xref: /freebsd/sys/fs/tmpfs/tmpfs_vnops.c (revision 5b5b7e2ca2fa9a2418dd51749f4ef6f881ae7179)
1 /*	$NetBSD: tmpfs_vnops.c,v 1.39 2007/07/23 15:41:01 jmmv Exp $	*/
2 
3 /*-
4  * SPDX-License-Identifier: BSD-2-Clause-NetBSD
5  *
6  * Copyright (c) 2005, 2006 The NetBSD Foundation, Inc.
7  * All rights reserved.
8  *
9  * This code is derived from software contributed to The NetBSD Foundation
10  * by Julio M. Merino Vidal, developed as part of Google's Summer of Code
11  * 2005 program.
12  *
13  * Redistribution and use in source and binary forms, with or without
14  * modification, are permitted provided that the following conditions
15  * are met:
16  * 1. Redistributions of source code must retain the above copyright
17  *    notice, this list of conditions and the following disclaimer.
18  * 2. Redistributions in binary form must reproduce the above copyright
19  *    notice, this list of conditions and the following disclaimer in the
20  *    documentation and/or other materials provided with the distribution.
21  *
22  * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
23  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
24  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
25  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
26  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
27  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
28  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
29  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
30  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
31  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
32  * POSSIBILITY OF SUCH DAMAGE.
33  */
34 
35 /*
36  * tmpfs vnode interface.
37  */
38 #include <sys/cdefs.h>
39 __FBSDID("$FreeBSD$");
40 
41 #include <sys/param.h>
42 #include <sys/systm.h>
43 #include <sys/dirent.h>
44 #include <sys/fcntl.h>
45 #include <sys/file.h>
46 #include <sys/limits.h>
47 #include <sys/lockf.h>
48 #include <sys/lock.h>
49 #include <sys/mount.h>
50 #include <sys/namei.h>
51 #include <sys/priv.h>
52 #include <sys/proc.h>
53 #include <sys/rwlock.h>
54 #include <sys/sched.h>
55 #include <sys/stat.h>
56 #include <sys/sysctl.h>
57 #include <sys/unistd.h>
58 #include <sys/vnode.h>
59 #include <sys/smr.h>
60 #include <security/audit/audit.h>
61 #include <security/mac/mac_framework.h>
62 
63 #include <vm/vm.h>
64 #include <vm/vm_param.h>
65 #include <vm/vm_object.h>
66 
67 #include <fs/tmpfs/tmpfs_vnops.h>
68 #include <fs/tmpfs/tmpfs.h>
69 
70 SYSCTL_DECL(_vfs_tmpfs);
71 VFS_SMR_DECLARE;
72 
73 static volatile int tmpfs_rename_restarts;
74 SYSCTL_INT(_vfs_tmpfs, OID_AUTO, rename_restarts, CTLFLAG_RD,
75     __DEVOLATILE(int *, &tmpfs_rename_restarts), 0,
76     "Times rename had to restart due to lock contention");
77 
78 static int
79 tmpfs_vn_get_ino_alloc(struct mount *mp, void *arg, int lkflags,
80     struct vnode **rvp)
81 {
82 
83 	return (tmpfs_alloc_vp(mp, arg, lkflags, rvp));
84 }
85 
86 static int
87 tmpfs_lookup1(struct vnode *dvp, struct vnode **vpp, struct componentname *cnp)
88 {
89 	struct tmpfs_dirent *de;
90 	struct tmpfs_node *dnode, *pnode;
91 	struct tmpfs_mount *tm;
92 	int error;
93 
94 	/* Caller assumes responsibility for ensuring access (VEXEC). */
95 	dnode = VP_TO_TMPFS_DIR(dvp);
96 	*vpp = NULLVP;
97 
98 	/* We cannot be requesting the parent directory of the root node. */
99 	MPASS(IMPLIES(dnode->tn_type == VDIR &&
100 	    dnode->tn_dir.tn_parent == dnode,
101 	    !(cnp->cn_flags & ISDOTDOT)));
102 
103 	TMPFS_ASSERT_LOCKED(dnode);
104 	if (dnode->tn_dir.tn_parent == NULL) {
105 		error = ENOENT;
106 		goto out;
107 	}
108 	if (cnp->cn_flags & ISDOTDOT) {
109 		tm = VFS_TO_TMPFS(dvp->v_mount);
110 		pnode = dnode->tn_dir.tn_parent;
111 		tmpfs_ref_node(pnode);
112 		error = vn_vget_ino_gen(dvp, tmpfs_vn_get_ino_alloc,
113 		    pnode, cnp->cn_lkflags, vpp);
114 		tmpfs_free_node(tm, pnode);
115 		if (error != 0)
116 			goto out;
117 	} else if (cnp->cn_namelen == 1 && cnp->cn_nameptr[0] == '.') {
118 		VREF(dvp);
119 		*vpp = dvp;
120 		error = 0;
121 	} else {
122 		de = tmpfs_dir_lookup(dnode, NULL, cnp);
123 		if (de != NULL && de->td_node == NULL)
124 			cnp->cn_flags |= ISWHITEOUT;
125 		if (de == NULL || de->td_node == NULL) {
126 			/*
127 			 * The entry was not found in the directory.
128 			 * This is OK if we are creating or renaming an
129 			 * entry and are working on the last component of
130 			 * the path name.
131 			 */
132 			if ((cnp->cn_flags & ISLASTCN) &&
133 			    (cnp->cn_nameiop == CREATE || \
134 			    cnp->cn_nameiop == RENAME ||
135 			    (cnp->cn_nameiop == DELETE &&
136 			    cnp->cn_flags & DOWHITEOUT &&
137 			    cnp->cn_flags & ISWHITEOUT))) {
138 				error = VOP_ACCESS(dvp, VWRITE, cnp->cn_cred,
139 				    curthread);
140 				if (error != 0)
141 					goto out;
142 
143 				error = EJUSTRETURN;
144 			} else
145 				error = ENOENT;
146 		} else {
147 			struct tmpfs_node *tnode;
148 
149 			/*
150 			 * The entry was found, so get its associated
151 			 * tmpfs_node.
152 			 */
153 			tnode = de->td_node;
154 
155 			/*
156 			 * If we are not at the last path component and
157 			 * found a non-directory or non-link entry (which
158 			 * may itself be pointing to a directory), raise
159 			 * an error.
160 			 */
161 			if ((tnode->tn_type != VDIR &&
162 			    tnode->tn_type != VLNK) &&
163 			    !(cnp->cn_flags & ISLASTCN)) {
164 				error = ENOTDIR;
165 				goto out;
166 			}
167 
168 			/*
169 			 * If we are deleting or renaming the entry, keep
170 			 * track of its tmpfs_dirent so that it can be
171 			 * easily deleted later.
172 			 */
173 			if ((cnp->cn_flags & ISLASTCN) &&
174 			    (cnp->cn_nameiop == DELETE ||
175 			    cnp->cn_nameiop == RENAME)) {
176 				error = VOP_ACCESS(dvp, VWRITE, cnp->cn_cred,
177 				    curthread);
178 				if (error != 0)
179 					goto out;
180 
181 				/* Allocate a new vnode on the matching entry. */
182 				error = tmpfs_alloc_vp(dvp->v_mount, tnode,
183 				    cnp->cn_lkflags, vpp);
184 				if (error != 0)
185 					goto out;
186 
187 				if ((dnode->tn_mode & S_ISTXT) &&
188 				  VOP_ACCESS(dvp, VADMIN, cnp->cn_cred,
189 				  curthread) && VOP_ACCESS(*vpp, VADMIN,
190 				  cnp->cn_cred, curthread)) {
191 					error = EPERM;
192 					vput(*vpp);
193 					*vpp = NULL;
194 					goto out;
195 				}
196 			} else {
197 				error = tmpfs_alloc_vp(dvp->v_mount, tnode,
198 				    cnp->cn_lkflags, vpp);
199 				if (error != 0)
200 					goto out;
201 			}
202 		}
203 	}
204 
205 	/*
206 	 * Store the result of this lookup in the cache.  Avoid this if the
207 	 * request was for creation, as it does not improve timings on
208 	 * emprical tests.
209 	 */
210 	if ((cnp->cn_flags & MAKEENTRY) != 0 && tmpfs_use_nc(dvp))
211 		cache_enter(dvp, *vpp, cnp);
212 
213 out:
214 	/*
215 	 * If there were no errors, *vpp cannot be null and it must be
216 	 * locked.
217 	 */
218 	MPASS(IFF(error == 0, *vpp != NULLVP && VOP_ISLOCKED(*vpp)));
219 
220 	return (error);
221 }
222 
223 static int
224 tmpfs_cached_lookup(struct vop_cachedlookup_args *v)
225 {
226 
227 	return (tmpfs_lookup1(v->a_dvp, v->a_vpp, v->a_cnp));
228 }
229 
230 static int
231 tmpfs_lookup(struct vop_lookup_args *v)
232 {
233 	struct vnode *dvp = v->a_dvp;
234 	struct vnode **vpp = v->a_vpp;
235 	struct componentname *cnp = v->a_cnp;
236 	int error;
237 
238 	/* Check accessibility of requested node as a first step. */
239 	error = vn_dir_check_exec(dvp, cnp);
240 	if (error != 0)
241 		return (error);
242 
243 	return (tmpfs_lookup1(dvp, vpp, cnp));
244 }
245 
246 static int
247 tmpfs_create(struct vop_create_args *v)
248 {
249 	struct vnode *dvp = v->a_dvp;
250 	struct vnode **vpp = v->a_vpp;
251 	struct componentname *cnp = v->a_cnp;
252 	struct vattr *vap = v->a_vap;
253 	int error;
254 
255 	MPASS(vap->va_type == VREG || vap->va_type == VSOCK);
256 
257 	error = tmpfs_alloc_file(dvp, vpp, vap, cnp, NULL);
258 	if (error == 0 && (cnp->cn_flags & MAKEENTRY) != 0 && tmpfs_use_nc(dvp))
259 		cache_enter(dvp, *vpp, cnp);
260 	return (error);
261 }
262 
263 static int
264 tmpfs_mknod(struct vop_mknod_args *v)
265 {
266 	struct vnode *dvp = v->a_dvp;
267 	struct vnode **vpp = v->a_vpp;
268 	struct componentname *cnp = v->a_cnp;
269 	struct vattr *vap = v->a_vap;
270 
271 	if (vap->va_type != VBLK && vap->va_type != VCHR &&
272 	    vap->va_type != VFIFO)
273 		return (EINVAL);
274 
275 	return (tmpfs_alloc_file(dvp, vpp, vap, cnp, NULL));
276 }
277 
278 struct fileops tmpfs_fnops;
279 
280 static int
281 tmpfs_open(struct vop_open_args *v)
282 {
283 	struct vnode *vp;
284 	struct tmpfs_node *node;
285 	struct file *fp;
286 	int error, mode;
287 
288 	vp = v->a_vp;
289 	mode = v->a_mode;
290 	node = VP_TO_TMPFS_NODE(vp);
291 
292 	/*
293 	 * The file is still active but all its names have been removed
294 	 * (e.g. by a "rmdir $(pwd)").  It cannot be opened any more as
295 	 * it is about to die.
296 	 */
297 	if (node->tn_links < 1)
298 		return (ENOENT);
299 
300 	/* If the file is marked append-only, deny write requests. */
301 	if (node->tn_flags & APPEND && (mode & (FWRITE | O_APPEND)) == FWRITE)
302 		error = EPERM;
303 	else {
304 		error = 0;
305 		/* For regular files, the call below is nop. */
306 		KASSERT(vp->v_type != VREG || (node->tn_reg.tn_aobj->flags &
307 		    OBJ_DEAD) == 0, ("dead object"));
308 		vnode_create_vobject(vp, node->tn_size, v->a_td);
309 	}
310 
311 	fp = v->a_fp;
312 	MPASS(fp == NULL || fp->f_data == NULL);
313 	if (error == 0 && fp != NULL && vp->v_type == VREG) {
314 		tmpfs_ref_node(node);
315 		finit_vnode(fp, mode, node, &tmpfs_fnops);
316 	}
317 
318 	return (error);
319 }
320 
321 static int
322 tmpfs_close(struct vop_close_args *v)
323 {
324 	struct vnode *vp = v->a_vp;
325 
326 	/* Update node times. */
327 	tmpfs_update(vp);
328 
329 	return (0);
330 }
331 
332 int
333 tmpfs_fo_close(struct file *fp, struct thread *td)
334 {
335 	struct tmpfs_node *node;
336 
337 	node = fp->f_data;
338 	if (node != NULL) {
339 		MPASS(node->tn_type == VREG);
340 		tmpfs_free_node(node->tn_reg.tn_tmp, node);
341 	}
342 	return (vnops.fo_close(fp, td));
343 }
344 
345 /*
346  * VOP_FPLOOKUP_VEXEC routines are subject to special circumstances, see
347  * the comment above cache_fplookup for details.
348  */
349 int
350 tmpfs_fplookup_vexec(struct vop_fplookup_vexec_args *v)
351 {
352 	struct vnode *vp;
353 	struct tmpfs_node *node;
354 	struct ucred *cred;
355 	mode_t all_x, mode;
356 
357 	vp = v->a_vp;
358 	node = VP_TO_TMPFS_NODE_SMR(vp);
359 	if (__predict_false(node == NULL))
360 		return (EAGAIN);
361 
362 	all_x = S_IXUSR | S_IXGRP | S_IXOTH;
363 	mode = atomic_load_short(&node->tn_mode);
364 	if (__predict_true((mode & all_x) == all_x))
365 		return (0);
366 
367 	cred = v->a_cred;
368 	return (vaccess_vexec_smr(mode, node->tn_uid, node->tn_gid, cred));
369 }
370 
371 int
372 tmpfs_access(struct vop_access_args *v)
373 {
374 	struct vnode *vp = v->a_vp;
375 	accmode_t accmode = v->a_accmode;
376 	struct ucred *cred = v->a_cred;
377 	mode_t all_x = S_IXUSR | S_IXGRP | S_IXOTH;
378 	int error;
379 	struct tmpfs_node *node;
380 
381 	MPASS(VOP_ISLOCKED(vp));
382 
383 	node = VP_TO_TMPFS_NODE(vp);
384 
385 	/*
386 	 * Common case path lookup.
387 	 */
388 	if (__predict_true(accmode == VEXEC && (node->tn_mode & all_x) == all_x))
389 		return (0);
390 
391 	switch (vp->v_type) {
392 	case VDIR:
393 		/* FALLTHROUGH */
394 	case VLNK:
395 		/* FALLTHROUGH */
396 	case VREG:
397 		if (accmode & VWRITE && vp->v_mount->mnt_flag & MNT_RDONLY) {
398 			error = EROFS;
399 			goto out;
400 		}
401 		break;
402 
403 	case VBLK:
404 		/* FALLTHROUGH */
405 	case VCHR:
406 		/* FALLTHROUGH */
407 	case VSOCK:
408 		/* FALLTHROUGH */
409 	case VFIFO:
410 		break;
411 
412 	default:
413 		error = EINVAL;
414 		goto out;
415 	}
416 
417 	if (accmode & VWRITE && node->tn_flags & IMMUTABLE) {
418 		error = EPERM;
419 		goto out;
420 	}
421 
422 	error = vaccess(vp->v_type, node->tn_mode, node->tn_uid, node->tn_gid,
423 	    accmode, cred);
424 
425 out:
426 	MPASS(VOP_ISLOCKED(vp));
427 
428 	return (error);
429 }
430 
431 int
432 tmpfs_stat(struct vop_stat_args *v)
433 {
434 	struct vnode *vp = v->a_vp;
435 	struct stat *sb = v->a_sb;
436 	vm_object_t obj;
437 	struct tmpfs_node *node;
438 	int error;
439 
440 	node = VP_TO_TMPFS_NODE(vp);
441 
442 	tmpfs_update_getattr(vp);
443 
444 	error = vop_stat_helper_pre(v);
445 	if (__predict_false(error))
446 		return (error);
447 
448 	sb->st_dev = vp->v_mount->mnt_stat.f_fsid.val[0];
449 	sb->st_ino = node->tn_id;
450 	sb->st_mode = node->tn_mode | VTTOIF(vp->v_type);
451 	sb->st_nlink = node->tn_links;
452 	sb->st_uid = node->tn_uid;
453 	sb->st_gid = node->tn_gid;
454 	sb->st_rdev = (vp->v_type == VBLK || vp->v_type == VCHR) ?
455 		node->tn_rdev : NODEV;
456 	sb->st_size = node->tn_size;
457 	sb->st_atim.tv_sec = node->tn_atime.tv_sec;
458 	sb->st_atim.tv_nsec = node->tn_atime.tv_nsec;
459 	sb->st_mtim.tv_sec = node->tn_mtime.tv_sec;
460 	sb->st_mtim.tv_nsec = node->tn_mtime.tv_nsec;
461 	sb->st_ctim.tv_sec = node->tn_ctime.tv_sec;
462 	sb->st_ctim.tv_nsec = node->tn_ctime.tv_nsec;
463 	sb->st_birthtim.tv_sec = node->tn_birthtime.tv_sec;
464 	sb->st_birthtim.tv_nsec = node->tn_birthtime.tv_nsec;
465 	sb->st_blksize = PAGE_SIZE;
466 	sb->st_flags = node->tn_flags;
467 	sb->st_gen = node->tn_gen;
468 	if (vp->v_type == VREG) {
469 		obj = node->tn_reg.tn_aobj;
470 		sb->st_blocks = (u_quad_t)obj->resident_page_count * PAGE_SIZE;
471 	} else
472 		sb->st_blocks = node->tn_size;
473 	sb->st_blocks /= S_BLKSIZE;
474 	return (vop_stat_helper_post(v, error));
475 }
476 
477 int
478 tmpfs_getattr(struct vop_getattr_args *v)
479 {
480 	struct vnode *vp = v->a_vp;
481 	struct vattr *vap = v->a_vap;
482 	vm_object_t obj;
483 	struct tmpfs_node *node;
484 
485 	node = VP_TO_TMPFS_NODE(vp);
486 
487 	tmpfs_update_getattr(vp);
488 
489 	vap->va_type = vp->v_type;
490 	vap->va_mode = node->tn_mode;
491 	vap->va_nlink = node->tn_links;
492 	vap->va_uid = node->tn_uid;
493 	vap->va_gid = node->tn_gid;
494 	vap->va_fsid = vp->v_mount->mnt_stat.f_fsid.val[0];
495 	vap->va_fileid = node->tn_id;
496 	vap->va_size = node->tn_size;
497 	vap->va_blocksize = PAGE_SIZE;
498 	vap->va_atime = node->tn_atime;
499 	vap->va_mtime = node->tn_mtime;
500 	vap->va_ctime = node->tn_ctime;
501 	vap->va_birthtime = node->tn_birthtime;
502 	vap->va_gen = node->tn_gen;
503 	vap->va_flags = node->tn_flags;
504 	vap->va_rdev = (vp->v_type == VBLK || vp->v_type == VCHR) ?
505 		node->tn_rdev : NODEV;
506 	if (vp->v_type == VREG) {
507 		obj = node->tn_reg.tn_aobj;
508 		vap->va_bytes = (u_quad_t)obj->resident_page_count * PAGE_SIZE;
509 	} else
510 		vap->va_bytes = node->tn_size;
511 	vap->va_filerev = 0;
512 
513 	return (0);
514 }
515 
516 int
517 tmpfs_setattr(struct vop_setattr_args *v)
518 {
519 	struct vnode *vp = v->a_vp;
520 	struct vattr *vap = v->a_vap;
521 	struct ucred *cred = v->a_cred;
522 	struct thread *td = curthread;
523 
524 	int error;
525 
526 	MPASS(VOP_ISLOCKED(vp));
527 	ASSERT_VOP_IN_SEQC(vp);
528 
529 	error = 0;
530 
531 	/* Abort if any unsettable attribute is given. */
532 	if (vap->va_type != VNON ||
533 	    vap->va_nlink != VNOVAL ||
534 	    vap->va_fsid != VNOVAL ||
535 	    vap->va_fileid != VNOVAL ||
536 	    vap->va_blocksize != VNOVAL ||
537 	    vap->va_gen != VNOVAL ||
538 	    vap->va_rdev != VNOVAL ||
539 	    vap->va_bytes != VNOVAL)
540 		error = EINVAL;
541 
542 	if (error == 0 && (vap->va_flags != VNOVAL))
543 		error = tmpfs_chflags(vp, vap->va_flags, cred, td);
544 
545 	if (error == 0 && (vap->va_size != VNOVAL))
546 		error = tmpfs_chsize(vp, vap->va_size, cred, td);
547 
548 	if (error == 0 && (vap->va_uid != VNOVAL || vap->va_gid != VNOVAL))
549 		error = tmpfs_chown(vp, vap->va_uid, vap->va_gid, cred, td);
550 
551 	if (error == 0 && (vap->va_mode != (mode_t)VNOVAL))
552 		error = tmpfs_chmod(vp, vap->va_mode, cred, td);
553 
554 	if (error == 0 && ((vap->va_atime.tv_sec != VNOVAL &&
555 	    vap->va_atime.tv_nsec != VNOVAL) ||
556 	    (vap->va_mtime.tv_sec != VNOVAL &&
557 	    vap->va_mtime.tv_nsec != VNOVAL) ||
558 	    (vap->va_birthtime.tv_sec != VNOVAL &&
559 	    vap->va_birthtime.tv_nsec != VNOVAL)))
560 		error = tmpfs_chtimes(vp, vap, cred, td);
561 
562 	/*
563 	 * Update the node times.  We give preference to the error codes
564 	 * generated by this function rather than the ones that may arise
565 	 * from tmpfs_update.
566 	 */
567 	tmpfs_update(vp);
568 
569 	MPASS(VOP_ISLOCKED(vp));
570 
571 	return (error);
572 }
573 
574 static int
575 tmpfs_read(struct vop_read_args *v)
576 {
577 	struct vnode *vp;
578 	struct uio *uio;
579 	struct tmpfs_node *node;
580 
581 	vp = v->a_vp;
582 	if (vp->v_type != VREG)
583 		return (EISDIR);
584 	uio = v->a_uio;
585 	if (uio->uio_offset < 0)
586 		return (EINVAL);
587 	node = VP_TO_TMPFS_NODE(vp);
588 	tmpfs_set_accessed(VFS_TO_TMPFS(vp->v_mount), node);
589 	return (uiomove_object(node->tn_reg.tn_aobj, node->tn_size, uio));
590 }
591 
592 static int
593 tmpfs_read_pgcache(struct vop_read_pgcache_args *v)
594 {
595 	struct vnode *vp;
596 	struct tmpfs_node *node;
597 	vm_object_t object;
598 	off_t size;
599 	int error;
600 
601 	vp = v->a_vp;
602 	VNPASS((vn_irflag_read(vp) & VIRF_PGREAD) != 0, vp);
603 
604 	if (v->a_uio->uio_offset < 0)
605 		return (EINVAL);
606 
607 	error = EJUSTRETURN;
608 	vfs_smr_enter();
609 
610 	node = VP_TO_TMPFS_NODE_SMR(vp);
611 	if (node == NULL)
612 		goto out_smr;
613 	MPASS(node->tn_type == VREG);
614 	MPASS(node->tn_refcount >= 1);
615 	object = node->tn_reg.tn_aobj;
616 	if (object == NULL)
617 		goto out_smr;
618 
619 	MPASS(object->type == tmpfs_pager_type);
620 	MPASS((object->flags & (OBJ_ANON | OBJ_DEAD | OBJ_SWAP)) ==
621 	    OBJ_SWAP);
622 	if (!VN_IS_DOOMED(vp)) {
623 		/* size cannot become shorter due to rangelock. */
624 		size = node->tn_size;
625 		tmpfs_set_accessed(node->tn_reg.tn_tmp, node);
626 		vfs_smr_exit();
627 		error = uiomove_object(object, size, v->a_uio);
628 		return (error);
629 	}
630 out_smr:
631 	vfs_smr_exit();
632 	return (error);
633 }
634 
635 static int
636 tmpfs_write(struct vop_write_args *v)
637 {
638 	struct vnode *vp;
639 	struct uio *uio;
640 	struct tmpfs_node *node;
641 	off_t oldsize;
642 	int error, ioflag;
643 	mode_t newmode;
644 
645 	vp = v->a_vp;
646 	uio = v->a_uio;
647 	ioflag = v->a_ioflag;
648 	error = 0;
649 	node = VP_TO_TMPFS_NODE(vp);
650 	oldsize = node->tn_size;
651 
652 	if (uio->uio_offset < 0 || vp->v_type != VREG)
653 		return (EINVAL);
654 	if (uio->uio_resid == 0)
655 		return (0);
656 	if (ioflag & IO_APPEND)
657 		uio->uio_offset = node->tn_size;
658 	if (uio->uio_offset + uio->uio_resid >
659 	  VFS_TO_TMPFS(vp->v_mount)->tm_maxfilesize)
660 		return (EFBIG);
661 	if (vn_rlimit_fsize(vp, uio, uio->uio_td))
662 		return (EFBIG);
663 	if (uio->uio_offset + uio->uio_resid > node->tn_size) {
664 		error = tmpfs_reg_resize(vp, uio->uio_offset + uio->uio_resid,
665 		    FALSE);
666 		if (error != 0)
667 			goto out;
668 	}
669 
670 	error = uiomove_object(node->tn_reg.tn_aobj, node->tn_size, uio);
671 	node->tn_status |= TMPFS_NODE_MODIFIED | TMPFS_NODE_CHANGED;
672 	node->tn_accessed = true;
673 	if (node->tn_mode & (S_ISUID | S_ISGID)) {
674 		if (priv_check_cred(v->a_cred, PRIV_VFS_RETAINSUGID)) {
675 			newmode = node->tn_mode & ~(S_ISUID | S_ISGID);
676 			vn_seqc_write_begin(vp);
677 			atomic_store_short(&node->tn_mode, newmode);
678 			vn_seqc_write_end(vp);
679 		}
680 	}
681 	if (error != 0)
682 		(void)tmpfs_reg_resize(vp, oldsize, TRUE);
683 
684 out:
685 	MPASS(IMPLIES(error == 0, uio->uio_resid == 0));
686 	MPASS(IMPLIES(error != 0, oldsize == node->tn_size));
687 
688 	return (error);
689 }
690 
691 static int
692 tmpfs_deallocate(struct vop_deallocate_args *v)
693 {
694 	return (tmpfs_reg_punch_hole(v->a_vp, v->a_offset, v->a_len));
695 }
696 
697 static int
698 tmpfs_fsync(struct vop_fsync_args *v)
699 {
700 	struct vnode *vp = v->a_vp;
701 
702 	MPASS(VOP_ISLOCKED(vp));
703 
704 	tmpfs_check_mtime(vp);
705 	tmpfs_update(vp);
706 
707 	return (0);
708 }
709 
710 static int
711 tmpfs_remove(struct vop_remove_args *v)
712 {
713 	struct vnode *dvp = v->a_dvp;
714 	struct vnode *vp = v->a_vp;
715 
716 	int error;
717 	struct tmpfs_dirent *de;
718 	struct tmpfs_mount *tmp;
719 	struct tmpfs_node *dnode;
720 	struct tmpfs_node *node;
721 
722 	MPASS(VOP_ISLOCKED(dvp));
723 	MPASS(VOP_ISLOCKED(vp));
724 
725 	if (vp->v_type == VDIR) {
726 		error = EISDIR;
727 		goto out;
728 	}
729 
730 	dnode = VP_TO_TMPFS_DIR(dvp);
731 	node = VP_TO_TMPFS_NODE(vp);
732 	tmp = VFS_TO_TMPFS(vp->v_mount);
733 	de = tmpfs_dir_lookup(dnode, node, v->a_cnp);
734 	MPASS(de != NULL);
735 
736 	/* Files marked as immutable or append-only cannot be deleted. */
737 	if ((node->tn_flags & (IMMUTABLE | APPEND | NOUNLINK)) ||
738 	    (dnode->tn_flags & APPEND)) {
739 		error = EPERM;
740 		goto out;
741 	}
742 
743 	/* Remove the entry from the directory; as it is a file, we do not
744 	 * have to change the number of hard links of the directory. */
745 	tmpfs_dir_detach(dvp, de);
746 	if (v->a_cnp->cn_flags & DOWHITEOUT)
747 		tmpfs_dir_whiteout_add(dvp, v->a_cnp);
748 
749 	/* Free the directory entry we just deleted.  Note that the node
750 	 * referred by it will not be removed until the vnode is really
751 	 * reclaimed. */
752 	tmpfs_free_dirent(tmp, de);
753 
754 	node->tn_status |= TMPFS_NODE_CHANGED;
755 	node->tn_accessed = true;
756 	error = 0;
757 
758 out:
759 	return (error);
760 }
761 
762 static int
763 tmpfs_link(struct vop_link_args *v)
764 {
765 	struct vnode *dvp = v->a_tdvp;
766 	struct vnode *vp = v->a_vp;
767 	struct componentname *cnp = v->a_cnp;
768 
769 	int error;
770 	struct tmpfs_dirent *de;
771 	struct tmpfs_node *node;
772 
773 	MPASS(VOP_ISLOCKED(dvp));
774 	MPASS(dvp != vp); /* XXX When can this be false? */
775 	node = VP_TO_TMPFS_NODE(vp);
776 
777 	/* Ensure that we do not overflow the maximum number of links imposed
778 	 * by the system. */
779 	MPASS(node->tn_links <= TMPFS_LINK_MAX);
780 	if (node->tn_links == TMPFS_LINK_MAX) {
781 		error = EMLINK;
782 		goto out;
783 	}
784 
785 	/* We cannot create links of files marked immutable or append-only. */
786 	if (node->tn_flags & (IMMUTABLE | APPEND)) {
787 		error = EPERM;
788 		goto out;
789 	}
790 
791 	/* Allocate a new directory entry to represent the node. */
792 	error = tmpfs_alloc_dirent(VFS_TO_TMPFS(vp->v_mount), node,
793 	    cnp->cn_nameptr, cnp->cn_namelen, &de);
794 	if (error != 0)
795 		goto out;
796 
797 	/* Insert the new directory entry into the appropriate directory. */
798 	if (cnp->cn_flags & ISWHITEOUT)
799 		tmpfs_dir_whiteout_remove(dvp, cnp);
800 	tmpfs_dir_attach(dvp, de);
801 
802 	/* vp link count has changed, so update node times. */
803 	node->tn_status |= TMPFS_NODE_CHANGED;
804 	tmpfs_update(vp);
805 
806 	error = 0;
807 
808 out:
809 	return (error);
810 }
811 
812 /*
813  * We acquire all but fdvp locks using non-blocking acquisitions.  If we
814  * fail to acquire any lock in the path we will drop all held locks,
815  * acquire the new lock in a blocking fashion, and then release it and
816  * restart the rename.  This acquire/release step ensures that we do not
817  * spin on a lock waiting for release.  On error release all vnode locks
818  * and decrement references the way tmpfs_rename() would do.
819  */
820 static int
821 tmpfs_rename_relock(struct vnode *fdvp, struct vnode **fvpp,
822     struct vnode *tdvp, struct vnode **tvpp,
823     struct componentname *fcnp, struct componentname *tcnp)
824 {
825 	struct vnode *nvp;
826 	struct mount *mp;
827 	struct tmpfs_dirent *de;
828 	int error, restarts = 0;
829 
830 	VOP_UNLOCK(tdvp);
831 	if (*tvpp != NULL && *tvpp != tdvp)
832 		VOP_UNLOCK(*tvpp);
833 	mp = fdvp->v_mount;
834 
835 relock:
836 	restarts += 1;
837 	error = vn_lock(fdvp, LK_EXCLUSIVE);
838 	if (error)
839 		goto releout;
840 	if (vn_lock(tdvp, LK_EXCLUSIVE | LK_NOWAIT) != 0) {
841 		VOP_UNLOCK(fdvp);
842 		error = vn_lock(tdvp, LK_EXCLUSIVE);
843 		if (error)
844 			goto releout;
845 		VOP_UNLOCK(tdvp);
846 		goto relock;
847 	}
848 	/*
849 	 * Re-resolve fvp to be certain it still exists and fetch the
850 	 * correct vnode.
851 	 */
852 	de = tmpfs_dir_lookup(VP_TO_TMPFS_DIR(fdvp), NULL, fcnp);
853 	if (de == NULL) {
854 		VOP_UNLOCK(fdvp);
855 		VOP_UNLOCK(tdvp);
856 		if ((fcnp->cn_flags & ISDOTDOT) != 0 ||
857 		    (fcnp->cn_namelen == 1 && fcnp->cn_nameptr[0] == '.'))
858 			error = EINVAL;
859 		else
860 			error = ENOENT;
861 		goto releout;
862 	}
863 	error = tmpfs_alloc_vp(mp, de->td_node, LK_EXCLUSIVE | LK_NOWAIT, &nvp);
864 	if (error != 0) {
865 		VOP_UNLOCK(fdvp);
866 		VOP_UNLOCK(tdvp);
867 		if (error != EBUSY)
868 			goto releout;
869 		error = tmpfs_alloc_vp(mp, de->td_node, LK_EXCLUSIVE, &nvp);
870 		if (error != 0)
871 			goto releout;
872 		VOP_UNLOCK(nvp);
873 		/*
874 		 * Concurrent rename race.
875 		 */
876 		if (nvp == tdvp) {
877 			vrele(nvp);
878 			error = EINVAL;
879 			goto releout;
880 		}
881 		vrele(*fvpp);
882 		*fvpp = nvp;
883 		goto relock;
884 	}
885 	vrele(*fvpp);
886 	*fvpp = nvp;
887 	VOP_UNLOCK(*fvpp);
888 	/*
889 	 * Re-resolve tvp and acquire the vnode lock if present.
890 	 */
891 	de = tmpfs_dir_lookup(VP_TO_TMPFS_DIR(tdvp), NULL, tcnp);
892 	/*
893 	 * If tvp disappeared we just carry on.
894 	 */
895 	if (de == NULL && *tvpp != NULL) {
896 		vrele(*tvpp);
897 		*tvpp = NULL;
898 	}
899 	/*
900 	 * Get the tvp ino if the lookup succeeded.  We may have to restart
901 	 * if the non-blocking acquire fails.
902 	 */
903 	if (de != NULL) {
904 		nvp = NULL;
905 		error = tmpfs_alloc_vp(mp, de->td_node,
906 		    LK_EXCLUSIVE | LK_NOWAIT, &nvp);
907 		if (*tvpp != NULL)
908 			vrele(*tvpp);
909 		*tvpp = nvp;
910 		if (error != 0) {
911 			VOP_UNLOCK(fdvp);
912 			VOP_UNLOCK(tdvp);
913 			if (error != EBUSY)
914 				goto releout;
915 			error = tmpfs_alloc_vp(mp, de->td_node, LK_EXCLUSIVE,
916 			    &nvp);
917 			if (error != 0)
918 				goto releout;
919 			VOP_UNLOCK(nvp);
920 			/*
921 			 * fdvp contains fvp, thus tvp (=fdvp) is not empty.
922 			 */
923 			if (nvp == fdvp) {
924 				error = ENOTEMPTY;
925 				goto releout;
926 			}
927 			goto relock;
928 		}
929 	}
930 	tmpfs_rename_restarts += restarts;
931 
932 	return (0);
933 
934 releout:
935 	vrele(fdvp);
936 	vrele(*fvpp);
937 	vrele(tdvp);
938 	if (*tvpp != NULL)
939 		vrele(*tvpp);
940 	tmpfs_rename_restarts += restarts;
941 
942 	return (error);
943 }
944 
945 static int
946 tmpfs_rename(struct vop_rename_args *v)
947 {
948 	struct vnode *fdvp = v->a_fdvp;
949 	struct vnode *fvp = v->a_fvp;
950 	struct componentname *fcnp = v->a_fcnp;
951 	struct vnode *tdvp = v->a_tdvp;
952 	struct vnode *tvp = v->a_tvp;
953 	struct componentname *tcnp = v->a_tcnp;
954 	char *newname;
955 	struct tmpfs_dirent *de;
956 	struct tmpfs_mount *tmp;
957 	struct tmpfs_node *fdnode;
958 	struct tmpfs_node *fnode;
959 	struct tmpfs_node *tnode;
960 	struct tmpfs_node *tdnode;
961 	int error;
962 	bool want_seqc_end;
963 
964 	MPASS(VOP_ISLOCKED(tdvp));
965 	MPASS(IMPLIES(tvp != NULL, VOP_ISLOCKED(tvp)));
966 
967 	want_seqc_end = false;
968 
969 	/*
970 	 * Disallow cross-device renames.
971 	 * XXX Why isn't this done by the caller?
972 	 */
973 	if (fvp->v_mount != tdvp->v_mount ||
974 	    (tvp != NULL && fvp->v_mount != tvp->v_mount)) {
975 		error = EXDEV;
976 		goto out;
977 	}
978 
979 	/* If source and target are the same file, there is nothing to do. */
980 	if (fvp == tvp) {
981 		error = 0;
982 		goto out;
983 	}
984 
985 	/*
986 	 * If we need to move the directory between entries, lock the
987 	 * source so that we can safely operate on it.
988 	 */
989 	if (fdvp != tdvp && fdvp != tvp) {
990 		if (vn_lock(fdvp, LK_EXCLUSIVE | LK_NOWAIT) != 0) {
991 			error = tmpfs_rename_relock(fdvp, &fvp, tdvp, &tvp,
992 			    fcnp, tcnp);
993 			if (error != 0)
994 				return (error);
995 			ASSERT_VOP_ELOCKED(fdvp,
996 			    "tmpfs_rename: fdvp not locked");
997 			ASSERT_VOP_ELOCKED(tdvp,
998 			    "tmpfs_rename: tdvp not locked");
999 			if (tvp != NULL)
1000 				ASSERT_VOP_ELOCKED(tvp,
1001 				    "tmpfs_rename: tvp not locked");
1002 			if (fvp == tvp) {
1003 				error = 0;
1004 				goto out_locked;
1005 			}
1006 		}
1007 	}
1008 
1009 	if (tvp != NULL)
1010 		vn_seqc_write_begin(tvp);
1011 	vn_seqc_write_begin(tdvp);
1012 	vn_seqc_write_begin(fvp);
1013 	vn_seqc_write_begin(fdvp);
1014 	want_seqc_end = true;
1015 
1016 	tmp = VFS_TO_TMPFS(tdvp->v_mount);
1017 	tdnode = VP_TO_TMPFS_DIR(tdvp);
1018 	tnode = (tvp == NULL) ? NULL : VP_TO_TMPFS_NODE(tvp);
1019 	fdnode = VP_TO_TMPFS_DIR(fdvp);
1020 	fnode = VP_TO_TMPFS_NODE(fvp);
1021 	de = tmpfs_dir_lookup(fdnode, fnode, fcnp);
1022 
1023 	/*
1024 	 * Entry can disappear before we lock fdvp,
1025 	 * also avoid manipulating '.' and '..' entries.
1026 	 */
1027 	if (de == NULL) {
1028 		if ((fcnp->cn_flags & ISDOTDOT) != 0 ||
1029 		    (fcnp->cn_namelen == 1 && fcnp->cn_nameptr[0] == '.'))
1030 			error = EINVAL;
1031 		else
1032 			error = ENOENT;
1033 		goto out_locked;
1034 	}
1035 	MPASS(de->td_node == fnode);
1036 
1037 	/*
1038 	 * If re-naming a directory to another preexisting directory
1039 	 * ensure that the target directory is empty so that its
1040 	 * removal causes no side effects.
1041 	 * Kern_rename guarantees the destination to be a directory
1042 	 * if the source is one.
1043 	 */
1044 	if (tvp != NULL) {
1045 		MPASS(tnode != NULL);
1046 
1047 		if ((tnode->tn_flags & (NOUNLINK | IMMUTABLE | APPEND)) ||
1048 		    (tdnode->tn_flags & (APPEND | IMMUTABLE))) {
1049 			error = EPERM;
1050 			goto out_locked;
1051 		}
1052 
1053 		if (fnode->tn_type == VDIR && tnode->tn_type == VDIR) {
1054 			if (tnode->tn_size > 0) {
1055 				error = ENOTEMPTY;
1056 				goto out_locked;
1057 			}
1058 		} else if (fnode->tn_type == VDIR && tnode->tn_type != VDIR) {
1059 			error = ENOTDIR;
1060 			goto out_locked;
1061 		} else if (fnode->tn_type != VDIR && tnode->tn_type == VDIR) {
1062 			error = EISDIR;
1063 			goto out_locked;
1064 		} else {
1065 			MPASS(fnode->tn_type != VDIR &&
1066 				tnode->tn_type != VDIR);
1067 		}
1068 	}
1069 
1070 	if ((fnode->tn_flags & (NOUNLINK | IMMUTABLE | APPEND))
1071 	    || (fdnode->tn_flags & (APPEND | IMMUTABLE))) {
1072 		error = EPERM;
1073 		goto out_locked;
1074 	}
1075 
1076 	/*
1077 	 * Ensure that we have enough memory to hold the new name, if it
1078 	 * has to be changed.
1079 	 */
1080 	if (fcnp->cn_namelen != tcnp->cn_namelen ||
1081 	    bcmp(fcnp->cn_nameptr, tcnp->cn_nameptr, fcnp->cn_namelen) != 0) {
1082 		newname = malloc(tcnp->cn_namelen, M_TMPFSNAME, M_WAITOK);
1083 	} else
1084 		newname = NULL;
1085 
1086 	/*
1087 	 * If the node is being moved to another directory, we have to do
1088 	 * the move.
1089 	 */
1090 	if (fdnode != tdnode) {
1091 		/*
1092 		 * In case we are moving a directory, we have to adjust its
1093 		 * parent to point to the new parent.
1094 		 */
1095 		if (de->td_node->tn_type == VDIR) {
1096 			struct tmpfs_node *n;
1097 
1098 			/*
1099 			 * Ensure the target directory is not a child of the
1100 			 * directory being moved.  Otherwise, we'd end up
1101 			 * with stale nodes.
1102 			 */
1103 			n = tdnode;
1104 			/*
1105 			 * TMPFS_LOCK guaranties that no nodes are freed while
1106 			 * traversing the list. Nodes can only be marked as
1107 			 * removed: tn_parent == NULL.
1108 			 */
1109 			TMPFS_LOCK(tmp);
1110 			TMPFS_NODE_LOCK(n);
1111 			while (n != n->tn_dir.tn_parent) {
1112 				struct tmpfs_node *parent;
1113 
1114 				if (n == fnode) {
1115 					TMPFS_NODE_UNLOCK(n);
1116 					TMPFS_UNLOCK(tmp);
1117 					error = EINVAL;
1118 					if (newname != NULL)
1119 						    free(newname, M_TMPFSNAME);
1120 					goto out_locked;
1121 				}
1122 				parent = n->tn_dir.tn_parent;
1123 				TMPFS_NODE_UNLOCK(n);
1124 				if (parent == NULL) {
1125 					n = NULL;
1126 					break;
1127 				}
1128 				TMPFS_NODE_LOCK(parent);
1129 				if (parent->tn_dir.tn_parent == NULL) {
1130 					TMPFS_NODE_UNLOCK(parent);
1131 					n = NULL;
1132 					break;
1133 				}
1134 				n = parent;
1135 			}
1136 			TMPFS_UNLOCK(tmp);
1137 			if (n == NULL) {
1138 				error = EINVAL;
1139 				if (newname != NULL)
1140 					    free(newname, M_TMPFSNAME);
1141 				goto out_locked;
1142 			}
1143 			TMPFS_NODE_UNLOCK(n);
1144 
1145 			/* Adjust the parent pointer. */
1146 			TMPFS_VALIDATE_DIR(fnode);
1147 			TMPFS_NODE_LOCK(de->td_node);
1148 			de->td_node->tn_dir.tn_parent = tdnode;
1149 			TMPFS_NODE_UNLOCK(de->td_node);
1150 
1151 			/*
1152 			 * As a result of changing the target of the '..'
1153 			 * entry, the link count of the source and target
1154 			 * directories has to be adjusted.
1155 			 */
1156 			TMPFS_NODE_LOCK(tdnode);
1157 			TMPFS_ASSERT_LOCKED(tdnode);
1158 			tdnode->tn_links++;
1159 			TMPFS_NODE_UNLOCK(tdnode);
1160 
1161 			TMPFS_NODE_LOCK(fdnode);
1162 			TMPFS_ASSERT_LOCKED(fdnode);
1163 			fdnode->tn_links--;
1164 			TMPFS_NODE_UNLOCK(fdnode);
1165 		}
1166 	}
1167 
1168 	/*
1169 	 * Do the move: just remove the entry from the source directory
1170 	 * and insert it into the target one.
1171 	 */
1172 	tmpfs_dir_detach(fdvp, de);
1173 
1174 	if (fcnp->cn_flags & DOWHITEOUT)
1175 		tmpfs_dir_whiteout_add(fdvp, fcnp);
1176 	if (tcnp->cn_flags & ISWHITEOUT)
1177 		tmpfs_dir_whiteout_remove(tdvp, tcnp);
1178 
1179 	/*
1180 	 * If the name has changed, we need to make it effective by changing
1181 	 * it in the directory entry.
1182 	 */
1183 	if (newname != NULL) {
1184 		MPASS(tcnp->cn_namelen <= MAXNAMLEN);
1185 
1186 		free(de->ud.td_name, M_TMPFSNAME);
1187 		de->ud.td_name = newname;
1188 		tmpfs_dirent_init(de, tcnp->cn_nameptr, tcnp->cn_namelen);
1189 
1190 		fnode->tn_status |= TMPFS_NODE_CHANGED;
1191 		tdnode->tn_status |= TMPFS_NODE_MODIFIED;
1192 	}
1193 
1194 	/*
1195 	 * If we are overwriting an entry, we have to remove the old one
1196 	 * from the target directory.
1197 	 */
1198 	if (tvp != NULL) {
1199 		struct tmpfs_dirent *tde;
1200 
1201 		/* Remove the old entry from the target directory. */
1202 		tde = tmpfs_dir_lookup(tdnode, tnode, tcnp);
1203 		tmpfs_dir_detach(tdvp, tde);
1204 
1205 		/*
1206 		 * Free the directory entry we just deleted.  Note that the
1207 		 * node referred by it will not be removed until the vnode is
1208 		 * really reclaimed.
1209 		 */
1210 		tmpfs_free_dirent(VFS_TO_TMPFS(tvp->v_mount), tde);
1211 	}
1212 
1213 	tmpfs_dir_attach(tdvp, de);
1214 
1215 	if (tmpfs_use_nc(fvp)) {
1216 		cache_vop_rename(fdvp, fvp, tdvp, tvp, fcnp, tcnp);
1217 	}
1218 
1219 	error = 0;
1220 
1221 out_locked:
1222 	if (fdvp != tdvp && fdvp != tvp)
1223 		VOP_UNLOCK(fdvp);
1224 
1225 out:
1226 	if (want_seqc_end) {
1227 		if (tvp != NULL)
1228 			vn_seqc_write_end(tvp);
1229 		vn_seqc_write_end(tdvp);
1230 		vn_seqc_write_end(fvp);
1231 		vn_seqc_write_end(fdvp);
1232 	}
1233 
1234 	/*
1235 	 * Release target nodes.
1236 	 * XXX: I don't understand when tdvp can be the same as tvp, but
1237 	 * other code takes care of this...
1238 	 */
1239 	if (tdvp == tvp)
1240 		vrele(tdvp);
1241 	else
1242 		vput(tdvp);
1243 	if (tvp != NULL)
1244 		vput(tvp);
1245 
1246 	/* Release source nodes. */
1247 	vrele(fdvp);
1248 	vrele(fvp);
1249 
1250 	return (error);
1251 }
1252 
1253 static int
1254 tmpfs_mkdir(struct vop_mkdir_args *v)
1255 {
1256 	struct vnode *dvp = v->a_dvp;
1257 	struct vnode **vpp = v->a_vpp;
1258 	struct componentname *cnp = v->a_cnp;
1259 	struct vattr *vap = v->a_vap;
1260 
1261 	MPASS(vap->va_type == VDIR);
1262 
1263 	return (tmpfs_alloc_file(dvp, vpp, vap, cnp, NULL));
1264 }
1265 
1266 static int
1267 tmpfs_rmdir(struct vop_rmdir_args *v)
1268 {
1269 	struct vnode *dvp = v->a_dvp;
1270 	struct vnode *vp = v->a_vp;
1271 
1272 	int error;
1273 	struct tmpfs_dirent *de;
1274 	struct tmpfs_mount *tmp;
1275 	struct tmpfs_node *dnode;
1276 	struct tmpfs_node *node;
1277 
1278 	MPASS(VOP_ISLOCKED(dvp));
1279 	MPASS(VOP_ISLOCKED(vp));
1280 
1281 	tmp = VFS_TO_TMPFS(dvp->v_mount);
1282 	dnode = VP_TO_TMPFS_DIR(dvp);
1283 	node = VP_TO_TMPFS_DIR(vp);
1284 
1285 	/* Directories with more than two entries ('.' and '..') cannot be
1286 	 * removed. */
1287 	 if (node->tn_size > 0) {
1288 		 error = ENOTEMPTY;
1289 		 goto out;
1290 	 }
1291 
1292 	if ((dnode->tn_flags & APPEND)
1293 	    || (node->tn_flags & (NOUNLINK | IMMUTABLE | APPEND))) {
1294 		error = EPERM;
1295 		goto out;
1296 	}
1297 
1298 	/* This invariant holds only if we are not trying to remove "..".
1299 	  * We checked for that above so this is safe now. */
1300 	MPASS(node->tn_dir.tn_parent == dnode);
1301 
1302 	/* Get the directory entry associated with node (vp).  This was
1303 	 * filled by tmpfs_lookup while looking up the entry. */
1304 	de = tmpfs_dir_lookup(dnode, node, v->a_cnp);
1305 	MPASS(TMPFS_DIRENT_MATCHES(de,
1306 	    v->a_cnp->cn_nameptr,
1307 	    v->a_cnp->cn_namelen));
1308 
1309 	/* Check flags to see if we are allowed to remove the directory. */
1310 	if ((dnode->tn_flags & APPEND) != 0 ||
1311 	    (node->tn_flags & (NOUNLINK | IMMUTABLE | APPEND)) != 0) {
1312 		error = EPERM;
1313 		goto out;
1314 	}
1315 
1316 	/* Detach the directory entry from the directory (dnode). */
1317 	tmpfs_dir_detach(dvp, de);
1318 	if (v->a_cnp->cn_flags & DOWHITEOUT)
1319 		tmpfs_dir_whiteout_add(dvp, v->a_cnp);
1320 
1321 	/* No vnode should be allocated for this entry from this point */
1322 	TMPFS_NODE_LOCK(node);
1323 	node->tn_links--;
1324 	node->tn_dir.tn_parent = NULL;
1325 	node->tn_status |= TMPFS_NODE_CHANGED | TMPFS_NODE_MODIFIED;
1326 	node->tn_accessed = true;
1327 
1328 	TMPFS_NODE_UNLOCK(node);
1329 
1330 	TMPFS_NODE_LOCK(dnode);
1331 	dnode->tn_links--;
1332 	dnode->tn_status |= TMPFS_NODE_CHANGED | TMPFS_NODE_MODIFIED;
1333 	dnode->tn_accessed = true;
1334 	TMPFS_NODE_UNLOCK(dnode);
1335 
1336 	if (tmpfs_use_nc(dvp)) {
1337 		cache_vop_rmdir(dvp, vp);
1338 	}
1339 
1340 	/* Free the directory entry we just deleted.  Note that the node
1341 	 * referred by it will not be removed until the vnode is really
1342 	 * reclaimed. */
1343 	tmpfs_free_dirent(tmp, de);
1344 
1345 	/* Release the deleted vnode (will destroy the node, notify
1346 	 * interested parties and clean it from the cache). */
1347 
1348 	dnode->tn_status |= TMPFS_NODE_CHANGED;
1349 	tmpfs_update(dvp);
1350 
1351 	error = 0;
1352 
1353 out:
1354 	return (error);
1355 }
1356 
1357 static int
1358 tmpfs_symlink(struct vop_symlink_args *v)
1359 {
1360 	struct vnode *dvp = v->a_dvp;
1361 	struct vnode **vpp = v->a_vpp;
1362 	struct componentname *cnp = v->a_cnp;
1363 	struct vattr *vap = v->a_vap;
1364 	const char *target = v->a_target;
1365 
1366 #ifdef notyet /* XXX FreeBSD BUG: kern_symlink is not setting VLNK */
1367 	MPASS(vap->va_type == VLNK);
1368 #else
1369 	vap->va_type = VLNK;
1370 #endif
1371 
1372 	return (tmpfs_alloc_file(dvp, vpp, vap, cnp, target));
1373 }
1374 
1375 static int
1376 tmpfs_readdir(struct vop_readdir_args *va)
1377 {
1378 	struct vnode *vp;
1379 	struct uio *uio;
1380 	struct tmpfs_mount *tm;
1381 	struct tmpfs_node *node;
1382 	uint64_t **cookies;
1383 	int *eofflag, *ncookies;
1384 	ssize_t startresid;
1385 	int error, maxcookies;
1386 
1387 	vp = va->a_vp;
1388 	uio = va->a_uio;
1389 	eofflag = va->a_eofflag;
1390 	cookies = va->a_cookies;
1391 	ncookies = va->a_ncookies;
1392 
1393 	/* This operation only makes sense on directory nodes. */
1394 	if (vp->v_type != VDIR)
1395 		return (ENOTDIR);
1396 
1397 	maxcookies = 0;
1398 	node = VP_TO_TMPFS_DIR(vp);
1399 	tm = VFS_TO_TMPFS(vp->v_mount);
1400 
1401 	startresid = uio->uio_resid;
1402 
1403 	/* Allocate cookies for NFS and compat modules. */
1404 	if (cookies != NULL && ncookies != NULL) {
1405 		maxcookies = howmany(node->tn_size,
1406 		    sizeof(struct tmpfs_dirent)) + 2;
1407 		*cookies = malloc(maxcookies * sizeof(**cookies), M_TEMP,
1408 		    M_WAITOK);
1409 		*ncookies = 0;
1410 	}
1411 
1412 	if (cookies == NULL)
1413 		error = tmpfs_dir_getdents(tm, node, uio, 0, NULL, NULL);
1414 	else
1415 		error = tmpfs_dir_getdents(tm, node, uio, maxcookies, *cookies,
1416 		    ncookies);
1417 
1418 	/* Buffer was filled without hitting EOF. */
1419 	if (error == EJUSTRETURN)
1420 		error = (uio->uio_resid != startresid) ? 0 : EINVAL;
1421 
1422 	if (error != 0 && cookies != NULL && ncookies != NULL) {
1423 		free(*cookies, M_TEMP);
1424 		*cookies = NULL;
1425 		*ncookies = 0;
1426 	}
1427 
1428 	if (eofflag != NULL)
1429 		*eofflag =
1430 		    (error == 0 && uio->uio_offset == TMPFS_DIRCOOKIE_EOF);
1431 
1432 	return (error);
1433 }
1434 
1435 static int
1436 tmpfs_readlink(struct vop_readlink_args *v)
1437 {
1438 	struct vnode *vp = v->a_vp;
1439 	struct uio *uio = v->a_uio;
1440 
1441 	int error;
1442 	struct tmpfs_node *node;
1443 
1444 	MPASS(uio->uio_offset == 0);
1445 	MPASS(vp->v_type == VLNK);
1446 
1447 	node = VP_TO_TMPFS_NODE(vp);
1448 
1449 	error = uiomove(node->tn_link_target, MIN(node->tn_size, uio->uio_resid),
1450 	    uio);
1451 	tmpfs_set_accessed(VFS_TO_TMPFS(vp->v_mount), node);
1452 
1453 	return (error);
1454 }
1455 
1456 /*
1457  * VOP_FPLOOKUP_SYMLINK routines are subject to special circumstances, see
1458  * the comment above cache_fplookup for details.
1459  *
1460  * Check tmpfs_alloc_node for tmpfs-specific synchronisation notes.
1461  */
1462 static int
1463 tmpfs_fplookup_symlink(struct vop_fplookup_symlink_args *v)
1464 {
1465 	struct vnode *vp;
1466 	struct tmpfs_node *node;
1467 	char *symlink;
1468 
1469 	vp = v->a_vp;
1470 	node = VP_TO_TMPFS_NODE_SMR(vp);
1471 	if (__predict_false(node == NULL))
1472 		return (EAGAIN);
1473 	if (!atomic_load_char(&node->tn_link_smr))
1474 		return (EAGAIN);
1475 	symlink = atomic_load_ptr(&node->tn_link_target);
1476 	if (symlink == NULL)
1477 		return (EAGAIN);
1478 
1479 	return (cache_symlink_resolve(v->a_fpl, symlink, node->tn_size));
1480 }
1481 
1482 static int
1483 tmpfs_inactive(struct vop_inactive_args *v)
1484 {
1485 	struct vnode *vp;
1486 	struct tmpfs_node *node;
1487 
1488 	vp = v->a_vp;
1489 	node = VP_TO_TMPFS_NODE(vp);
1490 	if (node->tn_links == 0)
1491 		vrecycle(vp);
1492 	else
1493 		tmpfs_check_mtime(vp);
1494 	return (0);
1495 }
1496 
1497 static int
1498 tmpfs_need_inactive(struct vop_need_inactive_args *ap)
1499 {
1500 	struct vnode *vp;
1501 	struct tmpfs_node *node;
1502 	struct vm_object *obj;
1503 
1504 	vp = ap->a_vp;
1505 	node = VP_TO_TMPFS_NODE(vp);
1506 	if (node->tn_links == 0)
1507 		goto need;
1508 	if (vp->v_type == VREG) {
1509 		obj = vp->v_object;
1510 		if (obj->generation != obj->cleangeneration)
1511 			goto need;
1512 	}
1513 	return (0);
1514 need:
1515 	return (1);
1516 }
1517 
1518 int
1519 tmpfs_reclaim(struct vop_reclaim_args *v)
1520 {
1521 	struct vnode *vp;
1522 	struct tmpfs_mount *tmp;
1523 	struct tmpfs_node *node;
1524 	bool unlock;
1525 
1526 	vp = v->a_vp;
1527 	node = VP_TO_TMPFS_NODE(vp);
1528 	tmp = VFS_TO_TMPFS(vp->v_mount);
1529 
1530 	if (vp->v_type == VREG)
1531 		tmpfs_destroy_vobject(vp, node->tn_reg.tn_aobj);
1532 	vp->v_object = NULL;
1533 
1534 	TMPFS_LOCK(tmp);
1535 	TMPFS_NODE_LOCK(node);
1536 	tmpfs_free_vp(vp);
1537 
1538 	/*
1539 	 * If the node referenced by this vnode was deleted by the user,
1540 	 * we must free its associated data structures (now that the vnode
1541 	 * is being reclaimed).
1542 	 */
1543 	unlock = true;
1544 	if (node->tn_links == 0 &&
1545 	    (node->tn_vpstate & TMPFS_VNODE_ALLOCATING) == 0) {
1546 		node->tn_vpstate = TMPFS_VNODE_DOOMED;
1547 		unlock = !tmpfs_free_node_locked(tmp, node, true);
1548 	}
1549 
1550 	if (unlock) {
1551 		TMPFS_NODE_UNLOCK(node);
1552 		TMPFS_UNLOCK(tmp);
1553 	}
1554 
1555 	MPASS(vp->v_data == NULL);
1556 	return (0);
1557 }
1558 
1559 int
1560 tmpfs_print(struct vop_print_args *v)
1561 {
1562 	struct vnode *vp = v->a_vp;
1563 
1564 	struct tmpfs_node *node;
1565 
1566 	node = VP_TO_TMPFS_NODE(vp);
1567 
1568 	printf("tag VT_TMPFS, tmpfs_node %p, flags 0x%lx, links %jd\n",
1569 	    node, node->tn_flags, (uintmax_t)node->tn_links);
1570 	printf("\tmode 0%o, owner %d, group %d, size %jd, status 0x%x\n",
1571 	    node->tn_mode, node->tn_uid, node->tn_gid,
1572 	    (intmax_t)node->tn_size, node->tn_status);
1573 
1574 	if (vp->v_type == VFIFO)
1575 		fifo_printinfo(vp);
1576 
1577 	printf("\n");
1578 
1579 	return (0);
1580 }
1581 
1582 int
1583 tmpfs_pathconf(struct vop_pathconf_args *v)
1584 {
1585 	struct vnode *vp = v->a_vp;
1586 	int name = v->a_name;
1587 	long *retval = v->a_retval;
1588 
1589 	int error;
1590 
1591 	error = 0;
1592 
1593 	switch (name) {
1594 	case _PC_LINK_MAX:
1595 		*retval = TMPFS_LINK_MAX;
1596 		break;
1597 
1598 	case _PC_SYMLINK_MAX:
1599 		*retval = MAXPATHLEN;
1600 		break;
1601 
1602 	case _PC_NAME_MAX:
1603 		*retval = NAME_MAX;
1604 		break;
1605 
1606 	case _PC_PIPE_BUF:
1607 		if (vp->v_type == VDIR || vp->v_type == VFIFO)
1608 			*retval = PIPE_BUF;
1609 		else
1610 			error = EINVAL;
1611 		break;
1612 
1613 	case _PC_CHOWN_RESTRICTED:
1614 		*retval = 1;
1615 		break;
1616 
1617 	case _PC_NO_TRUNC:
1618 		*retval = 1;
1619 		break;
1620 
1621 	case _PC_SYNC_IO:
1622 		*retval = 1;
1623 		break;
1624 
1625 	case _PC_FILESIZEBITS:
1626 		*retval = 64;
1627 		break;
1628 
1629 	default:
1630 		error = vop_stdpathconf(v);
1631 	}
1632 
1633 	return (error);
1634 }
1635 
1636 static int
1637 tmpfs_vptofh(struct vop_vptofh_args *ap)
1638 /*
1639 vop_vptofh {
1640 	IN struct vnode *a_vp;
1641 	IN struct fid *a_fhp;
1642 };
1643 */
1644 {
1645 	struct tmpfs_fid_data tfd;
1646 	struct tmpfs_node *node;
1647 	struct fid *fhp;
1648 
1649 	node = VP_TO_TMPFS_NODE(ap->a_vp);
1650 	fhp = ap->a_fhp;
1651 	fhp->fid_len = sizeof(tfd);
1652 
1653 	/*
1654 	 * Copy into fid_data from the stack to avoid unaligned pointer use.
1655 	 * See the comment in sys/mount.h on struct fid for details.
1656 	 */
1657 	tfd.tfd_id = node->tn_id;
1658 	tfd.tfd_gen = node->tn_gen;
1659 	memcpy(fhp->fid_data, &tfd, fhp->fid_len);
1660 
1661 	return (0);
1662 }
1663 
1664 static int
1665 tmpfs_whiteout(struct vop_whiteout_args *ap)
1666 {
1667 	struct vnode *dvp = ap->a_dvp;
1668 	struct componentname *cnp = ap->a_cnp;
1669 	struct tmpfs_dirent *de;
1670 
1671 	switch (ap->a_flags) {
1672 	case LOOKUP:
1673 		return (0);
1674 	case CREATE:
1675 		de = tmpfs_dir_lookup(VP_TO_TMPFS_DIR(dvp), NULL, cnp);
1676 		if (de != NULL)
1677 			return (de->td_node == NULL ? 0 : EEXIST);
1678 		return (tmpfs_dir_whiteout_add(dvp, cnp));
1679 	case DELETE:
1680 		tmpfs_dir_whiteout_remove(dvp, cnp);
1681 		return (0);
1682 	default:
1683 		panic("tmpfs_whiteout: unknown op");
1684 	}
1685 }
1686 
1687 static int
1688 tmpfs_vptocnp_dir(struct tmpfs_node *tn, struct tmpfs_node *tnp,
1689     struct tmpfs_dirent **pde)
1690 {
1691 	struct tmpfs_dir_cursor dc;
1692 	struct tmpfs_dirent *de;
1693 
1694 	for (de = tmpfs_dir_first(tnp, &dc); de != NULL;
1695 	     de = tmpfs_dir_next(tnp, &dc)) {
1696 		if (de->td_node == tn) {
1697 			*pde = de;
1698 			return (0);
1699 		}
1700 	}
1701 	return (ENOENT);
1702 }
1703 
1704 static int
1705 tmpfs_vptocnp_fill(struct vnode *vp, struct tmpfs_node *tn,
1706     struct tmpfs_node *tnp, char *buf, size_t *buflen, struct vnode **dvp)
1707 {
1708 	struct tmpfs_dirent *de;
1709 	int error, i;
1710 
1711 	error = vn_vget_ino_gen(vp, tmpfs_vn_get_ino_alloc, tnp, LK_SHARED,
1712 	    dvp);
1713 	if (error != 0)
1714 		return (error);
1715 	error = tmpfs_vptocnp_dir(tn, tnp, &de);
1716 	if (error == 0) {
1717 		i = *buflen;
1718 		i -= de->td_namelen;
1719 		if (i < 0) {
1720 			error = ENOMEM;
1721 		} else {
1722 			bcopy(de->ud.td_name, buf + i, de->td_namelen);
1723 			*buflen = i;
1724 		}
1725 	}
1726 	if (error == 0) {
1727 		if (vp != *dvp)
1728 			VOP_UNLOCK(*dvp);
1729 	} else {
1730 		if (vp != *dvp)
1731 			vput(*dvp);
1732 		else
1733 			vrele(vp);
1734 	}
1735 	return (error);
1736 }
1737 
1738 static int
1739 tmpfs_vptocnp(struct vop_vptocnp_args *ap)
1740 {
1741 	struct vnode *vp, **dvp;
1742 	struct tmpfs_node *tn, *tnp, *tnp1;
1743 	struct tmpfs_dirent *de;
1744 	struct tmpfs_mount *tm;
1745 	char *buf;
1746 	size_t *buflen;
1747 	int error;
1748 
1749 	vp = ap->a_vp;
1750 	dvp = ap->a_vpp;
1751 	buf = ap->a_buf;
1752 	buflen = ap->a_buflen;
1753 
1754 	tm = VFS_TO_TMPFS(vp->v_mount);
1755 	tn = VP_TO_TMPFS_NODE(vp);
1756 	if (tn->tn_type == VDIR) {
1757 		tnp = tn->tn_dir.tn_parent;
1758 		if (tnp == NULL)
1759 			return (ENOENT);
1760 		tmpfs_ref_node(tnp);
1761 		error = tmpfs_vptocnp_fill(vp, tn, tn->tn_dir.tn_parent, buf,
1762 		    buflen, dvp);
1763 		tmpfs_free_node(tm, tnp);
1764 		return (error);
1765 	}
1766 restart:
1767 	TMPFS_LOCK(tm);
1768 restart_locked:
1769 	LIST_FOREACH_SAFE(tnp, &tm->tm_nodes_used, tn_entries, tnp1) {
1770 		if (tnp->tn_type != VDIR)
1771 			continue;
1772 		TMPFS_NODE_LOCK(tnp);
1773 		tmpfs_ref_node(tnp);
1774 
1775 		/*
1776 		 * tn_vnode cannot be instantiated while we hold the
1777 		 * node lock, so the directory cannot be changed while
1778 		 * we iterate over it.  Do this to avoid instantiating
1779 		 * vnode for directories which cannot point to our
1780 		 * node.
1781 		 */
1782 		error = tnp->tn_vnode == NULL ? tmpfs_vptocnp_dir(tn, tnp,
1783 		    &de) : 0;
1784 
1785 		if (error == 0) {
1786 			TMPFS_NODE_UNLOCK(tnp);
1787 			TMPFS_UNLOCK(tm);
1788 			error = tmpfs_vptocnp_fill(vp, tn, tnp, buf, buflen,
1789 			    dvp);
1790 			if (error == 0) {
1791 				tmpfs_free_node(tm, tnp);
1792 				return (0);
1793 			}
1794 			if (VN_IS_DOOMED(vp)) {
1795 				tmpfs_free_node(tm, tnp);
1796 				return (ENOENT);
1797 			}
1798 			TMPFS_LOCK(tm);
1799 			TMPFS_NODE_LOCK(tnp);
1800 		}
1801 		if (tmpfs_free_node_locked(tm, tnp, false)) {
1802 			goto restart;
1803 		} else {
1804 			KASSERT(tnp->tn_refcount > 0,
1805 			    ("node %p refcount zero", tnp));
1806 			if (tnp->tn_attached) {
1807 				tnp1 = LIST_NEXT(tnp, tn_entries);
1808 				TMPFS_NODE_UNLOCK(tnp);
1809 			} else {
1810 				TMPFS_NODE_UNLOCK(tnp);
1811 				goto restart_locked;
1812 			}
1813 		}
1814 	}
1815 	TMPFS_UNLOCK(tm);
1816 	return (ENOENT);
1817 }
1818 
1819 /*
1820  * Vnode operations vector used for files stored in a tmpfs file system.
1821  */
1822 struct vop_vector tmpfs_vnodeop_entries = {
1823 	.vop_default =			&default_vnodeops,
1824 	.vop_lookup =			vfs_cache_lookup,
1825 	.vop_cachedlookup =		tmpfs_cached_lookup,
1826 	.vop_create =			tmpfs_create,
1827 	.vop_mknod =			tmpfs_mknod,
1828 	.vop_open =			tmpfs_open,
1829 	.vop_close =			tmpfs_close,
1830 	.vop_fplookup_vexec =		tmpfs_fplookup_vexec,
1831 	.vop_fplookup_symlink =		tmpfs_fplookup_symlink,
1832 	.vop_access =			tmpfs_access,
1833 	.vop_stat =			tmpfs_stat,
1834 	.vop_getattr =			tmpfs_getattr,
1835 	.vop_setattr =			tmpfs_setattr,
1836 	.vop_read =			tmpfs_read,
1837 	.vop_read_pgcache =		tmpfs_read_pgcache,
1838 	.vop_write =			tmpfs_write,
1839 	.vop_deallocate =		tmpfs_deallocate,
1840 	.vop_fsync =			tmpfs_fsync,
1841 	.vop_remove =			tmpfs_remove,
1842 	.vop_link =			tmpfs_link,
1843 	.vop_rename =			tmpfs_rename,
1844 	.vop_mkdir =			tmpfs_mkdir,
1845 	.vop_rmdir =			tmpfs_rmdir,
1846 	.vop_symlink =			tmpfs_symlink,
1847 	.vop_readdir =			tmpfs_readdir,
1848 	.vop_readlink =			tmpfs_readlink,
1849 	.vop_inactive =			tmpfs_inactive,
1850 	.vop_need_inactive =		tmpfs_need_inactive,
1851 	.vop_reclaim =			tmpfs_reclaim,
1852 	.vop_print =			tmpfs_print,
1853 	.vop_pathconf =			tmpfs_pathconf,
1854 	.vop_vptofh =			tmpfs_vptofh,
1855 	.vop_whiteout =			tmpfs_whiteout,
1856 	.vop_bmap =			VOP_EOPNOTSUPP,
1857 	.vop_vptocnp =			tmpfs_vptocnp,
1858 	.vop_lock1 =			vop_lock,
1859 	.vop_unlock = 			vop_unlock,
1860 	.vop_islocked = 		vop_islocked,
1861 	.vop_add_writecount =		vop_stdadd_writecount_nomsync,
1862 };
1863 VFS_VOP_VECTOR_REGISTER(tmpfs_vnodeop_entries);
1864 
1865 /*
1866  * Same vector for mounts which do not use namecache.
1867  */
1868 struct vop_vector tmpfs_vnodeop_nonc_entries = {
1869 	.vop_default =			&tmpfs_vnodeop_entries,
1870 	.vop_lookup =			tmpfs_lookup,
1871 };
1872 VFS_VOP_VECTOR_REGISTER(tmpfs_vnodeop_nonc_entries);
1873