1/*-
2 * SPDX-License-Identifier: BSD-2-Clause
3 *
4 * Copyright (c) 1999-2002 Poul-Henning Kamp
5 * All rights reserved.
6 *
7 * Redistribution and use in source and binary forms, with or without
8 * modification, are permitted provided that the following conditions
9 * are met:
10 * 1. Redistributions of source code must retain the above copyright
11 *    notice, this list of conditions and the following disclaimer.
12 * 2. Redistributions in binary form must reproduce the above copyright
13 *    notice, this list of conditions and the following disclaimer in the
14 *    documentation and/or other materials provided with the distribution.
15 *
16 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
17 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
18 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
19 * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
20 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
21 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
22 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
23 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
24 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
25 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
26 * SUCH DAMAGE.
27 */
28
29#include <sys/param.h>
30#include <sys/kernel.h>
31#include <sys/systm.h>
32#include <sys/bio.h>
33#include <sys/devctl.h>
34#include <sys/lock.h>
35#include <sys/mutex.h>
36#include <sys/module.h>
37#include <sys/malloc.h>
38#include <sys/conf.h>
39#include <sys/vnode.h>
40#include <sys/queue.h>
41#include <sys/poll.h>
42#include <sys/sx.h>
43#include <sys/ctype.h>
44#include <sys/ucred.h>
45#include <sys/taskqueue.h>
46#include <machine/stdarg.h>
47
48#include <fs/devfs/devfs_int.h>
49#include <vm/vm.h>
50
51static MALLOC_DEFINE(M_DEVT, "cdev", "cdev storage");
52
53struct mtx devmtx;
54static void destroy_devl(struct cdev *dev);
55static int destroy_dev_sched_cbl(struct cdev *dev,
56    void (*cb)(void *), void *arg);
57static void destroy_dev_tq(void *ctx, int pending);
58static void destroy_dev_tq_giant(void *ctx, int pending);
59static int make_dev_credv(int flags, struct cdev **dres, struct cdevsw *devsw,
60    int unit, struct ucred *cr, uid_t uid, gid_t gid, int mode, const char *fmt,
61    va_list ap);
62
63static struct cdev_priv_list cdevp_free_list =
64    TAILQ_HEAD_INITIALIZER(cdevp_free_list);
65static SLIST_HEAD(free_cdevsw, cdevsw) cdevsw_gt_post_list =
66    SLIST_HEAD_INITIALIZER(cdevsw_gt_post_list);
67
68void
69dev_lock(void)
70{
71
72	mtx_lock(&devmtx);
73}
74
75/*
76 * Free all the memory collected while the cdev mutex was
77 * locked. Since devmtx is after the system map mutex, free() cannot
78 * be called immediately and is postponed until cdev mutex can be
79 * dropped.
80 */
81static void
82dev_unlock_and_free(void)
83{
84	struct cdev_priv_list cdp_free;
85	struct free_cdevsw csw_free;
86	struct cdev_priv *cdp;
87	struct cdevsw *csw;
88
89	dev_lock_assert_locked();
90
91	/*
92	 * Make the local copy of the list heads while the dev_mtx is
93	 * held. Free it later.
94	 */
95	TAILQ_INIT(&cdp_free);
96	TAILQ_CONCAT(&cdp_free, &cdevp_free_list, cdp_list);
97	csw_free = cdevsw_gt_post_list;
98	SLIST_INIT(&cdevsw_gt_post_list);
99
100	mtx_unlock(&devmtx);
101
102	while ((cdp = TAILQ_FIRST(&cdp_free)) != NULL) {
103		TAILQ_REMOVE(&cdp_free, cdp, cdp_list);
104		devfs_free(&cdp->cdp_c);
105	}
106	while ((csw = SLIST_FIRST(&csw_free)) != NULL) {
107		SLIST_REMOVE_HEAD(&csw_free, d_postfree_list);
108		free(csw, M_DEVT);
109	}
110}
111
112static void
113dev_free_devlocked(struct cdev *cdev)
114{
115	struct cdev_priv *cdp;
116
117	dev_lock_assert_locked();
118	cdp = cdev2priv(cdev);
119	KASSERT((cdp->cdp_flags & CDP_UNREF_DTR) == 0,
120	    ("destroy_dev() was not called after delist_dev(%p)", cdev));
121	KASSERT((cdp->cdp_flags & CDP_ON_ACTIVE_LIST) == 0,
122	    ("%s: cdp %p (%s) on active list", __func__, cdp, cdev->si_name));
123	TAILQ_INSERT_HEAD(&cdevp_free_list, cdp, cdp_list);
124}
125
126static void
127cdevsw_free_devlocked(struct cdevsw *csw)
128{
129
130	dev_lock_assert_locked();
131	SLIST_INSERT_HEAD(&cdevsw_gt_post_list, csw, d_postfree_list);
132}
133
134void
135dev_unlock(void)
136{
137
138	mtx_unlock(&devmtx);
139}
140
141void
142dev_ref(struct cdev *dev)
143{
144
145	dev_lock_assert_unlocked();
146	mtx_lock(&devmtx);
147	dev->si_refcount++;
148	mtx_unlock(&devmtx);
149}
150
151void
152dev_refl(struct cdev *dev)
153{
154
155	dev_lock_assert_locked();
156	dev->si_refcount++;
157}
158
159void
160dev_rel(struct cdev *dev)
161{
162	int flag = 0;
163
164	dev_lock_assert_unlocked();
165	dev_lock();
166	dev->si_refcount--;
167	KASSERT(dev->si_refcount >= 0,
168	    ("dev_rel(%s) gave negative count", devtoname(dev)));
169	if (dev->si_devsw == NULL && dev->si_refcount == 0) {
170		LIST_REMOVE(dev, si_list);
171		flag = 1;
172	}
173	dev_unlock();
174	if (flag)
175		devfs_free(dev);
176}
177
178struct cdevsw *
179dev_refthread(struct cdev *dev, int *ref)
180{
181	struct cdevsw *csw;
182	struct cdev_priv *cdp;
183
184	dev_lock_assert_unlocked();
185	if ((dev->si_flags & SI_ETERNAL) != 0) {
186		*ref = 0;
187		return (dev->si_devsw);
188	}
189	cdp = cdev2priv(dev);
190	mtx_lock(&cdp->cdp_threadlock);
191	csw = dev->si_devsw;
192	if (csw != NULL) {
193		if ((cdp->cdp_flags & CDP_SCHED_DTR) == 0)
194			atomic_add_long(&dev->si_threadcount, 1);
195		else
196			csw = NULL;
197	}
198	mtx_unlock(&cdp->cdp_threadlock);
199	if (csw != NULL)
200		*ref = 1;
201	return (csw);
202}
203
204struct cdevsw *
205devvn_refthread(struct vnode *vp, struct cdev **devp, int *ref)
206{
207	struct cdevsw *csw;
208	struct cdev_priv *cdp;
209	struct cdev *dev;
210
211	dev_lock_assert_unlocked();
212	if ((vp->v_vflag & VV_ETERNALDEV) != 0) {
213		dev = vp->v_rdev;
214		if (dev == NULL)
215			return (NULL);
216		KASSERT((dev->si_flags & SI_ETERNAL) != 0,
217		    ("Not eternal cdev"));
218		*ref = 0;
219		csw = dev->si_devsw;
220		KASSERT(csw != NULL, ("Eternal cdev is destroyed"));
221		*devp = dev;
222		return (csw);
223	}
224
225	csw = NULL;
226	VI_LOCK(vp);
227	dev = vp->v_rdev;
228	if (dev == NULL) {
229		VI_UNLOCK(vp);
230		return (NULL);
231	}
232	cdp = cdev2priv(dev);
233	mtx_lock(&cdp->cdp_threadlock);
234	if ((cdp->cdp_flags & CDP_SCHED_DTR) == 0) {
235		csw = dev->si_devsw;
236		if (csw != NULL)
237			atomic_add_long(&dev->si_threadcount, 1);
238	}
239	mtx_unlock(&cdp->cdp_threadlock);
240	VI_UNLOCK(vp);
241	if (csw != NULL) {
242		*devp = dev;
243		*ref = 1;
244	}
245	return (csw);
246}
247
248void
249dev_relthread(struct cdev *dev, int ref)
250{
251
252	dev_lock_assert_unlocked();
253	if (!ref)
254		return;
255	KASSERT(dev->si_threadcount > 0,
256	    ("%s threadcount is wrong", dev->si_name));
257	atomic_subtract_rel_long(&dev->si_threadcount, 1);
258}
259
260int
261nullop(void)
262{
263
264	return (0);
265}
266
267int
268eopnotsupp(void)
269{
270
271	return (EOPNOTSUPP);
272}
273
274static int
275enxio(void)
276{
277	return (ENXIO);
278}
279
280static int
281enodev(void)
282{
283	return (ENODEV);
284}
285
286/* Define a dead_cdevsw for use when devices leave unexpectedly. */
287
288#define dead_open	(d_open_t *)enxio
289#define dead_close	(d_close_t *)enxio
290#define dead_read	(d_read_t *)enxio
291#define dead_write	(d_write_t *)enxio
292#define dead_ioctl	(d_ioctl_t *)enxio
293#define dead_poll	(d_poll_t *)enodev
294#define dead_mmap	(d_mmap_t *)enodev
295
296static void
297dead_strategy(struct bio *bp)
298{
299
300	biofinish(bp, NULL, ENXIO);
301}
302
303#define dead_kqfilter	(d_kqfilter_t *)enxio
304#define dead_mmap_single (d_mmap_single_t *)enodev
305
306static struct cdevsw dead_cdevsw = {
307	.d_version =	D_VERSION,
308	.d_open =	dead_open,
309	.d_close =	dead_close,
310	.d_read =	dead_read,
311	.d_write =	dead_write,
312	.d_ioctl =	dead_ioctl,
313	.d_poll =	dead_poll,
314	.d_mmap =	dead_mmap,
315	.d_strategy =	dead_strategy,
316	.d_name =	"dead",
317	.d_kqfilter =	dead_kqfilter,
318	.d_mmap_single = dead_mmap_single
319};
320
321/* Default methods if driver does not specify method */
322
323#define null_open	(d_open_t *)nullop
324#define null_close	(d_close_t *)nullop
325#define no_read		(d_read_t *)enodev
326#define no_write	(d_write_t *)enodev
327#define no_ioctl	(d_ioctl_t *)enodev
328#define no_mmap		(d_mmap_t *)enodev
329#define no_kqfilter	(d_kqfilter_t *)enodev
330#define no_mmap_single	(d_mmap_single_t *)enodev
331
332static void
333no_strategy(struct bio *bp)
334{
335
336	biofinish(bp, NULL, ENODEV);
337}
338
339static int
340no_poll(struct cdev *dev __unused, int events, struct thread *td __unused)
341{
342
343	return (poll_no_poll(events));
344}
345
346static int
347giant_open(struct cdev *dev, int oflags, int devtype, struct thread *td)
348{
349	struct cdevsw *dsw;
350	int ref, retval;
351
352	dsw = dev_refthread(dev, &ref);
353	if (dsw == NULL)
354		return (ENXIO);
355	mtx_lock(&Giant);
356	retval = dsw->d_gianttrick->d_open(dev, oflags, devtype, td);
357	mtx_unlock(&Giant);
358	dev_relthread(dev, ref);
359	return (retval);
360}
361
362static int
363giant_fdopen(struct cdev *dev, int oflags, struct thread *td, struct file *fp)
364{
365	struct cdevsw *dsw;
366	int ref, retval;
367
368	dsw = dev_refthread(dev, &ref);
369	if (dsw == NULL)
370		return (ENXIO);
371	mtx_lock(&Giant);
372	retval = dsw->d_gianttrick->d_fdopen(dev, oflags, td, fp);
373	mtx_unlock(&Giant);
374	dev_relthread(dev, ref);
375	return (retval);
376}
377
378static int
379giant_close(struct cdev *dev, int fflag, int devtype, struct thread *td)
380{
381	struct cdevsw *dsw;
382	int ref, retval;
383
384	dsw = dev_refthread(dev, &ref);
385	if (dsw == NULL)
386		return (ENXIO);
387	mtx_lock(&Giant);
388	retval = dsw->d_gianttrick->d_close(dev, fflag, devtype, td);
389	mtx_unlock(&Giant);
390	dev_relthread(dev, ref);
391	return (retval);
392}
393
394static void
395giant_strategy(struct bio *bp)
396{
397	struct cdevsw *dsw;
398	struct cdev *dev;
399	int ref;
400
401	dev = bp->bio_dev;
402	dsw = dev_refthread(dev, &ref);
403	if (dsw == NULL) {
404		biofinish(bp, NULL, ENXIO);
405		return;
406	}
407	mtx_lock(&Giant);
408	dsw->d_gianttrick->d_strategy(bp);
409	mtx_unlock(&Giant);
410	dev_relthread(dev, ref);
411}
412
413static int
414giant_ioctl(struct cdev *dev, u_long cmd, caddr_t data, int fflag, struct thread *td)
415{
416	struct cdevsw *dsw;
417	int ref, retval;
418
419	dsw = dev_refthread(dev, &ref);
420	if (dsw == NULL)
421		return (ENXIO);
422	mtx_lock(&Giant);
423	retval = dsw->d_gianttrick->d_ioctl(dev, cmd, data, fflag, td);
424	mtx_unlock(&Giant);
425	dev_relthread(dev, ref);
426	return (retval);
427}
428
429static int
430giant_read(struct cdev *dev, struct uio *uio, int ioflag)
431{
432	struct cdevsw *dsw;
433	int ref, retval;
434
435	dsw = dev_refthread(dev, &ref);
436	if (dsw == NULL)
437		return (ENXIO);
438	mtx_lock(&Giant);
439	retval = dsw->d_gianttrick->d_read(dev, uio, ioflag);
440	mtx_unlock(&Giant);
441	dev_relthread(dev, ref);
442	return (retval);
443}
444
445static int
446giant_write(struct cdev *dev, struct uio *uio, int ioflag)
447{
448	struct cdevsw *dsw;
449	int ref, retval;
450
451	dsw = dev_refthread(dev, &ref);
452	if (dsw == NULL)
453		return (ENXIO);
454	mtx_lock(&Giant);
455	retval = dsw->d_gianttrick->d_write(dev, uio, ioflag);
456	mtx_unlock(&Giant);
457	dev_relthread(dev, ref);
458	return (retval);
459}
460
461static int
462giant_poll(struct cdev *dev, int events, struct thread *td)
463{
464	struct cdevsw *dsw;
465	int ref, retval;
466
467	dsw = dev_refthread(dev, &ref);
468	if (dsw == NULL)
469		return (ENXIO);
470	mtx_lock(&Giant);
471	retval = dsw->d_gianttrick->d_poll(dev, events, td);
472	mtx_unlock(&Giant);
473	dev_relthread(dev, ref);
474	return (retval);
475}
476
477static int
478giant_kqfilter(struct cdev *dev, struct knote *kn)
479{
480	struct cdevsw *dsw;
481	int ref, retval;
482
483	dsw = dev_refthread(dev, &ref);
484	if (dsw == NULL)
485		return (ENXIO);
486	mtx_lock(&Giant);
487	retval = dsw->d_gianttrick->d_kqfilter(dev, kn);
488	mtx_unlock(&Giant);
489	dev_relthread(dev, ref);
490	return (retval);
491}
492
493static int
494giant_mmap(struct cdev *dev, vm_ooffset_t offset, vm_paddr_t *paddr, int nprot,
495    vm_memattr_t *memattr)
496{
497	struct cdevsw *dsw;
498	int ref, retval;
499
500	dsw = dev_refthread(dev, &ref);
501	if (dsw == NULL)
502		return (ENXIO);
503	mtx_lock(&Giant);
504	retval = dsw->d_gianttrick->d_mmap(dev, offset, paddr, nprot,
505	    memattr);
506	mtx_unlock(&Giant);
507	dev_relthread(dev, ref);
508	return (retval);
509}
510
511static int
512giant_mmap_single(struct cdev *dev, vm_ooffset_t *offset, vm_size_t size,
513    vm_object_t *object, int nprot)
514{
515	struct cdevsw *dsw;
516	int ref, retval;
517
518	dsw = dev_refthread(dev, &ref);
519	if (dsw == NULL)
520		return (ENXIO);
521	mtx_lock(&Giant);
522	retval = dsw->d_gianttrick->d_mmap_single(dev, offset, size, object,
523	    nprot);
524	mtx_unlock(&Giant);
525	dev_relthread(dev, ref);
526	return (retval);
527}
528
529static void
530notify(struct cdev *dev, const char *ev, int flags)
531{
532	static const char prefix[] = "cdev=";
533	char *data;
534	int namelen, mflags;
535
536	if (cold)
537		return;
538	mflags = (flags & MAKEDEV_NOWAIT) ? M_NOWAIT : M_WAITOK;
539	namelen = strlen(dev->si_name);
540	data = malloc(namelen + sizeof(prefix), M_TEMP, mflags);
541	if (data == NULL)
542		return;
543	memcpy(data, prefix, sizeof(prefix) - 1);
544	memcpy(data + sizeof(prefix) - 1, dev->si_name, namelen + 1);
545	devctl_notify("DEVFS", "CDEV", ev, data);
546	free(data, M_TEMP);
547}
548
549static void
550notify_create(struct cdev *dev, int flags)
551{
552
553	notify(dev, "CREATE", flags);
554}
555
556static void
557notify_destroy(struct cdev *dev)
558{
559
560	notify(dev, "DESTROY", MAKEDEV_WAITOK);
561}
562
563static struct cdev *
564newdev(struct make_dev_args *args, struct cdev *si)
565{
566	struct cdev *si2;
567	struct cdevsw *csw;
568
569	dev_lock_assert_locked();
570	csw = args->mda_devsw;
571	si2 = NULL;
572	if (csw->d_flags & D_NEEDMINOR) {
573		/* We may want to return an existing device */
574		LIST_FOREACH(si2, &csw->d_devs, si_list) {
575			if (dev2unit(si2) == args->mda_unit) {
576				dev_free_devlocked(si);
577				si = si2;
578				break;
579			}
580		}
581
582		/*
583		 * If we're returning an existing device, we should make sure
584		 * it isn't already initialized.  This would have been caught
585		 * in consumers anyways, but it's good to catch such a case
586		 * early.  We still need to complete initialization of the
587		 * device, and we'll use whatever make_dev_args were passed in
588		 * to do so.
589		 */
590		KASSERT(si2 == NULL || (si2->si_flags & SI_NAMED) == 0,
591		    ("make_dev() by driver %s on pre-existing device (min=%x, name=%s)",
592		    args->mda_devsw->d_name, dev2unit(si2), devtoname(si2)));
593	}
594	si->si_drv0 = args->mda_unit;
595	si->si_drv1 = args->mda_si_drv1;
596	si->si_drv2 = args->mda_si_drv2;
597	/* Only push to csw->d_devs if it's not a cloned device. */
598	if (si2 == NULL) {
599		si->si_devsw = csw;
600		LIST_INSERT_HEAD(&csw->d_devs, si, si_list);
601	} else {
602		KASSERT(si->si_devsw == csw,
603		    ("%s: inconsistent devsw between clone_create() and make_dev()",
604		    __func__));
605	}
606	return (si);
607}
608
609static void
610fini_cdevsw(struct cdevsw *devsw)
611{
612	struct cdevsw *gt;
613
614	if (devsw->d_gianttrick != NULL) {
615		gt = devsw->d_gianttrick;
616		memcpy(devsw, gt, sizeof *devsw);
617		cdevsw_free_devlocked(gt);
618		devsw->d_gianttrick = NULL;
619	}
620	devsw->d_flags &= ~D_INIT;
621}
622
623static int
624prep_cdevsw(struct cdevsw *devsw, int flags)
625{
626	struct cdevsw *dsw2;
627
628	dev_lock_assert_locked();
629	if (devsw->d_flags & D_INIT)
630		return (0);
631	if (devsw->d_flags & D_NEEDGIANT) {
632		dev_unlock();
633		dsw2 = malloc(sizeof *dsw2, M_DEVT,
634		     (flags & MAKEDEV_NOWAIT) ? M_NOWAIT : M_WAITOK);
635		dev_lock();
636		if (dsw2 == NULL && !(devsw->d_flags & D_INIT))
637			return (ENOMEM);
638	} else
639		dsw2 = NULL;
640	if (devsw->d_flags & D_INIT) {
641		if (dsw2 != NULL)
642			cdevsw_free_devlocked(dsw2);
643		return (0);
644	}
645
646	if (devsw->d_version != D_VERSION_04) {
647		printf(
648		    "WARNING: Device driver \"%s\" has wrong version %s\n",
649		    devsw->d_name == NULL ? "???" : devsw->d_name,
650		    "and is disabled.  Recompile KLD module.");
651		devsw->d_open = dead_open;
652		devsw->d_close = dead_close;
653		devsw->d_read = dead_read;
654		devsw->d_write = dead_write;
655		devsw->d_ioctl = dead_ioctl;
656		devsw->d_poll = dead_poll;
657		devsw->d_mmap = dead_mmap;
658		devsw->d_mmap_single = dead_mmap_single;
659		devsw->d_strategy = dead_strategy;
660		devsw->d_kqfilter = dead_kqfilter;
661	}
662
663	if ((devsw->d_flags & D_NEEDGIANT) != 0) {
664		if ((devsw->d_flags & D_GIANTOK) == 0) {
665			printf(
666			    "WARNING: Device \"%s\" is Giant locked and may be "
667			    "deleted before FreeBSD 15.0.\n",
668			    devsw->d_name == NULL ? "???" : devsw->d_name);
669		}
670		if (devsw->d_gianttrick == NULL) {
671			memcpy(dsw2, devsw, sizeof *dsw2);
672			devsw->d_gianttrick = dsw2;
673			dsw2 = NULL;
674		}
675	}
676
677#define FIXUP(member, noop, giant) 				\
678	do {							\
679		if (devsw->member == NULL) {			\
680			devsw->member = noop;			\
681		} else if (devsw->d_flags & D_NEEDGIANT)	\
682			devsw->member = giant;			\
683		}						\
684	while (0)
685
686	FIXUP(d_open,		null_open,	giant_open);
687	FIXUP(d_fdopen,		NULL,		giant_fdopen);
688	FIXUP(d_close,		null_close,	giant_close);
689	FIXUP(d_read,		no_read,	giant_read);
690	FIXUP(d_write,		no_write,	giant_write);
691	FIXUP(d_ioctl,		no_ioctl,	giant_ioctl);
692	FIXUP(d_poll,		no_poll,	giant_poll);
693	FIXUP(d_mmap,		no_mmap,	giant_mmap);
694	FIXUP(d_strategy,	no_strategy,	giant_strategy);
695	FIXUP(d_kqfilter,	no_kqfilter,	giant_kqfilter);
696	FIXUP(d_mmap_single,	no_mmap_single,	giant_mmap_single);
697
698	LIST_INIT(&devsw->d_devs);
699
700	devsw->d_flags |= D_INIT;
701
702	if (dsw2 != NULL)
703		cdevsw_free_devlocked(dsw2);
704	return (0);
705}
706
707static int
708prep_devname(struct cdev *dev, const char *fmt, va_list ap)
709{
710	int len;
711	char *from, *q, *s, *to;
712
713	dev_lock_assert_locked();
714
715	len = vsnrprintf(dev->si_name, sizeof(dev->si_name), 32, fmt, ap);
716	if (len > sizeof(dev->si_name) - 1)
717		return (ENAMETOOLONG);
718
719	/* Strip leading slashes. */
720	for (from = dev->si_name; *from == '/'; from++)
721		;
722
723	for (to = dev->si_name; *from != '\0'; from++, to++) {
724		/*
725		 * Spaces and double quotation marks cause
726		 * problems for the devctl(4) protocol.
727		 * Reject names containing those characters.
728		 */
729		if (isspace(*from) || *from == '"')
730			return (EINVAL);
731		/* Treat multiple sequential slashes as single. */
732		while (from[0] == '/' && from[1] == '/')
733			from++;
734		/* Trailing slash is considered invalid. */
735		if (from[0] == '/' && from[1] == '\0')
736			return (EINVAL);
737		*to = *from;
738	}
739	*to = '\0';
740
741	if (dev->si_name[0] == '\0')
742		return (EINVAL);
743
744	/* Disallow "." and ".." components. */
745	for (s = dev->si_name;;) {
746		for (q = s; *q != '/' && *q != '\0'; q++)
747			;
748		if (q - s == 1 && s[0] == '.')
749			return (EINVAL);
750		if (q - s == 2 && s[0] == '.' && s[1] == '.')
751			return (EINVAL);
752		if (*q != '/')
753			break;
754		s = q + 1;
755	}
756
757	if (devfs_dev_exists(dev->si_name) != 0)
758		return (EEXIST);
759
760	return (0);
761}
762
763void
764make_dev_args_init_impl(struct make_dev_args *args, size_t sz)
765{
766
767	bzero(args, sz);
768	args->mda_size = sz;
769}
770
771static int
772make_dev_sv(struct make_dev_args *args1, struct cdev **dres,
773    const char *fmt, va_list ap)
774{
775	struct cdev *dev, *dev_new;
776	struct make_dev_args args;
777	int res;
778
779	bzero(&args, sizeof(args));
780	if (sizeof(args) < args1->mda_size)
781		return (EINVAL);
782	bcopy(args1, &args, args1->mda_size);
783	KASSERT((args.mda_flags & MAKEDEV_WAITOK) == 0 ||
784	    (args.mda_flags & MAKEDEV_NOWAIT) == 0,
785	    ("make_dev_sv: both WAITOK and NOWAIT specified"));
786	dev_new = devfs_alloc(args.mda_flags);
787	if (dev_new == NULL)
788		return (ENOMEM);
789	dev_lock();
790	res = prep_cdevsw(args.mda_devsw, args.mda_flags);
791	if (res != 0) {
792		dev_unlock();
793		devfs_free(dev_new);
794		return (res);
795	}
796	dev = newdev(&args, dev_new);
797	if ((dev->si_flags & SI_NAMED) == 0) {
798		res = prep_devname(dev, fmt, ap);
799		if (res != 0) {
800			if ((args.mda_flags & MAKEDEV_CHECKNAME) == 0) {
801				panic(
802			"make_dev_sv: bad si_name (error=%d, si_name=%s)",
803				    res, dev->si_name);
804			}
805			if (dev == dev_new) {
806				LIST_REMOVE(dev, si_list);
807				dev_unlock();
808				devfs_free(dev);
809			} else
810				dev_unlock();
811			return (res);
812		}
813	}
814	if ((args.mda_flags & MAKEDEV_REF) != 0)
815		dev_refl(dev);
816	if ((args.mda_flags & MAKEDEV_ETERNAL) != 0)
817		dev->si_flags |= SI_ETERNAL;
818	KASSERT(!(dev->si_flags & SI_NAMED),
819	    ("make_dev() by driver %s on pre-existing device (min=%x, name=%s)",
820	    args.mda_devsw->d_name, dev2unit(dev), devtoname(dev)));
821	dev->si_flags |= SI_NAMED;
822	if (args.mda_cr != NULL)
823		dev->si_cred = crhold(args.mda_cr);
824	dev->si_uid = args.mda_uid;
825	dev->si_gid = args.mda_gid;
826	dev->si_mode = args.mda_mode;
827
828	devfs_create(dev);
829	clean_unrhdrl(devfs_inos);
830	dev_unlock_and_free();
831
832	notify_create(dev, args.mda_flags);
833
834	*dres = dev;
835	return (0);
836}
837
838int
839make_dev_s(struct make_dev_args *args, struct cdev **dres,
840    const char *fmt, ...)
841{
842	va_list ap;
843	int res;
844
845	va_start(ap, fmt);
846	res = make_dev_sv(args, dres, fmt, ap);
847	va_end(ap);
848	return (res);
849}
850
851static int
852make_dev_credv(int flags, struct cdev **dres, struct cdevsw *devsw, int unit,
853    struct ucred *cr, uid_t uid, gid_t gid, int mode, const char *fmt,
854    va_list ap)
855{
856	struct make_dev_args args;
857
858	make_dev_args_init(&args);
859	args.mda_flags = flags;
860	args.mda_devsw = devsw;
861	args.mda_cr = cr;
862	args.mda_uid = uid;
863	args.mda_gid = gid;
864	args.mda_mode = mode;
865	args.mda_unit = unit;
866	return (make_dev_sv(&args, dres, fmt, ap));
867}
868
869struct cdev *
870make_dev(struct cdevsw *devsw, int unit, uid_t uid, gid_t gid, int mode,
871    const char *fmt, ...)
872{
873	struct cdev *dev;
874	va_list ap;
875	int res __unused;
876
877	va_start(ap, fmt);
878	res = make_dev_credv(0, &dev, devsw, unit, NULL, uid, gid, mode, fmt,
879		      ap);
880	va_end(ap);
881	KASSERT(res == 0 && dev != NULL,
882	    ("make_dev: failed make_dev_credv (error=%d)", res));
883	return (dev);
884}
885
886struct cdev *
887make_dev_cred(struct cdevsw *devsw, int unit, struct ucred *cr, uid_t uid,
888    gid_t gid, int mode, const char *fmt, ...)
889{
890	struct cdev *dev;
891	va_list ap;
892	int res __unused;
893
894	va_start(ap, fmt);
895	res = make_dev_credv(0, &dev, devsw, unit, cr, uid, gid, mode, fmt, ap);
896	va_end(ap);
897
898	KASSERT(res == 0 && dev != NULL,
899	    ("make_dev_cred: failed make_dev_credv (error=%d)", res));
900	return (dev);
901}
902
903struct cdev *
904make_dev_credf(int flags, struct cdevsw *devsw, int unit, struct ucred *cr,
905    uid_t uid, gid_t gid, int mode, const char *fmt, ...)
906{
907	struct cdev *dev;
908	va_list ap;
909	int res;
910
911	va_start(ap, fmt);
912	res = make_dev_credv(flags, &dev, devsw, unit, cr, uid, gid, mode,
913	    fmt, ap);
914	va_end(ap);
915
916	KASSERT(((flags & MAKEDEV_NOWAIT) != 0 && res == ENOMEM) ||
917	    ((flags & MAKEDEV_CHECKNAME) != 0 && res != ENOMEM) || res == 0,
918	    ("make_dev_credf: failed make_dev_credv (error=%d)", res));
919	return (res == 0 ? dev : NULL);
920}
921
922int
923make_dev_p(int flags, struct cdev **cdev, struct cdevsw *devsw,
924    struct ucred *cr, uid_t uid, gid_t gid, int mode, const char *fmt, ...)
925{
926	va_list ap;
927	int res;
928
929	va_start(ap, fmt);
930	res = make_dev_credv(flags, cdev, devsw, 0, cr, uid, gid, mode,
931	    fmt, ap);
932	va_end(ap);
933
934	KASSERT(((flags & MAKEDEV_NOWAIT) != 0 && res == ENOMEM) ||
935	    ((flags & MAKEDEV_CHECKNAME) != 0 && res != ENOMEM) || res == 0,
936	    ("make_dev_p: failed make_dev_credv (error=%d)", res));
937	return (res);
938}
939
940static void
941dev_dependsl(struct cdev *pdev, struct cdev *cdev)
942{
943
944	cdev->si_parent = pdev;
945	cdev->si_flags |= SI_CHILD;
946	LIST_INSERT_HEAD(&pdev->si_children, cdev, si_siblings);
947}
948
949void
950dev_depends(struct cdev *pdev, struct cdev *cdev)
951{
952
953	dev_lock();
954	dev_dependsl(pdev, cdev);
955	dev_unlock();
956}
957
958static int
959make_dev_alias_v(int flags, struct cdev **cdev, struct cdev *pdev,
960    const char *fmt, va_list ap)
961{
962	struct cdev *dev;
963	int error;
964
965	KASSERT(pdev != NULL, ("make_dev_alias_v: pdev is NULL"));
966	KASSERT((flags & MAKEDEV_WAITOK) == 0 || (flags & MAKEDEV_NOWAIT) == 0,
967	    ("make_dev_alias_v: both WAITOK and NOWAIT specified"));
968	KASSERT((flags & ~(MAKEDEV_WAITOK | MAKEDEV_NOWAIT |
969	    MAKEDEV_CHECKNAME)) == 0,
970	    ("make_dev_alias_v: invalid flags specified (flags=%02x)", flags));
971
972	dev = devfs_alloc(flags);
973	if (dev == NULL)
974		return (ENOMEM);
975	dev_lock();
976	dev->si_flags |= SI_ALIAS;
977	error = prep_devname(dev, fmt, ap);
978	if (error != 0) {
979		if ((flags & MAKEDEV_CHECKNAME) == 0) {
980			panic("make_dev_alias_v: bad si_name "
981			    "(error=%d, si_name=%s)", error, dev->si_name);
982		}
983		dev_unlock();
984		devfs_free(dev);
985		return (error);
986	}
987	dev->si_flags |= SI_NAMED;
988	devfs_create(dev);
989	dev_dependsl(pdev, dev);
990	clean_unrhdrl(devfs_inos);
991	dev_unlock();
992
993	notify_create(dev, flags);
994	*cdev = dev;
995
996	return (0);
997}
998
999struct cdev *
1000make_dev_alias(struct cdev *pdev, const char *fmt, ...)
1001{
1002	struct cdev *dev;
1003	va_list ap;
1004	int res __unused;
1005
1006	va_start(ap, fmt);
1007	res = make_dev_alias_v(MAKEDEV_WAITOK, &dev, pdev, fmt, ap);
1008	va_end(ap);
1009
1010	KASSERT(res == 0 && dev != NULL,
1011	    ("make_dev_alias: failed make_dev_alias_v (error=%d)", res));
1012	return (dev);
1013}
1014
1015int
1016make_dev_alias_p(int flags, struct cdev **cdev, struct cdev *pdev,
1017    const char *fmt, ...)
1018{
1019	va_list ap;
1020	int res;
1021
1022	va_start(ap, fmt);
1023	res = make_dev_alias_v(flags, cdev, pdev, fmt, ap);
1024	va_end(ap);
1025	return (res);
1026}
1027
1028int
1029make_dev_physpath_alias(int flags, struct cdev **cdev, struct cdev *pdev,
1030    struct cdev *old_alias, const char *physpath)
1031{
1032	char *devfspath;
1033	int physpath_len;
1034	int max_parentpath_len;
1035	int parentpath_len;
1036	int devfspathbuf_len;
1037	int mflags;
1038	int ret;
1039
1040	*cdev = NULL;
1041	devfspath = NULL;
1042	physpath_len = strlen(physpath);
1043	ret = EINVAL;
1044	if (physpath_len == 0)
1045		goto out;
1046
1047	if (strncmp("id1,", physpath, 4) == 0) {
1048		physpath += 4;
1049		physpath_len -= 4;
1050		if (physpath_len == 0)
1051			goto out;
1052	}
1053
1054	max_parentpath_len = SPECNAMELEN - physpath_len - /*/*/1;
1055	parentpath_len = strlen(pdev->si_name);
1056	if (max_parentpath_len < parentpath_len) {
1057		if (bootverbose)
1058			printf("WARNING: Unable to alias %s "
1059			    "to %s/%s - path too long\n",
1060			    pdev->si_name, physpath, pdev->si_name);
1061		ret = ENAMETOOLONG;
1062		goto out;
1063	}
1064
1065	mflags = (flags & MAKEDEV_NOWAIT) ? M_NOWAIT : M_WAITOK;
1066	devfspathbuf_len = physpath_len + /*/*/1 + parentpath_len + /*NUL*/1;
1067	devfspath = malloc(devfspathbuf_len, M_DEVBUF, mflags);
1068	if (devfspath == NULL) {
1069		ret = ENOMEM;
1070		goto out;
1071	}
1072
1073	sprintf(devfspath, "%s/%s", physpath, pdev->si_name);
1074	if (old_alias != NULL && strcmp(old_alias->si_name, devfspath) == 0) {
1075		/* Retain the existing alias. */
1076		*cdev = old_alias;
1077		old_alias = NULL;
1078		ret = 0;
1079	} else {
1080		ret = make_dev_alias_p(flags, cdev, pdev, "%s", devfspath);
1081	}
1082out:
1083	if (old_alias != NULL)
1084		destroy_dev(old_alias);
1085	if (devfspath != NULL)
1086		free(devfspath, M_DEVBUF);
1087	return (ret);
1088}
1089
1090static void
1091destroy_devl(struct cdev *dev)
1092{
1093	struct cdevsw *csw;
1094	struct cdev_privdata *p;
1095	struct cdev_priv *cdp;
1096
1097	dev_lock_assert_locked();
1098	KASSERT(dev->si_flags & SI_NAMED,
1099	    ("WARNING: Driver mistake: destroy_dev on %d\n", dev2unit(dev)));
1100	KASSERT((dev->si_flags & SI_ETERNAL) == 0,
1101	    ("WARNING: Driver mistake: destroy_dev on eternal %d\n",
1102	     dev2unit(dev)));
1103
1104	cdp = cdev2priv(dev);
1105	if ((cdp->cdp_flags & CDP_UNREF_DTR) == 0) {
1106		/*
1107		 * Avoid race with dev_rel(), e.g. from the populate
1108		 * loop.  If CDP_UNREF_DTR flag is set, the reference
1109		 * to be dropped at the end of destroy_devl() was
1110		 * already taken by delist_dev_locked().
1111		 */
1112		dev_refl(dev);
1113
1114		devfs_destroy(dev);
1115	}
1116
1117	/* Remove name marking */
1118	dev->si_flags &= ~SI_NAMED;
1119
1120	/* If we are a child, remove us from the parents list */
1121	if (dev->si_flags & SI_CHILD) {
1122		LIST_REMOVE(dev, si_siblings);
1123		dev->si_flags &= ~SI_CHILD;
1124	}
1125
1126	/* Kill our children */
1127	while (!LIST_EMPTY(&dev->si_children))
1128		destroy_devl(LIST_FIRST(&dev->si_children));
1129
1130	/* Remove from clone list */
1131	if (dev->si_flags & SI_CLONELIST) {
1132		LIST_REMOVE(dev, si_clone);
1133		dev->si_flags &= ~SI_CLONELIST;
1134	}
1135
1136	mtx_lock(&cdp->cdp_threadlock);
1137	csw = dev->si_devsw;
1138	dev->si_devsw = NULL;	/* already NULL for SI_ALIAS */
1139	while (csw != NULL && csw->d_purge != NULL && dev->si_threadcount) {
1140		csw->d_purge(dev);
1141		mtx_unlock(&cdp->cdp_threadlock);
1142		msleep(csw, &devmtx, PRIBIO, "devprg", hz/10);
1143		mtx_lock(&cdp->cdp_threadlock);
1144		if (dev->si_threadcount)
1145			printf("Still %lu threads in %s\n",
1146			    dev->si_threadcount, devtoname(dev));
1147	}
1148	while (dev->si_threadcount != 0) {
1149		/* Use unique dummy wait ident */
1150		mtx_unlock(&cdp->cdp_threadlock);
1151		msleep(&csw, &devmtx, PRIBIO, "devdrn", hz / 10);
1152		mtx_lock(&cdp->cdp_threadlock);
1153	}
1154
1155	mtx_unlock(&cdp->cdp_threadlock);
1156	dev_unlock();
1157	if ((cdp->cdp_flags & CDP_UNREF_DTR) == 0) {
1158		/* avoid out of order notify events */
1159		notify_destroy(dev);
1160	}
1161	mtx_lock(&cdevpriv_mtx);
1162	while ((p = LIST_FIRST(&cdp->cdp_fdpriv)) != NULL) {
1163		devfs_destroy_cdevpriv(p);
1164		mtx_lock(&cdevpriv_mtx);
1165	}
1166	mtx_unlock(&cdevpriv_mtx);
1167	dev_lock();
1168
1169	dev->si_drv1 = 0;
1170	dev->si_drv2 = 0;
1171
1172	if (!(dev->si_flags & SI_ALIAS)) {
1173		/* Remove from cdevsw list */
1174		LIST_REMOVE(dev, si_list);
1175
1176		/* If cdevsw has no more struct cdev *'s, clean it */
1177		if (LIST_EMPTY(&csw->d_devs)) {
1178			fini_cdevsw(csw);
1179			wakeup(&csw->d_devs);
1180		}
1181	}
1182	dev->si_flags &= ~SI_ALIAS;
1183	cdp->cdp_flags &= ~CDP_UNREF_DTR;
1184	dev->si_refcount--;
1185
1186	if (dev->si_refcount > 0)
1187		LIST_INSERT_HEAD(&dead_cdevsw.d_devs, dev, si_list);
1188	else
1189		dev_free_devlocked(dev);
1190}
1191
1192static void
1193delist_dev_locked(struct cdev *dev)
1194{
1195	struct cdev_priv *cdp;
1196	struct cdev *child;
1197
1198	dev_lock_assert_locked();
1199	cdp = cdev2priv(dev);
1200	if ((cdp->cdp_flags & CDP_UNREF_DTR) != 0)
1201		return;
1202	cdp->cdp_flags |= CDP_UNREF_DTR;
1203	dev_refl(dev);
1204	devfs_destroy(dev);
1205	LIST_FOREACH(child, &dev->si_children, si_siblings)
1206		delist_dev_locked(child);
1207	dev_unlock();
1208	/* ensure the destroy event is queued in order */
1209	notify_destroy(dev);
1210	dev_lock();
1211}
1212
1213/*
1214 * This function will delist a character device and its children from
1215 * the directory listing and create a destroy event without waiting
1216 * for all character device references to go away. At some later point
1217 * destroy_dev() must be called to complete the character device
1218 * destruction. After calling this function the character device name
1219 * can instantly be re-used.
1220 */
1221void
1222delist_dev(struct cdev *dev)
1223{
1224
1225	WITNESS_WARN(WARN_GIANTOK | WARN_SLEEPOK, NULL, "delist_dev");
1226	dev_lock();
1227	delist_dev_locked(dev);
1228	dev_unlock();
1229}
1230
1231void
1232destroy_dev(struct cdev *dev)
1233{
1234
1235	WITNESS_WARN(WARN_GIANTOK | WARN_SLEEPOK, NULL, "destroy_dev");
1236	dev_lock();
1237	destroy_devl(dev);
1238	dev_unlock_and_free();
1239}
1240
1241const char *
1242devtoname(struct cdev *dev)
1243{
1244
1245	return (dev->si_name);
1246}
1247
1248int
1249dev_stdclone(char *name, char **namep, const char *stem, int *unit)
1250{
1251	int u, i;
1252
1253	i = strlen(stem);
1254	if (strncmp(stem, name, i) != 0)
1255		return (0);
1256	if (!isdigit(name[i]))
1257		return (0);
1258	u = 0;
1259	if (name[i] == '0' && isdigit(name[i+1]))
1260		return (0);
1261	while (isdigit(name[i])) {
1262		u *= 10;
1263		u += name[i++] - '0';
1264	}
1265	if (u > 0xffffff)
1266		return (0);
1267	*unit = u;
1268	if (namep)
1269		*namep = &name[i];
1270	if (name[i])
1271		return (2);
1272	return (1);
1273}
1274
1275/*
1276 * Helper functions for cloning device drivers.
1277 *
1278 * The objective here is to make it unnecessary for the device drivers to
1279 * use rman or similar to manage their unit number space.  Due to the way
1280 * we do "on-demand" devices, using rman or other "private" methods
1281 * will be very tricky to lock down properly once we lock down this file.
1282 *
1283 * Instead we give the drivers these routines which puts the struct cdev *'s
1284 * that are to be managed on their own list, and gives the driver the ability
1285 * to ask for the first free unit number or a given specified unit number.
1286 *
1287 * In addition these routines support paired devices (pty, nmdm and similar)
1288 * by respecting a number of "flag" bits in the minor number.
1289 *
1290 */
1291
1292struct clonedevs {
1293	LIST_HEAD(,cdev)	head;
1294};
1295
1296void
1297clone_setup(struct clonedevs **cdp)
1298{
1299
1300	*cdp = malloc(sizeof **cdp, M_DEVBUF, M_WAITOK | M_ZERO);
1301	LIST_INIT(&(*cdp)->head);
1302}
1303
1304int
1305clone_create(struct clonedevs **cdp, struct cdevsw *csw, int *up,
1306    struct cdev **dp, int extra)
1307{
1308	struct clonedevs *cd;
1309	struct cdev *dev, *ndev, *dl, *de;
1310	struct make_dev_args args;
1311	int unit, low, u;
1312
1313	KASSERT(*cdp != NULL,
1314	    ("clone_setup() not called in driver \"%s\"", csw->d_name));
1315	KASSERT(!(extra & CLONE_UNITMASK),
1316	    ("Illegal extra bits (0x%x) in clone_create", extra));
1317	KASSERT(*up <= CLONE_UNITMASK,
1318	    ("Too high unit (0x%x) in clone_create", *up));
1319	KASSERT(csw->d_flags & D_NEEDMINOR,
1320	    ("clone_create() on cdevsw without minor numbers"));
1321
1322	/*
1323	 * Search the list for a lot of things in one go:
1324	 *   A preexisting match is returned immediately.
1325	 *   The lowest free unit number if we are passed -1, and the place
1326	 *	 in the list where we should insert that new element.
1327	 *   The place to insert a specified unit number, if applicable
1328	 *       the end of the list.
1329	 */
1330	unit = *up;
1331	ndev = devfs_alloc(MAKEDEV_WAITOK);
1332	dev_lock();
1333	prep_cdevsw(csw, MAKEDEV_WAITOK);
1334	low = extra;
1335	de = dl = NULL;
1336	cd = *cdp;
1337	LIST_FOREACH(dev, &cd->head, si_clone) {
1338		KASSERT(dev->si_flags & SI_CLONELIST,
1339		    ("Dev %p(%s) should be on clonelist", dev, dev->si_name));
1340		u = dev2unit(dev);
1341		if (u == (unit | extra)) {
1342			*dp = dev;
1343			dev_unlock();
1344			devfs_free(ndev);
1345			return (0);
1346		}
1347		if (unit == -1 && u == low) {
1348			low++;
1349			de = dev;
1350			continue;
1351		} else if (u < (unit | extra)) {
1352			de = dev;
1353			continue;
1354		} else if (u > (unit | extra)) {
1355			dl = dev;
1356			break;
1357		}
1358	}
1359	if (unit == -1)
1360		unit = low & CLONE_UNITMASK;
1361	make_dev_args_init(&args);
1362	args.mda_unit = unit | extra;
1363	args.mda_devsw = csw;
1364	dev = newdev(&args, ndev);
1365	if (dev->si_flags & SI_CLONELIST) {
1366		printf("dev %p (%s) is on clonelist\n", dev, dev->si_name);
1367		printf("unit=%d, low=%d, extra=0x%x\n", unit, low, extra);
1368		LIST_FOREACH(dev, &cd->head, si_clone) {
1369			printf("\t%p %s\n", dev, dev->si_name);
1370		}
1371		panic("foo");
1372	}
1373	KASSERT(!(dev->si_flags & SI_CLONELIST),
1374	    ("Dev %p(%s) should not be on clonelist", dev, dev->si_name));
1375	if (dl != NULL)
1376		LIST_INSERT_BEFORE(dl, dev, si_clone);
1377	else if (de != NULL)
1378		LIST_INSERT_AFTER(de, dev, si_clone);
1379	else
1380		LIST_INSERT_HEAD(&cd->head, dev, si_clone);
1381	dev->si_flags |= SI_CLONELIST;
1382	*up = unit;
1383	dev_unlock_and_free();
1384	return (1);
1385}
1386
1387/*
1388 * Kill everything still on the list.  The driver should already have
1389 * disposed of any softc hung of the struct cdev *'s at this time.
1390 */
1391void
1392clone_cleanup(struct clonedevs **cdp)
1393{
1394	struct cdev *dev;
1395	struct cdev_priv *cp;
1396	struct clonedevs *cd;
1397
1398	cd = *cdp;
1399	if (cd == NULL)
1400		return;
1401	dev_lock();
1402	while (!LIST_EMPTY(&cd->head)) {
1403		dev = LIST_FIRST(&cd->head);
1404		LIST_REMOVE(dev, si_clone);
1405		KASSERT(dev->si_flags & SI_CLONELIST,
1406		    ("Dev %p(%s) should be on clonelist", dev, dev->si_name));
1407		dev->si_flags &= ~SI_CLONELIST;
1408		cp = cdev2priv(dev);
1409		if (!(cp->cdp_flags & CDP_SCHED_DTR)) {
1410			cp->cdp_flags |= CDP_SCHED_DTR;
1411			KASSERT(dev->si_flags & SI_NAMED,
1412				("Driver has goofed in cloning underways udev %jx unit %x",
1413				(uintmax_t)dev2udev(dev), dev2unit(dev)));
1414			destroy_devl(dev);
1415		}
1416	}
1417	dev_unlock_and_free();
1418	free(cd, M_DEVBUF);
1419	*cdp = NULL;
1420}
1421
1422static TAILQ_HEAD(, cdev_priv) dev_ddtr =
1423	TAILQ_HEAD_INITIALIZER(dev_ddtr);
1424static TAILQ_HEAD(, cdev_priv) dev_ddtr_giant =
1425	TAILQ_HEAD_INITIALIZER(dev_ddtr_giant);
1426static struct task dev_dtr_task = TASK_INITIALIZER(0, destroy_dev_tq, &dev_ddtr);
1427static struct task dev_dtr_task_giant = TASK_INITIALIZER(0, destroy_dev_tq_giant,
1428    &dev_ddtr_giant);
1429
1430static void
1431destroy_dev_tq(void *ctx, int pending)
1432{
1433	TAILQ_HEAD(, cdev_priv) *ddtr = ctx;
1434	struct cdev_priv *cp;
1435	struct cdev *dev;
1436	void (*cb)(void *);
1437	void *cb_arg;
1438
1439	dev_lock();
1440	while (!TAILQ_EMPTY(ddtr)) {
1441		cp = TAILQ_FIRST(ddtr);
1442		dev = &cp->cdp_c;
1443		KASSERT(cp->cdp_flags & CDP_SCHED_DTR,
1444		    ("cdev %p in dev_destroy_tq without CDP_SCHED_DTR", cp));
1445		TAILQ_REMOVE(ddtr, cp, cdp_dtr_list);
1446		cb = cp->cdp_dtr_cb;
1447		cb_arg = cp->cdp_dtr_cb_arg;
1448		destroy_devl(dev);
1449		dev_unlock_and_free();
1450		dev_rel(dev);
1451		if (cb != NULL)
1452			cb(cb_arg);
1453		dev_lock();
1454	}
1455	dev_unlock();
1456}
1457
1458static void
1459destroy_dev_tq_giant(void *ctx, int pending)
1460{
1461	mtx_lock(&Giant);
1462	destroy_dev_tq(ctx, pending);
1463	mtx_unlock(&Giant);
1464}
1465
1466/*
1467 * devmtx shall be locked on entry. devmtx will be unlocked after
1468 * function return.
1469 */
1470static int
1471destroy_dev_sched_cbl(struct cdev *dev, void (*cb)(void *), void *arg)
1472{
1473	struct cdev_priv *cp;
1474	bool need_giant;
1475
1476	dev_lock_assert_locked();
1477	cp = cdev2priv(dev);
1478	if (cp->cdp_flags & CDP_SCHED_DTR) {
1479		dev_unlock();
1480		return (0);
1481	}
1482	dev_refl(dev);
1483	cp->cdp_flags |= CDP_SCHED_DTR;
1484	cp->cdp_dtr_cb = cb;
1485	cp->cdp_dtr_cb_arg = arg;
1486	need_giant = (dev->si_devsw->d_flags & D_NEEDGIANT) != 0;
1487	if (need_giant)
1488		TAILQ_INSERT_TAIL(&dev_ddtr_giant, cp, cdp_dtr_list);
1489	else
1490		TAILQ_INSERT_TAIL(&dev_ddtr, cp, cdp_dtr_list);
1491	dev_unlock();
1492	if (need_giant)
1493		taskqueue_enqueue(taskqueue_thread, &dev_dtr_task_giant);
1494	else
1495		taskqueue_enqueue(taskqueue_thread, &dev_dtr_task);
1496	return (1);
1497}
1498
1499int
1500destroy_dev_sched_cb(struct cdev *dev, void (*cb)(void *), void *arg)
1501{
1502
1503	dev_lock();
1504	return (destroy_dev_sched_cbl(dev, cb, arg));
1505}
1506
1507int
1508destroy_dev_sched(struct cdev *dev)
1509{
1510
1511	return (destroy_dev_sched_cb(dev, NULL, NULL));
1512}
1513
1514void
1515destroy_dev_drain(struct cdevsw *csw)
1516{
1517
1518	dev_lock();
1519	while (!LIST_EMPTY(&csw->d_devs)) {
1520		msleep(&csw->d_devs, &devmtx, PRIBIO, "devscd", hz/10);
1521	}
1522	dev_unlock();
1523}
1524
1525#include "opt_ddb.h"
1526#ifdef DDB
1527#include <sys/kernel.h>
1528
1529#include <ddb/ddb.h>
1530
1531DB_SHOW_COMMAND(cdev, db_show_cdev)
1532{
1533	struct cdev_priv *cdp;
1534	struct cdev *dev;
1535	u_int flags;
1536	char buf[512];
1537
1538	if (!have_addr) {
1539		TAILQ_FOREACH(cdp, &cdevp_list, cdp_list) {
1540			dev = &cdp->cdp_c;
1541			db_printf("%s %p\n", dev->si_name, dev);
1542			if (db_pager_quit)
1543				break;
1544		}
1545		return;
1546	}
1547
1548	dev = (struct cdev *)addr;
1549	cdp = cdev2priv(dev);
1550	db_printf("dev %s ref %d use %ld thr %ld inuse %u fdpriv %p\n",
1551	    dev->si_name, dev->si_refcount, dev->si_usecount,
1552	    dev->si_threadcount, cdp->cdp_inuse, cdp->cdp_fdpriv.lh_first);
1553	db_printf("devsw %p si_drv0 %d si_drv1 %p si_drv2 %p\n",
1554	    dev->si_devsw, dev->si_drv0, dev->si_drv1, dev->si_drv2);
1555	flags = dev->si_flags;
1556#define	SI_FLAG(flag)	do {						\
1557	if (flags & (flag)) {						\
1558		if (buf[0] != '\0')					\
1559			strlcat(buf, ", ", sizeof(buf));		\
1560		strlcat(buf, (#flag) + 3, sizeof(buf));			\
1561		flags &= ~(flag);					\
1562	}								\
1563} while (0)
1564	buf[0] = '\0';
1565	SI_FLAG(SI_ETERNAL);
1566	SI_FLAG(SI_ALIAS);
1567	SI_FLAG(SI_NAMED);
1568	SI_FLAG(SI_CHILD);
1569	SI_FLAG(SI_DUMPDEV);
1570	SI_FLAG(SI_CLONELIST);
1571	db_printf("si_flags %s\n", buf);
1572
1573	flags = cdp->cdp_flags;
1574#define	CDP_FLAG(flag)	do {						\
1575	if (flags & (flag)) {						\
1576		if (buf[0] != '\0')					\
1577			strlcat(buf, ", ", sizeof(buf));		\
1578		strlcat(buf, (#flag) + 4, sizeof(buf));			\
1579		flags &= ~(flag);					\
1580	}								\
1581} while (0)
1582	buf[0] = '\0';
1583	CDP_FLAG(CDP_ACTIVE);
1584	CDP_FLAG(CDP_SCHED_DTR);
1585	db_printf("cdp_flags %s\n", buf);
1586}
1587#endif
1588