xref: /dflybsd-src/sys/vfs/tmpfs/tmpfs_vnops.c (revision 6ff1f1620fde5b0fb7649f604e05eb90f0f59ff8)
1 /*-
2  * Copyright (c) 2005, 2006 The NetBSD Foundation, Inc.
3  * All rights reserved.
4  *
5  * This code is derived from software contributed to The NetBSD Foundation
6  * by Julio M. Merino Vidal, developed as part of Google's Summer of Code
7  * 2005 program.
8  *
9  * Redistribution and use in source and binary forms, with or without
10  * modification, are permitted provided that the following conditions
11  * are met:
12  * 1. Redistributions of source code must retain the above copyright
13  *    notice, this list of conditions and the following disclaimer.
14  * 2. Redistributions in binary form must reproduce the above copyright
15  *    notice, this list of conditions and the following disclaimer in the
16  *    documentation and/or other materials provided with the distribution.
17  *
18  * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
19  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
20  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
21  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
22  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
23  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
24  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
25  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
26  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
27  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
28  * POSSIBILITY OF SUCH DAMAGE.
29  *
30  * $NetBSD: tmpfs_vnops.c,v 1.39 2007/07/23 15:41:01 jmmv Exp $
31  */
32 
33 /*
34  * tmpfs vnode interface.
35  */
36 
37 #include <sys/kernel.h>
38 #include <sys/kern_syscall.h>
39 #include <sys/param.h>
40 #include <sys/fcntl.h>
41 #include <sys/lockf.h>
42 #include <sys/priv.h>
43 #include <sys/proc.h>
44 #include <sys/resourcevar.h>
45 #include <sys/sched.h>
46 #include <sys/stat.h>
47 #include <sys/systm.h>
48 #include <sys/unistd.h>
49 #include <sys/vfsops.h>
50 #include <sys/vnode.h>
51 #include <sys/mountctl.h>
52 
53 #include <vm/vm.h>
54 #include <vm/vm_extern.h>
55 #include <vm/vm_object.h>
56 #include <vm/vm_page.h>
57 #include <vm/vm_pager.h>
58 #include <vm/swap_pager.h>
59 
60 #include <sys/buf2.h>
61 #include <vm/vm_page2.h>
62 
63 #include <vfs/fifofs/fifo.h>
64 #include <vfs/tmpfs/tmpfs_vnops.h>
65 #if 0
66 #include <vfs/tmpfs/tmpfs.h>
67 #endif
68 #include "tmpfs.h"
69 
70 static void tmpfs_strategy_done(struct bio *bio);
71 
72 static __inline
73 void
74 tmpfs_knote(struct vnode *vp, int flags)
75 {
76 	if (flags)
77 		KNOTE(&vp->v_pollinfo.vpi_kqinfo.ki_note, flags);
78 }
79 
80 
81 /* --------------------------------------------------------------------- */
82 
83 static int
84 tmpfs_nresolve(struct vop_nresolve_args *v)
85 {
86 	struct vnode *dvp = v->a_dvp;
87 	struct vnode *vp = NULL;
88 	struct namecache *ncp = v->a_nch->ncp;
89 	struct tmpfs_node *tnode;
90 	struct mount *mp;
91 
92 	int error;
93 	struct tmpfs_dirent *de;
94 	struct tmpfs_node *dnode;
95 
96 	mp = dvp->v_mount;
97 	lwkt_gettoken(&mp->mnt_token);
98 
99 	dnode = VP_TO_TMPFS_DIR(dvp);
100 
101 	de = tmpfs_dir_lookup(dnode, NULL, ncp);
102 	if (de == NULL) {
103 		error = ENOENT;
104 	} else {
105 		/*
106 		 * Allocate a vnode for the node we found.
107 		 */
108 		tnode = de->td_node;
109 		error = tmpfs_alloc_vp(dvp->v_mount, tnode,
110 				       LK_EXCLUSIVE | LK_RETRY, &vp);
111 		if (error)
112 			goto out;
113 		KKASSERT(vp);
114 	}
115 
116 out:
117 	/*
118 	 * Store the result of this lookup in the cache.  Avoid this if the
119 	 * request was for creation, as it does not improve timings on
120 	 * emprical tests.
121 	 */
122 	if (vp) {
123 		vn_unlock(vp);
124 		cache_setvp(v->a_nch, vp);
125 		vrele(vp);
126 	} else if (error == ENOENT) {
127 		cache_setvp(v->a_nch, NULL);
128 	}
129 
130 	lwkt_reltoken(&mp->mnt_token);
131 	return (error);
132 }
133 
134 static int
135 tmpfs_nlookupdotdot(struct vop_nlookupdotdot_args *v)
136 {
137 	struct vnode *dvp = v->a_dvp;
138 	struct vnode **vpp = v->a_vpp;
139 	struct tmpfs_node *dnode = VP_TO_TMPFS_NODE(dvp);
140 	struct ucred *cred = v->a_cred;
141 	struct mount *mp;
142 	int error;
143 
144 	*vpp = NULL;
145 
146 	mp = dvp->v_mount;
147 	lwkt_gettoken(&mp->mnt_token);
148 
149 	/* Check accessibility of requested node as a first step. */
150 	error = VOP_ACCESS(dvp, VEXEC, cred);
151 	if (error != 0) {
152 		lwkt_reltoken(&mp->mnt_token);
153 		return error;
154 	}
155 
156 	if (dnode->tn_dir.tn_parent != NULL) {
157 		/* Allocate a new vnode on the matching entry. */
158 		error = tmpfs_alloc_vp(dvp->v_mount, dnode->tn_dir.tn_parent,
159 				       LK_EXCLUSIVE | LK_RETRY, vpp);
160 
161 		if (*vpp)
162 			vn_unlock(*vpp);
163 	}
164 
165 	lwkt_reltoken(&mp->mnt_token);
166 
167 	return (*vpp == NULL) ? ENOENT : 0;
168 }
169 
170 /* --------------------------------------------------------------------- */
171 
172 static int
173 tmpfs_ncreate(struct vop_ncreate_args *v)
174 {
175 	struct vnode *dvp = v->a_dvp;
176 	struct vnode **vpp = v->a_vpp;
177 	struct namecache *ncp = v->a_nch->ncp;
178 	struct vattr *vap = v->a_vap;
179 	struct ucred *cred = v->a_cred;
180 	struct mount *mp;
181 	int error;
182 
183 	mp = dvp->v_mount;
184 	lwkt_gettoken(&mp->mnt_token);
185 
186 	KKASSERT(vap->va_type == VREG || vap->va_type == VSOCK);
187 
188 	error = tmpfs_alloc_file(dvp, vpp, vap, ncp, cred, NULL);
189 	if (error == 0) {
190 		cache_setunresolved(v->a_nch);
191 		cache_setvp(v->a_nch, *vpp);
192 		tmpfs_knote(dvp, NOTE_WRITE);
193 	}
194 
195 	lwkt_reltoken(&mp->mnt_token);
196 
197 	return (error);
198 }
199 /* --------------------------------------------------------------------- */
200 
201 static int
202 tmpfs_nmknod(struct vop_nmknod_args *v)
203 {
204 	struct vnode *dvp = v->a_dvp;
205 	struct vnode **vpp = v->a_vpp;
206 	struct namecache *ncp = v->a_nch->ncp;
207 	struct vattr *vap = v->a_vap;
208 	struct ucred *cred = v->a_cred;
209 	struct mount *mp = dvp->v_mount;
210 	int error;
211 
212 	lwkt_gettoken(&mp->mnt_token);
213 
214 	if (vap->va_type != VBLK && vap->va_type != VCHR &&
215 	    vap->va_type != VFIFO) {
216 		lwkt_reltoken(&mp->mnt_token);
217 		return (EINVAL);
218 	}
219 
220 	error = tmpfs_alloc_file(dvp, vpp, vap, ncp, cred, NULL);
221 	if (error == 0) {
222 		cache_setunresolved(v->a_nch);
223 		cache_setvp(v->a_nch, *vpp);
224 		tmpfs_knote(dvp, NOTE_WRITE);
225 	}
226 
227 	lwkt_reltoken(&mp->mnt_token);
228 
229 	return error;
230 }
231 
232 /* --------------------------------------------------------------------- */
233 
234 static int
235 tmpfs_open(struct vop_open_args *v)
236 {
237 	struct vnode *vp = v->a_vp;
238 	int mode = v->a_mode;
239 	struct mount *mp = vp->v_mount;
240 	struct tmpfs_node *node;
241 	int error;
242 
243 	lwkt_gettoken(&mp->mnt_token);
244 	node = VP_TO_TMPFS_NODE(vp);
245 
246 #if 0
247 	/* The file is still active but all its names have been removed
248 	 * (e.g. by a "rmdir $(pwd)").  It cannot be opened any more as
249 	 * it is about to die. */
250 	if (node->tn_links < 1)
251 		return (ENOENT);
252 #endif
253 
254 	/* If the file is marked append-only, deny write requests. */
255 	if ((node->tn_flags & APPEND) &&
256 	    (mode & (FWRITE | O_APPEND)) == FWRITE) {
257 		error = EPERM;
258 	} else {
259 		error = (vop_stdopen(v));
260 	}
261 
262 	lwkt_reltoken(&mp->mnt_token);
263 	return (error);
264 }
265 
266 /* --------------------------------------------------------------------- */
267 
268 static int
269 tmpfs_close(struct vop_close_args *v)
270 {
271 	struct vnode *vp = v->a_vp;
272 	struct tmpfs_node *node;
273 	int error;
274 
275 	lwkt_gettoken(&vp->v_mount->mnt_token);
276 	node = VP_TO_TMPFS_NODE(vp);
277 
278 	if (node->tn_links > 0) {
279 		/*
280 		 * Update node times.  No need to do it if the node has
281 		 * been deleted, because it will vanish after we return.
282 		 */
283 		tmpfs_update(vp);
284 	}
285 
286 	error = vop_stdclose(v);
287 
288 	lwkt_reltoken(&vp->v_mount->mnt_token);
289 
290 	return (error);
291 }
292 
293 /* --------------------------------------------------------------------- */
294 
295 int
296 tmpfs_access(struct vop_access_args *v)
297 {
298 	struct vnode *vp = v->a_vp;
299 	int error;
300 	struct tmpfs_node *node;
301 
302 	lwkt_gettoken(&vp->v_mount->mnt_token);
303 	node = VP_TO_TMPFS_NODE(vp);
304 
305 	switch (vp->v_type) {
306 	case VDIR:
307 		/* FALLTHROUGH */
308 	case VLNK:
309 		/* FALLTHROUGH */
310 	case VREG:
311 		if ((v->a_mode & VWRITE) &&
312 	            (vp->v_mount->mnt_flag & MNT_RDONLY)) {
313 			error = EROFS;
314 			goto out;
315 		}
316 		break;
317 
318 	case VBLK:
319 		/* FALLTHROUGH */
320 	case VCHR:
321 		/* FALLTHROUGH */
322 	case VSOCK:
323 		/* FALLTHROUGH */
324 	case VFIFO:
325 		break;
326 
327 	default:
328 		error = EINVAL;
329 		goto out;
330 	}
331 
332 	if ((v->a_mode & VWRITE) && (node->tn_flags & IMMUTABLE)) {
333 		error = EPERM;
334 		goto out;
335 	}
336 
337 	error = vop_helper_access(v, node->tn_uid, node->tn_gid,
338 			          node->tn_mode, 0);
339 
340 out:
341 	lwkt_reltoken(&vp->v_mount->mnt_token);
342 	return error;
343 }
344 
345 /* --------------------------------------------------------------------- */
346 
347 int
348 tmpfs_getattr(struct vop_getattr_args *v)
349 {
350 	struct vnode *vp = v->a_vp;
351 	struct vattr *vap = v->a_vap;
352 	struct tmpfs_node *node;
353 
354 	lwkt_gettoken(&vp->v_mount->mnt_token);
355 	node = VP_TO_TMPFS_NODE(vp);
356 
357 	tmpfs_update(vp);
358 
359 	vap->va_type = vp->v_type;
360 	vap->va_mode = node->tn_mode;
361 	vap->va_nlink = node->tn_links;
362 	vap->va_uid = node->tn_uid;
363 	vap->va_gid = node->tn_gid;
364 	vap->va_fsid = vp->v_mount->mnt_stat.f_fsid.val[0];
365 	vap->va_fileid = node->tn_id;
366 	vap->va_size = node->tn_size;
367 	vap->va_blocksize = PAGE_SIZE;
368 	vap->va_atime.tv_sec = node->tn_atime;
369 	vap->va_atime.tv_nsec = node->tn_atimensec;
370 	vap->va_mtime.tv_sec = node->tn_mtime;
371 	vap->va_mtime.tv_nsec = node->tn_mtimensec;
372 	vap->va_ctime.tv_sec = node->tn_ctime;
373 	vap->va_ctime.tv_nsec = node->tn_ctimensec;
374 	vap->va_gen = node->tn_gen;
375 	vap->va_flags = node->tn_flags;
376 	if (vp->v_type == VBLK || vp->v_type == VCHR)
377 	{
378 		vap->va_rmajor = umajor(node->tn_rdev);
379 		vap->va_rminor = uminor(node->tn_rdev);
380 	}
381 	vap->va_bytes = round_page(node->tn_size);
382 	vap->va_filerev = 0;
383 
384 	lwkt_reltoken(&vp->v_mount->mnt_token);
385 
386 	return 0;
387 }
388 
389 /* --------------------------------------------------------------------- */
390 
391 int
392 tmpfs_setattr(struct vop_setattr_args *v)
393 {
394 	struct vnode *vp = v->a_vp;
395 	struct vattr *vap = v->a_vap;
396 	struct ucred *cred = v->a_cred;
397 	struct tmpfs_node *node = VP_TO_TMPFS_NODE(vp);
398 	int error = 0;
399 	int kflags = 0;
400 
401 	lwkt_gettoken(&vp->v_mount->mnt_token);
402 	if (error == 0 && (vap->va_flags != VNOVAL)) {
403 		error = tmpfs_chflags(vp, vap->va_flags, cred);
404 		kflags |= NOTE_ATTRIB;
405 	}
406 
407 	if (error == 0 && (vap->va_size != VNOVAL)) {
408 		if (vap->va_size > node->tn_size)
409 			kflags |= NOTE_WRITE | NOTE_EXTEND;
410 		else
411 			kflags |= NOTE_WRITE;
412 		error = tmpfs_chsize(vp, vap->va_size, cred);
413 	}
414 
415 	if (error == 0 && (vap->va_uid != (uid_t)VNOVAL ||
416 			   vap->va_gid != (gid_t)VNOVAL)) {
417 		error = tmpfs_chown(vp, vap->va_uid, vap->va_gid, cred);
418 		kflags |= NOTE_ATTRIB;
419 	}
420 
421 	if (error == 0 && (vap->va_mode != (mode_t)VNOVAL)) {
422 		error = tmpfs_chmod(vp, vap->va_mode, cred);
423 		kflags |= NOTE_ATTRIB;
424 	}
425 
426 	if (error == 0 && ((vap->va_atime.tv_sec != VNOVAL &&
427 	    vap->va_atime.tv_nsec != VNOVAL) ||
428 	    (vap->va_mtime.tv_sec != VNOVAL &&
429 	    vap->va_mtime.tv_nsec != VNOVAL) )) {
430 		error = tmpfs_chtimes(vp, &vap->va_atime, &vap->va_mtime,
431 				      vap->va_vaflags, cred);
432 		kflags |= NOTE_ATTRIB;
433 	}
434 
435 	/* Update the node times.  We give preference to the error codes
436 	 * generated by this function rather than the ones that may arise
437 	 * from tmpfs_update. */
438 	tmpfs_update(vp);
439 	tmpfs_knote(vp, kflags);
440 
441 	lwkt_reltoken(&vp->v_mount->mnt_token);
442 
443 	return (error);
444 }
445 
446 /* --------------------------------------------------------------------- */
447 
448 /*
449  * fsync is usually a NOP, but we must take action when unmounting or
450  * when recycling.
451  */
452 static int
453 tmpfs_fsync(struct vop_fsync_args *v)
454 {
455 	struct tmpfs_node *node;
456 	struct vnode *vp = v->a_vp;
457 
458 	lwkt_gettoken(&vp->v_mount->mnt_token);
459 	node = VP_TO_TMPFS_NODE(vp);
460 
461 	tmpfs_update(vp);
462 	if (vp->v_type == VREG) {
463 		if (vp->v_flag & VRECLAIMED) {
464 			if (node->tn_links == 0)
465 				tmpfs_truncate(vp, 0);
466 			else
467 				vfsync(v->a_vp, v->a_waitfor, 1, NULL, NULL);
468 		}
469 	}
470 
471 	lwkt_reltoken(&vp->v_mount->mnt_token);
472 	return 0;
473 }
474 
475 /* --------------------------------------------------------------------- */
476 
477 static int
478 tmpfs_read (struct vop_read_args *ap)
479 {
480 	struct buf *bp;
481 	struct vnode *vp = ap->a_vp;
482 	struct uio *uio = ap->a_uio;
483 	struct tmpfs_node *node;
484 	off_t base_offset;
485 	size_t offset;
486 	size_t len;
487 	size_t resid;
488 	int error;
489 
490 	/*
491 	 * Check the basics
492 	 */
493 	if (uio->uio_offset < 0)
494 		return (EINVAL);
495 	if (vp->v_type != VREG)
496 		return (EINVAL);
497 
498 	/*
499 	 * Extract node, try to shortcut the operation through
500 	 * the VM page cache, allowing us to avoid buffer cache
501 	 * overheads.
502 	 */
503 	node = VP_TO_TMPFS_NODE(vp);
504         resid = uio->uio_resid;
505         error = vop_helper_read_shortcut(ap);
506         if (error)
507                 return error;
508         if (uio->uio_resid == 0) {
509 		if (resid)
510 			goto finished;
511 		return error;
512 	}
513 
514 	/*
515 	 * Fall-through to our normal read code.
516 	 */
517 	while (uio->uio_resid > 0 && uio->uio_offset < node->tn_size) {
518 		/*
519 		 * Use buffer cache I/O (via tmpfs_strategy)
520 		 */
521 		offset = (size_t)uio->uio_offset & TMPFS_BLKMASK64;
522 		base_offset = (off_t)uio->uio_offset - offset;
523 		bp = getcacheblk(vp, base_offset, TMPFS_BLKSIZE, 0);
524 		if (bp == NULL) {
525 			lwkt_gettoken(&vp->v_mount->mnt_token);
526 			error = bread(vp, base_offset, TMPFS_BLKSIZE, &bp);
527 			if (error) {
528 				brelse(bp);
529 				lwkt_reltoken(&vp->v_mount->mnt_token);
530 				kprintf("tmpfs_read bread error %d\n", error);
531 				break;
532 			}
533 			lwkt_reltoken(&vp->v_mount->mnt_token);
534 
535 			/*
536 			 * tmpfs pretty much fiddles directly with the VM
537 			 * system, don't let it exhaust it or we won't play
538 			 * nice with other processes.
539 			 *
540 			 * Only do this if the VOP is coming from a normal
541 			 * read/write.  The VM system handles the case for
542 			 * UIO_NOCOPY.
543 			 */
544 			if (uio->uio_segflg != UIO_NOCOPY)
545 				vm_wait_nominal();
546 		}
547 		bp->b_flags |= B_CLUSTEROK;
548 
549 		/*
550 		 * Figure out how many bytes we can actually copy this loop.
551 		 */
552 		len = TMPFS_BLKSIZE - offset;
553 		if (len > uio->uio_resid)
554 			len = uio->uio_resid;
555 		if (len > node->tn_size - uio->uio_offset)
556 			len = (size_t)(node->tn_size - uio->uio_offset);
557 
558 		error = uiomovebp(bp, (char *)bp->b_data + offset, len, uio);
559 		bqrelse(bp);
560 		if (error) {
561 			kprintf("tmpfs_read uiomove error %d\n", error);
562 			break;
563 		}
564 	}
565 
566 finished:
567 	TMPFS_NODE_LOCK(node);
568 	node->tn_status |= TMPFS_NODE_ACCESSED;
569 	TMPFS_NODE_UNLOCK(node);
570 
571 	return (error);
572 }
573 
574 static int
575 tmpfs_write (struct vop_write_args *ap)
576 {
577 	struct buf *bp;
578 	struct vnode *vp = ap->a_vp;
579 	struct uio *uio = ap->a_uio;
580 	struct thread *td = uio->uio_td;
581 	struct tmpfs_node *node;
582 	boolean_t extended;
583 	off_t oldsize;
584 	int error;
585 	off_t base_offset;
586 	size_t offset;
587 	size_t len;
588 	struct rlimit limit;
589 	int trivial = 0;
590 	int kflags = 0;
591 	int seqcount;
592 
593 	error = 0;
594 	if (uio->uio_resid == 0) {
595 		return error;
596 	}
597 
598 	node = VP_TO_TMPFS_NODE(vp);
599 
600 	if (vp->v_type != VREG)
601 		return (EINVAL);
602 	seqcount = ap->a_ioflag >> 16;
603 
604 	lwkt_gettoken(&vp->v_mount->mnt_token);
605 
606 	oldsize = node->tn_size;
607 	if (ap->a_ioflag & IO_APPEND)
608 		uio->uio_offset = node->tn_size;
609 
610 	/*
611 	 * Check for illegal write offsets.
612 	 */
613 	if (uio->uio_offset + uio->uio_resid >
614 	  VFS_TO_TMPFS(vp->v_mount)->tm_maxfilesize) {
615 		lwkt_reltoken(&vp->v_mount->mnt_token);
616 		return (EFBIG);
617 	}
618 
619 	/*
620 	 * NOTE: Ignore if UIO does not come from a user thread (e.g. VN).
621 	 */
622 	if (vp->v_type == VREG && td != NULL && td->td_lwp != NULL) {
623 		error = kern_getrlimit(RLIMIT_FSIZE, &limit);
624 		if (error != 0) {
625 			lwkt_reltoken(&vp->v_mount->mnt_token);
626 			return error;
627 		}
628 		if (uio->uio_offset + uio->uio_resid > limit.rlim_cur) {
629 			ksignal(td->td_proc, SIGXFSZ);
630 			lwkt_reltoken(&vp->v_mount->mnt_token);
631 			return (EFBIG);
632 		}
633 	}
634 
635 
636 	/*
637 	 * Extend the file's size if necessary
638 	 */
639 	extended = ((uio->uio_offset + uio->uio_resid) > node->tn_size);
640 
641 	while (uio->uio_resid > 0) {
642 		/*
643 		 * Don't completely blow out running buffer I/O
644 		 * when being hit from the pageout daemon.
645 		 */
646 		if (uio->uio_segflg == UIO_NOCOPY &&
647 		    (ap->a_ioflag & IO_RECURSE) == 0) {
648 			bwillwrite(TMPFS_BLKSIZE);
649 		}
650 
651 		/*
652 		 * Use buffer cache I/O (via tmpfs_strategy)
653 		 */
654 		offset = (size_t)uio->uio_offset & TMPFS_BLKMASK64;
655 		base_offset = (off_t)uio->uio_offset - offset;
656 		len = TMPFS_BLKSIZE - offset;
657 		if (len > uio->uio_resid)
658 			len = uio->uio_resid;
659 
660 		if ((uio->uio_offset + len) > node->tn_size) {
661 			trivial = (uio->uio_offset <= node->tn_size);
662 			error = tmpfs_reg_resize(vp, uio->uio_offset + len,  trivial);
663 			if (error)
664 				break;
665 		}
666 
667 		/*
668 		 * Read to fill in any gaps.  Theoretically we could
669 		 * optimize this if the write covers the entire buffer
670 		 * and is not a UIO_NOCOPY write, however this can lead
671 		 * to a security violation exposing random kernel memory
672 		 * (whatever junk was in the backing VM pages before).
673 		 *
674 		 * So just use bread() to do the right thing.
675 		 */
676 		error = bread(vp, base_offset, TMPFS_BLKSIZE, &bp);
677 		error = uiomovebp(bp, (char *)bp->b_data + offset, len, uio);
678 		if (error) {
679 			kprintf("tmpfs_write uiomove error %d\n", error);
680 			brelse(bp);
681 			break;
682 		}
683 
684 		if (uio->uio_offset > node->tn_size) {
685 			node->tn_size = uio->uio_offset;
686 			kflags |= NOTE_EXTEND;
687 		}
688 		kflags |= NOTE_WRITE;
689 
690 		/*
691 		 * Always try to flush the page in the UIO_NOCOPY case.  This
692 		 * can come from the pageout daemon or during vnode eviction.
693 		 * It is not necessarily going to be marked IO_ASYNC/IO_SYNC.
694 		 *
695 		 * For the normal case we buwrite(), dirtying the underlying
696 		 * VM pages instead of dirtying the buffer and releasing the
697 		 * buffer as a clean buffer.  This allows tmpfs to use
698 		 * essentially all available memory to cache file data.
699 		 * If we used bdwrite() the buffer cache would wind up
700 		 * flushing the data to swap too quickly.
701 		 *
702 		 * But because tmpfs can seriously load the VM system we
703 		 * fall-back to using bdwrite() when free memory starts
704 		 * to get low.  This shifts the load away from the VM system
705 		 * and makes tmpfs act more like a normal filesystem with
706 		 * regards to disk activity.
707 		 *
708 		 * tmpfs pretty much fiddles directly with the VM
709 		 * system, don't let it exhaust it or we won't play
710 		 * nice with other processes.  Only do this if the
711 		 * VOP is coming from a normal read/write.  The VM system
712 		 * handles the case for UIO_NOCOPY.
713 		 */
714 		bp->b_flags |= B_CLUSTEROK;
715 		if (uio->uio_segflg == UIO_NOCOPY) {
716 			/*
717 			 * Flush from the pageout daemon, deal with
718 			 * potentially very heavy tmpfs write activity
719 			 * causing long stalls in the pageout daemon
720 			 * before pages get to free/cache.
721 			 *
722 			 * (a) Under severe pressure setting B_DIRECT will
723 			 *     cause a buffer release to try to free the
724 			 *     underlying pages.
725 			 *
726 			 * (b) Under modest memory pressure the B_RELBUF
727 			 *     alone is sufficient to get the pages moved
728 			 *     to the cache.  We could also force this by
729 			 *     setting B_NOTMETA but that might have other
730 			 *     unintended side-effects (e.g. setting
731 			 *     PG_NOTMETA on the VM page).
732 			 *
733 			 * Hopefully this will unblock the VM system more
734 			 * quickly under extreme tmpfs write load.
735 			 */
736 			if (vm_page_count_min(0))
737 				bp->b_flags |= B_DIRECT;
738 			bp->b_flags |= B_AGE | B_RELBUF;
739 			bp->b_act_count = 0;	/* buffer->deactivate pgs */
740 			cluster_awrite(bp);
741 		} else if (vm_page_count_target()) {
742 			/*
743 			 * Normal (userland) write but we are low on memory,
744 			 * run the buffer the buffer cache.
745 			 */
746 			bp->b_act_count = 0;	/* buffer->deactivate pgs */
747 			bdwrite(bp);
748 		} else {
749 			/*
750 			 * Otherwise run the buffer directly through to the
751 			 * backing VM store.
752 			 */
753 			buwrite(bp);
754 			/*vm_wait_nominal();*/
755 		}
756 
757 		if (bp->b_error) {
758 			kprintf("tmpfs_write bwrite error %d\n", bp->b_error);
759 			break;
760 		}
761 	}
762 
763 	if (error) {
764 		if (extended) {
765 			(void)tmpfs_reg_resize(vp, oldsize, trivial);
766 			kflags &= ~NOTE_EXTEND;
767 		}
768 		goto done;
769 	}
770 
771 	/*
772 	 * Currently we don't set the mtime on files modified via mmap()
773 	 * because we can't tell the difference between those modifications
774 	 * and an attempt by the pageout daemon to flush tmpfs pages to
775 	 * swap.
776 	 *
777 	 * This is because in order to defer flushes as long as possible
778 	 * buwrite() works by marking the underlying VM pages dirty in
779 	 * order to be able to dispose of the buffer cache buffer without
780 	 * flushing it.
781 	 */
782 	TMPFS_NODE_LOCK(node);
783 	if (uio->uio_segflg != UIO_NOCOPY)
784 		node->tn_status |= TMPFS_NODE_ACCESSED | TMPFS_NODE_MODIFIED;
785 	if (extended)
786 		node->tn_status |= TMPFS_NODE_CHANGED;
787 
788 	if (node->tn_mode & (S_ISUID | S_ISGID)) {
789 		if (priv_check_cred(ap->a_cred, PRIV_VFS_RETAINSUGID, 0))
790 			node->tn_mode &= ~(S_ISUID | S_ISGID);
791 	}
792 	TMPFS_NODE_UNLOCK(node);
793 done:
794 
795 	tmpfs_knote(vp, kflags);
796 
797 	lwkt_reltoken(&vp->v_mount->mnt_token);
798 	return(error);
799 }
800 
801 static int
802 tmpfs_advlock (struct vop_advlock_args *ap)
803 {
804 	struct tmpfs_node *node;
805 	struct vnode *vp = ap->a_vp;
806 	int error;
807 
808 	lwkt_gettoken(&vp->v_mount->mnt_token);
809 	node = VP_TO_TMPFS_NODE(vp);
810 
811 	error = (lf_advlock(ap, &node->tn_advlock, node->tn_size));
812 	lwkt_reltoken(&vp->v_mount->mnt_token);
813 
814 	return (error);
815 }
816 
817 /*
818  * The strategy function is typically only called when memory pressure
819  * forces the system to attempt to pageout pages.  It can also be called
820  * by [n]vtruncbuf() when a truncation cuts a page in half.  Normal write
821  * operations
822  */
823 static int
824 tmpfs_strategy(struct vop_strategy_args *ap)
825 {
826 	struct bio *bio = ap->a_bio;
827 	struct bio *nbio;
828 	struct buf *bp = bio->bio_buf;
829 	struct vnode *vp = ap->a_vp;
830 	struct tmpfs_node *node;
831 	vm_object_t uobj;
832 	vm_page_t m;
833 	int i;
834 
835 	if (vp->v_type != VREG) {
836 		bp->b_resid = bp->b_bcount;
837 		bp->b_flags |= B_ERROR | B_INVAL;
838 		bp->b_error = EINVAL;
839 		biodone(bio);
840 		return(0);
841 	}
842 
843 	lwkt_gettoken(&vp->v_mount->mnt_token);
844 	node = VP_TO_TMPFS_NODE(vp);
845 
846 	uobj = node->tn_reg.tn_aobj;
847 
848 	/*
849 	 * Don't bother flushing to swap if there is no swap, just
850 	 * ensure that the pages are marked as needing a commit (still).
851 	 */
852 	if (bp->b_cmd == BUF_CMD_WRITE && vm_swap_size == 0) {
853 		for (i = 0; i < bp->b_xio.xio_npages; ++i) {
854 			m = bp->b_xio.xio_pages[i];
855 			vm_page_need_commit(m);
856 		}
857 		bp->b_resid = 0;
858 		bp->b_error = 0;
859 		biodone(bio);
860 	} else {
861 		nbio = push_bio(bio);
862 		nbio->bio_done = tmpfs_strategy_done;
863 		nbio->bio_offset = bio->bio_offset;
864 		swap_pager_strategy(uobj, nbio);
865 	}
866 
867 	lwkt_reltoken(&vp->v_mount->mnt_token);
868 	return 0;
869 }
870 
871 /*
872  * If we were unable to commit the pages to swap make sure they are marked
873  * as needing a commit (again).  If we were, clear the flag to allow the
874  * pages to be freed.
875  */
876 static void
877 tmpfs_strategy_done(struct bio *bio)
878 {
879 	struct buf *bp;
880 	vm_page_t m;
881 	int i;
882 
883 	bp = bio->bio_buf;
884 
885 	if (bp->b_flags & B_ERROR) {
886 		bp->b_flags &= ~B_ERROR;
887 		bp->b_error = 0;
888 		bp->b_resid = 0;
889 		for (i = 0; i < bp->b_xio.xio_npages; ++i) {
890 			m = bp->b_xio.xio_pages[i];
891 			vm_page_need_commit(m);
892 		}
893 	} else {
894 		for (i = 0; i < bp->b_xio.xio_npages; ++i) {
895 			m = bp->b_xio.xio_pages[i];
896 			vm_page_clear_commit(m);
897 		}
898 	}
899 	bio = pop_bio(bio);
900 	biodone(bio);
901 }
902 
903 static int
904 tmpfs_bmap(struct vop_bmap_args *ap)
905 {
906 	if (ap->a_doffsetp != NULL)
907 		*ap->a_doffsetp = ap->a_loffset;
908 	if (ap->a_runp != NULL)
909 		*ap->a_runp = 0;
910 	if (ap->a_runb != NULL)
911 		*ap->a_runb = 0;
912 
913 	return 0;
914 }
915 
916 /* --------------------------------------------------------------------- */
917 
918 static int
919 tmpfs_nremove(struct vop_nremove_args *v)
920 {
921 	struct vnode *dvp = v->a_dvp;
922 	struct namecache *ncp = v->a_nch->ncp;
923 	struct vnode *vp;
924 	int error;
925 	struct tmpfs_dirent *de;
926 	struct tmpfs_mount *tmp;
927 	struct tmpfs_node *dnode;
928 	struct tmpfs_node *node;
929 	struct mount *mp;
930 
931 	mp = dvp->v_mount;
932 
933 	lwkt_gettoken(&mp->mnt_token);
934 
935 	/*
936 	 * We have to acquire the vp from v->a_nch because we will likely
937 	 * unresolve the namecache entry, and a vrele/vput is needed to
938 	 * trigger the tmpfs_inactive/tmpfs_reclaim sequence.
939 	 *
940 	 * We have to use vget to clear any inactive state on the vnode,
941 	 * otherwise the vnode may remain inactive and thus tmpfs_inactive
942 	 * will not get called when we release it.
943 	 */
944 	error = cache_vget(v->a_nch, v->a_cred, LK_SHARED, &vp);
945 	KKASSERT(vp->v_mount == dvp->v_mount);
946 	KKASSERT(error == 0);
947 	vn_unlock(vp);
948 
949 	if (vp->v_type == VDIR) {
950 		error = EISDIR;
951 		goto out;
952 	}
953 
954 	dnode = VP_TO_TMPFS_DIR(dvp);
955 	node = VP_TO_TMPFS_NODE(vp);
956 	tmp = VFS_TO_TMPFS(vp->v_mount);
957 	de = tmpfs_dir_lookup(dnode, node, ncp);
958 	if (de == NULL) {
959 		error = ENOENT;
960 		goto out;
961 	}
962 
963 	/* Files marked as immutable or append-only cannot be deleted. */
964 	if ((node->tn_flags & (IMMUTABLE | APPEND | NOUNLINK)) ||
965 	    (dnode->tn_flags & APPEND)) {
966 		error = EPERM;
967 		goto out;
968 	}
969 
970 	/* Remove the entry from the directory; as it is a file, we do not
971 	 * have to change the number of hard links of the directory. */
972 	tmpfs_dir_detach(dnode, de);
973 
974 	/* Free the directory entry we just deleted.  Note that the node
975 	 * referred by it will not be removed until the vnode is really
976 	 * reclaimed. */
977 	tmpfs_free_dirent(tmp, de);
978 
979 	if (node->tn_links > 0) {
980 	        TMPFS_NODE_LOCK(node);
981 		node->tn_status |= TMPFS_NODE_ACCESSED | TMPFS_NODE_CHANGED | \
982 	                TMPFS_NODE_MODIFIED;
983 	        TMPFS_NODE_UNLOCK(node);
984 	}
985 
986 	cache_unlink(v->a_nch);
987 	tmpfs_knote(vp, NOTE_DELETE);
988 	tmpfs_knote(dvp, NOTE_WRITE);
989 	error = 0;
990 
991 out:
992 	vrele(vp);
993 	lwkt_reltoken(&mp->mnt_token);
994 
995 	return error;
996 }
997 
998 /* --------------------------------------------------------------------- */
999 
1000 static int
1001 tmpfs_nlink(struct vop_nlink_args *v)
1002 {
1003 	struct vnode *dvp = v->a_dvp;
1004 	struct vnode *vp = v->a_vp;
1005 	struct namecache *ncp = v->a_nch->ncp;
1006 	struct tmpfs_dirent *de;
1007 	struct tmpfs_node *node;
1008 	struct tmpfs_node *dnode;
1009 	struct mount *mp;
1010 	int error;
1011 
1012 	if (dvp->v_mount != vp->v_mount)
1013 		return(EXDEV);
1014 	mp = dvp->v_mount;
1015 
1016 	lwkt_gettoken(&mp->mnt_token);
1017 	KKASSERT(dvp != vp); /* XXX When can this be false? */
1018 
1019 	node = VP_TO_TMPFS_NODE(vp);
1020 	dnode = VP_TO_TMPFS_NODE(dvp);
1021 
1022 	/* XXX: Why aren't the following two tests done by the caller? */
1023 
1024 	/* Hard links of directories are forbidden. */
1025 	if (vp->v_type == VDIR) {
1026 		error = EPERM;
1027 		goto out;
1028 	}
1029 
1030 	/* Cannot create cross-device links. */
1031 	if (dvp->v_mount != vp->v_mount) {
1032 		error = EXDEV;
1033 		goto out;
1034 	}
1035 
1036 	/* Ensure that we do not overflow the maximum number of links imposed
1037 	 * by the system. */
1038 	KKASSERT(node->tn_links <= LINK_MAX);
1039 	if (node->tn_links == LINK_MAX) {
1040 		error = EMLINK;
1041 		goto out;
1042 	}
1043 
1044 	/* We cannot create links of files marked immutable or append-only. */
1045 	if (node->tn_flags & (IMMUTABLE | APPEND)) {
1046 		error = EPERM;
1047 		goto out;
1048 	}
1049 
1050 	/* Allocate a new directory entry to represent the node. */
1051 	error = tmpfs_alloc_dirent(VFS_TO_TMPFS(vp->v_mount), node,
1052 				   ncp->nc_name, ncp->nc_nlen, &de);
1053 	if (error != 0)
1054 		goto out;
1055 
1056 	/* Insert the new directory entry into the appropriate directory. */
1057 	tmpfs_dir_attach(dnode, de);
1058 
1059 	/* vp link count has changed, so update node times. */
1060 
1061 	TMPFS_NODE_LOCK(node);
1062 	node->tn_status |= TMPFS_NODE_CHANGED;
1063 	TMPFS_NODE_UNLOCK(node);
1064 	tmpfs_update(vp);
1065 
1066 	tmpfs_knote(vp, NOTE_LINK);
1067 	cache_setunresolved(v->a_nch);
1068 	cache_setvp(v->a_nch, vp);
1069 	tmpfs_knote(dvp, NOTE_WRITE);
1070 	error = 0;
1071 
1072 out:
1073 	lwkt_reltoken(&mp->mnt_token);
1074 	return error;
1075 }
1076 
1077 /* --------------------------------------------------------------------- */
1078 
1079 static int
1080 tmpfs_nrename(struct vop_nrename_args *v)
1081 {
1082 	struct vnode *fdvp = v->a_fdvp;
1083 	struct namecache *fncp = v->a_fnch->ncp;
1084 	struct vnode *fvp = fncp->nc_vp;
1085 	struct vnode *tdvp = v->a_tdvp;
1086 	struct namecache *tncp = v->a_tnch->ncp;
1087 	struct vnode *tvp;
1088 	struct tmpfs_dirent *de, *tde;
1089 	struct tmpfs_mount *tmp;
1090 	struct tmpfs_node *fdnode;
1091 	struct tmpfs_node *fnode;
1092 	struct tmpfs_node *tnode;
1093 	struct tmpfs_node *tdnode;
1094 	struct mount *mp;
1095 	char *newname;
1096 	char *oldname;
1097 	int error;
1098 
1099 	mp = fdvp->v_mount;
1100 	KKASSERT(fdvp->v_mount == fvp->v_mount);
1101 
1102 	lwkt_gettoken(&mp->mnt_token);
1103 	/*
1104 	 * Because tvp can get overwritten we have to vget it instead of
1105 	 * just vref or use it, otherwise it's VINACTIVE flag may not get
1106 	 * cleared and the node won't get destroyed.
1107 	 */
1108 	error = cache_vget(v->a_tnch, v->a_cred, LK_SHARED, &tvp);
1109 	if (error == 0) {
1110 		tnode = VP_TO_TMPFS_NODE(tvp);
1111 		vn_unlock(tvp);
1112 	} else {
1113 		tnode = NULL;
1114 	}
1115 
1116 	/* Disallow cross-device renames.
1117 	 * XXX Why isn't this done by the caller? */
1118 	if (fvp->v_mount != tdvp->v_mount ||
1119 	    (tvp != NULL && fvp->v_mount != tvp->v_mount)) {
1120 		error = EXDEV;
1121 		goto out;
1122 	}
1123 
1124 	tmp = VFS_TO_TMPFS(tdvp->v_mount);
1125 	tdnode = VP_TO_TMPFS_DIR(tdvp);
1126 
1127 	/* If source and target are the same file, there is nothing to do. */
1128 	if (fvp == tvp) {
1129 		error = 0;
1130 		goto out;
1131 	}
1132 
1133 	fdnode = VP_TO_TMPFS_DIR(fdvp);
1134 	fnode = VP_TO_TMPFS_NODE(fvp);
1135 	de = tmpfs_dir_lookup(fdnode, fnode, fncp);
1136 
1137 	/* Avoid manipulating '.' and '..' entries. */
1138 	if (de == NULL) {
1139 		error = ENOENT;
1140 		goto out_locked;
1141 	}
1142 	KKASSERT(de->td_node == fnode);
1143 
1144 	/*
1145 	 * If replacing an entry in the target directory and that entry
1146 	 * is a directory, it must be empty.
1147 	 *
1148 	 * Kern_rename gurantees the destination to be a directory
1149 	 * if the source is one (it does?).
1150 	 */
1151 	if (tvp != NULL) {
1152 		KKASSERT(tnode != NULL);
1153 
1154 		if ((tnode->tn_flags & (NOUNLINK | IMMUTABLE | APPEND)) ||
1155 		    (tdnode->tn_flags & (APPEND | IMMUTABLE))) {
1156 			error = EPERM;
1157 			goto out_locked;
1158 		}
1159 
1160 		if (fnode->tn_type == VDIR && tnode->tn_type == VDIR) {
1161 			if (tnode->tn_size > 0) {
1162 				error = ENOTEMPTY;
1163 				goto out_locked;
1164 			}
1165 		} else if (fnode->tn_type == VDIR && tnode->tn_type != VDIR) {
1166 			error = ENOTDIR;
1167 			goto out_locked;
1168 		} else if (fnode->tn_type != VDIR && tnode->tn_type == VDIR) {
1169 			error = EISDIR;
1170 			goto out_locked;
1171 		} else {
1172 			KKASSERT(fnode->tn_type != VDIR &&
1173 				tnode->tn_type != VDIR);
1174 		}
1175 	}
1176 
1177 	if ((fnode->tn_flags & (NOUNLINK | IMMUTABLE | APPEND)) ||
1178 	    (fdnode->tn_flags & (APPEND | IMMUTABLE))) {
1179 		error = EPERM;
1180 		goto out_locked;
1181 	}
1182 
1183 	/*
1184 	 * Ensure that we have enough memory to hold the new name, if it
1185 	 * has to be changed.
1186 	 */
1187 	if (fncp->nc_nlen != tncp->nc_nlen ||
1188 	    bcmp(fncp->nc_name, tncp->nc_name, fncp->nc_nlen) != 0) {
1189 		newname = kmalloc(tncp->nc_nlen + 1, tmp->tm_name_zone,
1190 				  M_WAITOK | M_NULLOK);
1191 		if (newname == NULL) {
1192 			error = ENOSPC;
1193 			goto out_locked;
1194 		}
1195 		bcopy(tncp->nc_name, newname, tncp->nc_nlen);
1196 		newname[tncp->nc_nlen] = '\0';
1197 	} else {
1198 		newname = NULL;
1199 	}
1200 
1201 	/*
1202 	 * Unlink entry from source directory.  Note that the kernel has
1203 	 * already checked for illegal recursion cases (renaming a directory
1204 	 * into a subdirectory of itself).
1205 	 */
1206 	if (fdnode != tdnode) {
1207 		tmpfs_dir_detach(fdnode, de);
1208 	} else {
1209 		RB_REMOVE(tmpfs_dirtree, &fdnode->tn_dir.tn_dirtree, de);
1210 	}
1211 
1212 	/*
1213 	 * Handle any name change.  Swap with newname, we will
1214 	 * deallocate it at the end.
1215 	 */
1216 	if (newname != NULL) {
1217 #if 0
1218 		TMPFS_NODE_LOCK(fnode);
1219 		fnode->tn_status |= TMPFS_NODE_CHANGED;
1220 		TMPFS_NODE_UNLOCK(fnode);
1221 #endif
1222 		oldname = de->td_name;
1223 		de->td_name = newname;
1224 		de->td_namelen = (uint16_t)tncp->nc_nlen;
1225 		newname = oldname;
1226 	}
1227 
1228 	/*
1229 	 * If we are overwriting an entry, we have to remove the old one
1230 	 * from the target directory.
1231 	 */
1232 	if (tvp != NULL) {
1233 		/* Remove the old entry from the target directory. */
1234 		tde = tmpfs_dir_lookup(tdnode, tnode, tncp);
1235 		tmpfs_dir_detach(tdnode, tde);
1236 		tmpfs_knote(tdnode->tn_vnode, NOTE_DELETE);
1237 
1238 		/*
1239 		 * Free the directory entry we just deleted.  Note that the
1240 		 * node referred by it will not be removed until the vnode is
1241 		 * really reclaimed.
1242 		 */
1243 		tmpfs_free_dirent(VFS_TO_TMPFS(tvp->v_mount), tde);
1244 		/*cache_inval_vp(tvp, CINV_DESTROY);*/
1245 	}
1246 
1247 	/*
1248 	 * Link entry to target directory.  If the entry
1249 	 * represents a directory move the parent linkage
1250 	 * as well.
1251 	 */
1252 	if (fdnode != tdnode) {
1253 		if (de->td_node->tn_type == VDIR) {
1254 			TMPFS_VALIDATE_DIR(fnode);
1255 		}
1256 		tmpfs_dir_attach(tdnode, de);
1257 	} else {
1258 		TMPFS_NODE_LOCK(tdnode);
1259 		tdnode->tn_status |= TMPFS_NODE_MODIFIED;
1260 		RB_INSERT(tmpfs_dirtree, &tdnode->tn_dir.tn_dirtree, de);
1261 		TMPFS_NODE_UNLOCK(tdnode);
1262 	}
1263 
1264 	/*
1265 	 * Finish up
1266 	 */
1267 	if (newname) {
1268 		kfree(newname, tmp->tm_name_zone);
1269 		newname = NULL;
1270 	}
1271 	cache_rename(v->a_fnch, v->a_tnch);
1272 	tmpfs_knote(v->a_fdvp, NOTE_WRITE);
1273 	tmpfs_knote(v->a_tdvp, NOTE_WRITE);
1274 	if (fnode->tn_vnode)
1275 		tmpfs_knote(fnode->tn_vnode, NOTE_RENAME);
1276 	error = 0;
1277 
1278 out_locked:
1279 	;
1280 
1281 out:
1282 	if (tvp)
1283 		vrele(tvp);
1284 
1285 	lwkt_reltoken(&mp->mnt_token);
1286 
1287 	return error;
1288 }
1289 
1290 /* --------------------------------------------------------------------- */
1291 
1292 static int
1293 tmpfs_nmkdir(struct vop_nmkdir_args *v)
1294 {
1295 	struct vnode *dvp = v->a_dvp;
1296 	struct vnode **vpp = v->a_vpp;
1297 	struct namecache *ncp = v->a_nch->ncp;
1298 	struct vattr *vap = v->a_vap;
1299 	struct ucred *cred = v->a_cred;
1300 	struct mount *mp;
1301 	int error;
1302 
1303 	mp = dvp->v_mount;
1304 
1305 	lwkt_gettoken(&mp->mnt_token);
1306 	KKASSERT(vap->va_type == VDIR);
1307 
1308 	error = tmpfs_alloc_file(dvp, vpp, vap, ncp, cred, NULL);
1309 	if (error == 0) {
1310 		cache_setunresolved(v->a_nch);
1311 		cache_setvp(v->a_nch, *vpp);
1312 		tmpfs_knote(dvp, NOTE_WRITE | NOTE_LINK);
1313 	}
1314 
1315 	lwkt_reltoken(&mp->mnt_token);
1316 
1317 	return error;
1318 }
1319 
1320 /* --------------------------------------------------------------------- */
1321 
1322 static int
1323 tmpfs_nrmdir(struct vop_nrmdir_args *v)
1324 {
1325 	struct vnode *dvp = v->a_dvp;
1326 	struct namecache *ncp = v->a_nch->ncp;
1327 	struct vnode *vp;
1328 	struct tmpfs_dirent *de;
1329 	struct tmpfs_mount *tmp;
1330 	struct tmpfs_node *dnode;
1331 	struct tmpfs_node *node;
1332 	struct mount *mp;
1333 	int error;
1334 
1335 	mp = dvp->v_mount;
1336 	lwkt_gettoken(&mp->mnt_token);
1337 
1338 	/*
1339 	 * We have to acquire the vp from v->a_nch because we will likely
1340 	 * unresolve the namecache entry, and a vrele/vput is needed to
1341 	 * trigger the tmpfs_inactive/tmpfs_reclaim sequence.
1342 	 *
1343 	 * We have to use vget to clear any inactive state on the vnode,
1344 	 * otherwise the vnode may remain inactive and thus tmpfs_inactive
1345 	 * will not get called when we release it.
1346 	 */
1347 	error = cache_vget(v->a_nch, v->a_cred, LK_SHARED, &vp);
1348 	KKASSERT(error == 0);
1349 	vn_unlock(vp);
1350 
1351 	/*
1352 	 * Prevalidate so we don't hit an assertion later
1353 	 */
1354 	if (vp->v_type != VDIR) {
1355 		error = ENOTDIR;
1356 		goto out;
1357 	}
1358 
1359 	tmp = VFS_TO_TMPFS(dvp->v_mount);
1360 	dnode = VP_TO_TMPFS_DIR(dvp);
1361 	node = VP_TO_TMPFS_DIR(vp);
1362 
1363 	/* Directories with more than two entries ('.' and '..') cannot be
1364 	 * removed. */
1365 	 if (node->tn_size > 0) {
1366 		 error = ENOTEMPTY;
1367 		 goto out;
1368 	 }
1369 
1370 	if ((dnode->tn_flags & APPEND)
1371 	    || (node->tn_flags & (NOUNLINK | IMMUTABLE | APPEND))) {
1372 		error = EPERM;
1373 		goto out;
1374 	}
1375 
1376 	/* This invariant holds only if we are not trying to remove "..".
1377 	  * We checked for that above so this is safe now. */
1378 	KKASSERT(node->tn_dir.tn_parent == dnode);
1379 
1380 	/* Get the directory entry associated with node (vp).  This was
1381 	 * filled by tmpfs_lookup while looking up the entry. */
1382 	de = tmpfs_dir_lookup(dnode, node, ncp);
1383 	KKASSERT(TMPFS_DIRENT_MATCHES(de,
1384 	    ncp->nc_name,
1385 	    ncp->nc_nlen));
1386 
1387 	/* Check flags to see if we are allowed to remove the directory. */
1388 	if ((dnode->tn_flags & APPEND) ||
1389 	    node->tn_flags & (NOUNLINK | IMMUTABLE | APPEND)) {
1390 		error = EPERM;
1391 		goto out;
1392 	}
1393 
1394 
1395 	/* Detach the directory entry from the directory (dnode). */
1396 	tmpfs_dir_detach(dnode, de);
1397 
1398 	/* No vnode should be allocated for this entry from this point */
1399 	TMPFS_NODE_LOCK(node);
1400 	TMPFS_ASSERT_ELOCKED(node);
1401 	TMPFS_NODE_LOCK(dnode);
1402 	TMPFS_ASSERT_ELOCKED(dnode);
1403 
1404 	/*
1405 	 * Must set parent linkage to NULL (tested by ncreate to disallow
1406 	 * the creation of new files/dirs in a deleted directory)
1407 	 */
1408 	node->tn_status |= TMPFS_NODE_ACCESSED | TMPFS_NODE_CHANGED | \
1409 	    TMPFS_NODE_MODIFIED;
1410 
1411 	dnode->tn_status |= TMPFS_NODE_ACCESSED | \
1412 	    TMPFS_NODE_CHANGED | TMPFS_NODE_MODIFIED;
1413 
1414 	TMPFS_NODE_UNLOCK(dnode);
1415 	TMPFS_NODE_UNLOCK(node);
1416 
1417 	/* Free the directory entry we just deleted.  Note that the node
1418 	 * referred by it will not be removed until the vnode is really
1419 	 * reclaimed. */
1420 	tmpfs_free_dirent(tmp, de);
1421 
1422 	/* Release the deleted vnode (will destroy the node, notify
1423 	 * interested parties and clean it from the cache). */
1424 
1425 	TMPFS_NODE_LOCK(dnode);
1426 	dnode->tn_status |= TMPFS_NODE_CHANGED;
1427 	TMPFS_NODE_UNLOCK(dnode);
1428 	tmpfs_update(dvp);
1429 
1430 	cache_unlink(v->a_nch);
1431 	tmpfs_knote(dvp, NOTE_WRITE | NOTE_LINK);
1432 	error = 0;
1433 
1434 out:
1435 	vrele(vp);
1436 
1437 	lwkt_reltoken(&mp->mnt_token);
1438 
1439 	return error;
1440 }
1441 
1442 /* --------------------------------------------------------------------- */
1443 
1444 static int
1445 tmpfs_nsymlink(struct vop_nsymlink_args *v)
1446 {
1447 	struct vnode *dvp = v->a_dvp;
1448 	struct vnode **vpp = v->a_vpp;
1449 	struct namecache *ncp = v->a_nch->ncp;
1450 	struct vattr *vap = v->a_vap;
1451 	struct ucred *cred = v->a_cred;
1452 	char *target = v->a_target;
1453 	struct mount *mp = dvp->v_mount;
1454 	int error;
1455 
1456 	lwkt_gettoken(&mp->mnt_token);
1457 	vap->va_type = VLNK;
1458 	error = tmpfs_alloc_file(dvp, vpp, vap, ncp, cred, target);
1459 	if (error == 0) {
1460 		tmpfs_knote(*vpp, NOTE_WRITE);
1461 		cache_setunresolved(v->a_nch);
1462 		cache_setvp(v->a_nch, *vpp);
1463 	}
1464 
1465 	lwkt_reltoken(&mp->mnt_token);
1466 
1467 	return error;
1468 }
1469 
1470 /* --------------------------------------------------------------------- */
1471 
1472 static int
1473 tmpfs_readdir(struct vop_readdir_args *v)
1474 {
1475 	struct vnode *vp = v->a_vp;
1476 	struct uio *uio = v->a_uio;
1477 	int *eofflag = v->a_eofflag;
1478 	off_t **cookies = v->a_cookies;
1479 	int *ncookies = v->a_ncookies;
1480 	struct tmpfs_mount *tmp;
1481 	int error;
1482 	off_t startoff;
1483 	off_t cnt = 0;
1484 	struct tmpfs_node *node;
1485 	struct mount *mp = vp->v_mount;
1486 
1487 	lwkt_gettoken(&mp->mnt_token);
1488 
1489 	/* This operation only makes sense on directory nodes. */
1490 	if (vp->v_type != VDIR) {
1491 		lwkt_reltoken(&mp->mnt_token);
1492 		return ENOTDIR;
1493 	}
1494 
1495 	tmp = VFS_TO_TMPFS(vp->v_mount);
1496 	node = VP_TO_TMPFS_DIR(vp);
1497 	startoff = uio->uio_offset;
1498 
1499 	if (uio->uio_offset == TMPFS_DIRCOOKIE_DOT) {
1500 		error = tmpfs_dir_getdotdent(node, uio);
1501 		if (error != 0)
1502 			goto outok;
1503 		cnt++;
1504 	}
1505 
1506 	if (uio->uio_offset == TMPFS_DIRCOOKIE_DOTDOT) {
1507 		error = tmpfs_dir_getdotdotdent(tmp, node, uio);
1508 		if (error != 0)
1509 			goto outok;
1510 		cnt++;
1511 	}
1512 
1513 	error = tmpfs_dir_getdents(node, uio, &cnt);
1514 
1515 outok:
1516 	KKASSERT(error >= -1);
1517 
1518 	if (error == -1)
1519 		error = 0;
1520 
1521 	if (eofflag != NULL)
1522 		*eofflag =
1523 		    (error == 0 && uio->uio_offset == TMPFS_DIRCOOKIE_EOF);
1524 
1525 	/* Update NFS-related variables. */
1526 	if (error == 0 && cookies != NULL && ncookies != NULL) {
1527 		off_t i;
1528 		off_t off = startoff;
1529 		struct tmpfs_dirent *de = NULL;
1530 
1531 		*ncookies = cnt;
1532 		*cookies = kmalloc(cnt * sizeof(off_t), M_TEMP, M_WAITOK);
1533 
1534 		for (i = 0; i < cnt; i++) {
1535 			KKASSERT(off != TMPFS_DIRCOOKIE_EOF);
1536 			if (off == TMPFS_DIRCOOKIE_DOT) {
1537 				off = TMPFS_DIRCOOKIE_DOTDOT;
1538 			} else {
1539 				if (off == TMPFS_DIRCOOKIE_DOTDOT) {
1540 					de = RB_MIN(tmpfs_dirtree, &node->tn_dir.tn_dirtree);
1541 				} else if (de != NULL) {
1542 					de = RB_NEXT(tmpfs_dirtree, &node->tn_dir.tn_dirtree, de);
1543 				} else {
1544 					de = tmpfs_dir_lookupbycookie(node,
1545 					    off);
1546 					KKASSERT(de != NULL);
1547 					de = RB_NEXT(tmpfs_dirtree, &node->tn_dir.tn_dirtree, de);
1548 				}
1549 				if (de == NULL)
1550 					off = TMPFS_DIRCOOKIE_EOF;
1551 				else
1552 					off = tmpfs_dircookie(de);
1553 			}
1554 
1555 			(*cookies)[i] = off;
1556 		}
1557 		KKASSERT(uio->uio_offset == off);
1558 	}
1559 
1560 	lwkt_reltoken(&mp->mnt_token);
1561 
1562 	return error;
1563 }
1564 
1565 /* --------------------------------------------------------------------- */
1566 
1567 static int
1568 tmpfs_readlink(struct vop_readlink_args *v)
1569 {
1570 	struct vnode *vp = v->a_vp;
1571 	struct uio *uio = v->a_uio;
1572 	struct mount *mp = vp->v_mount;
1573 	int error;
1574 	struct tmpfs_node *node;
1575 
1576 	lwkt_gettoken(&mp->mnt_token);
1577 
1578 	KKASSERT(uio->uio_offset == 0);
1579 	KKASSERT(vp->v_type == VLNK);
1580 
1581 	node = VP_TO_TMPFS_NODE(vp);
1582 
1583 	error = uiomove(node->tn_link, MIN(node->tn_size, uio->uio_resid),
1584 	    uio);
1585 	TMPFS_NODE_LOCK(node);
1586 	node->tn_status |= TMPFS_NODE_ACCESSED;
1587 	TMPFS_NODE_UNLOCK(node);
1588 
1589 	lwkt_reltoken(&mp->mnt_token);
1590 
1591 	return error;
1592 }
1593 
1594 /* --------------------------------------------------------------------- */
1595 
1596 static int
1597 tmpfs_inactive(struct vop_inactive_args *v)
1598 {
1599 	struct vnode *vp = v->a_vp;
1600 	struct tmpfs_node *node;
1601 	struct mount *mp;
1602 
1603 	mp = vp->v_mount;
1604 	lwkt_gettoken(&mp->mnt_token);
1605 	node = VP_TO_TMPFS_NODE(vp);
1606 
1607 	/*
1608 	 * Degenerate case
1609 	 */
1610 	if (node == NULL) {
1611 		vrecycle(vp);
1612 		lwkt_reltoken(&mp->mnt_token);
1613 		return(0);
1614 	}
1615 
1616 	/*
1617 	 * Get rid of unreferenced deleted vnodes sooner rather than
1618 	 * later so the data memory can be recovered immediately.
1619 	 *
1620 	 * We must truncate the vnode to prevent the normal reclamation
1621 	 * path from flushing the data for the removed file to disk.
1622 	 */
1623 	TMPFS_NODE_LOCK(node);
1624 	if ((node->tn_vpstate & TMPFS_VNODE_ALLOCATING) == 0 &&
1625 	    node->tn_links == 0)
1626 	{
1627 		node->tn_vpstate = TMPFS_VNODE_DOOMED;
1628 		TMPFS_NODE_UNLOCK(node);
1629 		if (node->tn_type == VREG)
1630 			tmpfs_truncate(vp, 0);
1631 		vrecycle(vp);
1632 	} else {
1633 		TMPFS_NODE_UNLOCK(node);
1634 	}
1635 	lwkt_reltoken(&mp->mnt_token);
1636 
1637 	return 0;
1638 }
1639 
1640 /* --------------------------------------------------------------------- */
1641 
1642 int
1643 tmpfs_reclaim(struct vop_reclaim_args *v)
1644 {
1645 	struct vnode *vp = v->a_vp;
1646 	struct tmpfs_mount *tmp;
1647 	struct tmpfs_node *node;
1648 	struct mount *mp;
1649 
1650 	mp = vp->v_mount;
1651 	lwkt_gettoken(&mp->mnt_token);
1652 
1653 	node = VP_TO_TMPFS_NODE(vp);
1654 	tmp = VFS_TO_TMPFS(vp->v_mount);
1655 	KKASSERT(mp == tmp->tm_mount);
1656 
1657 	tmpfs_free_vp(vp);
1658 
1659 	/*
1660 	 * If the node referenced by this vnode was deleted by the
1661 	 * user, we must free its associated data structures now that
1662 	 * the vnode is being reclaimed.
1663 	 *
1664 	 * Directories have an extra link ref.
1665 	 */
1666 	TMPFS_NODE_LOCK(node);
1667 	if ((node->tn_vpstate & TMPFS_VNODE_ALLOCATING) == 0 &&
1668 	    node->tn_links == 0) {
1669 		node->tn_vpstate = TMPFS_VNODE_DOOMED;
1670 		tmpfs_free_node(tmp, node);
1671 		/* eats the lock */
1672 	} else {
1673 		TMPFS_NODE_UNLOCK(node);
1674 	}
1675 	lwkt_reltoken(&mp->mnt_token);
1676 
1677 	KKASSERT(vp->v_data == NULL);
1678 	return 0;
1679 }
1680 
1681 /* --------------------------------------------------------------------- */
1682 
1683 static int
1684 tmpfs_mountctl(struct vop_mountctl_args *ap)
1685 {
1686 	struct tmpfs_mount *tmp;
1687 	struct mount *mp;
1688 	int rc;
1689 
1690 	mp = ap->a_head.a_ops->head.vv_mount;
1691 	lwkt_gettoken(&mp->mnt_token);
1692 
1693 	switch (ap->a_op) {
1694 	case (MOUNTCTL_SET_EXPORT):
1695 		tmp = (struct tmpfs_mount *) mp->mnt_data;
1696 
1697 		if (ap->a_ctllen != sizeof(struct export_args))
1698 			rc = (EINVAL);
1699 		else
1700 			rc = vfs_export(mp, &tmp->tm_export,
1701 					(const struct export_args *) ap->a_ctl);
1702 		break;
1703 	default:
1704 		rc = vop_stdmountctl(ap);
1705 		break;
1706 	}
1707 
1708 	lwkt_reltoken(&mp->mnt_token);
1709 	return (rc);
1710 }
1711 
1712 /* --------------------------------------------------------------------- */
1713 
1714 static int
1715 tmpfs_print(struct vop_print_args *v)
1716 {
1717 	struct vnode *vp = v->a_vp;
1718 
1719 	struct tmpfs_node *node;
1720 
1721 	node = VP_TO_TMPFS_NODE(vp);
1722 
1723 	kprintf("tag VT_TMPFS, tmpfs_node %p, flags 0x%x, links %d\n",
1724 	    node, node->tn_flags, node->tn_links);
1725 	kprintf("\tmode 0%o, owner %d, group %d, size %ju, status 0x%x\n",
1726 	    node->tn_mode, node->tn_uid, node->tn_gid,
1727 	    (uintmax_t)node->tn_size, node->tn_status);
1728 
1729 	if (vp->v_type == VFIFO)
1730 		fifo_printinfo(vp);
1731 
1732 	kprintf("\n");
1733 
1734 	return 0;
1735 }
1736 
1737 /* --------------------------------------------------------------------- */
1738 
1739 static int
1740 tmpfs_pathconf(struct vop_pathconf_args *v)
1741 {
1742 	int name = v->a_name;
1743 	register_t *retval = v->a_retval;
1744 
1745 	int error;
1746 
1747 	error = 0;
1748 
1749 	switch (name) {
1750 	case _PC_LINK_MAX:
1751 		*retval = LINK_MAX;
1752 		break;
1753 
1754 	case _PC_NAME_MAX:
1755 		*retval = NAME_MAX;
1756 		break;
1757 
1758 	case _PC_PATH_MAX:
1759 		*retval = PATH_MAX;
1760 		break;
1761 
1762 	case _PC_PIPE_BUF:
1763 		*retval = PIPE_BUF;
1764 		break;
1765 
1766 	case _PC_CHOWN_RESTRICTED:
1767 		*retval = 1;
1768 		break;
1769 
1770 	case _PC_NO_TRUNC:
1771 		*retval = 1;
1772 		break;
1773 
1774 	case _PC_SYNC_IO:
1775 		*retval = 1;
1776 		break;
1777 
1778 	case _PC_FILESIZEBITS:
1779 		*retval = 0; /* XXX Don't know which value should I return. */
1780 		break;
1781 
1782 	default:
1783 		error = EINVAL;
1784 	}
1785 
1786 	return error;
1787 }
1788 
1789 /************************************************************************
1790  *                          KQFILTER OPS                                *
1791  ************************************************************************/
1792 
1793 static void filt_tmpfsdetach(struct knote *kn);
1794 static int filt_tmpfsread(struct knote *kn, long hint);
1795 static int filt_tmpfswrite(struct knote *kn, long hint);
1796 static int filt_tmpfsvnode(struct knote *kn, long hint);
1797 
1798 static struct filterops tmpfsread_filtops =
1799 	{ FILTEROP_ISFD, NULL, filt_tmpfsdetach, filt_tmpfsread };
1800 static struct filterops tmpfswrite_filtops =
1801 	{ FILTEROP_ISFD, NULL, filt_tmpfsdetach, filt_tmpfswrite };
1802 static struct filterops tmpfsvnode_filtops =
1803 	{ FILTEROP_ISFD, NULL, filt_tmpfsdetach, filt_tmpfsvnode };
1804 
1805 static int
1806 tmpfs_kqfilter (struct vop_kqfilter_args *ap)
1807 {
1808 	struct vnode *vp = ap->a_vp;
1809 	struct knote *kn = ap->a_kn;
1810 
1811 	switch (kn->kn_filter) {
1812 	case EVFILT_READ:
1813 		kn->kn_fop = &tmpfsread_filtops;
1814 		break;
1815 	case EVFILT_WRITE:
1816 		kn->kn_fop = &tmpfswrite_filtops;
1817 		break;
1818 	case EVFILT_VNODE:
1819 		kn->kn_fop = &tmpfsvnode_filtops;
1820 		break;
1821 	default:
1822 		return (EOPNOTSUPP);
1823 	}
1824 
1825 	kn->kn_hook = (caddr_t)vp;
1826 
1827 	knote_insert(&vp->v_pollinfo.vpi_kqinfo.ki_note, kn);
1828 
1829 	return(0);
1830 }
1831 
1832 static void
1833 filt_tmpfsdetach(struct knote *kn)
1834 {
1835 	struct vnode *vp = (void *)kn->kn_hook;
1836 
1837 	knote_remove(&vp->v_pollinfo.vpi_kqinfo.ki_note, kn);
1838 }
1839 
1840 static int
1841 filt_tmpfsread(struct knote *kn, long hint)
1842 {
1843 	struct vnode *vp = (void *)kn->kn_hook;
1844 	struct tmpfs_node *node = VP_TO_TMPFS_NODE(vp);
1845 	off_t off;
1846 
1847 	if (hint == NOTE_REVOKE) {
1848 		kn->kn_flags |= (EV_EOF | EV_NODATA | EV_ONESHOT);
1849 		return(1);
1850 	}
1851 
1852 	/*
1853 	 * Interlock against MP races when performing this function.
1854 	 */
1855 	lwkt_gettoken(&vp->v_mount->mnt_token);
1856 	off = node->tn_size - kn->kn_fp->f_offset;
1857 	kn->kn_data = (off < INTPTR_MAX) ? off : INTPTR_MAX;
1858 	if (kn->kn_sfflags & NOTE_OLDAPI) {
1859 		lwkt_reltoken(&vp->v_mount->mnt_token);
1860 		return(1);
1861 	}
1862 
1863 	if (kn->kn_data == 0) {
1864 		kn->kn_data = (off < INTPTR_MAX) ? off : INTPTR_MAX;
1865 	}
1866 	lwkt_reltoken(&vp->v_mount->mnt_token);
1867 	return (kn->kn_data != 0);
1868 }
1869 
1870 static int
1871 filt_tmpfswrite(struct knote *kn, long hint)
1872 {
1873 	if (hint == NOTE_REVOKE)
1874 		kn->kn_flags |= (EV_EOF | EV_NODATA | EV_ONESHOT);
1875 	kn->kn_data = 0;
1876 	return (1);
1877 }
1878 
1879 static int
1880 filt_tmpfsvnode(struct knote *kn, long hint)
1881 {
1882 	if (kn->kn_sfflags & hint)
1883 		kn->kn_fflags |= hint;
1884 	if (hint == NOTE_REVOKE) {
1885 		kn->kn_flags |= (EV_EOF | EV_NODATA);
1886 		return (1);
1887 	}
1888 	return (kn->kn_fflags != 0);
1889 }
1890 
1891 
1892 /* --------------------------------------------------------------------- */
1893 
1894 /*
1895  * vnode operations vector used for files stored in a tmpfs file system.
1896  */
1897 struct vop_ops tmpfs_vnode_vops = {
1898 	.vop_default =			vop_defaultop,
1899 	.vop_getpages = 		vop_stdgetpages,
1900 	.vop_putpages = 		vop_stdputpages,
1901 	.vop_ncreate =			tmpfs_ncreate,
1902 	.vop_nresolve =			tmpfs_nresolve,
1903 	.vop_nlookupdotdot =		tmpfs_nlookupdotdot,
1904 	.vop_nmknod =			tmpfs_nmknod,
1905 	.vop_open =			tmpfs_open,
1906 	.vop_close =			tmpfs_close,
1907 	.vop_access =			tmpfs_access,
1908 	.vop_getattr =			tmpfs_getattr,
1909 	.vop_setattr =			tmpfs_setattr,
1910 	.vop_read =			tmpfs_read,
1911 	.vop_write =			tmpfs_write,
1912 	.vop_fsync =			tmpfs_fsync,
1913 	.vop_mountctl =			tmpfs_mountctl,
1914 	.vop_nremove =			tmpfs_nremove,
1915 	.vop_nlink =			tmpfs_nlink,
1916 	.vop_nrename =			tmpfs_nrename,
1917 	.vop_nmkdir =			tmpfs_nmkdir,
1918 	.vop_nrmdir =			tmpfs_nrmdir,
1919 	.vop_nsymlink =			tmpfs_nsymlink,
1920 	.vop_readdir =			tmpfs_readdir,
1921 	.vop_readlink =			tmpfs_readlink,
1922 	.vop_inactive =			tmpfs_inactive,
1923 	.vop_reclaim =			tmpfs_reclaim,
1924 	.vop_print =			tmpfs_print,
1925 	.vop_pathconf =			tmpfs_pathconf,
1926 	.vop_bmap =			tmpfs_bmap,
1927 	.vop_strategy =			tmpfs_strategy,
1928 	.vop_advlock =			tmpfs_advlock,
1929 	.vop_kqfilter =			tmpfs_kqfilter
1930 };
1931