]> git.saurik.com Git - apple/xnu.git/blobdiff - bsd/vfs/vfs_fsevents.c
xnu-3247.1.106.tar.gz
[apple/xnu.git] / bsd / vfs / vfs_fsevents.c
index 52cdb65aff904a43b60a72d8f0fa1a26b0db5fa8..d2f32bd7489478e3af593ded542aacb3ed933dea 100644 (file)
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2004-2008 Apple Inc. All rights reserved.
+ * Copyright (c) 2004-2014 Apple Inc. All rights reserved.
  *
  * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
  * 
@@ -165,30 +165,6 @@ __private_extern__ void qsort(
     size_t member_size,
     int (*)(const void *, const void *));
 
-
-
-/* From kdp_udp.c + user mode Libc - this ought to be in a library */
-static char *
-strnstr(char *s, const char *find, size_t slen)
-{
-  char c, sc;
-  size_t len;
-  
-  if ((c = *find++) != '\0') {
-    len = strlen(find);
-    do {
-      do {
-        if ((sc = *s++) == '\0' || slen-- < 1)
-          return (NULL);
-      } while (sc != c);
-      if (len > slen)
-        return (NULL);
-    } while (strncmp(s, find, len) != 0);
-    s--;
-  }
-  return (s);
-}
-
 static int
 is_ignored_directory(const char *path) {
 
@@ -196,14 +172,14 @@ is_ignored_directory(const char *path) {
       return 0;
     }
 
-#define IS_TLD(x) strnstr((char *) path, x, MAXPATHLEN) 
+#define IS_TLD(x) strnstr(__DECONST(char *, path), x, MAXPATHLEN)
     if (IS_TLD("/.Spotlight-V100/") ||
         IS_TLD("/.MobileBackups/") || 
         IS_TLD("/Backups.backupdb/")) {
         return 1;
     }
 #undef IS_TLD
-    
+       
     return 0;
 }
 
@@ -382,7 +358,7 @@ add_fsevent(int type, vfs_context_t ctx, ...)
     kfs_event        *kfse, *kfse_dest=NULL, *cur;
     fs_event_watcher *watcher;
     va_list           ap;
-    int              error = 0, did_alloc=0, need_event_unlock = 0;
+    int              error = 0, did_alloc=0;
     dev_t             dev = 0;
     uint64_t          now, elapsed;
     char             *pathbuff=NULL;
@@ -416,7 +392,7 @@ add_fsevent(int type, vfs_context_t ctx, ...)
     // (as long as it's not an event type that can never be the
     // same as a previous event)
     //
-    if (type != FSE_CREATE_FILE && type != FSE_DELETE && type != FSE_RENAME && type != FSE_EXCHANGE && type != FSE_CHOWN) {
+    if (type != FSE_CREATE_FILE && type != FSE_DELETE && type != FSE_RENAME && type != FSE_EXCHANGE && type != FSE_CHOWN && type != FSE_DOCID_CHANGED && type != FSE_DOCID_CREATED) {
        void *ptr=NULL;
        int   vid=0, was_str=0, nlen=0;
 
@@ -524,6 +500,7 @@ add_fsevent(int type, vfs_context_t ctx, ...)
                    printf("add_fsevent: kfse_list head %p ; num_pending_rename %d\n", listhead, num_pending_rename);
                    printf("add_fsevent: zalloc sez: %p\n", junkptr);
                    printf("add_fsevent: event_zone info: %d 0x%x\n", ((int *)event_zone)[0], ((int *)event_zone)[1]);
+                   lock_watch_table();
                    for(ii=0; ii < MAX_WATCHERS; ii++) {
                        if (watcher_table[ii] == NULL) {
                            continue;
@@ -535,6 +512,7 @@ add_fsevent(int type, vfs_context_t ctx, ...)
                               watcher_table[ii]->rd, watcher_table[ii]->wr,
                               watcher_table[ii]->eventq_size, watcher_table[ii]->flags);
                    }
+                   unlock_watch_table();
 
                    last_print = current_tv;
                    if (junkptr) {
@@ -559,11 +537,9 @@ add_fsevent(int type, vfs_context_t ctx, ...)
     kfse->abstime  = now;
     kfse->pid      = p->p_pid;
     if (type == FSE_RENAME || type == FSE_EXCHANGE) {
-       if (need_event_unlock == 0) {
-           memset(kfse_dest, 0, sizeof(kfs_event));
-           kfse_dest->refcount = 1;
-           OSBitOrAtomic16(KFSE_BEING_CREATED, &kfse_dest->flags);
-       }
+       memset(kfse_dest, 0, sizeof(kfs_event));
+       kfse_dest->refcount = 1;
+       OSBitOrAtomic16(KFSE_BEING_CREATED, &kfse_dest->flags);
        kfse_dest->type     = type;
        kfse_dest->pid      = p->p_pid;
        kfse_dest->abstime  = now;
@@ -587,11 +563,62 @@ add_fsevent(int type, vfs_context_t ctx, ...)
     // now process the arguments passed in and copy them into
     // the kfse
     //
-    if (need_event_unlock == 0) {
-       lck_rw_lock_shared(&event_handling_lock);
-    }
     
     cur = kfse;
+
+    if (type == FSE_DOCID_CREATED || type == FSE_DOCID_CHANGED) {
+           uint64_t val;
+
+           //
+           // These events are special and not like the other events.  They only
+           // have a dev_t, src inode #, dest inode #, and a doc-id.  We use the
+           // fields that we can in the kfse but have to overlay the dest inode
+           // number and the doc-id on the other fields.
+           //
+
+           // First the dev_t
+           arg_type = va_arg(ap, int32_t);
+           if (arg_type == FSE_ARG_DEV) {
+                   cur->dev = (dev_t)(va_arg(ap, dev_t));
+           } else {
+                   cur->dev = (dev_t)0xbadc0de1;
+           }
+
+           // next the source inode #
+           arg_type = va_arg(ap, int32_t);
+           if (arg_type == FSE_ARG_INO) {
+                   cur->ino = (ino64_t)(va_arg(ap, ino64_t));
+           } else {
+                   cur->ino = 0xbadc0de2;
+           }
+
+           // now the dest inode #
+           arg_type = va_arg(ap, int32_t);
+           if (arg_type == FSE_ARG_INO) {
+                   val = (ino64_t)(va_arg(ap, ino64_t));
+           } else {
+                   val = 0xbadc0de2;
+           }
+           // overlay the dest inode number on the str/dest pointer fields
+           memcpy(&cur->str, &val, sizeof(ino64_t));
+
+
+           // and last the document-id
+           arg_type = va_arg(ap, int32_t);
+           if (arg_type == FSE_ARG_INT32) {
+                   val = (uint64_t)va_arg(ap, uint32_t);
+           } else if (arg_type == FSE_ARG_INT64) {
+                   val = (uint64_t)va_arg(ap, uint64_t);
+           } else {
+                   val = 0xbadc0de3;
+           }
+           
+           // the docid is 64-bit and overlays the uid/gid fields
+           memcpy(&cur->uid, &val, sizeof(uint64_t));
+
+           goto done_with_args;
+    }
+
     for(arg_type=va_arg(ap, int32_t); arg_type != FSE_ARG_DONE; arg_type=va_arg(ap, int32_t))
 
        switch(arg_type) {
@@ -616,14 +643,11 @@ add_fsevent(int type, vfs_context_t ctx, ...)
                VATTR_WANTED(&va, va_mode);
                VATTR_WANTED(&va, va_uid);
                VATTR_WANTED(&va, va_gid);
+               VATTR_WANTED(&va, va_nlink);
                if ((ret = vnode_getattr(vp, &va, vfs_context_kernel())) != 0) {
                    // printf("add_fsevent: failed to getattr on vp %p (%d)\n", cur->fref.vp, ret);
                    cur->str = NULL;
                    error = EINVAL;
-                   if (need_event_unlock == 0) {
-                       // then we only grabbed it shared 
-                       lck_rw_unlock_shared(&event_handling_lock);
-                   }
                    goto clean_up;
                }
 
@@ -632,6 +656,12 @@ add_fsevent(int type, vfs_context_t ctx, ...)
                cur->mode = (int32_t)vnode_vttoif(vnode_vtype(vp)) | va.va_mode;
                cur->uid  = va.va_uid;
                cur->gid  = va.va_gid;
+               if (vp->v_flag & VISHARDLINK) {
+                       cur->mode |= FSE_MODE_HLINK;
+                       if ((vp->v_type == VDIR && va.va_dirlinkcount == 0) || (vp->v_type == VREG && va.va_nlink == 0)) {
+                               cur->mode |= FSE_MODE_LAST_HLINK;
+                       }
+               }
 
                // if we haven't gotten the path yet, get it.
                if (pathbuff == NULL) {
@@ -663,10 +693,6 @@ add_fsevent(int type, vfs_context_t ctx, ...)
                                
                        if (ret != 0 || vp == NULL) {
                                error = ENOENT;
-                               if (need_event_unlock == 0) {
-                                       // then we only grabbed it shared 
-                                       lck_rw_unlock_shared(&event_handling_lock);
-                               }
                                goto clean_up;
                        }
                    }
@@ -724,12 +750,19 @@ add_fsevent(int type, vfs_context_t ctx, ...)
                }
                break;
 
+           case FSE_ARG_INT32: {
+                   uint32_t ival = (uint32_t)va_arg(ap, int32_t);
+                   kfse->uid = (ino64_t)ival;
+               break;
+           }
+                   
            default:
                printf("add_fsevent: unknown type %d\n", arg_type);
                // just skip one 32-bit word and hope we sync up...
                (void)va_arg(ap, int32_t);
        }
 
+done_with_args:
     va_end(ap);
 
     OSBitAndAtomic16(~KFSE_BEING_CREATED, &kfse->flags);
@@ -737,18 +770,6 @@ add_fsevent(int type, vfs_context_t ctx, ...)
        OSBitAndAtomic16(~KFSE_BEING_CREATED, &kfse_dest->flags);
     }
 
-    if (need_event_unlock == 0) {
-       // then we only grabbed it shared 
-       lck_rw_unlock_shared(&event_handling_lock);
-    }
-    
-    // unlock this here so we don't hold it across the
-    // event delivery loop.
-    if (need_event_unlock) {
-       lck_rw_unlock_exclusive(&event_handling_lock);
-       need_event_unlock = 0;
-    }
-
     //
     // now we have to go and let everyone know that
     // is interested in this type of event
@@ -761,28 +782,24 @@ add_fsevent(int type, vfs_context_t ctx, ...)
            continue;
        }
        
-       if (   watcher->event_list[type] == FSE_REPORT
+       if (   type < watcher->num_events
+           && watcher->event_list[type] == FSE_REPORT
            && watcher_cares_about_dev(watcher, dev)) {
            
            if (watcher_add_event(watcher, kfse) != 0) {
                watcher->num_dropped++;
+               continue;
            }
        }
 
-       if (kfse->refcount < 1) {
-           panic("add_fsevent: line %d: kfse recount %d but should be at least 1\n", __LINE__, kfse->refcount);
-       }
+       // if (kfse->refcount < 1) {
+       //    panic("add_fsevent: line %d: kfse recount %d but should be at least 1\n", __LINE__, kfse->refcount);
+       // }
     }
 
     unlock_watch_table();
 
   clean_up:
-    // have to check if this needs to be unlocked (in
-    // case we came here from an error handling path)
-    if (need_event_unlock) {
-       lck_rw_unlock_exclusive(&event_handling_lock);
-       need_event_unlock = 0;
-    }
 
     if (pathbuff) {
        release_pathbuff(pathbuff);
@@ -889,7 +906,7 @@ release_event_ref(kfs_event *kfse)
     unlock_fs_event_list();
     
     // if we have a pointer in the union
-    if (copy.str) {
+    if (copy.str && copy.type != FSE_DOCID_CHANGED) {
        if (copy.len == 0) {    // and it's not a string
            panic("%s:%d: no more fref.vp!\n", __FILE__, __LINE__);
            // vnode_rele_ext(copy.fref.vp, O_EVTONLY, 0);
@@ -950,18 +967,14 @@ add_watcher(int8_t *event_list, int32_t num_events, int32_t eventq_size, fs_even
        !strncmp(watcher->proc_name, "coreservicesd", sizeof(watcher->proc_name)) ||
        !strncmp(watcher->proc_name, "mds", sizeof(watcher->proc_name))) {
        watcher->flags |= WATCHER_APPLE_SYSTEM_SERVICE;
+    } else {
+      printf("fsevents: watcher %s (pid: %d) - Using /dev/fsevents directly is unsupported.  Migrate to FSEventsFramework\n",
+            watcher->proc_name, watcher->pid);
     }
 
     lock_watch_table();
 
-    // now update the global list of who's interested in
-    // events of a particular type...
-    for(i=0; i < num_events; i++) {
-       if (event_list[i] != FSE_IGNORE && i < FSE_MAX_EVENTS) {
-           fs_event_type_watchers[i]++;
-       }
-    }
-
+    // find a slot for the new watcher
     for(i=0; i < MAX_WATCHERS; i++) {
        if (watcher_table[i] == NULL) {
            watcher->my_id   = i;
@@ -970,12 +983,21 @@ add_watcher(int8_t *event_list, int32_t num_events, int32_t eventq_size, fs_even
        }
     }
 
-    if (i > MAX_WATCHERS) {
+    if (i >= MAX_WATCHERS) {
        printf("fsevents: too many watchers!\n");
        unlock_watch_table();
+       FREE(watcher, M_TEMP);
        return ENOSPC;
     }
 
+    // now update the global list of who's interested in
+    // events of a particular type...
+    for(i=0; i < num_events; i++) {
+       if (event_list[i] != FSE_IGNORE && i < FSE_MAX_EVENTS) {
+           fs_event_type_watchers[i]++;
+       }
+    }
+
     unlock_watch_table();
 
     *watcher_out = watcher;
@@ -1033,22 +1055,17 @@ remove_watcher(fs_event_watcher *target)
 
        // drain the event_queue 
 
+       lck_rw_lock_exclusive(&event_handling_lock);
        while(watcher->rd != watcher->wr) {
-           lck_rw_lock_exclusive(&event_handling_lock);
            kfse = watcher->event_queue[watcher->rd];
-           if (!kfse || kfse->type == FSE_INVALID || kfse->refcount < 1) {
-               lck_rw_unlock_exclusive(&event_handling_lock);
-               break;
-           }
            watcher->event_queue[watcher->rd] = NULL;
            watcher->rd = (watcher->rd+1) % watcher->eventq_size;
            OSSynchronizeIO();
-           if (kfse != NULL) {
+           if (kfse != NULL && kfse->type != FSE_INVALID && kfse->refcount >= 1) {
                release_event_ref(kfse);
            }
-           lck_rw_unlock_exclusive(&event_handling_lock);
        }
-
+       lck_rw_unlock_exclusive(&event_handling_lock);
            
        if (watcher->event_list) {
            FREE(watcher->event_list, M_TEMP);
@@ -1134,54 +1151,49 @@ watcher_add_event(fs_event_watcher *watcher, kfs_event *kfse)
     watcher->event_queue[watcher->wr] = kfse;
     OSSynchronizeIO();
     watcher->wr = (watcher->wr + 1) % watcher->eventq_size;
-    
+
     //
     // wake up the watcher if there are more than MAX_NUM_PENDING events.
     // otherwise schedule a timer (if one isn't already set) which will 
     // send any pending events if no more are received in the next 
     // EVENT_DELAY_IN_MS milli-seconds.
     //
-       int32_t num_pending = 0;
-       if (watcher->rd < watcher->wr) {
-               num_pending = watcher->wr - watcher->rd;
-       }
-
-       if (watcher->rd > watcher->wr) {
-               num_pending = watcher->wr + watcher->eventq_size - watcher->rd;
-       }
-
-       if (num_pending > (watcher->eventq_size*3/4) && !(watcher->flags & WATCHER_APPLE_SYSTEM_SERVICE)) {
-           /* Non-Apple Service is falling behind, start dropping events for this process */
+    int32_t num_pending = 0;
+    if (watcher->rd < watcher->wr) {
+      num_pending = watcher->wr - watcher->rd;
+    }
+    
+    if (watcher->rd > watcher->wr) {
+      num_pending = watcher->wr + watcher->eventq_size - watcher->rd;
+    }
+    
+    if (num_pending > (watcher->eventq_size*3/4) && !(watcher->flags & WATCHER_APPLE_SYSTEM_SERVICE)) {
+      /* Non-Apple Service is falling behind, start dropping events for this process */
+      lck_rw_lock_exclusive(&event_handling_lock);             
+      while (watcher->rd != watcher->wr) {
+       kfse = watcher->event_queue[watcher->rd];
+       watcher->event_queue[watcher->rd] = NULL;               
+       watcher->rd = (watcher->rd+1) % watcher->eventq_size;
+       OSSynchronizeIO();
+       if (kfse != NULL && kfse->type != FSE_INVALID && kfse->refcount >= 1) {
+         release_event_ref(kfse);
+       }
+      }
+      watcher->flags |= WATCHER_DROPPED_EVENTS;
+      lck_rw_unlock_exclusive(&event_handling_lock);
+
+      printf("fsevents: watcher falling behind: %s (pid: %d) rd: %4d wr: %4d q_size: %4d flags: 0x%x\n",
+            watcher->proc_name, watcher->pid, watcher->rd, watcher->wr,
+            watcher->eventq_size, watcher->flags);
+
+      fsevents_wakeup(watcher);
+    } else if (num_pending > MAX_NUM_PENDING) {
+      fsevents_wakeup(watcher);
+    } else if (timer_set == 0) {
+      schedule_event_wakeup();
+    } 
 
-           lck_rw_lock_exclusive(&event_handling_lock);            
-           while (watcher->rd != watcher->wr) {
-             kfse = watcher->event_queue[watcher->rd];
-             if (!kfse || kfse->type == FSE_INVALID || kfse->refcount < 1) {
-                 lck_rw_unlock_exclusive(&event_handling_lock);
-                 break;
-             }
-             watcher->event_queue[watcher->rd] = NULL;         
-             watcher->rd = (watcher->rd+1) % watcher->eventq_size;
-             OSSynchronizeIO();
-             if (kfse != NULL) {
-               release_event_ref(kfse);
-             }
-           }
-           lck_rw_unlock_exclusive(&event_handling_lock);
-           
-           printf("fsevents: watcher failing behind: %s (pid: %d) rd: %4d wr: %4d q_size: %4d flags: 0x%x\n",
-                  watcher->proc_name, watcher->pid, watcher->rd, watcher->wr,
-                  watcher->eventq_size, watcher->flags);
-           
-           watcher->flags |= WATCHER_DROPPED_EVENTS;
-           fsevents_wakeup(watcher);
-       } else if (num_pending > MAX_NUM_PENDING) {
-           fsevents_wakeup(watcher);
-       } else if (timer_set == 0) {
-           schedule_event_wakeup();
-       }
-       
-       return 0;
+    return 0;
 }
 
 static int
@@ -1309,6 +1321,36 @@ copy_out_kfse(fs_event_watcher *watcher, kfs_event *kfse, struct uio *uio)
 
   copy_again:
 
+    if (kfse->type == FSE_DOCID_CHANGED || kfse->type == FSE_DOCID_CREATED) {
+       dev_t    dev  = cur->dev;
+       ino_t    ino  = cur->ino;
+       uint64_t ival;
+
+       error = fill_buff(FSE_ARG_DEV, sizeof(dev_t), &dev, evbuff, &evbuff_idx, sizeof(evbuff), uio);
+       if (error != 0) {
+           goto get_out;
+       }
+
+       error = fill_buff(FSE_ARG_INO, sizeof(ino_t), &ino, evbuff, &evbuff_idx, sizeof(evbuff), uio);
+       if (error != 0) {
+           goto get_out;
+       }
+
+       memcpy(&ino, &cur->str, sizeof(ino_t));
+       error = fill_buff(FSE_ARG_INO, sizeof(ino_t), &ino, evbuff, &evbuff_idx, sizeof(evbuff), uio);
+       if (error != 0) {
+           goto get_out;
+       }
+
+       memcpy(&ival, &cur->uid, sizeof(uint64_t));   // the docid gets stuffed into the ino field
+       error = fill_buff(FSE_ARG_INT64, sizeof(uint64_t), &ival, evbuff, &evbuff_idx, sizeof(evbuff), uio);
+       if (error != 0) {
+           goto get_out;
+       }
+
+       goto done;
+    }
+
     if (cur->str == NULL || cur->str[0] == '\0') {
        printf("copy_out_kfse:2: empty/short path (%s)\n", cur->str);
        error = fill_buff(FSE_ARG_STRING, 2, "/", evbuff, &evbuff_idx, sizeof(evbuff), uio);
@@ -1480,6 +1522,8 @@ fmod_watch(fs_event_watcher *watcher, struct uio *uio)
     }
 
     skipped = 0;
+
+    lck_rw_lock_shared(&event_handling_lock);
     while (uio_resid(uio) > 0 && watcher->rd != watcher->wr) {
        if (watcher->flags & WATCHER_CLOSING) {
            break;
@@ -1490,17 +1534,14 @@ fmod_watch(fs_event_watcher *watcher, struct uio *uio)
        // (since it may have been recycled/reused and changed
        // its type or which device it is for)
        //
-       lck_rw_lock_shared(&event_handling_lock);
-
        kfse = watcher->event_queue[watcher->rd];
-       if (!kfse || kfse->type == FSE_INVALID || kfse->refcount < 1) {
-         lck_rw_unlock_shared(&event_handling_lock);
+       if (!kfse || kfse->type == FSE_INVALID || kfse->type >= watcher->num_events || kfse->refcount < 1) {
          break;
        }
 
        if (watcher->event_list[kfse->type] == FSE_REPORT && watcher_cares_about_dev(watcher, kfse->dev)) {
 
-         if (!(watcher->flags & WATCHER_APPLE_SYSTEM_SERVICE) & is_ignored_directory(kfse->str)) {
+         if (!(watcher->flags & WATCHER_APPLE_SYSTEM_SERVICE) && kfse->type != FSE_DOCID_CHANGED && is_ignored_directory(kfse->str)) {
            // If this is not an Apple System Service, skip specified directories
            // radar://12034844
            error = 0;
@@ -1532,12 +1573,12 @@ fmod_watch(fs_event_watcher *watcher, struct uio *uio)
          }
        }
 
+       watcher->event_queue[watcher->rd] = NULL;
        watcher->rd = (watcher->rd + 1) % watcher->eventq_size;
        OSSynchronizeIO();
        release_event_ref(kfse);
-
-       lck_rw_unlock_shared(&event_handling_lock);
     }
+    lck_rw_unlock_shared(&event_handling_lock);
 
     if (skipped && error == 0) {
       goto restart_watch;
@@ -1601,62 +1642,25 @@ fseventsf_write(__unused struct fileproc *fp, __unused struct uio *uio,
 }
 
 #pragma pack(push, 4)
-typedef struct ext_fsevent_dev_filter_args {
-    uint32_t    num_devices;
-    user_addr_t devices;
-} ext_fsevent_dev_filter_args;
-#pragma pack(pop)
-
-#define NEW_FSEVENTS_DEVICE_FILTER      _IOW('s', 100, ext_fsevent_dev_filter_args)
-
-typedef struct old_fsevent_dev_filter_args {
-    uint32_t  num_devices;
-    int32_t   devices;
-} old_fsevent_dev_filter_args;
-
-#define        OLD_FSEVENTS_DEVICE_FILTER      _IOW('s', 100, old_fsevent_dev_filter_args)
-
-#if __LP64__
-/* need this in spite of the padding due to alignment of devices */
 typedef struct fsevent_dev_filter_args32 {
-    uint32_t  num_devices;
-    uint32_t  devices;
-    int32_t   pad1;
+    uint32_t            num_devices;
+    user32_addr_t       devices;
 } fsevent_dev_filter_args32;
-#endif
+typedef struct fsevent_dev_filter_args64 {
+    uint32_t            num_devices;
+    user64_addr_t       devices;
+} fsevent_dev_filter_args64;
+#pragma pack(pop)
+
+#define        FSEVENTS_DEVICE_FILTER_32       _IOW('s', 100, fsevent_dev_filter_args32)
+#define        FSEVENTS_DEVICE_FILTER_64       _IOW('s', 100, fsevent_dev_filter_args64)
 
 static int
 fseventsf_ioctl(struct fileproc *fp, u_long cmd, caddr_t data, vfs_context_t ctx)
 {
     fsevent_handle *fseh = (struct fsevent_handle *)fp->f_fglob->fg_data;
     int ret = 0;
-    ext_fsevent_dev_filter_args *devfilt_args, _devfilt_args;
-
-    if (proc_is64bit(vfs_context_proc(ctx))) {
-       devfilt_args = (ext_fsevent_dev_filter_args *)data;
-    }
-    else if (cmd == OLD_FSEVENTS_DEVICE_FILTER) {
-       old_fsevent_dev_filter_args *udev_filt_args = (old_fsevent_dev_filter_args *)data;
-       
-       devfilt_args = &_devfilt_args;
-       memset(devfilt_args, 0, sizeof(ext_fsevent_dev_filter_args));
-
-       devfilt_args->num_devices = udev_filt_args->num_devices;
-       devfilt_args->devices     = CAST_USER_ADDR_T(udev_filt_args->devices);
-    }
-    else {
-#if __LP64__
-       fsevent_dev_filter_args32 *udev_filt_args = (fsevent_dev_filter_args32 *)data;
-#else
-       fsevent_dev_filter_args *udev_filt_args = (fsevent_dev_filter_args *)data;
-#endif
-       
-       devfilt_args = &_devfilt_args;
-       memset(devfilt_args, 0, sizeof(ext_fsevent_dev_filter_args));
-
-       devfilt_args->num_devices = udev_filt_args->num_devices;
-       devfilt_args->devices     = CAST_USER_ADDR_T(udev_filt_args->devices);
-    }
+    fsevent_dev_filter_args64 *devfilt_args, _devfilt_args;
 
     OSAddAtomic(1, &fseh->active);
     if (fseh->flags & FSEH_CLOSING) {
@@ -1685,8 +1689,29 @@ fseventsf_ioctl(struct fileproc *fp, u_long cmd, caddr_t data, vfs_context_t ctx
                break;
        }
 
-       case OLD_FSEVENTS_DEVICE_FILTER:
-       case NEW_FSEVENTS_DEVICE_FILTER: {
+       case FSEVENTS_DEVICE_FILTER_32: {
+           if (proc_is64bit(vfs_context_proc(ctx))) {
+                   ret = EINVAL;
+                   break;
+           }
+           fsevent_dev_filter_args32 *devfilt_args32 = (fsevent_dev_filter_args32 *)data;
+
+           devfilt_args = &_devfilt_args;
+           memset(devfilt_args, 0, sizeof(fsevent_dev_filter_args64));
+           devfilt_args->num_devices = devfilt_args32->num_devices;
+           devfilt_args->devices     = CAST_USER_ADDR_T(devfilt_args32->devices);
+           goto handle_dev_filter;
+       }
+
+       case FSEVENTS_DEVICE_FILTER_64:
+           if (!proc_is64bit(vfs_context_proc(ctx))) {
+                   ret = EINVAL;
+                   break;
+           }
+           devfilt_args = (fsevent_dev_filter_args64 *)data;
+
+       handle_dev_filter:
+       {
            int new_num_devices;
            dev_t *devices_not_to_watch, *tmp=NULL;
            
@@ -1928,7 +1953,7 @@ fseventsf_drain(struct fileproc *fp, __unused vfs_context_t ctx)
 static int
 fseventsopen(__unused dev_t dev, __unused int flag, __unused int mode, __unused struct proc *p)
 {
-    if (!is_suser()) {
+    if (!kauth_cred_issuser(kauth_cred_get())) {
        return EPERM;
     }
     
@@ -2067,7 +2092,7 @@ fseventswrite(__unused dev_t dev, struct uio *uio, __unused int ioflag)
     lck_mtx_lock(&event_writer_lock);
 
     if (write_buffer == NULL) {
-       if (kmem_alloc(kernel_map, (vm_offset_t *)&write_buffer, WRITE_BUFFER_SIZE)) {
+       if (kmem_alloc(kernel_map, (vm_offset_t *)&write_buffer, WRITE_BUFFER_SIZE, VM_KERN_MEMORY_FILE)) {
            lck_mtx_unlock(&event_writer_lock);
            return ENOMEM;
        }
@@ -2121,7 +2146,8 @@ fseventswrite(__unused dev_t dev, struct uio *uio, __unused int ioflag)
 }
 
 
-static struct fileops fsevents_fops = {
+static const struct fileops fsevents_fops = {
+    DTYPE_FSEVENTS,
     fseventsf_read,
     fseventsf_write,
     fseventsf_ioctl,
@@ -2131,21 +2157,22 @@ static struct fileops fsevents_fops = {
     fseventsf_drain
 };
 
-typedef struct ext_fsevent_clone_args {
-    user_addr_t  event_list;
-    int32_t      num_events;
-    int32_t      event_queue_depth;
-    user_addr_t  fd;
-} ext_fsevent_clone_args;
+typedef struct fsevent_clone_args32 {
+    user32_addr_t       event_list;
+    int32_t             num_events;
+    int32_t             event_queue_depth;
+    user32_addr_t       fd;
+} fsevent_clone_args32;
 
-typedef struct old_fsevent_clone_args {
-    uint32_t  event_list;
-    int32_t  num_events;
-    int32_t  event_queue_depth;
-    uint32_t  fd;
-} old_fsevent_clone_args;
+typedef struct fsevent_clone_args64 {
+    user64_addr_t       event_list;
+    int32_t             num_events;
+    int32_t             event_queue_depth;
+    user64_addr_t       fd;
+} fsevent_clone_args64;
 
-#define        OLD_FSEVENTS_CLONE      _IOW('s', 1, old_fsevent_clone_args)
+#define        FSEVENTS_CLONE_32       _IOW('s', 1, fsevent_clone_args32)
+#define        FSEVENTS_CLONE_64       _IOW('s', 1, fsevent_clone_args64)
 
 static int
 fseventsioctl(__unused dev_t dev, u_long cmd, caddr_t data, __unused int flag, struct proc *p)
@@ -2153,38 +2180,32 @@ fseventsioctl(__unused dev_t dev, u_long cmd, caddr_t data, __unused int flag, s
     struct fileproc *f;
     int fd, error;
     fsevent_handle *fseh = NULL;
-    ext_fsevent_clone_args *fse_clone_args, _fse_clone;
+    fsevent_clone_args64 *fse_clone_args, _fse_clone;
     int8_t *event_list;
     int is64bit = proc_is64bit(p);
 
     switch (cmd) {
-       case OLD_FSEVENTS_CLONE: {
-           old_fsevent_clone_args *old_args = (old_fsevent_clone_args *)data;
+       case FSEVENTS_CLONE_32: {
+           if (is64bit) {
+                   return EINVAL;
+           }
+           fsevent_clone_args32 *args32 = (fsevent_clone_args32 *)data;
 
            fse_clone_args = &_fse_clone;
-           memset(fse_clone_args, 0, sizeof(ext_fsevent_clone_args));
+           memset(fse_clone_args, 0, sizeof(fsevent_clone_args64));
 
-           fse_clone_args->event_list        = CAST_USER_ADDR_T(old_args->event_list);
-           fse_clone_args->num_events        = old_args->num_events;
-           fse_clone_args->event_queue_depth = old_args->event_queue_depth;
-           fse_clone_args->fd                = CAST_USER_ADDR_T(old_args->fd);
+           fse_clone_args->event_list        = CAST_USER_ADDR_T(args32->event_list);
+           fse_clone_args->num_events        = args32->num_events;
+           fse_clone_args->event_queue_depth = args32->event_queue_depth;
+           fse_clone_args->fd                = CAST_USER_ADDR_T(args32->fd);
            goto handle_clone;
        }
-           
-       case FSEVENTS_CLONE:
-           if (is64bit) {
-               fse_clone_args = (ext_fsevent_clone_args *)data;
-           } else {
-               fsevent_clone_args *ufse_clone = (fsevent_clone_args *)data;
-               
-               fse_clone_args = &_fse_clone;
-               memset(fse_clone_args, 0, sizeof(ext_fsevent_clone_args));
 
-               fse_clone_args->event_list        = CAST_USER_ADDR_T(ufse_clone->event_list);
-               fse_clone_args->num_events        = ufse_clone->num_events;
-               fse_clone_args->event_queue_depth = ufse_clone->event_queue_depth;
-               fse_clone_args->fd                = CAST_USER_ADDR_T(ufse_clone->fd);
+       case FSEVENTS_CLONE_64:
+           if (!is64bit) {
+                   return EINVAL;
            }
+           fse_clone_args = (fsevent_clone_args64 *)data;
 
        handle_clone:
            if (fse_clone_args->num_events < 0 || fse_clone_args->num_events > 4096) {
@@ -2232,13 +2253,13 @@ fseventsioctl(__unused dev_t dev, u_long cmd, caddr_t data, __unused int flag, s
 
            error = falloc(p, &f, &fd, vfs_context_current());
            if (error) {
+               remove_watcher(fseh->watcher);
                FREE(event_list, M_TEMP);
                FREE(fseh, M_TEMP);
                return (error);
            }
            proc_fdlock(p);
            f->f_fglob->fg_flag = FREAD | FWRITE;
-           f->f_fglob->fg_type = DTYPE_FSEVENTS;
            f->f_fglob->fg_ops = &fsevents_fops;
            f->f_fglob->fg_data = (caddr_t) fseh;
            proc_fdunlock(p);