devfs - zygaena/hammerhead

root / base / usr / src / uts / common / fs / devfs
devfs Plain Text 3657 lines 92.0 KB
/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License (the "License").
 * You may not use this file except in compliance with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */
/*
 * Copyright (c) 2002, 2010, Oracle and/or its affiliates. All rights reserved.
 */

/*
 * Copyright 2023 Oxide Computer Company
 */

/*
 * miscellaneous routines for the devfs
 */

#include <sys/types.h>
#include <sys/param.h>
#include <sys/t_lock.h>
#include <sys/systm.h>
#include <sys/sysmacros.h>
#include <sys/user.h>
#include <sys/time.h>
#include <sys/vfs.h>
#include <sys/vnode.h>
#include <sys/file.h>
#include <sys/fcntl.h>
#include <sys/flock.h>
#include <sys/kmem.h>
#include <sys/uio.h>
#include <sys/errno.h>
#include <sys/stat.h>
#include <sys/cred.h>
#include <sys/dirent.h>
#include <sys/pathname.h>
#include <sys/cmn_err.h>
#include <sys/debug.h>
#include <sys/modctl.h>
#include <fs/fs_subr.h>
#include <sys/fs/dv_node.h>
#include <sys/fs/snode.h>
#include <sys/sunndi.h>
#include <sys/sunmdi.h>
#include <sys/conf.h>

#ifdef DEBUG
int devfs_debug = 0x0;
#endif

const char	dvnm[] = "devfs";
kmem_cache_t	*dv_node_cache;	/* dv_node cache */

/*
 * The devfs_clean_key is taken during a devfs_clean operation: it is used to
 * prevent unnecessary code execution and for detection of potential deadlocks.
 */
uint_t		devfs_clean_key;

struct dv_node *dvroot;

/* prototype memory vattrs */
vattr_t dv_vattr_dir = {
	AT_TYPE|AT_MODE|AT_UID|AT_GID,		/* va_mask */
	VDIR,					/* va_type */
	DV_DIRMODE_DEFAULT,			/* va_mode */
	DV_UID_DEFAULT,				/* va_uid */
	DV_GID_DEFAULT,				/* va_gid */
	0,					/* va_fsid; */
	0,					/* va_nodeid; */
	0,					/* va_nlink; */
	0,					/* va_size; */
	0,					/* va_atime; */
	0,					/* va_mtime; */
	0,					/* va_ctime; */
	0,					/* va_rdev; */
	0,					/* va_blksize; */
	0,					/* va_nblocks; */
	0,					/* va_seq; */
};

vattr_t dv_vattr_file = {
	AT_TYPE|AT_MODE|AT_SIZE|AT_UID|AT_GID|AT_RDEV,	/* va_mask */
	0,					/* va_type */
	DV_DEVMODE_DEFAULT,			/* va_mode */
	DV_UID_DEFAULT,				/* va_uid */
	DV_GID_DEFAULT,				/* va_gid */
	0,					/* va_fsid; */
	0,					/* va_nodeid; */
	0,					/* va_nlink; */
	0,					/* va_size; */
	0,					/* va_atime; */
	0,					/* va_mtime; */
	0,					/* va_ctime; */
	0,					/* va_rdev; */
	0,					/* va_blksize; */
	0,					/* va_nblocks; */
	0,					/* va_seq; */
};

vattr_t dv_vattr_priv = {
	AT_TYPE|AT_MODE|AT_SIZE|AT_UID|AT_GID|AT_RDEV,	/* va_mask */
	0,					/* va_type */
	DV_DEVMODE_PRIV,			/* va_mode */
	DV_UID_DEFAULT,				/* va_uid */
	DV_GID_DEFAULT,				/* va_gid */
	0,					/* va_fsid; */
	0,					/* va_nodeid; */
	0,					/* va_nlink; */
	0,					/* va_size; */
	0,					/* va_atime; */
	0,					/* va_mtime; */
	0,					/* va_ctime; */
	0,					/* va_rdev; */
	0,					/* va_blksize; */
	0,					/* va_nblocks; */
	0,					/* va_seq; */
};

extern dev_info_t	*clone_dip;
extern major_t		clone_major;
extern struct dev_ops	*ddi_hold_driver(major_t);

/* dv_node node constructor for kmem cache */
static int
i_dv_node_ctor(void *buf, void *cfarg, int flag)
{
	_NOTE(ARGUNUSED(cfarg, flag))
	struct dv_node	*dv = (struct dv_node *)buf;
	struct vnode	*vp;

	bzero(buf, sizeof (struct dv_node));
	vp = dv->dv_vnode = vn_alloc(flag);
	if (vp == NULL) {
		return (-1);
	}
	vp->v_data = dv;
	rw_init(&dv->dv_contents, NULL, RW_DEFAULT, NULL);
	return (0);
}

/* dv_node node destructor for kmem cache */
static void
i_dv_node_dtor(void *buf, void *arg)
{
	_NOTE(ARGUNUSED(arg))
	struct dv_node	*dv = (struct dv_node *)buf;
	struct vnode	*vp = DVTOV(dv);

	rw_destroy(&dv->dv_contents);
	vn_invalid(vp);
	vn_free(vp);
}


/* initialize dv_node node cache */
void
dv_node_cache_init()
{
	ASSERT(dv_node_cache == NULL);
	dv_node_cache = kmem_cache_create("dv_node_cache",
	    sizeof (struct dv_node), 0, i_dv_node_ctor, i_dv_node_dtor,
	    NULL, NULL, NULL, 0);

	tsd_create(&devfs_clean_key, NULL);
}

/* destroy dv_node node cache */
void
dv_node_cache_fini()
{
	ASSERT(dv_node_cache != NULL);
	kmem_cache_destroy(dv_node_cache);
	dv_node_cache = NULL;

	tsd_destroy(&devfs_clean_key);
}

/*
 * dv_mkino - Generate a unique inode number for devfs nodes.
 *
 * Although ino_t is 64 bits, the inode number is truncated to 32 bits for 32
 * bit non-LARGEFILE applications. This means that there is a requirement to
 * maintain the inode number as a 32 bit value or applications will have
 * stat(2) calls fail with EOVERFLOW.  We form a 32 bit inode number from the
 * dev_t. but if the minor number is larger than L_MAXMIN32 we fold extra minor
 *
 * To generate inode numbers for directories, we assume that we will never use
 * more than half the major space - this allows for ~8190 drivers. We use this
 * upper major number space to allocate inode numbers for directories by
 * encoding the major and instance into this space.
 *
 * We also skew the result so that inode 2 is reserved for the root of the file
 * system.
 *
 * As part of the future support for 64-bit dev_t APIs, the upper minor bits
 * should be folded into the high inode bits by adding the following code
 * after "ino |= 1":
 *
 * #if (L_BITSMINOR32 != L_BITSMINOR)
 *		|* fold overflow minor bits into high bits of inode number *|
 *		ino |= ((ino_t)(minor >> L_BITSMINOR32)) << L_BITSMINOR;
 * #endif |* (L_BITSMINOR32 != L_BITSMINOR) *|
 *
 * This way only applications that use devices that overflow their minor
 * space will have an application level impact.
 */
static ino_t
dv_mkino(dev_info_t *devi, vtype_t typ, dev_t dev)
{
	major_t		major;
	minor_t		minor;
	ino_t		ino;
	static int	warn;

	if (typ == VDIR) {
		major = ((L_MAXMAJ32 + 1) >> 1) + DEVI(devi)->devi_major;
		minor = ddi_get_instance(devi);

		/* makedevice32 in high half of major number space */
		ino = (ino_t)((major << L_BITSMINOR32) | (minor & L_MAXMIN32));

		major = DEVI(devi)->devi_major;
	} else {
		major = getmajor(dev);
		minor = getminor(dev);

		/* makedevice32 */
		ino = (ino_t)((major << L_BITSMINOR32) | (minor & L_MAXMIN32));

		/* make ino for VCHR different than VBLK */
		ino <<= 1;
		if (typ == VCHR)
			ino |= 1;
	}

	ino += DV_ROOTINO + 1;		/* skew */

	/*
	 * diagnose things a little early because adding the skew to a large
	 * minor number could roll over the major.
	 */
	if ((major >= (L_MAXMAJ32 >> 1)) && (warn == 0)) {
		warn = 1;
		cmn_err(CE_WARN, "%s: inode numbers are not unique", dvnm);
	}

	return (ino);
}

/*
 * Compare two nodes lexographically to balance avl tree
 */
static int
dv_compare_nodes(const struct dv_node *dv1, const struct dv_node *dv2)
{
	int	rv;

	if ((rv = strcmp(dv1->dv_name, dv2->dv_name)) == 0)
		return (0);
	return ((rv < 0) ? -1 : 1);
}

/*
 * dv_mkroot
 *
 * Build the first VDIR dv_node.
 */
struct dv_node *
dv_mkroot(struct vfs *vfsp, dev_t devfsdev)
{
	struct dv_node	*dv;
	struct vnode	*vp;

	ASSERT(ddi_root_node() != NULL);
	ASSERT(dv_node_cache != NULL);

	dcmn_err3(("dv_mkroot\n"));
	dv = kmem_cache_alloc(dv_node_cache, KM_SLEEP);
	vp = DVTOV(dv);
	vn_reinit(vp);
	vp->v_flag = VROOT;
	vp->v_vfsp = vfsp;
	vp->v_type = VDIR;
	vp->v_rdev = devfsdev;
	vn_setops(vp, dv_vnodeops);
	vn_exists(vp);

	dvroot = dv;

	dv->dv_name = NULL;		/* not needed */
	dv->dv_namelen = 0;

	dv->dv_devi = ddi_root_node();

	dv->dv_ino = DV_ROOTINO;
	dv->dv_nlink = 2;		/* name + . (no dv_insert) */
	dv->dv_dotdot = dv;		/* .. == self */
	dv->dv_attrvp = NULLVP;
	dv->dv_attr = NULL;
	dv->dv_flags = DV_BUILD;
	dv->dv_priv = NULL;
	dv->dv_busy = 0;
	dv->dv_dflt_mode = 0;

	avl_create(&dv->dv_entries,
	    (int (*)(const void *, const void *))dv_compare_nodes,
	    sizeof (struct dv_node), offsetof(struct dv_node, dv_avllink));

	return (dv);
}

/*
 * dv_mkdir
 *
 * Given an probed or attached nexus node, create a VDIR dv_node.
 * No dv_attrvp is created at this point.
 */
struct dv_node *
dv_mkdir(struct dv_node *ddv, dev_info_t *devi, char *nm)
{
	struct dv_node	*dv;
	struct vnode	*vp;
	size_t		nmlen;

	ASSERT((devi));
	dcmn_err4(("dv_mkdir: %s\n", nm));

	dv = kmem_cache_alloc(dv_node_cache, KM_SLEEP);
	nmlen = strlen(nm) + 1;
	dv->dv_name = kmem_alloc(nmlen, KM_SLEEP);
	bcopy(nm, dv->dv_name, nmlen);
	dv->dv_namelen = nmlen - 1;	/* '\0' not included */

	vp = DVTOV(dv);
	vn_reinit(vp);
	vp->v_flag = 0;
	vp->v_vfsp = DVTOV(ddv)->v_vfsp;
	vp->v_type = VDIR;
	vp->v_rdev = DVTOV(ddv)->v_rdev;
	vn_setops(vp, vn_getops(DVTOV(ddv)));
	vn_exists(vp);

	dv->dv_devi = devi;
	ndi_hold_devi(devi);

	dv->dv_ino = dv_mkino(devi, VDIR, NODEV);
	dv->dv_nlink = 0;		/* updated on insert */
	dv->dv_dotdot = ddv;
	dv->dv_attrvp = NULLVP;
	dv->dv_attr = NULL;
	dv->dv_flags = DV_BUILD;
	dv->dv_priv = NULL;
	dv->dv_busy = 0;
	dv->dv_dflt_mode = 0;

	avl_create(&dv->dv_entries,
	    (int (*)(const void *, const void *))dv_compare_nodes,
	    sizeof (struct dv_node), offsetof(struct dv_node, dv_avllink));

	return (dv);
}

/*
 * dv_mknod
 *
 * Given a minor node, create a VCHR or VBLK dv_node.
 * No dv_attrvp is created at this point.
 */
static struct dv_node *
dv_mknod(struct dv_node *ddv, dev_info_t *devi, char *nm,
    struct ddi_minor_data *dmd)
{
	struct dv_node	*dv;
	struct vnode	*vp;
	size_t		nmlen;

	dcmn_err4(("dv_mknod: %s\n", nm));

	dv = kmem_cache_alloc(dv_node_cache, KM_SLEEP);
	nmlen = strlen(nm) + 1;
	dv->dv_name = kmem_alloc(nmlen, KM_SLEEP);
	bcopy(nm, dv->dv_name, nmlen);
	dv->dv_namelen = nmlen - 1;	/* no '\0' */

	vp = DVTOV(dv);
	vn_reinit(vp);
	vp->v_flag = 0;
	vp->v_vfsp = DVTOV(ddv)->v_vfsp;
	vp->v_type = dmd->ddm_spec_type == S_IFCHR ? VCHR : VBLK;
	vp->v_rdev = dmd->ddm_dev;
	vn_setops(vp, vn_getops(DVTOV(ddv)));
	vn_exists(vp);

	/* increment dev_ref with devi_lock held */
	ASSERT(DEVI_BUSY_OWNED(devi));
	mutex_enter(&DEVI(devi)->devi_lock);
	dv->dv_devi = devi;
	DEVI(devi)->devi_ref++;		/* ndi_hold_devi(dip) */
	mutex_exit(&DEVI(devi)->devi_lock);

	dv->dv_ino = dv_mkino(devi, vp->v_type, vp->v_rdev);
	dv->dv_nlink = 0;		/* updated on insert */
	dv->dv_dotdot = ddv;
	dv->dv_attrvp = NULLVP;
	dv->dv_attr = NULL;
	dv->dv_flags = 0;

	if (dmd->type == DDM_INTERNAL_PATH)
		dv->dv_flags |= DV_INTERNAL;
	if (dmd->ddm_flags & DM_NO_FSPERM)
		dv->dv_flags |= DV_NO_FSPERM;

	dv->dv_priv = dmd->ddm_node_priv;
	if (dv->dv_priv)
		dphold(dv->dv_priv);

	/*
	 * Minors created with ddi_create_priv_minor_node can specify
	 * a default mode permission other than the devfs default.
	 */
	if (dv->dv_priv || dv->dv_flags & DV_NO_FSPERM) {
		dcmn_err5(("%s: dv_mknod default priv mode 0%o\n",
		    dv->dv_name, dmd->ddm_priv_mode));
		dv->dv_flags |= DV_DFLT_MODE;
		dv->dv_dflt_mode = dmd->ddm_priv_mode & S_IAMB;
	}

	return (dv);
}

/*
 * dv_destroy
 *
 * Destroy what we created in dv_mkdir or dv_mknod.
 * In the case of a *referenced* directory, do nothing.
 */
void
dv_destroy(struct dv_node *dv, uint_t flags)
{
	vnode_t *vp = DVTOV(dv);
	ASSERT(dv->dv_nlink == 0);		/* no references */

	dcmn_err4(("dv_destroy: %s\n", dv->dv_name));

	/*
	 * We may be asked to unlink referenced directories.
	 * In this case, there is nothing to be done.
	 * The eventual memory free will be done in
	 * devfs_inactive.
	 */
	if (vp->v_count != 0) {
		ASSERT(vp->v_type == VDIR);
		ASSERT(flags & DV_CLEAN_FORCE);
		ASSERT(DV_STALE(dv));
		return;
	}

	if (vp->v_type == VDIR) {
		ASSERT(DV_FIRST_ENTRY(dv) == NULL);
		avl_destroy(&dv->dv_entries);
	}

	if (dv->dv_attrvp != NULLVP)
		VN_RELE(dv->dv_attrvp);
	if (dv->dv_attr != NULL)
		kmem_free(dv->dv_attr, sizeof (struct vattr));
	if (dv->dv_name != NULL)
		kmem_free(dv->dv_name, dv->dv_namelen + 1);
	if (dv->dv_devi != NULL) {
		ndi_rele_devi(dv->dv_devi);
	}
	if (dv->dv_priv != NULL) {
		dpfree(dv->dv_priv);
	}

	kmem_cache_free(dv_node_cache, dv);
}

/*
 * Find and hold dv_node by name
 */
static struct dv_node *
dv_findbyname(struct dv_node *ddv, char *nm)
{
	struct dv_node  *dv;
	avl_index_t	where;
	struct dv_node	dvtmp;

	ASSERT(RW_LOCK_HELD(&ddv->dv_contents));
	dcmn_err3(("dv_findbyname: %s\n", nm));

	dvtmp.dv_name = nm;
	dv = avl_find(&ddv->dv_entries, &dvtmp, &where);
	if (dv) {
		ASSERT(dv->dv_dotdot == ddv);
		ASSERT(strcmp(dv->dv_name, nm) == 0);
		VN_HOLD(DVTOV(dv));
		return (dv);
	}
	return (NULL);
}

/*
 * Inserts a new dv_node in a parent directory
 */
void
dv_insert(struct dv_node *ddv, struct dv_node *dv)
{
	avl_index_t	where;

	ASSERT(RW_WRITE_HELD(&ddv->dv_contents));
	ASSERT(DVTOV(ddv)->v_type == VDIR);
	ASSERT(ddv->dv_nlink >= 2);
	ASSERT(dv->dv_nlink == 0);

	dcmn_err3(("dv_insert: %s\n", dv->dv_name));

	dv->dv_dotdot = ddv;
	if (DVTOV(dv)->v_type == VDIR) {
		ddv->dv_nlink++;	/* .. to containing directory */
		dv->dv_nlink = 2;	/* name + . */
	} else {
		dv->dv_nlink = 1;	/* name */
	}

	/* enter node in the avl tree */
	VERIFY(avl_find(&ddv->dv_entries, dv, &where) == NULL);
	avl_insert(&ddv->dv_entries, dv, where);
}

/*
 * Unlink a dv_node from a perent directory
 */
void
dv_unlink(struct dv_node *ddv, struct dv_node *dv)
{
	/* verify linkage of arguments */
	ASSERT(ddv && dv);
	ASSERT(dv->dv_dotdot == ddv);
	ASSERT(RW_WRITE_HELD(&ddv->dv_contents));
	ASSERT(DVTOV(ddv)->v_type == VDIR);

	dcmn_err3(("dv_unlink: %s\n", dv->dv_name));

	if (DVTOV(dv)->v_type == VDIR) {
		ddv->dv_nlink--;	/* .. to containing directory */
		dv->dv_nlink -= 2;	/* name + . */
	} else {
		dv->dv_nlink -= 1;	/* name */
	}
	ASSERT(ddv->dv_nlink >= 2);
	ASSERT(dv->dv_nlink == 0);

	dv->dv_dotdot = NULL;

	/* remove from avl tree */
	avl_remove(&ddv->dv_entries, dv);
}

/*
 * Merge devfs node specific information into an attribute structure.
 *
 * NOTE: specfs provides ATIME,MTIME,CTIME,SIZE,BLKSIZE,NBLOCKS on leaf node.
 */
void
dv_vattr_merge(struct dv_node *dv, struct vattr *vap)
{
	struct vnode	*vp = DVTOV(dv);

	vap->va_nodeid = dv->dv_ino;
	vap->va_nlink = dv->dv_nlink;

	if (vp->v_type == VDIR) {
		vap->va_rdev = 0;
		vap->va_fsid = vp->v_rdev;
	} else {
		vap->va_rdev = vp->v_rdev;
		vap->va_fsid = DVTOV(dv->dv_dotdot)->v_rdev;
		vap->va_type = vp->v_type;
		/* don't trust the shadow file type */
		vap->va_mode &= ~S_IFMT;
		if (vap->va_type == VCHR)
			vap->va_mode |= S_IFCHR;
		else
			vap->va_mode |= S_IFBLK;
	}
}

/*
 * Get default device permission by consulting rules in
 * privilege specification in minor node and /etc/minor_perm.
 *
 * This function is called from the devname filesystem to get default
 * permissions for a device exported to a non-global zone.
 */
void
devfs_get_defattr(struct vnode *vp, struct vattr *vap, int *no_fs_perm)
{
	mperm_t		mp;
	struct dv_node	*dv;

	/* If vp isn't a dv_node, return something sensible */
	if (!vn_matchops(vp, dv_vnodeops)) {
		if (no_fs_perm)
			*no_fs_perm = 0;
		*vap = dv_vattr_file;
		return;
	}

	/*
	 * For minors not created by ddi_create_priv_minor_node(),
	 * use devfs defaults.
	 */
	dv = VTODV(vp);
	if (vp->v_type == VDIR) {
		*vap = dv_vattr_dir;
	} else if (dv->dv_flags & DV_NO_FSPERM) {
		if (no_fs_perm)
			*no_fs_perm = 1;
		*vap = dv_vattr_priv;
	} else {
		/*
		 * look up perm bits from minor_perm
		 */
		*vap = dv_vattr_file;
		if (dev_minorperm(dv->dv_devi, dv->dv_name, &mp) == 0) {
			VATTR_MP_MERGE((*vap), mp);
			dcmn_err5(("%s: minor perm mode 0%o\n",
			    dv->dv_name, vap->va_mode));
		} else if (dv->dv_flags & DV_DFLT_MODE) {
			ASSERT((dv->dv_dflt_mode & ~S_IAMB) == 0);
			vap->va_mode &= ~S_IAMB;
			vap->va_mode |= dv->dv_dflt_mode;
			dcmn_err5(("%s: priv mode 0%o\n",
			    dv->dv_name, vap->va_mode));
		}
	}
}

/*
 * dv_shadow_node
 *
 * Given a VDIR dv_node, find/create the associated VDIR
 * node in the shadow attribute filesystem.
 *
 * Given a VCHR/VBLK dv_node, find the associated VREG
 * node in the shadow attribute filesystem.  These nodes
 * are only created to persist non-default attributes.
 * Lack of such a node implies the default permissions
 * are sufficient.
 *
 * Managing the attribute file entries is slightly tricky (mostly
 * because we can't intercept VN_HOLD and VN_RELE except on the last
 * release).
 *
 * We assert that if the dv_attrvp pointer is non-NULL, it points
 * to a singly-held (by us) vnode that represents the shadow entry
 * in the underlying filesystem.  To avoid store-ordering issues,
 * we assert that the pointer can only be tested under the dv_contents
 * READERS lock.
 */

void
dv_shadow_node(
	struct vnode *dvp,	/* devfs parent directory vnode */
	char *nm,		/* name component */
	struct vnode *vp,	/* devfs vnode */
	struct pathname *pnp,	/* the path .. */
	struct vnode *rdir,	/* the root .. */
	struct cred *cred,	/* who's asking? */
	int flags)		/* optionally create shadow node */
{
	struct dv_node	*dv;	/* dv_node of named directory */
	struct vnode	*rdvp;	/* shadow parent directory vnode */
	struct vnode	*rvp;	/* shadow vnode */
	struct vnode	*rrvp;	/* realvp of shadow vnode */
	struct vattr	vattr;
	int		create_tried;
	int		error;

	ASSERT(vp->v_type == VDIR || vp->v_type == VCHR || vp->v_type == VBLK);
	dv = VTODV(vp);
	dcmn_err3(("dv_shadow_node: name %s attr %p\n",
	    nm, (void *)dv->dv_attrvp));

	if ((flags & DV_SHADOW_WRITE_HELD) == 0) {
		ASSERT(RW_READ_HELD(&dv->dv_contents));
		if (dv->dv_attrvp != NULLVP)
			return;
		if (!rw_tryupgrade(&dv->dv_contents)) {
			rw_exit(&dv->dv_contents);
			rw_enter(&dv->dv_contents, RW_WRITER);
			if (dv->dv_attrvp != NULLVP) {
				rw_downgrade(&dv->dv_contents);
				return;
			}
		}
	} else {
		ASSERT(RW_WRITE_HELD(&dv->dv_contents));
		if (dv->dv_attrvp != NULLVP)
			return;
	}

	ASSERT(RW_WRITE_HELD(&dv->dv_contents) && dv->dv_attrvp == NULL);

	rdvp = VTODV(dvp)->dv_attrvp;
	create_tried = 0;
lookup:
	if (rdvp && (dv->dv_flags & DV_NO_FSPERM) == 0) {
		error = VOP_LOOKUP(rdvp, nm, &rvp, pnp, LOOKUP_DIR, rdir, cred,
		    NULL, NULL, NULL);

		/* factor out the snode since we only want the attribute node */
		if ((error == 0) && (VOP_REALVP(rvp, &rrvp, NULL) == 0)) {
			VN_HOLD(rrvp);
			VN_RELE(rvp);
			rvp = rrvp;
		}
	} else
		error = EROFS;		/* no parent, no entry */

	/*
	 * All we want is the permissions (and maybe ACLs and
	 * extended attributes), and we want to perform lookups
	 * by name.  Drivers occasionally change their minor
	 * number space.  If something changes, there's no
	 * much we can do about it here.
	 */

	/* The shadow node checks out. We are done */
	if (error == 0) {
		dv->dv_attrvp = rvp;	/* with one hold */

		/*
		 * Determine if we have non-trivial ACLs on this node.
		 * It is not necessary to VOP_RWLOCK since fs_acl_nontrivial
		 * only does VOP_GETSECATTR.
		 */
		dv->dv_flags &= ~DV_ACL;

		if (fs_acl_nontrivial(rvp, cred))
			dv->dv_flags |= DV_ACL;

		/*
		 * If we have synced out the memory attributes, free
		 * them and switch back to using the persistent store.
		 */
		if (rvp && dv->dv_attr) {
			kmem_free(dv->dv_attr, sizeof (struct vattr));
			dv->dv_attr = NULL;
		}
		if ((flags & DV_SHADOW_WRITE_HELD) == 0)
			rw_downgrade(&dv->dv_contents);
		ASSERT(RW_LOCK_HELD(&dv->dv_contents));
		return;
	}

	/*
	 * Failed to find attribute in persistent backing store,
	 * get default permission bits.
	 */
	devfs_get_defattr(vp, &vattr, NULL);

	dv_vattr_merge(dv, &vattr);
	gethrestime(&vattr.va_atime);
	vattr.va_mtime = vattr.va_atime;
	vattr.va_ctime = vattr.va_atime;

	/*
	 * Try to create shadow dir. This is necessary in case
	 * we need to create a shadow leaf node later, when user
	 * executes chmod.
	 */
	if ((error == ENOENT) && !create_tried) {
		switch (vp->v_type) {
		case VDIR:
			error = VOP_MKDIR(rdvp, nm, &vattr, &rvp, kcred,
			    NULL, 0, NULL);
			dsysdebug(error, ("vop_mkdir %s %s %d\n",
			    VTODV(dvp)->dv_name, nm, error));
			create_tried = 1;
			break;

		case VCHR:
		case VBLK:
			/*
			 * Shadow nodes are only created on demand
			 */
			if (flags & DV_SHADOW_CREATE) {
				error = VOP_CREATE(rdvp, nm, &vattr, NONEXCL,
				    VREAD|VWRITE, &rvp, kcred, 0, NULL, NULL);
				dsysdebug(error, ("vop_create %s %s %d\n",
				    VTODV(dvp)->dv_name, nm, error));
				create_tried = 1;
			}
			break;

		default:
			cmn_err(CE_PANIC, "devfs: %s: create", dvnm);
			/*NOTREACHED*/
		}

		if (create_tried &&
		    (error == 0) || (error == EEXIST)) {
			VN_RELE(rvp);
			goto lookup;
		}
	}

	/* Store attribute in memory */
	if (dv->dv_attr == NULL) {
		dv->dv_attr = kmem_alloc(sizeof (struct vattr), KM_SLEEP);
		*(dv->dv_attr) = vattr;
	}

	if ((flags & DV_SHADOW_WRITE_HELD) == 0)
		rw_downgrade(&dv->dv_contents);
	ASSERT(RW_LOCK_HELD(&dv->dv_contents));
}

/*
 * Given a devinfo node, and a name, returns the appropriate
 * minor information for that named node, if it exists.
 */
static int
dv_find_leafnode(dev_info_t *devi, char *minor_nm, struct ddi_minor_data *r_mi)
{
	struct ddi_minor_data	*dmd;

	ASSERT(i_ddi_devi_attached(devi));

	dcmn_err3(("dv_find_leafnode: %s\n", minor_nm));
	ASSERT(DEVI_BUSY_OWNED(devi));
	for (dmd = DEVI(devi)->devi_minor; dmd; dmd = dmd->next) {

		/*
		 * Skip alias nodes and nodes without a name.
		 */
		if ((dmd->type == DDM_ALIAS) || (dmd->ddm_name == NULL))
			continue;

		dcmn_err4(("dv_find_leafnode: (%s,%s)\n",
		    minor_nm, dmd->ddm_name));
		if (strcmp(minor_nm, dmd->ddm_name) == 0) {
			r_mi->ddm_dev = dmd->ddm_dev;
			r_mi->ddm_spec_type = dmd->ddm_spec_type;
			r_mi->type = dmd->type;
			r_mi->ddm_flags = dmd->ddm_flags;
			r_mi->ddm_node_priv = dmd->ddm_node_priv;
			r_mi->ddm_priv_mode = dmd->ddm_priv_mode;
			if (r_mi->ddm_node_priv)
				dphold(r_mi->ddm_node_priv);
			return (0);
		}
	}

	dcmn_err3(("dv_find_leafnode: %s: ENOENT\n", minor_nm));
	return (ENOENT);
}

/*
 * Special handling for clone node:
 *	Clone minor name is a driver name, the minor number will
 *	be the major number of the driver. There is no minor
 *	node under the clone driver, so we'll manufacture the
 *	dev_t.
 */
static struct dv_node *
dv_clone_mknod(struct dv_node *ddv, char *drvname)
{
	major_t			major;
	struct dv_node		*dvp;
	char			*devnm;
	struct ddi_minor_data	*dmd;

	/*
	 * Make sure drvname is a STREAMS driver. We load the driver,
	 * but don't attach to any instances. This makes stat(2)
	 * relatively cheap.
	 */
	major = ddi_name_to_major(drvname);
	if (major == DDI_MAJOR_T_NONE)
		return (NULL);

	if (ddi_hold_driver(major) == NULL)
		return (NULL);

	if (STREAMSTAB(major) == NULL) {
		ddi_rele_driver(major);
		return (NULL);
	}

	ddi_rele_driver(major);
	devnm = kmem_alloc(MAXNAMELEN, KM_SLEEP);
	(void) snprintf(devnm, MAXNAMELEN, "clone@0:%s", drvname);
	dmd = kmem_zalloc(sizeof (*dmd), KM_SLEEP);
	dmd->ddm_dev = makedevice(clone_major, (minor_t)major);
	dmd->ddm_spec_type = S_IFCHR;
	dvp = dv_mknod(ddv, clone_dip, devnm, dmd);
	kmem_free(dmd, sizeof (*dmd));
	kmem_free(devnm, MAXNAMELEN);
	return (dvp);
}

/*
 * Given the parent directory node, and a name in it, returns the
 * named dv_node to the caller (as a vnode).
 *
 * (We need pnp and rdir for doing shadow lookups; they can be NULL)
 */
int
dv_find(struct dv_node *ddv, char *nm, struct vnode **vpp, struct pathname *pnp,
    struct vnode *rdir, struct cred *cred, uint_t ndi_flags)
{
	extern int isminiroot;	/* see modctl.c */

	int			rv = 0, was_busy = 0, nmlen, write_held = 0;
	struct vnode		*vp;
	struct dv_node		*dv, *dup;
	dev_info_t		*pdevi, *devi = NULL;
	char			*mnm;
	struct ddi_minor_data	*dmd;

	dcmn_err3(("dv_find %s\n", nm));

	if (!rw_tryenter(&ddv->dv_contents, RW_READER)) {
		if (tsd_get(devfs_clean_key))
			return (EBUSY);
		rw_enter(&ddv->dv_contents, RW_READER);
	}
start:
	if (DV_STALE(ddv)) {
		rw_exit(&ddv->dv_contents);
		return (ESTALE);
	}

	/*
	 * Empty name or ., return node itself.
	 */
	nmlen = strlen(nm);
	if ((nmlen == 0) || ((nmlen == 1) && (nm[0] == '.'))) {
		*vpp = DVTOV(ddv);
		rw_exit(&ddv->dv_contents);
		VN_HOLD(*vpp);
		return (0);
	}

	/*
	 * .., return the parent directory
	 */
	if ((nmlen == 2) && (strcmp(nm, "..") == 0)) {
		*vpp = DVTOV(ddv->dv_dotdot);
		rw_exit(&ddv->dv_contents);
		VN_HOLD(*vpp);
		return (0);
	}

	/*
	 * Fail anything without a valid device name component
	 */
	if (nm[0] == '@' || nm[0] == ':') {
		dcmn_err3(("devfs: no driver '%s'\n", nm));
		rw_exit(&ddv->dv_contents);
		return (ENOENT);
	}

	/*
	 * So, now we have to deal with the trickier stuff.
	 *
	 * (a) search the existing list of dv_nodes on this directory
	 */
	if ((dv = dv_findbyname(ddv, nm)) != NULL) {
founddv:
		ASSERT(RW_LOCK_HELD(&ddv->dv_contents));

		if (!rw_tryenter(&dv->dv_contents, RW_READER)) {
			if (tsd_get(devfs_clean_key)) {
				VN_RELE(DVTOV(dv));
				rw_exit(&ddv->dv_contents);
				return (EBUSY);
			}
			rw_enter(&dv->dv_contents, RW_READER);
		}

		vp = DVTOV(dv);
		if ((dv->dv_attrvp != NULLVP) ||
		    (vp->v_type != VDIR && dv->dv_attr != NULL)) {
			/*
			 * Common case - we already have attributes
			 */
			rw_exit(&dv->dv_contents);
			rw_exit(&ddv->dv_contents);
			goto found;
		}

		/*
		 * No attribute vp, try and build one.
		 *
		 * dv_shadow_node() can briefly drop &dv->dv_contents lock
		 * if it is unable to upgrade it to a write lock. If the
		 * current thread has come in through the bottom-up device
		 * configuration devfs_clean() path, we may deadlock against
		 * a thread performing top-down device configuration if it
		 * grabs the contents lock. To avoid this, when we are on the
		 * devfs_clean() path we attempt to upgrade the dv_contents
		 * lock before we call dv_shadow_node().
		 */
		if (tsd_get(devfs_clean_key)) {
			if (!rw_tryupgrade(&dv->dv_contents)) {
				VN_RELE(DVTOV(dv));
				rw_exit(&dv->dv_contents);
				rw_exit(&ddv->dv_contents);
				return (EBUSY);
			}

			write_held = DV_SHADOW_WRITE_HELD;
		}

		dv_shadow_node(DVTOV(ddv), nm, vp, pnp, rdir, cred,
		    write_held);

		rw_exit(&dv->dv_contents);
		rw_exit(&ddv->dv_contents);
		goto found;
	}

	/*
	 * (b) Search the child devinfo nodes of our parent directory,
	 * looking for the named node.  If we find it, build a new
	 * node, then grab the writers lock, search the directory
	 * if it's still not there, then insert it.
	 *
	 * We drop the devfs locks before accessing the device tree.
	 * Take care to mark the node BUSY so that a forced devfs_clean
	 * doesn't mark the directory node stale.
	 *
	 * Also, check if we are called as part of devfs_clean or
	 * reset_perm. If so, simply return not found because there
	 * is nothing to clean.
	 */
	if (tsd_get(devfs_clean_key)) {
		rw_exit(&ddv->dv_contents);
		return (ENOENT);
	}

	/*
	 * We could be either READ or WRITE locked at
	 * this point. Upgrade if we are read locked.
	 */
	ASSERT(RW_LOCK_HELD(&ddv->dv_contents));
	if (rw_read_locked(&ddv->dv_contents) &&
	    !rw_tryupgrade(&ddv->dv_contents)) {
		rw_exit(&ddv->dv_contents);
		rw_enter(&ddv->dv_contents, RW_WRITER);
		/*
		 * Things may have changed when we dropped
		 * the contents lock, so start from top again
		 */
		goto start;
	}
	ddv->dv_busy++;		/* mark busy before dropping lock */
	was_busy++;
	rw_exit(&ddv->dv_contents);

	pdevi = ddv->dv_devi;
	ASSERT(pdevi != NULL);

	mnm = strchr(nm, ':');
	if (mnm)
		*mnm = (char)0;

	/*
	 * Configure one nexus child, will call nexus's bus_ops
	 * If successful, devi is held upon returning.
	 * Note: devfs lookup should not be configuring grandchildren.
	 */
	ASSERT((ndi_flags & NDI_CONFIG) == 0);

	rv = ndi_devi_config_one(pdevi, nm, &devi, ndi_flags | NDI_NO_EVENT);
	if (mnm)
		*mnm = ':';
	if (rv != NDI_SUCCESS) {
		rv = ENOENT;
		goto notfound;
	}

	ASSERT(devi);

	/* Check if this is a path alias */
	if (ddi_aliases_present == B_TRUE && ddi_get_parent(devi) != pdevi) {
		char *curr = kmem_alloc(MAXPATHLEN, KM_SLEEP);

		(void) ddi_pathname(devi, curr);

		vp = NULL;
		if (devfs_lookupname(curr, NULL, &vp) == 0 && vp) {
			dv = VTODV(vp);
			kmem_free(curr, MAXPATHLEN);
			goto found;
		}
		kmem_free(curr, MAXPATHLEN);
	}

	/*
	 * If we configured a hidden node, consider it notfound.
	 */
	if (ndi_dev_is_hidden_node(devi)) {
		ndi_rele_devi(devi);
		rv = ENOENT;
		goto notfound;
	}

	/*
	 * Don't make vhci clients visible under phci, unless we
	 * are in miniroot.
	 */
	if (isminiroot == 0 && ddi_get_parent(devi) != pdevi) {
		ndi_rele_devi(devi);
		rv = ENOENT;
		goto notfound;
	}

	ASSERT(devi && i_ddi_devi_attached(devi));

	/*
	 * Invalidate cache to notice newly created minor nodes.
	 */
	rw_enter(&ddv->dv_contents, RW_WRITER);
	ddv->dv_flags |= DV_BUILD;
	rw_exit(&ddv->dv_contents);

	/*
	 * mkdir for nexus drivers and leaf nodes as well.  If we are racing
	 * and create a duplicate, the duplicate will be destroyed below.
	 */
	if (mnm == NULL) {
		dv = dv_mkdir(ddv, devi, nm);
	} else {
		/*
		 * Allocate dmd first to avoid KM_SLEEP with active
		 * ndi_devi_enter.
		 */
		dmd = kmem_zalloc(sizeof (*dmd), KM_SLEEP);
		ndi_devi_enter(devi);
		if (devi == clone_dip) {
			/*
			 * For clone minors, load the driver indicated by
			 * minor name.
			 */
			dv = dv_clone_mknod(ddv, mnm + 1);
		} else {
			/*
			 * Find minor node and make a dv_node
			 */
			if (dv_find_leafnode(devi, mnm + 1, dmd) == 0) {
				dv = dv_mknod(ddv, devi, nm, dmd);
				if (dmd->ddm_node_priv)
					dpfree(dmd->ddm_node_priv);
			}
		}
		ndi_devi_exit(devi);
		kmem_free(dmd, sizeof (*dmd));
	}
	/*
	 * Release hold from ndi_devi_config_one()
	 */
	ndi_rele_devi(devi);

	if (dv == NULL) {
		rv = ENOENT;
		goto notfound;
	}

	/*
	 * We have released the dv_contents lock, need to check
	 * if another thread already created a duplicate node
	 */
	rw_enter(&ddv->dv_contents, RW_WRITER);
	if ((dup = dv_findbyname(ddv, nm)) == NULL) {
		dv_insert(ddv, dv);
	} else {
		/*
		 * Duplicate found, use the existing node
		 */
		VN_RELE(DVTOV(dv));
		dv_destroy(dv, 0);
		dv = dup;
	}
	goto founddv;
	/*NOTREACHED*/

found:
	/*
	 * Fail lookup of device that has now become hidden (typically via
	 * hot removal of open device).
	 */
	if (dv->dv_devi && ndi_dev_is_hidden_node(dv->dv_devi)) {
		dcmn_err2(("dv_find: nm %s failed: hidden/removed\n", nm));
		VN_RELE(vp);
		rv = ENOENT;
		goto notfound;
	}

	/*
	 * Skip non-kernel lookups of internal nodes.
	 * This use of kcred to distinguish between user and
	 * internal kernel lookups is unfortunate.  The information
	 * provided by the seg argument to lookupnameat should
	 * evolve into a lookup flag for filesystems that need
	 * this distinction.
	 */
	if ((dv->dv_flags & DV_INTERNAL) && (cred != kcred)) {
		dcmn_err2(("dv_find: nm %s failed: internal\n", nm));
		VN_RELE(vp);
		rv = ENOENT;
		goto notfound;
	}

	dcmn_err2(("dv_find: returning vp for nm %s\n", nm));
	if (vp->v_type == VCHR || vp->v_type == VBLK) {
		/*
		 * If vnode is a device, return special vnode instead
		 * (though it knows all about -us- via sp->s_realvp,
		 * sp->s_devvp, and sp->s_dip)
		 */
		*vpp = specvp_devfs(vp, vp->v_rdev, vp->v_type, cred,
		    dv->dv_devi);
		VN_RELE(vp);
		if (*vpp == NULLVP)
			rv = ENOSYS;
	} else
		*vpp = vp;

notfound:
	if (was_busy) {
		/*
		 * Non-zero was_busy tells us that we are not in the
		 * devfs_clean() path which in turn means that we can afford
		 * to take the contents lock unconditionally.
		 */
		rw_enter(&ddv->dv_contents, RW_WRITER);
		ddv->dv_busy--;
		rw_exit(&ddv->dv_contents);
	}
	return (rv);
}

/*
 * The given directory node is out-of-date; that is, it has been
 * marked as needing to be rebuilt, possibly because some new devinfo
 * node has come into existence, or possibly because this is the first
 * time we've been here.
 */
void
dv_filldir(struct dv_node *ddv)
{
	struct dv_node		*dv;
	dev_info_t		*devi, *pdevi;
	struct ddi_minor_data	*dmd;
	char			devnm[MAXNAMELEN];

	ASSERT(DVTOV(ddv)->v_type == VDIR);
	ASSERT(RW_WRITE_HELD(&ddv->dv_contents));
	ASSERT(ddv->dv_flags & DV_BUILD);

	dcmn_err3(("dv_filldir: %s\n", ddv->dv_name));
	if (DV_STALE(ddv))
		return;
	pdevi = ddv->dv_devi;

	if (ndi_devi_config(pdevi, NDI_NO_EVENT) != NDI_SUCCESS) {
		dcmn_err3(("dv_filldir: config error %s\n", ddv->dv_name));
	}

	ndi_devi_enter(pdevi);
	for (devi = ddi_get_child(pdevi); devi;
	    devi = ddi_get_next_sibling(devi)) {
		/*
		 * While we know enough to create a directory at DS_INITIALIZED,
		 * the directory will be empty until DS_ATTACHED. The existence
		 * of an empty directory dv_node will cause a devi_ref, which
		 * has caused problems for existing code paths doing offline/DR
		 * type operations - making devfs_clean coordination even more
		 * sensitive and error prone. Given this, the 'continue' below
		 * is checking for DS_ATTACHED instead of DS_INITIALIZED.
		 */
		if (i_ddi_node_state(devi) < DS_ATTACHED)
			continue;

		/* skip hidden nodes */
		if (ndi_dev_is_hidden_node(devi))
			continue;

		dcmn_err3(("dv_filldir: node %s\n", ddi_node_name(devi)));

		ndi_devi_enter(devi);
		for (dmd = DEVI(devi)->devi_minor; dmd; dmd = dmd->next) {
			char *addr;

			/*
			 * Skip alias nodes, internal nodes, and nodes
			 * without a name.  We allow DDM_DEFAULT nodes
			 * to appear in readdir.
			 */
			if ((dmd->type == DDM_ALIAS) ||
			    (dmd->type == DDM_INTERNAL_PATH) ||
			    (dmd->ddm_name == NULL))
				continue;

			addr = ddi_get_name_addr(devi);
			if (addr && *addr)
				(void) sprintf(devnm, "%s@%s:%s",
				    ddi_node_name(devi), addr, dmd->ddm_name);
			else
				(void) sprintf(devnm, "%s:%s",
				    ddi_node_name(devi), dmd->ddm_name);

			if ((dv = dv_findbyname(ddv, devnm)) != NULL) {
				/* dv_node already exists */
				VN_RELE(DVTOV(dv));
				continue;
			}

			dv = dv_mknod(ddv, devi, devnm, dmd);
			dv_insert(ddv, dv);
			VN_RELE(DVTOV(dv));
		}
		ndi_devi_exit(devi);

		(void) ddi_deviname(devi, devnm);
		if ((dv = dv_findbyname(ddv, devnm + 1)) == NULL) {
			/* directory doesn't exist */
			dv = dv_mkdir(ddv, devi, devnm + 1);
			dv_insert(ddv, dv);
		}
		VN_RELE(DVTOV(dv));
	}
	ndi_devi_exit(pdevi);

	ddv->dv_flags &= ~DV_BUILD;
}

/*
 * Given a directory node, clean out all the nodes beneath.
 *
 * VDIR:	Reinvoke to clean them, then delete the directory.
 * VCHR, VBLK:	Just blow them away.
 *
 * Mark the directories touched as in need of a rebuild, in case
 * we fall over part way through. When DV_CLEAN_FORCE is specified,
 * we mark referenced empty directories as stale to facilitate DR.
 */
int
dv_cleandir(struct dv_node *ddv, char *devnm, uint_t flags)
{
	struct dv_node	*dv;
	struct dv_node	*next;
	struct vnode	*vp;
	int		busy = 0;

	/*
	 * We should always be holding the tsd_clean_key here: dv_cleandir()
	 * will be called as a result of a devfs_clean request and the
	 * tsd_clean_key will be set in either in devfs_clean() itself or in
	 * devfs_clean_vhci().
	 *
	 * Since we are on the devfs_clean path, we return EBUSY if we cannot
	 * get the contents lock: if we blocked here we might deadlock against
	 * a thread performing top-down device configuration.
	 */
	ASSERT(tsd_get(devfs_clean_key));

	dcmn_err3(("dv_cleandir: %s\n", ddv->dv_name));

	if (!(flags & DV_CLEANDIR_LCK) &&
	    !rw_tryenter(&ddv->dv_contents, RW_WRITER))
		return (EBUSY);

	for (dv = DV_FIRST_ENTRY(ddv); dv; dv = next) {
		next = DV_NEXT_ENTRY(ddv, dv);

		/*
		 * If devnm is specified, the non-minor portion of the
		 * name must match devnm.
		 */
		if (devnm &&
		    (strncmp(devnm, dv->dv_name, strlen(devnm)) ||
		    (dv->dv_name[strlen(devnm)] != ':' &&
		    dv->dv_name[strlen(devnm)] != '\0')))
			continue;

		/* check type of what we are cleaning */
		vp = DVTOV(dv);
		if (vp->v_type == VDIR) {
			/* recurse on directories */
			rw_enter(&dv->dv_contents, RW_WRITER);
			if (dv_cleandir(dv, NULL,
			    flags | DV_CLEANDIR_LCK) == EBUSY) {
				rw_exit(&dv->dv_contents);
				goto set_busy;
			}

			/* A clean directory is an empty directory... */
			ASSERT(dv->dv_nlink == 2);
			mutex_enter(&vp->v_lock);
			if (vp->v_count > 0) {
				/*
				 * ... but an empty directory can still have
				 * references to it. If we have dv_busy or
				 * DV_CLEAN_FORCE is *not* specified then a
				 * referenced directory is considered busy.
				 */
				if (dv->dv_busy || !(flags & DV_CLEAN_FORCE)) {
					mutex_exit(&vp->v_lock);
					rw_exit(&dv->dv_contents);
					goto set_busy;
				}

				/*
				 * Mark referenced directory stale so that DR
				 * will succeed even if a shell has
				 * /devices/xxx as current directory (causing
				 * VN_HOLD reference to an empty directory).
				 */
				ASSERT(!DV_STALE(dv));
				ndi_rele_devi(dv->dv_devi);
				dv->dv_devi = NULL;	/* mark DV_STALE */
			}
		} else {
			ASSERT((vp->v_type == VCHR) || (vp->v_type == VBLK));
			ASSERT(dv->dv_nlink == 1);	/* no hard links */
			mutex_enter(&vp->v_lock);
			if (vp->v_count > 0) {
				mutex_exit(&vp->v_lock);
				goto set_busy;
			}
		}

		/* unlink from directory */
		dv_unlink(ddv, dv);

		/* drop locks */
		mutex_exit(&vp->v_lock);
		if (vp->v_type == VDIR)
			rw_exit(&dv->dv_contents);

		/* destroy vnode if ref count is zero */
		if (vp->v_count == 0)
			dv_destroy(dv, flags);

		continue;

		/*
		 * If devnm is not NULL we return immediately on busy,
		 * otherwise we continue destroying unused dv_node's.
		 */
set_busy:	busy++;
		if (devnm)
			break;
	}

	/*
	 * This code may be invoked to inform devfs that a new node has
	 * been created in the kernel device tree. So we always set
	 * the DV_BUILD flag to allow the next dv_filldir() to pick
	 * the new devinfo nodes.
	 */
	ddv->dv_flags |= DV_BUILD;

	if (!(flags & DV_CLEANDIR_LCK))
		rw_exit(&ddv->dv_contents);

	return (busy ? EBUSY : 0);
}

/*
 * Walk through the devfs hierarchy, correcting the permissions of
 * devices with default permissions that do not match those specified
 * by minor perm.  This can only be done for all drivers for now.
 */
static int
dv_reset_perm_dir(struct dv_node *ddv, uint_t flags)
{
	struct dv_node	*dv;
	struct vnode	*vp;
	int		retval = 0;
	struct vattr	*attrp;
	mperm_t		mp;
	char		*nm;
	uid_t		old_uid;
	gid_t		old_gid;
	mode_t		old_mode;

	rw_enter(&ddv->dv_contents, RW_WRITER);
	for (dv = DV_FIRST_ENTRY(ddv); dv; dv = DV_NEXT_ENTRY(ddv, dv)) {
		int error = 0;
		nm = dv->dv_name;

		rw_enter(&dv->dv_contents, RW_READER);
		vp = DVTOV(dv);
		if (vp->v_type == VDIR) {
			rw_exit(&dv->dv_contents);
			if (dv_reset_perm_dir(dv, flags) != 0) {
				error = EBUSY;
			}
		} else {
			ASSERT(vp->v_type == VCHR || vp->v_type == VBLK);

			/*
			 * Check for permissions from minor_perm
			 * If there are none, we're done
			 */
			rw_exit(&dv->dv_contents);
			if (dev_minorperm(dv->dv_devi, nm, &mp) != 0)
				continue;

			rw_enter(&dv->dv_contents, RW_READER);

			/*
			 * Allow a node's permissions to be altered
			 * permanently from the defaults by chmod,
			 * using the shadow node as backing store.
			 * Otherwise, update node to minor_perm permissions.
			 */
			if (dv->dv_attrvp == NULLVP) {
				/*
				 * No attribute vp, try to find one.
				 */
				dv_shadow_node(DVTOV(ddv), nm, vp,
				    NULL, NULLVP, kcred, 0);
			}
			if (dv->dv_attrvp != NULLVP || dv->dv_attr == NULL) {
				rw_exit(&dv->dv_contents);
				continue;
			}

			attrp = dv->dv_attr;

			if (VATTRP_MP_CMP(attrp, mp) == 0) {
				dcmn_err5(("%s: no perm change: "
				    "%d %d 0%o\n", nm, attrp->va_uid,
				    attrp->va_gid, attrp->va_mode));
				rw_exit(&dv->dv_contents);
				continue;
			}

			old_uid = attrp->va_uid;
			old_gid = attrp->va_gid;
			old_mode = attrp->va_mode;

			VATTRP_MP_MERGE(attrp, mp);
			mutex_enter(&vp->v_lock);
			if (vp->v_count > 0) {
				error = EBUSY;
			}
			mutex_exit(&vp->v_lock);

			dcmn_err5(("%s: perm %d/%d/0%o -> %d/%d/0%o (%d)\n",
			    nm, old_uid, old_gid, old_mode, attrp->va_uid,
			    attrp->va_gid, attrp->va_mode, error));

			rw_exit(&dv->dv_contents);
		}

		if (error != 0) {
			retval = error;
		}
	}

	ddv->dv_flags |= DV_BUILD;

	rw_exit(&ddv->dv_contents);

	return (retval);
}

int
devfs_reset_perm(uint_t flags)
{
	struct dv_node	*dvp;
	int		rval;

	if ((dvp = devfs_dip_to_dvnode(ddi_root_node())) == NULL)
		return (0);

	VN_HOLD(DVTOV(dvp));
	rval = dv_reset_perm_dir(dvp, flags);
	VN_RELE(DVTOV(dvp));
	return (rval);
}

/*
 * Clean up dangling devfs shadow nodes for removed
 * drivers so that, in the event the driver is re-added
 * to the system, newly created nodes won't incorrectly
 * pick up these stale shadow node permissions.
 *
 * This is accomplished by walking down the pathname
 * to the directory, starting at the root's attribute
 * node, then removing all minors matching the specified
 * node name.  Care must be taken to remove all entries
 * in a directory before the directory itself, so that
 * the clean-up associated with rem_drv'ing a nexus driver
 * does not inadvertently result in an inconsistent
 * filesystem underlying devfs.
 */

static int
devfs_remdrv_rmdir(vnode_t *dirvp, const char *dir, vnode_t *rvp)
{
	int		error;
	vnode_t		*vp;
	int		eof;
	struct iovec	iov;
	struct uio	uio;
	struct dirent64	*dp;
	dirent64_t	*dbuf;
	size_t		dlen;
	size_t		dbuflen;
	int		ndirents = 64;
	char		*nm;

	VN_HOLD(dirvp);

	dlen = ndirents * (sizeof (*dbuf));
	dbuf = kmem_alloc(dlen, KM_SLEEP);

	uio.uio_iov = &iov;
	uio.uio_iovcnt = 1;
	uio.uio_segflg = UIO_SYSSPACE;
	uio.uio_fmode = 0;
	uio.uio_extflg = UIO_COPY_CACHED;
	uio.uio_loffset = 0;
	uio.uio_llimit = MAXOFFSET_T;

	eof = 0;
	error = 0;
	while (!error && !eof) {
		uio.uio_resid = dlen;
		iov.iov_base = (char *)dbuf;
		iov.iov_len = dlen;

		(void) VOP_RWLOCK(dirvp, V_WRITELOCK_FALSE, NULL);
		error = VOP_READDIR(dirvp, &uio, kcred, &eof, NULL, 0);
		VOP_RWUNLOCK(dirvp, V_WRITELOCK_FALSE, NULL);

		dbuflen = dlen - uio.uio_resid;

		if (error || dbuflen == 0)
			break;

		for (dp = dbuf; ((intptr_t)dp < (intptr_t)dbuf + dbuflen);
		    dp = (dirent64_t *)((intptr_t)dp + dp->d_reclen)) {

			nm = dp->d_name;

			if (strcmp(nm, ".") == 0 || strcmp(nm, "..") == 0)
				continue;

			error = VOP_LOOKUP(dirvp, nm,
			    &vp, NULL, 0, NULL, kcred, NULL, NULL, NULL);

			dsysdebug(error,
			    ("rem_drv %s/%s lookup (%d)\n",
			    dir, nm, error));

			if (error)
				continue;

			ASSERT(vp->v_type == VDIR ||
			    vp->v_type == VCHR || vp->v_type == VBLK);

			if (vp->v_type == VDIR) {
				error = devfs_remdrv_rmdir(vp, nm, rvp);
				if (error == 0) {
					error = VOP_RMDIR(dirvp,
					    (char *)nm, rvp, kcred, NULL, 0);
					dsysdebug(error,
					    ("rem_drv %s/%s rmdir (%d)\n",
					    dir, nm, error));
				}
			} else {
				error = VOP_REMOVE(dirvp, (char *)nm, kcred,
				    NULL, 0);
				dsysdebug(error,
				    ("rem_drv %s/%s remove (%d)\n",
				    dir, nm, error));
			}

			VN_RELE(vp);
			if (error) {
				goto exit;
			}
		}
	}

exit:
	VN_RELE(dirvp);
	kmem_free(dbuf, dlen);

	return (error);
}

int
devfs_remdrv_cleanup(const char *dir, const char *nodename)
{
	int		error;
	vnode_t		*vp;
	vnode_t		*dirvp;
	int		eof;
	struct iovec	iov;
	struct uio	uio;
	struct dirent64	*dp;
	dirent64_t	*dbuf;
	size_t		dlen;
	size_t		dbuflen;
	int		ndirents = 64;
	int		nodenamelen = strlen(nodename);
	char		*nm;
	struct pathname	pn;
	vnode_t		*rvp;	/* root node of the underlying attribute fs */

	dcmn_err5(("devfs_remdrv_cleanup: %s %s\n", dir, nodename));

	if (error = pn_get((char *)dir, UIO_SYSSPACE, &pn))
		return (0);

	rvp = dvroot->dv_attrvp;
	ASSERT(rvp != NULL);
	VN_HOLD(rvp);

	pn_skipslash(&pn);
	dirvp = rvp;
	VN_HOLD(dirvp);

	nm = kmem_alloc(MAXNAMELEN, KM_SLEEP);

	while (pn_pathleft(&pn)) {
		ASSERT(dirvp->v_type == VDIR);
		(void) pn_getcomponent(&pn, nm);
		ASSERT((strcmp(nm, ".") != 0) && (strcmp(nm, "..") != 0));
		error = VOP_LOOKUP(dirvp, nm, &vp, NULL, 0, rvp, kcred,
		    NULL, NULL, NULL);
		if (error) {
			dcmn_err5(("remdrv_cleanup %s lookup error %d\n",
			    nm, error));
			VN_RELE(dirvp);
			if (dirvp != rvp)
				VN_RELE(rvp);
			pn_free(&pn);
			kmem_free(nm, MAXNAMELEN);
			return (0);
		}
		VN_RELE(dirvp);
		dirvp = vp;
		pn_skipslash(&pn);
	}

	ASSERT(dirvp->v_type == VDIR);
	if (dirvp != rvp)
		VN_RELE(rvp);
	pn_free(&pn);
	kmem_free(nm, MAXNAMELEN);

	dlen = ndirents * (sizeof (*dbuf));
	dbuf = kmem_alloc(dlen, KM_SLEEP);

	uio.uio_iov = &iov;
	uio.uio_iovcnt = 1;
	uio.uio_segflg = UIO_SYSSPACE;
	uio.uio_fmode = 0;
	uio.uio_extflg = UIO_COPY_CACHED;
	uio.uio_loffset = 0;
	uio.uio_llimit = MAXOFFSET_T;

	eof = 0;
	error = 0;
	while (!error && !eof) {
		uio.uio_resid = dlen;
		iov.iov_base = (char *)dbuf;
		iov.iov_len = dlen;

		(void) VOP_RWLOCK(dirvp, V_WRITELOCK_FALSE, NULL);
		error = VOP_READDIR(dirvp, &uio, kcred, &eof, NULL, 0);
		VOP_RWUNLOCK(dirvp, V_WRITELOCK_FALSE, NULL);

		dbuflen = dlen - uio.uio_resid;

		if (error || dbuflen == 0)
			break;

		for (dp = dbuf; ((intptr_t)dp < (intptr_t)dbuf + dbuflen);
		    dp = (dirent64_t *)((intptr_t)dp + dp->d_reclen)) {

			nm = dp->d_name;

			if (strcmp(nm, ".") == 0 || strcmp(nm, "..") == 0)
				continue;

			if (strncmp(nm, nodename, nodenamelen) != 0)
				continue;

			error = VOP_LOOKUP(dirvp, nm, &vp,
			    NULL, 0, NULL, kcred, NULL, NULL, NULL);

			dsysdebug(error,
			    ("rem_drv %s/%s lookup (%d)\n",
			    dir, nm, error));

			if (error)
				continue;

			ASSERT(vp->v_type == VDIR ||
			    vp->v_type == VCHR || vp->v_type == VBLK);

			if (vp->v_type == VDIR) {
				error = devfs_remdrv_rmdir(vp, nm, rvp);
				if (error == 0) {
					error = VOP_RMDIR(dirvp, (char *)nm,
					    rvp, kcred, NULL, 0);
					dsysdebug(error,
					    ("rem_drv %s/%s rmdir (%d)\n",
					    dir, nm, error));
				}
			} else {
				error = VOP_REMOVE(dirvp, (char *)nm, kcred,
				    NULL, 0);
				dsysdebug(error,
				    ("rem_drv %s/%s remove (%d)\n",
				    dir, nm, error));
			}

			VN_RELE(vp);
			if (error)
				goto exit;
		}
	}

exit:
	VN_RELE(dirvp);

	kmem_free(dbuf, dlen);

	return (0);
}

struct dv_list {
	struct dv_node	*dv;
	struct dv_list	*next;
};

void
dv_walk(
	struct dv_node	*ddv,
	char		*devnm,
	void		(*callback)(struct dv_node *, void *),
	void		*arg)
{
	struct vnode	*dvp;
	struct dv_node	*dv;
	struct dv_list	*head, *tail, *next;
	int		len;

	dcmn_err3(("dv_walk: ddv = %s, devnm = %s\n",
	    ddv->dv_name, devnm ? devnm : "<null>"));

	dvp = DVTOV(ddv);

	ASSERT(dvp->v_type == VDIR);

	head = tail = next = NULL;

	rw_enter(&ddv->dv_contents, RW_READER);
	mutex_enter(&dvp->v_lock);
	for (dv = DV_FIRST_ENTRY(ddv); dv; dv = DV_NEXT_ENTRY(ddv, dv)) {
		/*
		 * If devnm is not NULL and is not the empty string,
		 * select only dv_nodes with matching non-minor name
		 */
		if (devnm && (len = strlen(devnm)) &&
		    (strncmp(devnm, dv->dv_name, len) ||
		    (dv->dv_name[len] != ':' && dv->dv_name[len] != '\0')))
			continue;

		callback(dv, arg);

		if (DVTOV(dv)->v_type != VDIR)
			continue;

		next = kmem_zalloc(sizeof (*next), KM_SLEEP);
		next->dv = dv;

		if (tail)
			tail->next = next;
		else
			head = next;

		tail = next;
	}

	while (head) {
		dv_walk(head->dv, NULL, callback, arg);
		next = head->next;
		kmem_free(head, sizeof (*head));
		head = next;
	}
	rw_exit(&ddv->dv_contents);
	mutex_exit(&dvp->v_lock);
}
/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License (the "License").
 * You may not use this file except in compliance with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */
/*
 * Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
 * Use is subject to license terms.
 */

/*
 * This is the device filesystem.
 *
 * It is a combination of a namer to drive autoconfiguration,
 * plus the access methods for the device drivers of the system.
 *
 * The prototype is fairly dependent on specfs for the latter part
 * of its implementation, though a final version would integrate the two.
 */
#include <sys/types.h>
#include <sys/param.h>
#include <sys/sysmacros.h>
#include <sys/systm.h>
#include <sys/kmem.h>
#include <sys/time.h>
#include <sys/pathname.h>
#include <sys/vfs.h>
#include <sys/vfs_opreg.h>
#include <sys/vnode.h>
#include <sys/stat.h>
#include <sys/uio.h>
#include <sys/stat.h>
#include <sys/errno.h>
#include <sys/cmn_err.h>
#include <sys/cred.h>
#include <sys/statvfs.h>
#include <sys/mount.h>
#include <sys/debug.h>
#include <sys/modctl.h>
#include <fs/fs_subr.h>
#include <sys/fs/dv_node.h>
#include <sys/fs/snode.h>
#include <sys/sunndi.h>
#include <sys/policy.h>
#include <sys/sunmdi.h>

/*
 * devfs vfs operations.
 */
static int devfs_mount(struct vfs *, struct vnode *, struct mounta *,
    struct cred *);
static int devfs_unmount(struct vfs *, int, struct cred *);
static int devfs_root(struct vfs *, struct vnode **);
static int devfs_statvfs(struct vfs *, struct statvfs64 *);
static int devfs_mountroot(struct vfs *, enum whymountroot);

static int devfsinit(int, char *);

static vfsdef_t devfs_vfssw = {
	VFSDEF_VERSION,
	"devfs",	/* type name string */
	devfsinit,	/* init routine */
	0,		/* flags */
	NULL		/* mount options table prototype */
};

static kmutex_t devfs_lock;	/* protects global data */
static int devfstype;		/* fstype */
static dev_t devfsdev;		/* the fictious 'device' we live on */
static struct devfs_data *devfs_mntinfo;	/* linked list of instances */

/*
 * Module linkage information
 */
static struct modlfs modlfs = {
	&mod_fsops, "devices filesystem", &devfs_vfssw
};

static struct modlinkage modlinkage = {
	MODREV_1, (void *)&modlfs, NULL
};

int
_init(void)
{
	int e;

	mutex_init(&devfs_lock, "devfs lock", MUTEX_DEFAULT, NULL);
	dv_node_cache_init();
	if ((e = mod_install(&modlinkage)) != 0) {
		dv_node_cache_fini();
		mutex_destroy(&devfs_lock);
		return (e);
	}
	dcmn_err(("devfs loaded\n"));
	return (0);
}

int
_fini(void)
{
	return (EBUSY);
}

int
_info(struct modinfo *modinfop)
{
	return (mod_info(&modlinkage, modinfop));
}

/*ARGSUSED1*/
static int
devfsinit(int fstype, char *name)
{
	static const fs_operation_def_t devfs_vfsops_template[] = {
		VFSNAME_MOUNT,		{ .vfs_mount = devfs_mount },
		VFSNAME_UNMOUNT,	{ .vfs_unmount = devfs_unmount },
		VFSNAME_ROOT,		{ .vfs_root = devfs_root },
		VFSNAME_STATVFS,	{ .vfs_statvfs = devfs_statvfs },
		VFSNAME_SYNC,		{ .vfs_sync = fs_sync },
		VFSNAME_MOUNTROOT,	{ .vfs_mountroot = devfs_mountroot },
		NULL,			NULL
	};
	int error;
	int dev;
	extern major_t getudev(void);	/* gack - what a function */

	devfstype = fstype;
	/*
	 * Associate VFS ops vector with this fstype
	 */
	error = vfs_setfsops(fstype, devfs_vfsops_template, NULL);
	if (error != 0) {
		cmn_err(CE_WARN, "devfsinit: bad vfs ops template");
		return (error);
	}

	error = vn_make_ops("dev fs", dv_vnodeops_template, &dv_vnodeops);
	if (error != 0) {
		(void) vfs_freevfsops_by_type(fstype);
		cmn_err(CE_WARN, "devfsinit: bad vnode ops template");
		return (error);
	}

	/*
	 * Invent a dev_t (sigh).
	 */
	if ((dev = getudev()) == DDI_MAJOR_T_NONE) {
		cmn_err(CE_NOTE, "%s: can't get unique dev", devfs_vfssw.name);
		dev = 0;
	}
	devfsdev = makedevice(dev, 0);

	return (0);
}

/*
 * The name of the mount point and the name of the attribute
 * filesystem are passed down from userland for now.
 */
static int
devfs_mount(struct vfs *vfsp, struct vnode *mvp, struct mounta *uap,
    struct cred *cr)
{
	struct devfs_data *devfs_data;
	struct vnode *avp;
	struct dv_node *dv;
	struct vattr va;

	dcmn_err(("devfs_mount\n"));

	if (secpolicy_fs_mount(cr, mvp, vfsp) != 0)
		return (EPERM);

	/*
	 * check that the mount point is sane
	 */
	if (mvp->v_type != VDIR)
		return (ENOTDIR);

	ASSERT(uap->flags & MS_SYSSPACE);
	/*
	 * Devfs can only be mounted from kernel during boot.
	 * avp is the existing /devices, the same as the mount point.
	 */
	avp = mvp;

	/*
	 * Create and initialize the vfs-private data.
	 * This includes a hand-crafted root vnode (we build
	 * this here mostly so that traverse() doesn't sleep
	 * in VFS_ROOT()).
	 */
	mutex_enter(&devfs_lock);
	ASSERT(devfs_mntinfo == NULL);
	dv = dv_mkroot(vfsp, devfsdev);
	dv->dv_attrvp = avp;		/* attribute root vp */

	ASSERT(dv == dv->dv_dotdot);

	devfs_data = kmem_zalloc(sizeof (struct devfs_data), KM_SLEEP);
	devfs_data->devfs_vfsp = vfsp;
	devfs_data->devfs_root = dv;

	vfsp->vfs_data = (caddr_t)devfs_data;
	vfsp->vfs_fstype = devfstype;
	vfsp->vfs_dev = devfsdev;
	vfsp->vfs_bsize = DEV_BSIZE;
	vfsp->vfs_mtime = ddi_get_time();
	vfs_make_fsid(&vfsp->vfs_fsid, vfsp->vfs_dev, devfstype);

	/* We're there. */
	devfs_mntinfo = devfs_data;
	mutex_exit(&devfs_lock);

	va.va_mask = AT_ATIME|AT_MTIME;
	gethrestime(&va.va_atime);
	gethrestime(&va.va_mtime);
	(void) VOP_SETATTR(DVTOV(dv), &va, 0, cr, NULL);
	return (0);
}


/*
 * We never unmount devfs in a real production system.
 */
/*ARGSUSED*/
static int
devfs_unmount(struct vfs *vfsp, int flag, struct cred *cr)
{
	return (EBUSY);
}

/*
 * return root vnode for given vfs
 */
static int
devfs_root(struct vfs *vfsp, struct vnode **vpp)
{
	dcmn_err(("devfs_root\n"));
	*vpp = DVTOV(VFSTODVFS(vfsp)->devfs_root);
	VN_HOLD(*vpp);
	return (0);
}

/*
 * return 'generic superblock' information to userland.
 *
 * not much that we can usefully admit to here
 */
static int
devfs_statvfs(struct vfs *vfsp, struct statvfs64 *sbp)
{
	extern kmem_cache_t *dv_node_cache;

	dev32_t d32;

	dcmn_err(("devfs_statvfs\n"));
	bzero(sbp, sizeof (*sbp));
	sbp->f_frsize = sbp->f_bsize = vfsp->vfs_bsize;
	/*
	 * We could compute the number of devfsnodes here .. but since
	 * it's dynamic anyway, it's not clear how useful this is.
	 */
	sbp->f_files = kmem_cache_stat(dv_node_cache, "alloc");

	/* no illusions that free/avail files is relevant to devfs */
	sbp->f_ffree = 0;
	sbp->f_favail = 0;

	/* no illusions that blocks are relevant to devfs */
	sbp->f_bfree = 0;
	sbp->f_bavail = 0;
	sbp->f_blocks = 0;

	(void) cmpldev(&d32, vfsp->vfs_dev);
	sbp->f_fsid = d32;
	(void) strcpy(sbp->f_basetype, vfssw[devfstype].vsw_name);
	sbp->f_flag = vf_to_stf(vfsp->vfs_flag);
	sbp->f_namemax = MAXNAMELEN - 1;
	(void) strcpy(sbp->f_fstr, "devices");

	return (0);
}

/*
 * devfs always mount after root is mounted, so this should never
 * be invoked.
 */
/*ARGSUSED*/
static int
devfs_mountroot(struct vfs *vfsp, enum whymountroot why)
{
	dcmn_err(("devfs_mountroot\n"));

	return (EINVAL);
}

struct dv_node *
devfs_dip_to_dvnode(dev_info_t *dip)
{
	char *dirpath;
	struct vnode *dirvp;

	ASSERT(dip != NULL);

	/* no-op if devfs not mounted yet */
	if (devfs_mntinfo == NULL)
		return (NULL);

	/*
	 * The lookupname below only looks up cached dv_nodes
	 * because devfs_clean_key is set in thread specific data.
	 */
	dirpath = kmem_alloc(MAXPATHLEN, KM_SLEEP);
	(void) ddi_pathname(dip, dirpath);
	if (devfs_lookupname(dirpath, NULLVPP, &dirvp)) {
		dcmn_err(("directory %s not found\n", dirpath));
		kmem_free(dirpath, MAXPATHLEN);
		return (NULL);
	}

	kmem_free(dirpath, MAXPATHLEN);
	return (VTODV(dirvp));
}

/*
 * If DV_CLEAN_FORCE devfs_clean is issued with a dip that is not the root
 * and not a vHCI we also need to clean any vHCI branches because they
 * may contain pHCI nodes. A detach_node() of a pHCI will fail if its
 * mdi_devi_offline() fails, and the mdi_devi_offline() of the last
 * pHCI will fail unless an ndi_devi_offline() of the Client nodes under
 * the vHCI is successful - which requires a clean vHCI branch to removed
 * the devi_refs associated with devfs vnodes.
 */
static int
devfs_clean_vhci(dev_info_t *dip, void *args)
{
	struct dv_node	*dvp;
	uint_t		flags = (uint_t)(uintptr_t)args;

	(void) tsd_set(devfs_clean_key, (void *)1);
	dvp = devfs_dip_to_dvnode(dip);
	if (dvp) {
		(void) dv_cleandir(dvp, NULL, flags);
		VN_RELE(DVTOV(dvp));
	}
	(void) tsd_set(devfs_clean_key, NULL);
	return (DDI_WALK_CONTINUE);
}

/*
 * devfs_clean()
 *
 * Destroy unreferenced dv_node's and detach devices.
 *
 * devfs_clean will try its best to clean up unused nodes. It is
 * no longer valid to assume that just because devfs_clean fails,
 * the device is not removable. This is because device contracts
 * can result in userland processes releasing a device during the
 * device offline process in the kernel. Thus it is no longer
 * correct to fail an offline just because devfs_clean finds
 * referenced dv_nodes. To enforce this, devfs_clean() always
 * returns success i.e. 0.
 *
 * devfs_clean() may return before removing all possible nodes if
 * we cannot acquire locks in areas of the code where potential for
 * deadlock exists (see comments in dv_find() and dv_cleandir() for
 * examples of this).
 *
 * devfs caches unreferenced dv_node to speed by the performance
 * of ls, find, etc. devfs_clean() is invoked to cleanup cached
 * dv_nodes to reclaim memory as well as to facilitate device
 * removal (dv_node reference devinfo nodes, which prevents driver
 * detach).
 *
 * If a shell parks in a /devices directory, the dv_node will be
 * held, preventing the corresponding device to be detached.
 * This would be a denial of service against DR. To prevent this,
 * DR code calls devfs_clean() with the DV_CLEAN_FORCE flag.
 * The dv_cleandir() implementation does the right thing to ensure
 * successful DR.
 */
int
devfs_clean(dev_info_t *dip, char *devnm, uint_t flags)
{
	struct dv_node		*dvp;

	dcmn_err(("devfs_unconfigure: dip = 0x%p, flags = 0x%x",
	    (void *)dip, flags));

	/* avoid recursion back into the device tree */
	(void) tsd_set(devfs_clean_key, (void *)1);
	dvp = devfs_dip_to_dvnode(dip);
	if (dvp == NULL) {
		(void) tsd_set(devfs_clean_key, NULL);
		return (0);
	}

	(void) dv_cleandir(dvp, devnm, flags);
	(void) tsd_set(devfs_clean_key, NULL);
	VN_RELE(DVTOV(dvp));

	/*
	 * If we are doing a DV_CLEAN_FORCE, and we did not start at the
	 * root, and we did not start at a vHCI node then clean vHCI
	 * branches too.  Failure to clean vHCI branch does not cause EBUSY.
	 *
	 * Also, to accommodate nexus callers that clean 'self' to DR 'child'
	 * (like pcihp) we clean vHCIs even when dv_cleandir() of dip branch
	 * above fails - this prevents a busy DR 'child' sibling from causing
	 * the DR of 'child' to fail because a vHCI branch was not cleaned.
	 */
	if ((flags & DV_CLEAN_FORCE) && (dip != ddi_root_node()) &&
	    (mdi_component_is_vhci(dip, NULL) != MDI_SUCCESS)) {
		/*
		 * NOTE: for backport the following is recommended
		 * 	(void) devfs_clean_vhci(scsi_vhci_dip,
		 *	    (void *)(uintptr_t)flags);
		 */
		mdi_walk_vhcis(devfs_clean_vhci, (void *)(uintptr_t)flags);
	}

	return (0);
}

/*
 * lookup a devfs relative pathname, returning held vnodes for the final
 * component and the containing directory (if requested).
 *
 * NOTE: We can't use lookupname because this would use the current
 *	processes credentials (CRED) in the call lookuppnvp instead
 *	of kcred.  It also does not give you the flexibility so
 * 	specify the directory to start the resolution in (devicesdir).
 */
int
devfs_lookupname(
	char	*pathname,		/* user pathname */
	vnode_t **dirvpp,		/* ret for ptr to parent dir vnode */
	vnode_t **compvpp)		/* ret for ptr to component vnode */
{
	struct pathname	pn;
	int		error;

	ASSERT(devicesdir);		/* devfs must be initialized */
	ASSERT(pathname);		/* must have some path */

	if (error = pn_get(pathname, UIO_SYSSPACE, &pn))
		return (error);

	/* make the path relative to /devices. */
	pn_skipslash(&pn);
	if (pn_pathleft(&pn) == 0) {
		/* all we had was "\0" or "/" (which skipslash skiped) */
		if (dirvpp)
			*dirvpp = NULL;
		if (compvpp) {
			VN_HOLD(devicesdir);
			*compvpp = devicesdir;
		}
	} else {
		/*
		 * Use devfs lookup to resolve pathname to the vnode for
		 * the device via relative lookup in devfs. Extra holds for
		 * using devicesdir as directory we are searching and for
		 * being our root without being == rootdir.
		 */
		VN_HOLD(devicesdir);
		VN_HOLD(devicesdir);
		error = lookuppnvp(&pn, NULL, FOLLOW, dirvpp, compvpp,
		    devicesdir, devicesdir, kcred);
	}
	pn_free(&pn);

	return (error);
}

/*
 * Given a devfs path (without the /devices prefix), walk
 * the dv_node sub-tree rooted at the path.
 */
int
devfs_walk(
	char		*path,
	void		(*callback)(struct dv_node *, void *),
	void		*arg)
{
	char *dirpath, *devnm;
	struct vnode	*dirvp;

	ASSERT(path && callback);

	if (*path != '/' || devfs_mntinfo == NULL)
		return (ENXIO);

	dcmn_err(("devfs_walk: path = %s", path));

	dirpath = kmem_alloc(MAXPATHLEN, KM_SLEEP);

	(void) snprintf(dirpath, MAXPATHLEN, "/devices%s", path);

	devnm = strrchr(dirpath, '/');

	ASSERT(devnm);

	*devnm++ = '\0';

	if (lookupname(dirpath, UIO_SYSSPACE, 0, NULL, &dirvp)) {
		dcmn_err(("directory %s not found\n", dirpath));
		kmem_free(dirpath, MAXPATHLEN);
		return (ENXIO);
	}

	/*
	 * if path == "/", visit the root dv_node
	 */
	if (*devnm == '\0') {
		callback(VTODV(dirvp), arg);
		devnm = NULL;
	}

	dv_walk(VTODV(dirvp), devnm, callback, arg);

	VN_RELE(dirvp);

	kmem_free(dirpath, MAXPATHLEN);

	return (0);
}

int
devfs_devpolicy(vnode_t *vp, devplcy_t **dpp)
{
	struct vnode *rvp;
	struct dv_node *dvp;
	int rval = -1;

	/* fail if devfs not mounted yet */
	if (devfs_mntinfo == NULL)
		return (rval);

	if (VOP_REALVP(vp, &rvp, NULL) == 0 && vn_matchops(rvp, dv_vnodeops)) {
		dvp = VTODV(rvp);
		rw_enter(&dvp->dv_contents, RW_READER);
		if (dvp->dv_priv) {
			dphold(dvp->dv_priv);
			*dpp = dvp->dv_priv;
			rval = 0;
		}
		rw_exit(&dvp->dv_contents);
	}
	return (rval);
}
/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License (the "License").
 * You may not use this file except in compliance with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */
/*
 * Copyright (c) 2002, 2010, Oracle and/or its affiliates. All rights reserved.
 * Copyright (c) 2017 by Delphix. All rights reserved.
 * Copyright 2023 Oxide Computer Company
 */

/*
 * vnode ops for the devfs
 *
 * For leaf vnode special files (VCHR|VBLK) specfs will always see the VOP
 * first because dv_find always performs leaf vnode substitution, returning
 * a specfs vnode with an s_realvp pointing to the devfs leaf vnode. This
 * means that the only leaf special file VOP operations that devfs will see
 * after VOP_LOOKUP are the ones that specfs forwards.
 */

#include <sys/types.h>
#include <sys/param.h>
#include <sys/t_lock.h>
#include <sys/systm.h>
#include <sys/sysmacros.h>
#include <sys/user.h>
#include <sys/time.h>
#include <sys/vfs.h>
#include <sys/vnode.h>
#include <sys/vfs_opreg.h>
#include <sys/file.h>
#include <sys/fcntl.h>
#include <sys/flock.h>
#include <sys/kmem.h>
#include <sys/uio.h>
#include <sys/errno.h>
#include <sys/stat.h>
#include <sys/cred.h>
#include <sys/dirent.h>
#include <sys/pathname.h>
#include <sys/cmn_err.h>
#include <sys/debug.h>
#include <sys/policy.h>
#include <sys/modctl.h>
#include <sys/sunndi.h>
#include <fs/fs_subr.h>
#include <sys/fs/dv_node.h>

extern struct vattr	dv_vattr_dir, dv_vattr_file;
extern dev_t rconsdev;

/*
 * Open of devices (leaf nodes) is handled by specfs.
 * There is nothing to do to open a directory
 */
/*ARGSUSED*/
static int
devfs_open(struct vnode **vpp, int flag, struct cred *cred,
    caller_context_t *ct)
{
	struct dv_node	*dv = VTODV(*vpp);

	dcmn_err2(("devfs_open %s\n", dv->dv_name));
	ASSERT((*vpp)->v_type == VDIR);
	return (0);
}

/*
 * Close of devices (leaf nodes) is handled by specfs.
 * There is nothing much to do inorder to close a directory.
 */
/*ARGSUSED1*/
static int
devfs_close(struct vnode *vp, int flag, int count,
    offset_t offset, struct cred *cred, caller_context_t *ct)
{
	struct dv_node	*dv = VTODV(vp);

	dcmn_err2(("devfs_close %s\n", dv->dv_name));
	ASSERT(vp->v_type == VDIR);

	cleanlocks(vp, ttoproc(curthread)->p_pid, 0);
	cleanshares(vp, ttoproc(curthread)->p_pid);
	return (0);
}

/*
 * Read of devices (leaf nodes) is handled by specfs.
 * Read of directories is not supported.
 */
/*ARGSUSED*/
static int
devfs_read(struct vnode *vp, struct uio *uiop, int ioflag, struct cred *cred,
    struct caller_context *ct)
{
	dcmn_err2(("devfs_read %s\n", VTODV(vp)->dv_name));
	ASSERT(vp->v_type == VDIR);
	ASSERT(RW_READ_HELD(&VTODV(vp)->dv_contents));
	return (EISDIR);
}

/*
 * Write of devices (leaf nodes) is handled by specfs.
 * Write of directories is not supported.
 */
/*ARGSUSED*/
static int
devfs_write(struct vnode *vp, struct uio *uiop, int ioflag, struct cred *cred,
    struct caller_context *ct)
{
	dcmn_err2(("devfs_write %s\n", VTODV(vp)->dv_name));
	ASSERT(vp->v_type == VDIR);
	ASSERT(RW_WRITE_HELD(&VTODV(vp)->dv_contents));
	return (EISDIR);
}

/*
 * Ioctls to device (leaf nodes) is handled by specfs.
 * Ioctl to directories is not supported.
 */
/*ARGSUSED*/
static int
devfs_ioctl(struct vnode *vp, int cmd, intptr_t arg, int flag,
    struct cred *cred, int *rvalp, caller_context_t *ct)
{
	dcmn_err2(("devfs_ioctl %s\n", VTODV(vp)->dv_name));
	ASSERT(vp->v_type == VDIR);

	return (ENOTTY);	/* no ioctls supported */
}

/*
 * We can be asked directly about the attributes of directories, or
 * (via sp->s_realvp) about the filesystem attributes of special files.
 *
 * For directories, we just believe the attribute store
 * though we mangle the nodeid, fsid, and rdev to convince userland we
 * really are a different filesystem.
 *
 * For special files, a little more fakery is required.
 *
 * If the attribute store is not there (read only root), we believe our
 * memory based attributes.
 */
static int
devfs_getattr(struct vnode *vp, struct vattr *vap, int flags, struct cred *cr,
    caller_context_t *ct)
{
	struct dv_node	*dv = VTODV(vp);
	int		error = 0;
	uint_t		mask;

	/*
	 * Message goes to console only. Otherwise, the message
	 * causes devfs_getattr to be invoked again... infinite loop
	 */
	dcmn_err2(("?devfs_getattr %s\n", dv->dv_name));
	ASSERT(dv->dv_attr || dv->dv_attrvp);

	if (!(vp->v_type == VDIR || vp->v_type == VCHR || vp->v_type == VBLK)) {
		cmn_err(CE_WARN,	/* panic ? */
		    "?%s: getattr on vnode type %d", dvnm, vp->v_type);
		return (ENOENT);
	}

	rw_enter(&dv->dv_contents, RW_READER);
	if (dv->dv_attr) {
		/*
		 * obtain from the memory version of attribute.
		 * preserve mask for those that optimize.
		 * devfs specific fields are already merged on creation.
		 */
		mask = vap->va_mask;
		*vap = *dv->dv_attr;
		vap->va_mask = mask;
	} else {
		/* obtain from attribute store and merge */
		error = VOP_GETATTR(dv->dv_attrvp, vap, flags, cr, ct);
		dsysdebug(error, ("vop_getattr %s %d\n", dv->dv_name, error));
		dv_vattr_merge(dv, vap);
	}
	rw_exit(&dv->dv_contents);

	/*
	 * Restrict the permissions of the node fronting the console
	 * to 0600 with root as the owner.  This prevents a non-root
	 * user from gaining access to a serial terminal (like /dev/term/a)
	 * which is in reality serving as the console device (/dev/console).
	 */
	if (vp->v_rdev == rconsdev) {
		mode_t	rconsmask = S_IXUSR|S_IRWXG|S_IRWXO;
		vap->va_mode &= (~rconsmask);
		vap->va_uid = 0;
	}

	return (error);
}

static int devfs_unlocked_access(void *, int, struct cred *);

/*ARGSUSED4*/
static int
devfs_setattr_dir(
	struct dv_node *dv,
	struct vnode *vp,
	struct vattr *vap,
	int flags,
	struct cred *cr)
{
	struct vattr	*map;
	uint_t		mask;
	int		error = 0;
	struct vattr	vattr;

	ASSERT(dv->dv_attr || dv->dv_attrvp);

	ASSERT(vp->v_type == VDIR);
	ASSERT((dv->dv_flags & DV_NO_FSPERM) == 0);

	if (vap->va_mask & AT_NOSET)
		return (EINVAL);

	/* to ensure consistency, single thread setting of attributes */
	rw_enter(&dv->dv_contents, RW_WRITER);

again:	if (dv->dv_attr) {

		error = secpolicy_vnode_setattr(cr, vp, vap,
		    dv->dv_attr, flags, devfs_unlocked_access, dv);

		if (error)
			goto out;

		/*
		 * Apply changes to the memory based attribute. This code
		 * is modeled after the tmpfs implementation of memory
		 * based vnodes
		 */
		map = dv->dv_attr;
		mask = vap->va_mask;

		/* Change file access modes. */
		if (mask & AT_MODE) {
			map->va_mode &= S_IFMT;
			map->va_mode |= vap->va_mode & ~S_IFMT;
		}
		if (mask & AT_UID)
			map->va_uid = vap->va_uid;
		if (mask & AT_GID)
			map->va_gid = vap->va_gid;
		if (mask & AT_ATIME)
			map->va_atime = vap->va_atime;
		if (mask & AT_MTIME)
			map->va_mtime = vap->va_mtime;

		if (mask & (AT_MODE | AT_UID | AT_GID | AT_MTIME))
			gethrestime(&map->va_ctime);
	} else {
		/* use the backing attribute store */
		ASSERT(dv->dv_attrvp);

		/*
		 * See if we are changing something we care about
		 * the persistence of - return success if we don't care.
		 */
		if (vap->va_mask & (AT_MODE|AT_UID|AT_GID|AT_ATIME|AT_MTIME)) {
			/* Set the attributes */
			error = VOP_SETATTR(dv->dv_attrvp,
			    vap, flags, cr, NULL);
			dsysdebug(error,
			    ("vop_setattr %s %d\n", dv->dv_name, error));

			/*
			 * Some file systems may return EROFS for a setattr
			 * on a readonly file system.  In this case we create
			 * our own memory based attribute.
			 */
			if (error == EROFS) {
				/*
				 * obtain attributes from existing file
				 * that we will modify and switch to memory
				 * based attribute until attribute store is
				 * read/write.
				 */
				vattr = dv_vattr_dir;
				if (VOP_GETATTR(dv->dv_attrvp,
				    &vattr, flags, cr, NULL) == 0) {
					dv->dv_attr = kmem_alloc(
					    sizeof (struct vattr), KM_SLEEP);
					*dv->dv_attr = vattr;
					dv_vattr_merge(dv, dv->dv_attr);
					goto again;
				}
			}
		}
	}
out:
	rw_exit(&dv->dv_contents);
	return (error);
}


/*
 * Compare the uid/gid/mode changes requested for a setattr
 * operation with the same details of a node's default minor
 * perm information.  Return 0 if identical.
 */
static int
dv_setattr_cmp(struct vattr *map, mperm_t *mp)
{
	if ((map->va_mode & S_IAMB) != (mp->mp_mode & S_IAMB))
		return (1);
	if (map->va_uid != mp->mp_uid)
		return (1);
	if (map->va_gid != mp->mp_gid)
		return (1);
	return (0);
}


/*ARGSUSED4*/
static int
devfs_setattr(
	struct vnode *vp,
	struct vattr *vap,
	int flags,
	struct cred *cr,
	caller_context_t *ct)
{
	struct dv_node	*dv = VTODV(vp);
	struct dv_node	*ddv;
	struct vnode	*dvp;
	struct vattr	*map;
	uint_t		mask;
	int		error = 0;
	struct vattr	*free_vattr = NULL;
	struct vattr	*vattrp = NULL;
	mperm_t		mp;
	int		persist;

	/*
	 * Message goes to console only. Otherwise, the message
	 * causes devfs_getattr to be invoked again... infinite loop
	 */
	dcmn_err2(("?devfs_setattr %s\n", dv->dv_name));
	ASSERT(dv->dv_attr || dv->dv_attrvp);

	if (!(vp->v_type == VDIR || vp->v_type == VCHR || vp->v_type == VBLK)) {
		cmn_err(CE_WARN,	/* panic ? */
		    "?%s: getattr on vnode type %d", dvnm, vp->v_type);
		return (ENOENT);
	}

	if (vap->va_mask & AT_NOSET)
		return (EINVAL);

	/*
	 * If we are changing something we don't care about
	 * the persistence of, return success.
	 */
	if ((vap->va_mask &
	    (AT_MODE|AT_UID|AT_GID|AT_ATIME|AT_MTIME)) == 0)
		return (0);

	/*
	 * If driver overrides fs perm, disallow chmod
	 * and do not create attribute nodes.
	 */
	if (dv->dv_flags & DV_NO_FSPERM) {
		ASSERT(dv->dv_attr);
		if (vap->va_mask & (AT_MODE | AT_UID | AT_GID))
			return (EPERM);
		if ((vap->va_mask & (AT_ATIME|AT_MTIME)) == 0)
			return (0);
		rw_enter(&dv->dv_contents, RW_WRITER);
		if (vap->va_mask & AT_ATIME)
			dv->dv_attr->va_atime = vap->va_atime;
		if (vap->va_mask & AT_MTIME)
			dv->dv_attr->va_mtime = vap->va_mtime;
		rw_exit(&dv->dv_contents);
		return (0);
	}

	/*
	 * Directories are always created but device nodes are
	 * only used to persist non-default permissions.
	 */
	if (vp->v_type == VDIR) {
		ASSERT(dv->dv_attr || dv->dv_attrvp);
		return (devfs_setattr_dir(dv, vp, vap, flags, cr));
	}

	/*
	 * Allocate now before we take any locks
	 */
	vattrp = kmem_zalloc(sizeof (*vattrp), KM_SLEEP);

	/* to ensure consistency, single thread setting of attributes */
	rw_enter(&dv->dv_contents, RW_WRITER);

	/*
	 * We don't need to create an attribute node
	 * to persist access or modification times.
	 */
	persist = (vap->va_mask & (AT_MODE | AT_UID | AT_GID));

	/*
	 * If persisting something, get the default permissions
	 * for this minor to compare against what the attributes
	 * are now being set to.  Default ordering is:
	 *	- minor_perm match for this minor
	 *	- mode supplied by ddi_create_priv_minor_node
	 *	- devfs defaults
	 */
	if (persist) {
		if (dev_minorperm(dv->dv_devi, dv->dv_name, &mp) != 0) {
			mp.mp_uid = dv_vattr_file.va_uid;
			mp.mp_gid = dv_vattr_file.va_gid;
			mp.mp_mode = dv_vattr_file.va_mode;
			if (dv->dv_flags & DV_DFLT_MODE) {
				ASSERT((dv->dv_dflt_mode & ~S_IAMB) == 0);
				mp.mp_mode &= ~S_IAMB;
				mp.mp_mode |= dv->dv_dflt_mode;
				dcmn_err5(("%s: setattr priv default 0%o\n",
				    dv->dv_name, mp.mp_mode));
			} else {
				dcmn_err5(("%s: setattr devfs default 0%o\n",
				    dv->dv_name, mp.mp_mode));
			}
		} else {
			dcmn_err5(("%s: setattr minor perm default 0%o\n",
			    dv->dv_name, mp.mp_mode));
		}
	}

	/*
	 * If we don't have a vattr for this node, construct one.
	 */
	if (dv->dv_attr) {
		free_vattr = vattrp;
		vattrp = NULL;
	} else {
		ASSERT(dv->dv_attrvp);
		ASSERT(vp->v_type != VDIR);
		*vattrp = dv_vattr_file;
		error = VOP_GETATTR(dv->dv_attrvp, vattrp, 0, cr, ct);
		dsysdebug(error, ("vop_getattr %s %d\n", dv->dv_name, error));
		if (error)
			goto out;
		dv->dv_attr = vattrp;
		dv_vattr_merge(dv, dv->dv_attr);
		vattrp = NULL;
	}

	error = secpolicy_vnode_setattr(cr, vp, vap, dv->dv_attr,
	    flags, devfs_unlocked_access, dv);
	if (error) {
		dsysdebug(error, ("devfs_setattr %s secpolicy error %d\n",
		    dv->dv_name, error));
		goto out;
	}

	/*
	 * Apply changes to the memory based attribute. This code
	 * is modeled after the tmpfs implementation of memory
	 * based vnodes
	 */
	map = dv->dv_attr;
	mask = vap->va_mask;

	/* Change file access modes. */
	if (mask & AT_MODE) {
		map->va_mode &= S_IFMT;
		map->va_mode |= vap->va_mode & ~S_IFMT;
	}
	if (mask & AT_UID)
		map->va_uid = vap->va_uid;
	if (mask & AT_GID)
		map->va_gid = vap->va_gid;
	if (mask & AT_ATIME)
		map->va_atime = vap->va_atime;
	if (mask & AT_MTIME)
		map->va_mtime = vap->va_mtime;

	if (mask & (AT_MODE | AT_UID | AT_GID | AT_MTIME)) {
		gethrestime(&map->va_ctime);
	}

	/*
	 * A setattr to defaults means we no longer need the
	 * shadow node as a persistent store, unless there
	 * are ACLs.  Otherwise create a shadow node if one
	 * doesn't exist yet.
	 */
	if (persist) {
		if ((dv_setattr_cmp(map, &mp) == 0) &&
		    ((dv->dv_flags & DV_ACL) == 0)) {

			if (dv->dv_attrvp) {
				ddv = dv->dv_dotdot;
				ASSERT(ddv->dv_attrvp);
				error = VOP_REMOVE(ddv->dv_attrvp,
				    dv->dv_name, cr, ct, 0);
				dsysdebug(error,
				    ("vop_remove %s %s %d\n",
				    ddv->dv_name, dv->dv_name, error));

				if (error == EROFS)
					error = 0;
				VN_RELE(dv->dv_attrvp);
				dv->dv_attrvp = NULL;
			}
			ASSERT(dv->dv_attr);
		} else {
			if (mask & AT_MODE)
				dcmn_err5(("%s persisting mode 0%o\n",
				    dv->dv_name, vap->va_mode));
			if (mask & AT_UID)
				dcmn_err5(("%s persisting uid %d\n",
				    dv->dv_name, vap->va_uid));
			if (mask & AT_GID)
				dcmn_err5(("%s persisting gid %d\n",
				    dv->dv_name, vap->va_gid));

			if (dv->dv_attrvp == NULL) {
				dvp = DVTOV(dv->dv_dotdot);
				dv_shadow_node(dvp, dv->dv_name, vp,
				    NULL, NULLVP, cr,
				    DV_SHADOW_CREATE | DV_SHADOW_WRITE_HELD);
			}
			if (dv->dv_attrvp) {
				/* If map still valid do TIME for free. */
				if (dv->dv_attr == map) {
					mask = map->va_mask;
					map->va_mask =
					    vap->va_mask | AT_ATIME | AT_MTIME;
					error = VOP_SETATTR(dv->dv_attrvp, map,
					    flags, cr, NULL);
					map->va_mask = mask;
				} else {
					error = VOP_SETATTR(dv->dv_attrvp,
					    vap, flags, cr, NULL);
				}
				dsysdebug(error, ("vop_setattr %s %d\n",
				    dv->dv_name, error));
			}
			/*
			 * Some file systems may return EROFS for a setattr
			 * on a readonly file system.  In this case save
			 * as our own memory based attribute.
			 * NOTE: ufs is NOT one of these (see ufs_iupdat).
			 */
			if (dv->dv_attr && dv->dv_attrvp && error == 0) {
				vattrp = dv->dv_attr;
				dv->dv_attr = NULL;
			} else if (error == EROFS)
				error = 0;
		}
	}

out:
	rw_exit(&dv->dv_contents);

	if (vattrp)
		kmem_free(vattrp, sizeof (*vattrp));
	if (free_vattr)
		kmem_free(free_vattr, sizeof (*free_vattr));
	return (error);
}

static int
devfs_pathconf(vnode_t *vp, int cmd, ulong_t *valp, cred_t *cr,
    caller_context_t *ct)
{
	switch (cmd) {
	case _PC_ACL_ENABLED:
		/*
		 * We rely on the underlying filesystem for ACLs,
		 * so direct the query for ACL support there.
		 * ACL support isn't relative to the file
		 * and we can't guarantee that the dv node
		 * has an attribute node, so any valid
		 * attribute node will suffice.
		 */
		ASSERT(dvroot);
		ASSERT(dvroot->dv_attrvp);
		return (VOP_PATHCONF(dvroot->dv_attrvp, cmd, valp, cr, ct));
		/*NOTREACHED*/
	}

	return (fs_pathconf(vp, cmd, valp, cr, ct));
}

/*
 * Let avp handle security attributes (acl's).
 */
static int
devfs_getsecattr(struct vnode *vp, struct vsecattr *vsap, int flags,
    struct cred *cr, caller_context_t *ct)
{
	dvnode_t *dv = VTODV(vp);
	struct vnode *avp;
	int	error;

	dcmn_err2(("devfs_getsecattr %s\n", dv->dv_name));
	ASSERT(vp->v_type == VDIR || vp->v_type == VCHR || vp->v_type == VBLK);

	rw_enter(&dv->dv_contents, RW_READER);

	avp = dv->dv_attrvp;

	/* fabricate the acl */
	if (avp == NULL) {
		error = fs_fab_acl(vp, vsap, flags, cr, ct);
		rw_exit(&dv->dv_contents);
		return (error);
	}

	error = VOP_GETSECATTR(avp, vsap, flags, cr, ct);
	dsysdebug(error, ("vop_getsecattr %s %d\n", VTODV(vp)->dv_name, error));
	rw_exit(&dv->dv_contents);
	return (error);
}

/*
 * Set security attributes (acl's)
 *
 * Note that the dv_contents lock has already been acquired
 * by the caller's VOP_RWLOCK.
 */
static int
devfs_setsecattr(struct vnode *vp, struct vsecattr *vsap, int flags,
    struct cred *cr, caller_context_t *ct)
{
	dvnode_t *dv = VTODV(vp);
	struct vnode *avp;
	int	error;

	dcmn_err2(("devfs_setsecattr %s\n", dv->dv_name));
	ASSERT(vp->v_type == VDIR || vp->v_type == VCHR || vp->v_type == VBLK);
	ASSERT(RW_LOCK_HELD(&dv->dv_contents));

	/*
	 * Not a supported operation on drivers not providing
	 * file system based permissions.
	 */
	if (dv->dv_flags & DV_NO_FSPERM)
		return (ENOTSUP);

	/*
	 * To complete, the setsecattr requires an underlying attribute node.
	 */
	if (dv->dv_attrvp == NULL) {
		ASSERT(vp->v_type == VCHR || vp->v_type == VBLK);
		dv_shadow_node(DVTOV(dv->dv_dotdot), dv->dv_name, vp,
		    NULL, NULLVP, cr, DV_SHADOW_CREATE | DV_SHADOW_WRITE_HELD);
	}

	if ((avp = dv->dv_attrvp) == NULL) {
		dcmn_err2(("devfs_setsecattr %s: "
		    "cannot construct attribute node\n", dv->dv_name));
		return (fs_nosys());
	}

	/*
	 * The acl(2) system call issues a VOP_RWLOCK before setting an ACL.
	 * Since backing file systems expect the lock to be held before seeing
	 * a VOP_SETSECATTR ACL, we need to issue the VOP_RWLOCK to the backing
	 * store before forwarding the ACL.
	 */
	(void) VOP_RWLOCK(avp, V_WRITELOCK_TRUE, NULL);
	error = VOP_SETSECATTR(avp, vsap, flags, cr, ct);
	dsysdebug(error, ("vop_setsecattr %s %d\n", VTODV(vp)->dv_name, error));
	VOP_RWUNLOCK(avp, V_WRITELOCK_TRUE, NULL);

	/*
	 * Set DV_ACL if we have a non-trivial set of ACLs.  It is not
	 * necessary to hold VOP_RWLOCK since fs_acl_nontrivial only does
	 * VOP_GETSECATTR calls.
	 */
	if (fs_acl_nontrivial(avp, cr))
		dv->dv_flags |= DV_ACL;
	return (error);
}

/*
 * This function is used for secpolicy_setattr().  It must call an
 * access() like function while it is already holding the
 * dv_contents lock.  We only care about this when dv_attr != NULL;
 * so the unlocked access call only concerns itself with that
 * particular branch of devfs_access().
 */
static int
devfs_unlocked_access(void *vdv, int mode, struct cred *cr)
{
	struct dv_node *dv = vdv;
	int shift = 0;
	uid_t owner = dv->dv_attr->va_uid;

	/* Check access based on owner, group and public permissions. */
	if (crgetuid(cr) != owner) {
		shift += 3;
		if (groupmember(dv->dv_attr->va_gid, cr) == 0)
			shift += 3;
	}

	return (secpolicy_vnode_access2(cr, DVTOV(dv), owner,
	    dv->dv_attr->va_mode << shift, mode));
}

static int
devfs_access(struct vnode *vp, int mode, int flags, struct cred *cr,
    caller_context_t *ct)
{
	struct dv_node	*dv = VTODV(vp);
	int		res;

	dcmn_err2(("devfs_access %s\n", dv->dv_name));
	ASSERT(dv->dv_attr || dv->dv_attrvp);

	/* restrict console access to privileged processes */
	if ((vp->v_rdev == rconsdev) && secpolicy_console(cr) != 0) {
		return (EACCES);
	}

	rw_enter(&dv->dv_contents, RW_READER);
	if (dv->dv_attr && ((dv->dv_flags & DV_ACL) == 0)) {
		res = devfs_unlocked_access(dv, mode, cr);
	} else {
		res = VOP_ACCESS(dv->dv_attrvp, mode, flags, cr, ct);
	}
	rw_exit(&dv->dv_contents);
	return (res);
}

/*
 * Lookup
 *
 * Given the directory vnode and the name of the component, return
 * the corresponding held vnode for that component.
 *
 * Of course in these fictional filesystems, nothing's ever quite
 * -that- simple.
 *
 * devfs name	type		shadow (fs attributes)	type	comments
 * -------------------------------------------------------------------------
 * drv[@addr]	VDIR		drv[@addr]		VDIR	nexus driver
 * drv[@addr]:m	VCHR/VBLK	drv[@addr]:m		VREG	leaf driver
 * drv[@addr]	VCHR/VBLK	drv[@addr]:.default	VREG	leaf driver
 * -------------------------------------------------------------------------
 *
 * The following names are reserved for the attribute filesystem (which
 * could easily be another layer on top of this one - we simply need to
 * hold the vnode of the thing we're looking at)
 *
 * attr name	type		shadow (fs attributes)	type	comments
 * -------------------------------------------------------------------------
 * drv[@addr]	VDIR		-			-	attribute dir
 * minorname	VDIR		-			-	minorname
 * attribute	VREG		-			-	attribute
 * -------------------------------------------------------------------------
 *
 * Examples:
 *
 *	devfs:/devices/.../mm@0:zero		VCHR
 *	shadow:/.devices/.../mm@0:zero		VREG, fs attrs
 *	devfs:/devices/.../mm@0:/zero/attr	VREG, driver attribute
 *
 *	devfs:/devices/.../sd@0,0:a		VBLK
 *	shadow:/.devices/.../sd@0,0:a		VREG, fs attrs
 *	devfs:/devices/.../sd@0,0:/a/.type	VREG, "ddi_block:chan"
 *
 *	devfs:/devices/.../mm@0			VCHR
 *	shadow:/.devices/.../mm@0:.default	VREG, fs attrs
 *	devfs:/devices/.../mm@0:/.default/attr	VREG, driver attribute
 *	devfs:/devices/.../mm@0:/.default/.type	VREG, "ddi_pseudo"
 *
 *	devfs:/devices/.../obio			VDIR
 *	shadow:/devices/.../obio		VDIR, needed for fs attrs.
 *	devfs:/devices/.../obio:/.default/attr	VDIR, driver attribute
 *
 * We also need to be able deal with "old" devices that have gone away,
 * though I think that provided we return them with readdir, they can
 * be removed (i.e. they don't have to respond to lookup, though it might
 * be weird if they didn't ;-)
 *
 * Lookup has side-effects.
 *
 * - It will create directories and fs attribute files in the shadow hierarchy.
 * - It should cause non-SID devices to be probed (ask the parent nexi).
 */
/*ARGSUSED3*/
static int
devfs_lookup(struct vnode *dvp, char *nm, struct vnode **vpp,
    struct pathname *pnp, int flags, struct vnode *rdir, struct cred *cred,
    caller_context_t *ct, int *direntflags, pathname_t *realpnp)
{
	ASSERT(dvp->v_type == VDIR);
	dcmn_err2(("devfs_lookup: %s\n", nm));
	return (dv_find(VTODV(dvp), nm, vpp, pnp, rdir, cred, 0));
}

/*
 * devfs nodes can't really be created directly by userland - however,
 * we do allow creates to find existing nodes:
 *
 * - any create fails if the node doesn't exist - EROFS.
 * - creating an existing directory read-only succeeds, otherwise EISDIR.
 * - exclusive creates fail if the node already exists - EEXIST.
 * - failure to create the snode for an existing device - ENOSYS.
 */
/*ARGSUSED2*/
static int
devfs_create(struct vnode *dvp, char *nm, struct vattr *vap, vcexcl_t excl,
    int mode, struct vnode **vpp, struct cred *cred, int flag,
    caller_context_t *ct, vsecattr_t *vsecp)
{
	int error;
	struct vnode *vp;

	dcmn_err2(("devfs_create %s\n", nm));
	error = dv_find(VTODV(dvp), nm, &vp, NULL, NULLVP, cred, 0);
	if (error == 0) {
		if (excl == EXCL)
			error = EEXIST;
		else if (vp->v_type == VDIR && (mode & VWRITE))
			error = EISDIR;
		else
			error = VOP_ACCESS(vp, mode, 0, cred, ct);

		if (error) {
			VN_RELE(vp);
		} else
			*vpp = vp;
	} else if (error == ENOENT)
		error = EROFS;

	return (error);
}

/*
 * If DV_BUILD is set, we call into nexus driver to do a BUS_CONFIG_ALL.
 * Otherwise, simply return cached dv_node's. Hotplug code always call
 * devfs_clean() to invalid the dv_node cache.
 */
/*ARGSUSED5*/
static int
devfs_readdir(struct vnode *dvp, struct uio *uiop, struct cred *cred, int *eofp,
    caller_context_t *ct, int flags)
{
	struct dv_node *ddv, *dv;
	struct dirent64 *de, *bufp;
	offset_t diroff;
	offset_t	soff;
	size_t reclen, movesz;
	int error;
	struct vattr va;
	size_t bufsz;

	ddv = VTODV(dvp);
	dcmn_err2(("devfs_readdir %s: offset %lld len %ld\n",
	    ddv->dv_name, uiop->uio_loffset, uiop->uio_iov->iov_len));
	ASSERT(ddv->dv_attr || ddv->dv_attrvp);
	ASSERT(RW_READ_HELD(&ddv->dv_contents));

	if (uiop->uio_loffset >= MAXOFF_T) {
		if (eofp)
			*eofp = 1;
		return (0);
	}

	if (uiop->uio_iovcnt != 1)
		return (EINVAL);

	if (dvp->v_type != VDIR)
		return (ENOTDIR);

	/* Load the initial contents */
	if (ddv->dv_flags & DV_BUILD) {
		if (!rw_tryupgrade(&ddv->dv_contents)) {
			rw_exit(&ddv->dv_contents);
			rw_enter(&ddv->dv_contents, RW_WRITER);
		}

		/* recheck and fill */
		if (ddv->dv_flags & DV_BUILD)
			dv_filldir(ddv);

		rw_downgrade(&ddv->dv_contents);
	}

	/*
	 * Even if the dv node was not stale at entry to this function, it may
	 * be stale now if another process got in between the rw_exit/rw_enter
	 * calls above and unlinked it.
	 */
	if (DV_STALE(ddv))
		return (ESTALE);

	soff = uiop->uio_loffset;
	bufsz = uiop->uio_iov->iov_len;
	de = bufp = kmem_alloc(bufsz, KM_SLEEP);
	movesz = 0;
	dv = (struct dv_node *)-1;

	/*
	 * Move as many entries into the uio structure as it will take.
	 * Special case "." and "..".
	 */
	diroff = 0;
	if (soff == 0) {				/* . */
		reclen = DIRENT64_RECLEN(strlen("."));
		if ((movesz + reclen) > bufsz)
			goto full;
		de->d_ino = (ino64_t)ddv->dv_ino;
		de->d_off = (off64_t)diroff + 1;
		de->d_reclen = (ushort_t)reclen;

		/* use strncpy(9f) to zero out uninitialized bytes */

		(void) strncpy(de->d_name, ".", DIRENT64_NAMELEN(reclen));
		movesz += reclen;
		de = (dirent64_t *)(intptr_t)((char *)de + reclen);
		dcmn_err3(("devfs_readdir: A: diroff %lld, soff %lld: '%s' "
		    "reclen %lu\n", diroff, soff, ".", reclen));
	}

	diroff++;
	if (soff <= 1) {				/* .. */
		reclen = DIRENT64_RECLEN(strlen(".."));
		if ((movesz + reclen) > bufsz)
			goto full;
		de->d_ino = (ino64_t)ddv->dv_dotdot->dv_ino;
		de->d_off = (off64_t)diroff + 1;
		de->d_reclen = (ushort_t)reclen;

		/* use strncpy(9f) to zero out uninitialized bytes */

		(void) strncpy(de->d_name, "..", DIRENT64_NAMELEN(reclen));
		movesz += reclen;
		de = (dirent64_t *)(intptr_t)((char *)de + reclen);
		dcmn_err3(("devfs_readdir: B: diroff %lld, soff %lld: '%s' "
		    "reclen %lu\n", diroff, soff, "..", reclen));
	}

	diroff++;
	for (dv = DV_FIRST_ENTRY(ddv); dv;
	    dv = DV_NEXT_ENTRY(ddv, dv), diroff++) {
		/* skip entries until at correct directory offset */
		if (diroff < soff)
			continue;

		/*
		 * hidden nodes are skipped (but they still occupy a
		 * directory offset).
		 */
		if (dv->dv_devi && ndi_dev_is_hidden_node(dv->dv_devi))
			continue;

		/*
		 * DDM_INTERNAL_PATH minor nodes are skipped for readdirs
		 * outside the kernel (but they still occupy a directory
		 * offset).
		 */
		if ((dv->dv_flags & DV_INTERNAL) && (cred != kcred))
			continue;

		reclen = DIRENT64_RECLEN(strlen(dv->dv_name));
		if ((movesz + reclen) > bufsz) {
			dcmn_err3(("devfs_readdir: C: diroff "
			    "%lld, soff %lld: '%s' reclen %lu\n",
			    diroff, soff, dv->dv_name, reclen));
			goto full;
		}
		de->d_ino = (ino64_t)dv->dv_ino;
		de->d_off = (off64_t)diroff + 1;
		de->d_reclen = (ushort_t)reclen;

		/* use strncpy(9f) to zero out uninitialized bytes */

		ASSERT(strlen(dv->dv_name) + 1 <=
		    DIRENT64_NAMELEN(reclen));
		(void) strncpy(de->d_name, dv->dv_name,
		    DIRENT64_NAMELEN(reclen));

		movesz += reclen;
		de = (dirent64_t *)(intptr_t)((char *)de + reclen);
		dcmn_err4(("devfs_readdir: D: diroff "
		    "%lld, soff %lld: '%s' reclen %lu\n", diroff, soff,
		    dv->dv_name, reclen));
	}

	/* the buffer is full, or we exhausted everything */
full:	dcmn_err3(("devfs_readdir: moving %lu bytes: "
	    "diroff %lld, soff %lld, dv %p\n",
	    movesz, diroff, soff, (void *)dv));

	if ((movesz == 0) && dv)
		error = EINVAL;		/* cannot be represented */
	else {
		error = uiomove(bufp, movesz, UIO_READ, uiop);
		if (error == 0) {
			if (eofp)
				*eofp = dv ? 0 : 1;
			uiop->uio_loffset = diroff;
		}

		va.va_mask = AT_ATIME;
		gethrestime(&va.va_atime);
		rw_exit(&ddv->dv_contents);
		(void) devfs_setattr(dvp, &va, 0, cred, ct);
		rw_enter(&ddv->dv_contents, RW_READER);
	}

	kmem_free(bufp, bufsz);
	return (error);
}

/*ARGSUSED*/
static int
devfs_fsync(struct vnode *vp, int syncflag, struct cred *cred,
    caller_context_t *ct)
{
	/*
	 * Message goes to console only. Otherwise, the message
	 * causes devfs_fsync to be invoked again... infinite loop
	 */
	dcmn_err2(("devfs_fsync %s\n", VTODV(vp)->dv_name));
	return (0);
}

/*
 * Normally, we leave the dv_node here at count of 0.
 * The node will be destroyed when dv_cleandir() is called.
 *
 * Stale dv_node's are already unlinked from the fs tree,
 * so dv_cleandir() won't find them. We destroy such nodes
 * immediately.
 */
/*ARGSUSED1*/
static void
devfs_inactive(struct vnode *vp, struct cred *cred, caller_context_t *ct)
{
	int destroy;
	struct dv_node *dv = VTODV(vp);

	dcmn_err2(("devfs_inactive: %s\n", dv->dv_name));
	mutex_enter(&vp->v_lock);
	ASSERT(vp->v_count >= 1);
	VN_RELE_LOCKED(vp);
	destroy = (DV_STALE(dv) && vp->v_count == 0);
	mutex_exit(&vp->v_lock);

	/* stale nodes cannot be rediscovered, destroy it here */
	if (destroy)
		dv_destroy(dv, 0);
}

/*
 * XXX Why do we need this?  NFS mounted /dev directories?
 * XXX Talk to peter staubach about this.
 */
/*ARGSUSED2*/
static int
devfs_fid(struct vnode *vp, struct fid *fidp, caller_context_t *ct)
{
	struct dv_node	*dv = VTODV(vp);
	struct dv_fid	*dv_fid;

	if (fidp->fid_len < (sizeof (struct dv_fid) - sizeof (ushort_t))) {
		fidp->fid_len = sizeof (struct dv_fid) - sizeof (ushort_t);
		return (ENOSPC);
	}

	dv_fid = (struct dv_fid *)fidp;
	bzero(dv_fid, sizeof (struct dv_fid));
	dv_fid->dvfid_len = (int)sizeof (struct dv_fid) - sizeof (ushort_t);
	dv_fid->dvfid_ino = dv->dv_ino;
	/* dv_fid->dvfid_gen = dv->tn_gen; XXX ? */

	return (0);
}

/*
 * This pair of routines bracket all VOP_READ, VOP_WRITE
 * and VOP_READDIR requests.  The contents lock stops things
 * moving around while we're looking at them.
 *
 * Also used by file and record locking.
 */
/*ARGSUSED2*/
static int
devfs_rwlock(struct vnode *vp, int write_flag, caller_context_t *ct)
{
	dcmn_err2(("devfs_rwlock %s\n", VTODV(vp)->dv_name));
	rw_enter(&VTODV(vp)->dv_contents, write_flag ? RW_WRITER : RW_READER);
	return (write_flag);
}

/*ARGSUSED1*/
static void
devfs_rwunlock(struct vnode *vp, int write_flag, caller_context_t *ct)
{
	dcmn_err2(("devfs_rwunlock %s\n", VTODV(vp)->dv_name));
	rw_exit(&VTODV(vp)->dv_contents);
}

/*
 * XXX	Should probably do a better job of computing the maximum
 *	offset available in the directory.
 */
/*ARGSUSED1*/
static int
devfs_seek(struct vnode *vp, offset_t ooff, offset_t *noffp,
    caller_context_t *ct)
{
	ASSERT(vp->v_type == VDIR);
	dcmn_err2(("devfs_seek %s\n", VTODV(vp)->dv_name));
	return (*noffp < 0 ? EINVAL : 0);
}

vnodeops_t *dv_vnodeops;

const fs_operation_def_t dv_vnodeops_template[] = {
	VOPNAME_OPEN,		{ .vop_open = devfs_open },
	VOPNAME_CLOSE,		{ .vop_close = devfs_close },
	VOPNAME_READ,		{ .vop_read = devfs_read },
	VOPNAME_WRITE,		{ .vop_write = devfs_write },
	VOPNAME_IOCTL,		{ .vop_ioctl = devfs_ioctl },
	VOPNAME_GETATTR,	{ .vop_getattr = devfs_getattr },
	VOPNAME_SETATTR,	{ .vop_setattr = devfs_setattr },
	VOPNAME_ACCESS,		{ .vop_access = devfs_access },
	VOPNAME_LOOKUP,		{ .vop_lookup = devfs_lookup },
	VOPNAME_CREATE,		{ .vop_create = devfs_create },
	VOPNAME_READDIR,	{ .vop_readdir = devfs_readdir },
	VOPNAME_FSYNC,		{ .vop_fsync = devfs_fsync },
	VOPNAME_INACTIVE,	{ .vop_inactive = devfs_inactive },
	VOPNAME_FID,		{ .vop_fid = devfs_fid },
	VOPNAME_RWLOCK,		{ .vop_rwlock = devfs_rwlock },
	VOPNAME_RWUNLOCK,	{ .vop_rwunlock = devfs_rwunlock },
	VOPNAME_SEEK,		{ .vop_seek = devfs_seek },
	VOPNAME_PATHCONF,	{ .vop_pathconf = devfs_pathconf },
	VOPNAME_DISPOSE,	{ .error = fs_error },
	VOPNAME_SETSECATTR,	{ .vop_setsecattr = devfs_setsecattr },
	VOPNAME_GETSECATTR,	{ .vop_getsecattr = devfs_getsecattr },
	NULL,			NULL
};