xref: /freebsd/sys/fs/tmpfs/tmpfs_vnops.c (revision 3c91c65a2b999a8d27e99bcc6493de7cf812c948)
1 /*	$NetBSD: tmpfs_vnops.c,v 1.39 2007/07/23 15:41:01 jmmv Exp $	*/
2 
3 /*-
4  * Copyright (c) 2005, 2006 The NetBSD Foundation, Inc.
5  * All rights reserved.
6  *
7  * This code is derived from software contributed to The NetBSD Foundation
8  * by Julio M. Merino Vidal, developed as part of Google's Summer of Code
9  * 2005 program.
10  *
11  * Redistribution and use in source and binary forms, with or without
12  * modification, are permitted provided that the following conditions
13  * are met:
14  * 1. Redistributions of source code must retain the above copyright
15  *    notice, this list of conditions and the following disclaimer.
16  * 2. Redistributions in binary form must reproduce the above copyright
17  *    notice, this list of conditions and the following disclaimer in the
18  *    documentation and/or other materials provided with the distribution.
19  *
20  * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
21  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
22  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
23  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
24  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
25  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
26  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
27  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
28  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
29  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
30  * POSSIBILITY OF SUCH DAMAGE.
31  */
32 
33 /*
34  * tmpfs vnode interface.
35  */
36 #include <sys/cdefs.h>
37 __FBSDID("$FreeBSD$");
38 
39 #include <sys/param.h>
40 #include <sys/fcntl.h>
41 #include <sys/lockf.h>
42 #include <sys/namei.h>
43 #include <sys/priv.h>
44 #include <sys/proc.h>
45 #include <sys/sched.h>
46 #include <sys/sf_buf.h>
47 #include <sys/stat.h>
48 #include <sys/systm.h>
49 #include <sys/sysctl.h>
50 #include <sys/unistd.h>
51 #include <sys/vnode.h>
52 
53 #include <vm/vm.h>
54 #include <vm/vm_param.h>
55 #include <vm/vm_object.h>
56 #include <vm/vm_page.h>
57 #include <vm/vm_pager.h>
58 
59 #include <fs/tmpfs/tmpfs_vnops.h>
60 #include <fs/tmpfs/tmpfs.h>
61 
62 SYSCTL_DECL(_vfs_tmpfs);
63 
64 static volatile int tmpfs_rename_restarts;
65 SYSCTL_INT(_vfs_tmpfs, OID_AUTO, rename_restarts, CTLFLAG_RD,
66     __DEVOLATILE(int *, &tmpfs_rename_restarts), 0,
67     "Times rename had to restart due to lock contention");
68 
69 /* --------------------------------------------------------------------- */
70 
71 static int
72 tmpfs_lookup(struct vop_cachedlookup_args *v)
73 {
74 	struct vnode *dvp = v->a_dvp;
75 	struct vnode **vpp = v->a_vpp;
76 	struct componentname *cnp = v->a_cnp;
77 
78 	int error;
79 	struct tmpfs_dirent *de;
80 	struct tmpfs_node *dnode;
81 
82 	dnode = VP_TO_TMPFS_DIR(dvp);
83 	*vpp = NULLVP;
84 
85 	/* Check accessibility of requested node as a first step. */
86 	error = VOP_ACCESS(dvp, VEXEC, cnp->cn_cred, cnp->cn_thread);
87 	if (error != 0)
88 		goto out;
89 
90 	/* We cannot be requesting the parent directory of the root node. */
91 	MPASS(IMPLIES(dnode->tn_type == VDIR &&
92 	    dnode->tn_dir.tn_parent == dnode,
93 	    !(cnp->cn_flags & ISDOTDOT)));
94 
95 	TMPFS_ASSERT_LOCKED(dnode);
96 	if (dnode->tn_dir.tn_parent == NULL) {
97 		error = ENOENT;
98 		goto out;
99 	}
100 	if (cnp->cn_flags & ISDOTDOT) {
101 		int ltype = 0;
102 
103 		ltype = VOP_ISLOCKED(dvp);
104 		vhold(dvp);
105 		VOP_UNLOCK(dvp, 0);
106 		/* Allocate a new vnode on the matching entry. */
107 		error = tmpfs_alloc_vp(dvp->v_mount, dnode->tn_dir.tn_parent,
108 		    cnp->cn_lkflags, vpp);
109 
110 		vn_lock(dvp, ltype | LK_RETRY);
111 		vdrop(dvp);
112 	} else if (cnp->cn_namelen == 1 && cnp->cn_nameptr[0] == '.') {
113 		VREF(dvp);
114 		*vpp = dvp;
115 		error = 0;
116 	} else {
117 		de = tmpfs_dir_lookup(dnode, NULL, cnp);
118 		if (de != NULL && de->td_node == NULL)
119 			cnp->cn_flags |= ISWHITEOUT;
120 		if (de == NULL || de->td_node == NULL) {
121 			/* The entry was not found in the directory.
122 			 * This is OK if we are creating or renaming an
123 			 * entry and are working on the last component of
124 			 * the path name. */
125 			if ((cnp->cn_flags & ISLASTCN) &&
126 			    (cnp->cn_nameiop == CREATE || \
127 			    cnp->cn_nameiop == RENAME ||
128 			    (cnp->cn_nameiop == DELETE &&
129 			    cnp->cn_flags & DOWHITEOUT &&
130 			    cnp->cn_flags & ISWHITEOUT))) {
131 				error = VOP_ACCESS(dvp, VWRITE, cnp->cn_cred,
132 				    cnp->cn_thread);
133 				if (error != 0)
134 					goto out;
135 
136 				/* Keep the component name in the buffer for
137 				 * future uses. */
138 				cnp->cn_flags |= SAVENAME;
139 
140 				error = EJUSTRETURN;
141 			} else
142 				error = ENOENT;
143 		} else {
144 			struct tmpfs_node *tnode;
145 
146 			/* The entry was found, so get its associated
147 			 * tmpfs_node. */
148 			tnode = de->td_node;
149 
150 			/* If we are not at the last path component and
151 			 * found a non-directory or non-link entry (which
152 			 * may itself be pointing to a directory), raise
153 			 * an error. */
154 			if ((tnode->tn_type != VDIR &&
155 			    tnode->tn_type != VLNK) &&
156 			    !(cnp->cn_flags & ISLASTCN)) {
157 				error = ENOTDIR;
158 				goto out;
159 			}
160 
161 			/* If we are deleting or renaming the entry, keep
162 			 * track of its tmpfs_dirent so that it can be
163 			 * easily deleted later. */
164 			if ((cnp->cn_flags & ISLASTCN) &&
165 			    (cnp->cn_nameiop == DELETE ||
166 			    cnp->cn_nameiop == RENAME)) {
167 				error = VOP_ACCESS(dvp, VWRITE, cnp->cn_cred,
168 				    cnp->cn_thread);
169 				if (error != 0)
170 					goto out;
171 
172 				/* Allocate a new vnode on the matching entry. */
173 				error = tmpfs_alloc_vp(dvp->v_mount, tnode,
174 						cnp->cn_lkflags, vpp);
175 				if (error != 0)
176 					goto out;
177 
178 				if ((dnode->tn_mode & S_ISTXT) &&
179 				  VOP_ACCESS(dvp, VADMIN, cnp->cn_cred, cnp->cn_thread) &&
180 				  VOP_ACCESS(*vpp, VADMIN, cnp->cn_cred, cnp->cn_thread)) {
181 					error = EPERM;
182 					vput(*vpp);
183 					*vpp = NULL;
184 					goto out;
185 				}
186 				cnp->cn_flags |= SAVENAME;
187 			} else {
188 				error = tmpfs_alloc_vp(dvp->v_mount, tnode,
189 						cnp->cn_lkflags, vpp);
190 			}
191 		}
192 	}
193 
194 	/* Store the result of this lookup in the cache.  Avoid this if the
195 	 * request was for creation, as it does not improve timings on
196 	 * emprical tests. */
197 	if ((cnp->cn_flags & MAKEENTRY) && cnp->cn_nameiop != CREATE)
198 		cache_enter(dvp, *vpp, cnp);
199 
200 out:
201 	/* If there were no errors, *vpp cannot be null and it must be
202 	 * locked. */
203 	MPASS(IFF(error == 0, *vpp != NULLVP && VOP_ISLOCKED(*vpp)));
204 
205 	return error;
206 }
207 
208 /* --------------------------------------------------------------------- */
209 
210 static int
211 tmpfs_create(struct vop_create_args *v)
212 {
213 	struct vnode *dvp = v->a_dvp;
214 	struct vnode **vpp = v->a_vpp;
215 	struct componentname *cnp = v->a_cnp;
216 	struct vattr *vap = v->a_vap;
217 
218 	MPASS(vap->va_type == VREG || vap->va_type == VSOCK);
219 
220 	return tmpfs_alloc_file(dvp, vpp, vap, cnp, NULL);
221 }
222 /* --------------------------------------------------------------------- */
223 
224 static int
225 tmpfs_mknod(struct vop_mknod_args *v)
226 {
227 	struct vnode *dvp = v->a_dvp;
228 	struct vnode **vpp = v->a_vpp;
229 	struct componentname *cnp = v->a_cnp;
230 	struct vattr *vap = v->a_vap;
231 
232 	if (vap->va_type != VBLK && vap->va_type != VCHR &&
233 	    vap->va_type != VFIFO)
234 		return EINVAL;
235 
236 	return tmpfs_alloc_file(dvp, vpp, vap, cnp, NULL);
237 }
238 
239 /* --------------------------------------------------------------------- */
240 
241 static int
242 tmpfs_open(struct vop_open_args *v)
243 {
244 	struct vnode *vp = v->a_vp;
245 	int mode = v->a_mode;
246 
247 	int error;
248 	struct tmpfs_node *node;
249 
250 	MPASS(VOP_ISLOCKED(vp));
251 
252 	node = VP_TO_TMPFS_NODE(vp);
253 
254 	/* The file is still active but all its names have been removed
255 	 * (e.g. by a "rmdir $(pwd)").  It cannot be opened any more as
256 	 * it is about to die. */
257 	if (node->tn_links < 1)
258 		return (ENOENT);
259 
260 	/* If the file is marked append-only, deny write requests. */
261 	if (node->tn_flags & APPEND && (mode & (FWRITE | O_APPEND)) == FWRITE)
262 		error = EPERM;
263 	else {
264 		error = 0;
265 		vnode_create_vobject(vp, node->tn_size, v->a_td);
266 	}
267 
268 	MPASS(VOP_ISLOCKED(vp));
269 	return error;
270 }
271 
272 /* --------------------------------------------------------------------- */
273 
274 static int
275 tmpfs_close(struct vop_close_args *v)
276 {
277 	struct vnode *vp = v->a_vp;
278 
279 	MPASS(VOP_ISLOCKED(vp));
280 
281 	/* Update node times. */
282 	tmpfs_update(vp);
283 
284 	return (0);
285 }
286 
287 /* --------------------------------------------------------------------- */
288 
289 int
290 tmpfs_access(struct vop_access_args *v)
291 {
292 	struct vnode *vp = v->a_vp;
293 	accmode_t accmode = v->a_accmode;
294 	struct ucred *cred = v->a_cred;
295 
296 	int error;
297 	struct tmpfs_node *node;
298 
299 	MPASS(VOP_ISLOCKED(vp));
300 
301 	node = VP_TO_TMPFS_NODE(vp);
302 
303 	switch (vp->v_type) {
304 	case VDIR:
305 		/* FALLTHROUGH */
306 	case VLNK:
307 		/* FALLTHROUGH */
308 	case VREG:
309 		if (accmode & VWRITE && vp->v_mount->mnt_flag & MNT_RDONLY) {
310 			error = EROFS;
311 			goto out;
312 		}
313 		break;
314 
315 	case VBLK:
316 		/* FALLTHROUGH */
317 	case VCHR:
318 		/* FALLTHROUGH */
319 	case VSOCK:
320 		/* FALLTHROUGH */
321 	case VFIFO:
322 		break;
323 
324 	default:
325 		error = EINVAL;
326 		goto out;
327 	}
328 
329 	if (accmode & VWRITE && node->tn_flags & IMMUTABLE) {
330 		error = EPERM;
331 		goto out;
332 	}
333 
334 	error = vaccess(vp->v_type, node->tn_mode, node->tn_uid,
335 	    node->tn_gid, accmode, cred, NULL);
336 
337 out:
338 	MPASS(VOP_ISLOCKED(vp));
339 
340 	return error;
341 }
342 
343 /* --------------------------------------------------------------------- */
344 
345 int
346 tmpfs_getattr(struct vop_getattr_args *v)
347 {
348 	struct vnode *vp = v->a_vp;
349 	struct vattr *vap = v->a_vap;
350 
351 	struct tmpfs_node *node;
352 
353 	node = VP_TO_TMPFS_NODE(vp);
354 
355 	tmpfs_update(vp);
356 
357 	vap->va_type = vp->v_type;
358 	vap->va_mode = node->tn_mode;
359 	vap->va_nlink = node->tn_links;
360 	vap->va_uid = node->tn_uid;
361 	vap->va_gid = node->tn_gid;
362 	vap->va_fsid = vp->v_mount->mnt_stat.f_fsid.val[0];
363 	vap->va_fileid = node->tn_id;
364 	vap->va_size = node->tn_size;
365 	vap->va_blocksize = PAGE_SIZE;
366 	vap->va_atime = node->tn_atime;
367 	vap->va_mtime = node->tn_mtime;
368 	vap->va_ctime = node->tn_ctime;
369 	vap->va_birthtime = node->tn_birthtime;
370 	vap->va_gen = node->tn_gen;
371 	vap->va_flags = node->tn_flags;
372 	vap->va_rdev = (vp->v_type == VBLK || vp->v_type == VCHR) ?
373 		node->tn_rdev : NODEV;
374 	vap->va_bytes = round_page(node->tn_size);
375 	vap->va_filerev = 0;
376 
377 	return 0;
378 }
379 
380 /* --------------------------------------------------------------------- */
381 
382 /* XXX Should this operation be atomic?  I think it should, but code in
383  * XXX other places (e.g., ufs) doesn't seem to be... */
384 int
385 tmpfs_setattr(struct vop_setattr_args *v)
386 {
387 	struct vnode *vp = v->a_vp;
388 	struct vattr *vap = v->a_vap;
389 	struct ucred *cred = v->a_cred;
390 	struct thread *td = curthread;
391 
392 	int error;
393 
394 	MPASS(VOP_ISLOCKED(vp));
395 
396 	error = 0;
397 
398 	/* Abort if any unsettable attribute is given. */
399 	if (vap->va_type != VNON ||
400 	    vap->va_nlink != VNOVAL ||
401 	    vap->va_fsid != VNOVAL ||
402 	    vap->va_fileid != VNOVAL ||
403 	    vap->va_blocksize != VNOVAL ||
404 	    vap->va_gen != VNOVAL ||
405 	    vap->va_rdev != VNOVAL ||
406 	    vap->va_bytes != VNOVAL)
407 		error = EINVAL;
408 
409 	if (error == 0 && (vap->va_flags != VNOVAL))
410 		error = tmpfs_chflags(vp, vap->va_flags, cred, td);
411 
412 	if (error == 0 && (vap->va_size != VNOVAL))
413 		error = tmpfs_chsize(vp, vap->va_size, cred, td);
414 
415 	if (error == 0 && (vap->va_uid != VNOVAL || vap->va_gid != VNOVAL))
416 		error = tmpfs_chown(vp, vap->va_uid, vap->va_gid, cred, td);
417 
418 	if (error == 0 && (vap->va_mode != (mode_t)VNOVAL))
419 		error = tmpfs_chmod(vp, vap->va_mode, cred, td);
420 
421 	if (error == 0 && ((vap->va_atime.tv_sec != VNOVAL &&
422 	    vap->va_atime.tv_nsec != VNOVAL) ||
423 	    (vap->va_mtime.tv_sec != VNOVAL &&
424 	    vap->va_mtime.tv_nsec != VNOVAL) ||
425 	    (vap->va_birthtime.tv_sec != VNOVAL &&
426 	    vap->va_birthtime.tv_nsec != VNOVAL)))
427 		error = tmpfs_chtimes(vp, &vap->va_atime, &vap->va_mtime,
428 			&vap->va_birthtime, vap->va_vaflags, cred, td);
429 
430 	/* Update the node times.  We give preference to the error codes
431 	 * generated by this function rather than the ones that may arise
432 	 * from tmpfs_update. */
433 	tmpfs_update(vp);
434 
435 	MPASS(VOP_ISLOCKED(vp));
436 
437 	return error;
438 }
439 
440 /* --------------------------------------------------------------------- */
441 static int
442 tmpfs_nocacheread(vm_object_t tobj, vm_pindex_t idx,
443     vm_offset_t offset, size_t tlen, struct uio *uio)
444 {
445 	vm_page_t	m;
446 	int		error, rv;
447 
448 	VM_OBJECT_LOCK(tobj);
449 	m = vm_page_grab(tobj, idx, VM_ALLOC_WIRED |
450 	    VM_ALLOC_NORMAL | VM_ALLOC_RETRY);
451 	if (m->valid != VM_PAGE_BITS_ALL) {
452 		if (vm_pager_has_page(tobj, idx, NULL, NULL)) {
453 			rv = vm_pager_get_pages(tobj, &m, 1, 0);
454 			if (rv != VM_PAGER_OK) {
455 				vm_page_lock(m);
456 				vm_page_free(m);
457 				vm_page_unlock(m);
458 				VM_OBJECT_UNLOCK(tobj);
459 				return (EIO);
460 			}
461 		} else
462 			vm_page_zero_invalid(m, TRUE);
463 	}
464 	VM_OBJECT_UNLOCK(tobj);
465 	error = uiomove_fromphys(&m, offset, tlen, uio);
466 	VM_OBJECT_LOCK(tobj);
467 	vm_page_lock(m);
468 	vm_page_unwire(m, TRUE);
469 	vm_page_unlock(m);
470 	vm_page_wakeup(m);
471 	VM_OBJECT_UNLOCK(tobj);
472 
473 	return (error);
474 }
475 
476 static __inline int
477 tmpfs_nocacheread_buf(vm_object_t tobj, vm_pindex_t idx,
478     vm_offset_t offset, size_t tlen, void *buf)
479 {
480 	struct uio uio;
481 	struct iovec iov;
482 
483 	uio.uio_iovcnt = 1;
484 	uio.uio_iov = &iov;
485 	iov.iov_base = buf;
486 	iov.iov_len = tlen;
487 
488 	uio.uio_offset = 0;
489 	uio.uio_resid = tlen;
490 	uio.uio_rw = UIO_READ;
491 	uio.uio_segflg = UIO_SYSSPACE;
492 	uio.uio_td = curthread;
493 
494 	return (tmpfs_nocacheread(tobj, idx, offset, tlen, &uio));
495 }
496 
497 static int
498 tmpfs_mappedread(vm_object_t vobj, vm_object_t tobj, size_t len, struct uio *uio)
499 {
500 	struct sf_buf	*sf;
501 	vm_pindex_t	idx;
502 	vm_page_t	m;
503 	vm_offset_t	offset;
504 	off_t		addr;
505 	size_t		tlen;
506 	char		*ma;
507 	int		error;
508 
509 	addr = uio->uio_offset;
510 	idx = OFF_TO_IDX(addr);
511 	offset = addr & PAGE_MASK;
512 	tlen = MIN(PAGE_SIZE - offset, len);
513 
514 	if ((vobj == NULL) ||
515 	    (vobj->resident_page_count == 0 && vobj->cache == NULL))
516 		goto nocache;
517 
518 	VM_OBJECT_LOCK(vobj);
519 lookupvpg:
520 	if (((m = vm_page_lookup(vobj, idx)) != NULL) &&
521 	    vm_page_is_valid(m, offset, tlen)) {
522 		if ((m->oflags & VPO_BUSY) != 0) {
523 			/*
524 			 * Reference the page before unlocking and sleeping so
525 			 * that the page daemon is less likely to reclaim it.
526 			 */
527 			vm_page_reference(m);
528 			vm_page_sleep(m, "tmfsmr");
529 			goto lookupvpg;
530 		}
531 		vm_page_busy(m);
532 		VM_OBJECT_UNLOCK(vobj);
533 		error = uiomove_fromphys(&m, offset, tlen, uio);
534 		VM_OBJECT_LOCK(vobj);
535 		vm_page_wakeup(m);
536 		VM_OBJECT_UNLOCK(vobj);
537 		return	(error);
538 	} else if (m != NULL && uio->uio_segflg == UIO_NOCOPY) {
539 		KASSERT(offset == 0,
540 		    ("unexpected offset in tmpfs_mappedread for sendfile"));
541 		if ((m->oflags & VPO_BUSY) != 0) {
542 			/*
543 			 * Reference the page before unlocking and sleeping so
544 			 * that the page daemon is less likely to reclaim it.
545 			 */
546 			vm_page_reference(m);
547 			vm_page_sleep(m, "tmfsmr");
548 			goto lookupvpg;
549 		}
550 		vm_page_busy(m);
551 		VM_OBJECT_UNLOCK(vobj);
552 		sched_pin();
553 		sf = sf_buf_alloc(m, SFB_CPUPRIVATE);
554 		ma = (char *)sf_buf_kva(sf);
555 		error = tmpfs_nocacheread_buf(tobj, idx, 0, tlen, ma);
556 		if (error == 0) {
557 			if (tlen != PAGE_SIZE)
558 				bzero(ma + tlen, PAGE_SIZE - tlen);
559 			uio->uio_offset += tlen;
560 			uio->uio_resid -= tlen;
561 		}
562 		sf_buf_free(sf);
563 		sched_unpin();
564 		VM_OBJECT_LOCK(vobj);
565 		if (error == 0)
566 			m->valid = VM_PAGE_BITS_ALL;
567 		vm_page_wakeup(m);
568 		VM_OBJECT_UNLOCK(vobj);
569 		return	(error);
570 	}
571 	VM_OBJECT_UNLOCK(vobj);
572 nocache:
573 	error = tmpfs_nocacheread(tobj, idx, offset, tlen, uio);
574 
575 	return	(error);
576 }
577 
578 static int
579 tmpfs_read(struct vop_read_args *v)
580 {
581 	struct vnode *vp = v->a_vp;
582 	struct uio *uio = v->a_uio;
583 
584 	struct tmpfs_node *node;
585 	vm_object_t uobj;
586 	size_t len;
587 	int resid;
588 
589 	int error = 0;
590 
591 	node = VP_TO_TMPFS_NODE(vp);
592 
593 	if (vp->v_type != VREG) {
594 		error = EISDIR;
595 		goto out;
596 	}
597 
598 	if (uio->uio_offset < 0) {
599 		error = EINVAL;
600 		goto out;
601 	}
602 
603 	node->tn_status |= TMPFS_NODE_ACCESSED;
604 
605 	uobj = node->tn_reg.tn_aobj;
606 	while ((resid = uio->uio_resid) > 0) {
607 		error = 0;
608 		if (node->tn_size <= uio->uio_offset)
609 			break;
610 		len = MIN(node->tn_size - uio->uio_offset, resid);
611 		if (len == 0)
612 			break;
613 		error = tmpfs_mappedread(vp->v_object, uobj, len, uio);
614 		if ((error != 0) || (resid == uio->uio_resid))
615 			break;
616 	}
617 
618 out:
619 
620 	return error;
621 }
622 
623 /* --------------------------------------------------------------------- */
624 
625 static int
626 tmpfs_mappedwrite(vm_object_t vobj, vm_object_t tobj, size_t len, struct uio *uio)
627 {
628 	vm_pindex_t	idx;
629 	vm_page_t	vpg, tpg;
630 	vm_offset_t	offset;
631 	off_t		addr;
632 	size_t		tlen;
633 	int		error, rv;
634 
635 	error = 0;
636 
637 	addr = uio->uio_offset;
638 	idx = OFF_TO_IDX(addr);
639 	offset = addr & PAGE_MASK;
640 	tlen = MIN(PAGE_SIZE - offset, len);
641 
642 	if ((vobj == NULL) ||
643 	    (vobj->resident_page_count == 0 && vobj->cache == NULL)) {
644 		vpg = NULL;
645 		goto nocache;
646 	}
647 
648 	VM_OBJECT_LOCK(vobj);
649 lookupvpg:
650 	if (((vpg = vm_page_lookup(vobj, idx)) != NULL) &&
651 	    vm_page_is_valid(vpg, offset, tlen)) {
652 		if ((vpg->oflags & VPO_BUSY) != 0) {
653 			/*
654 			 * Reference the page before unlocking and sleeping so
655 			 * that the page daemon is less likely to reclaim it.
656 			 */
657 			vm_page_reference(vpg);
658 			vm_page_sleep(vpg, "tmfsmw");
659 			goto lookupvpg;
660 		}
661 		vm_page_busy(vpg);
662 		vm_page_undirty(vpg);
663 		VM_OBJECT_UNLOCK(vobj);
664 		error = uiomove_fromphys(&vpg, offset, tlen, uio);
665 	} else {
666 		if (vm_page_is_cached(vobj, idx))
667 			vm_page_cache_free(vobj, idx, idx + 1);
668 		VM_OBJECT_UNLOCK(vobj);
669 		vpg = NULL;
670 	}
671 nocache:
672 	VM_OBJECT_LOCK(tobj);
673 	tpg = vm_page_grab(tobj, idx, VM_ALLOC_WIRED |
674 	    VM_ALLOC_NORMAL | VM_ALLOC_RETRY);
675 	if (tpg->valid != VM_PAGE_BITS_ALL) {
676 		if (vm_pager_has_page(tobj, idx, NULL, NULL)) {
677 			rv = vm_pager_get_pages(tobj, &tpg, 1, 0);
678 			if (rv != VM_PAGER_OK) {
679 				vm_page_lock(tpg);
680 				vm_page_free(tpg);
681 				vm_page_unlock(tpg);
682 				error = EIO;
683 				goto out;
684 			}
685 		} else
686 			vm_page_zero_invalid(tpg, TRUE);
687 	}
688 	VM_OBJECT_UNLOCK(tobj);
689 	if (vpg == NULL)
690 		error = uiomove_fromphys(&tpg, offset, tlen, uio);
691 	else {
692 		KASSERT(vpg->valid == VM_PAGE_BITS_ALL, ("parts of vpg invalid"));
693 		pmap_copy_page(vpg, tpg);
694 	}
695 	VM_OBJECT_LOCK(tobj);
696 	if (error == 0) {
697 		KASSERT(tpg->valid == VM_PAGE_BITS_ALL,
698 		    ("parts of tpg invalid"));
699 		vm_page_dirty(tpg);
700 	}
701 	vm_page_lock(tpg);
702 	vm_page_unwire(tpg, TRUE);
703 	vm_page_unlock(tpg);
704 	vm_page_wakeup(tpg);
705 out:
706 	VM_OBJECT_UNLOCK(tobj);
707 	if (vpg != NULL) {
708 		VM_OBJECT_LOCK(vobj);
709 		vm_page_wakeup(vpg);
710 		VM_OBJECT_UNLOCK(vobj);
711 	}
712 
713 	return	(error);
714 }
715 
716 static int
717 tmpfs_write(struct vop_write_args *v)
718 {
719 	struct vnode *vp = v->a_vp;
720 	struct uio *uio = v->a_uio;
721 	int ioflag = v->a_ioflag;
722 
723 	boolean_t extended;
724 	int error = 0;
725 	off_t oldsize;
726 	struct tmpfs_node *node;
727 	vm_object_t uobj;
728 	size_t len;
729 	int resid;
730 
731 	node = VP_TO_TMPFS_NODE(vp);
732 	oldsize = node->tn_size;
733 
734 	if (uio->uio_offset < 0 || vp->v_type != VREG) {
735 		error = EINVAL;
736 		goto out;
737 	}
738 
739 	if (uio->uio_resid == 0) {
740 		error = 0;
741 		goto out;
742 	}
743 
744 	if (ioflag & IO_APPEND)
745 		uio->uio_offset = node->tn_size;
746 
747 	if (uio->uio_offset + uio->uio_resid >
748 	  VFS_TO_TMPFS(vp->v_mount)->tm_maxfilesize)
749 		return (EFBIG);
750 
751 	if (vn_rlimit_fsize(vp, uio, uio->uio_td))
752 		return (EFBIG);
753 
754 	extended = uio->uio_offset + uio->uio_resid > node->tn_size;
755 	if (extended) {
756 		error = tmpfs_reg_resize(vp, uio->uio_offset + uio->uio_resid,
757 		    FALSE);
758 		if (error != 0)
759 			goto out;
760 	}
761 
762 	uobj = node->tn_reg.tn_aobj;
763 	while ((resid = uio->uio_resid) > 0) {
764 		if (node->tn_size <= uio->uio_offset)
765 			break;
766 		len = MIN(node->tn_size - uio->uio_offset, resid);
767 		if (len == 0)
768 			break;
769 		error = tmpfs_mappedwrite(vp->v_object, uobj, len, uio);
770 		if ((error != 0) || (resid == uio->uio_resid))
771 			break;
772 	}
773 
774 	node->tn_status |= TMPFS_NODE_ACCESSED | TMPFS_NODE_MODIFIED |
775 	    (extended ? TMPFS_NODE_CHANGED : 0);
776 
777 	if (node->tn_mode & (S_ISUID | S_ISGID)) {
778 		if (priv_check_cred(v->a_cred, PRIV_VFS_RETAINSUGID, 0))
779 			node->tn_mode &= ~(S_ISUID | S_ISGID);
780 	}
781 
782 	if (error != 0)
783 		(void)tmpfs_reg_resize(vp, oldsize, TRUE);
784 
785 out:
786 	MPASS(IMPLIES(error == 0, uio->uio_resid == 0));
787 	MPASS(IMPLIES(error != 0, oldsize == node->tn_size));
788 
789 	return error;
790 }
791 
792 /* --------------------------------------------------------------------- */
793 
794 static int
795 tmpfs_fsync(struct vop_fsync_args *v)
796 {
797 	struct vnode *vp = v->a_vp;
798 
799 	MPASS(VOP_ISLOCKED(vp));
800 
801 	tmpfs_update(vp);
802 
803 	return 0;
804 }
805 
806 /* --------------------------------------------------------------------- */
807 
808 static int
809 tmpfs_remove(struct vop_remove_args *v)
810 {
811 	struct vnode *dvp = v->a_dvp;
812 	struct vnode *vp = v->a_vp;
813 
814 	int error;
815 	struct tmpfs_dirent *de;
816 	struct tmpfs_mount *tmp;
817 	struct tmpfs_node *dnode;
818 	struct tmpfs_node *node;
819 
820 	MPASS(VOP_ISLOCKED(dvp));
821 	MPASS(VOP_ISLOCKED(vp));
822 
823 	if (vp->v_type == VDIR) {
824 		error = EISDIR;
825 		goto out;
826 	}
827 
828 	dnode = VP_TO_TMPFS_DIR(dvp);
829 	node = VP_TO_TMPFS_NODE(vp);
830 	tmp = VFS_TO_TMPFS(vp->v_mount);
831 	de = tmpfs_dir_lookup(dnode, node, v->a_cnp);
832 	MPASS(de != NULL);
833 
834 	/* Files marked as immutable or append-only cannot be deleted. */
835 	if ((node->tn_flags & (IMMUTABLE | APPEND | NOUNLINK)) ||
836 	    (dnode->tn_flags & APPEND)) {
837 		error = EPERM;
838 		goto out;
839 	}
840 
841 	/* Remove the entry from the directory; as it is a file, we do not
842 	 * have to change the number of hard links of the directory. */
843 	tmpfs_dir_detach(dvp, de);
844 	if (v->a_cnp->cn_flags & DOWHITEOUT)
845 		tmpfs_dir_whiteout_add(dvp, v->a_cnp);
846 
847 	/* Free the directory entry we just deleted.  Note that the node
848 	 * referred by it will not be removed until the vnode is really
849 	 * reclaimed. */
850 	tmpfs_free_dirent(tmp, de);
851 
852 	node->tn_status |= TMPFS_NODE_ACCESSED | TMPFS_NODE_CHANGED;
853 	error = 0;
854 
855 out:
856 
857 	return error;
858 }
859 
860 /* --------------------------------------------------------------------- */
861 
862 static int
863 tmpfs_link(struct vop_link_args *v)
864 {
865 	struct vnode *dvp = v->a_tdvp;
866 	struct vnode *vp = v->a_vp;
867 	struct componentname *cnp = v->a_cnp;
868 
869 	int error;
870 	struct tmpfs_dirent *de;
871 	struct tmpfs_node *node;
872 
873 	MPASS(VOP_ISLOCKED(dvp));
874 	MPASS(cnp->cn_flags & HASBUF);
875 	MPASS(dvp != vp); /* XXX When can this be false? */
876 
877 	node = VP_TO_TMPFS_NODE(vp);
878 
879 	/* XXX: Why aren't the following two tests done by the caller? */
880 
881 	/* Hard links of directories are forbidden. */
882 	if (vp->v_type == VDIR) {
883 		error = EPERM;
884 		goto out;
885 	}
886 
887 	/* Cannot create cross-device links. */
888 	if (dvp->v_mount != vp->v_mount) {
889 		error = EXDEV;
890 		goto out;
891 	}
892 
893 	/* Ensure that we do not overflow the maximum number of links imposed
894 	 * by the system. */
895 	MPASS(node->tn_links <= LINK_MAX);
896 	if (node->tn_links == LINK_MAX) {
897 		error = EMLINK;
898 		goto out;
899 	}
900 
901 	/* We cannot create links of files marked immutable or append-only. */
902 	if (node->tn_flags & (IMMUTABLE | APPEND)) {
903 		error = EPERM;
904 		goto out;
905 	}
906 
907 	/* Allocate a new directory entry to represent the node. */
908 	error = tmpfs_alloc_dirent(VFS_TO_TMPFS(vp->v_mount), node,
909 	    cnp->cn_nameptr, cnp->cn_namelen, &de);
910 	if (error != 0)
911 		goto out;
912 
913 	/* Insert the new directory entry into the appropriate directory. */
914 	if (cnp->cn_flags & ISWHITEOUT)
915 		tmpfs_dir_whiteout_remove(dvp, cnp);
916 	tmpfs_dir_attach(dvp, de);
917 
918 	/* vp link count has changed, so update node times. */
919 	node->tn_status |= TMPFS_NODE_CHANGED;
920 	tmpfs_update(vp);
921 
922 	error = 0;
923 
924 out:
925 	return error;
926 }
927 
928 /* --------------------------------------------------------------------- */
929 
930 /*
931  * We acquire all but fdvp locks using non-blocking acquisitions.  If we
932  * fail to acquire any lock in the path we will drop all held locks,
933  * acquire the new lock in a blocking fashion, and then release it and
934  * restart the rename.  This acquire/release step ensures that we do not
935  * spin on a lock waiting for release.  On error release all vnode locks
936  * and decrement references the way tmpfs_rename() would do.
937  */
938 static int
939 tmpfs_rename_relock(struct vnode *fdvp, struct vnode **fvpp,
940     struct vnode *tdvp, struct vnode **tvpp,
941     struct componentname *fcnp, struct componentname *tcnp)
942 {
943 	struct vnode *nvp;
944 	struct mount *mp;
945 	struct tmpfs_dirent *de;
946 	int error, restarts = 0;
947 
948 	VOP_UNLOCK(tdvp, 0);
949 	if (*tvpp != NULL && *tvpp != tdvp)
950 		VOP_UNLOCK(*tvpp, 0);
951 	mp = fdvp->v_mount;
952 
953 relock:
954 	restarts += 1;
955 	error = vn_lock(fdvp, LK_EXCLUSIVE);
956 	if (error)
957 		goto releout;
958 	if (vn_lock(tdvp, LK_EXCLUSIVE | LK_NOWAIT) != 0) {
959 		VOP_UNLOCK(fdvp, 0);
960 		error = vn_lock(tdvp, LK_EXCLUSIVE);
961 		if (error)
962 			goto releout;
963 		VOP_UNLOCK(tdvp, 0);
964 		goto relock;
965 	}
966 	/*
967 	 * Re-resolve fvp to be certain it still exists and fetch the
968 	 * correct vnode.
969 	 */
970 	de = tmpfs_dir_lookup(VP_TO_TMPFS_DIR(fdvp), NULL, fcnp);
971 	if (de == NULL) {
972 		VOP_UNLOCK(fdvp, 0);
973 		VOP_UNLOCK(tdvp, 0);
974 		if ((fcnp->cn_flags & ISDOTDOT) != 0 ||
975 		    (fcnp->cn_namelen == 1 && fcnp->cn_nameptr[0] == '.'))
976 			error = EINVAL;
977 		else
978 			error = ENOENT;
979 		goto releout;
980 	}
981 	error = tmpfs_alloc_vp(mp, de->td_node, LK_EXCLUSIVE | LK_NOWAIT, &nvp);
982 	if (error != 0) {
983 		VOP_UNLOCK(fdvp, 0);
984 		VOP_UNLOCK(tdvp, 0);
985 		if (error != EBUSY)
986 			goto releout;
987 		error = tmpfs_alloc_vp(mp, de->td_node, LK_EXCLUSIVE, &nvp);
988 		if (error != 0)
989 			goto releout;
990 		VOP_UNLOCK(nvp, 0);
991 		/*
992 		 * Concurrent rename race.
993 		 */
994 		if (nvp == tdvp) {
995 			vrele(nvp);
996 			error = EINVAL;
997 			goto releout;
998 		}
999 		vrele(*fvpp);
1000 		*fvpp = nvp;
1001 		goto relock;
1002 	}
1003 	vrele(*fvpp);
1004 	*fvpp = nvp;
1005 	VOP_UNLOCK(*fvpp, 0);
1006 	/*
1007 	 * Re-resolve tvp and acquire the vnode lock if present.
1008 	 */
1009 	de = tmpfs_dir_lookup(VP_TO_TMPFS_DIR(tdvp), NULL, tcnp);
1010 	/*
1011 	 * If tvp disappeared we just carry on.
1012 	 */
1013 	if (de == NULL && *tvpp != NULL) {
1014 		vrele(*tvpp);
1015 		*tvpp = NULL;
1016 	}
1017 	/*
1018 	 * Get the tvp ino if the lookup succeeded.  We may have to restart
1019 	 * if the non-blocking acquire fails.
1020 	 */
1021 	if (de != NULL) {
1022 		nvp = NULL;
1023 		error = tmpfs_alloc_vp(mp, de->td_node,
1024 		    LK_EXCLUSIVE | LK_NOWAIT, &nvp);
1025 		if (*tvpp != NULL)
1026 			vrele(*tvpp);
1027 		*tvpp = nvp;
1028 		if (error != 0) {
1029 			VOP_UNLOCK(fdvp, 0);
1030 			VOP_UNLOCK(tdvp, 0);
1031 			if (error != EBUSY)
1032 				goto releout;
1033 			error = tmpfs_alloc_vp(mp, de->td_node, LK_EXCLUSIVE,
1034 			    &nvp);
1035 			if (error != 0)
1036 				goto releout;
1037 			VOP_UNLOCK(nvp, 0);
1038 			/*
1039 			 * fdvp contains fvp, thus tvp (=fdvp) is not empty.
1040 			 */
1041 			if (nvp == fdvp) {
1042 				error = ENOTEMPTY;
1043 				goto releout;
1044 			}
1045 			goto relock;
1046 		}
1047 	}
1048 	tmpfs_rename_restarts += restarts;
1049 
1050 	return (0);
1051 
1052 releout:
1053 	vrele(fdvp);
1054 	vrele(*fvpp);
1055 	vrele(tdvp);
1056 	if (*tvpp != NULL)
1057 		vrele(*tvpp);
1058 	tmpfs_rename_restarts += restarts;
1059 
1060 	return (error);
1061 }
1062 
1063 static int
1064 tmpfs_rename(struct vop_rename_args *v)
1065 {
1066 	struct vnode *fdvp = v->a_fdvp;
1067 	struct vnode *fvp = v->a_fvp;
1068 	struct componentname *fcnp = v->a_fcnp;
1069 	struct vnode *tdvp = v->a_tdvp;
1070 	struct vnode *tvp = v->a_tvp;
1071 	struct componentname *tcnp = v->a_tcnp;
1072 	struct mount *mp = NULL;
1073 
1074 	char *newname;
1075 	int error;
1076 	struct tmpfs_dirent *de;
1077 	struct tmpfs_mount *tmp;
1078 	struct tmpfs_node *fdnode;
1079 	struct tmpfs_node *fnode;
1080 	struct tmpfs_node *tnode;
1081 	struct tmpfs_node *tdnode;
1082 
1083 	MPASS(VOP_ISLOCKED(tdvp));
1084 	MPASS(IMPLIES(tvp != NULL, VOP_ISLOCKED(tvp)));
1085 	MPASS(fcnp->cn_flags & HASBUF);
1086 	MPASS(tcnp->cn_flags & HASBUF);
1087 
1088 	/* Disallow cross-device renames.
1089 	 * XXX Why isn't this done by the caller? */
1090 	if (fvp->v_mount != tdvp->v_mount ||
1091 	    (tvp != NULL && fvp->v_mount != tvp->v_mount)) {
1092 		error = EXDEV;
1093 		goto out;
1094 	}
1095 
1096 	/* If source and target are the same file, there is nothing to do. */
1097 	if (fvp == tvp) {
1098 		error = 0;
1099 		goto out;
1100 	}
1101 
1102 	/* If we need to move the directory between entries, lock the
1103 	 * source so that we can safely operate on it. */
1104 	if (fdvp != tdvp && fdvp != tvp) {
1105 		if (vn_lock(fdvp, LK_EXCLUSIVE | LK_NOWAIT) != 0) {
1106 			mp = tdvp->v_mount;
1107 			error = vfs_busy(mp, 0);
1108 			if (error != 0) {
1109 				mp = NULL;
1110 				goto out;
1111 			}
1112 			error = tmpfs_rename_relock(fdvp, &fvp, tdvp, &tvp,
1113 			    fcnp, tcnp);
1114 			if (error != 0) {
1115 				vfs_unbusy(mp);
1116 				return (error);
1117 			}
1118 			ASSERT_VOP_ELOCKED(fdvp,
1119 			    "tmpfs_rename: fdvp not locked");
1120 			ASSERT_VOP_ELOCKED(tdvp,
1121 			    "tmpfs_rename: tdvp not locked");
1122 			if (tvp != NULL)
1123 				ASSERT_VOP_ELOCKED(tvp,
1124 				    "tmpfs_rename: tvp not locked");
1125 			if (fvp == tvp) {
1126 				error = 0;
1127 				goto out_locked;
1128 			}
1129 		}
1130 	}
1131 
1132 	tmp = VFS_TO_TMPFS(tdvp->v_mount);
1133 	tdnode = VP_TO_TMPFS_DIR(tdvp);
1134 	tnode = (tvp == NULL) ? NULL : VP_TO_TMPFS_NODE(tvp);
1135 	fdnode = VP_TO_TMPFS_DIR(fdvp);
1136 	fnode = VP_TO_TMPFS_NODE(fvp);
1137 	de = tmpfs_dir_lookup(fdnode, fnode, fcnp);
1138 
1139 	/* Entry can disappear before we lock fdvp,
1140 	 * also avoid manipulating '.' and '..' entries. */
1141 	if (de == NULL) {
1142 		if ((fcnp->cn_flags & ISDOTDOT) != 0 ||
1143 		    (fcnp->cn_namelen == 1 && fcnp->cn_nameptr[0] == '.'))
1144 			error = EINVAL;
1145 		else
1146 			error = ENOENT;
1147 		goto out_locked;
1148 	}
1149 	MPASS(de->td_node == fnode);
1150 
1151 	/* If re-naming a directory to another preexisting directory
1152 	 * ensure that the target directory is empty so that its
1153 	 * removal causes no side effects.
1154 	 * Kern_rename gurantees the destination to be a directory
1155 	 * if the source is one. */
1156 	if (tvp != NULL) {
1157 		MPASS(tnode != NULL);
1158 
1159 		if ((tnode->tn_flags & (NOUNLINK | IMMUTABLE | APPEND)) ||
1160 		    (tdnode->tn_flags & (APPEND | IMMUTABLE))) {
1161 			error = EPERM;
1162 			goto out_locked;
1163 		}
1164 
1165 		if (fnode->tn_type == VDIR && tnode->tn_type == VDIR) {
1166 			if (tnode->tn_size > 0) {
1167 				error = ENOTEMPTY;
1168 				goto out_locked;
1169 			}
1170 		} else if (fnode->tn_type == VDIR && tnode->tn_type != VDIR) {
1171 			error = ENOTDIR;
1172 			goto out_locked;
1173 		} else if (fnode->tn_type != VDIR && tnode->tn_type == VDIR) {
1174 			error = EISDIR;
1175 			goto out_locked;
1176 		} else {
1177 			MPASS(fnode->tn_type != VDIR &&
1178 				tnode->tn_type != VDIR);
1179 		}
1180 	}
1181 
1182 	if ((fnode->tn_flags & (NOUNLINK | IMMUTABLE | APPEND))
1183 	    || (fdnode->tn_flags & (APPEND | IMMUTABLE))) {
1184 		error = EPERM;
1185 		goto out_locked;
1186 	}
1187 
1188 	/* Ensure that we have enough memory to hold the new name, if it
1189 	 * has to be changed. */
1190 	if (fcnp->cn_namelen != tcnp->cn_namelen ||
1191 	    bcmp(fcnp->cn_nameptr, tcnp->cn_nameptr, fcnp->cn_namelen) != 0) {
1192 		newname = malloc(tcnp->cn_namelen, M_TMPFSNAME, M_WAITOK);
1193 	} else
1194 		newname = NULL;
1195 
1196 	/* If the node is being moved to another directory, we have to do
1197 	 * the move. */
1198 	if (fdnode != tdnode) {
1199 		/* In case we are moving a directory, we have to adjust its
1200 		 * parent to point to the new parent. */
1201 		if (de->td_node->tn_type == VDIR) {
1202 			struct tmpfs_node *n;
1203 
1204 			/* Ensure the target directory is not a child of the
1205 			 * directory being moved.  Otherwise, we'd end up
1206 			 * with stale nodes. */
1207 			n = tdnode;
1208 			/* TMPFS_LOCK garanties that no nodes are freed while
1209 			 * traversing the list. Nodes can only be marked as
1210 			 * removed: tn_parent == NULL. */
1211 			TMPFS_LOCK(tmp);
1212 			TMPFS_NODE_LOCK(n);
1213 			while (n != n->tn_dir.tn_parent) {
1214 				struct tmpfs_node *parent;
1215 
1216 				if (n == fnode) {
1217 					TMPFS_NODE_UNLOCK(n);
1218 					TMPFS_UNLOCK(tmp);
1219 					error = EINVAL;
1220 					if (newname != NULL)
1221 						    free(newname, M_TMPFSNAME);
1222 					goto out_locked;
1223 				}
1224 				parent = n->tn_dir.tn_parent;
1225 				TMPFS_NODE_UNLOCK(n);
1226 				if (parent == NULL) {
1227 					n = NULL;
1228 					break;
1229 				}
1230 				TMPFS_NODE_LOCK(parent);
1231 				if (parent->tn_dir.tn_parent == NULL) {
1232 					TMPFS_NODE_UNLOCK(parent);
1233 					n = NULL;
1234 					break;
1235 				}
1236 				n = parent;
1237 			}
1238 			TMPFS_UNLOCK(tmp);
1239 			if (n == NULL) {
1240 				error = EINVAL;
1241 				if (newname != NULL)
1242 					    free(newname, M_TMPFSNAME);
1243 				goto out_locked;
1244 			}
1245 			TMPFS_NODE_UNLOCK(n);
1246 
1247 			/* Adjust the parent pointer. */
1248 			TMPFS_VALIDATE_DIR(fnode);
1249 			TMPFS_NODE_LOCK(de->td_node);
1250 			de->td_node->tn_dir.tn_parent = tdnode;
1251 			TMPFS_NODE_UNLOCK(de->td_node);
1252 
1253 			/* As a result of changing the target of the '..'
1254 			 * entry, the link count of the source and target
1255 			 * directories has to be adjusted. */
1256 			TMPFS_NODE_LOCK(tdnode);
1257 			TMPFS_ASSERT_LOCKED(tdnode);
1258 			tdnode->tn_links++;
1259 			TMPFS_NODE_UNLOCK(tdnode);
1260 
1261 			TMPFS_NODE_LOCK(fdnode);
1262 			TMPFS_ASSERT_LOCKED(fdnode);
1263 			fdnode->tn_links--;
1264 			TMPFS_NODE_UNLOCK(fdnode);
1265 		}
1266 	}
1267 
1268 	/* Do the move: just remove the entry from the source directory
1269 	 * and insert it into the target one. */
1270 	tmpfs_dir_detach(fdvp, de);
1271 
1272 	if (fcnp->cn_flags & DOWHITEOUT)
1273 		tmpfs_dir_whiteout_add(fdvp, fcnp);
1274 	if (tcnp->cn_flags & ISWHITEOUT)
1275 		tmpfs_dir_whiteout_remove(tdvp, tcnp);
1276 
1277 	/* If the name has changed, we need to make it effective by changing
1278 	 * it in the directory entry. */
1279 	if (newname != NULL) {
1280 		MPASS(tcnp->cn_namelen <= MAXNAMLEN);
1281 
1282 		free(de->ud.td_name, M_TMPFSNAME);
1283 		de->ud.td_name = newname;
1284 		tmpfs_dirent_init(de, tcnp->cn_nameptr, tcnp->cn_namelen);
1285 
1286 		fnode->tn_status |= TMPFS_NODE_CHANGED;
1287 		tdnode->tn_status |= TMPFS_NODE_MODIFIED;
1288 	}
1289 
1290 	/* If we are overwriting an entry, we have to remove the old one
1291 	 * from the target directory. */
1292 	if (tvp != NULL) {
1293 		struct tmpfs_dirent *tde;
1294 
1295 		/* Remove the old entry from the target directory. */
1296 		tde = tmpfs_dir_lookup(tdnode, tnode, tcnp);
1297 		tmpfs_dir_detach(tdvp, tde);
1298 
1299 		/* Free the directory entry we just deleted.  Note that the
1300 		 * node referred by it will not be removed until the vnode is
1301 		 * really reclaimed. */
1302 		tmpfs_free_dirent(VFS_TO_TMPFS(tvp->v_mount), tde);
1303 	}
1304 
1305 	tmpfs_dir_attach(tdvp, de);
1306 
1307 	cache_purge(fvp);
1308 	if (tvp != NULL)
1309 		cache_purge(tvp);
1310 
1311 	error = 0;
1312 
1313 out_locked:
1314 	if (fdvp != tdvp && fdvp != tvp)
1315 		VOP_UNLOCK(fdvp, 0);
1316 
1317 out:
1318 	/* Release target nodes. */
1319 	/* XXX: I don't understand when tdvp can be the same as tvp, but
1320 	 * other code takes care of this... */
1321 	if (tdvp == tvp)
1322 		vrele(tdvp);
1323 	else
1324 		vput(tdvp);
1325 	if (tvp != NULL)
1326 		vput(tvp);
1327 
1328 	/* Release source nodes. */
1329 	vrele(fdvp);
1330 	vrele(fvp);
1331 
1332 	if (mp != NULL)
1333 		vfs_unbusy(mp);
1334 
1335 	return error;
1336 }
1337 
1338 /* --------------------------------------------------------------------- */
1339 
1340 static int
1341 tmpfs_mkdir(struct vop_mkdir_args *v)
1342 {
1343 	struct vnode *dvp = v->a_dvp;
1344 	struct vnode **vpp = v->a_vpp;
1345 	struct componentname *cnp = v->a_cnp;
1346 	struct vattr *vap = v->a_vap;
1347 
1348 	MPASS(vap->va_type == VDIR);
1349 
1350 	return tmpfs_alloc_file(dvp, vpp, vap, cnp, NULL);
1351 }
1352 
1353 /* --------------------------------------------------------------------- */
1354 
1355 static int
1356 tmpfs_rmdir(struct vop_rmdir_args *v)
1357 {
1358 	struct vnode *dvp = v->a_dvp;
1359 	struct vnode *vp = v->a_vp;
1360 
1361 	int error;
1362 	struct tmpfs_dirent *de;
1363 	struct tmpfs_mount *tmp;
1364 	struct tmpfs_node *dnode;
1365 	struct tmpfs_node *node;
1366 
1367 	MPASS(VOP_ISLOCKED(dvp));
1368 	MPASS(VOP_ISLOCKED(vp));
1369 
1370 	tmp = VFS_TO_TMPFS(dvp->v_mount);
1371 	dnode = VP_TO_TMPFS_DIR(dvp);
1372 	node = VP_TO_TMPFS_DIR(vp);
1373 
1374 	/* Directories with more than two entries ('.' and '..') cannot be
1375 	 * removed. */
1376 	 if (node->tn_size > 0) {
1377 		 error = ENOTEMPTY;
1378 		 goto out;
1379 	 }
1380 
1381 	if ((dnode->tn_flags & APPEND)
1382 	    || (node->tn_flags & (NOUNLINK | IMMUTABLE | APPEND))) {
1383 		error = EPERM;
1384 		goto out;
1385 	}
1386 
1387 	/* This invariant holds only if we are not trying to remove "..".
1388 	  * We checked for that above so this is safe now. */
1389 	MPASS(node->tn_dir.tn_parent == dnode);
1390 
1391 	/* Get the directory entry associated with node (vp).  This was
1392 	 * filled by tmpfs_lookup while looking up the entry. */
1393 	de = tmpfs_dir_lookup(dnode, node, v->a_cnp);
1394 	MPASS(TMPFS_DIRENT_MATCHES(de,
1395 	    v->a_cnp->cn_nameptr,
1396 	    v->a_cnp->cn_namelen));
1397 
1398 	/* Check flags to see if we are allowed to remove the directory. */
1399 	if (dnode->tn_flags & APPEND
1400 		|| node->tn_flags & (NOUNLINK | IMMUTABLE | APPEND)) {
1401 		error = EPERM;
1402 		goto out;
1403 	}
1404 
1405 
1406 	/* Detach the directory entry from the directory (dnode). */
1407 	tmpfs_dir_detach(dvp, de);
1408 	if (v->a_cnp->cn_flags & DOWHITEOUT)
1409 		tmpfs_dir_whiteout_add(dvp, v->a_cnp);
1410 
1411 	/* No vnode should be allocated for this entry from this point */
1412 	TMPFS_NODE_LOCK(node);
1413 	TMPFS_ASSERT_ELOCKED(node);
1414 	node->tn_links--;
1415 	node->tn_dir.tn_parent = NULL;
1416 	node->tn_status |= TMPFS_NODE_ACCESSED | TMPFS_NODE_CHANGED | \
1417 	    TMPFS_NODE_MODIFIED;
1418 
1419 	TMPFS_NODE_UNLOCK(node);
1420 
1421 	TMPFS_NODE_LOCK(dnode);
1422 	TMPFS_ASSERT_ELOCKED(dnode);
1423 	dnode->tn_links--;
1424 	dnode->tn_status |= TMPFS_NODE_ACCESSED | \
1425 	    TMPFS_NODE_CHANGED | TMPFS_NODE_MODIFIED;
1426 	TMPFS_NODE_UNLOCK(dnode);
1427 
1428 	cache_purge(dvp);
1429 	cache_purge(vp);
1430 
1431 	/* Free the directory entry we just deleted.  Note that the node
1432 	 * referred by it will not be removed until the vnode is really
1433 	 * reclaimed. */
1434 	tmpfs_free_dirent(tmp, de);
1435 
1436 	/* Release the deleted vnode (will destroy the node, notify
1437 	 * interested parties and clean it from the cache). */
1438 
1439 	dnode->tn_status |= TMPFS_NODE_CHANGED;
1440 	tmpfs_update(dvp);
1441 
1442 	error = 0;
1443 
1444 out:
1445 	return error;
1446 }
1447 
1448 /* --------------------------------------------------------------------- */
1449 
1450 static int
1451 tmpfs_symlink(struct vop_symlink_args *v)
1452 {
1453 	struct vnode *dvp = v->a_dvp;
1454 	struct vnode **vpp = v->a_vpp;
1455 	struct componentname *cnp = v->a_cnp;
1456 	struct vattr *vap = v->a_vap;
1457 	char *target = v->a_target;
1458 
1459 #ifdef notyet /* XXX FreeBSD BUG: kern_symlink is not setting VLNK */
1460 	MPASS(vap->va_type == VLNK);
1461 #else
1462 	vap->va_type = VLNK;
1463 #endif
1464 
1465 	return tmpfs_alloc_file(dvp, vpp, vap, cnp, target);
1466 }
1467 
1468 /* --------------------------------------------------------------------- */
1469 
1470 static int
1471 tmpfs_readdir(struct vop_readdir_args *v)
1472 {
1473 	struct vnode *vp = v->a_vp;
1474 	struct uio *uio = v->a_uio;
1475 	int *eofflag = v->a_eofflag;
1476 	u_long **cookies = v->a_cookies;
1477 	int *ncookies = v->a_ncookies;
1478 
1479 	int error;
1480 	ssize_t startresid;
1481 	int cnt = 0;
1482 	struct tmpfs_node *node;
1483 
1484 	/* This operation only makes sense on directory nodes. */
1485 	if (vp->v_type != VDIR)
1486 		return ENOTDIR;
1487 
1488 	node = VP_TO_TMPFS_DIR(vp);
1489 
1490 	startresid = uio->uio_resid;
1491 
1492 	if (cookies != NULL && ncookies != NULL) {
1493 		cnt = howmany(node->tn_size, sizeof(struct tmpfs_dirent)) + 2;
1494 		*cookies = malloc(cnt * sizeof(**cookies), M_TEMP, M_WAITOK);
1495 		*ncookies = 0;
1496 	}
1497 
1498 	if (cnt == 0)
1499 		error = tmpfs_dir_getdents(node, uio, 0, NULL, NULL);
1500 	else
1501 		error = tmpfs_dir_getdents(node, uio, cnt, *cookies, ncookies);
1502 
1503 	if (error == EJUSTRETURN)
1504 		error = (uio->uio_resid != startresid) ? 0 : EINVAL;
1505 
1506 	if (error != 0 && cnt != 0)
1507 		free(*cookies, M_TEMP);
1508 
1509 	if (eofflag != NULL)
1510 		*eofflag =
1511 		    (error == 0 && uio->uio_offset == TMPFS_DIRCOOKIE_EOF);
1512 
1513 	return error;
1514 }
1515 
1516 /* --------------------------------------------------------------------- */
1517 
1518 static int
1519 tmpfs_readlink(struct vop_readlink_args *v)
1520 {
1521 	struct vnode *vp = v->a_vp;
1522 	struct uio *uio = v->a_uio;
1523 
1524 	int error;
1525 	struct tmpfs_node *node;
1526 
1527 	MPASS(uio->uio_offset == 0);
1528 	MPASS(vp->v_type == VLNK);
1529 
1530 	node = VP_TO_TMPFS_NODE(vp);
1531 
1532 	error = uiomove(node->tn_link, MIN(node->tn_size, uio->uio_resid),
1533 	    uio);
1534 	node->tn_status |= TMPFS_NODE_ACCESSED;
1535 
1536 	return error;
1537 }
1538 
1539 /* --------------------------------------------------------------------- */
1540 
1541 static int
1542 tmpfs_inactive(struct vop_inactive_args *v)
1543 {
1544 	struct vnode *vp = v->a_vp;
1545 
1546 	struct tmpfs_node *node;
1547 
1548 	MPASS(VOP_ISLOCKED(vp));
1549 
1550 	node = VP_TO_TMPFS_NODE(vp);
1551 
1552 	if (node->tn_links == 0)
1553 		vrecycle(vp);
1554 
1555 	return 0;
1556 }
1557 
1558 /* --------------------------------------------------------------------- */
1559 
1560 int
1561 tmpfs_reclaim(struct vop_reclaim_args *v)
1562 {
1563 	struct vnode *vp = v->a_vp;
1564 
1565 	struct tmpfs_mount *tmp;
1566 	struct tmpfs_node *node;
1567 
1568 	node = VP_TO_TMPFS_NODE(vp);
1569 	tmp = VFS_TO_TMPFS(vp->v_mount);
1570 
1571 	vnode_destroy_vobject(vp);
1572 	cache_purge(vp);
1573 
1574 	TMPFS_NODE_LOCK(node);
1575 	TMPFS_ASSERT_ELOCKED(node);
1576 	tmpfs_free_vp(vp);
1577 
1578 	/* If the node referenced by this vnode was deleted by the user,
1579 	 * we must free its associated data structures (now that the vnode
1580 	 * is being reclaimed). */
1581 	if (node->tn_links == 0 &&
1582 	    (node->tn_vpstate & TMPFS_VNODE_ALLOCATING) == 0) {
1583 		node->tn_vpstate = TMPFS_VNODE_DOOMED;
1584 		TMPFS_NODE_UNLOCK(node);
1585 		tmpfs_free_node(tmp, node);
1586 	} else
1587 		TMPFS_NODE_UNLOCK(node);
1588 
1589 	MPASS(vp->v_data == NULL);
1590 	return 0;
1591 }
1592 
1593 /* --------------------------------------------------------------------- */
1594 
1595 static int
1596 tmpfs_print(struct vop_print_args *v)
1597 {
1598 	struct vnode *vp = v->a_vp;
1599 
1600 	struct tmpfs_node *node;
1601 
1602 	node = VP_TO_TMPFS_NODE(vp);
1603 
1604 	printf("tag VT_TMPFS, tmpfs_node %p, flags 0x%x, links %d\n",
1605 	    node, node->tn_flags, node->tn_links);
1606 	printf("\tmode 0%o, owner %d, group %d, size %jd, status 0x%x\n",
1607 	    node->tn_mode, node->tn_uid, node->tn_gid,
1608 	    (intmax_t)node->tn_size, node->tn_status);
1609 
1610 	if (vp->v_type == VFIFO)
1611 		fifo_printinfo(vp);
1612 
1613 	printf("\n");
1614 
1615 	return 0;
1616 }
1617 
1618 /* --------------------------------------------------------------------- */
1619 
1620 static int
1621 tmpfs_pathconf(struct vop_pathconf_args *v)
1622 {
1623 	int name = v->a_name;
1624 	register_t *retval = v->a_retval;
1625 
1626 	int error;
1627 
1628 	error = 0;
1629 
1630 	switch (name) {
1631 	case _PC_LINK_MAX:
1632 		*retval = LINK_MAX;
1633 		break;
1634 
1635 	case _PC_NAME_MAX:
1636 		*retval = NAME_MAX;
1637 		break;
1638 
1639 	case _PC_PATH_MAX:
1640 		*retval = PATH_MAX;
1641 		break;
1642 
1643 	case _PC_PIPE_BUF:
1644 		*retval = PIPE_BUF;
1645 		break;
1646 
1647 	case _PC_CHOWN_RESTRICTED:
1648 		*retval = 1;
1649 		break;
1650 
1651 	case _PC_NO_TRUNC:
1652 		*retval = 1;
1653 		break;
1654 
1655 	case _PC_SYNC_IO:
1656 		*retval = 1;
1657 		break;
1658 
1659 	case _PC_FILESIZEBITS:
1660 		*retval = 0; /* XXX Don't know which value should I return. */
1661 		break;
1662 
1663 	default:
1664 		error = EINVAL;
1665 	}
1666 
1667 	return error;
1668 }
1669 
1670 static int
1671 tmpfs_vptofh(struct vop_vptofh_args *ap)
1672 {
1673 	struct tmpfs_fid *tfhp;
1674 	struct tmpfs_node *node;
1675 
1676 	tfhp = (struct tmpfs_fid *)ap->a_fhp;
1677 	node = VP_TO_TMPFS_NODE(ap->a_vp);
1678 
1679 	tfhp->tf_len = sizeof(struct tmpfs_fid);
1680 	tfhp->tf_id = node->tn_id;
1681 	tfhp->tf_gen = node->tn_gen;
1682 
1683 	return (0);
1684 }
1685 
1686 static int
1687 tmpfs_whiteout(struct vop_whiteout_args *ap)
1688 {
1689 	struct vnode *dvp = ap->a_dvp;
1690 	struct componentname *cnp = ap->a_cnp;
1691 	struct tmpfs_dirent *de;
1692 
1693 	switch (ap->a_flags) {
1694 	case LOOKUP:
1695 		return (0);
1696 	case CREATE:
1697 		de = tmpfs_dir_lookup(VP_TO_TMPFS_DIR(dvp), NULL, cnp);
1698 		if (de != NULL)
1699 			return (de->td_node == NULL ? 0 : EEXIST);
1700 		return (tmpfs_dir_whiteout_add(dvp, cnp));
1701 	case DELETE:
1702 		tmpfs_dir_whiteout_remove(dvp, cnp);
1703 		return (0);
1704 	default:
1705 		panic("tmpfs_whiteout: unknown op");
1706 	}
1707 }
1708 
1709 /* --------------------------------------------------------------------- */
1710 
1711 /*
1712  * vnode operations vector used for files stored in a tmpfs file system.
1713  */
1714 struct vop_vector tmpfs_vnodeop_entries = {
1715 	.vop_default =			&default_vnodeops,
1716 	.vop_lookup =			vfs_cache_lookup,
1717 	.vop_cachedlookup =		tmpfs_lookup,
1718 	.vop_create =			tmpfs_create,
1719 	.vop_mknod =			tmpfs_mknod,
1720 	.vop_open =			tmpfs_open,
1721 	.vop_close =			tmpfs_close,
1722 	.vop_access =			tmpfs_access,
1723 	.vop_getattr =			tmpfs_getattr,
1724 	.vop_setattr =			tmpfs_setattr,
1725 	.vop_read =			tmpfs_read,
1726 	.vop_write =			tmpfs_write,
1727 	.vop_fsync =			tmpfs_fsync,
1728 	.vop_remove =			tmpfs_remove,
1729 	.vop_link =			tmpfs_link,
1730 	.vop_rename =			tmpfs_rename,
1731 	.vop_mkdir =			tmpfs_mkdir,
1732 	.vop_rmdir =			tmpfs_rmdir,
1733 	.vop_symlink =			tmpfs_symlink,
1734 	.vop_readdir =			tmpfs_readdir,
1735 	.vop_readlink =			tmpfs_readlink,
1736 	.vop_inactive =			tmpfs_inactive,
1737 	.vop_reclaim =			tmpfs_reclaim,
1738 	.vop_print =			tmpfs_print,
1739 	.vop_pathconf =			tmpfs_pathconf,
1740 	.vop_vptofh =			tmpfs_vptofh,
1741 	.vop_whiteout =			tmpfs_whiteout,
1742 	.vop_bmap =			VOP_EOPNOTSUPP,
1743 };
1744 
1745