xref: /freebsd/sys/fs/devfs/devfs_vnops.c (revision 4f1f4356f3012928b463f9ef1710fb908e48b1e2)
1 /*-
2  * Copyright (c) 2000-2004
3  *	Poul-Henning Kamp.  All rights reserved.
4  * Copyright (c) 1989, 1992-1993, 1995
5  *	The Regents of the University of California.  All rights reserved.
6  *
7  * This code is derived from software donated to Berkeley by
8  * Jan-Simon Pendry.
9  *
10  * Redistribution and use in source and binary forms, with or without
11  * modification, are permitted provided that the following conditions
12  * are met:
13  * 1. Redistributions of source code must retain the above copyright
14  *    notice, this list of conditions and the following disclaimer.
15  * 2. Neither the name of the University nor the names of its contributors
16  *    may be used to endorse or promote products derived from this software
17  *    without specific prior written permission.
18  *
19  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
20  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
21  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
22  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
23  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
24  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
25  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
26  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
27  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
28  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
29  * SUCH DAMAGE.
30  *
31  *	@(#)kernfs_vnops.c	8.15 (Berkeley) 5/21/95
32  * From: FreeBSD: src/sys/miscfs/kernfs/kernfs_vnops.c 1.43
33  *
34  * $FreeBSD$
35  */
36 
37 /*
38  * TODO:
39  *	remove empty directories
40  *	mkdir: want it ?
41  */
42 
43 #include <sys/param.h>
44 #include <sys/systm.h>
45 #include <sys/conf.h>
46 #include <sys/dirent.h>
47 #include <sys/fcntl.h>
48 #include <sys/file.h>
49 #include <sys/filedesc.h>
50 #include <sys/filio.h>
51 #include <sys/jail.h>
52 #include <sys/kernel.h>
53 #include <sys/lock.h>
54 #include <sys/malloc.h>
55 #include <sys/mount.h>
56 #include <sys/namei.h>
57 #include <sys/priv.h>
58 #include <sys/proc.h>
59 #include <sys/stat.h>
60 #include <sys/sx.h>
61 #include <sys/time.h>
62 #include <sys/ttycom.h>
63 #include <sys/unistd.h>
64 #include <sys/vnode.h>
65 
66 static struct vop_vector devfs_vnodeops;
67 static struct vop_vector devfs_specops;
68 static struct fileops devfs_ops_f;
69 
70 #include <fs/devfs/devfs.h>
71 #include <fs/devfs/devfs_int.h>
72 
73 #include <security/mac/mac_framework.h>
74 
75 static MALLOC_DEFINE(M_CDEVPDATA, "DEVFSP", "Metainfo for cdev-fp data");
76 
77 struct mtx	devfs_de_interlock;
78 MTX_SYSINIT(devfs_de_interlock, &devfs_de_interlock, "devfs interlock", MTX_DEF);
79 struct sx	clone_drain_lock;
80 SX_SYSINIT(clone_drain_lock, &clone_drain_lock, "clone events drain lock");
81 struct mtx	cdevpriv_mtx;
82 MTX_SYSINIT(cdevpriv_mtx, &cdevpriv_mtx, "cdevpriv lock", MTX_DEF);
83 
84 static int
85 devfs_fp_check(struct file *fp, struct cdev **devp, struct cdevsw **dswp,
86     int *ref)
87 {
88 
89 	*dswp = devvn_refthread(fp->f_vnode, devp, ref);
90 	if (*devp != fp->f_data) {
91 		if (*dswp != NULL)
92 			dev_relthread(*devp, *ref);
93 		return (ENXIO);
94 	}
95 	KASSERT((*devp)->si_refcount > 0,
96 	    ("devfs: un-referenced struct cdev *(%s)", devtoname(*devp)));
97 	if (*dswp == NULL)
98 		return (ENXIO);
99 	curthread->td_fpop = fp;
100 	return (0);
101 }
102 
103 int
104 devfs_get_cdevpriv(void **datap)
105 {
106 	struct file *fp;
107 	struct cdev_privdata *p;
108 	int error;
109 
110 	fp = curthread->td_fpop;
111 	if (fp == NULL)
112 		return (EBADF);
113 	p = fp->f_cdevpriv;
114 	if (p != NULL) {
115 		error = 0;
116 		*datap = p->cdpd_data;
117 	} else
118 		error = ENOENT;
119 	return (error);
120 }
121 
122 int
123 devfs_set_cdevpriv(void *priv, cdevpriv_dtr_t priv_dtr)
124 {
125 	struct file *fp;
126 	struct cdev_priv *cdp;
127 	struct cdev_privdata *p;
128 	int error;
129 
130 	fp = curthread->td_fpop;
131 	if (fp == NULL)
132 		return (ENOENT);
133 	cdp = cdev2priv((struct cdev *)fp->f_data);
134 	p = malloc(sizeof(struct cdev_privdata), M_CDEVPDATA, M_WAITOK);
135 	p->cdpd_data = priv;
136 	p->cdpd_dtr = priv_dtr;
137 	p->cdpd_fp = fp;
138 	mtx_lock(&cdevpriv_mtx);
139 	if (fp->f_cdevpriv == NULL) {
140 		LIST_INSERT_HEAD(&cdp->cdp_fdpriv, p, cdpd_list);
141 		fp->f_cdevpriv = p;
142 		mtx_unlock(&cdevpriv_mtx);
143 		error = 0;
144 	} else {
145 		mtx_unlock(&cdevpriv_mtx);
146 		free(p, M_CDEVPDATA);
147 		error = EBUSY;
148 	}
149 	return (error);
150 }
151 
152 void
153 devfs_destroy_cdevpriv(struct cdev_privdata *p)
154 {
155 
156 	mtx_assert(&cdevpriv_mtx, MA_OWNED);
157 	p->cdpd_fp->f_cdevpriv = NULL;
158 	LIST_REMOVE(p, cdpd_list);
159 	mtx_unlock(&cdevpriv_mtx);
160 	(p->cdpd_dtr)(p->cdpd_data);
161 	free(p, M_CDEVPDATA);
162 }
163 
164 void
165 devfs_fpdrop(struct file *fp)
166 {
167 	struct cdev_privdata *p;
168 
169 	mtx_lock(&cdevpriv_mtx);
170 	if ((p = fp->f_cdevpriv) == NULL) {
171 		mtx_unlock(&cdevpriv_mtx);
172 		return;
173 	}
174 	devfs_destroy_cdevpriv(p);
175 }
176 
177 void
178 devfs_clear_cdevpriv(void)
179 {
180 	struct file *fp;
181 
182 	fp = curthread->td_fpop;
183 	if (fp == NULL)
184 		return;
185 	devfs_fpdrop(fp);
186 }
187 
188 /*
189  * On success devfs_populate_vp() returns with dmp->dm_lock held.
190  */
191 static int
192 devfs_populate_vp(struct vnode *vp)
193 {
194 	struct devfs_mount *dmp;
195 	int locked;
196 
197 	ASSERT_VOP_LOCKED(vp, "devfs_populate_vp");
198 
199 	dmp = VFSTODEVFS(vp->v_mount);
200 	locked = VOP_ISLOCKED(vp);
201 
202 	sx_xlock(&dmp->dm_lock);
203 	DEVFS_DMP_HOLD(dmp);
204 
205 	/* Can't call devfs_populate() with the vnode lock held. */
206 	VOP_UNLOCK(vp, 0);
207 	devfs_populate(dmp);
208 
209 	sx_xunlock(&dmp->dm_lock);
210 	vn_lock(vp, locked | LK_RETRY);
211 	sx_xlock(&dmp->dm_lock);
212 	if (DEVFS_DMP_DROP(dmp)) {
213 		sx_xunlock(&dmp->dm_lock);
214 		devfs_unmount_final(dmp);
215 		return (EBADF);
216 	}
217 	if (vp->v_iflag & VI_DOOMED) {
218 		sx_xunlock(&dmp->dm_lock);
219 		return (EBADF);
220 	}
221 
222 	return (0);
223 }
224 
225 static int
226 devfs_vptocnp(struct vop_vptocnp_args *ap)
227 {
228 	struct vnode *vp = ap->a_vp;
229 	struct vnode **dvp = ap->a_vpp;
230 	struct devfs_mount *dmp;
231 	char *buf = ap->a_buf;
232 	int *buflen = ap->a_buflen;
233 	struct devfs_dirent *dd, *de;
234 	int i, error;
235 
236 	dmp = VFSTODEVFS(vp->v_mount);
237 	i = *buflen;
238 	dd = vp->v_data;
239 	error = 0;
240 
241 	sx_xlock(&dmp->dm_lock);
242 
243 	if (vp->v_type == VCHR) {
244 		i -= strlen(dd->de_cdp->cdp_c.si_name);
245 		if (i < 0) {
246 			error = ENOMEM;
247 			goto finished;
248 		}
249 		bcopy(dd->de_cdp->cdp_c.si_name, buf + i,
250 		    strlen(dd->de_cdp->cdp_c.si_name));
251 		de = dd->de_dir;
252 	} else if (vp->v_type == VDIR) {
253 		if (dd == dmp->dm_rootdir) {
254 			*dvp = vp;
255 			vhold(*dvp);
256 			goto finished;
257 		}
258 		i -= dd->de_dirent->d_namlen;
259 		if (i < 0) {
260 			error = ENOMEM;
261 			goto finished;
262 		}
263 		bcopy(dd->de_dirent->d_name, buf + i,
264 		    dd->de_dirent->d_namlen);
265 		de = dd;
266 	} else {
267 		error = ENOENT;
268 		goto finished;
269 	}
270 	*buflen = i;
271 	de = devfs_parent_dirent(de);
272 	if (de == NULL) {
273 		error = ENOENT;
274 		goto finished;
275 	}
276 	mtx_lock(&devfs_de_interlock);
277 	*dvp = de->de_vnode;
278 	if (*dvp != NULL) {
279 		VI_LOCK(*dvp);
280 		mtx_unlock(&devfs_de_interlock);
281 		vholdl(*dvp);
282 		VI_UNLOCK(*dvp);
283 	} else {
284 		mtx_unlock(&devfs_de_interlock);
285 		error = ENOENT;
286 	}
287 finished:
288 	sx_xunlock(&dmp->dm_lock);
289 	return (error);
290 }
291 
292 /*
293  * Construct the fully qualified path name relative to the mountpoint
294  */
295 static char *
296 devfs_fqpn(char *buf, struct vnode *dvp, struct componentname *cnp)
297 {
298 	int i;
299 	struct devfs_dirent *de, *dd;
300 	struct devfs_mount *dmp;
301 
302 	dmp = VFSTODEVFS(dvp->v_mount);
303 	dd = dvp->v_data;
304 	i = SPECNAMELEN;
305 	buf[i] = '\0';
306 	i -= cnp->cn_namelen;
307 	if (i < 0)
308 		 return (NULL);
309 	bcopy(cnp->cn_nameptr, buf + i, cnp->cn_namelen);
310 	de = dd;
311 	while (de != dmp->dm_rootdir) {
312 		i--;
313 		if (i < 0)
314 			 return (NULL);
315 		buf[i] = '/';
316 		i -= de->de_dirent->d_namlen;
317 		if (i < 0)
318 			 return (NULL);
319 		bcopy(de->de_dirent->d_name, buf + i,
320 		    de->de_dirent->d_namlen);
321 		de = devfs_parent_dirent(de);
322 		if (de == NULL)
323 			return (NULL);
324 	}
325 	return (buf + i);
326 }
327 
328 static int
329 devfs_allocv_drop_refs(int drop_dm_lock, struct devfs_mount *dmp,
330 	struct devfs_dirent *de)
331 {
332 	int not_found;
333 
334 	not_found = 0;
335 	if (de->de_flags & DE_DOOMED)
336 		not_found = 1;
337 	if (DEVFS_DE_DROP(de)) {
338 		KASSERT(not_found == 1, ("DEVFS de dropped but not doomed"));
339 		devfs_dirent_free(de);
340 	}
341 	if (DEVFS_DMP_DROP(dmp)) {
342 		KASSERT(not_found == 1,
343 			("DEVFS mount struct freed before dirent"));
344 		not_found = 2;
345 		sx_xunlock(&dmp->dm_lock);
346 		devfs_unmount_final(dmp);
347 	}
348 	if (not_found == 1 || (drop_dm_lock && not_found != 2))
349 		sx_unlock(&dmp->dm_lock);
350 	return (not_found);
351 }
352 
353 static void
354 devfs_insmntque_dtr(struct vnode *vp, void *arg)
355 {
356 	struct devfs_dirent *de;
357 
358 	de = (struct devfs_dirent *)arg;
359 	mtx_lock(&devfs_de_interlock);
360 	vp->v_data = NULL;
361 	de->de_vnode = NULL;
362 	mtx_unlock(&devfs_de_interlock);
363 	vgone(vp);
364 	vput(vp);
365 }
366 
367 /*
368  * devfs_allocv shall be entered with dmp->dm_lock held, and it drops
369  * it on return.
370  */
371 int
372 devfs_allocv(struct devfs_dirent *de, struct mount *mp, int lockmode,
373     struct vnode **vpp)
374 {
375 	int error;
376 	struct vnode *vp;
377 	struct cdev *dev;
378 	struct devfs_mount *dmp;
379 	struct cdevsw *dsw;
380 
381 	dmp = VFSTODEVFS(mp);
382 	if (de->de_flags & DE_DOOMED) {
383 		sx_xunlock(&dmp->dm_lock);
384 		return (ENOENT);
385 	}
386 	DEVFS_DE_HOLD(de);
387 	DEVFS_DMP_HOLD(dmp);
388 	mtx_lock(&devfs_de_interlock);
389 	vp = de->de_vnode;
390 	if (vp != NULL) {
391 		VI_LOCK(vp);
392 		mtx_unlock(&devfs_de_interlock);
393 		sx_xunlock(&dmp->dm_lock);
394 		error = vget(vp, lockmode | LK_INTERLOCK, curthread);
395 		sx_xlock(&dmp->dm_lock);
396 		if (devfs_allocv_drop_refs(0, dmp, de)) {
397 			if (error == 0)
398 				vput(vp);
399 			return (ENOENT);
400 		}
401 		else if (error) {
402 			sx_xunlock(&dmp->dm_lock);
403 			return (error);
404 		}
405 		sx_xunlock(&dmp->dm_lock);
406 		*vpp = vp;
407 		return (0);
408 	}
409 	mtx_unlock(&devfs_de_interlock);
410 	if (de->de_dirent->d_type == DT_CHR) {
411 		if (!(de->de_cdp->cdp_flags & CDP_ACTIVE)) {
412 			devfs_allocv_drop_refs(1, dmp, de);
413 			return (ENOENT);
414 		}
415 		dev = &de->de_cdp->cdp_c;
416 	} else {
417 		dev = NULL;
418 	}
419 	error = getnewvnode("devfs", mp, &devfs_vnodeops, &vp);
420 	if (error != 0) {
421 		devfs_allocv_drop_refs(1, dmp, de);
422 		printf("devfs_allocv: failed to allocate new vnode\n");
423 		return (error);
424 	}
425 
426 	if (de->de_dirent->d_type == DT_CHR) {
427 		vp->v_type = VCHR;
428 		VI_LOCK(vp);
429 		dev_lock();
430 		dev_refl(dev);
431 		/* XXX: v_rdev should be protect by vnode lock */
432 		vp->v_rdev = dev;
433 		KASSERT(vp->v_usecount == 1,
434 		    ("%s %d (%d)\n", __func__, __LINE__, vp->v_usecount));
435 		dev->si_usecount += vp->v_usecount;
436 		/* Special casing of ttys for deadfs.  Probably redundant. */
437 		dsw = dev->si_devsw;
438 		if (dsw != NULL && (dsw->d_flags & D_TTY) != 0)
439 			vp->v_vflag |= VV_ISTTY;
440 		dev_unlock();
441 		VI_UNLOCK(vp);
442 		if ((dev->si_flags & SI_ETERNAL) != 0)
443 			vp->v_vflag |= VV_ETERNALDEV;
444 		vp->v_op = &devfs_specops;
445 	} else if (de->de_dirent->d_type == DT_DIR) {
446 		vp->v_type = VDIR;
447 	} else if (de->de_dirent->d_type == DT_LNK) {
448 		vp->v_type = VLNK;
449 	} else {
450 		vp->v_type = VBAD;
451 	}
452 	vn_lock(vp, LK_EXCLUSIVE | LK_RETRY | LK_NOWITNESS);
453 	VN_LOCK_ASHARE(vp);
454 	mtx_lock(&devfs_de_interlock);
455 	vp->v_data = de;
456 	de->de_vnode = vp;
457 	mtx_unlock(&devfs_de_interlock);
458 	error = insmntque1(vp, mp, devfs_insmntque_dtr, de);
459 	if (error != 0) {
460 		(void) devfs_allocv_drop_refs(1, dmp, de);
461 		return (error);
462 	}
463 	if (devfs_allocv_drop_refs(0, dmp, de)) {
464 		vput(vp);
465 		return (ENOENT);
466 	}
467 #ifdef MAC
468 	mac_devfs_vnode_associate(mp, de, vp);
469 #endif
470 	sx_xunlock(&dmp->dm_lock);
471 	*vpp = vp;
472 	return (0);
473 }
474 
475 static int
476 devfs_access(struct vop_access_args *ap)
477 {
478 	struct vnode *vp = ap->a_vp;
479 	struct devfs_dirent *de;
480 	int error;
481 
482 	de = vp->v_data;
483 	if (vp->v_type == VDIR)
484 		de = de->de_dir;
485 
486 	error = vaccess(vp->v_type, de->de_mode, de->de_uid, de->de_gid,
487 	    ap->a_accmode, ap->a_cred, NULL);
488 	if (error == 0)
489 		return (0);
490 	if (error != EACCES)
491 		return (error);
492 	/* We do, however, allow access to the controlling terminal */
493 	if (!(ap->a_td->td_proc->p_flag & P_CONTROLT))
494 		return (error);
495 	if (ap->a_td->td_proc->p_session->s_ttydp == de->de_cdp)
496 		return (0);
497 	return (error);
498 }
499 
500 /* ARGSUSED */
501 static int
502 devfs_close(struct vop_close_args *ap)
503 {
504 	struct vnode *vp = ap->a_vp, *oldvp;
505 	struct thread *td = ap->a_td;
506 	struct cdev *dev = vp->v_rdev;
507 	struct cdevsw *dsw;
508 	int vp_locked, error, ref;
509 
510 	/*
511 	 * XXX: Don't call d_close() if we were called because of
512 	 * XXX: insmntque1() failure.
513 	 */
514 	if (vp->v_data == NULL)
515 		return (0);
516 
517 	/*
518 	 * Hack: a tty device that is a controlling terminal
519 	 * has a reference from the session structure.
520 	 * We cannot easily tell that a character device is
521 	 * a controlling terminal, unless it is the closing
522 	 * process' controlling terminal.  In that case,
523 	 * if the reference count is 2 (this last descriptor
524 	 * plus the session), release the reference from the session.
525 	 */
526 	oldvp = NULL;
527 	sx_xlock(&proctree_lock);
528 	if (td && vp == td->td_proc->p_session->s_ttyvp) {
529 		SESS_LOCK(td->td_proc->p_session);
530 		VI_LOCK(vp);
531 		if (count_dev(dev) == 2 && (vp->v_iflag & VI_DOOMED) == 0) {
532 			td->td_proc->p_session->s_ttyvp = NULL;
533 			td->td_proc->p_session->s_ttydp = NULL;
534 			oldvp = vp;
535 		}
536 		VI_UNLOCK(vp);
537 		SESS_UNLOCK(td->td_proc->p_session);
538 	}
539 	sx_xunlock(&proctree_lock);
540 	if (oldvp != NULL)
541 		vrele(oldvp);
542 	/*
543 	 * We do not want to really close the device if it
544 	 * is still in use unless we are trying to close it
545 	 * forcibly. Since every use (buffer, vnode, swap, cmap)
546 	 * holds a reference to the vnode, and because we mark
547 	 * any other vnodes that alias this device, when the
548 	 * sum of the reference counts on all the aliased
549 	 * vnodes descends to one, we are on last close.
550 	 */
551 	dsw = dev_refthread(dev, &ref);
552 	if (dsw == NULL)
553 		return (ENXIO);
554 	VI_LOCK(vp);
555 	if (vp->v_iflag & VI_DOOMED) {
556 		/* Forced close. */
557 	} else if (dsw->d_flags & D_TRACKCLOSE) {
558 		/* Keep device updated on status. */
559 	} else if (count_dev(dev) > 1) {
560 		VI_UNLOCK(vp);
561 		dev_relthread(dev, ref);
562 		return (0);
563 	}
564 	vholdl(vp);
565 	VI_UNLOCK(vp);
566 	vp_locked = VOP_ISLOCKED(vp);
567 	VOP_UNLOCK(vp, 0);
568 	KASSERT(dev->si_refcount > 0,
569 	    ("devfs_close() on un-referenced struct cdev *(%s)", devtoname(dev)));
570 	error = dsw->d_close(dev, ap->a_fflag, S_IFCHR, td);
571 	dev_relthread(dev, ref);
572 	vn_lock(vp, vp_locked | LK_RETRY);
573 	vdrop(vp);
574 	return (error);
575 }
576 
577 static int
578 devfs_close_f(struct file *fp, struct thread *td)
579 {
580 	int error;
581 	struct file *fpop;
582 
583 	fpop = td->td_fpop;
584 	td->td_fpop = fp;
585 	error = vnops.fo_close(fp, td);
586 	td->td_fpop = fpop;
587 	return (error);
588 }
589 
590 static int
591 devfs_fsync(struct vop_fsync_args *ap)
592 {
593 	int error;
594 	struct bufobj *bo;
595 	struct devfs_dirent *de;
596 
597 	if (!vn_isdisk(ap->a_vp, &error)) {
598 		bo = &ap->a_vp->v_bufobj;
599 		de = ap->a_vp->v_data;
600 		if (error == ENXIO && bo->bo_dirty.bv_cnt > 0) {
601 			printf("Device %s went missing before all of the data "
602 			    "could be written to it; expect data loss.\n",
603 			    de->de_dirent->d_name);
604 
605 			error = vop_stdfsync(ap);
606 			if (bo->bo_dirty.bv_cnt != 0 || error != 0)
607 				panic("devfs_fsync: vop_stdfsync failed.");
608 		}
609 
610 		return (0);
611 	}
612 
613 	return (vop_stdfsync(ap));
614 }
615 
616 static int
617 devfs_getattr(struct vop_getattr_args *ap)
618 {
619 	struct vnode *vp = ap->a_vp;
620 	struct vattr *vap = ap->a_vap;
621 	int error;
622 	struct devfs_dirent *de;
623 	struct devfs_mount *dmp;
624 	struct cdev *dev;
625 
626 	error = devfs_populate_vp(vp);
627 	if (error != 0)
628 		return (error);
629 
630 	dmp = VFSTODEVFS(vp->v_mount);
631 	sx_xunlock(&dmp->dm_lock);
632 
633 	de = vp->v_data;
634 	KASSERT(de != NULL, ("Null dirent in devfs_getattr vp=%p", vp));
635 	if (vp->v_type == VDIR) {
636 		de = de->de_dir;
637 		KASSERT(de != NULL,
638 		    ("Null dir dirent in devfs_getattr vp=%p", vp));
639 	}
640 	vap->va_uid = de->de_uid;
641 	vap->va_gid = de->de_gid;
642 	vap->va_mode = de->de_mode;
643 	if (vp->v_type == VLNK)
644 		vap->va_size = strlen(de->de_symlink);
645 	else if (vp->v_type == VDIR)
646 		vap->va_size = vap->va_bytes = DEV_BSIZE;
647 	else
648 		vap->va_size = 0;
649 	if (vp->v_type != VDIR)
650 		vap->va_bytes = 0;
651 	vap->va_blocksize = DEV_BSIZE;
652 	vap->va_type = vp->v_type;
653 
654 #define fix(aa)							\
655 	do {							\
656 		if ((aa).tv_sec <= 3600) {			\
657 			(aa).tv_sec = boottime.tv_sec;		\
658 			(aa).tv_nsec = boottime.tv_usec * 1000; \
659 		}						\
660 	} while (0)
661 
662 	if (vp->v_type != VCHR)  {
663 		fix(de->de_atime);
664 		vap->va_atime = de->de_atime;
665 		fix(de->de_mtime);
666 		vap->va_mtime = de->de_mtime;
667 		fix(de->de_ctime);
668 		vap->va_ctime = de->de_ctime;
669 	} else {
670 		dev = vp->v_rdev;
671 		fix(dev->si_atime);
672 		vap->va_atime = dev->si_atime;
673 		fix(dev->si_mtime);
674 		vap->va_mtime = dev->si_mtime;
675 		fix(dev->si_ctime);
676 		vap->va_ctime = dev->si_ctime;
677 
678 		vap->va_rdev = cdev2priv(dev)->cdp_inode;
679 	}
680 	vap->va_gen = 0;
681 	vap->va_flags = 0;
682 	vap->va_filerev = 0;
683 	vap->va_nlink = de->de_links;
684 	vap->va_fileid = de->de_inode;
685 
686 	return (error);
687 }
688 
689 /* ARGSUSED */
690 static int
691 devfs_ioctl_f(struct file *fp, u_long com, void *data, struct ucred *cred, struct thread *td)
692 {
693 	struct cdev *dev;
694 	struct cdevsw *dsw;
695 	struct vnode *vp;
696 	struct vnode *vpold;
697 	int error, i, ref;
698 	const char *p;
699 	struct fiodgname_arg *fgn;
700 	struct file *fpop;
701 
702 	fpop = td->td_fpop;
703 	error = devfs_fp_check(fp, &dev, &dsw, &ref);
704 	if (error)
705 		return (error);
706 
707 	if (com == FIODTYPE) {
708 		*(int *)data = dsw->d_flags & D_TYPEMASK;
709 		td->td_fpop = fpop;
710 		dev_relthread(dev, ref);
711 		return (0);
712 	} else if (com == FIODGNAME) {
713 		fgn = data;
714 		p = devtoname(dev);
715 		i = strlen(p) + 1;
716 		if (i > fgn->len)
717 			error = EINVAL;
718 		else
719 			error = copyout(p, fgn->buf, i);
720 		td->td_fpop = fpop;
721 		dev_relthread(dev, ref);
722 		return (error);
723 	}
724 	error = dsw->d_ioctl(dev, com, data, fp->f_flag, td);
725 	td->td_fpop = NULL;
726 	dev_relthread(dev, ref);
727 	if (error == ENOIOCTL)
728 		error = ENOTTY;
729 	if (error == 0 && com == TIOCSCTTY) {
730 		vp = fp->f_vnode;
731 
732 		/* Do nothing if reassigning same control tty */
733 		sx_slock(&proctree_lock);
734 		if (td->td_proc->p_session->s_ttyvp == vp) {
735 			sx_sunlock(&proctree_lock);
736 			return (0);
737 		}
738 
739 		vpold = td->td_proc->p_session->s_ttyvp;
740 		VREF(vp);
741 		SESS_LOCK(td->td_proc->p_session);
742 		td->td_proc->p_session->s_ttyvp = vp;
743 		td->td_proc->p_session->s_ttydp = cdev2priv(dev);
744 		SESS_UNLOCK(td->td_proc->p_session);
745 
746 		sx_sunlock(&proctree_lock);
747 
748 		/* Get rid of reference to old control tty */
749 		if (vpold)
750 			vrele(vpold);
751 	}
752 	return (error);
753 }
754 
755 /* ARGSUSED */
756 static int
757 devfs_kqfilter_f(struct file *fp, struct knote *kn)
758 {
759 	struct cdev *dev;
760 	struct cdevsw *dsw;
761 	int error, ref;
762 	struct file *fpop;
763 	struct thread *td;
764 
765 	td = curthread;
766 	fpop = td->td_fpop;
767 	error = devfs_fp_check(fp, &dev, &dsw, &ref);
768 	if (error)
769 		return (error);
770 	error = dsw->d_kqfilter(dev, kn);
771 	td->td_fpop = fpop;
772 	dev_relthread(dev, ref);
773 	return (error);
774 }
775 
776 static inline int
777 devfs_prison_check(struct devfs_dirent *de, struct thread *td)
778 {
779 	struct cdev_priv *cdp;
780 	struct ucred *dcr;
781 	int error;
782 
783 	cdp = de->de_cdp;
784 	if (cdp == NULL)
785 		return (0);
786 	dcr = cdp->cdp_c.si_cred;
787 	if (dcr == NULL)
788 		return (0);
789 
790 	error = prison_check(td->td_ucred, dcr);
791 	if (error == 0)
792 		return (0);
793 	/* We do, however, allow access to the controlling terminal */
794 	if (!(td->td_proc->p_flag & P_CONTROLT))
795 		return (error);
796 	if (td->td_proc->p_session->s_ttydp == cdp)
797 		return (0);
798 	return (error);
799 }
800 
801 static int
802 devfs_lookupx(struct vop_lookup_args *ap, int *dm_unlock)
803 {
804 	struct componentname *cnp;
805 	struct vnode *dvp, **vpp;
806 	struct thread *td;
807 	struct devfs_dirent *de, *dd;
808 	struct devfs_dirent **dde;
809 	struct devfs_mount *dmp;
810 	struct cdev *cdev;
811 	int error, flags, nameiop, dvplocked;
812 	char specname[SPECNAMELEN + 1], *pname;
813 
814 	cnp = ap->a_cnp;
815 	vpp = ap->a_vpp;
816 	dvp = ap->a_dvp;
817 	pname = cnp->cn_nameptr;
818 	td = cnp->cn_thread;
819 	flags = cnp->cn_flags;
820 	nameiop = cnp->cn_nameiop;
821 	dmp = VFSTODEVFS(dvp->v_mount);
822 	dd = dvp->v_data;
823 	*vpp = NULLVP;
824 
825 	if ((flags & ISLASTCN) && nameiop == RENAME)
826 		return (EOPNOTSUPP);
827 
828 	if (dvp->v_type != VDIR)
829 		return (ENOTDIR);
830 
831 	if ((flags & ISDOTDOT) && (dvp->v_vflag & VV_ROOT))
832 		return (EIO);
833 
834 	error = VOP_ACCESS(dvp, VEXEC, cnp->cn_cred, td);
835 	if (error)
836 		return (error);
837 
838 	if (cnp->cn_namelen == 1 && *pname == '.') {
839 		if ((flags & ISLASTCN) && nameiop != LOOKUP)
840 			return (EINVAL);
841 		*vpp = dvp;
842 		VREF(dvp);
843 		return (0);
844 	}
845 
846 	if (flags & ISDOTDOT) {
847 		if ((flags & ISLASTCN) && nameiop != LOOKUP)
848 			return (EINVAL);
849 		de = devfs_parent_dirent(dd);
850 		if (de == NULL)
851 			return (ENOENT);
852 		dvplocked = VOP_ISLOCKED(dvp);
853 		VOP_UNLOCK(dvp, 0);
854 		error = devfs_allocv(de, dvp->v_mount,
855 		    cnp->cn_lkflags & LK_TYPE_MASK, vpp);
856 		*dm_unlock = 0;
857 		vn_lock(dvp, dvplocked | LK_RETRY);
858 		return (error);
859 	}
860 
861 	dd = dvp->v_data;
862 	de = devfs_find(dd, cnp->cn_nameptr, cnp->cn_namelen, 0);
863 	while (de == NULL) {	/* While(...) so we can use break */
864 
865 		if (nameiop == DELETE)
866 			return (ENOENT);
867 
868 		/*
869 		 * OK, we didn't have an entry for the name we were asked for
870 		 * so we try to see if anybody can create it on demand.
871 		 */
872 		pname = devfs_fqpn(specname, dvp, cnp);
873 		if (pname == NULL)
874 			break;
875 
876 		cdev = NULL;
877 		DEVFS_DMP_HOLD(dmp);
878 		sx_xunlock(&dmp->dm_lock);
879 		sx_slock(&clone_drain_lock);
880 		EVENTHANDLER_INVOKE(dev_clone,
881 		    td->td_ucred, pname, strlen(pname), &cdev);
882 		sx_sunlock(&clone_drain_lock);
883 
884 		if (cdev == NULL)
885 			sx_xlock(&dmp->dm_lock);
886 		else if (devfs_populate_vp(dvp) != 0) {
887 			*dm_unlock = 0;
888 			sx_xlock(&dmp->dm_lock);
889 			if (DEVFS_DMP_DROP(dmp)) {
890 				sx_xunlock(&dmp->dm_lock);
891 				devfs_unmount_final(dmp);
892 			} else
893 				sx_xunlock(&dmp->dm_lock);
894 			dev_rel(cdev);
895 			return (ENOENT);
896 		}
897 		if (DEVFS_DMP_DROP(dmp)) {
898 			*dm_unlock = 0;
899 			sx_xunlock(&dmp->dm_lock);
900 			devfs_unmount_final(dmp);
901 			if (cdev != NULL)
902 				dev_rel(cdev);
903 			return (ENOENT);
904 		}
905 
906 		if (cdev == NULL)
907 			break;
908 
909 		dev_lock();
910 		dde = &cdev2priv(cdev)->cdp_dirents[dmp->dm_idx];
911 		if (dde != NULL && *dde != NULL)
912 			de = *dde;
913 		dev_unlock();
914 		dev_rel(cdev);
915 		break;
916 	}
917 
918 	if (de == NULL || de->de_flags & DE_WHITEOUT) {
919 		if ((nameiop == CREATE || nameiop == RENAME) &&
920 		    (flags & (LOCKPARENT | WANTPARENT)) && (flags & ISLASTCN)) {
921 			cnp->cn_flags |= SAVENAME;
922 			return (EJUSTRETURN);
923 		}
924 		return (ENOENT);
925 	}
926 
927 	if (devfs_prison_check(de, td))
928 		return (ENOENT);
929 
930 	if ((cnp->cn_nameiop == DELETE) && (flags & ISLASTCN)) {
931 		error = VOP_ACCESS(dvp, VWRITE, cnp->cn_cred, td);
932 		if (error)
933 			return (error);
934 		if (*vpp == dvp) {
935 			VREF(dvp);
936 			*vpp = dvp;
937 			return (0);
938 		}
939 	}
940 	error = devfs_allocv(de, dvp->v_mount, cnp->cn_lkflags & LK_TYPE_MASK,
941 	    vpp);
942 	*dm_unlock = 0;
943 	return (error);
944 }
945 
946 static int
947 devfs_lookup(struct vop_lookup_args *ap)
948 {
949 	int j;
950 	struct devfs_mount *dmp;
951 	int dm_unlock;
952 
953 	if (devfs_populate_vp(ap->a_dvp) != 0)
954 		return (ENOTDIR);
955 
956 	dmp = VFSTODEVFS(ap->a_dvp->v_mount);
957 	dm_unlock = 1;
958 	j = devfs_lookupx(ap, &dm_unlock);
959 	if (dm_unlock == 1)
960 		sx_xunlock(&dmp->dm_lock);
961 	return (j);
962 }
963 
964 static int
965 devfs_mknod(struct vop_mknod_args *ap)
966 {
967 	struct componentname *cnp;
968 	struct vnode *dvp, **vpp;
969 	struct devfs_dirent *dd, *de;
970 	struct devfs_mount *dmp;
971 	int error;
972 
973 	/*
974 	 * The only type of node we should be creating here is a
975 	 * character device, for anything else return EOPNOTSUPP.
976 	 */
977 	if (ap->a_vap->va_type != VCHR)
978 		return (EOPNOTSUPP);
979 	dvp = ap->a_dvp;
980 	dmp = VFSTODEVFS(dvp->v_mount);
981 
982 	cnp = ap->a_cnp;
983 	vpp = ap->a_vpp;
984 	dd = dvp->v_data;
985 
986 	error = ENOENT;
987 	sx_xlock(&dmp->dm_lock);
988 	TAILQ_FOREACH(de, &dd->de_dlist, de_list) {
989 		if (cnp->cn_namelen != de->de_dirent->d_namlen)
990 			continue;
991 		if (bcmp(cnp->cn_nameptr, de->de_dirent->d_name,
992 		    de->de_dirent->d_namlen) != 0)
993 			continue;
994 		if (de->de_flags & DE_WHITEOUT)
995 			break;
996 		goto notfound;
997 	}
998 	if (de == NULL)
999 		goto notfound;
1000 	de->de_flags &= ~DE_WHITEOUT;
1001 	error = devfs_allocv(de, dvp->v_mount, LK_EXCLUSIVE, vpp);
1002 	return (error);
1003 notfound:
1004 	sx_xunlock(&dmp->dm_lock);
1005 	return (error);
1006 }
1007 
1008 /* ARGSUSED */
1009 static int
1010 devfs_open(struct vop_open_args *ap)
1011 {
1012 	struct thread *td = ap->a_td;
1013 	struct vnode *vp = ap->a_vp;
1014 	struct cdev *dev = vp->v_rdev;
1015 	struct file *fp = ap->a_fp;
1016 	int error, ref, vlocked;
1017 	struct cdevsw *dsw;
1018 	struct file *fpop;
1019 
1020 	if (vp->v_type == VBLK)
1021 		return (ENXIO);
1022 
1023 	if (dev == NULL)
1024 		return (ENXIO);
1025 
1026 	/* Make this field valid before any I/O in d_open. */
1027 	if (dev->si_iosize_max == 0)
1028 		dev->si_iosize_max = DFLTPHYS;
1029 
1030 	dsw = dev_refthread(dev, &ref);
1031 	if (dsw == NULL)
1032 		return (ENXIO);
1033 
1034 	vlocked = VOP_ISLOCKED(vp);
1035 	VOP_UNLOCK(vp, 0);
1036 
1037 	fpop = td->td_fpop;
1038 	td->td_fpop = fp;
1039 	if (fp != NULL) {
1040 		fp->f_data = dev;
1041 		fp->f_vnode = vp;
1042 	}
1043 	if (dsw->d_fdopen != NULL)
1044 		error = dsw->d_fdopen(dev, ap->a_mode, td, fp);
1045 	else
1046 		error = dsw->d_open(dev, ap->a_mode, S_IFCHR, td);
1047 	td->td_fpop = fpop;
1048 
1049 	vn_lock(vp, vlocked | LK_RETRY);
1050 	dev_relthread(dev, ref);
1051 	if (error)
1052 		return (error);
1053 
1054 #if 0	/* /dev/console */
1055 	KASSERT(fp != NULL, ("Could not vnode bypass device on NULL fp"));
1056 #else
1057 	if (fp == NULL)
1058 		return (error);
1059 #endif
1060 	if (fp->f_ops == &badfileops)
1061 		finit(fp, fp->f_flag, DTYPE_VNODE, dev, &devfs_ops_f);
1062 	return (error);
1063 }
1064 
1065 static int
1066 devfs_pathconf(struct vop_pathconf_args *ap)
1067 {
1068 
1069 	switch (ap->a_name) {
1070 	case _PC_MAC_PRESENT:
1071 #ifdef MAC
1072 		/*
1073 		 * If MAC is enabled, devfs automatically supports
1074 		 * trivial non-persistant label storage.
1075 		 */
1076 		*ap->a_retval = 1;
1077 #else
1078 		*ap->a_retval = 0;
1079 #endif
1080 		return (0);
1081 	default:
1082 		return (vop_stdpathconf(ap));
1083 	}
1084 	/* NOTREACHED */
1085 }
1086 
1087 /* ARGSUSED */
1088 static int
1089 devfs_poll_f(struct file *fp, int events, struct ucred *cred, struct thread *td)
1090 {
1091 	struct cdev *dev;
1092 	struct cdevsw *dsw;
1093 	int error, ref;
1094 	struct file *fpop;
1095 
1096 	fpop = td->td_fpop;
1097 	error = devfs_fp_check(fp, &dev, &dsw, &ref);
1098 	if (error)
1099 		return (poll_no_poll(events));
1100 	error = dsw->d_poll(dev, events, td);
1101 	td->td_fpop = fpop;
1102 	dev_relthread(dev, ref);
1103 	return(error);
1104 }
1105 
1106 /*
1107  * Print out the contents of a special device vnode.
1108  */
1109 static int
1110 devfs_print(struct vop_print_args *ap)
1111 {
1112 
1113 	printf("\tdev %s\n", devtoname(ap->a_vp->v_rdev));
1114 	return (0);
1115 }
1116 
1117 /* ARGSUSED */
1118 static int
1119 devfs_read_f(struct file *fp, struct uio *uio, struct ucred *cred, int flags, struct thread *td)
1120 {
1121 	struct cdev *dev;
1122 	int ioflag, error, ref, resid;
1123 	struct cdevsw *dsw;
1124 	struct file *fpop;
1125 
1126 	fpop = td->td_fpop;
1127 	error = devfs_fp_check(fp, &dev, &dsw, &ref);
1128 	if (error)
1129 		return (error);
1130 	resid = uio->uio_resid;
1131 	ioflag = fp->f_flag & (O_NONBLOCK | O_DIRECT);
1132 	if (ioflag & O_DIRECT)
1133 		ioflag |= IO_DIRECT;
1134 
1135 	if ((flags & FOF_OFFSET) == 0)
1136 		uio->uio_offset = fp->f_offset;
1137 
1138 	error = dsw->d_read(dev, uio, ioflag);
1139 	if (uio->uio_resid != resid || (error == 0 && resid != 0))
1140 		vfs_timestamp(&dev->si_atime);
1141 	td->td_fpop = fpop;
1142 	dev_relthread(dev, ref);
1143 
1144 	if ((flags & FOF_OFFSET) == 0)
1145 		fp->f_offset = uio->uio_offset;
1146 	fp->f_nextoff = uio->uio_offset;
1147 	return (error);
1148 }
1149 
1150 static int
1151 devfs_readdir(struct vop_readdir_args *ap)
1152 {
1153 	int error;
1154 	struct uio *uio;
1155 	struct dirent *dp;
1156 	struct devfs_dirent *dd;
1157 	struct devfs_dirent *de;
1158 	struct devfs_mount *dmp;
1159 	off_t off;
1160 	int *tmp_ncookies = NULL;
1161 
1162 	if (ap->a_vp->v_type != VDIR)
1163 		return (ENOTDIR);
1164 
1165 	uio = ap->a_uio;
1166 	if (uio->uio_offset < 0)
1167 		return (EINVAL);
1168 
1169 	/*
1170 	 * XXX: This is a temporary hack to get around this filesystem not
1171 	 * supporting cookies. We store the location of the ncookies pointer
1172 	 * in a temporary variable before calling vfs_subr.c:vfs_read_dirent()
1173 	 * and set the number of cookies to 0. We then set the pointer to
1174 	 * NULL so that vfs_read_dirent doesn't try to call realloc() on
1175 	 * ap->a_cookies. Later in this function, we restore the ap->a_ncookies
1176 	 * pointer to its original location before returning to the caller.
1177 	 */
1178 	if (ap->a_ncookies != NULL) {
1179 		tmp_ncookies = ap->a_ncookies;
1180 		*ap->a_ncookies = 0;
1181 		ap->a_ncookies = NULL;
1182 	}
1183 
1184 	dmp = VFSTODEVFS(ap->a_vp->v_mount);
1185 	if (devfs_populate_vp(ap->a_vp) != 0) {
1186 		if (tmp_ncookies != NULL)
1187 			ap->a_ncookies = tmp_ncookies;
1188 		return (EIO);
1189 	}
1190 	error = 0;
1191 	de = ap->a_vp->v_data;
1192 	off = 0;
1193 	TAILQ_FOREACH(dd, &de->de_dlist, de_list) {
1194 		KASSERT(dd->de_cdp != (void *)0xdeadc0de, ("%s %d\n", __func__, __LINE__));
1195 		if (dd->de_flags & (DE_COVERED | DE_WHITEOUT))
1196 			continue;
1197 		if (devfs_prison_check(dd, uio->uio_td))
1198 			continue;
1199 		if (dd->de_dirent->d_type == DT_DIR)
1200 			de = dd->de_dir;
1201 		else
1202 			de = dd;
1203 		dp = dd->de_dirent;
1204 		if (dp->d_reclen > uio->uio_resid)
1205 			break;
1206 		dp->d_fileno = de->de_inode;
1207 		if (off >= uio->uio_offset) {
1208 			error = vfs_read_dirent(ap, dp, off);
1209 			if (error)
1210 				break;
1211 		}
1212 		off += dp->d_reclen;
1213 	}
1214 	sx_xunlock(&dmp->dm_lock);
1215 	uio->uio_offset = off;
1216 
1217 	/*
1218 	 * Restore ap->a_ncookies if it wasn't originally NULL in the first
1219 	 * place.
1220 	 */
1221 	if (tmp_ncookies != NULL)
1222 		ap->a_ncookies = tmp_ncookies;
1223 
1224 	return (error);
1225 }
1226 
1227 static int
1228 devfs_readlink(struct vop_readlink_args *ap)
1229 {
1230 	struct devfs_dirent *de;
1231 
1232 	de = ap->a_vp->v_data;
1233 	return (uiomove(de->de_symlink, strlen(de->de_symlink), ap->a_uio));
1234 }
1235 
1236 static int
1237 devfs_reclaim(struct vop_reclaim_args *ap)
1238 {
1239 	struct vnode *vp = ap->a_vp;
1240 	struct devfs_dirent *de;
1241 	struct cdev *dev;
1242 
1243 	mtx_lock(&devfs_de_interlock);
1244 	de = vp->v_data;
1245 	if (de != NULL) {
1246 		de->de_vnode = NULL;
1247 		vp->v_data = NULL;
1248 	}
1249 	mtx_unlock(&devfs_de_interlock);
1250 
1251 	vnode_destroy_vobject(vp);
1252 
1253 	VI_LOCK(vp);
1254 	dev_lock();
1255 	dev = vp->v_rdev;
1256 	vp->v_rdev = NULL;
1257 
1258 	if (dev == NULL) {
1259 		dev_unlock();
1260 		VI_UNLOCK(vp);
1261 		return (0);
1262 	}
1263 
1264 	dev->si_usecount -= vp->v_usecount;
1265 	dev_unlock();
1266 	VI_UNLOCK(vp);
1267 	dev_rel(dev);
1268 	return (0);
1269 }
1270 
1271 static int
1272 devfs_remove(struct vop_remove_args *ap)
1273 {
1274 	struct vnode *vp = ap->a_vp;
1275 	struct devfs_dirent *dd;
1276 	struct devfs_dirent *de, *de_covered;
1277 	struct devfs_mount *dmp = VFSTODEVFS(vp->v_mount);
1278 
1279 	sx_xlock(&dmp->dm_lock);
1280 	dd = ap->a_dvp->v_data;
1281 	de = vp->v_data;
1282 	if (de->de_cdp == NULL) {
1283 		TAILQ_REMOVE(&dd->de_dlist, de, de_list);
1284 		if (de->de_dirent->d_type == DT_LNK) {
1285 			de_covered = devfs_find(dd, de->de_dirent->d_name,
1286 			    de->de_dirent->d_namlen, 0);
1287 			if (de_covered != NULL)
1288 				de_covered->de_flags &= ~DE_COVERED;
1289 		}
1290 		devfs_delete(dmp, de, 1);
1291 	} else {
1292 		de->de_flags |= DE_WHITEOUT;
1293 	}
1294 	sx_xunlock(&dmp->dm_lock);
1295 	return (0);
1296 }
1297 
1298 /*
1299  * Revoke is called on a tty when a terminal session ends.  The vnode
1300  * is orphaned by setting v_op to deadfs so we need to let go of it
1301  * as well so that we create a new one next time around.
1302  *
1303  */
1304 static int
1305 devfs_revoke(struct vop_revoke_args *ap)
1306 {
1307 	struct vnode *vp = ap->a_vp, *vp2;
1308 	struct cdev *dev;
1309 	struct cdev_priv *cdp;
1310 	struct devfs_dirent *de;
1311 	int i;
1312 
1313 	KASSERT((ap->a_flags & REVOKEALL) != 0, ("devfs_revoke !REVOKEALL"));
1314 
1315 	dev = vp->v_rdev;
1316 	cdp = cdev2priv(dev);
1317 
1318 	dev_lock();
1319 	cdp->cdp_inuse++;
1320 	dev_unlock();
1321 
1322 	vhold(vp);
1323 	vgone(vp);
1324 	vdrop(vp);
1325 
1326 	VOP_UNLOCK(vp,0);
1327  loop:
1328 	for (;;) {
1329 		mtx_lock(&devfs_de_interlock);
1330 		dev_lock();
1331 		vp2 = NULL;
1332 		for (i = 0; i <= cdp->cdp_maxdirent; i++) {
1333 			de = cdp->cdp_dirents[i];
1334 			if (de == NULL)
1335 				continue;
1336 
1337 			vp2 = de->de_vnode;
1338 			if (vp2 != NULL) {
1339 				dev_unlock();
1340 				VI_LOCK(vp2);
1341 				mtx_unlock(&devfs_de_interlock);
1342 				if (vget(vp2, LK_EXCLUSIVE | LK_INTERLOCK,
1343 				    curthread))
1344 					goto loop;
1345 				vhold(vp2);
1346 				vgone(vp2);
1347 				vdrop(vp2);
1348 				vput(vp2);
1349 				break;
1350 			}
1351 		}
1352 		if (vp2 != NULL) {
1353 			continue;
1354 		}
1355 		dev_unlock();
1356 		mtx_unlock(&devfs_de_interlock);
1357 		break;
1358 	}
1359 	dev_lock();
1360 	cdp->cdp_inuse--;
1361 	if (!(cdp->cdp_flags & CDP_ACTIVE) && cdp->cdp_inuse == 0) {
1362 		TAILQ_REMOVE(&cdevp_list, cdp, cdp_list);
1363 		dev_unlock();
1364 		dev_rel(&cdp->cdp_c);
1365 	} else
1366 		dev_unlock();
1367 
1368 	vn_lock(vp, LK_EXCLUSIVE | LK_RETRY);
1369 	return (0);
1370 }
1371 
1372 static int
1373 devfs_rioctl(struct vop_ioctl_args *ap)
1374 {
1375 	struct vnode *vp;
1376 	struct devfs_mount *dmp;
1377 	int error;
1378 
1379 	vp = ap->a_vp;
1380 	vn_lock(vp, LK_SHARED | LK_RETRY);
1381 	if (vp->v_iflag & VI_DOOMED) {
1382 		VOP_UNLOCK(vp, 0);
1383 		return (EBADF);
1384 	}
1385 	dmp = VFSTODEVFS(vp->v_mount);
1386 	sx_xlock(&dmp->dm_lock);
1387 	VOP_UNLOCK(vp, 0);
1388 	DEVFS_DMP_HOLD(dmp);
1389 	devfs_populate(dmp);
1390 	if (DEVFS_DMP_DROP(dmp)) {
1391 		sx_xunlock(&dmp->dm_lock);
1392 		devfs_unmount_final(dmp);
1393 		return (ENOENT);
1394 	}
1395 	error = devfs_rules_ioctl(dmp, ap->a_command, ap->a_data, ap->a_td);
1396 	sx_xunlock(&dmp->dm_lock);
1397 	return (error);
1398 }
1399 
1400 static int
1401 devfs_rread(struct vop_read_args *ap)
1402 {
1403 
1404 	if (ap->a_vp->v_type != VDIR)
1405 		return (EINVAL);
1406 	return (VOP_READDIR(ap->a_vp, ap->a_uio, ap->a_cred, NULL, NULL, NULL));
1407 }
1408 
1409 static int
1410 devfs_setattr(struct vop_setattr_args *ap)
1411 {
1412 	struct devfs_dirent *de;
1413 	struct vattr *vap;
1414 	struct vnode *vp;
1415 	struct thread *td;
1416 	int c, error;
1417 	uid_t uid;
1418 	gid_t gid;
1419 
1420 	vap = ap->a_vap;
1421 	vp = ap->a_vp;
1422 	td = curthread;
1423 	if ((vap->va_type != VNON) ||
1424 	    (vap->va_nlink != VNOVAL) ||
1425 	    (vap->va_fsid != VNOVAL) ||
1426 	    (vap->va_fileid != VNOVAL) ||
1427 	    (vap->va_blocksize != VNOVAL) ||
1428 	    (vap->va_flags != VNOVAL && vap->va_flags != 0) ||
1429 	    (vap->va_rdev != VNOVAL) ||
1430 	    ((int)vap->va_bytes != VNOVAL) ||
1431 	    (vap->va_gen != VNOVAL)) {
1432 		return (EINVAL);
1433 	}
1434 
1435 	de = vp->v_data;
1436 	if (vp->v_type == VDIR)
1437 		de = de->de_dir;
1438 
1439 	error = c = 0;
1440 	if (vap->va_uid == (uid_t)VNOVAL)
1441 		uid = de->de_uid;
1442 	else
1443 		uid = vap->va_uid;
1444 	if (vap->va_gid == (gid_t)VNOVAL)
1445 		gid = de->de_gid;
1446 	else
1447 		gid = vap->va_gid;
1448 	if (uid != de->de_uid || gid != de->de_gid) {
1449 		if ((ap->a_cred->cr_uid != de->de_uid) || uid != de->de_uid ||
1450 		    (gid != de->de_gid && !groupmember(gid, ap->a_cred))) {
1451 			error = priv_check(td, PRIV_VFS_CHOWN);
1452 			if (error)
1453 				return (error);
1454 		}
1455 		de->de_uid = uid;
1456 		de->de_gid = gid;
1457 		c = 1;
1458 	}
1459 
1460 	if (vap->va_mode != (mode_t)VNOVAL) {
1461 		if (ap->a_cred->cr_uid != de->de_uid) {
1462 			error = priv_check(td, PRIV_VFS_ADMIN);
1463 			if (error)
1464 				return (error);
1465 		}
1466 		de->de_mode = vap->va_mode;
1467 		c = 1;
1468 	}
1469 
1470 	if (vap->va_atime.tv_sec != VNOVAL || vap->va_mtime.tv_sec != VNOVAL) {
1471 		/* See the comment in ufs_vnops::ufs_setattr(). */
1472 		if ((error = VOP_ACCESS(vp, VADMIN, ap->a_cred, td)) &&
1473 		    ((vap->va_vaflags & VA_UTIMES_NULL) == 0 ||
1474 		    (error = VOP_ACCESS(vp, VWRITE, ap->a_cred, td))))
1475 			return (error);
1476 		if (vap->va_atime.tv_sec != VNOVAL) {
1477 			if (vp->v_type == VCHR)
1478 				vp->v_rdev->si_atime = vap->va_atime;
1479 			else
1480 				de->de_atime = vap->va_atime;
1481 		}
1482 		if (vap->va_mtime.tv_sec != VNOVAL) {
1483 			if (vp->v_type == VCHR)
1484 				vp->v_rdev->si_mtime = vap->va_mtime;
1485 			else
1486 				de->de_mtime = vap->va_mtime;
1487 		}
1488 		c = 1;
1489 	}
1490 
1491 	if (c) {
1492 		if (vp->v_type == VCHR)
1493 			vfs_timestamp(&vp->v_rdev->si_ctime);
1494 		else
1495 			vfs_timestamp(&de->de_mtime);
1496 	}
1497 	return (0);
1498 }
1499 
1500 #ifdef MAC
1501 static int
1502 devfs_setlabel(struct vop_setlabel_args *ap)
1503 {
1504 	struct vnode *vp;
1505 	struct devfs_dirent *de;
1506 
1507 	vp = ap->a_vp;
1508 	de = vp->v_data;
1509 
1510 	mac_vnode_relabel(ap->a_cred, vp, ap->a_label);
1511 	mac_devfs_update(vp->v_mount, de, vp);
1512 
1513 	return (0);
1514 }
1515 #endif
1516 
1517 static int
1518 devfs_stat_f(struct file *fp, struct stat *sb, struct ucred *cred, struct thread *td)
1519 {
1520 
1521 	return (vnops.fo_stat(fp, sb, cred, td));
1522 }
1523 
1524 static int
1525 devfs_symlink(struct vop_symlink_args *ap)
1526 {
1527 	int i, error;
1528 	struct devfs_dirent *dd;
1529 	struct devfs_dirent *de, *de_covered, *de_dotdot;
1530 	struct devfs_mount *dmp;
1531 
1532 	error = priv_check(curthread, PRIV_DEVFS_SYMLINK);
1533 	if (error)
1534 		return(error);
1535 	dmp = VFSTODEVFS(ap->a_dvp->v_mount);
1536 	dd = ap->a_dvp->v_data;
1537 	de = devfs_newdirent(ap->a_cnp->cn_nameptr, ap->a_cnp->cn_namelen);
1538 	de->de_uid = 0;
1539 	de->de_gid = 0;
1540 	de->de_mode = 0755;
1541 	de->de_inode = alloc_unr(devfs_inos);
1542 	de->de_dir = dd;
1543 	de->de_dirent->d_type = DT_LNK;
1544 	i = strlen(ap->a_target) + 1;
1545 	de->de_symlink = malloc(i, M_DEVFS, M_WAITOK);
1546 	bcopy(ap->a_target, de->de_symlink, i);
1547 	sx_xlock(&dmp->dm_lock);
1548 #ifdef MAC
1549 	mac_devfs_create_symlink(ap->a_cnp->cn_cred, dmp->dm_mount, dd, de);
1550 #endif
1551 	de_covered = devfs_find(dd, de->de_dirent->d_name,
1552 	    de->de_dirent->d_namlen, 0);
1553 	if (de_covered != NULL) {
1554 		KASSERT((de_covered->de_flags & DE_COVERED) == 0,
1555 		    ("devfs_symlink: entry %p already covered", de_covered));
1556 		de_covered->de_flags |= DE_COVERED;
1557 	}
1558 
1559 	de_dotdot = TAILQ_FIRST(&dd->de_dlist);		/* "." */
1560 	de_dotdot = TAILQ_NEXT(de_dotdot, de_list);	/* ".." */
1561 	TAILQ_INSERT_AFTER(&dd->de_dlist, de_dotdot, de, de_list);
1562 
1563 	return (devfs_allocv(de, ap->a_dvp->v_mount, LK_EXCLUSIVE, ap->a_vpp));
1564 }
1565 
1566 static int
1567 devfs_truncate_f(struct file *fp, off_t length, struct ucred *cred, struct thread *td)
1568 {
1569 
1570 	return (vnops.fo_truncate(fp, length, cred, td));
1571 }
1572 
1573 /* ARGSUSED */
1574 static int
1575 devfs_write_f(struct file *fp, struct uio *uio, struct ucred *cred, int flags, struct thread *td)
1576 {
1577 	struct cdev *dev;
1578 	int error, ioflag, ref, resid;
1579 	struct cdevsw *dsw;
1580 	struct file *fpop;
1581 
1582 	fpop = td->td_fpop;
1583 	error = devfs_fp_check(fp, &dev, &dsw, &ref);
1584 	if (error)
1585 		return (error);
1586 	KASSERT(uio->uio_td == td, ("uio_td %p is not td %p", uio->uio_td, td));
1587 	ioflag = fp->f_flag & (O_NONBLOCK | O_DIRECT | O_FSYNC);
1588 	if (ioflag & O_DIRECT)
1589 		ioflag |= IO_DIRECT;
1590 	if ((flags & FOF_OFFSET) == 0)
1591 		uio->uio_offset = fp->f_offset;
1592 
1593 	resid = uio->uio_resid;
1594 
1595 	error = dsw->d_write(dev, uio, ioflag);
1596 	if (uio->uio_resid != resid || (error == 0 && resid != 0)) {
1597 		vfs_timestamp(&dev->si_ctime);
1598 		dev->si_mtime = dev->si_ctime;
1599 	}
1600 	td->td_fpop = fpop;
1601 	dev_relthread(dev, ref);
1602 
1603 	if ((flags & FOF_OFFSET) == 0)
1604 		fp->f_offset = uio->uio_offset;
1605 	fp->f_nextoff = uio->uio_offset;
1606 	return (error);
1607 }
1608 
1609 dev_t
1610 dev2udev(struct cdev *x)
1611 {
1612 	if (x == NULL)
1613 		return (NODEV);
1614 	return (cdev2priv(x)->cdp_inode);
1615 }
1616 
1617 static struct fileops devfs_ops_f = {
1618 	.fo_read =	devfs_read_f,
1619 	.fo_write =	devfs_write_f,
1620 	.fo_truncate =	devfs_truncate_f,
1621 	.fo_ioctl =	devfs_ioctl_f,
1622 	.fo_poll =	devfs_poll_f,
1623 	.fo_kqfilter =	devfs_kqfilter_f,
1624 	.fo_stat =	devfs_stat_f,
1625 	.fo_close =	devfs_close_f,
1626 	.fo_flags =	DFLAG_PASSABLE | DFLAG_SEEKABLE
1627 };
1628 
1629 static struct vop_vector devfs_vnodeops = {
1630 	.vop_default =		&default_vnodeops,
1631 
1632 	.vop_access =		devfs_access,
1633 	.vop_getattr =		devfs_getattr,
1634 	.vop_ioctl =		devfs_rioctl,
1635 	.vop_lookup =		devfs_lookup,
1636 	.vop_mknod =		devfs_mknod,
1637 	.vop_pathconf =		devfs_pathconf,
1638 	.vop_read =		devfs_rread,
1639 	.vop_readdir =		devfs_readdir,
1640 	.vop_readlink =		devfs_readlink,
1641 	.vop_reclaim =		devfs_reclaim,
1642 	.vop_remove =		devfs_remove,
1643 	.vop_revoke =		devfs_revoke,
1644 	.vop_setattr =		devfs_setattr,
1645 #ifdef MAC
1646 	.vop_setlabel =		devfs_setlabel,
1647 #endif
1648 	.vop_symlink =		devfs_symlink,
1649 	.vop_vptocnp =		devfs_vptocnp,
1650 };
1651 
1652 static struct vop_vector devfs_specops = {
1653 	.vop_default =		&default_vnodeops,
1654 
1655 	.vop_access =		devfs_access,
1656 	.vop_bmap =		VOP_PANIC,
1657 	.vop_close =		devfs_close,
1658 	.vop_create =		VOP_PANIC,
1659 	.vop_fsync =		devfs_fsync,
1660 	.vop_getattr =		devfs_getattr,
1661 	.vop_link =		VOP_PANIC,
1662 	.vop_mkdir =		VOP_PANIC,
1663 	.vop_mknod =		VOP_PANIC,
1664 	.vop_open =		devfs_open,
1665 	.vop_pathconf =		devfs_pathconf,
1666 	.vop_print =		devfs_print,
1667 	.vop_read =		VOP_PANIC,
1668 	.vop_readdir =		VOP_PANIC,
1669 	.vop_readlink =		VOP_PANIC,
1670 	.vop_reallocblks =	VOP_PANIC,
1671 	.vop_reclaim =		devfs_reclaim,
1672 	.vop_remove =		devfs_remove,
1673 	.vop_rename =		VOP_PANIC,
1674 	.vop_revoke =		devfs_revoke,
1675 	.vop_rmdir =		VOP_PANIC,
1676 	.vop_setattr =		devfs_setattr,
1677 #ifdef MAC
1678 	.vop_setlabel =		devfs_setlabel,
1679 #endif
1680 	.vop_strategy =		VOP_PANIC,
1681 	.vop_symlink =		VOP_PANIC,
1682 	.vop_vptocnp =		devfs_vptocnp,
1683 	.vop_write =		VOP_PANIC,
1684 };
1685 
1686 /*
1687  * Our calling convention to the device drivers used to be that we passed
1688  * vnode.h IO_* flags to read()/write(), but we're moving to fcntl.h O_
1689  * flags instead since that's what open(), close() and ioctl() takes and
1690  * we don't really want vnode.h in device drivers.
1691  * We solved the source compatibility by redefining some vnode flags to
1692  * be the same as the fcntl ones and by sending down the bitwise OR of
1693  * the respective fcntl/vnode flags.  These CTASSERTS make sure nobody
1694  * pulls the rug out under this.
1695  */
1696 CTASSERT(O_NONBLOCK == IO_NDELAY);
1697 CTASSERT(O_FSYNC == IO_SYNC);
1698