xref: /freebsd/sys/fs/tmpfs/tmpfs_subr.c (revision fcb560670601b2a4d87bb31d7531c8dcc37ee71b)
1 /*	$NetBSD: tmpfs_subr.c,v 1.35 2007/07/09 21:10:50 ad Exp $	*/
2 
3 /*-
4  * Copyright (c) 2005 The NetBSD Foundation, Inc.
5  * All rights reserved.
6  *
7  * This code is derived from software contributed to The NetBSD Foundation
8  * by Julio M. Merino Vidal, developed as part of Google's Summer of Code
9  * 2005 program.
10  *
11  * Redistribution and use in source and binary forms, with or without
12  * modification, are permitted provided that the following conditions
13  * are met:
14  * 1. Redistributions of source code must retain the above copyright
15  *    notice, this list of conditions and the following disclaimer.
16  * 2. Redistributions in binary form must reproduce the above copyright
17  *    notice, this list of conditions and the following disclaimer in the
18  *    documentation and/or other materials provided with the distribution.
19  *
20  * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
21  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
22  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
23  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
24  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
25  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
26  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
27  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
28  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
29  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
30  * POSSIBILITY OF SUCH DAMAGE.
31  */
32 
33 /*
34  * Efficient memory file system supporting functions.
35  */
36 #include <sys/cdefs.h>
37 __FBSDID("$FreeBSD$");
38 
39 #include <sys/param.h>
40 #include <sys/fnv_hash.h>
41 #include <sys/lock.h>
42 #include <sys/namei.h>
43 #include <sys/priv.h>
44 #include <sys/proc.h>
45 #include <sys/rwlock.h>
46 #include <sys/stat.h>
47 #include <sys/systm.h>
48 #include <sys/sysctl.h>
49 #include <sys/vnode.h>
50 #include <sys/vmmeter.h>
51 
52 #include <vm/vm.h>
53 #include <vm/vm_param.h>
54 #include <vm/vm_object.h>
55 #include <vm/vm_page.h>
56 #include <vm/vm_pageout.h>
57 #include <vm/vm_pager.h>
58 #include <vm/vm_extern.h>
59 
60 #include <fs/tmpfs/tmpfs.h>
61 #include <fs/tmpfs/tmpfs_fifoops.h>
62 #include <fs/tmpfs/tmpfs_vnops.h>
63 
64 struct tmpfs_dir_cursor {
65 	struct tmpfs_dirent	*tdc_current;
66 	struct tmpfs_dirent	*tdc_tree;
67 };
68 
69 SYSCTL_NODE(_vfs, OID_AUTO, tmpfs, CTLFLAG_RW, 0, "tmpfs file system");
70 
71 static long tmpfs_pages_reserved = TMPFS_PAGES_MINRESERVED;
72 
73 static int
74 sysctl_mem_reserved(SYSCTL_HANDLER_ARGS)
75 {
76 	int error;
77 	long pages, bytes;
78 
79 	pages = *(long *)arg1;
80 	bytes = pages * PAGE_SIZE;
81 
82 	error = sysctl_handle_long(oidp, &bytes, 0, req);
83 	if (error || !req->newptr)
84 		return (error);
85 
86 	pages = bytes / PAGE_SIZE;
87 	if (pages < TMPFS_PAGES_MINRESERVED)
88 		return (EINVAL);
89 
90 	*(long *)arg1 = pages;
91 	return (0);
92 }
93 
94 SYSCTL_PROC(_vfs_tmpfs, OID_AUTO, memory_reserved, CTLTYPE_LONG|CTLFLAG_RW,
95     &tmpfs_pages_reserved, 0, sysctl_mem_reserved, "L",
96     "Amount of available memory and swap below which tmpfs growth stops");
97 
98 static __inline int tmpfs_dirtree_cmp(struct tmpfs_dirent *a,
99     struct tmpfs_dirent *b);
100 RB_PROTOTYPE_STATIC(tmpfs_dir, tmpfs_dirent, uh.td_entries, tmpfs_dirtree_cmp);
101 
102 size_t
103 tmpfs_mem_avail(void)
104 {
105 	vm_ooffset_t avail;
106 
107 	avail = swap_pager_avail + vm_cnt.v_free_count + vm_cnt.v_cache_count -
108 	    tmpfs_pages_reserved;
109 	if (__predict_false(avail < 0))
110 		avail = 0;
111 	return (avail);
112 }
113 
114 size_t
115 tmpfs_pages_used(struct tmpfs_mount *tmp)
116 {
117 	const size_t node_size = sizeof(struct tmpfs_node) +
118 	    sizeof(struct tmpfs_dirent);
119 	size_t meta_pages;
120 
121 	meta_pages = howmany((uintmax_t)tmp->tm_nodes_inuse * node_size,
122 	    PAGE_SIZE);
123 	return (meta_pages + tmp->tm_pages_used);
124 }
125 
126 static size_t
127 tmpfs_pages_check_avail(struct tmpfs_mount *tmp, size_t req_pages)
128 {
129 	if (tmpfs_mem_avail() < req_pages)
130 		return (0);
131 
132 	if (tmp->tm_pages_max != SIZE_MAX &&
133 	    tmp->tm_pages_max < req_pages + tmpfs_pages_used(tmp))
134 			return (0);
135 
136 	return (1);
137 }
138 
139 /*
140  * Allocates a new node of type 'type' inside the 'tmp' mount point, with
141  * its owner set to 'uid', its group to 'gid' and its mode set to 'mode',
142  * using the credentials of the process 'p'.
143  *
144  * If the node type is set to 'VDIR', then the parent parameter must point
145  * to the parent directory of the node being created.  It may only be NULL
146  * while allocating the root node.
147  *
148  * If the node type is set to 'VBLK' or 'VCHR', then the rdev parameter
149  * specifies the device the node represents.
150  *
151  * If the node type is set to 'VLNK', then the parameter target specifies
152  * the file name of the target file for the symbolic link that is being
153  * created.
154  *
155  * Note that new nodes are retrieved from the available list if it has
156  * items or, if it is empty, from the node pool as long as there is enough
157  * space to create them.
158  *
159  * Returns zero on success or an appropriate error code on failure.
160  */
161 int
162 tmpfs_alloc_node(struct mount *mp, struct tmpfs_mount *tmp, enum vtype type,
163     uid_t uid, gid_t gid, mode_t mode, struct tmpfs_node *parent,
164     char *target, dev_t rdev, struct tmpfs_node **node)
165 {
166 	struct tmpfs_node *nnode;
167 	vm_object_t obj;
168 
169 	/* If the root directory of the 'tmp' file system is not yet
170 	 * allocated, this must be the request to do it. */
171 	MPASS(IMPLIES(tmp->tm_root == NULL, parent == NULL && type == VDIR));
172 	KASSERT(tmp->tm_root == NULL || mp->mnt_writeopcount > 0,
173 	    ("creating node not under vn_start_write"));
174 
175 	MPASS(IFF(type == VLNK, target != NULL));
176 	MPASS(IFF(type == VBLK || type == VCHR, rdev != VNOVAL));
177 
178 	if (tmp->tm_nodes_inuse >= tmp->tm_nodes_max)
179 		return (ENOSPC);
180 	if (tmpfs_pages_check_avail(tmp, 1) == 0)
181 		return (ENOSPC);
182 
183 	if ((mp->mnt_kern_flag & MNTK_UNMOUNT) != 0) {
184 		/*
185 		 * When a new tmpfs node is created for fully
186 		 * constructed mount point, there must be a parent
187 		 * node, which vnode is locked exclusively.  As
188 		 * consequence, if the unmount is executing in
189 		 * parallel, vflush() cannot reclaim the parent vnode.
190 		 * Due to this, the check for MNTK_UNMOUNT flag is not
191 		 * racy: if we did not see MNTK_UNMOUNT flag, then tmp
192 		 * cannot be destroyed until node construction is
193 		 * finished and the parent vnode unlocked.
194 		 *
195 		 * Tmpfs does not need to instantiate new nodes during
196 		 * unmount.
197 		 */
198 		return (EBUSY);
199 	}
200 
201 	nnode = (struct tmpfs_node *)uma_zalloc_arg(
202 				tmp->tm_node_pool, tmp, M_WAITOK);
203 
204 	/* Generic initialization. */
205 	nnode->tn_type = type;
206 	vfs_timestamp(&nnode->tn_atime);
207 	nnode->tn_birthtime = nnode->tn_ctime = nnode->tn_mtime =
208 	    nnode->tn_atime;
209 	nnode->tn_uid = uid;
210 	nnode->tn_gid = gid;
211 	nnode->tn_mode = mode;
212 	nnode->tn_id = alloc_unr(tmp->tm_ino_unr);
213 
214 	/* Type-specific initialization. */
215 	switch (nnode->tn_type) {
216 	case VBLK:
217 	case VCHR:
218 		nnode->tn_rdev = rdev;
219 		break;
220 
221 	case VDIR:
222 		RB_INIT(&nnode->tn_dir.tn_dirhead);
223 		LIST_INIT(&nnode->tn_dir.tn_dupindex);
224 		MPASS(parent != nnode);
225 		MPASS(IMPLIES(parent == NULL, tmp->tm_root == NULL));
226 		nnode->tn_dir.tn_parent = (parent == NULL) ? nnode : parent;
227 		nnode->tn_dir.tn_readdir_lastn = 0;
228 		nnode->tn_dir.tn_readdir_lastp = NULL;
229 		nnode->tn_links++;
230 		TMPFS_NODE_LOCK(nnode->tn_dir.tn_parent);
231 		nnode->tn_dir.tn_parent->tn_links++;
232 		TMPFS_NODE_UNLOCK(nnode->tn_dir.tn_parent);
233 		break;
234 
235 	case VFIFO:
236 		/* FALLTHROUGH */
237 	case VSOCK:
238 		break;
239 
240 	case VLNK:
241 		MPASS(strlen(target) < MAXPATHLEN);
242 		nnode->tn_size = strlen(target);
243 		nnode->tn_link = malloc(nnode->tn_size, M_TMPFSNAME,
244 		    M_WAITOK);
245 		memcpy(nnode->tn_link, target, nnode->tn_size);
246 		break;
247 
248 	case VREG:
249 		obj = nnode->tn_reg.tn_aobj =
250 		    vm_pager_allocate(OBJT_SWAP, NULL, 0, VM_PROT_DEFAULT, 0,
251 			NULL /* XXXKIB - tmpfs needs swap reservation */);
252 		VM_OBJECT_WLOCK(obj);
253 		/* OBJ_TMPFS is set together with the setting of vp->v_object */
254 		vm_object_set_flag(obj, OBJ_NOSPLIT | OBJ_TMPFS_NODE);
255 		vm_object_clear_flag(obj, OBJ_ONEMAPPING);
256 		VM_OBJECT_WUNLOCK(obj);
257 		break;
258 
259 	default:
260 		panic("tmpfs_alloc_node: type %p %d", nnode, (int)nnode->tn_type);
261 	}
262 
263 	TMPFS_LOCK(tmp);
264 	LIST_INSERT_HEAD(&tmp->tm_nodes_used, nnode, tn_entries);
265 	tmp->tm_nodes_inuse++;
266 	TMPFS_UNLOCK(tmp);
267 
268 	*node = nnode;
269 	return 0;
270 }
271 
272 /*
273  * Destroys the node pointed to by node from the file system 'tmp'.
274  * If the node does not belong to the given mount point, the results are
275  * unpredicted.
276  *
277  * If the node references a directory; no entries are allowed because
278  * their removal could need a recursive algorithm, something forbidden in
279  * kernel space.  Furthermore, there is not need to provide such
280  * functionality (recursive removal) because the only primitives offered
281  * to the user are the removal of empty directories and the deletion of
282  * individual files.
283  *
284  * Note that nodes are not really deleted; in fact, when a node has been
285  * allocated, it cannot be deleted during the whole life of the file
286  * system.  Instead, they are moved to the available list and remain there
287  * until reused.
288  */
289 void
290 tmpfs_free_node(struct tmpfs_mount *tmp, struct tmpfs_node *node)
291 {
292 	vm_object_t uobj;
293 
294 #ifdef INVARIANTS
295 	TMPFS_NODE_LOCK(node);
296 	MPASS(node->tn_vnode == NULL);
297 	MPASS((node->tn_vpstate & TMPFS_VNODE_ALLOCATING) == 0);
298 	TMPFS_NODE_UNLOCK(node);
299 #endif
300 
301 	TMPFS_LOCK(tmp);
302 	LIST_REMOVE(node, tn_entries);
303 	tmp->tm_nodes_inuse--;
304 	TMPFS_UNLOCK(tmp);
305 
306 	switch (node->tn_type) {
307 	case VNON:
308 		/* Do not do anything.  VNON is provided to let the
309 		 * allocation routine clean itself easily by avoiding
310 		 * duplicating code in it. */
311 		/* FALLTHROUGH */
312 	case VBLK:
313 		/* FALLTHROUGH */
314 	case VCHR:
315 		/* FALLTHROUGH */
316 	case VDIR:
317 		/* FALLTHROUGH */
318 	case VFIFO:
319 		/* FALLTHROUGH */
320 	case VSOCK:
321 		break;
322 
323 	case VLNK:
324 		free(node->tn_link, M_TMPFSNAME);
325 		break;
326 
327 	case VREG:
328 		uobj = node->tn_reg.tn_aobj;
329 		if (uobj != NULL) {
330 			TMPFS_LOCK(tmp);
331 			tmp->tm_pages_used -= uobj->size;
332 			TMPFS_UNLOCK(tmp);
333 			KASSERT((uobj->flags & OBJ_TMPFS) == 0,
334 			    ("leaked OBJ_TMPFS node %p vm_obj %p", node, uobj));
335 			vm_object_deallocate(uobj);
336 		}
337 		break;
338 
339 	default:
340 		panic("tmpfs_free_node: type %p %d", node, (int)node->tn_type);
341 	}
342 
343 	free_unr(tmp->tm_ino_unr, node->tn_id);
344 	uma_zfree(tmp->tm_node_pool, node);
345 }
346 
347 static __inline uint32_t
348 tmpfs_dirent_hash(const char *name, u_int len)
349 {
350 	uint32_t hash;
351 
352 	hash = fnv_32_buf(name, len, FNV1_32_INIT + len) & TMPFS_DIRCOOKIE_MASK;
353 #ifdef TMPFS_DEBUG_DIRCOOKIE_DUP
354 	hash &= 0xf;
355 #endif
356 	if (hash < TMPFS_DIRCOOKIE_MIN)
357 		hash += TMPFS_DIRCOOKIE_MIN;
358 
359 	return (hash);
360 }
361 
362 static __inline off_t
363 tmpfs_dirent_cookie(struct tmpfs_dirent *de)
364 {
365 	if (de == NULL)
366 		return (TMPFS_DIRCOOKIE_EOF);
367 
368 	MPASS(de->td_cookie >= TMPFS_DIRCOOKIE_MIN);
369 
370 	return (de->td_cookie);
371 }
372 
373 static __inline boolean_t
374 tmpfs_dirent_dup(struct tmpfs_dirent *de)
375 {
376 	return ((de->td_cookie & TMPFS_DIRCOOKIE_DUP) != 0);
377 }
378 
379 static __inline boolean_t
380 tmpfs_dirent_duphead(struct tmpfs_dirent *de)
381 {
382 	return ((de->td_cookie & TMPFS_DIRCOOKIE_DUPHEAD) != 0);
383 }
384 
385 void
386 tmpfs_dirent_init(struct tmpfs_dirent *de, const char *name, u_int namelen)
387 {
388 	de->td_hash = de->td_cookie = tmpfs_dirent_hash(name, namelen);
389 	memcpy(de->ud.td_name, name, namelen);
390 	de->td_namelen = namelen;
391 }
392 
393 /*
394  * Allocates a new directory entry for the node node with a name of name.
395  * The new directory entry is returned in *de.
396  *
397  * The link count of node is increased by one to reflect the new object
398  * referencing it.
399  *
400  * Returns zero on success or an appropriate error code on failure.
401  */
402 int
403 tmpfs_alloc_dirent(struct tmpfs_mount *tmp, struct tmpfs_node *node,
404     const char *name, u_int len, struct tmpfs_dirent **de)
405 {
406 	struct tmpfs_dirent *nde;
407 
408 	nde = uma_zalloc(tmp->tm_dirent_pool, M_WAITOK);
409 	nde->td_node = node;
410 	if (name != NULL) {
411 		nde->ud.td_name = malloc(len, M_TMPFSNAME, M_WAITOK);
412 		tmpfs_dirent_init(nde, name, len);
413 	} else
414 		nde->td_namelen = 0;
415 	if (node != NULL)
416 		node->tn_links++;
417 
418 	*de = nde;
419 
420 	return 0;
421 }
422 
423 /*
424  * Frees a directory entry.  It is the caller's responsibility to destroy
425  * the node referenced by it if needed.
426  *
427  * The link count of node is decreased by one to reflect the removal of an
428  * object that referenced it.  This only happens if 'node_exists' is true;
429  * otherwise the function will not access the node referred to by the
430  * directory entry, as it may already have been released from the outside.
431  */
432 void
433 tmpfs_free_dirent(struct tmpfs_mount *tmp, struct tmpfs_dirent *de)
434 {
435 	struct tmpfs_node *node;
436 
437 	node = de->td_node;
438 	if (node != NULL) {
439 		MPASS(node->tn_links > 0);
440 		node->tn_links--;
441 	}
442 	if (!tmpfs_dirent_duphead(de) && de->ud.td_name != NULL)
443 		free(de->ud.td_name, M_TMPFSNAME);
444 	uma_zfree(tmp->tm_dirent_pool, de);
445 }
446 
447 void
448 tmpfs_destroy_vobject(struct vnode *vp, vm_object_t obj)
449 {
450 
451 	ASSERT_VOP_ELOCKED(vp, "tmpfs_destroy_vobject");
452 	if (vp->v_type != VREG || obj == NULL)
453 		return;
454 
455 	VM_OBJECT_WLOCK(obj);
456 	VI_LOCK(vp);
457 	vm_object_clear_flag(obj, OBJ_TMPFS);
458 	obj->un_pager.swp.swp_tmpfs = NULL;
459 	VI_UNLOCK(vp);
460 	VM_OBJECT_WUNLOCK(obj);
461 }
462 
463 /*
464  * Need to clear v_object for insmntque failure.
465  */
466 static void
467 tmpfs_insmntque_dtr(struct vnode *vp, void *dtr_arg)
468 {
469 
470 	tmpfs_destroy_vobject(vp, vp->v_object);
471 	vp->v_object = NULL;
472 	vp->v_data = NULL;
473 	vp->v_op = &dead_vnodeops;
474 	vgone(vp);
475 	vput(vp);
476 }
477 
478 /*
479  * Allocates a new vnode for the node node or returns a new reference to
480  * an existing one if the node had already a vnode referencing it.  The
481  * resulting locked vnode is returned in *vpp.
482  *
483  * Returns zero on success or an appropriate error code on failure.
484  */
485 int
486 tmpfs_alloc_vp(struct mount *mp, struct tmpfs_node *node, int lkflag,
487     struct vnode **vpp)
488 {
489 	struct vnode *vp;
490 	vm_object_t object;
491 	int error;
492 
493 	error = 0;
494 loop:
495 	TMPFS_NODE_LOCK(node);
496 loop1:
497 	if ((vp = node->tn_vnode) != NULL) {
498 		MPASS((node->tn_vpstate & TMPFS_VNODE_DOOMED) == 0);
499 		VI_LOCK(vp);
500 		if ((node->tn_type == VDIR && node->tn_dir.tn_parent == NULL) ||
501 		    ((vp->v_iflag & VI_DOOMED) != 0 &&
502 		    (lkflag & LK_NOWAIT) != 0)) {
503 			VI_UNLOCK(vp);
504 			TMPFS_NODE_UNLOCK(node);
505 			error = ENOENT;
506 			vp = NULL;
507 			goto out;
508 		}
509 		if ((vp->v_iflag & VI_DOOMED) != 0) {
510 			VI_UNLOCK(vp);
511 			node->tn_vpstate |= TMPFS_VNODE_WRECLAIM;
512 			while ((node->tn_vpstate & TMPFS_VNODE_WRECLAIM) != 0) {
513 				msleep(&node->tn_vnode, TMPFS_NODE_MTX(node),
514 				    0, "tmpfsE", 0);
515 			}
516 			goto loop1;
517 		}
518 		TMPFS_NODE_UNLOCK(node);
519 		error = vget(vp, lkflag | LK_INTERLOCK, curthread);
520 		if (error == ENOENT)
521 			goto loop;
522 		if (error != 0) {
523 			vp = NULL;
524 			goto out;
525 		}
526 
527 		/*
528 		 * Make sure the vnode is still there after
529 		 * getting the interlock to avoid racing a free.
530 		 */
531 		if (node->tn_vnode == NULL || node->tn_vnode != vp) {
532 			vput(vp);
533 			goto loop;
534 		}
535 
536 		goto out;
537 	}
538 
539 	if ((node->tn_vpstate & TMPFS_VNODE_DOOMED) ||
540 	    (node->tn_type == VDIR && node->tn_dir.tn_parent == NULL)) {
541 		TMPFS_NODE_UNLOCK(node);
542 		error = ENOENT;
543 		vp = NULL;
544 		goto out;
545 	}
546 
547 	/*
548 	 * otherwise lock the vp list while we call getnewvnode
549 	 * since that can block.
550 	 */
551 	if (node->tn_vpstate & TMPFS_VNODE_ALLOCATING) {
552 		node->tn_vpstate |= TMPFS_VNODE_WANT;
553 		error = msleep((caddr_t) &node->tn_vpstate,
554 		    TMPFS_NODE_MTX(node), PDROP | PCATCH,
555 		    "tmpfs_alloc_vp", 0);
556 		if (error)
557 			return error;
558 
559 		goto loop;
560 	} else
561 		node->tn_vpstate |= TMPFS_VNODE_ALLOCATING;
562 
563 	TMPFS_NODE_UNLOCK(node);
564 
565 	/* Get a new vnode and associate it with our node. */
566 	error = getnewvnode("tmpfs", mp, &tmpfs_vnodeop_entries, &vp);
567 	if (error != 0)
568 		goto unlock;
569 	MPASS(vp != NULL);
570 
571 	/* lkflag is ignored, the lock is exclusive */
572 	(void) vn_lock(vp, lkflag | LK_RETRY);
573 
574 	vp->v_data = node;
575 	vp->v_type = node->tn_type;
576 
577 	/* Type-specific initialization. */
578 	switch (node->tn_type) {
579 	case VBLK:
580 		/* FALLTHROUGH */
581 	case VCHR:
582 		/* FALLTHROUGH */
583 	case VLNK:
584 		/* FALLTHROUGH */
585 	case VSOCK:
586 		break;
587 	case VFIFO:
588 		vp->v_op = &tmpfs_fifoop_entries;
589 		break;
590 	case VREG:
591 		object = node->tn_reg.tn_aobj;
592 		VM_OBJECT_WLOCK(object);
593 		VI_LOCK(vp);
594 		KASSERT(vp->v_object == NULL, ("Not NULL v_object in tmpfs"));
595 		vp->v_object = object;
596 		object->un_pager.swp.swp_tmpfs = vp;
597 		vm_object_set_flag(object, OBJ_TMPFS);
598 		VI_UNLOCK(vp);
599 		VM_OBJECT_WUNLOCK(object);
600 		break;
601 	case VDIR:
602 		MPASS(node->tn_dir.tn_parent != NULL);
603 		if (node->tn_dir.tn_parent == node)
604 			vp->v_vflag |= VV_ROOT;
605 		break;
606 
607 	default:
608 		panic("tmpfs_alloc_vp: type %p %d", node, (int)node->tn_type);
609 	}
610 	if (vp->v_type != VFIFO)
611 		VN_LOCK_ASHARE(vp);
612 
613 	error = insmntque1(vp, mp, tmpfs_insmntque_dtr, NULL);
614 	if (error)
615 		vp = NULL;
616 
617 unlock:
618 	TMPFS_NODE_LOCK(node);
619 
620 	MPASS(node->tn_vpstate & TMPFS_VNODE_ALLOCATING);
621 	node->tn_vpstate &= ~TMPFS_VNODE_ALLOCATING;
622 	node->tn_vnode = vp;
623 
624 	if (node->tn_vpstate & TMPFS_VNODE_WANT) {
625 		node->tn_vpstate &= ~TMPFS_VNODE_WANT;
626 		TMPFS_NODE_UNLOCK(node);
627 		wakeup((caddr_t) &node->tn_vpstate);
628 	} else
629 		TMPFS_NODE_UNLOCK(node);
630 
631 out:
632 	*vpp = vp;
633 
634 #ifdef INVARIANTS
635 	if (error == 0) {
636 		MPASS(*vpp != NULL && VOP_ISLOCKED(*vpp));
637 		TMPFS_NODE_LOCK(node);
638 		MPASS(*vpp == node->tn_vnode);
639 		TMPFS_NODE_UNLOCK(node);
640 	}
641 #endif
642 
643 	return error;
644 }
645 
646 /*
647  * Destroys the association between the vnode vp and the node it
648  * references.
649  */
650 void
651 tmpfs_free_vp(struct vnode *vp)
652 {
653 	struct tmpfs_node *node;
654 
655 	node = VP_TO_TMPFS_NODE(vp);
656 
657 	TMPFS_NODE_ASSERT_LOCKED(node);
658 	node->tn_vnode = NULL;
659 	if ((node->tn_vpstate & TMPFS_VNODE_WRECLAIM) != 0)
660 		wakeup(&node->tn_vnode);
661 	node->tn_vpstate &= ~TMPFS_VNODE_WRECLAIM;
662 	vp->v_data = NULL;
663 }
664 
665 /*
666  * Allocates a new file of type 'type' and adds it to the parent directory
667  * 'dvp'; this addition is done using the component name given in 'cnp'.
668  * The ownership of the new file is automatically assigned based on the
669  * credentials of the caller (through 'cnp'), the group is set based on
670  * the parent directory and the mode is determined from the 'vap' argument.
671  * If successful, *vpp holds a vnode to the newly created file and zero
672  * is returned.  Otherwise *vpp is NULL and the function returns an
673  * appropriate error code.
674  */
675 int
676 tmpfs_alloc_file(struct vnode *dvp, struct vnode **vpp, struct vattr *vap,
677     struct componentname *cnp, char *target)
678 {
679 	int error;
680 	struct tmpfs_dirent *de;
681 	struct tmpfs_mount *tmp;
682 	struct tmpfs_node *dnode;
683 	struct tmpfs_node *node;
684 	struct tmpfs_node *parent;
685 
686 	MPASS(VOP_ISLOCKED(dvp));
687 	MPASS(cnp->cn_flags & HASBUF);
688 
689 	tmp = VFS_TO_TMPFS(dvp->v_mount);
690 	dnode = VP_TO_TMPFS_DIR(dvp);
691 	*vpp = NULL;
692 
693 	/* If the entry we are creating is a directory, we cannot overflow
694 	 * the number of links of its parent, because it will get a new
695 	 * link. */
696 	if (vap->va_type == VDIR) {
697 		/* Ensure that we do not overflow the maximum number of links
698 		 * imposed by the system. */
699 		MPASS(dnode->tn_links <= LINK_MAX);
700 		if (dnode->tn_links == LINK_MAX) {
701 			return (EMLINK);
702 		}
703 
704 		parent = dnode;
705 		MPASS(parent != NULL);
706 	} else
707 		parent = NULL;
708 
709 	/* Allocate a node that represents the new file. */
710 	error = tmpfs_alloc_node(dvp->v_mount, tmp, vap->va_type,
711 	    cnp->cn_cred->cr_uid,
712 	    dnode->tn_gid, vap->va_mode, parent, target, vap->va_rdev, &node);
713 	if (error != 0)
714 		return (error);
715 
716 	/* Allocate a directory entry that points to the new file. */
717 	error = tmpfs_alloc_dirent(tmp, node, cnp->cn_nameptr, cnp->cn_namelen,
718 	    &de);
719 	if (error != 0) {
720 		tmpfs_free_node(tmp, node);
721 		return (error);
722 	}
723 
724 	/* Allocate a vnode for the new file. */
725 	error = tmpfs_alloc_vp(dvp->v_mount, node, LK_EXCLUSIVE, vpp);
726 	if (error != 0) {
727 		tmpfs_free_dirent(tmp, de);
728 		tmpfs_free_node(tmp, node);
729 		return (error);
730 	}
731 
732 	/* Now that all required items are allocated, we can proceed to
733 	 * insert the new node into the directory, an operation that
734 	 * cannot fail. */
735 	if (cnp->cn_flags & ISWHITEOUT)
736 		tmpfs_dir_whiteout_remove(dvp, cnp);
737 	tmpfs_dir_attach(dvp, de);
738 	return (0);
739 }
740 
741 static struct tmpfs_dirent *
742 tmpfs_dir_first(struct tmpfs_node *dnode, struct tmpfs_dir_cursor *dc)
743 {
744 	struct tmpfs_dirent *de;
745 
746 	de = RB_MIN(tmpfs_dir, &dnode->tn_dir.tn_dirhead);
747 	dc->tdc_tree = de;
748 	if (de != NULL && tmpfs_dirent_duphead(de))
749 		de = LIST_FIRST(&de->ud.td_duphead);
750 	dc->tdc_current = de;
751 
752 	return (dc->tdc_current);
753 }
754 
755 static struct tmpfs_dirent *
756 tmpfs_dir_next(struct tmpfs_node *dnode, struct tmpfs_dir_cursor *dc)
757 {
758 	struct tmpfs_dirent *de;
759 
760 	MPASS(dc->tdc_tree != NULL);
761 	if (tmpfs_dirent_dup(dc->tdc_current)) {
762 		dc->tdc_current = LIST_NEXT(dc->tdc_current, uh.td_dup.entries);
763 		if (dc->tdc_current != NULL)
764 			return (dc->tdc_current);
765 	}
766 	dc->tdc_tree = dc->tdc_current = RB_NEXT(tmpfs_dir,
767 	    &dnode->tn_dir.tn_dirhead, dc->tdc_tree);
768 	if ((de = dc->tdc_current) != NULL && tmpfs_dirent_duphead(de)) {
769 		dc->tdc_current = LIST_FIRST(&de->ud.td_duphead);
770 		MPASS(dc->tdc_current != NULL);
771 	}
772 
773 	return (dc->tdc_current);
774 }
775 
776 /* Lookup directory entry in RB-Tree. Function may return duphead entry. */
777 static struct tmpfs_dirent *
778 tmpfs_dir_xlookup_hash(struct tmpfs_node *dnode, uint32_t hash)
779 {
780 	struct tmpfs_dirent *de, dekey;
781 
782 	dekey.td_hash = hash;
783 	de = RB_FIND(tmpfs_dir, &dnode->tn_dir.tn_dirhead, &dekey);
784 	return (de);
785 }
786 
787 /* Lookup directory entry by cookie, initialize directory cursor accordingly. */
788 static struct tmpfs_dirent *
789 tmpfs_dir_lookup_cookie(struct tmpfs_node *node, off_t cookie,
790     struct tmpfs_dir_cursor *dc)
791 {
792 	struct tmpfs_dir *dirhead = &node->tn_dir.tn_dirhead;
793 	struct tmpfs_dirent *de, dekey;
794 
795 	MPASS(cookie >= TMPFS_DIRCOOKIE_MIN);
796 
797 	if (cookie == node->tn_dir.tn_readdir_lastn &&
798 	    (de = node->tn_dir.tn_readdir_lastp) != NULL) {
799 		/* Protect against possible race, tn_readdir_last[pn]
800 		 * may be updated with only shared vnode lock held. */
801 		if (cookie == tmpfs_dirent_cookie(de))
802 			goto out;
803 	}
804 
805 	if ((cookie & TMPFS_DIRCOOKIE_DUP) != 0) {
806 		LIST_FOREACH(de, &node->tn_dir.tn_dupindex,
807 		    uh.td_dup.index_entries) {
808 			MPASS(tmpfs_dirent_dup(de));
809 			if (de->td_cookie == cookie)
810 				goto out;
811 			/* dupindex list is sorted. */
812 			if (de->td_cookie < cookie) {
813 				de = NULL;
814 				goto out;
815 			}
816 		}
817 		MPASS(de == NULL);
818 		goto out;
819 	}
820 
821 	MPASS((cookie & TMPFS_DIRCOOKIE_MASK) == cookie);
822 	dekey.td_hash = cookie;
823 	/* Recover if direntry for cookie was removed */
824 	de = RB_NFIND(tmpfs_dir, dirhead, &dekey);
825 	dc->tdc_tree = de;
826 	dc->tdc_current = de;
827 	if (de != NULL && tmpfs_dirent_duphead(de)) {
828 		dc->tdc_current = LIST_FIRST(&de->ud.td_duphead);
829 		MPASS(dc->tdc_current != NULL);
830 	}
831 	return (dc->tdc_current);
832 
833 out:
834 	dc->tdc_tree = de;
835 	dc->tdc_current = de;
836 	if (de != NULL && tmpfs_dirent_dup(de))
837 		dc->tdc_tree = tmpfs_dir_xlookup_hash(node,
838 		    de->td_hash);
839 	return (dc->tdc_current);
840 }
841 
842 /*
843  * Looks for a directory entry in the directory represented by node.
844  * 'cnp' describes the name of the entry to look for.  Note that the .
845  * and .. components are not allowed as they do not physically exist
846  * within directories.
847  *
848  * Returns a pointer to the entry when found, otherwise NULL.
849  */
850 struct tmpfs_dirent *
851 tmpfs_dir_lookup(struct tmpfs_node *node, struct tmpfs_node *f,
852     struct componentname *cnp)
853 {
854 	struct tmpfs_dir_duphead *duphead;
855 	struct tmpfs_dirent *de;
856 	uint32_t hash;
857 
858 	MPASS(IMPLIES(cnp->cn_namelen == 1, cnp->cn_nameptr[0] != '.'));
859 	MPASS(IMPLIES(cnp->cn_namelen == 2, !(cnp->cn_nameptr[0] == '.' &&
860 	    cnp->cn_nameptr[1] == '.')));
861 	TMPFS_VALIDATE_DIR(node);
862 
863 	hash = tmpfs_dirent_hash(cnp->cn_nameptr, cnp->cn_namelen);
864 	de = tmpfs_dir_xlookup_hash(node, hash);
865 	if (de != NULL && tmpfs_dirent_duphead(de)) {
866 		duphead = &de->ud.td_duphead;
867 		LIST_FOREACH(de, duphead, uh.td_dup.entries) {
868 			if (TMPFS_DIRENT_MATCHES(de, cnp->cn_nameptr,
869 			    cnp->cn_namelen))
870 				break;
871 		}
872 	} else if (de != NULL) {
873 		if (!TMPFS_DIRENT_MATCHES(de, cnp->cn_nameptr,
874 		    cnp->cn_namelen))
875 			de = NULL;
876 	}
877 	if (de != NULL && f != NULL && de->td_node != f)
878 		de = NULL;
879 
880 	return (de);
881 }
882 
883 /*
884  * Attach duplicate-cookie directory entry nde to dnode and insert to dupindex
885  * list, allocate new cookie value.
886  */
887 static void
888 tmpfs_dir_attach_dup(struct tmpfs_node *dnode,
889     struct tmpfs_dir_duphead *duphead, struct tmpfs_dirent *nde)
890 {
891 	struct tmpfs_dir_duphead *dupindex;
892 	struct tmpfs_dirent *de, *pde;
893 
894 	dupindex = &dnode->tn_dir.tn_dupindex;
895 	de = LIST_FIRST(dupindex);
896 	if (de == NULL || de->td_cookie < TMPFS_DIRCOOKIE_DUP_MAX) {
897 		if (de == NULL)
898 			nde->td_cookie = TMPFS_DIRCOOKIE_DUP_MIN;
899 		else
900 			nde->td_cookie = de->td_cookie + 1;
901 		MPASS(tmpfs_dirent_dup(nde));
902 		LIST_INSERT_HEAD(dupindex, nde, uh.td_dup.index_entries);
903 		LIST_INSERT_HEAD(duphead, nde, uh.td_dup.entries);
904 		return;
905 	}
906 
907 	/*
908 	 * Cookie numbers are near exhaustion. Scan dupindex list for unused
909 	 * numbers. dupindex list is sorted in descending order. Keep it so
910 	 * after inserting nde.
911 	 */
912 	while (1) {
913 		pde = de;
914 		de = LIST_NEXT(de, uh.td_dup.index_entries);
915 		if (de == NULL && pde->td_cookie != TMPFS_DIRCOOKIE_DUP_MIN) {
916 			/*
917 			 * Last element of the index doesn't have minimal cookie
918 			 * value, use it.
919 			 */
920 			nde->td_cookie = TMPFS_DIRCOOKIE_DUP_MIN;
921 			LIST_INSERT_AFTER(pde, nde, uh.td_dup.index_entries);
922 			LIST_INSERT_HEAD(duphead, nde, uh.td_dup.entries);
923 			return;
924 		} else if (de == NULL) {
925 			/*
926 			 * We are so lucky have 2^30 hash duplicates in single
927 			 * directory :) Return largest possible cookie value.
928 			 * It should be fine except possible issues with
929 			 * VOP_READDIR restart.
930 			 */
931 			nde->td_cookie = TMPFS_DIRCOOKIE_DUP_MAX;
932 			LIST_INSERT_HEAD(dupindex, nde,
933 			    uh.td_dup.index_entries);
934 			LIST_INSERT_HEAD(duphead, nde, uh.td_dup.entries);
935 			return;
936 		}
937 		if (de->td_cookie + 1 == pde->td_cookie ||
938 		    de->td_cookie >= TMPFS_DIRCOOKIE_DUP_MAX)
939 			continue;	/* No hole or invalid cookie. */
940 		nde->td_cookie = de->td_cookie + 1;
941 		MPASS(tmpfs_dirent_dup(nde));
942 		MPASS(pde->td_cookie > nde->td_cookie);
943 		MPASS(nde->td_cookie > de->td_cookie);
944 		LIST_INSERT_BEFORE(de, nde, uh.td_dup.index_entries);
945 		LIST_INSERT_HEAD(duphead, nde, uh.td_dup.entries);
946 		return;
947 	};
948 }
949 
950 /*
951  * Attaches the directory entry de to the directory represented by vp.
952  * Note that this does not change the link count of the node pointed by
953  * the directory entry, as this is done by tmpfs_alloc_dirent.
954  */
955 void
956 tmpfs_dir_attach(struct vnode *vp, struct tmpfs_dirent *de)
957 {
958 	struct tmpfs_node *dnode;
959 	struct tmpfs_dirent *xde, *nde;
960 
961 	ASSERT_VOP_ELOCKED(vp, __func__);
962 	MPASS(de->td_namelen > 0);
963 	MPASS(de->td_hash >= TMPFS_DIRCOOKIE_MIN);
964 	MPASS(de->td_cookie == de->td_hash);
965 
966 	dnode = VP_TO_TMPFS_DIR(vp);
967 	dnode->tn_dir.tn_readdir_lastn = 0;
968 	dnode->tn_dir.tn_readdir_lastp = NULL;
969 
970 	MPASS(!tmpfs_dirent_dup(de));
971 	xde = RB_INSERT(tmpfs_dir, &dnode->tn_dir.tn_dirhead, de);
972 	if (xde != NULL && tmpfs_dirent_duphead(xde))
973 		tmpfs_dir_attach_dup(dnode, &xde->ud.td_duphead, de);
974 	else if (xde != NULL) {
975 		/*
976 		 * Allocate new duphead. Swap xde with duphead to avoid
977 		 * adding/removing elements with the same hash.
978 		 */
979 		MPASS(!tmpfs_dirent_dup(xde));
980 		tmpfs_alloc_dirent(VFS_TO_TMPFS(vp->v_mount), NULL, NULL, 0,
981 		    &nde);
982 		/* *nde = *xde; XXX gcc 4.2.1 may generate invalid code. */
983 		memcpy(nde, xde, sizeof(*xde));
984 		xde->td_cookie |= TMPFS_DIRCOOKIE_DUPHEAD;
985 		LIST_INIT(&xde->ud.td_duphead);
986 		xde->td_namelen = 0;
987 		xde->td_node = NULL;
988 		tmpfs_dir_attach_dup(dnode, &xde->ud.td_duphead, nde);
989 		tmpfs_dir_attach_dup(dnode, &xde->ud.td_duphead, de);
990 	}
991 	dnode->tn_size += sizeof(struct tmpfs_dirent);
992 	dnode->tn_status |= TMPFS_NODE_ACCESSED | TMPFS_NODE_CHANGED | \
993 	    TMPFS_NODE_MODIFIED;
994 	tmpfs_update(vp);
995 }
996 
997 /*
998  * Detaches the directory entry de from the directory represented by vp.
999  * Note that this does not change the link count of the node pointed by
1000  * the directory entry, as this is done by tmpfs_free_dirent.
1001  */
1002 void
1003 tmpfs_dir_detach(struct vnode *vp, struct tmpfs_dirent *de)
1004 {
1005 	struct tmpfs_mount *tmp;
1006 	struct tmpfs_dir *head;
1007 	struct tmpfs_node *dnode;
1008 	struct tmpfs_dirent *xde;
1009 
1010 	ASSERT_VOP_ELOCKED(vp, __func__);
1011 
1012 	dnode = VP_TO_TMPFS_DIR(vp);
1013 	head = &dnode->tn_dir.tn_dirhead;
1014 	dnode->tn_dir.tn_readdir_lastn = 0;
1015 	dnode->tn_dir.tn_readdir_lastp = NULL;
1016 
1017 	if (tmpfs_dirent_dup(de)) {
1018 		/* Remove duphead if de was last entry. */
1019 		if (LIST_NEXT(de, uh.td_dup.entries) == NULL) {
1020 			xde = tmpfs_dir_xlookup_hash(dnode, de->td_hash);
1021 			MPASS(tmpfs_dirent_duphead(xde));
1022 		} else
1023 			xde = NULL;
1024 		LIST_REMOVE(de, uh.td_dup.entries);
1025 		LIST_REMOVE(de, uh.td_dup.index_entries);
1026 		if (xde != NULL) {
1027 			if (LIST_EMPTY(&xde->ud.td_duphead)) {
1028 				RB_REMOVE(tmpfs_dir, head, xde);
1029 				tmp = VFS_TO_TMPFS(vp->v_mount);
1030 				MPASS(xde->td_node == NULL);
1031 				tmpfs_free_dirent(tmp, xde);
1032 			}
1033 		}
1034 	} else
1035 		RB_REMOVE(tmpfs_dir, head, de);
1036 
1037 	dnode->tn_size -= sizeof(struct tmpfs_dirent);
1038 	dnode->tn_status |= TMPFS_NODE_ACCESSED | TMPFS_NODE_CHANGED | \
1039 	    TMPFS_NODE_MODIFIED;
1040 	tmpfs_update(vp);
1041 }
1042 
1043 void
1044 tmpfs_dir_destroy(struct tmpfs_mount *tmp, struct tmpfs_node *dnode)
1045 {
1046 	struct tmpfs_dirent *de, *dde, *nde;
1047 
1048 	RB_FOREACH_SAFE(de, tmpfs_dir, &dnode->tn_dir.tn_dirhead, nde) {
1049 		RB_REMOVE(tmpfs_dir, &dnode->tn_dir.tn_dirhead, de);
1050 		/* Node may already be destroyed. */
1051 		de->td_node = NULL;
1052 		if (tmpfs_dirent_duphead(de)) {
1053 			while ((dde = LIST_FIRST(&de->ud.td_duphead)) != NULL) {
1054 				LIST_REMOVE(dde, uh.td_dup.entries);
1055 				dde->td_node = NULL;
1056 				tmpfs_free_dirent(tmp, dde);
1057 			}
1058 		}
1059 		tmpfs_free_dirent(tmp, de);
1060 	}
1061 }
1062 
1063 /*
1064  * Helper function for tmpfs_readdir.  Creates a '.' entry for the given
1065  * directory and returns it in the uio space.  The function returns 0
1066  * on success, -1 if there was not enough space in the uio structure to
1067  * hold the directory entry or an appropriate error code if another
1068  * error happens.
1069  */
1070 static int
1071 tmpfs_dir_getdotdent(struct tmpfs_node *node, struct uio *uio)
1072 {
1073 	int error;
1074 	struct dirent dent;
1075 
1076 	TMPFS_VALIDATE_DIR(node);
1077 	MPASS(uio->uio_offset == TMPFS_DIRCOOKIE_DOT);
1078 
1079 	dent.d_fileno = node->tn_id;
1080 	dent.d_type = DT_DIR;
1081 	dent.d_namlen = 1;
1082 	dent.d_name[0] = '.';
1083 	dent.d_name[1] = '\0';
1084 	dent.d_reclen = GENERIC_DIRSIZ(&dent);
1085 
1086 	if (dent.d_reclen > uio->uio_resid)
1087 		error = EJUSTRETURN;
1088 	else
1089 		error = uiomove(&dent, dent.d_reclen, uio);
1090 
1091 	node->tn_status |= TMPFS_NODE_ACCESSED;
1092 
1093 	return error;
1094 }
1095 
1096 /*
1097  * Helper function for tmpfs_readdir.  Creates a '..' entry for the given
1098  * directory and returns it in the uio space.  The function returns 0
1099  * on success, -1 if there was not enough space in the uio structure to
1100  * hold the directory entry or an appropriate error code if another
1101  * error happens.
1102  */
1103 static int
1104 tmpfs_dir_getdotdotdent(struct tmpfs_node *node, struct uio *uio)
1105 {
1106 	int error;
1107 	struct dirent dent;
1108 
1109 	TMPFS_VALIDATE_DIR(node);
1110 	MPASS(uio->uio_offset == TMPFS_DIRCOOKIE_DOTDOT);
1111 
1112 	/*
1113 	 * Return ENOENT if the current node is already removed.
1114 	 */
1115 	TMPFS_ASSERT_LOCKED(node);
1116 	if (node->tn_dir.tn_parent == NULL) {
1117 		return (ENOENT);
1118 	}
1119 
1120 	TMPFS_NODE_LOCK(node->tn_dir.tn_parent);
1121 	dent.d_fileno = node->tn_dir.tn_parent->tn_id;
1122 	TMPFS_NODE_UNLOCK(node->tn_dir.tn_parent);
1123 
1124 	dent.d_type = DT_DIR;
1125 	dent.d_namlen = 2;
1126 	dent.d_name[0] = '.';
1127 	dent.d_name[1] = '.';
1128 	dent.d_name[2] = '\0';
1129 	dent.d_reclen = GENERIC_DIRSIZ(&dent);
1130 
1131 	if (dent.d_reclen > uio->uio_resid)
1132 		error = EJUSTRETURN;
1133 	else
1134 		error = uiomove(&dent, dent.d_reclen, uio);
1135 
1136 	node->tn_status |= TMPFS_NODE_ACCESSED;
1137 
1138 	return error;
1139 }
1140 
1141 /*
1142  * Helper function for tmpfs_readdir.  Returns as much directory entries
1143  * as can fit in the uio space.  The read starts at uio->uio_offset.
1144  * The function returns 0 on success, -1 if there was not enough space
1145  * in the uio structure to hold the directory entry or an appropriate
1146  * error code if another error happens.
1147  */
1148 int
1149 tmpfs_dir_getdents(struct tmpfs_node *node, struct uio *uio, int maxcookies,
1150     u_long *cookies, int *ncookies)
1151 {
1152 	struct tmpfs_dir_cursor dc;
1153 	struct tmpfs_dirent *de;
1154 	off_t off;
1155 	int error;
1156 
1157 	TMPFS_VALIDATE_DIR(node);
1158 
1159 	off = 0;
1160 
1161 	/*
1162 	 * Lookup the node from the current offset.  The starting offset of
1163 	 * 0 will lookup both '.' and '..', and then the first real entry,
1164 	 * or EOF if there are none.  Then find all entries for the dir that
1165 	 * fit into the buffer.  Once no more entries are found (de == NULL),
1166 	 * the offset is set to TMPFS_DIRCOOKIE_EOF, which will cause the next
1167 	 * call to return 0.
1168 	 */
1169 	switch (uio->uio_offset) {
1170 	case TMPFS_DIRCOOKIE_DOT:
1171 		error = tmpfs_dir_getdotdent(node, uio);
1172 		if (error != 0)
1173 			return (error);
1174 		uio->uio_offset = TMPFS_DIRCOOKIE_DOTDOT;
1175 		if (cookies != NULL)
1176 			cookies[(*ncookies)++] = off = uio->uio_offset;
1177 		/* FALLTHROUGH */
1178 	case TMPFS_DIRCOOKIE_DOTDOT:
1179 		error = tmpfs_dir_getdotdotdent(node, uio);
1180 		if (error != 0)
1181 			return (error);
1182 		de = tmpfs_dir_first(node, &dc);
1183 		uio->uio_offset = tmpfs_dirent_cookie(de);
1184 		if (cookies != NULL)
1185 			cookies[(*ncookies)++] = off = uio->uio_offset;
1186 		/* EOF. */
1187 		if (de == NULL)
1188 			return (0);
1189 		break;
1190 	case TMPFS_DIRCOOKIE_EOF:
1191 		return (0);
1192 	default:
1193 		de = tmpfs_dir_lookup_cookie(node, uio->uio_offset, &dc);
1194 		if (de == NULL)
1195 			return (EINVAL);
1196 		if (cookies != NULL)
1197 			off = tmpfs_dirent_cookie(de);
1198 	}
1199 
1200 	/* Read as much entries as possible; i.e., until we reach the end of
1201 	 * the directory or we exhaust uio space. */
1202 	do {
1203 		struct dirent d;
1204 
1205 		/* Create a dirent structure representing the current
1206 		 * tmpfs_node and fill it. */
1207 		if (de->td_node == NULL) {
1208 			d.d_fileno = 1;
1209 			d.d_type = DT_WHT;
1210 		} else {
1211 			d.d_fileno = de->td_node->tn_id;
1212 			switch (de->td_node->tn_type) {
1213 			case VBLK:
1214 				d.d_type = DT_BLK;
1215 				break;
1216 
1217 			case VCHR:
1218 				d.d_type = DT_CHR;
1219 				break;
1220 
1221 			case VDIR:
1222 				d.d_type = DT_DIR;
1223 				break;
1224 
1225 			case VFIFO:
1226 				d.d_type = DT_FIFO;
1227 				break;
1228 
1229 			case VLNK:
1230 				d.d_type = DT_LNK;
1231 				break;
1232 
1233 			case VREG:
1234 				d.d_type = DT_REG;
1235 				break;
1236 
1237 			case VSOCK:
1238 				d.d_type = DT_SOCK;
1239 				break;
1240 
1241 			default:
1242 				panic("tmpfs_dir_getdents: type %p %d",
1243 				    de->td_node, (int)de->td_node->tn_type);
1244 			}
1245 		}
1246 		d.d_namlen = de->td_namelen;
1247 		MPASS(de->td_namelen < sizeof(d.d_name));
1248 		(void)memcpy(d.d_name, de->ud.td_name, de->td_namelen);
1249 		d.d_name[de->td_namelen] = '\0';
1250 		d.d_reclen = GENERIC_DIRSIZ(&d);
1251 
1252 		/* Stop reading if the directory entry we are treating is
1253 		 * bigger than the amount of data that can be returned. */
1254 		if (d.d_reclen > uio->uio_resid) {
1255 			error = EJUSTRETURN;
1256 			break;
1257 		}
1258 
1259 		/* Copy the new dirent structure into the output buffer and
1260 		 * advance pointers. */
1261 		error = uiomove(&d, d.d_reclen, uio);
1262 		if (error == 0) {
1263 			de = tmpfs_dir_next(node, &dc);
1264 			if (cookies != NULL) {
1265 				off = tmpfs_dirent_cookie(de);
1266 				MPASS(*ncookies < maxcookies);
1267 				cookies[(*ncookies)++] = off;
1268 			}
1269 		}
1270 	} while (error == 0 && uio->uio_resid > 0 && de != NULL);
1271 
1272 	/* Skip setting off when using cookies as it is already done above. */
1273 	if (cookies == NULL)
1274 		off = tmpfs_dirent_cookie(de);
1275 
1276 	/* Update the offset and cache. */
1277 	uio->uio_offset = off;
1278 	node->tn_dir.tn_readdir_lastn = off;
1279 	node->tn_dir.tn_readdir_lastp = de;
1280 
1281 	node->tn_status |= TMPFS_NODE_ACCESSED;
1282 	return error;
1283 }
1284 
1285 int
1286 tmpfs_dir_whiteout_add(struct vnode *dvp, struct componentname *cnp)
1287 {
1288 	struct tmpfs_dirent *de;
1289 	int error;
1290 
1291 	error = tmpfs_alloc_dirent(VFS_TO_TMPFS(dvp->v_mount), NULL,
1292 	    cnp->cn_nameptr, cnp->cn_namelen, &de);
1293 	if (error != 0)
1294 		return (error);
1295 	tmpfs_dir_attach(dvp, de);
1296 	return (0);
1297 }
1298 
1299 void
1300 tmpfs_dir_whiteout_remove(struct vnode *dvp, struct componentname *cnp)
1301 {
1302 	struct tmpfs_dirent *de;
1303 
1304 	de = tmpfs_dir_lookup(VP_TO_TMPFS_DIR(dvp), NULL, cnp);
1305 	MPASS(de != NULL && de->td_node == NULL);
1306 	tmpfs_dir_detach(dvp, de);
1307 	tmpfs_free_dirent(VFS_TO_TMPFS(dvp->v_mount), de);
1308 }
1309 
1310 /*
1311  * Resizes the aobj associated with the regular file pointed to by 'vp' to the
1312  * size 'newsize'.  'vp' must point to a vnode that represents a regular file.
1313  * 'newsize' must be positive.
1314  *
1315  * Returns zero on success or an appropriate error code on failure.
1316  */
1317 int
1318 tmpfs_reg_resize(struct vnode *vp, off_t newsize, boolean_t ignerr)
1319 {
1320 	struct tmpfs_mount *tmp;
1321 	struct tmpfs_node *node;
1322 	vm_object_t uobj;
1323 	vm_page_t m, ma[1];
1324 	vm_pindex_t idx, newpages, oldpages;
1325 	off_t oldsize;
1326 	int base, rv;
1327 
1328 	MPASS(vp->v_type == VREG);
1329 	MPASS(newsize >= 0);
1330 
1331 	node = VP_TO_TMPFS_NODE(vp);
1332 	uobj = node->tn_reg.tn_aobj;
1333 	tmp = VFS_TO_TMPFS(vp->v_mount);
1334 
1335 	/*
1336 	 * Convert the old and new sizes to the number of pages needed to
1337 	 * store them.  It may happen that we do not need to do anything
1338 	 * because the last allocated page can accommodate the change on
1339 	 * its own.
1340 	 */
1341 	oldsize = node->tn_size;
1342 	oldpages = OFF_TO_IDX(oldsize + PAGE_MASK);
1343 	MPASS(oldpages == uobj->size);
1344 	newpages = OFF_TO_IDX(newsize + PAGE_MASK);
1345 	if (newpages > oldpages &&
1346 	    tmpfs_pages_check_avail(tmp, newpages - oldpages) == 0)
1347 		return (ENOSPC);
1348 
1349 	VM_OBJECT_WLOCK(uobj);
1350 	if (newsize < oldsize) {
1351 		/*
1352 		 * Zero the truncated part of the last page.
1353 		 */
1354 		base = newsize & PAGE_MASK;
1355 		if (base != 0) {
1356 			idx = OFF_TO_IDX(newsize);
1357 retry:
1358 			m = vm_page_lookup(uobj, idx);
1359 			if (m != NULL) {
1360 				if (vm_page_sleep_if_busy(m, "tmfssz"))
1361 					goto retry;
1362 				MPASS(m->valid == VM_PAGE_BITS_ALL);
1363 			} else if (vm_pager_has_page(uobj, idx, NULL, NULL)) {
1364 				m = vm_page_alloc(uobj, idx, VM_ALLOC_NORMAL);
1365 				if (m == NULL) {
1366 					VM_OBJECT_WUNLOCK(uobj);
1367 					VM_WAIT;
1368 					VM_OBJECT_WLOCK(uobj);
1369 					goto retry;
1370 				} else if (m->valid != VM_PAGE_BITS_ALL) {
1371 					ma[0] = m;
1372 					rv = vm_pager_get_pages(uobj, ma, 1, 0);
1373 					m = vm_page_lookup(uobj, idx);
1374 				} else
1375 					/* A cached page was reactivated. */
1376 					rv = VM_PAGER_OK;
1377 				vm_page_lock(m);
1378 				if (rv == VM_PAGER_OK) {
1379 					vm_page_deactivate(m);
1380 					vm_page_unlock(m);
1381 					vm_page_xunbusy(m);
1382 				} else {
1383 					vm_page_free(m);
1384 					vm_page_unlock(m);
1385 					if (ignerr)
1386 						m = NULL;
1387 					else {
1388 						VM_OBJECT_WUNLOCK(uobj);
1389 						return (EIO);
1390 					}
1391 				}
1392 			}
1393 			if (m != NULL) {
1394 				pmap_zero_page_area(m, base, PAGE_SIZE - base);
1395 				vm_page_dirty(m);
1396 				vm_pager_page_unswapped(m);
1397 			}
1398 		}
1399 
1400 		/*
1401 		 * Release any swap space and free any whole pages.
1402 		 */
1403 		if (newpages < oldpages) {
1404 			swap_pager_freespace(uobj, newpages, oldpages -
1405 			    newpages);
1406 			vm_object_page_remove(uobj, newpages, 0, 0);
1407 		}
1408 	}
1409 	uobj->size = newpages;
1410 	VM_OBJECT_WUNLOCK(uobj);
1411 
1412 	TMPFS_LOCK(tmp);
1413 	tmp->tm_pages_used += (newpages - oldpages);
1414 	TMPFS_UNLOCK(tmp);
1415 
1416 	node->tn_size = newsize;
1417 	return (0);
1418 }
1419 
1420 void
1421 tmpfs_check_mtime(struct vnode *vp)
1422 {
1423 	struct tmpfs_node *node;
1424 	struct vm_object *obj;
1425 
1426 	ASSERT_VOP_ELOCKED(vp, "check_mtime");
1427 	if (vp->v_type != VREG)
1428 		return;
1429 	obj = vp->v_object;
1430 	KASSERT((obj->flags & (OBJ_TMPFS_NODE | OBJ_TMPFS)) ==
1431 	    (OBJ_TMPFS_NODE | OBJ_TMPFS), ("non-tmpfs obj"));
1432 	/* unlocked read */
1433 	if ((obj->flags & OBJ_TMPFS_DIRTY) != 0) {
1434 		VM_OBJECT_WLOCK(obj);
1435 		if ((obj->flags & OBJ_TMPFS_DIRTY) != 0) {
1436 			obj->flags &= ~OBJ_TMPFS_DIRTY;
1437 			node = VP_TO_TMPFS_NODE(vp);
1438 			node->tn_status |= TMPFS_NODE_MODIFIED |
1439 			    TMPFS_NODE_CHANGED;
1440 		}
1441 		VM_OBJECT_WUNLOCK(obj);
1442 	}
1443 }
1444 
1445 /*
1446  * Change flags of the given vnode.
1447  * Caller should execute tmpfs_update on vp after a successful execution.
1448  * The vnode must be locked on entry and remain locked on exit.
1449  */
1450 int
1451 tmpfs_chflags(struct vnode *vp, u_long flags, struct ucred *cred,
1452     struct thread *p)
1453 {
1454 	int error;
1455 	struct tmpfs_node *node;
1456 
1457 	MPASS(VOP_ISLOCKED(vp));
1458 
1459 	node = VP_TO_TMPFS_NODE(vp);
1460 
1461 	if ((flags & ~(SF_APPEND | SF_ARCHIVED | SF_IMMUTABLE | SF_NOUNLINK |
1462 	    UF_APPEND | UF_ARCHIVE | UF_HIDDEN | UF_IMMUTABLE | UF_NODUMP |
1463 	    UF_NOUNLINK | UF_OFFLINE | UF_OPAQUE | UF_READONLY | UF_REPARSE |
1464 	    UF_SPARSE | UF_SYSTEM)) != 0)
1465 		return (EOPNOTSUPP);
1466 
1467 	/* Disallow this operation if the file system is mounted read-only. */
1468 	if (vp->v_mount->mnt_flag & MNT_RDONLY)
1469 		return EROFS;
1470 
1471 	/*
1472 	 * Callers may only modify the file flags on objects they
1473 	 * have VADMIN rights for.
1474 	 */
1475 	if ((error = VOP_ACCESS(vp, VADMIN, cred, p)))
1476 		return (error);
1477 	/*
1478 	 * Unprivileged processes are not permitted to unset system
1479 	 * flags, or modify flags if any system flags are set.
1480 	 */
1481 	if (!priv_check_cred(cred, PRIV_VFS_SYSFLAGS, 0)) {
1482 		if (node->tn_flags &
1483 		    (SF_NOUNLINK | SF_IMMUTABLE | SF_APPEND)) {
1484 			error = securelevel_gt(cred, 0);
1485 			if (error)
1486 				return (error);
1487 		}
1488 	} else {
1489 		if (node->tn_flags &
1490 		    (SF_NOUNLINK | SF_IMMUTABLE | SF_APPEND) ||
1491 		    ((flags ^ node->tn_flags) & SF_SETTABLE))
1492 			return (EPERM);
1493 	}
1494 	node->tn_flags = flags;
1495 	node->tn_status |= TMPFS_NODE_CHANGED;
1496 
1497 	MPASS(VOP_ISLOCKED(vp));
1498 
1499 	return 0;
1500 }
1501 
1502 /*
1503  * Change access mode on the given vnode.
1504  * Caller should execute tmpfs_update on vp after a successful execution.
1505  * The vnode must be locked on entry and remain locked on exit.
1506  */
1507 int
1508 tmpfs_chmod(struct vnode *vp, mode_t mode, struct ucred *cred, struct thread *p)
1509 {
1510 	int error;
1511 	struct tmpfs_node *node;
1512 
1513 	MPASS(VOP_ISLOCKED(vp));
1514 
1515 	node = VP_TO_TMPFS_NODE(vp);
1516 
1517 	/* Disallow this operation if the file system is mounted read-only. */
1518 	if (vp->v_mount->mnt_flag & MNT_RDONLY)
1519 		return EROFS;
1520 
1521 	/* Immutable or append-only files cannot be modified, either. */
1522 	if (node->tn_flags & (IMMUTABLE | APPEND))
1523 		return EPERM;
1524 
1525 	/*
1526 	 * To modify the permissions on a file, must possess VADMIN
1527 	 * for that file.
1528 	 */
1529 	if ((error = VOP_ACCESS(vp, VADMIN, cred, p)))
1530 		return (error);
1531 
1532 	/*
1533 	 * Privileged processes may set the sticky bit on non-directories,
1534 	 * as well as set the setgid bit on a file with a group that the
1535 	 * process is not a member of.
1536 	 */
1537 	if (vp->v_type != VDIR && (mode & S_ISTXT)) {
1538 		if (priv_check_cred(cred, PRIV_VFS_STICKYFILE, 0))
1539 			return (EFTYPE);
1540 	}
1541 	if (!groupmember(node->tn_gid, cred) && (mode & S_ISGID)) {
1542 		error = priv_check_cred(cred, PRIV_VFS_SETGID, 0);
1543 		if (error)
1544 			return (error);
1545 	}
1546 
1547 
1548 	node->tn_mode &= ~ALLPERMS;
1549 	node->tn_mode |= mode & ALLPERMS;
1550 
1551 	node->tn_status |= TMPFS_NODE_CHANGED;
1552 
1553 	MPASS(VOP_ISLOCKED(vp));
1554 
1555 	return 0;
1556 }
1557 
1558 /*
1559  * Change ownership of the given vnode.  At least one of uid or gid must
1560  * be different than VNOVAL.  If one is set to that value, the attribute
1561  * is unchanged.
1562  * Caller should execute tmpfs_update on vp after a successful execution.
1563  * The vnode must be locked on entry and remain locked on exit.
1564  */
1565 int
1566 tmpfs_chown(struct vnode *vp, uid_t uid, gid_t gid, struct ucred *cred,
1567     struct thread *p)
1568 {
1569 	int error;
1570 	struct tmpfs_node *node;
1571 	uid_t ouid;
1572 	gid_t ogid;
1573 
1574 	MPASS(VOP_ISLOCKED(vp));
1575 
1576 	node = VP_TO_TMPFS_NODE(vp);
1577 
1578 	/* Assign default values if they are unknown. */
1579 	MPASS(uid != VNOVAL || gid != VNOVAL);
1580 	if (uid == VNOVAL)
1581 		uid = node->tn_uid;
1582 	if (gid == VNOVAL)
1583 		gid = node->tn_gid;
1584 	MPASS(uid != VNOVAL && gid != VNOVAL);
1585 
1586 	/* Disallow this operation if the file system is mounted read-only. */
1587 	if (vp->v_mount->mnt_flag & MNT_RDONLY)
1588 		return EROFS;
1589 
1590 	/* Immutable or append-only files cannot be modified, either. */
1591 	if (node->tn_flags & (IMMUTABLE | APPEND))
1592 		return EPERM;
1593 
1594 	/*
1595 	 * To modify the ownership of a file, must possess VADMIN for that
1596 	 * file.
1597 	 */
1598 	if ((error = VOP_ACCESS(vp, VADMIN, cred, p)))
1599 		return (error);
1600 
1601 	/*
1602 	 * To change the owner of a file, or change the group of a file to a
1603 	 * group of which we are not a member, the caller must have
1604 	 * privilege.
1605 	 */
1606 	if ((uid != node->tn_uid ||
1607 	    (gid != node->tn_gid && !groupmember(gid, cred))) &&
1608 	    (error = priv_check_cred(cred, PRIV_VFS_CHOWN, 0)))
1609 		return (error);
1610 
1611 	ogid = node->tn_gid;
1612 	ouid = node->tn_uid;
1613 
1614 	node->tn_uid = uid;
1615 	node->tn_gid = gid;
1616 
1617 	node->tn_status |= TMPFS_NODE_CHANGED;
1618 
1619 	if ((node->tn_mode & (S_ISUID | S_ISGID)) && (ouid != uid || ogid != gid)) {
1620 		if (priv_check_cred(cred, PRIV_VFS_RETAINSUGID, 0))
1621 			node->tn_mode &= ~(S_ISUID | S_ISGID);
1622 	}
1623 
1624 	MPASS(VOP_ISLOCKED(vp));
1625 
1626 	return 0;
1627 }
1628 
1629 /*
1630  * Change size of the given vnode.
1631  * Caller should execute tmpfs_update on vp after a successful execution.
1632  * The vnode must be locked on entry and remain locked on exit.
1633  */
1634 int
1635 tmpfs_chsize(struct vnode *vp, u_quad_t size, struct ucred *cred,
1636     struct thread *p)
1637 {
1638 	int error;
1639 	struct tmpfs_node *node;
1640 
1641 	MPASS(VOP_ISLOCKED(vp));
1642 
1643 	node = VP_TO_TMPFS_NODE(vp);
1644 
1645 	/* Decide whether this is a valid operation based on the file type. */
1646 	error = 0;
1647 	switch (vp->v_type) {
1648 	case VDIR:
1649 		return EISDIR;
1650 
1651 	case VREG:
1652 		if (vp->v_mount->mnt_flag & MNT_RDONLY)
1653 			return EROFS;
1654 		break;
1655 
1656 	case VBLK:
1657 		/* FALLTHROUGH */
1658 	case VCHR:
1659 		/* FALLTHROUGH */
1660 	case VFIFO:
1661 		/* Allow modifications of special files even if in the file
1662 		 * system is mounted read-only (we are not modifying the
1663 		 * files themselves, but the objects they represent). */
1664 		return 0;
1665 
1666 	default:
1667 		/* Anything else is unsupported. */
1668 		return EOPNOTSUPP;
1669 	}
1670 
1671 	/* Immutable or append-only files cannot be modified, either. */
1672 	if (node->tn_flags & (IMMUTABLE | APPEND))
1673 		return EPERM;
1674 
1675 	error = tmpfs_truncate(vp, size);
1676 	/* tmpfs_truncate will raise the NOTE_EXTEND and NOTE_ATTRIB kevents
1677 	 * for us, as will update tn_status; no need to do that here. */
1678 
1679 	MPASS(VOP_ISLOCKED(vp));
1680 
1681 	return error;
1682 }
1683 
1684 /*
1685  * Change access and modification times of the given vnode.
1686  * Caller should execute tmpfs_update on vp after a successful execution.
1687  * The vnode must be locked on entry and remain locked on exit.
1688  */
1689 int
1690 tmpfs_chtimes(struct vnode *vp, struct vattr *vap,
1691     struct ucred *cred, struct thread *l)
1692 {
1693 	int error;
1694 	struct tmpfs_node *node;
1695 
1696 	MPASS(VOP_ISLOCKED(vp));
1697 
1698 	node = VP_TO_TMPFS_NODE(vp);
1699 
1700 	/* Disallow this operation if the file system is mounted read-only. */
1701 	if (vp->v_mount->mnt_flag & MNT_RDONLY)
1702 		return EROFS;
1703 
1704 	/* Immutable or append-only files cannot be modified, either. */
1705 	if (node->tn_flags & (IMMUTABLE | APPEND))
1706 		return EPERM;
1707 
1708 	error = vn_utimes_perm(vp, vap, cred, l);
1709 	if (error != 0)
1710 		return (error);
1711 
1712 	if (vap->va_atime.tv_sec != VNOVAL && vap->va_atime.tv_nsec != VNOVAL)
1713 		node->tn_status |= TMPFS_NODE_ACCESSED;
1714 
1715 	if (vap->va_mtime.tv_sec != VNOVAL && vap->va_mtime.tv_nsec != VNOVAL)
1716 		node->tn_status |= TMPFS_NODE_MODIFIED;
1717 
1718 	if (vap->va_birthtime.tv_nsec != VNOVAL &&
1719 	    vap->va_birthtime.tv_nsec != VNOVAL)
1720 		node->tn_status |= TMPFS_NODE_MODIFIED;
1721 
1722 	tmpfs_itimes(vp, &vap->va_atime, &vap->va_mtime);
1723 
1724 	if (vap->va_birthtime.tv_nsec != VNOVAL &&
1725 	    vap->va_birthtime.tv_nsec != VNOVAL)
1726 		node->tn_birthtime = vap->va_birthtime;
1727 	MPASS(VOP_ISLOCKED(vp));
1728 
1729 	return 0;
1730 }
1731 
1732 /* Sync timestamps */
1733 void
1734 tmpfs_itimes(struct vnode *vp, const struct timespec *acc,
1735     const struct timespec *mod)
1736 {
1737 	struct tmpfs_node *node;
1738 	struct timespec now;
1739 
1740 	node = VP_TO_TMPFS_NODE(vp);
1741 
1742 	if ((node->tn_status & (TMPFS_NODE_ACCESSED | TMPFS_NODE_MODIFIED |
1743 	    TMPFS_NODE_CHANGED)) == 0)
1744 		return;
1745 
1746 	vfs_timestamp(&now);
1747 	if (node->tn_status & TMPFS_NODE_ACCESSED) {
1748 		if (acc == NULL)
1749 			 acc = &now;
1750 		node->tn_atime = *acc;
1751 	}
1752 	if (node->tn_status & TMPFS_NODE_MODIFIED) {
1753 		if (mod == NULL)
1754 			mod = &now;
1755 		node->tn_mtime = *mod;
1756 	}
1757 	if (node->tn_status & TMPFS_NODE_CHANGED) {
1758 		node->tn_ctime = now;
1759 	}
1760 	node->tn_status &=
1761 	    ~(TMPFS_NODE_ACCESSED | TMPFS_NODE_MODIFIED | TMPFS_NODE_CHANGED);
1762 }
1763 
1764 void
1765 tmpfs_update(struct vnode *vp)
1766 {
1767 
1768 	tmpfs_itimes(vp, NULL, NULL);
1769 }
1770 
1771 int
1772 tmpfs_truncate(struct vnode *vp, off_t length)
1773 {
1774 	int error;
1775 	struct tmpfs_node *node;
1776 
1777 	node = VP_TO_TMPFS_NODE(vp);
1778 
1779 	if (length < 0) {
1780 		error = EINVAL;
1781 		goto out;
1782 	}
1783 
1784 	if (node->tn_size == length) {
1785 		error = 0;
1786 		goto out;
1787 	}
1788 
1789 	if (length > VFS_TO_TMPFS(vp->v_mount)->tm_maxfilesize)
1790 		return (EFBIG);
1791 
1792 	error = tmpfs_reg_resize(vp, length, FALSE);
1793 	if (error == 0) {
1794 		node->tn_status |= TMPFS_NODE_CHANGED | TMPFS_NODE_MODIFIED;
1795 	}
1796 
1797 out:
1798 	tmpfs_update(vp);
1799 
1800 	return error;
1801 }
1802 
1803 static __inline int
1804 tmpfs_dirtree_cmp(struct tmpfs_dirent *a, struct tmpfs_dirent *b)
1805 {
1806 	if (a->td_hash > b->td_hash)
1807 		return (1);
1808 	else if (a->td_hash < b->td_hash)
1809 		return (-1);
1810 	return (0);
1811 }
1812 
1813 RB_GENERATE_STATIC(tmpfs_dir, tmpfs_dirent, uh.td_entries, tmpfs_dirtree_cmp);
1814