xref: /freebsd/sys/fs/tmpfs/tmpfs_vnops.c (revision 9768746b)
1 /*	$NetBSD: tmpfs_vnops.c,v 1.39 2007/07/23 15:41:01 jmmv Exp $	*/
2 
3 /*-
4  * SPDX-License-Identifier: BSD-2-Clause-NetBSD
5  *
6  * Copyright (c) 2005, 2006 The NetBSD Foundation, Inc.
7  * All rights reserved.
8  *
9  * This code is derived from software contributed to The NetBSD Foundation
10  * by Julio M. Merino Vidal, developed as part of Google's Summer of Code
11  * 2005 program.
12  *
13  * Redistribution and use in source and binary forms, with or without
14  * modification, are permitted provided that the following conditions
15  * are met:
16  * 1. Redistributions of source code must retain the above copyright
17  *    notice, this list of conditions and the following disclaimer.
18  * 2. Redistributions in binary form must reproduce the above copyright
19  *    notice, this list of conditions and the following disclaimer in the
20  *    documentation and/or other materials provided with the distribution.
21  *
22  * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
23  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
24  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
25  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
26  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
27  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
28  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
29  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
30  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
31  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
32  * POSSIBILITY OF SUCH DAMAGE.
33  */
34 
35 /*
36  * tmpfs vnode interface.
37  */
38 #include <sys/cdefs.h>
39 __FBSDID("$FreeBSD$");
40 
41 #include <sys/param.h>
42 #include <sys/systm.h>
43 #include <sys/dirent.h>
44 #include <sys/extattr.h>
45 #include <sys/fcntl.h>
46 #include <sys/file.h>
47 #include <sys/filio.h>
48 #include <sys/limits.h>
49 #include <sys/lockf.h>
50 #include <sys/lock.h>
51 #include <sys/mount.h>
52 #include <sys/namei.h>
53 #include <sys/priv.h>
54 #include <sys/proc.h>
55 #include <sys/rwlock.h>
56 #include <sys/sched.h>
57 #include <sys/smr.h>
58 #include <sys/stat.h>
59 #include <sys/sysctl.h>
60 #include <sys/unistd.h>
61 #include <sys/vnode.h>
62 #include <security/audit/audit.h>
63 #include <security/mac/mac_framework.h>
64 
65 #include <vm/vm.h>
66 #include <vm/vm_param.h>
67 #include <vm/vm_object.h>
68 #include <vm/vm_page.h>
69 #include <vm/vm_pager.h>
70 #include <vm/swap_pager.h>
71 
72 #include <fs/tmpfs/tmpfs_vnops.h>
73 #include <fs/tmpfs/tmpfs.h>
74 
75 SYSCTL_DECL(_vfs_tmpfs);
76 VFS_SMR_DECLARE;
77 
78 static volatile int tmpfs_rename_restarts;
79 SYSCTL_INT(_vfs_tmpfs, OID_AUTO, rename_restarts, CTLFLAG_RD,
80     __DEVOLATILE(int *, &tmpfs_rename_restarts), 0,
81     "Times rename had to restart due to lock contention");
82 
83 MALLOC_DEFINE(M_TMPFSEA, "tmpfs extattr", "tmpfs extattr structure");
84 
85 static int
86 tmpfs_vn_get_ino_alloc(struct mount *mp, void *arg, int lkflags,
87     struct vnode **rvp)
88 {
89 
90 	return (tmpfs_alloc_vp(mp, arg, lkflags, rvp));
91 }
92 
93 static int
94 tmpfs_lookup1(struct vnode *dvp, struct vnode **vpp, struct componentname *cnp)
95 {
96 	struct tmpfs_dirent *de;
97 	struct tmpfs_node *dnode, *pnode;
98 	struct tmpfs_mount *tm;
99 	int error;
100 
101 	/* Caller assumes responsibility for ensuring access (VEXEC). */
102 	dnode = VP_TO_TMPFS_DIR(dvp);
103 	*vpp = NULLVP;
104 
105 	/* We cannot be requesting the parent directory of the root node. */
106 	MPASS(IMPLIES(dnode->tn_type == VDIR &&
107 	    dnode->tn_dir.tn_parent == dnode,
108 	    !(cnp->cn_flags & ISDOTDOT)));
109 
110 	TMPFS_ASSERT_LOCKED(dnode);
111 	if (dnode->tn_dir.tn_parent == NULL) {
112 		error = ENOENT;
113 		goto out;
114 	}
115 	if (cnp->cn_flags & ISDOTDOT) {
116 		tm = VFS_TO_TMPFS(dvp->v_mount);
117 		pnode = dnode->tn_dir.tn_parent;
118 		tmpfs_ref_node(pnode);
119 		error = vn_vget_ino_gen(dvp, tmpfs_vn_get_ino_alloc,
120 		    pnode, cnp->cn_lkflags, vpp);
121 		tmpfs_free_node(tm, pnode);
122 		if (error != 0)
123 			goto out;
124 	} else if (cnp->cn_namelen == 1 && cnp->cn_nameptr[0] == '.') {
125 		VREF(dvp);
126 		*vpp = dvp;
127 		error = 0;
128 	} else {
129 		de = tmpfs_dir_lookup(dnode, NULL, cnp);
130 		if (de != NULL && de->td_node == NULL)
131 			cnp->cn_flags |= ISWHITEOUT;
132 		if (de == NULL || de->td_node == NULL) {
133 			/*
134 			 * The entry was not found in the directory.
135 			 * This is OK if we are creating or renaming an
136 			 * entry and are working on the last component of
137 			 * the path name.
138 			 */
139 			if ((cnp->cn_flags & ISLASTCN) &&
140 			    (cnp->cn_nameiop == CREATE || \
141 			    cnp->cn_nameiop == RENAME ||
142 			    (cnp->cn_nameiop == DELETE &&
143 			    cnp->cn_flags & DOWHITEOUT &&
144 			    cnp->cn_flags & ISWHITEOUT))) {
145 				error = VOP_ACCESS(dvp, VWRITE, cnp->cn_cred,
146 				    curthread);
147 				if (error != 0)
148 					goto out;
149 
150 				error = EJUSTRETURN;
151 			} else
152 				error = ENOENT;
153 		} else {
154 			struct tmpfs_node *tnode;
155 
156 			/*
157 			 * The entry was found, so get its associated
158 			 * tmpfs_node.
159 			 */
160 			tnode = de->td_node;
161 
162 			/*
163 			 * If we are not at the last path component and
164 			 * found a non-directory or non-link entry (which
165 			 * may itself be pointing to a directory), raise
166 			 * an error.
167 			 */
168 			if ((tnode->tn_type != VDIR &&
169 			    tnode->tn_type != VLNK) &&
170 			    !(cnp->cn_flags & ISLASTCN)) {
171 				error = ENOTDIR;
172 				goto out;
173 			}
174 
175 			/*
176 			 * If we are deleting or renaming the entry, keep
177 			 * track of its tmpfs_dirent so that it can be
178 			 * easily deleted later.
179 			 */
180 			if ((cnp->cn_flags & ISLASTCN) &&
181 			    (cnp->cn_nameiop == DELETE ||
182 			    cnp->cn_nameiop == RENAME)) {
183 				error = VOP_ACCESS(dvp, VWRITE, cnp->cn_cred,
184 				    curthread);
185 				if (error != 0)
186 					goto out;
187 
188 				/* Allocate a new vnode on the matching entry. */
189 				error = tmpfs_alloc_vp(dvp->v_mount, tnode,
190 				    cnp->cn_lkflags, vpp);
191 				if (error != 0)
192 					goto out;
193 
194 				if ((dnode->tn_mode & S_ISTXT) &&
195 				  VOP_ACCESS(dvp, VADMIN, cnp->cn_cred,
196 				  curthread) && VOP_ACCESS(*vpp, VADMIN,
197 				  cnp->cn_cred, curthread)) {
198 					error = EPERM;
199 					vput(*vpp);
200 					*vpp = NULL;
201 					goto out;
202 				}
203 			} else {
204 				error = tmpfs_alloc_vp(dvp->v_mount, tnode,
205 				    cnp->cn_lkflags, vpp);
206 				if (error != 0)
207 					goto out;
208 			}
209 		}
210 	}
211 
212 	/*
213 	 * Store the result of this lookup in the cache.  Avoid this if the
214 	 * request was for creation, as it does not improve timings on
215 	 * emprical tests.
216 	 */
217 	if ((cnp->cn_flags & MAKEENTRY) != 0 && tmpfs_use_nc(dvp))
218 		cache_enter(dvp, *vpp, cnp);
219 
220 out:
221 	/*
222 	 * If there were no errors, *vpp cannot be null and it must be
223 	 * locked.
224 	 */
225 	MPASS(IFF(error == 0, *vpp != NULLVP && VOP_ISLOCKED(*vpp)));
226 
227 	return (error);
228 }
229 
230 static int
231 tmpfs_cached_lookup(struct vop_cachedlookup_args *v)
232 {
233 
234 	return (tmpfs_lookup1(v->a_dvp, v->a_vpp, v->a_cnp));
235 }
236 
237 static int
238 tmpfs_lookup(struct vop_lookup_args *v)
239 {
240 	struct vnode *dvp = v->a_dvp;
241 	struct vnode **vpp = v->a_vpp;
242 	struct componentname *cnp = v->a_cnp;
243 	int error;
244 
245 	/* Check accessibility of requested node as a first step. */
246 	error = vn_dir_check_exec(dvp, cnp);
247 	if (error != 0)
248 		return (error);
249 
250 	return (tmpfs_lookup1(dvp, vpp, cnp));
251 }
252 
253 static int
254 tmpfs_create(struct vop_create_args *v)
255 {
256 	struct vnode *dvp = v->a_dvp;
257 	struct vnode **vpp = v->a_vpp;
258 	struct componentname *cnp = v->a_cnp;
259 	struct vattr *vap = v->a_vap;
260 	int error;
261 
262 	MPASS(vap->va_type == VREG || vap->va_type == VSOCK);
263 
264 	error = tmpfs_alloc_file(dvp, vpp, vap, cnp, NULL);
265 	if (error == 0 && (cnp->cn_flags & MAKEENTRY) != 0 && tmpfs_use_nc(dvp))
266 		cache_enter(dvp, *vpp, cnp);
267 	return (error);
268 }
269 
270 static int
271 tmpfs_mknod(struct vop_mknod_args *v)
272 {
273 	struct vnode *dvp = v->a_dvp;
274 	struct vnode **vpp = v->a_vpp;
275 	struct componentname *cnp = v->a_cnp;
276 	struct vattr *vap = v->a_vap;
277 
278 	if (vap->va_type != VBLK && vap->va_type != VCHR &&
279 	    vap->va_type != VFIFO)
280 		return (EINVAL);
281 
282 	return (tmpfs_alloc_file(dvp, vpp, vap, cnp, NULL));
283 }
284 
285 struct fileops tmpfs_fnops;
286 
287 static int
288 tmpfs_open(struct vop_open_args *v)
289 {
290 	struct vnode *vp;
291 	struct tmpfs_node *node;
292 	struct file *fp;
293 	int error, mode;
294 
295 	vp = v->a_vp;
296 	mode = v->a_mode;
297 	node = VP_TO_TMPFS_NODE(vp);
298 
299 	/*
300 	 * The file is still active but all its names have been removed
301 	 * (e.g. by a "rmdir $(pwd)").  It cannot be opened any more as
302 	 * it is about to die.
303 	 */
304 	if (node->tn_links < 1)
305 		return (ENOENT);
306 
307 	/* If the file is marked append-only, deny write requests. */
308 	if (node->tn_flags & APPEND && (mode & (FWRITE | O_APPEND)) == FWRITE)
309 		error = EPERM;
310 	else {
311 		error = 0;
312 		/* For regular files, the call below is nop. */
313 		KASSERT(vp->v_type != VREG || (node->tn_reg.tn_aobj->flags &
314 		    OBJ_DEAD) == 0, ("dead object"));
315 		vnode_create_vobject(vp, node->tn_size, v->a_td);
316 	}
317 
318 	fp = v->a_fp;
319 	MPASS(fp == NULL || fp->f_data == NULL);
320 	if (error == 0 && fp != NULL && vp->v_type == VREG) {
321 		tmpfs_ref_node(node);
322 		finit_vnode(fp, mode, node, &tmpfs_fnops);
323 	}
324 
325 	return (error);
326 }
327 
328 static int
329 tmpfs_close(struct vop_close_args *v)
330 {
331 	struct vnode *vp = v->a_vp;
332 
333 	/* Update node times. */
334 	tmpfs_update(vp);
335 
336 	return (0);
337 }
338 
339 int
340 tmpfs_fo_close(struct file *fp, struct thread *td)
341 {
342 	struct tmpfs_node *node;
343 
344 	node = fp->f_data;
345 	if (node != NULL) {
346 		MPASS(node->tn_type == VREG);
347 		tmpfs_free_node(node->tn_reg.tn_tmp, node);
348 	}
349 	return (vnops.fo_close(fp, td));
350 }
351 
352 /*
353  * VOP_FPLOOKUP_VEXEC routines are subject to special circumstances, see
354  * the comment above cache_fplookup for details.
355  */
356 int
357 tmpfs_fplookup_vexec(struct vop_fplookup_vexec_args *v)
358 {
359 	struct vnode *vp;
360 	struct tmpfs_node *node;
361 	struct ucred *cred;
362 	mode_t all_x, mode;
363 
364 	vp = v->a_vp;
365 	node = VP_TO_TMPFS_NODE_SMR(vp);
366 	if (__predict_false(node == NULL))
367 		return (EAGAIN);
368 
369 	all_x = S_IXUSR | S_IXGRP | S_IXOTH;
370 	mode = atomic_load_short(&node->tn_mode);
371 	if (__predict_true((mode & all_x) == all_x))
372 		return (0);
373 
374 	cred = v->a_cred;
375 	return (vaccess_vexec_smr(mode, node->tn_uid, node->tn_gid, cred));
376 }
377 
378 int
379 tmpfs_access(struct vop_access_args *v)
380 {
381 	struct vnode *vp = v->a_vp;
382 	accmode_t accmode = v->a_accmode;
383 	struct ucred *cred = v->a_cred;
384 	mode_t all_x = S_IXUSR | S_IXGRP | S_IXOTH;
385 	int error;
386 	struct tmpfs_node *node;
387 
388 	MPASS(VOP_ISLOCKED(vp));
389 
390 	node = VP_TO_TMPFS_NODE(vp);
391 
392 	/*
393 	 * Common case path lookup.
394 	 */
395 	if (__predict_true(accmode == VEXEC && (node->tn_mode & all_x) == all_x))
396 		return (0);
397 
398 	switch (vp->v_type) {
399 	case VDIR:
400 		/* FALLTHROUGH */
401 	case VLNK:
402 		/* FALLTHROUGH */
403 	case VREG:
404 		if (accmode & VWRITE && vp->v_mount->mnt_flag & MNT_RDONLY) {
405 			error = EROFS;
406 			goto out;
407 		}
408 		break;
409 
410 	case VBLK:
411 		/* FALLTHROUGH */
412 	case VCHR:
413 		/* FALLTHROUGH */
414 	case VSOCK:
415 		/* FALLTHROUGH */
416 	case VFIFO:
417 		break;
418 
419 	default:
420 		error = EINVAL;
421 		goto out;
422 	}
423 
424 	if (accmode & VWRITE && node->tn_flags & IMMUTABLE) {
425 		error = EPERM;
426 		goto out;
427 	}
428 
429 	error = vaccess(vp->v_type, node->tn_mode, node->tn_uid, node->tn_gid,
430 	    accmode, cred);
431 
432 out:
433 	MPASS(VOP_ISLOCKED(vp));
434 
435 	return (error);
436 }
437 
438 int
439 tmpfs_stat(struct vop_stat_args *v)
440 {
441 	struct vnode *vp = v->a_vp;
442 	struct stat *sb = v->a_sb;
443 	struct tmpfs_node *node;
444 	int error;
445 
446 	node = VP_TO_TMPFS_NODE(vp);
447 
448 	tmpfs_update_getattr(vp);
449 
450 	error = vop_stat_helper_pre(v);
451 	if (__predict_false(error))
452 		return (error);
453 
454 	sb->st_dev = vp->v_mount->mnt_stat.f_fsid.val[0];
455 	sb->st_ino = node->tn_id;
456 	sb->st_mode = node->tn_mode | VTTOIF(vp->v_type);
457 	sb->st_nlink = node->tn_links;
458 	sb->st_uid = node->tn_uid;
459 	sb->st_gid = node->tn_gid;
460 	sb->st_rdev = (vp->v_type == VBLK || vp->v_type == VCHR) ?
461 		node->tn_rdev : NODEV;
462 	sb->st_size = node->tn_size;
463 	sb->st_atim.tv_sec = node->tn_atime.tv_sec;
464 	sb->st_atim.tv_nsec = node->tn_atime.tv_nsec;
465 	sb->st_mtim.tv_sec = node->tn_mtime.tv_sec;
466 	sb->st_mtim.tv_nsec = node->tn_mtime.tv_nsec;
467 	sb->st_ctim.tv_sec = node->tn_ctime.tv_sec;
468 	sb->st_ctim.tv_nsec = node->tn_ctime.tv_nsec;
469 	sb->st_birthtim.tv_sec = node->tn_birthtime.tv_sec;
470 	sb->st_birthtim.tv_nsec = node->tn_birthtime.tv_nsec;
471 	sb->st_blksize = PAGE_SIZE;
472 	sb->st_flags = node->tn_flags;
473 	sb->st_gen = node->tn_gen;
474 	if (vp->v_type == VREG) {
475 #ifdef __ILP32__
476 		vm_object_t obj = node->tn_reg.tn_aobj;
477 
478 		/* Handle torn read */
479 		VM_OBJECT_RLOCK(obj);
480 #endif
481 		sb->st_blocks = ptoa(node->tn_reg.tn_pages);
482 #ifdef __ILP32__
483 		VM_OBJECT_RUNLOCK(obj);
484 #endif
485 	} else {
486 		sb->st_blocks = node->tn_size;
487 	}
488 	sb->st_blocks /= S_BLKSIZE;
489 	return (vop_stat_helper_post(v, error));
490 }
491 
492 int
493 tmpfs_getattr(struct vop_getattr_args *v)
494 {
495 	struct vnode *vp = v->a_vp;
496 	struct vattr *vap = v->a_vap;
497 	struct tmpfs_node *node;
498 
499 	node = VP_TO_TMPFS_NODE(vp);
500 
501 	tmpfs_update_getattr(vp);
502 
503 	vap->va_type = vp->v_type;
504 	vap->va_mode = node->tn_mode;
505 	vap->va_nlink = node->tn_links;
506 	vap->va_uid = node->tn_uid;
507 	vap->va_gid = node->tn_gid;
508 	vap->va_fsid = vp->v_mount->mnt_stat.f_fsid.val[0];
509 	vap->va_fileid = node->tn_id;
510 	vap->va_size = node->tn_size;
511 	vap->va_blocksize = PAGE_SIZE;
512 	vap->va_atime = node->tn_atime;
513 	vap->va_mtime = node->tn_mtime;
514 	vap->va_ctime = node->tn_ctime;
515 	vap->va_birthtime = node->tn_birthtime;
516 	vap->va_gen = node->tn_gen;
517 	vap->va_flags = node->tn_flags;
518 	vap->va_rdev = (vp->v_type == VBLK || vp->v_type == VCHR) ?
519 	    node->tn_rdev : NODEV;
520 	if (vp->v_type == VREG) {
521 #ifdef __ILP32__
522 		vm_object_t obj = node->tn_reg.tn_aobj;
523 
524 		VM_OBJECT_RLOCK(obj);
525 #endif
526 		vap->va_bytes = ptoa(node->tn_reg.tn_pages);
527 #ifdef __ILP32__
528 		VM_OBJECT_RUNLOCK(obj);
529 #endif
530 	} else {
531 		vap->va_bytes = node->tn_size;
532 	}
533 	vap->va_filerev = 0;
534 
535 	return (0);
536 }
537 
538 int
539 tmpfs_setattr(struct vop_setattr_args *v)
540 {
541 	struct vnode *vp = v->a_vp;
542 	struct vattr *vap = v->a_vap;
543 	struct ucred *cred = v->a_cred;
544 	struct thread *td = curthread;
545 
546 	int error;
547 
548 	MPASS(VOP_ISLOCKED(vp));
549 	ASSERT_VOP_IN_SEQC(vp);
550 
551 	error = 0;
552 
553 	/* Abort if any unsettable attribute is given. */
554 	if (vap->va_type != VNON ||
555 	    vap->va_nlink != VNOVAL ||
556 	    vap->va_fsid != VNOVAL ||
557 	    vap->va_fileid != VNOVAL ||
558 	    vap->va_blocksize != VNOVAL ||
559 	    vap->va_gen != VNOVAL ||
560 	    vap->va_rdev != VNOVAL ||
561 	    vap->va_bytes != VNOVAL)
562 		error = EINVAL;
563 
564 	if (error == 0 && (vap->va_flags != VNOVAL))
565 		error = tmpfs_chflags(vp, vap->va_flags, cred, td);
566 
567 	if (error == 0 && (vap->va_size != VNOVAL))
568 		error = tmpfs_chsize(vp, vap->va_size, cred, td);
569 
570 	if (error == 0 && (vap->va_uid != VNOVAL || vap->va_gid != VNOVAL))
571 		error = tmpfs_chown(vp, vap->va_uid, vap->va_gid, cred, td);
572 
573 	if (error == 0 && (vap->va_mode != (mode_t)VNOVAL))
574 		error = tmpfs_chmod(vp, vap->va_mode, cred, td);
575 
576 	if (error == 0 && ((vap->va_atime.tv_sec != VNOVAL &&
577 	    vap->va_atime.tv_nsec != VNOVAL) ||
578 	    (vap->va_mtime.tv_sec != VNOVAL &&
579 	    vap->va_mtime.tv_nsec != VNOVAL) ||
580 	    (vap->va_birthtime.tv_sec != VNOVAL &&
581 	    vap->va_birthtime.tv_nsec != VNOVAL)))
582 		error = tmpfs_chtimes(vp, vap, cred, td);
583 
584 	/*
585 	 * Update the node times.  We give preference to the error codes
586 	 * generated by this function rather than the ones that may arise
587 	 * from tmpfs_update.
588 	 */
589 	tmpfs_update(vp);
590 
591 	MPASS(VOP_ISLOCKED(vp));
592 
593 	return (error);
594 }
595 
596 static int
597 tmpfs_read(struct vop_read_args *v)
598 {
599 	struct vnode *vp;
600 	struct uio *uio;
601 	struct tmpfs_node *node;
602 
603 	vp = v->a_vp;
604 	if (vp->v_type != VREG)
605 		return (EISDIR);
606 	uio = v->a_uio;
607 	if (uio->uio_offset < 0)
608 		return (EINVAL);
609 	node = VP_TO_TMPFS_NODE(vp);
610 	tmpfs_set_accessed(VFS_TO_TMPFS(vp->v_mount), node);
611 	return (uiomove_object(node->tn_reg.tn_aobj, node->tn_size, uio));
612 }
613 
614 static int
615 tmpfs_read_pgcache(struct vop_read_pgcache_args *v)
616 {
617 	struct vnode *vp;
618 	struct tmpfs_node *node;
619 	vm_object_t object;
620 	off_t size;
621 	int error;
622 
623 	vp = v->a_vp;
624 	VNPASS((vn_irflag_read(vp) & VIRF_PGREAD) != 0, vp);
625 
626 	if (v->a_uio->uio_offset < 0)
627 		return (EINVAL);
628 
629 	error = EJUSTRETURN;
630 	vfs_smr_enter();
631 
632 	node = VP_TO_TMPFS_NODE_SMR(vp);
633 	if (node == NULL)
634 		goto out_smr;
635 	MPASS(node->tn_type == VREG);
636 	MPASS(node->tn_refcount >= 1);
637 	object = node->tn_reg.tn_aobj;
638 	if (object == NULL)
639 		goto out_smr;
640 
641 	MPASS(object->type == tmpfs_pager_type);
642 	MPASS((object->flags & (OBJ_ANON | OBJ_DEAD | OBJ_SWAP)) ==
643 	    OBJ_SWAP);
644 	if (!VN_IS_DOOMED(vp)) {
645 		/* size cannot become shorter due to rangelock. */
646 		size = node->tn_size;
647 		tmpfs_set_accessed(node->tn_reg.tn_tmp, node);
648 		vfs_smr_exit();
649 		error = uiomove_object(object, size, v->a_uio);
650 		return (error);
651 	}
652 out_smr:
653 	vfs_smr_exit();
654 	return (error);
655 }
656 
657 static int
658 tmpfs_write(struct vop_write_args *v)
659 {
660 	struct vnode *vp;
661 	struct uio *uio;
662 	struct tmpfs_node *node;
663 	off_t oldsize;
664 	ssize_t r;
665 	int error, ioflag;
666 	mode_t newmode;
667 
668 	vp = v->a_vp;
669 	uio = v->a_uio;
670 	ioflag = v->a_ioflag;
671 	error = 0;
672 	node = VP_TO_TMPFS_NODE(vp);
673 	oldsize = node->tn_size;
674 
675 	if (uio->uio_offset < 0 || vp->v_type != VREG)
676 		return (EINVAL);
677 	if (uio->uio_resid == 0)
678 		return (0);
679 	if (ioflag & IO_APPEND)
680 		uio->uio_offset = node->tn_size;
681 	error = vn_rlimit_fsizex(vp, uio, VFS_TO_TMPFS(vp->v_mount)->
682 	    tm_maxfilesize, &r, uio->uio_td);
683 	if (error != 0) {
684 		vn_rlimit_fsizex_res(uio, r);
685 		return (error);
686 	}
687 
688 	if (uio->uio_offset + uio->uio_resid > node->tn_size) {
689 		error = tmpfs_reg_resize(vp, uio->uio_offset + uio->uio_resid,
690 		    FALSE);
691 		if (error != 0)
692 			goto out;
693 	}
694 
695 	error = uiomove_object(node->tn_reg.tn_aobj, node->tn_size, uio);
696 	node->tn_status |= TMPFS_NODE_MODIFIED | TMPFS_NODE_CHANGED;
697 	node->tn_accessed = true;
698 	if (node->tn_mode & (S_ISUID | S_ISGID)) {
699 		if (priv_check_cred(v->a_cred, PRIV_VFS_RETAINSUGID)) {
700 			newmode = node->tn_mode & ~(S_ISUID | S_ISGID);
701 			vn_seqc_write_begin(vp);
702 			atomic_store_short(&node->tn_mode, newmode);
703 			vn_seqc_write_end(vp);
704 		}
705 	}
706 	if (error != 0)
707 		(void)tmpfs_reg_resize(vp, oldsize, TRUE);
708 
709 out:
710 	MPASS(IMPLIES(error == 0, uio->uio_resid == 0));
711 	MPASS(IMPLIES(error != 0, oldsize == node->tn_size));
712 
713 	vn_rlimit_fsizex_res(uio, r);
714 	return (error);
715 }
716 
717 static int
718 tmpfs_deallocate(struct vop_deallocate_args *v)
719 {
720 	return (tmpfs_reg_punch_hole(v->a_vp, v->a_offset, v->a_len));
721 }
722 
723 static int
724 tmpfs_fsync(struct vop_fsync_args *v)
725 {
726 	struct vnode *vp = v->a_vp;
727 
728 	MPASS(VOP_ISLOCKED(vp));
729 
730 	tmpfs_check_mtime(vp);
731 	tmpfs_update(vp);
732 
733 	return (0);
734 }
735 
736 static int
737 tmpfs_remove(struct vop_remove_args *v)
738 {
739 	struct vnode *dvp = v->a_dvp;
740 	struct vnode *vp = v->a_vp;
741 
742 	int error;
743 	struct tmpfs_dirent *de;
744 	struct tmpfs_mount *tmp;
745 	struct tmpfs_node *dnode;
746 	struct tmpfs_node *node;
747 
748 	MPASS(VOP_ISLOCKED(dvp));
749 	MPASS(VOP_ISLOCKED(vp));
750 
751 	if (vp->v_type == VDIR) {
752 		error = EISDIR;
753 		goto out;
754 	}
755 
756 	dnode = VP_TO_TMPFS_DIR(dvp);
757 	node = VP_TO_TMPFS_NODE(vp);
758 	tmp = VFS_TO_TMPFS(vp->v_mount);
759 	de = tmpfs_dir_lookup(dnode, node, v->a_cnp);
760 	MPASS(de != NULL);
761 
762 	/* Files marked as immutable or append-only cannot be deleted. */
763 	if ((node->tn_flags & (IMMUTABLE | APPEND | NOUNLINK)) ||
764 	    (dnode->tn_flags & APPEND)) {
765 		error = EPERM;
766 		goto out;
767 	}
768 
769 	/* Remove the entry from the directory; as it is a file, we do not
770 	 * have to change the number of hard links of the directory. */
771 	tmpfs_dir_detach(dvp, de);
772 	if (v->a_cnp->cn_flags & DOWHITEOUT)
773 		tmpfs_dir_whiteout_add(dvp, v->a_cnp);
774 
775 	/* Free the directory entry we just deleted.  Note that the node
776 	 * referred by it will not be removed until the vnode is really
777 	 * reclaimed. */
778 	tmpfs_free_dirent(tmp, de);
779 
780 	node->tn_status |= TMPFS_NODE_CHANGED;
781 	node->tn_accessed = true;
782 	error = 0;
783 
784 out:
785 	return (error);
786 }
787 
788 static int
789 tmpfs_link(struct vop_link_args *v)
790 {
791 	struct vnode *dvp = v->a_tdvp;
792 	struct vnode *vp = v->a_vp;
793 	struct componentname *cnp = v->a_cnp;
794 
795 	int error;
796 	struct tmpfs_dirent *de;
797 	struct tmpfs_node *node;
798 
799 	MPASS(VOP_ISLOCKED(dvp));
800 	MPASS(dvp != vp); /* XXX When can this be false? */
801 	node = VP_TO_TMPFS_NODE(vp);
802 
803 	/* Ensure that we do not overflow the maximum number of links imposed
804 	 * by the system. */
805 	MPASS(node->tn_links <= TMPFS_LINK_MAX);
806 	if (node->tn_links == TMPFS_LINK_MAX) {
807 		error = EMLINK;
808 		goto out;
809 	}
810 
811 	/* We cannot create links of files marked immutable or append-only. */
812 	if (node->tn_flags & (IMMUTABLE | APPEND)) {
813 		error = EPERM;
814 		goto out;
815 	}
816 
817 	/* Allocate a new directory entry to represent the node. */
818 	error = tmpfs_alloc_dirent(VFS_TO_TMPFS(vp->v_mount), node,
819 	    cnp->cn_nameptr, cnp->cn_namelen, &de);
820 	if (error != 0)
821 		goto out;
822 
823 	/* Insert the new directory entry into the appropriate directory. */
824 	if (cnp->cn_flags & ISWHITEOUT)
825 		tmpfs_dir_whiteout_remove(dvp, cnp);
826 	tmpfs_dir_attach(dvp, de);
827 
828 	/* vp link count has changed, so update node times. */
829 	node->tn_status |= TMPFS_NODE_CHANGED;
830 	tmpfs_update(vp);
831 
832 	error = 0;
833 
834 out:
835 	return (error);
836 }
837 
838 /*
839  * We acquire all but fdvp locks using non-blocking acquisitions.  If we
840  * fail to acquire any lock in the path we will drop all held locks,
841  * acquire the new lock in a blocking fashion, and then release it and
842  * restart the rename.  This acquire/release step ensures that we do not
843  * spin on a lock waiting for release.  On error release all vnode locks
844  * and decrement references the way tmpfs_rename() would do.
845  */
846 static int
847 tmpfs_rename_relock(struct vnode *fdvp, struct vnode **fvpp,
848     struct vnode *tdvp, struct vnode **tvpp,
849     struct componentname *fcnp, struct componentname *tcnp)
850 {
851 	struct vnode *nvp;
852 	struct mount *mp;
853 	struct tmpfs_dirent *de;
854 	int error, restarts = 0;
855 
856 	VOP_UNLOCK(tdvp);
857 	if (*tvpp != NULL && *tvpp != tdvp)
858 		VOP_UNLOCK(*tvpp);
859 	mp = fdvp->v_mount;
860 
861 relock:
862 	restarts += 1;
863 	error = vn_lock(fdvp, LK_EXCLUSIVE);
864 	if (error)
865 		goto releout;
866 	if (vn_lock(tdvp, LK_EXCLUSIVE | LK_NOWAIT) != 0) {
867 		VOP_UNLOCK(fdvp);
868 		error = vn_lock(tdvp, LK_EXCLUSIVE);
869 		if (error)
870 			goto releout;
871 		VOP_UNLOCK(tdvp);
872 		goto relock;
873 	}
874 	/*
875 	 * Re-resolve fvp to be certain it still exists and fetch the
876 	 * correct vnode.
877 	 */
878 	de = tmpfs_dir_lookup(VP_TO_TMPFS_DIR(fdvp), NULL, fcnp);
879 	if (de == NULL) {
880 		VOP_UNLOCK(fdvp);
881 		VOP_UNLOCK(tdvp);
882 		if ((fcnp->cn_flags & ISDOTDOT) != 0 ||
883 		    (fcnp->cn_namelen == 1 && fcnp->cn_nameptr[0] == '.'))
884 			error = EINVAL;
885 		else
886 			error = ENOENT;
887 		goto releout;
888 	}
889 	error = tmpfs_alloc_vp(mp, de->td_node, LK_EXCLUSIVE | LK_NOWAIT, &nvp);
890 	if (error != 0) {
891 		VOP_UNLOCK(fdvp);
892 		VOP_UNLOCK(tdvp);
893 		if (error != EBUSY)
894 			goto releout;
895 		error = tmpfs_alloc_vp(mp, de->td_node, LK_EXCLUSIVE, &nvp);
896 		if (error != 0)
897 			goto releout;
898 		VOP_UNLOCK(nvp);
899 		/*
900 		 * Concurrent rename race.
901 		 */
902 		if (nvp == tdvp) {
903 			vrele(nvp);
904 			error = EINVAL;
905 			goto releout;
906 		}
907 		vrele(*fvpp);
908 		*fvpp = nvp;
909 		goto relock;
910 	}
911 	vrele(*fvpp);
912 	*fvpp = nvp;
913 	VOP_UNLOCK(*fvpp);
914 	/*
915 	 * Re-resolve tvp and acquire the vnode lock if present.
916 	 */
917 	de = tmpfs_dir_lookup(VP_TO_TMPFS_DIR(tdvp), NULL, tcnp);
918 	/*
919 	 * If tvp disappeared we just carry on.
920 	 */
921 	if (de == NULL && *tvpp != NULL) {
922 		vrele(*tvpp);
923 		*tvpp = NULL;
924 	}
925 	/*
926 	 * Get the tvp ino if the lookup succeeded.  We may have to restart
927 	 * if the non-blocking acquire fails.
928 	 */
929 	if (de != NULL) {
930 		nvp = NULL;
931 		error = tmpfs_alloc_vp(mp, de->td_node,
932 		    LK_EXCLUSIVE | LK_NOWAIT, &nvp);
933 		if (*tvpp != NULL)
934 			vrele(*tvpp);
935 		*tvpp = nvp;
936 		if (error != 0) {
937 			VOP_UNLOCK(fdvp);
938 			VOP_UNLOCK(tdvp);
939 			if (error != EBUSY)
940 				goto releout;
941 			error = tmpfs_alloc_vp(mp, de->td_node, LK_EXCLUSIVE,
942 			    &nvp);
943 			if (error != 0)
944 				goto releout;
945 			VOP_UNLOCK(nvp);
946 			/*
947 			 * fdvp contains fvp, thus tvp (=fdvp) is not empty.
948 			 */
949 			if (nvp == fdvp) {
950 				error = ENOTEMPTY;
951 				goto releout;
952 			}
953 			goto relock;
954 		}
955 	}
956 	tmpfs_rename_restarts += restarts;
957 
958 	return (0);
959 
960 releout:
961 	vrele(fdvp);
962 	vrele(*fvpp);
963 	vrele(tdvp);
964 	if (*tvpp != NULL)
965 		vrele(*tvpp);
966 	tmpfs_rename_restarts += restarts;
967 
968 	return (error);
969 }
970 
971 static int
972 tmpfs_rename(struct vop_rename_args *v)
973 {
974 	struct vnode *fdvp = v->a_fdvp;
975 	struct vnode *fvp = v->a_fvp;
976 	struct componentname *fcnp = v->a_fcnp;
977 	struct vnode *tdvp = v->a_tdvp;
978 	struct vnode *tvp = v->a_tvp;
979 	struct componentname *tcnp = v->a_tcnp;
980 	char *newname;
981 	struct tmpfs_dirent *de;
982 	struct tmpfs_mount *tmp;
983 	struct tmpfs_node *fdnode;
984 	struct tmpfs_node *fnode;
985 	struct tmpfs_node *tnode;
986 	struct tmpfs_node *tdnode;
987 	int error;
988 	bool want_seqc_end;
989 
990 	MPASS(VOP_ISLOCKED(tdvp));
991 	MPASS(IMPLIES(tvp != NULL, VOP_ISLOCKED(tvp)));
992 
993 	want_seqc_end = false;
994 
995 	/*
996 	 * Disallow cross-device renames.
997 	 * XXX Why isn't this done by the caller?
998 	 */
999 	if (fvp->v_mount != tdvp->v_mount ||
1000 	    (tvp != NULL && fvp->v_mount != tvp->v_mount)) {
1001 		error = EXDEV;
1002 		goto out;
1003 	}
1004 
1005 	/* If source and target are the same file, there is nothing to do. */
1006 	if (fvp == tvp) {
1007 		error = 0;
1008 		goto out;
1009 	}
1010 
1011 	/*
1012 	 * If we need to move the directory between entries, lock the
1013 	 * source so that we can safely operate on it.
1014 	 */
1015 	if (fdvp != tdvp && fdvp != tvp) {
1016 		if (vn_lock(fdvp, LK_EXCLUSIVE | LK_NOWAIT) != 0) {
1017 			error = tmpfs_rename_relock(fdvp, &fvp, tdvp, &tvp,
1018 			    fcnp, tcnp);
1019 			if (error != 0)
1020 				return (error);
1021 			ASSERT_VOP_ELOCKED(fdvp,
1022 			    "tmpfs_rename: fdvp not locked");
1023 			ASSERT_VOP_ELOCKED(tdvp,
1024 			    "tmpfs_rename: tdvp not locked");
1025 			if (tvp != NULL)
1026 				ASSERT_VOP_ELOCKED(tvp,
1027 				    "tmpfs_rename: tvp not locked");
1028 			if (fvp == tvp) {
1029 				error = 0;
1030 				goto out_locked;
1031 			}
1032 		}
1033 	}
1034 
1035 	/*
1036 	 * Avoid manipulating '.' and '..' entries.
1037 	 */
1038 	if ((fcnp->cn_flags & ISDOTDOT) != 0 ||
1039 	    (fcnp->cn_namelen == 1 && fcnp->cn_nameptr[0] == '.')) {
1040 		error = EINVAL;
1041 		goto out_locked;
1042 	}
1043 
1044 	if (tvp != NULL)
1045 		vn_seqc_write_begin(tvp);
1046 	vn_seqc_write_begin(tdvp);
1047 	vn_seqc_write_begin(fvp);
1048 	vn_seqc_write_begin(fdvp);
1049 	want_seqc_end = true;
1050 
1051 	tmp = VFS_TO_TMPFS(tdvp->v_mount);
1052 	tdnode = VP_TO_TMPFS_DIR(tdvp);
1053 	tnode = (tvp == NULL) ? NULL : VP_TO_TMPFS_NODE(tvp);
1054 	fdnode = VP_TO_TMPFS_DIR(fdvp);
1055 	fnode = VP_TO_TMPFS_NODE(fvp);
1056 	de = tmpfs_dir_lookup(fdnode, fnode, fcnp);
1057 
1058 	/*
1059 	 * Entry can disappear before we lock fdvp.
1060 	 */
1061 	if (de == NULL) {
1062 		if ((fcnp->cn_flags & ISDOTDOT) != 0 ||
1063 		    (fcnp->cn_namelen == 1 && fcnp->cn_nameptr[0] == '.'))
1064 			error = EINVAL;
1065 		else
1066 			error = ENOENT;
1067 		goto out_locked;
1068 	}
1069 	MPASS(de->td_node == fnode);
1070 
1071 	/*
1072 	 * If re-naming a directory to another preexisting directory
1073 	 * ensure that the target directory is empty so that its
1074 	 * removal causes no side effects.
1075 	 * Kern_rename guarantees the destination to be a directory
1076 	 * if the source is one.
1077 	 */
1078 	if (tvp != NULL) {
1079 		MPASS(tnode != NULL);
1080 
1081 		if ((tnode->tn_flags & (NOUNLINK | IMMUTABLE | APPEND)) ||
1082 		    (tdnode->tn_flags & (APPEND | IMMUTABLE))) {
1083 			error = EPERM;
1084 			goto out_locked;
1085 		}
1086 
1087 		if (fnode->tn_type == VDIR && tnode->tn_type == VDIR) {
1088 			if (tnode->tn_size > 0) {
1089 				error = ENOTEMPTY;
1090 				goto out_locked;
1091 			}
1092 		} else if (fnode->tn_type == VDIR && tnode->tn_type != VDIR) {
1093 			error = ENOTDIR;
1094 			goto out_locked;
1095 		} else if (fnode->tn_type != VDIR && tnode->tn_type == VDIR) {
1096 			error = EISDIR;
1097 			goto out_locked;
1098 		} else {
1099 			MPASS(fnode->tn_type != VDIR &&
1100 				tnode->tn_type != VDIR);
1101 		}
1102 	}
1103 
1104 	if ((fnode->tn_flags & (NOUNLINK | IMMUTABLE | APPEND))
1105 	    || (fdnode->tn_flags & (APPEND | IMMUTABLE))) {
1106 		error = EPERM;
1107 		goto out_locked;
1108 	}
1109 
1110 	/*
1111 	 * Ensure that we have enough memory to hold the new name, if it
1112 	 * has to be changed.
1113 	 */
1114 	if (fcnp->cn_namelen != tcnp->cn_namelen ||
1115 	    bcmp(fcnp->cn_nameptr, tcnp->cn_nameptr, fcnp->cn_namelen) != 0) {
1116 		newname = malloc(tcnp->cn_namelen, M_TMPFSNAME, M_WAITOK);
1117 	} else
1118 		newname = NULL;
1119 
1120 	/*
1121 	 * If the node is being moved to another directory, we have to do
1122 	 * the move.
1123 	 */
1124 	if (fdnode != tdnode) {
1125 		/*
1126 		 * In case we are moving a directory, we have to adjust its
1127 		 * parent to point to the new parent.
1128 		 */
1129 		if (de->td_node->tn_type == VDIR) {
1130 			struct tmpfs_node *n;
1131 
1132 			error = VOP_ACCESS(fvp, VWRITE, tcnp->cn_cred, curthread);
1133 			if (error) {
1134 				if (newname != NULL)
1135 					free(newname, M_TMPFSNAME);
1136 				goto out_locked;
1137 			}
1138 
1139 			/*
1140 			 * Ensure the target directory is not a child of the
1141 			 * directory being moved.  Otherwise, we'd end up
1142 			 * with stale nodes.
1143 			 */
1144 			n = tdnode;
1145 			/*
1146 			 * TMPFS_LOCK guaranties that no nodes are freed while
1147 			 * traversing the list. Nodes can only be marked as
1148 			 * removed: tn_parent == NULL.
1149 			 */
1150 			TMPFS_LOCK(tmp);
1151 			TMPFS_NODE_LOCK(n);
1152 			while (n != n->tn_dir.tn_parent) {
1153 				struct tmpfs_node *parent;
1154 
1155 				if (n == fnode) {
1156 					TMPFS_NODE_UNLOCK(n);
1157 					TMPFS_UNLOCK(tmp);
1158 					error = EINVAL;
1159 					if (newname != NULL)
1160 						    free(newname, M_TMPFSNAME);
1161 					goto out_locked;
1162 				}
1163 				parent = n->tn_dir.tn_parent;
1164 				TMPFS_NODE_UNLOCK(n);
1165 				if (parent == NULL) {
1166 					n = NULL;
1167 					break;
1168 				}
1169 				TMPFS_NODE_LOCK(parent);
1170 				if (parent->tn_dir.tn_parent == NULL) {
1171 					TMPFS_NODE_UNLOCK(parent);
1172 					n = NULL;
1173 					break;
1174 				}
1175 				n = parent;
1176 			}
1177 			TMPFS_UNLOCK(tmp);
1178 			if (n == NULL) {
1179 				error = EINVAL;
1180 				if (newname != NULL)
1181 					    free(newname, M_TMPFSNAME);
1182 				goto out_locked;
1183 			}
1184 			TMPFS_NODE_UNLOCK(n);
1185 
1186 			/* Adjust the parent pointer. */
1187 			TMPFS_VALIDATE_DIR(fnode);
1188 			TMPFS_NODE_LOCK(de->td_node);
1189 			de->td_node->tn_dir.tn_parent = tdnode;
1190 			TMPFS_NODE_UNLOCK(de->td_node);
1191 
1192 			/*
1193 			 * As a result of changing the target of the '..'
1194 			 * entry, the link count of the source and target
1195 			 * directories has to be adjusted.
1196 			 */
1197 			TMPFS_NODE_LOCK(tdnode);
1198 			TMPFS_ASSERT_LOCKED(tdnode);
1199 			tdnode->tn_links++;
1200 			TMPFS_NODE_UNLOCK(tdnode);
1201 
1202 			TMPFS_NODE_LOCK(fdnode);
1203 			TMPFS_ASSERT_LOCKED(fdnode);
1204 			fdnode->tn_links--;
1205 			TMPFS_NODE_UNLOCK(fdnode);
1206 		}
1207 	}
1208 
1209 	/*
1210 	 * Do the move: just remove the entry from the source directory
1211 	 * and insert it into the target one.
1212 	 */
1213 	tmpfs_dir_detach(fdvp, de);
1214 
1215 	if (fcnp->cn_flags & DOWHITEOUT)
1216 		tmpfs_dir_whiteout_add(fdvp, fcnp);
1217 	if (tcnp->cn_flags & ISWHITEOUT)
1218 		tmpfs_dir_whiteout_remove(tdvp, tcnp);
1219 
1220 	/*
1221 	 * If the name has changed, we need to make it effective by changing
1222 	 * it in the directory entry.
1223 	 */
1224 	if (newname != NULL) {
1225 		MPASS(tcnp->cn_namelen <= MAXNAMLEN);
1226 
1227 		free(de->ud.td_name, M_TMPFSNAME);
1228 		de->ud.td_name = newname;
1229 		tmpfs_dirent_init(de, tcnp->cn_nameptr, tcnp->cn_namelen);
1230 
1231 		fnode->tn_status |= TMPFS_NODE_CHANGED;
1232 		tdnode->tn_status |= TMPFS_NODE_MODIFIED;
1233 	}
1234 
1235 	/*
1236 	 * If we are overwriting an entry, we have to remove the old one
1237 	 * from the target directory.
1238 	 */
1239 	if (tvp != NULL) {
1240 		struct tmpfs_dirent *tde;
1241 
1242 		/* Remove the old entry from the target directory. */
1243 		tde = tmpfs_dir_lookup(tdnode, tnode, tcnp);
1244 		tmpfs_dir_detach(tdvp, tde);
1245 
1246 		/* Update node's ctime because of possible hardlinks. */
1247 		tnode->tn_status |= TMPFS_NODE_CHANGED;
1248 		tmpfs_update(tvp);
1249 
1250 		/*
1251 		 * Free the directory entry we just deleted.  Note that the
1252 		 * node referred by it will not be removed until the vnode is
1253 		 * really reclaimed.
1254 		 */
1255 		tmpfs_free_dirent(VFS_TO_TMPFS(tvp->v_mount), tde);
1256 	}
1257 
1258 	tmpfs_dir_attach(tdvp, de);
1259 
1260 	if (tmpfs_use_nc(fvp)) {
1261 		cache_vop_rename(fdvp, fvp, tdvp, tvp, fcnp, tcnp);
1262 	}
1263 
1264 	error = 0;
1265 
1266 out_locked:
1267 	if (fdvp != tdvp && fdvp != tvp)
1268 		VOP_UNLOCK(fdvp);
1269 
1270 out:
1271 	if (want_seqc_end) {
1272 		if (tvp != NULL)
1273 			vn_seqc_write_end(tvp);
1274 		vn_seqc_write_end(tdvp);
1275 		vn_seqc_write_end(fvp);
1276 		vn_seqc_write_end(fdvp);
1277 	}
1278 
1279 	/*
1280 	 * Release target nodes.
1281 	 * XXX: I don't understand when tdvp can be the same as tvp, but
1282 	 * other code takes care of this...
1283 	 */
1284 	if (tdvp == tvp)
1285 		vrele(tdvp);
1286 	else
1287 		vput(tdvp);
1288 	if (tvp != NULL)
1289 		vput(tvp);
1290 
1291 	/* Release source nodes. */
1292 	vrele(fdvp);
1293 	vrele(fvp);
1294 
1295 	return (error);
1296 }
1297 
1298 static int
1299 tmpfs_mkdir(struct vop_mkdir_args *v)
1300 {
1301 	struct vnode *dvp = v->a_dvp;
1302 	struct vnode **vpp = v->a_vpp;
1303 	struct componentname *cnp = v->a_cnp;
1304 	struct vattr *vap = v->a_vap;
1305 
1306 	MPASS(vap->va_type == VDIR);
1307 
1308 	return (tmpfs_alloc_file(dvp, vpp, vap, cnp, NULL));
1309 }
1310 
1311 static int
1312 tmpfs_rmdir(struct vop_rmdir_args *v)
1313 {
1314 	struct vnode *dvp = v->a_dvp;
1315 	struct vnode *vp = v->a_vp;
1316 
1317 	int error;
1318 	struct tmpfs_dirent *de;
1319 	struct tmpfs_mount *tmp;
1320 	struct tmpfs_node *dnode;
1321 	struct tmpfs_node *node;
1322 
1323 	MPASS(VOP_ISLOCKED(dvp));
1324 	MPASS(VOP_ISLOCKED(vp));
1325 
1326 	tmp = VFS_TO_TMPFS(dvp->v_mount);
1327 	dnode = VP_TO_TMPFS_DIR(dvp);
1328 	node = VP_TO_TMPFS_DIR(vp);
1329 
1330 	/* Directories with more than two entries ('.' and '..') cannot be
1331 	 * removed. */
1332 	 if (node->tn_size > 0) {
1333 		 error = ENOTEMPTY;
1334 		 goto out;
1335 	 }
1336 
1337 	if ((dnode->tn_flags & APPEND)
1338 	    || (node->tn_flags & (NOUNLINK | IMMUTABLE | APPEND))) {
1339 		error = EPERM;
1340 		goto out;
1341 	}
1342 
1343 	/* This invariant holds only if we are not trying to remove "..".
1344 	  * We checked for that above so this is safe now. */
1345 	MPASS(node->tn_dir.tn_parent == dnode);
1346 
1347 	/* Get the directory entry associated with node (vp).  This was
1348 	 * filled by tmpfs_lookup while looking up the entry. */
1349 	de = tmpfs_dir_lookup(dnode, node, v->a_cnp);
1350 	MPASS(TMPFS_DIRENT_MATCHES(de,
1351 	    v->a_cnp->cn_nameptr,
1352 	    v->a_cnp->cn_namelen));
1353 
1354 	/* Check flags to see if we are allowed to remove the directory. */
1355 	if ((dnode->tn_flags & APPEND) != 0 ||
1356 	    (node->tn_flags & (NOUNLINK | IMMUTABLE | APPEND)) != 0) {
1357 		error = EPERM;
1358 		goto out;
1359 	}
1360 
1361 	/* Detach the directory entry from the directory (dnode). */
1362 	tmpfs_dir_detach(dvp, de);
1363 	if (v->a_cnp->cn_flags & DOWHITEOUT)
1364 		tmpfs_dir_whiteout_add(dvp, v->a_cnp);
1365 
1366 	/* No vnode should be allocated for this entry from this point */
1367 	TMPFS_NODE_LOCK(node);
1368 	node->tn_links--;
1369 	node->tn_dir.tn_parent = NULL;
1370 	node->tn_status |= TMPFS_NODE_CHANGED | TMPFS_NODE_MODIFIED;
1371 	node->tn_accessed = true;
1372 
1373 	TMPFS_NODE_UNLOCK(node);
1374 
1375 	TMPFS_NODE_LOCK(dnode);
1376 	dnode->tn_links--;
1377 	dnode->tn_status |= TMPFS_NODE_CHANGED | TMPFS_NODE_MODIFIED;
1378 	dnode->tn_accessed = true;
1379 	TMPFS_NODE_UNLOCK(dnode);
1380 
1381 	if (tmpfs_use_nc(dvp)) {
1382 		cache_vop_rmdir(dvp, vp);
1383 	}
1384 
1385 	/* Free the directory entry we just deleted.  Note that the node
1386 	 * referred by it will not be removed until the vnode is really
1387 	 * reclaimed. */
1388 	tmpfs_free_dirent(tmp, de);
1389 
1390 	/* Release the deleted vnode (will destroy the node, notify
1391 	 * interested parties and clean it from the cache). */
1392 
1393 	dnode->tn_status |= TMPFS_NODE_CHANGED;
1394 	tmpfs_update(dvp);
1395 
1396 	error = 0;
1397 
1398 out:
1399 	return (error);
1400 }
1401 
1402 static int
1403 tmpfs_symlink(struct vop_symlink_args *v)
1404 {
1405 	struct vnode *dvp = v->a_dvp;
1406 	struct vnode **vpp = v->a_vpp;
1407 	struct componentname *cnp = v->a_cnp;
1408 	struct vattr *vap = v->a_vap;
1409 	const char *target = v->a_target;
1410 
1411 #ifdef notyet /* XXX FreeBSD BUG: kern_symlink is not setting VLNK */
1412 	MPASS(vap->va_type == VLNK);
1413 #else
1414 	vap->va_type = VLNK;
1415 #endif
1416 
1417 	return (tmpfs_alloc_file(dvp, vpp, vap, cnp, target));
1418 }
1419 
1420 static int
1421 tmpfs_readdir(struct vop_readdir_args *va)
1422 {
1423 	struct vnode *vp;
1424 	struct uio *uio;
1425 	struct tmpfs_mount *tm;
1426 	struct tmpfs_node *node;
1427 	uint64_t **cookies;
1428 	int *eofflag, *ncookies;
1429 	ssize_t startresid;
1430 	int error, maxcookies;
1431 
1432 	vp = va->a_vp;
1433 	uio = va->a_uio;
1434 	eofflag = va->a_eofflag;
1435 	cookies = va->a_cookies;
1436 	ncookies = va->a_ncookies;
1437 
1438 	/* This operation only makes sense on directory nodes. */
1439 	if (vp->v_type != VDIR)
1440 		return (ENOTDIR);
1441 
1442 	maxcookies = 0;
1443 	node = VP_TO_TMPFS_DIR(vp);
1444 	tm = VFS_TO_TMPFS(vp->v_mount);
1445 
1446 	startresid = uio->uio_resid;
1447 
1448 	/* Allocate cookies for NFS and compat modules. */
1449 	if (cookies != NULL && ncookies != NULL) {
1450 		maxcookies = howmany(node->tn_size,
1451 		    sizeof(struct tmpfs_dirent)) + 2;
1452 		*cookies = malloc(maxcookies * sizeof(**cookies), M_TEMP,
1453 		    M_WAITOK);
1454 		*ncookies = 0;
1455 	}
1456 
1457 	if (cookies == NULL)
1458 		error = tmpfs_dir_getdents(tm, node, uio, 0, NULL, NULL);
1459 	else
1460 		error = tmpfs_dir_getdents(tm, node, uio, maxcookies, *cookies,
1461 		    ncookies);
1462 
1463 	/* Buffer was filled without hitting EOF. */
1464 	if (error == EJUSTRETURN)
1465 		error = (uio->uio_resid != startresid) ? 0 : EINVAL;
1466 
1467 	if (error != 0 && cookies != NULL && ncookies != NULL) {
1468 		free(*cookies, M_TEMP);
1469 		*cookies = NULL;
1470 		*ncookies = 0;
1471 	}
1472 
1473 	if (eofflag != NULL)
1474 		*eofflag =
1475 		    (error == 0 && uio->uio_offset == TMPFS_DIRCOOKIE_EOF);
1476 
1477 	return (error);
1478 }
1479 
1480 static int
1481 tmpfs_readlink(struct vop_readlink_args *v)
1482 {
1483 	struct vnode *vp = v->a_vp;
1484 	struct uio *uio = v->a_uio;
1485 
1486 	int error;
1487 	struct tmpfs_node *node;
1488 
1489 	MPASS(uio->uio_offset == 0);
1490 	MPASS(vp->v_type == VLNK);
1491 
1492 	node = VP_TO_TMPFS_NODE(vp);
1493 
1494 	error = uiomove(node->tn_link_target, MIN(node->tn_size, uio->uio_resid),
1495 	    uio);
1496 	tmpfs_set_accessed(VFS_TO_TMPFS(vp->v_mount), node);
1497 
1498 	return (error);
1499 }
1500 
1501 /*
1502  * VOP_FPLOOKUP_SYMLINK routines are subject to special circumstances, see
1503  * the comment above cache_fplookup for details.
1504  *
1505  * Check tmpfs_alloc_node for tmpfs-specific synchronisation notes.
1506  */
1507 static int
1508 tmpfs_fplookup_symlink(struct vop_fplookup_symlink_args *v)
1509 {
1510 	struct vnode *vp;
1511 	struct tmpfs_node *node;
1512 	char *symlink;
1513 
1514 	vp = v->a_vp;
1515 	node = VP_TO_TMPFS_NODE_SMR(vp);
1516 	if (__predict_false(node == NULL))
1517 		return (EAGAIN);
1518 	if (!atomic_load_char(&node->tn_link_smr))
1519 		return (EAGAIN);
1520 	symlink = atomic_load_ptr(&node->tn_link_target);
1521 	if (symlink == NULL)
1522 		return (EAGAIN);
1523 
1524 	return (cache_symlink_resolve(v->a_fpl, symlink, node->tn_size));
1525 }
1526 
1527 static int
1528 tmpfs_inactive(struct vop_inactive_args *v)
1529 {
1530 	struct vnode *vp;
1531 	struct tmpfs_node *node;
1532 
1533 	vp = v->a_vp;
1534 	node = VP_TO_TMPFS_NODE(vp);
1535 	if (node->tn_links == 0)
1536 		vrecycle(vp);
1537 	else
1538 		tmpfs_check_mtime(vp);
1539 	return (0);
1540 }
1541 
1542 static int
1543 tmpfs_need_inactive(struct vop_need_inactive_args *ap)
1544 {
1545 	struct vnode *vp;
1546 	struct tmpfs_node *node;
1547 	struct vm_object *obj;
1548 
1549 	vp = ap->a_vp;
1550 	node = VP_TO_TMPFS_NODE(vp);
1551 	if (node->tn_links == 0)
1552 		goto need;
1553 	if (vp->v_type == VREG) {
1554 		obj = vp->v_object;
1555 		if (obj->generation != obj->cleangeneration)
1556 			goto need;
1557 	}
1558 	return (0);
1559 need:
1560 	return (1);
1561 }
1562 
1563 int
1564 tmpfs_reclaim(struct vop_reclaim_args *v)
1565 {
1566 	struct vnode *vp;
1567 	struct tmpfs_mount *tmp;
1568 	struct tmpfs_node *node;
1569 	bool unlock;
1570 
1571 	vp = v->a_vp;
1572 	node = VP_TO_TMPFS_NODE(vp);
1573 	tmp = VFS_TO_TMPFS(vp->v_mount);
1574 
1575 	if (vp->v_type == VREG)
1576 		tmpfs_destroy_vobject(vp, node->tn_reg.tn_aobj);
1577 	vp->v_object = NULL;
1578 
1579 	TMPFS_LOCK(tmp);
1580 	TMPFS_NODE_LOCK(node);
1581 	tmpfs_free_vp(vp);
1582 
1583 	/*
1584 	 * If the node referenced by this vnode was deleted by the user,
1585 	 * we must free its associated data structures (now that the vnode
1586 	 * is being reclaimed).
1587 	 */
1588 	unlock = true;
1589 	if (node->tn_links == 0 &&
1590 	    (node->tn_vpstate & TMPFS_VNODE_ALLOCATING) == 0) {
1591 		node->tn_vpstate = TMPFS_VNODE_DOOMED;
1592 		unlock = !tmpfs_free_node_locked(tmp, node, true);
1593 	}
1594 
1595 	if (unlock) {
1596 		TMPFS_NODE_UNLOCK(node);
1597 		TMPFS_UNLOCK(tmp);
1598 	}
1599 
1600 	MPASS(vp->v_data == NULL);
1601 	return (0);
1602 }
1603 
1604 int
1605 tmpfs_print(struct vop_print_args *v)
1606 {
1607 	struct vnode *vp = v->a_vp;
1608 
1609 	struct tmpfs_node *node;
1610 
1611 	node = VP_TO_TMPFS_NODE(vp);
1612 
1613 	printf("tag VT_TMPFS, tmpfs_node %p, flags 0x%lx, links %jd\n",
1614 	    node, node->tn_flags, (uintmax_t)node->tn_links);
1615 	printf("\tmode 0%o, owner %d, group %d, size %jd, status 0x%x\n",
1616 	    node->tn_mode, node->tn_uid, node->tn_gid,
1617 	    (intmax_t)node->tn_size, node->tn_status);
1618 
1619 	if (vp->v_type == VFIFO)
1620 		fifo_printinfo(vp);
1621 
1622 	printf("\n");
1623 
1624 	return (0);
1625 }
1626 
1627 int
1628 tmpfs_pathconf(struct vop_pathconf_args *v)
1629 {
1630 	struct vnode *vp = v->a_vp;
1631 	int name = v->a_name;
1632 	long *retval = v->a_retval;
1633 
1634 	int error;
1635 
1636 	error = 0;
1637 
1638 	switch (name) {
1639 	case _PC_LINK_MAX:
1640 		*retval = TMPFS_LINK_MAX;
1641 		break;
1642 
1643 	case _PC_SYMLINK_MAX:
1644 		*retval = MAXPATHLEN;
1645 		break;
1646 
1647 	case _PC_NAME_MAX:
1648 		*retval = NAME_MAX;
1649 		break;
1650 
1651 	case _PC_PIPE_BUF:
1652 		if (vp->v_type == VDIR || vp->v_type == VFIFO)
1653 			*retval = PIPE_BUF;
1654 		else
1655 			error = EINVAL;
1656 		break;
1657 
1658 	case _PC_CHOWN_RESTRICTED:
1659 		*retval = 1;
1660 		break;
1661 
1662 	case _PC_NO_TRUNC:
1663 		*retval = 1;
1664 		break;
1665 
1666 	case _PC_SYNC_IO:
1667 		*retval = 1;
1668 		break;
1669 
1670 	case _PC_FILESIZEBITS:
1671 		*retval = 64;
1672 		break;
1673 
1674 	case _PC_MIN_HOLE_SIZE:
1675 		*retval = PAGE_SIZE;
1676 		break;
1677 
1678 	default:
1679 		error = vop_stdpathconf(v);
1680 	}
1681 
1682 	return (error);
1683 }
1684 
1685 static int
1686 tmpfs_vptofh(struct vop_vptofh_args *ap)
1687 /*
1688 vop_vptofh {
1689 	IN struct vnode *a_vp;
1690 	IN struct fid *a_fhp;
1691 };
1692 */
1693 {
1694 	struct tmpfs_fid_data tfd;
1695 	struct tmpfs_node *node;
1696 	struct fid *fhp;
1697 
1698 	node = VP_TO_TMPFS_NODE(ap->a_vp);
1699 	fhp = ap->a_fhp;
1700 	fhp->fid_len = sizeof(tfd);
1701 
1702 	/*
1703 	 * Copy into fid_data from the stack to avoid unaligned pointer use.
1704 	 * See the comment in sys/mount.h on struct fid for details.
1705 	 */
1706 	tfd.tfd_id = node->tn_id;
1707 	tfd.tfd_gen = node->tn_gen;
1708 	memcpy(fhp->fid_data, &tfd, fhp->fid_len);
1709 
1710 	return (0);
1711 }
1712 
1713 static int
1714 tmpfs_whiteout(struct vop_whiteout_args *ap)
1715 {
1716 	struct vnode *dvp = ap->a_dvp;
1717 	struct componentname *cnp = ap->a_cnp;
1718 	struct tmpfs_dirent *de;
1719 
1720 	switch (ap->a_flags) {
1721 	case LOOKUP:
1722 		return (0);
1723 	case CREATE:
1724 		de = tmpfs_dir_lookup(VP_TO_TMPFS_DIR(dvp), NULL, cnp);
1725 		if (de != NULL)
1726 			return (de->td_node == NULL ? 0 : EEXIST);
1727 		return (tmpfs_dir_whiteout_add(dvp, cnp));
1728 	case DELETE:
1729 		tmpfs_dir_whiteout_remove(dvp, cnp);
1730 		return (0);
1731 	default:
1732 		panic("tmpfs_whiteout: unknown op");
1733 	}
1734 }
1735 
1736 static int
1737 tmpfs_vptocnp_dir(struct tmpfs_node *tn, struct tmpfs_node *tnp,
1738     struct tmpfs_dirent **pde)
1739 {
1740 	struct tmpfs_dir_cursor dc;
1741 	struct tmpfs_dirent *de;
1742 
1743 	for (de = tmpfs_dir_first(tnp, &dc); de != NULL;
1744 	     de = tmpfs_dir_next(tnp, &dc)) {
1745 		if (de->td_node == tn) {
1746 			*pde = de;
1747 			return (0);
1748 		}
1749 	}
1750 	return (ENOENT);
1751 }
1752 
1753 static int
1754 tmpfs_vptocnp_fill(struct vnode *vp, struct tmpfs_node *tn,
1755     struct tmpfs_node *tnp, char *buf, size_t *buflen, struct vnode **dvp)
1756 {
1757 	struct tmpfs_dirent *de;
1758 	int error, i;
1759 
1760 	error = vn_vget_ino_gen(vp, tmpfs_vn_get_ino_alloc, tnp, LK_SHARED,
1761 	    dvp);
1762 	if (error != 0)
1763 		return (error);
1764 	error = tmpfs_vptocnp_dir(tn, tnp, &de);
1765 	if (error == 0) {
1766 		i = *buflen;
1767 		i -= de->td_namelen;
1768 		if (i < 0) {
1769 			error = ENOMEM;
1770 		} else {
1771 			bcopy(de->ud.td_name, buf + i, de->td_namelen);
1772 			*buflen = i;
1773 		}
1774 	}
1775 	if (error == 0) {
1776 		if (vp != *dvp)
1777 			VOP_UNLOCK(*dvp);
1778 	} else {
1779 		if (vp != *dvp)
1780 			vput(*dvp);
1781 		else
1782 			vrele(vp);
1783 	}
1784 	return (error);
1785 }
1786 
1787 static int
1788 tmpfs_vptocnp(struct vop_vptocnp_args *ap)
1789 {
1790 	struct vnode *vp, **dvp;
1791 	struct tmpfs_node *tn, *tnp, *tnp1;
1792 	struct tmpfs_dirent *de;
1793 	struct tmpfs_mount *tm;
1794 	char *buf;
1795 	size_t *buflen;
1796 	int error;
1797 
1798 	vp = ap->a_vp;
1799 	dvp = ap->a_vpp;
1800 	buf = ap->a_buf;
1801 	buflen = ap->a_buflen;
1802 
1803 	tm = VFS_TO_TMPFS(vp->v_mount);
1804 	tn = VP_TO_TMPFS_NODE(vp);
1805 	if (tn->tn_type == VDIR) {
1806 		tnp = tn->tn_dir.tn_parent;
1807 		if (tnp == NULL)
1808 			return (ENOENT);
1809 		tmpfs_ref_node(tnp);
1810 		error = tmpfs_vptocnp_fill(vp, tn, tn->tn_dir.tn_parent, buf,
1811 		    buflen, dvp);
1812 		tmpfs_free_node(tm, tnp);
1813 		return (error);
1814 	}
1815 restart:
1816 	TMPFS_LOCK(tm);
1817 restart_locked:
1818 	LIST_FOREACH_SAFE(tnp, &tm->tm_nodes_used, tn_entries, tnp1) {
1819 		if (tnp->tn_type != VDIR)
1820 			continue;
1821 		TMPFS_NODE_LOCK(tnp);
1822 		tmpfs_ref_node(tnp);
1823 
1824 		/*
1825 		 * tn_vnode cannot be instantiated while we hold the
1826 		 * node lock, so the directory cannot be changed while
1827 		 * we iterate over it.  Do this to avoid instantiating
1828 		 * vnode for directories which cannot point to our
1829 		 * node.
1830 		 */
1831 		error = tnp->tn_vnode == NULL ? tmpfs_vptocnp_dir(tn, tnp,
1832 		    &de) : 0;
1833 
1834 		if (error == 0) {
1835 			TMPFS_NODE_UNLOCK(tnp);
1836 			TMPFS_UNLOCK(tm);
1837 			error = tmpfs_vptocnp_fill(vp, tn, tnp, buf, buflen,
1838 			    dvp);
1839 			if (error == 0) {
1840 				tmpfs_free_node(tm, tnp);
1841 				return (0);
1842 			}
1843 			if (VN_IS_DOOMED(vp)) {
1844 				tmpfs_free_node(tm, tnp);
1845 				return (ENOENT);
1846 			}
1847 			TMPFS_LOCK(tm);
1848 			TMPFS_NODE_LOCK(tnp);
1849 		}
1850 		if (tmpfs_free_node_locked(tm, tnp, false)) {
1851 			goto restart;
1852 		} else {
1853 			KASSERT(tnp->tn_refcount > 0,
1854 			    ("node %p refcount zero", tnp));
1855 			if (tnp->tn_attached) {
1856 				tnp1 = LIST_NEXT(tnp, tn_entries);
1857 				TMPFS_NODE_UNLOCK(tnp);
1858 			} else {
1859 				TMPFS_NODE_UNLOCK(tnp);
1860 				goto restart_locked;
1861 			}
1862 		}
1863 	}
1864 	TMPFS_UNLOCK(tm);
1865 	return (ENOENT);
1866 }
1867 
1868 void
1869 tmpfs_extattr_free(struct tmpfs_extattr *ea)
1870 {
1871 	free(ea->ea_name, M_TMPFSEA);
1872 	free(ea->ea_value, M_TMPFSEA);
1873 	free(ea, M_TMPFSEA);
1874 }
1875 
1876 static bool
1877 tmpfs_extattr_update_mem(struct tmpfs_mount *tmp, ssize_t size)
1878 {
1879 	TMPFS_LOCK(tmp);
1880 	if (size > 0 &&
1881 	    !tmpfs_pages_check_avail(tmp, howmany(size, PAGE_SIZE))) {
1882 		TMPFS_UNLOCK(tmp);
1883 		return (false);
1884 	}
1885 	if (tmp->tm_ea_memory_inuse + size > tmp->tm_ea_memory_max) {
1886 		TMPFS_UNLOCK(tmp);
1887 		return (false);
1888 	}
1889 	tmp->tm_ea_memory_inuse += size;
1890 	TMPFS_UNLOCK(tmp);
1891 	return (true);
1892 }
1893 
1894 static int
1895 tmpfs_deleteextattr(struct vop_deleteextattr_args *ap)
1896 {
1897 	struct vnode *vp = ap->a_vp;
1898 	struct tmpfs_mount *tmp;
1899 	struct tmpfs_node *node;
1900 	struct tmpfs_extattr *ea;
1901 	size_t namelen;
1902 	ssize_t diff;
1903 	int error;
1904 
1905 	node = VP_TO_TMPFS_NODE(vp);
1906 	tmp = VFS_TO_TMPFS(vp->v_mount);
1907 	if (ap->a_vp->v_type == VCHR || ap->a_vp->v_type == VBLK)
1908 		return (EOPNOTSUPP);
1909 	error = extattr_check_cred(ap->a_vp, ap->a_attrnamespace,
1910 	    ap->a_cred, ap->a_td, VWRITE);
1911 	if (error != 0)
1912 		return (error);
1913 	if (ap->a_name == NULL || ap->a_name[0] == '\0')
1914 		return (EINVAL);
1915 	namelen = strlen(ap->a_name);
1916 	if (namelen > EXTATTR_MAXNAMELEN)
1917 		return (EINVAL);
1918 
1919 	LIST_FOREACH(ea, &node->tn_extattrs, ea_extattrs) {
1920 		if (ea->ea_namespace == ap->a_attrnamespace &&
1921 		    namelen == ea->ea_namelen &&
1922 		    memcmp(ap->a_name, ea->ea_name, namelen) == 0)
1923 			break;
1924 	}
1925 
1926 	if (ea == NULL)
1927 		return (ENOATTR);
1928 	LIST_REMOVE(ea, ea_extattrs);
1929 	diff = -(sizeof(struct tmpfs_extattr) + namelen + ea->ea_size);
1930 	tmpfs_extattr_update_mem(tmp, diff);
1931 	tmpfs_extattr_free(ea);
1932 	return (0);
1933 }
1934 
1935 static int
1936 tmpfs_getextattr(struct vop_getextattr_args *ap)
1937 {
1938 	struct vnode *vp = ap->a_vp;
1939 	struct tmpfs_node *node;
1940 	struct tmpfs_extattr *ea;
1941 	size_t namelen;
1942 	int error;
1943 
1944 	node = VP_TO_TMPFS_NODE(vp);
1945 	if (ap->a_vp->v_type == VCHR || ap->a_vp->v_type == VBLK)
1946 		return (EOPNOTSUPP);
1947 	error = extattr_check_cred(ap->a_vp, ap->a_attrnamespace,
1948 	    ap->a_cred, ap->a_td, VREAD);
1949 	if (error != 0)
1950 		return (error);
1951 	if (ap->a_name == NULL || ap->a_name[0] == '\0')
1952 		return (EINVAL);
1953 	namelen = strlen(ap->a_name);
1954 	if (namelen > EXTATTR_MAXNAMELEN)
1955 		return (EINVAL);
1956 
1957 	LIST_FOREACH(ea, &node->tn_extattrs, ea_extattrs) {
1958 		if (ea->ea_namespace == ap->a_attrnamespace &&
1959 		    namelen == ea->ea_namelen &&
1960 		    memcmp(ap->a_name, ea->ea_name, namelen) == 0)
1961 			break;
1962 	}
1963 
1964 	if (ea == NULL)
1965 		return (ENOATTR);
1966 	if (ap->a_size != NULL)
1967 		*ap->a_size = ea->ea_size;
1968 	if (ap->a_uio != NULL && ea->ea_size != 0)
1969 		error = uiomove(ea->ea_value, ea->ea_size, ap->a_uio);
1970 	return (error);
1971 }
1972 
1973 static int
1974 tmpfs_listextattr(struct vop_listextattr_args *ap)
1975 {
1976 	struct vnode *vp = ap->a_vp;
1977 	struct tmpfs_node *node;
1978 	struct tmpfs_extattr *ea;
1979 	int error;
1980 
1981 	node = VP_TO_TMPFS_NODE(vp);
1982 	if (ap->a_vp->v_type == VCHR || ap->a_vp->v_type == VBLK)
1983 		return (EOPNOTSUPP);
1984 	error = extattr_check_cred(ap->a_vp, ap->a_attrnamespace,
1985 	    ap->a_cred, ap->a_td, VREAD);
1986 	if (error != 0)
1987 		return (error);
1988 	if (ap->a_size != NULL)
1989 		*ap->a_size = 0;
1990 
1991 	LIST_FOREACH(ea, &node->tn_extattrs, ea_extattrs) {
1992 		if (ea->ea_namespace != ap->a_attrnamespace)
1993 			continue;
1994 		if (ap->a_size != NULL)
1995 			*ap->a_size += ea->ea_namelen + 1;
1996 		if (ap->a_uio != NULL) {
1997 			error = uiomove(&ea->ea_namelen, 1, ap->a_uio);
1998 			if (error != 0)
1999 				break;
2000 			error = uiomove(ea->ea_name, ea->ea_namelen, ap->a_uio);
2001 			if (error != 0)
2002 				break;
2003 		}
2004 	}
2005 
2006 	return (error);
2007 }
2008 
2009 static int
2010 tmpfs_setextattr(struct vop_setextattr_args *ap)
2011 {
2012 	struct vnode *vp = ap->a_vp;
2013 	struct tmpfs_mount *tmp;
2014 	struct tmpfs_node *node;
2015 	struct tmpfs_extattr *ea;
2016 	struct tmpfs_extattr *new_ea;
2017 	size_t attr_size;
2018 	size_t namelen;
2019 	ssize_t diff;
2020 	int error;
2021 
2022 	node = VP_TO_TMPFS_NODE(vp);
2023 	tmp = VFS_TO_TMPFS(vp->v_mount);
2024 	attr_size = ap->a_uio->uio_resid;
2025 	diff = 0;
2026 	if (ap->a_vp->v_type == VCHR || ap->a_vp->v_type == VBLK)
2027 		return (EOPNOTSUPP);
2028 	error = extattr_check_cred(ap->a_vp, ap->a_attrnamespace,
2029 	    ap->a_cred, ap->a_td, VWRITE);
2030 	if (error != 0)
2031 		return (error);
2032 	if (ap->a_name == NULL || ap->a_name[0] == '\0')
2033 		return (EINVAL);
2034 	namelen = strlen(ap->a_name);
2035 	if (namelen > EXTATTR_MAXNAMELEN)
2036 		return (EINVAL);
2037 
2038 	LIST_FOREACH(ea, &node->tn_extattrs, ea_extattrs) {
2039 		if (ea->ea_namespace == ap->a_attrnamespace &&
2040 		    namelen == ea->ea_namelen &&
2041 		    memcmp(ap->a_name, ea->ea_name, namelen) == 0) {
2042 			diff -= sizeof(struct tmpfs_extattr) + ea->ea_namelen +
2043 			    ea->ea_size;
2044 			break;
2045 		}
2046 	}
2047 
2048 	diff += sizeof(struct tmpfs_extattr) + namelen + attr_size;
2049 	if (!tmpfs_extattr_update_mem(tmp, diff))
2050 		return (ENOSPC);
2051 	new_ea = malloc(sizeof(struct tmpfs_extattr), M_TMPFSEA, M_WAITOK);
2052 	new_ea->ea_namespace = ap->a_attrnamespace;
2053 	new_ea->ea_name = malloc(namelen, M_TMPFSEA, M_WAITOK);
2054 	new_ea->ea_namelen = namelen;
2055 	memcpy(new_ea->ea_name, ap->a_name, namelen);
2056 	if (attr_size != 0) {
2057 		new_ea->ea_value = malloc(attr_size, M_TMPFSEA, M_WAITOK);
2058 		new_ea->ea_size = attr_size;
2059 		error = uiomove(new_ea->ea_value, attr_size, ap->a_uio);
2060 	} else {
2061 		new_ea->ea_value = NULL;
2062 		new_ea->ea_size = 0;
2063 	}
2064 	if (error != 0) {
2065 		tmpfs_extattr_update_mem(tmp, -diff);
2066 		tmpfs_extattr_free(new_ea);
2067 		return (error);
2068 	}
2069 	if (ea != NULL) {
2070 		LIST_REMOVE(ea, ea_extattrs);
2071 		tmpfs_extattr_free(ea);
2072 	}
2073 	LIST_INSERT_HEAD(&node->tn_extattrs, new_ea, ea_extattrs);
2074 	return (0);
2075 }
2076 
2077 static off_t
2078 tmpfs_seek_data_locked(vm_object_t obj, off_t noff)
2079 {
2080 	vm_page_t m;
2081 	vm_pindex_t p, p_m, p_swp;
2082 
2083 	p = OFF_TO_IDX(noff);
2084 	m = vm_page_find_least(obj, p);
2085 
2086 	/*
2087 	 * Microoptimize the most common case for SEEK_DATA, where
2088 	 * there is no hole and the page is resident.
2089 	 */
2090 	if (m != NULL && vm_page_any_valid(m) && m->pindex == p)
2091 		return (noff);
2092 
2093 	p_swp = swap_pager_find_least(obj, p);
2094 	if (p_swp == p)
2095 		return (noff);
2096 
2097 	p_m = m == NULL ? obj->size : m->pindex;
2098 	return (IDX_TO_OFF(MIN(p_m, p_swp)));
2099 }
2100 
2101 static off_t
2102 tmpfs_seek_next(off_t noff)
2103 {
2104 	return (noff + PAGE_SIZE - (noff & PAGE_MASK));
2105 }
2106 
2107 static int
2108 tmpfs_seek_clamp(struct tmpfs_node *tn, off_t *noff, bool seekdata)
2109 {
2110 	if (*noff < tn->tn_size)
2111 		return (0);
2112 	if (seekdata)
2113 		return (ENXIO);
2114 	*noff = tn->tn_size;
2115 	return (0);
2116 }
2117 
2118 static off_t
2119 tmpfs_seek_hole_locked(vm_object_t obj, off_t noff)
2120 {
2121 	vm_page_t m;
2122 	vm_pindex_t p, p_swp;
2123 
2124 	for (;; noff = tmpfs_seek_next(noff)) {
2125 		/*
2126 		 * Walk over the largest sequential run of the valid pages.
2127 		 */
2128 		for (m = vm_page_lookup(obj, OFF_TO_IDX(noff));
2129 		    m != NULL && vm_page_any_valid(m);
2130 		    m = vm_page_next(m), noff = tmpfs_seek_next(noff))
2131 			;
2132 
2133 		/*
2134 		 * Found a hole in the object's page queue.  Check if
2135 		 * there is a hole in the swap at the same place.
2136 		 */
2137 		p = OFF_TO_IDX(noff);
2138 		p_swp = swap_pager_find_least(obj, p);
2139 		if (p_swp != p) {
2140 			noff = IDX_TO_OFF(p);
2141 			break;
2142 		}
2143 	}
2144 	return (noff);
2145 }
2146 
2147 static int
2148 tmpfs_seek_datahole(struct vnode *vp, off_t *off, bool seekdata)
2149 {
2150 	struct tmpfs_node *tn;
2151 	vm_object_t obj;
2152 	off_t noff;
2153 	int error;
2154 
2155 	if (vp->v_type != VREG)
2156 		return (ENOTTY);
2157 	tn = VP_TO_TMPFS_NODE(vp);
2158 	noff = *off;
2159 	if (noff < 0)
2160 		return (ENXIO);
2161 	error = tmpfs_seek_clamp(tn, &noff, seekdata);
2162 	if (error != 0)
2163 		return (error);
2164 	obj = tn->tn_reg.tn_aobj;
2165 
2166 	VM_OBJECT_RLOCK(obj);
2167 	noff = seekdata ? tmpfs_seek_data_locked(obj, noff) :
2168 	    tmpfs_seek_hole_locked(obj, noff);
2169 	VM_OBJECT_RUNLOCK(obj);
2170 
2171 	error = tmpfs_seek_clamp(tn, &noff, seekdata);
2172 	if (error == 0)
2173 		*off = noff;
2174 	return (error);
2175 }
2176 
2177 static int
2178 tmpfs_ioctl(struct vop_ioctl_args *ap)
2179 {
2180 	struct vnode *vp = ap->a_vp;
2181 	int error = 0;
2182 
2183 	switch (ap->a_command) {
2184 	case FIOSEEKDATA:
2185 	case FIOSEEKHOLE:
2186 		error = vn_lock(vp, LK_SHARED);
2187 		if (error != 0) {
2188 			error = EBADF;
2189 			break;
2190 		}
2191 		error = tmpfs_seek_datahole(vp, (off_t *)ap->a_data,
2192 		    ap->a_command == FIOSEEKDATA);
2193 		VOP_UNLOCK(vp);
2194 		break;
2195 	default:
2196 		error = ENOTTY;
2197 		break;
2198 	}
2199 	return (error);
2200 }
2201 
2202 /*
2203  * Vnode operations vector used for files stored in a tmpfs file system.
2204  */
2205 struct vop_vector tmpfs_vnodeop_entries = {
2206 	.vop_default =			&default_vnodeops,
2207 	.vop_lookup =			vfs_cache_lookup,
2208 	.vop_cachedlookup =		tmpfs_cached_lookup,
2209 	.vop_create =			tmpfs_create,
2210 	.vop_mknod =			tmpfs_mknod,
2211 	.vop_open =			tmpfs_open,
2212 	.vop_close =			tmpfs_close,
2213 	.vop_fplookup_vexec =		tmpfs_fplookup_vexec,
2214 	.vop_fplookup_symlink =		tmpfs_fplookup_symlink,
2215 	.vop_access =			tmpfs_access,
2216 	.vop_stat =			tmpfs_stat,
2217 	.vop_getattr =			tmpfs_getattr,
2218 	.vop_setattr =			tmpfs_setattr,
2219 	.vop_read =			tmpfs_read,
2220 	.vop_read_pgcache =		tmpfs_read_pgcache,
2221 	.vop_write =			tmpfs_write,
2222 	.vop_deallocate =		tmpfs_deallocate,
2223 	.vop_fsync =			tmpfs_fsync,
2224 	.vop_remove =			tmpfs_remove,
2225 	.vop_link =			tmpfs_link,
2226 	.vop_rename =			tmpfs_rename,
2227 	.vop_mkdir =			tmpfs_mkdir,
2228 	.vop_rmdir =			tmpfs_rmdir,
2229 	.vop_symlink =			tmpfs_symlink,
2230 	.vop_readdir =			tmpfs_readdir,
2231 	.vop_readlink =			tmpfs_readlink,
2232 	.vop_inactive =			tmpfs_inactive,
2233 	.vop_need_inactive =		tmpfs_need_inactive,
2234 	.vop_reclaim =			tmpfs_reclaim,
2235 	.vop_print =			tmpfs_print,
2236 	.vop_pathconf =			tmpfs_pathconf,
2237 	.vop_vptofh =			tmpfs_vptofh,
2238 	.vop_whiteout =			tmpfs_whiteout,
2239 	.vop_bmap =			VOP_EOPNOTSUPP,
2240 	.vop_vptocnp =			tmpfs_vptocnp,
2241 	.vop_lock1 =			vop_lock,
2242 	.vop_unlock = 			vop_unlock,
2243 	.vop_islocked = 		vop_islocked,
2244 	.vop_deleteextattr =		tmpfs_deleteextattr,
2245 	.vop_getextattr =		tmpfs_getextattr,
2246 	.vop_listextattr =		tmpfs_listextattr,
2247 	.vop_setextattr =		tmpfs_setextattr,
2248 	.vop_add_writecount =		vop_stdadd_writecount_nomsync,
2249 	.vop_ioctl =			tmpfs_ioctl,
2250 };
2251 VFS_VOP_VECTOR_REGISTER(tmpfs_vnodeop_entries);
2252 
2253 /*
2254  * Same vector for mounts which do not use namecache.
2255  */
2256 struct vop_vector tmpfs_vnodeop_nonc_entries = {
2257 	.vop_default =			&tmpfs_vnodeop_entries,
2258 	.vop_lookup =			tmpfs_lookup,
2259 };
2260 VFS_VOP_VECTOR_REGISTER(tmpfs_vnodeop_nonc_entries);
2261