1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 /*
22  * Copyright 2007 Sun Microsystems, Inc.  All rights reserved.
23  * Use is subject to license terms.
24  */
25 
26 #pragma ident	"%Z%%M%	%I%	%E% SMI"
27 
28 #include <sys/types.h>
29 #include <sys/param.h>
30 #include <sys/t_lock.h>
31 #include <sys/systm.h>
32 #include <sys/sysmacros.h>
33 #include <sys/user.h>
34 #include <sys/time.h>
35 #include <sys/vfs.h>
36 #include <sys/vfs_opreg.h>
37 #include <sys/vnode.h>
38 #include <sys/file.h>
39 #include <sys/fcntl.h>
40 #include <sys/flock.h>
41 #include <sys/kmem.h>
42 #include <sys/uio.h>
43 #include <sys/errno.h>
44 #include <sys/stat.h>
45 #include <sys/cred.h>
46 #include <sys/dirent.h>
47 #include <sys/pathname.h>
48 #include <sys/vmsystm.h>
49 #include <sys/fs/tmp.h>
50 #include <sys/fs/tmpnode.h>
51 #include <sys/mman.h>
52 #include <vm/hat.h>
53 #include <vm/seg_vn.h>
54 #include <vm/seg_map.h>
55 #include <vm/seg.h>
56 #include <vm/anon.h>
57 #include <vm/as.h>
58 #include <vm/page.h>
59 #include <vm/pvn.h>
60 #include <sys/cmn_err.h>
61 #include <sys/debug.h>
62 #include <sys/swap.h>
63 #include <sys/buf.h>
64 #include <sys/vm.h>
65 #include <sys/vtrace.h>
66 #include <sys/policy.h>
67 #include <fs/fs_subr.h>
68 
69 static int	tmp_getapage(struct vnode *, u_offset_t, size_t, uint_t *,
70 	page_t **, size_t, struct seg *, caddr_t, enum seg_rw, struct cred *);
71 static int 	tmp_putapage(struct vnode *, page_t *, u_offset_t *, size_t *,
72 	int, struct cred *);
73 
74 /* ARGSUSED1 */
75 static int
76 tmp_open(struct vnode **vpp, int flag, struct cred *cred, caller_context_t *ct)
77 {
78 	/*
79 	 * swapon to a tmpfs file is not supported so access
80 	 * is denied on open if VISSWAP is set.
81 	 */
82 	if ((*vpp)->v_flag & VISSWAP)
83 		return (EINVAL);
84 	return (0);
85 }
86 
87 /* ARGSUSED1 */
88 static int
89 tmp_close(
90 	struct vnode *vp,
91 	int flag,
92 	int count,
93 	offset_t offset,
94 	struct cred *cred,
95 	caller_context_t *ct)
96 {
97 	cleanlocks(vp, ttoproc(curthread)->p_pid, 0);
98 	cleanshares(vp, ttoproc(curthread)->p_pid);
99 	return (0);
100 }
101 
102 /*
103  * wrtmp does the real work of write requests for tmpfs.
104  */
105 static int
106 wrtmp(
107 	struct tmount *tm,
108 	struct tmpnode *tp,
109 	struct uio *uio,
110 	struct cred *cr,
111 	struct caller_context *ct)
112 {
113 	pgcnt_t pageoffset;	/* offset in pages */
114 	ulong_t segmap_offset;	/* pagesize byte offset into segmap */
115 	caddr_t base;		/* base of segmap */
116 	ssize_t bytes;		/* bytes to uiomove */
117 	pfn_t pagenumber;	/* offset in pages into tmp file */
118 	struct vnode *vp;
119 	int error = 0;
120 	int	pagecreate;	/* == 1 if we allocated a page */
121 	int	newpage;
122 	rlim64_t limit = uio->uio_llimit;
123 	long oresid = uio->uio_resid;
124 	timestruc_t now;
125 
126 	/*
127 	 * tp->tn_size is incremented before the uiomove
128 	 * is done on a write.  If the move fails (bad user
129 	 * address) reset tp->tn_size.
130 	 * The better way would be to increment tp->tn_size
131 	 * only if the uiomove succeeds.
132 	 */
133 	long tn_size_changed = 0;
134 	long old_tn_size;
135 
136 	vp = TNTOV(tp);
137 	ASSERT(vp->v_type == VREG);
138 
139 	TRACE_1(TR_FAC_TMPFS, TR_TMPFS_RWTMP_START,
140 		"tmp_wrtmp_start:vp %p", vp);
141 
142 	ASSERT(RW_WRITE_HELD(&tp->tn_contents));
143 	ASSERT(RW_WRITE_HELD(&tp->tn_rwlock));
144 
145 	if (MANDLOCK(vp, tp->tn_mode)) {
146 		rw_exit(&tp->tn_contents);
147 		/*
148 		 * tmp_getattr ends up being called by chklock
149 		 */
150 		error = chklock(vp, FWRITE,
151 			uio->uio_loffset, uio->uio_resid, uio->uio_fmode, ct);
152 		rw_enter(&tp->tn_contents, RW_WRITER);
153 		if (error != 0) {
154 			TRACE_2(TR_FAC_TMPFS, TR_TMPFS_RWTMP_END,
155 				"tmp_wrtmp_end:vp %p error %d", vp, error);
156 			return (error);
157 		}
158 	}
159 
160 	if (uio->uio_loffset < 0)
161 		return (EINVAL);
162 
163 	if (limit == RLIM64_INFINITY || limit > MAXOFFSET_T)
164 		limit = MAXOFFSET_T;
165 
166 	if (uio->uio_loffset >= limit) {
167 		proc_t *p = ttoproc(curthread);
168 
169 		mutex_enter(&p->p_lock);
170 		(void) rctl_action(rctlproc_legacy[RLIMIT_FSIZE], p->p_rctls,
171 		    p, RCA_UNSAFE_SIGINFO);
172 		mutex_exit(&p->p_lock);
173 		return (EFBIG);
174 	}
175 
176 	if (uio->uio_loffset >= MAXOFF_T) {
177 		TRACE_2(TR_FAC_TMPFS, TR_TMPFS_RWTMP_END,
178 			"tmp_wrtmp_end:vp %p error %d", vp, EINVAL);
179 		return (EFBIG);
180 	}
181 
182 	if (uio->uio_resid == 0) {
183 		TRACE_2(TR_FAC_TMPFS, TR_TMPFS_RWTMP_END,
184 			"tmp_wrtmp_end:vp %p error %d", vp, 0);
185 		return (0);
186 	}
187 
188 	if (limit > MAXOFF_T)
189 		limit = MAXOFF_T;
190 
191 	do {
192 		long	offset;
193 		long	delta;
194 
195 		offset = (long)uio->uio_offset;
196 		pageoffset = offset & PAGEOFFSET;
197 		/*
198 		 * A maximum of PAGESIZE bytes of data is transferred
199 		 * each pass through this loop
200 		 */
201 		bytes = MIN(PAGESIZE - pageoffset, uio->uio_resid);
202 
203 		if (offset + bytes >= limit) {
204 			if (offset >= limit) {
205 				error = EFBIG;
206 				goto out;
207 			}
208 			bytes = limit - offset;
209 		}
210 		pagenumber = btop(offset);
211 
212 		/*
213 		 * delta is the amount of anonymous memory
214 		 * to reserve for the file.
215 		 * We always reserve in pagesize increments so
216 		 * unless we're extending the file into a new page,
217 		 * we don't need to call tmp_resv.
218 		 */
219 		delta = offset + bytes -
220 		    P2ROUNDUP_TYPED(tp->tn_size, PAGESIZE, u_offset_t);
221 		if (delta > 0) {
222 			pagecreate = 1;
223 			if (tmp_resv(tm, tp, delta, pagecreate)) {
224 				/*
225 				 * Log file system full in the zone that owns
226 				 * the tmpfs mount, as well as in the global
227 				 * zone if necessary.
228 				 */
229 				zcmn_err(tm->tm_vfsp->vfs_zone->zone_id,
230 				    CE_WARN, "%s: File system full, "
231 				    "swap space limit exceeded",
232 				    tm->tm_mntpath);
233 
234 				if (tm->tm_vfsp->vfs_zone->zone_id !=
235 				    GLOBAL_ZONEID) {
236 
237 					vfs_t *vfs = tm->tm_vfsp;
238 
239 					zcmn_err(GLOBAL_ZONEID,
240 					    CE_WARN, "%s: File system full, "
241 					    "swap space limit exceeded",
242 					    vfs->vfs_vnodecovered->v_path);
243 				}
244 				error = ENOSPC;
245 				break;
246 			}
247 			tmpnode_growmap(tp, (ulong_t)offset + bytes);
248 		}
249 		/* grow the file to the new length */
250 		if (offset + bytes > tp->tn_size) {
251 			tn_size_changed = 1;
252 			old_tn_size = tp->tn_size;
253 			tp->tn_size = offset + bytes;
254 		}
255 		if (bytes == PAGESIZE) {
256 			/*
257 			 * Writing whole page so reading from disk
258 			 * is a waste
259 			 */
260 			pagecreate = 1;
261 		} else {
262 			pagecreate = 0;
263 		}
264 		/*
265 		 * If writing past EOF or filling in a hole
266 		 * we need to allocate an anon slot.
267 		 */
268 		if (anon_get_ptr(tp->tn_anon, pagenumber) == NULL) {
269 			(void) anon_set_ptr(tp->tn_anon, pagenumber,
270 				anon_alloc(vp, ptob(pagenumber)), ANON_SLEEP);
271 			pagecreate = 1;
272 			tp->tn_nblocks++;
273 		}
274 
275 		/*
276 		 * We have to drop the contents lock to allow the VM
277 		 * system to reacquire it in tmp_getpage()
278 		 */
279 		rw_exit(&tp->tn_contents);
280 
281 		newpage = 0;
282 		if (vpm_enable) {
283 			/*
284 			 * Copy data. If new pages are created, part of
285 			 * the page that is not written will be initizliazed
286 			 * with zeros.
287 			 */
288 			error = vpm_data_copy(vp, offset, bytes, uio,
289 				!pagecreate, &newpage, 1, S_WRITE);
290 		} else {
291 			/* Get offset within the segmap mapping */
292 			segmap_offset = (offset & PAGEMASK) & MAXBOFFSET;
293 			base = segmap_getmapflt(segkmap, vp,
294 						(offset &  MAXBMASK),
295 			    PAGESIZE, !pagecreate, S_WRITE);
296 		}
297 
298 
299 		if (!vpm_enable && pagecreate) {
300 			/*
301 			 * segmap_pagecreate() returns 1 if it calls
302 			 * page_create_va() to allocate any pages.
303 			 */
304 			newpage = segmap_pagecreate(segkmap,
305 			    base + segmap_offset, (size_t)PAGESIZE, 0);
306 			/*
307 			 * Clear from the beginning of the page to the starting
308 			 * offset of the data.
309 			 */
310 			if (pageoffset != 0)
311 				(void) kzero(base + segmap_offset,
312 				    (size_t)pageoffset);
313 		}
314 
315 		if (!vpm_enable) {
316 			error = uiomove(base + segmap_offset + pageoffset,
317 			(long)bytes, UIO_WRITE, uio);
318 		}
319 
320 		if (!vpm_enable && pagecreate &&
321 		    uio->uio_offset < P2ROUNDUP(offset + bytes, PAGESIZE)) {
322 			long	zoffset; /* zero from offset into page */
323 			/*
324 			 * We created pages w/o initializing them completely,
325 			 * thus we need to zero the part that wasn't set up.
326 			 * This happens on most EOF write cases and if
327 			 * we had some sort of error during the uiomove.
328 			 */
329 			long nmoved;
330 
331 			nmoved = uio->uio_offset - offset;
332 			ASSERT((nmoved + pageoffset) <= PAGESIZE);
333 
334 			/*
335 			 * Zero from the end of data in the page to the
336 			 * end of the page.
337 			 */
338 			if ((zoffset = pageoffset + nmoved) < PAGESIZE)
339 				(void) kzero(base + segmap_offset + zoffset,
340 					(size_t)PAGESIZE - zoffset);
341 		}
342 
343 		/*
344 		 * Unlock the pages which have been allocated by
345 		 * page_create_va() in segmap_pagecreate()
346 		 */
347 		if (!vpm_enable && newpage) {
348 			segmap_pageunlock(segkmap, base + segmap_offset,
349 			    (size_t)PAGESIZE, S_WRITE);
350 		}
351 
352 		if (error) {
353 			/*
354 			 * If we failed on a write, we must
355 			 * be sure to invalidate any pages that may have
356 			 * been allocated.
357 			 */
358 			if (vpm_enable) {
359 				(void) vpm_sync_pages(vp, offset,
360 						PAGESIZE, SM_INVAL);
361 			} else {
362 				(void) segmap_release(segkmap, base, SM_INVAL);
363 			}
364 		} else {
365 			if (vpm_enable) {
366 				error = vpm_sync_pages(vp, offset,
367 						PAGESIZE, 0);
368 			} else {
369 				error = segmap_release(segkmap, base, 0);
370 			}
371 		}
372 
373 		/*
374 		 * Re-acquire contents lock.
375 		 */
376 		rw_enter(&tp->tn_contents, RW_WRITER);
377 		/*
378 		 * If the uiomove failed, fix up tn_size.
379 		 */
380 		if (error) {
381 			if (tn_size_changed) {
382 				/*
383 				 * The uiomove failed, and we
384 				 * allocated blocks,so get rid
385 				 * of them.
386 				 */
387 				(void) tmpnode_trunc(tm, tp,
388 				    (ulong_t)old_tn_size);
389 			}
390 		} else {
391 			/*
392 			 * XXX - Can this be out of the loop?
393 			 */
394 			if ((tp->tn_mode & (S_IXUSR | S_IXGRP | S_IXOTH)) &&
395 			    (tp->tn_mode & (S_ISUID | S_ISGID)) &&
396 			    secpolicy_vnode_setid_retain(cr,
397 			    (tp->tn_mode & S_ISUID) != 0 && tp->tn_uid == 0)) {
398 				/*
399 				 * Clear Set-UID & Set-GID bits on
400 				 * successful write if not privileged
401 				 * and at least one of the execute bits
402 				 * is set.  If we always clear Set-GID,
403 				 * mandatory file and record locking is
404 				 * unuseable.
405 				 */
406 				tp->tn_mode &= ~(S_ISUID | S_ISGID);
407 			}
408 			gethrestime(&now);
409 			tp->tn_mtime = now;
410 			tp->tn_ctime = now;
411 		}
412 	} while (error == 0 && uio->uio_resid > 0 && bytes != 0);
413 
414 out:
415 	/*
416 	 * If we've already done a partial-write, terminate
417 	 * the write but return no error.
418 	 */
419 	if (oresid != uio->uio_resid)
420 		error = 0;
421 	TRACE_2(TR_FAC_TMPFS, TR_TMPFS_RWTMP_END,
422 		"tmp_wrtmp_end:vp %p error %d", vp, error);
423 	return (error);
424 }
425 
426 /*
427  * rdtmp does the real work of read requests for tmpfs.
428  */
429 static int
430 rdtmp(
431 	struct tmount *tm,
432 	struct tmpnode *tp,
433 	struct uio *uio,
434 	struct caller_context *ct)
435 {
436 	ulong_t pageoffset;	/* offset in tmpfs file (uio_offset) */
437 	ulong_t segmap_offset;	/* pagesize byte offset into segmap */
438 	caddr_t base;		/* base of segmap */
439 	ssize_t bytes;		/* bytes to uiomove */
440 	struct vnode *vp;
441 	int error;
442 	long oresid = uio->uio_resid;
443 
444 #if defined(lint)
445 	tm = tm;
446 #endif
447 	vp = TNTOV(tp);
448 
449 	TRACE_1(TR_FAC_TMPFS, TR_TMPFS_RWTMP_START,
450 		"tmp_rdtmp_start:vp %p", vp);
451 
452 	ASSERT(RW_LOCK_HELD(&tp->tn_contents));
453 
454 	if (MANDLOCK(vp, tp->tn_mode)) {
455 		rw_exit(&tp->tn_contents);
456 		/*
457 		 * tmp_getattr ends up being called by chklock
458 		 */
459 		error = chklock(vp, FREAD,
460 			uio->uio_loffset, uio->uio_resid, uio->uio_fmode, ct);
461 		rw_enter(&tp->tn_contents, RW_READER);
462 		if (error != 0) {
463 			TRACE_2(TR_FAC_TMPFS, TR_TMPFS_RWTMP_END,
464 				"tmp_rdtmp_end:vp %p error %d", vp, error);
465 			return (error);
466 		}
467 	}
468 	ASSERT(tp->tn_type == VREG);
469 
470 	if (uio->uio_loffset >= MAXOFF_T) {
471 		TRACE_2(TR_FAC_TMPFS, TR_TMPFS_RWTMP_END,
472 			"tmp_rdtmp_end:vp %p error %d", vp, EINVAL);
473 		return (0);
474 	}
475 	if (uio->uio_loffset < 0)
476 		return (EINVAL);
477 	if (uio->uio_resid == 0) {
478 		TRACE_2(TR_FAC_TMPFS, TR_TMPFS_RWTMP_END,
479 			"tmp_rdtmp_end:vp %p error %d", vp, 0);
480 		return (0);
481 	}
482 
483 	vp = TNTOV(tp);
484 
485 	do {
486 		long diff;
487 		long offset;
488 
489 		offset = uio->uio_offset;
490 		pageoffset = offset & PAGEOFFSET;
491 		bytes = MIN(PAGESIZE - pageoffset, uio->uio_resid);
492 
493 		diff = tp->tn_size - offset;
494 
495 		if (diff <= 0) {
496 			error = 0;
497 			goto out;
498 		}
499 		if (diff < bytes)
500 			bytes = diff;
501 
502 		/*
503 		 * We have to drop the contents lock to prevent the VM
504 		 * system from trying to reacquire it in tmp_getpage()
505 		 * should the uiomove cause a pagefault.
506 		 */
507 		rw_exit(&tp->tn_contents);
508 
509 		if (vpm_enable) {
510 			/*
511 			 * Copy data.
512 			 */
513 			error = vpm_data_copy(vp, offset, bytes, uio,
514 				1, NULL, 0, S_READ);
515 		} else {
516 			segmap_offset = (offset & PAGEMASK) & MAXBOFFSET;
517 			base = segmap_getmapflt(segkmap, vp, offset & MAXBMASK,
518 			    bytes, 1, S_READ);
519 
520 			error = uiomove(base + segmap_offset + pageoffset,
521 			    (long)bytes, UIO_READ, uio);
522 		}
523 
524 		if (error) {
525 			if (vpm_enable) {
526 				(void) vpm_sync_pages(vp, offset,
527 						PAGESIZE, 0);
528 			} else {
529 				(void) segmap_release(segkmap, base, 0);
530 			}
531 		} else {
532 			if (vpm_enable) {
533 				error = vpm_sync_pages(vp, offset,
534 						PAGESIZE, 0);
535 			} else {
536 				error = segmap_release(segkmap, base, 0);
537 			}
538 		}
539 
540 		/*
541 		 * Re-acquire contents lock.
542 		 */
543 		rw_enter(&tp->tn_contents, RW_READER);
544 
545 	} while (error == 0 && uio->uio_resid > 0);
546 
547 out:
548 	gethrestime(&tp->tn_atime);
549 
550 	/*
551 	 * If we've already done a partial read, terminate
552 	 * the read but return no error.
553 	 */
554 	if (oresid != uio->uio_resid)
555 		error = 0;
556 
557 	TRACE_2(TR_FAC_TMPFS, TR_TMPFS_RWTMP_END,
558 		"tmp_rdtmp_end:vp %x error %d", vp, error);
559 	return (error);
560 }
561 
562 /* ARGSUSED2 */
563 static int
564 tmp_read(struct vnode *vp, struct uio *uiop, int ioflag, cred_t *cred,
565 	struct caller_context *ct)
566 {
567 	struct tmpnode *tp = (struct tmpnode *)VTOTN(vp);
568 	struct tmount *tm = (struct tmount *)VTOTM(vp);
569 	int error;
570 
571 	/*
572 	 * We don't currently support reading non-regular files
573 	 */
574 	if (vp->v_type == VDIR)
575 		return (EISDIR);
576 	if (vp->v_type != VREG)
577 		return (EINVAL);
578 	/*
579 	 * tmp_rwlock should have already been called from layers above
580 	 */
581 	ASSERT(RW_READ_HELD(&tp->tn_rwlock));
582 
583 	rw_enter(&tp->tn_contents, RW_READER);
584 
585 	error = rdtmp(tm, tp, uiop, ct);
586 
587 	rw_exit(&tp->tn_contents);
588 
589 	return (error);
590 }
591 
592 static int
593 tmp_write(struct vnode *vp, struct uio *uiop, int ioflag, struct cred *cred,
594 	struct caller_context *ct)
595 {
596 	struct tmpnode *tp = (struct tmpnode *)VTOTN(vp);
597 	struct tmount *tm = (struct tmount *)VTOTM(vp);
598 	int error;
599 
600 	/*
601 	 * We don't currently support writing to non-regular files
602 	 */
603 	if (vp->v_type != VREG)
604 		return (EINVAL);	/* XXX EISDIR? */
605 
606 	/*
607 	 * tmp_rwlock should have already been called from layers above
608 	 */
609 	ASSERT(RW_WRITE_HELD(&tp->tn_rwlock));
610 
611 	rw_enter(&tp->tn_contents, RW_WRITER);
612 
613 	if (ioflag & FAPPEND) {
614 		/*
615 		 * In append mode start at end of file.
616 		 */
617 		uiop->uio_loffset = tp->tn_size;
618 	}
619 
620 	error = wrtmp(tm, tp, uiop, cred, ct);
621 
622 	rw_exit(&tp->tn_contents);
623 
624 	return (error);
625 }
626 
627 /* ARGSUSED */
628 static int
629 tmp_ioctl(
630 	struct vnode *vp,
631 	int com,
632 	intptr_t data,
633 	int flag,
634 	struct cred *cred,
635 	int *rvalp,
636 	caller_context_t *ct)
637 {
638 	return (ENOTTY);
639 }
640 
641 /* ARGSUSED2 */
642 static int
643 tmp_getattr(
644 	struct vnode *vp,
645 	struct vattr *vap,
646 	int flags,
647 	struct cred *cred,
648 	caller_context_t *ct)
649 {
650 	struct tmpnode *tp = (struct tmpnode *)VTOTN(vp);
651 	struct vnode *mvp;
652 	struct vattr va;
653 	int attrs = 1;
654 
655 	/*
656 	 * A special case to handle the root tnode on a diskless nfs
657 	 * client who may have had its uid and gid inherited
658 	 * from an nfs vnode with nobody ownership.  Likely the
659 	 * root filesystem. After nfs is fully functional the uid/gid
660 	 * may be mapable so ask again.
661 	 * vfsp can't get unmounted because we hold vp.
662 	 */
663 	if (vp->v_flag & VROOT &&
664 	    (mvp = vp->v_vfsp->vfs_vnodecovered) != NULL) {
665 		mutex_enter(&tp->tn_tlock);
666 		if (tp->tn_uid == UID_NOBODY || tp->tn_gid == GID_NOBODY) {
667 			mutex_exit(&tp->tn_tlock);
668 			bzero(&va, sizeof (struct vattr));
669 			va.va_mask = AT_UID|AT_GID;
670 			attrs = VOP_GETATTR(mvp, &va, 0, cred, ct);
671 		} else {
672 			mutex_exit(&tp->tn_tlock);
673 		}
674 	}
675 	mutex_enter(&tp->tn_tlock);
676 	if (attrs == 0) {
677 		tp->tn_uid = va.va_uid;
678 		tp->tn_gid = va.va_gid;
679 	}
680 	vap->va_type = vp->v_type;
681 	vap->va_mode = tp->tn_mode & MODEMASK;
682 	vap->va_uid = tp->tn_uid;
683 	vap->va_gid = tp->tn_gid;
684 	vap->va_fsid = tp->tn_fsid;
685 	vap->va_nodeid = (ino64_t)tp->tn_nodeid;
686 	vap->va_nlink = tp->tn_nlink;
687 	vap->va_size = (u_offset_t)tp->tn_size;
688 	vap->va_atime = tp->tn_atime;
689 	vap->va_mtime = tp->tn_mtime;
690 	vap->va_ctime = tp->tn_ctime;
691 	vap->va_blksize = PAGESIZE;
692 	vap->va_rdev = tp->tn_rdev;
693 	vap->va_seq = tp->tn_seq;
694 
695 	/*
696 	 * XXX Holes are not taken into account.  We could take the time to
697 	 * run through the anon array looking for allocated slots...
698 	 */
699 	vap->va_nblocks = (fsblkcnt64_t)btodb(ptob(btopr(vap->va_size)));
700 	mutex_exit(&tp->tn_tlock);
701 	return (0);
702 }
703 
704 /*ARGSUSED4*/
705 static int
706 tmp_setattr(
707 	struct vnode *vp,
708 	struct vattr *vap,
709 	int flags,
710 	struct cred *cred,
711 	caller_context_t *ct)
712 {
713 	struct tmount *tm = (struct tmount *)VTOTM(vp);
714 	struct tmpnode *tp = (struct tmpnode *)VTOTN(vp);
715 	int error = 0;
716 	struct vattr *get;
717 	long mask;
718 
719 	/*
720 	 * Cannot set these attributes
721 	 */
722 	if ((vap->va_mask & AT_NOSET) || (vap->va_mask & AT_XVATTR))
723 		return (EINVAL);
724 
725 	mutex_enter(&tp->tn_tlock);
726 
727 	get = &tp->tn_attr;
728 	/*
729 	 * Change file access modes. Must be owner or have sufficient
730 	 * privileges.
731 	 */
732 	error = secpolicy_vnode_setattr(cred, vp, vap, get, flags,
733 			    tmp_taccess, tp);
734 
735 	if (error)
736 		goto out;
737 
738 	mask = vap->va_mask;
739 
740 	if (mask & AT_MODE) {
741 		get->va_mode &= S_IFMT;
742 		get->va_mode |= vap->va_mode & ~S_IFMT;
743 	}
744 
745 	if (mask & AT_UID)
746 		get->va_uid = vap->va_uid;
747 	if (mask & AT_GID)
748 		get->va_gid = vap->va_gid;
749 	if (mask & AT_ATIME)
750 		get->va_atime = vap->va_atime;
751 	if (mask & AT_MTIME)
752 		get->va_mtime = vap->va_mtime;
753 
754 	if (mask & (AT_UID | AT_GID | AT_MODE | AT_MTIME))
755 		gethrestime(&tp->tn_ctime);
756 
757 	if (mask & AT_SIZE) {
758 		ASSERT(vp->v_type != VDIR);
759 
760 		/* Don't support large files. */
761 		if (vap->va_size > MAXOFF_T) {
762 			error = EFBIG;
763 			goto out;
764 		}
765 		mutex_exit(&tp->tn_tlock);
766 
767 		rw_enter(&tp->tn_rwlock, RW_WRITER);
768 		rw_enter(&tp->tn_contents, RW_WRITER);
769 		error = tmpnode_trunc(tm, tp, (ulong_t)vap->va_size);
770 		rw_exit(&tp->tn_contents);
771 		rw_exit(&tp->tn_rwlock);
772 		goto out1;
773 	}
774 out:
775 	mutex_exit(&tp->tn_tlock);
776 out1:
777 	return (error);
778 }
779 
780 /* ARGSUSED2 */
781 static int
782 tmp_access(
783 	struct vnode *vp,
784 	int mode,
785 	int flags,
786 	struct cred *cred,
787 	caller_context_t *ct)
788 {
789 	struct tmpnode *tp = (struct tmpnode *)VTOTN(vp);
790 	int error;
791 
792 	mutex_enter(&tp->tn_tlock);
793 	error = tmp_taccess(tp, mode, cred);
794 	mutex_exit(&tp->tn_tlock);
795 	return (error);
796 }
797 
798 /* ARGSUSED3 */
799 static int
800 tmp_lookup(
801 	struct vnode *dvp,
802 	char *nm,
803 	struct vnode **vpp,
804 	struct pathname *pnp,
805 	int flags,
806 	struct vnode *rdir,
807 	struct cred *cred,
808 	caller_context_t *ct,
809 	int *direntflags,
810 	pathname_t *realpnp)
811 {
812 	struct tmpnode *tp = (struct tmpnode *)VTOTN(dvp);
813 	struct tmpnode *ntp = NULL;
814 	int error;
815 
816 
817 	/* allow cd into @ dir */
818 	if (flags & LOOKUP_XATTR) {
819 		struct tmpnode *xdp;
820 		struct tmount *tm;
821 
822 		/*
823 		 * don't allow attributes if not mounted XATTR support
824 		 */
825 		if (!(dvp->v_vfsp->vfs_flag & VFS_XATTR))
826 			return (EINVAL);
827 
828 		if (tp->tn_flags & ISXATTR)
829 			/* No attributes on attributes */
830 			return (EINVAL);
831 
832 		rw_enter(&tp->tn_rwlock, RW_WRITER);
833 		if (tp->tn_xattrdp == NULL) {
834 			if (!(flags & CREATE_XATTR_DIR)) {
835 				rw_exit(&tp->tn_rwlock);
836 				return (ENOENT);
837 			}
838 
839 			/*
840 			 * No attribute directory exists for this
841 			 * node - create the attr dir as a side effect
842 			 * of this lookup.
843 			 */
844 
845 			/*
846 			 * Make sure we have adequate permission...
847 			 */
848 
849 			if ((error = tmp_taccess(tp, VWRITE, cred)) != 0) {
850 				rw_exit(&tp->tn_rwlock);
851 				return (error);
852 			}
853 
854 			xdp = tmp_memalloc(sizeof (struct tmpnode),
855 				TMP_MUSTHAVE);
856 			tm = VTOTM(dvp);
857 			tmpnode_init(tm, xdp, &tp->tn_attr, NULL);
858 			/*
859 			 * Fix-up fields unique to attribute directories.
860 			 */
861 			xdp->tn_flags = ISXATTR;
862 			xdp->tn_type = VDIR;
863 			if (tp->tn_type == VDIR) {
864 				xdp->tn_mode = tp->tn_attr.va_mode;
865 			} else {
866 				xdp->tn_mode = 0700;
867 				if (tp->tn_attr.va_mode & 0040)
868 					xdp->tn_mode |= 0750;
869 				if (tp->tn_attr.va_mode & 0004)
870 					xdp->tn_mode |= 0705;
871 			}
872 			xdp->tn_vnode->v_type = VDIR;
873 			xdp->tn_vnode->v_flag |= V_XATTRDIR;
874 			tdirinit(tp, xdp);
875 			tp->tn_xattrdp = xdp;
876 		} else {
877 			VN_HOLD(tp->tn_xattrdp->tn_vnode);
878 		}
879 		*vpp = TNTOV(tp->tn_xattrdp);
880 		rw_exit(&tp->tn_rwlock);
881 		return (0);
882 	}
883 
884 	/*
885 	 * Null component name is a synonym for directory being searched.
886 	 */
887 	if (*nm == '\0') {
888 		VN_HOLD(dvp);
889 		*vpp = dvp;
890 		return (0);
891 	}
892 	ASSERT(tp);
893 
894 	error = tdirlookup(tp, nm, &ntp, cred);
895 
896 	if (error == 0) {
897 		ASSERT(ntp);
898 		*vpp = TNTOV(ntp);
899 		/*
900 		 * If vnode is a device return special vnode instead
901 		 */
902 		if (IS_DEVVP(*vpp)) {
903 			struct vnode *newvp;
904 
905 			newvp = specvp(*vpp, (*vpp)->v_rdev, (*vpp)->v_type,
906 			    cred);
907 			VN_RELE(*vpp);
908 			*vpp = newvp;
909 		}
910 	}
911 	TRACE_4(TR_FAC_TMPFS, TR_TMPFS_LOOKUP,
912 	    "tmpfs lookup:vp %p name %s vpp %p error %d",
913 	    dvp, nm, vpp, error);
914 	return (error);
915 }
916 
917 /*ARGSUSED7*/
918 static int
919 tmp_create(
920 	struct vnode *dvp,
921 	char *nm,
922 	struct vattr *vap,
923 	enum vcexcl exclusive,
924 	int mode,
925 	struct vnode **vpp,
926 	struct cred *cred,
927 	int flag,
928 	caller_context_t *ct,
929 	vsecattr_t *vsecp)
930 {
931 	struct tmpnode *parent;
932 	struct tmount *tm;
933 	struct tmpnode *self;
934 	int error;
935 	struct tmpnode *oldtp;
936 
937 again:
938 	parent = (struct tmpnode *)VTOTN(dvp);
939 	tm = (struct tmount *)VTOTM(dvp);
940 	self = NULL;
941 	error = 0;
942 	oldtp = NULL;
943 
944 	/* device files not allowed in ext. attr dirs */
945 	if ((parent->tn_flags & ISXATTR) &&
946 		(vap->va_type == VBLK || vap->va_type == VCHR ||
947 		vap->va_type == VFIFO || vap->va_type == VDOOR ||
948 		vap->va_type == VSOCK || vap->va_type == VPORT))
949 			return (EINVAL);
950 
951 	if (vap->va_type == VREG && (vap->va_mode & VSVTX)) {
952 		/* Must be privileged to set sticky bit */
953 		if (secpolicy_vnode_stky_modify(cred))
954 			vap->va_mode &= ~VSVTX;
955 	} else if (vap->va_type == VNON) {
956 		return (EINVAL);
957 	}
958 
959 	/*
960 	 * Null component name is a synonym for directory being searched.
961 	 */
962 	if (*nm == '\0') {
963 		VN_HOLD(dvp);
964 		oldtp = parent;
965 	} else {
966 		error = tdirlookup(parent, nm, &oldtp, cred);
967 	}
968 
969 	if (error == 0) {	/* name found */
970 		ASSERT(oldtp);
971 
972 		rw_enter(&oldtp->tn_rwlock, RW_WRITER);
973 
974 		/*
975 		 * if create/read-only an existing
976 		 * directory, allow it
977 		 */
978 		if (exclusive == EXCL)
979 			error = EEXIST;
980 		else if ((oldtp->tn_type == VDIR) && (mode & VWRITE))
981 			error = EISDIR;
982 		else {
983 			error = tmp_taccess(oldtp, mode, cred);
984 		}
985 
986 		if (error) {
987 			rw_exit(&oldtp->tn_rwlock);
988 			tmpnode_rele(oldtp);
989 			return (error);
990 		}
991 		*vpp = TNTOV(oldtp);
992 		if ((*vpp)->v_type == VREG && (vap->va_mask & AT_SIZE) &&
993 		    vap->va_size == 0) {
994 			rw_enter(&oldtp->tn_contents, RW_WRITER);
995 			(void) tmpnode_trunc(tm, oldtp, 0);
996 			rw_exit(&oldtp->tn_contents);
997 		}
998 		rw_exit(&oldtp->tn_rwlock);
999 		if (IS_DEVVP(*vpp)) {
1000 			struct vnode *newvp;
1001 
1002 			newvp = specvp(*vpp, (*vpp)->v_rdev, (*vpp)->v_type,
1003 			    cred);
1004 			VN_RELE(*vpp);
1005 			if (newvp == NULL) {
1006 				return (ENOSYS);
1007 			}
1008 			*vpp = newvp;
1009 		}
1010 
1011 		if (error == 0) {
1012 			vnevent_create(*vpp, ct);
1013 		}
1014 		return (0);
1015 	}
1016 
1017 	if (error != ENOENT)
1018 		return (error);
1019 
1020 	rw_enter(&parent->tn_rwlock, RW_WRITER);
1021 	error = tdirenter(tm, parent, nm, DE_CREATE,
1022 	    (struct tmpnode *)NULL, (struct tmpnode *)NULL,
1023 	    vap, &self, cred, ct);
1024 	rw_exit(&parent->tn_rwlock);
1025 
1026 	if (error) {
1027 		if (self)
1028 			tmpnode_rele(self);
1029 
1030 		if (error == EEXIST) {
1031 			/*
1032 			 * This means that the file was created sometime
1033 			 * after we checked and did not find it and when
1034 			 * we went to create it.
1035 			 * Since creat() is supposed to truncate a file
1036 			 * that already exits go back to the begining
1037 			 * of the function. This time we will find it
1038 			 * and go down the tmp_trunc() path
1039 			 */
1040 			goto again;
1041 		}
1042 		return (error);
1043 	}
1044 
1045 	*vpp = TNTOV(self);
1046 
1047 	if (!error && IS_DEVVP(*vpp)) {
1048 		struct vnode *newvp;
1049 
1050 		newvp = specvp(*vpp, (*vpp)->v_rdev, (*vpp)->v_type, cred);
1051 		VN_RELE(*vpp);
1052 		if (newvp == NULL)
1053 			return (ENOSYS);
1054 		*vpp = newvp;
1055 	}
1056 	TRACE_3(TR_FAC_TMPFS, TR_TMPFS_CREATE,
1057 		"tmpfs create:dvp %p nm %s vpp %p", dvp, nm, vpp);
1058 	return (0);
1059 }
1060 
1061 /* ARGSUSED3 */
1062 static int
1063 tmp_remove(
1064 	struct vnode *dvp,
1065 	char *nm,
1066 	struct cred *cred,
1067 	caller_context_t *ct,
1068 	int flags)
1069 {
1070 	struct tmpnode *parent = (struct tmpnode *)VTOTN(dvp);
1071 	int error;
1072 	struct tmpnode *tp = NULL;
1073 
1074 	error = tdirlookup(parent, nm, &tp, cred);
1075 	if (error)
1076 		return (error);
1077 
1078 	ASSERT(tp);
1079 	rw_enter(&parent->tn_rwlock, RW_WRITER);
1080 	rw_enter(&tp->tn_rwlock, RW_WRITER);
1081 
1082 	if (tp->tn_type != VDIR ||
1083 	    (error = secpolicy_fs_linkdir(cred, dvp->v_vfsp)) == 0)
1084 		error = tdirdelete(parent, tp, nm, DR_REMOVE, cred);
1085 
1086 	rw_exit(&tp->tn_rwlock);
1087 	rw_exit(&parent->tn_rwlock);
1088 	vnevent_remove(TNTOV(tp), dvp, nm, ct);
1089 	tmpnode_rele(tp);
1090 
1091 	TRACE_3(TR_FAC_TMPFS, TR_TMPFS_REMOVE,
1092 		"tmpfs remove:dvp %p nm %s error %d", dvp, nm, error);
1093 	return (error);
1094 }
1095 
1096 /* ARGSUSED4 */
1097 static int
1098 tmp_link(
1099 	struct vnode *dvp,
1100 	struct vnode *srcvp,
1101 	char *tnm,
1102 	struct cred *cred,
1103 	caller_context_t *ct,
1104 	int flags)
1105 {
1106 	struct tmpnode *parent;
1107 	struct tmpnode *from;
1108 	struct tmount *tm = (struct tmount *)VTOTM(dvp);
1109 	int error;
1110 	struct tmpnode *found = NULL;
1111 	struct vnode *realvp;
1112 
1113 	if (VOP_REALVP(srcvp, &realvp, ct) == 0)
1114 		srcvp = realvp;
1115 
1116 	parent = (struct tmpnode *)VTOTN(dvp);
1117 	from = (struct tmpnode *)VTOTN(srcvp);
1118 
1119 	if ((srcvp->v_type == VDIR &&
1120 	    secpolicy_fs_linkdir(cred, dvp->v_vfsp)) ||
1121 	    (from->tn_uid != crgetuid(cred) && secpolicy_basic_link(cred)))
1122 		return (EPERM);
1123 
1124 	/*
1125 	 * Make sure link for extended attributes is valid
1126 	 * We only support hard linking of xattr's in xattrdir to an xattrdir
1127 	 */
1128 	if ((from->tn_flags & ISXATTR) != (parent->tn_flags & ISXATTR))
1129 		return (EINVAL);
1130 
1131 	error = tdirlookup(parent, tnm, &found, cred);
1132 	if (error == 0) {
1133 		ASSERT(found);
1134 		tmpnode_rele(found);
1135 		return (EEXIST);
1136 	}
1137 
1138 	if (error != ENOENT)
1139 		return (error);
1140 
1141 	rw_enter(&parent->tn_rwlock, RW_WRITER);
1142 	error = tdirenter(tm, parent, tnm, DE_LINK, (struct tmpnode *)NULL,
1143 		from, NULL, (struct tmpnode **)NULL, cred, ct);
1144 	rw_exit(&parent->tn_rwlock);
1145 	if (error == 0) {
1146 		vnevent_link(srcvp, ct);
1147 	}
1148 	return (error);
1149 }
1150 
1151 /* ARGSUSED5 */
1152 static int
1153 tmp_rename(
1154 	struct vnode *odvp,	/* source parent vnode */
1155 	char *onm,		/* source name */
1156 	struct vnode *ndvp,	/* destination parent vnode */
1157 	char *nnm,		/* destination name */
1158 	struct cred *cred,
1159 	caller_context_t *ct,
1160 	int flags)
1161 {
1162 	struct tmpnode *fromparent;
1163 	struct tmpnode *toparent;
1164 	struct tmpnode *fromtp = NULL;	/* source tmpnode */
1165 	struct tmount *tm = (struct tmount *)VTOTM(odvp);
1166 	int error;
1167 	int samedir = 0;	/* set if odvp == ndvp */
1168 	struct vnode *realvp;
1169 
1170 	if (VOP_REALVP(ndvp, &realvp, ct) == 0)
1171 		ndvp = realvp;
1172 
1173 	fromparent = (struct tmpnode *)VTOTN(odvp);
1174 	toparent = (struct tmpnode *)VTOTN(ndvp);
1175 
1176 	if ((fromparent->tn_flags & ISXATTR) != (toparent->tn_flags & ISXATTR))
1177 		return (EINVAL);
1178 
1179 	mutex_enter(&tm->tm_renamelck);
1180 
1181 	/*
1182 	 * Look up tmpnode of file we're supposed to rename.
1183 	 */
1184 	error = tdirlookup(fromparent, onm, &fromtp, cred);
1185 	if (error) {
1186 		mutex_exit(&tm->tm_renamelck);
1187 		return (error);
1188 	}
1189 
1190 	/*
1191 	 * Make sure we can delete the old (source) entry.  This
1192 	 * requires write permission on the containing directory.  If
1193 	 * that directory is "sticky" it requires further checks.
1194 	 */
1195 	if (((error = tmp_taccess(fromparent, VWRITE, cred)) != 0) ||
1196 	    (error = tmp_sticky_remove_access(fromparent, fromtp, cred)) != 0)
1197 		goto done;
1198 
1199 	/*
1200 	 * Check for renaming to or from '.' or '..' or that
1201 	 * fromtp == fromparent
1202 	 */
1203 	if ((onm[0] == '.' &&
1204 	    (onm[1] == '\0' || (onm[1] == '.' && onm[2] == '\0'))) ||
1205 	    (nnm[0] == '.' &&
1206 	    (nnm[1] == '\0' || (nnm[1] == '.' && nnm[2] == '\0'))) ||
1207 	    (fromparent == fromtp)) {
1208 		error = EINVAL;
1209 		goto done;
1210 	}
1211 
1212 	samedir = (fromparent == toparent);
1213 	/*
1214 	 * Make sure we can search and rename into the new
1215 	 * (destination) directory.
1216 	 */
1217 	if (!samedir) {
1218 		error = tmp_taccess(toparent, VEXEC|VWRITE, cred);
1219 		if (error)
1220 			goto done;
1221 	}
1222 
1223 	/*
1224 	 * Link source to new target
1225 	 */
1226 	rw_enter(&toparent->tn_rwlock, RW_WRITER);
1227 	error = tdirenter(tm, toparent, nnm, DE_RENAME,
1228 	    fromparent, fromtp, (struct vattr *)NULL,
1229 	    (struct tmpnode **)NULL, cred, ct);
1230 	rw_exit(&toparent->tn_rwlock);
1231 
1232 	if (error) {
1233 		/*
1234 		 * ESAME isn't really an error; it indicates that the
1235 		 * operation should not be done because the source and target
1236 		 * are the same file, but that no error should be reported.
1237 		 */
1238 		if (error == ESAME)
1239 			error = 0;
1240 		goto done;
1241 	}
1242 	vnevent_rename_src(TNTOV(fromtp), odvp, onm, ct);
1243 
1244 	/*
1245 	 * Notify the target directory if not same as
1246 	 * source directory.
1247 	 */
1248 	if (ndvp != odvp) {
1249 		vnevent_rename_dest_dir(ndvp, ct);
1250 	}
1251 
1252 	/*
1253 	 * Unlink from source.
1254 	 */
1255 	rw_enter(&fromparent->tn_rwlock, RW_WRITER);
1256 	rw_enter(&fromtp->tn_rwlock, RW_WRITER);
1257 
1258 	error = tdirdelete(fromparent, fromtp, onm, DR_RENAME, cred);
1259 
1260 	/*
1261 	 * The following handles the case where our source tmpnode was
1262 	 * removed before we got to it.
1263 	 *
1264 	 * XXX We should also cleanup properly in the case where tdirdelete
1265 	 * fails for some other reason.  Currently this case shouldn't happen.
1266 	 * (see 1184991).
1267 	 */
1268 	if (error == ENOENT)
1269 		error = 0;
1270 
1271 	rw_exit(&fromtp->tn_rwlock);
1272 	rw_exit(&fromparent->tn_rwlock);
1273 done:
1274 	tmpnode_rele(fromtp);
1275 	mutex_exit(&tm->tm_renamelck);
1276 
1277 	TRACE_5(TR_FAC_TMPFS, TR_TMPFS_RENAME,
1278 		"tmpfs rename:ovp %p onm %s nvp %p nnm %s error %d",
1279 		odvp, onm, ndvp, nnm, error);
1280 	return (error);
1281 }
1282 
1283 /* ARGSUSED5 */
1284 static int
1285 tmp_mkdir(
1286 	struct vnode *dvp,
1287 	char *nm,
1288 	struct vattr *va,
1289 	struct vnode **vpp,
1290 	struct cred *cred,
1291 	caller_context_t *ct,
1292 	int flags,
1293 	vsecattr_t *vsecp)
1294 {
1295 	struct tmpnode *parent = (struct tmpnode *)VTOTN(dvp);
1296 	struct tmpnode *self = NULL;
1297 	struct tmount *tm = (struct tmount *)VTOTM(dvp);
1298 	int error;
1299 
1300 	/* no new dirs allowed in xattr dirs */
1301 	if (parent->tn_flags & ISXATTR)
1302 		return (EINVAL);
1303 
1304 	/*
1305 	 * Might be dangling directory.  Catch it here,
1306 	 * because a ENOENT return from tdirlookup() is
1307 	 * an "o.k. return".
1308 	 */
1309 	if (parent->tn_nlink == 0)
1310 		return (ENOENT);
1311 
1312 	error = tdirlookup(parent, nm, &self, cred);
1313 	if (error == 0) {
1314 		ASSERT(self);
1315 		tmpnode_rele(self);
1316 		return (EEXIST);
1317 	}
1318 	if (error != ENOENT)
1319 		return (error);
1320 
1321 	rw_enter(&parent->tn_rwlock, RW_WRITER);
1322 	error = tdirenter(tm, parent, nm, DE_MKDIR,
1323 		(struct tmpnode *)NULL, (struct tmpnode *)NULL, va,
1324 		&self, cred, ct);
1325 	if (error) {
1326 		rw_exit(&parent->tn_rwlock);
1327 		if (self)
1328 			tmpnode_rele(self);
1329 		return (error);
1330 	}
1331 	rw_exit(&parent->tn_rwlock);
1332 	*vpp = TNTOV(self);
1333 	return (0);
1334 }
1335 
1336 /* ARGSUSED4 */
1337 static int
1338 tmp_rmdir(
1339 	struct vnode *dvp,
1340 	char *nm,
1341 	struct vnode *cdir,
1342 	struct cred *cred,
1343 	caller_context_t *ct,
1344 	int flags)
1345 {
1346 	struct tmpnode *parent = (struct tmpnode *)VTOTN(dvp);
1347 	struct tmpnode *self = NULL;
1348 	struct vnode *vp;
1349 	int error = 0;
1350 
1351 	/*
1352 	 * Return error when removing . and ..
1353 	 */
1354 	if (strcmp(nm, ".") == 0)
1355 		return (EINVAL);
1356 	if (strcmp(nm, "..") == 0)
1357 		return (EEXIST); /* Should be ENOTEMPTY */
1358 	error = tdirlookup(parent, nm, &self, cred);
1359 	if (error)
1360 		return (error);
1361 
1362 	rw_enter(&parent->tn_rwlock, RW_WRITER);
1363 	rw_enter(&self->tn_rwlock, RW_WRITER);
1364 
1365 	vp = TNTOV(self);
1366 	if (vp == dvp || vp == cdir) {
1367 		error = EINVAL;
1368 		goto done1;
1369 	}
1370 	if (self->tn_type != VDIR) {
1371 		error = ENOTDIR;
1372 		goto done1;
1373 	}
1374 
1375 	mutex_enter(&self->tn_tlock);
1376 	if (self->tn_nlink > 2) {
1377 		mutex_exit(&self->tn_tlock);
1378 		error = EEXIST;
1379 		goto done1;
1380 	}
1381 	mutex_exit(&self->tn_tlock);
1382 
1383 	if (vn_vfswlock(vp)) {
1384 		error = EBUSY;
1385 		goto done1;
1386 	}
1387 	if (vn_mountedvfs(vp) != NULL) {
1388 		error = EBUSY;
1389 		goto done;
1390 	}
1391 
1392 	/*
1393 	 * Check for an empty directory
1394 	 * i.e. only includes entries for "." and ".."
1395 	 */
1396 	if (self->tn_dirents > 2) {
1397 		error = EEXIST;		/* SIGH should be ENOTEMPTY */
1398 		/*
1399 		 * Update atime because checking tn_dirents is logically
1400 		 * equivalent to reading the directory
1401 		 */
1402 		gethrestime(&self->tn_atime);
1403 		goto done;
1404 	}
1405 
1406 	error = tdirdelete(parent, self, nm, DR_RMDIR, cred);
1407 done:
1408 	vn_vfsunlock(vp);
1409 done1:
1410 	rw_exit(&self->tn_rwlock);
1411 	rw_exit(&parent->tn_rwlock);
1412 	vnevent_rmdir(TNTOV(self), dvp, nm, ct);
1413 	tmpnode_rele(self);
1414 
1415 	return (error);
1416 }
1417 
1418 /* ARGSUSED2 */
1419 static int
1420 tmp_readdir(
1421 	struct vnode *vp,
1422 	struct uio *uiop,
1423 	struct cred *cred,
1424 	int *eofp,
1425 	caller_context_t *ct,
1426 	int flags)
1427 {
1428 	struct tmpnode *tp = (struct tmpnode *)VTOTN(vp);
1429 	struct tdirent *tdp;
1430 	int error = 0;
1431 	size_t namelen;
1432 	struct dirent64 *dp;
1433 	ulong_t offset;
1434 	ulong_t total_bytes_wanted;
1435 	long outcount = 0;
1436 	long bufsize;
1437 	int reclen;
1438 	caddr_t outbuf;
1439 
1440 	if (uiop->uio_loffset >= MAXOFF_T) {
1441 		if (eofp)
1442 			*eofp = 1;
1443 		return (0);
1444 	}
1445 	/*
1446 	 * assuming system call has already called tmp_rwlock
1447 	 */
1448 	ASSERT(RW_READ_HELD(&tp->tn_rwlock));
1449 
1450 	if (uiop->uio_iovcnt != 1)
1451 		return (EINVAL);
1452 
1453 	if (vp->v_type != VDIR)
1454 		return (ENOTDIR);
1455 
1456 	/*
1457 	 * There's a window here where someone could have removed
1458 	 * all the entries in the directory after we put a hold on the
1459 	 * vnode but before we grabbed the rwlock.  Just return.
1460 	 */
1461 	if (tp->tn_dir == NULL) {
1462 		if (tp->tn_nlink) {
1463 			panic("empty directory 0x%p", (void *)tp);
1464 			/*NOTREACHED*/
1465 		}
1466 		return (0);
1467 	}
1468 
1469 	/*
1470 	 * Get space for multiple directory entries
1471 	 */
1472 	total_bytes_wanted = uiop->uio_iov->iov_len;
1473 	bufsize = total_bytes_wanted + sizeof (struct dirent64);
1474 	outbuf = kmem_alloc(bufsize, KM_SLEEP);
1475 
1476 	dp = (struct dirent64 *)outbuf;
1477 
1478 
1479 	offset = 0;
1480 	tdp = tp->tn_dir;
1481 	while (tdp) {
1482 		namelen = strlen(tdp->td_name);	/* no +1 needed */
1483 		offset = tdp->td_offset;
1484 		if (offset >= uiop->uio_offset) {
1485 			reclen = (int)DIRENT64_RECLEN(namelen);
1486 			if (outcount + reclen > total_bytes_wanted) {
1487 				if (!outcount)
1488 					/*
1489 					 * Buffer too small for any entries.
1490 					 */
1491 					error = EINVAL;
1492 				break;
1493 			}
1494 			ASSERT(tdp->td_tmpnode != NULL);
1495 
1496 			/* use strncpy(9f) to zero out uninitialized bytes */
1497 
1498 			(void) strncpy(dp->d_name, tdp->td_name,
1499 			    DIRENT64_NAMELEN(reclen));
1500 			dp->d_reclen = (ushort_t)reclen;
1501 			dp->d_ino = (ino64_t)tdp->td_tmpnode->tn_nodeid;
1502 			dp->d_off = (offset_t)tdp->td_offset + 1;
1503 			dp = (struct dirent64 *)
1504 			    ((uintptr_t)dp + dp->d_reclen);
1505 			outcount += reclen;
1506 			ASSERT(outcount <= bufsize);
1507 		}
1508 		tdp = tdp->td_next;
1509 	}
1510 
1511 	if (!error)
1512 		error = uiomove(outbuf, outcount, UIO_READ, uiop);
1513 
1514 	if (!error) {
1515 		/* If we reached the end of the list our offset */
1516 		/* should now be just past the end. */
1517 		if (!tdp) {
1518 			offset += 1;
1519 			if (eofp)
1520 				*eofp = 1;
1521 		} else if (eofp)
1522 			*eofp = 0;
1523 		uiop->uio_offset = offset;
1524 	}
1525 	gethrestime(&tp->tn_atime);
1526 	kmem_free(outbuf, bufsize);
1527 	return (error);
1528 }
1529 
1530 /* ARGSUSED5 */
1531 static int
1532 tmp_symlink(
1533 	struct vnode *dvp,
1534 	char *lnm,
1535 	struct vattr *tva,
1536 	char *tnm,
1537 	struct cred *cred,
1538 	caller_context_t *ct,
1539 	int flags)
1540 {
1541 	struct tmpnode *parent = (struct tmpnode *)VTOTN(dvp);
1542 	struct tmpnode *self = (struct tmpnode *)NULL;
1543 	struct tmount *tm = (struct tmount *)VTOTM(dvp);
1544 	char *cp = NULL;
1545 	int error;
1546 	size_t len;
1547 
1548 	/* no symlinks allowed to files in xattr dirs */
1549 	if (parent->tn_flags & ISXATTR)
1550 		return (EINVAL);
1551 
1552 	error = tdirlookup(parent, lnm, &self, cred);
1553 	if (error == 0) {
1554 		/*
1555 		 * The entry already exists
1556 		 */
1557 		tmpnode_rele(self);
1558 		return (EEXIST);	/* was 0 */
1559 	}
1560 
1561 	if (error != ENOENT) {
1562 		if (self != NULL)
1563 			tmpnode_rele(self);
1564 		return (error);
1565 	}
1566 
1567 	rw_enter(&parent->tn_rwlock, RW_WRITER);
1568 	error = tdirenter(tm, parent, lnm, DE_CREATE, (struct tmpnode *)NULL,
1569 	    (struct tmpnode *)NULL, tva, &self, cred, ct);
1570 	rw_exit(&parent->tn_rwlock);
1571 
1572 	if (error) {
1573 		if (self)
1574 			tmpnode_rele(self);
1575 		return (error);
1576 	}
1577 	len = strlen(tnm) + 1;
1578 	cp = tmp_memalloc(len, 0);
1579 	if (cp == NULL) {
1580 		tmpnode_rele(self);
1581 		return (ENOSPC);
1582 	}
1583 	(void) strcpy(cp, tnm);
1584 
1585 	self->tn_symlink = cp;
1586 	self->tn_size = len - 1;
1587 	tmpnode_rele(self);
1588 	return (error);
1589 }
1590 
1591 /* ARGSUSED2 */
1592 static int
1593 tmp_readlink(
1594 	struct vnode *vp,
1595 	struct uio *uiop,
1596 	struct cred *cred,
1597 	caller_context_t *ct)
1598 {
1599 	struct tmpnode *tp = (struct tmpnode *)VTOTN(vp);
1600 	int error = 0;
1601 
1602 	if (vp->v_type != VLNK)
1603 		return (EINVAL);
1604 
1605 	rw_enter(&tp->tn_rwlock, RW_READER);
1606 	rw_enter(&tp->tn_contents, RW_READER);
1607 	error = uiomove(tp->tn_symlink, tp->tn_size, UIO_READ, uiop);
1608 	gethrestime(&tp->tn_atime);
1609 	rw_exit(&tp->tn_contents);
1610 	rw_exit(&tp->tn_rwlock);
1611 	return (error);
1612 }
1613 
1614 /* ARGSUSED */
1615 static int
1616 tmp_fsync(
1617 	struct vnode *vp,
1618 	int syncflag,
1619 	struct cred *cred,
1620 	caller_context_t *ct)
1621 {
1622 	return (0);
1623 }
1624 
1625 /* ARGSUSED */
1626 static void
1627 tmp_inactive(struct vnode *vp, struct cred *cred, caller_context_t *ct)
1628 {
1629 	struct tmpnode *tp = (struct tmpnode *)VTOTN(vp);
1630 	struct tmount *tm = (struct tmount *)VFSTOTM(vp->v_vfsp);
1631 
1632 	rw_enter(&tp->tn_rwlock, RW_WRITER);
1633 top:
1634 	mutex_enter(&tp->tn_tlock);
1635 	mutex_enter(&vp->v_lock);
1636 	ASSERT(vp->v_count >= 1);
1637 
1638 	/*
1639 	 * If we don't have the last hold or the link count is non-zero,
1640 	 * there's little to do -- just drop our hold.
1641 	 */
1642 	if (vp->v_count > 1 || tp->tn_nlink != 0) {
1643 		vp->v_count--;
1644 		mutex_exit(&vp->v_lock);
1645 		mutex_exit(&tp->tn_tlock);
1646 		rw_exit(&tp->tn_rwlock);
1647 		return;
1648 	}
1649 
1650 	/*
1651 	 * We have the last hold *and* the link count is zero, so this
1652 	 * tmpnode is dead from the filesystem's viewpoint.  However,
1653 	 * if the tmpnode has any pages associated with it (i.e. if it's
1654 	 * a normal file with non-zero size), the tmpnode can still be
1655 	 * discovered by pageout or fsflush via the page vnode pointers.
1656 	 * In this case we must drop all our locks, truncate the tmpnode,
1657 	 * and try the whole dance again.
1658 	 */
1659 	if (tp->tn_size != 0) {
1660 		if (tp->tn_type == VREG) {
1661 			mutex_exit(&vp->v_lock);
1662 			mutex_exit(&tp->tn_tlock);
1663 			rw_enter(&tp->tn_contents, RW_WRITER);
1664 			(void) tmpnode_trunc(tm, tp, 0);
1665 			rw_exit(&tp->tn_contents);
1666 			ASSERT(tp->tn_size == 0);
1667 			ASSERT(tp->tn_nblocks == 0);
1668 			goto top;
1669 		}
1670 		if (tp->tn_type == VLNK)
1671 			tmp_memfree(tp->tn_symlink, tp->tn_size + 1);
1672 	}
1673 
1674 	/*
1675 	 * Remove normal file/dir's xattr dir and xattrs.
1676 	 */
1677 	if (tp->tn_xattrdp) {
1678 		struct tmpnode *xtp = tp->tn_xattrdp;
1679 
1680 		ASSERT(xtp->tn_flags & ISXATTR);
1681 		tmpnode_hold(xtp);
1682 		rw_enter(&xtp->tn_rwlock, RW_WRITER);
1683 		tdirtrunc(xtp);
1684 		DECR_COUNT(&xtp->tn_nlink, &xtp->tn_tlock);
1685 		tp->tn_xattrdp = NULL;
1686 		rw_exit(&xtp->tn_rwlock);
1687 		tmpnode_rele(xtp);
1688 	}
1689 
1690 	mutex_exit(&vp->v_lock);
1691 	mutex_exit(&tp->tn_tlock);
1692 	/* Here's our chance to send invalid event while we're between locks */
1693 	vn_invalid(TNTOV(tp));
1694 	mutex_enter(&tm->tm_contents);
1695 	if (tp->tn_forw == NULL)
1696 		tm->tm_rootnode->tn_back = tp->tn_back;
1697 	else
1698 		tp->tn_forw->tn_back = tp->tn_back;
1699 	tp->tn_back->tn_forw = tp->tn_forw;
1700 	mutex_exit(&tm->tm_contents);
1701 	rw_exit(&tp->tn_rwlock);
1702 	rw_destroy(&tp->tn_rwlock);
1703 	mutex_destroy(&tp->tn_tlock);
1704 	vn_free(TNTOV(tp));
1705 	tmp_memfree(tp, sizeof (struct tmpnode));
1706 }
1707 
1708 /* ARGSUSED2 */
1709 static int
1710 tmp_fid(struct vnode *vp, struct fid *fidp, caller_context_t *ct)
1711 {
1712 	struct tmpnode *tp = (struct tmpnode *)VTOTN(vp);
1713 	struct tfid *tfid;
1714 
1715 	if (fidp->fid_len < (sizeof (struct tfid) - sizeof (ushort_t))) {
1716 		fidp->fid_len = sizeof (struct tfid) - sizeof (ushort_t);
1717 		return (ENOSPC);
1718 	}
1719 
1720 	tfid = (struct tfid *)fidp;
1721 	bzero(tfid, sizeof (struct tfid));
1722 	tfid->tfid_len = (int)sizeof (struct tfid) - sizeof (ushort_t);
1723 
1724 	tfid->tfid_ino = tp->tn_nodeid;
1725 	tfid->tfid_gen = tp->tn_gen;
1726 
1727 	return (0);
1728 }
1729 
1730 
1731 /*
1732  * Return all the pages from [off..off+len] in given file
1733  */
1734 /* ARGSUSED */
1735 static int
1736 tmp_getpage(
1737 	struct vnode *vp,
1738 	offset_t off,
1739 	size_t len,
1740 	uint_t *protp,
1741 	page_t *pl[],
1742 	size_t plsz,
1743 	struct seg *seg,
1744 	caddr_t addr,
1745 	enum seg_rw rw,
1746 	struct cred *cr,
1747 	caller_context_t *ct)
1748 {
1749 	int err = 0;
1750 	struct tmpnode *tp = VTOTN(vp);
1751 	anoff_t toff = (anoff_t)off;
1752 	size_t tlen = len;
1753 	u_offset_t tmpoff;
1754 	timestruc_t now;
1755 
1756 	rw_enter(&tp->tn_contents, RW_READER);
1757 
1758 	if (off + len  > tp->tn_size + PAGEOFFSET) {
1759 		err = EFAULT;
1760 		goto out;
1761 	}
1762 	/*
1763 	 * Look for holes (no anon slot) in faulting range. If there are
1764 	 * holes we have to switch to a write lock and fill them in. Swap
1765 	 * space for holes was already reserved when the file was grown.
1766 	 */
1767 	tmpoff = toff;
1768 	if (non_anon(tp->tn_anon, btop(off), &tmpoff, &tlen)) {
1769 		if (!rw_tryupgrade(&tp->tn_contents)) {
1770 			rw_exit(&tp->tn_contents);
1771 			rw_enter(&tp->tn_contents, RW_WRITER);
1772 			/* Size may have changed when lock was dropped */
1773 			if (off + len  > tp->tn_size + PAGEOFFSET) {
1774 				err = EFAULT;
1775 				goto out;
1776 			}
1777 		}
1778 		for (toff = (anoff_t)off; toff < (anoff_t)off + len;
1779 		    toff += PAGESIZE) {
1780 			if (anon_get_ptr(tp->tn_anon, btop(toff)) == NULL) {
1781 				/* XXX - may allocate mem w. write lock held */
1782 				(void) anon_set_ptr(tp->tn_anon, btop(toff),
1783 						anon_alloc(vp, toff),
1784 						ANON_SLEEP);
1785 				tp->tn_nblocks++;
1786 			}
1787 		}
1788 		rw_downgrade(&tp->tn_contents);
1789 	}
1790 
1791 
1792 	if (len <= PAGESIZE)
1793 		err = tmp_getapage(vp, (u_offset_t)off, len, protp, pl, plsz,
1794 		    seg, addr, rw, cr);
1795 	else
1796 		err = pvn_getpages(tmp_getapage, vp, (u_offset_t)off, len,
1797 		    protp, pl, plsz, seg, addr, rw, cr);
1798 
1799 	gethrestime(&now);
1800 	tp->tn_atime = now;
1801 	if (rw == S_WRITE)
1802 		tp->tn_mtime = now;
1803 
1804 out:
1805 	rw_exit(&tp->tn_contents);
1806 	return (err);
1807 }
1808 
1809 /*
1810  * Called from pvn_getpages or swap_getpage to get a particular page.
1811  */
1812 /*ARGSUSED*/
1813 static int
1814 tmp_getapage(
1815 	struct vnode *vp,
1816 	u_offset_t off,
1817 	size_t len,
1818 	uint_t *protp,
1819 	page_t *pl[],
1820 	size_t plsz,
1821 	struct seg *seg,
1822 	caddr_t addr,
1823 	enum seg_rw rw,
1824 	struct cred *cr)
1825 {
1826 	struct page *pp;
1827 	int flags;
1828 	int err = 0;
1829 	struct vnode *pvp;
1830 	u_offset_t poff;
1831 
1832 	if (protp != NULL)
1833 		*protp = PROT_ALL;
1834 again:
1835 	if (pp = page_lookup(vp, off, rw == S_CREATE ? SE_EXCL : SE_SHARED)) {
1836 		if (pl) {
1837 			pl[0] = pp;
1838 			pl[1] = NULL;
1839 		} else {
1840 			page_unlock(pp);
1841 		}
1842 	} else {
1843 		pp = page_create_va(vp, off, PAGESIZE,
1844 		    PG_WAIT | PG_EXCL, seg, addr);
1845 		/*
1846 		 * Someone raced in and created the page after we did the
1847 		 * lookup but before we did the create, so go back and
1848 		 * try to look it up again.
1849 		 */
1850 		if (pp == NULL)
1851 			goto again;
1852 		/*
1853 		 * Fill page from backing store, if any. If none, then
1854 		 * either this is a newly filled hole or page must have
1855 		 * been unmodified and freed so just zero it out.
1856 		 */
1857 		err = swap_getphysname(vp, off, &pvp, &poff);
1858 		if (err) {
1859 			panic("tmp_getapage: no anon slot vp %p "
1860 			    "off %llx pp %p\n", (void *)vp, off, (void *)pp);
1861 		}
1862 		if (pvp) {
1863 			flags = (pl == NULL ? B_ASYNC|B_READ : B_READ);
1864 			err = VOP_PAGEIO(pvp, pp, (u_offset_t)poff, PAGESIZE,
1865 			    flags, cr, NULL);
1866 			if (flags & B_ASYNC)
1867 				pp = NULL;
1868 		} else if (rw != S_CREATE) {
1869 			pagezero(pp, 0, PAGESIZE);
1870 		}
1871 		if (err && pp)
1872 			pvn_read_done(pp, B_ERROR);
1873 		if (err == 0) {
1874 			if (pl)
1875 				pvn_plist_init(pp, pl, plsz, off, PAGESIZE, rw);
1876 			else
1877 				pvn_io_done(pp);
1878 		}
1879 	}
1880 	return (err);
1881 }
1882 
1883 
1884 /*
1885  * Flags are composed of {B_INVAL, B_DIRTY B_FREE, B_DONTNEED}.
1886  * If len == 0, do from off to EOF.
1887  */
1888 static int tmp_nopage = 0;	/* Don't do tmp_putpage's if set */
1889 
1890 /* ARGSUSED */
1891 int
1892 tmp_putpage(
1893 	register struct vnode *vp,
1894 	offset_t off,
1895 	size_t len,
1896 	int flags,
1897 	struct cred *cr,
1898 	caller_context_t *ct)
1899 {
1900 	register page_t *pp;
1901 	u_offset_t io_off;
1902 	size_t io_len = 0;
1903 	int err = 0;
1904 	struct tmpnode *tp = VTOTN(vp);
1905 	int dolock;
1906 
1907 	if (tmp_nopage)
1908 		return (0);
1909 
1910 	ASSERT(vp->v_count != 0);
1911 
1912 	if (vp->v_flag & VNOMAP)
1913 		return (ENOSYS);
1914 
1915 	/*
1916 	 * This being tmpfs, we don't ever do i/o unless we really
1917 	 * have to (when we're low on memory and pageout calls us
1918 	 * with B_ASYNC | B_FREE or the user explicitly asks for it with
1919 	 * B_DONTNEED).
1920 	 * XXX to approximately track the mod time like ufs we should
1921 	 * update the times here. The problem is, once someone does a
1922 	 * store we never clear the mod bit and do i/o, thus fsflush
1923 	 * will keep calling us every 30 seconds to do the i/o and we'll
1924 	 * continually update the mod time. At least we update the mod
1925 	 * time on the first store because this results in a call to getpage.
1926 	 */
1927 	if (flags != (B_ASYNC | B_FREE) && (flags & B_INVAL) == 0 &&
1928 		(flags & B_DONTNEED) == 0)
1929 		return (0);
1930 	/*
1931 	 * If this thread owns the lock, i.e., this thread grabbed it
1932 	 * as writer somewhere above, then we don't need to grab the
1933 	 * lock as reader in this routine.
1934 	 */
1935 	dolock = (rw_owner(&tp->tn_contents) != curthread);
1936 
1937 	/*
1938 	 * If this is pageout don't block on the lock as you could deadlock
1939 	 * when freemem == 0 (another thread has the read lock and is blocked
1940 	 * creating a page, and a third thread is waiting to get the writers
1941 	 * lock - waiting writers priority blocks us from getting the read
1942 	 * lock). Of course, if the only freeable pages are on this tmpnode
1943 	 * we're hosed anyways. A better solution might be a new lock type.
1944 	 * Note: ufs has the same problem.
1945 	 */
1946 	if (curproc == proc_pageout) {
1947 		if (!rw_tryenter(&tp->tn_contents, RW_READER))
1948 			return (ENOMEM);
1949 	} else if (dolock)
1950 		rw_enter(&tp->tn_contents, RW_READER);
1951 
1952 	if (!vn_has_cached_data(vp))
1953 		goto out;
1954 
1955 	if (len == 0) {
1956 		if (curproc == proc_pageout) {
1957 			panic("tmp: pageout can't block");
1958 			/*NOTREACHED*/
1959 		}
1960 
1961 		/* Search the entire vp list for pages >= off. */
1962 		err = pvn_vplist_dirty(vp, (u_offset_t)off, tmp_putapage,
1963 		    flags, cr);
1964 	} else {
1965 		u_offset_t eoff;
1966 
1967 		/*
1968 		 * Loop over all offsets in the range [off...off + len]
1969 		 * looking for pages to deal with.
1970 		 */
1971 		eoff = MIN(off + len, tp->tn_size);
1972 		for (io_off = off; io_off < eoff; io_off += io_len) {
1973 			/*
1974 			 * If we are not invalidating, synchronously
1975 			 * freeing or writing pages use the routine
1976 			 * page_lookup_nowait() to prevent reclaiming
1977 			 * them from the free list.
1978 			 */
1979 			if ((flags & B_INVAL) || ((flags & B_ASYNC) == 0)) {
1980 				pp = page_lookup(vp, io_off,
1981 				    (flags & (B_INVAL | B_FREE)) ?
1982 				    SE_EXCL : SE_SHARED);
1983 			} else {
1984 				pp = page_lookup_nowait(vp, io_off,
1985 				    (flags & B_FREE) ? SE_EXCL : SE_SHARED);
1986 			}
1987 
1988 			if (pp == NULL || pvn_getdirty(pp, flags) == 0)
1989 				io_len = PAGESIZE;
1990 			else {
1991 				err = tmp_putapage(vp, pp, &io_off, &io_len,
1992 				    flags, cr);
1993 				if (err != 0)
1994 					break;
1995 			}
1996 		}
1997 	}
1998 	/* If invalidating, verify all pages on vnode list are gone. */
1999 	if (err == 0 && off == 0 && len == 0 &&
2000 	    (flags & B_INVAL) && vn_has_cached_data(vp)) {
2001 		panic("tmp_putpage: B_INVAL, pages not gone");
2002 		/*NOTREACHED*/
2003 	}
2004 out:
2005 	if ((curproc == proc_pageout) || dolock)
2006 		rw_exit(&tp->tn_contents);
2007 	/*
2008 	 * Only reason putapage is going to give us SE_NOSWAP as error
2009 	 * is when we ask a page to be written to physical backing store
2010 	 * and there is none. Ignore this because we might be dealing
2011 	 * with a swap page which does not have any backing store
2012 	 * on disk. In any other case we won't get this error over here.
2013 	 */
2014 	if (err == SE_NOSWAP)
2015 		err = 0;
2016 	return (err);
2017 }
2018 
2019 long tmp_putpagecnt, tmp_pagespushed;
2020 
2021 /*
2022  * Write out a single page.
2023  * For tmpfs this means choose a physical swap slot and write the page
2024  * out using VOP_PAGEIO. For performance, we attempt to kluster; i.e.,
2025  * we try to find a bunch of other dirty pages adjacent in the file
2026  * and a bunch of contiguous swap slots, and then write all the pages
2027  * out in a single i/o.
2028  */
2029 /*ARGSUSED*/
2030 static int
2031 tmp_putapage(
2032 	struct vnode *vp,
2033 	page_t *pp,
2034 	u_offset_t *offp,
2035 	size_t *lenp,
2036 	int flags,
2037 	struct cred *cr)
2038 {
2039 	int err;
2040 	ulong_t klstart, kllen;
2041 	page_t *pplist, *npplist;
2042 	extern int klustsize;
2043 	long tmp_klustsize;
2044 	struct tmpnode *tp;
2045 	size_t pp_off, pp_len;
2046 	u_offset_t io_off;
2047 	size_t io_len;
2048 	struct vnode *pvp;
2049 	u_offset_t pstart;
2050 	u_offset_t offset;
2051 	u_offset_t tmpoff;
2052 
2053 	ASSERT(PAGE_LOCKED(pp));
2054 
2055 	/* Kluster in tmp_klustsize chunks */
2056 	tp = VTOTN(vp);
2057 	tmp_klustsize = klustsize;
2058 	offset = pp->p_offset;
2059 	klstart = (offset / tmp_klustsize) * tmp_klustsize;
2060 	kllen = MIN(tmp_klustsize, tp->tn_size - klstart);
2061 
2062 	/* Get a kluster of pages */
2063 	pplist =
2064 	    pvn_write_kluster(vp, pp, &tmpoff, &pp_len, klstart, kllen, flags);
2065 
2066 	pp_off = (size_t)tmpoff;
2067 
2068 	/*
2069 	 * Get a cluster of physical offsets for the pages; the amount we
2070 	 * get may be some subrange of what we ask for (io_off, io_len).
2071 	 */
2072 	io_off = pp_off;
2073 	io_len = pp_len;
2074 	err = swap_newphysname(vp, offset, &io_off, &io_len, &pvp, &pstart);
2075 	ASSERT(err != SE_NOANON); /* anon slot must have been filled */
2076 	if (err) {
2077 		pvn_write_done(pplist, B_ERROR | B_WRITE | flags);
2078 		/*
2079 		 * If this routine is called as a result of segvn_sync
2080 		 * operation and we have no physical swap then we can get an
2081 		 * error here. In such case we would return SE_NOSWAP as error.
2082 		 * At this point, we expect only SE_NOSWAP.
2083 		 */
2084 		ASSERT(err == SE_NOSWAP);
2085 		if (flags & B_INVAL)
2086 			err = ENOMEM;
2087 		goto out;
2088 	}
2089 	ASSERT(pp_off <= io_off && io_off + io_len <= pp_off + pp_len);
2090 	ASSERT(io_off <= offset && offset < io_off + io_len);
2091 
2092 	/* Toss pages at front/rear that we couldn't get physical backing for */
2093 	if (io_off != pp_off) {
2094 		npplist = NULL;
2095 		page_list_break(&pplist, &npplist, btop(io_off - pp_off));
2096 		ASSERT(pplist->p_offset == pp_off);
2097 		ASSERT(pplist->p_prev->p_offset == io_off - PAGESIZE);
2098 		pvn_write_done(pplist, B_ERROR | B_WRITE | flags);
2099 		pplist = npplist;
2100 	}
2101 	if (io_off + io_len < pp_off + pp_len) {
2102 		npplist = NULL;
2103 		page_list_break(&pplist, &npplist, btop(io_len));
2104 		ASSERT(npplist->p_offset == io_off + io_len);
2105 		ASSERT(npplist->p_prev->p_offset == pp_off + pp_len - PAGESIZE);
2106 		pvn_write_done(npplist, B_ERROR | B_WRITE | flags);
2107 	}
2108 
2109 	ASSERT(pplist->p_offset == io_off);
2110 	ASSERT(pplist->p_prev->p_offset == io_off + io_len - PAGESIZE);
2111 	ASSERT(btopr(io_len) <= btopr(kllen));
2112 
2113 	/* Do i/o on the remaining kluster */
2114 	err = VOP_PAGEIO(pvp, pplist, (u_offset_t)pstart, io_len,
2115 	    B_WRITE | flags, cr, NULL);
2116 
2117 	if ((flags & B_ASYNC) == 0) {
2118 		pvn_write_done(pplist, ((err) ? B_ERROR : 0) | B_WRITE | flags);
2119 	}
2120 out:
2121 	if (!err) {
2122 		if (offp)
2123 			*offp = io_off;
2124 		if (lenp)
2125 			*lenp = io_len;
2126 		tmp_putpagecnt++;
2127 		tmp_pagespushed += btop(io_len);
2128 	}
2129 	if (err && err != ENOMEM && err != SE_NOSWAP)
2130 		cmn_err(CE_WARN, "tmp_putapage: err %d\n", err);
2131 	return (err);
2132 }
2133 
2134 /* ARGSUSED */
2135 static int
2136 tmp_map(
2137 	struct vnode *vp,
2138 	offset_t off,
2139 	struct as *as,
2140 	caddr_t *addrp,
2141 	size_t len,
2142 	uchar_t prot,
2143 	uchar_t maxprot,
2144 	uint_t flags,
2145 	struct cred *cred,
2146 	caller_context_t *ct)
2147 {
2148 	struct segvn_crargs vn_a;
2149 	struct tmpnode *tp = (struct tmpnode *)VTOTN(vp);
2150 	int error;
2151 
2152 #ifdef _ILP32
2153 	if (len > MAXOFF_T)
2154 		return (ENOMEM);
2155 #endif
2156 
2157 	if (vp->v_flag & VNOMAP)
2158 		return (ENOSYS);
2159 
2160 	if (off < 0 || (offset_t)(off + len) < 0 ||
2161 	    off > MAXOFF_T || (off + len) > MAXOFF_T)
2162 		return (ENXIO);
2163 
2164 	if (vp->v_type != VREG)
2165 		return (ENODEV);
2166 
2167 	/*
2168 	 * Don't allow mapping to locked file
2169 	 */
2170 	if (vn_has_mandatory_locks(vp, tp->tn_mode)) {
2171 		return (EAGAIN);
2172 	}
2173 
2174 	as_rangelock(as);
2175 	if ((flags & MAP_FIXED) == 0) {
2176 		map_addr(addrp, len, (offset_t)off, 1, flags);
2177 		if (*addrp == NULL) {
2178 			as_rangeunlock(as);
2179 			return (ENOMEM);
2180 		}
2181 	} else {
2182 		/*
2183 		 * User specified address - blow away any previous mappings
2184 		 */
2185 		(void) as_unmap(as, *addrp, len);
2186 	}
2187 
2188 	vn_a.vp = vp;
2189 	vn_a.offset = (u_offset_t)off;
2190 	vn_a.type = flags & MAP_TYPE;
2191 	vn_a.prot = prot;
2192 	vn_a.maxprot = maxprot;
2193 	vn_a.flags = flags & ~MAP_TYPE;
2194 	vn_a.cred = cred;
2195 	vn_a.amp = NULL;
2196 	vn_a.szc = 0;
2197 	vn_a.lgrp_mem_policy_flags = 0;
2198 
2199 	error = as_map(as, *addrp, len, segvn_create, &vn_a);
2200 	as_rangeunlock(as);
2201 	return (error);
2202 }
2203 
2204 /*
2205  * tmp_addmap and tmp_delmap can't be called since the vp
2206  * maintained in the segvn mapping is NULL.
2207  */
2208 /* ARGSUSED */
2209 static int
2210 tmp_addmap(
2211 	struct vnode *vp,
2212 	offset_t off,
2213 	struct as *as,
2214 	caddr_t addr,
2215 	size_t len,
2216 	uchar_t prot,
2217 	uchar_t maxprot,
2218 	uint_t flags,
2219 	struct cred *cred,
2220 	caller_context_t *ct)
2221 {
2222 	return (0);
2223 }
2224 
2225 /* ARGSUSED */
2226 static int
2227 tmp_delmap(
2228 	struct vnode *vp,
2229 	offset_t off,
2230 	struct as *as,
2231 	caddr_t addr,
2232 	size_t len,
2233 	uint_t prot,
2234 	uint_t maxprot,
2235 	uint_t flags,
2236 	struct cred *cred,
2237 	caller_context_t *ct)
2238 {
2239 	return (0);
2240 }
2241 
2242 static int
2243 tmp_freesp(struct vnode *vp, struct flock64 *lp, int flag)
2244 {
2245 	register int i;
2246 	register struct tmpnode *tp = VTOTN(vp);
2247 	int error;
2248 
2249 	ASSERT(vp->v_type == VREG);
2250 	ASSERT(lp->l_start >= 0);
2251 
2252 	if (lp->l_len != 0)
2253 		return (EINVAL);
2254 
2255 	rw_enter(&tp->tn_rwlock, RW_WRITER);
2256 	if (tp->tn_size == lp->l_start) {
2257 		rw_exit(&tp->tn_rwlock);
2258 		return (0);
2259 	}
2260 
2261 	/*
2262 	 * Check for any mandatory locks on the range
2263 	 */
2264 	if (MANDLOCK(vp, tp->tn_mode)) {
2265 		long save_start;
2266 
2267 		save_start = lp->l_start;
2268 
2269 		if (tp->tn_size < lp->l_start) {
2270 			/*
2271 			 * "Truncate up" case: need to make sure there
2272 			 * is no lock beyond current end-of-file. To
2273 			 * do so, we need to set l_start to the size
2274 			 * of the file temporarily.
2275 			 */
2276 			lp->l_start = tp->tn_size;
2277 		}
2278 		lp->l_type = F_WRLCK;
2279 		lp->l_sysid = 0;
2280 		lp->l_pid = ttoproc(curthread)->p_pid;
2281 		i = (flag & (FNDELAY|FNONBLOCK)) ? 0 : SLPFLCK;
2282 		if ((i = reclock(vp, lp, i, 0, lp->l_start, NULL)) != 0 ||
2283 		    lp->l_type != F_UNLCK) {
2284 			rw_exit(&tp->tn_rwlock);
2285 			return (i ? i : EAGAIN);
2286 		}
2287 
2288 		lp->l_start = save_start;
2289 	}
2290 	VFSTOTM(vp->v_vfsp);
2291 
2292 	rw_enter(&tp->tn_contents, RW_WRITER);
2293 	error = tmpnode_trunc((struct tmount *)VFSTOTM(vp->v_vfsp),
2294 	    tp, (ulong_t)lp->l_start);
2295 	rw_exit(&tp->tn_contents);
2296 	rw_exit(&tp->tn_rwlock);
2297 	return (error);
2298 }
2299 
2300 /* ARGSUSED */
2301 static int
2302 tmp_space(
2303 	struct vnode *vp,
2304 	int cmd,
2305 	struct flock64 *bfp,
2306 	int flag,
2307 	offset_t offset,
2308 	cred_t *cred,
2309 	caller_context_t *ct)
2310 {
2311 	int error;
2312 
2313 	if (cmd != F_FREESP)
2314 		return (EINVAL);
2315 	if ((error = convoff(vp, bfp, 0, (offset_t)offset)) == 0) {
2316 		if ((bfp->l_start > MAXOFF_T) || (bfp->l_len > MAXOFF_T))
2317 			return (EFBIG);
2318 		error = tmp_freesp(vp, bfp, flag);
2319 	}
2320 	return (error);
2321 }
2322 
2323 /* ARGSUSED */
2324 static int
2325 tmp_seek(
2326 	struct vnode *vp,
2327 	offset_t ooff,
2328 	offset_t *noffp,
2329 	caller_context_t *ct)
2330 {
2331 	return ((*noffp < 0 || *noffp > MAXOFFSET_T) ? EINVAL : 0);
2332 }
2333 
2334 /* ARGSUSED2 */
2335 static int
2336 tmp_rwlock(struct vnode *vp, int write_lock, caller_context_t *ctp)
2337 {
2338 	struct tmpnode *tp = VTOTN(vp);
2339 
2340 	if (write_lock) {
2341 		rw_enter(&tp->tn_rwlock, RW_WRITER);
2342 	} else {
2343 		rw_enter(&tp->tn_rwlock, RW_READER);
2344 	}
2345 	return (write_lock);
2346 }
2347 
2348 /* ARGSUSED1 */
2349 static void
2350 tmp_rwunlock(struct vnode *vp, int write_lock, caller_context_t *ctp)
2351 {
2352 	struct tmpnode *tp = VTOTN(vp);
2353 
2354 	rw_exit(&tp->tn_rwlock);
2355 }
2356 
2357 static int
2358 tmp_pathconf(
2359 	struct vnode *vp,
2360 	int cmd,
2361 	ulong_t *valp,
2362 	cred_t *cr,
2363 	caller_context_t *ct)
2364 {
2365 	struct tmpnode *tp = NULL;
2366 	int error;
2367 
2368 	switch (cmd) {
2369 	case _PC_XATTR_EXISTS:
2370 		if (vp->v_vfsp->vfs_flag & VFS_XATTR) {
2371 			*valp = 0;	/* assume no attributes */
2372 			error = 0;	/* okay to ask */
2373 			tp = VTOTN(vp);
2374 			rw_enter(&tp->tn_rwlock, RW_READER);
2375 			if (tp->tn_xattrdp) {
2376 				rw_enter(&tp->tn_xattrdp->tn_rwlock, RW_READER);
2377 				/* do not count "." and ".." */
2378 				if (tp->tn_xattrdp->tn_dirents > 2)
2379 					*valp = 1;
2380 				rw_exit(&tp->tn_xattrdp->tn_rwlock);
2381 			}
2382 			rw_exit(&tp->tn_rwlock);
2383 		} else {
2384 			error = EINVAL;
2385 		}
2386 		break;
2387 	case _PC_SATTR_ENABLED:
2388 	case _PC_SATTR_EXISTS:
2389 		*valp = vfs_has_feature(vp->v_vfsp, VFSFT_XVATTR) &&
2390 		    (vp->v_type == VREG || vp->v_type == VDIR);
2391 		error = 0;
2392 		break;
2393 	default:
2394 		error = fs_pathconf(vp, cmd, valp, cr, ct);
2395 	}
2396 	return (error);
2397 }
2398 
2399 
2400 struct vnodeops *tmp_vnodeops;
2401 
2402 const fs_operation_def_t tmp_vnodeops_template[] = {
2403 	VOPNAME_OPEN,		{ .vop_open = tmp_open },
2404 	VOPNAME_CLOSE,		{ .vop_close = tmp_close },
2405 	VOPNAME_READ,		{ .vop_read = tmp_read },
2406 	VOPNAME_WRITE,		{ .vop_write = tmp_write },
2407 	VOPNAME_IOCTL,		{ .vop_ioctl = tmp_ioctl },
2408 	VOPNAME_GETATTR,	{ .vop_getattr = tmp_getattr },
2409 	VOPNAME_SETATTR,	{ .vop_setattr = tmp_setattr },
2410 	VOPNAME_ACCESS,		{ .vop_access = tmp_access },
2411 	VOPNAME_LOOKUP,		{ .vop_lookup = tmp_lookup },
2412 	VOPNAME_CREATE,		{ .vop_create = tmp_create },
2413 	VOPNAME_REMOVE,		{ .vop_remove = tmp_remove },
2414 	VOPNAME_LINK,		{ .vop_link = tmp_link },
2415 	VOPNAME_RENAME,		{ .vop_rename = tmp_rename },
2416 	VOPNAME_MKDIR,		{ .vop_mkdir = tmp_mkdir },
2417 	VOPNAME_RMDIR,		{ .vop_rmdir = tmp_rmdir },
2418 	VOPNAME_READDIR,	{ .vop_readdir = tmp_readdir },
2419 	VOPNAME_SYMLINK,	{ .vop_symlink = tmp_symlink },
2420 	VOPNAME_READLINK,	{ .vop_readlink = tmp_readlink },
2421 	VOPNAME_FSYNC,		{ .vop_fsync = tmp_fsync },
2422 	VOPNAME_INACTIVE,	{ .vop_inactive = tmp_inactive },
2423 	VOPNAME_FID,		{ .vop_fid = tmp_fid },
2424 	VOPNAME_RWLOCK,		{ .vop_rwlock = tmp_rwlock },
2425 	VOPNAME_RWUNLOCK,	{ .vop_rwunlock = tmp_rwunlock },
2426 	VOPNAME_SEEK,		{ .vop_seek = tmp_seek },
2427 	VOPNAME_SPACE,		{ .vop_space = tmp_space },
2428 	VOPNAME_GETPAGE,	{ .vop_getpage = tmp_getpage },
2429 	VOPNAME_PUTPAGE,	{ .vop_putpage = tmp_putpage },
2430 	VOPNAME_MAP,		{ .vop_map = tmp_map },
2431 	VOPNAME_ADDMAP,		{ .vop_addmap = tmp_addmap },
2432 	VOPNAME_DELMAP,		{ .vop_delmap = tmp_delmap },
2433 	VOPNAME_PATHCONF,	{ .vop_pathconf = tmp_pathconf },
2434 	VOPNAME_VNEVENT,	{ .vop_vnevent = fs_vnevent_support },
2435 	NULL,			NULL
2436 };
2437