703 /* ARGSUSED */
704 static int
705 devfs_ioctl_f(struct file *fp, u_long com, void *data, struct ucred *cred, struct thread *td)
706 {
707 	struct cdev *dev;
708 	struct cdevsw *dsw;
709 	struct vnode *vp;
710 	struct vnode *vpold;
711 	int error, i, ref;
712 	const char *p;
713 	struct fiodgname_arg *fgn;
714 	struct file *fpop;
715 
716 	fpop = td->td_fpop;
717 	error = devfs_fp_check(fp, &dev, &dsw, &ref);
718 	if (error)
719 		return (error);
720 
721 	if (com == FIODTYPE) {
722 		*(int *)data = dsw->d_flags & D_TYPEMASK;
723 		td->td_fpop = fpop;
724 		dev_relthread(dev, ref);
725 		return (0);
726 	} else if (com == FIODGNAME) {
727 		fgn = data;
728 		p = devtoname(dev);
729 		i = strlen(p) + 1;
730 		if (i > fgn->len)
731 			error = EINVAL;
732 		else
733 			error = copyout(p, fgn->buf, i);
734 		td->td_fpop = fpop;
735 		dev_relthread(dev, ref);
736 		return (error);
737 	}
738 	error = dsw->d_ioctl(dev, com, data, fp->f_flag, td);
739 	td->td_fpop = NULL;
740 	dev_relthread(dev, ref);
741 	if (error == ENOIOCTL)
742 		error = ENOTTY;
743 	if (error == 0 && com == TIOCSCTTY) {
744 		vp = fp->f_vnode;
745 
746 		/* Do nothing if reassigning same control tty */
747 		sx_slock(&proctree_lock);
748 		if (td->td_proc->p_session->s_ttyvp == vp) {
749 			sx_sunlock(&proctree_lock);
750 			return (0);
751 		}
752 
753 		vpold = td->td_proc->p_session->s_ttyvp;
754 		VREF(vp);
755 		SESS_LOCK(td->td_proc->p_session);
756 		td->td_proc->p_session->s_ttyvp = vp;
757 		td->td_proc->p_session->s_ttydp = cdev2priv(dev);
758 		SESS_UNLOCK(td->td_proc->p_session);
759 
760 		sx_sunlock(&proctree_lock);
761 
762 		/* Get rid of reference to old control tty */
763 		if (vpold)
764 			vrele(vpold);
765 	}
766 	return (error);
767 }
768 
769 /* ARGSUSED */
770 static int
771 devfs_kqfilter_f(struct file *fp, struct knote *kn)
772 {
773 	struct cdev *dev;
774 	struct cdevsw *dsw;
775 	int error, ref;
776 	struct file *fpop;
777 	struct thread *td;
778 
779 	td = curthread;
780 	fpop = td->td_fpop;
781 	error = devfs_fp_check(fp, &dev, &dsw, &ref);
782 	if (error)
783 		return (error);
784 	error = dsw->d_kqfilter(dev, kn);
785 	td->td_fpop = fpop;
786 	dev_relthread(dev, ref);
787 	return (error);
788 }
789 
790 static inline int
791 devfs_prison_check(struct devfs_dirent *de, struct thread *td)
792 {
793 	struct cdev_priv *cdp;
794 	struct ucred *dcr;
795 	int error;
796 
797 	cdp = de->de_cdp;
798 	if (cdp == NULL)
799 		return (0);
800 	dcr = cdp->cdp_c.si_cred;
801 	if (dcr == NULL)
802 		return (0);
803 
804 	error = prison_check(td->td_ucred, dcr);
805 	if (error == 0)
806 		return (0);
807 	/* We do, however, allow access to the controlling terminal */
808 	if (!(td->td_proc->p_flag & P_CONTROLT))
809 		return (error);
810 	if (td->td_proc->p_session->s_ttydp == cdp)
811 		return (0);
812 	return (error);
813 }
814 
815 static int
816 devfs_lookupx(struct vop_lookup_args *ap, int *dm_unlock)
817 {
818 	struct componentname *cnp;
819 	struct vnode *dvp, **vpp;
820 	struct thread *td;
821 	struct devfs_dirent *de, *dd;
822 	struct devfs_dirent **dde;
823 	struct devfs_mount *dmp;
824 	struct cdev *cdev;
825 	int error, flags, nameiop, dvplocked;
826 	char specname[SPECNAMELEN + 1], *pname;
827 
828 	cnp = ap->a_cnp;
829 	vpp = ap->a_vpp;
830 	dvp = ap->a_dvp;
831 	pname = cnp->cn_nameptr;
832 	td = cnp->cn_thread;
833 	flags = cnp->cn_flags;
834 	nameiop = cnp->cn_nameiop;
835 	dmp = VFSTODEVFS(dvp->v_mount);
836 	dd = dvp->v_data;
837 	*vpp = NULLVP;
838 
839 	if ((flags & ISLASTCN) && nameiop == RENAME)
840 		return (EOPNOTSUPP);
841 
842 	if (dvp->v_type != VDIR)
843 		return (ENOTDIR);
844 
845 	if ((flags & ISDOTDOT) && (dvp->v_vflag & VV_ROOT))
846 		return (EIO);
847 
848 	error = VOP_ACCESS(dvp, VEXEC, cnp->cn_cred, td);
849 	if (error)
850 		return (error);
851 
852 	if (cnp->cn_namelen == 1 && *pname == '.') {
853 		if ((flags & ISLASTCN) && nameiop != LOOKUP)
854 			return (EINVAL);
855 		*vpp = dvp;
856 		VREF(dvp);
857 		return (0);
858 	}
859 
860 	if (flags & ISDOTDOT) {
861 		if ((flags & ISLASTCN) && nameiop != LOOKUP)
862 			return (EINVAL);
863 		de = devfs_parent_dirent(dd);
864 		if (de == NULL)
865 			return (ENOENT);
866 		dvplocked = VOP_ISLOCKED(dvp);
867 		VOP_UNLOCK(dvp, 0);
868 		error = devfs_allocv(de, dvp->v_mount,
869 		    cnp->cn_lkflags & LK_TYPE_MASK, vpp);
870 		*dm_unlock = 0;
871 		vn_lock(dvp, dvplocked | LK_RETRY);
872 		return (error);
873 	}
874 
875 	dd = dvp->v_data;
876 	de = devfs_find(dd, cnp->cn_nameptr, cnp->cn_namelen, 0);
877 	while (de == NULL) {	/* While(...) so we can use break */
878 
879 		if (nameiop == DELETE)
880 			return (ENOENT);
881 
882 		/*
883 		 * OK, we didn't have an entry for the name we were asked for
884 		 * so we try to see if anybody can create it on demand.
885 		 */
886 		pname = devfs_fqpn(specname, dmp, dd, cnp);
887 		if (pname == NULL)
888 			break;
889 
890 		cdev = NULL;
891 		DEVFS_DMP_HOLD(dmp);
892 		sx_xunlock(&dmp->dm_lock);
893 		sx_slock(&clone_drain_lock);
894 		EVENTHANDLER_INVOKE(dev_clone,
895 		    td->td_ucred, pname, strlen(pname), &cdev);
896 		sx_sunlock(&clone_drain_lock);
897 
898 		if (cdev == NULL)
899 			sx_xlock(&dmp->dm_lock);
900 		else if (devfs_populate_vp(dvp) != 0) {
901 			*dm_unlock = 0;
902 			sx_xlock(&dmp->dm_lock);
903 			if (DEVFS_DMP_DROP(dmp)) {
904 				sx_xunlock(&dmp->dm_lock);
905 				devfs_unmount_final(dmp);
906 			} else
907 				sx_xunlock(&dmp->dm_lock);
908 			dev_rel(cdev);
909 			return (ENOENT);
910 		}
911 		if (DEVFS_DMP_DROP(dmp)) {
912 			*dm_unlock = 0;
913 			sx_xunlock(&dmp->dm_lock);
914 			devfs_unmount_final(dmp);
915 			if (cdev != NULL)
916 				dev_rel(cdev);
917 			return (ENOENT);
918 		}
919 
920 		if (cdev == NULL)
921 			break;
922 
923 		dev_lock();
924 		dde = &cdev2priv(cdev)->cdp_dirents[dmp->dm_idx];
925 		if (dde != NULL && *dde != NULL)
926 			de = *dde;
927 		dev_unlock();
928 		dev_rel(cdev);
929 		break;
930 	}
931 
932 	if (de == NULL || de->de_flags & DE_WHITEOUT) {
933 		if ((nameiop == CREATE || nameiop == RENAME) &&
934 		    (flags & (LOCKPARENT | WANTPARENT)) && (flags & ISLASTCN)) {
935 			cnp->cn_flags |= SAVENAME;
936 			return (EJUSTRETURN);
937 		}
938 		return (ENOENT);
939 	}
940 
941 	if (devfs_prison_check(de, td))
942 		return (ENOENT);
943 
944 	if ((cnp->cn_nameiop == DELETE) && (flags & ISLASTCN)) {
945 		error = VOP_ACCESS(dvp, VWRITE, cnp->cn_cred, td);
946 		if (error)
947 			return (error);
948 		if (*vpp == dvp) {
949 			VREF(dvp);
950 			*vpp = dvp;
951 			return (0);
952 		}
953 	}
954 	error = devfs_allocv(de, dvp->v_mount, cnp->cn_lkflags & LK_TYPE_MASK,
955 	    vpp);
956 	*dm_unlock = 0;
957 	return (error);
958 }
959 
960 static int
961 devfs_lookup(struct vop_lookup_args *ap)
962 {
963 	int j;
964 	struct devfs_mount *dmp;
965 	int dm_unlock;
966 
967 	if (devfs_populate_vp(ap->a_dvp) != 0)
968 		return (ENOTDIR);
969 
970 	dmp = VFSTODEVFS(ap->a_dvp->v_mount);
971 	dm_unlock = 1;
972 	j = devfs_lookupx(ap, &dm_unlock);
973 	if (dm_unlock == 1)
974 		sx_xunlock(&dmp->dm_lock);
975 	return (j);
976 }
977 
978 static int
979 devfs_mknod(struct vop_mknod_args *ap)
980 {
981 	struct componentname *cnp;
982 	struct vnode *dvp, **vpp;
983 	struct devfs_dirent *dd, *de;
984 	struct devfs_mount *dmp;
985 	int error;
986 
987 	/*
988 	 * The only type of node we should be creating here is a
989 	 * character device, for anything else return EOPNOTSUPP.
990 	 */
991 	if (ap->a_vap->va_type != VCHR)
992 		return (EOPNOTSUPP);
993 	dvp = ap->a_dvp;
994 	dmp = VFSTODEVFS(dvp->v_mount);
995 
996 	cnp = ap->a_cnp;
997 	vpp = ap->a_vpp;
998 	dd = dvp->v_data;
999 
1000 	error = ENOENT;
1001 	sx_xlock(&dmp->dm_lock);
1002 	TAILQ_FOREACH(de, &dd->de_dlist, de_list) {
1003 		if (cnp->cn_namelen != de->de_dirent->d_namlen)
1004 			continue;
1005 		if (bcmp(cnp->cn_nameptr, de->de_dirent->d_name,
1006 		    de->de_dirent->d_namlen) != 0)
1007 			continue;
1008 		if (de->de_flags & DE_WHITEOUT)
1009 			break;
1010 		goto notfound;
1011 	}
1012 	if (de == NULL)
1013 		goto notfound;
1014 	de->de_flags &= ~DE_WHITEOUT;
1015 	error = devfs_allocv(de, dvp->v_mount, LK_EXCLUSIVE, vpp);
1016 	return (error);
1017 notfound:
1018 	sx_xunlock(&dmp->dm_lock);
1019 	return (error);
1020 }
1021 
1022 /* ARGSUSED */
1023 static int
1024 devfs_open(struct vop_open_args *ap)
1025 {
1026 	struct thread *td = ap->a_td;
1027 	struct vnode *vp = ap->a_vp;
1028 	struct cdev *dev = vp->v_rdev;
1029 	struct file *fp = ap->a_fp;
1030 	int error, ref, vlocked;
1031 	struct cdevsw *dsw;
1032 	struct file *fpop;
1033 
1034 	if (vp->v_type == VBLK)
1035 		return (ENXIO);
1036 
1037 	if (dev == NULL)
1038 		return (ENXIO);
1039 
1040 	/* Make this field valid before any I/O in d_open. */
1041 	if (dev->si_iosize_max == 0)
1042 		dev->si_iosize_max = DFLTPHYS;
1043 
1044 	dsw = dev_refthread(dev, &ref);
1045 	if (dsw == NULL)
1046 		return (ENXIO);
1047 
1048 	vlocked = VOP_ISLOCKED(vp);
1049 	VOP_UNLOCK(vp, 0);
1050 
1051 	fpop = td->td_fpop;
1052 	td->td_fpop = fp;
1053 	if (fp != NULL) {
1054 		fp->f_data = dev;
1055 		fp->f_vnode = vp;
1056 	}
1057 	if (dsw->d_fdopen != NULL)
1058 		error = dsw->d_fdopen(dev, ap->a_mode, td, fp);
1059 	else
1060 		error = dsw->d_open(dev, ap->a_mode, S_IFCHR, td);
1061 	td->td_fpop = fpop;
1062 
1063 	vn_lock(vp, vlocked | LK_RETRY);
1064 	dev_relthread(dev, ref);
1065 	if (error)
1066 		return (error);
1067 
1068 #if 0	/* /dev/console */
1069 	KASSERT(fp != NULL, ("Could not vnode bypass device on NULL fp"));
1070 #else
1071 	if (fp == NULL)
1072 		return (error);
1073 #endif
1074 	if (fp->f_ops == &badfileops)
1075 		finit(fp, fp->f_flag, DTYPE_VNODE, dev, &devfs_ops_f);
1076 	return (error);
1077 }
1078 
1079 static int
1080 devfs_pathconf(struct vop_pathconf_args *ap)
1081 {
1082 
1083 	switch (ap->a_name) {
1084 	case _PC_MAC_PRESENT:
1085 #ifdef MAC
1086 		/*
1087 		 * If MAC is enabled, devfs automatically supports
1088 		 * trivial non-persistant label storage.
1089 		 */
1090 		*ap->a_retval = 1;
1091 #else
1092 		*ap->a_retval = 0;
1093 #endif
1094 		return (0);
1095 	default:
1096 		return (vop_stdpathconf(ap));
1097 	}
1098 	/* NOTREACHED */
1099 }
1100 
1101 /* ARGSUSED */
1102 static int
1103 devfs_poll_f(struct file *fp, int events, struct ucred *cred, struct thread *td)
1104 {
1105 	struct cdev *dev;
1106 	struct cdevsw *dsw;
1107 	int error, ref;
1108 	struct file *fpop;
1109 
1110 	fpop = td->td_fpop;
1111 	error = devfs_fp_check(fp, &dev, &dsw, &ref);
1112 	if (error)
1113 		return (poll_no_poll(events));
1114 	error = dsw->d_poll(dev, events, td);
1115 	td->td_fpop = fpop;
1116 	dev_relthread(dev, ref);
1117 	return(error);
1118 }
1119 
1120 /*
1121  * Print out the contents of a special device vnode.
1122  */
1123 static int
1124 devfs_print(struct vop_print_args *ap)
1125 {
1126 
1127 	printf("\tdev %s\n", devtoname(ap->a_vp->v_rdev));
1128 	return (0);
1129 }
1130 
1131 /* ARGSUSED */
1132 static int
1133 devfs_read_f(struct file *fp, struct uio *uio, struct ucred *cred, int flags, struct thread *td)
1134 {
1135 	struct cdev *dev;
1136 	int ioflag, error, ref, resid;
1137 	struct cdevsw *dsw;
1138 	struct file *fpop;
1139 
1140 	fpop = td->td_fpop;
1141 	error = devfs_fp_check(fp, &dev, &dsw, &ref);
1142 	if (error)
1143 		return (error);
1144 	resid = uio->uio_resid;
1145 	ioflag = fp->f_flag & (O_NONBLOCK | O_DIRECT);
1146 	if (ioflag & O_DIRECT)
1147 		ioflag |= IO_DIRECT;
1148 
1149 	if ((flags & FOF_OFFSET) == 0)
1150 		uio->uio_offset = fp->f_offset;
1151 
1152 	error = dsw->d_read(dev, uio, ioflag);
1153 	if (uio->uio_resid != resid || (error == 0 && resid != 0))
1154 		vfs_timestamp(&dev->si_atime);
1155 	td->td_fpop = fpop;
1156 	dev_relthread(dev, ref);
1157 
1158 	if ((flags & FOF_OFFSET) == 0)
1159 		fp->f_offset = uio->uio_offset;
1160 	fp->f_nextoff = uio->uio_offset;
1161 	return (error);
1162 }
1163 
1164 static int
1165 devfs_readdir(struct vop_readdir_args *ap)
1166 {
1167 	int error;
1168 	struct uio *uio;
1169 	struct dirent *dp;
1170 	struct devfs_dirent *dd;
1171 	struct devfs_dirent *de;
1172 	struct devfs_mount *dmp;
1173 	off_t off;
1174 	int *tmp_ncookies = NULL;
1175 
1176 	if (ap->a_vp->v_type != VDIR)
1177 		return (ENOTDIR);
1178 
1179 	uio = ap->a_uio;
1180 	if (uio->uio_offset < 0)
1181 		return (EINVAL);
1182 
1183 	/*
1184 	 * XXX: This is a temporary hack to get around this filesystem not
1185 	 * supporting cookies. We store the location of the ncookies pointer
1186 	 * in a temporary variable before calling vfs_subr.c:vfs_read_dirent()
1187 	 * and set the number of cookies to 0. We then set the pointer to
1188 	 * NULL so that vfs_read_dirent doesn't try to call realloc() on
1189 	 * ap->a_cookies. Later in this function, we restore the ap->a_ncookies
1190 	 * pointer to its original location before returning to the caller.
1191 	 */
1192 	if (ap->a_ncookies != NULL) {
1193 		tmp_ncookies = ap->a_ncookies;
1194 		*ap->a_ncookies = 0;
1195 		ap->a_ncookies = NULL;
1196 	}
1197 
1198 	dmp = VFSTODEVFS(ap->a_vp->v_mount);
1199 	if (devfs_populate_vp(ap->a_vp) != 0) {
1200 		if (tmp_ncookies != NULL)
1201 			ap->a_ncookies = tmp_ncookies;
1202 		return (EIO);
1203 	}
1204 	error = 0;
1205 	de = ap->a_vp->v_data;
1206 	off = 0;
1207 	TAILQ_FOREACH(dd, &de->de_dlist, de_list) {
1208 		KASSERT(dd->de_cdp != (void *)0xdeadc0de, ("%s %d\n", __func__, __LINE__));
1209 		if (dd->de_flags & (DE_COVERED | DE_WHITEOUT))
1210 			continue;
1211 		if (devfs_prison_check(dd, uio->uio_td))
1212 			continue;
1213 		if (dd->de_dirent->d_type == DT_DIR)
1214 			de = dd->de_dir;
1215 		else
1216 			de = dd;
1217 		dp = dd->de_dirent;
1218 		if (dp->d_reclen > uio->uio_resid)
1219 			break;
1220 		dp->d_fileno = de->de_inode;
1221 		if (off >= uio->uio_offset) {
1222 			error = vfs_read_dirent(ap, dp, off);
1223 			if (error)
1224 				break;
1225 		}
1226 		off += dp->d_reclen;
1227 	}
1228 	sx_xunlock(&dmp->dm_lock);
1229 	uio->uio_offset = off;
1230 
1231 	/*
1232 	 * Restore ap->a_ncookies if it wasn't originally NULL in the first
1233 	 * place.
1234 	 */
1235 	if (tmp_ncookies != NULL)
1236 		ap->a_ncookies = tmp_ncookies;
1237 
1238 	return (error);
1239 }
1240 
1241 static int
1242 devfs_readlink(struct vop_readlink_args *ap)
1243 {
1244 	struct devfs_dirent *de;
1245 
1246 	de = ap->a_vp->v_data;
1247 	return (uiomove(de->de_symlink, strlen(de->de_symlink), ap->a_uio));
1248 }
1249 
1250 static int
1251 devfs_reclaim(struct vop_reclaim_args *ap)
1252 {
1253 	struct vnode *vp = ap->a_vp;
1254 	struct devfs_dirent *de;
1255 	struct cdev *dev;
1256 
1257 	mtx_lock(&devfs_de_interlock);
1258 	de = vp->v_data;
1259 	if (de != NULL) {
1260 		de->de_vnode = NULL;
1261 		vp->v_data = NULL;
1262 	}
1263 	mtx_unlock(&devfs_de_interlock);
1264 
1265 	vnode_destroy_vobject(vp);
1266 
1267 	VI_LOCK(vp);
1268 	dev_lock();
1269 	dev = vp->v_rdev;
1270 	vp->v_rdev = NULL;
1271 
1272 	if (dev == NULL) {
1273 		dev_unlock();
1274 		VI_UNLOCK(vp);
1275 		return (0);
1276 	}
1277 
1278 	dev->si_usecount -= vp->v_usecount;
1279 	dev_unlock();
1280 	VI_UNLOCK(vp);
1281 	dev_rel(dev);
1282 	return (0);
1283 }
1284 
1285 static int
1286 devfs_remove(struct vop_remove_args *ap)
1287 {
1288 	struct vnode *dvp = ap->a_dvp;
1289 	struct vnode *vp = ap->a_vp;
1290 	struct devfs_dirent *dd;
1291 	struct devfs_dirent *de, *de_covered;
1292 	struct devfs_mount *dmp = VFSTODEVFS(vp->v_mount);
1293 
1294 	ASSERT_VOP_ELOCKED(dvp, "devfs_remove");
1295 	ASSERT_VOP_ELOCKED(vp, "devfs_remove");
1296 
1297 	sx_xlock(&dmp->dm_lock);
1298 	dd = ap->a_dvp->v_data;
1299 	de = vp->v_data;
1300 	if (de->de_cdp == NULL) {
1301 		TAILQ_REMOVE(&dd->de_dlist, de, de_list);
1302 		if (de->de_dirent->d_type == DT_LNK) {
1303 			de_covered = devfs_find(dd, de->de_dirent->d_name,
1304 			    de->de_dirent->d_namlen, 0);
1305 			if (de_covered != NULL)
1306 				de_covered->de_flags &= ~DE_COVERED;
1307 		}
1308 		/* We need to unlock dvp because devfs_delete() may lock it. */
1309 		VOP_UNLOCK(vp, 0);
1310 		if (dvp != vp)
1311 			VOP_UNLOCK(dvp, 0);
1312 		devfs_delete(dmp, de, 0);
1313 		sx_xunlock(&dmp->dm_lock);
1314 		if (dvp != vp)
1315 			vn_lock(dvp, LK_EXCLUSIVE | LK_RETRY);
1316 		vn_lock(vp, LK_EXCLUSIVE | LK_RETRY);
1317 	} else {
1318 		de->de_flags |= DE_WHITEOUT;
1319 		sx_xunlock(&dmp->dm_lock);
1320 	}
1321 	return (0);
1322 }
1323 
1324 /*
1325  * Revoke is called on a tty when a terminal session ends.  The vnode
1326  * is orphaned by setting v_op to deadfs so we need to let go of it
1327  * as well so that we create a new one next time around.
1328  *
1329  */
1330 static int
1331 devfs_revoke(struct vop_revoke_args *ap)
1332 {
1333 	struct vnode *vp = ap->a_vp, *vp2;
1334 	struct cdev *dev;
1335 	struct cdev_priv *cdp;
1336 	struct devfs_dirent *de;
1337 	int i;
1338 
1339 	KASSERT((ap->a_flags & REVOKEALL) != 0, ("devfs_revoke !REVOKEALL"));
1340 
1341 	dev = vp->v_rdev;
1342 	cdp = cdev2priv(dev);
1343 
1344 	dev_lock();
1345 	cdp->cdp_inuse++;
1346 	dev_unlock();
1347 
1348 	vhold(vp);
1349 	vgone(vp);
1350 	vdrop(vp);
1351 
1352 	VOP_UNLOCK(vp,0);
1353  loop:
1354 	for (;;) {
1355 		mtx_lock(&devfs_de_interlock);
1356 		dev_lock();
1357 		vp2 = NULL;
1358 		for (i = 0; i <= cdp->cdp_maxdirent; i++) {
1359 			de = cdp->cdp_dirents[i];
1360 			if (de == NULL)
1361 				continue;
1362 
1363 			vp2 = de->de_vnode;
1364 			if (vp2 != NULL) {
1365 				dev_unlock();
1366 				VI_LOCK(vp2);
1367 				mtx_unlock(&devfs_de_interlock);
1368 				if (vget(vp2, LK_EXCLUSIVE | LK_INTERLOCK,
1369 				    curthread))
1370 					goto loop;
1371 				vhold(vp2);
1372 				vgone(vp2);
1373 				vdrop(vp2);
1374 				vput(vp2);
1375 				break;
1376 			}
1377 		}
1378 		if (vp2 != NULL) {
1379 			continue;
1380 		}
1381 		dev_unlock();
1382 		mtx_unlock(&devfs_de_interlock);
1383 		break;
1384 	}
1385 	dev_lock();
1386 	cdp->cdp_inuse--;
1387 	if (!(cdp->cdp_flags & CDP_ACTIVE) && cdp->cdp_inuse == 0) {
1388 		TAILQ_REMOVE(&cdevp_list, cdp, cdp_list);
1389 		dev_unlock();
1390 		dev_rel(&cdp->cdp_c);
1391 	} else
1392 		dev_unlock();
1393 
1394 	vn_lock(vp, LK_EXCLUSIVE | LK_RETRY);
1395 	return (0);
1396 }
1397 
1398 static int
1399 devfs_rioctl(struct vop_ioctl_args *ap)
1400 {
1401 	struct vnode *vp;
1402 	struct devfs_mount *dmp;
1403 	int error;
1404 
1405 	vp = ap->a_vp;
1406 	vn_lock(vp, LK_SHARED | LK_RETRY);
1407 	if (vp->v_iflag & VI_DOOMED) {
1408 		VOP_UNLOCK(vp, 0);
1409 		return (EBADF);
1410 	}
1411 	dmp = VFSTODEVFS(vp->v_mount);
1412 	sx_xlock(&dmp->dm_lock);
1413 	VOP_UNLOCK(vp, 0);
1414 	DEVFS_DMP_HOLD(dmp);
1415 	devfs_populate(dmp);
1416 	if (DEVFS_DMP_DROP(dmp)) {
1417 		sx_xunlock(&dmp->dm_lock);
1418 		devfs_unmount_final(dmp);
1419 		return (ENOENT);
1420 	}
1421 	error = devfs_rules_ioctl(dmp, ap->a_command, ap->a_data, ap->a_td);
1422 	sx_xunlock(&dmp->dm_lock);
1423 	return (error);
1424 }
1425 
1426 static int
1427 devfs_rread(struct vop_read_args *ap)
1428 {
1429 
1430 	if (ap->a_vp->v_type != VDIR)
1431 		return (EINVAL);
1432 	return (VOP_READDIR(ap->a_vp, ap->a_uio, ap->a_cred, NULL, NULL, NULL));
1433 }
1434 
1435 static int
1436 devfs_setattr(struct vop_setattr_args *ap)
1437 {
1438 	struct devfs_dirent *de;
1439 	struct vattr *vap;
1440 	struct vnode *vp;
1441 	struct thread *td;
1442 	int c, error;
1443 	uid_t uid;
1444 	gid_t gid;
1445 
1446 	vap = ap->a_vap;
1447 	vp = ap->a_vp;
1448 	td = curthread;
1449 	if ((vap->va_type != VNON) ||
1450 	    (vap->va_nlink != VNOVAL) ||
1451 	    (vap->va_fsid != VNOVAL) ||
1452 	    (vap->va_fileid != VNOVAL) ||
1453 	    (vap->va_blocksize != VNOVAL) ||
1454 	    (vap->va_flags != VNOVAL && vap->va_flags != 0) ||
1455 	    (vap->va_rdev != VNOVAL) ||
1456 	    ((int)vap->va_bytes != VNOVAL) ||
1457 	    (vap->va_gen != VNOVAL)) {
1458 		return (EINVAL);
1459 	}
1460 
1461 	de = vp->v_data;
1462 	if (vp->v_type == VDIR)
1463 		de = de->de_dir;
1464 
1465 	error = c = 0;
1466 	if (vap->va_uid == (uid_t)VNOVAL)
1467 		uid = de->de_uid;
1468 	else
1469 		uid = vap->va_uid;
1470 	if (vap->va_gid == (gid_t)VNOVAL)
1471 		gid = de->de_gid;
1472 	else
1473 		gid = vap->va_gid;
1474 	if (uid != de->de_uid || gid != de->de_gid) {
1475 		if ((ap->a_cred->cr_uid != de->de_uid) || uid != de->de_uid ||
1476 		    (gid != de->de_gid && !groupmember(gid, ap->a_cred))) {
1477 			error = priv_check(td, PRIV_VFS_CHOWN);
1478 			if (error)
1479 				return (error);
1480 		}
1481 		de->de_uid = uid;
1482 		de->de_gid = gid;
1483 		c = 1;
1484 	}
1485 
1486 	if (vap->va_mode != (mode_t)VNOVAL) {
1487 		if (ap->a_cred->cr_uid != de->de_uid) {
1488 			error = priv_check(td, PRIV_VFS_ADMIN);
1489 			if (error)
1490 				return (error);
1491 		}
1492 		de->de_mode = vap->va_mode;
1493 		c = 1;
1494 	}
1495 
1496 	if (vap->va_atime.tv_sec != VNOVAL || vap->va_mtime.tv_sec != VNOVAL) {
1497 		/* See the comment in ufs_vnops::ufs_setattr(). */
1498 		if ((error = VOP_ACCESS(vp, VADMIN, ap->a_cred, td)) &&
1499 		    ((vap->va_vaflags & VA_UTIMES_NULL) == 0 ||
1500 		    (error = VOP_ACCESS(vp, VWRITE, ap->a_cred, td))))
1501 			return (error);
1502 		if (vap->va_atime.tv_sec != VNOVAL) {
1503 			if (vp->v_type == VCHR)
1504 				vp->v_rdev->si_atime = vap->va_atime;
1505 			else
1506 				de->de_atime = vap->va_atime;
1507 		}
1508 		if (vap->va_mtime.tv_sec != VNOVAL) {
1509 			if (vp->v_type == VCHR)
1510 				vp->v_rdev->si_mtime = vap->va_mtime;
1511 			else
1512 				de->de_mtime = vap->va_mtime;
1513 		}
1514 		c = 1;
1515 	}
1516 
1517 	if (c) {
1518 		if (vp->v_type == VCHR)
1519 			vfs_timestamp(&vp->v_rdev->si_ctime);
1520 		else
1521 			vfs_timestamp(&de->de_mtime);
1522 	}
1523 	return (0);
1524 }
1525 
1526 #ifdef MAC
1527 static int
1528 devfs_setlabel(struct vop_setlabel_args *ap)
1529 {
1530 	struct vnode *vp;
1531 	struct devfs_dirent *de;
1532 
1533 	vp = ap->a_vp;
1534 	de = vp->v_data;
1535 
1536 	mac_vnode_relabel(ap->a_cred, vp, ap->a_label);
1537 	mac_devfs_update(vp->v_mount, de, vp);
1538 
1539 	return (0);
1540 }
1541 #endif
1542 
1543 static int
1544 devfs_stat_f(struct file *fp, struct stat *sb, struct ucred *cred, struct thread *td)
1545 {
1546 
1547 	return (vnops.fo_stat(fp, sb, cred, td));
1548 }
1549 
1550 static int
1551 devfs_symlink(struct vop_symlink_args *ap)
1552 {
1553 	int i, error;
1554 	struct devfs_dirent *dd;
1555 	struct devfs_dirent *de, *de_covered, *de_dotdot;
1556 	struct devfs_mount *dmp;
1557 
1558 	error = priv_check(curthread, PRIV_DEVFS_SYMLINK);
1559 	if (error)
1560 		return(error);
1561 	dmp = VFSTODEVFS(ap->a_dvp->v_mount);
1562 	if (devfs_populate_vp(ap->a_dvp) != 0)
1563 		return (ENOENT);
1564 
1565 	dd = ap->a_dvp->v_data;
1566 	de = devfs_newdirent(ap->a_cnp->cn_nameptr, ap->a_cnp->cn_namelen);
1567 	de->de_flags = DE_USER;
1568 	de->de_uid = 0;
1569 	de->de_gid = 0;
1570 	de->de_mode = 0755;
1571 	de->de_inode = alloc_unr(devfs_inos);
1572 	de->de_dir = dd;
1573 	de->de_dirent->d_type = DT_LNK;
1574 	i = strlen(ap->a_target) + 1;
1575 	de->de_symlink = malloc(i, M_DEVFS, M_WAITOK);
1576 	bcopy(ap->a_target, de->de_symlink, i);
1577 #ifdef MAC
1578 	mac_devfs_create_symlink(ap->a_cnp->cn_cred, dmp->dm_mount, dd, de);
1579 #endif
1580 	de_covered = devfs_find(dd, de->de_dirent->d_name,
1581 	    de->de_dirent->d_namlen, 0);
1582 	if (de_covered != NULL) {
1583 		if ((de_covered->de_flags & DE_USER) != 0) {
1584 			devfs_delete(dmp, de, DEVFS_DEL_NORECURSE);
1585 			sx_xunlock(&dmp->dm_lock);
1586 			return (EEXIST);
1587 		}
1588 		KASSERT((de_covered->de_flags & DE_COVERED) == 0,
1589 		    ("devfs_symlink: entry %p already covered", de_covered));
1590 		de_covered->de_flags |= DE_COVERED;
1591 	}
1592 
1593 	de_dotdot = TAILQ_FIRST(&dd->de_dlist);		/* "." */
1594 	de_dotdot = TAILQ_NEXT(de_dotdot, de_list);	/* ".." */
1595 	TAILQ_INSERT_AFTER(&dd->de_dlist, de_dotdot, de, de_list);
1596 	devfs_dir_ref_de(dmp, dd);
1597 	devfs_rules_apply(dmp, de);
1598 
1599 	return (devfs_allocv(de, ap->a_dvp->v_mount, LK_EXCLUSIVE, ap->a_vpp));
1600 }
1601 
1602 static int
1603 devfs_truncate_f(struct file *fp, off_t length, struct ucred *cred, struct thread *td)
1604 {
1605 
1606 	return (vnops.fo_truncate(fp, length, cred, td));
1607 }
1608 
1609 /* ARGSUSED */
1610 static int
1611 devfs_write_f(struct file *fp, struct uio *uio, struct ucred *cred, int flags, struct thread *td)
1612 {
1613 	struct cdev *dev;
1614 	int error, ioflag, ref, resid;
1615 	struct cdevsw *dsw;
1616 	struct file *fpop;
1617 
1618 	fpop = td->td_fpop;
1619 	error = devfs_fp_check(fp, &dev, &dsw, &ref);
1620 	if (error)
1621 		return (error);
1622 	KASSERT(uio->uio_td == td, ("uio_td %p is not td %p", uio->uio_td, td));
1623 	ioflag = fp->f_flag & (O_NONBLOCK | O_DIRECT | O_FSYNC);
1624 	if (ioflag & O_DIRECT)
1625 		ioflag |= IO_DIRECT;
1626 	if ((flags & FOF_OFFSET) == 0)
1627 		uio->uio_offset = fp->f_offset;
1628 
1629 	resid = uio->uio_resid;
1630 
1631 	error = dsw->d_write(dev, uio, ioflag);
1632 	if (uio->uio_resid != resid || (error == 0 && resid != 0)) {
1633 		vfs_timestamp(&dev->si_ctime);
1634 		dev->si_mtime = dev->si_ctime;
1635 	}
1636 	td->td_fpop = fpop;
1637 	dev_relthread(dev, ref);
1638 
1639 	if ((flags & FOF_OFFSET) == 0)
1640 		fp->f_offset = uio->uio_offset;
1641 	fp->f_nextoff = uio->uio_offset;
1642 	return (error);
1643 }
1644 
1645 dev_t
1646 dev2udev(struct cdev *x)
1647 {
1648 	if (x == NULL)
1649 		return (NODEV);
1650 	return (cdev2priv(x)->cdp_inode);
1651 }
1652 
1653 static struct fileops devfs_ops_f = {
1654 	.fo_read =	devfs_read_f,
1655 	.fo_write =	devfs_write_f,
1656 	.fo_truncate =	devfs_truncate_f,
1657 	.fo_ioctl =	devfs_ioctl_f,
1658 	.fo_poll =	devfs_poll_f,
1659 	.fo_kqfilter =	devfs_kqfilter_f,
1660 	.fo_stat =	devfs_stat_f,
1661 	.fo_close =	devfs_close_f,
1662 	.fo_flags =	DFLAG_PASSABLE | DFLAG_SEEKABLE
1663 };
1664 
1665 static struct vop_vector devfs_vnodeops = {
1666 	.vop_default =		&default_vnodeops,
1667 
1668 	.vop_access =		devfs_access,
1669 	.vop_getattr =		devfs_getattr,
1670 	.vop_ioctl =		devfs_rioctl,
1671 	.vop_lookup =		devfs_lookup,
1672 	.vop_mknod =		devfs_mknod,
1673 	.vop_pathconf =		devfs_pathconf,
1674 	.vop_read =		devfs_rread,
1675 	.vop_readdir =		devfs_readdir,
1676 	.vop_readlink =		devfs_readlink,
1677 	.vop_reclaim =		devfs_reclaim,
1678 	.vop_remove =		devfs_remove,
1679 	.vop_revoke =		devfs_revoke,
1680 	.vop_setattr =		devfs_setattr,
1681 #ifdef MAC
1682 	.vop_setlabel =		devfs_setlabel,
1683 #endif
1684 	.vop_symlink =		devfs_symlink,
1685 	.vop_vptocnp =		devfs_vptocnp,
1686 };
1687 
1688 static struct vop_vector devfs_specops = {
1689 	.vop_default =		&default_vnodeops,
1690 
1691 	.vop_access =		devfs_access,
1692 	.vop_bmap =		VOP_PANIC,
1693 	.vop_close =		devfs_close,
1694 	.vop_create =		VOP_PANIC,
1695 	.vop_fsync =		devfs_fsync,
1696 	.vop_getattr =		devfs_getattr,
1697 	.vop_link =		VOP_PANIC,
1698 	.vop_mkdir =		VOP_PANIC,
1699 	.vop_mknod =		VOP_PANIC,
1700 	.vop_open =		devfs_open,
1701 	.vop_pathconf =		devfs_pathconf,
1702 	.vop_print =		devfs_print,
1703 	.vop_read =		VOP_PANIC,
1704 	.vop_readdir =		VOP_PANIC,
1705 	.vop_readlink =		VOP_PANIC,
1706 	.vop_reallocblks =	VOP_PANIC,
1707 	.vop_reclaim =		devfs_reclaim,
1708 	.vop_remove =		devfs_remove,
1709 	.vop_rename =		VOP_PANIC,
1710 	.vop_revoke =		devfs_revoke,
1711 	.vop_rmdir =		VOP_PANIC,
1712 	.vop_setattr =		devfs_setattr,
1713 #ifdef MAC
1714 	.vop_setlabel =		devfs_setlabel,
1715 #endif
1716 	.vop_strategy =		VOP_PANIC,
1717 	.vop_symlink =		VOP_PANIC,
1718 	.vop_vptocnp =		devfs_vptocnp,
1719 	.vop_write =		VOP_PANIC,
1720 };
1721 
1722 /*
1723  * Our calling convention to the device drivers used to be that we passed
1724  * vnode.h IO_* flags to read()/write(), but we're moving to fcntl.h O_
1725  * flags instead since that's what open(), close() and ioctl() takes and
1726  * we don't really want vnode.h in device drivers.
1727  * We solved the source compatibility by redefining some vnode flags to
1728  * be the same as the fcntl ones and by sending down the bitwise OR of
1729  * the respective fcntl/vnode flags.  These CTASSERTS make sure nobody
1730  * pulls the rug out under this.
1731  */
1732 CTASSERT(O_NONBLOCK == IO_NDELAY);
1733 CTASSERT(O_FSYNC == IO_SYNC);
1734