I think MPASS() is enough there.

Again, I think you need to destroy_dev() before iterating over the hcli tailq.

I think you should use make_dev_s() there to set si_drv1 atomically when creating the device.

The hcli loop sets is_closing, so why would we want to destroy_dev() first?

D59874

I do not understand this block. Isn't cuse_server_unref() does the same but conditional on the refs?

Seems like that yes. However, cuse_server_unref() performs the full cleanup only when the server's refs are 0 (see comment above cuse_server_unref() below, otherwise it just decrements the ref.

But we should not free() until the ref count goes to zero. This was my point. And if the ref count is zero, calling unref is pointless and probably buggy.

Also, the code probably should grow the checks that we do not unref more than there are references (lile KASSERT(refs > 0) before decrementing) and same for overflow on referencing.

I will add the KASSERTs in a follow-up patch. However, the thing with cuse_server_free() is that it is the cdevpriv destructor callback, not a generic cleanup function. The point is that when the cdevpriv closes, we want to free the devices belonging to the cdevpriv, and as a last step, call cuse_server_unref() which will take the refcount to 0 and perform the full cleanup for the server.

The redundant thing here is that cuse_server_unref() also calls cuse_server_free_devs_locked().

So can we eliminate the redundancy? Also, can we assert that the ref count is zero when freeing?

can we assert that the ref count is zero when freeing?

D60043