1/*
2 * CDDL HEADER START
3 *
4 * The contents of this file are subject to the terms of the
5 * Common Development and Distribution License (the "License").
6 * You may not use this file except in compliance with the License.
7 *
8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9 * or http://www.opensolaris.org/os/licensing.
10 * See the License for the specific language governing permissions
11 * and limitations under the License.
12 *
13 * When distributing Covered Code, include this CDDL HEADER in each
14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15 * If applicable, add the following below this CDDL HEADER, with the
16 * fields enclosed by brackets "[]" replaced with your own identifying
17 * information: Portions Copyright [yyyy] [name of copyright owner]
18 *
19 * CDDL HEADER END
20 */
21/*
22 * Copyright (c) 1990, 2010, Oracle and/or its affiliates. All rights reserved.
23 * Copyright 2015 Joyent, Inc.
24 */
25
26#include <sys/types.h>
27#include <sys/param.h>
28#include <sys/sysmacros.h>
29#include <sys/kmem.h>
30#include <sys/time.h>
31#include <sys/pathname.h>
32#include <sys/vfs.h>
33#include <sys/vfs_opreg.h>
34#include <sys/vnode.h>
35#include <sys/stat.h>
36#include <sys/uio.h>
37#include <sys/stat.h>
38#include <sys/errno.h>
39#include <sys/cmn_err.h>
40#include <sys/cred.h>
41#include <sys/statvfs.h>
42#include <sys/mount.h>
43#include <sys/debug.h>
44#include <sys/systm.h>
45#include <sys/mntent.h>
46#include <fs/fs_subr.h>
47#include <vm/page.h>
48#include <vm/anon.h>
49#include <sys/model.h>
50#include <sys/policy.h>
51
52#include <sys/fs/swapnode.h>
53#include <sys/fs/tmp.h>
54#include <sys/fs/tmpnode.h>
55
56static int tmpfsfstype;
57
58/*
59 * tmpfs vfs operations.
60 */
61static int tmpfsinit(int, char *);
62static int tmp_mount(struct vfs *, struct vnode *,
63	struct mounta *, struct cred *);
64static int tmp_unmount(struct vfs *, int, struct cred *);
65static int tmp_root(struct vfs *, struct vnode **);
66static int tmp_statvfs(struct vfs *, struct statvfs64 *);
67static int tmp_vget(struct vfs *, struct vnode **, struct fid *);
68
69/*
70 * Loadable module wrapper
71 */
72#include <sys/modctl.h>
73
74static mntopts_t tmpfs_proto_opttbl;
75
76static vfsdef_t vfw = {
77	VFSDEF_VERSION,
78	"tmpfs",
79	tmpfsinit,
80	VSW_HASPROTO|VSW_CANREMOUNT|VSW_STATS|VSW_ZMOUNT,
81	&tmpfs_proto_opttbl
82};
83
84/*
85 * in-kernel mnttab options
86 */
87static char *xattr_cancel[] = { MNTOPT_NOXATTR, NULL };
88static char *noxattr_cancel[] = { MNTOPT_XATTR, NULL };
89
90static mntopt_t tmpfs_options[] = {
91	/* Option name		Cancel Opt	Arg	Flags		Data */
92	{ MNTOPT_XATTR,		xattr_cancel,	NULL,	MO_DEFAULT,	NULL},
93	{ MNTOPT_NOXATTR,	noxattr_cancel,	NULL,	0,		NULL},
94	{ "size",		NULL,		"0",	MO_HASVALUE,	NULL},
95	{ "mode",		NULL,		NULL,	MO_HASVALUE,	NULL}
96};
97
98
99static mntopts_t tmpfs_proto_opttbl = {
100	sizeof (tmpfs_options) / sizeof (mntopt_t),
101	tmpfs_options
102};
103
104/*
105 * Module linkage information
106 */
107static struct modlfs modlfs = {
108	&mod_fsops, "filesystem for tmpfs", &vfw
109};
110
111static struct modlinkage modlinkage = {
112	MODREV_1, &modlfs, NULL
113};
114
115int
116_init()
117{
118	return (mod_install(&modlinkage));
119}
120
121int
122_fini()
123{
124	int error;
125
126	error = mod_remove(&modlinkage);
127	if (error)
128		return (error);
129	/*
130	 * Tear down the operations vectors
131	 */
132	(void) vfs_freevfsops_by_type(tmpfsfstype);
133	vn_freevnodeops(tmp_vnodeops);
134	return (0);
135}
136
137int
138_info(struct modinfo *modinfop)
139{
140	return (mod_info(&modlinkage, modinfop));
141}
142
143/*
144 * The following are patchable variables limiting the amount of system
145 * resources tmpfs can use.
146 *
147 * tmpfs_maxkmem limits the amount of kernel kmem_alloc memory
148 * tmpfs can use for it's data structures (e.g. tmpnodes, directory entries)
149 * It is not determined by setting a hard limit but rather as a percentage of
150 * physical memory which is determined when tmpfs is first used in the system.
151 *
152 * tmpfs_minfree is the minimum amount of swap space that tmpfs leaves for
153 * the rest of the system.  In other words, if the amount of free swap space
154 * in the system (i.e. anoninfo.ani_free) drops below tmpfs_minfree, tmpfs
155 * anon allocations will fail.
156 *
157 * There is also a per mount limit on the amount of swap space
158 * (tmount.tm_anonmax) settable via a mount option.
159 */
160size_t tmpfs_maxkmem = 0;
161size_t tmpfs_minfree = 0;
162size_t tmp_kmemspace;		/* bytes of kernel heap used by all tmpfs */
163
164static major_t tmpfs_major;
165static minor_t tmpfs_minor;
166static kmutex_t	tmpfs_minor_lock;
167
168/*
169 * initialize global tmpfs locks and such
170 * called when loading tmpfs module
171 */
172static int
173tmpfsinit(int fstype, char *name)
174{
175	static const fs_operation_def_t tmp_vfsops_template[] = {
176		VFSNAME_MOUNT,		{ .vfs_mount = tmp_mount },
177		VFSNAME_UNMOUNT,	{ .vfs_unmount = tmp_unmount },
178		VFSNAME_ROOT,		{ .vfs_root = tmp_root },
179		VFSNAME_STATVFS,	{ .vfs_statvfs = tmp_statvfs },
180		VFSNAME_VGET,		{ .vfs_vget = tmp_vget },
181		NULL,			NULL
182	};
183	int error;
184	extern  void    tmpfs_hash_init();
185
186	tmpfs_hash_init();
187	tmpfsfstype = fstype;
188	ASSERT(tmpfsfstype != 0);
189
190	error = vfs_setfsops(fstype, tmp_vfsops_template, NULL);
191	if (error != 0) {
192		cmn_err(CE_WARN, "tmpfsinit: bad vfs ops template");
193		return (error);
194	}
195
196	error = vn_make_ops(name, tmp_vnodeops_template, &tmp_vnodeops);
197	if (error != 0) {
198		(void) vfs_freevfsops_by_type(fstype);
199		cmn_err(CE_WARN, "tmpfsinit: bad vnode ops template");
200		return (error);
201	}
202
203	/*
204	 * tmpfs_minfree doesn't need to be some function of configured
205	 * swap space since it really is an absolute limit of swap space
206	 * which still allows other processes to execute.
207	 */
208	if (tmpfs_minfree == 0) {
209		/*
210		 * Set if not patched
211		 */
212		tmpfs_minfree = btopr(TMPMINFREE);
213	}
214
215	/*
216	 * The maximum amount of space tmpfs can allocate is
217	 * TMPMAXPROCKMEM percent of kernel memory
218	 */
219	if (tmpfs_maxkmem == 0)
220		tmpfs_maxkmem = MAX(PAGESIZE, kmem_maxavail() / TMPMAXFRACKMEM);
221
222	if ((tmpfs_major = getudev()) == (major_t)-1) {
223		cmn_err(CE_WARN, "tmpfsinit: Can't get unique device number.");
224		tmpfs_major = 0;
225	}
226	mutex_init(&tmpfs_minor_lock, NULL, MUTEX_DEFAULT, NULL);
227	return (0);
228}
229
230static int
231tmp_mount(vfs_t *vfsp, vnode_t *mvp, struct mounta *uap, cred_t *cr)
232{
233	struct tmount *tm = NULL;
234	struct tmpnode *tp;
235	struct pathname dpn;
236	int error;
237	pgcnt_t anonmax;
238	struct vattr rattr;
239	int got_attrs;
240	boolean_t mode_arg = B_FALSE;
241	mode_t root_mode = 0777;
242	char *argstr;
243
244	if ((error = secpolicy_fs_mount(cr, mvp, vfsp)) != 0)
245		return (error);
246
247	if (mvp->v_type != VDIR)
248		return (ENOTDIR);
249
250	mutex_enter(&mvp->v_lock);
251	if ((uap->flags & MS_REMOUNT) == 0 && (uap->flags & MS_OVERLAY) == 0 &&
252	    (mvp->v_count != 1 || (mvp->v_flag & VROOT))) {
253		mutex_exit(&mvp->v_lock);
254		return (EBUSY);
255	}
256	mutex_exit(&mvp->v_lock);
257
258	/*
259	 * Having the resource be anything but "swap" doesn't make sense.
260	 */
261	vfs_setresource(vfsp, "swap", 0);
262
263	/*
264	 * now look for options we understand...
265	 */
266
267	/* tmpfs doesn't support read-only mounts */
268	if (vfs_optionisset(vfsp, MNTOPT_RO, NULL)) {
269		error = EINVAL;
270		goto out;
271	}
272
273	/*
274	 * tm_anonmax is set according to the mount arguments
275	 * if any.  Otherwise, it is set to a maximum value.
276	 */
277	if (vfs_optionisset(vfsp, "size", &argstr)) {
278		if ((error = tmp_convnum(argstr, &anonmax)) != 0)
279			goto out;
280	} else {
281		anonmax = ULONG_MAX;
282	}
283
284	/*
285	 * The "mode" mount argument allows the operator to override the
286	 * permissions of the root of the tmpfs mount.
287	 */
288	if (vfs_optionisset(vfsp, "mode", &argstr)) {
289		if ((error = tmp_convmode(argstr, &root_mode)) != 0) {
290			goto out;
291		}
292		mode_arg = B_TRUE;
293	}
294
295	if (error = pn_get(uap->dir,
296	    (uap->flags & MS_SYSSPACE) ? UIO_SYSSPACE : UIO_USERSPACE, &dpn))
297		goto out;
298
299	if (uap->flags & MS_REMOUNT) {
300		tm = (struct tmount *)VFSTOTM(vfsp);
301
302		/*
303		 * If we change the size so its less than what is currently
304		 * being used, we allow that. The file system will simply be
305		 * full until enough files have been removed to get below the
306		 * new max.
307		 */
308		mutex_enter(&tm->tm_contents);
309		tm->tm_anonmax = anonmax;
310		mutex_exit(&tm->tm_contents);
311		goto out;
312	}
313
314	if ((tm = tmp_memalloc(sizeof (struct tmount), 0)) == NULL) {
315		pn_free(&dpn);
316		error = ENOMEM;
317		goto out;
318	}
319
320	/*
321	 * find an available minor device number for this mount
322	 */
323	mutex_enter(&tmpfs_minor_lock);
324	do {
325		tmpfs_minor = (tmpfs_minor + 1) & L_MAXMIN32;
326		tm->tm_dev = makedevice(tmpfs_major, tmpfs_minor);
327	} while (vfs_devismounted(tm->tm_dev));
328	mutex_exit(&tmpfs_minor_lock);
329
330	/*
331	 * Set but don't bother entering the mutex
332	 * (tmount not on mount list yet)
333	 */
334	mutex_init(&tm->tm_contents, NULL, MUTEX_DEFAULT, NULL);
335	mutex_init(&tm->tm_renamelck, NULL, MUTEX_DEFAULT, NULL);
336
337	tm->tm_vfsp = vfsp;
338	tm->tm_anonmax = anonmax;
339
340	vfsp->vfs_data = (caddr_t)tm;
341	vfsp->vfs_fstype = tmpfsfstype;
342	vfsp->vfs_dev = tm->tm_dev;
343	vfsp->vfs_bsize = PAGESIZE;
344	vfsp->vfs_flag |= VFS_NOTRUNC;
345	vfs_make_fsid(&vfsp->vfs_fsid, tm->tm_dev, tmpfsfstype);
346	tm->tm_mntpath = tmp_memalloc(dpn.pn_pathlen + 1, TMP_MUSTHAVE);
347	(void) strcpy(tm->tm_mntpath, dpn.pn_path);
348
349	/*
350	 * allocate and initialize root tmpnode structure
351	 */
352	bzero(&rattr, sizeof (struct vattr));
353	rattr.va_mode = (mode_t)(S_IFDIR | root_mode);
354	rattr.va_type = VDIR;
355	rattr.va_rdev = 0;
356	tp = tmp_memalloc(sizeof (struct tmpnode), TMP_MUSTHAVE);
357	tmpnode_init(tm, tp, &rattr, cr);
358
359	/*
360	 * Get the mode, uid, and gid from the underlying mount point.
361	 */
362	rattr.va_mask = AT_MODE|AT_UID|AT_GID;	/* Hint to getattr */
363	got_attrs = VOP_GETATTR(mvp, &rattr, 0, cr, NULL);
364
365	rw_enter(&tp->tn_rwlock, RW_WRITER);
366	TNTOV(tp)->v_flag |= VROOT;
367
368	/*
369	 * If the getattr succeeded, use its results.  Otherwise allow
370	 * the previously set hardwired defaults to prevail.
371	 */
372	if (got_attrs == 0) {
373		if (!mode_arg) {
374			/*
375			 * Only use the underlying mount point for the
376			 * mode if the "mode" mount argument was not
377			 * provided.
378			 */
379			tp->tn_mode = rattr.va_mode;
380		}
381		tp->tn_uid = rattr.va_uid;
382		tp->tn_gid = rattr.va_gid;
383	}
384
385	/*
386	 * initialize linked list of tmpnodes so that the back pointer of
387	 * the root tmpnode always points to the last one on the list
388	 * and the forward pointer of the last node is null
389	 */
390	tp->tn_back = tp;
391	tp->tn_forw = NULL;
392	tp->tn_nlink = 0;
393	tm->tm_rootnode = tp;
394
395	tdirinit(tp, tp);
396
397	rw_exit(&tp->tn_rwlock);
398
399	pn_free(&dpn);
400	error = 0;
401
402out:
403	if (error == 0)
404		vfs_set_feature(vfsp, VFSFT_SYSATTR_VIEWS);
405
406	return (error);
407}
408
409static int
410tmp_unmount(struct vfs *vfsp, int flag, struct cred *cr)
411{
412	struct tmount *tm = (struct tmount *)VFSTOTM(vfsp);
413	struct tmpnode *tnp, *cancel;
414	struct vnode	*vp;
415	int error;
416
417	if ((error = secpolicy_fs_unmount(cr, vfsp)) != 0)
418		return (error);
419
420	/*
421	 * forced unmount is not supported by this file system
422	 * and thus, ENOTSUP, is being returned.
423	 */
424	if (flag & MS_FORCE)
425		return (ENOTSUP);
426
427	mutex_enter(&tm->tm_contents);
428
429	/*
430	 * If there are no open files, only the root node should have
431	 * a reference count.
432	 * With tm_contents held, nothing can be added or removed.
433	 * There may be some dirty pages.  To prevent fsflush from
434	 * disrupting the unmount, put a hold on each node while scanning.
435	 * If we find a previously referenced node, undo the holds we have
436	 * placed and fail EBUSY.
437	 */
438	tnp = tm->tm_rootnode;
439	if (TNTOV(tnp)->v_count > 1) {
440		mutex_exit(&tm->tm_contents);
441		return (EBUSY);
442	}
443
444	for (tnp = tnp->tn_forw; tnp; tnp = tnp->tn_forw) {
445		if ((vp = TNTOV(tnp))->v_count > 0) {
446			cancel = tm->tm_rootnode->tn_forw;
447			while (cancel != tnp) {
448				vp = TNTOV(cancel);
449				ASSERT(vp->v_count > 0);
450				VN_RELE(vp);
451				cancel = cancel->tn_forw;
452			}
453			mutex_exit(&tm->tm_contents);
454			return (EBUSY);
455		}
456		VN_HOLD(vp);
457	}
458
459	/*
460	 * We can drop the mutex now because no one can find this mount
461	 */
462	mutex_exit(&tm->tm_contents);
463
464	/*
465	 * Free all kmemalloc'd and anonalloc'd memory associated with
466	 * this filesystem.  To do this, we go through the file list twice,
467	 * once to remove all the directory entries, and then to remove
468	 * all the files.  We do this because there is useful code in
469	 * tmpnode_free which assumes that the directory entry has been
470	 * removed before the file.
471	 */
472	/*
473	 * Remove all directory entries
474	 */
475	for (tnp = tm->tm_rootnode; tnp; tnp = tnp->tn_forw) {
476		rw_enter(&tnp->tn_rwlock, RW_WRITER);
477		if (tnp->tn_type == VDIR)
478			tdirtrunc(tnp);
479		if (tnp->tn_vnode->v_flag & V_XATTRDIR) {
480			/*
481			 * Account for implicit attrdir reference.
482			 */
483			ASSERT(tnp->tn_nlink > 0);
484			DECR_COUNT(&tnp->tn_nlink, &tnp->tn_tlock);
485		}
486		rw_exit(&tnp->tn_rwlock);
487	}
488
489	ASSERT(tm->tm_rootnode);
490
491	/*
492	 * All links are gone, v_count is keeping nodes in place.
493	 * VN_RELE should make the node disappear, unless somebody
494	 * is holding pages against it.  Nap and retry until it disappears.
495	 *
496	 * We re-acquire the lock to prevent others who have a HOLD on
497	 * a tmpnode via its pages or anon slots from blowing it away
498	 * (in tmp_inactive) while we're trying to get to it here. Once
499	 * we have a HOLD on it we know it'll stick around.
500	 *
501	 */
502	mutex_enter(&tm->tm_contents);
503	/*
504	 * Remove all the files (except the rootnode) backwards.
505	 */
506	while ((tnp = tm->tm_rootnode->tn_back) != tm->tm_rootnode) {
507		mutex_exit(&tm->tm_contents);
508		/*
509		 * Inhibit tmp_inactive from touching attribute directory
510		 * as all nodes will be released here.
511		 * Note we handled the link count in pass 2 above.
512		 */
513		rw_enter(&tnp->tn_rwlock, RW_WRITER);
514		tnp->tn_xattrdp = NULL;
515		rw_exit(&tnp->tn_rwlock);
516		vp = TNTOV(tnp);
517		VN_RELE(vp);
518		mutex_enter(&tm->tm_contents);
519		/*
520		 * It's still there after the RELE. Someone else like pageout
521		 * has a hold on it so wait a bit and then try again - we know
522		 * they'll give it up soon.
523		 */
524		if (tnp == tm->tm_rootnode->tn_back) {
525			VN_HOLD(vp);
526			mutex_exit(&tm->tm_contents);
527			delay(hz / 4);
528			mutex_enter(&tm->tm_contents);
529		}
530	}
531	mutex_exit(&tm->tm_contents);
532
533	tm->tm_rootnode->tn_xattrdp = NULL;
534	VN_RELE(TNTOV(tm->tm_rootnode));
535
536	ASSERT(tm->tm_mntpath);
537
538	tmp_memfree(tm->tm_mntpath, strlen(tm->tm_mntpath) + 1);
539
540	ASSERT(tm->tm_anonmem == 0);
541
542	mutex_destroy(&tm->tm_contents);
543	mutex_destroy(&tm->tm_renamelck);
544	tmp_memfree(tm, sizeof (struct tmount));
545
546	return (0);
547}
548
549/*
550 * return root tmpnode for given vnode
551 */
552static int
553tmp_root(struct vfs *vfsp, struct vnode **vpp)
554{
555	struct tmount *tm = (struct tmount *)VFSTOTM(vfsp);
556	struct tmpnode *tp = tm->tm_rootnode;
557	struct vnode *vp;
558
559	ASSERT(tp);
560
561	vp = TNTOV(tp);
562	VN_HOLD(vp);
563	*vpp = vp;
564	return (0);
565}
566
567static int
568tmp_statvfs(struct vfs *vfsp, struct statvfs64 *sbp)
569{
570	struct tmount	*tm = (struct tmount *)VFSTOTM(vfsp);
571	ulong_t	blocks;
572	dev32_t d32;
573	zoneid_t eff_zid;
574	struct zone *zp;
575
576	/*
577	 * The file system may have been mounted by the global zone on
578	 * behalf of the non-global zone.  In that case, the tmount zone_id
579	 * will be the global zone.  We still want to show the swap cap inside
580	 * the zone in this case, even though the file system was mounted by
581	 * the global zone.
582	 */
583	if (curproc->p_zone->zone_id != GLOBAL_ZONEUNIQID)
584		zp = curproc->p_zone;
585	else
586		zp = tm->tm_vfsp->vfs_zone;
587
588	if (zp == NULL)
589		eff_zid = GLOBAL_ZONEUNIQID;
590	else
591		eff_zid = zp->zone_id;
592
593	sbp->f_bsize = PAGESIZE;
594	sbp->f_frsize = PAGESIZE;
595
596	/*
597	 * Find the amount of available physical and memory swap
598	 */
599	mutex_enter(&anoninfo_lock);
600	ASSERT(k_anoninfo.ani_max >= k_anoninfo.ani_phys_resv);
601	blocks = (ulong_t)CURRENT_TOTAL_AVAILABLE_SWAP;
602	mutex_exit(&anoninfo_lock);
603
604	/*
605	 * If tm_anonmax for this mount is less than the available swap space
606	 * (minus the amount tmpfs can't use), use that instead
607	 */
608	if (blocks > tmpfs_minfree)
609		sbp->f_bfree = MIN(blocks - tmpfs_minfree,
610		    tm->tm_anonmax - tm->tm_anonmem);
611	else
612		sbp->f_bfree = 0;
613
614	sbp->f_bavail = sbp->f_bfree;
615
616	/*
617	 * Total number of blocks is what's available plus what's been used
618	 */
619	sbp->f_blocks = (fsblkcnt64_t)(sbp->f_bfree + tm->tm_anonmem);
620
621	if (eff_zid != GLOBAL_ZONEUNIQID &&
622	    zp->zone_max_swap_ctl != UINT64_MAX) {
623		/*
624		 * If the fs is used by a non-global zone with a swap cap,
625		 * then report the capped size.
626		 */
627		rctl_qty_t cap, used;
628		pgcnt_t pgcap, pgused;
629
630		mutex_enter(&zp->zone_mem_lock);
631		cap = zp->zone_max_swap_ctl;
632		used = zp->zone_max_swap;
633		mutex_exit(&zp->zone_mem_lock);
634
635		pgcap = btop(cap);
636		pgused = btop(used);
637
638		sbp->f_bfree = MIN(pgcap - pgused, sbp->f_bfree);
639		sbp->f_bavail = sbp->f_bfree;
640		sbp->f_blocks = MIN(pgcap, sbp->f_blocks);
641	}
642
643	/*
644	 * The maximum number of files available is approximately the number
645	 * of tmpnodes we can allocate from the remaining kernel memory
646	 * available to tmpfs.  This is fairly inaccurate since it doesn't
647	 * take into account the names stored in the directory entries.
648	 */
649	if (tmpfs_maxkmem > tmp_kmemspace)
650		sbp->f_ffree = (tmpfs_maxkmem - tmp_kmemspace) /
651		    (sizeof (struct tmpnode) + sizeof (struct tdirent));
652	else
653		sbp->f_ffree = 0;
654
655	sbp->f_files = tmpfs_maxkmem /
656	    (sizeof (struct tmpnode) + sizeof (struct tdirent));
657	sbp->f_favail = (fsfilcnt64_t)(sbp->f_ffree);
658	(void) cmpldev(&d32, vfsp->vfs_dev);
659	sbp->f_fsid = d32;
660	(void) strcpy(sbp->f_basetype, vfssw[tmpfsfstype].vsw_name);
661	(void) strncpy(sbp->f_fstr, tm->tm_mntpath, sizeof (sbp->f_fstr));
662	/*
663	 * ensure null termination
664	 */
665	sbp->f_fstr[sizeof (sbp->f_fstr) - 1] = '\0';
666	sbp->f_flag = vf_to_stf(vfsp->vfs_flag);
667	sbp->f_namemax = MAXNAMELEN - 1;
668	return (0);
669}
670
671static int
672tmp_vget(struct vfs *vfsp, struct vnode **vpp, struct fid *fidp)
673{
674	struct tfid *tfid;
675	struct tmount *tm = (struct tmount *)VFSTOTM(vfsp);
676	struct tmpnode *tp = NULL;
677
678	tfid = (struct tfid *)fidp;
679	*vpp = NULL;
680
681	mutex_enter(&tm->tm_contents);
682	for (tp = tm->tm_rootnode; tp; tp = tp->tn_forw) {
683		mutex_enter(&tp->tn_tlock);
684		if (tp->tn_nodeid == tfid->tfid_ino) {
685			/*
686			 * If the gen numbers don't match we know the
687			 * file won't be found since only one tmpnode
688			 * can have this number at a time.
689			 */
690			if (tp->tn_gen != tfid->tfid_gen || tp->tn_nlink == 0) {
691				mutex_exit(&tp->tn_tlock);
692				mutex_exit(&tm->tm_contents);
693				return (0);
694			}
695			*vpp = (struct vnode *)TNTOV(tp);
696
697			VN_HOLD(*vpp);
698
699			if ((tp->tn_mode & S_ISVTX) &&
700			    !(tp->tn_mode & (S_IXUSR | S_IFDIR))) {
701				mutex_enter(&(*vpp)->v_lock);
702				(*vpp)->v_flag |= VISSWAP;
703				mutex_exit(&(*vpp)->v_lock);
704			}
705			mutex_exit(&tp->tn_tlock);
706			mutex_exit(&tm->tm_contents);
707			return (0);
708		}
709		mutex_exit(&tp->tn_tlock);
710	}
711	mutex_exit(&tm->tm_contents);
712	return (0);
713}
714