xref: /illumos-gate/usr/src/uts/common/fs/ufs/ufs_vnops.c (revision da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 /*
22  * Copyright 2007 Sun Microsystems, Inc.  All rights reserved.
23  * Use is subject to license terms.
24  */
25 
26 /*	Copyright (c) 1983, 1984, 1985, 1986, 1987, 1988, 1989 AT&T	*/
27 /*	  All Rights Reserved  	*/
28 
29 /*
30  * Portions of this source code were derived from Berkeley 4.3 BSD
31  * under license from the Regents of the University of California.
32  */
33 
34 #pragma ident	"%Z%%M%	%I%	%E% SMI"
35 
36 #include <sys/types.h>
37 #include <sys/t_lock.h>
38 #include <sys/ksynch.h>
39 #include <sys/param.h>
40 #include <sys/time.h>
41 #include <sys/systm.h>
42 #include <sys/sysmacros.h>
43 #include <sys/resource.h>
44 #include <sys/signal.h>
45 #include <sys/cred.h>
46 #include <sys/user.h>
47 #include <sys/buf.h>
48 #include <sys/vfs.h>
49 #include <sys/vfs_opreg.h>
50 #include <sys/vnode.h>
51 #include <sys/proc.h>
52 #include <sys/disp.h>
53 #include <sys/file.h>
54 #include <sys/fcntl.h>
55 #include <sys/flock.h>
56 #include <sys/atomic.h>
57 #include <sys/kmem.h>
58 #include <sys/uio.h>
59 #include <sys/dnlc.h>
60 #include <sys/conf.h>
61 #include <sys/mman.h>
62 #include <sys/pathname.h>
63 #include <sys/debug.h>
64 #include <sys/vmsystm.h>
65 #include <sys/cmn_err.h>
66 #include <sys/filio.h>
67 #include <sys/policy.h>
68 
69 #include <sys/fs/ufs_fs.h>
70 #include <sys/fs/ufs_lockfs.h>
71 #include <sys/fs/ufs_filio.h>
72 #include <sys/fs/ufs_inode.h>
73 #include <sys/fs/ufs_fsdir.h>
74 #include <sys/fs/ufs_quota.h>
75 #include <sys/fs/ufs_log.h>
76 #include <sys/fs/ufs_snap.h>
77 #include <sys/fs/ufs_trans.h>
78 #include <sys/fs/ufs_panic.h>
79 #include <sys/fs/ufs_bio.h>
80 #include <sys/dirent.h>		/* must be AFTER <sys/fs/fsdir.h>! */
81 #include <sys/errno.h>
82 #include <sys/fssnap_if.h>
83 #include <sys/unistd.h>
84 #include <sys/sunddi.h>
85 
86 #include <sys/filio.h>		/* _FIOIO */
87 
88 #include <vm/hat.h>
89 #include <vm/page.h>
90 #include <vm/pvn.h>
91 #include <vm/as.h>
92 #include <vm/seg.h>
93 #include <vm/seg_map.h>
94 #include <vm/seg_vn.h>
95 #include <vm/seg_kmem.h>
96 #include <vm/rm.h>
97 #include <sys/swap.h>
98 
99 #include <fs/fs_subr.h>
100 
101 static struct instats ins;
102 
103 static 	int ufs_getpage_ra(struct vnode *, u_offset_t, struct seg *, caddr_t);
104 static	int ufs_getpage_miss(struct vnode *, u_offset_t, size_t, struct seg *,
105 		caddr_t, struct page **, size_t, enum seg_rw, int);
106 static	int ufs_open(struct vnode **, int, struct cred *, caller_context_t *);
107 static	int ufs_close(struct vnode *, int, int, offset_t, struct cred *,
108 		caller_context_t *);
109 static	int ufs_read(struct vnode *, struct uio *, int, struct cred *,
110 		struct caller_context *);
111 static	int ufs_write(struct vnode *, struct uio *, int, struct cred *,
112 		struct caller_context *);
113 static	int ufs_ioctl(struct vnode *, int, intptr_t, int, struct cred *,
114 		int *, caller_context_t *);
115 static	int ufs_getattr(struct vnode *, struct vattr *, int, struct cred *,
116 		caller_context_t *);
117 static	int ufs_setattr(struct vnode *, struct vattr *, int, struct cred *,
118 		caller_context_t *);
119 static	int ufs_access(struct vnode *, int, int, struct cred *,
120 		caller_context_t *);
121 static	int ufs_lookup(struct vnode *, char *, struct vnode **,
122 		struct pathname *, int, struct vnode *, struct cred *,
123 		caller_context_t *, int *, pathname_t *);
124 static	int ufs_create(struct vnode *, char *, struct vattr *, enum vcexcl,
125 		int, struct vnode **, struct cred *, int,
126 		caller_context_t *, vsecattr_t  *);
127 static	int ufs_remove(struct vnode *, char *, struct cred *,
128 		caller_context_t *, int);
129 static	int ufs_link(struct vnode *, struct vnode *, char *, struct cred *,
130 		caller_context_t *, int);
131 static	int ufs_rename(struct vnode *, char *, struct vnode *, char *,
132 		struct cred *, caller_context_t *, int);
133 static	int ufs_mkdir(struct vnode *, char *, struct vattr *, struct vnode **,
134 		struct cred *, caller_context_t *, int, vsecattr_t *);
135 static	int ufs_rmdir(struct vnode *, char *, struct vnode *, struct cred *,
136 		caller_context_t *, int);
137 static	int ufs_readdir(struct vnode *, struct uio *, struct cred *, int *,
138 		caller_context_t *, int);
139 static	int ufs_symlink(struct vnode *, char *, struct vattr *, char *,
140 		struct cred *, caller_context_t *, int);
141 static	int ufs_readlink(struct vnode *, struct uio *, struct cred *,
142 		caller_context_t *);
143 static	int ufs_fsync(struct vnode *, int, struct cred *, caller_context_t *);
144 static	void ufs_inactive(struct vnode *, struct cred *, caller_context_t *);
145 static	int ufs_fid(struct vnode *, struct fid *, caller_context_t *);
146 static	int ufs_rwlock(struct vnode *, int, caller_context_t *);
147 static	void ufs_rwunlock(struct vnode *, int, caller_context_t *);
148 static	int ufs_seek(struct vnode *, offset_t, offset_t *, caller_context_t *);
149 static	int ufs_frlock(struct vnode *, int, struct flock64 *, int, offset_t,
150 		struct flk_callback *, struct cred *,
151 		caller_context_t *);
152 static  int ufs_space(struct vnode *, int, struct flock64 *, int, offset_t,
153 		cred_t *, caller_context_t *);
154 static	int ufs_getpage(struct vnode *, offset_t, size_t, uint_t *,
155 		struct page **, size_t, struct seg *, caddr_t,
156 		enum seg_rw, struct cred *, caller_context_t *);
157 static	int ufs_putpage(struct vnode *, offset_t, size_t, int, struct cred *,
158 		caller_context_t *);
159 static	int ufs_putpages(struct vnode *, offset_t, size_t, int, struct cred *);
160 static	int ufs_map(struct vnode *, offset_t, struct as *, caddr_t *, size_t,
161 		uchar_t, uchar_t, uint_t, struct cred *, caller_context_t *);
162 static	int ufs_addmap(struct vnode *, offset_t, struct as *, caddr_t,  size_t,
163 		uchar_t, uchar_t, uint_t, struct cred *, caller_context_t *);
164 static	int ufs_delmap(struct vnode *, offset_t, struct as *, caddr_t,  size_t,
165 		uint_t, uint_t, uint_t, struct cred *, caller_context_t *);
166 static	int ufs_poll(vnode_t *, short, int, short *, struct pollhead **,
167 		caller_context_t *);
168 static	int ufs_dump(vnode_t *, caddr_t, int, int, caller_context_t *);
169 static	int ufs_l_pathconf(struct vnode *, int, ulong_t *, struct cred *,
170 		caller_context_t *);
171 static	int ufs_pageio(struct vnode *, struct page *, u_offset_t, size_t, int,
172 		struct cred *, caller_context_t *);
173 static	int ufs_dumpctl(vnode_t *, int, int *, caller_context_t *);
174 static	daddr32_t *save_dblks(struct inode *, struct ufsvfs *, daddr32_t *,
175 		daddr32_t *, int, int);
176 static	int ufs_getsecattr(struct vnode *, vsecattr_t *, int, struct cred *,
177 		caller_context_t *);
178 static	int ufs_setsecattr(struct vnode *, vsecattr_t *, int, struct cred *,
179 		caller_context_t *);
180 
181 extern int as_map_locked(struct as *, caddr_t, size_t, int ((*)()), void *);
182 
183 /*
184  * For lockfs: ulockfs begin/end is now inlined in the ufs_xxx functions.
185  *
186  * XXX - ULOCKFS in fs_pathconf and ufs_ioctl is not inlined yet.
187  */
188 struct vnodeops *ufs_vnodeops;
189 
190 /* NOTE: "not blkd" below  means that the operation isn't blocked by lockfs */
191 const fs_operation_def_t ufs_vnodeops_template[] = {
192 	VOPNAME_OPEN,		{ .vop_open = ufs_open },	/* not blkd */
193 	VOPNAME_CLOSE,		{ .vop_close = ufs_close },	/* not blkd */
194 	VOPNAME_READ,		{ .vop_read = ufs_read },
195 	VOPNAME_WRITE,		{ .vop_write = ufs_write },
196 	VOPNAME_IOCTL,		{ .vop_ioctl = ufs_ioctl },
197 	VOPNAME_GETATTR,	{ .vop_getattr = ufs_getattr },
198 	VOPNAME_SETATTR,	{ .vop_setattr = ufs_setattr },
199 	VOPNAME_ACCESS,		{ .vop_access = ufs_access },
200 	VOPNAME_LOOKUP,		{ .vop_lookup = ufs_lookup },
201 	VOPNAME_CREATE,		{ .vop_create = ufs_create },
202 	VOPNAME_REMOVE,		{ .vop_remove = ufs_remove },
203 	VOPNAME_LINK,		{ .vop_link = ufs_link },
204 	VOPNAME_RENAME,		{ .vop_rename = ufs_rename },
205 	VOPNAME_MKDIR,		{ .vop_mkdir = ufs_mkdir },
206 	VOPNAME_RMDIR,		{ .vop_rmdir = ufs_rmdir },
207 	VOPNAME_READDIR,	{ .vop_readdir = ufs_readdir },
208 	VOPNAME_SYMLINK,	{ .vop_symlink = ufs_symlink },
209 	VOPNAME_READLINK,	{ .vop_readlink = ufs_readlink },
210 	VOPNAME_FSYNC,		{ .vop_fsync = ufs_fsync },
211 	VOPNAME_INACTIVE,	{ .vop_inactive = ufs_inactive }, /* not blkd */
212 	VOPNAME_FID,		{ .vop_fid = ufs_fid },
213 	VOPNAME_RWLOCK,		{ .vop_rwlock = ufs_rwlock },	/* not blkd */
214 	VOPNAME_RWUNLOCK,	{ .vop_rwunlock = ufs_rwunlock }, /* not blkd */
215 	VOPNAME_SEEK,		{ .vop_seek = ufs_seek },
216 	VOPNAME_FRLOCK,		{ .vop_frlock = ufs_frlock },
217 	VOPNAME_SPACE,		{ .vop_space = ufs_space },
218 	VOPNAME_GETPAGE,	{ .vop_getpage = ufs_getpage },
219 	VOPNAME_PUTPAGE,	{ .vop_putpage = ufs_putpage },
220 	VOPNAME_MAP,		{ .vop_map = ufs_map },
221 	VOPNAME_ADDMAP,		{ .vop_addmap = ufs_addmap },	/* not blkd */
222 	VOPNAME_DELMAP,		{ .vop_delmap = ufs_delmap },	/* not blkd */
223 	VOPNAME_POLL,		{ .vop_poll = ufs_poll },	/* not blkd */
224 	VOPNAME_DUMP,		{ .vop_dump = ufs_dump },
225 	VOPNAME_PATHCONF,	{ .vop_pathconf = ufs_l_pathconf },
226 	VOPNAME_PAGEIO,		{ .vop_pageio = ufs_pageio },
227 	VOPNAME_DUMPCTL,	{ .vop_dumpctl = ufs_dumpctl },
228 	VOPNAME_GETSECATTR,	{ .vop_getsecattr = ufs_getsecattr },
229 	VOPNAME_SETSECATTR,	{ .vop_setsecattr = ufs_setsecattr },
230 	VOPNAME_VNEVENT,	{ .vop_vnevent = fs_vnevent_support },
231 	NULL,			NULL
232 };
233 
234 #define	MAX_BACKFILE_COUNT	9999
235 
236 /*
237  * Created by ufs_dumpctl() to store a file's disk block info into memory.
238  * Used by ufs_dump() to dump data to disk directly.
239  */
240 struct dump {
241 	struct inode	*ip;		/* the file we contain */
242 	daddr_t		fsbs;		/* number of blocks stored */
243 	struct timeval32 time;		/* time stamp for the struct */
244 	daddr32_t 	dblk[1];	/* place holder for block info */
245 };
246 
247 static struct dump *dump_info = NULL;
248 
249 /*
250  * Previously there was no special action required for ordinary files.
251  * (Devices are handled through the device file system.)
252  * Now we support Large Files and Large File API requires open to
253  * fail if file is large.
254  * We could take care to prevent data corruption
255  * by doing an atomic check of size and truncate if file is opened with
256  * FTRUNC flag set but traditionally this is being done by the vfs/vnode
257  * layers. So taking care of truncation here is a change in the existing
258  * semantics of VOP_OPEN and therefore we chose not to implement any thing
259  * here. The check for the size of the file > 2GB is being done at the
260  * vfs layer in routine vn_open().
261  */
262 
263 /* ARGSUSED */
264 static int
265 ufs_open(struct vnode **vpp, int flag, struct cred *cr, caller_context_t *ct)
266 {
267 	return (0);
268 }
269 
270 /*ARGSUSED*/
271 static int
272 ufs_close(struct vnode *vp, int flag, int count, offset_t offset,
273 	struct cred *cr, caller_context_t *ct)
274 {
275 	cleanlocks(vp, ttoproc(curthread)->p_pid, 0);
276 	cleanshares(vp, ttoproc(curthread)->p_pid);
277 
278 	/*
279 	 * Push partially filled cluster at last close.
280 	 * ``last close'' is approximated because the dnlc
281 	 * may have a hold on the vnode.
282 	 * Checking for VBAD here will also act as a forced umount check.
283 	 */
284 	if (vp->v_count <= 2 && vp->v_type != VBAD) {
285 		struct inode *ip = VTOI(vp);
286 		if (ip->i_delaylen) {
287 			ins.in_poc.value.ul++;
288 			(void) ufs_putpages(vp, ip->i_delayoff, ip->i_delaylen,
289 			    B_ASYNC | B_FREE, cr);
290 			ip->i_delaylen = 0;
291 		}
292 	}
293 
294 	return (0);
295 }
296 
297 /*ARGSUSED*/
298 static int
299 ufs_read(struct vnode *vp, struct uio *uiop, int ioflag, struct cred *cr,
300 	struct caller_context *ct)
301 {
302 	struct inode *ip = VTOI(vp);
303 	struct ufsvfs *ufsvfsp;
304 	struct ulockfs *ulp = NULL;
305 	int error = 0;
306 	int intrans = 0;
307 
308 	ASSERT(RW_READ_HELD(&ip->i_rwlock));
309 
310 	/*
311 	 * Mandatory locking needs to be done before ufs_lockfs_begin()
312 	 * and TRANS_BEGIN_SYNC() calls since mandatory locks can sleep.
313 	 */
314 	if (MANDLOCK(vp, ip->i_mode)) {
315 		/*
316 		 * ufs_getattr ends up being called by chklock
317 		 */
318 		error = chklock(vp, FREAD, uiop->uio_loffset,
319 		    uiop->uio_resid, uiop->uio_fmode, ct);
320 		if (error)
321 			goto out;
322 	}
323 
324 	ufsvfsp = ip->i_ufsvfs;
325 	error = ufs_lockfs_begin(ufsvfsp, &ulp, ULOCKFS_READ_MASK);
326 	if (error)
327 		goto out;
328 
329 	/*
330 	 * In the case that a directory is opened for reading as a file
331 	 * (eg "cat .") with the  O_RSYNC, O_SYNC and O_DSYNC flags set.
332 	 * The locking order had to be changed to avoid a deadlock with
333 	 * an update taking place on that directory at the same time.
334 	 */
335 	if ((ip->i_mode & IFMT) == IFDIR) {
336 
337 		rw_enter(&ip->i_contents, RW_READER);
338 		error = rdip(ip, uiop, ioflag, cr);
339 		rw_exit(&ip->i_contents);
340 
341 		if (error) {
342 			if (ulp)
343 				ufs_lockfs_end(ulp);
344 			goto out;
345 		}
346 
347 		if (ulp && (ioflag & FRSYNC) && (ioflag & (FSYNC | FDSYNC)) &&
348 		    TRANS_ISTRANS(ufsvfsp)) {
349 			rw_exit(&ip->i_rwlock);
350 			TRANS_BEGIN_SYNC(ufsvfsp, TOP_READ_SYNC, TOP_READ_SIZE,
351 			    error);
352 			ASSERT(!error);
353 			TRANS_END_SYNC(ufsvfsp, error, TOP_READ_SYNC,
354 			    TOP_READ_SIZE);
355 			rw_enter(&ip->i_rwlock, RW_READER);
356 		}
357 	} else {
358 		/*
359 		 * Only transact reads to files opened for sync-read and
360 		 * sync-write on a file system that is not write locked.
361 		 *
362 		 * The ``not write locked'' check prevents problems with
363 		 * enabling/disabling logging on a busy file system.  E.g.,
364 		 * logging exists at the beginning of the read but does not
365 		 * at the end.
366 		 *
367 		 */
368 		if (ulp && (ioflag & FRSYNC) && (ioflag & (FSYNC | FDSYNC)) &&
369 		    TRANS_ISTRANS(ufsvfsp)) {
370 			TRANS_BEGIN_SYNC(ufsvfsp, TOP_READ_SYNC, TOP_READ_SIZE,
371 			    error);
372 			ASSERT(!error);
373 			intrans = 1;
374 		}
375 
376 		rw_enter(&ip->i_contents, RW_READER);
377 		error = rdip(ip, uiop, ioflag, cr);
378 		rw_exit(&ip->i_contents);
379 
380 		if (intrans) {
381 			TRANS_END_SYNC(ufsvfsp, error, TOP_READ_SYNC,
382 			    TOP_READ_SIZE);
383 		}
384 	}
385 
386 	if (ulp) {
387 		ufs_lockfs_end(ulp);
388 	}
389 out:
390 
391 	return (error);
392 }
393 
394 extern	int	ufs_HW;		/* high water mark */
395 extern	int	ufs_LW;		/* low water mark */
396 int	ufs_WRITES = 1;		/* XXX - enable/disable */
397 int	ufs_throttles = 0;	/* throttling count */
398 int	ufs_allow_shared_writes = 1;	/* directio shared writes */
399 
400 static int
401 ufs_check_rewrite(struct inode *ip, struct uio *uiop, int ioflag)
402 {
403 	int	shared_write;
404 
405 	/*
406 	 * If the FDSYNC flag is set then ignore the global
407 	 * ufs_allow_shared_writes in this case.
408 	 */
409 	shared_write = (ioflag & FDSYNC) | ufs_allow_shared_writes;
410 
411 	/*
412 	 * Filter to determine if this request is suitable as a
413 	 * concurrent rewrite. This write must not allocate blocks
414 	 * by extending the file or filling in holes. No use trying
415 	 * through FSYNC descriptors as the inode will be synchronously
416 	 * updated after the write. The uio structure has not yet been
417 	 * checked for sanity, so assume nothing.
418 	 */
419 	return (((ip->i_mode & IFMT) == IFREG) && !(ioflag & FAPPEND) &&
420 	    (uiop->uio_loffset >= (offset_t)0) &&
421 	    (uiop->uio_loffset < ip->i_size) && (uiop->uio_resid > 0) &&
422 	    ((ip->i_size - uiop->uio_loffset) >= uiop->uio_resid) &&
423 	    !(ioflag & FSYNC) && !bmap_has_holes(ip) &&
424 	    shared_write);
425 }
426 
427 /*ARGSUSED*/
428 static int
429 ufs_write(struct vnode *vp, struct uio *uiop, int ioflag, cred_t *cr,
430 	caller_context_t *ct)
431 {
432 	struct inode *ip = VTOI(vp);
433 	struct ufsvfs *ufsvfsp;
434 	struct ulockfs *ulp;
435 	int retry = 1;
436 	int error, resv, resid = 0;
437 	int directio_status;
438 	int exclusive;
439 	int rewriteflg;
440 	long start_resid = uiop->uio_resid;
441 
442 	ASSERT(RW_LOCK_HELD(&ip->i_rwlock));
443 
444 retry_mandlock:
445 	/*
446 	 * Mandatory locking needs to be done before ufs_lockfs_begin()
447 	 * and TRANS_BEGIN_[A]SYNC() calls since mandatory locks can sleep.
448 	 * Check for forced unmounts normally done in ufs_lockfs_begin().
449 	 */
450 	if ((ufsvfsp = ip->i_ufsvfs) == NULL) {
451 		error = EIO;
452 		goto out;
453 	}
454 	if (MANDLOCK(vp, ip->i_mode)) {
455 
456 		ASSERT(RW_WRITE_HELD(&ip->i_rwlock));
457 
458 		/*
459 		 * ufs_getattr ends up being called by chklock
460 		 */
461 		error = chklock(vp, FWRITE, uiop->uio_loffset,
462 		    uiop->uio_resid, uiop->uio_fmode, ct);
463 		if (error)
464 			goto out;
465 	}
466 
467 	/* i_rwlock can change in chklock */
468 	exclusive = rw_write_held(&ip->i_rwlock);
469 	rewriteflg = ufs_check_rewrite(ip, uiop, ioflag);
470 
471 	/*
472 	 * Check for fast-path special case of directio re-writes.
473 	 */
474 	if ((ip->i_flag & IDIRECTIO || ufsvfsp->vfs_forcedirectio) &&
475 	    !exclusive && rewriteflg) {
476 
477 		error = ufs_lockfs_begin(ufsvfsp, &ulp, ULOCKFS_WRITE_MASK);
478 		if (error)
479 			goto out;
480 
481 		rw_enter(&ip->i_contents, RW_READER);
482 		error = ufs_directio_write(ip, uiop, ioflag, 1, cr,
483 		    &directio_status);
484 		if (directio_status == DIRECTIO_SUCCESS) {
485 			uint_t i_flag_save;
486 
487 			if (start_resid != uiop->uio_resid)
488 				error = 0;
489 			/*
490 			 * Special treatment of access times for re-writes.
491 			 * If IMOD is not already set, then convert it
492 			 * to IMODACC for this operation. This defers
493 			 * entering a delta into the log until the inode
494 			 * is flushed. This mimics what is done for read
495 			 * operations and inode access time.
496 			 */
497 			mutex_enter(&ip->i_tlock);
498 			i_flag_save = ip->i_flag;
499 			ip->i_flag |= IUPD | ICHG;
500 			ip->i_seq++;
501 			ITIMES_NOLOCK(ip);
502 			if ((i_flag_save & IMOD) == 0) {
503 				ip->i_flag &= ~IMOD;
504 				ip->i_flag |= IMODACC;
505 			}
506 			mutex_exit(&ip->i_tlock);
507 			rw_exit(&ip->i_contents);
508 			if (ulp)
509 				ufs_lockfs_end(ulp);
510 			goto out;
511 		}
512 		rw_exit(&ip->i_contents);
513 		if (ulp)
514 			ufs_lockfs_end(ulp);
515 	}
516 
517 	if (!exclusive && !rw_tryupgrade(&ip->i_rwlock)) {
518 		rw_exit(&ip->i_rwlock);
519 		rw_enter(&ip->i_rwlock, RW_WRITER);
520 		/*
521 		 * Mandatory locking could have been enabled
522 		 * after dropping the i_rwlock.
523 		 */
524 		if (MANDLOCK(vp, ip->i_mode))
525 			goto retry_mandlock;
526 	}
527 
528 	error = ufs_lockfs_begin(ufsvfsp, &ulp, ULOCKFS_WRITE_MASK);
529 	if (error)
530 		goto out;
531 
532 	/*
533 	 * Amount of log space needed for this write
534 	 */
535 	if (!rewriteflg || !(ioflag & FDSYNC))
536 		TRANS_WRITE_RESV(ip, uiop, ulp, &resv, &resid);
537 
538 	/*
539 	 * Throttle writes.
540 	 */
541 	if (ufs_WRITES && (ip->i_writes > ufs_HW)) {
542 		mutex_enter(&ip->i_tlock);
543 		while (ip->i_writes > ufs_HW) {
544 			ufs_throttles++;
545 			cv_wait(&ip->i_wrcv, &ip->i_tlock);
546 		}
547 		mutex_exit(&ip->i_tlock);
548 	}
549 
550 	/*
551 	 * Enter Transaction
552 	 *
553 	 * If the write is a rewrite there is no need to open a transaction
554 	 * if the FDSYNC flag is set and not the FSYNC.  In this case just
555 	 * set the IMODACC flag to modify do the update at a later time
556 	 * thus avoiding the overhead of the logging transaction that is
557 	 * not required.
558 	 */
559 	if (ioflag & (FSYNC|FDSYNC)) {
560 		if (ulp) {
561 			if (rewriteflg) {
562 				uint_t i_flag_save;
563 
564 				rw_enter(&ip->i_contents, RW_READER);
565 				mutex_enter(&ip->i_tlock);
566 				i_flag_save = ip->i_flag;
567 				ip->i_flag |= IUPD | ICHG;
568 				ip->i_seq++;
569 				ITIMES_NOLOCK(ip);
570 				if ((i_flag_save & IMOD) == 0) {
571 					ip->i_flag &= ~IMOD;
572 					ip->i_flag |= IMODACC;
573 				}
574 				mutex_exit(&ip->i_tlock);
575 				rw_exit(&ip->i_contents);
576 			} else {
577 				int terr = 0;
578 				TRANS_BEGIN_SYNC(ufsvfsp, TOP_WRITE_SYNC, resv,
579 				    terr);
580 				ASSERT(!terr);
581 			}
582 		}
583 	} else {
584 		if (ulp)
585 			TRANS_BEGIN_ASYNC(ufsvfsp, TOP_WRITE, resv);
586 	}
587 
588 	/*
589 	 * Write the file
590 	 */
591 	rw_enter(&ufsvfsp->vfs_dqrwlock, RW_READER);
592 	rw_enter(&ip->i_contents, RW_WRITER);
593 	if ((ioflag & FAPPEND) != 0 && (ip->i_mode & IFMT) == IFREG) {
594 		/*
595 		 * In append mode start at end of file.
596 		 */
597 		uiop->uio_loffset = ip->i_size;
598 	}
599 
600 	/*
601 	 * Mild optimisation, don't call ufs_trans_write() unless we have to
602 	 * Also, suppress file system full messages if we will retry.
603 	 */
604 	if (retry)
605 		ip->i_flag |= IQUIET;
606 	if (resid) {
607 		TRANS_WRITE(ip, uiop, ioflag, error, ulp, cr, resv, resid);
608 	} else {
609 		error = wrip(ip, uiop, ioflag, cr);
610 	}
611 	ip->i_flag &= ~IQUIET;
612 
613 	rw_exit(&ip->i_contents);
614 	rw_exit(&ufsvfsp->vfs_dqrwlock);
615 
616 	/*
617 	 * Leave Transaction
618 	 */
619 	if (ulp) {
620 		if (ioflag & (FSYNC|FDSYNC)) {
621 			if (!rewriteflg) {
622 				int terr = 0;
623 
624 				TRANS_END_SYNC(ufsvfsp, terr, TOP_WRITE_SYNC,
625 				    resv);
626 				if (error == 0)
627 					error = terr;
628 			}
629 		} else {
630 			TRANS_END_ASYNC(ufsvfsp, TOP_WRITE, resv);
631 		}
632 		ufs_lockfs_end(ulp);
633 	}
634 out:
635 	if ((error == ENOSPC) && retry && TRANS_ISTRANS(ufsvfsp)) {
636 		/*
637 		 * Any blocks tied up in pending deletes?
638 		 */
639 		ufs_delete_drain_wait(ufsvfsp, 1);
640 		retry = 0;
641 		goto retry_mandlock;
642 	}
643 
644 	if (error == ENOSPC && (start_resid != uiop->uio_resid))
645 		error = 0;
646 
647 	return (error);
648 }
649 
650 /*
651  * Don't cache write blocks to files with the sticky bit set.
652  * Used to keep swap files from blowing the page cache on a server.
653  */
654 int stickyhack = 1;
655 
656 /*
657  * Free behind hacks.  The pager is busted.
658  * XXX - need to pass the information down to writedone() in a flag like B_SEQ
659  * or B_FREE_IF_TIGHT_ON_MEMORY.
660  */
661 int	freebehind = 1;
662 int	smallfile = 0;
663 u_offset_t smallfile64 = 32 * 1024;
664 
665 /*
666  * While we should, in most cases, cache the pages for write, we
667  * may also want to cache the pages for read as long as they are
668  * frequently re-usable.
669  *
670  * If cache_read_ahead = 1, the pages for read will go to the tail
671  * of the cache list when they are released, otherwise go to the head.
672  */
673 int	cache_read_ahead = 0;
674 
675 /*
676  * Freebehind exists  so that as we read  large files  sequentially we
677  * don't consume most of memory with pages  from a few files. It takes
678  * longer to re-read from disk multiple small files as it does reading
679  * one large one sequentially.  As system  memory grows customers need
680  * to retain bigger chunks   of files in  memory.   The advent of  the
681  * cachelist opens up of the possibility freeing pages  to the head or
682  * tail of the list.
683  *
684  * Not freeing a page is a bet that the page will be read again before
685  * it's segmap slot is needed for something else. If we loose the bet,
686  * it means some  other thread is  burdened with the  page free we did
687  * not do. If we win we save a free and reclaim.
688  *
689  * Freeing it at the tail  vs the head of cachelist  is a bet that the
690  * page will survive until the next  read.  It's also saying that this
691  * page is more likely to  be re-used than a  page freed some time ago
692  * and never reclaimed.
693  *
694  * Freebehind maintains a  range of  file offset [smallfile1; smallfile2]
695  *
696  *            0 < offset < smallfile1 : pages are not freed.
697  *   smallfile1 < offset < smallfile2 : pages freed to tail of cachelist.
698  *   smallfile2 < offset              : pages freed to head of cachelist.
699  *
700  * The range  is  computed  at most  once  per second  and  depends on
701  * freemem  and  ncpus_online.  Both parameters  are   bounded to be
702  * >= smallfile && >= smallfile64.
703  *
704  * smallfile1 = (free memory / ncpu) / 1000
705  * smallfile2 = (free memory / ncpu) / 10
706  *
707  * A few examples values:
708  *
709  *       Free Mem (in Bytes) [smallfile1; smallfile2]  [smallfile1; smallfile2]
710  *                                 ncpus_online = 4          ncpus_online = 64
711  *       ------------------  -----------------------   -----------------------
712  *             1G                   [256K;  25M]               [32K; 1.5M]
713  *            10G                   [2.5M; 250M]              [156K; 15M]
714  *           100G                    [25M; 2.5G]              [1.5M; 150M]
715  *
716  */
717 
718 #define	SMALLFILE1_D 1000
719 #define	SMALLFILE2_D 10
720 static u_offset_t smallfile1 = 32 * 1024;
721 static u_offset_t smallfile2 = 32 * 1024;
722 static clock_t smallfile_update = 0; /* lbolt value of when to recompute */
723 uint_t smallfile1_d = SMALLFILE1_D;
724 uint_t smallfile2_d = SMALLFILE2_D;
725 
726 /*
727  * wrip does the real work of write requests for ufs.
728  */
729 int
730 wrip(struct inode *ip, struct uio *uio, int ioflag, struct cred *cr)
731 {
732 	rlim64_t limit = uio->uio_llimit;
733 	u_offset_t off;
734 	u_offset_t old_i_size;
735 	struct fs *fs;
736 	struct vnode *vp;
737 	struct ufsvfs *ufsvfsp;
738 	caddr_t base;
739 	long start_resid = uio->uio_resid;	/* save starting resid */
740 	long premove_resid;			/* resid before uiomove() */
741 	uint_t flags;
742 	int newpage;
743 	int iupdat_flag, directio_status;
744 	int n, on, mapon;
745 	int error, pagecreate;
746 	int do_dqrwlock;		/* drop/reacquire vfs_dqrwlock */
747 	int32_t	iblocks;
748 	int	new_iblocks;
749 
750 	/*
751 	 * ip->i_size is incremented before the uiomove
752 	 * is done on a write.  If the move fails (bad user
753 	 * address) reset ip->i_size.
754 	 * The better way would be to increment ip->i_size
755 	 * only if the uiomove succeeds.
756 	 */
757 	int i_size_changed = 0;
758 	o_mode_t type;
759 	int i_seq_needed = 0;
760 
761 	vp = ITOV(ip);
762 
763 	/*
764 	 * check for forced unmount - should not happen as
765 	 * the request passed the lockfs checks.
766 	 */
767 	if ((ufsvfsp = ip->i_ufsvfs) == NULL)
768 		return (EIO);
769 
770 	fs = ip->i_fs;
771 
772 	ASSERT(RW_WRITE_HELD(&ip->i_contents));
773 
774 	/* check for valid filetype */
775 	type = ip->i_mode & IFMT;
776 	if ((type != IFREG) && (type != IFDIR) && (type != IFATTRDIR) &&
777 	    (type != IFLNK) && (type != IFSHAD)) {
778 		return (EIO);
779 	}
780 
781 	/*
782 	 * the actual limit of UFS file size
783 	 * is UFS_MAXOFFSET_T
784 	 */
785 	if (limit == RLIM64_INFINITY || limit > MAXOFFSET_T)
786 		limit = MAXOFFSET_T;
787 
788 	if (uio->uio_loffset >= limit) {
789 		proc_t *p = ttoproc(curthread);
790 
791 		mutex_enter(&p->p_lock);
792 		(void) rctl_action(rctlproc_legacy[RLIMIT_FSIZE], p->p_rctls,
793 		    p, RCA_UNSAFE_SIGINFO);
794 		mutex_exit(&p->p_lock);
795 		return (EFBIG);
796 	}
797 
798 	/*
799 	 * if largefiles are disallowed, the limit is
800 	 * the pre-largefiles value of 2GB
801 	 */
802 	if (ufsvfsp->vfs_lfflags & UFS_LARGEFILES)
803 		limit = MIN(UFS_MAXOFFSET_T, limit);
804 	else
805 		limit = MIN(MAXOFF32_T, limit);
806 
807 	if (uio->uio_loffset < (offset_t)0) {
808 		return (EINVAL);
809 	}
810 	if (uio->uio_resid == 0) {
811 		return (0);
812 	}
813 
814 	if (uio->uio_loffset >= limit)
815 		return (EFBIG);
816 
817 	ip->i_flag |= INOACC;	/* don't update ref time in getpage */
818 
819 	if (ioflag & (FSYNC|FDSYNC)) {
820 		ip->i_flag |= ISYNC;
821 		iupdat_flag = 1;
822 	}
823 	/*
824 	 * Try to go direct
825 	 */
826 	if (ip->i_flag & IDIRECTIO || ufsvfsp->vfs_forcedirectio) {
827 		uio->uio_llimit = limit;
828 		error = ufs_directio_write(ip, uio, ioflag, 0, cr,
829 		    &directio_status);
830 		/*
831 		 * If ufs_directio wrote to the file or set the flags,
832 		 * we need to update i_seq, but it may be deferred.
833 		 */
834 		if (start_resid != uio->uio_resid ||
835 		    (ip->i_flag & (ICHG|IUPD))) {
836 			i_seq_needed = 1;
837 			ip->i_flag |= ISEQ;
838 		}
839 		if (directio_status == DIRECTIO_SUCCESS)
840 			goto out;
841 	}
842 
843 	/*
844 	 * Behavior with respect to dropping/reacquiring vfs_dqrwlock:
845 	 *
846 	 * o shadow inodes: vfs_dqrwlock is not held at all
847 	 * o quota updates: vfs_dqrwlock is read or write held
848 	 * o other updates: vfs_dqrwlock is read held
849 	 *
850 	 * The first case is the only one where we do not hold
851 	 * vfs_dqrwlock at all while entering wrip().
852 	 * We must make sure not to downgrade/drop vfs_dqrwlock if we
853 	 * have it as writer, i.e. if we are updating the quota inode.
854 	 * There is no potential deadlock scenario in this case as
855 	 * ufs_getpage() takes care of this and avoids reacquiring
856 	 * vfs_dqrwlock in that case.
857 	 *
858 	 * This check is done here since the above conditions do not change
859 	 * and we possibly loop below, so save a few cycles.
860 	 */
861 	if ((type == IFSHAD) ||
862 	    (rw_owner(&ufsvfsp->vfs_dqrwlock) == curthread)) {
863 			do_dqrwlock = 0;
864 	} else {
865 		do_dqrwlock = 1;
866 	}
867 
868 	/*
869 	 * Large Files: We cast MAXBMASK to offset_t
870 	 * inorder to mask out the higher bits. Since offset_t
871 	 * is a signed value, the high order bit set in MAXBMASK
872 	 * value makes it do the right thing by having all bits 1
873 	 * in the higher word. May be removed for _SOLARIS64_.
874 	 */
875 
876 	fs = ip->i_fs;
877 	do {
878 		u_offset_t uoff = uio->uio_loffset;
879 		off = uoff & (offset_t)MAXBMASK;
880 		mapon = (int)(uoff & (offset_t)MAXBOFFSET);
881 		on = (int)blkoff(fs, uoff);
882 		n = (int)MIN(fs->fs_bsize - on, uio->uio_resid);
883 		new_iblocks = 1;
884 
885 		if (type == IFREG && uoff + n >= limit) {
886 			if (uoff >= limit) {
887 				error = EFBIG;
888 				goto out;
889 			}
890 			/*
891 			 * since uoff + n >= limit,
892 			 * therefore n >= limit - uoff, and n is an int
893 			 * so it is safe to cast it to an int
894 			 */
895 			n = (int)(limit - (rlim64_t)uoff);
896 		}
897 		if (uoff + n > ip->i_size) {
898 			/*
899 			 * We are extending the length of the file.
900 			 * bmap is used so that we are sure that
901 			 * if we need to allocate new blocks, that it
902 			 * is done here before we up the file size.
903 			 */
904 			error = bmap_write(ip, uoff, (int)(on + n),
905 			    mapon == 0, NULL, cr);
906 			/*
907 			 * bmap_write never drops i_contents so if
908 			 * the flags are set it changed the file.
909 			 */
910 			if (ip->i_flag & (ICHG|IUPD)) {
911 				i_seq_needed = 1;
912 				ip->i_flag |= ISEQ;
913 			}
914 			if (error)
915 				break;
916 			/*
917 			 * There is a window of vulnerability here.
918 			 * The sequence of operations: allocate file
919 			 * system blocks, uiomove the data into pages,
920 			 * and then update the size of the file in the
921 			 * inode, must happen atomically.  However, due
922 			 * to current locking constraints, this can not
923 			 * be done.
924 			 */
925 			ASSERT(ip->i_writer == NULL);
926 			ip->i_writer = curthread;
927 			i_size_changed = 1;
928 			/*
929 			 * If we are writing from the beginning of
930 			 * the mapping, we can just create the
931 			 * pages without having to read them.
932 			 */
933 			pagecreate = (mapon == 0);
934 		} else if (n == MAXBSIZE) {
935 			/*
936 			 * Going to do a whole mappings worth,
937 			 * so we can just create the pages w/o
938 			 * having to read them in.  But before
939 			 * we do that, we need to make sure any
940 			 * needed blocks are allocated first.
941 			 */
942 			iblocks = ip->i_blocks;
943 			error = bmap_write(ip, uoff, (int)(on + n),
944 			    BI_ALLOC_ONLY, NULL, cr);
945 			/*
946 			 * bmap_write never drops i_contents so if
947 			 * the flags are set it changed the file.
948 			 */
949 			if (ip->i_flag & (ICHG|IUPD)) {
950 				i_seq_needed = 1;
951 				ip->i_flag |= ISEQ;
952 			}
953 			if (error)
954 				break;
955 			pagecreate = 1;
956 			/*
957 			 * check if the new created page needed the
958 			 * allocation of new disk blocks.
959 			 */
960 			if (iblocks == ip->i_blocks)
961 				new_iblocks = 0; /* no new blocks allocated */
962 		} else {
963 			pagecreate = 0;
964 			/*
965 			 * In sync mode flush the indirect blocks which
966 			 * may have been allocated and not written on
967 			 * disk. In above cases bmap_write will allocate
968 			 * in sync mode.
969 			 */
970 			if (ioflag & (FSYNC|FDSYNC)) {
971 				error = ufs_indirblk_sync(ip, uoff);
972 				if (error)
973 					break;
974 			}
975 		}
976 
977 		/*
978 		 * At this point we can enter ufs_getpage() in one
979 		 * of two ways:
980 		 * 1) segmap_getmapflt() calls ufs_getpage() when the
981 		 *    forcefault parameter is true (pagecreate == 0)
982 		 * 2) uiomove() causes a page fault.
983 		 *
984 		 * We have to drop the contents lock to prevent the VM
985 		 * system from trying to reacquire it in ufs_getpage()
986 		 * should the uiomove cause a pagefault.
987 		 *
988 		 * We have to drop the reader vfs_dqrwlock here as well.
989 		 */
990 		rw_exit(&ip->i_contents);
991 		if (do_dqrwlock) {
992 			ASSERT(RW_LOCK_HELD(&ufsvfsp->vfs_dqrwlock));
993 			ASSERT(!(RW_WRITE_HELD(&ufsvfsp->vfs_dqrwlock)));
994 			rw_exit(&ufsvfsp->vfs_dqrwlock);
995 		}
996 
997 		newpage = 0;
998 		premove_resid = uio->uio_resid;
999 		if (vpm_enable) {
1000 			/*
1001 			 * Copy data. If new pages are created, part of
1002 			 * the page that is not written will be initizliazed
1003 			 * with zeros.
1004 			 */
1005 			error = vpm_data_copy(vp, (off + mapon), (uint_t)n,
1006 			    uio, !pagecreate, &newpage, 0, S_WRITE);
1007 		} else {
1008 
1009 			base = segmap_getmapflt(segkmap, vp, (off + mapon),
1010 			    (uint_t)n, !pagecreate, S_WRITE);
1011 
1012 			/*
1013 			 * segmap_pagecreate() returns 1 if it calls
1014 			 * page_create_va() to allocate any pages.
1015 			 */
1016 
1017 			if (pagecreate)
1018 				newpage = segmap_pagecreate(segkmap, base,
1019 				    (size_t)n, 0);
1020 
1021 			error = uiomove(base + mapon, (long)n, UIO_WRITE, uio);
1022 		}
1023 
1024 		/*
1025 		 * If "newpage" is set, then a new page was created and it
1026 		 * does not contain valid data, so it needs to be initialized
1027 		 * at this point.
1028 		 * Otherwise the page contains old data, which was overwritten
1029 		 * partially or as a whole in uiomove.
1030 		 * If there is only one iovec structure within uio, then
1031 		 * on error uiomove will not be able to update uio->uio_loffset
1032 		 * and we would zero the whole page here!
1033 		 *
1034 		 * If uiomove fails because of an error, the old valid data
1035 		 * is kept instead of filling the rest of the page with zero's.
1036 		 */
1037 		if (!vpm_enable && newpage &&
1038 		    uio->uio_loffset < roundup(off + mapon + n, PAGESIZE)) {
1039 			/*
1040 			 * We created pages w/o initializing them completely,
1041 			 * thus we need to zero the part that wasn't set up.
1042 			 * This happens on most EOF write cases and if
1043 			 * we had some sort of error during the uiomove.
1044 			 */
1045 			int nzero, nmoved;
1046 
1047 			nmoved = (int)(uio->uio_loffset - (off + mapon));
1048 			ASSERT(nmoved >= 0 && nmoved <= n);
1049 			nzero = roundup(on + n, PAGESIZE) - nmoved;
1050 			ASSERT(nzero > 0 && mapon + nmoved + nzero <= MAXBSIZE);
1051 			(void) kzero(base + mapon + nmoved, (uint_t)nzero);
1052 		}
1053 
1054 		/*
1055 		 * Unlock the pages allocated by page_create_va()
1056 		 * in segmap_pagecreate()
1057 		 */
1058 		if (!vpm_enable && newpage)
1059 			segmap_pageunlock(segkmap, base, (size_t)n, S_WRITE);
1060 
1061 		/*
1062 		 * If the size of the file changed, then update the
1063 		 * size field in the inode now.  This can't be done
1064 		 * before the call to segmap_pageunlock or there is
1065 		 * a potential deadlock with callers to ufs_putpage().
1066 		 * They will be holding i_contents and trying to lock
1067 		 * a page, while this thread is holding a page locked
1068 		 * and trying to acquire i_contents.
1069 		 */
1070 		if (i_size_changed) {
1071 			rw_enter(&ip->i_contents, RW_WRITER);
1072 			old_i_size = ip->i_size;
1073 			UFS_SET_ISIZE(uoff + n, ip);
1074 			TRANS_INODE(ufsvfsp, ip);
1075 			/*
1076 			 * file has grown larger than 2GB. Set flag
1077 			 * in superblock to indicate this, if it
1078 			 * is not already set.
1079 			 */
1080 			if ((ip->i_size > MAXOFF32_T) &&
1081 			    !(fs->fs_flags & FSLARGEFILES)) {
1082 				ASSERT(ufsvfsp->vfs_lfflags & UFS_LARGEFILES);
1083 				mutex_enter(&ufsvfsp->vfs_lock);
1084 				fs->fs_flags |= FSLARGEFILES;
1085 				ufs_sbwrite(ufsvfsp);
1086 				mutex_exit(&ufsvfsp->vfs_lock);
1087 			}
1088 			mutex_enter(&ip->i_tlock);
1089 			ip->i_writer = NULL;
1090 			cv_broadcast(&ip->i_wrcv);
1091 			mutex_exit(&ip->i_tlock);
1092 			rw_exit(&ip->i_contents);
1093 		}
1094 
1095 		if (error) {
1096 			/*
1097 			 * If we failed on a write, we may have already
1098 			 * allocated file blocks as well as pages.  It's
1099 			 * hard to undo the block allocation, but we must
1100 			 * be sure to invalidate any pages that may have
1101 			 * been allocated.
1102 			 *
1103 			 * If the page was created without initialization
1104 			 * then we must check if it should be possible
1105 			 * to destroy the new page and to keep the old data
1106 			 * on the disk.
1107 			 *
1108 			 * It is possible to destroy the page without
1109 			 * having to write back its contents only when
1110 			 * - the size of the file keeps unchanged
1111 			 * - bmap_write() did not allocate new disk blocks
1112 			 *   it is possible to create big files using "seek" and
1113 			 *   write to the end of the file. A "write" to a
1114 			 *   position before the end of the file would not
1115 			 *   change the size of the file but it would allocate
1116 			 *   new disk blocks.
1117 			 * - uiomove intended to overwrite the whole page.
1118 			 * - a new page was created (newpage == 1).
1119 			 */
1120 
1121 			if (i_size_changed == 0 && new_iblocks == 0 &&
1122 			    newpage) {
1123 
1124 				/* unwind what uiomove eventually last did */
1125 				uio->uio_resid = premove_resid;
1126 
1127 				/*
1128 				 * destroy the page, do not write ambiguous
1129 				 * data to the disk.
1130 				 */
1131 				flags = SM_DESTROY;
1132 			} else {
1133 				/*
1134 				 * write the page back to the disk, if dirty,
1135 				 * and remove the page from the cache.
1136 				 */
1137 				flags = SM_INVAL;
1138 			}
1139 
1140 			if (vpm_enable) {
1141 				/*
1142 				 *  Flush pages.
1143 				 */
1144 				(void) vpm_sync_pages(vp, off, n, flags);
1145 			} else {
1146 				(void) segmap_release(segkmap, base, flags);
1147 			}
1148 		} else {
1149 			flags = 0;
1150 			/*
1151 			 * Force write back for synchronous write cases.
1152 			 */
1153 			if ((ioflag & (FSYNC|FDSYNC)) || type == IFDIR) {
1154 				/*
1155 				 * If the sticky bit is set but the
1156 				 * execute bit is not set, we do a
1157 				 * synchronous write back and free
1158 				 * the page when done.  We set up swap
1159 				 * files to be handled this way to
1160 				 * prevent servers from keeping around
1161 				 * the client's swap pages too long.
1162 				 * XXX - there ought to be a better way.
1163 				 */
1164 				if (IS_SWAPVP(vp)) {
1165 					flags = SM_WRITE | SM_FREE |
1166 					    SM_DONTNEED;
1167 					iupdat_flag = 0;
1168 				} else {
1169 					flags = SM_WRITE;
1170 				}
1171 			} else if (n + on == MAXBSIZE || IS_SWAPVP(vp)) {
1172 				/*
1173 				 * Have written a whole block.
1174 				 * Start an asynchronous write and
1175 				 * mark the buffer to indicate that
1176 				 * it won't be needed again soon.
1177 				 */
1178 				flags = SM_WRITE | SM_ASYNC | SM_DONTNEED;
1179 			}
1180 			if (vpm_enable) {
1181 				/*
1182 				 * Flush pages.
1183 				 */
1184 				error = vpm_sync_pages(vp, off, n, flags);
1185 			} else {
1186 				error = segmap_release(segkmap, base, flags);
1187 			}
1188 			/*
1189 			 * If the operation failed and is synchronous,
1190 			 * then we need to unwind what uiomove() last
1191 			 * did so we can potentially return an error to
1192 			 * the caller.  If this write operation was
1193 			 * done in two pieces and the first succeeded,
1194 			 * then we won't return an error for the second
1195 			 * piece that failed.  However, we only want to
1196 			 * return a resid value that reflects what was
1197 			 * really done.
1198 			 *
1199 			 * Failures for non-synchronous operations can
1200 			 * be ignored since the page subsystem will
1201 			 * retry the operation until it succeeds or the
1202 			 * file system is unmounted.
1203 			 */
1204 			if (error) {
1205 				if ((ioflag & (FSYNC | FDSYNC)) ||
1206 				    type == IFDIR) {
1207 					uio->uio_resid = premove_resid;
1208 				} else {
1209 					error = 0;
1210 				}
1211 			}
1212 		}
1213 
1214 		/*
1215 		 * Re-acquire contents lock.
1216 		 * If it was dropped, reacquire reader vfs_dqrwlock as well.
1217 		 */
1218 		if (do_dqrwlock)
1219 			rw_enter(&ufsvfsp->vfs_dqrwlock, RW_READER);
1220 		rw_enter(&ip->i_contents, RW_WRITER);
1221 
1222 		/*
1223 		 * If the uiomove() failed or if a synchronous
1224 		 * page push failed, fix up i_size.
1225 		 */
1226 		if (error) {
1227 			if (i_size_changed) {
1228 				/*
1229 				 * The uiomove failed, and we
1230 				 * allocated blocks,so get rid
1231 				 * of them.
1232 				 */
1233 				(void) ufs_itrunc(ip, old_i_size, 0, cr);
1234 			}
1235 		} else {
1236 			/*
1237 			 * XXX - Can this be out of the loop?
1238 			 */
1239 			ip->i_flag |= IUPD | ICHG;
1240 			/*
1241 			 * Only do one increase of i_seq for multiple
1242 			 * pieces.  Because we drop locks, record
1243 			 * the fact that we changed the timestamp and
1244 			 * are deferring the increase in case another thread
1245 			 * pushes our timestamp update.
1246 			 */
1247 			i_seq_needed = 1;
1248 			ip->i_flag |= ISEQ;
1249 			if (i_size_changed)
1250 				ip->i_flag |= IATTCHG;
1251 			if ((ip->i_mode & (IEXEC | (IEXEC >> 3) |
1252 			    (IEXEC >> 6))) != 0 &&
1253 			    (ip->i_mode & (ISUID | ISGID)) != 0 &&
1254 			    secpolicy_vnode_setid_retain(cr,
1255 			    (ip->i_mode & ISUID) != 0 && ip->i_uid == 0) != 0) {
1256 				/*
1257 				 * Clear Set-UID & Set-GID bits on
1258 				 * successful write if not privileged
1259 				 * and at least one of the execute bits
1260 				 * is set.  If we always clear Set-GID,
1261 				 * mandatory file and record locking is
1262 				 * unuseable.
1263 				 */
1264 				ip->i_mode &= ~(ISUID | ISGID);
1265 			}
1266 		}
1267 		/*
1268 		 * In the case the FDSYNC flag is set and this is a
1269 		 * "rewrite" we won't log a delta.
1270 		 * The FSYNC flag overrides all cases.
1271 		 */
1272 		if (!ufs_check_rewrite(ip, uio, ioflag) || !(ioflag & FDSYNC)) {
1273 			TRANS_INODE(ufsvfsp, ip);
1274 		}
1275 	} while (error == 0 && uio->uio_resid > 0 && n != 0);
1276 
1277 out:
1278 	/*
1279 	 * Make sure i_seq is increased at least once per write
1280 	 */
1281 	if (i_seq_needed) {
1282 		ip->i_seq++;
1283 		ip->i_flag &= ~ISEQ;	/* no longer deferred */
1284 	}
1285 
1286 	/*
1287 	 * Inode is updated according to this table -
1288 	 *
1289 	 *   FSYNC	  FDSYNC(posix.4)
1290 	 *   --------------------------
1291 	 *   always@	  IATTCHG|IBDWRITE
1292 	 *
1293 	 * @ - 	If we are doing synchronous write the only time we should
1294 	 *	not be sync'ing the ip here is if we have the stickyhack
1295 	 *	activated, the file is marked with the sticky bit and
1296 	 *	no exec bit, the file length has not been changed and
1297 	 *	no new blocks have been allocated during this write.
1298 	 */
1299 
1300 	if ((ip->i_flag & ISYNC) != 0) {
1301 		/*
1302 		 * we have eliminated nosync
1303 		 */
1304 		if ((ip->i_flag & (IATTCHG|IBDWRITE)) ||
1305 		    ((ioflag & FSYNC) && iupdat_flag)) {
1306 			ufs_iupdat(ip, 1);
1307 		}
1308 	}
1309 
1310 	/*
1311 	 * If we've already done a partial-write, terminate
1312 	 * the write but return no error unless the error is ENOSPC
1313 	 * because the caller can detect this and free resources and
1314 	 * try again.
1315 	 */
1316 	if ((start_resid != uio->uio_resid) && (error != ENOSPC))
1317 		error = 0;
1318 
1319 	ip->i_flag &= ~(INOACC | ISYNC);
1320 	ITIMES_NOLOCK(ip);
1321 	return (error);
1322 }
1323 
1324 /*
1325  * rdip does the real work of read requests for ufs.
1326  */
1327 int
1328 rdip(struct inode *ip, struct uio *uio, int ioflag, cred_t *cr)
1329 {
1330 	u_offset_t off;
1331 	caddr_t base;
1332 	struct fs *fs;
1333 	struct ufsvfs *ufsvfsp;
1334 	struct vnode *vp;
1335 	long oresid = uio->uio_resid;
1336 	u_offset_t n, on, mapon;
1337 	int error = 0;
1338 	int doupdate = 1;
1339 	uint_t flags;
1340 	int dofree, directio_status;
1341 	krw_t rwtype;
1342 	o_mode_t type;
1343 
1344 	vp = ITOV(ip);
1345 
1346 	ASSERT(RW_LOCK_HELD(&ip->i_contents));
1347 
1348 	ufsvfsp = ip->i_ufsvfs;
1349 
1350 	if (ufsvfsp == NULL)
1351 		return (EIO);
1352 
1353 	fs = ufsvfsp->vfs_fs;
1354 
1355 	/* check for valid filetype */
1356 	type = ip->i_mode & IFMT;
1357 	if ((type != IFREG) && (type != IFDIR) && (type != IFATTRDIR) &&
1358 	    (type != IFLNK) && (type != IFSHAD)) {
1359 		return (EIO);
1360 	}
1361 
1362 	if (uio->uio_loffset > UFS_MAXOFFSET_T) {
1363 		error = 0;
1364 		goto out;
1365 	}
1366 	if (uio->uio_loffset < (offset_t)0) {
1367 		return (EINVAL);
1368 	}
1369 	if (uio->uio_resid == 0) {
1370 		return (0);
1371 	}
1372 
1373 	if (!ULOCKFS_IS_NOIACC(ITOUL(ip)) && (fs->fs_ronly == 0) &&
1374 	    (!ufsvfsp->vfs_noatime)) {
1375 		mutex_enter(&ip->i_tlock);
1376 		ip->i_flag |= IACC;
1377 		mutex_exit(&ip->i_tlock);
1378 	}
1379 	/*
1380 	 * Try to go direct
1381 	 */
1382 	if (ip->i_flag & IDIRECTIO || ufsvfsp->vfs_forcedirectio) {
1383 		error = ufs_directio_read(ip, uio, cr, &directio_status);
1384 		if (directio_status == DIRECTIO_SUCCESS)
1385 			goto out;
1386 	}
1387 
1388 	rwtype = (rw_write_held(&ip->i_contents)?RW_WRITER:RW_READER);
1389 
1390 	do {
1391 		offset_t diff;
1392 		u_offset_t uoff = uio->uio_loffset;
1393 		off = uoff & (offset_t)MAXBMASK;
1394 		mapon = (u_offset_t)(uoff & (offset_t)MAXBOFFSET);
1395 		on = (u_offset_t)blkoff(fs, uoff);
1396 		n = MIN((u_offset_t)fs->fs_bsize - on,
1397 		    (u_offset_t)uio->uio_resid);
1398 
1399 		diff = ip->i_size - uoff;
1400 
1401 		if (diff <= (offset_t)0) {
1402 			error = 0;
1403 			goto out;
1404 		}
1405 		if (diff < (offset_t)n)
1406 			n = (int)diff;
1407 
1408 		/*
1409 		 * We update smallfile2 and smallfile1 at most every second.
1410 		 */
1411 		if (lbolt >= smallfile_update) {
1412 			uint64_t percpufreeb;
1413 			if (smallfile1_d == 0) smallfile1_d = SMALLFILE1_D;
1414 			if (smallfile2_d == 0) smallfile2_d = SMALLFILE2_D;
1415 			percpufreeb = ptob((uint64_t)freemem) / ncpus_online;
1416 			smallfile1 = percpufreeb / smallfile1_d;
1417 			smallfile2 = percpufreeb / smallfile2_d;
1418 			smallfile1 = MAX(smallfile1, smallfile);
1419 			smallfile1 = MAX(smallfile1, smallfile64);
1420 			smallfile2 = MAX(smallfile1, smallfile2);
1421 			smallfile_update = lbolt + hz;
1422 		}
1423 
1424 		dofree = freebehind &&
1425 		    ip->i_nextr == (off & PAGEMASK) && off > smallfile1;
1426 
1427 		/*
1428 		 * At this point we can enter ufs_getpage() in one of two
1429 		 * ways:
1430 		 * 1) segmap_getmapflt() calls ufs_getpage() when the
1431 		 *    forcefault parameter is true (value of 1 is passed)
1432 		 * 2) uiomove() causes a page fault.
1433 		 *
1434 		 * We cannot hold onto an i_contents reader lock without
1435 		 * risking deadlock in ufs_getpage() so drop a reader lock.
1436 		 * The ufs_getpage() dolock logic already allows for a
1437 		 * thread holding i_contents as writer to work properly
1438 		 * so we keep a writer lock.
1439 		 */
1440 		if (rwtype == RW_READER)
1441 			rw_exit(&ip->i_contents);
1442 
1443 		if (vpm_enable) {
1444 			/*
1445 			 * Copy data.
1446 			 */
1447 			error = vpm_data_copy(vp, (off + mapon), (uint_t)n,
1448 			    uio, 1, NULL, 0, S_READ);
1449 		} else {
1450 			base = segmap_getmapflt(segkmap, vp, (off + mapon),
1451 			    (uint_t)n, 1, S_READ);
1452 			error = uiomove(base + mapon, (long)n, UIO_READ, uio);
1453 		}
1454 
1455 		flags = 0;
1456 		if (!error) {
1457 			/*
1458 			 * If  reading sequential  we won't need  this
1459 			 * buffer again  soon.  For  offsets in  range
1460 			 * [smallfile1,  smallfile2] release the pages
1461 			 * at   the  tail  of the   cache list, larger
1462 			 * offsets are released at the head.
1463 			 */
1464 			if (dofree) {
1465 				flags = SM_FREE | SM_ASYNC;
1466 				if ((cache_read_ahead == 0) &&
1467 				    (off > smallfile2))
1468 					flags |=  SM_DONTNEED;
1469 			}
1470 			/*
1471 			 * In POSIX SYNC (FSYNC and FDSYNC) read mode,
1472 			 * we want to make sure that the page which has
1473 			 * been read, is written on disk if it is dirty.
1474 			 * And corresponding indirect blocks should also
1475 			 * be flushed out.
1476 			 */
1477 			if ((ioflag & FRSYNC) && (ioflag & (FSYNC|FDSYNC))) {
1478 				flags &= ~SM_ASYNC;
1479 				flags |= SM_WRITE;
1480 			}
1481 			if (vpm_enable) {
1482 				error = vpm_sync_pages(vp, off, n, flags);
1483 			} else {
1484 				error = segmap_release(segkmap, base, flags);
1485 			}
1486 		} else {
1487 			if (vpm_enable) {
1488 				(void) vpm_sync_pages(vp, off, n, flags);
1489 			} else {
1490 				(void) segmap_release(segkmap, base, flags);
1491 			}
1492 		}
1493 
1494 		if (rwtype == RW_READER)
1495 			rw_enter(&ip->i_contents, rwtype);
1496 	} while (error == 0 && uio->uio_resid > 0 && n != 0);
1497 out:
1498 	/*
1499 	 * Inode is updated according to this table if FRSYNC is set.
1500 	 *
1501 	 *   FSYNC	  FDSYNC(posix.4)
1502 	 *   --------------------------
1503 	 *   always	  IATTCHG|IBDWRITE
1504 	 */
1505 	/*
1506 	 * The inode is not updated if we're logging and the inode is a
1507 	 * directory with FRSYNC, FSYNC and FDSYNC flags set.
1508 	 */
1509 	if (ioflag & FRSYNC) {
1510 		if (TRANS_ISTRANS(ufsvfsp) && ((ip->i_mode & IFMT) == IFDIR)) {
1511 				doupdate = 0;
1512 		}
1513 		if (doupdate) {
1514 			if ((ioflag & FSYNC) ||
1515 			    ((ioflag & FDSYNC) &&
1516 			    (ip->i_flag & (IATTCHG|IBDWRITE)))) {
1517 				ufs_iupdat(ip, 1);
1518 			}
1519 		}
1520 	}
1521 	/*
1522 	 * If we've already done a partial read, terminate
1523 	 * the read but return no error.
1524 	 */
1525 	if (oresid != uio->uio_resid)
1526 		error = 0;
1527 	ITIMES(ip);
1528 
1529 	return (error);
1530 }
1531 
1532 /* ARGSUSED */
1533 static int
1534 ufs_ioctl(
1535 	struct vnode	*vp,
1536 	int		cmd,
1537 	intptr_t	arg,
1538 	int		flag,
1539 	struct cred	*cr,
1540 	int		*rvalp,
1541 	caller_context_t *ct)
1542 {
1543 	struct lockfs	lockfs, lockfs_out;
1544 	struct ufsvfs	*ufsvfsp = VTOI(vp)->i_ufsvfs;
1545 	char		*comment, *original_comment;
1546 	struct fs	*fs;
1547 	struct ulockfs	*ulp;
1548 	offset_t	off;
1549 	extern int	maxphys;
1550 	int		error;
1551 	int		issync;
1552 	int		trans_size;
1553 
1554 
1555 	/*
1556 	 * forcibly unmounted
1557 	 */
1558 	if (ufsvfsp == NULL) {
1559 		return (EIO);
1560 	}
1561 
1562 	fs = ufsvfsp->vfs_fs;
1563 
1564 	if (cmd == Q_QUOTACTL) {
1565 		error = ufs_lockfs_begin(ufsvfsp, &ulp, ULOCKFS_QUOTA_MASK);
1566 		if (error)
1567 			return (error);
1568 
1569 		if (ulp) {
1570 			TRANS_BEGIN_ASYNC(ufsvfsp, TOP_QUOTA,
1571 			    TOP_SETQUOTA_SIZE(fs));
1572 		}
1573 
1574 		error = quotactl(vp, arg, flag, cr);
1575 
1576 		if (ulp) {
1577 			TRANS_END_ASYNC(ufsvfsp, TOP_QUOTA,
1578 			    TOP_SETQUOTA_SIZE(fs));
1579 			ufs_lockfs_end(ulp);
1580 		}
1581 		return (error);
1582 	}
1583 
1584 	switch (cmd) {
1585 		case _FIOLFS:
1586 			/*
1587 			 * file system locking
1588 			 */
1589 			if (secpolicy_fs_config(cr, ufsvfsp->vfs_vfs) != 0)
1590 				return (EPERM);
1591 
1592 			if ((flag & DATAMODEL_MASK) == DATAMODEL_NATIVE) {
1593 				if (copyin((caddr_t)arg, &lockfs,
1594 				    sizeof (struct lockfs)))
1595 					return (EFAULT);
1596 			}
1597 #ifdef _SYSCALL32_IMPL
1598 			else {
1599 				struct lockfs32	lockfs32;
1600 				/* Translate ILP32 lockfs to LP64 lockfs */
1601 				if (copyin((caddr_t)arg, &lockfs32,
1602 				    sizeof (struct lockfs32)))
1603 					return (EFAULT);
1604 				lockfs.lf_lock = (ulong_t)lockfs32.lf_lock;
1605 				lockfs.lf_flags = (ulong_t)lockfs32.lf_flags;
1606 				lockfs.lf_key = (ulong_t)lockfs32.lf_key;
1607 				lockfs.lf_comlen = (ulong_t)lockfs32.lf_comlen;
1608 				lockfs.lf_comment =
1609 				    (caddr_t)(uintptr_t)lockfs32.lf_comment;
1610 			}
1611 #endif /* _SYSCALL32_IMPL */
1612 
1613 			if (lockfs.lf_comlen) {
1614 				if (lockfs.lf_comlen > LOCKFS_MAXCOMMENTLEN)
1615 					return (ENAMETOOLONG);
1616 				comment =
1617 				    kmem_alloc(lockfs.lf_comlen, KM_SLEEP);
1618 				if (copyin(lockfs.lf_comment, comment,
1619 				    lockfs.lf_comlen)) {
1620 					kmem_free(comment, lockfs.lf_comlen);
1621 					return (EFAULT);
1622 				}
1623 				original_comment = lockfs.lf_comment;
1624 				lockfs.lf_comment = comment;
1625 			}
1626 			if ((error = ufs_fiolfs(vp, &lockfs, 0)) == 0) {
1627 				lockfs.lf_comment = original_comment;
1628 
1629 				if ((flag & DATAMODEL_MASK) ==
1630 				    DATAMODEL_NATIVE) {
1631 					(void) copyout(&lockfs, (caddr_t)arg,
1632 					    sizeof (struct lockfs));
1633 				}
1634 #ifdef _SYSCALL32_IMPL
1635 				else {
1636 					struct lockfs32	lockfs32;
1637 					/* Translate LP64 to ILP32 lockfs */
1638 					lockfs32.lf_lock =
1639 					    (uint32_t)lockfs.lf_lock;
1640 					lockfs32.lf_flags =
1641 					    (uint32_t)lockfs.lf_flags;
1642 					lockfs32.lf_key =
1643 					    (uint32_t)lockfs.lf_key;
1644 					lockfs32.lf_comlen =
1645 					    (uint32_t)lockfs.lf_comlen;
1646 					lockfs32.lf_comment =
1647 					    (uint32_t)(uintptr_t)
1648 					    lockfs.lf_comment;
1649 					(void) copyout(&lockfs32, (caddr_t)arg,
1650 					    sizeof (struct lockfs32));
1651 				}
1652 #endif /* _SYSCALL32_IMPL */
1653 
1654 			} else {
1655 				if (lockfs.lf_comlen)
1656 					kmem_free(comment, lockfs.lf_comlen);
1657 			}
1658 			return (error);
1659 
1660 		case _FIOLFSS:
1661 			/*
1662 			 * get file system locking status
1663 			 */
1664 
1665 			if ((flag & DATAMODEL_MASK) == DATAMODEL_NATIVE) {
1666 				if (copyin((caddr_t)arg, &lockfs,
1667 				    sizeof (struct lockfs)))
1668 					return (EFAULT);
1669 			}
1670 #ifdef _SYSCALL32_IMPL
1671 			else {
1672 				struct lockfs32	lockfs32;
1673 				/* Translate ILP32 lockfs to LP64 lockfs */
1674 				if (copyin((caddr_t)arg, &lockfs32,
1675 				    sizeof (struct lockfs32)))
1676 					return (EFAULT);
1677 				lockfs.lf_lock = (ulong_t)lockfs32.lf_lock;
1678 				lockfs.lf_flags = (ulong_t)lockfs32.lf_flags;
1679 				lockfs.lf_key = (ulong_t)lockfs32.lf_key;
1680 				lockfs.lf_comlen = (ulong_t)lockfs32.lf_comlen;
1681 				lockfs.lf_comment =
1682 				    (caddr_t)(uintptr_t)lockfs32.lf_comment;
1683 			}
1684 #endif /* _SYSCALL32_IMPL */
1685 
1686 			if (error =  ufs_fiolfss(vp, &lockfs_out))
1687 				return (error);
1688 			lockfs.lf_lock = lockfs_out.lf_lock;
1689 			lockfs.lf_key = lockfs_out.lf_key;
1690 			lockfs.lf_flags = lockfs_out.lf_flags;
1691 			lockfs.lf_comlen = MIN(lockfs.lf_comlen,
1692 			    lockfs_out.lf_comlen);
1693 
1694 			if ((flag & DATAMODEL_MASK) == DATAMODEL_NATIVE) {
1695 				if (copyout(&lockfs, (caddr_t)arg,
1696 				    sizeof (struct lockfs)))
1697 					return (EFAULT);
1698 			}
1699 #ifdef _SYSCALL32_IMPL
1700 			else {
1701 				/* Translate LP64 to ILP32 lockfs */
1702 				struct lockfs32	lockfs32;
1703 				lockfs32.lf_lock = (uint32_t)lockfs.lf_lock;
1704 				lockfs32.lf_flags = (uint32_t)lockfs.lf_flags;
1705 				lockfs32.lf_key = (uint32_t)lockfs.lf_key;
1706 				lockfs32.lf_comlen = (uint32_t)lockfs.lf_comlen;
1707 				lockfs32.lf_comment =
1708 				    (uint32_t)(uintptr_t)lockfs.lf_comment;
1709 				if (copyout(&lockfs32, (caddr_t)arg,
1710 				    sizeof (struct lockfs32)))
1711 					return (EFAULT);
1712 			}
1713 #endif /* _SYSCALL32_IMPL */
1714 
1715 			if (lockfs.lf_comlen &&
1716 			    lockfs.lf_comment && lockfs_out.lf_comment)
1717 				if (copyout(lockfs_out.lf_comment,
1718 				    lockfs.lf_comment, lockfs.lf_comlen))
1719 					return (EFAULT);
1720 			return (0);
1721 
1722 		case _FIOSATIME:
1723 			/*
1724 			 * set access time
1725 			 */
1726 
1727 			/*
1728 			 * if mounted w/o atime, return quietly.
1729 			 * I briefly thought about returning ENOSYS, but
1730 			 * figured that most apps would consider this fatal
1731 			 * but the idea is to make this as seamless as poss.
1732 			 */
1733 			if (ufsvfsp->vfs_noatime)
1734 				return (0);
1735 
1736 			error = ufs_lockfs_begin(ufsvfsp, &ulp,
1737 			    ULOCKFS_SETATTR_MASK);
1738 			if (error)
1739 				return (error);
1740 
1741 			if (ulp) {
1742 				trans_size = (int)TOP_SETATTR_SIZE(VTOI(vp));
1743 				TRANS_BEGIN_CSYNC(ufsvfsp, issync,
1744 				    TOP_SETATTR, trans_size);
1745 			}
1746 
1747 			error = ufs_fiosatime(vp, (struct timeval *)arg,
1748 			    flag, cr);
1749 
1750 			if (ulp) {
1751 				TRANS_END_CSYNC(ufsvfsp, error, issync,
1752 				    TOP_SETATTR, trans_size);
1753 				ufs_lockfs_end(ulp);
1754 			}
1755 			return (error);
1756 
1757 		case _FIOSDIO:
1758 			/*
1759 			 * set delayed-io
1760 			 */
1761 			return (ufs_fiosdio(vp, (uint_t *)arg, flag, cr));
1762 
1763 		case _FIOGDIO:
1764 			/*
1765 			 * get delayed-io
1766 			 */
1767 			return (ufs_fiogdio(vp, (uint_t *)arg, flag, cr));
1768 
1769 		case _FIOIO:
1770 			/*
1771 			 * inode open
1772 			 */
1773 			error = ufs_lockfs_begin(ufsvfsp, &ulp,
1774 			    ULOCKFS_VGET_MASK);
1775 			if (error)
1776 				return (error);
1777 
1778 			error = ufs_fioio(vp, (struct fioio *)arg, flag, cr);
1779 
1780 			if (ulp) {
1781 				ufs_lockfs_end(ulp);
1782 			}
1783 			return (error);
1784 
1785 		case _FIOFFS:
1786 			/*
1787 			 * file system flush (push w/invalidate)
1788 			 */
1789 			if ((caddr_t)arg != NULL)
1790 				return (EINVAL);
1791 			return (ufs_fioffs(vp, NULL, cr));
1792 
1793 		case _FIOISBUSY:
1794 			/*
1795 			 * Contract-private interface for Legato
1796 			 * Purge this vnode from the DNLC and decide
1797 			 * if this vnode is busy (*arg == 1) or not
1798 			 * (*arg == 0)
1799 			 */
1800 			if (secpolicy_fs_config(cr, ufsvfsp->vfs_vfs) != 0)
1801 				return (EPERM);
1802 			error = ufs_fioisbusy(vp, (int *)arg, cr);
1803 			return (error);
1804 
1805 		case _FIODIRECTIO:
1806 			return (ufs_fiodirectio(vp, (int)arg, cr));
1807 
1808 		case _FIOTUNE:
1809 			/*
1810 			 * Tune the file system (aka setting fs attributes)
1811 			 */
1812 			error = ufs_lockfs_begin(ufsvfsp, &ulp,
1813 			    ULOCKFS_SETATTR_MASK);
1814 			if (error)
1815 				return (error);
1816 
1817 			error = ufs_fiotune(vp, (struct fiotune *)arg, cr);
1818 
1819 			if (ulp)
1820 				ufs_lockfs_end(ulp);
1821 			return (error);
1822 
1823 		case _FIOLOGENABLE:
1824 			if (secpolicy_fs_config(cr, ufsvfsp->vfs_vfs) != 0)
1825 				return (EPERM);
1826 			return (ufs_fiologenable(vp, (void *)arg, cr, flag));
1827 
1828 		case _FIOLOGDISABLE:
1829 			if (secpolicy_fs_config(cr, ufsvfsp->vfs_vfs) != 0)
1830 				return (EPERM);
1831 			return (ufs_fiologdisable(vp, (void *)arg, cr, flag));
1832 
1833 		case _FIOISLOG:
1834 			return (ufs_fioislog(vp, (void *)arg, cr, flag));
1835 
1836 		case _FIOSNAPSHOTCREATE_MULTI:
1837 		{
1838 			struct fiosnapcreate_multi	fc, *fcp;
1839 			size_t	fcm_size;
1840 
1841 			if (copyin((void *)arg, &fc, sizeof (fc)))
1842 				return (EFAULT);
1843 			if (fc.backfilecount > MAX_BACKFILE_COUNT)
1844 				return (EINVAL);
1845 			fcm_size = sizeof (struct fiosnapcreate_multi) +
1846 			    (fc.backfilecount - 1) * sizeof (int);
1847 			fcp = (struct fiosnapcreate_multi *)
1848 			    kmem_alloc(fcm_size, KM_SLEEP);
1849 			if (copyin((void *)arg, fcp, fcm_size)) {
1850 				kmem_free(fcp, fcm_size);
1851 				return (EFAULT);
1852 			}
1853 			error = ufs_snap_create(vp, fcp, cr);
1854 			if (!error && copyout(fcp, (void *)arg, fcm_size))
1855 				error = EFAULT;
1856 			kmem_free(fcp, fcm_size);
1857 			return (error);
1858 		}
1859 
1860 		case _FIOSNAPSHOTDELETE:
1861 		{
1862 			struct fiosnapdelete	fc;
1863 
1864 			if (copyin((void *)arg, &fc, sizeof (fc)))
1865 				return (EFAULT);
1866 			error = ufs_snap_delete(vp, &fc, cr);
1867 			if (!error && copyout(&fc, (void *)arg, sizeof (fc)))
1868 				error = EFAULT;
1869 			return (error);
1870 		}
1871 
1872 		case _FIOGETSUPERBLOCK:
1873 			if (copyout(fs, (void *)arg, SBSIZE))
1874 				return (EFAULT);
1875 			return (0);
1876 
1877 		case _FIOGETMAXPHYS:
1878 			if (copyout(&maxphys, (void *)arg, sizeof (maxphys)))
1879 				return (EFAULT);
1880 			return (0);
1881 
1882 		/*
1883 		 * The following 3 ioctls are for TSufs support
1884 		 * although could potentially be used elsewhere
1885 		 */
1886 		case _FIO_SET_LUFS_DEBUG:
1887 			if (secpolicy_fs_config(cr, ufsvfsp->vfs_vfs) != 0)
1888 				return (EPERM);
1889 			lufs_debug = (uint32_t)arg;
1890 			return (0);
1891 
1892 		case _FIO_SET_LUFS_ERROR:
1893 			if (secpolicy_fs_config(cr, ufsvfsp->vfs_vfs) != 0)
1894 				return (EPERM);
1895 			TRANS_SETERROR(ufsvfsp);
1896 			return (0);
1897 
1898 		case _FIO_GET_TOP_STATS:
1899 		{
1900 			fio_lufs_stats_t *ls;
1901 			ml_unit_t *ul = ufsvfsp->vfs_log;
1902 
1903 			ls = kmem_zalloc(sizeof (*ls), KM_SLEEP);
1904 			ls->ls_debug = ul->un_debug; /* return debug value */
1905 			/* Copy stucture if statistics are being kept */
1906 			if (ul->un_logmap->mtm_tops) {
1907 				ls->ls_topstats = *(ul->un_logmap->mtm_tops);
1908 			}
1909 			error = 0;
1910 			if (copyout(ls, (void *)arg, sizeof (*ls)))
1911 				error = EFAULT;
1912 			kmem_free(ls, sizeof (*ls));
1913 			return (error);
1914 		}
1915 
1916 		case _FIO_SEEK_DATA:
1917 		case _FIO_SEEK_HOLE:
1918 			if (ddi_copyin((void *)arg, &off, sizeof (off), flag))
1919 				return (EFAULT);
1920 			/* offset paramater is in/out */
1921 			error = ufs_fio_holey(vp, cmd, &off);
1922 			if (error)
1923 				return (error);
1924 			if (ddi_copyout(&off, (void *)arg, sizeof (off), flag))
1925 				return (EFAULT);
1926 			return (0);
1927 
1928 		default:
1929 			return (ENOTTY);
1930 	}
1931 }
1932 
1933 /* ARGSUSED */
1934 static int
1935 ufs_getattr(struct vnode *vp, struct vattr *vap, int flags,
1936 	struct cred *cr, caller_context_t *ct)
1937 {
1938 	struct inode *ip = VTOI(vp);
1939 	struct ufsvfs *ufsvfsp;
1940 	int err;
1941 
1942 	if (vap->va_mask == AT_SIZE) {
1943 		/*
1944 		 * for performance, if only the size is requested don't bother
1945 		 * with anything else.
1946 		 */
1947 		UFS_GET_ISIZE(&vap->va_size, ip);
1948 		return (0);
1949 	}
1950 
1951 	/*
1952 	 * inlined lockfs checks
1953 	 */
1954 	ufsvfsp = ip->i_ufsvfs;
1955 	if ((ufsvfsp == NULL) || ULOCKFS_IS_HLOCK(&ufsvfsp->vfs_ulockfs)) {
1956 		err = EIO;
1957 		goto out;
1958 	}
1959 
1960 	rw_enter(&ip->i_contents, RW_READER);
1961 	/*
1962 	 * Return all the attributes.  This should be refined so
1963 	 * that it only returns what's asked for.
1964 	 */
1965 
1966 	/*
1967 	 * Copy from inode table.
1968 	 */
1969 	vap->va_type = vp->v_type;
1970 	vap->va_mode = ip->i_mode & MODEMASK;
1971 	/*
1972 	 * If there is an ACL and there is a mask entry, then do the
1973 	 * extra work that completes the equivalent of an acltomode(3)
1974 	 * call.  According to POSIX P1003.1e, the acl mask should be
1975 	 * returned in the group permissions field.
1976 	 *
1977 	 * - start with the original permission and mode bits (from above)
1978 	 * - clear the group owner bits
1979 	 * - add in the mask bits.
1980 	 */
1981 	if (ip->i_ufs_acl && ip->i_ufs_acl->aclass.acl_ismask) {
1982 		vap->va_mode &= ~((VREAD | VWRITE | VEXEC) >> 3);
1983 		vap->va_mode |=
1984 		    (ip->i_ufs_acl->aclass.acl_maskbits & PERMMASK) << 3;
1985 	}
1986 	vap->va_uid = ip->i_uid;
1987 	vap->va_gid = ip->i_gid;
1988 	vap->va_fsid = ip->i_dev;
1989 	vap->va_nodeid = (ino64_t)ip->i_number;
1990 	vap->va_nlink = ip->i_nlink;
1991 	vap->va_size = ip->i_size;
1992 	if (vp->v_type == VCHR || vp->v_type == VBLK)
1993 		vap->va_rdev = ip->i_rdev;
1994 	else
1995 		vap->va_rdev = 0;	/* not a b/c spec. */
1996 	mutex_enter(&ip->i_tlock);
1997 	ITIMES_NOLOCK(ip);	/* mark correct time in inode */
1998 	vap->va_seq = ip->i_seq;
1999 	vap->va_atime.tv_sec = (time_t)ip->i_atime.tv_sec;
2000 	vap->va_atime.tv_nsec = ip->i_atime.tv_usec*1000;
2001 	vap->va_mtime.tv_sec = (time_t)ip->i_mtime.tv_sec;
2002 	vap->va_mtime.tv_nsec = ip->i_mtime.tv_usec*1000;
2003 	vap->va_ctime.tv_sec = (time_t)ip->i_ctime.tv_sec;
2004 	vap->va_ctime.tv_nsec = ip->i_ctime.tv_usec*1000;
2005 	mutex_exit(&ip->i_tlock);
2006 
2007 	switch (ip->i_mode & IFMT) {
2008 
2009 	case IFBLK:
2010 		vap->va_blksize = MAXBSIZE;		/* was BLKDEV_IOSIZE */
2011 		break;
2012 
2013 	case IFCHR:
2014 		vap->va_blksize = MAXBSIZE;
2015 		break;
2016 
2017 	default:
2018 		vap->va_blksize = ip->i_fs->fs_bsize;
2019 		break;
2020 	}
2021 	vap->va_nblocks = (fsblkcnt64_t)ip->i_blocks;
2022 	rw_exit(&ip->i_contents);
2023 	err = 0;
2024 
2025 out:
2026 	return (err);
2027 }
2028 
2029 /*ARGSUSED4*/
2030 static int
2031 ufs_setattr(
2032 	struct vnode *vp,
2033 	struct vattr *vap,
2034 	int flags,
2035 	struct cred *cr,
2036 	caller_context_t *ct)
2037 {
2038 	struct inode *ip = VTOI(vp);
2039 	struct ufsvfs *ufsvfsp = ip->i_ufsvfs;
2040 	struct fs *fs;
2041 	struct ulockfs *ulp;
2042 	char *errmsg1;
2043 	char *errmsg2;
2044 	long blocks;
2045 	long int mask = vap->va_mask;
2046 	size_t len1, len2;
2047 	int issync;
2048 	int trans_size;
2049 	int dotrans;
2050 	int dorwlock;
2051 	int error;
2052 	int owner_change;
2053 	int dodqlock;
2054 	timestruc_t now;
2055 	vattr_t oldva;
2056 	int retry = 1;
2057 	int indeadlock;
2058 
2059 	/*
2060 	 * Cannot set these attributes.
2061 	 */
2062 	if ((mask & AT_NOSET) || (mask & AT_XVATTR))
2063 		return (EINVAL);
2064 
2065 	/*
2066 	 * check for forced unmount
2067 	 */
2068 	if (ufsvfsp == NULL)
2069 		return (EIO);
2070 
2071 	fs = ufsvfsp->vfs_fs;
2072 	if (fs->fs_ronly != 0)
2073 		return (EROFS);
2074 
2075 again:
2076 	errmsg1 = NULL;
2077 	errmsg2 = NULL;
2078 	dotrans = 0;
2079 	dorwlock = 0;
2080 	dodqlock = 0;
2081 
2082 	error = ufs_lockfs_begin(ufsvfsp, &ulp, ULOCKFS_SETATTR_MASK);
2083 	if (error)
2084 		goto out;
2085 
2086 	/*
2087 	 * Acquire i_rwlock before TRANS_BEGIN_CSYNC() if this is a file.
2088 	 * This follows the protocol for read()/write().
2089 	 */
2090 	if (vp->v_type != VDIR) {
2091 		/*
2092 		 * ufs_tryirwlock uses rw_tryenter and checks for SLOCK to
2093 		 * avoid i_rwlock, ufs_lockfs_begin deadlock. If deadlock
2094 		 * possible, retries the operation.
2095 		 */
2096 		ufs_tryirwlock(&ip->i_rwlock, RW_WRITER, retry_file);
2097 		if (indeadlock) {
2098 			if (ulp)
2099 				ufs_lockfs_end(ulp);
2100 			goto again;
2101 		}
2102 		dorwlock = 1;
2103 	}
2104 
2105 	/*
2106 	 * Truncate file.  Must have write permission and not be a directory.
2107 	 */
2108 	if (mask & AT_SIZE) {
2109 		rw_enter(&ip->i_contents, RW_WRITER);
2110 		if (vp->v_type == VDIR) {
2111 			error = EISDIR;
2112 			goto update_inode;
2113 		}
2114 		if (error = ufs_iaccess(ip, IWRITE, cr))
2115 			goto update_inode;
2116 
2117 		rw_exit(&ip->i_contents);
2118 		error = TRANS_ITRUNC(ip, vap->va_size, 0, cr);
2119 		if (error) {
2120 			rw_enter(&ip->i_contents, RW_WRITER);
2121 			goto update_inode;
2122 		}
2123 	}
2124 
2125 	if (ulp) {
2126 		trans_size = (int)TOP_SETATTR_SIZE(ip);
2127 		TRANS_BEGIN_CSYNC(ufsvfsp, issync, TOP_SETATTR, trans_size);
2128 		++dotrans;
2129 	}
2130 
2131 	/*
2132 	 * Acquire i_rwlock after TRANS_BEGIN_CSYNC() if this is a directory.
2133 	 * This follows the protocol established by
2134 	 * ufs_link/create/remove/rename/mkdir/rmdir/symlink.
2135 	 */
2136 	if (vp->v_type == VDIR) {
2137 		ufs_tryirwlock_trans(&ip->i_rwlock, RW_WRITER, TOP_SETATTR,
2138 		    retry_dir);
2139 		if (indeadlock)
2140 			goto again;
2141 		dorwlock = 1;
2142 	}
2143 
2144 	/*
2145 	 * Grab quota lock if we are changing the file's owner.
2146 	 */
2147 	if (mask & AT_UID) {
2148 		rw_enter(&ufsvfsp->vfs_dqrwlock, RW_READER);
2149 		dodqlock = 1;
2150 	}
2151 	rw_enter(&ip->i_contents, RW_WRITER);
2152 
2153 	oldva.va_mode = ip->i_mode;
2154 	oldva.va_uid = ip->i_uid;
2155 	oldva.va_gid = ip->i_gid;
2156 
2157 	vap->va_mask &= ~AT_SIZE;
2158 	/*
2159 	 * ufs_iaccess is "close enough"; that's because it doesn't
2160 	 * map the defines.
2161 	 */
2162 	error = secpolicy_vnode_setattr(cr, vp, vap, &oldva, flags,
2163 	    ufs_iaccess, ip);
2164 	if (error)
2165 		goto update_inode;
2166 
2167 	mask = vap->va_mask;
2168 
2169 	/*
2170 	 * Change file access modes.
2171 	 */
2172 	if (mask & AT_MODE) {
2173 		ip->i_mode = (ip->i_mode & IFMT) | (vap->va_mode & ~IFMT);
2174 		TRANS_INODE(ufsvfsp, ip);
2175 		ip->i_flag |= ICHG;
2176 		if (stickyhack) {
2177 			mutex_enter(&vp->v_lock);
2178 			if ((ip->i_mode & (ISVTX | IEXEC | IFDIR)) == ISVTX)
2179 				vp->v_flag |= VSWAPLIKE;
2180 			else
2181 				vp->v_flag &= ~VSWAPLIKE;
2182 			mutex_exit(&vp->v_lock);
2183 		}
2184 	}
2185 	if (mask & (AT_UID|AT_GID)) {
2186 		if (mask & AT_UID) {
2187 			/*
2188 			 * Don't change ownership of the quota inode.
2189 			 */
2190 			if (ufsvfsp->vfs_qinod == ip) {
2191 				ASSERT(ufsvfsp->vfs_qflags & MQ_ENABLED);
2192 				error = EINVAL;
2193 				goto update_inode;
2194 			}
2195 
2196 			/*
2197 			 * No real ownership change.
2198 			 */
2199 			if (ip->i_uid == vap->va_uid) {
2200 				blocks = 0;
2201 				owner_change = 0;
2202 			}
2203 			/*
2204 			 * Remove the blocks and the file, from the old user's
2205 			 * quota.
2206 			 */
2207 			else {
2208 				blocks = ip->i_blocks;
2209 				owner_change = 1;
2210 
2211 				(void) chkdq(ip, -blocks, /* force */ 1, cr,
2212 				    (char **)NULL, (size_t *)NULL);
2213 				(void) chkiq(ufsvfsp, /* change */ -1, ip,
2214 				    (uid_t)ip->i_uid, /* force */ 1, cr,
2215 				    (char **)NULL, (size_t *)NULL);
2216 				dqrele(ip->i_dquot);
2217 			}
2218 
2219 			ip->i_uid = vap->va_uid;
2220 
2221 			/*
2222 			 * There is a real ownership change.
2223 			 */
2224 			if (owner_change) {
2225 				/*
2226 				 * Add the blocks and the file to the new
2227 				 * user's quota.
2228 				 */
2229 				ip->i_dquot = getinoquota(ip);
2230 				(void) chkdq(ip, blocks, /* force */ 1, cr,
2231 				    &errmsg1, &len1);
2232 				(void) chkiq(ufsvfsp, /* change */ 1,
2233 				    (struct inode *)NULL, (uid_t)ip->i_uid,
2234 				    /* force */ 1, cr, &errmsg2, &len2);
2235 			}
2236 		}
2237 		if (mask & AT_GID) {
2238 			ip->i_gid = vap->va_gid;
2239 		}
2240 		TRANS_INODE(ufsvfsp, ip);
2241 		ip->i_flag |= ICHG;
2242 	}
2243 	/*
2244 	 * Change file access or modified times.
2245 	 */
2246 	if (mask & (AT_ATIME|AT_MTIME)) {
2247 		/* Check that the time value is within ufs range */
2248 		if (((mask & AT_ATIME) && TIMESPEC_OVERFLOW(&vap->va_atime)) ||
2249 		    ((mask & AT_MTIME) && TIMESPEC_OVERFLOW(&vap->va_mtime))) {
2250 			error = EOVERFLOW;
2251 			goto update_inode;
2252 		}
2253 
2254 		/*
2255 		 * if the "noaccess" mount option is set and only atime
2256 		 * update is requested, do nothing. No error is returned.
2257 		 */
2258 		if ((ufsvfsp->vfs_noatime) &&
2259 		    ((mask & (AT_ATIME|AT_MTIME)) == AT_ATIME))
2260 			goto skip_atime;
2261 
2262 		if (mask & AT_ATIME) {
2263 			ip->i_atime.tv_sec = vap->va_atime.tv_sec;
2264 			ip->i_atime.tv_usec = vap->va_atime.tv_nsec / 1000;
2265 			ip->i_flag &= ~IACC;
2266 		}
2267 		if (mask & AT_MTIME) {
2268 			ip->i_mtime.tv_sec = vap->va_mtime.tv_sec;
2269 			ip->i_mtime.tv_usec = vap->va_mtime.tv_nsec / 1000;
2270 			gethrestime(&now);
2271 			if (now.tv_sec > TIME32_MAX) {
2272 				/*
2273 				 * In 2038, ctime sticks forever..
2274 				 */
2275 				ip->i_ctime.tv_sec = TIME32_MAX;
2276 				ip->i_ctime.tv_usec = 0;
2277 			} else {
2278 				ip->i_ctime.tv_sec = now.tv_sec;
2279 				ip->i_ctime.tv_usec = now.tv_nsec / 1000;
2280 			}
2281 			ip->i_flag &= ~(IUPD|ICHG);
2282 			ip->i_flag |= IMODTIME;
2283 		}
2284 		TRANS_INODE(ufsvfsp, ip);
2285 		ip->i_flag |= IMOD;
2286 	}
2287 
2288 skip_atime:
2289 	/*
2290 	 * The presence of a shadow inode may indicate an ACL, but does
2291 	 * not imply an ACL.  Future FSD types should be handled here too
2292 	 * and check for the presence of the attribute-specific data
2293 	 * before referencing it.
2294 	 */
2295 	if (ip->i_shadow) {
2296 		/*
2297 		 * XXX if ufs_iupdat is changed to sandbagged write fix
2298 		 * ufs_acl_setattr to push ip to keep acls consistent
2299 		 *
2300 		 * Suppress out of inodes messages if we will retry.
2301 		 */
2302 		if (retry)
2303 			ip->i_flag |= IQUIET;
2304 		error = ufs_acl_setattr(ip, vap, cr);
2305 		ip->i_flag &= ~IQUIET;
2306 	}
2307 
2308 update_inode:
2309 	/*
2310 	 * Setattr always increases the sequence number
2311 	 */
2312 	ip->i_seq++;
2313 
2314 	/*
2315 	 * if nfsd and not logging; push synchronously
2316 	 */
2317 	if ((curthread->t_flag & T_DONTPEND) && !TRANS_ISTRANS(ufsvfsp)) {
2318 		ufs_iupdat(ip, 1);
2319 	} else {
2320 		ITIMES_NOLOCK(ip);
2321 	}
2322 
2323 	rw_exit(&ip->i_contents);
2324 	if (dodqlock) {
2325 		rw_exit(&ufsvfsp->vfs_dqrwlock);
2326 	}
2327 	if (dorwlock)
2328 		rw_exit(&ip->i_rwlock);
2329 
2330 	if (ulp) {
2331 		if (dotrans) {
2332 			int terr = 0;
2333 			TRANS_END_CSYNC(ufsvfsp, terr, issync, TOP_SETATTR,
2334 			    trans_size);
2335 			if (error == 0)
2336 				error = terr;
2337 		}
2338 		ufs_lockfs_end(ulp);
2339 	}
2340 out:
2341 	/*
2342 	 * If out of inodes or blocks, see if we can free something
2343 	 * up from the delete queue.
2344 	 */
2345 	if ((error == ENOSPC) && retry && TRANS_ISTRANS(ufsvfsp)) {
2346 		ufs_delete_drain_wait(ufsvfsp, 1);
2347 		retry = 0;
2348 		if (errmsg1 != NULL)
2349 			kmem_free(errmsg1, len1);
2350 		if (errmsg2 != NULL)
2351 			kmem_free(errmsg2, len2);
2352 		goto again;
2353 	}
2354 	if (errmsg1 != NULL) {
2355 		uprintf(errmsg1);
2356 		kmem_free(errmsg1, len1);
2357 	}
2358 	if (errmsg2 != NULL) {
2359 		uprintf(errmsg2);
2360 		kmem_free(errmsg2, len2);
2361 	}
2362 	return (error);
2363 }
2364 
2365 /*ARGSUSED*/
2366 static int
2367 ufs_access(struct vnode *vp, int mode, int flags, struct cred *cr,
2368 	caller_context_t *ct)
2369 {
2370 	struct inode *ip = VTOI(vp);
2371 	int error;
2372 
2373 	if (ip->i_ufsvfs == NULL)
2374 		return (EIO);
2375 
2376 	rw_enter(&ip->i_contents, RW_READER);
2377 
2378 	/*
2379 	 * The ufs_iaccess function wants to be called with
2380 	 * mode bits expressed as "ufs specific" bits.
2381 	 * I.e., VWRITE|VREAD|VEXEC do not make sense to
2382 	 * ufs_iaccess() but IWRITE|IREAD|IEXEC do.
2383 	 * But since they're the same we just pass the vnode mode
2384 	 * bit but just verify that assumption at compile time.
2385 	 */
2386 #if IWRITE != VWRITE || IREAD != VREAD || IEXEC != VEXEC
2387 #error "ufs_access needs to map Vmodes to Imodes"
2388 #endif
2389 	error = ufs_iaccess(ip, mode, cr);
2390 
2391 	rw_exit(&ip->i_contents);
2392 
2393 	return (error);
2394 }
2395 
2396 /* ARGSUSED */
2397 static int
2398 ufs_readlink(struct vnode *vp, struct uio *uiop, struct cred *cr,
2399 	caller_context_t *ct)
2400 {
2401 	struct inode *ip = VTOI(vp);
2402 	struct ufsvfs *ufsvfsp;
2403 	struct ulockfs *ulp;
2404 	int error;
2405 	int fastsymlink;
2406 
2407 	if (vp->v_type != VLNK) {
2408 		error = EINVAL;
2409 		goto nolockout;
2410 	}
2411 
2412 	/*
2413 	 * If the symbolic link is empty there is nothing to read.
2414 	 * Fast-track these empty symbolic links
2415 	 */
2416 	if (ip->i_size == 0) {
2417 		error = 0;
2418 		goto nolockout;
2419 	}
2420 
2421 	ufsvfsp = ip->i_ufsvfs;
2422 	error = ufs_lockfs_begin(ufsvfsp, &ulp, ULOCKFS_READLINK_MASK);
2423 	if (error)
2424 		goto nolockout;
2425 	/*
2426 	 * The ip->i_rwlock protects the data blocks used for FASTSYMLINK
2427 	 */
2428 again:
2429 	fastsymlink = 0;
2430 	if (ip->i_flag & IFASTSYMLNK) {
2431 		rw_enter(&ip->i_rwlock, RW_READER);
2432 		rw_enter(&ip->i_contents, RW_READER);
2433 		if (ip->i_flag & IFASTSYMLNK) {
2434 			if (!ULOCKFS_IS_NOIACC(ITOUL(ip)) &&
2435 			    (ip->i_fs->fs_ronly == 0) &&
2436 			    (!ufsvfsp->vfs_noatime)) {
2437 				mutex_enter(&ip->i_tlock);
2438 				ip->i_flag |= IACC;
2439 				mutex_exit(&ip->i_tlock);
2440 			}
2441 			error = uiomove((caddr_t)&ip->i_db[1],
2442 			    MIN(ip->i_size, uiop->uio_resid),
2443 			    UIO_READ, uiop);
2444 			ITIMES(ip);
2445 			++fastsymlink;
2446 		}
2447 		rw_exit(&ip->i_contents);
2448 		rw_exit(&ip->i_rwlock);
2449 	}
2450 	if (!fastsymlink) {
2451 		ssize_t size;	/* number of bytes read  */
2452 		caddr_t basep;	/* pointer to input data */
2453 		ino_t ino;
2454 		long  igen;
2455 		struct uio tuio;	/* temp uio struct */
2456 		struct uio *tuiop;
2457 		iovec_t tiov;		/* temp iovec struct */
2458 		char kbuf[FSL_SIZE];	/* buffer to hold fast symlink */
2459 		int tflag = 0;		/* flag to indicate temp vars used */
2460 
2461 		ino = ip->i_number;
2462 		igen = ip->i_gen;
2463 		size = uiop->uio_resid;
2464 		basep = uiop->uio_iov->iov_base;
2465 		tuiop = uiop;
2466 
2467 		rw_enter(&ip->i_rwlock, RW_WRITER);
2468 		rw_enter(&ip->i_contents, RW_WRITER);
2469 		if (ip->i_flag & IFASTSYMLNK) {
2470 			rw_exit(&ip->i_contents);
2471 			rw_exit(&ip->i_rwlock);
2472 			goto again;
2473 		}
2474 
2475 		/* can this be a fast symlink and is it a user buffer? */
2476 		if (ip->i_size <= FSL_SIZE &&
2477 		    (uiop->uio_segflg == UIO_USERSPACE ||
2478 		    uiop->uio_segflg == UIO_USERISPACE)) {
2479 
2480 			bzero(&tuio, sizeof (struct uio));
2481 			/*
2482 			 * setup a kernel buffer to read link into.  this
2483 			 * is to fix a race condition where the user buffer
2484 			 * got corrupted before copying it into the inode.
2485 			 */
2486 			size = ip->i_size;
2487 			tiov.iov_len = size;
2488 			tiov.iov_base = kbuf;
2489 			tuio.uio_iov = &tiov;
2490 			tuio.uio_iovcnt = 1;
2491 			tuio.uio_offset = uiop->uio_offset;
2492 			tuio.uio_segflg = UIO_SYSSPACE;
2493 			tuio.uio_fmode = uiop->uio_fmode;
2494 			tuio.uio_extflg = uiop->uio_extflg;
2495 			tuio.uio_limit = uiop->uio_limit;
2496 			tuio.uio_resid = size;
2497 
2498 			basep = tuio.uio_iov->iov_base;
2499 			tuiop = &tuio;
2500 			tflag = 1;
2501 		}
2502 
2503 		error = rdip(ip, tuiop, 0, cr);
2504 		if (!(error == 0 && ip->i_number == ino && ip->i_gen == igen)) {
2505 			rw_exit(&ip->i_contents);
2506 			rw_exit(&ip->i_rwlock);
2507 			goto out;
2508 		}
2509 
2510 		if (tflag == 0)
2511 			size -= uiop->uio_resid;
2512 
2513 		if ((tflag == 0 && ip->i_size <= FSL_SIZE &&
2514 		    ip->i_size == size) || (tflag == 1 &&
2515 		    tuio.uio_resid == 0)) {
2516 			error = kcopy(basep, &ip->i_db[1], ip->i_size);
2517 			if (error == 0) {
2518 				ip->i_flag |= IFASTSYMLNK;
2519 				/*
2520 				 * free page
2521 				 */
2522 				(void) VOP_PUTPAGE(ITOV(ip),
2523 				    (offset_t)0, PAGESIZE,
2524 				    (B_DONTNEED | B_FREE | B_FORCE | B_ASYNC),
2525 				    cr, ct);
2526 			} else {
2527 				int i;
2528 				/* error, clear garbage left behind */
2529 				for (i = 1; i < NDADDR; i++)
2530 					ip->i_db[i] = 0;
2531 				for (i = 0; i < NIADDR; i++)
2532 					ip->i_ib[i] = 0;
2533 			}
2534 		}
2535 		if (tflag == 1) {
2536 			/* now, copy it into the user buffer */
2537 			error = uiomove((caddr_t)kbuf,
2538 			    MIN(size, uiop->uio_resid),
2539 			    UIO_READ, uiop);
2540 		}
2541 		rw_exit(&ip->i_contents);
2542 		rw_exit(&ip->i_rwlock);
2543 	}
2544 out:
2545 	if (ulp) {
2546 		ufs_lockfs_end(ulp);
2547 	}
2548 nolockout:
2549 	return (error);
2550 }
2551 
2552 /* ARGSUSED */
2553 static int
2554 ufs_fsync(struct vnode *vp, int syncflag, struct cred *cr,
2555 	caller_context_t *ct)
2556 {
2557 	struct inode *ip = VTOI(vp);
2558 	struct ufsvfs *ufsvfsp = ip->i_ufsvfs;
2559 	struct ulockfs *ulp;
2560 	int error;
2561 
2562 	error = ufs_lockfs_begin(ufsvfsp, &ulp, ULOCKFS_FSYNC_MASK);
2563 	if (error)
2564 		return (error);
2565 
2566 	if (TRANS_ISTRANS(ufsvfsp)) {
2567 		/*
2568 		 * First push out any data pages
2569 		 */
2570 		if (vn_has_cached_data(vp) && !(syncflag & FNODSYNC) &&
2571 		    (vp->v_type != VCHR) && !(IS_SWAPVP(vp))) {
2572 			error = VOP_PUTPAGE(vp, (offset_t)0, (size_t)0,
2573 			    0, CRED(), ct);
2574 			if (error)
2575 				goto out;
2576 		}
2577 
2578 		/*
2579 		 * Delta any delayed inode times updates
2580 		 * and push inode to log.
2581 		 * All other inode deltas will have already been delta'd
2582 		 * and will be pushed during the commit.
2583 		 */
2584 		if (!(syncflag & FDSYNC) &&
2585 		    ((ip->i_flag & (IMOD|IMODACC)) == IMODACC)) {
2586 			if (ulp) {
2587 				TRANS_BEGIN_ASYNC(ufsvfsp, TOP_FSYNC,
2588 				    TOP_SYNCIP_SIZE);
2589 			}
2590 			rw_enter(&ip->i_contents, RW_READER);
2591 			mutex_enter(&ip->i_tlock);
2592 			ip->i_flag &= ~IMODTIME;
2593 			mutex_exit(&ip->i_tlock);
2594 			ufs_iupdat(ip, I_SYNC);
2595 			rw_exit(&ip->i_contents);
2596 			if (ulp) {
2597 				TRANS_END_ASYNC(ufsvfsp, TOP_FSYNC,
2598 				    TOP_SYNCIP_SIZE);
2599 			}
2600 		}
2601 
2602 		/*
2603 		 * Commit the Moby transaction
2604 		 *
2605 		 * Deltas have already been made so we just need to
2606 		 * commit them with a synchronous transaction.
2607 		 * TRANS_BEGIN_SYNC() will return an error
2608 		 * if there are no deltas to commit, for an
2609 		 * empty transaction.
2610 		 */
2611 		if (ulp) {
2612 			TRANS_BEGIN_SYNC(ufsvfsp, TOP_FSYNC, TOP_COMMIT_SIZE,
2613 			    error);
2614 			if (error) {
2615 				error = 0; /* commit wasn't needed */
2616 				goto out;
2617 			}
2618 			TRANS_END_SYNC(ufsvfsp, error, TOP_FSYNC,
2619 			    TOP_COMMIT_SIZE);
2620 		}
2621 	} else {	/* not logging */
2622 		if (!(IS_SWAPVP(vp)))
2623 			if (syncflag & FNODSYNC) {
2624 				/* Just update the inode only */
2625 				TRANS_IUPDAT(ip, 1);
2626 				error = 0;
2627 			} else if (syncflag & FDSYNC)
2628 				/* Do data-synchronous writes */
2629 				error = TRANS_SYNCIP(ip, 0, I_DSYNC, TOP_FSYNC);
2630 			else
2631 				/* Do synchronous writes */
2632 				error = TRANS_SYNCIP(ip, 0, I_SYNC, TOP_FSYNC);
2633 
2634 		rw_enter(&ip->i_contents, RW_WRITER);
2635 		if (!error)
2636 			error = ufs_sync_indir(ip);
2637 		rw_exit(&ip->i_contents);
2638 	}
2639 out:
2640 	if (ulp) {
2641 		ufs_lockfs_end(ulp);
2642 	}
2643 	return (error);
2644 }
2645 
2646 /*ARGSUSED*/
2647 static void
2648 ufs_inactive(struct vnode *vp, struct cred *cr, caller_context_t *ct)
2649 {
2650 	ufs_iinactive(VTOI(vp));
2651 }
2652 
2653 /*
2654  * Unix file system operations having to do with directory manipulation.
2655  */
2656 int ufs_lookup_idle_count = 2;	/* Number of inodes to idle each time */
2657 /* ARGSUSED */
2658 static int
2659 ufs_lookup(struct vnode *dvp, char *nm, struct vnode **vpp,
2660 	struct pathname *pnp, int flags, struct vnode *rdir, struct cred *cr,
2661 	caller_context_t *ct, int *direntflags, pathname_t *realpnp)
2662 {
2663 	struct inode *ip;
2664 	struct inode *sip;
2665 	struct inode *xip;
2666 	struct ufsvfs *ufsvfsp;
2667 	struct ulockfs *ulp;
2668 	struct vnode *vp;
2669 	int error;
2670 
2671 	/*
2672 	 * Check flags for type of lookup (regular file or attribute file)
2673 	 */
2674 
2675 	ip = VTOI(dvp);
2676 
2677 	if (flags & LOOKUP_XATTR) {
2678 
2679 		/*
2680 		 * If not mounted with XATTR support then return EINVAL
2681 		 */
2682 
2683 		if (!(ip->i_ufsvfs->vfs_vfs->vfs_flag & VFS_XATTR))
2684 			return (EINVAL);
2685 		/*
2686 		 * We don't allow recursive attributes...
2687 		 * Maybe someday we will.
2688 		 */
2689 		if ((ip->i_cflags & IXATTR)) {
2690 			return (EINVAL);
2691 		}
2692 
2693 		if ((vp = dnlc_lookup(dvp, XATTR_DIR_NAME)) == NULL) {
2694 			error = ufs_xattr_getattrdir(dvp, &sip, flags, cr);
2695 			if (error) {
2696 				*vpp = NULL;
2697 				goto out;
2698 			}
2699 
2700 			vp = ITOV(sip);
2701 			dnlc_update(dvp, XATTR_DIR_NAME, vp);
2702 		}
2703 
2704 		/*
2705 		 * Check accessibility of directory.
2706 		 */
2707 		if (vp == DNLC_NO_VNODE) {
2708 			VN_RELE(vp);
2709 			error = ENOENT;
2710 			goto out;
2711 		}
2712 		if ((error = ufs_iaccess(VTOI(vp), IEXEC, cr)) != 0) {
2713 			VN_RELE(vp);
2714 			goto out;
2715 		}
2716 
2717 		*vpp = vp;
2718 		return (0);
2719 	}
2720 
2721 	/*
2722 	 * Check for a null component, which we should treat as
2723 	 * looking at dvp from within it's parent, so we don't
2724 	 * need a call to ufs_iaccess(), as it has already been
2725 	 * done.
2726 	 */
2727 	if (nm[0] == 0) {
2728 		VN_HOLD(dvp);
2729 		error = 0;
2730 		*vpp = dvp;
2731 		goto out;
2732 	}
2733 
2734 	/*
2735 	 * Check for "." ie itself. this is a quick check and
2736 	 * avoids adding "." into the dnlc (which have been seen
2737 	 * to occupy >10% of the cache).
2738 	 */
2739 	if ((nm[0] == '.') && (nm[1] == 0)) {
2740 		/*
2741 		 * Don't return without checking accessibility
2742 		 * of the directory. We only need the lock if
2743 		 * we are going to return it.
2744 		 */
2745 		if ((error = ufs_iaccess(ip, IEXEC, cr)) == 0) {
2746 			VN_HOLD(dvp);
2747 			*vpp = dvp;
2748 		}
2749 		goto out;
2750 	}
2751 
2752 	/*
2753 	 * Fast path: Check the directory name lookup cache.
2754 	 */
2755 	if (vp = dnlc_lookup(dvp, nm)) {
2756 		/*
2757 		 * Check accessibility of directory.
2758 		 */
2759 		if ((error = ufs_iaccess(ip, IEXEC, cr)) != 0) {
2760 			VN_RELE(vp);
2761 			goto out;
2762 		}
2763 		if (vp == DNLC_NO_VNODE) {
2764 			VN_RELE(vp);
2765 			error = ENOENT;
2766 			goto out;
2767 		}
2768 		xip = VTOI(vp);
2769 		ulp = NULL;
2770 		goto fastpath;
2771 	}
2772 
2773 	/*
2774 	 * Keep the idle queue from getting too long by
2775 	 * idling two inodes before attempting to allocate another.
2776 	 *    This operation must be performed before entering
2777 	 *    lockfs or a transaction.
2778 	 */
2779 	if (ufs_idle_q.uq_ne > ufs_idle_q.uq_hiwat)
2780 		if ((curthread->t_flag & T_DONTBLOCK) == 0) {
2781 			ins.in_lidles.value.ul += ufs_lookup_idle_count;
2782 			ufs_idle_some(ufs_lookup_idle_count);
2783 		}
2784 
2785 retry_lookup:
2786 	ufsvfsp = ip->i_ufsvfs;
2787 	error = ufs_lockfs_begin(ufsvfsp, &ulp, ULOCKFS_LOOKUP_MASK);
2788 	if (error)
2789 		goto out;
2790 
2791 	error = ufs_dirlook(ip, nm, &xip, cr, 1);
2792 
2793 fastpath:
2794 	if (error == 0) {
2795 		ip = xip;
2796 		*vpp = ITOV(ip);
2797 
2798 		/*
2799 		 * If vnode is a device return special vnode instead.
2800 		 */
2801 		if (IS_DEVVP(*vpp)) {
2802 			struct vnode *newvp;
2803 
2804 			newvp = specvp(*vpp, (*vpp)->v_rdev, (*vpp)->v_type,
2805 			    cr);
2806 			VN_RELE(*vpp);
2807 			if (newvp == NULL)
2808 				error = ENOSYS;
2809 			else
2810 				*vpp = newvp;
2811 		}
2812 	}
2813 	if (ulp) {
2814 		ufs_lockfs_end(ulp);
2815 	}
2816 
2817 	if (error == EAGAIN)
2818 		goto retry_lookup;
2819 
2820 out:
2821 	return (error);
2822 }
2823 
2824 /*ARGSUSED*/
2825 static int
2826 ufs_create(struct vnode *dvp, char *name, struct vattr *vap, enum vcexcl excl,
2827 	int mode, struct vnode **vpp, struct cred *cr, int flag,
2828 	caller_context_t *ct, vsecattr_t *vsecp)
2829 {
2830 	struct inode *ip;
2831 	struct inode *xip;
2832 	struct inode *dip;
2833 	struct vnode *xvp;
2834 	struct ufsvfs *ufsvfsp;
2835 	struct ulockfs *ulp;
2836 	int error;
2837 	int issync;
2838 	int truncflag;
2839 	int trans_size;
2840 	int noentry;
2841 	int defer_dip_seq_update = 0;	/* need to defer update of dip->i_seq */
2842 	int retry = 1;
2843 	int indeadlock;
2844 
2845 again:
2846 	ip = VTOI(dvp);
2847 	ufsvfsp = ip->i_ufsvfs;
2848 	truncflag = 0;
2849 
2850 	error = ufs_lockfs_begin(ufsvfsp, &ulp, ULOCKFS_CREATE_MASK);
2851 	if (error)
2852 		goto out;
2853 
2854 	if (ulp) {
2855 		trans_size = (int)TOP_CREATE_SIZE(ip);
2856 		TRANS_BEGIN_CSYNC(ufsvfsp, issync, TOP_CREATE, trans_size);
2857 	}
2858 
2859 	if ((vap->va_mode & VSVTX) && secpolicy_vnode_stky_modify(cr) != 0)
2860 		vap->va_mode &= ~VSVTX;
2861 
2862 	if (*name == '\0') {
2863 		/*
2864 		 * Null component name refers to the directory itself.
2865 		 */
2866 		VN_HOLD(dvp);
2867 		/*
2868 		 * Even though this is an error case, we need to grab the
2869 		 * quota lock since the error handling code below is common.
2870 		 */
2871 		rw_enter(&ufsvfsp->vfs_dqrwlock, RW_READER);
2872 		rw_enter(&ip->i_contents, RW_WRITER);
2873 		error = EEXIST;
2874 	} else {
2875 		xip = NULL;
2876 		noentry = 0;
2877 		/*
2878 		 * ufs_tryirwlock_trans uses rw_tryenter and checks for SLOCK
2879 		 * to avoid i_rwlock, ufs_lockfs_begin deadlock. If deadlock
2880 		 * possible, retries the operation.
2881 		 */
2882 		ufs_tryirwlock_trans(&ip->i_rwlock, RW_WRITER, TOP_CREATE,
2883 		    retry_dir);
2884 		if (indeadlock)
2885 			goto again;
2886 
2887 		xvp = dnlc_lookup(dvp, name);
2888 		if (xvp == DNLC_NO_VNODE) {
2889 			noentry = 1;
2890 			VN_RELE(xvp);
2891 			xvp = NULL;
2892 		}
2893 		if (xvp) {
2894 			rw_exit(&ip->i_rwlock);
2895 			if (error = ufs_iaccess(ip, IEXEC, cr)) {
2896 				VN_RELE(xvp);
2897 			} else {
2898 				error = EEXIST;
2899 				xip = VTOI(xvp);
2900 			}
2901 		} else {
2902 			/*
2903 			 * Suppress file system full message if we will retry
2904 			 */
2905 			error = ufs_direnter_cm(ip, name, DE_CREATE,
2906 			    vap, &xip, cr, (noentry | (retry ? IQUIET : 0)));
2907 			if (error == EAGAIN) {
2908 				if (ulp) {
2909 					TRANS_END_CSYNC(ufsvfsp, error, issync,
2910 					    TOP_CREATE, trans_size);
2911 					ufs_lockfs_end(ulp);
2912 				}
2913 				goto again;
2914 			}
2915 			rw_exit(&ip->i_rwlock);
2916 		}
2917 		ip = xip;
2918 		if (ip != NULL) {
2919 			rw_enter(&ufsvfsp->vfs_dqrwlock, RW_READER);
2920 			rw_enter(&ip->i_contents, RW_WRITER);
2921 		}
2922 	}
2923 
2924 	/*
2925 	 * If the file already exists and this is a non-exclusive create,
2926 	 * check permissions and allow access for non-directories.
2927 	 * Read-only create of an existing directory is also allowed.
2928 	 * We fail an exclusive create of anything which already exists.
2929 	 */
2930 	if (error == EEXIST) {
2931 		dip = VTOI(dvp);
2932 		if (excl == NONEXCL) {
2933 			if ((((ip->i_mode & IFMT) == IFDIR) ||
2934 			    ((ip->i_mode & IFMT) == IFATTRDIR)) &&
2935 			    (mode & IWRITE))
2936 				error = EISDIR;
2937 			else if (mode)
2938 				error = ufs_iaccess(ip, mode, cr);
2939 			else
2940 				error = 0;
2941 		}
2942 		if (error) {
2943 			rw_exit(&ip->i_contents);
2944 			rw_exit(&ufsvfsp->vfs_dqrwlock);
2945 			VN_RELE(ITOV(ip));
2946 			goto unlock;
2947 		}
2948 		/*
2949 		 * If the error EEXIST was set, then i_seq can not
2950 		 * have been updated. The sequence number interface
2951 		 * is defined such that a non-error VOP_CREATE must
2952 		 * increase the dir va_seq it by at least one. If we
2953 		 * have cleared the error, increase i_seq. Note that
2954 		 * we are increasing the dir i_seq and in rare cases
2955 		 * ip may actually be from the dvp, so we already have
2956 		 * the locks and it will not be subject to truncation.
2957 		 * In case we have to update i_seq of the parent
2958 		 * directory dip, we have to defer it till we have
2959 		 * released our locks on ip due to lock ordering requirements.
2960 		 */
2961 		if (ip != dip)
2962 			defer_dip_seq_update = 1;
2963 		else
2964 			ip->i_seq++;
2965 
2966 		if (((ip->i_mode & IFMT) == IFREG) &&
2967 		    (vap->va_mask & AT_SIZE) && vap->va_size == 0) {
2968 			/*
2969 			 * Truncate regular files, if requested by caller.
2970 			 * Grab i_rwlock to make sure no one else is
2971 			 * currently writing to the file (we promised
2972 			 * bmap we would do this).
2973 			 * Must get the locks in the correct order.
2974 			 */
2975 			if (ip->i_size == 0) {
2976 				ip->i_flag |= ICHG | IUPD;
2977 				ip->i_seq++;
2978 				TRANS_INODE(ufsvfsp, ip);
2979 			} else {
2980 				/*
2981 				 * Large Files: Why this check here?
2982 				 * Though we do it in vn_create() we really
2983 				 * want to guarantee that we do not destroy
2984 				 * Large file data by atomically checking
2985 				 * the size while holding the contents
2986 				 * lock.
2987 				 */
2988 				if (flag && !(flag & FOFFMAX) &&
2989 				    ((ip->i_mode & IFMT) == IFREG) &&
2990 				    (ip->i_size > (offset_t)MAXOFF32_T)) {
2991 					rw_exit(&ip->i_contents);
2992 					rw_exit(&ufsvfsp->vfs_dqrwlock);
2993 					error = EOVERFLOW;
2994 					goto unlock;
2995 				}
2996 				if (TRANS_ISTRANS(ufsvfsp))
2997 					truncflag++;
2998 				else {
2999 					rw_exit(&ip->i_contents);
3000 					rw_exit(&ufsvfsp->vfs_dqrwlock);
3001 					ufs_tryirwlock_trans(&ip->i_rwlock,
3002 					    RW_WRITER, TOP_CREATE,
3003 					    retry_file);
3004 					if (indeadlock) {
3005 						VN_RELE(ITOV(ip));
3006 						goto again;
3007 					}
3008 					rw_enter(&ufsvfsp->vfs_dqrwlock,
3009 					    RW_READER);
3010 					rw_enter(&ip->i_contents, RW_WRITER);
3011 					(void) ufs_itrunc(ip, (u_offset_t)0, 0,
3012 					    cr);
3013 					rw_exit(&ip->i_rwlock);
3014 				}
3015 
3016 			}
3017 			if (error == 0) {
3018 				vnevent_create(ITOV(ip), ct);
3019 			}
3020 		}
3021 	}
3022 
3023 	if (error) {
3024 		if (ip != NULL) {
3025 			rw_exit(&ufsvfsp->vfs_dqrwlock);
3026 			rw_exit(&ip->i_contents);
3027 		}
3028 		goto unlock;
3029 	}
3030 
3031 	*vpp = ITOV(ip);
3032 	ITIMES(ip);
3033 	rw_exit(&ip->i_contents);
3034 	rw_exit(&ufsvfsp->vfs_dqrwlock);
3035 
3036 	/*
3037 	 * If vnode is a device return special vnode instead.
3038 	 */
3039 	if (!error && IS_DEVVP(*vpp)) {
3040 		struct vnode *newvp;
3041 
3042 		newvp = specvp(*vpp, (*vpp)->v_rdev, (*vpp)->v_type, cr);
3043 		VN_RELE(*vpp);
3044 		if (newvp == NULL) {
3045 			error = ENOSYS;
3046 			goto unlock;
3047 		}
3048 		truncflag = 0;
3049 		*vpp = newvp;
3050 	}
3051 unlock:
3052 
3053 	/*
3054 	 * Do the deferred update of the parent directory's sequence
3055 	 * number now.
3056 	 */
3057 	if (defer_dip_seq_update == 1) {
3058 		rw_enter(&dip->i_contents, RW_READER);
3059 		mutex_enter(&dip->i_tlock);
3060 		dip->i_seq++;
3061 		mutex_exit(&dip->i_tlock);
3062 		rw_exit(&dip->i_contents);
3063 	}
3064 
3065 	if (ulp) {
3066 		int terr = 0;
3067 
3068 		TRANS_END_CSYNC(ufsvfsp, terr, issync, TOP_CREATE,
3069 		    trans_size);
3070 
3071 		/*
3072 		 * If we haven't had a more interesting failure
3073 		 * already, then anything that might've happened
3074 		 * here should be reported.
3075 		 */
3076 		if (error == 0)
3077 			error = terr;
3078 	}
3079 
3080 	if (!error && truncflag) {
3081 		ufs_tryirwlock(&ip->i_rwlock, RW_WRITER, retry_trunc);
3082 		if (indeadlock) {
3083 			if (ulp)
3084 				ufs_lockfs_end(ulp);
3085 			VN_RELE(ITOV(ip));
3086 			goto again;
3087 		}
3088 		(void) TRANS_ITRUNC(ip, (u_offset_t)0, 0, cr);
3089 		rw_exit(&ip->i_rwlock);
3090 	}
3091 
3092 	if (ulp)
3093 		ufs_lockfs_end(ulp);
3094 
3095 	/*
3096 	 * If no inodes available, try to free one up out of the
3097 	 * pending delete queue.
3098 	 */
3099 	if ((error == ENOSPC) && retry && TRANS_ISTRANS(ufsvfsp)) {
3100 		ufs_delete_drain_wait(ufsvfsp, 1);
3101 		retry = 0;
3102 		goto again;
3103 	}
3104 
3105 out:
3106 	return (error);
3107 }
3108 
3109 extern int ufs_idle_max;
3110 /*ARGSUSED*/
3111 static int
3112 ufs_remove(struct vnode *vp, char *nm, struct cred *cr,
3113 	caller_context_t *ct, int flags)
3114 {
3115 	struct inode *ip = VTOI(vp);
3116 	struct ufsvfs *ufsvfsp	= ip->i_ufsvfs;
3117 	struct ulockfs *ulp;
3118 	vnode_t *rmvp = NULL;	/* Vnode corresponding to name being removed */
3119 	int indeadlock;
3120 	int error;
3121 	int issync;
3122 	int trans_size;
3123 
3124 	/*
3125 	 * don't let the delete queue get too long
3126 	 */
3127 	if (ufsvfsp == NULL) {
3128 		error = EIO;
3129 		goto out;
3130 	}
3131 	if (ufsvfsp->vfs_delete.uq_ne > ufs_idle_max)
3132 		ufs_delete_drain(vp->v_vfsp, 1, 1);
3133 
3134 retry_remove:
3135 	error = ufs_lockfs_begin(ufsvfsp, &ulp, ULOCKFS_REMOVE_MASK);
3136 	if (error)
3137 		goto out;
3138 
3139 	if (ulp)
3140 		TRANS_BEGIN_CSYNC(ufsvfsp, issync, TOP_REMOVE,
3141 		    trans_size = (int)TOP_REMOVE_SIZE(VTOI(vp)));
3142 
3143 	/*
3144 	 * ufs_tryirwlock_trans uses rw_tryenter and checks for SLOCK
3145 	 * to avoid i_rwlock, ufs_lockfs_begin deadlock. If deadlock
3146 	 * possible, retries the operation.
3147 	 */
3148 	ufs_tryirwlock_trans(&ip->i_rwlock, RW_WRITER, TOP_REMOVE, retry);
3149 	if (indeadlock)
3150 		goto retry_remove;
3151 	error = ufs_dirremove(ip, nm, (struct inode *)0, (struct vnode *)0,
3152 	    DR_REMOVE, cr, &rmvp);
3153 	rw_exit(&ip->i_rwlock);
3154 
3155 	if (ulp) {
3156 		TRANS_END_CSYNC(ufsvfsp, error, issync, TOP_REMOVE, trans_size);
3157 		ufs_lockfs_end(ulp);
3158 	}
3159 
3160 	/*
3161 	 * This must be called after the remove transaction is closed.
3162 	 */
3163 	if (rmvp != NULL) {
3164 		/* Only send the event if there were no errors */
3165 		if (error == 0)
3166 			vnevent_remove(rmvp, vp, nm, ct);
3167 		VN_RELE(rmvp);
3168 	}
3169 out:
3170 	return (error);
3171 }
3172 
3173 /*
3174  * Link a file or a directory.  Only privileged processes are allowed to
3175  * make links to directories.
3176  */
3177 /*ARGSUSED*/
3178 static int
3179 ufs_link(struct vnode *tdvp, struct vnode *svp, char *tnm, struct cred *cr,
3180 	caller_context_t *ct, int flags)
3181 {
3182 	struct inode *sip;
3183 	struct inode *tdp = VTOI(tdvp);
3184 	struct ufsvfs *ufsvfsp = tdp->i_ufsvfs;
3185 	struct ulockfs *ulp;
3186 	struct vnode *realvp;
3187 	int error;
3188 	int issync;
3189 	int trans_size;
3190 	int isdev;
3191 	int indeadlock;
3192 
3193 retry_link:
3194 	error = ufs_lockfs_begin(ufsvfsp, &ulp, ULOCKFS_LINK_MASK);
3195 	if (error)
3196 		goto out;
3197 
3198 	if (ulp)
3199 		TRANS_BEGIN_CSYNC(ufsvfsp, issync, TOP_LINK,
3200 		    trans_size = (int)TOP_LINK_SIZE(VTOI(tdvp)));
3201 
3202 	if (VOP_REALVP(svp, &realvp, ct) == 0)
3203 		svp = realvp;
3204 
3205 	/*
3206 	 * Make sure link for extended attributes is valid
3207 	 * We only support hard linking of attr in ATTRDIR to ATTRDIR
3208 	 *
3209 	 * Make certain we don't attempt to look at a device node as
3210 	 * a ufs inode.
3211 	 */
3212 
3213 	isdev = IS_DEVVP(svp);
3214 	if (((isdev == 0) && ((VTOI(svp)->i_cflags & IXATTR) == 0) &&
3215 	    ((tdp->i_mode & IFMT) == IFATTRDIR)) ||
3216 	    ((isdev == 0) && (VTOI(svp)->i_cflags & IXATTR) &&
3217 	    ((tdp->i_mode & IFMT) == IFDIR))) {
3218 		error = EINVAL;
3219 		goto unlock;
3220 	}
3221 
3222 	sip = VTOI(svp);
3223 	if ((svp->v_type == VDIR &&
3224 	    secpolicy_fs_linkdir(cr, ufsvfsp->vfs_vfs) != 0) ||
3225 	    (sip->i_uid != crgetuid(cr) && secpolicy_basic_link(cr) != 0)) {
3226 		error = EPERM;
3227 		goto unlock;
3228 	}
3229 
3230 	/*
3231 	 * ufs_tryirwlock_trans uses rw_tryenter and checks for SLOCK
3232 	 * to avoid i_rwlock, ufs_lockfs_begin deadlock. If deadlock
3233 	 * possible, retries the operation.
3234 	 */
3235 	ufs_tryirwlock_trans(&tdp->i_rwlock, RW_WRITER, TOP_LINK, retry);
3236 	if (indeadlock)
3237 		goto retry_link;
3238 	error = ufs_direnter_lr(tdp, tnm, DE_LINK, (struct inode *)0,
3239 	    sip, cr, NULL);
3240 	rw_exit(&tdp->i_rwlock);
3241 
3242 unlock:
3243 	if (ulp) {
3244 		TRANS_END_CSYNC(ufsvfsp, error, issync, TOP_LINK, trans_size);
3245 		ufs_lockfs_end(ulp);
3246 	}
3247 
3248 	if (!error) {
3249 		vnevent_link(svp, ct);
3250 	}
3251 out:
3252 	return (error);
3253 }
3254 
3255 uint64_t ufs_rename_retry_cnt;
3256 uint64_t ufs_rename_upgrade_retry_cnt;
3257 uint64_t ufs_rename_dircheck_retry_cnt;
3258 clock_t	 ufs_rename_backoff_delay = 1;
3259 
3260 /*
3261  * Rename a file or directory.
3262  * We are given the vnode and entry string of the source and the
3263  * vnode and entry string of the place we want to move the source
3264  * to (the target). The essential operation is:
3265  *	unlink(target);
3266  *	link(source, target);
3267  *	unlink(source);
3268  * but "atomically".  Can't do full commit without saving state in
3269  * the inode on disk, which isn't feasible at this time.  Best we
3270  * can do is always guarantee that the TARGET exists.
3271  */
3272 
3273 /*ARGSUSED*/
3274 static int
3275 ufs_rename(
3276 	struct vnode *sdvp,		/* old (source) parent vnode */
3277 	char *snm,			/* old (source) entry name */
3278 	struct vnode *tdvp,		/* new (target) parent vnode */
3279 	char *tnm,			/* new (target) entry name */
3280 	struct cred *cr,
3281 	caller_context_t *ct,
3282 	int flags)
3283 {
3284 	struct inode *sip = NULL;	/* source inode */
3285 	struct inode *ip = NULL;	/* check inode */
3286 	struct inode *sdp;		/* old (source) parent inode */
3287 	struct inode *tdp;		/* new (target) parent inode */
3288 	struct vnode *tvp = NULL;	/* target vnode, if it exists */
3289 	struct vnode *realvp;
3290 	struct ufsvfs *ufsvfsp;
3291 	struct ulockfs *ulp;
3292 	struct ufs_slot slot;
3293 	timestruc_t now;
3294 	int error;
3295 	int issync;
3296 	int trans_size;
3297 	krwlock_t *first_lock;
3298 	krwlock_t *second_lock;
3299 	krwlock_t *reverse_lock;
3300 
3301 	sdp = VTOI(sdvp);
3302 	slot.fbp = NULL;
3303 	ufsvfsp = sdp->i_ufsvfs;
3304 retry_rename:
3305 	error = ufs_lockfs_begin(ufsvfsp, &ulp, ULOCKFS_RENAME_MASK);
3306 	if (error)
3307 		goto out;
3308 
3309 	if (ulp)
3310 		TRANS_BEGIN_CSYNC(ufsvfsp, issync, TOP_RENAME,
3311 		    trans_size = (int)TOP_RENAME_SIZE(sdp));
3312 
3313 	if (VOP_REALVP(tdvp, &realvp, ct) == 0)
3314 		tdvp = realvp;
3315 
3316 	tdp = VTOI(tdvp);
3317 
3318 
3319 	/*
3320 	 * We only allow renaming of attributes from ATTRDIR to ATTRDIR.
3321 	 */
3322 	if ((tdp->i_mode & IFMT) != (sdp->i_mode & IFMT)) {
3323 		error = EINVAL;
3324 		goto unlock;
3325 	}
3326 
3327 	/*
3328 	 * Look up inode of file we're supposed to rename.
3329 	 */
3330 	gethrestime(&now);
3331 	if (error = ufs_dirlook(sdp, snm, &sip, cr, 0)) {
3332 		if (error == EAGAIN) {
3333 			if (ulp) {
3334 				TRANS_END_CSYNC(ufsvfsp, error, issync,
3335 				    TOP_RENAME, trans_size);
3336 				ufs_lockfs_end(ulp);
3337 			}
3338 			goto retry_rename;
3339 		}
3340 
3341 		goto unlock;
3342 	}
3343 
3344 	/*
3345 	 * Lock both the source and target directories (they may be
3346 	 * the same) to provide the atomicity semantics that was
3347 	 * previously provided by the per file system vfs_rename_lock
3348 	 *
3349 	 * with vfs_rename_lock removed to allow simultaneous renames
3350 	 * within a file system, ufs_dircheckpath can deadlock while
3351 	 * traversing back to ensure that source is not a parent directory
3352 	 * of target parent directory. This is because we get into
3353 	 * ufs_dircheckpath with the sdp and tdp locks held as RW_WRITER.
3354 	 * If the tdp and sdp of the simultaneous renames happen to be
3355 	 * in the path of each other, it can lead to a deadlock. This
3356 	 * can be avoided by getting the locks as RW_READER here and then
3357 	 * upgrading to RW_WRITER after completing the ufs_dircheckpath.
3358 	 *
3359 	 * We hold the target directory's i_rwlock after calling
3360 	 * ufs_lockfs_begin but in many other operations (like ufs_readdir)
3361 	 * VOP_RWLOCK is explicitly called by the filesystem independent code
3362 	 * before calling the file system operation. In these cases the order
3363 	 * is reversed (i.e i_rwlock is taken first and then ufs_lockfs_begin
3364 	 * is called). This is fine as long as ufs_lockfs_begin acts as a VOP
3365 	 * counter but with ufs_quiesce setting the SLOCK bit this becomes a
3366 	 * synchronizing object which might lead to a deadlock. So we use
3367 	 * rw_tryenter instead of rw_enter. If we fail to get this lock and
3368 	 * find that SLOCK bit is set, we call ufs_lockfs_end and restart the
3369 	 * operation.
3370 	 */
3371 retry:
3372 	first_lock = &tdp->i_rwlock;
3373 	second_lock = &sdp->i_rwlock;
3374 retry_firstlock:
3375 	if (!rw_tryenter(first_lock, RW_READER)) {
3376 		/*
3377 		 * We didn't get the lock. Check if the SLOCK is set in the
3378 		 * ufsvfs. If yes, we might be in a deadlock. Safer to give up
3379 		 * and wait for SLOCK to be cleared.
3380 		 */
3381 
3382 		if (ulp && ULOCKFS_IS_SLOCK(ulp)) {
3383 			TRANS_END_CSYNC(ufsvfsp, error, issync, TOP_RENAME,
3384 			    trans_size);
3385 			ufs_lockfs_end(ulp);
3386 			goto retry_rename;
3387 
3388 		} else {
3389 			/*
3390 			 * SLOCK isn't set so this is a genuine synchronization
3391 			 * case. Let's try again after giving them a breather.
3392 			 */
3393 			delay(RETRY_LOCK_DELAY);
3394 			goto  retry_firstlock;
3395 		}
3396 	}
3397 	/*
3398 	 * Need to check if the tdp and sdp are same !!!
3399 	 */
3400 	if ((tdp != sdp) && (!rw_tryenter(second_lock, RW_READER))) {
3401 		/*
3402 		 * We didn't get the lock. Check if the SLOCK is set in the
3403 		 * ufsvfs. If yes, we might be in a deadlock. Safer to give up
3404 		 * and wait for SLOCK to be cleared.
3405 		 */
3406 
3407 		rw_exit(first_lock);
3408 		if (ulp && ULOCKFS_IS_SLOCK(ulp)) {
3409 			TRANS_END_CSYNC(ufsvfsp, error, issync, TOP_RENAME,
3410 			    trans_size);
3411 			ufs_lockfs_end(ulp);
3412 			goto retry_rename;
3413 
3414 		} else {
3415 			/*
3416 			 * So we couldn't get the second level peer lock *and*
3417 			 * the SLOCK bit isn't set. Too bad we can be
3418 			 * contentding with someone wanting these locks otherway
3419 			 * round. Reverse the locks in case there is a heavy
3420 			 * contention for the second level lock.
3421 			 */
3422 			reverse_lock = first_lock;
3423 			first_lock = second_lock;
3424 			second_lock = reverse_lock;
3425 			ufs_rename_retry_cnt++;
3426 			goto  retry_firstlock;
3427 		}
3428 	}
3429 
3430 	if (sip == tdp) {
3431 		error = EINVAL;
3432 		goto errout;
3433 	}
3434 	/*
3435 	 * Make sure we can delete the source entry.  This requires
3436 	 * write permission on the containing directory.
3437 	 * Check for sticky directories.
3438 	 */
3439 	rw_enter(&sdp->i_contents, RW_READER);
3440 	rw_enter(&sip->i_contents, RW_READER);
3441 	if ((error = ufs_iaccess(sdp, IWRITE, cr)) != 0 ||
3442 	    (error = ufs_sticky_remove_access(sdp, sip, cr)) != 0) {
3443 		rw_exit(&sip->i_contents);
3444 		rw_exit(&sdp->i_contents);
3445 		goto errout;
3446 	}
3447 
3448 	/*
3449 	 * If this is a rename of a directory and the parent is
3450 	 * different (".." must be changed), then the source
3451 	 * directory must not be in the directory hierarchy
3452 	 * above the target, as this would orphan everything
3453 	 * below the source directory.  Also the user must have
3454 	 * write permission in the source so as to be able to
3455 	 * change "..".
3456 	 */
3457 	if ((((sip->i_mode & IFMT) == IFDIR) ||
3458 	    ((sip->i_mode & IFMT) == IFATTRDIR)) && sdp != tdp) {
3459 		ino_t	inum;
3460 
3461 		if ((error = ufs_iaccess(sip, IWRITE, cr))) {
3462 			rw_exit(&sip->i_contents);
3463 			rw_exit(&sdp->i_contents);
3464 			goto errout;
3465 		}
3466 		inum = sip->i_number;
3467 		rw_exit(&sip->i_contents);
3468 		rw_exit(&sdp->i_contents);
3469 		if ((error = ufs_dircheckpath(inum, tdp, sdp, cr))) {
3470 			/*
3471 			 * If we got EAGAIN ufs_dircheckpath detected a
3472 			 * potential deadlock and backed out. We need
3473 			 * to retry the operation since sdp and tdp have
3474 			 * to be released to avoid the deadlock.
3475 			 */
3476 			if (error == EAGAIN) {
3477 				rw_exit(&tdp->i_rwlock);
3478 				if (tdp != sdp)
3479 					rw_exit(&sdp->i_rwlock);
3480 				delay(ufs_rename_backoff_delay);
3481 				ufs_rename_dircheck_retry_cnt++;
3482 				goto retry;
3483 			}
3484 			goto errout;
3485 		}
3486 	} else {
3487 		rw_exit(&sip->i_contents);
3488 		rw_exit(&sdp->i_contents);
3489 	}
3490 
3491 
3492 	/*
3493 	 * Check for renaming '.' or '..' or alias of '.'
3494 	 */
3495 	if (strcmp(snm, ".") == 0 || strcmp(snm, "..") == 0 || sdp == sip) {
3496 		error = EINVAL;
3497 		goto errout;
3498 	}
3499 
3500 	/*
3501 	 * Simultaneous renames can deadlock in ufs_dircheckpath since it
3502 	 * tries to traverse back the file tree with both tdp and sdp held
3503 	 * as RW_WRITER. To avoid that we have to hold the tdp and sdp locks
3504 	 * as RW_READERS  till ufs_dircheckpath is done.
3505 	 * Now that ufs_dircheckpath is done with, we can upgrade the locks
3506 	 * to RW_WRITER.
3507 	 */
3508 	if (!rw_tryupgrade(&tdp->i_rwlock)) {
3509 		/*
3510 		 * The upgrade failed. We got to give away the lock
3511 		 * as to avoid deadlocking with someone else who is
3512 		 * waiting for writer lock. With the lock gone, we
3513 		 * cannot be sure the checks done above will hold
3514 		 * good when we eventually get them back as writer.
3515 		 * So if we can't upgrade we drop the locks and retry
3516 		 * everything again.
3517 		 */
3518 		rw_exit(&tdp->i_rwlock);
3519 		if (tdp != sdp)
3520 			rw_exit(&sdp->i_rwlock);
3521 		delay(ufs_rename_backoff_delay);
3522 		ufs_rename_upgrade_retry_cnt++;
3523 		goto retry;
3524 	}
3525 	if (tdp != sdp) {
3526 		if (!rw_tryupgrade(&sdp->i_rwlock)) {
3527 			/*
3528 			 * The upgrade failed. We got to give away the lock
3529 			 * as to avoid deadlocking with someone else who is
3530 			 * waiting for writer lock. With the lock gone, we
3531 			 * cannot be sure the checks done above will hold
3532 			 * good when we eventually get them back as writer.
3533 			 * So if we can't upgrade we drop the locks and retry
3534 			 * everything again.
3535 			 */
3536 			rw_exit(&tdp->i_rwlock);
3537 			rw_exit(&sdp->i_rwlock);
3538 			delay(ufs_rename_backoff_delay);
3539 			ufs_rename_upgrade_retry_cnt++;
3540 			goto retry;
3541 		}
3542 	}
3543 
3544 	/*
3545 	 * Now that all the locks are held check to make sure another thread
3546 	 * didn't slip in and take out the sip.
3547 	 */
3548 	slot.status = NONE;
3549 	if ((sip->i_ctime.tv_usec * 1000) > now.tv_nsec ||
3550 	    sip->i_ctime.tv_sec > now.tv_sec) {
3551 		rw_enter(&sdp->i_ufsvfs->vfs_dqrwlock, RW_READER);
3552 		rw_enter(&sdp->i_contents, RW_WRITER);
3553 		error = ufs_dircheckforname(sdp, snm, strlen(snm), &slot,
3554 		    &ip, cr, 0);
3555 		rw_exit(&sdp->i_contents);
3556 		rw_exit(&sdp->i_ufsvfs->vfs_dqrwlock);
3557 		if (error) {
3558 			goto errout;
3559 		}
3560 		if (ip == NULL) {
3561 			error = ENOENT;
3562 			goto errout;
3563 		} else {
3564 			/*
3565 			 * If the inode was found need to drop the v_count
3566 			 * so as not to keep the filesystem from being
3567 			 * unmounted at a later time.
3568 			 */
3569 			VN_RELE(ITOV(ip));
3570 		}
3571 
3572 		/*
3573 		 * Release the slot.fbp that has the page mapped and
3574 		 * locked SE_SHARED, and could be used in in
3575 		 * ufs_direnter_lr() which needs to get the SE_EXCL lock
3576 		 * on said page.
3577 		 */
3578 		if (slot.fbp) {
3579 			fbrelse(slot.fbp, S_OTHER);
3580 			slot.fbp = NULL;
3581 		}
3582 	}
3583 
3584 	/*
3585 	 * Link source to the target.  If a target exists, return its
3586 	 * vnode pointer in tvp.  We'll release it after sending the
3587 	 * vnevent.
3588 	 */
3589 	if (error = ufs_direnter_lr(tdp, tnm, DE_RENAME, sdp, sip, cr, &tvp)) {
3590 		/*
3591 		 * ESAME isn't really an error; it indicates that the
3592 		 * operation should not be done because the source and target
3593 		 * are the same file, but that no error should be reported.
3594 		 */
3595 		if (error == ESAME)
3596 			error = 0;
3597 		goto errout;
3598 	}
3599 
3600 	/*
3601 	 * Unlink the source.
3602 	 * Remove the source entry.  ufs_dirremove() checks that the entry
3603 	 * still reflects sip, and returns an error if it doesn't.
3604 	 * If the entry has changed just forget about it.  Release
3605 	 * the source inode.
3606 	 */
3607 	if ((error = ufs_dirremove(sdp, snm, sip, (struct vnode *)0,
3608 	    DR_RENAME, cr, NULL)) == ENOENT)
3609 		error = 0;
3610 
3611 errout:
3612 	if (slot.fbp)
3613 		fbrelse(slot.fbp, S_OTHER);
3614 
3615 	rw_exit(&tdp->i_rwlock);
3616 	if (sdp != tdp) {
3617 		rw_exit(&sdp->i_rwlock);
3618 	}
3619 
3620 unlock:
3621 	if (ulp) {
3622 		TRANS_END_CSYNC(ufsvfsp, error, issync, TOP_RENAME, trans_size);
3623 		ufs_lockfs_end(ulp);
3624 	}
3625 
3626 	/*
3627 	 * If no errors, send the appropriate events on the source
3628 	 * and destination (a.k.a, target) vnodes, if they exist.
3629 	 * This has to be done after the rename transaction has closed.
3630 	 */
3631 	if (error == 0) {
3632 		if (tvp != NULL)
3633 			vnevent_rename_dest(tvp, tdvp, tnm, ct);
3634 
3635 		/*
3636 		 * Notify the target directory of the rename event
3637 		 * if source and target directories are not same.
3638 		 */
3639 		if (sdvp != tdvp)
3640 			vnevent_rename_dest_dir(tdvp, ct);
3641 
3642 		/*
3643 		 * Note that if ufs_direnter_lr() returned ESAME then
3644 		 * this event will still be sent.  This isn't expected
3645 		 * to be a problem for anticipated usage by consumers.
3646 		 */
3647 		if (sip != NULL)
3648 			vnevent_rename_src(ITOV(sip), sdvp, snm, ct);
3649 	}
3650 
3651 	if (tvp != NULL)
3652 		VN_RELE(tvp);
3653 
3654 	if (sip != NULL)
3655 		VN_RELE(ITOV(sip));
3656 
3657 out:
3658 	return (error);
3659 }
3660 
3661 /*ARGSUSED*/
3662 static int
3663 ufs_mkdir(struct vnode *dvp, char *dirname, struct vattr *vap,
3664 	struct vnode **vpp, struct cred *cr, caller_context_t *ct, int flags,
3665 	vsecattr_t *vsecp)
3666 {
3667 	struct inode *ip;
3668 	struct inode *xip;
3669 	struct ufsvfs *ufsvfsp;
3670 	struct ulockfs *ulp;
3671 	int error;
3672 	int issync;
3673 	int trans_size;
3674 	int indeadlock;
3675 	int retry = 1;
3676 
3677 	ASSERT((vap->va_mask & (AT_TYPE|AT_MODE)) == (AT_TYPE|AT_MODE));
3678 
3679 	/*
3680 	 * Can't make directory in attr hidden dir
3681 	 */
3682 	if ((VTOI(dvp)->i_mode & IFMT) == IFATTRDIR)
3683 		return (EINVAL);
3684 
3685 again:
3686 	ip = VTOI(dvp);
3687 	ufsvfsp = ip->i_ufsvfs;
3688 	error = ufs_lockfs_begin(ufsvfsp, &ulp, ULOCKFS_MKDIR_MASK);
3689 	if (error)
3690 		goto out;
3691 	if (ulp)
3692 		TRANS_BEGIN_CSYNC(ufsvfsp, issync, TOP_MKDIR,
3693 		    trans_size = (int)TOP_MKDIR_SIZE(ip));
3694 
3695 	/*
3696 	 * ufs_tryirwlock_trans uses rw_tryenter and checks for SLOCK
3697 	 * to avoid i_rwlock, ufs_lockfs_begin deadlock. If deadlock
3698 	 * possible, retries the operation.
3699 	 */
3700 	ufs_tryirwlock_trans(&ip->i_rwlock, RW_WRITER, TOP_MKDIR, retry);
3701 	if (indeadlock)
3702 		goto again;
3703 
3704 	error = ufs_direnter_cm(ip, dirname, DE_MKDIR, vap, &xip, cr,
3705 	    (retry ? IQUIET : 0));
3706 	if (error == EAGAIN) {
3707 		if (ulp) {
3708 			TRANS_END_CSYNC(ufsvfsp, error, issync, TOP_MKDIR,
3709 			    trans_size);
3710 			ufs_lockfs_end(ulp);
3711 		}
3712 		goto again;
3713 	}
3714 
3715 	rw_exit(&ip->i_rwlock);
3716 	if (error == 0) {
3717 		ip = xip;
3718 		*vpp = ITOV(ip);
3719 	} else if (error == EEXIST)
3720 		VN_RELE(ITOV(xip));
3721 
3722 	if (ulp) {
3723 		int terr = 0;
3724 		TRANS_END_CSYNC(ufsvfsp, terr, issync, TOP_MKDIR, trans_size);
3725 		ufs_lockfs_end(ulp);
3726 		if (error == 0)
3727 			error = terr;
3728 	}
3729 out:
3730 	if ((error == ENOSPC) && retry && TRANS_ISTRANS(ufsvfsp)) {
3731 		ufs_delete_drain_wait(ufsvfsp, 1);
3732 		retry = 0;
3733 		goto again;
3734 	}
3735 
3736 	return (error);
3737 }
3738 
3739 /*ARGSUSED*/
3740 static int
3741 ufs_rmdir(struct vnode *vp, char *nm, struct vnode *cdir, struct cred *cr,
3742 	caller_context_t *ct, int flags)
3743 {
3744 	struct inode *ip = VTOI(vp);
3745 	struct ufsvfs *ufsvfsp = ip->i_ufsvfs;
3746 	struct ulockfs *ulp;
3747 	vnode_t *rmvp = NULL;	/* Vnode of removed directory */
3748 	int error;
3749 	int issync;
3750 	int trans_size;
3751 	int indeadlock;
3752 
3753 	/*
3754 	 * don't let the delete queue get too long
3755 	 */
3756 	if (ufsvfsp == NULL) {
3757 		error = EIO;
3758 		goto out;
3759 	}
3760 	if (ufsvfsp->vfs_delete.uq_ne > ufs_idle_max)
3761 		ufs_delete_drain(vp->v_vfsp, 1, 1);
3762 
3763 retry_rmdir:
3764 	error = ufs_lockfs_begin(ufsvfsp, &ulp, ULOCKFS_RMDIR_MASK);
3765 	if (error)
3766 		goto out;
3767 
3768 	if (ulp)
3769 		TRANS_BEGIN_CSYNC(ufsvfsp, issync, TOP_RMDIR,
3770 		    trans_size = TOP_RMDIR_SIZE);
3771 
3772 	/*
3773 	 * ufs_tryirwlock_trans uses rw_tryenter and checks for SLOCK
3774 	 * to avoid i_rwlock, ufs_lockfs_begin deadlock. If deadlock
3775 	 * possible, retries the operation.
3776 	 */
3777 	ufs_tryirwlock_trans(&ip->i_rwlock, RW_WRITER, TOP_RMDIR, retry);
3778 	if (indeadlock)
3779 		goto retry_rmdir;
3780 	error = ufs_dirremove(ip, nm, (struct inode *)0, cdir, DR_RMDIR, cr,
3781 	    &rmvp);
3782 	rw_exit(&ip->i_rwlock);
3783 
3784 	if (ulp) {
3785 		TRANS_END_CSYNC(ufsvfsp, error, issync, TOP_RMDIR,
3786 		    trans_size);
3787 		ufs_lockfs_end(ulp);
3788 	}
3789 
3790 	/*
3791 	 * This must be done AFTER the rmdir transaction has closed.
3792 	 */
3793 	if (rmvp != NULL) {
3794 		/* Only send the event if there were no errors */
3795 		if (error == 0)
3796 			vnevent_rmdir(rmvp, vp, nm, ct);
3797 		VN_RELE(rmvp);
3798 	}
3799 out:
3800 	return (error);
3801 }
3802 
3803 /* ARGSUSED */
3804 static int
3805 ufs_readdir(
3806 	struct vnode *vp,
3807 	struct uio *uiop,
3808 	struct cred *cr,
3809 	int *eofp,
3810 	caller_context_t *ct,
3811 	int flags)
3812 {
3813 	struct iovec *iovp;
3814 	struct inode *ip;
3815 	struct direct *idp;
3816 	struct dirent64 *odp;
3817 	struct fbuf *fbp;
3818 	struct ufsvfs *ufsvfsp;
3819 	struct ulockfs *ulp;
3820 	caddr_t outbuf;
3821 	size_t bufsize;
3822 	uint_t offset;
3823 	uint_t bytes_wanted, total_bytes_wanted;
3824 	int incount = 0;
3825 	int outcount = 0;
3826 	int error;
3827 
3828 	ip = VTOI(vp);
3829 	ASSERT(RW_READ_HELD(&ip->i_rwlock));
3830 
3831 	if (uiop->uio_loffset >= MAXOFF32_T) {
3832 		if (eofp)
3833 			*eofp = 1;
3834 		return (0);
3835 	}
3836 
3837 	/*
3838 	 * Check if we have been called with a valid iov_len
3839 	 * and bail out if not, otherwise we may potentially loop
3840 	 * forever further down.
3841 	 */
3842 	if (uiop->uio_iov->iov_len <= 0) {
3843 		error = EINVAL;
3844 		goto out;
3845 	}
3846 
3847 	/*
3848 	 * Large Files: When we come here we are guaranteed that
3849 	 * uio_offset can be used safely. The high word is zero.
3850 	 */
3851 
3852 	ufsvfsp = ip->i_ufsvfs;
3853 	error = ufs_lockfs_begin(ufsvfsp, &ulp, ULOCKFS_READDIR_MASK);
3854 	if (error)
3855 		goto out;
3856 
3857 	iovp = uiop->uio_iov;
3858 	total_bytes_wanted = iovp->iov_len;
3859 
3860 	/* Large Files: directory files should not be "large" */
3861 
3862 	ASSERT(ip->i_size <= MAXOFF32_T);
3863 
3864 	/* Force offset to be valid (to guard against bogus lseek() values) */
3865 	offset = (uint_t)uiop->uio_offset & ~(DIRBLKSIZ - 1);
3866 
3867 	/* Quit if at end of file or link count of zero (posix) */
3868 	if (offset >= (uint_t)ip->i_size || ip->i_nlink <= 0) {
3869 		if (eofp)
3870 			*eofp = 1;
3871 		error = 0;
3872 		goto unlock;
3873 	}
3874 
3875 	/*
3876 	 * Get space to change directory entries into fs independent format.
3877 	 * Do fast alloc for the most commonly used-request size (filesystem
3878 	 * block size).
3879 	 */
3880 	if (uiop->uio_segflg != UIO_SYSSPACE || uiop->uio_iovcnt != 1) {
3881 		bufsize = total_bytes_wanted;
3882 		outbuf = kmem_alloc(bufsize, KM_SLEEP);
3883 		odp = (struct dirent64 *)outbuf;
3884 	} else {
3885 		bufsize = total_bytes_wanted;
3886 		odp = (struct dirent64 *)iovp->iov_base;
3887 	}
3888 
3889 nextblk:
3890 	bytes_wanted = total_bytes_wanted;
3891 
3892 	/* Truncate request to file size */
3893 	if (offset + bytes_wanted > (int)ip->i_size)
3894 		bytes_wanted = (int)(ip->i_size - offset);
3895 
3896 	/* Comply with MAXBSIZE boundary restrictions of fbread() */
3897 	if ((offset & MAXBOFFSET) + bytes_wanted > MAXBSIZE)
3898 		bytes_wanted = MAXBSIZE - (offset & MAXBOFFSET);
3899 
3900 	/*
3901 	 * Read in the next chunk.
3902 	 * We are still holding the i_rwlock.
3903 	 */
3904 	error = fbread(vp, (offset_t)offset, bytes_wanted, S_OTHER, &fbp);
3905 
3906 	if (error)
3907 		goto update_inode;
3908 	if (!ULOCKFS_IS_NOIACC(ITOUL(ip)) && (ip->i_fs->fs_ronly == 0) &&
3909 	    (!ufsvfsp->vfs_noatime)) {
3910 		ip->i_flag |= IACC;
3911 	}
3912 	incount = 0;
3913 	idp = (struct direct *)fbp->fb_addr;
3914 	if (idp->d_ino == 0 && idp->d_reclen == 0 && idp->d_namlen == 0) {
3915 		cmn_err(CE_WARN, "ufs_readdir: bad dir, inumber = %llu, "
3916 		    "fs = %s\n",
3917 		    (u_longlong_t)ip->i_number, ufsvfsp->vfs_fs->fs_fsmnt);
3918 		fbrelse(fbp, S_OTHER);
3919 		error = ENXIO;
3920 		goto update_inode;
3921 	}
3922 	/* Transform to file-system independent format */
3923 	while (incount < bytes_wanted) {
3924 		/*
3925 		 * If the current directory entry is mangled, then skip
3926 		 * to the next block.  It would be nice to set the FSBAD
3927 		 * flag in the super-block so that a fsck is forced on
3928 		 * next reboot, but locking is a problem.
3929 		 */
3930 		if (idp->d_reclen & 0x3) {
3931 			offset = (offset + DIRBLKSIZ) & ~(DIRBLKSIZ-1);
3932 			break;
3933 		}
3934 
3935 		/* Skip to requested offset and skip empty entries */
3936 		if (idp->d_ino != 0 && offset >= (uint_t)uiop->uio_offset) {
3937 			ushort_t this_reclen =
3938 			    DIRENT64_RECLEN(idp->d_namlen);
3939 			/* Buffer too small for any entries */
3940 			if (!outcount && this_reclen > bufsize) {
3941 				fbrelse(fbp, S_OTHER);
3942 				error = EINVAL;
3943 				goto update_inode;
3944 			}
3945 			/* If would overrun the buffer, quit */
3946 			if (outcount + this_reclen > bufsize) {
3947 				break;
3948 			}
3949 			/* Take this entry */
3950 			odp->d_ino = (ino64_t)idp->d_ino;
3951 			odp->d_reclen = (ushort_t)this_reclen;
3952 			odp->d_off = (offset_t)(offset + idp->d_reclen);
3953 
3954 			/* use strncpy(9f) to zero out uninitialized bytes */
3955 
3956 			ASSERT(strlen(idp->d_name) + 1 <=
3957 			    DIRENT64_NAMELEN(this_reclen));
3958 			(void) strncpy(odp->d_name, idp->d_name,
3959 			    DIRENT64_NAMELEN(this_reclen));
3960 			outcount += odp->d_reclen;
3961 			odp = (struct dirent64 *)
3962 			    ((intptr_t)odp + odp->d_reclen);
3963 			ASSERT(outcount <= bufsize);
3964 		}
3965 		if (idp->d_reclen) {
3966 			incount += idp->d_reclen;
3967 			offset += idp->d_reclen;
3968 			idp = (struct direct *)((intptr_t)idp + idp->d_reclen);
3969 		} else {
3970 			offset = (offset + DIRBLKSIZ) & ~(DIRBLKSIZ-1);
3971 			break;
3972 		}
3973 	}
3974 	/* Release the chunk */
3975 	fbrelse(fbp, S_OTHER);
3976 
3977 	/* Read whole block, but got no entries, read another if not eof */
3978 
3979 	/*
3980 	 * Large Files: casting i_size to int here is not a problem
3981 	 * because directory sizes are always less than MAXOFF32_T.
3982 	 * See assertion above.
3983 	 */
3984 
3985 	if (offset < (int)ip->i_size && !outcount)
3986 		goto nextblk;
3987 
3988 	/* Copy out the entry data */
3989 	if (uiop->uio_segflg == UIO_SYSSPACE && uiop->uio_iovcnt == 1) {
3990 		iovp->iov_base += outcount;
3991 		iovp->iov_len -= outcount;
3992 		uiop->uio_resid -= outcount;
3993 		uiop->uio_offset = offset;
3994 	} else if ((error = uiomove(outbuf, (long)outcount, UIO_READ,
3995 	    uiop)) == 0)
3996 		uiop->uio_offset = offset;
3997 update_inode:
3998 	ITIMES(ip);
3999 	if (uiop->uio_segflg != UIO_SYSSPACE || uiop->uio_iovcnt != 1)
4000 		kmem_free(outbuf, bufsize);
4001 
4002 	if (eofp && error == 0)
4003 		*eofp = (uiop->uio_offset >= (int)ip->i_size);
4004 unlock:
4005 	if (ulp) {
4006 		ufs_lockfs_end(ulp);
4007 	}
4008 out:
4009 	return (error);
4010 }
4011 
4012 /*ARGSUSED*/
4013 static int
4014 ufs_symlink(
4015 	struct vnode *dvp,		/* ptr to parent dir vnode */
4016 	char *linkname,			/* name of symbolic link */
4017 	struct vattr *vap,		/* attributes */
4018 	char *target,			/* target path */
4019 	struct cred *cr,		/* user credentials */
4020 	caller_context_t *ct,
4021 	int flags)
4022 {
4023 	struct inode *ip, *dip = VTOI(dvp);
4024 	struct ufsvfs *ufsvfsp = dip->i_ufsvfs;
4025 	struct ulockfs *ulp;
4026 	int error;
4027 	int issync;
4028 	int trans_size;
4029 	int residual;
4030 	int ioflag;
4031 	int retry = 1;
4032 
4033 	/*
4034 	 * No symlinks in attrdirs at this time
4035 	 */
4036 	if ((VTOI(dvp)->i_mode & IFMT) == IFATTRDIR)
4037 		return (EINVAL);
4038 
4039 again:
4040 	ip = (struct inode *)NULL;
4041 	vap->va_type = VLNK;
4042 	vap->va_rdev = 0;
4043 
4044 	error = ufs_lockfs_begin(ufsvfsp, &ulp, ULOCKFS_SYMLINK_MASK);
4045 	if (error)
4046 		goto out;
4047 
4048 	if (ulp)
4049 		TRANS_BEGIN_CSYNC(ufsvfsp, issync, TOP_SYMLINK,
4050 		    trans_size = (int)TOP_SYMLINK_SIZE(dip));
4051 
4052 	/*
4053 	 * We must create the inode before the directory entry, to avoid
4054 	 * racing with readlink().  ufs_dirmakeinode requires that we
4055 	 * hold the quota lock as reader, and directory locks as writer.
4056 	 */
4057 
4058 	rw_enter(&dip->i_rwlock, RW_WRITER);
4059 	rw_enter(&ufsvfsp->vfs_dqrwlock, RW_READER);
4060 	rw_enter(&dip->i_contents, RW_WRITER);
4061 
4062 	/*
4063 	 * Suppress any out of inodes messages if we will retry on
4064 	 * ENOSP
4065 	 */
4066 	if (retry)
4067 		dip->i_flag |= IQUIET;
4068 
4069 	error = ufs_dirmakeinode(dip, &ip, vap, DE_SYMLINK, cr);
4070 
4071 	dip->i_flag &= ~IQUIET;
4072 
4073 	rw_exit(&dip->i_contents);
4074 	rw_exit(&ufsvfsp->vfs_dqrwlock);
4075 	rw_exit(&dip->i_rwlock);
4076 
4077 	if (error)
4078 		goto unlock;
4079 
4080 	/*
4081 	 * OK.  The inode has been created.  Write out the data of the
4082 	 * symbolic link.  Since symbolic links are metadata, and should
4083 	 * remain consistent across a system crash, we need to force the
4084 	 * data out synchronously.
4085 	 *
4086 	 * (This is a change from the semantics in earlier releases, which
4087 	 * only created symbolic links synchronously if the semi-documented
4088 	 * 'syncdir' option was set, or if we were being invoked by the NFS
4089 	 * server, which requires symbolic links to be created synchronously.)
4090 	 *
4091 	 * We need to pass in a pointer for the residual length; otherwise
4092 	 * ufs_rdwri() will always return EIO if it can't write the data,
4093 	 * even if the error was really ENOSPC or EDQUOT.
4094 	 */
4095 
4096 	ioflag = FWRITE | FDSYNC;
4097 	residual = 0;
4098 
4099 	rw_enter(&ufsvfsp->vfs_dqrwlock, RW_READER);
4100 	rw_enter(&ip->i_contents, RW_WRITER);
4101 
4102 	/*
4103 	 * Suppress file system full messages if we will retry
4104 	 */
4105 	if (retry)
4106 		ip->i_flag |= IQUIET;
4107 
4108 	error = ufs_rdwri(UIO_WRITE, ioflag, ip, target, strlen(target),
4109 	    (offset_t)0, UIO_SYSSPACE, &residual, cr);
4110 
4111 	ip->i_flag &= ~IQUIET;
4112 
4113 	if (error) {
4114 		rw_exit(&ip->i_contents);
4115 		rw_exit(&ufsvfsp->vfs_dqrwlock);
4116 		goto remove;
4117 	}
4118 
4119 	/*
4120 	 * If the link's data is small enough, we can cache it in the inode.
4121 	 * This is a "fast symbolic link".  We don't use the first direct
4122 	 * block because that's actually used to point at the symbolic link's
4123 	 * contents on disk; but we know that none of the other direct or
4124 	 * indirect blocks can be used because symbolic links are restricted
4125 	 * to be smaller than a file system block.
4126 	 */
4127 
4128 	ASSERT(MAXPATHLEN <= VBSIZE(ITOV(ip)));
4129 
4130 	if (ip->i_size > 0 && ip->i_size <= FSL_SIZE) {
4131 		if (kcopy(target, &ip->i_db[1], ip->i_size) == 0) {
4132 			ip->i_flag |= IFASTSYMLNK;
4133 		} else {
4134 			int i;
4135 			/* error, clear garbage left behind */
4136 			for (i = 1; i < NDADDR; i++)
4137 				ip->i_db[i] = 0;
4138 			for (i = 0; i < NIADDR; i++)
4139 				ip->i_ib[i] = 0;
4140 		}
4141 	}
4142 
4143 	rw_exit(&ip->i_contents);
4144 	rw_exit(&ufsvfsp->vfs_dqrwlock);
4145 
4146 	/*
4147 	 * OK.  We've successfully created the symbolic link.  All that
4148 	 * remains is to insert it into the appropriate directory.
4149 	 */
4150 
4151 	rw_enter(&dip->i_rwlock, RW_WRITER);
4152 	error = ufs_direnter_lr(dip, linkname, DE_SYMLINK, NULL, ip, cr, NULL);
4153 	rw_exit(&dip->i_rwlock);
4154 
4155 	/*
4156 	 * Fall through into remove-on-error code.  We're either done, or we
4157 	 * need to remove the inode (if we couldn't insert it).
4158 	 */
4159 
4160 remove:
4161 	if (error && (ip != NULL)) {
4162 		rw_enter(&ip->i_contents, RW_WRITER);
4163 		ip->i_nlink--;
4164 		ip->i_flag |= ICHG;
4165 		ip->i_seq++;
4166 		ufs_setreclaim(ip);
4167 		rw_exit(&ip->i_contents);
4168 	}
4169 
4170 unlock:
4171 	if (ip != NULL)
4172 		VN_RELE(ITOV(ip));
4173 
4174 	if (ulp) {
4175 		int terr = 0;
4176 
4177 		TRANS_END_CSYNC(ufsvfsp, terr, issync, TOP_SYMLINK,
4178 		    trans_size);
4179 		ufs_lockfs_end(ulp);
4180 		if (error == 0)
4181 			error = terr;
4182 	}
4183 
4184 	/*
4185 	 * We may have failed due to lack of an inode or of a block to
4186 	 * store the target in.  Try flushing the delete queue to free
4187 	 * logically-available things up and try again.
4188 	 */
4189 	if ((error == ENOSPC) && retry && TRANS_ISTRANS(ufsvfsp)) {
4190 		ufs_delete_drain_wait(ufsvfsp, 1);
4191 		retry = 0;
4192 		goto again;
4193 	}
4194 
4195 out:
4196 	return (error);
4197 }
4198 
4199 /*
4200  * Ufs specific routine used to do ufs io.
4201  */
4202 int
4203 ufs_rdwri(enum uio_rw rw, int ioflag, struct inode *ip, caddr_t base,
4204 	ssize_t len, offset_t offset, enum uio_seg seg, int *aresid,
4205 	struct cred *cr)
4206 {
4207 	struct uio auio;
4208 	struct iovec aiov;
4209 	int error;
4210 
4211 	ASSERT(RW_LOCK_HELD(&ip->i_contents));
4212 
4213 	bzero((caddr_t)&auio, sizeof (uio_t));
4214 	bzero((caddr_t)&aiov, sizeof (iovec_t));
4215 
4216 	aiov.iov_base = base;
4217 	aiov.iov_len = len;
4218 	auio.uio_iov = &aiov;
4219 	auio.uio_iovcnt = 1;
4220 	auio.uio_loffset = offset;
4221 	auio.uio_segflg = (short)seg;
4222 	auio.uio_resid = len;
4223 
4224 	if (rw == UIO_WRITE) {
4225 		auio.uio_fmode = FWRITE;
4226 		auio.uio_extflg = UIO_COPY_DEFAULT;
4227 		auio.uio_llimit = curproc->p_fsz_ctl;
4228 		error = wrip(ip, &auio, ioflag, cr);
4229 	} else {
4230 		auio.uio_fmode = FREAD;
4231 		auio.uio_extflg = UIO_COPY_CACHED;
4232 		auio.uio_llimit = MAXOFFSET_T;
4233 		error = rdip(ip, &auio, ioflag, cr);
4234 	}
4235 
4236 	if (aresid) {
4237 		*aresid = auio.uio_resid;
4238 	} else if (auio.uio_resid) {
4239 		error = EIO;
4240 	}
4241 	return (error);
4242 }
4243 
4244 /*ARGSUSED*/
4245 static int
4246 ufs_fid(struct vnode *vp, struct fid *fidp, caller_context_t *ct)
4247 {
4248 	struct ufid *ufid;
4249 	struct inode *ip = VTOI(vp);
4250 
4251 	if (ip->i_ufsvfs == NULL)
4252 		return (EIO);
4253 
4254 	if (fidp->fid_len < (sizeof (struct ufid) - sizeof (ushort_t))) {
4255 		fidp->fid_len = sizeof (struct ufid) - sizeof (ushort_t);
4256 		return (ENOSPC);
4257 	}
4258 
4259 	ufid = (struct ufid *)fidp;
4260 	bzero((char *)ufid, sizeof (struct ufid));
4261 	ufid->ufid_len = sizeof (struct ufid) - sizeof (ushort_t);
4262 	ufid->ufid_ino = ip->i_number;
4263 	ufid->ufid_gen = ip->i_gen;
4264 
4265 	return (0);
4266 }
4267 
4268 /* ARGSUSED2 */
4269 static int
4270 ufs_rwlock(struct vnode *vp, int write_lock, caller_context_t *ctp)
4271 {
4272 	struct inode	*ip = VTOI(vp);
4273 	struct ufsvfs	*ufsvfsp;
4274 	int		forcedirectio;
4275 
4276 	/*
4277 	 * Read case is easy.
4278 	 */
4279 	if (!write_lock) {
4280 		rw_enter(&ip->i_rwlock, RW_READER);
4281 		return (V_WRITELOCK_FALSE);
4282 	}
4283 
4284 	/*
4285 	 * Caller has requested a writer lock, but that inhibits any
4286 	 * concurrency in the VOPs that follow. Acquire the lock shared
4287 	 * and defer exclusive access until it is known to be needed in
4288 	 * other VOP handlers. Some cases can be determined here.
4289 	 */
4290 
4291 	/*
4292 	 * If directio is not set, there is no chance of concurrency,
4293 	 * so just acquire the lock exclusive. Beware of a forced
4294 	 * unmount before looking at the mount option.
4295 	 */
4296 	ufsvfsp = ip->i_ufsvfs;
4297 	forcedirectio = ufsvfsp ? ufsvfsp->vfs_forcedirectio : 0;
4298 	if (!(ip->i_flag & IDIRECTIO || forcedirectio) ||
4299 	    !ufs_allow_shared_writes) {
4300 		rw_enter(&ip->i_rwlock, RW_WRITER);
4301 		return (V_WRITELOCK_TRUE);
4302 	}
4303 
4304 	/*
4305 	 * Mandatory locking forces acquiring i_rwlock exclusive.
4306 	 */
4307 	if (MANDLOCK(vp, ip->i_mode)) {
4308 		rw_enter(&ip->i_rwlock, RW_WRITER);
4309 		return (V_WRITELOCK_TRUE);
4310 	}
4311 
4312 	/*
4313 	 * Acquire the lock shared in case a concurrent write follows.
4314 	 * Mandatory locking could have become enabled before the lock
4315 	 * was acquired. Re-check and upgrade if needed.
4316 	 */
4317 	rw_enter(&ip->i_rwlock, RW_READER);
4318 	if (MANDLOCK(vp, ip->i_mode)) {
4319 		rw_exit(&ip->i_rwlock);
4320 		rw_enter(&ip->i_rwlock, RW_WRITER);
4321 		return (V_WRITELOCK_TRUE);
4322 	}
4323 	return (V_WRITELOCK_FALSE);
4324 }
4325 
4326 /*ARGSUSED*/
4327 static void
4328 ufs_rwunlock(struct vnode *vp, int write_lock, caller_context_t *ctp)
4329 {
4330 	struct inode	*ip = VTOI(vp);
4331 
4332 	rw_exit(&ip->i_rwlock);
4333 }
4334 
4335 /* ARGSUSED */
4336 static int
4337 ufs_seek(struct vnode *vp, offset_t ooff, offset_t *noffp,
4338 	caller_context_t *ct)
4339 {
4340 	return ((*noffp < 0 || *noffp > MAXOFFSET_T) ? EINVAL : 0);
4341 }
4342 
4343 /* ARGSUSED */
4344 static int
4345 ufs_frlock(struct vnode *vp, int cmd, struct flock64 *bfp, int flag,
4346 	offset_t offset, struct flk_callback *flk_cbp, struct cred *cr,
4347 	caller_context_t *ct)
4348 {
4349 	struct inode *ip = VTOI(vp);
4350 
4351 	if (ip->i_ufsvfs == NULL)
4352 		return (EIO);
4353 
4354 	/*
4355 	 * If file is being mapped, disallow frlock.
4356 	 * XXX I am not holding tlock while checking i_mapcnt because the
4357 	 * current locking strategy drops all locks before calling fs_frlock.
4358 	 * So, mapcnt could change before we enter fs_frlock making is
4359 	 * meaningless to have held tlock in the first place.
4360 	 */
4361 	if (ip->i_mapcnt > 0 && MANDLOCK(vp, ip->i_mode))
4362 		return (EAGAIN);
4363 	return (fs_frlock(vp, cmd, bfp, flag, offset, flk_cbp, cr, ct));
4364 }
4365 
4366 /* ARGSUSED */
4367 static int
4368 ufs_space(struct vnode *vp, int cmd, struct flock64 *bfp, int flag,
4369 	offset_t offset, cred_t *cr, caller_context_t *ct)
4370 {
4371 	struct ufsvfs *ufsvfsp = VTOI(vp)->i_ufsvfs;
4372 	struct ulockfs *ulp;
4373 	int error;
4374 
4375 	if ((error = convoff(vp, bfp, 0, offset)) == 0) {
4376 		if (cmd == F_FREESP) {
4377 			error = ufs_lockfs_begin(ufsvfsp, &ulp,
4378 			    ULOCKFS_SPACE_MASK);
4379 			if (error)
4380 				return (error);
4381 			error = ufs_freesp(vp, bfp, flag, cr);
4382 		} else if (cmd == F_ALLOCSP) {
4383 			error = ufs_lockfs_begin(ufsvfsp, &ulp,
4384 			    ULOCKFS_FALLOCATE_MASK);
4385 			if (error)
4386 				return (error);
4387 			error = ufs_allocsp(vp, bfp, cr);
4388 		} else
4389 			return (EINVAL); /* Command not handled here */
4390 
4391 		if (ulp)
4392 			ufs_lockfs_end(ulp);
4393 
4394 	}
4395 	return (error);
4396 }
4397 
4398 /*
4399  * Used to determine if read ahead should be done. Also used to
4400  * to determine when write back occurs.
4401  */
4402 #define	CLUSTSZ(ip)		((ip)->i_ufsvfs->vfs_ioclustsz)
4403 
4404 /*
4405  * A faster version of ufs_getpage.
4406  *
4407  * We optimize by inlining the pvn_getpages iterator, eliminating
4408  * calls to bmap_read if file doesn't have UFS holes, and avoiding
4409  * the overhead of page_exists().
4410  *
4411  * When files has UFS_HOLES and ufs_getpage is called with S_READ,
4412  * we set *protp to PROT_READ to avoid calling bmap_read. This approach
4413  * victimizes performance when a file with UFS holes is faulted
4414  * first in the S_READ mode, and then in the S_WRITE mode. We will get
4415  * two MMU faults in this case.
4416  *
4417  * XXX - the inode fields which control the sequential mode are not
4418  *	 protected by any mutex. The read ahead will act wild if
4419  *	 multiple processes will access the file concurrently and
4420  *	 some of them in sequential mode. One particulary bad case
4421  *	 is if another thread will change the value of i_nextrio between
4422  *	 the time this thread tests the i_nextrio value and then reads it
4423  *	 again to use it as the offset for the read ahead.
4424  */
4425 /*ARGSUSED*/
4426 static int
4427 ufs_getpage(struct vnode *vp, offset_t off, size_t len, uint_t *protp,
4428 	page_t *plarr[], size_t plsz, struct seg *seg, caddr_t addr,
4429 	enum seg_rw rw, struct cred *cr, caller_context_t *ct)
4430 {
4431 	u_offset_t	uoff = (u_offset_t)off; /* type conversion */
4432 	u_offset_t	pgoff;
4433 	u_offset_t	eoff;
4434 	struct inode 	*ip = VTOI(vp);
4435 	struct ufsvfs	*ufsvfsp = ip->i_ufsvfs;
4436 	struct fs 	*fs;
4437 	struct ulockfs	*ulp;
4438 	page_t		**pl;
4439 	caddr_t		pgaddr;
4440 	krw_t		rwtype;
4441 	int 		err;
4442 	int		has_holes;
4443 	int		beyond_eof;
4444 	int		seqmode;
4445 	int		pgsize = PAGESIZE;
4446 	int		dolock;
4447 	int		do_qlock;
4448 	int		trans_size;
4449 
4450 	ASSERT((uoff & PAGEOFFSET) == 0);
4451 
4452 	if (protp)
4453 		*protp = PROT_ALL;
4454 
4455 	/*
4456 	 * Obey the lockfs protocol
4457 	 */
4458 	err = ufs_lockfs_begin_getpage(ufsvfsp, &ulp, seg,
4459 	    rw == S_READ || rw == S_EXEC, protp);
4460 	if (err)
4461 		goto out;
4462 
4463 	fs = ufsvfsp->vfs_fs;
4464 
4465 	if (ulp && (rw == S_CREATE || rw == S_WRITE) &&
4466 	    !(vp->v_flag & VISSWAP)) {
4467 		/*
4468 		 * Try to start a transaction, will return if blocking is
4469 		 * expected to occur and the address space is not the
4470 		 * kernel address space.
4471 		 */
4472 		trans_size = TOP_GETPAGE_SIZE(ip);
4473 		if (seg->s_as != &kas) {
4474 			TRANS_TRY_BEGIN_ASYNC(ufsvfsp, TOP_GETPAGE,
4475 			    trans_size, err)
4476 			if (err == EWOULDBLOCK) {
4477 				/*
4478 				 * Use EDEADLK here because the VM code
4479 				 * can normally never see this error.
4480 				 */
4481 				err = EDEADLK;
4482 				ufs_lockfs_end(ulp);
4483 				goto out;
4484 			}
4485 		} else {
4486 			TRANS_BEGIN_ASYNC(ufsvfsp, TOP_GETPAGE, trans_size);
4487 		}
4488 	}
4489 
4490 	if (vp->v_flag & VNOMAP) {
4491 		err = ENOSYS;
4492 		goto unlock;
4493 	}
4494 
4495 	seqmode = ip->i_nextr == uoff && rw != S_CREATE;
4496 
4497 	rwtype = RW_READER;		/* start as a reader */
4498 	dolock = (rw_owner(&ip->i_contents) != curthread);
4499 	/*
4500 	 * If this thread owns the lock, i.e., this thread grabbed it
4501 	 * as writer somewhere above, then we don't need to grab the
4502 	 * lock as reader in this routine.
4503 	 */
4504 	do_qlock = (rw_owner(&ufsvfsp->vfs_dqrwlock) != curthread);
4505 
4506 retrylock:
4507 	if (dolock) {
4508 		/*
4509 		 * Grab the quota lock if we need to call
4510 		 * bmap_write() below (with i_contents as writer).
4511 		 */
4512 		if (do_qlock && rwtype == RW_WRITER)
4513 			rw_enter(&ufsvfsp->vfs_dqrwlock, RW_READER);
4514 		rw_enter(&ip->i_contents, rwtype);
4515 	}
4516 
4517 	/*
4518 	 * We may be getting called as a side effect of a bmap using
4519 	 * fbread() when the blocks might be being allocated and the
4520 	 * size has not yet been up'ed.  In this case we want to be
4521 	 * able to return zero pages if we get back UFS_HOLE from
4522 	 * calling bmap for a non write case here.  We also might have
4523 	 * to read some frags from the disk into a page if we are
4524 	 * extending the number of frags for a given lbn in bmap().
4525 	 * Large Files: The read of i_size here is atomic because
4526 	 * i_contents is held here. If dolock is zero, the lock
4527 	 * is held in bmap routines.
4528 	 */
4529 	beyond_eof = uoff + len > ip->i_size + PAGEOFFSET;
4530 	if (beyond_eof && seg != segkmap) {
4531 		if (dolock) {
4532 			rw_exit(&ip->i_contents);
4533 			if (do_qlock && rwtype == RW_WRITER)
4534 				rw_exit(&ufsvfsp->vfs_dqrwlock);
4535 		}
4536 		err = EFAULT;
4537 		goto unlock;
4538 	}
4539 
4540 	/*
4541 	 * Must hold i_contents lock throughout the call to pvn_getpages
4542 	 * since locked pages are returned from each call to ufs_getapage.
4543 	 * Must *not* return locked pages and then try for contents lock
4544 	 * due to lock ordering requirements (inode > page)
4545 	 */
4546 
4547 	has_holes = bmap_has_holes(ip);
4548 
4549 	if ((rw == S_WRITE || rw == S_CREATE) && has_holes && !beyond_eof) {
4550 		int	blk_size;
4551 		u_offset_t offset;
4552 
4553 		/*
4554 		 * We must acquire the RW_WRITER lock in order to
4555 		 * call bmap_write().
4556 		 */
4557 		if (dolock && rwtype == RW_READER) {
4558 			rwtype = RW_WRITER;
4559 
4560 			/*
4561 			 * Grab the quota lock before
4562 			 * upgrading i_contents, but if we can't grab it
4563 			 * don't wait here due to lock order:
4564 			 * vfs_dqrwlock > i_contents.
4565 			 */
4566 			if (do_qlock &&
4567 			    rw_tryenter(&ufsvfsp->vfs_dqrwlock, RW_READER)
4568 			    == 0) {
4569 				rw_exit(&ip->i_contents);
4570 				goto retrylock;
4571 			}
4572 			if (!rw_tryupgrade(&ip->i_contents)) {
4573 				rw_exit(&ip->i_contents);
4574 				if (do_qlock)
4575 					rw_exit(&ufsvfsp->vfs_dqrwlock);
4576 				goto retrylock;
4577 			}
4578 		}
4579 
4580 		/*
4581 		 * May be allocating disk blocks for holes here as
4582 		 * a result of mmap faults. write(2) does the bmap_write
4583 		 * in rdip/wrip, not here. We are not dealing with frags
4584 		 * in this case.
4585 		 */
4586 		/*
4587 		 * Large Files: We cast fs_bmask field to offset_t
4588 		 * just as we do for MAXBMASK because uoff is a 64-bit
4589 		 * data type. fs_bmask will still be a 32-bit type
4590 		 * as we cannot change any ondisk data structures.
4591 		 */
4592 
4593 		offset = uoff & (offset_t)fs->fs_bmask;
4594 		while (offset < uoff + len) {
4595 			blk_size = (int)blksize(fs, ip, lblkno(fs, offset));
4596 			err = bmap_write(ip, offset, blk_size,
4597 			    BI_NORMAL, NULL, cr);
4598 			if (ip->i_flag & (ICHG|IUPD))
4599 				ip->i_seq++;
4600 			if (err)
4601 				goto update_inode;
4602 			offset += blk_size; /* XXX - make this contig */
4603 		}
4604 	}
4605 
4606 	/*
4607 	 * Can be a reader from now on.
4608 	 */
4609 	if (dolock && rwtype == RW_WRITER) {
4610 		rw_downgrade(&ip->i_contents);
4611 		/*
4612 		 * We can release vfs_dqrwlock early so do it, but make
4613 		 * sure we don't try to release it again at the bottom.
4614 		 */
4615 		if (do_qlock) {
4616 			rw_exit(&ufsvfsp->vfs_dqrwlock);
4617 			do_qlock = 0;
4618 		}
4619 	}
4620 
4621 	/*
4622 	 * We remove PROT_WRITE in cases when the file has UFS holes
4623 	 * because we don't  want to call bmap_read() to check each
4624 	 * page if it is backed with a disk block.
4625 	 */
4626 	if (protp && has_holes && rw != S_WRITE && rw != S_CREATE)
4627 		*protp &= ~PROT_WRITE;
4628 
4629 	err = 0;
4630 
4631 	/*
4632 	 * The loop looks up pages in the range [off, off + len).
4633 	 * For each page, we first check if we should initiate an asynchronous
4634 	 * read ahead before we call page_lookup (we may sleep in page_lookup
4635 	 * for a previously initiated disk read).
4636 	 */
4637 	eoff = (uoff + len);
4638 	for (pgoff = uoff, pgaddr = addr, pl = plarr;
4639 	    pgoff < eoff; /* empty */) {
4640 		page_t	*pp;
4641 		u_offset_t	nextrio;
4642 		se_t	se;
4643 		int retval;
4644 
4645 		se = ((rw == S_CREATE || rw == S_OTHER) ? SE_EXCL : SE_SHARED);
4646 
4647 		/* Handle async getpage (faultahead) */
4648 		if (plarr == NULL) {
4649 			ip->i_nextrio = pgoff;
4650 			(void) ufs_getpage_ra(vp, pgoff, seg, pgaddr);
4651 			pgoff += pgsize;
4652 			pgaddr += pgsize;
4653 			continue;
4654 		}
4655 		/*
4656 		 * Check if we should initiate read ahead of next cluster.
4657 		 * We call page_exists only when we need to confirm that
4658 		 * we have the current page before we initiate the read ahead.
4659 		 */
4660 		nextrio = ip->i_nextrio;
4661 		if (seqmode &&
4662 		    pgoff + CLUSTSZ(ip) >= nextrio && pgoff <= nextrio &&
4663 		    nextrio < ip->i_size && page_exists(vp, pgoff)) {
4664 			retval = ufs_getpage_ra(vp, pgoff, seg, pgaddr);
4665 			/*
4666 			 * We always read ahead the next cluster of data
4667 			 * starting from i_nextrio. If the page (vp,nextrio)
4668 			 * is actually in core at this point, the routine
4669 			 * ufs_getpage_ra() will stop pre-fetching data
4670 			 * until we read that page in a synchronized manner
4671 			 * through ufs_getpage_miss(). So, we should increase
4672 			 * i_nextrio if the page (vp, nextrio) exists.
4673 			 */
4674 			if ((retval == 0) && page_exists(vp, nextrio)) {
4675 				ip->i_nextrio = nextrio + pgsize;
4676 			}
4677 		}
4678 
4679 		if ((pp = page_lookup(vp, pgoff, se)) != NULL) {
4680 			/*
4681 			 * We found the page in the page cache.
4682 			 */
4683 			*pl++ = pp;
4684 			pgoff += pgsize;
4685 			pgaddr += pgsize;
4686 			len -= pgsize;
4687 			plsz -= pgsize;
4688 		} else  {
4689 			/*
4690 			 * We have to create the page, or read it from disk.
4691 			 */
4692 			if (err = ufs_getpage_miss(vp, pgoff, len, seg, pgaddr,
4693 			    pl, plsz, rw, seqmode))
4694 				goto error;
4695 
4696 			while (*pl != NULL) {
4697 				pl++;
4698 				pgoff += pgsize;
4699 				pgaddr += pgsize;
4700 				len -= pgsize;
4701 				plsz -= pgsize;
4702 			}
4703 		}
4704 	}
4705 
4706 	/*
4707 	 * Return pages up to plsz if they are in the page cache.
4708 	 * We cannot return pages if there is a chance that they are
4709 	 * backed with a UFS hole and rw is S_WRITE or S_CREATE.
4710 	 */
4711 	if (plarr && !(has_holes && (rw == S_WRITE || rw == S_CREATE))) {
4712 
4713 		ASSERT((protp == NULL) ||
4714 		    !(has_holes && (*protp & PROT_WRITE)));
4715 
4716 		eoff = pgoff + plsz;
4717 		while (pgoff < eoff) {
4718 			page_t		*pp;
4719 
4720 			if ((pp = page_lookup_nowait(vp, pgoff,
4721 			    SE_SHARED)) == NULL)
4722 				break;
4723 
4724 			*pl++ = pp;
4725 			pgoff += pgsize;
4726 			plsz -= pgsize;
4727 		}
4728 	}
4729 
4730 	if (plarr)
4731 		*pl = NULL;			/* Terminate page list */
4732 	ip->i_nextr = pgoff;
4733 
4734 error:
4735 	if (err && plarr) {
4736 		/*
4737 		 * Release any pages we have locked.
4738 		 */
4739 		while (pl > &plarr[0])
4740 			page_unlock(*--pl);
4741 
4742 		plarr[0] = NULL;
4743 	}
4744 
4745 update_inode:
4746 	/*
4747 	 * If the inode is not already marked for IACC (in rdip() for read)
4748 	 * and the inode is not marked for no access time update (in wrip()
4749 	 * for write) then update the inode access time and mod time now.
4750 	 */
4751 	if ((ip->i_flag & (IACC | INOACC)) == 0) {
4752 		if ((rw != S_OTHER) && (ip->i_mode & IFMT) != IFDIR) {
4753 			if (!ULOCKFS_IS_NOIACC(ITOUL(ip)) &&
4754 			    (fs->fs_ronly == 0) &&
4755 			    (!ufsvfsp->vfs_noatime)) {
4756 				mutex_enter(&ip->i_tlock);
4757 				ip->i_flag |= IACC;
4758 				ITIMES_NOLOCK(ip);
4759 				mutex_exit(&ip->i_tlock);
4760 			}
4761 		}
4762 	}
4763 
4764 	if (dolock) {
4765 		rw_exit(&ip->i_contents);
4766 		if (do_qlock && rwtype == RW_WRITER)
4767 			rw_exit(&ufsvfsp->vfs_dqrwlock);
4768 	}
4769 
4770 unlock:
4771 	if (ulp) {
4772 		if ((rw == S_CREATE || rw == S_WRITE) &&
4773 		    !(vp->v_flag & VISSWAP)) {
4774 			TRANS_END_ASYNC(ufsvfsp, TOP_GETPAGE, trans_size);
4775 		}
4776 		ufs_lockfs_end(ulp);
4777 	}
4778 out:
4779 	return (err);
4780 }
4781 
4782 /*
4783  * ufs_getpage_miss is called when ufs_getpage missed the page in the page
4784  * cache. The page is either read from the disk, or it's created.
4785  * A page is created (without disk read) if rw == S_CREATE, or if
4786  * the page is not backed with a real disk block (UFS hole).
4787  */
4788 /* ARGSUSED */
4789 static int
4790 ufs_getpage_miss(struct vnode *vp, u_offset_t off, size_t len, struct seg *seg,
4791 	caddr_t addr, page_t *pl[], size_t plsz, enum seg_rw rw, int seq)
4792 {
4793 	struct inode	*ip = VTOI(vp);
4794 	page_t		*pp;
4795 	daddr_t		bn;
4796 	size_t		io_len;
4797 	int		crpage = 0;
4798 	int		err;
4799 	int		contig;
4800 	int		bsize = ip->i_fs->fs_bsize;
4801 
4802 	/*
4803 	 * Figure out whether the page can be created, or must be
4804 	 * must be read from the disk.
4805 	 */
4806 	if (rw == S_CREATE)
4807 		crpage = 1;
4808 	else {
4809 		contig = 0;
4810 		if (err = bmap_read(ip, off, &bn, &contig))
4811 			return (err);
4812 
4813 		crpage = (bn == UFS_HOLE);
4814 
4815 		/*
4816 		 * If its also a fallocated block that hasn't been written to
4817 		 * yet, we will treat it just like a UFS_HOLE and create
4818 		 * a zero page for it
4819 		 */
4820 		if (ISFALLOCBLK(ip, bn))
4821 			crpage = 1;
4822 	}
4823 
4824 	if (crpage) {
4825 		if ((pp = page_create_va(vp, off, PAGESIZE, PG_WAIT, seg,
4826 		    addr)) == NULL) {
4827 			return (ufs_fault(vp,
4828 			    "ufs_getpage_miss: page_create == NULL"));
4829 		}
4830 
4831 		if (rw != S_CREATE)
4832 			pagezero(pp, 0, PAGESIZE);
4833 
4834 		io_len = PAGESIZE;
4835 	} else {
4836 		u_offset_t	io_off;
4837 		uint_t	xlen;
4838 		struct buf	*bp;
4839 		ufsvfs_t	*ufsvfsp = ip->i_ufsvfs;
4840 
4841 		/*
4842 		 * If access is not in sequential order, we read from disk
4843 		 * in bsize units.
4844 		 *
4845 		 * We limit the size of the transfer to bsize if we are reading
4846 		 * from the beginning of the file. Note in this situation we
4847 		 * will hedge our bets and initiate an async read ahead of
4848 		 * the second block.
4849 		 */
4850 		if (!seq || off == 0)
4851 			contig = MIN(contig, bsize);
4852 
4853 		pp = pvn_read_kluster(vp, off, seg, addr, &io_off,
4854 		    &io_len, off, contig, 0);
4855 
4856 		/*
4857 		 * Some other thread has entered the page.
4858 		 * ufs_getpage will retry page_lookup.
4859 		 */
4860 		if (pp == NULL) {
4861 			pl[0] = NULL;
4862 			return (0);
4863 		}
4864 
4865 		/*
4866 		 * Zero part of the page which we are not
4867 		 * going to read from the disk.
4868 		 */
4869 		xlen = io_len & PAGEOFFSET;
4870 		if (xlen != 0)
4871 			pagezero(pp->p_prev, xlen, PAGESIZE - xlen);
4872 
4873 		bp = pageio_setup(pp, io_len, ip->i_devvp, B_READ);
4874 		bp->b_edev = ip->i_dev;
4875 		bp->b_dev = cmpdev(ip->i_dev);
4876 		bp->b_blkno = bn;
4877 		bp->b_un.b_addr = (caddr_t)0;
4878 		bp->b_file = ip->i_vnode;
4879 		bp->b_offset = off;
4880 
4881 		if (ufsvfsp->vfs_log) {
4882 			lufs_read_strategy(ufsvfsp->vfs_log, bp);
4883 		} else if (ufsvfsp->vfs_snapshot) {
4884 			fssnap_strategy(&ufsvfsp->vfs_snapshot, bp);
4885 		} else {
4886 			ufsvfsp->vfs_iotstamp = lbolt;
4887 			ub.ub_getpages.value.ul++;
4888 			(void) bdev_strategy(bp);
4889 			lwp_stat_update(LWP_STAT_INBLK, 1);
4890 		}
4891 
4892 		ip->i_nextrio = off + ((io_len + PAGESIZE - 1) & PAGEMASK);
4893 
4894 		/*
4895 		 * If the file access is sequential, initiate read ahead
4896 		 * of the next cluster.
4897 		 */
4898 		if (seq && ip->i_nextrio < ip->i_size)
4899 			(void) ufs_getpage_ra(vp, off, seg, addr);
4900 		err = biowait(bp);
4901 		pageio_done(bp);
4902 
4903 		if (err) {
4904 			pvn_read_done(pp, B_ERROR);
4905 			return (err);
4906 		}
4907 	}
4908 
4909 	pvn_plist_init(pp, pl, plsz, off, io_len, rw);
4910 	return (0);
4911 }
4912 
4913 /*
4914  * Read ahead a cluster from the disk. Returns the length in bytes.
4915  */
4916 static int
4917 ufs_getpage_ra(struct vnode *vp, u_offset_t off, struct seg *seg, caddr_t addr)
4918 {
4919 	struct inode	*ip = VTOI(vp);
4920 	page_t		*pp;
4921 	u_offset_t	io_off = ip->i_nextrio;
4922 	ufsvfs_t	*ufsvfsp;
4923 	caddr_t		addr2 = addr + (io_off - off);
4924 	struct buf	*bp;
4925 	daddr_t		bn;
4926 	size_t		io_len;
4927 	int		err;
4928 	int		contig;
4929 	int		xlen;
4930 	int		bsize = ip->i_fs->fs_bsize;
4931 
4932 	/*
4933 	 * If the directio advisory is in effect on this file,
4934 	 * then do not do buffered read ahead. Read ahead makes
4935 	 * it more difficult on threads using directio as they
4936 	 * will be forced to flush the pages from this vnode.
4937 	 */
4938 	if ((ufsvfsp = ip->i_ufsvfs) == NULL)
4939 		return (0);
4940 	if (ip->i_flag & IDIRECTIO || ufsvfsp->vfs_forcedirectio)
4941 		return (0);
4942 
4943 	/*
4944 	 * Is this test needed?
4945 	 */
4946 	if (addr2 >= seg->s_base + seg->s_size)
4947 		return (0);
4948 
4949 	contig = 0;
4950 	err = bmap_read(ip, io_off, &bn, &contig);
4951 	/*
4952 	 * If its a UFS_HOLE or a fallocated block, do not perform
4953 	 * any read ahead's since there probably is nothing to read ahead
4954 	 */
4955 	if (err || bn == UFS_HOLE || ISFALLOCBLK(ip, bn))
4956 		return (0);
4957 
4958 	/*
4959 	 * Limit the transfer size to bsize if this is the 2nd block.
4960 	 */
4961 	if (io_off == (u_offset_t)bsize)
4962 		contig = MIN(contig, bsize);
4963 
4964 	if ((pp = pvn_read_kluster(vp, io_off, seg, addr2, &io_off,
4965 	    &io_len, io_off, contig, 1)) == NULL)
4966 		return (0);
4967 
4968 	/*
4969 	 * Zero part of page which we are not going to read from disk
4970 	 */
4971 	if ((xlen = (io_len & PAGEOFFSET)) > 0)
4972 		pagezero(pp->p_prev, xlen, PAGESIZE - xlen);
4973 
4974 	ip->i_nextrio = (io_off + io_len + PAGESIZE - 1) & PAGEMASK;
4975 
4976 	bp = pageio_setup(pp, io_len, ip->i_devvp, B_READ | B_ASYNC);
4977 	bp->b_edev = ip->i_dev;
4978 	bp->b_dev = cmpdev(ip->i_dev);
4979 	bp->b_blkno = bn;
4980 	bp->b_un.b_addr = (caddr_t)0;
4981 	bp->b_file = ip->i_vnode;
4982 	bp->b_offset = off;
4983 
4984 	if (ufsvfsp->vfs_log) {
4985 		lufs_read_strategy(ufsvfsp->vfs_log, bp);
4986 	} else if (ufsvfsp->vfs_snapshot) {
4987 		fssnap_strategy(&ufsvfsp->vfs_snapshot, bp);
4988 	} else {
4989 		ufsvfsp->vfs_iotstamp = lbolt;
4990 		ub.ub_getras.value.ul++;
4991 		(void) bdev_strategy(bp);
4992 		lwp_stat_update(LWP_STAT_INBLK, 1);
4993 	}
4994 
4995 	return (io_len);
4996 }
4997 
4998 int	ufs_delay = 1;
4999 /*
5000  * Flags are composed of {B_INVAL, B_FREE, B_DONTNEED, B_FORCE, B_ASYNC}
5001  *
5002  * LMXXX - the inode really ought to contain a pointer to one of these
5003  * async args.  Stuff gunk in there and just hand the whole mess off.
5004  * This would replace i_delaylen, i_delayoff.
5005  */
5006 /*ARGSUSED*/
5007 static int
5008 ufs_putpage(struct vnode *vp, offset_t off, size_t len, int flags,
5009 	struct cred *cr, caller_context_t *ct)
5010 {
5011 	struct inode *ip = VTOI(vp);
5012 	int err = 0;
5013 
5014 	if (vp->v_count == 0) {
5015 		return (ufs_fault(vp, "ufs_putpage: bad v_count == 0"));
5016 	}
5017 
5018 	/*
5019 	 * XXX - Why should this check be made here?
5020 	 */
5021 	if (vp->v_flag & VNOMAP) {
5022 		err = ENOSYS;
5023 		goto errout;
5024 	}
5025 
5026 	if (ip->i_ufsvfs == NULL) {
5027 		err = EIO;
5028 		goto errout;
5029 	}
5030 
5031 	if (flags & B_ASYNC) {
5032 		if (ufs_delay && len &&
5033 		    (flags & ~(B_ASYNC|B_DONTNEED|B_FREE)) == 0) {
5034 			mutex_enter(&ip->i_tlock);
5035 			/*
5036 			 * If nobody stalled, start a new cluster.
5037 			 */
5038 			if (ip->i_delaylen == 0) {
5039 				ip->i_delayoff = off;
5040 				ip->i_delaylen = len;
5041 				mutex_exit(&ip->i_tlock);
5042 				goto errout;
5043 			}
5044 			/*
5045 			 * If we have a full cluster or they are not contig,
5046 			 * then push last cluster and start over.
5047 			 */
5048 			if (ip->i_delaylen >= CLUSTSZ(ip) ||
5049 			    ip->i_delayoff + ip->i_delaylen != off) {
5050 				u_offset_t doff;
5051 				size_t dlen;
5052 
5053 				doff = ip->i_delayoff;
5054 				dlen = ip->i_delaylen;
5055 				ip->i_delayoff = off;
5056 				ip->i_delaylen = len;
5057 				mutex_exit(&ip->i_tlock);
5058 				err = ufs_putpages(vp, doff, dlen,
5059 				    flags, cr);
5060 				/* LMXXX - flags are new val, not old */
5061 				goto errout;
5062 			}
5063 			/*
5064 			 * There is something there, it's not full, and
5065 			 * it is contig.
5066 			 */
5067 			ip->i_delaylen += len;
5068 			mutex_exit(&ip->i_tlock);
5069 			goto errout;
5070 		}
5071 		/*
5072 		 * Must have weird flags or we are not clustering.
5073 		 */
5074 	}
5075 
5076 	err = ufs_putpages(vp, off, len, flags, cr);
5077 
5078 errout:
5079 	return (err);
5080 }
5081 
5082 /*
5083  * If len == 0, do from off to EOF.
5084  *
5085  * The normal cases should be len == 0 & off == 0 (entire vp list),
5086  * len == MAXBSIZE (from segmap_release actions), and len == PAGESIZE
5087  * (from pageout).
5088  */
5089 /*ARGSUSED*/
5090 static int
5091 ufs_putpages(
5092 	struct vnode *vp,
5093 	offset_t off,
5094 	size_t len,
5095 	int flags,
5096 	struct cred *cr)
5097 {
5098 	u_offset_t io_off;
5099 	u_offset_t eoff;
5100 	struct inode *ip = VTOI(vp);
5101 	page_t *pp;
5102 	size_t io_len;
5103 	int err = 0;
5104 	int dolock;
5105 
5106 	if (vp->v_count == 0)
5107 		return (ufs_fault(vp, "ufs_putpages: v_count == 0"));
5108 	/*
5109 	 * Acquire the readers/write inode lock before locking
5110 	 * any pages in this inode.
5111 	 * The inode lock is held during i/o.
5112 	 */
5113 	if (len == 0) {
5114 		mutex_enter(&ip->i_tlock);
5115 		ip->i_delayoff = ip->i_delaylen = 0;
5116 		mutex_exit(&ip->i_tlock);
5117 	}
5118 	dolock = (rw_owner(&ip->i_contents) != curthread);
5119 	if (dolock) {
5120 		/*
5121 		 * Must synchronize this thread and any possible thread
5122 		 * operating in the window of vulnerability in wrip().
5123 		 * It is dangerous to allow both a thread doing a putpage
5124 		 * and a thread writing, so serialize them.  The exception
5125 		 * is when the thread in wrip() does something which causes
5126 		 * a putpage operation.  Then, the thread must be allowed
5127 		 * to continue.  It may encounter a bmap_read problem in
5128 		 * ufs_putapage, but that is handled in ufs_putapage.
5129 		 * Allow async writers to proceed, we don't want to block
5130 		 * the pageout daemon.
5131 		 */
5132 		if (ip->i_writer == curthread)
5133 			rw_enter(&ip->i_contents, RW_READER);
5134 		else {
5135 			for (;;) {
5136 				rw_enter(&ip->i_contents, RW_READER);
5137 				mutex_enter(&ip->i_tlock);
5138 				/*
5139 				 * If there is no thread in the critical
5140 				 * section of wrip(), then proceed.
5141 				 * Otherwise, wait until there isn't one.
5142 				 */
5143 				if (ip->i_writer == NULL) {
5144 					mutex_exit(&ip->i_tlock);
5145 					break;
5146 				}
5147 				rw_exit(&ip->i_contents);
5148 				/*
5149 				 * Bounce async writers when we have a writer
5150 				 * working on this file so we don't deadlock
5151 				 * the pageout daemon.
5152 				 */
5153 				if (flags & B_ASYNC) {
5154 					mutex_exit(&ip->i_tlock);
5155 					return (0);
5156 				}
5157 				cv_wait(&ip->i_wrcv, &ip->i_tlock);
5158 				mutex_exit(&ip->i_tlock);
5159 			}
5160 		}
5161 	}
5162 
5163 	if (!vn_has_cached_data(vp)) {
5164 		if (dolock)
5165 			rw_exit(&ip->i_contents);
5166 		return (0);
5167 	}
5168 
5169 	if (len == 0) {
5170 		/*
5171 		 * Search the entire vp list for pages >= off.
5172 		 */
5173 		err = pvn_vplist_dirty(vp, (u_offset_t)off, ufs_putapage,
5174 		    flags, cr);
5175 	} else {
5176 		/*
5177 		 * Loop over all offsets in the range looking for
5178 		 * pages to deal with.
5179 		 */
5180 		if ((eoff = blkroundup(ip->i_fs, ip->i_size)) != 0)
5181 			eoff = MIN(off + len, eoff);
5182 		else
5183 			eoff = off + len;
5184 
5185 		for (io_off = off; io_off < eoff; io_off += io_len) {
5186 			/*
5187 			 * If we are not invalidating, synchronously
5188 			 * freeing or writing pages, use the routine
5189 			 * page_lookup_nowait() to prevent reclaiming
5190 			 * them from the free list.
5191 			 */
5192 			if ((flags & B_INVAL) || ((flags & B_ASYNC) == 0)) {
5193 				pp = page_lookup(vp, io_off,
5194 				    (flags & (B_INVAL | B_FREE)) ?
5195 				    SE_EXCL : SE_SHARED);
5196 			} else {
5197 				pp = page_lookup_nowait(vp, io_off,
5198 				    (flags & B_FREE) ? SE_EXCL : SE_SHARED);
5199 			}
5200 
5201 			if (pp == NULL || pvn_getdirty(pp, flags) == 0)
5202 				io_len = PAGESIZE;
5203 			else {
5204 				u_offset_t *io_offp = &io_off;
5205 
5206 				err = ufs_putapage(vp, pp, io_offp, &io_len,
5207 				    flags, cr);
5208 				if (err != 0)
5209 					break;
5210 				/*
5211 				 * "io_off" and "io_len" are returned as
5212 				 * the range of pages we actually wrote.
5213 				 * This allows us to skip ahead more quickly
5214 				 * since several pages may've been dealt
5215 				 * with by this iteration of the loop.
5216 				 */
5217 			}
5218 		}
5219 	}
5220 	if (err == 0 && off == 0 && (len == 0 || len >= ip->i_size)) {
5221 		/*
5222 		 * We have just sync'ed back all the pages on
5223 		 * the inode, turn off the IMODTIME flag.
5224 		 */
5225 		mutex_enter(&ip->i_tlock);
5226 		ip->i_flag &= ~IMODTIME;
5227 		mutex_exit(&ip->i_tlock);
5228 	}
5229 	if (dolock)
5230 		rw_exit(&ip->i_contents);
5231 	return (err);
5232 }
5233 
5234 static void
5235 ufs_iodone(buf_t *bp)
5236 {
5237 	struct inode *ip;
5238 
5239 	ASSERT((bp->b_pages->p_vnode != NULL) && !(bp->b_flags & B_READ));
5240 
5241 	bp->b_iodone = NULL;
5242 
5243 	ip = VTOI(bp->b_pages->p_vnode);
5244 
5245 	mutex_enter(&ip->i_tlock);
5246 	if (ip->i_writes >= ufs_LW) {
5247 		if ((ip->i_writes -= bp->b_bcount) <= ufs_LW)
5248 			if (ufs_WRITES)
5249 				cv_broadcast(&ip->i_wrcv); /* wake all up */
5250 	} else {
5251 		ip->i_writes -= bp->b_bcount;
5252 	}
5253 
5254 	mutex_exit(&ip->i_tlock);
5255 	iodone(bp);
5256 }
5257 
5258 /*
5259  * Write out a single page, possibly klustering adjacent
5260  * dirty pages.  The inode lock must be held.
5261  *
5262  * LMXXX - bsize < pagesize not done.
5263  */
5264 /*ARGSUSED*/
5265 int
5266 ufs_putapage(
5267 	struct vnode *vp,
5268 	page_t *pp,
5269 	u_offset_t *offp,
5270 	size_t *lenp,		/* return values */
5271 	int flags,
5272 	struct cred *cr)
5273 {
5274 	u_offset_t io_off;
5275 	u_offset_t off;
5276 	struct inode *ip = VTOI(vp);
5277 	struct ufsvfs *ufsvfsp = ip->i_ufsvfs;
5278 	struct fs *fs;
5279 	struct buf *bp;
5280 	size_t io_len;
5281 	daddr_t bn;
5282 	int err;
5283 	int contig;
5284 
5285 	ASSERT(RW_LOCK_HELD(&ip->i_contents));
5286 
5287 	if (ufsvfsp == NULL) {
5288 		err = EIO;
5289 		goto out_trace;
5290 	}
5291 
5292 	fs = ip->i_fs;
5293 	ASSERT(fs->fs_ronly == 0);
5294 
5295 	/*
5296 	 * If the modified time on the inode has not already been
5297 	 * set elsewhere (e.g. for write/setattr) we set the time now.
5298 	 * This gives us approximate modified times for mmap'ed files
5299 	 * which are modified via stores in the user address space.
5300 	 */
5301 	if ((ip->i_flag & IMODTIME) == 0) {
5302 		mutex_enter(&ip->i_tlock);
5303 		ip->i_flag |= IUPD;
5304 		ip->i_seq++;
5305 		ITIMES_NOLOCK(ip);
5306 		mutex_exit(&ip->i_tlock);
5307 	}
5308 
5309 	/*
5310 	 * Align the request to a block boundry (for old file systems),
5311 	 * and go ask bmap() how contiguous things are for this file.
5312 	 */
5313 	off = pp->p_offset & (offset_t)fs->fs_bmask;	/* block align it */
5314 	contig = 0;
5315 	err = bmap_read(ip, off, &bn, &contig);
5316 	if (err)
5317 		goto out;
5318 	if (bn == UFS_HOLE) {			/* putpage never allocates */
5319 		/*
5320 		 * logging device is in error mode; simply return EIO
5321 		 */
5322 		if (TRANS_ISERROR(ufsvfsp)) {
5323 			err = EIO;
5324 			goto out;
5325 		}
5326 		/*
5327 		 * Oops, the thread in the window in wrip() did some
5328 		 * sort of operation which caused a putpage in the bad
5329 		 * range.  In this case, just return an error which will
5330 		 * cause the software modified bit on the page to set
5331 		 * and the page will get written out again later.
5332 		 */
5333 		if (ip->i_writer == curthread) {
5334 			err = EIO;
5335 			goto out;
5336 		}
5337 		/*
5338 		 * If the pager is trying to push a page in the bad range
5339 		 * just tell him to try again later when things are better.
5340 		 */
5341 		if (flags & B_ASYNC) {
5342 			err = EAGAIN;
5343 			goto out;
5344 		}
5345 		err = ufs_fault(ITOV(ip), "ufs_putapage: bn == UFS_HOLE");
5346 		goto out;
5347 	}
5348 
5349 	/*
5350 	 * If it is an fallocate'd block, reverse the negativity since
5351 	 * we are now writing to it
5352 	 */
5353 	if (ISFALLOCBLK(ip, bn)) {
5354 		err = bmap_set_bn(vp, off, dbtofsb(fs, -bn));
5355 		if (err)
5356 			goto out;
5357 
5358 		bn = -bn;
5359 	}
5360 
5361 	/*
5362 	 * Take the length (of contiguous bytes) passed back from bmap()
5363 	 * and _try_ and get a set of pages covering that extent.
5364 	 */
5365 	pp = pvn_write_kluster(vp, pp, &io_off, &io_len, off, contig, flags);
5366 
5367 	/*
5368 	 * May have run out of memory and not clustered backwards.
5369 	 * off		p_offset
5370 	 * [  pp - 1  ][   pp   ]
5371 	 * [	block		]
5372 	 * We told bmap off, so we have to adjust the bn accordingly.
5373 	 */
5374 	if (io_off > off) {
5375 		bn += btod(io_off - off);
5376 		contig -= (io_off - off);
5377 	}
5378 
5379 	/*
5380 	 * bmap was carefull to tell us the right size so use that.
5381 	 * There might be unallocated frags at the end.
5382 	 * LMXXX - bzero the end of the page?  We must be writing after EOF.
5383 	 */
5384 	if (io_len > contig) {
5385 		ASSERT(io_len - contig < fs->fs_bsize);
5386 		io_len -= (io_len - contig);
5387 	}
5388 
5389 	/*
5390 	 * Handle the case where we are writing the last page after EOF.
5391 	 *
5392 	 * XXX - just a patch for i-mt3.
5393 	 */
5394 	if (io_len == 0) {
5395 		ASSERT(pp->p_offset >=
5396 		    (u_offset_t)(roundup(ip->i_size, PAGESIZE)));
5397 		io_len = PAGESIZE;
5398 	}
5399 
5400 	bp = pageio_setup(pp, io_len, ip->i_devvp, B_WRITE | flags);
5401 
5402 	ULOCKFS_SET_MOD(ITOUL(ip));
5403 
5404 	bp->b_edev = ip->i_dev;
5405 	bp->b_dev = cmpdev(ip->i_dev);
5406 	bp->b_blkno = bn;
5407 	bp->b_un.b_addr = (caddr_t)0;
5408 	bp->b_file = ip->i_vnode;
5409 
5410 	if (TRANS_ISTRANS(ufsvfsp)) {
5411 		if ((ip->i_mode & IFMT) == IFSHAD) {
5412 			TRANS_BUF(ufsvfsp, 0, io_len, bp, DT_SHAD);
5413 		} else if (ufsvfsp->vfs_qinod == ip) {
5414 			TRANS_DELTA(ufsvfsp, ldbtob(bn), bp->b_bcount, DT_QR,
5415 			    0, 0);
5416 		}
5417 	}
5418 
5419 	/* write throttle */
5420 
5421 	ASSERT(bp->b_iodone == NULL);
5422 	bp->b_iodone = (int (*)())ufs_iodone;
5423 	mutex_enter(&ip->i_tlock);
5424 	ip->i_writes += bp->b_bcount;
5425 	mutex_exit(&ip->i_tlock);
5426 
5427 	if (bp->b_flags & B_ASYNC) {
5428 		if (ufsvfsp->vfs_log) {
5429 			lufs_write_strategy(ufsvfsp->vfs_log, bp);
5430 		} else if (ufsvfsp->vfs_snapshot) {
5431 			fssnap_strategy(&ufsvfsp->vfs_snapshot, bp);
5432 		} else {
5433 			ufsvfsp->vfs_iotstamp = lbolt;
5434 			ub.ub_putasyncs.value.ul++;
5435 			(void) bdev_strategy(bp);
5436 			lwp_stat_update(LWP_STAT_OUBLK, 1);
5437 		}
5438 	} else {
5439 		if (ufsvfsp->vfs_log) {
5440 			lufs_write_strategy(ufsvfsp->vfs_log, bp);
5441 		} else if (ufsvfsp->vfs_snapshot) {
5442 			fssnap_strategy(&ufsvfsp->vfs_snapshot, bp);
5443 		} else {
5444 			ufsvfsp->vfs_iotstamp = lbolt;
5445 			ub.ub_putsyncs.value.ul++;
5446 			(void) bdev_strategy(bp);
5447 			lwp_stat_update(LWP_STAT_OUBLK, 1);
5448 		}
5449 		err = biowait(bp);
5450 		pageio_done(bp);
5451 		pvn_write_done(pp, ((err) ? B_ERROR : 0) | B_WRITE | flags);
5452 	}
5453 
5454 	pp = NULL;
5455 
5456 out:
5457 	if (err != 0 && pp != NULL)
5458 		pvn_write_done(pp, B_ERROR | B_WRITE | flags);
5459 
5460 	if (offp)
5461 		*offp = io_off;
5462 	if (lenp)
5463 		*lenp = io_len;
5464 out_trace:
5465 	return (err);
5466 }
5467 
5468 /* ARGSUSED */
5469 static int
5470 ufs_map(struct vnode *vp,
5471 	offset_t off,
5472 	struct as *as,
5473 	caddr_t *addrp,
5474 	size_t len,
5475 	uchar_t prot,
5476 	uchar_t maxprot,
5477 	uint_t flags,
5478 	struct cred *cr,
5479 	caller_context_t *ct)
5480 {
5481 	struct segvn_crargs vn_a;
5482 	struct ufsvfs *ufsvfsp = VTOI(vp)->i_ufsvfs;
5483 	struct ulockfs *ulp;
5484 	int error;
5485 
5486 retry_map:
5487 	error = ufs_lockfs_begin(ufsvfsp, &ulp, ULOCKFS_MAP_MASK);
5488 	if (error)
5489 		goto out;
5490 
5491 	if (vp->v_flag & VNOMAP) {
5492 		error = ENOSYS;
5493 		goto unlock;
5494 	}
5495 
5496 	if (off < (offset_t)0 || (offset_t)(off + len) < (offset_t)0) {
5497 		error = ENXIO;
5498 		goto unlock;
5499 	}
5500 
5501 	if (vp->v_type != VREG) {
5502 		error = ENODEV;
5503 		goto unlock;
5504 	}
5505 
5506 	/*
5507 	 * If file is being locked, disallow mapping.
5508 	 */
5509 	if (vn_has_mandatory_locks(vp, VTOI(vp)->i_mode)) {
5510 		error = EAGAIN;
5511 		goto unlock;
5512 	}
5513 
5514 	as_rangelock(as);
5515 	if ((flags & MAP_FIXED) == 0) {
5516 		map_addr(addrp, len, off, 1, flags);
5517 		if (*addrp == NULL) {
5518 			as_rangeunlock(as);
5519 			error = ENOMEM;
5520 			goto unlock;
5521 		}
5522 	} else {
5523 		/*
5524 		 * User specified address - blow away any previous mappings
5525 		 */
5526 		(void) as_unmap(as, *addrp, len);
5527 	}
5528 
5529 	vn_a.vp = vp;
5530 	vn_a.offset = (u_offset_t)off;
5531 	vn_a.type = flags & MAP_TYPE;
5532 	vn_a.prot = prot;
5533 	vn_a.maxprot = maxprot;
5534 	vn_a.cred = cr;
5535 	vn_a.amp = NULL;
5536 	vn_a.flags = flags & ~MAP_TYPE;
5537 	vn_a.szc = 0;
5538 	vn_a.lgrp_mem_policy_flags = 0;
5539 
5540 retry_lock:
5541 	if (!AS_LOCK_TRYENTER(ias, &as->a_lock, RW_WRITER)) {
5542 		/*
5543 		 * We didn't get the lock. Check if the SLOCK is set in the
5544 		 * ufsvfs. If yes, we might be in a deadlock. Safer to give up
5545 		 * and wait for SLOCK to be cleared.
5546 		 */
5547 
5548 		if (ulp && ULOCKFS_IS_SLOCK(ulp)) {
5549 			as_rangeunlock(as);
5550 			ufs_lockfs_end(ulp);
5551 			goto retry_map;
5552 		} else {
5553 			/*
5554 			 * SLOCK isn't set so this is a genuine synchronization
5555 			 * case. Let's try again after giving them a breather.
5556 			 */
5557 			delay(RETRY_LOCK_DELAY);
5558 			goto  retry_lock;
5559 		}
5560 	}
5561 	error = as_map_locked(as, *addrp, len, segvn_create, &vn_a);
5562 	as_rangeunlock(as);
5563 
5564 unlock:
5565 	if (ulp) {
5566 		ufs_lockfs_end(ulp);
5567 	}
5568 out:
5569 	return (error);
5570 }
5571 
5572 /* ARGSUSED */
5573 static int
5574 ufs_addmap(struct vnode *vp,
5575 	offset_t off,
5576 	struct as *as,
5577 	caddr_t addr,
5578 	size_t	len,
5579 	uchar_t  prot,
5580 	uchar_t  maxprot,
5581 	uint_t    flags,
5582 	struct cred *cr,
5583 	caller_context_t *ct)
5584 {
5585 	struct inode *ip = VTOI(vp);
5586 
5587 	if (vp->v_flag & VNOMAP) {
5588 		return (ENOSYS);
5589 	}
5590 
5591 	mutex_enter(&ip->i_tlock);
5592 	ip->i_mapcnt += btopr(len);
5593 	mutex_exit(&ip->i_tlock);
5594 	return (0);
5595 }
5596 
5597 /*ARGSUSED*/
5598 static int
5599 ufs_delmap(struct vnode *vp, offset_t off, struct as *as, caddr_t addr,
5600 	size_t len, uint_t prot,  uint_t maxprot,  uint_t flags,
5601 	struct cred *cr, caller_context_t *ct)
5602 {
5603 	struct inode *ip = VTOI(vp);
5604 
5605 	if (vp->v_flag & VNOMAP) {
5606 		return (ENOSYS);
5607 	}
5608 
5609 	mutex_enter(&ip->i_tlock);
5610 	ip->i_mapcnt -= btopr(len); 	/* Count released mappings */
5611 	ASSERT(ip->i_mapcnt >= 0);
5612 	mutex_exit(&ip->i_tlock);
5613 	return (0);
5614 }
5615 /*
5616  * Return the answer requested to poll() for non-device files
5617  */
5618 struct pollhead ufs_pollhd;
5619 
5620 /* ARGSUSED */
5621 int
5622 ufs_poll(vnode_t *vp, short ev, int any, short *revp, struct pollhead **phpp,
5623 	caller_context_t *ct)
5624 {
5625 	struct ufsvfs	*ufsvfsp;
5626 
5627 	*revp = 0;
5628 	ufsvfsp = VTOI(vp)->i_ufsvfs;
5629 
5630 	if (!ufsvfsp) {
5631 		*revp = POLLHUP;
5632 		goto out;
5633 	}
5634 
5635 	if (ULOCKFS_IS_HLOCK(&ufsvfsp->vfs_ulockfs) ||
5636 	    ULOCKFS_IS_ELOCK(&ufsvfsp->vfs_ulockfs)) {
5637 		*revp |= POLLERR;
5638 
5639 	} else {
5640 		if ((ev & POLLOUT) && !ufsvfsp->vfs_fs->fs_ronly &&
5641 		    !ULOCKFS_IS_WLOCK(&ufsvfsp->vfs_ulockfs))
5642 			*revp |= POLLOUT;
5643 
5644 		if ((ev & POLLWRBAND) && !ufsvfsp->vfs_fs->fs_ronly &&
5645 		    !ULOCKFS_IS_WLOCK(&ufsvfsp->vfs_ulockfs))
5646 			*revp |= POLLWRBAND;
5647 
5648 		if (ev & POLLIN)
5649 			*revp |= POLLIN;
5650 
5651 		if (ev & POLLRDNORM)
5652 			*revp |= POLLRDNORM;
5653 
5654 		if (ev & POLLRDBAND)
5655 			*revp |= POLLRDBAND;
5656 	}
5657 
5658 	if ((ev & POLLPRI) && (*revp & (POLLERR|POLLHUP)))
5659 		*revp |= POLLPRI;
5660 out:
5661 	*phpp = !any && !*revp ? &ufs_pollhd : (struct pollhead *)NULL;
5662 
5663 	return (0);
5664 }
5665 
5666 /* ARGSUSED */
5667 static int
5668 ufs_l_pathconf(struct vnode *vp, int cmd, ulong_t *valp, struct cred *cr,
5669 	caller_context_t *ct)
5670 {
5671 	struct ufsvfs	*ufsvfsp = VTOI(vp)->i_ufsvfs;
5672 	struct ulockfs	*ulp = NULL;
5673 	struct inode 	*sip = NULL;
5674 	int		error;
5675 	struct inode 	*ip = VTOI(vp);
5676 	int		issync;
5677 
5678 	error = ufs_lockfs_begin(ufsvfsp, &ulp, ULOCKFS_PATHCONF_MASK);
5679 	if (error)
5680 		return (error);
5681 
5682 	switch (cmd) {
5683 		/*
5684 		 * Have to handle _PC_NAME_MAX here, because the normal way
5685 		 * [fs_pathconf() -> VOP_STATVFS() -> ufs_statvfs()]
5686 		 * results in a lock ordering reversal between
5687 		 * ufs_lockfs_{begin,end}() and
5688 		 * ufs_thread_{suspend,continue}().
5689 		 *
5690 		 * Keep in sync with ufs_statvfs().
5691 		 */
5692 	case _PC_NAME_MAX:
5693 		*valp = MAXNAMLEN;
5694 		break;
5695 
5696 	case _PC_FILESIZEBITS:
5697 		if (ufsvfsp->vfs_lfflags & UFS_LARGEFILES)
5698 			*valp = UFS_FILESIZE_BITS;
5699 		else
5700 			*valp = 32;
5701 		break;
5702 
5703 	case _PC_XATTR_EXISTS:
5704 		if (vp->v_vfsp->vfs_flag & VFS_XATTR) {
5705 
5706 			error =
5707 			    ufs_xattr_getattrdir(vp, &sip, LOOKUP_XATTR, cr);
5708 			if (error ==  0 && sip != NULL) {
5709 				/* Start transaction */
5710 				if (ulp) {
5711 					TRANS_BEGIN_CSYNC(ufsvfsp, issync,
5712 					    TOP_RMDIR, TOP_RMDIR_SIZE);
5713 				}
5714 				/*
5715 				 * Is directory empty
5716 				 */
5717 				rw_enter(&sip->i_rwlock, RW_WRITER);
5718 				rw_enter(&sip->i_contents, RW_WRITER);
5719 				if (ufs_xattrdirempty(sip,
5720 				    sip->i_number, CRED())) {
5721 					rw_enter(&ip->i_contents, RW_WRITER);
5722 					ufs_unhook_shadow(ip, sip);
5723 					rw_exit(&ip->i_contents);
5724 
5725 					*valp = 0;
5726 
5727 				} else
5728 					*valp = 1;
5729 				rw_exit(&sip->i_contents);
5730 				rw_exit(&sip->i_rwlock);
5731 				if (ulp) {
5732 					TRANS_END_CSYNC(ufsvfsp, error, issync,
5733 					    TOP_RMDIR, TOP_RMDIR_SIZE);
5734 				}
5735 				VN_RELE(ITOV(sip));
5736 			} else if (error == ENOENT) {
5737 				*valp = 0;
5738 				error = 0;
5739 			}
5740 		} else {
5741 			error = fs_pathconf(vp, cmd, valp, cr, ct);
5742 		}
5743 		break;
5744 
5745 	case _PC_ACL_ENABLED:
5746 		*valp = _ACL_ACLENT_ENABLED;
5747 		break;
5748 
5749 	case _PC_MIN_HOLE_SIZE:
5750 		*valp = (ulong_t)ip->i_fs->fs_bsize;
5751 		break;
5752 
5753 	case _PC_SATTR_ENABLED:
5754 	case _PC_SATTR_EXISTS:
5755 		*valp = vfs_has_feature(vp->v_vfsp, VFSFT_XVATTR) &&
5756 		    (vp->v_type == VREG || vp->v_type == VDIR);
5757 		break;
5758 
5759 	default:
5760 		error = fs_pathconf(vp, cmd, valp, cr, ct);
5761 	}
5762 
5763 	if (ulp != NULL) {
5764 		ufs_lockfs_end(ulp);
5765 	}
5766 	return (error);
5767 }
5768 
5769 int ufs_pageio_writes, ufs_pageio_reads;
5770 
5771 /*ARGSUSED*/
5772 static int
5773 ufs_pageio(struct vnode *vp, page_t *pp, u_offset_t io_off, size_t io_len,
5774 	int flags, struct cred *cr, caller_context_t *ct)
5775 {
5776 	struct inode *ip = VTOI(vp);
5777 	struct ufsvfs *ufsvfsp;
5778 	page_t *npp = NULL, *opp = NULL, *cpp = pp;
5779 	struct buf *bp;
5780 	daddr_t bn;
5781 	size_t done_len = 0, cur_len = 0;
5782 	int err = 0;
5783 	int contig = 0;
5784 	int dolock;
5785 	int vmpss = 0;
5786 	struct ulockfs *ulp;
5787 
5788 	if ((flags & B_READ) && pp != NULL && pp->p_vnode == vp &&
5789 	    vp->v_mpssdata != NULL) {
5790 		vmpss = 1;
5791 	}
5792 
5793 	dolock = (rw_owner(&ip->i_contents) != curthread);
5794 	/*
5795 	 * We need a better check.  Ideally, we would use another
5796 	 * vnodeops so that hlocked and forcibly unmounted file
5797 	 * systems would return EIO where appropriate and w/o the
5798 	 * need for these checks.
5799 	 */
5800 	if ((ufsvfsp = ip->i_ufsvfs) == NULL)
5801 		return (EIO);
5802 
5803 	/*
5804 	 * For vmpss (pp can be NULL) case respect the quiesce protocol.
5805 	 * ul_lock must be taken before locking pages so we can't use it here
5806 	 * if pp is non NULL because segvn already locked pages
5807 	 * SE_EXCL. Instead we rely on the fact that a forced umount or
5808 	 * applying a filesystem lock via ufs_fiolfs() will block in the
5809 	 * implicit call to ufs_flush() until we unlock the pages after the
5810 	 * return to segvn. Other ufs_quiesce() callers keep ufs_quiesce_pend
5811 	 * above 0 until they are done. We have to be careful not to increment
5812 	 * ul_vnops_cnt here after forceful unmount hlocks the file system.
5813 	 *
5814 	 * If pp is NULL use ul_lock to make sure we don't increment
5815 	 * ul_vnops_cnt after forceful unmount hlocks the file system.
5816 	 */
5817 	if (vmpss || pp == NULL) {
5818 		ulp = &ufsvfsp->vfs_ulockfs;
5819 		if (pp == NULL)
5820 			mutex_enter(&ulp->ul_lock);
5821 		if (ulp->ul_fs_lock & ULOCKFS_GETREAD_MASK) {
5822 			if (pp == NULL) {
5823 				mutex_exit(&ulp->ul_lock);
5824 			}
5825 			return (vmpss ? EIO : EINVAL);
5826 		}
5827 		atomic_add_long(&ulp->ul_vnops_cnt, 1);
5828 		if (pp == NULL)
5829 			mutex_exit(&ulp->ul_lock);
5830 		if (ufs_quiesce_pend) {
5831 			if (!atomic_add_long_nv(&ulp->ul_vnops_cnt, -1))
5832 				cv_broadcast(&ulp->ul_cv);
5833 			return (vmpss ? EIO : EINVAL);
5834 		}
5835 	}
5836 
5837 	if (dolock) {
5838 		/*
5839 		 * segvn may call VOP_PAGEIO() instead of VOP_GETPAGE() to
5840 		 * handle a fault against a segment that maps vnode pages with
5841 		 * large mappings.  Segvn creates pages and holds them locked
5842 		 * SE_EXCL during VOP_PAGEIO() call. In this case we have to
5843 		 * use rw_tryenter() to avoid a potential deadlock since in
5844 		 * lock order i_contents needs to be taken first.
5845 		 * Segvn will retry via VOP_GETPAGE() if VOP_PAGEIO() fails.
5846 		 */
5847 		if (!vmpss) {
5848 			rw_enter(&ip->i_contents, RW_READER);
5849 		} else if (!rw_tryenter(&ip->i_contents, RW_READER)) {
5850 			if (!atomic_add_long_nv(&ulp->ul_vnops_cnt, -1))
5851 				cv_broadcast(&ulp->ul_cv);
5852 			return (EDEADLK);
5853 		}
5854 	}
5855 
5856 	/*
5857 	 * Return an error to segvn because the pagefault request is beyond
5858 	 * PAGESIZE rounded EOF.
5859 	 */
5860 	if (vmpss && btopr(io_off + io_len) > btopr(ip->i_size)) {
5861 		if (dolock)
5862 			rw_exit(&ip->i_contents);
5863 		if (!atomic_add_long_nv(&ulp->ul_vnops_cnt, -1))
5864 			cv_broadcast(&ulp->ul_cv);
5865 		return (EFAULT);
5866 	}
5867 
5868 	if (pp == NULL) {
5869 		if (bmap_has_holes(ip)) {
5870 			err = ENOSYS;
5871 		} else {
5872 			err = EINVAL;
5873 		}
5874 		if (dolock)
5875 			rw_exit(&ip->i_contents);
5876 		if (!atomic_add_long_nv(&ulp->ul_vnops_cnt, -1))
5877 			cv_broadcast(&ulp->ul_cv);
5878 		return (err);
5879 	}
5880 
5881 	/*
5882 	 * Break the io request into chunks, one for each contiguous
5883 	 * stretch of disk blocks in the target file.
5884 	 */
5885 	while (done_len < io_len) {
5886 		ASSERT(cpp);
5887 		contig = 0;
5888 		if (err = bmap_read(ip, (u_offset_t)(io_off + done_len),
5889 		    &bn, &contig))
5890 			break;
5891 
5892 		if (bn == UFS_HOLE) {	/* No holey swapfiles */
5893 			if (vmpss) {
5894 				err = EFAULT;
5895 				break;
5896 			}
5897 			err = ufs_fault(ITOV(ip), "ufs_pageio: bn == UFS_HOLE");
5898 			break;
5899 		}
5900 
5901 		cur_len = MIN(io_len - done_len, contig);
5902 		/*
5903 		 * Zero out a page beyond EOF, when the last block of
5904 		 * a file is a UFS fragment so that ufs_pageio() can be used
5905 		 * instead of ufs_getpage() to handle faults against
5906 		 * segvn segments that use large pages.
5907 		 */
5908 		page_list_break(&cpp, &npp, btopr(cur_len));
5909 		if ((flags & B_READ) && (cur_len & PAGEOFFSET)) {
5910 			size_t xlen = cur_len & PAGEOFFSET;
5911 			pagezero(cpp->p_prev, xlen, PAGESIZE - xlen);
5912 		}
5913 
5914 		bp = pageio_setup(cpp, cur_len, ip->i_devvp, flags);
5915 		ASSERT(bp != NULL);
5916 
5917 		bp->b_edev = ip->i_dev;
5918 		bp->b_dev = cmpdev(ip->i_dev);
5919 		bp->b_blkno = bn;
5920 		bp->b_un.b_addr = (caddr_t)0;
5921 		bp->b_file = ip->i_vnode;
5922 
5923 		ufsvfsp->vfs_iotstamp = lbolt;
5924 		ub.ub_pageios.value.ul++;
5925 		if (ufsvfsp->vfs_snapshot)
5926 			fssnap_strategy(&(ufsvfsp->vfs_snapshot), bp);
5927 		else
5928 			(void) bdev_strategy(bp);
5929 
5930 		if (flags & B_READ)
5931 			ufs_pageio_reads++;
5932 		else
5933 			ufs_pageio_writes++;
5934 		if (flags & B_READ)
5935 			lwp_stat_update(LWP_STAT_INBLK, 1);
5936 		else
5937 			lwp_stat_update(LWP_STAT_OUBLK, 1);
5938 		/*
5939 		 * If the request is not B_ASYNC, wait for i/o to complete
5940 		 * and re-assemble the page list to return to the caller.
5941 		 * If it is B_ASYNC we leave the page list in pieces and
5942 		 * cleanup() will dispose of them.
5943 		 */
5944 		if ((flags & B_ASYNC) == 0) {
5945 			err = biowait(bp);
5946 			pageio_done(bp);
5947 			if (err)
5948 				break;
5949 			page_list_concat(&opp, &cpp);
5950 		}
5951 		cpp = npp;
5952 		npp = NULL;
5953 		if (flags & B_READ)
5954 			cur_len = P2ROUNDUP_TYPED(cur_len, PAGESIZE, size_t);
5955 		done_len += cur_len;
5956 	}
5957 	ASSERT(err || (cpp == NULL && npp == NULL && done_len == io_len));
5958 	if (err) {
5959 		if (flags & B_ASYNC) {
5960 			/* Cleanup unprocessed parts of list */
5961 			page_list_concat(&cpp, &npp);
5962 			if (flags & B_READ)
5963 				pvn_read_done(cpp, B_ERROR);
5964 			else
5965 				pvn_write_done(cpp, B_ERROR);
5966 		} else {
5967 			/* Re-assemble list and let caller clean up */
5968 			page_list_concat(&opp, &cpp);
5969 			page_list_concat(&opp, &npp);
5970 		}
5971 	}
5972 
5973 	if (vmpss && !(ip->i_flag & IACC) && !ULOCKFS_IS_NOIACC(ulp) &&
5974 	    ufsvfsp->vfs_fs->fs_ronly == 0 && !ufsvfsp->vfs_noatime) {
5975 		mutex_enter(&ip->i_tlock);
5976 		ip->i_flag |= IACC;
5977 		ITIMES_NOLOCK(ip);
5978 		mutex_exit(&ip->i_tlock);
5979 	}
5980 
5981 	if (dolock)
5982 		rw_exit(&ip->i_contents);
5983 	if (vmpss && !atomic_add_long_nv(&ulp->ul_vnops_cnt, -1))
5984 		cv_broadcast(&ulp->ul_cv);
5985 	return (err);
5986 }
5987 
5988 /*
5989  * Called when the kernel is in a frozen state to dump data
5990  * directly to the device. It uses a private dump data structure,
5991  * set up by dump_ctl, to locate the correct disk block to which to dump.
5992  */
5993 /*ARGSUSED*/
5994 static int
5995 ufs_dump(vnode_t *vp, caddr_t addr, int ldbn, int dblks, caller_context_t *ct)
5996 {
5997 	u_offset_t	file_size;
5998 	struct inode    *ip = VTOI(vp);
5999 	struct fs	*fs = ip->i_fs;
6000 	daddr_t		dbn, lfsbn;
6001 	int		disk_blks = fs->fs_bsize >> DEV_BSHIFT;
6002 	int		error = 0;
6003 	int		ndbs, nfsbs;
6004 
6005 	/*
6006 	 * forced unmount case
6007 	 */
6008 	if (ip->i_ufsvfs == NULL)
6009 		return (EIO);
6010 	/*
6011 	 * Validate the inode that it has not been modified since
6012 	 * the dump structure is allocated.
6013 	 */
6014 	mutex_enter(&ip->i_tlock);
6015 	if ((dump_info == NULL) ||
6016 	    (dump_info->ip != ip) ||
6017 	    (dump_info->time.tv_sec != ip->i_mtime.tv_sec) ||
6018 	    (dump_info->time.tv_usec != ip->i_mtime.tv_usec)) {
6019 		mutex_exit(&ip->i_tlock);
6020 		return (-1);
6021 	}
6022 	mutex_exit(&ip->i_tlock);
6023 
6024 	/*
6025 	 * See that the file has room for this write
6026 	 */
6027 	UFS_GET_ISIZE(&file_size, ip);
6028 
6029 	if (ldbtob((offset_t)(ldbn + dblks)) > file_size)
6030 		return (ENOSPC);
6031 
6032 	/*
6033 	 * Find the physical disk block numbers from the dump
6034 	 * private data structure directly and write out the data
6035 	 * in contiguous block lumps
6036 	 */
6037 	while (dblks > 0 && !error) {
6038 		lfsbn = (daddr_t)lblkno(fs, ldbtob((offset_t)ldbn));
6039 		dbn = fsbtodb(fs, dump_info->dblk[lfsbn]) + ldbn % disk_blks;
6040 		nfsbs = 1;
6041 		ndbs = disk_blks - ldbn % disk_blks;
6042 		while (ndbs < dblks && fsbtodb(fs, dump_info->dblk[lfsbn +
6043 		    nfsbs]) == dbn + ndbs) {
6044 			nfsbs++;
6045 			ndbs += disk_blks;
6046 		}
6047 		if (ndbs > dblks)
6048 			ndbs = dblks;
6049 		error = bdev_dump(ip->i_dev, addr, dbn, ndbs);
6050 		addr += ldbtob((offset_t)ndbs);
6051 		dblks -= ndbs;
6052 		ldbn += ndbs;
6053 	}
6054 	return (error);
6055 
6056 }
6057 
6058 /*
6059  * Prepare the file system before and after the dump operation.
6060  *
6061  * action = DUMP_ALLOC:
6062  * Preparation before dump, allocate dump private data structure
6063  * to hold all the direct and indirect block info for dump.
6064  *
6065  * action = DUMP_FREE:
6066  * Clean up after dump, deallocate the dump private data structure.
6067  *
6068  * action = DUMP_SCAN:
6069  * Scan dump_info for *blkp DEV_BSIZE blocks of contig fs space;
6070  * if found, the starting file-relative DEV_BSIZE lbn is written
6071  * to *bklp; that lbn is intended for use with VOP_DUMP()
6072  */
6073 /*ARGSUSED*/
6074 static int
6075 ufs_dumpctl(vnode_t *vp, int action, int *blkp, caller_context_t *ct)
6076 {
6077 	struct inode	*ip = VTOI(vp);
6078 	ufsvfs_t	*ufsvfsp = ip->i_ufsvfs;
6079 	struct fs	*fs;
6080 	daddr32_t	*dblk, *storeblk;
6081 	daddr32_t	*nextblk, *endblk;
6082 	struct buf	*bp;
6083 	int		i, entry, entries;
6084 	int		n, ncontig;
6085 
6086 	/*
6087 	 * check for forced unmount
6088 	 */
6089 	if (ufsvfsp == NULL)
6090 		return (EIO);
6091 
6092 	if (action == DUMP_ALLOC) {
6093 		/*
6094 		 * alloc and record dump_info
6095 		 */
6096 		if (dump_info != NULL)
6097 			return (EINVAL);
6098 
6099 		ASSERT(vp->v_type == VREG);
6100 		fs = ufsvfsp->vfs_fs;
6101 
6102 		rw_enter(&ip->i_contents, RW_READER);
6103 
6104 		if (bmap_has_holes(ip)) {
6105 			rw_exit(&ip->i_contents);
6106 			return (EFAULT);
6107 		}
6108 
6109 		/*
6110 		 * calculate and allocate space needed according to i_size
6111 		 */
6112 		entries = (int)lblkno(fs, blkroundup(fs, ip->i_size));
6113 		dump_info = kmem_alloc(sizeof (struct dump) +
6114 		    (entries - 1) * sizeof (daddr32_t), KM_NOSLEEP);
6115 		if (dump_info == NULL) {
6116 			rw_exit(&ip->i_contents);
6117 			return (ENOMEM);
6118 		}
6119 
6120 		/* Start saving the info */
6121 		dump_info->fsbs = entries;
6122 		dump_info->ip = ip;
6123 		storeblk = &dump_info->dblk[0];
6124 
6125 		/* Direct Blocks */
6126 		for (entry = 0; entry < NDADDR && entry < entries; entry++)
6127 			*storeblk++ = ip->i_db[entry];
6128 
6129 		/* Indirect Blocks */
6130 		for (i = 0; i < NIADDR; i++) {
6131 			int error = 0;
6132 
6133 			bp = UFS_BREAD(ufsvfsp,
6134 			    ip->i_dev, fsbtodb(fs, ip->i_ib[i]), fs->fs_bsize);
6135 			if (bp->b_flags & B_ERROR)
6136 				error = EIO;
6137 			else {
6138 				dblk = bp->b_un.b_daddr;
6139 				if ((storeblk = save_dblks(ip, ufsvfsp,
6140 				    storeblk, dblk, i, entries)) == NULL)
6141 					error = EIO;
6142 			}
6143 
6144 			brelse(bp);
6145 
6146 			if (error != 0) {
6147 				kmem_free(dump_info, sizeof (struct dump) +
6148 				    (entries - 1) * sizeof (daddr32_t));
6149 				rw_exit(&ip->i_contents);
6150 				dump_info = NULL;
6151 				return (error);
6152 			}
6153 		}
6154 		/* and time stamp the information */
6155 		mutex_enter(&ip->i_tlock);
6156 		dump_info->time = ip->i_mtime;
6157 		mutex_exit(&ip->i_tlock);
6158 
6159 		rw_exit(&ip->i_contents);
6160 	} else if (action == DUMP_FREE) {
6161 		/*
6162 		 * free dump_info
6163 		 */
6164 		if (dump_info == NULL)
6165 			return (EINVAL);
6166 		entries = dump_info->fsbs - 1;
6167 		kmem_free(dump_info, sizeof (struct dump) +
6168 		    entries * sizeof (daddr32_t));
6169 		dump_info = NULL;
6170 	} else if (action == DUMP_SCAN) {
6171 		/*
6172 		 * scan dump_info
6173 		 */
6174 		if (dump_info == NULL)
6175 			return (EINVAL);
6176 
6177 		dblk = dump_info->dblk;
6178 		nextblk = dblk + 1;
6179 		endblk = dblk + dump_info->fsbs - 1;
6180 		fs = ufsvfsp->vfs_fs;
6181 		ncontig = *blkp >> (fs->fs_bshift - DEV_BSHIFT);
6182 
6183 		/*
6184 		 * scan dblk[] entries; contig fs space is found when:
6185 		 * ((current blkno + frags per block) == next blkno)
6186 		 */
6187 		n = 0;
6188 		while (n < ncontig && dblk < endblk) {
6189 			if ((*dblk + fs->fs_frag) == *nextblk)
6190 				n++;
6191 			else
6192 				n = 0;
6193 			dblk++;
6194 			nextblk++;
6195 		}
6196 
6197 		/*
6198 		 * index is where size bytes of contig space begins;
6199 		 * conversion from index to the file's DEV_BSIZE lbn
6200 		 * is equivalent to:  (index * fs_bsize) / DEV_BSIZE
6201 		 */
6202 		if (n == ncontig) {
6203 			i = (dblk - dump_info->dblk) - ncontig;
6204 			*blkp = i << (fs->fs_bshift - DEV_BSHIFT);
6205 		} else
6206 			return (EFAULT);
6207 	}
6208 	return (0);
6209 }
6210 
6211 /*
6212  * Recursive helper function for ufs_dumpctl().  It follows the indirect file
6213  * system  blocks until it reaches the the disk block addresses, which are
6214  * then stored into the given buffer, storeblk.
6215  */
6216 static daddr32_t *
6217 save_dblks(struct inode *ip, struct ufsvfs *ufsvfsp,  daddr32_t *storeblk,
6218     daddr32_t *dblk, int level, int entries)
6219 {
6220 	struct fs	*fs = ufsvfsp->vfs_fs;
6221 	struct buf	*bp;
6222 	int		i;
6223 
6224 	if (level == 0) {
6225 		for (i = 0; i < NINDIR(fs); i++) {
6226 			if (storeblk - dump_info->dblk >= entries)
6227 				break;
6228 			*storeblk++ = dblk[i];
6229 		}
6230 		return (storeblk);
6231 	}
6232 	for (i = 0; i < NINDIR(fs); i++) {
6233 		if (storeblk - dump_info->dblk >= entries)
6234 			break;
6235 		bp = UFS_BREAD(ufsvfsp,
6236 		    ip->i_dev, fsbtodb(fs, dblk[i]), fs->fs_bsize);
6237 		if (bp->b_flags & B_ERROR) {
6238 			brelse(bp);
6239 			return (NULL);
6240 		}
6241 		storeblk = save_dblks(ip, ufsvfsp, storeblk, bp->b_un.b_daddr,
6242 		    level - 1, entries);
6243 		brelse(bp);
6244 
6245 		if (storeblk == NULL)
6246 			return (NULL);
6247 	}
6248 	return (storeblk);
6249 }
6250 
6251 /* ARGSUSED */
6252 static int
6253 ufs_getsecattr(struct vnode *vp, vsecattr_t *vsap, int flag,
6254 	struct cred *cr, caller_context_t *ct)
6255 {
6256 	struct inode	*ip = VTOI(vp);
6257 	struct ulockfs	*ulp;
6258 	struct ufsvfs	*ufsvfsp = ip->i_ufsvfs;
6259 	ulong_t		vsa_mask = vsap->vsa_mask;
6260 	int		err = EINVAL;
6261 
6262 	vsa_mask &= (VSA_ACL | VSA_ACLCNT | VSA_DFACL | VSA_DFACLCNT);
6263 
6264 	/*
6265 	 * Only grab locks if needed - they're not needed to check vsa_mask
6266 	 * or if the mask contains no acl flags.
6267 	 */
6268 	if (vsa_mask != 0) {
6269 		if (err = ufs_lockfs_begin(ufsvfsp, &ulp,
6270 		    ULOCKFS_GETATTR_MASK))
6271 			return (err);
6272 
6273 		rw_enter(&ip->i_contents, RW_READER);
6274 		err = ufs_acl_get(ip, vsap, flag, cr);
6275 		rw_exit(&ip->i_contents);
6276 
6277 		if (ulp)
6278 			ufs_lockfs_end(ulp);
6279 	}
6280 	return (err);
6281 }
6282 
6283 /* ARGSUSED */
6284 static int
6285 ufs_setsecattr(struct vnode *vp, vsecattr_t *vsap, int flag, struct cred *cr,
6286 	caller_context_t *ct)
6287 {
6288 	struct inode	*ip = VTOI(vp);
6289 	struct ulockfs	*ulp = NULL;
6290 	struct ufsvfs	*ufsvfsp = VTOI(vp)->i_ufsvfs;
6291 	ulong_t		vsa_mask = vsap->vsa_mask;
6292 	int		err;
6293 	int		haverwlock = 1;
6294 	int		trans_size;
6295 	int		donetrans = 0;
6296 	int		retry = 1;
6297 
6298 	ASSERT(RW_LOCK_HELD(&ip->i_rwlock));
6299 
6300 	/* Abort now if the request is either empty or invalid. */
6301 	vsa_mask &= (VSA_ACL | VSA_ACLCNT | VSA_DFACL | VSA_DFACLCNT);
6302 	if ((vsa_mask == 0) ||
6303 	    ((vsap->vsa_aclentp == NULL) &&
6304 	    (vsap->vsa_dfaclentp == NULL))) {
6305 		err = EINVAL;
6306 		goto out;
6307 	}
6308 
6309 	/*
6310 	 * Following convention, if this is a directory then we acquire the
6311 	 * inode's i_rwlock after starting a UFS logging transaction;
6312 	 * otherwise, we acquire it beforehand. Since we were called (and
6313 	 * must therefore return) with the lock held, we will have to drop it,
6314 	 * and later reacquire it, if operating on a directory.
6315 	 */
6316 	if (vp->v_type == VDIR) {
6317 		rw_exit(&ip->i_rwlock);
6318 		haverwlock = 0;
6319 	} else {
6320 		/* Upgrade the lock if required. */
6321 		if (!rw_write_held(&ip->i_rwlock)) {
6322 			rw_exit(&ip->i_rwlock);
6323 			rw_enter(&ip->i_rwlock, RW_WRITER);
6324 		}
6325 	}
6326 
6327 again:
6328 	ASSERT(!(vp->v_type == VDIR && haverwlock));
6329 	if (err = ufs_lockfs_begin(ufsvfsp, &ulp, ULOCKFS_SETATTR_MASK)) {
6330 		ulp = NULL;
6331 		retry = 0;
6332 		goto out;
6333 	}
6334 
6335 	/*
6336 	 * Check that the file system supports this operation. Note that
6337 	 * ufs_lockfs_begin() will have checked that the file system had
6338 	 * not been forcibly unmounted.
6339 	 */
6340 	if (ufsvfsp->vfs_fs->fs_ronly) {
6341 		err = EROFS;
6342 		goto out;
6343 	}
6344 	if (ufsvfsp->vfs_nosetsec) {
6345 		err = ENOSYS;
6346 		goto out;
6347 	}
6348 
6349 	if (ulp) {
6350 		TRANS_BEGIN_ASYNC(ufsvfsp, TOP_SETSECATTR,
6351 		    trans_size = TOP_SETSECATTR_SIZE(VTOI(vp)));
6352 		donetrans = 1;
6353 	}
6354 
6355 	if (vp->v_type == VDIR) {
6356 		rw_enter(&ip->i_rwlock, RW_WRITER);
6357 		haverwlock = 1;
6358 	}
6359 
6360 	ASSERT(haverwlock);
6361 
6362 	/* Do the actual work. */
6363 	rw_enter(&ip->i_contents, RW_WRITER);
6364 	/*
6365 	 * Suppress out of inodes messages if we will retry.
6366 	 */
6367 	if (retry)
6368 		ip->i_flag |= IQUIET;
6369 	err = ufs_acl_set(ip, vsap, flag, cr);
6370 	ip->i_flag &= ~IQUIET;
6371 	rw_exit(&ip->i_contents);
6372 
6373 out:
6374 	if (ulp) {
6375 		if (donetrans) {
6376 			/*
6377 			 * top_end_async() can eventually call
6378 			 * top_end_sync(), which can block. We must
6379 			 * therefore observe the lock-ordering protocol
6380 			 * here as well.
6381 			 */
6382 			if (vp->v_type == VDIR) {
6383 				rw_exit(&ip->i_rwlock);
6384 				haverwlock = 0;
6385 			}
6386 			TRANS_END_ASYNC(ufsvfsp, TOP_SETSECATTR, trans_size);
6387 		}
6388 		ufs_lockfs_end(ulp);
6389 	}
6390 	/*
6391 	 * If no inodes available, try scaring a logically-
6392 	 * free one out of the delete queue to someplace
6393 	 * that we can find it.
6394 	 */
6395 	if ((err == ENOSPC) && retry && TRANS_ISTRANS(ufsvfsp)) {
6396 		ufs_delete_drain_wait(ufsvfsp, 1);
6397 		retry = 0;
6398 		if (vp->v_type == VDIR && haverwlock) {
6399 			rw_exit(&ip->i_rwlock);
6400 			haverwlock = 0;
6401 		}
6402 		goto again;
6403 	}
6404 	/*
6405 	 * If we need to reacquire the lock then it is safe to do so
6406 	 * as a reader. This is because ufs_rwunlock(), which will be
6407 	 * called by our caller after we return, does not differentiate
6408 	 * between shared and exclusive locks.
6409 	 */
6410 	if (!haverwlock) {
6411 		ASSERT(vp->v_type == VDIR);
6412 		rw_enter(&ip->i_rwlock, RW_READER);
6413 	}
6414 
6415 	return (err);
6416 }
6417