xref: /openbsd-src/sys/tmpfs/tmpfs_vnops.c (revision 46035553bfdd96e63c94e32da0210227ec2e3cf1)
1 /*	$OpenBSD: tmpfs_vnops.c,v 1.45 2020/12/25 12:59:53 visa Exp $	*/
2 /*	$NetBSD: tmpfs_vnops.c,v 1.100 2012/11/05 17:27:39 dholland Exp $	*/
3 
4 /*
5  * Copyright (c) 2005, 2006, 2007, 2012 The NetBSD Foundation, Inc.
6  * Copyright (c) 2013 Pedro Martelletto
7  * All rights reserved.
8  *
9  * This code is derived from software contributed to The NetBSD Foundation
10  * by Julio M. Merino Vidal, developed as part of Google's Summer of Code
11  * 2005 program, and by Taylor R Campbell.
12  *
13  * Redistribution and use in source and binary forms, with or without
14  * modification, are permitted provided that the following conditions
15  * are met:
16  * 1. Redistributions of source code must retain the above copyright
17  *    notice, this list of conditions and the following disclaimer.
18  * 2. Redistributions in binary form must reproduce the above copyright
19  *    notice, this list of conditions and the following disclaimer in the
20  *    documentation and/or other materials provided with the distribution.
21  *
22  * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
23  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
24  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
25  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
26  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
27  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
28  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
29  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
30  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
31  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
32  * POSSIBILITY OF SUCH DAMAGE.
33  */
34 
35 /*
36  * tmpfs vnode interface.
37  */
38 
39 #include <sys/param.h>
40 #include <sys/systm.h>
41 #include <sys/fcntl.h>
42 #include <sys/event.h>
43 #include <sys/namei.h>
44 #include <sys/stat.h>
45 #include <sys/uio.h>
46 #include <sys/unistd.h>
47 #include <sys/vnode.h>
48 #include <sys/lockf.h>
49 #include <sys/poll.h>
50 #include <sys/file.h>
51 
52 #include <miscfs/fifofs/fifo.h>
53 #include <tmpfs/tmpfs_vnops.h>
54 #include <tmpfs/tmpfs.h>
55 
56 int tmpfs_kqfilter(void *v);
57 
58 /*
59  * vnode operations vector used for files stored in a tmpfs file system.
60  */
61 const struct vops tmpfs_vops = {
62 	.vop_lookup	= tmpfs_lookup,
63 	.vop_create	= tmpfs_create,
64 	.vop_mknod	= tmpfs_mknod,
65 	.vop_open	= tmpfs_open,
66 	.vop_close	= tmpfs_close,
67 	.vop_access	= tmpfs_access,
68 	.vop_getattr	= tmpfs_getattr,
69 	.vop_setattr	= tmpfs_setattr,
70 	.vop_read	= tmpfs_read,
71 	.vop_write	= tmpfs_write,
72 	.vop_ioctl	= tmpfs_ioctl,
73 	.vop_poll	= tmpfs_poll,
74 	.vop_kqfilter	= tmpfs_kqfilter,
75 	.vop_revoke	= vop_generic_revoke,
76 	.vop_fsync	= tmpfs_fsync,
77 	.vop_remove	= tmpfs_remove,
78 	.vop_link	= tmpfs_link,
79 	.vop_rename	= tmpfs_rename,
80 	.vop_mkdir	= tmpfs_mkdir,
81 	.vop_rmdir	= tmpfs_rmdir,
82 	.vop_symlink	= tmpfs_symlink,
83 	.vop_readdir	= tmpfs_readdir,
84 	.vop_readlink	= tmpfs_readlink,
85 	.vop_abortop	= vop_generic_abortop,
86 	.vop_inactive	= tmpfs_inactive,
87 	.vop_reclaim	= tmpfs_reclaim,
88 	.vop_lock	= tmpfs_lock,
89 	.vop_unlock	= tmpfs_unlock,
90 	.vop_bmap	= vop_generic_bmap,
91 	.vop_strategy	= tmpfs_strategy,
92 	.vop_print	= tmpfs_print,
93 	.vop_islocked	= tmpfs_islocked,
94 	.vop_pathconf	= tmpfs_pathconf,
95 	.vop_advlock	= tmpfs_advlock,
96 	.vop_bwrite	= tmpfs_bwrite,
97 };
98 
99 /*
100  * tmpfs_lookup: path name traversal routine.
101  *
102  * Arguments: dvp (directory being searched), vpp (result),
103  * cnp (component name - path).
104  *
105  * => Caller holds a reference and lock on dvp.
106  * => We return looked-up vnode (vpp) locked, with a reference held.
107  */
108 int
109 tmpfs_lookup(void *v)
110 {
111 	struct vop_lookup_args /* {
112 		struct vnode *a_dvp;
113 		struct vnode **a_vpp;
114 		struct componentname *a_cnp;
115 	} */ *ap = v;
116 	struct vnode *dvp = ap->a_dvp, **vpp = ap->a_vpp;
117 	struct componentname *cnp = ap->a_cnp;
118 	struct ucred *cred = cnp->cn_cred;
119 	const int lastcn = (cnp->cn_flags & ISLASTCN) != 0;
120 	const int lockparent = (cnp->cn_flags & LOCKPARENT) != 0;
121 	tmpfs_node_t *dnode, *tnode;
122 	tmpfs_dirent_t *de;
123 	int cachefound;
124 	int error;
125 
126 	KASSERT(VOP_ISLOCKED(dvp));
127 
128 	dnode = VP_TO_TMPFS_DIR(dvp);
129 	cnp->cn_flags &= ~PDIRUNLOCK;
130 	*vpp = NULL;
131 
132 	/* Check accessibility of directory. */
133 	error = VOP_ACCESS(dvp, VEXEC, cred, curproc);
134 	if (error) {
135 		goto out;
136 	}
137 
138 	/*
139 	 * If requesting the last path component on a read-only file system
140 	 * with a write operation, deny it.
141 	 */
142 	if (lastcn && (dvp->v_mount->mnt_flag & MNT_RDONLY) != 0 &&
143 	    (cnp->cn_nameiop == DELETE || cnp->cn_nameiop == RENAME)) {
144 		error = EROFS;
145 		goto out;
146 	}
147 
148 	/*
149 	 * Avoid doing a linear scan of the directory if the requested
150 	 * directory/name couple is already in the cache.
151 	 */
152 	cachefound = cache_lookup(dvp, vpp, cnp);
153 	if (cachefound == ENOENT /* && *vpp == NULLVP */)
154 		return ENOENT; /* Negative cache hit. */
155 	else if (cachefound != -1)
156 		return 0; /* Found in cache. */
157 
158 	if (cnp->cn_flags & ISDOTDOT) {
159 		tmpfs_node_t *pnode;
160 
161 		/*
162 		 * Lookup of ".." case.
163 		 */
164 		if (lastcn) {
165 			if (cnp->cn_nameiop == RENAME) {
166 				error = EINVAL;
167 				goto out;
168 			}
169 			if (cnp->cn_nameiop == DELETE) {
170 				/* Keep the name for tmpfs_rmdir(). */
171 				cnp->cn_flags |= SAVENAME;
172 			}
173 		}
174 		KASSERT(dnode->tn_type == VDIR);
175 		pnode = dnode->tn_spec.tn_dir.tn_parent;
176 		if (pnode == NULL) {
177 			error = ENOENT;
178 			goto out;
179 		}
180 
181 		/*
182 		 * Lock the parent tn_nlock before releasing the vnode lock,
183 		 * and thus prevents parent from disappearing.
184 		 */
185 		rw_enter_write(&pnode->tn_nlock);
186 		VOP_UNLOCK(dvp);
187 
188 		/*
189 		 * Get a vnode of the '..' entry and re-acquire the lock.
190 		 * Release the tn_nlock.
191 		 */
192 		error = tmpfs_vnode_get(dvp->v_mount, pnode, vpp);
193 		vn_lock(dvp, LK_EXCLUSIVE | LK_RETRY);
194 		goto out;
195 
196 	} else if (cnp->cn_namelen == 1 && cnp->cn_nameptr[0] == '.') {
197 		/*
198 		 * Lookup of "." case.
199 		 */
200 		if (lastcn && cnp->cn_nameiop == RENAME) {
201 			error = EISDIR;
202 			goto out;
203 		}
204 		vref(dvp);
205 		*vpp = dvp;
206 		error = 0;
207 		goto done;
208 	}
209 
210 	/*
211 	 * Other lookup cases: perform directory scan.
212 	 */
213 	de = tmpfs_dir_lookup(dnode, cnp);
214 	if (de == NULL) {
215 		/*
216 		 * The entry was not found in the directory.  This is valid
217 		 * if we are creating or renaming an entry and are working
218 		 * on the last component of the path name.
219 		 */
220 		if (lastcn && (cnp->cn_nameiop == CREATE ||
221 		    cnp->cn_nameiop == RENAME)) {
222 			error = VOP_ACCESS(dvp, VWRITE, cred, curproc);
223 			if (error) {
224 				goto out;
225 			}
226 			/*
227 			 * We are creating an entry in the file system, so
228 			 * save its name for further use by tmpfs_create().
229 			 */
230 			cnp->cn_flags |= SAVENAME;
231 			error = EJUSTRETURN;
232 		} else {
233 			error = ENOENT;
234 		}
235 		goto done;
236 	}
237 
238 	tnode = de->td_node;
239 
240 	/*
241 	 * If it is not the last path component and found a non-directory
242 	 * or non-link entry (which may itself be pointing to a directory),
243 	 * raise an error.
244 	 */
245 	if (!lastcn && tnode->tn_type != VDIR && tnode->tn_type != VLNK) {
246 		error = ENOTDIR;
247 		goto out;
248 	}
249 
250 	/* Check the permissions. */
251 	if (lastcn && (cnp->cn_nameiop == DELETE || cnp->cn_nameiop == RENAME)) {
252 		error = VOP_ACCESS(dvp, VWRITE, cred, curproc);
253 		if (error)
254 			goto out;
255 
256 		/*
257 		 * If not root and directory is sticky, check for permission
258 		 * on directory or on file. This implements append-only
259 		 * directories.
260 		 */
261 		if ((dnode->tn_mode & S_ISTXT) != 0) {
262 			if (cred->cr_uid != 0 &&
263 			    cred->cr_uid != dnode->tn_uid &&
264 			    cred->cr_uid != tnode->tn_uid) {
265 				error = EPERM;
266 				goto out;
267 			}
268 		}
269 
270 		/*
271 		 * XXX pedro: We might need cn_nameptr later in tmpfs_remove()
272 		 * or tmpfs_rmdir() for a tmpfs_dir_lookup(). We should really
273 		 * get rid of SAVENAME at some point.
274 		 */
275 		if (cnp->cn_nameiop == DELETE)
276 			cnp->cn_flags |= SAVENAME;
277 	}
278 
279 	/* Get a vnode for the matching entry. */
280 	rw_enter_write(&tnode->tn_nlock);
281 	error = tmpfs_vnode_get(dvp->v_mount, tnode, vpp);
282 done:
283 	/*
284 	 * Cache the result, unless request was for creation (as it does
285 	 * not improve the performance).
286 	 */
287 	if ((cnp->cn_flags & MAKEENTRY) && cnp->cn_nameiop != CREATE) {
288 		cache_enter(dvp, *vpp, cnp);
289 	}
290 out:
291 	/*
292 	 * If (1) we succeded, (2) found a distinct vnode to return and (3) were
293 	 * either explicitly told to keep the parent locked or are in the
294 	 * middle of a lookup, unlock the parent vnode.
295 	 */
296 	if ((error == 0 || error == EJUSTRETURN) && /* (1) */
297 	    *vpp != dvp &&			    /* (2) */
298 	    (!lockparent || !lastcn)) {		    /* (3) */
299 		VOP_UNLOCK(dvp);
300 		cnp->cn_flags |= PDIRUNLOCK;
301 	} else
302 		KASSERT(VOP_ISLOCKED(dvp));
303 
304 	KASSERT((*vpp && VOP_ISLOCKED(*vpp)) || error);
305 
306 	return error;
307 }
308 
309 int
310 tmpfs_create(void *v)
311 {
312 	struct vop_create_args /* {
313 		struct vnode		*a_dvp;
314 		struct vnode		**a_vpp;
315 		struct componentname	*a_cnp;
316 		struct vattr		*a_vap;
317 	} */ *ap = v;
318 	struct vnode *dvp = ap->a_dvp, **vpp = ap->a_vpp;
319 	struct componentname *cnp = ap->a_cnp;
320 	struct vattr *vap = ap->a_vap;
321 
322 	KASSERT(VOP_ISLOCKED(dvp));
323 	KASSERT(cnp->cn_flags & HASBUF);
324 	KASSERT(vap->va_type == VREG || vap->va_type == VSOCK);
325 	return tmpfs_alloc_file(dvp, vpp, vap, cnp, NULL);
326 }
327 
328 int
329 tmpfs_mknod(void *v)
330 {
331 	struct vop_mknod_args /* {
332 		struct vnode		*a_dvp;
333 		struct vnode		**a_vpp;
334 		struct componentname	*a_cnp;
335 		struct vattr		*a_vap;
336 	} */ *ap = v;
337 	struct vnode *dvp = ap->a_dvp, **vpp = ap->a_vpp;
338 	struct componentname *cnp = ap->a_cnp;
339 	struct vattr *vap = ap->a_vap;
340 	enum vtype vt = vap->va_type;
341 	int error;
342 
343 	if (vt != VBLK && vt != VCHR && vt != VFIFO)
344 		return EINVAL;
345 
346 	error = tmpfs_alloc_file(dvp, vpp, vap, cnp, NULL);
347 
348 	if (error == 0)
349 		vput(*vpp);
350 
351 	return error;
352 }
353 
354 int
355 tmpfs_open(void *v)
356 {
357 	struct vop_open_args /* {
358 		struct vnode	*a_vp;
359 		int		a_mode;
360 		kauth_cred_t	a_cred;
361 	} */ *ap = v;
362 	struct vnode *vp = ap->a_vp;
363 	mode_t mode = ap->a_mode;
364 	tmpfs_node_t *node;
365 
366 	KASSERT(VOP_ISLOCKED(vp));
367 
368 	node = VP_TO_TMPFS_NODE(vp);
369 	if (node->tn_links < 1) {
370 		/*
371 		 * The file is still active, but all its names have been
372 		 * removed (e.g. by a "rmdir $(pwd)").  It cannot be opened
373 		 * any more, as it is about to be destroyed.
374 		 */
375 		return ENOENT;
376 	}
377 
378 	/* If the file is marked append-only, deny write requests. */
379 	if ((node->tn_flags & APPEND) != 0 &&
380 	    (mode & (FWRITE | O_APPEND)) == FWRITE) {
381 		return EPERM;
382 	}
383 	return 0;
384 }
385 
386 int
387 tmpfs_close(void *v)
388 {
389 #ifdef DIAGNOSTIC
390 	struct vop_close_args /* {
391 		struct vnode	*a_vp;
392 		int		a_fflag;
393 		kauth_cred_t	a_cred;
394 	} */ *ap = v;
395 	struct vnode *vp = ap->a_vp;
396 
397 	KASSERT(VOP_ISLOCKED(vp));
398 #endif
399 	return 0;
400 }
401 
402 int
403 tmpfs_access(void *v)
404 {
405 	struct vop_access_args /* {
406 		struct vnode	*a_vp;
407 		int		a_mode;
408 		kauth_cred_t	a_cred;
409 	} */ *ap = v;
410 	struct vnode *vp = ap->a_vp;
411 	mode_t mode = ap->a_mode;
412 	tmpfs_node_t *node = VP_TO_TMPFS_NODE(vp);
413 	const int writing = (mode & VWRITE) != 0;
414 
415 	KASSERT(VOP_ISLOCKED(vp));
416 
417 	/* Possible? */
418 	switch (vp->v_type) {
419 	case VDIR:
420 	case VLNK:
421 	case VREG:
422 		if (writing && (vp->v_mount->mnt_flag & MNT_RDONLY) != 0) {
423 			return EROFS;
424 		}
425 		break;
426 	case VBLK:
427 	case VCHR:
428 	case VSOCK:
429 	case VFIFO:
430 		break;
431 	default:
432 		return EINVAL;
433 	}
434 	if (writing && (node->tn_flags & IMMUTABLE) != 0) {
435 		return EPERM;
436 	}
437 
438 	return (vaccess(vp->v_type, node->tn_mode, node->tn_uid, node->tn_gid,
439 	    mode, ap->a_cred));
440 }
441 
442 int
443 tmpfs_getattr(void *v)
444 {
445 	struct vop_getattr_args /* {
446 		struct vnode	*a_vp;
447 		struct vattr	*a_vap;
448 		kauth_cred_t	a_cred;
449 	} */ *ap = v;
450 	struct vnode *vp = ap->a_vp;
451 	struct vattr *vap = ap->a_vap;
452 	tmpfs_node_t *node = VP_TO_TMPFS_NODE(vp);
453 
454 	vattr_null(vap);
455 
456 	vap->va_type = vp->v_type;
457 	vap->va_mode = node->tn_mode;
458 	vap->va_nlink = node->tn_links;
459 	vap->va_uid = node->tn_uid;
460 	vap->va_gid = node->tn_gid;
461 	vap->va_fsid = vp->v_mount->mnt_stat.f_fsid.val[0];
462 	vap->va_fileid = node->tn_id;
463 	vap->va_size = node->tn_size;
464 	vap->va_blocksize = PAGE_SIZE;
465 	vap->va_atime = node->tn_atime;
466 	vap->va_mtime = node->tn_mtime;
467 	vap->va_ctime = node->tn_ctime;
468 	/* vap->va_birthtime = node->tn_birthtime; */
469 	vap->va_gen = TMPFS_NODE_GEN(node);
470 	vap->va_flags = node->tn_flags;
471 	vap->va_rdev = (vp->v_type == VBLK || vp->v_type == VCHR) ?
472 	    node->tn_spec.tn_dev.tn_rdev : VNOVAL;
473 	vap->va_bytes = round_page(node->tn_size);
474 	vap->va_filerev = VNOVAL;
475 	vap->va_vaflags = 0;
476 	vap->va_spare = VNOVAL; /* XXX */
477 
478 	return 0;
479 }
480 
481 #define GOODTIME(tv)	((tv)->tv_nsec != VNOVAL)
482 /* XXX Should this operation be atomic?  I think it should, but code in
483  * XXX other places (e.g., ufs) doesn't seem to be... */
484 int
485 tmpfs_setattr(void *v)
486 {
487 	struct vop_setattr_args /* {
488 		struct vnode	*a_vp;
489 		struct vattr	*a_vap;
490 		kauth_cred_t	a_cred;
491 	} */ *ap = v;
492 	struct vnode *vp = ap->a_vp;
493 	struct vattr *vap = ap->a_vap;
494 	struct ucred *cred = ap->a_cred;
495 	struct proc *p = curproc;
496 	int error = 0;
497 
498 	KASSERT(VOP_ISLOCKED(vp));
499 
500 	/* Abort if any unsettable attribute is given. */
501 	if (vap->va_type != VNON || vap->va_nlink != VNOVAL ||
502 	    vap->va_fsid != VNOVAL || vap->va_fileid != VNOVAL ||
503 	    vap->va_blocksize != VNOVAL || GOODTIME(&vap->va_ctime) ||
504 	    vap->va_gen != VNOVAL || vap->va_rdev != VNOVAL ||
505 	    vap->va_bytes != VNOVAL) {
506 		return EINVAL;
507 	}
508 	if (error == 0 && (vap->va_flags != VNOVAL))
509 		error = tmpfs_chflags(vp, vap->va_flags, cred, p);
510 
511 	if (error == 0 && (vap->va_size != VNOVAL))
512 		error = tmpfs_chsize(vp, vap->va_size, cred, p);
513 
514 	if (error == 0 && (vap->va_uid != VNOVAL || vap->va_gid != VNOVAL))
515 		error = tmpfs_chown(vp, vap->va_uid, vap->va_gid, cred, p);
516 
517 	if (error == 0 && (vap->va_mode != VNOVAL))
518 		error = tmpfs_chmod(vp, vap->va_mode, cred, p);
519 
520 	if (error == 0 && ((vap->va_vaflags & VA_UTIMES_CHANGE)
521 	    || GOODTIME(&vap->va_atime)
522 	    || GOODTIME(&vap->va_mtime)))
523 		error = tmpfs_chtimes(vp, &vap->va_atime, &vap->va_mtime,
524 		    vap->va_vaflags, cred, p);
525 
526 	return error;
527 }
528 
529 int
530 tmpfs_read(void *v)
531 {
532 	struct vop_read_args /* {
533 		struct vnode *a_vp;
534 		struct uio *a_uio;
535 		int a_ioflag;
536 		struct ucred *a_cred;
537 	} */ *ap = v;
538 	struct vnode *vp = ap->a_vp;
539 	struct uio *uio = ap->a_uio;
540 	/* const int ioflag = ap->a_ioflag; */
541 	tmpfs_node_t *node;
542 	int error;
543 
544 	KASSERT(VOP_ISLOCKED(vp));
545 
546 	if (vp->v_type != VREG) {
547 		return EISDIR;
548 	}
549 	if (uio->uio_offset < 0) {
550 		return EINVAL;
551 	}
552 	if (uio->uio_resid == 0)
553 		return 0;
554 
555 	node = VP_TO_TMPFS_NODE(vp);
556 	error = 0;
557 
558 	while (error == 0 && uio->uio_resid > 0) {
559 		vsize_t len;
560 
561 		if (node->tn_size <= uio->uio_offset) {
562 			break;
563 		}
564 		len = MIN(node->tn_size - uio->uio_offset, uio->uio_resid);
565 		if (len == 0) {
566 			break;
567 		}
568 		error = tmpfs_uiomove(node, uio, len);
569 	}
570 
571 	if (!(vp->v_mount->mnt_flag & MNT_NOATIME))
572 		tmpfs_update(node, TMPFS_NODE_ACCESSED);
573 
574 	return error;
575 }
576 
577 int
578 tmpfs_write(void *v)
579 {
580 	struct vop_write_args /* {
581 		struct vnode	*a_vp;
582 		struct uio	*a_uio;
583 		int		a_ioflag;
584 		kauth_cred_t	a_cred;
585 	} */ *ap = v;
586 	struct vnode *vp = ap->a_vp;
587 	struct uio *uio = ap->a_uio;
588 	const int ioflag = ap->a_ioflag;
589 	tmpfs_node_t *node;
590 	off_t oldsize;
591 	ssize_t overrun;
592 	int extended;
593 	int error;
594 
595 	KASSERT(VOP_ISLOCKED(vp));
596 
597 	node = VP_TO_TMPFS_NODE(vp);
598 	oldsize = node->tn_size;
599 
600 	if (vp->v_type != VREG)
601 		return (EINVAL);
602 
603 	if (uio->uio_resid == 0)
604 		return (0);
605 
606 	if (ioflag & IO_APPEND) {
607 		uio->uio_offset = node->tn_size;
608 	}
609 
610 	if (uio->uio_offset < 0 ||
611 	    (u_int64_t)uio->uio_offset + uio->uio_resid > LLONG_MAX)
612 		return (EFBIG);
613 
614 	/* do the filesize rlimit check */
615 	if ((error = vn_fsizechk(vp, uio, ioflag, &overrun)))
616 		return (error);
617 
618 	extended = uio->uio_offset + uio->uio_resid > node->tn_size;
619 	if (extended) {
620 		error = tmpfs_reg_resize(vp, uio->uio_offset + uio->uio_resid);
621 		if (error)
622 			goto out;
623 	}
624 
625 	error = 0;
626 	while (error == 0 && uio->uio_resid > 0) {
627 		vsize_t len;
628 
629 		len = MIN(node->tn_size - uio->uio_offset, uio->uio_resid);
630 		if (len == 0) {
631 			break;
632 		}
633 		error = tmpfs_uiomove(node, uio, len);
634 	}
635 	if (error) {
636 		(void)tmpfs_reg_resize(vp, oldsize);
637 	}
638 
639 	tmpfs_update(node, TMPFS_NODE_MODIFIED | TMPFS_NODE_CHANGED);
640 	if (extended)
641 		VN_KNOTE(vp, NOTE_WRITE | NOTE_EXTEND);
642 	else
643 		VN_KNOTE(vp, NOTE_WRITE);
644 out:
645 	if (error) {
646 		KASSERT(oldsize == node->tn_size);
647 	} else {
648 		KASSERT(uio->uio_resid == 0);
649 
650 		/* correct the result for writes clamped by vn_fsizechk() */
651 		uio->uio_resid += overrun;
652 
653 	}
654 	return error;
655 }
656 
657 int
658 tmpfs_fsync(void *v)
659 {
660 #ifdef DIAGNOSTIC
661 	struct vop_fsync_args /* {
662 		struct vnode *a_vp;
663 		struct ucred *a_cred;
664 		int a_flags;
665 		off_t a_offlo;
666 		off_t a_offhi;
667 		struct lwp *a_l;
668 	} */ *ap = v;
669 	struct vnode *vp = ap->a_vp;
670 
671 	/* Nothing to do.  Just update. */
672 	KASSERT(VOP_ISLOCKED(vp));
673 #endif
674 	return 0;
675 }
676 
677 /*
678  * tmpfs_remove: unlink a file.
679  *
680  * => Both directory (dvp) and file (vp) are locked.
681  * => We unlock and drop the reference on both.
682  */
683 int
684 tmpfs_remove(void *v)
685 {
686 	struct vop_remove_args /* {
687 		struct vnode *a_dvp;
688 		struct vnode *a_vp;
689 		struct componentname *a_cnp;
690 	} */ *ap = v;
691 	struct vnode *dvp = ap->a_dvp, *vp = ap->a_vp;
692 	struct componentname *cnp = ap->a_cnp;
693 	tmpfs_node_t *dnode, *node;
694 	tmpfs_dirent_t *de;
695 	int error;
696 
697 	KASSERT(VOP_ISLOCKED(dvp));
698 	KASSERT(VOP_ISLOCKED(vp));
699 	KASSERT(cnp->cn_flags & HASBUF);
700 
701 	if (vp->v_type == VDIR) {
702 		error = EPERM;
703 		goto out;
704 	}
705 
706 	dnode = VP_TO_TMPFS_NODE(dvp);
707 	node = VP_TO_TMPFS_NODE(vp);
708 
709 	/* Files marked as immutable or append-only cannot be deleted. */
710 	if (node->tn_flags & (IMMUTABLE | APPEND)) {
711 		error = EPERM;
712 		goto out;
713 	}
714 
715 	/*
716 	 * Likewise, files residing on directories marked as append-only cannot
717 	 * be deleted.
718 	 */
719 	if (dnode->tn_flags & APPEND) {
720 		error = EPERM;
721 		goto out;
722 	}
723 
724 	/* Lookup the directory entry (check the cached hint first). */
725 	de = tmpfs_dir_cached(node);
726 	if (de == NULL) {
727 		de = tmpfs_dir_lookup(dnode, cnp);
728 	}
729 
730 	KASSERT(de && de->td_node == node);
731 
732 	/*
733 	 * Remove the entry from the directory (drops the link count) and
734 	 * destroy it.
735 	 * Note: the inode referred by it will not be destroyed
736 	 * until the vnode is reclaimed/recycled.
737 	 */
738 	tmpfs_dir_detach(dnode, de);
739 	tmpfs_free_dirent(VFS_TO_TMPFS(vp->v_mount), de);
740 	if (node->tn_links > 0)  {
741 		/* We removed a hard link. */
742 		tmpfs_update(node, TMPFS_NODE_CHANGED);
743 	}
744 	error = 0;
745 out:
746 	pool_put(&namei_pool, cnp->cn_pnbuf);
747 	/* Drop the references and unlock the vnodes. */
748 	vput(vp);
749 	if (dvp == vp) {
750 		vrele(dvp);
751 	} else {
752 		vput(dvp);
753 	}
754 	return error;
755 }
756 
757 /*
758  * tmpfs_link: create a hard link.
759  */
760 int
761 tmpfs_link(void *v)
762 {
763 	struct vop_link_args /* {
764 		struct vnode *a_dvp;
765 		struct vnode *a_vp;
766 		struct componentname *a_cnp;
767 	} */ *ap = v;
768 	struct vnode *dvp = ap->a_dvp;
769 	struct vnode *vp = ap->a_vp;
770 	struct componentname *cnp = ap->a_cnp;
771 	tmpfs_node_t *dnode, *node;
772 	tmpfs_dirent_t *de;
773 	int error;
774 
775 	KASSERT(VOP_ISLOCKED(dvp));
776 
777 	if (vp->v_type == VDIR) {
778 		VOP_ABORTOP(dvp, cnp);
779 		vput(dvp);
780 		return EPERM;
781 	}
782 
783 	KASSERT(dvp != vp);
784 
785 	if (dvp->v_mount != vp->v_mount) {
786 		VOP_ABORTOP(dvp, cnp);
787 		vput(dvp);
788 		return EXDEV;
789 	}
790 
791 	dnode = VP_TO_TMPFS_DIR(dvp);
792 	node = VP_TO_TMPFS_NODE(vp);
793 
794 	vn_lock(vp, LK_EXCLUSIVE | LK_RETRY);
795 
796 	/* Check for maximum number of links limit. */
797 	if (node->tn_links == LINK_MAX) {
798 		error = EMLINK;
799 		goto out;
800 	}
801 	KASSERT(node->tn_links < LINK_MAX);
802 
803 	/* We cannot create links of files marked immutable or append-only. */
804 	if (node->tn_flags & (IMMUTABLE | APPEND)) {
805 		error = EPERM;
806 		goto out;
807 	}
808 
809 	if (TMPFS_DIRSEQ_FULL(dnode)) {
810 		error = ENOSPC;
811 		goto out;
812 	}
813 
814 	/* Allocate a new directory entry to represent the inode. */
815 	error = tmpfs_alloc_dirent(VFS_TO_TMPFS(vp->v_mount),
816 	    cnp->cn_nameptr, cnp->cn_namelen, &de);
817 	if (error) {
818 		goto out;
819 	}
820 
821 	/*
822 	 * Insert the entry into the directory.
823 	 * It will increase the inode link count.
824 	 */
825 	tmpfs_dir_attach(dnode, de, node);
826 
827 	/* Update the timestamps and trigger the event. */
828 	if (node->tn_vnode) {
829 		VN_KNOTE(node->tn_vnode, NOTE_LINK);
830 	}
831 	tmpfs_update(node, TMPFS_NODE_CHANGED);
832 	error = 0;
833 out:
834 	pool_put(&namei_pool, cnp->cn_pnbuf);
835 	VOP_UNLOCK(vp);
836 	vput(dvp);
837 	return error;
838 }
839 
840 int
841 tmpfs_mkdir(void *v)
842 {
843 	struct vop_mkdir_args /* {
844 		struct vnode		*a_dvp;
845 		struct vnode		**a_vpp;
846 		struct componentname	*a_cnp;
847 		struct vattr		*a_vap;
848 	} */ *ap = v;
849 	struct vnode *dvp = ap->a_dvp;
850 	struct vnode **vpp = ap->a_vpp;
851 	struct componentname *cnp = ap->a_cnp;
852 	struct vattr *vap = ap->a_vap;
853 	int error;
854 
855 	KASSERT(vap->va_type == VDIR);
856 	error = tmpfs_alloc_file(dvp, vpp, vap, cnp, NULL);
857 	vput(dvp);
858 	return error;
859 }
860 
861 int
862 tmpfs_rmdir(void *v)
863 {
864 	struct vop_rmdir_args /* {
865 		struct vnode		*a_dvp;
866 		struct vnode		*a_vp;
867 		struct componentname	*a_cnp;
868 	} */ *ap = v;
869 	struct vnode *dvp = ap->a_dvp;
870 	struct vnode *vp = ap->a_vp;
871 	struct componentname *cnp = ap->a_cnp;
872 	tmpfs_mount_t *tmp = VFS_TO_TMPFS(dvp->v_mount);
873 	tmpfs_node_t *dnode = VP_TO_TMPFS_DIR(dvp);
874 	tmpfs_node_t *node = VP_TO_TMPFS_DIR(vp);
875 	tmpfs_dirent_t *de;
876 	int error = 0;
877 
878 	KASSERT(VOP_ISLOCKED(dvp));
879 	KASSERT(VOP_ISLOCKED(vp));
880 	KASSERT(cnp->cn_flags & HASBUF);
881 
882 	if (cnp->cn_namelen == 2 && cnp->cn_nameptr[0] == '.' &&
883 	    cnp->cn_nameptr[1] == '.') {
884 		error = ENOTEMPTY;
885 		goto out;
886 	}
887 
888 	KASSERT(node->tn_spec.tn_dir.tn_parent == dnode);
889 
890 	/*
891 	 * Directories with more than two entries ('.' and '..') cannot be
892 	 * removed.
893 	 */
894 	if (node->tn_size > 0) {
895 		KASSERT(error == 0);
896 		TAILQ_FOREACH(de, &node->tn_spec.tn_dir.tn_dir, td_entries) {
897 			error = ENOTEMPTY;
898 			break;
899 		}
900 		if (error)
901 			goto out;
902 	}
903 
904 	/* Lookup the directory entry (check the cached hint first). */
905 	de = tmpfs_dir_cached(node);
906 	if (de == NULL)
907 		de = tmpfs_dir_lookup(dnode, cnp);
908 
909 	KASSERT(de && de->td_node == node);
910 
911 	/* Check flags to see if we are allowed to remove the directory. */
912 	if (dnode->tn_flags & APPEND || node->tn_flags & (IMMUTABLE | APPEND)) {
913 		error = EPERM;
914 		goto out;
915 	}
916 
917 	/* Decrement the link count for the virtual '.' entry. */
918 	node->tn_links--;
919 	tmpfs_update(node, TMPFS_NODE_STATUSALL);
920 
921 	/* Detach the directory entry from the directory. */
922 	tmpfs_dir_detach(dnode, de);
923 
924 	/* Purge the cache for parent. */
925 	cache_purge(dvp);
926 
927 	/*
928 	 * Destroy the directory entry.
929 	 * Note: the inode referred by it will not be destroyed
930 	 * until the vnode is reclaimed.
931 	 */
932 	tmpfs_free_dirent(tmp, de);
933 	KASSERT(TAILQ_FIRST(&node->tn_spec.tn_dir.tn_dir) == NULL);
934 
935 	KASSERT(node->tn_links == 0);
936 out:
937 	pool_put(&namei_pool, cnp->cn_pnbuf);
938 	/* Release the nodes. */
939 	vput(dvp);
940 	vput(vp);
941 	return error;
942 }
943 
944 int
945 tmpfs_symlink(void *v)
946 {
947 	struct vop_symlink_args /* {
948 		struct vnode		*a_dvp;
949 		struct vnode		**a_vpp;
950 		struct componentname	*a_cnp;
951 		struct vattr		*a_vap;
952 		char			*a_target;
953 	} */ *ap = v;
954 	struct vnode *dvp = ap->a_dvp;
955 	struct vnode **vpp = ap->a_vpp;
956 	struct componentname *cnp = ap->a_cnp;
957 	struct vattr *vap = ap->a_vap;
958 	char *target = ap->a_target;
959 	int error;
960 
961 	KASSERT(vap->va_type == 0);
962 	vap->va_type = VLNK;
963 
964 	error = tmpfs_alloc_file(dvp, vpp, vap, cnp, target);
965 	vput(dvp);
966 	if (error == 0)
967 		vput(*vpp);
968 
969 	return error;
970 }
971 
972 int
973 tmpfs_readdir(void *v)
974 {
975 	struct vop_readdir_args /* {
976 		struct vnode	*a_vp;
977 		struct uio	*a_uio;
978 		kauth_cred_t	a_cred;
979 		int		*a_eofflag;
980 	} */ *ap = v;
981 	struct vnode *vp = ap->a_vp;
982 	struct uio *uio = ap->a_uio;
983 	int *eofflag = ap->a_eofflag;
984 	tmpfs_node_t *node;
985 	int error;
986 
987 	KASSERT(VOP_ISLOCKED(vp));
988 
989 	/* This operation only makes sense on directory nodes. */
990 	if (vp->v_type != VDIR) {
991 		return ENOTDIR;
992 	}
993 	node = VP_TO_TMPFS_DIR(vp);
994 	/*
995 	 * Retrieve the directory entries, unless it is being destroyed.
996 	 */
997 	if (node->tn_links) {
998 		error = tmpfs_dir_getdents(node, uio);
999 	} else {
1000 		error = 0;
1001 	}
1002 
1003 	if (eofflag != NULL) {
1004 		*eofflag = !error && uio->uio_offset == TMPFS_DIRSEQ_EOF;
1005 	}
1006 	return error;
1007 }
1008 
1009 int
1010 tmpfs_readlink(void *v)
1011 {
1012 	struct vop_readlink_args /* {
1013 		struct vnode	*a_vp;
1014 		struct uio	*a_uio;
1015 		kauth_cred_t	a_cred;
1016 	} */ *ap = v;
1017 	struct vnode *vp = ap->a_vp;
1018 	struct uio *uio = ap->a_uio;
1019 	tmpfs_node_t *node;
1020 	int error;
1021 
1022 	KASSERT(VOP_ISLOCKED(vp));
1023 	KASSERT(uio->uio_offset == 0);
1024 	KASSERT(vp->v_type == VLNK);
1025 
1026 	node = VP_TO_TMPFS_NODE(vp);
1027 	error = uiomove(node->tn_spec.tn_lnk.tn_link,
1028 	    MIN((size_t)node->tn_size, uio->uio_resid), uio);
1029 
1030 	if (!(vp->v_mount->mnt_flag & MNT_NOATIME))
1031 		tmpfs_update(node, TMPFS_NODE_ACCESSED);
1032 
1033 	return error;
1034 }
1035 
1036 int
1037 tmpfs_inactive(void *v)
1038 {
1039 	struct vop_inactive_args /* {
1040 		struct vnode *a_vp;
1041 		int *a_recycle;
1042 	} */ *ap = v;
1043 	struct vnode *vp = ap->a_vp;
1044 	tmpfs_node_t *node;
1045 
1046 	KASSERT(VOP_ISLOCKED(vp));
1047 
1048 	node = VP_TO_TMPFS_NODE(vp);
1049 
1050 	if (vp->v_type == VREG && tmpfs_uio_cached(node))
1051 		tmpfs_uio_uncache(node);
1052 
1053 	VOP_UNLOCK(vp);
1054 
1055 	/*
1056 	 * If we are done with the node, reclaim it so that it can be reused
1057 	 * immediately.
1058 	 */
1059 	if (node->tn_links == 0)
1060 		vrecycle(vp, curproc);
1061 
1062 	return 0;
1063 }
1064 
1065 int
1066 tmpfs_reclaim(void *v)
1067 {
1068 	struct vop_reclaim_args /* {
1069 		struct vnode *a_vp;
1070 	} */ *ap = v;
1071 	struct vnode *vp = ap->a_vp;
1072 	tmpfs_mount_t *tmp = VFS_TO_TMPFS(vp->v_mount);
1073 	tmpfs_node_t *node = VP_TO_TMPFS_NODE(vp);
1074 	int racing;
1075 
1076 	/* Disassociate inode from vnode. */
1077 	rw_enter_write(&node->tn_nlock);
1078 	node->tn_vnode = NULL;
1079 	vp->v_data = NULL;
1080 	/* Check if tmpfs_vnode_get() is racing with us. */
1081 	racing = TMPFS_NODE_RECLAIMING(node);
1082 	rw_exit_write(&node->tn_nlock);
1083 
1084 	cache_purge(vp);
1085 
1086 	/*
1087 	 * If inode is not referenced, i.e. no links, then destroy it.
1088 	 * Note: if racing - inode is about to get a new vnode, leave it.
1089 	 */
1090 	if (node->tn_links == 0 && !racing) {
1091 		tmpfs_free_node(tmp, node);
1092 	}
1093 	return 0;
1094 }
1095 
1096 int
1097 tmpfs_pathconf(void *v)
1098 {
1099 	struct vop_pathconf_args /* {
1100 		struct vnode	*a_vp;
1101 		int		a_name;
1102 		register_t	*a_retval;
1103 	} */ *ap = v;
1104 	const int name = ap->a_name;
1105 	register_t *retval = ap->a_retval;
1106 	int error = 0;
1107 
1108 	switch (name) {
1109 	case _PC_LINK_MAX:
1110 		*retval = LINK_MAX;
1111 		break;
1112 	case _PC_NAME_MAX:
1113 		*retval = TMPFS_MAXNAMLEN;
1114 		break;
1115 	case _PC_CHOWN_RESTRICTED:
1116 		*retval = 1;
1117 		break;
1118 	case _PC_NO_TRUNC:
1119 		*retval = 1;
1120 		break;
1121 	case _PC_FILESIZEBITS:
1122 		*retval = 64;
1123 		break;
1124 	case _PC_TIMESTAMP_RESOLUTION:
1125 		*retval = 1;
1126 		break;
1127 	default:
1128 		error = EINVAL;
1129 	}
1130 	return error;
1131 }
1132 
1133 int
1134 tmpfs_advlock(void *v)
1135 {
1136 	struct vop_advlock_args /* {
1137 		struct vnode	*a_vp;
1138 		void *		a_id;
1139 		int		a_op;
1140 		struct flock	*a_fl;
1141 		int		a_flags;
1142 	} */ *ap = v;
1143 	struct vnode *vp = ap->a_vp;
1144 	tmpfs_node_t *node = VP_TO_TMPFS_NODE(vp);
1145 
1146 	return lf_advlock(&node->tn_lockf, node->tn_size, ap->a_id, ap->a_op,
1147 	    ap->a_fl, ap->a_flags);
1148 }
1149 
1150 int
1151 tmpfs_print(void *v)
1152 {
1153 	struct vop_print_args /* {
1154 		struct vnode	*a_vp;
1155 	} */ *ap = v;
1156 	struct vnode *vp = ap->a_vp;
1157 	tmpfs_node_t *node = VP_TO_TMPFS_NODE(vp);
1158 
1159 	printf("tag VT_TMPFS, tmpfs_node %p, flags 0x%x, links %d\n"
1160 	    "\tmode 0%o, owner %d, group %d, size %lld",
1161 	    node, node->tn_flags, node->tn_links, node->tn_mode, node->tn_uid,
1162 	    node->tn_gid, node->tn_size);
1163 #ifdef FIFO
1164 	if (vp->v_type == VFIFO)
1165 		fifo_printinfo(vp);
1166 #endif
1167 	printf("\n");
1168 	return 0;
1169 }
1170 
1171 /* a null op */
1172 int
1173 tmpfs_bwrite(void *v)
1174 {
1175 	return 0;
1176 }
1177 
1178 int
1179 tmpfs_poll(void *v)
1180 {
1181 	struct vop_poll_args *ap = v;
1182 	return (ap->a_events & (POLLIN | POLLOUT | POLLRDNORM | POLLWRNORM));
1183 }
1184 
1185 int
1186 tmpfs_strategy(void *v)
1187 {
1188 	return EOPNOTSUPP;
1189 }
1190 
1191 int
1192 tmpfs_ioctl(void *v)
1193 {
1194 	return ENOTTY;
1195 }
1196 
1197 int
1198 tmpfs_lock(void *v)
1199 {
1200 	struct vop_lock_args *ap = v;
1201 	tmpfs_node_t *tnp = VP_TO_TMPFS_NODE(ap->a_vp);
1202 
1203 	return rrw_enter(&tnp->tn_vlock, ap->a_flags & LK_RWFLAGS);
1204 }
1205 
1206 int
1207 tmpfs_unlock(void *v)
1208 {
1209 	struct vop_unlock_args *ap = v;
1210 	tmpfs_node_t *tnp = VP_TO_TMPFS_NODE(ap->a_vp);
1211 
1212 	rrw_exit(&tnp->tn_vlock);
1213 	return 0;
1214 }
1215 
1216 int
1217 tmpfs_islocked(void *v)
1218 {
1219 	struct vop_islocked_args *ap = v;
1220 	tmpfs_node_t *tnp = VP_TO_TMPFS_NODE(ap->a_vp);
1221 
1222 	return rrw_status(&tnp->tn_vlock);
1223 }
1224 
1225 /*
1226  * tmpfs_rename: rename routine, the hairiest system call, with the
1227  * insane API.
1228  *
1229  * Arguments: fdvp (from-parent vnode), fvp (from-leaf), tdvp (to-parent)
1230  * and tvp (to-leaf), if exists (NULL if not).
1231  *
1232  * => Caller holds a reference on fdvp and fvp, they are unlocked.
1233  *    Note: fdvp and fvp can refer to the same object (i.e. when it is root).
1234  *
1235  * => Both tdvp and tvp are referenced and locked.  It is our responsibility
1236  *    to release the references and unlock them (or destroy).
1237  */
1238 
1239 /*
1240  * First, some forward declarations of subroutines.
1241  */
1242 
1243 int tmpfs_sane_rename(struct vnode *, struct componentname *,
1244     struct vnode *, struct componentname *, struct ucred *, int);
1245 int tmpfs_rename_enter(struct mount *, struct tmpfs_mount *,
1246     struct ucred *,
1247     struct vnode *, struct tmpfs_node *, struct componentname *,
1248     struct tmpfs_dirent **, struct vnode **,
1249     struct vnode *, struct tmpfs_node *, struct componentname *,
1250     struct tmpfs_dirent **, struct vnode **);
1251 int tmpfs_rename_enter_common(struct mount *, struct tmpfs_mount *,
1252     struct ucred *,
1253     struct vnode *, struct tmpfs_node *,
1254     struct componentname *, struct tmpfs_dirent **, struct vnode **,
1255     struct componentname *, struct tmpfs_dirent **, struct vnode **);
1256 int tmpfs_rename_enter_separate(struct mount *, struct tmpfs_mount *,
1257     struct ucred *,
1258     struct vnode *, struct tmpfs_node *, struct componentname *,
1259     struct tmpfs_dirent **, struct vnode **,
1260     struct vnode *, struct tmpfs_node *, struct componentname *,
1261     struct tmpfs_dirent **, struct vnode **);
1262 void tmpfs_rename_exit(struct tmpfs_mount *,
1263     struct vnode *, struct vnode *, struct vnode *, struct vnode *);
1264 int tmpfs_rename_lock_directory(struct vnode *, struct tmpfs_node *);
1265 int tmpfs_rename_genealogy(struct tmpfs_node *, struct tmpfs_node *,
1266     struct tmpfs_node **);
1267 int tmpfs_rename_lock(struct mount *, struct ucred *, int,
1268     struct vnode *, struct tmpfs_node *, struct componentname *, int,
1269     struct tmpfs_dirent **, struct vnode **,
1270     struct vnode *, struct tmpfs_node *, struct componentname *, int,
1271     struct tmpfs_dirent **, struct vnode **);
1272 void tmpfs_rename_attachdetach(struct tmpfs_mount *,
1273     struct vnode *, struct tmpfs_dirent *, struct vnode *,
1274     struct vnode *, struct tmpfs_dirent *, struct vnode *);
1275 int tmpfs_do_remove(struct tmpfs_mount *, struct vnode *,
1276     struct tmpfs_node *, struct tmpfs_dirent *, struct vnode *, struct ucred *);
1277 int tmpfs_rename_check_possible(struct tmpfs_node *,
1278     struct tmpfs_node *, struct tmpfs_node *, struct tmpfs_node *);
1279 int tmpfs_rename_check_permitted(struct ucred *,
1280     struct tmpfs_node *, struct tmpfs_node *,
1281     struct tmpfs_node *, struct tmpfs_node *);
1282 int tmpfs_remove_check_possible(struct tmpfs_node *,
1283     struct tmpfs_node *);
1284 int tmpfs_remove_check_permitted(struct ucred *,
1285     struct tmpfs_node *, struct tmpfs_node *);
1286 int tmpfs_check_sticky(struct ucred *,
1287     struct tmpfs_node *, struct tmpfs_node *);
1288 void tmpfs_rename_cache_purge(struct vnode *, struct vnode *, struct vnode *,
1289     struct vnode *);
1290 void tmpfs_rename_abort(void *);
1291 
1292 int
1293 tmpfs_rename(void *v)
1294 {
1295 	struct vop_rename_args  /* {
1296 		struct vnode		*a_fdvp;
1297 		struct vnode		*a_fvp;
1298 		struct componentname	*a_fcnp;
1299 		struct vnode		*a_tdvp;
1300 		struct vnode		*a_tvp;
1301 		struct componentname	*a_tcnp;
1302 	} */ *ap = v;
1303 	struct vnode *fdvp = ap->a_fdvp;
1304 	struct vnode *fvp = ap->a_fvp;
1305 	struct componentname *fcnp = ap->a_fcnp;
1306 	struct vnode *tdvp = ap->a_tdvp;
1307 	struct vnode *tvp = ap->a_tvp;
1308 	struct componentname *tcnp = ap->a_tcnp;
1309 	struct ucred *cred;
1310 	int error;
1311 
1312 	KASSERT(fdvp != NULL);
1313 	KASSERT(fvp != NULL);
1314 	KASSERT(fcnp != NULL);
1315 	KASSERT(fcnp->cn_nameptr != NULL);
1316 	KASSERT(tdvp != NULL);
1317 	KASSERT(tcnp != NULL);
1318 	KASSERT(fcnp->cn_nameptr != NULL);
1319 	/* KASSERT(VOP_ISLOCKED(fdvp) != LK_EXCLUSIVE); */
1320 	/* KASSERT(VOP_ISLOCKED(fvp) != LK_EXCLUSIVE); */
1321 	KASSERT(fdvp->v_type == VDIR);
1322 	KASSERT(tdvp->v_type == VDIR);
1323 	KASSERT(fcnp->cn_flags & HASBUF);
1324 	KASSERT(tcnp->cn_flags & HASBUF);
1325 
1326 	cred = fcnp->cn_cred;
1327 	KASSERT(tcnp->cn_cred == cred);
1328 
1329 	/*
1330 	 * Check for cross-device rename.
1331 	 */
1332 	if (fvp->v_mount != tdvp->v_mount ||
1333 	    (tvp != NULL && (fvp->v_mount != tvp->v_mount))) {
1334 	    	tmpfs_rename_abort(v);
1335 		return EXDEV;
1336 	}
1337 
1338 	/*
1339 	 * Can't check the locks on these until we know they're on
1340 	 * the same FS, as not all FS do locking the same way.
1341 	 */
1342 	KASSERT(VOP_ISLOCKED(tdvp) == LK_EXCLUSIVE);
1343 	KASSERT((tvp == NULL) || (VOP_ISLOCKED(tvp) == LK_EXCLUSIVE));
1344 
1345 	/*
1346 	 * Reject renaming '.' and '..'.
1347 	 */
1348 	if ((fcnp->cn_namelen == 1 && fcnp->cn_nameptr[0] == '.') ||
1349 	    (fcnp->cn_namelen == 2 && fcnp->cn_nameptr[0] == '.' &&
1350 	    fcnp->cn_nameptr[1] == '.')) {
1351 		tmpfs_rename_abort(v);
1352 		return EINVAL;
1353 	}
1354 
1355 	/*
1356 	 * Sanitize our world from the VFS insanity.  Unlock the target
1357 	 * directory and node, which are locked.  Release the children,
1358 	 * which are referenced.  Check for rename("x", "y/."), which
1359 	 * it is our responsibility to reject, not the caller's.  (But
1360 	 * the caller does reject rename("x/.", "y").  Go figure.)
1361 	 */
1362 
1363 	VOP_UNLOCK(tdvp);
1364 	if ((tvp != NULL) && (tvp != tdvp))
1365 		VOP_UNLOCK(tvp);
1366 
1367 	vrele(fvp);
1368 	if (tvp != NULL)
1369 		vrele(tvp);
1370 
1371 	if (tvp == tdvp) {
1372 		error = EINVAL;
1373 		goto out;
1374 	}
1375 
1376 	error = tmpfs_sane_rename(fdvp, fcnp, tdvp, tcnp, cred, 0);
1377 
1378 out:	/*
1379 	 * All done, whether with success or failure.  Release the
1380 	 * directory nodes now, as the caller expects from the VFS
1381 	 * protocol.
1382 	 */
1383 	vrele(fdvp);
1384 	vrele(tdvp);
1385 
1386 	return error;
1387 }
1388 
1389 /*
1390  * tmpfs_sane_rename: rename routine, the hairiest system call, with
1391  * the sane API.
1392  *
1393  * Arguments:
1394  *
1395  * . fdvp (from directory vnode),
1396  * . fcnp (from component name),
1397  * . tdvp (to directory vnode), and
1398  * . tcnp (to component name).
1399  *
1400  * fdvp and tdvp must be referenced and unlocked.
1401  */
1402 int
1403 tmpfs_sane_rename(struct vnode *fdvp, struct componentname *fcnp,
1404     struct vnode *tdvp, struct componentname *tcnp, struct ucred *cred,
1405     int posixly_correct)
1406 {
1407 	struct mount *mount;
1408 	struct tmpfs_mount *tmpfs;
1409 	struct tmpfs_node *fdnode, *tdnode;
1410 	struct tmpfs_dirent *fde, *tde;
1411 	struct vnode *fvp, *tvp;
1412 	char *newname;
1413 	int error;
1414 
1415 	KASSERT(fdvp != NULL);
1416 	KASSERT(fcnp != NULL);
1417 	KASSERT(tdvp != NULL);
1418 	KASSERT(tcnp != NULL);
1419 	/* KASSERT(VOP_ISLOCKED(fdvp) != LK_EXCLUSIVE); */
1420 	/* KASSERT(VOP_ISLOCKED(tdvp) != LK_EXCLUSIVE); */
1421 	KASSERT(fdvp->v_type == VDIR);
1422 	KASSERT(tdvp->v_type == VDIR);
1423 	KASSERT(fdvp->v_mount == tdvp->v_mount);
1424 	KASSERT((fcnp->cn_flags & ISDOTDOT) == 0);
1425 	KASSERT((tcnp->cn_flags & ISDOTDOT) == 0);
1426 	KASSERT((fcnp->cn_namelen != 1) || (fcnp->cn_nameptr[0] != '.'));
1427 	KASSERT((tcnp->cn_namelen != 1) || (tcnp->cn_nameptr[0] != '.'));
1428 	KASSERT((fcnp->cn_namelen != 2) || (fcnp->cn_nameptr[0] != '.') ||
1429 	    (fcnp->cn_nameptr[1] != '.'));
1430 	KASSERT((tcnp->cn_namelen != 2) || (tcnp->cn_nameptr[0] != '.') ||
1431 	    (tcnp->cn_nameptr[1] != '.'));
1432 
1433 	/*
1434 	 * Pull out the tmpfs data structures.
1435 	 */
1436 	fdnode = VP_TO_TMPFS_NODE(fdvp);
1437 	tdnode = VP_TO_TMPFS_NODE(tdvp);
1438 	KASSERT(fdnode != NULL);
1439 	KASSERT(tdnode != NULL);
1440 	KASSERT(fdnode->tn_vnode == fdvp);
1441 	KASSERT(tdnode->tn_vnode == tdvp);
1442 	KASSERT(fdnode->tn_type == VDIR);
1443 	KASSERT(tdnode->tn_type == VDIR);
1444 
1445 	mount = fdvp->v_mount;
1446 	KASSERT(mount != NULL);
1447 	KASSERT(mount == tdvp->v_mount);
1448 	/* XXX How can we be sure this stays true?  (Not that you're
1449 	 * likely to mount a tmpfs read-only...)  */
1450 	KASSERT((mount->mnt_flag & MNT_RDONLY) == 0);
1451 	tmpfs = VFS_TO_TMPFS(mount);
1452 	KASSERT(tmpfs != NULL);
1453 
1454 	/*
1455 	 * Decide whether we need a new name, and allocate memory for
1456 	 * it if so.  Do this before locking anything or taking
1457 	 * destructive actions so that we can back out safely and sleep
1458 	 * safely.  XXX Is sleeping an issue here?  Can this just be
1459 	 * moved into tmpfs_rename_attachdetach?
1460 	 */
1461 	if (tmpfs_strname_neqlen(fcnp, tcnp)) {
1462 		newname = tmpfs_strname_alloc(tmpfs, tcnp->cn_namelen);
1463 		if (newname == NULL) {
1464 			error = ENOSPC;
1465 			goto out_unlocked;
1466 		}
1467 	} else {
1468 		newname = NULL;
1469 	}
1470 
1471 	/*
1472 	 * Lock and look up everything.  GCC is not very clever.
1473 	 */
1474 	fde = tde = NULL;
1475 	fvp = tvp = NULL;
1476 	error = tmpfs_rename_enter(mount, tmpfs, cred,
1477 	    fdvp, fdnode, fcnp, &fde, &fvp,
1478 	    tdvp, tdnode, tcnp, &tde, &tvp);
1479 	if (error)
1480 		goto out_unlocked;
1481 
1482 	/*
1483 	 * Check that everything is locked and looks right.
1484 	 */
1485 	KASSERT(fde != NULL);
1486 	KASSERT(fvp != NULL);
1487 	KASSERT(fde->td_node != NULL);
1488 	KASSERT(fde->td_node->tn_vnode == fvp);
1489 	KASSERT(fde->td_node->tn_type == fvp->v_type);
1490 	KASSERT((tde == NULL) == (tvp == NULL));
1491 	KASSERT((tde == NULL) || (tde->td_node != NULL));
1492 	KASSERT((tde == NULL) || (tde->td_node->tn_vnode == tvp));
1493 	KASSERT((tde == NULL) || (tde->td_node->tn_type == tvp->v_type));
1494 	KASSERT(VOP_ISLOCKED(fdvp) == LK_EXCLUSIVE);
1495 	KASSERT(VOP_ISLOCKED(tdvp) == LK_EXCLUSIVE);
1496 	KASSERT(VOP_ISLOCKED(fvp) == LK_EXCLUSIVE);
1497 	KASSERT((tvp == NULL) || (VOP_ISLOCKED(tvp) == LK_EXCLUSIVE));
1498 
1499 	/*
1500 	 * If the source and destination are the same object, we need
1501 	 * only at most delete the source entry.
1502 	 */
1503 	if (fvp == tvp) {
1504 		KASSERT(tvp != NULL);
1505 		if (fde->td_node->tn_type == VDIR) {
1506 			/* XXX How can this possibly happen?  */
1507 			error = EINVAL;
1508 			goto out_locked;
1509 		}
1510 		if (!posixly_correct && (fde != tde)) {
1511 			/* XXX Doesn't work because of locking.
1512 			 * error = VOP_REMOVE(fdvp, fvp);
1513 			 */
1514 			error = tmpfs_do_remove(tmpfs, fdvp, fdnode, fde, fvp,
1515 			    cred);
1516 			if (error)
1517 				goto out_locked;
1518 		}
1519 		goto success;
1520 	}
1521 	KASSERT(fde != tde);
1522 	KASSERT(fvp != tvp);
1523 
1524 	/*
1525 	 * If the target exists, refuse to rename a directory over a
1526 	 * non-directory or vice versa, or to clobber a non-empty
1527 	 * directory.
1528 	 */
1529 	if (tvp != NULL) {
1530 		KASSERT(tde != NULL);
1531 		KASSERT(tde->td_node != NULL);
1532 		if (fvp->v_type == VDIR && tvp->v_type == VDIR)
1533 			error = ((tde->td_node->tn_size > 0)? ENOTEMPTY : 0);
1534 		else if (fvp->v_type == VDIR && tvp->v_type != VDIR)
1535 			error = ENOTDIR;
1536 		else if (fvp->v_type != VDIR && tvp->v_type == VDIR)
1537 			error = EISDIR;
1538 		else
1539 			error = 0;
1540 		if (error)
1541 			goto out_locked;
1542 		KASSERT((fvp->v_type == VDIR) == (tvp->v_type == VDIR));
1543 	}
1544 
1545 	/*
1546 	 * Authorize the rename.
1547 	 */
1548 	error = tmpfs_rename_check_possible(fdnode, fde->td_node,
1549 	    tdnode, (tde? tde->td_node : NULL));
1550 	if (error)
1551 		goto out_locked;
1552 	error = tmpfs_rename_check_permitted(cred, fdnode, fde->td_node,
1553 	    tdnode, (tde? tde->td_node : NULL));
1554 	if (error)
1555 		goto out_locked;
1556 
1557 	/*
1558 	 * Everything is hunky-dory.  Shuffle the directory entries.
1559 	 */
1560 	tmpfs_rename_attachdetach(tmpfs, fdvp, fde, fvp, tdvp, tde, tvp);
1561 
1562 	/*
1563 	 * Update the directory entry's name necessary, and flag
1564 	 * metadata updates.  A memory allocation failure here is not
1565 	 * OK because we've already committed some changes that we
1566 	 * can't back out at this point, and we have things locked so
1567 	 * we can't sleep, hence the early allocation above.
1568 	 */
1569 	if (newname != NULL) {
1570 		KASSERT(tcnp->cn_namelen <= TMPFS_MAXNAMLEN);
1571 
1572 		tmpfs_strname_free(tmpfs, fde->td_name, fde->td_namelen);
1573 		fde->td_namelen = (uint16_t)tcnp->cn_namelen;
1574 		(void)memcpy(newname, tcnp->cn_nameptr, tcnp->cn_namelen);
1575 		/* Commit newname and don't free it on the way out.  */
1576 		fde->td_name = newname;
1577 		newname = NULL;
1578 
1579 		tmpfs_update(fde->td_node, TMPFS_NODE_CHANGED);
1580 		tmpfs_update(tdnode, TMPFS_NODE_MODIFIED);
1581 	}
1582 
1583 success:
1584 	VN_KNOTE(fvp, NOTE_RENAME);
1585 	tmpfs_rename_cache_purge(fdvp, fvp, tdvp, tvp);
1586 	error = 0;
1587 
1588 out_locked:
1589 	tmpfs_rename_exit(tmpfs, fdvp, fvp, tdvp, tvp);
1590 
1591 out_unlocked:
1592 	/* KASSERT(VOP_ISLOCKED(fdvp) != LK_EXCLUSIVE); */
1593 	/* KASSERT(VOP_ISLOCKED(tdvp) != LK_EXCLUSIVE); */
1594 	/* KASSERT((fvp == NULL) || (VOP_ISLOCKED(fvp) != LK_EXCLUSIVE)); */
1595 	/* KASSERT((tvp == NULL) || (VOP_ISLOCKED(tvp) != LK_EXCLUSIVE)); */
1596 
1597 	if (newname != NULL)
1598 		tmpfs_strname_free(tmpfs, newname, tcnp->cn_namelen);
1599 
1600 	return error;
1601 }
1602 
1603 /*
1604  * Look up fcnp in fdnode/fdvp and store its directory entry in fde_ret
1605  * and the associated vnode in fvp_ret; fail if not found.  Look up
1606  * tcnp in tdnode/tdvp and store its directory entry in tde_ret and the
1607  * associated vnode in tvp_ret; store null instead if not found.  Fail
1608  * if anything has been mounted on any of the nodes involved.
1609  *
1610  * fdvp and tdvp must be referenced.
1611  *
1612  * On entry, nothing is locked.
1613  *
1614  * On success, everything is locked, and *fvp_ret, and *tvp_ret if
1615  * nonnull, are referenced.  The only pairs of vnodes that may be
1616  * identical are {fdvp, tdvp} and {fvp, tvp}.
1617  *
1618  * On failure, everything remains as was.
1619  *
1620  * Locking everything including the source and target nodes is
1621  * necessary to make sure that, e.g., link count updates are OK.  The
1622  * locking order is, in general, ancestor-first, matching the order you
1623  * need to use to look up a descendant anyway.
1624  */
1625 int
1626 tmpfs_rename_enter(struct mount *mount, struct tmpfs_mount *tmpfs,
1627     struct ucred *cred,
1628     struct vnode *fdvp, struct tmpfs_node *fdnode, struct componentname *fcnp,
1629     struct tmpfs_dirent **fde_ret, struct vnode **fvp_ret,
1630     struct vnode *tdvp, struct tmpfs_node *tdnode, struct componentname *tcnp,
1631     struct tmpfs_dirent **tde_ret, struct vnode **tvp_ret)
1632 {
1633 	int error;
1634 
1635 	KASSERT(mount != NULL);
1636 	KASSERT(tmpfs != NULL);
1637 	KASSERT(fdvp != NULL);
1638 	KASSERT(fdnode != NULL);
1639 	KASSERT(fcnp != NULL);
1640 	KASSERT(fde_ret != NULL);
1641 	KASSERT(fvp_ret != NULL);
1642 	KASSERT(tdvp != NULL);
1643 	KASSERT(tdnode != NULL);
1644 	KASSERT(tcnp != NULL);
1645 	KASSERT(tde_ret != NULL);
1646 	KASSERT(tvp_ret != NULL);
1647 	KASSERT(fdnode->tn_vnode == fdvp);
1648 	KASSERT(tdnode->tn_vnode == tdvp);
1649 	KASSERT(fdnode->tn_type == VDIR);
1650 	KASSERT(tdnode->tn_type == VDIR);
1651 
1652 	if (fdvp == tdvp) {
1653 		KASSERT(fdnode == tdnode);
1654 		error = tmpfs_rename_enter_common(mount, tmpfs, cred, fdvp,
1655 		    fdnode, fcnp, fde_ret, fvp_ret, tcnp, tde_ret, tvp_ret);
1656 	} else {
1657 		KASSERT(fdnode != tdnode);
1658 		error = tmpfs_rename_enter_separate(mount, tmpfs, cred,
1659 		    fdvp, fdnode, fcnp, fde_ret, fvp_ret,
1660 		    tdvp, tdnode, tcnp, tde_ret, tvp_ret);
1661 	}
1662 
1663 	if (error)
1664 		return error;
1665 
1666 	KASSERT(*fde_ret != NULL);
1667 	KASSERT(*fvp_ret != NULL);
1668 	KASSERT((*tde_ret == NULL) == (*tvp_ret == NULL));
1669 	KASSERT((*tde_ret == NULL) || ((*tde_ret)->td_node != NULL));
1670 	KASSERT((*tde_ret == NULL) ||
1671 	    ((*tde_ret)->td_node->tn_vnode == *tvp_ret));
1672 	KASSERT(VOP_ISLOCKED(fdvp) == LK_EXCLUSIVE);
1673 	KASSERT(VOP_ISLOCKED(*fvp_ret) == LK_EXCLUSIVE);
1674 	KASSERT(VOP_ISLOCKED(tdvp) == LK_EXCLUSIVE);
1675 	KASSERT((*tvp_ret == NULL) ||
1676 	    (VOP_ISLOCKED(*tvp_ret) == LK_EXCLUSIVE));
1677 	KASSERT(*fvp_ret != fdvp);
1678 	KASSERT(*fvp_ret != tdvp);
1679 	KASSERT(*tvp_ret != fdvp);
1680 	KASSERT(*tvp_ret != tdvp);
1681 	return 0;
1682 }
1683 
1684 /*
1685  * Lock and look up with a common source/target directory.
1686  */
1687 int
1688 tmpfs_rename_enter_common(struct mount *mount, struct tmpfs_mount *tmpfs,
1689     struct ucred *cred,
1690     struct vnode *dvp, struct tmpfs_node *dnode,
1691     struct componentname *fcnp,
1692     struct tmpfs_dirent **fde_ret, struct vnode **fvp_ret,
1693     struct componentname *tcnp,
1694     struct tmpfs_dirent **tde_ret, struct vnode **tvp_ret)
1695 {
1696 	struct tmpfs_dirent *fde, *tde;
1697 	struct vnode *fvp, *tvp;
1698 	int error;
1699 
1700 	error = tmpfs_rename_lock_directory(dvp, dnode);
1701 	if (error)
1702 		goto fail0;
1703 
1704 	/* Did we lose a race with mount?  */
1705 	if (dvp->v_mountedhere != NULL) {
1706 		error = EBUSY;
1707 		goto fail1;
1708 	}
1709 
1710 	/* Make sure the caller may read the directory.  */
1711 	error = VOP_ACCESS(dvp, VEXEC, cred, curproc);
1712 	if (error)
1713 		goto fail1;
1714 
1715 	/*
1716 	 * The order in which we lock the source and target nodes is
1717 	 * irrelevant because there can only be one rename on this
1718 	 * directory in flight at a time, and we have it locked.
1719 	 */
1720 
1721 	fde = tmpfs_dir_lookup(dnode, fcnp);
1722 	if (fde == NULL) {
1723 		error = ENOENT;
1724 		goto fail1;
1725 	}
1726 
1727 	KASSERT(fde->td_node != NULL);
1728 	/* We ruled out `.' earlier.  */
1729 	KASSERT(fde->td_node != dnode);
1730 	/* We ruled out `..' earlier.  */
1731 	KASSERT(fde->td_node != dnode->tn_spec.tn_dir.tn_parent);
1732 	rw_enter_write(&fde->td_node->tn_nlock);
1733 	error = tmpfs_vnode_get(mount, fde->td_node, &fvp);
1734 	if (error)
1735 		goto fail1;
1736 	KASSERT(fvp != NULL);
1737 	KASSERT(VOP_ISLOCKED(fvp) == LK_EXCLUSIVE);
1738 	KASSERT(fvp != dvp);
1739 	KASSERT(fvp->v_mount == mount);
1740 
1741 	/* Refuse to rename a mount point.  */
1742 	if ((fvp->v_type == VDIR) && (fvp->v_mountedhere != NULL)) {
1743 		error = EBUSY;
1744 		goto fail2;
1745 	}
1746 
1747 	tde = tmpfs_dir_lookup(dnode, tcnp);
1748 	if (tde == NULL) {
1749 		tvp = NULL;
1750 	} else {
1751 		KASSERT(tde->td_node != NULL);
1752 		/* We ruled out `.' earlier.  */
1753 		KASSERT(tde->td_node != dnode);
1754 		/* We ruled out `..' earlier.  */
1755 		KASSERT(tde->td_node != dnode->tn_spec.tn_dir.tn_parent);
1756 		if (tde->td_node != fde->td_node) {
1757 			rw_enter_write(&tde->td_node->tn_nlock);
1758 			error = tmpfs_vnode_get(mount, tde->td_node, &tvp);
1759 			if (error)
1760 				goto fail2;
1761 			KASSERT(tvp->v_mount == mount);
1762 			/* Refuse to rename over a mount point.  */
1763 			if ((tvp->v_type == VDIR) &&
1764 			    (tvp->v_mountedhere != NULL)) {
1765 				error = EBUSY;
1766 				goto fail3;
1767 			}
1768 		} else {
1769 			tvp = fvp;
1770 			vref(tvp);
1771 		}
1772 		KASSERT(tvp != NULL);
1773 		KASSERT(VOP_ISLOCKED(tvp) == LK_EXCLUSIVE);
1774 	}
1775 	KASSERT(tvp != dvp);
1776 
1777 	*fde_ret = fde;
1778 	*fvp_ret = fvp;
1779 	*tde_ret = tde;
1780 	*tvp_ret = tvp;
1781 	return 0;
1782 
1783 fail3:	if (tvp != NULL) {
1784 		if (tvp != fvp)
1785 			vput(tvp);
1786 		else
1787 			vrele(tvp);
1788 	}
1789 
1790 fail2:	vput(fvp);
1791 fail1:	VOP_UNLOCK(dvp);
1792 fail0:	return error;
1793 }
1794 
1795 /*
1796  * Lock and look up with separate source and target directories.
1797  */
1798 int
1799 tmpfs_rename_enter_separate(struct mount *mount, struct tmpfs_mount *tmpfs,
1800     struct ucred *cred,
1801     struct vnode *fdvp, struct tmpfs_node *fdnode, struct componentname *fcnp,
1802     struct tmpfs_dirent **fde_ret, struct vnode **fvp_ret,
1803     struct vnode *tdvp, struct tmpfs_node *tdnode, struct componentname *tcnp,
1804     struct tmpfs_dirent **tde_ret, struct vnode **tvp_ret)
1805 {
1806 	struct tmpfs_node *intermediate_node;
1807 	struct tmpfs_dirent *fde, *tde;
1808 	struct vnode *fvp, *tvp;
1809 	int error;
1810 
1811 	KASSERT(fdvp != tdvp);
1812 	KASSERT(fdnode != tdnode);
1813 
1814 #if 0				/* XXX */
1815 	mutex_enter(&tmpfs->tm_rename_lock);
1816 #endif
1817 
1818 	error = tmpfs_rename_genealogy(fdnode, tdnode, &intermediate_node);
1819 	if (error)
1820 		goto fail;
1821 
1822 	/*
1823 	 * intermediate_node == NULL means fdnode is not an ancestor of
1824 	 * tdnode.
1825 	 */
1826 	if (intermediate_node == NULL)
1827 		error = tmpfs_rename_lock(mount, cred, ENOTEMPTY,
1828 		    tdvp, tdnode, tcnp, 1, &tde, &tvp,
1829 		    fdvp, fdnode, fcnp, 0, &fde, &fvp);
1830 	else
1831 		error = tmpfs_rename_lock(mount, cred, EINVAL,
1832 		    fdvp, fdnode, fcnp, 0, &fde, &fvp,
1833 		    tdvp, tdnode, tcnp, 1, &tde, &tvp);
1834 	if (error)
1835 		goto fail;
1836 
1837 	KASSERT(fde != NULL);
1838 	KASSERT(fde->td_node != NULL);
1839 
1840 	/*
1841 	 * Reject rename("foo/bar", "foo/bar/baz/quux/zot").
1842 	 */
1843 	if (fde->td_node == intermediate_node) {
1844 		tmpfs_rename_exit(tmpfs, fdvp, fvp, tdvp, tvp);
1845 		return EINVAL;
1846 	}
1847 
1848 	*fde_ret = fde;
1849 	*fvp_ret = fvp;
1850 	*tde_ret = tde;
1851 	*tvp_ret = tvp;
1852 	return 0;
1853 
1854 fail:
1855 #if 0				/* XXX */
1856 	mutex_exit(&tmpfs->tm_rename_lock);
1857 #endif
1858 	return error;
1859 }
1860 
1861 /*
1862  * Unlock everything we locked for rename.
1863  *
1864  * fdvp and tdvp must be referenced.
1865  *
1866  * On entry, everything is locked, and fvp and tvp referenced.
1867  *
1868  * On exit, everything is unlocked, and fvp and tvp are released.
1869  */
1870 void
1871 tmpfs_rename_exit(struct tmpfs_mount *tmpfs,
1872     struct vnode *fdvp, struct vnode *fvp,
1873     struct vnode *tdvp, struct vnode *tvp)
1874 {
1875 
1876 	KASSERT(tmpfs != NULL);
1877 	KASSERT(fdvp != NULL);
1878 	KASSERT(fvp != NULL);
1879 	KASSERT(fdvp != fvp);
1880 	KASSERT(fdvp != tvp);
1881 	KASSERT(tdvp != tvp);
1882 	KASSERT(tdvp != fvp);
1883 	KASSERT(VOP_ISLOCKED(fdvp) == LK_EXCLUSIVE);
1884 	KASSERT(VOP_ISLOCKED(tdvp) == LK_EXCLUSIVE);
1885 	KASSERT(VOP_ISLOCKED(fvp) == LK_EXCLUSIVE);
1886 	KASSERT((tvp == NULL) || (VOP_ISLOCKED(tvp) == LK_EXCLUSIVE));
1887 
1888 	if (tvp != NULL) {
1889 		if (tvp != fvp)
1890 			vput(tvp);
1891 		else
1892 			vrele(tvp);
1893 	}
1894 	VOP_UNLOCK(tdvp);
1895 	vput(fvp);
1896 	if (fdvp != tdvp)
1897 		VOP_UNLOCK(fdvp);
1898 
1899 #if 0				/* XXX */
1900 	if (fdvp != tdvp)
1901 		mutex_exit(&tmpfs->tm_rename_lock);
1902 #endif
1903 }
1904 
1905 /*
1906  * Lock a directory, but fail if it has been rmdir'd.
1907  *
1908  * vp must be referenced.
1909  */
1910 int
1911 tmpfs_rename_lock_directory(struct vnode *vp, struct tmpfs_node *node)
1912 {
1913 
1914 	KASSERT(vp != NULL);
1915 	KASSERT(node != NULL);
1916 	KASSERT(node->tn_vnode == vp);
1917 	KASSERT(node->tn_type == VDIR);
1918 
1919 	vn_lock(vp, LK_EXCLUSIVE | LK_RETRY);
1920 	if (node->tn_spec.tn_dir.tn_parent == NULL) {
1921 		VOP_UNLOCK(vp);
1922 		return ENOENT;
1923 	}
1924 
1925 	return 0;
1926 }
1927 
1928 /*
1929  * Analyze the genealogy of the source and target nodes.
1930  *
1931  * On success, stores in *intermediate_node_ret either the child of
1932  * fdnode of which tdnode is a descendant, or null if tdnode is not a
1933  * descendant of fdnode at all.
1934  *
1935  * fdnode and tdnode must be unlocked and referenced.  The file
1936  * system's rename lock must also be held, to exclude concurrent
1937  * changes to the file system's genealogy other than rmdir.
1938  *
1939  * XXX This causes an extra lock/unlock of tdnode in the case when
1940  * we're just about to lock it again before locking anything else.
1941  * However, changing that requires reorganizing the code to make it
1942  * even more horrifically obscure.
1943  */
1944 int
1945 tmpfs_rename_genealogy(struct tmpfs_node *fdnode, struct tmpfs_node *tdnode,
1946     struct tmpfs_node **intermediate_node_ret)
1947 {
1948 	struct tmpfs_node *node = tdnode, *parent;
1949 	int error;
1950 
1951 	KASSERT(fdnode != NULL);
1952 	KASSERT(tdnode != NULL);
1953 	KASSERT(fdnode != tdnode);
1954 	KASSERT(intermediate_node_ret != NULL);
1955 
1956 	KASSERT(fdnode->tn_vnode != NULL);
1957 	KASSERT(tdnode->tn_vnode != NULL);
1958 	KASSERT(fdnode->tn_type == VDIR);
1959 	KASSERT(tdnode->tn_type == VDIR);
1960 
1961 	/*
1962 	 * We need to provisionally lock tdnode->tn_vnode to keep rmdir
1963 	 * from deleting it -- or any ancestor -- at an inopportune
1964 	 * moment.
1965 	 */
1966 	error = tmpfs_rename_lock_directory(tdnode->tn_vnode, tdnode);
1967 	if (error)
1968 		return error;
1969 
1970 	for (;;) {
1971 		parent = node->tn_spec.tn_dir.tn_parent;
1972 		KASSERT(parent != NULL);
1973 		KASSERT(parent->tn_type == VDIR);
1974 
1975 		/* Did we hit the root without finding fdnode?  */
1976 		if (parent == node) {
1977 			*intermediate_node_ret = NULL;
1978 			break;
1979 		}
1980 
1981 		/* Did we find that fdnode is an ancestor?  */
1982 		if (parent == fdnode) {
1983 			*intermediate_node_ret = node;
1984 			break;
1985 		}
1986 
1987 		/* Neither -- keep ascending the family tree.  */
1988 		node = parent;
1989 	}
1990 
1991 	VOP_UNLOCK(tdnode->tn_vnode);
1992 	return 0;
1993 }
1994 
1995 /*
1996  * Lock directories a and b, which must be distinct, and look up and
1997  * lock nodes a and b.  Do a first and then b.  Directory b may not be
1998  * an ancestor of directory a, although directory a may be an ancestor
1999  * of directory b.  Fail with overlap_error if node a is directory b.
2000  * Neither componentname may be `.' or `..'.
2001  *
2002  * a_dvp and b_dvp must be referenced.
2003  *
2004  * On entry, a_dvp and b_dvp are unlocked.
2005  *
2006  * On success,
2007  * . a_dvp and b_dvp are locked,
2008  * . *a_dirent_ret is filled with a directory entry whose node is
2009  *     locked and referenced,
2010  * . *b_vp_ret is filled with the corresponding vnode,
2011  * . *b_dirent_ret is filled either with null or with a directory entry
2012  *     whose node is locked and referenced,
2013  * . *b_vp is filled either with null or with the corresponding vnode,
2014  *     and
2015  * . the only pair of vnodes that may be identical is a_vp and b_vp.
2016  *
2017  * On failure, a_dvp and b_dvp are left unlocked, and *a_dirent_ret,
2018  * *a_vp, *b_dirent_ret, and *b_vp are left alone.
2019  */
2020 int
2021 tmpfs_rename_lock(struct mount *mount, struct ucred *cred, int overlap_error,
2022     struct vnode *a_dvp, struct tmpfs_node *a_dnode,
2023     struct componentname *a_cnp, int a_missing_ok,
2024     struct tmpfs_dirent **a_dirent_ret, struct vnode **a_vp_ret,
2025     struct vnode *b_dvp, struct tmpfs_node *b_dnode,
2026     struct componentname *b_cnp, int b_missing_ok,
2027     struct tmpfs_dirent **b_dirent_ret, struct vnode **b_vp_ret)
2028 {
2029 	struct tmpfs_dirent *a_dirent, *b_dirent;
2030 	struct vnode *a_vp, *b_vp;
2031 	int error;
2032 
2033 	KASSERT(a_dvp != NULL);
2034 	KASSERT(a_dnode != NULL);
2035 	KASSERT(a_cnp != NULL);
2036 	KASSERT(a_dirent_ret != NULL);
2037 	KASSERT(a_vp_ret != NULL);
2038 	KASSERT(b_dvp != NULL);
2039 	KASSERT(b_dnode != NULL);
2040 	KASSERT(b_cnp != NULL);
2041 	KASSERT(b_dirent_ret != NULL);
2042 	KASSERT(b_vp_ret != NULL);
2043 	KASSERT(a_dvp != b_dvp);
2044 	KASSERT(a_dnode != b_dnode);
2045 	KASSERT(a_dnode->tn_vnode == a_dvp);
2046 	KASSERT(b_dnode->tn_vnode == b_dvp);
2047 	KASSERT(a_dnode->tn_type == VDIR);
2048 	KASSERT(b_dnode->tn_type == VDIR);
2049 	KASSERT(a_missing_ok != b_missing_ok);
2050 
2051 	error = tmpfs_rename_lock_directory(a_dvp, a_dnode);
2052 	if (error)
2053 		goto fail0;
2054 
2055 	/* Did we lose a race with mount?  */
2056 	if (a_dvp->v_mountedhere != NULL) {
2057 		error = EBUSY;
2058 		goto fail1;
2059 	}
2060 
2061 	/* Make sure the caller may read the directory.  */
2062 	error = VOP_ACCESS(a_dvp, VEXEC, cred, curproc);
2063 	if (error)
2064 		goto fail1;
2065 
2066 	a_dirent = tmpfs_dir_lookup(a_dnode, a_cnp);
2067 	if (a_dirent != NULL) {
2068 		KASSERT(a_dirent->td_node != NULL);
2069 		/* We ruled out `.' earlier.  */
2070 		KASSERT(a_dirent->td_node != a_dnode);
2071 		/* We ruled out `..' earlier.  */
2072 		KASSERT(a_dirent->td_node !=
2073 		    a_dnode->tn_spec.tn_dir.tn_parent);
2074 		if (a_dirent->td_node == b_dnode) {
2075 			error = overlap_error;
2076 			goto fail1;
2077 		}
2078 		rw_enter_write(&a_dirent->td_node->tn_nlock);
2079 		error = tmpfs_vnode_get(mount, a_dirent->td_node, &a_vp);
2080 		if (error)
2081 			goto fail1;
2082 		KASSERT(a_vp->v_mount == mount);
2083 		/* Refuse to rename (over) a mount point.  */
2084 		if ((a_vp->v_type == VDIR) && (a_vp->v_mountedhere != NULL)) {
2085 			error = EBUSY;
2086 			goto fail2;
2087 		}
2088 	} else if (!a_missing_ok) {
2089 		error = ENOENT;
2090 		goto fail1;
2091 	} else {
2092 		a_vp = NULL;
2093 	}
2094 	KASSERT(a_vp != a_dvp);
2095 	KASSERT(a_vp != b_dvp);
2096 
2097 	error = tmpfs_rename_lock_directory(b_dvp, b_dnode);
2098 	if (error)
2099 		goto fail2;
2100 
2101 	/* Did we lose a race with mount?  */
2102 	if (b_dvp->v_mountedhere != NULL) {
2103 		error = EBUSY;
2104 		goto fail3;
2105 	}
2106 
2107 	/* Make sure the caller may read the directory.  */
2108 	error = VOP_ACCESS(b_dvp, VEXEC, cred, curproc);
2109 	if (error)
2110 		goto fail3;
2111 
2112 	b_dirent = tmpfs_dir_lookup(b_dnode, b_cnp);
2113 	if (b_dirent != NULL) {
2114 		KASSERT(b_dirent->td_node != NULL);
2115 		/* We ruled out `.' earlier.  */
2116 		KASSERT(b_dirent->td_node != b_dnode);
2117 		/* We ruled out `..' earlier.  */
2118 		KASSERT(b_dirent->td_node !=
2119 		    b_dnode->tn_spec.tn_dir.tn_parent);
2120 		/* b is not an ancestor of a.  */
2121 		KASSERT(b_dirent->td_node != a_dnode);
2122 		/* But the source and target nodes might be the same.  */
2123 		if ((a_dirent == NULL) ||
2124 		    (a_dirent->td_node != b_dirent->td_node)) {
2125 			rw_enter_write(&b_dirent->td_node->tn_nlock);
2126 			error = tmpfs_vnode_get(mount, b_dirent->td_node,
2127 			    &b_vp);
2128 			if (error)
2129 				goto fail3;
2130 			KASSERT(b_vp->v_mount == mount);
2131 			KASSERT(a_vp != b_vp);
2132 			/* Refuse to rename (over) a mount point.  */
2133 			if ((b_vp->v_type == VDIR) &&
2134 			    (b_vp->v_mountedhere != NULL)) {
2135 				error = EBUSY;
2136 				goto fail4;
2137 			}
2138 		} else {
2139 			b_vp = a_vp;
2140 			vref(b_vp);
2141 		}
2142 	} else if (!b_missing_ok) {
2143 		error = ENOENT;
2144 		goto fail3;
2145 	} else {
2146 		b_vp = NULL;
2147 	}
2148 	KASSERT(b_vp != a_dvp);
2149 	KASSERT(b_vp != b_dvp);
2150 
2151 	KASSERT(VOP_ISLOCKED(a_dvp) == LK_EXCLUSIVE);
2152 	KASSERT(VOP_ISLOCKED(b_dvp) == LK_EXCLUSIVE);
2153 	KASSERT(a_missing_ok || (a_dirent != NULL));
2154 	KASSERT(a_missing_ok || (a_dirent->td_node != NULL));
2155 	KASSERT(b_missing_ok || (b_dirent != NULL));
2156 	KASSERT(b_missing_ok || (b_dirent->td_node != NULL));
2157 	KASSERT((a_dirent == NULL) || (a_dirent->td_node != NULL));
2158 	KASSERT((a_dirent == NULL) || (a_dirent->td_node->tn_vnode == a_vp));
2159 	KASSERT((b_dirent == NULL) || (b_dirent->td_node != NULL));
2160 	KASSERT((b_dirent == NULL) || (b_dirent->td_node->tn_vnode == b_vp));
2161 	KASSERT((a_vp == NULL) || (VOP_ISLOCKED(a_vp) == LK_EXCLUSIVE));
2162 	KASSERT((b_vp == NULL) || (VOP_ISLOCKED(b_vp) == LK_EXCLUSIVE));
2163 
2164 	*a_dirent_ret = a_dirent;
2165 	*b_dirent_ret = b_dirent;
2166 	*a_vp_ret = a_vp;
2167 	*b_vp_ret = b_vp;
2168 	return 0;
2169 
2170 fail4:	if (b_vp != NULL) {
2171 		KASSERT(VOP_ISLOCKED(b_vp) == LK_EXCLUSIVE);
2172 		if (b_vp != a_vp)
2173 			vput(b_vp);
2174 		else
2175 			vrele(a_vp);
2176 	}
2177 
2178 fail3:	KASSERT(VOP_ISLOCKED(b_dvp) == LK_EXCLUSIVE);
2179 	VOP_UNLOCK(b_dvp);
2180 
2181 fail2:	if (a_vp != NULL) {
2182 		KASSERT(VOP_ISLOCKED(a_vp) == LK_EXCLUSIVE);
2183 		vput(a_vp);
2184 	}
2185 
2186 fail1:	KASSERT(VOP_ISLOCKED(a_dvp) == LK_EXCLUSIVE);
2187 	VOP_UNLOCK(a_dvp);
2188 
2189 fail0:	/* KASSERT(VOP_ISLOCKED(a_dvp) != LK_EXCLUSIVE); */
2190 	/* KASSERT(VOP_ISLOCKED(b_dvp) != LK_EXCLUSIVE); */
2191 	/* KASSERT((a_vp == NULL) || (VOP_ISLOCKED(a_vp) != LK_EXCLUSIVE)); */
2192 	/* KASSERT((b_vp == NULL) || (VOP_ISLOCKED(b_vp) != LK_EXCLUSIVE)); */
2193 	return error;
2194 }
2195 
2196 /*
2197  * Shuffle the directory entries to move fvp from the directory fdvp
2198  * into the directory tdvp.  fde is fvp's directory entry in fdvp.  If
2199  * we are overwriting a target node, it is tvp, and tde is its
2200  * directory entry in tdvp.
2201  *
2202  * fdvp, fvp, tdvp, and tvp must all be locked and referenced.
2203  */
2204 void
2205 tmpfs_rename_attachdetach(struct tmpfs_mount *tmpfs,
2206     struct vnode *fdvp, struct tmpfs_dirent *fde, struct vnode *fvp,
2207     struct vnode *tdvp, struct tmpfs_dirent *tde, struct vnode *tvp)
2208 {
2209 
2210 	KASSERT(tmpfs != NULL);
2211 	KASSERT(fdvp != NULL);
2212 	KASSERT(fde != NULL);
2213 	KASSERT(fvp != NULL);
2214 	KASSERT(tdvp != NULL);
2215 	KASSERT(fde->td_node != NULL);
2216 	KASSERT(fde->td_node->tn_vnode == fvp);
2217 	KASSERT((tde == NULL) == (tvp == NULL));
2218 	KASSERT((tde == NULL) || (tde->td_node != NULL));
2219 	KASSERT((tde == NULL) || (tde->td_node->tn_vnode == tvp));
2220 	KASSERT(VOP_ISLOCKED(fdvp) == LK_EXCLUSIVE);
2221 	KASSERT(VOP_ISLOCKED(tdvp) == LK_EXCLUSIVE);
2222 	KASSERT(VOP_ISLOCKED(fvp) == LK_EXCLUSIVE);
2223 	KASSERT((tvp == NULL) || (VOP_ISLOCKED(tvp) == LK_EXCLUSIVE));
2224 
2225 	/*
2226 	 * If we are moving from one directory to another, detach the
2227 	 * source entry and reattach it to the target directory.
2228 	 */
2229 	if (fdvp != tdvp) {
2230 		/* tmpfs_dir_detach clobbers fde->td_node, so save it.  */
2231 		struct tmpfs_node *fnode = fde->td_node;
2232 		tmpfs_node_t *fdnode = VP_TO_TMPFS_DIR(fdvp);
2233 		tmpfs_node_t *tdnode = VP_TO_TMPFS_DIR(tdvp);
2234 		tmpfs_dir_detach(fdnode, fde);
2235 		tmpfs_dir_attach(tdnode, fde, fnode);
2236 	} else if (tvp == NULL) {
2237 		/*
2238 		 * We are changing the directory.  tmpfs_dir_attach and
2239 		 * tmpfs_dir_detach note the events for us, but for
2240 		 * this case we don't call them, so we must note the
2241 		 * event explicitly.
2242 		 */
2243 		VN_KNOTE(fdvp, NOTE_WRITE);
2244 	}
2245 
2246 	/*
2247 	 * If we are replacing an existing target entry, delete it.
2248 	 */
2249 	if (tde != NULL) {
2250 		tmpfs_node_t *tdnode = VP_TO_TMPFS_DIR(tdvp);
2251 		KASSERT(tvp != NULL);
2252 		KASSERT(tde->td_node != NULL);
2253 		KASSERT((fvp->v_type == VDIR) == (tvp->v_type == VDIR));
2254 		if (tde->td_node->tn_type == VDIR) {
2255 			KASSERT(tde->td_node->tn_size == 0);
2256 			KASSERT(tde->td_node->tn_links == 2);
2257 			/* Decrement the extra link count for `.' so
2258 			 * the vnode will be recycled when released.  */
2259 			tde->td_node->tn_links--;
2260 		}
2261 		tmpfs_dir_detach(tdnode, tde);
2262 		tmpfs_free_dirent(tmpfs, tde);
2263 	}
2264 }
2265 
2266 /*
2267  * Remove the entry de for the non-directory vp from the directory dvp.
2268  *
2269  * Everything must be locked and referenced.
2270  */
2271 int
2272 tmpfs_do_remove(struct tmpfs_mount *tmpfs, struct vnode *dvp,
2273     struct tmpfs_node *dnode, struct tmpfs_dirent *de, struct vnode *vp,
2274     struct ucred *cred)
2275 {
2276 	int error;
2277 
2278 	KASSERT(tmpfs != NULL);
2279 	KASSERT(dvp != NULL);
2280 	KASSERT(dnode != NULL);
2281 	KASSERT(de != NULL);
2282 	KASSERT(vp != NULL);
2283 	KASSERT(dnode->tn_vnode == dvp);
2284 	KASSERT(de->td_node != NULL);
2285 	KASSERT(de->td_node->tn_vnode == vp);
2286 	KASSERT(VOP_ISLOCKED(dvp) == LK_EXCLUSIVE);
2287 	KASSERT(VOP_ISLOCKED(vp) == LK_EXCLUSIVE);
2288 
2289 	error = tmpfs_remove_check_possible(dnode, de->td_node);
2290 	if (error)
2291 		return error;
2292 
2293 	error = tmpfs_remove_check_permitted(cred, dnode, de->td_node);
2294 	if (error)
2295 		return error;
2296 
2297 	/*
2298 	 * If not root and directory is sticky, check for permission on
2299 	 * directory or on file. This implements append-only directories.
2300 	 */
2301 	if ((dnode->tn_mode & S_ISTXT) != 0)
2302 		if (cred->cr_uid != 0 && cred->cr_uid != dnode->tn_uid &&
2303 		    cred->cr_uid != de->td_node->tn_uid)
2304 			return EPERM;
2305 
2306 	tmpfs_dir_detach(dnode, de);
2307 	tmpfs_free_dirent(tmpfs, de);
2308 
2309 	return 0;
2310 }
2311 
2312 /*
2313  * Check whether a rename is possible independent of credentials.
2314  *
2315  * Everything must be locked and referenced.
2316  */
2317 int
2318 tmpfs_rename_check_possible(
2319     struct tmpfs_node *fdnode, struct tmpfs_node *fnode,
2320     struct tmpfs_node *tdnode, struct tmpfs_node *tnode)
2321 {
2322 
2323 	KASSERT(fdnode != NULL);
2324 	KASSERT(fnode != NULL);
2325 	KASSERT(tdnode != NULL);
2326 	KASSERT(fdnode != fnode);
2327 	KASSERT(tdnode != tnode);
2328 	KASSERT(fnode != tnode);
2329 	KASSERT(fdnode->tn_vnode != NULL);
2330 	KASSERT(fnode->tn_vnode != NULL);
2331 	KASSERT(tdnode->tn_vnode != NULL);
2332 	KASSERT((tnode == NULL) || (tnode->tn_vnode != NULL));
2333 	KASSERT(VOP_ISLOCKED(fdnode->tn_vnode) == LK_EXCLUSIVE);
2334 	KASSERT(VOP_ISLOCKED(fnode->tn_vnode) == LK_EXCLUSIVE);
2335 	KASSERT(VOP_ISLOCKED(tdnode->tn_vnode) == LK_EXCLUSIVE);
2336 	KASSERT((tnode == NULL) ||
2337 	    (VOP_ISLOCKED(tnode->tn_vnode) == LK_EXCLUSIVE));
2338 
2339 	/*
2340 	 * If fdnode is immutable, we can't write to it.  If fdnode is
2341 	 * append-only, the only change we can make is to add entries
2342 	 * to it.  If fnode is immutable, we can't change the links to
2343 	 * it.  If fnode is append-only...well, this is what UFS does.
2344 	 */
2345 	if ((fdnode->tn_flags | fnode->tn_flags) & (IMMUTABLE | APPEND))
2346 		return EPERM;
2347 
2348 	/*
2349 	 * If tdnode is immutable, we can't write to it.  If tdnode is
2350 	 * append-only, we can add entries, but we can't change
2351 	 * existing entries.
2352 	 */
2353 	if (tdnode->tn_flags & (IMMUTABLE | (tnode? APPEND : 0)))
2354 		return EPERM;
2355 
2356 	/*
2357 	 * If tnode is immutable, we can't replace links to it.  If
2358 	 * tnode is append-only...well, this is what UFS does.
2359 	 */
2360 	if (tnode != NULL) {
2361 		KASSERT(tnode != NULL);
2362 		if ((tnode->tn_flags & (IMMUTABLE | APPEND)) != 0)
2363 			return EPERM;
2364 	}
2365 
2366 	return 0;
2367 }
2368 
2369 /*
2370  * Check whether a rename is permitted given our credentials.
2371  *
2372  * Everything must be locked and referenced.
2373  */
2374 int
2375 tmpfs_rename_check_permitted(struct ucred *cred,
2376     struct tmpfs_node *fdnode, struct tmpfs_node *fnode,
2377     struct tmpfs_node *tdnode, struct tmpfs_node *tnode)
2378 {
2379 	int error;
2380 
2381 	KASSERT(fdnode != NULL);
2382 	KASSERT(fnode != NULL);
2383 	KASSERT(tdnode != NULL);
2384 	KASSERT(fdnode != fnode);
2385 	KASSERT(tdnode != tnode);
2386 	KASSERT(fnode != tnode);
2387 	KASSERT(fdnode->tn_vnode != NULL);
2388 	KASSERT(fnode->tn_vnode != NULL);
2389 	KASSERT(tdnode->tn_vnode != NULL);
2390 	KASSERT((tnode == NULL) || (tnode->tn_vnode != NULL));
2391 	KASSERT(VOP_ISLOCKED(fdnode->tn_vnode) == LK_EXCLUSIVE);
2392 	KASSERT(VOP_ISLOCKED(fnode->tn_vnode) == LK_EXCLUSIVE);
2393 	KASSERT(VOP_ISLOCKED(tdnode->tn_vnode) == LK_EXCLUSIVE);
2394 	KASSERT((tnode == NULL) ||
2395 	    (VOP_ISLOCKED(tnode->tn_vnode) == LK_EXCLUSIVE));
2396 
2397 	/*
2398 	 * We need to remove or change an entry in the source directory.
2399 	 */
2400 	error = VOP_ACCESS(fdnode->tn_vnode, VWRITE, cred, curproc);
2401 	if (error)
2402 		return error;
2403 
2404 	/*
2405 	 * If we are changing directories, then we need to write to the
2406 	 * target directory to add or change an entry.  Also, if fnode
2407 	 * is a directory, we need to write to it to change its `..'
2408 	 * entry.
2409 	 */
2410 	if (fdnode != tdnode) {
2411 		error = VOP_ACCESS(tdnode->tn_vnode, VWRITE, cred, curproc);
2412 		if (error)
2413 			return error;
2414 		if (fnode->tn_type == VDIR) {
2415 			error = VOP_ACCESS(fnode->tn_vnode, VWRITE, cred,
2416 			    curproc);
2417 			if (error)
2418 				return error;
2419 		}
2420 	}
2421 
2422 	error = tmpfs_check_sticky(cred, fdnode, fnode);
2423 	if (error)
2424 		return error;
2425 
2426 	if (TMPFS_DIRSEQ_FULL(tdnode))
2427 		return (ENOSPC);
2428 
2429 	error = tmpfs_check_sticky(cred, tdnode, tnode);
2430 	if (error)
2431 		return error;
2432 
2433 	return 0;
2434 }
2435 
2436 /*
2437  * Check whether removing node's entry in dnode is possible independent
2438  * of credentials.
2439  *
2440  * Everything must be locked and referenced.
2441  */
2442 int
2443 tmpfs_remove_check_possible(struct tmpfs_node *dnode, struct tmpfs_node *node)
2444 {
2445 
2446 	KASSERT(dnode != NULL);
2447 	KASSERT(dnode->tn_vnode != NULL);
2448 	KASSERT(node != NULL);
2449 	KASSERT(dnode != node);
2450 	KASSERT(VOP_ISLOCKED(dnode->tn_vnode) == LK_EXCLUSIVE);
2451 	KASSERT(VOP_ISLOCKED(node->tn_vnode) == LK_EXCLUSIVE);
2452 
2453 	/*
2454 	 * We want to delete the entry.  If dnode is immutable, we
2455 	 * can't write to it to delete the entry.  If dnode is
2456 	 * append-only, the only change we can make is to add entries,
2457 	 * so we can't delete entries.  If node is immutable, we can't
2458 	 * change the links to it, so we can't delete the entry.  If
2459 	 * node is append-only...well, this is what UFS does.
2460 	 */
2461 	if ((dnode->tn_flags | node->tn_flags) & (IMMUTABLE | APPEND))
2462 		return EPERM;
2463 
2464 	return 0;
2465 }
2466 
2467 /*
2468  * Check whether removing node's entry in dnode is permitted given our
2469  * credentials.
2470  *
2471  * Everything must be locked and referenced.
2472  */
2473 int
2474 tmpfs_remove_check_permitted(struct ucred *cred,
2475     struct tmpfs_node *dnode, struct tmpfs_node *node)
2476 {
2477 	int error;
2478 
2479 	KASSERT(dnode != NULL);
2480 	KASSERT(dnode->tn_vnode != NULL);
2481 	KASSERT(node != NULL);
2482 	KASSERT(dnode != node);
2483 	KASSERT(VOP_ISLOCKED(dnode->tn_vnode) == LK_EXCLUSIVE);
2484 	KASSERT(VOP_ISLOCKED(node->tn_vnode) == LK_EXCLUSIVE);
2485 
2486 	/*
2487 	 * Check whether we are permitted to write to the source
2488 	 * directory in order to delete an entry from it.
2489 	 */
2490 	error = VOP_ACCESS(dnode->tn_vnode, VWRITE, cred, curproc);
2491 	if (error)
2492 		return error;
2493 
2494 	error = tmpfs_check_sticky(cred, dnode, node);
2495 	if (error)
2496 		return error;
2497 
2498 	return 0;
2499 }
2500 
2501 /*
2502  * Check whether we may change an entry in a sticky directory.  If the
2503  * directory is sticky, the user must own either the directory or, if
2504  * it exists, the node, in order to change the entry.
2505  *
2506  * Everything must be locked and referenced.
2507  */
2508 int
2509 tmpfs_check_sticky(struct ucred *cred,
2510     struct tmpfs_node *dnode, struct tmpfs_node *node)
2511 {
2512 
2513 	KASSERT(dnode != NULL);
2514 	KASSERT(dnode->tn_vnode != NULL);
2515 	KASSERT(VOP_ISLOCKED(dnode->tn_vnode) == LK_EXCLUSIVE);
2516 	KASSERT((node == NULL) || (node->tn_vnode != NULL));
2517 	KASSERT((node == NULL) ||
2518 	    (VOP_ISLOCKED(dnode->tn_vnode) == LK_EXCLUSIVE));
2519 
2520 	if (node == NULL)
2521 		return 0;
2522 
2523 	if (dnode->tn_mode & S_ISTXT) {
2524 		if (cred->cr_uid != 0 &&
2525 		    cred->cr_uid != dnode->tn_uid &&
2526 		    cred->cr_uid != node->tn_uid)
2527 			return EPERM;
2528 	}
2529 
2530 	return 0;
2531 }
2532 
2533 void
2534 tmpfs_rename_cache_purge(struct vnode *fdvp, struct vnode *fvp,
2535     struct vnode *tdvp, struct vnode *tvp)
2536 {
2537 
2538 	KASSERT(fdvp != NULL);
2539 	KASSERT(fvp != NULL);
2540 	KASSERT(tdvp != NULL);
2541 	KASSERT(fdvp != fvp);
2542 	KASSERT(fdvp != tvp);
2543 	KASSERT(tdvp != fvp);
2544 	KASSERT(tdvp != tvp);
2545 	KASSERT(fvp != tvp);
2546 	KASSERT(fdvp->v_type == VDIR);
2547 	KASSERT(tdvp->v_type == VDIR);
2548 
2549 	/*
2550 	 * XXX What actually needs to be purged?
2551 	 */
2552 
2553 	cache_purge(fdvp);
2554 
2555 	if (fvp->v_type == VDIR)
2556 		cache_purge(fvp);
2557 
2558 	if (tdvp != fdvp)
2559 		cache_purge(tdvp);
2560 
2561 	if ((tvp != NULL) && (tvp->v_type == VDIR))
2562 		cache_purge(tvp);
2563 }
2564 
2565 void
2566 tmpfs_rename_abort(void *v)
2567 {
2568 	struct vop_rename_args *ap = v;
2569 	struct vnode *fdvp = ap->a_fdvp;
2570 	struct vnode *fvp = ap->a_fvp;
2571 	struct componentname *fcnp = ap->a_fcnp;
2572 	struct vnode *tdvp = ap->a_tdvp;
2573 	struct vnode *tvp = ap->a_tvp;
2574 	struct componentname *tcnp = ap->a_tcnp;
2575 
2576 	VOP_ABORTOP(tdvp, tcnp);
2577 	if (tdvp == tvp)
2578 		vrele(tdvp);
2579 	else
2580 		vput(tdvp);
2581 	if (tvp != NULL)
2582 		vput(tvp);
2583 	VOP_ABORTOP(fdvp, fcnp);
2584 	vrele(fdvp);
2585 	vrele(fvp);
2586 }
2587 
2588 void filt_tmpfsdetach(struct knote *kn);
2589 int filt_tmpfsread(struct knote *kn, long hint);
2590 int filt_tmpfswrite(struct knote *kn, long hint);
2591 int filt_tmpfsvnode(struct knote *kn, long hint);
2592 
2593 const struct filterops tmpfsread_filtops = {
2594 	.f_flags	= FILTEROP_ISFD,
2595 	.f_attach	= NULL,
2596 	.f_detach	= filt_tmpfsdetach,
2597 	.f_event	= filt_tmpfsread,
2598 };
2599 
2600 const struct filterops tmpfswrite_filtops = {
2601 	.f_flags	= FILTEROP_ISFD,
2602 	.f_attach	= NULL,
2603 	.f_detach	= filt_tmpfsdetach,
2604 	.f_event	= filt_tmpfswrite,
2605 };
2606 
2607 const struct filterops tmpfsvnode_filtops = {
2608 	.f_flags	= FILTEROP_ISFD,
2609 	.f_attach	= NULL,
2610 	.f_detach	= filt_tmpfsdetach,
2611 	.f_event	= filt_tmpfsvnode,
2612 };
2613 
2614 int
2615 tmpfs_kqfilter(void *v)
2616 {
2617 	struct vop_kqfilter_args *ap = v;
2618 	struct vnode *vp = ap->a_vp;
2619 	struct knote *kn = ap->a_kn;
2620 
2621 	switch (kn->kn_filter) {
2622 	case EVFILT_READ:
2623 		kn->kn_fop = &tmpfsread_filtops;
2624 		break;
2625 	case EVFILT_WRITE:
2626 		kn->kn_fop = &tmpfswrite_filtops;
2627 		break;
2628 	case EVFILT_VNODE:
2629 		kn->kn_fop = &tmpfsvnode_filtops;
2630 		break;
2631 	default:
2632 		return (EINVAL);
2633 	}
2634 
2635 	kn->kn_hook = (caddr_t)vp;
2636 
2637 	klist_insert_locked(&vp->v_selectinfo.si_note, kn);
2638 
2639 	return (0);
2640 }
2641 
2642 void
2643 filt_tmpfsdetach(struct knote *kn)
2644 {
2645 	struct vnode *vp = (struct vnode *)kn->kn_hook;
2646 
2647 	klist_remove_locked(&vp->v_selectinfo.si_note, kn);
2648 }
2649 
2650 int
2651 filt_tmpfsread(struct knote *kn, long hint)
2652 {
2653 	struct vnode *vp = (struct vnode *)kn->kn_hook;
2654 	tmpfs_node_t *node = VP_TO_TMPFS_NODE(vp);
2655 
2656 	/*
2657 	 * filesystem is gone, so set the EOF flag and schedule
2658 	 * the knote for deletion.
2659 	 */
2660 	if (hint == NOTE_REVOKE) {
2661 		kn->kn_flags |= (EV_EOF | EV_ONESHOT);
2662 		return (1);
2663 	}
2664 
2665 	kn->kn_data = node->tn_size - foffset(kn->kn_fp);
2666 	if (kn->kn_data == 0 && kn->kn_sfflags & NOTE_EOF) {
2667 		kn->kn_fflags |= NOTE_EOF;
2668 		return (1);
2669 	}
2670 
2671 	if (kn->kn_flags & __EV_POLL)
2672 		return (1);
2673 
2674 	return (kn->kn_data != 0);
2675 }
2676 
2677 int
2678 filt_tmpfswrite(struct knote *kn, long hint)
2679 {
2680 	/*
2681 	 * filesystem is gone, so set the EOF flag and schedule
2682 	 * the knote for deletion.
2683 	 */
2684 	if (hint == NOTE_REVOKE) {
2685 		kn->kn_flags |= (EV_EOF | EV_ONESHOT);
2686 		return (1);
2687 	}
2688 
2689 	kn->kn_data = 0;
2690 	return (1);
2691 }
2692 
2693 int
2694 filt_tmpfsvnode(struct knote *kn, long hint)
2695 {
2696 	if (kn->kn_sfflags & hint)
2697 		kn->kn_fflags |= hint;
2698 	if (hint == NOTE_REVOKE) {
2699 		kn->kn_flags |= EV_EOF;
2700 		return (1);
2701 	}
2702 	return (kn->kn_fflags != 0);
2703 }
2704