xref: /freebsd/sys/kern/kern_conf.c (revision e5b786625f7f82a1fa91e41823332459ea5550f9)
1 /*-
2  * SPDX-License-Identifier: BSD-2-Clause
3  *
4  * Copyright (c) 1999-2002 Poul-Henning Kamp
5  * All rights reserved.
6  *
7  * Redistribution and use in source and binary forms, with or without
8  * modification, are permitted provided that the following conditions
9  * are met:
10  * 1. Redistributions of source code must retain the above copyright
11  *    notice, this list of conditions and the following disclaimer.
12  * 2. Redistributions in binary form must reproduce the above copyright
13  *    notice, this list of conditions and the following disclaimer in the
14  *    documentation and/or other materials provided with the distribution.
15  *
16  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
17  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
18  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
19  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
20  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
21  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
22  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
23  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
24  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
25  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
26  * SUCH DAMAGE.
27  */
28 
29 #include <sys/cdefs.h>
30 #include <sys/param.h>
31 #include <sys/kernel.h>
32 #include <sys/systm.h>
33 #include <sys/bio.h>
34 #include <sys/devctl.h>
35 #include <sys/lock.h>
36 #include <sys/mutex.h>
37 #include <sys/module.h>
38 #include <sys/malloc.h>
39 #include <sys/conf.h>
40 #include <sys/vnode.h>
41 #include <sys/queue.h>
42 #include <sys/poll.h>
43 #include <sys/sx.h>
44 #include <sys/ctype.h>
45 #include <sys/ucred.h>
46 #include <sys/taskqueue.h>
47 #include <machine/stdarg.h>
48 
49 #include <fs/devfs/devfs_int.h>
50 #include <vm/vm.h>
51 
52 static MALLOC_DEFINE(M_DEVT, "cdev", "cdev storage");
53 
54 struct mtx devmtx;
55 static void destroy_devl(struct cdev *dev);
56 static int destroy_dev_sched_cbl(struct cdev *dev,
57     void (*cb)(void *), void *arg);
58 static void destroy_dev_tq(void *ctx, int pending);
59 static void destroy_dev_tq_giant(void *ctx, int pending);
60 static int make_dev_credv(int flags, struct cdev **dres, struct cdevsw *devsw,
61     int unit, struct ucred *cr, uid_t uid, gid_t gid, int mode, const char *fmt,
62     va_list ap);
63 
64 static struct cdev_priv_list cdevp_free_list =
65     TAILQ_HEAD_INITIALIZER(cdevp_free_list);
66 static SLIST_HEAD(free_cdevsw, cdevsw) cdevsw_gt_post_list =
67     SLIST_HEAD_INITIALIZER(cdevsw_gt_post_list);
68 
69 void
70 dev_lock(void)
71 {
72 
73 	mtx_lock(&devmtx);
74 }
75 
76 /*
77  * Free all the memory collected while the cdev mutex was
78  * locked. Since devmtx is after the system map mutex, free() cannot
79  * be called immediately and is postponed until cdev mutex can be
80  * dropped.
81  */
82 static void
83 dev_unlock_and_free(void)
84 {
85 	struct cdev_priv_list cdp_free;
86 	struct free_cdevsw csw_free;
87 	struct cdev_priv *cdp;
88 	struct cdevsw *csw;
89 
90 	dev_lock_assert_locked();
91 
92 	/*
93 	 * Make the local copy of the list heads while the dev_mtx is
94 	 * held. Free it later.
95 	 */
96 	TAILQ_INIT(&cdp_free);
97 	TAILQ_CONCAT(&cdp_free, &cdevp_free_list, cdp_list);
98 	csw_free = cdevsw_gt_post_list;
99 	SLIST_INIT(&cdevsw_gt_post_list);
100 
101 	mtx_unlock(&devmtx);
102 
103 	while ((cdp = TAILQ_FIRST(&cdp_free)) != NULL) {
104 		TAILQ_REMOVE(&cdp_free, cdp, cdp_list);
105 		devfs_free(&cdp->cdp_c);
106 	}
107 	while ((csw = SLIST_FIRST(&csw_free)) != NULL) {
108 		SLIST_REMOVE_HEAD(&csw_free, d_postfree_list);
109 		free(csw, M_DEVT);
110 	}
111 }
112 
113 static void
114 dev_free_devlocked(struct cdev *cdev)
115 {
116 	struct cdev_priv *cdp;
117 
118 	dev_lock_assert_locked();
119 	cdp = cdev2priv(cdev);
120 	KASSERT((cdp->cdp_flags & CDP_UNREF_DTR) == 0,
121 	    ("destroy_dev() was not called after delist_dev(%p)", cdev));
122 	KASSERT((cdp->cdp_flags & CDP_ON_ACTIVE_LIST) == 0,
123 	    ("%s: cdp %p (%s) on active list", __func__, cdp, cdev->si_name));
124 	TAILQ_INSERT_HEAD(&cdevp_free_list, cdp, cdp_list);
125 }
126 
127 static void
128 cdevsw_free_devlocked(struct cdevsw *csw)
129 {
130 
131 	dev_lock_assert_locked();
132 	SLIST_INSERT_HEAD(&cdevsw_gt_post_list, csw, d_postfree_list);
133 }
134 
135 void
136 dev_unlock(void)
137 {
138 
139 	mtx_unlock(&devmtx);
140 }
141 
142 void
143 dev_ref(struct cdev *dev)
144 {
145 
146 	dev_lock_assert_unlocked();
147 	mtx_lock(&devmtx);
148 	dev->si_refcount++;
149 	mtx_unlock(&devmtx);
150 }
151 
152 void
153 dev_refl(struct cdev *dev)
154 {
155 
156 	dev_lock_assert_locked();
157 	dev->si_refcount++;
158 }
159 
160 void
161 dev_rel(struct cdev *dev)
162 {
163 	int flag = 0;
164 
165 	dev_lock_assert_unlocked();
166 	dev_lock();
167 	dev->si_refcount--;
168 	KASSERT(dev->si_refcount >= 0,
169 	    ("dev_rel(%s) gave negative count", devtoname(dev)));
170 	if (dev->si_devsw == NULL && dev->si_refcount == 0) {
171 		LIST_REMOVE(dev, si_list);
172 		flag = 1;
173 	}
174 	dev_unlock();
175 	if (flag)
176 		devfs_free(dev);
177 }
178 
179 struct cdevsw *
180 dev_refthread(struct cdev *dev, int *ref)
181 {
182 	struct cdevsw *csw;
183 	struct cdev_priv *cdp;
184 
185 	dev_lock_assert_unlocked();
186 	if ((dev->si_flags & SI_ETERNAL) != 0) {
187 		*ref = 0;
188 		return (dev->si_devsw);
189 	}
190 	cdp = cdev2priv(dev);
191 	mtx_lock(&cdp->cdp_threadlock);
192 	csw = dev->si_devsw;
193 	if (csw != NULL) {
194 		if ((cdp->cdp_flags & CDP_SCHED_DTR) == 0)
195 			atomic_add_long(&dev->si_threadcount, 1);
196 		else
197 			csw = NULL;
198 	}
199 	mtx_unlock(&cdp->cdp_threadlock);
200 	if (csw != NULL)
201 		*ref = 1;
202 	return (csw);
203 }
204 
205 struct cdevsw *
206 devvn_refthread(struct vnode *vp, struct cdev **devp, int *ref)
207 {
208 	struct cdevsw *csw;
209 	struct cdev_priv *cdp;
210 	struct cdev *dev;
211 
212 	dev_lock_assert_unlocked();
213 	if ((vp->v_vflag & VV_ETERNALDEV) != 0) {
214 		dev = vp->v_rdev;
215 		if (dev == NULL)
216 			return (NULL);
217 		KASSERT((dev->si_flags & SI_ETERNAL) != 0,
218 		    ("Not eternal cdev"));
219 		*ref = 0;
220 		csw = dev->si_devsw;
221 		KASSERT(csw != NULL, ("Eternal cdev is destroyed"));
222 		*devp = dev;
223 		return (csw);
224 	}
225 
226 	csw = NULL;
227 	VI_LOCK(vp);
228 	dev = vp->v_rdev;
229 	if (dev == NULL) {
230 		VI_UNLOCK(vp);
231 		return (NULL);
232 	}
233 	cdp = cdev2priv(dev);
234 	mtx_lock(&cdp->cdp_threadlock);
235 	if ((cdp->cdp_flags & CDP_SCHED_DTR) == 0) {
236 		csw = dev->si_devsw;
237 		if (csw != NULL)
238 			atomic_add_long(&dev->si_threadcount, 1);
239 	}
240 	mtx_unlock(&cdp->cdp_threadlock);
241 	VI_UNLOCK(vp);
242 	if (csw != NULL) {
243 		*devp = dev;
244 		*ref = 1;
245 	}
246 	return (csw);
247 }
248 
249 void
250 dev_relthread(struct cdev *dev, int ref)
251 {
252 
253 	dev_lock_assert_unlocked();
254 	if (!ref)
255 		return;
256 	KASSERT(dev->si_threadcount > 0,
257 	    ("%s threadcount is wrong", dev->si_name));
258 	atomic_subtract_rel_long(&dev->si_threadcount, 1);
259 }
260 
261 int
262 nullop(void)
263 {
264 
265 	return (0);
266 }
267 
268 int
269 eopnotsupp(void)
270 {
271 
272 	return (EOPNOTSUPP);
273 }
274 
275 static int
276 enxio(void)
277 {
278 	return (ENXIO);
279 }
280 
281 static int
282 enodev(void)
283 {
284 	return (ENODEV);
285 }
286 
287 /* Define a dead_cdevsw for use when devices leave unexpectedly. */
288 
289 #define dead_open	(d_open_t *)enxio
290 #define dead_close	(d_close_t *)enxio
291 #define dead_read	(d_read_t *)enxio
292 #define dead_write	(d_write_t *)enxio
293 #define dead_ioctl	(d_ioctl_t *)enxio
294 #define dead_poll	(d_poll_t *)enodev
295 #define dead_mmap	(d_mmap_t *)enodev
296 
297 static void
298 dead_strategy(struct bio *bp)
299 {
300 
301 	biofinish(bp, NULL, ENXIO);
302 }
303 
304 #define dead_kqfilter	(d_kqfilter_t *)enxio
305 #define dead_mmap_single (d_mmap_single_t *)enodev
306 
307 static struct cdevsw dead_cdevsw = {
308 	.d_version =	D_VERSION,
309 	.d_open =	dead_open,
310 	.d_close =	dead_close,
311 	.d_read =	dead_read,
312 	.d_write =	dead_write,
313 	.d_ioctl =	dead_ioctl,
314 	.d_poll =	dead_poll,
315 	.d_mmap =	dead_mmap,
316 	.d_strategy =	dead_strategy,
317 	.d_name =	"dead",
318 	.d_kqfilter =	dead_kqfilter,
319 	.d_mmap_single = dead_mmap_single
320 };
321 
322 /* Default methods if driver does not specify method */
323 
324 #define null_open	(d_open_t *)nullop
325 #define null_close	(d_close_t *)nullop
326 #define no_read		(d_read_t *)enodev
327 #define no_write	(d_write_t *)enodev
328 #define no_ioctl	(d_ioctl_t *)enodev
329 #define no_mmap		(d_mmap_t *)enodev
330 #define no_kqfilter	(d_kqfilter_t *)enodev
331 #define no_mmap_single	(d_mmap_single_t *)enodev
332 
333 static void
334 no_strategy(struct bio *bp)
335 {
336 
337 	biofinish(bp, NULL, ENODEV);
338 }
339 
340 static int
341 no_poll(struct cdev *dev __unused, int events, struct thread *td __unused)
342 {
343 
344 	return (poll_no_poll(events));
345 }
346 
347 static int
348 giant_open(struct cdev *dev, int oflags, int devtype, struct thread *td)
349 {
350 	struct cdevsw *dsw;
351 	int ref, retval;
352 
353 	dsw = dev_refthread(dev, &ref);
354 	if (dsw == NULL)
355 		return (ENXIO);
356 	mtx_lock(&Giant);
357 	retval = dsw->d_gianttrick->d_open(dev, oflags, devtype, td);
358 	mtx_unlock(&Giant);
359 	dev_relthread(dev, ref);
360 	return (retval);
361 }
362 
363 static int
364 giant_fdopen(struct cdev *dev, int oflags, struct thread *td, struct file *fp)
365 {
366 	struct cdevsw *dsw;
367 	int ref, retval;
368 
369 	dsw = dev_refthread(dev, &ref);
370 	if (dsw == NULL)
371 		return (ENXIO);
372 	mtx_lock(&Giant);
373 	retval = dsw->d_gianttrick->d_fdopen(dev, oflags, td, fp);
374 	mtx_unlock(&Giant);
375 	dev_relthread(dev, ref);
376 	return (retval);
377 }
378 
379 static int
380 giant_close(struct cdev *dev, int fflag, int devtype, struct thread *td)
381 {
382 	struct cdevsw *dsw;
383 	int ref, retval;
384 
385 	dsw = dev_refthread(dev, &ref);
386 	if (dsw == NULL)
387 		return (ENXIO);
388 	mtx_lock(&Giant);
389 	retval = dsw->d_gianttrick->d_close(dev, fflag, devtype, td);
390 	mtx_unlock(&Giant);
391 	dev_relthread(dev, ref);
392 	return (retval);
393 }
394 
395 static void
396 giant_strategy(struct bio *bp)
397 {
398 	struct cdevsw *dsw;
399 	struct cdev *dev;
400 	int ref;
401 
402 	dev = bp->bio_dev;
403 	dsw = dev_refthread(dev, &ref);
404 	if (dsw == NULL) {
405 		biofinish(bp, NULL, ENXIO);
406 		return;
407 	}
408 	mtx_lock(&Giant);
409 	dsw->d_gianttrick->d_strategy(bp);
410 	mtx_unlock(&Giant);
411 	dev_relthread(dev, ref);
412 }
413 
414 static int
415 giant_ioctl(struct cdev *dev, u_long cmd, caddr_t data, int fflag, struct thread *td)
416 {
417 	struct cdevsw *dsw;
418 	int ref, retval;
419 
420 	dsw = dev_refthread(dev, &ref);
421 	if (dsw == NULL)
422 		return (ENXIO);
423 	mtx_lock(&Giant);
424 	retval = dsw->d_gianttrick->d_ioctl(dev, cmd, data, fflag, td);
425 	mtx_unlock(&Giant);
426 	dev_relthread(dev, ref);
427 	return (retval);
428 }
429 
430 static int
431 giant_read(struct cdev *dev, struct uio *uio, int ioflag)
432 {
433 	struct cdevsw *dsw;
434 	int ref, retval;
435 
436 	dsw = dev_refthread(dev, &ref);
437 	if (dsw == NULL)
438 		return (ENXIO);
439 	mtx_lock(&Giant);
440 	retval = dsw->d_gianttrick->d_read(dev, uio, ioflag);
441 	mtx_unlock(&Giant);
442 	dev_relthread(dev, ref);
443 	return (retval);
444 }
445 
446 static int
447 giant_write(struct cdev *dev, struct uio *uio, int ioflag)
448 {
449 	struct cdevsw *dsw;
450 	int ref, retval;
451 
452 	dsw = dev_refthread(dev, &ref);
453 	if (dsw == NULL)
454 		return (ENXIO);
455 	mtx_lock(&Giant);
456 	retval = dsw->d_gianttrick->d_write(dev, uio, ioflag);
457 	mtx_unlock(&Giant);
458 	dev_relthread(dev, ref);
459 	return (retval);
460 }
461 
462 static int
463 giant_poll(struct cdev *dev, int events, struct thread *td)
464 {
465 	struct cdevsw *dsw;
466 	int ref, retval;
467 
468 	dsw = dev_refthread(dev, &ref);
469 	if (dsw == NULL)
470 		return (ENXIO);
471 	mtx_lock(&Giant);
472 	retval = dsw->d_gianttrick->d_poll(dev, events, td);
473 	mtx_unlock(&Giant);
474 	dev_relthread(dev, ref);
475 	return (retval);
476 }
477 
478 static int
479 giant_kqfilter(struct cdev *dev, struct knote *kn)
480 {
481 	struct cdevsw *dsw;
482 	int ref, retval;
483 
484 	dsw = dev_refthread(dev, &ref);
485 	if (dsw == NULL)
486 		return (ENXIO);
487 	mtx_lock(&Giant);
488 	retval = dsw->d_gianttrick->d_kqfilter(dev, kn);
489 	mtx_unlock(&Giant);
490 	dev_relthread(dev, ref);
491 	return (retval);
492 }
493 
494 static int
495 giant_mmap(struct cdev *dev, vm_ooffset_t offset, vm_paddr_t *paddr, int nprot,
496     vm_memattr_t *memattr)
497 {
498 	struct cdevsw *dsw;
499 	int ref, retval;
500 
501 	dsw = dev_refthread(dev, &ref);
502 	if (dsw == NULL)
503 		return (ENXIO);
504 	mtx_lock(&Giant);
505 	retval = dsw->d_gianttrick->d_mmap(dev, offset, paddr, nprot,
506 	    memattr);
507 	mtx_unlock(&Giant);
508 	dev_relthread(dev, ref);
509 	return (retval);
510 }
511 
512 static int
513 giant_mmap_single(struct cdev *dev, vm_ooffset_t *offset, vm_size_t size,
514     vm_object_t *object, int nprot)
515 {
516 	struct cdevsw *dsw;
517 	int ref, retval;
518 
519 	dsw = dev_refthread(dev, &ref);
520 	if (dsw == NULL)
521 		return (ENXIO);
522 	mtx_lock(&Giant);
523 	retval = dsw->d_gianttrick->d_mmap_single(dev, offset, size, object,
524 	    nprot);
525 	mtx_unlock(&Giant);
526 	dev_relthread(dev, ref);
527 	return (retval);
528 }
529 
530 static void
531 notify(struct cdev *dev, const char *ev, int flags)
532 {
533 	static const char prefix[] = "cdev=";
534 	char *data;
535 	int namelen, mflags;
536 
537 	if (cold)
538 		return;
539 	mflags = (flags & MAKEDEV_NOWAIT) ? M_NOWAIT : M_WAITOK;
540 	namelen = strlen(dev->si_name);
541 	data = malloc(namelen + sizeof(prefix), M_TEMP, mflags);
542 	if (data == NULL)
543 		return;
544 	memcpy(data, prefix, sizeof(prefix) - 1);
545 	memcpy(data + sizeof(prefix) - 1, dev->si_name, namelen + 1);
546 	devctl_notify("DEVFS", "CDEV", ev, data);
547 	free(data, M_TEMP);
548 }
549 
550 static void
551 notify_create(struct cdev *dev, int flags)
552 {
553 
554 	notify(dev, "CREATE", flags);
555 }
556 
557 static void
558 notify_destroy(struct cdev *dev)
559 {
560 
561 	notify(dev, "DESTROY", MAKEDEV_WAITOK);
562 }
563 
564 static struct cdev *
565 newdev(struct make_dev_args *args, struct cdev *si)
566 {
567 	struct cdev *si2;
568 	struct cdevsw *csw;
569 
570 	dev_lock_assert_locked();
571 	csw = args->mda_devsw;
572 	si2 = NULL;
573 	if (csw->d_flags & D_NEEDMINOR) {
574 		/* We may want to return an existing device */
575 		LIST_FOREACH(si2, &csw->d_devs, si_list) {
576 			if (dev2unit(si2) == args->mda_unit) {
577 				dev_free_devlocked(si);
578 				si = si2;
579 				break;
580 			}
581 		}
582 
583 		/*
584 		 * If we're returning an existing device, we should make sure
585 		 * it isn't already initialized.  This would have been caught
586 		 * in consumers anyways, but it's good to catch such a case
587 		 * early.  We still need to complete initialization of the
588 		 * device, and we'll use whatever make_dev_args were passed in
589 		 * to do so.
590 		 */
591 		KASSERT(si2 == NULL || (si2->si_flags & SI_NAMED) == 0,
592 		    ("make_dev() by driver %s on pre-existing device (min=%x, name=%s)",
593 		    args->mda_devsw->d_name, dev2unit(si2), devtoname(si2)));
594 	}
595 	si->si_drv0 = args->mda_unit;
596 	si->si_drv1 = args->mda_si_drv1;
597 	si->si_drv2 = args->mda_si_drv2;
598 	/* Only push to csw->d_devs if it's not a cloned device. */
599 	if (si2 == NULL) {
600 		si->si_devsw = csw;
601 		LIST_INSERT_HEAD(&csw->d_devs, si, si_list);
602 	} else {
603 		KASSERT(si->si_devsw == csw,
604 		    ("%s: inconsistent devsw between clone_create() and make_dev()",
605 		    __func__));
606 	}
607 	return (si);
608 }
609 
610 static void
611 fini_cdevsw(struct cdevsw *devsw)
612 {
613 	struct cdevsw *gt;
614 
615 	if (devsw->d_gianttrick != NULL) {
616 		gt = devsw->d_gianttrick;
617 		memcpy(devsw, gt, sizeof *devsw);
618 		cdevsw_free_devlocked(gt);
619 		devsw->d_gianttrick = NULL;
620 	}
621 	devsw->d_flags &= ~D_INIT;
622 }
623 
624 static int
625 prep_cdevsw(struct cdevsw *devsw, int flags)
626 {
627 	struct cdevsw *dsw2;
628 
629 	dev_lock_assert_locked();
630 	if (devsw->d_flags & D_INIT)
631 		return (0);
632 	if (devsw->d_flags & D_NEEDGIANT) {
633 		dev_unlock();
634 		dsw2 = malloc(sizeof *dsw2, M_DEVT,
635 		     (flags & MAKEDEV_NOWAIT) ? M_NOWAIT : M_WAITOK);
636 		dev_lock();
637 		if (dsw2 == NULL && !(devsw->d_flags & D_INIT))
638 			return (ENOMEM);
639 	} else
640 		dsw2 = NULL;
641 	if (devsw->d_flags & D_INIT) {
642 		if (dsw2 != NULL)
643 			cdevsw_free_devlocked(dsw2);
644 		return (0);
645 	}
646 
647 	if (devsw->d_version != D_VERSION_04) {
648 		printf(
649 		    "WARNING: Device driver \"%s\" has wrong version %s\n",
650 		    devsw->d_name == NULL ? "???" : devsw->d_name,
651 		    "and is disabled.  Recompile KLD module.");
652 		devsw->d_open = dead_open;
653 		devsw->d_close = dead_close;
654 		devsw->d_read = dead_read;
655 		devsw->d_write = dead_write;
656 		devsw->d_ioctl = dead_ioctl;
657 		devsw->d_poll = dead_poll;
658 		devsw->d_mmap = dead_mmap;
659 		devsw->d_mmap_single = dead_mmap_single;
660 		devsw->d_strategy = dead_strategy;
661 		devsw->d_kqfilter = dead_kqfilter;
662 	}
663 
664 	if ((devsw->d_flags & D_NEEDGIANT) != 0) {
665 		if ((devsw->d_flags & D_GIANTOK) == 0) {
666 			printf(
667 			    "WARNING: Device \"%s\" is Giant locked and may be "
668 			    "deleted before FreeBSD 14.0.\n",
669 			    devsw->d_name == NULL ? "???" : devsw->d_name);
670 		}
671 		if (devsw->d_gianttrick == NULL) {
672 			memcpy(dsw2, devsw, sizeof *dsw2);
673 			devsw->d_gianttrick = dsw2;
674 			dsw2 = NULL;
675 		}
676 	}
677 
678 #define FIXUP(member, noop, giant) 				\
679 	do {							\
680 		if (devsw->member == NULL) {			\
681 			devsw->member = noop;			\
682 		} else if (devsw->d_flags & D_NEEDGIANT)	\
683 			devsw->member = giant;			\
684 		}						\
685 	while (0)
686 
687 	FIXUP(d_open,		null_open,	giant_open);
688 	FIXUP(d_fdopen,		NULL,		giant_fdopen);
689 	FIXUP(d_close,		null_close,	giant_close);
690 	FIXUP(d_read,		no_read,	giant_read);
691 	FIXUP(d_write,		no_write,	giant_write);
692 	FIXUP(d_ioctl,		no_ioctl,	giant_ioctl);
693 	FIXUP(d_poll,		no_poll,	giant_poll);
694 	FIXUP(d_mmap,		no_mmap,	giant_mmap);
695 	FIXUP(d_strategy,	no_strategy,	giant_strategy);
696 	FIXUP(d_kqfilter,	no_kqfilter,	giant_kqfilter);
697 	FIXUP(d_mmap_single,	no_mmap_single,	giant_mmap_single);
698 
699 	LIST_INIT(&devsw->d_devs);
700 
701 	devsw->d_flags |= D_INIT;
702 
703 	if (dsw2 != NULL)
704 		cdevsw_free_devlocked(dsw2);
705 	return (0);
706 }
707 
708 static int
709 prep_devname(struct cdev *dev, const char *fmt, va_list ap)
710 {
711 	int len;
712 	char *from, *q, *s, *to;
713 
714 	dev_lock_assert_locked();
715 
716 	len = vsnrprintf(dev->si_name, sizeof(dev->si_name), 32, fmt, ap);
717 	if (len > sizeof(dev->si_name) - 1)
718 		return (ENAMETOOLONG);
719 
720 	/* Strip leading slashes. */
721 	for (from = dev->si_name; *from == '/'; from++)
722 		;
723 
724 	for (to = dev->si_name; *from != '\0'; from++, to++) {
725 		/*
726 		 * Spaces and double quotation marks cause
727 		 * problems for the devctl(4) protocol.
728 		 * Reject names containing those characters.
729 		 */
730 		if (isspace(*from) || *from == '"')
731 			return (EINVAL);
732 		/* Treat multiple sequential slashes as single. */
733 		while (from[0] == '/' && from[1] == '/')
734 			from++;
735 		/* Trailing slash is considered invalid. */
736 		if (from[0] == '/' && from[1] == '\0')
737 			return (EINVAL);
738 		*to = *from;
739 	}
740 	*to = '\0';
741 
742 	if (dev->si_name[0] == '\0')
743 		return (EINVAL);
744 
745 	/* Disallow "." and ".." components. */
746 	for (s = dev->si_name;;) {
747 		for (q = s; *q != '/' && *q != '\0'; q++)
748 			;
749 		if (q - s == 1 && s[0] == '.')
750 			return (EINVAL);
751 		if (q - s == 2 && s[0] == '.' && s[1] == '.')
752 			return (EINVAL);
753 		if (*q != '/')
754 			break;
755 		s = q + 1;
756 	}
757 
758 	if (devfs_dev_exists(dev->si_name) != 0)
759 		return (EEXIST);
760 
761 	return (0);
762 }
763 
764 void
765 make_dev_args_init_impl(struct make_dev_args *args, size_t sz)
766 {
767 
768 	bzero(args, sz);
769 	args->mda_size = sz;
770 }
771 
772 static int
773 make_dev_sv(struct make_dev_args *args1, struct cdev **dres,
774     const char *fmt, va_list ap)
775 {
776 	struct cdev *dev, *dev_new;
777 	struct make_dev_args args;
778 	int res;
779 
780 	bzero(&args, sizeof(args));
781 	if (sizeof(args) < args1->mda_size)
782 		return (EINVAL);
783 	bcopy(args1, &args, args1->mda_size);
784 	KASSERT((args.mda_flags & MAKEDEV_WAITOK) == 0 ||
785 	    (args.mda_flags & MAKEDEV_NOWAIT) == 0,
786 	    ("make_dev_sv: both WAITOK and NOWAIT specified"));
787 	dev_new = devfs_alloc(args.mda_flags);
788 	if (dev_new == NULL)
789 		return (ENOMEM);
790 	dev_lock();
791 	res = prep_cdevsw(args.mda_devsw, args.mda_flags);
792 	if (res != 0) {
793 		dev_unlock();
794 		devfs_free(dev_new);
795 		return (res);
796 	}
797 	dev = newdev(&args, dev_new);
798 	if ((dev->si_flags & SI_NAMED) == 0) {
799 		res = prep_devname(dev, fmt, ap);
800 		if (res != 0) {
801 			if ((args.mda_flags & MAKEDEV_CHECKNAME) == 0) {
802 				panic(
803 			"make_dev_sv: bad si_name (error=%d, si_name=%s)",
804 				    res, dev->si_name);
805 			}
806 			if (dev == dev_new) {
807 				LIST_REMOVE(dev, si_list);
808 				dev_unlock();
809 				devfs_free(dev);
810 			} else
811 				dev_unlock();
812 			return (res);
813 		}
814 	}
815 	if ((args.mda_flags & MAKEDEV_REF) != 0)
816 		dev_refl(dev);
817 	if ((args.mda_flags & MAKEDEV_ETERNAL) != 0)
818 		dev->si_flags |= SI_ETERNAL;
819 	KASSERT(!(dev->si_flags & SI_NAMED),
820 	    ("make_dev() by driver %s on pre-existing device (min=%x, name=%s)",
821 	    args.mda_devsw->d_name, dev2unit(dev), devtoname(dev)));
822 	dev->si_flags |= SI_NAMED;
823 	if (args.mda_cr != NULL)
824 		dev->si_cred = crhold(args.mda_cr);
825 	dev->si_uid = args.mda_uid;
826 	dev->si_gid = args.mda_gid;
827 	dev->si_mode = args.mda_mode;
828 
829 	devfs_create(dev);
830 	clean_unrhdrl(devfs_inos);
831 	dev_unlock_and_free();
832 
833 	notify_create(dev, args.mda_flags);
834 
835 	*dres = dev;
836 	return (0);
837 }
838 
839 int
840 make_dev_s(struct make_dev_args *args, struct cdev **dres,
841     const char *fmt, ...)
842 {
843 	va_list ap;
844 	int res;
845 
846 	va_start(ap, fmt);
847 	res = make_dev_sv(args, dres, fmt, ap);
848 	va_end(ap);
849 	return (res);
850 }
851 
852 static int
853 make_dev_credv(int flags, struct cdev **dres, struct cdevsw *devsw, int unit,
854     struct ucred *cr, uid_t uid, gid_t gid, int mode, const char *fmt,
855     va_list ap)
856 {
857 	struct make_dev_args args;
858 
859 	make_dev_args_init(&args);
860 	args.mda_flags = flags;
861 	args.mda_devsw = devsw;
862 	args.mda_cr = cr;
863 	args.mda_uid = uid;
864 	args.mda_gid = gid;
865 	args.mda_mode = mode;
866 	args.mda_unit = unit;
867 	return (make_dev_sv(&args, dres, fmt, ap));
868 }
869 
870 struct cdev *
871 make_dev(struct cdevsw *devsw, int unit, uid_t uid, gid_t gid, int mode,
872     const char *fmt, ...)
873 {
874 	struct cdev *dev;
875 	va_list ap;
876 	int res __unused;
877 
878 	va_start(ap, fmt);
879 	res = make_dev_credv(0, &dev, devsw, unit, NULL, uid, gid, mode, fmt,
880 		      ap);
881 	va_end(ap);
882 	KASSERT(res == 0 && dev != NULL,
883 	    ("make_dev: failed make_dev_credv (error=%d)", res));
884 	return (dev);
885 }
886 
887 struct cdev *
888 make_dev_cred(struct cdevsw *devsw, int unit, struct ucred *cr, uid_t uid,
889     gid_t gid, int mode, const char *fmt, ...)
890 {
891 	struct cdev *dev;
892 	va_list ap;
893 	int res __unused;
894 
895 	va_start(ap, fmt);
896 	res = make_dev_credv(0, &dev, devsw, unit, cr, uid, gid, mode, fmt, ap);
897 	va_end(ap);
898 
899 	KASSERT(res == 0 && dev != NULL,
900 	    ("make_dev_cred: failed make_dev_credv (error=%d)", res));
901 	return (dev);
902 }
903 
904 struct cdev *
905 make_dev_credf(int flags, struct cdevsw *devsw, int unit, struct ucred *cr,
906     uid_t uid, gid_t gid, int mode, const char *fmt, ...)
907 {
908 	struct cdev *dev;
909 	va_list ap;
910 	int res;
911 
912 	va_start(ap, fmt);
913 	res = make_dev_credv(flags, &dev, devsw, unit, cr, uid, gid, mode,
914 	    fmt, ap);
915 	va_end(ap);
916 
917 	KASSERT(((flags & MAKEDEV_NOWAIT) != 0 && res == ENOMEM) ||
918 	    ((flags & MAKEDEV_CHECKNAME) != 0 && res != ENOMEM) || res == 0,
919 	    ("make_dev_credf: failed make_dev_credv (error=%d)", res));
920 	return (res == 0 ? dev : NULL);
921 }
922 
923 int
924 make_dev_p(int flags, struct cdev **cdev, struct cdevsw *devsw,
925     struct ucred *cr, uid_t uid, gid_t gid, int mode, const char *fmt, ...)
926 {
927 	va_list ap;
928 	int res;
929 
930 	va_start(ap, fmt);
931 	res = make_dev_credv(flags, cdev, devsw, 0, cr, uid, gid, mode,
932 	    fmt, ap);
933 	va_end(ap);
934 
935 	KASSERT(((flags & MAKEDEV_NOWAIT) != 0 && res == ENOMEM) ||
936 	    ((flags & MAKEDEV_CHECKNAME) != 0 && res != ENOMEM) || res == 0,
937 	    ("make_dev_p: failed make_dev_credv (error=%d)", res));
938 	return (res);
939 }
940 
941 static void
942 dev_dependsl(struct cdev *pdev, struct cdev *cdev)
943 {
944 
945 	cdev->si_parent = pdev;
946 	cdev->si_flags |= SI_CHILD;
947 	LIST_INSERT_HEAD(&pdev->si_children, cdev, si_siblings);
948 }
949 
950 void
951 dev_depends(struct cdev *pdev, struct cdev *cdev)
952 {
953 
954 	dev_lock();
955 	dev_dependsl(pdev, cdev);
956 	dev_unlock();
957 }
958 
959 static int
960 make_dev_alias_v(int flags, struct cdev **cdev, struct cdev *pdev,
961     const char *fmt, va_list ap)
962 {
963 	struct cdev *dev;
964 	int error;
965 
966 	KASSERT(pdev != NULL, ("make_dev_alias_v: pdev is NULL"));
967 	KASSERT((flags & MAKEDEV_WAITOK) == 0 || (flags & MAKEDEV_NOWAIT) == 0,
968 	    ("make_dev_alias_v: both WAITOK and NOWAIT specified"));
969 	KASSERT((flags & ~(MAKEDEV_WAITOK | MAKEDEV_NOWAIT |
970 	    MAKEDEV_CHECKNAME)) == 0,
971 	    ("make_dev_alias_v: invalid flags specified (flags=%02x)", flags));
972 
973 	dev = devfs_alloc(flags);
974 	if (dev == NULL)
975 		return (ENOMEM);
976 	dev_lock();
977 	dev->si_flags |= SI_ALIAS;
978 	error = prep_devname(dev, fmt, ap);
979 	if (error != 0) {
980 		if ((flags & MAKEDEV_CHECKNAME) == 0) {
981 			panic("make_dev_alias_v: bad si_name "
982 			    "(error=%d, si_name=%s)", error, dev->si_name);
983 		}
984 		dev_unlock();
985 		devfs_free(dev);
986 		return (error);
987 	}
988 	dev->si_flags |= SI_NAMED;
989 	devfs_create(dev);
990 	dev_dependsl(pdev, dev);
991 	clean_unrhdrl(devfs_inos);
992 	dev_unlock();
993 
994 	notify_create(dev, flags);
995 	*cdev = dev;
996 
997 	return (0);
998 }
999 
1000 struct cdev *
1001 make_dev_alias(struct cdev *pdev, const char *fmt, ...)
1002 {
1003 	struct cdev *dev;
1004 	va_list ap;
1005 	int res __unused;
1006 
1007 	va_start(ap, fmt);
1008 	res = make_dev_alias_v(MAKEDEV_WAITOK, &dev, pdev, fmt, ap);
1009 	va_end(ap);
1010 
1011 	KASSERT(res == 0 && dev != NULL,
1012 	    ("make_dev_alias: failed make_dev_alias_v (error=%d)", res));
1013 	return (dev);
1014 }
1015 
1016 int
1017 make_dev_alias_p(int flags, struct cdev **cdev, struct cdev *pdev,
1018     const char *fmt, ...)
1019 {
1020 	va_list ap;
1021 	int res;
1022 
1023 	va_start(ap, fmt);
1024 	res = make_dev_alias_v(flags, cdev, pdev, fmt, ap);
1025 	va_end(ap);
1026 	return (res);
1027 }
1028 
1029 int
1030 make_dev_physpath_alias(int flags, struct cdev **cdev, struct cdev *pdev,
1031     struct cdev *old_alias, const char *physpath)
1032 {
1033 	char *devfspath;
1034 	int physpath_len;
1035 	int max_parentpath_len;
1036 	int parentpath_len;
1037 	int devfspathbuf_len;
1038 	int mflags;
1039 	int ret;
1040 
1041 	*cdev = NULL;
1042 	devfspath = NULL;
1043 	physpath_len = strlen(physpath);
1044 	ret = EINVAL;
1045 	if (physpath_len == 0)
1046 		goto out;
1047 
1048 	if (strncmp("id1,", physpath, 4) == 0) {
1049 		physpath += 4;
1050 		physpath_len -= 4;
1051 		if (physpath_len == 0)
1052 			goto out;
1053 	}
1054 
1055 	max_parentpath_len = SPECNAMELEN - physpath_len - /*/*/1;
1056 	parentpath_len = strlen(pdev->si_name);
1057 	if (max_parentpath_len < parentpath_len) {
1058 		if (bootverbose)
1059 			printf("WARNING: Unable to alias %s "
1060 			    "to %s/%s - path too long\n",
1061 			    pdev->si_name, physpath, pdev->si_name);
1062 		ret = ENAMETOOLONG;
1063 		goto out;
1064 	}
1065 
1066 	mflags = (flags & MAKEDEV_NOWAIT) ? M_NOWAIT : M_WAITOK;
1067 	devfspathbuf_len = physpath_len + /*/*/1 + parentpath_len + /*NUL*/1;
1068 	devfspath = malloc(devfspathbuf_len, M_DEVBUF, mflags);
1069 	if (devfspath == NULL) {
1070 		ret = ENOMEM;
1071 		goto out;
1072 	}
1073 
1074 	sprintf(devfspath, "%s/%s", physpath, pdev->si_name);
1075 	if (old_alias != NULL && strcmp(old_alias->si_name, devfspath) == 0) {
1076 		/* Retain the existing alias. */
1077 		*cdev = old_alias;
1078 		old_alias = NULL;
1079 		ret = 0;
1080 	} else {
1081 		ret = make_dev_alias_p(flags, cdev, pdev, "%s", devfspath);
1082 	}
1083 out:
1084 	if (old_alias != NULL)
1085 		destroy_dev(old_alias);
1086 	if (devfspath != NULL)
1087 		free(devfspath, M_DEVBUF);
1088 	return (ret);
1089 }
1090 
1091 static void
1092 destroy_devl(struct cdev *dev)
1093 {
1094 	struct cdevsw *csw;
1095 	struct cdev_privdata *p;
1096 	struct cdev_priv *cdp;
1097 
1098 	dev_lock_assert_locked();
1099 	KASSERT(dev->si_flags & SI_NAMED,
1100 	    ("WARNING: Driver mistake: destroy_dev on %d\n", dev2unit(dev)));
1101 	KASSERT((dev->si_flags & SI_ETERNAL) == 0,
1102 	    ("WARNING: Driver mistake: destroy_dev on eternal %d\n",
1103 	     dev2unit(dev)));
1104 
1105 	cdp = cdev2priv(dev);
1106 	if ((cdp->cdp_flags & CDP_UNREF_DTR) == 0) {
1107 		/*
1108 		 * Avoid race with dev_rel(), e.g. from the populate
1109 		 * loop.  If CDP_UNREF_DTR flag is set, the reference
1110 		 * to be dropped at the end of destroy_devl() was
1111 		 * already taken by delist_dev_locked().
1112 		 */
1113 		dev_refl(dev);
1114 
1115 		devfs_destroy(dev);
1116 	}
1117 
1118 	/* Remove name marking */
1119 	dev->si_flags &= ~SI_NAMED;
1120 
1121 	/* If we are a child, remove us from the parents list */
1122 	if (dev->si_flags & SI_CHILD) {
1123 		LIST_REMOVE(dev, si_siblings);
1124 		dev->si_flags &= ~SI_CHILD;
1125 	}
1126 
1127 	/* Kill our children */
1128 	while (!LIST_EMPTY(&dev->si_children))
1129 		destroy_devl(LIST_FIRST(&dev->si_children));
1130 
1131 	/* Remove from clone list */
1132 	if (dev->si_flags & SI_CLONELIST) {
1133 		LIST_REMOVE(dev, si_clone);
1134 		dev->si_flags &= ~SI_CLONELIST;
1135 	}
1136 
1137 	mtx_lock(&cdp->cdp_threadlock);
1138 	csw = dev->si_devsw;
1139 	dev->si_devsw = NULL;	/* already NULL for SI_ALIAS */
1140 	while (csw != NULL && csw->d_purge != NULL && dev->si_threadcount) {
1141 		csw->d_purge(dev);
1142 		mtx_unlock(&cdp->cdp_threadlock);
1143 		msleep(csw, &devmtx, PRIBIO, "devprg", hz/10);
1144 		mtx_lock(&cdp->cdp_threadlock);
1145 		if (dev->si_threadcount)
1146 			printf("Still %lu threads in %s\n",
1147 			    dev->si_threadcount, devtoname(dev));
1148 	}
1149 	while (dev->si_threadcount != 0) {
1150 		/* Use unique dummy wait ident */
1151 		mtx_unlock(&cdp->cdp_threadlock);
1152 		msleep(&csw, &devmtx, PRIBIO, "devdrn", hz / 10);
1153 		mtx_lock(&cdp->cdp_threadlock);
1154 	}
1155 
1156 	mtx_unlock(&cdp->cdp_threadlock);
1157 	dev_unlock();
1158 	if ((cdp->cdp_flags & CDP_UNREF_DTR) == 0) {
1159 		/* avoid out of order notify events */
1160 		notify_destroy(dev);
1161 	}
1162 	mtx_lock(&cdevpriv_mtx);
1163 	while ((p = LIST_FIRST(&cdp->cdp_fdpriv)) != NULL) {
1164 		devfs_destroy_cdevpriv(p);
1165 		mtx_lock(&cdevpriv_mtx);
1166 	}
1167 	mtx_unlock(&cdevpriv_mtx);
1168 	dev_lock();
1169 
1170 	dev->si_drv1 = 0;
1171 	dev->si_drv2 = 0;
1172 
1173 	if (!(dev->si_flags & SI_ALIAS)) {
1174 		/* Remove from cdevsw list */
1175 		LIST_REMOVE(dev, si_list);
1176 
1177 		/* If cdevsw has no more struct cdev *'s, clean it */
1178 		if (LIST_EMPTY(&csw->d_devs)) {
1179 			fini_cdevsw(csw);
1180 			wakeup(&csw->d_devs);
1181 		}
1182 	}
1183 	dev->si_flags &= ~SI_ALIAS;
1184 	cdp->cdp_flags &= ~CDP_UNREF_DTR;
1185 	dev->si_refcount--;
1186 
1187 	if (dev->si_refcount > 0)
1188 		LIST_INSERT_HEAD(&dead_cdevsw.d_devs, dev, si_list);
1189 	else
1190 		dev_free_devlocked(dev);
1191 }
1192 
1193 static void
1194 delist_dev_locked(struct cdev *dev)
1195 {
1196 	struct cdev_priv *cdp;
1197 	struct cdev *child;
1198 
1199 	dev_lock_assert_locked();
1200 	cdp = cdev2priv(dev);
1201 	if ((cdp->cdp_flags & CDP_UNREF_DTR) != 0)
1202 		return;
1203 	cdp->cdp_flags |= CDP_UNREF_DTR;
1204 	dev_refl(dev);
1205 	devfs_destroy(dev);
1206 	LIST_FOREACH(child, &dev->si_children, si_siblings)
1207 		delist_dev_locked(child);
1208 	dev_unlock();
1209 	/* ensure the destroy event is queued in order */
1210 	notify_destroy(dev);
1211 	dev_lock();
1212 }
1213 
1214 /*
1215  * This function will delist a character device and its children from
1216  * the directory listing and create a destroy event without waiting
1217  * for all character device references to go away. At some later point
1218  * destroy_dev() must be called to complete the character device
1219  * destruction. After calling this function the character device name
1220  * can instantly be re-used.
1221  */
1222 void
1223 delist_dev(struct cdev *dev)
1224 {
1225 
1226 	WITNESS_WARN(WARN_GIANTOK | WARN_SLEEPOK, NULL, "delist_dev");
1227 	dev_lock();
1228 	delist_dev_locked(dev);
1229 	dev_unlock();
1230 }
1231 
1232 void
1233 destroy_dev(struct cdev *dev)
1234 {
1235 
1236 	WITNESS_WARN(WARN_GIANTOK | WARN_SLEEPOK, NULL, "destroy_dev");
1237 	dev_lock();
1238 	destroy_devl(dev);
1239 	dev_unlock_and_free();
1240 }
1241 
1242 const char *
1243 devtoname(struct cdev *dev)
1244 {
1245 
1246 	return (dev->si_name);
1247 }
1248 
1249 int
1250 dev_stdclone(char *name, char **namep, const char *stem, int *unit)
1251 {
1252 	int u, i;
1253 
1254 	i = strlen(stem);
1255 	if (strncmp(stem, name, i) != 0)
1256 		return (0);
1257 	if (!isdigit(name[i]))
1258 		return (0);
1259 	u = 0;
1260 	if (name[i] == '0' && isdigit(name[i+1]))
1261 		return (0);
1262 	while (isdigit(name[i])) {
1263 		u *= 10;
1264 		u += name[i++] - '0';
1265 	}
1266 	if (u > 0xffffff)
1267 		return (0);
1268 	*unit = u;
1269 	if (namep)
1270 		*namep = &name[i];
1271 	if (name[i])
1272 		return (2);
1273 	return (1);
1274 }
1275 
1276 /*
1277  * Helper functions for cloning device drivers.
1278  *
1279  * The objective here is to make it unnecessary for the device drivers to
1280  * use rman or similar to manage their unit number space.  Due to the way
1281  * we do "on-demand" devices, using rman or other "private" methods
1282  * will be very tricky to lock down properly once we lock down this file.
1283  *
1284  * Instead we give the drivers these routines which puts the struct cdev *'s
1285  * that are to be managed on their own list, and gives the driver the ability
1286  * to ask for the first free unit number or a given specified unit number.
1287  *
1288  * In addition these routines support paired devices (pty, nmdm and similar)
1289  * by respecting a number of "flag" bits in the minor number.
1290  *
1291  */
1292 
1293 struct clonedevs {
1294 	LIST_HEAD(,cdev)	head;
1295 };
1296 
1297 void
1298 clone_setup(struct clonedevs **cdp)
1299 {
1300 
1301 	*cdp = malloc(sizeof **cdp, M_DEVBUF, M_WAITOK | M_ZERO);
1302 	LIST_INIT(&(*cdp)->head);
1303 }
1304 
1305 int
1306 clone_create(struct clonedevs **cdp, struct cdevsw *csw, int *up,
1307     struct cdev **dp, int extra)
1308 {
1309 	struct clonedevs *cd;
1310 	struct cdev *dev, *ndev, *dl, *de;
1311 	struct make_dev_args args;
1312 	int unit, low, u;
1313 
1314 	KASSERT(*cdp != NULL,
1315 	    ("clone_setup() not called in driver \"%s\"", csw->d_name));
1316 	KASSERT(!(extra & CLONE_UNITMASK),
1317 	    ("Illegal extra bits (0x%x) in clone_create", extra));
1318 	KASSERT(*up <= CLONE_UNITMASK,
1319 	    ("Too high unit (0x%x) in clone_create", *up));
1320 	KASSERT(csw->d_flags & D_NEEDMINOR,
1321 	    ("clone_create() on cdevsw without minor numbers"));
1322 
1323 	/*
1324 	 * Search the list for a lot of things in one go:
1325 	 *   A preexisting match is returned immediately.
1326 	 *   The lowest free unit number if we are passed -1, and the place
1327 	 *	 in the list where we should insert that new element.
1328 	 *   The place to insert a specified unit number, if applicable
1329 	 *       the end of the list.
1330 	 */
1331 	unit = *up;
1332 	ndev = devfs_alloc(MAKEDEV_WAITOK);
1333 	dev_lock();
1334 	prep_cdevsw(csw, MAKEDEV_WAITOK);
1335 	low = extra;
1336 	de = dl = NULL;
1337 	cd = *cdp;
1338 	LIST_FOREACH(dev, &cd->head, si_clone) {
1339 		KASSERT(dev->si_flags & SI_CLONELIST,
1340 		    ("Dev %p(%s) should be on clonelist", dev, dev->si_name));
1341 		u = dev2unit(dev);
1342 		if (u == (unit | extra)) {
1343 			*dp = dev;
1344 			dev_unlock();
1345 			devfs_free(ndev);
1346 			return (0);
1347 		}
1348 		if (unit == -1 && u == low) {
1349 			low++;
1350 			de = dev;
1351 			continue;
1352 		} else if (u < (unit | extra)) {
1353 			de = dev;
1354 			continue;
1355 		} else if (u > (unit | extra)) {
1356 			dl = dev;
1357 			break;
1358 		}
1359 	}
1360 	if (unit == -1)
1361 		unit = low & CLONE_UNITMASK;
1362 	make_dev_args_init(&args);
1363 	args.mda_unit = unit | extra;
1364 	args.mda_devsw = csw;
1365 	dev = newdev(&args, ndev);
1366 	if (dev->si_flags & SI_CLONELIST) {
1367 		printf("dev %p (%s) is on clonelist\n", dev, dev->si_name);
1368 		printf("unit=%d, low=%d, extra=0x%x\n", unit, low, extra);
1369 		LIST_FOREACH(dev, &cd->head, si_clone) {
1370 			printf("\t%p %s\n", dev, dev->si_name);
1371 		}
1372 		panic("foo");
1373 	}
1374 	KASSERT(!(dev->si_flags & SI_CLONELIST),
1375 	    ("Dev %p(%s) should not be on clonelist", dev, dev->si_name));
1376 	if (dl != NULL)
1377 		LIST_INSERT_BEFORE(dl, dev, si_clone);
1378 	else if (de != NULL)
1379 		LIST_INSERT_AFTER(de, dev, si_clone);
1380 	else
1381 		LIST_INSERT_HEAD(&cd->head, dev, si_clone);
1382 	dev->si_flags |= SI_CLONELIST;
1383 	*up = unit;
1384 	dev_unlock_and_free();
1385 	return (1);
1386 }
1387 
1388 /*
1389  * Kill everything still on the list.  The driver should already have
1390  * disposed of any softc hung of the struct cdev *'s at this time.
1391  */
1392 void
1393 clone_cleanup(struct clonedevs **cdp)
1394 {
1395 	struct cdev *dev;
1396 	struct cdev_priv *cp;
1397 	struct clonedevs *cd;
1398 
1399 	cd = *cdp;
1400 	if (cd == NULL)
1401 		return;
1402 	dev_lock();
1403 	while (!LIST_EMPTY(&cd->head)) {
1404 		dev = LIST_FIRST(&cd->head);
1405 		LIST_REMOVE(dev, si_clone);
1406 		KASSERT(dev->si_flags & SI_CLONELIST,
1407 		    ("Dev %p(%s) should be on clonelist", dev, dev->si_name));
1408 		dev->si_flags &= ~SI_CLONELIST;
1409 		cp = cdev2priv(dev);
1410 		if (!(cp->cdp_flags & CDP_SCHED_DTR)) {
1411 			cp->cdp_flags |= CDP_SCHED_DTR;
1412 			KASSERT(dev->si_flags & SI_NAMED,
1413 				("Driver has goofed in cloning underways udev %jx unit %x",
1414 				(uintmax_t)dev2udev(dev), dev2unit(dev)));
1415 			destroy_devl(dev);
1416 		}
1417 	}
1418 	dev_unlock_and_free();
1419 	free(cd, M_DEVBUF);
1420 	*cdp = NULL;
1421 }
1422 
1423 static TAILQ_HEAD(, cdev_priv) dev_ddtr =
1424 	TAILQ_HEAD_INITIALIZER(dev_ddtr);
1425 static TAILQ_HEAD(, cdev_priv) dev_ddtr_giant =
1426 	TAILQ_HEAD_INITIALIZER(dev_ddtr_giant);
1427 static struct task dev_dtr_task = TASK_INITIALIZER(0, destroy_dev_tq, &dev_ddtr);
1428 static struct task dev_dtr_task_giant = TASK_INITIALIZER(0, destroy_dev_tq_giant,
1429     &dev_ddtr_giant);
1430 
1431 static void
1432 destroy_dev_tq(void *ctx, int pending)
1433 {
1434 	TAILQ_HEAD(, cdev_priv) *ddtr = ctx;
1435 	struct cdev_priv *cp;
1436 	struct cdev *dev;
1437 	void (*cb)(void *);
1438 	void *cb_arg;
1439 
1440 	dev_lock();
1441 	while (!TAILQ_EMPTY(ddtr)) {
1442 		cp = TAILQ_FIRST(ddtr);
1443 		dev = &cp->cdp_c;
1444 		KASSERT(cp->cdp_flags & CDP_SCHED_DTR,
1445 		    ("cdev %p in dev_destroy_tq without CDP_SCHED_DTR", cp));
1446 		TAILQ_REMOVE(ddtr, cp, cdp_dtr_list);
1447 		cb = cp->cdp_dtr_cb;
1448 		cb_arg = cp->cdp_dtr_cb_arg;
1449 		destroy_devl(dev);
1450 		dev_unlock_and_free();
1451 		dev_rel(dev);
1452 		if (cb != NULL)
1453 			cb(cb_arg);
1454 		dev_lock();
1455 	}
1456 	dev_unlock();
1457 }
1458 
1459 static void
1460 destroy_dev_tq_giant(void *ctx, int pending)
1461 {
1462 	mtx_lock(&Giant);
1463 	destroy_dev_tq(ctx, pending);
1464 	mtx_unlock(&Giant);
1465 }
1466 
1467 /*
1468  * devmtx shall be locked on entry. devmtx will be unlocked after
1469  * function return.
1470  */
1471 static int
1472 destroy_dev_sched_cbl(struct cdev *dev, void (*cb)(void *), void *arg)
1473 {
1474 	struct cdev_priv *cp;
1475 	bool need_giant;
1476 
1477 	dev_lock_assert_locked();
1478 	cp = cdev2priv(dev);
1479 	if (cp->cdp_flags & CDP_SCHED_DTR) {
1480 		dev_unlock();
1481 		return (0);
1482 	}
1483 	dev_refl(dev);
1484 	cp->cdp_flags |= CDP_SCHED_DTR;
1485 	cp->cdp_dtr_cb = cb;
1486 	cp->cdp_dtr_cb_arg = arg;
1487 	need_giant = (dev->si_devsw->d_flags & D_NEEDGIANT) != 0;
1488 	if (need_giant)
1489 		TAILQ_INSERT_TAIL(&dev_ddtr_giant, cp, cdp_dtr_list);
1490 	else
1491 		TAILQ_INSERT_TAIL(&dev_ddtr, cp, cdp_dtr_list);
1492 	dev_unlock();
1493 	if (need_giant)
1494 		taskqueue_enqueue(taskqueue_thread, &dev_dtr_task_giant);
1495 	else
1496 		taskqueue_enqueue(taskqueue_thread, &dev_dtr_task);
1497 	return (1);
1498 }
1499 
1500 int
1501 destroy_dev_sched_cb(struct cdev *dev, void (*cb)(void *), void *arg)
1502 {
1503 
1504 	dev_lock();
1505 	return (destroy_dev_sched_cbl(dev, cb, arg));
1506 }
1507 
1508 int
1509 destroy_dev_sched(struct cdev *dev)
1510 {
1511 
1512 	return (destroy_dev_sched_cb(dev, NULL, NULL));
1513 }
1514 
1515 void
1516 destroy_dev_drain(struct cdevsw *csw)
1517 {
1518 
1519 	dev_lock();
1520 	while (!LIST_EMPTY(&csw->d_devs)) {
1521 		msleep(&csw->d_devs, &devmtx, PRIBIO, "devscd", hz/10);
1522 	}
1523 	dev_unlock();
1524 }
1525 
1526 #include "opt_ddb.h"
1527 #ifdef DDB
1528 #include <sys/kernel.h>
1529 
1530 #include <ddb/ddb.h>
1531 
1532 DB_SHOW_COMMAND(cdev, db_show_cdev)
1533 {
1534 	struct cdev_priv *cdp;
1535 	struct cdev *dev;
1536 	u_int flags;
1537 	char buf[512];
1538 
1539 	if (!have_addr) {
1540 		TAILQ_FOREACH(cdp, &cdevp_list, cdp_list) {
1541 			dev = &cdp->cdp_c;
1542 			db_printf("%s %p\n", dev->si_name, dev);
1543 			if (db_pager_quit)
1544 				break;
1545 		}
1546 		return;
1547 	}
1548 
1549 	dev = (struct cdev *)addr;
1550 	cdp = cdev2priv(dev);
1551 	db_printf("dev %s ref %d use %ld thr %ld inuse %u fdpriv %p\n",
1552 	    dev->si_name, dev->si_refcount, dev->si_usecount,
1553 	    dev->si_threadcount, cdp->cdp_inuse, cdp->cdp_fdpriv.lh_first);
1554 	db_printf("devsw %p si_drv0 %d si_drv1 %p si_drv2 %p\n",
1555 	    dev->si_devsw, dev->si_drv0, dev->si_drv1, dev->si_drv2);
1556 	flags = dev->si_flags;
1557 #define	SI_FLAG(flag)	do {						\
1558 	if (flags & (flag)) {						\
1559 		if (buf[0] != '\0')					\
1560 			strlcat(buf, ", ", sizeof(buf));		\
1561 		strlcat(buf, (#flag) + 3, sizeof(buf));			\
1562 		flags &= ~(flag);					\
1563 	}								\
1564 } while (0)
1565 	buf[0] = '\0';
1566 	SI_FLAG(SI_ETERNAL);
1567 	SI_FLAG(SI_ALIAS);
1568 	SI_FLAG(SI_NAMED);
1569 	SI_FLAG(SI_CHILD);
1570 	SI_FLAG(SI_DUMPDEV);
1571 	SI_FLAG(SI_CLONELIST);
1572 	db_printf("si_flags %s\n", buf);
1573 
1574 	flags = cdp->cdp_flags;
1575 #define	CDP_FLAG(flag)	do {						\
1576 	if (flags & (flag)) {						\
1577 		if (buf[0] != '\0')					\
1578 			strlcat(buf, ", ", sizeof(buf));		\
1579 		strlcat(buf, (#flag) + 4, sizeof(buf));			\
1580 		flags &= ~(flag);					\
1581 	}								\
1582 } while (0)
1583 	buf[0] = '\0';
1584 	CDP_FLAG(CDP_ACTIVE);
1585 	CDP_FLAG(CDP_SCHED_DTR);
1586 	db_printf("cdp_flags %s\n", buf);
1587 }
1588 #endif
1589