vfs: Initial revision of inotify

Add an implementation of inotify_init(), inotify_add_watch(),
inotify_rm_watch(), source-compatible with Linux.  This provides
functionality similar to kevent(2)'s EVFILT_VNODE, i.e., it lets
applications monitor filesystem files for accesses.  Compared to
inotify, however, EVFILT_VNODE has the limitation of requiring the
application to open the file to be monitored.  This means that activity
on a newly created file cannot be monitored reliably, and that a file
descriptor per file in the hierarchy is required.

inotify on the other hand allows a directory and its entries to be
monitored at once.  It introduces a new file descriptor type to which
"watches" can be attached; a watch is a pseudo-file descriptor
associated with a file or directory and a set of events to watch for.
When a watched vnode is accessed, a description of the event is queued
to the inotify descriptor, readable with read(2).  Events for files in a
watched directory include the file name.

A watched vnode has its usecount bumped, so name cache entries
originating from a watched directory are not evicted.  Name cache
entries are used to populate inotify events for files with a link in a
watched directory.  In particular, if a file is accessed with, say,
read(2), an IN_ACCESS event will be generated for any watched hard link
of the file.

The inotify_add_watch_at() variant is included so that this
functionality is available in capability mode; plain inotify_add_watch()
is disallowed in capability mode.

When a file in a nullfs mount is watched, the watch is attached to the
lower vnode, such that accesses via either layer generate inotify
events.

Many thanks to Gleb Popov for testing this patch and finding lots of
bugs.

PR:		258010, 215011
Reviewed by:	kib
Tested by:	arrowd
MFC after:	3 months
Sponsored by:	Klara, Inc.
Differential Revision:	https://reviews.freebsd.org/D50315

(cherry picked from commit f1f230439fa48581f40a57f095627f667a9713c3)

24 files changed, 1399 insertions, 14 deletions

diff --git a/share/man/man4/rights.4 b/share/man/man4/rights.4
index 6669f75e1674..3195cc579e2d 100644
--- a/share/man/man4/rights.4
+++ b/share/man/man4/rights.4
@@ -30,7 +30,7 @@
 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 .\" SUCH DAMAGE.
 .\"
-.Dd March 22, 2024
+.Dd May 22, 2025
 .Dt RIGHTS 4
 .Os
 .Sh NAME
@@ -315,6 +315,14 @@ Permit
 .It Dv CAP_GETSOCKOPT
 Permit
 .Xr getsockopt 2 .
+.It Dv CAP_INOTIFY_ADD
+Permit
+.Xr inotify_add_watch 2
+and
+.Xr inotify_add_watch_at 2 .
+.It Dv CAP_INOTIFY_RM
+Permit
+.Xr inotify_rm_watch 2 .
 .It Dv CAP_IOCTL
 Permit
 .Xr ioctl 2 .
diff --git a/sys/bsm/audit_kevents.h b/sys/bsm/audit_kevents.h
index 0f110d5f9ddd..9381396f247c 100644
--- a/sys/bsm/audit_kevents.h
+++ b/sys/bsm/audit_kevents.h
@@ -663,6 +663,7 @@
 #define	AUE_FSPACECTL		43269	/* FreeBSD-specific. */
 #define	AUE_TIMERFD		43270	/* FreeBSD/Linux. */
 #define	AUE_SETCRED		43271	/* FreeBSD-specific. */
+#define	AUE_INOTIFY		43272	/* FreeBSD/Linux. */
 
 /*
  * Darwin BSM uses a number of AUE_O_* definitions, which are aliased to the
diff --git a/sys/conf/files b/sys/conf/files
index 4f5ac7de8988..b5270cf286ce 100644
--- a/sys/conf/files
+++ b/sys/conf/files
@@ -3957,6 +3957,7 @@ kern/vfs_export.c		standard
 kern/vfs_extattr.c		standard
 kern/vfs_hash.c			standard
 kern/vfs_init.c			standard
+kern/vfs_inotify.c		standard
 kern/vfs_lookup.c		standard
 kern/vfs_mount.c		standard
 kern/vfs_mountroot.c		standard
diff --git a/sys/fs/nullfs/null_subr.c b/sys/fs/nullfs/null_subr.c
index b0e3d15b4789..d4617ffe9a6d 100644
--- a/sys/fs/nullfs/null_subr.c
+++ b/sys/fs/nullfs/null_subr.c
@@ -249,6 +249,10 @@ null_nodeget(struct mount *mp, struct vnode *lowervp, struct vnode **vpp)
 		vp->v_object = lowervp->v_object;
 		vn_irflag_set(vp, VIRF_PGREAD);
 	}
+	if ((vn_irflag_read(lowervp) & VIRF_INOTIFY) != 0)
+		vn_irflag_set(vp, VIRF_INOTIFY);
+	if ((vn_irflag_read(lowervp) & VIRF_INOTIFY_PARENT) != 0)
+		vn_irflag_set(vp, VIRF_INOTIFY_PARENT);
 	if (lowervp == MOUNTTONULLMOUNT(mp)->nullm_lowerrootvp)
 		vp->v_vflag |= VV_ROOT;
 
diff --git a/sys/fs/nullfs/null_vnops.c b/sys/fs/nullfs/null_vnops.c
index 2e34b77a5a7e..8190f424532b 100644
--- a/sys/fs/nullfs/null_vnops.c
+++ b/sys/fs/nullfs/null_vnops.c
@@ -194,6 +194,26 @@ SYSCTL_INT(_debug, OID_AUTO, nullfs_bug_bypass, CTLFLAG_RW,
 	&null_bug_bypass, 0, "");
 
 /*
+ * Synchronize inotify flags with the lower vnode:
+ * - If the upper vnode has the flag set and the lower does not, then the lower
+ *   vnode is unwatched and the upper vnode does not need to go through
+ *   VOP_INOTIFY.
+ * - If the lower vnode is watched, then the upper vnode should go through
+ *   VOP_INOTIFY, so copy the flag up.
+ */
+static void
+null_copy_inotify(struct vnode *vp, struct vnode *lvp, short flag)
+{
+	if ((vn_irflag_read(vp) & flag) != 0) {
+		if (__predict_false((vn_irflag_read(lvp) & flag) == 0))
+			vn_irflag_unset(vp, flag);
+	} else if ((vn_irflag_read(lvp) & flag) != 0) {
+		if (__predict_false((vn_irflag_read(vp) & flag) == 0))
+			vn_irflag_set(vp, flag);
+	}
+}
+
+/*
  * This is the 10-Apr-92 bypass routine.
  *    This version has been optimized for speed, throwing away some
  * safety checks.  It should still always work, but it's not as
@@ -309,7 +329,10 @@ null_bypass(struct vop_generic_args *ap)
 			lvp = *(vps_p[i]);
 
 			/*
-			 * Get rid of the transient hold on lvp.
+			 * Get rid of the transient hold on lvp.  Copy inotify
+			 * flags up in case something is watching the lower
+			 * layer.
+			 *
 			 * If lowervp was unlocked during VOP
 			 * operation, nullfs upper vnode could have
 			 * been reclaimed, which changes its v_vnlock
@@ -318,6 +341,10 @@ null_bypass(struct vop_generic_args *ap)
 			 * upper (reclaimed) vnode.
 			 */
 			if (lvp != NULLVP) {
+				null_copy_inotify(old_vps[i], lvp,
+				    VIRF_INOTIFY);
+				null_copy_inotify(old_vps[i], lvp,
+				    VIRF_INOTIFY_PARENT);
 				if (VOP_ISLOCKED(lvp) == LK_EXCLUSIVE &&
 				    old_vps[i]->v_vnlock != lvp->v_vnlock) {
 					VOP_UNLOCK(lvp);
diff --git a/sys/kern/kern_resource.c b/sys/kern/kern_resource.c
index 80f3588f2614..8694c793a721 100644
--- a/sys/kern/kern_resource.c
+++ b/sys/kern/kern_resource.c
@@ -1642,6 +1642,12 @@ uifree(struct uidinfo *uip)
 	if (uip->ui_pipecnt != 0)
 		printf("freeing uidinfo: uid = %d, pipecnt = %ld\n",
 		    uip->ui_uid, uip->ui_pipecnt);
+	if (uip->ui_inotifycnt != 0)
+		printf("freeing uidinfo: uid = %d, inotifycnt = %ld\n",
+		    uip->ui_uid, uip->ui_inotifycnt);
+	if (uip->ui_inotifywatchcnt != 0)
+		printf("freeing uidinfo: uid = %d, inotifywatchcnt = %ld\n",
+		    uip->ui_uid, uip->ui_inotifywatchcnt);
 	free(uip, M_UIDINFO);
 }
 
@@ -1747,6 +1753,21 @@ chgpipecnt(struct uidinfo *uip, int diff, rlim_t max)
 	return (chglimit(uip, &uip->ui_pipecnt, diff, max, "pipecnt"));
 }
 
+int
+chginotifycnt(struct uidinfo *uip, int diff, rlim_t max)
+{
+
+	return (chglimit(uip, &uip->ui_inotifycnt, diff, max, "inotifycnt"));
+}
+
+int
+chginotifywatchcnt(struct uidinfo *uip, int diff, rlim_t max)
+{
+
+	return (chglimit(uip, &uip->ui_inotifywatchcnt, diff, max,
+	    "inotifywatchcnt"));
+}
+
 static int
 sysctl_kern_proc_rlimit_usage(SYSCTL_HANDLER_ARGS)
 {
diff --git a/sys/kern/subr_capability.c b/sys/kern/subr_capability.c
index b4fedb402b43..945ba9a7152d 100644
--- a/sys/kern/subr_capability.c
+++ b/sys/kern/subr_capability.c
@@ -73,6 +73,10 @@ const cap_rights_t cap_getsockopt_rights =
     CAP_RIGHTS_INITIALIZER(CAP_GETSOCKOPT);
 const cap_rights_t cap_getsockname_rights =
     CAP_RIGHTS_INITIALIZER(CAP_GETSOCKNAME);
+const cap_rights_t cap_inotify_add_rights =
+    CAP_RIGHTS_INITIALIZER(CAP_INOTIFY_ADD);
+const cap_rights_t cap_inotify_rm_rights =
+    CAP_RIGHTS_INITIALIZER(CAP_INOTIFY_RM);
 const cap_rights_t cap_ioctl_rights = CAP_RIGHTS_INITIALIZER(CAP_IOCTL);
 const cap_rights_t cap_listen_rights = CAP_RIGHTS_INITIALIZER(CAP_LISTEN);
 const cap_rights_t cap_linkat_source_rights =
diff --git a/sys/kern/sys_generic.c b/sys/kern/sys_generic.c
index 6590b1ac9c59..4cb38b0a0b89 100644
--- a/sys/kern/sys_generic.c
+++ b/sys/kern/sys_generic.c
@@ -48,6 +48,7 @@
 #include <sys/filio.h>
 #include <sys/fcntl.h>
 #include <sys/file.h>
+#include <sys/inotify.h>
 #include <sys/lock.h>
 #include <sys/proc.h>
 #include <sys/signalvar.h>
@@ -945,7 +946,6 @@ int
 kern_specialfd(struct thread *td, int type, void *arg)
 {
 	struct file *fp;
-	struct specialfd_eventfd *ae;
 	int error, fd, fflags;
 
 	fflags = 0;
@@ -954,12 +954,22 @@ kern_specialfd(struct thread *td, int type, void *arg)
 		return (error);
 
 	switch (type) {
-	case SPECIALFD_EVENTFD:
+	case SPECIALFD_EVENTFD: {
+		struct specialfd_eventfd *ae;
+
 		ae = arg;
 		if ((ae->flags & EFD_CLOEXEC) != 0)
 			fflags |= O_CLOEXEC;
 		error = eventfd_create_file(td, fp, ae->initval, ae->flags);
 		break;
+	}
+	case SPECIALFD_INOTIFY: {
+		struct specialfd_inotify *si;
+
+		si = arg;
+		error = inotify_create_file(td, fp, si->flags, &fflags);
+		break;
+	}
 	default:
 		error = EINVAL;
 		break;
@@ -976,11 +986,12 @@ kern_specialfd(struct thread *td, int type, void *arg)
 int
 sys___specialfd(struct thread *td, struct __specialfd_args *args)
 {
-	struct specialfd_eventfd ae;
 	int error;
 
 	switch (args->type) {
-	case SPECIALFD_EVENTFD:
+	case SPECIALFD_EVENTFD: {
+		struct specialfd_eventfd ae;
+
 		if (args->len != sizeof(struct specialfd_eventfd)) {
 			error = EINVAL;
 			break;
@@ -995,6 +1006,20 @@ sys___specialfd(struct thread *td, struct __specialfd_args *args)
 		}
 		error = kern_specialfd(td, args->type, &ae);
 		break;
+	}
+	case SPECIALFD_INOTIFY: {
+		struct specialfd_inotify si;
+
+		if (args->len != sizeof(si)) {
+			error = EINVAL;
+			break;
+		}
+		error = copyin(args->req, &si, sizeof(si));
+		if (error != 0)
+			break;
+		error = kern_specialfd(td, args->type, &si);
+		break;
+	}
 	default:
 		error = EINVAL;
 		break;
diff --git a/sys/kern/syscalls.master b/sys/kern/syscalls.master
index a52f4bd88b85..81b27d583c8c 100644
--- a/sys/kern/syscalls.master
+++ b/sys/kern/syscalls.master
@@ -3362,5 +3362,20 @@
 		    size_t size
 		);
 	}
+592	AUE_NULL	UNIMPL	exterrctl
+593	AUE_INOTIFY	STD|CAPENABLED {
+		int inotify_add_watch_at(
+		    int fd,
+		    int dfd,
+		    _In_z_ const char *path,
+		    uint32_t mask
+		);
+	}
+594	AUE_INOTIFY	STD|CAPENABLED {
+		int inotify_rm_watch(
+		    int fd,
+		    int wd
+		);
+	}
 
 ; vim: syntax=off
diff --git a/sys/kern/vfs_cache.c b/sys/kern/vfs_cache.c
index 0b0fbdb3cb1d..b7f80a1f952f 100644
--- a/sys/kern/vfs_cache.c
+++ b/sys/kern/vfs_cache.c
@@ -43,6 +43,7 @@
 #include <sys/counter.h>
 #include <sys/filedesc.h>
 #include <sys/fnv_hash.h>
+#include <sys/inotify.h>
 #include <sys/kernel.h>
 #include <sys/ktr.h>
 #include <sys/lock.h>
@@ -2543,6 +2544,14 @@ cache_enter_time(struct vnode *dvp, struct vnode *vp, struct componentname *cnp,
 		atomic_store_ptr(&dvp->v_cache_dd, ncp);
 	} else if (vp != NULL) {
 		/*
+		 * Take the slow path in INOTIFY().  This flag will be lazily
+		 * cleared by cache_vop_inotify() once all directories referring
+		 * to vp are unwatched.
+		 */
+		if (__predict_false((vn_irflag_read(dvp) & VIRF_INOTIFY) != 0))
+			vn_irflag_set_cond(vp, VIRF_INOTIFY_PARENT);
+
+		/*
 		 * For this case, the cache entry maps both the
 		 * directory name in it and the name ".." for the
 		 * directory's parent.
@@ -3958,6 +3967,56 @@ out:
 	return (error);
 }
 
+void
+cache_vop_inotify(struct vnode *vp, int event, uint32_t cookie)
+{
+	struct mtx *vlp;
+	struct namecache *ncp;
+	int isdir;
+	bool logged, self;
+
+	isdir = vp->v_type == VDIR ? IN_ISDIR : 0;
+	self = (vn_irflag_read(vp) & VIRF_INOTIFY) != 0 &&
+	    (vp->v_type != VDIR || (event & ~_IN_DIR_EVENTS) != 0);
+
+	if (self) {
+		int selfevent;
+
+		if (event == _IN_ATTRIB_LINKCOUNT)
+			selfevent = IN_ATTRIB;
+		else
+			selfevent = event;
+		inotify_log(vp, NULL, 0, selfevent | isdir, cookie);
+	}
+	if ((event & IN_ALL_EVENTS) == 0)
+		return;
+
+	logged = false;
+	vlp = VP2VNODELOCK(vp);
+	mtx_lock(vlp);
+	TAILQ_FOREACH(ncp, &vp->v_cache_dst, nc_dst) {
+		if ((ncp->nc_flag & NCF_ISDOTDOT) != 0)
+			continue;
+		if ((vn_irflag_read(ncp->nc_dvp) & VIRF_INOTIFY) != 0) {
+			/*
+			 * XXX-MJ if the vnode has two links in the same
+			 * dir, we'll log the same event twice.
+			 */
+			inotify_log(ncp->nc_dvp, ncp->nc_name, ncp->nc_nlen,
+			    event | isdir, cookie);
+			logged = true;
+		}
+	}
+	if (!logged && (vn_irflag_read(vp) & VIRF_INOTIFY_PARENT) != 0) {
+		/*
+		 * We didn't find a watched directory that contains this vnode,
+		 * so stop calling VOP_INOTIFY for operations on the vnode.
+		 */
+		vn_irflag_unset(vp, VIRF_INOTIFY_PARENT);
+	}
+	mtx_unlock(vlp);
+}
+
 #ifdef DDB
 static void
 db_print_vpath(struct vnode *vp)
diff --git a/sys/kern/vfs_default.c b/sys/kern/vfs_default.c
index 006da1c19f3d..26f80748b881 100644
--- a/sys/kern/vfs_default.c
+++ b/sys/kern/vfs_default.c
@@ -42,6 +42,7 @@
 #include <sys/conf.h>
 #include <sys/event.h>
 #include <sys/filio.h>
+#include <sys/inotify.h>
 #include <sys/kernel.h>
 #include <sys/limits.h>
 #include <sys/lock.h>
@@ -122,6 +123,8 @@ struct vop_vector default_vnodeops = {
 	.vop_getwritemount =	vop_stdgetwritemount,
 	.vop_inactive =		VOP_NULL,
 	.vop_need_inactive =	vop_stdneed_inactive,
+	.vop_inotify =		vop_stdinotify,
+	.vop_inotify_add_watch = vop_stdinotify_add_watch,
 	.vop_ioctl =		vop_stdioctl,
 	.vop_kqfilter =		vop_stdkqfilter,
 	.vop_islocked =		vop_stdislocked,
@@ -1307,6 +1310,20 @@ vop_stdneed_inactive(struct vop_need_inactive_args *ap)
 }
 
 int
+vop_stdinotify(struct vop_inotify_args *ap)
+{
+	vn_inotify(ap->a_vp, ap->a_dvp, ap->a_cnp, ap->a_event, ap->a_cookie);
+	return (0);
+}
+
+int
+vop_stdinotify_add_watch(struct vop_inotify_add_watch_args *ap)
+{
+	return (vn_inotify_add_watch(ap->a_vp, ap->a_sc, ap->a_mask,
+	    ap->a_wdp, ap->a_td));
+}
+
+int
 vop_stdioctl(struct vop_ioctl_args *ap)
 {
 	struct vnode *vp;
diff --git a/sys/kern/vfs_inotify.c b/sys/kern/vfs_inotify.c
new file mode 100644
index 000000000000..91d3e8d5f0fd
--- /dev/null
+++ b/sys/kern/vfs_inotify.c
@@ -0,0 +1,1004 @@
+/*-
+ * SPDX-License-Identifier: BSD-2-Clause
+ *
+ * Copyright (c) 2025 Klara, Inc.
+ */
+
+#include "opt_ktrace.h"
+
+#include <sys/param.h>
+#include <sys/systm.h>
+#include <sys/caprights.h>
+#include <sys/counter.h>
+#include <sys/dirent.h>
+#include <sys/fcntl.h>
+#include <sys/file.h>
+#include <sys/filio.h>
+#include <sys/inotify.h>
+#include <sys/kernel.h>
+#include <sys/lock.h>
+#include <sys/ktrace.h>
+#include <sys/malloc.h>
+#include <sys/mutex.h>
+#include <sys/namei.h>
+#include <sys/poll.h>
+#include <sys/proc.h>
+#include <sys/queue.h>
+#include <sys/resourcevar.h>
+#include <sys/selinfo.h>
+#include <sys/stat.h>
+#include <sys/syscallsubr.h>
+#include <sys/sysctl.h>
+#include <sys/sysent.h>
+#include <sys/syslimits.h>
+#include <sys/sysproto.h>
+#include <sys/tree.h>
+#include <sys/user.h>
+#include <sys/vnode.h>
+
+uint32_t inotify_rename_cookie;
+
+static SYSCTL_NODE(_vfs, OID_AUTO, inotify, CTLFLAG_RD | CTLFLAG_MPSAFE, 0,
+    "inotify configuration");
+
+static int inotify_max_queued_events = 16384;
+SYSCTL_INT(_vfs_inotify, OID_AUTO, max_queued_events, CTLFLAG_RWTUN,
+    &inotify_max_queued_events, 0,
+    "Maximum number of events to queue on an inotify descriptor");
+
+static int inotify_max_user_instances = 256;
+SYSCTL_INT(_vfs_inotify, OID_AUTO, max_user_instances, CTLFLAG_RWTUN,
+    &inotify_max_user_instances, 0,
+    "Maximum number of inotify descriptors per user");
+
+static int inotify_max_user_watches;
+SYSCTL_INT(_vfs_inotify, OID_AUTO, max_user_watches, CTLFLAG_RWTUN,
+    &inotify_max_user_watches, 0,
+    "Maximum number of inotify watches per user");
+
+static int inotify_max_watches;
+SYSCTL_INT(_vfs_inotify, OID_AUTO, max_watches, CTLFLAG_RWTUN,
+    &inotify_max_watches, 0,
+    "Maximum number of inotify watches system-wide");
+
+static int inotify_watches;
+SYSCTL_INT(_vfs_inotify, OID_AUTO, watches, CTLFLAG_RD,
+    &inotify_watches, 0,
+    "Total number of inotify watches currently in use");
+
+static int inotify_coalesce = 1;
+SYSCTL_INT(_vfs_inotify, OID_AUTO, coalesce, CTLFLAG_RWTUN,
+    &inotify_coalesce, 0,
+    "Coalesce inotify events when possible");
+
+static COUNTER_U64_DEFINE_EARLY(inotify_event_drops);
+SYSCTL_COUNTER_U64(_vfs_inotify, OID_AUTO, event_drops, CTLFLAG_RD,
+    &inotify_event_drops,
+    "Number of inotify events dropped due to limits or allocation failures");
+
+static fo_rdwr_t	inotify_read;
+static fo_ioctl_t	inotify_ioctl;
+static fo_poll_t	inotify_poll;
+static fo_kqfilter_t	inotify_kqfilter;
+static fo_stat_t	inotify_stat;
+static fo_close_t	inotify_close;
+static fo_fill_kinfo_t	inotify_fill_kinfo;
+
+static const struct fileops inotifyfdops = {
+	.fo_read = inotify_read,
+	.fo_write = invfo_rdwr,
+	.fo_truncate = invfo_truncate,
+	.fo_ioctl = inotify_ioctl,
+	.fo_poll = inotify_poll,
+	.fo_kqfilter = inotify_kqfilter,
+	.fo_stat = inotify_stat,
+	.fo_close = inotify_close,
+	.fo_chmod = invfo_chmod,
+	.fo_chown = invfo_chown,
+	.fo_sendfile = invfo_sendfile,
+	.fo_fill_kinfo = inotify_fill_kinfo,
+	.fo_cmp = file_kcmp_generic,
+	.fo_flags = DFLAG_PASSABLE,
+};
+
+static void	filt_inotifydetach(struct knote *kn);
+static int	filt_inotifyevent(struct knote *kn, long hint);
+
+static const struct filterops inotify_rfiltops = {
+	.f_isfd = 1,
+	.f_detach = filt_inotifydetach,
+	.f_event = filt_inotifyevent,
+};
+
+static MALLOC_DEFINE(M_INOTIFY, "inotify", "inotify data structures");
+
+struct inotify_record {
+	STAILQ_ENTRY(inotify_record) link;
+	struct inotify_event	ev;
+};
+
+static uint64_t inotify_ino = 1;
+
+/*
+ * On LP64 systems this occupies 64 bytes, so we don't get internal
+ * fragmentation by allocating watches with malloc(9).  If the size changes,
+ * consider using a UMA zone to improve memory efficiency.
+ */
+struct inotify_watch {
+	struct inotify_softc *sc; /* back-pointer */
+	int		wd;	/* unique ID */
+	uint32_t	mask;	/* event mask */
+	struct vnode	*vp;	/* vnode being watched, refed */
+	RB_ENTRY(inotify_watch) ilink;		/* inotify linkage */
+	TAILQ_ENTRY(inotify_watch) vlink;	/* vnode linkage */
+};
+
+static void
+inotify_init(void *arg __unused)
+{
+	/* Don't let a user hold too many vnodes. */
+	inotify_max_user_watches = desiredvnodes / 3;
+	/* Don't let the system hold too many vnodes. */
+	inotify_max_watches = desiredvnodes / 2;
+}
+SYSINIT(inotify, SI_SUB_VFS, SI_ORDER_ANY, inotify_init, NULL);
+
+static int
+inotify_watch_cmp(const struct inotify_watch *a,
+    const struct inotify_watch *b)
+{
+	if (a->wd < b->wd)
+		return (-1);
+	else if (a->wd > b->wd)
+		return (1);
+	else
+		return (0);
+}
+RB_HEAD(inotify_watch_tree, inotify_watch);
+RB_GENERATE_STATIC(inotify_watch_tree, inotify_watch, ilink, inotify_watch_cmp);
+
+struct inotify_softc {
+	struct mtx	lock;			/* serialize all softc writes */
+	STAILQ_HEAD(, inotify_record) pending;	/* events waiting to be read */
+	struct inotify_record overflow;		/* preallocated record */
+	int		nextwatch;		/* next watch ID to try */
+	int		npending;		/* number of pending events */
+	size_t		nbpending;		/* bytes available to read */
+	uint64_t	ino;			/* unique identifier */
+	struct inotify_watch_tree watches;	/* active watches */
+	struct selinfo	sel;			/* select/poll/kevent info */
+	struct ucred	*cred;			/* credential ref */
+};
+
+static struct inotify_record *
+inotify_dequeue(struct inotify_softc *sc)
+{
+	struct inotify_record *rec;
+
+	mtx_assert(&sc->lock, MA_OWNED);
+	KASSERT(!STAILQ_EMPTY(&sc->pending),
+	    ("%s: queue for %p is empty", __func__, sc));
+
+	rec = STAILQ_FIRST(&sc->pending);
+	STAILQ_REMOVE_HEAD(&sc->pending, link);
+	sc->npending--;
+	sc->nbpending -= sizeof(rec->ev) + rec->ev.len;
+	return (rec);
+}
+
+static void
+inotify_enqueue(struct inotify_softc *sc, struct inotify_record *rec, bool head)
+{
+	mtx_assert(&sc->lock, MA_OWNED);
+
+	if (head)
+		STAILQ_INSERT_HEAD(&sc->pending, rec, link);
+	else
+		STAILQ_INSERT_TAIL(&sc->pending, rec, link);
+	sc->npending++;
+	sc->nbpending += sizeof(rec->ev) + rec->ev.len;
+}
+
+static int
+inotify_read(struct file *fp, struct uio *uio, struct ucred *cred, int flags,
+    struct thread *td)
+{
+	struct inotify_softc *sc;
+	struct inotify_record *rec;
+	int error;
+	bool first;
+
+	sc = fp->f_data;
+	error = 0;
+
+	mtx_lock(&sc->lock);
+	while (STAILQ_EMPTY(&sc->pending)) {
+		if ((flags & IO_NDELAY) != 0 || (fp->f_flag & FNONBLOCK) != 0) {
+			mtx_unlock(&sc->lock);
+			return (EWOULDBLOCK);
+		}
+		error = msleep(&sc->pending, &sc->lock, PCATCH, "inotify", 0);
+		if (error != 0) {
+			mtx_unlock(&sc->lock);
+			return (error);
+		}
+	}
+	for (first = true; !STAILQ_EMPTY(&sc->pending); first = false) {
+		size_t len;
+
+		rec = inotify_dequeue(sc);
+		len = sizeof(rec->ev) + rec->ev.len;
+		if (uio->uio_resid < (ssize_t)len) {
+			inotify_enqueue(sc, rec, true);
+			if (first) {
+				error = EINVAL;
+			}
+			break;
+		}
+		mtx_unlock(&sc->lock);
+		error = uiomove(&rec->ev, len, uio);
+#ifdef KTRACE
+		if (error == 0 && KTRPOINT(td, KTR_STRUCT))
+			ktrstruct("inotify", &rec->ev, len);
+#endif
+		mtx_lock(&sc->lock);
+		if (error != 0) {
+			inotify_enqueue(sc, rec, true);
+			mtx_unlock(&sc->lock);
+			return (error);
+		}
+		if (rec == &sc->overflow) {
+			/*
+			 * Signal to inotify_queue_record() that the overflow
+			 * record can be reused.
+			 */
+			memset(rec, 0, sizeof(*rec));
+		} else {
+			free(rec, M_INOTIFY);
+		}
+	}
+	mtx_unlock(&sc->lock);
+	return (error);
+}
+
+static int
+inotify_ioctl(struct file *fp, u_long com, void *data, struct ucred *cred,
+    struct thread *td)
+{
+	struct inotify_softc *sc;
+
+	sc = fp->f_data;
+
+	switch (com) {
+	case FIONREAD:
+		*(int *)data = (int)sc->nbpending;
+		return (0);
+	case FIONBIO:
+	case FIOASYNC:
+		return (0);
+	default:
+		return (ENOTTY);
+	}
+
+	return (0);
+}
+
+static int
+inotify_poll(struct file *fp, int events, struct ucred *cred, struct thread *td)
+{
+	struct inotify_softc *sc;
+	int revents;
+
+	sc = fp->f_data;
+	revents = 0;
+
+	mtx_lock(&sc->lock);
+	if ((events & (POLLIN | POLLRDNORM)) != 0 && sc->npending > 0)
+		revents |= events & (POLLIN | POLLRDNORM);
+	else
+		selrecord(td, &sc->sel);
+	mtx_unlock(&sc->lock);
+	return (revents);
+}
+
+static void
+filt_inotifydetach(struct knote *kn)
+{
+	struct inotify_softc *sc;
+
+	sc = kn->kn_hook;
+	knlist_remove(&sc->sel.si_note, kn, 0);
+}
+
+static int
+filt_inotifyevent(struct knote *kn, long hint)
+{
+	struct inotify_softc *sc;
+
+	sc = kn->kn_hook;
+	mtx_assert(&sc->lock, MA_OWNED);
+	kn->kn_data = sc->nbpending;
+	return (kn->kn_data > 0);
+}
+
+static int
+inotify_kqfilter(struct file *fp, struct knote *kn)
+{
+	struct inotify_softc *sc;
+
+	if (kn->kn_filter != EVFILT_READ)
+		return (EINVAL);
+	sc = fp->f_data;
+	kn->kn_fop = &inotify_rfiltops;
+	kn->kn_hook = sc;
+	knlist_add(&sc->sel.si_note, kn, 0);
+	return (0);
+}
+
+static int
+inotify_stat(struct file *fp, struct stat *sb, struct ucred *cred)
+{
+	struct inotify_softc *sc;
+
+	sc = fp->f_data;
+
+	memset(sb, 0, sizeof(*sb));
+	sb->st_mode = S_IFREG | S_IRUSR;
+	sb->st_blksize = sizeof(struct inotify_event) + _IN_NAMESIZE(NAME_MAX);
+	mtx_lock(&sc->lock);
+	sb->st_size = sc->nbpending;
+	sb->st_blocks = sc->npending;
+	sb->st_uid = sc->cred->cr_ruid;
+	sb->st_gid = sc->cred->cr_rgid;
+	sb->st_ino = sc->ino;
+	mtx_unlock(&sc->lock);
+	return (0);
+}
+
+static void
+inotify_unlink_watch_locked(struct inotify_softc *sc, struct inotify_watch *watch)
+{
+	struct vnode *vp;
+
+	vp = watch->vp;
+	mtx_assert(&vp->v_pollinfo->vpi_lock, MA_OWNED);
+
+	atomic_subtract_int(&inotify_watches, 1);
+	(void)chginotifywatchcnt(sc->cred->cr_ruidinfo, -1, 0);
+
+	TAILQ_REMOVE(&vp->v_pollinfo->vpi_inotify, watch, vlink);
+	if (TAILQ_EMPTY(&vp->v_pollinfo->vpi_inotify))
+		vn_irflag_unset_locked(vp, VIRF_INOTIFY);
+}
+
+/*
+ * Assumes that the watch has already been removed from its softc.
+ */
+static void
+inotify_remove_watch(struct inotify_watch *watch)
+{
+	struct inotify_softc *sc;
+	struct vnode *vp;
+
+	sc = watch->sc;
+
+	vp = watch->vp;
+	mtx_lock(&vp->v_pollinfo->vpi_lock);
+	inotify_unlink_watch_locked(sc, watch);
+	mtx_unlock(&vp->v_pollinfo->vpi_lock);
+
+	vrele(vp);
+	free(watch, M_INOTIFY);
+}
+
+static int
+inotify_close(struct file *fp, struct thread *td)
+{
+	struct inotify_softc *sc;
+	struct inotify_record *rec;
+	struct inotify_watch *watch;
+
+	sc = fp->f_data;
+
+	mtx_lock(&sc->lock);
+	(void)chginotifycnt(sc->cred->cr_ruidinfo, -1, 0);
+	while ((watch = RB_MIN(inotify_watch_tree, &sc->watches)) != NULL) {
+		RB_REMOVE(inotify_watch_tree, &sc->watches, watch);
+		mtx_unlock(&sc->lock);
+		inotify_remove_watch(watch);
+		mtx_lock(&sc->lock);
+	}
+	while (!STAILQ_EMPTY(&sc->pending)) {
+		rec = inotify_dequeue(sc);
+		if (rec != &sc->overflow)
+			free(rec, M_INOTIFY);
+	}
+	mtx_unlock(&sc->lock);
+	seldrain(&sc->sel);
+	knlist_destroy(&sc->sel.si_note);
+	mtx_destroy(&sc->lock);
+	crfree(sc->cred);
+	free(sc, M_INOTIFY);
+	return (0);
+}
+
+static int
+inotify_fill_kinfo(struct file *fp, struct kinfo_file *kif,
+    struct filedesc *fdp)
+{
+	struct inotify_softc *sc;
+
+	sc = fp->f_data;
+
+	kif->kf_type = KF_TYPE_INOTIFY;
+	kif->kf_un.kf_inotify.kf_inotify_npending = sc->npending;
+	kif->kf_un.kf_inotify.kf_inotify_nbpending = sc->nbpending;
+	return (0);
+}
+
+int
+inotify_create_file(struct thread *td, struct file *fp, int flags, int *fflagsp)
+{
+	struct inotify_softc *sc;
+	int fflags;
+
+	if ((flags & ~(IN_NONBLOCK | IN_CLOEXEC)) != 0)
+		return (EINVAL);
+
+	if (!chginotifycnt(td->td_ucred->cr_ruidinfo, 1,
+	    inotify_max_user_instances))
+		return (EMFILE);
+
+	sc = malloc(sizeof(*sc), M_INOTIFY, M_WAITOK | M_ZERO);
+	sc->nextwatch = 1; /* Required for compatibility. */
+	STAILQ_INIT(&sc->pending);
+	RB_INIT(&sc->watches);
+	mtx_init(&sc->lock, "inotify", NULL, MTX_DEF);
+	knlist_init_mtx(&sc->sel.si_note, &sc->lock);
+	sc->cred = crhold(td->td_ucred);
+	sc->ino = atomic_fetchadd_64(&inotify_ino, 1);
+
+	fflags = FREAD;
+	if ((flags & IN_NONBLOCK) != 0)
+		fflags |= FNONBLOCK;
+	if ((flags & IN_CLOEXEC) != 0)
+		*fflagsp |= O_CLOEXEC;
+	finit(fp, fflags, DTYPE_INOTIFY, sc, &inotifyfdops);
+
+	return (0);
+}
+
+static struct inotify_record *
+inotify_alloc_record(uint32_t wd, const char *name, size_t namelen, int event,
+    uint32_t cookie, int waitok)
+{
+	struct inotify_event *evp;
+	struct inotify_record *rec;
+
+	rec = malloc(sizeof(*rec) + _IN_NAMESIZE(namelen), M_INOTIFY,
+	    waitok | M_ZERO);
+	if (rec == NULL)
+		return (NULL);
+	evp = &rec->ev;
+	evp->wd = wd;
+	evp->mask = event;
+	evp->cookie = cookie;
+	evp->len = _IN_NAMESIZE(namelen);
+	if (name != NULL)
+		memcpy(evp->name, name, namelen);
+	return (rec);
+}
+
+static bool
+inotify_can_coalesce(struct inotify_softc *sc, struct inotify_event *evp)
+{
+	struct inotify_record *prev;
+
+	mtx_assert(&sc->lock, MA_OWNED);
+
+	prev = STAILQ_LAST(&sc->pending, inotify_record, link);
+	return (prev != NULL && prev->ev.mask == evp->mask &&
+	    prev->ev.wd == evp->wd && prev->ev.cookie == evp->cookie &&
+	    prev->ev.len == evp->len &&
+	    (evp->len == 0 || strcmp(prev->ev.name, evp->name) == 0));
+}
+
+static void
+inotify_overflow_event(struct inotify_event *evp)
+{
+	evp->mask = IN_Q_OVERFLOW;
+	evp->wd = -1;
+	evp->cookie = 0;
+	evp->len = 0;
+}
+
+/*
+ * Put an event record on the queue for an inotify desscriptor.  Return false if
+ * the record was not enqueued for some reason, true otherwise.
+ */
+static bool
+inotify_queue_record(struct inotify_softc *sc, struct inotify_record *rec)
+{
+	struct inotify_event *evp;
+
+	mtx_assert(&sc->lock, MA_OWNED);
+
+	evp = &rec->ev;
+	if (__predict_false(rec == &sc->overflow)) {
+		/*
+		 * Is the overflow record already in the queue?  If so, there's
+		 * not much else we can do: we're here because a kernel memory
+		 * shortage prevented new record allocations.
+		 */
+		counter_u64_add(inotify_event_drops, 1);
+		if (evp->mask == IN_Q_OVERFLOW)
+			return (false);
+		inotify_overflow_event(evp);
+	} else {
+		/* Try to coalesce duplicate events. */
+		if (inotify_coalesce && inotify_can_coalesce(sc, evp))
+			return (false);
+
+		/*
+		 * Would this one overflow the queue?  If so, convert it to an
+		 * overflow event and try again to coalesce.
+		 */
+		if (sc->npending >= inotify_max_queued_events) {
+			counter_u64_add(inotify_event_drops, 1);
+			inotify_overflow_event(evp);
+			if (inotify_can_coalesce(sc, evp))
+				return (false);
+		}
+	}
+	inotify_enqueue(sc, rec, false);
+	selwakeup(&sc->sel);
+	KNOTE_LOCKED(&sc->sel.si_note, 0);
+	wakeup(&sc->pending);
+	return (true);
+}
+
+static int
+inotify_log_one(struct inotify_watch *watch, const char *name, size_t namelen,
+    int event, uint32_t cookie)
+{
+	struct inotify_watch key;
+	struct inotify_softc *sc;
+	struct inotify_record *rec;
+	int relecount;
+	bool allocfail;
+
+	relecount = 0;
+
+	sc = watch->sc;
+	rec = inotify_alloc_record(watch->wd, name, namelen, event, cookie,
+	    M_NOWAIT);
+	if (rec == NULL) {
+		rec = &sc->overflow;
+		allocfail = true;
+	} else {
+		allocfail = false;
+	}
+
+	mtx_lock(&sc->lock);
+	if (!inotify_queue_record(sc, rec) && rec != &sc->overflow)
+		free(rec, M_INOTIFY);
+	if ((watch->mask & IN_ONESHOT) != 0 ||
+	    (event & (IN_DELETE_SELF | IN_UNMOUNT)) != 0) {
+		if (!allocfail) {
+			rec = inotify_alloc_record(watch->wd, NULL, 0,
+			    IN_IGNORED, 0, M_NOWAIT);
+			if (rec == NULL)
+				rec = &sc->overflow;
+			if (!inotify_queue_record(sc, rec) &&
+			    rec != &sc->overflow)
+				free(rec, M_INOTIFY);
+		}
+
+		/*
+		 * Remove the watch, taking care to handle races with
+		 * inotify_close().
+		 */
+		key.wd = watch->wd;
+		if (RB_FIND(inotify_watch_tree, &sc->watches, &key) != NULL) {
+			RB_REMOVE(inotify_watch_tree, &sc->watches, watch);
+			inotify_unlink_watch_locked(sc, watch);
+			free(watch, M_INOTIFY);
+
+			/* Defer vrele() to until locks are dropped. */
+			relecount++;
+		}
+	}
+	mtx_unlock(&sc->lock);
+	return (relecount);
+}
+
+void
+inotify_log(struct vnode *vp, const char *name, size_t namelen, int event,
+    uint32_t cookie)
+{
+	struct inotify_watch *watch, *tmp;
+	int relecount;
+
+	KASSERT((event & ~(IN_ALL_EVENTS | IN_ISDIR | IN_UNMOUNT)) == 0,
+	    ("inotify_log: invalid event %#x", event));
+
+	relecount = 0;
+	mtx_lock(&vp->v_pollinfo->vpi_lock);
+	TAILQ_FOREACH_SAFE(watch, &vp->v_pollinfo->vpi_inotify, vlink, tmp) {
+		KASSERT(watch->vp == vp,
+		    ("inotify_log: watch %p vp != vp", watch));
+		if ((watch->mask & event) != 0 || event == IN_UNMOUNT) {
+			relecount += inotify_log_one(watch, name, namelen, event,
+			    cookie);
+		}
+	}
+	mtx_unlock(&vp->v_pollinfo->vpi_lock);
+
+	for (int i = 0; i < relecount; i++)
+		vrele(vp);
+}
+
+/*
+ * An inotify event occurred on a watched vnode.
+ */
+void
+vn_inotify(struct vnode *vp, struct vnode *dvp, struct componentname *cnp,
+    int event, uint32_t cookie)
+{
+	int isdir;
+
+	VNPASS(vp->v_holdcnt > 0, vp);
+
+	isdir = vp->v_type == VDIR ? IN_ISDIR : 0;
+
+	if (dvp != NULL) {
+		VNPASS(dvp->v_holdcnt > 0, dvp);
+
+		/*
+		 * Should we log an event for the vnode itself?
+		 */
+		if ((vn_irflag_read(vp) & VIRF_INOTIFY) != 0) {
+			int selfevent;
+
+			switch (event) {
+			case _IN_MOVE_DELETE:
+			case IN_DELETE:
+				/*
+				 * IN_DELETE_SELF is only generated when the
+				 * last hard link of a file is removed.
+				 */
+				selfevent = IN_DELETE_SELF;
+				if (vp->v_type != VDIR) {
+					struct vattr va;
+					int error;
+
+					error = VOP_GETATTR(vp, &va, cnp->cn_cred);
+					if (error == 0 && va.va_nlink != 0)
+						selfevent = 0;
+				}
+				break;
+			case IN_MOVED_FROM:
+				cookie = 0;
+				selfevent = IN_MOVE_SELF;
+				break;
+			case _IN_ATTRIB_LINKCOUNT:
+				selfevent = IN_ATTRIB;
+				break;
+			default:
+				selfevent = event;
+				break;
+			}
+
+			if ((selfevent & ~_IN_DIR_EVENTS) != 0) {
+				inotify_log(vp, NULL, 0, selfevent | isdir,
+				    cookie);
+			}
+		}
+
+		/*
+		 * Something is watching the directory through which this vnode
+		 * was referenced, so we may need to log the event.
+		 */
+		if ((event & IN_ALL_EVENTS) != 0 &&
+		    (vn_irflag_read(dvp) & VIRF_INOTIFY) != 0) {
+			inotify_log(dvp, cnp->cn_nameptr,
+			    cnp->cn_namelen, event | isdir, cookie);
+		}
+	} else {
+		/*
+		 * We don't know which watched directory might contain the
+		 * vnode, so we have to fall back to searching the name cache.
+		 */
+		cache_vop_inotify(vp, event, cookie);
+	}
+}
+
+int
+vn_inotify_add_watch(struct vnode *vp, struct inotify_softc *sc, uint32_t mask,
+    uint32_t *wdp, struct thread *td)
+{
+	struct inotify_watch *watch, *watch1;
+	uint32_t wd;
+
+	/*
+	 * If this is a directory, make sure all of its entries are present in
+	 * the name cache so that we're able to look them up if an event occurs.
+	 * The persistent reference on the directory prevents the outgoing name
+	 * cache entries from being reclaimed.
+	 */
+	if (vp->v_type == VDIR) {
+		struct dirent *dp;
+		char *buf;
+		off_t off;
+		size_t buflen, len;
+		int eof, error;
+
+		buflen = 128 * sizeof(struct dirent);
+		buf = malloc(buflen, M_TEMP, M_WAITOK);
+
+		error = 0;
+		len = off = eof = 0;
+		for (;;) {
+			struct nameidata nd;
+
+			error = vn_dir_next_dirent(vp, td, buf, buflen, &dp,
+			    &len, &off, &eof);
+			if (error != 0)
+				break;
+			if (len == 0)
+				/* Finished reading. */
+				break;
+			if (strcmp(dp->d_name, ".") == 0 ||
+			    strcmp(dp->d_name, "..") == 0)
+				continue;
+
+			/*
+			 * namei() consumes a reference on the starting
+			 * directory if it's specified as a vnode.
+			 */
+			vrefact(vp);
+			NDINIT_ATVP(&nd, LOOKUP, NOFOLLOW, UIO_SYSSPACE,
+			    dp->d_name, vp);
+			error = namei(&nd);
+			if (error != 0)
+				break;
+			vn_irflag_set_cond(nd.ni_vp, VIRF_INOTIFY_PARENT);
+			vrele(nd.ni_vp);
+		}
+		free(buf, M_TEMP);
+		if (error != 0)
+			return (error);
+	}
+
+	/*
+	 * The vnode referenced in kern_inotify_add_watch() might be different
+	 * than this one if nullfs is in the picture.
+	 */
+	vrefact(vp);
+	watch = malloc(sizeof(*watch), M_INOTIFY, M_WAITOK | M_ZERO);
+	watch->sc = sc;
+	watch->vp = vp;
+	watch->mask = mask;
+
+	/*
+	 * Are we updating an existing watch?  Search the vnode's list rather
+	 * than that of the softc, as the former is likely to be shorter.
+	 */
+	v_addpollinfo(vp);
+	mtx_lock(&vp->v_pollinfo->vpi_lock);
+	TAILQ_FOREACH(watch1, &vp->v_pollinfo->vpi_inotify, vlink) {
+		if (watch1->sc == sc)
+			break;
+	}
+	mtx_lock(&sc->lock);
+	if (watch1 != NULL) {
+		mtx_unlock(&vp->v_pollinfo->vpi_lock);
+
+		/*
+		 * We found an existing watch, update it based on our flags.
+		 */
+		if ((mask & IN_MASK_CREATE) != 0) {
+			mtx_unlock(&sc->lock);
+			vrele(vp);
+			free(watch, M_INOTIFY);
+			return (EEXIST);
+		}
+		if ((mask & IN_MASK_ADD) != 0)
+			watch1->mask |= mask;
+		else
+			watch1->mask = mask;
+		*wdp = watch1->wd;
+		mtx_unlock(&sc->lock);
+		vrele(vp);
+		free(watch, M_INOTIFY);
+		return (EJUSTRETURN);
+	}
+
+	/*
+	 * We're creating a new watch.  Add it to the softc and vnode watch
+	 * lists.
+	 */
+	do {
+		struct inotify_watch key;
+
+		/*
+		 * Search for the next available watch descriptor.  This is
+		 * implemented so as to avoid reusing watch descriptors for as
+		 * long as possible.
+		 */
+		key.wd = wd = sc->nextwatch++;
+		watch1 = RB_FIND(inotify_watch_tree, &sc->watches, &key);
+	} while (watch1 != NULL || wd == 0);
+	watch->wd = wd;
+	RB_INSERT(inotify_watch_tree, &sc->watches, watch);
+	TAILQ_INSERT_TAIL(&vp->v_pollinfo->vpi_inotify, watch, vlink);
+	mtx_unlock(&sc->lock);
+	mtx_unlock(&vp->v_pollinfo->vpi_lock);
+	vn_irflag_set_cond(vp, VIRF_INOTIFY);
+
+	*wdp = wd;
+
+	return (0);
+}
+
+void
+vn_inotify_revoke(struct vnode *vp)
+{
+	if (vp->v_pollinfo == NULL) {
+		/* This is a nullfs vnode which shadows a watched vnode. */
+		return;
+	}
+	inotify_log(vp, NULL, 0, IN_UNMOUNT, 0);
+}
+
+static int
+fget_inotify(struct thread *td, int fd, const cap_rights_t *needrightsp,
+    struct file **fpp)
+{
+	struct file *fp;
+	int error;
+
+	error = fget(td, fd, needrightsp, &fp);
+	if (error != 0)
+		return (error);
+	if (fp->f_type != DTYPE_INOTIFY) {
+		fdrop(fp, td);
+		return (EINVAL);
+	}
+	*fpp = fp;
+	return (0);
+}
+
+static int
+kern_inotify_add_watch(int fd, int dfd, const char *path, uint32_t mask,
+    struct thread *td)
+{
+	struct nameidata nd;
+	struct file *fp;
+	struct inotify_softc *sc;
+	struct vnode *vp;
+	uint32_t wd;
+	int count, error;
+
+	fp = NULL;
+	vp = NULL;
+
+	if ((mask & IN_ALL_EVENTS) == 0)
+		return (EINVAL);
+	if ((mask & (IN_MASK_ADD | IN_MASK_CREATE)) ==
+	    (IN_MASK_ADD | IN_MASK_CREATE))
+		return (EINVAL);
+	if ((mask & ~(IN_ALL_EVENTS | _IN_ALL_FLAGS | IN_UNMOUNT)) != 0)
+		return (EINVAL);
+
+	error = fget_inotify(td, fd, &cap_inotify_add_rights, &fp);
+	if (error != 0)
+		return (error);
+	sc = fp->f_data;
+
+	NDINIT_AT(&nd, LOOKUP,
+	    ((mask & IN_DONT_FOLLOW) ? NOFOLLOW : FOLLOW) | LOCKLEAF |
+	    LOCKSHARED | AUDITVNODE1, UIO_USERSPACE, path, dfd);
+	error = namei(&nd);
+	if (error != 0)
+		goto out;
+	NDFREE_PNBUF(&nd);
+	vp = nd.ni_vp;
+
+	error = VOP_ACCESS(vp, VREAD, td->td_ucred, td);
+	if (error != 0)
+		goto out;
+
+	if ((mask & IN_ONLYDIR) != 0 && vp->v_type != VDIR) {
+		error = ENOTDIR;
+		goto out;
+	}
+
+	count = atomic_fetchadd_int(&inotify_watches, 1);
+	if (count > inotify_max_watches) {
+		atomic_subtract_int(&inotify_watches, 1);
+		error = ENOSPC;
+		goto out;
+	}
+	if (!chginotifywatchcnt(sc->cred->cr_ruidinfo, 1,
+	    inotify_max_user_watches)) {
+		atomic_subtract_int(&inotify_watches, 1);
+		error = ENOSPC;
+		goto out;
+	}
+	error = VOP_INOTIFY_ADD_WATCH(vp, sc, mask, &wd, td);
+	if (error != 0) {
+		atomic_subtract_int(&inotify_watches, 1);
+		(void)chginotifywatchcnt(sc->cred->cr_ruidinfo, -1, 0);
+		if (error == EJUSTRETURN) {
+			/* We updated an existing watch, everything is ok. */
+			error = 0;
+		} else {
+			goto out;
+		}
+	}
+	td->td_retval[0] = wd;
+
+out:
+	if (vp != NULL)
+		vput(vp);
+	fdrop(fp, td);
+	return (error);
+}
+
+int
+sys_inotify_add_watch_at(struct thread *td,
+    struct inotify_add_watch_at_args *uap)
+{
+	return (kern_inotify_add_watch(uap->fd, uap->dfd, uap->path,
+	    uap->mask, td));
+}
+
+static int
+kern_inotify_rm_watch(int fd, uint32_t wd, struct thread *td)
+{
+	struct file *fp;
+	struct inotify_softc *sc;
+	struct inotify_record *rec;
+	struct inotify_watch key, *watch;
+	int error;
+
+	error = fget_inotify(td, fd, &cap_inotify_rm_rights, &fp);
+	if (error != 0)
+		return (error);
+	sc = fp->f_data;
+
+	rec = inotify_alloc_record(wd, NULL, 0, IN_IGNORED, 0, M_WAITOK);
+
+	/*
+	 * For compatibility with Linux, we do not remove pending events
+	 * associated with the watch.  Watch descriptors are implemented so as
+	 * to avoid being reused for as long as possible, so one hopes that any
+	 * pending events from the removed watch descriptor will be removed
+	 * before the watch descriptor is recycled.
+	 */
+	key.wd = wd;
+	mtx_lock(&sc->lock);
+	watch = RB_FIND(inotify_watch_tree, &sc->watches, &key);
+	if (watch == NULL) {
+		free(rec, M_INOTIFY);
+		error = EINVAL;
+	} else {
+		RB_REMOVE(inotify_watch_tree, &sc->watches, watch);
+		if (!inotify_queue_record(sc, rec)) {
+			free(rec, M_INOTIFY);
+			error = 0;
+		}
+	}
+	mtx_unlock(&sc->lock);
+	if (watch != NULL)
+		inotify_remove_watch(watch);
+	fdrop(fp, td);
+	return (error);
+}
+
+int
+sys_inotify_rm_watch(struct thread *td, struct inotify_rm_watch_args *uap)
+{
+	return (kern_inotify_rm_watch(uap->fd, uap->wd, td));
+}
diff --git a/sys/kern/vfs_subr.c b/sys/kern/vfs_subr.c
index aa02b54c3260..0f59117df378 100644
--- a/sys/kern/vfs_subr.c
+++ b/sys/kern/vfs_subr.c
@@ -40,7 +40,6 @@
  * External virtual filesystem routines
  */
 
-#include <sys/cdefs.h>
 #include "opt_ddb.h"
 #include "opt_watchdog.h"
 
@@ -5181,7 +5180,8 @@ destroy_vpollinfo_free(struct vpollinfo *vi)
 static void
 destroy_vpollinfo(struct vpollinfo *vi)
 {
-
+	KASSERT(TAILQ_EMPTY(&vi->vpi_inotify),
+	    ("%s: pollinfo %p has lingering watches", __func__, vi));
 	knlist_clear(&vi->vpi_selinfo.si_note, 1);
 	seldrain(&vi->vpi_selinfo);
 	destroy_vpollinfo_free(vi);
@@ -5195,12 +5195,13 @@ v_addpollinfo(struct vnode *vp)
 {
 	struct vpollinfo *vi;
 
-	if (vp->v_pollinfo != NULL)
+	if (atomic_load_ptr(&vp->v_pollinfo) != NULL)
 		return;
 	vi = malloc(sizeof(*vi), M_VNODEPOLL, M_WAITOK | M_ZERO);
 	mtx_init(&vi->vpi_lock, "vnode pollinfo", NULL, MTX_DEF);
 	knlist_init(&vi->vpi_selinfo.si_note, vp, vfs_knllock,
 	    vfs_knlunlock, vfs_knl_assert_lock);
+	TAILQ_INIT(&vi->vpi_inotify);
 	VI_LOCK(vp);
 	if (vp->v_pollinfo != NULL) {
 		VI_UNLOCK(vp);
diff --git a/sys/kern/vfs_vnops.c b/sys/kern/vfs_vnops.c
index 1e97d2260ac9..4e5767f182dd 100644
--- a/sys/kern/vfs_vnops.c
+++ b/sys/kern/vfs_vnops.c
@@ -284,7 +284,8 @@ restart:
 				NDREINIT(ndp);
 				goto restart;
 			}
-			if ((vn_open_flags & VN_OPEN_NAMECACHE) != 0)
+			if ((vn_open_flags & VN_OPEN_NAMECACHE) != 0 ||
+			    (vn_irflag_read(ndp->ni_dvp) & VIRF_INOTIFY) != 0)
 				ndp->ni_cnd.cn_flags |= MAKEENTRY;
 #ifdef MAC
 			error = mac_vnode_check_create(cred, ndp->ni_dvp,
diff --git a/sys/kern/vnode_if.src b/sys/kern/vnode_if.src
index d13e7efb4bb5..ea66cc435881 100644
--- a/sys/kern/vnode_if.src
+++ b/sys/kern/vnode_if.src
@@ -824,6 +824,27 @@ vop_deallocate {
 };
 
 
+%% inotify	vp	- - -
+
+vop_inotify {
+	IN struct vnode *vp;
+	IN struct vnode *dvp;
+	IN struct componentname *cnp;
+	IN int event;
+	IN uint32_t cookie;
+};
+
+
+%% inotify_add_watch vp	L L L
+
+vop_inotify_add_watch {
+	IN struct vnode *vp;
+	IN struct inotify_softc *sc;
+	IN uint32_t mask;
+	OUT uint32_t *wdp;
+	IN struct thread *td;
+};
+
 # The VOPs below are spares at the end of the table to allow new VOPs to be
 # added in stable branches without breaking the KBI.  New VOPs in HEAD should
 # be added above these spares.  When merging a new VOP to a stable branch,
diff --git a/sys/sys/caprights.h b/sys/sys/caprights.h
index b2fb2898437a..2a90a06386eb 100644
--- a/sys/sys/caprights.h
+++ b/sys/sys/caprights.h
@@ -78,6 +78,8 @@ extern const cap_rights_t cap_futimes_rights;
 extern const cap_rights_t cap_getpeername_rights;
 extern const cap_rights_t cap_getsockopt_rights;
 extern const cap_rights_t cap_getsockname_rights;
+extern const cap_rights_t cap_inotify_add_rights;
+extern const cap_rights_t cap_inotify_rm_rights;
 extern const cap_rights_t cap_ioctl_rights;
 extern const cap_rights_t cap_linkat_source_rights;
 extern const cap_rights_t cap_linkat_target_rights;
diff --git a/sys/sys/capsicum.h b/sys/sys/capsicum.h
index 9dd34cff943a..2393a39fecb9 100644
--- a/sys/sys/capsicum.h
+++ b/sys/sys/capsicum.h
@@ -279,11 +279,15 @@
 
 #define	CAP_KQUEUE		(CAP_KQUEUE_EVENT | CAP_KQUEUE_CHANGE)
 
+/* Allows operations on inotify descriptors. */
+#define	CAP_INOTIFY_ADD		CAPRIGHT(1, 0x0000000000200000ULL)
+#define	CAP_INOTIFY_RM		CAPRIGHT(1, 0x0000000000400000ULL)
+
 /* All used bits for index 1. */
-#define	CAP_ALL1		CAPRIGHT(1, 0x00000000001FFFFFULL)
+#define	CAP_ALL1		CAPRIGHT(1, 0x00000000007FFFFFULL)
 
 /* Available bits for index 1. */
-#define	CAP_UNUSED1_22		CAPRIGHT(1, 0x0000000000200000ULL)
+#define	CAP_UNUSED1_22		CAPRIGHT(1, 0x0000000000800000ULL)
 /* ... */
 #define	CAP_UNUSED1_57		CAPRIGHT(1, 0x0100000000000000ULL)
 
diff --git a/sys/sys/file.h b/sys/sys/file.h
index 785230160b69..fa5c3546f392 100644
--- a/sys/sys/file.h
+++ b/sys/sys/file.h
@@ -70,6 +70,7 @@ struct nameidata;
 #define	DTYPE_PROCDESC	12	/* process descriptor */
 #define	DTYPE_EVENTFD	13	/* eventfd */
 #define	DTYPE_TIMERFD	14	/* timerfd */
+#define	DTYPE_INOTIFY	15	/* inotify descriptor */
 
 #ifdef _KERNEL
 
diff --git a/sys/sys/inotify.h b/sys/sys/inotify.h
new file mode 100644
index 000000000000..6a266aacce32
--- /dev/null
+++ b/sys/sys/inotify.h
@@ -0,0 +1,146 @@
+/*-
+ * SPDX-License-Identifier: BSD-2-Clause
+ *
+ * Copyright (c) 2025 Klara, Inc.
+ */
+
+#ifndef _INOTIFY_H_
+#define _INOTIFY_H_
+
+#include <sys/_types.h>
+
+/* Flags for inotify_init1(). */
+#define	IN_NONBLOCK	0x00000004	/* O_NONBLOCK */
+#define	IN_CLOEXEC	0x00100000	/* O_CLOEXEC */
+
+struct inotify_event {
+	int		wd;
+	__uint32_t	mask;
+	__uint32_t	cookie;
+	__uint32_t	len;
+	char		name[0];
+};
+
+/* Events, set in the mask field. */
+#define	IN_ACCESS		0x00000001
+#define	IN_MODIFY		0x00000002
+#define	IN_ATTRIB		0x00000004
+#define	IN_CLOSE_WRITE		0x00000008
+#define	IN_CLOSE_NOWRITE	0x00000010
+#define	IN_CLOSE		(IN_CLOSE_WRITE | IN_CLOSE_NOWRITE)
+#define	IN_OPEN			0x00000020
+#define	IN_MOVED_FROM		0x00000040
+#define	IN_MOVED_TO		0x00000080
+#define	IN_MOVE			(IN_MOVED_FROM | IN_MOVED_TO)
+#define	IN_CREATE		0x00000100
+#define	IN_DELETE		0x00000200
+#define	IN_DELETE_SELF		0x00000400
+#define	IN_MOVE_SELF		0x00000800
+#define	IN_ALL_EVENTS		0x00000fff
+
+/* Events report only for entries in a watched dir, not the dir itself. */
+#define	_IN_DIR_EVENTS		(IN_CLOSE_WRITE | IN_DELETE | IN_MODIFY | \
+				 IN_MOVED_FROM | IN_MOVED_TO)
+
+#ifdef _KERNEL
+/*
+ * An unlink that's done as part of a rename only records IN_DELETE if the
+ * unlinked vnode itself is watched, and not when the containing directory is
+ * watched.
+ */
+#define	_IN_MOVE_DELETE		0x40000000
+/*
+ * Inode link count changes only trigger IN_ATTRIB events if the inode itself is
+ * watched, and not when the containing directory is watched.
+ */
+#define	_IN_ATTRIB_LINKCOUNT	0x80000000
+#endif
+
+/* Flags, set in the mask field. */
+#define	IN_ONLYDIR		0x01000000
+#define	IN_DONT_FOLLOW		0x02000000
+#define	IN_EXCL_UNLINK		0x04000000
+#define	IN_MASK_CREATE		0x10000000
+#define	IN_MASK_ADD		0x20000000
+#define	IN_ONESHOT		0x80000000
+#define	_IN_ALL_FLAGS		(IN_ONLYDIR | IN_DONT_FOLLOW |		\
+				 IN_EXCL_UNLINK | IN_MASK_CREATE |	\
+				 IN_MASK_ADD | IN_ONESHOT)
+
+/* Flags returned by the kernel. */
+#define	IN_UNMOUNT		0x00002000
+#define	IN_Q_OVERFLOW		0x00004000
+#define	IN_IGNORED		0x00008000
+#define	IN_ISDIR		0x40000000
+#define	_IN_ALL_RETFLAGS	(IN_Q_OVERFLOW | IN_UNMOUNT | IN_IGNORED | \
+				 IN_ISDIR)
+
+#define	_IN_ALIGN		_Alignof(struct inotify_event)
+#define	_IN_NAMESIZE(namelen)	\
+	((namelen) == 0 ? 0 : __align_up((namelen) + 1, _IN_ALIGN))
+
+#ifdef _KERNEL
+struct componentname;
+struct file;
+struct inotify_softc;
+struct thread;
+struct vnode;
+
+int	inotify_create_file(struct thread *, struct file *, int, int *);
+void	inotify_log(struct vnode *, const char *, size_t, int, __uint32_t);
+
+void	vn_inotify(struct vnode *, struct vnode *, struct componentname *, int,
+	    uint32_t);
+int	vn_inotify_add_watch(struct vnode *, struct inotify_softc *,
+	    __uint32_t, __uint32_t *, struct thread *);
+void	vn_inotify_revoke(struct vnode *);
+
+/* Log an inotify event. */
+#define	INOTIFY(vp, ev) do {						\
+	if (__predict_false((vn_irflag_read(vp) & (VIRF_INOTIFY |	\
+	    VIRF_INOTIFY_PARENT)) != 0))				\
+		VOP_INOTIFY((vp), NULL, NULL, (ev), 0);			\
+} while (0)
+
+/* Log an inotify event using a specific name for the vnode. */
+#define	INOTIFY_NAME(vp, dvp, cnp, ev) do {				\
+	if (__predict_false((vn_irflag_read(vp) & VIRF_INOTIFY) != 0 ||	\
+	    (vn_irflag_read(dvp) & VIRF_INOTIFY) != 0)) 		\
+		VOP_INOTIFY((vp), (dvp), (cnp), (ev), 0);		\
+} while (0)
+
+extern __uint32_t inotify_rename_cookie;
+
+#define	INOTIFY_MOVE(vp, fdvp, fcnp, tvp, tdvp, tcnp) do {		\
+	if (__predict_false((vn_irflag_read(fdvp) & VIRF_INOTIFY) != 0 || \
+	    (vn_irflag_read(tdvp) & VIRF_INOTIFY) != 0 ||		\
+	    (vn_irflag_read(vp) & VIRF_INOTIFY) != 0)) {		\
+		__uint32_t cookie;					\
+									\
+		cookie = atomic_fetchadd_32(&inotify_rename_cookie, 1);	\
+		VOP_INOTIFY((vp), (fdvp), (fcnp), IN_MOVED_FROM, cookie); \
+		VOP_INOTIFY((vp), (tdvp), (tcnp), IN_MOVED_TO, cookie);	\
+	}								\
+	if ((tvp) != NULL)						\
+		INOTIFY_NAME((tvp), (tdvp), (tcnp), _IN_MOVE_DELETE);	\
+} while (0)
+
+#define	INOTIFY_REVOKE(vp) do {						\
+	if (__predict_false((vn_irflag_read(vp) & VIRF_INOTIFY) != 0))	\
+		vn_inotify_revoke((vp));				\
+} while (0)
+
+#else
+#include <sys/cdefs.h>
+
+__BEGIN_DECLS
+int	inotify_init(void);
+int	inotify_init1(int flags);
+int	inotify_add_watch(int fd, const char *pathname, __uint32_t mask);
+int	inotify_add_watch_at(int fd, int dfd, const char *pathname,
+	    __uint32_t mask);
+int	inotify_rm_watch(int fd, int wd);
+__END_DECLS
+#endif /* !_KERNEL */
+
+#endif /* !_INOTIFY_H_ */
diff --git a/sys/sys/resourcevar.h b/sys/sys/resourcevar.h
index 8449201dee67..7b77a487dd1e 100644
--- a/sys/sys/resourcevar.h
+++ b/sys/sys/resourcevar.h
@@ -124,6 +124,8 @@ struct uidinfo {
 	long	ui_kqcnt;		/* (b) number of kqueues */
 	long	ui_umtxcnt;		/* (b) number of shared umtxs */
 	long	ui_pipecnt;		/* (b) consumption of pipe buffers */
+	long	ui_inotifycnt;		/* (b) number of inotify descriptors */
+	long	ui_inotifywatchcnt;	/* (b) number of inotify watches */
 	uid_t	ui_uid;			/* (a) uid */
 	u_int	ui_ref;			/* (b) reference count */
 #ifdef	RACCT
@@ -146,6 +148,8 @@ int	 chgsbsize(struct uidinfo *uip, u_int *hiwat, u_int to,
 int	 chgptscnt(struct uidinfo *uip, int diff, rlim_t maxval);
 int	 chgumtxcnt(struct uidinfo *uip, int diff, rlim_t maxval);
 int	 chgpipecnt(struct uidinfo *uip, int diff, rlim_t max);
+int	 chginotifycnt(struct uidinfo *uip, int diff, rlim_t maxval);
+int	 chginotifywatchcnt(struct uidinfo *uip, int diff, rlim_t maxval);
 int	 kern_proc_setrlimit(struct thread *td, struct proc *p, u_int which,
 	    struct rlimit *limp);
 struct plimit
diff --git a/sys/sys/specialfd.h b/sys/sys/specialfd.h
index dc4d88ce689f..0b79c841d149 100644
--- a/sys/sys/specialfd.h
+++ b/sys/sys/specialfd.h
@@ -30,6 +30,7 @@
 
 enum specialfd_type {
 	SPECIALFD_EVENTFD	  = 1,
+	SPECIALFD_INOTIFY	  = 2,
 };
 
 struct specialfd_eventfd {
@@ -37,4 +38,8 @@ struct specialfd_eventfd {
 	int flags;
 };
 
+struct specialfd_inotify {
+	int flags;
+};
+
 #endif /* !_SYS_SPECIALFD_H_ */
diff --git a/sys/sys/user.h b/sys/sys/user.h
index bae0737b6f2d..8499bb6af4e4 100644
--- a/sys/sys/user.h
+++ b/sys/sys/user.h
@@ -266,6 +266,7 @@ struct user {
 #define	KF_TYPE_DEV	12
 #define	KF_TYPE_EVENTFD	13
 #define	KF_TYPE_TIMERFD	14
+#define	KF_TYPE_INOTIFY	15
 #define	KF_TYPE_UNKNOWN	255
 
 #define	KF_VTYPE_VNON	0
@@ -457,6 +458,10 @@ struct kinfo_file {
 				int32_t		kf_kqueue_count;
 				int32_t		kf_kqueue_state;
 			} kf_kqueue;
+			struct {
+				uint64_t	kf_inotify_npending;
+				uint64_t	kf_inotify_nbpending;
+			} kf_inotify;
 		} kf_un;
 	};
 	uint16_t	kf_status;		/* Status flags. */
diff --git a/sys/sys/vnode.h b/sys/sys/vnode.h
index 28eb49dd3eac..d63cff7d4ada 100644
--- a/sys/sys/vnode.h
+++ b/sys/sys/vnode.h
@@ -93,11 +93,13 @@ enum vgetstate {
  * it from v_data.  If non-null, this area is freed in getnewvnode().
  */
 
-struct namecache;
 struct cache_fpl;
+struct inotify_watch;
+struct namecache;
 
 struct vpollinfo {
 	struct	mtx vpi_lock;		/* lock to protect below */
+	TAILQ_HEAD(, inotify_watch) vpi_inotify; /* list of inotify watchers */
 	struct	selinfo vpi_selinfo;	/* identity of poller(s) */
 	short	vpi_events;		/* what they are looking for */
 	short	vpi_revents;		/* what has happened */
@@ -255,6 +257,9 @@ _Static_assert(sizeof(struct vnode) <= 448, "vnode size crosses 448 bytes");
 #define	VIRF_MOUNTPOINT	0x0004	/* This vnode is mounted on */
 #define	VIRF_TEXT_REF	0x0008	/* Executable mappings ref the vnode */
 #define	VIRF_CROSSMP	0x0010	/* Cross-mp vnode, no locking */
+#define	VIRF_INOTIFY	0x0080	/* This vnode is being watched */
+#define	VIRF_INOTIFY_PARENT 0x0100 /* A parent of this vnode may be being
+				      watched */
 
 #define	VI_UNUSED0	0x0001	/* unused */
 #define	VI_MOUNT	0x0002	/* Mount in progress */
@@ -676,6 +681,7 @@ char	*cache_symlink_alloc(size_t size, int flags);
 void	cache_symlink_free(char *string, size_t size);
 int	cache_symlink_resolve(struct cache_fpl *fpl, const char *string,
 	    size_t len);
+void	cache_vop_inotify(struct vnode *vp, int event, uint32_t cookie);
 void	cache_vop_rename(struct vnode *fdvp, struct vnode *fvp, struct vnode *tdvp,
     struct vnode *tvp, struct componentname *fcnp, struct componentname *tcnp);
 void	cache_vop_rmdir(struct vnode *dvp, struct vnode *vp);
@@ -882,8 +888,10 @@ int	vop_stdfsync(struct vop_fsync_args *);
 int	vop_stdgetwritemount(struct vop_getwritemount_args *);
 int	vop_stdgetpages(struct vop_getpages_args *);
 int	vop_stdinactive(struct vop_inactive_args *);
-int	vop_stdioctl(struct vop_ioctl_args *);
 int	vop_stdneed_inactive(struct vop_need_inactive_args *);
+int	vop_stdinotify(struct vop_inotify_args *);
+int	vop_stdinotify_add_watch(struct vop_inotify_add_watch_args *);
+int	vop_stdioctl(struct vop_ioctl_args *);
 int	vop_stdkqfilter(struct vop_kqfilter_args *);
 int	vop_stdlock(struct vop_lock1_args *);
 int	vop_stdunlock(struct vop_unlock_args *);
diff --git a/sys/tools/vnode_if.awk b/sys/tools/vnode_if.awk
index e4fb29f4a8f0..c13561e0d201 100644
--- a/sys/tools/vnode_if.awk
+++ b/sys/tools/vnode_if.awk
@@ -196,6 +196,7 @@ if (cfile) {
 	printc(common_head \
 	    "#include <sys/param.h>\n" \
 	    "#include <sys/event.h>\n" \
+	    "#include <sys/inotify.h>\n" \
 	    "#include <sys/kernel.h>\n" \
 	    "#include <sys/mount.h>\n" \
 	    "#include <sys/sdt.h>\n" \