1 /*
   2  * CDDL HEADER START
   3  *
   4  * The contents of this file are subject to the terms of the
   5  * Common Development and Distribution License (the "License").
   6  * You may not use this file except in compliance with the License.
   7  *
   8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
   9  * or http://www.opensolaris.org/os/licensing.
  10  * See the License for the specific language governing permissions
  11  * and limitations under the License.
  12  *
  13  * When distributing Covered Code, include this CDDL HEADER in each
  14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
  15  * If applicable, add the following below this CDDL HEADER, with the
  16  * fields enclosed by brackets "[]" replaced with your own identifying
  17  * information: Portions Copyright [yyyy] [name of copyright owner]
  18  *
  19  * CDDL HEADER END
  20  */
  21 
  22 /*
  23  * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
  24  * Use is subject to license terms.
  25  */
  26 
  27 /*
  28  * Copyright 2016 Joyent, Inc.
  29  * Copyright 2015 Nexenta Systems, Inc.  All rights reserved.
  30  * Copyright 2016 RackTop Systems.
  31  */
  32 
  33 #include <sys/types.h>
  34 #include <sys/param.h>
  35 #include <sys/t_lock.h>
  36 #include <sys/systm.h>
  37 #include <sys/sysmacros.h>
  38 #include <sys/user.h>
  39 #include <sys/time.h>
  40 #include <sys/vfs.h>
  41 #include <sys/vfs_opreg.h>
  42 #include <sys/vnode.h>
  43 #include <sys/file.h>
  44 #include <sys/fcntl.h>
  45 #include <sys/flock.h>
  46 #include <sys/kmem.h>
  47 #include <sys/uio.h>
  48 #include <sys/errno.h>
  49 #include <sys/stat.h>
  50 #include <sys/cred.h>
  51 #include <sys/dirent.h>
  52 #include <sys/pathname.h>
  53 #include <sys/vmsystm.h>
  54 #include <sys/fs/tmp.h>
  55 #include <sys/fs/tmpnode.h>
  56 #include <sys/mman.h>
  57 #include <vm/hat.h>
  58 #include <vm/seg_vn.h>
  59 #include <vm/seg_map.h>
  60 #include <vm/seg.h>
  61 #include <vm/anon.h>
  62 #include <vm/as.h>
  63 #include <vm/page.h>
  64 #include <vm/pvn.h>
  65 #include <sys/cmn_err.h>
  66 #include <sys/debug.h>
  67 #include <sys/swap.h>
  68 #include <sys/buf.h>
  69 #include <sys/vm.h>
  70 #include <sys/vtrace.h>
  71 #include <sys/policy.h>
  72 #include <fs/fs_subr.h>
  73 
  74 static int      tmp_getapage(struct vnode *, u_offset_t, size_t, uint_t *,
  75         page_t **, size_t, struct seg *, caddr_t, enum seg_rw, struct cred *);
  76 static int      tmp_putapage(struct vnode *, page_t *, u_offset_t *, size_t *,
  77         int, struct cred *);
  78 
  79 /* ARGSUSED1 */
  80 static int
  81 tmp_open(struct vnode **vpp, int flag, struct cred *cred, caller_context_t *ct)
  82 {
  83         /*
  84          * swapon to a tmpfs file is not supported so access
  85          * is denied on open if VISSWAP is set.
  86          */
  87         if ((*vpp)->v_flag & VISSWAP)
  88                 return (EINVAL);
  89         return (0);
  90 }
  91 
  92 /* ARGSUSED1 */
  93 static int
  94 tmp_close(
  95         struct vnode *vp,
  96         int flag,
  97         int count,
  98         offset_t offset,
  99         struct cred *cred,
 100         caller_context_t *ct)
 101 {
 102         cleanlocks(vp, ttoproc(curthread)->p_pid, 0);
 103         cleanshares(vp, ttoproc(curthread)->p_pid);
 104         return (0);
 105 }
 106 
 107 /*
 108  * wrtmp does the real work of write requests for tmpfs.
 109  */
 110 static int
 111 wrtmp(
 112         struct tmount *tm,
 113         struct tmpnode *tp,
 114         struct uio *uio,
 115         struct cred *cr,
 116         struct caller_context *ct)
 117 {
 118         pgcnt_t pageoffset;     /* offset in pages */
 119         ulong_t segmap_offset;  /* pagesize byte offset into segmap */
 120         caddr_t base;           /* base of segmap */
 121         ssize_t bytes;          /* bytes to uiomove */
 122         pfn_t pagenumber;       /* offset in pages into tmp file */
 123         struct vnode *vp;
 124         int error = 0;
 125         int     pagecreate;     /* == 1 if we allocated a page */
 126         int     newpage;
 127         rlim64_t limit = uio->uio_llimit;
 128         long oresid = uio->uio_resid;
 129         timestruc_t now;
 130 
 131         long tn_size_changed = 0;
 132         long old_tn_size;
 133         long new_tn_size;
 134 
 135         vp = TNTOV(tp);
 136         ASSERT(vp->v_type == VREG);
 137 
 138         TRACE_1(TR_FAC_TMPFS, TR_TMPFS_RWTMP_START,
 139             "tmp_wrtmp_start:vp %p", vp);
 140 
 141         ASSERT(RW_WRITE_HELD(&tp->tn_contents));
 142         ASSERT(RW_WRITE_HELD(&tp->tn_rwlock));
 143 
 144         if (MANDLOCK(vp, tp->tn_mode)) {
 145                 rw_exit(&tp->tn_contents);
 146                 /*
 147                  * tmp_getattr ends up being called by chklock
 148                  */
 149                 error = chklock(vp, FWRITE, uio->uio_loffset, uio->uio_resid,
 150                     uio->uio_fmode, ct);
 151                 rw_enter(&tp->tn_contents, RW_WRITER);
 152                 if (error != 0) {
 153                         TRACE_2(TR_FAC_TMPFS, TR_TMPFS_RWTMP_END,
 154                             "tmp_wrtmp_end:vp %p error %d", vp, error);
 155                         return (error);
 156                 }
 157         }
 158 
 159         if (uio->uio_loffset < 0)
 160                 return (EINVAL);
 161 
 162         if (limit == RLIM64_INFINITY || limit > MAXOFFSET_T)
 163                 limit = MAXOFFSET_T;
 164 
 165         if (uio->uio_loffset >= limit) {
 166                 proc_t *p = ttoproc(curthread);
 167 
 168                 mutex_enter(&p->p_lock);
 169                 (void) rctl_action(rctlproc_legacy[RLIMIT_FSIZE], p->p_rctls,
 170                     p, RCA_UNSAFE_SIGINFO);
 171                 mutex_exit(&p->p_lock);
 172                 return (EFBIG);
 173         }
 174 
 175         if (uio->uio_loffset >= MAXOFF_T) {
 176                 TRACE_2(TR_FAC_TMPFS, TR_TMPFS_RWTMP_END,
 177                     "tmp_wrtmp_end:vp %p error %d", vp, EINVAL);
 178                 return (EFBIG);
 179         }
 180 
 181         if (uio->uio_resid == 0) {
 182                 TRACE_2(TR_FAC_TMPFS, TR_TMPFS_RWTMP_END,
 183                     "tmp_wrtmp_end:vp %p error %d", vp, 0);
 184                 return (0);
 185         }
 186 
 187         if (limit > MAXOFF_T)
 188                 limit = MAXOFF_T;
 189 
 190         do {
 191                 long    offset;
 192                 long    delta;
 193 
 194                 offset = (long)uio->uio_offset;
 195                 pageoffset = offset & PAGEOFFSET;
 196                 /*
 197                  * A maximum of PAGESIZE bytes of data is transferred
 198                  * each pass through this loop
 199                  */
 200                 bytes = MIN(PAGESIZE - pageoffset, uio->uio_resid);
 201 
 202                 if (offset + bytes >= limit) {
 203                         if (offset >= limit) {
 204                                 error = EFBIG;
 205                                 goto out;
 206                         }
 207                         bytes = limit - offset;
 208                 }
 209                 pagenumber = btop(offset);
 210 
 211                 /*
 212                  * delta is the amount of anonymous memory
 213                  * to reserve for the file.
 214                  * We always reserve in pagesize increments so
 215                  * unless we're extending the file into a new page,
 216                  * we don't need to call tmp_resv.
 217                  */
 218                 delta = offset + bytes -
 219                     P2ROUNDUP_TYPED(tp->tn_size, PAGESIZE, u_offset_t);
 220                 if (delta > 0) {
 221                         pagecreate = 1;
 222                         if (tmp_resv(tm, tp, delta, pagecreate)) {
 223                                 /*
 224                                  * Log file system full in the zone that owns
 225                                  * the tmpfs mount, as well as in the global
 226                                  * zone if necessary.
 227                                  */
 228                                 zcmn_err(tm->tm_vfsp->vfs_zone->zone_id,
 229                                     CE_WARN, "%s: File system full, "
 230                                     "swap space limit exceeded",
 231                                     tm->tm_mntpath);
 232 
 233                                 if (tm->tm_vfsp->vfs_zone->zone_id !=
 234                                     GLOBAL_ZONEID) {
 235 
 236                                         vfs_t *vfs = tm->tm_vfsp;
 237 
 238                                         zcmn_err(GLOBAL_ZONEID,
 239                                             CE_WARN, "%s: File system full, "
 240                                             "swap space limit exceeded",
 241                                             vfs->vfs_vnodecovered->v_path);
 242                                 }
 243                                 error = ENOSPC;
 244                                 break;
 245                         }
 246                         tmpnode_growmap(tp, (ulong_t)offset + bytes);
 247                 }
 248                 /* grow the file to the new length */
 249                 if (offset + bytes > tp->tn_size) {
 250                         tn_size_changed = 1;
 251                         old_tn_size = tp->tn_size;
 252                         /*
 253                          * Postpone updating tp->tn_size until uiomove() is
 254                          * done.
 255                          */
 256                         new_tn_size = offset + bytes;
 257                 }
 258                 if (bytes == PAGESIZE) {
 259                         /*
 260                          * Writing whole page so reading from disk
 261                          * is a waste
 262                          */
 263                         pagecreate = 1;
 264                 } else {
 265                         pagecreate = 0;
 266                 }
 267                 /*
 268                  * If writing past EOF or filling in a hole
 269                  * we need to allocate an anon slot.
 270                  */
 271                 if (anon_get_ptr(tp->tn_anon, pagenumber) == NULL) {
 272                         (void) anon_set_ptr(tp->tn_anon, pagenumber,
 273                             anon_alloc(vp, ptob(pagenumber)), ANON_SLEEP);
 274                         pagecreate = 1;
 275                         tp->tn_nblocks++;
 276                 }
 277 
 278                 /*
 279                  * We have to drop the contents lock to allow the VM
 280                  * system to reacquire it in tmp_getpage()
 281                  */
 282                 rw_exit(&tp->tn_contents);
 283 
 284                 /*
 285                  * Touch the page and fault it in if it is not in core
 286                  * before segmap_getmapflt or vpm_data_copy can lock it.
 287                  * This is to avoid the deadlock if the buffer is mapped
 288                  * to the same file through mmap which we want to write.
 289                  */
 290                 uio_prefaultpages((long)bytes, uio);
 291 
 292                 newpage = 0;
 293                 if (vpm_enable) {
 294                         /*
 295                          * Copy data. If new pages are created, part of
 296                          * the page that is not written will be initizliazed
 297                          * with zeros.
 298                          */
 299                         error = vpm_data_copy(vp, offset, bytes, uio,
 300                             !pagecreate, &newpage, 1, S_WRITE);
 301                 } else {
 302                         /* Get offset within the segmap mapping */
 303                         segmap_offset = (offset & PAGEMASK) & MAXBOFFSET;
 304                         base = segmap_getmapflt(segkmap, vp,
 305                             (offset &  MAXBMASK), PAGESIZE, !pagecreate,
 306                             S_WRITE);
 307                 }
 308 
 309 
 310                 if (!vpm_enable && pagecreate) {
 311                         /*
 312                          * segmap_pagecreate() returns 1 if it calls
 313                          * page_create_va() to allocate any pages.
 314                          */
 315                         newpage = segmap_pagecreate(segkmap,
 316                             base + segmap_offset, (size_t)PAGESIZE, 0);
 317                         /*
 318                          * Clear from the beginning of the page to the starting
 319                          * offset of the data.
 320                          */
 321                         if (pageoffset != 0)
 322                                 (void) kzero(base + segmap_offset,
 323                                     (size_t)pageoffset);
 324                 }
 325 
 326                 if (!vpm_enable) {
 327                         error = uiomove(base + segmap_offset + pageoffset,
 328                             (long)bytes, UIO_WRITE, uio);
 329                 }
 330 
 331                 if (!vpm_enable && pagecreate &&
 332                     uio->uio_offset < P2ROUNDUP(offset + bytes, PAGESIZE)) {
 333                         long    zoffset; /* zero from offset into page */
 334                         /*
 335                          * We created pages w/o initializing them completely,
 336                          * thus we need to zero the part that wasn't set up.
 337                          * This happens on most EOF write cases and if
 338                          * we had some sort of error during the uiomove.
 339                          */
 340                         long nmoved;
 341 
 342                         nmoved = uio->uio_offset - offset;
 343                         ASSERT((nmoved + pageoffset) <= PAGESIZE);
 344 
 345                         /*
 346                          * Zero from the end of data in the page to the
 347                          * end of the page.
 348                          */
 349                         if ((zoffset = pageoffset + nmoved) < PAGESIZE)
 350                                 (void) kzero(base + segmap_offset + zoffset,
 351                                     (size_t)PAGESIZE - zoffset);
 352                 }
 353 
 354                 /*
 355                  * Unlock the pages which have been allocated by
 356                  * page_create_va() in segmap_pagecreate()
 357                  */
 358                 if (!vpm_enable && newpage) {
 359                         segmap_pageunlock(segkmap, base + segmap_offset,
 360                             (size_t)PAGESIZE, S_WRITE);
 361                 }
 362 
 363                 if (error) {
 364                         /*
 365                          * If we failed on a write, we must
 366                          * be sure to invalidate any pages that may have
 367                          * been allocated.
 368                          */
 369                         if (vpm_enable) {
 370                                 (void) vpm_sync_pages(vp, offset, PAGESIZE,
 371                                     SM_INVAL);
 372                         } else {
 373                                 (void) segmap_release(segkmap, base, SM_INVAL);
 374                         }
 375                 } else {
 376                         if (vpm_enable) {
 377                                 error = vpm_sync_pages(vp, offset, PAGESIZE,
 378                                     0);
 379                         } else {
 380                                 error = segmap_release(segkmap, base, 0);
 381                         }
 382                 }
 383 
 384                 /*
 385                  * Re-acquire contents lock.
 386                  */
 387                 rw_enter(&tp->tn_contents, RW_WRITER);
 388 
 389                 /*
 390                  * Update tn_size.
 391                  */
 392                 if (tn_size_changed)
 393                         tp->tn_size = new_tn_size;
 394 
 395                 /*
 396                  * If the uiomove failed, fix up tn_size.
 397                  */
 398                 if (error) {
 399                         if (tn_size_changed) {
 400                                 /*
 401                                  * The uiomove failed, and we
 402                                  * allocated blocks,so get rid
 403                                  * of them.
 404                                  */
 405                                 (void) tmpnode_trunc(tm, tp,
 406                                     (ulong_t)old_tn_size);
 407                         }
 408                 } else {
 409                         /*
 410                          * XXX - Can this be out of the loop?
 411                          */
 412                         if ((tp->tn_mode & (S_IXUSR | S_IXGRP | S_IXOTH)) &&
 413                             (tp->tn_mode & (S_ISUID | S_ISGID)) &&
 414                             secpolicy_vnode_setid_retain(cr,
 415                             (tp->tn_mode & S_ISUID) != 0 && tp->tn_uid == 0)) {
 416                                 /*
 417                                  * Clear Set-UID & Set-GID bits on
 418                                  * successful write if not privileged
 419                                  * and at least one of the execute bits
 420                                  * is set.  If we always clear Set-GID,
 421                                  * mandatory file and record locking is
 422                                  * unuseable.
 423                                  */
 424                                 tp->tn_mode &= ~(S_ISUID | S_ISGID);
 425                         }
 426                         gethrestime(&now);
 427                         tp->tn_mtime = now;
 428                         tp->tn_ctime = now;
 429                 }
 430         } while (error == 0 && uio->uio_resid > 0 && bytes != 0);
 431 
 432 out:
 433         /*
 434          * If we've already done a partial-write, terminate
 435          * the write but return no error.
 436          */
 437         if (oresid != uio->uio_resid)
 438                 error = 0;
 439         TRACE_2(TR_FAC_TMPFS, TR_TMPFS_RWTMP_END,
 440             "tmp_wrtmp_end:vp %p error %d", vp, error);
 441         return (error);
 442 }
 443 
 444 /*
 445  * rdtmp does the real work of read requests for tmpfs.
 446  */
 447 static int
 448 rdtmp(
 449         struct tmount *tm,
 450         struct tmpnode *tp,
 451         struct uio *uio,
 452         struct caller_context *ct)
 453 {
 454         ulong_t pageoffset;     /* offset in tmpfs file (uio_offset) */
 455         ulong_t segmap_offset;  /* pagesize byte offset into segmap */
 456         caddr_t base;           /* base of segmap */
 457         ssize_t bytes;          /* bytes to uiomove */
 458         struct vnode *vp;
 459         int error;
 460         long oresid = uio->uio_resid;
 461 
 462 #if defined(lint)
 463         tm = tm;
 464 #endif
 465         vp = TNTOV(tp);
 466 
 467         TRACE_1(TR_FAC_TMPFS, TR_TMPFS_RWTMP_START, "tmp_rdtmp_start:vp %p",
 468             vp);
 469 
 470         ASSERT(RW_LOCK_HELD(&tp->tn_contents));
 471 
 472         if (MANDLOCK(vp, tp->tn_mode)) {
 473                 rw_exit(&tp->tn_contents);
 474                 /*
 475                  * tmp_getattr ends up being called by chklock
 476                  */
 477                 error = chklock(vp, FREAD, uio->uio_loffset, uio->uio_resid,
 478                     uio->uio_fmode, ct);
 479                 rw_enter(&tp->tn_contents, RW_READER);
 480                 if (error != 0) {
 481                         TRACE_2(TR_FAC_TMPFS, TR_TMPFS_RWTMP_END,
 482                             "tmp_rdtmp_end:vp %p error %d", vp, error);
 483                         return (error);
 484                 }
 485         }
 486         ASSERT(tp->tn_type == VREG);
 487 
 488         if (uio->uio_loffset >= MAXOFF_T) {
 489                 TRACE_2(TR_FAC_TMPFS, TR_TMPFS_RWTMP_END,
 490                     "tmp_rdtmp_end:vp %p error %d", vp, EINVAL);
 491                 return (0);
 492         }
 493         if (uio->uio_loffset < 0)
 494                 return (EINVAL);
 495         if (uio->uio_resid == 0) {
 496                 TRACE_2(TR_FAC_TMPFS, TR_TMPFS_RWTMP_END,
 497                     "tmp_rdtmp_end:vp %p error %d", vp, 0);
 498                 return (0);
 499         }
 500 
 501         vp = TNTOV(tp);
 502 
 503         do {
 504                 long diff;
 505                 long offset;
 506 
 507                 offset = uio->uio_offset;
 508                 pageoffset = offset & PAGEOFFSET;
 509                 bytes = MIN(PAGESIZE - pageoffset, uio->uio_resid);
 510 
 511                 diff = tp->tn_size - offset;
 512 
 513                 if (diff <= 0) {
 514                         error = 0;
 515                         goto out;
 516                 }
 517                 if (diff < bytes)
 518                         bytes = diff;
 519 
 520                 /*
 521                  * We have to drop the contents lock to allow the VM system
 522                  * to reacquire it in tmp_getpage() should the uiomove cause a
 523                  * pagefault.
 524                  */
 525                 rw_exit(&tp->tn_contents);
 526 
 527                 if (vpm_enable) {
 528                         /*
 529                          * Copy data.
 530                          */
 531                         error = vpm_data_copy(vp, offset, bytes, uio, 1, NULL,
 532                             0, S_READ);
 533                 } else {
 534                         segmap_offset = (offset & PAGEMASK) & MAXBOFFSET;
 535                         base = segmap_getmapflt(segkmap, vp, offset & MAXBMASK,
 536                             bytes, 1, S_READ);
 537 
 538                         error = uiomove(base + segmap_offset + pageoffset,
 539                             (long)bytes, UIO_READ, uio);
 540                 }
 541 
 542                 if (error) {
 543                         if (vpm_enable) {
 544                                 (void) vpm_sync_pages(vp, offset, PAGESIZE, 0);
 545                         } else {
 546                                 (void) segmap_release(segkmap, base, 0);
 547                         }
 548                 } else {
 549                         if (vpm_enable) {
 550                                 error = vpm_sync_pages(vp, offset, PAGESIZE,
 551                                     0);
 552                         } else {
 553                                 error = segmap_release(segkmap, base, 0);
 554                         }
 555                 }
 556 
 557                 /*
 558                  * Re-acquire contents lock.
 559                  */
 560                 rw_enter(&tp->tn_contents, RW_READER);
 561 
 562         } while (error == 0 && uio->uio_resid > 0);
 563 
 564 out:
 565         gethrestime(&tp->tn_atime);
 566 
 567         /*
 568          * If we've already done a partial read, terminate
 569          * the read but return no error.
 570          */
 571         if (oresid != uio->uio_resid)
 572                 error = 0;
 573 
 574         TRACE_2(TR_FAC_TMPFS, TR_TMPFS_RWTMP_END,
 575             "tmp_rdtmp_end:vp %x error %d", vp, error);
 576         return (error);
 577 }
 578 
 579 /* ARGSUSED2 */
 580 static int
 581 tmp_read(struct vnode *vp, struct uio *uiop, int ioflag, cred_t *cred,
 582     struct caller_context *ct)
 583 {
 584         struct tmpnode *tp = (struct tmpnode *)VTOTN(vp);
 585         struct tmount *tm = (struct tmount *)VTOTM(vp);
 586         int error;
 587 
 588         /* If the filesystem was umounted by force, return immediately. */
 589         if (vp->v_vfsp->vfs_flag & VFS_UNMOUNTED)
 590                 return (EIO);
 591 
 592         /*
 593          * We don't currently support reading non-regular files
 594          */
 595         if (vp->v_type == VDIR)
 596                 return (EISDIR);
 597         if (vp->v_type != VREG)
 598                 return (EINVAL);
 599         /*
 600          * tmp_rwlock should have already been called from layers above
 601          */
 602         ASSERT(RW_READ_HELD(&tp->tn_rwlock));
 603 
 604         rw_enter(&tp->tn_contents, RW_READER);
 605 
 606         error = rdtmp(tm, tp, uiop, ct);
 607 
 608         rw_exit(&tp->tn_contents);
 609 
 610         return (error);
 611 }
 612 
 613 static int
 614 tmp_write(struct vnode *vp, struct uio *uiop, int ioflag, struct cred *cred,
 615     struct caller_context *ct)
 616 {
 617         struct tmpnode *tp = (struct tmpnode *)VTOTN(vp);
 618         struct tmount *tm = (struct tmount *)VTOTM(vp);
 619         int error;
 620 
 621         /* If the filesystem was umounted by force, return immediately. */
 622         if (vp->v_vfsp->vfs_flag & VFS_UNMOUNTED)
 623                 return (EIO);
 624 
 625         /*
 626          * We don't currently support writing to non-regular files
 627          */
 628         if (vp->v_type != VREG)
 629                 return (EINVAL);        /* XXX EISDIR? */
 630 
 631         /*
 632          * tmp_rwlock should have already been called from layers above
 633          */
 634         ASSERT(RW_WRITE_HELD(&tp->tn_rwlock));
 635 
 636         rw_enter(&tp->tn_contents, RW_WRITER);
 637 
 638         if (ioflag & FAPPEND) {
 639                 /*
 640                  * In append mode start at end of file.
 641                  */
 642                 uiop->uio_loffset = tp->tn_size;
 643         }
 644 
 645         error = wrtmp(tm, tp, uiop, cred, ct);
 646 
 647         rw_exit(&tp->tn_contents);
 648 
 649         return (error);
 650 }
 651 
 652 /* ARGSUSED */
 653 static int
 654 tmp_ioctl(
 655         struct vnode *vp,
 656         int com,
 657         intptr_t data,
 658         int flag,
 659         struct cred *cred,
 660         int *rvalp,
 661         caller_context_t *ct)
 662 {
 663         return (ENOTTY);
 664 }
 665 
 666 /* ARGSUSED2 */
 667 static int
 668 tmp_getattr(
 669         struct vnode *vp,
 670         struct vattr *vap,
 671         int flags,
 672         struct cred *cred,
 673         caller_context_t *ct)
 674 {
 675         struct tmpnode *tp = (struct tmpnode *)VTOTN(vp);
 676         struct vnode *mvp;
 677         struct vattr va;
 678         int attrs = 1;
 679 
 680         /*
 681          * A special case to handle the root tnode on a diskless nfs
 682          * client who may have had its uid and gid inherited
 683          * from an nfs vnode with nobody ownership.  Likely the
 684          * root filesystem. After nfs is fully functional the uid/gid
 685          * may be mapable so ask again.
 686          * vfsp can't get unmounted because we hold vp.
 687          */
 688         if (vp->v_flag & VROOT &&
 689             (mvp = vp->v_vfsp->vfs_vnodecovered) != NULL) {
 690                 mutex_enter(&tp->tn_tlock);
 691                 if (tp->tn_uid == UID_NOBODY || tp->tn_gid == GID_NOBODY) {
 692                         mutex_exit(&tp->tn_tlock);
 693                         bzero(&va, sizeof (struct vattr));
 694                         va.va_mask = AT_UID|AT_GID;
 695                         attrs = VOP_GETATTR(mvp, &va, 0, cred, ct);
 696                 } else {
 697                         mutex_exit(&tp->tn_tlock);
 698                 }
 699         }
 700         mutex_enter(&tp->tn_tlock);
 701         if (attrs == 0) {
 702                 tp->tn_uid = va.va_uid;
 703                 tp->tn_gid = va.va_gid;
 704         }
 705         vap->va_type = vp->v_type;
 706         vap->va_mode = tp->tn_mode & MODEMASK;
 707         vap->va_uid = tp->tn_uid;
 708         vap->va_gid = tp->tn_gid;
 709         vap->va_fsid = tp->tn_fsid;
 710         vap->va_nodeid = (ino64_t)tp->tn_nodeid;
 711         vap->va_nlink = tp->tn_nlink;
 712         vap->va_size = (u_offset_t)tp->tn_size;
 713         vap->va_atime = tp->tn_atime;
 714         vap->va_mtime = tp->tn_mtime;
 715         vap->va_ctime = tp->tn_ctime;
 716         vap->va_blksize = PAGESIZE;
 717         vap->va_rdev = tp->tn_rdev;
 718         vap->va_seq = tp->tn_seq;
 719 
 720         /*
 721          * XXX Holes are not taken into account.  We could take the time to
 722          * run through the anon array looking for allocated slots...
 723          */
 724         vap->va_nblocks = (fsblkcnt64_t)btodb(ptob(btopr(vap->va_size)));
 725         mutex_exit(&tp->tn_tlock);
 726         return (0);
 727 }
 728 
 729 /*ARGSUSED4*/
 730 static int
 731 tmp_setattr(
 732         struct vnode *vp,
 733         struct vattr *vap,
 734         int flags,
 735         struct cred *cred,
 736         caller_context_t *ct)
 737 {
 738         struct tmount *tm = (struct tmount *)VTOTM(vp);
 739         struct tmpnode *tp = (struct tmpnode *)VTOTN(vp);
 740         int error = 0;
 741         struct vattr *get;
 742         long mask;
 743 
 744         /*
 745          * Cannot set these attributes
 746          */
 747         if ((vap->va_mask & AT_NOSET) || (vap->va_mask & AT_XVATTR))
 748                 return (EINVAL);
 749 
 750         mutex_enter(&tp->tn_tlock);
 751 
 752         get = &tp->tn_attr;
 753         /*
 754          * Change file access modes. Must be owner or have sufficient
 755          * privileges.
 756          */
 757         error = secpolicy_vnode_setattr(cred, vp, vap, get, flags, tmp_taccess,
 758             tp);
 759 
 760         if (error)
 761                 goto out;
 762 
 763         mask = vap->va_mask;
 764 
 765         if (mask & AT_MODE) {
 766                 get->va_mode &= S_IFMT;
 767                 get->va_mode |= vap->va_mode & ~S_IFMT;
 768         }
 769 
 770         if (mask & AT_UID)
 771                 get->va_uid = vap->va_uid;
 772         if (mask & AT_GID)
 773                 get->va_gid = vap->va_gid;
 774         if (mask & AT_ATIME)
 775                 get->va_atime = vap->va_atime;
 776         if (mask & AT_MTIME)
 777                 get->va_mtime = vap->va_mtime;
 778 
 779         if (mask & (AT_UID | AT_GID | AT_MODE | AT_MTIME))
 780                 gethrestime(&tp->tn_ctime);
 781 
 782         if (mask & AT_SIZE) {
 783                 ASSERT(vp->v_type != VDIR);
 784 
 785                 /* Don't support large files. */
 786                 if (vap->va_size > MAXOFF_T) {
 787                         error = EFBIG;
 788                         goto out;
 789                 }
 790                 mutex_exit(&tp->tn_tlock);
 791 
 792                 rw_enter(&tp->tn_rwlock, RW_WRITER);
 793                 rw_enter(&tp->tn_contents, RW_WRITER);
 794                 error = tmpnode_trunc(tm, tp, (ulong_t)vap->va_size);
 795                 rw_exit(&tp->tn_contents);
 796                 rw_exit(&tp->tn_rwlock);
 797 
 798                 if (error == 0) {
 799                         if (vap->va_size == 0) {
 800                                 vnevent_truncate(vp, ct);
 801                         } else {
 802                                 vnevent_resize(vp, ct);
 803                         }
 804                 }
 805 
 806                 goto out1;
 807         }
 808 out:
 809         mutex_exit(&tp->tn_tlock);
 810 out1:
 811         return (error);
 812 }
 813 
 814 /* ARGSUSED2 */
 815 static int
 816 tmp_access(
 817         struct vnode *vp,
 818         int mode,
 819         int flags,
 820         struct cred *cred,
 821         caller_context_t *ct)
 822 {
 823         struct tmpnode *tp = (struct tmpnode *)VTOTN(vp);
 824         int error;
 825 
 826         mutex_enter(&tp->tn_tlock);
 827         error = tmp_taccess(tp, mode, cred);
 828         mutex_exit(&tp->tn_tlock);
 829         return (error);
 830 }
 831 
 832 /* ARGSUSED3 */
 833 static int
 834 tmp_lookup(
 835         struct vnode *dvp,
 836         char *nm,
 837         struct vnode **vpp,
 838         struct pathname *pnp,
 839         int flags,
 840         struct vnode *rdir,
 841         struct cred *cred,
 842         caller_context_t *ct,
 843         int *direntflags,
 844         pathname_t *realpnp)
 845 {
 846         struct tmpnode *tp = (struct tmpnode *)VTOTN(dvp);
 847         struct tmpnode *ntp = NULL;
 848         int error;
 849 
 850         /* If the filesystem was umounted by force, return immediately. */
 851         if (dvp->v_vfsp->vfs_flag & VFS_UNMOUNTED)
 852                 return (EIO);
 853 
 854         /* allow cd into @ dir */
 855         if (flags & LOOKUP_XATTR) {
 856                 struct tmpnode *xdp;
 857                 struct tmount *tm;
 858 
 859                 /*
 860                  * don't allow attributes if not mounted XATTR support
 861                  */
 862                 if (!(dvp->v_vfsp->vfs_flag & VFS_XATTR))
 863                         return (EINVAL);
 864 
 865                 if (tp->tn_flags & ISXATTR)
 866                         /* No attributes on attributes */
 867                         return (EINVAL);
 868 
 869                 rw_enter(&tp->tn_rwlock, RW_WRITER);
 870                 if (tp->tn_xattrdp == NULL) {
 871                         int err;
 872 
 873                         if (!(flags & CREATE_XATTR_DIR)) {
 874                                 rw_exit(&tp->tn_rwlock);
 875                                 return (ENOENT);
 876                         }
 877 
 878                         /*
 879                          * No attribute directory exists for this
 880                          * node - create the attr dir as a side effect
 881                          * of this lookup.
 882                          */
 883 
 884                         /*
 885                          * Make sure we have adequate permission...
 886                          */
 887 
 888                         if ((error = tmp_taccess(tp, VWRITE, cred)) != 0) {
 889                                 rw_exit(&tp->tn_rwlock);
 890                                 return (error);
 891                         }
 892 
 893                         tm = VTOTM(dvp);
 894                         xdp = tmp_kmem_zalloc(tm, sizeof (struct tmpnode),
 895                             KM_SLEEP);
 896                         if (xdp == NULL) {
 897                                 rw_exit(&tp->tn_rwlock);
 898                                 return (ENOSPC);
 899                         }
 900                         tmpnode_init(tm, xdp, &tp->tn_attr, NULL);
 901                         /*
 902                          * Fix-up fields unique to attribute directories.
 903                          */
 904                         xdp->tn_flags = ISXATTR;
 905                         xdp->tn_type = VDIR;
 906                         if (tp->tn_type == VDIR) {
 907                                 xdp->tn_mode = tp->tn_attr.va_mode;
 908                         } else {
 909                                 xdp->tn_mode = 0700;
 910                                 if (tp->tn_attr.va_mode & 0040)
 911                                         xdp->tn_mode |= 0750;
 912                                 if (tp->tn_attr.va_mode & 0004)
 913                                         xdp->tn_mode |= 0705;
 914                         }
 915                         xdp->tn_vnode->v_type = VDIR;
 916                         xdp->tn_vnode->v_flag |= V_XATTRDIR;
 917                         if ((err = tdirinit(tp, xdp)) != 0) {
 918                                 rw_exit(&tp->tn_rwlock);
 919                                 /*
 920                                  * This never got properly initialized so we can
 921                                  * just clean it up.
 922                                  */
 923                                 xdp->tn_vnode->v_flag &= V_XATTRDIR;
 924                                 tmpnode_cleanup(tp);
 925                                 return (err);
 926                         }
 927                         tp->tn_xattrdp = xdp;
 928                 } else {
 929                         VN_HOLD(tp->tn_xattrdp->tn_vnode);
 930                 }
 931                 *vpp = TNTOV(tp->tn_xattrdp);
 932                 rw_exit(&tp->tn_rwlock);
 933                 return (0);
 934         }
 935 
 936         /*
 937          * Null component name is a synonym for directory being searched.
 938          */
 939         if (*nm == '\0') {
 940                 VN_HOLD(dvp);
 941                 *vpp = dvp;
 942                 return (0);
 943         }
 944         ASSERT(tp);
 945 
 946         error = tdirlookup(tp, nm, &ntp, cred);
 947 
 948         if (error == 0) {
 949                 ASSERT(ntp);
 950                 *vpp = TNTOV(ntp);
 951                 /*
 952                  * If vnode is a device return special vnode instead
 953                  */
 954                 if (IS_DEVVP(*vpp)) {
 955                         struct vnode *newvp;
 956 
 957                         newvp = specvp(*vpp, (*vpp)->v_rdev, (*vpp)->v_type,
 958                             cred);
 959                         VN_RELE(*vpp);
 960                         *vpp = newvp;
 961                 }
 962         }
 963         TRACE_4(TR_FAC_TMPFS, TR_TMPFS_LOOKUP,
 964             "tmpfs lookup:vp %p name %s vpp %p error %d",
 965             dvp, nm, vpp, error);
 966         return (error);
 967 }
 968 
 969 /*ARGSUSED7*/
 970 static int
 971 tmp_create(
 972         struct vnode *dvp,
 973         char *nm,
 974         struct vattr *vap,
 975         enum vcexcl exclusive,
 976         int mode,
 977         struct vnode **vpp,
 978         struct cred *cred,
 979         int flag,
 980         caller_context_t *ct,
 981         vsecattr_t *vsecp)
 982 {
 983         struct tmpnode *parent;
 984         struct tmount *tm;
 985         struct tmpnode *self;
 986         int error;
 987         struct tmpnode *oldtp;
 988 
 989 again:
 990         parent = (struct tmpnode *)VTOTN(dvp);
 991         tm = (struct tmount *)VTOTM(dvp);
 992         self = NULL;
 993         error = 0;
 994         oldtp = NULL;
 995 
 996         /* device files not allowed in ext. attr dirs */
 997         if ((parent->tn_flags & ISXATTR) &&
 998             (vap->va_type == VBLK || vap->va_type == VCHR ||
 999             vap->va_type == VFIFO || vap->va_type == VDOOR ||
1000             vap->va_type == VSOCK || vap->va_type == VPORT))
1001                         return (EINVAL);
1002 
1003         if (vap->va_type == VREG && (vap->va_mode & VSVTX)) {
1004                 /* Must be privileged to set sticky bit */
1005                 if (secpolicy_vnode_stky_modify(cred))
1006                         vap->va_mode &= ~VSVTX;
1007         } else if (vap->va_type == VNON) {
1008                 return (EINVAL);
1009         }
1010 
1011         /*
1012          * Null component name is a synonym for directory being searched.
1013          */
1014         if (*nm == '\0') {
1015                 VN_HOLD(dvp);
1016                 oldtp = parent;
1017         } else {
1018                 error = tdirlookup(parent, nm, &oldtp, cred);
1019         }
1020 
1021         if (error == 0) {       /* name found */
1022                 boolean_t trunc = B_FALSE;
1023 
1024                 ASSERT(oldtp);
1025 
1026                 rw_enter(&oldtp->tn_rwlock, RW_WRITER);
1027 
1028                 /*
1029                  * if create/read-only an existing
1030                  * directory, allow it
1031                  */
1032                 if (exclusive == EXCL)
1033                         error = EEXIST;
1034                 else if ((oldtp->tn_type == VDIR) && (mode & VWRITE))
1035                         error = EISDIR;
1036                 else {
1037                         error = tmp_taccess(oldtp, mode, cred);
1038                 }
1039 
1040                 if (error) {
1041                         rw_exit(&oldtp->tn_rwlock);
1042                         tmpnode_rele(oldtp);
1043                         return (error);
1044                 }
1045                 *vpp = TNTOV(oldtp);
1046                 if ((*vpp)->v_type == VREG && (vap->va_mask & AT_SIZE) &&
1047                     vap->va_size == 0) {
1048                         rw_enter(&oldtp->tn_contents, RW_WRITER);
1049                         (void) tmpnode_trunc(tm, oldtp, 0);
1050                         rw_exit(&oldtp->tn_contents);
1051                         trunc = B_TRUE;
1052                 }
1053                 rw_exit(&oldtp->tn_rwlock);
1054                 if (IS_DEVVP(*vpp)) {
1055                         struct vnode *newvp;
1056 
1057                         newvp = specvp(*vpp, (*vpp)->v_rdev, (*vpp)->v_type,
1058                             cred);
1059                         VN_RELE(*vpp);
1060                         if (newvp == NULL) {
1061                                 return (ENOSYS);
1062                         }
1063                         *vpp = newvp;
1064                 }
1065 
1066                 if (trunc)
1067                         vnevent_create(*vpp, ct);
1068 
1069                 return (0);
1070         }
1071 
1072         if (error != ENOENT)
1073                 return (error);
1074 
1075         rw_enter(&parent->tn_rwlock, RW_WRITER);
1076         error = tdirenter(tm, parent, nm, DE_CREATE,
1077             (struct tmpnode *)NULL, (struct tmpnode *)NULL,
1078             vap, &self, cred, ct);
1079         rw_exit(&parent->tn_rwlock);
1080 
1081         if (error) {
1082                 if (self)
1083                         tmpnode_rele(self);
1084 
1085                 if (error == EEXIST) {
1086                         /*
1087                          * This means that the file was created sometime
1088                          * after we checked and did not find it and when
1089                          * we went to create it.
1090                          * Since creat() is supposed to truncate a file
1091                          * that already exits go back to the begining
1092                          * of the function. This time we will find it
1093                          * and go down the tmp_trunc() path
1094                          */
1095                         goto again;
1096                 }
1097                 return (error);
1098         }
1099 
1100         *vpp = TNTOV(self);
1101 
1102         if (!error && IS_DEVVP(*vpp)) {
1103                 struct vnode *newvp;
1104 
1105                 newvp = specvp(*vpp, (*vpp)->v_rdev, (*vpp)->v_type, cred);
1106                 VN_RELE(*vpp);
1107                 if (newvp == NULL)
1108                         return (ENOSYS);
1109                 *vpp = newvp;
1110         }
1111         TRACE_3(TR_FAC_TMPFS, TR_TMPFS_CREATE,
1112             "tmpfs create:dvp %p nm %s vpp %p", dvp, nm, vpp);
1113         return (0);
1114 }
1115 
1116 /* ARGSUSED3 */
1117 static int
1118 tmp_remove(
1119         struct vnode *dvp,
1120         char *nm,
1121         struct cred *cred,
1122         caller_context_t *ct,
1123         int flags)
1124 {
1125         struct tmpnode *parent = (struct tmpnode *)VTOTN(dvp);
1126         int error;
1127         struct tmpnode *tp = NULL;
1128 
1129         error = tdirlookup(parent, nm, &tp, cred);
1130         if (error)
1131                 return (error);
1132 
1133         ASSERT(tp);
1134         rw_enter(&parent->tn_rwlock, RW_WRITER);
1135         rw_enter(&tp->tn_rwlock, RW_WRITER);
1136 
1137         if (tp->tn_type != VDIR ||
1138             (error = secpolicy_fs_linkdir(cred, dvp->v_vfsp)) == 0)
1139                 error = tdirdelete(parent, tp, nm, tp->tn_type == VDIR ?
1140                     DR_RMDIR : DR_REMOVE, cred);
1141 
1142         rw_exit(&tp->tn_rwlock);
1143         rw_exit(&parent->tn_rwlock);
1144         vnevent_remove(TNTOV(tp), dvp, nm, ct);
1145         tmpnode_rele(tp);
1146 
1147         TRACE_3(TR_FAC_TMPFS, TR_TMPFS_REMOVE,
1148             "tmpfs remove:dvp %p nm %s error %d", dvp, nm, error);
1149         return (error);
1150 }
1151 
1152 /* ARGSUSED4 */
1153 static int
1154 tmp_link(
1155         struct vnode *dvp,
1156         struct vnode *srcvp,
1157         char *tnm,
1158         struct cred *cred,
1159         caller_context_t *ct,
1160         int flags)
1161 {
1162         struct tmpnode *parent;
1163         struct tmpnode *from;
1164         struct tmount *tm = (struct tmount *)VTOTM(dvp);
1165         int error;
1166         struct tmpnode *found = NULL;
1167         struct vnode *realvp;
1168 
1169         if (VOP_REALVP(srcvp, &realvp, ct) == 0)
1170                 srcvp = realvp;
1171 
1172         parent = (struct tmpnode *)VTOTN(dvp);
1173         from = (struct tmpnode *)VTOTN(srcvp);
1174 
1175         if ((srcvp->v_type == VDIR &&
1176             secpolicy_fs_linkdir(cred, dvp->v_vfsp)) ||
1177             (from->tn_uid != crgetuid(cred) && secpolicy_basic_link(cred)))
1178                 return (EPERM);
1179 
1180         /*
1181          * Make sure link for extended attributes is valid
1182          * We only support hard linking of xattr's in xattrdir to an xattrdir
1183          */
1184         if ((from->tn_flags & ISXATTR) != (parent->tn_flags & ISXATTR))
1185                 return (EINVAL);
1186 
1187         error = tdirlookup(parent, tnm, &found, cred);
1188         if (error == 0) {
1189                 ASSERT(found);
1190                 tmpnode_rele(found);
1191                 return (EEXIST);
1192         }
1193 
1194         if (error != ENOENT)
1195                 return (error);
1196 
1197         rw_enter(&parent->tn_rwlock, RW_WRITER);
1198         error = tdirenter(tm, parent, tnm, DE_LINK, (struct tmpnode *)NULL,
1199             from, NULL, (struct tmpnode **)NULL, cred, ct);
1200         rw_exit(&parent->tn_rwlock);
1201         if (error == 0) {
1202                 vnevent_link(srcvp, ct);
1203         }
1204         return (error);
1205 }
1206 
1207 /* ARGSUSED5 */
1208 static int
1209 tmp_rename(
1210         struct vnode *odvp,     /* source parent vnode */
1211         char *onm,              /* source name */
1212         struct vnode *ndvp,     /* destination parent vnode */
1213         char *nnm,              /* destination name */
1214         struct cred *cred,
1215         caller_context_t *ct,
1216         int flags)
1217 {
1218         struct tmpnode *fromparent;
1219         struct tmpnode *toparent;
1220         struct tmpnode *fromtp = NULL;  /* source tmpnode */
1221         struct tmpnode *totp;           /* target tmpnode */
1222         struct tmount *tm = (struct tmount *)VTOTM(odvp);
1223         int error;
1224         int samedir = 0;        /* set if odvp == ndvp */
1225         struct vnode *realvp;
1226 
1227         if (VOP_REALVP(ndvp, &realvp, ct) == 0)
1228                 ndvp = realvp;
1229 
1230         fromparent = (struct tmpnode *)VTOTN(odvp);
1231         toparent = (struct tmpnode *)VTOTN(ndvp);
1232 
1233         if ((fromparent->tn_flags & ISXATTR) != (toparent->tn_flags & ISXATTR))
1234                 return (EINVAL);
1235 
1236         mutex_enter(&tm->tm_renamelck);
1237 
1238         /*
1239          * Look up tmpnode of file we're supposed to rename.
1240          */
1241         error = tdirlookup(fromparent, onm, &fromtp, cred);
1242         if (error) {
1243                 mutex_exit(&tm->tm_renamelck);
1244                 return (error);
1245         }
1246 
1247         /*
1248          * Make sure we can delete the old (source) entry.  This
1249          * requires write permission on the containing directory.  If
1250          * that directory is "sticky" it requires further checks.
1251          */
1252         if (((error = tmp_taccess(fromparent, VWRITE, cred)) != 0) ||
1253             (error = tmp_sticky_remove_access(fromparent, fromtp, cred)) != 0)
1254                 goto done;
1255 
1256         /*
1257          * Check for renaming to or from '.' or '..' or that
1258          * fromtp == fromparent
1259          */
1260         if ((onm[0] == '.' &&
1261             (onm[1] == '\0' || (onm[1] == '.' && onm[2] == '\0'))) ||
1262             (nnm[0] == '.' &&
1263             (nnm[1] == '\0' || (nnm[1] == '.' && nnm[2] == '\0'))) ||
1264             (fromparent == fromtp)) {
1265                 error = EINVAL;
1266                 goto done;
1267         }
1268 
1269         samedir = (fromparent == toparent);
1270         /*
1271          * Make sure we can search and rename into the new
1272          * (destination) directory.
1273          */
1274         if (!samedir) {
1275                 error = tmp_taccess(toparent, VEXEC|VWRITE, cred);
1276                 if (error)
1277                         goto done;
1278         }
1279 
1280         if (tdirlookup(toparent, nnm, &totp, cred) == 0) {
1281                 vnevent_pre_rename_dest(TNTOV(totp), ndvp, nnm, ct);
1282                 tmpnode_rele(totp);
1283         }
1284 
1285         /* Notify the target dir. if not the same as the source dir. */
1286         if (ndvp != odvp) {
1287                 vnevent_pre_rename_dest_dir(ndvp, TNTOV(fromtp), nnm, ct);
1288         }
1289 
1290         vnevent_pre_rename_src(TNTOV(fromtp), odvp, onm, ct);
1291 
1292         /*
1293          * Link source to new target
1294          */
1295         rw_enter(&toparent->tn_rwlock, RW_WRITER);
1296         error = tdirenter(tm, toparent, nnm, DE_RENAME,
1297             fromparent, fromtp, (struct vattr *)NULL,
1298             (struct tmpnode **)NULL, cred, ct);
1299         rw_exit(&toparent->tn_rwlock);
1300 
1301         if (error) {
1302                 /*
1303                  * ESAME isn't really an error; it indicates that the
1304                  * operation should not be done because the source and target
1305                  * are the same file, but that no error should be reported.
1306                  */
1307                 if (error == ESAME)
1308                         error = 0;
1309                 goto done;
1310         }
1311 
1312         /*
1313          * Unlink from source.
1314          */
1315         rw_enter(&fromparent->tn_rwlock, RW_WRITER);
1316         rw_enter(&fromtp->tn_rwlock, RW_WRITER);
1317 
1318         error = tdirdelete(fromparent, fromtp, onm, DR_RENAME, cred);
1319 
1320         /*
1321          * The following handles the case where our source tmpnode was
1322          * removed before we got to it.
1323          *
1324          * XXX We should also cleanup properly in the case where tdirdelete
1325          * fails for some other reason.  Currently this case shouldn't happen.
1326          * (see 1184991).
1327          */
1328         if (error == ENOENT)
1329                 error = 0;
1330 
1331         rw_exit(&fromtp->tn_rwlock);
1332         rw_exit(&fromparent->tn_rwlock);
1333 
1334         if (error == 0) {
1335                 vnevent_rename_src(TNTOV(fromtp), odvp, onm, ct);
1336                 /*
1337                  * vnevent_rename_dest is called in tdirenter().
1338                  */
1339                 vnevent_rename_dest_dir(ndvp, TNTOV(fromtp), nnm, ct);
1340         }
1341 
1342 done:
1343         tmpnode_rele(fromtp);
1344         mutex_exit(&tm->tm_renamelck);
1345 
1346         TRACE_5(TR_FAC_TMPFS, TR_TMPFS_RENAME,
1347             "tmpfs rename:ovp %p onm %s nvp %p nnm %s error %d", odvp, onm,
1348             ndvp, nnm, error);
1349         return (error);
1350 }
1351 
1352 /* ARGSUSED5 */
1353 static int
1354 tmp_mkdir(
1355         struct vnode *dvp,
1356         char *nm,
1357         struct vattr *va,
1358         struct vnode **vpp,
1359         struct cred *cred,
1360         caller_context_t *ct,
1361         int flags,
1362         vsecattr_t *vsecp)
1363 {
1364         struct tmpnode *parent = (struct tmpnode *)VTOTN(dvp);
1365         struct tmpnode *self = NULL;
1366         struct tmount *tm = (struct tmount *)VTOTM(dvp);
1367         int error;
1368 
1369         /* no new dirs allowed in xattr dirs */
1370         if (parent->tn_flags & ISXATTR)
1371                 return (EINVAL);
1372 
1373         /*
1374          * Might be dangling directory.  Catch it here,
1375          * because a ENOENT return from tdirlookup() is
1376          * an "o.k. return".
1377          */
1378         if (parent->tn_nlink == 0)
1379                 return (ENOENT);
1380 
1381         error = tdirlookup(parent, nm, &self, cred);
1382         if (error == 0) {
1383                 ASSERT(self);
1384                 tmpnode_rele(self);
1385                 return (EEXIST);
1386         }
1387         if (error != ENOENT)
1388                 return (error);
1389 
1390         rw_enter(&parent->tn_rwlock, RW_WRITER);
1391         error = tdirenter(tm, parent, nm, DE_MKDIR, (struct tmpnode *)NULL,
1392             (struct tmpnode *)NULL, va, &self, cred, ct);
1393         if (error) {
1394                 rw_exit(&parent->tn_rwlock);
1395                 if (self)
1396                         tmpnode_rele(self);
1397                 return (error);
1398         }
1399         rw_exit(&parent->tn_rwlock);
1400         *vpp = TNTOV(self);
1401         return (0);
1402 }
1403 
1404 /* ARGSUSED4 */
1405 static int
1406 tmp_rmdir(
1407         struct vnode *dvp,
1408         char *nm,
1409         struct vnode *cdir,
1410         struct cred *cred,
1411         caller_context_t *ct,
1412         int flags)
1413 {
1414         struct tmpnode *parent = (struct tmpnode *)VTOTN(dvp);
1415         struct tmpnode *self = NULL;
1416         struct vnode *vp;
1417         int error = 0;
1418 
1419         /*
1420          * Return error when removing . and ..
1421          */
1422         if (strcmp(nm, ".") == 0)
1423                 return (EINVAL);
1424         if (strcmp(nm, "..") == 0)
1425                 return (EEXIST); /* Should be ENOTEMPTY */
1426         error = tdirlookup(parent, nm, &self, cred);
1427         if (error)
1428                 return (error);
1429 
1430         rw_enter(&parent->tn_rwlock, RW_WRITER);
1431         rw_enter(&self->tn_rwlock, RW_WRITER);
1432 
1433         vp = TNTOV(self);
1434         if (vp == dvp || vp == cdir) {
1435                 error = EINVAL;
1436                 goto done1;
1437         }
1438         if (self->tn_type != VDIR) {
1439                 error = ENOTDIR;
1440                 goto done1;
1441         }
1442 
1443         mutex_enter(&self->tn_tlock);
1444         if (self->tn_nlink > 2) {
1445                 mutex_exit(&self->tn_tlock);
1446                 error = EEXIST;
1447                 goto done1;
1448         }
1449         mutex_exit(&self->tn_tlock);
1450 
1451         if (vn_vfswlock(vp)) {
1452                 error = EBUSY;
1453                 goto done1;
1454         }
1455         if (vn_mountedvfs(vp) != NULL) {
1456                 error = EBUSY;
1457                 goto done;
1458         }
1459 
1460         /*
1461          * Check for an empty directory
1462          * i.e. only includes entries for "." and ".."
1463          */
1464         if (self->tn_dirents > 2) {
1465                 error = EEXIST;         /* SIGH should be ENOTEMPTY */
1466                 /*
1467                  * Update atime because checking tn_dirents is logically
1468                  * equivalent to reading the directory
1469                  */
1470                 gethrestime(&self->tn_atime);
1471                 goto done;
1472         }
1473 
1474         error = tdirdelete(parent, self, nm, DR_RMDIR, cred);
1475 done:
1476         vn_vfsunlock(vp);
1477 done1:
1478         rw_exit(&self->tn_rwlock);
1479         rw_exit(&parent->tn_rwlock);
1480         vnevent_rmdir(TNTOV(self), dvp, nm, ct);
1481         tmpnode_rele(self);
1482 
1483         return (error);
1484 }
1485 
1486 /* ARGSUSED2 */
1487 static int
1488 tmp_readdir(
1489         struct vnode *vp,
1490         struct uio *uiop,
1491         struct cred *cred,
1492         int *eofp,
1493         caller_context_t *ct,
1494         int flags)
1495 {
1496         struct tmpnode *tp = (struct tmpnode *)VTOTN(vp);
1497         struct tdirent *tdp;
1498         int error = 0;
1499         size_t namelen;
1500         struct dirent64 *dp;
1501         ulong_t offset;
1502         ulong_t total_bytes_wanted;
1503         long outcount = 0;
1504         long bufsize;
1505         int reclen;
1506         caddr_t outbuf;
1507 
1508         /* If the filesystem was umounted by force, return immediately. */
1509         if (vp->v_vfsp->vfs_flag & VFS_UNMOUNTED)
1510                 return (EIO);
1511 
1512         if (uiop->uio_loffset >= MAXOFF_T) {
1513                 if (eofp)
1514                         *eofp = 1;
1515                 return (0);
1516         }
1517         /*
1518          * assuming system call has already called tmp_rwlock
1519          */
1520         ASSERT(RW_READ_HELD(&tp->tn_rwlock));
1521 
1522         if (uiop->uio_iovcnt != 1)
1523                 return (EINVAL);
1524 
1525         if (vp->v_type != VDIR)
1526                 return (ENOTDIR);
1527 
1528         /*
1529          * There's a window here where someone could have removed
1530          * all the entries in the directory after we put a hold on the
1531          * vnode but before we grabbed the rwlock.  Just return.
1532          */
1533         if (tp->tn_dir == NULL) {
1534                 if (tp->tn_nlink) {
1535                         panic("empty directory 0x%p", (void *)tp);
1536                         /*NOTREACHED*/
1537                 }
1538                 return (0);
1539         }
1540 
1541         /*
1542          * Get space for multiple directory entries
1543          */
1544         total_bytes_wanted = uiop->uio_iov->iov_len;
1545         bufsize = total_bytes_wanted + sizeof (struct dirent64);
1546         outbuf = kmem_alloc(bufsize, KM_SLEEP);
1547 
1548         dp = (struct dirent64 *)outbuf;
1549 
1550 
1551         offset = 0;
1552         tdp = tp->tn_dir;
1553         while (tdp) {
1554                 namelen = strlen(tdp->td_name);      /* no +1 needed */
1555                 offset = tdp->td_offset;
1556                 if (offset >= uiop->uio_offset) {
1557                         reclen = (int)DIRENT64_RECLEN(namelen);
1558                         if (outcount + reclen > total_bytes_wanted) {
1559                                 if (!outcount)
1560                                         /*
1561                                          * Buffer too small for any entries.
1562                                          */
1563                                         error = EINVAL;
1564                                 break;
1565                         }
1566                         ASSERT(tdp->td_tmpnode != NULL);
1567 
1568                         /* use strncpy(9f) to zero out uninitialized bytes */
1569 
1570                         (void) strncpy(dp->d_name, tdp->td_name,
1571                             DIRENT64_NAMELEN(reclen));
1572                         dp->d_reclen = (ushort_t)reclen;
1573                         dp->d_ino = (ino64_t)tdp->td_tmpnode->tn_nodeid;
1574                         dp->d_off = (offset_t)tdp->td_offset + 1;
1575                         dp = (struct dirent64 *)
1576                             ((uintptr_t)dp + dp->d_reclen);
1577                         outcount += reclen;
1578                         ASSERT(outcount <= bufsize);
1579                 }
1580                 tdp = tdp->td_next;
1581         }
1582 
1583         if (!error)
1584                 error = uiomove(outbuf, outcount, UIO_READ, uiop);
1585 
1586         if (!error) {
1587                 /* If we reached the end of the list our offset */
1588                 /* should now be just past the end. */
1589                 if (!tdp) {
1590                         offset += 1;
1591                         if (eofp)
1592                                 *eofp = 1;
1593                 } else if (eofp)
1594                         *eofp = 0;
1595                 uiop->uio_offset = offset;
1596         }
1597         gethrestime(&tp->tn_atime);
1598         kmem_free(outbuf, bufsize);
1599         return (error);
1600 }
1601 
1602 /* ARGSUSED5 */
1603 static int
1604 tmp_symlink(
1605         struct vnode *dvp,
1606         char *lnm,
1607         struct vattr *tva,
1608         char *tnm,
1609         struct cred *cred,
1610         caller_context_t *ct,
1611         int flags)
1612 {
1613         struct tmpnode *parent = (struct tmpnode *)VTOTN(dvp);
1614         struct tmpnode *self = (struct tmpnode *)NULL;
1615         struct tmount *tm = (struct tmount *)VTOTM(dvp);
1616         char *cp = NULL;
1617         int error;
1618         size_t len;
1619 
1620         /* no symlinks allowed to files in xattr dirs */
1621         if (parent->tn_flags & ISXATTR)
1622                 return (EINVAL);
1623 
1624         error = tdirlookup(parent, lnm, &self, cred);
1625         if (error == 0) {
1626                 /*
1627                  * The entry already exists
1628                  */
1629                 tmpnode_rele(self);
1630                 return (EEXIST);        /* was 0 */
1631         }
1632 
1633         if (error != ENOENT) {
1634                 if (self != NULL)
1635                         tmpnode_rele(self);
1636                 return (error);
1637         }
1638 
1639         rw_enter(&parent->tn_rwlock, RW_WRITER);
1640         error = tdirenter(tm, parent, lnm, DE_CREATE, (struct tmpnode *)NULL,
1641             (struct tmpnode *)NULL, tva, &self, cred, ct);
1642         rw_exit(&parent->tn_rwlock);
1643 
1644         if (error) {
1645                 if (self != NULL)
1646                         tmpnode_rele(self);
1647                 return (error);
1648         }
1649         len = strlen(tnm) + 1;
1650         cp = tmp_kmem_zalloc(tm, len, KM_NOSLEEP | KM_NORMALPRI);
1651         if (cp == NULL) {
1652                 tmpnode_rele(self);
1653                 return (ENOSPC);
1654         }
1655         (void) strcpy(cp, tnm);
1656 
1657         self->tn_symlink = cp;
1658         self->tn_size = len - 1;
1659         tmpnode_rele(self);
1660         return (error);
1661 }
1662 
1663 /* ARGSUSED2 */
1664 static int
1665 tmp_readlink(
1666         struct vnode *vp,
1667         struct uio *uiop,
1668         struct cred *cred,
1669         caller_context_t *ct)
1670 {
1671         struct tmpnode *tp = (struct tmpnode *)VTOTN(vp);
1672         int error = 0;
1673 
1674         if (vp->v_type != VLNK)
1675                 return (EINVAL);
1676 
1677         rw_enter(&tp->tn_rwlock, RW_READER);
1678         rw_enter(&tp->tn_contents, RW_READER);
1679         error = uiomove(tp->tn_symlink, tp->tn_size, UIO_READ, uiop);
1680         gethrestime(&tp->tn_atime);
1681         rw_exit(&tp->tn_contents);
1682         rw_exit(&tp->tn_rwlock);
1683         return (error);
1684 }
1685 
1686 /* ARGSUSED */
1687 static int
1688 tmp_fsync(
1689         struct vnode *vp,
1690         int syncflag,
1691         struct cred *cred,
1692         caller_context_t *ct)
1693 {
1694         return (0);
1695 }
1696 
1697 /* ARGSUSED */
1698 static void
1699 tmp_inactive(struct vnode *vp, struct cred *cred, caller_context_t *ct)
1700 {
1701         struct tmpnode *tp = (struct tmpnode *)VTOTN(vp);
1702         struct tmount *tm = (struct tmount *)VFSTOTM(vp->v_vfsp);
1703 
1704         rw_enter(&tp->tn_rwlock, RW_WRITER);
1705 top:
1706         mutex_enter(&tp->tn_tlock);
1707         mutex_enter(&vp->v_lock);
1708         ASSERT(vp->v_count >= 1);
1709 
1710         /*
1711          * If we don't have the last hold or the link count is non-zero,
1712          * there's little to do -- just drop our hold.
1713          */
1714         if (vp->v_count > 1 || tp->tn_nlink != 0) {
1715                 if (vp->v_vfsp->vfs_flag & VFS_UNMOUNTED) {
1716                         /*
1717                          * Since the file system was forcibly unmounted, we can
1718                          * have a case (v_count == 1, tn_nlink != 0) where this
1719                          * file was open so we didn't add an extra hold on the
1720                          * file in tmp_unmount. We are counting on the
1721                          * interaction of the hold made in tmp_unmount and
1722                          * rele-ed in tmp_vfsfree so we need to be sure we
1723                          * don't decrement in this case.
1724                          */
1725                         if (vp->v_count > 1)
1726                                 vp->v_count--;
1727                 } else {
1728                         vp->v_count--;
1729                 }
1730                 mutex_exit(&vp->v_lock);
1731                 mutex_exit(&tp->tn_tlock);
1732                 rw_exit(&tp->tn_rwlock);
1733                 /* If the filesystem was umounted by force, rele the vfs ref */
1734                 if (tm->tm_vfsp->vfs_flag & VFS_UNMOUNTED)
1735                         VFS_RELE(tm->tm_vfsp);
1736                 return;
1737         }
1738 
1739         /*
1740          * We have the last hold *and* the link count is zero, so this
1741          * tmpnode is dead from the filesystem's viewpoint.  However,
1742          * if the tmpnode has any pages associated with it (i.e. if it's
1743          * a normal file with non-zero size), the tmpnode can still be
1744          * discovered by pageout or fsflush via the page vnode pointers.
1745          * In this case we must drop all our locks, truncate the tmpnode,
1746          * and try the whole dance again.
1747          */
1748         if (tp->tn_size != 0) {
1749                 if (tp->tn_type == VREG) {
1750                         mutex_exit(&vp->v_lock);
1751                         mutex_exit(&tp->tn_tlock);
1752                         rw_enter(&tp->tn_contents, RW_WRITER);
1753                         (void) tmpnode_trunc(tm, tp, 0);
1754                         rw_exit(&tp->tn_contents);
1755                         ASSERT(tp->tn_size == 0);
1756                         ASSERT(tp->tn_nblocks == 0);
1757                         goto top;
1758                 }
1759                 if (tp->tn_type == VLNK)
1760                         tmp_kmem_free(tm, tp->tn_symlink, tp->tn_size + 1);
1761         }
1762 
1763         /*
1764          * Remove normal file/dir's xattr dir and xattrs.
1765          */
1766         if (tp->tn_xattrdp) {
1767                 struct tmpnode *xtp = tp->tn_xattrdp;
1768 
1769                 ASSERT(xtp->tn_flags & ISXATTR);
1770                 tmpnode_hold(xtp);
1771                 rw_enter(&xtp->tn_rwlock, RW_WRITER);
1772                 tdirtrunc(xtp);
1773                 DECR_COUNT(&xtp->tn_nlink, &xtp->tn_tlock);
1774                 tp->tn_xattrdp = NULL;
1775                 rw_exit(&xtp->tn_rwlock);
1776                 tmpnode_rele(xtp);
1777         }
1778 
1779         mutex_exit(&vp->v_lock);
1780         mutex_exit(&tp->tn_tlock);
1781         /* Here's our chance to send invalid event while we're between locks */
1782         vn_invalid(TNTOV(tp));
1783         mutex_enter(&tm->tm_contents);
1784         if (tp->tn_forw == NULL)
1785                 tm->tm_rootnode->tn_back = tp->tn_back;
1786         else
1787                 tp->tn_forw->tn_back = tp->tn_back;
1788         tp->tn_back->tn_forw = tp->tn_forw;
1789         mutex_exit(&tm->tm_contents);
1790         rw_exit(&tp->tn_rwlock);
1791         rw_destroy(&tp->tn_rwlock);
1792         mutex_destroy(&tp->tn_tlock);
1793         vn_free(TNTOV(tp));
1794         tmp_kmem_free(tm, tp, sizeof (struct tmpnode));
1795 
1796         /* If the filesystem was umounted by force, rele the vfs ref */
1797         if (tm->tm_vfsp->vfs_flag & VFS_UNMOUNTED)
1798                 VFS_RELE(tm->tm_vfsp);
1799 }
1800 
1801 /* ARGSUSED2 */
1802 static int
1803 tmp_fid(struct vnode *vp, struct fid *fidp, caller_context_t *ct)
1804 {
1805         struct tmpnode *tp = (struct tmpnode *)VTOTN(vp);
1806         struct tfid *tfid;
1807 
1808         if (fidp->fid_len < (sizeof (struct tfid) - sizeof (ushort_t))) {
1809                 fidp->fid_len = sizeof (struct tfid) - sizeof (ushort_t);
1810                 return (ENOSPC);
1811         }
1812 
1813         tfid = (struct tfid *)fidp;
1814         bzero(tfid, sizeof (struct tfid));
1815         tfid->tfid_len = (int)sizeof (struct tfid) - sizeof (ushort_t);
1816 
1817         tfid->tfid_ino = tp->tn_nodeid;
1818         tfid->tfid_gen = tp->tn_gen;
1819 
1820         return (0);
1821 }
1822 
1823 
1824 /*
1825  * Return all the pages from [off..off+len] in given file
1826  */
1827 /* ARGSUSED */
1828 static int
1829 tmp_getpage(
1830         struct vnode *vp,
1831         offset_t off,
1832         size_t len,
1833         uint_t *protp,
1834         page_t *pl[],
1835         size_t plsz,
1836         struct seg *seg,
1837         caddr_t addr,
1838         enum seg_rw rw,
1839         struct cred *cr,
1840         caller_context_t *ct)
1841 {
1842         int err = 0;
1843         struct tmpnode *tp = VTOTN(vp);
1844         anoff_t toff = (anoff_t)off;
1845         size_t tlen = len;
1846         u_offset_t tmpoff;
1847         timestruc_t now;
1848 
1849         rw_enter(&tp->tn_contents, RW_READER);
1850 
1851         if (off + len  > tp->tn_size + PAGEOFFSET) {
1852                 err = EFAULT;
1853                 goto out;
1854         }
1855         /*
1856          * Look for holes (no anon slot) in faulting range. If there are
1857          * holes we have to switch to a write lock and fill them in. Swap
1858          * space for holes was already reserved when the file was grown.
1859          */
1860         tmpoff = toff;
1861         if (non_anon(tp->tn_anon, btop(off), &tmpoff, &tlen)) {
1862                 if (!rw_tryupgrade(&tp->tn_contents)) {
1863                         rw_exit(&tp->tn_contents);
1864                         rw_enter(&tp->tn_contents, RW_WRITER);
1865                         /* Size may have changed when lock was dropped */
1866                         if (off + len  > tp->tn_size + PAGEOFFSET) {
1867                                 err = EFAULT;
1868                                 goto out;
1869                         }
1870                 }
1871                 for (toff = (anoff_t)off; toff < (anoff_t)off + len;
1872                     toff += PAGESIZE) {
1873                         if (anon_get_ptr(tp->tn_anon, btop(toff)) == NULL) {
1874                                 /* XXX - may allocate mem w. write lock held */
1875                                 (void) anon_set_ptr(tp->tn_anon, btop(toff),
1876                                     anon_alloc(vp, toff), ANON_SLEEP);
1877                                 tp->tn_nblocks++;
1878                         }
1879                 }
1880                 rw_downgrade(&tp->tn_contents);
1881         }
1882 
1883 
1884         err = pvn_getpages(tmp_getapage, vp, (u_offset_t)off, len, protp,
1885             pl, plsz, seg, addr, rw, cr);
1886 
1887         gethrestime(&now);
1888         tp->tn_atime = now;
1889         if (rw == S_WRITE)
1890                 tp->tn_mtime = now;
1891 
1892 out:
1893         rw_exit(&tp->tn_contents);
1894         return (err);
1895 }
1896 
1897 /*
1898  * Called from pvn_getpages to get a particular page.
1899  */
1900 /*ARGSUSED*/
1901 static int
1902 tmp_getapage(
1903         struct vnode *vp,
1904         u_offset_t off,
1905         size_t len,
1906         uint_t *protp,
1907         page_t *pl[],
1908         size_t plsz,
1909         struct seg *seg,
1910         caddr_t addr,
1911         enum seg_rw rw,
1912         struct cred *cr)
1913 {
1914         struct page *pp;
1915         int flags;
1916         int err = 0;
1917         struct vnode *pvp;
1918         u_offset_t poff;
1919 
1920         /* If the filesystem was umounted by force, return immediately. */
1921         if (vp->v_vfsp->vfs_flag & VFS_UNMOUNTED)
1922                 return (EIO);
1923 
1924         if (protp != NULL)
1925                 *protp = PROT_ALL;
1926 again:
1927         if (pp = page_lookup(vp, off, rw == S_CREATE ? SE_EXCL : SE_SHARED)) {
1928                 if (pl) {
1929                         pl[0] = pp;
1930                         pl[1] = NULL;
1931                 } else {
1932                         page_unlock(pp);
1933                 }
1934         } else {
1935                 pp = page_create_va(vp, off, PAGESIZE,
1936                     PG_WAIT | PG_EXCL, seg, addr);
1937                 /*
1938                  * Someone raced in and created the page after we did the
1939                  * lookup but before we did the create, so go back and
1940                  * try to look it up again.
1941                  */
1942                 if (pp == NULL)
1943                         goto again;
1944                 /*
1945                  * Fill page from backing store, if any. If none, then
1946                  * either this is a newly filled hole or page must have
1947                  * been unmodified and freed so just zero it out.
1948                  */
1949                 err = swap_getphysname(vp, off, &pvp, &poff);
1950                 if (err) {
1951                         panic("tmp_getapage: no anon slot vp %p "
1952                             "off %llx pp %p\n", (void *)vp, off, (void *)pp);
1953                 }
1954                 if (pvp) {
1955                         flags = (pl == NULL ? B_ASYNC|B_READ : B_READ);
1956                         err = VOP_PAGEIO(pvp, pp, (u_offset_t)poff, PAGESIZE,
1957                             flags, cr, NULL);
1958                         if (flags & B_ASYNC)
1959                                 pp = NULL;
1960                 } else if (rw != S_CREATE) {
1961                         pagezero(pp, 0, PAGESIZE);
1962                 }
1963                 if (err && pp)
1964                         pvn_read_done(pp, B_ERROR);
1965                 if (err == 0) {
1966                         if (pl)
1967                                 pvn_plist_init(pp, pl, plsz, off, PAGESIZE, rw);
1968                         else
1969                                 pvn_io_done(pp);
1970                 }
1971         }
1972         return (err);
1973 }
1974 
1975 
1976 /*
1977  * Flags are composed of {B_INVAL, B_DIRTY B_FREE, B_DONTNEED}.
1978  * If len == 0, do from off to EOF.
1979  */
1980 static int tmp_nopage = 0;      /* Don't do tmp_putpage's if set */
1981 
1982 /* ARGSUSED */
1983 int
1984 tmp_putpage(
1985         register struct vnode *vp,
1986         offset_t off,
1987         size_t len,
1988         int flags,
1989         struct cred *cr,
1990         caller_context_t *ct)
1991 {
1992         register page_t *pp;
1993         u_offset_t io_off;
1994         size_t io_len = 0;
1995         int err = 0;
1996         struct tmpnode *tp = VTOTN(vp);
1997         int dolock;
1998 
1999         if (tmp_nopage)
2000                 return (0);
2001 
2002         ASSERT(vp->v_count != 0);
2003 
2004         if (vp->v_flag & VNOMAP)
2005                 return (ENOSYS);
2006 
2007         /*
2008          * This being tmpfs, we don't ever do i/o unless we really
2009          * have to (when we're low on memory and pageout calls us
2010          * with B_ASYNC | B_FREE or the user explicitly asks for it with
2011          * B_DONTNEED).
2012          * XXX to approximately track the mod time like ufs we should
2013          * update the times here. The problem is, once someone does a
2014          * store we never clear the mod bit and do i/o, thus fsflush
2015          * will keep calling us every 30 seconds to do the i/o and we'll
2016          * continually update the mod time. At least we update the mod
2017          * time on the first store because this results in a call to getpage.
2018          */
2019         if (flags != (B_ASYNC | B_FREE) && (flags & B_INVAL) == 0 &&
2020             (flags & B_DONTNEED) == 0)
2021                 return (0);
2022         /*
2023          * If this thread owns the lock, i.e., this thread grabbed it
2024          * as writer somewhere above, then we don't need to grab the
2025          * lock as reader in this routine.
2026          */
2027         dolock = (rw_owner(&tp->tn_contents) != curthread);
2028 
2029         /*
2030          * If this is pageout don't block on the lock as you could deadlock
2031          * when freemem == 0 (another thread has the read lock and is blocked
2032          * creating a page, and a third thread is waiting to get the writers
2033          * lock - waiting writers priority blocks us from getting the read
2034          * lock). Of course, if the only freeable pages are on this tmpnode
2035          * we're hosed anyways. A better solution might be a new lock type.
2036          * Note: ufs has the same problem.
2037          */
2038         if (curproc == proc_pageout) {
2039                 if (!rw_tryenter(&tp->tn_contents, RW_READER))
2040                         return (ENOMEM);
2041         } else if (dolock)
2042                 rw_enter(&tp->tn_contents, RW_READER);
2043 
2044         if (!vn_has_cached_data(vp))
2045                 goto out;
2046 
2047         if (len == 0) {
2048                 if (curproc == proc_pageout) {
2049                         panic("tmp: pageout can't block");
2050                         /*NOTREACHED*/
2051                 }
2052 
2053                 /* Search the entire vp list for pages >= off. */
2054                 err = pvn_vplist_dirty(vp, (u_offset_t)off, tmp_putapage,
2055                     flags, cr);
2056         } else {
2057                 u_offset_t eoff;
2058 
2059                 /*
2060                  * Loop over all offsets in the range [off...off + len]
2061                  * looking for pages to deal with.
2062                  */
2063                 eoff = MIN(off + len, tp->tn_size);
2064                 for (io_off = off; io_off < eoff; io_off += io_len) {
2065                         /*
2066                          * If we are not invalidating, synchronously
2067                          * freeing or writing pages use the routine
2068                          * page_lookup_nowait() to prevent reclaiming
2069                          * them from the free list.
2070                          */
2071                         if ((flags & B_INVAL) || ((flags & B_ASYNC) == 0)) {
2072                                 pp = page_lookup(vp, io_off,
2073                                     (flags & (B_INVAL | B_FREE)) ?
2074                                     SE_EXCL : SE_SHARED);
2075                         } else {
2076                                 pp = page_lookup_nowait(vp, io_off,
2077                                     (flags & B_FREE) ? SE_EXCL : SE_SHARED);
2078                         }
2079 
2080                         if (pp == NULL || pvn_getdirty(pp, flags) == 0)
2081                                 io_len = PAGESIZE;
2082                         else {
2083                                 err = tmp_putapage(vp, pp, &io_off, &io_len,
2084                                     flags, cr);
2085                                 if (err != 0)
2086                                         break;
2087                         }
2088                 }
2089         }
2090         /* If invalidating, verify all pages on vnode list are gone. */
2091         if (err == 0 && off == 0 && len == 0 &&
2092             (flags & B_INVAL) && vn_has_cached_data(vp)) {
2093                 panic("tmp_putpage: B_INVAL, pages not gone");
2094                 /*NOTREACHED*/
2095         }
2096 out:
2097         if ((curproc == proc_pageout) || dolock)
2098                 rw_exit(&tp->tn_contents);
2099         /*
2100          * Only reason putapage is going to give us SE_NOSWAP as error
2101          * is when we ask a page to be written to physical backing store
2102          * and there is none. Ignore this because we might be dealing
2103          * with a swap page which does not have any backing store
2104          * on disk. In any other case we won't get this error over here.
2105          */
2106         if (err == SE_NOSWAP)
2107                 err = 0;
2108         return (err);
2109 }
2110 
2111 long tmp_putpagecnt, tmp_pagespushed;
2112 
2113 /*
2114  * Write out a single page.
2115  * For tmpfs this means choose a physical swap slot and write the page
2116  * out using VOP_PAGEIO. For performance, we attempt to kluster; i.e.,
2117  * we try to find a bunch of other dirty pages adjacent in the file
2118  * and a bunch of contiguous swap slots, and then write all the pages
2119  * out in a single i/o.
2120  */
2121 /*ARGSUSED*/
2122 static int
2123 tmp_putapage(
2124         struct vnode *vp,
2125         page_t *pp,
2126         u_offset_t *offp,
2127         size_t *lenp,
2128         int flags,
2129         struct cred *cr)
2130 {
2131         int err;
2132         ulong_t klstart, kllen;
2133         page_t *pplist, *npplist;
2134         extern int klustsize;
2135         long tmp_klustsize;
2136         struct tmpnode *tp;
2137         size_t pp_off, pp_len;
2138         u_offset_t io_off;
2139         size_t io_len;
2140         struct vnode *pvp;
2141         u_offset_t pstart;
2142         u_offset_t offset;
2143         u_offset_t tmpoff;
2144 
2145         /* If the filesystem was umounted by force, return immediately. */
2146         if (vp->v_vfsp->vfs_flag & VFS_UNMOUNTED)
2147                 return (EIO);
2148 
2149         ASSERT(PAGE_LOCKED(pp));
2150 
2151         /* Kluster in tmp_klustsize chunks */
2152         tp = VTOTN(vp);
2153         tmp_klustsize = klustsize;
2154         offset = pp->p_offset;
2155         klstart = (offset / tmp_klustsize) * tmp_klustsize;
2156         kllen = MIN(tmp_klustsize, tp->tn_size - klstart);
2157 
2158         /* Get a kluster of pages */
2159         pplist =
2160             pvn_write_kluster(vp, pp, &tmpoff, &pp_len, klstart, kllen, flags);
2161 
2162         pp_off = (size_t)tmpoff;
2163 
2164         /*
2165          * Get a cluster of physical offsets for the pages; the amount we
2166          * get may be some subrange of what we ask for (io_off, io_len).
2167          */
2168         io_off = pp_off;
2169         io_len = pp_len;
2170         err = swap_newphysname(vp, offset, &io_off, &io_len, &pvp, &pstart);
2171         ASSERT(err != SE_NOANON); /* anon slot must have been filled */
2172         if (err) {
2173                 pvn_write_done(pplist, B_ERROR | B_WRITE | flags);
2174                 /*
2175                  * If this routine is called as a result of segvn_sync
2176                  * operation and we have no physical swap then we can get an
2177                  * error here. In such case we would return SE_NOSWAP as error.
2178                  * At this point, we expect only SE_NOSWAP.
2179                  */
2180                 ASSERT(err == SE_NOSWAP);
2181                 if (flags & B_INVAL)
2182                         err = ENOMEM;
2183                 goto out;
2184         }
2185         ASSERT(pp_off <= io_off && io_off + io_len <= pp_off + pp_len);
2186         ASSERT(io_off <= offset && offset < io_off + io_len);
2187 
2188         /* Toss pages at front/rear that we couldn't get physical backing for */
2189         if (io_off != pp_off) {
2190                 npplist = NULL;
2191                 page_list_break(&pplist, &npplist, btop(io_off - pp_off));
2192                 ASSERT(pplist->p_offset == pp_off);
2193                 ASSERT(pplist->p_prev->p_offset == io_off - PAGESIZE);
2194                 pvn_write_done(pplist, B_ERROR | B_WRITE | flags);
2195                 pplist = npplist;
2196         }
2197         if (io_off + io_len < pp_off + pp_len) {
2198                 npplist = NULL;
2199                 page_list_break(&pplist, &npplist, btop(io_len));
2200                 ASSERT(npplist->p_offset == io_off + io_len);
2201                 ASSERT(npplist->p_prev->p_offset == pp_off + pp_len - PAGESIZE);
2202                 pvn_write_done(npplist, B_ERROR | B_WRITE | flags);
2203         }
2204 
2205         ASSERT(pplist->p_offset == io_off);
2206         ASSERT(pplist->p_prev->p_offset == io_off + io_len - PAGESIZE);
2207         ASSERT(btopr(io_len) <= btopr(kllen));
2208 
2209         /* Do i/o on the remaining kluster */
2210         err = VOP_PAGEIO(pvp, pplist, (u_offset_t)pstart, io_len,
2211             B_WRITE | flags, cr, NULL);
2212 
2213         if ((flags & B_ASYNC) == 0) {
2214                 pvn_write_done(pplist, ((err) ? B_ERROR : 0) | B_WRITE | flags);
2215         }
2216 out:
2217         if (!err) {
2218                 if (offp)
2219                         *offp = io_off;
2220                 if (lenp)
2221                         *lenp = io_len;
2222                 tmp_putpagecnt++;
2223                 tmp_pagespushed += btop(io_len);
2224         }
2225         if (err && err != ENOMEM && err != SE_NOSWAP)
2226                 cmn_err(CE_WARN, "tmp_putapage: err %d\n", err);
2227         return (err);
2228 }
2229 
2230 /* ARGSUSED */
2231 static int
2232 tmp_map(
2233         struct vnode *vp,
2234         offset_t off,
2235         struct as *as,
2236         caddr_t *addrp,
2237         size_t len,
2238         uchar_t prot,
2239         uchar_t maxprot,
2240         uint_t flags,
2241         struct cred *cred,
2242         caller_context_t *ct)
2243 {
2244         struct segvn_crargs vn_a;
2245         struct tmpnode *tp = (struct tmpnode *)VTOTN(vp);
2246         int error;
2247 
2248 #ifdef _ILP32
2249         if (len > MAXOFF_T)
2250                 return (ENOMEM);
2251 #endif
2252 
2253         if (vp->v_flag & VNOMAP)
2254                 return (ENOSYS);
2255 
2256         if (off < 0 || (offset_t)(off + len) < 0 ||
2257             off > MAXOFF_T || (off + len) > MAXOFF_T)
2258                 return (ENXIO);
2259 
2260         if (vp->v_type != VREG)
2261                 return (ENODEV);
2262 
2263         /*
2264          * Don't allow mapping to locked file
2265          */
2266         if (vn_has_mandatory_locks(vp, tp->tn_mode)) {
2267                 return (EAGAIN);
2268         }
2269 
2270         as_rangelock(as);
2271         error = choose_addr(as, addrp, len, off, ADDR_VACALIGN, flags);
2272         if (error != 0) {
2273                 as_rangeunlock(as);
2274                 return (error);
2275         }
2276 
2277         vn_a.vp = vp;
2278         vn_a.offset = (u_offset_t)off;
2279         vn_a.type = flags & MAP_TYPE;
2280         vn_a.prot = prot;
2281         vn_a.maxprot = maxprot;
2282         vn_a.flags = flags & ~MAP_TYPE;
2283         vn_a.cred = cred;
2284         vn_a.amp = NULL;
2285         vn_a.szc = 0;
2286         vn_a.lgrp_mem_policy_flags = 0;
2287 
2288         error = as_map(as, *addrp, len, segvn_create, &vn_a);
2289         as_rangeunlock(as);
2290         return (error);
2291 }
2292 
2293 /*
2294  * tmp_addmap and tmp_delmap can't be called since the vp
2295  * maintained in the segvn mapping is NULL.
2296  */
2297 /* ARGSUSED */
2298 static int
2299 tmp_addmap(
2300         struct vnode *vp,
2301         offset_t off,
2302         struct as *as,
2303         caddr_t addr,
2304         size_t len,
2305         uchar_t prot,
2306         uchar_t maxprot,
2307         uint_t flags,
2308         struct cred *cred,
2309         caller_context_t *ct)
2310 {
2311         return (0);
2312 }
2313 
2314 /* ARGSUSED */
2315 static int
2316 tmp_delmap(
2317         struct vnode *vp,
2318         offset_t off,
2319         struct as *as,
2320         caddr_t addr,
2321         size_t len,
2322         uint_t prot,
2323         uint_t maxprot,
2324         uint_t flags,
2325         struct cred *cred,
2326         caller_context_t *ct)
2327 {
2328         return (0);
2329 }
2330 
2331 static int
2332 tmp_freesp(struct vnode *vp, struct flock64 *lp, int flag)
2333 {
2334         register int i;
2335         register struct tmpnode *tp = VTOTN(vp);
2336         int error;
2337 
2338         ASSERT(vp->v_type == VREG);
2339         ASSERT(lp->l_start >= 0);
2340 
2341         if (lp->l_len != 0)
2342                 return (EINVAL);
2343 
2344         rw_enter(&tp->tn_rwlock, RW_WRITER);
2345         if (tp->tn_size == lp->l_start) {
2346                 rw_exit(&tp->tn_rwlock);
2347                 return (0);
2348         }
2349 
2350         /*
2351          * Check for any mandatory locks on the range
2352          */
2353         if (MANDLOCK(vp, tp->tn_mode)) {
2354                 long save_start;
2355 
2356                 save_start = lp->l_start;
2357 
2358                 if (tp->tn_size < lp->l_start) {
2359                         /*
2360                          * "Truncate up" case: need to make sure there
2361                          * is no lock beyond current end-of-file. To
2362                          * do so, we need to set l_start to the size
2363                          * of the file temporarily.
2364                          */
2365                         lp->l_start = tp->tn_size;
2366                 }
2367                 lp->l_type = F_WRLCK;
2368                 lp->l_sysid = 0;
2369                 lp->l_pid = ttoproc(curthread)->p_pid;
2370                 i = (flag & (FNDELAY|FNONBLOCK)) ? 0 : SLPFLCK;
2371                 if ((i = reclock(vp, lp, i, 0, lp->l_start, NULL)) != 0 ||
2372                     lp->l_type != F_UNLCK) {
2373                         rw_exit(&tp->tn_rwlock);
2374                         return (i ? i : EAGAIN);
2375                 }
2376 
2377                 lp->l_start = save_start;
2378         }
2379         VFSTOTM(vp->v_vfsp);
2380 
2381         rw_enter(&tp->tn_contents, RW_WRITER);
2382         error = tmpnode_trunc((struct tmount *)VFSTOTM(vp->v_vfsp),
2383             tp, (ulong_t)lp->l_start);
2384         rw_exit(&tp->tn_contents);
2385         rw_exit(&tp->tn_rwlock);
2386         return (error);
2387 }
2388 
2389 /* ARGSUSED */
2390 static int
2391 tmp_space(
2392         struct vnode *vp,
2393         int cmd,
2394         struct flock64 *bfp,
2395         int flag,
2396         offset_t offset,
2397         cred_t *cred,
2398         caller_context_t *ct)
2399 {
2400         int error;
2401 
2402         if (cmd != F_FREESP)
2403                 return (EINVAL);
2404         if ((error = convoff(vp, bfp, 0, (offset_t)offset)) == 0) {
2405                 if ((bfp->l_start > MAXOFF_T) || (bfp->l_len > MAXOFF_T))
2406                         return (EFBIG);
2407                 error = tmp_freesp(vp, bfp, flag);
2408 
2409                 if (error == 0) {
2410                         if (bfp->l_start == 0) {
2411                                 vnevent_truncate(vp, ct);
2412                         } else {
2413                                 vnevent_resize(vp, ct);
2414                         }
2415                 }
2416         }
2417         return (error);
2418 }
2419 
2420 /* ARGSUSED */
2421 static int
2422 tmp_seek(
2423         struct vnode *vp,
2424         offset_t ooff,
2425         offset_t *noffp,
2426         caller_context_t *ct)
2427 {
2428         return ((*noffp < 0 || *noffp > MAXOFFSET_T) ? EINVAL : 0);
2429 }
2430 
2431 /* ARGSUSED2 */
2432 static int
2433 tmp_rwlock(struct vnode *vp, int write_lock, caller_context_t *ctp)
2434 {
2435         struct tmpnode *tp = VTOTN(vp);
2436 
2437         if (write_lock) {
2438                 rw_enter(&tp->tn_rwlock, RW_WRITER);
2439         } else {
2440                 rw_enter(&tp->tn_rwlock, RW_READER);
2441         }
2442         return (write_lock);
2443 }
2444 
2445 /* ARGSUSED1 */
2446 static void
2447 tmp_rwunlock(struct vnode *vp, int write_lock, caller_context_t *ctp)
2448 {
2449         struct tmpnode *tp = VTOTN(vp);
2450 
2451         rw_exit(&tp->tn_rwlock);
2452 }
2453 
2454 static int
2455 tmp_pathconf(
2456         struct vnode *vp,
2457         int cmd,
2458         ulong_t *valp,
2459         cred_t *cr,
2460         caller_context_t *ct)
2461 {
2462         struct tmpnode *tp = NULL;
2463         int error;
2464 
2465         switch (cmd) {
2466         case _PC_XATTR_EXISTS:
2467                 if (vp->v_vfsp->vfs_flag & VFS_XATTR) {
2468                         *valp = 0;      /* assume no attributes */
2469                         error = 0;      /* okay to ask */
2470                         tp = VTOTN(vp);
2471                         rw_enter(&tp->tn_rwlock, RW_READER);
2472                         if (tp->tn_xattrdp) {
2473                                 rw_enter(&tp->tn_xattrdp->tn_rwlock, RW_READER);
2474                                 /* do not count "." and ".." */
2475                                 if (tp->tn_xattrdp->tn_dirents > 2)
2476                                         *valp = 1;
2477                                 rw_exit(&tp->tn_xattrdp->tn_rwlock);
2478                         }
2479                         rw_exit(&tp->tn_rwlock);
2480                 } else {
2481                         error = EINVAL;
2482                 }
2483                 break;
2484         case _PC_SATTR_ENABLED:
2485         case _PC_SATTR_EXISTS:
2486                 *valp = vfs_has_feature(vp->v_vfsp, VFSFT_SYSATTR_VIEWS) &&
2487                     (vp->v_type == VREG || vp->v_type == VDIR);
2488                 error = 0;
2489                 break;
2490         case _PC_TIMESTAMP_RESOLUTION:
2491                 /* nanosecond timestamp resolution */
2492                 *valp = 1L;
2493                 error = 0;
2494                 break;
2495         default:
2496                 error = fs_pathconf(vp, cmd, valp, cr, ct);
2497         }
2498         return (error);
2499 }
2500 
2501 
2502 struct vnodeops *tmp_vnodeops;
2503 
2504 const fs_operation_def_t tmp_vnodeops_template[] = {
2505         VOPNAME_OPEN,           { .vop_open = tmp_open },
2506         VOPNAME_CLOSE,          { .vop_close = tmp_close },
2507         VOPNAME_READ,           { .vop_read = tmp_read },
2508         VOPNAME_WRITE,          { .vop_write = tmp_write },
2509         VOPNAME_IOCTL,          { .vop_ioctl = tmp_ioctl },
2510         VOPNAME_GETATTR,        { .vop_getattr = tmp_getattr },
2511         VOPNAME_SETATTR,        { .vop_setattr = tmp_setattr },
2512         VOPNAME_ACCESS,         { .vop_access = tmp_access },
2513         VOPNAME_LOOKUP,         { .vop_lookup = tmp_lookup },
2514         VOPNAME_CREATE,         { .vop_create = tmp_create },
2515         VOPNAME_REMOVE,         { .vop_remove = tmp_remove },
2516         VOPNAME_LINK,           { .vop_link = tmp_link },
2517         VOPNAME_RENAME,         { .vop_rename = tmp_rename },
2518         VOPNAME_MKDIR,          { .vop_mkdir = tmp_mkdir },
2519         VOPNAME_RMDIR,          { .vop_rmdir = tmp_rmdir },
2520         VOPNAME_READDIR,        { .vop_readdir = tmp_readdir },
2521         VOPNAME_SYMLINK,        { .vop_symlink = tmp_symlink },
2522         VOPNAME_READLINK,       { .vop_readlink = tmp_readlink },
2523         VOPNAME_FSYNC,          { .vop_fsync = tmp_fsync },
2524         VOPNAME_INACTIVE,       { .vop_inactive = tmp_inactive },
2525         VOPNAME_FID,            { .vop_fid = tmp_fid },
2526         VOPNAME_RWLOCK,         { .vop_rwlock = tmp_rwlock },
2527         VOPNAME_RWUNLOCK,       { .vop_rwunlock = tmp_rwunlock },
2528         VOPNAME_SEEK,           { .vop_seek = tmp_seek },
2529         VOPNAME_SPACE,          { .vop_space = tmp_space },
2530         VOPNAME_GETPAGE,        { .vop_getpage = tmp_getpage },
2531         VOPNAME_PUTPAGE,        { .vop_putpage = tmp_putpage },
2532         VOPNAME_MAP,            { .vop_map = tmp_map },
2533         VOPNAME_ADDMAP,         { .vop_addmap = tmp_addmap },
2534         VOPNAME_DELMAP,         { .vop_delmap = tmp_delmap },
2535         VOPNAME_PATHCONF,       { .vop_pathconf = tmp_pathconf },
2536         VOPNAME_VNEVENT,        { .vop_vnevent = fs_vnevent_support },
2537         NULL,                   NULL
2538 };