xref: /dflybsd-src/sys/vfs/tmpfs/tmpfs_vnops.c (revision ca98100781ae2b744f37f5faf3f42216c257c711)
1 /*-
2  * Copyright (c) 2005, 2006 The NetBSD Foundation, Inc.
3  * All rights reserved.
4  *
5  * This code is derived from software contributed to The NetBSD Foundation
6  * by Julio M. Merino Vidal, developed as part of Google's Summer of Code
7  * 2005 program.
8  *
9  * Redistribution and use in source and binary forms, with or without
10  * modification, are permitted provided that the following conditions
11  * are met:
12  * 1. Redistributions of source code must retain the above copyright
13  *    notice, this list of conditions and the following disclaimer.
14  * 2. Redistributions in binary form must reproduce the above copyright
15  *    notice, this list of conditions and the following disclaimer in the
16  *    documentation and/or other materials provided with the distribution.
17  *
18  * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
19  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
20  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
21  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
22  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
23  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
24  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
25  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
26  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
27  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
28  * POSSIBILITY OF SUCH DAMAGE.
29  *
30  * $NetBSD: tmpfs_vnops.c,v 1.39 2007/07/23 15:41:01 jmmv Exp $
31  */
32 
33 /*
34  * tmpfs vnode interface.
35  */
36 
37 #include <sys/kernel.h>
38 #include <sys/kern_syscall.h>
39 #include <sys/param.h>
40 #include <sys/fcntl.h>
41 #include <sys/lockf.h>
42 #include <sys/priv.h>
43 #include <sys/proc.h>
44 #include <sys/resourcevar.h>
45 #include <sys/sched.h>
46 #include <sys/stat.h>
47 #include <sys/systm.h>
48 #include <sys/unistd.h>
49 #include <sys/vfsops.h>
50 #include <sys/vnode.h>
51 #include <sys/mountctl.h>
52 
53 #include <vm/vm.h>
54 #include <vm/vm_extern.h>
55 #include <vm/vm_object.h>
56 #include <vm/vm_page.h>
57 #include <vm/vm_pageout.h>
58 #include <vm/vm_pager.h>
59 #include <vm/swap_pager.h>
60 
61 #include <sys/buf2.h>
62 #include <vm/vm_page2.h>
63 
64 #include <vfs/fifofs/fifo.h>
65 #include <vfs/tmpfs/tmpfs_vnops.h>
66 #include "tmpfs.h"
67 
68 static void tmpfs_strategy_done(struct bio *bio);
69 
70 static __inline
71 void
72 tmpfs_knote(struct vnode *vp, int flags)
73 {
74 	if (flags)
75 		KNOTE(&vp->v_pollinfo.vpi_kqinfo.ki_note, flags);
76 }
77 
78 
79 /* --------------------------------------------------------------------- */
80 
81 static int
82 tmpfs_nresolve(struct vop_nresolve_args *v)
83 {
84 	struct vnode *dvp = v->a_dvp;
85 	struct vnode *vp = NULL;
86 	struct namecache *ncp = v->a_nch->ncp;
87 	struct tmpfs_node *tnode;
88 	struct mount *mp;
89 	struct tmpfs_dirent *de;
90 	struct tmpfs_node *dnode;
91 	int error;
92 
93 	mp = dvp->v_mount;
94 
95 	dnode = VP_TO_TMPFS_DIR(dvp);
96 
97 	TMPFS_NODE_LOCK_SH(dnode);
98 	de = tmpfs_dir_lookup(dnode, NULL, ncp);
99 	if (de == NULL) {
100 		error = ENOENT;
101 	} else {
102 		/*
103 		 * Allocate a vnode for the node we found.
104 		 */
105 		tnode = de->td_node;
106 		error = tmpfs_alloc_vp(dvp->v_mount, tnode,
107 				       LK_EXCLUSIVE | LK_RETRY, &vp);
108 		if (error)
109 			goto out;
110 		KKASSERT(vp);
111 	}
112 
113 out:
114 	TMPFS_NODE_UNLOCK(dnode);
115 
116 	if ((dnode->tn_status & TMPFS_NODE_ACCESSED) == 0) {
117 		TMPFS_NODE_LOCK(dnode);
118 		dnode->tn_status |= TMPFS_NODE_ACCESSED;
119 		TMPFS_NODE_UNLOCK(dnode);
120 	}
121 
122 	/*
123 	 * Store the result of this lookup in the cache.  Avoid this if the
124 	 * request was for creation, as it does not improve timings on
125 	 * emprical tests.
126 	 */
127 	if (vp) {
128 		vn_unlock(vp);
129 		cache_setvp(v->a_nch, vp);
130 		vrele(vp);
131 	} else if (error == ENOENT) {
132 		cache_setvp(v->a_nch, NULL);
133 	}
134 	return (error);
135 }
136 
137 static int
138 tmpfs_nlookupdotdot(struct vop_nlookupdotdot_args *v)
139 {
140 	struct vnode *dvp = v->a_dvp;
141 	struct vnode **vpp = v->a_vpp;
142 	struct tmpfs_node *dnode = VP_TO_TMPFS_NODE(dvp);
143 	struct ucred *cred = v->a_cred;
144 	struct mount *mp;
145 	int error;
146 
147 	*vpp = NULL;
148 
149 	mp = dvp->v_mount;
150 
151 	/* Check accessibility of requested node as a first step. */
152 	error = VOP_ACCESS(dvp, VEXEC, cred);
153 	if (error != 0)
154 		return error;
155 
156 	if (dnode->tn_dir.tn_parent != NULL) {
157 		/* Allocate a new vnode on the matching entry. */
158 		error = tmpfs_alloc_vp(dvp->v_mount, dnode->tn_dir.tn_parent,
159 				       LK_EXCLUSIVE | LK_RETRY, vpp);
160 
161 		if (*vpp)
162 			vn_unlock(*vpp);
163 	}
164 	return (*vpp == NULL) ? ENOENT : 0;
165 }
166 
167 /* --------------------------------------------------------------------- */
168 
169 static int
170 tmpfs_ncreate(struct vop_ncreate_args *v)
171 {
172 	struct vnode *dvp = v->a_dvp;
173 	struct vnode **vpp = v->a_vpp;
174 	struct namecache *ncp = v->a_nch->ncp;
175 	struct vattr *vap = v->a_vap;
176 	struct ucred *cred = v->a_cred;
177 	struct mount *mp;
178 	int error;
179 
180 	mp = dvp->v_mount;
181 
182 	KKASSERT(vap->va_type == VREG || vap->va_type == VSOCK);
183 
184 	error = tmpfs_alloc_file(dvp, vpp, vap, ncp, cred, NULL);
185 	if (error == 0) {
186 		cache_setunresolved(v->a_nch);
187 		cache_setvp(v->a_nch, *vpp);
188 		tmpfs_knote(dvp, NOTE_WRITE);
189 	}
190 	return (error);
191 }
192 /* --------------------------------------------------------------------- */
193 
194 static int
195 tmpfs_nmknod(struct vop_nmknod_args *v)
196 {
197 	struct vnode *dvp = v->a_dvp;
198 	struct vnode **vpp = v->a_vpp;
199 	struct namecache *ncp = v->a_nch->ncp;
200 	struct vattr *vap = v->a_vap;
201 	struct ucred *cred = v->a_cred;
202 	int error;
203 
204 	if (vap->va_type != VBLK && vap->va_type != VCHR &&
205 	    vap->va_type != VFIFO) {
206 		return (EINVAL);
207 	}
208 
209 	error = tmpfs_alloc_file(dvp, vpp, vap, ncp, cred, NULL);
210 	if (error == 0) {
211 		cache_setunresolved(v->a_nch);
212 		cache_setvp(v->a_nch, *vpp);
213 		tmpfs_knote(dvp, NOTE_WRITE);
214 	}
215 	return error;
216 }
217 
218 /* --------------------------------------------------------------------- */
219 
220 static int
221 tmpfs_open(struct vop_open_args *v)
222 {
223 	struct vnode *vp = v->a_vp;
224 	int mode = v->a_mode;
225 	struct tmpfs_node *node;
226 	int error;
227 
228 	node = VP_TO_TMPFS_NODE(vp);
229 
230 #if 0
231 	/* The file is still active but all its names have been removed
232 	 * (e.g. by a "rmdir $(pwd)").  It cannot be opened any more as
233 	 * it is about to die. */
234 	if (node->tn_links < 1)
235 		return (ENOENT);
236 #endif
237 
238 	/* If the file is marked append-only, deny write requests. */
239 	if ((node->tn_flags & APPEND) &&
240 	    (mode & (FWRITE | O_APPEND)) == FWRITE) {
241 		error = EPERM;
242 	} else {
243 		error = (vop_stdopen(v));
244 	}
245 
246 	return (error);
247 }
248 
249 /* --------------------------------------------------------------------- */
250 
251 static int
252 tmpfs_close(struct vop_close_args *v)
253 {
254 	struct vnode *vp = v->a_vp;
255 	struct tmpfs_node *node;
256 	int error;
257 
258 	node = VP_TO_TMPFS_NODE(vp);
259 
260 	if (node->tn_links > 0) {
261 		/*
262 		 * Update node times.  No need to do it if the node has
263 		 * been deleted, because it will vanish after we return.
264 		 */
265 		tmpfs_update(vp);
266 	}
267 
268 	error = vop_stdclose(v);
269 
270 	return (error);
271 }
272 
273 /* --------------------------------------------------------------------- */
274 
275 int
276 tmpfs_access(struct vop_access_args *v)
277 {
278 	struct vnode *vp = v->a_vp;
279 	int error;
280 	struct tmpfs_node *node;
281 
282 	node = VP_TO_TMPFS_NODE(vp);
283 
284 	switch (vp->v_type) {
285 	case VDIR:
286 		/* FALLTHROUGH */
287 	case VLNK:
288 		/* FALLTHROUGH */
289 	case VREG:
290 		if ((v->a_mode & VWRITE) &&
291 	            (vp->v_mount->mnt_flag & MNT_RDONLY)) {
292 			error = EROFS;
293 			goto out;
294 		}
295 		break;
296 
297 	case VBLK:
298 		/* FALLTHROUGH */
299 	case VCHR:
300 		/* FALLTHROUGH */
301 	case VSOCK:
302 		/* FALLTHROUGH */
303 	case VFIFO:
304 		break;
305 
306 	default:
307 		error = EINVAL;
308 		goto out;
309 	}
310 
311 	if ((v->a_mode & VWRITE) && (node->tn_flags & IMMUTABLE)) {
312 		error = EPERM;
313 		goto out;
314 	}
315 
316 	error = vop_helper_access(v, node->tn_uid, node->tn_gid,
317 			          node->tn_mode, 0);
318 out:
319 	return error;
320 }
321 
322 /* --------------------------------------------------------------------- */
323 
324 int
325 tmpfs_getattr(struct vop_getattr_args *v)
326 {
327 	struct vnode *vp = v->a_vp;
328 	struct vattr *vap = v->a_vap;
329 	struct tmpfs_node *node;
330 
331 	node = VP_TO_TMPFS_NODE(vp);
332 
333 	tmpfs_update(vp);
334 
335 	TMPFS_NODE_LOCK_SH(node);
336 	vap->va_type = vp->v_type;
337 	vap->va_mode = node->tn_mode;
338 	vap->va_nlink = node->tn_links;
339 	vap->va_uid = node->tn_uid;
340 	vap->va_gid = node->tn_gid;
341 	vap->va_fsid = vp->v_mount->mnt_stat.f_fsid.val[0];
342 	vap->va_fileid = node->tn_id;
343 	vap->va_size = node->tn_size;
344 	vap->va_blocksize = PAGE_SIZE;
345 	vap->va_atime.tv_sec = node->tn_atime;
346 	vap->va_atime.tv_nsec = node->tn_atimensec;
347 	vap->va_mtime.tv_sec = node->tn_mtime;
348 	vap->va_mtime.tv_nsec = node->tn_mtimensec;
349 	vap->va_ctime.tv_sec = node->tn_ctime;
350 	vap->va_ctime.tv_nsec = node->tn_ctimensec;
351 	vap->va_gen = node->tn_gen;
352 	vap->va_flags = node->tn_flags;
353 	if (vp->v_type == VBLK || vp->v_type == VCHR) {
354 		vap->va_rmajor = umajor(node->tn_rdev);
355 		vap->va_rminor = uminor(node->tn_rdev);
356 	}
357 	vap->va_bytes = round_page(node->tn_size);
358 	vap->va_filerev = 0;
359 	TMPFS_NODE_UNLOCK(node);
360 
361 	return 0;
362 }
363 
364 /* --------------------------------------------------------------------- */
365 
366 int
367 tmpfs_setattr(struct vop_setattr_args *v)
368 {
369 	struct vnode *vp = v->a_vp;
370 	struct vattr *vap = v->a_vap;
371 	struct ucred *cred = v->a_cred;
372 	struct tmpfs_node *node = VP_TO_TMPFS_NODE(vp);
373 	int error = 0;
374 	int kflags = 0;
375 
376 	TMPFS_NODE_LOCK(node);
377 	if (error == 0 && (vap->va_flags != VNOVAL)) {
378 		error = tmpfs_chflags(vp, vap->va_flags, cred);
379 		kflags |= NOTE_ATTRIB;
380 	}
381 
382 	if (error == 0 && (vap->va_size != VNOVAL)) {
383 		if (vap->va_size > node->tn_size)
384 			kflags |= NOTE_WRITE | NOTE_EXTEND;
385 		else
386 			kflags |= NOTE_WRITE;
387 		error = tmpfs_chsize(vp, vap->va_size, cred);
388 	}
389 
390 	if (error == 0 && (vap->va_uid != (uid_t)VNOVAL ||
391 			   vap->va_gid != (gid_t)VNOVAL)) {
392 		error = tmpfs_chown(vp, vap->va_uid, vap->va_gid, cred);
393 		kflags |= NOTE_ATTRIB;
394 	}
395 
396 	if (error == 0 && (vap->va_mode != (mode_t)VNOVAL)) {
397 		error = tmpfs_chmod(vp, vap->va_mode, cred);
398 		kflags |= NOTE_ATTRIB;
399 	}
400 
401 	if (error == 0 && ((vap->va_atime.tv_sec != VNOVAL &&
402 	    vap->va_atime.tv_nsec != VNOVAL) ||
403 	    (vap->va_mtime.tv_sec != VNOVAL &&
404 	    vap->va_mtime.tv_nsec != VNOVAL) )) {
405 		error = tmpfs_chtimes(vp, &vap->va_atime, &vap->va_mtime,
406 				      vap->va_vaflags, cred);
407 		kflags |= NOTE_ATTRIB;
408 	}
409 
410 	/*
411 	 * Update the node times.  We give preference to the error codes
412 	 * generated by this function rather than the ones that may arise
413 	 * from tmpfs_update.
414 	 */
415 	tmpfs_update(vp);
416 	TMPFS_NODE_UNLOCK(node);
417 	tmpfs_knote(vp, kflags);
418 
419 	return (error);
420 }
421 
422 /* --------------------------------------------------------------------- */
423 
424 /*
425  * fsync is usually a NOP, but we must take action when unmounting or
426  * when recycling.
427  */
428 static int
429 tmpfs_fsync(struct vop_fsync_args *v)
430 {
431 	struct tmpfs_node *node;
432 	struct vnode *vp = v->a_vp;
433 
434 	node = VP_TO_TMPFS_NODE(vp);
435 
436 	tmpfs_update(vp);
437 	if (vp->v_type == VREG) {
438 		if (vp->v_flag & VRECLAIMED) {
439 			if (node->tn_links == 0)
440 				tmpfs_truncate(vp, 0);
441 			else
442 				vfsync(v->a_vp, v->a_waitfor, 1, NULL, NULL);
443 		}
444 	}
445 	return 0;
446 }
447 
448 /* --------------------------------------------------------------------- */
449 
450 static int
451 tmpfs_read (struct vop_read_args *ap)
452 {
453 	struct buf *bp;
454 	struct vnode *vp = ap->a_vp;
455 	struct uio *uio = ap->a_uio;
456 	struct tmpfs_node *node;
457 	off_t base_offset;
458 	size_t offset;
459 	size_t len;
460 	size_t resid;
461 	int error;
462 
463 	/*
464 	 * Check the basics
465 	 */
466 	if (uio->uio_offset < 0)
467 		return (EINVAL);
468 	if (vp->v_type != VREG)
469 		return (EINVAL);
470 
471 	/*
472 	 * Extract node, try to shortcut the operation through
473 	 * the VM page cache, allowing us to avoid buffer cache
474 	 * overheads.
475 	 */
476 	node = VP_TO_TMPFS_NODE(vp);
477         resid = uio->uio_resid;
478         error = vop_helper_read_shortcut(ap);
479         if (error)
480                 return error;
481         if (uio->uio_resid == 0) {
482 		if (resid)
483 			goto finished;
484 		return error;
485 	}
486 
487 	/*
488 	 * Fall-through to our normal read code.
489 	 */
490 	while (uio->uio_resid > 0 && uio->uio_offset < node->tn_size) {
491 		/*
492 		 * Use buffer cache I/O (via tmpfs_strategy)
493 		 */
494 		offset = (size_t)uio->uio_offset & TMPFS_BLKMASK64;
495 		base_offset = (off_t)uio->uio_offset - offset;
496 		bp = getcacheblk(vp, base_offset, TMPFS_BLKSIZE, 0);
497 		if (bp == NULL) {
498 			error = bread(vp, base_offset, TMPFS_BLKSIZE, &bp);
499 			if (error) {
500 				brelse(bp);
501 				kprintf("tmpfs_read bread error %d\n", error);
502 				break;
503 			}
504 
505 			/*
506 			 * tmpfs pretty much fiddles directly with the VM
507 			 * system, don't let it exhaust it or we won't play
508 			 * nice with other processes.
509 			 *
510 			 * Only do this if the VOP is coming from a normal
511 			 * read/write.  The VM system handles the case for
512 			 * UIO_NOCOPY.
513 			 */
514 			if (uio->uio_segflg != UIO_NOCOPY)
515 				vm_wait_nominal();
516 		}
517 		bp->b_flags |= B_CLUSTEROK;
518 
519 		/*
520 		 * Figure out how many bytes we can actually copy this loop.
521 		 */
522 		len = TMPFS_BLKSIZE - offset;
523 		if (len > uio->uio_resid)
524 			len = uio->uio_resid;
525 		if (len > node->tn_size - uio->uio_offset)
526 			len = (size_t)(node->tn_size - uio->uio_offset);
527 
528 		error = uiomovebp(bp, (char *)bp->b_data + offset, len, uio);
529 		bqrelse(bp);
530 		if (error) {
531 			kprintf("tmpfs_read uiomove error %d\n", error);
532 			break;
533 		}
534 	}
535 
536 finished:
537 	if ((node->tn_status & TMPFS_NODE_ACCESSED) == 0) {
538 		TMPFS_NODE_LOCK(node);
539 		node->tn_status |= TMPFS_NODE_ACCESSED;
540 		TMPFS_NODE_UNLOCK(node);
541 	}
542 	return (error);
543 }
544 
545 static int
546 tmpfs_write (struct vop_write_args *ap)
547 {
548 	struct buf *bp;
549 	struct vnode *vp = ap->a_vp;
550 	struct uio *uio = ap->a_uio;
551 	struct thread *td = uio->uio_td;
552 	struct tmpfs_node *node;
553 	boolean_t extended;
554 	off_t oldsize;
555 	int error;
556 	off_t base_offset;
557 	size_t offset;
558 	size_t len;
559 	struct rlimit limit;
560 	int trivial = 0;
561 	int kflags = 0;
562 	int seqcount;
563 
564 	error = 0;
565 	if (uio->uio_resid == 0) {
566 		return error;
567 	}
568 
569 	node = VP_TO_TMPFS_NODE(vp);
570 
571 	if (vp->v_type != VREG)
572 		return (EINVAL);
573 	seqcount = ap->a_ioflag >> 16;
574 
575 	oldsize = node->tn_size;
576 	if (ap->a_ioflag & IO_APPEND)
577 		uio->uio_offset = node->tn_size;
578 
579 	/*
580 	 * Check for illegal write offsets.
581 	 */
582 	if (uio->uio_offset + uio->uio_resid >
583 	  VFS_TO_TMPFS(vp->v_mount)->tm_maxfilesize) {
584 		return (EFBIG);
585 	}
586 
587 	/*
588 	 * NOTE: Ignore if UIO does not come from a user thread (e.g. VN).
589 	 */
590 	if (vp->v_type == VREG && td != NULL && td->td_lwp != NULL) {
591 		error = kern_getrlimit(RLIMIT_FSIZE, &limit);
592 		if (error != 0) {
593 			return error;
594 		}
595 		if (uio->uio_offset + uio->uio_resid > limit.rlim_cur) {
596 			ksignal(td->td_proc, SIGXFSZ);
597 			return (EFBIG);
598 		}
599 	}
600 
601 
602 	/*
603 	 * Extend the file's size if necessary
604 	 */
605 	extended = ((uio->uio_offset + uio->uio_resid) > node->tn_size);
606 
607 	while (uio->uio_resid > 0) {
608 		/*
609 		 * Don't completely blow out running buffer I/O
610 		 * when being hit from the pageout daemon.
611 		 */
612 		if (uio->uio_segflg == UIO_NOCOPY &&
613 		    (ap->a_ioflag & IO_RECURSE) == 0) {
614 			bwillwrite(TMPFS_BLKSIZE);
615 		}
616 
617 		/*
618 		 * Use buffer cache I/O (via tmpfs_strategy)
619 		 */
620 		offset = (size_t)uio->uio_offset & TMPFS_BLKMASK64;
621 		base_offset = (off_t)uio->uio_offset - offset;
622 		len = TMPFS_BLKSIZE - offset;
623 		if (len > uio->uio_resid)
624 			len = uio->uio_resid;
625 
626 		if ((uio->uio_offset + len) > node->tn_size) {
627 			trivial = (uio->uio_offset <= node->tn_size);
628 			error = tmpfs_reg_resize(vp, uio->uio_offset + len,  trivial);
629 			if (error)
630 				break;
631 		}
632 
633 		/*
634 		 * Read to fill in any gaps.  Theoretically we could
635 		 * optimize this if the write covers the entire buffer
636 		 * and is not a UIO_NOCOPY write, however this can lead
637 		 * to a security violation exposing random kernel memory
638 		 * (whatever junk was in the backing VM pages before).
639 		 *
640 		 * So just use bread() to do the right thing.
641 		 */
642 		error = bread(vp, base_offset, TMPFS_BLKSIZE, &bp);
643 		error = uiomovebp(bp, (char *)bp->b_data + offset, len, uio);
644 		if (error) {
645 			kprintf("tmpfs_write uiomove error %d\n", error);
646 			brelse(bp);
647 			break;
648 		}
649 
650 		if (uio->uio_offset > node->tn_size) {
651 			node->tn_size = uio->uio_offset;
652 			kflags |= NOTE_EXTEND;
653 		}
654 		kflags |= NOTE_WRITE;
655 
656 		/*
657 		 * Always try to flush the page in the UIO_NOCOPY case.  This
658 		 * can come from the pageout daemon or during vnode eviction.
659 		 * It is not necessarily going to be marked IO_ASYNC/IO_SYNC.
660 		 *
661 		 * For the normal case we buwrite(), dirtying the underlying
662 		 * VM pages instead of dirtying the buffer and releasing the
663 		 * buffer as a clean buffer.  This allows tmpfs to use
664 		 * essentially all available memory to cache file data.
665 		 * If we used bdwrite() the buffer cache would wind up
666 		 * flushing the data to swap too quickly.
667 		 *
668 		 * But because tmpfs can seriously load the VM system we
669 		 * fall-back to using bdwrite() when free memory starts
670 		 * to get low.  This shifts the load away from the VM system
671 		 * and makes tmpfs act more like a normal filesystem with
672 		 * regards to disk activity.
673 		 *
674 		 * tmpfs pretty much fiddles directly with the VM
675 		 * system, don't let it exhaust it or we won't play
676 		 * nice with other processes.  Only do this if the
677 		 * VOP is coming from a normal read/write.  The VM system
678 		 * handles the case for UIO_NOCOPY.
679 		 */
680 		bp->b_flags |= B_CLUSTEROK;
681 		if (uio->uio_segflg == UIO_NOCOPY) {
682 			/*
683 			 * Flush from the pageout daemon, deal with
684 			 * potentially very heavy tmpfs write activity
685 			 * causing long stalls in the pageout daemon
686 			 * before pages get to free/cache.
687 			 *
688 			 * (a) Under severe pressure setting B_DIRECT will
689 			 *     cause a buffer release to try to free the
690 			 *     underlying pages.
691 			 *
692 			 * (b) Under modest memory pressure the B_RELBUF
693 			 *     alone is sufficient to get the pages moved
694 			 *     to the cache.  We could also force this by
695 			 *     setting B_NOTMETA but that might have other
696 			 *     unintended side-effects (e.g. setting
697 			 *     PG_NOTMETA on the VM page).
698 			 *
699 			 * Hopefully this will unblock the VM system more
700 			 * quickly under extreme tmpfs write load.
701 			 */
702 			if (vm_page_count_min(vm_page_free_hysteresis))
703 				bp->b_flags |= B_DIRECT;
704 			bp->b_flags |= B_AGE | B_RELBUF;
705 			bp->b_act_count = 0;	/* buffer->deactivate pgs */
706 			cluster_awrite(bp);
707 		} else if (vm_page_count_target()) {
708 			/*
709 			 * Normal (userland) write but we are low on memory,
710 			 * run the buffer the buffer cache.
711 			 */
712 			bp->b_act_count = 0;	/* buffer->deactivate pgs */
713 			bdwrite(bp);
714 		} else {
715 			/*
716 			 * Otherwise run the buffer directly through to the
717 			 * backing VM store.
718 			 */
719 			buwrite(bp);
720 			/*vm_wait_nominal();*/
721 		}
722 
723 		if (bp->b_error) {
724 			kprintf("tmpfs_write bwrite error %d\n", bp->b_error);
725 			break;
726 		}
727 	}
728 
729 	if (error) {
730 		if (extended) {
731 			(void)tmpfs_reg_resize(vp, oldsize, trivial);
732 			kflags &= ~NOTE_EXTEND;
733 		}
734 		goto done;
735 	}
736 
737 	/*
738 	 * Currently we don't set the mtime on files modified via mmap()
739 	 * because we can't tell the difference between those modifications
740 	 * and an attempt by the pageout daemon to flush tmpfs pages to
741 	 * swap.
742 	 *
743 	 * This is because in order to defer flushes as long as possible
744 	 * buwrite() works by marking the underlying VM pages dirty in
745 	 * order to be able to dispose of the buffer cache buffer without
746 	 * flushing it.
747 	 */
748 	TMPFS_NODE_LOCK(node);
749 	if (uio->uio_segflg != UIO_NOCOPY)
750 		node->tn_status |= TMPFS_NODE_ACCESSED | TMPFS_NODE_MODIFIED;
751 	if (extended)
752 		node->tn_status |= TMPFS_NODE_CHANGED;
753 
754 	if (node->tn_mode & (S_ISUID | S_ISGID)) {
755 		if (priv_check_cred(ap->a_cred, PRIV_VFS_RETAINSUGID, 0))
756 			node->tn_mode &= ~(S_ISUID | S_ISGID);
757 	}
758 	TMPFS_NODE_UNLOCK(node);
759 done:
760 	tmpfs_knote(vp, kflags);
761 
762 	return(error);
763 }
764 
765 static int
766 tmpfs_advlock (struct vop_advlock_args *ap)
767 {
768 	struct tmpfs_node *node;
769 	struct vnode *vp = ap->a_vp;
770 	int error;
771 
772 	node = VP_TO_TMPFS_NODE(vp);
773 	error = (lf_advlock(ap, &node->tn_advlock, node->tn_size));
774 
775 	return (error);
776 }
777 
778 /*
779  * The strategy function is typically only called when memory pressure
780  * forces the system to attempt to pageout pages.  It can also be called
781  * by [n]vtruncbuf() when a truncation cuts a page in half.  Normal write
782  * operations
783  */
784 static int
785 tmpfs_strategy(struct vop_strategy_args *ap)
786 {
787 	struct bio *bio = ap->a_bio;
788 	struct bio *nbio;
789 	struct buf *bp = bio->bio_buf;
790 	struct vnode *vp = ap->a_vp;
791 	struct tmpfs_node *node;
792 	vm_object_t uobj;
793 	vm_page_t m;
794 	int i;
795 
796 	if (vp->v_type != VREG) {
797 		bp->b_resid = bp->b_bcount;
798 		bp->b_flags |= B_ERROR | B_INVAL;
799 		bp->b_error = EINVAL;
800 		biodone(bio);
801 		return(0);
802 	}
803 
804 	node = VP_TO_TMPFS_NODE(vp);
805 
806 	uobj = node->tn_reg.tn_aobj;
807 
808 	/*
809 	 * Don't bother flushing to swap if there is no swap, just
810 	 * ensure that the pages are marked as needing a commit (still).
811 	 */
812 	if (bp->b_cmd == BUF_CMD_WRITE && vm_swap_size == 0) {
813 		for (i = 0; i < bp->b_xio.xio_npages; ++i) {
814 			m = bp->b_xio.xio_pages[i];
815 			vm_page_need_commit(m);
816 		}
817 		bp->b_resid = 0;
818 		bp->b_error = 0;
819 		biodone(bio);
820 	} else {
821 		nbio = push_bio(bio);
822 		nbio->bio_done = tmpfs_strategy_done;
823 		nbio->bio_offset = bio->bio_offset;
824 		swap_pager_strategy(uobj, nbio);
825 	}
826 	return 0;
827 }
828 
829 /*
830  * If we were unable to commit the pages to swap make sure they are marked
831  * as needing a commit (again).  If we were, clear the flag to allow the
832  * pages to be freed.
833  */
834 static void
835 tmpfs_strategy_done(struct bio *bio)
836 {
837 	struct buf *bp;
838 	vm_page_t m;
839 	int i;
840 
841 	bp = bio->bio_buf;
842 
843 	if (bp->b_flags & B_ERROR) {
844 		bp->b_flags &= ~B_ERROR;
845 		bp->b_error = 0;
846 		bp->b_resid = 0;
847 		for (i = 0; i < bp->b_xio.xio_npages; ++i) {
848 			m = bp->b_xio.xio_pages[i];
849 			vm_page_need_commit(m);
850 		}
851 	} else {
852 		for (i = 0; i < bp->b_xio.xio_npages; ++i) {
853 			m = bp->b_xio.xio_pages[i];
854 			vm_page_clear_commit(m);
855 		}
856 	}
857 	bio = pop_bio(bio);
858 	biodone(bio);
859 }
860 
861 static int
862 tmpfs_bmap(struct vop_bmap_args *ap)
863 {
864 	if (ap->a_doffsetp != NULL)
865 		*ap->a_doffsetp = ap->a_loffset;
866 	if (ap->a_runp != NULL)
867 		*ap->a_runp = 0;
868 	if (ap->a_runb != NULL)
869 		*ap->a_runb = 0;
870 
871 	return 0;
872 }
873 
874 /* --------------------------------------------------------------------- */
875 
876 static int
877 tmpfs_nremove(struct vop_nremove_args *v)
878 {
879 	struct vnode *dvp = v->a_dvp;
880 	struct namecache *ncp = v->a_nch->ncp;
881 	struct vnode *vp;
882 	int error;
883 	struct tmpfs_dirent *de;
884 	struct tmpfs_mount *tmp;
885 	struct tmpfs_node *dnode;
886 	struct tmpfs_node *node;
887 	struct mount *mp;
888 
889 	mp = dvp->v_mount;
890 
891 	/*
892 	 * We have to acquire the vp from v->a_nch because we will likely
893 	 * unresolve the namecache entry, and a vrele/vput is needed to
894 	 * trigger the tmpfs_inactive/tmpfs_reclaim sequence.
895 	 *
896 	 * We have to use vget to clear any inactive state on the vnode,
897 	 * otherwise the vnode may remain inactive and thus tmpfs_inactive
898 	 * will not get called when we release it.
899 	 */
900 	error = cache_vget(v->a_nch, v->a_cred, LK_SHARED, &vp);
901 	KKASSERT(vp->v_mount == dvp->v_mount);
902 	KKASSERT(error == 0);
903 	vn_unlock(vp);
904 
905 	if (vp->v_type == VDIR) {
906 		error = EISDIR;
907 		goto out2;
908 	}
909 
910 	dnode = VP_TO_TMPFS_DIR(dvp);
911 	node = VP_TO_TMPFS_NODE(vp);
912 	tmp = VFS_TO_TMPFS(vp->v_mount);
913 
914 	TMPFS_NODE_LOCK(dnode);
915 	de = tmpfs_dir_lookup(dnode, node, ncp);
916 	if (de == NULL) {
917 		error = ENOENT;
918 		goto out;
919 	}
920 
921 	/* Files marked as immutable or append-only cannot be deleted. */
922 	if ((node->tn_flags & (IMMUTABLE | APPEND | NOUNLINK)) ||
923 	    (dnode->tn_flags & APPEND)) {
924 		error = EPERM;
925 		goto out;
926 	}
927 
928 	/* Remove the entry from the directory; as it is a file, we do not
929 	 * have to change the number of hard links of the directory. */
930 	tmpfs_dir_detach(dnode, de);
931 
932 	/* Free the directory entry we just deleted.  Note that the node
933 	 * referred by it will not be removed until the vnode is really
934 	 * reclaimed. */
935 	tmpfs_free_dirent(tmp, de);
936 
937 	if (node->tn_links > 0) {
938 	        TMPFS_NODE_LOCK(node);
939 		node->tn_status |= TMPFS_NODE_ACCESSED | TMPFS_NODE_CHANGED | \
940 	                TMPFS_NODE_MODIFIED;
941 	        TMPFS_NODE_UNLOCK(node);
942 	}
943 
944 	cache_unlink(v->a_nch);
945 	tmpfs_knote(vp, NOTE_DELETE);
946 	error = 0;
947 
948 out:
949 	TMPFS_NODE_UNLOCK(dnode);
950 	if (error == 0)
951 		tmpfs_knote(dvp, NOTE_WRITE);
952 out2:
953 	vrele(vp);
954 
955 	return error;
956 }
957 
958 /* --------------------------------------------------------------------- */
959 
960 static int
961 tmpfs_nlink(struct vop_nlink_args *v)
962 {
963 	struct vnode *dvp = v->a_dvp;
964 	struct vnode *vp = v->a_vp;
965 	struct namecache *ncp = v->a_nch->ncp;
966 	struct tmpfs_dirent *de;
967 	struct tmpfs_node *node;
968 	struct tmpfs_node *dnode;
969 	struct mount *mp;
970 	int error;
971 
972 	mp = dvp->v_mount;
973 
974 	KKASSERT(dvp != vp); /* XXX When can this be false? */
975 
976 	node = VP_TO_TMPFS_NODE(vp);
977 	dnode = VP_TO_TMPFS_NODE(dvp);
978 	TMPFS_NODE_LOCK(dnode);
979 
980 	/* XXX: Why aren't the following two tests done by the caller? */
981 
982 	/* Hard links of directories are forbidden. */
983 	if (vp->v_type == VDIR) {
984 		error = EPERM;
985 		goto out;
986 	}
987 
988 	/* Cannot create cross-device links. */
989 	if (dvp->v_mount != vp->v_mount) {
990 		error = EXDEV;
991 		goto out;
992 	}
993 
994 	/* Ensure that we do not overflow the maximum number of links imposed
995 	 * by the system. */
996 	KKASSERT(node->tn_links <= LINK_MAX);
997 	if (node->tn_links >= LINK_MAX) {
998 		error = EMLINK;
999 		goto out;
1000 	}
1001 
1002 	/* We cannot create links of files marked immutable or append-only. */
1003 	if (node->tn_flags & (IMMUTABLE | APPEND)) {
1004 		error = EPERM;
1005 		goto out;
1006 	}
1007 
1008 	/* Allocate a new directory entry to represent the node. */
1009 	error = tmpfs_alloc_dirent(VFS_TO_TMPFS(vp->v_mount), node,
1010 				   ncp->nc_name, ncp->nc_nlen, &de);
1011 	if (error != 0)
1012 		goto out;
1013 
1014 	/* Insert the new directory entry into the appropriate directory. */
1015 	tmpfs_dir_attach(dnode, de);
1016 
1017 	/* vp link count has changed, so update node times. */
1018 
1019 	TMPFS_NODE_LOCK(node);
1020 	node->tn_status |= TMPFS_NODE_CHANGED;
1021 	TMPFS_NODE_UNLOCK(node);
1022 	tmpfs_update(vp);
1023 
1024 	tmpfs_knote(vp, NOTE_LINK);
1025 	cache_setunresolved(v->a_nch);
1026 	cache_setvp(v->a_nch, vp);
1027 	error = 0;
1028 
1029 out:
1030 	TMPFS_NODE_UNLOCK(dnode);
1031 	if (error == 0)
1032 		tmpfs_knote(dvp, NOTE_WRITE);
1033 	return error;
1034 }
1035 
1036 /* --------------------------------------------------------------------- */
1037 
1038 static int
1039 tmpfs_nrename(struct vop_nrename_args *v)
1040 {
1041 	struct vnode *fdvp = v->a_fdvp;
1042 	struct namecache *fncp = v->a_fnch->ncp;
1043 	struct vnode *fvp = fncp->nc_vp;
1044 	struct vnode *tdvp = v->a_tdvp;
1045 	struct namecache *tncp = v->a_tnch->ncp;
1046 	struct vnode *tvp;
1047 	struct tmpfs_dirent *de, *tde;
1048 	struct tmpfs_mount *tmp;
1049 	struct tmpfs_node *fdnode;
1050 	struct tmpfs_node *fnode;
1051 	struct tmpfs_node *tnode;
1052 	struct tmpfs_node *tdnode;
1053 	struct mount *mp;
1054 	char *newname;
1055 	char *oldname;
1056 	int error;
1057 
1058 	mp = fdvp->v_mount;
1059 	KKASSERT(fdvp->v_mount == fvp->v_mount);
1060 
1061 	/*
1062 	 * Because tvp can get overwritten we have to vget it instead of
1063 	 * just vref or use it, otherwise it's VINACTIVE flag may not get
1064 	 * cleared and the node won't get destroyed.
1065 	 */
1066 	error = cache_vget(v->a_tnch, v->a_cred, LK_SHARED, &tvp);
1067 	if (error == 0) {
1068 		tnode = VP_TO_TMPFS_NODE(tvp);
1069 		vn_unlock(tvp);
1070 	} else {
1071 		tnode = NULL;
1072 	}
1073 
1074 	/* Disallow cross-device renames.
1075 	 * XXX Why isn't this done by the caller? */
1076 	if (fvp->v_mount != tdvp->v_mount ||
1077 	    (tvp != NULL && fvp->v_mount != tvp->v_mount)) {
1078 		error = EXDEV;
1079 		goto out;
1080 	}
1081 
1082 	tmp = VFS_TO_TMPFS(tdvp->v_mount);
1083 	tdnode = VP_TO_TMPFS_DIR(tdvp);
1084 
1085 	/* If source and target are the same file, there is nothing to do. */
1086 	if (fvp == tvp) {
1087 		error = 0;
1088 		goto out;
1089 	}
1090 
1091 	fdnode = VP_TO_TMPFS_DIR(fdvp);
1092 	fnode = VP_TO_TMPFS_NODE(fvp);
1093 	TMPFS_NODE_LOCK(fdnode);
1094 	de = tmpfs_dir_lookup(fdnode, fnode, fncp);
1095 	TMPFS_NODE_UNLOCK(fdnode);	/* XXX depend on namecache lock */
1096 
1097 	/* Avoid manipulating '.' and '..' entries. */
1098 	if (de == NULL) {
1099 		error = ENOENT;
1100 		goto out_locked;
1101 	}
1102 	KKASSERT(de->td_node == fnode);
1103 
1104 	/*
1105 	 * If replacing an entry in the target directory and that entry
1106 	 * is a directory, it must be empty.
1107 	 *
1108 	 * Kern_rename gurantees the destination to be a directory
1109 	 * if the source is one (it does?).
1110 	 */
1111 	if (tvp != NULL) {
1112 		KKASSERT(tnode != NULL);
1113 
1114 		if ((tnode->tn_flags & (NOUNLINK | IMMUTABLE | APPEND)) ||
1115 		    (tdnode->tn_flags & (APPEND | IMMUTABLE))) {
1116 			error = EPERM;
1117 			goto out_locked;
1118 		}
1119 
1120 		if (fnode->tn_type == VDIR && tnode->tn_type == VDIR) {
1121 			if (tnode->tn_size > 0) {
1122 				error = ENOTEMPTY;
1123 				goto out_locked;
1124 			}
1125 		} else if (fnode->tn_type == VDIR && tnode->tn_type != VDIR) {
1126 			error = ENOTDIR;
1127 			goto out_locked;
1128 		} else if (fnode->tn_type != VDIR && tnode->tn_type == VDIR) {
1129 			error = EISDIR;
1130 			goto out_locked;
1131 		} else {
1132 			KKASSERT(fnode->tn_type != VDIR &&
1133 				tnode->tn_type != VDIR);
1134 		}
1135 	}
1136 
1137 	if ((fnode->tn_flags & (NOUNLINK | IMMUTABLE | APPEND)) ||
1138 	    (fdnode->tn_flags & (APPEND | IMMUTABLE))) {
1139 		error = EPERM;
1140 		goto out_locked;
1141 	}
1142 
1143 	/*
1144 	 * Ensure that we have enough memory to hold the new name, if it
1145 	 * has to be changed.
1146 	 */
1147 	if (fncp->nc_nlen != tncp->nc_nlen ||
1148 	    bcmp(fncp->nc_name, tncp->nc_name, fncp->nc_nlen) != 0) {
1149 		newname = kmalloc(tncp->nc_nlen + 1, tmp->tm_name_zone,
1150 				  M_WAITOK | M_NULLOK);
1151 		if (newname == NULL) {
1152 			error = ENOSPC;
1153 			goto out_locked;
1154 		}
1155 		bcopy(tncp->nc_name, newname, tncp->nc_nlen);
1156 		newname[tncp->nc_nlen] = '\0';
1157 	} else {
1158 		newname = NULL;
1159 	}
1160 
1161 	/*
1162 	 * Unlink entry from source directory.  Note that the kernel has
1163 	 * already checked for illegal recursion cases (renaming a directory
1164 	 * into a subdirectory of itself).
1165 	 */
1166 	if (fdnode != tdnode) {
1167 		tmpfs_dir_detach(fdnode, de);
1168 	} else {
1169 		/* XXX depend on namecache lock */
1170 		TMPFS_NODE_LOCK(fdnode);
1171 		KKASSERT(de == tmpfs_dir_lookup(fdnode, fnode, fncp));
1172 		RB_REMOVE(tmpfs_dirtree, &fdnode->tn_dir.tn_dirtree, de);
1173 		RB_REMOVE(tmpfs_dirtree_cookie,
1174 			  &fdnode->tn_dir.tn_cookietree, de);
1175 		TMPFS_NODE_UNLOCK(fdnode);
1176 	}
1177 
1178 	/*
1179 	 * Handle any name change.  Swap with newname, we will
1180 	 * deallocate it at the end.
1181 	 */
1182 	if (newname != NULL) {
1183 #if 0
1184 		TMPFS_NODE_LOCK(fnode);
1185 		fnode->tn_status |= TMPFS_NODE_CHANGED;
1186 		TMPFS_NODE_UNLOCK(fnode);
1187 #endif
1188 		oldname = de->td_name;
1189 		de->td_name = newname;
1190 		de->td_namelen = (uint16_t)tncp->nc_nlen;
1191 		newname = oldname;
1192 	}
1193 
1194 	/*
1195 	 * If we are overwriting an entry, we have to remove the old one
1196 	 * from the target directory.
1197 	 */
1198 	if (tvp != NULL) {
1199 		/* Remove the old entry from the target directory. */
1200 		TMPFS_NODE_LOCK(tdnode);
1201 		tde = tmpfs_dir_lookup(tdnode, tnode, tncp);
1202 		tmpfs_dir_detach(tdnode, tde);
1203 		TMPFS_NODE_UNLOCK(tdnode);
1204 		tmpfs_knote(tdnode->tn_vnode, NOTE_DELETE);
1205 
1206 		/*
1207 		 * Free the directory entry we just deleted.  Note that the
1208 		 * node referred by it will not be removed until the vnode is
1209 		 * really reclaimed.
1210 		 */
1211 		tmpfs_free_dirent(VFS_TO_TMPFS(tvp->v_mount), tde);
1212 		/*cache_inval_vp(tvp, CINV_DESTROY);*/
1213 	}
1214 
1215 	/*
1216 	 * Link entry to target directory.  If the entry
1217 	 * represents a directory move the parent linkage
1218 	 * as well.
1219 	 */
1220 	if (fdnode != tdnode) {
1221 		if (de->td_node->tn_type == VDIR) {
1222 			TMPFS_VALIDATE_DIR(fnode);
1223 		}
1224 		tmpfs_dir_attach(tdnode, de);
1225 	} else {
1226 		TMPFS_NODE_LOCK(tdnode);
1227 		tdnode->tn_status |= TMPFS_NODE_MODIFIED;
1228 		RB_INSERT(tmpfs_dirtree, &tdnode->tn_dir.tn_dirtree, de);
1229 		RB_INSERT(tmpfs_dirtree_cookie,
1230 			  &tdnode->tn_dir.tn_cookietree, de);
1231 		TMPFS_NODE_UNLOCK(tdnode);
1232 	}
1233 
1234 	/*
1235 	 * Finish up
1236 	 */
1237 	if (newname) {
1238 		kfree(newname, tmp->tm_name_zone);
1239 		newname = NULL;
1240 	}
1241 	cache_rename(v->a_fnch, v->a_tnch);
1242 	tmpfs_knote(v->a_fdvp, NOTE_WRITE);
1243 	tmpfs_knote(v->a_tdvp, NOTE_WRITE);
1244 	if (fnode->tn_vnode)
1245 		tmpfs_knote(fnode->tn_vnode, NOTE_RENAME);
1246 	error = 0;
1247 
1248 out_locked:
1249 	;
1250 out:
1251 	if (tvp)
1252 		vrele(tvp);
1253 	return error;
1254 }
1255 
1256 /* --------------------------------------------------------------------- */
1257 
1258 static int
1259 tmpfs_nmkdir(struct vop_nmkdir_args *v)
1260 {
1261 	struct vnode *dvp = v->a_dvp;
1262 	struct vnode **vpp = v->a_vpp;
1263 	struct namecache *ncp = v->a_nch->ncp;
1264 	struct vattr *vap = v->a_vap;
1265 	struct ucred *cred = v->a_cred;
1266 	struct mount *mp;
1267 	int error;
1268 
1269 	mp = dvp->v_mount;
1270 
1271 	KKASSERT(vap->va_type == VDIR);
1272 
1273 	error = tmpfs_alloc_file(dvp, vpp, vap, ncp, cred, NULL);
1274 	if (error == 0) {
1275 		cache_setunresolved(v->a_nch);
1276 		cache_setvp(v->a_nch, *vpp);
1277 		tmpfs_knote(dvp, NOTE_WRITE | NOTE_LINK);
1278 	}
1279 	return error;
1280 }
1281 
1282 /* --------------------------------------------------------------------- */
1283 
1284 static int
1285 tmpfs_nrmdir(struct vop_nrmdir_args *v)
1286 {
1287 	struct vnode *dvp = v->a_dvp;
1288 	struct namecache *ncp = v->a_nch->ncp;
1289 	struct vnode *vp;
1290 	struct tmpfs_dirent *de;
1291 	struct tmpfs_mount *tmp;
1292 	struct tmpfs_node *dnode;
1293 	struct tmpfs_node *node;
1294 	struct mount *mp;
1295 	int error;
1296 
1297 	mp = dvp->v_mount;
1298 
1299 	/*
1300 	 * We have to acquire the vp from v->a_nch because we will likely
1301 	 * unresolve the namecache entry, and a vrele/vput is needed to
1302 	 * trigger the tmpfs_inactive/tmpfs_reclaim sequence.
1303 	 *
1304 	 * We have to use vget to clear any inactive state on the vnode,
1305 	 * otherwise the vnode may remain inactive and thus tmpfs_inactive
1306 	 * will not get called when we release it.
1307 	 */
1308 	error = cache_vget(v->a_nch, v->a_cred, LK_SHARED, &vp);
1309 	KKASSERT(error == 0);
1310 	vn_unlock(vp);
1311 
1312 	/*
1313 	 * Prevalidate so we don't hit an assertion later
1314 	 */
1315 	if (vp->v_type != VDIR) {
1316 		error = ENOTDIR;
1317 		goto out;
1318 	}
1319 
1320 	tmp = VFS_TO_TMPFS(dvp->v_mount);
1321 	dnode = VP_TO_TMPFS_DIR(dvp);
1322 	node = VP_TO_TMPFS_DIR(vp);
1323 
1324 	/*
1325 	 * Directories with more than two entries ('.' and '..') cannot
1326 	 * be removed.
1327 	 */
1328 	if (node->tn_size > 0) {
1329 		error = ENOTEMPTY;
1330 		goto out;
1331 	}
1332 
1333 	if ((dnode->tn_flags & APPEND)
1334 	    || (node->tn_flags & (NOUNLINK | IMMUTABLE | APPEND))) {
1335 		error = EPERM;
1336 		goto out;
1337 	}
1338 
1339 	/*
1340 	 * This invariant holds only if we are not trying to
1341 	 * remove "..".  We checked for that above so this is safe now.
1342 	 */
1343 	KKASSERT(node->tn_dir.tn_parent == dnode);
1344 
1345 	/*
1346 	 * Get the directory entry associated with node (vp).  This
1347 	 * was filled by tmpfs_lookup while looking up the entry.
1348 	 */
1349 	TMPFS_NODE_LOCK(dnode);
1350 	de = tmpfs_dir_lookup(dnode, node, ncp);
1351 	KKASSERT(TMPFS_DIRENT_MATCHES(de, ncp->nc_name, ncp->nc_nlen));
1352 
1353 	/* Check flags to see if we are allowed to remove the directory. */
1354 	if ((dnode->tn_flags & APPEND) ||
1355 	    node->tn_flags & (NOUNLINK | IMMUTABLE | APPEND)) {
1356 		error = EPERM;
1357 		TMPFS_NODE_UNLOCK(dnode);
1358 		goto out;
1359 	}
1360 
1361 	/* Detach the directory entry from the directory (dnode). */
1362 	tmpfs_dir_detach(dnode, de);
1363 	TMPFS_NODE_UNLOCK(dnode);
1364 
1365 	/* No vnode should be allocated for this entry from this point */
1366 	TMPFS_NODE_LOCK(dnode);
1367 	TMPFS_ASSERT_ELOCKED(dnode);
1368 	TMPFS_NODE_LOCK(node);
1369 	TMPFS_ASSERT_ELOCKED(node);
1370 
1371 	/*
1372 	 * Must set parent linkage to NULL (tested by ncreate to disallow
1373 	 * the creation of new files/dirs in a deleted directory)
1374 	 */
1375 	node->tn_status |= TMPFS_NODE_ACCESSED | TMPFS_NODE_CHANGED |
1376 			   TMPFS_NODE_MODIFIED;
1377 
1378 	dnode->tn_status |= TMPFS_NODE_ACCESSED | TMPFS_NODE_CHANGED |
1379 			    TMPFS_NODE_MODIFIED;
1380 
1381 	TMPFS_NODE_UNLOCK(node);
1382 	TMPFS_NODE_UNLOCK(dnode);
1383 
1384 	/* Free the directory entry we just deleted.  Note that the node
1385 	 * referred by it will not be removed until the vnode is really
1386 	 * reclaimed. */
1387 	tmpfs_free_dirent(tmp, de);
1388 
1389 	/* Release the deleted vnode (will destroy the node, notify
1390 	 * interested parties and clean it from the cache). */
1391 
1392 	TMPFS_NODE_LOCK(dnode);
1393 	dnode->tn_status |= TMPFS_NODE_CHANGED;
1394 	TMPFS_NODE_UNLOCK(dnode);
1395 	tmpfs_update(dvp);
1396 
1397 	cache_unlink(v->a_nch);
1398 	tmpfs_knote(dvp, NOTE_WRITE | NOTE_LINK);
1399 	error = 0;
1400 
1401 out:
1402 	vrele(vp);
1403 
1404 	return error;
1405 }
1406 
1407 /* --------------------------------------------------------------------- */
1408 
1409 static int
1410 tmpfs_nsymlink(struct vop_nsymlink_args *v)
1411 {
1412 	struct vnode *dvp = v->a_dvp;
1413 	struct vnode **vpp = v->a_vpp;
1414 	struct namecache *ncp = v->a_nch->ncp;
1415 	struct vattr *vap = v->a_vap;
1416 	struct ucred *cred = v->a_cred;
1417 	char *target = v->a_target;
1418 	int error;
1419 
1420 	vap->va_type = VLNK;
1421 	error = tmpfs_alloc_file(dvp, vpp, vap, ncp, cred, target);
1422 	if (error == 0) {
1423 		tmpfs_knote(*vpp, NOTE_WRITE);
1424 		cache_setunresolved(v->a_nch);
1425 		cache_setvp(v->a_nch, *vpp);
1426 	}
1427 	return error;
1428 }
1429 
1430 /* --------------------------------------------------------------------- */
1431 
1432 static int
1433 tmpfs_readdir(struct vop_readdir_args *v)
1434 {
1435 	struct vnode *vp = v->a_vp;
1436 	struct uio *uio = v->a_uio;
1437 	int *eofflag = v->a_eofflag;
1438 	off_t **cookies = v->a_cookies;
1439 	int *ncookies = v->a_ncookies;
1440 	struct tmpfs_mount *tmp;
1441 	int error;
1442 	off_t startoff;
1443 	off_t cnt = 0;
1444 	struct tmpfs_node *node;
1445 
1446 	/* This operation only makes sense on directory nodes. */
1447 	if (vp->v_type != VDIR) {
1448 		return ENOTDIR;
1449 	}
1450 
1451 	tmp = VFS_TO_TMPFS(vp->v_mount);
1452 	node = VP_TO_TMPFS_DIR(vp);
1453 	startoff = uio->uio_offset;
1454 
1455 	if (uio->uio_offset == TMPFS_DIRCOOKIE_DOT) {
1456 		error = tmpfs_dir_getdotdent(node, uio);
1457 		if (error != 0) {
1458 			TMPFS_NODE_LOCK_SH(node);
1459 			goto outok;
1460 		}
1461 		cnt++;
1462 	}
1463 
1464 	if (uio->uio_offset == TMPFS_DIRCOOKIE_DOTDOT) {
1465 		/* may lock parent, cannot hold node lock */
1466 		error = tmpfs_dir_getdotdotdent(tmp, node, uio);
1467 		if (error != 0) {
1468 			TMPFS_NODE_LOCK_SH(node);
1469 			goto outok;
1470 		}
1471 		cnt++;
1472 	}
1473 
1474 	TMPFS_NODE_LOCK_SH(node);
1475 	error = tmpfs_dir_getdents(node, uio, &cnt);
1476 
1477 outok:
1478 	KKASSERT(error >= -1);
1479 
1480 	if (error == -1)
1481 		error = 0;
1482 
1483 	if (eofflag != NULL)
1484 		*eofflag =
1485 		    (error == 0 && uio->uio_offset == TMPFS_DIRCOOKIE_EOF);
1486 
1487 	/* Update NFS-related variables. */
1488 	if (error == 0 && cookies != NULL && ncookies != NULL) {
1489 		off_t i;
1490 		off_t off = startoff;
1491 		struct tmpfs_dirent *de = NULL;
1492 
1493 		*ncookies = cnt;
1494 		*cookies = kmalloc(cnt * sizeof(off_t), M_TEMP, M_WAITOK);
1495 
1496 		for (i = 0; i < cnt; i++) {
1497 			KKASSERT(off != TMPFS_DIRCOOKIE_EOF);
1498 			if (off == TMPFS_DIRCOOKIE_DOT) {
1499 				off = TMPFS_DIRCOOKIE_DOTDOT;
1500 			} else {
1501 				if (off == TMPFS_DIRCOOKIE_DOTDOT) {
1502 					de = RB_MIN(tmpfs_dirtree_cookie,
1503 						&node->tn_dir.tn_cookietree);
1504 				} else if (de != NULL) {
1505 					de = RB_NEXT(tmpfs_dirtree_cookie,
1506 					       &node->tn_dir.tn_cookietree, de);
1507 				} else {
1508 					de = tmpfs_dir_lookupbycookie(node,
1509 								      off);
1510 					KKASSERT(de != NULL);
1511 					de = RB_NEXT(tmpfs_dirtree_cookie,
1512 					       &node->tn_dir.tn_cookietree, de);
1513 				}
1514 				if (de == NULL)
1515 					off = TMPFS_DIRCOOKIE_EOF;
1516 				else
1517 					off = tmpfs_dircookie(de);
1518 			}
1519 			(*cookies)[i] = off;
1520 		}
1521 		KKASSERT(uio->uio_offset == off);
1522 	}
1523 	TMPFS_NODE_UNLOCK(node);
1524 
1525 	if ((node->tn_status & TMPFS_NODE_ACCESSED) == 0) {
1526 		TMPFS_NODE_LOCK(node);
1527 		node->tn_status |= TMPFS_NODE_ACCESSED;
1528 		TMPFS_NODE_UNLOCK(node);
1529 	}
1530 	return error;
1531 }
1532 
1533 /* --------------------------------------------------------------------- */
1534 
1535 static int
1536 tmpfs_readlink(struct vop_readlink_args *v)
1537 {
1538 	struct vnode *vp = v->a_vp;
1539 	struct uio *uio = v->a_uio;
1540 	int error;
1541 	struct tmpfs_node *node;
1542 
1543 	KKASSERT(uio->uio_offset == 0);
1544 	KKASSERT(vp->v_type == VLNK);
1545 
1546 	node = VP_TO_TMPFS_NODE(vp);
1547 	TMPFS_NODE_LOCK_SH(node);
1548 	error = uiomove(node->tn_link,
1549 			MIN(node->tn_size, uio->uio_resid), uio);
1550 	TMPFS_NODE_UNLOCK(node);
1551 	if ((node->tn_status & TMPFS_NODE_ACCESSED) == 0) {
1552 		TMPFS_NODE_LOCK(node);
1553 		node->tn_status |= TMPFS_NODE_ACCESSED;
1554 		TMPFS_NODE_UNLOCK(node);
1555 	}
1556 	return error;
1557 }
1558 
1559 /* --------------------------------------------------------------------- */
1560 
1561 static int
1562 tmpfs_inactive(struct vop_inactive_args *v)
1563 {
1564 	struct vnode *vp = v->a_vp;
1565 	struct tmpfs_node *node;
1566 	struct mount *mp;
1567 
1568 	mp = vp->v_mount;
1569 	lwkt_gettoken(&mp->mnt_token);
1570 	node = VP_TO_TMPFS_NODE(vp);
1571 
1572 	/*
1573 	 * Degenerate case
1574 	 */
1575 	if (node == NULL) {
1576 		vrecycle(vp);
1577 		lwkt_reltoken(&mp->mnt_token);
1578 		return(0);
1579 	}
1580 
1581 	/*
1582 	 * Get rid of unreferenced deleted vnodes sooner rather than
1583 	 * later so the data memory can be recovered immediately.
1584 	 *
1585 	 * We must truncate the vnode to prevent the normal reclamation
1586 	 * path from flushing the data for the removed file to disk.
1587 	 */
1588 	TMPFS_NODE_LOCK(node);
1589 	if ((node->tn_vpstate & TMPFS_VNODE_ALLOCATING) == 0 &&
1590 	    node->tn_links == 0)
1591 	{
1592 		node->tn_vpstate = TMPFS_VNODE_DOOMED;
1593 		TMPFS_NODE_UNLOCK(node);
1594 		if (node->tn_type == VREG)
1595 			tmpfs_truncate(vp, 0);
1596 		vrecycle(vp);
1597 	} else {
1598 		TMPFS_NODE_UNLOCK(node);
1599 	}
1600 	lwkt_reltoken(&mp->mnt_token);
1601 
1602 	return 0;
1603 }
1604 
1605 /* --------------------------------------------------------------------- */
1606 
1607 int
1608 tmpfs_reclaim(struct vop_reclaim_args *v)
1609 {
1610 	struct vnode *vp = v->a_vp;
1611 	struct tmpfs_mount *tmp;
1612 	struct tmpfs_node *node;
1613 	struct mount *mp;
1614 
1615 	mp = vp->v_mount;
1616 	lwkt_gettoken(&mp->mnt_token);
1617 
1618 	node = VP_TO_TMPFS_NODE(vp);
1619 	tmp = VFS_TO_TMPFS(vp->v_mount);
1620 	KKASSERT(mp == tmp->tm_mount);
1621 
1622 	tmpfs_free_vp(vp);
1623 
1624 	/*
1625 	 * If the node referenced by this vnode was deleted by the
1626 	 * user, we must free its associated data structures now that
1627 	 * the vnode is being reclaimed.
1628 	 *
1629 	 * Directories have an extra link ref.
1630 	 */
1631 	TMPFS_NODE_LOCK(node);
1632 	if ((node->tn_vpstate & TMPFS_VNODE_ALLOCATING) == 0 &&
1633 	    node->tn_links == 0) {
1634 		node->tn_vpstate = TMPFS_VNODE_DOOMED;
1635 		tmpfs_free_node(tmp, node);
1636 		/* eats the lock */
1637 	} else {
1638 		TMPFS_NODE_UNLOCK(node);
1639 	}
1640 	lwkt_reltoken(&mp->mnt_token);
1641 
1642 	KKASSERT(vp->v_data == NULL);
1643 	return 0;
1644 }
1645 
1646 /* --------------------------------------------------------------------- */
1647 
1648 static int
1649 tmpfs_mountctl(struct vop_mountctl_args *ap)
1650 {
1651 	struct tmpfs_mount *tmp;
1652 	struct mount *mp;
1653 	int rc;
1654 
1655 	mp = ap->a_head.a_ops->head.vv_mount;
1656 	lwkt_gettoken(&mp->mnt_token);
1657 
1658 	switch (ap->a_op) {
1659 	case (MOUNTCTL_SET_EXPORT):
1660 		tmp = (struct tmpfs_mount *) mp->mnt_data;
1661 
1662 		if (ap->a_ctllen != sizeof(struct export_args))
1663 			rc = (EINVAL);
1664 		else
1665 			rc = vfs_export(mp, &tmp->tm_export,
1666 					(const struct export_args *) ap->a_ctl);
1667 		break;
1668 	default:
1669 		rc = vop_stdmountctl(ap);
1670 		break;
1671 	}
1672 
1673 	lwkt_reltoken(&mp->mnt_token);
1674 	return (rc);
1675 }
1676 
1677 /* --------------------------------------------------------------------- */
1678 
1679 static int
1680 tmpfs_print(struct vop_print_args *v)
1681 {
1682 	struct vnode *vp = v->a_vp;
1683 
1684 	struct tmpfs_node *node;
1685 
1686 	node = VP_TO_TMPFS_NODE(vp);
1687 
1688 	kprintf("tag VT_TMPFS, tmpfs_node %p, flags 0x%x, links %d\n",
1689 	    node, node->tn_flags, node->tn_links);
1690 	kprintf("\tmode 0%o, owner %d, group %d, size %ju, status 0x%x\n",
1691 	    node->tn_mode, node->tn_uid, node->tn_gid,
1692 	    (uintmax_t)node->tn_size, node->tn_status);
1693 
1694 	if (vp->v_type == VFIFO)
1695 		fifo_printinfo(vp);
1696 
1697 	kprintf("\n");
1698 
1699 	return 0;
1700 }
1701 
1702 /* --------------------------------------------------------------------- */
1703 
1704 static int
1705 tmpfs_pathconf(struct vop_pathconf_args *v)
1706 {
1707 	int name = v->a_name;
1708 	register_t *retval = v->a_retval;
1709 
1710 	int error;
1711 
1712 	error = 0;
1713 
1714 	switch (name) {
1715 	case _PC_LINK_MAX:
1716 		*retval = LINK_MAX;
1717 		break;
1718 
1719 	case _PC_NAME_MAX:
1720 		*retval = NAME_MAX;
1721 		break;
1722 
1723 	case _PC_PATH_MAX:
1724 		*retval = PATH_MAX;
1725 		break;
1726 
1727 	case _PC_PIPE_BUF:
1728 		*retval = PIPE_BUF;
1729 		break;
1730 
1731 	case _PC_CHOWN_RESTRICTED:
1732 		*retval = 1;
1733 		break;
1734 
1735 	case _PC_NO_TRUNC:
1736 		*retval = 1;
1737 		break;
1738 
1739 	case _PC_SYNC_IO:
1740 		*retval = 1;
1741 		break;
1742 
1743 	case _PC_FILESIZEBITS:
1744 		*retval = 0; /* XXX Don't know which value should I return. */
1745 		break;
1746 
1747 	default:
1748 		error = EINVAL;
1749 	}
1750 
1751 	return error;
1752 }
1753 
1754 /************************************************************************
1755  *                          KQFILTER OPS                                *
1756  ************************************************************************/
1757 
1758 static void filt_tmpfsdetach(struct knote *kn);
1759 static int filt_tmpfsread(struct knote *kn, long hint);
1760 static int filt_tmpfswrite(struct knote *kn, long hint);
1761 static int filt_tmpfsvnode(struct knote *kn, long hint);
1762 
1763 static struct filterops tmpfsread_filtops =
1764 	{ FILTEROP_ISFD | FILTEROP_MPSAFE,
1765 	  NULL, filt_tmpfsdetach, filt_tmpfsread };
1766 static struct filterops tmpfswrite_filtops =
1767 	{ FILTEROP_ISFD | FILTEROP_MPSAFE,
1768 	  NULL, filt_tmpfsdetach, filt_tmpfswrite };
1769 static struct filterops tmpfsvnode_filtops =
1770 	{ FILTEROP_ISFD | FILTEROP_MPSAFE,
1771 	  NULL, filt_tmpfsdetach, filt_tmpfsvnode };
1772 
1773 static int
1774 tmpfs_kqfilter (struct vop_kqfilter_args *ap)
1775 {
1776 	struct vnode *vp = ap->a_vp;
1777 	struct knote *kn = ap->a_kn;
1778 
1779 	switch (kn->kn_filter) {
1780 	case EVFILT_READ:
1781 		kn->kn_fop = &tmpfsread_filtops;
1782 		break;
1783 	case EVFILT_WRITE:
1784 		kn->kn_fop = &tmpfswrite_filtops;
1785 		break;
1786 	case EVFILT_VNODE:
1787 		kn->kn_fop = &tmpfsvnode_filtops;
1788 		break;
1789 	default:
1790 		return (EOPNOTSUPP);
1791 	}
1792 
1793 	kn->kn_hook = (caddr_t)vp;
1794 
1795 	knote_insert(&vp->v_pollinfo.vpi_kqinfo.ki_note, kn);
1796 
1797 	return(0);
1798 }
1799 
1800 static void
1801 filt_tmpfsdetach(struct knote *kn)
1802 {
1803 	struct vnode *vp = (void *)kn->kn_hook;
1804 
1805 	knote_remove(&vp->v_pollinfo.vpi_kqinfo.ki_note, kn);
1806 }
1807 
1808 static int
1809 filt_tmpfsread(struct knote *kn, long hint)
1810 {
1811 	struct vnode *vp = (void *)kn->kn_hook;
1812 	struct tmpfs_node *node = VP_TO_TMPFS_NODE(vp);
1813 	off_t off;
1814 
1815 	if (hint == NOTE_REVOKE) {
1816 		kn->kn_flags |= (EV_EOF | EV_NODATA | EV_ONESHOT);
1817 		return(1);
1818 	}
1819 
1820 	/*
1821 	 * Interlock against MP races when performing this function.
1822 	 */
1823 	TMPFS_NODE_LOCK_SH(node);
1824 	off = node->tn_size - kn->kn_fp->f_offset;
1825 	kn->kn_data = (off < INTPTR_MAX) ? off : INTPTR_MAX;
1826 	if (kn->kn_sfflags & NOTE_OLDAPI) {
1827 		TMPFS_NODE_UNLOCK(node);
1828 		return(1);
1829 	}
1830 	if (kn->kn_data == 0) {
1831 		kn->kn_data = (off < INTPTR_MAX) ? off : INTPTR_MAX;
1832 	}
1833 	TMPFS_NODE_UNLOCK(node);
1834 	return (kn->kn_data != 0);
1835 }
1836 
1837 static int
1838 filt_tmpfswrite(struct knote *kn, long hint)
1839 {
1840 	if (hint == NOTE_REVOKE)
1841 		kn->kn_flags |= (EV_EOF | EV_NODATA | EV_ONESHOT);
1842 	kn->kn_data = 0;
1843 	return (1);
1844 }
1845 
1846 static int
1847 filt_tmpfsvnode(struct knote *kn, long hint)
1848 {
1849 	if (kn->kn_sfflags & hint)
1850 		kn->kn_fflags |= hint;
1851 	if (hint == NOTE_REVOKE) {
1852 		kn->kn_flags |= (EV_EOF | EV_NODATA);
1853 		return (1);
1854 	}
1855 	return (kn->kn_fflags != 0);
1856 }
1857 
1858 
1859 /* --------------------------------------------------------------------- */
1860 
1861 /*
1862  * vnode operations vector used for files stored in a tmpfs file system.
1863  */
1864 struct vop_ops tmpfs_vnode_vops = {
1865 	.vop_default =			vop_defaultop,
1866 	.vop_getpages = 		vop_stdgetpages,
1867 	.vop_putpages = 		vop_stdputpages,
1868 	.vop_ncreate =			tmpfs_ncreate,
1869 	.vop_nresolve =			tmpfs_nresolve,
1870 	.vop_nlookupdotdot =		tmpfs_nlookupdotdot,
1871 	.vop_nmknod =			tmpfs_nmknod,
1872 	.vop_open =			tmpfs_open,
1873 	.vop_close =			tmpfs_close,
1874 	.vop_access =			tmpfs_access,
1875 	.vop_getattr =			tmpfs_getattr,
1876 	.vop_setattr =			tmpfs_setattr,
1877 	.vop_read =			tmpfs_read,
1878 	.vop_write =			tmpfs_write,
1879 	.vop_fsync =			tmpfs_fsync,
1880 	.vop_mountctl =			tmpfs_mountctl,
1881 	.vop_nremove =			tmpfs_nremove,
1882 	.vop_nlink =			tmpfs_nlink,
1883 	.vop_nrename =			tmpfs_nrename,
1884 	.vop_nmkdir =			tmpfs_nmkdir,
1885 	.vop_nrmdir =			tmpfs_nrmdir,
1886 	.vop_nsymlink =			tmpfs_nsymlink,
1887 	.vop_readdir =			tmpfs_readdir,
1888 	.vop_readlink =			tmpfs_readlink,
1889 	.vop_inactive =			tmpfs_inactive,
1890 	.vop_reclaim =			tmpfs_reclaim,
1891 	.vop_print =			tmpfs_print,
1892 	.vop_pathconf =			tmpfs_pathconf,
1893 	.vop_bmap =			tmpfs_bmap,
1894 	.vop_strategy =			tmpfs_strategy,
1895 	.vop_advlock =			tmpfs_advlock,
1896 	.vop_kqfilter =			tmpfs_kqfilter
1897 };
1898