xref: /freebsd/sys/ufs/ffs/ffs_vnops.c (revision d0b2dbfa0ecf2bbc9709efc5e20baf8e4b44bbbf)
1 /*-
2  * SPDX-License-Identifier: (BSD-2-Clause AND BSD-3-Clause)
3  *
4  * Copyright (c) 2002, 2003 Networks Associates Technology, Inc.
5  * All rights reserved.
6  *
7  * This software was developed for the FreeBSD Project by Marshall
8  * Kirk McKusick and Network Associates Laboratories, the Security
9  * Research Division of Network Associates, Inc. under DARPA/SPAWAR
10  * contract N66001-01-C-8035 ("CBOSS"), as part of the DARPA CHATS
11  * research program
12  *
13  * Redistribution and use in source and binary forms, with or without
14  * modification, are permitted provided that the following conditions
15  * are met:
16  * 1. Redistributions of source code must retain the above copyright
17  *    notice, this list of conditions and the following disclaimer.
18  * 2. Redistributions in binary form must reproduce the above copyright
19  *    notice, this list of conditions and the following disclaimer in the
20  *    documentation and/or other materials provided with the distribution.
21  *
22  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
23  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
24  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
25  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
26  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
27  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
28  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
29  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
30  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
31  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
32  * SUCH DAMAGE.
33  *
34  * Copyright (c) 1982, 1986, 1989, 1993
35  *	The Regents of the University of California.  All rights reserved.
36  *
37  * Redistribution and use in source and binary forms, with or without
38  * modification, are permitted provided that the following conditions
39  * are met:
40  * 1. Redistributions of source code must retain the above copyright
41  *    notice, this list of conditions and the following disclaimer.
42  * 2. Redistributions in binary form must reproduce the above copyright
43  *    notice, this list of conditions and the following disclaimer in the
44  *    documentation and/or other materials provided with the distribution.
45  * 3. Neither the name of the University nor the names of its contributors
46  *    may be used to endorse or promote products derived from this software
47  *    without specific prior written permission.
48  *
49  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
50  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
51  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
52  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
53  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
54  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
55  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
56  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
57  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
58  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
59  * SUCH DAMAGE.
60  *
61  *	from: @(#)ufs_readwrite.c	8.11 (Berkeley) 5/8/95
62  * from: $FreeBSD: .../ufs/ufs_readwrite.c,v 1.96 2002/08/12 09:22:11 phk ...
63  *	@(#)ffs_vnops.c	8.15 (Berkeley) 5/14/95
64  */
65 
66 #include <sys/cdefs.h>
67 #include "opt_directio.h"
68 #include "opt_ffs.h"
69 #include "opt_ufs.h"
70 
71 #include <sys/param.h>
72 #include <sys/bio.h>
73 #include <sys/systm.h>
74 #include <sys/buf.h>
75 #include <sys/conf.h>
76 #include <sys/extattr.h>
77 #include <sys/kernel.h>
78 #include <sys/limits.h>
79 #include <sys/malloc.h>
80 #include <sys/mount.h>
81 #include <sys/priv.h>
82 #include <sys/rwlock.h>
83 #include <sys/stat.h>
84 #include <sys/sysctl.h>
85 #include <sys/vmmeter.h>
86 #include <sys/vnode.h>
87 
88 #include <vm/vm.h>
89 #include <vm/vm_param.h>
90 #include <vm/vm_extern.h>
91 #include <vm/vm_object.h>
92 #include <vm/vm_page.h>
93 #include <vm/vm_pager.h>
94 #include <vm/vnode_pager.h>
95 
96 #include <ufs/ufs/extattr.h>
97 #include <ufs/ufs/quota.h>
98 #include <ufs/ufs/inode.h>
99 #include <ufs/ufs/ufs_extern.h>
100 #include <ufs/ufs/ufsmount.h>
101 #include <ufs/ufs/dir.h>
102 #ifdef UFS_DIRHASH
103 #include <ufs/ufs/dirhash.h>
104 #endif
105 
106 #include <ufs/ffs/fs.h>
107 #include <ufs/ffs/ffs_extern.h>
108 
109 #define	ALIGNED_TO(ptr, s)	\
110 	(((uintptr_t)(ptr) & (_Alignof(s) - 1)) == 0)
111 
112 #ifdef DIRECTIO
113 extern int	ffs_rawread(struct vnode *vp, struct uio *uio, int *workdone);
114 #endif
115 static vop_fdatasync_t	ffs_fdatasync;
116 static vop_fsync_t	ffs_fsync;
117 static vop_getpages_t	ffs_getpages;
118 static vop_getpages_async_t	ffs_getpages_async;
119 static vop_lock1_t	ffs_lock;
120 #ifdef INVARIANTS
121 static vop_unlock_t	ffs_unlock_debug;
122 #endif
123 static vop_read_t	ffs_read;
124 static vop_write_t	ffs_write;
125 static int	ffs_extread(struct vnode *vp, struct uio *uio, int ioflag);
126 static int	ffs_extwrite(struct vnode *vp, struct uio *uio, int ioflag,
127 		    struct ucred *cred);
128 static vop_strategy_t	ffsext_strategy;
129 static vop_closeextattr_t	ffs_closeextattr;
130 static vop_deleteextattr_t	ffs_deleteextattr;
131 static vop_getextattr_t	ffs_getextattr;
132 static vop_listextattr_t	ffs_listextattr;
133 static vop_openextattr_t	ffs_openextattr;
134 static vop_setextattr_t	ffs_setextattr;
135 static vop_vptofh_t	ffs_vptofh;
136 static vop_vput_pair_t	ffs_vput_pair;
137 
138 /* Global vfs data structures for ufs. */
139 struct vop_vector ffs_vnodeops1 = {
140 	.vop_default =		&ufs_vnodeops,
141 	.vop_fsync =		ffs_fsync,
142 	.vop_fdatasync =	ffs_fdatasync,
143 	.vop_getpages =		ffs_getpages,
144 	.vop_getpages_async =	ffs_getpages_async,
145 	.vop_lock1 =		ffs_lock,
146 #ifdef INVARIANTS
147 	.vop_unlock =		ffs_unlock_debug,
148 #endif
149 	.vop_read =		ffs_read,
150 	.vop_reallocblks =	ffs_reallocblks,
151 	.vop_write =		ffs_write,
152 	.vop_vptofh =		ffs_vptofh,
153 	.vop_vput_pair =	ffs_vput_pair,
154 	.vop_fplookup_vexec =	VOP_EAGAIN,
155 	.vop_fplookup_symlink =	VOP_EAGAIN,
156 };
157 VFS_VOP_VECTOR_REGISTER(ffs_vnodeops1);
158 
159 struct vop_vector ffs_fifoops1 = {
160 	.vop_default =		&ufs_fifoops,
161 	.vop_fsync =		ffs_fsync,
162 	.vop_fdatasync =	ffs_fdatasync,
163 	.vop_lock1 =		ffs_lock,
164 #ifdef INVARIANTS
165 	.vop_unlock =		ffs_unlock_debug,
166 #endif
167 	.vop_vptofh =		ffs_vptofh,
168 	.vop_fplookup_vexec =   VOP_EAGAIN,
169 	.vop_fplookup_symlink = VOP_EAGAIN,
170 };
171 VFS_VOP_VECTOR_REGISTER(ffs_fifoops1);
172 
173 /* Global vfs data structures for ufs. */
174 struct vop_vector ffs_vnodeops2 = {
175 	.vop_default =		&ufs_vnodeops,
176 	.vop_fsync =		ffs_fsync,
177 	.vop_fdatasync =	ffs_fdatasync,
178 	.vop_getpages =		ffs_getpages,
179 	.vop_getpages_async =	ffs_getpages_async,
180 	.vop_lock1 =		ffs_lock,
181 #ifdef INVARIANTS
182 	.vop_unlock =		ffs_unlock_debug,
183 #endif
184 	.vop_read =		ffs_read,
185 	.vop_reallocblks =	ffs_reallocblks,
186 	.vop_write =		ffs_write,
187 	.vop_closeextattr =	ffs_closeextattr,
188 	.vop_deleteextattr =	ffs_deleteextattr,
189 	.vop_getextattr =	ffs_getextattr,
190 	.vop_listextattr =	ffs_listextattr,
191 	.vop_openextattr =	ffs_openextattr,
192 	.vop_setextattr =	ffs_setextattr,
193 	.vop_vptofh =		ffs_vptofh,
194 	.vop_vput_pair =	ffs_vput_pair,
195 	.vop_fplookup_vexec =	VOP_EAGAIN,
196 	.vop_fplookup_symlink =	VOP_EAGAIN,
197 };
198 VFS_VOP_VECTOR_REGISTER(ffs_vnodeops2);
199 
200 struct vop_vector ffs_fifoops2 = {
201 	.vop_default =		&ufs_fifoops,
202 	.vop_fsync =		ffs_fsync,
203 	.vop_fdatasync =	ffs_fdatasync,
204 	.vop_lock1 =		ffs_lock,
205 #ifdef INVARIANTS
206 	.vop_unlock =		ffs_unlock_debug,
207 #endif
208 	.vop_reallocblks =	ffs_reallocblks,
209 	.vop_strategy =		ffsext_strategy,
210 	.vop_closeextattr =	ffs_closeextattr,
211 	.vop_deleteextattr =	ffs_deleteextattr,
212 	.vop_getextattr =	ffs_getextattr,
213 	.vop_listextattr =	ffs_listextattr,
214 	.vop_openextattr =	ffs_openextattr,
215 	.vop_setextattr =	ffs_setextattr,
216 	.vop_vptofh =		ffs_vptofh,
217 	.vop_fplookup_vexec =   VOP_EAGAIN,
218 	.vop_fplookup_symlink = VOP_EAGAIN,
219 };
220 VFS_VOP_VECTOR_REGISTER(ffs_fifoops2);
221 
222 /*
223  * Synch an open file.
224  */
225 /* ARGSUSED */
226 static int
227 ffs_fsync(struct vop_fsync_args *ap)
228 {
229 	struct vnode *vp;
230 	struct bufobj *bo;
231 	int error;
232 
233 	vp = ap->a_vp;
234 	bo = &vp->v_bufobj;
235 retry:
236 	error = ffs_syncvnode(vp, ap->a_waitfor, 0);
237 	if (error)
238 		return (error);
239 	if (ap->a_waitfor == MNT_WAIT && DOINGSOFTDEP(vp)) {
240 		error = softdep_fsync(vp);
241 		if (error)
242 			return (error);
243 
244 		/*
245 		 * The softdep_fsync() function may drop vp lock,
246 		 * allowing for dirty buffers to reappear on the
247 		 * bo_dirty list. Recheck and resync as needed.
248 		 */
249 		BO_LOCK(bo);
250 		if ((vp->v_type == VREG || vp->v_type == VDIR) &&
251 		    (bo->bo_numoutput > 0 || bo->bo_dirty.bv_cnt > 0)) {
252 			BO_UNLOCK(bo);
253 			goto retry;
254 		}
255 		BO_UNLOCK(bo);
256 	}
257 	if (ffs_fsfail_cleanup(VFSTOUFS(vp->v_mount), 0))
258 		return (ENXIO);
259 	return (0);
260 }
261 
262 int
263 ffs_syncvnode(struct vnode *vp, int waitfor, int flags)
264 {
265 	struct inode *ip;
266 	struct bufobj *bo;
267 	struct ufsmount *ump;
268 	struct buf *bp, *nbp;
269 	ufs_lbn_t lbn;
270 	int error, passes, wflag;
271 	bool still_dirty, unlocked, wait;
272 
273 	ip = VTOI(vp);
274 	bo = &vp->v_bufobj;
275 	ump = VFSTOUFS(vp->v_mount);
276 #ifdef WITNESS
277 	wflag = IS_SNAPSHOT(ip) ? LK_NOWITNESS : 0;
278 #else
279 	wflag = 0;
280 #endif
281 
282 	/*
283 	 * When doing MNT_WAIT we must first flush all dependencies
284 	 * on the inode.
285 	 */
286 	if (DOINGSOFTDEP(vp) && waitfor == MNT_WAIT &&
287 	    (error = softdep_sync_metadata(vp)) != 0) {
288 		if (ffs_fsfail_cleanup(ump, error))
289 			error = 0;
290 		return (error);
291 	}
292 
293 	/*
294 	 * Flush all dirty buffers associated with a vnode.
295 	 */
296 	error = 0;
297 	passes = 0;
298 	wait = false;	/* Always do an async pass first. */
299 	unlocked = false;
300 	lbn = lblkno(ITOFS(ip), (ip->i_size + ITOFS(ip)->fs_bsize - 1));
301 	BO_LOCK(bo);
302 loop:
303 	TAILQ_FOREACH(bp, &bo->bo_dirty.bv_hd, b_bobufs)
304 		bp->b_vflags &= ~BV_SCANNED;
305 	TAILQ_FOREACH_SAFE(bp, &bo->bo_dirty.bv_hd, b_bobufs, nbp) {
306 		/*
307 		 * Reasons to skip this buffer: it has already been considered
308 		 * on this pass, the buffer has dependencies that will cause
309 		 * it to be redirtied and it has not already been deferred,
310 		 * or it is already being written.
311 		 */
312 		if ((bp->b_vflags & BV_SCANNED) != 0)
313 			continue;
314 		bp->b_vflags |= BV_SCANNED;
315 		/*
316 		 * Flush indirects in order, if requested.
317 		 *
318 		 * Note that if only datasync is requested, we can
319 		 * skip indirect blocks when softupdates are not
320 		 * active.  Otherwise we must flush them with data,
321 		 * since dependencies prevent data block writes.
322 		 */
323 		if (waitfor == MNT_WAIT && bp->b_lblkno <= -UFS_NDADDR &&
324 		    (lbn_level(bp->b_lblkno) >= passes ||
325 		    ((flags & DATA_ONLY) != 0 && !DOINGSOFTDEP(vp))))
326 			continue;
327 		if (bp->b_lblkno > lbn)
328 			panic("ffs_syncvnode: syncing truncated data.");
329 		if (BUF_LOCK(bp, LK_EXCLUSIVE | LK_NOWAIT, NULL) == 0) {
330 			BO_UNLOCK(bo);
331 		} else if (wait) {
332 			if (BUF_LOCK(bp, LK_EXCLUSIVE | LK_SLEEPFAIL |
333 			    LK_INTERLOCK | wflag, BO_LOCKPTR(bo)) != 0) {
334 				BO_LOCK(bo);
335 				bp->b_vflags &= ~BV_SCANNED;
336 				goto next_locked;
337 			}
338 		} else
339 			continue;
340 		if ((bp->b_flags & B_DELWRI) == 0)
341 			panic("ffs_fsync: not dirty");
342 		/*
343 		 * Check for dependencies and potentially complete them.
344 		 */
345 		if (!LIST_EMPTY(&bp->b_dep) &&
346 		    (error = softdep_sync_buf(vp, bp,
347 		    wait ? MNT_WAIT : MNT_NOWAIT)) != 0) {
348 			/*
349 			 * Lock order conflict, buffer was already unlocked,
350 			 * and vnode possibly unlocked.
351 			 */
352 			if (error == ERELOOKUP) {
353 				if (vp->v_data == NULL)
354 					return (EBADF);
355 				unlocked = true;
356 				if (DOINGSOFTDEP(vp) && waitfor == MNT_WAIT &&
357 				    (error = softdep_sync_metadata(vp)) != 0) {
358 					if (ffs_fsfail_cleanup(ump, error))
359 						error = 0;
360 					return (unlocked && error == 0 ?
361 					    ERELOOKUP : error);
362 				}
363 				/* Re-evaluate inode size */
364 				lbn = lblkno(ITOFS(ip), (ip->i_size +
365 				    ITOFS(ip)->fs_bsize - 1));
366 				goto next;
367 			}
368 			/* I/O error. */
369 			if (error != EBUSY) {
370 				BUF_UNLOCK(bp);
371 				return (error);
372 			}
373 			/* If we deferred once, don't defer again. */
374 		    	if ((bp->b_flags & B_DEFERRED) == 0) {
375 				bp->b_flags |= B_DEFERRED;
376 				BUF_UNLOCK(bp);
377 				goto next;
378 			}
379 		}
380 		if (wait) {
381 			bremfree(bp);
382 			error = bwrite(bp);
383 			if (ffs_fsfail_cleanup(ump, error))
384 				error = 0;
385 			if (error != 0)
386 				return (error);
387 		} else if ((bp->b_flags & B_CLUSTEROK)) {
388 			(void) vfs_bio_awrite(bp);
389 		} else {
390 			bremfree(bp);
391 			(void) bawrite(bp);
392 		}
393 next:
394 		/*
395 		 * Since we may have slept during the I/O, we need
396 		 * to start from a known point.
397 		 */
398 		BO_LOCK(bo);
399 next_locked:
400 		nbp = TAILQ_FIRST(&bo->bo_dirty.bv_hd);
401 	}
402 	if (waitfor != MNT_WAIT) {
403 		BO_UNLOCK(bo);
404 		if ((flags & NO_INO_UPDT) != 0)
405 			return (unlocked ? ERELOOKUP : 0);
406 		error = ffs_update(vp, 0);
407 		if (error == 0 && unlocked)
408 			error = ERELOOKUP;
409 		return (error);
410 	}
411 	/* Drain IO to see if we're done. */
412 	bufobj_wwait(bo, 0, 0);
413 	/*
414 	 * Block devices associated with filesystems may have new I/O
415 	 * requests posted for them even if the vnode is locked, so no
416 	 * amount of trying will get them clean.  We make several passes
417 	 * as a best effort.
418 	 *
419 	 * Regular files may need multiple passes to flush all dependency
420 	 * work as it is possible that we must write once per indirect
421 	 * level, once for the leaf, and once for the inode and each of
422 	 * these will be done with one sync and one async pass.
423 	 */
424 	if (bo->bo_dirty.bv_cnt > 0) {
425 		if ((flags & DATA_ONLY) == 0) {
426 			still_dirty = true;
427 		} else {
428 			/*
429 			 * For data-only sync, dirty indirect buffers
430 			 * are ignored.
431 			 */
432 			still_dirty = false;
433 			TAILQ_FOREACH(bp, &bo->bo_dirty.bv_hd, b_bobufs) {
434 				if (bp->b_lblkno > -UFS_NDADDR) {
435 					still_dirty = true;
436 					break;
437 				}
438 			}
439 		}
440 
441 		if (still_dirty) {
442 			/* Write the inode after sync passes to flush deps. */
443 			if (wait && DOINGSOFTDEP(vp) &&
444 			    (flags & NO_INO_UPDT) == 0) {
445 				BO_UNLOCK(bo);
446 				ffs_update(vp, 1);
447 				BO_LOCK(bo);
448 			}
449 			/* switch between sync/async. */
450 			wait = !wait;
451 			if (wait || ++passes < UFS_NIADDR + 2)
452 				goto loop;
453 		}
454 	}
455 	BO_UNLOCK(bo);
456 	error = 0;
457 	if ((flags & DATA_ONLY) == 0) {
458 		if ((flags & NO_INO_UPDT) == 0)
459 			error = ffs_update(vp, 1);
460 		if (DOINGSUJ(vp))
461 			softdep_journal_fsync(VTOI(vp));
462 	} else if ((ip->i_flags & (IN_SIZEMOD | IN_IBLKDATA)) != 0) {
463 		error = ffs_update(vp, 1);
464 	}
465 	if (error == 0 && unlocked)
466 		error = ERELOOKUP;
467 	if (error == 0)
468 		ip->i_flag &= ~IN_NEEDSYNC;
469 	return (error);
470 }
471 
472 static int
473 ffs_fdatasync(struct vop_fdatasync_args *ap)
474 {
475 
476 	return (ffs_syncvnode(ap->a_vp, MNT_WAIT, DATA_ONLY));
477 }
478 
479 static int
480 ffs_lock(
481 	struct vop_lock1_args /* {
482 		struct vnode *a_vp;
483 		int a_flags;
484 		char *file;
485 		int line;
486 	} */ *ap)
487 {
488 #if !defined(NO_FFS_SNAPSHOT) || defined(DIAGNOSTIC)
489 	struct vnode *vp = ap->a_vp;
490 #endif	/* !NO_FFS_SNAPSHOT || DIAGNOSTIC */
491 #ifdef DIAGNOSTIC
492 	struct inode *ip;
493 #endif	/* DIAGNOSTIC */
494 	int result;
495 #ifndef NO_FFS_SNAPSHOT
496 	int flags;
497 	struct lock *lkp;
498 
499 	/*
500 	 * Adaptive spinning mixed with SU leads to trouble. use a giant hammer
501 	 * and only use it when LK_NODDLKTREAT is set. Currently this means it
502 	 * is only used during path lookup.
503 	 */
504 	if ((ap->a_flags & LK_NODDLKTREAT) != 0)
505 		ap->a_flags |= LK_ADAPTIVE;
506 	switch (ap->a_flags & LK_TYPE_MASK) {
507 	case LK_SHARED:
508 	case LK_UPGRADE:
509 	case LK_EXCLUSIVE:
510 		flags = ap->a_flags;
511 		for (;;) {
512 #ifdef DEBUG_VFS_LOCKS
513 			VNPASS(vp->v_holdcnt != 0, vp);
514 #endif	/* DEBUG_VFS_LOCKS */
515 			lkp = vp->v_vnlock;
516 			result = lockmgr_lock_flags(lkp, flags,
517 			    &VI_MTX(vp)->lock_object, ap->a_file, ap->a_line);
518 			if (lkp == vp->v_vnlock || result != 0)
519 				break;
520 			/*
521 			 * Apparent success, except that the vnode
522 			 * mutated between snapshot file vnode and
523 			 * regular file vnode while this process
524 			 * slept.  The lock currently held is not the
525 			 * right lock.  Release it, and try to get the
526 			 * new lock.
527 			 */
528 			lockmgr_unlock(lkp);
529 			if ((flags & (LK_INTERLOCK | LK_NOWAIT)) ==
530 			    (LK_INTERLOCK | LK_NOWAIT))
531 				return (EBUSY);
532 			if ((flags & LK_TYPE_MASK) == LK_UPGRADE)
533 				flags = (flags & ~LK_TYPE_MASK) | LK_EXCLUSIVE;
534 			flags &= ~LK_INTERLOCK;
535 		}
536 #ifdef DIAGNOSTIC
537 		switch (ap->a_flags & LK_TYPE_MASK) {
538 		case LK_UPGRADE:
539 		case LK_EXCLUSIVE:
540 			if (result == 0 && vp->v_vnlock->lk_recurse == 0) {
541 				ip = VTOI(vp);
542 				if (ip != NULL)
543 					ip->i_lock_gen++;
544 			}
545 		}
546 #endif	/* DIAGNOSTIC */
547 		break;
548 	default:
549 #ifdef DIAGNOSTIC
550 		if ((ap->a_flags & LK_TYPE_MASK) == LK_DOWNGRADE) {
551 			ip = VTOI(vp);
552 			if (ip != NULL)
553 				ufs_unlock_tracker(ip);
554 		}
555 #endif	/* DIAGNOSTIC */
556 		result = VOP_LOCK1_APV(&ufs_vnodeops, ap);
557 		break;
558 	}
559 #else	/* NO_FFS_SNAPSHOT */
560 	/*
561 	 * See above for an explanation.
562 	 */
563 	if ((ap->a_flags & LK_NODDLKTREAT) != 0)
564 		ap->a_flags |= LK_ADAPTIVE;
565 #ifdef DIAGNOSTIC
566 	if ((ap->a_flags & LK_TYPE_MASK) == LK_DOWNGRADE) {
567 		ip = VTOI(vp);
568 		if (ip != NULL)
569 			ufs_unlock_tracker(ip);
570 	}
571 #endif	/* DIAGNOSTIC */
572 	result =  VOP_LOCK1_APV(&ufs_vnodeops, ap);
573 #endif	/* NO_FFS_SNAPSHOT */
574 #ifdef DIAGNOSTIC
575 	switch (ap->a_flags & LK_TYPE_MASK) {
576 	case LK_UPGRADE:
577 	case LK_EXCLUSIVE:
578 		if (result == 0 && vp->v_vnlock->lk_recurse == 0) {
579 			ip = VTOI(vp);
580 			if (ip != NULL)
581 				ip->i_lock_gen++;
582 		}
583 	}
584 #endif	/* DIAGNOSTIC */
585 	return (result);
586 }
587 
588 #ifdef INVARIANTS
589 static int
590 ffs_unlock_debug(struct vop_unlock_args *ap)
591 {
592 	struct vnode *vp;
593 	struct inode *ip;
594 
595 	vp = ap->a_vp;
596 	ip = VTOI(vp);
597 	if (ip->i_flag & UFS_INODE_FLAG_LAZY_MASK_ASSERTABLE) {
598 		if ((vp->v_mflag & VMP_LAZYLIST) == 0) {
599 			VI_LOCK(vp);
600 			VNASSERT((vp->v_mflag & VMP_LAZYLIST), vp,
601 			    ("%s: modified vnode (%x) not on lazy list",
602 			    __func__, ip->i_flag));
603 			VI_UNLOCK(vp);
604 		}
605 	}
606 	KASSERT(vp->v_type != VDIR || vp->v_vnlock->lk_recurse != 0 ||
607 	    (ip->i_flag & IN_ENDOFF) == 0,
608 	    ("ufs dir vp %p ip %p flags %#x", vp, ip, ip->i_flag));
609 #ifdef DIAGNOSTIC
610 	if (VOP_ISLOCKED(vp) == LK_EXCLUSIVE && ip != NULL &&
611 	    vp->v_vnlock->lk_recurse == 0)
612 		ufs_unlock_tracker(ip);
613 #endif
614 	return (VOP_UNLOCK_APV(&ufs_vnodeops, ap));
615 }
616 #endif
617 
618 static int
619 ffs_read_hole(struct uio *uio, long xfersize, long *size)
620 {
621 	ssize_t saved_resid, tlen;
622 	int error;
623 
624 	while (xfersize > 0) {
625 		tlen = min(xfersize, ZERO_REGION_SIZE);
626 		saved_resid = uio->uio_resid;
627 		error = vn_io_fault_uiomove(__DECONST(void *, zero_region),
628 		    tlen, uio);
629 		if (error != 0)
630 			return (error);
631 		tlen = saved_resid - uio->uio_resid;
632 		xfersize -= tlen;
633 		*size -= tlen;
634 	}
635 	return (0);
636 }
637 
638 /*
639  * Vnode op for reading.
640  */
641 static int
642 ffs_read(
643 	struct vop_read_args /* {
644 		struct vnode *a_vp;
645 		struct uio *a_uio;
646 		int a_ioflag;
647 		struct ucred *a_cred;
648 	} */ *ap)
649 {
650 	struct vnode *vp;
651 	struct inode *ip;
652 	struct uio *uio;
653 	struct fs *fs;
654 	struct buf *bp;
655 	ufs_lbn_t lbn, nextlbn;
656 	off_t bytesinfile;
657 	long size, xfersize, blkoffset;
658 	ssize_t orig_resid;
659 	int bflag, error, ioflag, seqcount;
660 
661 	vp = ap->a_vp;
662 	uio = ap->a_uio;
663 	ioflag = ap->a_ioflag;
664 	if (ap->a_ioflag & IO_EXT)
665 #ifdef notyet
666 		return (ffs_extread(vp, uio, ioflag));
667 #else
668 		panic("ffs_read+IO_EXT");
669 #endif
670 #ifdef DIRECTIO
671 	if ((ioflag & IO_DIRECT) != 0) {
672 		int workdone;
673 
674 		error = ffs_rawread(vp, uio, &workdone);
675 		if (error != 0 || workdone != 0)
676 			return error;
677 	}
678 #endif
679 
680 	seqcount = ap->a_ioflag >> IO_SEQSHIFT;
681 	ip = VTOI(vp);
682 
683 #ifdef INVARIANTS
684 	if (uio->uio_rw != UIO_READ)
685 		panic("ffs_read: mode");
686 
687 	if (vp->v_type == VLNK) {
688 		if ((int)ip->i_size < VFSTOUFS(vp->v_mount)->um_maxsymlinklen)
689 			panic("ffs_read: short symlink");
690 	} else if (vp->v_type != VREG && vp->v_type != VDIR)
691 		panic("ffs_read: type %d",  vp->v_type);
692 #endif
693 	orig_resid = uio->uio_resid;
694 	KASSERT(orig_resid >= 0, ("ffs_read: uio->uio_resid < 0"));
695 	if (orig_resid == 0)
696 		return (0);
697 	KASSERT(uio->uio_offset >= 0, ("ffs_read: uio->uio_offset < 0"));
698 	fs = ITOFS(ip);
699 	if (uio->uio_offset < ip->i_size &&
700 	    uio->uio_offset >= fs->fs_maxfilesize)
701 		return (EOVERFLOW);
702 
703 	bflag = GB_UNMAPPED | (uio->uio_segflg == UIO_NOCOPY ? 0 : GB_NOSPARSE);
704 #ifdef WITNESS
705 	bflag |= IS_SNAPSHOT(ip) ? GB_NOWITNESS : 0;
706 #endif
707 	for (error = 0, bp = NULL; uio->uio_resid > 0; bp = NULL) {
708 		if ((bytesinfile = ip->i_size - uio->uio_offset) <= 0)
709 			break;
710 		lbn = lblkno(fs, uio->uio_offset);
711 		nextlbn = lbn + 1;
712 
713 		/*
714 		 * size of buffer.  The buffer representing the
715 		 * end of the file is rounded up to the size of
716 		 * the block type ( fragment or full block,
717 		 * depending ).
718 		 */
719 		size = blksize(fs, ip, lbn);
720 		blkoffset = blkoff(fs, uio->uio_offset);
721 
722 		/*
723 		 * The amount we want to transfer in this iteration is
724 		 * one FS block less the amount of the data before
725 		 * our startpoint (duh!)
726 		 */
727 		xfersize = fs->fs_bsize - blkoffset;
728 
729 		/*
730 		 * But if we actually want less than the block,
731 		 * or the file doesn't have a whole block more of data,
732 		 * then use the lesser number.
733 		 */
734 		if (uio->uio_resid < xfersize)
735 			xfersize = uio->uio_resid;
736 		if (bytesinfile < xfersize)
737 			xfersize = bytesinfile;
738 
739 		if (lblktosize(fs, nextlbn) >= ip->i_size) {
740 			/*
741 			 * Don't do readahead if this is the end of the file.
742 			 */
743 			error = bread_gb(vp, lbn, size, NOCRED, bflag, &bp);
744 		} else if ((vp->v_mount->mnt_flag & MNT_NOCLUSTERR) == 0) {
745 			/*
746 			 * Otherwise if we are allowed to cluster,
747 			 * grab as much as we can.
748 			 *
749 			 * XXX  This may not be a win if we are not
750 			 * doing sequential access.
751 			 */
752 			error = cluster_read(vp, ip->i_size, lbn,
753 			    size, NOCRED, blkoffset + uio->uio_resid,
754 			    seqcount, bflag, &bp);
755 		} else if (seqcount > 1) {
756 			/*
757 			 * If we are NOT allowed to cluster, then
758 			 * if we appear to be acting sequentially,
759 			 * fire off a request for a readahead
760 			 * as well as a read. Note that the 4th and 5th
761 			 * arguments point to arrays of the size specified in
762 			 * the 6th argument.
763 			 */
764 			int nextsize = blksize(fs, ip, nextlbn);
765 			error = breadn_flags(vp, lbn, lbn, size, &nextlbn,
766 			    &nextsize, 1, NOCRED, bflag, NULL, &bp);
767 		} else {
768 			/*
769 			 * Failing all of the above, just read what the
770 			 * user asked for. Interestingly, the same as
771 			 * the first option above.
772 			 */
773 			error = bread_gb(vp, lbn, size, NOCRED, bflag, &bp);
774 		}
775 		if (error == EJUSTRETURN) {
776 			error = ffs_read_hole(uio, xfersize, &size);
777 			if (error == 0)
778 				continue;
779 		}
780 		if (error != 0) {
781 			brelse(bp);
782 			bp = NULL;
783 			break;
784 		}
785 
786 		/*
787 		 * We should only get non-zero b_resid when an I/O error
788 		 * has occurred, which should cause us to break above.
789 		 * However, if the short read did not cause an error,
790 		 * then we want to ensure that we do not uiomove bad
791 		 * or uninitialized data.
792 		 */
793 		size -= bp->b_resid;
794 		if (size < xfersize) {
795 			if (size == 0)
796 				break;
797 			xfersize = size;
798 		}
799 
800 		if (buf_mapped(bp)) {
801 			error = vn_io_fault_uiomove((char *)bp->b_data +
802 			    blkoffset, (int)xfersize, uio);
803 		} else {
804 			error = vn_io_fault_pgmove(bp->b_pages,
805 			    blkoffset + (bp->b_offset & PAGE_MASK),
806 			    (int)xfersize, uio);
807 		}
808 		if (error)
809 			break;
810 
811 		vfs_bio_brelse(bp, ioflag);
812 	}
813 
814 	/*
815 	 * This can only happen in the case of an error
816 	 * because the loop above resets bp to NULL on each iteration
817 	 * and on normal completion has not set a new value into it.
818 	 * so it must have come from a 'break' statement
819 	 */
820 	if (bp != NULL)
821 		vfs_bio_brelse(bp, ioflag);
822 
823 	if ((error == 0 || uio->uio_resid != orig_resid) &&
824 	    (vp->v_mount->mnt_flag & (MNT_NOATIME | MNT_RDONLY)) == 0)
825 		UFS_INODE_SET_FLAG_SHARED(ip, IN_ACCESS);
826 	return (error);
827 }
828 
829 /*
830  * Vnode op for writing.
831  */
832 static int
833 ffs_write(
834 	struct vop_write_args /* {
835 		struct vnode *a_vp;
836 		struct uio *a_uio;
837 		int a_ioflag;
838 		struct ucred *a_cred;
839 	} */ *ap)
840 {
841 	struct vnode *vp;
842 	struct uio *uio;
843 	struct inode *ip;
844 	struct fs *fs;
845 	struct buf *bp;
846 	ufs_lbn_t lbn;
847 	off_t osize;
848 	ssize_t resid, r;
849 	int seqcount;
850 	int blkoffset, error, flags, ioflag, size, xfersize;
851 
852 	vp = ap->a_vp;
853 	if (DOINGSUJ(vp))
854 		softdep_prealloc(vp, MNT_WAIT);
855 	if (vp->v_data == NULL)
856 		return (EBADF);
857 
858 	uio = ap->a_uio;
859 	ioflag = ap->a_ioflag;
860 	if (ap->a_ioflag & IO_EXT)
861 #ifdef notyet
862 		return (ffs_extwrite(vp, uio, ioflag, ap->a_cred));
863 #else
864 		panic("ffs_write+IO_EXT");
865 #endif
866 
867 	seqcount = ap->a_ioflag >> IO_SEQSHIFT;
868 	ip = VTOI(vp);
869 
870 #ifdef INVARIANTS
871 	if (uio->uio_rw != UIO_WRITE)
872 		panic("ffs_write: mode");
873 #endif
874 
875 	switch (vp->v_type) {
876 	case VREG:
877 		if (ioflag & IO_APPEND)
878 			uio->uio_offset = ip->i_size;
879 		if ((ip->i_flags & APPEND) && uio->uio_offset != ip->i_size)
880 			return (EPERM);
881 		/* FALLTHROUGH */
882 	case VLNK:
883 		break;
884 	case VDIR:
885 		panic("ffs_write: dir write");
886 		break;
887 	default:
888 		panic("ffs_write: type %p %d (%d,%d)", vp, (int)vp->v_type,
889 			(int)uio->uio_offset,
890 			(int)uio->uio_resid
891 		);
892 	}
893 
894 	KASSERT(uio->uio_resid >= 0, ("ffs_write: uio->uio_resid < 0"));
895 	KASSERT(uio->uio_offset >= 0, ("ffs_write: uio->uio_offset < 0"));
896 	fs = ITOFS(ip);
897 
898 	/*
899 	 * Maybe this should be above the vnode op call, but so long as
900 	 * file servers have no limits, I don't think it matters.
901 	 */
902 	error = vn_rlimit_fsizex(vp, uio, fs->fs_maxfilesize, &r,
903 	    uio->uio_td);
904 	if (error != 0) {
905 		vn_rlimit_fsizex_res(uio, r);
906 		return (error);
907 	}
908 
909 	resid = uio->uio_resid;
910 	osize = ip->i_size;
911 	if (seqcount > BA_SEQMAX)
912 		flags = BA_SEQMAX << BA_SEQSHIFT;
913 	else
914 		flags = seqcount << BA_SEQSHIFT;
915 	if (ioflag & IO_SYNC)
916 		flags |= IO_SYNC;
917 	flags |= BA_UNMAPPED;
918 
919 	for (error = 0; uio->uio_resid > 0;) {
920 		lbn = lblkno(fs, uio->uio_offset);
921 		blkoffset = blkoff(fs, uio->uio_offset);
922 		xfersize = fs->fs_bsize - blkoffset;
923 		if (uio->uio_resid < xfersize)
924 			xfersize = uio->uio_resid;
925 		if (uio->uio_offset + xfersize > ip->i_size)
926 			vnode_pager_setsize(vp, uio->uio_offset + xfersize);
927 
928 		/*
929 		 * We must perform a read-before-write if the transfer size
930 		 * does not cover the entire buffer.
931 		 */
932 		if (fs->fs_bsize > xfersize)
933 			flags |= BA_CLRBUF;
934 		else
935 			flags &= ~BA_CLRBUF;
936 /* XXX is uio->uio_offset the right thing here? */
937 		error = UFS_BALLOC(vp, uio->uio_offset, xfersize,
938 		    ap->a_cred, flags, &bp);
939 		if (error != 0) {
940 			vnode_pager_setsize(vp, ip->i_size);
941 			break;
942 		}
943 		if ((ioflag & (IO_SYNC|IO_INVAL)) == (IO_SYNC|IO_INVAL))
944 			bp->b_flags |= B_NOCACHE;
945 
946 		if (uio->uio_offset + xfersize > ip->i_size) {
947 			ip->i_size = uio->uio_offset + xfersize;
948 			DIP_SET(ip, i_size, ip->i_size);
949 			UFS_INODE_SET_FLAG(ip, IN_SIZEMOD | IN_CHANGE);
950 		}
951 
952 		size = blksize(fs, ip, lbn) - bp->b_resid;
953 		if (size < xfersize)
954 			xfersize = size;
955 
956 		if (buf_mapped(bp)) {
957 			error = vn_io_fault_uiomove((char *)bp->b_data +
958 			    blkoffset, (int)xfersize, uio);
959 		} else {
960 			error = vn_io_fault_pgmove(bp->b_pages,
961 			    blkoffset + (bp->b_offset & PAGE_MASK),
962 			    (int)xfersize, uio);
963 		}
964 		/*
965 		 * If the buffer is not already filled and we encounter an
966 		 * error while trying to fill it, we have to clear out any
967 		 * garbage data from the pages instantiated for the buffer.
968 		 * If we do not, a failed uiomove() during a write can leave
969 		 * the prior contents of the pages exposed to a userland mmap.
970 		 *
971 		 * Note that we need only clear buffers with a transfer size
972 		 * equal to the block size because buffers with a shorter
973 		 * transfer size were cleared above by the call to UFS_BALLOC()
974 		 * with the BA_CLRBUF flag set.
975 		 *
976 		 * If the source region for uiomove identically mmaps the
977 		 * buffer, uiomove() performed the NOP copy, and the buffer
978 		 * content remains valid because the page fault handler
979 		 * validated the pages.
980 		 */
981 		if (error != 0 && (bp->b_flags & B_CACHE) == 0 &&
982 		    fs->fs_bsize == xfersize)
983 			vfs_bio_clrbuf(bp);
984 
985 		vfs_bio_set_flags(bp, ioflag);
986 
987 		/*
988 		 * If IO_SYNC each buffer is written synchronously.  Otherwise
989 		 * if we have a severe page deficiency write the buffer
990 		 * asynchronously.  Otherwise try to cluster, and if that
991 		 * doesn't do it then either do an async write (if O_DIRECT),
992 		 * or a delayed write (if not).
993 		 */
994 		if (ioflag & IO_SYNC) {
995 			(void)bwrite(bp);
996 		} else if (vm_page_count_severe() ||
997 			    buf_dirty_count_severe() ||
998 			    (ioflag & IO_ASYNC)) {
999 			bp->b_flags |= B_CLUSTEROK;
1000 			bawrite(bp);
1001 		} else if (xfersize + blkoffset == fs->fs_bsize) {
1002 			if ((vp->v_mount->mnt_flag & MNT_NOCLUSTERW) == 0) {
1003 				bp->b_flags |= B_CLUSTEROK;
1004 				cluster_write(vp, &ip->i_clusterw, bp,
1005 				    ip->i_size, seqcount, GB_UNMAPPED);
1006 			} else {
1007 				bawrite(bp);
1008 			}
1009 		} else if (ioflag & IO_DIRECT) {
1010 			bp->b_flags |= B_CLUSTEROK;
1011 			bawrite(bp);
1012 		} else {
1013 			bp->b_flags |= B_CLUSTEROK;
1014 			bdwrite(bp);
1015 		}
1016 		if (error || xfersize == 0)
1017 			break;
1018 		UFS_INODE_SET_FLAG(ip, IN_CHANGE | IN_UPDATE);
1019 	}
1020 	/*
1021 	 * If we successfully wrote any data, and we are not the superuser
1022 	 * we clear the setuid and setgid bits as a precaution against
1023 	 * tampering.
1024 	 */
1025 	if ((ip->i_mode & (ISUID | ISGID)) && resid > uio->uio_resid &&
1026 	    ap->a_cred) {
1027 		if (priv_check_cred(ap->a_cred, PRIV_VFS_RETAINSUGID)) {
1028 			vn_seqc_write_begin(vp);
1029 			UFS_INODE_SET_MODE(ip, ip->i_mode & ~(ISUID | ISGID));
1030 			DIP_SET(ip, i_mode, ip->i_mode);
1031 			vn_seqc_write_end(vp);
1032 		}
1033 	}
1034 	if (error) {
1035 		if (ioflag & IO_UNIT) {
1036 			(void)ffs_truncate(vp, osize,
1037 			    IO_NORMAL | (ioflag & IO_SYNC), ap->a_cred);
1038 			uio->uio_offset -= resid - uio->uio_resid;
1039 			uio->uio_resid = resid;
1040 		}
1041 	} else if (resid > uio->uio_resid && (ioflag & IO_SYNC)) {
1042 		if (!(ioflag & IO_DATASYNC) ||
1043 		    (ip->i_flags & (IN_SIZEMOD | IN_IBLKDATA)))
1044 			error = ffs_update(vp, 1);
1045 		if (ffs_fsfail_cleanup(VFSTOUFS(vp->v_mount), error))
1046 			error = ENXIO;
1047 	}
1048 	vn_rlimit_fsizex_res(uio, r);
1049 	return (error);
1050 }
1051 
1052 /*
1053  * Extended attribute area reading.
1054  */
1055 static int
1056 ffs_extread(struct vnode *vp, struct uio *uio, int ioflag)
1057 {
1058 	struct inode *ip;
1059 	struct ufs2_dinode *dp;
1060 	struct fs *fs;
1061 	struct buf *bp;
1062 	ufs_lbn_t lbn, nextlbn;
1063 	off_t bytesinfile;
1064 	long size, xfersize, blkoffset;
1065 	ssize_t orig_resid;
1066 	int error;
1067 
1068 	ip = VTOI(vp);
1069 	fs = ITOFS(ip);
1070 	dp = ip->i_din2;
1071 
1072 #ifdef INVARIANTS
1073 	if (uio->uio_rw != UIO_READ || fs->fs_magic != FS_UFS2_MAGIC)
1074 		panic("ffs_extread: mode");
1075 
1076 #endif
1077 	orig_resid = uio->uio_resid;
1078 	KASSERT(orig_resid >= 0, ("ffs_extread: uio->uio_resid < 0"));
1079 	if (orig_resid == 0)
1080 		return (0);
1081 	KASSERT(uio->uio_offset >= 0, ("ffs_extread: uio->uio_offset < 0"));
1082 
1083 	for (error = 0, bp = NULL; uio->uio_resid > 0; bp = NULL) {
1084 		if ((bytesinfile = dp->di_extsize - uio->uio_offset) <= 0)
1085 			break;
1086 		lbn = lblkno(fs, uio->uio_offset);
1087 		nextlbn = lbn + 1;
1088 
1089 		/*
1090 		 * size of buffer.  The buffer representing the
1091 		 * end of the file is rounded up to the size of
1092 		 * the block type ( fragment or full block,
1093 		 * depending ).
1094 		 */
1095 		size = sblksize(fs, dp->di_extsize, lbn);
1096 		blkoffset = blkoff(fs, uio->uio_offset);
1097 
1098 		/*
1099 		 * The amount we want to transfer in this iteration is
1100 		 * one FS block less the amount of the data before
1101 		 * our startpoint (duh!)
1102 		 */
1103 		xfersize = fs->fs_bsize - blkoffset;
1104 
1105 		/*
1106 		 * But if we actually want less than the block,
1107 		 * or the file doesn't have a whole block more of data,
1108 		 * then use the lesser number.
1109 		 */
1110 		if (uio->uio_resid < xfersize)
1111 			xfersize = uio->uio_resid;
1112 		if (bytesinfile < xfersize)
1113 			xfersize = bytesinfile;
1114 
1115 		if (lblktosize(fs, nextlbn) >= dp->di_extsize) {
1116 			/*
1117 			 * Don't do readahead if this is the end of the info.
1118 			 */
1119 			error = bread(vp, -1 - lbn, size, NOCRED, &bp);
1120 		} else {
1121 			/*
1122 			 * If we have a second block, then
1123 			 * fire off a request for a readahead
1124 			 * as well as a read. Note that the 4th and 5th
1125 			 * arguments point to arrays of the size specified in
1126 			 * the 6th argument.
1127 			 */
1128 			int nextsize = sblksize(fs, dp->di_extsize, nextlbn);
1129 			nextlbn = -1 - nextlbn;
1130 			error = breadn(vp, -1 - lbn,
1131 			    size, &nextlbn, &nextsize, 1, NOCRED, &bp);
1132 		}
1133 		if (error) {
1134 			brelse(bp);
1135 			bp = NULL;
1136 			break;
1137 		}
1138 
1139 		/*
1140 		 * We should only get non-zero b_resid when an I/O error
1141 		 * has occurred, which should cause us to break above.
1142 		 * However, if the short read did not cause an error,
1143 		 * then we want to ensure that we do not uiomove bad
1144 		 * or uninitialized data.
1145 		 */
1146 		size -= bp->b_resid;
1147 		if (size < xfersize) {
1148 			if (size == 0)
1149 				break;
1150 			xfersize = size;
1151 		}
1152 
1153 		error = uiomove((char *)bp->b_data + blkoffset,
1154 					(int)xfersize, uio);
1155 		if (error)
1156 			break;
1157 		vfs_bio_brelse(bp, ioflag);
1158 	}
1159 
1160 	/*
1161 	 * This can only happen in the case of an error
1162 	 * because the loop above resets bp to NULL on each iteration
1163 	 * and on normal completion has not set a new value into it.
1164 	 * so it must have come from a 'break' statement
1165 	 */
1166 	if (bp != NULL)
1167 		vfs_bio_brelse(bp, ioflag);
1168 	return (error);
1169 }
1170 
1171 /*
1172  * Extended attribute area writing.
1173  */
1174 static int
1175 ffs_extwrite(struct vnode *vp, struct uio *uio, int ioflag, struct ucred *ucred)
1176 {
1177 	struct inode *ip;
1178 	struct ufs2_dinode *dp;
1179 	struct fs *fs;
1180 	struct buf *bp;
1181 	ufs_lbn_t lbn;
1182 	off_t osize;
1183 	ssize_t resid;
1184 	int blkoffset, error, flags, size, xfersize;
1185 
1186 	ip = VTOI(vp);
1187 	fs = ITOFS(ip);
1188 	dp = ip->i_din2;
1189 
1190 #ifdef INVARIANTS
1191 	if (uio->uio_rw != UIO_WRITE || fs->fs_magic != FS_UFS2_MAGIC)
1192 		panic("ffs_extwrite: mode");
1193 #endif
1194 
1195 	if (ioflag & IO_APPEND)
1196 		uio->uio_offset = dp->di_extsize;
1197 	KASSERT(uio->uio_offset >= 0, ("ffs_extwrite: uio->uio_offset < 0"));
1198 	KASSERT(uio->uio_resid >= 0, ("ffs_extwrite: uio->uio_resid < 0"));
1199 	if ((uoff_t)uio->uio_offset + uio->uio_resid >
1200 	    UFS_NXADDR * fs->fs_bsize)
1201 		return (EFBIG);
1202 
1203 	resid = uio->uio_resid;
1204 	osize = dp->di_extsize;
1205 	flags = IO_EXT;
1206 	if (ioflag & IO_SYNC)
1207 		flags |= IO_SYNC;
1208 
1209 	for (error = 0; uio->uio_resid > 0;) {
1210 		lbn = lblkno(fs, uio->uio_offset);
1211 		blkoffset = blkoff(fs, uio->uio_offset);
1212 		xfersize = fs->fs_bsize - blkoffset;
1213 		if (uio->uio_resid < xfersize)
1214 			xfersize = uio->uio_resid;
1215 
1216 		/*
1217 		 * We must perform a read-before-write if the transfer size
1218 		 * does not cover the entire buffer.
1219 		 */
1220 		if (fs->fs_bsize > xfersize)
1221 			flags |= BA_CLRBUF;
1222 		else
1223 			flags &= ~BA_CLRBUF;
1224 		error = UFS_BALLOC(vp, uio->uio_offset, xfersize,
1225 		    ucred, flags, &bp);
1226 		if (error != 0)
1227 			break;
1228 		/*
1229 		 * If the buffer is not valid we have to clear out any
1230 		 * garbage data from the pages instantiated for the buffer.
1231 		 * If we do not, a failed uiomove() during a write can leave
1232 		 * the prior contents of the pages exposed to a userland
1233 		 * mmap().  XXX deal with uiomove() errors a better way.
1234 		 */
1235 		if ((bp->b_flags & B_CACHE) == 0 && fs->fs_bsize <= xfersize)
1236 			vfs_bio_clrbuf(bp);
1237 
1238 		if (uio->uio_offset + xfersize > dp->di_extsize) {
1239 			dp->di_extsize = uio->uio_offset + xfersize;
1240 			UFS_INODE_SET_FLAG(ip, IN_SIZEMOD | IN_CHANGE);
1241 		}
1242 
1243 		size = sblksize(fs, dp->di_extsize, lbn) - bp->b_resid;
1244 		if (size < xfersize)
1245 			xfersize = size;
1246 
1247 		error =
1248 		    uiomove((char *)bp->b_data + blkoffset, (int)xfersize, uio);
1249 
1250 		vfs_bio_set_flags(bp, ioflag);
1251 
1252 		/*
1253 		 * If IO_SYNC each buffer is written synchronously.  Otherwise
1254 		 * if we have a severe page deficiency write the buffer
1255 		 * asynchronously.  Otherwise try to cluster, and if that
1256 		 * doesn't do it then either do an async write (if O_DIRECT),
1257 		 * or a delayed write (if not).
1258 		 */
1259 		if (ioflag & IO_SYNC) {
1260 			(void)bwrite(bp);
1261 		} else if (vm_page_count_severe() ||
1262 			    buf_dirty_count_severe() ||
1263 			    xfersize + blkoffset == fs->fs_bsize ||
1264 			    (ioflag & (IO_ASYNC | IO_DIRECT)))
1265 			bawrite(bp);
1266 		else
1267 			bdwrite(bp);
1268 		if (error || xfersize == 0)
1269 			break;
1270 		UFS_INODE_SET_FLAG(ip, IN_CHANGE);
1271 	}
1272 	/*
1273 	 * If we successfully wrote any data, and we are not the superuser
1274 	 * we clear the setuid and setgid bits as a precaution against
1275 	 * tampering.
1276 	 */
1277 	if ((ip->i_mode & (ISUID | ISGID)) && resid > uio->uio_resid && ucred) {
1278 		if (priv_check_cred(ucred, PRIV_VFS_RETAINSUGID)) {
1279 			vn_seqc_write_begin(vp);
1280 			UFS_INODE_SET_MODE(ip, ip->i_mode & ~(ISUID | ISGID));
1281 			dp->di_mode = ip->i_mode;
1282 			vn_seqc_write_end(vp);
1283 		}
1284 	}
1285 	if (error) {
1286 		if (ioflag & IO_UNIT) {
1287 			(void)ffs_truncate(vp, osize,
1288 			    IO_EXT | (ioflag&IO_SYNC), ucred);
1289 			uio->uio_offset -= resid - uio->uio_resid;
1290 			uio->uio_resid = resid;
1291 		}
1292 	} else if (resid > uio->uio_resid && (ioflag & IO_SYNC))
1293 		error = ffs_update(vp, 1);
1294 	return (error);
1295 }
1296 
1297 /*
1298  * Vnode operating to retrieve a named extended attribute.
1299  *
1300  * Locate a particular EA (nspace:name) in the area (ptr:length), and return
1301  * the length of the EA, and possibly the pointer to the entry and to the data.
1302  */
1303 static int
1304 ffs_findextattr(uint8_t *ptr, uint64_t length, int nspace, const char *name,
1305     struct extattr **eapp, uint8_t **eac)
1306 {
1307 	struct extattr *eap, *eaend;
1308 	size_t nlen;
1309 
1310 	nlen = strlen(name);
1311 	KASSERT(ALIGNED_TO(ptr, struct extattr), ("unaligned"));
1312 	eap = (struct extattr *)ptr;
1313 	eaend = (struct extattr *)(ptr + length);
1314 	for (; eap < eaend; eap = EXTATTR_NEXT(eap)) {
1315 		KASSERT(EXTATTR_NEXT(eap) <= eaend,
1316 		    ("extattr next %p beyond %p", EXTATTR_NEXT(eap), eaend));
1317 		if (eap->ea_namespace != nspace || eap->ea_namelength != nlen
1318 		    || memcmp(eap->ea_name, name, nlen) != 0)
1319 			continue;
1320 		if (eapp != NULL)
1321 			*eapp = eap;
1322 		if (eac != NULL)
1323 			*eac = EXTATTR_CONTENT(eap);
1324 		return (EXTATTR_CONTENT_SIZE(eap));
1325 	}
1326 	return (-1);
1327 }
1328 
1329 static int
1330 ffs_rdextattr(uint8_t **p, struct vnode *vp, struct thread *td)
1331 {
1332 	const struct extattr *eap, *eaend, *eapnext;
1333 	struct inode *ip;
1334 	struct ufs2_dinode *dp;
1335 	struct fs *fs;
1336 	struct uio luio;
1337 	struct iovec liovec;
1338 	uint64_t easize;
1339 	int error;
1340 	uint8_t *eae;
1341 
1342 	ip = VTOI(vp);
1343 	fs = ITOFS(ip);
1344 	dp = ip->i_din2;
1345 	easize = dp->di_extsize;
1346 	if ((uoff_t)easize > UFS_NXADDR * fs->fs_bsize)
1347 		return (EFBIG);
1348 
1349 	eae = malloc(easize, M_TEMP, M_WAITOK);
1350 
1351 	liovec.iov_base = eae;
1352 	liovec.iov_len = easize;
1353 	luio.uio_iov = &liovec;
1354 	luio.uio_iovcnt = 1;
1355 	luio.uio_offset = 0;
1356 	luio.uio_resid = easize;
1357 	luio.uio_segflg = UIO_SYSSPACE;
1358 	luio.uio_rw = UIO_READ;
1359 	luio.uio_td = td;
1360 
1361 	error = ffs_extread(vp, &luio, IO_EXT | IO_SYNC);
1362 	if (error) {
1363 		free(eae, M_TEMP);
1364 		return (error);
1365 	}
1366 	/* Validate disk xattrfile contents. */
1367 	for (eap = (void *)eae, eaend = (void *)(eae + easize); eap < eaend;
1368 	    eap = eapnext) {
1369 		/* Detect zeroed out tail */
1370 		if (eap->ea_length < sizeof(*eap) || eap->ea_length == 0) {
1371 			easize = (const uint8_t *)eap - eae;
1372 			break;
1373 		}
1374 
1375 		eapnext = EXTATTR_NEXT(eap);
1376 		/* Bogusly long entry. */
1377 		if (eapnext > eaend) {
1378 			free(eae, M_TEMP);
1379 			return (EINTEGRITY);
1380 		}
1381 	}
1382 	ip->i_ea_len = easize;
1383 	*p = eae;
1384 	return (0);
1385 }
1386 
1387 static void
1388 ffs_lock_ea(struct vnode *vp)
1389 {
1390 	struct inode *ip;
1391 
1392 	ip = VTOI(vp);
1393 	VI_LOCK(vp);
1394 	while (ip->i_flag & IN_EA_LOCKED) {
1395 		UFS_INODE_SET_FLAG(ip, IN_EA_LOCKWAIT);
1396 		msleep(&ip->i_ea_refs, &vp->v_interlock, PINOD + 2, "ufs_ea",
1397 		    0);
1398 	}
1399 	UFS_INODE_SET_FLAG(ip, IN_EA_LOCKED);
1400 	VI_UNLOCK(vp);
1401 }
1402 
1403 static void
1404 ffs_unlock_ea(struct vnode *vp)
1405 {
1406 	struct inode *ip;
1407 
1408 	ip = VTOI(vp);
1409 	VI_LOCK(vp);
1410 	if (ip->i_flag & IN_EA_LOCKWAIT)
1411 		wakeup(&ip->i_ea_refs);
1412 	ip->i_flag &= ~(IN_EA_LOCKED | IN_EA_LOCKWAIT);
1413 	VI_UNLOCK(vp);
1414 }
1415 
1416 static int
1417 ffs_open_ea(struct vnode *vp, struct ucred *cred, struct thread *td)
1418 {
1419 	struct inode *ip;
1420 	int error;
1421 
1422 	ip = VTOI(vp);
1423 
1424 	ffs_lock_ea(vp);
1425 	if (ip->i_ea_area != NULL) {
1426 		ip->i_ea_refs++;
1427 		ffs_unlock_ea(vp);
1428 		return (0);
1429 	}
1430 	error = ffs_rdextattr(&ip->i_ea_area, vp, td);
1431 	if (error) {
1432 		ffs_unlock_ea(vp);
1433 		return (error);
1434 	}
1435 	ip->i_ea_error = 0;
1436 	ip->i_ea_refs++;
1437 	ffs_unlock_ea(vp);
1438 	return (0);
1439 }
1440 
1441 /*
1442  * Vnode extattr transaction commit/abort
1443  */
1444 static int
1445 ffs_close_ea(struct vnode *vp, int commit, struct ucred *cred, struct thread *td)
1446 {
1447 	struct inode *ip;
1448 	struct uio luio;
1449 	struct iovec *liovec;
1450 	struct ufs2_dinode *dp;
1451 	size_t ea_len, tlen;
1452 	int error, i, lcnt;
1453 	bool truncate;
1454 
1455 	ip = VTOI(vp);
1456 
1457 	ffs_lock_ea(vp);
1458 	if (ip->i_ea_area == NULL) {
1459 		ffs_unlock_ea(vp);
1460 		return (EINVAL);
1461 	}
1462 	dp = ip->i_din2;
1463 	error = ip->i_ea_error;
1464 	truncate = false;
1465 	if (commit && error == 0) {
1466 		ASSERT_VOP_ELOCKED(vp, "ffs_close_ea commit");
1467 		if (cred == NOCRED)
1468 			cred =  vp->v_mount->mnt_cred;
1469 
1470 		ea_len = MAX(ip->i_ea_len, dp->di_extsize);
1471 		for (lcnt = 1, tlen = ea_len - ip->i_ea_len; tlen > 0;) {
1472 			tlen -= MIN(ZERO_REGION_SIZE, tlen);
1473 			lcnt++;
1474 		}
1475 
1476 		liovec = __builtin_alloca(lcnt * sizeof(struct iovec));
1477 		luio.uio_iovcnt = lcnt;
1478 
1479 		liovec[0].iov_base = ip->i_ea_area;
1480 		liovec[0].iov_len = ip->i_ea_len;
1481 		for (i = 1, tlen = ea_len - ip->i_ea_len; i < lcnt; i++) {
1482 			liovec[i].iov_base = __DECONST(void *, zero_region);
1483 			liovec[i].iov_len = MIN(ZERO_REGION_SIZE, tlen);
1484 			tlen -= liovec[i].iov_len;
1485 		}
1486 		MPASS(tlen == 0);
1487 
1488 		luio.uio_iov = liovec;
1489 		luio.uio_offset = 0;
1490 		luio.uio_resid = ea_len;
1491 		luio.uio_segflg = UIO_SYSSPACE;
1492 		luio.uio_rw = UIO_WRITE;
1493 		luio.uio_td = td;
1494 		error = ffs_extwrite(vp, &luio, IO_EXT | IO_SYNC, cred);
1495 		if (error == 0 && ip->i_ea_len == 0)
1496 			truncate = true;
1497 	}
1498 	if (--ip->i_ea_refs == 0) {
1499 		free(ip->i_ea_area, M_TEMP);
1500 		ip->i_ea_area = NULL;
1501 		ip->i_ea_len = 0;
1502 		ip->i_ea_error = 0;
1503 	}
1504 	ffs_unlock_ea(vp);
1505 
1506 	if (truncate)
1507 		ffs_truncate(vp, 0, IO_EXT, cred);
1508 	return (error);
1509 }
1510 
1511 /*
1512  * Vnode extattr strategy routine for fifos.
1513  *
1514  * We need to check for a read or write of the external attributes.
1515  * Otherwise we just fall through and do the usual thing.
1516  */
1517 static int
1518 ffsext_strategy(
1519 	struct vop_strategy_args /* {
1520 		struct vnodeop_desc *a_desc;
1521 		struct vnode *a_vp;
1522 		struct buf *a_bp;
1523 	} */ *ap)
1524 {
1525 	struct vnode *vp;
1526 	daddr_t lbn;
1527 
1528 	vp = ap->a_vp;
1529 	lbn = ap->a_bp->b_lblkno;
1530 	if (I_IS_UFS2(VTOI(vp)) && lbn < 0 && lbn >= -UFS_NXADDR)
1531 		return (VOP_STRATEGY_APV(&ufs_vnodeops, ap));
1532 	if (vp->v_type == VFIFO)
1533 		return (VOP_STRATEGY_APV(&ufs_fifoops, ap));
1534 	panic("spec nodes went here");
1535 }
1536 
1537 /*
1538  * Vnode extattr transaction commit/abort
1539  */
1540 static int
1541 ffs_openextattr(
1542 	struct vop_openextattr_args /* {
1543 		struct vnodeop_desc *a_desc;
1544 		struct vnode *a_vp;
1545 		IN struct ucred *a_cred;
1546 		IN struct thread *a_td;
1547 	} */ *ap)
1548 {
1549 
1550 	if (ap->a_vp->v_type == VCHR || ap->a_vp->v_type == VBLK)
1551 		return (EOPNOTSUPP);
1552 
1553 	return (ffs_open_ea(ap->a_vp, ap->a_cred, ap->a_td));
1554 }
1555 
1556 /*
1557  * Vnode extattr transaction commit/abort
1558  */
1559 static int
1560 ffs_closeextattr(
1561 	struct vop_closeextattr_args /* {
1562 		struct vnodeop_desc *a_desc;
1563 		struct vnode *a_vp;
1564 		int a_commit;
1565 		IN struct ucred *a_cred;
1566 		IN struct thread *a_td;
1567 	} */ *ap)
1568 {
1569 	struct vnode *vp;
1570 
1571 	vp = ap->a_vp;
1572 	if (vp->v_type == VCHR || vp->v_type == VBLK)
1573 		return (EOPNOTSUPP);
1574 	if (ap->a_commit && (vp->v_mount->mnt_flag & MNT_RDONLY) != 0)
1575 		return (EROFS);
1576 
1577 	if (ap->a_commit && DOINGSUJ(vp)) {
1578 		ASSERT_VOP_ELOCKED(vp, "ffs_closeextattr commit");
1579 		softdep_prealloc(vp, MNT_WAIT);
1580 		if (vp->v_data == NULL)
1581 			return (EBADF);
1582 	}
1583 	return (ffs_close_ea(vp, ap->a_commit, ap->a_cred, ap->a_td));
1584 }
1585 
1586 /*
1587  * Vnode operation to remove a named attribute.
1588  */
1589 static int
1590 ffs_deleteextattr(
1591 	struct vop_deleteextattr_args /* {
1592 		IN struct vnode *a_vp;
1593 		IN int a_attrnamespace;
1594 		IN const char *a_name;
1595 		IN struct ucred *a_cred;
1596 		IN struct thread *a_td;
1597 	} */ *ap)
1598 {
1599 	struct vnode *vp;
1600 	struct inode *ip;
1601 	struct extattr *eap;
1602 	uint32_t ul;
1603 	int olen, error, i, easize;
1604 	uint8_t *eae;
1605 	void *tmp;
1606 
1607 	vp = ap->a_vp;
1608 	ip = VTOI(vp);
1609 
1610 	if (vp->v_type == VCHR || vp->v_type == VBLK)
1611 		return (EOPNOTSUPP);
1612 	if (strlen(ap->a_name) == 0)
1613 		return (EINVAL);
1614 	if (vp->v_mount->mnt_flag & MNT_RDONLY)
1615 		return (EROFS);
1616 
1617 	error = extattr_check_cred(vp, ap->a_attrnamespace,
1618 	    ap->a_cred, ap->a_td, VWRITE);
1619 	if (error) {
1620 		/*
1621 		 * ffs_lock_ea is not needed there, because the vnode
1622 		 * must be exclusively locked.
1623 		 */
1624 		if (ip->i_ea_area != NULL && ip->i_ea_error == 0)
1625 			ip->i_ea_error = error;
1626 		return (error);
1627 	}
1628 
1629 	if (DOINGSUJ(vp)) {
1630 		ASSERT_VOP_ELOCKED(vp, "ffs_deleteextattr");
1631 		softdep_prealloc(vp, MNT_WAIT);
1632 		if (vp->v_data == NULL)
1633 			return (EBADF);
1634 	}
1635 
1636 	error = ffs_open_ea(vp, ap->a_cred, ap->a_td);
1637 	if (error)
1638 		return (error);
1639 
1640 	/* CEM: delete could be done in-place instead */
1641 	eae = malloc(ip->i_ea_len, M_TEMP, M_WAITOK);
1642 	bcopy(ip->i_ea_area, eae, ip->i_ea_len);
1643 	easize = ip->i_ea_len;
1644 
1645 	olen = ffs_findextattr(eae, easize, ap->a_attrnamespace, ap->a_name,
1646 	    &eap, NULL);
1647 	if (olen == -1) {
1648 		/* delete but nonexistent */
1649 		free(eae, M_TEMP);
1650 		ffs_close_ea(vp, 0, ap->a_cred, ap->a_td);
1651 		return (ENOATTR);
1652 	}
1653 	ul = eap->ea_length;
1654 	i = (uint8_t *)EXTATTR_NEXT(eap) - eae;
1655 	bcopy(EXTATTR_NEXT(eap), eap, easize - i);
1656 	easize -= ul;
1657 
1658 	tmp = ip->i_ea_area;
1659 	ip->i_ea_area = eae;
1660 	ip->i_ea_len = easize;
1661 	free(tmp, M_TEMP);
1662 	error = ffs_close_ea(vp, 1, ap->a_cred, ap->a_td);
1663 	return (error);
1664 }
1665 
1666 /*
1667  * Vnode operation to retrieve a named extended attribute.
1668  */
1669 static int
1670 ffs_getextattr(
1671 	struct vop_getextattr_args /* {
1672 		IN struct vnode *a_vp;
1673 		IN int a_attrnamespace;
1674 		IN const char *a_name;
1675 		INOUT struct uio *a_uio;
1676 		OUT size_t *a_size;
1677 		IN struct ucred *a_cred;
1678 		IN struct thread *a_td;
1679 	} */ *ap)
1680 {
1681 	struct inode *ip;
1682 	uint8_t *eae, *p;
1683 	unsigned easize;
1684 	int error, ealen;
1685 
1686 	ip = VTOI(ap->a_vp);
1687 
1688 	if (ap->a_vp->v_type == VCHR || ap->a_vp->v_type == VBLK)
1689 		return (EOPNOTSUPP);
1690 
1691 	error = extattr_check_cred(ap->a_vp, ap->a_attrnamespace,
1692 	    ap->a_cred, ap->a_td, VREAD);
1693 	if (error)
1694 		return (error);
1695 
1696 	error = ffs_open_ea(ap->a_vp, ap->a_cred, ap->a_td);
1697 	if (error)
1698 		return (error);
1699 
1700 	eae = ip->i_ea_area;
1701 	easize = ip->i_ea_len;
1702 
1703 	ealen = ffs_findextattr(eae, easize, ap->a_attrnamespace, ap->a_name,
1704 	    NULL, &p);
1705 	if (ealen >= 0) {
1706 		error = 0;
1707 		if (ap->a_size != NULL)
1708 			*ap->a_size = ealen;
1709 		else if (ap->a_uio != NULL)
1710 			error = uiomove(p, ealen, ap->a_uio);
1711 	} else
1712 		error = ENOATTR;
1713 
1714 	ffs_close_ea(ap->a_vp, 0, ap->a_cred, ap->a_td);
1715 	return (error);
1716 }
1717 
1718 /*
1719  * Vnode operation to retrieve extended attributes on a vnode.
1720  */
1721 static int
1722 ffs_listextattr(
1723 	struct vop_listextattr_args /* {
1724 		IN struct vnode *a_vp;
1725 		IN int a_attrnamespace;
1726 		INOUT struct uio *a_uio;
1727 		OUT size_t *a_size;
1728 		IN struct ucred *a_cred;
1729 		IN struct thread *a_td;
1730 	} */ *ap)
1731 {
1732 	struct inode *ip;
1733 	struct extattr *eap, *eaend;
1734 	int error, ealen;
1735 
1736 	ip = VTOI(ap->a_vp);
1737 
1738 	if (ap->a_vp->v_type == VCHR || ap->a_vp->v_type == VBLK)
1739 		return (EOPNOTSUPP);
1740 
1741 	error = extattr_check_cred(ap->a_vp, ap->a_attrnamespace,
1742 	    ap->a_cred, ap->a_td, VREAD);
1743 	if (error)
1744 		return (error);
1745 
1746 	error = ffs_open_ea(ap->a_vp, ap->a_cred, ap->a_td);
1747 	if (error)
1748 		return (error);
1749 
1750 	error = 0;
1751 	if (ap->a_size != NULL)
1752 		*ap->a_size = 0;
1753 
1754 	KASSERT(ALIGNED_TO(ip->i_ea_area, struct extattr), ("unaligned"));
1755 	eap = (struct extattr *)ip->i_ea_area;
1756 	eaend = (struct extattr *)(ip->i_ea_area + ip->i_ea_len);
1757 	for (; error == 0 && eap < eaend; eap = EXTATTR_NEXT(eap)) {
1758 		KASSERT(EXTATTR_NEXT(eap) <= eaend,
1759 		    ("extattr next %p beyond %p", EXTATTR_NEXT(eap), eaend));
1760 		if (eap->ea_namespace != ap->a_attrnamespace)
1761 			continue;
1762 
1763 		ealen = eap->ea_namelength;
1764 		if (ap->a_size != NULL)
1765 			*ap->a_size += ealen + 1;
1766 		else if (ap->a_uio != NULL)
1767 			error = uiomove(&eap->ea_namelength, ealen + 1,
1768 			    ap->a_uio);
1769 	}
1770 
1771 	ffs_close_ea(ap->a_vp, 0, ap->a_cred, ap->a_td);
1772 	return (error);
1773 }
1774 
1775 /*
1776  * Vnode operation to set a named attribute.
1777  */
1778 static int
1779 ffs_setextattr(
1780 	struct vop_setextattr_args /* {
1781 		IN struct vnode *a_vp;
1782 		IN int a_attrnamespace;
1783 		IN const char *a_name;
1784 		INOUT struct uio *a_uio;
1785 		IN struct ucred *a_cred;
1786 		IN struct thread *a_td;
1787 	} */ *ap)
1788 {
1789 	struct vnode *vp;
1790 	struct inode *ip;
1791 	struct fs *fs;
1792 	struct extattr *eap;
1793 	uint32_t ealength, ul;
1794 	ssize_t ealen;
1795 	int olen, eapad1, eapad2, error, i, easize;
1796 	uint8_t *eae;
1797 	void *tmp;
1798 
1799 	vp = ap->a_vp;
1800 	ip = VTOI(vp);
1801 	fs = ITOFS(ip);
1802 
1803 	if (vp->v_type == VCHR || vp->v_type == VBLK)
1804 		return (EOPNOTSUPP);
1805 	if (strlen(ap->a_name) == 0)
1806 		return (EINVAL);
1807 
1808 	/* XXX Now unsupported API to delete EAs using NULL uio. */
1809 	if (ap->a_uio == NULL)
1810 		return (EOPNOTSUPP);
1811 
1812 	if (vp->v_mount->mnt_flag & MNT_RDONLY)
1813 		return (EROFS);
1814 
1815 	ealen = ap->a_uio->uio_resid;
1816 	if (ealen < 0 || ealen > lblktosize(fs, UFS_NXADDR))
1817 		return (EINVAL);
1818 
1819 	error = extattr_check_cred(vp, ap->a_attrnamespace,
1820 	    ap->a_cred, ap->a_td, VWRITE);
1821 	if (error) {
1822 		/*
1823 		 * ffs_lock_ea is not needed there, because the vnode
1824 		 * must be exclusively locked.
1825 		 */
1826 		if (ip->i_ea_area != NULL && ip->i_ea_error == 0)
1827 			ip->i_ea_error = error;
1828 		return (error);
1829 	}
1830 
1831 	if (DOINGSUJ(vp)) {
1832 		ASSERT_VOP_ELOCKED(vp, "ffs_deleteextattr");
1833 		softdep_prealloc(vp, MNT_WAIT);
1834 		if (vp->v_data == NULL)
1835 			return (EBADF);
1836 	}
1837 
1838 	error = ffs_open_ea(vp, ap->a_cred, ap->a_td);
1839 	if (error)
1840 		return (error);
1841 
1842 	ealength = sizeof(uint32_t) + 3 + strlen(ap->a_name);
1843 	eapad1 = roundup2(ealength, 8) - ealength;
1844 	eapad2 = roundup2(ealen, 8) - ealen;
1845 	ealength += eapad1 + ealen + eapad2;
1846 
1847 	/*
1848 	 * CEM: rewrites of the same size or smaller could be done in-place
1849 	 * instead.  (We don't acquire any fine-grained locks in here either,
1850 	 * so we could also do bigger writes in-place.)
1851 	 */
1852 	eae = malloc(ip->i_ea_len + ealength, M_TEMP, M_WAITOK);
1853 	bcopy(ip->i_ea_area, eae, ip->i_ea_len);
1854 	easize = ip->i_ea_len;
1855 
1856 	olen = ffs_findextattr(eae, easize, ap->a_attrnamespace, ap->a_name,
1857 	    &eap, NULL);
1858         if (olen == -1) {
1859 		/* new, append at end */
1860 		KASSERT(ALIGNED_TO(eae + easize, struct extattr),
1861 		    ("unaligned"));
1862 		eap = (struct extattr *)(eae + easize);
1863 		easize += ealength;
1864 	} else {
1865 		ul = eap->ea_length;
1866 		i = (uint8_t *)EXTATTR_NEXT(eap) - eae;
1867 		if (ul != ealength) {
1868 			bcopy(EXTATTR_NEXT(eap), (uint8_t *)eap + ealength,
1869 			    easize - i);
1870 			easize += (ealength - ul);
1871 		}
1872 	}
1873 	if (easize > lblktosize(fs, UFS_NXADDR)) {
1874 		free(eae, M_TEMP);
1875 		ffs_close_ea(vp, 0, ap->a_cred, ap->a_td);
1876 		if (ip->i_ea_area != NULL && ip->i_ea_error == 0)
1877 			ip->i_ea_error = ENOSPC;
1878 		return (ENOSPC);
1879 	}
1880 	eap->ea_length = ealength;
1881 	eap->ea_namespace = ap->a_attrnamespace;
1882 	eap->ea_contentpadlen = eapad2;
1883 	eap->ea_namelength = strlen(ap->a_name);
1884 	memcpy(eap->ea_name, ap->a_name, strlen(ap->a_name));
1885 	bzero(&eap->ea_name[strlen(ap->a_name)], eapad1);
1886 	error = uiomove(EXTATTR_CONTENT(eap), ealen, ap->a_uio);
1887 	if (error) {
1888 		free(eae, M_TEMP);
1889 		ffs_close_ea(vp, 0, ap->a_cred, ap->a_td);
1890 		if (ip->i_ea_area != NULL && ip->i_ea_error == 0)
1891 			ip->i_ea_error = error;
1892 		return (error);
1893 	}
1894 	bzero((uint8_t *)EXTATTR_CONTENT(eap) + ealen, eapad2);
1895 
1896 	tmp = ip->i_ea_area;
1897 	ip->i_ea_area = eae;
1898 	ip->i_ea_len = easize;
1899 	free(tmp, M_TEMP);
1900 	error = ffs_close_ea(vp, 1, ap->a_cred, ap->a_td);
1901 	return (error);
1902 }
1903 
1904 /*
1905  * Vnode pointer to File handle
1906  */
1907 static int
1908 ffs_vptofh(
1909 	struct vop_vptofh_args /* {
1910 		IN struct vnode *a_vp;
1911 		IN struct fid *a_fhp;
1912 	} */ *ap)
1913 {
1914 	struct inode *ip;
1915 	struct ufid *ufhp;
1916 
1917 	ip = VTOI(ap->a_vp);
1918 	ufhp = (struct ufid *)ap->a_fhp;
1919 	ufhp->ufid_len = sizeof(struct ufid);
1920 	ufhp->ufid_ino = ip->i_number;
1921 	ufhp->ufid_gen = ip->i_gen;
1922 	return (0);
1923 }
1924 
1925 SYSCTL_DECL(_vfs_ffs);
1926 static int use_buf_pager = 1;
1927 SYSCTL_INT(_vfs_ffs, OID_AUTO, use_buf_pager, CTLFLAG_RWTUN, &use_buf_pager, 0,
1928     "Always use buffer pager instead of bmap");
1929 
1930 static daddr_t
1931 ffs_gbp_getblkno(struct vnode *vp, vm_ooffset_t off)
1932 {
1933 
1934 	return (lblkno(VFSTOUFS(vp->v_mount)->um_fs, off));
1935 }
1936 
1937 static int
1938 ffs_gbp_getblksz(struct vnode *vp, daddr_t lbn, long *sz)
1939 {
1940 
1941 	*sz = blksize(VFSTOUFS(vp->v_mount)->um_fs, VTOI(vp), lbn);
1942 	return (0);
1943 }
1944 
1945 static int
1946 ffs_getpages(struct vop_getpages_args *ap)
1947 {
1948 	struct vnode *vp;
1949 	struct ufsmount *um;
1950 
1951 	vp = ap->a_vp;
1952 	um = VFSTOUFS(vp->v_mount);
1953 
1954 	if (!use_buf_pager && um->um_devvp->v_bufobj.bo_bsize <= PAGE_SIZE)
1955 		return (vnode_pager_generic_getpages(vp, ap->a_m, ap->a_count,
1956 		    ap->a_rbehind, ap->a_rahead, NULL, NULL));
1957 	return (vfs_bio_getpages(vp, ap->a_m, ap->a_count, ap->a_rbehind,
1958 	    ap->a_rahead, ffs_gbp_getblkno, ffs_gbp_getblksz));
1959 }
1960 
1961 static int
1962 ffs_getpages_async(struct vop_getpages_async_args *ap)
1963 {
1964 	struct vnode *vp;
1965 	struct ufsmount *um;
1966 	bool do_iodone;
1967 	int error;
1968 
1969 	vp = ap->a_vp;
1970 	um = VFSTOUFS(vp->v_mount);
1971 	do_iodone = true;
1972 
1973 	if (um->um_devvp->v_bufobj.bo_bsize <= PAGE_SIZE) {
1974 		error = vnode_pager_generic_getpages(vp, ap->a_m, ap->a_count,
1975 		    ap->a_rbehind, ap->a_rahead, ap->a_iodone, ap->a_arg);
1976 		if (error == 0)
1977 			do_iodone = false;
1978 	} else {
1979 		error = vfs_bio_getpages(vp, ap->a_m, ap->a_count,
1980 		    ap->a_rbehind, ap->a_rahead, ffs_gbp_getblkno,
1981 		    ffs_gbp_getblksz);
1982 	}
1983 	if (do_iodone && ap->a_iodone != NULL)
1984 		ap->a_iodone(ap->a_arg, ap->a_m, ap->a_count, error);
1985 
1986 	return (error);
1987 }
1988 
1989 static int
1990 ffs_vput_pair(struct vop_vput_pair_args *ap)
1991 {
1992 	struct mount *mp;
1993 	struct vnode *dvp, *vp, *vp1, **vpp;
1994 	struct inode *dp, *ip;
1995 	ino_t ip_ino;
1996 	uint64_t ip_gen;
1997 	int error, vp_locked;
1998 
1999 	dvp = ap->a_dvp;
2000 	dp = VTOI(dvp);
2001 	vpp = ap->a_vpp;
2002 	vp = vpp != NULL ? *vpp : NULL;
2003 
2004 	if ((dp->i_flag & (IN_NEEDSYNC | IN_ENDOFF)) == 0) {
2005 		vput(dvp);
2006 		if (vp != NULL && ap->a_unlock_vp)
2007 			vput(vp);
2008 		return (0);
2009 	}
2010 
2011 	mp = dvp->v_mount;
2012 	if (vp != NULL) {
2013 		if (ap->a_unlock_vp) {
2014 			vput(vp);
2015 		} else {
2016 			MPASS(vp->v_type != VNON);
2017 			vp_locked = VOP_ISLOCKED(vp);
2018 			ip = VTOI(vp);
2019 			ip_ino = ip->i_number;
2020 			ip_gen = ip->i_gen;
2021 			VOP_UNLOCK(vp);
2022 		}
2023 	}
2024 
2025 	/*
2026 	 * If compaction or fsync was requested do it in ffs_vput_pair()
2027 	 * now that other locks are no longer held.
2028          */
2029 	if ((dp->i_flag & IN_ENDOFF) != 0) {
2030 		VNASSERT(I_ENDOFF(dp) != 0 && I_ENDOFF(dp) < dp->i_size, dvp,
2031 		    ("IN_ENDOFF set but I_ENDOFF() is not"));
2032 		dp->i_flag &= ~IN_ENDOFF;
2033 		error = UFS_TRUNCATE(dvp, (off_t)I_ENDOFF(dp), IO_NORMAL |
2034 		    (DOINGASYNC(dvp) ? 0 : IO_SYNC), curthread->td_ucred);
2035 		if (error != 0 && error != ERELOOKUP) {
2036 			if (!ffs_fsfail_cleanup(VFSTOUFS(mp), error)) {
2037 				vn_printf(dvp,
2038 				    "IN_ENDOFF: failed to truncate, "
2039 				    "error %d\n", error);
2040 			}
2041 #ifdef UFS_DIRHASH
2042 			ufsdirhash_free(dp);
2043 #endif
2044 		}
2045 		SET_I_ENDOFF(dp, 0);
2046 	}
2047 	if ((dp->i_flag & IN_NEEDSYNC) != 0) {
2048 		do {
2049 			error = ffs_syncvnode(dvp, MNT_WAIT, 0);
2050 		} while (error == ERELOOKUP);
2051 	}
2052 
2053 	vput(dvp);
2054 
2055 	if (vp == NULL || ap->a_unlock_vp)
2056 		return (0);
2057 	MPASS(mp != NULL);
2058 
2059 	/*
2060 	 * It is possible that vp is reclaimed at this point. Only
2061 	 * routines that call us with a_unlock_vp == false can find
2062 	 * that their vp has been reclaimed. There are three areas
2063 	 * that are affected:
2064 	 * 1) vn_open_cred() - later VOPs could fail, but
2065 	 *    dead_open() returns 0 to simulate successful open.
2066 	 * 2) ffs_snapshot() - creation of snapshot fails with EBADF.
2067 	 * 3) NFS server (several places) - code is prepared to detect
2068 	 *    and respond to dead vnodes by returning ESTALE.
2069 	 */
2070 	VOP_LOCK(vp, vp_locked | LK_RETRY);
2071 	if (IS_UFS(vp))
2072 		return (0);
2073 
2074 	/*
2075 	 * Try harder to recover from reclaimed vp if reclaim was not
2076 	 * because underlying inode was cleared.  We saved inode
2077 	 * number and inode generation, so we can try to reinstantiate
2078 	 * exactly same version of inode.  If this fails, return
2079 	 * original doomed vnode and let caller to handle
2080 	 * consequences.
2081 	 *
2082 	 * Note that callers must keep write started around
2083 	 * VOP_VPUT_PAIR() calls, so it is safe to use mp without
2084 	 * busying it.
2085 	 */
2086 	VOP_UNLOCK(vp);
2087 	error = ffs_inotovp(mp, ip_ino, ip_gen, LK_EXCLUSIVE, &vp1,
2088 	    FFSV_REPLACE_DOOMED);
2089 	if (error != 0) {
2090 		VOP_LOCK(vp, vp_locked | LK_RETRY);
2091 	} else {
2092 		vrele(vp);
2093 		*vpp = vp1;
2094 	}
2095 	return (error);
2096 }
2097