xref: /titanic_41/usr/src/uts/common/fs/ufs/ufs_vnops.c (revision 35f36846429327ed1512f8098c6a6b337055d875)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License, Version 1.0 only
6  * (the "License").  You may not use this file except in compliance
7  * with the License.
8  *
9  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
10  * or http://www.opensolaris.org/os/licensing.
11  * See the License for the specific language governing permissions
12  * and limitations under the License.
13  *
14  * When distributing Covered Code, include this CDDL HEADER in each
15  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
16  * If applicable, add the following below this CDDL HEADER, with the
17  * fields enclosed by brackets "[]" replaced with your own identifying
18  * information: Portions Copyright [yyyy] [name of copyright owner]
19  *
20  * CDDL HEADER END
21  */
22 /*
23  * Copyright 2005 Sun Microsystems, Inc.  All rights reserved.
24  * Use is subject to license terms.
25  */
26 
27 /*	Copyright (c) 1983, 1984, 1985, 1986, 1987, 1988, 1989 AT&T	*/
28 /*	  All Rights Reserved  	*/
29 
30 /*
31  * Portions of this source code were derived from Berkeley 4.3 BSD
32  * under license from the Regents of the University of California.
33  */
34 
35 #pragma ident	"%Z%%M%	%I%	%E% SMI"
36 
37 #include <sys/types.h>
38 #include <sys/t_lock.h>
39 #include <sys/ksynch.h>
40 #include <sys/param.h>
41 #include <sys/time.h>
42 #include <sys/systm.h>
43 #include <sys/sysmacros.h>
44 #include <sys/resource.h>
45 #include <sys/signal.h>
46 #include <sys/cred.h>
47 #include <sys/user.h>
48 #include <sys/buf.h>
49 #include <sys/vfs.h>
50 #include <sys/vnode.h>
51 #include <sys/proc.h>
52 #include <sys/disp.h>
53 #include <sys/file.h>
54 #include <sys/fcntl.h>
55 #include <sys/flock.h>
56 #include <sys/atomic.h>
57 #include <sys/kmem.h>
58 #include <sys/uio.h>
59 #include <sys/dnlc.h>
60 #include <sys/conf.h>
61 #include <sys/mman.h>
62 #include <sys/pathname.h>
63 #include <sys/debug.h>
64 #include <sys/vmsystm.h>
65 #include <sys/cmn_err.h>
66 #include <sys/vtrace.h>
67 #include <sys/filio.h>
68 #include <sys/policy.h>
69 
70 #include <sys/fs/ufs_fs.h>
71 #include <sys/fs/ufs_lockfs.h>
72 #include <sys/fs/ufs_filio.h>
73 #include <sys/fs/ufs_inode.h>
74 #include <sys/fs/ufs_fsdir.h>
75 #include <sys/fs/ufs_quota.h>
76 #include <sys/fs/ufs_log.h>
77 #include <sys/fs/ufs_snap.h>
78 #include <sys/fs/ufs_trans.h>
79 #include <sys/fs/ufs_panic.h>
80 #include <sys/fs/ufs_bio.h>
81 #include <sys/dirent.h>		/* must be AFTER <sys/fs/fsdir.h>! */
82 #include <sys/errno.h>
83 #include <sys/fssnap_if.h>
84 #include <sys/unistd.h>
85 #include <sys/sunddi.h>
86 
87 #include <sys/filio.h>		/* _FIOIO */
88 
89 #include <vm/hat.h>
90 #include <vm/page.h>
91 #include <vm/pvn.h>
92 #include <vm/as.h>
93 #include <vm/seg.h>
94 #include <vm/seg_map.h>
95 #include <vm/seg_vn.h>
96 #include <vm/seg_kmem.h>
97 #include <vm/rm.h>
98 #include <sys/swap.h>
99 
100 #include <fs/fs_subr.h>
101 
102 static struct instats ins;
103 
104 static 	int ufs_getpage_ra(struct vnode *, u_offset_t, struct seg *, caddr_t);
105 static	int ufs_getpage_miss(struct vnode *, u_offset_t, size_t, struct seg *,
106 		caddr_t, struct page **, size_t, enum seg_rw, int);
107 static	int ufs_open(struct vnode **, int, struct cred *);
108 static	int ufs_close(struct vnode *, int, int, offset_t, struct cred *);
109 static	int ufs_read(struct vnode *, struct uio *, int, struct cred *,
110 			struct caller_context *);
111 static	int ufs_write(struct vnode *, struct uio *, int, struct cred *,
112 			struct caller_context *);
113 static	int ufs_ioctl(struct vnode *, int, intptr_t, int, struct cred *, int *);
114 static	int ufs_getattr(struct vnode *, struct vattr *, int, struct cred *);
115 static	int ufs_setattr(struct vnode *, struct vattr *, int, struct cred *,
116 			caller_context_t *);
117 static	int ufs_access(struct vnode *, int, int, struct cred *);
118 static	int ufs_lookup(struct vnode *, char *, struct vnode **,
119 		struct pathname *, int, struct vnode *, struct cred *);
120 static	int ufs_create(struct vnode *, char *, struct vattr *, enum vcexcl,
121 			int, struct vnode **, struct cred *, int);
122 static	int ufs_remove(struct vnode *, char *, struct cred *);
123 static	int ufs_link(struct vnode *, struct vnode *, char *, struct cred *);
124 static	int ufs_rename(struct vnode *, char *, struct vnode *, char *,
125 			struct cred *);
126 static	int ufs_mkdir(struct vnode *, char *, struct vattr *, struct vnode **,
127 			struct cred *);
128 static	int ufs_rmdir(struct vnode *, char *, struct vnode *, struct cred *);
129 static	int ufs_readdir(struct vnode *, struct uio *, struct cred *, int *);
130 static	int ufs_symlink(struct vnode *, char *, struct vattr *, char *,
131 			struct cred *);
132 static	int ufs_readlink(struct vnode *, struct uio *, struct cred *);
133 static	int ufs_fsync(struct vnode *, int, struct cred *);
134 static	void ufs_inactive(struct vnode *, struct cred *);
135 static	int ufs_fid(struct vnode *, struct fid *);
136 static	int ufs_rwlock(struct vnode *, int, caller_context_t *);
137 static	void ufs_rwunlock(struct vnode *, int, caller_context_t *);
138 static	int ufs_seek(struct vnode *, offset_t, offset_t *);
139 static	int ufs_frlock(struct vnode *, int, struct flock64 *, int, offset_t,
140 			struct flk_callback *, struct cred *);
141 static  int ufs_space(struct vnode *, int, struct flock64 *, int, offset_t,
142 		cred_t *, caller_context_t *);
143 static	int ufs_getpage(struct vnode *, offset_t, size_t, uint_t *,
144 		struct page **, size_t, struct seg *, caddr_t,
145 		enum seg_rw, struct cred *);
146 static	int ufs_putpage(struct vnode *, offset_t, size_t, int, struct cred *);
147 static	int ufs_putpages(struct vnode *, offset_t, size_t, int, struct cred *);
148 static	int ufs_map(struct vnode *, offset_t, struct as *, caddr_t *, size_t,
149 			uchar_t, uchar_t, uint_t, struct cred *);
150 static	int ufs_addmap(struct vnode *, offset_t, struct as *, caddr_t,  size_t,
151 			uchar_t, uchar_t, uint_t, struct cred *);
152 static	int ufs_delmap(struct vnode *, offset_t, struct as *, caddr_t,  size_t,
153 			uint_t, uint_t, uint_t, struct cred *);
154 static	int ufs_poll(vnode_t *, short, int, short *, struct pollhead **);
155 static	int ufs_dump(vnode_t *, caddr_t, int, int);
156 static	int ufs_l_pathconf(struct vnode *, int, ulong_t *, struct cred *);
157 static	int ufs_pageio(struct vnode *, struct page *, u_offset_t, size_t, int,
158 			struct cred *);
159 static	int ufs_dump(vnode_t *, caddr_t, int, int);
160 static	int ufs_dumpctl(vnode_t *, int, int *);
161 static	daddr32_t *save_dblks(struct inode *, struct ufsvfs *, daddr32_t *,
162 			daddr32_t *, int, int);
163 static	int ufs_getsecattr(struct vnode *, vsecattr_t *, int, struct cred *);
164 static	int ufs_setsecattr(struct vnode *, vsecattr_t *, int, struct cred *);
165 
166 /*
167  * For lockfs: ulockfs begin/end is now inlined in the ufs_xxx functions.
168  *
169  * XXX - ULOCKFS in fs_pathconf and ufs_ioctl is not inlined yet.
170  */
171 struct vnodeops *ufs_vnodeops;
172 
173 const fs_operation_def_t ufs_vnodeops_template[] = {
174 	VOPNAME_OPEN, ufs_open,	/* will not be blocked by lockfs */
175 	VOPNAME_CLOSE, ufs_close,	/* will not be blocked by lockfs */
176 	VOPNAME_READ, ufs_read,
177 	VOPNAME_WRITE, ufs_write,
178 	VOPNAME_IOCTL, ufs_ioctl,
179 	VOPNAME_GETATTR, ufs_getattr,
180 	VOPNAME_SETATTR, ufs_setattr,
181 	VOPNAME_ACCESS, ufs_access,
182 	VOPNAME_LOOKUP, ufs_lookup,
183 	VOPNAME_CREATE, ufs_create,
184 	VOPNAME_REMOVE, ufs_remove,
185 	VOPNAME_LINK, ufs_link,
186 	VOPNAME_RENAME, ufs_rename,
187 	VOPNAME_MKDIR, ufs_mkdir,
188 	VOPNAME_RMDIR, ufs_rmdir,
189 	VOPNAME_READDIR, ufs_readdir,
190 	VOPNAME_SYMLINK, ufs_symlink,
191 	VOPNAME_READLINK, ufs_readlink,
192 	VOPNAME_FSYNC, ufs_fsync,
193 	VOPNAME_INACTIVE, (fs_generic_func_p) ufs_inactive,  /* not blocked */
194 	VOPNAME_FID, ufs_fid,
195 	VOPNAME_RWLOCK, ufs_rwlock, /* not blocked */
196 	VOPNAME_RWUNLOCK, (fs_generic_func_p) ufs_rwunlock,  /* not blocked */
197 	VOPNAME_SEEK, ufs_seek,
198 	VOPNAME_FRLOCK, ufs_frlock,
199 	VOPNAME_SPACE, ufs_space,
200 	VOPNAME_GETPAGE, ufs_getpage,
201 	VOPNAME_PUTPAGE, ufs_putpage,
202 	VOPNAME_MAP, (fs_generic_func_p) ufs_map,
203 	VOPNAME_ADDMAP, (fs_generic_func_p) ufs_addmap,	/* not blocked */
204 	VOPNAME_DELMAP, ufs_delmap,	/* will not be blocked by lockfs */
205 	VOPNAME_POLL, (fs_generic_func_p) ufs_poll,	/* not blocked */
206 	VOPNAME_DUMP, ufs_dump,
207 	VOPNAME_PATHCONF, ufs_l_pathconf,
208 	VOPNAME_PAGEIO, ufs_pageio,
209 	VOPNAME_DUMPCTL, ufs_dumpctl,
210 	VOPNAME_GETSECATTR, ufs_getsecattr,
211 	VOPNAME_SETSECATTR, ufs_setsecattr,
212 	VOPNAME_VNEVENT, fs_vnevent_support,
213 	NULL, NULL
214 };
215 
216 #define	MAX_BACKFILE_COUNT	9999
217 
218 /*
219  * Created by ufs_dumpctl() to store a file's disk block info into memory.
220  * Used by ufs_dump() to dump data to disk directly.
221  */
222 struct dump {
223 	struct inode	*ip;		/* the file we contain */
224 	daddr_t		fsbs;		/* number of blocks stored */
225 	struct timeval32 time;		/* time stamp for the struct */
226 	daddr32_t 	dblk[1];	/* place holder for block info */
227 };
228 
229 static struct dump *dump_info = NULL;
230 
231 /*
232  * Previously there was no special action required for ordinary files.
233  * (Devices are handled through the device file system.)
234  * Now we support Large Files and Large File API requires open to
235  * fail if file is large.
236  * We could take care to prevent data corruption
237  * by doing an atomic check of size and truncate if file is opened with
238  * FTRUNC flag set but traditionally this is being done by the vfs/vnode
239  * layers. So taking care of truncation here is a change in the existing
240  * semantics of VOP_OPEN and therefore we chose not to implement any thing
241  * here. The check for the size of the file > 2GB is being done at the
242  * vfs layer in routine vn_open().
243  */
244 
245 /* ARGSUSED */
246 static int
247 ufs_open(struct vnode **vpp, int flag, struct cred *cr)
248 {
249 	TRACE_1(TR_FAC_UFS, TR_UFS_OPEN, "ufs_open:vpp %p", vpp);
250 	return (0);
251 }
252 
253 /*ARGSUSED*/
254 static int
255 ufs_close(struct vnode *vp, int flag, int count, offset_t offset,
256 	struct cred *cr)
257 {
258 	TRACE_1(TR_FAC_UFS, TR_UFS_CLOSE, "ufs_close:vp %p", vp);
259 
260 	cleanlocks(vp, ttoproc(curthread)->p_pid, 0);
261 	cleanshares(vp, ttoproc(curthread)->p_pid);
262 
263 	/*
264 	 * Push partially filled cluster at last close.
265 	 * ``last close'' is approximated because the dnlc
266 	 * may have a hold on the vnode.
267 	 * Checking for VBAD here will also act as a forced umount check.
268 	 */
269 	if (vp->v_count <= 2 && vp->v_type != VBAD) {
270 		struct inode *ip = VTOI(vp);
271 		if (ip->i_delaylen) {
272 			ins.in_poc.value.ul++;
273 			(void) ufs_putpages(vp, ip->i_delayoff, ip->i_delaylen,
274 					B_ASYNC | B_FREE, cr);
275 			ip->i_delaylen = 0;
276 		}
277 	}
278 
279 	return (0);
280 }
281 
282 /*ARGSUSED*/
283 static int
284 ufs_read(struct vnode *vp, struct uio *uiop, int ioflag, struct cred *cr,
285 	struct caller_context *ct)
286 {
287 	struct inode *ip = VTOI(vp);
288 	struct ufsvfs *ufsvfsp;
289 	struct ulockfs *ulp = NULL;
290 	int error = 0;
291 	int intrans = 0;
292 
293 	ASSERT(RW_READ_HELD(&ip->i_rwlock));
294 	TRACE_3(TR_FAC_UFS, TR_UFS_READ_START,
295 		"ufs_read_start:vp %p uiop %p ioflag %x",
296 		vp, uiop, ioflag);
297 
298 	/*
299 	 * Mandatory locking needs to be done before ufs_lockfs_begin()
300 	 * and TRANS_BEGIN_SYNC() calls since mandatory locks can sleep.
301 	 */
302 	if (MANDLOCK(vp, ip->i_mode)) {
303 		/*
304 		 * ufs_getattr ends up being called by chklock
305 		 */
306 		error = chklock(vp, FREAD, uiop->uio_loffset,
307 				uiop->uio_resid, uiop->uio_fmode, ct);
308 		if (error)
309 			goto out;
310 	}
311 
312 	ufsvfsp = ip->i_ufsvfs;
313 	error = ufs_lockfs_begin(ufsvfsp, &ulp, ULOCKFS_READ_MASK);
314 	if (error)
315 		goto out;
316 
317 	/*
318 	 * In the case that a directory is opened for reading as a file
319 	 * (eg "cat .") with the  O_RSYNC, O_SYNC and O_DSYNC flags set.
320 	 * The locking order had to be changed to avoid a deadlock with
321 	 * an update taking place on that directory at the same time.
322 	 */
323 	if ((ip->i_mode & IFMT) == IFDIR) {
324 
325 		rw_enter(&ip->i_contents, RW_READER);
326 		error = rdip(ip, uiop, ioflag, cr);
327 		rw_exit(&ip->i_contents);
328 
329 		if (error) {
330 			if (ulp)
331 				ufs_lockfs_end(ulp);
332 			goto out;
333 		}
334 
335 		if (ulp && (ioflag & FRSYNC) && (ioflag & (FSYNC | FDSYNC)) &&
336 		    TRANS_ISTRANS(ufsvfsp)) {
337 			rw_exit(&ip->i_rwlock);
338 			TRANS_BEGIN_SYNC(ufsvfsp, TOP_READ_SYNC, TOP_READ_SIZE,
339 			    error);
340 			ASSERT(!error);
341 			TRANS_END_SYNC(ufsvfsp, error, TOP_READ_SYNC,
342 			    TOP_READ_SIZE);
343 			rw_enter(&ip->i_rwlock, RW_READER);
344 		}
345 	} else {
346 		/*
347 		 * Only transact reads to files opened for sync-read and
348 		 * sync-write on a file system that is not write locked.
349 		 *
350 		 * The ``not write locked'' check prevents problems with
351 		 * enabling/disabling logging on a busy file system.  E.g.,
352 		 * logging exists at the beginning of the read but does not
353 		 * at the end.
354 		 *
355 		 */
356 		if (ulp && (ioflag & FRSYNC) && (ioflag & (FSYNC | FDSYNC)) &&
357 		    TRANS_ISTRANS(ufsvfsp)) {
358 			TRANS_BEGIN_SYNC(ufsvfsp, TOP_READ_SYNC, TOP_READ_SIZE,
359 			    error);
360 			ASSERT(!error);
361 			intrans = 1;
362 		}
363 
364 		rw_enter(&ip->i_contents, RW_READER);
365 		error = rdip(ip, uiop, ioflag, cr);
366 		rw_exit(&ip->i_contents);
367 
368 		if (intrans) {
369 			TRANS_END_SYNC(ufsvfsp, error, TOP_READ_SYNC,
370 			    TOP_READ_SIZE);
371 		}
372 	}
373 
374 	if (ulp) {
375 		ufs_lockfs_end(ulp);
376 	}
377 out:
378 
379 	TRACE_2(TR_FAC_UFS, TR_UFS_READ_END,
380 		"ufs_read_end:vp %p error %d", vp, error);
381 	return (error);
382 }
383 
384 extern	int	ufs_HW;		/* high water mark */
385 extern	int	ufs_LW;		/* low water mark */
386 int	ufs_WRITES = 1;		/* XXX - enable/disable */
387 int	ufs_throttles = 0;	/* throttling count */
388 int	ufs_allow_shared_writes = 1;	/* directio shared writes */
389 
390 static int
391 ufs_check_rewrite(struct inode *ip, struct uio *uiop, int ioflag)
392 {
393 	int	shared_write;
394 
395 	/*
396 	 * If the FDSYNC flag is set then ignore the global
397 	 * ufs_allow_shared_writes in this case.
398 	 */
399 	shared_write = (ioflag & FDSYNC) | ufs_allow_shared_writes;
400 
401 	/*
402 	 * Filter to determine if this request is suitable as a
403 	 * concurrent rewrite. This write must not allocate blocks
404 	 * by extending the file or filling in holes. No use trying
405 	 * through FSYNC descriptors as the inode will be synchronously
406 	 * updated after the write. The uio structure has not yet been
407 	 * checked for sanity, so assume nothing.
408 	 */
409 	return (((ip->i_mode & IFMT) == IFREG) && !(ioflag & FAPPEND) &&
410 		(uiop->uio_loffset >= (offset_t)0) &&
411 		(uiop->uio_loffset < ip->i_size) && (uiop->uio_resid > 0) &&
412 		((ip->i_size - uiop->uio_loffset) >= uiop->uio_resid) &&
413 		!(ioflag & FSYNC) && !bmap_has_holes(ip) &&
414 		shared_write);
415 }
416 
417 /*ARGSUSED*/
418 static int
419 ufs_write(struct vnode *vp, struct uio *uiop, int ioflag, cred_t *cr,
420 	caller_context_t *ct)
421 {
422 	struct inode *ip = VTOI(vp);
423 	struct ufsvfs *ufsvfsp;
424 	struct ulockfs *ulp;
425 	int retry = 1;
426 	int error, resv, resid = 0;
427 	int directio_status;
428 	int exclusive;
429 	int rewriteflg;
430 	long start_resid = uiop->uio_resid;
431 
432 	TRACE_3(TR_FAC_UFS, TR_UFS_WRITE_START,
433 		"ufs_write_start:vp %p uiop %p ioflag %x",
434 		vp, uiop, ioflag);
435 
436 	ASSERT(RW_LOCK_HELD(&ip->i_rwlock));
437 
438 retry_mandlock:
439 	/*
440 	 * Mandatory locking needs to be done before ufs_lockfs_begin()
441 	 * and TRANS_BEGIN_[A]SYNC() calls since mandatory locks can sleep.
442 	 * Check for forced unmounts normally done in ufs_lockfs_begin().
443 	 */
444 	if ((ufsvfsp = ip->i_ufsvfs) == NULL) {
445 		error = EIO;
446 		goto out;
447 	}
448 	if (MANDLOCK(vp, ip->i_mode)) {
449 
450 		ASSERT(RW_WRITE_HELD(&ip->i_rwlock));
451 
452 		/*
453 		 * ufs_getattr ends up being called by chklock
454 		 */
455 		error = chklock(vp, FWRITE, uiop->uio_loffset,
456 				uiop->uio_resid, uiop->uio_fmode, ct);
457 		if (error)
458 			goto out;
459 	}
460 
461 	/* i_rwlock can change in chklock */
462 	exclusive = rw_write_held(&ip->i_rwlock);
463 	rewriteflg = ufs_check_rewrite(ip, uiop, ioflag);
464 
465 	/*
466 	 * Check for fast-path special case of directio re-writes.
467 	 */
468 	if ((ip->i_flag & IDIRECTIO || ufsvfsp->vfs_forcedirectio) &&
469 	    !exclusive && rewriteflg) {
470 
471 		error = ufs_lockfs_begin(ufsvfsp, &ulp, ULOCKFS_WRITE_MASK);
472 		if (error)
473 			goto out;
474 
475 		rw_enter(&ip->i_contents, RW_READER);
476 		error = ufs_directio_write(ip, uiop, ioflag, 1, cr,
477 			&directio_status);
478 		if (directio_status == DIRECTIO_SUCCESS) {
479 			uint_t i_flag_save;
480 
481 			if (start_resid != uiop->uio_resid)
482 				error = 0;
483 			/*
484 			 * Special treatment of access times for re-writes.
485 			 * If IMOD is not already set, then convert it
486 			 * to IMODACC for this operation. This defers
487 			 * entering a delta into the log until the inode
488 			 * is flushed. This mimics what is done for read
489 			 * operations and inode access time.
490 			 */
491 			mutex_enter(&ip->i_tlock);
492 			i_flag_save = ip->i_flag;
493 			ip->i_flag |= IUPD | ICHG;
494 			ip->i_seq++;
495 			ITIMES_NOLOCK(ip);
496 			if ((i_flag_save & IMOD) == 0) {
497 				ip->i_flag &= ~IMOD;
498 				ip->i_flag |= IMODACC;
499 			}
500 			mutex_exit(&ip->i_tlock);
501 			rw_exit(&ip->i_contents);
502 			if (ulp)
503 				ufs_lockfs_end(ulp);
504 			goto out;
505 		}
506 		rw_exit(&ip->i_contents);
507 		if (ulp)
508 			ufs_lockfs_end(ulp);
509 	}
510 
511 	if (!exclusive && !rw_tryupgrade(&ip->i_rwlock)) {
512 		rw_exit(&ip->i_rwlock);
513 		rw_enter(&ip->i_rwlock, RW_WRITER);
514 		/*
515 		 * Mandatory locking could have been enabled
516 		 * after dropping the i_rwlock.
517 		 */
518 		if (MANDLOCK(vp, ip->i_mode))
519 			goto retry_mandlock;
520 	}
521 
522 	error = ufs_lockfs_begin(ufsvfsp, &ulp, ULOCKFS_WRITE_MASK);
523 	if (error)
524 		goto out;
525 
526 	/*
527 	 * Amount of log space needed for this write
528 	 */
529 	if (!rewriteflg || !(ioflag & FDSYNC))
530 		TRANS_WRITE_RESV(ip, uiop, ulp, &resv, &resid);
531 
532 	/*
533 	 * Throttle writes.
534 	 */
535 	if (ufs_WRITES && (ip->i_writes > ufs_HW)) {
536 		mutex_enter(&ip->i_tlock);
537 		while (ip->i_writes > ufs_HW) {
538 			ufs_throttles++;
539 			cv_wait(&ip->i_wrcv, &ip->i_tlock);
540 		}
541 		mutex_exit(&ip->i_tlock);
542 	}
543 
544 	/*
545 	 * Enter Transaction
546 	 *
547 	 * If the write is a rewrite there is no need to open a transaction
548 	 * if the FDSYNC flag is set and not the FSYNC.  In this case just
549 	 * set the IMODACC flag to modify do the update at a later time
550 	 * thus avoiding the overhead of the logging transaction that is
551 	 * not required.
552 	 */
553 	if (ioflag & (FSYNC|FDSYNC)) {
554 		if (ulp) {
555 			if (rewriteflg) {
556 				uint_t i_flag_save;
557 
558 				rw_enter(&ip->i_contents, RW_READER);
559 				mutex_enter(&ip->i_tlock);
560 				i_flag_save = ip->i_flag;
561 				ip->i_flag |= IUPD | ICHG;
562 				ip->i_seq++;
563 				ITIMES_NOLOCK(ip);
564 				if ((i_flag_save & IMOD) == 0) {
565 					ip->i_flag &= ~IMOD;
566 					ip->i_flag |= IMODACC;
567 				}
568 				mutex_exit(&ip->i_tlock);
569 				rw_exit(&ip->i_contents);
570 			} else {
571 				int terr = 0;
572 				TRANS_BEGIN_SYNC(ufsvfsp, TOP_WRITE_SYNC, resv,
573 				    terr);
574 				ASSERT(!terr);
575 			}
576 		}
577 	} else {
578 		if (ulp)
579 			TRANS_BEGIN_ASYNC(ufsvfsp, TOP_WRITE, resv);
580 	}
581 
582 	/*
583 	 * Write the file
584 	 */
585 	rw_enter(&ufsvfsp->vfs_dqrwlock, RW_READER);
586 	rw_enter(&ip->i_contents, RW_WRITER);
587 	if ((ioflag & FAPPEND) != 0 && (ip->i_mode & IFMT) == IFREG) {
588 		/*
589 		 * In append mode start at end of file.
590 		 */
591 		uiop->uio_loffset = ip->i_size;
592 	}
593 
594 	/*
595 	 * Mild optimisation, don't call ufs_trans_write() unless we have to
596 	 * Also, suppress file system full messages if we will retry.
597 	 */
598 	if (retry)
599 		ip->i_flag |= IQUIET;
600 	if (resid) {
601 		TRANS_WRITE(ip, uiop, ioflag, error, ulp, cr, resv, resid);
602 	} else {
603 		error = wrip(ip, uiop, ioflag, cr);
604 	}
605 	ip->i_flag &= ~IQUIET;
606 
607 	rw_exit(&ip->i_contents);
608 	rw_exit(&ufsvfsp->vfs_dqrwlock);
609 
610 	/*
611 	 * Leave Transaction
612 	 */
613 	if (ulp) {
614 		if (ioflag & (FSYNC|FDSYNC)) {
615 			if (!rewriteflg) {
616 				int terr = 0;
617 
618 				TRANS_END_SYNC(ufsvfsp, terr, TOP_WRITE_SYNC,
619 					resv);
620 				if (error == 0)
621 					error = terr;
622 			}
623 		} else {
624 			TRANS_END_ASYNC(ufsvfsp, TOP_WRITE, resv);
625 		}
626 		ufs_lockfs_end(ulp);
627 	}
628 out:
629 	if ((error == ENOSPC) && retry && TRANS_ISTRANS(ufsvfsp)) {
630 		/*
631 		 * Any blocks tied up in pending deletes?
632 		 */
633 		ufs_delete_drain_wait(ufsvfsp, 1);
634 		retry = 0;
635 		goto retry_mandlock;
636 	}
637 
638 	if (error == ENOSPC && (start_resid != uiop->uio_resid))
639 		error = 0;
640 
641 	TRACE_2(TR_FAC_UFS, TR_UFS_WRITE_END,
642 		"ufs_write_end:vp %p error %d", vp, error);
643 	return (error);
644 }
645 
646 /*
647  * Don't cache write blocks to files with the sticky bit set.
648  * Used to keep swap files from blowing the page cache on a server.
649  */
650 int stickyhack = 1;
651 
652 /*
653  * Free behind hacks.  The pager is busted.
654  * XXX - need to pass the information down to writedone() in a flag like B_SEQ
655  * or B_FREE_IF_TIGHT_ON_MEMORY.
656  */
657 int	freebehind = 1;
658 int	smallfile = 0;
659 u_offset_t smallfile64 = 32 * 1024;
660 
661 /*
662  * While we should, in most cases, cache the pages for write, we
663  * may also want to cache the pages for read as long as they are
664  * frequently re-usable.
665  *
666  * If cache_read_ahead = 1, the pages for read will go to the tail
667  * of the cache list when they are released, otherwise go to the head.
668  */
669 int	cache_read_ahead = 0;
670 
671 /*
672  * Freebehind exists  so that as we read  large files  sequentially we
673  * don't consume most of memory with pages  from a few files. It takes
674  * longer to re-read from disk multiple small files as it does reading
675  * one large one sequentially.  As system  memory grows customers need
676  * to retain bigger chunks   of files in  memory.   The advent of  the
677  * cachelist opens up of the possibility freeing pages  to the head or
678  * tail of the list.
679  *
680  * Not freeing a page is a bet that the page will be read again before
681  * it's segmap slot is needed for something else. If we loose the bet,
682  * it means some  other thread is  burdened with the  page free we did
683  * not do. If we win we save a free and reclaim.
684  *
685  * Freeing it at the tail  vs the head of cachelist  is a bet that the
686  * page will survive until the next  read.  It's also saying that this
687  * page is more likely to  be re-used than a  page freed some time ago
688  * and never reclaimed.
689  *
690  * Freebehind maintains a  range of  file offset [smallfile1; smallfile2]
691  *
692  *            0 < offset < smallfile1 : pages are not freed.
693  *   smallfile1 < offset < smallfile2 : pages freed to tail of cachelist.
694  *   smallfile2 < offset              : pages freed to head of cachelist.
695  *
696  * The range  is  computed  at most  once  per second  and  depends on
697  * freemem  and  ncpus_online.  Both parameters  are   bounded to be
698  * >= smallfile && >= smallfile64.
699  *
700  * smallfile1 = (free memory / ncpu) / 1000
701  * smallfile2 = (free memory / ncpu) / 10
702  *
703  * A few examples values:
704  *
705  *       Free Mem (in Bytes) [smallfile1; smallfile2]  [smallfile1; smallfile2]
706  *                                 ncpus_online = 4          ncpus_online = 64
707  *       ------------------  -----------------------   -----------------------
708  *             1G                   [256K;  25M]               [32K; 1.5M]
709  *            10G                   [2.5M; 250M]              [156K; 15M]
710  *           100G                    [25M; 2.5G]              [1.5M; 150M]
711  *
712  */
713 
714 #define	SMALLFILE1_D 1000
715 #define	SMALLFILE2_D 10
716 static u_offset_t smallfile1 = 32 * 1024;
717 static u_offset_t smallfile2 = 32 * 1024;
718 static clock_t smallfile_update = 0; /* lbolt value of when to recompute */
719 uint_t smallfile1_d = SMALLFILE1_D;
720 uint_t smallfile2_d = SMALLFILE2_D;
721 
722 /*
723  * wrip does the real work of write requests for ufs.
724  */
725 int
726 wrip(struct inode *ip, struct uio *uio, int ioflag, struct cred *cr)
727 {
728 	rlim64_t limit = uio->uio_llimit;
729 	u_offset_t off;
730 	u_offset_t old_i_size;
731 	struct fs *fs;
732 	struct vnode *vp;
733 	struct ufsvfs *ufsvfsp;
734 	caddr_t base;
735 	long start_resid = uio->uio_resid;	/* save starting resid */
736 	long premove_resid;			/* resid before uiomove() */
737 	uint_t flags;
738 	int newpage;
739 	int iupdat_flag, directio_status;
740 	int n, on, mapon;
741 	int error, pagecreate;
742 	int do_dqrwlock;		/* drop/reacquire vfs_dqrwlock */
743 	int32_t	iblocks;
744 	int	new_iblocks;
745 
746 	/*
747 	 * ip->i_size is incremented before the uiomove
748 	 * is done on a write.  If the move fails (bad user
749 	 * address) reset ip->i_size.
750 	 * The better way would be to increment ip->i_size
751 	 * only if the uiomove succeeds.
752 	 */
753 	int i_size_changed = 0;
754 	o_mode_t type;
755 	int i_seq_needed = 0;
756 
757 	vp = ITOV(ip);
758 
759 	/*
760 	 * check for forced unmount - should not happen as
761 	 * the request passed the lockfs checks.
762 	 */
763 	if ((ufsvfsp = ip->i_ufsvfs) == NULL)
764 		return (EIO);
765 
766 	fs = ip->i_fs;
767 
768 	TRACE_1(TR_FAC_UFS, TR_UFS_RWIP_START,
769 		"ufs_wrip_start:vp %p", vp);
770 
771 	ASSERT(RW_WRITE_HELD(&ip->i_contents));
772 
773 	/* check for valid filetype */
774 	type = ip->i_mode & IFMT;
775 	if ((type != IFREG) && (type != IFDIR) && (type != IFATTRDIR) &&
776 	    (type != IFLNK) && (type != IFSHAD)) {
777 		return (EIO);
778 	}
779 
780 	/*
781 	 * the actual limit of UFS file size
782 	 * is UFS_MAXOFFSET_T
783 	 */
784 	if (limit == RLIM64_INFINITY || limit > MAXOFFSET_T)
785 		limit = MAXOFFSET_T;
786 
787 	if (uio->uio_loffset >= limit) {
788 		proc_t *p = ttoproc(curthread);
789 
790 		TRACE_2(TR_FAC_UFS, TR_UFS_RWIP_END,
791 			"ufs_wrip_end:vp %p error %d", vp, EINVAL);
792 
793 		mutex_enter(&p->p_lock);
794 		(void) rctl_action(rctlproc_legacy[RLIMIT_FSIZE], p->p_rctls,
795 		    p, RCA_UNSAFE_SIGINFO);
796 		mutex_exit(&p->p_lock);
797 		return (EFBIG);
798 	}
799 
800 	/*
801 	 * if largefiles are disallowed, the limit is
802 	 * the pre-largefiles value of 2GB
803 	 */
804 	if (ufsvfsp->vfs_lfflags & UFS_LARGEFILES)
805 		limit = MIN(UFS_MAXOFFSET_T, limit);
806 	else
807 		limit = MIN(MAXOFF32_T, limit);
808 
809 	if (uio->uio_loffset < (offset_t)0) {
810 		TRACE_2(TR_FAC_UFS, TR_UFS_RWIP_END,
811 			"ufs_wrip_end:vp %p error %d", vp, EINVAL);
812 		return (EINVAL);
813 	}
814 	if (uio->uio_resid == 0) {
815 		TRACE_2(TR_FAC_UFS, TR_UFS_RWIP_END,
816 			"ufs_wrip_end:vp %p error %d", vp, 0);
817 		return (0);
818 	}
819 
820 	if (uio->uio_loffset >= limit)
821 		return (EFBIG);
822 
823 	ip->i_flag |= INOACC;	/* don't update ref time in getpage */
824 
825 	if (ioflag & (FSYNC|FDSYNC)) {
826 		ip->i_flag |= ISYNC;
827 		iupdat_flag = 1;
828 	}
829 	/*
830 	 * Try to go direct
831 	 */
832 	if (ip->i_flag & IDIRECTIO || ufsvfsp->vfs_forcedirectio) {
833 		uio->uio_llimit = limit;
834 		error = ufs_directio_write(ip, uio, ioflag, 0, cr,
835 			&directio_status);
836 		/*
837 		 * If ufs_directio wrote to the file or set the flags,
838 		 * we need to update i_seq, but it may be deferred.
839 		 */
840 		if (start_resid != uio->uio_resid ||
841 					(ip->i_flag & (ICHG|IUPD))) {
842 			i_seq_needed = 1;
843 			ip->i_flag |= ISEQ;
844 		}
845 		if (directio_status == DIRECTIO_SUCCESS)
846 			goto out;
847 	}
848 
849 	/*
850 	 * Behavior with respect to dropping/reacquiring vfs_dqrwlock:
851 	 *
852 	 * o shadow inodes: vfs_dqrwlock is not held at all
853 	 * o quota updates: vfs_dqrwlock is read or write held
854 	 * o other updates: vfs_dqrwlock is read held
855 	 *
856 	 * The first case is the only one where we do not hold
857 	 * vfs_dqrwlock at all while entering wrip().
858 	 * We must make sure not to downgrade/drop vfs_dqrwlock if we
859 	 * have it as writer, i.e. if we are updating the quota inode.
860 	 * There is no potential deadlock scenario in this case as
861 	 * ufs_getpage() takes care of this and avoids reacquiring
862 	 * vfs_dqrwlock in that case.
863 	 *
864 	 * This check is done here since the above conditions do not change
865 	 * and we possibly loop below, so save a few cycles.
866 	 */
867 	if ((type == IFSHAD) ||
868 		(rw_owner(&ufsvfsp->vfs_dqrwlock) == curthread)) {
869 			do_dqrwlock = 0;
870 	} else {
871 		do_dqrwlock = 1;
872 	}
873 
874 	/*
875 	 * Large Files: We cast MAXBMASK to offset_t
876 	 * inorder to mask out the higher bits. Since offset_t
877 	 * is a signed value, the high order bit set in MAXBMASK
878 	 * value makes it do the right thing by having all bits 1
879 	 * in the higher word. May be removed for _SOLARIS64_.
880 	 */
881 
882 	fs = ip->i_fs;
883 	do {
884 		u_offset_t uoff = uio->uio_loffset;
885 		off = uoff & (offset_t)MAXBMASK;
886 		mapon = (int)(uoff & (offset_t)MAXBOFFSET);
887 		on = (int)blkoff(fs, uoff);
888 		n = (int)MIN(fs->fs_bsize - on, uio->uio_resid);
889 		new_iblocks = 1;
890 
891 		if (type == IFREG && uoff + n >= limit) {
892 			if (uoff >= limit) {
893 				error = EFBIG;
894 				goto out;
895 			}
896 			/*
897 			 * since uoff + n >= limit,
898 			 * therefore n >= limit - uoff, and n is an int
899 			 * so it is safe to cast it to an int
900 			 */
901 			n = (int)(limit - (rlim64_t)uoff);
902 		}
903 		if (uoff + n > ip->i_size) {
904 			/*
905 			 * We are extending the length of the file.
906 			 * bmap is used so that we are sure that
907 			 * if we need to allocate new blocks, that it
908 			 * is done here before we up the file size.
909 			 */
910 			error = bmap_write(ip, uoff, (int)(on + n),
911 			    mapon == 0, NULL, cr);
912 			/*
913 			 * bmap_write never drops i_contents so if
914 			 * the flags are set it changed the file.
915 			 */
916 			if (ip->i_flag & (ICHG|IUPD)) {
917 				i_seq_needed = 1;
918 				ip->i_flag |= ISEQ;
919 			}
920 			if (error)
921 				break;
922 			/*
923 			 * There is a window of vulnerability here.
924 			 * The sequence of operations: allocate file
925 			 * system blocks, uiomove the data into pages,
926 			 * and then update the size of the file in the
927 			 * inode, must happen atomically.  However, due
928 			 * to current locking constraints, this can not
929 			 * be done.
930 			 */
931 			ASSERT(ip->i_writer == NULL);
932 			ip->i_writer = curthread;
933 			i_size_changed = 1;
934 			/*
935 			 * If we are writing from the beginning of
936 			 * the mapping, we can just create the
937 			 * pages without having to read them.
938 			 */
939 			pagecreate = (mapon == 0);
940 		} else if (n == MAXBSIZE) {
941 			/*
942 			 * Going to do a whole mappings worth,
943 			 * so we can just create the pages w/o
944 			 * having to read them in.  But before
945 			 * we do that, we need to make sure any
946 			 * needed blocks are allocated first.
947 			 */
948 			iblocks = ip->i_blocks;
949 			error = bmap_write(ip, uoff, (int)(on + n),
950 			    BI_ALLOC_ONLY, NULL, cr);
951 			/*
952 			 * bmap_write never drops i_contents so if
953 			 * the flags are set it changed the file.
954 			 */
955 			if (ip->i_flag & (ICHG|IUPD)) {
956 				i_seq_needed = 1;
957 				ip->i_flag |= ISEQ;
958 			}
959 			if (error)
960 				break;
961 			pagecreate = 1;
962 			/*
963 			 * check if the new created page needed the
964 			 * allocation of new disk blocks.
965 			 */
966 			if (iblocks == ip->i_blocks)
967 				new_iblocks = 0; /* no new blocks allocated */
968 		} else {
969 			pagecreate = 0;
970 			/*
971 			 * In sync mode flush the indirect blocks which
972 			 * may have been allocated and not written on
973 			 * disk. In above cases bmap_write will allocate
974 			 * in sync mode.
975 			 */
976 			if (ioflag & (FSYNC|FDSYNC)) {
977 				error = ufs_indirblk_sync(ip, uoff);
978 				if (error)
979 					break;
980 			}
981 		}
982 
983 		/*
984 		 * At this point we can enter ufs_getpage() in one
985 		 * of two ways:
986 		 * 1) segmap_getmapflt() calls ufs_getpage() when the
987 		 *    forcefault parameter is true (pagecreate == 0)
988 		 * 2) uiomove() causes a page fault.
989 		 *
990 		 * We have to drop the contents lock to prevent the VM
991 		 * system from trying to reaquire it in ufs_getpage()
992 		 * should the uiomove cause a pagefault.
993 		 *
994 		 * We have to drop the reader vfs_dqrwlock here as well.
995 		 */
996 		rw_exit(&ip->i_contents);
997 		if (do_dqrwlock) {
998 			ASSERT(RW_LOCK_HELD(&ufsvfsp->vfs_dqrwlock));
999 			ASSERT(!(RW_WRITE_HELD(&ufsvfsp->vfs_dqrwlock)));
1000 			rw_exit(&ufsvfsp->vfs_dqrwlock);
1001 		}
1002 
1003 		base = segmap_getmapflt(segkmap, vp, (off + mapon),
1004 					(uint_t)n, !pagecreate, S_WRITE);
1005 
1006 		/*
1007 		 * segmap_pagecreate() returns 1 if it calls
1008 		 * page_create_va() to allocate any pages.
1009 		 */
1010 		newpage = 0;
1011 
1012 		if (pagecreate)
1013 			newpage = segmap_pagecreate(segkmap, base,
1014 			    (size_t)n, 0);
1015 
1016 		premove_resid = uio->uio_resid;
1017 		error = uiomove(base + mapon, (long)n, UIO_WRITE, uio);
1018 
1019 		/*
1020 		 * If "newpage" is set, then a new page was created and it
1021 		 * does not contain valid data, so it needs to be initialized
1022 		 * at this point.
1023 		 * Otherwise the page contains old data, which was overwritten
1024 		 * partially or as a whole in uiomove.
1025 		 * If there is only one iovec structure within uio, then
1026 		 * on error uiomove will not be able to update uio->uio_loffset
1027 		 * and we would zero the whole page here!
1028 		 *
1029 		 * If uiomove fails because of an error, the old valid data
1030 		 * is kept instead of filling the rest of the page with zero's.
1031 		 */
1032 		if (newpage &&
1033 		    uio->uio_loffset < roundup(off + mapon + n, PAGESIZE)) {
1034 			/*
1035 			 * We created pages w/o initializing them completely,
1036 			 * thus we need to zero the part that wasn't set up.
1037 			 * This happens on most EOF write cases and if
1038 			 * we had some sort of error during the uiomove.
1039 			 */
1040 			int nzero, nmoved;
1041 
1042 			nmoved = (int)(uio->uio_loffset - (off + mapon));
1043 			ASSERT(nmoved >= 0 && nmoved <= n);
1044 			nzero = roundup(on + n, PAGESIZE) - nmoved;
1045 			ASSERT(nzero > 0 && mapon + nmoved + nzero <= MAXBSIZE);
1046 			(void) kzero(base + mapon + nmoved, (uint_t)nzero);
1047 		}
1048 
1049 		/*
1050 		 * Unlock the pages allocated by page_create_va()
1051 		 * in segmap_pagecreate()
1052 		 */
1053 		if (newpage)
1054 			segmap_pageunlock(segkmap, base, (size_t)n, S_WRITE);
1055 
1056 		/*
1057 		 * If the size of the file changed, then update the
1058 		 * size field in the inode now.  This can't be done
1059 		 * before the call to segmap_pageunlock or there is
1060 		 * a potential deadlock with callers to ufs_putpage().
1061 		 * They will be holding i_contents and trying to lock
1062 		 * a page, while this thread is holding a page locked
1063 		 * and trying to acquire i_contents.
1064 		 */
1065 		if (i_size_changed) {
1066 			rw_enter(&ip->i_contents, RW_WRITER);
1067 			old_i_size = ip->i_size;
1068 			UFS_SET_ISIZE(uoff + n, ip);
1069 			TRANS_INODE(ufsvfsp, ip);
1070 			/*
1071 			 * file has grown larger than 2GB. Set flag
1072 			 * in superblock to indicate this, if it
1073 			 * is not already set.
1074 			 */
1075 			if ((ip->i_size > MAXOFF32_T) &&
1076 			    !(fs->fs_flags & FSLARGEFILES)) {
1077 				ASSERT(ufsvfsp->vfs_lfflags & UFS_LARGEFILES);
1078 				mutex_enter(&ufsvfsp->vfs_lock);
1079 				fs->fs_flags |= FSLARGEFILES;
1080 				ufs_sbwrite(ufsvfsp);
1081 				mutex_exit(&ufsvfsp->vfs_lock);
1082 			}
1083 			mutex_enter(&ip->i_tlock);
1084 			ip->i_writer = NULL;
1085 			cv_broadcast(&ip->i_wrcv);
1086 			mutex_exit(&ip->i_tlock);
1087 			rw_exit(&ip->i_contents);
1088 		}
1089 
1090 		if (error) {
1091 			/*
1092 			 * If we failed on a write, we may have already
1093 			 * allocated file blocks as well as pages.  It's
1094 			 * hard to undo the block allocation, but we must
1095 			 * be sure to invalidate any pages that may have
1096 			 * been allocated.
1097 			 *
1098 			 * If the page was created without initialization
1099 			 * then we must check if it should be possible
1100 			 * to destroy the new page and to keep the old data
1101 			 * on the disk.
1102 			 *
1103 			 * It is possible to destroy the page without
1104 			 * having to write back its contents only when
1105 			 * - the size of the file keeps unchanged
1106 			 * - bmap_write() did not allocate new disk blocks
1107 			 *   it is possible to create big files using "seek" and
1108 			 *   write to the end of the file. A "write" to a
1109 			 *   position before the end of the file would not
1110 			 *   change the size of the file but it would allocate
1111 			 *   new disk blocks.
1112 			 * - uiomove intended to overwrite the whole page.
1113 			 * - a new page was created (newpage == 1).
1114 			 */
1115 
1116 			if (i_size_changed == 0 && new_iblocks == 0 &&
1117 			    newpage) {
1118 
1119 				/* unwind what uiomove eventually last did */
1120 				uio->uio_resid = premove_resid;
1121 
1122 				/*
1123 				 * destroy the page, do not write ambiguous
1124 				 * data to the disk.
1125 				 */
1126 				flags = SM_DESTROY;
1127 			} else {
1128 				/*
1129 				 * write the page back to the disk, if dirty,
1130 				 * and remove the page from the cache.
1131 				 */
1132 				flags = SM_INVAL;
1133 			}
1134 			(void) segmap_release(segkmap, base, flags);
1135 		} else {
1136 			flags = 0;
1137 			/*
1138 			 * Force write back for synchronous write cases.
1139 			 */
1140 			if ((ioflag & (FSYNC|FDSYNC)) || type == IFDIR) {
1141 				/*
1142 				 * If the sticky bit is set but the
1143 				 * execute bit is not set, we do a
1144 				 * synchronous write back and free
1145 				 * the page when done.  We set up swap
1146 				 * files to be handled this way to
1147 				 * prevent servers from keeping around
1148 				 * the client's swap pages too long.
1149 				 * XXX - there ought to be a better way.
1150 				 */
1151 				if (IS_SWAPVP(vp)) {
1152 					flags = SM_WRITE | SM_FREE |
1153 					    SM_DONTNEED;
1154 					iupdat_flag = 0;
1155 				} else {
1156 					flags = SM_WRITE;
1157 				}
1158 			} else if (n + on == MAXBSIZE || IS_SWAPVP(vp)) {
1159 				/*
1160 				 * Have written a whole block.
1161 				 * Start an asynchronous write and
1162 				 * mark the buffer to indicate that
1163 				 * it won't be needed again soon.
1164 				 */
1165 				flags = SM_WRITE | SM_ASYNC | SM_DONTNEED;
1166 			}
1167 			error = segmap_release(segkmap, base, flags);
1168 			/*
1169 			 * If the operation failed and is synchronous,
1170 			 * then we need to unwind what uiomove() last
1171 			 * did so we can potentially return an error to
1172 			 * the caller.  If this write operation was
1173 			 * done in two pieces and the first succeeded,
1174 			 * then we won't return an error for the second
1175 			 * piece that failed.  However, we only want to
1176 			 * return a resid value that reflects what was
1177 			 * really done.
1178 			 *
1179 			 * Failures for non-synchronous operations can
1180 			 * be ignored since the page subsystem will
1181 			 * retry the operation until it succeeds or the
1182 			 * file system is unmounted.
1183 			 */
1184 			if (error) {
1185 				if ((ioflag & (FSYNC | FDSYNC)) ||
1186 				    type == IFDIR) {
1187 					uio->uio_resid = premove_resid;
1188 				} else {
1189 					error = 0;
1190 				}
1191 			}
1192 		}
1193 
1194 		/*
1195 		 * Re-acquire contents lock.
1196 		 * If it was dropped, reacquire reader vfs_dqrwlock as well.
1197 		 */
1198 		if (do_dqrwlock)
1199 			rw_enter(&ufsvfsp->vfs_dqrwlock, RW_READER);
1200 		rw_enter(&ip->i_contents, RW_WRITER);
1201 
1202 		/*
1203 		 * If the uiomove() failed or if a synchronous
1204 		 * page push failed, fix up i_size.
1205 		 */
1206 		if (error) {
1207 			if (i_size_changed) {
1208 				/*
1209 				 * The uiomove failed, and we
1210 				 * allocated blocks,so get rid
1211 				 * of them.
1212 				 */
1213 				(void) ufs_itrunc(ip, old_i_size, 0, cr);
1214 			}
1215 		} else {
1216 			/*
1217 			 * XXX - Can this be out of the loop?
1218 			 */
1219 			ip->i_flag |= IUPD | ICHG;
1220 			/*
1221 			 * Only do one increase of i_seq for multiple
1222 			 * pieces.  Because we drop locks, record
1223 			 * the fact that we changed the timestamp and
1224 			 * are deferring the increase in case another thread
1225 			 * pushes our timestamp update.
1226 			 */
1227 			i_seq_needed = 1;
1228 			ip->i_flag |= ISEQ;
1229 			if (i_size_changed)
1230 				ip->i_flag |= IATTCHG;
1231 			if ((ip->i_mode & (IEXEC | (IEXEC >> 3) |
1232 			    (IEXEC >> 6))) != 0 &&
1233 			    (ip->i_mode & (ISUID | ISGID)) != 0 &&
1234 			    secpolicy_vnode_setid_retain(cr,
1235 			    (ip->i_mode & ISUID) != 0 && ip->i_uid == 0) != 0) {
1236 				/*
1237 				 * Clear Set-UID & Set-GID bits on
1238 				 * successful write if not privileged
1239 				 * and at least one of the execute bits
1240 				 * is set.  If we always clear Set-GID,
1241 				 * mandatory file and record locking is
1242 				 * unuseable.
1243 				 */
1244 				ip->i_mode &= ~(ISUID | ISGID);
1245 			}
1246 		}
1247 		/*
1248 		 * In the case the FDSYNC flag is set and this is a
1249 		 * "rewrite" we won't log a delta.
1250 		 * The FSYNC flag overrides all cases.
1251 		 */
1252 		if (!ufs_check_rewrite(ip, uio, ioflag) || !(ioflag & FDSYNC)) {
1253 			TRANS_INODE(ufsvfsp, ip);
1254 		}
1255 	} while (error == 0 && uio->uio_resid > 0 && n != 0);
1256 
1257 out:
1258 	/*
1259 	 * Make sure i_seq is increased at least once per write
1260 	 */
1261 	if (i_seq_needed) {
1262 		ip->i_seq++;
1263 		ip->i_flag &= ~ISEQ;	/* no longer deferred */
1264 	}
1265 
1266 	/*
1267 	 * Inode is updated according to this table -
1268 	 *
1269 	 *   FSYNC	  FDSYNC(posix.4)
1270 	 *   --------------------------
1271 	 *   always@	  IATTCHG|IBDWRITE
1272 	 *
1273 	 * @ - 	If we are doing synchronous write the only time we should
1274 	 *	not be sync'ing the ip here is if we have the stickyhack
1275 	 *	activated, the file is marked with the sticky bit and
1276 	 *	no exec bit, the file length has not been changed and
1277 	 *	no new blocks have been allocated during this write.
1278 	 */
1279 
1280 	if ((ip->i_flag & ISYNC) != 0) {
1281 		/*
1282 		 * we have eliminated nosync
1283 		 */
1284 		if ((ip->i_flag & (IATTCHG|IBDWRITE)) ||
1285 			((ioflag & FSYNC) && iupdat_flag)) {
1286 			ufs_iupdat(ip, 1);
1287 		}
1288 	}
1289 
1290 	/*
1291 	 * If we've already done a partial-write, terminate
1292 	 * the write but return no error unless the error is ENOSPC
1293 	 * because the caller can detect this and free resources and
1294 	 * try again.
1295 	 */
1296 	if ((start_resid != uio->uio_resid) && (error != ENOSPC))
1297 		error = 0;
1298 
1299 	ip->i_flag &= ~(INOACC | ISYNC);
1300 	ITIMES_NOLOCK(ip);
1301 	TRACE_2(TR_FAC_UFS, TR_UFS_RWIP_END,
1302 		"ufs_wrip_end:vp %p error %d", vp, error);
1303 	return (error);
1304 }
1305 
1306 /*
1307  * rdip does the real work of read requests for ufs.
1308  */
1309 int
1310 rdip(struct inode *ip, struct uio *uio, int ioflag, cred_t *cr)
1311 {
1312 	u_offset_t off;
1313 	caddr_t base;
1314 	struct fs *fs;
1315 	struct ufsvfs *ufsvfsp;
1316 	struct vnode *vp;
1317 	long oresid = uio->uio_resid;
1318 	u_offset_t n, on, mapon;
1319 	int error = 0;
1320 	int doupdate = 1;
1321 	uint_t flags;
1322 	int dofree, directio_status;
1323 	krw_t rwtype;
1324 	o_mode_t type;
1325 
1326 	vp = ITOV(ip);
1327 
1328 	TRACE_1(TR_FAC_UFS, TR_UFS_RWIP_START,
1329 		"ufs_rdip_start:vp %p", vp);
1330 
1331 	ASSERT(RW_LOCK_HELD(&ip->i_contents));
1332 
1333 	ufsvfsp = ip->i_ufsvfs;
1334 
1335 	if (ufsvfsp == NULL)
1336 		return (EIO);
1337 
1338 	fs = ufsvfsp->vfs_fs;
1339 
1340 	/* check for valid filetype */
1341 	type = ip->i_mode & IFMT;
1342 	if ((type != IFREG) && (type != IFDIR) && (type != IFATTRDIR) &&
1343 	    (type != IFLNK) && (type != IFSHAD)) {
1344 		return (EIO);
1345 	}
1346 
1347 	if (uio->uio_loffset > UFS_MAXOFFSET_T) {
1348 		TRACE_2(TR_FAC_UFS, TR_UFS_RWIP_END,
1349 			"ufs_rdip_end:vp %p error %d", vp, EINVAL);
1350 		error = 0;
1351 		goto out;
1352 	}
1353 	if (uio->uio_loffset < (offset_t)0) {
1354 		TRACE_2(TR_FAC_UFS, TR_UFS_RWIP_END,
1355 			"ufs_rdip_end:vp %p error %d", vp, EINVAL);
1356 		return (EINVAL);
1357 	}
1358 	if (uio->uio_resid == 0) {
1359 		TRACE_2(TR_FAC_UFS, TR_UFS_RWIP_END,
1360 			"ufs_rdip_end:vp %p error %d", vp, 0);
1361 		return (0);
1362 	}
1363 
1364 	if (!ULOCKFS_IS_NOIACC(ITOUL(ip)) && (fs->fs_ronly == 0) &&
1365 		(!ufsvfsp->vfs_noatime)) {
1366 		mutex_enter(&ip->i_tlock);
1367 		ip->i_flag |= IACC;
1368 		mutex_exit(&ip->i_tlock);
1369 	}
1370 	/*
1371 	 * Try to go direct
1372 	 */
1373 	if (ip->i_flag & IDIRECTIO || ufsvfsp->vfs_forcedirectio) {
1374 		error = ufs_directio_read(ip, uio, cr, &directio_status);
1375 		if (directio_status == DIRECTIO_SUCCESS)
1376 			goto out;
1377 	}
1378 
1379 	rwtype = (rw_write_held(&ip->i_contents)?RW_WRITER:RW_READER);
1380 
1381 	do {
1382 		offset_t diff;
1383 		u_offset_t uoff = uio->uio_loffset;
1384 		off = uoff & (offset_t)MAXBMASK;
1385 		mapon = (u_offset_t)(uoff & (offset_t)MAXBOFFSET);
1386 		on = (u_offset_t)blkoff(fs, uoff);
1387 		n = MIN((u_offset_t)fs->fs_bsize - on,
1388 			(u_offset_t)uio->uio_resid);
1389 
1390 		diff = ip->i_size - uoff;
1391 
1392 		if (diff <= (offset_t)0) {
1393 			error = 0;
1394 			goto out;
1395 		}
1396 		if (diff < (offset_t)n)
1397 			n = (int)diff;
1398 
1399 		/*
1400 		 * We update smallfile2 and smallfile1 at most every second.
1401 		 */
1402 		if (lbolt >= smallfile_update) {
1403 			uint64_t percpufreeb;
1404 			if (smallfile1_d == 0) smallfile1_d = SMALLFILE1_D;
1405 			if (smallfile2_d == 0) smallfile2_d = SMALLFILE2_D;
1406 			percpufreeb = ptob((uint64_t)freemem) / ncpus_online;
1407 			smallfile1 = percpufreeb / smallfile1_d;
1408 			smallfile2 = percpufreeb / smallfile2_d;
1409 			smallfile1 = MAX(smallfile1, smallfile);
1410 			smallfile1 = MAX(smallfile1, smallfile64);
1411 			smallfile2 = MAX(smallfile1, smallfile2);
1412 			smallfile_update = lbolt + hz;
1413 		}
1414 
1415 		dofree = freebehind &&
1416 		    ip->i_nextr == (off & PAGEMASK) && off > smallfile1;
1417 
1418 		/*
1419 		 * At this point we can enter ufs_getpage() in one of two
1420 		 * ways:
1421 		 * 1) segmap_getmapflt() calls ufs_getpage() when the
1422 		 *    forcefault parameter is true (value of 1 is passed)
1423 		 * 2) uiomove() causes a page fault.
1424 		 *
1425 		 * We cannot hold onto an i_contents reader lock without
1426 		 * risking deadlock in ufs_getpage() so drop a reader lock.
1427 		 * The ufs_getpage() dolock logic already allows for a
1428 		 * thread holding i_contents as writer to work properly
1429 		 * so we keep a writer lock.
1430 		 */
1431 		if (rwtype == RW_READER)
1432 			rw_exit(&ip->i_contents);
1433 		base = segmap_getmapflt(segkmap, vp, (off + mapon),
1434 					(uint_t)n, 1, S_READ);
1435 
1436 		error = uiomove(base + mapon, (long)n, UIO_READ, uio);
1437 
1438 		flags = 0;
1439 		if (!error) {
1440 			/*
1441 			 * If  reading sequential  we won't need  this
1442 			 * buffer again  soon.  For  offsets in  range
1443 			 * [smallfile1,  smallfile2] release the pages
1444 			 * at   the  tail  of the   cache list, larger
1445 			 * offsets are released at the head.
1446 			 */
1447 			if (dofree) {
1448 				flags = SM_FREE | SM_ASYNC;
1449 				if ((cache_read_ahead == 0) &&
1450 					(off > smallfile2))
1451 					flags |=  SM_DONTNEED;
1452 			}
1453 			/*
1454 			 * In POSIX SYNC (FSYNC and FDSYNC) read mode,
1455 			 * we want to make sure that the page which has
1456 			 * been read, is written on disk if it is dirty.
1457 			 * And corresponding indirect blocks should also
1458 			 * be flushed out.
1459 			 */
1460 			if ((ioflag & FRSYNC) && (ioflag & (FSYNC|FDSYNC))) {
1461 				flags &= ~SM_ASYNC;
1462 				flags |= SM_WRITE;
1463 			}
1464 			error = segmap_release(segkmap, base, flags);
1465 		} else
1466 			(void) segmap_release(segkmap, base, flags);
1467 
1468 		if (rwtype == RW_READER)
1469 			rw_enter(&ip->i_contents, rwtype);
1470 	} while (error == 0 && uio->uio_resid > 0 && n != 0);
1471 out:
1472 	/*
1473 	 * Inode is updated according to this table if FRSYNC is set.
1474 	 *
1475 	 *   FSYNC	  FDSYNC(posix.4)
1476 	 *   --------------------------
1477 	 *   always	  IATTCHG|IBDWRITE
1478 	 */
1479 	/*
1480 	 * The inode is not updated if we're logging and the inode is a
1481 	 * directory with FRSYNC, FSYNC and FDSYNC flags set.
1482 	 */
1483 	if (ioflag & FRSYNC) {
1484 		if (TRANS_ISTRANS(ufsvfsp) && ((ip->i_mode & IFMT) == IFDIR)) {
1485 				doupdate = 0;
1486 		}
1487 		if (doupdate) {
1488 			if ((ioflag & FSYNC) ||
1489 			    ((ioflag & FDSYNC) &&
1490 			    (ip->i_flag & (IATTCHG|IBDWRITE)))) {
1491 				ufs_iupdat(ip, 1);
1492 			}
1493 		}
1494 	}
1495 	/*
1496 	 * If we've already done a partial read, terminate
1497 	 * the read but return no error.
1498 	 */
1499 	if (oresid != uio->uio_resid)
1500 		error = 0;
1501 	ITIMES(ip);
1502 
1503 	TRACE_2(TR_FAC_UFS, TR_UFS_RWIP_END,
1504 		"ufs_rdip_end:vp %p error %d", vp, error);
1505 	return (error);
1506 }
1507 
1508 /* ARGSUSED */
1509 static int
1510 ufs_ioctl(
1511 	struct vnode	*vp,
1512 	int		cmd,
1513 	intptr_t	arg,
1514 	int		flag,
1515 	struct cred	*cr,
1516 	int		*rvalp)
1517 {
1518 	struct lockfs	lockfs, lockfs_out;
1519 	struct ufsvfs	*ufsvfsp = VTOI(vp)->i_ufsvfs;
1520 	char		*comment, *original_comment;
1521 	struct fs	*fs;
1522 	struct ulockfs	*ulp;
1523 	offset_t	off;
1524 	extern int	maxphys;
1525 	int		error;
1526 	int		issync;
1527 	int		trans_size;
1528 
1529 
1530 	/*
1531 	 * forcibly unmounted
1532 	 */
1533 	if (ufsvfsp == NULL) {
1534 		return (EIO);
1535 	}
1536 
1537 	fs = ufsvfsp->vfs_fs;
1538 
1539 	if (cmd == Q_QUOTACTL) {
1540 		error = ufs_lockfs_begin(ufsvfsp, &ulp, ULOCKFS_QUOTA_MASK);
1541 		if (error)
1542 			return (error);
1543 
1544 		if (ulp) {
1545 			TRANS_BEGIN_ASYNC(ufsvfsp, TOP_QUOTA,
1546 						TOP_SETQUOTA_SIZE(fs));
1547 		}
1548 
1549 		error = quotactl(vp, arg, flag, cr);
1550 
1551 		if (ulp) {
1552 			TRANS_END_ASYNC(ufsvfsp, TOP_QUOTA,
1553 						TOP_SETQUOTA_SIZE(fs));
1554 			ufs_lockfs_end(ulp);
1555 		}
1556 		return (error);
1557 	}
1558 
1559 	switch (cmd) {
1560 		case _FIOLFS:
1561 			/*
1562 			 * file system locking
1563 			 */
1564 			if (secpolicy_fs_config(cr, ufsvfsp->vfs_vfs) != 0)
1565 				return (EPERM);
1566 
1567 			if ((flag & DATAMODEL_MASK) == DATAMODEL_NATIVE) {
1568 				if (copyin((caddr_t)arg, &lockfs,
1569 						sizeof (struct lockfs)))
1570 					return (EFAULT);
1571 			}
1572 #ifdef _SYSCALL32_IMPL
1573 			else {
1574 				struct lockfs32	lockfs32;
1575 				/* Translate ILP32 lockfs to LP64 lockfs */
1576 				if (copyin((caddr_t)arg, &lockfs32,
1577 				    sizeof (struct lockfs32)))
1578 					return (EFAULT);
1579 				lockfs.lf_lock = (ulong_t)lockfs32.lf_lock;
1580 				lockfs.lf_flags = (ulong_t)lockfs32.lf_flags;
1581 				lockfs.lf_key = (ulong_t)lockfs32.lf_key;
1582 				lockfs.lf_comlen = (ulong_t)lockfs32.lf_comlen;
1583 				lockfs.lf_comment =
1584 					(caddr_t)(uintptr_t)lockfs32.lf_comment;
1585 			}
1586 #endif /* _SYSCALL32_IMPL */
1587 
1588 			if (lockfs.lf_comlen) {
1589 				if (lockfs.lf_comlen > LOCKFS_MAXCOMMENTLEN)
1590 					return (ENAMETOOLONG);
1591 				comment = kmem_alloc(lockfs.lf_comlen,
1592 						KM_SLEEP);
1593 				if (copyin(lockfs.lf_comment, comment,
1594 					lockfs.lf_comlen)) {
1595 					kmem_free(comment, lockfs.lf_comlen);
1596 					return (EFAULT);
1597 				}
1598 				original_comment = lockfs.lf_comment;
1599 				lockfs.lf_comment = comment;
1600 			}
1601 			if ((error = ufs_fiolfs(vp, &lockfs, 0)) == 0) {
1602 				lockfs.lf_comment = original_comment;
1603 
1604 				if ((flag & DATAMODEL_MASK) ==
1605 				    DATAMODEL_NATIVE) {
1606 					(void) copyout(&lockfs, (caddr_t)arg,
1607 					    sizeof (struct lockfs));
1608 				}
1609 #ifdef _SYSCALL32_IMPL
1610 				else {
1611 					struct lockfs32	lockfs32;
1612 					/* Translate LP64 to ILP32 lockfs */
1613 					lockfs32.lf_lock =
1614 					    (uint32_t)lockfs.lf_lock;
1615 					lockfs32.lf_flags =
1616 					    (uint32_t)lockfs.lf_flags;
1617 					lockfs32.lf_key =
1618 					    (uint32_t)lockfs.lf_key;
1619 					lockfs32.lf_comlen =
1620 					    (uint32_t)lockfs.lf_comlen;
1621 					lockfs32.lf_comment =
1622 					(uint32_t)(uintptr_t)lockfs.lf_comment;
1623 					(void) copyout(&lockfs32, (caddr_t)arg,
1624 					    sizeof (struct lockfs32));
1625 				}
1626 #endif /* _SYSCALL32_IMPL */
1627 
1628 			} else {
1629 				if (lockfs.lf_comlen)
1630 					kmem_free(comment, lockfs.lf_comlen);
1631 			}
1632 			return (error);
1633 
1634 		case _FIOLFSS:
1635 			/*
1636 			 * get file system locking status
1637 			 */
1638 
1639 			if ((flag & DATAMODEL_MASK) == DATAMODEL_NATIVE) {
1640 				if (copyin((caddr_t)arg, &lockfs,
1641 						sizeof (struct lockfs)))
1642 					return (EFAULT);
1643 			}
1644 #ifdef _SYSCALL32_IMPL
1645 			else {
1646 				struct lockfs32	lockfs32;
1647 				/* Translate ILP32 lockfs to LP64 lockfs */
1648 				if (copyin((caddr_t)arg, &lockfs32,
1649 						sizeof (struct lockfs32)))
1650 					return (EFAULT);
1651 				lockfs.lf_lock = (ulong_t)lockfs32.lf_lock;
1652 				lockfs.lf_flags = (ulong_t)lockfs32.lf_flags;
1653 				lockfs.lf_key = (ulong_t)lockfs32.lf_key;
1654 				lockfs.lf_comlen = (ulong_t)lockfs32.lf_comlen;
1655 				lockfs.lf_comment =
1656 					(caddr_t)(uintptr_t)lockfs32.lf_comment;
1657 			}
1658 #endif /* _SYSCALL32_IMPL */
1659 
1660 			if (error =  ufs_fiolfss(vp, &lockfs_out))
1661 				return (error);
1662 			lockfs.lf_lock = lockfs_out.lf_lock;
1663 			lockfs.lf_key = lockfs_out.lf_key;
1664 			lockfs.lf_flags = lockfs_out.lf_flags;
1665 			lockfs.lf_comlen = MIN(lockfs.lf_comlen,
1666 				lockfs_out.lf_comlen);
1667 
1668 			if ((flag & DATAMODEL_MASK) == DATAMODEL_NATIVE) {
1669 				if (copyout(&lockfs, (caddr_t)arg,
1670 						sizeof (struct lockfs)))
1671 					return (EFAULT);
1672 			}
1673 #ifdef _SYSCALL32_IMPL
1674 			else {
1675 				/* Translate LP64 to ILP32 lockfs */
1676 				struct lockfs32	lockfs32;
1677 				lockfs32.lf_lock = (uint32_t)lockfs.lf_lock;
1678 				lockfs32.lf_flags = (uint32_t)lockfs.lf_flags;
1679 				lockfs32.lf_key = (uint32_t)lockfs.lf_key;
1680 				lockfs32.lf_comlen = (uint32_t)lockfs.lf_comlen;
1681 				lockfs32.lf_comment =
1682 					(uint32_t)(uintptr_t)lockfs.lf_comment;
1683 				if (copyout(&lockfs32, (caddr_t)arg,
1684 					    sizeof (struct lockfs32)))
1685 					return (EFAULT);
1686 			}
1687 #endif /* _SYSCALL32_IMPL */
1688 
1689 			if (lockfs.lf_comlen &&
1690 			    lockfs.lf_comment && lockfs_out.lf_comment)
1691 				if (copyout(lockfs_out.lf_comment,
1692 					lockfs.lf_comment,
1693 					lockfs.lf_comlen))
1694 					return (EFAULT);
1695 			return (0);
1696 
1697 		case _FIOSATIME:
1698 			/*
1699 			 * set access time
1700 			 */
1701 
1702 			/*
1703 			 * if mounted w/o atime, return quietly.
1704 			 * I briefly thought about returning ENOSYS, but
1705 			 * figured that most apps would consider this fatal
1706 			 * but the idea is to make this as seamless as poss.
1707 			 */
1708 			if (ufsvfsp->vfs_noatime)
1709 				return (0);
1710 
1711 			error = ufs_lockfs_begin(ufsvfsp, &ulp,
1712 					ULOCKFS_SETATTR_MASK);
1713 			if (error)
1714 				return (error);
1715 
1716 			if (ulp) {
1717 				trans_size = (int)TOP_SETATTR_SIZE(VTOI(vp));
1718 				TRANS_BEGIN_CSYNC(ufsvfsp, issync,
1719 						TOP_SETATTR, trans_size);
1720 			}
1721 
1722 			error = ufs_fiosatime(vp, (struct timeval *)arg,
1723 					flag, cr);
1724 
1725 			if (ulp) {
1726 				TRANS_END_CSYNC(ufsvfsp, error, issync,
1727 						TOP_SETATTR, trans_size);
1728 				ufs_lockfs_end(ulp);
1729 			}
1730 			return (error);
1731 
1732 		case _FIOSDIO:
1733 			/*
1734 			 * set delayed-io
1735 			 */
1736 			return (ufs_fiosdio(vp, (uint_t *)arg, flag, cr));
1737 
1738 		case _FIOGDIO:
1739 			/*
1740 			 * get delayed-io
1741 			 */
1742 			return (ufs_fiogdio(vp, (uint_t *)arg, flag, cr));
1743 
1744 		case _FIOIO:
1745 			/*
1746 			 * inode open
1747 			 */
1748 			error = ufs_lockfs_begin(ufsvfsp, &ulp,
1749 					ULOCKFS_VGET_MASK);
1750 			if (error)
1751 				return (error);
1752 
1753 			error = ufs_fioio(vp, (struct fioio *)arg, flag, cr);
1754 
1755 			if (ulp) {
1756 				ufs_lockfs_end(ulp);
1757 			}
1758 			return (error);
1759 
1760 		case _FIOFFS:
1761 			/*
1762 			 * file system flush (push w/invalidate)
1763 			 */
1764 			if ((caddr_t)arg != NULL)
1765 				return (EINVAL);
1766 			return (ufs_fioffs(vp, NULL, cr));
1767 
1768 		case _FIOISBUSY:
1769 			/*
1770 			 * Contract-private interface for Legato
1771 			 * Purge this vnode from the DNLC and decide
1772 			 * if this vnode is busy (*arg == 1) or not
1773 			 * (*arg == 0)
1774 			 */
1775 			if (secpolicy_fs_config(cr, ufsvfsp->vfs_vfs) != 0)
1776 				return (EPERM);
1777 			error = ufs_fioisbusy(vp, (int *)arg, cr);
1778 			return (error);
1779 
1780 		case _FIODIRECTIO:
1781 			return (ufs_fiodirectio(vp, (int)arg, cr));
1782 
1783 		case _FIOTUNE:
1784 			/*
1785 			 * Tune the file system (aka setting fs attributes)
1786 			 */
1787 			error = ufs_lockfs_begin(ufsvfsp, &ulp,
1788 					ULOCKFS_SETATTR_MASK);
1789 			if (error)
1790 				return (error);
1791 
1792 			error = ufs_fiotune(vp, (struct fiotune *)arg, cr);
1793 
1794 			if (ulp)
1795 				ufs_lockfs_end(ulp);
1796 			return (error);
1797 
1798 		case _FIOLOGENABLE:
1799 			if (secpolicy_fs_config(cr, ufsvfsp->vfs_vfs) != 0)
1800 				return (EPERM);
1801 			return (ufs_fiologenable(vp, (void *)arg, cr, flag));
1802 
1803 		case _FIOLOGDISABLE:
1804 			if (secpolicy_fs_config(cr, ufsvfsp->vfs_vfs) != 0)
1805 				return (EPERM);
1806 			return (ufs_fiologdisable(vp, (void *)arg, cr, flag));
1807 
1808 		case _FIOISLOG:
1809 			return (ufs_fioislog(vp, (void *)arg, cr, flag));
1810 
1811 		case _FIOSNAPSHOTCREATE_MULTI:
1812 		{
1813 			struct fiosnapcreate_multi	fc, *fcp;
1814 			size_t	fcm_size;
1815 
1816 			if (copyin((void *)arg, &fc, sizeof (fc)))
1817 				return (EFAULT);
1818 			if (fc.backfilecount > MAX_BACKFILE_COUNT)
1819 				return (EINVAL);
1820 			fcm_size = sizeof (struct fiosnapcreate_multi) +
1821 			    (fc.backfilecount - 1) * sizeof (int);
1822 			fcp = (struct fiosnapcreate_multi *)
1823 			    kmem_alloc(fcm_size, KM_SLEEP);
1824 			if (copyin((void *)arg, fcp, fcm_size)) {
1825 				kmem_free(fcp, fcm_size);
1826 				return (EFAULT);
1827 			}
1828 			error = ufs_snap_create(vp, fcp, cr);
1829 			if (!error && copyout(fcp, (void *)arg, fcm_size))
1830 				error = EFAULT;
1831 			kmem_free(fcp, fcm_size);
1832 			return (error);
1833 		}
1834 
1835 		case _FIOSNAPSHOTDELETE:
1836 		{
1837 			struct fiosnapdelete	fc;
1838 
1839 			if (copyin((void *)arg, &fc, sizeof (fc)))
1840 				return (EFAULT);
1841 			error = ufs_snap_delete(vp, &fc, cr);
1842 			if (!error && copyout(&fc, (void *)arg, sizeof (fc)))
1843 				error = EFAULT;
1844 			return (error);
1845 		}
1846 
1847 		case _FIOGETSUPERBLOCK:
1848 			if (copyout(fs, (void *)arg, SBSIZE))
1849 				return (EFAULT);
1850 			return (0);
1851 
1852 		case _FIOGETMAXPHYS:
1853 			if (copyout(&maxphys, (void *)arg, sizeof (maxphys)))
1854 				return (EFAULT);
1855 			return (0);
1856 
1857 		/*
1858 		 * The following 3 ioctls are for TSufs support
1859 		 * although could potentially be used elsewhere
1860 		 */
1861 		case _FIO_SET_LUFS_DEBUG:
1862 			if (secpolicy_fs_config(cr, ufsvfsp->vfs_vfs) != 0)
1863 				return (EPERM);
1864 			lufs_debug = (uint32_t)arg;
1865 			return (0);
1866 
1867 		case _FIO_SET_LUFS_ERROR:
1868 			if (secpolicy_fs_config(cr, ufsvfsp->vfs_vfs) != 0)
1869 				return (EPERM);
1870 			TRANS_SETERROR(ufsvfsp);
1871 			return (0);
1872 
1873 		case _FIO_GET_TOP_STATS:
1874 		{
1875 			fio_lufs_stats_t *ls;
1876 			ml_unit_t *ul = ufsvfsp->vfs_log;
1877 
1878 			ls = kmem_zalloc(sizeof (*ls), KM_SLEEP);
1879 			ls->ls_debug = ul->un_debug; /* return debug value */
1880 			/* Copy stucture if statistics are being kept */
1881 			if (ul->un_logmap->mtm_tops) {
1882 				ls->ls_topstats = *(ul->un_logmap->mtm_tops);
1883 			}
1884 			error = 0;
1885 			if (copyout(ls, (void *)arg, sizeof (*ls)))
1886 				error = EFAULT;
1887 			kmem_free(ls, sizeof (*ls));
1888 			return (error);
1889 		}
1890 
1891 		case _FIO_SEEK_DATA:
1892 		case _FIO_SEEK_HOLE:
1893 			if (ddi_copyin((void *)arg, &off, sizeof (off), flag))
1894 				return (EFAULT);
1895 			/* offset paramater is in/out */
1896 			error = ufs_fio_holey(vp, cmd, &off);
1897 			if (error)
1898 				return (error);
1899 			if (ddi_copyout(&off, (void *)arg, sizeof (off), flag))
1900 				return (EFAULT);
1901 			return (0);
1902 
1903 		default:
1904 			return (ENOTTY);
1905 	}
1906 }
1907 
1908 /* ARGSUSED */
1909 static int
1910 ufs_getattr(struct vnode *vp, struct vattr *vap, int flags,
1911 	struct cred *cr)
1912 {
1913 	struct inode *ip = VTOI(vp);
1914 	struct ufsvfs *ufsvfsp;
1915 	int err;
1916 
1917 	TRACE_2(TR_FAC_UFS, TR_UFS_GETATTR_START,
1918 		"ufs_getattr_start:vp %p flags %x", vp, flags);
1919 
1920 	if (vap->va_mask == AT_SIZE) {
1921 		/*
1922 		 * for performance, if only the size is requested don't bother
1923 		 * with anything else.
1924 		 */
1925 		UFS_GET_ISIZE(&vap->va_size, ip);
1926 		TRACE_1(TR_FAC_UFS, TR_UFS_GETATTR_END,
1927 			"ufs_getattr_end:vp %p", vp);
1928 		return (0);
1929 	}
1930 
1931 	/*
1932 	 * inlined lockfs checks
1933 	 */
1934 	ufsvfsp = ip->i_ufsvfs;
1935 	if ((ufsvfsp == NULL) || ULOCKFS_IS_HLOCK(&ufsvfsp->vfs_ulockfs)) {
1936 		err = EIO;
1937 		goto out;
1938 	}
1939 
1940 	rw_enter(&ip->i_contents, RW_READER);
1941 	/*
1942 	 * Return all the attributes.  This should be refined so
1943 	 * that it only returns what's asked for.
1944 	 */
1945 
1946 	/*
1947 	 * Copy from inode table.
1948 	 */
1949 	vap->va_type = vp->v_type;
1950 	vap->va_mode = ip->i_mode & MODEMASK;
1951 	/*
1952 	 * If there is an ACL and there is a mask entry, then do the
1953 	 * extra work that completes the equivalent of an acltomode(3)
1954 	 * call.  According to POSIX P1003.1e, the acl mask should be
1955 	 * returned in the group permissions field.
1956 	 *
1957 	 * - start with the original permission and mode bits (from above)
1958 	 * - clear the group owner bits
1959 	 * - add in the mask bits.
1960 	 */
1961 	if (ip->i_ufs_acl && ip->i_ufs_acl->aclass.acl_ismask) {
1962 		vap->va_mode &= ~((VREAD | VWRITE | VEXEC) >> 3);
1963 		vap->va_mode |=
1964 		    (ip->i_ufs_acl->aclass.acl_maskbits & PERMMASK) << 3;
1965 	}
1966 	vap->va_uid = ip->i_uid;
1967 	vap->va_gid = ip->i_gid;
1968 	vap->va_fsid = ip->i_dev;
1969 	vap->va_nodeid = (ino64_t)ip->i_number;
1970 	vap->va_nlink = ip->i_nlink;
1971 	vap->va_size = ip->i_size;
1972 	if (vp->v_type == VCHR || vp->v_type == VBLK)
1973 		vap->va_rdev = ip->i_rdev;
1974 	else
1975 		vap->va_rdev = 0;	/* not a b/c spec. */
1976 	mutex_enter(&ip->i_tlock);
1977 	ITIMES_NOLOCK(ip);	/* mark correct time in inode */
1978 	vap->va_seq = ip->i_seq;
1979 	vap->va_atime.tv_sec = (time_t)ip->i_atime.tv_sec;
1980 	vap->va_atime.tv_nsec = ip->i_atime.tv_usec*1000;
1981 	vap->va_mtime.tv_sec = (time_t)ip->i_mtime.tv_sec;
1982 	vap->va_mtime.tv_nsec = ip->i_mtime.tv_usec*1000;
1983 	vap->va_ctime.tv_sec = (time_t)ip->i_ctime.tv_sec;
1984 	vap->va_ctime.tv_nsec = ip->i_ctime.tv_usec*1000;
1985 	mutex_exit(&ip->i_tlock);
1986 
1987 	switch (ip->i_mode & IFMT) {
1988 
1989 	case IFBLK:
1990 		vap->va_blksize = MAXBSIZE;		/* was BLKDEV_IOSIZE */
1991 		break;
1992 
1993 	case IFCHR:
1994 		vap->va_blksize = MAXBSIZE;
1995 		break;
1996 
1997 	default:
1998 		vap->va_blksize = ip->i_fs->fs_bsize;
1999 		break;
2000 	}
2001 	vap->va_nblocks = (fsblkcnt64_t)ip->i_blocks;
2002 	rw_exit(&ip->i_contents);
2003 	err = 0;
2004 
2005 out:
2006 	TRACE_1(TR_FAC_UFS, TR_UFS_GETATTR_END, "ufs_getattr_end:vp %p", vp);
2007 
2008 	return (err);
2009 }
2010 
2011 /*ARGSUSED4*/
2012 static int
2013 ufs_setattr(
2014 	struct vnode *vp,
2015 	struct vattr *vap,
2016 	int flags,
2017 	struct cred *cr,
2018 	caller_context_t *ct)
2019 {
2020 	struct inode *ip = VTOI(vp);
2021 	struct ufsvfs *ufsvfsp = ip->i_ufsvfs;
2022 	struct fs *fs;
2023 	struct ulockfs *ulp;
2024 	char *errmsg1;
2025 	char *errmsg2;
2026 	long blocks;
2027 	long int mask = vap->va_mask;
2028 	size_t len1, len2;
2029 	int issync;
2030 	int trans_size;
2031 	int dotrans;
2032 	int dorwlock;
2033 	int error;
2034 	int owner_change;
2035 	int dodqlock;
2036 	timestruc_t now;
2037 	vattr_t oldva;
2038 	int retry = 1;
2039 
2040 	TRACE_2(TR_FAC_UFS, TR_UFS_SETATTR_START,
2041 		"ufs_setattr_start:vp %p flags %x", vp, flags);
2042 
2043 	/*
2044 	 * Cannot set these attributes.
2045 	 */
2046 	if (mask & AT_NOSET) {
2047 		error = EINVAL;
2048 		goto out;
2049 	}
2050 
2051 	/*
2052 	 * check for forced unmount
2053 	 */
2054 	if (ufsvfsp == NULL)
2055 		return (EIO);
2056 
2057 	fs = ufsvfsp->vfs_fs;
2058 	if (fs->fs_ronly != 0)
2059 		return (EROFS);
2060 
2061 again:
2062 	errmsg1 = NULL;
2063 	errmsg2 = NULL;
2064 	dotrans = 0;
2065 	dorwlock = 0;
2066 	dodqlock = 0;
2067 
2068 	error = ufs_lockfs_begin(ufsvfsp, &ulp, ULOCKFS_SETATTR_MASK);
2069 	if (error)
2070 		goto out;
2071 
2072 	/*
2073 	 * Acquire i_rwlock before TRANS_BEGIN_CSYNC() if this is a file.
2074 	 * This follows the protocol for read()/write().
2075 	 */
2076 	if (vp->v_type != VDIR) {
2077 		rw_enter(&ip->i_rwlock, RW_WRITER);
2078 		dorwlock = 1;
2079 	}
2080 
2081 	/*
2082 	 * Truncate file.  Must have write permission and not be a directory.
2083 	 */
2084 	if (mask & AT_SIZE) {
2085 		rw_enter(&ip->i_contents, RW_WRITER);
2086 		if (vp->v_type == VDIR) {
2087 			error = EISDIR;
2088 			goto update_inode;
2089 		}
2090 		if (error = ufs_iaccess(ip, IWRITE, cr))
2091 			goto update_inode;
2092 
2093 		rw_exit(&ip->i_contents);
2094 		error = TRANS_ITRUNC(ip, vap->va_size, 0, cr);
2095 		if (error) {
2096 			rw_enter(&ip->i_contents, RW_WRITER);
2097 			goto update_inode;
2098 		}
2099 	}
2100 
2101 	if (ulp) {
2102 		trans_size = (int)TOP_SETATTR_SIZE(ip);
2103 		TRANS_BEGIN_CSYNC(ufsvfsp, issync, TOP_SETATTR, trans_size);
2104 		++dotrans;
2105 	}
2106 
2107 	/*
2108 	 * Acquire i_rwlock after TRANS_BEGIN_CSYNC() if this is a directory.
2109 	 * This follows the protocol established by
2110 	 * ufs_link/create/remove/rename/mkdir/rmdir/symlink.
2111 	 */
2112 	if (vp->v_type == VDIR) {
2113 		rw_enter(&ip->i_rwlock, RW_WRITER);
2114 		dorwlock = 1;
2115 	}
2116 
2117 	/*
2118 	 * Grab quota lock if we are changing the file's owner.
2119 	 */
2120 	if (mask & AT_UID) {
2121 		rw_enter(&ufsvfsp->vfs_dqrwlock, RW_READER);
2122 		dodqlock = 1;
2123 	}
2124 	rw_enter(&ip->i_contents, RW_WRITER);
2125 
2126 	oldva.va_mode = ip->i_mode;
2127 	oldva.va_uid = ip->i_uid;
2128 	oldva.va_gid = ip->i_gid;
2129 
2130 	vap->va_mask &= ~AT_SIZE;
2131 	/*
2132 	 * ufs_iaccess is "close enough"; that's because it doesn't
2133 	 * map the defines.
2134 	 */
2135 	error = secpolicy_vnode_setattr(cr, vp, vap, &oldva, flags,
2136 				ufs_iaccess, ip);
2137 	if (error)
2138 		goto update_inode;
2139 
2140 	mask = vap->va_mask;
2141 
2142 	/*
2143 	 * Change file access modes.
2144 	 */
2145 	if (mask & AT_MODE) {
2146 		ip->i_mode = (ip->i_mode & IFMT) | (vap->va_mode & ~IFMT);
2147 		TRANS_INODE(ufsvfsp, ip);
2148 		ip->i_flag |= ICHG;
2149 		if (stickyhack) {
2150 			mutex_enter(&vp->v_lock);
2151 			if ((ip->i_mode & (ISVTX | IEXEC | IFDIR)) == ISVTX)
2152 				vp->v_flag |= VSWAPLIKE;
2153 			else
2154 				vp->v_flag &= ~VSWAPLIKE;
2155 			mutex_exit(&vp->v_lock);
2156 		}
2157 	}
2158 	if (mask & (AT_UID|AT_GID)) {
2159 		if (mask & AT_UID) {
2160 			/*
2161 			 * Don't change ownership of the quota inode.
2162 			 */
2163 			if (ufsvfsp->vfs_qinod == ip) {
2164 				ASSERT(ufsvfsp->vfs_qflags & MQ_ENABLED);
2165 				error = EINVAL;
2166 				goto update_inode;
2167 			}
2168 
2169 			/*
2170 			 * No real ownership change.
2171 			 */
2172 			if (ip->i_uid == vap->va_uid) {
2173 				blocks = 0;
2174 				owner_change = 0;
2175 			}
2176 			/*
2177 			 * Remove the blocks and the file, from the old user's
2178 			 * quota.
2179 			 */
2180 			else {
2181 				blocks = ip->i_blocks;
2182 				owner_change = 1;
2183 
2184 				(void) chkdq(ip, -blocks, /* force */ 1, cr,
2185 						(char **)NULL, (size_t *)NULL);
2186 				(void) chkiq(ufsvfsp, /* change */ -1, ip,
2187 						(uid_t)ip->i_uid,
2188 						/* force */ 1, cr,
2189 						(char **)NULL, (size_t *)NULL);
2190 				dqrele(ip->i_dquot);
2191 			}
2192 
2193 			ip->i_uid = vap->va_uid;
2194 
2195 			/*
2196 			 * There is a real ownership change.
2197 			 */
2198 			if (owner_change) {
2199 				/*
2200 				 * Add the blocks and the file to the new
2201 				 * user's quota.
2202 				 */
2203 				ip->i_dquot = getinoquota(ip);
2204 				(void) chkdq(ip, blocks, /* force */ 1, cr,
2205 						&errmsg1, &len1);
2206 				(void) chkiq(ufsvfsp, /* change */ 1,
2207 						(struct inode *)NULL,
2208 						(uid_t)ip->i_uid,
2209 						/* force */ 1, cr,
2210 						&errmsg2, &len2);
2211 			}
2212 		}
2213 		if (mask & AT_GID) {
2214 			ip->i_gid = vap->va_gid;
2215 		}
2216 		TRANS_INODE(ufsvfsp, ip);
2217 		ip->i_flag |= ICHG;
2218 	}
2219 	/*
2220 	 * Change file access or modified times.
2221 	 */
2222 	if (mask & (AT_ATIME|AT_MTIME)) {
2223 		/* Check that the time value is within ufs range */
2224 		if (((mask & AT_ATIME) && TIMESPEC_OVERFLOW(&vap->va_atime)) ||
2225 		    ((mask & AT_MTIME) && TIMESPEC_OVERFLOW(&vap->va_mtime))) {
2226 			error = EOVERFLOW;
2227 			goto update_inode;
2228 		}
2229 
2230 		/*
2231 		 * if the "noaccess" mount option is set and only atime
2232 		 * update is requested, do nothing. No error is returned.
2233 		 */
2234 		if ((ufsvfsp->vfs_noatime) &&
2235 		    ((mask & (AT_ATIME|AT_MTIME)) == AT_ATIME))
2236 			goto skip_atime;
2237 
2238 		if (mask & AT_ATIME) {
2239 			ip->i_atime.tv_sec = vap->va_atime.tv_sec;
2240 			ip->i_atime.tv_usec = vap->va_atime.tv_nsec / 1000;
2241 			ip->i_flag &= ~IACC;
2242 		}
2243 		if (mask & AT_MTIME) {
2244 			ip->i_mtime.tv_sec = vap->va_mtime.tv_sec;
2245 			ip->i_mtime.tv_usec = vap->va_mtime.tv_nsec / 1000;
2246 			gethrestime(&now);
2247 			if (now.tv_sec > TIME32_MAX) {
2248 				/*
2249 				 * In 2038, ctime sticks forever..
2250 				 */
2251 				ip->i_ctime.tv_sec = TIME32_MAX;
2252 				ip->i_ctime.tv_usec = 0;
2253 			} else {
2254 				ip->i_ctime.tv_sec = now.tv_sec;
2255 				ip->i_ctime.tv_usec = now.tv_nsec / 1000;
2256 			}
2257 			ip->i_flag &= ~(IUPD|ICHG);
2258 			ip->i_flag |= IMODTIME;
2259 		}
2260 		TRANS_INODE(ufsvfsp, ip);
2261 		ip->i_flag |= IMOD;
2262 	}
2263 
2264 skip_atime:
2265 	/*
2266 	 * The presence of a shadow inode may indicate an ACL, but does
2267 	 * not imply an ACL.  Future FSD types should be handled here too
2268 	 * and check for the presence of the attribute-specific data
2269 	 * before referencing it.
2270 	 */
2271 	if (ip->i_shadow) {
2272 		/*
2273 		 * XXX if ufs_iupdat is changed to sandbagged write fix
2274 		 * ufs_acl_setattr to push ip to keep acls consistent
2275 		 *
2276 		 * Suppress out of inodes messages if we will retry.
2277 		 */
2278 		if (retry)
2279 			ip->i_flag |= IQUIET;
2280 		error = ufs_acl_setattr(ip, vap, cr);
2281 		ip->i_flag &= ~IQUIET;
2282 	}
2283 
2284 update_inode:
2285 	/*
2286 	 * Setattr always increases the sequence number
2287 	 */
2288 	ip->i_seq++;
2289 
2290 	/*
2291 	 * if nfsd and not logging; push synchronously
2292 	 */
2293 	if ((curthread->t_flag & T_DONTPEND) && !TRANS_ISTRANS(ufsvfsp)) {
2294 		ufs_iupdat(ip, 1);
2295 	} else {
2296 		ITIMES_NOLOCK(ip);
2297 	}
2298 
2299 	rw_exit(&ip->i_contents);
2300 	if (dodqlock) {
2301 		rw_exit(&ufsvfsp->vfs_dqrwlock);
2302 	}
2303 	if (dorwlock)
2304 		rw_exit(&ip->i_rwlock);
2305 
2306 	if (ulp) {
2307 		if (dotrans) {
2308 			int terr = 0;
2309 			TRANS_END_CSYNC(ufsvfsp, terr, issync, TOP_SETATTR,
2310 			    trans_size);
2311 			if (error == 0)
2312 				error = terr;
2313 		}
2314 		ufs_lockfs_end(ulp);
2315 	}
2316 out:
2317 	/*
2318 	 * If out of inodes or blocks, see if we can free something
2319 	 * up from the delete queue.
2320 	 */
2321 	if ((error == ENOSPC) && retry && TRANS_ISTRANS(ufsvfsp)) {
2322 		ufs_delete_drain_wait(ufsvfsp, 1);
2323 		retry = 0;
2324 		if (errmsg1 != NULL)
2325 			kmem_free(errmsg1, len1);
2326 		if (errmsg2 != NULL)
2327 			kmem_free(errmsg2, len2);
2328 		goto again;
2329 	}
2330 	TRACE_2(TR_FAC_UFS, TR_UFS_SETATTR_END,
2331 		"ufs_setattr_end:vp %p error %d", vp, error);
2332 	if (errmsg1 != NULL) {
2333 		uprintf(errmsg1);
2334 		kmem_free(errmsg1, len1);
2335 	}
2336 	if (errmsg2 != NULL) {
2337 		uprintf(errmsg2);
2338 		kmem_free(errmsg2, len2);
2339 	}
2340 	return (error);
2341 }
2342 
2343 /*ARGSUSED*/
2344 static int
2345 ufs_access(struct vnode *vp, int mode, int flags, struct cred *cr)
2346 {
2347 	struct inode *ip = VTOI(vp);
2348 	int error;
2349 
2350 	TRACE_3(TR_FAC_UFS, TR_UFS_ACCESS_START,
2351 		"ufs_access_start:vp %p mode %x flags %x", vp, mode, flags);
2352 
2353 	if (ip->i_ufsvfs == NULL)
2354 		return (EIO);
2355 
2356 	rw_enter(&ip->i_contents, RW_READER);
2357 
2358 	/*
2359 	 * The ufs_iaccess function wants to be called with
2360 	 * mode bits expressed as "ufs specific" bits.
2361 	 * I.e., VWRITE|VREAD|VEXEC do not make sense to
2362 	 * ufs_iaccess() but IWRITE|IREAD|IEXEC do.
2363 	 * But since they're the same we just pass the vnode mode
2364 	 * bit but just verify that assumption at compile time.
2365 	 */
2366 #if IWRITE != VWRITE || IREAD != VREAD || IEXEC != VEXEC
2367 #error "ufs_access needs to map Vmodes to Imodes"
2368 #endif
2369 	error = ufs_iaccess(ip, mode, cr);
2370 
2371 	rw_exit(&ip->i_contents);
2372 
2373 	TRACE_2(TR_FAC_UFS, TR_UFS_ACCESS_END,
2374 		"ufs_access_end:vp %p error %d", vp, error);
2375 	return (error);
2376 }
2377 
2378 /* ARGSUSED */
2379 static int
2380 ufs_readlink(struct vnode *vp, struct uio *uiop, struct cred *cr)
2381 {
2382 	struct inode *ip = VTOI(vp);
2383 	struct ufsvfs *ufsvfsp;
2384 	struct ulockfs *ulp;
2385 	int error;
2386 	int fastsymlink;
2387 
2388 	TRACE_2(TR_FAC_UFS, TR_UFS_READLINK_START,
2389 		"ufs_readlink_start:vp %p uiop %p", uiop, vp);
2390 
2391 	if (vp->v_type != VLNK) {
2392 		error = EINVAL;
2393 		goto nolockout;
2394 	}
2395 
2396 	/*
2397 	 * If the symbolic link is empty there is nothing to read.
2398 	 * Fast-track these empty symbolic links
2399 	 */
2400 	if (ip->i_size == 0) {
2401 		error = 0;
2402 		goto nolockout;
2403 	}
2404 
2405 	ufsvfsp = ip->i_ufsvfs;
2406 	error = ufs_lockfs_begin(ufsvfsp, &ulp, ULOCKFS_READLINK_MASK);
2407 	if (error)
2408 		goto nolockout;
2409 	/*
2410 	 * The ip->i_rwlock protects the data blocks used for FASTSYMLINK
2411 	 */
2412 again:
2413 	fastsymlink = 0;
2414 	if (ip->i_flag & IFASTSYMLNK) {
2415 		rw_enter(&ip->i_rwlock, RW_READER);
2416 		rw_enter(&ip->i_contents, RW_READER);
2417 		if (ip->i_flag & IFASTSYMLNK) {
2418 			if (!ULOCKFS_IS_NOIACC(ITOUL(ip)) &&
2419 			    (ip->i_fs->fs_ronly == 0) &&
2420 			    (!ufsvfsp->vfs_noatime)) {
2421 				mutex_enter(&ip->i_tlock);
2422 				ip->i_flag |= IACC;
2423 				mutex_exit(&ip->i_tlock);
2424 			}
2425 			error = uiomove((caddr_t)&ip->i_db[1],
2426 				MIN(ip->i_size, uiop->uio_resid),
2427 				UIO_READ, uiop);
2428 			ITIMES(ip);
2429 			++fastsymlink;
2430 		}
2431 		rw_exit(&ip->i_contents);
2432 		rw_exit(&ip->i_rwlock);
2433 	}
2434 	if (!fastsymlink) {
2435 		ssize_t size;	/* number of bytes read  */
2436 		caddr_t basep;	/* pointer to input data */
2437 		ino_t ino;
2438 		long  igen;
2439 		struct uio tuio;	/* temp uio struct */
2440 		struct uio *tuiop;
2441 		iovec_t tiov;		/* temp iovec struct */
2442 		char kbuf[FSL_SIZE];	/* buffer to hold fast symlink */
2443 		int tflag = 0;		/* flag to indicate temp vars used */
2444 
2445 		ino = ip->i_number;
2446 		igen = ip->i_gen;
2447 		size = uiop->uio_resid;
2448 		basep = uiop->uio_iov->iov_base;
2449 		tuiop = uiop;
2450 
2451 		rw_enter(&ip->i_rwlock, RW_WRITER);
2452 		rw_enter(&ip->i_contents, RW_WRITER);
2453 		if (ip->i_flag & IFASTSYMLNK) {
2454 			rw_exit(&ip->i_contents);
2455 			rw_exit(&ip->i_rwlock);
2456 			goto again;
2457 		}
2458 
2459 		/* can this be a fast symlink and is it a user buffer? */
2460 		if (ip->i_size <= FSL_SIZE &&
2461 		    (uiop->uio_segflg == UIO_USERSPACE ||
2462 		    uiop->uio_segflg == UIO_USERISPACE)) {
2463 
2464 			bzero(&tuio, sizeof (struct uio));
2465 			/*
2466 			 * setup a kernel buffer to read link into.  this
2467 			 * is to fix a race condition where the user buffer
2468 			 * got corrupted before copying it into the inode.
2469 			 */
2470 			size = ip->i_size;
2471 			tiov.iov_len = size;
2472 			tiov.iov_base = kbuf;
2473 			tuio.uio_iov = &tiov;
2474 			tuio.uio_iovcnt = 1;
2475 			tuio.uio_offset = uiop->uio_offset;
2476 			tuio.uio_segflg = UIO_SYSSPACE;
2477 			tuio.uio_fmode = uiop->uio_fmode;
2478 			tuio.uio_extflg = uiop->uio_extflg;
2479 			tuio.uio_limit = uiop->uio_limit;
2480 			tuio.uio_resid = size;
2481 
2482 			basep = tuio.uio_iov->iov_base;
2483 			tuiop = &tuio;
2484 			tflag = 1;
2485 		}
2486 
2487 		error = rdip(ip, tuiop, 0, cr);
2488 		if (!(error == 0 && ip->i_number == ino && ip->i_gen == igen)) {
2489 			rw_exit(&ip->i_contents);
2490 			rw_exit(&ip->i_rwlock);
2491 			goto out;
2492 		}
2493 
2494 		if (tflag == 0)
2495 			size -= uiop->uio_resid;
2496 
2497 		if ((tflag == 0 && ip->i_size <= FSL_SIZE &&
2498 		    ip->i_size == size) || (tflag == 1 &&
2499 		    tuio.uio_resid == 0)) {
2500 			error = kcopy(basep, &ip->i_db[1], ip->i_size);
2501 			if (error == 0) {
2502 				ip->i_flag |= IFASTSYMLNK;
2503 				/*
2504 				 * free page
2505 				 */
2506 				(void) VOP_PUTPAGE(ITOV(ip),
2507 				    (offset_t)0, PAGESIZE,
2508 				    (B_DONTNEED | B_FREE | B_FORCE | B_ASYNC),
2509 				    cr);
2510 			} else {
2511 				int i;
2512 				/* error, clear garbage left behind */
2513 				for (i = 1; i < NDADDR; i++)
2514 					ip->i_db[i] = 0;
2515 				for (i = 0; i < NIADDR; i++)
2516 					ip->i_ib[i] = 0;
2517 			}
2518 		}
2519 		if (tflag == 1) {
2520 			/* now, copy it into the user buffer */
2521 			error = uiomove((caddr_t)kbuf,
2522 				MIN(size, uiop->uio_resid),
2523 				UIO_READ, uiop);
2524 		}
2525 		rw_exit(&ip->i_contents);
2526 		rw_exit(&ip->i_rwlock);
2527 	}
2528 out:
2529 	if (ulp) {
2530 		ufs_lockfs_end(ulp);
2531 	}
2532 nolockout:
2533 	TRACE_2(TR_FAC_UFS, TR_UFS_READLINK_END,
2534 		"ufs_readlink_end:vp %p error %d", vp, error);
2535 
2536 	return (error);
2537 }
2538 
2539 /* ARGSUSED */
2540 static int
2541 ufs_fsync(struct vnode *vp, int syncflag, struct cred *cr)
2542 {
2543 	struct inode *ip = VTOI(vp);
2544 	struct ufsvfs *ufsvfsp = ip->i_ufsvfs;
2545 	struct ulockfs *ulp;
2546 	int error;
2547 
2548 	TRACE_1(TR_FAC_UFS, TR_UFS_FSYNC_START,
2549 		"ufs_fsync_start:vp %p", vp);
2550 
2551 	error = ufs_lockfs_begin(ufsvfsp, &ulp, ULOCKFS_FSYNC_MASK);
2552 	if (error)
2553 		return (error);
2554 
2555 	if (TRANS_ISTRANS(ufsvfsp)) {
2556 		/*
2557 		 * First push out any data pages
2558 		 */
2559 		if (vn_has_cached_data(vp) && !(syncflag & FNODSYNC) &&
2560 		    (vp->v_type != VCHR) && !(IS_SWAPVP(vp))) {
2561 			error = VOP_PUTPAGE(vp, (offset_t)0, (size_t)0,
2562 			    0, CRED());
2563 			if (error)
2564 				goto out;
2565 		}
2566 
2567 		/*
2568 		 * Delta any delayed inode times updates
2569 		 * and push inode to log.
2570 		 * All other inode deltas will have already been delta'd
2571 		 * and will be pushed during the commit.
2572 		 */
2573 		if (!(syncflag & FDSYNC) &&
2574 		    ((ip->i_flag & (IMOD|IMODACC)) == IMODACC)) {
2575 			if (ulp) {
2576 				TRANS_BEGIN_ASYNC(ufsvfsp, TOP_FSYNC,
2577 				    TOP_SYNCIP_SIZE);
2578 			}
2579 			rw_enter(&ip->i_contents, RW_READER);
2580 			mutex_enter(&ip->i_tlock);
2581 			ip->i_flag &= ~IMODTIME;
2582 			mutex_exit(&ip->i_tlock);
2583 			ufs_iupdat(ip, I_SYNC);
2584 			rw_exit(&ip->i_contents);
2585 			if (ulp) {
2586 				TRANS_END_ASYNC(ufsvfsp, TOP_FSYNC,
2587 				    TOP_SYNCIP_SIZE);
2588 			}
2589 		}
2590 
2591 		/*
2592 		 * Commit the Moby transaction
2593 		 *
2594 		 * Deltas have already been made so we just need to
2595 		 * commit them with a synchronous transaction.
2596 		 * TRANS_BEGIN_SYNC() will return an error
2597 		 * if there are no deltas to commit, for an
2598 		 * empty transaction.
2599 		 */
2600 		if (ulp) {
2601 			TRANS_BEGIN_SYNC(ufsvfsp, TOP_FSYNC, TOP_COMMIT_SIZE,
2602 			    error);
2603 			if (error) {
2604 				error = 0; /* commit wasn't needed */
2605 				goto out;
2606 			}
2607 			TRANS_END_SYNC(ufsvfsp, error, TOP_FSYNC,
2608 			    TOP_COMMIT_SIZE);
2609 		}
2610 	} else {	/* not logging */
2611 		if (!(IS_SWAPVP(vp)))
2612 			if (syncflag & FNODSYNC) {
2613 				/* Just update the inode only */
2614 				TRANS_IUPDAT(ip, 1);
2615 				error = 0;
2616 			} else if (syncflag & FDSYNC)
2617 				/* Do data-synchronous writes */
2618 				error = TRANS_SYNCIP(ip, 0, I_DSYNC, TOP_FSYNC);
2619 			else
2620 				/* Do synchronous writes */
2621 				error = TRANS_SYNCIP(ip, 0, I_SYNC, TOP_FSYNC);
2622 
2623 		rw_enter(&ip->i_contents, RW_WRITER);
2624 		if (!error)
2625 			error = ufs_sync_indir(ip);
2626 		rw_exit(&ip->i_contents);
2627 	}
2628 out:
2629 	if (ulp) {
2630 		ufs_lockfs_end(ulp);
2631 	}
2632 	TRACE_2(TR_FAC_UFS, TR_UFS_FSYNC_END,
2633 		"ufs_fsync_end:vp %p error %d", vp, error);
2634 	return (error);
2635 }
2636 
2637 /*ARGSUSED*/
2638 static void
2639 ufs_inactive(struct vnode *vp, struct cred *cr)
2640 {
2641 	ufs_iinactive(VTOI(vp));
2642 }
2643 
2644 /*
2645  * Unix file system operations having to do with directory manipulation.
2646  */
2647 int ufs_lookup_idle_count = 2;	/* Number of inodes to idle each time */
2648 /* ARGSUSED */
2649 static int
2650 ufs_lookup(struct vnode *dvp, char *nm, struct vnode **vpp,
2651 	struct pathname *pnp, int flags, struct vnode *rdir, struct cred *cr)
2652 {
2653 	struct inode *ip;
2654 	struct inode *sip;
2655 	struct inode *xip;
2656 	struct ufsvfs *ufsvfsp;
2657 	struct ulockfs *ulp;
2658 	struct vnode *vp;
2659 	int error;
2660 
2661 	TRACE_2(TR_FAC_UFS, TR_UFS_LOOKUP_START,
2662 		"ufs_lookup_start:dvp %p name %s", dvp, nm);
2663 
2664 
2665 	/*
2666 	 * Check flags for type of lookup (regular file or attribute file)
2667 	 */
2668 
2669 	ip = VTOI(dvp);
2670 
2671 	if (flags & LOOKUP_XATTR) {
2672 
2673 		/*
2674 		 * We don't allow recursive attributes...
2675 		 * Maybe someday we will.
2676 		 */
2677 		if ((ip->i_cflags & IXATTR)) {
2678 			return (EINVAL);
2679 		}
2680 
2681 		if ((vp = dnlc_lookup(dvp, XATTR_DIR_NAME)) == NULL) {
2682 			error = ufs_xattr_getattrdir(dvp, &sip, flags, cr);
2683 			if (error) {
2684 				*vpp = NULL;
2685 				goto out;
2686 			}
2687 
2688 			vp = ITOV(sip);
2689 			dnlc_update(dvp, XATTR_DIR_NAME, vp);
2690 		}
2691 
2692 		/*
2693 		 * Check accessibility of directory.
2694 		 */
2695 		if (vp == DNLC_NO_VNODE) {
2696 			VN_RELE(vp);
2697 			error = ENOENT;
2698 			goto out;
2699 		}
2700 		if ((error = ufs_iaccess(VTOI(vp), IEXEC, cr)) != 0) {
2701 			VN_RELE(vp);
2702 			goto out;
2703 		}
2704 
2705 		*vpp = vp;
2706 		return (0);
2707 	}
2708 
2709 	/*
2710 	 * Check for a null component, which we should treat as
2711 	 * looking at dvp from within it's parent, so we don't
2712 	 * need a call to ufs_iaccess(), as it has already been
2713 	 * done.
2714 	 */
2715 	if (nm[0] == 0) {
2716 		VN_HOLD(dvp);
2717 		error = 0;
2718 		*vpp = dvp;
2719 		goto out;
2720 	}
2721 
2722 	/*
2723 	 * Check for "." ie itself. this is a quick check and
2724 	 * avoids adding "." into the dnlc (which have been seen
2725 	 * to occupy >10% of the cache).
2726 	 */
2727 	if ((nm[0] == '.') && (nm[1] == 0)) {
2728 		/*
2729 		 * Don't return without checking accessibility
2730 		 * of the directory. We only need the lock if
2731 		 * we are going to return it.
2732 		 */
2733 		if ((error = ufs_iaccess(ip, IEXEC, cr)) == 0) {
2734 			VN_HOLD(dvp);
2735 			*vpp = dvp;
2736 		}
2737 		goto out;
2738 	}
2739 
2740 	/*
2741 	 * Fast path: Check the directory name lookup cache.
2742 	 */
2743 	if (vp = dnlc_lookup(dvp, nm)) {
2744 		/*
2745 		 * Check accessibility of directory.
2746 		 */
2747 		if ((error = ufs_iaccess(ip, IEXEC, cr)) != 0) {
2748 			VN_RELE(vp);
2749 			goto out;
2750 		}
2751 		if (vp == DNLC_NO_VNODE) {
2752 			VN_RELE(vp);
2753 			error = ENOENT;
2754 			goto out;
2755 		}
2756 		xip = VTOI(vp);
2757 		ulp = NULL;
2758 		goto fastpath;
2759 	}
2760 
2761 	/*
2762 	 * Keep the idle queue from getting too long by
2763 	 * idling two inodes before attempting to allocate another.
2764 	 *    This operation must be performed before entering
2765 	 *    lockfs or a transaction.
2766 	 */
2767 	if (ufs_idle_q.uq_ne > ufs_idle_q.uq_hiwat)
2768 		if ((curthread->t_flag & T_DONTBLOCK) == 0) {
2769 			ins.in_lidles.value.ul += ufs_lookup_idle_count;
2770 			ufs_idle_some(ufs_lookup_idle_count);
2771 		}
2772 
2773 	ufsvfsp = ip->i_ufsvfs;
2774 	error = ufs_lockfs_begin(ufsvfsp, &ulp, ULOCKFS_LOOKUP_MASK);
2775 	if (error)
2776 		goto out;
2777 
2778 	error = ufs_dirlook(ip, nm, &xip, cr, 1);
2779 
2780 fastpath:
2781 	if (error == 0) {
2782 		ip = xip;
2783 		*vpp = ITOV(ip);
2784 
2785 		/*
2786 		 * If vnode is a device return special vnode instead.
2787 		 */
2788 		if (IS_DEVVP(*vpp)) {
2789 			struct vnode *newvp;
2790 
2791 			newvp = specvp(*vpp, (*vpp)->v_rdev, (*vpp)->v_type,
2792 			    cr);
2793 			VN_RELE(*vpp);
2794 			if (newvp == NULL)
2795 				error = ENOSYS;
2796 			else
2797 				*vpp = newvp;
2798 		}
2799 	}
2800 	if (ulp) {
2801 		ufs_lockfs_end(ulp);
2802 	}
2803 
2804 out:
2805 	TRACE_3(TR_FAC_UFS, TR_UFS_LOOKUP_END,
2806 		"ufs_lookup_end:dvp %p name %s error %d", vpp, nm, error);
2807 	return (error);
2808 }
2809 
2810 static int
2811 ufs_create(struct vnode *dvp, char *name, struct vattr *vap, enum vcexcl excl,
2812 	int mode, struct vnode **vpp, struct cred *cr, int flag)
2813 {
2814 	struct inode *ip;
2815 	struct inode *xip;
2816 	struct inode *dip;
2817 	struct vnode *xvp;
2818 	struct ufsvfs *ufsvfsp;
2819 	struct ulockfs *ulp;
2820 	int error;
2821 	int issync;
2822 	int truncflag;
2823 	int trans_size;
2824 	int noentry;
2825 	int defer_dip_seq_update = 0;	/* need to defer update of dip->i_seq */
2826 	int retry = 1;
2827 
2828 	TRACE_1(TR_FAC_UFS, TR_UFS_CREATE_START,
2829 		"ufs_create_start:dvp %p", dvp);
2830 
2831 again:
2832 	ip = VTOI(dvp);
2833 	ufsvfsp = ip->i_ufsvfs;
2834 	truncflag = 0;
2835 
2836 	error = ufs_lockfs_begin(ufsvfsp, &ulp, ULOCKFS_CREATE_MASK);
2837 	if (error)
2838 		goto out;
2839 
2840 	if (ulp) {
2841 		trans_size = (int)TOP_CREATE_SIZE(ip);
2842 		TRANS_BEGIN_CSYNC(ufsvfsp, issync, TOP_CREATE, trans_size);
2843 	}
2844 
2845 	if ((vap->va_mode & VSVTX) && secpolicy_vnode_stky_modify(cr) != 0)
2846 		vap->va_mode &= ~VSVTX;
2847 
2848 	if (*name == '\0') {
2849 		/*
2850 		 * Null component name refers to the directory itself.
2851 		 */
2852 		VN_HOLD(dvp);
2853 		/*
2854 		 * Even though this is an error case, we need to grab the
2855 		 * quota lock since the error handling code below is common.
2856 		 */
2857 		rw_enter(&ufsvfsp->vfs_dqrwlock, RW_READER);
2858 		rw_enter(&ip->i_contents, RW_WRITER);
2859 		error = EEXIST;
2860 	} else {
2861 		xip = NULL;
2862 		noentry = 0;
2863 		rw_enter(&ip->i_rwlock, RW_WRITER);
2864 		xvp = dnlc_lookup(dvp, name);
2865 		if (xvp == DNLC_NO_VNODE) {
2866 			noentry = 1;
2867 			VN_RELE(xvp);
2868 			xvp = NULL;
2869 		}
2870 		if (xvp) {
2871 			rw_exit(&ip->i_rwlock);
2872 			if (error = ufs_iaccess(ip, IEXEC, cr)) {
2873 				VN_RELE(xvp);
2874 			} else {
2875 				error = EEXIST;
2876 				xip = VTOI(xvp);
2877 			}
2878 		} else {
2879 			/*
2880 			 * Suppress file system full message if we will retry
2881 			 */
2882 			error = ufs_direnter_cm(ip, name, DE_CREATE,
2883 				vap, &xip, cr,
2884 				(noentry | (retry ? IQUIET : 0)));
2885 			rw_exit(&ip->i_rwlock);
2886 		}
2887 		ip = xip;
2888 		if (ip != NULL) {
2889 			rw_enter(&ufsvfsp->vfs_dqrwlock, RW_READER);
2890 			rw_enter(&ip->i_contents, RW_WRITER);
2891 		}
2892 	}
2893 
2894 	/*
2895 	 * If the file already exists and this is a non-exclusive create,
2896 	 * check permissions and allow access for non-directories.
2897 	 * Read-only create of an existing directory is also allowed.
2898 	 * We fail an exclusive create of anything which already exists.
2899 	 */
2900 	if (error == EEXIST) {
2901 		dip = VTOI(dvp);
2902 		if (excl == NONEXCL) {
2903 			if ((((ip->i_mode & IFMT) == IFDIR) ||
2904 			    ((ip->i_mode & IFMT) == IFATTRDIR)) &&
2905 			    (mode & IWRITE))
2906 				error = EISDIR;
2907 			else if (mode)
2908 				error = ufs_iaccess(ip, mode, cr);
2909 			else
2910 				error = 0;
2911 		}
2912 		if (error) {
2913 			rw_exit(&ip->i_contents);
2914 			rw_exit(&ufsvfsp->vfs_dqrwlock);
2915 			VN_RELE(ITOV(ip));
2916 			goto unlock;
2917 		}
2918 		/*
2919 		 * If the error EEXIST was set, then i_seq can not
2920 		 * have been updated. The sequence number interface
2921 		 * is defined such that a non-error VOP_CREATE must
2922 		 * increase the dir va_seq it by at least one. If we
2923 		 * have cleared the error, increase i_seq. Note that
2924 		 * we are increasing the dir i_seq and in rare cases
2925 		 * ip may actually be from the dvp, so we already have
2926 		 * the locks and it will not be subject to truncation.
2927 		 * In case we have to update i_seq of the parent
2928 		 * directory dip, we have to defer it till we have
2929 		 * released our locks on ip due to lock ordering requirements.
2930 		 */
2931 		if (ip != dip)
2932 			defer_dip_seq_update = 1;
2933 		else
2934 			ip->i_seq++;
2935 
2936 		if (((ip->i_mode & IFMT) == IFREG) &&
2937 		    (vap->va_mask & AT_SIZE) && vap->va_size == 0) {
2938 			/*
2939 			 * Truncate regular files, if requested by caller.
2940 			 * Grab i_rwlock to make sure no one else is
2941 			 * currently writing to the file (we promised
2942 			 * bmap we would do this).
2943 			 * Must get the locks in the correct order.
2944 			 */
2945 			if (ip->i_size == 0) {
2946 				ip->i_flag |= ICHG | IUPD;
2947 				ip->i_seq++;
2948 				TRANS_INODE(ufsvfsp, ip);
2949 			} else {
2950 				/*
2951 				 * Large Files: Why this check here?
2952 				 * Though we do it in vn_create() we really
2953 				 * want to guarantee that we do not destroy
2954 				 * Large file data by atomically checking
2955 				 * the size while holding the contents
2956 				 * lock.
2957 				 */
2958 				if (flag && !(flag & FOFFMAX) &&
2959 				    ((ip->i_mode & IFMT) == IFREG) &&
2960 				    (ip->i_size > (offset_t)MAXOFF32_T)) {
2961 					rw_exit(&ip->i_contents);
2962 					rw_exit(&ufsvfsp->vfs_dqrwlock);
2963 					error = EOVERFLOW;
2964 					goto unlock;
2965 				}
2966 				if (TRANS_ISTRANS(ufsvfsp))
2967 					truncflag++;
2968 				else {
2969 					rw_exit(&ip->i_contents);
2970 					rw_exit(&ufsvfsp->vfs_dqrwlock);
2971 					rw_enter(&ip->i_rwlock, RW_WRITER);
2972 					rw_enter(&ufsvfsp->vfs_dqrwlock,
2973 							RW_READER);
2974 					rw_enter(&ip->i_contents, RW_WRITER);
2975 					(void) ufs_itrunc(ip, (u_offset_t)0, 0,
2976 								cr);
2977 					rw_exit(&ip->i_rwlock);
2978 				}
2979 			}
2980 		}
2981 	}
2982 
2983 	if (error) {
2984 		if (ip != NULL) {
2985 			rw_exit(&ufsvfsp->vfs_dqrwlock);
2986 			rw_exit(&ip->i_contents);
2987 		}
2988 		goto unlock;
2989 	}
2990 
2991 	*vpp = ITOV(ip);
2992 	ITIMES(ip);
2993 	rw_exit(&ip->i_contents);
2994 	rw_exit(&ufsvfsp->vfs_dqrwlock);
2995 
2996 	/*
2997 	 * If vnode is a device return special vnode instead.
2998 	 */
2999 	if (!error && IS_DEVVP(*vpp)) {
3000 		struct vnode *newvp;
3001 
3002 		newvp = specvp(*vpp, (*vpp)->v_rdev, (*vpp)->v_type, cr);
3003 		VN_RELE(*vpp);
3004 		if (newvp == NULL) {
3005 			error = ENOSYS;
3006 			goto unlock;
3007 		}
3008 		truncflag = 0;
3009 		*vpp = newvp;
3010 	}
3011 unlock:
3012 
3013 	/*
3014 	 * Do the deferred update of the parent directory's sequence
3015 	 * number now.
3016 	 */
3017 	if (defer_dip_seq_update == 1) {
3018 		rw_enter(&dip->i_contents, RW_READER);
3019 		mutex_enter(&dip->i_tlock);
3020 		dip->i_seq++;
3021 		mutex_exit(&dip->i_tlock);
3022 		rw_exit(&dip->i_contents);
3023 	}
3024 
3025 	if (ulp) {
3026 		int terr = 0;
3027 
3028 		TRANS_END_CSYNC(ufsvfsp, terr, issync, TOP_CREATE,
3029 		    trans_size);
3030 
3031 		/*
3032 		 * If we haven't had a more interesting failure
3033 		 * already, then anything that might've happened
3034 		 * here should be reported.
3035 		 */
3036 		if (error == 0)
3037 			error = terr;
3038 	}
3039 
3040 	if (!error && truncflag) {
3041 		rw_enter(&ip->i_rwlock, RW_WRITER);
3042 		(void) TRANS_ITRUNC(ip, (u_offset_t)0, 0, cr);
3043 		rw_exit(&ip->i_rwlock);
3044 	}
3045 
3046 	if (ulp)
3047 		ufs_lockfs_end(ulp);
3048 
3049 	/*
3050 	 * If no inodes available, try to free one up out of the
3051 	 * pending delete queue.
3052 	 */
3053 	if ((error == ENOSPC) && retry && TRANS_ISTRANS(ufsvfsp)) {
3054 		ufs_delete_drain_wait(ufsvfsp, 1);
3055 		retry = 0;
3056 		goto again;
3057 	}
3058 
3059 out:
3060 	TRACE_3(TR_FAC_UFS, TR_UFS_CREATE_END,
3061 		"ufs_create_end:dvp %p name %s error %d", vpp, name, error);
3062 	return (error);
3063 }
3064 
3065 extern int ufs_idle_max;
3066 /*ARGSUSED*/
3067 static int
3068 ufs_remove(struct vnode *vp, char *nm, struct cred *cr)
3069 {
3070 	struct inode *ip = VTOI(vp);
3071 	struct ufsvfs *ufsvfsp	= ip->i_ufsvfs;
3072 	struct ulockfs *ulp;
3073 	vnode_t *rmvp = NULL;	/* Vnode corresponding to name being removed */
3074 	int error;
3075 	int issync;
3076 	int trans_size;
3077 
3078 	TRACE_1(TR_FAC_UFS, TR_UFS_REMOVE_START,
3079 		"ufs_remove_start:vp %p", vp);
3080 
3081 	/*
3082 	 * don't let the delete queue get too long
3083 	 */
3084 	if (ufsvfsp == NULL) {
3085 		error = EIO;
3086 		goto out;
3087 	}
3088 	if (ufsvfsp->vfs_delete.uq_ne > ufs_idle_max)
3089 		ufs_delete_drain(vp->v_vfsp, 1, 1);
3090 
3091 	error = ufs_lockfs_begin(ufsvfsp, &ulp, ULOCKFS_REMOVE_MASK);
3092 	if (error)
3093 		goto out;
3094 
3095 	if (ulp)
3096 		TRANS_BEGIN_CSYNC(ufsvfsp, issync, TOP_REMOVE,
3097 		    trans_size = (int)TOP_REMOVE_SIZE(VTOI(vp)));
3098 
3099 	rw_enter(&ip->i_rwlock, RW_WRITER);
3100 	error = ufs_dirremove(ip, nm, (struct inode *)0, (struct vnode *)0,
3101 	    DR_REMOVE, cr, &rmvp);
3102 	rw_exit(&ip->i_rwlock);
3103 
3104 	if (ulp) {
3105 		TRANS_END_CSYNC(ufsvfsp, error, issync, TOP_REMOVE, trans_size);
3106 		ufs_lockfs_end(ulp);
3107 	}
3108 
3109 	/*
3110 	 * This must be called after the remove transaction is closed.
3111 	 */
3112 	if (rmvp != NULL) {
3113 		/* Only send the event if there were no errors */
3114 		if (error == 0)
3115 			vnevent_remove(rmvp);
3116 		VN_RELE(rmvp);
3117 	}
3118 out:
3119 	TRACE_3(TR_FAC_UFS, TR_UFS_REMOVE_END,
3120 		"ufs_remove_end:vp %p name %s error %d", vp, nm, error);
3121 	return (error);
3122 }
3123 
3124 /*
3125  * Link a file or a directory.  Only privileged processes are allowed to
3126  * make links to directories.
3127  */
3128 static int
3129 ufs_link(struct vnode *tdvp, struct vnode *svp, char *tnm, struct cred *cr)
3130 {
3131 	struct inode *sip;
3132 	struct inode *tdp = VTOI(tdvp);
3133 	struct ufsvfs *ufsvfsp = tdp->i_ufsvfs;
3134 	struct ulockfs *ulp;
3135 	struct vnode *realvp;
3136 	int error;
3137 	int issync;
3138 	int trans_size;
3139 	int isdev;
3140 
3141 	TRACE_1(TR_FAC_UFS, TR_UFS_LINK_START,
3142 		"ufs_link_start:tdvp %p", tdvp);
3143 
3144 	error = ufs_lockfs_begin(ufsvfsp, &ulp, ULOCKFS_LINK_MASK);
3145 	if (error)
3146 		goto out;
3147 
3148 	if (ulp)
3149 		TRANS_BEGIN_CSYNC(ufsvfsp, issync, TOP_LINK,
3150 		    trans_size = (int)TOP_LINK_SIZE(VTOI(tdvp)));
3151 
3152 	if (VOP_REALVP(svp, &realvp) == 0)
3153 		svp = realvp;
3154 
3155 	/*
3156 	 * Make sure link for extended attributes is valid
3157 	 * We only support hard linking of attr in ATTRDIR to ATTRDIR
3158 	 *
3159 	 * Make certain we don't attempt to look at a device node as
3160 	 * a ufs inode.
3161 	 */
3162 
3163 	isdev = IS_DEVVP(svp);
3164 	if (((isdev == 0) && ((VTOI(svp)->i_cflags & IXATTR) == 0) &&
3165 	    ((tdp->i_mode & IFMT) == IFATTRDIR)) ||
3166 	    ((isdev == 0) && (VTOI(svp)->i_cflags & IXATTR) &&
3167 	    ((tdp->i_mode & IFMT) == IFDIR))) {
3168 		error = EINVAL;
3169 		goto unlock;
3170 	}
3171 
3172 	sip = VTOI(svp);
3173 	if ((svp->v_type == VDIR &&
3174 	    secpolicy_fs_linkdir(cr, ufsvfsp->vfs_vfs) != 0) ||
3175 	    (sip->i_uid != crgetuid(cr) && secpolicy_basic_link(cr) != 0)) {
3176 		error = EPERM;
3177 		goto unlock;
3178 	}
3179 	rw_enter(&tdp->i_rwlock, RW_WRITER);
3180 	error = ufs_direnter_lr(tdp, tnm, DE_LINK, (struct inode *)0,
3181 	    sip, cr, NULL);
3182 	rw_exit(&tdp->i_rwlock);
3183 
3184 unlock:
3185 	if (ulp) {
3186 		TRANS_END_CSYNC(ufsvfsp, error, issync, TOP_LINK, trans_size);
3187 		ufs_lockfs_end(ulp);
3188 	}
3189 out:
3190 	TRACE_2(TR_FAC_UFS, TR_UFS_LINK_END,
3191 		"ufs_link_end:tdvp %p error %d", tdvp, error);
3192 	return (error);
3193 }
3194 
3195 uint64_t ufs_rename_retry_cnt;
3196 uint64_t ufs_rename_upgrade_retry_cnt;
3197 uint64_t ufs_rename_dircheck_retry_cnt;
3198 clock_t	 ufs_rename_backoff_delay = 1;
3199 
3200 /*
3201  * Rename a file or directory.
3202  * We are given the vnode and entry string of the source and the
3203  * vnode and entry string of the place we want to move the source
3204  * to (the target). The essential operation is:
3205  *	unlink(target);
3206  *	link(source, target);
3207  *	unlink(source);
3208  * but "atomically".  Can't do full commit without saving state in
3209  * the inode on disk, which isn't feasible at this time.  Best we
3210  * can do is always guarantee that the TARGET exists.
3211  */
3212 
3213 /*ARGSUSED*/
3214 static int
3215 ufs_rename(
3216 	struct vnode *sdvp,		/* old (source) parent vnode */
3217 	char *snm,			/* old (source) entry name */
3218 	struct vnode *tdvp,		/* new (target) parent vnode */
3219 	char *tnm,			/* new (target) entry name */
3220 	struct cred *cr)
3221 {
3222 	struct inode *sip = NULL;	/* source inode */
3223 	struct inode *ip = NULL;	/* check inode */
3224 	struct inode *sdp;		/* old (source) parent inode */
3225 	struct inode *tdp;		/* new (target) parent inode */
3226 	struct vnode *tvp = NULL;	/* target vnode, if it exists */
3227 	struct vnode *realvp;
3228 	struct ufsvfs *ufsvfsp;
3229 	struct ulockfs *ulp;
3230 	struct slot slot;
3231 	timestruc_t now;
3232 	int error;
3233 	int issync;
3234 	int trans_size;
3235 
3236 	TRACE_1(TR_FAC_UFS, TR_UFS_RENAME_START,
3237 		"ufs_rename_start:sdvp %p", sdvp);
3238 
3239 
3240 	sdp = VTOI(sdvp);
3241 	slot.fbp = NULL;
3242 	ufsvfsp = sdp->i_ufsvfs;
3243 	error = ufs_lockfs_begin(ufsvfsp, &ulp, ULOCKFS_RENAME_MASK);
3244 	if (error)
3245 		goto out;
3246 
3247 	if (ulp)
3248 		TRANS_BEGIN_CSYNC(ufsvfsp, issync, TOP_RENAME,
3249 		    trans_size = (int)TOP_RENAME_SIZE(sdp));
3250 
3251 	if (VOP_REALVP(tdvp, &realvp) == 0)
3252 		tdvp = realvp;
3253 
3254 	tdp = VTOI(tdvp);
3255 
3256 
3257 	/*
3258 	 * We only allow renaming of attributes from ATTRDIR to ATTRDIR.
3259 	 */
3260 	if ((tdp->i_mode & IFMT) != (sdp->i_mode & IFMT)) {
3261 		error = EINVAL;
3262 		goto unlock;
3263 	}
3264 
3265 	/*
3266 	 * Look up inode of file we're supposed to rename.
3267 	 */
3268 	gethrestime(&now);
3269 	if (error = ufs_dirlook(sdp, snm, &sip, cr, 0)) {
3270 		goto unlock;
3271 	}
3272 
3273 	/*
3274 	 * Lock both the source and target directories (they may be
3275 	 * the same) to provide the atomicity semantics that was
3276 	 * previously provided by the per file system vfs_rename_lock
3277 	 *
3278 	 * with vfs_rename_lock removed to allow simultaneous renames
3279 	 * within a file system, ufs_dircheckpath can deadlock while
3280 	 * traversing back to ensure that source is not a parent directory
3281 	 * of target parent directory. This is because we get into
3282 	 * ufs_dircheckpath with the sdp and tdp locks held as RW_WRITER.
3283 	 * If the tdp and sdp of the simultaneous renames happen to be
3284 	 * in the path of each other, it can lead to a deadlock. This
3285 	 * can be avoided by getting the locks as RW_READER here and then
3286 	 * upgrading to RW_WRITER after completing the ufs_dircheckpath.
3287 	 */
3288 retry:
3289 	rw_enter(&tdp->i_rwlock, RW_READER);
3290 	if (tdp != sdp) {
3291 		/*
3292 		 * We're locking 2 peer level locks, so must use tryenter
3293 		 * on the 2nd to avoid deadlocks that would occur
3294 		 * if we renamed a->b and b->a concurrently.
3295 		 */
3296 		if (!rw_tryenter(&sdp->i_rwlock, RW_READER)) {
3297 			/*
3298 			 * Reverse the lock grabs in case we have heavy
3299 			 * contention on the 2nd lock.
3300 			 */
3301 			rw_exit(&tdp->i_rwlock);
3302 			rw_enter(&sdp->i_rwlock, RW_READER);
3303 			if (!rw_tryenter(&tdp->i_rwlock, RW_READER)) {
3304 				ufs_rename_retry_cnt++;
3305 				rw_exit(&sdp->i_rwlock);
3306 				goto retry;
3307 			}
3308 		}
3309 	}
3310 
3311 	if (sip == tdp) {
3312 		error = EINVAL;
3313 		goto errout;
3314 	}
3315 	/*
3316 	 * Make sure we can delete the source entry.  This requires
3317 	 * write permission on the containing directory.
3318 	 * Check for sticky directories.
3319 	 */
3320 	rw_enter(&sdp->i_contents, RW_READER);
3321 	rw_enter(&sip->i_contents, RW_READER);
3322 	if ((error = ufs_iaccess(sdp, IWRITE, cr)) != 0 ||
3323 	    (error = ufs_sticky_remove_access(sdp, sip, cr)) != 0) {
3324 		rw_exit(&sip->i_contents);
3325 		rw_exit(&sdp->i_contents);
3326 		goto errout;
3327 	}
3328 
3329 	/*
3330 	 * If this is a rename of a directory and the parent is
3331 	 * different (".." must be changed), then the source
3332 	 * directory must not be in the directory hierarchy
3333 	 * above the target, as this would orphan everything
3334 	 * below the source directory.  Also the user must have
3335 	 * write permission in the source so as to be able to
3336 	 * change "..".
3337 	 */
3338 	if ((((sip->i_mode & IFMT) == IFDIR) ||
3339 	    ((sip->i_mode & IFMT) == IFATTRDIR)) && sdp != tdp) {
3340 		ino_t	inum;
3341 
3342 		if ((error = ufs_iaccess(sip, IWRITE, cr))) {
3343 			rw_exit(&sip->i_contents);
3344 			rw_exit(&sdp->i_contents);
3345 			goto errout;
3346 		}
3347 		inum = sip->i_number;
3348 		rw_exit(&sip->i_contents);
3349 		rw_exit(&sdp->i_contents);
3350 		if ((error = ufs_dircheckpath(inum, tdp, sdp, cr))) {
3351 			/*
3352 			 * If we got EAGAIN ufs_dircheckpath detected a
3353 			 * potential deadlock and backed out. We need
3354 			 * to retry the operation since sdp and tdp have
3355 			 * to be released to avoid the deadlock.
3356 			 */
3357 			if (error == EAGAIN) {
3358 				rw_exit(&tdp->i_rwlock);
3359 				if (tdp != sdp)
3360 					rw_exit(&sdp->i_rwlock);
3361 				delay(ufs_rename_backoff_delay);
3362 				ufs_rename_dircheck_retry_cnt++;
3363 				goto retry;
3364 			}
3365 			goto errout;
3366 		}
3367 	} else {
3368 		rw_exit(&sip->i_contents);
3369 		rw_exit(&sdp->i_contents);
3370 	}
3371 
3372 
3373 	/*
3374 	 * Check for renaming '.' or '..' or alias of '.'
3375 	 */
3376 	if (strcmp(snm, ".") == 0 || strcmp(snm, "..") == 0 || sdp == sip) {
3377 		error = EINVAL;
3378 		goto errout;
3379 	}
3380 
3381 	/*
3382 	 * Simultaneous renames can deadlock in ufs_dircheckpath since it
3383 	 * tries to traverse back the file tree with both tdp and sdp held
3384 	 * as RW_WRITER. To avoid that we have to hold the tdp and sdp locks
3385 	 * as RW_READERS  till ufs_dircheckpath is done.
3386 	 * Now that ufs_dircheckpath is done with, we can upgrade the locks
3387 	 * to RW_WRITER.
3388 	 */
3389 	if (!rw_tryupgrade(&tdp->i_rwlock)) {
3390 		/*
3391 		 * The upgrade failed. We got to give away the lock
3392 		 * as to avoid deadlocking with someone else who is
3393 		 * waiting for writer lock. With the lock gone, we
3394 		 * cannot be sure the checks done above will hold
3395 		 * good when we eventually get them back as writer.
3396 		 * So if we can't upgrade we drop the locks and retry
3397 		 * everything again.
3398 		 */
3399 		rw_exit(&tdp->i_rwlock);
3400 		if (tdp != sdp)
3401 			rw_exit(&sdp->i_rwlock);
3402 		delay(ufs_rename_backoff_delay);
3403 		ufs_rename_upgrade_retry_cnt++;
3404 		goto retry;
3405 	}
3406 	if (tdp != sdp) {
3407 		if (!rw_tryupgrade(&sdp->i_rwlock)) {
3408 			/*
3409 			 * The upgrade failed. We got to give away the lock
3410 			 * as to avoid deadlocking with someone else who is
3411 			 * waiting for writer lock. With the lock gone, we
3412 			 * cannot be sure the checks done above will hold
3413 			 * good when we eventually get them back as writer.
3414 			 * So if we can't upgrade we drop the locks and retry
3415 			 * everything again.
3416 			 */
3417 			rw_exit(&tdp->i_rwlock);
3418 			rw_exit(&sdp->i_rwlock);
3419 			delay(ufs_rename_backoff_delay);
3420 			ufs_rename_upgrade_retry_cnt++;
3421 			goto retry;
3422 		}
3423 	}
3424 
3425 	/*
3426 	 * Now that all the locks are held check to make sure another thread
3427 	 * didn't slip in and take out the sip.
3428 	 */
3429 	slot.status = NONE;
3430 	if ((sip->i_ctime.tv_usec * 1000) > now.tv_nsec ||
3431 	    sip->i_ctime.tv_sec > now.tv_sec) {
3432 		rw_enter(&sdp->i_ufsvfs->vfs_dqrwlock, RW_READER);
3433 		rw_enter(&sdp->i_contents, RW_WRITER);
3434 		error = ufs_dircheckforname(sdp, snm, strlen(snm), &slot,
3435 		    &ip, cr, 0);
3436 		rw_exit(&sdp->i_contents);
3437 		rw_exit(&sdp->i_ufsvfs->vfs_dqrwlock);
3438 		if (error) {
3439 			goto errout;
3440 		}
3441 		if (ip == NULL) {
3442 			error = ENOENT;
3443 			goto errout;
3444 		} else {
3445 			/*
3446 			 * If the inode was found need to drop the v_count
3447 			 * so as not to keep the filesystem from being
3448 			 * unmounted at a later time.
3449 			 */
3450 			VN_RELE(ITOV(ip));
3451 		}
3452 
3453 		/*
3454 		 * Release the slot.fbp that has the page mapped and
3455 		 * locked SE_SHARED, and could be used in in
3456 		 * ufs_direnter_lr() which needs to get the SE_EXCL lock
3457 		 * on said page.
3458 		 */
3459 		if (slot.fbp) {
3460 			fbrelse(slot.fbp, S_OTHER);
3461 			slot.fbp = NULL;
3462 		}
3463 	}
3464 
3465 	/*
3466 	 * Link source to the target.  If a target exists, return its
3467 	 * vnode pointer in tvp.  We'll release it after sending the
3468 	 * vnevent.
3469 	 */
3470 	if (error = ufs_direnter_lr(tdp, tnm, DE_RENAME, sdp, sip, cr, &tvp)) {
3471 		/*
3472 		 * ESAME isn't really an error; it indicates that the
3473 		 * operation should not be done because the source and target
3474 		 * are the same file, but that no error should be reported.
3475 		 */
3476 		if (error == ESAME)
3477 			error = 0;
3478 		goto errout;
3479 	}
3480 
3481 	/*
3482 	 * Unlink the source.
3483 	 * Remove the source entry.  ufs_dirremove() checks that the entry
3484 	 * still reflects sip, and returns an error if it doesn't.
3485 	 * If the entry has changed just forget about it.  Release
3486 	 * the source inode.
3487 	 */
3488 	if ((error = ufs_dirremove(sdp, snm, sip, (struct vnode *)0,
3489 	    DR_RENAME, cr, NULL)) == ENOENT)
3490 		error = 0;
3491 
3492 errout:
3493 	if (slot.fbp)
3494 		fbrelse(slot.fbp, S_OTHER);
3495 
3496 	rw_exit(&tdp->i_rwlock);
3497 	if (sdp != tdp) {
3498 		rw_exit(&sdp->i_rwlock);
3499 	}
3500 
3501 unlock:
3502 	if (ulp) {
3503 		TRANS_END_CSYNC(ufsvfsp, error, issync, TOP_RENAME, trans_size);
3504 		ufs_lockfs_end(ulp);
3505 	}
3506 
3507 	/*
3508 	 * If no errors, send the appropriate events on the source
3509 	 * and destination (a.k.a, target) vnodes, if they exist.
3510 	 * This has to be done after the rename transaction has closed.
3511 	 */
3512 	if (error == 0) {
3513 		if (tvp != NULL)
3514 			vnevent_rename_dest(tvp);
3515 		/*
3516 		 * Note that if ufs_direnter_lr() returned ESAME then
3517 		 * this event will still be sent.  This isn't expected
3518 		 * to be a problem for anticipated usage by consumers.
3519 		 */
3520 		if (sip != NULL)
3521 			vnevent_rename_src(ITOV(sip));
3522 	}
3523 
3524 	if (tvp != NULL)
3525 		VN_RELE(tvp);
3526 
3527 	if (sip != NULL)
3528 		VN_RELE(ITOV(sip));
3529 
3530 out:
3531 	TRACE_5(TR_FAC_UFS, TR_UFS_RENAME_END,
3532 		"ufs_rename_end:sdvp %p snm %s tdvp %p tnm %s error %d",
3533 			sdvp, snm, tdvp, tnm, error);
3534 	return (error);
3535 }
3536 
3537 /*ARGSUSED*/
3538 static int
3539 ufs_mkdir(struct vnode *dvp, char *dirname, struct vattr *vap,
3540 	struct vnode **vpp, struct cred *cr)
3541 {
3542 	struct inode *ip;
3543 	struct inode *xip;
3544 	struct ufsvfs *ufsvfsp;
3545 	struct ulockfs *ulp;
3546 	int error;
3547 	int issync;
3548 	int trans_size;
3549 	int retry = 1;
3550 
3551 	ASSERT((vap->va_mask & (AT_TYPE|AT_MODE)) == (AT_TYPE|AT_MODE));
3552 
3553 	TRACE_1(TR_FAC_UFS, TR_UFS_MKDIR_START,
3554 		"ufs_mkdir_start:dvp %p", dvp);
3555 
3556 	/*
3557 	 * Can't make directory in attr hidden dir
3558 	 */
3559 	if ((VTOI(dvp)->i_mode & IFMT) == IFATTRDIR)
3560 		return (EINVAL);
3561 
3562 again:
3563 	ip = VTOI(dvp);
3564 	ufsvfsp = ip->i_ufsvfs;
3565 	error = ufs_lockfs_begin(ufsvfsp, &ulp, ULOCKFS_MKDIR_MASK);
3566 	if (error)
3567 		goto out;
3568 	if (ulp)
3569 		TRANS_BEGIN_CSYNC(ufsvfsp, issync, TOP_MKDIR,
3570 		    trans_size = (int)TOP_MKDIR_SIZE(ip));
3571 
3572 	rw_enter(&ip->i_rwlock, RW_WRITER);
3573 
3574 	error = ufs_direnter_cm(ip, dirname, DE_MKDIR, vap, &xip, cr,
3575 		(retry ? IQUIET : 0));
3576 
3577 	rw_exit(&ip->i_rwlock);
3578 	if (error == 0) {
3579 		ip = xip;
3580 		*vpp = ITOV(ip);
3581 	} else if (error == EEXIST)
3582 		VN_RELE(ITOV(xip));
3583 
3584 	if (ulp) {
3585 		int terr = 0;
3586 		TRANS_END_CSYNC(ufsvfsp, terr, issync, TOP_MKDIR, trans_size);
3587 		ufs_lockfs_end(ulp);
3588 		if (error == 0)
3589 			error = terr;
3590 	}
3591 out:
3592 	if ((error == ENOSPC) && retry && TRANS_ISTRANS(ufsvfsp)) {
3593 		ufs_delete_drain_wait(ufsvfsp, 1);
3594 		retry = 0;
3595 		goto again;
3596 	}
3597 
3598 	TRACE_2(TR_FAC_UFS, TR_UFS_MKDIR_END,
3599 		"ufs_mkdir_end:dvp %p error %d", dvp, error);
3600 	return (error);
3601 }
3602 
3603 /*ARGSUSED*/
3604 static int
3605 ufs_rmdir(struct vnode *vp, char *nm, struct vnode *cdir, struct cred *cr)
3606 {
3607 	struct inode *ip = VTOI(vp);
3608 	struct ufsvfs *ufsvfsp = ip->i_ufsvfs;
3609 	struct ulockfs *ulp;
3610 	vnode_t *rmvp = NULL;	/* Vnode of removed directory */
3611 	int error;
3612 	int issync;
3613 
3614 	TRACE_1(TR_FAC_UFS, TR_UFS_RMDIR_START,
3615 		"ufs_rmdir_start:vp %p", vp);
3616 
3617 	/*
3618 	 * don't let the delete queue get too long
3619 	 */
3620 	if (ufsvfsp == NULL) {
3621 		error = EIO;
3622 		goto out;
3623 	}
3624 	if (ufsvfsp->vfs_delete.uq_ne > ufs_idle_max)
3625 		ufs_delete_drain(vp->v_vfsp, 1, 1);
3626 
3627 	error = ufs_lockfs_begin(ufsvfsp, &ulp, ULOCKFS_RMDIR_MASK);
3628 	if (error)
3629 		goto out;
3630 
3631 	if (ulp)
3632 		TRANS_BEGIN_CSYNC(ufsvfsp, issync, TOP_RMDIR, TOP_RMDIR_SIZE);
3633 
3634 	rw_enter(&ip->i_rwlock, RW_WRITER);
3635 	error = ufs_dirremove(ip, nm, (struct inode *)0, cdir, DR_RMDIR, cr,
3636 									&rmvp);
3637 	rw_exit(&ip->i_rwlock);
3638 
3639 	if (ulp) {
3640 		TRANS_END_CSYNC(ufsvfsp, error, issync, TOP_RMDIR,
3641 				TOP_RMDIR_SIZE);
3642 		ufs_lockfs_end(ulp);
3643 	}
3644 
3645 	/*
3646 	 * This must be done AFTER the rmdir transaction has closed.
3647 	 */
3648 	if (rmvp != NULL) {
3649 		/* Only send the event if there were no errors */
3650 		if (error == 0)
3651 			vnevent_rmdir(rmvp);
3652 		VN_RELE(rmvp);
3653 	}
3654 out:
3655 	TRACE_2(TR_FAC_UFS, TR_UFS_RMDIR_END,
3656 		"ufs_rmdir_end:vp %p error %d", vp, error);
3657 
3658 	return (error);
3659 }
3660 
3661 /* ARGSUSED */
3662 static int
3663 ufs_readdir(
3664 	struct vnode *vp,
3665 	struct uio *uiop,
3666 	struct cred *cr,
3667 	int *eofp)
3668 {
3669 	struct iovec *iovp;
3670 	struct inode *ip;
3671 	struct direct *idp;
3672 	struct dirent64 *odp;
3673 	struct fbuf *fbp;
3674 	struct ufsvfs *ufsvfsp;
3675 	struct ulockfs *ulp;
3676 	caddr_t outbuf;
3677 	size_t bufsize;
3678 	uint_t offset;
3679 	uint_t bytes_wanted, total_bytes_wanted;
3680 	int incount = 0;
3681 	int outcount = 0;
3682 	int error;
3683 
3684 	ip = VTOI(vp);
3685 	ASSERT(RW_READ_HELD(&ip->i_rwlock));
3686 
3687 	TRACE_2(TR_FAC_UFS, TR_UFS_READDIR_START,
3688 		"ufs_readdir_start:vp %p uiop %p", vp, uiop);
3689 
3690 	if (uiop->uio_loffset >= MAXOFF32_T) {
3691 		if (eofp)
3692 			*eofp = 1;
3693 		return (0);
3694 	}
3695 
3696 	/*
3697 	 * Check if we have been called with a valid iov_len
3698 	 * and bail out if not, otherwise we may potentially loop
3699 	 * forever further down.
3700 	 */
3701 	if (uiop->uio_iov->iov_len <= 0) {
3702 		error = EINVAL;
3703 		goto out;
3704 	}
3705 
3706 	/*
3707 	 * Large Files: When we come here we are guaranteed that
3708 	 * uio_offset can be used safely. The high word is zero.
3709 	 */
3710 
3711 	ufsvfsp = ip->i_ufsvfs;
3712 	error = ufs_lockfs_begin(ufsvfsp, &ulp, ULOCKFS_READDIR_MASK);
3713 	if (error)
3714 		goto out;
3715 
3716 	iovp = uiop->uio_iov;
3717 	total_bytes_wanted = iovp->iov_len;
3718 
3719 	/* Large Files: directory files should not be "large" */
3720 
3721 	ASSERT(ip->i_size <= MAXOFF32_T);
3722 
3723 	/* Force offset to be valid (to guard against bogus lseek() values) */
3724 	offset = (uint_t)uiop->uio_offset & ~(DIRBLKSIZ - 1);
3725 
3726 	/* Quit if at end of file or link count of zero (posix) */
3727 	if (offset >= (uint_t)ip->i_size || ip->i_nlink <= 0) {
3728 		if (eofp)
3729 			*eofp = 1;
3730 		error = 0;
3731 		goto unlock;
3732 	}
3733 
3734 	/*
3735 	 * Get space to change directory entries into fs independent format.
3736 	 * Do fast alloc for the most commonly used-request size (filesystem
3737 	 * block size).
3738 	 */
3739 	if (uiop->uio_segflg != UIO_SYSSPACE || uiop->uio_iovcnt != 1) {
3740 		bufsize = total_bytes_wanted;
3741 		outbuf = kmem_alloc(bufsize, KM_SLEEP);
3742 		odp = (struct dirent64 *)outbuf;
3743 	} else {
3744 		bufsize = total_bytes_wanted;
3745 		odp = (struct dirent64 *)iovp->iov_base;
3746 	}
3747 
3748 nextblk:
3749 	bytes_wanted = total_bytes_wanted;
3750 
3751 	/* Truncate request to file size */
3752 	if (offset + bytes_wanted > (int)ip->i_size)
3753 		bytes_wanted = (int)(ip->i_size - offset);
3754 
3755 	/* Comply with MAXBSIZE boundary restrictions of fbread() */
3756 	if ((offset & MAXBOFFSET) + bytes_wanted > MAXBSIZE)
3757 		bytes_wanted = MAXBSIZE - (offset & MAXBOFFSET);
3758 
3759 	/*
3760 	 * Read in the next chunk.
3761 	 * We are still holding the i_rwlock.
3762 	 */
3763 	error = fbread(vp, (offset_t)offset, bytes_wanted, S_OTHER, &fbp);
3764 
3765 	if (error)
3766 		goto update_inode;
3767 	if (!ULOCKFS_IS_NOIACC(ITOUL(ip)) && (ip->i_fs->fs_ronly == 0) &&
3768 	    (!ufsvfsp->vfs_noatime)) {
3769 		ip->i_flag |= IACC;
3770 	}
3771 	incount = 0;
3772 	idp = (struct direct *)fbp->fb_addr;
3773 	if (idp->d_ino == 0 && idp->d_reclen == 0 &&
3774 		idp->d_namlen == 0) {
3775 		cmn_err(CE_WARN, "ufs_readdir: bad dir, inumber = %llu, "
3776 			"fs = %s\n",
3777 			(u_longlong_t)ip->i_number, ufsvfsp->vfs_fs->fs_fsmnt);
3778 		fbrelse(fbp, S_OTHER);
3779 		error = ENXIO;
3780 		goto update_inode;
3781 	}
3782 	/* Transform to file-system independent format */
3783 	while (incount < bytes_wanted) {
3784 		/*
3785 		 * If the current directory entry is mangled, then skip
3786 		 * to the next block.  It would be nice to set the FSBAD
3787 		 * flag in the super-block so that a fsck is forced on
3788 		 * next reboot, but locking is a problem.
3789 		 */
3790 		if (idp->d_reclen & 0x3) {
3791 			offset = (offset + DIRBLKSIZ) & ~(DIRBLKSIZ-1);
3792 			break;
3793 		}
3794 
3795 		/* Skip to requested offset and skip empty entries */
3796 		if (idp->d_ino != 0 && offset >= (uint_t)uiop->uio_offset) {
3797 			ushort_t this_reclen =
3798 			    DIRENT64_RECLEN(idp->d_namlen);
3799 			/* Buffer too small for any entries */
3800 			if (!outcount && this_reclen > bufsize) {
3801 				fbrelse(fbp, S_OTHER);
3802 				error = EINVAL;
3803 				goto update_inode;
3804 			}
3805 			/* If would overrun the buffer, quit */
3806 			if (outcount + this_reclen > bufsize) {
3807 				break;
3808 			}
3809 			/* Take this entry */
3810 			odp->d_ino = (ino64_t)idp->d_ino;
3811 			odp->d_reclen = (ushort_t)this_reclen;
3812 			odp->d_off = (offset_t)(offset + idp->d_reclen);
3813 
3814 			/* use strncpy(9f) to zero out uninitialized bytes */
3815 
3816 			ASSERT(strlen(idp->d_name) + 1 <=
3817 			    DIRENT64_NAMELEN(this_reclen));
3818 			(void) strncpy(odp->d_name, idp->d_name,
3819 			    DIRENT64_NAMELEN(this_reclen));
3820 			outcount += odp->d_reclen;
3821 			odp = (struct dirent64 *)((intptr_t)odp +
3822 				    odp->d_reclen);
3823 			ASSERT(outcount <= bufsize);
3824 		}
3825 		if (idp->d_reclen) {
3826 			incount += idp->d_reclen;
3827 			offset += idp->d_reclen;
3828 			idp = (struct direct *)((intptr_t)idp + idp->d_reclen);
3829 		} else {
3830 			offset = (offset + DIRBLKSIZ) & ~(DIRBLKSIZ-1);
3831 			break;
3832 		}
3833 	}
3834 	/* Release the chunk */
3835 	fbrelse(fbp, S_OTHER);
3836 
3837 	/* Read whole block, but got no entries, read another if not eof */
3838 
3839 	/*
3840 	 * Large Files: casting i_size to int here is not a problem
3841 	 * because directory sizes are always less than MAXOFF32_T.
3842 	 * See assertion above.
3843 	 */
3844 
3845 	if (offset < (int)ip->i_size && !outcount)
3846 		goto nextblk;
3847 
3848 	/* Copy out the entry data */
3849 	if (uiop->uio_segflg == UIO_SYSSPACE && uiop->uio_iovcnt == 1) {
3850 		iovp->iov_base += outcount;
3851 		iovp->iov_len -= outcount;
3852 		uiop->uio_resid -= outcount;
3853 		uiop->uio_offset = offset;
3854 	} else if ((error = uiomove(outbuf, (long)outcount, UIO_READ,
3855 				    uiop)) == 0)
3856 		uiop->uio_offset = offset;
3857 update_inode:
3858 	ITIMES(ip);
3859 	if (uiop->uio_segflg != UIO_SYSSPACE || uiop->uio_iovcnt != 1)
3860 		kmem_free(outbuf, bufsize);
3861 
3862 	if (eofp && error == 0)
3863 		*eofp = (uiop->uio_offset >= (int)ip->i_size);
3864 unlock:
3865 	if (ulp) {
3866 		ufs_lockfs_end(ulp);
3867 	}
3868 out:
3869 	TRACE_2(TR_FAC_UFS, TR_UFS_READDIR_END,
3870 		"ufs_readdir_end:vp %p error %d", vp, error);
3871 	return (error);
3872 }
3873 
3874 /*ARGSUSED*/
3875 static int
3876 ufs_symlink(
3877 	struct vnode *dvp,		/* ptr to parent dir vnode */
3878 	char *linkname,			/* name of symbolic link */
3879 	struct vattr *vap,		/* attributes */
3880 	char *target,			/* target path */
3881 	struct cred *cr)		/* user credentials */
3882 {
3883 	struct inode *ip, *dip = VTOI(dvp);
3884 	struct ufsvfs *ufsvfsp = dip->i_ufsvfs;
3885 	struct ulockfs *ulp;
3886 	int error;
3887 	int issync;
3888 	int trans_size;
3889 	int residual;
3890 	int ioflag;
3891 	int retry = 1;
3892 
3893 	TRACE_1(TR_FAC_UFS, TR_UFS_SYMLINK_START,
3894 		"ufs_symlink_start:dvp %p", dvp);
3895 
3896 	/*
3897 	 * No symlinks in attrdirs at this time
3898 	 */
3899 	if ((VTOI(dvp)->i_mode & IFMT) == IFATTRDIR)
3900 		return (EINVAL);
3901 
3902 again:
3903 	ip = (struct inode *)NULL;
3904 	vap->va_type = VLNK;
3905 	vap->va_rdev = 0;
3906 
3907 	error = ufs_lockfs_begin(ufsvfsp, &ulp, ULOCKFS_SYMLINK_MASK);
3908 	if (error)
3909 		goto out;
3910 
3911 	if (ulp)
3912 		TRANS_BEGIN_CSYNC(ufsvfsp, issync, TOP_SYMLINK,
3913 		    trans_size = (int)TOP_SYMLINK_SIZE(dip));
3914 
3915 	/*
3916 	 * We must create the inode before the directory entry, to avoid
3917 	 * racing with readlink().  ufs_dirmakeinode requires that we
3918 	 * hold the quota lock as reader, and directory locks as writer.
3919 	 */
3920 
3921 	rw_enter(&dip->i_rwlock, RW_WRITER);
3922 	rw_enter(&ufsvfsp->vfs_dqrwlock, RW_READER);
3923 	rw_enter(&dip->i_contents, RW_WRITER);
3924 
3925 	/*
3926 	 * Suppress any out of inodes messages if we will retry on
3927 	 * ENOSP
3928 	 */
3929 	if (retry)
3930 		dip->i_flag |= IQUIET;
3931 
3932 	error = ufs_dirmakeinode(dip, &ip, vap, DE_SYMLINK, cr);
3933 
3934 	dip->i_flag &= ~IQUIET;
3935 
3936 	rw_exit(&dip->i_contents);
3937 	rw_exit(&ufsvfsp->vfs_dqrwlock);
3938 	rw_exit(&dip->i_rwlock);
3939 
3940 	if (error)
3941 		goto unlock;
3942 
3943 	/*
3944 	 * OK.  The inode has been created.  Write out the data of the
3945 	 * symbolic link.  Since symbolic links are metadata, and should
3946 	 * remain consistent across a system crash, we need to force the
3947 	 * data out synchronously.
3948 	 *
3949 	 * (This is a change from the semantics in earlier releases, which
3950 	 * only created symbolic links synchronously if the semi-documented
3951 	 * 'syncdir' option was set, or if we were being invoked by the NFS
3952 	 * server, which requires symbolic links to be created synchronously.)
3953 	 *
3954 	 * We need to pass in a pointer for the residual length; otherwise
3955 	 * ufs_rdwri() will always return EIO if it can't write the data,
3956 	 * even if the error was really ENOSPC or EDQUOT.
3957 	 */
3958 
3959 	ioflag = FWRITE | FDSYNC;
3960 	residual = 0;
3961 
3962 	rw_enter(&ufsvfsp->vfs_dqrwlock, RW_READER);
3963 	rw_enter(&ip->i_contents, RW_WRITER);
3964 
3965 	/*
3966 	 * Suppress file system full messages if we will retry
3967 	 */
3968 	if (retry)
3969 		ip->i_flag |= IQUIET;
3970 
3971 	error = ufs_rdwri(UIO_WRITE, ioflag, ip, target, strlen(target),
3972 	    (offset_t)0, UIO_SYSSPACE, &residual, cr);
3973 
3974 	ip->i_flag &= ~IQUIET;
3975 
3976 	if (error) {
3977 		rw_exit(&ip->i_contents);
3978 		rw_exit(&ufsvfsp->vfs_dqrwlock);
3979 		goto remove;
3980 	}
3981 
3982 	/*
3983 	 * If the link's data is small enough, we can cache it in the inode.
3984 	 * This is a "fast symbolic link".  We don't use the first direct
3985 	 * block because that's actually used to point at the symbolic link's
3986 	 * contents on disk; but we know that none of the other direct or
3987 	 * indirect blocks can be used because symbolic links are restricted
3988 	 * to be smaller than a file system block.
3989 	 */
3990 
3991 	ASSERT(MAXPATHLEN <= VBSIZE(ITOV(ip)));
3992 
3993 	if (ip->i_size > 0 && ip->i_size <= FSL_SIZE) {
3994 		if (kcopy(target, &ip->i_db[1], ip->i_size) == 0) {
3995 			ip->i_flag |= IFASTSYMLNK;
3996 		} else {
3997 			int i;
3998 			/* error, clear garbage left behind */
3999 			for (i = 1; i < NDADDR; i++)
4000 				ip->i_db[i] = 0;
4001 			for (i = 0; i < NIADDR; i++)
4002 				ip->i_ib[i] = 0;
4003 		}
4004 	}
4005 
4006 	rw_exit(&ip->i_contents);
4007 	rw_exit(&ufsvfsp->vfs_dqrwlock);
4008 
4009 	/*
4010 	 * OK.  We've successfully created the symbolic link.  All that
4011 	 * remains is to insert it into the appropriate directory.
4012 	 */
4013 
4014 	rw_enter(&dip->i_rwlock, RW_WRITER);
4015 	error = ufs_direnter_lr(dip, linkname, DE_SYMLINK, NULL, ip, cr, NULL);
4016 	rw_exit(&dip->i_rwlock);
4017 
4018 	/*
4019 	 * Fall through into remove-on-error code.  We're either done, or we
4020 	 * need to remove the inode (if we couldn't insert it).
4021 	 */
4022 
4023 remove:
4024 	if (error && (ip != NULL)) {
4025 		rw_enter(&ip->i_contents, RW_WRITER);
4026 		ip->i_nlink--;
4027 		ip->i_flag |= ICHG;
4028 		ip->i_seq++;
4029 		ufs_setreclaim(ip);
4030 		rw_exit(&ip->i_contents);
4031 	}
4032 
4033 unlock:
4034 	if (ip != NULL)
4035 		VN_RELE(ITOV(ip));
4036 
4037 	if (ulp) {
4038 		int terr = 0;
4039 
4040 		TRANS_END_CSYNC(ufsvfsp, terr, issync, TOP_SYMLINK,
4041 				trans_size);
4042 		ufs_lockfs_end(ulp);
4043 		if (error == 0)
4044 			error = terr;
4045 	}
4046 
4047 	/*
4048 	 * We may have failed due to lack of an inode or of a block to
4049 	 * store the target in.  Try flushing the delete queue to free
4050 	 * logically-available things up and try again.
4051 	 */
4052 	if ((error == ENOSPC) && retry && TRANS_ISTRANS(ufsvfsp)) {
4053 		ufs_delete_drain_wait(ufsvfsp, 1);
4054 		retry = 0;
4055 		goto again;
4056 	}
4057 
4058 out:
4059 	TRACE_2(TR_FAC_UFS, TR_UFS_SYMLINK_END,
4060 		"ufs_symlink_end:dvp %p error %d", dvp, error);
4061 	return (error);
4062 }
4063 
4064 /*
4065  * Ufs specific routine used to do ufs io.
4066  */
4067 int
4068 ufs_rdwri(enum uio_rw rw, int ioflag, struct inode *ip, caddr_t base,
4069 	ssize_t len, offset_t offset, enum uio_seg seg, int *aresid,
4070 	struct cred *cr)
4071 {
4072 	struct uio auio;
4073 	struct iovec aiov;
4074 	int error;
4075 
4076 	ASSERT(RW_LOCK_HELD(&ip->i_contents));
4077 
4078 	bzero((caddr_t)&auio, sizeof (uio_t));
4079 	bzero((caddr_t)&aiov, sizeof (iovec_t));
4080 
4081 	aiov.iov_base = base;
4082 	aiov.iov_len = len;
4083 	auio.uio_iov = &aiov;
4084 	auio.uio_iovcnt = 1;
4085 	auio.uio_loffset = offset;
4086 	auio.uio_segflg = (short)seg;
4087 	auio.uio_resid = len;
4088 
4089 	if (rw == UIO_WRITE) {
4090 		auio.uio_fmode = FWRITE;
4091 		auio.uio_extflg = UIO_COPY_DEFAULT;
4092 		auio.uio_llimit = curproc->p_fsz_ctl;
4093 		error = wrip(ip, &auio, ioflag, cr);
4094 	} else {
4095 		auio.uio_fmode = FREAD;
4096 		auio.uio_extflg = UIO_COPY_CACHED;
4097 		auio.uio_llimit = MAXOFFSET_T;
4098 		error = rdip(ip, &auio, ioflag, cr);
4099 	}
4100 
4101 	if (aresid) {
4102 		*aresid = auio.uio_resid;
4103 	} else if (auio.uio_resid) {
4104 		error = EIO;
4105 	}
4106 	return (error);
4107 }
4108 
4109 static int
4110 ufs_fid(vp, fidp)
4111 	struct vnode *vp;
4112 	struct fid *fidp;
4113 {
4114 	struct ufid *ufid;
4115 	struct inode *ip = VTOI(vp);
4116 
4117 	if (ip->i_ufsvfs == NULL)
4118 		return (EIO);
4119 
4120 	if (fidp->fid_len < (sizeof (struct ufid) - sizeof (ushort_t))) {
4121 		fidp->fid_len = sizeof (struct ufid) - sizeof (ushort_t);
4122 		return (ENOSPC);
4123 	}
4124 
4125 	ufid = (struct ufid *)fidp;
4126 	bzero((char *)ufid, sizeof (struct ufid));
4127 	ufid->ufid_len = sizeof (struct ufid) - sizeof (ushort_t);
4128 	ufid->ufid_ino = ip->i_number;
4129 	ufid->ufid_gen = ip->i_gen;
4130 
4131 	return (0);
4132 }
4133 
4134 /* ARGSUSED2 */
4135 static int
4136 ufs_rwlock(struct vnode *vp, int write_lock, caller_context_t *ctp)
4137 {
4138 	struct inode	*ip = VTOI(vp);
4139 	struct ufsvfs	*ufsvfsp;
4140 	int		forcedirectio;
4141 
4142 	/*
4143 	 * Read case is easy.
4144 	 */
4145 	if (!write_lock) {
4146 		rw_enter(&ip->i_rwlock, RW_READER);
4147 		return (V_WRITELOCK_FALSE);
4148 	}
4149 
4150 	/*
4151 	 * Caller has requested a writer lock, but that inhibits any
4152 	 * concurrency in the VOPs that follow. Acquire the lock shared
4153 	 * and defer exclusive access until it is known to be needed in
4154 	 * other VOP handlers. Some cases can be determined here.
4155 	 */
4156 
4157 	/*
4158 	 * If directio is not set, there is no chance of concurrency,
4159 	 * so just acquire the lock exclusive. Beware of a forced
4160 	 * unmount before looking at the mount option.
4161 	 */
4162 	ufsvfsp = ip->i_ufsvfs;
4163 	forcedirectio = ufsvfsp ? ufsvfsp->vfs_forcedirectio : 0;
4164 	if (!(ip->i_flag & IDIRECTIO || forcedirectio) ||
4165 	    !ufs_allow_shared_writes) {
4166 		rw_enter(&ip->i_rwlock, RW_WRITER);
4167 		return (V_WRITELOCK_TRUE);
4168 	}
4169 
4170 	/*
4171 	 * Mandatory locking forces acquiring i_rwlock exclusive.
4172 	 */
4173 	if (MANDLOCK(vp, ip->i_mode)) {
4174 		rw_enter(&ip->i_rwlock, RW_WRITER);
4175 		return (V_WRITELOCK_TRUE);
4176 	}
4177 
4178 	/*
4179 	 * Acquire the lock shared in case a concurrent write follows.
4180 	 * Mandatory locking could have become enabled before the lock
4181 	 * was acquired. Re-check and upgrade if needed.
4182 	 */
4183 	rw_enter(&ip->i_rwlock, RW_READER);
4184 	if (MANDLOCK(vp, ip->i_mode)) {
4185 		rw_exit(&ip->i_rwlock);
4186 		rw_enter(&ip->i_rwlock, RW_WRITER);
4187 		return (V_WRITELOCK_TRUE);
4188 	}
4189 	return (V_WRITELOCK_FALSE);
4190 }
4191 
4192 /*ARGSUSED*/
4193 static void
4194 ufs_rwunlock(struct vnode *vp, int write_lock, caller_context_t *ctp)
4195 {
4196 	struct inode	*ip = VTOI(vp);
4197 
4198 	rw_exit(&ip->i_rwlock);
4199 }
4200 
4201 /* ARGSUSED */
4202 static int
4203 ufs_seek(struct vnode *vp, offset_t ooff, offset_t *noffp)
4204 {
4205 	return ((*noffp < 0 || *noffp > MAXOFFSET_T) ? EINVAL : 0);
4206 }
4207 
4208 /* ARGSUSED */
4209 static int
4210 ufs_frlock(struct vnode *vp, int cmd, struct flock64 *bfp, int flag,
4211 	offset_t offset, struct flk_callback *flk_cbp, struct cred *cr)
4212 {
4213 	struct inode *ip = VTOI(vp);
4214 
4215 	if (ip->i_ufsvfs == NULL)
4216 		return (EIO);
4217 
4218 	/*
4219 	 * If file is being mapped, disallow frlock.
4220 	 * XXX I am not holding tlock while checking i_mapcnt because the
4221 	 * current locking strategy drops all locks before calling fs_frlock.
4222 	 * So, mapcnt could change before we enter fs_frlock making is
4223 	 * meaningless to have held tlock in the first place.
4224 	 */
4225 	if (ip->i_mapcnt > 0 && MANDLOCK(vp, ip->i_mode))
4226 		return (EAGAIN);
4227 	return (fs_frlock(vp, cmd, bfp, flag, offset, flk_cbp, cr));
4228 }
4229 
4230 /* ARGSUSED */
4231 static int
4232 ufs_space(struct vnode *vp, int cmd, struct flock64 *bfp, int flag,
4233 	offset_t offset, cred_t *cr, caller_context_t *ct)
4234 {
4235 	struct ufsvfs *ufsvfsp = VTOI(vp)->i_ufsvfs;
4236 	struct ulockfs *ulp;
4237 	int error;
4238 
4239 	if ((error = convoff(vp, bfp, 0, offset)) == 0) {
4240 		if (cmd == F_FREESP) {
4241 			error = ufs_lockfs_begin(ufsvfsp, &ulp,
4242 			    ULOCKFS_SPACE_MASK);
4243 			if (error)
4244 				return (error);
4245 			error = ufs_freesp(vp, bfp, flag, cr);
4246 		} else if (cmd == F_ALLOCSP) {
4247 			error = ufs_lockfs_begin(ufsvfsp, &ulp,
4248 			    ULOCKFS_FALLOCATE_MASK);
4249 			if (error)
4250 				return (error);
4251 			error = ufs_allocsp(vp, bfp, cr);
4252 		} else
4253 			return (EINVAL); /* Command not handled here */
4254 
4255 		if (ulp)
4256 			ufs_lockfs_end(ulp);
4257 
4258 	}
4259 	return (error);
4260 }
4261 
4262 /*
4263  * Used to determine if read ahead should be done. Also used to
4264  * to determine when write back occurs.
4265  */
4266 #define	CLUSTSZ(ip)		((ip)->i_ufsvfs->vfs_ioclustsz)
4267 
4268 /*
4269  * A faster version of ufs_getpage.
4270  *
4271  * We optimize by inlining the pvn_getpages iterator, eliminating
4272  * calls to bmap_read if file doesn't have UFS holes, and avoiding
4273  * the overhead of page_exists().
4274  *
4275  * When files has UFS_HOLES and ufs_getpage is called with S_READ,
4276  * we set *protp to PROT_READ to avoid calling bmap_read. This approach
4277  * victimizes performance when a file with UFS holes is faulted
4278  * first in the S_READ mode, and then in the S_WRITE mode. We will get
4279  * two MMU faults in this case.
4280  *
4281  * XXX - the inode fields which control the sequential mode are not
4282  *	 protected by any mutex. The read ahead will act wild if
4283  *	 multiple processes will access the file concurrently and
4284  *	 some of them in sequential mode. One particulary bad case
4285  *	 is if another thread will change the value of i_nextrio between
4286  *	 the time this thread tests the i_nextrio value and then reads it
4287  *	 again to use it as the offset for the read ahead.
4288  */
4289 static int
4290 ufs_getpage(struct vnode *vp, offset_t off, size_t len, uint_t *protp,
4291 	page_t *plarr[], size_t plsz, struct seg *seg, caddr_t addr,
4292 	enum seg_rw rw, struct cred *cr)
4293 {
4294 	u_offset_t	uoff = (u_offset_t)off; /* type conversion */
4295 	u_offset_t	pgoff;
4296 	u_offset_t	eoff;
4297 	struct inode 	*ip = VTOI(vp);
4298 	struct ufsvfs	*ufsvfsp = ip->i_ufsvfs;
4299 	struct fs 	*fs;
4300 	struct ulockfs	*ulp;
4301 	page_t		**pl;
4302 	caddr_t		pgaddr;
4303 	krw_t		rwtype;
4304 	int 		err;
4305 	int		has_holes;
4306 	int		beyond_eof;
4307 	int		seqmode;
4308 	int		pgsize = PAGESIZE;
4309 	int		dolock;
4310 	int		do_qlock;
4311 	int		trans_size;
4312 
4313 	TRACE_1(TR_FAC_UFS, TR_UFS_GETPAGE_START,
4314 		"ufs_getpage_start:vp %p", vp);
4315 
4316 	ASSERT((uoff & PAGEOFFSET) == 0);
4317 
4318 	if (protp)
4319 		*protp = PROT_ALL;
4320 
4321 	/*
4322 	 * Obey the lockfs protocol
4323 	 */
4324 	err = ufs_lockfs_begin_getpage(ufsvfsp, &ulp, seg,
4325 			rw == S_READ || rw == S_EXEC, protp);
4326 	if (err)
4327 		goto out;
4328 
4329 	fs = ufsvfsp->vfs_fs;
4330 
4331 	if (ulp && (rw == S_CREATE || rw == S_WRITE) &&
4332 	    !(vp->v_flag & VISSWAP)) {
4333 		/*
4334 		 * Try to start a transaction, will return if blocking is
4335 		 * expected to occur and the address space is not the
4336 		 * kernel address space.
4337 		 */
4338 		trans_size = TOP_GETPAGE_SIZE(ip);
4339 		if (seg->s_as != &kas) {
4340 			TRANS_TRY_BEGIN_ASYNC(ufsvfsp, TOP_GETPAGE,
4341 				trans_size, err)
4342 			if (err == EWOULDBLOCK) {
4343 				/*
4344 				 * Use EDEADLK here because the VM code
4345 				 * can normally never see this error.
4346 				 */
4347 				err = EDEADLK;
4348 				ufs_lockfs_end(ulp);
4349 				goto out;
4350 			}
4351 		} else {
4352 			TRANS_BEGIN_ASYNC(ufsvfsp, TOP_GETPAGE, trans_size);
4353 		}
4354 	}
4355 
4356 	if (vp->v_flag & VNOMAP) {
4357 		err = ENOSYS;
4358 		goto unlock;
4359 	}
4360 
4361 	seqmode = ip->i_nextr == uoff && rw != S_CREATE;
4362 
4363 	rwtype = RW_READER;		/* start as a reader */
4364 	dolock = (rw_owner(&ip->i_contents) != curthread);
4365 	/*
4366 	 * If this thread owns the lock, i.e., this thread grabbed it
4367 	 * as writer somewhere above, then we don't need to grab the
4368 	 * lock as reader in this routine.
4369 	 */
4370 	do_qlock = (rw_owner(&ufsvfsp->vfs_dqrwlock) != curthread);
4371 
4372 retrylock:
4373 	if (dolock) {
4374 		/*
4375 		 * Grab the quota lock if we need to call
4376 		 * bmap_write() below (with i_contents as writer).
4377 		 */
4378 		if (do_qlock && rwtype == RW_WRITER)
4379 			rw_enter(&ufsvfsp->vfs_dqrwlock, RW_READER);
4380 		rw_enter(&ip->i_contents, rwtype);
4381 	}
4382 
4383 	/*
4384 	 * We may be getting called as a side effect of a bmap using
4385 	 * fbread() when the blocks might be being allocated and the
4386 	 * size has not yet been up'ed.  In this case we want to be
4387 	 * able to return zero pages if we get back UFS_HOLE from
4388 	 * calling bmap for a non write case here.  We also might have
4389 	 * to read some frags from the disk into a page if we are
4390 	 * extending the number of frags for a given lbn in bmap().
4391 	 * Large Files: The read of i_size here is atomic because
4392 	 * i_contents is held here. If dolock is zero, the lock
4393 	 * is held in bmap routines.
4394 	 */
4395 	beyond_eof = uoff + len > ip->i_size + PAGEOFFSET;
4396 	if (beyond_eof && seg != segkmap) {
4397 		if (dolock) {
4398 			rw_exit(&ip->i_contents);
4399 			if (do_qlock && rwtype == RW_WRITER)
4400 				rw_exit(&ufsvfsp->vfs_dqrwlock);
4401 		}
4402 		err = EFAULT;
4403 		goto unlock;
4404 	}
4405 
4406 	/*
4407 	 * Must hold i_contents lock throughout the call to pvn_getpages
4408 	 * since locked pages are returned from each call to ufs_getapage.
4409 	 * Must *not* return locked pages and then try for contents lock
4410 	 * due to lock ordering requirements (inode > page)
4411 	 */
4412 
4413 	has_holes = bmap_has_holes(ip);
4414 
4415 	if ((rw == S_WRITE || rw == S_CREATE) && has_holes && !beyond_eof) {
4416 		int	blk_size;
4417 		u_offset_t offset;
4418 
4419 		/*
4420 		 * We must acquire the RW_WRITER lock in order to
4421 		 * call bmap_write().
4422 		 */
4423 		if (dolock && rwtype == RW_READER) {
4424 			rwtype = RW_WRITER;
4425 
4426 			/*
4427 			 * Grab the quota lock before
4428 			 * upgrading i_contents, but if we can't grab it
4429 			 * don't wait here due to lock order:
4430 			 * vfs_dqrwlock > i_contents.
4431 			 */
4432 			if (do_qlock && rw_tryenter(&ufsvfsp->vfs_dqrwlock,
4433 							RW_READER) == 0) {
4434 				rw_exit(&ip->i_contents);
4435 				goto retrylock;
4436 			}
4437 			if (!rw_tryupgrade(&ip->i_contents)) {
4438 				rw_exit(&ip->i_contents);
4439 				if (do_qlock)
4440 					rw_exit(&ufsvfsp->vfs_dqrwlock);
4441 				goto retrylock;
4442 			}
4443 		}
4444 
4445 		/*
4446 		 * May be allocating disk blocks for holes here as
4447 		 * a result of mmap faults. write(2) does the bmap_write
4448 		 * in rdip/wrip, not here. We are not dealing with frags
4449 		 * in this case.
4450 		 */
4451 		/*
4452 		 * Large Files: We cast fs_bmask field to offset_t
4453 		 * just as we do for MAXBMASK because uoff is a 64-bit
4454 		 * data type. fs_bmask will still be a 32-bit type
4455 		 * as we cannot change any ondisk data structures.
4456 		 */
4457 
4458 		offset = uoff & (offset_t)fs->fs_bmask;
4459 		while (offset < uoff + len) {
4460 			blk_size = (int)blksize(fs, ip, lblkno(fs, offset));
4461 			err = bmap_write(ip, offset, blk_size,
4462 			    BI_NORMAL, NULL, cr);
4463 			if (ip->i_flag & (ICHG|IUPD))
4464 				ip->i_seq++;
4465 			if (err)
4466 				goto update_inode;
4467 			offset += blk_size; /* XXX - make this contig */
4468 		}
4469 	}
4470 
4471 	/*
4472 	 * Can be a reader from now on.
4473 	 */
4474 	if (dolock && rwtype == RW_WRITER) {
4475 		rw_downgrade(&ip->i_contents);
4476 		/*
4477 		 * We can release vfs_dqrwlock early so do it, but make
4478 		 * sure we don't try to release it again at the bottom.
4479 		 */
4480 		if (do_qlock) {
4481 			rw_exit(&ufsvfsp->vfs_dqrwlock);
4482 			do_qlock = 0;
4483 		}
4484 	}
4485 
4486 	/*
4487 	 * We remove PROT_WRITE in cases when the file has UFS holes
4488 	 * because we don't  want to call bmap_read() to check each
4489 	 * page if it is backed with a disk block.
4490 	 */
4491 	if (protp && has_holes && rw != S_WRITE && rw != S_CREATE)
4492 		*protp &= ~PROT_WRITE;
4493 
4494 	err = 0;
4495 
4496 	/*
4497 	 * The loop looks up pages in the range [off, off + len).
4498 	 * For each page, we first check if we should initiate an asynchronous
4499 	 * read ahead before we call page_lookup (we may sleep in page_lookup
4500 	 * for a previously initiated disk read).
4501 	 */
4502 	eoff = (uoff + len);
4503 	for (pgoff = uoff, pgaddr = addr, pl = plarr;
4504 	    pgoff < eoff; /* empty */) {
4505 		page_t	*pp;
4506 		u_offset_t	nextrio;
4507 		se_t	se;
4508 		int retval;
4509 
4510 		se = ((rw == S_CREATE || rw == S_OTHER) ? SE_EXCL : SE_SHARED);
4511 
4512 		/* Handle async getpage (faultahead) */
4513 		if (plarr == NULL) {
4514 			ip->i_nextrio = pgoff;
4515 			(void) ufs_getpage_ra(vp, pgoff, seg, pgaddr);
4516 			pgoff += pgsize;
4517 			pgaddr += pgsize;
4518 			continue;
4519 		}
4520 		/*
4521 		 * Check if we should initiate read ahead of next cluster.
4522 		 * We call page_exists only when we need to confirm that
4523 		 * we have the current page before we initiate the read ahead.
4524 		 */
4525 		nextrio = ip->i_nextrio;
4526 		if (seqmode &&
4527 		    pgoff + CLUSTSZ(ip) >= nextrio && pgoff <= nextrio &&
4528 		    nextrio < ip->i_size && page_exists(vp, pgoff)) {
4529 			retval = ufs_getpage_ra(vp, pgoff, seg, pgaddr);
4530 			/*
4531 			 * We always read ahead the next cluster of data
4532 			 * starting from i_nextrio. If the page (vp,nextrio)
4533 			 * is actually in core at this point, the routine
4534 			 * ufs_getpage_ra() will stop pre-fetching data
4535 			 * until we read that page in a synchronized manner
4536 			 * through ufs_getpage_miss(). So, we should increase
4537 			 * i_nextrio if the page (vp, nextrio) exists.
4538 			 */
4539 			if ((retval == 0) && page_exists(vp, nextrio)) {
4540 				ip->i_nextrio = nextrio + pgsize;
4541 			}
4542 		}
4543 
4544 		if ((pp = page_lookup(vp, pgoff, se)) != NULL) {
4545 			/*
4546 			 * We found the page in the page cache.
4547 			 */
4548 			*pl++ = pp;
4549 			pgoff += pgsize;
4550 			pgaddr += pgsize;
4551 			len -= pgsize;
4552 			plsz -= pgsize;
4553 		} else  {
4554 			/*
4555 			 * We have to create the page, or read it from disk.
4556 			 */
4557 			if (err = ufs_getpage_miss(vp, pgoff, len, seg, pgaddr,
4558 			    pl, plsz, rw, seqmode))
4559 				goto error;
4560 
4561 			while (*pl != NULL) {
4562 				pl++;
4563 				pgoff += pgsize;
4564 				pgaddr += pgsize;
4565 				len -= pgsize;
4566 				plsz -= pgsize;
4567 			}
4568 		}
4569 	}
4570 
4571 	/*
4572 	 * Return pages up to plsz if they are in the page cache.
4573 	 * We cannot return pages if there is a chance that they are
4574 	 * backed with a UFS hole and rw is S_WRITE or S_CREATE.
4575 	 */
4576 	if (plarr && !(has_holes && (rw == S_WRITE || rw == S_CREATE))) {
4577 
4578 		ASSERT((protp == NULL) ||
4579 			!(has_holes && (*protp & PROT_WRITE)));
4580 
4581 		eoff = pgoff + plsz;
4582 		while (pgoff < eoff) {
4583 			page_t		*pp;
4584 
4585 			if ((pp = page_lookup_nowait(vp, pgoff,
4586 			    SE_SHARED)) == NULL)
4587 				break;
4588 
4589 			*pl++ = pp;
4590 			pgoff += pgsize;
4591 			plsz -= pgsize;
4592 		}
4593 	}
4594 
4595 	if (plarr)
4596 		*pl = NULL;			/* Terminate page list */
4597 	ip->i_nextr = pgoff;
4598 
4599 error:
4600 	if (err && plarr) {
4601 		/*
4602 		 * Release any pages we have locked.
4603 		 */
4604 		while (pl > &plarr[0])
4605 			page_unlock(*--pl);
4606 
4607 		plarr[0] = NULL;
4608 	}
4609 
4610 update_inode:
4611 	/*
4612 	 * If the inode is not already marked for IACC (in rdip() for read)
4613 	 * and the inode is not marked for no access time update (in wrip()
4614 	 * for write) then update the inode access time and mod time now.
4615 	 */
4616 	if ((ip->i_flag & (IACC | INOACC)) == 0) {
4617 		if ((rw != S_OTHER) && (ip->i_mode & IFMT) != IFDIR) {
4618 			if (!ULOCKFS_IS_NOIACC(ITOUL(ip)) &&
4619 			    (fs->fs_ronly == 0) &&
4620 			    (!ufsvfsp->vfs_noatime)) {
4621 				mutex_enter(&ip->i_tlock);
4622 				ip->i_flag |= IACC;
4623 				ITIMES_NOLOCK(ip);
4624 				mutex_exit(&ip->i_tlock);
4625 			}
4626 		}
4627 	}
4628 
4629 	if (dolock) {
4630 		rw_exit(&ip->i_contents);
4631 		if (do_qlock && rwtype == RW_WRITER)
4632 			rw_exit(&ufsvfsp->vfs_dqrwlock);
4633 	}
4634 
4635 unlock:
4636 	if (ulp) {
4637 		if ((rw == S_CREATE || rw == S_WRITE) &&
4638 		    !(vp->v_flag & VISSWAP)) {
4639 			TRANS_END_ASYNC(ufsvfsp, TOP_GETPAGE, trans_size);
4640 		}
4641 		ufs_lockfs_end(ulp);
4642 	}
4643 out:
4644 	TRACE_2(TR_FAC_UFS, TR_UFS_GETPAGE_END,
4645 		"ufs_getpage_end:vp %p error %d", vp, err);
4646 	return (err);
4647 }
4648 
4649 /*
4650  * ufs_getpage_miss is called when ufs_getpage missed the page in the page
4651  * cache. The page is either read from the disk, or it's created.
4652  * A page is created (without disk read) if rw == S_CREATE, or if
4653  * the page is not backed with a real disk block (UFS hole).
4654  */
4655 /* ARGSUSED */
4656 static int
4657 ufs_getpage_miss(struct vnode *vp, u_offset_t off, size_t len, struct seg *seg,
4658 	caddr_t addr, page_t *pl[], size_t plsz, enum seg_rw rw, int seq)
4659 {
4660 	struct inode	*ip = VTOI(vp);
4661 	page_t		*pp;
4662 	daddr_t		bn;
4663 	size_t		io_len;
4664 	int		crpage = 0;
4665 	int		err;
4666 	int		contig;
4667 	int		bsize = ip->i_fs->fs_bsize;
4668 
4669 	/*
4670 	 * Figure out whether the page can be created, or must be
4671 	 * must be read from the disk.
4672 	 */
4673 	if (rw == S_CREATE)
4674 		crpage = 1;
4675 	else {
4676 		contig = 0;
4677 		if (err = bmap_read(ip, off, &bn, &contig))
4678 			return (err);
4679 
4680 		crpage = (bn == UFS_HOLE);
4681 
4682 		/*
4683 		 * If its also a fallocated block that hasn't been written to
4684 		 * yet, we will treat it just like a UFS_HOLE and create
4685 		 * a zero page for it
4686 		 */
4687 		if (ISFALLOCBLK(ip, bn))
4688 			crpage = 1;
4689 	}
4690 
4691 	if (crpage) {
4692 		if ((pp = page_create_va(vp, off, PAGESIZE, PG_WAIT, seg,
4693 		    addr)) == NULL) {
4694 			return (ufs_fault(vp,
4695 				    "ufs_getpage_miss: page_create == NULL"));
4696 		}
4697 
4698 		if (rw != S_CREATE)
4699 			pagezero(pp, 0, PAGESIZE);
4700 
4701 		io_len = PAGESIZE;
4702 	} else {
4703 		u_offset_t	io_off;
4704 		uint_t	xlen;
4705 		struct buf	*bp;
4706 		ufsvfs_t	*ufsvfsp = ip->i_ufsvfs;
4707 
4708 		/*
4709 		 * If access is not in sequential order, we read from disk
4710 		 * in bsize units.
4711 		 *
4712 		 * We limit the size of the transfer to bsize if we are reading
4713 		 * from the beginning of the file. Note in this situation we
4714 		 * will hedge our bets and initiate an async read ahead of
4715 		 * the second block.
4716 		 */
4717 		if (!seq || off == 0)
4718 			contig = MIN(contig, bsize);
4719 
4720 		pp = pvn_read_kluster(vp, off, seg, addr, &io_off,
4721 		    &io_len, off, contig, 0);
4722 
4723 		/*
4724 		 * Some other thread has entered the page.
4725 		 * ufs_getpage will retry page_lookup.
4726 		 */
4727 		if (pp == NULL) {
4728 			pl[0] = NULL;
4729 			return (0);
4730 		}
4731 
4732 		/*
4733 		 * Zero part of the page which we are not
4734 		 * going to read from the disk.
4735 		 */
4736 		xlen = io_len & PAGEOFFSET;
4737 		if (xlen != 0)
4738 			pagezero(pp->p_prev, xlen, PAGESIZE - xlen);
4739 
4740 		bp = pageio_setup(pp, io_len, ip->i_devvp, B_READ);
4741 		bp->b_edev = ip->i_dev;
4742 		bp->b_dev = cmpdev(ip->i_dev);
4743 		bp->b_blkno = bn;
4744 		bp->b_un.b_addr = (caddr_t)0;
4745 		bp->b_file = ip->i_vnode;
4746 		bp->b_offset = off;
4747 
4748 		if (ufsvfsp->vfs_log) {
4749 			lufs_read_strategy(ufsvfsp->vfs_log, bp);
4750 		} else if (ufsvfsp->vfs_snapshot) {
4751 			fssnap_strategy(&ufsvfsp->vfs_snapshot, bp);
4752 		} else {
4753 			ufsvfsp->vfs_iotstamp = lbolt;
4754 			ub.ub_getpages.value.ul++;
4755 			(void) bdev_strategy(bp);
4756 			lwp_stat_update(LWP_STAT_INBLK, 1);
4757 		}
4758 
4759 		ip->i_nextrio = off + ((io_len + PAGESIZE - 1) & PAGEMASK);
4760 
4761 		/*
4762 		 * If the file access is sequential, initiate read ahead
4763 		 * of the next cluster.
4764 		 */
4765 		if (seq && ip->i_nextrio < ip->i_size)
4766 			(void) ufs_getpage_ra(vp, off, seg, addr);
4767 		err = biowait(bp);
4768 		pageio_done(bp);
4769 
4770 		if (err) {
4771 			pvn_read_done(pp, B_ERROR);
4772 			return (err);
4773 		}
4774 	}
4775 
4776 	pvn_plist_init(pp, pl, plsz, off, io_len, rw);
4777 	return (0);
4778 }
4779 
4780 /*
4781  * Read ahead a cluster from the disk. Returns the length in bytes.
4782  */
4783 static int
4784 ufs_getpage_ra(struct vnode *vp, u_offset_t off, struct seg *seg, caddr_t addr)
4785 {
4786 	struct inode	*ip = VTOI(vp);
4787 	page_t		*pp;
4788 	u_offset_t	io_off = ip->i_nextrio;
4789 	ufsvfs_t	*ufsvfsp;
4790 	caddr_t		addr2 = addr + (io_off - off);
4791 	struct buf	*bp;
4792 	daddr_t		bn;
4793 	size_t		io_len;
4794 	int		err;
4795 	int		contig;
4796 	int		xlen;
4797 	int		bsize = ip->i_fs->fs_bsize;
4798 
4799 	/*
4800 	 * If the directio advisory is in effect on this file,
4801 	 * then do not do buffered read ahead. Read ahead makes
4802 	 * it more difficult on threads using directio as they
4803 	 * will be forced to flush the pages from this vnode.
4804 	 */
4805 	if ((ufsvfsp = ip->i_ufsvfs) == NULL)
4806 		return (0);
4807 	if (ip->i_flag & IDIRECTIO || ufsvfsp->vfs_forcedirectio)
4808 		return (0);
4809 
4810 	/*
4811 	 * Is this test needed?
4812 	 */
4813 	if (addr2 >= seg->s_base + seg->s_size)
4814 		return (0);
4815 
4816 	contig = 0;
4817 	err = bmap_read(ip, io_off, &bn, &contig);
4818 	/*
4819 	 * If its a UFS_HOLE or a fallocated block, do not perform
4820 	 * any read ahead's since there probably is nothing to read ahead
4821 	 */
4822 	if (err || bn == UFS_HOLE || ISFALLOCBLK(ip, bn))
4823 		return (0);
4824 
4825 	/*
4826 	 * Limit the transfer size to bsize if this is the 2nd block.
4827 	 */
4828 	if (io_off == (u_offset_t)bsize)
4829 		contig = MIN(contig, bsize);
4830 
4831 	if ((pp = pvn_read_kluster(vp, io_off, seg, addr2, &io_off,
4832 	    &io_len, io_off, contig, 1)) == NULL)
4833 		return (0);
4834 
4835 	/*
4836 	 * Zero part of page which we are not going to read from disk
4837 	 */
4838 	if ((xlen = (io_len & PAGEOFFSET)) > 0)
4839 		pagezero(pp->p_prev, xlen, PAGESIZE - xlen);
4840 
4841 	ip->i_nextrio = (io_off + io_len + PAGESIZE - 1) & PAGEMASK;
4842 
4843 	bp = pageio_setup(pp, io_len, ip->i_devvp, B_READ | B_ASYNC);
4844 	bp->b_edev = ip->i_dev;
4845 	bp->b_dev = cmpdev(ip->i_dev);
4846 	bp->b_blkno = bn;
4847 	bp->b_un.b_addr = (caddr_t)0;
4848 	bp->b_file = ip->i_vnode;
4849 	bp->b_offset = off;
4850 
4851 	if (ufsvfsp->vfs_log) {
4852 		lufs_read_strategy(ufsvfsp->vfs_log, bp);
4853 	} else if (ufsvfsp->vfs_snapshot) {
4854 		fssnap_strategy(&ufsvfsp->vfs_snapshot, bp);
4855 	} else {
4856 		ufsvfsp->vfs_iotstamp = lbolt;
4857 		ub.ub_getras.value.ul++;
4858 		(void) bdev_strategy(bp);
4859 		lwp_stat_update(LWP_STAT_INBLK, 1);
4860 	}
4861 
4862 	return (io_len);
4863 }
4864 
4865 int	ufs_delay = 1;
4866 /*
4867  * Flags are composed of {B_INVAL, B_FREE, B_DONTNEED, B_FORCE, B_ASYNC}
4868  *
4869  * LMXXX - the inode really ought to contain a pointer to one of these
4870  * async args.  Stuff gunk in there and just hand the whole mess off.
4871  * This would replace i_delaylen, i_delayoff.
4872  */
4873 /*ARGSUSED*/
4874 static int
4875 ufs_putpage(struct vnode *vp, offset_t off, size_t len, int flags,
4876 	struct cred *cr)
4877 {
4878 	struct inode *ip = VTOI(vp);
4879 	int err = 0;
4880 
4881 	if (vp->v_count == 0) {
4882 		return (ufs_fault(vp, "ufs_putpage: bad v_count == 0"));
4883 	}
4884 
4885 	TRACE_1(TR_FAC_UFS, TR_UFS_PUTPAGE_START,
4886 		"ufs_putpage_start:vp %p", vp);
4887 
4888 	/*
4889 	 * XXX - Why should this check be made here?
4890 	 */
4891 	if (vp->v_flag & VNOMAP) {
4892 		err = ENOSYS;
4893 		goto errout;
4894 	}
4895 
4896 	if (ip->i_ufsvfs == NULL) {
4897 		err = EIO;
4898 		goto errout;
4899 	}
4900 
4901 	if (flags & B_ASYNC) {
4902 		if (ufs_delay && len &&
4903 		    (flags & ~(B_ASYNC|B_DONTNEED|B_FREE)) == 0) {
4904 			mutex_enter(&ip->i_tlock);
4905 			/*
4906 			 * If nobody stalled, start a new cluster.
4907 			 */
4908 			if (ip->i_delaylen == 0) {
4909 				ip->i_delayoff = off;
4910 				ip->i_delaylen = len;
4911 				mutex_exit(&ip->i_tlock);
4912 				goto errout;
4913 			}
4914 			/*
4915 			 * If we have a full cluster or they are not contig,
4916 			 * then push last cluster and start over.
4917 			 */
4918 			if (ip->i_delaylen >= CLUSTSZ(ip) ||
4919 			    ip->i_delayoff + ip->i_delaylen != off) {
4920 				u_offset_t doff;
4921 				size_t dlen;
4922 
4923 				doff = ip->i_delayoff;
4924 				dlen = ip->i_delaylen;
4925 				ip->i_delayoff = off;
4926 				ip->i_delaylen = len;
4927 				mutex_exit(&ip->i_tlock);
4928 				err = ufs_putpages(vp, doff, dlen,
4929 				    flags, cr);
4930 				/* LMXXX - flags are new val, not old */
4931 				goto errout;
4932 			}
4933 			/*
4934 			 * There is something there, it's not full, and
4935 			 * it is contig.
4936 			 */
4937 			ip->i_delaylen += len;
4938 			mutex_exit(&ip->i_tlock);
4939 			goto errout;
4940 		}
4941 		/*
4942 		 * Must have weird flags or we are not clustering.
4943 		 */
4944 	}
4945 
4946 	err = ufs_putpages(vp, off, len, flags, cr);
4947 
4948 errout:
4949 	TRACE_2(TR_FAC_UFS, TR_UFS_PUTPAGE_END,
4950 		"ufs_putpage_end:vp %p error %d", vp, err);
4951 	return (err);
4952 }
4953 
4954 /*
4955  * If len == 0, do from off to EOF.
4956  *
4957  * The normal cases should be len == 0 & off == 0 (entire vp list),
4958  * len == MAXBSIZE (from segmap_release actions), and len == PAGESIZE
4959  * (from pageout).
4960  */
4961 /*ARGSUSED*/
4962 static int
4963 ufs_putpages(
4964 	struct vnode *vp,
4965 	offset_t off,
4966 	size_t len,
4967 	int flags,
4968 	struct cred *cr)
4969 {
4970 	u_offset_t io_off;
4971 	u_offset_t eoff;
4972 	struct inode *ip = VTOI(vp);
4973 	page_t *pp;
4974 	size_t io_len;
4975 	int err = 0;
4976 	int dolock;
4977 
4978 	if (vp->v_count == 0)
4979 		return (ufs_fault(vp, "ufs_putpages: v_count == 0"));
4980 	/*
4981 	 * Acquire the readers/write inode lock before locking
4982 	 * any pages in this inode.
4983 	 * The inode lock is held during i/o.
4984 	 */
4985 	if (len == 0) {
4986 		mutex_enter(&ip->i_tlock);
4987 		ip->i_delayoff = ip->i_delaylen = 0;
4988 		mutex_exit(&ip->i_tlock);
4989 	}
4990 	dolock = (rw_owner(&ip->i_contents) != curthread);
4991 	if (dolock) {
4992 		/*
4993 		 * Must synchronize this thread and any possible thread
4994 		 * operating in the window of vulnerability in wrip().
4995 		 * It is dangerous to allow both a thread doing a putpage
4996 		 * and a thread writing, so serialize them.  The exception
4997 		 * is when the thread in wrip() does something which causes
4998 		 * a putpage operation.  Then, the thread must be allowed
4999 		 * to continue.  It may encounter a bmap_read problem in
5000 		 * ufs_putapage, but that is handled in ufs_putapage.
5001 		 * Allow async writers to proceed, we don't want to block
5002 		 * the pageout daemon.
5003 		 */
5004 		if (ip->i_writer == curthread)
5005 			rw_enter(&ip->i_contents, RW_READER);
5006 		else {
5007 			for (;;) {
5008 				rw_enter(&ip->i_contents, RW_READER);
5009 				mutex_enter(&ip->i_tlock);
5010 				/*
5011 				 * If there is no thread in the critical
5012 				 * section of wrip(), then proceed.
5013 				 * Otherwise, wait until there isn't one.
5014 				 */
5015 				if (ip->i_writer == NULL) {
5016 					mutex_exit(&ip->i_tlock);
5017 					break;
5018 				}
5019 				rw_exit(&ip->i_contents);
5020 				/*
5021 				 * Bounce async writers when we have a writer
5022 				 * working on this file so we don't deadlock
5023 				 * the pageout daemon.
5024 				 */
5025 				if (flags & B_ASYNC) {
5026 					mutex_exit(&ip->i_tlock);
5027 					return (0);
5028 				}
5029 				cv_wait(&ip->i_wrcv, &ip->i_tlock);
5030 				mutex_exit(&ip->i_tlock);
5031 			}
5032 		}
5033 	}
5034 
5035 	if (!vn_has_cached_data(vp)) {
5036 		if (dolock)
5037 			rw_exit(&ip->i_contents);
5038 		return (0);
5039 	}
5040 
5041 	if (len == 0) {
5042 		/*
5043 		 * Search the entire vp list for pages >= off.
5044 		 */
5045 		err = pvn_vplist_dirty(vp, (u_offset_t)off, ufs_putapage,
5046 					flags, cr);
5047 	} else {
5048 		/*
5049 		 * Loop over all offsets in the range looking for
5050 		 * pages to deal with.
5051 		 */
5052 		if ((eoff = blkroundup(ip->i_fs, ip->i_size)) != 0)
5053 			eoff = MIN(off + len, eoff);
5054 		else
5055 			eoff = off + len;
5056 
5057 		for (io_off = off; io_off < eoff; io_off += io_len) {
5058 			/*
5059 			 * If we are not invalidating, synchronously
5060 			 * freeing or writing pages, use the routine
5061 			 * page_lookup_nowait() to prevent reclaiming
5062 			 * them from the free list.
5063 			 */
5064 			if ((flags & B_INVAL) || ((flags & B_ASYNC) == 0)) {
5065 				pp = page_lookup(vp, io_off,
5066 					(flags & (B_INVAL | B_FREE)) ?
5067 					    SE_EXCL : SE_SHARED);
5068 			} else {
5069 				pp = page_lookup_nowait(vp, io_off,
5070 					(flags & B_FREE) ? SE_EXCL : SE_SHARED);
5071 			}
5072 
5073 			if (pp == NULL || pvn_getdirty(pp, flags) == 0)
5074 				io_len = PAGESIZE;
5075 			else {
5076 				u_offset_t *io_offp = &io_off;
5077 
5078 				err = ufs_putapage(vp, pp, io_offp, &io_len,
5079 				    flags, cr);
5080 				if (err != 0)
5081 					break;
5082 				/*
5083 				 * "io_off" and "io_len" are returned as
5084 				 * the range of pages we actually wrote.
5085 				 * This allows us to skip ahead more quickly
5086 				 * since several pages may've been dealt
5087 				 * with by this iteration of the loop.
5088 				 */
5089 			}
5090 		}
5091 	}
5092 	if (err == 0 && off == 0 && (len == 0 || len >= ip->i_size)) {
5093 		/*
5094 		 * We have just sync'ed back all the pages on
5095 		 * the inode, turn off the IMODTIME flag.
5096 		 */
5097 		mutex_enter(&ip->i_tlock);
5098 		ip->i_flag &= ~IMODTIME;
5099 		mutex_exit(&ip->i_tlock);
5100 	}
5101 	if (dolock)
5102 		rw_exit(&ip->i_contents);
5103 	return (err);
5104 }
5105 
5106 static void
5107 ufs_iodone(buf_t *bp)
5108 {
5109 	struct inode *ip;
5110 
5111 	ASSERT((bp->b_pages->p_vnode != NULL) && !(bp->b_flags & B_READ));
5112 
5113 	bp->b_iodone = NULL;
5114 
5115 	ip = VTOI(bp->b_pages->p_vnode);
5116 
5117 	mutex_enter(&ip->i_tlock);
5118 	if (ip->i_writes >= ufs_LW) {
5119 		if ((ip->i_writes -= bp->b_bcount) <= ufs_LW)
5120 			if (ufs_WRITES)
5121 				cv_broadcast(&ip->i_wrcv); /* wake all up */
5122 	} else {
5123 		ip->i_writes -= bp->b_bcount;
5124 	}
5125 
5126 	mutex_exit(&ip->i_tlock);
5127 	iodone(bp);
5128 }
5129 
5130 /*
5131  * Write out a single page, possibly klustering adjacent
5132  * dirty pages.  The inode lock must be held.
5133  *
5134  * LMXXX - bsize < pagesize not done.
5135  */
5136 /*ARGSUSED*/
5137 int
5138 ufs_putapage(
5139 	struct vnode *vp,
5140 	page_t *pp,
5141 	u_offset_t *offp,
5142 	size_t *lenp,		/* return values */
5143 	int flags,
5144 	struct cred *cr)
5145 {
5146 	u_offset_t io_off;
5147 	u_offset_t off;
5148 	struct inode *ip = VTOI(vp);
5149 	struct ufsvfs *ufsvfsp = ip->i_ufsvfs;
5150 	struct fs *fs;
5151 	struct buf *bp;
5152 	size_t io_len;
5153 	daddr_t bn;
5154 	int err;
5155 	int contig;
5156 
5157 	ASSERT(RW_LOCK_HELD(&ip->i_contents));
5158 
5159 	TRACE_1(TR_FAC_UFS, TR_UFS_PUTAPAGE_START,
5160 		"ufs_putapage_start:vp %p", vp);
5161 
5162 	if (ufsvfsp == NULL) {
5163 		err = EIO;
5164 		goto out_trace;
5165 	}
5166 
5167 	fs = ip->i_fs;
5168 	ASSERT(fs->fs_ronly == 0);
5169 
5170 	/*
5171 	 * If the modified time on the inode has not already been
5172 	 * set elsewhere (e.g. for write/setattr) we set the time now.
5173 	 * This gives us approximate modified times for mmap'ed files
5174 	 * which are modified via stores in the user address space.
5175 	 */
5176 	if ((ip->i_flag & IMODTIME) == 0) {
5177 		mutex_enter(&ip->i_tlock);
5178 		ip->i_flag |= IUPD;
5179 		ip->i_seq++;
5180 		ITIMES_NOLOCK(ip);
5181 		mutex_exit(&ip->i_tlock);
5182 	}
5183 
5184 	/*
5185 	 * Align the request to a block boundry (for old file systems),
5186 	 * and go ask bmap() how contiguous things are for this file.
5187 	 */
5188 	off = pp->p_offset & (offset_t)fs->fs_bmask;	/* block align it */
5189 	contig = 0;
5190 	err = bmap_read(ip, off, &bn, &contig);
5191 	if (err)
5192 		goto out;
5193 	if (bn == UFS_HOLE) {			/* putpage never allocates */
5194 		/*
5195 		 * logging device is in error mode; simply return EIO
5196 		 */
5197 		if (TRANS_ISERROR(ufsvfsp)) {
5198 			err = EIO;
5199 			goto out;
5200 		}
5201 		/*
5202 		 * Oops, the thread in the window in wrip() did some
5203 		 * sort of operation which caused a putpage in the bad
5204 		 * range.  In this case, just return an error which will
5205 		 * cause the software modified bit on the page to set
5206 		 * and the page will get written out again later.
5207 		 */
5208 		if (ip->i_writer == curthread) {
5209 			err = EIO;
5210 			goto out;
5211 		}
5212 		/*
5213 		 * If the pager is trying to push a page in the bad range
5214 		 * just tell him to try again later when things are better.
5215 		 */
5216 		if (flags & B_ASYNC) {
5217 			err = EAGAIN;
5218 			goto out;
5219 		}
5220 		err = ufs_fault(ITOV(ip), "ufs_putapage: bn == UFS_HOLE");
5221 		goto out;
5222 	}
5223 
5224 	/*
5225 	 * If it is an fallocate'd block, reverse the negativity since
5226 	 * we are now writing to it
5227 	 */
5228 	if (ISFALLOCBLK(ip, bn)) {
5229 		err = bmap_set_bn(vp, off, dbtofsb(fs, -bn));
5230 		if (err)
5231 			goto out;
5232 
5233 		bn = -bn;
5234 	}
5235 
5236 	/*
5237 	 * Take the length (of contiguous bytes) passed back from bmap()
5238 	 * and _try_ and get a set of pages covering that extent.
5239 	 */
5240 	pp = pvn_write_kluster(vp, pp, &io_off, &io_len, off, contig, flags);
5241 
5242 	/*
5243 	 * May have run out of memory and not clustered backwards.
5244 	 * off		p_offset
5245 	 * [  pp - 1  ][   pp   ]
5246 	 * [	block		]
5247 	 * We told bmap off, so we have to adjust the bn accordingly.
5248 	 */
5249 	if (io_off > off) {
5250 		bn += btod(io_off - off);
5251 		contig -= (io_off - off);
5252 	}
5253 
5254 	/*
5255 	 * bmap was carefull to tell us the right size so use that.
5256 	 * There might be unallocated frags at the end.
5257 	 * LMXXX - bzero the end of the page?  We must be writing after EOF.
5258 	 */
5259 	if (io_len > contig) {
5260 		ASSERT(io_len - contig < fs->fs_bsize);
5261 		io_len -= (io_len - contig);
5262 	}
5263 
5264 	/*
5265 	 * Handle the case where we are writing the last page after EOF.
5266 	 *
5267 	 * XXX - just a patch for i-mt3.
5268 	 */
5269 	if (io_len == 0) {
5270 		ASSERT(pp->p_offset >= (u_offset_t)(roundup(ip->i_size,
5271 							    PAGESIZE)));
5272 		io_len = PAGESIZE;
5273 	}
5274 
5275 	bp = pageio_setup(pp, io_len, ip->i_devvp, B_WRITE | flags);
5276 
5277 	ULOCKFS_SET_MOD(ITOUL(ip));
5278 
5279 	bp->b_edev = ip->i_dev;
5280 	bp->b_dev = cmpdev(ip->i_dev);
5281 	bp->b_blkno = bn;
5282 	bp->b_un.b_addr = (caddr_t)0;
5283 	bp->b_file = ip->i_vnode;
5284 
5285 	if (TRANS_ISTRANS(ufsvfsp)) {
5286 		if ((ip->i_mode & IFMT) == IFSHAD) {
5287 			TRANS_BUF(ufsvfsp, 0, io_len, bp, DT_SHAD);
5288 		} else if (ufsvfsp->vfs_qinod == ip) {
5289 			TRANS_DELTA(ufsvfsp, ldbtob(bn), bp->b_bcount, DT_QR,
5290 			    0, 0);
5291 		}
5292 	}
5293 
5294 	/* write throttle */
5295 
5296 	ASSERT(bp->b_iodone == NULL);
5297 	bp->b_iodone = (int (*)())ufs_iodone;
5298 	mutex_enter(&ip->i_tlock);
5299 	ip->i_writes += bp->b_bcount;
5300 	mutex_exit(&ip->i_tlock);
5301 
5302 	if (bp->b_flags & B_ASYNC) {
5303 		if (ufsvfsp->vfs_log) {
5304 			lufs_write_strategy(ufsvfsp->vfs_log, bp);
5305 		} else if (ufsvfsp->vfs_snapshot) {
5306 			fssnap_strategy(&ufsvfsp->vfs_snapshot, bp);
5307 		} else {
5308 			ufsvfsp->vfs_iotstamp = lbolt;
5309 			ub.ub_putasyncs.value.ul++;
5310 			(void) bdev_strategy(bp);
5311 			lwp_stat_update(LWP_STAT_OUBLK, 1);
5312 		}
5313 	} else {
5314 		if (ufsvfsp->vfs_log) {
5315 			lufs_write_strategy(ufsvfsp->vfs_log, bp);
5316 		} else if (ufsvfsp->vfs_snapshot) {
5317 			fssnap_strategy(&ufsvfsp->vfs_snapshot, bp);
5318 		} else {
5319 			ufsvfsp->vfs_iotstamp = lbolt;
5320 			ub.ub_putsyncs.value.ul++;
5321 			(void) bdev_strategy(bp);
5322 			lwp_stat_update(LWP_STAT_OUBLK, 1);
5323 		}
5324 		err = biowait(bp);
5325 		pageio_done(bp);
5326 		pvn_write_done(pp, ((err) ? B_ERROR : 0) | B_WRITE | flags);
5327 	}
5328 
5329 	pp = NULL;
5330 
5331 out:
5332 	if (err != 0 && pp != NULL)
5333 		pvn_write_done(pp, B_ERROR | B_WRITE | flags);
5334 
5335 	if (offp)
5336 		*offp = io_off;
5337 	if (lenp)
5338 		*lenp = io_len;
5339 out_trace:
5340 	TRACE_2(TR_FAC_UFS, TR_UFS_PUTAPAGE_END,
5341 		"ufs_putapage_end:vp %p error %d", vp, err);
5342 	return (err);
5343 }
5344 
5345 /* ARGSUSED */
5346 static int
5347 ufs_map(struct vnode *vp,
5348 	offset_t off,
5349 	struct as *as,
5350 	caddr_t *addrp,
5351 	size_t len,
5352 	uchar_t prot,
5353 	uchar_t maxprot,
5354 	uint_t flags,
5355 	struct cred *cr)
5356 {
5357 	struct segvn_crargs vn_a;
5358 	struct ufsvfs *ufsvfsp = VTOI(vp)->i_ufsvfs;
5359 	struct ulockfs *ulp;
5360 	int error;
5361 
5362 	TRACE_1(TR_FAC_UFS, TR_UFS_MAP_START,
5363 		"ufs_map_start:vp %p", vp);
5364 
5365 	error = ufs_lockfs_begin(ufsvfsp, &ulp, ULOCKFS_MAP_MASK);
5366 	if (error)
5367 		goto out;
5368 
5369 	if (vp->v_flag & VNOMAP) {
5370 		error = ENOSYS;
5371 		goto unlock;
5372 	}
5373 
5374 	if (off < (offset_t)0 || (offset_t)(off + len) < (offset_t)0) {
5375 		error = ENXIO;
5376 		goto unlock;
5377 	}
5378 
5379 	if (vp->v_type != VREG) {
5380 		error = ENODEV;
5381 		goto unlock;
5382 	}
5383 
5384 	/*
5385 	 * If file is being locked, disallow mapping.
5386 	 */
5387 	if (vn_has_mandatory_locks(vp, VTOI(vp)->i_mode)) {
5388 		error = EAGAIN;
5389 		goto unlock;
5390 	}
5391 
5392 	as_rangelock(as);
5393 	if ((flags & MAP_FIXED) == 0) {
5394 		map_addr(addrp, len, off, 1, flags);
5395 		if (*addrp == NULL) {
5396 			as_rangeunlock(as);
5397 			error = ENOMEM;
5398 			goto unlock;
5399 		}
5400 	} else {
5401 		/*
5402 		 * User specified address - blow away any previous mappings
5403 		 */
5404 		(void) as_unmap(as, *addrp, len);
5405 	}
5406 
5407 	vn_a.vp = vp;
5408 	vn_a.offset = (u_offset_t)off;
5409 	vn_a.type = flags & MAP_TYPE;
5410 	vn_a.prot = prot;
5411 	vn_a.maxprot = maxprot;
5412 	vn_a.cred = cr;
5413 	vn_a.amp = NULL;
5414 	vn_a.flags = flags & ~MAP_TYPE;
5415 	vn_a.szc = 0;
5416 	vn_a.lgrp_mem_policy_flags = 0;
5417 
5418 	error = as_map(as, *addrp, len, segvn_create, &vn_a);
5419 	as_rangeunlock(as);
5420 
5421 unlock:
5422 	if (ulp) {
5423 		ufs_lockfs_end(ulp);
5424 	}
5425 out:
5426 	TRACE_2(TR_FAC_UFS, TR_UFS_MAP_END,
5427 		"ufs_map_end:vp %p error %d", vp, error);
5428 	return (error);
5429 }
5430 
5431 /* ARGSUSED */
5432 static int
5433 ufs_addmap(struct vnode *vp,
5434 	offset_t off,
5435 	struct as *as,
5436 	caddr_t addr,
5437 	size_t	len,
5438 	uchar_t  prot,
5439 	uchar_t  maxprot,
5440 	uint_t    flags,
5441 	struct cred *cr)
5442 {
5443 	struct inode *ip = VTOI(vp);
5444 
5445 	if (vp->v_flag & VNOMAP) {
5446 		return (ENOSYS);
5447 	}
5448 
5449 	mutex_enter(&ip->i_tlock);
5450 	ip->i_mapcnt += btopr(len);
5451 	mutex_exit(&ip->i_tlock);
5452 	return (0);
5453 }
5454 
5455 /*ARGSUSED*/
5456 static int
5457 ufs_delmap(struct vnode *vp, offset_t off, struct as *as, caddr_t addr,
5458 	size_t len, uint_t prot,  uint_t maxprot,  uint_t flags,
5459 	struct cred *cr)
5460 {
5461 	struct inode *ip = VTOI(vp);
5462 
5463 	if (vp->v_flag & VNOMAP) {
5464 		return (ENOSYS);
5465 	}
5466 
5467 	mutex_enter(&ip->i_tlock);
5468 	ip->i_mapcnt -= btopr(len); 	/* Count released mappings */
5469 	ASSERT(ip->i_mapcnt >= 0);
5470 	mutex_exit(&ip->i_tlock);
5471 	return (0);
5472 }
5473 /*
5474  * Return the answer requested to poll() for non-device files
5475  */
5476 struct pollhead ufs_pollhd;
5477 
5478 /* ARGSUSED */
5479 int
5480 ufs_poll(vnode_t *vp, short ev, int any, short *revp, struct pollhead **phpp)
5481 {
5482 	struct ufsvfs	*ufsvfsp;
5483 
5484 	*revp = 0;
5485 	ufsvfsp = VTOI(vp)->i_ufsvfs;
5486 
5487 	if (!ufsvfsp) {
5488 		*revp = POLLHUP;
5489 		goto out;
5490 	}
5491 
5492 	if (ULOCKFS_IS_HLOCK(&ufsvfsp->vfs_ulockfs) ||
5493 	    ULOCKFS_IS_ELOCK(&ufsvfsp->vfs_ulockfs)) {
5494 		*revp |= POLLERR;
5495 
5496 	} else {
5497 		if ((ev & POLLOUT) && !ufsvfsp->vfs_fs->fs_ronly &&
5498 		    !ULOCKFS_IS_WLOCK(&ufsvfsp->vfs_ulockfs))
5499 			*revp |= POLLOUT;
5500 
5501 		if ((ev & POLLWRBAND) && !ufsvfsp->vfs_fs->fs_ronly &&
5502 		    !ULOCKFS_IS_WLOCK(&ufsvfsp->vfs_ulockfs))
5503 			*revp |= POLLWRBAND;
5504 
5505 		if (ev & POLLIN)
5506 			*revp |= POLLIN;
5507 
5508 		if (ev & POLLRDNORM)
5509 			*revp |= POLLRDNORM;
5510 
5511 		if (ev & POLLRDBAND)
5512 			*revp |= POLLRDBAND;
5513 	}
5514 
5515 	if ((ev & POLLPRI) && (*revp & (POLLERR|POLLHUP)))
5516 		*revp |= POLLPRI;
5517 out:
5518 	*phpp = !any && !*revp ? &ufs_pollhd : (struct pollhead *)NULL;
5519 
5520 	return (0);
5521 }
5522 
5523 /* ARGSUSED */
5524 static int
5525 ufs_l_pathconf(struct vnode *vp, int cmd, ulong_t *valp, struct cred *cr)
5526 {
5527 	struct ufsvfs	*ufsvfsp = VTOI(vp)->i_ufsvfs;
5528 	struct ulockfs	*ulp = NULL;
5529 	struct inode 	*sip = NULL;
5530 	int		error;
5531 	struct inode 	*ip = VTOI(vp);
5532 	int		issync;
5533 
5534 	error = ufs_lockfs_begin(ufsvfsp, &ulp, ULOCKFS_PATHCONF_MASK);
5535 	if (error)
5536 		return (error);
5537 
5538 	switch (cmd) {
5539 		/*
5540 		 * Have to handle _PC_NAME_MAX here, because the normal way
5541 		 * [fs_pathconf() -> VOP_STATVFS() -> ufs_statvfs()]
5542 		 * results in a lock ordering reversal between
5543 		 * ufs_lockfs_{begin,end}() and
5544 		 * ufs_thread_{suspend,continue}().
5545 		 *
5546 		 * Keep in sync with ufs_statvfs().
5547 		 */
5548 	case _PC_NAME_MAX:
5549 		*valp = MAXNAMLEN;
5550 		break;
5551 
5552 	case _PC_FILESIZEBITS:
5553 		if (ufsvfsp->vfs_lfflags & UFS_LARGEFILES)
5554 			*valp = UFS_FILESIZE_BITS;
5555 		else
5556 			*valp = 32;
5557 		break;
5558 
5559 	case _PC_XATTR_EXISTS:
5560 		if (vp->v_vfsp->vfs_flag & VFS_XATTR) {
5561 
5562 			error = ufs_xattr_getattrdir(vp, &sip, LOOKUP_XATTR,
5563 							cr);
5564 			if (error ==  0 && sip != NULL) {
5565 				/* Start transaction */
5566 				if (ulp) {
5567 					TRANS_BEGIN_CSYNC(ufsvfsp, issync,
5568 					    TOP_RMDIR, TOP_RMDIR_SIZE);
5569 				}
5570 				/*
5571 				 * Is directory empty
5572 				 */
5573 				rw_enter(&sip->i_rwlock, RW_WRITER);
5574 				rw_enter(&sip->i_contents, RW_WRITER);
5575 				if (ufs_xattrdirempty(sip,
5576 						sip->i_number, CRED())) {
5577 					rw_enter(&ip->i_contents, RW_WRITER);
5578 					ufs_unhook_shadow(ip, sip);
5579 					rw_exit(&ip->i_contents);
5580 
5581 					*valp = 0;
5582 
5583 				} else
5584 					*valp = 1;
5585 				rw_exit(&sip->i_contents);
5586 				rw_exit(&sip->i_rwlock);
5587 				if (ulp) {
5588 					TRANS_END_CSYNC(ufsvfsp, error, issync,
5589 					    TOP_RMDIR, TOP_RMDIR_SIZE);
5590 				}
5591 				VN_RELE(ITOV(sip));
5592 			} else if (error == ENOENT) {
5593 				*valp = 0;
5594 				error = 0;
5595 			}
5596 		} else {
5597 			error = fs_pathconf(vp, cmd, valp, cr);
5598 		}
5599 		break;
5600 
5601 	case _PC_ACL_ENABLED:
5602 		*valp = _ACL_ACLENT_ENABLED;
5603 		break;
5604 
5605 	case _PC_MIN_HOLE_SIZE:
5606 		*valp = (ulong_t)ip->i_fs->fs_bsize;
5607 		break;
5608 
5609 	default:
5610 		error = fs_pathconf(vp, cmd, valp, cr);
5611 	}
5612 
5613 	if (ulp != NULL) {
5614 		ufs_lockfs_end(ulp);
5615 	}
5616 	return (error);
5617 }
5618 
5619 int ufs_pageio_writes, ufs_pageio_reads;
5620 
5621 /*ARGSUSED*/
5622 static int
5623 ufs_pageio(struct vnode *vp, page_t *pp, u_offset_t io_off, size_t io_len,
5624 	int flags, struct cred *cr)
5625 {
5626 	struct inode *ip = VTOI(vp);
5627 	struct ufsvfs *ufsvfsp;
5628 	page_t *npp = NULL, *opp = NULL, *cpp = pp;
5629 	struct buf *bp;
5630 	daddr_t bn;
5631 	size_t done_len = 0, cur_len = 0;
5632 	int err = 0;
5633 	int contig = 0;
5634 	int dolock;
5635 	int vmpss = 0;
5636 	struct ulockfs *ulp;
5637 
5638 	if ((flags & B_READ) && pp != NULL && pp->p_vnode == vp &&
5639 	    vp->v_mpssdata != NULL) {
5640 		vmpss = 1;
5641 	}
5642 
5643 	dolock = (rw_owner(&ip->i_contents) != curthread);
5644 	/*
5645 	 * We need a better check.  Ideally, we would use another
5646 	 * vnodeops so that hlocked and forcibly unmounted file
5647 	 * systems would return EIO where appropriate and w/o the
5648 	 * need for these checks.
5649 	 */
5650 	if ((ufsvfsp = ip->i_ufsvfs) == NULL)
5651 		return (EIO);
5652 
5653 	/*
5654 	 * For vmpss (pp can be NULL) case respect the quiesce protocol.
5655 	 * ul_lock must be taken before locking pages so we can't use it here
5656 	 * if pp is non NULL because segvn already locked pages
5657 	 * SE_EXCL. Instead we rely on the fact that a forced umount or
5658 	 * applying a filesystem lock via ufs_fiolfs() will block in the
5659 	 * implicit call to ufs_flush() until we unlock the pages after the
5660 	 * return to segvn. Other ufs_quiesce() callers keep ufs_quiesce_pend
5661 	 * above 0 until they are done. We have to be careful not to increment
5662 	 * ul_vnops_cnt here after forceful unmount hlocks the file system.
5663 	 *
5664 	 * If pp is NULL use ul_lock to make sure we don't increment
5665 	 * ul_vnops_cnt after forceful unmount hlocks the file system.
5666 	 */
5667 	if (vmpss || pp == NULL) {
5668 		ulp = &ufsvfsp->vfs_ulockfs;
5669 		if (pp == NULL)
5670 			mutex_enter(&ulp->ul_lock);
5671 		if (ulp->ul_fs_lock & ULOCKFS_GETREAD_MASK) {
5672 			if (pp == NULL) {
5673 				mutex_exit(&ulp->ul_lock);
5674 			}
5675 			return (vmpss ? EIO : EINVAL);
5676 		}
5677 		atomic_add_long(&ulp->ul_vnops_cnt, 1);
5678 		if (pp == NULL)
5679 			mutex_exit(&ulp->ul_lock);
5680 		if (ufs_quiesce_pend) {
5681 			if (!atomic_add_long_nv(&ulp->ul_vnops_cnt, -1))
5682 				cv_broadcast(&ulp->ul_cv);
5683 			return (vmpss ? EIO : EINVAL);
5684 		}
5685 	}
5686 
5687 	if (dolock) {
5688 		/*
5689 		 * segvn may call VOP_PAGEIO() instead of VOP_GETPAGE() to
5690 		 * handle a fault against a segment that maps vnode pages with
5691 		 * large mappings.  Segvn creates pages and holds them locked
5692 		 * SE_EXCL during VOP_PAGEIO() call. In this case we have to
5693 		 * use rw_tryenter() to avoid a potential deadlock since in
5694 		 * lock order i_contents needs to be taken first.
5695 		 * Segvn will retry via VOP_GETPAGE() if VOP_PAGEIO() fails.
5696 		 */
5697 		if (!vmpss) {
5698 			rw_enter(&ip->i_contents, RW_READER);
5699 		} else if (!rw_tryenter(&ip->i_contents, RW_READER)) {
5700 			if (!atomic_add_long_nv(&ulp->ul_vnops_cnt, -1))
5701 				cv_broadcast(&ulp->ul_cv);
5702 			return (EDEADLK);
5703 		}
5704 	}
5705 
5706 	/*
5707 	 * Return an error to segvn because the pagefault request is beyond
5708 	 * PAGESIZE rounded EOF.
5709 	 */
5710 	if (vmpss && btopr(io_off + io_len) > btopr(ip->i_size)) {
5711 		if (dolock)
5712 			rw_exit(&ip->i_contents);
5713 		if (!atomic_add_long_nv(&ulp->ul_vnops_cnt, -1))
5714 			cv_broadcast(&ulp->ul_cv);
5715 		return (EFAULT);
5716 	}
5717 
5718 	if (pp == NULL) {
5719 		if (bmap_has_holes(ip)) {
5720 			err = ENOSYS;
5721 		} else {
5722 			err = EINVAL;
5723 		}
5724 		if (dolock)
5725 			rw_exit(&ip->i_contents);
5726 		if (!atomic_add_long_nv(&ulp->ul_vnops_cnt, -1))
5727 			cv_broadcast(&ulp->ul_cv);
5728 		return (err);
5729 	}
5730 
5731 	/*
5732 	 * Break the io request into chunks, one for each contiguous
5733 	 * stretch of disk blocks in the target file.
5734 	 */
5735 	while (done_len < io_len) {
5736 		ASSERT(cpp);
5737 		contig = 0;
5738 		if (err = bmap_read(ip, (u_offset_t)(io_off + done_len),
5739 				    &bn, &contig))
5740 			break;
5741 
5742 		if (bn == UFS_HOLE) {	/* No holey swapfiles */
5743 			if (vmpss) {
5744 				err = EFAULT;
5745 				break;
5746 			}
5747 			err = ufs_fault(ITOV(ip), "ufs_pageio: bn == UFS_HOLE");
5748 			break;
5749 		}
5750 
5751 		cur_len = MIN(io_len - done_len, contig);
5752 		/*
5753 		 * Zero out a page beyond EOF, when the last block of
5754 		 * a file is a UFS fragment so that ufs_pageio() can be used
5755 		 * instead of ufs_getpage() to handle faults against
5756 		 * segvn segments that use large pages.
5757 		 */
5758 		page_list_break(&cpp, &npp, btopr(cur_len));
5759 		if ((flags & B_READ) && (cur_len & PAGEOFFSET)) {
5760 			size_t xlen = cur_len & PAGEOFFSET;
5761 			pagezero(cpp->p_prev, xlen, PAGESIZE - xlen);
5762 		}
5763 
5764 		bp = pageio_setup(cpp, cur_len, ip->i_devvp, flags);
5765 		ASSERT(bp != NULL);
5766 
5767 		bp->b_edev = ip->i_dev;
5768 		bp->b_dev = cmpdev(ip->i_dev);
5769 		bp->b_blkno = bn;
5770 		bp->b_un.b_addr = (caddr_t)0;
5771 		bp->b_file = ip->i_vnode;
5772 
5773 		ufsvfsp->vfs_iotstamp = lbolt;
5774 		ub.ub_pageios.value.ul++;
5775 		if (ufsvfsp->vfs_snapshot)
5776 			fssnap_strategy(&(ufsvfsp->vfs_snapshot), bp);
5777 		else
5778 			(void) bdev_strategy(bp);
5779 
5780 		if (flags & B_READ)
5781 			ufs_pageio_reads++;
5782 		else
5783 			ufs_pageio_writes++;
5784 		if (flags & B_READ)
5785 			lwp_stat_update(LWP_STAT_INBLK, 1);
5786 		else
5787 			lwp_stat_update(LWP_STAT_OUBLK, 1);
5788 		/*
5789 		 * If the request is not B_ASYNC, wait for i/o to complete
5790 		 * and re-assemble the page list to return to the caller.
5791 		 * If it is B_ASYNC we leave the page list in pieces and
5792 		 * cleanup() will dispose of them.
5793 		 */
5794 		if ((flags & B_ASYNC) == 0) {
5795 			err = biowait(bp);
5796 			pageio_done(bp);
5797 			if (err)
5798 				break;
5799 			page_list_concat(&opp, &cpp);
5800 		}
5801 		cpp = npp;
5802 		npp = NULL;
5803 		if (flags & B_READ)
5804 			cur_len = P2ROUNDUP_TYPED(cur_len, PAGESIZE, size_t);
5805 		done_len += cur_len;
5806 	}
5807 	ASSERT(err || (cpp == NULL && npp == NULL && done_len == io_len));
5808 	if (err) {
5809 		if (flags & B_ASYNC) {
5810 			/* Cleanup unprocessed parts of list */
5811 			page_list_concat(&cpp, &npp);
5812 			if (flags & B_READ)
5813 				pvn_read_done(cpp, B_ERROR);
5814 			else
5815 				pvn_write_done(cpp, B_ERROR);
5816 		} else {
5817 			/* Re-assemble list and let caller clean up */
5818 			page_list_concat(&opp, &cpp);
5819 			page_list_concat(&opp, &npp);
5820 		}
5821 	}
5822 
5823 	if (vmpss && !(ip->i_flag & IACC) && !ULOCKFS_IS_NOIACC(ulp) &&
5824 	    ufsvfsp->vfs_fs->fs_ronly == 0 && !ufsvfsp->vfs_noatime) {
5825 		mutex_enter(&ip->i_tlock);
5826 		ip->i_flag |= IACC;
5827 		ITIMES_NOLOCK(ip);
5828 		mutex_exit(&ip->i_tlock);
5829 	}
5830 
5831 	if (dolock)
5832 		rw_exit(&ip->i_contents);
5833 	if (vmpss && !atomic_add_long_nv(&ulp->ul_vnops_cnt, -1))
5834 		cv_broadcast(&ulp->ul_cv);
5835 	return (err);
5836 }
5837 
5838 /*
5839  * Called when the kernel is in a frozen state to dump data
5840  * directly to the device. It uses a private dump data structure,
5841  * set up by dump_ctl, to locate the correct disk block to which to dump.
5842  */
5843 static int
5844 ufs_dump(vnode_t *vp, caddr_t addr, int ldbn, int dblks)
5845 {
5846 	u_offset_t	file_size;
5847 	struct inode    *ip = VTOI(vp);
5848 	struct fs	*fs = ip->i_fs;
5849 	daddr_t		dbn, lfsbn;
5850 	int		disk_blks = fs->fs_bsize >> DEV_BSHIFT;
5851 	int		error = 0;
5852 	int		ndbs, nfsbs;
5853 
5854 	/*
5855 	 * forced unmount case
5856 	 */
5857 	if (ip->i_ufsvfs == NULL)
5858 		return (EIO);
5859 	/*
5860 	 * Validate the inode that it has not been modified since
5861 	 * the dump structure is allocated.
5862 	 */
5863 	mutex_enter(&ip->i_tlock);
5864 	if ((dump_info == NULL) ||
5865 	    (dump_info->ip != ip) ||
5866 	    (dump_info->time.tv_sec != ip->i_mtime.tv_sec) ||
5867 	    (dump_info->time.tv_usec != ip->i_mtime.tv_usec)) {
5868 		mutex_exit(&ip->i_tlock);
5869 		return (-1);
5870 	}
5871 	mutex_exit(&ip->i_tlock);
5872 
5873 	/*
5874 	 * See that the file has room for this write
5875 	 */
5876 	UFS_GET_ISIZE(&file_size, ip);
5877 
5878 	if (ldbtob((offset_t)(ldbn + dblks)) > file_size)
5879 		return (ENOSPC);
5880 
5881 	/*
5882 	 * Find the physical disk block numbers from the dump
5883 	 * private data structure directly and write out the data
5884 	 * in contiguous block lumps
5885 	 */
5886 	while (dblks > 0 && !error) {
5887 		lfsbn = (daddr_t)lblkno(fs, ldbtob((offset_t)ldbn));
5888 		dbn = fsbtodb(fs, dump_info->dblk[lfsbn]) + ldbn % disk_blks;
5889 		nfsbs = 1;
5890 		ndbs = disk_blks - ldbn % disk_blks;
5891 		while (ndbs < dblks && fsbtodb(fs, dump_info->dblk[lfsbn +
5892 		    nfsbs]) == dbn + ndbs) {
5893 			nfsbs++;
5894 			ndbs += disk_blks;
5895 		}
5896 		if (ndbs > dblks)
5897 			ndbs = dblks;
5898 		error = bdev_dump(ip->i_dev, addr, dbn, ndbs);
5899 		addr += ldbtob((offset_t)ndbs);
5900 		dblks -= ndbs;
5901 		ldbn += ndbs;
5902 	}
5903 	return (error);
5904 
5905 }
5906 
5907 /*
5908  * Prepare the file system before and after the dump operation.
5909  *
5910  * action = DUMP_ALLOC:
5911  * Preparation before dump, allocate dump private data structure
5912  * to hold all the direct and indirect block info for dump.
5913  *
5914  * action = DUMP_FREE:
5915  * Clean up after dump, deallocate the dump private data structure.
5916  *
5917  * action = DUMP_SCAN:
5918  * Scan dump_info for *blkp DEV_BSIZE blocks of contig fs space;
5919  * if found, the starting file-relative DEV_BSIZE lbn is written
5920  * to *bklp; that lbn is intended for use with VOP_DUMP()
5921  */
5922 static int
5923 ufs_dumpctl(vnode_t *vp, int action, int *blkp)
5924 {
5925 	struct inode	*ip = VTOI(vp);
5926 	ufsvfs_t	*ufsvfsp = ip->i_ufsvfs;
5927 	struct fs	*fs;
5928 	daddr32_t	*dblk, *storeblk;
5929 	daddr32_t	*nextblk, *endblk;
5930 	struct buf	*bp;
5931 	int		i, entry, entries;
5932 	int		n, ncontig;
5933 
5934 	/*
5935 	 * check for forced unmount
5936 	 */
5937 	if (ufsvfsp == NULL)
5938 		return (EIO);
5939 
5940 	if (action == DUMP_ALLOC) {
5941 		/*
5942 		 * alloc and record dump_info
5943 		 */
5944 		if (dump_info != NULL)
5945 			return (EINVAL);
5946 
5947 		ASSERT(vp->v_type == VREG);
5948 		fs = ufsvfsp->vfs_fs;
5949 
5950 		rw_enter(&ip->i_contents, RW_READER);
5951 
5952 		if (bmap_has_holes(ip)) {
5953 			rw_exit(&ip->i_contents);
5954 			return (EFAULT);
5955 		}
5956 
5957 		/*
5958 		 * calculate and allocate space needed according to i_size
5959 		 */
5960 		entries = (int)lblkno(fs, blkroundup(fs, ip->i_size));
5961 		if ((dump_info = (struct dump *)
5962 		    kmem_alloc(sizeof (struct dump) +
5963 		    (entries - 1) * sizeof (daddr32_t), KM_NOSLEEP)) == NULL) {
5964 			    rw_exit(&ip->i_contents);
5965 			    return (ENOMEM);
5966 		}
5967 
5968 		/* Start saving the info */
5969 		dump_info->fsbs = entries;
5970 		dump_info->ip = ip;
5971 		storeblk = &dump_info->dblk[0];
5972 
5973 		/* Direct Blocks */
5974 		for (entry = 0; entry < NDADDR && entry < entries; entry++)
5975 			*storeblk++ = ip->i_db[entry];
5976 
5977 		/* Indirect Blocks */
5978 		for (i = 0; i < NIADDR; i++) {
5979 			int error = 0;
5980 
5981 			bp = UFS_BREAD(ufsvfsp,
5982 				ip->i_dev, fsbtodb(fs, ip->i_ib[i]),
5983 				fs->fs_bsize);
5984 			if (bp->b_flags & B_ERROR)
5985 				error = EIO;
5986 			else {
5987 				dblk = bp->b_un.b_daddr;
5988 				if ((storeblk = save_dblks(ip, ufsvfsp,
5989 				    storeblk, dblk, i, entries)) == NULL)
5990 					error = EIO;
5991 			}
5992 
5993 			brelse(bp);
5994 
5995 			if (error != 0) {
5996 				kmem_free(dump_info, sizeof (struct dump) +
5997 				    (entries - 1) * sizeof (daddr32_t));
5998 				rw_exit(&ip->i_contents);
5999 				dump_info = NULL;
6000 				return (error);
6001 			}
6002 		}
6003 		/* and time stamp the information */
6004 		mutex_enter(&ip->i_tlock);
6005 		dump_info->time = ip->i_mtime;
6006 		mutex_exit(&ip->i_tlock);
6007 
6008 		rw_exit(&ip->i_contents);
6009 	} else if (action == DUMP_FREE) {
6010 		/*
6011 		 * free dump_info
6012 		 */
6013 		if (dump_info == NULL)
6014 			return (EINVAL);
6015 		entries = dump_info->fsbs - 1;
6016 		kmem_free(dump_info, sizeof (struct dump) +
6017 		    entries * sizeof (daddr32_t));
6018 		dump_info = NULL;
6019 	} else if (action == DUMP_SCAN) {
6020 		/*
6021 		 * scan dump_info
6022 		 */
6023 		if (dump_info == NULL)
6024 			return (EINVAL);
6025 
6026 		dblk = dump_info->dblk;
6027 		nextblk = dblk + 1;
6028 		endblk = dblk + dump_info->fsbs - 1;
6029 		fs = ufsvfsp->vfs_fs;
6030 		ncontig = *blkp >> (fs->fs_bshift - DEV_BSHIFT);
6031 
6032 		/*
6033 		 * scan dblk[] entries; contig fs space is found when:
6034 		 * ((current blkno + frags per block) == next blkno)
6035 		 */
6036 		n = 0;
6037 		while (n < ncontig && dblk < endblk) {
6038 			if ((*dblk + fs->fs_frag) == *nextblk)
6039 				n++;
6040 			else
6041 				n = 0;
6042 			dblk++;
6043 			nextblk++;
6044 		}
6045 
6046 		/*
6047 		 * index is where size bytes of contig space begins;
6048 		 * conversion from index to the file's DEV_BSIZE lbn
6049 		 * is equivalent to:  (index * fs_bsize) / DEV_BSIZE
6050 		 */
6051 		if (n == ncontig) {
6052 			i = (dblk - dump_info->dblk) - ncontig;
6053 			*blkp = i << (fs->fs_bshift - DEV_BSHIFT);
6054 		} else
6055 			return (EFAULT);
6056 	}
6057 	return (0);
6058 }
6059 
6060 /*
6061  * Recursive helper function for ufs_dumpctl().  It follows the indirect file
6062  * system  blocks until it reaches the the disk block addresses, which are
6063  * then stored into the given buffer, storeblk.
6064  */
6065 static daddr32_t *
6066 save_dblks(struct inode *ip, struct ufsvfs *ufsvfsp,  daddr32_t *storeblk,
6067     daddr32_t *dblk, int level, int entries)
6068 {
6069 	struct fs	*fs = ufsvfsp->vfs_fs;
6070 	struct buf	*bp;
6071 	int		i;
6072 
6073 	if (level == 0) {
6074 		for (i = 0; i < NINDIR(fs); i++) {
6075 			if (storeblk - dump_info->dblk >= entries)
6076 				break;
6077 			*storeblk++ = dblk[i];
6078 		}
6079 		return (storeblk);
6080 	}
6081 	for (i = 0; i < NINDIR(fs); i++) {
6082 		if (storeblk - dump_info->dblk >= entries)
6083 			break;
6084 		bp = UFS_BREAD(ufsvfsp,
6085 				ip->i_dev, fsbtodb(fs, dblk[i]), fs->fs_bsize);
6086 		if (bp->b_flags & B_ERROR) {
6087 			brelse(bp);
6088 			return (NULL);
6089 		}
6090 		storeblk = save_dblks(ip, ufsvfsp, storeblk, bp->b_un.b_daddr,
6091 		    level - 1, entries);
6092 		brelse(bp);
6093 
6094 		if (storeblk == NULL)
6095 			return (NULL);
6096 	}
6097 	return (storeblk);
6098 }
6099 
6100 /* ARGSUSED */
6101 static int
6102 ufs_getsecattr(struct vnode *vp, vsecattr_t *vsap, int flag,
6103 	struct cred *cr)
6104 {
6105 	struct inode	*ip = VTOI(vp);
6106 	struct ulockfs	*ulp;
6107 	struct ufsvfs	*ufsvfsp = ip->i_ufsvfs;
6108 	ulong_t		vsa_mask = vsap->vsa_mask;
6109 	int		err = EINVAL;
6110 
6111 	TRACE_3(TR_FAC_UFS, TR_UFS_GETSECATTR_START,
6112 	    "ufs_getsecattr_start:vp %p, vsap %p, flags %x", vp, vsap, flag);
6113 
6114 	vsa_mask &= (VSA_ACL | VSA_ACLCNT | VSA_DFACL | VSA_DFACLCNT);
6115 
6116 	/*
6117 	 * Only grab locks if needed - they're not needed to check vsa_mask
6118 	 * or if the mask contains no acl flags.
6119 	 */
6120 	if (vsa_mask != 0) {
6121 		if (err = ufs_lockfs_begin(ufsvfsp, &ulp,
6122 		    ULOCKFS_GETATTR_MASK))
6123 			return (err);
6124 
6125 		rw_enter(&ip->i_contents, RW_READER);
6126 		err = ufs_acl_get(ip, vsap, flag, cr);
6127 		rw_exit(&ip->i_contents);
6128 
6129 		if (ulp)
6130 			ufs_lockfs_end(ulp);
6131 	}
6132 	TRACE_1(TR_FAC_UFS, TR_UFS_GETSECATTR_END,
6133 	    "ufs_getsecattr_end:vp %p", vp);
6134 	return (err);
6135 }
6136 
6137 /* ARGSUSED */
6138 static int
6139 ufs_setsecattr(struct vnode *vp, vsecattr_t *vsap, int flag, struct cred *cr)
6140 {
6141 	struct inode	*ip = VTOI(vp);
6142 	struct ulockfs	*ulp = NULL;
6143 	struct ufsvfs	*ufsvfsp = VTOI(vp)->i_ufsvfs;
6144 	ulong_t		vsa_mask = vsap->vsa_mask;
6145 	int		err;
6146 	int		haverwlock = 1;
6147 	int		trans_size;
6148 	int		donetrans = 0;
6149 	int		retry = 1;
6150 
6151 
6152 	TRACE_3(TR_FAC_UFS, TR_UFS_SETSECATTR_START,
6153 	    "ufs_setsecattr_start:vp %p, vsap %p, flags %x", vp, vsap, flag);
6154 
6155 	ASSERT(RW_LOCK_HELD(&ip->i_rwlock));
6156 
6157 	/* Abort now if the request is either empty or invalid. */
6158 	vsa_mask &= (VSA_ACL | VSA_ACLCNT | VSA_DFACL | VSA_DFACLCNT);
6159 	if ((vsa_mask == 0) ||
6160 	    ((vsap->vsa_aclentp == NULL) &&
6161 	    (vsap->vsa_dfaclentp == NULL))) {
6162 		err = EINVAL;
6163 		goto out;
6164 	}
6165 
6166 	/*
6167 	 * Following convention, if this is a directory then we acquire the
6168 	 * inode's i_rwlock after starting a UFS logging transaction;
6169 	 * otherwise, we acquire it beforehand. Since we were called (and
6170 	 * must therefore return) with the lock held, we will have to drop it,
6171 	 * and later reacquire it, if operating on a directory.
6172 	 */
6173 	if (vp->v_type == VDIR) {
6174 		rw_exit(&ip->i_rwlock);
6175 		haverwlock = 0;
6176 	} else {
6177 		/* Upgrade the lock if required. */
6178 		if (!rw_write_held(&ip->i_rwlock)) {
6179 			rw_exit(&ip->i_rwlock);
6180 			rw_enter(&ip->i_rwlock, RW_WRITER);
6181 		}
6182 	}
6183 
6184 again:
6185 	ASSERT(!(vp->v_type == VDIR && haverwlock));
6186 	if (err = ufs_lockfs_begin(ufsvfsp, &ulp, ULOCKFS_SETATTR_MASK)) {
6187 		ulp = NULL;
6188 		retry = 0;
6189 		goto out;
6190 	}
6191 
6192 	/*
6193 	 * Check that the file system supports this operation. Note that
6194 	 * ufs_lockfs_begin() will have checked that the file system had
6195 	 * not been forcibly unmounted.
6196 	 */
6197 	if (ufsvfsp->vfs_fs->fs_ronly) {
6198 		err = EROFS;
6199 		goto out;
6200 	}
6201 	if (ufsvfsp->vfs_nosetsec) {
6202 		err = ENOSYS;
6203 		goto out;
6204 	}
6205 
6206 	if (ulp) {
6207 		TRANS_BEGIN_ASYNC(ufsvfsp, TOP_SETSECATTR,
6208 			trans_size = TOP_SETSECATTR_SIZE(VTOI(vp)));
6209 		donetrans = 1;
6210 	}
6211 
6212 	if (vp->v_type == VDIR) {
6213 		rw_enter(&ip->i_rwlock, RW_WRITER);
6214 		haverwlock = 1;
6215 	}
6216 
6217 	ASSERT(haverwlock);
6218 
6219 	/* Do the actual work. */
6220 	rw_enter(&ip->i_contents, RW_WRITER);
6221 	/*
6222 	 * Suppress out of inodes messages if we will retry.
6223 	 */
6224 	if (retry)
6225 		ip->i_flag |= IQUIET;
6226 	err = ufs_acl_set(ip, vsap, flag, cr);
6227 	ip->i_flag &= ~IQUIET;
6228 	rw_exit(&ip->i_contents);
6229 
6230 out:
6231 	if (ulp) {
6232 		if (donetrans) {
6233 			/*
6234 			 * top_end_async() can eventually call
6235 			 * top_end_sync(), which can block. We must
6236 			 * therefore observe the lock-ordering protocol
6237 			 * here as well.
6238 			 */
6239 			if (vp->v_type == VDIR) {
6240 				rw_exit(&ip->i_rwlock);
6241 				haverwlock = 0;
6242 			}
6243 			TRANS_END_ASYNC(ufsvfsp, TOP_SETSECATTR, trans_size);
6244 		}
6245 		ufs_lockfs_end(ulp);
6246 	}
6247 	/*
6248 	 * If no inodes available, try scaring a logically-
6249 	 * free one out of the delete queue to someplace
6250 	 * that we can find it.
6251 	 */
6252 	if ((err == ENOSPC) && retry && TRANS_ISTRANS(ufsvfsp)) {
6253 		ufs_delete_drain_wait(ufsvfsp, 1);
6254 		retry = 0;
6255 		if (vp->v_type == VDIR && haverwlock) {
6256 			rw_exit(&ip->i_rwlock);
6257 			haverwlock = 0;
6258 		}
6259 		goto again;
6260 	}
6261 	/*
6262 	 * If we need to reacquire the lock then it is safe to do so
6263 	 * as a reader. This is because ufs_rwunlock(), which will be
6264 	 * called by our caller after we return, does not differentiate
6265 	 * between shared and exclusive locks.
6266 	 */
6267 	if (!haverwlock) {
6268 		ASSERT(vp->v_type == VDIR);
6269 		rw_enter(&ip->i_rwlock, RW_READER);
6270 	}
6271 
6272 	TRACE_1(TR_FAC_UFS, TR_UFS_SETSECATTR_END,
6273 	    "ufs_setsecattr_end:vp %p", vp);
6274 	return (err);
6275 }
6276