xref: /freebsd/sys/fs/devfs/devfs_vnops.c (revision 7778ab7e0cc22f0824eb1d1047a7ef8b4785267a)
1 /*-
2  * Copyright (c) 2000-2004
3  *	Poul-Henning Kamp.  All rights reserved.
4  * Copyright (c) 1989, 1992-1993, 1995
5  *	The Regents of the University of California.  All rights reserved.
6  *
7  * This code is derived from software donated to Berkeley by
8  * Jan-Simon Pendry.
9  *
10  * Redistribution and use in source and binary forms, with or without
11  * modification, are permitted provided that the following conditions
12  * are met:
13  * 1. Redistributions of source code must retain the above copyright
14  *    notice, this list of conditions and the following disclaimer.
15  * 2. Neither the name of the University nor the names of its contributors
16  *    may be used to endorse or promote products derived from this software
17  *    without specific prior written permission.
18  *
19  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
20  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
21  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
22  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
23  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
24  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
25  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
26  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
27  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
28  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
29  * SUCH DAMAGE.
30  *
31  *	@(#)kernfs_vnops.c	8.15 (Berkeley) 5/21/95
32  * From: FreeBSD: src/sys/miscfs/kernfs/kernfs_vnops.c 1.43
33  *
34  * $FreeBSD$
35  */
36 
37 /*
38  * TODO:
39  *	mkdir: want it ?
40  */
41 
42 #include <sys/param.h>
43 #include <sys/systm.h>
44 #include <sys/conf.h>
45 #include <sys/dirent.h>
46 #include <sys/fcntl.h>
47 #include <sys/file.h>
48 #include <sys/filedesc.h>
49 #include <sys/filio.h>
50 #include <sys/jail.h>
51 #include <sys/kernel.h>
52 #include <sys/lock.h>
53 #include <sys/malloc.h>
54 #include <sys/mount.h>
55 #include <sys/namei.h>
56 #include <sys/priv.h>
57 #include <sys/proc.h>
58 #include <sys/stat.h>
59 #include <sys/sx.h>
60 #include <sys/time.h>
61 #include <sys/ttycom.h>
62 #include <sys/unistd.h>
63 #include <sys/vnode.h>
64 
65 static struct vop_vector devfs_vnodeops;
66 static struct vop_vector devfs_specops;
67 static struct fileops devfs_ops_f;
68 
69 #include <fs/devfs/devfs.h>
70 #include <fs/devfs/devfs_int.h>
71 
72 #include <security/mac/mac_framework.h>
73 
74 static MALLOC_DEFINE(M_CDEVPDATA, "DEVFSP", "Metainfo for cdev-fp data");
75 
76 struct mtx	devfs_de_interlock;
77 MTX_SYSINIT(devfs_de_interlock, &devfs_de_interlock, "devfs interlock", MTX_DEF);
78 struct sx	clone_drain_lock;
79 SX_SYSINIT(clone_drain_lock, &clone_drain_lock, "clone events drain lock");
80 struct mtx	cdevpriv_mtx;
81 MTX_SYSINIT(cdevpriv_mtx, &cdevpriv_mtx, "cdevpriv lock", MTX_DEF);
82 
83 static int
84 devfs_fp_check(struct file *fp, struct cdev **devp, struct cdevsw **dswp,
85     int *ref)
86 {
87 
88 	*dswp = devvn_refthread(fp->f_vnode, devp, ref);
89 	if (*devp != fp->f_data) {
90 		if (*dswp != NULL)
91 			dev_relthread(*devp, *ref);
92 		return (ENXIO);
93 	}
94 	KASSERT((*devp)->si_refcount > 0,
95 	    ("devfs: un-referenced struct cdev *(%s)", devtoname(*devp)));
96 	if (*dswp == NULL)
97 		return (ENXIO);
98 	curthread->td_fpop = fp;
99 	return (0);
100 }
101 
102 int
103 devfs_get_cdevpriv(void **datap)
104 {
105 	struct file *fp;
106 	struct cdev_privdata *p;
107 	int error;
108 
109 	fp = curthread->td_fpop;
110 	if (fp == NULL)
111 		return (EBADF);
112 	p = fp->f_cdevpriv;
113 	if (p != NULL) {
114 		error = 0;
115 		*datap = p->cdpd_data;
116 	} else
117 		error = ENOENT;
118 	return (error);
119 }
120 
121 int
122 devfs_set_cdevpriv(void *priv, cdevpriv_dtr_t priv_dtr)
123 {
124 	struct file *fp;
125 	struct cdev_priv *cdp;
126 	struct cdev_privdata *p;
127 	int error;
128 
129 	fp = curthread->td_fpop;
130 	if (fp == NULL)
131 		return (ENOENT);
132 	cdp = cdev2priv((struct cdev *)fp->f_data);
133 	p = malloc(sizeof(struct cdev_privdata), M_CDEVPDATA, M_WAITOK);
134 	p->cdpd_data = priv;
135 	p->cdpd_dtr = priv_dtr;
136 	p->cdpd_fp = fp;
137 	mtx_lock(&cdevpriv_mtx);
138 	if (fp->f_cdevpriv == NULL) {
139 		LIST_INSERT_HEAD(&cdp->cdp_fdpriv, p, cdpd_list);
140 		fp->f_cdevpriv = p;
141 		mtx_unlock(&cdevpriv_mtx);
142 		error = 0;
143 	} else {
144 		mtx_unlock(&cdevpriv_mtx);
145 		free(p, M_CDEVPDATA);
146 		error = EBUSY;
147 	}
148 	return (error);
149 }
150 
151 void
152 devfs_destroy_cdevpriv(struct cdev_privdata *p)
153 {
154 
155 	mtx_assert(&cdevpriv_mtx, MA_OWNED);
156 	p->cdpd_fp->f_cdevpriv = NULL;
157 	LIST_REMOVE(p, cdpd_list);
158 	mtx_unlock(&cdevpriv_mtx);
159 	(p->cdpd_dtr)(p->cdpd_data);
160 	free(p, M_CDEVPDATA);
161 }
162 
163 void
164 devfs_fpdrop(struct file *fp)
165 {
166 	struct cdev_privdata *p;
167 
168 	mtx_lock(&cdevpriv_mtx);
169 	if ((p = fp->f_cdevpriv) == NULL) {
170 		mtx_unlock(&cdevpriv_mtx);
171 		return;
172 	}
173 	devfs_destroy_cdevpriv(p);
174 }
175 
176 void
177 devfs_clear_cdevpriv(void)
178 {
179 	struct file *fp;
180 
181 	fp = curthread->td_fpop;
182 	if (fp == NULL)
183 		return;
184 	devfs_fpdrop(fp);
185 }
186 
187 /*
188  * On success devfs_populate_vp() returns with dmp->dm_lock held.
189  */
190 static int
191 devfs_populate_vp(struct vnode *vp)
192 {
193 	struct devfs_dirent *de;
194 	struct devfs_mount *dmp;
195 	int locked;
196 
197 	ASSERT_VOP_LOCKED(vp, "devfs_populate_vp");
198 
199 	dmp = VFSTODEVFS(vp->v_mount);
200 	locked = VOP_ISLOCKED(vp);
201 
202 	sx_xlock(&dmp->dm_lock);
203 	DEVFS_DMP_HOLD(dmp);
204 
205 	/* Can't call devfs_populate() with the vnode lock held. */
206 	VOP_UNLOCK(vp, 0);
207 	devfs_populate(dmp);
208 
209 	sx_xunlock(&dmp->dm_lock);
210 	vn_lock(vp, locked | LK_RETRY);
211 	sx_xlock(&dmp->dm_lock);
212 	if (DEVFS_DMP_DROP(dmp)) {
213 		sx_xunlock(&dmp->dm_lock);
214 		devfs_unmount_final(dmp);
215 		return (EBADF);
216 	}
217 	if ((vp->v_iflag & VI_DOOMED) != 0) {
218 		sx_xunlock(&dmp->dm_lock);
219 		return (EBADF);
220 	}
221 	de = vp->v_data;
222 	KASSERT(de != NULL,
223 	    ("devfs_populate_vp: vp->v_data == NULL but vnode not doomed"));
224 	if ((de->de_flags & DE_DOOMED) != 0) {
225 		sx_xunlock(&dmp->dm_lock);
226 		return (EBADF);
227 	}
228 
229 	return (0);
230 }
231 
232 static int
233 devfs_vptocnp(struct vop_vptocnp_args *ap)
234 {
235 	struct vnode *vp = ap->a_vp;
236 	struct vnode **dvp = ap->a_vpp;
237 	struct devfs_mount *dmp;
238 	char *buf = ap->a_buf;
239 	int *buflen = ap->a_buflen;
240 	struct devfs_dirent *dd, *de;
241 	int i, error;
242 
243 	dmp = VFSTODEVFS(vp->v_mount);
244 
245 	error = devfs_populate_vp(vp);
246 	if (error != 0)
247 		return (error);
248 
249 	i = *buflen;
250 	dd = vp->v_data;
251 
252 	if (vp->v_type == VCHR) {
253 		i -= strlen(dd->de_cdp->cdp_c.si_name);
254 		if (i < 0) {
255 			error = ENOMEM;
256 			goto finished;
257 		}
258 		bcopy(dd->de_cdp->cdp_c.si_name, buf + i,
259 		    strlen(dd->de_cdp->cdp_c.si_name));
260 		de = dd->de_dir;
261 	} else if (vp->v_type == VDIR) {
262 		if (dd == dmp->dm_rootdir) {
263 			*dvp = vp;
264 			vhold(*dvp);
265 			goto finished;
266 		}
267 		i -= dd->de_dirent->d_namlen;
268 		if (i < 0) {
269 			error = ENOMEM;
270 			goto finished;
271 		}
272 		bcopy(dd->de_dirent->d_name, buf + i,
273 		    dd->de_dirent->d_namlen);
274 		de = dd;
275 	} else {
276 		error = ENOENT;
277 		goto finished;
278 	}
279 	*buflen = i;
280 	de = devfs_parent_dirent(de);
281 	if (de == NULL) {
282 		error = ENOENT;
283 		goto finished;
284 	}
285 	mtx_lock(&devfs_de_interlock);
286 	*dvp = de->de_vnode;
287 	if (*dvp != NULL) {
288 		VI_LOCK(*dvp);
289 		mtx_unlock(&devfs_de_interlock);
290 		vholdl(*dvp);
291 		VI_UNLOCK(*dvp);
292 	} else {
293 		mtx_unlock(&devfs_de_interlock);
294 		error = ENOENT;
295 	}
296 finished:
297 	sx_xunlock(&dmp->dm_lock);
298 	return (error);
299 }
300 
301 /*
302  * Construct the fully qualified path name relative to the mountpoint.
303  * If a NULL cnp is provided, no '/' is appended to the resulting path.
304  */
305 char *
306 devfs_fqpn(char *buf, struct devfs_mount *dmp, struct devfs_dirent *dd,
307     struct componentname *cnp)
308 {
309 	int i;
310 	struct devfs_dirent *de;
311 
312 	sx_assert(&dmp->dm_lock, SA_LOCKED);
313 
314 	i = SPECNAMELEN;
315 	buf[i] = '\0';
316 	if (cnp != NULL)
317 		i -= cnp->cn_namelen;
318 	if (i < 0)
319 		 return (NULL);
320 	if (cnp != NULL)
321 		bcopy(cnp->cn_nameptr, buf + i, cnp->cn_namelen);
322 	de = dd;
323 	while (de != dmp->dm_rootdir) {
324 		if (cnp != NULL || i < SPECNAMELEN) {
325 			i--;
326 			if (i < 0)
327 				 return (NULL);
328 			buf[i] = '/';
329 		}
330 		i -= de->de_dirent->d_namlen;
331 		if (i < 0)
332 			 return (NULL);
333 		bcopy(de->de_dirent->d_name, buf + i,
334 		    de->de_dirent->d_namlen);
335 		de = devfs_parent_dirent(de);
336 		if (de == NULL)
337 			return (NULL);
338 	}
339 	return (buf + i);
340 }
341 
342 static int
343 devfs_allocv_drop_refs(int drop_dm_lock, struct devfs_mount *dmp,
344 	struct devfs_dirent *de)
345 {
346 	int not_found;
347 
348 	not_found = 0;
349 	if (de->de_flags & DE_DOOMED)
350 		not_found = 1;
351 	if (DEVFS_DE_DROP(de)) {
352 		KASSERT(not_found == 1, ("DEVFS de dropped but not doomed"));
353 		devfs_dirent_free(de);
354 	}
355 	if (DEVFS_DMP_DROP(dmp)) {
356 		KASSERT(not_found == 1,
357 			("DEVFS mount struct freed before dirent"));
358 		not_found = 2;
359 		sx_xunlock(&dmp->dm_lock);
360 		devfs_unmount_final(dmp);
361 	}
362 	if (not_found == 1 || (drop_dm_lock && not_found != 2))
363 		sx_unlock(&dmp->dm_lock);
364 	return (not_found);
365 }
366 
367 static void
368 devfs_insmntque_dtr(struct vnode *vp, void *arg)
369 {
370 	struct devfs_dirent *de;
371 
372 	de = (struct devfs_dirent *)arg;
373 	mtx_lock(&devfs_de_interlock);
374 	vp->v_data = NULL;
375 	de->de_vnode = NULL;
376 	mtx_unlock(&devfs_de_interlock);
377 	vgone(vp);
378 	vput(vp);
379 }
380 
381 /*
382  * devfs_allocv shall be entered with dmp->dm_lock held, and it drops
383  * it on return.
384  */
385 int
386 devfs_allocv(struct devfs_dirent *de, struct mount *mp, int lockmode,
387     struct vnode **vpp)
388 {
389 	int error;
390 	struct vnode *vp;
391 	struct cdev *dev;
392 	struct devfs_mount *dmp;
393 	struct cdevsw *dsw;
394 
395 	dmp = VFSTODEVFS(mp);
396 	if (de->de_flags & DE_DOOMED) {
397 		sx_xunlock(&dmp->dm_lock);
398 		return (ENOENT);
399 	}
400 loop:
401 	DEVFS_DE_HOLD(de);
402 	DEVFS_DMP_HOLD(dmp);
403 	mtx_lock(&devfs_de_interlock);
404 	vp = de->de_vnode;
405 	if (vp != NULL) {
406 		VI_LOCK(vp);
407 		mtx_unlock(&devfs_de_interlock);
408 		sx_xunlock(&dmp->dm_lock);
409 		vget(vp, lockmode | LK_INTERLOCK | LK_RETRY, curthread);
410 		sx_xlock(&dmp->dm_lock);
411 		if (devfs_allocv_drop_refs(0, dmp, de)) {
412 			vput(vp);
413 			return (ENOENT);
414 		}
415 		else if ((vp->v_iflag & VI_DOOMED) != 0) {
416 			mtx_lock(&devfs_de_interlock);
417 			if (de->de_vnode == vp) {
418 				de->de_vnode = NULL;
419 				vp->v_data = NULL;
420 			}
421 			mtx_unlock(&devfs_de_interlock);
422 			vput(vp);
423 			goto loop;
424 		}
425 		sx_xunlock(&dmp->dm_lock);
426 		*vpp = vp;
427 		return (0);
428 	}
429 	mtx_unlock(&devfs_de_interlock);
430 	if (de->de_dirent->d_type == DT_CHR) {
431 		if (!(de->de_cdp->cdp_flags & CDP_ACTIVE)) {
432 			devfs_allocv_drop_refs(1, dmp, de);
433 			return (ENOENT);
434 		}
435 		dev = &de->de_cdp->cdp_c;
436 	} else {
437 		dev = NULL;
438 	}
439 	error = getnewvnode("devfs", mp, &devfs_vnodeops, &vp);
440 	if (error != 0) {
441 		devfs_allocv_drop_refs(1, dmp, de);
442 		printf("devfs_allocv: failed to allocate new vnode\n");
443 		return (error);
444 	}
445 
446 	if (de->de_dirent->d_type == DT_CHR) {
447 		vp->v_type = VCHR;
448 		VI_LOCK(vp);
449 		dev_lock();
450 		dev_refl(dev);
451 		/* XXX: v_rdev should be protect by vnode lock */
452 		vp->v_rdev = dev;
453 		KASSERT(vp->v_usecount == 1,
454 		    ("%s %d (%d)\n", __func__, __LINE__, vp->v_usecount));
455 		dev->si_usecount += vp->v_usecount;
456 		/* Special casing of ttys for deadfs.  Probably redundant. */
457 		dsw = dev->si_devsw;
458 		if (dsw != NULL && (dsw->d_flags & D_TTY) != 0)
459 			vp->v_vflag |= VV_ISTTY;
460 		dev_unlock();
461 		VI_UNLOCK(vp);
462 		if ((dev->si_flags & SI_ETERNAL) != 0)
463 			vp->v_vflag |= VV_ETERNALDEV;
464 		vp->v_op = &devfs_specops;
465 	} else if (de->de_dirent->d_type == DT_DIR) {
466 		vp->v_type = VDIR;
467 	} else if (de->de_dirent->d_type == DT_LNK) {
468 		vp->v_type = VLNK;
469 	} else {
470 		vp->v_type = VBAD;
471 	}
472 	vn_lock(vp, LK_EXCLUSIVE | LK_RETRY | LK_NOWITNESS);
473 	VN_LOCK_ASHARE(vp);
474 	mtx_lock(&devfs_de_interlock);
475 	vp->v_data = de;
476 	de->de_vnode = vp;
477 	mtx_unlock(&devfs_de_interlock);
478 	error = insmntque1(vp, mp, devfs_insmntque_dtr, de);
479 	if (error != 0) {
480 		(void) devfs_allocv_drop_refs(1, dmp, de);
481 		return (error);
482 	}
483 	if (devfs_allocv_drop_refs(0, dmp, de)) {
484 		vput(vp);
485 		return (ENOENT);
486 	}
487 #ifdef MAC
488 	mac_devfs_vnode_associate(mp, de, vp);
489 #endif
490 	sx_xunlock(&dmp->dm_lock);
491 	*vpp = vp;
492 	return (0);
493 }
494 
495 static int
496 devfs_access(struct vop_access_args *ap)
497 {
498 	struct vnode *vp = ap->a_vp;
499 	struct devfs_dirent *de;
500 	int error;
501 
502 	de = vp->v_data;
503 	if (vp->v_type == VDIR)
504 		de = de->de_dir;
505 
506 	error = vaccess(vp->v_type, de->de_mode, de->de_uid, de->de_gid,
507 	    ap->a_accmode, ap->a_cred, NULL);
508 	if (error == 0)
509 		return (0);
510 	if (error != EACCES)
511 		return (error);
512 	/* We do, however, allow access to the controlling terminal */
513 	if (!(ap->a_td->td_proc->p_flag & P_CONTROLT))
514 		return (error);
515 	if (ap->a_td->td_proc->p_session->s_ttydp == de->de_cdp)
516 		return (0);
517 	return (error);
518 }
519 
520 /* ARGSUSED */
521 static int
522 devfs_close(struct vop_close_args *ap)
523 {
524 	struct vnode *vp = ap->a_vp, *oldvp;
525 	struct thread *td = ap->a_td;
526 	struct cdev *dev = vp->v_rdev;
527 	struct cdevsw *dsw;
528 	int vp_locked, error, ref;
529 
530 	/*
531 	 * XXX: Don't call d_close() if we were called because of
532 	 * XXX: insmntque1() failure.
533 	 */
534 	if (vp->v_data == NULL)
535 		return (0);
536 
537 	/*
538 	 * Hack: a tty device that is a controlling terminal
539 	 * has a reference from the session structure.
540 	 * We cannot easily tell that a character device is
541 	 * a controlling terminal, unless it is the closing
542 	 * process' controlling terminal.  In that case,
543 	 * if the reference count is 2 (this last descriptor
544 	 * plus the session), release the reference from the session.
545 	 */
546 	oldvp = NULL;
547 	sx_xlock(&proctree_lock);
548 	if (td && vp == td->td_proc->p_session->s_ttyvp) {
549 		SESS_LOCK(td->td_proc->p_session);
550 		VI_LOCK(vp);
551 		if (count_dev(dev) == 2 && (vp->v_iflag & VI_DOOMED) == 0) {
552 			td->td_proc->p_session->s_ttyvp = NULL;
553 			td->td_proc->p_session->s_ttydp = NULL;
554 			oldvp = vp;
555 		}
556 		VI_UNLOCK(vp);
557 		SESS_UNLOCK(td->td_proc->p_session);
558 	}
559 	sx_xunlock(&proctree_lock);
560 	if (oldvp != NULL)
561 		vrele(oldvp);
562 	/*
563 	 * We do not want to really close the device if it
564 	 * is still in use unless we are trying to close it
565 	 * forcibly. Since every use (buffer, vnode, swap, cmap)
566 	 * holds a reference to the vnode, and because we mark
567 	 * any other vnodes that alias this device, when the
568 	 * sum of the reference counts on all the aliased
569 	 * vnodes descends to one, we are on last close.
570 	 */
571 	dsw = dev_refthread(dev, &ref);
572 	if (dsw == NULL)
573 		return (ENXIO);
574 	VI_LOCK(vp);
575 	if (vp->v_iflag & VI_DOOMED) {
576 		/* Forced close. */
577 	} else if (dsw->d_flags & D_TRACKCLOSE) {
578 		/* Keep device updated on status. */
579 	} else if (count_dev(dev) > 1) {
580 		VI_UNLOCK(vp);
581 		dev_relthread(dev, ref);
582 		return (0);
583 	}
584 	vholdl(vp);
585 	VI_UNLOCK(vp);
586 	vp_locked = VOP_ISLOCKED(vp);
587 	VOP_UNLOCK(vp, 0);
588 	KASSERT(dev->si_refcount > 0,
589 	    ("devfs_close() on un-referenced struct cdev *(%s)", devtoname(dev)));
590 	error = dsw->d_close(dev, ap->a_fflag, S_IFCHR, td);
591 	dev_relthread(dev, ref);
592 	vn_lock(vp, vp_locked | LK_RETRY);
593 	vdrop(vp);
594 	return (error);
595 }
596 
597 static int
598 devfs_close_f(struct file *fp, struct thread *td)
599 {
600 	int error;
601 	struct file *fpop;
602 
603 	fpop = td->td_fpop;
604 	td->td_fpop = fp;
605 	error = vnops.fo_close(fp, td);
606 	td->td_fpop = fpop;
607 	return (error);
608 }
609 
610 static int
611 devfs_fsync(struct vop_fsync_args *ap)
612 {
613 	int error;
614 	struct bufobj *bo;
615 	struct devfs_dirent *de;
616 
617 	if (!vn_isdisk(ap->a_vp, &error)) {
618 		bo = &ap->a_vp->v_bufobj;
619 		de = ap->a_vp->v_data;
620 		if (error == ENXIO && bo->bo_dirty.bv_cnt > 0) {
621 			printf("Device %s went missing before all of the data "
622 			    "could be written to it; expect data loss.\n",
623 			    de->de_dirent->d_name);
624 
625 			error = vop_stdfsync(ap);
626 			if (bo->bo_dirty.bv_cnt != 0 || error != 0)
627 				panic("devfs_fsync: vop_stdfsync failed.");
628 		}
629 
630 		return (0);
631 	}
632 
633 	return (vop_stdfsync(ap));
634 }
635 
636 static int
637 devfs_getattr(struct vop_getattr_args *ap)
638 {
639 	struct vnode *vp = ap->a_vp;
640 	struct vattr *vap = ap->a_vap;
641 	int error;
642 	struct devfs_dirent *de;
643 	struct devfs_mount *dmp;
644 	struct cdev *dev;
645 
646 	error = devfs_populate_vp(vp);
647 	if (error != 0)
648 		return (error);
649 
650 	dmp = VFSTODEVFS(vp->v_mount);
651 	sx_xunlock(&dmp->dm_lock);
652 
653 	de = vp->v_data;
654 	KASSERT(de != NULL, ("Null dirent in devfs_getattr vp=%p", vp));
655 	if (vp->v_type == VDIR) {
656 		de = de->de_dir;
657 		KASSERT(de != NULL,
658 		    ("Null dir dirent in devfs_getattr vp=%p", vp));
659 	}
660 	vap->va_uid = de->de_uid;
661 	vap->va_gid = de->de_gid;
662 	vap->va_mode = de->de_mode;
663 	if (vp->v_type == VLNK)
664 		vap->va_size = strlen(de->de_symlink);
665 	else if (vp->v_type == VDIR)
666 		vap->va_size = vap->va_bytes = DEV_BSIZE;
667 	else
668 		vap->va_size = 0;
669 	if (vp->v_type != VDIR)
670 		vap->va_bytes = 0;
671 	vap->va_blocksize = DEV_BSIZE;
672 	vap->va_type = vp->v_type;
673 
674 #define fix(aa)							\
675 	do {							\
676 		if ((aa).tv_sec <= 3600) {			\
677 			(aa).tv_sec = boottime.tv_sec;		\
678 			(aa).tv_nsec = boottime.tv_usec * 1000; \
679 		}						\
680 	} while (0)
681 
682 	if (vp->v_type != VCHR)  {
683 		fix(de->de_atime);
684 		vap->va_atime = de->de_atime;
685 		fix(de->de_mtime);
686 		vap->va_mtime = de->de_mtime;
687 		fix(de->de_ctime);
688 		vap->va_ctime = de->de_ctime;
689 	} else {
690 		dev = vp->v_rdev;
691 		fix(dev->si_atime);
692 		vap->va_atime = dev->si_atime;
693 		fix(dev->si_mtime);
694 		vap->va_mtime = dev->si_mtime;
695 		fix(dev->si_ctime);
696 		vap->va_ctime = dev->si_ctime;
697 
698 		vap->va_rdev = cdev2priv(dev)->cdp_inode;
699 	}
700 	vap->va_gen = 0;
701 	vap->va_flags = 0;
702 	vap->va_filerev = 0;
703 	vap->va_nlink = de->de_links;
704 	vap->va_fileid = de->de_inode;
705 
706 	return (error);
707 }
708 
709 /* ARGSUSED */
710 static int
711 devfs_ioctl_f(struct file *fp, u_long com, void *data, struct ucred *cred, struct thread *td)
712 {
713 	struct cdev *dev;
714 	struct cdevsw *dsw;
715 	struct vnode *vp;
716 	struct vnode *vpold;
717 	int error, i, ref;
718 	const char *p;
719 	struct fiodgname_arg *fgn;
720 	struct file *fpop;
721 
722 	fpop = td->td_fpop;
723 	error = devfs_fp_check(fp, &dev, &dsw, &ref);
724 	if (error)
725 		return (error);
726 
727 	if (com == FIODTYPE) {
728 		*(int *)data = dsw->d_flags & D_TYPEMASK;
729 		td->td_fpop = fpop;
730 		dev_relthread(dev, ref);
731 		return (0);
732 	} else if (com == FIODGNAME) {
733 		fgn = data;
734 		p = devtoname(dev);
735 		i = strlen(p) + 1;
736 		if (i > fgn->len)
737 			error = EINVAL;
738 		else
739 			error = copyout(p, fgn->buf, i);
740 		td->td_fpop = fpop;
741 		dev_relthread(dev, ref);
742 		return (error);
743 	}
744 	error = dsw->d_ioctl(dev, com, data, fp->f_flag, td);
745 	td->td_fpop = NULL;
746 	dev_relthread(dev, ref);
747 	if (error == ENOIOCTL)
748 		error = ENOTTY;
749 	if (error == 0 && com == TIOCSCTTY) {
750 		vp = fp->f_vnode;
751 
752 		/* Do nothing if reassigning same control tty */
753 		sx_slock(&proctree_lock);
754 		if (td->td_proc->p_session->s_ttyvp == vp) {
755 			sx_sunlock(&proctree_lock);
756 			return (0);
757 		}
758 
759 		vpold = td->td_proc->p_session->s_ttyvp;
760 		VREF(vp);
761 		SESS_LOCK(td->td_proc->p_session);
762 		td->td_proc->p_session->s_ttyvp = vp;
763 		td->td_proc->p_session->s_ttydp = cdev2priv(dev);
764 		SESS_UNLOCK(td->td_proc->p_session);
765 
766 		sx_sunlock(&proctree_lock);
767 
768 		/* Get rid of reference to old control tty */
769 		if (vpold)
770 			vrele(vpold);
771 	}
772 	return (error);
773 }
774 
775 /* ARGSUSED */
776 static int
777 devfs_kqfilter_f(struct file *fp, struct knote *kn)
778 {
779 	struct cdev *dev;
780 	struct cdevsw *dsw;
781 	int error, ref;
782 	struct file *fpop;
783 	struct thread *td;
784 
785 	td = curthread;
786 	fpop = td->td_fpop;
787 	error = devfs_fp_check(fp, &dev, &dsw, &ref);
788 	if (error)
789 		return (error);
790 	error = dsw->d_kqfilter(dev, kn);
791 	td->td_fpop = fpop;
792 	dev_relthread(dev, ref);
793 	return (error);
794 }
795 
796 static inline int
797 devfs_prison_check(struct devfs_dirent *de, struct thread *td)
798 {
799 	struct cdev_priv *cdp;
800 	struct ucred *dcr;
801 	int error;
802 
803 	cdp = de->de_cdp;
804 	if (cdp == NULL)
805 		return (0);
806 	dcr = cdp->cdp_c.si_cred;
807 	if (dcr == NULL)
808 		return (0);
809 
810 	error = prison_check(td->td_ucred, dcr);
811 	if (error == 0)
812 		return (0);
813 	/* We do, however, allow access to the controlling terminal */
814 	if (!(td->td_proc->p_flag & P_CONTROLT))
815 		return (error);
816 	if (td->td_proc->p_session->s_ttydp == cdp)
817 		return (0);
818 	return (error);
819 }
820 
821 static int
822 devfs_lookupx(struct vop_lookup_args *ap, int *dm_unlock)
823 {
824 	struct componentname *cnp;
825 	struct vnode *dvp, **vpp;
826 	struct thread *td;
827 	struct devfs_dirent *de, *dd;
828 	struct devfs_dirent **dde;
829 	struct devfs_mount *dmp;
830 	struct cdev *cdev;
831 	int error, flags, nameiop, dvplocked;
832 	char specname[SPECNAMELEN + 1], *pname;
833 
834 	cnp = ap->a_cnp;
835 	vpp = ap->a_vpp;
836 	dvp = ap->a_dvp;
837 	pname = cnp->cn_nameptr;
838 	td = cnp->cn_thread;
839 	flags = cnp->cn_flags;
840 	nameiop = cnp->cn_nameiop;
841 	dmp = VFSTODEVFS(dvp->v_mount);
842 	dd = dvp->v_data;
843 	*vpp = NULLVP;
844 
845 	if ((flags & ISLASTCN) && nameiop == RENAME)
846 		return (EOPNOTSUPP);
847 
848 	if (dvp->v_type != VDIR)
849 		return (ENOTDIR);
850 
851 	if ((flags & ISDOTDOT) && (dvp->v_vflag & VV_ROOT))
852 		return (EIO);
853 
854 	error = VOP_ACCESS(dvp, VEXEC, cnp->cn_cred, td);
855 	if (error)
856 		return (error);
857 
858 	if (cnp->cn_namelen == 1 && *pname == '.') {
859 		if ((flags & ISLASTCN) && nameiop != LOOKUP)
860 			return (EINVAL);
861 		*vpp = dvp;
862 		VREF(dvp);
863 		return (0);
864 	}
865 
866 	if (flags & ISDOTDOT) {
867 		if ((flags & ISLASTCN) && nameiop != LOOKUP)
868 			return (EINVAL);
869 		de = devfs_parent_dirent(dd);
870 		if (de == NULL)
871 			return (ENOENT);
872 		dvplocked = VOP_ISLOCKED(dvp);
873 		VOP_UNLOCK(dvp, 0);
874 		error = devfs_allocv(de, dvp->v_mount,
875 		    cnp->cn_lkflags & LK_TYPE_MASK, vpp);
876 		*dm_unlock = 0;
877 		vn_lock(dvp, dvplocked | LK_RETRY);
878 		return (error);
879 	}
880 
881 	dd = dvp->v_data;
882 	de = devfs_find(dd, cnp->cn_nameptr, cnp->cn_namelen, 0);
883 	while (de == NULL) {	/* While(...) so we can use break */
884 
885 		if (nameiop == DELETE)
886 			return (ENOENT);
887 
888 		/*
889 		 * OK, we didn't have an entry for the name we were asked for
890 		 * so we try to see if anybody can create it on demand.
891 		 */
892 		pname = devfs_fqpn(specname, dmp, dd, cnp);
893 		if (pname == NULL)
894 			break;
895 
896 		cdev = NULL;
897 		DEVFS_DMP_HOLD(dmp);
898 		sx_xunlock(&dmp->dm_lock);
899 		sx_slock(&clone_drain_lock);
900 		EVENTHANDLER_INVOKE(dev_clone,
901 		    td->td_ucred, pname, strlen(pname), &cdev);
902 		sx_sunlock(&clone_drain_lock);
903 
904 		if (cdev == NULL)
905 			sx_xlock(&dmp->dm_lock);
906 		else if (devfs_populate_vp(dvp) != 0) {
907 			*dm_unlock = 0;
908 			sx_xlock(&dmp->dm_lock);
909 			if (DEVFS_DMP_DROP(dmp)) {
910 				sx_xunlock(&dmp->dm_lock);
911 				devfs_unmount_final(dmp);
912 			} else
913 				sx_xunlock(&dmp->dm_lock);
914 			dev_rel(cdev);
915 			return (ENOENT);
916 		}
917 		if (DEVFS_DMP_DROP(dmp)) {
918 			*dm_unlock = 0;
919 			sx_xunlock(&dmp->dm_lock);
920 			devfs_unmount_final(dmp);
921 			if (cdev != NULL)
922 				dev_rel(cdev);
923 			return (ENOENT);
924 		}
925 
926 		if (cdev == NULL)
927 			break;
928 
929 		dev_lock();
930 		dde = &cdev2priv(cdev)->cdp_dirents[dmp->dm_idx];
931 		if (dde != NULL && *dde != NULL)
932 			de = *dde;
933 		dev_unlock();
934 		dev_rel(cdev);
935 		break;
936 	}
937 
938 	if (de == NULL || de->de_flags & DE_WHITEOUT) {
939 		if ((nameiop == CREATE || nameiop == RENAME) &&
940 		    (flags & (LOCKPARENT | WANTPARENT)) && (flags & ISLASTCN)) {
941 			cnp->cn_flags |= SAVENAME;
942 			return (EJUSTRETURN);
943 		}
944 		return (ENOENT);
945 	}
946 
947 	if (devfs_prison_check(de, td))
948 		return (ENOENT);
949 
950 	if ((cnp->cn_nameiop == DELETE) && (flags & ISLASTCN)) {
951 		error = VOP_ACCESS(dvp, VWRITE, cnp->cn_cred, td);
952 		if (error)
953 			return (error);
954 		if (*vpp == dvp) {
955 			VREF(dvp);
956 			*vpp = dvp;
957 			return (0);
958 		}
959 	}
960 	error = devfs_allocv(de, dvp->v_mount, cnp->cn_lkflags & LK_TYPE_MASK,
961 	    vpp);
962 	*dm_unlock = 0;
963 	return (error);
964 }
965 
966 static int
967 devfs_lookup(struct vop_lookup_args *ap)
968 {
969 	int j;
970 	struct devfs_mount *dmp;
971 	int dm_unlock;
972 
973 	if (devfs_populate_vp(ap->a_dvp) != 0)
974 		return (ENOTDIR);
975 
976 	dmp = VFSTODEVFS(ap->a_dvp->v_mount);
977 	dm_unlock = 1;
978 	j = devfs_lookupx(ap, &dm_unlock);
979 	if (dm_unlock == 1)
980 		sx_xunlock(&dmp->dm_lock);
981 	return (j);
982 }
983 
984 static int
985 devfs_mknod(struct vop_mknod_args *ap)
986 {
987 	struct componentname *cnp;
988 	struct vnode *dvp, **vpp;
989 	struct devfs_dirent *dd, *de;
990 	struct devfs_mount *dmp;
991 	int error;
992 
993 	/*
994 	 * The only type of node we should be creating here is a
995 	 * character device, for anything else return EOPNOTSUPP.
996 	 */
997 	if (ap->a_vap->va_type != VCHR)
998 		return (EOPNOTSUPP);
999 	dvp = ap->a_dvp;
1000 	dmp = VFSTODEVFS(dvp->v_mount);
1001 
1002 	cnp = ap->a_cnp;
1003 	vpp = ap->a_vpp;
1004 	dd = dvp->v_data;
1005 
1006 	error = ENOENT;
1007 	sx_xlock(&dmp->dm_lock);
1008 	TAILQ_FOREACH(de, &dd->de_dlist, de_list) {
1009 		if (cnp->cn_namelen != de->de_dirent->d_namlen)
1010 			continue;
1011 		if (bcmp(cnp->cn_nameptr, de->de_dirent->d_name,
1012 		    de->de_dirent->d_namlen) != 0)
1013 			continue;
1014 		if (de->de_flags & DE_WHITEOUT)
1015 			break;
1016 		goto notfound;
1017 	}
1018 	if (de == NULL)
1019 		goto notfound;
1020 	de->de_flags &= ~DE_WHITEOUT;
1021 	error = devfs_allocv(de, dvp->v_mount, LK_EXCLUSIVE, vpp);
1022 	return (error);
1023 notfound:
1024 	sx_xunlock(&dmp->dm_lock);
1025 	return (error);
1026 }
1027 
1028 /* ARGSUSED */
1029 static int
1030 devfs_open(struct vop_open_args *ap)
1031 {
1032 	struct thread *td = ap->a_td;
1033 	struct vnode *vp = ap->a_vp;
1034 	struct cdev *dev = vp->v_rdev;
1035 	struct file *fp = ap->a_fp;
1036 	int error, ref, vlocked;
1037 	struct cdevsw *dsw;
1038 	struct file *fpop;
1039 
1040 	if (vp->v_type == VBLK)
1041 		return (ENXIO);
1042 
1043 	if (dev == NULL)
1044 		return (ENXIO);
1045 
1046 	/* Make this field valid before any I/O in d_open. */
1047 	if (dev->si_iosize_max == 0)
1048 		dev->si_iosize_max = DFLTPHYS;
1049 
1050 	dsw = dev_refthread(dev, &ref);
1051 	if (dsw == NULL)
1052 		return (ENXIO);
1053 
1054 	vlocked = VOP_ISLOCKED(vp);
1055 	VOP_UNLOCK(vp, 0);
1056 
1057 	fpop = td->td_fpop;
1058 	td->td_fpop = fp;
1059 	if (fp != NULL) {
1060 		fp->f_data = dev;
1061 		fp->f_vnode = vp;
1062 	}
1063 	if (dsw->d_fdopen != NULL)
1064 		error = dsw->d_fdopen(dev, ap->a_mode, td, fp);
1065 	else
1066 		error = dsw->d_open(dev, ap->a_mode, S_IFCHR, td);
1067 	td->td_fpop = fpop;
1068 
1069 	vn_lock(vp, vlocked | LK_RETRY);
1070 	dev_relthread(dev, ref);
1071 	if (error)
1072 		return (error);
1073 
1074 #if 0	/* /dev/console */
1075 	KASSERT(fp != NULL, ("Could not vnode bypass device on NULL fp"));
1076 #else
1077 	if (fp == NULL)
1078 		return (error);
1079 #endif
1080 	if (fp->f_ops == &badfileops)
1081 		finit(fp, fp->f_flag, DTYPE_VNODE, dev, &devfs_ops_f);
1082 	return (error);
1083 }
1084 
1085 static int
1086 devfs_pathconf(struct vop_pathconf_args *ap)
1087 {
1088 
1089 	switch (ap->a_name) {
1090 	case _PC_MAC_PRESENT:
1091 #ifdef MAC
1092 		/*
1093 		 * If MAC is enabled, devfs automatically supports
1094 		 * trivial non-persistant label storage.
1095 		 */
1096 		*ap->a_retval = 1;
1097 #else
1098 		*ap->a_retval = 0;
1099 #endif
1100 		return (0);
1101 	default:
1102 		return (vop_stdpathconf(ap));
1103 	}
1104 	/* NOTREACHED */
1105 }
1106 
1107 /* ARGSUSED */
1108 static int
1109 devfs_poll_f(struct file *fp, int events, struct ucred *cred, struct thread *td)
1110 {
1111 	struct cdev *dev;
1112 	struct cdevsw *dsw;
1113 	int error, ref;
1114 	struct file *fpop;
1115 
1116 	fpop = td->td_fpop;
1117 	error = devfs_fp_check(fp, &dev, &dsw, &ref);
1118 	if (error)
1119 		return (poll_no_poll(events));
1120 	error = dsw->d_poll(dev, events, td);
1121 	td->td_fpop = fpop;
1122 	dev_relthread(dev, ref);
1123 	return(error);
1124 }
1125 
1126 /*
1127  * Print out the contents of a special device vnode.
1128  */
1129 static int
1130 devfs_print(struct vop_print_args *ap)
1131 {
1132 
1133 	printf("\tdev %s\n", devtoname(ap->a_vp->v_rdev));
1134 	return (0);
1135 }
1136 
1137 /* ARGSUSED */
1138 static int
1139 devfs_read_f(struct file *fp, struct uio *uio, struct ucred *cred, int flags, struct thread *td)
1140 {
1141 	struct cdev *dev;
1142 	int ioflag, error, ref, resid;
1143 	struct cdevsw *dsw;
1144 	struct file *fpop;
1145 
1146 	fpop = td->td_fpop;
1147 	error = devfs_fp_check(fp, &dev, &dsw, &ref);
1148 	if (error)
1149 		return (error);
1150 	resid = uio->uio_resid;
1151 	ioflag = fp->f_flag & (O_NONBLOCK | O_DIRECT);
1152 	if (ioflag & O_DIRECT)
1153 		ioflag |= IO_DIRECT;
1154 
1155 	if ((flags & FOF_OFFSET) == 0)
1156 		uio->uio_offset = fp->f_offset;
1157 
1158 	error = dsw->d_read(dev, uio, ioflag);
1159 	if (uio->uio_resid != resid || (error == 0 && resid != 0))
1160 		vfs_timestamp(&dev->si_atime);
1161 	td->td_fpop = fpop;
1162 	dev_relthread(dev, ref);
1163 
1164 	if ((flags & FOF_OFFSET) == 0)
1165 		fp->f_offset = uio->uio_offset;
1166 	fp->f_nextoff = uio->uio_offset;
1167 	return (error);
1168 }
1169 
1170 static int
1171 devfs_readdir(struct vop_readdir_args *ap)
1172 {
1173 	int error;
1174 	struct uio *uio;
1175 	struct dirent *dp;
1176 	struct devfs_dirent *dd;
1177 	struct devfs_dirent *de;
1178 	struct devfs_mount *dmp;
1179 	off_t off;
1180 	int *tmp_ncookies = NULL;
1181 
1182 	if (ap->a_vp->v_type != VDIR)
1183 		return (ENOTDIR);
1184 
1185 	uio = ap->a_uio;
1186 	if (uio->uio_offset < 0)
1187 		return (EINVAL);
1188 
1189 	/*
1190 	 * XXX: This is a temporary hack to get around this filesystem not
1191 	 * supporting cookies. We store the location of the ncookies pointer
1192 	 * in a temporary variable before calling vfs_subr.c:vfs_read_dirent()
1193 	 * and set the number of cookies to 0. We then set the pointer to
1194 	 * NULL so that vfs_read_dirent doesn't try to call realloc() on
1195 	 * ap->a_cookies. Later in this function, we restore the ap->a_ncookies
1196 	 * pointer to its original location before returning to the caller.
1197 	 */
1198 	if (ap->a_ncookies != NULL) {
1199 		tmp_ncookies = ap->a_ncookies;
1200 		*ap->a_ncookies = 0;
1201 		ap->a_ncookies = NULL;
1202 	}
1203 
1204 	dmp = VFSTODEVFS(ap->a_vp->v_mount);
1205 	if (devfs_populate_vp(ap->a_vp) != 0) {
1206 		if (tmp_ncookies != NULL)
1207 			ap->a_ncookies = tmp_ncookies;
1208 		return (EIO);
1209 	}
1210 	error = 0;
1211 	de = ap->a_vp->v_data;
1212 	off = 0;
1213 	TAILQ_FOREACH(dd, &de->de_dlist, de_list) {
1214 		KASSERT(dd->de_cdp != (void *)0xdeadc0de, ("%s %d\n", __func__, __LINE__));
1215 		if (dd->de_flags & (DE_COVERED | DE_WHITEOUT))
1216 			continue;
1217 		if (devfs_prison_check(dd, uio->uio_td))
1218 			continue;
1219 		if (dd->de_dirent->d_type == DT_DIR)
1220 			de = dd->de_dir;
1221 		else
1222 			de = dd;
1223 		dp = dd->de_dirent;
1224 		if (dp->d_reclen > uio->uio_resid)
1225 			break;
1226 		dp->d_fileno = de->de_inode;
1227 		if (off >= uio->uio_offset) {
1228 			error = vfs_read_dirent(ap, dp, off);
1229 			if (error)
1230 				break;
1231 		}
1232 		off += dp->d_reclen;
1233 	}
1234 	sx_xunlock(&dmp->dm_lock);
1235 	uio->uio_offset = off;
1236 
1237 	/*
1238 	 * Restore ap->a_ncookies if it wasn't originally NULL in the first
1239 	 * place.
1240 	 */
1241 	if (tmp_ncookies != NULL)
1242 		ap->a_ncookies = tmp_ncookies;
1243 
1244 	return (error);
1245 }
1246 
1247 static int
1248 devfs_readlink(struct vop_readlink_args *ap)
1249 {
1250 	struct devfs_dirent *de;
1251 
1252 	de = ap->a_vp->v_data;
1253 	return (uiomove(de->de_symlink, strlen(de->de_symlink), ap->a_uio));
1254 }
1255 
1256 static int
1257 devfs_reclaim(struct vop_reclaim_args *ap)
1258 {
1259 	struct vnode *vp = ap->a_vp;
1260 	struct devfs_dirent *de;
1261 	struct cdev *dev;
1262 
1263 	mtx_lock(&devfs_de_interlock);
1264 	de = vp->v_data;
1265 	if (de != NULL) {
1266 		de->de_vnode = NULL;
1267 		vp->v_data = NULL;
1268 	}
1269 	mtx_unlock(&devfs_de_interlock);
1270 
1271 	vnode_destroy_vobject(vp);
1272 
1273 	VI_LOCK(vp);
1274 	dev_lock();
1275 	dev = vp->v_rdev;
1276 	vp->v_rdev = NULL;
1277 
1278 	if (dev == NULL) {
1279 		dev_unlock();
1280 		VI_UNLOCK(vp);
1281 		return (0);
1282 	}
1283 
1284 	dev->si_usecount -= vp->v_usecount;
1285 	dev_unlock();
1286 	VI_UNLOCK(vp);
1287 	dev_rel(dev);
1288 	return (0);
1289 }
1290 
1291 static int
1292 devfs_remove(struct vop_remove_args *ap)
1293 {
1294 	struct vnode *dvp = ap->a_dvp;
1295 	struct vnode *vp = ap->a_vp;
1296 	struct devfs_dirent *dd;
1297 	struct devfs_dirent *de, *de_covered;
1298 	struct devfs_mount *dmp = VFSTODEVFS(vp->v_mount);
1299 
1300 	ASSERT_VOP_ELOCKED(dvp, "devfs_remove");
1301 	ASSERT_VOP_ELOCKED(vp, "devfs_remove");
1302 
1303 	sx_xlock(&dmp->dm_lock);
1304 	dd = ap->a_dvp->v_data;
1305 	de = vp->v_data;
1306 	if (de->de_cdp == NULL) {
1307 		TAILQ_REMOVE(&dd->de_dlist, de, de_list);
1308 		if (de->de_dirent->d_type == DT_LNK) {
1309 			de_covered = devfs_find(dd, de->de_dirent->d_name,
1310 			    de->de_dirent->d_namlen, 0);
1311 			if (de_covered != NULL)
1312 				de_covered->de_flags &= ~DE_COVERED;
1313 		}
1314 		/* We need to unlock dvp because devfs_delete() may lock it. */
1315 		VOP_UNLOCK(vp, 0);
1316 		if (dvp != vp)
1317 			VOP_UNLOCK(dvp, 0);
1318 		devfs_delete(dmp, de, 0);
1319 		sx_xunlock(&dmp->dm_lock);
1320 		if (dvp != vp)
1321 			vn_lock(dvp, LK_EXCLUSIVE | LK_RETRY);
1322 		vn_lock(vp, LK_EXCLUSIVE | LK_RETRY);
1323 	} else {
1324 		de->de_flags |= DE_WHITEOUT;
1325 		sx_xunlock(&dmp->dm_lock);
1326 	}
1327 	return (0);
1328 }
1329 
1330 /*
1331  * Revoke is called on a tty when a terminal session ends.  The vnode
1332  * is orphaned by setting v_op to deadfs so we need to let go of it
1333  * as well so that we create a new one next time around.
1334  *
1335  */
1336 static int
1337 devfs_revoke(struct vop_revoke_args *ap)
1338 {
1339 	struct vnode *vp = ap->a_vp, *vp2;
1340 	struct cdev *dev;
1341 	struct cdev_priv *cdp;
1342 	struct devfs_dirent *de;
1343 	int i;
1344 
1345 	KASSERT((ap->a_flags & REVOKEALL) != 0, ("devfs_revoke !REVOKEALL"));
1346 
1347 	dev = vp->v_rdev;
1348 	cdp = cdev2priv(dev);
1349 
1350 	dev_lock();
1351 	cdp->cdp_inuse++;
1352 	dev_unlock();
1353 
1354 	vhold(vp);
1355 	vgone(vp);
1356 	vdrop(vp);
1357 
1358 	VOP_UNLOCK(vp,0);
1359  loop:
1360 	for (;;) {
1361 		mtx_lock(&devfs_de_interlock);
1362 		dev_lock();
1363 		vp2 = NULL;
1364 		for (i = 0; i <= cdp->cdp_maxdirent; i++) {
1365 			de = cdp->cdp_dirents[i];
1366 			if (de == NULL)
1367 				continue;
1368 
1369 			vp2 = de->de_vnode;
1370 			if (vp2 != NULL) {
1371 				dev_unlock();
1372 				VI_LOCK(vp2);
1373 				mtx_unlock(&devfs_de_interlock);
1374 				if (vget(vp2, LK_EXCLUSIVE | LK_INTERLOCK,
1375 				    curthread))
1376 					goto loop;
1377 				vhold(vp2);
1378 				vgone(vp2);
1379 				vdrop(vp2);
1380 				vput(vp2);
1381 				break;
1382 			}
1383 		}
1384 		if (vp2 != NULL) {
1385 			continue;
1386 		}
1387 		dev_unlock();
1388 		mtx_unlock(&devfs_de_interlock);
1389 		break;
1390 	}
1391 	dev_lock();
1392 	cdp->cdp_inuse--;
1393 	if (!(cdp->cdp_flags & CDP_ACTIVE) && cdp->cdp_inuse == 0) {
1394 		TAILQ_REMOVE(&cdevp_list, cdp, cdp_list);
1395 		dev_unlock();
1396 		dev_rel(&cdp->cdp_c);
1397 	} else
1398 		dev_unlock();
1399 
1400 	vn_lock(vp, LK_EXCLUSIVE | LK_RETRY);
1401 	return (0);
1402 }
1403 
1404 static int
1405 devfs_rioctl(struct vop_ioctl_args *ap)
1406 {
1407 	struct vnode *vp;
1408 	struct devfs_mount *dmp;
1409 	int error;
1410 
1411 	vp = ap->a_vp;
1412 	vn_lock(vp, LK_SHARED | LK_RETRY);
1413 	if (vp->v_iflag & VI_DOOMED) {
1414 		VOP_UNLOCK(vp, 0);
1415 		return (EBADF);
1416 	}
1417 	dmp = VFSTODEVFS(vp->v_mount);
1418 	sx_xlock(&dmp->dm_lock);
1419 	VOP_UNLOCK(vp, 0);
1420 	DEVFS_DMP_HOLD(dmp);
1421 	devfs_populate(dmp);
1422 	if (DEVFS_DMP_DROP(dmp)) {
1423 		sx_xunlock(&dmp->dm_lock);
1424 		devfs_unmount_final(dmp);
1425 		return (ENOENT);
1426 	}
1427 	error = devfs_rules_ioctl(dmp, ap->a_command, ap->a_data, ap->a_td);
1428 	sx_xunlock(&dmp->dm_lock);
1429 	return (error);
1430 }
1431 
1432 static int
1433 devfs_rread(struct vop_read_args *ap)
1434 {
1435 
1436 	if (ap->a_vp->v_type != VDIR)
1437 		return (EINVAL);
1438 	return (VOP_READDIR(ap->a_vp, ap->a_uio, ap->a_cred, NULL, NULL, NULL));
1439 }
1440 
1441 static int
1442 devfs_setattr(struct vop_setattr_args *ap)
1443 {
1444 	struct devfs_dirent *de;
1445 	struct vattr *vap;
1446 	struct vnode *vp;
1447 	struct thread *td;
1448 	int c, error;
1449 	uid_t uid;
1450 	gid_t gid;
1451 
1452 	vap = ap->a_vap;
1453 	vp = ap->a_vp;
1454 	td = curthread;
1455 	if ((vap->va_type != VNON) ||
1456 	    (vap->va_nlink != VNOVAL) ||
1457 	    (vap->va_fsid != VNOVAL) ||
1458 	    (vap->va_fileid != VNOVAL) ||
1459 	    (vap->va_blocksize != VNOVAL) ||
1460 	    (vap->va_flags != VNOVAL && vap->va_flags != 0) ||
1461 	    (vap->va_rdev != VNOVAL) ||
1462 	    ((int)vap->va_bytes != VNOVAL) ||
1463 	    (vap->va_gen != VNOVAL)) {
1464 		return (EINVAL);
1465 	}
1466 
1467 	de = vp->v_data;
1468 	if (vp->v_type == VDIR)
1469 		de = de->de_dir;
1470 
1471 	error = c = 0;
1472 	if (vap->va_uid == (uid_t)VNOVAL)
1473 		uid = de->de_uid;
1474 	else
1475 		uid = vap->va_uid;
1476 	if (vap->va_gid == (gid_t)VNOVAL)
1477 		gid = de->de_gid;
1478 	else
1479 		gid = vap->va_gid;
1480 	if (uid != de->de_uid || gid != de->de_gid) {
1481 		if ((ap->a_cred->cr_uid != de->de_uid) || uid != de->de_uid ||
1482 		    (gid != de->de_gid && !groupmember(gid, ap->a_cred))) {
1483 			error = priv_check(td, PRIV_VFS_CHOWN);
1484 			if (error)
1485 				return (error);
1486 		}
1487 		de->de_uid = uid;
1488 		de->de_gid = gid;
1489 		c = 1;
1490 	}
1491 
1492 	if (vap->va_mode != (mode_t)VNOVAL) {
1493 		if (ap->a_cred->cr_uid != de->de_uid) {
1494 			error = priv_check(td, PRIV_VFS_ADMIN);
1495 			if (error)
1496 				return (error);
1497 		}
1498 		de->de_mode = vap->va_mode;
1499 		c = 1;
1500 	}
1501 
1502 	if (vap->va_atime.tv_sec != VNOVAL || vap->va_mtime.tv_sec != VNOVAL) {
1503 		/* See the comment in ufs_vnops::ufs_setattr(). */
1504 		if ((error = VOP_ACCESS(vp, VADMIN, ap->a_cred, td)) &&
1505 		    ((vap->va_vaflags & VA_UTIMES_NULL) == 0 ||
1506 		    (error = VOP_ACCESS(vp, VWRITE, ap->a_cred, td))))
1507 			return (error);
1508 		if (vap->va_atime.tv_sec != VNOVAL) {
1509 			if (vp->v_type == VCHR)
1510 				vp->v_rdev->si_atime = vap->va_atime;
1511 			else
1512 				de->de_atime = vap->va_atime;
1513 		}
1514 		if (vap->va_mtime.tv_sec != VNOVAL) {
1515 			if (vp->v_type == VCHR)
1516 				vp->v_rdev->si_mtime = vap->va_mtime;
1517 			else
1518 				de->de_mtime = vap->va_mtime;
1519 		}
1520 		c = 1;
1521 	}
1522 
1523 	if (c) {
1524 		if (vp->v_type == VCHR)
1525 			vfs_timestamp(&vp->v_rdev->si_ctime);
1526 		else
1527 			vfs_timestamp(&de->de_mtime);
1528 	}
1529 	return (0);
1530 }
1531 
1532 #ifdef MAC
1533 static int
1534 devfs_setlabel(struct vop_setlabel_args *ap)
1535 {
1536 	struct vnode *vp;
1537 	struct devfs_dirent *de;
1538 
1539 	vp = ap->a_vp;
1540 	de = vp->v_data;
1541 
1542 	mac_vnode_relabel(ap->a_cred, vp, ap->a_label);
1543 	mac_devfs_update(vp->v_mount, de, vp);
1544 
1545 	return (0);
1546 }
1547 #endif
1548 
1549 static int
1550 devfs_stat_f(struct file *fp, struct stat *sb, struct ucred *cred, struct thread *td)
1551 {
1552 
1553 	return (vnops.fo_stat(fp, sb, cred, td));
1554 }
1555 
1556 static int
1557 devfs_symlink(struct vop_symlink_args *ap)
1558 {
1559 	int i, error;
1560 	struct devfs_dirent *dd;
1561 	struct devfs_dirent *de, *de_covered, *de_dotdot;
1562 	struct devfs_mount *dmp;
1563 
1564 	error = priv_check(curthread, PRIV_DEVFS_SYMLINK);
1565 	if (error)
1566 		return(error);
1567 	dmp = VFSTODEVFS(ap->a_dvp->v_mount);
1568 	if (devfs_populate_vp(ap->a_dvp) != 0)
1569 		return (ENOENT);
1570 
1571 	dd = ap->a_dvp->v_data;
1572 	de = devfs_newdirent(ap->a_cnp->cn_nameptr, ap->a_cnp->cn_namelen);
1573 	de->de_flags = DE_USER;
1574 	de->de_uid = 0;
1575 	de->de_gid = 0;
1576 	de->de_mode = 0755;
1577 	de->de_inode = alloc_unr(devfs_inos);
1578 	de->de_dir = dd;
1579 	de->de_dirent->d_type = DT_LNK;
1580 	i = strlen(ap->a_target) + 1;
1581 	de->de_symlink = malloc(i, M_DEVFS, M_WAITOK);
1582 	bcopy(ap->a_target, de->de_symlink, i);
1583 #ifdef MAC
1584 	mac_devfs_create_symlink(ap->a_cnp->cn_cred, dmp->dm_mount, dd, de);
1585 #endif
1586 	de_covered = devfs_find(dd, de->de_dirent->d_name,
1587 	    de->de_dirent->d_namlen, 0);
1588 	if (de_covered != NULL) {
1589 		if ((de_covered->de_flags & DE_USER) != 0) {
1590 			devfs_delete(dmp, de, DEVFS_DEL_NORECURSE);
1591 			sx_xunlock(&dmp->dm_lock);
1592 			return (EEXIST);
1593 		}
1594 		KASSERT((de_covered->de_flags & DE_COVERED) == 0,
1595 		    ("devfs_symlink: entry %p already covered", de_covered));
1596 		de_covered->de_flags |= DE_COVERED;
1597 	}
1598 
1599 	de_dotdot = TAILQ_FIRST(&dd->de_dlist);		/* "." */
1600 	de_dotdot = TAILQ_NEXT(de_dotdot, de_list);	/* ".." */
1601 	TAILQ_INSERT_AFTER(&dd->de_dlist, de_dotdot, de, de_list);
1602 	devfs_dir_ref_de(dmp, dd);
1603 	devfs_rules_apply(dmp, de);
1604 
1605 	return (devfs_allocv(de, ap->a_dvp->v_mount, LK_EXCLUSIVE, ap->a_vpp));
1606 }
1607 
1608 static int
1609 devfs_truncate_f(struct file *fp, off_t length, struct ucred *cred, struct thread *td)
1610 {
1611 
1612 	return (vnops.fo_truncate(fp, length, cred, td));
1613 }
1614 
1615 /* ARGSUSED */
1616 static int
1617 devfs_write_f(struct file *fp, struct uio *uio, struct ucred *cred, int flags, struct thread *td)
1618 {
1619 	struct cdev *dev;
1620 	int error, ioflag, ref, resid;
1621 	struct cdevsw *dsw;
1622 	struct file *fpop;
1623 
1624 	fpop = td->td_fpop;
1625 	error = devfs_fp_check(fp, &dev, &dsw, &ref);
1626 	if (error)
1627 		return (error);
1628 	KASSERT(uio->uio_td == td, ("uio_td %p is not td %p", uio->uio_td, td));
1629 	ioflag = fp->f_flag & (O_NONBLOCK | O_DIRECT | O_FSYNC);
1630 	if (ioflag & O_DIRECT)
1631 		ioflag |= IO_DIRECT;
1632 	if ((flags & FOF_OFFSET) == 0)
1633 		uio->uio_offset = fp->f_offset;
1634 
1635 	resid = uio->uio_resid;
1636 
1637 	error = dsw->d_write(dev, uio, ioflag);
1638 	if (uio->uio_resid != resid || (error == 0 && resid != 0)) {
1639 		vfs_timestamp(&dev->si_ctime);
1640 		dev->si_mtime = dev->si_ctime;
1641 	}
1642 	td->td_fpop = fpop;
1643 	dev_relthread(dev, ref);
1644 
1645 	if ((flags & FOF_OFFSET) == 0)
1646 		fp->f_offset = uio->uio_offset;
1647 	fp->f_nextoff = uio->uio_offset;
1648 	return (error);
1649 }
1650 
1651 dev_t
1652 dev2udev(struct cdev *x)
1653 {
1654 	if (x == NULL)
1655 		return (NODEV);
1656 	return (cdev2priv(x)->cdp_inode);
1657 }
1658 
1659 static struct fileops devfs_ops_f = {
1660 	.fo_read =	devfs_read_f,
1661 	.fo_write =	devfs_write_f,
1662 	.fo_truncate =	devfs_truncate_f,
1663 	.fo_ioctl =	devfs_ioctl_f,
1664 	.fo_poll =	devfs_poll_f,
1665 	.fo_kqfilter =	devfs_kqfilter_f,
1666 	.fo_stat =	devfs_stat_f,
1667 	.fo_close =	devfs_close_f,
1668 	.fo_chmod =	vn_chmod,
1669 	.fo_chown =	vn_chown,
1670 	.fo_flags =	DFLAG_PASSABLE | DFLAG_SEEKABLE
1671 };
1672 
1673 static struct vop_vector devfs_vnodeops = {
1674 	.vop_default =		&default_vnodeops,
1675 
1676 	.vop_access =		devfs_access,
1677 	.vop_getattr =		devfs_getattr,
1678 	.vop_ioctl =		devfs_rioctl,
1679 	.vop_lookup =		devfs_lookup,
1680 	.vop_mknod =		devfs_mknod,
1681 	.vop_pathconf =		devfs_pathconf,
1682 	.vop_read =		devfs_rread,
1683 	.vop_readdir =		devfs_readdir,
1684 	.vop_readlink =		devfs_readlink,
1685 	.vop_reclaim =		devfs_reclaim,
1686 	.vop_remove =		devfs_remove,
1687 	.vop_revoke =		devfs_revoke,
1688 	.vop_setattr =		devfs_setattr,
1689 #ifdef MAC
1690 	.vop_setlabel =		devfs_setlabel,
1691 #endif
1692 	.vop_symlink =		devfs_symlink,
1693 	.vop_vptocnp =		devfs_vptocnp,
1694 };
1695 
1696 static struct vop_vector devfs_specops = {
1697 	.vop_default =		&default_vnodeops,
1698 
1699 	.vop_access =		devfs_access,
1700 	.vop_bmap =		VOP_PANIC,
1701 	.vop_close =		devfs_close,
1702 	.vop_create =		VOP_PANIC,
1703 	.vop_fsync =		devfs_fsync,
1704 	.vop_getattr =		devfs_getattr,
1705 	.vop_link =		VOP_PANIC,
1706 	.vop_mkdir =		VOP_PANIC,
1707 	.vop_mknod =		VOP_PANIC,
1708 	.vop_open =		devfs_open,
1709 	.vop_pathconf =		devfs_pathconf,
1710 	.vop_print =		devfs_print,
1711 	.vop_read =		VOP_PANIC,
1712 	.vop_readdir =		VOP_PANIC,
1713 	.vop_readlink =		VOP_PANIC,
1714 	.vop_reallocblks =	VOP_PANIC,
1715 	.vop_reclaim =		devfs_reclaim,
1716 	.vop_remove =		devfs_remove,
1717 	.vop_rename =		VOP_PANIC,
1718 	.vop_revoke =		devfs_revoke,
1719 	.vop_rmdir =		VOP_PANIC,
1720 	.vop_setattr =		devfs_setattr,
1721 #ifdef MAC
1722 	.vop_setlabel =		devfs_setlabel,
1723 #endif
1724 	.vop_strategy =		VOP_PANIC,
1725 	.vop_symlink =		VOP_PANIC,
1726 	.vop_vptocnp =		devfs_vptocnp,
1727 	.vop_write =		VOP_PANIC,
1728 };
1729 
1730 /*
1731  * Our calling convention to the device drivers used to be that we passed
1732  * vnode.h IO_* flags to read()/write(), but we're moving to fcntl.h O_
1733  * flags instead since that's what open(), close() and ioctl() takes and
1734  * we don't really want vnode.h in device drivers.
1735  * We solved the source compatibility by redefining some vnode flags to
1736  * be the same as the fcntl ones and by sending down the bitwise OR of
1737  * the respective fcntl/vnode flags.  These CTASSERTS make sure nobody
1738  * pulls the rug out under this.
1739  */
1740 CTASSERT(O_NONBLOCK == IO_NDELAY);
1741 CTASSERT(O_FSYNC == IO_SYNC);
1742