xref: /freebsd/sys/fs/tmpfs/tmpfs_vnops.c (revision 64038db825d64fb4827fc8ee264ea0fa1a046d82)
1 /*	$NetBSD: tmpfs_vnops.c,v 1.39 2007/07/23 15:41:01 jmmv Exp $	*/
2 
3 /*-
4  * SPDX-License-Identifier: BSD-2-Clause
5  *
6  * Copyright (c) 2005, 2006 The NetBSD Foundation, Inc.
7  * All rights reserved.
8  *
9  * This code is derived from software contributed to The NetBSD Foundation
10  * by Julio M. Merino Vidal, developed as part of Google's Summer of Code
11  * 2005 program.
12  *
13  * Redistribution and use in source and binary forms, with or without
14  * modification, are permitted provided that the following conditions
15  * are met:
16  * 1. Redistributions of source code must retain the above copyright
17  *    notice, this list of conditions and the following disclaimer.
18  * 2. Redistributions in binary form must reproduce the above copyright
19  *    notice, this list of conditions and the following disclaimer in the
20  *    documentation and/or other materials provided with the distribution.
21  *
22  * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
23  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
24  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
25  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
26  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
27  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
28  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
29  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
30  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
31  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
32  * POSSIBILITY OF SUCH DAMAGE.
33  */
34 
35 /*
36  * tmpfs vnode interface.
37  */
38 
39 #include <sys/param.h>
40 #include <sys/systm.h>
41 #include <sys/dirent.h>
42 #include <sys/extattr.h>
43 #include <sys/fcntl.h>
44 #include <sys/file.h>
45 #include <sys/filio.h>
46 #include <sys/limits.h>
47 #include <sys/lockf.h>
48 #include <sys/lock.h>
49 #include <sys/mount.h>
50 #include <sys/namei.h>
51 #include <sys/priv.h>
52 #include <sys/proc.h>
53 #include <sys/rwlock.h>
54 #include <sys/sched.h>
55 #include <sys/smr.h>
56 #include <sys/stat.h>
57 #include <sys/sysctl.h>
58 #include <sys/unistd.h>
59 #include <sys/vnode.h>
60 #include <security/audit/audit.h>
61 #include <security/mac/mac_framework.h>
62 
63 #include <vm/vm.h>
64 #include <vm/vm_param.h>
65 #include <vm/vm_object.h>
66 #include <vm/vm_page.h>
67 #include <vm/vm_pager.h>
68 #include <vm/swap_pager.h>
69 
70 #include <fs/tmpfs/tmpfs_vnops.h>
71 #include <fs/tmpfs/tmpfs.h>
72 
73 SYSCTL_DECL(_vfs_tmpfs);
74 VFS_SMR_DECLARE;
75 
76 static volatile int tmpfs_rename_restarts;
77 SYSCTL_INT(_vfs_tmpfs, OID_AUTO, rename_restarts, CTLFLAG_RD,
78     __DEVOLATILE(int *, &tmpfs_rename_restarts), 0,
79     "Times rename had to restart due to lock contention");
80 
81 MALLOC_DEFINE(M_TMPFSEA, "tmpfs extattr", "tmpfs extattr structure");
82 
83 static int
84 tmpfs_vn_get_ino_alloc(struct mount *mp, void *arg, int lkflags,
85     struct vnode **rvp)
86 {
87 
88 	return (tmpfs_alloc_vp(mp, arg, lkflags, rvp));
89 }
90 
91 static int
92 tmpfs_lookup1(struct vnode *dvp, struct vnode **vpp, struct componentname *cnp)
93 {
94 	struct tmpfs_dirent *de;
95 	struct tmpfs_node *dnode, *pnode;
96 	struct tmpfs_mount *tm;
97 	int error;
98 
99 	/* Caller assumes responsibility for ensuring access (VEXEC). */
100 	dnode = VP_TO_TMPFS_DIR(dvp);
101 	*vpp = NULL;
102 
103 	/* We cannot be requesting the parent directory of the root node. */
104 	MPASS(IMPLIES(dnode->tn_type == VDIR &&
105 	    dnode->tn_dir.tn_parent == dnode,
106 	    !(cnp->cn_flags & ISDOTDOT)));
107 
108 	TMPFS_ASSERT_LOCKED(dnode);
109 	if (dnode->tn_dir.tn_parent == NULL) {
110 		error = ENOENT;
111 		goto out;
112 	}
113 	if (cnp->cn_flags & ISDOTDOT) {
114 		tm = VFS_TO_TMPFS(dvp->v_mount);
115 		pnode = dnode->tn_dir.tn_parent;
116 		tmpfs_ref_node(pnode);
117 		error = vn_vget_ino_gen(dvp, tmpfs_vn_get_ino_alloc,
118 		    pnode, cnp->cn_lkflags, vpp);
119 		tmpfs_free_node(tm, pnode);
120 		if (error != 0)
121 			goto out;
122 	} else if (cnp->cn_namelen == 1 && cnp->cn_nameptr[0] == '.') {
123 		vref(dvp);
124 		*vpp = dvp;
125 		error = 0;
126 	} else {
127 		de = tmpfs_dir_lookup(dnode, NULL, cnp);
128 		if (de != NULL && de->td_node == NULL)
129 			cnp->cn_flags |= ISWHITEOUT;
130 		if (de == NULL || de->td_node == NULL) {
131 			/*
132 			 * The entry was not found in the directory.
133 			 * This is OK if we are creating or renaming an
134 			 * entry and are working on the last component of
135 			 * the path name.
136 			 */
137 			if ((cnp->cn_flags & ISLASTCN) &&
138 			    (cnp->cn_nameiop == CREATE || \
139 			    cnp->cn_nameiop == RENAME ||
140 			    (cnp->cn_nameiop == DELETE &&
141 			    cnp->cn_flags & DOWHITEOUT &&
142 			    cnp->cn_flags & ISWHITEOUT))) {
143 				error = VOP_ACCESS(dvp, VWRITE, cnp->cn_cred,
144 				    curthread);
145 				if (error != 0)
146 					goto out;
147 
148 				error = EJUSTRETURN;
149 			} else
150 				error = ENOENT;
151 		} else {
152 			struct tmpfs_node *tnode;
153 
154 			/*
155 			 * The entry was found, so get its associated
156 			 * tmpfs_node.
157 			 */
158 			tnode = de->td_node;
159 
160 			/*
161 			 * If we are not at the last path component and
162 			 * found a non-directory or non-link entry (which
163 			 * may itself be pointing to a directory), raise
164 			 * an error.
165 			 */
166 			if ((tnode->tn_type != VDIR &&
167 			    tnode->tn_type != VLNK) &&
168 			    !(cnp->cn_flags & ISLASTCN)) {
169 				error = ENOTDIR;
170 				goto out;
171 			}
172 
173 			/*
174 			 * If we are deleting or renaming the entry, keep
175 			 * track of its tmpfs_dirent so that it can be
176 			 * easily deleted later.
177 			 */
178 			if ((cnp->cn_flags & ISLASTCN) &&
179 			    (cnp->cn_nameiop == DELETE ||
180 			    cnp->cn_nameiop == RENAME)) {
181 				error = VOP_ACCESS(dvp, VWRITE, cnp->cn_cred,
182 				    curthread);
183 				if (error != 0)
184 					goto out;
185 
186 				/* Allocate a new vnode on the matching entry. */
187 				error = tmpfs_alloc_vp(dvp->v_mount, tnode,
188 				    cnp->cn_lkflags, vpp);
189 				if (error != 0)
190 					goto out;
191 
192 				if ((dnode->tn_mode & S_ISTXT) &&
193 				  VOP_ACCESS(dvp, VADMIN, cnp->cn_cred,
194 				  curthread) && VOP_ACCESS(*vpp, VADMIN,
195 				  cnp->cn_cred, curthread)) {
196 					error = EPERM;
197 					vput(*vpp);
198 					*vpp = NULL;
199 					goto out;
200 				}
201 			} else {
202 				error = tmpfs_alloc_vp(dvp->v_mount, tnode,
203 				    cnp->cn_lkflags, vpp);
204 				if (error != 0)
205 					goto out;
206 			}
207 		}
208 	}
209 
210 	/*
211 	 * Store the result of this lookup in the cache.  Avoid this if the
212 	 * request was for creation, as it does not improve timings on
213 	 * emprical tests.
214 	 */
215 	if ((cnp->cn_flags & MAKEENTRY) != 0 && tmpfs_use_nc(dvp))
216 		cache_enter(dvp, *vpp, cnp);
217 
218 out:
219 #ifdef INVARIANTS
220 	/*
221 	 * If there were no errors, *vpp cannot be null and it must be
222 	 * locked.
223 	 */
224 	if (error == 0) {
225 		MPASS(*vpp != NULL);
226 		ASSERT_VOP_LOCKED(*vpp, __func__);
227 	} else {
228 		MPASS(*vpp == NULL);
229 	}
230 #endif
231 
232 	return (error);
233 }
234 
235 static int
236 tmpfs_cached_lookup(struct vop_cachedlookup_args *v)
237 {
238 
239 	return (tmpfs_lookup1(v->a_dvp, v->a_vpp, v->a_cnp));
240 }
241 
242 static int
243 tmpfs_lookup(struct vop_lookup_args *v)
244 {
245 	struct vnode *dvp = v->a_dvp;
246 	struct vnode **vpp = v->a_vpp;
247 	struct componentname *cnp = v->a_cnp;
248 	int error;
249 
250 	/* Check accessibility of requested node as a first step. */
251 	error = vn_dir_check_exec(dvp, cnp);
252 	if (error != 0)
253 		return (error);
254 
255 	return (tmpfs_lookup1(dvp, vpp, cnp));
256 }
257 
258 static int
259 tmpfs_create(struct vop_create_args *v)
260 {
261 	struct vnode *dvp = v->a_dvp;
262 	struct vnode **vpp = v->a_vpp;
263 	struct componentname *cnp = v->a_cnp;
264 	struct vattr *vap = v->a_vap;
265 	int error;
266 
267 	MPASS(vap->va_type == VREG || vap->va_type == VSOCK);
268 
269 	error = tmpfs_alloc_file(dvp, vpp, vap, cnp, NULL);
270 	if (error == 0 && (cnp->cn_flags & MAKEENTRY) != 0 && tmpfs_use_nc(dvp))
271 		cache_enter(dvp, *vpp, cnp);
272 	return (error);
273 }
274 
275 static int
276 tmpfs_mknod(struct vop_mknod_args *v)
277 {
278 	struct vnode *dvp = v->a_dvp;
279 	struct vnode **vpp = v->a_vpp;
280 	struct componentname *cnp = v->a_cnp;
281 	struct vattr *vap = v->a_vap;
282 
283 	if (!VATTR_ISDEV(vap) && vap->va_type != VFIFO)
284 		return (EINVAL);
285 
286 	return (tmpfs_alloc_file(dvp, vpp, vap, cnp, NULL));
287 }
288 
289 struct fileops tmpfs_fnops;
290 
291 static int
292 tmpfs_open(struct vop_open_args *v)
293 {
294 	struct vnode *vp;
295 	struct tmpfs_node *node;
296 	struct file *fp;
297 	int error, mode;
298 
299 	vp = v->a_vp;
300 	mode = v->a_mode;
301 	node = VP_TO_TMPFS_NODE(vp);
302 
303 	/*
304 	 * The file is still active but all its names have been removed
305 	 * (e.g. by a "rmdir $(pwd)").  It cannot be opened any more as
306 	 * it is about to die.
307 	 */
308 	if (node->tn_links < 1)
309 		return (ENOENT);
310 
311 	/* If the file is marked append-only, deny write requests. */
312 	if (node->tn_flags & APPEND && (mode & (FWRITE | O_APPEND)) == FWRITE)
313 		error = EPERM;
314 	else {
315 		error = 0;
316 		/* For regular files, the call below is nop. */
317 		KASSERT(vp->v_type != VREG || (node->tn_reg.tn_aobj->flags &
318 		    OBJ_DEAD) == 0, ("dead object"));
319 		vnode_create_vobject(vp, node->tn_size, v->a_td);
320 	}
321 
322 	fp = v->a_fp;
323 	MPASS(fp == NULL || fp->f_data == NULL);
324 	if (error == 0 && fp != NULL && vp->v_type == VREG) {
325 		tmpfs_ref_node(node);
326 		finit_vnode(fp, mode, node, &tmpfs_fnops);
327 	}
328 
329 	return (error);
330 }
331 
332 static int
333 tmpfs_close(struct vop_close_args *v)
334 {
335 	struct vnode *vp = v->a_vp;
336 
337 	/* Update node times. */
338 	tmpfs_update(vp);
339 
340 	return (0);
341 }
342 
343 int
344 tmpfs_fo_close(struct file *fp, struct thread *td)
345 {
346 	struct tmpfs_node *node;
347 
348 	node = fp->f_data;
349 	if (node != NULL) {
350 		MPASS(node->tn_type == VREG);
351 		tmpfs_free_node(node->tn_reg.tn_tmp, node);
352 	}
353 	return (vnops.fo_close(fp, td));
354 }
355 
356 /*
357  * VOP_FPLOOKUP_VEXEC routines are subject to special circumstances, see
358  * the comment above cache_fplookup for details.
359  */
360 int
361 tmpfs_fplookup_vexec(struct vop_fplookup_vexec_args *v)
362 {
363 	struct vnode *vp;
364 	struct tmpfs_node *node;
365 	struct ucred *cred;
366 	mode_t all_x, mode;
367 
368 	vp = v->a_vp;
369 	node = VP_TO_TMPFS_NODE_SMR(vp);
370 	if (__predict_false(node == NULL))
371 		return (EAGAIN);
372 
373 	all_x = S_IXUSR | S_IXGRP | S_IXOTH;
374 	mode = atomic_load_short(&node->tn_mode);
375 	if (__predict_true((mode & all_x) == all_x))
376 		return (0);
377 
378 	cred = v->a_cred;
379 	return (vaccess_vexec_smr(mode, node->tn_uid, node->tn_gid, cred));
380 }
381 
382 static int
383 tmpfs_access_locked(struct vnode *vp, struct tmpfs_node *node,
384     accmode_t accmode, struct ucred *cred)
385 {
386 #ifdef INVARIANTS
387 	if (!mtx_owned(TMPFS_NODE_MTX(node))) {
388 		ASSERT_VOP_LOCKED(vp,
389 		    "tmpfs_access_locked needs locked vnode or node");
390 	}
391 #endif
392 
393 	if ((accmode & VWRITE) != 0 && (node->tn_flags & IMMUTABLE) != 0)
394 		return (EPERM);
395 	return (vaccess(vp->v_type, node->tn_mode, node->tn_uid, node->tn_gid,
396 	    accmode, cred));
397 }
398 
399 int
400 tmpfs_access(struct vop_access_args *v)
401 {
402 	struct vnode *vp = v->a_vp;
403 	struct ucred *cred = v->a_cred;
404 	struct tmpfs_node *node = VP_TO_TMPFS_NODE(vp);
405 	mode_t all_x = S_IXUSR | S_IXGRP | S_IXOTH;
406 	accmode_t accmode = v->a_accmode;
407 
408 	/*
409 	 * Common case path lookup.
410 	 */
411 	if (__predict_true(accmode == VEXEC &&
412 	    (node->tn_mode & all_x) == all_x))
413 		return (0);
414 
415 	switch (vp->v_type) {
416 	case VDIR:
417 		/* FALLTHROUGH */
418 	case VLNK:
419 		/* FALLTHROUGH */
420 	case VREG:
421 		if ((accmode & VWRITE) != 0 &&
422 		    (vp->v_mount->mnt_flag & MNT_RDONLY) != 0)
423 			return (EROFS);
424 		break;
425 
426 	case VBLK:
427 		/* FALLTHROUGH */
428 	case VCHR:
429 		/* FALLTHROUGH */
430 	case VSOCK:
431 		/* FALLTHROUGH */
432 	case VFIFO:
433 		break;
434 
435 	default:
436 		return (EINVAL);
437 	}
438 
439 	return (tmpfs_access_locked(vp, node, accmode, cred));
440 }
441 
442 int
443 tmpfs_stat(struct vop_stat_args *v)
444 {
445 	struct vnode *vp = v->a_vp;
446 	struct stat *sb = v->a_sb;
447 	struct tmpfs_node *node;
448 	int error;
449 
450 	node = VP_TO_TMPFS_NODE(vp);
451 
452 	tmpfs_update_getattr(vp);
453 
454 	error = vop_stat_helper_pre(v);
455 	if (__predict_false(error))
456 		return (error);
457 
458 	sb->st_dev = vp->v_mount->mnt_stat.f_fsid.val[0];
459 	sb->st_ino = node->tn_id;
460 	sb->st_mode = node->tn_mode | VTTOIF(vp->v_type);
461 	sb->st_nlink = node->tn_links;
462 	sb->st_uid = node->tn_uid;
463 	sb->st_gid = node->tn_gid;
464 	sb->st_rdev = VN_ISDEV(vp) ? node->tn_rdev : NODEV;
465 	sb->st_size = node->tn_size;
466 	sb->st_atim.tv_sec = node->tn_atime.tv_sec;
467 	sb->st_atim.tv_nsec = node->tn_atime.tv_nsec;
468 	sb->st_mtim.tv_sec = node->tn_mtime.tv_sec;
469 	sb->st_mtim.tv_nsec = node->tn_mtime.tv_nsec;
470 	sb->st_ctim.tv_sec = node->tn_ctime.tv_sec;
471 	sb->st_ctim.tv_nsec = node->tn_ctime.tv_nsec;
472 	sb->st_birthtim.tv_sec = node->tn_birthtime.tv_sec;
473 	sb->st_birthtim.tv_nsec = node->tn_birthtime.tv_nsec;
474 	sb->st_blksize = PAGE_SIZE;
475 	sb->st_flags = node->tn_flags;
476 	sb->st_gen = node->tn_gen;
477 	sb->st_filerev = 0;
478 	if (vp->v_type == VREG) {
479 #ifdef __ILP32__
480 		vm_object_t obj = node->tn_reg.tn_aobj;
481 
482 		/* Handle torn read */
483 		VM_OBJECT_RLOCK(obj);
484 #endif
485 		sb->st_blocks = ptoa(node->tn_reg.tn_pages);
486 #ifdef __ILP32__
487 		VM_OBJECT_RUNLOCK(obj);
488 #endif
489 	} else {
490 		sb->st_blocks = node->tn_size;
491 	}
492 	sb->st_blocks /= S_BLKSIZE;
493 	return (vop_stat_helper_post(v, error));
494 }
495 
496 int
497 tmpfs_getattr(struct vop_getattr_args *v)
498 {
499 	struct vnode *vp = v->a_vp;
500 	struct vattr *vap = v->a_vap;
501 	struct tmpfs_node *node;
502 
503 	node = VP_TO_TMPFS_NODE(vp);
504 
505 	tmpfs_update_getattr(vp);
506 
507 	vap->va_type = vp->v_type;
508 	vap->va_mode = node->tn_mode;
509 	vap->va_nlink = node->tn_links;
510 	vap->va_uid = node->tn_uid;
511 	vap->va_gid = node->tn_gid;
512 	vap->va_fsid = vp->v_mount->mnt_stat.f_fsid.val[0];
513 	vap->va_fileid = node->tn_id;
514 	vap->va_size = node->tn_size;
515 	vap->va_blocksize = PAGE_SIZE;
516 	vap->va_atime = node->tn_atime;
517 	vap->va_mtime = node->tn_mtime;
518 	vap->va_ctime = node->tn_ctime;
519 	vap->va_birthtime = node->tn_birthtime;
520 	vap->va_gen = node->tn_gen;
521 	vap->va_flags = node->tn_flags;
522 	vap->va_rdev = VN_ISDEV(vp) ? node->tn_rdev : NODEV;
523 	if (vp->v_type == VREG) {
524 #ifdef __ILP32__
525 		vm_object_t obj = node->tn_reg.tn_aobj;
526 
527 		VM_OBJECT_RLOCK(obj);
528 #endif
529 		vap->va_bytes = ptoa(node->tn_reg.tn_pages);
530 #ifdef __ILP32__
531 		VM_OBJECT_RUNLOCK(obj);
532 #endif
533 	} else {
534 		vap->va_bytes = node->tn_size;
535 	}
536 	vap->va_filerev = 0;
537 
538 	return (0);
539 }
540 
541 int
542 tmpfs_setattr(struct vop_setattr_args *v)
543 {
544 	struct vnode *vp = v->a_vp;
545 	struct vattr *vap = v->a_vap;
546 	struct ucred *cred = v->a_cred;
547 	struct thread *td = curthread;
548 
549 	int error;
550 
551 	ASSERT_VOP_IN_SEQC(vp);
552 
553 	error = 0;
554 
555 	/* Abort if any unsettable attribute is given. */
556 	if (vap->va_type != VNON ||
557 	    vap->va_nlink != VNOVAL ||
558 	    vap->va_fsid != VNOVAL ||
559 	    vap->va_fileid != VNOVAL ||
560 	    vap->va_blocksize != VNOVAL ||
561 	    vap->va_gen != VNOVAL ||
562 	    vap->va_rdev != VNOVAL ||
563 	    vap->va_bytes != VNOVAL)
564 		error = EINVAL;
565 
566 	if (error == 0 && (vap->va_flags != VNOVAL))
567 		error = tmpfs_chflags(vp, vap->va_flags, cred, td);
568 
569 	if (error == 0 && (vap->va_size != VNOVAL))
570 		error = tmpfs_chsize(vp, vap->va_size, cred, td);
571 
572 	if (error == 0 && (vap->va_uid != VNOVAL || vap->va_gid != VNOVAL))
573 		error = tmpfs_chown(vp, vap->va_uid, vap->va_gid, cred, td);
574 
575 	if (error == 0 && (vap->va_mode != (mode_t)VNOVAL))
576 		error = tmpfs_chmod(vp, vap->va_mode, cred, td);
577 
578 	if (error == 0 && ((vap->va_atime.tv_sec != VNOVAL &&
579 	    vap->va_atime.tv_nsec != VNOVAL) ||
580 	    (vap->va_mtime.tv_sec != VNOVAL &&
581 	    vap->va_mtime.tv_nsec != VNOVAL) ||
582 	    (vap->va_birthtime.tv_sec != VNOVAL &&
583 	    vap->va_birthtime.tv_nsec != VNOVAL)))
584 		error = tmpfs_chtimes(vp, vap, cred, td);
585 
586 	/*
587 	 * Update the node times.  We give preference to the error codes
588 	 * generated by this function rather than the ones that may arise
589 	 * from tmpfs_update.
590 	 */
591 	tmpfs_update(vp);
592 
593 	return (error);
594 }
595 
596 static int
597 tmpfs_read(struct vop_read_args *v)
598 {
599 	struct vnode *vp;
600 	struct uio *uio;
601 	struct tmpfs_node *node;
602 
603 	vp = v->a_vp;
604 	if (vp->v_type != VREG)
605 		return (EISDIR);
606 	uio = v->a_uio;
607 	if (uio->uio_offset < 0)
608 		return (EINVAL);
609 	node = VP_TO_TMPFS_NODE(vp);
610 	tmpfs_set_accessed(VFS_TO_TMPFS(vp->v_mount), node);
611 	return (uiomove_object(node->tn_reg.tn_aobj, node->tn_size, uio));
612 }
613 
614 static int
615 tmpfs_read_pgcache(struct vop_read_pgcache_args *v)
616 {
617 	struct vnode *vp;
618 	struct tmpfs_node *node;
619 	vm_object_t object;
620 	off_t size;
621 	int error;
622 
623 	vp = v->a_vp;
624 	VNPASS((vn_irflag_read(vp) & VIRF_PGREAD) != 0, vp);
625 
626 	if (v->a_uio->uio_offset < 0)
627 		return (EINVAL);
628 
629 	error = EJUSTRETURN;
630 	vfs_smr_enter();
631 
632 	node = VP_TO_TMPFS_NODE_SMR(vp);
633 	if (node == NULL)
634 		goto out_smr;
635 	MPASS(node->tn_type == VREG);
636 	MPASS(node->tn_refcount >= 1);
637 	object = node->tn_reg.tn_aobj;
638 	if (object == NULL)
639 		goto out_smr;
640 
641 	MPASS(object->type == tmpfs_pager_type);
642 	MPASS((object->flags & (OBJ_ANON | OBJ_DEAD | OBJ_SWAP)) ==
643 	    OBJ_SWAP);
644 	if (!VN_IS_DOOMED(vp)) {
645 		/* size cannot become shorter due to rangelock. */
646 		size = node->tn_size;
647 		tmpfs_set_accessed(node->tn_reg.tn_tmp, node);
648 		vfs_smr_exit();
649 		error = uiomove_object(object, size, v->a_uio);
650 		return (error);
651 	}
652 out_smr:
653 	vfs_smr_exit();
654 	return (error);
655 }
656 
657 static int
658 tmpfs_write(struct vop_write_args *v)
659 {
660 	struct vnode *vp;
661 	struct uio *uio;
662 	struct tmpfs_node *node;
663 	off_t oldsize;
664 	ssize_t r;
665 	int error, ioflag;
666 	mode_t newmode;
667 
668 	vp = v->a_vp;
669 	uio = v->a_uio;
670 	ioflag = v->a_ioflag;
671 	error = 0;
672 	node = VP_TO_TMPFS_NODE(vp);
673 	oldsize = node->tn_size;
674 
675 	if (uio->uio_offset < 0 || vp->v_type != VREG)
676 		return (EINVAL);
677 	if (uio->uio_resid == 0)
678 		return (0);
679 	if (ioflag & IO_APPEND)
680 		uio->uio_offset = node->tn_size;
681 	error = vn_rlimit_fsizex(vp, uio, VFS_TO_TMPFS(vp->v_mount)->
682 	    tm_maxfilesize, &r, uio->uio_td);
683 	if (error != 0) {
684 		vn_rlimit_fsizex_res(uio, r);
685 		return (error);
686 	}
687 
688 	if (uio->uio_offset + uio->uio_resid > node->tn_size) {
689 		error = tmpfs_reg_resize(vp, uio->uio_offset + uio->uio_resid,
690 		    FALSE);
691 		if (error != 0)
692 			goto out;
693 	}
694 
695 	error = uiomove_object(node->tn_reg.tn_aobj, node->tn_size, uio);
696 	node->tn_status |= TMPFS_NODE_MODIFIED | TMPFS_NODE_CHANGED;
697 	node->tn_accessed = true;
698 	if (node->tn_mode & (S_ISUID | S_ISGID)) {
699 		if (priv_check_cred(v->a_cred, PRIV_VFS_RETAINSUGID)) {
700 			newmode = node->tn_mode & ~(S_ISUID | S_ISGID);
701 			vn_seqc_write_begin(vp);
702 			atomic_store_short(&node->tn_mode, newmode);
703 			vn_seqc_write_end(vp);
704 		}
705 	}
706 	if (error != 0)
707 		(void)tmpfs_reg_resize(vp, oldsize, TRUE);
708 
709 out:
710 	MPASS(IMPLIES(error == 0, uio->uio_resid == 0));
711 	MPASS(IMPLIES(error != 0, oldsize == node->tn_size));
712 
713 	vn_rlimit_fsizex_res(uio, r);
714 	return (error);
715 }
716 
717 static int
718 tmpfs_deallocate(struct vop_deallocate_args *v)
719 {
720 	return (tmpfs_reg_punch_hole(v->a_vp, v->a_offset, v->a_len));
721 }
722 
723 static int
724 tmpfs_fsync(struct vop_fsync_args *v)
725 {
726 	struct vnode *vp = v->a_vp;
727 
728 	tmpfs_check_mtime(vp);
729 	tmpfs_update(vp);
730 
731 	return (0);
732 }
733 
734 static int
735 tmpfs_remove(struct vop_remove_args *v)
736 {
737 	struct vnode *dvp = v->a_dvp;
738 	struct vnode *vp = v->a_vp;
739 
740 	int error;
741 	struct tmpfs_dirent *de;
742 	struct tmpfs_mount *tmp;
743 	struct tmpfs_node *dnode;
744 	struct tmpfs_node *node;
745 
746 	if (vp->v_type == VDIR) {
747 		error = EISDIR;
748 		goto out;
749 	}
750 
751 	dnode = VP_TO_TMPFS_DIR(dvp);
752 	node = VP_TO_TMPFS_NODE(vp);
753 	tmp = VFS_TO_TMPFS(vp->v_mount);
754 	de = tmpfs_dir_lookup(dnode, node, v->a_cnp);
755 	MPASS(de != NULL);
756 
757 	/* Files marked as immutable or append-only cannot be deleted. */
758 	if ((node->tn_flags & (IMMUTABLE | APPEND | NOUNLINK)) ||
759 	    (dnode->tn_flags & APPEND)) {
760 		error = EPERM;
761 		goto out;
762 	}
763 
764 	/* Remove the entry from the directory; as it is a file, we do not
765 	 * have to change the number of hard links of the directory. */
766 	tmpfs_dir_detach(dvp, de);
767 	if (v->a_cnp->cn_flags & DOWHITEOUT)
768 		tmpfs_dir_whiteout_add(dvp, v->a_cnp);
769 
770 	/* Free the directory entry we just deleted.  Note that the node
771 	 * referred by it will not be removed until the vnode is really
772 	 * reclaimed. */
773 	tmpfs_free_dirent(tmp, de);
774 
775 	node->tn_status |= TMPFS_NODE_CHANGED;
776 	node->tn_accessed = true;
777 	error = 0;
778 
779 out:
780 	return (error);
781 }
782 
783 static int
784 tmpfs_link(struct vop_link_args *v)
785 {
786 	struct vnode *dvp = v->a_tdvp;
787 	struct vnode *vp = v->a_vp;
788 	struct componentname *cnp = v->a_cnp;
789 
790 	int error;
791 	struct tmpfs_dirent *de;
792 	struct tmpfs_node *node;
793 
794 	MPASS(dvp != vp); /* XXX When can this be false? */
795 	node = VP_TO_TMPFS_NODE(vp);
796 
797 	/* Ensure that we do not overflow the maximum number of links imposed
798 	 * by the system. */
799 	MPASS(node->tn_links <= TMPFS_LINK_MAX);
800 	if (node->tn_links == TMPFS_LINK_MAX) {
801 		error = EMLINK;
802 		goto out;
803 	}
804 
805 	/* We cannot create links of files marked immutable or append-only. */
806 	if (node->tn_flags & (IMMUTABLE | APPEND)) {
807 		error = EPERM;
808 		goto out;
809 	}
810 
811 	/* Allocate a new directory entry to represent the node. */
812 	error = tmpfs_alloc_dirent(VFS_TO_TMPFS(vp->v_mount), node,
813 	    cnp->cn_nameptr, cnp->cn_namelen, &de);
814 	if (error != 0)
815 		goto out;
816 
817 	/* Insert the new directory entry into the appropriate directory. */
818 	if (cnp->cn_flags & ISWHITEOUT)
819 		tmpfs_dir_whiteout_remove(dvp, cnp);
820 	tmpfs_dir_attach(dvp, de);
821 
822 	/* vp link count has changed, so update node times. */
823 	node->tn_status |= TMPFS_NODE_CHANGED;
824 	tmpfs_update(vp);
825 
826 	error = 0;
827 
828 out:
829 	return (error);
830 }
831 
832 /*
833  * We acquire all but fdvp locks using non-blocking acquisitions.  If we
834  * fail to acquire any lock in the path we will drop all held locks,
835  * acquire the new lock in a blocking fashion, and then release it and
836  * restart the rename.  This acquire/release step ensures that we do not
837  * spin on a lock waiting for release.  On error release all vnode locks
838  * and decrement references the way tmpfs_rename() would do.
839  */
840 static int
841 tmpfs_rename_relock(struct vnode *fdvp, struct vnode **fvpp,
842     struct vnode *tdvp, struct vnode **tvpp,
843     struct componentname *fcnp, struct componentname *tcnp)
844 {
845 	struct vnode *nvp;
846 	struct mount *mp;
847 	struct tmpfs_dirent *de;
848 	int error, restarts = 0;
849 
850 	VOP_UNLOCK(tdvp);
851 	if (*tvpp != NULL && *tvpp != tdvp)
852 		VOP_UNLOCK(*tvpp);
853 	mp = fdvp->v_mount;
854 
855 relock:
856 	restarts += 1;
857 	error = vn_lock(fdvp, LK_EXCLUSIVE);
858 	if (error)
859 		goto releout;
860 	if (vn_lock(tdvp, LK_EXCLUSIVE | LK_NOWAIT) != 0) {
861 		VOP_UNLOCK(fdvp);
862 		error = vn_lock(tdvp, LK_EXCLUSIVE);
863 		if (error)
864 			goto releout;
865 		VOP_UNLOCK(tdvp);
866 		goto relock;
867 	}
868 	/*
869 	 * Re-resolve fvp to be certain it still exists and fetch the
870 	 * correct vnode.
871 	 */
872 	de = tmpfs_dir_lookup(VP_TO_TMPFS_DIR(fdvp), NULL, fcnp);
873 	if (de == NULL) {
874 		VOP_UNLOCK(fdvp);
875 		VOP_UNLOCK(tdvp);
876 		if ((fcnp->cn_flags & ISDOTDOT) != 0 ||
877 		    (fcnp->cn_namelen == 1 && fcnp->cn_nameptr[0] == '.'))
878 			error = EINVAL;
879 		else
880 			error = ENOENT;
881 		goto releout;
882 	}
883 	error = tmpfs_alloc_vp(mp, de->td_node, LK_EXCLUSIVE | LK_NOWAIT, &nvp);
884 	if (error != 0) {
885 		VOP_UNLOCK(fdvp);
886 		VOP_UNLOCK(tdvp);
887 		if (error != EBUSY)
888 			goto releout;
889 		error = tmpfs_alloc_vp(mp, de->td_node, LK_EXCLUSIVE, &nvp);
890 		if (error != 0)
891 			goto releout;
892 		VOP_UNLOCK(nvp);
893 		/*
894 		 * Concurrent rename race.
895 		 */
896 		if (nvp == tdvp) {
897 			vrele(nvp);
898 			error = EINVAL;
899 			goto releout;
900 		}
901 		vrele(*fvpp);
902 		*fvpp = nvp;
903 		goto relock;
904 	}
905 	vrele(*fvpp);
906 	*fvpp = nvp;
907 	VOP_UNLOCK(*fvpp);
908 	/*
909 	 * Re-resolve tvp and acquire the vnode lock if present.
910 	 */
911 	de = tmpfs_dir_lookup(VP_TO_TMPFS_DIR(tdvp), NULL, tcnp);
912 	/*
913 	 * If tvp disappeared we just carry on.
914 	 */
915 	if (de == NULL && *tvpp != NULL) {
916 		vrele(*tvpp);
917 		*tvpp = NULL;
918 	}
919 	/*
920 	 * Get the tvp ino if the lookup succeeded.  We may have to restart
921 	 * if the non-blocking acquire fails.
922 	 */
923 	if (de != NULL) {
924 		nvp = NULL;
925 		error = tmpfs_alloc_vp(mp, de->td_node,
926 		    LK_EXCLUSIVE | LK_NOWAIT, &nvp);
927 		if (*tvpp != NULL)
928 			vrele(*tvpp);
929 		*tvpp = nvp;
930 		if (error != 0) {
931 			VOP_UNLOCK(fdvp);
932 			VOP_UNLOCK(tdvp);
933 			if (error != EBUSY)
934 				goto releout;
935 			error = tmpfs_alloc_vp(mp, de->td_node, LK_EXCLUSIVE,
936 			    &nvp);
937 			if (error != 0)
938 				goto releout;
939 			VOP_UNLOCK(nvp);
940 			/*
941 			 * fdvp contains fvp, thus tvp (=fdvp) is not empty.
942 			 */
943 			if (nvp == fdvp) {
944 				error = ENOTEMPTY;
945 				goto releout;
946 			}
947 			goto relock;
948 		}
949 	}
950 	tmpfs_rename_restarts += restarts;
951 
952 	return (0);
953 
954 releout:
955 	vrele(fdvp);
956 	vrele(*fvpp);
957 	vrele(tdvp);
958 	if (*tvpp != NULL)
959 		vrele(*tvpp);
960 	tmpfs_rename_restarts += restarts;
961 
962 	return (error);
963 }
964 
965 static int
966 tmpfs_rename_check_parent(struct tmpfs_mount *tmp, struct tmpfs_node *fdnode,
967     struct vnode *fvp, struct tmpfs_node *fnode, struct tmpfs_dirent *de,
968     struct tmpfs_node *tdnode, struct ucred *tcred)
969 {
970 	struct tmpfs_node *n;
971 	int error;
972 
973 	TMPFS_NODE_LOCK(fnode);
974 	error = tmpfs_access_locked(fvp, fnode, VWRITE, tcred);
975 	TMPFS_NODE_UNLOCK(fnode);
976 	if (error != 0)
977 		return (error);
978 
979 	/*
980 	 * Ensure the target directory is not a child of the
981 	 * directory being moved.  Otherwise, we'd end up
982 	 * with stale nodes.
983 	 *
984 	 * TMPFS_LOCK guarantees that no nodes are freed while
985 	 * traversing the list. Nodes can only be marked as
986 	 * removed: tn_parent == NULL.
987 	 */
988 	n = tdnode;
989 	TMPFS_LOCK(tmp);
990 	TMPFS_NODE_LOCK(n);
991 	while (n != n->tn_dir.tn_parent) {
992 		struct tmpfs_node *parent;
993 
994 		if (n == fnode) {
995 			TMPFS_NODE_UNLOCK(n);
996 			TMPFS_UNLOCK(tmp);
997 			return (EINVAL);
998 		}
999 		parent = n->tn_dir.tn_parent;
1000 		TMPFS_NODE_UNLOCK(n);
1001 		if (parent == NULL) {
1002 			n = NULL;
1003 			break;
1004 		}
1005 		TMPFS_NODE_LOCK(parent);
1006 		if (parent->tn_dir.tn_parent == NULL) {
1007 			TMPFS_NODE_UNLOCK(parent);
1008 			n = NULL;
1009 			break;
1010 		}
1011 		n = parent;
1012 	}
1013 	TMPFS_UNLOCK(tmp);
1014 	if (n == NULL)
1015 		return (EINVAL);
1016 
1017 	TMPFS_NODE_UNLOCK(n);
1018 
1019 	return (0);
1020 }
1021 
1022 static void
1023 tmpfs_rename_set_parent(struct tmpfs_node *fdnode, struct tmpfs_node *fnode,
1024     struct tmpfs_dirent *de, struct tmpfs_node *tdnode)
1025 {
1026 	/* Adjust the parent pointer. */
1027 	TMPFS_VALIDATE_DIR(fnode);
1028 	TMPFS_NODE_LOCK(de->td_node);
1029 	de->td_node->tn_dir.tn_parent = tdnode;
1030 	TMPFS_NODE_UNLOCK(de->td_node);
1031 
1032 	/*
1033 	 * As a result of changing the target of the '..'
1034 	 * entry, the link count of the source and target
1035 	 * directories has to be adjusted.
1036 	 */
1037 	TMPFS_NODE_LOCK(tdnode);
1038 	TMPFS_ASSERT_LOCKED(tdnode);
1039 	tdnode->tn_links++;
1040 	TMPFS_NODE_UNLOCK(tdnode);
1041 
1042 	TMPFS_NODE_LOCK(fdnode);
1043 	TMPFS_ASSERT_LOCKED(fdnode);
1044 	fdnode->tn_links--;
1045 	TMPFS_NODE_UNLOCK(fdnode);
1046 }
1047 
1048 static int
1049 tmpfs_rename(struct vop_rename_args *v)
1050 {
1051 	struct vnode *fdvp = v->a_fdvp;
1052 	struct vnode *fvp = v->a_fvp;
1053 	struct componentname *fcnp = v->a_fcnp;
1054 	struct vnode *tdvp = v->a_tdvp;
1055 	struct vnode *tvp = v->a_tvp;
1056 	struct componentname *tcnp = v->a_tcnp;
1057 	char *newname;
1058 	struct tmpfs_dirent *de, *tde;
1059 	struct tmpfs_mount *tmp;
1060 	struct tmpfs_node *fdnode;
1061 	struct tmpfs_node *fnode;
1062 	struct tmpfs_node *tnode;
1063 	struct tmpfs_node *tdnode;
1064 	int error;
1065 	bool want_seqc_end;
1066 	bool exchange;
1067 
1068 	want_seqc_end = false;
1069 	newname = NULL;
1070 	error = 0;
1071 
1072 	/*
1073 	 * Disallow cross-device renames.
1074 	 * XXX Why isn't this done by the caller?
1075 	 */
1076 	if (fvp->v_mount != tdvp->v_mount ||
1077 	    (tvp != NULL && fvp->v_mount != tvp->v_mount)) {
1078 		error = EXDEV;
1079 		goto out;
1080 	}
1081 
1082 	if ((v->a_flags & ~(AT_RENAME_NOREPLACE | AT_RENAME_EXCHANGE)) != 0) {
1083 		error = EOPNOTSUPP;
1084 		goto out;
1085 	}
1086 
1087 	/* If source and target are the same file, there is nothing to do. */
1088 	if (fvp == tvp)
1089 		goto out;
1090 	exchange = (v->a_flags & AT_RENAME_EXCHANGE) != 0;
1091 
1092 	/*
1093 	 * If we need to move the directory between entries, lock the
1094 	 * source so that we can safely operate on it.
1095 	 */
1096 	if (fdvp != tdvp && fdvp != tvp) {
1097 		if (vn_lock(fdvp, LK_EXCLUSIVE | LK_NOWAIT) != 0) {
1098 			error = tmpfs_rename_relock(fdvp, &fvp, tdvp, &tvp,
1099 			    fcnp, tcnp);
1100 			if (error != 0)
1101 				return (error);
1102 			ASSERT_VOP_ELOCKED(fdvp,
1103 			    "tmpfs_rename: fdvp not locked");
1104 			ASSERT_VOP_ELOCKED(tdvp,
1105 			    "tmpfs_rename: tdvp not locked");
1106 			if (tvp != NULL) {
1107 				ASSERT_VOP_ELOCKED(tvp,
1108 				    "tmpfs_rename: tvp not locked");
1109 				if ((v->a_flags & AT_RENAME_NOREPLACE) != 0) {
1110 					error = EEXIST;
1111 					goto out_locked;
1112 				}
1113 			}
1114 			if (fvp == tvp) {
1115 				error = 0;
1116 				goto out_locked;
1117 			}
1118 		}
1119 	}
1120 
1121 	/*
1122 	 * Avoid manipulating '.' and '..' entries.
1123 	 */
1124 	if ((fcnp->cn_flags & ISDOTDOT) != 0 ||
1125 	    (fcnp->cn_namelen == 1 && fcnp->cn_nameptr[0] == '.')) {
1126 		error = EINVAL;
1127 		goto out_locked;
1128 	}
1129 
1130 	if (tvp != NULL)
1131 		vn_seqc_write_begin(tvp);
1132 	vn_seqc_write_begin(tdvp);
1133 	vn_seqc_write_begin(fvp);
1134 	vn_seqc_write_begin(fdvp);
1135 	want_seqc_end = true;
1136 
1137 	tmp = VFS_TO_TMPFS(tdvp->v_mount);
1138 	tdnode = VP_TO_TMPFS_DIR(tdvp);
1139 	tnode = (tvp == NULL) ? NULL : VP_TO_TMPFS_NODE(tvp);
1140 	fdnode = VP_TO_TMPFS_DIR(fdvp);
1141 	fnode = VP_TO_TMPFS_NODE(fvp);
1142 	de = tmpfs_dir_lookup(fdnode, fnode, fcnp);
1143 	if (exchange)
1144 		tde = tmpfs_dir_lookup(tdnode, tnode, tcnp);
1145 
1146 	/*
1147 	 * Entry can disappear before we lock fdvp.
1148 	 */
1149 	if (de == NULL) {
1150 		if ((fcnp->cn_flags & ISDOTDOT) != 0 ||
1151 		    (fcnp->cn_namelen == 1 && fcnp->cn_nameptr[0] == '.'))
1152 			error = EINVAL;
1153 		else
1154 			error = ENOENT;
1155 		goto out_locked;
1156 	}
1157 	MPASS(de->td_node == fnode);
1158 	if (exchange) {
1159 		if (tde == NULL) {
1160 			error = ENOENT;
1161 			goto out_locked;
1162 		}
1163 		MPASS(tde->td_node == tnode);
1164 	}
1165 
1166 	/*
1167 	 * If re-naming a directory to another preexisting directory
1168 	 * ensure that the target directory is empty so that its
1169 	 * removal causes no side effects.
1170 	 * Kern_rename guarantees the destination to be a directory
1171 	 * if the source is one.
1172 	 */
1173 	if (tvp != NULL) {
1174 		MPASS(tnode != NULL);
1175 
1176 		if ((tnode->tn_flags & (NOUNLINK | IMMUTABLE | APPEND)) ||
1177 		    (tdnode->tn_flags & (APPEND | IMMUTABLE))) {
1178 			error = EPERM;
1179 			goto out_locked;
1180 		}
1181 
1182 		if (!exchange) {
1183 			if (fnode->tn_type == VDIR && tnode->tn_type == VDIR) {
1184 				if (tnode->tn_size != 0 &&
1185 				    ((tcnp->cn_flags & IGNOREWHITEOUT) == 0 ||
1186 				    tnode->tn_size >
1187 				    tnode->tn_dir.tn_wht_size)) {
1188 					error = ENOTEMPTY;
1189 					goto out_locked;
1190 				}
1191 			} else if (fnode->tn_type == VDIR &&
1192 			    tnode->tn_type != VDIR) {
1193 				error = ENOTDIR;
1194 				goto out_locked;
1195 			} else if (fnode->tn_type != VDIR &&
1196 			    tnode->tn_type == VDIR) {
1197 				error = EISDIR;
1198 				goto out_locked;
1199 			} else {
1200 				MPASS(fnode->tn_type != VDIR &&
1201 				    tnode->tn_type != VDIR);
1202 			}
1203 		}
1204 	}
1205 
1206 	if ((fnode->tn_flags & (NOUNLINK | IMMUTABLE | APPEND)) != 0 ||
1207 	    (fdnode->tn_flags & (APPEND | IMMUTABLE)) != 0) {
1208 		error = EPERM;
1209 		goto out_locked;
1210 	}
1211 
1212 	/*
1213 	 * Ensure that we have enough memory to hold the new name, if it
1214 	 * has to be changed.
1215 	 */
1216 	if (!exchange && (fcnp->cn_namelen != tcnp->cn_namelen ||
1217 	    bcmp(fcnp->cn_nameptr, tcnp->cn_nameptr, fcnp->cn_namelen) != 0))
1218 		newname = malloc(tcnp->cn_namelen, M_TMPFSNAME, M_WAITOK);
1219 
1220 	/*
1221 	 * If the node is being moved to another directory, we have to do
1222 	 * the move.
1223 	 */
1224 	if (fdnode != tdnode) {
1225 		/*
1226 		 * In case we are moving a directory, we have to adjust its
1227 		 * parent to point to the new parent.
1228 		 */
1229 		if (fnode->tn_type == VDIR) {
1230 			error = tmpfs_rename_check_parent(tmp, fdnode, fvp,
1231 			    fnode, de, tdnode, tcnp->cn_cred);
1232 			if (error != 0) {
1233 				free(newname, M_TMPFSNAME);
1234 				goto out_locked;
1235 			}
1236 		}
1237 		if (exchange && tnode->tn_type == VDIR) {
1238 			MPASS(newname == NULL);
1239 			error = tmpfs_rename_check_parent(tmp, tdnode, tvp,
1240 			    tnode, tde, fdnode, fcnp->cn_cred);
1241 			if (error != 0)
1242 				goto out_locked;
1243 		}
1244 		if (fnode->tn_type == VDIR)
1245 			tmpfs_rename_set_parent(fdnode, fnode, de, tdnode);
1246 		if (exchange && tnode->tn_type == VDIR)
1247 			tmpfs_rename_set_parent(tdnode, tnode, tde, fdnode);
1248 	}
1249 	if (exchange) {
1250 		de->td_node = tnode;
1251 		tde->td_node = fnode;
1252 		if (tmpfs_use_nc(fvp)) {
1253 			cache_purge(fvp);
1254 			cache_purge(tvp);
1255 			cache_enter(tdvp, fvp, tcnp);
1256 			cache_enter(fdvp, tvp, fcnp);
1257 		}
1258 		fdnode->tn_status |= TMPFS_NODE_MODIFIED | TMPFS_NODE_CHANGED;
1259 		fdnode->tn_accessed = true;
1260 		tmpfs_update(fdvp);
1261 		if (fdvp != tdvp) {
1262 			tdnode->tn_status |= TMPFS_NODE_MODIFIED |
1263 			    TMPFS_NODE_CHANGED;
1264 			tdnode->tn_accessed = true;
1265 			tmpfs_update(tdvp);
1266 		}
1267 		goto out_locked;
1268 	}
1269 
1270 	/*
1271 	 * Do the move: just remove the entry from the source directory
1272 	 * and insert it into the target one.
1273 	 */
1274 	tmpfs_dir_detach(fdvp, de);
1275 
1276 	if (fcnp->cn_flags & DOWHITEOUT)
1277 		tmpfs_dir_whiteout_add(fdvp, fcnp);
1278 	if (tcnp->cn_flags & ISWHITEOUT)
1279 		tmpfs_dir_whiteout_remove(tdvp, tcnp);
1280 
1281 	/*
1282 	 * If the name has changed, we need to make it effective by changing
1283 	 * it in the directory entry.
1284 	 */
1285 	if (newname != NULL) {
1286 		MPASS(tcnp->cn_namelen <= MAXNAMLEN);
1287 
1288 		free(de->ud.td_name, M_TMPFSNAME);
1289 		de->ud.td_name = newname;
1290 		tmpfs_dirent_init(de, tcnp->cn_nameptr, tcnp->cn_namelen);
1291 
1292 		fnode->tn_status |= TMPFS_NODE_CHANGED;
1293 		tdnode->tn_status |= TMPFS_NODE_MODIFIED;
1294 	}
1295 
1296 	/*
1297 	 * If we are overwriting an entry, we have to remove the old one
1298 	 * from the target directory.
1299 	 */
1300 	if (tvp != NULL) {
1301 		struct tmpfs_dirent *tde;
1302 
1303 		/* Remove the old entry from the target directory. */
1304 		tde = tmpfs_dir_lookup(tdnode, tnode, tcnp);
1305 		tmpfs_dir_detach(tdvp, tde);
1306 
1307 		/*
1308 		 * If we are overwriting a directory, per the ENOTEMPTY check
1309 		 * above it must either be empty or contain only whiteout
1310 		 * entries.  In the latter case (which can only happen if
1311 		 * IGNOREWHITEOUT was passed in tcnp->cn_flags), clear the
1312 		 * whiteout entries to avoid leaking memory.
1313 		 */
1314 		if (tnode->tn_type == VDIR && tnode->tn_size > 0)
1315 			tmpfs_dir_clear_whiteouts(tvp);
1316 
1317 		/* Update node's ctime because of possible hardlinks. */
1318 		tnode->tn_status |= TMPFS_NODE_CHANGED;
1319 		tmpfs_update(tvp);
1320 
1321 		/*
1322 		 * Free the directory entry we just deleted.  Note that the
1323 		 * node referred by it will not be removed until the vnode is
1324 		 * really reclaimed.
1325 		 */
1326 		tmpfs_free_dirent(VFS_TO_TMPFS(tvp->v_mount), tde);
1327 	}
1328 
1329 	tmpfs_dir_attach(tdvp, de);
1330 
1331 	if (tmpfs_use_nc(fvp)) {
1332 		cache_vop_rename(fdvp, fvp, tdvp, tvp, fcnp, tcnp);
1333 	}
1334 
1335 	error = 0;
1336 
1337 out_locked:
1338 	if (fdvp != tdvp && fdvp != tvp)
1339 		VOP_UNLOCK(fdvp);
1340 
1341 out:
1342 	if (want_seqc_end) {
1343 		if (tvp != NULL)
1344 			vn_seqc_write_end(tvp);
1345 		vn_seqc_write_end(tdvp);
1346 		vn_seqc_write_end(fvp);
1347 		vn_seqc_write_end(fdvp);
1348 	}
1349 
1350 	/*
1351 	 * Release target nodes.
1352 	 * XXX: I don't understand when tdvp can be the same as tvp, but
1353 	 * other code takes care of this...
1354 	 */
1355 	if (tdvp == tvp)
1356 		vrele(tdvp);
1357 	else
1358 		vput(tdvp);
1359 	if (tvp != NULL)
1360 		vput(tvp);
1361 
1362 	/* Release source nodes. */
1363 	vrele(fdvp);
1364 	vrele(fvp);
1365 
1366 	return (error);
1367 }
1368 
1369 static int
1370 tmpfs_mkdir(struct vop_mkdir_args *v)
1371 {
1372 	struct vnode *dvp = v->a_dvp;
1373 	struct vnode **vpp = v->a_vpp;
1374 	struct componentname *cnp = v->a_cnp;
1375 	struct vattr *vap = v->a_vap;
1376 
1377 	MPASS(vap->va_type == VDIR);
1378 
1379 	return (tmpfs_alloc_file(dvp, vpp, vap, cnp, NULL));
1380 }
1381 
1382 static int
1383 tmpfs_rmdir(struct vop_rmdir_args *v)
1384 {
1385 	struct vnode *dvp = v->a_dvp;
1386 	struct vnode *vp = v->a_vp;
1387 	struct componentname *cnp = v->a_cnp;
1388 
1389 	int error;
1390 	struct tmpfs_dirent *de;
1391 	struct tmpfs_mount *tmp;
1392 	struct tmpfs_node *dnode;
1393 	struct tmpfs_node *node;
1394 
1395 	tmp = VFS_TO_TMPFS(dvp->v_mount);
1396 	dnode = VP_TO_TMPFS_DIR(dvp);
1397 	node = VP_TO_TMPFS_DIR(vp);
1398 
1399 	/*
1400 	 * Directories with more than two non-whiteout entries ('.' and '..')
1401 	 * cannot be removed.
1402 	 */
1403 	if (node->tn_size != 0 &&
1404 	    ((cnp->cn_flags & IGNOREWHITEOUT) == 0 ||
1405 	    node->tn_size > node->tn_dir.tn_wht_size)) {
1406 		error = ENOTEMPTY;
1407 		goto out;
1408 	}
1409 
1410 	/* Check flags to see if we are allowed to remove the directory. */
1411 	if ((dnode->tn_flags & APPEND)
1412 	    || (node->tn_flags & (NOUNLINK | IMMUTABLE | APPEND))) {
1413 		error = EPERM;
1414 		goto out;
1415 	}
1416 
1417 	/* This invariant holds only if we are not trying to remove "..".
1418 	 * We checked for that above so this is safe now. */
1419 	MPASS(node->tn_dir.tn_parent == dnode);
1420 
1421 	/* Get the directory entry associated with node (vp).  This was
1422 	 * filled by tmpfs_lookup while looking up the entry. */
1423 	de = tmpfs_dir_lookup(dnode, node, cnp);
1424 	MPASS(TMPFS_DIRENT_MATCHES(de,
1425 	    cnp->cn_nameptr,
1426 	    cnp->cn_namelen));
1427 
1428 	/* Detach the directory entry from the directory (dnode). */
1429 	tmpfs_dir_detach(dvp, de);
1430 
1431 	/*
1432 	 * If we are removing a directory, per the ENOTEMPTY check above it
1433 	 * must either be empty or contain only whiteout entries.  In the
1434 	 * latter case (which can only happen if IGNOREWHITEOUT was passed
1435 	 * in cnp->cn_flags), clear the whiteout entries to avoid leaking
1436 	 * memory.
1437 	 */
1438 	if (node->tn_size > 0)
1439 		tmpfs_dir_clear_whiteouts(vp);
1440 
1441 	if (cnp->cn_flags & DOWHITEOUT)
1442 		tmpfs_dir_whiteout_add(dvp, cnp);
1443 
1444 	/* No vnode should be allocated for this entry from this point */
1445 	TMPFS_NODE_LOCK(node);
1446 	node->tn_links--;
1447 	node->tn_dir.tn_parent = NULL;
1448 	node->tn_status |= TMPFS_NODE_CHANGED | TMPFS_NODE_MODIFIED;
1449 	node->tn_accessed = true;
1450 
1451 	TMPFS_NODE_UNLOCK(node);
1452 
1453 	TMPFS_NODE_LOCK(dnode);
1454 	dnode->tn_links--;
1455 	dnode->tn_status |= TMPFS_NODE_CHANGED | TMPFS_NODE_MODIFIED;
1456 	dnode->tn_accessed = true;
1457 	TMPFS_NODE_UNLOCK(dnode);
1458 
1459 	if (tmpfs_use_nc(dvp)) {
1460 		cache_vop_rmdir(dvp, vp);
1461 	}
1462 
1463 	/* Free the directory entry we just deleted.  Note that the node
1464 	 * referred by it will not be removed until the vnode is really
1465 	 * reclaimed. */
1466 	tmpfs_free_dirent(tmp, de);
1467 
1468 	/* Release the deleted vnode (will destroy the node, notify
1469 	 * interested parties and clean it from the cache). */
1470 
1471 	dnode->tn_status |= TMPFS_NODE_CHANGED;
1472 	tmpfs_update(dvp);
1473 
1474 	error = 0;
1475 
1476 out:
1477 	return (error);
1478 }
1479 
1480 static int
1481 tmpfs_symlink(struct vop_symlink_args *v)
1482 {
1483 	struct vnode *dvp = v->a_dvp;
1484 	struct vnode **vpp = v->a_vpp;
1485 	struct componentname *cnp = v->a_cnp;
1486 	struct vattr *vap = v->a_vap;
1487 	const char *target = v->a_target;
1488 
1489 #ifdef notyet /* XXX FreeBSD BUG: kern_symlink is not setting VLNK */
1490 	MPASS(vap->va_type == VLNK);
1491 #else
1492 	vap->va_type = VLNK;
1493 #endif
1494 
1495 	return (tmpfs_alloc_file(dvp, vpp, vap, cnp, target));
1496 }
1497 
1498 static int
1499 tmpfs_readdir(struct vop_readdir_args *va)
1500 {
1501 	struct vnode *vp;
1502 	struct uio *uio;
1503 	struct tmpfs_mount *tm;
1504 	struct tmpfs_node *node;
1505 	uint64_t **cookies;
1506 	int *eofflag, *ncookies;
1507 	ssize_t startresid;
1508 	int error, maxcookies;
1509 
1510 	vp = va->a_vp;
1511 	uio = va->a_uio;
1512 	eofflag = va->a_eofflag;
1513 	cookies = va->a_cookies;
1514 	ncookies = va->a_ncookies;
1515 
1516 	/* This operation only makes sense on directory nodes. */
1517 	if (vp->v_type != VDIR)
1518 		return (ENOTDIR);
1519 
1520 	maxcookies = 0;
1521 	node = VP_TO_TMPFS_DIR(vp);
1522 	tm = VFS_TO_TMPFS(vp->v_mount);
1523 
1524 	startresid = uio->uio_resid;
1525 
1526 	/* Allocate cookies for NFS and compat modules. */
1527 	if (cookies != NULL && ncookies != NULL) {
1528 		maxcookies = howmany(node->tn_size,
1529 		    sizeof(struct tmpfs_dirent)) + 2;
1530 		*cookies = malloc(maxcookies * sizeof(**cookies), M_TEMP,
1531 		    M_WAITOK);
1532 		*ncookies = 0;
1533 	}
1534 
1535 	if (cookies == NULL)
1536 		error = tmpfs_dir_getdents(tm, node, uio, 0, NULL, NULL);
1537 	else
1538 		error = tmpfs_dir_getdents(tm, node, uio, maxcookies, *cookies,
1539 		    ncookies);
1540 
1541 	/* Buffer was filled without hitting EOF. */
1542 	if (error == EJUSTRETURN)
1543 		error = (uio->uio_resid != startresid) ? 0 : EINVAL;
1544 
1545 	if (error != 0 && cookies != NULL && ncookies != NULL) {
1546 		free(*cookies, M_TEMP);
1547 		*cookies = NULL;
1548 		*ncookies = 0;
1549 	}
1550 
1551 	if (eofflag != NULL)
1552 		*eofflag =
1553 		    (error == 0 && uio->uio_offset == TMPFS_DIRCOOKIE_EOF);
1554 
1555 	return (error);
1556 }
1557 
1558 static int
1559 tmpfs_readlink(struct vop_readlink_args *v)
1560 {
1561 	struct vnode *vp = v->a_vp;
1562 	struct uio *uio = v->a_uio;
1563 
1564 	int error;
1565 	struct tmpfs_node *node;
1566 
1567 	MPASS(uio->uio_offset == 0);
1568 	MPASS(vp->v_type == VLNK);
1569 
1570 	node = VP_TO_TMPFS_NODE(vp);
1571 
1572 	error = uiomove(node->tn_link_target, MIN(node->tn_size, uio->uio_resid),
1573 	    uio);
1574 	tmpfs_set_accessed(VFS_TO_TMPFS(vp->v_mount), node);
1575 
1576 	return (error);
1577 }
1578 
1579 /*
1580  * VOP_FPLOOKUP_SYMLINK routines are subject to special circumstances, see
1581  * the comment above cache_fplookup for details.
1582  *
1583  * Check tmpfs_alloc_node for tmpfs-specific synchronisation notes.
1584  */
1585 static int
1586 tmpfs_fplookup_symlink(struct vop_fplookup_symlink_args *v)
1587 {
1588 	struct vnode *vp;
1589 	struct tmpfs_node *node;
1590 	char *symlink;
1591 
1592 	vp = v->a_vp;
1593 	node = VP_TO_TMPFS_NODE_SMR(vp);
1594 	if (__predict_false(node == NULL))
1595 		return (EAGAIN);
1596 	if (!atomic_load_char(&node->tn_link_smr))
1597 		return (EAGAIN);
1598 	symlink = atomic_load_ptr(&node->tn_link_target);
1599 	if (symlink == NULL)
1600 		return (EAGAIN);
1601 
1602 	return (cache_symlink_resolve(v->a_fpl, symlink, node->tn_size));
1603 }
1604 
1605 static int
1606 tmpfs_inactive(struct vop_inactive_args *v)
1607 {
1608 	struct vnode *vp;
1609 	struct tmpfs_node *node;
1610 
1611 	vp = v->a_vp;
1612 	node = VP_TO_TMPFS_NODE(vp);
1613 	if (node->tn_links == 0)
1614 		vrecycle(vp);
1615 	else
1616 		tmpfs_check_mtime(vp);
1617 	return (0);
1618 }
1619 
1620 static int
1621 tmpfs_need_inactive(struct vop_need_inactive_args *ap)
1622 {
1623 	struct vnode *vp;
1624 	struct tmpfs_node *node;
1625 	struct vm_object *obj;
1626 
1627 	vp = ap->a_vp;
1628 	node = VP_TO_TMPFS_NODE(vp);
1629 	if (node->tn_links == 0)
1630 		goto need;
1631 	if (vp->v_type == VREG) {
1632 		obj = vp->v_object;
1633 		if (obj->generation != obj->cleangeneration)
1634 			goto need;
1635 	}
1636 	return (0);
1637 need:
1638 	return (1);
1639 }
1640 
1641 int
1642 tmpfs_reclaim(struct vop_reclaim_args *v)
1643 {
1644 	struct vnode *vp;
1645 	struct tmpfs_mount *tmp;
1646 	struct tmpfs_node *node;
1647 	bool unlock;
1648 
1649 	vp = v->a_vp;
1650 	node = VP_TO_TMPFS_NODE(vp);
1651 	tmp = VFS_TO_TMPFS(vp->v_mount);
1652 
1653 	if (vp->v_type == VREG)
1654 		tmpfs_destroy_vobject(vp, node->tn_reg.tn_aobj);
1655 	vp->v_object = NULL;
1656 
1657 	TMPFS_LOCK(tmp);
1658 	TMPFS_NODE_LOCK(node);
1659 	tmpfs_free_vp(vp);
1660 
1661 	/*
1662 	 * If the node referenced by this vnode was deleted by the user,
1663 	 * we must free its associated data structures (now that the vnode
1664 	 * is being reclaimed).
1665 	 */
1666 	unlock = true;
1667 	if (node->tn_links == 0 &&
1668 	    (node->tn_vpstate & TMPFS_VNODE_ALLOCATING) == 0) {
1669 		node->tn_vpstate = TMPFS_VNODE_DOOMED;
1670 		unlock = !tmpfs_free_node_locked(tmp, node, true);
1671 	}
1672 
1673 	if (unlock) {
1674 		TMPFS_NODE_UNLOCK(node);
1675 		TMPFS_UNLOCK(tmp);
1676 	}
1677 
1678 	MPASS(vp->v_data == NULL);
1679 	return (0);
1680 }
1681 
1682 int
1683 tmpfs_print(struct vop_print_args *v)
1684 {
1685 	struct vnode *vp = v->a_vp;
1686 
1687 	struct tmpfs_node *node;
1688 
1689 	node = VP_TO_TMPFS_NODE(vp);
1690 
1691 	printf("tag VT_TMPFS, tmpfs_node %p, flags 0x%lx, links %jd\n",
1692 	    node, node->tn_flags, (uintmax_t)node->tn_links);
1693 	printf("\tmode 0%o, owner %d, group %d, size %jd, status 0x%x\n",
1694 	    node->tn_mode, node->tn_uid, node->tn_gid,
1695 	    (intmax_t)node->tn_size, node->tn_status);
1696 
1697 	if (vp->v_type == VFIFO)
1698 		fifo_printinfo(vp);
1699 
1700 	printf("\n");
1701 
1702 	return (0);
1703 }
1704 
1705 int
1706 tmpfs_pathconf(struct vop_pathconf_args *v)
1707 {
1708 	struct vnode *vp = v->a_vp;
1709 	int name = v->a_name;
1710 	long *retval = v->a_retval;
1711 
1712 	int error;
1713 
1714 	error = 0;
1715 
1716 	switch (name) {
1717 	case _PC_LINK_MAX:
1718 		*retval = TMPFS_LINK_MAX;
1719 		break;
1720 
1721 	case _PC_SYMLINK_MAX:
1722 		*retval = MAXPATHLEN;
1723 		break;
1724 
1725 	case _PC_NAME_MAX:
1726 		*retval = NAME_MAX;
1727 		break;
1728 
1729 	case _PC_PIPE_BUF:
1730 		if (vp->v_type == VDIR || vp->v_type == VFIFO)
1731 			*retval = PIPE_BUF;
1732 		else
1733 			error = EINVAL;
1734 		break;
1735 
1736 	case _PC_CHOWN_RESTRICTED:
1737 		*retval = 1;
1738 		break;
1739 
1740 	case _PC_NO_TRUNC:
1741 		*retval = 1;
1742 		break;
1743 
1744 	case _PC_SYNC_IO:
1745 		*retval = 1;
1746 		break;
1747 
1748 	case _PC_FILESIZEBITS:
1749 		*retval = 64;
1750 		break;
1751 
1752 	case _PC_MIN_HOLE_SIZE:
1753 		*retval = PAGE_SIZE;
1754 		break;
1755 
1756 	case _PC_HAS_HIDDENSYSTEM:
1757 		*retval = 1;
1758 		break;
1759 
1760 	default:
1761 		error = vop_stdpathconf(v);
1762 	}
1763 
1764 	return (error);
1765 }
1766 
1767 static int
1768 tmpfs_vptofh(struct vop_vptofh_args *ap)
1769 /*
1770 vop_vptofh {
1771 	IN struct vnode *a_vp;
1772 	IN struct fid *a_fhp;
1773 };
1774 */
1775 {
1776 	struct tmpfs_fid_data *const tfd = (struct tmpfs_fid_data *)ap->a_fhp;
1777 	struct tmpfs_node *node;
1778 	_Static_assert(sizeof(struct tmpfs_fid_data) <= sizeof(struct fid),
1779 	    "struct tmpfs_fid_data cannot be larger than struct fid");
1780 
1781 	node = VP_TO_TMPFS_NODE(ap->a_vp);
1782 	tfd->tfd_len = sizeof(*tfd);
1783 	tfd->tfd_gen = node->tn_gen;
1784 	tfd->tfd_id = node->tn_id;
1785 
1786 	return (0);
1787 }
1788 
1789 static int
1790 tmpfs_whiteout(struct vop_whiteout_args *ap)
1791 {
1792 	struct vnode *dvp = ap->a_dvp;
1793 	struct componentname *cnp = ap->a_cnp;
1794 	struct tmpfs_dirent *de;
1795 
1796 	switch (ap->a_flags) {
1797 	case LOOKUP:
1798 		return (0);
1799 	case CREATE:
1800 		de = tmpfs_dir_lookup(VP_TO_TMPFS_DIR(dvp), NULL, cnp);
1801 		if (de != NULL)
1802 			return (de->td_node == NULL ? 0 : EEXIST);
1803 		return (tmpfs_dir_whiteout_add(dvp, cnp));
1804 	case DELETE:
1805 		tmpfs_dir_whiteout_remove(dvp, cnp);
1806 		return (0);
1807 	default:
1808 		panic("tmpfs_whiteout: unknown op");
1809 	}
1810 }
1811 
1812 static int
1813 tmpfs_vptocnp_dir(struct tmpfs_node *tn, struct tmpfs_node *tnp,
1814     struct tmpfs_dirent **pde)
1815 {
1816 	struct tmpfs_dir_cursor dc;
1817 	struct tmpfs_dirent *de;
1818 
1819 	for (de = tmpfs_dir_first(tnp, &dc); de != NULL;
1820 	     de = tmpfs_dir_next(tnp, &dc)) {
1821 		if (de->td_node == tn) {
1822 			*pde = de;
1823 			return (0);
1824 		}
1825 	}
1826 	return (ENOENT);
1827 }
1828 
1829 static int
1830 tmpfs_vptocnp_fill(struct vnode *vp, struct tmpfs_node *tn,
1831     struct tmpfs_node *tnp, char *buf, size_t *buflen, struct vnode **dvp)
1832 {
1833 	struct tmpfs_dirent *de;
1834 	int error, i;
1835 
1836 	error = vn_vget_ino_gen(vp, tmpfs_vn_get_ino_alloc, tnp, LK_SHARED,
1837 	    dvp);
1838 	if (error != 0)
1839 		return (error);
1840 	error = tmpfs_vptocnp_dir(tn, tnp, &de);
1841 	if (error == 0) {
1842 		i = *buflen;
1843 		i -= de->td_namelen;
1844 		if (i < 0) {
1845 			error = ENOMEM;
1846 		} else {
1847 			bcopy(de->ud.td_name, buf + i, de->td_namelen);
1848 			*buflen = i;
1849 		}
1850 	}
1851 	if (error == 0) {
1852 		if (vp != *dvp)
1853 			VOP_UNLOCK(*dvp);
1854 	} else {
1855 		if (vp != *dvp)
1856 			vput(*dvp);
1857 		else
1858 			vrele(vp);
1859 	}
1860 	return (error);
1861 }
1862 
1863 static int
1864 tmpfs_vptocnp(struct vop_vptocnp_args *ap)
1865 {
1866 	struct vnode *vp, **dvp;
1867 	struct tmpfs_node *tn, *tnp, *tnp1;
1868 	struct tmpfs_dirent *de;
1869 	struct tmpfs_mount *tm;
1870 	char *buf;
1871 	size_t *buflen;
1872 	int error;
1873 
1874 	vp = ap->a_vp;
1875 	dvp = ap->a_vpp;
1876 	buf = ap->a_buf;
1877 	buflen = ap->a_buflen;
1878 
1879 	tm = VFS_TO_TMPFS(vp->v_mount);
1880 	tn = VP_TO_TMPFS_NODE(vp);
1881 	if (tn->tn_type == VDIR) {
1882 		tnp = tn->tn_dir.tn_parent;
1883 		if (tnp == NULL)
1884 			return (ENOENT);
1885 		tmpfs_ref_node(tnp);
1886 		error = tmpfs_vptocnp_fill(vp, tn, tn->tn_dir.tn_parent, buf,
1887 		    buflen, dvp);
1888 		tmpfs_free_node(tm, tnp);
1889 		return (error);
1890 	}
1891 restart:
1892 	TMPFS_LOCK(tm);
1893 restart_locked:
1894 	LIST_FOREACH_SAFE(tnp, &tm->tm_nodes_used, tn_entries, tnp1) {
1895 		if (tnp->tn_type != VDIR)
1896 			continue;
1897 		TMPFS_NODE_LOCK(tnp);
1898 		tmpfs_ref_node(tnp);
1899 
1900 		/*
1901 		 * tn_vnode cannot be instantiated while we hold the
1902 		 * node lock, so the directory cannot be changed while
1903 		 * we iterate over it.  Do this to avoid instantiating
1904 		 * vnode for directories which cannot point to our
1905 		 * node.
1906 		 */
1907 		error = tnp->tn_vnode == NULL ? tmpfs_vptocnp_dir(tn, tnp,
1908 		    &de) : 0;
1909 
1910 		if (error == 0) {
1911 			TMPFS_NODE_UNLOCK(tnp);
1912 			TMPFS_UNLOCK(tm);
1913 			error = tmpfs_vptocnp_fill(vp, tn, tnp, buf, buflen,
1914 			    dvp);
1915 			if (error == 0) {
1916 				tmpfs_free_node(tm, tnp);
1917 				return (0);
1918 			}
1919 			if (VN_IS_DOOMED(vp)) {
1920 				tmpfs_free_node(tm, tnp);
1921 				return (ENOENT);
1922 			}
1923 			TMPFS_LOCK(tm);
1924 			TMPFS_NODE_LOCK(tnp);
1925 		}
1926 		if (tmpfs_free_node_locked(tm, tnp, false)) {
1927 			goto restart;
1928 		} else {
1929 			KASSERT(tnp->tn_refcount > 0,
1930 			    ("node %p refcount zero", tnp));
1931 			if (tnp->tn_attached) {
1932 				tnp1 = LIST_NEXT(tnp, tn_entries);
1933 				TMPFS_NODE_UNLOCK(tnp);
1934 			} else {
1935 				TMPFS_NODE_UNLOCK(tnp);
1936 				goto restart_locked;
1937 			}
1938 		}
1939 	}
1940 	TMPFS_UNLOCK(tm);
1941 	return (ENOENT);
1942 }
1943 
1944 void
1945 tmpfs_extattr_free(struct tmpfs_extattr *ea)
1946 {
1947 	free(ea->ea_name, M_TMPFSEA);
1948 	free(ea->ea_value, M_TMPFSEA);
1949 	free(ea, M_TMPFSEA);
1950 }
1951 
1952 static bool
1953 tmpfs_extattr_update_mem(struct tmpfs_mount *tmp, ssize_t size)
1954 {
1955 	TMPFS_LOCK(tmp);
1956 	if (size > 0 &&
1957 	    !tmpfs_pages_check_avail(tmp, howmany(size, PAGE_SIZE))) {
1958 		TMPFS_UNLOCK(tmp);
1959 		return (false);
1960 	}
1961 	if (tmp->tm_ea_memory_inuse + size > tmp->tm_ea_memory_max) {
1962 		TMPFS_UNLOCK(tmp);
1963 		return (false);
1964 	}
1965 	tmp->tm_ea_memory_inuse += size;
1966 	TMPFS_UNLOCK(tmp);
1967 	return (true);
1968 }
1969 
1970 static int
1971 tmpfs_deleteextattr(struct vop_deleteextattr_args *ap)
1972 {
1973 	struct vnode *vp = ap->a_vp;
1974 	struct tmpfs_mount *tmp;
1975 	struct tmpfs_node *node;
1976 	struct tmpfs_extattr *ea;
1977 	size_t namelen;
1978 	ssize_t diff;
1979 	int error;
1980 
1981 	node = VP_TO_TMPFS_NODE(vp);
1982 	tmp = VFS_TO_TMPFS(vp->v_mount);
1983 	if (VN_ISDEV(ap->a_vp))
1984 		return (EOPNOTSUPP);
1985 	error = extattr_check_cred(ap->a_vp, ap->a_attrnamespace,
1986 	    ap->a_cred, ap->a_td, VWRITE);
1987 	if (error != 0)
1988 		return (error);
1989 	if (ap->a_name == NULL || ap->a_name[0] == '\0')
1990 		return (EINVAL);
1991 	namelen = strlen(ap->a_name);
1992 	if (namelen > EXTATTR_MAXNAMELEN)
1993 		return (EINVAL);
1994 
1995 	LIST_FOREACH(ea, &node->tn_extattrs, ea_extattrs) {
1996 		if (ea->ea_namespace == ap->a_attrnamespace &&
1997 		    namelen == ea->ea_namelen &&
1998 		    memcmp(ap->a_name, ea->ea_name, namelen) == 0)
1999 			break;
2000 	}
2001 
2002 	if (ea == NULL)
2003 		return (ENOATTR);
2004 	LIST_REMOVE(ea, ea_extattrs);
2005 	diff = -(sizeof(struct tmpfs_extattr) + namelen + ea->ea_size);
2006 	tmpfs_extattr_update_mem(tmp, diff);
2007 	tmpfs_extattr_free(ea);
2008 	return (0);
2009 }
2010 
2011 static int
2012 tmpfs_getextattr(struct vop_getextattr_args *ap)
2013 {
2014 	struct vnode *vp = ap->a_vp;
2015 	struct tmpfs_node *node;
2016 	struct tmpfs_extattr *ea;
2017 	size_t namelen;
2018 	int error;
2019 
2020 	node = VP_TO_TMPFS_NODE(vp);
2021 	if (VN_ISDEV(ap->a_vp))
2022 		return (EOPNOTSUPP);
2023 	error = extattr_check_cred(ap->a_vp, ap->a_attrnamespace,
2024 	    ap->a_cred, ap->a_td, VREAD);
2025 	if (error != 0)
2026 		return (error);
2027 	if (ap->a_name == NULL || ap->a_name[0] == '\0')
2028 		return (EINVAL);
2029 	namelen = strlen(ap->a_name);
2030 	if (namelen > EXTATTR_MAXNAMELEN)
2031 		return (EINVAL);
2032 
2033 	LIST_FOREACH(ea, &node->tn_extattrs, ea_extattrs) {
2034 		if (ea->ea_namespace == ap->a_attrnamespace &&
2035 		    namelen == ea->ea_namelen &&
2036 		    memcmp(ap->a_name, ea->ea_name, namelen) == 0)
2037 			break;
2038 	}
2039 
2040 	if (ea == NULL)
2041 		return (ENOATTR);
2042 	if (ap->a_size != NULL)
2043 		*ap->a_size = ea->ea_size;
2044 	if (ap->a_uio != NULL && ea->ea_size != 0)
2045 		error = uiomove(ea->ea_value, ea->ea_size, ap->a_uio);
2046 	return (error);
2047 }
2048 
2049 static int
2050 tmpfs_listextattr(struct vop_listextattr_args *ap)
2051 {
2052 	struct vnode *vp = ap->a_vp;
2053 	struct tmpfs_node *node;
2054 	struct tmpfs_extattr *ea;
2055 	int error;
2056 
2057 	node = VP_TO_TMPFS_NODE(vp);
2058 	if (VN_ISDEV(ap->a_vp))
2059 		return (EOPNOTSUPP);
2060 	error = extattr_check_cred(ap->a_vp, ap->a_attrnamespace,
2061 	    ap->a_cred, ap->a_td, VREAD);
2062 	if (error != 0)
2063 		return (error);
2064 	if (ap->a_size != NULL)
2065 		*ap->a_size = 0;
2066 
2067 	LIST_FOREACH(ea, &node->tn_extattrs, ea_extattrs) {
2068 		if (ea->ea_namespace != ap->a_attrnamespace)
2069 			continue;
2070 		if (ap->a_size != NULL)
2071 			*ap->a_size += ea->ea_namelen + 1;
2072 		if (ap->a_uio != NULL) {
2073 			error = uiomove(&ea->ea_namelen, 1, ap->a_uio);
2074 			if (error != 0)
2075 				break;
2076 			error = uiomove(ea->ea_name, ea->ea_namelen, ap->a_uio);
2077 			if (error != 0)
2078 				break;
2079 		}
2080 	}
2081 
2082 	return (error);
2083 }
2084 
2085 static int
2086 tmpfs_setextattr(struct vop_setextattr_args *ap)
2087 {
2088 	struct vnode *vp = ap->a_vp;
2089 	struct tmpfs_mount *tmp;
2090 	struct tmpfs_node *node;
2091 	struct tmpfs_extattr *ea;
2092 	struct tmpfs_extattr *new_ea;
2093 	size_t attr_size;
2094 	size_t namelen;
2095 	ssize_t diff;
2096 	int error;
2097 
2098 	node = VP_TO_TMPFS_NODE(vp);
2099 	tmp = VFS_TO_TMPFS(vp->v_mount);
2100 	attr_size = ap->a_uio->uio_resid;
2101 	diff = 0;
2102 	if (VN_ISDEV(ap->a_vp))
2103 		return (EOPNOTSUPP);
2104 	error = extattr_check_cred(ap->a_vp, ap->a_attrnamespace,
2105 	    ap->a_cred, ap->a_td, VWRITE);
2106 	if (error != 0)
2107 		return (error);
2108 	if (ap->a_name == NULL || ap->a_name[0] == '\0')
2109 		return (EINVAL);
2110 	namelen = strlen(ap->a_name);
2111 	if (namelen > EXTATTR_MAXNAMELEN)
2112 		return (EINVAL);
2113 
2114 	LIST_FOREACH(ea, &node->tn_extattrs, ea_extattrs) {
2115 		if (ea->ea_namespace == ap->a_attrnamespace &&
2116 		    namelen == ea->ea_namelen &&
2117 		    memcmp(ap->a_name, ea->ea_name, namelen) == 0) {
2118 			diff -= sizeof(struct tmpfs_extattr) + ea->ea_namelen +
2119 			    ea->ea_size;
2120 			break;
2121 		}
2122 	}
2123 
2124 	diff += sizeof(struct tmpfs_extattr) + namelen + attr_size;
2125 	if (!tmpfs_extattr_update_mem(tmp, diff))
2126 		return (ENOSPC);
2127 	new_ea = malloc(sizeof(struct tmpfs_extattr), M_TMPFSEA, M_WAITOK);
2128 	new_ea->ea_namespace = ap->a_attrnamespace;
2129 	new_ea->ea_name = malloc(namelen, M_TMPFSEA, M_WAITOK);
2130 	new_ea->ea_namelen = namelen;
2131 	memcpy(new_ea->ea_name, ap->a_name, namelen);
2132 	if (attr_size != 0) {
2133 		new_ea->ea_value = malloc(attr_size, M_TMPFSEA, M_WAITOK);
2134 		new_ea->ea_size = attr_size;
2135 		error = uiomove(new_ea->ea_value, attr_size, ap->a_uio);
2136 	} else {
2137 		new_ea->ea_value = NULL;
2138 		new_ea->ea_size = 0;
2139 	}
2140 	if (error != 0) {
2141 		tmpfs_extattr_update_mem(tmp, -diff);
2142 		tmpfs_extattr_free(new_ea);
2143 		return (error);
2144 	}
2145 	if (ea != NULL) {
2146 		LIST_REMOVE(ea, ea_extattrs);
2147 		tmpfs_extattr_free(ea);
2148 	}
2149 	LIST_INSERT_HEAD(&node->tn_extattrs, new_ea, ea_extattrs);
2150 	return (0);
2151 }
2152 
2153 static off_t
2154 tmpfs_seek_data_locked(vm_object_t obj, off_t noff)
2155 {
2156 	vm_pindex_t p;
2157 
2158 	p = swap_pager_seek_data(obj, OFF_TO_IDX(noff));
2159 	if (p == OBJ_MAX_SIZE)
2160 		p = obj->size;
2161 	return (p == OFF_TO_IDX(noff) ? noff : IDX_TO_OFF(p));
2162 }
2163 
2164 static int
2165 tmpfs_seek_clamp(struct tmpfs_node *tn, off_t *noff, bool seekdata)
2166 {
2167 	if (*noff < tn->tn_size)
2168 		return (0);
2169 	if (seekdata)
2170 		return (ENXIO);
2171 	*noff = tn->tn_size;
2172 	return (0);
2173 }
2174 
2175 static off_t
2176 tmpfs_seek_hole_locked(vm_object_t obj, off_t noff)
2177 {
2178 
2179 	return (IDX_TO_OFF(swap_pager_seek_hole(obj, OFF_TO_IDX(noff))));
2180 }
2181 
2182 static int
2183 tmpfs_seek_datahole(struct vnode *vp, off_t *off, bool seekdata)
2184 {
2185 	struct tmpfs_node *tn;
2186 	vm_object_t obj;
2187 	off_t noff;
2188 	int error;
2189 
2190 	if (vp->v_type != VREG)
2191 		return (ENOTTY);
2192 	tn = VP_TO_TMPFS_NODE(vp);
2193 	noff = *off;
2194 	if (noff < 0)
2195 		return (ENXIO);
2196 	error = tmpfs_seek_clamp(tn, &noff, seekdata);
2197 	if (error != 0)
2198 		return (error);
2199 	obj = tn->tn_reg.tn_aobj;
2200 
2201 	VM_OBJECT_RLOCK(obj);
2202 	noff = seekdata ? tmpfs_seek_data_locked(obj, noff) :
2203 	    tmpfs_seek_hole_locked(obj, noff);
2204 	VM_OBJECT_RUNLOCK(obj);
2205 
2206 	error = tmpfs_seek_clamp(tn, &noff, seekdata);
2207 	if (error == 0)
2208 		*off = noff;
2209 	return (error);
2210 }
2211 
2212 static int
2213 tmpfs_ioctl(struct vop_ioctl_args *ap)
2214 {
2215 	struct vnode *vp = ap->a_vp;
2216 	int error = 0;
2217 
2218 	switch (ap->a_command) {
2219 	case FIOSEEKDATA:
2220 	case FIOSEEKHOLE:
2221 		error = vn_lock(vp, LK_SHARED);
2222 		if (error != 0) {
2223 			error = EBADF;
2224 			break;
2225 		}
2226 		error = tmpfs_seek_datahole(vp, (off_t *)ap->a_data,
2227 		    ap->a_command == FIOSEEKDATA);
2228 		VOP_UNLOCK(vp);
2229 		break;
2230 	default:
2231 		error = ENOTTY;
2232 		break;
2233 	}
2234 	return (error);
2235 }
2236 
2237 /*
2238  * Vnode operations vector used for files stored in a tmpfs file system.
2239  */
2240 struct vop_vector tmpfs_vnodeop_entries = {
2241 	.vop_default =			&default_vnodeops,
2242 	.vop_lookup =			vfs_cache_lookup,
2243 	.vop_cachedlookup =		tmpfs_cached_lookup,
2244 	.vop_create =			tmpfs_create,
2245 	.vop_mknod =			tmpfs_mknod,
2246 	.vop_open =			tmpfs_open,
2247 	.vop_close =			tmpfs_close,
2248 	.vop_fplookup_vexec =		tmpfs_fplookup_vexec,
2249 	.vop_fplookup_symlink =		tmpfs_fplookup_symlink,
2250 	.vop_access =			tmpfs_access,
2251 	.vop_stat =			tmpfs_stat,
2252 	.vop_getattr =			tmpfs_getattr,
2253 	.vop_setattr =			tmpfs_setattr,
2254 	.vop_read =			tmpfs_read,
2255 	.vop_read_pgcache =		tmpfs_read_pgcache,
2256 	.vop_write =			tmpfs_write,
2257 	.vop_deallocate =		tmpfs_deallocate,
2258 	.vop_fsync =			tmpfs_fsync,
2259 	.vop_remove =			tmpfs_remove,
2260 	.vop_link =			tmpfs_link,
2261 	.vop_rename =			tmpfs_rename,
2262 	.vop_mkdir =			tmpfs_mkdir,
2263 	.vop_rmdir =			tmpfs_rmdir,
2264 	.vop_symlink =			tmpfs_symlink,
2265 	.vop_readdir =			tmpfs_readdir,
2266 	.vop_readlink =			tmpfs_readlink,
2267 	.vop_inactive =			tmpfs_inactive,
2268 	.vop_need_inactive =		tmpfs_need_inactive,
2269 	.vop_reclaim =			tmpfs_reclaim,
2270 	.vop_print =			tmpfs_print,
2271 	.vop_pathconf =			tmpfs_pathconf,
2272 	.vop_vptofh =			tmpfs_vptofh,
2273 	.vop_whiteout =			tmpfs_whiteout,
2274 	.vop_bmap =			VOP_EOPNOTSUPP,
2275 	.vop_vptocnp =			tmpfs_vptocnp,
2276 	.vop_lock1 =			vop_lock,
2277 	.vop_unlock = 			vop_unlock,
2278 	.vop_islocked = 		vop_islocked,
2279 	.vop_deleteextattr =		tmpfs_deleteextattr,
2280 	.vop_getextattr =		tmpfs_getextattr,
2281 	.vop_listextattr =		tmpfs_listextattr,
2282 	.vop_setextattr =		tmpfs_setextattr,
2283 	.vop_add_writecount =		vop_stdadd_writecount_nomsync,
2284 	.vop_ioctl =			tmpfs_ioctl,
2285 };
2286 VFS_VOP_VECTOR_REGISTER(tmpfs_vnodeop_entries);
2287 
2288 /*
2289  * Same vector for mounts which do not use namecache.
2290  */
2291 struct vop_vector tmpfs_vnodeop_nonc_entries = {
2292 	.vop_default =			&tmpfs_vnodeop_entries,
2293 	.vop_lookup =			tmpfs_lookup,
2294 };
2295 VFS_VOP_VECTOR_REGISTER(tmpfs_vnodeop_nonc_entries);
2296