xref: /freebsd/sys/kern/vfs_vnops.c (revision 6bfca4dcab07dad45a805879d954876b353c0810)
1 /*-
2  * SPDX-License-Identifier: BSD-3-Clause
3  *
4  * Copyright (c) 1982, 1986, 1989, 1993
5  *	The Regents of the University of California.  All rights reserved.
6  * (c) UNIX System Laboratories, Inc.
7  * All or some portions of this file are derived from material licensed
8  * to the University of California by American Telephone and Telegraph
9  * Co. or Unix System Laboratories, Inc. and are reproduced herein with
10  * the permission of UNIX System Laboratories, Inc.
11  *
12  * Copyright (c) 2012 Konstantin Belousov <kib@FreeBSD.org>
13  * Copyright (c) 2013, 2014 The FreeBSD Foundation
14  *
15  * Portions of this software were developed by Konstantin Belousov
16  * under sponsorship from the FreeBSD Foundation.
17  *
18  * Redistribution and use in source and binary forms, with or without
19  * modification, are permitted provided that the following conditions
20  * are met:
21  * 1. Redistributions of source code must retain the above copyright
22  *    notice, this list of conditions and the following disclaimer.
23  * 2. Redistributions in binary form must reproduce the above copyright
24  *    notice, this list of conditions and the following disclaimer in the
25  *    documentation and/or other materials provided with the distribution.
26  * 3. Neither the name of the University nor the names of its contributors
27  *    may be used to endorse or promote products derived from this software
28  *    without specific prior written permission.
29  *
30  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
31  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
32  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
33  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
34  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
35  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
36  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
37  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
38  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
39  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
40  * SUCH DAMAGE.
41  */
42 
43 #include <sys/cdefs.h>
44 #include "opt_hwpmc_hooks.h"
45 
46 #include <sys/param.h>
47 #include <sys/systm.h>
48 #include <sys/disk.h>
49 #include <sys/fail.h>
50 #include <sys/fcntl.h>
51 #include <sys/file.h>
52 #include <sys/kdb.h>
53 #include <sys/ktr.h>
54 #include <sys/stat.h>
55 #include <sys/priv.h>
56 #include <sys/proc.h>
57 #include <sys/limits.h>
58 #include <sys/lock.h>
59 #include <sys/mman.h>
60 #include <sys/mount.h>
61 #include <sys/mutex.h>
62 #include <sys/namei.h>
63 #include <sys/vnode.h>
64 #include <sys/dirent.h>
65 #include <sys/bio.h>
66 #include <sys/buf.h>
67 #include <sys/filio.h>
68 #include <sys/resourcevar.h>
69 #include <sys/rwlock.h>
70 #include <sys/prng.h>
71 #include <sys/sx.h>
72 #include <sys/sleepqueue.h>
73 #include <sys/sysctl.h>
74 #include <sys/ttycom.h>
75 #include <sys/conf.h>
76 #include <sys/syslog.h>
77 #include <sys/unistd.h>
78 #include <sys/user.h>
79 #include <sys/ktrace.h>
80 
81 #include <security/audit/audit.h>
82 #include <security/mac/mac_framework.h>
83 
84 #include <vm/vm.h>
85 #include <vm/vm_extern.h>
86 #include <vm/pmap.h>
87 #include <vm/vm_map.h>
88 #include <vm/vm_object.h>
89 #include <vm/vm_page.h>
90 #include <vm/vm_pager.h>
91 
92 #ifdef HWPMC_HOOKS
93 #include <sys/pmckern.h>
94 #endif
95 
96 static fo_rdwr_t	vn_read;
97 static fo_rdwr_t	vn_write;
98 static fo_rdwr_t	vn_io_fault;
99 static fo_truncate_t	vn_truncate;
100 static fo_ioctl_t	vn_ioctl;
101 static fo_poll_t	vn_poll;
102 static fo_kqfilter_t	vn_kqfilter;
103 static fo_close_t	vn_closefile;
104 static fo_mmap_t	vn_mmap;
105 static fo_fallocate_t	vn_fallocate;
106 static fo_fspacectl_t	vn_fspacectl;
107 
108 struct 	fileops vnops = {
109 	.fo_read = vn_io_fault,
110 	.fo_write = vn_io_fault,
111 	.fo_truncate = vn_truncate,
112 	.fo_ioctl = vn_ioctl,
113 	.fo_poll = vn_poll,
114 	.fo_kqfilter = vn_kqfilter,
115 	.fo_stat = vn_statfile,
116 	.fo_close = vn_closefile,
117 	.fo_chmod = vn_chmod,
118 	.fo_chown = vn_chown,
119 	.fo_sendfile = vn_sendfile,
120 	.fo_seek = vn_seek,
121 	.fo_fill_kinfo = vn_fill_kinfo,
122 	.fo_mmap = vn_mmap,
123 	.fo_fallocate = vn_fallocate,
124 	.fo_fspacectl = vn_fspacectl,
125 	.fo_flags = DFLAG_PASSABLE | DFLAG_SEEKABLE
126 };
127 
128 const u_int io_hold_cnt = 16;
129 static int vn_io_fault_enable = 1;
130 SYSCTL_INT(_debug, OID_AUTO, vn_io_fault_enable, CTLFLAG_RWTUN,
131     &vn_io_fault_enable, 0, "Enable vn_io_fault lock avoidance");
132 static int vn_io_fault_prefault = 0;
133 SYSCTL_INT(_debug, OID_AUTO, vn_io_fault_prefault, CTLFLAG_RWTUN,
134     &vn_io_fault_prefault, 0, "Enable vn_io_fault prefaulting");
135 static int vn_io_pgcache_read_enable = 1;
136 SYSCTL_INT(_debug, OID_AUTO, vn_io_pgcache_read_enable, CTLFLAG_RWTUN,
137     &vn_io_pgcache_read_enable, 0,
138     "Enable copying from page cache for reads, avoiding fs");
139 static u_long vn_io_faults_cnt;
140 SYSCTL_ULONG(_debug, OID_AUTO, vn_io_faults, CTLFLAG_RD,
141     &vn_io_faults_cnt, 0, "Count of vn_io_fault lock avoidance triggers");
142 
143 static int vfs_allow_read_dir = 0;
144 SYSCTL_INT(_security_bsd, OID_AUTO, allow_read_dir, CTLFLAG_RW,
145     &vfs_allow_read_dir, 0,
146     "Enable read(2) of directory by root for filesystems that support it");
147 
148 /*
149  * Returns true if vn_io_fault mode of handling the i/o request should
150  * be used.
151  */
152 static bool
153 do_vn_io_fault(struct vnode *vp, struct uio *uio)
154 {
155 	struct mount *mp;
156 
157 	return (uio->uio_segflg == UIO_USERSPACE && vp->v_type == VREG &&
158 	    (mp = vp->v_mount) != NULL &&
159 	    (mp->mnt_kern_flag & MNTK_NO_IOPF) != 0 && vn_io_fault_enable);
160 }
161 
162 /*
163  * Structure used to pass arguments to vn_io_fault1(), to do either
164  * file- or vnode-based I/O calls.
165  */
166 struct vn_io_fault_args {
167 	enum {
168 		VN_IO_FAULT_FOP,
169 		VN_IO_FAULT_VOP
170 	} kind;
171 	struct ucred *cred;
172 	int flags;
173 	union {
174 		struct fop_args_tag {
175 			struct file *fp;
176 			fo_rdwr_t *doio;
177 		} fop_args;
178 		struct vop_args_tag {
179 			struct vnode *vp;
180 		} vop_args;
181 	} args;
182 };
183 
184 static int vn_io_fault1(struct vnode *vp, struct uio *uio,
185     struct vn_io_fault_args *args, struct thread *td);
186 
187 int
188 vn_open(struct nameidata *ndp, int *flagp, int cmode, struct file *fp)
189 {
190 	struct thread *td = curthread;
191 
192 	return (vn_open_cred(ndp, flagp, cmode, 0, td->td_ucred, fp));
193 }
194 
195 static uint64_t
196 open2nameif(int fmode, u_int vn_open_flags)
197 {
198 	uint64_t res;
199 
200 	res = ISOPEN | LOCKLEAF;
201 	if ((fmode & O_RESOLVE_BENEATH) != 0)
202 		res |= RBENEATH;
203 	if ((fmode & O_EMPTY_PATH) != 0)
204 		res |= EMPTYPATH;
205 	if ((fmode & FREAD) != 0)
206 		res |= OPENREAD;
207 	if ((fmode & FWRITE) != 0)
208 		res |= OPENWRITE;
209 	if ((vn_open_flags & VN_OPEN_NOAUDIT) == 0)
210 		res |= AUDITVNODE1;
211 	if ((vn_open_flags & VN_OPEN_NOCAPCHECK) != 0)
212 		res |= NOCAPCHECK;
213 	if ((vn_open_flags & VN_OPEN_WANTIOCTLCAPS) != 0)
214 		res |= WANTIOCTLCAPS;
215 	return (res);
216 }
217 
218 /*
219  * Common code for vnode open operations via a name lookup.
220  * Lookup the vnode and invoke VOP_CREATE if needed.
221  * Check permissions, and call the VOP_OPEN or VOP_CREATE routine.
222  *
223  * Note that this does NOT free nameidata for the successful case,
224  * due to the NDINIT being done elsewhere.
225  */
226 int
227 vn_open_cred(struct nameidata *ndp, int *flagp, int cmode, u_int vn_open_flags,
228     struct ucred *cred, struct file *fp)
229 {
230 	struct vnode *vp;
231 	struct mount *mp;
232 	struct vattr vat;
233 	struct vattr *vap = &vat;
234 	int fmode, error;
235 	bool first_open;
236 
237 restart:
238 	first_open = false;
239 	fmode = *flagp;
240 	if ((fmode & (O_CREAT | O_EXCL | O_DIRECTORY)) == (O_CREAT |
241 	    O_EXCL | O_DIRECTORY) ||
242 	    (fmode & (O_CREAT | O_EMPTY_PATH)) == (O_CREAT | O_EMPTY_PATH))
243 		return (EINVAL);
244 	else if ((fmode & (O_CREAT | O_DIRECTORY)) == O_CREAT) {
245 		ndp->ni_cnd.cn_nameiop = CREATE;
246 		ndp->ni_cnd.cn_flags = open2nameif(fmode, vn_open_flags);
247 		/*
248 		 * Set NOCACHE to avoid flushing the cache when
249 		 * rolling in many files at once.
250 		 *
251 		 * Set NC_KEEPPOSENTRY to keep positive entries if they already
252 		 * exist despite NOCACHE.
253 		 */
254 		ndp->ni_cnd.cn_flags |= LOCKPARENT | NOCACHE | NC_KEEPPOSENTRY;
255 		if ((fmode & O_EXCL) == 0 && (fmode & O_NOFOLLOW) == 0)
256 			ndp->ni_cnd.cn_flags |= FOLLOW;
257 		if ((vn_open_flags & VN_OPEN_INVFS) == 0)
258 			bwillwrite();
259 		if ((error = namei(ndp)) != 0)
260 			return (error);
261 		if (ndp->ni_vp == NULL) {
262 			VATTR_NULL(vap);
263 			vap->va_type = VREG;
264 			vap->va_mode = cmode;
265 			if (fmode & O_EXCL)
266 				vap->va_vaflags |= VA_EXCLUSIVE;
267 			if (vn_start_write(ndp->ni_dvp, &mp, V_NOWAIT) != 0) {
268 				NDFREE_PNBUF(ndp);
269 				vput(ndp->ni_dvp);
270 				if ((error = vn_start_write(NULL, &mp,
271 				    V_XSLEEP | V_PCATCH)) != 0)
272 					return (error);
273 				NDREINIT(ndp);
274 				goto restart;
275 			}
276 			if ((vn_open_flags & VN_OPEN_NAMECACHE) != 0)
277 				ndp->ni_cnd.cn_flags |= MAKEENTRY;
278 #ifdef MAC
279 			error = mac_vnode_check_create(cred, ndp->ni_dvp,
280 			    &ndp->ni_cnd, vap);
281 			if (error == 0)
282 #endif
283 				error = VOP_CREATE(ndp->ni_dvp, &ndp->ni_vp,
284 				    &ndp->ni_cnd, vap);
285 			vp = ndp->ni_vp;
286 			if (error == 0 && (fmode & O_EXCL) != 0 &&
287 			    (fmode & (O_EXLOCK | O_SHLOCK)) != 0) {
288 				VI_LOCK(vp);
289 				vp->v_iflag |= VI_FOPENING;
290 				VI_UNLOCK(vp);
291 				first_open = true;
292 			}
293 			VOP_VPUT_PAIR(ndp->ni_dvp, error == 0 ? &vp : NULL,
294 			    false);
295 			vn_finished_write(mp);
296 			if (error) {
297 				NDFREE_PNBUF(ndp);
298 				if (error == ERELOOKUP) {
299 					NDREINIT(ndp);
300 					goto restart;
301 				}
302 				return (error);
303 			}
304 			fmode &= ~O_TRUNC;
305 		} else {
306 			if (ndp->ni_dvp == ndp->ni_vp)
307 				vrele(ndp->ni_dvp);
308 			else
309 				vput(ndp->ni_dvp);
310 			ndp->ni_dvp = NULL;
311 			vp = ndp->ni_vp;
312 			if (fmode & O_EXCL) {
313 				error = EEXIST;
314 				goto bad;
315 			}
316 			if (vp->v_type == VDIR) {
317 				error = EISDIR;
318 				goto bad;
319 			}
320 			fmode &= ~O_CREAT;
321 		}
322 	} else {
323 		ndp->ni_cnd.cn_nameiop = LOOKUP;
324 		ndp->ni_cnd.cn_flags = open2nameif(fmode, vn_open_flags);
325 		ndp->ni_cnd.cn_flags |= (fmode & O_NOFOLLOW) != 0 ? NOFOLLOW :
326 		    FOLLOW;
327 		if ((fmode & FWRITE) == 0)
328 			ndp->ni_cnd.cn_flags |= LOCKSHARED;
329 		if ((error = namei(ndp)) != 0)
330 			return (error);
331 		vp = ndp->ni_vp;
332 	}
333 	error = vn_open_vnode(vp, fmode, cred, curthread, fp);
334 	if (first_open) {
335 		VI_LOCK(vp);
336 		vp->v_iflag &= ~VI_FOPENING;
337 		wakeup(vp);
338 		VI_UNLOCK(vp);
339 	}
340 	if (error)
341 		goto bad;
342 	*flagp = fmode;
343 	return (0);
344 bad:
345 	NDFREE_PNBUF(ndp);
346 	vput(vp);
347 	*flagp = fmode;
348 	ndp->ni_vp = NULL;
349 	return (error);
350 }
351 
352 static int
353 vn_open_vnode_advlock(struct vnode *vp, int fmode, struct file *fp)
354 {
355 	struct flock lf;
356 	int error, lock_flags, type;
357 
358 	ASSERT_VOP_LOCKED(vp, "vn_open_vnode_advlock");
359 	if ((fmode & (O_EXLOCK | O_SHLOCK)) == 0)
360 		return (0);
361 	KASSERT(fp != NULL, ("open with flock requires fp"));
362 	if (fp->f_type != DTYPE_NONE && fp->f_type != DTYPE_VNODE)
363 		return (EOPNOTSUPP);
364 
365 	lock_flags = VOP_ISLOCKED(vp);
366 	VOP_UNLOCK(vp);
367 
368 	lf.l_whence = SEEK_SET;
369 	lf.l_start = 0;
370 	lf.l_len = 0;
371 	lf.l_type = (fmode & O_EXLOCK) != 0 ? F_WRLCK : F_RDLCK;
372 	type = F_FLOCK;
373 	if ((fmode & FNONBLOCK) == 0)
374 		type |= F_WAIT;
375 	if ((fmode & (O_CREAT | O_EXCL)) == (O_CREAT | O_EXCL))
376 		type |= F_FIRSTOPEN;
377 	error = VOP_ADVLOCK(vp, (caddr_t)fp, F_SETLK, &lf, type);
378 	if (error == 0)
379 		fp->f_flag |= FHASLOCK;
380 
381 	vn_lock(vp, lock_flags | LK_RETRY);
382 	return (error);
383 }
384 
385 /*
386  * Common code for vnode open operations once a vnode is located.
387  * Check permissions, and call the VOP_OPEN routine.
388  */
389 int
390 vn_open_vnode(struct vnode *vp, int fmode, struct ucred *cred,
391     struct thread *td, struct file *fp)
392 {
393 	accmode_t accmode;
394 	int error;
395 
396 	if (vp->v_type == VLNK) {
397 		if ((fmode & O_PATH) == 0 || (fmode & FEXEC) != 0)
398 			return (EMLINK);
399 	}
400 	if (vp->v_type != VDIR && fmode & O_DIRECTORY)
401 		return (ENOTDIR);
402 
403 	accmode = 0;
404 	if ((fmode & O_PATH) == 0) {
405 		if (vp->v_type == VSOCK)
406 			return (EOPNOTSUPP);
407 		if ((fmode & (FWRITE | O_TRUNC)) != 0) {
408 			if (vp->v_type == VDIR)
409 				return (EISDIR);
410 			accmode |= VWRITE;
411 		}
412 		if ((fmode & FREAD) != 0)
413 			accmode |= VREAD;
414 		if ((fmode & O_APPEND) && (fmode & FWRITE))
415 			accmode |= VAPPEND;
416 #ifdef MAC
417 		if ((fmode & O_CREAT) != 0)
418 			accmode |= VCREAT;
419 #endif
420 	}
421 	if ((fmode & FEXEC) != 0)
422 		accmode |= VEXEC;
423 #ifdef MAC
424 	if ((fmode & O_VERIFY) != 0)
425 		accmode |= VVERIFY;
426 	error = mac_vnode_check_open(cred, vp, accmode);
427 	if (error != 0)
428 		return (error);
429 
430 	accmode &= ~(VCREAT | VVERIFY);
431 #endif
432 	if ((fmode & O_CREAT) == 0 && accmode != 0) {
433 		error = VOP_ACCESS(vp, accmode, cred, td);
434 		if (error != 0)
435 			return (error);
436 	}
437 	if ((fmode & O_PATH) != 0) {
438 		if (vp->v_type != VFIFO && vp->v_type != VSOCK &&
439 		    VOP_ACCESS(vp, VREAD, cred, td) == 0)
440 			fp->f_flag |= FKQALLOWED;
441 		return (0);
442 	}
443 
444 	if (vp->v_type == VFIFO && VOP_ISLOCKED(vp) != LK_EXCLUSIVE)
445 		vn_lock(vp, LK_UPGRADE | LK_RETRY);
446 	error = VOP_OPEN(vp, fmode, cred, td, fp);
447 	if (error != 0)
448 		return (error);
449 
450 	error = vn_open_vnode_advlock(vp, fmode, fp);
451 	if (error == 0 && (fmode & FWRITE) != 0) {
452 		error = VOP_ADD_WRITECOUNT(vp, 1);
453 		if (error == 0) {
454 			CTR3(KTR_VFS, "%s: vp %p v_writecount increased to %d",
455 			     __func__, vp, vp->v_writecount);
456 		}
457 	}
458 
459 	/*
460 	 * Error from advlock or VOP_ADD_WRITECOUNT() still requires
461 	 * calling VOP_CLOSE() to pair with earlier VOP_OPEN().
462 	 */
463 	if (error != 0) {
464 		if (fp != NULL) {
465 			/*
466 			 * Arrange the call by having fdrop() to use
467 			 * vn_closefile().  This is to satisfy
468 			 * filesystems like devfs or tmpfs, which
469 			 * override fo_close().
470 			 */
471 			fp->f_flag |= FOPENFAILED;
472 			fp->f_vnode = vp;
473 			if (fp->f_ops == &badfileops) {
474 				fp->f_type = DTYPE_VNODE;
475 				fp->f_ops = &vnops;
476 			}
477 			vref(vp);
478 		} else {
479 			/*
480 			 * If there is no fp, due to kernel-mode open,
481 			 * we can call VOP_CLOSE() now.
482 			 */
483 			if ((vp->v_type == VFIFO ||
484 			    !MNT_EXTENDED_SHARED(vp->v_mount)) &&
485 			    VOP_ISLOCKED(vp) != LK_EXCLUSIVE)
486 				vn_lock(vp, LK_UPGRADE | LK_RETRY);
487 			(void)VOP_CLOSE(vp, fmode & (FREAD | FWRITE | FEXEC),
488 			    cred, td);
489 		}
490 	}
491 
492 	ASSERT_VOP_LOCKED(vp, "vn_open_vnode");
493 	return (error);
494 
495 }
496 
497 /*
498  * Check for write permissions on the specified vnode.
499  * Prototype text segments cannot be written.
500  * It is racy.
501  */
502 int
503 vn_writechk(struct vnode *vp)
504 {
505 
506 	ASSERT_VOP_LOCKED(vp, "vn_writechk");
507 	/*
508 	 * If there's shared text associated with
509 	 * the vnode, try to free it up once.  If
510 	 * we fail, we can't allow writing.
511 	 */
512 	if (VOP_IS_TEXT(vp))
513 		return (ETXTBSY);
514 
515 	return (0);
516 }
517 
518 /*
519  * Vnode close call
520  */
521 static int
522 vn_close1(struct vnode *vp, int flags, struct ucred *file_cred,
523     struct thread *td, bool keep_ref)
524 {
525 	struct mount *mp;
526 	int error, lock_flags;
527 
528 	lock_flags = vp->v_type != VFIFO && MNT_EXTENDED_SHARED(vp->v_mount) ?
529 	    LK_SHARED : LK_EXCLUSIVE;
530 
531 	vn_start_write(vp, &mp, V_WAIT);
532 	vn_lock(vp, lock_flags | LK_RETRY);
533 	AUDIT_ARG_VNODE1(vp);
534 	if ((flags & (FWRITE | FOPENFAILED)) == FWRITE) {
535 		VOP_ADD_WRITECOUNT_CHECKED(vp, -1);
536 		CTR3(KTR_VFS, "%s: vp %p v_writecount decreased to %d",
537 		    __func__, vp, vp->v_writecount);
538 	}
539 	error = VOP_CLOSE(vp, flags, file_cred, td);
540 	if (keep_ref)
541 		VOP_UNLOCK(vp);
542 	else
543 		vput(vp);
544 	vn_finished_write(mp);
545 	return (error);
546 }
547 
548 int
549 vn_close(struct vnode *vp, int flags, struct ucred *file_cred,
550     struct thread *td)
551 {
552 
553 	return (vn_close1(vp, flags, file_cred, td, false));
554 }
555 
556 /*
557  * Heuristic to detect sequential operation.
558  */
559 static int
560 sequential_heuristic(struct uio *uio, struct file *fp)
561 {
562 	enum uio_rw rw;
563 
564 	ASSERT_VOP_LOCKED(fp->f_vnode, __func__);
565 
566 	rw = uio->uio_rw;
567 	if (fp->f_flag & FRDAHEAD)
568 		return (fp->f_seqcount[rw] << IO_SEQSHIFT);
569 
570 	/*
571 	 * Offset 0 is handled specially.  open() sets f_seqcount to 1 so
572 	 * that the first I/O is normally considered to be slightly
573 	 * sequential.  Seeking to offset 0 doesn't change sequentiality
574 	 * unless previous seeks have reduced f_seqcount to 0, in which
575 	 * case offset 0 is not special.
576 	 */
577 	if ((uio->uio_offset == 0 && fp->f_seqcount[rw] > 0) ||
578 	    uio->uio_offset == fp->f_nextoff[rw]) {
579 		/*
580 		 * f_seqcount is in units of fixed-size blocks so that it
581 		 * depends mainly on the amount of sequential I/O and not
582 		 * much on the number of sequential I/O's.  The fixed size
583 		 * of 16384 is hard-coded here since it is (not quite) just
584 		 * a magic size that works well here.  This size is more
585 		 * closely related to the best I/O size for real disks than
586 		 * to any block size used by software.
587 		 */
588 		if (uio->uio_resid >= IO_SEQMAX * 16384)
589 			fp->f_seqcount[rw] = IO_SEQMAX;
590 		else {
591 			fp->f_seqcount[rw] += howmany(uio->uio_resid, 16384);
592 			if (fp->f_seqcount[rw] > IO_SEQMAX)
593 				fp->f_seqcount[rw] = IO_SEQMAX;
594 		}
595 		return (fp->f_seqcount[rw] << IO_SEQSHIFT);
596 	}
597 
598 	/* Not sequential.  Quickly draw-down sequentiality. */
599 	if (fp->f_seqcount[rw] > 1)
600 		fp->f_seqcount[rw] = 1;
601 	else
602 		fp->f_seqcount[rw] = 0;
603 	return (0);
604 }
605 
606 /*
607  * Package up an I/O request on a vnode into a uio and do it.
608  */
609 int
610 vn_rdwr(enum uio_rw rw, struct vnode *vp, void *base, int len, off_t offset,
611     enum uio_seg segflg, int ioflg, struct ucred *active_cred,
612     struct ucred *file_cred, ssize_t *aresid, struct thread *td)
613 {
614 	struct uio auio;
615 	struct iovec aiov;
616 	struct mount *mp;
617 	struct ucred *cred;
618 	void *rl_cookie;
619 	struct vn_io_fault_args args;
620 	int error, lock_flags;
621 
622 	if (offset < 0 && vp->v_type != VCHR)
623 		return (EINVAL);
624 	auio.uio_iov = &aiov;
625 	auio.uio_iovcnt = 1;
626 	aiov.iov_base = base;
627 	aiov.iov_len = len;
628 	auio.uio_resid = len;
629 	auio.uio_offset = offset;
630 	auio.uio_segflg = segflg;
631 	auio.uio_rw = rw;
632 	auio.uio_td = td;
633 	error = 0;
634 
635 	if ((ioflg & IO_NODELOCKED) == 0) {
636 		if ((ioflg & IO_RANGELOCKED) == 0) {
637 			if (rw == UIO_READ) {
638 				rl_cookie = vn_rangelock_rlock(vp, offset,
639 				    offset + len);
640 			} else if ((ioflg & IO_APPEND) != 0) {
641 				rl_cookie = vn_rangelock_wlock(vp, 0, OFF_MAX);
642 			} else {
643 				rl_cookie = vn_rangelock_wlock(vp, offset,
644 				    offset + len);
645 			}
646 		} else
647 			rl_cookie = NULL;
648 		mp = NULL;
649 		if (rw == UIO_WRITE) {
650 			if (vp->v_type != VCHR &&
651 			    (error = vn_start_write(vp, &mp, V_WAIT | V_PCATCH))
652 			    != 0)
653 				goto out;
654 			lock_flags = vn_lktype_write(mp, vp);
655 		} else
656 			lock_flags = LK_SHARED;
657 		vn_lock(vp, lock_flags | LK_RETRY);
658 	} else
659 		rl_cookie = NULL;
660 
661 	ASSERT_VOP_LOCKED(vp, "IO_NODELOCKED with no vp lock held");
662 #ifdef MAC
663 	if ((ioflg & IO_NOMACCHECK) == 0) {
664 		if (rw == UIO_READ)
665 			error = mac_vnode_check_read(active_cred, file_cred,
666 			    vp);
667 		else
668 			error = mac_vnode_check_write(active_cred, file_cred,
669 			    vp);
670 	}
671 #endif
672 	if (error == 0) {
673 		if (file_cred != NULL)
674 			cred = file_cred;
675 		else
676 			cred = active_cred;
677 		if (do_vn_io_fault(vp, &auio)) {
678 			args.kind = VN_IO_FAULT_VOP;
679 			args.cred = cred;
680 			args.flags = ioflg;
681 			args.args.vop_args.vp = vp;
682 			error = vn_io_fault1(vp, &auio, &args, td);
683 		} else if (rw == UIO_READ) {
684 			error = VOP_READ(vp, &auio, ioflg, cred);
685 		} else /* if (rw == UIO_WRITE) */ {
686 			error = VOP_WRITE(vp, &auio, ioflg, cred);
687 		}
688 	}
689 	if (aresid)
690 		*aresid = auio.uio_resid;
691 	else
692 		if (auio.uio_resid && error == 0)
693 			error = EIO;
694 	if ((ioflg & IO_NODELOCKED) == 0) {
695 		VOP_UNLOCK(vp);
696 		if (mp != NULL)
697 			vn_finished_write(mp);
698 	}
699  out:
700 	if (rl_cookie != NULL)
701 		vn_rangelock_unlock(vp, rl_cookie);
702 	return (error);
703 }
704 
705 /*
706  * Package up an I/O request on a vnode into a uio and do it.  The I/O
707  * request is split up into smaller chunks and we try to avoid saturating
708  * the buffer cache while potentially holding a vnode locked, so we
709  * check bwillwrite() before calling vn_rdwr().  We also call kern_yield()
710  * to give other processes a chance to lock the vnode (either other processes
711  * core'ing the same binary, or unrelated processes scanning the directory).
712  */
713 int
714 vn_rdwr_inchunks(enum uio_rw rw, struct vnode *vp, void *base, size_t len,
715     off_t offset, enum uio_seg segflg, int ioflg, struct ucred *active_cred,
716     struct ucred *file_cred, size_t *aresid, struct thread *td)
717 {
718 	int error = 0;
719 	ssize_t iaresid;
720 
721 	do {
722 		int chunk;
723 
724 		/*
725 		 * Force `offset' to a multiple of MAXBSIZE except possibly
726 		 * for the first chunk, so that filesystems only need to
727 		 * write full blocks except possibly for the first and last
728 		 * chunks.
729 		 */
730 		chunk = MAXBSIZE - (uoff_t)offset % MAXBSIZE;
731 
732 		if (chunk > len)
733 			chunk = len;
734 		if (rw != UIO_READ && vp->v_type == VREG)
735 			bwillwrite();
736 		iaresid = 0;
737 		error = vn_rdwr(rw, vp, base, chunk, offset, segflg,
738 		    ioflg, active_cred, file_cred, &iaresid, td);
739 		len -= chunk;	/* aresid calc already includes length */
740 		if (error)
741 			break;
742 		offset += chunk;
743 		base = (char *)base + chunk;
744 		kern_yield(PRI_USER);
745 	} while (len);
746 	if (aresid)
747 		*aresid = len + iaresid;
748 	return (error);
749 }
750 
751 #if OFF_MAX <= LONG_MAX
752 off_t
753 foffset_lock(struct file *fp, int flags)
754 {
755 	volatile short *flagsp;
756 	off_t res;
757 	short state;
758 
759 	KASSERT((flags & FOF_OFFSET) == 0, ("FOF_OFFSET passed"));
760 
761 	if ((flags & FOF_NOLOCK) != 0)
762 		return (atomic_load_long(&fp->f_offset));
763 
764 	/*
765 	 * According to McKusick the vn lock was protecting f_offset here.
766 	 * It is now protected by the FOFFSET_LOCKED flag.
767 	 */
768 	flagsp = &fp->f_vnread_flags;
769 	if (atomic_cmpset_acq_16(flagsp, 0, FOFFSET_LOCKED))
770 		return (atomic_load_long(&fp->f_offset));
771 
772 	sleepq_lock(&fp->f_vnread_flags);
773 	state = atomic_load_16(flagsp);
774 	for (;;) {
775 		if ((state & FOFFSET_LOCKED) == 0) {
776 			if (!atomic_fcmpset_acq_16(flagsp, &state,
777 			    FOFFSET_LOCKED))
778 				continue;
779 			break;
780 		}
781 		if ((state & FOFFSET_LOCK_WAITING) == 0) {
782 			if (!atomic_fcmpset_acq_16(flagsp, &state,
783 			    state | FOFFSET_LOCK_WAITING))
784 				continue;
785 		}
786 		DROP_GIANT();
787 		sleepq_add(&fp->f_vnread_flags, NULL, "vofflock", 0, 0);
788 		sleepq_wait(&fp->f_vnread_flags, PUSER -1);
789 		PICKUP_GIANT();
790 		sleepq_lock(&fp->f_vnread_flags);
791 		state = atomic_load_16(flagsp);
792 	}
793 	res = atomic_load_long(&fp->f_offset);
794 	sleepq_release(&fp->f_vnread_flags);
795 	return (res);
796 }
797 
798 void
799 foffset_unlock(struct file *fp, off_t val, int flags)
800 {
801 	volatile short *flagsp;
802 	short state;
803 
804 	KASSERT((flags & FOF_OFFSET) == 0, ("FOF_OFFSET passed"));
805 
806 	if ((flags & FOF_NOUPDATE) == 0)
807 		atomic_store_long(&fp->f_offset, val);
808 	if ((flags & FOF_NEXTOFF_R) != 0)
809 		fp->f_nextoff[UIO_READ] = val;
810 	if ((flags & FOF_NEXTOFF_W) != 0)
811 		fp->f_nextoff[UIO_WRITE] = val;
812 
813 	if ((flags & FOF_NOLOCK) != 0)
814 		return;
815 
816 	flagsp = &fp->f_vnread_flags;
817 	state = atomic_load_16(flagsp);
818 	if ((state & FOFFSET_LOCK_WAITING) == 0 &&
819 	    atomic_cmpset_rel_16(flagsp, state, 0))
820 		return;
821 
822 	sleepq_lock(&fp->f_vnread_flags);
823 	MPASS((fp->f_vnread_flags & FOFFSET_LOCKED) != 0);
824 	MPASS((fp->f_vnread_flags & FOFFSET_LOCK_WAITING) != 0);
825 	fp->f_vnread_flags = 0;
826 	sleepq_broadcast(&fp->f_vnread_flags, SLEEPQ_SLEEP, 0, 0);
827 	sleepq_release(&fp->f_vnread_flags);
828 }
829 
830 static off_t
831 foffset_read(struct file *fp)
832 {
833 
834 	return (atomic_load_long(&fp->f_offset));
835 }
836 #else
837 off_t
838 foffset_lock(struct file *fp, int flags)
839 {
840 	struct mtx *mtxp;
841 	off_t res;
842 
843 	KASSERT((flags & FOF_OFFSET) == 0, ("FOF_OFFSET passed"));
844 
845 	mtxp = mtx_pool_find(mtxpool_sleep, fp);
846 	mtx_lock(mtxp);
847 	if ((flags & FOF_NOLOCK) == 0) {
848 		while (fp->f_vnread_flags & FOFFSET_LOCKED) {
849 			fp->f_vnread_flags |= FOFFSET_LOCK_WAITING;
850 			msleep(&fp->f_vnread_flags, mtxp, PUSER -1,
851 			    "vofflock", 0);
852 		}
853 		fp->f_vnread_flags |= FOFFSET_LOCKED;
854 	}
855 	res = fp->f_offset;
856 	mtx_unlock(mtxp);
857 	return (res);
858 }
859 
860 void
861 foffset_unlock(struct file *fp, off_t val, int flags)
862 {
863 	struct mtx *mtxp;
864 
865 	KASSERT((flags & FOF_OFFSET) == 0, ("FOF_OFFSET passed"));
866 
867 	mtxp = mtx_pool_find(mtxpool_sleep, fp);
868 	mtx_lock(mtxp);
869 	if ((flags & FOF_NOUPDATE) == 0)
870 		fp->f_offset = val;
871 	if ((flags & FOF_NEXTOFF_R) != 0)
872 		fp->f_nextoff[UIO_READ] = val;
873 	if ((flags & FOF_NEXTOFF_W) != 0)
874 		fp->f_nextoff[UIO_WRITE] = val;
875 	if ((flags & FOF_NOLOCK) == 0) {
876 		KASSERT((fp->f_vnread_flags & FOFFSET_LOCKED) != 0,
877 		    ("Lost FOFFSET_LOCKED"));
878 		if (fp->f_vnread_flags & FOFFSET_LOCK_WAITING)
879 			wakeup(&fp->f_vnread_flags);
880 		fp->f_vnread_flags = 0;
881 	}
882 	mtx_unlock(mtxp);
883 }
884 
885 static off_t
886 foffset_read(struct file *fp)
887 {
888 
889 	return (foffset_lock(fp, FOF_NOLOCK));
890 }
891 #endif
892 
893 void
894 foffset_lock_uio(struct file *fp, struct uio *uio, int flags)
895 {
896 
897 	if ((flags & FOF_OFFSET) == 0)
898 		uio->uio_offset = foffset_lock(fp, flags);
899 }
900 
901 void
902 foffset_unlock_uio(struct file *fp, struct uio *uio, int flags)
903 {
904 
905 	if ((flags & FOF_OFFSET) == 0)
906 		foffset_unlock(fp, uio->uio_offset, flags);
907 }
908 
909 static int
910 get_advice(struct file *fp, struct uio *uio)
911 {
912 	struct mtx *mtxp;
913 	int ret;
914 
915 	ret = POSIX_FADV_NORMAL;
916 	if (fp->f_advice == NULL || fp->f_vnode->v_type != VREG)
917 		return (ret);
918 
919 	mtxp = mtx_pool_find(mtxpool_sleep, fp);
920 	mtx_lock(mtxp);
921 	if (fp->f_advice != NULL &&
922 	    uio->uio_offset >= fp->f_advice->fa_start &&
923 	    uio->uio_offset + uio->uio_resid <= fp->f_advice->fa_end)
924 		ret = fp->f_advice->fa_advice;
925 	mtx_unlock(mtxp);
926 	return (ret);
927 }
928 
929 static int
930 get_write_ioflag(struct file *fp)
931 {
932 	int ioflag;
933 	struct mount *mp;
934 	struct vnode *vp;
935 
936 	ioflag = 0;
937 	vp = fp->f_vnode;
938 	mp = atomic_load_ptr(&vp->v_mount);
939 
940 	if ((fp->f_flag & O_DIRECT) != 0)
941 		ioflag |= IO_DIRECT;
942 
943 	if ((fp->f_flag & O_FSYNC) != 0 ||
944 	    (mp != NULL && (mp->mnt_flag & MNT_SYNCHRONOUS) != 0))
945 		ioflag |= IO_SYNC;
946 
947 	/*
948 	 * For O_DSYNC we set both IO_SYNC and IO_DATASYNC, so that VOP_WRITE()
949 	 * or VOP_DEALLOCATE() implementations that don't understand IO_DATASYNC
950 	 * fall back to full O_SYNC behavior.
951 	 */
952 	if ((fp->f_flag & O_DSYNC) != 0)
953 		ioflag |= IO_SYNC | IO_DATASYNC;
954 
955 	return (ioflag);
956 }
957 
958 int
959 vn_read_from_obj(struct vnode *vp, struct uio *uio)
960 {
961 	vm_object_t obj;
962 	vm_page_t ma[io_hold_cnt + 2];
963 	off_t off, vsz;
964 	ssize_t resid;
965 	int error, i, j;
966 
967 	MPASS(uio->uio_resid <= ptoa(io_hold_cnt + 2));
968 	obj = atomic_load_ptr(&vp->v_object);
969 	if (obj == NULL)
970 		return (EJUSTRETURN);
971 
972 	/*
973 	 * Depends on type stability of vm_objects.
974 	 */
975 	vm_object_pip_add(obj, 1);
976 	if ((obj->flags & OBJ_DEAD) != 0) {
977 		/*
978 		 * Note that object might be already reused from the
979 		 * vnode, and the OBJ_DEAD flag cleared.  This is fine,
980 		 * we recheck for DOOMED vnode state after all pages
981 		 * are busied, and retract then.
982 		 *
983 		 * But we check for OBJ_DEAD to ensure that we do not
984 		 * busy pages while vm_object_terminate_pages()
985 		 * processes the queue.
986 		 */
987 		error = EJUSTRETURN;
988 		goto out_pip;
989 	}
990 
991 	resid = uio->uio_resid;
992 	off = uio->uio_offset;
993 	for (i = 0; resid > 0; i++) {
994 		MPASS(i < io_hold_cnt + 2);
995 		ma[i] = vm_page_grab_unlocked(obj, atop(off),
996 		    VM_ALLOC_NOCREAT | VM_ALLOC_SBUSY | VM_ALLOC_IGN_SBUSY |
997 		    VM_ALLOC_NOWAIT);
998 		if (ma[i] == NULL)
999 			break;
1000 
1001 		/*
1002 		 * Skip invalid pages.  Valid mask can be partial only
1003 		 * at EOF, and we clip later.
1004 		 */
1005 		if (vm_page_none_valid(ma[i])) {
1006 			vm_page_sunbusy(ma[i]);
1007 			break;
1008 		}
1009 
1010 		resid -= PAGE_SIZE;
1011 		off += PAGE_SIZE;
1012 	}
1013 	if (i == 0) {
1014 		error = EJUSTRETURN;
1015 		goto out_pip;
1016 	}
1017 
1018 	/*
1019 	 * Check VIRF_DOOMED after we busied our pages.  Since
1020 	 * vgonel() terminates the vnode' vm_object, it cannot
1021 	 * process past pages busied by us.
1022 	 */
1023 	if (VN_IS_DOOMED(vp)) {
1024 		error = EJUSTRETURN;
1025 		goto out;
1026 	}
1027 
1028 	resid = PAGE_SIZE - (uio->uio_offset & PAGE_MASK) + ptoa(i - 1);
1029 	if (resid > uio->uio_resid)
1030 		resid = uio->uio_resid;
1031 
1032 	/*
1033 	 * Unlocked read of vnp_size is safe because truncation cannot
1034 	 * pass busied page.  But we load vnp_size into a local
1035 	 * variable so that possible concurrent extension does not
1036 	 * break calculation.
1037 	 */
1038 #if defined(__powerpc__) && !defined(__powerpc64__)
1039 	vsz = obj->un_pager.vnp.vnp_size;
1040 #else
1041 	vsz = atomic_load_64(&obj->un_pager.vnp.vnp_size);
1042 #endif
1043 	if (uio->uio_offset >= vsz) {
1044 		error = EJUSTRETURN;
1045 		goto out;
1046 	}
1047 	if (uio->uio_offset + resid > vsz)
1048 		resid = vsz - uio->uio_offset;
1049 
1050 	error = vn_io_fault_pgmove(ma, uio->uio_offset & PAGE_MASK, resid, uio);
1051 
1052 out:
1053 	for (j = 0; j < i; j++) {
1054 		if (error == 0)
1055 			vm_page_reference(ma[j]);
1056 		vm_page_sunbusy(ma[j]);
1057 	}
1058 out_pip:
1059 	vm_object_pip_wakeup(obj);
1060 	if (error != 0)
1061 		return (error);
1062 	return (uio->uio_resid == 0 ? 0 : EJUSTRETURN);
1063 }
1064 
1065 /*
1066  * File table vnode read routine.
1067  */
1068 static int
1069 vn_read(struct file *fp, struct uio *uio, struct ucred *active_cred, int flags,
1070     struct thread *td)
1071 {
1072 	struct vnode *vp;
1073 	off_t orig_offset;
1074 	int error, ioflag;
1075 	int advice;
1076 
1077 	KASSERT(uio->uio_td == td, ("uio_td %p is not td %p",
1078 	    uio->uio_td, td));
1079 	KASSERT(flags & FOF_OFFSET, ("No FOF_OFFSET"));
1080 	vp = fp->f_vnode;
1081 	ioflag = 0;
1082 	if (fp->f_flag & FNONBLOCK)
1083 		ioflag |= IO_NDELAY;
1084 	if (fp->f_flag & O_DIRECT)
1085 		ioflag |= IO_DIRECT;
1086 
1087 	/*
1088 	 * Try to read from page cache.  VIRF_DOOMED check is racy but
1089 	 * allows us to avoid unneeded work outright.
1090 	 */
1091 	if (vn_io_pgcache_read_enable && !mac_vnode_check_read_enabled() &&
1092 	    (vn_irflag_read(vp) & (VIRF_DOOMED | VIRF_PGREAD)) == VIRF_PGREAD) {
1093 		error = VOP_READ_PGCACHE(vp, uio, ioflag, fp->f_cred);
1094 		if (error == 0) {
1095 			fp->f_nextoff[UIO_READ] = uio->uio_offset;
1096 			return (0);
1097 		}
1098 		if (error != EJUSTRETURN)
1099 			return (error);
1100 	}
1101 
1102 	advice = get_advice(fp, uio);
1103 	vn_lock(vp, LK_SHARED | LK_RETRY);
1104 
1105 	switch (advice) {
1106 	case POSIX_FADV_NORMAL:
1107 	case POSIX_FADV_SEQUENTIAL:
1108 	case POSIX_FADV_NOREUSE:
1109 		ioflag |= sequential_heuristic(uio, fp);
1110 		break;
1111 	case POSIX_FADV_RANDOM:
1112 		/* Disable read-ahead for random I/O. */
1113 		break;
1114 	}
1115 	orig_offset = uio->uio_offset;
1116 
1117 #ifdef MAC
1118 	error = mac_vnode_check_read(active_cred, fp->f_cred, vp);
1119 	if (error == 0)
1120 #endif
1121 		error = VOP_READ(vp, uio, ioflag, fp->f_cred);
1122 	fp->f_nextoff[UIO_READ] = uio->uio_offset;
1123 	VOP_UNLOCK(vp);
1124 	if (error == 0 && advice == POSIX_FADV_NOREUSE &&
1125 	    orig_offset != uio->uio_offset)
1126 		/*
1127 		 * Use POSIX_FADV_DONTNEED to flush pages and buffers
1128 		 * for the backing file after a POSIX_FADV_NOREUSE
1129 		 * read(2).
1130 		 */
1131 		error = VOP_ADVISE(vp, orig_offset, uio->uio_offset - 1,
1132 		    POSIX_FADV_DONTNEED);
1133 	return (error);
1134 }
1135 
1136 /*
1137  * File table vnode write routine.
1138  */
1139 static int
1140 vn_write(struct file *fp, struct uio *uio, struct ucred *active_cred, int flags,
1141     struct thread *td)
1142 {
1143 	struct vnode *vp;
1144 	struct mount *mp;
1145 	off_t orig_offset;
1146 	int error, ioflag;
1147 	int advice;
1148 	bool need_finished_write;
1149 
1150 	KASSERT(uio->uio_td == td, ("uio_td %p is not td %p",
1151 	    uio->uio_td, td));
1152 	KASSERT(flags & FOF_OFFSET, ("No FOF_OFFSET"));
1153 	vp = fp->f_vnode;
1154 	if (vp->v_type == VREG)
1155 		bwillwrite();
1156 	ioflag = IO_UNIT;
1157 	if (vp->v_type == VREG && (fp->f_flag & O_APPEND) != 0)
1158 		ioflag |= IO_APPEND;
1159 	if ((fp->f_flag & FNONBLOCK) != 0)
1160 		ioflag |= IO_NDELAY;
1161 	ioflag |= get_write_ioflag(fp);
1162 
1163 	mp = NULL;
1164 	need_finished_write = false;
1165 	if (vp->v_type != VCHR) {
1166 		error = vn_start_write(vp, &mp, V_WAIT | V_PCATCH);
1167 		if (error != 0)
1168 			goto unlock;
1169 		need_finished_write = true;
1170 	}
1171 
1172 	advice = get_advice(fp, uio);
1173 
1174 	vn_lock(vp, vn_lktype_write(mp, vp) | LK_RETRY);
1175 	switch (advice) {
1176 	case POSIX_FADV_NORMAL:
1177 	case POSIX_FADV_SEQUENTIAL:
1178 	case POSIX_FADV_NOREUSE:
1179 		ioflag |= sequential_heuristic(uio, fp);
1180 		break;
1181 	case POSIX_FADV_RANDOM:
1182 		/* XXX: Is this correct? */
1183 		break;
1184 	}
1185 	orig_offset = uio->uio_offset;
1186 
1187 #ifdef MAC
1188 	error = mac_vnode_check_write(active_cred, fp->f_cred, vp);
1189 	if (error == 0)
1190 #endif
1191 		error = VOP_WRITE(vp, uio, ioflag, fp->f_cred);
1192 	fp->f_nextoff[UIO_WRITE] = uio->uio_offset;
1193 	VOP_UNLOCK(vp);
1194 	if (need_finished_write)
1195 		vn_finished_write(mp);
1196 	if (error == 0 && advice == POSIX_FADV_NOREUSE &&
1197 	    orig_offset != uio->uio_offset)
1198 		/*
1199 		 * Use POSIX_FADV_DONTNEED to flush pages and buffers
1200 		 * for the backing file after a POSIX_FADV_NOREUSE
1201 		 * write(2).
1202 		 */
1203 		error = VOP_ADVISE(vp, orig_offset, uio->uio_offset - 1,
1204 		    POSIX_FADV_DONTNEED);
1205 unlock:
1206 	return (error);
1207 }
1208 
1209 /*
1210  * The vn_io_fault() is a wrapper around vn_read() and vn_write() to
1211  * prevent the following deadlock:
1212  *
1213  * Assume that the thread A reads from the vnode vp1 into userspace
1214  * buffer buf1 backed by the pages of vnode vp2.  If a page in buf1 is
1215  * currently not resident, then system ends up with the call chain
1216  *   vn_read() -> VOP_READ(vp1) -> uiomove() -> [Page Fault] ->
1217  *     vm_fault(buf1) -> vnode_pager_getpages(vp2) -> VOP_GETPAGES(vp2)
1218  * which establishes lock order vp1->vn_lock, then vp2->vn_lock.
1219  * If, at the same time, thread B reads from vnode vp2 into buffer buf2
1220  * backed by the pages of vnode vp1, and some page in buf2 is not
1221  * resident, we get a reversed order vp2->vn_lock, then vp1->vn_lock.
1222  *
1223  * To prevent the lock order reversal and deadlock, vn_io_fault() does
1224  * not allow page faults to happen during VOP_READ() or VOP_WRITE().
1225  * Instead, it first tries to do the whole range i/o with pagefaults
1226  * disabled. If all pages in the i/o buffer are resident and mapped,
1227  * VOP will succeed (ignoring the genuine filesystem errors).
1228  * Otherwise, we get back EFAULT, and vn_io_fault() falls back to do
1229  * i/o in chunks, with all pages in the chunk prefaulted and held
1230  * using vm_fault_quick_hold_pages().
1231  *
1232  * Filesystems using this deadlock avoidance scheme should use the
1233  * array of the held pages from uio, saved in the curthread->td_ma,
1234  * instead of doing uiomove().  A helper function
1235  * vn_io_fault_uiomove() converts uiomove request into
1236  * uiomove_fromphys() over td_ma array.
1237  *
1238  * Since vnode locks do not cover the whole i/o anymore, rangelocks
1239  * make the current i/o request atomic with respect to other i/os and
1240  * truncations.
1241  */
1242 
1243 /*
1244  * Decode vn_io_fault_args and perform the corresponding i/o.
1245  */
1246 static int
1247 vn_io_fault_doio(struct vn_io_fault_args *args, struct uio *uio,
1248     struct thread *td)
1249 {
1250 	int error, save;
1251 
1252 	error = 0;
1253 	save = vm_fault_disable_pagefaults();
1254 	switch (args->kind) {
1255 	case VN_IO_FAULT_FOP:
1256 		error = (args->args.fop_args.doio)(args->args.fop_args.fp,
1257 		    uio, args->cred, args->flags, td);
1258 		break;
1259 	case VN_IO_FAULT_VOP:
1260 		if (uio->uio_rw == UIO_READ) {
1261 			error = VOP_READ(args->args.vop_args.vp, uio,
1262 			    args->flags, args->cred);
1263 		} else if (uio->uio_rw == UIO_WRITE) {
1264 			error = VOP_WRITE(args->args.vop_args.vp, uio,
1265 			    args->flags, args->cred);
1266 		}
1267 		break;
1268 	default:
1269 		panic("vn_io_fault_doio: unknown kind of io %d %d",
1270 		    args->kind, uio->uio_rw);
1271 	}
1272 	vm_fault_enable_pagefaults(save);
1273 	return (error);
1274 }
1275 
1276 static int
1277 vn_io_fault_touch(char *base, const struct uio *uio)
1278 {
1279 	int r;
1280 
1281 	r = fubyte(base);
1282 	if (r == -1 || (uio->uio_rw == UIO_READ && subyte(base, r) == -1))
1283 		return (EFAULT);
1284 	return (0);
1285 }
1286 
1287 static int
1288 vn_io_fault_prefault_user(const struct uio *uio)
1289 {
1290 	char *base;
1291 	const struct iovec *iov;
1292 	size_t len;
1293 	ssize_t resid;
1294 	int error, i;
1295 
1296 	KASSERT(uio->uio_segflg == UIO_USERSPACE,
1297 	    ("vn_io_fault_prefault userspace"));
1298 
1299 	error = i = 0;
1300 	iov = uio->uio_iov;
1301 	resid = uio->uio_resid;
1302 	base = iov->iov_base;
1303 	len = iov->iov_len;
1304 	while (resid > 0) {
1305 		error = vn_io_fault_touch(base, uio);
1306 		if (error != 0)
1307 			break;
1308 		if (len < PAGE_SIZE) {
1309 			if (len != 0) {
1310 				error = vn_io_fault_touch(base + len - 1, uio);
1311 				if (error != 0)
1312 					break;
1313 				resid -= len;
1314 			}
1315 			if (++i >= uio->uio_iovcnt)
1316 				break;
1317 			iov = uio->uio_iov + i;
1318 			base = iov->iov_base;
1319 			len = iov->iov_len;
1320 		} else {
1321 			len -= PAGE_SIZE;
1322 			base += PAGE_SIZE;
1323 			resid -= PAGE_SIZE;
1324 		}
1325 	}
1326 	return (error);
1327 }
1328 
1329 /*
1330  * Common code for vn_io_fault(), agnostic to the kind of i/o request.
1331  * Uses vn_io_fault_doio() to make the call to an actual i/o function.
1332  * Used from vn_rdwr() and vn_io_fault(), which encode the i/o request
1333  * into args and call vn_io_fault1() to handle faults during the user
1334  * mode buffer accesses.
1335  */
1336 static int
1337 vn_io_fault1(struct vnode *vp, struct uio *uio, struct vn_io_fault_args *args,
1338     struct thread *td)
1339 {
1340 	vm_page_t ma[io_hold_cnt + 2];
1341 	struct uio *uio_clone, short_uio;
1342 	struct iovec short_iovec[1];
1343 	vm_page_t *prev_td_ma;
1344 	vm_prot_t prot;
1345 	vm_offset_t addr, end;
1346 	size_t len, resid;
1347 	ssize_t adv;
1348 	int error, cnt, saveheld, prev_td_ma_cnt;
1349 
1350 	if (vn_io_fault_prefault) {
1351 		error = vn_io_fault_prefault_user(uio);
1352 		if (error != 0)
1353 			return (error); /* Or ignore ? */
1354 	}
1355 
1356 	prot = uio->uio_rw == UIO_READ ? VM_PROT_WRITE : VM_PROT_READ;
1357 
1358 	/*
1359 	 * The UFS follows IO_UNIT directive and replays back both
1360 	 * uio_offset and uio_resid if an error is encountered during the
1361 	 * operation.  But, since the iovec may be already advanced,
1362 	 * uio is still in an inconsistent state.
1363 	 *
1364 	 * Cache a copy of the original uio, which is advanced to the redo
1365 	 * point using UIO_NOCOPY below.
1366 	 */
1367 	uio_clone = cloneuio(uio);
1368 	resid = uio->uio_resid;
1369 
1370 	short_uio.uio_segflg = UIO_USERSPACE;
1371 	short_uio.uio_rw = uio->uio_rw;
1372 	short_uio.uio_td = uio->uio_td;
1373 
1374 	error = vn_io_fault_doio(args, uio, td);
1375 	if (error != EFAULT)
1376 		goto out;
1377 
1378 	atomic_add_long(&vn_io_faults_cnt, 1);
1379 	uio_clone->uio_segflg = UIO_NOCOPY;
1380 	uiomove(NULL, resid - uio->uio_resid, uio_clone);
1381 	uio_clone->uio_segflg = uio->uio_segflg;
1382 
1383 	saveheld = curthread_pflags_set(TDP_UIOHELD);
1384 	prev_td_ma = td->td_ma;
1385 	prev_td_ma_cnt = td->td_ma_cnt;
1386 
1387 	while (uio_clone->uio_resid != 0) {
1388 		len = uio_clone->uio_iov->iov_len;
1389 		if (len == 0) {
1390 			KASSERT(uio_clone->uio_iovcnt >= 1,
1391 			    ("iovcnt underflow"));
1392 			uio_clone->uio_iov++;
1393 			uio_clone->uio_iovcnt--;
1394 			continue;
1395 		}
1396 		if (len > ptoa(io_hold_cnt))
1397 			len = ptoa(io_hold_cnt);
1398 		addr = (uintptr_t)uio_clone->uio_iov->iov_base;
1399 		end = round_page(addr + len);
1400 		if (end < addr) {
1401 			error = EFAULT;
1402 			break;
1403 		}
1404 		/*
1405 		 * A perfectly misaligned address and length could cause
1406 		 * both the start and the end of the chunk to use partial
1407 		 * page.  +2 accounts for such a situation.
1408 		 */
1409 		cnt = vm_fault_quick_hold_pages(&td->td_proc->p_vmspace->vm_map,
1410 		    addr, len, prot, ma, io_hold_cnt + 2);
1411 		if (cnt == -1) {
1412 			error = EFAULT;
1413 			break;
1414 		}
1415 		short_uio.uio_iov = &short_iovec[0];
1416 		short_iovec[0].iov_base = (void *)addr;
1417 		short_uio.uio_iovcnt = 1;
1418 		short_uio.uio_resid = short_iovec[0].iov_len = len;
1419 		short_uio.uio_offset = uio_clone->uio_offset;
1420 		td->td_ma = ma;
1421 		td->td_ma_cnt = cnt;
1422 
1423 		error = vn_io_fault_doio(args, &short_uio, td);
1424 		vm_page_unhold_pages(ma, cnt);
1425 		adv = len - short_uio.uio_resid;
1426 
1427 		uio_clone->uio_iov->iov_base =
1428 		    (char *)uio_clone->uio_iov->iov_base + adv;
1429 		uio_clone->uio_iov->iov_len -= adv;
1430 		uio_clone->uio_resid -= adv;
1431 		uio_clone->uio_offset += adv;
1432 
1433 		uio->uio_resid -= adv;
1434 		uio->uio_offset += adv;
1435 
1436 		if (error != 0 || adv == 0)
1437 			break;
1438 	}
1439 	td->td_ma = prev_td_ma;
1440 	td->td_ma_cnt = prev_td_ma_cnt;
1441 	curthread_pflags_restore(saveheld);
1442 out:
1443 	free(uio_clone, M_IOV);
1444 	return (error);
1445 }
1446 
1447 static int
1448 vn_io_fault(struct file *fp, struct uio *uio, struct ucred *active_cred,
1449     int flags, struct thread *td)
1450 {
1451 	fo_rdwr_t *doio;
1452 	struct vnode *vp;
1453 	void *rl_cookie;
1454 	struct vn_io_fault_args args;
1455 	int error;
1456 	bool do_io_fault, do_rangelock;
1457 
1458 	doio = uio->uio_rw == UIO_READ ? vn_read : vn_write;
1459 	vp = fp->f_vnode;
1460 
1461 	/*
1462 	 * The ability to read(2) on a directory has historically been
1463 	 * allowed for all users, but this can and has been the source of
1464 	 * at least one security issue in the past.  As such, it is now hidden
1465 	 * away behind a sysctl for those that actually need it to use it, and
1466 	 * restricted to root when it's turned on to make it relatively safe to
1467 	 * leave on for longer sessions of need.
1468 	 */
1469 	if (vp->v_type == VDIR) {
1470 		KASSERT(uio->uio_rw == UIO_READ,
1471 		    ("illegal write attempted on a directory"));
1472 		if (!vfs_allow_read_dir)
1473 			return (EISDIR);
1474 		if ((error = priv_check(td, PRIV_VFS_READ_DIR)) != 0)
1475 			return (EISDIR);
1476 	}
1477 
1478 	do_io_fault = do_vn_io_fault(vp, uio);
1479 	do_rangelock = do_io_fault || (vn_irflag_read(vp) & VIRF_PGREAD) != 0;
1480 	foffset_lock_uio(fp, uio, flags);
1481 	if (do_rangelock) {
1482 		if (uio->uio_rw == UIO_READ) {
1483 			rl_cookie = vn_rangelock_rlock(vp, uio->uio_offset,
1484 			    uio->uio_offset + uio->uio_resid);
1485 		} else if ((fp->f_flag & O_APPEND) != 0 ||
1486 		    (flags & FOF_OFFSET) == 0) {
1487 			/* For appenders, punt and lock the whole range. */
1488 			rl_cookie = vn_rangelock_wlock(vp, 0, OFF_MAX);
1489 		} else {
1490 			rl_cookie = vn_rangelock_wlock(vp, uio->uio_offset,
1491 			    uio->uio_offset + uio->uio_resid);
1492 		}
1493 	}
1494 	if (do_io_fault) {
1495 		args.kind = VN_IO_FAULT_FOP;
1496 		args.args.fop_args.fp = fp;
1497 		args.args.fop_args.doio = doio;
1498 		args.cred = active_cred;
1499 		args.flags = flags | FOF_OFFSET;
1500 		error = vn_io_fault1(vp, uio, &args, td);
1501 	} else {
1502 		error = doio(fp, uio, active_cred, flags | FOF_OFFSET, td);
1503 	}
1504 	if (do_rangelock)
1505 		vn_rangelock_unlock(vp, rl_cookie);
1506 	foffset_unlock_uio(fp, uio, flags);
1507 	return (error);
1508 }
1509 
1510 /*
1511  * Helper function to perform the requested uiomove operation using
1512  * the held pages for io->uio_iov[0].iov_base buffer instead of
1513  * copyin/copyout.  Access to the pages with uiomove_fromphys()
1514  * instead of iov_base prevents page faults that could occur due to
1515  * pmap_collect() invalidating the mapping created by
1516  * vm_fault_quick_hold_pages(), or pageout daemon, page laundry or
1517  * object cleanup revoking the write access from page mappings.
1518  *
1519  * Filesystems specified MNTK_NO_IOPF shall use vn_io_fault_uiomove()
1520  * instead of plain uiomove().
1521  */
1522 int
1523 vn_io_fault_uiomove(char *data, int xfersize, struct uio *uio)
1524 {
1525 	struct uio transp_uio;
1526 	struct iovec transp_iov[1];
1527 	struct thread *td;
1528 	size_t adv;
1529 	int error, pgadv;
1530 
1531 	td = curthread;
1532 	if ((td->td_pflags & TDP_UIOHELD) == 0 ||
1533 	    uio->uio_segflg != UIO_USERSPACE)
1534 		return (uiomove(data, xfersize, uio));
1535 
1536 	KASSERT(uio->uio_iovcnt == 1, ("uio_iovcnt %d", uio->uio_iovcnt));
1537 	transp_iov[0].iov_base = data;
1538 	transp_uio.uio_iov = &transp_iov[0];
1539 	transp_uio.uio_iovcnt = 1;
1540 	if (xfersize > uio->uio_resid)
1541 		xfersize = uio->uio_resid;
1542 	transp_uio.uio_resid = transp_iov[0].iov_len = xfersize;
1543 	transp_uio.uio_offset = 0;
1544 	transp_uio.uio_segflg = UIO_SYSSPACE;
1545 	/*
1546 	 * Since transp_iov points to data, and td_ma page array
1547 	 * corresponds to original uio->uio_iov, we need to invert the
1548 	 * direction of the i/o operation as passed to
1549 	 * uiomove_fromphys().
1550 	 */
1551 	switch (uio->uio_rw) {
1552 	case UIO_WRITE:
1553 		transp_uio.uio_rw = UIO_READ;
1554 		break;
1555 	case UIO_READ:
1556 		transp_uio.uio_rw = UIO_WRITE;
1557 		break;
1558 	}
1559 	transp_uio.uio_td = uio->uio_td;
1560 	error = uiomove_fromphys(td->td_ma,
1561 	    ((vm_offset_t)uio->uio_iov->iov_base) & PAGE_MASK,
1562 	    xfersize, &transp_uio);
1563 	adv = xfersize - transp_uio.uio_resid;
1564 	pgadv =
1565 	    (((vm_offset_t)uio->uio_iov->iov_base + adv) >> PAGE_SHIFT) -
1566 	    (((vm_offset_t)uio->uio_iov->iov_base) >> PAGE_SHIFT);
1567 	td->td_ma += pgadv;
1568 	KASSERT(td->td_ma_cnt >= pgadv, ("consumed pages %d %d", td->td_ma_cnt,
1569 	    pgadv));
1570 	td->td_ma_cnt -= pgadv;
1571 	uio->uio_iov->iov_base = (char *)uio->uio_iov->iov_base + adv;
1572 	uio->uio_iov->iov_len -= adv;
1573 	uio->uio_resid -= adv;
1574 	uio->uio_offset += adv;
1575 	return (error);
1576 }
1577 
1578 int
1579 vn_io_fault_pgmove(vm_page_t ma[], vm_offset_t offset, int xfersize,
1580     struct uio *uio)
1581 {
1582 	struct thread *td;
1583 	vm_offset_t iov_base;
1584 	int cnt, pgadv;
1585 
1586 	td = curthread;
1587 	if ((td->td_pflags & TDP_UIOHELD) == 0 ||
1588 	    uio->uio_segflg != UIO_USERSPACE)
1589 		return (uiomove_fromphys(ma, offset, xfersize, uio));
1590 
1591 	KASSERT(uio->uio_iovcnt == 1, ("uio_iovcnt %d", uio->uio_iovcnt));
1592 	cnt = xfersize > uio->uio_resid ? uio->uio_resid : xfersize;
1593 	iov_base = (vm_offset_t)uio->uio_iov->iov_base;
1594 	switch (uio->uio_rw) {
1595 	case UIO_WRITE:
1596 		pmap_copy_pages(td->td_ma, iov_base & PAGE_MASK, ma,
1597 		    offset, cnt);
1598 		break;
1599 	case UIO_READ:
1600 		pmap_copy_pages(ma, offset, td->td_ma, iov_base & PAGE_MASK,
1601 		    cnt);
1602 		break;
1603 	}
1604 	pgadv = ((iov_base + cnt) >> PAGE_SHIFT) - (iov_base >> PAGE_SHIFT);
1605 	td->td_ma += pgadv;
1606 	KASSERT(td->td_ma_cnt >= pgadv, ("consumed pages %d %d", td->td_ma_cnt,
1607 	    pgadv));
1608 	td->td_ma_cnt -= pgadv;
1609 	uio->uio_iov->iov_base = (char *)(iov_base + cnt);
1610 	uio->uio_iov->iov_len -= cnt;
1611 	uio->uio_resid -= cnt;
1612 	uio->uio_offset += cnt;
1613 	return (0);
1614 }
1615 
1616 /*
1617  * File table truncate routine.
1618  */
1619 static int
1620 vn_truncate(struct file *fp, off_t length, struct ucred *active_cred,
1621     struct thread *td)
1622 {
1623 	struct mount *mp;
1624 	struct vnode *vp;
1625 	void *rl_cookie;
1626 	int error;
1627 
1628 	vp = fp->f_vnode;
1629 
1630 retry:
1631 	/*
1632 	 * Lock the whole range for truncation.  Otherwise split i/o
1633 	 * might happen partly before and partly after the truncation.
1634 	 */
1635 	rl_cookie = vn_rangelock_wlock(vp, 0, OFF_MAX);
1636 	error = vn_start_write(vp, &mp, V_WAIT | V_PCATCH);
1637 	if (error)
1638 		goto out1;
1639 	vn_lock(vp, LK_EXCLUSIVE | LK_RETRY);
1640 	AUDIT_ARG_VNODE1(vp);
1641 	if (vp->v_type == VDIR) {
1642 		error = EISDIR;
1643 		goto out;
1644 	}
1645 #ifdef MAC
1646 	error = mac_vnode_check_write(active_cred, fp->f_cred, vp);
1647 	if (error)
1648 		goto out;
1649 #endif
1650 	error = vn_truncate_locked(vp, length, (fp->f_flag & O_FSYNC) != 0,
1651 	    fp->f_cred);
1652 out:
1653 	VOP_UNLOCK(vp);
1654 	vn_finished_write(mp);
1655 out1:
1656 	vn_rangelock_unlock(vp, rl_cookie);
1657 	if (error == ERELOOKUP)
1658 		goto retry;
1659 	return (error);
1660 }
1661 
1662 /*
1663  * Truncate a file that is already locked.
1664  */
1665 int
1666 vn_truncate_locked(struct vnode *vp, off_t length, bool sync,
1667     struct ucred *cred)
1668 {
1669 	struct vattr vattr;
1670 	int error;
1671 
1672 	error = VOP_ADD_WRITECOUNT(vp, 1);
1673 	if (error == 0) {
1674 		VATTR_NULL(&vattr);
1675 		vattr.va_size = length;
1676 		if (sync)
1677 			vattr.va_vaflags |= VA_SYNC;
1678 		error = VOP_SETATTR(vp, &vattr, cred);
1679 		VOP_ADD_WRITECOUNT_CHECKED(vp, -1);
1680 	}
1681 	return (error);
1682 }
1683 
1684 /*
1685  * File table vnode stat routine.
1686  */
1687 int
1688 vn_statfile(struct file *fp, struct stat *sb, struct ucred *active_cred)
1689 {
1690 	struct vnode *vp = fp->f_vnode;
1691 	int error;
1692 
1693 	vn_lock(vp, LK_SHARED | LK_RETRY);
1694 	error = VOP_STAT(vp, sb, active_cred, fp->f_cred);
1695 	VOP_UNLOCK(vp);
1696 
1697 	return (error);
1698 }
1699 
1700 /*
1701  * File table vnode ioctl routine.
1702  */
1703 static int
1704 vn_ioctl(struct file *fp, u_long com, void *data, struct ucred *active_cred,
1705     struct thread *td)
1706 {
1707 	struct vnode *vp;
1708 	struct fiobmap2_arg *bmarg;
1709 	off_t size;
1710 	int error;
1711 
1712 	vp = fp->f_vnode;
1713 	switch (vp->v_type) {
1714 	case VDIR:
1715 	case VREG:
1716 		switch (com) {
1717 		case FIONREAD:
1718 			error = vn_getsize(vp, &size, active_cred);
1719 			if (error == 0)
1720 				*(int *)data = size - fp->f_offset;
1721 			return (error);
1722 		case FIOBMAP2:
1723 			bmarg = (struct fiobmap2_arg *)data;
1724 			vn_lock(vp, LK_SHARED | LK_RETRY);
1725 #ifdef MAC
1726 			error = mac_vnode_check_read(active_cred, fp->f_cred,
1727 			    vp);
1728 			if (error == 0)
1729 #endif
1730 				error = VOP_BMAP(vp, bmarg->bn, NULL,
1731 				    &bmarg->bn, &bmarg->runp, &bmarg->runb);
1732 			VOP_UNLOCK(vp);
1733 			return (error);
1734 		case FIONBIO:
1735 		case FIOASYNC:
1736 			return (0);
1737 		default:
1738 			return (VOP_IOCTL(vp, com, data, fp->f_flag,
1739 			    active_cred, td));
1740 		}
1741 		break;
1742 	case VCHR:
1743 		return (VOP_IOCTL(vp, com, data, fp->f_flag,
1744 		    active_cred, td));
1745 	default:
1746 		return (ENOTTY);
1747 	}
1748 }
1749 
1750 /*
1751  * File table vnode poll routine.
1752  */
1753 static int
1754 vn_poll(struct file *fp, int events, struct ucred *active_cred,
1755     struct thread *td)
1756 {
1757 	struct vnode *vp;
1758 	int error;
1759 
1760 	vp = fp->f_vnode;
1761 #if defined(MAC) || defined(AUDIT)
1762 	if (AUDITING_TD(td) || mac_vnode_check_poll_enabled()) {
1763 		vn_lock(vp, LK_EXCLUSIVE | LK_RETRY);
1764 		AUDIT_ARG_VNODE1(vp);
1765 		error = mac_vnode_check_poll(active_cred, fp->f_cred, vp);
1766 		VOP_UNLOCK(vp);
1767 		if (error != 0)
1768 			return (error);
1769 	}
1770 #endif
1771 	error = VOP_POLL(vp, events, fp->f_cred, td);
1772 	return (error);
1773 }
1774 
1775 /*
1776  * Acquire the requested lock and then check for validity.  LK_RETRY
1777  * permits vn_lock to return doomed vnodes.
1778  */
1779 static int __noinline
1780 _vn_lock_fallback(struct vnode *vp, int flags, const char *file, int line,
1781     int error)
1782 {
1783 
1784 	KASSERT((flags & LK_RETRY) == 0 || error == 0,
1785 	    ("vn_lock: error %d incompatible with flags %#x", error, flags));
1786 
1787 	if (error == 0)
1788 		VNASSERT(VN_IS_DOOMED(vp), vp, ("vnode not doomed"));
1789 
1790 	if ((flags & LK_RETRY) == 0) {
1791 		if (error == 0) {
1792 			VOP_UNLOCK(vp);
1793 			error = ENOENT;
1794 		}
1795 		return (error);
1796 	}
1797 
1798 	/*
1799 	 * LK_RETRY case.
1800 	 *
1801 	 * Nothing to do if we got the lock.
1802 	 */
1803 	if (error == 0)
1804 		return (0);
1805 
1806 	/*
1807 	 * Interlock was dropped by the call in _vn_lock.
1808 	 */
1809 	flags &= ~LK_INTERLOCK;
1810 	do {
1811 		error = VOP_LOCK1(vp, flags, file, line);
1812 	} while (error != 0);
1813 	return (0);
1814 }
1815 
1816 int
1817 _vn_lock(struct vnode *vp, int flags, const char *file, int line)
1818 {
1819 	int error;
1820 
1821 	VNASSERT((flags & LK_TYPE_MASK) != 0, vp,
1822 	    ("vn_lock: no locktype (%d passed)", flags));
1823 	VNPASS(vp->v_holdcnt > 0, vp);
1824 	error = VOP_LOCK1(vp, flags, file, line);
1825 	if (__predict_false(error != 0 || VN_IS_DOOMED(vp)))
1826 		return (_vn_lock_fallback(vp, flags, file, line, error));
1827 	return (0);
1828 }
1829 
1830 /*
1831  * File table vnode close routine.
1832  */
1833 static int
1834 vn_closefile(struct file *fp, struct thread *td)
1835 {
1836 	struct vnode *vp;
1837 	struct flock lf;
1838 	int error;
1839 	bool ref;
1840 
1841 	vp = fp->f_vnode;
1842 	fp->f_ops = &badfileops;
1843 	ref = (fp->f_flag & FHASLOCK) != 0;
1844 
1845 	error = vn_close1(vp, fp->f_flag, fp->f_cred, td, ref);
1846 
1847 	if (__predict_false(ref)) {
1848 		lf.l_whence = SEEK_SET;
1849 		lf.l_start = 0;
1850 		lf.l_len = 0;
1851 		lf.l_type = F_UNLCK;
1852 		(void) VOP_ADVLOCK(vp, fp, F_UNLCK, &lf, F_FLOCK);
1853 		vrele(vp);
1854 	}
1855 	return (error);
1856 }
1857 
1858 /*
1859  * Preparing to start a filesystem write operation. If the operation is
1860  * permitted, then we bump the count of operations in progress and
1861  * proceed. If a suspend request is in progress, we wait until the
1862  * suspension is over, and then proceed.
1863  */
1864 static int
1865 vn_start_write_refed(struct mount *mp, int flags, bool mplocked)
1866 {
1867 	struct mount_pcpu *mpcpu;
1868 	int error, mflags;
1869 
1870 	if (__predict_true(!mplocked) && (flags & V_XSLEEP) == 0 &&
1871 	    vfs_op_thread_enter(mp, mpcpu)) {
1872 		MPASS((mp->mnt_kern_flag & MNTK_SUSPEND) == 0);
1873 		vfs_mp_count_add_pcpu(mpcpu, writeopcount, 1);
1874 		vfs_op_thread_exit(mp, mpcpu);
1875 		return (0);
1876 	}
1877 
1878 	if (mplocked)
1879 		mtx_assert(MNT_MTX(mp), MA_OWNED);
1880 	else
1881 		MNT_ILOCK(mp);
1882 
1883 	error = 0;
1884 
1885 	/*
1886 	 * Check on status of suspension.
1887 	 */
1888 	if ((curthread->td_pflags & TDP_IGNSUSP) == 0 ||
1889 	    mp->mnt_susp_owner != curthread) {
1890 		mflags = 0;
1891 		if ((mp->mnt_vfc->vfc_flags & VFCF_SBDRY) != 0) {
1892 			if (flags & V_PCATCH)
1893 				mflags |= PCATCH;
1894 		}
1895 		mflags |= (PUSER - 1);
1896 		while ((mp->mnt_kern_flag & MNTK_SUSPEND) != 0) {
1897 			if ((flags & V_NOWAIT) != 0) {
1898 				error = EWOULDBLOCK;
1899 				goto unlock;
1900 			}
1901 			error = msleep(&mp->mnt_flag, MNT_MTX(mp), mflags,
1902 			    "suspfs", 0);
1903 			if (error != 0)
1904 				goto unlock;
1905 		}
1906 	}
1907 	if ((flags & V_XSLEEP) != 0)
1908 		goto unlock;
1909 	mp->mnt_writeopcount++;
1910 unlock:
1911 	if (error != 0 || (flags & V_XSLEEP) != 0)
1912 		MNT_REL(mp);
1913 	MNT_IUNLOCK(mp);
1914 	return (error);
1915 }
1916 
1917 int
1918 vn_start_write(struct vnode *vp, struct mount **mpp, int flags)
1919 {
1920 	struct mount *mp;
1921 	int error;
1922 
1923 	KASSERT((flags & ~V_VALID_FLAGS) == 0,
1924 	    ("%s: invalid flags passed %d\n", __func__, flags));
1925 
1926 	error = 0;
1927 	/*
1928 	 * If a vnode is provided, get and return the mount point that
1929 	 * to which it will write.
1930 	 */
1931 	if (vp != NULL) {
1932 		if ((error = VOP_GETWRITEMOUNT(vp, mpp)) != 0) {
1933 			*mpp = NULL;
1934 			if (error != EOPNOTSUPP)
1935 				return (error);
1936 			return (0);
1937 		}
1938 	}
1939 	if ((mp = *mpp) == NULL)
1940 		return (0);
1941 
1942 	/*
1943 	 * VOP_GETWRITEMOUNT() returns with the mp refcount held through
1944 	 * a vfs_ref().
1945 	 * As long as a vnode is not provided we need to acquire a
1946 	 * refcount for the provided mountpoint too, in order to
1947 	 * emulate a vfs_ref().
1948 	 */
1949 	if (vp == NULL)
1950 		vfs_ref(mp);
1951 
1952 	error = vn_start_write_refed(mp, flags, false);
1953 	if (error != 0 && (flags & V_NOWAIT) == 0)
1954 		*mpp = NULL;
1955 	return (error);
1956 }
1957 
1958 /*
1959  * Secondary suspension. Used by operations such as vop_inactive
1960  * routines that are needed by the higher level functions. These
1961  * are allowed to proceed until all the higher level functions have
1962  * completed (indicated by mnt_writeopcount dropping to zero). At that
1963  * time, these operations are halted until the suspension is over.
1964  */
1965 int
1966 vn_start_secondary_write(struct vnode *vp, struct mount **mpp, int flags)
1967 {
1968 	struct mount *mp;
1969 	int error, mflags;
1970 
1971 	KASSERT((flags & (~V_VALID_FLAGS | V_XSLEEP)) == 0,
1972 	    ("%s: invalid flags passed %d\n", __func__, flags));
1973 
1974  retry:
1975 	if (vp != NULL) {
1976 		if ((error = VOP_GETWRITEMOUNT(vp, mpp)) != 0) {
1977 			*mpp = NULL;
1978 			if (error != EOPNOTSUPP)
1979 				return (error);
1980 			return (0);
1981 		}
1982 	}
1983 	/*
1984 	 * If we are not suspended or have not yet reached suspended
1985 	 * mode, then let the operation proceed.
1986 	 */
1987 	if ((mp = *mpp) == NULL)
1988 		return (0);
1989 
1990 	/*
1991 	 * VOP_GETWRITEMOUNT() returns with the mp refcount held through
1992 	 * a vfs_ref().
1993 	 * As long as a vnode is not provided we need to acquire a
1994 	 * refcount for the provided mountpoint too, in order to
1995 	 * emulate a vfs_ref().
1996 	 */
1997 	MNT_ILOCK(mp);
1998 	if (vp == NULL)
1999 		MNT_REF(mp);
2000 	if ((mp->mnt_kern_flag & (MNTK_SUSPENDED | MNTK_SUSPEND2)) == 0) {
2001 		mp->mnt_secondary_writes++;
2002 		mp->mnt_secondary_accwrites++;
2003 		MNT_IUNLOCK(mp);
2004 		return (0);
2005 	}
2006 	if ((flags & V_NOWAIT) != 0) {
2007 		MNT_REL(mp);
2008 		MNT_IUNLOCK(mp);
2009 		*mpp = NULL;
2010 		return (EWOULDBLOCK);
2011 	}
2012 	/*
2013 	 * Wait for the suspension to finish.
2014 	 */
2015 	mflags = 0;
2016 	if ((mp->mnt_vfc->vfc_flags & VFCF_SBDRY) != 0) {
2017 		if ((flags & V_PCATCH) != 0)
2018 			mflags |= PCATCH;
2019 	}
2020 	mflags |= (PUSER - 1) | PDROP;
2021 	error = msleep(&mp->mnt_flag, MNT_MTX(mp), mflags, "suspfs", 0);
2022 	vfs_rel(mp);
2023 	if (error == 0)
2024 		goto retry;
2025 	*mpp = NULL;
2026 	return (error);
2027 }
2028 
2029 /*
2030  * Filesystem write operation has completed. If we are suspending and this
2031  * operation is the last one, notify the suspender that the suspension is
2032  * now in effect.
2033  */
2034 void
2035 vn_finished_write(struct mount *mp)
2036 {
2037 	struct mount_pcpu *mpcpu;
2038 	int c;
2039 
2040 	if (mp == NULL)
2041 		return;
2042 
2043 	if (vfs_op_thread_enter(mp, mpcpu)) {
2044 		vfs_mp_count_sub_pcpu(mpcpu, writeopcount, 1);
2045 		vfs_mp_count_sub_pcpu(mpcpu, ref, 1);
2046 		vfs_op_thread_exit(mp, mpcpu);
2047 		return;
2048 	}
2049 
2050 	MNT_ILOCK(mp);
2051 	vfs_assert_mount_counters(mp);
2052 	MNT_REL(mp);
2053 	c = --mp->mnt_writeopcount;
2054 	if (mp->mnt_vfs_ops == 0) {
2055 		MPASS((mp->mnt_kern_flag & MNTK_SUSPEND) == 0);
2056 		MNT_IUNLOCK(mp);
2057 		return;
2058 	}
2059 	if (c < 0)
2060 		vfs_dump_mount_counters(mp);
2061 	if ((mp->mnt_kern_flag & MNTK_SUSPEND) != 0 && c == 0)
2062 		wakeup(&mp->mnt_writeopcount);
2063 	MNT_IUNLOCK(mp);
2064 }
2065 
2066 /*
2067  * Filesystem secondary write operation has completed. If we are
2068  * suspending and this operation is the last one, notify the suspender
2069  * that the suspension is now in effect.
2070  */
2071 void
2072 vn_finished_secondary_write(struct mount *mp)
2073 {
2074 	if (mp == NULL)
2075 		return;
2076 	MNT_ILOCK(mp);
2077 	MNT_REL(mp);
2078 	mp->mnt_secondary_writes--;
2079 	if (mp->mnt_secondary_writes < 0)
2080 		panic("vn_finished_secondary_write: neg cnt");
2081 	if ((mp->mnt_kern_flag & MNTK_SUSPEND) != 0 &&
2082 	    mp->mnt_secondary_writes <= 0)
2083 		wakeup(&mp->mnt_secondary_writes);
2084 	MNT_IUNLOCK(mp);
2085 }
2086 
2087 /*
2088  * Request a filesystem to suspend write operations.
2089  */
2090 int
2091 vfs_write_suspend(struct mount *mp, int flags)
2092 {
2093 	int error;
2094 
2095 	vfs_op_enter(mp);
2096 
2097 	MNT_ILOCK(mp);
2098 	vfs_assert_mount_counters(mp);
2099 	if (mp->mnt_susp_owner == curthread) {
2100 		vfs_op_exit_locked(mp);
2101 		MNT_IUNLOCK(mp);
2102 		return (EALREADY);
2103 	}
2104 	while (mp->mnt_kern_flag & MNTK_SUSPEND)
2105 		msleep(&mp->mnt_flag, MNT_MTX(mp), PUSER - 1, "wsuspfs", 0);
2106 
2107 	/*
2108 	 * Unmount holds a write reference on the mount point.  If we
2109 	 * own busy reference and drain for writers, we deadlock with
2110 	 * the reference draining in the unmount path.  Callers of
2111 	 * vfs_write_suspend() must specify VS_SKIP_UNMOUNT if
2112 	 * vfs_busy() reference is owned and caller is not in the
2113 	 * unmount context.
2114 	 */
2115 	if ((flags & VS_SKIP_UNMOUNT) != 0 &&
2116 	    (mp->mnt_kern_flag & MNTK_UNMOUNT) != 0) {
2117 		vfs_op_exit_locked(mp);
2118 		MNT_IUNLOCK(mp);
2119 		return (EBUSY);
2120 	}
2121 
2122 	mp->mnt_kern_flag |= MNTK_SUSPEND;
2123 	mp->mnt_susp_owner = curthread;
2124 	if (mp->mnt_writeopcount > 0)
2125 		(void) msleep(&mp->mnt_writeopcount,
2126 		    MNT_MTX(mp), (PUSER - 1)|PDROP, "suspwt", 0);
2127 	else
2128 		MNT_IUNLOCK(mp);
2129 	if ((error = VFS_SYNC(mp, MNT_SUSPEND)) != 0) {
2130 		vfs_write_resume(mp, 0);
2131 		/* vfs_write_resume does vfs_op_exit() for us */
2132 	}
2133 	return (error);
2134 }
2135 
2136 /*
2137  * Request a filesystem to resume write operations.
2138  */
2139 void
2140 vfs_write_resume(struct mount *mp, int flags)
2141 {
2142 
2143 	MNT_ILOCK(mp);
2144 	if ((mp->mnt_kern_flag & MNTK_SUSPEND) != 0) {
2145 		KASSERT(mp->mnt_susp_owner == curthread, ("mnt_susp_owner"));
2146 		mp->mnt_kern_flag &= ~(MNTK_SUSPEND | MNTK_SUSPEND2 |
2147 				       MNTK_SUSPENDED);
2148 		mp->mnt_susp_owner = NULL;
2149 		wakeup(&mp->mnt_writeopcount);
2150 		wakeup(&mp->mnt_flag);
2151 		curthread->td_pflags &= ~TDP_IGNSUSP;
2152 		if ((flags & VR_START_WRITE) != 0) {
2153 			MNT_REF(mp);
2154 			mp->mnt_writeopcount++;
2155 		}
2156 		MNT_IUNLOCK(mp);
2157 		if ((flags & VR_NO_SUSPCLR) == 0)
2158 			VFS_SUSP_CLEAN(mp);
2159 		vfs_op_exit(mp);
2160 	} else if ((flags & VR_START_WRITE) != 0) {
2161 		MNT_REF(mp);
2162 		vn_start_write_refed(mp, 0, true);
2163 	} else {
2164 		MNT_IUNLOCK(mp);
2165 	}
2166 }
2167 
2168 /*
2169  * Helper loop around vfs_write_suspend() for filesystem unmount VFS
2170  * methods.
2171  */
2172 int
2173 vfs_write_suspend_umnt(struct mount *mp)
2174 {
2175 	int error;
2176 
2177 	KASSERT((curthread->td_pflags & TDP_IGNSUSP) == 0,
2178 	    ("vfs_write_suspend_umnt: recursed"));
2179 
2180 	/* dounmount() already called vn_start_write(). */
2181 	for (;;) {
2182 		vn_finished_write(mp);
2183 		error = vfs_write_suspend(mp, 0);
2184 		if (error != 0) {
2185 			vn_start_write(NULL, &mp, V_WAIT);
2186 			return (error);
2187 		}
2188 		MNT_ILOCK(mp);
2189 		if ((mp->mnt_kern_flag & MNTK_SUSPENDED) != 0)
2190 			break;
2191 		MNT_IUNLOCK(mp);
2192 		vn_start_write(NULL, &mp, V_WAIT);
2193 	}
2194 	mp->mnt_kern_flag &= ~(MNTK_SUSPENDED | MNTK_SUSPEND2);
2195 	wakeup(&mp->mnt_flag);
2196 	MNT_IUNLOCK(mp);
2197 	curthread->td_pflags |= TDP_IGNSUSP;
2198 	return (0);
2199 }
2200 
2201 /*
2202  * Implement kqueues for files by translating it to vnode operation.
2203  */
2204 static int
2205 vn_kqfilter(struct file *fp, struct knote *kn)
2206 {
2207 
2208 	return (VOP_KQFILTER(fp->f_vnode, kn));
2209 }
2210 
2211 int
2212 vn_kqfilter_opath(struct file *fp, struct knote *kn)
2213 {
2214 	if ((fp->f_flag & FKQALLOWED) == 0)
2215 		return (EBADF);
2216 	return (vn_kqfilter(fp, kn));
2217 }
2218 
2219 /*
2220  * Simplified in-kernel wrapper calls for extended attribute access.
2221  * Both calls pass in a NULL credential, authorizing as "kernel" access.
2222  * Set IO_NODELOCKED in ioflg if the vnode is already locked.
2223  */
2224 int
2225 vn_extattr_get(struct vnode *vp, int ioflg, int attrnamespace,
2226     const char *attrname, int *buflen, char *buf, struct thread *td)
2227 {
2228 	struct uio	auio;
2229 	struct iovec	iov;
2230 	int	error;
2231 
2232 	iov.iov_len = *buflen;
2233 	iov.iov_base = buf;
2234 
2235 	auio.uio_iov = &iov;
2236 	auio.uio_iovcnt = 1;
2237 	auio.uio_rw = UIO_READ;
2238 	auio.uio_segflg = UIO_SYSSPACE;
2239 	auio.uio_td = td;
2240 	auio.uio_offset = 0;
2241 	auio.uio_resid = *buflen;
2242 
2243 	if ((ioflg & IO_NODELOCKED) == 0)
2244 		vn_lock(vp, LK_SHARED | LK_RETRY);
2245 
2246 	ASSERT_VOP_LOCKED(vp, "IO_NODELOCKED with no vp lock held");
2247 
2248 	/* authorize attribute retrieval as kernel */
2249 	error = VOP_GETEXTATTR(vp, attrnamespace, attrname, &auio, NULL, NULL,
2250 	    td);
2251 
2252 	if ((ioflg & IO_NODELOCKED) == 0)
2253 		VOP_UNLOCK(vp);
2254 
2255 	if (error == 0) {
2256 		*buflen = *buflen - auio.uio_resid;
2257 	}
2258 
2259 	return (error);
2260 }
2261 
2262 /*
2263  * XXX failure mode if partially written?
2264  */
2265 int
2266 vn_extattr_set(struct vnode *vp, int ioflg, int attrnamespace,
2267     const char *attrname, int buflen, char *buf, struct thread *td)
2268 {
2269 	struct uio	auio;
2270 	struct iovec	iov;
2271 	struct mount	*mp;
2272 	int	error;
2273 
2274 	iov.iov_len = buflen;
2275 	iov.iov_base = buf;
2276 
2277 	auio.uio_iov = &iov;
2278 	auio.uio_iovcnt = 1;
2279 	auio.uio_rw = UIO_WRITE;
2280 	auio.uio_segflg = UIO_SYSSPACE;
2281 	auio.uio_td = td;
2282 	auio.uio_offset = 0;
2283 	auio.uio_resid = buflen;
2284 
2285 	if ((ioflg & IO_NODELOCKED) == 0) {
2286 		if ((error = vn_start_write(vp, &mp, V_WAIT)) != 0)
2287 			return (error);
2288 		vn_lock(vp, LK_EXCLUSIVE | LK_RETRY);
2289 	}
2290 
2291 	ASSERT_VOP_LOCKED(vp, "IO_NODELOCKED with no vp lock held");
2292 
2293 	/* authorize attribute setting as kernel */
2294 	error = VOP_SETEXTATTR(vp, attrnamespace, attrname, &auio, NULL, td);
2295 
2296 	if ((ioflg & IO_NODELOCKED) == 0) {
2297 		vn_finished_write(mp);
2298 		VOP_UNLOCK(vp);
2299 	}
2300 
2301 	return (error);
2302 }
2303 
2304 int
2305 vn_extattr_rm(struct vnode *vp, int ioflg, int attrnamespace,
2306     const char *attrname, struct thread *td)
2307 {
2308 	struct mount	*mp;
2309 	int	error;
2310 
2311 	if ((ioflg & IO_NODELOCKED) == 0) {
2312 		if ((error = vn_start_write(vp, &mp, V_WAIT)) != 0)
2313 			return (error);
2314 		vn_lock(vp, LK_EXCLUSIVE | LK_RETRY);
2315 	}
2316 
2317 	ASSERT_VOP_LOCKED(vp, "IO_NODELOCKED with no vp lock held");
2318 
2319 	/* authorize attribute removal as kernel */
2320 	error = VOP_DELETEEXTATTR(vp, attrnamespace, attrname, NULL, td);
2321 	if (error == EOPNOTSUPP)
2322 		error = VOP_SETEXTATTR(vp, attrnamespace, attrname, NULL,
2323 		    NULL, td);
2324 
2325 	if ((ioflg & IO_NODELOCKED) == 0) {
2326 		vn_finished_write(mp);
2327 		VOP_UNLOCK(vp);
2328 	}
2329 
2330 	return (error);
2331 }
2332 
2333 static int
2334 vn_get_ino_alloc_vget(struct mount *mp, void *arg, int lkflags,
2335     struct vnode **rvp)
2336 {
2337 
2338 	return (VFS_VGET(mp, *(ino_t *)arg, lkflags, rvp));
2339 }
2340 
2341 int
2342 vn_vget_ino(struct vnode *vp, ino_t ino, int lkflags, struct vnode **rvp)
2343 {
2344 
2345 	return (vn_vget_ino_gen(vp, vn_get_ino_alloc_vget, &ino,
2346 	    lkflags, rvp));
2347 }
2348 
2349 int
2350 vn_vget_ino_gen(struct vnode *vp, vn_get_ino_t alloc, void *alloc_arg,
2351     int lkflags, struct vnode **rvp)
2352 {
2353 	struct mount *mp;
2354 	int ltype, error;
2355 
2356 	ASSERT_VOP_LOCKED(vp, "vn_vget_ino_get");
2357 	mp = vp->v_mount;
2358 	ltype = VOP_ISLOCKED(vp);
2359 	KASSERT(ltype == LK_EXCLUSIVE || ltype == LK_SHARED,
2360 	    ("vn_vget_ino: vp not locked"));
2361 	error = vfs_busy(mp, MBF_NOWAIT);
2362 	if (error != 0) {
2363 		vfs_ref(mp);
2364 		VOP_UNLOCK(vp);
2365 		error = vfs_busy(mp, 0);
2366 		vn_lock(vp, ltype | LK_RETRY);
2367 		vfs_rel(mp);
2368 		if (error != 0)
2369 			return (ENOENT);
2370 		if (VN_IS_DOOMED(vp)) {
2371 			vfs_unbusy(mp);
2372 			return (ENOENT);
2373 		}
2374 	}
2375 	VOP_UNLOCK(vp);
2376 	error = alloc(mp, alloc_arg, lkflags, rvp);
2377 	vfs_unbusy(mp);
2378 	if (error != 0 || *rvp != vp)
2379 		vn_lock(vp, ltype | LK_RETRY);
2380 	if (VN_IS_DOOMED(vp)) {
2381 		if (error == 0) {
2382 			if (*rvp == vp)
2383 				vunref(vp);
2384 			else
2385 				vput(*rvp);
2386 		}
2387 		error = ENOENT;
2388 	}
2389 	return (error);
2390 }
2391 
2392 static void
2393 vn_send_sigxfsz(struct proc *p)
2394 {
2395 	PROC_LOCK(p);
2396 	kern_psignal(p, SIGXFSZ);
2397 	PROC_UNLOCK(p);
2398 }
2399 
2400 int
2401 vn_rlimit_trunc(u_quad_t size, struct thread *td)
2402 {
2403 	if (size <= lim_cur(td, RLIMIT_FSIZE))
2404 		return (0);
2405 	vn_send_sigxfsz(td->td_proc);
2406 	return (EFBIG);
2407 }
2408 
2409 static int
2410 vn_rlimit_fsizex1(const struct vnode *vp, struct uio *uio, off_t maxfsz,
2411     bool adj, struct thread *td)
2412 {
2413 	off_t lim;
2414 	bool ktr_write;
2415 
2416 	if (vp->v_type != VREG)
2417 		return (0);
2418 
2419 	/*
2420 	 * Handle file system maximum file size.
2421 	 */
2422 	if (maxfsz != 0 && uio->uio_offset + uio->uio_resid > maxfsz) {
2423 		if (!adj || uio->uio_offset >= maxfsz)
2424 			return (EFBIG);
2425 		uio->uio_resid = maxfsz - uio->uio_offset;
2426 	}
2427 
2428 	/*
2429 	 * This is kernel write (e.g. vnode_pager) or accounting
2430 	 * write, ignore limit.
2431 	 */
2432 	if (td == NULL || (td->td_pflags2 & TDP2_ACCT) != 0)
2433 		return (0);
2434 
2435 	/*
2436 	 * Calculate file size limit.
2437 	 */
2438 	ktr_write = (td->td_pflags & TDP_INKTRACE) != 0;
2439 	lim = __predict_false(ktr_write) ? td->td_ktr_io_lim :
2440 	    lim_cur(td, RLIMIT_FSIZE);
2441 
2442 	/*
2443 	 * Is the limit reached?
2444 	 */
2445 	if (__predict_true((uoff_t)uio->uio_offset + uio->uio_resid <= lim))
2446 		return (0);
2447 
2448 	/*
2449 	 * Prepared filesystems can handle writes truncated to the
2450 	 * file size limit.
2451 	 */
2452 	if (adj && (uoff_t)uio->uio_offset < lim) {
2453 		uio->uio_resid = lim - (uoff_t)uio->uio_offset;
2454 		return (0);
2455 	}
2456 
2457 	if (!ktr_write || ktr_filesize_limit_signal)
2458 		vn_send_sigxfsz(td->td_proc);
2459 	return (EFBIG);
2460 }
2461 
2462 /*
2463  * Helper for VOP_WRITE() implementations, the common code to
2464  * handle maximum supported file size on the filesystem, and
2465  * RLIMIT_FSIZE, except for special writes from accounting subsystem
2466  * and ktrace.
2467  *
2468  * For maximum file size (maxfsz argument):
2469  * - return EFBIG if uio_offset is beyond it
2470  * - otherwise, clamp uio_resid if write would extend file beyond maxfsz.
2471  *
2472  * For RLIMIT_FSIZE:
2473  * - return EFBIG and send SIGXFSZ if uio_offset is beyond the limit
2474  * - otherwise, clamp uio_resid if write would extend file beyond limit.
2475  *
2476  * If clamping occured, the adjustment for uio_resid is stored in
2477  * *resid_adj, to be re-applied by vn_rlimit_fsizex_res() on return
2478  * from the VOP.
2479  */
2480 int
2481 vn_rlimit_fsizex(const struct vnode *vp, struct uio *uio, off_t maxfsz,
2482     ssize_t *resid_adj, struct thread *td)
2483 {
2484 	ssize_t resid_orig;
2485 	int error;
2486 	bool adj;
2487 
2488 	resid_orig = uio->uio_resid;
2489 	adj = resid_adj != NULL;
2490 	error = vn_rlimit_fsizex1(vp, uio, maxfsz, adj, td);
2491 	if (adj)
2492 		*resid_adj = resid_orig - uio->uio_resid;
2493 	return (error);
2494 }
2495 
2496 void
2497 vn_rlimit_fsizex_res(struct uio *uio, ssize_t resid_adj)
2498 {
2499 	uio->uio_resid += resid_adj;
2500 }
2501 
2502 int
2503 vn_rlimit_fsize(const struct vnode *vp, const struct uio *uio,
2504     struct thread *td)
2505 {
2506 	return (vn_rlimit_fsizex(vp, __DECONST(struct uio *, uio), 0, NULL,
2507 	    td));
2508 }
2509 
2510 int
2511 vn_chmod(struct file *fp, mode_t mode, struct ucred *active_cred,
2512     struct thread *td)
2513 {
2514 	struct vnode *vp;
2515 
2516 	vp = fp->f_vnode;
2517 #ifdef AUDIT
2518 	vn_lock(vp, LK_SHARED | LK_RETRY);
2519 	AUDIT_ARG_VNODE1(vp);
2520 	VOP_UNLOCK(vp);
2521 #endif
2522 	return (setfmode(td, active_cred, vp, mode));
2523 }
2524 
2525 int
2526 vn_chown(struct file *fp, uid_t uid, gid_t gid, struct ucred *active_cred,
2527     struct thread *td)
2528 {
2529 	struct vnode *vp;
2530 
2531 	vp = fp->f_vnode;
2532 #ifdef AUDIT
2533 	vn_lock(vp, LK_SHARED | LK_RETRY);
2534 	AUDIT_ARG_VNODE1(vp);
2535 	VOP_UNLOCK(vp);
2536 #endif
2537 	return (setfown(td, active_cred, vp, uid, gid));
2538 }
2539 
2540 /*
2541  * Remove pages in the range ["start", "end") from the vnode's VM object.  If
2542  * "end" is 0, then the range extends to the end of the object.
2543  */
2544 void
2545 vn_pages_remove(struct vnode *vp, vm_pindex_t start, vm_pindex_t end)
2546 {
2547 	vm_object_t object;
2548 
2549 	if ((object = vp->v_object) == NULL)
2550 		return;
2551 	VM_OBJECT_WLOCK(object);
2552 	vm_object_page_remove(object, start, end, 0);
2553 	VM_OBJECT_WUNLOCK(object);
2554 }
2555 
2556 /*
2557  * Like vn_pages_remove(), but skips invalid pages, which by definition are not
2558  * mapped into any process' address space.  Filesystems may use this in
2559  * preference to vn_pages_remove() to avoid blocking on pages busied in
2560  * preparation for a VOP_GETPAGES.
2561  */
2562 void
2563 vn_pages_remove_valid(struct vnode *vp, vm_pindex_t start, vm_pindex_t end)
2564 {
2565 	vm_object_t object;
2566 
2567 	if ((object = vp->v_object) == NULL)
2568 		return;
2569 	VM_OBJECT_WLOCK(object);
2570 	vm_object_page_remove(object, start, end, OBJPR_VALIDONLY);
2571 	VM_OBJECT_WUNLOCK(object);
2572 }
2573 
2574 int
2575 vn_bmap_seekhole_locked(struct vnode *vp, u_long cmd, off_t *off,
2576     struct ucred *cred)
2577 {
2578 	vm_object_t obj;
2579 	off_t size;
2580 	daddr_t bn, bnp;
2581 	uint64_t bsize;
2582 	off_t noff;
2583 	int error;
2584 
2585 	KASSERT(cmd == FIOSEEKHOLE || cmd == FIOSEEKDATA,
2586 	    ("%s: Wrong command %lu", __func__, cmd));
2587 	ASSERT_VOP_ELOCKED(vp, "vn_bmap_seekhole_locked");
2588 
2589 	if (vp->v_type != VREG) {
2590 		error = ENOTTY;
2591 		goto out;
2592 	}
2593 	error = vn_getsize_locked(vp, &size, cred);
2594 	if (error != 0)
2595 		goto out;
2596 	noff = *off;
2597 	if (noff < 0 || noff >= size) {
2598 		error = ENXIO;
2599 		goto out;
2600 	}
2601 
2602 	/* See the comment in ufs_bmap_seekdata(). */
2603 	obj = vp->v_object;
2604 	if (obj != NULL) {
2605 		VM_OBJECT_WLOCK(obj);
2606 		vm_object_page_clean(obj, 0, 0, OBJPC_SYNC);
2607 		VM_OBJECT_WUNLOCK(obj);
2608 	}
2609 
2610 	bsize = vp->v_mount->mnt_stat.f_iosize;
2611 	for (bn = noff / bsize; noff < size; bn++, noff += bsize -
2612 	    noff % bsize) {
2613 		error = VOP_BMAP(vp, bn, NULL, &bnp, NULL, NULL);
2614 		if (error == EOPNOTSUPP) {
2615 			error = ENOTTY;
2616 			goto out;
2617 		}
2618 		if ((bnp == -1 && cmd == FIOSEEKHOLE) ||
2619 		    (bnp != -1 && cmd == FIOSEEKDATA)) {
2620 			noff = bn * bsize;
2621 			if (noff < *off)
2622 				noff = *off;
2623 			goto out;
2624 		}
2625 	}
2626 	if (noff > size)
2627 		noff = size;
2628 	/* noff == size. There is an implicit hole at the end of file. */
2629 	if (cmd == FIOSEEKDATA)
2630 		error = ENXIO;
2631 out:
2632 	if (error == 0)
2633 		*off = noff;
2634 	return (error);
2635 }
2636 
2637 int
2638 vn_bmap_seekhole(struct vnode *vp, u_long cmd, off_t *off, struct ucred *cred)
2639 {
2640 	int error;
2641 
2642 	KASSERT(cmd == FIOSEEKHOLE || cmd == FIOSEEKDATA,
2643 	    ("%s: Wrong command %lu", __func__, cmd));
2644 
2645 	if (vn_lock(vp, LK_EXCLUSIVE) != 0)
2646 		return (EBADF);
2647 	error = vn_bmap_seekhole_locked(vp, cmd, off, cred);
2648 	VOP_UNLOCK(vp);
2649 	return (error);
2650 }
2651 
2652 int
2653 vn_seek(struct file *fp, off_t offset, int whence, struct thread *td)
2654 {
2655 	struct ucred *cred;
2656 	struct vnode *vp;
2657 	off_t foffset, fsize, size;
2658 	int error, noneg;
2659 
2660 	cred = td->td_ucred;
2661 	vp = fp->f_vnode;
2662 	noneg = (vp->v_type != VCHR);
2663 	/*
2664 	 * Try to dodge locking for common case of querying the offset.
2665 	 */
2666 	if (whence == L_INCR && offset == 0) {
2667 		foffset = foffset_read(fp);
2668 		if (__predict_false(foffset < 0 && noneg)) {
2669 			return (EOVERFLOW);
2670 		}
2671 		td->td_uretoff.tdu_off = foffset;
2672 		return (0);
2673 	}
2674 	foffset = foffset_lock(fp, 0);
2675 	error = 0;
2676 	switch (whence) {
2677 	case L_INCR:
2678 		if (noneg &&
2679 		    (foffset < 0 ||
2680 		    (offset > 0 && foffset > OFF_MAX - offset))) {
2681 			error = EOVERFLOW;
2682 			break;
2683 		}
2684 		offset += foffset;
2685 		break;
2686 	case L_XTND:
2687 		error = vn_getsize(vp, &fsize, cred);
2688 		if (error != 0)
2689 			break;
2690 
2691 		/*
2692 		 * If the file references a disk device, then fetch
2693 		 * the media size and use that to determine the ending
2694 		 * offset.
2695 		 */
2696 		if (fsize == 0 && vp->v_type == VCHR &&
2697 		    fo_ioctl(fp, DIOCGMEDIASIZE, &size, cred, td) == 0)
2698 			fsize = size;
2699 		if (noneg && offset > 0 && fsize > OFF_MAX - offset) {
2700 			error = EOVERFLOW;
2701 			break;
2702 		}
2703 		offset += fsize;
2704 		break;
2705 	case L_SET:
2706 		break;
2707 	case SEEK_DATA:
2708 		error = fo_ioctl(fp, FIOSEEKDATA, &offset, cred, td);
2709 		if (error == ENOTTY)
2710 			error = EINVAL;
2711 		break;
2712 	case SEEK_HOLE:
2713 		error = fo_ioctl(fp, FIOSEEKHOLE, &offset, cred, td);
2714 		if (error == ENOTTY)
2715 			error = EINVAL;
2716 		break;
2717 	default:
2718 		error = EINVAL;
2719 	}
2720 	if (error == 0 && noneg && offset < 0)
2721 		error = EINVAL;
2722 	if (error != 0)
2723 		goto drop;
2724 	VFS_KNOTE_UNLOCKED(vp, 0);
2725 	td->td_uretoff.tdu_off = offset;
2726 drop:
2727 	foffset_unlock(fp, offset, error != 0 ? FOF_NOUPDATE : 0);
2728 	return (error);
2729 }
2730 
2731 int
2732 vn_utimes_perm(struct vnode *vp, struct vattr *vap, struct ucred *cred,
2733     struct thread *td)
2734 {
2735 	int error;
2736 
2737 	/*
2738 	 * Grant permission if the caller is the owner of the file, or
2739 	 * the super-user, or has ACL_WRITE_ATTRIBUTES permission on
2740 	 * on the file.  If the time pointer is null, then write
2741 	 * permission on the file is also sufficient.
2742 	 *
2743 	 * From NFSv4.1, draft 21, 6.2.1.3.1, Discussion of Mask Attributes:
2744 	 * A user having ACL_WRITE_DATA or ACL_WRITE_ATTRIBUTES
2745 	 * will be allowed to set the times [..] to the current
2746 	 * server time.
2747 	 */
2748 	error = VOP_ACCESSX(vp, VWRITE_ATTRIBUTES, cred, td);
2749 	if (error != 0 && (vap->va_vaflags & VA_UTIMES_NULL) != 0)
2750 		error = VOP_ACCESS(vp, VWRITE, cred, td);
2751 	return (error);
2752 }
2753 
2754 int
2755 vn_fill_kinfo(struct file *fp, struct kinfo_file *kif, struct filedesc *fdp)
2756 {
2757 	struct vnode *vp;
2758 	int error;
2759 
2760 	if (fp->f_type == DTYPE_FIFO)
2761 		kif->kf_type = KF_TYPE_FIFO;
2762 	else
2763 		kif->kf_type = KF_TYPE_VNODE;
2764 	vp = fp->f_vnode;
2765 	vref(vp);
2766 	FILEDESC_SUNLOCK(fdp);
2767 	error = vn_fill_kinfo_vnode(vp, kif);
2768 	vrele(vp);
2769 	FILEDESC_SLOCK(fdp);
2770 	return (error);
2771 }
2772 
2773 static inline void
2774 vn_fill_junk(struct kinfo_file *kif)
2775 {
2776 	size_t len, olen;
2777 
2778 	/*
2779 	 * Simulate vn_fullpath returning changing values for a given
2780 	 * vp during e.g. coredump.
2781 	 */
2782 	len = (arc4random() % (sizeof(kif->kf_path) - 2)) + 1;
2783 	olen = strlen(kif->kf_path);
2784 	if (len < olen)
2785 		strcpy(&kif->kf_path[len - 1], "$");
2786 	else
2787 		for (; olen < len; olen++)
2788 			strcpy(&kif->kf_path[olen], "A");
2789 }
2790 
2791 int
2792 vn_fill_kinfo_vnode(struct vnode *vp, struct kinfo_file *kif)
2793 {
2794 	struct vattr va;
2795 	char *fullpath, *freepath;
2796 	int error;
2797 
2798 	kif->kf_un.kf_file.kf_file_type = vntype_to_kinfo(vp->v_type);
2799 	freepath = NULL;
2800 	fullpath = "-";
2801 	error = vn_fullpath(vp, &fullpath, &freepath);
2802 	if (error == 0) {
2803 		strlcpy(kif->kf_path, fullpath, sizeof(kif->kf_path));
2804 	}
2805 	if (freepath != NULL)
2806 		free(freepath, M_TEMP);
2807 
2808 	KFAIL_POINT_CODE(DEBUG_FP, fill_kinfo_vnode__random_path,
2809 		vn_fill_junk(kif);
2810 	);
2811 
2812 	/*
2813 	 * Retrieve vnode attributes.
2814 	 */
2815 	va.va_fsid = VNOVAL;
2816 	va.va_rdev = NODEV;
2817 	vn_lock(vp, LK_SHARED | LK_RETRY);
2818 	error = VOP_GETATTR(vp, &va, curthread->td_ucred);
2819 	VOP_UNLOCK(vp);
2820 	if (error != 0)
2821 		return (error);
2822 	if (va.va_fsid != VNOVAL)
2823 		kif->kf_un.kf_file.kf_file_fsid = va.va_fsid;
2824 	else
2825 		kif->kf_un.kf_file.kf_file_fsid =
2826 		    vp->v_mount->mnt_stat.f_fsid.val[0];
2827 	kif->kf_un.kf_file.kf_file_fsid_freebsd11 =
2828 	    kif->kf_un.kf_file.kf_file_fsid; /* truncate */
2829 	kif->kf_un.kf_file.kf_file_fileid = va.va_fileid;
2830 	kif->kf_un.kf_file.kf_file_mode = MAKEIMODE(va.va_type, va.va_mode);
2831 	kif->kf_un.kf_file.kf_file_size = va.va_size;
2832 	kif->kf_un.kf_file.kf_file_rdev = va.va_rdev;
2833 	kif->kf_un.kf_file.kf_file_rdev_freebsd11 =
2834 	    kif->kf_un.kf_file.kf_file_rdev; /* truncate */
2835 	kif->kf_un.kf_file.kf_file_nlink = va.va_nlink;
2836 	return (0);
2837 }
2838 
2839 int
2840 vn_mmap(struct file *fp, vm_map_t map, vm_offset_t *addr, vm_size_t size,
2841     vm_prot_t prot, vm_prot_t cap_maxprot, int flags, vm_ooffset_t foff,
2842     struct thread *td)
2843 {
2844 #ifdef HWPMC_HOOKS
2845 	struct pmckern_map_in pkm;
2846 #endif
2847 	struct mount *mp;
2848 	struct vnode *vp;
2849 	vm_object_t object;
2850 	vm_prot_t maxprot;
2851 	boolean_t writecounted;
2852 	int error;
2853 
2854 #if defined(COMPAT_FREEBSD7) || defined(COMPAT_FREEBSD6) || \
2855     defined(COMPAT_FREEBSD5) || defined(COMPAT_FREEBSD4)
2856 	/*
2857 	 * POSIX shared-memory objects are defined to have
2858 	 * kernel persistence, and are not defined to support
2859 	 * read(2)/write(2) -- or even open(2).  Thus, we can
2860 	 * use MAP_ASYNC to trade on-disk coherence for speed.
2861 	 * The shm_open(3) library routine turns on the FPOSIXSHM
2862 	 * flag to request this behavior.
2863 	 */
2864 	if ((fp->f_flag & FPOSIXSHM) != 0)
2865 		flags |= MAP_NOSYNC;
2866 #endif
2867 	vp = fp->f_vnode;
2868 
2869 	/*
2870 	 * Ensure that file and memory protections are
2871 	 * compatible.  Note that we only worry about
2872 	 * writability if mapping is shared; in this case,
2873 	 * current and max prot are dictated by the open file.
2874 	 * XXX use the vnode instead?  Problem is: what
2875 	 * credentials do we use for determination? What if
2876 	 * proc does a setuid?
2877 	 */
2878 	mp = vp->v_mount;
2879 	if (mp != NULL && (mp->mnt_flag & MNT_NOEXEC) != 0) {
2880 		maxprot = VM_PROT_NONE;
2881 		if ((prot & VM_PROT_EXECUTE) != 0)
2882 			return (EACCES);
2883 	} else
2884 		maxprot = VM_PROT_EXECUTE;
2885 	if ((fp->f_flag & FREAD) != 0)
2886 		maxprot |= VM_PROT_READ;
2887 	else if ((prot & VM_PROT_READ) != 0)
2888 		return (EACCES);
2889 
2890 	/*
2891 	 * If we are sharing potential changes via MAP_SHARED and we
2892 	 * are trying to get write permission although we opened it
2893 	 * without asking for it, bail out.
2894 	 */
2895 	if ((flags & MAP_SHARED) != 0) {
2896 		if ((fp->f_flag & FWRITE) != 0)
2897 			maxprot |= VM_PROT_WRITE;
2898 		else if ((prot & VM_PROT_WRITE) != 0)
2899 			return (EACCES);
2900 	} else {
2901 		maxprot |= VM_PROT_WRITE;
2902 		cap_maxprot |= VM_PROT_WRITE;
2903 	}
2904 	maxprot &= cap_maxprot;
2905 
2906 	/*
2907 	 * For regular files and shared memory, POSIX requires that
2908 	 * the value of foff be a legitimate offset within the data
2909 	 * object.  In particular, negative offsets are invalid.
2910 	 * Blocking negative offsets and overflows here avoids
2911 	 * possible wraparound or user-level access into reserved
2912 	 * ranges of the data object later.  In contrast, POSIX does
2913 	 * not dictate how offsets are used by device drivers, so in
2914 	 * the case of a device mapping a negative offset is passed
2915 	 * on.
2916 	 */
2917 	if (
2918 #ifdef _LP64
2919 	    size > OFF_MAX ||
2920 #endif
2921 	    foff > OFF_MAX - size)
2922 		return (EINVAL);
2923 
2924 	writecounted = FALSE;
2925 	error = vm_mmap_vnode(td, size, prot, &maxprot, &flags, vp,
2926 	    &foff, &object, &writecounted);
2927 	if (error != 0)
2928 		return (error);
2929 	error = vm_mmap_object(map, addr, size, prot, maxprot, flags, object,
2930 	    foff, writecounted, td);
2931 	if (error != 0) {
2932 		/*
2933 		 * If this mapping was accounted for in the vnode's
2934 		 * writecount, then undo that now.
2935 		 */
2936 		if (writecounted)
2937 			vm_pager_release_writecount(object, 0, size);
2938 		vm_object_deallocate(object);
2939 	}
2940 #ifdef HWPMC_HOOKS
2941 	/* Inform hwpmc(4) if an executable is being mapped. */
2942 	if (PMC_HOOK_INSTALLED(PMC_FN_MMAP)) {
2943 		if ((prot & VM_PROT_EXECUTE) != 0 && error == 0) {
2944 			pkm.pm_file = vp;
2945 			pkm.pm_address = (uintptr_t) *addr;
2946 			PMC_CALL_HOOK_UNLOCKED(td, PMC_FN_MMAP, (void *) &pkm);
2947 		}
2948 	}
2949 #endif
2950 	return (error);
2951 }
2952 
2953 void
2954 vn_fsid(struct vnode *vp, struct vattr *va)
2955 {
2956 	fsid_t *f;
2957 
2958 	f = &vp->v_mount->mnt_stat.f_fsid;
2959 	va->va_fsid = (uint32_t)f->val[1];
2960 	va->va_fsid <<= sizeof(f->val[1]) * NBBY;
2961 	va->va_fsid += (uint32_t)f->val[0];
2962 }
2963 
2964 int
2965 vn_fsync_buf(struct vnode *vp, int waitfor)
2966 {
2967 	struct buf *bp, *nbp;
2968 	struct bufobj *bo;
2969 	struct mount *mp;
2970 	int error, maxretry;
2971 
2972 	error = 0;
2973 	maxretry = 10000;     /* large, arbitrarily chosen */
2974 	mp = NULL;
2975 	if (vp->v_type == VCHR) {
2976 		VI_LOCK(vp);
2977 		mp = vp->v_rdev->si_mountpt;
2978 		VI_UNLOCK(vp);
2979 	}
2980 	bo = &vp->v_bufobj;
2981 	BO_LOCK(bo);
2982 loop1:
2983 	/*
2984 	 * MARK/SCAN initialization to avoid infinite loops.
2985 	 */
2986         TAILQ_FOREACH(bp, &bo->bo_dirty.bv_hd, b_bobufs) {
2987 		bp->b_vflags &= ~BV_SCANNED;
2988 		bp->b_error = 0;
2989 	}
2990 
2991 	/*
2992 	 * Flush all dirty buffers associated with a vnode.
2993 	 */
2994 loop2:
2995 	TAILQ_FOREACH_SAFE(bp, &bo->bo_dirty.bv_hd, b_bobufs, nbp) {
2996 		if ((bp->b_vflags & BV_SCANNED) != 0)
2997 			continue;
2998 		bp->b_vflags |= BV_SCANNED;
2999 		if (BUF_LOCK(bp, LK_EXCLUSIVE | LK_NOWAIT, NULL)) {
3000 			if (waitfor != MNT_WAIT)
3001 				continue;
3002 			if (BUF_LOCK(bp,
3003 			    LK_EXCLUSIVE | LK_INTERLOCK | LK_SLEEPFAIL,
3004 			    BO_LOCKPTR(bo)) != 0) {
3005 				BO_LOCK(bo);
3006 				goto loop1;
3007 			}
3008 			BO_LOCK(bo);
3009 		}
3010 		BO_UNLOCK(bo);
3011 		KASSERT(bp->b_bufobj == bo,
3012 		    ("bp %p wrong b_bufobj %p should be %p",
3013 		    bp, bp->b_bufobj, bo));
3014 		if ((bp->b_flags & B_DELWRI) == 0)
3015 			panic("fsync: not dirty");
3016 		if ((vp->v_object != NULL) && (bp->b_flags & B_CLUSTEROK)) {
3017 			vfs_bio_awrite(bp);
3018 		} else {
3019 			bremfree(bp);
3020 			bawrite(bp);
3021 		}
3022 		if (maxretry < 1000)
3023 			pause("dirty", hz < 1000 ? 1 : hz / 1000);
3024 		BO_LOCK(bo);
3025 		goto loop2;
3026 	}
3027 
3028 	/*
3029 	 * If synchronous the caller expects us to completely resolve all
3030 	 * dirty buffers in the system.  Wait for in-progress I/O to
3031 	 * complete (which could include background bitmap writes), then
3032 	 * retry if dirty blocks still exist.
3033 	 */
3034 	if (waitfor == MNT_WAIT) {
3035 		bufobj_wwait(bo, 0, 0);
3036 		if (bo->bo_dirty.bv_cnt > 0) {
3037 			/*
3038 			 * If we are unable to write any of these buffers
3039 			 * then we fail now rather than trying endlessly
3040 			 * to write them out.
3041 			 */
3042 			TAILQ_FOREACH(bp, &bo->bo_dirty.bv_hd, b_bobufs)
3043 				if ((error = bp->b_error) != 0)
3044 					break;
3045 			if ((mp != NULL && mp->mnt_secondary_writes > 0) ||
3046 			    (error == 0 && --maxretry >= 0))
3047 				goto loop1;
3048 			if (error == 0)
3049 				error = EAGAIN;
3050 		}
3051 	}
3052 	BO_UNLOCK(bo);
3053 	if (error != 0)
3054 		vn_printf(vp, "fsync: giving up on dirty (error = %d) ", error);
3055 
3056 	return (error);
3057 }
3058 
3059 /*
3060  * Copies a byte range from invp to outvp.  Calls VOP_COPY_FILE_RANGE()
3061  * or vn_generic_copy_file_range() after rangelocking the byte ranges,
3062  * to do the actual copy.
3063  * vn_generic_copy_file_range() is factored out, so it can be called
3064  * from a VOP_COPY_FILE_RANGE() call as well, but handles vnodes from
3065  * different file systems.
3066  */
3067 int
3068 vn_copy_file_range(struct vnode *invp, off_t *inoffp, struct vnode *outvp,
3069     off_t *outoffp, size_t *lenp, unsigned int flags, struct ucred *incred,
3070     struct ucred *outcred, struct thread *fsize_td)
3071 {
3072 	struct mount *inmp, *outmp;
3073 	int error;
3074 	size_t len;
3075 	uint64_t uval;
3076 
3077 	len = *lenp;
3078 	*lenp = 0;		/* For error returns. */
3079 	error = 0;
3080 
3081 	/* Do some sanity checks on the arguments. */
3082 	if (invp->v_type == VDIR || outvp->v_type == VDIR)
3083 		error = EISDIR;
3084 	else if (*inoffp < 0 || *outoffp < 0 ||
3085 	    invp->v_type != VREG || outvp->v_type != VREG)
3086 		error = EINVAL;
3087 	if (error != 0)
3088 		goto out;
3089 
3090 	/* Ensure offset + len does not wrap around. */
3091 	uval = *inoffp;
3092 	uval += len;
3093 	if (uval > INT64_MAX)
3094 		len = INT64_MAX - *inoffp;
3095 	uval = *outoffp;
3096 	uval += len;
3097 	if (uval > INT64_MAX)
3098 		len = INT64_MAX - *outoffp;
3099 	if (len == 0)
3100 		goto out;
3101 
3102 	inmp = invp->v_mount;
3103 	outmp = outvp->v_mount;
3104 	if (inmp == NULL || outmp == NULL) {
3105 		error = EBADF;
3106 		goto out;
3107 	}
3108 
3109 	for (;;) {
3110 		error = vfs_busy(inmp, 0);
3111 		if (error != 0)
3112 			goto out;
3113 		if (inmp == outmp)
3114 			break;
3115 		error = vfs_busy(outmp, MBF_NOWAIT);
3116 		if (error != 0) {
3117 			vfs_unbusy(inmp);
3118 			error = vfs_busy(outmp, 0);
3119 			if (error == 0) {
3120 				vfs_unbusy(outmp);
3121 				continue;
3122 			}
3123 			goto out;
3124 		}
3125 		break;
3126 	}
3127 
3128 	/*
3129 	 * If the two vnodes are for the same file system type, call
3130 	 * VOP_COPY_FILE_RANGE(), otherwise call vn_generic_copy_file_range()
3131 	 * which can handle copies across multiple file system types.
3132 	 */
3133 	*lenp = len;
3134 	if (inmp == outmp || strcmp(inmp->mnt_vfc->vfc_name,
3135 	    outmp->mnt_vfc->vfc_name) == 0)
3136 		error = VOP_COPY_FILE_RANGE(invp, inoffp, outvp, outoffp,
3137 		    lenp, flags, incred, outcred, fsize_td);
3138 	else
3139 		error = vn_generic_copy_file_range(invp, inoffp, outvp,
3140 		    outoffp, lenp, flags, incred, outcred, fsize_td);
3141 	vfs_unbusy(outmp);
3142 	if (inmp != outmp)
3143 		vfs_unbusy(inmp);
3144 out:
3145 	return (error);
3146 }
3147 
3148 /*
3149  * Test len bytes of data starting at dat for all bytes == 0.
3150  * Return true if all bytes are zero, false otherwise.
3151  * Expects dat to be well aligned.
3152  */
3153 static bool
3154 mem_iszero(void *dat, int len)
3155 {
3156 	int i;
3157 	const u_int *p;
3158 	const char *cp;
3159 
3160 	for (p = dat; len > 0; len -= sizeof(*p), p++) {
3161 		if (len >= sizeof(*p)) {
3162 			if (*p != 0)
3163 				return (false);
3164 		} else {
3165 			cp = (const char *)p;
3166 			for (i = 0; i < len; i++, cp++)
3167 				if (*cp != '\0')
3168 					return (false);
3169 		}
3170 	}
3171 	return (true);
3172 }
3173 
3174 /*
3175  * Look for a hole in the output file and, if found, adjust *outoffp
3176  * and *xferp to skip past the hole.
3177  * *xferp is the entire hole length to be written and xfer2 is how many bytes
3178  * to be written as 0's upon return.
3179  */
3180 static off_t
3181 vn_skip_hole(struct vnode *outvp, off_t xfer2, off_t *outoffp, off_t *xferp,
3182     off_t *dataoffp, off_t *holeoffp, struct ucred *cred)
3183 {
3184 	int error;
3185 	off_t delta;
3186 
3187 	if (*holeoffp == 0 || *holeoffp <= *outoffp) {
3188 		*dataoffp = *outoffp;
3189 		error = VOP_IOCTL(outvp, FIOSEEKDATA, dataoffp, 0, cred,
3190 		    curthread);
3191 		if (error == 0) {
3192 			*holeoffp = *dataoffp;
3193 			error = VOP_IOCTL(outvp, FIOSEEKHOLE, holeoffp, 0, cred,
3194 			    curthread);
3195 		}
3196 		if (error != 0 || *holeoffp == *dataoffp) {
3197 			/*
3198 			 * Since outvp is unlocked, it may be possible for
3199 			 * another thread to do a truncate(), lseek(), write()
3200 			 * creating a hole at startoff between the above
3201 			 * VOP_IOCTL() calls, if the other thread does not do
3202 			 * rangelocking.
3203 			 * If that happens, *holeoffp == *dataoffp and finding
3204 			 * the hole has failed, so disable vn_skip_hole().
3205 			 */
3206 			*holeoffp = -1;	/* Disable use of vn_skip_hole(). */
3207 			return (xfer2);
3208 		}
3209 		KASSERT(*dataoffp >= *outoffp,
3210 		    ("vn_skip_hole: dataoff=%jd < outoff=%jd",
3211 		    (intmax_t)*dataoffp, (intmax_t)*outoffp));
3212 		KASSERT(*holeoffp > *dataoffp,
3213 		    ("vn_skip_hole: holeoff=%jd <= dataoff=%jd",
3214 		    (intmax_t)*holeoffp, (intmax_t)*dataoffp));
3215 	}
3216 
3217 	/*
3218 	 * If there is a hole before the data starts, advance *outoffp and
3219 	 * *xferp past the hole.
3220 	 */
3221 	if (*dataoffp > *outoffp) {
3222 		delta = *dataoffp - *outoffp;
3223 		if (delta >= *xferp) {
3224 			/* Entire *xferp is a hole. */
3225 			*outoffp += *xferp;
3226 			*xferp = 0;
3227 			return (0);
3228 		}
3229 		*xferp -= delta;
3230 		*outoffp += delta;
3231 		xfer2 = MIN(xfer2, *xferp);
3232 	}
3233 
3234 	/*
3235 	 * If a hole starts before the end of this xfer2, reduce this xfer2 so
3236 	 * that the write ends at the start of the hole.
3237 	 * *holeoffp should always be greater than *outoffp, but for the
3238 	 * non-INVARIANTS case, check this to make sure xfer2 remains a sane
3239 	 * value.
3240 	 */
3241 	if (*holeoffp > *outoffp && *holeoffp < *outoffp + xfer2)
3242 		xfer2 = *holeoffp - *outoffp;
3243 	return (xfer2);
3244 }
3245 
3246 /*
3247  * Write an xfer sized chunk to outvp in blksize blocks from dat.
3248  * dat is a maximum of blksize in length and can be written repeatedly in
3249  * the chunk.
3250  * If growfile == true, just grow the file via vn_truncate_locked() instead
3251  * of doing actual writes.
3252  * If checkhole == true, a hole is being punched, so skip over any hole
3253  * already in the output file.
3254  */
3255 static int
3256 vn_write_outvp(struct vnode *outvp, char *dat, off_t outoff, off_t xfer,
3257     u_long blksize, bool growfile, bool checkhole, struct ucred *cred)
3258 {
3259 	struct mount *mp;
3260 	off_t dataoff, holeoff, xfer2;
3261 	int error;
3262 
3263 	/*
3264 	 * Loop around doing writes of blksize until write has been completed.
3265 	 * Lock/unlock on each loop iteration so that a bwillwrite() can be
3266 	 * done for each iteration, since the xfer argument can be very
3267 	 * large if there is a large hole to punch in the output file.
3268 	 */
3269 	error = 0;
3270 	holeoff = 0;
3271 	do {
3272 		xfer2 = MIN(xfer, blksize);
3273 		if (checkhole) {
3274 			/*
3275 			 * Punching a hole.  Skip writing if there is
3276 			 * already a hole in the output file.
3277 			 */
3278 			xfer2 = vn_skip_hole(outvp, xfer2, &outoff, &xfer,
3279 			    &dataoff, &holeoff, cred);
3280 			if (xfer == 0)
3281 				break;
3282 			if (holeoff < 0)
3283 				checkhole = false;
3284 			KASSERT(xfer2 > 0, ("vn_write_outvp: xfer2=%jd",
3285 			    (intmax_t)xfer2));
3286 		}
3287 		bwillwrite();
3288 		mp = NULL;
3289 		error = vn_start_write(outvp, &mp, V_WAIT);
3290 		if (error != 0)
3291 			break;
3292 		if (growfile) {
3293 			error = vn_lock(outvp, LK_EXCLUSIVE);
3294 			if (error == 0) {
3295 				error = vn_truncate_locked(outvp, outoff + xfer,
3296 				    false, cred);
3297 				VOP_UNLOCK(outvp);
3298 			}
3299 		} else {
3300 			error = vn_lock(outvp, vn_lktype_write(mp, outvp));
3301 			if (error == 0) {
3302 				error = vn_rdwr(UIO_WRITE, outvp, dat, xfer2,
3303 				    outoff, UIO_SYSSPACE, IO_NODELOCKED,
3304 				    curthread->td_ucred, cred, NULL, curthread);
3305 				outoff += xfer2;
3306 				xfer -= xfer2;
3307 				VOP_UNLOCK(outvp);
3308 			}
3309 		}
3310 		if (mp != NULL)
3311 			vn_finished_write(mp);
3312 	} while (!growfile && xfer > 0 && error == 0);
3313 	return (error);
3314 }
3315 
3316 /*
3317  * Copy a byte range of one file to another.  This function can handle the
3318  * case where invp and outvp are on different file systems.
3319  * It can also be called by a VOP_COPY_FILE_RANGE() to do the work, if there
3320  * is no better file system specific way to do it.
3321  */
3322 int
3323 vn_generic_copy_file_range(struct vnode *invp, off_t *inoffp,
3324     struct vnode *outvp, off_t *outoffp, size_t *lenp, unsigned int flags,
3325     struct ucred *incred, struct ucred *outcred, struct thread *fsize_td)
3326 {
3327 	struct mount *mp;
3328 	off_t startoff, endoff, xfer, xfer2;
3329 	u_long blksize;
3330 	int error, interrupted;
3331 	bool cantseek, readzeros, eof, lastblock, holetoeof;
3332 	ssize_t aresid, r = 0;
3333 	size_t copylen, len, savlen;
3334 	off_t insize, outsize;
3335 	char *dat;
3336 	long holein, holeout;
3337 	struct timespec curts, endts;
3338 
3339 	holein = holeout = 0;
3340 	savlen = len = *lenp;
3341 	error = 0;
3342 	interrupted = 0;
3343 	dat = NULL;
3344 
3345 	error = vn_lock(invp, LK_SHARED);
3346 	if (error != 0)
3347 		goto out;
3348 	if (VOP_PATHCONF(invp, _PC_MIN_HOLE_SIZE, &holein) != 0)
3349 		holein = 0;
3350 	if (holein > 0)
3351 		error = vn_getsize_locked(invp, &insize, incred);
3352 	VOP_UNLOCK(invp);
3353 	if (error != 0)
3354 		goto out;
3355 
3356 	mp = NULL;
3357 	error = vn_start_write(outvp, &mp, V_WAIT);
3358 	if (error == 0)
3359 		error = vn_lock(outvp, LK_EXCLUSIVE);
3360 	if (error == 0) {
3361 		/*
3362 		 * If fsize_td != NULL, do a vn_rlimit_fsizex() call,
3363 		 * now that outvp is locked.
3364 		 */
3365 		if (fsize_td != NULL) {
3366 			struct uio io;
3367 
3368 			io.uio_offset = *outoffp;
3369 			io.uio_resid = len;
3370 			error = vn_rlimit_fsizex(outvp, &io, 0, &r, fsize_td);
3371 			len = savlen = io.uio_resid;
3372 			/*
3373 			 * No need to call vn_rlimit_fsizex_res before return,
3374 			 * since the uio is local.
3375 			 */
3376 		}
3377 		if (VOP_PATHCONF(outvp, _PC_MIN_HOLE_SIZE, &holeout) != 0)
3378 			holeout = 0;
3379 		/*
3380 		 * Holes that are past EOF do not need to be written as a block
3381 		 * of zero bytes.  So, truncate the output file as far as
3382 		 * possible and then use size to decide if writing 0
3383 		 * bytes is necessary in the loop below.
3384 		 */
3385 		if (error == 0)
3386 			error = vn_getsize_locked(outvp, &outsize, outcred);
3387 		if (error == 0 && outsize > *outoffp && outsize <= *outoffp + len) {
3388 #ifdef MAC
3389 			error = mac_vnode_check_write(curthread->td_ucred,
3390 			    outcred, outvp);
3391 			if (error == 0)
3392 #endif
3393 				error = vn_truncate_locked(outvp, *outoffp,
3394 				    false, outcred);
3395 			if (error == 0)
3396 				outsize = *outoffp;
3397 		}
3398 		VOP_UNLOCK(outvp);
3399 	}
3400 	if (mp != NULL)
3401 		vn_finished_write(mp);
3402 	if (error != 0)
3403 		goto out;
3404 
3405 	if (holein == 0 && holeout > 0) {
3406 		/*
3407 		 * For this special case, the input data will be scanned
3408 		 * for blocks of all 0 bytes.  For these blocks, the
3409 		 * write can be skipped for the output file to create
3410 		 * an unallocated region.
3411 		 * Therefore, use the appropriate size for the output file.
3412 		 */
3413 		blksize = holeout;
3414 		if (blksize <= 512) {
3415 			/*
3416 			 * Use f_iosize, since ZFS reports a _PC_MIN_HOLE_SIZE
3417 			 * of 512, although it actually only creates
3418 			 * unallocated regions for blocks >= f_iosize.
3419 			 */
3420 			blksize = outvp->v_mount->mnt_stat.f_iosize;
3421 		}
3422 	} else {
3423 		/*
3424 		 * Use the larger of the two f_iosize values.  If they are
3425 		 * not the same size, one will normally be an exact multiple of
3426 		 * the other, since they are both likely to be a power of 2.
3427 		 */
3428 		blksize = MAX(invp->v_mount->mnt_stat.f_iosize,
3429 		    outvp->v_mount->mnt_stat.f_iosize);
3430 	}
3431 
3432 	/* Clip to sane limits. */
3433 	if (blksize < 4096)
3434 		blksize = 4096;
3435 	else if (blksize > maxphys)
3436 		blksize = maxphys;
3437 	dat = malloc(blksize, M_TEMP, M_WAITOK);
3438 
3439 	/*
3440 	 * If VOP_IOCTL(FIOSEEKHOLE) works for invp, use it and FIOSEEKDATA
3441 	 * to find holes.  Otherwise, just scan the read block for all 0s
3442 	 * in the inner loop where the data copying is done.
3443 	 * Note that some file systems such as NFSv3, NFSv4.0 and NFSv4.1 may
3444 	 * support holes on the server, but do not support FIOSEEKHOLE.
3445 	 * The kernel flag COPY_FILE_RANGE_TIMEO1SEC is used to indicate
3446 	 * that this function should return after 1second with a partial
3447 	 * completion.
3448 	 */
3449 	if ((flags & COPY_FILE_RANGE_TIMEO1SEC) != 0) {
3450 		getnanouptime(&endts);
3451 		endts.tv_sec++;
3452 	} else
3453 		timespecclear(&endts);
3454 	holetoeof = eof = false;
3455 	while (len > 0 && error == 0 && !eof && interrupted == 0) {
3456 		endoff = 0;			/* To shut up compilers. */
3457 		cantseek = true;
3458 		startoff = *inoffp;
3459 		copylen = len;
3460 
3461 		/*
3462 		 * Find the next data area.  If there is just a hole to EOF,
3463 		 * FIOSEEKDATA should fail with ENXIO.
3464 		 * (I do not know if any file system will report a hole to
3465 		 *  EOF via FIOSEEKHOLE, but I am pretty sure FIOSEEKDATA
3466 		 *  will fail for those file systems.)
3467 		 *
3468 		 * For input files that don't support FIOSEEKDATA/FIOSEEKHOLE,
3469 		 * the code just falls through to the inner copy loop.
3470 		 */
3471 		error = EINVAL;
3472 		if (holein > 0) {
3473 			error = VOP_IOCTL(invp, FIOSEEKDATA, &startoff, 0,
3474 			    incred, curthread);
3475 			if (error == ENXIO) {
3476 				startoff = endoff = insize;
3477 				eof = holetoeof = true;
3478 				error = 0;
3479 			}
3480 		}
3481 		if (error == 0 && !holetoeof) {
3482 			endoff = startoff;
3483 			error = VOP_IOCTL(invp, FIOSEEKHOLE, &endoff, 0,
3484 			    incred, curthread);
3485 			/*
3486 			 * Since invp is unlocked, it may be possible for
3487 			 * another thread to do a truncate(), lseek(), write()
3488 			 * creating a hole at startoff between the above
3489 			 * VOP_IOCTL() calls, if the other thread does not do
3490 			 * rangelocking.
3491 			 * If that happens, startoff == endoff and finding
3492 			 * the hole has failed, so set an error.
3493 			 */
3494 			if (error == 0 && startoff == endoff)
3495 				error = EINVAL; /* Any error. Reset to 0. */
3496 		}
3497 		if (error == 0) {
3498 			if (startoff > *inoffp) {
3499 				/* Found hole before data block. */
3500 				xfer = MIN(startoff - *inoffp, len);
3501 				if (*outoffp < outsize) {
3502 					/* Must write 0s to punch hole. */
3503 					xfer2 = MIN(outsize - *outoffp,
3504 					    xfer);
3505 					memset(dat, 0, MIN(xfer2, blksize));
3506 					error = vn_write_outvp(outvp, dat,
3507 					    *outoffp, xfer2, blksize, false,
3508 					    holeout > 0, outcred);
3509 				}
3510 
3511 				if (error == 0 && *outoffp + xfer >
3512 				    outsize && (xfer == len || holetoeof)) {
3513 					/* Grow output file (hole at end). */
3514 					error = vn_write_outvp(outvp, dat,
3515 					    *outoffp, xfer, blksize, true,
3516 					    false, outcred);
3517 				}
3518 				if (error == 0) {
3519 					*inoffp += xfer;
3520 					*outoffp += xfer;
3521 					len -= xfer;
3522 					if (len < savlen) {
3523 						interrupted = sig_intr();
3524 						if (timespecisset(&endts) &&
3525 						    interrupted == 0) {
3526 							getnanouptime(&curts);
3527 							if (timespeccmp(&curts,
3528 							    &endts, >=))
3529 								interrupted =
3530 								    EINTR;
3531 						}
3532 					}
3533 				}
3534 			}
3535 			copylen = MIN(len, endoff - startoff);
3536 			cantseek = false;
3537 		} else {
3538 			cantseek = true;
3539 			startoff = *inoffp;
3540 			copylen = len;
3541 			error = 0;
3542 		}
3543 
3544 		xfer = blksize;
3545 		if (cantseek) {
3546 			/*
3547 			 * Set first xfer to end at a block boundary, so that
3548 			 * holes are more likely detected in the loop below via
3549 			 * the for all bytes 0 method.
3550 			 */
3551 			xfer -= (*inoffp % blksize);
3552 		}
3553 		/* Loop copying the data block. */
3554 		while (copylen > 0 && error == 0 && !eof && interrupted == 0) {
3555 			if (copylen < xfer)
3556 				xfer = copylen;
3557 			error = vn_lock(invp, LK_SHARED);
3558 			if (error != 0)
3559 				goto out;
3560 			error = vn_rdwr(UIO_READ, invp, dat, xfer,
3561 			    startoff, UIO_SYSSPACE, IO_NODELOCKED,
3562 			    curthread->td_ucred, incred, &aresid,
3563 			    curthread);
3564 			VOP_UNLOCK(invp);
3565 			lastblock = false;
3566 			if (error == 0 && aresid > 0) {
3567 				/* Stop the copy at EOF on the input file. */
3568 				xfer -= aresid;
3569 				eof = true;
3570 				lastblock = true;
3571 			}
3572 			if (error == 0) {
3573 				/*
3574 				 * Skip the write for holes past the initial EOF
3575 				 * of the output file, unless this is the last
3576 				 * write of the output file at EOF.
3577 				 */
3578 				readzeros = cantseek ? mem_iszero(dat, xfer) :
3579 				    false;
3580 				if (xfer == len)
3581 					lastblock = true;
3582 				if (!cantseek || *outoffp < outsize ||
3583 				    lastblock || !readzeros)
3584 					error = vn_write_outvp(outvp, dat,
3585 					    *outoffp, xfer, blksize,
3586 					    readzeros && lastblock &&
3587 					    *outoffp >= outsize, false,
3588 					    outcred);
3589 				if (error == 0) {
3590 					*inoffp += xfer;
3591 					startoff += xfer;
3592 					*outoffp += xfer;
3593 					copylen -= xfer;
3594 					len -= xfer;
3595 					if (len < savlen) {
3596 						interrupted = sig_intr();
3597 						if (timespecisset(&endts) &&
3598 						    interrupted == 0) {
3599 							getnanouptime(&curts);
3600 							if (timespeccmp(&curts,
3601 							    &endts, >=))
3602 								interrupted =
3603 								    EINTR;
3604 						}
3605 					}
3606 				}
3607 			}
3608 			xfer = blksize;
3609 		}
3610 	}
3611 out:
3612 	*lenp = savlen - len;
3613 	free(dat, M_TEMP);
3614 	return (error);
3615 }
3616 
3617 static int
3618 vn_fallocate(struct file *fp, off_t offset, off_t len, struct thread *td)
3619 {
3620 	struct mount *mp;
3621 	struct vnode *vp;
3622 	off_t olen, ooffset;
3623 	int error;
3624 #ifdef AUDIT
3625 	int audited_vnode1 = 0;
3626 #endif
3627 
3628 	vp = fp->f_vnode;
3629 	if (vp->v_type != VREG)
3630 		return (ENODEV);
3631 
3632 	/* Allocating blocks may take a long time, so iterate. */
3633 	for (;;) {
3634 		olen = len;
3635 		ooffset = offset;
3636 
3637 		bwillwrite();
3638 		mp = NULL;
3639 		error = vn_start_write(vp, &mp, V_WAIT | V_PCATCH);
3640 		if (error != 0)
3641 			break;
3642 		error = vn_lock(vp, LK_EXCLUSIVE);
3643 		if (error != 0) {
3644 			vn_finished_write(mp);
3645 			break;
3646 		}
3647 #ifdef AUDIT
3648 		if (!audited_vnode1) {
3649 			AUDIT_ARG_VNODE1(vp);
3650 			audited_vnode1 = 1;
3651 		}
3652 #endif
3653 #ifdef MAC
3654 		error = mac_vnode_check_write(td->td_ucred, fp->f_cred, vp);
3655 		if (error == 0)
3656 #endif
3657 			error = VOP_ALLOCATE(vp, &offset, &len, 0,
3658 			    td->td_ucred);
3659 		VOP_UNLOCK(vp);
3660 		vn_finished_write(mp);
3661 
3662 		if (olen + ooffset != offset + len) {
3663 			panic("offset + len changed from %jx/%jx to %jx/%jx",
3664 			    ooffset, olen, offset, len);
3665 		}
3666 		if (error != 0 || len == 0)
3667 			break;
3668 		KASSERT(olen > len, ("Iteration did not make progress?"));
3669 		maybe_yield();
3670 	}
3671 
3672 	return (error);
3673 }
3674 
3675 static int
3676 vn_deallocate_impl(struct vnode *vp, off_t *offset, off_t *length, int flags,
3677     int ioflag, struct ucred *cred, struct ucred *active_cred,
3678     struct ucred *file_cred)
3679 {
3680 	struct mount *mp;
3681 	void *rl_cookie;
3682 	off_t off, len;
3683 	int error;
3684 #ifdef AUDIT
3685 	bool audited_vnode1 = false;
3686 #endif
3687 
3688 	rl_cookie = NULL;
3689 	error = 0;
3690 	mp = NULL;
3691 	off = *offset;
3692 	len = *length;
3693 
3694 	if ((ioflag & (IO_NODELOCKED | IO_RANGELOCKED)) == 0)
3695 		rl_cookie = vn_rangelock_wlock(vp, off, off + len);
3696 	while (len > 0 && error == 0) {
3697 		/*
3698 		 * Try to deallocate the longest range in one pass.
3699 		 * In case a pass takes too long to be executed, it returns
3700 		 * partial result. The residue will be proceeded in the next
3701 		 * pass.
3702 		 */
3703 
3704 		if ((ioflag & IO_NODELOCKED) == 0) {
3705 			bwillwrite();
3706 			if ((error = vn_start_write(vp, &mp,
3707 			    V_WAIT | V_PCATCH)) != 0)
3708 				goto out;
3709 			vn_lock(vp, vn_lktype_write(mp, vp) | LK_RETRY);
3710 		}
3711 #ifdef AUDIT
3712 		if (!audited_vnode1) {
3713 			AUDIT_ARG_VNODE1(vp);
3714 			audited_vnode1 = true;
3715 		}
3716 #endif
3717 
3718 #ifdef MAC
3719 		if ((ioflag & IO_NOMACCHECK) == 0)
3720 			error = mac_vnode_check_write(active_cred, file_cred,
3721 			    vp);
3722 #endif
3723 		if (error == 0)
3724 			error = VOP_DEALLOCATE(vp, &off, &len, flags, ioflag,
3725 			    cred);
3726 
3727 		if ((ioflag & IO_NODELOCKED) == 0) {
3728 			VOP_UNLOCK(vp);
3729 			if (mp != NULL) {
3730 				vn_finished_write(mp);
3731 				mp = NULL;
3732 			}
3733 		}
3734 		if (error == 0 && len != 0)
3735 			maybe_yield();
3736 	}
3737 out:
3738 	if (rl_cookie != NULL)
3739 		vn_rangelock_unlock(vp, rl_cookie);
3740 	*offset = off;
3741 	*length = len;
3742 	return (error);
3743 }
3744 
3745 /*
3746  * This function is supposed to be used in the situations where the deallocation
3747  * is not triggered by a user request.
3748  */
3749 int
3750 vn_deallocate(struct vnode *vp, off_t *offset, off_t *length, int flags,
3751     int ioflag, struct ucred *active_cred, struct ucred *file_cred)
3752 {
3753 	struct ucred *cred;
3754 
3755 	if (*offset < 0 || *length <= 0 || *length > OFF_MAX - *offset ||
3756 	    flags != 0)
3757 		return (EINVAL);
3758 	if (vp->v_type != VREG)
3759 		return (ENODEV);
3760 
3761 	cred = file_cred != NOCRED ? file_cred : active_cred;
3762 	return (vn_deallocate_impl(vp, offset, length, flags, ioflag, cred,
3763 	    active_cred, file_cred));
3764 }
3765 
3766 static int
3767 vn_fspacectl(struct file *fp, int cmd, off_t *offset, off_t *length, int flags,
3768     struct ucred *active_cred, struct thread *td)
3769 {
3770 	int error;
3771 	struct vnode *vp;
3772 	int ioflag;
3773 
3774 	KASSERT(cmd == SPACECTL_DEALLOC, ("vn_fspacectl: Invalid cmd"));
3775 	KASSERT((flags & ~SPACECTL_F_SUPPORTED) == 0,
3776 	    ("vn_fspacectl: non-zero flags"));
3777 	KASSERT(*offset >= 0 && *length > 0 && *length <= OFF_MAX - *offset,
3778 	    ("vn_fspacectl: offset/length overflow or underflow"));
3779 	vp = fp->f_vnode;
3780 
3781 	if (vp->v_type != VREG)
3782 		return (ENODEV);
3783 
3784 	ioflag = get_write_ioflag(fp);
3785 
3786 	switch (cmd) {
3787 	case SPACECTL_DEALLOC:
3788 		error = vn_deallocate_impl(vp, offset, length, flags, ioflag,
3789 		    active_cred, active_cred, fp->f_cred);
3790 		break;
3791 	default:
3792 		panic("vn_fspacectl: unknown cmd %d", cmd);
3793 	}
3794 
3795 	return (error);
3796 }
3797 
3798 /*
3799  * Keep this assert as long as sizeof(struct dirent) is used as the maximum
3800  * entry size.
3801  */
3802 _Static_assert(_GENERIC_MAXDIRSIZ == sizeof(struct dirent),
3803     "'struct dirent' size must be a multiple of its alignment "
3804     "(see _GENERIC_DIRLEN())");
3805 
3806 /*
3807  * Returns successive directory entries through some caller's provided buffer.
3808  *
3809  * This function automatically refills the provided buffer with calls to
3810  * VOP_READDIR() (after MAC permission checks).
3811  *
3812  * 'td' is used for credentials and passed to uiomove().  'dirbuf' is the
3813  * caller's buffer to fill and 'dirbuflen' its allocated size.  'dirbuf' must
3814  * be properly aligned to access 'struct dirent' structures and 'dirbuflen'
3815  * must be greater than GENERIC_MAXDIRSIZ to avoid VOP_READDIR() returning
3816  * EINVAL (the latter is not a strong guarantee (yet); but EINVAL will always
3817  * be returned if this requirement is not verified).  '*dpp' points to the
3818  * current directory entry in the buffer and '*len' contains the remaining
3819  * valid bytes in 'dirbuf' after 'dpp' (including the pointed entry).
3820  *
3821  * At first call (or when restarting the read), '*len' must have been set to 0,
3822  * '*off' to 0 (or any valid start offset) and '*eofflag' to 0.  There are no
3823  * more entries as soon as '*len' is 0 after a call that returned 0.  Calling
3824  * again this function after such a condition is considered an error and EINVAL
3825  * will be returned.  Other possible error codes are those of VOP_READDIR(),
3826  * EINTEGRITY if the returned entries do not pass coherency tests, or EINVAL
3827  * (bad call).  All errors are unrecoverable, i.e., the state ('*len', '*off'
3828  * and '*eofflag') must be re-initialized before a subsequent call.  On error
3829  * or at end of directory, '*dpp' is reset to NULL.
3830  *
3831  * '*len', '*off' and '*eofflag' are internal state the caller should not
3832  * tamper with except as explained above.  '*off' is the next directory offset
3833  * to read from to refill the buffer.  '*eofflag' is set to 0 or 1 by the last
3834  * internal call to VOP_READDIR() that returned without error, indicating
3835  * whether it reached the end of the directory, and to 2 by this function after
3836  * all entries have been read.
3837  */
3838 int
3839 vn_dir_next_dirent(struct vnode *vp, struct thread *td,
3840     char *dirbuf, size_t dirbuflen,
3841     struct dirent **dpp, size_t *len, off_t *off, int *eofflag)
3842 {
3843 	struct dirent *dp = NULL;
3844 	int reclen;
3845 	int error;
3846 	struct uio uio;
3847 	struct iovec iov;
3848 
3849 	ASSERT_VOP_LOCKED(vp, "vnode not locked");
3850 	VNASSERT(vp->v_type == VDIR, vp, ("vnode is not a directory"));
3851 	MPASS2((uintptr_t)dirbuf < (uintptr_t)dirbuf + dirbuflen,
3852 	    "Address space overflow");
3853 
3854 	if (__predict_false(dirbuflen < GENERIC_MAXDIRSIZ)) {
3855 		/* Don't take any chances in this case */
3856 		error = EINVAL;
3857 		goto out;
3858 	}
3859 
3860 	if (*len != 0) {
3861 		dp = *dpp;
3862 
3863 		/*
3864 		 * The caller continued to call us after an error (we set dp to
3865 		 * NULL in a previous iteration).  Bail out right now.
3866 		 */
3867 		if (__predict_false(dp == NULL))
3868 			return (EINVAL);
3869 
3870 		MPASS(*len <= dirbuflen);
3871 		MPASS2((uintptr_t)dirbuf <= (uintptr_t)dp &&
3872 		    (uintptr_t)dp + *len <= (uintptr_t)dirbuf + dirbuflen,
3873 		    "Filled range not inside buffer");
3874 
3875 		reclen = dp->d_reclen;
3876 		if (reclen >= *len) {
3877 			/* End of buffer reached */
3878 			*len = 0;
3879 		} else {
3880 			dp = (struct dirent *)((char *)dp + reclen);
3881 			*len -= reclen;
3882 		}
3883 	}
3884 
3885 	if (*len == 0) {
3886 		dp = NULL;
3887 
3888 		/* Have to refill. */
3889 		switch (*eofflag) {
3890 		case 0:
3891 			break;
3892 
3893 		case 1:
3894 			/* Nothing more to read. */
3895 			*eofflag = 2; /* Remember the caller reached EOF. */
3896 			goto success;
3897 
3898 		default:
3899 			/* The caller didn't test for EOF. */
3900 			error = EINVAL;
3901 			goto out;
3902 		}
3903 
3904 		iov.iov_base = dirbuf;
3905 		iov.iov_len = dirbuflen;
3906 
3907 		uio.uio_iov = &iov;
3908 		uio.uio_iovcnt = 1;
3909 		uio.uio_offset = *off;
3910 		uio.uio_resid = dirbuflen;
3911 		uio.uio_segflg = UIO_SYSSPACE;
3912 		uio.uio_rw = UIO_READ;
3913 		uio.uio_td = td;
3914 
3915 #ifdef MAC
3916 		error = mac_vnode_check_readdir(td->td_ucred, vp);
3917 		if (error == 0)
3918 #endif
3919 			error = VOP_READDIR(vp, &uio, td->td_ucred, eofflag,
3920 			    NULL, NULL);
3921 		if (error != 0)
3922 			goto out;
3923 
3924 		*len = dirbuflen - uio.uio_resid;
3925 		*off = uio.uio_offset;
3926 
3927 		if (*len == 0) {
3928 			/* Sanity check on INVARIANTS. */
3929 			MPASS(*eofflag != 0);
3930 			*eofflag = 1;
3931 			goto success;
3932 		}
3933 
3934 		/*
3935 		 * Normalize the flag returned by VOP_READDIR(), since we use 2
3936 		 * as a sentinel value.
3937 		 */
3938 		if (*eofflag != 0)
3939 			*eofflag = 1;
3940 
3941 		dp = (struct dirent *)dirbuf;
3942 	}
3943 
3944 	if (__predict_false(*len < GENERIC_MINDIRSIZ ||
3945 	    dp->d_reclen < GENERIC_MINDIRSIZ)) {
3946 		error = EINTEGRITY;
3947 		dp = NULL;
3948 		goto out;
3949 	}
3950 
3951 success:
3952 	error = 0;
3953 out:
3954 	*dpp = dp;
3955 	return (error);
3956 }
3957 
3958 /*
3959  * Checks whether a directory is empty or not.
3960  *
3961  * If the directory is empty, returns 0, and if it is not, ENOTEMPTY.  Other
3962  * values are genuine errors preventing the check.
3963  */
3964 int
3965 vn_dir_check_empty(struct vnode *vp)
3966 {
3967 	struct thread *const td = curthread;
3968 	char *dirbuf;
3969 	size_t dirbuflen, len;
3970 	off_t off;
3971 	int eofflag, error;
3972 	struct dirent *dp;
3973 	struct vattr va;
3974 
3975 	ASSERT_VOP_LOCKED(vp, "vfs_emptydir");
3976 	VNPASS(vp->v_type == VDIR, vp);
3977 
3978 	error = VOP_GETATTR(vp, &va, td->td_ucred);
3979 	if (error != 0)
3980 		return (error);
3981 
3982 	dirbuflen = max(DEV_BSIZE, GENERIC_MAXDIRSIZ);
3983 	if (dirbuflen < va.va_blocksize)
3984 		dirbuflen = va.va_blocksize;
3985 	dirbuf = malloc(dirbuflen, M_TEMP, M_WAITOK);
3986 
3987 	len = 0;
3988 	off = 0;
3989 	eofflag = 0;
3990 
3991 	for (;;) {
3992 		error = vn_dir_next_dirent(vp, td, dirbuf, dirbuflen,
3993 		    &dp, &len, &off, &eofflag);
3994 		if (error != 0)
3995 			goto end;
3996 
3997 		if (len == 0) {
3998 			/* EOF */
3999 			error = 0;
4000 			goto end;
4001 		}
4002 
4003 		/*
4004 		 * Skip whiteouts.  Unionfs operates on filesystems only and
4005 		 * not on hierarchies, so these whiteouts would be shadowed on
4006 		 * the system hierarchy but not for a union using the
4007 		 * filesystem of their directories as the upper layer.
4008 		 * Additionally, unionfs currently transparently exposes
4009 		 * union-specific metadata of its upper layer, meaning that
4010 		 * whiteouts can be seen through the union view in empty
4011 		 * directories.  Taking into account these whiteouts would then
4012 		 * prevent mounting another filesystem on such effectively
4013 		 * empty directories.
4014 		 */
4015 		if (dp->d_type == DT_WHT)
4016 			continue;
4017 
4018 		/*
4019 		 * Any file in the directory which is not '.' or '..' indicates
4020 		 * the directory is not empty.
4021 		 */
4022 		switch (dp->d_namlen) {
4023 		case 2:
4024 			if (dp->d_name[1] != '.') {
4025 				/* Can't be '..' (nor '.') */
4026 				error = ENOTEMPTY;
4027 				goto end;
4028 			}
4029 			/* FALLTHROUGH */
4030 		case 1:
4031 			if (dp->d_name[0] != '.') {
4032 				/* Can't be '..' nor '.' */
4033 				error = ENOTEMPTY;
4034 				goto end;
4035 			}
4036 			break;
4037 
4038 		default:
4039 			error = ENOTEMPTY;
4040 			goto end;
4041 		}
4042 	}
4043 
4044 end:
4045 	free(dirbuf, M_TEMP);
4046 	return (error);
4047 }
4048 
4049 
4050 static u_long vn_lock_pair_pause_cnt;
4051 SYSCTL_ULONG(_debug, OID_AUTO, vn_lock_pair_pause, CTLFLAG_RD,
4052     &vn_lock_pair_pause_cnt, 0,
4053     "Count of vn_lock_pair deadlocks");
4054 
4055 u_int vn_lock_pair_pause_max;
4056 SYSCTL_UINT(_debug, OID_AUTO, vn_lock_pair_pause_max, CTLFLAG_RW,
4057     &vn_lock_pair_pause_max, 0,
4058     "Max ticks for vn_lock_pair deadlock avoidance sleep");
4059 
4060 static void
4061 vn_lock_pair_pause(const char *wmesg)
4062 {
4063 	atomic_add_long(&vn_lock_pair_pause_cnt, 1);
4064 	pause(wmesg, prng32_bounded(vn_lock_pair_pause_max));
4065 }
4066 
4067 /*
4068  * Lock pair of (possibly same) vnodes vp1, vp2, avoiding lock order
4069  * reversal.  vp1_locked indicates whether vp1 is locked; if not, vp1
4070  * must be unlocked.  Same for vp2 and vp2_locked.  One of the vnodes
4071  * can be NULL.
4072  *
4073  * The function returns with both vnodes exclusively or shared locked,
4074  * according to corresponding lkflags, and guarantees that it does not
4075  * create lock order reversal with other threads during its execution.
4076  * Both vnodes could be unlocked temporary (and reclaimed).
4077  *
4078  * If requesting shared locking, locked vnode lock must not be recursed.
4079  *
4080  * Only one of LK_SHARED and LK_EXCLUSIVE must be specified.
4081  * LK_NODDLKTREAT can be optionally passed.
4082  *
4083  * If vp1 == vp2, only one, most exclusive, lock is obtained on it.
4084  */
4085 void
4086 vn_lock_pair(struct vnode *vp1, bool vp1_locked, int lkflags1,
4087     struct vnode *vp2, bool vp2_locked, int lkflags2)
4088 {
4089 	int error, locked1;
4090 
4091 	MPASS(((lkflags1 & LK_SHARED) != 0) ^ ((lkflags1 & LK_EXCLUSIVE) != 0));
4092 	MPASS((lkflags1 & ~(LK_SHARED | LK_EXCLUSIVE | LK_NODDLKTREAT)) == 0);
4093 	MPASS(((lkflags2 & LK_SHARED) != 0) ^ ((lkflags2 & LK_EXCLUSIVE) != 0));
4094 	MPASS((lkflags2 & ~(LK_SHARED | LK_EXCLUSIVE | LK_NODDLKTREAT)) == 0);
4095 
4096 	if (vp1 == NULL && vp2 == NULL)
4097 		return;
4098 
4099 	if (vp1 == vp2) {
4100 		MPASS(vp1_locked == vp2_locked);
4101 
4102 		/* Select the most exclusive mode for lock. */
4103 		if ((lkflags1 & LK_TYPE_MASK) != (lkflags2 & LK_TYPE_MASK))
4104 			lkflags1 = (lkflags1 & ~LK_SHARED) | LK_EXCLUSIVE;
4105 
4106 		if (vp1_locked) {
4107 			ASSERT_VOP_LOCKED(vp1, "vp1");
4108 
4109 			/* No need to relock if any lock is exclusive. */
4110 			if ((vp1->v_vnlock->lock_object.lo_flags &
4111 			    LK_NOSHARE) != 0)
4112 				return;
4113 
4114 			locked1 = VOP_ISLOCKED(vp1);
4115 			if (((lkflags1 & LK_SHARED) != 0 &&
4116 			    locked1 != LK_EXCLUSIVE) ||
4117 			    ((lkflags1 & LK_EXCLUSIVE) != 0 &&
4118 			    locked1 == LK_EXCLUSIVE))
4119 				return;
4120 			VOP_UNLOCK(vp1);
4121 		}
4122 
4123 		ASSERT_VOP_UNLOCKED(vp1, "vp1");
4124 		vn_lock(vp1, lkflags1 | LK_RETRY);
4125 		return;
4126 	}
4127 
4128 	if (vp1 != NULL) {
4129 		if ((lkflags1 & LK_SHARED) != 0 &&
4130 		    (vp1->v_vnlock->lock_object.lo_flags & LK_NOSHARE) != 0)
4131 			lkflags1 = (lkflags1 & ~LK_SHARED) | LK_EXCLUSIVE;
4132 		if (vp1_locked && VOP_ISLOCKED(vp1) != LK_EXCLUSIVE) {
4133 			ASSERT_VOP_LOCKED(vp1, "vp1");
4134 			if ((lkflags1 & LK_EXCLUSIVE) != 0) {
4135 				VOP_UNLOCK(vp1);
4136 				ASSERT_VOP_UNLOCKED(vp1,
4137 				    "vp1 shared recursed");
4138 				vp1_locked = false;
4139 			}
4140 		} else if (!vp1_locked)
4141 			ASSERT_VOP_UNLOCKED(vp1, "vp1");
4142 	} else {
4143 		vp1_locked = true;
4144 	}
4145 
4146 	if (vp2 != NULL) {
4147 		if ((lkflags2 & LK_SHARED) != 0 &&
4148 		    (vp2->v_vnlock->lock_object.lo_flags & LK_NOSHARE) != 0)
4149 			lkflags2 = (lkflags2 & ~LK_SHARED) | LK_EXCLUSIVE;
4150 		if (vp2_locked && VOP_ISLOCKED(vp2) != LK_EXCLUSIVE) {
4151 			ASSERT_VOP_LOCKED(vp2, "vp2");
4152 			if ((lkflags2 & LK_EXCLUSIVE) != 0) {
4153 				VOP_UNLOCK(vp2);
4154 				ASSERT_VOP_UNLOCKED(vp2,
4155 				    "vp2 shared recursed");
4156 				vp2_locked = false;
4157 			}
4158 		} else if (!vp2_locked)
4159 			ASSERT_VOP_UNLOCKED(vp2, "vp2");
4160 	} else {
4161 		vp2_locked = true;
4162 	}
4163 
4164 	if (!vp1_locked && !vp2_locked) {
4165 		vn_lock(vp1, lkflags1 | LK_RETRY);
4166 		vp1_locked = true;
4167 	}
4168 
4169 	while (!vp1_locked || !vp2_locked) {
4170 		if (vp1_locked && vp2 != NULL) {
4171 			if (vp1 != NULL) {
4172 				error = VOP_LOCK1(vp2, lkflags2 | LK_NOWAIT,
4173 				    __FILE__, __LINE__);
4174 				if (error == 0)
4175 					break;
4176 				VOP_UNLOCK(vp1);
4177 				vp1_locked = false;
4178 				vn_lock_pair_pause("vlp1");
4179 			}
4180 			vn_lock(vp2, lkflags2 | LK_RETRY);
4181 			vp2_locked = true;
4182 		}
4183 		if (vp2_locked && vp1 != NULL) {
4184 			if (vp2 != NULL) {
4185 				error = VOP_LOCK1(vp1, lkflags1 | LK_NOWAIT,
4186 				    __FILE__, __LINE__);
4187 				if (error == 0)
4188 					break;
4189 				VOP_UNLOCK(vp2);
4190 				vp2_locked = false;
4191 				vn_lock_pair_pause("vlp2");
4192 			}
4193 			vn_lock(vp1, lkflags1 | LK_RETRY);
4194 			vp1_locked = true;
4195 		}
4196 	}
4197 	if (vp1 != NULL) {
4198 		if (lkflags1 == LK_EXCLUSIVE)
4199 			ASSERT_VOP_ELOCKED(vp1, "vp1 ret");
4200 		else
4201 			ASSERT_VOP_LOCKED(vp1, "vp1 ret");
4202 	}
4203 	if (vp2 != NULL) {
4204 		if (lkflags2 == LK_EXCLUSIVE)
4205 			ASSERT_VOP_ELOCKED(vp2, "vp2 ret");
4206 		else
4207 			ASSERT_VOP_LOCKED(vp2, "vp2 ret");
4208 	}
4209 }
4210 
4211 int
4212 vn_lktype_write(struct mount *mp, struct vnode *vp)
4213 {
4214 	if (MNT_SHARED_WRITES(mp) ||
4215 	    (mp == NULL && MNT_SHARED_WRITES(vp->v_mount)))
4216 		return (LK_SHARED);
4217 	return (LK_EXCLUSIVE);
4218 }
4219