1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 /*
22  * Copyright 2007 Sun Microsystems, Inc.  All rights reserved.
23  * Use is subject to license terms.
24  */
25 
26 /*	Copyright (c) 1983, 1984, 1985, 1986, 1987, 1988, 1989 AT&T	*/
27 /*	  All Rights Reserved  	*/
28 
29 /*
30  * University Copyright- Copyright (c) 1982, 1986, 1988
31  * The Regents of the University of California
32  * All Rights Reserved
33  *
34  * University Acknowledgment- Portions of this document are derived from
35  * software developed by the University of California, Berkeley, and its
36  * contributors.
37  */
38 
39 
40 #pragma ident	"%Z%%M%	%I%	%E% SMI"
41 
42 #include <sys/types.h>
43 #include <sys/thread.h>
44 #include <sys/t_lock.h>
45 #include <sys/param.h>
46 #include <sys/systm.h>
47 #include <sys/bitmap.h>
48 #include <sys/buf.h>
49 #include <sys/cmn_err.h>
50 #include <sys/conf.h>
51 #include <sys/ddi.h>
52 #include <sys/debug.h>
53 #include <sys/dkio.h>
54 #include <sys/errno.h>
55 #include <sys/time.h>
56 #include <sys/fcntl.h>
57 #include <sys/flock.h>
58 #include <sys/file.h>
59 #include <sys/kmem.h>
60 #include <sys/mman.h>
61 #include <sys/open.h>
62 #include <sys/swap.h>
63 #include <sys/sysmacros.h>
64 #include <sys/uio.h>
65 #include <sys/vfs.h>
66 #include <sys/vfs_opreg.h>
67 #include <sys/vnode.h>
68 #include <sys/stat.h>
69 #include <sys/poll.h>
70 #include <sys/stream.h>
71 #include <sys/strsubr.h>
72 #include <sys/policy.h>
73 #include <sys/devpolicy.h>
74 
75 #include <sys/proc.h>
76 #include <sys/user.h>
77 #include <sys/session.h>
78 #include <sys/vmsystm.h>
79 #include <sys/vtrace.h>
80 #include <sys/pathname.h>
81 
82 #include <sys/fs/snode.h>
83 
84 #include <vm/seg.h>
85 #include <vm/seg_map.h>
86 #include <vm/page.h>
87 #include <vm/pvn.h>
88 #include <vm/seg_dev.h>
89 #include <vm/seg_vn.h>
90 
91 #include <fs/fs_subr.h>
92 
93 #include <sys/esunddi.h>
94 #include <sys/autoconf.h>
95 #include <sys/sunndi.h>
96 
97 
98 static int spec_open(struct vnode **, int, struct cred *);
99 static int spec_close(struct vnode *, int, int, offset_t, struct cred *);
100 static int spec_read(struct vnode *, struct uio *, int, struct cred *,
101 	struct caller_context *);
102 static int spec_write(struct vnode *, struct uio *, int, struct cred *,
103 	struct caller_context *);
104 static int spec_ioctl(struct vnode *, int, intptr_t, int, struct cred *, int *);
105 static int spec_getattr(struct vnode *, struct vattr *, int, struct cred *);
106 static int spec_setattr(struct vnode *, struct vattr *, int, struct cred *,
107 	caller_context_t *);
108 static int spec_access(struct vnode *, int, int, struct cred *);
109 static int spec_create(struct vnode *, char *, vattr_t *, enum vcexcl,
110     int, struct vnode **, struct cred *, int);
111 static int spec_fsync(struct vnode *, int, struct cred *);
112 static void spec_inactive(struct vnode *, struct cred *);
113 static int spec_fid(struct vnode *, struct fid *);
114 static int spec_seek(struct vnode *, offset_t, offset_t *);
115 static int spec_frlock(struct vnode *, int, struct flock64 *, int, offset_t,
116     struct flk_callback *, struct cred *);
117 static int spec_realvp(struct vnode *, struct vnode **);
118 
119 static int spec_getpage(struct vnode *, offset_t, size_t, uint_t *, page_t **,
120     size_t, struct seg *, caddr_t, enum seg_rw, struct cred *);
121 static int spec_putapage(struct vnode *, page_t *, u_offset_t *, size_t *, int,
122 	struct cred *);
123 static struct buf *spec_startio(struct vnode *, page_t *, u_offset_t, size_t,
124 	int);
125 static int spec_getapage(struct vnode *, u_offset_t, size_t, uint_t *,
126     page_t **, size_t, struct seg *, caddr_t, enum seg_rw, struct cred *);
127 static int spec_map(struct vnode *, offset_t, struct as *, caddr_t *, size_t,
128     uchar_t, uchar_t, uint_t, struct cred *);
129 static int spec_addmap(struct vnode *, offset_t, struct as *, caddr_t, size_t,
130     uchar_t, uchar_t, uint_t, struct cred *);
131 static int spec_delmap(struct vnode *, offset_t, struct as *, caddr_t, size_t,
132     uint_t, uint_t, uint_t, struct cred *);
133 
134 static int spec_poll(struct vnode *, short, int, short *, struct pollhead **);
135 static int spec_dump(struct vnode *, caddr_t, int, int);
136 static int spec_pageio(struct vnode *, page_t *, u_offset_t, size_t, int,
137     cred_t *);
138 
139 static int spec_getsecattr(struct vnode *, vsecattr_t *, int, struct cred *);
140 static int spec_setsecattr(struct vnode *, vsecattr_t *, int, struct cred *);
141 static int spec_pathconf(struct	vnode *, int, ulong_t *, struct cred *);
142 
143 #define	SN_HOLD(csp)	{ \
144 	mutex_enter(&csp->s_lock); \
145 	csp->s_count++; \
146 	mutex_exit(&csp->s_lock); \
147 }
148 
149 #define	SN_RELE(csp)	{ \
150 	mutex_enter(&csp->s_lock); \
151 	csp->s_count--; \
152 	ASSERT((csp->s_count > 0) || (csp->s_vnode->v_stream == NULL)); \
153 	mutex_exit(&csp->s_lock); \
154 }
155 
156 struct vnodeops *spec_vnodeops;
157 
158 const fs_operation_def_t spec_vnodeops_template[] = {
159 	VOPNAME_OPEN,		{ .vop_open = spec_open },
160 	VOPNAME_CLOSE,		{ .vop_close = spec_close },
161 	VOPNAME_READ,		{ .vop_read = spec_read },
162 	VOPNAME_WRITE,		{ .vop_write = spec_write },
163 	VOPNAME_IOCTL,		{ .vop_ioctl = spec_ioctl },
164 	VOPNAME_GETATTR,	{ .vop_getattr = spec_getattr },
165 	VOPNAME_SETATTR,	{ .vop_setattr = spec_setattr },
166 	VOPNAME_ACCESS,		{ .vop_access = spec_access },
167 	VOPNAME_CREATE,		{ .vop_create = spec_create },
168 	VOPNAME_FSYNC,		{ .vop_fsync = spec_fsync },
169 	VOPNAME_INACTIVE,	{ .vop_inactive = spec_inactive },
170 	VOPNAME_FID,		{ .vop_fid = spec_fid },
171 	VOPNAME_SEEK,		{ .vop_seek = spec_seek },
172 	VOPNAME_PATHCONF,	{ .vop_pathconf = spec_pathconf },
173 	VOPNAME_FRLOCK,		{ .vop_frlock = spec_frlock },
174 	VOPNAME_REALVP,		{ .vop_realvp = spec_realvp },
175 	VOPNAME_GETPAGE,	{ .vop_getpage = spec_getpage },
176 	VOPNAME_PUTPAGE,	{ .vop_putpage = spec_putpage },
177 	VOPNAME_MAP,		{ .vop_map = spec_map },
178 	VOPNAME_ADDMAP,		{ .vop_addmap = spec_addmap },
179 	VOPNAME_DELMAP,		{ .vop_delmap = spec_delmap },
180 	VOPNAME_POLL,		{ .vop_poll = spec_poll },
181 	VOPNAME_DUMP,		{ .vop_dump = spec_dump },
182 	VOPNAME_PAGEIO,		{ .vop_pageio = spec_pageio },
183 	VOPNAME_SETSECATTR,	{ .vop_setsecattr = spec_setsecattr },
184 	VOPNAME_GETSECATTR,	{ .vop_getsecattr = spec_getsecattr },
185 	NULL,			NULL
186 };
187 
188 /*
189  * Return address of spec_vnodeops
190  */
191 struct vnodeops *
192 spec_getvnodeops(void)
193 {
194 	return (spec_vnodeops);
195 }
196 
197 extern vnode_t *rconsvp;
198 
199 /*
200  * Acquire the serial lock on the common snode.
201  */
202 #define	LOCK_CSP(csp)			(void) spec_lockcsp(csp, 0, 1, 0)
203 #define	LOCKHOLD_CSP_SIG(csp)		spec_lockcsp(csp, 1, 1, 1)
204 #define	SYNCHOLD_CSP_SIG(csp, intr)	spec_lockcsp(csp, intr, 0, 1)
205 
206 /*
207  * Synchronize with active SLOCKED, optionally checking for a signal and
208  * optionally returning with SLOCKED set and SN_HOLD done.  The 'intr'
209  * argument determines if the thread is interruptible by a signal while
210  * waiting, the function returns 0 if interrupted.  When 1 is returned
211  * the 'hold' argument determines if the open count (SN_HOLD) has been
212  * incremented and the 'setlock' argument determines if the function
213  * returns with SLOCKED set.
214  */
215 static int
216 spec_lockcsp(struct snode *csp, int intr, int setlock, int hold)
217 {
218 	mutex_enter(&csp->s_lock);
219 	while (csp->s_flag & SLOCKED) {
220 		csp->s_flag |= SWANT;
221 		if (intr) {
222 			if (!cv_wait_sig(&csp->s_cv, &csp->s_lock)) {
223 				mutex_exit(&csp->s_lock);
224 				return (0);		/* interrupted */
225 			}
226 		} else {
227 			cv_wait(&csp->s_cv, &csp->s_lock);
228 		}
229 	}
230 	if (setlock)
231 		csp->s_flag |= SLOCKED;
232 	if (hold)
233 		csp->s_count++;		/* one more open reference : SN_HOLD */
234 	mutex_exit(&csp->s_lock);
235 	return (1);			/* serialized/locked */
236 }
237 
238 /*
239  * Unlock the serial lock on the common snode
240  */
241 #define	UNLOCK_CSP_LOCK_HELD(csp)			\
242 	ASSERT(mutex_owned(&csp->s_lock));		\
243 	if (csp->s_flag & SWANT)			\
244 		cv_broadcast(&csp->s_cv);		\
245 	csp->s_flag &= ~(SWANT|SLOCKED);
246 
247 #define	UNLOCK_CSP(csp)					\
248 	mutex_enter(&csp->s_lock);			\
249 	UNLOCK_CSP_LOCK_HELD(csp);			\
250 	mutex_exit(&csp->s_lock);
251 
252 /*
253  * compute/return the size of the device
254  */
255 #define	SPEC_SIZE(csp)	\
256 	(((csp)->s_flag & SSIZEVALID) ? (csp)->s_size : spec_size(csp))
257 
258 /*
259  * Compute and return the size.  If the size in the common snode is valid then
260  * return it.  If not valid then get the size from the driver and set size in
261  * the common snode.  If the device has not been attached then we don't ask for
262  * an update from the driver- for non-streams SSIZEVALID stays unset until the
263  * device is attached. A stat of a mknod outside /devices (non-devfs) may
264  * report UNKNOWN_SIZE because the device may not be attached yet (SDIPSET not
265  * established in mknod until open time). An stat in /devices will report the
266  * size correctly.  Specfs should always call SPEC_SIZE instead of referring
267  * directly to s_size to initialize/retrieve the size of a device.
268  *
269  * XXX There is an inconsistency between block and raw - "unknown" is
270  * UNKNOWN_SIZE for VBLK and 0 for VCHR(raw).
271  */
272 static u_offset_t
273 spec_size(struct snode *csp)
274 {
275 	struct vnode	*cvp = STOV(csp);
276 	u_offset_t	size;
277 	int		plen;
278 	uint32_t	size32;
279 	dev_t		dev;
280 	dev_info_t	*devi;
281 	major_t		maj;
282 	uint_t		blksize;
283 	int		blkshift;
284 
285 	ASSERT((csp)->s_commonvp == cvp);	/* must be common node */
286 
287 	/* return cached value */
288 	mutex_enter(&csp->s_lock);
289 	if (csp->s_flag & SSIZEVALID) {
290 		mutex_exit(&csp->s_lock);
291 		return (csp->s_size);
292 	}
293 
294 	/* VOP_GETATTR of mknod has not had devcnt restriction applied */
295 	dev = cvp->v_rdev;
296 	maj = getmajor(dev);
297 	if (maj >= devcnt) {
298 		/* return non-cached UNKNOWN_SIZE */
299 		mutex_exit(&csp->s_lock);
300 		return ((cvp->v_type == VCHR) ? 0 : UNKNOWN_SIZE);
301 	}
302 
303 	/* establish cached zero size for streams */
304 	if (STREAMSTAB(maj)) {
305 		csp->s_size = 0;
306 		csp->s_flag |= SSIZEVALID;
307 		mutex_exit(&csp->s_lock);
308 		return (0);
309 	}
310 
311 	/*
312 	 * Return non-cached UNKNOWN_SIZE if not open.
313 	 *
314 	 * NB: This check is bogus, calling prop_op(9E) should be gated by
315 	 * attach, not open. Not having this check however opens up a new
316 	 * context under which a driver's prop_op(9E) could be called. Calling
317 	 * prop_op(9E) in this new context has been shown to expose latent
318 	 * driver bugs (insufficient NULL pointer checks that lead to panic).
319 	 * We are keeping this open check for now to avoid these panics.
320 	 */
321 	if (csp->s_count == 0) {
322 		mutex_exit(&csp->s_lock);
323 		return ((cvp->v_type == VCHR) ? 0 : UNKNOWN_SIZE);
324 	}
325 
326 	/* Return non-cached UNKNOWN_SIZE if not attached. */
327 	if (((csp->s_flag & SDIPSET) == 0) || (csp->s_dip == NULL) ||
328 	    !i_ddi_devi_attached(csp->s_dip)) {
329 		mutex_exit(&csp->s_lock);
330 		return ((cvp->v_type == VCHR) ? 0 : UNKNOWN_SIZE);
331 	}
332 
333 	devi = csp->s_dip;
334 
335 	/*
336 	 * Established cached size obtained from the attached driver. Since we
337 	 * know the devinfo node, for efficiency we use cdev_prop_op directly
338 	 * instead of [cb]dev_[Ss]size.
339 	 */
340 	if (cvp->v_type == VCHR) {
341 		size = 0;
342 		plen = sizeof (size);
343 		if (cdev_prop_op(dev, devi, PROP_LEN_AND_VAL_BUF,
344 		    DDI_PROP_NOTPROM | DDI_PROP_DONTPASS |
345 		    DDI_PROP_CONSUMER_TYPED, "Size", (caddr_t)&size,
346 		    &plen) != DDI_PROP_SUCCESS) {
347 			plen = sizeof (size32);
348 			if (cdev_prop_op(dev, devi, PROP_LEN_AND_VAL_BUF,
349 			    DDI_PROP_NOTPROM | DDI_PROP_DONTPASS,
350 			    "size", (caddr_t)&size32, &plen) ==
351 			    DDI_PROP_SUCCESS)
352 				size = size32;
353 		}
354 	} else {
355 		size = UNKNOWN_SIZE;
356 		plen = sizeof (size);
357 		if (cdev_prop_op(dev, devi, PROP_LEN_AND_VAL_BUF,
358 		    DDI_PROP_NOTPROM | DDI_PROP_DONTPASS |
359 		    DDI_PROP_CONSUMER_TYPED, "Nblocks", (caddr_t)&size,
360 		    &plen) != DDI_PROP_SUCCESS) {
361 			plen = sizeof (size32);
362 			if (cdev_prop_op(dev, devi, PROP_LEN_AND_VAL_BUF,
363 			    DDI_PROP_NOTPROM | DDI_PROP_DONTPASS,
364 			    "nblocks", (caddr_t)&size32, &plen) ==
365 			    DDI_PROP_SUCCESS)
366 				size = size32;
367 		}
368 
369 		if (size != UNKNOWN_SIZE) {
370 			blksize = DEV_BSIZE;		/* default */
371 			plen = sizeof (blksize);
372 
373 			/* try to get dev_t specific "blksize" */
374 			if (cdev_prop_op(dev, devi, PROP_LEN_AND_VAL_BUF,
375 			    DDI_PROP_NOTPROM | DDI_PROP_DONTPASS,
376 			    "blksize", (caddr_t)&blksize, &plen) !=
377 			    DDI_PROP_SUCCESS) {
378 				/*
379 				 * Try for dev_info node "device-blksize".
380 				 * If this fails then blksize will still be
381 				 * DEV_BSIZE default value.
382 				 */
383 				(void) cdev_prop_op(DDI_DEV_T_ANY, devi,
384 				    PROP_LEN_AND_VAL_BUF,
385 				    DDI_PROP_NOTPROM | DDI_PROP_DONTPASS,
386 				    "device-blksize", (caddr_t)&blksize, &plen);
387 			}
388 
389 			/* blksize must be a power of two */
390 			ASSERT(BIT_ONLYONESET(blksize));
391 			blkshift = highbit(blksize) - 1;
392 
393 			/* convert from block size to byte size */
394 			if (size < (MAXOFFSET_T >> blkshift))
395 				size = size << blkshift;
396 			else
397 				size = UNKNOWN_SIZE;
398 		}
399 	}
400 
401 	csp->s_size = size;
402 	csp->s_flag |= SSIZEVALID;
403 
404 	mutex_exit(&csp->s_lock);
405 	return (size);
406 }
407 
408 /*
409  * This function deal with vnode substitution in the case of
410  * device cloning.
411  */
412 static int
413 spec_clone(struct vnode **vpp, dev_t newdev, int vtype, struct stdata *stp)
414 {
415 	dev_t		dev = (*vpp)->v_rdev;
416 	major_t		maj = getmajor(dev);
417 	major_t 	newmaj = getmajor(newdev);
418 	int		sysclone = (maj == clone_major);
419 	int		qassociate_used = 0;
420 	struct snode	*oldsp, *oldcsp;
421 	struct snode	*newsp, *newcsp;
422 	struct vnode	*newvp, *newcvp;
423 	dev_info_t	*dip;
424 	queue_t		*dq;
425 
426 	ASSERT(dev != newdev);
427 
428 	/*
429 	 * Check for cloning across different drivers.
430 	 * We only support this under the system provided clone driver
431 	 */
432 	if ((maj != newmaj) && !sysclone) {
433 		cmn_err(CE_NOTE,
434 		    "unsupported clone open maj = %u, newmaj = %u",
435 		    maj, newmaj);
436 		return (ENXIO);
437 	}
438 
439 	/* old */
440 	oldsp = VTOS(*vpp);
441 	oldcsp = VTOS(oldsp->s_commonvp);
442 
443 	/* new */
444 	newvp = makespecvp(newdev, vtype);
445 	ASSERT(newvp != NULL);
446 	newsp = VTOS(newvp);
447 	newcvp = newsp->s_commonvp;
448 	newcsp = VTOS(newcvp);
449 
450 	/*
451 	 * Clones inherit fsid, realvp, and dip.
452 	 * XXX realvp inherit is not occurring, does fstat of clone work?
453 	 */
454 	newsp->s_fsid = oldsp->s_fsid;
455 	if (sysclone) {
456 		newsp->s_flag |= SCLONE;
457 		dip = NULL;
458 	} else {
459 		newsp->s_flag |= SSELFCLONE;
460 		dip = oldcsp->s_dip;
461 	}
462 
463 	/*
464 	 * If we cloned to an opened newdev that already has called
465 	 * spec_assoc_vp_with_devi (SDIPSET set) then the association is
466 	 * already established.
467 	 */
468 	if (!(newcsp->s_flag & SDIPSET)) {
469 		/*
470 		 * Establish s_dip association for newdev.
471 		 *
472 		 * If we trusted the getinfo(9E) DDI_INFO_DEVT2INSTANCE
473 		 * implementation of all cloning drivers  (SCLONE and SELFCLONE)
474 		 * we would always use e_ddi_hold_devi_by_dev().  We know that
475 		 * many drivers have had (still have?) problems with
476 		 * DDI_INFO_DEVT2INSTANCE, so we try to minimize reliance by
477 		 * detecting drivers that use QASSOCIATE (by looking down the
478 		 * stream) and setting their s_dip association to NULL.
479 		 */
480 		qassociate_used = 0;
481 		if (stp) {
482 			for (dq = stp->sd_wrq; dq; dq = dq->q_next) {
483 				if (_RD(dq)->q_flag & _QASSOCIATED) {
484 					qassociate_used = 1;
485 					dip = NULL;
486 					break;
487 				}
488 			}
489 		}
490 
491 		if (dip || qassociate_used) {
492 			spec_assoc_vp_with_devi(newvp, dip);
493 		} else {
494 			/* derive association from newdev */
495 			dip = e_ddi_hold_devi_by_dev(newdev, 0);
496 			spec_assoc_vp_with_devi(newvp, dip);
497 			if (dip)
498 				ddi_release_devi(dip);
499 		}
500 	}
501 
502 	SN_HOLD(newcsp);
503 
504 	/* deal with stream stuff */
505 	if (stp != NULL) {
506 		LOCK_CSP(newcsp);	/* synchronize stream open/close */
507 		mutex_enter(&newcsp->s_lock);
508 		newcvp->v_stream = newvp->v_stream = stp;
509 		stp->sd_vnode = newcvp;
510 		stp->sd_strtab = STREAMSTAB(newmaj);
511 		mutex_exit(&newcsp->s_lock);
512 		UNLOCK_CSP(newcsp);
513 	}
514 
515 	/* substitute the vnode */
516 	SN_RELE(oldcsp);
517 	VN_RELE(*vpp);
518 	*vpp = newvp;
519 
520 	return (0);
521 }
522 
523 static int
524 spec_open(struct vnode **vpp, int flag, struct cred *cr)
525 {
526 	major_t maj;
527 	dev_t dev, newdev;
528 	struct vnode *vp, *cvp;
529 	struct snode *sp, *csp;
530 	struct stdata *stp;
531 	dev_info_t *dip;
532 	int error, type;
533 	int open_returns_eintr;
534 
535 	flag &= ~FCREAT;		/* paranoia */
536 
537 	vp = *vpp;
538 	sp = VTOS(vp);
539 	ASSERT((vp->v_type == VCHR) || (vp->v_type == VBLK));
540 	if ((vp->v_type != VCHR) && (vp->v_type != VBLK))
541 		return (ENXIO);
542 
543 	/*
544 	 * If the VFS_NODEVICES bit was set for the mount,
545 	 * do not allow opens of special devices.
546 	 */
547 	if (sp->s_realvp && (sp->s_realvp->v_vfsp->vfs_flag & VFS_NODEVICES))
548 		return (ENXIO);
549 
550 	newdev = dev = vp->v_rdev;
551 
552 	/*
553 	 * If we are opening a node that has not had spec_assoc_vp_with_devi
554 	 * called against it (mknod outside /devices or a non-dacf makespecvp
555 	 * node) then SDIPSET will not be set. In this case we call an
556 	 * interface which will reconstruct the path and lookup (drive attach)
557 	 * through devfs (e_ddi_hold_devi_by_dev -> e_ddi_hold_devi_by_path ->
558 	 * devfs_lookupname).  For support of broken drivers that don't call
559 	 * ddi_create_minor_node for all minor nodes in their instance space,
560 	 * we call interfaces that operates at the directory/devinfo
561 	 * (major/instance) level instead of to the leaf/minor node level.
562 	 * After finding and attaching the dip we associate it with the
563 	 * common specfs vnode (s_dip), which sets SDIPSET.  A DL_DETACH_REQ
564 	 * to style-2 stream driver may set s_dip to NULL with SDIPSET set.
565 	 *
566 	 * NOTE: Although e_ddi_hold_devi_by_dev takes a dev_t argument, its
567 	 * implementation operates at the major/instance level since it only
568 	 * need to return a dip.
569 	 */
570 	cvp = sp->s_commonvp;
571 	csp = VTOS(cvp);
572 	if (!(csp->s_flag & SDIPSET)) {
573 		/* try to attach, return error if we fail */
574 		if ((dip = e_ddi_hold_devi_by_dev(dev, 0)) == NULL)
575 			return (ENXIO);
576 
577 		/* associate dip with the common snode s_dip */
578 		spec_assoc_vp_with_devi(vp, dip);
579 		ddi_release_devi(dip);	/* from e_ddi_hold_devi_by_dev */
580 	}
581 
582 #ifdef  DEBUG
583 	/* verify attach/open exclusion guarantee */
584 	dip = csp->s_dip;
585 	ASSERT((dip == NULL) || i_ddi_devi_attached(dip));
586 #endif  /* DEBUG */
587 
588 	if ((error = secpolicy_spec_open(cr, vp, flag)) != 0)
589 		return (error);
590 
591 	maj = getmajor(dev);
592 	if (STREAMSTAB(maj))
593 		goto streams_open;
594 
595 	/*
596 	 * Wait for in progress last close to complete. This guarantees
597 	 * to the driver writer that we will never be in the drivers
598 	 * open and close on the same (dev_t, otype) at the same time.
599 	 * Open count already incremented (SN_HOLD) on non-zero return.
600 	 * The wait is interruptible by a signal if the driver sets the
601 	 * D_OPEN_RETURNS_EINTR cb_ops(9S) cb_flag or sets the
602 	 * ddi-open-returns-eintr(9P) property in its driver.conf.
603 	 */
604 	if ((devopsp[maj]->devo_cb_ops->cb_flag & D_OPEN_RETURNS_EINTR) ||
605 	    (devnamesp[maj].dn_flags & DN_OPEN_RETURNS_EINTR))
606 		open_returns_eintr = 1;
607 	else
608 		open_returns_eintr = 0;
609 	while (SYNCHOLD_CSP_SIG(csp, open_returns_eintr) == 0) {
610 		if (csp->s_flag & SCLOSING)
611 			return (EINTR);
612 	}
613 
614 	/* non streams open */
615 	type = (vp->v_type == VBLK ? OTYP_BLK : OTYP_CHR);
616 	error = dev_open(&newdev, flag, type, cr);
617 
618 	/* deal with clone case */
619 	if (error == 0 && dev != newdev) {
620 		error = spec_clone(vpp, newdev, vp->v_type, NULL);
621 		/*
622 		 * bail on clone failure, further processing
623 		 * results in undefined behaviors.
624 		 */
625 		if (error != 0)
626 			return (error);
627 		sp = VTOS(*vpp);
628 		csp = VTOS(sp->s_commonvp);
629 	}
630 
631 	if (error == 0) {
632 		sp->s_size = SPEC_SIZE(csp);
633 
634 		if ((csp->s_flag & SNEEDCLOSE) == 0) {
635 			int nmaj = getmajor(newdev);
636 			mutex_enter(&csp->s_lock);
637 			/* successful open needs a close later */
638 			csp->s_flag |= SNEEDCLOSE;
639 
640 			/*
641 			 * Invalidate possible cached "unknown" size
642 			 * established by a VOP_GETATTR while open was in
643 			 * progress, and the driver might fail prop_op(9E).
644 			 */
645 			if (((cvp->v_type == VCHR) && (csp->s_size == 0)) ||
646 			    ((cvp->v_type == VBLK) &&
647 			    (csp->s_size == UNKNOWN_SIZE)))
648 				csp->s_flag &= ~SSIZEVALID;
649 
650 			if (devopsp[nmaj]->devo_cb_ops->cb_flag & D_64BIT)
651 				csp->s_flag |= SLOFFSET;
652 			if (devopsp[nmaj]->devo_cb_ops->cb_flag & D_U64BIT)
653 				csp->s_flag |= SLOFFSET | SANYOFFSET;
654 			mutex_exit(&csp->s_lock);
655 		}
656 		return (0);
657 	}
658 
659 	/*
660 	 * Open failed. If we missed a close operation because
661 	 * we were trying to get the device open and it is the
662 	 * last in progress open that is failing then call close.
663 	 *
664 	 * NOTE: Only non-streams open has this race condition.
665 	 */
666 	mutex_enter(&csp->s_lock);
667 	csp->s_count--;			/* decrement open count : SN_RELE */
668 	if ((csp->s_count == 0) &&	/* no outstanding open */
669 	    (csp->s_mapcnt == 0) &&	/* no mapping */
670 	    (csp->s_flag & SNEEDCLOSE)) { /* need a close */
671 		csp->s_flag &= ~(SNEEDCLOSE | SSIZEVALID);
672 
673 		/* See comment in spec_close() */
674 		if (csp->s_flag & (SCLONE | SSELFCLONE))
675 			csp->s_flag &= ~SDIPSET;
676 
677 		csp->s_flag |= SCLOSING;
678 		mutex_exit(&csp->s_lock);
679 
680 		ASSERT(*vpp != NULL);
681 		(void) device_close(*vpp, flag, cr);
682 
683 		mutex_enter(&csp->s_lock);
684 		csp->s_flag &= ~SCLOSING;
685 		mutex_exit(&csp->s_lock);
686 	} else {
687 		mutex_exit(&csp->s_lock);
688 	}
689 	return (error);
690 
691 streams_open:
692 	if (vp->v_type != VCHR)
693 		return (ENXIO);
694 
695 	/*
696 	 * Lock common snode to prevent any new clone opens on this
697 	 * stream while one is in progress. This is necessary since
698 	 * the stream currently associated with the clone device will
699 	 * not be part of it after the clone open completes. Unfortunately
700 	 * we don't know in advance if this is a clone
701 	 * device so we have to lock all opens.
702 	 *
703 	 * If we fail, it's because of an interrupt - EINTR return is an
704 	 * expected aspect of opening a stream so we don't need to check
705 	 * D_OPEN_RETURNS_EINTR. Open count already incremented (SN_HOLD)
706 	 * on non-zero return.
707 	 */
708 	if (LOCKHOLD_CSP_SIG(csp) == 0)
709 		return (EINTR);
710 
711 	error = stropen(cvp, &newdev, flag, cr);
712 	stp = cvp->v_stream;
713 
714 	/* deal with the clone case */
715 	if ((error == 0) && (dev != newdev)) {
716 		vp->v_stream = cvp->v_stream = NULL;
717 		UNLOCK_CSP(csp);
718 		error = spec_clone(vpp, newdev, vp->v_type, stp);
719 		/*
720 		 * bail on clone failure, further processing
721 		 * results in undefined behaviors.
722 		 */
723 		if (error != 0)
724 			return (error);
725 		sp = VTOS(*vpp);
726 		csp = VTOS(sp->s_commonvp);
727 	} else if (error == 0) {
728 		vp->v_stream = stp;
729 		UNLOCK_CSP(csp);
730 	}
731 
732 	if (error == 0) {
733 		/* STREAMS devices don't have a size */
734 		sp->s_size = csp->s_size = 0;
735 
736 		if (!(stp->sd_flag & STRISTTY) || (flag & FNOCTTY))
737 			return (0);
738 
739 		/* try to allocate it as a controlling terminal */
740 		if (strctty(stp) != EINTR)
741 			return (0);
742 
743 		/* strctty() was interrupted by a signal */
744 		(void) spec_close(vp, flag, 1, 0, cr);
745 		return (EINTR);
746 	}
747 
748 	/*
749 	 * Deal with stropen failure.
750 	 *
751 	 * sd_flag in the stream head cannot change since the
752 	 * common snode is locked before the call to stropen().
753 	 */
754 	if ((stp != NULL) && (stp->sd_flag & STREOPENFAIL)) {
755 		/*
756 		 * Open failed part way through.
757 		 */
758 		mutex_enter(&stp->sd_lock);
759 		stp->sd_flag &= ~STREOPENFAIL;
760 		mutex_exit(&stp->sd_lock);
761 
762 		UNLOCK_CSP(csp);
763 		(void) spec_close(vp, flag, 1, 0, cr);
764 	} else {
765 		UNLOCK_CSP(csp);
766 		SN_RELE(csp);
767 	}
768 
769 	return (error);
770 }
771 
772 /*ARGSUSED2*/
773 static int
774 spec_close(
775 	struct vnode	*vp,
776 	int		flag,
777 	int		count,
778 	offset_t	offset,
779 	struct cred	*cr)
780 {
781 	struct vnode *cvp;
782 	struct snode *sp, *csp;
783 	enum vtype type;
784 	dev_t dev;
785 	int error = 0;
786 	int sysclone;
787 
788 	if (!(flag & FKLYR)) {
789 		/* this only applies to closes of devices from userland */
790 		cleanlocks(vp, ttoproc(curthread)->p_pid, 0);
791 		cleanshares(vp, ttoproc(curthread)->p_pid);
792 		if (vp->v_stream)
793 			strclean(vp);
794 	}
795 	if (count > 1)
796 		return (0);
797 
798 	sp = VTOS(vp);
799 	cvp = sp->s_commonvp;
800 
801 	dev = sp->s_dev;
802 	type = vp->v_type;
803 
804 	ASSERT(type == VCHR || type == VBLK);
805 
806 	/*
807 	 * Prevent close/close and close/open races by serializing closes
808 	 * on this common snode. Clone opens are held up until after
809 	 * we have closed this device so the streams linkage is maintained
810 	 */
811 	csp = VTOS(cvp);
812 
813 	LOCK_CSP(csp);
814 	mutex_enter(&csp->s_lock);
815 
816 	csp->s_count--;			/* one fewer open reference : SN_RELE */
817 	sysclone = sp->s_flag & SCLONE;
818 
819 	/*
820 	 * Invalidate size on each close.
821 	 *
822 	 * XXX We do this on each close because we don't have interfaces that
823 	 * allow a driver to invalidate the size.  Since clearing this on each
824 	 * close this causes property overhead we skip /dev/null and
825 	 * /dev/zero to avoid degrading kenbus performance.
826 	 */
827 	if (getmajor(dev) != mm_major)
828 		csp->s_flag &= ~SSIZEVALID;
829 
830 	/*
831 	 * Only call the close routine when the last open reference through
832 	 * any [s, v]node goes away.  This can be checked by looking at
833 	 * s_count on the common vnode.
834 	 */
835 	if ((csp->s_count == 0) && (csp->s_mapcnt == 0)) {
836 		/* we don't need a close */
837 		csp->s_flag &= ~(SNEEDCLOSE | SSIZEVALID);
838 
839 		/*
840 		 * A cloning driver may open-clone to the same dev_t that we
841 		 * are closing before spec_inactive destroys the common snode.
842 		 * If this occurs the s_dip association needs to be reevaluated.
843 		 * We clear SDIPSET to force reevaluation in this case.  When
844 		 * reevaluation occurs (by spec_clone after open), if the
845 		 * devinfo association has changed then the old association
846 		 * will be released as the new association is established by
847 		 * spec_assoc_vp_with_devi().
848 		 */
849 		if (csp->s_flag & (SCLONE | SSELFCLONE))
850 			csp->s_flag &= ~SDIPSET;
851 
852 		csp->s_flag |= SCLOSING;
853 		mutex_exit(&csp->s_lock);
854 		error = device_close(vp, flag, cr);
855 
856 		/*
857 		 * Decrement the devops held in clnopen()
858 		 */
859 		if (sysclone) {
860 			ddi_rele_driver(getmajor(dev));
861 		}
862 		mutex_enter(&csp->s_lock);
863 		csp->s_flag &= ~SCLOSING;
864 	}
865 
866 	UNLOCK_CSP_LOCK_HELD(csp);
867 	mutex_exit(&csp->s_lock);
868 
869 	return (error);
870 }
871 
872 /*ARGSUSED2*/
873 static int
874 spec_read(
875 	struct vnode	*vp,
876 	struct uio	*uiop,
877 	int		ioflag,
878 	struct cred	*cr,
879 	struct caller_context *ct)
880 {
881 	int error;
882 	struct snode *sp = VTOS(vp);
883 	dev_t dev = sp->s_dev;
884 	size_t n;
885 	ulong_t on;
886 	u_offset_t bdevsize;
887 	offset_t maxoff;
888 	offset_t off;
889 	struct vnode *blkvp;
890 
891 	ASSERT(vp->v_type == VCHR || vp->v_type == VBLK);
892 
893 	if (STREAMSTAB(getmajor(dev))) {	/* stream */
894 		ASSERT(vp->v_type == VCHR);
895 		smark(sp, SACC);
896 		return (strread(vp, uiop, cr));
897 	}
898 
899 	if (uiop->uio_resid == 0)
900 		return (0);
901 
902 	/*
903 	 * Plain old character devices that set D_U64BIT can have
904 	 * unrestricted offsets.
905 	 */
906 	maxoff = spec_maxoffset(vp);
907 	ASSERT(maxoff != -1 || vp->v_type == VCHR);
908 
909 	if (maxoff != -1 && (uiop->uio_loffset < 0 ||
910 	    uiop->uio_loffset + uiop->uio_resid > maxoff))
911 		return (EINVAL);
912 
913 	if (vp->v_type == VCHR) {
914 		smark(sp, SACC);
915 		ASSERT(STREAMSTAB(getmajor(dev)) == 0);
916 		return (cdev_read(dev, uiop, cr));
917 	}
918 
919 	/*
920 	 * Block device.
921 	 */
922 	error = 0;
923 	blkvp = sp->s_commonvp;
924 	bdevsize = SPEC_SIZE(VTOS(blkvp));
925 
926 	do {
927 		caddr_t base;
928 		offset_t diff;
929 
930 		off = uiop->uio_loffset & (offset_t)MAXBMASK;
931 		on = (size_t)(uiop->uio_loffset & MAXBOFFSET);
932 		n = (size_t)MIN(MAXBSIZE - on, uiop->uio_resid);
933 		diff = bdevsize - uiop->uio_loffset;
934 
935 		if (diff <= 0)
936 			break;
937 		if (diff < n)
938 			n = (size_t)diff;
939 
940 		if (vpm_enable) {
941 			error = vpm_data_copy(blkvp, (u_offset_t)(off + on),
942 			    n, uiop, 1, NULL, 0, S_READ);
943 		} else {
944 			base = segmap_getmapflt(segkmap, blkvp,
945 			    (u_offset_t)(off + on), n, 1, S_READ);
946 
947 			error = uiomove(base + on, n, UIO_READ, uiop);
948 		}
949 		if (!error) {
950 			int flags = 0;
951 			/*
952 			 * If we read a whole block, we won't need this
953 			 * buffer again soon.
954 			 */
955 			if (n + on == MAXBSIZE)
956 				flags = SM_DONTNEED | SM_FREE;
957 			if (vpm_enable) {
958 				error = vpm_sync_pages(blkvp, off, n, flags);
959 			} else {
960 				error = segmap_release(segkmap, base, flags);
961 			}
962 		} else {
963 			if (vpm_enable) {
964 				(void) vpm_sync_pages(blkvp, off, n, 0);
965 			} else {
966 				(void) segmap_release(segkmap, base, 0);
967 			}
968 			if (bdevsize == UNKNOWN_SIZE) {
969 				error = 0;
970 				break;
971 			}
972 		}
973 	} while (error == 0 && uiop->uio_resid > 0 && n != 0);
974 
975 	return (error);
976 }
977 
978 /*ARGSUSED*/
979 static int
980 spec_write(
981 	struct vnode *vp,
982 	struct uio *uiop,
983 	int ioflag,
984 	struct cred *cr,
985 	struct caller_context *ct)
986 {
987 	int error;
988 	struct snode *sp = VTOS(vp);
989 	dev_t dev = sp->s_dev;
990 	size_t n;
991 	ulong_t on;
992 	u_offset_t bdevsize;
993 	offset_t maxoff;
994 	offset_t off;
995 	struct vnode *blkvp;
996 
997 	ASSERT(vp->v_type == VCHR || vp->v_type == VBLK);
998 
999 	if (STREAMSTAB(getmajor(dev))) {
1000 		ASSERT(vp->v_type == VCHR);
1001 		smark(sp, SUPD);
1002 		return (strwrite(vp, uiop, cr));
1003 	}
1004 
1005 	/*
1006 	 * Plain old character devices that set D_U64BIT can have
1007 	 * unrestricted offsets.
1008 	 */
1009 	maxoff = spec_maxoffset(vp);
1010 	ASSERT(maxoff != -1 || vp->v_type == VCHR);
1011 
1012 	if (maxoff != -1 && (uiop->uio_loffset < 0 ||
1013 	    uiop->uio_loffset + uiop->uio_resid > maxoff))
1014 		return (EINVAL);
1015 
1016 	if (vp->v_type == VCHR) {
1017 		smark(sp, SUPD);
1018 		ASSERT(STREAMSTAB(getmajor(dev)) == 0);
1019 		return (cdev_write(dev, uiop, cr));
1020 	}
1021 
1022 	if (uiop->uio_resid == 0)
1023 		return (0);
1024 
1025 	error = 0;
1026 	blkvp = sp->s_commonvp;
1027 	bdevsize = SPEC_SIZE(VTOS(blkvp));
1028 
1029 	do {
1030 		int pagecreate;
1031 		int newpage;
1032 		caddr_t base;
1033 		offset_t diff;
1034 
1035 		off = uiop->uio_loffset & (offset_t)MAXBMASK;
1036 		on = (ulong_t)(uiop->uio_loffset & MAXBOFFSET);
1037 		n = (size_t)MIN(MAXBSIZE - on, uiop->uio_resid);
1038 		pagecreate = 0;
1039 
1040 		diff = bdevsize - uiop->uio_loffset;
1041 		if (diff <= 0) {
1042 			error = ENXIO;
1043 			break;
1044 		}
1045 		if (diff < n)
1046 			n = (size_t)diff;
1047 
1048 		/*
1049 		 * Check to see if we can skip reading in the page
1050 		 * and just allocate the memory.  We can do this
1051 		 * if we are going to rewrite the entire mapping
1052 		 * or if we are going to write to end of the device
1053 		 * from the beginning of the mapping.
1054 		 */
1055 		if (n == MAXBSIZE || (on == 0 && (off + n) == bdevsize))
1056 			pagecreate = 1;
1057 
1058 		newpage = 0;
1059 		if (vpm_enable) {
1060 			error = vpm_data_copy(blkvp, (u_offset_t)(off + on),
1061 			    n, uiop, !pagecreate, NULL, 0, S_WRITE);
1062 		} else {
1063 			base = segmap_getmapflt(segkmap, blkvp,
1064 			    (u_offset_t)(off + on), n, !pagecreate, S_WRITE);
1065 
1066 			/*
1067 			 * segmap_pagecreate() returns 1 if it calls
1068 			 * page_create_va() to allocate any pages.
1069 			 */
1070 
1071 			if (pagecreate)
1072 				newpage = segmap_pagecreate(segkmap, base + on,
1073 				    n, 0);
1074 
1075 			error = uiomove(base + on, n, UIO_WRITE, uiop);
1076 		}
1077 
1078 		if (!vpm_enable && pagecreate &&
1079 		    uiop->uio_loffset <
1080 		    P2ROUNDUP_TYPED(off + on + n, PAGESIZE, offset_t)) {
1081 			/*
1082 			 * We created pages w/o initializing them completely,
1083 			 * thus we need to zero the part that wasn't set up.
1084 			 * This can happen if we write to the end of the device
1085 			 * or if we had some sort of error during the uiomove.
1086 			 */
1087 			long nzero;
1088 			offset_t nmoved;
1089 
1090 			nmoved = (uiop->uio_loffset - (off + on));
1091 			if (nmoved < 0 || nmoved > n) {
1092 				panic("spec_write: nmoved bogus");
1093 				/*NOTREACHED*/
1094 			}
1095 			nzero = (long)P2ROUNDUP(on + n, PAGESIZE) -
1096 			    (on + nmoved);
1097 			if (nzero < 0 || (on + nmoved + nzero > MAXBSIZE)) {
1098 				panic("spec_write: nzero bogus");
1099 				/*NOTREACHED*/
1100 			}
1101 			(void) kzero(base + on + nmoved, (size_t)nzero);
1102 		}
1103 
1104 		/*
1105 		 * Unlock the pages which have been allocated by
1106 		 * page_create_va() in segmap_pagecreate().
1107 		 */
1108 		if (!vpm_enable && newpage)
1109 			segmap_pageunlock(segkmap, base + on,
1110 			    (size_t)n, S_WRITE);
1111 
1112 		if (error == 0) {
1113 			int flags = 0;
1114 
1115 			/*
1116 			 * Force write back for synchronous write cases.
1117 			 */
1118 			if (ioflag & (FSYNC|FDSYNC))
1119 				flags = SM_WRITE;
1120 			else if (n + on == MAXBSIZE || IS_SWAPVP(vp)) {
1121 				/*
1122 				 * Have written a whole block.
1123 				 * Start an asynchronous write and
1124 				 * mark the buffer to indicate that
1125 				 * it won't be needed again soon.
1126 				 * Push swap files here, since it
1127 				 * won't happen anywhere else.
1128 				 */
1129 				flags = SM_WRITE | SM_ASYNC | SM_DONTNEED;
1130 			}
1131 			smark(sp, SUPD|SCHG);
1132 			if (vpm_enable) {
1133 				error = vpm_sync_pages(blkvp, off, n, flags);
1134 			} else {
1135 				error = segmap_release(segkmap, base, flags);
1136 			}
1137 		} else {
1138 			if (vpm_enable) {
1139 				(void) vpm_sync_pages(blkvp, off, n, SM_INVAL);
1140 			} else {
1141 				(void) segmap_release(segkmap, base, SM_INVAL);
1142 			}
1143 		}
1144 
1145 	} while (error == 0 && uiop->uio_resid > 0 && n != 0);
1146 
1147 	return (error);
1148 }
1149 
1150 static int
1151 spec_ioctl(struct vnode *vp, int cmd, intptr_t arg, int mode, struct cred *cr,
1152     int *rvalp)
1153 {
1154 	struct snode *sp;
1155 	dev_t dev;
1156 	int error;
1157 
1158 	if (vp->v_type != VCHR)
1159 		return (ENOTTY);
1160 	sp = VTOS(vp);
1161 	dev = sp->s_dev;
1162 	if (STREAMSTAB(getmajor(dev))) {
1163 		error = strioctl(vp, cmd, arg, mode, U_TO_K, cr, rvalp);
1164 	} else {
1165 		error = cdev_ioctl(dev, cmd, arg, mode, cr, rvalp);
1166 	}
1167 	return (error);
1168 }
1169 
1170 static int
1171 spec_getattr(struct vnode *vp, struct vattr *vap, int flags, struct cred *cr)
1172 {
1173 	int error;
1174 	struct snode *sp;
1175 	struct vnode *realvp;
1176 
1177 	/* With ATTR_COMM we will not get attributes from realvp */
1178 	if (flags & ATTR_COMM) {
1179 		sp = VTOS(vp);
1180 		vp = sp->s_commonvp;
1181 	}
1182 	sp = VTOS(vp);
1183 	realvp = sp->s_realvp;
1184 
1185 	if (realvp == NULL) {
1186 		static int snode_shift	= 0;
1187 
1188 		/*
1189 		 * Calculate the amount of bitshift to a snode pointer which
1190 		 * will still keep it unique.  See below.
1191 		 */
1192 		if (snode_shift == 0)
1193 			snode_shift = highbit(sizeof (struct snode));
1194 		ASSERT(snode_shift > 0);
1195 
1196 		/*
1197 		 * No real vnode behind this one.  Fill in the fields
1198 		 * from the snode.
1199 		 *
1200 		 * This code should be refined to return only the
1201 		 * attributes asked for instead of all of them.
1202 		 */
1203 		vap->va_type = vp->v_type;
1204 		vap->va_mode = 0;
1205 		vap->va_uid = vap->va_gid = 0;
1206 		vap->va_fsid = sp->s_fsid;
1207 
1208 		/*
1209 		 * If the va_nodeid is > MAX_USHORT, then i386 stats might
1210 		 * fail. So we shift down the snode pointer to try and get
1211 		 * the most uniqueness into 16-bits.
1212 		 */
1213 		vap->va_nodeid = ((ino64_t)(uintptr_t)sp >> snode_shift) &
1214 		    0xFFFF;
1215 		vap->va_nlink = 0;
1216 		vap->va_rdev = sp->s_dev;
1217 
1218 		/*
1219 		 * va_nblocks is the number of 512 byte blocks used to store
1220 		 * the mknod for the device, not the number of blocks on the
1221 		 * device itself.  This is typically zero since the mknod is
1222 		 * represented directly in the inode itself.
1223 		 */
1224 		vap->va_nblocks = 0;
1225 	} else {
1226 		error = VOP_GETATTR(realvp, vap, flags, cr);
1227 		if (error != 0)
1228 			return (error);
1229 	}
1230 
1231 	/* set the size from the snode */
1232 	vap->va_size = SPEC_SIZE(VTOS(sp->s_commonvp));
1233 	vap->va_blksize = MAXBSIZE;
1234 
1235 	mutex_enter(&sp->s_lock);
1236 	vap->va_atime.tv_sec = sp->s_atime;
1237 	vap->va_mtime.tv_sec = sp->s_mtime;
1238 	vap->va_ctime.tv_sec = sp->s_ctime;
1239 	mutex_exit(&sp->s_lock);
1240 
1241 	vap->va_atime.tv_nsec = 0;
1242 	vap->va_mtime.tv_nsec = 0;
1243 	vap->va_ctime.tv_nsec = 0;
1244 	vap->va_seq = 0;
1245 
1246 	return (0);
1247 }
1248 
1249 static int
1250 spec_setattr(
1251 	struct vnode *vp,
1252 	struct vattr *vap,
1253 	int flags,
1254 	struct cred *cr,
1255 	caller_context_t *ctp)
1256 {
1257 	struct snode *sp = VTOS(vp);
1258 	struct vnode *realvp;
1259 	int error;
1260 
1261 	if (vp->v_type == VCHR && vp->v_stream && (vap->va_mask & AT_SIZE)) {
1262 		/*
1263 		 * 1135080:	O_TRUNC should have no effect on
1264 		 *		named pipes and terminal devices.
1265 		 */
1266 		ASSERT(vap->va_mask == AT_SIZE);
1267 		return (0);
1268 	}
1269 
1270 	if ((realvp = sp->s_realvp) == NULL)
1271 		error = 0;	/* no real vnode to update */
1272 	else
1273 		error = VOP_SETATTR(realvp, vap, flags, cr, ctp);
1274 	if (error == 0) {
1275 		/*
1276 		 * If times were changed, update snode.
1277 		 */
1278 		mutex_enter(&sp->s_lock);
1279 		if (vap->va_mask & AT_ATIME)
1280 			sp->s_atime = vap->va_atime.tv_sec;
1281 		if (vap->va_mask & AT_MTIME) {
1282 			sp->s_mtime = vap->va_mtime.tv_sec;
1283 			sp->s_ctime = gethrestime_sec();
1284 		}
1285 		mutex_exit(&sp->s_lock);
1286 	}
1287 	return (error);
1288 }
1289 
1290 static int
1291 spec_access(struct vnode *vp, int mode, int flags, struct cred *cr)
1292 {
1293 	struct vnode *realvp;
1294 	struct snode *sp = VTOS(vp);
1295 
1296 	if ((realvp = sp->s_realvp) != NULL)
1297 		return (VOP_ACCESS(realvp, mode, flags, cr));
1298 	else
1299 		return (0);	/* Allow all access. */
1300 }
1301 
1302 /*
1303  * This can be called if creat or an open with O_CREAT is done on the root
1304  * of a lofs mount where the mounted entity is a special file.
1305  */
1306 /*ARGSUSED*/
1307 static int
1308 spec_create(struct vnode *dvp, char *name, vattr_t *vap, enum vcexcl excl,
1309     int mode, struct vnode **vpp, struct cred *cr, int flag)
1310 {
1311 	int error;
1312 
1313 	ASSERT(dvp && (dvp->v_flag & VROOT) && *name == '\0');
1314 	if (excl == NONEXCL) {
1315 		if (mode && (error = spec_access(dvp, mode, 0, cr)))
1316 			return (error);
1317 		VN_HOLD(dvp);
1318 		return (0);
1319 	}
1320 	return (EEXIST);
1321 }
1322 
1323 /*
1324  * In order to sync out the snode times without multi-client problems,
1325  * make sure the times written out are never earlier than the times
1326  * already set in the vnode.
1327  */
1328 static int
1329 spec_fsync(struct vnode *vp, int syncflag, struct cred *cr)
1330 {
1331 	struct snode *sp = VTOS(vp);
1332 	struct vnode *realvp;
1333 	struct vnode *cvp;
1334 	struct vattr va, vatmp;
1335 
1336 	/* If times didn't change, don't flush anything. */
1337 	mutex_enter(&sp->s_lock);
1338 	if ((sp->s_flag & (SACC|SUPD|SCHG)) == 0 && vp->v_type != VBLK) {
1339 		mutex_exit(&sp->s_lock);
1340 		return (0);
1341 	}
1342 	sp->s_flag &= ~(SACC|SUPD|SCHG);
1343 	mutex_exit(&sp->s_lock);
1344 	cvp = sp->s_commonvp;
1345 	realvp = sp->s_realvp;
1346 
1347 	if (vp->v_type == VBLK && cvp != vp && vn_has_cached_data(cvp) &&
1348 	    (cvp->v_flag & VISSWAP) == 0)
1349 		(void) VOP_PUTPAGE(cvp, (offset_t)0, 0, 0, cr);
1350 
1351 	/*
1352 	 * For devices that support it, force write cache to stable storage.
1353 	 * We don't need the lock to check s_flags since we can treat
1354 	 * SNOFLUSH as a hint.
1355 	 */
1356 	if ((vp->v_type == VBLK || vp->v_type == VCHR) &&
1357 	    !(sp->s_flag & SNOFLUSH)) {
1358 		int rval, rc;
1359 		rc = cdev_ioctl(vp->v_rdev, DKIOCFLUSHWRITECACHE,
1360 		    NULL, FNATIVE|FKIOCTL, cr, &rval);
1361 		if (rc == ENOTSUP || rc == ENOTTY) {
1362 			mutex_enter(&sp->s_lock);
1363 			sp->s_flag |= SNOFLUSH;
1364 			mutex_exit(&sp->s_lock);
1365 		}
1366 	}
1367 
1368 	/*
1369 	 * If no real vnode to update, don't flush anything.
1370 	 */
1371 	if (realvp == NULL)
1372 		return (0);
1373 
1374 	vatmp.va_mask = AT_ATIME|AT_MTIME;
1375 	if (VOP_GETATTR(realvp, &vatmp, 0, cr) == 0) {
1376 
1377 		mutex_enter(&sp->s_lock);
1378 		if (vatmp.va_atime.tv_sec > sp->s_atime)
1379 			va.va_atime = vatmp.va_atime;
1380 		else {
1381 			va.va_atime.tv_sec = sp->s_atime;
1382 			va.va_atime.tv_nsec = 0;
1383 		}
1384 		if (vatmp.va_mtime.tv_sec > sp->s_mtime)
1385 			va.va_mtime = vatmp.va_mtime;
1386 		else {
1387 			va.va_mtime.tv_sec = sp->s_mtime;
1388 			va.va_mtime.tv_nsec = 0;
1389 		}
1390 		mutex_exit(&sp->s_lock);
1391 
1392 		va.va_mask = AT_ATIME|AT_MTIME;
1393 		(void) VOP_SETATTR(realvp, &va, 0, cr, NULL);
1394 	}
1395 	(void) VOP_FSYNC(realvp, syncflag, cr);
1396 	return (0);
1397 }
1398 
1399 /*ARGSUSED*/
1400 static void
1401 spec_inactive(struct vnode *vp, struct cred *cr)
1402 {
1403 	struct snode *sp = VTOS(vp);
1404 	struct vnode *cvp;
1405 	struct vnode *rvp;
1406 
1407 	/*
1408 	 * If no one has reclaimed the vnode, remove from the
1409 	 * cache now.
1410 	 */
1411 	if (vp->v_count < 1) {
1412 		panic("spec_inactive: Bad v_count");
1413 		/*NOTREACHED*/
1414 	}
1415 	mutex_enter(&stable_lock);
1416 
1417 	mutex_enter(&vp->v_lock);
1418 	/*
1419 	 * Drop the temporary hold by vn_rele now
1420 	 */
1421 	if (--vp->v_count != 0) {
1422 		mutex_exit(&vp->v_lock);
1423 		mutex_exit(&stable_lock);
1424 		return;
1425 	}
1426 	mutex_exit(&vp->v_lock);
1427 
1428 	sdelete(sp);
1429 	mutex_exit(&stable_lock);
1430 
1431 	/* We are the sole owner of sp now */
1432 	cvp = sp->s_commonvp;
1433 	rvp = sp->s_realvp;
1434 
1435 	if (rvp) {
1436 		/*
1437 		 * If the snode times changed, then update the times
1438 		 * associated with the "realvp".
1439 		 */
1440 		if ((sp->s_flag & (SACC|SUPD|SCHG)) != 0) {
1441 
1442 			struct vattr va, vatmp;
1443 
1444 			mutex_enter(&sp->s_lock);
1445 			sp->s_flag &= ~(SACC|SUPD|SCHG);
1446 			mutex_exit(&sp->s_lock);
1447 			vatmp.va_mask = AT_ATIME|AT_MTIME;
1448 			/*
1449 			 * The user may not own the device, but we
1450 			 * want to update the attributes anyway.
1451 			 */
1452 			if (VOP_GETATTR(rvp, &vatmp, 0, kcred) == 0) {
1453 				if (vatmp.va_atime.tv_sec > sp->s_atime)
1454 					va.va_atime = vatmp.va_atime;
1455 				else {
1456 					va.va_atime.tv_sec = sp->s_atime;
1457 					va.va_atime.tv_nsec = 0;
1458 				}
1459 				if (vatmp.va_mtime.tv_sec > sp->s_mtime)
1460 					va.va_mtime = vatmp.va_mtime;
1461 				else {
1462 					va.va_mtime.tv_sec = sp->s_mtime;
1463 					va.va_mtime.tv_nsec = 0;
1464 				}
1465 
1466 				va.va_mask = AT_ATIME|AT_MTIME;
1467 				(void) VOP_SETATTR(rvp, &va, 0, kcred, NULL);
1468 			}
1469 		}
1470 	}
1471 	ASSERT(!vn_has_cached_data(vp));
1472 	vn_invalid(vp);
1473 
1474 	/* if we are sharing another file systems vfs, release it */
1475 	if (vp->v_vfsp && (vp->v_vfsp != &spec_vfs))
1476 		VFS_RELE(vp->v_vfsp);
1477 
1478 	/* if we have a realvp, release the realvp */
1479 	if (rvp)
1480 		VN_RELE(rvp);
1481 
1482 	/* if we have a common, release the common */
1483 	if (cvp && (cvp != vp)) {
1484 		VN_RELE(cvp);
1485 #ifdef DEBUG
1486 	} else if (cvp) {
1487 		/*
1488 		 * if this is the last reference to a common vnode, any
1489 		 * associated stream had better have been closed
1490 		 */
1491 		ASSERT(cvp == vp);
1492 		ASSERT(cvp->v_stream == NULL);
1493 #endif /* DEBUG */
1494 	}
1495 
1496 	/*
1497 	 * if we have a hold on a devinfo node (established by
1498 	 * spec_assoc_vp_with_devi), release the hold
1499 	 */
1500 	if (sp->s_dip)
1501 		ddi_release_devi(sp->s_dip);
1502 
1503 	/*
1504 	 * If we have an associated device policy, release it.
1505 	 */
1506 	if (sp->s_plcy != NULL)
1507 		dpfree(sp->s_plcy);
1508 
1509 	/*
1510 	 * If all holds on the devinfo node are through specfs/devfs
1511 	 * and we just destroyed the last specfs node associated with the
1512 	 * device, then the devinfo node reference count should now be
1513 	 * zero.  We can't check this because there may be other holds
1514 	 * on the node from non file system sources: ddi_hold_devi_by_instance
1515 	 * for example.
1516 	 */
1517 	kmem_cache_free(snode_cache, sp);
1518 }
1519 
1520 static int
1521 spec_fid(struct vnode *vp, struct fid *fidp)
1522 {
1523 	struct vnode *realvp;
1524 	struct snode *sp = VTOS(vp);
1525 
1526 	if ((realvp = sp->s_realvp) != NULL)
1527 		return (VOP_FID(realvp, fidp));
1528 	else
1529 		return (EINVAL);
1530 }
1531 
1532 /*ARGSUSED1*/
1533 static int
1534 spec_seek(struct vnode *vp, offset_t ooff, offset_t *noffp)
1535 {
1536 	offset_t maxoff = spec_maxoffset(vp);
1537 
1538 	if (maxoff == -1 || *noffp <= maxoff)
1539 		return (0);
1540 	else
1541 		return (EINVAL);
1542 }
1543 
1544 static int
1545 spec_frlock(
1546 	struct vnode *vp,
1547 	int		cmd,
1548 	struct flock64	*bfp,
1549 	int		flag,
1550 	offset_t	offset,
1551 	struct flk_callback *flk_cbp,
1552 	struct cred	*cr)
1553 {
1554 	struct snode *sp = VTOS(vp);
1555 	struct snode *csp;
1556 
1557 	csp = VTOS(sp->s_commonvp);
1558 	/*
1559 	 * If file is being mapped, disallow frlock.
1560 	 */
1561 	if (csp->s_mapcnt > 0)
1562 		return (EAGAIN);
1563 
1564 	return (fs_frlock(vp, cmd, bfp, flag, offset, flk_cbp, cr));
1565 }
1566 
1567 static int
1568 spec_realvp(struct vnode *vp, struct vnode **vpp)
1569 {
1570 	struct vnode *rvp;
1571 
1572 	if ((rvp = VTOS(vp)->s_realvp) != NULL) {
1573 		vp = rvp;
1574 		if (VOP_REALVP(vp, &rvp) == 0)
1575 			vp = rvp;
1576 	}
1577 
1578 	*vpp = vp;
1579 	return (0);
1580 }
1581 
1582 /*
1583  * Return all the pages from [off..off + len] in block
1584  * or character device.
1585  */
1586 static int
1587 spec_getpage(
1588 	struct vnode	*vp,
1589 	offset_t	off,
1590 	size_t		len,
1591 	uint_t		*protp,
1592 	page_t		*pl[],
1593 	size_t		plsz,
1594 	struct seg	*seg,
1595 	caddr_t		addr,
1596 	enum seg_rw	rw,
1597 	struct cred	*cr)
1598 {
1599 	struct snode *sp = VTOS(vp);
1600 	int err;
1601 
1602 	ASSERT(sp->s_commonvp == vp);
1603 
1604 	/*
1605 	 * XXX	Given the above assertion, this might not do
1606 	 *	what is wanted here.
1607 	 */
1608 	if (vp->v_flag & VNOMAP)
1609 		return (ENOSYS);
1610 	TRACE_4(TR_FAC_SPECFS, TR_SPECFS_GETPAGE,
1611 	    "specfs getpage:vp %p off %llx len %ld snode %p",
1612 	    vp, off, len, sp);
1613 
1614 	switch (vp->v_type) {
1615 	case VBLK:
1616 		if (protp != NULL)
1617 			*protp = PROT_ALL;
1618 
1619 		if (((u_offset_t)off + len) > (SPEC_SIZE(sp) + PAGEOFFSET))
1620 			return (EFAULT);	/* beyond EOF */
1621 
1622 		if (len <= PAGESIZE)
1623 			err = spec_getapage(vp, (u_offset_t)off, len, protp, pl,
1624 			    plsz, seg, addr, rw, cr);
1625 		else
1626 			err = pvn_getpages(spec_getapage, vp, (u_offset_t)off,
1627 			    len, protp, pl, plsz, seg, addr, rw, cr);
1628 		break;
1629 
1630 	case VCHR:
1631 		cmn_err(CE_NOTE, "spec_getpage called for character device. "
1632 		    "Check any non-ON consolidation drivers");
1633 		err = 0;
1634 		pl[0] = (page_t *)0;
1635 		break;
1636 
1637 	default:
1638 		panic("spec_getpage: bad v_type 0x%x", vp->v_type);
1639 		/*NOTREACHED*/
1640 	}
1641 
1642 	return (err);
1643 }
1644 
1645 extern int klustsize;	/* set in machdep.c */
1646 
1647 int spec_ra = 1;
1648 int spec_lostpage;	/* number of times we lost original page */
1649 
1650 /*ARGSUSED2*/
1651 static int
1652 spec_getapage(
1653 	struct vnode *vp,
1654 	u_offset_t	off,
1655 	size_t		len,
1656 	uint_t		*protp,
1657 	page_t		*pl[],
1658 	size_t		plsz,
1659 	struct seg	*seg,
1660 	caddr_t		addr,
1661 	enum seg_rw	rw,
1662 	struct cred	*cr)
1663 {
1664 	struct snode *sp;
1665 	struct buf *bp;
1666 	page_t *pp, *pp2;
1667 	u_offset_t io_off1, io_off2;
1668 	size_t io_len1;
1669 	size_t io_len2;
1670 	size_t blksz;
1671 	u_offset_t blkoff;
1672 	int dora, err;
1673 	page_t *pagefound;
1674 	uint_t xlen;
1675 	size_t adj_klustsize;
1676 	u_offset_t size;
1677 	u_offset_t tmpoff;
1678 
1679 	sp = VTOS(vp);
1680 	TRACE_3(TR_FAC_SPECFS, TR_SPECFS_GETAPAGE,
1681 	    "specfs getapage:vp %p off %llx snode %p", vp, off, sp);
1682 reread:
1683 
1684 	err = 0;
1685 	bp = NULL;
1686 	pp = NULL;
1687 	pp2 = NULL;
1688 
1689 	if (pl != NULL)
1690 		pl[0] = NULL;
1691 
1692 	size = SPEC_SIZE(VTOS(sp->s_commonvp));
1693 
1694 	if (spec_ra && sp->s_nextr == off)
1695 		dora = 1;
1696 	else
1697 		dora = 0;
1698 
1699 	if (size == UNKNOWN_SIZE) {
1700 		dora = 0;
1701 		adj_klustsize = PAGESIZE;
1702 	} else {
1703 		adj_klustsize = dora ? klustsize : PAGESIZE;
1704 	}
1705 
1706 again:
1707 	if ((pagefound = page_exists(vp, off)) == NULL) {
1708 		if (rw == S_CREATE) {
1709 			/*
1710 			 * We're allocating a swap slot and it's
1711 			 * associated page was not found, so allocate
1712 			 * and return it.
1713 			 */
1714 			if ((pp = page_create_va(vp, off,
1715 			    PAGESIZE, PG_WAIT, seg, addr)) == NULL) {
1716 				panic("spec_getapage: page_create");
1717 				/*NOTREACHED*/
1718 			}
1719 			io_len1 = PAGESIZE;
1720 			sp->s_nextr = off + PAGESIZE;
1721 		} else {
1722 			/*
1723 			 * Need to really do disk I/O to get the page(s).
1724 			 */
1725 			blkoff = (off / adj_klustsize) * adj_klustsize;
1726 			if (size == UNKNOWN_SIZE) {
1727 				blksz = PAGESIZE;
1728 			} else {
1729 				if (blkoff + adj_klustsize <= size)
1730 					blksz = adj_klustsize;
1731 				else
1732 					blksz =
1733 					    MIN(size - blkoff, adj_klustsize);
1734 			}
1735 
1736 			pp = pvn_read_kluster(vp, off, seg, addr, &tmpoff,
1737 			    &io_len1, blkoff, blksz, 0);
1738 			io_off1 = tmpoff;
1739 			/*
1740 			 * Make sure the page didn't sneek into the
1741 			 * cache while we blocked in pvn_read_kluster.
1742 			 */
1743 			if (pp == NULL)
1744 				goto again;
1745 
1746 			/*
1747 			 * Zero part of page which we are not
1748 			 * going to be reading from disk now.
1749 			 */
1750 			xlen = (uint_t)(io_len1 & PAGEOFFSET);
1751 			if (xlen != 0)
1752 				pagezero(pp->p_prev, xlen, PAGESIZE - xlen);
1753 
1754 			bp = spec_startio(vp, pp, io_off1, io_len1,
1755 			    pl == NULL ? (B_ASYNC | B_READ) : B_READ);
1756 			sp->s_nextr = io_off1 + io_len1;
1757 		}
1758 	}
1759 
1760 	if (dora && rw != S_CREATE) {
1761 		u_offset_t off2;
1762 		caddr_t addr2;
1763 
1764 		off2 = ((off / adj_klustsize) + 1) * adj_klustsize;
1765 		addr2 = addr + (off2 - off);
1766 
1767 		pp2 = NULL;
1768 		/*
1769 		 * If we are past EOF then don't bother trying
1770 		 * with read-ahead.
1771 		 */
1772 		if (off2 >= size)
1773 			pp2 = NULL;
1774 		else {
1775 			if (off2 + adj_klustsize <= size)
1776 				blksz = adj_klustsize;
1777 			else
1778 				blksz = MIN(size - off2, adj_klustsize);
1779 
1780 			pp2 = pvn_read_kluster(vp, off2, seg, addr2, &tmpoff,
1781 			    &io_len2, off2, blksz, 1);
1782 			io_off2 = tmpoff;
1783 		}
1784 
1785 		if (pp2 != NULL) {
1786 			/*
1787 			 * Zero part of page which we are not
1788 			 * going to be reading from disk now.
1789 			 */
1790 			xlen = (uint_t)(io_len2 & PAGEOFFSET);
1791 			if (xlen != 0)
1792 				pagezero(pp2->p_prev, xlen, PAGESIZE - xlen);
1793 
1794 			(void) spec_startio(vp, pp2, io_off2, io_len2,
1795 			    B_READ | B_ASYNC);
1796 		}
1797 	}
1798 
1799 	if (pl == NULL)
1800 		return (err);
1801 
1802 	if (bp != NULL) {
1803 		err = biowait(bp);
1804 		pageio_done(bp);
1805 
1806 		if (err) {
1807 			if (pp != NULL)
1808 				pvn_read_done(pp, B_ERROR);
1809 			return (err);
1810 		}
1811 	}
1812 
1813 	if (pagefound) {
1814 		se_t se = (rw == S_CREATE ? SE_EXCL : SE_SHARED);
1815 		/*
1816 		 * Page exists in the cache, acquire the appropriate
1817 		 * lock.  If this fails, start all over again.
1818 		 */
1819 
1820 		if ((pp = page_lookup(vp, off, se)) == NULL) {
1821 			spec_lostpage++;
1822 			goto reread;
1823 		}
1824 		pl[0] = pp;
1825 		pl[1] = NULL;
1826 
1827 		sp->s_nextr = off + PAGESIZE;
1828 		return (0);
1829 	}
1830 
1831 	if (pp != NULL)
1832 		pvn_plist_init(pp, pl, plsz, off, io_len1, rw);
1833 	return (0);
1834 }
1835 
1836 /*
1837  * Flags are composed of {B_INVAL, B_DIRTY B_FREE, B_DONTNEED, B_FORCE}.
1838  * If len == 0, do from off to EOF.
1839  *
1840  * The normal cases should be len == 0 & off == 0 (entire vp list),
1841  * len == MAXBSIZE (from segmap_release actions), and len == PAGESIZE
1842  * (from pageout).
1843  */
1844 int
1845 spec_putpage(
1846 	struct vnode *vp,
1847 	offset_t	off,
1848 	size_t		len,
1849 	int		flags,
1850 	struct cred	*cr)
1851 {
1852 	struct snode *sp = VTOS(vp);
1853 	struct vnode *cvp;
1854 	page_t *pp;
1855 	u_offset_t io_off;
1856 	size_t io_len = 0;	/* for lint */
1857 	int err = 0;
1858 	u_offset_t size;
1859 	u_offset_t tmpoff;
1860 
1861 	ASSERT(vp->v_count != 0);
1862 
1863 	if (vp->v_flag & VNOMAP)
1864 		return (ENOSYS);
1865 
1866 	cvp = sp->s_commonvp;
1867 	size = SPEC_SIZE(VTOS(cvp));
1868 
1869 	if (!vn_has_cached_data(vp) || off >= size)
1870 		return (0);
1871 
1872 	ASSERT(vp->v_type == VBLK && cvp == vp);
1873 	TRACE_4(TR_FAC_SPECFS, TR_SPECFS_PUTPAGE,
1874 	    "specfs putpage:vp %p off %llx len %ld snode %p",
1875 	    vp, off, len, sp);
1876 
1877 	if (len == 0) {
1878 		/*
1879 		 * Search the entire vp list for pages >= off.
1880 		 */
1881 		err = pvn_vplist_dirty(vp, off, spec_putapage,
1882 		    flags, cr);
1883 	} else {
1884 		u_offset_t eoff;
1885 
1886 		/*
1887 		 * Loop over all offsets in the range [off...off + len]
1888 		 * looking for pages to deal with.  We set limits so
1889 		 * that we kluster to klustsize boundaries.
1890 		 */
1891 		eoff = off + len;
1892 		for (io_off = off; io_off < eoff && io_off < size;
1893 		    io_off += io_len) {
1894 			/*
1895 			 * If we are not invalidating, synchronously
1896 			 * freeing or writing pages use the routine
1897 			 * page_lookup_nowait() to prevent reclaiming
1898 			 * them from the free list.
1899 			 */
1900 			if ((flags & B_INVAL) || ((flags & B_ASYNC) == 0)) {
1901 				pp = page_lookup(vp, io_off,
1902 				    (flags & (B_INVAL | B_FREE)) ?
1903 				    SE_EXCL : SE_SHARED);
1904 			} else {
1905 				pp = page_lookup_nowait(vp, io_off,
1906 				    (flags & B_FREE) ? SE_EXCL : SE_SHARED);
1907 			}
1908 
1909 			if (pp == NULL || pvn_getdirty(pp, flags) == 0)
1910 				io_len = PAGESIZE;
1911 			else {
1912 				err = spec_putapage(vp, pp, &tmpoff, &io_len,
1913 				    flags, cr);
1914 				io_off = tmpoff;
1915 				if (err != 0)
1916 					break;
1917 				/*
1918 				 * "io_off" and "io_len" are returned as
1919 				 * the range of pages we actually wrote.
1920 				 * This allows us to skip ahead more quickly
1921 				 * since several pages may've been dealt
1922 				 * with by this iteration of the loop.
1923 				 */
1924 			}
1925 		}
1926 	}
1927 	return (err);
1928 }
1929 
1930 
1931 /*
1932  * Write out a single page, possibly klustering adjacent
1933  * dirty pages.
1934  */
1935 /*ARGSUSED5*/
1936 static int
1937 spec_putapage(
1938 	struct vnode	*vp,
1939 	page_t		*pp,
1940 	u_offset_t	*offp,		/* return value */
1941 	size_t		*lenp,		/* return value */
1942 	int		flags,
1943 	struct cred	*cr)
1944 {
1945 	struct snode *sp = VTOS(vp);
1946 	u_offset_t io_off;
1947 	size_t io_len;
1948 	size_t blksz;
1949 	u_offset_t blkoff;
1950 	int err = 0;
1951 	struct buf *bp;
1952 	u_offset_t size;
1953 	size_t adj_klustsize;
1954 	u_offset_t tmpoff;
1955 
1956 	/*
1957 	 * Destroy read ahead value since we are really going to write.
1958 	 */
1959 	sp->s_nextr = 0;
1960 	size = SPEC_SIZE(VTOS(sp->s_commonvp));
1961 
1962 	adj_klustsize = klustsize;
1963 
1964 	blkoff = (pp->p_offset / adj_klustsize) * adj_klustsize;
1965 
1966 	if (blkoff + adj_klustsize <= size)
1967 		blksz = adj_klustsize;
1968 	else
1969 		blksz = size - blkoff;
1970 
1971 	/*
1972 	 * Find a kluster that fits in one contiguous chunk.
1973 	 */
1974 	pp = pvn_write_kluster(vp, pp, &tmpoff, &io_len, blkoff,
1975 	    blksz, flags);
1976 	io_off = tmpoff;
1977 
1978 	/*
1979 	 * Check for page length rounding problems
1980 	 * XXX - Is this necessary?
1981 	 */
1982 	if (io_off + io_len > size) {
1983 		ASSERT((io_off + io_len) - size < PAGESIZE);
1984 		io_len = size - io_off;
1985 	}
1986 
1987 	bp = spec_startio(vp, pp, io_off, io_len, B_WRITE | flags);
1988 
1989 	/*
1990 	 * Wait for i/o to complete if the request is not B_ASYNC.
1991 	 */
1992 	if ((flags & B_ASYNC) == 0) {
1993 		err = biowait(bp);
1994 		pageio_done(bp);
1995 		pvn_write_done(pp, ((err) ? B_ERROR : 0) | B_WRITE | flags);
1996 	}
1997 
1998 	if (offp)
1999 		*offp = io_off;
2000 	if (lenp)
2001 		*lenp = io_len;
2002 	TRACE_4(TR_FAC_SPECFS, TR_SPECFS_PUTAPAGE,
2003 	    "specfs putapage:vp %p offp %p snode %p err %d",
2004 	    vp, offp, sp, err);
2005 	return (err);
2006 }
2007 
2008 /*
2009  * Flags are composed of {B_ASYNC, B_INVAL, B_FREE, B_DONTNEED}
2010  */
2011 static struct buf *
2012 spec_startio(
2013 	struct vnode *vp,
2014 	page_t		*pp,
2015 	u_offset_t	io_off,
2016 	size_t		io_len,
2017 	int		flags)
2018 {
2019 	struct buf *bp;
2020 
2021 	bp = pageio_setup(pp, io_len, vp, flags);
2022 
2023 	bp->b_edev = vp->v_rdev;
2024 	bp->b_dev = cmpdev(vp->v_rdev);
2025 	bp->b_blkno = btodt(io_off);
2026 	bp->b_un.b_addr = (caddr_t)0;
2027 
2028 	(void) bdev_strategy(bp);
2029 
2030 	if (flags & B_READ)
2031 		lwp_stat_update(LWP_STAT_INBLK, 1);
2032 	else
2033 		lwp_stat_update(LWP_STAT_OUBLK, 1);
2034 
2035 	return (bp);
2036 }
2037 
2038 static int
2039 spec_poll(
2040 	struct vnode	*vp,
2041 	short		events,
2042 	int		anyyet,
2043 	short		*reventsp,
2044 	struct pollhead **phpp)
2045 {
2046 	dev_t dev;
2047 	int error;
2048 
2049 	if (vp->v_type == VBLK)
2050 		error = fs_poll(vp, events, anyyet, reventsp, phpp);
2051 	else {
2052 		ASSERT(vp->v_type == VCHR);
2053 		dev = vp->v_rdev;
2054 		if (STREAMSTAB(getmajor(dev))) {
2055 			ASSERT(vp->v_stream != NULL);
2056 			error = strpoll(vp->v_stream, events, anyyet,
2057 			    reventsp, phpp);
2058 		} else if (devopsp[getmajor(dev)]->devo_cb_ops->cb_chpoll) {
2059 			error = cdev_poll(dev, events, anyyet, reventsp, phpp);
2060 		} else {
2061 			error = fs_poll(vp, events, anyyet, reventsp, phpp);
2062 		}
2063 	}
2064 	return (error);
2065 }
2066 
2067 /*
2068  * This routine is called through the cdevsw[] table to handle
2069  * traditional mmap'able devices that support a d_mmap function.
2070  */
2071 /*ARGSUSED8*/
2072 int
2073 spec_segmap(
2074 	dev_t dev,
2075 	off_t off,
2076 	struct as *as,
2077 	caddr_t *addrp,
2078 	off_t len,
2079 	uint_t prot,
2080 	uint_t maxprot,
2081 	uint_t flags,
2082 	struct cred *cred)
2083 {
2084 	struct segdev_crargs dev_a;
2085 	int (*mapfunc)(dev_t dev, off_t off, int prot);
2086 	size_t i;
2087 	int	error;
2088 
2089 	if ((mapfunc = devopsp[getmajor(dev)]->devo_cb_ops->cb_mmap) == nodev)
2090 		return (ENODEV);
2091 	TRACE_4(TR_FAC_SPECFS, TR_SPECFS_SEGMAP,
2092 	    "specfs segmap:dev %x as %p len %lx prot %x",
2093 	    dev, as, len, prot);
2094 
2095 	/*
2096 	 * Character devices that support the d_mmap
2097 	 * interface can only be mmap'ed shared.
2098 	 */
2099 	if ((flags & MAP_TYPE) != MAP_SHARED)
2100 		return (EINVAL);
2101 
2102 	/*
2103 	 * Check to ensure that the entire range is
2104 	 * legal and we are not trying to map in
2105 	 * more than the device will let us.
2106 	 */
2107 	for (i = 0; i < len; i += PAGESIZE) {
2108 		if (cdev_mmap(mapfunc, dev, off + i, maxprot) == -1)
2109 			return (ENXIO);
2110 	}
2111 
2112 	as_rangelock(as);
2113 	if ((flags & MAP_FIXED) == 0) {
2114 		/*
2115 		 * Pick an address w/o worrying about
2116 		 * any vac alignment constraints.
2117 		 */
2118 		map_addr(addrp, len, (offset_t)off, 0, flags);
2119 		if (*addrp == NULL) {
2120 			as_rangeunlock(as);
2121 			return (ENOMEM);
2122 		}
2123 	} else {
2124 		/*
2125 		 * User-specified address; blow away any previous mappings.
2126 		 */
2127 		(void) as_unmap(as, *addrp, len);
2128 	}
2129 
2130 	dev_a.mapfunc = mapfunc;
2131 	dev_a.dev = dev;
2132 	dev_a.offset = off;
2133 	dev_a.prot = (uchar_t)prot;
2134 	dev_a.maxprot = (uchar_t)maxprot;
2135 	dev_a.hat_flags = 0;
2136 	dev_a.hat_attr = 0;
2137 	dev_a.devmap_data = NULL;
2138 
2139 	error = as_map(as, *addrp, len, segdev_create, &dev_a);
2140 	as_rangeunlock(as);
2141 	return (error);
2142 }
2143 
2144 int
2145 spec_char_map(
2146 	dev_t dev,
2147 	offset_t off,
2148 	struct as *as,
2149 	caddr_t *addrp,
2150 	size_t len,
2151 	uchar_t prot,
2152 	uchar_t maxprot,
2153 	uint_t flags,
2154 	struct cred *cred)
2155 {
2156 	int error = 0;
2157 	major_t maj = getmajor(dev);
2158 	int map_flag;
2159 	int (*segmap)(dev_t, off_t, struct as *,
2160 	    caddr_t *, off_t, uint_t, uint_t, uint_t, cred_t *);
2161 	int (*devmap)(dev_t, devmap_cookie_t, offset_t,
2162 	    size_t, size_t *, uint_t);
2163 	int (*mmap)(dev_t dev, off_t off, int prot);
2164 
2165 	/*
2166 	 * Character device: let the device driver
2167 	 * pick the appropriate segment driver.
2168 	 *
2169 	 * 4.x compat.: allow 'NULL' cb_segmap => spec_segmap
2170 	 * Kindness: allow 'nulldev' cb_segmap => spec_segmap
2171 	 */
2172 	segmap = devopsp[maj]->devo_cb_ops->cb_segmap;
2173 	if (segmap == NULL || segmap == nulldev || segmap == nodev) {
2174 		mmap = devopsp[maj]->devo_cb_ops->cb_mmap;
2175 		map_flag = devopsp[maj]->devo_cb_ops->cb_flag;
2176 
2177 		/*
2178 		 * Use old mmap framework if the driver has both mmap
2179 		 * and devmap entry points.  This is to prevent the
2180 		 * system from calling invalid devmap entry point
2181 		 * for some drivers that might have put garbage in the
2182 		 * devmap entry point.
2183 		 */
2184 		if ((map_flag & D_DEVMAP) || mmap == NULL ||
2185 		    mmap == nulldev || mmap == nodev) {
2186 			devmap = devopsp[maj]->devo_cb_ops->cb_devmap;
2187 
2188 			/*
2189 			 * If driver provides devmap entry point in
2190 			 * cb_ops but not xx_segmap(9E), call
2191 			 * devmap_setup with default settings
2192 			 * (NULL) for callback_ops and driver
2193 			 * callback private data
2194 			 */
2195 			if (devmap == nodev || devmap == NULL ||
2196 			    devmap == nulldev)
2197 				return (ENODEV);
2198 
2199 			error = devmap_setup(dev, off, as, addrp,
2200 			    len, prot, maxprot, flags, cred);
2201 
2202 			return (error);
2203 		} else
2204 			segmap = spec_segmap;
2205 	} else
2206 		segmap = cdev_segmap;
2207 
2208 	return ((*segmap)(dev, (off_t)off, as, addrp, len, prot,
2209 	    maxprot, flags, cred));
2210 }
2211 
2212 static int
2213 spec_map(
2214 	struct vnode *vp,
2215 	offset_t off,
2216 	struct as *as,
2217 	caddr_t *addrp,
2218 	size_t len,
2219 	uchar_t prot,
2220 	uchar_t maxprot,
2221 	uint_t flags,
2222 	struct cred *cred)
2223 {
2224 	int error = 0;
2225 
2226 	if (vp->v_flag & VNOMAP)
2227 		return (ENOSYS);
2228 
2229 	/*
2230 	 * If file is locked, fail mapping attempt.
2231 	 */
2232 	if (vn_has_flocks(vp))
2233 		return (EAGAIN);
2234 
2235 	if (vp->v_type == VCHR) {
2236 		return (spec_char_map(vp->v_rdev, off, as, addrp, len, prot,
2237 		    maxprot, flags, cred));
2238 	} else if (vp->v_type == VBLK) {
2239 		struct segvn_crargs vn_a;
2240 		struct vnode *cvp;
2241 		struct snode *sp;
2242 
2243 		/*
2244 		 * Block device, use segvn mapping to the underlying commonvp
2245 		 * for pages.
2246 		 */
2247 		if (off > spec_maxoffset(vp))
2248 			return (ENXIO);
2249 
2250 		sp = VTOS(vp);
2251 		cvp = sp->s_commonvp;
2252 		ASSERT(cvp != NULL);
2253 
2254 		if (off < 0 || ((offset_t)(off + len) < 0))
2255 			return (ENXIO);
2256 
2257 		as_rangelock(as);
2258 		if ((flags & MAP_FIXED) == 0) {
2259 			map_addr(addrp, len, off, 1, flags);
2260 			if (*addrp == NULL) {
2261 				as_rangeunlock(as);
2262 				return (ENOMEM);
2263 			}
2264 		} else {
2265 			/*
2266 			 * User-specified address; blow away any
2267 			 * previous mappings.
2268 			 */
2269 			(void) as_unmap(as, *addrp, len);
2270 		}
2271 
2272 		vn_a.vp = cvp;
2273 		vn_a.offset = off;
2274 		vn_a.type = flags & MAP_TYPE;
2275 		vn_a.prot = (uchar_t)prot;
2276 		vn_a.maxprot = (uchar_t)maxprot;
2277 		vn_a.flags = flags & ~MAP_TYPE;
2278 		vn_a.cred = cred;
2279 		vn_a.amp = NULL;
2280 		vn_a.szc = 0;
2281 		vn_a.lgrp_mem_policy_flags = 0;
2282 
2283 		error = as_map(as, *addrp, len, segvn_create, &vn_a);
2284 		as_rangeunlock(as);
2285 	} else
2286 		return (ENODEV);
2287 
2288 	return (error);
2289 }
2290 
2291 /*ARGSUSED1*/
2292 static int
2293 spec_addmap(
2294 	struct vnode *vp,	/* the common vnode */
2295 	offset_t off,
2296 	struct as *as,
2297 	caddr_t addr,
2298 	size_t len,		/* how many bytes to add */
2299 	uchar_t prot,
2300 	uchar_t maxprot,
2301 	uint_t flags,
2302 	struct cred *cred)
2303 {
2304 	int error = 0;
2305 	struct snode *csp = VTOS(vp);
2306 	ulong_t npages;
2307 
2308 	ASSERT(vp != NULL && VTOS(vp)->s_commonvp == vp);
2309 
2310 	/*
2311 	 * XXX	Given the above assertion, this might not
2312 	 *	be a particularly sensible thing to test.
2313 	 */
2314 	if (vp->v_flag & VNOMAP)
2315 		return (ENOSYS);
2316 
2317 	npages = btopr(len);
2318 	LOCK_CSP(csp);
2319 	csp->s_mapcnt += npages;
2320 
2321 	UNLOCK_CSP(csp);
2322 	return (error);
2323 }
2324 
2325 /*ARGSUSED1*/
2326 static int
2327 spec_delmap(
2328 	struct vnode *vp,	/* the common vnode */
2329 	offset_t off,
2330 	struct as *as,
2331 	caddr_t addr,
2332 	size_t len,		/* how many bytes to take away */
2333 	uint_t prot,
2334 	uint_t maxprot,
2335 	uint_t flags,
2336 	struct cred *cred)
2337 {
2338 	struct snode *csp = VTOS(vp);
2339 	ulong_t npages;
2340 	long mcnt;
2341 
2342 	/* segdev passes us the common vp */
2343 
2344 	ASSERT(vp != NULL && VTOS(vp)->s_commonvp == vp);
2345 
2346 	/*
2347 	 * XXX	Given the above assertion, this might not
2348 	 *	be a particularly sensible thing to test..
2349 	 */
2350 	if (vp->v_flag & VNOMAP)
2351 		return (ENOSYS);
2352 
2353 	npages = btopr(len);
2354 
2355 	LOCK_CSP(csp);
2356 	mutex_enter(&csp->s_lock);
2357 	mcnt = (csp->s_mapcnt -= npages);
2358 
2359 	if (mcnt == 0) {
2360 		/*
2361 		 * Call the close routine when the last reference of any
2362 		 * kind through any [s, v]node goes away.  The s_dip hold
2363 		 * on the devinfo node is released when the vnode is
2364 		 * destroyed.
2365 		 */
2366 		if (csp->s_count == 0) {
2367 			csp->s_flag &= ~(SNEEDCLOSE | SSIZEVALID);
2368 
2369 			/* See comment in spec_close() */
2370 			if (csp->s_flag & (SCLONE | SSELFCLONE))
2371 				csp->s_flag &= ~SDIPSET;
2372 
2373 			mutex_exit(&csp->s_lock);
2374 
2375 			(void) device_close(vp, 0, cred);
2376 		} else
2377 			mutex_exit(&csp->s_lock);
2378 
2379 		mutex_enter(&csp->s_lock);
2380 	}
2381 	ASSERT(mcnt >= 0);
2382 
2383 	UNLOCK_CSP_LOCK_HELD(csp);
2384 	mutex_exit(&csp->s_lock);
2385 
2386 	return (0);
2387 }
2388 
2389 static int
2390 spec_dump(struct vnode *vp, caddr_t addr, int bn, int count)
2391 {
2392 	ASSERT(vp->v_type == VBLK);
2393 	return (bdev_dump(vp->v_rdev, addr, bn, count));
2394 }
2395 
2396 
2397 /*
2398  * Do i/o on the given page list from/to vp, io_off for io_len.
2399  * Flags are composed of:
2400  * 	{B_ASYNC, B_INVAL, B_FREE, B_DONTNEED, B_READ, B_WRITE}
2401  * If B_ASYNC is not set i/o is waited for.
2402  */
2403 /*ARGSUSED5*/
2404 static int
2405 spec_pageio(
2406 	struct vnode *vp,
2407 	page_t	*pp,
2408 	u_offset_t io_off,
2409 	size_t	io_len,
2410 	int	flags,
2411 	cred_t	*cr)
2412 {
2413 	struct buf *bp = NULL;
2414 	int err = 0;
2415 
2416 	if (pp == NULL)
2417 		return (EINVAL);
2418 
2419 	bp = spec_startio(vp, pp, io_off, io_len, flags);
2420 
2421 	/*
2422 	 * Wait for i/o to complete if the request is not B_ASYNC.
2423 	 */
2424 	if ((flags & B_ASYNC) == 0) {
2425 		err = biowait(bp);
2426 		pageio_done(bp);
2427 	}
2428 	return (err);
2429 }
2430 
2431 /*
2432  * Set ACL on underlying vnode if one exists, or return ENOSYS otherwise.
2433  */
2434 int
2435 spec_setsecattr(struct vnode *vp, vsecattr_t *vsap, int flag, struct cred *cr)
2436 {
2437 	struct vnode *realvp;
2438 	struct snode *sp = VTOS(vp);
2439 	int error;
2440 
2441 	/*
2442 	 * The acl(2) system calls VOP_RWLOCK on the file before setting an
2443 	 * ACL, but since specfs does not serialize reads and writes, this
2444 	 * VOP does not do anything.  However, some backing file systems may
2445 	 * expect the lock to be held before setting an ACL, so it is taken
2446 	 * here privately to avoid serializing specfs reads and writes.
2447 	 */
2448 	if ((realvp = sp->s_realvp) != NULL) {
2449 		(void) VOP_RWLOCK(realvp, V_WRITELOCK_TRUE, NULL);
2450 		error = VOP_SETSECATTR(realvp, vsap, flag, cr);
2451 		(void) VOP_RWUNLOCK(realvp, V_WRITELOCK_TRUE, NULL);
2452 		return (error);
2453 	} else
2454 		return (fs_nosys());
2455 }
2456 
2457 /*
2458  * Get ACL from underlying vnode if one exists, or fabricate it from
2459  * the permissions returned by spec_getattr() otherwise.
2460  */
2461 int
2462 spec_getsecattr(struct vnode *vp, vsecattr_t *vsap, int flag, struct cred *cr)
2463 {
2464 	struct vnode *realvp;
2465 	struct snode *sp = VTOS(vp);
2466 
2467 	if ((realvp = sp->s_realvp) != NULL)
2468 		return (VOP_GETSECATTR(realvp, vsap, flag, cr));
2469 	else
2470 		return (fs_fab_acl(vp, vsap, flag, cr));
2471 }
2472 
2473 int
2474 spec_pathconf(vnode_t *vp, int cmd, ulong_t *valp, cred_t *cr)
2475 {
2476 	vnode_t *realvp;
2477 	struct snode *sp = VTOS(vp);
2478 
2479 	if ((realvp = sp->s_realvp) != NULL)
2480 		return (VOP_PATHCONF(realvp, cmd, valp, cr));
2481 	else
2482 		return (fs_pathconf(vp, cmd, valp, cr));
2483 }
2484