xref: /titanic_41/usr/src/uts/common/fs/ufs/ufs_vnops.c (revision 2e1a94749a6ae1ee25de9f4492d4b90a3b408c4c)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 
22 /*
23  * Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
24  * Use is subject to license terms.
25  */
26 
27 /*	Copyright (c) 1983, 1984, 1985, 1986, 1987, 1988, 1989 AT&T	*/
28 /*	  All Rights Reserved  	*/
29 
30 /*
31  * Portions of this source code were derived from Berkeley 4.3 BSD
32  * under license from the Regents of the University of California.
33  */
34 
35 #include <sys/types.h>
36 #include <sys/t_lock.h>
37 #include <sys/ksynch.h>
38 #include <sys/param.h>
39 #include <sys/time.h>
40 #include <sys/systm.h>
41 #include <sys/sysmacros.h>
42 #include <sys/resource.h>
43 #include <sys/signal.h>
44 #include <sys/cred.h>
45 #include <sys/user.h>
46 #include <sys/buf.h>
47 #include <sys/vfs.h>
48 #include <sys/vfs_opreg.h>
49 #include <sys/vnode.h>
50 #include <sys/proc.h>
51 #include <sys/disp.h>
52 #include <sys/file.h>
53 #include <sys/fcntl.h>
54 #include <sys/flock.h>
55 #include <sys/atomic.h>
56 #include <sys/kmem.h>
57 #include <sys/uio.h>
58 #include <sys/dnlc.h>
59 #include <sys/conf.h>
60 #include <sys/mman.h>
61 #include <sys/pathname.h>
62 #include <sys/debug.h>
63 #include <sys/vmsystm.h>
64 #include <sys/cmn_err.h>
65 #include <sys/filio.h>
66 #include <sys/policy.h>
67 
68 #include <sys/fs/ufs_fs.h>
69 #include <sys/fs/ufs_lockfs.h>
70 #include <sys/fs/ufs_filio.h>
71 #include <sys/fs/ufs_inode.h>
72 #include <sys/fs/ufs_fsdir.h>
73 #include <sys/fs/ufs_quota.h>
74 #include <sys/fs/ufs_log.h>
75 #include <sys/fs/ufs_snap.h>
76 #include <sys/fs/ufs_trans.h>
77 #include <sys/fs/ufs_panic.h>
78 #include <sys/fs/ufs_bio.h>
79 #include <sys/dirent.h>		/* must be AFTER <sys/fs/fsdir.h>! */
80 #include <sys/errno.h>
81 #include <sys/fssnap_if.h>
82 #include <sys/unistd.h>
83 #include <sys/sunddi.h>
84 
85 #include <sys/filio.h>		/* _FIOIO */
86 
87 #include <vm/hat.h>
88 #include <vm/page.h>
89 #include <vm/pvn.h>
90 #include <vm/as.h>
91 #include <vm/seg.h>
92 #include <vm/seg_map.h>
93 #include <vm/seg_vn.h>
94 #include <vm/seg_kmem.h>
95 #include <vm/rm.h>
96 #include <sys/swap.h>
97 
98 #include <fs/fs_subr.h>
99 
100 #include <sys/fs/decomp.h>
101 
102 static struct instats ins;
103 
104 static 	int ufs_getpage_ra(struct vnode *, u_offset_t, struct seg *, caddr_t);
105 static	int ufs_getpage_miss(struct vnode *, u_offset_t, size_t, struct seg *,
106 		caddr_t, struct page **, size_t, enum seg_rw, int);
107 static	int ufs_open(struct vnode **, int, struct cred *, caller_context_t *);
108 static	int ufs_close(struct vnode *, int, int, offset_t, struct cred *,
109 		caller_context_t *);
110 static	int ufs_read(struct vnode *, struct uio *, int, struct cred *,
111 		struct caller_context *);
112 static	int ufs_write(struct vnode *, struct uio *, int, struct cred *,
113 		struct caller_context *);
114 static	int ufs_ioctl(struct vnode *, int, intptr_t, int, struct cred *,
115 		int *, caller_context_t *);
116 static	int ufs_getattr(struct vnode *, struct vattr *, int, struct cred *,
117 		caller_context_t *);
118 static	int ufs_setattr(struct vnode *, struct vattr *, int, struct cred *,
119 		caller_context_t *);
120 static	int ufs_access(struct vnode *, int, int, struct cred *,
121 		caller_context_t *);
122 static	int ufs_lookup(struct vnode *, char *, struct vnode **,
123 		struct pathname *, int, struct vnode *, struct cred *,
124 		caller_context_t *, int *, pathname_t *);
125 static	int ufs_create(struct vnode *, char *, struct vattr *, enum vcexcl,
126 		int, struct vnode **, struct cred *, int,
127 		caller_context_t *, vsecattr_t  *);
128 static	int ufs_remove(struct vnode *, char *, struct cred *,
129 		caller_context_t *, int);
130 static	int ufs_link(struct vnode *, struct vnode *, char *, struct cred *,
131 		caller_context_t *, int);
132 static	int ufs_rename(struct vnode *, char *, struct vnode *, char *,
133 		struct cred *, caller_context_t *, int);
134 static	int ufs_mkdir(struct vnode *, char *, struct vattr *, struct vnode **,
135 		struct cred *, caller_context_t *, int, vsecattr_t *);
136 static	int ufs_rmdir(struct vnode *, char *, struct vnode *, struct cred *,
137 		caller_context_t *, int);
138 static	int ufs_readdir(struct vnode *, struct uio *, struct cred *, int *,
139 		caller_context_t *, int);
140 static	int ufs_symlink(struct vnode *, char *, struct vattr *, char *,
141 		struct cred *, caller_context_t *, int);
142 static	int ufs_readlink(struct vnode *, struct uio *, struct cred *,
143 		caller_context_t *);
144 static	int ufs_fsync(struct vnode *, int, struct cred *, caller_context_t *);
145 static	void ufs_inactive(struct vnode *, struct cred *, caller_context_t *);
146 static	int ufs_fid(struct vnode *, struct fid *, caller_context_t *);
147 static	int ufs_rwlock(struct vnode *, int, caller_context_t *);
148 static	void ufs_rwunlock(struct vnode *, int, caller_context_t *);
149 static	int ufs_seek(struct vnode *, offset_t, offset_t *, caller_context_t *);
150 static	int ufs_frlock(struct vnode *, int, struct flock64 *, int, offset_t,
151 		struct flk_callback *, struct cred *,
152 		caller_context_t *);
153 static  int ufs_space(struct vnode *, int, struct flock64 *, int, offset_t,
154 		cred_t *, caller_context_t *);
155 static	int ufs_getpage(struct vnode *, offset_t, size_t, uint_t *,
156 		struct page **, size_t, struct seg *, caddr_t,
157 		enum seg_rw, struct cred *, caller_context_t *);
158 static	int ufs_putpage(struct vnode *, offset_t, size_t, int, struct cred *,
159 		caller_context_t *);
160 static	int ufs_putpages(struct vnode *, offset_t, size_t, int, struct cred *);
161 static	int ufs_map(struct vnode *, offset_t, struct as *, caddr_t *, size_t,
162 		uchar_t, uchar_t, uint_t, struct cred *, caller_context_t *);
163 static	int ufs_addmap(struct vnode *, offset_t, struct as *, caddr_t,  size_t,
164 		uchar_t, uchar_t, uint_t, struct cred *, caller_context_t *);
165 static	int ufs_delmap(struct vnode *, offset_t, struct as *, caddr_t,  size_t,
166 		uint_t, uint_t, uint_t, struct cred *, caller_context_t *);
167 static	int ufs_poll(vnode_t *, short, int, short *, struct pollhead **,
168 		caller_context_t *);
169 static	int ufs_dump(vnode_t *, caddr_t, offset_t, offset_t,
170     caller_context_t *);
171 static	int ufs_l_pathconf(struct vnode *, int, ulong_t *, struct cred *,
172 		caller_context_t *);
173 static	int ufs_pageio(struct vnode *, struct page *, u_offset_t, size_t, int,
174 		struct cred *, caller_context_t *);
175 static	int ufs_dumpctl(vnode_t *, int, offset_t *, caller_context_t *);
176 static	daddr32_t *save_dblks(struct inode *, struct ufsvfs *, daddr32_t *,
177 		daddr32_t *, int, int);
178 static	int ufs_getsecattr(struct vnode *, vsecattr_t *, int, struct cred *,
179 		caller_context_t *);
180 static	int ufs_setsecattr(struct vnode *, vsecattr_t *, int, struct cred *,
181 		caller_context_t *);
182 extern int as_map_locked(struct as *, caddr_t, size_t, int ((*)()), void *);
183 
184 /*
185  * For lockfs: ulockfs begin/end is now inlined in the ufs_xxx functions.
186  *
187  * XXX - ULOCKFS in fs_pathconf and ufs_ioctl is not inlined yet.
188  */
189 struct vnodeops *ufs_vnodeops;
190 
191 /* NOTE: "not blkd" below  means that the operation isn't blocked by lockfs */
192 const fs_operation_def_t ufs_vnodeops_template[] = {
193 	VOPNAME_OPEN,		{ .vop_open = ufs_open },	/* not blkd */
194 	VOPNAME_CLOSE,		{ .vop_close = ufs_close },	/* not blkd */
195 	VOPNAME_READ,		{ .vop_read = ufs_read },
196 	VOPNAME_WRITE,		{ .vop_write = ufs_write },
197 	VOPNAME_IOCTL,		{ .vop_ioctl = ufs_ioctl },
198 	VOPNAME_GETATTR,	{ .vop_getattr = ufs_getattr },
199 	VOPNAME_SETATTR,	{ .vop_setattr = ufs_setattr },
200 	VOPNAME_ACCESS,		{ .vop_access = ufs_access },
201 	VOPNAME_LOOKUP,		{ .vop_lookup = ufs_lookup },
202 	VOPNAME_CREATE,		{ .vop_create = ufs_create },
203 	VOPNAME_REMOVE,		{ .vop_remove = ufs_remove },
204 	VOPNAME_LINK,		{ .vop_link = ufs_link },
205 	VOPNAME_RENAME,		{ .vop_rename = ufs_rename },
206 	VOPNAME_MKDIR,		{ .vop_mkdir = ufs_mkdir },
207 	VOPNAME_RMDIR,		{ .vop_rmdir = ufs_rmdir },
208 	VOPNAME_READDIR,	{ .vop_readdir = ufs_readdir },
209 	VOPNAME_SYMLINK,	{ .vop_symlink = ufs_symlink },
210 	VOPNAME_READLINK,	{ .vop_readlink = ufs_readlink },
211 	VOPNAME_FSYNC,		{ .vop_fsync = ufs_fsync },
212 	VOPNAME_INACTIVE,	{ .vop_inactive = ufs_inactive }, /* not blkd */
213 	VOPNAME_FID,		{ .vop_fid = ufs_fid },
214 	VOPNAME_RWLOCK,		{ .vop_rwlock = ufs_rwlock },	/* not blkd */
215 	VOPNAME_RWUNLOCK,	{ .vop_rwunlock = ufs_rwunlock }, /* not blkd */
216 	VOPNAME_SEEK,		{ .vop_seek = ufs_seek },
217 	VOPNAME_FRLOCK,		{ .vop_frlock = ufs_frlock },
218 	VOPNAME_SPACE,		{ .vop_space = ufs_space },
219 	VOPNAME_GETPAGE,	{ .vop_getpage = ufs_getpage },
220 	VOPNAME_PUTPAGE,	{ .vop_putpage = ufs_putpage },
221 	VOPNAME_MAP,		{ .vop_map = ufs_map },
222 	VOPNAME_ADDMAP,		{ .vop_addmap = ufs_addmap },	/* not blkd */
223 	VOPNAME_DELMAP,		{ .vop_delmap = ufs_delmap },	/* not blkd */
224 	VOPNAME_POLL,		{ .vop_poll = ufs_poll },	/* not blkd */
225 	VOPNAME_DUMP,		{ .vop_dump = ufs_dump },
226 	VOPNAME_PATHCONF,	{ .vop_pathconf = ufs_l_pathconf },
227 	VOPNAME_PAGEIO,		{ .vop_pageio = ufs_pageio },
228 	VOPNAME_DUMPCTL,	{ .vop_dumpctl = ufs_dumpctl },
229 	VOPNAME_GETSECATTR,	{ .vop_getsecattr = ufs_getsecattr },
230 	VOPNAME_SETSECATTR,	{ .vop_setsecattr = ufs_setsecattr },
231 	VOPNAME_VNEVENT,	{ .vop_vnevent = fs_vnevent_support },
232 	NULL,			NULL
233 };
234 
235 #define	MAX_BACKFILE_COUNT	9999
236 
237 /*
238  * Created by ufs_dumpctl() to store a file's disk block info into memory.
239  * Used by ufs_dump() to dump data to disk directly.
240  */
241 struct dump {
242 	struct inode	*ip;		/* the file we contain */
243 	daddr_t		fsbs;		/* number of blocks stored */
244 	struct timeval32 time;		/* time stamp for the struct */
245 	daddr32_t 	dblk[1];	/* place holder for block info */
246 };
247 
248 static struct dump *dump_info = NULL;
249 
250 /*
251  * Previously there was no special action required for ordinary files.
252  * (Devices are handled through the device file system.)
253  * Now we support Large Files and Large File API requires open to
254  * fail if file is large.
255  * We could take care to prevent data corruption
256  * by doing an atomic check of size and truncate if file is opened with
257  * FTRUNC flag set but traditionally this is being done by the vfs/vnode
258  * layers. So taking care of truncation here is a change in the existing
259  * semantics of VOP_OPEN and therefore we chose not to implement any thing
260  * here. The check for the size of the file > 2GB is being done at the
261  * vfs layer in routine vn_open().
262  */
263 
264 /* ARGSUSED */
265 static int
266 ufs_open(struct vnode **vpp, int flag, struct cred *cr, caller_context_t *ct)
267 {
268 	return (0);
269 }
270 
271 /*ARGSUSED*/
272 static int
273 ufs_close(struct vnode *vp, int flag, int count, offset_t offset,
274 	struct cred *cr, caller_context_t *ct)
275 {
276 	cleanlocks(vp, ttoproc(curthread)->p_pid, 0);
277 	cleanshares(vp, ttoproc(curthread)->p_pid);
278 
279 	/*
280 	 * Push partially filled cluster at last close.
281 	 * ``last close'' is approximated because the dnlc
282 	 * may have a hold on the vnode.
283 	 * Checking for VBAD here will also act as a forced umount check.
284 	 */
285 	if (vp->v_count <= 2 && vp->v_type != VBAD) {
286 		struct inode *ip = VTOI(vp);
287 		if (ip->i_delaylen) {
288 			ins.in_poc.value.ul++;
289 			(void) ufs_putpages(vp, ip->i_delayoff, ip->i_delaylen,
290 			    B_ASYNC | B_FREE, cr);
291 			ip->i_delaylen = 0;
292 		}
293 	}
294 
295 	return (0);
296 }
297 
298 /*ARGSUSED*/
299 static int
300 ufs_read(struct vnode *vp, struct uio *uiop, int ioflag, struct cred *cr,
301 	struct caller_context *ct)
302 {
303 	struct inode *ip = VTOI(vp);
304 	struct ufsvfs *ufsvfsp;
305 	struct ulockfs *ulp = NULL;
306 	int error = 0;
307 	int intrans = 0;
308 
309 	ASSERT(RW_READ_HELD(&ip->i_rwlock));
310 
311 	/*
312 	 * Mandatory locking needs to be done before ufs_lockfs_begin()
313 	 * and TRANS_BEGIN_SYNC() calls since mandatory locks can sleep.
314 	 */
315 	if (MANDLOCK(vp, ip->i_mode)) {
316 		/*
317 		 * ufs_getattr ends up being called by chklock
318 		 */
319 		error = chklock(vp, FREAD, uiop->uio_loffset,
320 		    uiop->uio_resid, uiop->uio_fmode, ct);
321 		if (error)
322 			goto out;
323 	}
324 
325 	ufsvfsp = ip->i_ufsvfs;
326 	error = ufs_lockfs_begin(ufsvfsp, &ulp, ULOCKFS_READ_MASK);
327 	if (error)
328 		goto out;
329 
330 	/*
331 	 * In the case that a directory is opened for reading as a file
332 	 * (eg "cat .") with the  O_RSYNC, O_SYNC and O_DSYNC flags set.
333 	 * The locking order had to be changed to avoid a deadlock with
334 	 * an update taking place on that directory at the same time.
335 	 */
336 	if ((ip->i_mode & IFMT) == IFDIR) {
337 
338 		rw_enter(&ip->i_contents, RW_READER);
339 		error = rdip(ip, uiop, ioflag, cr);
340 		rw_exit(&ip->i_contents);
341 
342 		if (error) {
343 			if (ulp)
344 				ufs_lockfs_end(ulp);
345 			goto out;
346 		}
347 
348 		if (ulp && (ioflag & FRSYNC) && (ioflag & (FSYNC | FDSYNC)) &&
349 		    TRANS_ISTRANS(ufsvfsp)) {
350 			rw_exit(&ip->i_rwlock);
351 			TRANS_BEGIN_SYNC(ufsvfsp, TOP_READ_SYNC, TOP_READ_SIZE,
352 			    error);
353 			ASSERT(!error);
354 			TRANS_END_SYNC(ufsvfsp, error, TOP_READ_SYNC,
355 			    TOP_READ_SIZE);
356 			rw_enter(&ip->i_rwlock, RW_READER);
357 		}
358 	} else {
359 		/*
360 		 * Only transact reads to files opened for sync-read and
361 		 * sync-write on a file system that is not write locked.
362 		 *
363 		 * The ``not write locked'' check prevents problems with
364 		 * enabling/disabling logging on a busy file system.  E.g.,
365 		 * logging exists at the beginning of the read but does not
366 		 * at the end.
367 		 *
368 		 */
369 		if (ulp && (ioflag & FRSYNC) && (ioflag & (FSYNC | FDSYNC)) &&
370 		    TRANS_ISTRANS(ufsvfsp)) {
371 			TRANS_BEGIN_SYNC(ufsvfsp, TOP_READ_SYNC, TOP_READ_SIZE,
372 			    error);
373 			ASSERT(!error);
374 			intrans = 1;
375 		}
376 
377 		rw_enter(&ip->i_contents, RW_READER);
378 		error = rdip(ip, uiop, ioflag, cr);
379 		rw_exit(&ip->i_contents);
380 
381 		if (intrans) {
382 			TRANS_END_SYNC(ufsvfsp, error, TOP_READ_SYNC,
383 			    TOP_READ_SIZE);
384 		}
385 	}
386 
387 	if (ulp) {
388 		ufs_lockfs_end(ulp);
389 	}
390 out:
391 
392 	return (error);
393 }
394 
395 extern	int	ufs_HW;		/* high water mark */
396 extern	int	ufs_LW;		/* low water mark */
397 int	ufs_WRITES = 1;		/* XXX - enable/disable */
398 int	ufs_throttles = 0;	/* throttling count */
399 int	ufs_allow_shared_writes = 1;	/* directio shared writes */
400 
401 static int
402 ufs_check_rewrite(struct inode *ip, struct uio *uiop, int ioflag)
403 {
404 	int	shared_write;
405 
406 	/*
407 	 * If the FDSYNC flag is set then ignore the global
408 	 * ufs_allow_shared_writes in this case.
409 	 */
410 	shared_write = (ioflag & FDSYNC) | ufs_allow_shared_writes;
411 
412 	/*
413 	 * Filter to determine if this request is suitable as a
414 	 * concurrent rewrite. This write must not allocate blocks
415 	 * by extending the file or filling in holes. No use trying
416 	 * through FSYNC descriptors as the inode will be synchronously
417 	 * updated after the write. The uio structure has not yet been
418 	 * checked for sanity, so assume nothing.
419 	 */
420 	return (((ip->i_mode & IFMT) == IFREG) && !(ioflag & FAPPEND) &&
421 	    (uiop->uio_loffset >= (offset_t)0) &&
422 	    (uiop->uio_loffset < ip->i_size) && (uiop->uio_resid > 0) &&
423 	    ((ip->i_size - uiop->uio_loffset) >= uiop->uio_resid) &&
424 	    !(ioflag & FSYNC) && !bmap_has_holes(ip) &&
425 	    shared_write);
426 }
427 
428 /*ARGSUSED*/
429 static int
430 ufs_write(struct vnode *vp, struct uio *uiop, int ioflag, cred_t *cr,
431 	caller_context_t *ct)
432 {
433 	struct inode *ip = VTOI(vp);
434 	struct ufsvfs *ufsvfsp;
435 	struct ulockfs *ulp;
436 	int retry = 1;
437 	int error, resv, resid = 0;
438 	int directio_status;
439 	int exclusive;
440 	int rewriteflg;
441 	long start_resid = uiop->uio_resid;
442 
443 	ASSERT(RW_LOCK_HELD(&ip->i_rwlock));
444 
445 retry_mandlock:
446 	/*
447 	 * Mandatory locking needs to be done before ufs_lockfs_begin()
448 	 * and TRANS_BEGIN_[A]SYNC() calls since mandatory locks can sleep.
449 	 * Check for forced unmounts normally done in ufs_lockfs_begin().
450 	 */
451 	if ((ufsvfsp = ip->i_ufsvfs) == NULL) {
452 		error = EIO;
453 		goto out;
454 	}
455 	if (MANDLOCK(vp, ip->i_mode)) {
456 
457 		ASSERT(RW_WRITE_HELD(&ip->i_rwlock));
458 
459 		/*
460 		 * ufs_getattr ends up being called by chklock
461 		 */
462 		error = chklock(vp, FWRITE, uiop->uio_loffset,
463 		    uiop->uio_resid, uiop->uio_fmode, ct);
464 		if (error)
465 			goto out;
466 	}
467 
468 	/* i_rwlock can change in chklock */
469 	exclusive = rw_write_held(&ip->i_rwlock);
470 	rewriteflg = ufs_check_rewrite(ip, uiop, ioflag);
471 
472 	/*
473 	 * Check for fast-path special case of directio re-writes.
474 	 */
475 	if ((ip->i_flag & IDIRECTIO || ufsvfsp->vfs_forcedirectio) &&
476 	    !exclusive && rewriteflg) {
477 
478 		error = ufs_lockfs_begin(ufsvfsp, &ulp, ULOCKFS_WRITE_MASK);
479 		if (error)
480 			goto out;
481 
482 		rw_enter(&ip->i_contents, RW_READER);
483 		error = ufs_directio_write(ip, uiop, ioflag, 1, cr,
484 		    &directio_status);
485 		if (directio_status == DIRECTIO_SUCCESS) {
486 			uint_t i_flag_save;
487 
488 			if (start_resid != uiop->uio_resid)
489 				error = 0;
490 			/*
491 			 * Special treatment of access times for re-writes.
492 			 * If IMOD is not already set, then convert it
493 			 * to IMODACC for this operation. This defers
494 			 * entering a delta into the log until the inode
495 			 * is flushed. This mimics what is done for read
496 			 * operations and inode access time.
497 			 */
498 			mutex_enter(&ip->i_tlock);
499 			i_flag_save = ip->i_flag;
500 			ip->i_flag |= IUPD | ICHG;
501 			ip->i_seq++;
502 			ITIMES_NOLOCK(ip);
503 			if ((i_flag_save & IMOD) == 0) {
504 				ip->i_flag &= ~IMOD;
505 				ip->i_flag |= IMODACC;
506 			}
507 			mutex_exit(&ip->i_tlock);
508 			rw_exit(&ip->i_contents);
509 			if (ulp)
510 				ufs_lockfs_end(ulp);
511 			goto out;
512 		}
513 		rw_exit(&ip->i_contents);
514 		if (ulp)
515 			ufs_lockfs_end(ulp);
516 	}
517 
518 	if (!exclusive && !rw_tryupgrade(&ip->i_rwlock)) {
519 		rw_exit(&ip->i_rwlock);
520 		rw_enter(&ip->i_rwlock, RW_WRITER);
521 		/*
522 		 * Mandatory locking could have been enabled
523 		 * after dropping the i_rwlock.
524 		 */
525 		if (MANDLOCK(vp, ip->i_mode))
526 			goto retry_mandlock;
527 	}
528 
529 	error = ufs_lockfs_begin(ufsvfsp, &ulp, ULOCKFS_WRITE_MASK);
530 	if (error)
531 		goto out;
532 
533 	/*
534 	 * Amount of log space needed for this write
535 	 */
536 	if (!rewriteflg || !(ioflag & FDSYNC))
537 		TRANS_WRITE_RESV(ip, uiop, ulp, &resv, &resid);
538 
539 	/*
540 	 * Throttle writes.
541 	 */
542 	if (ufs_WRITES && (ip->i_writes > ufs_HW)) {
543 		mutex_enter(&ip->i_tlock);
544 		while (ip->i_writes > ufs_HW) {
545 			ufs_throttles++;
546 			cv_wait(&ip->i_wrcv, &ip->i_tlock);
547 		}
548 		mutex_exit(&ip->i_tlock);
549 	}
550 
551 	/*
552 	 * Enter Transaction
553 	 *
554 	 * If the write is a rewrite there is no need to open a transaction
555 	 * if the FDSYNC flag is set and not the FSYNC.  In this case just
556 	 * set the IMODACC flag to modify do the update at a later time
557 	 * thus avoiding the overhead of the logging transaction that is
558 	 * not required.
559 	 */
560 	if (ioflag & (FSYNC|FDSYNC)) {
561 		if (ulp) {
562 			if (rewriteflg) {
563 				uint_t i_flag_save;
564 
565 				rw_enter(&ip->i_contents, RW_READER);
566 				mutex_enter(&ip->i_tlock);
567 				i_flag_save = ip->i_flag;
568 				ip->i_flag |= IUPD | ICHG;
569 				ip->i_seq++;
570 				ITIMES_NOLOCK(ip);
571 				if ((i_flag_save & IMOD) == 0) {
572 					ip->i_flag &= ~IMOD;
573 					ip->i_flag |= IMODACC;
574 				}
575 				mutex_exit(&ip->i_tlock);
576 				rw_exit(&ip->i_contents);
577 			} else {
578 				int terr = 0;
579 				TRANS_BEGIN_SYNC(ufsvfsp, TOP_WRITE_SYNC, resv,
580 				    terr);
581 				ASSERT(!terr);
582 			}
583 		}
584 	} else {
585 		if (ulp)
586 			TRANS_BEGIN_ASYNC(ufsvfsp, TOP_WRITE, resv);
587 	}
588 
589 	/*
590 	 * Write the file
591 	 */
592 	rw_enter(&ufsvfsp->vfs_dqrwlock, RW_READER);
593 	rw_enter(&ip->i_contents, RW_WRITER);
594 	if ((ioflag & FAPPEND) != 0 && (ip->i_mode & IFMT) == IFREG) {
595 		/*
596 		 * In append mode start at end of file.
597 		 */
598 		uiop->uio_loffset = ip->i_size;
599 	}
600 
601 	/*
602 	 * Mild optimisation, don't call ufs_trans_write() unless we have to
603 	 * Also, suppress file system full messages if we will retry.
604 	 */
605 	if (retry)
606 		ip->i_flag |= IQUIET;
607 	if (resid) {
608 		TRANS_WRITE(ip, uiop, ioflag, error, ulp, cr, resv, resid);
609 	} else {
610 		error = wrip(ip, uiop, ioflag, cr);
611 	}
612 	ip->i_flag &= ~IQUIET;
613 
614 	rw_exit(&ip->i_contents);
615 	rw_exit(&ufsvfsp->vfs_dqrwlock);
616 
617 	/*
618 	 * Leave Transaction
619 	 */
620 	if (ulp) {
621 		if (ioflag & (FSYNC|FDSYNC)) {
622 			if (!rewriteflg) {
623 				int terr = 0;
624 
625 				TRANS_END_SYNC(ufsvfsp, terr, TOP_WRITE_SYNC,
626 				    resv);
627 				if (error == 0)
628 					error = terr;
629 			}
630 		} else {
631 			TRANS_END_ASYNC(ufsvfsp, TOP_WRITE, resv);
632 		}
633 		ufs_lockfs_end(ulp);
634 	}
635 out:
636 	if ((error == ENOSPC) && retry && TRANS_ISTRANS(ufsvfsp)) {
637 		/*
638 		 * Any blocks tied up in pending deletes?
639 		 */
640 		ufs_delete_drain_wait(ufsvfsp, 1);
641 		retry = 0;
642 		goto retry_mandlock;
643 	}
644 
645 	if (error == ENOSPC && (start_resid != uiop->uio_resid))
646 		error = 0;
647 
648 	return (error);
649 }
650 
651 /*
652  * Don't cache write blocks to files with the sticky bit set.
653  * Used to keep swap files from blowing the page cache on a server.
654  */
655 int stickyhack = 1;
656 
657 /*
658  * Free behind hacks.  The pager is busted.
659  * XXX - need to pass the information down to writedone() in a flag like B_SEQ
660  * or B_FREE_IF_TIGHT_ON_MEMORY.
661  */
662 int	freebehind = 1;
663 int	smallfile = 0;
664 u_offset_t smallfile64 = 32 * 1024;
665 
666 /*
667  * While we should, in most cases, cache the pages for write, we
668  * may also want to cache the pages for read as long as they are
669  * frequently re-usable.
670  *
671  * If cache_read_ahead = 1, the pages for read will go to the tail
672  * of the cache list when they are released, otherwise go to the head.
673  */
674 int	cache_read_ahead = 0;
675 
676 /*
677  * Freebehind exists  so that as we read  large files  sequentially we
678  * don't consume most of memory with pages  from a few files. It takes
679  * longer to re-read from disk multiple small files as it does reading
680  * one large one sequentially.  As system  memory grows customers need
681  * to retain bigger chunks   of files in  memory.   The advent of  the
682  * cachelist opens up of the possibility freeing pages  to the head or
683  * tail of the list.
684  *
685  * Not freeing a page is a bet that the page will be read again before
686  * it's segmap slot is needed for something else. If we loose the bet,
687  * it means some  other thread is  burdened with the  page free we did
688  * not do. If we win we save a free and reclaim.
689  *
690  * Freeing it at the tail  vs the head of cachelist  is a bet that the
691  * page will survive until the next  read.  It's also saying that this
692  * page is more likely to  be re-used than a  page freed some time ago
693  * and never reclaimed.
694  *
695  * Freebehind maintains a  range of  file offset [smallfile1; smallfile2]
696  *
697  *            0 < offset < smallfile1 : pages are not freed.
698  *   smallfile1 < offset < smallfile2 : pages freed to tail of cachelist.
699  *   smallfile2 < offset              : pages freed to head of cachelist.
700  *
701  * The range  is  computed  at most  once  per second  and  depends on
702  * freemem  and  ncpus_online.  Both parameters  are   bounded to be
703  * >= smallfile && >= smallfile64.
704  *
705  * smallfile1 = (free memory / ncpu) / 1000
706  * smallfile2 = (free memory / ncpu) / 10
707  *
708  * A few examples values:
709  *
710  *       Free Mem (in Bytes) [smallfile1; smallfile2]  [smallfile1; smallfile2]
711  *                                 ncpus_online = 4          ncpus_online = 64
712  *       ------------------  -----------------------   -----------------------
713  *             1G                   [256K;  25M]               [32K; 1.5M]
714  *            10G                   [2.5M; 250M]              [156K; 15M]
715  *           100G                    [25M; 2.5G]              [1.5M; 150M]
716  *
717  */
718 
719 #define	SMALLFILE1_D 1000
720 #define	SMALLFILE2_D 10
721 static u_offset_t smallfile1 = 32 * 1024;
722 static u_offset_t smallfile2 = 32 * 1024;
723 static clock_t smallfile_update = 0; /* lbolt value of when to recompute */
724 uint_t smallfile1_d = SMALLFILE1_D;
725 uint_t smallfile2_d = SMALLFILE2_D;
726 
727 /*
728  * wrip does the real work of write requests for ufs.
729  */
730 int
731 wrip(struct inode *ip, struct uio *uio, int ioflag, struct cred *cr)
732 {
733 	rlim64_t limit = uio->uio_llimit;
734 	u_offset_t off;
735 	u_offset_t old_i_size;
736 	struct fs *fs;
737 	struct vnode *vp;
738 	struct ufsvfs *ufsvfsp;
739 	caddr_t base;
740 	long start_resid = uio->uio_resid;	/* save starting resid */
741 	long premove_resid;			/* resid before uiomove() */
742 	uint_t flags;
743 	int newpage;
744 	int iupdat_flag, directio_status;
745 	int n, on, mapon;
746 	int error, pagecreate;
747 	int do_dqrwlock;		/* drop/reacquire vfs_dqrwlock */
748 	int32_t	iblocks;
749 	int	new_iblocks;
750 
751 	/*
752 	 * ip->i_size is incremented before the uiomove
753 	 * is done on a write.  If the move fails (bad user
754 	 * address) reset ip->i_size.
755 	 * The better way would be to increment ip->i_size
756 	 * only if the uiomove succeeds.
757 	 */
758 	int i_size_changed = 0;
759 	o_mode_t type;
760 	int i_seq_needed = 0;
761 
762 	vp = ITOV(ip);
763 
764 	/*
765 	 * check for forced unmount - should not happen as
766 	 * the request passed the lockfs checks.
767 	 */
768 	if ((ufsvfsp = ip->i_ufsvfs) == NULL)
769 		return (EIO);
770 
771 	fs = ip->i_fs;
772 
773 	ASSERT(RW_WRITE_HELD(&ip->i_contents));
774 
775 	/* check for valid filetype */
776 	type = ip->i_mode & IFMT;
777 	if ((type != IFREG) && (type != IFDIR) && (type != IFATTRDIR) &&
778 	    (type != IFLNK) && (type != IFSHAD)) {
779 		return (EIO);
780 	}
781 
782 	/*
783 	 * the actual limit of UFS file size
784 	 * is UFS_MAXOFFSET_T
785 	 */
786 	if (limit == RLIM64_INFINITY || limit > MAXOFFSET_T)
787 		limit = MAXOFFSET_T;
788 
789 	if (uio->uio_loffset >= limit) {
790 		proc_t *p = ttoproc(curthread);
791 
792 		mutex_enter(&p->p_lock);
793 		(void) rctl_action(rctlproc_legacy[RLIMIT_FSIZE], p->p_rctls,
794 		    p, RCA_UNSAFE_SIGINFO);
795 		mutex_exit(&p->p_lock);
796 		return (EFBIG);
797 	}
798 
799 	/*
800 	 * if largefiles are disallowed, the limit is
801 	 * the pre-largefiles value of 2GB
802 	 */
803 	if (ufsvfsp->vfs_lfflags & UFS_LARGEFILES)
804 		limit = MIN(UFS_MAXOFFSET_T, limit);
805 	else
806 		limit = MIN(MAXOFF32_T, limit);
807 
808 	if (uio->uio_loffset < (offset_t)0) {
809 		return (EINVAL);
810 	}
811 	if (uio->uio_resid == 0) {
812 		return (0);
813 	}
814 
815 	if (uio->uio_loffset >= limit)
816 		return (EFBIG);
817 
818 	ip->i_flag |= INOACC;	/* don't update ref time in getpage */
819 
820 	if (ioflag & (FSYNC|FDSYNC)) {
821 		ip->i_flag |= ISYNC;
822 		iupdat_flag = 1;
823 	}
824 	/*
825 	 * Try to go direct
826 	 */
827 	if (ip->i_flag & IDIRECTIO || ufsvfsp->vfs_forcedirectio) {
828 		uio->uio_llimit = limit;
829 		error = ufs_directio_write(ip, uio, ioflag, 0, cr,
830 		    &directio_status);
831 		/*
832 		 * If ufs_directio wrote to the file or set the flags,
833 		 * we need to update i_seq, but it may be deferred.
834 		 */
835 		if (start_resid != uio->uio_resid ||
836 		    (ip->i_flag & (ICHG|IUPD))) {
837 			i_seq_needed = 1;
838 			ip->i_flag |= ISEQ;
839 		}
840 		if (directio_status == DIRECTIO_SUCCESS)
841 			goto out;
842 	}
843 
844 	/*
845 	 * Behavior with respect to dropping/reacquiring vfs_dqrwlock:
846 	 *
847 	 * o shadow inodes: vfs_dqrwlock is not held at all
848 	 * o quota updates: vfs_dqrwlock is read or write held
849 	 * o other updates: vfs_dqrwlock is read held
850 	 *
851 	 * The first case is the only one where we do not hold
852 	 * vfs_dqrwlock at all while entering wrip().
853 	 * We must make sure not to downgrade/drop vfs_dqrwlock if we
854 	 * have it as writer, i.e. if we are updating the quota inode.
855 	 * There is no potential deadlock scenario in this case as
856 	 * ufs_getpage() takes care of this and avoids reacquiring
857 	 * vfs_dqrwlock in that case.
858 	 *
859 	 * This check is done here since the above conditions do not change
860 	 * and we possibly loop below, so save a few cycles.
861 	 */
862 	if ((type == IFSHAD) ||
863 	    (rw_owner(&ufsvfsp->vfs_dqrwlock) == curthread)) {
864 		do_dqrwlock = 0;
865 	} else {
866 		do_dqrwlock = 1;
867 	}
868 
869 	/*
870 	 * Large Files: We cast MAXBMASK to offset_t
871 	 * inorder to mask out the higher bits. Since offset_t
872 	 * is a signed value, the high order bit set in MAXBMASK
873 	 * value makes it do the right thing by having all bits 1
874 	 * in the higher word. May be removed for _SOLARIS64_.
875 	 */
876 
877 	fs = ip->i_fs;
878 	do {
879 		u_offset_t uoff = uio->uio_loffset;
880 		off = uoff & (offset_t)MAXBMASK;
881 		mapon = (int)(uoff & (offset_t)MAXBOFFSET);
882 		on = (int)blkoff(fs, uoff);
883 		n = (int)MIN(fs->fs_bsize - on, uio->uio_resid);
884 		new_iblocks = 1;
885 
886 		if (type == IFREG && uoff + n >= limit) {
887 			if (uoff >= limit) {
888 				error = EFBIG;
889 				goto out;
890 			}
891 			/*
892 			 * since uoff + n >= limit,
893 			 * therefore n >= limit - uoff, and n is an int
894 			 * so it is safe to cast it to an int
895 			 */
896 			n = (int)(limit - (rlim64_t)uoff);
897 		}
898 		if (uoff + n > ip->i_size) {
899 			/*
900 			 * We are extending the length of the file.
901 			 * bmap is used so that we are sure that
902 			 * if we need to allocate new blocks, that it
903 			 * is done here before we up the file size.
904 			 */
905 			error = bmap_write(ip, uoff, (int)(on + n),
906 			    mapon == 0, NULL, cr);
907 			/*
908 			 * bmap_write never drops i_contents so if
909 			 * the flags are set it changed the file.
910 			 */
911 			if (ip->i_flag & (ICHG|IUPD)) {
912 				i_seq_needed = 1;
913 				ip->i_flag |= ISEQ;
914 			}
915 			if (error)
916 				break;
917 			/*
918 			 * There is a window of vulnerability here.
919 			 * The sequence of operations: allocate file
920 			 * system blocks, uiomove the data into pages,
921 			 * and then update the size of the file in the
922 			 * inode, must happen atomically.  However, due
923 			 * to current locking constraints, this can not
924 			 * be done.
925 			 */
926 			ASSERT(ip->i_writer == NULL);
927 			ip->i_writer = curthread;
928 			i_size_changed = 1;
929 			/*
930 			 * If we are writing from the beginning of
931 			 * the mapping, we can just create the
932 			 * pages without having to read them.
933 			 */
934 			pagecreate = (mapon == 0);
935 		} else if (n == MAXBSIZE) {
936 			/*
937 			 * Going to do a whole mappings worth,
938 			 * so we can just create the pages w/o
939 			 * having to read them in.  But before
940 			 * we do that, we need to make sure any
941 			 * needed blocks are allocated first.
942 			 */
943 			iblocks = ip->i_blocks;
944 			error = bmap_write(ip, uoff, (int)(on + n),
945 			    BI_ALLOC_ONLY, NULL, cr);
946 			/*
947 			 * bmap_write never drops i_contents so if
948 			 * the flags are set it changed the file.
949 			 */
950 			if (ip->i_flag & (ICHG|IUPD)) {
951 				i_seq_needed = 1;
952 				ip->i_flag |= ISEQ;
953 			}
954 			if (error)
955 				break;
956 			pagecreate = 1;
957 			/*
958 			 * check if the new created page needed the
959 			 * allocation of new disk blocks.
960 			 */
961 			if (iblocks == ip->i_blocks)
962 				new_iblocks = 0; /* no new blocks allocated */
963 		} else {
964 			pagecreate = 0;
965 			/*
966 			 * In sync mode flush the indirect blocks which
967 			 * may have been allocated and not written on
968 			 * disk. In above cases bmap_write will allocate
969 			 * in sync mode.
970 			 */
971 			if (ioflag & (FSYNC|FDSYNC)) {
972 				error = ufs_indirblk_sync(ip, uoff);
973 				if (error)
974 					break;
975 			}
976 		}
977 
978 		/*
979 		 * At this point we can enter ufs_getpage() in one
980 		 * of two ways:
981 		 * 1) segmap_getmapflt() calls ufs_getpage() when the
982 		 *    forcefault parameter is true (pagecreate == 0)
983 		 * 2) uiomove() causes a page fault.
984 		 *
985 		 * We have to drop the contents lock to prevent the VM
986 		 * system from trying to reacquire it in ufs_getpage()
987 		 * should the uiomove cause a pagefault.
988 		 *
989 		 * We have to drop the reader vfs_dqrwlock here as well.
990 		 */
991 		rw_exit(&ip->i_contents);
992 		if (do_dqrwlock) {
993 			ASSERT(RW_LOCK_HELD(&ufsvfsp->vfs_dqrwlock));
994 			ASSERT(!(RW_WRITE_HELD(&ufsvfsp->vfs_dqrwlock)));
995 			rw_exit(&ufsvfsp->vfs_dqrwlock);
996 		}
997 
998 		newpage = 0;
999 		premove_resid = uio->uio_resid;
1000 		if (vpm_enable) {
1001 			/*
1002 			 * Copy data. If new pages are created, part of
1003 			 * the page that is not written will be initizliazed
1004 			 * with zeros.
1005 			 */
1006 			error = vpm_data_copy(vp, (off + mapon), (uint_t)n,
1007 			    uio, !pagecreate, &newpage, 0, S_WRITE);
1008 		} else {
1009 
1010 			base = segmap_getmapflt(segkmap, vp, (off + mapon),
1011 			    (uint_t)n, !pagecreate, S_WRITE);
1012 
1013 			/*
1014 			 * segmap_pagecreate() returns 1 if it calls
1015 			 * page_create_va() to allocate any pages.
1016 			 */
1017 
1018 			if (pagecreate)
1019 				newpage = segmap_pagecreate(segkmap, base,
1020 				    (size_t)n, 0);
1021 
1022 			error = uiomove(base + mapon, (long)n, UIO_WRITE, uio);
1023 		}
1024 
1025 		/*
1026 		 * If "newpage" is set, then a new page was created and it
1027 		 * does not contain valid data, so it needs to be initialized
1028 		 * at this point.
1029 		 * Otherwise the page contains old data, which was overwritten
1030 		 * partially or as a whole in uiomove.
1031 		 * If there is only one iovec structure within uio, then
1032 		 * on error uiomove will not be able to update uio->uio_loffset
1033 		 * and we would zero the whole page here!
1034 		 *
1035 		 * If uiomove fails because of an error, the old valid data
1036 		 * is kept instead of filling the rest of the page with zero's.
1037 		 */
1038 		if (!vpm_enable && newpage &&
1039 		    uio->uio_loffset < roundup(off + mapon + n, PAGESIZE)) {
1040 			/*
1041 			 * We created pages w/o initializing them completely,
1042 			 * thus we need to zero the part that wasn't set up.
1043 			 * This happens on most EOF write cases and if
1044 			 * we had some sort of error during the uiomove.
1045 			 */
1046 			int nzero, nmoved;
1047 
1048 			nmoved = (int)(uio->uio_loffset - (off + mapon));
1049 			ASSERT(nmoved >= 0 && nmoved <= n);
1050 			nzero = roundup(on + n, PAGESIZE) - nmoved;
1051 			ASSERT(nzero > 0 && mapon + nmoved + nzero <= MAXBSIZE);
1052 			(void) kzero(base + mapon + nmoved, (uint_t)nzero);
1053 		}
1054 
1055 		/*
1056 		 * Unlock the pages allocated by page_create_va()
1057 		 * in segmap_pagecreate()
1058 		 */
1059 		if (!vpm_enable && newpage)
1060 			segmap_pageunlock(segkmap, base, (size_t)n, S_WRITE);
1061 
1062 		/*
1063 		 * If the size of the file changed, then update the
1064 		 * size field in the inode now.  This can't be done
1065 		 * before the call to segmap_pageunlock or there is
1066 		 * a potential deadlock with callers to ufs_putpage().
1067 		 * They will be holding i_contents and trying to lock
1068 		 * a page, while this thread is holding a page locked
1069 		 * and trying to acquire i_contents.
1070 		 */
1071 		if (i_size_changed) {
1072 			rw_enter(&ip->i_contents, RW_WRITER);
1073 			old_i_size = ip->i_size;
1074 			UFS_SET_ISIZE(uoff + n, ip);
1075 			TRANS_INODE(ufsvfsp, ip);
1076 			/*
1077 			 * file has grown larger than 2GB. Set flag
1078 			 * in superblock to indicate this, if it
1079 			 * is not already set.
1080 			 */
1081 			if ((ip->i_size > MAXOFF32_T) &&
1082 			    !(fs->fs_flags & FSLARGEFILES)) {
1083 				ASSERT(ufsvfsp->vfs_lfflags & UFS_LARGEFILES);
1084 				mutex_enter(&ufsvfsp->vfs_lock);
1085 				fs->fs_flags |= FSLARGEFILES;
1086 				ufs_sbwrite(ufsvfsp);
1087 				mutex_exit(&ufsvfsp->vfs_lock);
1088 			}
1089 			mutex_enter(&ip->i_tlock);
1090 			ip->i_writer = NULL;
1091 			cv_broadcast(&ip->i_wrcv);
1092 			mutex_exit(&ip->i_tlock);
1093 			rw_exit(&ip->i_contents);
1094 		}
1095 
1096 		if (error) {
1097 			/*
1098 			 * If we failed on a write, we may have already
1099 			 * allocated file blocks as well as pages.  It's
1100 			 * hard to undo the block allocation, but we must
1101 			 * be sure to invalidate any pages that may have
1102 			 * been allocated.
1103 			 *
1104 			 * If the page was created without initialization
1105 			 * then we must check if it should be possible
1106 			 * to destroy the new page and to keep the old data
1107 			 * on the disk.
1108 			 *
1109 			 * It is possible to destroy the page without
1110 			 * having to write back its contents only when
1111 			 * - the size of the file keeps unchanged
1112 			 * - bmap_write() did not allocate new disk blocks
1113 			 *   it is possible to create big files using "seek" and
1114 			 *   write to the end of the file. A "write" to a
1115 			 *   position before the end of the file would not
1116 			 *   change the size of the file but it would allocate
1117 			 *   new disk blocks.
1118 			 * - uiomove intended to overwrite the whole page.
1119 			 * - a new page was created (newpage == 1).
1120 			 */
1121 
1122 			if (i_size_changed == 0 && new_iblocks == 0 &&
1123 			    newpage) {
1124 
1125 				/* unwind what uiomove eventually last did */
1126 				uio->uio_resid = premove_resid;
1127 
1128 				/*
1129 				 * destroy the page, do not write ambiguous
1130 				 * data to the disk.
1131 				 */
1132 				flags = SM_DESTROY;
1133 			} else {
1134 				/*
1135 				 * write the page back to the disk, if dirty,
1136 				 * and remove the page from the cache.
1137 				 */
1138 				flags = SM_INVAL;
1139 			}
1140 
1141 			if (vpm_enable) {
1142 				/*
1143 				 *  Flush pages.
1144 				 */
1145 				(void) vpm_sync_pages(vp, off, n, flags);
1146 			} else {
1147 				(void) segmap_release(segkmap, base, flags);
1148 			}
1149 		} else {
1150 			flags = 0;
1151 			/*
1152 			 * Force write back for synchronous write cases.
1153 			 */
1154 			if ((ioflag & (FSYNC|FDSYNC)) || type == IFDIR) {
1155 				/*
1156 				 * If the sticky bit is set but the
1157 				 * execute bit is not set, we do a
1158 				 * synchronous write back and free
1159 				 * the page when done.  We set up swap
1160 				 * files to be handled this way to
1161 				 * prevent servers from keeping around
1162 				 * the client's swap pages too long.
1163 				 * XXX - there ought to be a better way.
1164 				 */
1165 				if (IS_SWAPVP(vp)) {
1166 					flags = SM_WRITE | SM_FREE |
1167 					    SM_DONTNEED;
1168 					iupdat_flag = 0;
1169 				} else {
1170 					flags = SM_WRITE;
1171 				}
1172 			} else if (n + on == MAXBSIZE || IS_SWAPVP(vp)) {
1173 				/*
1174 				 * Have written a whole block.
1175 				 * Start an asynchronous write and
1176 				 * mark the buffer to indicate that
1177 				 * it won't be needed again soon.
1178 				 */
1179 				flags = SM_WRITE | SM_ASYNC | SM_DONTNEED;
1180 			}
1181 			if (vpm_enable) {
1182 				/*
1183 				 * Flush pages.
1184 				 */
1185 				error = vpm_sync_pages(vp, off, n, flags);
1186 			} else {
1187 				error = segmap_release(segkmap, base, flags);
1188 			}
1189 			/*
1190 			 * If the operation failed and is synchronous,
1191 			 * then we need to unwind what uiomove() last
1192 			 * did so we can potentially return an error to
1193 			 * the caller.  If this write operation was
1194 			 * done in two pieces and the first succeeded,
1195 			 * then we won't return an error for the second
1196 			 * piece that failed.  However, we only want to
1197 			 * return a resid value that reflects what was
1198 			 * really done.
1199 			 *
1200 			 * Failures for non-synchronous operations can
1201 			 * be ignored since the page subsystem will
1202 			 * retry the operation until it succeeds or the
1203 			 * file system is unmounted.
1204 			 */
1205 			if (error) {
1206 				if ((ioflag & (FSYNC | FDSYNC)) ||
1207 				    type == IFDIR) {
1208 					uio->uio_resid = premove_resid;
1209 				} else {
1210 					error = 0;
1211 				}
1212 			}
1213 		}
1214 
1215 		/*
1216 		 * Re-acquire contents lock.
1217 		 * If it was dropped, reacquire reader vfs_dqrwlock as well.
1218 		 */
1219 		if (do_dqrwlock)
1220 			rw_enter(&ufsvfsp->vfs_dqrwlock, RW_READER);
1221 		rw_enter(&ip->i_contents, RW_WRITER);
1222 
1223 		/*
1224 		 * If the uiomove() failed or if a synchronous
1225 		 * page push failed, fix up i_size.
1226 		 */
1227 		if (error) {
1228 			if (i_size_changed) {
1229 				/*
1230 				 * The uiomove failed, and we
1231 				 * allocated blocks,so get rid
1232 				 * of them.
1233 				 */
1234 				(void) ufs_itrunc(ip, old_i_size, 0, cr);
1235 			}
1236 		} else {
1237 			/*
1238 			 * XXX - Can this be out of the loop?
1239 			 */
1240 			ip->i_flag |= IUPD | ICHG;
1241 			/*
1242 			 * Only do one increase of i_seq for multiple
1243 			 * pieces.  Because we drop locks, record
1244 			 * the fact that we changed the timestamp and
1245 			 * are deferring the increase in case another thread
1246 			 * pushes our timestamp update.
1247 			 */
1248 			i_seq_needed = 1;
1249 			ip->i_flag |= ISEQ;
1250 			if (i_size_changed)
1251 				ip->i_flag |= IATTCHG;
1252 			if ((ip->i_mode & (IEXEC | (IEXEC >> 3) |
1253 			    (IEXEC >> 6))) != 0 &&
1254 			    (ip->i_mode & (ISUID | ISGID)) != 0 &&
1255 			    secpolicy_vnode_setid_retain(cr,
1256 			    (ip->i_mode & ISUID) != 0 && ip->i_uid == 0) != 0) {
1257 				/*
1258 				 * Clear Set-UID & Set-GID bits on
1259 				 * successful write if not privileged
1260 				 * and at least one of the execute bits
1261 				 * is set.  If we always clear Set-GID,
1262 				 * mandatory file and record locking is
1263 				 * unuseable.
1264 				 */
1265 				ip->i_mode &= ~(ISUID | ISGID);
1266 			}
1267 		}
1268 		/*
1269 		 * In the case the FDSYNC flag is set and this is a
1270 		 * "rewrite" we won't log a delta.
1271 		 * The FSYNC flag overrides all cases.
1272 		 */
1273 		if (!ufs_check_rewrite(ip, uio, ioflag) || !(ioflag & FDSYNC)) {
1274 			TRANS_INODE(ufsvfsp, ip);
1275 		}
1276 	} while (error == 0 && uio->uio_resid > 0 && n != 0);
1277 
1278 out:
1279 	/*
1280 	 * Make sure i_seq is increased at least once per write
1281 	 */
1282 	if (i_seq_needed) {
1283 		ip->i_seq++;
1284 		ip->i_flag &= ~ISEQ;	/* no longer deferred */
1285 	}
1286 
1287 	/*
1288 	 * Inode is updated according to this table -
1289 	 *
1290 	 *   FSYNC	  FDSYNC(posix.4)
1291 	 *   --------------------------
1292 	 *   always@	  IATTCHG|IBDWRITE
1293 	 *
1294 	 * @ - 	If we are doing synchronous write the only time we should
1295 	 *	not be sync'ing the ip here is if we have the stickyhack
1296 	 *	activated, the file is marked with the sticky bit and
1297 	 *	no exec bit, the file length has not been changed and
1298 	 *	no new blocks have been allocated during this write.
1299 	 */
1300 
1301 	if ((ip->i_flag & ISYNC) != 0) {
1302 		/*
1303 		 * we have eliminated nosync
1304 		 */
1305 		if ((ip->i_flag & (IATTCHG|IBDWRITE)) ||
1306 		    ((ioflag & FSYNC) && iupdat_flag)) {
1307 			ufs_iupdat(ip, 1);
1308 		}
1309 	}
1310 
1311 	/*
1312 	 * If we've already done a partial-write, terminate
1313 	 * the write but return no error unless the error is ENOSPC
1314 	 * because the caller can detect this and free resources and
1315 	 * try again.
1316 	 */
1317 	if ((start_resid != uio->uio_resid) && (error != ENOSPC))
1318 		error = 0;
1319 
1320 	ip->i_flag &= ~(INOACC | ISYNC);
1321 	ITIMES_NOLOCK(ip);
1322 	return (error);
1323 }
1324 
1325 /*
1326  * rdip does the real work of read requests for ufs.
1327  */
1328 int
1329 rdip(struct inode *ip, struct uio *uio, int ioflag, cred_t *cr)
1330 {
1331 	u_offset_t off;
1332 	caddr_t base;
1333 	struct fs *fs;
1334 	struct ufsvfs *ufsvfsp;
1335 	struct vnode *vp;
1336 	long oresid = uio->uio_resid;
1337 	u_offset_t n, on, mapon;
1338 	int error = 0;
1339 	int doupdate = 1;
1340 	uint_t flags;
1341 	int dofree, directio_status;
1342 	krw_t rwtype;
1343 	o_mode_t type;
1344 
1345 	vp = ITOV(ip);
1346 
1347 	ASSERT(RW_LOCK_HELD(&ip->i_contents));
1348 
1349 	ufsvfsp = ip->i_ufsvfs;
1350 
1351 	if (ufsvfsp == NULL)
1352 		return (EIO);
1353 
1354 	fs = ufsvfsp->vfs_fs;
1355 
1356 	/* check for valid filetype */
1357 	type = ip->i_mode & IFMT;
1358 	if ((type != IFREG) && (type != IFDIR) && (type != IFATTRDIR) &&
1359 	    (type != IFLNK) && (type != IFSHAD)) {
1360 		return (EIO);
1361 	}
1362 
1363 	if (uio->uio_loffset > UFS_MAXOFFSET_T) {
1364 		error = 0;
1365 		goto out;
1366 	}
1367 	if (uio->uio_loffset < (offset_t)0) {
1368 		return (EINVAL);
1369 	}
1370 	if (uio->uio_resid == 0) {
1371 		return (0);
1372 	}
1373 
1374 	if (!ULOCKFS_IS_NOIACC(ITOUL(ip)) && (fs->fs_ronly == 0) &&
1375 	    (!ufsvfsp->vfs_noatime)) {
1376 		mutex_enter(&ip->i_tlock);
1377 		ip->i_flag |= IACC;
1378 		mutex_exit(&ip->i_tlock);
1379 	}
1380 	/*
1381 	 * Try to go direct
1382 	 */
1383 	if (ip->i_flag & IDIRECTIO || ufsvfsp->vfs_forcedirectio) {
1384 		error = ufs_directio_read(ip, uio, cr, &directio_status);
1385 		if (directio_status == DIRECTIO_SUCCESS)
1386 			goto out;
1387 	}
1388 
1389 	rwtype = (rw_write_held(&ip->i_contents)?RW_WRITER:RW_READER);
1390 
1391 	do {
1392 		offset_t diff;
1393 		u_offset_t uoff = uio->uio_loffset;
1394 		off = uoff & (offset_t)MAXBMASK;
1395 		mapon = (u_offset_t)(uoff & (offset_t)MAXBOFFSET);
1396 		on = (u_offset_t)blkoff(fs, uoff);
1397 		n = MIN((u_offset_t)fs->fs_bsize - on,
1398 		    (u_offset_t)uio->uio_resid);
1399 
1400 		diff = ip->i_size - uoff;
1401 
1402 		if (diff <= (offset_t)0) {
1403 			error = 0;
1404 			goto out;
1405 		}
1406 		if (diff < (offset_t)n)
1407 			n = (int)diff;
1408 
1409 		/*
1410 		 * We update smallfile2 and smallfile1 at most every second.
1411 		 */
1412 		if (lbolt >= smallfile_update) {
1413 			uint64_t percpufreeb;
1414 			if (smallfile1_d == 0) smallfile1_d = SMALLFILE1_D;
1415 			if (smallfile2_d == 0) smallfile2_d = SMALLFILE2_D;
1416 			percpufreeb = ptob((uint64_t)freemem) / ncpus_online;
1417 			smallfile1 = percpufreeb / smallfile1_d;
1418 			smallfile2 = percpufreeb / smallfile2_d;
1419 			smallfile1 = MAX(smallfile1, smallfile);
1420 			smallfile1 = MAX(smallfile1, smallfile64);
1421 			smallfile2 = MAX(smallfile1, smallfile2);
1422 			smallfile_update = lbolt + hz;
1423 		}
1424 
1425 		dofree = freebehind &&
1426 		    ip->i_nextr == (off & PAGEMASK) && off > smallfile1;
1427 
1428 		/*
1429 		 * At this point we can enter ufs_getpage() in one of two
1430 		 * ways:
1431 		 * 1) segmap_getmapflt() calls ufs_getpage() when the
1432 		 *    forcefault parameter is true (value of 1 is passed)
1433 		 * 2) uiomove() causes a page fault.
1434 		 *
1435 		 * We cannot hold onto an i_contents reader lock without
1436 		 * risking deadlock in ufs_getpage() so drop a reader lock.
1437 		 * The ufs_getpage() dolock logic already allows for a
1438 		 * thread holding i_contents as writer to work properly
1439 		 * so we keep a writer lock.
1440 		 */
1441 		if (rwtype == RW_READER)
1442 			rw_exit(&ip->i_contents);
1443 
1444 		if (vpm_enable) {
1445 			/*
1446 			 * Copy data.
1447 			 */
1448 			error = vpm_data_copy(vp, (off + mapon), (uint_t)n,
1449 			    uio, 1, NULL, 0, S_READ);
1450 		} else {
1451 			base = segmap_getmapflt(segkmap, vp, (off + mapon),
1452 			    (uint_t)n, 1, S_READ);
1453 			error = uiomove(base + mapon, (long)n, UIO_READ, uio);
1454 		}
1455 
1456 		flags = 0;
1457 		if (!error) {
1458 			/*
1459 			 * If  reading sequential  we won't need  this
1460 			 * buffer again  soon.  For  offsets in  range
1461 			 * [smallfile1,  smallfile2] release the pages
1462 			 * at   the  tail  of the   cache list, larger
1463 			 * offsets are released at the head.
1464 			 */
1465 			if (dofree) {
1466 				flags = SM_FREE | SM_ASYNC;
1467 				if ((cache_read_ahead == 0) &&
1468 				    (off > smallfile2))
1469 					flags |=  SM_DONTNEED;
1470 			}
1471 			/*
1472 			 * In POSIX SYNC (FSYNC and FDSYNC) read mode,
1473 			 * we want to make sure that the page which has
1474 			 * been read, is written on disk if it is dirty.
1475 			 * And corresponding indirect blocks should also
1476 			 * be flushed out.
1477 			 */
1478 			if ((ioflag & FRSYNC) && (ioflag & (FSYNC|FDSYNC))) {
1479 				flags &= ~SM_ASYNC;
1480 				flags |= SM_WRITE;
1481 			}
1482 			if (vpm_enable) {
1483 				error = vpm_sync_pages(vp, off, n, flags);
1484 			} else {
1485 				error = segmap_release(segkmap, base, flags);
1486 			}
1487 		} else {
1488 			if (vpm_enable) {
1489 				(void) vpm_sync_pages(vp, off, n, flags);
1490 			} else {
1491 				(void) segmap_release(segkmap, base, flags);
1492 			}
1493 		}
1494 
1495 		if (rwtype == RW_READER)
1496 			rw_enter(&ip->i_contents, rwtype);
1497 	} while (error == 0 && uio->uio_resid > 0 && n != 0);
1498 out:
1499 	/*
1500 	 * Inode is updated according to this table if FRSYNC is set.
1501 	 *
1502 	 *   FSYNC	  FDSYNC(posix.4)
1503 	 *   --------------------------
1504 	 *   always	  IATTCHG|IBDWRITE
1505 	 */
1506 	/*
1507 	 * The inode is not updated if we're logging and the inode is a
1508 	 * directory with FRSYNC, FSYNC and FDSYNC flags set.
1509 	 */
1510 	if (ioflag & FRSYNC) {
1511 		if (TRANS_ISTRANS(ufsvfsp) && ((ip->i_mode & IFMT) == IFDIR)) {
1512 			doupdate = 0;
1513 		}
1514 		if (doupdate) {
1515 			if ((ioflag & FSYNC) ||
1516 			    ((ioflag & FDSYNC) &&
1517 			    (ip->i_flag & (IATTCHG|IBDWRITE)))) {
1518 				ufs_iupdat(ip, 1);
1519 			}
1520 		}
1521 	}
1522 	/*
1523 	 * If we've already done a partial read, terminate
1524 	 * the read but return no error.
1525 	 */
1526 	if (oresid != uio->uio_resid)
1527 		error = 0;
1528 	ITIMES(ip);
1529 
1530 	return (error);
1531 }
1532 
1533 /* ARGSUSED */
1534 static int
1535 ufs_ioctl(
1536 	struct vnode	*vp,
1537 	int		cmd,
1538 	intptr_t	arg,
1539 	int		flag,
1540 	struct cred	*cr,
1541 	int		*rvalp,
1542 	caller_context_t *ct)
1543 {
1544 	struct lockfs	lockfs, lockfs_out;
1545 	struct ufsvfs	*ufsvfsp = VTOI(vp)->i_ufsvfs;
1546 	char		*comment, *original_comment;
1547 	struct fs	*fs;
1548 	struct ulockfs	*ulp;
1549 	offset_t	off;
1550 	extern int	maxphys;
1551 	int		error;
1552 	int		issync;
1553 	int		trans_size;
1554 
1555 
1556 	/*
1557 	 * forcibly unmounted
1558 	 */
1559 	if (ufsvfsp == NULL || vp->v_vfsp == NULL ||
1560 	    vp->v_vfsp->vfs_flag & VFS_UNMOUNTED)
1561 		return (EIO);
1562 	fs = ufsvfsp->vfs_fs;
1563 
1564 	if (cmd == Q_QUOTACTL) {
1565 		error = ufs_lockfs_begin(ufsvfsp, &ulp, ULOCKFS_QUOTA_MASK);
1566 		if (error)
1567 			return (error);
1568 
1569 		if (ulp) {
1570 			TRANS_BEGIN_ASYNC(ufsvfsp, TOP_QUOTA,
1571 			    TOP_SETQUOTA_SIZE(fs));
1572 		}
1573 
1574 		error = quotactl(vp, arg, flag, cr);
1575 
1576 		if (ulp) {
1577 			TRANS_END_ASYNC(ufsvfsp, TOP_QUOTA,
1578 			    TOP_SETQUOTA_SIZE(fs));
1579 			ufs_lockfs_end(ulp);
1580 		}
1581 		return (error);
1582 	}
1583 
1584 	switch (cmd) {
1585 		case _FIOLFS:
1586 			/*
1587 			 * file system locking
1588 			 */
1589 			if (secpolicy_fs_config(cr, ufsvfsp->vfs_vfs) != 0)
1590 				return (EPERM);
1591 
1592 			if ((flag & DATAMODEL_MASK) == DATAMODEL_NATIVE) {
1593 				if (copyin((caddr_t)arg, &lockfs,
1594 				    sizeof (struct lockfs)))
1595 					return (EFAULT);
1596 			}
1597 #ifdef _SYSCALL32_IMPL
1598 			else {
1599 				struct lockfs32	lockfs32;
1600 				/* Translate ILP32 lockfs to LP64 lockfs */
1601 				if (copyin((caddr_t)arg, &lockfs32,
1602 				    sizeof (struct lockfs32)))
1603 					return (EFAULT);
1604 				lockfs.lf_lock = (ulong_t)lockfs32.lf_lock;
1605 				lockfs.lf_flags = (ulong_t)lockfs32.lf_flags;
1606 				lockfs.lf_key = (ulong_t)lockfs32.lf_key;
1607 				lockfs.lf_comlen = (ulong_t)lockfs32.lf_comlen;
1608 				lockfs.lf_comment =
1609 				    (caddr_t)(uintptr_t)lockfs32.lf_comment;
1610 			}
1611 #endif /* _SYSCALL32_IMPL */
1612 
1613 			if (lockfs.lf_comlen) {
1614 				if (lockfs.lf_comlen > LOCKFS_MAXCOMMENTLEN)
1615 					return (ENAMETOOLONG);
1616 				comment =
1617 				    kmem_alloc(lockfs.lf_comlen, KM_SLEEP);
1618 				if (copyin(lockfs.lf_comment, comment,
1619 				    lockfs.lf_comlen)) {
1620 					kmem_free(comment, lockfs.lf_comlen);
1621 					return (EFAULT);
1622 				}
1623 				original_comment = lockfs.lf_comment;
1624 				lockfs.lf_comment = comment;
1625 			}
1626 			if ((error = ufs_fiolfs(vp, &lockfs, 0)) == 0) {
1627 				lockfs.lf_comment = original_comment;
1628 
1629 				if ((flag & DATAMODEL_MASK) ==
1630 				    DATAMODEL_NATIVE) {
1631 					(void) copyout(&lockfs, (caddr_t)arg,
1632 					    sizeof (struct lockfs));
1633 				}
1634 #ifdef _SYSCALL32_IMPL
1635 				else {
1636 					struct lockfs32	lockfs32;
1637 					/* Translate LP64 to ILP32 lockfs */
1638 					lockfs32.lf_lock =
1639 					    (uint32_t)lockfs.lf_lock;
1640 					lockfs32.lf_flags =
1641 					    (uint32_t)lockfs.lf_flags;
1642 					lockfs32.lf_key =
1643 					    (uint32_t)lockfs.lf_key;
1644 					lockfs32.lf_comlen =
1645 					    (uint32_t)lockfs.lf_comlen;
1646 					lockfs32.lf_comment =
1647 					    (uint32_t)(uintptr_t)
1648 					    lockfs.lf_comment;
1649 					(void) copyout(&lockfs32, (caddr_t)arg,
1650 					    sizeof (struct lockfs32));
1651 				}
1652 #endif /* _SYSCALL32_IMPL */
1653 
1654 			} else {
1655 				if (lockfs.lf_comlen)
1656 					kmem_free(comment, lockfs.lf_comlen);
1657 			}
1658 			return (error);
1659 
1660 		case _FIOLFSS:
1661 			/*
1662 			 * get file system locking status
1663 			 */
1664 
1665 			if ((flag & DATAMODEL_MASK) == DATAMODEL_NATIVE) {
1666 				if (copyin((caddr_t)arg, &lockfs,
1667 				    sizeof (struct lockfs)))
1668 					return (EFAULT);
1669 			}
1670 #ifdef _SYSCALL32_IMPL
1671 			else {
1672 				struct lockfs32	lockfs32;
1673 				/* Translate ILP32 lockfs to LP64 lockfs */
1674 				if (copyin((caddr_t)arg, &lockfs32,
1675 				    sizeof (struct lockfs32)))
1676 					return (EFAULT);
1677 				lockfs.lf_lock = (ulong_t)lockfs32.lf_lock;
1678 				lockfs.lf_flags = (ulong_t)lockfs32.lf_flags;
1679 				lockfs.lf_key = (ulong_t)lockfs32.lf_key;
1680 				lockfs.lf_comlen = (ulong_t)lockfs32.lf_comlen;
1681 				lockfs.lf_comment =
1682 				    (caddr_t)(uintptr_t)lockfs32.lf_comment;
1683 			}
1684 #endif /* _SYSCALL32_IMPL */
1685 
1686 			if (error =  ufs_fiolfss(vp, &lockfs_out))
1687 				return (error);
1688 			lockfs.lf_lock = lockfs_out.lf_lock;
1689 			lockfs.lf_key = lockfs_out.lf_key;
1690 			lockfs.lf_flags = lockfs_out.lf_flags;
1691 			lockfs.lf_comlen = MIN(lockfs.lf_comlen,
1692 			    lockfs_out.lf_comlen);
1693 
1694 			if ((flag & DATAMODEL_MASK) == DATAMODEL_NATIVE) {
1695 				if (copyout(&lockfs, (caddr_t)arg,
1696 				    sizeof (struct lockfs)))
1697 					return (EFAULT);
1698 			}
1699 #ifdef _SYSCALL32_IMPL
1700 			else {
1701 				/* Translate LP64 to ILP32 lockfs */
1702 				struct lockfs32	lockfs32;
1703 				lockfs32.lf_lock = (uint32_t)lockfs.lf_lock;
1704 				lockfs32.lf_flags = (uint32_t)lockfs.lf_flags;
1705 				lockfs32.lf_key = (uint32_t)lockfs.lf_key;
1706 				lockfs32.lf_comlen = (uint32_t)lockfs.lf_comlen;
1707 				lockfs32.lf_comment =
1708 				    (uint32_t)(uintptr_t)lockfs.lf_comment;
1709 				if (copyout(&lockfs32, (caddr_t)arg,
1710 				    sizeof (struct lockfs32)))
1711 					return (EFAULT);
1712 			}
1713 #endif /* _SYSCALL32_IMPL */
1714 
1715 			if (lockfs.lf_comlen &&
1716 			    lockfs.lf_comment && lockfs_out.lf_comment)
1717 				if (copyout(lockfs_out.lf_comment,
1718 				    lockfs.lf_comment, lockfs.lf_comlen))
1719 					return (EFAULT);
1720 			return (0);
1721 
1722 		case _FIOSATIME:
1723 			/*
1724 			 * set access time
1725 			 */
1726 
1727 			/*
1728 			 * if mounted w/o atime, return quietly.
1729 			 * I briefly thought about returning ENOSYS, but
1730 			 * figured that most apps would consider this fatal
1731 			 * but the idea is to make this as seamless as poss.
1732 			 */
1733 			if (ufsvfsp->vfs_noatime)
1734 				return (0);
1735 
1736 			error = ufs_lockfs_begin(ufsvfsp, &ulp,
1737 			    ULOCKFS_SETATTR_MASK);
1738 			if (error)
1739 				return (error);
1740 
1741 			if (ulp) {
1742 				trans_size = (int)TOP_SETATTR_SIZE(VTOI(vp));
1743 				TRANS_BEGIN_CSYNC(ufsvfsp, issync,
1744 				    TOP_SETATTR, trans_size);
1745 			}
1746 
1747 			error = ufs_fiosatime(vp, (struct timeval *)arg,
1748 			    flag, cr);
1749 
1750 			if (ulp) {
1751 				TRANS_END_CSYNC(ufsvfsp, error, issync,
1752 				    TOP_SETATTR, trans_size);
1753 				ufs_lockfs_end(ulp);
1754 			}
1755 			return (error);
1756 
1757 		case _FIOSDIO:
1758 			/*
1759 			 * set delayed-io
1760 			 */
1761 			return (ufs_fiosdio(vp, (uint_t *)arg, flag, cr));
1762 
1763 		case _FIOGDIO:
1764 			/*
1765 			 * get delayed-io
1766 			 */
1767 			return (ufs_fiogdio(vp, (uint_t *)arg, flag, cr));
1768 
1769 		case _FIOIO:
1770 			/*
1771 			 * inode open
1772 			 */
1773 			error = ufs_lockfs_begin(ufsvfsp, &ulp,
1774 			    ULOCKFS_VGET_MASK);
1775 			if (error)
1776 				return (error);
1777 
1778 			error = ufs_fioio(vp, (struct fioio *)arg, flag, cr);
1779 
1780 			if (ulp) {
1781 				ufs_lockfs_end(ulp);
1782 			}
1783 			return (error);
1784 
1785 		case _FIOFFS:
1786 			/*
1787 			 * file system flush (push w/invalidate)
1788 			 */
1789 			if ((caddr_t)arg != NULL)
1790 				return (EINVAL);
1791 			return (ufs_fioffs(vp, NULL, cr));
1792 
1793 		case _FIOISBUSY:
1794 			/*
1795 			 * Contract-private interface for Legato
1796 			 * Purge this vnode from the DNLC and decide
1797 			 * if this vnode is busy (*arg == 1) or not
1798 			 * (*arg == 0)
1799 			 */
1800 			if (secpolicy_fs_config(cr, ufsvfsp->vfs_vfs) != 0)
1801 				return (EPERM);
1802 			error = ufs_fioisbusy(vp, (int *)arg, cr);
1803 			return (error);
1804 
1805 		case _FIODIRECTIO:
1806 			return (ufs_fiodirectio(vp, (int)arg, cr));
1807 
1808 		case _FIOTUNE:
1809 			/*
1810 			 * Tune the file system (aka setting fs attributes)
1811 			 */
1812 			error = ufs_lockfs_begin(ufsvfsp, &ulp,
1813 			    ULOCKFS_SETATTR_MASK);
1814 			if (error)
1815 				return (error);
1816 
1817 			error = ufs_fiotune(vp, (struct fiotune *)arg, cr);
1818 
1819 			if (ulp)
1820 				ufs_lockfs_end(ulp);
1821 			return (error);
1822 
1823 		case _FIOLOGENABLE:
1824 			if (secpolicy_fs_config(cr, ufsvfsp->vfs_vfs) != 0)
1825 				return (EPERM);
1826 			return (ufs_fiologenable(vp, (void *)arg, cr, flag));
1827 
1828 		case _FIOLOGDISABLE:
1829 			if (secpolicy_fs_config(cr, ufsvfsp->vfs_vfs) != 0)
1830 				return (EPERM);
1831 			return (ufs_fiologdisable(vp, (void *)arg, cr, flag));
1832 
1833 		case _FIOISLOG:
1834 			return (ufs_fioislog(vp, (void *)arg, cr, flag));
1835 
1836 		case _FIOSNAPSHOTCREATE_MULTI:
1837 		{
1838 			struct fiosnapcreate_multi	fc, *fcp;
1839 			size_t	fcm_size;
1840 
1841 			if (copyin((void *)arg, &fc, sizeof (fc)))
1842 				return (EFAULT);
1843 			if (fc.backfilecount > MAX_BACKFILE_COUNT)
1844 				return (EINVAL);
1845 			fcm_size = sizeof (struct fiosnapcreate_multi) +
1846 			    (fc.backfilecount - 1) * sizeof (int);
1847 			fcp = (struct fiosnapcreate_multi *)
1848 			    kmem_alloc(fcm_size, KM_SLEEP);
1849 			if (copyin((void *)arg, fcp, fcm_size)) {
1850 				kmem_free(fcp, fcm_size);
1851 				return (EFAULT);
1852 			}
1853 			error = ufs_snap_create(vp, fcp, cr);
1854 			/*
1855 			 * Do copyout even if there is an error because
1856 			 * the details of error is stored in fcp.
1857 			 */
1858 			if (copyout(fcp, (void *)arg, fcm_size))
1859 				error = EFAULT;
1860 			kmem_free(fcp, fcm_size);
1861 			return (error);
1862 		}
1863 
1864 		case _FIOSNAPSHOTDELETE:
1865 		{
1866 			struct fiosnapdelete	fc;
1867 
1868 			if (copyin((void *)arg, &fc, sizeof (fc)))
1869 				return (EFAULT);
1870 			error = ufs_snap_delete(vp, &fc, cr);
1871 			if (!error && copyout(&fc, (void *)arg, sizeof (fc)))
1872 				error = EFAULT;
1873 			return (error);
1874 		}
1875 
1876 		case _FIOGETSUPERBLOCK:
1877 			if (copyout(fs, (void *)arg, SBSIZE))
1878 				return (EFAULT);
1879 			return (0);
1880 
1881 		case _FIOGETMAXPHYS:
1882 			if (copyout(&maxphys, (void *)arg, sizeof (maxphys)))
1883 				return (EFAULT);
1884 			return (0);
1885 
1886 		/*
1887 		 * The following 3 ioctls are for TSufs support
1888 		 * although could potentially be used elsewhere
1889 		 */
1890 		case _FIO_SET_LUFS_DEBUG:
1891 			if (secpolicy_fs_config(cr, ufsvfsp->vfs_vfs) != 0)
1892 				return (EPERM);
1893 			lufs_debug = (uint32_t)arg;
1894 			return (0);
1895 
1896 		case _FIO_SET_LUFS_ERROR:
1897 			if (secpolicy_fs_config(cr, ufsvfsp->vfs_vfs) != 0)
1898 				return (EPERM);
1899 			TRANS_SETERROR(ufsvfsp);
1900 			return (0);
1901 
1902 		case _FIO_GET_TOP_STATS:
1903 		{
1904 			fio_lufs_stats_t *ls;
1905 			ml_unit_t *ul = ufsvfsp->vfs_log;
1906 
1907 			ls = kmem_zalloc(sizeof (*ls), KM_SLEEP);
1908 			ls->ls_debug = ul->un_debug; /* return debug value */
1909 			/* Copy stucture if statistics are being kept */
1910 			if (ul->un_logmap->mtm_tops) {
1911 				ls->ls_topstats = *(ul->un_logmap->mtm_tops);
1912 			}
1913 			error = 0;
1914 			if (copyout(ls, (void *)arg, sizeof (*ls)))
1915 				error = EFAULT;
1916 			kmem_free(ls, sizeof (*ls));
1917 			return (error);
1918 		}
1919 
1920 		case _FIO_SEEK_DATA:
1921 		case _FIO_SEEK_HOLE:
1922 			if (ddi_copyin((void *)arg, &off, sizeof (off), flag))
1923 				return (EFAULT);
1924 			/* offset paramater is in/out */
1925 			error = ufs_fio_holey(vp, cmd, &off);
1926 			if (error)
1927 				return (error);
1928 			if (ddi_copyout(&off, (void *)arg, sizeof (off), flag))
1929 				return (EFAULT);
1930 			return (0);
1931 
1932 		case _FIO_COMPRESSED:
1933 		{
1934 			/*
1935 			 * This is a project private ufs ioctl() to mark
1936 			 * the inode as that belonging to a compressed
1937 			 * file. This is used to mark individual
1938 			 * compressed files in a miniroot archive.
1939 			 * The files compressed in this manner are
1940 			 * automatically decompressed by the dcfs filesystem
1941 			 * (via an interception in ufs_lookup - see decompvp())
1942 			 * which is layered on top of ufs on a system running
1943 			 * from the archive. See uts/common/fs/dcfs for details.
1944 			 * This ioctl only marks the file as compressed - the
1945 			 * actual compression is done by fiocompress (a
1946 			 * userland utility) which invokes this ioctl().
1947 			 */
1948 			struct inode *ip = VTOI(vp);
1949 
1950 			error = ufs_lockfs_begin(ufsvfsp, &ulp,
1951 			    ULOCKFS_SETATTR_MASK);
1952 			if (error)
1953 				return (error);
1954 
1955 			if (ulp) {
1956 				TRANS_BEGIN_ASYNC(ufsvfsp, TOP_IUPDAT,
1957 				    TOP_IUPDAT_SIZE(ip));
1958 			}
1959 
1960 			error = ufs_mark_compressed(vp);
1961 
1962 			if (ulp) {
1963 				TRANS_END_ASYNC(ufsvfsp, TOP_IUPDAT,
1964 				    TOP_IUPDAT_SIZE(ip));
1965 				ufs_lockfs_end(ulp);
1966 			}
1967 
1968 			return (error);
1969 
1970 		}
1971 
1972 		default:
1973 			return (ENOTTY);
1974 	}
1975 }
1976 
1977 
1978 /* ARGSUSED */
1979 static int
1980 ufs_getattr(struct vnode *vp, struct vattr *vap, int flags,
1981 	struct cred *cr, caller_context_t *ct)
1982 {
1983 	struct inode *ip = VTOI(vp);
1984 	struct ufsvfs *ufsvfsp;
1985 	int err;
1986 
1987 	if (vap->va_mask == AT_SIZE) {
1988 		/*
1989 		 * for performance, if only the size is requested don't bother
1990 		 * with anything else.
1991 		 */
1992 		UFS_GET_ISIZE(&vap->va_size, ip);
1993 		return (0);
1994 	}
1995 
1996 	/*
1997 	 * inlined lockfs checks
1998 	 */
1999 	ufsvfsp = ip->i_ufsvfs;
2000 	if ((ufsvfsp == NULL) || ULOCKFS_IS_HLOCK(&ufsvfsp->vfs_ulockfs)) {
2001 		err = EIO;
2002 		goto out;
2003 	}
2004 
2005 	rw_enter(&ip->i_contents, RW_READER);
2006 	/*
2007 	 * Return all the attributes.  This should be refined so
2008 	 * that it only returns what's asked for.
2009 	 */
2010 
2011 	/*
2012 	 * Copy from inode table.
2013 	 */
2014 	vap->va_type = vp->v_type;
2015 	vap->va_mode = ip->i_mode & MODEMASK;
2016 	/*
2017 	 * If there is an ACL and there is a mask entry, then do the
2018 	 * extra work that completes the equivalent of an acltomode(3)
2019 	 * call.  According to POSIX P1003.1e, the acl mask should be
2020 	 * returned in the group permissions field.
2021 	 *
2022 	 * - start with the original permission and mode bits (from above)
2023 	 * - clear the group owner bits
2024 	 * - add in the mask bits.
2025 	 */
2026 	if (ip->i_ufs_acl && ip->i_ufs_acl->aclass.acl_ismask) {
2027 		vap->va_mode &= ~((VREAD | VWRITE | VEXEC) >> 3);
2028 		vap->va_mode |=
2029 		    (ip->i_ufs_acl->aclass.acl_maskbits & PERMMASK) << 3;
2030 	}
2031 	vap->va_uid = ip->i_uid;
2032 	vap->va_gid = ip->i_gid;
2033 	vap->va_fsid = ip->i_dev;
2034 	vap->va_nodeid = (ino64_t)ip->i_number;
2035 	vap->va_nlink = ip->i_nlink;
2036 	vap->va_size = ip->i_size;
2037 	if (vp->v_type == VCHR || vp->v_type == VBLK)
2038 		vap->va_rdev = ip->i_rdev;
2039 	else
2040 		vap->va_rdev = 0;	/* not a b/c spec. */
2041 	mutex_enter(&ip->i_tlock);
2042 	ITIMES_NOLOCK(ip);	/* mark correct time in inode */
2043 	vap->va_seq = ip->i_seq;
2044 	vap->va_atime.tv_sec = (time_t)ip->i_atime.tv_sec;
2045 	vap->va_atime.tv_nsec = ip->i_atime.tv_usec*1000;
2046 	vap->va_mtime.tv_sec = (time_t)ip->i_mtime.tv_sec;
2047 	vap->va_mtime.tv_nsec = ip->i_mtime.tv_usec*1000;
2048 	vap->va_ctime.tv_sec = (time_t)ip->i_ctime.tv_sec;
2049 	vap->va_ctime.tv_nsec = ip->i_ctime.tv_usec*1000;
2050 	mutex_exit(&ip->i_tlock);
2051 
2052 	switch (ip->i_mode & IFMT) {
2053 
2054 	case IFBLK:
2055 		vap->va_blksize = MAXBSIZE;		/* was BLKDEV_IOSIZE */
2056 		break;
2057 
2058 	case IFCHR:
2059 		vap->va_blksize = MAXBSIZE;
2060 		break;
2061 
2062 	default:
2063 		vap->va_blksize = ip->i_fs->fs_bsize;
2064 		break;
2065 	}
2066 	vap->va_nblocks = (fsblkcnt64_t)ip->i_blocks;
2067 	rw_exit(&ip->i_contents);
2068 	err = 0;
2069 
2070 out:
2071 	return (err);
2072 }
2073 
2074 /*ARGSUSED4*/
2075 static int
2076 ufs_setattr(
2077 	struct vnode *vp,
2078 	struct vattr *vap,
2079 	int flags,
2080 	struct cred *cr,
2081 	caller_context_t *ct)
2082 {
2083 	struct inode *ip = VTOI(vp);
2084 	struct ufsvfs *ufsvfsp = ip->i_ufsvfs;
2085 	struct fs *fs;
2086 	struct ulockfs *ulp;
2087 	char *errmsg1;
2088 	char *errmsg2;
2089 	long blocks;
2090 	long int mask = vap->va_mask;
2091 	size_t len1, len2;
2092 	int issync;
2093 	int trans_size;
2094 	int dotrans;
2095 	int dorwlock;
2096 	int error;
2097 	int owner_change;
2098 	int dodqlock;
2099 	timestruc_t now;
2100 	vattr_t oldva;
2101 	int retry = 1;
2102 	int indeadlock;
2103 
2104 	/*
2105 	 * Cannot set these attributes.
2106 	 */
2107 	if ((mask & AT_NOSET) || (mask & AT_XVATTR))
2108 		return (EINVAL);
2109 
2110 	/*
2111 	 * check for forced unmount
2112 	 */
2113 	if (ufsvfsp == NULL)
2114 		return (EIO);
2115 
2116 	fs = ufsvfsp->vfs_fs;
2117 	if (fs->fs_ronly != 0)
2118 		return (EROFS);
2119 
2120 again:
2121 	errmsg1 = NULL;
2122 	errmsg2 = NULL;
2123 	dotrans = 0;
2124 	dorwlock = 0;
2125 	dodqlock = 0;
2126 
2127 	error = ufs_lockfs_begin(ufsvfsp, &ulp, ULOCKFS_SETATTR_MASK);
2128 	if (error)
2129 		goto out;
2130 
2131 	/*
2132 	 * Acquire i_rwlock before TRANS_BEGIN_CSYNC() if this is a file.
2133 	 * This follows the protocol for read()/write().
2134 	 */
2135 	if (vp->v_type != VDIR) {
2136 		/*
2137 		 * ufs_tryirwlock uses rw_tryenter and checks for SLOCK to
2138 		 * avoid i_rwlock, ufs_lockfs_begin deadlock. If deadlock
2139 		 * possible, retries the operation.
2140 		 */
2141 		ufs_tryirwlock(&ip->i_rwlock, RW_WRITER, retry_file);
2142 		if (indeadlock) {
2143 			if (ulp)
2144 				ufs_lockfs_end(ulp);
2145 			goto again;
2146 		}
2147 		dorwlock = 1;
2148 	}
2149 
2150 	/*
2151 	 * Truncate file.  Must have write permission and not be a directory.
2152 	 */
2153 	if (mask & AT_SIZE) {
2154 		rw_enter(&ip->i_contents, RW_WRITER);
2155 		if (vp->v_type == VDIR) {
2156 			error = EISDIR;
2157 			goto update_inode;
2158 		}
2159 		if (error = ufs_iaccess(ip, IWRITE, cr))
2160 			goto update_inode;
2161 
2162 		rw_exit(&ip->i_contents);
2163 		error = TRANS_ITRUNC(ip, vap->va_size, 0, cr);
2164 		if (error) {
2165 			rw_enter(&ip->i_contents, RW_WRITER);
2166 			goto update_inode;
2167 		}
2168 	}
2169 
2170 	if (ulp) {
2171 		trans_size = (int)TOP_SETATTR_SIZE(ip);
2172 		TRANS_BEGIN_CSYNC(ufsvfsp, issync, TOP_SETATTR, trans_size);
2173 		++dotrans;
2174 	}
2175 
2176 	/*
2177 	 * Acquire i_rwlock after TRANS_BEGIN_CSYNC() if this is a directory.
2178 	 * This follows the protocol established by
2179 	 * ufs_link/create/remove/rename/mkdir/rmdir/symlink.
2180 	 */
2181 	if (vp->v_type == VDIR) {
2182 		ufs_tryirwlock_trans(&ip->i_rwlock, RW_WRITER, TOP_SETATTR,
2183 		    retry_dir);
2184 		if (indeadlock)
2185 			goto again;
2186 		dorwlock = 1;
2187 	}
2188 
2189 	/*
2190 	 * Grab quota lock if we are changing the file's owner.
2191 	 */
2192 	if (mask & AT_UID) {
2193 		rw_enter(&ufsvfsp->vfs_dqrwlock, RW_READER);
2194 		dodqlock = 1;
2195 	}
2196 	rw_enter(&ip->i_contents, RW_WRITER);
2197 
2198 	oldva.va_mode = ip->i_mode;
2199 	oldva.va_uid = ip->i_uid;
2200 	oldva.va_gid = ip->i_gid;
2201 
2202 	vap->va_mask &= ~AT_SIZE;
2203 	/*
2204 	 * ufs_iaccess is "close enough"; that's because it doesn't
2205 	 * map the defines.
2206 	 */
2207 	error = secpolicy_vnode_setattr(cr, vp, vap, &oldva, flags,
2208 	    ufs_iaccess, ip);
2209 	if (error)
2210 		goto update_inode;
2211 
2212 	mask = vap->va_mask;
2213 
2214 	/*
2215 	 * Change file access modes.
2216 	 */
2217 	if (mask & AT_MODE) {
2218 		ip->i_mode = (ip->i_mode & IFMT) | (vap->va_mode & ~IFMT);
2219 		TRANS_INODE(ufsvfsp, ip);
2220 		ip->i_flag |= ICHG;
2221 		if (stickyhack) {
2222 			mutex_enter(&vp->v_lock);
2223 			if ((ip->i_mode & (ISVTX | IEXEC | IFDIR)) == ISVTX)
2224 				vp->v_flag |= VSWAPLIKE;
2225 			else
2226 				vp->v_flag &= ~VSWAPLIKE;
2227 			mutex_exit(&vp->v_lock);
2228 		}
2229 	}
2230 	if (mask & (AT_UID|AT_GID)) {
2231 		if (mask & AT_UID) {
2232 			/*
2233 			 * Don't change ownership of the quota inode.
2234 			 */
2235 			if (ufsvfsp->vfs_qinod == ip) {
2236 				ASSERT(ufsvfsp->vfs_qflags & MQ_ENABLED);
2237 				error = EINVAL;
2238 				goto update_inode;
2239 			}
2240 
2241 			/*
2242 			 * No real ownership change.
2243 			 */
2244 			if (ip->i_uid == vap->va_uid) {
2245 				blocks = 0;
2246 				owner_change = 0;
2247 			}
2248 			/*
2249 			 * Remove the blocks and the file, from the old user's
2250 			 * quota.
2251 			 */
2252 			else {
2253 				blocks = ip->i_blocks;
2254 				owner_change = 1;
2255 
2256 				(void) chkdq(ip, -blocks, /* force */ 1, cr,
2257 				    (char **)NULL, (size_t *)NULL);
2258 				(void) chkiq(ufsvfsp, /* change */ -1, ip,
2259 				    (uid_t)ip->i_uid, /* force */ 1, cr,
2260 				    (char **)NULL, (size_t *)NULL);
2261 				dqrele(ip->i_dquot);
2262 			}
2263 
2264 			ip->i_uid = vap->va_uid;
2265 
2266 			/*
2267 			 * There is a real ownership change.
2268 			 */
2269 			if (owner_change) {
2270 				/*
2271 				 * Add the blocks and the file to the new
2272 				 * user's quota.
2273 				 */
2274 				ip->i_dquot = getinoquota(ip);
2275 				(void) chkdq(ip, blocks, /* force */ 1, cr,
2276 				    &errmsg1, &len1);
2277 				(void) chkiq(ufsvfsp, /* change */ 1,
2278 				    (struct inode *)NULL, (uid_t)ip->i_uid,
2279 				    /* force */ 1, cr, &errmsg2, &len2);
2280 			}
2281 		}
2282 		if (mask & AT_GID) {
2283 			ip->i_gid = vap->va_gid;
2284 		}
2285 		TRANS_INODE(ufsvfsp, ip);
2286 		ip->i_flag |= ICHG;
2287 	}
2288 	/*
2289 	 * Change file access or modified times.
2290 	 */
2291 	if (mask & (AT_ATIME|AT_MTIME)) {
2292 		/* Check that the time value is within ufs range */
2293 		if (((mask & AT_ATIME) && TIMESPEC_OVERFLOW(&vap->va_atime)) ||
2294 		    ((mask & AT_MTIME) && TIMESPEC_OVERFLOW(&vap->va_mtime))) {
2295 			error = EOVERFLOW;
2296 			goto update_inode;
2297 		}
2298 
2299 		/*
2300 		 * if the "noaccess" mount option is set and only atime
2301 		 * update is requested, do nothing. No error is returned.
2302 		 */
2303 		if ((ufsvfsp->vfs_noatime) &&
2304 		    ((mask & (AT_ATIME|AT_MTIME)) == AT_ATIME))
2305 			goto skip_atime;
2306 
2307 		if (mask & AT_ATIME) {
2308 			ip->i_atime.tv_sec = vap->va_atime.tv_sec;
2309 			ip->i_atime.tv_usec = vap->va_atime.tv_nsec / 1000;
2310 			ip->i_flag &= ~IACC;
2311 		}
2312 		if (mask & AT_MTIME) {
2313 			ip->i_mtime.tv_sec = vap->va_mtime.tv_sec;
2314 			ip->i_mtime.tv_usec = vap->va_mtime.tv_nsec / 1000;
2315 			gethrestime(&now);
2316 			if (now.tv_sec > TIME32_MAX) {
2317 				/*
2318 				 * In 2038, ctime sticks forever..
2319 				 */
2320 				ip->i_ctime.tv_sec = TIME32_MAX;
2321 				ip->i_ctime.tv_usec = 0;
2322 			} else {
2323 				ip->i_ctime.tv_sec = now.tv_sec;
2324 				ip->i_ctime.tv_usec = now.tv_nsec / 1000;
2325 			}
2326 			ip->i_flag &= ~(IUPD|ICHG);
2327 			ip->i_flag |= IMODTIME;
2328 		}
2329 		TRANS_INODE(ufsvfsp, ip);
2330 		ip->i_flag |= IMOD;
2331 	}
2332 
2333 skip_atime:
2334 	/*
2335 	 * The presence of a shadow inode may indicate an ACL, but does
2336 	 * not imply an ACL.  Future FSD types should be handled here too
2337 	 * and check for the presence of the attribute-specific data
2338 	 * before referencing it.
2339 	 */
2340 	if (ip->i_shadow) {
2341 		/*
2342 		 * XXX if ufs_iupdat is changed to sandbagged write fix
2343 		 * ufs_acl_setattr to push ip to keep acls consistent
2344 		 *
2345 		 * Suppress out of inodes messages if we will retry.
2346 		 */
2347 		if (retry)
2348 			ip->i_flag |= IQUIET;
2349 		error = ufs_acl_setattr(ip, vap, cr);
2350 		ip->i_flag &= ~IQUIET;
2351 	}
2352 
2353 update_inode:
2354 	/*
2355 	 * Setattr always increases the sequence number
2356 	 */
2357 	ip->i_seq++;
2358 
2359 	/*
2360 	 * if nfsd and not logging; push synchronously
2361 	 */
2362 	if ((curthread->t_flag & T_DONTPEND) && !TRANS_ISTRANS(ufsvfsp)) {
2363 		ufs_iupdat(ip, 1);
2364 	} else {
2365 		ITIMES_NOLOCK(ip);
2366 	}
2367 
2368 	rw_exit(&ip->i_contents);
2369 	if (dodqlock) {
2370 		rw_exit(&ufsvfsp->vfs_dqrwlock);
2371 	}
2372 	if (dorwlock)
2373 		rw_exit(&ip->i_rwlock);
2374 
2375 	if (ulp) {
2376 		if (dotrans) {
2377 			int terr = 0;
2378 			TRANS_END_CSYNC(ufsvfsp, terr, issync, TOP_SETATTR,
2379 			    trans_size);
2380 			if (error == 0)
2381 				error = terr;
2382 		}
2383 		ufs_lockfs_end(ulp);
2384 	}
2385 out:
2386 	/*
2387 	 * If out of inodes or blocks, see if we can free something
2388 	 * up from the delete queue.
2389 	 */
2390 	if ((error == ENOSPC) && retry && TRANS_ISTRANS(ufsvfsp)) {
2391 		ufs_delete_drain_wait(ufsvfsp, 1);
2392 		retry = 0;
2393 		if (errmsg1 != NULL)
2394 			kmem_free(errmsg1, len1);
2395 		if (errmsg2 != NULL)
2396 			kmem_free(errmsg2, len2);
2397 		goto again;
2398 	}
2399 	if (errmsg1 != NULL) {
2400 		uprintf(errmsg1);
2401 		kmem_free(errmsg1, len1);
2402 	}
2403 	if (errmsg2 != NULL) {
2404 		uprintf(errmsg2);
2405 		kmem_free(errmsg2, len2);
2406 	}
2407 	return (error);
2408 }
2409 
2410 /*ARGSUSED*/
2411 static int
2412 ufs_access(struct vnode *vp, int mode, int flags, struct cred *cr,
2413 	caller_context_t *ct)
2414 {
2415 	struct inode *ip = VTOI(vp);
2416 	int error;
2417 
2418 	if (ip->i_ufsvfs == NULL)
2419 		return (EIO);
2420 
2421 	rw_enter(&ip->i_contents, RW_READER);
2422 
2423 	/*
2424 	 * The ufs_iaccess function wants to be called with
2425 	 * mode bits expressed as "ufs specific" bits.
2426 	 * I.e., VWRITE|VREAD|VEXEC do not make sense to
2427 	 * ufs_iaccess() but IWRITE|IREAD|IEXEC do.
2428 	 * But since they're the same we just pass the vnode mode
2429 	 * bit but just verify that assumption at compile time.
2430 	 */
2431 #if IWRITE != VWRITE || IREAD != VREAD || IEXEC != VEXEC
2432 #error "ufs_access needs to map Vmodes to Imodes"
2433 #endif
2434 	error = ufs_iaccess(ip, mode, cr);
2435 
2436 	rw_exit(&ip->i_contents);
2437 
2438 	return (error);
2439 }
2440 
2441 /* ARGSUSED */
2442 static int
2443 ufs_readlink(struct vnode *vp, struct uio *uiop, struct cred *cr,
2444 	caller_context_t *ct)
2445 {
2446 	struct inode *ip = VTOI(vp);
2447 	struct ufsvfs *ufsvfsp;
2448 	struct ulockfs *ulp;
2449 	int error;
2450 	int fastsymlink;
2451 
2452 	if (vp->v_type != VLNK) {
2453 		error = EINVAL;
2454 		goto nolockout;
2455 	}
2456 
2457 	/*
2458 	 * If the symbolic link is empty there is nothing to read.
2459 	 * Fast-track these empty symbolic links
2460 	 */
2461 	if (ip->i_size == 0) {
2462 		error = 0;
2463 		goto nolockout;
2464 	}
2465 
2466 	ufsvfsp = ip->i_ufsvfs;
2467 	error = ufs_lockfs_begin(ufsvfsp, &ulp, ULOCKFS_READLINK_MASK);
2468 	if (error)
2469 		goto nolockout;
2470 	/*
2471 	 * The ip->i_rwlock protects the data blocks used for FASTSYMLINK
2472 	 */
2473 again:
2474 	fastsymlink = 0;
2475 	if (ip->i_flag & IFASTSYMLNK) {
2476 		rw_enter(&ip->i_rwlock, RW_READER);
2477 		rw_enter(&ip->i_contents, RW_READER);
2478 		if (ip->i_flag & IFASTSYMLNK) {
2479 			if (!ULOCKFS_IS_NOIACC(ITOUL(ip)) &&
2480 			    (ip->i_fs->fs_ronly == 0) &&
2481 			    (!ufsvfsp->vfs_noatime)) {
2482 				mutex_enter(&ip->i_tlock);
2483 				ip->i_flag |= IACC;
2484 				mutex_exit(&ip->i_tlock);
2485 			}
2486 			error = uiomove((caddr_t)&ip->i_db[1],
2487 			    MIN(ip->i_size, uiop->uio_resid),
2488 			    UIO_READ, uiop);
2489 			ITIMES(ip);
2490 			++fastsymlink;
2491 		}
2492 		rw_exit(&ip->i_contents);
2493 		rw_exit(&ip->i_rwlock);
2494 	}
2495 	if (!fastsymlink) {
2496 		ssize_t size;	/* number of bytes read  */
2497 		caddr_t basep;	/* pointer to input data */
2498 		ino_t ino;
2499 		long  igen;
2500 		struct uio tuio;	/* temp uio struct */
2501 		struct uio *tuiop;
2502 		iovec_t tiov;		/* temp iovec struct */
2503 		char kbuf[FSL_SIZE];	/* buffer to hold fast symlink */
2504 		int tflag = 0;		/* flag to indicate temp vars used */
2505 
2506 		ino = ip->i_number;
2507 		igen = ip->i_gen;
2508 		size = uiop->uio_resid;
2509 		basep = uiop->uio_iov->iov_base;
2510 		tuiop = uiop;
2511 
2512 		rw_enter(&ip->i_rwlock, RW_WRITER);
2513 		rw_enter(&ip->i_contents, RW_WRITER);
2514 		if (ip->i_flag & IFASTSYMLNK) {
2515 			rw_exit(&ip->i_contents);
2516 			rw_exit(&ip->i_rwlock);
2517 			goto again;
2518 		}
2519 
2520 		/* can this be a fast symlink and is it a user buffer? */
2521 		if (ip->i_size <= FSL_SIZE &&
2522 		    (uiop->uio_segflg == UIO_USERSPACE ||
2523 		    uiop->uio_segflg == UIO_USERISPACE)) {
2524 
2525 			bzero(&tuio, sizeof (struct uio));
2526 			/*
2527 			 * setup a kernel buffer to read link into.  this
2528 			 * is to fix a race condition where the user buffer
2529 			 * got corrupted before copying it into the inode.
2530 			 */
2531 			size = ip->i_size;
2532 			tiov.iov_len = size;
2533 			tiov.iov_base = kbuf;
2534 			tuio.uio_iov = &tiov;
2535 			tuio.uio_iovcnt = 1;
2536 			tuio.uio_offset = uiop->uio_offset;
2537 			tuio.uio_segflg = UIO_SYSSPACE;
2538 			tuio.uio_fmode = uiop->uio_fmode;
2539 			tuio.uio_extflg = uiop->uio_extflg;
2540 			tuio.uio_limit = uiop->uio_limit;
2541 			tuio.uio_resid = size;
2542 
2543 			basep = tuio.uio_iov->iov_base;
2544 			tuiop = &tuio;
2545 			tflag = 1;
2546 		}
2547 
2548 		error = rdip(ip, tuiop, 0, cr);
2549 		if (!(error == 0 && ip->i_number == ino && ip->i_gen == igen)) {
2550 			rw_exit(&ip->i_contents);
2551 			rw_exit(&ip->i_rwlock);
2552 			goto out;
2553 		}
2554 
2555 		if (tflag == 0)
2556 			size -= uiop->uio_resid;
2557 
2558 		if ((tflag == 0 && ip->i_size <= FSL_SIZE &&
2559 		    ip->i_size == size) || (tflag == 1 &&
2560 		    tuio.uio_resid == 0)) {
2561 			error = kcopy(basep, &ip->i_db[1], ip->i_size);
2562 			if (error == 0) {
2563 				ip->i_flag |= IFASTSYMLNK;
2564 				/*
2565 				 * free page
2566 				 */
2567 				(void) VOP_PUTPAGE(ITOV(ip),
2568 				    (offset_t)0, PAGESIZE,
2569 				    (B_DONTNEED | B_FREE | B_FORCE | B_ASYNC),
2570 				    cr, ct);
2571 			} else {
2572 				int i;
2573 				/* error, clear garbage left behind */
2574 				for (i = 1; i < NDADDR; i++)
2575 					ip->i_db[i] = 0;
2576 				for (i = 0; i < NIADDR; i++)
2577 					ip->i_ib[i] = 0;
2578 			}
2579 		}
2580 		if (tflag == 1) {
2581 			/* now, copy it into the user buffer */
2582 			error = uiomove((caddr_t)kbuf,
2583 			    MIN(size, uiop->uio_resid),
2584 			    UIO_READ, uiop);
2585 		}
2586 		rw_exit(&ip->i_contents);
2587 		rw_exit(&ip->i_rwlock);
2588 	}
2589 out:
2590 	if (ulp) {
2591 		ufs_lockfs_end(ulp);
2592 	}
2593 nolockout:
2594 	return (error);
2595 }
2596 
2597 /* ARGSUSED */
2598 static int
2599 ufs_fsync(struct vnode *vp, int syncflag, struct cred *cr,
2600 	caller_context_t *ct)
2601 {
2602 	struct inode *ip = VTOI(vp);
2603 	struct ufsvfs *ufsvfsp = ip->i_ufsvfs;
2604 	struct ulockfs *ulp;
2605 	int error;
2606 
2607 	error = ufs_lockfs_begin(ufsvfsp, &ulp, ULOCKFS_FSYNC_MASK);
2608 	if (error)
2609 		return (error);
2610 
2611 	if (TRANS_ISTRANS(ufsvfsp)) {
2612 		/*
2613 		 * First push out any data pages
2614 		 */
2615 		if (vn_has_cached_data(vp) && !(syncflag & FNODSYNC) &&
2616 		    (vp->v_type != VCHR) && !(IS_SWAPVP(vp))) {
2617 			error = VOP_PUTPAGE(vp, (offset_t)0, (size_t)0,
2618 			    0, CRED(), ct);
2619 			if (error)
2620 				goto out;
2621 		}
2622 
2623 		/*
2624 		 * Delta any delayed inode times updates
2625 		 * and push inode to log.
2626 		 * All other inode deltas will have already been delta'd
2627 		 * and will be pushed during the commit.
2628 		 */
2629 		if (!(syncflag & FDSYNC) &&
2630 		    ((ip->i_flag & (IMOD|IMODACC)) == IMODACC)) {
2631 			if (ulp) {
2632 				TRANS_BEGIN_ASYNC(ufsvfsp, TOP_FSYNC,
2633 				    TOP_SYNCIP_SIZE);
2634 			}
2635 			rw_enter(&ip->i_contents, RW_READER);
2636 			mutex_enter(&ip->i_tlock);
2637 			ip->i_flag &= ~IMODTIME;
2638 			mutex_exit(&ip->i_tlock);
2639 			ufs_iupdat(ip, I_SYNC);
2640 			rw_exit(&ip->i_contents);
2641 			if (ulp) {
2642 				TRANS_END_ASYNC(ufsvfsp, TOP_FSYNC,
2643 				    TOP_SYNCIP_SIZE);
2644 			}
2645 		}
2646 
2647 		/*
2648 		 * Commit the Moby transaction
2649 		 *
2650 		 * Deltas have already been made so we just need to
2651 		 * commit them with a synchronous transaction.
2652 		 * TRANS_BEGIN_SYNC() will return an error
2653 		 * if there are no deltas to commit, for an
2654 		 * empty transaction.
2655 		 */
2656 		if (ulp) {
2657 			TRANS_BEGIN_SYNC(ufsvfsp, TOP_FSYNC, TOP_COMMIT_SIZE,
2658 			    error);
2659 			if (error) {
2660 				error = 0; /* commit wasn't needed */
2661 				goto out;
2662 			}
2663 			TRANS_END_SYNC(ufsvfsp, error, TOP_FSYNC,
2664 			    TOP_COMMIT_SIZE);
2665 		}
2666 	} else {	/* not logging */
2667 		if (!(IS_SWAPVP(vp)))
2668 			if (syncflag & FNODSYNC) {
2669 				/* Just update the inode only */
2670 				TRANS_IUPDAT(ip, 1);
2671 				error = 0;
2672 			} else if (syncflag & FDSYNC)
2673 				/* Do data-synchronous writes */
2674 				error = TRANS_SYNCIP(ip, 0, I_DSYNC, TOP_FSYNC);
2675 			else
2676 				/* Do synchronous writes */
2677 				error = TRANS_SYNCIP(ip, 0, I_SYNC, TOP_FSYNC);
2678 
2679 		rw_enter(&ip->i_contents, RW_WRITER);
2680 		if (!error)
2681 			error = ufs_sync_indir(ip);
2682 		rw_exit(&ip->i_contents);
2683 	}
2684 out:
2685 	if (ulp) {
2686 		ufs_lockfs_end(ulp);
2687 	}
2688 	return (error);
2689 }
2690 
2691 /*ARGSUSED*/
2692 static void
2693 ufs_inactive(struct vnode *vp, struct cred *cr, caller_context_t *ct)
2694 {
2695 	ufs_iinactive(VTOI(vp));
2696 }
2697 
2698 /*
2699  * Unix file system operations having to do with directory manipulation.
2700  */
2701 int ufs_lookup_idle_count = 2;	/* Number of inodes to idle each time */
2702 /* ARGSUSED */
2703 static int
2704 ufs_lookup(struct vnode *dvp, char *nm, struct vnode **vpp,
2705 	struct pathname *pnp, int flags, struct vnode *rdir, struct cred *cr,
2706 	caller_context_t *ct, int *direntflags, pathname_t *realpnp)
2707 {
2708 	struct inode *ip;
2709 	struct inode *sip;
2710 	struct inode *xip;
2711 	struct ufsvfs *ufsvfsp;
2712 	struct ulockfs *ulp;
2713 	struct vnode *vp;
2714 	int error;
2715 
2716 	/*
2717 	 * Check flags for type of lookup (regular file or attribute file)
2718 	 */
2719 
2720 	ip = VTOI(dvp);
2721 
2722 	if (flags & LOOKUP_XATTR) {
2723 
2724 		/*
2725 		 * If not mounted with XATTR support then return EINVAL
2726 		 */
2727 
2728 		if (!(ip->i_ufsvfs->vfs_vfs->vfs_flag & VFS_XATTR))
2729 			return (EINVAL);
2730 		/*
2731 		 * We don't allow recursive attributes...
2732 		 * Maybe someday we will.
2733 		 */
2734 		if ((ip->i_cflags & IXATTR)) {
2735 			return (EINVAL);
2736 		}
2737 
2738 		if ((vp = dnlc_lookup(dvp, XATTR_DIR_NAME)) == NULL) {
2739 			error = ufs_xattr_getattrdir(dvp, &sip, flags, cr);
2740 			if (error) {
2741 				*vpp = NULL;
2742 				goto out;
2743 			}
2744 
2745 			vp = ITOV(sip);
2746 			dnlc_update(dvp, XATTR_DIR_NAME, vp);
2747 		}
2748 
2749 		/*
2750 		 * Check accessibility of directory.
2751 		 */
2752 		if (vp == DNLC_NO_VNODE) {
2753 			VN_RELE(vp);
2754 			error = ENOENT;
2755 			goto out;
2756 		}
2757 		if ((error = ufs_iaccess(VTOI(vp), IEXEC, cr)) != 0) {
2758 			VN_RELE(vp);
2759 			goto out;
2760 		}
2761 
2762 		*vpp = vp;
2763 		return (0);
2764 	}
2765 
2766 	/*
2767 	 * Check for a null component, which we should treat as
2768 	 * looking at dvp from within it's parent, so we don't
2769 	 * need a call to ufs_iaccess(), as it has already been
2770 	 * done.
2771 	 */
2772 	if (nm[0] == 0) {
2773 		VN_HOLD(dvp);
2774 		error = 0;
2775 		*vpp = dvp;
2776 		goto out;
2777 	}
2778 
2779 	/*
2780 	 * Check for "." ie itself. this is a quick check and
2781 	 * avoids adding "." into the dnlc (which have been seen
2782 	 * to occupy >10% of the cache).
2783 	 */
2784 	if ((nm[0] == '.') && (nm[1] == 0)) {
2785 		/*
2786 		 * Don't return without checking accessibility
2787 		 * of the directory. We only need the lock if
2788 		 * we are going to return it.
2789 		 */
2790 		if ((error = ufs_iaccess(ip, IEXEC, cr)) == 0) {
2791 			VN_HOLD(dvp);
2792 			*vpp = dvp;
2793 		}
2794 		goto out;
2795 	}
2796 
2797 	/*
2798 	 * Fast path: Check the directory name lookup cache.
2799 	 */
2800 	if (vp = dnlc_lookup(dvp, nm)) {
2801 		/*
2802 		 * Check accessibility of directory.
2803 		 */
2804 		if ((error = ufs_iaccess(ip, IEXEC, cr)) != 0) {
2805 			VN_RELE(vp);
2806 			goto out;
2807 		}
2808 		if (vp == DNLC_NO_VNODE) {
2809 			VN_RELE(vp);
2810 			error = ENOENT;
2811 			goto out;
2812 		}
2813 		xip = VTOI(vp);
2814 		ulp = NULL;
2815 		goto fastpath;
2816 	}
2817 
2818 	/*
2819 	 * Keep the idle queue from getting too long by
2820 	 * idling two inodes before attempting to allocate another.
2821 	 *    This operation must be performed before entering
2822 	 *    lockfs or a transaction.
2823 	 */
2824 	if (ufs_idle_q.uq_ne > ufs_idle_q.uq_hiwat)
2825 		if ((curthread->t_flag & T_DONTBLOCK) == 0) {
2826 			ins.in_lidles.value.ul += ufs_lookup_idle_count;
2827 			ufs_idle_some(ufs_lookup_idle_count);
2828 		}
2829 
2830 retry_lookup:
2831 	ufsvfsp = ip->i_ufsvfs;
2832 	error = ufs_lockfs_begin(ufsvfsp, &ulp, ULOCKFS_LOOKUP_MASK);
2833 	if (error)
2834 		goto out;
2835 
2836 	error = ufs_dirlook(ip, nm, &xip, cr, 1);
2837 
2838 fastpath:
2839 	if (error == 0) {
2840 		ip = xip;
2841 		*vpp = ITOV(ip);
2842 
2843 		/*
2844 		 * If vnode is a device return special vnode instead.
2845 		 */
2846 		if (IS_DEVVP(*vpp)) {
2847 			struct vnode *newvp;
2848 
2849 			newvp = specvp(*vpp, (*vpp)->v_rdev, (*vpp)->v_type,
2850 			    cr);
2851 			VN_RELE(*vpp);
2852 			if (newvp == NULL)
2853 				error = ENOSYS;
2854 			else
2855 				*vpp = newvp;
2856 		} else if (ip->i_cflags & ICOMPRESS) {
2857 			struct vnode *newvp;
2858 
2859 			/*
2860 			 * Compressed file, substitute dcfs vnode
2861 			 */
2862 			newvp = decompvp(*vpp, cr, ct);
2863 			VN_RELE(*vpp);
2864 			if (newvp == NULL)
2865 				error = ENOSYS;
2866 			else
2867 				*vpp = newvp;
2868 		}
2869 	}
2870 	if (ulp) {
2871 		ufs_lockfs_end(ulp);
2872 	}
2873 
2874 	if (error == EAGAIN)
2875 		goto retry_lookup;
2876 
2877 out:
2878 	return (error);
2879 }
2880 
2881 /*ARGSUSED*/
2882 static int
2883 ufs_create(struct vnode *dvp, char *name, struct vattr *vap, enum vcexcl excl,
2884 	int mode, struct vnode **vpp, struct cred *cr, int flag,
2885 	caller_context_t *ct, vsecattr_t *vsecp)
2886 {
2887 	struct inode *ip;
2888 	struct inode *xip;
2889 	struct inode *dip;
2890 	struct vnode *xvp;
2891 	struct ufsvfs *ufsvfsp;
2892 	struct ulockfs *ulp;
2893 	int error;
2894 	int issync;
2895 	int truncflag;
2896 	int trans_size;
2897 	int noentry;
2898 	int defer_dip_seq_update = 0;	/* need to defer update of dip->i_seq */
2899 	int retry = 1;
2900 	int indeadlock;
2901 
2902 again:
2903 	ip = VTOI(dvp);
2904 	ufsvfsp = ip->i_ufsvfs;
2905 	truncflag = 0;
2906 
2907 	error = ufs_lockfs_begin(ufsvfsp, &ulp, ULOCKFS_CREATE_MASK);
2908 	if (error)
2909 		goto out;
2910 
2911 	if (ulp) {
2912 		trans_size = (int)TOP_CREATE_SIZE(ip);
2913 		TRANS_BEGIN_CSYNC(ufsvfsp, issync, TOP_CREATE, trans_size);
2914 	}
2915 
2916 	if ((vap->va_mode & VSVTX) && secpolicy_vnode_stky_modify(cr) != 0)
2917 		vap->va_mode &= ~VSVTX;
2918 
2919 	if (*name == '\0') {
2920 		/*
2921 		 * Null component name refers to the directory itself.
2922 		 */
2923 		VN_HOLD(dvp);
2924 		/*
2925 		 * Even though this is an error case, we need to grab the
2926 		 * quota lock since the error handling code below is common.
2927 		 */
2928 		rw_enter(&ufsvfsp->vfs_dqrwlock, RW_READER);
2929 		rw_enter(&ip->i_contents, RW_WRITER);
2930 		error = EEXIST;
2931 	} else {
2932 		xip = NULL;
2933 		noentry = 0;
2934 		/*
2935 		 * ufs_tryirwlock_trans uses rw_tryenter and checks for SLOCK
2936 		 * to avoid i_rwlock, ufs_lockfs_begin deadlock. If deadlock
2937 		 * possible, retries the operation.
2938 		 */
2939 		ufs_tryirwlock_trans(&ip->i_rwlock, RW_WRITER, TOP_CREATE,
2940 		    retry_dir);
2941 		if (indeadlock)
2942 			goto again;
2943 
2944 		xvp = dnlc_lookup(dvp, name);
2945 		if (xvp == DNLC_NO_VNODE) {
2946 			noentry = 1;
2947 			VN_RELE(xvp);
2948 			xvp = NULL;
2949 		}
2950 		if (xvp) {
2951 			rw_exit(&ip->i_rwlock);
2952 			if (error = ufs_iaccess(ip, IEXEC, cr)) {
2953 				VN_RELE(xvp);
2954 			} else {
2955 				error = EEXIST;
2956 				xip = VTOI(xvp);
2957 			}
2958 		} else {
2959 			/*
2960 			 * Suppress file system full message if we will retry
2961 			 */
2962 			error = ufs_direnter_cm(ip, name, DE_CREATE,
2963 			    vap, &xip, cr, (noentry | (retry ? IQUIET : 0)));
2964 			if (error == EAGAIN) {
2965 				if (ulp) {
2966 					TRANS_END_CSYNC(ufsvfsp, error, issync,
2967 					    TOP_CREATE, trans_size);
2968 					ufs_lockfs_end(ulp);
2969 				}
2970 				goto again;
2971 			}
2972 			rw_exit(&ip->i_rwlock);
2973 		}
2974 		ip = xip;
2975 		if (ip != NULL) {
2976 			rw_enter(&ufsvfsp->vfs_dqrwlock, RW_READER);
2977 			rw_enter(&ip->i_contents, RW_WRITER);
2978 		}
2979 	}
2980 
2981 	/*
2982 	 * If the file already exists and this is a non-exclusive create,
2983 	 * check permissions and allow access for non-directories.
2984 	 * Read-only create of an existing directory is also allowed.
2985 	 * We fail an exclusive create of anything which already exists.
2986 	 */
2987 	if (error == EEXIST) {
2988 		dip = VTOI(dvp);
2989 		if (excl == NONEXCL) {
2990 			if ((((ip->i_mode & IFMT) == IFDIR) ||
2991 			    ((ip->i_mode & IFMT) == IFATTRDIR)) &&
2992 			    (mode & IWRITE))
2993 				error = EISDIR;
2994 			else if (mode)
2995 				error = ufs_iaccess(ip, mode, cr);
2996 			else
2997 				error = 0;
2998 		}
2999 		if (error) {
3000 			rw_exit(&ip->i_contents);
3001 			rw_exit(&ufsvfsp->vfs_dqrwlock);
3002 			VN_RELE(ITOV(ip));
3003 			goto unlock;
3004 		}
3005 		/*
3006 		 * If the error EEXIST was set, then i_seq can not
3007 		 * have been updated. The sequence number interface
3008 		 * is defined such that a non-error VOP_CREATE must
3009 		 * increase the dir va_seq it by at least one. If we
3010 		 * have cleared the error, increase i_seq. Note that
3011 		 * we are increasing the dir i_seq and in rare cases
3012 		 * ip may actually be from the dvp, so we already have
3013 		 * the locks and it will not be subject to truncation.
3014 		 * In case we have to update i_seq of the parent
3015 		 * directory dip, we have to defer it till we have
3016 		 * released our locks on ip due to lock ordering requirements.
3017 		 */
3018 		if (ip != dip)
3019 			defer_dip_seq_update = 1;
3020 		else
3021 			ip->i_seq++;
3022 
3023 		if (((ip->i_mode & IFMT) == IFREG) &&
3024 		    (vap->va_mask & AT_SIZE) && vap->va_size == 0) {
3025 			/*
3026 			 * Truncate regular files, if requested by caller.
3027 			 * Grab i_rwlock to make sure no one else is
3028 			 * currently writing to the file (we promised
3029 			 * bmap we would do this).
3030 			 * Must get the locks in the correct order.
3031 			 */
3032 			if (ip->i_size == 0) {
3033 				ip->i_flag |= ICHG | IUPD;
3034 				ip->i_seq++;
3035 				TRANS_INODE(ufsvfsp, ip);
3036 			} else {
3037 				/*
3038 				 * Large Files: Why this check here?
3039 				 * Though we do it in vn_create() we really
3040 				 * want to guarantee that we do not destroy
3041 				 * Large file data by atomically checking
3042 				 * the size while holding the contents
3043 				 * lock.
3044 				 */
3045 				if (flag && !(flag & FOFFMAX) &&
3046 				    ((ip->i_mode & IFMT) == IFREG) &&
3047 				    (ip->i_size > (offset_t)MAXOFF32_T)) {
3048 					rw_exit(&ip->i_contents);
3049 					rw_exit(&ufsvfsp->vfs_dqrwlock);
3050 					error = EOVERFLOW;
3051 					goto unlock;
3052 				}
3053 				if (TRANS_ISTRANS(ufsvfsp))
3054 					truncflag++;
3055 				else {
3056 					rw_exit(&ip->i_contents);
3057 					rw_exit(&ufsvfsp->vfs_dqrwlock);
3058 					ufs_tryirwlock_trans(&ip->i_rwlock,
3059 					    RW_WRITER, TOP_CREATE,
3060 					    retry_file);
3061 					if (indeadlock) {
3062 						VN_RELE(ITOV(ip));
3063 						goto again;
3064 					}
3065 					rw_enter(&ufsvfsp->vfs_dqrwlock,
3066 					    RW_READER);
3067 					rw_enter(&ip->i_contents, RW_WRITER);
3068 					(void) ufs_itrunc(ip, (u_offset_t)0, 0,
3069 					    cr);
3070 					rw_exit(&ip->i_rwlock);
3071 				}
3072 
3073 			}
3074 			if (error == 0) {
3075 				vnevent_create(ITOV(ip), ct);
3076 			}
3077 		}
3078 	}
3079 
3080 	if (error) {
3081 		if (ip != NULL) {
3082 			rw_exit(&ufsvfsp->vfs_dqrwlock);
3083 			rw_exit(&ip->i_contents);
3084 		}
3085 		goto unlock;
3086 	}
3087 
3088 	*vpp = ITOV(ip);
3089 	ITIMES(ip);
3090 	rw_exit(&ip->i_contents);
3091 	rw_exit(&ufsvfsp->vfs_dqrwlock);
3092 
3093 	/*
3094 	 * If vnode is a device return special vnode instead.
3095 	 */
3096 	if (!error && IS_DEVVP(*vpp)) {
3097 		struct vnode *newvp;
3098 
3099 		newvp = specvp(*vpp, (*vpp)->v_rdev, (*vpp)->v_type, cr);
3100 		VN_RELE(*vpp);
3101 		if (newvp == NULL) {
3102 			error = ENOSYS;
3103 			goto unlock;
3104 		}
3105 		truncflag = 0;
3106 		*vpp = newvp;
3107 	}
3108 unlock:
3109 
3110 	/*
3111 	 * Do the deferred update of the parent directory's sequence
3112 	 * number now.
3113 	 */
3114 	if (defer_dip_seq_update == 1) {
3115 		rw_enter(&dip->i_contents, RW_READER);
3116 		mutex_enter(&dip->i_tlock);
3117 		dip->i_seq++;
3118 		mutex_exit(&dip->i_tlock);
3119 		rw_exit(&dip->i_contents);
3120 	}
3121 
3122 	if (ulp) {
3123 		int terr = 0;
3124 
3125 		TRANS_END_CSYNC(ufsvfsp, terr, issync, TOP_CREATE,
3126 		    trans_size);
3127 
3128 		/*
3129 		 * If we haven't had a more interesting failure
3130 		 * already, then anything that might've happened
3131 		 * here should be reported.
3132 		 */
3133 		if (error == 0)
3134 			error = terr;
3135 	}
3136 
3137 	if (!error && truncflag) {
3138 		ufs_tryirwlock(&ip->i_rwlock, RW_WRITER, retry_trunc);
3139 		if (indeadlock) {
3140 			if (ulp)
3141 				ufs_lockfs_end(ulp);
3142 			VN_RELE(ITOV(ip));
3143 			goto again;
3144 		}
3145 		(void) TRANS_ITRUNC(ip, (u_offset_t)0, 0, cr);
3146 		rw_exit(&ip->i_rwlock);
3147 	}
3148 
3149 	if (ulp)
3150 		ufs_lockfs_end(ulp);
3151 
3152 	/*
3153 	 * If no inodes available, try to free one up out of the
3154 	 * pending delete queue.
3155 	 */
3156 	if ((error == ENOSPC) && retry && TRANS_ISTRANS(ufsvfsp)) {
3157 		ufs_delete_drain_wait(ufsvfsp, 1);
3158 		retry = 0;
3159 		goto again;
3160 	}
3161 
3162 out:
3163 	return (error);
3164 }
3165 
3166 extern int ufs_idle_max;
3167 /*ARGSUSED*/
3168 static int
3169 ufs_remove(struct vnode *vp, char *nm, struct cred *cr,
3170 	caller_context_t *ct, int flags)
3171 {
3172 	struct inode *ip = VTOI(vp);
3173 	struct ufsvfs *ufsvfsp	= ip->i_ufsvfs;
3174 	struct ulockfs *ulp;
3175 	vnode_t *rmvp = NULL;	/* Vnode corresponding to name being removed */
3176 	int indeadlock;
3177 	int error;
3178 	int issync;
3179 	int trans_size;
3180 
3181 	/*
3182 	 * don't let the delete queue get too long
3183 	 */
3184 	if (ufsvfsp == NULL) {
3185 		error = EIO;
3186 		goto out;
3187 	}
3188 	if (ufsvfsp->vfs_delete.uq_ne > ufs_idle_max)
3189 		ufs_delete_drain(vp->v_vfsp, 1, 1);
3190 
3191 retry_remove:
3192 	error = ufs_lockfs_begin(ufsvfsp, &ulp, ULOCKFS_REMOVE_MASK);
3193 	if (error)
3194 		goto out;
3195 
3196 	if (ulp)
3197 		TRANS_BEGIN_CSYNC(ufsvfsp, issync, TOP_REMOVE,
3198 		    trans_size = (int)TOP_REMOVE_SIZE(VTOI(vp)));
3199 
3200 	/*
3201 	 * ufs_tryirwlock_trans uses rw_tryenter and checks for SLOCK
3202 	 * to avoid i_rwlock, ufs_lockfs_begin deadlock. If deadlock
3203 	 * possible, retries the operation.
3204 	 */
3205 	ufs_tryirwlock_trans(&ip->i_rwlock, RW_WRITER, TOP_REMOVE, retry);
3206 	if (indeadlock)
3207 		goto retry_remove;
3208 	error = ufs_dirremove(ip, nm, (struct inode *)0, (struct vnode *)0,
3209 	    DR_REMOVE, cr, &rmvp);
3210 	rw_exit(&ip->i_rwlock);
3211 
3212 	if (ulp) {
3213 		TRANS_END_CSYNC(ufsvfsp, error, issync, TOP_REMOVE, trans_size);
3214 		ufs_lockfs_end(ulp);
3215 	}
3216 
3217 	/*
3218 	 * This must be called after the remove transaction is closed.
3219 	 */
3220 	if (rmvp != NULL) {
3221 		/* Only send the event if there were no errors */
3222 		if (error == 0)
3223 			vnevent_remove(rmvp, vp, nm, ct);
3224 		VN_RELE(rmvp);
3225 	}
3226 out:
3227 	return (error);
3228 }
3229 
3230 /*
3231  * Link a file or a directory.  Only privileged processes are allowed to
3232  * make links to directories.
3233  */
3234 /*ARGSUSED*/
3235 static int
3236 ufs_link(struct vnode *tdvp, struct vnode *svp, char *tnm, struct cred *cr,
3237 	caller_context_t *ct, int flags)
3238 {
3239 	struct inode *sip;
3240 	struct inode *tdp = VTOI(tdvp);
3241 	struct ufsvfs *ufsvfsp = tdp->i_ufsvfs;
3242 	struct ulockfs *ulp;
3243 	struct vnode *realvp;
3244 	int error;
3245 	int issync;
3246 	int trans_size;
3247 	int isdev;
3248 	int indeadlock;
3249 
3250 retry_link:
3251 	error = ufs_lockfs_begin(ufsvfsp, &ulp, ULOCKFS_LINK_MASK);
3252 	if (error)
3253 		goto out;
3254 
3255 	if (ulp)
3256 		TRANS_BEGIN_CSYNC(ufsvfsp, issync, TOP_LINK,
3257 		    trans_size = (int)TOP_LINK_SIZE(VTOI(tdvp)));
3258 
3259 	if (VOP_REALVP(svp, &realvp, ct) == 0)
3260 		svp = realvp;
3261 
3262 	/*
3263 	 * Make sure link for extended attributes is valid
3264 	 * We only support hard linking of attr in ATTRDIR to ATTRDIR
3265 	 *
3266 	 * Make certain we don't attempt to look at a device node as
3267 	 * a ufs inode.
3268 	 */
3269 
3270 	isdev = IS_DEVVP(svp);
3271 	if (((isdev == 0) && ((VTOI(svp)->i_cflags & IXATTR) == 0) &&
3272 	    ((tdp->i_mode & IFMT) == IFATTRDIR)) ||
3273 	    ((isdev == 0) && (VTOI(svp)->i_cflags & IXATTR) &&
3274 	    ((tdp->i_mode & IFMT) == IFDIR))) {
3275 		error = EINVAL;
3276 		goto unlock;
3277 	}
3278 
3279 	sip = VTOI(svp);
3280 	if ((svp->v_type == VDIR &&
3281 	    secpolicy_fs_linkdir(cr, ufsvfsp->vfs_vfs) != 0) ||
3282 	    (sip->i_uid != crgetuid(cr) && secpolicy_basic_link(cr) != 0)) {
3283 		error = EPERM;
3284 		goto unlock;
3285 	}
3286 
3287 	/*
3288 	 * ufs_tryirwlock_trans uses rw_tryenter and checks for SLOCK
3289 	 * to avoid i_rwlock, ufs_lockfs_begin deadlock. If deadlock
3290 	 * possible, retries the operation.
3291 	 */
3292 	ufs_tryirwlock_trans(&tdp->i_rwlock, RW_WRITER, TOP_LINK, retry);
3293 	if (indeadlock)
3294 		goto retry_link;
3295 	error = ufs_direnter_lr(tdp, tnm, DE_LINK, (struct inode *)0,
3296 	    sip, cr, NULL);
3297 	rw_exit(&tdp->i_rwlock);
3298 
3299 unlock:
3300 	if (ulp) {
3301 		TRANS_END_CSYNC(ufsvfsp, error, issync, TOP_LINK, trans_size);
3302 		ufs_lockfs_end(ulp);
3303 	}
3304 
3305 	if (!error) {
3306 		vnevent_link(svp, ct);
3307 	}
3308 out:
3309 	return (error);
3310 }
3311 
3312 uint64_t ufs_rename_retry_cnt;
3313 uint64_t ufs_rename_upgrade_retry_cnt;
3314 uint64_t ufs_rename_dircheck_retry_cnt;
3315 clock_t	 ufs_rename_backoff_delay = 1;
3316 
3317 /*
3318  * Rename a file or directory.
3319  * We are given the vnode and entry string of the source and the
3320  * vnode and entry string of the place we want to move the source
3321  * to (the target). The essential operation is:
3322  *	unlink(target);
3323  *	link(source, target);
3324  *	unlink(source);
3325  * but "atomically".  Can't do full commit without saving state in
3326  * the inode on disk, which isn't feasible at this time.  Best we
3327  * can do is always guarantee that the TARGET exists.
3328  */
3329 
3330 /*ARGSUSED*/
3331 static int
3332 ufs_rename(
3333 	struct vnode *sdvp,		/* old (source) parent vnode */
3334 	char *snm,			/* old (source) entry name */
3335 	struct vnode *tdvp,		/* new (target) parent vnode */
3336 	char *tnm,			/* new (target) entry name */
3337 	struct cred *cr,
3338 	caller_context_t *ct,
3339 	int flags)
3340 {
3341 	struct inode *sip = NULL;	/* source inode */
3342 	struct inode *ip = NULL;	/* check inode */
3343 	struct inode *sdp;		/* old (source) parent inode */
3344 	struct inode *tdp;		/* new (target) parent inode */
3345 	struct vnode *tvp = NULL;	/* target vnode, if it exists */
3346 	struct vnode *realvp;
3347 	struct ufsvfs *ufsvfsp;
3348 	struct ulockfs *ulp;
3349 	struct ufs_slot slot;
3350 	timestruc_t now;
3351 	int error;
3352 	int issync;
3353 	int trans_size;
3354 	krwlock_t *first_lock;
3355 	krwlock_t *second_lock;
3356 	krwlock_t *reverse_lock;
3357 
3358 	sdp = VTOI(sdvp);
3359 	slot.fbp = NULL;
3360 	ufsvfsp = sdp->i_ufsvfs;
3361 retry_rename:
3362 	error = ufs_lockfs_begin(ufsvfsp, &ulp, ULOCKFS_RENAME_MASK);
3363 	if (error)
3364 		goto out;
3365 
3366 	if (ulp)
3367 		TRANS_BEGIN_CSYNC(ufsvfsp, issync, TOP_RENAME,
3368 		    trans_size = (int)TOP_RENAME_SIZE(sdp));
3369 
3370 	if (VOP_REALVP(tdvp, &realvp, ct) == 0)
3371 		tdvp = realvp;
3372 
3373 	tdp = VTOI(tdvp);
3374 
3375 
3376 	/*
3377 	 * We only allow renaming of attributes from ATTRDIR to ATTRDIR.
3378 	 */
3379 	if ((tdp->i_mode & IFMT) != (sdp->i_mode & IFMT)) {
3380 		error = EINVAL;
3381 		goto unlock;
3382 	}
3383 
3384 	/*
3385 	 * Look up inode of file we're supposed to rename.
3386 	 */
3387 	gethrestime(&now);
3388 	if (error = ufs_dirlook(sdp, snm, &sip, cr, 0)) {
3389 		if (error == EAGAIN) {
3390 			if (ulp) {
3391 				TRANS_END_CSYNC(ufsvfsp, error, issync,
3392 				    TOP_RENAME, trans_size);
3393 				ufs_lockfs_end(ulp);
3394 			}
3395 			goto retry_rename;
3396 		}
3397 
3398 		goto unlock;
3399 	}
3400 
3401 	/*
3402 	 * Lock both the source and target directories (they may be
3403 	 * the same) to provide the atomicity semantics that was
3404 	 * previously provided by the per file system vfs_rename_lock
3405 	 *
3406 	 * with vfs_rename_lock removed to allow simultaneous renames
3407 	 * within a file system, ufs_dircheckpath can deadlock while
3408 	 * traversing back to ensure that source is not a parent directory
3409 	 * of target parent directory. This is because we get into
3410 	 * ufs_dircheckpath with the sdp and tdp locks held as RW_WRITER.
3411 	 * If the tdp and sdp of the simultaneous renames happen to be
3412 	 * in the path of each other, it can lead to a deadlock. This
3413 	 * can be avoided by getting the locks as RW_READER here and then
3414 	 * upgrading to RW_WRITER after completing the ufs_dircheckpath.
3415 	 *
3416 	 * We hold the target directory's i_rwlock after calling
3417 	 * ufs_lockfs_begin but in many other operations (like ufs_readdir)
3418 	 * VOP_RWLOCK is explicitly called by the filesystem independent code
3419 	 * before calling the file system operation. In these cases the order
3420 	 * is reversed (i.e i_rwlock is taken first and then ufs_lockfs_begin
3421 	 * is called). This is fine as long as ufs_lockfs_begin acts as a VOP
3422 	 * counter but with ufs_quiesce setting the SLOCK bit this becomes a
3423 	 * synchronizing object which might lead to a deadlock. So we use
3424 	 * rw_tryenter instead of rw_enter. If we fail to get this lock and
3425 	 * find that SLOCK bit is set, we call ufs_lockfs_end and restart the
3426 	 * operation.
3427 	 */
3428 retry:
3429 	first_lock = &tdp->i_rwlock;
3430 	second_lock = &sdp->i_rwlock;
3431 retry_firstlock:
3432 	if (!rw_tryenter(first_lock, RW_READER)) {
3433 		/*
3434 		 * We didn't get the lock. Check if the SLOCK is set in the
3435 		 * ufsvfs. If yes, we might be in a deadlock. Safer to give up
3436 		 * and wait for SLOCK to be cleared.
3437 		 */
3438 
3439 		if (ulp && ULOCKFS_IS_SLOCK(ulp)) {
3440 			TRANS_END_CSYNC(ufsvfsp, error, issync, TOP_RENAME,
3441 			    trans_size);
3442 			ufs_lockfs_end(ulp);
3443 			goto retry_rename;
3444 
3445 		} else {
3446 			/*
3447 			 * SLOCK isn't set so this is a genuine synchronization
3448 			 * case. Let's try again after giving them a breather.
3449 			 */
3450 			delay(RETRY_LOCK_DELAY);
3451 			goto  retry_firstlock;
3452 		}
3453 	}
3454 	/*
3455 	 * Need to check if the tdp and sdp are same !!!
3456 	 */
3457 	if ((tdp != sdp) && (!rw_tryenter(second_lock, RW_READER))) {
3458 		/*
3459 		 * We didn't get the lock. Check if the SLOCK is set in the
3460 		 * ufsvfs. If yes, we might be in a deadlock. Safer to give up
3461 		 * and wait for SLOCK to be cleared.
3462 		 */
3463 
3464 		rw_exit(first_lock);
3465 		if (ulp && ULOCKFS_IS_SLOCK(ulp)) {
3466 			TRANS_END_CSYNC(ufsvfsp, error, issync, TOP_RENAME,
3467 			    trans_size);
3468 			ufs_lockfs_end(ulp);
3469 			goto retry_rename;
3470 
3471 		} else {
3472 			/*
3473 			 * So we couldn't get the second level peer lock *and*
3474 			 * the SLOCK bit isn't set. Too bad we can be
3475 			 * contentding with someone wanting these locks otherway
3476 			 * round. Reverse the locks in case there is a heavy
3477 			 * contention for the second level lock.
3478 			 */
3479 			reverse_lock = first_lock;
3480 			first_lock = second_lock;
3481 			second_lock = reverse_lock;
3482 			ufs_rename_retry_cnt++;
3483 			goto  retry_firstlock;
3484 		}
3485 	}
3486 
3487 	if (sip == tdp) {
3488 		error = EINVAL;
3489 		goto errout;
3490 	}
3491 	/*
3492 	 * Make sure we can delete the source entry.  This requires
3493 	 * write permission on the containing directory.
3494 	 * Check for sticky directories.
3495 	 */
3496 	rw_enter(&sdp->i_contents, RW_READER);
3497 	rw_enter(&sip->i_contents, RW_READER);
3498 	if ((error = ufs_iaccess(sdp, IWRITE, cr)) != 0 ||
3499 	    (error = ufs_sticky_remove_access(sdp, sip, cr)) != 0) {
3500 		rw_exit(&sip->i_contents);
3501 		rw_exit(&sdp->i_contents);
3502 		goto errout;
3503 	}
3504 
3505 	/*
3506 	 * If this is a rename of a directory and the parent is
3507 	 * different (".." must be changed), then the source
3508 	 * directory must not be in the directory hierarchy
3509 	 * above the target, as this would orphan everything
3510 	 * below the source directory.  Also the user must have
3511 	 * write permission in the source so as to be able to
3512 	 * change "..".
3513 	 */
3514 	if ((((sip->i_mode & IFMT) == IFDIR) ||
3515 	    ((sip->i_mode & IFMT) == IFATTRDIR)) && sdp != tdp) {
3516 		ino_t	inum;
3517 
3518 		if ((error = ufs_iaccess(sip, IWRITE, cr))) {
3519 			rw_exit(&sip->i_contents);
3520 			rw_exit(&sdp->i_contents);
3521 			goto errout;
3522 		}
3523 		inum = sip->i_number;
3524 		rw_exit(&sip->i_contents);
3525 		rw_exit(&sdp->i_contents);
3526 		if ((error = ufs_dircheckpath(inum, tdp, sdp, cr))) {
3527 			/*
3528 			 * If we got EAGAIN ufs_dircheckpath detected a
3529 			 * potential deadlock and backed out. We need
3530 			 * to retry the operation since sdp and tdp have
3531 			 * to be released to avoid the deadlock.
3532 			 */
3533 			if (error == EAGAIN) {
3534 				rw_exit(&tdp->i_rwlock);
3535 				if (tdp != sdp)
3536 					rw_exit(&sdp->i_rwlock);
3537 				delay(ufs_rename_backoff_delay);
3538 				ufs_rename_dircheck_retry_cnt++;
3539 				goto retry;
3540 			}
3541 			goto errout;
3542 		}
3543 	} else {
3544 		rw_exit(&sip->i_contents);
3545 		rw_exit(&sdp->i_contents);
3546 	}
3547 
3548 
3549 	/*
3550 	 * Check for renaming '.' or '..' or alias of '.'
3551 	 */
3552 	if (strcmp(snm, ".") == 0 || strcmp(snm, "..") == 0 || sdp == sip) {
3553 		error = EINVAL;
3554 		goto errout;
3555 	}
3556 
3557 	/*
3558 	 * Simultaneous renames can deadlock in ufs_dircheckpath since it
3559 	 * tries to traverse back the file tree with both tdp and sdp held
3560 	 * as RW_WRITER. To avoid that we have to hold the tdp and sdp locks
3561 	 * as RW_READERS  till ufs_dircheckpath is done.
3562 	 * Now that ufs_dircheckpath is done with, we can upgrade the locks
3563 	 * to RW_WRITER.
3564 	 */
3565 	if (!rw_tryupgrade(&tdp->i_rwlock)) {
3566 		/*
3567 		 * The upgrade failed. We got to give away the lock
3568 		 * as to avoid deadlocking with someone else who is
3569 		 * waiting for writer lock. With the lock gone, we
3570 		 * cannot be sure the checks done above will hold
3571 		 * good when we eventually get them back as writer.
3572 		 * So if we can't upgrade we drop the locks and retry
3573 		 * everything again.
3574 		 */
3575 		rw_exit(&tdp->i_rwlock);
3576 		if (tdp != sdp)
3577 			rw_exit(&sdp->i_rwlock);
3578 		delay(ufs_rename_backoff_delay);
3579 		ufs_rename_upgrade_retry_cnt++;
3580 		goto retry;
3581 	}
3582 	if (tdp != sdp) {
3583 		if (!rw_tryupgrade(&sdp->i_rwlock)) {
3584 			/*
3585 			 * The upgrade failed. We got to give away the lock
3586 			 * as to avoid deadlocking with someone else who is
3587 			 * waiting for writer lock. With the lock gone, we
3588 			 * cannot be sure the checks done above will hold
3589 			 * good when we eventually get them back as writer.
3590 			 * So if we can't upgrade we drop the locks and retry
3591 			 * everything again.
3592 			 */
3593 			rw_exit(&tdp->i_rwlock);
3594 			rw_exit(&sdp->i_rwlock);
3595 			delay(ufs_rename_backoff_delay);
3596 			ufs_rename_upgrade_retry_cnt++;
3597 			goto retry;
3598 		}
3599 	}
3600 
3601 	/*
3602 	 * Now that all the locks are held check to make sure another thread
3603 	 * didn't slip in and take out the sip.
3604 	 */
3605 	slot.status = NONE;
3606 	if ((sip->i_ctime.tv_usec * 1000) > now.tv_nsec ||
3607 	    sip->i_ctime.tv_sec > now.tv_sec) {
3608 		rw_enter(&sdp->i_ufsvfs->vfs_dqrwlock, RW_READER);
3609 		rw_enter(&sdp->i_contents, RW_WRITER);
3610 		error = ufs_dircheckforname(sdp, snm, strlen(snm), &slot,
3611 		    &ip, cr, 0);
3612 		rw_exit(&sdp->i_contents);
3613 		rw_exit(&sdp->i_ufsvfs->vfs_dqrwlock);
3614 		if (error) {
3615 			goto errout;
3616 		}
3617 		if (ip == NULL) {
3618 			error = ENOENT;
3619 			goto errout;
3620 		} else {
3621 			/*
3622 			 * If the inode was found need to drop the v_count
3623 			 * so as not to keep the filesystem from being
3624 			 * unmounted at a later time.
3625 			 */
3626 			VN_RELE(ITOV(ip));
3627 		}
3628 
3629 		/*
3630 		 * Release the slot.fbp that has the page mapped and
3631 		 * locked SE_SHARED, and could be used in in
3632 		 * ufs_direnter_lr() which needs to get the SE_EXCL lock
3633 		 * on said page.
3634 		 */
3635 		if (slot.fbp) {
3636 			fbrelse(slot.fbp, S_OTHER);
3637 			slot.fbp = NULL;
3638 		}
3639 	}
3640 
3641 	/*
3642 	 * Link source to the target.  If a target exists, return its
3643 	 * vnode pointer in tvp.  We'll release it after sending the
3644 	 * vnevent.
3645 	 */
3646 	if (error = ufs_direnter_lr(tdp, tnm, DE_RENAME, sdp, sip, cr, &tvp)) {
3647 		/*
3648 		 * ESAME isn't really an error; it indicates that the
3649 		 * operation should not be done because the source and target
3650 		 * are the same file, but that no error should be reported.
3651 		 */
3652 		if (error == ESAME)
3653 			error = 0;
3654 		goto errout;
3655 	}
3656 
3657 	/*
3658 	 * Unlink the source.
3659 	 * Remove the source entry.  ufs_dirremove() checks that the entry
3660 	 * still reflects sip, and returns an error if it doesn't.
3661 	 * If the entry has changed just forget about it.  Release
3662 	 * the source inode.
3663 	 */
3664 	if ((error = ufs_dirremove(sdp, snm, sip, (struct vnode *)0,
3665 	    DR_RENAME, cr, NULL)) == ENOENT)
3666 		error = 0;
3667 
3668 errout:
3669 	if (slot.fbp)
3670 		fbrelse(slot.fbp, S_OTHER);
3671 
3672 	rw_exit(&tdp->i_rwlock);
3673 	if (sdp != tdp) {
3674 		rw_exit(&sdp->i_rwlock);
3675 	}
3676 
3677 unlock:
3678 	if (ulp) {
3679 		TRANS_END_CSYNC(ufsvfsp, error, issync, TOP_RENAME, trans_size);
3680 		ufs_lockfs_end(ulp);
3681 	}
3682 
3683 	/*
3684 	 * If no errors, send the appropriate events on the source
3685 	 * and destination (a.k.a, target) vnodes, if they exist.
3686 	 * This has to be done after the rename transaction has closed.
3687 	 */
3688 	if (error == 0) {
3689 		if (tvp != NULL)
3690 			vnevent_rename_dest(tvp, tdvp, tnm, ct);
3691 
3692 		/*
3693 		 * Notify the target directory of the rename event
3694 		 * if source and target directories are not same.
3695 		 */
3696 		if (sdvp != tdvp)
3697 			vnevent_rename_dest_dir(tdvp, ct);
3698 
3699 		/*
3700 		 * Note that if ufs_direnter_lr() returned ESAME then
3701 		 * this event will still be sent.  This isn't expected
3702 		 * to be a problem for anticipated usage by consumers.
3703 		 */
3704 		if (sip != NULL)
3705 			vnevent_rename_src(ITOV(sip), sdvp, snm, ct);
3706 	}
3707 
3708 	if (tvp != NULL)
3709 		VN_RELE(tvp);
3710 
3711 	if (sip != NULL)
3712 		VN_RELE(ITOV(sip));
3713 
3714 out:
3715 	return (error);
3716 }
3717 
3718 /*ARGSUSED*/
3719 static int
3720 ufs_mkdir(struct vnode *dvp, char *dirname, struct vattr *vap,
3721 	struct vnode **vpp, struct cred *cr, caller_context_t *ct, int flags,
3722 	vsecattr_t *vsecp)
3723 {
3724 	struct inode *ip;
3725 	struct inode *xip;
3726 	struct ufsvfs *ufsvfsp;
3727 	struct ulockfs *ulp;
3728 	int error;
3729 	int issync;
3730 	int trans_size;
3731 	int indeadlock;
3732 	int retry = 1;
3733 
3734 	ASSERT((vap->va_mask & (AT_TYPE|AT_MODE)) == (AT_TYPE|AT_MODE));
3735 
3736 	/*
3737 	 * Can't make directory in attr hidden dir
3738 	 */
3739 	if ((VTOI(dvp)->i_mode & IFMT) == IFATTRDIR)
3740 		return (EINVAL);
3741 
3742 again:
3743 	ip = VTOI(dvp);
3744 	ufsvfsp = ip->i_ufsvfs;
3745 	error = ufs_lockfs_begin(ufsvfsp, &ulp, ULOCKFS_MKDIR_MASK);
3746 	if (error)
3747 		goto out;
3748 	if (ulp)
3749 		TRANS_BEGIN_CSYNC(ufsvfsp, issync, TOP_MKDIR,
3750 		    trans_size = (int)TOP_MKDIR_SIZE(ip));
3751 
3752 	/*
3753 	 * ufs_tryirwlock_trans uses rw_tryenter and checks for SLOCK
3754 	 * to avoid i_rwlock, ufs_lockfs_begin deadlock. If deadlock
3755 	 * possible, retries the operation.
3756 	 */
3757 	ufs_tryirwlock_trans(&ip->i_rwlock, RW_WRITER, TOP_MKDIR, retry);
3758 	if (indeadlock)
3759 		goto again;
3760 
3761 	error = ufs_direnter_cm(ip, dirname, DE_MKDIR, vap, &xip, cr,
3762 	    (retry ? IQUIET : 0));
3763 	if (error == EAGAIN) {
3764 		if (ulp) {
3765 			TRANS_END_CSYNC(ufsvfsp, error, issync, TOP_MKDIR,
3766 			    trans_size);
3767 			ufs_lockfs_end(ulp);
3768 		}
3769 		goto again;
3770 	}
3771 
3772 	rw_exit(&ip->i_rwlock);
3773 	if (error == 0) {
3774 		ip = xip;
3775 		*vpp = ITOV(ip);
3776 	} else if (error == EEXIST)
3777 		VN_RELE(ITOV(xip));
3778 
3779 	if (ulp) {
3780 		int terr = 0;
3781 		TRANS_END_CSYNC(ufsvfsp, terr, issync, TOP_MKDIR, trans_size);
3782 		ufs_lockfs_end(ulp);
3783 		if (error == 0)
3784 			error = terr;
3785 	}
3786 out:
3787 	if ((error == ENOSPC) && retry && TRANS_ISTRANS(ufsvfsp)) {
3788 		ufs_delete_drain_wait(ufsvfsp, 1);
3789 		retry = 0;
3790 		goto again;
3791 	}
3792 
3793 	return (error);
3794 }
3795 
3796 /*ARGSUSED*/
3797 static int
3798 ufs_rmdir(struct vnode *vp, char *nm, struct vnode *cdir, struct cred *cr,
3799 	caller_context_t *ct, int flags)
3800 {
3801 	struct inode *ip = VTOI(vp);
3802 	struct ufsvfs *ufsvfsp = ip->i_ufsvfs;
3803 	struct ulockfs *ulp;
3804 	vnode_t *rmvp = NULL;	/* Vnode of removed directory */
3805 	int error;
3806 	int issync;
3807 	int trans_size;
3808 	int indeadlock;
3809 
3810 	/*
3811 	 * don't let the delete queue get too long
3812 	 */
3813 	if (ufsvfsp == NULL) {
3814 		error = EIO;
3815 		goto out;
3816 	}
3817 	if (ufsvfsp->vfs_delete.uq_ne > ufs_idle_max)
3818 		ufs_delete_drain(vp->v_vfsp, 1, 1);
3819 
3820 retry_rmdir:
3821 	error = ufs_lockfs_begin(ufsvfsp, &ulp, ULOCKFS_RMDIR_MASK);
3822 	if (error)
3823 		goto out;
3824 
3825 	if (ulp)
3826 		TRANS_BEGIN_CSYNC(ufsvfsp, issync, TOP_RMDIR,
3827 		    trans_size = TOP_RMDIR_SIZE);
3828 
3829 	/*
3830 	 * ufs_tryirwlock_trans uses rw_tryenter and checks for SLOCK
3831 	 * to avoid i_rwlock, ufs_lockfs_begin deadlock. If deadlock
3832 	 * possible, retries the operation.
3833 	 */
3834 	ufs_tryirwlock_trans(&ip->i_rwlock, RW_WRITER, TOP_RMDIR, retry);
3835 	if (indeadlock)
3836 		goto retry_rmdir;
3837 	error = ufs_dirremove(ip, nm, (struct inode *)0, cdir, DR_RMDIR, cr,
3838 	    &rmvp);
3839 	rw_exit(&ip->i_rwlock);
3840 
3841 	if (ulp) {
3842 		TRANS_END_CSYNC(ufsvfsp, error, issync, TOP_RMDIR,
3843 		    trans_size);
3844 		ufs_lockfs_end(ulp);
3845 	}
3846 
3847 	/*
3848 	 * This must be done AFTER the rmdir transaction has closed.
3849 	 */
3850 	if (rmvp != NULL) {
3851 		/* Only send the event if there were no errors */
3852 		if (error == 0)
3853 			vnevent_rmdir(rmvp, vp, nm, ct);
3854 		VN_RELE(rmvp);
3855 	}
3856 out:
3857 	return (error);
3858 }
3859 
3860 /* ARGSUSED */
3861 static int
3862 ufs_readdir(
3863 	struct vnode *vp,
3864 	struct uio *uiop,
3865 	struct cred *cr,
3866 	int *eofp,
3867 	caller_context_t *ct,
3868 	int flags)
3869 {
3870 	struct iovec *iovp;
3871 	struct inode *ip;
3872 	struct direct *idp;
3873 	struct dirent64 *odp;
3874 	struct fbuf *fbp;
3875 	struct ufsvfs *ufsvfsp;
3876 	struct ulockfs *ulp;
3877 	caddr_t outbuf;
3878 	size_t bufsize;
3879 	uint_t offset;
3880 	uint_t bytes_wanted, total_bytes_wanted;
3881 	int incount = 0;
3882 	int outcount = 0;
3883 	int error;
3884 
3885 	ip = VTOI(vp);
3886 	ASSERT(RW_READ_HELD(&ip->i_rwlock));
3887 
3888 	if (uiop->uio_loffset >= MAXOFF32_T) {
3889 		if (eofp)
3890 			*eofp = 1;
3891 		return (0);
3892 	}
3893 
3894 	/*
3895 	 * Check if we have been called with a valid iov_len
3896 	 * and bail out if not, otherwise we may potentially loop
3897 	 * forever further down.
3898 	 */
3899 	if (uiop->uio_iov->iov_len <= 0) {
3900 		error = EINVAL;
3901 		goto out;
3902 	}
3903 
3904 	/*
3905 	 * Large Files: When we come here we are guaranteed that
3906 	 * uio_offset can be used safely. The high word is zero.
3907 	 */
3908 
3909 	ufsvfsp = ip->i_ufsvfs;
3910 	error = ufs_lockfs_begin(ufsvfsp, &ulp, ULOCKFS_READDIR_MASK);
3911 	if (error)
3912 		goto out;
3913 
3914 	iovp = uiop->uio_iov;
3915 	total_bytes_wanted = iovp->iov_len;
3916 
3917 	/* Large Files: directory files should not be "large" */
3918 
3919 	ASSERT(ip->i_size <= MAXOFF32_T);
3920 
3921 	/* Force offset to be valid (to guard against bogus lseek() values) */
3922 	offset = (uint_t)uiop->uio_offset & ~(DIRBLKSIZ - 1);
3923 
3924 	/* Quit if at end of file or link count of zero (posix) */
3925 	if (offset >= (uint_t)ip->i_size || ip->i_nlink <= 0) {
3926 		if (eofp)
3927 			*eofp = 1;
3928 		error = 0;
3929 		goto unlock;
3930 	}
3931 
3932 	/*
3933 	 * Get space to change directory entries into fs independent format.
3934 	 * Do fast alloc for the most commonly used-request size (filesystem
3935 	 * block size).
3936 	 */
3937 	if (uiop->uio_segflg != UIO_SYSSPACE || uiop->uio_iovcnt != 1) {
3938 		bufsize = total_bytes_wanted;
3939 		outbuf = kmem_alloc(bufsize, KM_SLEEP);
3940 		odp = (struct dirent64 *)outbuf;
3941 	} else {
3942 		bufsize = total_bytes_wanted;
3943 		odp = (struct dirent64 *)iovp->iov_base;
3944 	}
3945 
3946 nextblk:
3947 	bytes_wanted = total_bytes_wanted;
3948 
3949 	/* Truncate request to file size */
3950 	if (offset + bytes_wanted > (int)ip->i_size)
3951 		bytes_wanted = (int)(ip->i_size - offset);
3952 
3953 	/* Comply with MAXBSIZE boundary restrictions of fbread() */
3954 	if ((offset & MAXBOFFSET) + bytes_wanted > MAXBSIZE)
3955 		bytes_wanted = MAXBSIZE - (offset & MAXBOFFSET);
3956 
3957 	/*
3958 	 * Read in the next chunk.
3959 	 * We are still holding the i_rwlock.
3960 	 */
3961 	error = fbread(vp, (offset_t)offset, bytes_wanted, S_OTHER, &fbp);
3962 
3963 	if (error)
3964 		goto update_inode;
3965 	if (!ULOCKFS_IS_NOIACC(ITOUL(ip)) && (ip->i_fs->fs_ronly == 0) &&
3966 	    (!ufsvfsp->vfs_noatime)) {
3967 		ip->i_flag |= IACC;
3968 	}
3969 	incount = 0;
3970 	idp = (struct direct *)fbp->fb_addr;
3971 	if (idp->d_ino == 0 && idp->d_reclen == 0 && idp->d_namlen == 0) {
3972 		cmn_err(CE_WARN, "ufs_readdir: bad dir, inumber = %llu, "
3973 		    "fs = %s\n",
3974 		    (u_longlong_t)ip->i_number, ufsvfsp->vfs_fs->fs_fsmnt);
3975 		fbrelse(fbp, S_OTHER);
3976 		error = ENXIO;
3977 		goto update_inode;
3978 	}
3979 	/* Transform to file-system independent format */
3980 	while (incount < bytes_wanted) {
3981 		/*
3982 		 * If the current directory entry is mangled, then skip
3983 		 * to the next block.  It would be nice to set the FSBAD
3984 		 * flag in the super-block so that a fsck is forced on
3985 		 * next reboot, but locking is a problem.
3986 		 */
3987 		if (idp->d_reclen & 0x3) {
3988 			offset = (offset + DIRBLKSIZ) & ~(DIRBLKSIZ-1);
3989 			break;
3990 		}
3991 
3992 		/* Skip to requested offset and skip empty entries */
3993 		if (idp->d_ino != 0 && offset >= (uint_t)uiop->uio_offset) {
3994 			ushort_t this_reclen =
3995 			    DIRENT64_RECLEN(idp->d_namlen);
3996 			/* Buffer too small for any entries */
3997 			if (!outcount && this_reclen > bufsize) {
3998 				fbrelse(fbp, S_OTHER);
3999 				error = EINVAL;
4000 				goto update_inode;
4001 			}
4002 			/* If would overrun the buffer, quit */
4003 			if (outcount + this_reclen > bufsize) {
4004 				break;
4005 			}
4006 			/* Take this entry */
4007 			odp->d_ino = (ino64_t)idp->d_ino;
4008 			odp->d_reclen = (ushort_t)this_reclen;
4009 			odp->d_off = (offset_t)(offset + idp->d_reclen);
4010 
4011 			/* use strncpy(9f) to zero out uninitialized bytes */
4012 
4013 			ASSERT(strlen(idp->d_name) + 1 <=
4014 			    DIRENT64_NAMELEN(this_reclen));
4015 			(void) strncpy(odp->d_name, idp->d_name,
4016 			    DIRENT64_NAMELEN(this_reclen));
4017 			outcount += odp->d_reclen;
4018 			odp = (struct dirent64 *)
4019 			    ((intptr_t)odp + odp->d_reclen);
4020 			ASSERT(outcount <= bufsize);
4021 		}
4022 		if (idp->d_reclen) {
4023 			incount += idp->d_reclen;
4024 			offset += idp->d_reclen;
4025 			idp = (struct direct *)((intptr_t)idp + idp->d_reclen);
4026 		} else {
4027 			offset = (offset + DIRBLKSIZ) & ~(DIRBLKSIZ-1);
4028 			break;
4029 		}
4030 	}
4031 	/* Release the chunk */
4032 	fbrelse(fbp, S_OTHER);
4033 
4034 	/* Read whole block, but got no entries, read another if not eof */
4035 
4036 	/*
4037 	 * Large Files: casting i_size to int here is not a problem
4038 	 * because directory sizes are always less than MAXOFF32_T.
4039 	 * See assertion above.
4040 	 */
4041 
4042 	if (offset < (int)ip->i_size && !outcount)
4043 		goto nextblk;
4044 
4045 	/* Copy out the entry data */
4046 	if (uiop->uio_segflg == UIO_SYSSPACE && uiop->uio_iovcnt == 1) {
4047 		iovp->iov_base += outcount;
4048 		iovp->iov_len -= outcount;
4049 		uiop->uio_resid -= outcount;
4050 		uiop->uio_offset = offset;
4051 	} else if ((error = uiomove(outbuf, (long)outcount, UIO_READ,
4052 	    uiop)) == 0)
4053 		uiop->uio_offset = offset;
4054 update_inode:
4055 	ITIMES(ip);
4056 	if (uiop->uio_segflg != UIO_SYSSPACE || uiop->uio_iovcnt != 1)
4057 		kmem_free(outbuf, bufsize);
4058 
4059 	if (eofp && error == 0)
4060 		*eofp = (uiop->uio_offset >= (int)ip->i_size);
4061 unlock:
4062 	if (ulp) {
4063 		ufs_lockfs_end(ulp);
4064 	}
4065 out:
4066 	return (error);
4067 }
4068 
4069 /*ARGSUSED*/
4070 static int
4071 ufs_symlink(
4072 	struct vnode *dvp,		/* ptr to parent dir vnode */
4073 	char *linkname,			/* name of symbolic link */
4074 	struct vattr *vap,		/* attributes */
4075 	char *target,			/* target path */
4076 	struct cred *cr,		/* user credentials */
4077 	caller_context_t *ct,
4078 	int flags)
4079 {
4080 	struct inode *ip, *dip = VTOI(dvp);
4081 	struct ufsvfs *ufsvfsp = dip->i_ufsvfs;
4082 	struct ulockfs *ulp;
4083 	int error;
4084 	int issync;
4085 	int trans_size;
4086 	int residual;
4087 	int ioflag;
4088 	int retry = 1;
4089 
4090 	/*
4091 	 * No symlinks in attrdirs at this time
4092 	 */
4093 	if ((VTOI(dvp)->i_mode & IFMT) == IFATTRDIR)
4094 		return (EINVAL);
4095 
4096 again:
4097 	ip = (struct inode *)NULL;
4098 	vap->va_type = VLNK;
4099 	vap->va_rdev = 0;
4100 
4101 	error = ufs_lockfs_begin(ufsvfsp, &ulp, ULOCKFS_SYMLINK_MASK);
4102 	if (error)
4103 		goto out;
4104 
4105 	if (ulp)
4106 		TRANS_BEGIN_CSYNC(ufsvfsp, issync, TOP_SYMLINK,
4107 		    trans_size = (int)TOP_SYMLINK_SIZE(dip));
4108 
4109 	/*
4110 	 * We must create the inode before the directory entry, to avoid
4111 	 * racing with readlink().  ufs_dirmakeinode requires that we
4112 	 * hold the quota lock as reader, and directory locks as writer.
4113 	 */
4114 
4115 	rw_enter(&dip->i_rwlock, RW_WRITER);
4116 	rw_enter(&ufsvfsp->vfs_dqrwlock, RW_READER);
4117 	rw_enter(&dip->i_contents, RW_WRITER);
4118 
4119 	/*
4120 	 * Suppress any out of inodes messages if we will retry on
4121 	 * ENOSP
4122 	 */
4123 	if (retry)
4124 		dip->i_flag |= IQUIET;
4125 
4126 	error = ufs_dirmakeinode(dip, &ip, vap, DE_SYMLINK, cr);
4127 
4128 	dip->i_flag &= ~IQUIET;
4129 
4130 	rw_exit(&dip->i_contents);
4131 	rw_exit(&ufsvfsp->vfs_dqrwlock);
4132 	rw_exit(&dip->i_rwlock);
4133 
4134 	if (error)
4135 		goto unlock;
4136 
4137 	/*
4138 	 * OK.  The inode has been created.  Write out the data of the
4139 	 * symbolic link.  Since symbolic links are metadata, and should
4140 	 * remain consistent across a system crash, we need to force the
4141 	 * data out synchronously.
4142 	 *
4143 	 * (This is a change from the semantics in earlier releases, which
4144 	 * only created symbolic links synchronously if the semi-documented
4145 	 * 'syncdir' option was set, or if we were being invoked by the NFS
4146 	 * server, which requires symbolic links to be created synchronously.)
4147 	 *
4148 	 * We need to pass in a pointer for the residual length; otherwise
4149 	 * ufs_rdwri() will always return EIO if it can't write the data,
4150 	 * even if the error was really ENOSPC or EDQUOT.
4151 	 */
4152 
4153 	ioflag = FWRITE | FDSYNC;
4154 	residual = 0;
4155 
4156 	rw_enter(&ufsvfsp->vfs_dqrwlock, RW_READER);
4157 	rw_enter(&ip->i_contents, RW_WRITER);
4158 
4159 	/*
4160 	 * Suppress file system full messages if we will retry
4161 	 */
4162 	if (retry)
4163 		ip->i_flag |= IQUIET;
4164 
4165 	error = ufs_rdwri(UIO_WRITE, ioflag, ip, target, strlen(target),
4166 	    (offset_t)0, UIO_SYSSPACE, &residual, cr);
4167 
4168 	ip->i_flag &= ~IQUIET;
4169 
4170 	if (error) {
4171 		rw_exit(&ip->i_contents);
4172 		rw_exit(&ufsvfsp->vfs_dqrwlock);
4173 		goto remove;
4174 	}
4175 
4176 	/*
4177 	 * If the link's data is small enough, we can cache it in the inode.
4178 	 * This is a "fast symbolic link".  We don't use the first direct
4179 	 * block because that's actually used to point at the symbolic link's
4180 	 * contents on disk; but we know that none of the other direct or
4181 	 * indirect blocks can be used because symbolic links are restricted
4182 	 * to be smaller than a file system block.
4183 	 */
4184 
4185 	ASSERT(MAXPATHLEN <= VBSIZE(ITOV(ip)));
4186 
4187 	if (ip->i_size > 0 && ip->i_size <= FSL_SIZE) {
4188 		if (kcopy(target, &ip->i_db[1], ip->i_size) == 0) {
4189 			ip->i_flag |= IFASTSYMLNK;
4190 		} else {
4191 			int i;
4192 			/* error, clear garbage left behind */
4193 			for (i = 1; i < NDADDR; i++)
4194 				ip->i_db[i] = 0;
4195 			for (i = 0; i < NIADDR; i++)
4196 				ip->i_ib[i] = 0;
4197 		}
4198 	}
4199 
4200 	rw_exit(&ip->i_contents);
4201 	rw_exit(&ufsvfsp->vfs_dqrwlock);
4202 
4203 	/*
4204 	 * OK.  We've successfully created the symbolic link.  All that
4205 	 * remains is to insert it into the appropriate directory.
4206 	 */
4207 
4208 	rw_enter(&dip->i_rwlock, RW_WRITER);
4209 	error = ufs_direnter_lr(dip, linkname, DE_SYMLINK, NULL, ip, cr, NULL);
4210 	rw_exit(&dip->i_rwlock);
4211 
4212 	/*
4213 	 * Fall through into remove-on-error code.  We're either done, or we
4214 	 * need to remove the inode (if we couldn't insert it).
4215 	 */
4216 
4217 remove:
4218 	if (error && (ip != NULL)) {
4219 		rw_enter(&ip->i_contents, RW_WRITER);
4220 		ip->i_nlink--;
4221 		ip->i_flag |= ICHG;
4222 		ip->i_seq++;
4223 		ufs_setreclaim(ip);
4224 		rw_exit(&ip->i_contents);
4225 	}
4226 
4227 unlock:
4228 	if (ip != NULL)
4229 		VN_RELE(ITOV(ip));
4230 
4231 	if (ulp) {
4232 		int terr = 0;
4233 
4234 		TRANS_END_CSYNC(ufsvfsp, terr, issync, TOP_SYMLINK,
4235 		    trans_size);
4236 		ufs_lockfs_end(ulp);
4237 		if (error == 0)
4238 			error = terr;
4239 	}
4240 
4241 	/*
4242 	 * We may have failed due to lack of an inode or of a block to
4243 	 * store the target in.  Try flushing the delete queue to free
4244 	 * logically-available things up and try again.
4245 	 */
4246 	if ((error == ENOSPC) && retry && TRANS_ISTRANS(ufsvfsp)) {
4247 		ufs_delete_drain_wait(ufsvfsp, 1);
4248 		retry = 0;
4249 		goto again;
4250 	}
4251 
4252 out:
4253 	return (error);
4254 }
4255 
4256 /*
4257  * Ufs specific routine used to do ufs io.
4258  */
4259 int
4260 ufs_rdwri(enum uio_rw rw, int ioflag, struct inode *ip, caddr_t base,
4261 	ssize_t len, offset_t offset, enum uio_seg seg, int *aresid,
4262 	struct cred *cr)
4263 {
4264 	struct uio auio;
4265 	struct iovec aiov;
4266 	int error;
4267 
4268 	ASSERT(RW_LOCK_HELD(&ip->i_contents));
4269 
4270 	bzero((caddr_t)&auio, sizeof (uio_t));
4271 	bzero((caddr_t)&aiov, sizeof (iovec_t));
4272 
4273 	aiov.iov_base = base;
4274 	aiov.iov_len = len;
4275 	auio.uio_iov = &aiov;
4276 	auio.uio_iovcnt = 1;
4277 	auio.uio_loffset = offset;
4278 	auio.uio_segflg = (short)seg;
4279 	auio.uio_resid = len;
4280 
4281 	if (rw == UIO_WRITE) {
4282 		auio.uio_fmode = FWRITE;
4283 		auio.uio_extflg = UIO_COPY_DEFAULT;
4284 		auio.uio_llimit = curproc->p_fsz_ctl;
4285 		error = wrip(ip, &auio, ioflag, cr);
4286 	} else {
4287 		auio.uio_fmode = FREAD;
4288 		auio.uio_extflg = UIO_COPY_CACHED;
4289 		auio.uio_llimit = MAXOFFSET_T;
4290 		error = rdip(ip, &auio, ioflag, cr);
4291 	}
4292 
4293 	if (aresid) {
4294 		*aresid = auio.uio_resid;
4295 	} else if (auio.uio_resid) {
4296 		error = EIO;
4297 	}
4298 	return (error);
4299 }
4300 
4301 /*ARGSUSED*/
4302 static int
4303 ufs_fid(struct vnode *vp, struct fid *fidp, caller_context_t *ct)
4304 {
4305 	struct ufid *ufid;
4306 	struct inode *ip = VTOI(vp);
4307 
4308 	if (ip->i_ufsvfs == NULL)
4309 		return (EIO);
4310 
4311 	if (fidp->fid_len < (sizeof (struct ufid) - sizeof (ushort_t))) {
4312 		fidp->fid_len = sizeof (struct ufid) - sizeof (ushort_t);
4313 		return (ENOSPC);
4314 	}
4315 
4316 	ufid = (struct ufid *)fidp;
4317 	bzero((char *)ufid, sizeof (struct ufid));
4318 	ufid->ufid_len = sizeof (struct ufid) - sizeof (ushort_t);
4319 	ufid->ufid_ino = ip->i_number;
4320 	ufid->ufid_gen = ip->i_gen;
4321 
4322 	return (0);
4323 }
4324 
4325 /* ARGSUSED2 */
4326 static int
4327 ufs_rwlock(struct vnode *vp, int write_lock, caller_context_t *ctp)
4328 {
4329 	struct inode	*ip = VTOI(vp);
4330 	struct ufsvfs	*ufsvfsp;
4331 	int		forcedirectio;
4332 
4333 	/*
4334 	 * Read case is easy.
4335 	 */
4336 	if (!write_lock) {
4337 		rw_enter(&ip->i_rwlock, RW_READER);
4338 		return (V_WRITELOCK_FALSE);
4339 	}
4340 
4341 	/*
4342 	 * Caller has requested a writer lock, but that inhibits any
4343 	 * concurrency in the VOPs that follow. Acquire the lock shared
4344 	 * and defer exclusive access until it is known to be needed in
4345 	 * other VOP handlers. Some cases can be determined here.
4346 	 */
4347 
4348 	/*
4349 	 * If directio is not set, there is no chance of concurrency,
4350 	 * so just acquire the lock exclusive. Beware of a forced
4351 	 * unmount before looking at the mount option.
4352 	 */
4353 	ufsvfsp = ip->i_ufsvfs;
4354 	forcedirectio = ufsvfsp ? ufsvfsp->vfs_forcedirectio : 0;
4355 	if (!(ip->i_flag & IDIRECTIO || forcedirectio) ||
4356 	    !ufs_allow_shared_writes) {
4357 		rw_enter(&ip->i_rwlock, RW_WRITER);
4358 		return (V_WRITELOCK_TRUE);
4359 	}
4360 
4361 	/*
4362 	 * Mandatory locking forces acquiring i_rwlock exclusive.
4363 	 */
4364 	if (MANDLOCK(vp, ip->i_mode)) {
4365 		rw_enter(&ip->i_rwlock, RW_WRITER);
4366 		return (V_WRITELOCK_TRUE);
4367 	}
4368 
4369 	/*
4370 	 * Acquire the lock shared in case a concurrent write follows.
4371 	 * Mandatory locking could have become enabled before the lock
4372 	 * was acquired. Re-check and upgrade if needed.
4373 	 */
4374 	rw_enter(&ip->i_rwlock, RW_READER);
4375 	if (MANDLOCK(vp, ip->i_mode)) {
4376 		rw_exit(&ip->i_rwlock);
4377 		rw_enter(&ip->i_rwlock, RW_WRITER);
4378 		return (V_WRITELOCK_TRUE);
4379 	}
4380 	return (V_WRITELOCK_FALSE);
4381 }
4382 
4383 /*ARGSUSED*/
4384 static void
4385 ufs_rwunlock(struct vnode *vp, int write_lock, caller_context_t *ctp)
4386 {
4387 	struct inode	*ip = VTOI(vp);
4388 
4389 	rw_exit(&ip->i_rwlock);
4390 }
4391 
4392 /* ARGSUSED */
4393 static int
4394 ufs_seek(struct vnode *vp, offset_t ooff, offset_t *noffp,
4395 	caller_context_t *ct)
4396 {
4397 	return ((*noffp < 0 || *noffp > MAXOFFSET_T) ? EINVAL : 0);
4398 }
4399 
4400 /* ARGSUSED */
4401 static int
4402 ufs_frlock(struct vnode *vp, int cmd, struct flock64 *bfp, int flag,
4403 	offset_t offset, struct flk_callback *flk_cbp, struct cred *cr,
4404 	caller_context_t *ct)
4405 {
4406 	struct inode *ip = VTOI(vp);
4407 
4408 	if (ip->i_ufsvfs == NULL)
4409 		return (EIO);
4410 
4411 	/*
4412 	 * If file is being mapped, disallow frlock.
4413 	 * XXX I am not holding tlock while checking i_mapcnt because the
4414 	 * current locking strategy drops all locks before calling fs_frlock.
4415 	 * So, mapcnt could change before we enter fs_frlock making is
4416 	 * meaningless to have held tlock in the first place.
4417 	 */
4418 	if (ip->i_mapcnt > 0 && MANDLOCK(vp, ip->i_mode))
4419 		return (EAGAIN);
4420 	return (fs_frlock(vp, cmd, bfp, flag, offset, flk_cbp, cr, ct));
4421 }
4422 
4423 /* ARGSUSED */
4424 static int
4425 ufs_space(struct vnode *vp, int cmd, struct flock64 *bfp, int flag,
4426 	offset_t offset, cred_t *cr, caller_context_t *ct)
4427 {
4428 	struct ufsvfs *ufsvfsp = VTOI(vp)->i_ufsvfs;
4429 	struct ulockfs *ulp;
4430 	int error;
4431 
4432 	if ((error = convoff(vp, bfp, 0, offset)) == 0) {
4433 		if (cmd == F_FREESP) {
4434 			error = ufs_lockfs_begin(ufsvfsp, &ulp,
4435 			    ULOCKFS_SPACE_MASK);
4436 			if (error)
4437 				return (error);
4438 			error = ufs_freesp(vp, bfp, flag, cr);
4439 		} else if (cmd == F_ALLOCSP) {
4440 			error = ufs_lockfs_begin(ufsvfsp, &ulp,
4441 			    ULOCKFS_FALLOCATE_MASK);
4442 			if (error)
4443 				return (error);
4444 			error = ufs_allocsp(vp, bfp, cr);
4445 		} else
4446 			return (EINVAL); /* Command not handled here */
4447 
4448 		if (ulp)
4449 			ufs_lockfs_end(ulp);
4450 
4451 	}
4452 	return (error);
4453 }
4454 
4455 /*
4456  * Used to determine if read ahead should be done. Also used to
4457  * to determine when write back occurs.
4458  */
4459 #define	CLUSTSZ(ip)		((ip)->i_ufsvfs->vfs_ioclustsz)
4460 
4461 /*
4462  * A faster version of ufs_getpage.
4463  *
4464  * We optimize by inlining the pvn_getpages iterator, eliminating
4465  * calls to bmap_read if file doesn't have UFS holes, and avoiding
4466  * the overhead of page_exists().
4467  *
4468  * When files has UFS_HOLES and ufs_getpage is called with S_READ,
4469  * we set *protp to PROT_READ to avoid calling bmap_read. This approach
4470  * victimizes performance when a file with UFS holes is faulted
4471  * first in the S_READ mode, and then in the S_WRITE mode. We will get
4472  * two MMU faults in this case.
4473  *
4474  * XXX - the inode fields which control the sequential mode are not
4475  *	 protected by any mutex. The read ahead will act wild if
4476  *	 multiple processes will access the file concurrently and
4477  *	 some of them in sequential mode. One particulary bad case
4478  *	 is if another thread will change the value of i_nextrio between
4479  *	 the time this thread tests the i_nextrio value and then reads it
4480  *	 again to use it as the offset for the read ahead.
4481  */
4482 /*ARGSUSED*/
4483 static int
4484 ufs_getpage(struct vnode *vp, offset_t off, size_t len, uint_t *protp,
4485 	page_t *plarr[], size_t plsz, struct seg *seg, caddr_t addr,
4486 	enum seg_rw rw, struct cred *cr, caller_context_t *ct)
4487 {
4488 	u_offset_t	uoff = (u_offset_t)off; /* type conversion */
4489 	u_offset_t	pgoff;
4490 	u_offset_t	eoff;
4491 	struct inode 	*ip = VTOI(vp);
4492 	struct ufsvfs	*ufsvfsp = ip->i_ufsvfs;
4493 	struct fs 	*fs;
4494 	struct ulockfs	*ulp;
4495 	page_t		**pl;
4496 	caddr_t		pgaddr;
4497 	krw_t		rwtype;
4498 	int 		err;
4499 	int		has_holes;
4500 	int		beyond_eof;
4501 	int		seqmode;
4502 	int		pgsize = PAGESIZE;
4503 	int		dolock;
4504 	int		do_qlock;
4505 	int		trans_size;
4506 
4507 	ASSERT((uoff & PAGEOFFSET) == 0);
4508 
4509 	if (protp)
4510 		*protp = PROT_ALL;
4511 
4512 	/*
4513 	 * Obey the lockfs protocol
4514 	 */
4515 	err = ufs_lockfs_begin_getpage(ufsvfsp, &ulp, seg,
4516 	    rw == S_READ || rw == S_EXEC, protp);
4517 	if (err)
4518 		goto out;
4519 
4520 	fs = ufsvfsp->vfs_fs;
4521 
4522 	if (ulp && (rw == S_CREATE || rw == S_WRITE) &&
4523 	    !(vp->v_flag & VISSWAP)) {
4524 		/*
4525 		 * Try to start a transaction, will return if blocking is
4526 		 * expected to occur and the address space is not the
4527 		 * kernel address space.
4528 		 */
4529 		trans_size = TOP_GETPAGE_SIZE(ip);
4530 		if (seg->s_as != &kas) {
4531 			TRANS_TRY_BEGIN_ASYNC(ufsvfsp, TOP_GETPAGE,
4532 			    trans_size, err)
4533 			if (err == EWOULDBLOCK) {
4534 				/*
4535 				 * Use EDEADLK here because the VM code
4536 				 * can normally never see this error.
4537 				 */
4538 				err = EDEADLK;
4539 				ufs_lockfs_end(ulp);
4540 				goto out;
4541 			}
4542 		} else {
4543 			TRANS_BEGIN_ASYNC(ufsvfsp, TOP_GETPAGE, trans_size);
4544 		}
4545 	}
4546 
4547 	if (vp->v_flag & VNOMAP) {
4548 		err = ENOSYS;
4549 		goto unlock;
4550 	}
4551 
4552 	seqmode = ip->i_nextr == uoff && rw != S_CREATE;
4553 
4554 	rwtype = RW_READER;		/* start as a reader */
4555 	dolock = (rw_owner(&ip->i_contents) != curthread);
4556 	/*
4557 	 * If this thread owns the lock, i.e., this thread grabbed it
4558 	 * as writer somewhere above, then we don't need to grab the
4559 	 * lock as reader in this routine.
4560 	 */
4561 	do_qlock = (rw_owner(&ufsvfsp->vfs_dqrwlock) != curthread);
4562 
4563 retrylock:
4564 	if (dolock) {
4565 		/*
4566 		 * Grab the quota lock if we need to call
4567 		 * bmap_write() below (with i_contents as writer).
4568 		 */
4569 		if (do_qlock && rwtype == RW_WRITER)
4570 			rw_enter(&ufsvfsp->vfs_dqrwlock, RW_READER);
4571 		rw_enter(&ip->i_contents, rwtype);
4572 	}
4573 
4574 	/*
4575 	 * We may be getting called as a side effect of a bmap using
4576 	 * fbread() when the blocks might be being allocated and the
4577 	 * size has not yet been up'ed.  In this case we want to be
4578 	 * able to return zero pages if we get back UFS_HOLE from
4579 	 * calling bmap for a non write case here.  We also might have
4580 	 * to read some frags from the disk into a page if we are
4581 	 * extending the number of frags for a given lbn in bmap().
4582 	 * Large Files: The read of i_size here is atomic because
4583 	 * i_contents is held here. If dolock is zero, the lock
4584 	 * is held in bmap routines.
4585 	 */
4586 	beyond_eof = uoff + len >
4587 	    P2ROUNDUP_TYPED(ip->i_size, PAGESIZE, u_offset_t);
4588 	if (beyond_eof && seg != segkmap) {
4589 		if (dolock) {
4590 			rw_exit(&ip->i_contents);
4591 			if (do_qlock && rwtype == RW_WRITER)
4592 				rw_exit(&ufsvfsp->vfs_dqrwlock);
4593 		}
4594 		err = EFAULT;
4595 		goto unlock;
4596 	}
4597 
4598 	/*
4599 	 * Must hold i_contents lock throughout the call to pvn_getpages
4600 	 * since locked pages are returned from each call to ufs_getapage.
4601 	 * Must *not* return locked pages and then try for contents lock
4602 	 * due to lock ordering requirements (inode > page)
4603 	 */
4604 
4605 	has_holes = bmap_has_holes(ip);
4606 
4607 	if ((rw == S_WRITE || rw == S_CREATE) && has_holes && !beyond_eof) {
4608 		int	blk_size;
4609 		u_offset_t offset;
4610 
4611 		/*
4612 		 * We must acquire the RW_WRITER lock in order to
4613 		 * call bmap_write().
4614 		 */
4615 		if (dolock && rwtype == RW_READER) {
4616 			rwtype = RW_WRITER;
4617 
4618 			/*
4619 			 * Grab the quota lock before
4620 			 * upgrading i_contents, but if we can't grab it
4621 			 * don't wait here due to lock order:
4622 			 * vfs_dqrwlock > i_contents.
4623 			 */
4624 			if (do_qlock &&
4625 			    rw_tryenter(&ufsvfsp->vfs_dqrwlock, RW_READER)
4626 			    == 0) {
4627 				rw_exit(&ip->i_contents);
4628 				goto retrylock;
4629 			}
4630 			if (!rw_tryupgrade(&ip->i_contents)) {
4631 				rw_exit(&ip->i_contents);
4632 				if (do_qlock)
4633 					rw_exit(&ufsvfsp->vfs_dqrwlock);
4634 				goto retrylock;
4635 			}
4636 		}
4637 
4638 		/*
4639 		 * May be allocating disk blocks for holes here as
4640 		 * a result of mmap faults. write(2) does the bmap_write
4641 		 * in rdip/wrip, not here. We are not dealing with frags
4642 		 * in this case.
4643 		 */
4644 		/*
4645 		 * Large Files: We cast fs_bmask field to offset_t
4646 		 * just as we do for MAXBMASK because uoff is a 64-bit
4647 		 * data type. fs_bmask will still be a 32-bit type
4648 		 * as we cannot change any ondisk data structures.
4649 		 */
4650 
4651 		offset = uoff & (offset_t)fs->fs_bmask;
4652 		while (offset < uoff + len) {
4653 			blk_size = (int)blksize(fs, ip, lblkno(fs, offset));
4654 			err = bmap_write(ip, offset, blk_size,
4655 			    BI_NORMAL, NULL, cr);
4656 			if (ip->i_flag & (ICHG|IUPD))
4657 				ip->i_seq++;
4658 			if (err)
4659 				goto update_inode;
4660 			offset += blk_size; /* XXX - make this contig */
4661 		}
4662 	}
4663 
4664 	/*
4665 	 * Can be a reader from now on.
4666 	 */
4667 	if (dolock && rwtype == RW_WRITER) {
4668 		rw_downgrade(&ip->i_contents);
4669 		/*
4670 		 * We can release vfs_dqrwlock early so do it, but make
4671 		 * sure we don't try to release it again at the bottom.
4672 		 */
4673 		if (do_qlock) {
4674 			rw_exit(&ufsvfsp->vfs_dqrwlock);
4675 			do_qlock = 0;
4676 		}
4677 	}
4678 
4679 	/*
4680 	 * We remove PROT_WRITE in cases when the file has UFS holes
4681 	 * because we don't  want to call bmap_read() to check each
4682 	 * page if it is backed with a disk block.
4683 	 */
4684 	if (protp && has_holes && rw != S_WRITE && rw != S_CREATE)
4685 		*protp &= ~PROT_WRITE;
4686 
4687 	err = 0;
4688 
4689 	/*
4690 	 * The loop looks up pages in the range [off, off + len).
4691 	 * For each page, we first check if we should initiate an asynchronous
4692 	 * read ahead before we call page_lookup (we may sleep in page_lookup
4693 	 * for a previously initiated disk read).
4694 	 */
4695 	eoff = (uoff + len);
4696 	for (pgoff = uoff, pgaddr = addr, pl = plarr;
4697 	    pgoff < eoff; /* empty */) {
4698 		page_t	*pp;
4699 		u_offset_t	nextrio;
4700 		se_t	se;
4701 		int retval;
4702 
4703 		se = ((rw == S_CREATE || rw == S_OTHER) ? SE_EXCL : SE_SHARED);
4704 
4705 		/* Handle async getpage (faultahead) */
4706 		if (plarr == NULL) {
4707 			ip->i_nextrio = pgoff;
4708 			(void) ufs_getpage_ra(vp, pgoff, seg, pgaddr);
4709 			pgoff += pgsize;
4710 			pgaddr += pgsize;
4711 			continue;
4712 		}
4713 		/*
4714 		 * Check if we should initiate read ahead of next cluster.
4715 		 * We call page_exists only when we need to confirm that
4716 		 * we have the current page before we initiate the read ahead.
4717 		 */
4718 		nextrio = ip->i_nextrio;
4719 		if (seqmode &&
4720 		    pgoff + CLUSTSZ(ip) >= nextrio && pgoff <= nextrio &&
4721 		    nextrio < ip->i_size && page_exists(vp, pgoff)) {
4722 			retval = ufs_getpage_ra(vp, pgoff, seg, pgaddr);
4723 			/*
4724 			 * We always read ahead the next cluster of data
4725 			 * starting from i_nextrio. If the page (vp,nextrio)
4726 			 * is actually in core at this point, the routine
4727 			 * ufs_getpage_ra() will stop pre-fetching data
4728 			 * until we read that page in a synchronized manner
4729 			 * through ufs_getpage_miss(). So, we should increase
4730 			 * i_nextrio if the page (vp, nextrio) exists.
4731 			 */
4732 			if ((retval == 0) && page_exists(vp, nextrio)) {
4733 				ip->i_nextrio = nextrio + pgsize;
4734 			}
4735 		}
4736 
4737 		if ((pp = page_lookup(vp, pgoff, se)) != NULL) {
4738 			/*
4739 			 * We found the page in the page cache.
4740 			 */
4741 			*pl++ = pp;
4742 			pgoff += pgsize;
4743 			pgaddr += pgsize;
4744 			len -= pgsize;
4745 			plsz -= pgsize;
4746 		} else  {
4747 			/*
4748 			 * We have to create the page, or read it from disk.
4749 			 */
4750 			if (err = ufs_getpage_miss(vp, pgoff, len, seg, pgaddr,
4751 			    pl, plsz, rw, seqmode))
4752 				goto error;
4753 
4754 			while (*pl != NULL) {
4755 				pl++;
4756 				pgoff += pgsize;
4757 				pgaddr += pgsize;
4758 				len -= pgsize;
4759 				plsz -= pgsize;
4760 			}
4761 		}
4762 	}
4763 
4764 	/*
4765 	 * Return pages up to plsz if they are in the page cache.
4766 	 * We cannot return pages if there is a chance that they are
4767 	 * backed with a UFS hole and rw is S_WRITE or S_CREATE.
4768 	 */
4769 	if (plarr && !(has_holes && (rw == S_WRITE || rw == S_CREATE))) {
4770 
4771 		ASSERT((protp == NULL) ||
4772 		    !(has_holes && (*protp & PROT_WRITE)));
4773 
4774 		eoff = pgoff + plsz;
4775 		while (pgoff < eoff) {
4776 			page_t		*pp;
4777 
4778 			if ((pp = page_lookup_nowait(vp, pgoff,
4779 			    SE_SHARED)) == NULL)
4780 				break;
4781 
4782 			*pl++ = pp;
4783 			pgoff += pgsize;
4784 			plsz -= pgsize;
4785 		}
4786 	}
4787 
4788 	if (plarr)
4789 		*pl = NULL;			/* Terminate page list */
4790 	ip->i_nextr = pgoff;
4791 
4792 error:
4793 	if (err && plarr) {
4794 		/*
4795 		 * Release any pages we have locked.
4796 		 */
4797 		while (pl > &plarr[0])
4798 			page_unlock(*--pl);
4799 
4800 		plarr[0] = NULL;
4801 	}
4802 
4803 update_inode:
4804 	/*
4805 	 * If the inode is not already marked for IACC (in rdip() for read)
4806 	 * and the inode is not marked for no access time update (in wrip()
4807 	 * for write) then update the inode access time and mod time now.
4808 	 */
4809 	if ((ip->i_flag & (IACC | INOACC)) == 0) {
4810 		if ((rw != S_OTHER) && (ip->i_mode & IFMT) != IFDIR) {
4811 			if (!ULOCKFS_IS_NOIACC(ITOUL(ip)) &&
4812 			    (fs->fs_ronly == 0) &&
4813 			    (!ufsvfsp->vfs_noatime)) {
4814 				mutex_enter(&ip->i_tlock);
4815 				ip->i_flag |= IACC;
4816 				ITIMES_NOLOCK(ip);
4817 				mutex_exit(&ip->i_tlock);
4818 			}
4819 		}
4820 	}
4821 
4822 	if (dolock) {
4823 		rw_exit(&ip->i_contents);
4824 		if (do_qlock && rwtype == RW_WRITER)
4825 			rw_exit(&ufsvfsp->vfs_dqrwlock);
4826 	}
4827 
4828 unlock:
4829 	if (ulp) {
4830 		if ((rw == S_CREATE || rw == S_WRITE) &&
4831 		    !(vp->v_flag & VISSWAP)) {
4832 			TRANS_END_ASYNC(ufsvfsp, TOP_GETPAGE, trans_size);
4833 		}
4834 		ufs_lockfs_end(ulp);
4835 	}
4836 out:
4837 	return (err);
4838 }
4839 
4840 /*
4841  * ufs_getpage_miss is called when ufs_getpage missed the page in the page
4842  * cache. The page is either read from the disk, or it's created.
4843  * A page is created (without disk read) if rw == S_CREATE, or if
4844  * the page is not backed with a real disk block (UFS hole).
4845  */
4846 /* ARGSUSED */
4847 static int
4848 ufs_getpage_miss(struct vnode *vp, u_offset_t off, size_t len, struct seg *seg,
4849 	caddr_t addr, page_t *pl[], size_t plsz, enum seg_rw rw, int seq)
4850 {
4851 	struct inode	*ip = VTOI(vp);
4852 	page_t		*pp;
4853 	daddr_t		bn;
4854 	size_t		io_len;
4855 	int		crpage = 0;
4856 	int		err;
4857 	int		contig;
4858 	int		bsize = ip->i_fs->fs_bsize;
4859 
4860 	/*
4861 	 * Figure out whether the page can be created, or must be
4862 	 * must be read from the disk.
4863 	 */
4864 	if (rw == S_CREATE)
4865 		crpage = 1;
4866 	else {
4867 		contig = 0;
4868 		if (err = bmap_read(ip, off, &bn, &contig))
4869 			return (err);
4870 
4871 		crpage = (bn == UFS_HOLE);
4872 
4873 		/*
4874 		 * If its also a fallocated block that hasn't been written to
4875 		 * yet, we will treat it just like a UFS_HOLE and create
4876 		 * a zero page for it
4877 		 */
4878 		if (ISFALLOCBLK(ip, bn))
4879 			crpage = 1;
4880 	}
4881 
4882 	if (crpage) {
4883 		if ((pp = page_create_va(vp, off, PAGESIZE, PG_WAIT, seg,
4884 		    addr)) == NULL) {
4885 			return (ufs_fault(vp,
4886 			    "ufs_getpage_miss: page_create == NULL"));
4887 		}
4888 
4889 		if (rw != S_CREATE)
4890 			pagezero(pp, 0, PAGESIZE);
4891 
4892 		io_len = PAGESIZE;
4893 	} else {
4894 		u_offset_t	io_off;
4895 		uint_t	xlen;
4896 		struct buf	*bp;
4897 		ufsvfs_t	*ufsvfsp = ip->i_ufsvfs;
4898 
4899 		/*
4900 		 * If access is not in sequential order, we read from disk
4901 		 * in bsize units.
4902 		 *
4903 		 * We limit the size of the transfer to bsize if we are reading
4904 		 * from the beginning of the file. Note in this situation we
4905 		 * will hedge our bets and initiate an async read ahead of
4906 		 * the second block.
4907 		 */
4908 		if (!seq || off == 0)
4909 			contig = MIN(contig, bsize);
4910 
4911 		pp = pvn_read_kluster(vp, off, seg, addr, &io_off,
4912 		    &io_len, off, contig, 0);
4913 
4914 		/*
4915 		 * Some other thread has entered the page.
4916 		 * ufs_getpage will retry page_lookup.
4917 		 */
4918 		if (pp == NULL) {
4919 			pl[0] = NULL;
4920 			return (0);
4921 		}
4922 
4923 		/*
4924 		 * Zero part of the page which we are not
4925 		 * going to read from the disk.
4926 		 */
4927 		xlen = io_len & PAGEOFFSET;
4928 		if (xlen != 0)
4929 			pagezero(pp->p_prev, xlen, PAGESIZE - xlen);
4930 
4931 		bp = pageio_setup(pp, io_len, ip->i_devvp, B_READ);
4932 		bp->b_edev = ip->i_dev;
4933 		bp->b_dev = cmpdev(ip->i_dev);
4934 		bp->b_blkno = bn;
4935 		bp->b_un.b_addr = (caddr_t)0;
4936 		bp->b_file = ip->i_vnode;
4937 		bp->b_offset = off;
4938 
4939 		if (ufsvfsp->vfs_log) {
4940 			lufs_read_strategy(ufsvfsp->vfs_log, bp);
4941 		} else if (ufsvfsp->vfs_snapshot) {
4942 			fssnap_strategy(&ufsvfsp->vfs_snapshot, bp);
4943 		} else {
4944 			ufsvfsp->vfs_iotstamp = lbolt;
4945 			ub.ub_getpages.value.ul++;
4946 			(void) bdev_strategy(bp);
4947 			lwp_stat_update(LWP_STAT_INBLK, 1);
4948 		}
4949 
4950 		ip->i_nextrio = off + ((io_len + PAGESIZE - 1) & PAGEMASK);
4951 
4952 		/*
4953 		 * If the file access is sequential, initiate read ahead
4954 		 * of the next cluster.
4955 		 */
4956 		if (seq && ip->i_nextrio < ip->i_size)
4957 			(void) ufs_getpage_ra(vp, off, seg, addr);
4958 		err = biowait(bp);
4959 		pageio_done(bp);
4960 
4961 		if (err) {
4962 			pvn_read_done(pp, B_ERROR);
4963 			return (err);
4964 		}
4965 	}
4966 
4967 	pvn_plist_init(pp, pl, plsz, off, io_len, rw);
4968 	return (0);
4969 }
4970 
4971 /*
4972  * Read ahead a cluster from the disk. Returns the length in bytes.
4973  */
4974 static int
4975 ufs_getpage_ra(struct vnode *vp, u_offset_t off, struct seg *seg, caddr_t addr)
4976 {
4977 	struct inode	*ip = VTOI(vp);
4978 	page_t		*pp;
4979 	u_offset_t	io_off = ip->i_nextrio;
4980 	ufsvfs_t	*ufsvfsp;
4981 	caddr_t		addr2 = addr + (io_off - off);
4982 	struct buf	*bp;
4983 	daddr_t		bn;
4984 	size_t		io_len;
4985 	int		err;
4986 	int		contig;
4987 	int		xlen;
4988 	int		bsize = ip->i_fs->fs_bsize;
4989 
4990 	/*
4991 	 * If the directio advisory is in effect on this file,
4992 	 * then do not do buffered read ahead. Read ahead makes
4993 	 * it more difficult on threads using directio as they
4994 	 * will be forced to flush the pages from this vnode.
4995 	 */
4996 	if ((ufsvfsp = ip->i_ufsvfs) == NULL)
4997 		return (0);
4998 	if (ip->i_flag & IDIRECTIO || ufsvfsp->vfs_forcedirectio)
4999 		return (0);
5000 
5001 	/*
5002 	 * Is this test needed?
5003 	 */
5004 	if (addr2 >= seg->s_base + seg->s_size)
5005 		return (0);
5006 
5007 	contig = 0;
5008 	err = bmap_read(ip, io_off, &bn, &contig);
5009 	/*
5010 	 * If its a UFS_HOLE or a fallocated block, do not perform
5011 	 * any read ahead's since there probably is nothing to read ahead
5012 	 */
5013 	if (err || bn == UFS_HOLE || ISFALLOCBLK(ip, bn))
5014 		return (0);
5015 
5016 	/*
5017 	 * Limit the transfer size to bsize if this is the 2nd block.
5018 	 */
5019 	if (io_off == (u_offset_t)bsize)
5020 		contig = MIN(contig, bsize);
5021 
5022 	if ((pp = pvn_read_kluster(vp, io_off, seg, addr2, &io_off,
5023 	    &io_len, io_off, contig, 1)) == NULL)
5024 		return (0);
5025 
5026 	/*
5027 	 * Zero part of page which we are not going to read from disk
5028 	 */
5029 	if ((xlen = (io_len & PAGEOFFSET)) > 0)
5030 		pagezero(pp->p_prev, xlen, PAGESIZE - xlen);
5031 
5032 	ip->i_nextrio = (io_off + io_len + PAGESIZE - 1) & PAGEMASK;
5033 
5034 	bp = pageio_setup(pp, io_len, ip->i_devvp, B_READ | B_ASYNC);
5035 	bp->b_edev = ip->i_dev;
5036 	bp->b_dev = cmpdev(ip->i_dev);
5037 	bp->b_blkno = bn;
5038 	bp->b_un.b_addr = (caddr_t)0;
5039 	bp->b_file = ip->i_vnode;
5040 	bp->b_offset = off;
5041 
5042 	if (ufsvfsp->vfs_log) {
5043 		lufs_read_strategy(ufsvfsp->vfs_log, bp);
5044 	} else if (ufsvfsp->vfs_snapshot) {
5045 		fssnap_strategy(&ufsvfsp->vfs_snapshot, bp);
5046 	} else {
5047 		ufsvfsp->vfs_iotstamp = lbolt;
5048 		ub.ub_getras.value.ul++;
5049 		(void) bdev_strategy(bp);
5050 		lwp_stat_update(LWP_STAT_INBLK, 1);
5051 	}
5052 
5053 	return (io_len);
5054 }
5055 
5056 int	ufs_delay = 1;
5057 /*
5058  * Flags are composed of {B_INVAL, B_FREE, B_DONTNEED, B_FORCE, B_ASYNC}
5059  *
5060  * LMXXX - the inode really ought to contain a pointer to one of these
5061  * async args.  Stuff gunk in there and just hand the whole mess off.
5062  * This would replace i_delaylen, i_delayoff.
5063  */
5064 /*ARGSUSED*/
5065 static int
5066 ufs_putpage(struct vnode *vp, offset_t off, size_t len, int flags,
5067 	struct cred *cr, caller_context_t *ct)
5068 {
5069 	struct inode *ip = VTOI(vp);
5070 	int err = 0;
5071 
5072 	if (vp->v_count == 0) {
5073 		return (ufs_fault(vp, "ufs_putpage: bad v_count == 0"));
5074 	}
5075 
5076 	/*
5077 	 * XXX - Why should this check be made here?
5078 	 */
5079 	if (vp->v_flag & VNOMAP) {
5080 		err = ENOSYS;
5081 		goto errout;
5082 	}
5083 
5084 	if (ip->i_ufsvfs == NULL) {
5085 		err = EIO;
5086 		goto errout;
5087 	}
5088 
5089 	if (flags & B_ASYNC) {
5090 		if (ufs_delay && len &&
5091 		    (flags & ~(B_ASYNC|B_DONTNEED|B_FREE)) == 0) {
5092 			mutex_enter(&ip->i_tlock);
5093 			/*
5094 			 * If nobody stalled, start a new cluster.
5095 			 */
5096 			if (ip->i_delaylen == 0) {
5097 				ip->i_delayoff = off;
5098 				ip->i_delaylen = len;
5099 				mutex_exit(&ip->i_tlock);
5100 				goto errout;
5101 			}
5102 			/*
5103 			 * If we have a full cluster or they are not contig,
5104 			 * then push last cluster and start over.
5105 			 */
5106 			if (ip->i_delaylen >= CLUSTSZ(ip) ||
5107 			    ip->i_delayoff + ip->i_delaylen != off) {
5108 				u_offset_t doff;
5109 				size_t dlen;
5110 
5111 				doff = ip->i_delayoff;
5112 				dlen = ip->i_delaylen;
5113 				ip->i_delayoff = off;
5114 				ip->i_delaylen = len;
5115 				mutex_exit(&ip->i_tlock);
5116 				err = ufs_putpages(vp, doff, dlen,
5117 				    flags, cr);
5118 				/* LMXXX - flags are new val, not old */
5119 				goto errout;
5120 			}
5121 			/*
5122 			 * There is something there, it's not full, and
5123 			 * it is contig.
5124 			 */
5125 			ip->i_delaylen += len;
5126 			mutex_exit(&ip->i_tlock);
5127 			goto errout;
5128 		}
5129 		/*
5130 		 * Must have weird flags or we are not clustering.
5131 		 */
5132 	}
5133 
5134 	err = ufs_putpages(vp, off, len, flags, cr);
5135 
5136 errout:
5137 	return (err);
5138 }
5139 
5140 /*
5141  * If len == 0, do from off to EOF.
5142  *
5143  * The normal cases should be len == 0 & off == 0 (entire vp list),
5144  * len == MAXBSIZE (from segmap_release actions), and len == PAGESIZE
5145  * (from pageout).
5146  */
5147 /*ARGSUSED*/
5148 static int
5149 ufs_putpages(
5150 	struct vnode *vp,
5151 	offset_t off,
5152 	size_t len,
5153 	int flags,
5154 	struct cred *cr)
5155 {
5156 	u_offset_t io_off;
5157 	u_offset_t eoff;
5158 	struct inode *ip = VTOI(vp);
5159 	page_t *pp;
5160 	size_t io_len;
5161 	int err = 0;
5162 	int dolock;
5163 
5164 	if (vp->v_count == 0)
5165 		return (ufs_fault(vp, "ufs_putpages: v_count == 0"));
5166 	/*
5167 	 * Acquire the readers/write inode lock before locking
5168 	 * any pages in this inode.
5169 	 * The inode lock is held during i/o.
5170 	 */
5171 	if (len == 0) {
5172 		mutex_enter(&ip->i_tlock);
5173 		ip->i_delayoff = ip->i_delaylen = 0;
5174 		mutex_exit(&ip->i_tlock);
5175 	}
5176 	dolock = (rw_owner(&ip->i_contents) != curthread);
5177 	if (dolock) {
5178 		/*
5179 		 * Must synchronize this thread and any possible thread
5180 		 * operating in the window of vulnerability in wrip().
5181 		 * It is dangerous to allow both a thread doing a putpage
5182 		 * and a thread writing, so serialize them.  The exception
5183 		 * is when the thread in wrip() does something which causes
5184 		 * a putpage operation.  Then, the thread must be allowed
5185 		 * to continue.  It may encounter a bmap_read problem in
5186 		 * ufs_putapage, but that is handled in ufs_putapage.
5187 		 * Allow async writers to proceed, we don't want to block
5188 		 * the pageout daemon.
5189 		 */
5190 		if (ip->i_writer == curthread)
5191 			rw_enter(&ip->i_contents, RW_READER);
5192 		else {
5193 			for (;;) {
5194 				rw_enter(&ip->i_contents, RW_READER);
5195 				mutex_enter(&ip->i_tlock);
5196 				/*
5197 				 * If there is no thread in the critical
5198 				 * section of wrip(), then proceed.
5199 				 * Otherwise, wait until there isn't one.
5200 				 */
5201 				if (ip->i_writer == NULL) {
5202 					mutex_exit(&ip->i_tlock);
5203 					break;
5204 				}
5205 				rw_exit(&ip->i_contents);
5206 				/*
5207 				 * Bounce async writers when we have a writer
5208 				 * working on this file so we don't deadlock
5209 				 * the pageout daemon.
5210 				 */
5211 				if (flags & B_ASYNC) {
5212 					mutex_exit(&ip->i_tlock);
5213 					return (0);
5214 				}
5215 				cv_wait(&ip->i_wrcv, &ip->i_tlock);
5216 				mutex_exit(&ip->i_tlock);
5217 			}
5218 		}
5219 	}
5220 
5221 	if (!vn_has_cached_data(vp)) {
5222 		if (dolock)
5223 			rw_exit(&ip->i_contents);
5224 		return (0);
5225 	}
5226 
5227 	if (len == 0) {
5228 		/*
5229 		 * Search the entire vp list for pages >= off.
5230 		 */
5231 		err = pvn_vplist_dirty(vp, (u_offset_t)off, ufs_putapage,
5232 		    flags, cr);
5233 	} else {
5234 		/*
5235 		 * Loop over all offsets in the range looking for
5236 		 * pages to deal with.
5237 		 */
5238 		if ((eoff = blkroundup(ip->i_fs, ip->i_size)) != 0)
5239 			eoff = MIN(off + len, eoff);
5240 		else
5241 			eoff = off + len;
5242 
5243 		for (io_off = off; io_off < eoff; io_off += io_len) {
5244 			/*
5245 			 * If we are not invalidating, synchronously
5246 			 * freeing or writing pages, use the routine
5247 			 * page_lookup_nowait() to prevent reclaiming
5248 			 * them from the free list.
5249 			 */
5250 			if ((flags & B_INVAL) || ((flags & B_ASYNC) == 0)) {
5251 				pp = page_lookup(vp, io_off,
5252 				    (flags & (B_INVAL | B_FREE)) ?
5253 				    SE_EXCL : SE_SHARED);
5254 			} else {
5255 				pp = page_lookup_nowait(vp, io_off,
5256 				    (flags & B_FREE) ? SE_EXCL : SE_SHARED);
5257 			}
5258 
5259 			if (pp == NULL || pvn_getdirty(pp, flags) == 0)
5260 				io_len = PAGESIZE;
5261 			else {
5262 				u_offset_t *io_offp = &io_off;
5263 
5264 				err = ufs_putapage(vp, pp, io_offp, &io_len,
5265 				    flags, cr);
5266 				if (err != 0)
5267 					break;
5268 				/*
5269 				 * "io_off" and "io_len" are returned as
5270 				 * the range of pages we actually wrote.
5271 				 * This allows us to skip ahead more quickly
5272 				 * since several pages may've been dealt
5273 				 * with by this iteration of the loop.
5274 				 */
5275 			}
5276 		}
5277 	}
5278 	if (err == 0 && off == 0 && (len == 0 || len >= ip->i_size)) {
5279 		/*
5280 		 * We have just sync'ed back all the pages on
5281 		 * the inode, turn off the IMODTIME flag.
5282 		 */
5283 		mutex_enter(&ip->i_tlock);
5284 		ip->i_flag &= ~IMODTIME;
5285 		mutex_exit(&ip->i_tlock);
5286 	}
5287 	if (dolock)
5288 		rw_exit(&ip->i_contents);
5289 	return (err);
5290 }
5291 
5292 static void
5293 ufs_iodone(buf_t *bp)
5294 {
5295 	struct inode *ip;
5296 
5297 	ASSERT((bp->b_pages->p_vnode != NULL) && !(bp->b_flags & B_READ));
5298 
5299 	bp->b_iodone = NULL;
5300 
5301 	ip = VTOI(bp->b_pages->p_vnode);
5302 
5303 	mutex_enter(&ip->i_tlock);
5304 	if (ip->i_writes >= ufs_LW) {
5305 		if ((ip->i_writes -= bp->b_bcount) <= ufs_LW)
5306 			if (ufs_WRITES)
5307 				cv_broadcast(&ip->i_wrcv); /* wake all up */
5308 	} else {
5309 		ip->i_writes -= bp->b_bcount;
5310 	}
5311 
5312 	mutex_exit(&ip->i_tlock);
5313 	iodone(bp);
5314 }
5315 
5316 /*
5317  * Write out a single page, possibly klustering adjacent
5318  * dirty pages.  The inode lock must be held.
5319  *
5320  * LMXXX - bsize < pagesize not done.
5321  */
5322 /*ARGSUSED*/
5323 int
5324 ufs_putapage(
5325 	struct vnode *vp,
5326 	page_t *pp,
5327 	u_offset_t *offp,
5328 	size_t *lenp,		/* return values */
5329 	int flags,
5330 	struct cred *cr)
5331 {
5332 	u_offset_t io_off;
5333 	u_offset_t off;
5334 	struct inode *ip = VTOI(vp);
5335 	struct ufsvfs *ufsvfsp = ip->i_ufsvfs;
5336 	struct fs *fs;
5337 	struct buf *bp;
5338 	size_t io_len;
5339 	daddr_t bn;
5340 	int err;
5341 	int contig;
5342 	int dotrans;
5343 
5344 	ASSERT(RW_LOCK_HELD(&ip->i_contents));
5345 
5346 	if (ufsvfsp == NULL) {
5347 		err = EIO;
5348 		goto out_trace;
5349 	}
5350 
5351 	fs = ip->i_fs;
5352 	ASSERT(fs->fs_ronly == 0);
5353 
5354 	/*
5355 	 * If the modified time on the inode has not already been
5356 	 * set elsewhere (e.g. for write/setattr) we set the time now.
5357 	 * This gives us approximate modified times for mmap'ed files
5358 	 * which are modified via stores in the user address space.
5359 	 */
5360 	if ((ip->i_flag & IMODTIME) == 0) {
5361 		mutex_enter(&ip->i_tlock);
5362 		ip->i_flag |= IUPD;
5363 		ip->i_seq++;
5364 		ITIMES_NOLOCK(ip);
5365 		mutex_exit(&ip->i_tlock);
5366 	}
5367 
5368 	/*
5369 	 * Align the request to a block boundry (for old file systems),
5370 	 * and go ask bmap() how contiguous things are for this file.
5371 	 */
5372 	off = pp->p_offset & (offset_t)fs->fs_bmask;	/* block align it */
5373 	contig = 0;
5374 	err = bmap_read(ip, off, &bn, &contig);
5375 	if (err)
5376 		goto out;
5377 	if (bn == UFS_HOLE) {			/* putpage never allocates */
5378 		/*
5379 		 * logging device is in error mode; simply return EIO
5380 		 */
5381 		if (TRANS_ISERROR(ufsvfsp)) {
5382 			err = EIO;
5383 			goto out;
5384 		}
5385 		/*
5386 		 * Oops, the thread in the window in wrip() did some
5387 		 * sort of operation which caused a putpage in the bad
5388 		 * range.  In this case, just return an error which will
5389 		 * cause the software modified bit on the page to set
5390 		 * and the page will get written out again later.
5391 		 */
5392 		if (ip->i_writer == curthread) {
5393 			err = EIO;
5394 			goto out;
5395 		}
5396 		/*
5397 		 * If the pager is trying to push a page in the bad range
5398 		 * just tell him to try again later when things are better.
5399 		 */
5400 		if (flags & B_ASYNC) {
5401 			err = EAGAIN;
5402 			goto out;
5403 		}
5404 		err = ufs_fault(ITOV(ip), "ufs_putapage: bn == UFS_HOLE");
5405 		goto out;
5406 	}
5407 
5408 	/*
5409 	 * If it is an fallocate'd block, reverse the negativity since
5410 	 * we are now writing to it
5411 	 */
5412 	if (ISFALLOCBLK(ip, bn)) {
5413 		err = bmap_set_bn(vp, off, dbtofsb(fs, -bn));
5414 		if (err)
5415 			goto out;
5416 
5417 		bn = -bn;
5418 	}
5419 
5420 	/*
5421 	 * Take the length (of contiguous bytes) passed back from bmap()
5422 	 * and _try_ and get a set of pages covering that extent.
5423 	 */
5424 	pp = pvn_write_kluster(vp, pp, &io_off, &io_len, off, contig, flags);
5425 
5426 	/*
5427 	 * May have run out of memory and not clustered backwards.
5428 	 * off		p_offset
5429 	 * [  pp - 1  ][   pp   ]
5430 	 * [	block		]
5431 	 * We told bmap off, so we have to adjust the bn accordingly.
5432 	 */
5433 	if (io_off > off) {
5434 		bn += btod(io_off - off);
5435 		contig -= (io_off - off);
5436 	}
5437 
5438 	/*
5439 	 * bmap was carefull to tell us the right size so use that.
5440 	 * There might be unallocated frags at the end.
5441 	 * LMXXX - bzero the end of the page?  We must be writing after EOF.
5442 	 */
5443 	if (io_len > contig) {
5444 		ASSERT(io_len - contig < fs->fs_bsize);
5445 		io_len -= (io_len - contig);
5446 	}
5447 
5448 	/*
5449 	 * Handle the case where we are writing the last page after EOF.
5450 	 *
5451 	 * XXX - just a patch for i-mt3.
5452 	 */
5453 	if (io_len == 0) {
5454 		ASSERT(pp->p_offset >=
5455 		    (u_offset_t)(roundup(ip->i_size, PAGESIZE)));
5456 		io_len = PAGESIZE;
5457 	}
5458 
5459 	bp = pageio_setup(pp, io_len, ip->i_devvp, B_WRITE | flags);
5460 
5461 	ULOCKFS_SET_MOD(ITOUL(ip));
5462 
5463 	bp->b_edev = ip->i_dev;
5464 	bp->b_dev = cmpdev(ip->i_dev);
5465 	bp->b_blkno = bn;
5466 	bp->b_un.b_addr = (caddr_t)0;
5467 	bp->b_file = ip->i_vnode;
5468 
5469 	/*
5470 	 * File contents of shadow or quota inodes are metadata, and updates
5471 	 * to these need to be put into a logging transaction. All direct
5472 	 * callers in UFS do that, but fsflush can come here _before_ the
5473 	 * normal codepath. An example would be updating ACL information, for
5474 	 * which the normal codepath would be:
5475 	 *	ufs_si_store()
5476 	 *	ufs_rdwri()
5477 	 *	wrip()
5478 	 *	segmap_release()
5479 	 *	VOP_PUTPAGE()
5480 	 * Here, fsflush can pick up the dirty page before segmap_release()
5481 	 * forces it out. If that happens, there's no transaction.
5482 	 * We therefore need to test whether a transaction exists, and if not
5483 	 * create one - for fsflush.
5484 	 */
5485 	dotrans =
5486 	    (((ip->i_mode & IFMT) == IFSHAD || ufsvfsp->vfs_qinod == ip) &&
5487 	    ((curthread->t_flag & T_DONTBLOCK) == 0) &&
5488 	    (TRANS_ISTRANS(ufsvfsp)));
5489 
5490 	if (dotrans) {
5491 		curthread->t_flag |= T_DONTBLOCK;
5492 		TRANS_BEGIN_ASYNC(ufsvfsp, TOP_PUTPAGE, TOP_PUTPAGE_SIZE(ip));
5493 	}
5494 	if (TRANS_ISTRANS(ufsvfsp)) {
5495 		if ((ip->i_mode & IFMT) == IFSHAD) {
5496 			TRANS_BUF(ufsvfsp, 0, io_len, bp, DT_SHAD);
5497 		} else if (ufsvfsp->vfs_qinod == ip) {
5498 			TRANS_DELTA(ufsvfsp, ldbtob(bn), bp->b_bcount, DT_QR,
5499 			    0, 0);
5500 		}
5501 	}
5502 	if (dotrans) {
5503 		TRANS_END_ASYNC(ufsvfsp, TOP_PUTPAGE, TOP_PUTPAGE_SIZE(ip));
5504 		curthread->t_flag &= ~T_DONTBLOCK;
5505 	}
5506 
5507 	/* write throttle */
5508 
5509 	ASSERT(bp->b_iodone == NULL);
5510 	bp->b_iodone = (int (*)())ufs_iodone;
5511 	mutex_enter(&ip->i_tlock);
5512 	ip->i_writes += bp->b_bcount;
5513 	mutex_exit(&ip->i_tlock);
5514 
5515 	if (bp->b_flags & B_ASYNC) {
5516 		if (ufsvfsp->vfs_log) {
5517 			lufs_write_strategy(ufsvfsp->vfs_log, bp);
5518 		} else if (ufsvfsp->vfs_snapshot) {
5519 			fssnap_strategy(&ufsvfsp->vfs_snapshot, bp);
5520 		} else {
5521 			ufsvfsp->vfs_iotstamp = lbolt;
5522 			ub.ub_putasyncs.value.ul++;
5523 			(void) bdev_strategy(bp);
5524 			lwp_stat_update(LWP_STAT_OUBLK, 1);
5525 		}
5526 	} else {
5527 		if (ufsvfsp->vfs_log) {
5528 			lufs_write_strategy(ufsvfsp->vfs_log, bp);
5529 		} else if (ufsvfsp->vfs_snapshot) {
5530 			fssnap_strategy(&ufsvfsp->vfs_snapshot, bp);
5531 		} else {
5532 			ufsvfsp->vfs_iotstamp = lbolt;
5533 			ub.ub_putsyncs.value.ul++;
5534 			(void) bdev_strategy(bp);
5535 			lwp_stat_update(LWP_STAT_OUBLK, 1);
5536 		}
5537 		err = biowait(bp);
5538 		pageio_done(bp);
5539 		pvn_write_done(pp, ((err) ? B_ERROR : 0) | B_WRITE | flags);
5540 	}
5541 
5542 	pp = NULL;
5543 
5544 out:
5545 	if (err != 0 && pp != NULL)
5546 		pvn_write_done(pp, B_ERROR | B_WRITE | flags);
5547 
5548 	if (offp)
5549 		*offp = io_off;
5550 	if (lenp)
5551 		*lenp = io_len;
5552 out_trace:
5553 	return (err);
5554 }
5555 
5556 uint64_t ufs_map_alock_retry_cnt;
5557 uint64_t ufs_map_lockfs_retry_cnt;
5558 
5559 /* ARGSUSED */
5560 static int
5561 ufs_map(struct vnode *vp,
5562 	offset_t off,
5563 	struct as *as,
5564 	caddr_t *addrp,
5565 	size_t len,
5566 	uchar_t prot,
5567 	uchar_t maxprot,
5568 	uint_t flags,
5569 	struct cred *cr,
5570 	caller_context_t *ct)
5571 {
5572 	struct segvn_crargs vn_a;
5573 	struct ufsvfs *ufsvfsp = VTOI(vp)->i_ufsvfs;
5574 	struct ulockfs *ulp;
5575 	int error, sig;
5576 	k_sigset_t smask;
5577 	caddr_t hint = *addrp;
5578 
5579 	if (vp->v_flag & VNOMAP) {
5580 		error = ENOSYS;
5581 		goto out;
5582 	}
5583 
5584 	if (off < (offset_t)0 || (offset_t)(off + len) < (offset_t)0) {
5585 		error = ENXIO;
5586 		goto out;
5587 	}
5588 
5589 	if (vp->v_type != VREG) {
5590 		error = ENODEV;
5591 		goto out;
5592 	}
5593 
5594 retry_map:
5595 	*addrp = hint;
5596 	/*
5597 	 * If file is being locked, disallow mapping.
5598 	 */
5599 	if (vn_has_mandatory_locks(vp, VTOI(vp)->i_mode)) {
5600 		error = EAGAIN;
5601 		goto out;
5602 	}
5603 
5604 	as_rangelock(as);
5605 	/*
5606 	 * Note that if we are retrying (because ufs_lockfs_trybegin failed in
5607 	 * the previous attempt), some other thread could have grabbed
5608 	 * the same VA range if MAP_FIXED is set. In that case, choose_addr
5609 	 * would unmap the valid VA range, that is ok.
5610 	 */
5611 	error = choose_addr(as, addrp, len, off, ADDR_VACALIGN, flags);
5612 	if (error != 0) {
5613 		as_rangeunlock(as);
5614 		goto out;
5615 	}
5616 
5617 	/*
5618 	 * a_lock has to be acquired before entering the lockfs protocol
5619 	 * because that is the order in which pagefault works. Also we cannot
5620 	 * block on a_lock here because this waiting writer will prevent
5621 	 * further readers like ufs_read from progressing and could cause
5622 	 * deadlock between ufs_read/ufs_map/pagefault when a quiesce is
5623 	 * pending.
5624 	 */
5625 	while (!AS_LOCK_TRYENTER(as, &as->a_lock, RW_WRITER)) {
5626 		ufs_map_alock_retry_cnt++;
5627 		delay(RETRY_LOCK_DELAY);
5628 	}
5629 
5630 	/*
5631 	 * We can't hold as->a_lock and wait for lockfs to succeed because
5632 	 * the proc tools might hang on a_lock, so call ufs_lockfs_trybegin()
5633 	 * instead.
5634 	 */
5635 	if (error = ufs_lockfs_trybegin(ufsvfsp, &ulp, ULOCKFS_MAP_MASK)) {
5636 		/*
5637 		 * ufs_lockfs_trybegin() did not succeed. It is safer to give up
5638 		 * as->a_lock and wait for ulp->ul_fs_lock status to change.
5639 		 */
5640 		ufs_map_lockfs_retry_cnt++;
5641 		AS_LOCK_EXIT(as, &as->a_lock);
5642 		as_rangeunlock(as);
5643 		if (error == EIO)
5644 			goto out;
5645 
5646 		mutex_enter(&ulp->ul_lock);
5647 		while (ulp->ul_fs_lock & ULOCKFS_MAP_MASK) {
5648 			if (ULOCKFS_IS_SLOCK(ulp) || ufsvfsp->vfs_nointr) {
5649 				cv_wait(&ulp->ul_cv, &ulp->ul_lock);
5650 			} else {
5651 				sigintr(&smask, 1);
5652 				sig = cv_wait_sig(&ulp->ul_cv, &ulp->ul_lock);
5653 				sigunintr(&smask);
5654 				if (((ulp->ul_fs_lock & ULOCKFS_MAP_MASK) &&
5655 				    !sig) || ufsvfsp->vfs_dontblock) {
5656 					mutex_exit(&ulp->ul_lock);
5657 					return (EINTR);
5658 				}
5659 			}
5660 		}
5661 		mutex_exit(&ulp->ul_lock);
5662 		goto retry_map;
5663 	}
5664 
5665 	vn_a.vp = vp;
5666 	vn_a.offset = (u_offset_t)off;
5667 	vn_a.type = flags & MAP_TYPE;
5668 	vn_a.prot = prot;
5669 	vn_a.maxprot = maxprot;
5670 	vn_a.cred = cr;
5671 	vn_a.amp = NULL;
5672 	vn_a.flags = flags & ~MAP_TYPE;
5673 	vn_a.szc = 0;
5674 	vn_a.lgrp_mem_policy_flags = 0;
5675 
5676 	error = as_map_locked(as, *addrp, len, segvn_create, &vn_a);
5677 	if (ulp)
5678 		ufs_lockfs_end(ulp);
5679 	as_rangeunlock(as);
5680 out:
5681 	return (error);
5682 }
5683 
5684 /* ARGSUSED */
5685 static int
5686 ufs_addmap(struct vnode *vp,
5687 	offset_t off,
5688 	struct as *as,
5689 	caddr_t addr,
5690 	size_t	len,
5691 	uchar_t  prot,
5692 	uchar_t  maxprot,
5693 	uint_t    flags,
5694 	struct cred *cr,
5695 	caller_context_t *ct)
5696 {
5697 	struct inode *ip = VTOI(vp);
5698 
5699 	if (vp->v_flag & VNOMAP) {
5700 		return (ENOSYS);
5701 	}
5702 
5703 	mutex_enter(&ip->i_tlock);
5704 	ip->i_mapcnt += btopr(len);
5705 	mutex_exit(&ip->i_tlock);
5706 	return (0);
5707 }
5708 
5709 /*ARGSUSED*/
5710 static int
5711 ufs_delmap(struct vnode *vp, offset_t off, struct as *as, caddr_t addr,
5712 	size_t len, uint_t prot,  uint_t maxprot,  uint_t flags,
5713 	struct cred *cr, caller_context_t *ct)
5714 {
5715 	struct inode *ip = VTOI(vp);
5716 
5717 	if (vp->v_flag & VNOMAP) {
5718 		return (ENOSYS);
5719 	}
5720 
5721 	mutex_enter(&ip->i_tlock);
5722 	ip->i_mapcnt -= btopr(len); 	/* Count released mappings */
5723 	ASSERT(ip->i_mapcnt >= 0);
5724 	mutex_exit(&ip->i_tlock);
5725 	return (0);
5726 }
5727 /*
5728  * Return the answer requested to poll() for non-device files
5729  */
5730 struct pollhead ufs_pollhd;
5731 
5732 /* ARGSUSED */
5733 int
5734 ufs_poll(vnode_t *vp, short ev, int any, short *revp, struct pollhead **phpp,
5735 	caller_context_t *ct)
5736 {
5737 	struct ufsvfs	*ufsvfsp;
5738 
5739 	*revp = 0;
5740 	ufsvfsp = VTOI(vp)->i_ufsvfs;
5741 
5742 	if (!ufsvfsp) {
5743 		*revp = POLLHUP;
5744 		goto out;
5745 	}
5746 
5747 	if (ULOCKFS_IS_HLOCK(&ufsvfsp->vfs_ulockfs) ||
5748 	    ULOCKFS_IS_ELOCK(&ufsvfsp->vfs_ulockfs)) {
5749 		*revp |= POLLERR;
5750 
5751 	} else {
5752 		if ((ev & POLLOUT) && !ufsvfsp->vfs_fs->fs_ronly &&
5753 		    !ULOCKFS_IS_WLOCK(&ufsvfsp->vfs_ulockfs))
5754 			*revp |= POLLOUT;
5755 
5756 		if ((ev & POLLWRBAND) && !ufsvfsp->vfs_fs->fs_ronly &&
5757 		    !ULOCKFS_IS_WLOCK(&ufsvfsp->vfs_ulockfs))
5758 			*revp |= POLLWRBAND;
5759 
5760 		if (ev & POLLIN)
5761 			*revp |= POLLIN;
5762 
5763 		if (ev & POLLRDNORM)
5764 			*revp |= POLLRDNORM;
5765 
5766 		if (ev & POLLRDBAND)
5767 			*revp |= POLLRDBAND;
5768 	}
5769 
5770 	if ((ev & POLLPRI) && (*revp & (POLLERR|POLLHUP)))
5771 		*revp |= POLLPRI;
5772 out:
5773 	*phpp = !any && !*revp ? &ufs_pollhd : (struct pollhead *)NULL;
5774 
5775 	return (0);
5776 }
5777 
5778 /* ARGSUSED */
5779 static int
5780 ufs_l_pathconf(struct vnode *vp, int cmd, ulong_t *valp, struct cred *cr,
5781 	caller_context_t *ct)
5782 {
5783 	struct ufsvfs	*ufsvfsp = VTOI(vp)->i_ufsvfs;
5784 	struct ulockfs	*ulp = NULL;
5785 	struct inode 	*sip = NULL;
5786 	int		error;
5787 	struct inode 	*ip = VTOI(vp);
5788 	int		issync;
5789 
5790 	error = ufs_lockfs_begin(ufsvfsp, &ulp, ULOCKFS_PATHCONF_MASK);
5791 	if (error)
5792 		return (error);
5793 
5794 	switch (cmd) {
5795 		/*
5796 		 * Have to handle _PC_NAME_MAX here, because the normal way
5797 		 * [fs_pathconf() -> VOP_STATVFS() -> ufs_statvfs()]
5798 		 * results in a lock ordering reversal between
5799 		 * ufs_lockfs_{begin,end}() and
5800 		 * ufs_thread_{suspend,continue}().
5801 		 *
5802 		 * Keep in sync with ufs_statvfs().
5803 		 */
5804 	case _PC_NAME_MAX:
5805 		*valp = MAXNAMLEN;
5806 		break;
5807 
5808 	case _PC_FILESIZEBITS:
5809 		if (ufsvfsp->vfs_lfflags & UFS_LARGEFILES)
5810 			*valp = UFS_FILESIZE_BITS;
5811 		else
5812 			*valp = 32;
5813 		break;
5814 
5815 	case _PC_XATTR_EXISTS:
5816 		if (vp->v_vfsp->vfs_flag & VFS_XATTR) {
5817 
5818 			error =
5819 			    ufs_xattr_getattrdir(vp, &sip, LOOKUP_XATTR, cr);
5820 			if (error ==  0 && sip != NULL) {
5821 				/* Start transaction */
5822 				if (ulp) {
5823 					TRANS_BEGIN_CSYNC(ufsvfsp, issync,
5824 					    TOP_RMDIR, TOP_RMDIR_SIZE);
5825 				}
5826 				/*
5827 				 * Is directory empty
5828 				 */
5829 				rw_enter(&sip->i_rwlock, RW_WRITER);
5830 				rw_enter(&sip->i_contents, RW_WRITER);
5831 				if (ufs_xattrdirempty(sip,
5832 				    sip->i_number, CRED())) {
5833 					rw_enter(&ip->i_contents, RW_WRITER);
5834 					ufs_unhook_shadow(ip, sip);
5835 					rw_exit(&ip->i_contents);
5836 
5837 					*valp = 0;
5838 
5839 				} else
5840 					*valp = 1;
5841 				rw_exit(&sip->i_contents);
5842 				rw_exit(&sip->i_rwlock);
5843 				if (ulp) {
5844 					TRANS_END_CSYNC(ufsvfsp, error, issync,
5845 					    TOP_RMDIR, TOP_RMDIR_SIZE);
5846 				}
5847 				VN_RELE(ITOV(sip));
5848 			} else if (error == ENOENT) {
5849 				*valp = 0;
5850 				error = 0;
5851 			}
5852 		} else {
5853 			error = fs_pathconf(vp, cmd, valp, cr, ct);
5854 		}
5855 		break;
5856 
5857 	case _PC_ACL_ENABLED:
5858 		*valp = _ACL_ACLENT_ENABLED;
5859 		break;
5860 
5861 	case _PC_MIN_HOLE_SIZE:
5862 		*valp = (ulong_t)ip->i_fs->fs_bsize;
5863 		break;
5864 
5865 	case _PC_SATTR_ENABLED:
5866 	case _PC_SATTR_EXISTS:
5867 		*valp = vfs_has_feature(vp->v_vfsp, VFSFT_XVATTR) &&
5868 		    (vp->v_type == VREG || vp->v_type == VDIR);
5869 		break;
5870 
5871 	default:
5872 		error = fs_pathconf(vp, cmd, valp, cr, ct);
5873 	}
5874 
5875 	if (ulp != NULL) {
5876 		ufs_lockfs_end(ulp);
5877 	}
5878 	return (error);
5879 }
5880 
5881 int ufs_pageio_writes, ufs_pageio_reads;
5882 
5883 /*ARGSUSED*/
5884 static int
5885 ufs_pageio(struct vnode *vp, page_t *pp, u_offset_t io_off, size_t io_len,
5886 	int flags, struct cred *cr, caller_context_t *ct)
5887 {
5888 	struct inode *ip = VTOI(vp);
5889 	struct ufsvfs *ufsvfsp;
5890 	page_t *npp = NULL, *opp = NULL, *cpp = pp;
5891 	struct buf *bp;
5892 	daddr_t bn;
5893 	size_t done_len = 0, cur_len = 0;
5894 	int err = 0;
5895 	int contig = 0;
5896 	int dolock;
5897 	int vmpss = 0;
5898 	struct ulockfs *ulp;
5899 
5900 	if ((flags & B_READ) && pp != NULL && pp->p_vnode == vp &&
5901 	    vp->v_mpssdata != NULL) {
5902 		vmpss = 1;
5903 	}
5904 
5905 	dolock = (rw_owner(&ip->i_contents) != curthread);
5906 	/*
5907 	 * We need a better check.  Ideally, we would use another
5908 	 * vnodeops so that hlocked and forcibly unmounted file
5909 	 * systems would return EIO where appropriate and w/o the
5910 	 * need for these checks.
5911 	 */
5912 	if ((ufsvfsp = ip->i_ufsvfs) == NULL)
5913 		return (EIO);
5914 
5915 	/*
5916 	 * For vmpss (pp can be NULL) case respect the quiesce protocol.
5917 	 * ul_lock must be taken before locking pages so we can't use it here
5918 	 * if pp is non NULL because segvn already locked pages
5919 	 * SE_EXCL. Instead we rely on the fact that a forced umount or
5920 	 * applying a filesystem lock via ufs_fiolfs() will block in the
5921 	 * implicit call to ufs_flush() until we unlock the pages after the
5922 	 * return to segvn. Other ufs_quiesce() callers keep ufs_quiesce_pend
5923 	 * above 0 until they are done. We have to be careful not to increment
5924 	 * ul_vnops_cnt here after forceful unmount hlocks the file system.
5925 	 *
5926 	 * If pp is NULL use ul_lock to make sure we don't increment
5927 	 * ul_vnops_cnt after forceful unmount hlocks the file system.
5928 	 */
5929 	if (vmpss || pp == NULL) {
5930 		ulp = &ufsvfsp->vfs_ulockfs;
5931 		if (pp == NULL)
5932 			mutex_enter(&ulp->ul_lock);
5933 		if (ulp->ul_fs_lock & ULOCKFS_GETREAD_MASK) {
5934 			if (pp == NULL) {
5935 				mutex_exit(&ulp->ul_lock);
5936 			}
5937 			return (vmpss ? EIO : EINVAL);
5938 		}
5939 		atomic_add_long(&ulp->ul_vnops_cnt, 1);
5940 		if (pp == NULL)
5941 			mutex_exit(&ulp->ul_lock);
5942 		if (ufs_quiesce_pend) {
5943 			if (!atomic_add_long_nv(&ulp->ul_vnops_cnt, -1))
5944 				cv_broadcast(&ulp->ul_cv);
5945 			return (vmpss ? EIO : EINVAL);
5946 		}
5947 	}
5948 
5949 	if (dolock) {
5950 		/*
5951 		 * segvn may call VOP_PAGEIO() instead of VOP_GETPAGE() to
5952 		 * handle a fault against a segment that maps vnode pages with
5953 		 * large mappings.  Segvn creates pages and holds them locked
5954 		 * SE_EXCL during VOP_PAGEIO() call. In this case we have to
5955 		 * use rw_tryenter() to avoid a potential deadlock since in
5956 		 * lock order i_contents needs to be taken first.
5957 		 * Segvn will retry via VOP_GETPAGE() if VOP_PAGEIO() fails.
5958 		 */
5959 		if (!vmpss) {
5960 			rw_enter(&ip->i_contents, RW_READER);
5961 		} else if (!rw_tryenter(&ip->i_contents, RW_READER)) {
5962 			if (!atomic_add_long_nv(&ulp->ul_vnops_cnt, -1))
5963 				cv_broadcast(&ulp->ul_cv);
5964 			return (EDEADLK);
5965 		}
5966 	}
5967 
5968 	/*
5969 	 * Return an error to segvn because the pagefault request is beyond
5970 	 * PAGESIZE rounded EOF.
5971 	 */
5972 	if (vmpss && btopr(io_off + io_len) > btopr(ip->i_size)) {
5973 		if (dolock)
5974 			rw_exit(&ip->i_contents);
5975 		if (!atomic_add_long_nv(&ulp->ul_vnops_cnt, -1))
5976 			cv_broadcast(&ulp->ul_cv);
5977 		return (EFAULT);
5978 	}
5979 
5980 	if (pp == NULL) {
5981 		if (bmap_has_holes(ip)) {
5982 			err = ENOSYS;
5983 		} else {
5984 			err = EINVAL;
5985 		}
5986 		if (dolock)
5987 			rw_exit(&ip->i_contents);
5988 		if (!atomic_add_long_nv(&ulp->ul_vnops_cnt, -1))
5989 			cv_broadcast(&ulp->ul_cv);
5990 		return (err);
5991 	}
5992 
5993 	/*
5994 	 * Break the io request into chunks, one for each contiguous
5995 	 * stretch of disk blocks in the target file.
5996 	 */
5997 	while (done_len < io_len) {
5998 		ASSERT(cpp);
5999 		contig = 0;
6000 		if (err = bmap_read(ip, (u_offset_t)(io_off + done_len),
6001 		    &bn, &contig))
6002 			break;
6003 
6004 		if (bn == UFS_HOLE) {	/* No holey swapfiles */
6005 			if (vmpss) {
6006 				err = EFAULT;
6007 				break;
6008 			}
6009 			err = ufs_fault(ITOV(ip), "ufs_pageio: bn == UFS_HOLE");
6010 			break;
6011 		}
6012 
6013 		cur_len = MIN(io_len - done_len, contig);
6014 		/*
6015 		 * Zero out a page beyond EOF, when the last block of
6016 		 * a file is a UFS fragment so that ufs_pageio() can be used
6017 		 * instead of ufs_getpage() to handle faults against
6018 		 * segvn segments that use large pages.
6019 		 */
6020 		page_list_break(&cpp, &npp, btopr(cur_len));
6021 		if ((flags & B_READ) && (cur_len & PAGEOFFSET)) {
6022 			size_t xlen = cur_len & PAGEOFFSET;
6023 			pagezero(cpp->p_prev, xlen, PAGESIZE - xlen);
6024 		}
6025 
6026 		bp = pageio_setup(cpp, cur_len, ip->i_devvp, flags);
6027 		ASSERT(bp != NULL);
6028 
6029 		bp->b_edev = ip->i_dev;
6030 		bp->b_dev = cmpdev(ip->i_dev);
6031 		bp->b_blkno = bn;
6032 		bp->b_un.b_addr = (caddr_t)0;
6033 		bp->b_file = ip->i_vnode;
6034 
6035 		ufsvfsp->vfs_iotstamp = lbolt;
6036 		ub.ub_pageios.value.ul++;
6037 		if (ufsvfsp->vfs_snapshot)
6038 			fssnap_strategy(&(ufsvfsp->vfs_snapshot), bp);
6039 		else
6040 			(void) bdev_strategy(bp);
6041 
6042 		if (flags & B_READ)
6043 			ufs_pageio_reads++;
6044 		else
6045 			ufs_pageio_writes++;
6046 		if (flags & B_READ)
6047 			lwp_stat_update(LWP_STAT_INBLK, 1);
6048 		else
6049 			lwp_stat_update(LWP_STAT_OUBLK, 1);
6050 		/*
6051 		 * If the request is not B_ASYNC, wait for i/o to complete
6052 		 * and re-assemble the page list to return to the caller.
6053 		 * If it is B_ASYNC we leave the page list in pieces and
6054 		 * cleanup() will dispose of them.
6055 		 */
6056 		if ((flags & B_ASYNC) == 0) {
6057 			err = biowait(bp);
6058 			pageio_done(bp);
6059 			if (err)
6060 				break;
6061 			page_list_concat(&opp, &cpp);
6062 		}
6063 		cpp = npp;
6064 		npp = NULL;
6065 		if (flags & B_READ)
6066 			cur_len = P2ROUNDUP_TYPED(cur_len, PAGESIZE, size_t);
6067 		done_len += cur_len;
6068 	}
6069 	ASSERT(err || (cpp == NULL && npp == NULL && done_len == io_len));
6070 	if (err) {
6071 		if (flags & B_ASYNC) {
6072 			/* Cleanup unprocessed parts of list */
6073 			page_list_concat(&cpp, &npp);
6074 			if (flags & B_READ)
6075 				pvn_read_done(cpp, B_ERROR);
6076 			else
6077 				pvn_write_done(cpp, B_ERROR);
6078 		} else {
6079 			/* Re-assemble list and let caller clean up */
6080 			page_list_concat(&opp, &cpp);
6081 			page_list_concat(&opp, &npp);
6082 		}
6083 	}
6084 
6085 	if (vmpss && !(ip->i_flag & IACC) && !ULOCKFS_IS_NOIACC(ulp) &&
6086 	    ufsvfsp->vfs_fs->fs_ronly == 0 && !ufsvfsp->vfs_noatime) {
6087 		mutex_enter(&ip->i_tlock);
6088 		ip->i_flag |= IACC;
6089 		ITIMES_NOLOCK(ip);
6090 		mutex_exit(&ip->i_tlock);
6091 	}
6092 
6093 	if (dolock)
6094 		rw_exit(&ip->i_contents);
6095 	if (vmpss && !atomic_add_long_nv(&ulp->ul_vnops_cnt, -1))
6096 		cv_broadcast(&ulp->ul_cv);
6097 	return (err);
6098 }
6099 
6100 /*
6101  * Called when the kernel is in a frozen state to dump data
6102  * directly to the device. It uses a private dump data structure,
6103  * set up by dump_ctl, to locate the correct disk block to which to dump.
6104  */
6105 /*ARGSUSED*/
6106 static int
6107 ufs_dump(vnode_t *vp, caddr_t addr, offset_t ldbn, offset_t dblks,
6108     caller_context_t *ct)
6109 {
6110 	u_offset_t	file_size;
6111 	struct inode    *ip = VTOI(vp);
6112 	struct fs	*fs = ip->i_fs;
6113 	daddr_t		dbn, lfsbn;
6114 	int		disk_blks = fs->fs_bsize >> DEV_BSHIFT;
6115 	int		error = 0;
6116 	int		ndbs, nfsbs;
6117 
6118 	/*
6119 	 * forced unmount case
6120 	 */
6121 	if (ip->i_ufsvfs == NULL)
6122 		return (EIO);
6123 	/*
6124 	 * Validate the inode that it has not been modified since
6125 	 * the dump structure is allocated.
6126 	 */
6127 	mutex_enter(&ip->i_tlock);
6128 	if ((dump_info == NULL) ||
6129 	    (dump_info->ip != ip) ||
6130 	    (dump_info->time.tv_sec != ip->i_mtime.tv_sec) ||
6131 	    (dump_info->time.tv_usec != ip->i_mtime.tv_usec)) {
6132 		mutex_exit(&ip->i_tlock);
6133 		return (-1);
6134 	}
6135 	mutex_exit(&ip->i_tlock);
6136 
6137 	/*
6138 	 * See that the file has room for this write
6139 	 */
6140 	UFS_GET_ISIZE(&file_size, ip);
6141 
6142 	if (ldbtob(ldbn + dblks) > file_size)
6143 		return (ENOSPC);
6144 
6145 	/*
6146 	 * Find the physical disk block numbers from the dump
6147 	 * private data structure directly and write out the data
6148 	 * in contiguous block lumps
6149 	 */
6150 	while (dblks > 0 && !error) {
6151 		lfsbn = (daddr_t)lblkno(fs, ldbtob(ldbn));
6152 		dbn = fsbtodb(fs, dump_info->dblk[lfsbn]) + ldbn % disk_blks;
6153 		nfsbs = 1;
6154 		ndbs = disk_blks - ldbn % disk_blks;
6155 		while (ndbs < dblks && fsbtodb(fs, dump_info->dblk[lfsbn +
6156 		    nfsbs]) == dbn + ndbs) {
6157 			nfsbs++;
6158 			ndbs += disk_blks;
6159 		}
6160 		if (ndbs > dblks)
6161 			ndbs = dblks;
6162 		error = bdev_dump(ip->i_dev, addr, dbn, ndbs);
6163 		addr += ldbtob((offset_t)ndbs);
6164 		dblks -= ndbs;
6165 		ldbn += ndbs;
6166 	}
6167 	return (error);
6168 
6169 }
6170 
6171 /*
6172  * Prepare the file system before and after the dump operation.
6173  *
6174  * action = DUMP_ALLOC:
6175  * Preparation before dump, allocate dump private data structure
6176  * to hold all the direct and indirect block info for dump.
6177  *
6178  * action = DUMP_FREE:
6179  * Clean up after dump, deallocate the dump private data structure.
6180  *
6181  * action = DUMP_SCAN:
6182  * Scan dump_info for *blkp DEV_BSIZE blocks of contig fs space;
6183  * if found, the starting file-relative DEV_BSIZE lbn is written
6184  * to *bklp; that lbn is intended for use with VOP_DUMP()
6185  */
6186 /*ARGSUSED*/
6187 static int
6188 ufs_dumpctl(vnode_t *vp, int action, offset_t *blkp, caller_context_t *ct)
6189 {
6190 	struct inode	*ip = VTOI(vp);
6191 	ufsvfs_t	*ufsvfsp = ip->i_ufsvfs;
6192 	struct fs	*fs;
6193 	daddr32_t	*dblk, *storeblk;
6194 	daddr32_t	*nextblk, *endblk;
6195 	struct buf	*bp;
6196 	int		i, entry, entries;
6197 	int		n, ncontig;
6198 
6199 	/*
6200 	 * check for forced unmount
6201 	 */
6202 	if (ufsvfsp == NULL)
6203 		return (EIO);
6204 
6205 	if (action == DUMP_ALLOC) {
6206 		/*
6207 		 * alloc and record dump_info
6208 		 */
6209 		if (dump_info != NULL)
6210 			return (EINVAL);
6211 
6212 		ASSERT(vp->v_type == VREG);
6213 		fs = ufsvfsp->vfs_fs;
6214 
6215 		rw_enter(&ip->i_contents, RW_READER);
6216 
6217 		if (bmap_has_holes(ip)) {
6218 			rw_exit(&ip->i_contents);
6219 			return (EFAULT);
6220 		}
6221 
6222 		/*
6223 		 * calculate and allocate space needed according to i_size
6224 		 */
6225 		entries = (int)lblkno(fs, blkroundup(fs, ip->i_size));
6226 		dump_info = kmem_alloc(sizeof (struct dump) +
6227 		    (entries - 1) * sizeof (daddr32_t), KM_NOSLEEP);
6228 		if (dump_info == NULL) {
6229 			rw_exit(&ip->i_contents);
6230 			return (ENOMEM);
6231 		}
6232 
6233 		/* Start saving the info */
6234 		dump_info->fsbs = entries;
6235 		dump_info->ip = ip;
6236 		storeblk = &dump_info->dblk[0];
6237 
6238 		/* Direct Blocks */
6239 		for (entry = 0; entry < NDADDR && entry < entries; entry++)
6240 			*storeblk++ = ip->i_db[entry];
6241 
6242 		/* Indirect Blocks */
6243 		for (i = 0; i < NIADDR; i++) {
6244 			int error = 0;
6245 
6246 			bp = UFS_BREAD(ufsvfsp,
6247 			    ip->i_dev, fsbtodb(fs, ip->i_ib[i]), fs->fs_bsize);
6248 			if (bp->b_flags & B_ERROR)
6249 				error = EIO;
6250 			else {
6251 				dblk = bp->b_un.b_daddr;
6252 				if ((storeblk = save_dblks(ip, ufsvfsp,
6253 				    storeblk, dblk, i, entries)) == NULL)
6254 					error = EIO;
6255 			}
6256 
6257 			brelse(bp);
6258 
6259 			if (error != 0) {
6260 				kmem_free(dump_info, sizeof (struct dump) +
6261 				    (entries - 1) * sizeof (daddr32_t));
6262 				rw_exit(&ip->i_contents);
6263 				dump_info = NULL;
6264 				return (error);
6265 			}
6266 		}
6267 		/* and time stamp the information */
6268 		mutex_enter(&ip->i_tlock);
6269 		dump_info->time = ip->i_mtime;
6270 		mutex_exit(&ip->i_tlock);
6271 
6272 		rw_exit(&ip->i_contents);
6273 	} else if (action == DUMP_FREE) {
6274 		/*
6275 		 * free dump_info
6276 		 */
6277 		if (dump_info == NULL)
6278 			return (EINVAL);
6279 		entries = dump_info->fsbs - 1;
6280 		kmem_free(dump_info, sizeof (struct dump) +
6281 		    entries * sizeof (daddr32_t));
6282 		dump_info = NULL;
6283 	} else if (action == DUMP_SCAN) {
6284 		/*
6285 		 * scan dump_info
6286 		 */
6287 		if (dump_info == NULL)
6288 			return (EINVAL);
6289 
6290 		dblk = dump_info->dblk;
6291 		nextblk = dblk + 1;
6292 		endblk = dblk + dump_info->fsbs - 1;
6293 		fs = ufsvfsp->vfs_fs;
6294 		ncontig = *blkp >> (fs->fs_bshift - DEV_BSHIFT);
6295 
6296 		/*
6297 		 * scan dblk[] entries; contig fs space is found when:
6298 		 * ((current blkno + frags per block) == next blkno)
6299 		 */
6300 		n = 0;
6301 		while (n < ncontig && dblk < endblk) {
6302 			if ((*dblk + fs->fs_frag) == *nextblk)
6303 				n++;
6304 			else
6305 				n = 0;
6306 			dblk++;
6307 			nextblk++;
6308 		}
6309 
6310 		/*
6311 		 * index is where size bytes of contig space begins;
6312 		 * conversion from index to the file's DEV_BSIZE lbn
6313 		 * is equivalent to:  (index * fs_bsize) / DEV_BSIZE
6314 		 */
6315 		if (n == ncontig) {
6316 			i = (dblk - dump_info->dblk) - ncontig;
6317 			*blkp = i << (fs->fs_bshift - DEV_BSHIFT);
6318 		} else
6319 			return (EFAULT);
6320 	}
6321 	return (0);
6322 }
6323 
6324 /*
6325  * Recursive helper function for ufs_dumpctl().  It follows the indirect file
6326  * system  blocks until it reaches the the disk block addresses, which are
6327  * then stored into the given buffer, storeblk.
6328  */
6329 static daddr32_t *
6330 save_dblks(struct inode *ip, struct ufsvfs *ufsvfsp,  daddr32_t *storeblk,
6331     daddr32_t *dblk, int level, int entries)
6332 {
6333 	struct fs	*fs = ufsvfsp->vfs_fs;
6334 	struct buf	*bp;
6335 	int		i;
6336 
6337 	if (level == 0) {
6338 		for (i = 0; i < NINDIR(fs); i++) {
6339 			if (storeblk - dump_info->dblk >= entries)
6340 				break;
6341 			*storeblk++ = dblk[i];
6342 		}
6343 		return (storeblk);
6344 	}
6345 	for (i = 0; i < NINDIR(fs); i++) {
6346 		if (storeblk - dump_info->dblk >= entries)
6347 			break;
6348 		bp = UFS_BREAD(ufsvfsp,
6349 		    ip->i_dev, fsbtodb(fs, dblk[i]), fs->fs_bsize);
6350 		if (bp->b_flags & B_ERROR) {
6351 			brelse(bp);
6352 			return (NULL);
6353 		}
6354 		storeblk = save_dblks(ip, ufsvfsp, storeblk, bp->b_un.b_daddr,
6355 		    level - 1, entries);
6356 		brelse(bp);
6357 
6358 		if (storeblk == NULL)
6359 			return (NULL);
6360 	}
6361 	return (storeblk);
6362 }
6363 
6364 /* ARGSUSED */
6365 static int
6366 ufs_getsecattr(struct vnode *vp, vsecattr_t *vsap, int flag,
6367 	struct cred *cr, caller_context_t *ct)
6368 {
6369 	struct inode	*ip = VTOI(vp);
6370 	struct ulockfs	*ulp;
6371 	struct ufsvfs	*ufsvfsp = ip->i_ufsvfs;
6372 	ulong_t		vsa_mask = vsap->vsa_mask;
6373 	int		err = EINVAL;
6374 
6375 	vsa_mask &= (VSA_ACL | VSA_ACLCNT | VSA_DFACL | VSA_DFACLCNT);
6376 
6377 	/*
6378 	 * Only grab locks if needed - they're not needed to check vsa_mask
6379 	 * or if the mask contains no acl flags.
6380 	 */
6381 	if (vsa_mask != 0) {
6382 		if (err = ufs_lockfs_begin(ufsvfsp, &ulp,
6383 		    ULOCKFS_GETATTR_MASK))
6384 			return (err);
6385 
6386 		rw_enter(&ip->i_contents, RW_READER);
6387 		err = ufs_acl_get(ip, vsap, flag, cr);
6388 		rw_exit(&ip->i_contents);
6389 
6390 		if (ulp)
6391 			ufs_lockfs_end(ulp);
6392 	}
6393 	return (err);
6394 }
6395 
6396 /* ARGSUSED */
6397 static int
6398 ufs_setsecattr(struct vnode *vp, vsecattr_t *vsap, int flag, struct cred *cr,
6399 	caller_context_t *ct)
6400 {
6401 	struct inode	*ip = VTOI(vp);
6402 	struct ulockfs	*ulp = NULL;
6403 	struct ufsvfs	*ufsvfsp = VTOI(vp)->i_ufsvfs;
6404 	ulong_t		vsa_mask = vsap->vsa_mask;
6405 	int		err;
6406 	int		haverwlock = 1;
6407 	int		trans_size;
6408 	int		donetrans = 0;
6409 	int		retry = 1;
6410 
6411 	ASSERT(RW_LOCK_HELD(&ip->i_rwlock));
6412 
6413 	/* Abort now if the request is either empty or invalid. */
6414 	vsa_mask &= (VSA_ACL | VSA_ACLCNT | VSA_DFACL | VSA_DFACLCNT);
6415 	if ((vsa_mask == 0) ||
6416 	    ((vsap->vsa_aclentp == NULL) &&
6417 	    (vsap->vsa_dfaclentp == NULL))) {
6418 		err = EINVAL;
6419 		goto out;
6420 	}
6421 
6422 	/*
6423 	 * Following convention, if this is a directory then we acquire the
6424 	 * inode's i_rwlock after starting a UFS logging transaction;
6425 	 * otherwise, we acquire it beforehand. Since we were called (and
6426 	 * must therefore return) with the lock held, we will have to drop it,
6427 	 * and later reacquire it, if operating on a directory.
6428 	 */
6429 	if (vp->v_type == VDIR) {
6430 		rw_exit(&ip->i_rwlock);
6431 		haverwlock = 0;
6432 	} else {
6433 		/* Upgrade the lock if required. */
6434 		if (!rw_write_held(&ip->i_rwlock)) {
6435 			rw_exit(&ip->i_rwlock);
6436 			rw_enter(&ip->i_rwlock, RW_WRITER);
6437 		}
6438 	}
6439 
6440 again:
6441 	ASSERT(!(vp->v_type == VDIR && haverwlock));
6442 	if (err = ufs_lockfs_begin(ufsvfsp, &ulp, ULOCKFS_SETATTR_MASK)) {
6443 		ulp = NULL;
6444 		retry = 0;
6445 		goto out;
6446 	}
6447 
6448 	/*
6449 	 * Check that the file system supports this operation. Note that
6450 	 * ufs_lockfs_begin() will have checked that the file system had
6451 	 * not been forcibly unmounted.
6452 	 */
6453 	if (ufsvfsp->vfs_fs->fs_ronly) {
6454 		err = EROFS;
6455 		goto out;
6456 	}
6457 	if (ufsvfsp->vfs_nosetsec) {
6458 		err = ENOSYS;
6459 		goto out;
6460 	}
6461 
6462 	if (ulp) {
6463 		TRANS_BEGIN_ASYNC(ufsvfsp, TOP_SETSECATTR,
6464 		    trans_size = TOP_SETSECATTR_SIZE(VTOI(vp)));
6465 		donetrans = 1;
6466 	}
6467 
6468 	if (vp->v_type == VDIR) {
6469 		rw_enter(&ip->i_rwlock, RW_WRITER);
6470 		haverwlock = 1;
6471 	}
6472 
6473 	ASSERT(haverwlock);
6474 
6475 	/* Do the actual work. */
6476 	rw_enter(&ip->i_contents, RW_WRITER);
6477 	/*
6478 	 * Suppress out of inodes messages if we will retry.
6479 	 */
6480 	if (retry)
6481 		ip->i_flag |= IQUIET;
6482 	err = ufs_acl_set(ip, vsap, flag, cr);
6483 	ip->i_flag &= ~IQUIET;
6484 	rw_exit(&ip->i_contents);
6485 
6486 out:
6487 	if (ulp) {
6488 		if (donetrans) {
6489 			/*
6490 			 * top_end_async() can eventually call
6491 			 * top_end_sync(), which can block. We must
6492 			 * therefore observe the lock-ordering protocol
6493 			 * here as well.
6494 			 */
6495 			if (vp->v_type == VDIR) {
6496 				rw_exit(&ip->i_rwlock);
6497 				haverwlock = 0;
6498 			}
6499 			TRANS_END_ASYNC(ufsvfsp, TOP_SETSECATTR, trans_size);
6500 		}
6501 		ufs_lockfs_end(ulp);
6502 	}
6503 	/*
6504 	 * If no inodes available, try scaring a logically-
6505 	 * free one out of the delete queue to someplace
6506 	 * that we can find it.
6507 	 */
6508 	if ((err == ENOSPC) && retry && TRANS_ISTRANS(ufsvfsp)) {
6509 		ufs_delete_drain_wait(ufsvfsp, 1);
6510 		retry = 0;
6511 		if (vp->v_type == VDIR && haverwlock) {
6512 			rw_exit(&ip->i_rwlock);
6513 			haverwlock = 0;
6514 		}
6515 		goto again;
6516 	}
6517 	/*
6518 	 * If we need to reacquire the lock then it is safe to do so
6519 	 * as a reader. This is because ufs_rwunlock(), which will be
6520 	 * called by our caller after we return, does not differentiate
6521 	 * between shared and exclusive locks.
6522 	 */
6523 	if (!haverwlock) {
6524 		ASSERT(vp->v_type == VDIR);
6525 		rw_enter(&ip->i_rwlock, RW_READER);
6526 	}
6527 
6528 	return (err);
6529 }
6530