xref: /dflybsd-src/sys/vfs/tmpfs/tmpfs_vnops.c (revision d0a6ae340f6911686e3740553cb20e177881f93c)
1 /*-
2  * Copyright (c) 2005, 2006 The NetBSD Foundation, Inc.
3  * All rights reserved.
4  *
5  * This code is derived from software contributed to The NetBSD Foundation
6  * by Julio M. Merino Vidal, developed as part of Google's Summer of Code
7  * 2005 program.
8  *
9  * Redistribution and use in source and binary forms, with or without
10  * modification, are permitted provided that the following conditions
11  * are met:
12  * 1. Redistributions of source code must retain the above copyright
13  *    notice, this list of conditions and the following disclaimer.
14  * 2. Redistributions in binary form must reproduce the above copyright
15  *    notice, this list of conditions and the following disclaimer in the
16  *    documentation and/or other materials provided with the distribution.
17  *
18  * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
19  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
20  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
21  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
22  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
23  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
24  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
25  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
26  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
27  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
28  * POSSIBILITY OF SUCH DAMAGE.
29  *
30  * $NetBSD: tmpfs_vnops.c,v 1.39 2007/07/23 15:41:01 jmmv Exp $
31  */
32 
33 /*
34  * tmpfs vnode interface.
35  */
36 
37 #include <sys/kernel.h>
38 #include <sys/kern_syscall.h>
39 #include <sys/param.h>
40 #include <sys/fcntl.h>
41 #include <sys/lockf.h>
42 #include <sys/priv.h>
43 #include <sys/proc.h>
44 #include <sys/resourcevar.h>
45 #include <sys/sched.h>
46 #include <sys/stat.h>
47 #include <sys/systm.h>
48 #include <sys/unistd.h>
49 #include <sys/vfsops.h>
50 #include <sys/vnode.h>
51 #include <sys/mountctl.h>
52 
53 #include <vm/vm.h>
54 #include <vm/vm_extern.h>
55 #include <vm/vm_object.h>
56 #include <vm/vm_page.h>
57 #include <vm/vm_pageout.h>
58 #include <vm/vm_pager.h>
59 #include <vm/swap_pager.h>
60 
61 #include <sys/buf2.h>
62 #include <vm/vm_page2.h>
63 
64 #include <vfs/fifofs/fifo.h>
65 #include <vfs/tmpfs/tmpfs_vnops.h>
66 #include "tmpfs.h"
67 
68 static void tmpfs_strategy_done(struct bio *bio);
69 
70 static __inline
71 void
72 tmpfs_knote(struct vnode *vp, int flags)
73 {
74 	if (flags)
75 		KNOTE(&vp->v_pollinfo.vpi_kqinfo.ki_note, flags);
76 }
77 
78 
79 /* --------------------------------------------------------------------- */
80 
81 static int
82 tmpfs_nresolve(struct vop_nresolve_args *ap)
83 {
84 	struct vnode *dvp = ap->a_dvp;
85 	struct vnode *vp = NULL;
86 	struct namecache *ncp = ap->a_nch->ncp;
87 	struct tmpfs_node *tnode;
88 	struct tmpfs_dirent *de;
89 	struct tmpfs_node *dnode;
90 	int error;
91 
92 	dnode = VP_TO_TMPFS_DIR(dvp);
93 
94 	TMPFS_NODE_LOCK_SH(dnode);
95 	de = tmpfs_dir_lookup(dnode, NULL, ncp);
96 	if (de == NULL) {
97 		error = ENOENT;
98 	} else {
99 		/*
100 		 * Allocate a vnode for the node we found.
101 		 */
102 		tnode = de->td_node;
103 		error = tmpfs_alloc_vp(dvp->v_mount, tnode,
104 				       LK_EXCLUSIVE | LK_RETRY, &vp);
105 		if (error)
106 			goto out;
107 		KKASSERT(vp);
108 	}
109 
110 out:
111 	TMPFS_NODE_UNLOCK(dnode);
112 
113 	if ((dnode->tn_status & TMPFS_NODE_ACCESSED) == 0) {
114 		TMPFS_NODE_LOCK(dnode);
115 		dnode->tn_status |= TMPFS_NODE_ACCESSED;
116 		TMPFS_NODE_UNLOCK(dnode);
117 	}
118 
119 	/*
120 	 * Store the result of this lookup in the cache.  Avoid this if the
121 	 * request was for creation, as it does not improve timings on
122 	 * emprical tests.
123 	 */
124 	if (vp) {
125 		vn_unlock(vp);
126 		cache_setvp(ap->a_nch, vp);
127 		vrele(vp);
128 	} else if (error == ENOENT) {
129 		cache_setvp(ap->a_nch, NULL);
130 	}
131 	return (error);
132 }
133 
134 static int
135 tmpfs_nlookupdotdot(struct vop_nlookupdotdot_args *ap)
136 {
137 	struct vnode *dvp = ap->a_dvp;
138 	struct vnode **vpp = ap->a_vpp;
139 	struct tmpfs_node *dnode = VP_TO_TMPFS_NODE(dvp);
140 	struct ucred *cred = ap->a_cred;
141 	int error;
142 
143 	*vpp = NULL;
144 
145 	/* Check accessibility of requested node as a first step. */
146 	error = VOP_ACCESS(dvp, VEXEC, cred);
147 	if (error != 0)
148 		return error;
149 
150 	if (dnode->tn_dir.tn_parent != NULL) {
151 		/* Allocate a new vnode on the matching entry. */
152 		error = tmpfs_alloc_vp(dvp->v_mount, dnode->tn_dir.tn_parent,
153 				       LK_EXCLUSIVE | LK_RETRY, vpp);
154 
155 		if (*vpp)
156 			vn_unlock(*vpp);
157 	}
158 	return (*vpp == NULL) ? ENOENT : 0;
159 }
160 
161 /* --------------------------------------------------------------------- */
162 
163 static int
164 tmpfs_ncreate(struct vop_ncreate_args *ap)
165 {
166 	struct vnode *dvp = ap->a_dvp;
167 	struct vnode **vpp = ap->a_vpp;
168 	struct namecache *ncp = ap->a_nch->ncp;
169 	struct vattr *vap = ap->a_vap;
170 	struct ucred *cred = ap->a_cred;
171 	int error;
172 
173 	KKASSERT(vap->va_type == VREG || vap->va_type == VSOCK);
174 
175 	error = tmpfs_alloc_file(dvp, vpp, vap, ncp, cred, NULL);
176 	if (error == 0) {
177 		cache_setunresolved(ap->a_nch);
178 		cache_setvp(ap->a_nch, *vpp);
179 		tmpfs_knote(dvp, NOTE_WRITE);
180 	}
181 	return (error);
182 }
183 /* --------------------------------------------------------------------- */
184 
185 static int
186 tmpfs_nmknod(struct vop_nmknod_args *ap)
187 {
188 	struct vnode *dvp = ap->a_dvp;
189 	struct vnode **vpp = ap->a_vpp;
190 	struct namecache *ncp = ap->a_nch->ncp;
191 	struct vattr *vap = ap->a_vap;
192 	struct ucred *cred = ap->a_cred;
193 	int error;
194 
195 	if (vap->va_type != VBLK && vap->va_type != VCHR &&
196 	    vap->va_type != VFIFO) {
197 		return (EINVAL);
198 	}
199 
200 	error = tmpfs_alloc_file(dvp, vpp, vap, ncp, cred, NULL);
201 	if (error == 0) {
202 		cache_setunresolved(ap->a_nch);
203 		cache_setvp(ap->a_nch, *vpp);
204 		tmpfs_knote(dvp, NOTE_WRITE);
205 	}
206 	return error;
207 }
208 
209 /* --------------------------------------------------------------------- */
210 
211 static int
212 tmpfs_open(struct vop_open_args *ap)
213 {
214 	struct vnode *vp = ap->a_vp;
215 	int mode = ap->a_mode;
216 	struct tmpfs_node *node;
217 	int error;
218 
219 	node = VP_TO_TMPFS_NODE(vp);
220 
221 #if 0
222 	/* The file is still active but all its names have been removed
223 	 * (e.g. by a "rmdir $(pwd)").  It cannot be opened any more as
224 	 * it is about to die. */
225 	if (node->tn_links < 1)
226 		return (ENOENT);
227 #endif
228 
229 	/* If the file is marked append-only, deny write requests. */
230 	if ((node->tn_flags & APPEND) &&
231 	    (mode & (FWRITE | O_APPEND)) == FWRITE) {
232 		error = EPERM;
233 	} else {
234 		error = (vop_stdopen(ap));
235 	}
236 
237 	return (error);
238 }
239 
240 /* --------------------------------------------------------------------- */
241 
242 static int
243 tmpfs_close(struct vop_close_args *ap)
244 {
245 	struct vnode *vp = ap->a_vp;
246 	struct tmpfs_node *node;
247 	int error;
248 
249 	node = VP_TO_TMPFS_NODE(vp);
250 
251 	if (node->tn_links > 0) {
252 		/*
253 		 * Update node times.  No need to do it if the node has
254 		 * been deleted, because it will vanish after we return.
255 		 */
256 		tmpfs_update(vp);
257 	}
258 
259 	error = vop_stdclose(ap);
260 
261 	return (error);
262 }
263 
264 /* --------------------------------------------------------------------- */
265 
266 int
267 tmpfs_access(struct vop_access_args *ap)
268 {
269 	struct vnode *vp = ap->a_vp;
270 	int error;
271 	struct tmpfs_node *node;
272 
273 	node = VP_TO_TMPFS_NODE(vp);
274 
275 	switch (vp->v_type) {
276 	case VDIR:
277 		/* FALLTHROUGH */
278 	case VLNK:
279 		/* FALLTHROUGH */
280 	case VREG:
281 		if ((ap->a_mode & VWRITE) &&
282 	            (vp->v_mount->mnt_flag & MNT_RDONLY)) {
283 			error = EROFS;
284 			goto out;
285 		}
286 		break;
287 
288 	case VBLK:
289 		/* FALLTHROUGH */
290 	case VCHR:
291 		/* FALLTHROUGH */
292 	case VSOCK:
293 		/* FALLTHROUGH */
294 	case VFIFO:
295 		break;
296 
297 	default:
298 		error = EINVAL;
299 		goto out;
300 	}
301 
302 	if ((ap->a_mode & VWRITE) && (node->tn_flags & IMMUTABLE)) {
303 		error = EPERM;
304 		goto out;
305 	}
306 
307 	error = vop_helper_access(ap, node->tn_uid, node->tn_gid,
308 			          node->tn_mode, 0);
309 out:
310 	return error;
311 }
312 
313 /* --------------------------------------------------------------------- */
314 
315 int
316 tmpfs_getattr(struct vop_getattr_args *ap)
317 {
318 	struct vnode *vp = ap->a_vp;
319 	struct vattr *vap = ap->a_vap;
320 	struct tmpfs_node *node;
321 
322 	node = VP_TO_TMPFS_NODE(vp);
323 
324 	tmpfs_update(vp);
325 
326 	TMPFS_NODE_LOCK_SH(node);
327 	vap->va_type = vp->v_type;
328 	vap->va_mode = node->tn_mode;
329 	vap->va_nlink = node->tn_links;
330 	vap->va_uid = node->tn_uid;
331 	vap->va_gid = node->tn_gid;
332 	vap->va_fsid = vp->v_mount->mnt_stat.f_fsid.val[0];
333 	vap->va_fileid = node->tn_id;
334 	vap->va_size = node->tn_size;
335 	vap->va_blocksize = PAGE_SIZE;
336 	vap->va_atime.tv_sec = node->tn_atime;
337 	vap->va_atime.tv_nsec = node->tn_atimensec;
338 	vap->va_mtime.tv_sec = node->tn_mtime;
339 	vap->va_mtime.tv_nsec = node->tn_mtimensec;
340 	vap->va_ctime.tv_sec = node->tn_ctime;
341 	vap->va_ctime.tv_nsec = node->tn_ctimensec;
342 	vap->va_gen = node->tn_gen;
343 	vap->va_flags = node->tn_flags;
344 	if (vp->v_type == VBLK || vp->v_type == VCHR) {
345 		vap->va_rmajor = umajor(node->tn_rdev);
346 		vap->va_rminor = uminor(node->tn_rdev);
347 	}
348 	vap->va_bytes = round_page(node->tn_size);
349 	vap->va_filerev = 0;
350 	TMPFS_NODE_UNLOCK(node);
351 
352 	return 0;
353 }
354 
355 /* --------------------------------------------------------------------- */
356 
357 int
358 tmpfs_setattr(struct vop_setattr_args *ap)
359 {
360 	struct vnode *vp = ap->a_vp;
361 	struct vattr *vap = ap->a_vap;
362 	struct ucred *cred = ap->a_cred;
363 	struct tmpfs_node *node = VP_TO_TMPFS_NODE(vp);
364 	int error = 0;
365 	int kflags = 0;
366 
367 	TMPFS_NODE_LOCK(node);
368 	if (error == 0 && (vap->va_flags != VNOVAL)) {
369 		error = tmpfs_chflags(vp, vap->va_flags, cred);
370 		kflags |= NOTE_ATTRIB;
371 	}
372 
373 	if (error == 0 && (vap->va_size != VNOVAL)) {
374 		if (vap->va_size > node->tn_size)
375 			kflags |= NOTE_WRITE | NOTE_EXTEND;
376 		else
377 			kflags |= NOTE_WRITE;
378 		error = tmpfs_chsize(vp, vap->va_size, cred);
379 	}
380 
381 	if (error == 0 && (vap->va_uid != (uid_t)VNOVAL ||
382 			   vap->va_gid != (gid_t)VNOVAL)) {
383 		error = tmpfs_chown(vp, vap->va_uid, vap->va_gid, cred);
384 		kflags |= NOTE_ATTRIB;
385 	}
386 
387 	if (error == 0 && (vap->va_mode != (mode_t)VNOVAL)) {
388 		error = tmpfs_chmod(vp, vap->va_mode, cred);
389 		kflags |= NOTE_ATTRIB;
390 	}
391 
392 	if (error == 0 && ((vap->va_atime.tv_sec != VNOVAL &&
393 	    vap->va_atime.tv_nsec != VNOVAL) ||
394 	    (vap->va_mtime.tv_sec != VNOVAL &&
395 	    vap->va_mtime.tv_nsec != VNOVAL) )) {
396 		error = tmpfs_chtimes(vp, &vap->va_atime, &vap->va_mtime,
397 				      vap->va_vaflags, cred);
398 		kflags |= NOTE_ATTRIB;
399 	}
400 
401 	/*
402 	 * Update the node times.  We give preference to the error codes
403 	 * generated by this function rather than the ones that may arise
404 	 * from tmpfs_update.
405 	 */
406 	tmpfs_update(vp);
407 	TMPFS_NODE_UNLOCK(node);
408 	tmpfs_knote(vp, kflags);
409 
410 	return (error);
411 }
412 
413 /* --------------------------------------------------------------------- */
414 
415 /*
416  * fsync is usually a NOP, but we must take action when unmounting or
417  * when recycling.
418  */
419 static int
420 tmpfs_fsync(struct vop_fsync_args *ap)
421 {
422 	struct tmpfs_node *node;
423 	struct vnode *vp = ap->a_vp;
424 
425 	node = VP_TO_TMPFS_NODE(vp);
426 
427 	tmpfs_update(vp);
428 	if (vp->v_type == VREG) {
429 		if (vp->v_flag & VRECLAIMED) {
430 			if (node->tn_links == 0)
431 				tmpfs_truncate(vp, 0);
432 			else
433 				vfsync(ap->a_vp, ap->a_waitfor, 1, NULL, NULL);
434 		}
435 	}
436 	return 0;
437 }
438 
439 /* --------------------------------------------------------------------- */
440 
441 static int
442 tmpfs_read(struct vop_read_args *ap)
443 {
444 	struct buf *bp;
445 	struct vnode *vp = ap->a_vp;
446 	struct uio *uio = ap->a_uio;
447 	struct tmpfs_node *node;
448 	off_t base_offset;
449 	size_t offset;
450 	size_t len;
451 	size_t resid;
452 	int error;
453 
454 	/*
455 	 * Check the basics
456 	 */
457 	if (uio->uio_offset < 0)
458 		return (EINVAL);
459 	if (vp->v_type != VREG)
460 		return (EINVAL);
461 
462 	/*
463 	 * Extract node, try to shortcut the operation through
464 	 * the VM page cache, allowing us to avoid buffer cache
465 	 * overheads.
466 	 */
467 	node = VP_TO_TMPFS_NODE(vp);
468         resid = uio->uio_resid;
469         error = vop_helper_read_shortcut(ap);
470         if (error)
471                 return error;
472         if (uio->uio_resid == 0) {
473 		if (resid)
474 			goto finished;
475 		return error;
476 	}
477 
478 	/*
479 	 * Fall-through to our normal read code.
480 	 */
481 	while (uio->uio_resid > 0 && uio->uio_offset < node->tn_size) {
482 		/*
483 		 * Use buffer cache I/O (via tmpfs_strategy)
484 		 */
485 		offset = (size_t)uio->uio_offset & TMPFS_BLKMASK64;
486 		base_offset = (off_t)uio->uio_offset - offset;
487 		bp = getcacheblk(vp, base_offset, TMPFS_BLKSIZE, GETBLK_KVABIO);
488 		if (bp == NULL) {
489 			error = bread_kvabio(vp, base_offset,
490 					     TMPFS_BLKSIZE, &bp);
491 			if (error) {
492 				brelse(bp);
493 				kprintf("tmpfs_read bread error %d\n", error);
494 				break;
495 			}
496 
497 			/*
498 			 * tmpfs pretty much fiddles directly with the VM
499 			 * system, don't let it exhaust it or we won't play
500 			 * nice with other processes.
501 			 *
502 			 * Only do this if the VOP is coming from a normal
503 			 * read/write.  The VM system handles the case for
504 			 * UIO_NOCOPY.
505 			 */
506 			if (uio->uio_segflg != UIO_NOCOPY)
507 				vm_wait_nominal();
508 		}
509 		bp->b_flags |= B_CLUSTEROK;
510 		bkvasync(bp);
511 
512 		/*
513 		 * Figure out how many bytes we can actually copy this loop.
514 		 */
515 		len = TMPFS_BLKSIZE - offset;
516 		if (len > uio->uio_resid)
517 			len = uio->uio_resid;
518 		if (len > node->tn_size - uio->uio_offset)
519 			len = (size_t)(node->tn_size - uio->uio_offset);
520 
521 		error = uiomovebp(bp, (char *)bp->b_data + offset, len, uio);
522 		bqrelse(bp);
523 		if (error) {
524 			kprintf("tmpfs_read uiomove error %d\n", error);
525 			break;
526 		}
527 	}
528 
529 finished:
530 	if ((node->tn_status & TMPFS_NODE_ACCESSED) == 0) {
531 		TMPFS_NODE_LOCK(node);
532 		node->tn_status |= TMPFS_NODE_ACCESSED;
533 		TMPFS_NODE_UNLOCK(node);
534 	}
535 	return (error);
536 }
537 
538 static int
539 tmpfs_write(struct vop_write_args *ap)
540 {
541 	struct buf *bp;
542 	struct vnode *vp = ap->a_vp;
543 	struct uio *uio = ap->a_uio;
544 	struct thread *td = uio->uio_td;
545 	struct tmpfs_node *node;
546 	boolean_t extended;
547 	off_t oldsize;
548 	int error;
549 	off_t base_offset;
550 	size_t offset;
551 	size_t len;
552 	struct rlimit limit;
553 	int trivial = 0;
554 	int kflags = 0;
555 	int seqcount;
556 
557 	error = 0;
558 	if (uio->uio_resid == 0) {
559 		return error;
560 	}
561 
562 	node = VP_TO_TMPFS_NODE(vp);
563 
564 	if (vp->v_type != VREG)
565 		return (EINVAL);
566 	seqcount = ap->a_ioflag >> 16;
567 
568 	TMPFS_NODE_LOCK(node);
569 
570 	oldsize = node->tn_size;
571 	if (ap->a_ioflag & IO_APPEND)
572 		uio->uio_offset = node->tn_size;
573 
574 	/*
575 	 * Check for illegal write offsets.
576 	 */
577 	if (uio->uio_offset + uio->uio_resid >
578 	  VFS_TO_TMPFS(vp->v_mount)->tm_maxfilesize) {
579 		error = EFBIG;
580 		goto done;
581 	}
582 
583 	/*
584 	 * NOTE: Ignore if UIO does not come from a user thread (e.g. VN).
585 	 */
586 	if (vp->v_type == VREG && td != NULL && td->td_lwp != NULL) {
587 		error = kern_getrlimit(RLIMIT_FSIZE, &limit);
588 		if (error)
589 			goto done;
590 		if (uio->uio_offset + uio->uio_resid > limit.rlim_cur) {
591 			ksignal(td->td_proc, SIGXFSZ);
592 			error = EFBIG;
593 			goto done;
594 		}
595 	}
596 
597 	/*
598 	 * Extend the file's size if necessary
599 	 */
600 	extended = ((uio->uio_offset + uio->uio_resid) > node->tn_size);
601 
602 	while (uio->uio_resid > 0) {
603 		/*
604 		 * Don't completely blow out running buffer I/O
605 		 * when being hit from the pageout daemon.
606 		 */
607 		if (uio->uio_segflg == UIO_NOCOPY &&
608 		    (ap->a_ioflag & IO_RECURSE) == 0) {
609 			bwillwrite(TMPFS_BLKSIZE);
610 		}
611 
612 		/*
613 		 * Use buffer cache I/O (via tmpfs_strategy)
614 		 */
615 		offset = (size_t)uio->uio_offset & TMPFS_BLKMASK64;
616 		base_offset = (off_t)uio->uio_offset - offset;
617 		len = TMPFS_BLKSIZE - offset;
618 		if (len > uio->uio_resid)
619 			len = uio->uio_resid;
620 
621 		if ((uio->uio_offset + len) > node->tn_size) {
622 			trivial = (uio->uio_offset <= node->tn_size);
623 			error = tmpfs_reg_resize(vp, uio->uio_offset + len,
624 						 trivial);
625 			if (error)
626 				break;
627 		}
628 
629 		/*
630 		 * Read to fill in any gaps.  Theoretically we could
631 		 * optimize this if the write covers the entire buffer
632 		 * and is not a UIO_NOCOPY write, however this can lead
633 		 * to a security violation exposing random kernel memory
634 		 * (whatever junk was in the backing VM pages before).
635 		 *
636 		 * So just use bread() to do the right thing.
637 		 */
638 		error = bread_kvabio(vp, base_offset, TMPFS_BLKSIZE, &bp);
639 		bkvasync(bp);
640 		error = uiomovebp(bp, (char *)bp->b_data + offset, len, uio);
641 		if (error) {
642 			kprintf("tmpfs_write uiomove error %d\n", error);
643 			brelse(bp);
644 			break;
645 		}
646 
647 		if (uio->uio_offset > node->tn_size) {
648 			node->tn_size = uio->uio_offset;
649 			kflags |= NOTE_EXTEND;
650 		}
651 		kflags |= NOTE_WRITE;
652 
653 		/*
654 		 * Always try to flush the page in the UIO_NOCOPY case.  This
655 		 * can come from the pageout daemon or during vnode eviction.
656 		 * It is not necessarily going to be marked IO_ASYNC/IO_SYNC.
657 		 *
658 		 * For the normal case we buwrite(), dirtying the underlying
659 		 * VM pages instead of dirtying the buffer and releasing the
660 		 * buffer as a clean buffer.  This allows tmpfs to use
661 		 * essentially all available memory to cache file data.
662 		 * If we used bdwrite() the buffer cache would wind up
663 		 * flushing the data to swap too quickly.
664 		 *
665 		 * But because tmpfs can seriously load the VM system we
666 		 * fall-back to using bdwrite() when free memory starts
667 		 * to get low.  This shifts the load away from the VM system
668 		 * and makes tmpfs act more like a normal filesystem with
669 		 * regards to disk activity.
670 		 *
671 		 * tmpfs pretty much fiddles directly with the VM
672 		 * system, don't let it exhaust it or we won't play
673 		 * nice with other processes.  Only do this if the
674 		 * VOP is coming from a normal read/write.  The VM system
675 		 * handles the case for UIO_NOCOPY.
676 		 */
677 		bp->b_flags |= B_CLUSTEROK;
678 		if (uio->uio_segflg == UIO_NOCOPY) {
679 			/*
680 			 * Flush from the pageout daemon, deal with
681 			 * potentially very heavy tmpfs write activity
682 			 * causing long stalls in the pageout daemon
683 			 * before pages get to free/cache.
684 			 *
685 			 * (a) Under severe pressure setting B_DIRECT will
686 			 *     cause a buffer release to try to free the
687 			 *     underlying pages.
688 			 *
689 			 * (b) Under modest memory pressure the B_RELBUF
690 			 *     alone is sufficient to get the pages moved
691 			 *     to the cache.  We could also force this by
692 			 *     setting B_NOTMETA but that might have other
693 			 *     unintended side-effects (e.g. setting
694 			 *     PG_NOTMETA on the VM page).
695 			 *
696 			 * Hopefully this will unblock the VM system more
697 			 * quickly under extreme tmpfs write load.
698 			 */
699 			if (vm_page_count_min(vm_page_free_hysteresis))
700 				bp->b_flags |= B_DIRECT;
701 			bp->b_flags |= B_AGE | B_RELBUF;
702 			bp->b_act_count = 0;	/* buffer->deactivate pgs */
703 			cluster_awrite(bp);
704 		} else if (vm_page_count_target()) {
705 			/*
706 			 * Normal (userland) write but we are low on memory,
707 			 * run the buffer the buffer cache.
708 			 */
709 			bp->b_act_count = 0;	/* buffer->deactivate pgs */
710 			bdwrite(bp);
711 		} else {
712 			/*
713 			 * Otherwise run the buffer directly through to the
714 			 * backing VM store.
715 			 */
716 			buwrite(bp);
717 			/*vm_wait_nominal();*/
718 		}
719 
720 		if (bp->b_error) {
721 			kprintf("tmpfs_write bwrite error %d\n", bp->b_error);
722 			break;
723 		}
724 	}
725 
726 	if (error) {
727 		if (extended) {
728 			(void)tmpfs_reg_resize(vp, oldsize, trivial);
729 			kflags &= ~NOTE_EXTEND;
730 		}
731 		goto done;
732 	}
733 
734 	/*
735 	 * Currently we don't set the mtime on files modified via mmap()
736 	 * because we can't tell the difference between those modifications
737 	 * and an attempt by the pageout daemon to flush tmpfs pages to
738 	 * swap.
739 	 *
740 	 * This is because in order to defer flushes as long as possible
741 	 * buwrite() works by marking the underlying VM pages dirty in
742 	 * order to be able to dispose of the buffer cache buffer without
743 	 * flushing it.
744 	 */
745 	if (vp->v_writecount) {
746 		node->tn_status |= TMPFS_NODE_ACCESSED | TMPFS_NODE_MODIFIED;
747 	} else {
748 		node->tn_mtime = vp->v_lastwrite_ts.tv_sec;
749 		node->tn_mtimensec = vp->v_lastwrite_ts.tv_nsec;
750 	}
751 
752 	if (extended)
753 		node->tn_status |= TMPFS_NODE_CHANGED;
754 
755 	if (node->tn_mode & (S_ISUID | S_ISGID)) {
756 		if (priv_check_cred(ap->a_cred, PRIV_VFS_RETAINSUGID, 0))
757 			node->tn_mode &= ~(S_ISUID | S_ISGID);
758 	}
759 done:
760 	TMPFS_NODE_UNLOCK(node);
761 	if (kflags)
762 		tmpfs_knote(vp, kflags);
763 
764 	return(error);
765 }
766 
767 static int
768 tmpfs_advlock(struct vop_advlock_args *ap)
769 {
770 	struct tmpfs_node *node;
771 	struct vnode *vp = ap->a_vp;
772 	int error;
773 
774 	node = VP_TO_TMPFS_NODE(vp);
775 	error = (lf_advlock(ap, &node->tn_advlock, node->tn_size));
776 
777 	return (error);
778 }
779 
780 /*
781  * The strategy function is typically only called when memory pressure
782  * forces the system to attempt to pageout pages.  It can also be called
783  * by [n]vtruncbuf() when a truncation cuts a page in half.  Normal write
784  * operations
785  *
786  * We set VKVABIO for VREG files so bp->b_data may not be synchronized to
787  * our cpu.  swap_pager_strategy() is all we really use, and it directly
788  * supports this.
789  */
790 static int
791 tmpfs_strategy(struct vop_strategy_args *ap)
792 {
793 	struct bio *bio = ap->a_bio;
794 	struct bio *nbio;
795 	struct buf *bp = bio->bio_buf;
796 	struct vnode *vp = ap->a_vp;
797 	struct tmpfs_node *node;
798 	vm_object_t uobj;
799 	vm_page_t m;
800 	int i;
801 
802 	if (vp->v_type != VREG) {
803 		bp->b_resid = bp->b_bcount;
804 		bp->b_flags |= B_ERROR | B_INVAL;
805 		bp->b_error = EINVAL;
806 		biodone(bio);
807 		return(0);
808 	}
809 
810 	node = VP_TO_TMPFS_NODE(vp);
811 
812 	uobj = node->tn_reg.tn_aobj;
813 
814 	/*
815 	 * Don't bother flushing to swap if there is no swap, just
816 	 * ensure that the pages are marked as needing a commit (still).
817 	 */
818 	if (bp->b_cmd == BUF_CMD_WRITE && vm_swap_size == 0) {
819 		for (i = 0; i < bp->b_xio.xio_npages; ++i) {
820 			m = bp->b_xio.xio_pages[i];
821 			vm_page_need_commit(m);
822 		}
823 		bp->b_resid = 0;
824 		bp->b_error = 0;
825 		biodone(bio);
826 	} else {
827 		nbio = push_bio(bio);
828 		nbio->bio_done = tmpfs_strategy_done;
829 		nbio->bio_offset = bio->bio_offset;
830 		swap_pager_strategy(uobj, nbio);
831 	}
832 	return 0;
833 }
834 
835 /*
836  * If we were unable to commit the pages to swap make sure they are marked
837  * as needing a commit (again).  If we were, clear the flag to allow the
838  * pages to be freed.
839  */
840 static void
841 tmpfs_strategy_done(struct bio *bio)
842 {
843 	struct buf *bp;
844 	vm_page_t m;
845 	int i;
846 
847 	bp = bio->bio_buf;
848 
849 	if (bp->b_flags & B_ERROR) {
850 		bp->b_flags &= ~B_ERROR;
851 		bp->b_error = 0;
852 		bp->b_resid = 0;
853 		for (i = 0; i < bp->b_xio.xio_npages; ++i) {
854 			m = bp->b_xio.xio_pages[i];
855 			vm_page_need_commit(m);
856 		}
857 	} else {
858 		for (i = 0; i < bp->b_xio.xio_npages; ++i) {
859 			m = bp->b_xio.xio_pages[i];
860 			vm_page_clear_commit(m);
861 		}
862 	}
863 	bio = pop_bio(bio);
864 	biodone(bio);
865 }
866 
867 static int
868 tmpfs_bmap(struct vop_bmap_args *ap)
869 {
870 	if (ap->a_doffsetp != NULL)
871 		*ap->a_doffsetp = ap->a_loffset;
872 	if (ap->a_runp != NULL)
873 		*ap->a_runp = 0;
874 	if (ap->a_runb != NULL)
875 		*ap->a_runb = 0;
876 
877 	return 0;
878 }
879 
880 /* --------------------------------------------------------------------- */
881 
882 static int
883 tmpfs_nremove(struct vop_nremove_args *ap)
884 {
885 	struct vnode *dvp = ap->a_dvp;
886 	struct namecache *ncp = ap->a_nch->ncp;
887 	struct vnode *vp;
888 	int error;
889 	struct tmpfs_dirent *de;
890 	struct tmpfs_mount *tmp;
891 	struct tmpfs_node *dnode;
892 	struct tmpfs_node *node;
893 
894 	/*
895 	 * We have to acquire the vp from ap->a_nch because we will likely
896 	 * unresolve the namecache entry, and a vrele/vput is needed to
897 	 * trigger the tmpfs_inactive/tmpfs_reclaim sequence.
898 	 *
899 	 * We have to use vget to clear any inactive state on the vnode,
900 	 * otherwise the vnode may remain inactive and thus tmpfs_inactive
901 	 * will not get called when we release it.
902 	 */
903 	error = cache_vget(ap->a_nch, ap->a_cred, LK_SHARED, &vp);
904 	KKASSERT(vp->v_mount == dvp->v_mount);
905 	KKASSERT(error == 0);
906 	vn_unlock(vp);
907 
908 	if (vp->v_type == VDIR) {
909 		error = EISDIR;
910 		goto out2;
911 	}
912 
913 	dnode = VP_TO_TMPFS_DIR(dvp);
914 	node = VP_TO_TMPFS_NODE(vp);
915 	tmp = VFS_TO_TMPFS(vp->v_mount);
916 
917 	TMPFS_NODE_LOCK(dnode);
918 	de = tmpfs_dir_lookup(dnode, node, ncp);
919 	if (de == NULL) {
920 		error = ENOENT;
921 		goto out;
922 	}
923 
924 	/* Files marked as immutable or append-only cannot be deleted. */
925 	if ((node->tn_flags & (IMMUTABLE | APPEND | NOUNLINK)) ||
926 	    (dnode->tn_flags & APPEND)) {
927 		error = EPERM;
928 		goto out;
929 	}
930 
931 	/* Remove the entry from the directory; as it is a file, we do not
932 	 * have to change the number of hard links of the directory. */
933 	tmpfs_dir_detach(dnode, de);
934 
935 	/* Free the directory entry we just deleted.  Note that the node
936 	 * referred by it will not be removed until the vnode is really
937 	 * reclaimed. */
938 	tmpfs_free_dirent(tmp, de);
939 
940 	if (node->tn_links > 0) {
941 	        TMPFS_NODE_LOCK(node);
942 		node->tn_status |= TMPFS_NODE_ACCESSED | TMPFS_NODE_CHANGED | \
943 	                TMPFS_NODE_MODIFIED;
944 	        TMPFS_NODE_UNLOCK(node);
945 	}
946 
947 	cache_unlink(ap->a_nch);
948 	tmpfs_knote(vp, NOTE_DELETE);
949 	error = 0;
950 
951 out:
952 	TMPFS_NODE_UNLOCK(dnode);
953 	if (error == 0)
954 		tmpfs_knote(dvp, NOTE_WRITE);
955 out2:
956 	vrele(vp);
957 
958 	return error;
959 }
960 
961 /* --------------------------------------------------------------------- */
962 
963 static int
964 tmpfs_nlink(struct vop_nlink_args *ap)
965 {
966 	struct vnode *dvp = ap->a_dvp;
967 	struct vnode *vp = ap->a_vp;
968 	struct namecache *ncp = ap->a_nch->ncp;
969 	struct tmpfs_dirent *de;
970 	struct tmpfs_node *node;
971 	struct tmpfs_node *dnode;
972 	int error;
973 
974 	KKASSERT(dvp != vp); /* XXX When can this be false? */
975 
976 	node = VP_TO_TMPFS_NODE(vp);
977 	dnode = VP_TO_TMPFS_NODE(dvp);
978 	TMPFS_NODE_LOCK(dnode);
979 
980 	/* XXX: Why aren't the following two tests done by the caller? */
981 
982 	/* Hard links of directories are forbidden. */
983 	if (vp->v_type == VDIR) {
984 		error = EPERM;
985 		goto out;
986 	}
987 
988 	/* Cannot create cross-device links. */
989 	if (dvp->v_mount != vp->v_mount) {
990 		error = EXDEV;
991 		goto out;
992 	}
993 
994 	/* Ensure that we do not overflow the maximum number of links imposed
995 	 * by the system. */
996 	KKASSERT(node->tn_links <= LINK_MAX);
997 	if (node->tn_links >= LINK_MAX) {
998 		error = EMLINK;
999 		goto out;
1000 	}
1001 
1002 	/* We cannot create links of files marked immutable or append-only. */
1003 	if (node->tn_flags & (IMMUTABLE | APPEND)) {
1004 		error = EPERM;
1005 		goto out;
1006 	}
1007 
1008 	/* Allocate a new directory entry to represent the node. */
1009 	error = tmpfs_alloc_dirent(VFS_TO_TMPFS(vp->v_mount), node,
1010 				   ncp->nc_name, ncp->nc_nlen, &de);
1011 	if (error != 0)
1012 		goto out;
1013 
1014 	/* Insert the new directory entry into the appropriate directory. */
1015 	tmpfs_dir_attach(dnode, de);
1016 
1017 	/* vp link count has changed, so update node times. */
1018 
1019 	TMPFS_NODE_LOCK(node);
1020 	node->tn_status |= TMPFS_NODE_CHANGED;
1021 	TMPFS_NODE_UNLOCK(node);
1022 	tmpfs_update(vp);
1023 
1024 	tmpfs_knote(vp, NOTE_LINK);
1025 	cache_setunresolved(ap->a_nch);
1026 	cache_setvp(ap->a_nch, vp);
1027 	error = 0;
1028 
1029 out:
1030 	TMPFS_NODE_UNLOCK(dnode);
1031 	if (error == 0)
1032 		tmpfs_knote(dvp, NOTE_WRITE);
1033 	return error;
1034 }
1035 
1036 /* --------------------------------------------------------------------- */
1037 
1038 static int
1039 tmpfs_nrename(struct vop_nrename_args *ap)
1040 {
1041 	struct vnode *fdvp = ap->a_fdvp;
1042 	struct namecache *fncp = ap->a_fnch->ncp;
1043 	struct vnode *fvp = fncp->nc_vp;
1044 	struct vnode *tdvp = ap->a_tdvp;
1045 	struct namecache *tncp = ap->a_tnch->ncp;
1046 	struct vnode *tvp;
1047 	struct tmpfs_dirent *de, *tde;
1048 	struct tmpfs_mount *tmp;
1049 	struct tmpfs_node *fdnode;
1050 	struct tmpfs_node *fnode;
1051 	struct tmpfs_node *tnode;
1052 	struct tmpfs_node *tdnode;
1053 	char *newname;
1054 	char *oldname;
1055 	int error;
1056 
1057 	KKASSERT(fdvp->v_mount == fvp->v_mount);
1058 
1059 	/*
1060 	 * Because tvp can get overwritten we have to vget it instead of
1061 	 * just vref or use it, otherwise it's VINACTIVE flag may not get
1062 	 * cleared and the node won't get destroyed.
1063 	 */
1064 	error = cache_vget(ap->a_tnch, ap->a_cred, LK_SHARED, &tvp);
1065 	if (error == 0) {
1066 		tnode = VP_TO_TMPFS_NODE(tvp);
1067 		vn_unlock(tvp);
1068 	} else {
1069 		tnode = NULL;
1070 	}
1071 
1072 	/* Disallow cross-device renames.
1073 	 * XXX Why isn't this done by the caller? */
1074 	if (fvp->v_mount != tdvp->v_mount ||
1075 	    (tvp != NULL && fvp->v_mount != tvp->v_mount)) {
1076 		error = EXDEV;
1077 		goto out;
1078 	}
1079 
1080 	tmp = VFS_TO_TMPFS(tdvp->v_mount);
1081 	tdnode = VP_TO_TMPFS_DIR(tdvp);
1082 
1083 	/* If source and target are the same file, there is nothing to do. */
1084 	if (fvp == tvp) {
1085 		error = 0;
1086 		goto out;
1087 	}
1088 
1089 	fdnode = VP_TO_TMPFS_DIR(fdvp);
1090 	fnode = VP_TO_TMPFS_NODE(fvp);
1091 	TMPFS_NODE_LOCK(fdnode);
1092 	de = tmpfs_dir_lookup(fdnode, fnode, fncp);
1093 	TMPFS_NODE_UNLOCK(fdnode);	/* XXX depend on namecache lock */
1094 
1095 	/* Avoid manipulating '.' and '..' entries. */
1096 	if (de == NULL) {
1097 		error = ENOENT;
1098 		goto out_locked;
1099 	}
1100 	KKASSERT(de->td_node == fnode);
1101 
1102 	/*
1103 	 * If replacing an entry in the target directory and that entry
1104 	 * is a directory, it must be empty.
1105 	 *
1106 	 * Kern_rename gurantees the destination to be a directory
1107 	 * if the source is one (it does?).
1108 	 */
1109 	if (tvp != NULL) {
1110 		KKASSERT(tnode != NULL);
1111 
1112 		if ((tnode->tn_flags & (NOUNLINK | IMMUTABLE | APPEND)) ||
1113 		    (tdnode->tn_flags & (APPEND | IMMUTABLE))) {
1114 			error = EPERM;
1115 			goto out_locked;
1116 		}
1117 
1118 		if (fnode->tn_type == VDIR && tnode->tn_type == VDIR) {
1119 			if (tnode->tn_size > 0) {
1120 				error = ENOTEMPTY;
1121 				goto out_locked;
1122 			}
1123 		} else if (fnode->tn_type == VDIR && tnode->tn_type != VDIR) {
1124 			error = ENOTDIR;
1125 			goto out_locked;
1126 		} else if (fnode->tn_type != VDIR && tnode->tn_type == VDIR) {
1127 			error = EISDIR;
1128 			goto out_locked;
1129 		} else {
1130 			KKASSERT(fnode->tn_type != VDIR &&
1131 				tnode->tn_type != VDIR);
1132 		}
1133 	}
1134 
1135 	if ((fnode->tn_flags & (NOUNLINK | IMMUTABLE | APPEND)) ||
1136 	    (fdnode->tn_flags & (APPEND | IMMUTABLE))) {
1137 		error = EPERM;
1138 		goto out_locked;
1139 	}
1140 
1141 	/*
1142 	 * Ensure that we have enough memory to hold the new name, if it
1143 	 * has to be changed.
1144 	 */
1145 	if (fncp->nc_nlen != tncp->nc_nlen ||
1146 	    bcmp(fncp->nc_name, tncp->nc_name, fncp->nc_nlen) != 0) {
1147 		newname = kmalloc(tncp->nc_nlen + 1, tmp->tm_name_zone,
1148 				  M_WAITOK | M_NULLOK);
1149 		if (newname == NULL) {
1150 			error = ENOSPC;
1151 			goto out_locked;
1152 		}
1153 		bcopy(tncp->nc_name, newname, tncp->nc_nlen);
1154 		newname[tncp->nc_nlen] = '\0';
1155 	} else {
1156 		newname = NULL;
1157 	}
1158 
1159 	/*
1160 	 * Unlink entry from source directory.  Note that the kernel has
1161 	 * already checked for illegal recursion cases (renaming a directory
1162 	 * into a subdirectory of itself).
1163 	 */
1164 	if (fdnode != tdnode) {
1165 		tmpfs_dir_detach(fdnode, de);
1166 	} else {
1167 		/* XXX depend on namecache lock */
1168 		TMPFS_NODE_LOCK(fdnode);
1169 		KKASSERT(de == tmpfs_dir_lookup(fdnode, fnode, fncp));
1170 		RB_REMOVE(tmpfs_dirtree, &fdnode->tn_dir.tn_dirtree, de);
1171 		RB_REMOVE(tmpfs_dirtree_cookie,
1172 			  &fdnode->tn_dir.tn_cookietree, de);
1173 		TMPFS_NODE_UNLOCK(fdnode);
1174 	}
1175 
1176 	/*
1177 	 * Handle any name change.  Swap with newname, we will
1178 	 * deallocate it at the end.
1179 	 */
1180 	if (newname != NULL) {
1181 #if 0
1182 		TMPFS_NODE_LOCK(fnode);
1183 		fnode->tn_status |= TMPFS_NODE_CHANGED;
1184 		TMPFS_NODE_UNLOCK(fnode);
1185 #endif
1186 		oldname = de->td_name;
1187 		de->td_name = newname;
1188 		de->td_namelen = (uint16_t)tncp->nc_nlen;
1189 		newname = oldname;
1190 	}
1191 
1192 	/*
1193 	 * If we are overwriting an entry, we have to remove the old one
1194 	 * from the target directory.
1195 	 */
1196 	if (tvp != NULL) {
1197 		/* Remove the old entry from the target directory. */
1198 		TMPFS_NODE_LOCK(tdnode);
1199 		tde = tmpfs_dir_lookup(tdnode, tnode, tncp);
1200 		tmpfs_dir_detach(tdnode, tde);
1201 		TMPFS_NODE_UNLOCK(tdnode);
1202 		tmpfs_knote(tdnode->tn_vnode, NOTE_DELETE);
1203 
1204 		/*
1205 		 * Free the directory entry we just deleted.  Note that the
1206 		 * node referred by it will not be removed until the vnode is
1207 		 * really reclaimed.
1208 		 */
1209 		tmpfs_free_dirent(VFS_TO_TMPFS(tvp->v_mount), tde);
1210 		/*cache_inval_vp(tvp, CINV_DESTROY);*/
1211 	}
1212 
1213 	/*
1214 	 * Link entry to target directory.  If the entry
1215 	 * represents a directory move the parent linkage
1216 	 * as well.
1217 	 */
1218 	if (fdnode != tdnode) {
1219 		if (de->td_node->tn_type == VDIR) {
1220 			TMPFS_VALIDATE_DIR(fnode);
1221 		}
1222 		tmpfs_dir_attach(tdnode, de);
1223 	} else {
1224 		TMPFS_NODE_LOCK(tdnode);
1225 		tdnode->tn_status |= TMPFS_NODE_MODIFIED;
1226 		RB_INSERT(tmpfs_dirtree, &tdnode->tn_dir.tn_dirtree, de);
1227 		RB_INSERT(tmpfs_dirtree_cookie,
1228 			  &tdnode->tn_dir.tn_cookietree, de);
1229 		TMPFS_NODE_UNLOCK(tdnode);
1230 	}
1231 
1232 	/*
1233 	 * Finish up
1234 	 */
1235 	if (newname) {
1236 		kfree(newname, tmp->tm_name_zone);
1237 		newname = NULL;
1238 	}
1239 	cache_rename(ap->a_fnch, ap->a_tnch);
1240 	tmpfs_knote(ap->a_fdvp, NOTE_WRITE);
1241 	tmpfs_knote(ap->a_tdvp, NOTE_WRITE);
1242 	if (fnode->tn_vnode)
1243 		tmpfs_knote(fnode->tn_vnode, NOTE_RENAME);
1244 	error = 0;
1245 
1246 out_locked:
1247 	;
1248 out:
1249 	if (tvp)
1250 		vrele(tvp);
1251 	return error;
1252 }
1253 
1254 /* --------------------------------------------------------------------- */
1255 
1256 static int
1257 tmpfs_nmkdir(struct vop_nmkdir_args *ap)
1258 {
1259 	struct vnode *dvp = ap->a_dvp;
1260 	struct vnode **vpp = ap->a_vpp;
1261 	struct namecache *ncp = ap->a_nch->ncp;
1262 	struct vattr *vap = ap->a_vap;
1263 	struct ucred *cred = ap->a_cred;
1264 	int error;
1265 
1266 	KKASSERT(vap->va_type == VDIR);
1267 
1268 	error = tmpfs_alloc_file(dvp, vpp, vap, ncp, cred, NULL);
1269 	if (error == 0) {
1270 		cache_setunresolved(ap->a_nch);
1271 		cache_setvp(ap->a_nch, *vpp);
1272 		tmpfs_knote(dvp, NOTE_WRITE | NOTE_LINK);
1273 	}
1274 	return error;
1275 }
1276 
1277 /* --------------------------------------------------------------------- */
1278 
1279 static int
1280 tmpfs_nrmdir(struct vop_nrmdir_args *ap)
1281 {
1282 	struct vnode *dvp = ap->a_dvp;
1283 	struct namecache *ncp = ap->a_nch->ncp;
1284 	struct vnode *vp;
1285 	struct tmpfs_dirent *de;
1286 	struct tmpfs_mount *tmp;
1287 	struct tmpfs_node *dnode;
1288 	struct tmpfs_node *node;
1289 	int error;
1290 
1291 	/*
1292 	 * We have to acquire the vp from ap->a_nch because we will likely
1293 	 * unresolve the namecache entry, and a vrele/vput is needed to
1294 	 * trigger the tmpfs_inactive/tmpfs_reclaim sequence.
1295 	 *
1296 	 * We have to use vget to clear any inactive state on the vnode,
1297 	 * otherwise the vnode may remain inactive and thus tmpfs_inactive
1298 	 * will not get called when we release it.
1299 	 */
1300 	error = cache_vget(ap->a_nch, ap->a_cred, LK_SHARED, &vp);
1301 	KKASSERT(error == 0);
1302 	vn_unlock(vp);
1303 
1304 	/*
1305 	 * Prevalidate so we don't hit an assertion later
1306 	 */
1307 	if (vp->v_type != VDIR) {
1308 		error = ENOTDIR;
1309 		goto out;
1310 	}
1311 
1312 	tmp = VFS_TO_TMPFS(dvp->v_mount);
1313 	dnode = VP_TO_TMPFS_DIR(dvp);
1314 	node = VP_TO_TMPFS_DIR(vp);
1315 
1316 	/*
1317 	 * Directories with more than two entries ('.' and '..') cannot
1318 	 * be removed.
1319 	 */
1320 	if (node->tn_size > 0) {
1321 		error = ENOTEMPTY;
1322 		goto out;
1323 	}
1324 
1325 	if ((dnode->tn_flags & APPEND)
1326 	    || (node->tn_flags & (NOUNLINK | IMMUTABLE | APPEND))) {
1327 		error = EPERM;
1328 		goto out;
1329 	}
1330 
1331 	/*
1332 	 * This invariant holds only if we are not trying to
1333 	 * remove "..".  We checked for that above so this is safe now.
1334 	 */
1335 	KKASSERT(node->tn_dir.tn_parent == dnode);
1336 
1337 	/*
1338 	 * Get the directory entry associated with node (vp).  This
1339 	 * was filled by tmpfs_lookup while looking up the entry.
1340 	 */
1341 	TMPFS_NODE_LOCK(dnode);
1342 	de = tmpfs_dir_lookup(dnode, node, ncp);
1343 	KKASSERT(TMPFS_DIRENT_MATCHES(de, ncp->nc_name, ncp->nc_nlen));
1344 
1345 	/* Check flags to see if we are allowed to remove the directory. */
1346 	if ((dnode->tn_flags & APPEND) ||
1347 	    node->tn_flags & (NOUNLINK | IMMUTABLE | APPEND)) {
1348 		error = EPERM;
1349 		TMPFS_NODE_UNLOCK(dnode);
1350 		goto out;
1351 	}
1352 
1353 	/* Detach the directory entry from the directory (dnode). */
1354 	tmpfs_dir_detach(dnode, de);
1355 	TMPFS_NODE_UNLOCK(dnode);
1356 
1357 	/* No vnode should be allocated for this entry from this point */
1358 	TMPFS_NODE_LOCK(dnode);
1359 	TMPFS_ASSERT_ELOCKED(dnode);
1360 	TMPFS_NODE_LOCK(node);
1361 	TMPFS_ASSERT_ELOCKED(node);
1362 
1363 	/*
1364 	 * Must set parent linkage to NULL (tested by ncreate to disallow
1365 	 * the creation of new files/dirs in a deleted directory)
1366 	 */
1367 	node->tn_status |= TMPFS_NODE_ACCESSED | TMPFS_NODE_CHANGED |
1368 			   TMPFS_NODE_MODIFIED;
1369 
1370 	dnode->tn_status |= TMPFS_NODE_ACCESSED | TMPFS_NODE_CHANGED |
1371 			    TMPFS_NODE_MODIFIED;
1372 
1373 	TMPFS_NODE_UNLOCK(node);
1374 	TMPFS_NODE_UNLOCK(dnode);
1375 
1376 	/* Free the directory entry we just deleted.  Note that the node
1377 	 * referred by it will not be removed until the vnode is really
1378 	 * reclaimed. */
1379 	tmpfs_free_dirent(tmp, de);
1380 
1381 	/* Release the deleted vnode (will destroy the node, notify
1382 	 * interested parties and clean it from the cache). */
1383 
1384 	TMPFS_NODE_LOCK(dnode);
1385 	dnode->tn_status |= TMPFS_NODE_CHANGED;
1386 	TMPFS_NODE_UNLOCK(dnode);
1387 	tmpfs_update(dvp);
1388 
1389 	cache_unlink(ap->a_nch);
1390 	tmpfs_knote(dvp, NOTE_WRITE | NOTE_LINK);
1391 	error = 0;
1392 
1393 out:
1394 	vrele(vp);
1395 
1396 	return error;
1397 }
1398 
1399 /* --------------------------------------------------------------------- */
1400 
1401 static int
1402 tmpfs_nsymlink(struct vop_nsymlink_args *ap)
1403 {
1404 	struct vnode *dvp = ap->a_dvp;
1405 	struct vnode **vpp = ap->a_vpp;
1406 	struct namecache *ncp = ap->a_nch->ncp;
1407 	struct vattr *vap = ap->a_vap;
1408 	struct ucred *cred = ap->a_cred;
1409 	char *target = ap->a_target;
1410 	int error;
1411 
1412 	vap->va_type = VLNK;
1413 	error = tmpfs_alloc_file(dvp, vpp, vap, ncp, cred, target);
1414 	if (error == 0) {
1415 		tmpfs_knote(*vpp, NOTE_WRITE);
1416 		cache_setunresolved(ap->a_nch);
1417 		cache_setvp(ap->a_nch, *vpp);
1418 	}
1419 	return error;
1420 }
1421 
1422 /* --------------------------------------------------------------------- */
1423 
1424 static int
1425 tmpfs_readdir(struct vop_readdir_args *ap)
1426 {
1427 	struct vnode *vp = ap->a_vp;
1428 	struct uio *uio = ap->a_uio;
1429 	int *eofflag = ap->a_eofflag;
1430 	off_t **cookies = ap->a_cookies;
1431 	int *ncookies = ap->a_ncookies;
1432 	struct tmpfs_mount *tmp;
1433 	int error;
1434 	off_t startoff;
1435 	off_t cnt = 0;
1436 	struct tmpfs_node *node;
1437 
1438 	/* This operation only makes sense on directory nodes. */
1439 	if (vp->v_type != VDIR) {
1440 		return ENOTDIR;
1441 	}
1442 
1443 	tmp = VFS_TO_TMPFS(vp->v_mount);
1444 	node = VP_TO_TMPFS_DIR(vp);
1445 	startoff = uio->uio_offset;
1446 
1447 	if (uio->uio_offset == TMPFS_DIRCOOKIE_DOT) {
1448 		error = tmpfs_dir_getdotdent(node, uio);
1449 		if (error != 0) {
1450 			TMPFS_NODE_LOCK_SH(node);
1451 			goto outok;
1452 		}
1453 		cnt++;
1454 	}
1455 
1456 	if (uio->uio_offset == TMPFS_DIRCOOKIE_DOTDOT) {
1457 		/* may lock parent, cannot hold node lock */
1458 		error = tmpfs_dir_getdotdotdent(tmp, node, uio);
1459 		if (error != 0) {
1460 			TMPFS_NODE_LOCK_SH(node);
1461 			goto outok;
1462 		}
1463 		cnt++;
1464 	}
1465 
1466 	TMPFS_NODE_LOCK_SH(node);
1467 	error = tmpfs_dir_getdents(node, uio, &cnt);
1468 
1469 outok:
1470 	KKASSERT(error >= -1);
1471 
1472 	if (error == -1)
1473 		error = 0;
1474 
1475 	if (eofflag != NULL)
1476 		*eofflag =
1477 		    (error == 0 && uio->uio_offset == TMPFS_DIRCOOKIE_EOF);
1478 
1479 	/* Update NFS-related variables. */
1480 	if (error == 0 && cookies != NULL && ncookies != NULL) {
1481 		off_t i;
1482 		off_t off = startoff;
1483 		struct tmpfs_dirent *de = NULL;
1484 
1485 		*ncookies = cnt;
1486 		*cookies = kmalloc(cnt * sizeof(off_t), M_TEMP, M_WAITOK);
1487 
1488 		for (i = 0; i < cnt; i++) {
1489 			KKASSERT(off != TMPFS_DIRCOOKIE_EOF);
1490 			if (off == TMPFS_DIRCOOKIE_DOT) {
1491 				off = TMPFS_DIRCOOKIE_DOTDOT;
1492 			} else {
1493 				if (off == TMPFS_DIRCOOKIE_DOTDOT) {
1494 					de = RB_MIN(tmpfs_dirtree_cookie,
1495 						&node->tn_dir.tn_cookietree);
1496 				} else if (de != NULL) {
1497 					de = RB_NEXT(tmpfs_dirtree_cookie,
1498 					       &node->tn_dir.tn_cookietree, de);
1499 				} else {
1500 					de = tmpfs_dir_lookupbycookie(node,
1501 								      off);
1502 					KKASSERT(de != NULL);
1503 					de = RB_NEXT(tmpfs_dirtree_cookie,
1504 					       &node->tn_dir.tn_cookietree, de);
1505 				}
1506 				if (de == NULL)
1507 					off = TMPFS_DIRCOOKIE_EOF;
1508 				else
1509 					off = tmpfs_dircookie(de);
1510 			}
1511 			(*cookies)[i] = off;
1512 		}
1513 		KKASSERT(uio->uio_offset == off);
1514 	}
1515 	TMPFS_NODE_UNLOCK(node);
1516 
1517 	if ((node->tn_status & TMPFS_NODE_ACCESSED) == 0) {
1518 		TMPFS_NODE_LOCK(node);
1519 		node->tn_status |= TMPFS_NODE_ACCESSED;
1520 		TMPFS_NODE_UNLOCK(node);
1521 	}
1522 	return error;
1523 }
1524 
1525 /* --------------------------------------------------------------------- */
1526 
1527 static int
1528 tmpfs_readlink(struct vop_readlink_args *ap)
1529 {
1530 	struct vnode *vp = ap->a_vp;
1531 	struct uio *uio = ap->a_uio;
1532 	int error;
1533 	struct tmpfs_node *node;
1534 
1535 	KKASSERT(uio->uio_offset == 0);
1536 	KKASSERT(vp->v_type == VLNK);
1537 
1538 	node = VP_TO_TMPFS_NODE(vp);
1539 	TMPFS_NODE_LOCK_SH(node);
1540 	error = uiomove(node->tn_link,
1541 			MIN(node->tn_size, uio->uio_resid), uio);
1542 	TMPFS_NODE_UNLOCK(node);
1543 	if ((node->tn_status & TMPFS_NODE_ACCESSED) == 0) {
1544 		TMPFS_NODE_LOCK(node);
1545 		node->tn_status |= TMPFS_NODE_ACCESSED;
1546 		TMPFS_NODE_UNLOCK(node);
1547 	}
1548 	return error;
1549 }
1550 
1551 /* --------------------------------------------------------------------- */
1552 
1553 static int
1554 tmpfs_inactive(struct vop_inactive_args *ap)
1555 {
1556 	struct vnode *vp = ap->a_vp;
1557 	struct tmpfs_node *node;
1558 	struct mount *mp;
1559 
1560 	mp = vp->v_mount;
1561 	lwkt_gettoken(&mp->mnt_token);
1562 	node = VP_TO_TMPFS_NODE(vp);
1563 
1564 	/*
1565 	 * Degenerate case
1566 	 */
1567 	if (node == NULL) {
1568 		vrecycle(vp);
1569 		lwkt_reltoken(&mp->mnt_token);
1570 		return(0);
1571 	}
1572 
1573 	/*
1574 	 * Get rid of unreferenced deleted vnodes sooner rather than
1575 	 * later so the data memory can be recovered immediately.
1576 	 *
1577 	 * We must truncate the vnode to prevent the normal reclamation
1578 	 * path from flushing the data for the removed file to disk.
1579 	 */
1580 	TMPFS_NODE_LOCK(node);
1581 	if ((node->tn_vpstate & TMPFS_VNODE_ALLOCATING) == 0 &&
1582 	    node->tn_links == 0)
1583 	{
1584 		node->tn_vpstate = TMPFS_VNODE_DOOMED;
1585 		TMPFS_NODE_UNLOCK(node);
1586 		if (node->tn_type == VREG)
1587 			tmpfs_truncate(vp, 0);
1588 		vrecycle(vp);
1589 	} else {
1590 		TMPFS_NODE_UNLOCK(node);
1591 	}
1592 	lwkt_reltoken(&mp->mnt_token);
1593 
1594 	return 0;
1595 }
1596 
1597 /* --------------------------------------------------------------------- */
1598 
1599 int
1600 tmpfs_reclaim(struct vop_reclaim_args *ap)
1601 {
1602 	struct vnode *vp = ap->a_vp;
1603 	struct tmpfs_mount *tmp;
1604 	struct tmpfs_node *node;
1605 	struct mount *mp;
1606 
1607 	mp = vp->v_mount;
1608 	lwkt_gettoken(&mp->mnt_token);
1609 
1610 	node = VP_TO_TMPFS_NODE(vp);
1611 	tmp = VFS_TO_TMPFS(vp->v_mount);
1612 	KKASSERT(mp == tmp->tm_mount);
1613 
1614 	tmpfs_free_vp(vp);
1615 
1616 	/*
1617 	 * If the node referenced by this vnode was deleted by the
1618 	 * user, we must free its associated data structures now that
1619 	 * the vnode is being reclaimed.
1620 	 *
1621 	 * Directories have an extra link ref.
1622 	 */
1623 	TMPFS_NODE_LOCK(node);
1624 	if ((node->tn_vpstate & TMPFS_VNODE_ALLOCATING) == 0 &&
1625 	    node->tn_links == 0) {
1626 		node->tn_vpstate = TMPFS_VNODE_DOOMED;
1627 		tmpfs_free_node(tmp, node);
1628 		/* eats the lock */
1629 	} else {
1630 		TMPFS_NODE_UNLOCK(node);
1631 	}
1632 	lwkt_reltoken(&mp->mnt_token);
1633 
1634 	KKASSERT(vp->v_data == NULL);
1635 	return 0;
1636 }
1637 
1638 /* --------------------------------------------------------------------- */
1639 
1640 static int
1641 tmpfs_mountctl(struct vop_mountctl_args *ap)
1642 {
1643 	struct tmpfs_mount *tmp;
1644 	struct mount *mp;
1645 	int rc;
1646 
1647 	mp = ap->a_head.a_ops->head.vv_mount;
1648 	lwkt_gettoken(&mp->mnt_token);
1649 
1650 	switch (ap->a_op) {
1651 	case (MOUNTCTL_SET_EXPORT):
1652 		tmp = (struct tmpfs_mount *) mp->mnt_data;
1653 
1654 		if (ap->a_ctllen != sizeof(struct export_args))
1655 			rc = (EINVAL);
1656 		else
1657 			rc = vfs_export(mp, &tmp->tm_export,
1658 					(const struct export_args *) ap->a_ctl);
1659 		break;
1660 	default:
1661 		rc = vop_stdmountctl(ap);
1662 		break;
1663 	}
1664 
1665 	lwkt_reltoken(&mp->mnt_token);
1666 	return (rc);
1667 }
1668 
1669 /* --------------------------------------------------------------------- */
1670 
1671 static int
1672 tmpfs_print(struct vop_print_args *ap)
1673 {
1674 	struct vnode *vp = ap->a_vp;
1675 
1676 	struct tmpfs_node *node;
1677 
1678 	node = VP_TO_TMPFS_NODE(vp);
1679 
1680 	kprintf("tag VT_TMPFS, tmpfs_node %p, flags 0x%x, links %d\n",
1681 	    node, node->tn_flags, node->tn_links);
1682 	kprintf("\tmode 0%o, owner %d, group %d, size %ju, status 0x%x\n",
1683 	    node->tn_mode, node->tn_uid, node->tn_gid,
1684 	    (uintmax_t)node->tn_size, node->tn_status);
1685 
1686 	if (vp->v_type == VFIFO)
1687 		fifo_printinfo(vp);
1688 
1689 	kprintf("\n");
1690 
1691 	return 0;
1692 }
1693 
1694 /* --------------------------------------------------------------------- */
1695 
1696 static int
1697 tmpfs_pathconf(struct vop_pathconf_args *ap)
1698 {
1699 	struct vnode *vp = ap->a_vp;
1700 	int name = ap->a_name;
1701 	register_t *retval = ap->a_retval;
1702 	struct tmpfs_mount *tmp;
1703 	int error;
1704 
1705 	error = 0;
1706 
1707 	switch (name) {
1708 	case _PC_CHOWN_RESTRICTED:
1709 		*retval = 1;
1710 		break;
1711 
1712 	case _PC_FILESIZEBITS:
1713 		tmp = VFS_TO_TMPFS(vp->v_mount);
1714 		*retval = max(32, flsll(tmp->tm_pages_max * PAGE_SIZE) + 1);
1715 		break;
1716 
1717 	case _PC_LINK_MAX:
1718 		*retval = LINK_MAX;
1719 		break;
1720 
1721 	case _PC_NAME_MAX:
1722 		*retval = NAME_MAX;
1723 		break;
1724 
1725 	case _PC_NO_TRUNC:
1726 		*retval = 1;
1727 		break;
1728 
1729 	case _PC_PATH_MAX:
1730 		*retval = PATH_MAX;
1731 		break;
1732 
1733 	case _PC_PIPE_BUF:
1734 		*retval = PIPE_BUF;
1735 		break;
1736 
1737 	case _PC_SYNC_IO:
1738 		*retval = 1;
1739 		break;
1740 
1741 	case _PC_2_SYMLINKS:
1742 		*retval = 1;
1743 		break;
1744 
1745 	default:
1746 		error = EINVAL;
1747 	}
1748 
1749 	return error;
1750 }
1751 
1752 /************************************************************************
1753  *                          KQFILTER OPS                                *
1754  ************************************************************************/
1755 
1756 static void filt_tmpfsdetach(struct knote *kn);
1757 static int filt_tmpfsread(struct knote *kn, long hint);
1758 static int filt_tmpfswrite(struct knote *kn, long hint);
1759 static int filt_tmpfsvnode(struct knote *kn, long hint);
1760 
1761 static struct filterops tmpfsread_filtops =
1762 	{ FILTEROP_ISFD | FILTEROP_MPSAFE,
1763 	  NULL, filt_tmpfsdetach, filt_tmpfsread };
1764 static struct filterops tmpfswrite_filtops =
1765 	{ FILTEROP_ISFD | FILTEROP_MPSAFE,
1766 	  NULL, filt_tmpfsdetach, filt_tmpfswrite };
1767 static struct filterops tmpfsvnode_filtops =
1768 	{ FILTEROP_ISFD | FILTEROP_MPSAFE,
1769 	  NULL, filt_tmpfsdetach, filt_tmpfsvnode };
1770 
1771 static int
1772 tmpfs_kqfilter (struct vop_kqfilter_args *ap)
1773 {
1774 	struct vnode *vp = ap->a_vp;
1775 	struct knote *kn = ap->a_kn;
1776 
1777 	switch (kn->kn_filter) {
1778 	case EVFILT_READ:
1779 		kn->kn_fop = &tmpfsread_filtops;
1780 		break;
1781 	case EVFILT_WRITE:
1782 		kn->kn_fop = &tmpfswrite_filtops;
1783 		break;
1784 	case EVFILT_VNODE:
1785 		kn->kn_fop = &tmpfsvnode_filtops;
1786 		break;
1787 	default:
1788 		return (EOPNOTSUPP);
1789 	}
1790 
1791 	kn->kn_hook = (caddr_t)vp;
1792 
1793 	knote_insert(&vp->v_pollinfo.vpi_kqinfo.ki_note, kn);
1794 
1795 	return(0);
1796 }
1797 
1798 static void
1799 filt_tmpfsdetach(struct knote *kn)
1800 {
1801 	struct vnode *vp = (void *)kn->kn_hook;
1802 
1803 	knote_remove(&vp->v_pollinfo.vpi_kqinfo.ki_note, kn);
1804 }
1805 
1806 static int
1807 filt_tmpfsread(struct knote *kn, long hint)
1808 {
1809 	struct vnode *vp = (void *)kn->kn_hook;
1810 	struct tmpfs_node *node = VP_TO_TMPFS_NODE(vp);
1811 	off_t off;
1812 
1813 	if (hint == NOTE_REVOKE) {
1814 		kn->kn_flags |= (EV_EOF | EV_NODATA | EV_ONESHOT);
1815 		return(1);
1816 	}
1817 
1818 	/*
1819 	 * Interlock against MP races when performing this function.
1820 	 */
1821 	TMPFS_NODE_LOCK_SH(node);
1822 	off = node->tn_size - kn->kn_fp->f_offset;
1823 	kn->kn_data = (off < INTPTR_MAX) ? off : INTPTR_MAX;
1824 	if (kn->kn_sfflags & NOTE_OLDAPI) {
1825 		TMPFS_NODE_UNLOCK(node);
1826 		return(1);
1827 	}
1828 	if (kn->kn_data == 0) {
1829 		kn->kn_data = (off < INTPTR_MAX) ? off : INTPTR_MAX;
1830 	}
1831 	TMPFS_NODE_UNLOCK(node);
1832 	return (kn->kn_data != 0);
1833 }
1834 
1835 static int
1836 filt_tmpfswrite(struct knote *kn, long hint)
1837 {
1838 	if (hint == NOTE_REVOKE)
1839 		kn->kn_flags |= (EV_EOF | EV_NODATA | EV_ONESHOT);
1840 	kn->kn_data = 0;
1841 	return (1);
1842 }
1843 
1844 static int
1845 filt_tmpfsvnode(struct knote *kn, long hint)
1846 {
1847 	if (kn->kn_sfflags & hint)
1848 		kn->kn_fflags |= hint;
1849 	if (hint == NOTE_REVOKE) {
1850 		kn->kn_flags |= (EV_EOF | EV_NODATA);
1851 		return (1);
1852 	}
1853 	return (kn->kn_fflags != 0);
1854 }
1855 
1856 
1857 /* --------------------------------------------------------------------- */
1858 
1859 /*
1860  * vnode operations vector used for files stored in a tmpfs file system.
1861  */
1862 struct vop_ops tmpfs_vnode_vops = {
1863 	.vop_default =			vop_defaultop,
1864 	.vop_getpages = 		vop_stdgetpages,
1865 	.vop_putpages = 		vop_stdputpages,
1866 	.vop_ncreate =			tmpfs_ncreate,
1867 	.vop_nresolve =			tmpfs_nresolve,
1868 	.vop_nlookupdotdot =		tmpfs_nlookupdotdot,
1869 	.vop_nmknod =			tmpfs_nmknod,
1870 	.vop_open =			tmpfs_open,
1871 	.vop_close =			tmpfs_close,
1872 	.vop_access =			tmpfs_access,
1873 	.vop_getattr =			tmpfs_getattr,
1874 	.vop_setattr =			tmpfs_setattr,
1875 	.vop_read =			tmpfs_read,
1876 	.vop_write =			tmpfs_write,
1877 	.vop_fsync =			tmpfs_fsync,
1878 	.vop_mountctl =			tmpfs_mountctl,
1879 	.vop_nremove =			tmpfs_nremove,
1880 	.vop_nlink =			tmpfs_nlink,
1881 	.vop_nrename =			tmpfs_nrename,
1882 	.vop_nmkdir =			tmpfs_nmkdir,
1883 	.vop_nrmdir =			tmpfs_nrmdir,
1884 	.vop_nsymlink =			tmpfs_nsymlink,
1885 	.vop_readdir =			tmpfs_readdir,
1886 	.vop_readlink =			tmpfs_readlink,
1887 	.vop_inactive =			tmpfs_inactive,
1888 	.vop_reclaim =			tmpfs_reclaim,
1889 	.vop_print =			tmpfs_print,
1890 	.vop_pathconf =			tmpfs_pathconf,
1891 	.vop_bmap =			tmpfs_bmap,
1892 	.vop_strategy =			tmpfs_strategy,
1893 	.vop_advlock =			tmpfs_advlock,
1894 	.vop_kqfilter =			tmpfs_kqfilter
1895 };
1896