xref: /freebsd/sys/fs/tmpfs/tmpfs_vnops.c (revision 69c5fa5cd1ec9b09ed88a086607a8a0993818db9)
1 /*	$NetBSD: tmpfs_vnops.c,v 1.39 2007/07/23 15:41:01 jmmv Exp $	*/
2 
3 /*-
4  * SPDX-License-Identifier: BSD-2-Clause-NetBSD
5  *
6  * Copyright (c) 2005, 2006 The NetBSD Foundation, Inc.
7  * All rights reserved.
8  *
9  * This code is derived from software contributed to The NetBSD Foundation
10  * by Julio M. Merino Vidal, developed as part of Google's Summer of Code
11  * 2005 program.
12  *
13  * Redistribution and use in source and binary forms, with or without
14  * modification, are permitted provided that the following conditions
15  * are met:
16  * 1. Redistributions of source code must retain the above copyright
17  *    notice, this list of conditions and the following disclaimer.
18  * 2. Redistributions in binary form must reproduce the above copyright
19  *    notice, this list of conditions and the following disclaimer in the
20  *    documentation and/or other materials provided with the distribution.
21  *
22  * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
23  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
24  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
25  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
26  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
27  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
28  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
29  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
30  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
31  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
32  * POSSIBILITY OF SUCH DAMAGE.
33  */
34 
35 /*
36  * tmpfs vnode interface.
37  */
38 #include <sys/cdefs.h>
39 __FBSDID("$FreeBSD$");
40 
41 #include <sys/param.h>
42 #include <sys/systm.h>
43 #include <sys/dirent.h>
44 #include <sys/fcntl.h>
45 #include <sys/file.h>
46 #include <sys/limits.h>
47 #include <sys/lockf.h>
48 #include <sys/lock.h>
49 #include <sys/mount.h>
50 #include <sys/namei.h>
51 #include <sys/priv.h>
52 #include <sys/proc.h>
53 #include <sys/rwlock.h>
54 #include <sys/sched.h>
55 #include <sys/stat.h>
56 #include <sys/sysctl.h>
57 #include <sys/unistd.h>
58 #include <sys/vnode.h>
59 #include <sys/smr.h>
60 #include <security/audit/audit.h>
61 #include <security/mac/mac_framework.h>
62 
63 #include <vm/vm.h>
64 #include <vm/vm_param.h>
65 #include <vm/vm_object.h>
66 
67 #include <fs/tmpfs/tmpfs_vnops.h>
68 #include <fs/tmpfs/tmpfs.h>
69 
70 SYSCTL_DECL(_vfs_tmpfs);
71 VFS_SMR_DECLARE;
72 
73 static volatile int tmpfs_rename_restarts;
74 SYSCTL_INT(_vfs_tmpfs, OID_AUTO, rename_restarts, CTLFLAG_RD,
75     __DEVOLATILE(int *, &tmpfs_rename_restarts), 0,
76     "Times rename had to restart due to lock contention");
77 
78 static int
79 tmpfs_vn_get_ino_alloc(struct mount *mp, void *arg, int lkflags,
80     struct vnode **rvp)
81 {
82 
83 	return (tmpfs_alloc_vp(mp, arg, lkflags, rvp));
84 }
85 
86 static int
87 tmpfs_lookup1(struct vnode *dvp, struct vnode **vpp, struct componentname *cnp)
88 {
89 	struct tmpfs_dirent *de;
90 	struct tmpfs_node *dnode, *pnode;
91 	struct tmpfs_mount *tm;
92 	int error;
93 
94 	/* Caller assumes responsibility for ensuring access (VEXEC). */
95 	dnode = VP_TO_TMPFS_DIR(dvp);
96 	*vpp = NULLVP;
97 
98 	/* We cannot be requesting the parent directory of the root node. */
99 	MPASS(IMPLIES(dnode->tn_type == VDIR &&
100 	    dnode->tn_dir.tn_parent == dnode,
101 	    !(cnp->cn_flags & ISDOTDOT)));
102 
103 	TMPFS_ASSERT_LOCKED(dnode);
104 	if (dnode->tn_dir.tn_parent == NULL) {
105 		error = ENOENT;
106 		goto out;
107 	}
108 	if (cnp->cn_flags & ISDOTDOT) {
109 		tm = VFS_TO_TMPFS(dvp->v_mount);
110 		pnode = dnode->tn_dir.tn_parent;
111 		tmpfs_ref_node(pnode);
112 		error = vn_vget_ino_gen(dvp, tmpfs_vn_get_ino_alloc,
113 		    pnode, cnp->cn_lkflags, vpp);
114 		tmpfs_free_node(tm, pnode);
115 		if (error != 0)
116 			goto out;
117 	} else if (cnp->cn_namelen == 1 && cnp->cn_nameptr[0] == '.') {
118 		VREF(dvp);
119 		*vpp = dvp;
120 		error = 0;
121 	} else {
122 		de = tmpfs_dir_lookup(dnode, NULL, cnp);
123 		if (de != NULL && de->td_node == NULL)
124 			cnp->cn_flags |= ISWHITEOUT;
125 		if (de == NULL || de->td_node == NULL) {
126 			/*
127 			 * The entry was not found in the directory.
128 			 * This is OK if we are creating or renaming an
129 			 * entry and are working on the last component of
130 			 * the path name.
131 			 */
132 			if ((cnp->cn_flags & ISLASTCN) &&
133 			    (cnp->cn_nameiop == CREATE || \
134 			    cnp->cn_nameiop == RENAME ||
135 			    (cnp->cn_nameiop == DELETE &&
136 			    cnp->cn_flags & DOWHITEOUT &&
137 			    cnp->cn_flags & ISWHITEOUT))) {
138 				error = VOP_ACCESS(dvp, VWRITE, cnp->cn_cred,
139 				    cnp->cn_thread);
140 				if (error != 0)
141 					goto out;
142 
143 				/*
144 				 * Keep the component name in the buffer for
145 				 * future uses.
146 				 */
147 				cnp->cn_flags |= SAVENAME;
148 
149 				error = EJUSTRETURN;
150 			} else
151 				error = ENOENT;
152 		} else {
153 			struct tmpfs_node *tnode;
154 
155 			/*
156 			 * The entry was found, so get its associated
157 			 * tmpfs_node.
158 			 */
159 			tnode = de->td_node;
160 
161 			/*
162 			 * If we are not at the last path component and
163 			 * found a non-directory or non-link entry (which
164 			 * may itself be pointing to a directory), raise
165 			 * an error.
166 			 */
167 			if ((tnode->tn_type != VDIR &&
168 			    tnode->tn_type != VLNK) &&
169 			    !(cnp->cn_flags & ISLASTCN)) {
170 				error = ENOTDIR;
171 				goto out;
172 			}
173 
174 			/*
175 			 * If we are deleting or renaming the entry, keep
176 			 * track of its tmpfs_dirent so that it can be
177 			 * easily deleted later.
178 			 */
179 			if ((cnp->cn_flags & ISLASTCN) &&
180 			    (cnp->cn_nameiop == DELETE ||
181 			    cnp->cn_nameiop == RENAME)) {
182 				error = VOP_ACCESS(dvp, VWRITE, cnp->cn_cred,
183 				    cnp->cn_thread);
184 				if (error != 0)
185 					goto out;
186 
187 				/* Allocate a new vnode on the matching entry. */
188 				error = tmpfs_alloc_vp(dvp->v_mount, tnode,
189 				    cnp->cn_lkflags, vpp);
190 				if (error != 0)
191 					goto out;
192 
193 				if ((dnode->tn_mode & S_ISTXT) &&
194 				  VOP_ACCESS(dvp, VADMIN, cnp->cn_cred,
195 				  cnp->cn_thread) && VOP_ACCESS(*vpp, VADMIN,
196 				  cnp->cn_cred, cnp->cn_thread)) {
197 					error = EPERM;
198 					vput(*vpp);
199 					*vpp = NULL;
200 					goto out;
201 				}
202 				cnp->cn_flags |= SAVENAME;
203 			} else {
204 				error = tmpfs_alloc_vp(dvp->v_mount, tnode,
205 				    cnp->cn_lkflags, vpp);
206 				if (error != 0)
207 					goto out;
208 			}
209 		}
210 	}
211 
212 	/*
213 	 * Store the result of this lookup in the cache.  Avoid this if the
214 	 * request was for creation, as it does not improve timings on
215 	 * emprical tests.
216 	 */
217 	if ((cnp->cn_flags & MAKEENTRY) != 0 && tmpfs_use_nc(dvp))
218 		cache_enter(dvp, *vpp, cnp);
219 
220 out:
221 	/*
222 	 * If there were no errors, *vpp cannot be null and it must be
223 	 * locked.
224 	 */
225 	MPASS(IFF(error == 0, *vpp != NULLVP && VOP_ISLOCKED(*vpp)));
226 
227 	return (error);
228 }
229 
230 static int
231 tmpfs_cached_lookup(struct vop_cachedlookup_args *v)
232 {
233 
234 	return (tmpfs_lookup1(v->a_dvp, v->a_vpp, v->a_cnp));
235 }
236 
237 static int
238 tmpfs_lookup(struct vop_lookup_args *v)
239 {
240 	struct vnode *dvp = v->a_dvp;
241 	struct vnode **vpp = v->a_vpp;
242 	struct componentname *cnp = v->a_cnp;
243 	int error;
244 
245 	/* Check accessibility of requested node as a first step. */
246 	error = vn_dir_check_exec(dvp, cnp);
247 	if (error != 0)
248 		return (error);
249 
250 	return (tmpfs_lookup1(dvp, vpp, cnp));
251 }
252 
253 static int
254 tmpfs_create(struct vop_create_args *v)
255 {
256 	struct vnode *dvp = v->a_dvp;
257 	struct vnode **vpp = v->a_vpp;
258 	struct componentname *cnp = v->a_cnp;
259 	struct vattr *vap = v->a_vap;
260 	int error;
261 
262 	MPASS(vap->va_type == VREG || vap->va_type == VSOCK);
263 
264 	error = tmpfs_alloc_file(dvp, vpp, vap, cnp, NULL);
265 	if (error == 0 && (cnp->cn_flags & MAKEENTRY) != 0 && tmpfs_use_nc(dvp))
266 		cache_enter(dvp, *vpp, cnp);
267 	return (error);
268 }
269 
270 static int
271 tmpfs_mknod(struct vop_mknod_args *v)
272 {
273 	struct vnode *dvp = v->a_dvp;
274 	struct vnode **vpp = v->a_vpp;
275 	struct componentname *cnp = v->a_cnp;
276 	struct vattr *vap = v->a_vap;
277 
278 	if (vap->va_type != VBLK && vap->va_type != VCHR &&
279 	    vap->va_type != VFIFO)
280 		return EINVAL;
281 
282 	return tmpfs_alloc_file(dvp, vpp, vap, cnp, NULL);
283 }
284 
285 struct fileops tmpfs_fnops;
286 
287 static int
288 tmpfs_open(struct vop_open_args *v)
289 {
290 	struct vnode *vp;
291 	struct tmpfs_node *node;
292 	struct file *fp;
293 	int error, mode;
294 
295 	vp = v->a_vp;
296 	mode = v->a_mode;
297 	node = VP_TO_TMPFS_NODE(vp);
298 
299 	/*
300 	 * The file is still active but all its names have been removed
301 	 * (e.g. by a "rmdir $(pwd)").  It cannot be opened any more as
302 	 * it is about to die.
303 	 */
304 	if (node->tn_links < 1)
305 		return (ENOENT);
306 
307 	/* If the file is marked append-only, deny write requests. */
308 	if (node->tn_flags & APPEND && (mode & (FWRITE | O_APPEND)) == FWRITE)
309 		error = EPERM;
310 	else {
311 		error = 0;
312 		/* For regular files, the call below is nop. */
313 		KASSERT(vp->v_type != VREG || (node->tn_reg.tn_aobj->flags &
314 		    OBJ_DEAD) == 0, ("dead object"));
315 		vnode_create_vobject(vp, node->tn_size, v->a_td);
316 	}
317 
318 	fp = v->a_fp;
319 	MPASS(fp == NULL || fp->f_data == NULL);
320 	if (error == 0 && fp != NULL && vp->v_type == VREG) {
321 		tmpfs_ref_node(node);
322 		finit_vnode(fp, mode, node, &tmpfs_fnops);
323 	}
324 
325 	return (error);
326 }
327 
328 static int
329 tmpfs_close(struct vop_close_args *v)
330 {
331 	struct vnode *vp = v->a_vp;
332 
333 	/* Update node times. */
334 	tmpfs_update(vp);
335 
336 	return (0);
337 }
338 
339 int
340 tmpfs_fo_close(struct file *fp, struct thread *td)
341 {
342 	struct tmpfs_node *node;
343 
344 	node = fp->f_data;
345 	if (node != NULL) {
346 		MPASS(node->tn_type == VREG);
347 		tmpfs_free_node(node->tn_reg.tn_tmp, node);
348 	}
349 	return (vnops.fo_close(fp, td));
350 }
351 
352 /*
353  * VOP_FPLOOKUP_VEXEC routines are subject to special circumstances, see
354  * the comment above cache_fplookup for details.
355  */
356 int
357 tmpfs_fplookup_vexec(struct vop_fplookup_vexec_args *v)
358 {
359 	struct vnode *vp;
360 	struct tmpfs_node *node;
361 	struct ucred *cred;
362 	mode_t all_x, mode;
363 
364 	vp = v->a_vp;
365 	node = VP_TO_TMPFS_NODE_SMR(vp);
366 	if (__predict_false(node == NULL))
367 		return (EAGAIN);
368 
369 	all_x = S_IXUSR | S_IXGRP | S_IXOTH;
370 	mode = atomic_load_short(&node->tn_mode);
371 	if (__predict_true((mode & all_x) == all_x))
372 		return (0);
373 
374 	cred = v->a_cred;
375 	return (vaccess_vexec_smr(mode, node->tn_uid, node->tn_gid, cred));
376 }
377 
378 int
379 tmpfs_access(struct vop_access_args *v)
380 {
381 	struct vnode *vp = v->a_vp;
382 	accmode_t accmode = v->a_accmode;
383 	struct ucred *cred = v->a_cred;
384 	mode_t all_x = S_IXUSR | S_IXGRP | S_IXOTH;
385 	int error;
386 	struct tmpfs_node *node;
387 
388 	MPASS(VOP_ISLOCKED(vp));
389 
390 	node = VP_TO_TMPFS_NODE(vp);
391 
392 	/*
393 	 * Common case path lookup.
394 	 */
395 	if (__predict_true(accmode == VEXEC && (node->tn_mode & all_x) == all_x))
396 		return (0);
397 
398 	switch (vp->v_type) {
399 	case VDIR:
400 		/* FALLTHROUGH */
401 	case VLNK:
402 		/* FALLTHROUGH */
403 	case VREG:
404 		if (accmode & VWRITE && vp->v_mount->mnt_flag & MNT_RDONLY) {
405 			error = EROFS;
406 			goto out;
407 		}
408 		break;
409 
410 	case VBLK:
411 		/* FALLTHROUGH */
412 	case VCHR:
413 		/* FALLTHROUGH */
414 	case VSOCK:
415 		/* FALLTHROUGH */
416 	case VFIFO:
417 		break;
418 
419 	default:
420 		error = EINVAL;
421 		goto out;
422 	}
423 
424 	if (accmode & VWRITE && node->tn_flags & IMMUTABLE) {
425 		error = EPERM;
426 		goto out;
427 	}
428 
429 	error = vaccess(vp->v_type, node->tn_mode, node->tn_uid, node->tn_gid,
430 	    accmode, cred);
431 
432 out:
433 	MPASS(VOP_ISLOCKED(vp));
434 
435 	return (error);
436 }
437 
438 int
439 tmpfs_stat(struct vop_stat_args *v)
440 {
441 	struct vnode *vp = v->a_vp;
442 	struct stat *sb = v->a_sb;
443 	vm_object_t obj;
444 	struct tmpfs_node *node;
445 	int error;
446 
447 	node = VP_TO_TMPFS_NODE(vp);
448 
449 	tmpfs_update_getattr(vp);
450 
451 	error = vop_stat_helper_pre(v);
452 	if (__predict_false(error))
453 		return (error);
454 
455 	sb->st_dev = vp->v_mount->mnt_stat.f_fsid.val[0];
456 	sb->st_ino = node->tn_id;
457 	sb->st_mode = node->tn_mode | VTTOIF(vp->v_type);
458 	sb->st_nlink = node->tn_links;
459 	sb->st_uid = node->tn_uid;
460 	sb->st_gid = node->tn_gid;
461 	sb->st_rdev = (vp->v_type == VBLK || vp->v_type == VCHR) ?
462 		node->tn_rdev : NODEV;
463 	sb->st_size = node->tn_size;
464 	sb->st_atim.tv_sec = node->tn_atime.tv_sec;
465 	sb->st_atim.tv_nsec = node->tn_atime.tv_nsec;
466 	sb->st_mtim.tv_sec = node->tn_mtime.tv_sec;
467 	sb->st_mtim.tv_nsec = node->tn_mtime.tv_nsec;
468 	sb->st_ctim.tv_sec = node->tn_ctime.tv_sec;
469 	sb->st_ctim.tv_nsec = node->tn_ctime.tv_nsec;
470 	sb->st_birthtim.tv_sec = node->tn_birthtime.tv_sec;
471 	sb->st_birthtim.tv_nsec = node->tn_birthtime.tv_nsec;
472 	sb->st_blksize = PAGE_SIZE;
473 	sb->st_flags = node->tn_flags;
474 	sb->st_gen = node->tn_gen;
475 	if (vp->v_type == VREG) {
476 		obj = node->tn_reg.tn_aobj;
477 		sb->st_blocks = (u_quad_t)obj->resident_page_count * PAGE_SIZE;
478 	} else
479 		sb->st_blocks = node->tn_size;
480 	sb->st_blocks /= S_BLKSIZE;
481 	return (vop_stat_helper_post(v, error));
482 }
483 
484 int
485 tmpfs_getattr(struct vop_getattr_args *v)
486 {
487 	struct vnode *vp = v->a_vp;
488 	struct vattr *vap = v->a_vap;
489 	vm_object_t obj;
490 	struct tmpfs_node *node;
491 
492 	node = VP_TO_TMPFS_NODE(vp);
493 
494 	tmpfs_update_getattr(vp);
495 
496 	vap->va_type = vp->v_type;
497 	vap->va_mode = node->tn_mode;
498 	vap->va_nlink = node->tn_links;
499 	vap->va_uid = node->tn_uid;
500 	vap->va_gid = node->tn_gid;
501 	vap->va_fsid = vp->v_mount->mnt_stat.f_fsid.val[0];
502 	vap->va_fileid = node->tn_id;
503 	vap->va_size = node->tn_size;
504 	vap->va_blocksize = PAGE_SIZE;
505 	vap->va_atime = node->tn_atime;
506 	vap->va_mtime = node->tn_mtime;
507 	vap->va_ctime = node->tn_ctime;
508 	vap->va_birthtime = node->tn_birthtime;
509 	vap->va_gen = node->tn_gen;
510 	vap->va_flags = node->tn_flags;
511 	vap->va_rdev = (vp->v_type == VBLK || vp->v_type == VCHR) ?
512 		node->tn_rdev : NODEV;
513 	if (vp->v_type == VREG) {
514 		obj = node->tn_reg.tn_aobj;
515 		vap->va_bytes = (u_quad_t)obj->resident_page_count * PAGE_SIZE;
516 	} else
517 		vap->va_bytes = node->tn_size;
518 	vap->va_filerev = 0;
519 
520 	return 0;
521 }
522 
523 int
524 tmpfs_setattr(struct vop_setattr_args *v)
525 {
526 	struct vnode *vp = v->a_vp;
527 	struct vattr *vap = v->a_vap;
528 	struct ucred *cred = v->a_cred;
529 	struct thread *td = curthread;
530 
531 	int error;
532 
533 	MPASS(VOP_ISLOCKED(vp));
534 	ASSERT_VOP_IN_SEQC(vp);
535 
536 	error = 0;
537 
538 	/* Abort if any unsettable attribute is given. */
539 	if (vap->va_type != VNON ||
540 	    vap->va_nlink != VNOVAL ||
541 	    vap->va_fsid != VNOVAL ||
542 	    vap->va_fileid != VNOVAL ||
543 	    vap->va_blocksize != VNOVAL ||
544 	    vap->va_gen != VNOVAL ||
545 	    vap->va_rdev != VNOVAL ||
546 	    vap->va_bytes != VNOVAL)
547 		error = EINVAL;
548 
549 	if (error == 0 && (vap->va_flags != VNOVAL))
550 		error = tmpfs_chflags(vp, vap->va_flags, cred, td);
551 
552 	if (error == 0 && (vap->va_size != VNOVAL))
553 		error = tmpfs_chsize(vp, vap->va_size, cred, td);
554 
555 	if (error == 0 && (vap->va_uid != VNOVAL || vap->va_gid != VNOVAL))
556 		error = tmpfs_chown(vp, vap->va_uid, vap->va_gid, cred, td);
557 
558 	if (error == 0 && (vap->va_mode != (mode_t)VNOVAL))
559 		error = tmpfs_chmod(vp, vap->va_mode, cred, td);
560 
561 	if (error == 0 && ((vap->va_atime.tv_sec != VNOVAL &&
562 	    vap->va_atime.tv_nsec != VNOVAL) ||
563 	    (vap->va_mtime.tv_sec != VNOVAL &&
564 	    vap->va_mtime.tv_nsec != VNOVAL) ||
565 	    (vap->va_birthtime.tv_sec != VNOVAL &&
566 	    vap->va_birthtime.tv_nsec != VNOVAL)))
567 		error = tmpfs_chtimes(vp, vap, cred, td);
568 
569 	/*
570 	 * Update the node times.  We give preference to the error codes
571 	 * generated by this function rather than the ones that may arise
572 	 * from tmpfs_update.
573 	 */
574 	tmpfs_update(vp);
575 
576 	MPASS(VOP_ISLOCKED(vp));
577 
578 	return error;
579 }
580 
581 static int
582 tmpfs_read(struct vop_read_args *v)
583 {
584 	struct vnode *vp;
585 	struct uio *uio;
586 	struct tmpfs_node *node;
587 
588 	vp = v->a_vp;
589 	if (vp->v_type != VREG)
590 		return (EISDIR);
591 	uio = v->a_uio;
592 	if (uio->uio_offset < 0)
593 		return (EINVAL);
594 	node = VP_TO_TMPFS_NODE(vp);
595 	tmpfs_set_accessed(VFS_TO_TMPFS(vp->v_mount), node);
596 	return (uiomove_object(node->tn_reg.tn_aobj, node->tn_size, uio));
597 }
598 
599 static int
600 tmpfs_read_pgcache(struct vop_read_pgcache_args *v)
601 {
602 	struct vnode *vp;
603 	struct tmpfs_node *node;
604 	vm_object_t object;
605 	off_t size;
606 	int error;
607 
608 	vp = v->a_vp;
609 	VNPASS((vn_irflag_read(vp) & VIRF_PGREAD) != 0, vp);
610 
611 	if (v->a_uio->uio_offset < 0)
612 		return (EINVAL);
613 
614 	error = EJUSTRETURN;
615 	vfs_smr_enter();
616 
617 	node = VP_TO_TMPFS_NODE_SMR(vp);
618 	if (node == NULL)
619 		goto out_smr;
620 	MPASS(node->tn_type == VREG);
621 	MPASS(node->tn_refcount >= 1);
622 	object = node->tn_reg.tn_aobj;
623 	if (object == NULL)
624 		goto out_smr;
625 
626 	MPASS((object->flags & (OBJ_ANON | OBJ_DEAD | OBJ_TMPFS_NODE)) ==
627 	    OBJ_TMPFS_NODE);
628 	if (!VN_IS_DOOMED(vp)) {
629 		/* size cannot become shorter due to rangelock. */
630 		size = node->tn_size;
631 		tmpfs_set_accessed(node->tn_reg.tn_tmp, node);
632 		vfs_smr_exit();
633 		error = uiomove_object(object, size, v->a_uio);
634 		return (error);
635 	}
636 out_smr:
637 	vfs_smr_exit();
638 	return (error);
639 }
640 
641 static int
642 tmpfs_write(struct vop_write_args *v)
643 {
644 	struct vnode *vp;
645 	struct uio *uio;
646 	struct tmpfs_node *node;
647 	off_t oldsize;
648 	int error, ioflag;
649 	mode_t newmode;
650 
651 	vp = v->a_vp;
652 	uio = v->a_uio;
653 	ioflag = v->a_ioflag;
654 	error = 0;
655 	node = VP_TO_TMPFS_NODE(vp);
656 	oldsize = node->tn_size;
657 
658 	if (uio->uio_offset < 0 || vp->v_type != VREG)
659 		return (EINVAL);
660 	if (uio->uio_resid == 0)
661 		return (0);
662 	if (ioflag & IO_APPEND)
663 		uio->uio_offset = node->tn_size;
664 	if (uio->uio_offset + uio->uio_resid >
665 	  VFS_TO_TMPFS(vp->v_mount)->tm_maxfilesize)
666 		return (EFBIG);
667 	if (vn_rlimit_fsize(vp, uio, uio->uio_td))
668 		return (EFBIG);
669 	if (uio->uio_offset + uio->uio_resid > node->tn_size) {
670 		error = tmpfs_reg_resize(vp, uio->uio_offset + uio->uio_resid,
671 		    FALSE);
672 		if (error != 0)
673 			goto out;
674 	}
675 
676 	error = uiomove_object(node->tn_reg.tn_aobj, node->tn_size, uio);
677 	node->tn_status |= TMPFS_NODE_MODIFIED | TMPFS_NODE_CHANGED;
678 	node->tn_accessed = true;
679 	if (node->tn_mode & (S_ISUID | S_ISGID)) {
680 		if (priv_check_cred(v->a_cred, PRIV_VFS_RETAINSUGID)) {
681 			newmode = node->tn_mode & ~(S_ISUID | S_ISGID);
682 			vn_seqc_write_begin(vp);
683 			atomic_store_short(&node->tn_mode, newmode);
684 			vn_seqc_write_end(vp);
685 		}
686 	}
687 	if (error != 0)
688 		(void)tmpfs_reg_resize(vp, oldsize, TRUE);
689 
690 out:
691 	MPASS(IMPLIES(error == 0, uio->uio_resid == 0));
692 	MPASS(IMPLIES(error != 0, oldsize == node->tn_size));
693 
694 	return (error);
695 }
696 
697 static int
698 tmpfs_fsync(struct vop_fsync_args *v)
699 {
700 	struct vnode *vp = v->a_vp;
701 
702 	MPASS(VOP_ISLOCKED(vp));
703 
704 	tmpfs_check_mtime(vp);
705 	tmpfs_update(vp);
706 
707 	return 0;
708 }
709 
710 static int
711 tmpfs_remove(struct vop_remove_args *v)
712 {
713 	struct vnode *dvp = v->a_dvp;
714 	struct vnode *vp = v->a_vp;
715 
716 	int error;
717 	struct tmpfs_dirent *de;
718 	struct tmpfs_mount *tmp;
719 	struct tmpfs_node *dnode;
720 	struct tmpfs_node *node;
721 
722 	MPASS(VOP_ISLOCKED(dvp));
723 	MPASS(VOP_ISLOCKED(vp));
724 
725 	if (vp->v_type == VDIR) {
726 		error = EISDIR;
727 		goto out;
728 	}
729 
730 	dnode = VP_TO_TMPFS_DIR(dvp);
731 	node = VP_TO_TMPFS_NODE(vp);
732 	tmp = VFS_TO_TMPFS(vp->v_mount);
733 	de = tmpfs_dir_lookup(dnode, node, v->a_cnp);
734 	MPASS(de != NULL);
735 
736 	/* Files marked as immutable or append-only cannot be deleted. */
737 	if ((node->tn_flags & (IMMUTABLE | APPEND | NOUNLINK)) ||
738 	    (dnode->tn_flags & APPEND)) {
739 		error = EPERM;
740 		goto out;
741 	}
742 
743 	/* Remove the entry from the directory; as it is a file, we do not
744 	 * have to change the number of hard links of the directory. */
745 	tmpfs_dir_detach(dvp, de);
746 	if (v->a_cnp->cn_flags & DOWHITEOUT)
747 		tmpfs_dir_whiteout_add(dvp, v->a_cnp);
748 
749 	/* Free the directory entry we just deleted.  Note that the node
750 	 * referred by it will not be removed until the vnode is really
751 	 * reclaimed. */
752 	tmpfs_free_dirent(tmp, de);
753 
754 	node->tn_status |= TMPFS_NODE_CHANGED;
755 	node->tn_accessed = true;
756 	error = 0;
757 
758 out:
759 	return (error);
760 }
761 
762 static int
763 tmpfs_link(struct vop_link_args *v)
764 {
765 	struct vnode *dvp = v->a_tdvp;
766 	struct vnode *vp = v->a_vp;
767 	struct componentname *cnp = v->a_cnp;
768 
769 	int error;
770 	struct tmpfs_dirent *de;
771 	struct tmpfs_node *node;
772 
773 	MPASS(VOP_ISLOCKED(dvp));
774 	MPASS(cnp->cn_flags & HASBUF);
775 	MPASS(dvp != vp); /* XXX When can this be false? */
776 	node = VP_TO_TMPFS_NODE(vp);
777 
778 	/* Ensure that we do not overflow the maximum number of links imposed
779 	 * by the system. */
780 	MPASS(node->tn_links <= TMPFS_LINK_MAX);
781 	if (node->tn_links == TMPFS_LINK_MAX) {
782 		error = EMLINK;
783 		goto out;
784 	}
785 
786 	/* We cannot create links of files marked immutable or append-only. */
787 	if (node->tn_flags & (IMMUTABLE | APPEND)) {
788 		error = EPERM;
789 		goto out;
790 	}
791 
792 	/* Allocate a new directory entry to represent the node. */
793 	error = tmpfs_alloc_dirent(VFS_TO_TMPFS(vp->v_mount), node,
794 	    cnp->cn_nameptr, cnp->cn_namelen, &de);
795 	if (error != 0)
796 		goto out;
797 
798 	/* Insert the new directory entry into the appropriate directory. */
799 	if (cnp->cn_flags & ISWHITEOUT)
800 		tmpfs_dir_whiteout_remove(dvp, cnp);
801 	tmpfs_dir_attach(dvp, de);
802 
803 	/* vp link count has changed, so update node times. */
804 	node->tn_status |= TMPFS_NODE_CHANGED;
805 	tmpfs_update(vp);
806 
807 	error = 0;
808 
809 out:
810 	return error;
811 }
812 
813 /*
814  * We acquire all but fdvp locks using non-blocking acquisitions.  If we
815  * fail to acquire any lock in the path we will drop all held locks,
816  * acquire the new lock in a blocking fashion, and then release it and
817  * restart the rename.  This acquire/release step ensures that we do not
818  * spin on a lock waiting for release.  On error release all vnode locks
819  * and decrement references the way tmpfs_rename() would do.
820  */
821 static int
822 tmpfs_rename_relock(struct vnode *fdvp, struct vnode **fvpp,
823     struct vnode *tdvp, struct vnode **tvpp,
824     struct componentname *fcnp, struct componentname *tcnp)
825 {
826 	struct vnode *nvp;
827 	struct mount *mp;
828 	struct tmpfs_dirent *de;
829 	int error, restarts = 0;
830 
831 	VOP_UNLOCK(tdvp);
832 	if (*tvpp != NULL && *tvpp != tdvp)
833 		VOP_UNLOCK(*tvpp);
834 	mp = fdvp->v_mount;
835 
836 relock:
837 	restarts += 1;
838 	error = vn_lock(fdvp, LK_EXCLUSIVE);
839 	if (error)
840 		goto releout;
841 	if (vn_lock(tdvp, LK_EXCLUSIVE | LK_NOWAIT) != 0) {
842 		VOP_UNLOCK(fdvp);
843 		error = vn_lock(tdvp, LK_EXCLUSIVE);
844 		if (error)
845 			goto releout;
846 		VOP_UNLOCK(tdvp);
847 		goto relock;
848 	}
849 	/*
850 	 * Re-resolve fvp to be certain it still exists and fetch the
851 	 * correct vnode.
852 	 */
853 	de = tmpfs_dir_lookup(VP_TO_TMPFS_DIR(fdvp), NULL, fcnp);
854 	if (de == NULL) {
855 		VOP_UNLOCK(fdvp);
856 		VOP_UNLOCK(tdvp);
857 		if ((fcnp->cn_flags & ISDOTDOT) != 0 ||
858 		    (fcnp->cn_namelen == 1 && fcnp->cn_nameptr[0] == '.'))
859 			error = EINVAL;
860 		else
861 			error = ENOENT;
862 		goto releout;
863 	}
864 	error = tmpfs_alloc_vp(mp, de->td_node, LK_EXCLUSIVE | LK_NOWAIT, &nvp);
865 	if (error != 0) {
866 		VOP_UNLOCK(fdvp);
867 		VOP_UNLOCK(tdvp);
868 		if (error != EBUSY)
869 			goto releout;
870 		error = tmpfs_alloc_vp(mp, de->td_node, LK_EXCLUSIVE, &nvp);
871 		if (error != 0)
872 			goto releout;
873 		VOP_UNLOCK(nvp);
874 		/*
875 		 * Concurrent rename race.
876 		 */
877 		if (nvp == tdvp) {
878 			vrele(nvp);
879 			error = EINVAL;
880 			goto releout;
881 		}
882 		vrele(*fvpp);
883 		*fvpp = nvp;
884 		goto relock;
885 	}
886 	vrele(*fvpp);
887 	*fvpp = nvp;
888 	VOP_UNLOCK(*fvpp);
889 	/*
890 	 * Re-resolve tvp and acquire the vnode lock if present.
891 	 */
892 	de = tmpfs_dir_lookup(VP_TO_TMPFS_DIR(tdvp), NULL, tcnp);
893 	/*
894 	 * If tvp disappeared we just carry on.
895 	 */
896 	if (de == NULL && *tvpp != NULL) {
897 		vrele(*tvpp);
898 		*tvpp = NULL;
899 	}
900 	/*
901 	 * Get the tvp ino if the lookup succeeded.  We may have to restart
902 	 * if the non-blocking acquire fails.
903 	 */
904 	if (de != NULL) {
905 		nvp = NULL;
906 		error = tmpfs_alloc_vp(mp, de->td_node,
907 		    LK_EXCLUSIVE | LK_NOWAIT, &nvp);
908 		if (*tvpp != NULL)
909 			vrele(*tvpp);
910 		*tvpp = nvp;
911 		if (error != 0) {
912 			VOP_UNLOCK(fdvp);
913 			VOP_UNLOCK(tdvp);
914 			if (error != EBUSY)
915 				goto releout;
916 			error = tmpfs_alloc_vp(mp, de->td_node, LK_EXCLUSIVE,
917 			    &nvp);
918 			if (error != 0)
919 				goto releout;
920 			VOP_UNLOCK(nvp);
921 			/*
922 			 * fdvp contains fvp, thus tvp (=fdvp) is not empty.
923 			 */
924 			if (nvp == fdvp) {
925 				error = ENOTEMPTY;
926 				goto releout;
927 			}
928 			goto relock;
929 		}
930 	}
931 	tmpfs_rename_restarts += restarts;
932 
933 	return (0);
934 
935 releout:
936 	vrele(fdvp);
937 	vrele(*fvpp);
938 	vrele(tdvp);
939 	if (*tvpp != NULL)
940 		vrele(*tvpp);
941 	tmpfs_rename_restarts += restarts;
942 
943 	return (error);
944 }
945 
946 static int
947 tmpfs_rename(struct vop_rename_args *v)
948 {
949 	struct vnode *fdvp = v->a_fdvp;
950 	struct vnode *fvp = v->a_fvp;
951 	struct componentname *fcnp = v->a_fcnp;
952 	struct vnode *tdvp = v->a_tdvp;
953 	struct vnode *tvp = v->a_tvp;
954 	struct componentname *tcnp = v->a_tcnp;
955 	char *newname;
956 	struct tmpfs_dirent *de;
957 	struct tmpfs_mount *tmp;
958 	struct tmpfs_node *fdnode;
959 	struct tmpfs_node *fnode;
960 	struct tmpfs_node *tnode;
961 	struct tmpfs_node *tdnode;
962 	int error;
963 	bool want_seqc_end;
964 
965 	MPASS(VOP_ISLOCKED(tdvp));
966 	MPASS(IMPLIES(tvp != NULL, VOP_ISLOCKED(tvp)));
967 	MPASS(fcnp->cn_flags & HASBUF);
968 	MPASS(tcnp->cn_flags & HASBUF);
969 
970 	want_seqc_end = false;
971 
972 	/*
973 	 * Disallow cross-device renames.
974 	 * XXX Why isn't this done by the caller?
975 	 */
976 	if (fvp->v_mount != tdvp->v_mount ||
977 	    (tvp != NULL && fvp->v_mount != tvp->v_mount)) {
978 		error = EXDEV;
979 		goto out;
980 	}
981 
982 	/* If source and target are the same file, there is nothing to do. */
983 	if (fvp == tvp) {
984 		error = 0;
985 		goto out;
986 	}
987 
988 	/*
989 	 * If we need to move the directory between entries, lock the
990 	 * source so that we can safely operate on it.
991 	 */
992 	if (fdvp != tdvp && fdvp != tvp) {
993 		if (vn_lock(fdvp, LK_EXCLUSIVE | LK_NOWAIT) != 0) {
994 			error = tmpfs_rename_relock(fdvp, &fvp, tdvp, &tvp,
995 			    fcnp, tcnp);
996 			if (error != 0)
997 				return (error);
998 			ASSERT_VOP_ELOCKED(fdvp,
999 			    "tmpfs_rename: fdvp not locked");
1000 			ASSERT_VOP_ELOCKED(tdvp,
1001 			    "tmpfs_rename: tdvp not locked");
1002 			if (tvp != NULL)
1003 				ASSERT_VOP_ELOCKED(tvp,
1004 				    "tmpfs_rename: tvp not locked");
1005 			if (fvp == tvp) {
1006 				error = 0;
1007 				goto out_locked;
1008 			}
1009 		}
1010 	}
1011 
1012 	if (tvp != NULL)
1013 		vn_seqc_write_begin(tvp);
1014 	vn_seqc_write_begin(tdvp);
1015 	vn_seqc_write_begin(fvp);
1016 	vn_seqc_write_begin(fdvp);
1017 	want_seqc_end = true;
1018 
1019 	tmp = VFS_TO_TMPFS(tdvp->v_mount);
1020 	tdnode = VP_TO_TMPFS_DIR(tdvp);
1021 	tnode = (tvp == NULL) ? NULL : VP_TO_TMPFS_NODE(tvp);
1022 	fdnode = VP_TO_TMPFS_DIR(fdvp);
1023 	fnode = VP_TO_TMPFS_NODE(fvp);
1024 	de = tmpfs_dir_lookup(fdnode, fnode, fcnp);
1025 
1026 	/*
1027 	 * Entry can disappear before we lock fdvp,
1028 	 * also avoid manipulating '.' and '..' entries.
1029 	 */
1030 	if (de == NULL) {
1031 		if ((fcnp->cn_flags & ISDOTDOT) != 0 ||
1032 		    (fcnp->cn_namelen == 1 && fcnp->cn_nameptr[0] == '.'))
1033 			error = EINVAL;
1034 		else
1035 			error = ENOENT;
1036 		goto out_locked;
1037 	}
1038 	MPASS(de->td_node == fnode);
1039 
1040 	/*
1041 	 * If re-naming a directory to another preexisting directory
1042 	 * ensure that the target directory is empty so that its
1043 	 * removal causes no side effects.
1044 	 * Kern_rename guarantees the destination to be a directory
1045 	 * if the source is one.
1046 	 */
1047 	if (tvp != NULL) {
1048 		MPASS(tnode != NULL);
1049 
1050 		if ((tnode->tn_flags & (NOUNLINK | IMMUTABLE | APPEND)) ||
1051 		    (tdnode->tn_flags & (APPEND | IMMUTABLE))) {
1052 			error = EPERM;
1053 			goto out_locked;
1054 		}
1055 
1056 		if (fnode->tn_type == VDIR && tnode->tn_type == VDIR) {
1057 			if (tnode->tn_size > 0) {
1058 				error = ENOTEMPTY;
1059 				goto out_locked;
1060 			}
1061 		} else if (fnode->tn_type == VDIR && tnode->tn_type != VDIR) {
1062 			error = ENOTDIR;
1063 			goto out_locked;
1064 		} else if (fnode->tn_type != VDIR && tnode->tn_type == VDIR) {
1065 			error = EISDIR;
1066 			goto out_locked;
1067 		} else {
1068 			MPASS(fnode->tn_type != VDIR &&
1069 				tnode->tn_type != VDIR);
1070 		}
1071 	}
1072 
1073 	if ((fnode->tn_flags & (NOUNLINK | IMMUTABLE | APPEND))
1074 	    || (fdnode->tn_flags & (APPEND | IMMUTABLE))) {
1075 		error = EPERM;
1076 		goto out_locked;
1077 	}
1078 
1079 	/*
1080 	 * Ensure that we have enough memory to hold the new name, if it
1081 	 * has to be changed.
1082 	 */
1083 	if (fcnp->cn_namelen != tcnp->cn_namelen ||
1084 	    bcmp(fcnp->cn_nameptr, tcnp->cn_nameptr, fcnp->cn_namelen) != 0) {
1085 		newname = malloc(tcnp->cn_namelen, M_TMPFSNAME, M_WAITOK);
1086 	} else
1087 		newname = NULL;
1088 
1089 	/*
1090 	 * If the node is being moved to another directory, we have to do
1091 	 * the move.
1092 	 */
1093 	if (fdnode != tdnode) {
1094 		/*
1095 		 * In case we are moving a directory, we have to adjust its
1096 		 * parent to point to the new parent.
1097 		 */
1098 		if (de->td_node->tn_type == VDIR) {
1099 			struct tmpfs_node *n;
1100 
1101 			/*
1102 			 * Ensure the target directory is not a child of the
1103 			 * directory being moved.  Otherwise, we'd end up
1104 			 * with stale nodes.
1105 			 */
1106 			n = tdnode;
1107 			/*
1108 			 * TMPFS_LOCK guaranties that no nodes are freed while
1109 			 * traversing the list. Nodes can only be marked as
1110 			 * removed: tn_parent == NULL.
1111 			 */
1112 			TMPFS_LOCK(tmp);
1113 			TMPFS_NODE_LOCK(n);
1114 			while (n != n->tn_dir.tn_parent) {
1115 				struct tmpfs_node *parent;
1116 
1117 				if (n == fnode) {
1118 					TMPFS_NODE_UNLOCK(n);
1119 					TMPFS_UNLOCK(tmp);
1120 					error = EINVAL;
1121 					if (newname != NULL)
1122 						    free(newname, M_TMPFSNAME);
1123 					goto out_locked;
1124 				}
1125 				parent = n->tn_dir.tn_parent;
1126 				TMPFS_NODE_UNLOCK(n);
1127 				if (parent == NULL) {
1128 					n = NULL;
1129 					break;
1130 				}
1131 				TMPFS_NODE_LOCK(parent);
1132 				if (parent->tn_dir.tn_parent == NULL) {
1133 					TMPFS_NODE_UNLOCK(parent);
1134 					n = NULL;
1135 					break;
1136 				}
1137 				n = parent;
1138 			}
1139 			TMPFS_UNLOCK(tmp);
1140 			if (n == NULL) {
1141 				error = EINVAL;
1142 				if (newname != NULL)
1143 					    free(newname, M_TMPFSNAME);
1144 				goto out_locked;
1145 			}
1146 			TMPFS_NODE_UNLOCK(n);
1147 
1148 			/* Adjust the parent pointer. */
1149 			TMPFS_VALIDATE_DIR(fnode);
1150 			TMPFS_NODE_LOCK(de->td_node);
1151 			de->td_node->tn_dir.tn_parent = tdnode;
1152 			TMPFS_NODE_UNLOCK(de->td_node);
1153 
1154 			/*
1155 			 * As a result of changing the target of the '..'
1156 			 * entry, the link count of the source and target
1157 			 * directories has to be adjusted.
1158 			 */
1159 			TMPFS_NODE_LOCK(tdnode);
1160 			TMPFS_ASSERT_LOCKED(tdnode);
1161 			tdnode->tn_links++;
1162 			TMPFS_NODE_UNLOCK(tdnode);
1163 
1164 			TMPFS_NODE_LOCK(fdnode);
1165 			TMPFS_ASSERT_LOCKED(fdnode);
1166 			fdnode->tn_links--;
1167 			TMPFS_NODE_UNLOCK(fdnode);
1168 		}
1169 	}
1170 
1171 	/*
1172 	 * Do the move: just remove the entry from the source directory
1173 	 * and insert it into the target one.
1174 	 */
1175 	tmpfs_dir_detach(fdvp, de);
1176 
1177 	if (fcnp->cn_flags & DOWHITEOUT)
1178 		tmpfs_dir_whiteout_add(fdvp, fcnp);
1179 	if (tcnp->cn_flags & ISWHITEOUT)
1180 		tmpfs_dir_whiteout_remove(tdvp, tcnp);
1181 
1182 	/*
1183 	 * If the name has changed, we need to make it effective by changing
1184 	 * it in the directory entry.
1185 	 */
1186 	if (newname != NULL) {
1187 		MPASS(tcnp->cn_namelen <= MAXNAMLEN);
1188 
1189 		free(de->ud.td_name, M_TMPFSNAME);
1190 		de->ud.td_name = newname;
1191 		tmpfs_dirent_init(de, tcnp->cn_nameptr, tcnp->cn_namelen);
1192 
1193 		fnode->tn_status |= TMPFS_NODE_CHANGED;
1194 		tdnode->tn_status |= TMPFS_NODE_MODIFIED;
1195 	}
1196 
1197 	/*
1198 	 * If we are overwriting an entry, we have to remove the old one
1199 	 * from the target directory.
1200 	 */
1201 	if (tvp != NULL) {
1202 		struct tmpfs_dirent *tde;
1203 
1204 		/* Remove the old entry from the target directory. */
1205 		tde = tmpfs_dir_lookup(tdnode, tnode, tcnp);
1206 		tmpfs_dir_detach(tdvp, tde);
1207 
1208 		/*
1209 		 * Free the directory entry we just deleted.  Note that the
1210 		 * node referred by it will not be removed until the vnode is
1211 		 * really reclaimed.
1212 		 */
1213 		tmpfs_free_dirent(VFS_TO_TMPFS(tvp->v_mount), tde);
1214 	}
1215 
1216 	tmpfs_dir_attach(tdvp, de);
1217 
1218 	if (tmpfs_use_nc(fvp)) {
1219 		cache_vop_rename(fdvp, fvp, tdvp, tvp, fcnp, tcnp);
1220 	}
1221 
1222 	error = 0;
1223 
1224 out_locked:
1225 	if (fdvp != tdvp && fdvp != tvp)
1226 		VOP_UNLOCK(fdvp);
1227 
1228 out:
1229 	if (want_seqc_end) {
1230 		if (tvp != NULL)
1231 			vn_seqc_write_end(tvp);
1232 		vn_seqc_write_end(tdvp);
1233 		vn_seqc_write_end(fvp);
1234 		vn_seqc_write_end(fdvp);
1235 	}
1236 
1237 	/*
1238 	 * Release target nodes.
1239 	 * XXX: I don't understand when tdvp can be the same as tvp, but
1240 	 * other code takes care of this...
1241 	 */
1242 	if (tdvp == tvp)
1243 		vrele(tdvp);
1244 	else
1245 		vput(tdvp);
1246 	if (tvp != NULL)
1247 		vput(tvp);
1248 
1249 	/* Release source nodes. */
1250 	vrele(fdvp);
1251 	vrele(fvp);
1252 
1253 	return (error);
1254 }
1255 
1256 static int
1257 tmpfs_mkdir(struct vop_mkdir_args *v)
1258 {
1259 	struct vnode *dvp = v->a_dvp;
1260 	struct vnode **vpp = v->a_vpp;
1261 	struct componentname *cnp = v->a_cnp;
1262 	struct vattr *vap = v->a_vap;
1263 
1264 	MPASS(vap->va_type == VDIR);
1265 
1266 	return tmpfs_alloc_file(dvp, vpp, vap, cnp, NULL);
1267 }
1268 
1269 static int
1270 tmpfs_rmdir(struct vop_rmdir_args *v)
1271 {
1272 	struct vnode *dvp = v->a_dvp;
1273 	struct vnode *vp = v->a_vp;
1274 
1275 	int error;
1276 	struct tmpfs_dirent *de;
1277 	struct tmpfs_mount *tmp;
1278 	struct tmpfs_node *dnode;
1279 	struct tmpfs_node *node;
1280 
1281 	MPASS(VOP_ISLOCKED(dvp));
1282 	MPASS(VOP_ISLOCKED(vp));
1283 
1284 	tmp = VFS_TO_TMPFS(dvp->v_mount);
1285 	dnode = VP_TO_TMPFS_DIR(dvp);
1286 	node = VP_TO_TMPFS_DIR(vp);
1287 
1288 	/* Directories with more than two entries ('.' and '..') cannot be
1289 	 * removed. */
1290 	 if (node->tn_size > 0) {
1291 		 error = ENOTEMPTY;
1292 		 goto out;
1293 	 }
1294 
1295 	if ((dnode->tn_flags & APPEND)
1296 	    || (node->tn_flags & (NOUNLINK | IMMUTABLE | APPEND))) {
1297 		error = EPERM;
1298 		goto out;
1299 	}
1300 
1301 	/* This invariant holds only if we are not trying to remove "..".
1302 	  * We checked for that above so this is safe now. */
1303 	MPASS(node->tn_dir.tn_parent == dnode);
1304 
1305 	/* Get the directory entry associated with node (vp).  This was
1306 	 * filled by tmpfs_lookup while looking up the entry. */
1307 	de = tmpfs_dir_lookup(dnode, node, v->a_cnp);
1308 	MPASS(TMPFS_DIRENT_MATCHES(de,
1309 	    v->a_cnp->cn_nameptr,
1310 	    v->a_cnp->cn_namelen));
1311 
1312 	/* Check flags to see if we are allowed to remove the directory. */
1313 	if ((dnode->tn_flags & APPEND) != 0 ||
1314 	    (node->tn_flags & (NOUNLINK | IMMUTABLE | APPEND)) != 0) {
1315 		error = EPERM;
1316 		goto out;
1317 	}
1318 
1319 	/* Detach the directory entry from the directory (dnode). */
1320 	tmpfs_dir_detach(dvp, de);
1321 	if (v->a_cnp->cn_flags & DOWHITEOUT)
1322 		tmpfs_dir_whiteout_add(dvp, v->a_cnp);
1323 
1324 	/* No vnode should be allocated for this entry from this point */
1325 	TMPFS_NODE_LOCK(node);
1326 	node->tn_links--;
1327 	node->tn_dir.tn_parent = NULL;
1328 	node->tn_status |= TMPFS_NODE_CHANGED | TMPFS_NODE_MODIFIED;
1329 	node->tn_accessed = true;
1330 
1331 	TMPFS_NODE_UNLOCK(node);
1332 
1333 	TMPFS_NODE_LOCK(dnode);
1334 	dnode->tn_links--;
1335 	dnode->tn_status |= TMPFS_NODE_CHANGED | TMPFS_NODE_MODIFIED;
1336 	dnode->tn_accessed = true;
1337 	TMPFS_NODE_UNLOCK(dnode);
1338 
1339 	if (tmpfs_use_nc(dvp)) {
1340 		cache_vop_rmdir(dvp, vp);
1341 	}
1342 
1343 	/* Free the directory entry we just deleted.  Note that the node
1344 	 * referred by it will not be removed until the vnode is really
1345 	 * reclaimed. */
1346 	tmpfs_free_dirent(tmp, de);
1347 
1348 	/* Release the deleted vnode (will destroy the node, notify
1349 	 * interested parties and clean it from the cache). */
1350 
1351 	dnode->tn_status |= TMPFS_NODE_CHANGED;
1352 	tmpfs_update(dvp);
1353 
1354 	error = 0;
1355 
1356 out:
1357 	return error;
1358 }
1359 
1360 static int
1361 tmpfs_symlink(struct vop_symlink_args *v)
1362 {
1363 	struct vnode *dvp = v->a_dvp;
1364 	struct vnode **vpp = v->a_vpp;
1365 	struct componentname *cnp = v->a_cnp;
1366 	struct vattr *vap = v->a_vap;
1367 	const char *target = v->a_target;
1368 
1369 #ifdef notyet /* XXX FreeBSD BUG: kern_symlink is not setting VLNK */
1370 	MPASS(vap->va_type == VLNK);
1371 #else
1372 	vap->va_type = VLNK;
1373 #endif
1374 
1375 	return tmpfs_alloc_file(dvp, vpp, vap, cnp, target);
1376 }
1377 
1378 static int
1379 tmpfs_readdir(struct vop_readdir_args *va)
1380 {
1381 	struct vnode *vp;
1382 	struct uio *uio;
1383 	struct tmpfs_mount *tm;
1384 	struct tmpfs_node *node;
1385 	u_long **cookies;
1386 	int *eofflag, *ncookies;
1387 	ssize_t startresid;
1388 	int error, maxcookies;
1389 
1390 	vp = va->a_vp;
1391 	uio = va->a_uio;
1392 	eofflag = va->a_eofflag;
1393 	cookies = va->a_cookies;
1394 	ncookies = va->a_ncookies;
1395 
1396 	/* This operation only makes sense on directory nodes. */
1397 	if (vp->v_type != VDIR)
1398 		return ENOTDIR;
1399 
1400 	maxcookies = 0;
1401 	node = VP_TO_TMPFS_DIR(vp);
1402 	tm = VFS_TO_TMPFS(vp->v_mount);
1403 
1404 	startresid = uio->uio_resid;
1405 
1406 	/* Allocate cookies for NFS and compat modules. */
1407 	if (cookies != NULL && ncookies != NULL) {
1408 		maxcookies = howmany(node->tn_size,
1409 		    sizeof(struct tmpfs_dirent)) + 2;
1410 		*cookies = malloc(maxcookies * sizeof(**cookies), M_TEMP,
1411 		    M_WAITOK);
1412 		*ncookies = 0;
1413 	}
1414 
1415 	if (cookies == NULL)
1416 		error = tmpfs_dir_getdents(tm, node, uio, 0, NULL, NULL);
1417 	else
1418 		error = tmpfs_dir_getdents(tm, node, uio, maxcookies, *cookies,
1419 		    ncookies);
1420 
1421 	/* Buffer was filled without hitting EOF. */
1422 	if (error == EJUSTRETURN)
1423 		error = (uio->uio_resid != startresid) ? 0 : EINVAL;
1424 
1425 	if (error != 0 && cookies != NULL && ncookies != NULL) {
1426 		free(*cookies, M_TEMP);
1427 		*cookies = NULL;
1428 		*ncookies = 0;
1429 	}
1430 
1431 	if (eofflag != NULL)
1432 		*eofflag =
1433 		    (error == 0 && uio->uio_offset == TMPFS_DIRCOOKIE_EOF);
1434 
1435 	return error;
1436 }
1437 
1438 static int
1439 tmpfs_readlink(struct vop_readlink_args *v)
1440 {
1441 	struct vnode *vp = v->a_vp;
1442 	struct uio *uio = v->a_uio;
1443 
1444 	int error;
1445 	struct tmpfs_node *node;
1446 
1447 	MPASS(uio->uio_offset == 0);
1448 	MPASS(vp->v_type == VLNK);
1449 
1450 	node = VP_TO_TMPFS_NODE(vp);
1451 
1452 	error = uiomove(node->tn_link_target, MIN(node->tn_size, uio->uio_resid),
1453 	    uio);
1454 	tmpfs_set_accessed(VFS_TO_TMPFS(vp->v_mount), node);
1455 
1456 	return (error);
1457 }
1458 
1459 /*
1460  * VOP_FPLOOKUP_SYMLINK routines are subject to special circumstances, see
1461  * the comment above cache_fplookup for details.
1462  *
1463  * Check tmpfs_alloc_node for tmpfs-specific synchronisation notes.
1464  */
1465 static int
1466 tmpfs_fplookup_symlink(struct vop_fplookup_symlink_args *v)
1467 {
1468 	struct vnode *vp;
1469 	struct tmpfs_node *node;
1470 	char *symlink;
1471 
1472 	vp = v->a_vp;
1473 	node = VP_TO_TMPFS_NODE_SMR(vp);
1474 	if (__predict_false(node == NULL))
1475 		return (EAGAIN);
1476 	if (!atomic_load_char(&node->tn_link_smr))
1477 		return (EAGAIN);
1478 	symlink = atomic_load_ptr(&node->tn_link_target);
1479 	if (symlink == NULL)
1480 		return (EAGAIN);
1481 
1482 	return (cache_symlink_resolve(v->a_fpl, symlink, node->tn_size));
1483 }
1484 
1485 static int
1486 tmpfs_inactive(struct vop_inactive_args *v)
1487 {
1488 	struct vnode *vp;
1489 	struct tmpfs_node *node;
1490 
1491 	vp = v->a_vp;
1492 	node = VP_TO_TMPFS_NODE(vp);
1493 	if (node->tn_links == 0)
1494 		vrecycle(vp);
1495 	else
1496 		tmpfs_check_mtime(vp);
1497 	return (0);
1498 }
1499 
1500 static int
1501 tmpfs_need_inactive(struct vop_need_inactive_args *ap)
1502 {
1503 	struct vnode *vp;
1504 	struct tmpfs_node *node;
1505 	struct vm_object *obj;
1506 
1507 	vp = ap->a_vp;
1508 	node = VP_TO_TMPFS_NODE(vp);
1509 	if (node->tn_links == 0)
1510 		goto need;
1511 	if (vp->v_type == VREG) {
1512 		obj = vp->v_object;
1513 		if (obj->generation != obj->cleangeneration)
1514 			goto need;
1515 	}
1516 	return (0);
1517 need:
1518 	return (1);
1519 }
1520 
1521 int
1522 tmpfs_reclaim(struct vop_reclaim_args *v)
1523 {
1524 	struct vnode *vp;
1525 	struct tmpfs_mount *tmp;
1526 	struct tmpfs_node *node;
1527 	bool unlock, tm_locked;
1528 
1529 	vp = v->a_vp;
1530 	node = VP_TO_TMPFS_NODE(vp);
1531 	tmp = VFS_TO_TMPFS(vp->v_mount);
1532 	tm_locked = false;
1533 
1534 	if (vp->v_type == VREG)
1535 		tmpfs_destroy_vobject(vp, node->tn_reg.tn_aobj);
1536 	vp->v_object = NULL;
1537 
1538 relock:
1539 	TMPFS_NODE_LOCK(node);
1540 	if (!tm_locked && node->tn_links == 0 &&
1541 	    (node->tn_vpstate & TMPFS_VNODE_ALLOCATING) == 0) {
1542 		TMPFS_NODE_UNLOCK(node);
1543 		TMPFS_LOCK(tmp);
1544 		tm_locked = true;
1545 		goto relock;
1546 	}
1547 	tmpfs_free_vp(vp);
1548 
1549 	/*
1550 	 * If the node referenced by this vnode was deleted by the user,
1551 	 * we must free its associated data structures (now that the vnode
1552 	 * is being reclaimed).
1553 	 */
1554 	if (node->tn_links == 0 &&
1555 	    (node->tn_vpstate & TMPFS_VNODE_ALLOCATING) == 0) {
1556 		MPASS(tm_locked);
1557 		node->tn_vpstate = TMPFS_VNODE_DOOMED;
1558 		unlock = !tmpfs_free_node_locked(tmp, node, true);
1559 	} else {
1560 		unlock = true;
1561 	}
1562 
1563 	if (unlock) {
1564 		TMPFS_NODE_UNLOCK(node);
1565 		if (tm_locked)
1566 			TMPFS_UNLOCK(tmp);
1567 	}
1568 
1569 	MPASS(vp->v_data == NULL);
1570 	return (0);
1571 }
1572 
1573 int
1574 tmpfs_print(struct vop_print_args *v)
1575 {
1576 	struct vnode *vp = v->a_vp;
1577 
1578 	struct tmpfs_node *node;
1579 
1580 	node = VP_TO_TMPFS_NODE(vp);
1581 
1582 	printf("tag VT_TMPFS, tmpfs_node %p, flags 0x%lx, links %jd\n",
1583 	    node, node->tn_flags, (uintmax_t)node->tn_links);
1584 	printf("\tmode 0%o, owner %d, group %d, size %jd, status 0x%x\n",
1585 	    node->tn_mode, node->tn_uid, node->tn_gid,
1586 	    (intmax_t)node->tn_size, node->tn_status);
1587 
1588 	if (vp->v_type == VFIFO)
1589 		fifo_printinfo(vp);
1590 
1591 	printf("\n");
1592 
1593 	return 0;
1594 }
1595 
1596 int
1597 tmpfs_pathconf(struct vop_pathconf_args *v)
1598 {
1599 	struct vnode *vp = v->a_vp;
1600 	int name = v->a_name;
1601 	long *retval = v->a_retval;
1602 
1603 	int error;
1604 
1605 	error = 0;
1606 
1607 	switch (name) {
1608 	case _PC_LINK_MAX:
1609 		*retval = TMPFS_LINK_MAX;
1610 		break;
1611 
1612 	case _PC_SYMLINK_MAX:
1613 		*retval = MAXPATHLEN;
1614 		break;
1615 
1616 	case _PC_NAME_MAX:
1617 		*retval = NAME_MAX;
1618 		break;
1619 
1620 	case _PC_PIPE_BUF:
1621 		if (vp->v_type == VDIR || vp->v_type == VFIFO)
1622 			*retval = PIPE_BUF;
1623 		else
1624 			error = EINVAL;
1625 		break;
1626 
1627 	case _PC_CHOWN_RESTRICTED:
1628 		*retval = 1;
1629 		break;
1630 
1631 	case _PC_NO_TRUNC:
1632 		*retval = 1;
1633 		break;
1634 
1635 	case _PC_SYNC_IO:
1636 		*retval = 1;
1637 		break;
1638 
1639 	case _PC_FILESIZEBITS:
1640 		*retval = 64;
1641 		break;
1642 
1643 	default:
1644 		error = vop_stdpathconf(v);
1645 	}
1646 
1647 	return error;
1648 }
1649 
1650 static int
1651 tmpfs_vptofh(struct vop_vptofh_args *ap)
1652 /*
1653 vop_vptofh {
1654 	IN struct vnode *a_vp;
1655 	IN struct fid *a_fhp;
1656 };
1657 */
1658 {
1659 	struct tmpfs_fid_data tfd;
1660 	struct tmpfs_node *node;
1661 	struct fid *fhp;
1662 
1663 	node = VP_TO_TMPFS_NODE(ap->a_vp);
1664 	fhp = ap->a_fhp;
1665 	fhp->fid_len = sizeof(tfd);
1666 
1667 	/*
1668 	 * Copy into fid_data from the stack to avoid unaligned pointer use.
1669 	 * See the comment in sys/mount.h on struct fid for details.
1670 	 */
1671 	tfd.tfd_id = node->tn_id;
1672 	tfd.tfd_gen = node->tn_gen;
1673 	memcpy(fhp->fid_data, &tfd, fhp->fid_len);
1674 
1675 	return (0);
1676 }
1677 
1678 static int
1679 tmpfs_whiteout(struct vop_whiteout_args *ap)
1680 {
1681 	struct vnode *dvp = ap->a_dvp;
1682 	struct componentname *cnp = ap->a_cnp;
1683 	struct tmpfs_dirent *de;
1684 
1685 	switch (ap->a_flags) {
1686 	case LOOKUP:
1687 		return (0);
1688 	case CREATE:
1689 		de = tmpfs_dir_lookup(VP_TO_TMPFS_DIR(dvp), NULL, cnp);
1690 		if (de != NULL)
1691 			return (de->td_node == NULL ? 0 : EEXIST);
1692 		return (tmpfs_dir_whiteout_add(dvp, cnp));
1693 	case DELETE:
1694 		tmpfs_dir_whiteout_remove(dvp, cnp);
1695 		return (0);
1696 	default:
1697 		panic("tmpfs_whiteout: unknown op");
1698 	}
1699 }
1700 
1701 static int
1702 tmpfs_vptocnp_dir(struct tmpfs_node *tn, struct tmpfs_node *tnp,
1703     struct tmpfs_dirent **pde)
1704 {
1705 	struct tmpfs_dir_cursor dc;
1706 	struct tmpfs_dirent *de;
1707 
1708 	for (de = tmpfs_dir_first(tnp, &dc); de != NULL;
1709 	     de = tmpfs_dir_next(tnp, &dc)) {
1710 		if (de->td_node == tn) {
1711 			*pde = de;
1712 			return (0);
1713 		}
1714 	}
1715 	return (ENOENT);
1716 }
1717 
1718 static int
1719 tmpfs_vptocnp_fill(struct vnode *vp, struct tmpfs_node *tn,
1720     struct tmpfs_node *tnp, char *buf, size_t *buflen, struct vnode **dvp)
1721 {
1722 	struct tmpfs_dirent *de;
1723 	int error, i;
1724 
1725 	error = vn_vget_ino_gen(vp, tmpfs_vn_get_ino_alloc, tnp, LK_SHARED,
1726 	    dvp);
1727 	if (error != 0)
1728 		return (error);
1729 	error = tmpfs_vptocnp_dir(tn, tnp, &de);
1730 	if (error == 0) {
1731 		i = *buflen;
1732 		i -= de->td_namelen;
1733 		if (i < 0) {
1734 			error = ENOMEM;
1735 		} else {
1736 			bcopy(de->ud.td_name, buf + i, de->td_namelen);
1737 			*buflen = i;
1738 		}
1739 	}
1740 	if (error == 0) {
1741 		if (vp != *dvp)
1742 			VOP_UNLOCK(*dvp);
1743 	} else {
1744 		if (vp != *dvp)
1745 			vput(*dvp);
1746 		else
1747 			vrele(vp);
1748 	}
1749 	return (error);
1750 }
1751 
1752 static int
1753 tmpfs_vptocnp(struct vop_vptocnp_args *ap)
1754 {
1755 	struct vnode *vp, **dvp;
1756 	struct tmpfs_node *tn, *tnp, *tnp1;
1757 	struct tmpfs_dirent *de;
1758 	struct tmpfs_mount *tm;
1759 	char *buf;
1760 	size_t *buflen;
1761 	int error;
1762 
1763 	vp = ap->a_vp;
1764 	dvp = ap->a_vpp;
1765 	buf = ap->a_buf;
1766 	buflen = ap->a_buflen;
1767 
1768 	tm = VFS_TO_TMPFS(vp->v_mount);
1769 	tn = VP_TO_TMPFS_NODE(vp);
1770 	if (tn->tn_type == VDIR) {
1771 		tnp = tn->tn_dir.tn_parent;
1772 		if (tnp == NULL)
1773 			return (ENOENT);
1774 		tmpfs_ref_node(tnp);
1775 		error = tmpfs_vptocnp_fill(vp, tn, tn->tn_dir.tn_parent, buf,
1776 		    buflen, dvp);
1777 		tmpfs_free_node(tm, tnp);
1778 		return (error);
1779 	}
1780 restart:
1781 	TMPFS_LOCK(tm);
1782 restart_locked:
1783 	LIST_FOREACH_SAFE(tnp, &tm->tm_nodes_used, tn_entries, tnp1) {
1784 		if (tnp->tn_type != VDIR)
1785 			continue;
1786 		TMPFS_NODE_LOCK(tnp);
1787 		tmpfs_ref_node(tnp);
1788 
1789 		/*
1790 		 * tn_vnode cannot be instantiated while we hold the
1791 		 * node lock, so the directory cannot be changed while
1792 		 * we iterate over it.  Do this to avoid instantiating
1793 		 * vnode for directories which cannot point to our
1794 		 * node.
1795 		 */
1796 		error = tnp->tn_vnode == NULL ? tmpfs_vptocnp_dir(tn, tnp,
1797 		    &de) : 0;
1798 
1799 		if (error == 0) {
1800 			TMPFS_NODE_UNLOCK(tnp);
1801 			TMPFS_UNLOCK(tm);
1802 			error = tmpfs_vptocnp_fill(vp, tn, tnp, buf, buflen,
1803 			    dvp);
1804 			if (error == 0) {
1805 				tmpfs_free_node(tm, tnp);
1806 				return (0);
1807 			}
1808 			if (VN_IS_DOOMED(vp)) {
1809 				tmpfs_free_node(tm, tnp);
1810 				return (ENOENT);
1811 			}
1812 			TMPFS_LOCK(tm);
1813 			TMPFS_NODE_LOCK(tnp);
1814 		}
1815 		if (tmpfs_free_node_locked(tm, tnp, false)) {
1816 			goto restart;
1817 		} else {
1818 			KASSERT(tnp->tn_refcount > 0,
1819 			    ("node %p refcount zero", tnp));
1820 			if (tnp->tn_attached) {
1821 				tnp1 = LIST_NEXT(tnp, tn_entries);
1822 				TMPFS_NODE_UNLOCK(tnp);
1823 			} else {
1824 				TMPFS_NODE_UNLOCK(tnp);
1825 				goto restart_locked;
1826 			}
1827 		}
1828 	}
1829 	TMPFS_UNLOCK(tm);
1830 	return (ENOENT);
1831 }
1832 
1833 /*
1834  * Vnode operations vector used for files stored in a tmpfs file system.
1835  */
1836 struct vop_vector tmpfs_vnodeop_entries = {
1837 	.vop_default =			&default_vnodeops,
1838 	.vop_lookup =			vfs_cache_lookup,
1839 	.vop_cachedlookup =		tmpfs_cached_lookup,
1840 	.vop_create =			tmpfs_create,
1841 	.vop_mknod =			tmpfs_mknod,
1842 	.vop_open =			tmpfs_open,
1843 	.vop_close =			tmpfs_close,
1844 	.vop_fplookup_vexec =		tmpfs_fplookup_vexec,
1845 	.vop_fplookup_symlink =		tmpfs_fplookup_symlink,
1846 	.vop_access =			tmpfs_access,
1847 	.vop_stat =			tmpfs_stat,
1848 	.vop_getattr =			tmpfs_getattr,
1849 	.vop_setattr =			tmpfs_setattr,
1850 	.vop_read =			tmpfs_read,
1851 	.vop_read_pgcache =		tmpfs_read_pgcache,
1852 	.vop_write =			tmpfs_write,
1853 	.vop_fsync =			tmpfs_fsync,
1854 	.vop_remove =			tmpfs_remove,
1855 	.vop_link =			tmpfs_link,
1856 	.vop_rename =			tmpfs_rename,
1857 	.vop_mkdir =			tmpfs_mkdir,
1858 	.vop_rmdir =			tmpfs_rmdir,
1859 	.vop_symlink =			tmpfs_symlink,
1860 	.vop_readdir =			tmpfs_readdir,
1861 	.vop_readlink =			tmpfs_readlink,
1862 	.vop_inactive =			tmpfs_inactive,
1863 	.vop_need_inactive =		tmpfs_need_inactive,
1864 	.vop_reclaim =			tmpfs_reclaim,
1865 	.vop_print =			tmpfs_print,
1866 	.vop_pathconf =			tmpfs_pathconf,
1867 	.vop_vptofh =			tmpfs_vptofh,
1868 	.vop_whiteout =			tmpfs_whiteout,
1869 	.vop_bmap =			VOP_EOPNOTSUPP,
1870 	.vop_vptocnp =			tmpfs_vptocnp,
1871 	.vop_lock1 =			vop_lock,
1872 	.vop_unlock = 			vop_unlock,
1873 	.vop_islocked = 		vop_islocked,
1874 };
1875 VFS_VOP_VECTOR_REGISTER(tmpfs_vnodeop_entries);
1876 
1877 /*
1878  * Same vector for mounts which do not use namecache.
1879  */
1880 struct vop_vector tmpfs_vnodeop_nonc_entries = {
1881 	.vop_default =			&tmpfs_vnodeop_entries,
1882 	.vop_lookup =			tmpfs_lookup,
1883 };
1884 VFS_VOP_VECTOR_REGISTER(tmpfs_vnodeop_nonc_entries);
1885