xref: /titanic_41/usr/src/uts/common/fs/ufs/ufs_vnops.c (revision c719c59a5efa45b0a47db940384816b4ed77db7d)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License, Version 1.0 only
6  * (the "License").  You may not use this file except in compliance
7  * with the License.
8  *
9  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
10  * or http://www.opensolaris.org/os/licensing.
11  * See the License for the specific language governing permissions
12  * and limitations under the License.
13  *
14  * When distributing Covered Code, include this CDDL HEADER in each
15  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
16  * If applicable, add the following below this CDDL HEADER, with the
17  * fields enclosed by brackets "[]" replaced with your own identifying
18  * information: Portions Copyright [yyyy] [name of copyright owner]
19  *
20  * CDDL HEADER END
21  */
22 /*
23  * Copyright 2005 Sun Microsystems, Inc.  All rights reserved.
24  * Use is subject to license terms.
25  */
26 
27 /*	Copyright (c) 1983, 1984, 1985, 1986, 1987, 1988, 1989 AT&T	*/
28 /*	  All Rights Reserved  	*/
29 
30 /*
31  * Portions of this source code were derived from Berkeley 4.3 BSD
32  * under license from the Regents of the University of California.
33  */
34 
35 #pragma ident	"%Z%%M%	%I%	%E% SMI"
36 
37 #include <sys/types.h>
38 #include <sys/t_lock.h>
39 #include <sys/ksynch.h>
40 #include <sys/param.h>
41 #include <sys/time.h>
42 #include <sys/systm.h>
43 #include <sys/sysmacros.h>
44 #include <sys/resource.h>
45 #include <sys/signal.h>
46 #include <sys/cred.h>
47 #include <sys/user.h>
48 #include <sys/buf.h>
49 #include <sys/vfs.h>
50 #include <sys/vnode.h>
51 #include <sys/proc.h>
52 #include <sys/disp.h>
53 #include <sys/file.h>
54 #include <sys/fcntl.h>
55 #include <sys/flock.h>
56 #include <sys/atomic.h>
57 #include <sys/kmem.h>
58 #include <sys/uio.h>
59 #include <sys/dnlc.h>
60 #include <sys/conf.h>
61 #include <sys/mman.h>
62 #include <sys/pathname.h>
63 #include <sys/debug.h>
64 #include <sys/vmsystm.h>
65 #include <sys/cmn_err.h>
66 #include <sys/vtrace.h>
67 #include <sys/filio.h>
68 #include <sys/policy.h>
69 
70 #include <sys/fs/ufs_fs.h>
71 #include <sys/fs/ufs_lockfs.h>
72 #include <sys/fs/ufs_filio.h>
73 #include <sys/fs/ufs_inode.h>
74 #include <sys/fs/ufs_fsdir.h>
75 #include <sys/fs/ufs_quota.h>
76 #include <sys/fs/ufs_log.h>
77 #include <sys/fs/ufs_snap.h>
78 #include <sys/fs/ufs_trans.h>
79 #include <sys/fs/ufs_panic.h>
80 #include <sys/fs/ufs_bio.h>
81 #include <sys/dirent.h>		/* must be AFTER <sys/fs/fsdir.h>! */
82 #include <sys/errno.h>
83 #include <sys/fssnap_if.h>
84 #include <sys/unistd.h>
85 #include <sys/sunddi.h>
86 
87 #include <sys/filio.h>		/* _FIOIO */
88 
89 #include <vm/hat.h>
90 #include <vm/page.h>
91 #include <vm/pvn.h>
92 #include <vm/as.h>
93 #include <vm/seg.h>
94 #include <vm/seg_map.h>
95 #include <vm/seg_vn.h>
96 #include <vm/seg_kmem.h>
97 #include <vm/rm.h>
98 #include <sys/swap.h>
99 
100 #include <fs/fs_subr.h>
101 
102 static struct instats ins;
103 
104 static 	int ufs_getpage_ra(struct vnode *, u_offset_t, struct seg *, caddr_t);
105 static	int ufs_getpage_miss(struct vnode *, u_offset_t, size_t, struct seg *,
106 		caddr_t, struct page **, size_t, enum seg_rw, int);
107 static	int ufs_open(struct vnode **, int, struct cred *);
108 static	int ufs_close(struct vnode *, int, int, offset_t, struct cred *);
109 static	int ufs_read(struct vnode *, struct uio *, int, struct cred *,
110 			struct caller_context *);
111 static	int ufs_write(struct vnode *, struct uio *, int, struct cred *,
112 			struct caller_context *);
113 static	int ufs_ioctl(struct vnode *, int, intptr_t, int, struct cred *, int *);
114 static	int ufs_getattr(struct vnode *, struct vattr *, int, struct cred *);
115 static	int ufs_setattr(struct vnode *, struct vattr *, int, struct cred *,
116 			caller_context_t *);
117 static	int ufs_access(struct vnode *, int, int, struct cred *);
118 static	int ufs_lookup(struct vnode *, char *, struct vnode **,
119 		struct pathname *, int, struct vnode *, struct cred *);
120 static	int ufs_create(struct vnode *, char *, struct vattr *, enum vcexcl,
121 			int, struct vnode **, struct cred *, int);
122 static	int ufs_remove(struct vnode *, char *, struct cred *);
123 static	int ufs_link(struct vnode *, struct vnode *, char *, struct cred *);
124 static	int ufs_rename(struct vnode *, char *, struct vnode *, char *,
125 			struct cred *);
126 static	int ufs_mkdir(struct vnode *, char *, struct vattr *, struct vnode **,
127 			struct cred *);
128 static	int ufs_rmdir(struct vnode *, char *, struct vnode *, struct cred *);
129 static	int ufs_readdir(struct vnode *, struct uio *, struct cred *, int *);
130 static	int ufs_symlink(struct vnode *, char *, struct vattr *, char *,
131 			struct cred *);
132 static	int ufs_readlink(struct vnode *, struct uio *, struct cred *);
133 static	int ufs_fsync(struct vnode *, int, struct cred *);
134 static	void ufs_inactive(struct vnode *, struct cred *);
135 static	int ufs_fid(struct vnode *, struct fid *);
136 static	int ufs_rwlock(struct vnode *, int, caller_context_t *);
137 static	void ufs_rwunlock(struct vnode *, int, caller_context_t *);
138 static	int ufs_seek(struct vnode *, offset_t, offset_t *);
139 static	int ufs_frlock(struct vnode *, int, struct flock64 *, int, offset_t,
140 			struct flk_callback *, struct cred *);
141 static  int ufs_space(struct vnode *, int, struct flock64 *, int, offset_t,
142 		cred_t *, caller_context_t *);
143 static	int ufs_getpage(struct vnode *, offset_t, size_t, uint_t *,
144 		struct page **, size_t, struct seg *, caddr_t,
145 		enum seg_rw, struct cred *);
146 static	int ufs_putpage(struct vnode *, offset_t, size_t, int, struct cred *);
147 static	int ufs_putpages(struct vnode *, offset_t, size_t, int, struct cred *);
148 static	int ufs_map(struct vnode *, offset_t, struct as *, caddr_t *, size_t,
149 			uchar_t, uchar_t, uint_t, struct cred *);
150 static	int ufs_addmap(struct vnode *, offset_t, struct as *, caddr_t,  size_t,
151 			uchar_t, uchar_t, uint_t, struct cred *);
152 static	int ufs_delmap(struct vnode *, offset_t, struct as *, caddr_t,  size_t,
153 			uint_t, uint_t, uint_t, struct cred *);
154 static	int ufs_poll(vnode_t *, short, int, short *, struct pollhead **);
155 static	int ufs_dump(vnode_t *, caddr_t, int, int);
156 static	int ufs_l_pathconf(struct vnode *, int, ulong_t *, struct cred *);
157 static	int ufs_pageio(struct vnode *, struct page *, u_offset_t, size_t, int,
158 			struct cred *);
159 static	int ufs_dump(vnode_t *, caddr_t, int, int);
160 static	int ufs_dumpctl(vnode_t *, int, int *);
161 static	daddr32_t *save_dblks(struct inode *, struct ufsvfs *, daddr32_t *,
162 			daddr32_t *, int, int);
163 static	int ufs_getsecattr(struct vnode *, vsecattr_t *, int, struct cred *);
164 static	int ufs_setsecattr(struct vnode *, vsecattr_t *, int, struct cred *);
165 
166 /*
167  * For lockfs: ulockfs begin/end is now inlined in the ufs_xxx functions.
168  *
169  * XXX - ULOCKFS in fs_pathconf and ufs_ioctl is not inlined yet.
170  */
171 struct vnodeops *ufs_vnodeops;
172 
173 const fs_operation_def_t ufs_vnodeops_template[] = {
174 	VOPNAME_OPEN, ufs_open,	/* will not be blocked by lockfs */
175 	VOPNAME_CLOSE, ufs_close,	/* will not be blocked by lockfs */
176 	VOPNAME_READ, ufs_read,
177 	VOPNAME_WRITE, ufs_write,
178 	VOPNAME_IOCTL, ufs_ioctl,
179 	VOPNAME_GETATTR, ufs_getattr,
180 	VOPNAME_SETATTR, ufs_setattr,
181 	VOPNAME_ACCESS, ufs_access,
182 	VOPNAME_LOOKUP, ufs_lookup,
183 	VOPNAME_CREATE, ufs_create,
184 	VOPNAME_REMOVE, ufs_remove,
185 	VOPNAME_LINK, ufs_link,
186 	VOPNAME_RENAME, ufs_rename,
187 	VOPNAME_MKDIR, ufs_mkdir,
188 	VOPNAME_RMDIR, ufs_rmdir,
189 	VOPNAME_READDIR, ufs_readdir,
190 	VOPNAME_SYMLINK, ufs_symlink,
191 	VOPNAME_READLINK, ufs_readlink,
192 	VOPNAME_FSYNC, ufs_fsync,
193 	VOPNAME_INACTIVE, (fs_generic_func_p) ufs_inactive,  /* not blocked */
194 	VOPNAME_FID, ufs_fid,
195 	VOPNAME_RWLOCK, ufs_rwlock, /* not blocked */
196 	VOPNAME_RWUNLOCK, (fs_generic_func_p) ufs_rwunlock,  /* not blocked */
197 	VOPNAME_SEEK, ufs_seek,
198 	VOPNAME_FRLOCK, ufs_frlock,
199 	VOPNAME_SPACE, ufs_space,
200 	VOPNAME_GETPAGE, ufs_getpage,
201 	VOPNAME_PUTPAGE, ufs_putpage,
202 	VOPNAME_MAP, (fs_generic_func_p) ufs_map,
203 	VOPNAME_ADDMAP, (fs_generic_func_p) ufs_addmap,	/* not blocked */
204 	VOPNAME_DELMAP, ufs_delmap,	/* will not be blocked by lockfs */
205 	VOPNAME_POLL, (fs_generic_func_p) ufs_poll,	/* not blocked */
206 	VOPNAME_DUMP, ufs_dump,
207 	VOPNAME_PATHCONF, ufs_l_pathconf,
208 	VOPNAME_PAGEIO, ufs_pageio,
209 	VOPNAME_DUMPCTL, ufs_dumpctl,
210 	VOPNAME_GETSECATTR, ufs_getsecattr,
211 	VOPNAME_SETSECATTR, ufs_setsecattr,
212 	VOPNAME_VNEVENT, fs_vnevent_support,
213 	NULL, NULL
214 };
215 
216 #define	MAX_BACKFILE_COUNT	9999
217 
218 /*
219  * Created by ufs_dumpctl() to store a file's disk block info into memory.
220  * Used by ufs_dump() to dump data to disk directly.
221  */
222 struct dump {
223 	struct inode	*ip;		/* the file we contain */
224 	daddr_t		fsbs;		/* number of blocks stored */
225 	struct timeval32 time;		/* time stamp for the struct */
226 	daddr32_t 	dblk[1];	/* place holder for block info */
227 };
228 
229 static struct dump *dump_info = NULL;
230 
231 /*
232  * Previously there was no special action required for ordinary files.
233  * (Devices are handled through the device file system.)
234  * Now we support Large Files and Large File API requires open to
235  * fail if file is large.
236  * We could take care to prevent data corruption
237  * by doing an atomic check of size and truncate if file is opened with
238  * FTRUNC flag set but traditionally this is being done by the vfs/vnode
239  * layers. So taking care of truncation here is a change in the existing
240  * semantics of VOP_OPEN and therefore we chose not to implement any thing
241  * here. The check for the size of the file > 2GB is being done at the
242  * vfs layer in routine vn_open().
243  */
244 
245 /* ARGSUSED */
246 static int
247 ufs_open(struct vnode **vpp, int flag, struct cred *cr)
248 {
249 	TRACE_1(TR_FAC_UFS, TR_UFS_OPEN, "ufs_open:vpp %p", vpp);
250 	return (0);
251 }
252 
253 /*ARGSUSED*/
254 static int
255 ufs_close(struct vnode *vp, int flag, int count, offset_t offset,
256 	struct cred *cr)
257 {
258 	TRACE_1(TR_FAC_UFS, TR_UFS_CLOSE, "ufs_close:vp %p", vp);
259 
260 	cleanlocks(vp, ttoproc(curthread)->p_pid, 0);
261 	cleanshares(vp, ttoproc(curthread)->p_pid);
262 
263 	/*
264 	 * Push partially filled cluster at last close.
265 	 * ``last close'' is approximated because the dnlc
266 	 * may have a hold on the vnode.
267 	 * Checking for VBAD here will also act as a forced umount check.
268 	 */
269 	if (vp->v_count <= 2 && vp->v_type != VBAD) {
270 		struct inode *ip = VTOI(vp);
271 		if (ip->i_delaylen) {
272 			ins.in_poc.value.ul++;
273 			(void) ufs_putpages(vp, ip->i_delayoff, ip->i_delaylen,
274 					B_ASYNC | B_FREE, cr);
275 			ip->i_delaylen = 0;
276 		}
277 	}
278 
279 	return (0);
280 }
281 
282 /*ARGSUSED*/
283 static int
284 ufs_read(struct vnode *vp, struct uio *uiop, int ioflag, struct cred *cr,
285 	struct caller_context *ct)
286 {
287 	struct inode *ip = VTOI(vp);
288 	struct ufsvfs *ufsvfsp;
289 	struct ulockfs *ulp = NULL;
290 	int error = 0;
291 	int intrans = 0;
292 
293 	ASSERT(RW_READ_HELD(&ip->i_rwlock));
294 	TRACE_3(TR_FAC_UFS, TR_UFS_READ_START,
295 		"ufs_read_start:vp %p uiop %p ioflag %x",
296 		vp, uiop, ioflag);
297 
298 	/*
299 	 * Mandatory locking needs to be done before ufs_lockfs_begin()
300 	 * and TRANS_BEGIN_SYNC() calls since mandatory locks can sleep.
301 	 */
302 	if (MANDLOCK(vp, ip->i_mode)) {
303 		/*
304 		 * ufs_getattr ends up being called by chklock
305 		 */
306 		error = chklock(vp, FREAD, uiop->uio_loffset,
307 				uiop->uio_resid, uiop->uio_fmode, ct);
308 		if (error)
309 			goto out;
310 	}
311 
312 	ufsvfsp = ip->i_ufsvfs;
313 	error = ufs_lockfs_begin(ufsvfsp, &ulp, ULOCKFS_READ_MASK);
314 	if (error)
315 		goto out;
316 
317 	/*
318 	 * In the case that a directory is opened for reading as a file
319 	 * (eg "cat .") with the  O_RSYNC, O_SYNC and O_DSYNC flags set.
320 	 * The locking order had to be changed to avoid a deadlock with
321 	 * an update taking place on that directory at the same time.
322 	 */
323 	if ((ip->i_mode & IFMT) == IFDIR) {
324 
325 		rw_enter(&ip->i_contents, RW_READER);
326 		error = rdip(ip, uiop, ioflag, cr);
327 		rw_exit(&ip->i_contents);
328 
329 		if (error) {
330 			if (ulp)
331 				ufs_lockfs_end(ulp);
332 			goto out;
333 		}
334 
335 		if (ulp && (ioflag & FRSYNC) && (ioflag & (FSYNC | FDSYNC)) &&
336 		    TRANS_ISTRANS(ufsvfsp)) {
337 			rw_exit(&ip->i_rwlock);
338 			TRANS_BEGIN_SYNC(ufsvfsp, TOP_READ_SYNC, TOP_READ_SIZE,
339 			    error);
340 			ASSERT(!error);
341 			TRANS_END_SYNC(ufsvfsp, error, TOP_READ_SYNC,
342 			    TOP_READ_SIZE);
343 			rw_enter(&ip->i_rwlock, RW_READER);
344 		}
345 	} else {
346 		/*
347 		 * Only transact reads to files opened for sync-read and
348 		 * sync-write on a file system that is not write locked.
349 		 *
350 		 * The ``not write locked'' check prevents problems with
351 		 * enabling/disabling logging on a busy file system.  E.g.,
352 		 * logging exists at the beginning of the read but does not
353 		 * at the end.
354 		 *
355 		 */
356 		if (ulp && (ioflag & FRSYNC) && (ioflag & (FSYNC | FDSYNC)) &&
357 		    TRANS_ISTRANS(ufsvfsp)) {
358 			TRANS_BEGIN_SYNC(ufsvfsp, TOP_READ_SYNC, TOP_READ_SIZE,
359 			    error);
360 			ASSERT(!error);
361 			intrans = 1;
362 		}
363 
364 		rw_enter(&ip->i_contents, RW_READER);
365 		error = rdip(ip, uiop, ioflag, cr);
366 		rw_exit(&ip->i_contents);
367 
368 		if (intrans) {
369 			TRANS_END_SYNC(ufsvfsp, error, TOP_READ_SYNC,
370 			    TOP_READ_SIZE);
371 		}
372 	}
373 
374 	if (ulp) {
375 		ufs_lockfs_end(ulp);
376 	}
377 out:
378 
379 	TRACE_2(TR_FAC_UFS, TR_UFS_READ_END,
380 		"ufs_read_end:vp %p error %d", vp, error);
381 	return (error);
382 }
383 
384 extern	int	ufs_HW;		/* high water mark */
385 extern	int	ufs_LW;		/* low water mark */
386 int	ufs_WRITES = 1;		/* XXX - enable/disable */
387 int	ufs_throttles = 0;	/* throttling count */
388 int	ufs_allow_shared_writes = 1;	/* directio shared writes */
389 
390 static int
391 ufs_check_rewrite(struct inode *ip, struct uio *uiop, int ioflag)
392 {
393 
394 	/*
395 	 * Filter to determine if this request is suitable as a
396 	 * concurrent rewrite. This write must not allocate blocks
397 	 * by extending the file or filling in holes. No use trying
398 	 * through FSYNC descriptors as the inode will be synchronously
399 	 * updated after the write. The uio structure has not yet been
400 	 * checked for sanity, so assume nothing.
401 	 */
402 	return (((ip->i_mode & IFMT) == IFREG) && !(ioflag & FAPPEND) &&
403 		(uiop->uio_loffset >= (offset_t)0) &&
404 		(uiop->uio_loffset < ip->i_size) && (uiop->uio_resid > 0) &&
405 		((ip->i_size - uiop->uio_loffset) >= uiop->uio_resid) &&
406 		!(ioflag & FSYNC) && !bmap_has_holes(ip) &&
407 		ufs_allow_shared_writes);
408 }
409 
410 /*ARGSUSED*/
411 static int
412 ufs_write(struct vnode *vp, struct uio *uiop, int ioflag, cred_t *cr,
413 	caller_context_t *ct)
414 {
415 	struct inode *ip = VTOI(vp);
416 	struct ufsvfs *ufsvfsp;
417 	struct ulockfs *ulp;
418 	int retry = 1;
419 	int error, resv, resid = 0;
420 	int directio_status;
421 	int exclusive;
422 	long start_resid = uiop->uio_resid;
423 
424 	TRACE_3(TR_FAC_UFS, TR_UFS_WRITE_START,
425 		"ufs_write_start:vp %p uiop %p ioflag %x",
426 		vp, uiop, ioflag);
427 
428 	ASSERT(RW_LOCK_HELD(&ip->i_rwlock));
429 
430 retry_mandlock:
431 	/*
432 	 * Mandatory locking needs to be done before ufs_lockfs_begin()
433 	 * and TRANS_BEGIN_[A]SYNC() calls since mandatory locks can sleep.
434 	 * Check for forced unmounts normally done in ufs_lockfs_begin().
435 	 */
436 	if ((ufsvfsp = ip->i_ufsvfs) == NULL) {
437 		error = EIO;
438 		goto out;
439 	}
440 	if (MANDLOCK(vp, ip->i_mode)) {
441 
442 		ASSERT(RW_WRITE_HELD(&ip->i_rwlock));
443 
444 		/*
445 		 * ufs_getattr ends up being called by chklock
446 		 */
447 		error = chklock(vp, FWRITE, uiop->uio_loffset,
448 				uiop->uio_resid, uiop->uio_fmode, ct);
449 		if (error)
450 			goto out;
451 	}
452 
453 	/* i_rwlock can change in chklock */
454 	exclusive = rw_write_held(&ip->i_rwlock);
455 
456 	/*
457 	 * Check for fast-path special case of directio re-writes.
458 	 */
459 	if ((ip->i_flag & IDIRECTIO || ufsvfsp->vfs_forcedirectio) &&
460 	    !exclusive && ufs_check_rewrite(ip, uiop, ioflag)) {
461 
462 		error = ufs_lockfs_begin(ufsvfsp, &ulp, ULOCKFS_WRITE_MASK);
463 		if (error)
464 			goto out;
465 
466 		rw_enter(&ip->i_contents, RW_READER);
467 		error = ufs_directio_write(ip, uiop, ioflag, 1, cr,
468 			&directio_status);
469 		if (directio_status == DIRECTIO_SUCCESS) {
470 			uint_t i_flag_save;
471 
472 			if (start_resid != uiop->uio_resid)
473 				error = 0;
474 			/*
475 			 * Special treatment of access times for re-writes.
476 			 * If IMOD is not already set, then convert it
477 			 * to IMODACC for this operation. This defers
478 			 * entering a delta into the log until the inode
479 			 * is flushed. This mimics what is done for read
480 			 * operations and inode access time.
481 			 */
482 			mutex_enter(&ip->i_tlock);
483 			i_flag_save = ip->i_flag;
484 			ip->i_flag |= IUPD | ICHG;
485 			ip->i_seq++;
486 			ITIMES_NOLOCK(ip);
487 			if ((i_flag_save & IMOD) == 0) {
488 				ip->i_flag &= ~IMOD;
489 				ip->i_flag |= IMODACC;
490 			}
491 			mutex_exit(&ip->i_tlock);
492 			rw_exit(&ip->i_contents);
493 			if (ulp)
494 				ufs_lockfs_end(ulp);
495 			goto out;
496 		}
497 		rw_exit(&ip->i_contents);
498 		if (ulp)
499 			ufs_lockfs_end(ulp);
500 	}
501 
502 	if (!exclusive && !rw_tryupgrade(&ip->i_rwlock)) {
503 		rw_exit(&ip->i_rwlock);
504 		rw_enter(&ip->i_rwlock, RW_WRITER);
505 		/*
506 		 * Mandatory locking could have been enabled
507 		 * after dropping the i_rwlock.
508 		 */
509 		if (MANDLOCK(vp, ip->i_mode))
510 			goto retry_mandlock;
511 	}
512 
513 	error = ufs_lockfs_begin(ufsvfsp, &ulp, ULOCKFS_WRITE_MASK);
514 	if (error)
515 		goto out;
516 
517 	/*
518 	 * Amount of log space needed for this write
519 	 */
520 	TRANS_WRITE_RESV(ip, uiop, ulp, &resv, &resid);
521 
522 	/*
523 	 * Throttle writes.
524 	 */
525 	if (ufs_WRITES && (ip->i_writes > ufs_HW)) {
526 		mutex_enter(&ip->i_tlock);
527 		while (ip->i_writes > ufs_HW) {
528 			ufs_throttles++;
529 			cv_wait(&ip->i_wrcv, &ip->i_tlock);
530 		}
531 		mutex_exit(&ip->i_tlock);
532 	}
533 
534 	/*
535 	 * Enter Transaction
536 	 */
537 	if (ioflag & (FSYNC|FDSYNC)) {
538 		if (ulp) {
539 			int terr = 0;
540 			TRANS_BEGIN_SYNC(ufsvfsp, TOP_WRITE_SYNC, resv, terr);
541 			ASSERT(!terr);
542 		}
543 	} else {
544 		if (ulp)
545 			TRANS_BEGIN_ASYNC(ufsvfsp, TOP_WRITE, resv);
546 	}
547 
548 	/*
549 	 * Write the file
550 	 */
551 	rw_enter(&ufsvfsp->vfs_dqrwlock, RW_READER);
552 	rw_enter(&ip->i_contents, RW_WRITER);
553 	if ((ioflag & FAPPEND) != 0 && (ip->i_mode & IFMT) == IFREG) {
554 		/*
555 		 * In append mode start at end of file.
556 		 */
557 		uiop->uio_loffset = ip->i_size;
558 	}
559 
560 	/*
561 	 * Mild optimisation, don't call ufs_trans_write() unless we have to
562 	 * Also, suppress file system full messages if we will retry.
563 	 */
564 	if (retry)
565 		ip->i_flag |= IQUIET;
566 	if (resid) {
567 		TRANS_WRITE(ip, uiop, ioflag, error, ulp, cr, resv, resid);
568 	} else {
569 		error = wrip(ip, uiop, ioflag, cr);
570 	}
571 	ip->i_flag &= ~IQUIET;
572 
573 	rw_exit(&ip->i_contents);
574 	rw_exit(&ufsvfsp->vfs_dqrwlock);
575 
576 	/*
577 	 * Leave Transaction
578 	 */
579 	if (ulp) {
580 		if (ioflag & (FSYNC|FDSYNC)) {
581 			int terr = 0;
582 			TRANS_END_SYNC(ufsvfsp, terr, TOP_WRITE_SYNC, resv);
583 			if (error == 0)
584 				error = terr;
585 		} else {
586 			TRANS_END_ASYNC(ufsvfsp, TOP_WRITE, resv);
587 		}
588 		ufs_lockfs_end(ulp);
589 	}
590 out:
591 	if ((error == ENOSPC) && retry && TRANS_ISTRANS(ufsvfsp)) {
592 		/*
593 		 * Any blocks tied up in pending deletes?
594 		 */
595 		ufs_delete_drain_wait(ufsvfsp, 1);
596 		retry = 0;
597 		goto retry_mandlock;
598 	}
599 
600 	if (error == ENOSPC && (start_resid != uiop->uio_resid))
601 		error = 0;
602 
603 	TRACE_2(TR_FAC_UFS, TR_UFS_WRITE_END,
604 		"ufs_write_end:vp %p error %d", vp, error);
605 	return (error);
606 }
607 
608 /*
609  * Don't cache write blocks to files with the sticky bit set.
610  * Used to keep swap files from blowing the page cache on a server.
611  */
612 int stickyhack = 1;
613 
614 /*
615  * Free behind hacks.  The pager is busted.
616  * XXX - need to pass the information down to writedone() in a flag like B_SEQ
617  * or B_FREE_IF_TIGHT_ON_MEMORY.
618  */
619 int	freebehind = 1;
620 int	smallfile = 32 * 1024;
621 
622 /*
623  * While we should, in most cases, cache the pages for write, we
624  * may also want to cache the pages for read as long as they are
625  * frequently re-usable.
626  *
627  * If cache_read_ahead = 1, the pages for read will go to the tail
628  * of the cache list when they are released, otherwise go to the head.
629  */
630 int	cache_read_ahead = 0;
631 
632 /*
633  * wrip does the real work of write requests for ufs.
634  */
635 int
636 wrip(struct inode *ip, struct uio *uio, int ioflag, struct cred *cr)
637 {
638 	rlim64_t limit = uio->uio_llimit;
639 	u_offset_t off;
640 	u_offset_t old_i_size;
641 	struct fs *fs;
642 	struct vnode *vp;
643 	struct ufsvfs *ufsvfsp;
644 	caddr_t base;
645 	long start_resid = uio->uio_resid;	/* save starting resid */
646 	long premove_resid;			/* resid before uiomove() */
647 	uint_t flags;
648 	int newpage;
649 	int iupdat_flag, directio_status;
650 	int n, on, mapon;
651 	int error, pagecreate;
652 	int do_dqrwlock;		/* drop/reacquire vfs_dqrwlock */
653 	int32_t	iblocks;
654 	int	new_iblocks;
655 
656 	/*
657 	 * ip->i_size is incremented before the uiomove
658 	 * is done on a write.  If the move fails (bad user
659 	 * address) reset ip->i_size.
660 	 * The better way would be to increment ip->i_size
661 	 * only if the uiomove succeeds.
662 	 */
663 	int i_size_changed = 0;
664 	o_mode_t type;
665 	int i_seq_needed = 0;
666 
667 	vp = ITOV(ip);
668 
669 	/*
670 	 * check for forced unmount - should not happen as
671 	 * the request passed the lockfs checks.
672 	 */
673 	if ((ufsvfsp = ip->i_ufsvfs) == NULL)
674 		return (EIO);
675 
676 	fs = ip->i_fs;
677 
678 	TRACE_1(TR_FAC_UFS, TR_UFS_RWIP_START,
679 		"ufs_wrip_start:vp %p", vp);
680 
681 	ASSERT(RW_WRITE_HELD(&ip->i_contents));
682 
683 	/* check for valid filetype */
684 	type = ip->i_mode & IFMT;
685 	if ((type != IFREG) && (type != IFDIR) && (type != IFATTRDIR) &&
686 	    (type != IFLNK) && (type != IFSHAD)) {
687 		return (EIO);
688 	}
689 
690 	/*
691 	 * the actual limit of UFS file size
692 	 * is UFS_MAXOFFSET_T
693 	 */
694 	if (limit == RLIM64_INFINITY || limit > MAXOFFSET_T)
695 		limit = MAXOFFSET_T;
696 
697 	if (uio->uio_loffset >= limit) {
698 		proc_t *p = ttoproc(curthread);
699 
700 		TRACE_2(TR_FAC_UFS, TR_UFS_RWIP_END,
701 			"ufs_wrip_end:vp %p error %d", vp, EINVAL);
702 
703 		mutex_enter(&p->p_lock);
704 		(void) rctl_action(rctlproc_legacy[RLIMIT_FSIZE], p->p_rctls,
705 		    p, RCA_UNSAFE_SIGINFO);
706 		mutex_exit(&p->p_lock);
707 		return (EFBIG);
708 	}
709 
710 	/*
711 	 * if largefiles are disallowed, the limit is
712 	 * the pre-largefiles value of 2GB
713 	 */
714 	if (ufsvfsp->vfs_lfflags & UFS_LARGEFILES)
715 		limit = MIN(UFS_MAXOFFSET_T, limit);
716 	else
717 		limit = MIN(MAXOFF32_T, limit);
718 
719 	if (uio->uio_loffset < (offset_t)0) {
720 		TRACE_2(TR_FAC_UFS, TR_UFS_RWIP_END,
721 			"ufs_wrip_end:vp %p error %d", vp, EINVAL);
722 		return (EINVAL);
723 	}
724 	if (uio->uio_resid == 0) {
725 		TRACE_2(TR_FAC_UFS, TR_UFS_RWIP_END,
726 			"ufs_wrip_end:vp %p error %d", vp, 0);
727 		return (0);
728 	}
729 
730 	if (uio->uio_loffset >= limit)
731 		return (EFBIG);
732 
733 	ip->i_flag |= INOACC;	/* don't update ref time in getpage */
734 
735 	if (ioflag & (FSYNC|FDSYNC)) {
736 		ip->i_flag |= ISYNC;
737 		iupdat_flag = 1;
738 	}
739 	/*
740 	 * Try to go direct
741 	 */
742 	if (ip->i_flag & IDIRECTIO || ufsvfsp->vfs_forcedirectio) {
743 		uio->uio_llimit = limit;
744 		error = ufs_directio_write(ip, uio, ioflag, 0, cr,
745 			&directio_status);
746 		/*
747 		 * If ufs_directio wrote to the file or set the flags,
748 		 * we need to update i_seq, but it may be deferred.
749 		 */
750 		if (start_resid != uio->uio_resid ||
751 					(ip->i_flag & (ICHG|IUPD))) {
752 			i_seq_needed = 1;
753 			ip->i_flag |= ISEQ;
754 		}
755 		if (directio_status == DIRECTIO_SUCCESS)
756 			goto out;
757 	}
758 
759 	/*
760 	 * Behavior with respect to dropping/reacquiring vfs_dqrwlock:
761 	 *
762 	 * o shadow inodes: vfs_dqrwlock is not held at all
763 	 * o quota updates: vfs_dqrwlock is read or write held
764 	 * o other updates: vfs_dqrwlock is read held
765 	 *
766 	 * The first case is the only one where we do not hold
767 	 * vfs_dqrwlock at all while entering wrip().
768 	 * We must make sure not to downgrade/drop vfs_dqrwlock if we
769 	 * have it as writer, i.e. if we are updating the quota inode.
770 	 * There is no potential deadlock scenario in this case as
771 	 * ufs_getpage() takes care of this and avoids reacquiring
772 	 * vfs_dqrwlock in that case.
773 	 *
774 	 * This check is done here since the above conditions do not change
775 	 * and we possibly loop below, so save a few cycles.
776 	 */
777 	if ((type == IFSHAD) ||
778 		(rw_owner(&ufsvfsp->vfs_dqrwlock) == curthread)) {
779 			do_dqrwlock = 0;
780 	} else {
781 		do_dqrwlock = 1;
782 	}
783 
784 	/*
785 	 * Large Files: We cast MAXBMASK to offset_t
786 	 * inorder to mask out the higher bits. Since offset_t
787 	 * is a signed value, the high order bit set in MAXBMASK
788 	 * value makes it do the right thing by having all bits 1
789 	 * in the higher word. May be removed for _SOLARIS64_.
790 	 */
791 
792 	fs = ip->i_fs;
793 	do {
794 		u_offset_t uoff = uio->uio_loffset;
795 		off = uoff & (offset_t)MAXBMASK;
796 		mapon = (int)(uoff & (offset_t)MAXBOFFSET);
797 		on = (int)blkoff(fs, uoff);
798 		n = (int)MIN(fs->fs_bsize - on, uio->uio_resid);
799 		new_iblocks = 1;
800 
801 		if (type == IFREG && uoff + n >= limit) {
802 			if (uoff >= limit) {
803 				error = EFBIG;
804 				goto out;
805 			}
806 			/*
807 			 * since uoff + n >= limit,
808 			 * therefore n >= limit - uoff, and n is an int
809 			 * so it is safe to cast it to an int
810 			 */
811 			n = (int)(limit - (rlim64_t)uoff);
812 		}
813 		if (uoff + n > ip->i_size) {
814 			/*
815 			 * We are extending the length of the file.
816 			 * bmap is used so that we are sure that
817 			 * if we need to allocate new blocks, that it
818 			 * is done here before we up the file size.
819 			 */
820 			error = bmap_write(ip, uoff, (int)(on + n),
821 							mapon == 0, cr);
822 			/*
823 			 * bmap_write never drops i_contents so if
824 			 * the flags are set it changed the file.
825 			 */
826 			if (ip->i_flag & (ICHG|IUPD)) {
827 				i_seq_needed = 1;
828 				ip->i_flag |= ISEQ;
829 			}
830 			if (error)
831 				break;
832 			/*
833 			 * There is a window of vulnerability here.
834 			 * The sequence of operations: allocate file
835 			 * system blocks, uiomove the data into pages,
836 			 * and then update the size of the file in the
837 			 * inode, must happen atomically.  However, due
838 			 * to current locking constraints, this can not
839 			 * be done.
840 			 */
841 			ASSERT(ip->i_writer == NULL);
842 			ip->i_writer = curthread;
843 			i_size_changed = 1;
844 			/*
845 			 * If we are writing from the beginning of
846 			 * the mapping, we can just create the
847 			 * pages without having to read them.
848 			 */
849 			pagecreate = (mapon == 0);
850 		} else if (n == MAXBSIZE) {
851 			/*
852 			 * Going to do a whole mappings worth,
853 			 * so we can just create the pages w/o
854 			 * having to read them in.  But before
855 			 * we do that, we need to make sure any
856 			 * needed blocks are allocated first.
857 			 */
858 			iblocks = ip->i_blocks;
859 			error = bmap_write(ip, uoff, (int)(on + n), 1, cr);
860 			/*
861 			 * bmap_write never drops i_contents so if
862 			 * the flags are set it changed the file.
863 			 */
864 			if (ip->i_flag & (ICHG|IUPD)) {
865 				i_seq_needed = 1;
866 				ip->i_flag |= ISEQ;
867 			}
868 			if (error)
869 				break;
870 			pagecreate = 1;
871 			/*
872 			 * check if the new created page needed the
873 			 * allocation of new disk blocks.
874 			 */
875 			if (iblocks == ip->i_blocks)
876 				new_iblocks = 0; /* no new blocks allocated */
877 		} else {
878 			pagecreate = 0;
879 			/*
880 			 * In sync mode flush the indirect blocks which
881 			 * may have been allocated and not written on
882 			 * disk. In above cases bmap_write will allocate
883 			 * in sync mode.
884 			 */
885 			if (ioflag & (FSYNC|FDSYNC)) {
886 				error = ufs_indirblk_sync(ip, uoff);
887 				if (error)
888 					break;
889 			}
890 		}
891 
892 		/*
893 		 * At this point we can enter ufs_getpage() in one
894 		 * of two ways:
895 		 * 1) segmap_getmapflt() calls ufs_getpage() when the
896 		 *    forcefault parameter is true (pagecreate == 0)
897 		 * 2) uiomove() causes a page fault.
898 		 *
899 		 * We have to drop the contents lock to prevent the VM
900 		 * system from trying to reaquire it in ufs_getpage()
901 		 * should the uiomove cause a pagefault.
902 		 *
903 		 * We have to drop the reader vfs_dqrwlock here as well.
904 		 */
905 		rw_exit(&ip->i_contents);
906 		if (do_dqrwlock) {
907 			ASSERT(RW_LOCK_HELD(&ufsvfsp->vfs_dqrwlock));
908 			ASSERT(!(RW_WRITE_HELD(&ufsvfsp->vfs_dqrwlock)));
909 			rw_exit(&ufsvfsp->vfs_dqrwlock);
910 		}
911 
912 		base = segmap_getmapflt(segkmap, vp, (off + mapon),
913 					(uint_t)n, !pagecreate, S_WRITE);
914 
915 		/*
916 		 * segmap_pagecreate() returns 1 if it calls
917 		 * page_create_va() to allocate any pages.
918 		 */
919 		newpage = 0;
920 
921 		if (pagecreate)
922 			newpage = segmap_pagecreate(segkmap, base,
923 			    (size_t)n, 0);
924 
925 		premove_resid = uio->uio_resid;
926 		error = uiomove(base + mapon, (long)n, UIO_WRITE, uio);
927 
928 		/*
929 		 * If "newpage" is set, then a new page was created and it
930 		 * does not contain valid data, so it needs to be initialized
931 		 * at this point.
932 		 * Otherwise the page contains old data, which was overwritten
933 		 * partially or as a whole in uiomove.
934 		 * If there is only one iovec structure within uio, then
935 		 * on error uiomove will not be able to update uio->uio_loffset
936 		 * and we would zero the whole page here!
937 		 *
938 		 * If uiomove fails because of an error, the old valid data
939 		 * is kept instead of filling the rest of the page with zero's.
940 		 */
941 		if (newpage &&
942 		    uio->uio_loffset < roundup(off + mapon + n, PAGESIZE)) {
943 			/*
944 			 * We created pages w/o initializing them completely,
945 			 * thus we need to zero the part that wasn't set up.
946 			 * This happens on most EOF write cases and if
947 			 * we had some sort of error during the uiomove.
948 			 */
949 			int nzero, nmoved;
950 
951 			nmoved = (int)(uio->uio_loffset - (off + mapon));
952 			ASSERT(nmoved >= 0 && nmoved <= n);
953 			nzero = roundup(on + n, PAGESIZE) - nmoved;
954 			ASSERT(nzero > 0 && mapon + nmoved + nzero <= MAXBSIZE);
955 			(void) kzero(base + mapon + nmoved, (uint_t)nzero);
956 		}
957 
958 		/*
959 		 * Unlock the pages allocated by page_create_va()
960 		 * in segmap_pagecreate()
961 		 */
962 		if (newpage)
963 			segmap_pageunlock(segkmap, base, (size_t)n, S_WRITE);
964 
965 		/*
966 		 * If the size of the file changed, then update the
967 		 * size field in the inode now.  This can't be done
968 		 * before the call to segmap_pageunlock or there is
969 		 * a potential deadlock with callers to ufs_putpage().
970 		 * They will be holding i_contents and trying to lock
971 		 * a page, while this thread is holding a page locked
972 		 * and trying to acquire i_contents.
973 		 */
974 		if (i_size_changed) {
975 			rw_enter(&ip->i_contents, RW_WRITER);
976 			old_i_size = ip->i_size;
977 			UFS_SET_ISIZE(uoff + n, ip);
978 			TRANS_INODE(ufsvfsp, ip);
979 			/*
980 			 * file has grown larger than 2GB. Set flag
981 			 * in superblock to indicate this, if it
982 			 * is not already set.
983 			 */
984 			if ((ip->i_size > MAXOFF32_T) &&
985 			    !(fs->fs_flags & FSLARGEFILES)) {
986 				ASSERT(ufsvfsp->vfs_lfflags & UFS_LARGEFILES);
987 				mutex_enter(&ufsvfsp->vfs_lock);
988 				fs->fs_flags |= FSLARGEFILES;
989 				ufs_sbwrite(ufsvfsp);
990 				mutex_exit(&ufsvfsp->vfs_lock);
991 			}
992 			mutex_enter(&ip->i_tlock);
993 			ip->i_writer = NULL;
994 			cv_broadcast(&ip->i_wrcv);
995 			mutex_exit(&ip->i_tlock);
996 			rw_exit(&ip->i_contents);
997 		}
998 
999 		if (error) {
1000 			/*
1001 			 * If we failed on a write, we may have already
1002 			 * allocated file blocks as well as pages.  It's
1003 			 * hard to undo the block allocation, but we must
1004 			 * be sure to invalidate any pages that may have
1005 			 * been allocated.
1006 			 *
1007 			 * If the page was created without initialization
1008 			 * then we must check if it should be possible
1009 			 * to destroy the new page and to keep the old data
1010 			 * on the disk.
1011 			 *
1012 			 * It is possible to destroy the page without
1013 			 * having to write back its contents only when
1014 			 * - the size of the file keeps unchanged
1015 			 * - bmap_write() did not allocate new disk blocks
1016 			 *   it is possible to create big files using "seek" and
1017 			 *   write to the end of the file. A "write" to a
1018 			 *   position before the end of the file would not
1019 			 *   change the size of the file but it would allocate
1020 			 *   new disk blocks.
1021 			 * - uiomove intended to overwrite the whole page.
1022 			 * - a new page was created (newpage == 1).
1023 			 */
1024 
1025 			if (i_size_changed == 0 && new_iblocks == 0 &&
1026 			    newpage) {
1027 
1028 				/* unwind what uiomove eventually last did */
1029 				uio->uio_resid = premove_resid;
1030 
1031 				/*
1032 				 * destroy the page, do not write ambiguous
1033 				 * data to the disk.
1034 				 */
1035 				flags = SM_DESTROY;
1036 			} else {
1037 				/*
1038 				 * write the page back to the disk, if dirty,
1039 				 * and remove the page from the cache.
1040 				 */
1041 				flags = SM_INVAL;
1042 			}
1043 			(void) segmap_release(segkmap, base, flags);
1044 		} else {
1045 			flags = 0;
1046 			/*
1047 			 * Force write back for synchronous write cases.
1048 			 */
1049 			if ((ioflag & (FSYNC|FDSYNC)) || type == IFDIR) {
1050 				/*
1051 				 * If the sticky bit is set but the
1052 				 * execute bit is not set, we do a
1053 				 * synchronous write back and free
1054 				 * the page when done.  We set up swap
1055 				 * files to be handled this way to
1056 				 * prevent servers from keeping around
1057 				 * the client's swap pages too long.
1058 				 * XXX - there ought to be a better way.
1059 				 */
1060 				if (IS_SWAPVP(vp)) {
1061 					flags = SM_WRITE | SM_FREE |
1062 					    SM_DONTNEED;
1063 					iupdat_flag = 0;
1064 				} else {
1065 					flags = SM_WRITE;
1066 				}
1067 			} else if (n + on == MAXBSIZE || IS_SWAPVP(vp)) {
1068 				/*
1069 				 * Have written a whole block.
1070 				 * Start an asynchronous write and
1071 				 * mark the buffer to indicate that
1072 				 * it won't be needed again soon.
1073 				 */
1074 				flags = SM_WRITE | SM_ASYNC | SM_DONTNEED;
1075 			}
1076 			error = segmap_release(segkmap, base, flags);
1077 			/*
1078 			 * If the operation failed and is synchronous,
1079 			 * then we need to unwind what uiomove() last
1080 			 * did so we can potentially return an error to
1081 			 * the caller.  If this write operation was
1082 			 * done in two pieces and the first succeeded,
1083 			 * then we won't return an error for the second
1084 			 * piece that failed.  However, we only want to
1085 			 * return a resid value that reflects what was
1086 			 * really done.
1087 			 *
1088 			 * Failures for non-synchronous operations can
1089 			 * be ignored since the page subsystem will
1090 			 * retry the operation until it succeeds or the
1091 			 * file system is unmounted.
1092 			 */
1093 			if (error) {
1094 				if ((ioflag & (FSYNC | FDSYNC)) ||
1095 				    type == IFDIR) {
1096 					uio->uio_resid = premove_resid;
1097 				} else {
1098 					error = 0;
1099 				}
1100 			}
1101 		}
1102 
1103 		/*
1104 		 * Re-acquire contents lock.
1105 		 * If it was dropped, reacquire reader vfs_dqrwlock as well.
1106 		 */
1107 		if (do_dqrwlock)
1108 			rw_enter(&ufsvfsp->vfs_dqrwlock, RW_READER);
1109 		rw_enter(&ip->i_contents, RW_WRITER);
1110 
1111 		/*
1112 		 * If the uiomove() failed or if a synchronous
1113 		 * page push failed, fix up i_size.
1114 		 */
1115 		if (error) {
1116 			if (i_size_changed) {
1117 				/*
1118 				 * The uiomove failed, and we
1119 				 * allocated blocks,so get rid
1120 				 * of them.
1121 				 */
1122 				(void) ufs_itrunc(ip, old_i_size, 0, cr);
1123 			}
1124 		} else {
1125 			/*
1126 			 * XXX - Can this be out of the loop?
1127 			 */
1128 			ip->i_flag |= IUPD | ICHG;
1129 			/*
1130 			 * Only do one increase of i_seq for multiple
1131 			 * pieces.  Because we drop locks, record
1132 			 * the fact that we changed the timestamp and
1133 			 * are deferring the increase in case another thread
1134 			 * pushes our timestamp update.
1135 			 */
1136 			i_seq_needed = 1;
1137 			ip->i_flag |= ISEQ;
1138 			if (i_size_changed)
1139 				ip->i_flag |= IATTCHG;
1140 			if ((ip->i_mode & (IEXEC | (IEXEC >> 3) |
1141 			    (IEXEC >> 6))) != 0 &&
1142 			    (ip->i_mode & (ISUID | ISGID)) != 0 &&
1143 			    secpolicy_vnode_setid_retain(cr,
1144 			    (ip->i_mode & ISUID) != 0 && ip->i_uid == 0) != 0) {
1145 				/*
1146 				 * Clear Set-UID & Set-GID bits on
1147 				 * successful write if not privileged
1148 				 * and at least one of the execute bits
1149 				 * is set.  If we always clear Set-GID,
1150 				 * mandatory file and record locking is
1151 				 * unuseable.
1152 				 */
1153 				ip->i_mode &= ~(ISUID | ISGID);
1154 			}
1155 		}
1156 		TRANS_INODE(ufsvfsp, ip);
1157 	} while (error == 0 && uio->uio_resid > 0 && n != 0);
1158 
1159 out:
1160 	/*
1161 	 * Make sure i_seq is increased at least once per write
1162 	 */
1163 	if (i_seq_needed) {
1164 		ip->i_seq++;
1165 		ip->i_flag &= ~ISEQ;	/* no longer deferred */
1166 	}
1167 
1168 	/*
1169 	 * Inode is updated according to this table -
1170 	 *
1171 	 *   FSYNC	  FDSYNC(posix.4)
1172 	 *   --------------------------
1173 	 *   always@	  IATTCHG|IBDWRITE
1174 	 *
1175 	 * @ - 	If we are doing synchronous write the only time we should
1176 	 *	not be sync'ing the ip here is if we have the stickyhack
1177 	 *	activated, the file is marked with the sticky bit and
1178 	 *	no exec bit, the file length has not been changed and
1179 	 *	no new blocks have been allocated during this write.
1180 	 */
1181 
1182 	if ((ip->i_flag & ISYNC) != 0) {
1183 		/*
1184 		 * we have eliminated nosync
1185 		 */
1186 		if ((ip->i_flag & (IATTCHG|IBDWRITE)) ||
1187 			((ioflag & FSYNC) && iupdat_flag)) {
1188 			ufs_iupdat(ip, 1);
1189 		}
1190 	}
1191 
1192 	/*
1193 	 * If we've already done a partial-write, terminate
1194 	 * the write but return no error unless the error is ENOSPC
1195 	 * because the caller can detect this and free resources and
1196 	 * try again.
1197 	 */
1198 	if ((start_resid != uio->uio_resid) && (error != ENOSPC))
1199 		error = 0;
1200 
1201 	ip->i_flag &= ~(INOACC | ISYNC);
1202 	ITIMES_NOLOCK(ip);
1203 	TRACE_2(TR_FAC_UFS, TR_UFS_RWIP_END,
1204 		"ufs_wrip_end:vp %p error %d", vp, error);
1205 	return (error);
1206 }
1207 
1208 /*
1209  * rdip does the real work of read requests for ufs.
1210  */
1211 int
1212 rdip(struct inode *ip, struct uio *uio, int ioflag, cred_t *cr)
1213 {
1214 	u_offset_t off;
1215 	caddr_t base;
1216 	struct fs *fs;
1217 	struct ufsvfs *ufsvfsp;
1218 	struct vnode *vp;
1219 	long oresid = uio->uio_resid;
1220 	u_offset_t n, on, mapon;
1221 	int error = 0;
1222 	int doupdate = 1;
1223 	uint_t flags, cachemode;
1224 	int dofree, directio_status;
1225 	krw_t rwtype;
1226 	o_mode_t type;
1227 
1228 	vp = ITOV(ip);
1229 
1230 	TRACE_1(TR_FAC_UFS, TR_UFS_RWIP_START,
1231 		"ufs_rdip_start:vp %p", vp);
1232 
1233 	ASSERT(RW_LOCK_HELD(&ip->i_contents));
1234 
1235 	ufsvfsp = ip->i_ufsvfs;
1236 
1237 	if (ufsvfsp == NULL)
1238 		return (EIO);
1239 
1240 	fs = ufsvfsp->vfs_fs;
1241 
1242 	/* check for valid filetype */
1243 	type = ip->i_mode & IFMT;
1244 	if ((type != IFREG) && (type != IFDIR) && (type != IFATTRDIR) &&
1245 	    (type != IFLNK) && (type != IFSHAD)) {
1246 		return (EIO);
1247 	}
1248 
1249 	if (uio->uio_loffset > UFS_MAXOFFSET_T) {
1250 		TRACE_2(TR_FAC_UFS, TR_UFS_RWIP_END,
1251 			"ufs_rdip_end:vp %p error %d", vp, EINVAL);
1252 		error = 0;
1253 		goto out;
1254 	}
1255 	if (uio->uio_loffset < (offset_t)0) {
1256 		TRACE_2(TR_FAC_UFS, TR_UFS_RWIP_END,
1257 			"ufs_rdip_end:vp %p error %d", vp, EINVAL);
1258 		return (EINVAL);
1259 	}
1260 	if (uio->uio_resid == 0) {
1261 		TRACE_2(TR_FAC_UFS, TR_UFS_RWIP_END,
1262 			"ufs_rdip_end:vp %p error %d", vp, 0);
1263 		return (0);
1264 	}
1265 
1266 	if (!ULOCKFS_IS_NOIACC(ITOUL(ip)) && (fs->fs_ronly == 0) &&
1267 		(!ufsvfsp->vfs_noatime)) {
1268 		mutex_enter(&ip->i_tlock);
1269 		ip->i_flag |= IACC;
1270 		mutex_exit(&ip->i_tlock);
1271 	}
1272 	/*
1273 	 * Try to go direct
1274 	 */
1275 	if (ip->i_flag & IDIRECTIO || ufsvfsp->vfs_forcedirectio) {
1276 		error = ufs_directio_read(ip, uio, cr, &directio_status);
1277 		if (directio_status == DIRECTIO_SUCCESS)
1278 			goto out;
1279 	}
1280 
1281 	rwtype = (rw_write_held(&ip->i_contents)?RW_WRITER:RW_READER);
1282 
1283 	/*
1284 	 * If cache_read_ahead is enabled, we will
1285 	 * release the pages at the tail of the cache
1286 	 * list, otherwise we will put them at the head.
1287 	 */
1288 	if (cache_read_ahead)
1289 		cachemode = SM_FREE | SM_ASYNC;
1290 	else
1291 		cachemode = SM_FREE | SM_DONTNEED | SM_ASYNC;
1292 
1293 	do {
1294 		offset_t diff;
1295 		u_offset_t uoff = uio->uio_loffset;
1296 		off = uoff & (offset_t)MAXBMASK;
1297 		mapon = (u_offset_t)(uoff & (offset_t)MAXBOFFSET);
1298 		on = (u_offset_t)blkoff(fs, uoff);
1299 		n = MIN((u_offset_t)fs->fs_bsize - on,
1300 			(u_offset_t)uio->uio_resid);
1301 
1302 		diff = ip->i_size - uoff;
1303 
1304 		if (diff <= (offset_t)0) {
1305 			error = 0;
1306 			goto out;
1307 		}
1308 		if (diff < (offset_t)n)
1309 			n = (int)diff;
1310 		dofree = freebehind &&
1311 		    ip->i_nextr == (off & PAGEMASK) && off > smallfile;
1312 
1313 		/*
1314 		 * At this point we can enter ufs_getpage() in one of two
1315 		 * ways:
1316 		 * 1) segmap_getmapflt() calls ufs_getpage() when the
1317 		 *    forcefault parameter is true (value of 1 is passed)
1318 		 * 2) uiomove() causes a page fault.
1319 		 *
1320 		 * We cannot hold onto an i_contents reader lock without
1321 		 * risking deadlock in ufs_getpage() so drop a reader lock.
1322 		 * The ufs_getpage() dolock logic already allows for a
1323 		 * thread holding i_contents as writer to work properly
1324 		 * so we keep a writer lock.
1325 		 */
1326 		if (rwtype == RW_READER)
1327 			rw_exit(&ip->i_contents);
1328 		base = segmap_getmapflt(segkmap, vp, (off + mapon),
1329 					(uint_t)n, 1, S_READ);
1330 
1331 		error = uiomove(base + mapon, (long)n, UIO_READ, uio);
1332 
1333 		flags = 0;
1334 		if (!error) {
1335 			/*
1336 			 * If reading sequential we won't need
1337 			 * this buffer again soon.
1338 			 */
1339 			if (dofree) {
1340 				flags = cachemode;
1341 			}
1342 			/*
1343 			 * In POSIX SYNC (FSYNC and FDSYNC) read mode,
1344 			 * we want to make sure that the page which has
1345 			 * been read, is written on disk if it is dirty.
1346 			 * And corresponding indirect blocks should also
1347 			 * be flushed out.
1348 			 */
1349 			if ((ioflag & FRSYNC) && (ioflag & (FSYNC|FDSYNC))) {
1350 				flags &= ~SM_ASYNC;
1351 				flags |= SM_WRITE;
1352 			}
1353 			error = segmap_release(segkmap, base, flags);
1354 		} else
1355 			(void) segmap_release(segkmap, base, flags);
1356 
1357 		if (rwtype == RW_READER)
1358 			rw_enter(&ip->i_contents, rwtype);
1359 	} while (error == 0 && uio->uio_resid > 0 && n != 0);
1360 out:
1361 	/*
1362 	 * Inode is updated according to this table if FRSYNC is set.
1363 	 *
1364 	 *   FSYNC	  FDSYNC(posix.4)
1365 	 *   --------------------------
1366 	 *   always	  IATTCHG|IBDWRITE
1367 	 */
1368 	/*
1369 	 * The inode is not updated if we're logging and the inode is a
1370 	 * directory with FRSYNC, FSYNC and FDSYNC flags set.
1371 	 */
1372 	if (ioflag & FRSYNC) {
1373 		if (TRANS_ISTRANS(ufsvfsp) && ((ip->i_mode & IFMT) == IFDIR)) {
1374 				doupdate = 0;
1375 		}
1376 		if (doupdate) {
1377 			if ((ioflag & FSYNC) ||
1378 			    ((ioflag & FDSYNC) &&
1379 			    (ip->i_flag & (IATTCHG|IBDWRITE)))) {
1380 				ufs_iupdat(ip, 1);
1381 			}
1382 		}
1383 	}
1384 	/*
1385 	 * If we've already done a partial read, terminate
1386 	 * the read but return no error.
1387 	 */
1388 	if (oresid != uio->uio_resid)
1389 		error = 0;
1390 	ITIMES(ip);
1391 
1392 	TRACE_2(TR_FAC_UFS, TR_UFS_RWIP_END,
1393 		"ufs_rdip_end:vp %p error %d", vp, error);
1394 	return (error);
1395 }
1396 
1397 /* ARGSUSED */
1398 static int
1399 ufs_ioctl(
1400 	struct vnode	*vp,
1401 	int		cmd,
1402 	intptr_t	arg,
1403 	int		flag,
1404 	struct cred	*cr,
1405 	int		*rvalp)
1406 {
1407 	struct lockfs	lockfs, lockfs_out;
1408 	struct ufsvfs	*ufsvfsp = VTOI(vp)->i_ufsvfs;
1409 	char		*comment, *original_comment;
1410 	struct fs	*fs;
1411 	struct ulockfs	*ulp;
1412 	offset_t	off;
1413 	extern int	maxphys;
1414 	int		error;
1415 	int		issync;
1416 	int		trans_size;
1417 
1418 
1419 	/*
1420 	 * forcibly unmounted
1421 	 */
1422 	if (ufsvfsp == NULL) {
1423 		return (EIO);
1424 	}
1425 
1426 	fs = ufsvfsp->vfs_fs;
1427 
1428 	if (cmd == Q_QUOTACTL) {
1429 		error = ufs_lockfs_begin(ufsvfsp, &ulp, ULOCKFS_QUOTA_MASK);
1430 		if (error)
1431 			return (error);
1432 
1433 		if (ulp) {
1434 			TRANS_BEGIN_ASYNC(ufsvfsp, TOP_QUOTA,
1435 						TOP_SETQUOTA_SIZE(fs));
1436 		}
1437 
1438 		error = quotactl(vp, arg, flag, cr);
1439 
1440 		if (ulp) {
1441 			TRANS_END_ASYNC(ufsvfsp, TOP_QUOTA,
1442 						TOP_SETQUOTA_SIZE(fs));
1443 			ufs_lockfs_end(ulp);
1444 		}
1445 		return (error);
1446 	}
1447 
1448 	switch (cmd) {
1449 		case _FIOLFS:
1450 			/*
1451 			 * file system locking
1452 			 */
1453 			if (secpolicy_fs_config(cr, ufsvfsp->vfs_vfs) != 0)
1454 				return (EPERM);
1455 
1456 			if ((flag & DATAMODEL_MASK) == DATAMODEL_NATIVE) {
1457 				if (copyin((caddr_t)arg, &lockfs,
1458 						sizeof (struct lockfs)))
1459 					return (EFAULT);
1460 			}
1461 #ifdef _SYSCALL32_IMPL
1462 			else {
1463 				struct lockfs32	lockfs32;
1464 				/* Translate ILP32 lockfs to LP64 lockfs */
1465 				if (copyin((caddr_t)arg, &lockfs32,
1466 				    sizeof (struct lockfs32)))
1467 					return (EFAULT);
1468 				lockfs.lf_lock = (ulong_t)lockfs32.lf_lock;
1469 				lockfs.lf_flags = (ulong_t)lockfs32.lf_flags;
1470 				lockfs.lf_key = (ulong_t)lockfs32.lf_key;
1471 				lockfs.lf_comlen = (ulong_t)lockfs32.lf_comlen;
1472 				lockfs.lf_comment =
1473 					(caddr_t)(uintptr_t)lockfs32.lf_comment;
1474 			}
1475 #endif /* _SYSCALL32_IMPL */
1476 
1477 			if (lockfs.lf_comlen) {
1478 				if (lockfs.lf_comlen > LOCKFS_MAXCOMMENTLEN)
1479 					return (ENAMETOOLONG);
1480 				comment = kmem_alloc(lockfs.lf_comlen,
1481 						KM_SLEEP);
1482 				if (copyin(lockfs.lf_comment, comment,
1483 					lockfs.lf_comlen)) {
1484 					kmem_free(comment, lockfs.lf_comlen);
1485 					return (EFAULT);
1486 				}
1487 				original_comment = lockfs.lf_comment;
1488 				lockfs.lf_comment = comment;
1489 			}
1490 			if ((error = ufs_fiolfs(vp, &lockfs, 0)) == 0) {
1491 				lockfs.lf_comment = original_comment;
1492 
1493 				if ((flag & DATAMODEL_MASK) ==
1494 				    DATAMODEL_NATIVE) {
1495 					(void) copyout(&lockfs, (caddr_t)arg,
1496 					    sizeof (struct lockfs));
1497 				}
1498 #ifdef _SYSCALL32_IMPL
1499 				else {
1500 					struct lockfs32	lockfs32;
1501 					/* Translate LP64 to ILP32 lockfs */
1502 					lockfs32.lf_lock =
1503 					    (uint32_t)lockfs.lf_lock;
1504 					lockfs32.lf_flags =
1505 					    (uint32_t)lockfs.lf_flags;
1506 					lockfs32.lf_key =
1507 					    (uint32_t)lockfs.lf_key;
1508 					lockfs32.lf_comlen =
1509 					    (uint32_t)lockfs.lf_comlen;
1510 					lockfs32.lf_comment =
1511 					(uint32_t)(uintptr_t)lockfs.lf_comment;
1512 					(void) copyout(&lockfs32, (caddr_t)arg,
1513 					    sizeof (struct lockfs32));
1514 				}
1515 #endif /* _SYSCALL32_IMPL */
1516 
1517 			} else {
1518 				if (lockfs.lf_comlen)
1519 					kmem_free(comment, lockfs.lf_comlen);
1520 			}
1521 			return (error);
1522 
1523 		case _FIOLFSS:
1524 			/*
1525 			 * get file system locking status
1526 			 */
1527 
1528 			if ((flag & DATAMODEL_MASK) == DATAMODEL_NATIVE) {
1529 				if (copyin((caddr_t)arg, &lockfs,
1530 						sizeof (struct lockfs)))
1531 					return (EFAULT);
1532 			}
1533 #ifdef _SYSCALL32_IMPL
1534 			else {
1535 				struct lockfs32	lockfs32;
1536 				/* Translate ILP32 lockfs to LP64 lockfs */
1537 				if (copyin((caddr_t)arg, &lockfs32,
1538 						sizeof (struct lockfs32)))
1539 					return (EFAULT);
1540 				lockfs.lf_lock = (ulong_t)lockfs32.lf_lock;
1541 				lockfs.lf_flags = (ulong_t)lockfs32.lf_flags;
1542 				lockfs.lf_key = (ulong_t)lockfs32.lf_key;
1543 				lockfs.lf_comlen = (ulong_t)lockfs32.lf_comlen;
1544 				lockfs.lf_comment =
1545 					(caddr_t)(uintptr_t)lockfs32.lf_comment;
1546 			}
1547 #endif /* _SYSCALL32_IMPL */
1548 
1549 			if (error =  ufs_fiolfss(vp, &lockfs_out))
1550 				return (error);
1551 			lockfs.lf_lock = lockfs_out.lf_lock;
1552 			lockfs.lf_key = lockfs_out.lf_key;
1553 			lockfs.lf_flags = lockfs_out.lf_flags;
1554 			lockfs.lf_comlen = MIN(lockfs.lf_comlen,
1555 				lockfs_out.lf_comlen);
1556 
1557 			if ((flag & DATAMODEL_MASK) == DATAMODEL_NATIVE) {
1558 				if (copyout(&lockfs, (caddr_t)arg,
1559 						sizeof (struct lockfs)))
1560 					return (EFAULT);
1561 			}
1562 #ifdef _SYSCALL32_IMPL
1563 			else {
1564 				/* Translate LP64 to ILP32 lockfs */
1565 				struct lockfs32	lockfs32;
1566 				lockfs32.lf_lock = (uint32_t)lockfs.lf_lock;
1567 				lockfs32.lf_flags = (uint32_t)lockfs.lf_flags;
1568 				lockfs32.lf_key = (uint32_t)lockfs.lf_key;
1569 				lockfs32.lf_comlen = (uint32_t)lockfs.lf_comlen;
1570 				lockfs32.lf_comment =
1571 					(uint32_t)(uintptr_t)lockfs.lf_comment;
1572 				if (copyout(&lockfs32, (caddr_t)arg,
1573 					    sizeof (struct lockfs32)))
1574 					return (EFAULT);
1575 			}
1576 #endif /* _SYSCALL32_IMPL */
1577 
1578 			if (lockfs.lf_comlen &&
1579 			    lockfs.lf_comment && lockfs_out.lf_comment)
1580 				if (copyout(lockfs_out.lf_comment,
1581 					lockfs.lf_comment,
1582 					lockfs.lf_comlen))
1583 					return (EFAULT);
1584 			return (0);
1585 
1586 		case _FIOSATIME:
1587 			/*
1588 			 * set access time
1589 			 */
1590 
1591 			/*
1592 			 * if mounted w/o atime, return quietly.
1593 			 * I briefly thought about returning ENOSYS, but
1594 			 * figured that most apps would consider this fatal
1595 			 * but the idea is to make this as seamless as poss.
1596 			 */
1597 			if (ufsvfsp->vfs_noatime)
1598 				return (0);
1599 
1600 			error = ufs_lockfs_begin(ufsvfsp, &ulp,
1601 					ULOCKFS_SETATTR_MASK);
1602 			if (error)
1603 				return (error);
1604 
1605 			if (ulp) {
1606 				trans_size = (int)TOP_SETATTR_SIZE(VTOI(vp));
1607 				TRANS_BEGIN_CSYNC(ufsvfsp, issync,
1608 						TOP_SETATTR, trans_size);
1609 			}
1610 
1611 			error = ufs_fiosatime(vp, (struct timeval *)arg,
1612 					flag, cr);
1613 
1614 			if (ulp) {
1615 				TRANS_END_CSYNC(ufsvfsp, error, issync,
1616 						TOP_SETATTR, trans_size);
1617 				ufs_lockfs_end(ulp);
1618 			}
1619 			return (error);
1620 
1621 		case _FIOSDIO:
1622 			/*
1623 			 * set delayed-io
1624 			 */
1625 			return (ufs_fiosdio(vp, (uint_t *)arg, flag, cr));
1626 
1627 		case _FIOGDIO:
1628 			/*
1629 			 * get delayed-io
1630 			 */
1631 			return (ufs_fiogdio(vp, (uint_t *)arg, flag, cr));
1632 
1633 		case _FIOIO:
1634 			/*
1635 			 * inode open
1636 			 */
1637 			error = ufs_lockfs_begin(ufsvfsp, &ulp,
1638 					ULOCKFS_VGET_MASK);
1639 			if (error)
1640 				return (error);
1641 
1642 			error = ufs_fioio(vp, (struct fioio *)arg, flag, cr);
1643 
1644 			if (ulp) {
1645 				ufs_lockfs_end(ulp);
1646 			}
1647 			return (error);
1648 
1649 		case _FIOFFS:
1650 			/*
1651 			 * file system flush (push w/invalidate)
1652 			 */
1653 			if ((caddr_t)arg != NULL)
1654 				return (EINVAL);
1655 			return (ufs_fioffs(vp, NULL, cr));
1656 
1657 		case _FIOISBUSY:
1658 			/*
1659 			 * Contract-private interface for Legato
1660 			 * Purge this vnode from the DNLC and decide
1661 			 * if this vnode is busy (*arg == 1) or not
1662 			 * (*arg == 0)
1663 			 */
1664 			if (secpolicy_fs_config(cr, ufsvfsp->vfs_vfs) != 0)
1665 				return (EPERM);
1666 			error = ufs_fioisbusy(vp, (int *)arg, cr);
1667 			return (error);
1668 
1669 		case _FIODIRECTIO:
1670 			return (ufs_fiodirectio(vp, (int)arg, cr));
1671 
1672 		case _FIOTUNE:
1673 			/*
1674 			 * Tune the file system (aka setting fs attributes)
1675 			 */
1676 			error = ufs_lockfs_begin(ufsvfsp, &ulp,
1677 					ULOCKFS_SETATTR_MASK);
1678 			if (error)
1679 				return (error);
1680 
1681 			error = ufs_fiotune(vp, (struct fiotune *)arg, cr);
1682 
1683 			if (ulp)
1684 				ufs_lockfs_end(ulp);
1685 			return (error);
1686 
1687 		case _FIOLOGENABLE:
1688 			if (secpolicy_fs_config(cr, ufsvfsp->vfs_vfs) != 0)
1689 				return (EPERM);
1690 			return (ufs_fiologenable(vp, (void *)arg, cr, flag));
1691 
1692 		case _FIOLOGDISABLE:
1693 			if (secpolicy_fs_config(cr, ufsvfsp->vfs_vfs) != 0)
1694 				return (EPERM);
1695 			return (ufs_fiologdisable(vp, (void *)arg, cr, flag));
1696 
1697 		case _FIOISLOG:
1698 			return (ufs_fioislog(vp, (void *)arg, cr, flag));
1699 
1700 		case _FIOSNAPSHOTCREATE_MULTI:
1701 		{
1702 			struct fiosnapcreate_multi	fc, *fcp;
1703 			size_t	fcm_size;
1704 
1705 			if (copyin((void *)arg, &fc, sizeof (fc)))
1706 				return (EFAULT);
1707 			if (fc.backfilecount > MAX_BACKFILE_COUNT)
1708 				return (EINVAL);
1709 			fcm_size = sizeof (struct fiosnapcreate_multi) +
1710 			    (fc.backfilecount - 1) * sizeof (int);
1711 			fcp = (struct fiosnapcreate_multi *)
1712 			    kmem_alloc(fcm_size, KM_SLEEP);
1713 			if (copyin((void *)arg, fcp, fcm_size)) {
1714 				kmem_free(fcp, fcm_size);
1715 				return (EFAULT);
1716 			}
1717 			error = ufs_snap_create(vp, fcp, cr);
1718 			if (!error && copyout(fcp, (void *)arg, fcm_size))
1719 				error = EFAULT;
1720 			kmem_free(fcp, fcm_size);
1721 			return (error);
1722 		}
1723 
1724 		case _FIOSNAPSHOTDELETE:
1725 		{
1726 			struct fiosnapdelete	fc;
1727 
1728 			if (copyin((void *)arg, &fc, sizeof (fc)))
1729 				return (EFAULT);
1730 			error = ufs_snap_delete(vp, &fc, cr);
1731 			if (!error && copyout(&fc, (void *)arg, sizeof (fc)))
1732 				error = EFAULT;
1733 			return (error);
1734 		}
1735 
1736 		case _FIOGETSUPERBLOCK:
1737 			if (copyout(fs, (void *)arg, SBSIZE))
1738 				return (EFAULT);
1739 			return (0);
1740 
1741 		case _FIOGETMAXPHYS:
1742 			if (copyout(&maxphys, (void *)arg, sizeof (maxphys)))
1743 				return (EFAULT);
1744 			return (0);
1745 
1746 		/*
1747 		 * The following 3 ioctls are for TSufs support
1748 		 * although could potentially be used elsewhere
1749 		 */
1750 		case _FIO_SET_LUFS_DEBUG:
1751 			if (secpolicy_fs_config(cr, ufsvfsp->vfs_vfs) != 0)
1752 				return (EPERM);
1753 			lufs_debug = (uint32_t)arg;
1754 			return (0);
1755 
1756 		case _FIO_SET_LUFS_ERROR:
1757 			if (secpolicy_fs_config(cr, ufsvfsp->vfs_vfs) != 0)
1758 				return (EPERM);
1759 			TRANS_SETERROR(ufsvfsp);
1760 			return (0);
1761 
1762 		case _FIO_GET_TOP_STATS:
1763 		{
1764 			fio_lufs_stats_t *ls;
1765 			ml_unit_t *ul = ufsvfsp->vfs_log;
1766 
1767 			ls = kmem_zalloc(sizeof (*ls), KM_SLEEP);
1768 			ls->ls_debug = ul->un_debug; /* return debug value */
1769 			/* Copy stucture if statistics are being kept */
1770 			if (ul->un_logmap->mtm_tops) {
1771 				ls->ls_topstats = *(ul->un_logmap->mtm_tops);
1772 			}
1773 			error = 0;
1774 			if (copyout(ls, (void *)arg, sizeof (*ls)))
1775 				error = EFAULT;
1776 			kmem_free(ls, sizeof (*ls));
1777 			return (error);
1778 		}
1779 
1780 		case _FIO_SEEK_DATA:
1781 		case _FIO_SEEK_HOLE:
1782 			if (ddi_copyin((void *)arg, &off, sizeof (off), flag))
1783 				return (EFAULT);
1784 			/* offset paramater is in/out */
1785 			error = ufs_fio_holey(vp, cmd, &off);
1786 			if (error)
1787 				return (error);
1788 			if (ddi_copyout(&off, (void *)arg, sizeof (off), flag))
1789 				return (EFAULT);
1790 			return (0);
1791 
1792 		default:
1793 			return (ENOTTY);
1794 	}
1795 }
1796 
1797 /* ARGSUSED */
1798 static int
1799 ufs_getattr(struct vnode *vp, struct vattr *vap, int flags,
1800 	struct cred *cr)
1801 {
1802 	struct inode *ip = VTOI(vp);
1803 	struct ufsvfs *ufsvfsp;
1804 	int err;
1805 
1806 	TRACE_2(TR_FAC_UFS, TR_UFS_GETATTR_START,
1807 		"ufs_getattr_start:vp %p flags %x", vp, flags);
1808 
1809 	if (vap->va_mask == AT_SIZE) {
1810 		/*
1811 		 * for performance, if only the size is requested don't bother
1812 		 * with anything else.
1813 		 */
1814 		UFS_GET_ISIZE(&vap->va_size, ip);
1815 		TRACE_1(TR_FAC_UFS, TR_UFS_GETATTR_END,
1816 			"ufs_getattr_end:vp %p", vp);
1817 		return (0);
1818 	}
1819 
1820 	/*
1821 	 * inlined lockfs checks
1822 	 */
1823 	ufsvfsp = ip->i_ufsvfs;
1824 	if ((ufsvfsp == NULL) || ULOCKFS_IS_HLOCK(&ufsvfsp->vfs_ulockfs)) {
1825 		err = EIO;
1826 		goto out;
1827 	}
1828 
1829 	rw_enter(&ip->i_contents, RW_READER);
1830 	/*
1831 	 * Return all the attributes.  This should be refined so
1832 	 * that it only returns what's asked for.
1833 	 */
1834 
1835 	/*
1836 	 * Copy from inode table.
1837 	 */
1838 	vap->va_type = vp->v_type;
1839 	vap->va_mode = ip->i_mode & MODEMASK;
1840 	/*
1841 	 * If there is an ACL and there is a mask entry, then do the
1842 	 * extra work that completes the equivalent of an acltomode(3)
1843 	 * call.  According to POSIX P1003.1e, the acl mask should be
1844 	 * returned in the group permissions field.
1845 	 *
1846 	 * - start with the original permission and mode bits (from above)
1847 	 * - clear the group owner bits
1848 	 * - add in the mask bits.
1849 	 */
1850 	if (ip->i_ufs_acl && ip->i_ufs_acl->aclass.acl_ismask) {
1851 		vap->va_mode &= ~((VREAD | VWRITE | VEXEC) >> 3);
1852 		vap->va_mode |=
1853 		    (ip->i_ufs_acl->aclass.acl_maskbits & PERMMASK) << 3;
1854 	}
1855 	vap->va_uid = ip->i_uid;
1856 	vap->va_gid = ip->i_gid;
1857 	vap->va_fsid = ip->i_dev;
1858 	vap->va_nodeid = (ino64_t)ip->i_number;
1859 	vap->va_nlink = ip->i_nlink;
1860 	vap->va_size = ip->i_size;
1861 	if (vp->v_type == VCHR || vp->v_type == VBLK)
1862 		vap->va_rdev = ip->i_rdev;
1863 	else
1864 		vap->va_rdev = 0;	/* not a b/c spec. */
1865 	mutex_enter(&ip->i_tlock);
1866 	ITIMES_NOLOCK(ip);	/* mark correct time in inode */
1867 	vap->va_seq = ip->i_seq;
1868 	vap->va_atime.tv_sec = (time_t)ip->i_atime.tv_sec;
1869 	vap->va_atime.tv_nsec = ip->i_atime.tv_usec*1000;
1870 	vap->va_mtime.tv_sec = (time_t)ip->i_mtime.tv_sec;
1871 	vap->va_mtime.tv_nsec = ip->i_mtime.tv_usec*1000;
1872 	vap->va_ctime.tv_sec = (time_t)ip->i_ctime.tv_sec;
1873 	vap->va_ctime.tv_nsec = ip->i_ctime.tv_usec*1000;
1874 	mutex_exit(&ip->i_tlock);
1875 
1876 	switch (ip->i_mode & IFMT) {
1877 
1878 	case IFBLK:
1879 		vap->va_blksize = MAXBSIZE;		/* was BLKDEV_IOSIZE */
1880 		break;
1881 
1882 	case IFCHR:
1883 		vap->va_blksize = MAXBSIZE;
1884 		break;
1885 
1886 	default:
1887 		vap->va_blksize = ip->i_fs->fs_bsize;
1888 		break;
1889 	}
1890 	vap->va_nblocks = (fsblkcnt64_t)ip->i_blocks;
1891 	rw_exit(&ip->i_contents);
1892 	err = 0;
1893 
1894 out:
1895 	TRACE_1(TR_FAC_UFS, TR_UFS_GETATTR_END, "ufs_getattr_end:vp %p", vp);
1896 
1897 	return (err);
1898 }
1899 
1900 /*ARGSUSED4*/
1901 static int
1902 ufs_setattr(
1903 	struct vnode *vp,
1904 	struct vattr *vap,
1905 	int flags,
1906 	struct cred *cr,
1907 	caller_context_t *ct)
1908 {
1909 	struct inode *ip = VTOI(vp);
1910 	struct ufsvfs *ufsvfsp = ip->i_ufsvfs;
1911 	struct fs *fs;
1912 	struct ulockfs *ulp;
1913 	char *errmsg1;
1914 	char *errmsg2;
1915 	long blocks;
1916 	long int mask = vap->va_mask;
1917 	size_t len1, len2;
1918 	int issync;
1919 	int trans_size;
1920 	int dotrans;
1921 	int dorwlock;
1922 	int error;
1923 	int owner_change;
1924 	int dodqlock;
1925 	timestruc_t now;
1926 	vattr_t oldva;
1927 	int retry = 1;
1928 
1929 	TRACE_2(TR_FAC_UFS, TR_UFS_SETATTR_START,
1930 		"ufs_setattr_start:vp %p flags %x", vp, flags);
1931 
1932 	/*
1933 	 * Cannot set these attributes.
1934 	 */
1935 	if (mask & AT_NOSET) {
1936 		error = EINVAL;
1937 		goto out;
1938 	}
1939 
1940 	/*
1941 	 * check for forced unmount
1942 	 */
1943 	if (ufsvfsp == NULL)
1944 		return (EIO);
1945 
1946 	fs = ufsvfsp->vfs_fs;
1947 	if (fs->fs_ronly != 0)
1948 		return (EROFS);
1949 
1950 again:
1951 	errmsg1 = NULL;
1952 	errmsg2 = NULL;
1953 	dotrans = 0;
1954 	dorwlock = 0;
1955 	dodqlock = 0;
1956 
1957 	error = ufs_lockfs_begin(ufsvfsp, &ulp, ULOCKFS_SETATTR_MASK);
1958 	if (error)
1959 		goto out;
1960 
1961 	/*
1962 	 * Acquire i_rwlock before TRANS_BEGIN_CSYNC() if this is a file.
1963 	 * This follows the protocol for read()/write().
1964 	 */
1965 	if (vp->v_type != VDIR) {
1966 		rw_enter(&ip->i_rwlock, RW_WRITER);
1967 		dorwlock = 1;
1968 	}
1969 
1970 	/*
1971 	 * Truncate file.  Must have write permission and not be a directory.
1972 	 */
1973 	if (mask & AT_SIZE) {
1974 		rw_enter(&ip->i_contents, RW_WRITER);
1975 		if (vp->v_type == VDIR) {
1976 			error = EISDIR;
1977 			goto update_inode;
1978 		}
1979 		if (error = ufs_iaccess(ip, IWRITE, cr))
1980 			goto update_inode;
1981 
1982 		rw_exit(&ip->i_contents);
1983 		error = TRANS_ITRUNC(ip, vap->va_size, 0, cr);
1984 		if (error) {
1985 			rw_enter(&ip->i_contents, RW_WRITER);
1986 			goto update_inode;
1987 		}
1988 	}
1989 
1990 	if (ulp) {
1991 		trans_size = (int)TOP_SETATTR_SIZE(ip);
1992 		TRANS_BEGIN_CSYNC(ufsvfsp, issync, TOP_SETATTR, trans_size);
1993 		++dotrans;
1994 	}
1995 
1996 	/*
1997 	 * Acquire i_rwlock after TRANS_BEGIN_CSYNC() if this is a directory.
1998 	 * This follows the protocol established by
1999 	 * ufs_link/create/remove/rename/mkdir/rmdir/symlink.
2000 	 */
2001 	if (vp->v_type == VDIR) {
2002 		rw_enter(&ip->i_rwlock, RW_WRITER);
2003 		dorwlock = 1;
2004 	}
2005 
2006 	/*
2007 	 * Grab quota lock if we are changing the file's owner.
2008 	 */
2009 	if (mask & AT_UID) {
2010 		rw_enter(&ufsvfsp->vfs_dqrwlock, RW_READER);
2011 		dodqlock = 1;
2012 	}
2013 	rw_enter(&ip->i_contents, RW_WRITER);
2014 
2015 	oldva.va_mode = ip->i_mode;
2016 	oldva.va_uid = ip->i_uid;
2017 	oldva.va_gid = ip->i_gid;
2018 
2019 	vap->va_mask &= ~AT_SIZE;
2020 	/*
2021 	 * ufs_iaccess is "close enough"; that's because it doesn't
2022 	 * map the defines.
2023 	 */
2024 	error = secpolicy_vnode_setattr(cr, vp, vap, &oldva, flags,
2025 				ufs_iaccess, ip);
2026 	if (error)
2027 		goto update_inode;
2028 
2029 	mask = vap->va_mask;
2030 
2031 	/*
2032 	 * Change file access modes.
2033 	 */
2034 	if (mask & AT_MODE) {
2035 		ip->i_mode = (ip->i_mode & IFMT) | (vap->va_mode & ~IFMT);
2036 		TRANS_INODE(ufsvfsp, ip);
2037 		ip->i_flag |= ICHG;
2038 		if (stickyhack) {
2039 			mutex_enter(&vp->v_lock);
2040 			if ((ip->i_mode & (ISVTX | IEXEC | IFDIR)) == ISVTX)
2041 				vp->v_flag |= VSWAPLIKE;
2042 			else
2043 				vp->v_flag &= ~VSWAPLIKE;
2044 			mutex_exit(&vp->v_lock);
2045 		}
2046 	}
2047 	if (mask & (AT_UID|AT_GID)) {
2048 		if (mask & AT_UID) {
2049 			/*
2050 			 * Don't change ownership of the quota inode.
2051 			 */
2052 			if (ufsvfsp->vfs_qinod == ip) {
2053 				ASSERT(ufsvfsp->vfs_qflags & MQ_ENABLED);
2054 				error = EINVAL;
2055 				goto update_inode;
2056 			}
2057 
2058 			/*
2059 			 * No real ownership change.
2060 			 */
2061 			if (ip->i_uid == vap->va_uid) {
2062 				blocks = 0;
2063 				owner_change = 0;
2064 			}
2065 			/*
2066 			 * Remove the blocks and the file, from the old user's
2067 			 * quota.
2068 			 */
2069 			else {
2070 				blocks = ip->i_blocks;
2071 				owner_change = 1;
2072 
2073 				(void) chkdq(ip, -blocks, /* force */ 1, cr,
2074 						(char **)NULL, (size_t *)NULL);
2075 				(void) chkiq(ufsvfsp, /* change */ -1, ip,
2076 						(uid_t)ip->i_uid,
2077 						/* force */ 1, cr,
2078 						(char **)NULL, (size_t *)NULL);
2079 				dqrele(ip->i_dquot);
2080 			}
2081 
2082 			ip->i_uid = vap->va_uid;
2083 
2084 			/*
2085 			 * There is a real ownership change.
2086 			 */
2087 			if (owner_change) {
2088 				/*
2089 				 * Add the blocks and the file to the new
2090 				 * user's quota.
2091 				 */
2092 				ip->i_dquot = getinoquota(ip);
2093 				(void) chkdq(ip, blocks, /* force */ 1, cr,
2094 						&errmsg1, &len1);
2095 				(void) chkiq(ufsvfsp, /* change */ 1,
2096 						(struct inode *)NULL,
2097 						(uid_t)ip->i_uid,
2098 						/* force */ 1, cr,
2099 						&errmsg2, &len2);
2100 			}
2101 		}
2102 		if (mask & AT_GID) {
2103 			ip->i_gid = vap->va_gid;
2104 		}
2105 		TRANS_INODE(ufsvfsp, ip);
2106 		ip->i_flag |= ICHG;
2107 	}
2108 	/*
2109 	 * Change file access or modified times.
2110 	 */
2111 	if (mask & (AT_ATIME|AT_MTIME)) {
2112 		/* Check that the time value is within ufs range */
2113 		if (((mask & AT_ATIME) && TIMESPEC_OVERFLOW(&vap->va_atime)) ||
2114 		    ((mask & AT_MTIME) && TIMESPEC_OVERFLOW(&vap->va_mtime))) {
2115 			error = EOVERFLOW;
2116 			goto update_inode;
2117 		}
2118 
2119 		/*
2120 		 * if the "noaccess" mount option is set and only atime
2121 		 * update is requested, do nothing. No error is returned.
2122 		 */
2123 		if ((ufsvfsp->vfs_noatime) &&
2124 		    ((mask & (AT_ATIME|AT_MTIME)) == AT_ATIME))
2125 			goto skip_atime;
2126 
2127 		if (mask & AT_ATIME) {
2128 			ip->i_atime.tv_sec = vap->va_atime.tv_sec;
2129 			ip->i_atime.tv_usec = vap->va_atime.tv_nsec / 1000;
2130 			ip->i_flag &= ~IACC;
2131 		}
2132 		if (mask & AT_MTIME) {
2133 			ip->i_mtime.tv_sec = vap->va_mtime.tv_sec;
2134 			ip->i_mtime.tv_usec = vap->va_mtime.tv_nsec / 1000;
2135 			gethrestime(&now);
2136 			if (now.tv_sec > TIME32_MAX) {
2137 				/*
2138 				 * In 2038, ctime sticks forever..
2139 				 */
2140 				ip->i_ctime.tv_sec = TIME32_MAX;
2141 				ip->i_ctime.tv_usec = 0;
2142 			} else {
2143 				ip->i_ctime.tv_sec = now.tv_sec;
2144 				ip->i_ctime.tv_usec = now.tv_nsec / 1000;
2145 			}
2146 			ip->i_flag &= ~(IUPD|ICHG);
2147 			ip->i_flag |= IMODTIME;
2148 		}
2149 		TRANS_INODE(ufsvfsp, ip);
2150 		ip->i_flag |= IMOD;
2151 	}
2152 
2153 skip_atime:
2154 	/*
2155 	 * The presence of a shadow inode may indicate an ACL, but does
2156 	 * not imply an ACL.  Future FSD types should be handled here too
2157 	 * and check for the presence of the attribute-specific data
2158 	 * before referencing it.
2159 	 */
2160 	if (ip->i_shadow) {
2161 		/*
2162 		 * XXX if ufs_iupdat is changed to sandbagged write fix
2163 		 * ufs_acl_setattr to push ip to keep acls consistent
2164 		 *
2165 		 * Suppress out of inodes messages if we will retry.
2166 		 */
2167 		if (retry)
2168 			ip->i_flag |= IQUIET;
2169 		error = ufs_acl_setattr(ip, vap, cr);
2170 		ip->i_flag &= ~IQUIET;
2171 	}
2172 
2173 update_inode:
2174 	/*
2175 	 * Setattr always increases the sequence number
2176 	 */
2177 	ip->i_seq++;
2178 
2179 	/*
2180 	 * if nfsd and not logging; push synchronously
2181 	 */
2182 	if ((curthread->t_flag & T_DONTPEND) && !TRANS_ISTRANS(ufsvfsp)) {
2183 		ufs_iupdat(ip, 1);
2184 	} else {
2185 		ITIMES_NOLOCK(ip);
2186 	}
2187 
2188 	rw_exit(&ip->i_contents);
2189 	if (dodqlock) {
2190 		rw_exit(&ufsvfsp->vfs_dqrwlock);
2191 	}
2192 	if (dorwlock)
2193 		rw_exit(&ip->i_rwlock);
2194 
2195 	if (ulp) {
2196 		if (dotrans) {
2197 			int terr = 0;
2198 			TRANS_END_CSYNC(ufsvfsp, terr, issync, TOP_SETATTR,
2199 			    trans_size);
2200 			if (error == 0)
2201 				error = terr;
2202 		}
2203 		ufs_lockfs_end(ulp);
2204 	}
2205 out:
2206 	/*
2207 	 * If out of inodes or blocks, see if we can free something
2208 	 * up from the delete queue.
2209 	 */
2210 	if ((error == ENOSPC) && retry && TRANS_ISTRANS(ufsvfsp)) {
2211 		ufs_delete_drain_wait(ufsvfsp, 1);
2212 		retry = 0;
2213 		if (errmsg1 != NULL)
2214 			kmem_free(errmsg1, len1);
2215 		if (errmsg2 != NULL)
2216 			kmem_free(errmsg2, len2);
2217 		goto again;
2218 	}
2219 	TRACE_2(TR_FAC_UFS, TR_UFS_SETATTR_END,
2220 		"ufs_setattr_end:vp %p error %d", vp, error);
2221 	if (errmsg1 != NULL) {
2222 		uprintf(errmsg1);
2223 		kmem_free(errmsg1, len1);
2224 	}
2225 	if (errmsg2 != NULL) {
2226 		uprintf(errmsg2);
2227 		kmem_free(errmsg2, len2);
2228 	}
2229 	return (error);
2230 }
2231 
2232 /*ARGSUSED*/
2233 static int
2234 ufs_access(struct vnode *vp, int mode, int flags, struct cred *cr)
2235 {
2236 	struct inode *ip = VTOI(vp);
2237 	int error;
2238 
2239 	TRACE_3(TR_FAC_UFS, TR_UFS_ACCESS_START,
2240 		"ufs_access_start:vp %p mode %x flags %x", vp, mode, flags);
2241 
2242 	if (ip->i_ufsvfs == NULL)
2243 		return (EIO);
2244 
2245 	rw_enter(&ip->i_contents, RW_READER);
2246 
2247 	/*
2248 	 * The ufs_iaccess function wants to be called with
2249 	 * mode bits expressed as "ufs specific" bits.
2250 	 * I.e., VWRITE|VREAD|VEXEC do not make sense to
2251 	 * ufs_iaccess() but IWRITE|IREAD|IEXEC do.
2252 	 * But since they're the same we just pass the vnode mode
2253 	 * bit but just verify that assumption at compile time.
2254 	 */
2255 #if IWRITE != VWRITE || IREAD != VREAD || IEXEC != VEXEC
2256 #error "ufs_access needs to map Vmodes to Imodes"
2257 #endif
2258 	error = ufs_iaccess(ip, mode, cr);
2259 
2260 	rw_exit(&ip->i_contents);
2261 
2262 	TRACE_2(TR_FAC_UFS, TR_UFS_ACCESS_END,
2263 		"ufs_access_end:vp %p error %d", vp, error);
2264 	return (error);
2265 }
2266 
2267 /* ARGSUSED */
2268 static int
2269 ufs_readlink(struct vnode *vp, struct uio *uiop, struct cred *cr)
2270 {
2271 	struct inode *ip = VTOI(vp);
2272 	struct ufsvfs *ufsvfsp;
2273 	struct ulockfs *ulp;
2274 	int error;
2275 	int fastsymlink;
2276 
2277 	TRACE_2(TR_FAC_UFS, TR_UFS_READLINK_START,
2278 		"ufs_readlink_start:vp %p uiop %p", uiop, vp);
2279 
2280 	if (vp->v_type != VLNK) {
2281 		error = EINVAL;
2282 		goto nolockout;
2283 	}
2284 
2285 	/*
2286 	 * If the symbolic link is empty there is nothing to read.
2287 	 * Fast-track these empty symbolic links
2288 	 */
2289 	if (ip->i_size == 0) {
2290 		error = 0;
2291 		goto nolockout;
2292 	}
2293 
2294 	ufsvfsp = ip->i_ufsvfs;
2295 	error = ufs_lockfs_begin(ufsvfsp, &ulp, ULOCKFS_READLINK_MASK);
2296 	if (error)
2297 		goto nolockout;
2298 	/*
2299 	 * The ip->i_rwlock protects the data blocks used for FASTSYMLINK
2300 	 */
2301 again:
2302 	fastsymlink = 0;
2303 	if (ip->i_flag & IFASTSYMLNK) {
2304 		rw_enter(&ip->i_rwlock, RW_READER);
2305 		rw_enter(&ip->i_contents, RW_READER);
2306 		if (ip->i_flag & IFASTSYMLNK) {
2307 			if (!ULOCKFS_IS_NOIACC(ITOUL(ip)) &&
2308 			    (ip->i_fs->fs_ronly == 0) &&
2309 			    (!ufsvfsp->vfs_noatime)) {
2310 				mutex_enter(&ip->i_tlock);
2311 				ip->i_flag |= IACC;
2312 				mutex_exit(&ip->i_tlock);
2313 			}
2314 			error = uiomove((caddr_t)&ip->i_db[1],
2315 				MIN(ip->i_size, uiop->uio_resid),
2316 				UIO_READ, uiop);
2317 			ITIMES(ip);
2318 			++fastsymlink;
2319 		}
2320 		rw_exit(&ip->i_contents);
2321 		rw_exit(&ip->i_rwlock);
2322 	}
2323 	if (!fastsymlink) {
2324 		ssize_t size;	/* number of bytes read  */
2325 		caddr_t basep;	/* pointer to input data */
2326 		ino_t ino;
2327 		long  igen;
2328 		struct uio tuio;	/* temp uio struct */
2329 		struct uio *tuiop;
2330 		iovec_t tiov;		/* temp iovec struct */
2331 		char kbuf[FSL_SIZE];	/* buffer to hold fast symlink */
2332 		int tflag = 0;		/* flag to indicate temp vars used */
2333 
2334 		ino = ip->i_number;
2335 		igen = ip->i_gen;
2336 		size = uiop->uio_resid;
2337 		basep = uiop->uio_iov->iov_base;
2338 		tuiop = uiop;
2339 
2340 		rw_enter(&ip->i_rwlock, RW_WRITER);
2341 		rw_enter(&ip->i_contents, RW_WRITER);
2342 		if (ip->i_flag & IFASTSYMLNK) {
2343 			rw_exit(&ip->i_contents);
2344 			rw_exit(&ip->i_rwlock);
2345 			goto again;
2346 		}
2347 
2348 		/* can this be a fast symlink and is it a user buffer? */
2349 		if (ip->i_size <= FSL_SIZE &&
2350 		    (uiop->uio_segflg == UIO_USERSPACE ||
2351 		    uiop->uio_segflg == UIO_USERISPACE)) {
2352 
2353 			bzero(&tuio, sizeof (struct uio));
2354 			/*
2355 			 * setup a kernel buffer to read link into.  this
2356 			 * is to fix a race condition where the user buffer
2357 			 * got corrupted before copying it into the inode.
2358 			 */
2359 			size = ip->i_size;
2360 			tiov.iov_len = size;
2361 			tiov.iov_base = kbuf;
2362 			tuio.uio_iov = &tiov;
2363 			tuio.uio_iovcnt = 1;
2364 			tuio.uio_offset = uiop->uio_offset;
2365 			tuio.uio_segflg = UIO_SYSSPACE;
2366 			tuio.uio_fmode = uiop->uio_fmode;
2367 			tuio.uio_extflg = uiop->uio_extflg;
2368 			tuio.uio_limit = uiop->uio_limit;
2369 			tuio.uio_resid = size;
2370 
2371 			basep = tuio.uio_iov->iov_base;
2372 			tuiop = &tuio;
2373 			tflag = 1;
2374 		}
2375 
2376 		error = rdip(ip, tuiop, 0, cr);
2377 		if (!(error == 0 && ip->i_number == ino && ip->i_gen == igen)) {
2378 			rw_exit(&ip->i_contents);
2379 			rw_exit(&ip->i_rwlock);
2380 			goto out;
2381 		}
2382 
2383 		if (tflag == 0)
2384 			size -= uiop->uio_resid;
2385 
2386 		if ((tflag == 0 && ip->i_size <= FSL_SIZE &&
2387 		    ip->i_size == size) || (tflag == 1 &&
2388 		    tuio.uio_resid == 0)) {
2389 			error = kcopy(basep, &ip->i_db[1], ip->i_size);
2390 			if (error == 0) {
2391 				ip->i_flag |= IFASTSYMLNK;
2392 				/*
2393 				 * free page
2394 				 */
2395 				(void) VOP_PUTPAGE(ITOV(ip),
2396 				    (offset_t)0, PAGESIZE,
2397 				    (B_DONTNEED | B_FREE | B_FORCE | B_ASYNC),
2398 				    cr);
2399 			} else {
2400 				int i;
2401 				/* error, clear garbage left behind */
2402 				for (i = 1; i < NDADDR; i++)
2403 					ip->i_db[i] = 0;
2404 				for (i = 0; i < NIADDR; i++)
2405 					ip->i_ib[i] = 0;
2406 			}
2407 		}
2408 		if (tflag == 1) {
2409 			/* now, copy it into the user buffer */
2410 			error = uiomove((caddr_t)kbuf,
2411 				MIN(size, uiop->uio_resid),
2412 				UIO_READ, uiop);
2413 		}
2414 		rw_exit(&ip->i_contents);
2415 		rw_exit(&ip->i_rwlock);
2416 	}
2417 out:
2418 	if (ulp) {
2419 		ufs_lockfs_end(ulp);
2420 	}
2421 nolockout:
2422 	TRACE_2(TR_FAC_UFS, TR_UFS_READLINK_END,
2423 		"ufs_readlink_end:vp %p error %d", vp, error);
2424 
2425 	return (error);
2426 }
2427 
2428 /* ARGSUSED */
2429 static int
2430 ufs_fsync(struct vnode *vp, int syncflag, struct cred *cr)
2431 {
2432 	struct inode *ip = VTOI(vp);
2433 	struct ufsvfs *ufsvfsp = ip->i_ufsvfs;
2434 	struct ulockfs *ulp;
2435 	int error;
2436 
2437 	TRACE_1(TR_FAC_UFS, TR_UFS_FSYNC_START,
2438 		"ufs_fsync_start:vp %p", vp);
2439 
2440 	error = ufs_lockfs_begin(ufsvfsp, &ulp, ULOCKFS_FSYNC_MASK);
2441 	if (error)
2442 		return (error);
2443 
2444 	if (TRANS_ISTRANS(ufsvfsp)) {
2445 		/*
2446 		 * First push out any data pages
2447 		 */
2448 		if (vn_has_cached_data(vp) && !(syncflag & FNODSYNC) &&
2449 		    (vp->v_type != VCHR) && !(IS_SWAPVP(vp))) {
2450 			error = VOP_PUTPAGE(vp, (offset_t)0, (size_t)0,
2451 			    0, CRED());
2452 			if (error)
2453 				goto out;
2454 		}
2455 
2456 		/*
2457 		 * Delta any delayed inode times updates
2458 		 * and push inode to log.
2459 		 * All other inode deltas will have already been delta'd
2460 		 * and will be pushed during the commit.
2461 		 */
2462 		if (!(syncflag & FDSYNC) &&
2463 		    ((ip->i_flag & (IMOD|IMODACC)) == IMODACC)) {
2464 			if (ulp) {
2465 				TRANS_BEGIN_ASYNC(ufsvfsp, TOP_FSYNC,
2466 				    TOP_SYNCIP_SIZE);
2467 			}
2468 			rw_enter(&ip->i_contents, RW_READER);
2469 			mutex_enter(&ip->i_tlock);
2470 			ip->i_flag &= ~IMODTIME;
2471 			mutex_exit(&ip->i_tlock);
2472 			ufs_iupdat(ip, I_SYNC);
2473 			rw_exit(&ip->i_contents);
2474 			if (ulp) {
2475 				TRANS_END_ASYNC(ufsvfsp, TOP_FSYNC,
2476 				    TOP_SYNCIP_SIZE);
2477 			}
2478 		}
2479 
2480 		/*
2481 		 * Commit the Moby transaction
2482 		 *
2483 		 * Deltas have already been made so we just need to
2484 		 * commit them with a synchronous transaction.
2485 		 * TRANS_BEGIN_SYNC() will return an error
2486 		 * if there are no deltas to commit, for an
2487 		 * empty transaction.
2488 		 */
2489 		if (ulp) {
2490 			TRANS_BEGIN_SYNC(ufsvfsp, TOP_FSYNC, TOP_COMMIT_SIZE,
2491 			    error);
2492 			if (error) {
2493 				error = 0; /* commit wasn't needed */
2494 				goto out;
2495 			}
2496 			TRANS_END_SYNC(ufsvfsp, error, TOP_FSYNC,
2497 			    TOP_COMMIT_SIZE);
2498 		}
2499 	} else {	/* not logging */
2500 		if (!(IS_SWAPVP(vp)))
2501 			if (syncflag & FNODSYNC) {
2502 				/* Just update the inode only */
2503 				TRANS_IUPDAT(ip, 1);
2504 				error = 0;
2505 			} else if (syncflag & FDSYNC)
2506 				/* Do data-synchronous writes */
2507 				error = TRANS_SYNCIP(ip, 0, I_DSYNC, TOP_FSYNC);
2508 			else
2509 				/* Do synchronous writes */
2510 				error = TRANS_SYNCIP(ip, 0, I_SYNC, TOP_FSYNC);
2511 
2512 		rw_enter(&ip->i_contents, RW_WRITER);
2513 		if (!error)
2514 			error = ufs_sync_indir(ip);
2515 		rw_exit(&ip->i_contents);
2516 	}
2517 out:
2518 	if (ulp) {
2519 		ufs_lockfs_end(ulp);
2520 	}
2521 	TRACE_2(TR_FAC_UFS, TR_UFS_FSYNC_END,
2522 		"ufs_fsync_end:vp %p error %d", vp, error);
2523 	return (error);
2524 }
2525 
2526 /*ARGSUSED*/
2527 static void
2528 ufs_inactive(struct vnode *vp, struct cred *cr)
2529 {
2530 	ufs_iinactive(VTOI(vp));
2531 }
2532 
2533 /*
2534  * Unix file system operations having to do with directory manipulation.
2535  */
2536 int ufs_lookup_idle_count = 2;	/* Number of inodes to idle each time */
2537 /* ARGSUSED */
2538 static int
2539 ufs_lookup(struct vnode *dvp, char *nm, struct vnode **vpp,
2540 	struct pathname *pnp, int flags, struct vnode *rdir, struct cred *cr)
2541 {
2542 	struct inode *ip;
2543 	struct inode *sip;
2544 	struct inode *xip;
2545 	struct ufsvfs *ufsvfsp;
2546 	struct ulockfs *ulp;
2547 	struct vnode *vp;
2548 	int error;
2549 
2550 	TRACE_2(TR_FAC_UFS, TR_UFS_LOOKUP_START,
2551 		"ufs_lookup_start:dvp %p name %s", dvp, nm);
2552 
2553 
2554 	/*
2555 	 * Check flags for type of lookup (regular file or attribute file)
2556 	 */
2557 
2558 	ip = VTOI(dvp);
2559 
2560 	if (flags & LOOKUP_XATTR) {
2561 
2562 		/*
2563 		 * We don't allow recursive attributes...
2564 		 * Maybe someday we will.
2565 		 */
2566 		if ((ip->i_cflags & IXATTR)) {
2567 			return (EINVAL);
2568 		}
2569 
2570 		if ((vp = dnlc_lookup(dvp, XATTR_DIR_NAME)) == NULL) {
2571 			error = ufs_xattr_getattrdir(dvp, &sip, flags, cr);
2572 			if (error) {
2573 				*vpp = NULL;
2574 				goto out;
2575 			}
2576 
2577 			vp = ITOV(sip);
2578 			dnlc_update(dvp, XATTR_DIR_NAME, vp);
2579 		}
2580 
2581 		/*
2582 		 * Check accessibility of directory.
2583 		 */
2584 		if (vp == DNLC_NO_VNODE) {
2585 			VN_RELE(vp);
2586 			error = ENOENT;
2587 			goto out;
2588 		}
2589 		if ((error = ufs_iaccess(VTOI(vp), IEXEC, cr)) != 0) {
2590 			VN_RELE(vp);
2591 			goto out;
2592 		}
2593 
2594 		*vpp = vp;
2595 		return (0);
2596 	}
2597 
2598 	/*
2599 	 * Check for a null component, which we should treat as
2600 	 * looking at dvp from within it's parent, so we don't
2601 	 * need a call to ufs_iaccess(), as it has already been
2602 	 * done.
2603 	 */
2604 	if (nm[0] == 0) {
2605 		VN_HOLD(dvp);
2606 		error = 0;
2607 		*vpp = dvp;
2608 		goto out;
2609 	}
2610 
2611 	/*
2612 	 * Check for "." ie itself. this is a quick check and
2613 	 * avoids adding "." into the dnlc (which have been seen
2614 	 * to occupy >10% of the cache).
2615 	 */
2616 	if ((nm[0] == '.') && (nm[1] == 0)) {
2617 		/*
2618 		 * Don't return without checking accessibility
2619 		 * of the directory. We only need the lock if
2620 		 * we are going to return it.
2621 		 */
2622 		if ((error = ufs_iaccess(ip, IEXEC, cr)) == 0) {
2623 			VN_HOLD(dvp);
2624 			*vpp = dvp;
2625 		}
2626 		goto out;
2627 	}
2628 
2629 	/*
2630 	 * Fast path: Check the directory name lookup cache.
2631 	 */
2632 	if (vp = dnlc_lookup(dvp, nm)) {
2633 		/*
2634 		 * Check accessibility of directory.
2635 		 */
2636 		if ((error = ufs_iaccess(ip, IEXEC, cr)) != 0) {
2637 			VN_RELE(vp);
2638 			goto out;
2639 		}
2640 		if (vp == DNLC_NO_VNODE) {
2641 			VN_RELE(vp);
2642 			error = ENOENT;
2643 			goto out;
2644 		}
2645 		xip = VTOI(vp);
2646 		ulp = NULL;
2647 		goto fastpath;
2648 	}
2649 
2650 	/*
2651 	 * Keep the idle queue from getting too long by
2652 	 * idling two inodes before attempting to allocate another.
2653 	 *    This operation must be performed before entering
2654 	 *    lockfs or a transaction.
2655 	 */
2656 	if (ufs_idle_q.uq_ne > ufs_idle_q.uq_hiwat)
2657 		if ((curthread->t_flag & T_DONTBLOCK) == 0) {
2658 			ins.in_lidles.value.ul += ufs_lookup_idle_count;
2659 			ufs_idle_some(ufs_lookup_idle_count);
2660 		}
2661 
2662 	ufsvfsp = ip->i_ufsvfs;
2663 	error = ufs_lockfs_begin(ufsvfsp, &ulp, ULOCKFS_LOOKUP_MASK);
2664 	if (error)
2665 		goto out;
2666 
2667 	error = ufs_dirlook(ip, nm, &xip, cr, 1);
2668 
2669 fastpath:
2670 	if (error == 0) {
2671 		ip = xip;
2672 		*vpp = ITOV(ip);
2673 
2674 		/*
2675 		 * If vnode is a device return special vnode instead.
2676 		 */
2677 		if (IS_DEVVP(*vpp)) {
2678 			struct vnode *newvp;
2679 
2680 			newvp = specvp(*vpp, (*vpp)->v_rdev, (*vpp)->v_type,
2681 			    cr);
2682 			VN_RELE(*vpp);
2683 			if (newvp == NULL)
2684 				error = ENOSYS;
2685 			else
2686 				*vpp = newvp;
2687 		}
2688 	}
2689 	if (ulp) {
2690 		ufs_lockfs_end(ulp);
2691 	}
2692 
2693 out:
2694 	TRACE_3(TR_FAC_UFS, TR_UFS_LOOKUP_END,
2695 		"ufs_lookup_end:dvp %p name %s error %d", vpp, nm, error);
2696 	return (error);
2697 }
2698 
2699 static int
2700 ufs_create(struct vnode *dvp, char *name, struct vattr *vap, enum vcexcl excl,
2701 	int mode, struct vnode **vpp, struct cred *cr, int flag)
2702 {
2703 	struct inode *ip;
2704 	struct inode *xip;
2705 	struct inode *dip;
2706 	struct vnode *xvp;
2707 	struct ufsvfs *ufsvfsp;
2708 	struct ulockfs *ulp;
2709 	int error;
2710 	int issync;
2711 	int truncflag;
2712 	int trans_size;
2713 	int noentry;
2714 	int defer_dip_seq_update = 0;	/* need to defer update of dip->i_seq */
2715 	int retry = 1;
2716 
2717 	TRACE_1(TR_FAC_UFS, TR_UFS_CREATE_START,
2718 		"ufs_create_start:dvp %p", dvp);
2719 
2720 again:
2721 	ip = VTOI(dvp);
2722 	ufsvfsp = ip->i_ufsvfs;
2723 	truncflag = 0;
2724 
2725 	error = ufs_lockfs_begin(ufsvfsp, &ulp, ULOCKFS_CREATE_MASK);
2726 	if (error)
2727 		goto out;
2728 
2729 	if (ulp) {
2730 		trans_size = (int)TOP_CREATE_SIZE(ip);
2731 		TRANS_BEGIN_CSYNC(ufsvfsp, issync, TOP_CREATE, trans_size);
2732 	}
2733 
2734 	if ((vap->va_mode & VSVTX) && secpolicy_vnode_stky_modify(cr) != 0)
2735 		vap->va_mode &= ~VSVTX;
2736 
2737 	if (*name == '\0') {
2738 		/*
2739 		 * Null component name refers to the directory itself.
2740 		 */
2741 		VN_HOLD(dvp);
2742 		/*
2743 		 * Even though this is an error case, we need to grab the
2744 		 * quota lock since the error handling code below is common.
2745 		 */
2746 		rw_enter(&ufsvfsp->vfs_dqrwlock, RW_READER);
2747 		rw_enter(&ip->i_contents, RW_WRITER);
2748 		error = EEXIST;
2749 	} else {
2750 		xip = NULL;
2751 		noentry = 0;
2752 		rw_enter(&ip->i_rwlock, RW_WRITER);
2753 		xvp = dnlc_lookup(dvp, name);
2754 		if (xvp == DNLC_NO_VNODE) {
2755 			noentry = 1;
2756 			VN_RELE(xvp);
2757 			xvp = NULL;
2758 		}
2759 		if (xvp) {
2760 			rw_exit(&ip->i_rwlock);
2761 			if (error = ufs_iaccess(ip, IEXEC, cr)) {
2762 				VN_RELE(xvp);
2763 			} else {
2764 				error = EEXIST;
2765 				xip = VTOI(xvp);
2766 			}
2767 		} else {
2768 			/*
2769 			 * Suppress file system full message if we will retry
2770 			 */
2771 			error = ufs_direnter_cm(ip, name, DE_CREATE,
2772 				vap, &xip, cr,
2773 				(noentry | (retry ? IQUIET : 0)));
2774 			rw_exit(&ip->i_rwlock);
2775 		}
2776 		ip = xip;
2777 		if (ip != NULL) {
2778 			rw_enter(&ufsvfsp->vfs_dqrwlock, RW_READER);
2779 			rw_enter(&ip->i_contents, RW_WRITER);
2780 		}
2781 	}
2782 
2783 	/*
2784 	 * If the file already exists and this is a non-exclusive create,
2785 	 * check permissions and allow access for non-directories.
2786 	 * Read-only create of an existing directory is also allowed.
2787 	 * We fail an exclusive create of anything which already exists.
2788 	 */
2789 	if (error == EEXIST) {
2790 		dip = VTOI(dvp);
2791 		if (excl == NONEXCL) {
2792 			if ((((ip->i_mode & IFMT) == IFDIR) ||
2793 			    ((ip->i_mode & IFMT) == IFATTRDIR)) &&
2794 			    (mode & IWRITE))
2795 				error = EISDIR;
2796 			else if (mode)
2797 				error = ufs_iaccess(ip, mode, cr);
2798 			else
2799 				error = 0;
2800 		}
2801 		if (error) {
2802 			rw_exit(&ip->i_contents);
2803 			rw_exit(&ufsvfsp->vfs_dqrwlock);
2804 			VN_RELE(ITOV(ip));
2805 			goto unlock;
2806 		}
2807 		/*
2808 		 * If the error EEXIST was set, then i_seq can not
2809 		 * have been updated. The sequence number interface
2810 		 * is defined such that a non-error VOP_CREATE must
2811 		 * increase the dir va_seq it by at least one. If we
2812 		 * have cleared the error, increase i_seq. Note that
2813 		 * we are increasing the dir i_seq and in rare cases
2814 		 * ip may actually be from the dvp, so we already have
2815 		 * the locks and it will not be subject to truncation.
2816 		 * In case we have to update i_seq of the parent
2817 		 * directory dip, we have to defer it till we have
2818 		 * released our locks on ip due to lock ordering requirements.
2819 		 */
2820 		if (ip != dip)
2821 			defer_dip_seq_update = 1;
2822 		else
2823 			ip->i_seq++;
2824 
2825 		if (((ip->i_mode & IFMT) == IFREG) &&
2826 		    (vap->va_mask & AT_SIZE) && vap->va_size == 0) {
2827 			/*
2828 			 * Truncate regular files, if requested by caller.
2829 			 * Grab i_rwlock to make sure no one else is
2830 			 * currently writing to the file (we promised
2831 			 * bmap we would do this).
2832 			 * Must get the locks in the correct order.
2833 			 */
2834 			if (ip->i_size == 0) {
2835 				ip->i_flag |= ICHG | IUPD;
2836 				ip->i_seq++;
2837 				TRANS_INODE(ufsvfsp, ip);
2838 			} else {
2839 				/*
2840 				 * Large Files: Why this check here?
2841 				 * Though we do it in vn_create() we really
2842 				 * want to guarantee that we do not destroy
2843 				 * Large file data by atomically checking
2844 				 * the size while holding the contents
2845 				 * lock.
2846 				 */
2847 				if (flag && !(flag & FOFFMAX) &&
2848 				    ((ip->i_mode & IFMT) == IFREG) &&
2849 				    (ip->i_size > (offset_t)MAXOFF32_T)) {
2850 					rw_exit(&ip->i_contents);
2851 					rw_exit(&ufsvfsp->vfs_dqrwlock);
2852 					error = EOVERFLOW;
2853 					goto unlock;
2854 				}
2855 				if (TRANS_ISTRANS(ufsvfsp))
2856 					truncflag++;
2857 				else {
2858 					rw_exit(&ip->i_contents);
2859 					rw_exit(&ufsvfsp->vfs_dqrwlock);
2860 					rw_enter(&ip->i_rwlock, RW_WRITER);
2861 					rw_enter(&ufsvfsp->vfs_dqrwlock,
2862 							RW_READER);
2863 					rw_enter(&ip->i_contents, RW_WRITER);
2864 					(void) ufs_itrunc(ip, (u_offset_t)0, 0,
2865 								cr);
2866 					rw_exit(&ip->i_rwlock);
2867 				}
2868 			}
2869 		}
2870 	}
2871 
2872 	if (error) {
2873 		if (ip != NULL) {
2874 			rw_exit(&ufsvfsp->vfs_dqrwlock);
2875 			rw_exit(&ip->i_contents);
2876 		}
2877 		goto unlock;
2878 	}
2879 
2880 	*vpp = ITOV(ip);
2881 	ITIMES(ip);
2882 	rw_exit(&ip->i_contents);
2883 	rw_exit(&ufsvfsp->vfs_dqrwlock);
2884 
2885 	/*
2886 	 * If vnode is a device return special vnode instead.
2887 	 */
2888 	if (!error && IS_DEVVP(*vpp)) {
2889 		struct vnode *newvp;
2890 
2891 		newvp = specvp(*vpp, (*vpp)->v_rdev, (*vpp)->v_type, cr);
2892 		VN_RELE(*vpp);
2893 		if (newvp == NULL) {
2894 			error = ENOSYS;
2895 			goto unlock;
2896 		}
2897 		truncflag = 0;
2898 		*vpp = newvp;
2899 	}
2900 unlock:
2901 
2902 	/*
2903 	 * Do the deferred update of the parent directory's sequence
2904 	 * number now.
2905 	 */
2906 	if (defer_dip_seq_update == 1) {
2907 		rw_enter(&dip->i_contents, RW_READER);
2908 		mutex_enter(&dip->i_tlock);
2909 		dip->i_seq++;
2910 		mutex_exit(&dip->i_tlock);
2911 		rw_exit(&dip->i_contents);
2912 	}
2913 
2914 	if (ulp) {
2915 		int terr = 0;
2916 
2917 		TRANS_END_CSYNC(ufsvfsp, terr, issync, TOP_CREATE,
2918 		    trans_size);
2919 
2920 		/*
2921 		 * If we haven't had a more interesting failure
2922 		 * already, then anything that might've happened
2923 		 * here should be reported.
2924 		 */
2925 		if (error == 0)
2926 			error = terr;
2927 	}
2928 
2929 	if (!error && truncflag) {
2930 		rw_enter(&ip->i_rwlock, RW_WRITER);
2931 		(void) TRANS_ITRUNC(ip, (u_offset_t)0, 0, cr);
2932 		rw_exit(&ip->i_rwlock);
2933 	}
2934 
2935 	if (ulp)
2936 		ufs_lockfs_end(ulp);
2937 
2938 	/*
2939 	 * If no inodes available, try to free one up out of the
2940 	 * pending delete queue.
2941 	 */
2942 	if ((error == ENOSPC) && retry && TRANS_ISTRANS(ufsvfsp)) {
2943 		ufs_delete_drain_wait(ufsvfsp, 1);
2944 		retry = 0;
2945 		goto again;
2946 	}
2947 
2948 out:
2949 	TRACE_3(TR_FAC_UFS, TR_UFS_CREATE_END,
2950 		"ufs_create_end:dvp %p name %s error %d", vpp, name, error);
2951 	return (error);
2952 }
2953 
2954 extern int ufs_idle_max;
2955 /*ARGSUSED*/
2956 static int
2957 ufs_remove(struct vnode *vp, char *nm, struct cred *cr)
2958 {
2959 	struct inode *ip = VTOI(vp);
2960 	struct ufsvfs *ufsvfsp	= ip->i_ufsvfs;
2961 	struct ulockfs *ulp;
2962 	vnode_t *rmvp = NULL;	/* Vnode corresponding to name being removed */
2963 	int error;
2964 	int issync;
2965 	int trans_size;
2966 
2967 	TRACE_1(TR_FAC_UFS, TR_UFS_REMOVE_START,
2968 		"ufs_remove_start:vp %p", vp);
2969 
2970 	/*
2971 	 * don't let the delete queue get too long
2972 	 */
2973 	if (ufsvfsp == NULL) {
2974 		error = EIO;
2975 		goto out;
2976 	}
2977 	if (ufsvfsp->vfs_delete.uq_ne > ufs_idle_max)
2978 		ufs_delete_drain(vp->v_vfsp, 1, 1);
2979 
2980 	error = ufs_lockfs_begin(ufsvfsp, &ulp, ULOCKFS_REMOVE_MASK);
2981 	if (error)
2982 		goto out;
2983 
2984 	if (ulp)
2985 		TRANS_BEGIN_CSYNC(ufsvfsp, issync, TOP_REMOVE,
2986 		    trans_size = (int)TOP_REMOVE_SIZE(VTOI(vp)));
2987 
2988 	rw_enter(&ip->i_rwlock, RW_WRITER);
2989 	error = ufs_dirremove(ip, nm, (struct inode *)0, (struct vnode *)0,
2990 	    DR_REMOVE, cr, &rmvp);
2991 	rw_exit(&ip->i_rwlock);
2992 
2993 	if (ulp) {
2994 		TRANS_END_CSYNC(ufsvfsp, error, issync, TOP_REMOVE, trans_size);
2995 		ufs_lockfs_end(ulp);
2996 	}
2997 
2998 	/*
2999 	 * This must be called after the remove transaction is closed.
3000 	 */
3001 	if (rmvp != NULL) {
3002 		/* Only send the event if there were no errors */
3003 		if (error == 0)
3004 			vnevent_remove(rmvp);
3005 		VN_RELE(rmvp);
3006 	}
3007 out:
3008 	TRACE_3(TR_FAC_UFS, TR_UFS_REMOVE_END,
3009 		"ufs_remove_end:vp %p name %s error %d", vp, nm, error);
3010 	return (error);
3011 }
3012 
3013 /*
3014  * Link a file or a directory.  Only privileged processes are allowed to
3015  * make links to directories.
3016  */
3017 static int
3018 ufs_link(struct vnode *tdvp, struct vnode *svp, char *tnm, struct cred *cr)
3019 {
3020 	struct inode *sip;
3021 	struct inode *tdp = VTOI(tdvp);
3022 	struct ufsvfs *ufsvfsp = tdp->i_ufsvfs;
3023 	struct ulockfs *ulp;
3024 	struct vnode *realvp;
3025 	int error;
3026 	int issync;
3027 	int trans_size;
3028 	int isdev;
3029 
3030 	TRACE_1(TR_FAC_UFS, TR_UFS_LINK_START,
3031 		"ufs_link_start:tdvp %p", tdvp);
3032 
3033 	error = ufs_lockfs_begin(ufsvfsp, &ulp, ULOCKFS_LINK_MASK);
3034 	if (error)
3035 		goto out;
3036 
3037 	if (ulp)
3038 		TRANS_BEGIN_CSYNC(ufsvfsp, issync, TOP_LINK,
3039 		    trans_size = (int)TOP_LINK_SIZE(VTOI(tdvp)));
3040 
3041 	if (VOP_REALVP(svp, &realvp) == 0)
3042 		svp = realvp;
3043 
3044 	/*
3045 	 * Make sure link for extended attributes is valid
3046 	 * We only support hard linking of attr in ATTRDIR to ATTRDIR
3047 	 *
3048 	 * Make certain we don't attempt to look at a device node as
3049 	 * a ufs inode.
3050 	 */
3051 
3052 	isdev = IS_DEVVP(svp);
3053 	if (((isdev == 0) && ((VTOI(svp)->i_cflags & IXATTR) == 0) &&
3054 	    ((tdp->i_mode & IFMT) == IFATTRDIR)) ||
3055 	    ((isdev == 0) && (VTOI(svp)->i_cflags & IXATTR) &&
3056 	    ((tdp->i_mode & IFMT) == IFDIR))) {
3057 		error = EINVAL;
3058 		goto unlock;
3059 	}
3060 
3061 	sip = VTOI(svp);
3062 	if ((svp->v_type == VDIR &&
3063 	    secpolicy_fs_linkdir(cr, ufsvfsp->vfs_vfs) != 0) ||
3064 	    (sip->i_uid != crgetuid(cr) && secpolicy_basic_link(cr) != 0)) {
3065 		error = EPERM;
3066 		goto unlock;
3067 	}
3068 	rw_enter(&tdp->i_rwlock, RW_WRITER);
3069 	error = ufs_direnter_lr(tdp, tnm, DE_LINK, (struct inode *)0,
3070 	    sip, cr, NULL);
3071 	rw_exit(&tdp->i_rwlock);
3072 
3073 unlock:
3074 	if (ulp) {
3075 		TRANS_END_CSYNC(ufsvfsp, error, issync, TOP_LINK, trans_size);
3076 		ufs_lockfs_end(ulp);
3077 	}
3078 out:
3079 	TRACE_2(TR_FAC_UFS, TR_UFS_LINK_END,
3080 		"ufs_link_end:tdvp %p error %d", tdvp, error);
3081 	return (error);
3082 }
3083 
3084 uint64_t ufs_rename_retry_cnt;
3085 uint64_t ufs_rename_upgrade_retry_cnt;
3086 uint64_t ufs_rename_dircheck_retry_cnt;
3087 clock_t	 ufs_rename_backoff_delay = 1;
3088 
3089 /*
3090  * Rename a file or directory.
3091  * We are given the vnode and entry string of the source and the
3092  * vnode and entry string of the place we want to move the source
3093  * to (the target). The essential operation is:
3094  *	unlink(target);
3095  *	link(source, target);
3096  *	unlink(source);
3097  * but "atomically".  Can't do full commit without saving state in
3098  * the inode on disk, which isn't feasible at this time.  Best we
3099  * can do is always guarantee that the TARGET exists.
3100  */
3101 /*ARGSUSED*/
3102 static int
3103 ufs_rename(
3104 	struct vnode *sdvp,		/* old (source) parent vnode */
3105 	char *snm,			/* old (source) entry name */
3106 	struct vnode *tdvp,		/* new (target) parent vnode */
3107 	char *tnm,			/* new (target) entry name */
3108 	struct cred *cr)
3109 {
3110 	struct inode *sip = NULL;	/* source inode */
3111 	struct inode *sdp;		/* old (source) parent inode */
3112 	struct inode *tdp;		/* new (target) parent inode */
3113 	struct vnode *tvp = NULL;	/* target vnode, if it exists */
3114 	struct vnode *realvp;
3115 	struct ufsvfs *ufsvfsp;
3116 	struct ulockfs *ulp;
3117 	int error;
3118 	int issync;
3119 	int trans_size;
3120 
3121 	TRACE_1(TR_FAC_UFS, TR_UFS_RENAME_START,
3122 		"ufs_rename_start:sdvp %p", sdvp);
3123 
3124 
3125 	sdp = VTOI(sdvp);
3126 	ufsvfsp = sdp->i_ufsvfs;
3127 	error = ufs_lockfs_begin(ufsvfsp, &ulp, ULOCKFS_RENAME_MASK);
3128 	if (error)
3129 		goto out;
3130 
3131 	if (ulp)
3132 		TRANS_BEGIN_CSYNC(ufsvfsp, issync, TOP_RENAME,
3133 		    trans_size = (int)TOP_RENAME_SIZE(sdp));
3134 
3135 	if (VOP_REALVP(tdvp, &realvp) == 0)
3136 		tdvp = realvp;
3137 
3138 	tdp = VTOI(tdvp);
3139 
3140 	/*
3141 	 * We only allow renaming of attributes from ATTRDIR to ATTRDIR.
3142 	 */
3143 	if ((tdp->i_mode & IFMT) != (sdp->i_mode & IFMT)) {
3144 		error = EINVAL;
3145 		goto unlock;
3146 	}
3147 
3148 	/*
3149 	 * Look up inode of file we're supposed to rename.
3150 	 */
3151 	if (error = ufs_dirlook(sdp, snm, &sip, cr, 0)) {
3152 		goto unlock;
3153 	}
3154 
3155 	/*
3156 	 * Lock both the source and target directories (they may be
3157 	 * the same) to provide the atomicity semantics that was
3158 	 * previously provided by the per file system vfs_rename_lock
3159 	 *
3160 	 * with vfs_rename_lock removed to allow simultaneous renames
3161 	 * within a file system, ufs_dircheckpath can deadlock while
3162 	 * traversing back to ensure that source is not a parent directory
3163 	 * of target parent directory. This is because we get into
3164 	 * ufs_dircheckpath with the sdp and tdp locks held as RW_WRITER.
3165 	 * If the tdp and sdp of the simultaneous renames happen to be
3166 	 * in the path of each other, it can lead to a deadlock. This
3167 	 * can be avoided by getting the locks as RW_READER here and then
3168 	 * upgrading to RW_WRITER after completing the ufs_dircheckpath.
3169 	 */
3170 retry:
3171 	rw_enter(&tdp->i_rwlock, RW_READER);
3172 	if (tdp != sdp) {
3173 		/*
3174 		 * We're locking 2 peer level locks, so must use tryenter
3175 		 * on the 2nd to avoid deadlocks that would occur
3176 		 * if we renamed a->b and b->a concurrently.
3177 		 */
3178 		if (!rw_tryenter(&sdp->i_rwlock, RW_READER)) {
3179 			/*
3180 			 * Reverse the lock grabs in case we have heavy
3181 			 * contention on the 2nd lock.
3182 			 */
3183 			rw_exit(&tdp->i_rwlock);
3184 			rw_enter(&sdp->i_rwlock, RW_READER);
3185 			if (!rw_tryenter(&tdp->i_rwlock, RW_READER)) {
3186 				ufs_rename_retry_cnt++;
3187 				rw_exit(&sdp->i_rwlock);
3188 				goto retry;
3189 			}
3190 		}
3191 	}
3192 
3193 	if (sip == tdp) {
3194 		error = EINVAL;
3195 		goto errout;
3196 	}
3197 	/*
3198 	 * Make sure we can delete the source entry.  This requires
3199 	 * write permission on the containing directory.
3200 	 * Check for sticky directories.
3201 	 */
3202 	rw_enter(&sdp->i_contents, RW_READER);
3203 	rw_enter(&sip->i_contents, RW_READER);
3204 	if ((error = ufs_iaccess(sdp, IWRITE, cr)) != 0 ||
3205 	    (error = ufs_sticky_remove_access(sdp, sip, cr)) != 0) {
3206 		rw_exit(&sip->i_contents);
3207 		rw_exit(&sdp->i_contents);
3208 		goto errout;
3209 	}
3210 
3211 	/*
3212 	 * If this is a rename of a directory and the parent is
3213 	 * different (".." must be changed), then the source
3214 	 * directory must not be in the directory hierarchy
3215 	 * above the target, as this would orphan everything
3216 	 * below the source directory.  Also the user must have
3217 	 * write permission in the source so as to be able to
3218 	 * change "..".
3219 	 */
3220 	if ((((sip->i_mode & IFMT) == IFDIR) ||
3221 	    ((sip->i_mode & IFMT) == IFATTRDIR)) && sdp != tdp) {
3222 		ino_t	inum;
3223 
3224 		if ((error = ufs_iaccess(sip, IWRITE, cr))) {
3225 			rw_exit(&sip->i_contents);
3226 			rw_exit(&sdp->i_contents);
3227 			goto errout;
3228 		}
3229 		inum = sip->i_number;
3230 		rw_exit(&sip->i_contents);
3231 		rw_exit(&sdp->i_contents);
3232 		if ((error = ufs_dircheckpath(inum, tdp, sdp, cr))) {
3233 			/*
3234 			 * If we got EAGAIN ufs_dircheckpath detected a
3235 			 * potential deadlock and backed out. We need
3236 			 * to retry the operation since sdp and tdp have
3237 			 * to be released to avoid the deadlock.
3238 			 */
3239 			if (error == EAGAIN) {
3240 				rw_exit(&tdp->i_rwlock);
3241 				if (tdp != sdp)
3242 					rw_exit(&sdp->i_rwlock);
3243 				delay(ufs_rename_backoff_delay);
3244 				ufs_rename_dircheck_retry_cnt++;
3245 				goto retry;
3246 			}
3247 			goto errout;
3248 		}
3249 	} else {
3250 		rw_exit(&sip->i_contents);
3251 		rw_exit(&sdp->i_contents);
3252 	}
3253 
3254 
3255 	/*
3256 	 * Check for renaming '.' or '..' or alias of '.'
3257 	 */
3258 	if (strcmp(snm, ".") == 0 || strcmp(snm, "..") == 0 || sdp == sip) {
3259 		error = EINVAL;
3260 		goto errout;
3261 	}
3262 
3263 	/*
3264 	 * Simultaneous renames can deadlock in ufs_dircheckpath since it
3265 	 * tries to traverse back the file tree with both tdp and sdp held
3266 	 * as RW_WRITER. To avoid that we have to hold the tdp and sdp locks
3267 	 * as RW_READERS  till ufs_dircheckpath is done.
3268 	 * Now that ufs_dircheckpath is done with, we can upgrade the locks
3269 	 * to RW_WRITER.
3270 	 */
3271 	if (!rw_tryupgrade(&tdp->i_rwlock)) {
3272 		/*
3273 		 * The upgrade failed. We got to give away the lock
3274 		 * as to avoid deadlocking with someone else who is
3275 		 * waiting for writer lock. With the lock gone, we
3276 		 * cannot be sure the checks done above will hold
3277 		 * good when we eventually get them back as writer.
3278 		 * So if we can't upgrade we drop the locks and retry
3279 		 * everything again.
3280 		 */
3281 		rw_exit(&tdp->i_rwlock);
3282 		if (tdp != sdp)
3283 			rw_exit(&sdp->i_rwlock);
3284 		delay(ufs_rename_backoff_delay);
3285 		ufs_rename_upgrade_retry_cnt++;
3286 		goto retry;
3287 	}
3288 	if (tdp != sdp) {
3289 		if (!rw_tryupgrade(&sdp->i_rwlock)) {
3290 			/*
3291 			 * The upgrade failed. We got to give away the lock
3292 			 * as to avoid deadlocking with someone else who is
3293 			 * waiting for writer lock. With the lock gone, we
3294 			 * cannot be sure the checks done above will hold
3295 			 * good when we eventually get them back as writer.
3296 			 * So if we can't upgrade we drop the locks and retry
3297 			 * everything again.
3298 			 */
3299 			rw_exit(&tdp->i_rwlock);
3300 			rw_exit(&sdp->i_rwlock);
3301 			delay(ufs_rename_backoff_delay);
3302 			ufs_rename_upgrade_retry_cnt++;
3303 			goto retry;
3304 		}
3305 	}
3306 	/*
3307 	 * Link source to the target.  If a target exists, return its
3308 	 * vnode pointer in tvp.  We'll release it after sending the
3309 	 * vnevent.
3310 	 */
3311 	if (error = ufs_direnter_lr(tdp, tnm, DE_RENAME, sdp, sip, cr, &tvp)) {
3312 		/*
3313 		 * ESAME isn't really an error; it indicates that the
3314 		 * operation should not be done because the source and target
3315 		 * are the same file, but that no error should be reported.
3316 		 */
3317 		if (error == ESAME)
3318 			error = 0;
3319 		goto errout;
3320 	}
3321 
3322 	/*
3323 	 * Unlink the source.
3324 	 * Remove the source entry.  ufs_dirremove() checks that the entry
3325 	 * still reflects sip, and returns an error if it doesn't.
3326 	 * If the entry has changed just forget about it.  Release
3327 	 * the source inode.
3328 	 */
3329 	if ((error = ufs_dirremove(sdp, snm, sip, (struct vnode *)0,
3330 	    DR_RENAME, cr, NULL)) == ENOENT)
3331 		error = 0;
3332 
3333 errout:
3334 	rw_exit(&tdp->i_rwlock);
3335 	if (sdp != tdp) {
3336 		rw_exit(&sdp->i_rwlock);
3337 	}
3338 
3339 unlock:
3340 	if (ulp) {
3341 		TRANS_END_CSYNC(ufsvfsp, error, issync, TOP_RENAME, trans_size);
3342 		ufs_lockfs_end(ulp);
3343 	}
3344 
3345 	/*
3346 	 * If no errors, send the appropriate events on the source
3347 	 * and destination (a.k.a, target) vnodes, if they exist.
3348 	 * This has to be done after the rename transaction has closed.
3349 	 */
3350 	if (error == 0) {
3351 		if (tvp != NULL)
3352 			vnevent_rename_dest(tvp);
3353 		/*
3354 		 * Note that if ufs_direnter_lr() returned ESAME then
3355 		 * this event will still be sent.  This isn't expected
3356 		 * to be a problem for anticipated usage by consumers.
3357 		 */
3358 		if (sip != NULL)
3359 			vnevent_rename_src(ITOV(sip));
3360 	}
3361 
3362 	if (tvp != NULL)
3363 		VN_RELE(tvp);
3364 
3365 	if (sip != NULL)
3366 		VN_RELE(ITOV(sip));
3367 
3368 out:
3369 	TRACE_5(TR_FAC_UFS, TR_UFS_RENAME_END,
3370 		"ufs_rename_end:sdvp %p snm %s tdvp %p tnm %s error %d",
3371 			sdvp, snm, tdvp, tnm, error);
3372 	return (error);
3373 }
3374 
3375 /*ARGSUSED*/
3376 static int
3377 ufs_mkdir(struct vnode *dvp, char *dirname, struct vattr *vap,
3378 	struct vnode **vpp, struct cred *cr)
3379 {
3380 	struct inode *ip;
3381 	struct inode *xip;
3382 	struct ufsvfs *ufsvfsp;
3383 	struct ulockfs *ulp;
3384 	int error;
3385 	int issync;
3386 	int trans_size;
3387 	int retry = 1;
3388 
3389 	ASSERT((vap->va_mask & (AT_TYPE|AT_MODE)) == (AT_TYPE|AT_MODE));
3390 
3391 	TRACE_1(TR_FAC_UFS, TR_UFS_MKDIR_START,
3392 		"ufs_mkdir_start:dvp %p", dvp);
3393 
3394 	/*
3395 	 * Can't make directory in attr hidden dir
3396 	 */
3397 	if ((VTOI(dvp)->i_mode & IFMT) == IFATTRDIR)
3398 		return (EINVAL);
3399 
3400 again:
3401 	ip = VTOI(dvp);
3402 	ufsvfsp = ip->i_ufsvfs;
3403 	error = ufs_lockfs_begin(ufsvfsp, &ulp, ULOCKFS_MKDIR_MASK);
3404 	if (error)
3405 		goto out;
3406 	if (ulp)
3407 		TRANS_BEGIN_CSYNC(ufsvfsp, issync, TOP_MKDIR,
3408 		    trans_size = (int)TOP_MKDIR_SIZE(ip));
3409 
3410 	rw_enter(&ip->i_rwlock, RW_WRITER);
3411 
3412 	error = ufs_direnter_cm(ip, dirname, DE_MKDIR, vap, &xip, cr,
3413 		(retry ? IQUIET : 0));
3414 
3415 	rw_exit(&ip->i_rwlock);
3416 	if (error == 0) {
3417 		ip = xip;
3418 		*vpp = ITOV(ip);
3419 	} else if (error == EEXIST)
3420 		VN_RELE(ITOV(xip));
3421 
3422 	if (ulp) {
3423 		int terr = 0;
3424 		TRANS_END_CSYNC(ufsvfsp, terr, issync, TOP_MKDIR, trans_size);
3425 		ufs_lockfs_end(ulp);
3426 		if (error == 0)
3427 			error = terr;
3428 	}
3429 out:
3430 	if ((error == ENOSPC) && retry && TRANS_ISTRANS(ufsvfsp)) {
3431 		ufs_delete_drain_wait(ufsvfsp, 1);
3432 		retry = 0;
3433 		goto again;
3434 	}
3435 
3436 	TRACE_2(TR_FAC_UFS, TR_UFS_MKDIR_END,
3437 		"ufs_mkdir_end:dvp %p error %d", dvp, error);
3438 	return (error);
3439 }
3440 
3441 /*ARGSUSED*/
3442 static int
3443 ufs_rmdir(struct vnode *vp, char *nm, struct vnode *cdir, struct cred *cr)
3444 {
3445 	struct inode *ip = VTOI(vp);
3446 	struct ufsvfs *ufsvfsp = ip->i_ufsvfs;
3447 	struct ulockfs *ulp;
3448 	vnode_t *rmvp = NULL;	/* Vnode of removed directory */
3449 	int error;
3450 	int issync;
3451 
3452 	TRACE_1(TR_FAC_UFS, TR_UFS_RMDIR_START,
3453 		"ufs_rmdir_start:vp %p", vp);
3454 
3455 	/*
3456 	 * don't let the delete queue get too long
3457 	 */
3458 	if (ufsvfsp == NULL) {
3459 		error = EIO;
3460 		goto out;
3461 	}
3462 	if (ufsvfsp->vfs_delete.uq_ne > ufs_idle_max)
3463 		ufs_delete_drain(vp->v_vfsp, 1, 1);
3464 
3465 	error = ufs_lockfs_begin(ufsvfsp, &ulp, ULOCKFS_RMDIR_MASK);
3466 	if (error)
3467 		goto out;
3468 
3469 	if (ulp)
3470 		TRANS_BEGIN_CSYNC(ufsvfsp, issync, TOP_RMDIR, TOP_RMDIR_SIZE);
3471 
3472 	rw_enter(&ip->i_rwlock, RW_WRITER);
3473 	error = ufs_dirremove(ip, nm, (struct inode *)0, cdir, DR_RMDIR, cr,
3474 									&rmvp);
3475 	rw_exit(&ip->i_rwlock);
3476 
3477 	if (ulp) {
3478 		TRANS_END_CSYNC(ufsvfsp, error, issync, TOP_RMDIR,
3479 				TOP_RMDIR_SIZE);
3480 		ufs_lockfs_end(ulp);
3481 	}
3482 
3483 	/*
3484 	 * This must be done AFTER the rmdir transaction has closed.
3485 	 */
3486 	if (rmvp != NULL) {
3487 		/* Only send the event if there were no errors */
3488 		if (error == 0)
3489 			vnevent_rmdir(rmvp);
3490 		VN_RELE(rmvp);
3491 	}
3492 out:
3493 	TRACE_2(TR_FAC_UFS, TR_UFS_RMDIR_END,
3494 		"ufs_rmdir_end:vp %p error %d", vp, error);
3495 
3496 	return (error);
3497 }
3498 
3499 /* ARGSUSED */
3500 static int
3501 ufs_readdir(
3502 	struct vnode *vp,
3503 	struct uio *uiop,
3504 	struct cred *cr,
3505 	int *eofp)
3506 {
3507 	struct iovec *iovp;
3508 	struct inode *ip;
3509 	struct direct *idp;
3510 	struct dirent64 *odp;
3511 	struct fbuf *fbp;
3512 	struct ufsvfs *ufsvfsp;
3513 	struct ulockfs *ulp;
3514 	caddr_t outbuf;
3515 	size_t bufsize;
3516 	uint_t offset;
3517 	uint_t bytes_wanted, total_bytes_wanted;
3518 	int incount = 0;
3519 	int outcount = 0;
3520 	int error;
3521 
3522 	ip = VTOI(vp);
3523 	ASSERT(RW_READ_HELD(&ip->i_rwlock));
3524 
3525 	TRACE_2(TR_FAC_UFS, TR_UFS_READDIR_START,
3526 		"ufs_readdir_start:vp %p uiop %p", vp, uiop);
3527 
3528 	if (uiop->uio_loffset >= MAXOFF32_T) {
3529 		if (eofp)
3530 			*eofp = 1;
3531 		return (0);
3532 	}
3533 
3534 	/*
3535 	 * Check if we have been called with a valid iov_len
3536 	 * and bail out if not, otherwise we may potentially loop
3537 	 * forever further down.
3538 	 */
3539 	if (uiop->uio_iov->iov_len <= 0) {
3540 		error = EINVAL;
3541 		goto out;
3542 	}
3543 
3544 	/*
3545 	 * Large Files: When we come here we are guaranteed that
3546 	 * uio_offset can be used safely. The high word is zero.
3547 	 */
3548 
3549 	ufsvfsp = ip->i_ufsvfs;
3550 	error = ufs_lockfs_begin(ufsvfsp, &ulp, ULOCKFS_READDIR_MASK);
3551 	if (error)
3552 		goto out;
3553 
3554 	iovp = uiop->uio_iov;
3555 	total_bytes_wanted = iovp->iov_len;
3556 
3557 	/* Large Files: directory files should not be "large" */
3558 
3559 	ASSERT(ip->i_size <= MAXOFF32_T);
3560 
3561 	/* Force offset to be valid (to guard against bogus lseek() values) */
3562 	offset = (uint_t)uiop->uio_offset & ~(DIRBLKSIZ - 1);
3563 
3564 	/* Quit if at end of file or link count of zero (posix) */
3565 	if (offset >= (uint_t)ip->i_size || ip->i_nlink <= 0) {
3566 		if (eofp)
3567 			*eofp = 1;
3568 		error = 0;
3569 		goto unlock;
3570 	}
3571 
3572 	/*
3573 	 * Get space to change directory entries into fs independent format.
3574 	 * Do fast alloc for the most commonly used-request size (filesystem
3575 	 * block size).
3576 	 */
3577 	if (uiop->uio_segflg != UIO_SYSSPACE || uiop->uio_iovcnt != 1) {
3578 		bufsize = total_bytes_wanted;
3579 		outbuf = kmem_alloc(bufsize, KM_SLEEP);
3580 		odp = (struct dirent64 *)outbuf;
3581 	} else {
3582 		bufsize = total_bytes_wanted;
3583 		odp = (struct dirent64 *)iovp->iov_base;
3584 	}
3585 
3586 nextblk:
3587 	bytes_wanted = total_bytes_wanted;
3588 
3589 	/* Truncate request to file size */
3590 	if (offset + bytes_wanted > (int)ip->i_size)
3591 		bytes_wanted = (int)(ip->i_size - offset);
3592 
3593 	/* Comply with MAXBSIZE boundary restrictions of fbread() */
3594 	if ((offset & MAXBOFFSET) + bytes_wanted > MAXBSIZE)
3595 		bytes_wanted = MAXBSIZE - (offset & MAXBOFFSET);
3596 
3597 	/*
3598 	 * Read in the next chunk.
3599 	 * We are still holding the i_rwlock.
3600 	 */
3601 	error = fbread(vp, (offset_t)offset, bytes_wanted, S_OTHER, &fbp);
3602 
3603 	if (error)
3604 		goto update_inode;
3605 	if (!ULOCKFS_IS_NOIACC(ITOUL(ip)) && (ip->i_fs->fs_ronly == 0) &&
3606 	    (!ufsvfsp->vfs_noatime)) {
3607 		ip->i_flag |= IACC;
3608 	}
3609 	incount = 0;
3610 	idp = (struct direct *)fbp->fb_addr;
3611 	if (idp->d_ino == 0 && idp->d_reclen == 0 &&
3612 		idp->d_namlen == 0) {
3613 		cmn_err(CE_WARN, "ufs_readdir: bad dir, inumber = %llu, "
3614 			"fs = %s\n",
3615 			(u_longlong_t)ip->i_number, ufsvfsp->vfs_fs->fs_fsmnt);
3616 		fbrelse(fbp, S_OTHER);
3617 		error = ENXIO;
3618 		goto update_inode;
3619 	}
3620 	/* Transform to file-system independent format */
3621 	while (incount < bytes_wanted) {
3622 		/*
3623 		 * If the current directory entry is mangled, then skip
3624 		 * to the next block.  It would be nice to set the FSBAD
3625 		 * flag in the super-block so that a fsck is forced on
3626 		 * next reboot, but locking is a problem.
3627 		 */
3628 		if (idp->d_reclen & 0x3) {
3629 			offset = (offset + DIRBLKSIZ) & ~(DIRBLKSIZ-1);
3630 			break;
3631 		}
3632 
3633 		/* Skip to requested offset and skip empty entries */
3634 		if (idp->d_ino != 0 && offset >= (uint_t)uiop->uio_offset) {
3635 			ushort_t this_reclen =
3636 			    DIRENT64_RECLEN(idp->d_namlen);
3637 			/* Buffer too small for any entries */
3638 			if (!outcount && this_reclen > bufsize) {
3639 				fbrelse(fbp, S_OTHER);
3640 				error = EINVAL;
3641 				goto update_inode;
3642 			}
3643 			/* If would overrun the buffer, quit */
3644 			if (outcount + this_reclen > bufsize) {
3645 				break;
3646 			}
3647 			/* Take this entry */
3648 			odp->d_ino = (ino64_t)idp->d_ino;
3649 			odp->d_reclen = (ushort_t)this_reclen;
3650 			odp->d_off = (offset_t)(offset + idp->d_reclen);
3651 
3652 			/* use strncpy(9f) to zero out uninitialized bytes */
3653 
3654 			ASSERT(strlen(idp->d_name) + 1 <=
3655 			    DIRENT64_NAMELEN(this_reclen));
3656 			(void) strncpy(odp->d_name, idp->d_name,
3657 			    DIRENT64_NAMELEN(this_reclen));
3658 			outcount += odp->d_reclen;
3659 			odp = (struct dirent64 *)((intptr_t)odp +
3660 				    odp->d_reclen);
3661 			ASSERT(outcount <= bufsize);
3662 		}
3663 		if (idp->d_reclen) {
3664 			incount += idp->d_reclen;
3665 			offset += idp->d_reclen;
3666 			idp = (struct direct *)((intptr_t)idp + idp->d_reclen);
3667 		} else {
3668 			offset = (offset + DIRBLKSIZ) & ~(DIRBLKSIZ-1);
3669 			break;
3670 		}
3671 	}
3672 	/* Release the chunk */
3673 	fbrelse(fbp, S_OTHER);
3674 
3675 	/* Read whole block, but got no entries, read another if not eof */
3676 
3677 	/*
3678 	 * Large Files: casting i_size to int here is not a problem
3679 	 * because directory sizes are always less than MAXOFF32_T.
3680 	 * See assertion above.
3681 	 */
3682 
3683 	if (offset < (int)ip->i_size && !outcount)
3684 		goto nextblk;
3685 
3686 	/* Copy out the entry data */
3687 	if (uiop->uio_segflg == UIO_SYSSPACE && uiop->uio_iovcnt == 1) {
3688 		iovp->iov_base += outcount;
3689 		iovp->iov_len -= outcount;
3690 		uiop->uio_resid -= outcount;
3691 		uiop->uio_offset = offset;
3692 	} else if ((error = uiomove(outbuf, (long)outcount, UIO_READ,
3693 				    uiop)) == 0)
3694 		uiop->uio_offset = offset;
3695 update_inode:
3696 	ITIMES(ip);
3697 	if (uiop->uio_segflg != UIO_SYSSPACE || uiop->uio_iovcnt != 1)
3698 		kmem_free(outbuf, bufsize);
3699 
3700 	if (eofp && error == 0)
3701 		*eofp = (uiop->uio_offset >= (int)ip->i_size);
3702 unlock:
3703 	if (ulp) {
3704 		ufs_lockfs_end(ulp);
3705 	}
3706 out:
3707 	TRACE_2(TR_FAC_UFS, TR_UFS_READDIR_END,
3708 		"ufs_readdir_end:vp %p error %d", vp, error);
3709 	return (error);
3710 }
3711 
3712 /*ARGSUSED*/
3713 static int
3714 ufs_symlink(
3715 	struct vnode *dvp,		/* ptr to parent dir vnode */
3716 	char *linkname,			/* name of symbolic link */
3717 	struct vattr *vap,		/* attributes */
3718 	char *target,			/* target path */
3719 	struct cred *cr)		/* user credentials */
3720 {
3721 	struct inode *ip, *dip = VTOI(dvp);
3722 	struct ufsvfs *ufsvfsp = dip->i_ufsvfs;
3723 	struct ulockfs *ulp;
3724 	int error;
3725 	int issync;
3726 	int trans_size;
3727 	int residual;
3728 	int ioflag;
3729 	int retry = 1;
3730 
3731 	TRACE_1(TR_FAC_UFS, TR_UFS_SYMLINK_START,
3732 		"ufs_symlink_start:dvp %p", dvp);
3733 
3734 	/*
3735 	 * No symlinks in attrdirs at this time
3736 	 */
3737 	if ((VTOI(dvp)->i_mode & IFMT) == IFATTRDIR)
3738 		return (EINVAL);
3739 
3740 again:
3741 	ip = (struct inode *)NULL;
3742 	vap->va_type = VLNK;
3743 	vap->va_rdev = 0;
3744 
3745 	error = ufs_lockfs_begin(ufsvfsp, &ulp, ULOCKFS_SYMLINK_MASK);
3746 	if (error)
3747 		goto out;
3748 
3749 	if (ulp)
3750 		TRANS_BEGIN_CSYNC(ufsvfsp, issync, TOP_SYMLINK,
3751 		    trans_size = (int)TOP_SYMLINK_SIZE(dip));
3752 
3753 	/*
3754 	 * We must create the inode before the directory entry, to avoid
3755 	 * racing with readlink().  ufs_dirmakeinode requires that we
3756 	 * hold the quota lock as reader, and directory locks as writer.
3757 	 */
3758 
3759 	rw_enter(&dip->i_rwlock, RW_WRITER);
3760 	rw_enter(&ufsvfsp->vfs_dqrwlock, RW_READER);
3761 	rw_enter(&dip->i_contents, RW_WRITER);
3762 
3763 	/*
3764 	 * Suppress any out of inodes messages if we will retry on
3765 	 * ENOSP
3766 	 */
3767 	if (retry)
3768 		dip->i_flag |= IQUIET;
3769 
3770 	error = ufs_dirmakeinode(dip, &ip, vap, DE_SYMLINK, cr);
3771 
3772 	dip->i_flag &= ~IQUIET;
3773 
3774 	rw_exit(&dip->i_contents);
3775 	rw_exit(&ufsvfsp->vfs_dqrwlock);
3776 	rw_exit(&dip->i_rwlock);
3777 
3778 	if (error)
3779 		goto unlock;
3780 
3781 	/*
3782 	 * OK.  The inode has been created.  Write out the data of the
3783 	 * symbolic link.  Since symbolic links are metadata, and should
3784 	 * remain consistent across a system crash, we need to force the
3785 	 * data out synchronously.
3786 	 *
3787 	 * (This is a change from the semantics in earlier releases, which
3788 	 * only created symbolic links synchronously if the semi-documented
3789 	 * 'syncdir' option was set, or if we were being invoked by the NFS
3790 	 * server, which requires symbolic links to be created synchronously.)
3791 	 *
3792 	 * We need to pass in a pointer for the residual length; otherwise
3793 	 * ufs_rdwri() will always return EIO if it can't write the data,
3794 	 * even if the error was really ENOSPC or EDQUOT.
3795 	 */
3796 
3797 	ioflag = FWRITE | FDSYNC;
3798 	residual = 0;
3799 
3800 	rw_enter(&ufsvfsp->vfs_dqrwlock, RW_READER);
3801 	rw_enter(&ip->i_contents, RW_WRITER);
3802 
3803 	/*
3804 	 * Suppress file system full messages if we will retry
3805 	 */
3806 	if (retry)
3807 		ip->i_flag |= IQUIET;
3808 
3809 	error = ufs_rdwri(UIO_WRITE, ioflag, ip, target, strlen(target),
3810 	    (offset_t)0, UIO_SYSSPACE, &residual, cr);
3811 
3812 	ip->i_flag &= ~IQUIET;
3813 
3814 	if (error) {
3815 		rw_exit(&ip->i_contents);
3816 		rw_exit(&ufsvfsp->vfs_dqrwlock);
3817 		goto remove;
3818 	}
3819 
3820 	/*
3821 	 * If the link's data is small enough, we can cache it in the inode.
3822 	 * This is a "fast symbolic link".  We don't use the first direct
3823 	 * block because that's actually used to point at the symbolic link's
3824 	 * contents on disk; but we know that none of the other direct or
3825 	 * indirect blocks can be used because symbolic links are restricted
3826 	 * to be smaller than a file system block.
3827 	 */
3828 
3829 	ASSERT(MAXPATHLEN <= VBSIZE(ITOV(ip)));
3830 
3831 	if (ip->i_size > 0 && ip->i_size <= FSL_SIZE) {
3832 		if (kcopy(target, &ip->i_db[1], ip->i_size) == 0) {
3833 			ip->i_flag |= IFASTSYMLNK;
3834 		} else {
3835 			int i;
3836 			/* error, clear garbage left behind */
3837 			for (i = 1; i < NDADDR; i++)
3838 				ip->i_db[i] = 0;
3839 			for (i = 0; i < NIADDR; i++)
3840 				ip->i_ib[i] = 0;
3841 		}
3842 	}
3843 
3844 	rw_exit(&ip->i_contents);
3845 	rw_exit(&ufsvfsp->vfs_dqrwlock);
3846 
3847 	/*
3848 	 * OK.  We've successfully created the symbolic link.  All that
3849 	 * remains is to insert it into the appropriate directory.
3850 	 */
3851 
3852 	rw_enter(&dip->i_rwlock, RW_WRITER);
3853 	error = ufs_direnter_lr(dip, linkname, DE_SYMLINK, NULL, ip, cr, NULL);
3854 	rw_exit(&dip->i_rwlock);
3855 
3856 	/*
3857 	 * Fall through into remove-on-error code.  We're either done, or we
3858 	 * need to remove the inode (if we couldn't insert it).
3859 	 */
3860 
3861 remove:
3862 	if (error && (ip != NULL)) {
3863 		rw_enter(&ip->i_contents, RW_WRITER);
3864 		ip->i_nlink--;
3865 		ip->i_flag |= ICHG;
3866 		ip->i_seq++;
3867 		ufs_setreclaim(ip);
3868 		rw_exit(&ip->i_contents);
3869 	}
3870 
3871 unlock:
3872 	if (ip != NULL)
3873 		VN_RELE(ITOV(ip));
3874 
3875 	if (ulp) {
3876 		int terr = 0;
3877 
3878 		TRANS_END_CSYNC(ufsvfsp, terr, issync, TOP_SYMLINK,
3879 				trans_size);
3880 		ufs_lockfs_end(ulp);
3881 		if (error == 0)
3882 			error = terr;
3883 	}
3884 
3885 	/*
3886 	 * We may have failed due to lack of an inode or of a block to
3887 	 * store the target in.  Try flushing the delete queue to free
3888 	 * logically-available things up and try again.
3889 	 */
3890 	if ((error == ENOSPC) && retry && TRANS_ISTRANS(ufsvfsp)) {
3891 		ufs_delete_drain_wait(ufsvfsp, 1);
3892 		retry = 0;
3893 		goto again;
3894 	}
3895 
3896 out:
3897 	TRACE_2(TR_FAC_UFS, TR_UFS_SYMLINK_END,
3898 		"ufs_symlink_end:dvp %p error %d", dvp, error);
3899 	return (error);
3900 }
3901 
3902 /*
3903  * Ufs specific routine used to do ufs io.
3904  */
3905 int
3906 ufs_rdwri(enum uio_rw rw, int ioflag, struct inode *ip, caddr_t base,
3907 	ssize_t len, offset_t offset, enum uio_seg seg, int *aresid,
3908 	struct cred *cr)
3909 {
3910 	struct uio auio;
3911 	struct iovec aiov;
3912 	int error;
3913 
3914 	ASSERT(RW_LOCK_HELD(&ip->i_contents));
3915 
3916 	bzero((caddr_t)&auio, sizeof (uio_t));
3917 	bzero((caddr_t)&aiov, sizeof (iovec_t));
3918 
3919 	aiov.iov_base = base;
3920 	aiov.iov_len = len;
3921 	auio.uio_iov = &aiov;
3922 	auio.uio_iovcnt = 1;
3923 	auio.uio_loffset = offset;
3924 	auio.uio_segflg = (short)seg;
3925 	auio.uio_resid = len;
3926 
3927 	if (rw == UIO_WRITE) {
3928 		auio.uio_fmode = FWRITE;
3929 		auio.uio_extflg = UIO_COPY_DEFAULT;
3930 		auio.uio_llimit = curproc->p_fsz_ctl;
3931 		error = wrip(ip, &auio, ioflag, cr);
3932 	} else {
3933 		auio.uio_fmode = FREAD;
3934 		auio.uio_extflg = UIO_COPY_CACHED;
3935 		auio.uio_llimit = MAXOFFSET_T;
3936 		error = rdip(ip, &auio, ioflag, cr);
3937 	}
3938 
3939 	if (aresid) {
3940 		*aresid = auio.uio_resid;
3941 	} else if (auio.uio_resid) {
3942 		error = EIO;
3943 	}
3944 	return (error);
3945 }
3946 
3947 static int
3948 ufs_fid(vp, fidp)
3949 	struct vnode *vp;
3950 	struct fid *fidp;
3951 {
3952 	struct ufid *ufid;
3953 	struct inode *ip = VTOI(vp);
3954 
3955 	if (ip->i_ufsvfs == NULL)
3956 		return (EIO);
3957 
3958 	if (fidp->fid_len < (sizeof (struct ufid) - sizeof (ushort_t))) {
3959 		fidp->fid_len = sizeof (struct ufid) - sizeof (ushort_t);
3960 		return (ENOSPC);
3961 	}
3962 
3963 	ufid = (struct ufid *)fidp;
3964 	bzero((char *)ufid, sizeof (struct ufid));
3965 	ufid->ufid_len = sizeof (struct ufid) - sizeof (ushort_t);
3966 	ufid->ufid_ino = ip->i_number;
3967 	ufid->ufid_gen = ip->i_gen;
3968 
3969 	return (0);
3970 }
3971 
3972 /* ARGSUSED2 */
3973 static int
3974 ufs_rwlock(struct vnode *vp, int write_lock, caller_context_t *ctp)
3975 {
3976 	struct inode	*ip = VTOI(vp);
3977 	struct ufsvfs	*ufsvfsp;
3978 	int		forcedirectio;
3979 
3980 	/*
3981 	 * Read case is easy.
3982 	 */
3983 	if (!write_lock) {
3984 		rw_enter(&ip->i_rwlock, RW_READER);
3985 		return (V_WRITELOCK_FALSE);
3986 	}
3987 
3988 	/*
3989 	 * Caller has requested a writer lock, but that inhibits any
3990 	 * concurrency in the VOPs that follow. Acquire the lock shared
3991 	 * and defer exclusive access until it is known to be needed in
3992 	 * other VOP handlers. Some cases can be determined here.
3993 	 */
3994 
3995 	/*
3996 	 * If directio is not set, there is no chance of concurrency,
3997 	 * so just acquire the lock exclusive. Beware of a forced
3998 	 * unmount before looking at the mount option.
3999 	 */
4000 	ufsvfsp = ip->i_ufsvfs;
4001 	forcedirectio = ufsvfsp ? ufsvfsp->vfs_forcedirectio : 0;
4002 	if (!(ip->i_flag & IDIRECTIO || forcedirectio) ||
4003 	    !ufs_allow_shared_writes) {
4004 		rw_enter(&ip->i_rwlock, RW_WRITER);
4005 		return (V_WRITELOCK_TRUE);
4006 	}
4007 
4008 	/*
4009 	 * Mandatory locking forces acquiring i_rwlock exclusive.
4010 	 */
4011 	if (MANDLOCK(vp, ip->i_mode)) {
4012 		rw_enter(&ip->i_rwlock, RW_WRITER);
4013 		return (V_WRITELOCK_TRUE);
4014 	}
4015 
4016 	/*
4017 	 * Acquire the lock shared in case a concurrent write follows.
4018 	 * Mandatory locking could have become enabled before the lock
4019 	 * was acquired. Re-check and upgrade if needed.
4020 	 */
4021 	rw_enter(&ip->i_rwlock, RW_READER);
4022 	if (MANDLOCK(vp, ip->i_mode)) {
4023 		rw_exit(&ip->i_rwlock);
4024 		rw_enter(&ip->i_rwlock, RW_WRITER);
4025 		return (V_WRITELOCK_TRUE);
4026 	}
4027 	return (V_WRITELOCK_FALSE);
4028 }
4029 
4030 /*ARGSUSED*/
4031 static void
4032 ufs_rwunlock(struct vnode *vp, int write_lock, caller_context_t *ctp)
4033 {
4034 	struct inode	*ip = VTOI(vp);
4035 
4036 	rw_exit(&ip->i_rwlock);
4037 }
4038 
4039 /* ARGSUSED */
4040 static int
4041 ufs_seek(struct vnode *vp, offset_t ooff, offset_t *noffp)
4042 {
4043 	return ((*noffp < 0 || *noffp > MAXOFFSET_T) ? EINVAL : 0);
4044 }
4045 
4046 /* ARGSUSED */
4047 static int
4048 ufs_frlock(struct vnode *vp, int cmd, struct flock64 *bfp, int flag,
4049 	offset_t offset, struct flk_callback *flk_cbp, struct cred *cr)
4050 {
4051 	struct inode *ip = VTOI(vp);
4052 
4053 	if (ip->i_ufsvfs == NULL)
4054 		return (EIO);
4055 
4056 	/*
4057 	 * If file is being mapped, disallow frlock.
4058 	 * XXX I am not holding tlock while checking i_mapcnt because the
4059 	 * current locking strategy drops all locks before calling fs_frlock.
4060 	 * So, mapcnt could change before we enter fs_frlock making is
4061 	 * meaningless to have held tlock in the first place.
4062 	 */
4063 	if (ip->i_mapcnt > 0 && MANDLOCK(vp, ip->i_mode))
4064 		return (EAGAIN);
4065 	return (fs_frlock(vp, cmd, bfp, flag, offset, flk_cbp, cr));
4066 }
4067 
4068 /* ARGSUSED */
4069 static int
4070 ufs_space(
4071 	struct vnode *vp,
4072 	int cmd,
4073 	struct flock64 *bfp,
4074 	int flag,
4075 	offset_t offset,
4076 	cred_t *cr,
4077 	caller_context_t *ct)
4078 {
4079 	struct ufsvfs *ufsvfsp	= VTOI(vp)->i_ufsvfs;
4080 	struct ulockfs *ulp;
4081 	int error;
4082 
4083 	error = ufs_lockfs_begin(ufsvfsp, &ulp, ULOCKFS_SPACE_MASK);
4084 	if (error)
4085 		return (error);
4086 
4087 
4088 	if (cmd != F_FREESP)
4089 		error =  EINVAL;
4090 	else if ((error = convoff(vp, bfp, 0, offset)) == 0)
4091 		error = ufs_freesp(vp, bfp, flag, cr);
4092 
4093 	if (ulp)
4094 		ufs_lockfs_end(ulp);
4095 	return (error);
4096 }
4097 
4098 /*
4099  * Used to determine if read ahead should be done. Also used to
4100  * to determine when write back occurs.
4101  */
4102 #define	CLUSTSZ(ip)		((ip)->i_ufsvfs->vfs_ioclustsz)
4103 
4104 /*
4105  * A faster version of ufs_getpage.
4106  *
4107  * We optimize by inlining the pvn_getpages iterator, eliminating
4108  * calls to bmap_read if file doesn't have UFS holes, and avoiding
4109  * the overhead of page_exists().
4110  *
4111  * When files has UFS_HOLES and ufs_getpage is called with S_READ,
4112  * we set *protp to PROT_READ to avoid calling bmap_read. This approach
4113  * victimizes performance when a file with UFS holes is faulted
4114  * first in the S_READ mode, and then in the S_WRITE mode. We will get
4115  * two MMU faults in this case.
4116  *
4117  * XXX - the inode fields which control the sequential mode are not
4118  *	 protected by any mutex. The read ahead will act wild if
4119  *	 multiple processes will access the file concurrently and
4120  *	 some of them in sequential mode. One particulary bad case
4121  *	 is if another thread will change the value of i_nextrio between
4122  *	 the time this thread tests the i_nextrio value and then reads it
4123  *	 again to use it as the offset for the read ahead.
4124  */
4125 static int
4126 ufs_getpage(struct vnode *vp, offset_t off, size_t len, uint_t *protp,
4127 	page_t *plarr[], size_t plsz, struct seg *seg, caddr_t addr,
4128 	enum seg_rw rw, struct cred *cr)
4129 {
4130 	u_offset_t	uoff = (u_offset_t)off; /* type conversion */
4131 	u_offset_t	pgoff;
4132 	u_offset_t	eoff;
4133 	struct inode 	*ip = VTOI(vp);
4134 	struct ufsvfs	*ufsvfsp = ip->i_ufsvfs;
4135 	struct fs 	*fs;
4136 	struct ulockfs	*ulp;
4137 	page_t		**pl;
4138 	caddr_t		pgaddr;
4139 	krw_t		rwtype;
4140 	int 		err;
4141 	int		has_holes;
4142 	int		beyond_eof;
4143 	int		seqmode;
4144 	int		pgsize = PAGESIZE;
4145 	int		dolock;
4146 	int		do_qlock;
4147 	int		trans_size;
4148 
4149 	TRACE_1(TR_FAC_UFS, TR_UFS_GETPAGE_START,
4150 		"ufs_getpage_start:vp %p", vp);
4151 
4152 	ASSERT((uoff & PAGEOFFSET) == 0);
4153 
4154 	if (protp)
4155 		*protp = PROT_ALL;
4156 
4157 	/*
4158 	 * Obey the lockfs protocol
4159 	 */
4160 	err = ufs_lockfs_begin_getpage(ufsvfsp, &ulp, seg,
4161 			rw == S_READ || rw == S_EXEC, protp);
4162 	if (err)
4163 		goto out;
4164 
4165 	fs = ufsvfsp->vfs_fs;
4166 
4167 	if (ulp && (rw == S_CREATE || rw == S_WRITE) &&
4168 	    !(vp->v_flag & VISSWAP)) {
4169 		/*
4170 		 * Try to start a transaction, will return if blocking is
4171 		 * expected to occur and the address space is not the
4172 		 * kernel address space.
4173 		 */
4174 		trans_size = TOP_GETPAGE_SIZE(ip);
4175 		if (seg->s_as != &kas) {
4176 			TRANS_TRY_BEGIN_ASYNC(ufsvfsp, TOP_GETPAGE,
4177 				trans_size, err)
4178 			if (err == EWOULDBLOCK) {
4179 				/*
4180 				 * Use EDEADLK here because the VM code
4181 				 * can normally never see this error.
4182 				 */
4183 				err = EDEADLK;
4184 				ufs_lockfs_end(ulp);
4185 				goto out;
4186 			}
4187 		} else {
4188 			TRANS_BEGIN_ASYNC(ufsvfsp, TOP_GETPAGE, trans_size);
4189 		}
4190 	}
4191 
4192 	if (vp->v_flag & VNOMAP) {
4193 		err = ENOSYS;
4194 		goto unlock;
4195 	}
4196 
4197 	seqmode = ip->i_nextr == uoff && rw != S_CREATE;
4198 
4199 	rwtype = RW_READER;		/* start as a reader */
4200 	dolock = (rw_owner(&ip->i_contents) != curthread);
4201 	/*
4202 	 * If this thread owns the lock, i.e., this thread grabbed it
4203 	 * as writer somewhere above, then we don't need to grab the
4204 	 * lock as reader in this routine.
4205 	 */
4206 	do_qlock = (rw_owner(&ufsvfsp->vfs_dqrwlock) != curthread);
4207 
4208 retrylock:
4209 	if (dolock) {
4210 		/*
4211 		 * Grab the quota lock if we need to call
4212 		 * bmap_write() below (with i_contents as writer).
4213 		 */
4214 		if (do_qlock && rwtype == RW_WRITER)
4215 			rw_enter(&ufsvfsp->vfs_dqrwlock, RW_READER);
4216 		rw_enter(&ip->i_contents, rwtype);
4217 	}
4218 
4219 	/*
4220 	 * We may be getting called as a side effect of a bmap using
4221 	 * fbread() when the blocks might be being allocated and the
4222 	 * size has not yet been up'ed.  In this case we want to be
4223 	 * able to return zero pages if we get back UFS_HOLE from
4224 	 * calling bmap for a non write case here.  We also might have
4225 	 * to read some frags from the disk into a page if we are
4226 	 * extending the number of frags for a given lbn in bmap().
4227 	 * Large Files: The read of i_size here is atomic because
4228 	 * i_contents is held here. If dolock is zero, the lock
4229 	 * is held in bmap routines.
4230 	 */
4231 	beyond_eof = uoff + len > ip->i_size + PAGEOFFSET;
4232 	if (beyond_eof && seg != segkmap) {
4233 		if (dolock) {
4234 			rw_exit(&ip->i_contents);
4235 			if (do_qlock && rwtype == RW_WRITER)
4236 				rw_exit(&ufsvfsp->vfs_dqrwlock);
4237 		}
4238 		err = EFAULT;
4239 		goto unlock;
4240 	}
4241 
4242 	/*
4243 	 * Must hold i_contents lock throughout the call to pvn_getpages
4244 	 * since locked pages are returned from each call to ufs_getapage.
4245 	 * Must *not* return locked pages and then try for contents lock
4246 	 * due to lock ordering requirements (inode > page)
4247 	 */
4248 
4249 	has_holes = bmap_has_holes(ip);
4250 
4251 	if ((rw == S_WRITE || rw == S_CREATE) && has_holes && !beyond_eof) {
4252 		int	blk_size;
4253 		u_offset_t offset;
4254 
4255 		/*
4256 		 * We must acquire the RW_WRITER lock in order to
4257 		 * call bmap_write().
4258 		 */
4259 		if (dolock && rwtype == RW_READER) {
4260 			rwtype = RW_WRITER;
4261 
4262 			/*
4263 			 * Grab the quota lock before
4264 			 * upgrading i_contents, but if we can't grab it
4265 			 * don't wait here due to lock order:
4266 			 * vfs_dqrwlock > i_contents.
4267 			 */
4268 			if (do_qlock && rw_tryenter(&ufsvfsp->vfs_dqrwlock,
4269 							RW_READER) == 0) {
4270 				rw_exit(&ip->i_contents);
4271 				goto retrylock;
4272 			}
4273 			if (!rw_tryupgrade(&ip->i_contents)) {
4274 				rw_exit(&ip->i_contents);
4275 				if (do_qlock)
4276 					rw_exit(&ufsvfsp->vfs_dqrwlock);
4277 				goto retrylock;
4278 			}
4279 		}
4280 
4281 		/*
4282 		 * May be allocating disk blocks for holes here as
4283 		 * a result of mmap faults. write(2) does the bmap_write
4284 		 * in rdip/wrip, not here. We are not dealing with frags
4285 		 * in this case.
4286 		 */
4287 		/*
4288 		 * Large Files: We cast fs_bmask field to offset_t
4289 		 * just as we do for MAXBMASK because uoff is a 64-bit
4290 		 * data type. fs_bmask will still be a 32-bit type
4291 		 * as we cannot change any ondisk data structures.
4292 		 */
4293 
4294 		offset = uoff & (offset_t)fs->fs_bmask;
4295 		while (offset < uoff + len) {
4296 			blk_size = (int)blksize(fs, ip, lblkno(fs, offset));
4297 			err = bmap_write(ip, offset, blk_size, 0, cr);
4298 			if (ip->i_flag & (ICHG|IUPD))
4299 				ip->i_seq++;
4300 			if (err)
4301 				goto update_inode;
4302 			offset += blk_size; /* XXX - make this contig */
4303 		}
4304 	}
4305 
4306 	/*
4307 	 * Can be a reader from now on.
4308 	 */
4309 	if (dolock && rwtype == RW_WRITER) {
4310 		rw_downgrade(&ip->i_contents);
4311 		/*
4312 		 * We can release vfs_dqrwlock early so do it, but make
4313 		 * sure we don't try to release it again at the bottom.
4314 		 */
4315 		if (do_qlock) {
4316 			rw_exit(&ufsvfsp->vfs_dqrwlock);
4317 			do_qlock = 0;
4318 		}
4319 	}
4320 
4321 	/*
4322 	 * We remove PROT_WRITE in cases when the file has UFS holes
4323 	 * because we don't  want to call bmap_read() to check each
4324 	 * page if it is backed with a disk block.
4325 	 */
4326 	if (protp && has_holes && rw != S_WRITE && rw != S_CREATE)
4327 		*protp &= ~PROT_WRITE;
4328 
4329 	err = 0;
4330 
4331 	/*
4332 	 * The loop looks up pages in the range [off, off + len).
4333 	 * For each page, we first check if we should initiate an asynchronous
4334 	 * read ahead before we call page_lookup (we may sleep in page_lookup
4335 	 * for a previously initiated disk read).
4336 	 */
4337 	eoff = (uoff + len);
4338 	for (pgoff = uoff, pgaddr = addr, pl = plarr;
4339 	    pgoff < eoff; /* empty */) {
4340 		page_t	*pp;
4341 		u_offset_t	nextrio;
4342 		se_t	se;
4343 		int retval;
4344 
4345 		se = ((rw == S_CREATE || rw == S_OTHER) ? SE_EXCL : SE_SHARED);
4346 
4347 		/* Handle async getpage (faultahead) */
4348 		if (plarr == NULL) {
4349 			ip->i_nextrio = pgoff;
4350 			(void) ufs_getpage_ra(vp, pgoff, seg, pgaddr);
4351 			pgoff += pgsize;
4352 			pgaddr += pgsize;
4353 			continue;
4354 		}
4355 		/*
4356 		 * Check if we should initiate read ahead of next cluster.
4357 		 * We call page_exists only when we need to confirm that
4358 		 * we have the current page before we initiate the read ahead.
4359 		 */
4360 		nextrio = ip->i_nextrio;
4361 		if (seqmode &&
4362 		    pgoff + CLUSTSZ(ip) >= nextrio && pgoff <= nextrio &&
4363 		    nextrio < ip->i_size && page_exists(vp, pgoff)) {
4364 			retval = ufs_getpage_ra(vp, pgoff, seg, pgaddr);
4365 			/*
4366 			 * We always read ahead the next cluster of data
4367 			 * starting from i_nextrio. If the page (vp,nextrio)
4368 			 * is actually in core at this point, the routine
4369 			 * ufs_getpage_ra() will stop pre-fetching data
4370 			 * until we read that page in a synchronized manner
4371 			 * through ufs_getpage_miss(). So, we should increase
4372 			 * i_nextrio if the page (vp, nextrio) exists.
4373 			 */
4374 			if ((retval == 0) && page_exists(vp, nextrio)) {
4375 				ip->i_nextrio = nextrio + pgsize;
4376 			}
4377 		}
4378 
4379 		if ((pp = page_lookup(vp, pgoff, se)) != NULL) {
4380 			/*
4381 			 * We found the page in the page cache.
4382 			 */
4383 			*pl++ = pp;
4384 			pgoff += pgsize;
4385 			pgaddr += pgsize;
4386 			len -= pgsize;
4387 			plsz -= pgsize;
4388 		} else  {
4389 			/*
4390 			 * We have to create the page, or read it from disk.
4391 			 */
4392 			if (err = ufs_getpage_miss(vp, pgoff, len, seg, pgaddr,
4393 			    pl, plsz, rw, seqmode))
4394 				goto error;
4395 
4396 			while (*pl != NULL) {
4397 				pl++;
4398 				pgoff += pgsize;
4399 				pgaddr += pgsize;
4400 				len -= pgsize;
4401 				plsz -= pgsize;
4402 			}
4403 		}
4404 	}
4405 
4406 	/*
4407 	 * Return pages up to plsz if they are in the page cache.
4408 	 * We cannot return pages if there is a chance that they are
4409 	 * backed with a UFS hole and rw is S_WRITE or S_CREATE.
4410 	 */
4411 	if (plarr && !(has_holes && (rw == S_WRITE || rw == S_CREATE))) {
4412 
4413 		ASSERT((protp == NULL) ||
4414 			!(has_holes && (*protp & PROT_WRITE)));
4415 
4416 		eoff = pgoff + plsz;
4417 		while (pgoff < eoff) {
4418 			page_t		*pp;
4419 
4420 			if ((pp = page_lookup_nowait(vp, pgoff,
4421 			    SE_SHARED)) == NULL)
4422 				break;
4423 
4424 			*pl++ = pp;
4425 			pgoff += pgsize;
4426 			plsz -= pgsize;
4427 		}
4428 	}
4429 
4430 	if (plarr)
4431 		*pl = NULL;			/* Terminate page list */
4432 	ip->i_nextr = pgoff;
4433 
4434 error:
4435 	if (err && plarr) {
4436 		/*
4437 		 * Release any pages we have locked.
4438 		 */
4439 		while (pl > &plarr[0])
4440 			page_unlock(*--pl);
4441 
4442 		plarr[0] = NULL;
4443 	}
4444 
4445 update_inode:
4446 	/*
4447 	 * If the inode is not already marked for IACC (in rdip() for read)
4448 	 * and the inode is not marked for no access time update (in wrip()
4449 	 * for write) then update the inode access time and mod time now.
4450 	 */
4451 	if ((ip->i_flag & (IACC | INOACC)) == 0) {
4452 		if ((rw != S_OTHER) && (ip->i_mode & IFMT) != IFDIR) {
4453 			if (!ULOCKFS_IS_NOIACC(ITOUL(ip)) &&
4454 			    (fs->fs_ronly == 0) &&
4455 			    (!ufsvfsp->vfs_noatime)) {
4456 				mutex_enter(&ip->i_tlock);
4457 				ip->i_flag |= IACC;
4458 				ITIMES_NOLOCK(ip);
4459 				mutex_exit(&ip->i_tlock);
4460 			}
4461 		}
4462 	}
4463 
4464 	if (dolock) {
4465 		rw_exit(&ip->i_contents);
4466 		if (do_qlock && rwtype == RW_WRITER)
4467 			rw_exit(&ufsvfsp->vfs_dqrwlock);
4468 	}
4469 
4470 unlock:
4471 	if (ulp) {
4472 		if ((rw == S_CREATE || rw == S_WRITE) &&
4473 		    !(vp->v_flag & VISSWAP)) {
4474 			TRANS_END_ASYNC(ufsvfsp, TOP_GETPAGE, trans_size);
4475 		}
4476 		ufs_lockfs_end(ulp);
4477 	}
4478 out:
4479 	TRACE_2(TR_FAC_UFS, TR_UFS_GETPAGE_END,
4480 		"ufs_getpage_end:vp %p error %d", vp, err);
4481 	return (err);
4482 }
4483 
4484 /*
4485  * ufs_getpage_miss is called when ufs_getpage missed the page in the page
4486  * cache. The page is either read from the disk, or it's created.
4487  * A page is created (without disk read) if rw == S_CREATE, or if
4488  * the page is not backed with a real disk block (UFS hole).
4489  */
4490 /* ARGSUSED */
4491 static int
4492 ufs_getpage_miss(struct vnode *vp, u_offset_t off, size_t len, struct seg *seg,
4493 	caddr_t addr, page_t *pl[], size_t plsz, enum seg_rw rw, int seq)
4494 {
4495 	struct inode	*ip = VTOI(vp);
4496 	page_t		*pp;
4497 	daddr_t		bn;
4498 	size_t		io_len;
4499 	int		crpage;
4500 	int		err;
4501 	int		contig;
4502 	int		bsize = ip->i_fs->fs_bsize;
4503 
4504 	/*
4505 	 * Figure out whether the page can be created, or must be
4506 	 * must be read from the disk.
4507 	 */
4508 	if (rw == S_CREATE)
4509 		crpage = 1;
4510 	else {
4511 		contig = 0;
4512 		if (err = bmap_read(ip, off, &bn, &contig))
4513 			return (err);
4514 		crpage = (bn == UFS_HOLE);
4515 	}
4516 
4517 	if (crpage) {
4518 		if ((pp = page_create_va(vp, off, PAGESIZE, PG_WAIT, seg,
4519 		    addr)) == NULL) {
4520 			return (ufs_fault(vp,
4521 				    "ufs_getpage_miss: page_create == NULL"));
4522 		}
4523 
4524 		if (rw != S_CREATE)
4525 			pagezero(pp, 0, PAGESIZE);
4526 		io_len = PAGESIZE;
4527 	} else {
4528 		u_offset_t	io_off;
4529 		uint_t	xlen;
4530 		struct buf	*bp;
4531 		ufsvfs_t	*ufsvfsp = ip->i_ufsvfs;
4532 
4533 		/*
4534 		 * If access is not in sequential order, we read from disk
4535 		 * in bsize units.
4536 		 *
4537 		 * We limit the size of the transfer to bsize if we are reading
4538 		 * from the beginning of the file. Note in this situation we
4539 		 * will hedge our bets and initiate an async read ahead of
4540 		 * the second block.
4541 		 */
4542 		if (!seq || off == 0)
4543 			contig = MIN(contig, bsize);
4544 
4545 		pp = pvn_read_kluster(vp, off, seg, addr, &io_off,
4546 		    &io_len, off, contig, 0);
4547 
4548 		/*
4549 		 * Some other thread has entered the page.
4550 		 * ufs_getpage will retry page_lookup.
4551 		 */
4552 		if (pp == NULL) {
4553 			pl[0] = NULL;
4554 			return (0);
4555 		}
4556 
4557 		/*
4558 		 * Zero part of the page which we are not
4559 		 * going to read from the disk.
4560 		 */
4561 		xlen = io_len & PAGEOFFSET;
4562 		if (xlen != 0)
4563 			pagezero(pp->p_prev, xlen, PAGESIZE - xlen);
4564 
4565 		bp = pageio_setup(pp, io_len, ip->i_devvp, B_READ);
4566 		bp->b_edev = ip->i_dev;
4567 		bp->b_dev = cmpdev(ip->i_dev);
4568 		bp->b_blkno = bn;
4569 		bp->b_un.b_addr = (caddr_t)0;
4570 		bp->b_file = ip->i_vnode;
4571 		bp->b_offset = off;
4572 
4573 		if (ufsvfsp->vfs_log) {
4574 			lufs_read_strategy(ufsvfsp->vfs_log, bp);
4575 		} else if (ufsvfsp->vfs_snapshot) {
4576 			fssnap_strategy(&ufsvfsp->vfs_snapshot, bp);
4577 		} else {
4578 			ufsvfsp->vfs_iotstamp = lbolt;
4579 			ub.ub_getpages.value.ul++;
4580 			(void) bdev_strategy(bp);
4581 			lwp_stat_update(LWP_STAT_INBLK, 1);
4582 		}
4583 
4584 		ip->i_nextrio = off + ((io_len + PAGESIZE - 1) & PAGEMASK);
4585 
4586 		/*
4587 		 * If the file access is sequential, initiate read ahead
4588 		 * of the next cluster.
4589 		 */
4590 		if (seq && ip->i_nextrio < ip->i_size)
4591 			(void) ufs_getpage_ra(vp, off, seg, addr);
4592 		err = biowait(bp);
4593 		pageio_done(bp);
4594 
4595 		if (err) {
4596 			pvn_read_done(pp, B_ERROR);
4597 			return (err);
4598 		}
4599 	}
4600 
4601 	pvn_plist_init(pp, pl, plsz, off, io_len, rw);
4602 	return (0);
4603 }
4604 
4605 /*
4606  * Read ahead a cluster from the disk. Returns the length in bytes.
4607  */
4608 static int
4609 ufs_getpage_ra(struct vnode *vp, u_offset_t off, struct seg *seg, caddr_t addr)
4610 {
4611 	struct inode	*ip = VTOI(vp);
4612 	page_t		*pp;
4613 	u_offset_t	io_off = ip->i_nextrio;
4614 	ufsvfs_t	*ufsvfsp;
4615 	caddr_t		addr2 = addr + (io_off - off);
4616 	struct buf	*bp;
4617 	daddr_t		bn;
4618 	size_t		io_len;
4619 	int		contig;
4620 	int		xlen;
4621 	int		bsize = ip->i_fs->fs_bsize;
4622 
4623 	/*
4624 	 * If the directio advisory is in effect on this file,
4625 	 * then do not do buffered read ahead. Read ahead makes
4626 	 * it more difficult on threads using directio as they
4627 	 * will be forced to flush the pages from this vnode.
4628 	 */
4629 	if ((ufsvfsp = ip->i_ufsvfs) == NULL)
4630 		return (0);
4631 	if (ip->i_flag & IDIRECTIO || ufsvfsp->vfs_forcedirectio)
4632 		return (0);
4633 
4634 	/*
4635 	 * Is this test needed?
4636 	 */
4637 	if (addr2 >= seg->s_base + seg->s_size)
4638 		return (0);
4639 
4640 	contig = 0;
4641 	if (bmap_read(ip, io_off, &bn, &contig) != 0 || bn == UFS_HOLE)
4642 		return (0);
4643 
4644 	/*
4645 	 * Limit the transfer size to bsize if this is the 2nd block.
4646 	 */
4647 	if (io_off == (u_offset_t)bsize)
4648 		contig = MIN(contig, bsize);
4649 
4650 	if ((pp = pvn_read_kluster(vp, io_off, seg, addr2, &io_off,
4651 	    &io_len, io_off, contig, 1)) == NULL)
4652 		return (0);
4653 
4654 	/*
4655 	 * Zero part of page which we are not going to read from disk
4656 	 */
4657 	if ((xlen = (io_len & PAGEOFFSET)) > 0)
4658 		pagezero(pp->p_prev, xlen, PAGESIZE - xlen);
4659 
4660 	ip->i_nextrio = (io_off + io_len + PAGESIZE - 1) & PAGEMASK;
4661 
4662 	bp = pageio_setup(pp, io_len, ip->i_devvp, B_READ | B_ASYNC);
4663 	bp->b_edev = ip->i_dev;
4664 	bp->b_dev = cmpdev(ip->i_dev);
4665 	bp->b_blkno = bn;
4666 	bp->b_un.b_addr = (caddr_t)0;
4667 	bp->b_file = ip->i_vnode;
4668 	bp->b_offset = off;
4669 
4670 	if (ufsvfsp->vfs_log) {
4671 		lufs_read_strategy(ufsvfsp->vfs_log, bp);
4672 	} else if (ufsvfsp->vfs_snapshot) {
4673 		fssnap_strategy(&ufsvfsp->vfs_snapshot, bp);
4674 	} else {
4675 		ufsvfsp->vfs_iotstamp = lbolt;
4676 		ub.ub_getras.value.ul++;
4677 		(void) bdev_strategy(bp);
4678 		lwp_stat_update(LWP_STAT_INBLK, 1);
4679 	}
4680 
4681 	return (io_len);
4682 }
4683 
4684 int	ufs_delay = 1;
4685 /*
4686  * Flags are composed of {B_INVAL, B_FREE, B_DONTNEED, B_FORCE, B_ASYNC}
4687  *
4688  * LMXXX - the inode really ought to contain a pointer to one of these
4689  * async args.  Stuff gunk in there and just hand the whole mess off.
4690  * This would replace i_delaylen, i_delayoff.
4691  */
4692 /*ARGSUSED*/
4693 static int
4694 ufs_putpage(struct vnode *vp, offset_t off, size_t len, int flags,
4695 	struct cred *cr)
4696 {
4697 	struct inode *ip = VTOI(vp);
4698 	int err = 0;
4699 
4700 	if (vp->v_count == 0) {
4701 		return (ufs_fault(vp, "ufs_putpage: bad v_count == 0"));
4702 	}
4703 
4704 	TRACE_1(TR_FAC_UFS, TR_UFS_PUTPAGE_START,
4705 		"ufs_putpage_start:vp %p", vp);
4706 
4707 	/*
4708 	 * XXX - Why should this check be made here?
4709 	 */
4710 	if (vp->v_flag & VNOMAP) {
4711 		err = ENOSYS;
4712 		goto errout;
4713 	}
4714 
4715 	if (ip->i_ufsvfs == NULL) {
4716 		err = EIO;
4717 		goto errout;
4718 	}
4719 
4720 	if (flags & B_ASYNC) {
4721 		if (ufs_delay && len &&
4722 		    (flags & ~(B_ASYNC|B_DONTNEED|B_FREE)) == 0) {
4723 			mutex_enter(&ip->i_tlock);
4724 			/*
4725 			 * If nobody stalled, start a new cluster.
4726 			 */
4727 			if (ip->i_delaylen == 0) {
4728 				ip->i_delayoff = off;
4729 				ip->i_delaylen = len;
4730 				mutex_exit(&ip->i_tlock);
4731 				goto errout;
4732 			}
4733 			/*
4734 			 * If we have a full cluster or they are not contig,
4735 			 * then push last cluster and start over.
4736 			 */
4737 			if (ip->i_delaylen >= CLUSTSZ(ip) ||
4738 			    ip->i_delayoff + ip->i_delaylen != off) {
4739 				u_offset_t doff;
4740 				size_t dlen;
4741 
4742 				doff = ip->i_delayoff;
4743 				dlen = ip->i_delaylen;
4744 				ip->i_delayoff = off;
4745 				ip->i_delaylen = len;
4746 				mutex_exit(&ip->i_tlock);
4747 				err = ufs_putpages(vp, doff, dlen,
4748 				    flags, cr);
4749 				/* LMXXX - flags are new val, not old */
4750 				goto errout;
4751 			}
4752 			/*
4753 			 * There is something there, it's not full, and
4754 			 * it is contig.
4755 			 */
4756 			ip->i_delaylen += len;
4757 			mutex_exit(&ip->i_tlock);
4758 			goto errout;
4759 		}
4760 		/*
4761 		 * Must have weird flags or we are not clustering.
4762 		 */
4763 	}
4764 
4765 	err = ufs_putpages(vp, off, len, flags, cr);
4766 
4767 errout:
4768 	TRACE_2(TR_FAC_UFS, TR_UFS_PUTPAGE_END,
4769 		"ufs_putpage_end:vp %p error %d", vp, err);
4770 	return (err);
4771 }
4772 
4773 /*
4774  * If len == 0, do from off to EOF.
4775  *
4776  * The normal cases should be len == 0 & off == 0 (entire vp list),
4777  * len == MAXBSIZE (from segmap_release actions), and len == PAGESIZE
4778  * (from pageout).
4779  */
4780 /*ARGSUSED*/
4781 static int
4782 ufs_putpages(
4783 	struct vnode *vp,
4784 	offset_t off,
4785 	size_t len,
4786 	int flags,
4787 	struct cred *cr)
4788 {
4789 	u_offset_t io_off;
4790 	u_offset_t eoff;
4791 	struct inode *ip = VTOI(vp);
4792 	page_t *pp;
4793 	size_t io_len;
4794 	int err = 0;
4795 	int dolock;
4796 
4797 	if (vp->v_count == 0)
4798 		return (ufs_fault(vp, "ufs_putpages: v_count == 0"));
4799 	/*
4800 	 * Acquire the readers/write inode lock before locking
4801 	 * any pages in this inode.
4802 	 * The inode lock is held during i/o.
4803 	 */
4804 	if (len == 0) {
4805 		mutex_enter(&ip->i_tlock);
4806 		ip->i_delayoff = ip->i_delaylen = 0;
4807 		mutex_exit(&ip->i_tlock);
4808 	}
4809 	dolock = (rw_owner(&ip->i_contents) != curthread);
4810 	if (dolock) {
4811 		/*
4812 		 * Must synchronize this thread and any possible thread
4813 		 * operating in the window of vulnerability in wrip().
4814 		 * It is dangerous to allow both a thread doing a putpage
4815 		 * and a thread writing, so serialize them.  The exception
4816 		 * is when the thread in wrip() does something which causes
4817 		 * a putpage operation.  Then, the thread must be allowed
4818 		 * to continue.  It may encounter a bmap_read problem in
4819 		 * ufs_putapage, but that is handled in ufs_putapage.
4820 		 * Allow async writers to proceed, we don't want to block
4821 		 * the pageout daemon.
4822 		 */
4823 		if (ip->i_writer == curthread)
4824 			rw_enter(&ip->i_contents, RW_READER);
4825 		else {
4826 			for (;;) {
4827 				rw_enter(&ip->i_contents, RW_READER);
4828 				mutex_enter(&ip->i_tlock);
4829 				/*
4830 				 * If there is no thread in the critical
4831 				 * section of wrip(), then proceed.
4832 				 * Otherwise, wait until there isn't one.
4833 				 */
4834 				if (ip->i_writer == NULL) {
4835 					mutex_exit(&ip->i_tlock);
4836 					break;
4837 				}
4838 				rw_exit(&ip->i_contents);
4839 				/*
4840 				 * Bounce async writers when we have a writer
4841 				 * working on this file so we don't deadlock
4842 				 * the pageout daemon.
4843 				 */
4844 				if (flags & B_ASYNC) {
4845 					mutex_exit(&ip->i_tlock);
4846 					return (0);
4847 				}
4848 				cv_wait(&ip->i_wrcv, &ip->i_tlock);
4849 				mutex_exit(&ip->i_tlock);
4850 			}
4851 		}
4852 	}
4853 
4854 	if (!vn_has_cached_data(vp)) {
4855 		if (dolock)
4856 			rw_exit(&ip->i_contents);
4857 		return (0);
4858 	}
4859 
4860 	if (len == 0) {
4861 		/*
4862 		 * Search the entire vp list for pages >= off.
4863 		 */
4864 		err = pvn_vplist_dirty(vp, (u_offset_t)off, ufs_putapage,
4865 					flags, cr);
4866 	} else {
4867 		/*
4868 		 * Loop over all offsets in the range looking for
4869 		 * pages to deal with.
4870 		 */
4871 		if ((eoff = blkroundup(ip->i_fs, ip->i_size)) != 0)
4872 			eoff = MIN(off + len, eoff);
4873 		else
4874 			eoff = off + len;
4875 
4876 		for (io_off = off; io_off < eoff; io_off += io_len) {
4877 			/*
4878 			 * If we are not invalidating, synchronously
4879 			 * freeing or writing pages, use the routine
4880 			 * page_lookup_nowait() to prevent reclaiming
4881 			 * them from the free list.
4882 			 */
4883 			if ((flags & B_INVAL) || ((flags & B_ASYNC) == 0)) {
4884 				pp = page_lookup(vp, io_off,
4885 					(flags & (B_INVAL | B_FREE)) ?
4886 					    SE_EXCL : SE_SHARED);
4887 			} else {
4888 				pp = page_lookup_nowait(vp, io_off,
4889 					(flags & B_FREE) ? SE_EXCL : SE_SHARED);
4890 			}
4891 
4892 			if (pp == NULL || pvn_getdirty(pp, flags) == 0)
4893 				io_len = PAGESIZE;
4894 			else {
4895 				u_offset_t *io_offp = &io_off;
4896 
4897 				err = ufs_putapage(vp, pp, io_offp, &io_len,
4898 				    flags, cr);
4899 				if (err != 0)
4900 					break;
4901 				/*
4902 				 * "io_off" and "io_len" are returned as
4903 				 * the range of pages we actually wrote.
4904 				 * This allows us to skip ahead more quickly
4905 				 * since several pages may've been dealt
4906 				 * with by this iteration of the loop.
4907 				 */
4908 			}
4909 		}
4910 	}
4911 	if (err == 0 && off == 0 && (len == 0 || len >= ip->i_size)) {
4912 		/*
4913 		 * We have just sync'ed back all the pages on
4914 		 * the inode, turn off the IMODTIME flag.
4915 		 */
4916 		mutex_enter(&ip->i_tlock);
4917 		ip->i_flag &= ~IMODTIME;
4918 		mutex_exit(&ip->i_tlock);
4919 	}
4920 	if (dolock)
4921 		rw_exit(&ip->i_contents);
4922 	return (err);
4923 }
4924 
4925 static void
4926 ufs_iodone(buf_t *bp)
4927 {
4928 	struct inode *ip;
4929 
4930 	ASSERT((bp->b_pages->p_vnode != NULL) && !(bp->b_flags & B_READ));
4931 
4932 	bp->b_iodone = NULL;
4933 
4934 	ip = VTOI(bp->b_pages->p_vnode);
4935 
4936 	mutex_enter(&ip->i_tlock);
4937 	if (ip->i_writes >= ufs_LW) {
4938 		if ((ip->i_writes -= bp->b_bcount) <= ufs_LW)
4939 			if (ufs_WRITES)
4940 				cv_broadcast(&ip->i_wrcv); /* wake all up */
4941 	} else {
4942 		ip->i_writes -= bp->b_bcount;
4943 	}
4944 
4945 	mutex_exit(&ip->i_tlock);
4946 	iodone(bp);
4947 }
4948 
4949 /*
4950  * Write out a single page, possibly klustering adjacent
4951  * dirty pages.  The inode lock must be held.
4952  *
4953  * LMXXX - bsize < pagesize not done.
4954  */
4955 /*ARGSUSED*/
4956 int
4957 ufs_putapage(
4958 	struct vnode *vp,
4959 	page_t *pp,
4960 	u_offset_t *offp,
4961 	size_t *lenp,		/* return values */
4962 	int flags,
4963 	struct cred *cr)
4964 {
4965 	u_offset_t io_off;
4966 	u_offset_t off;
4967 	struct inode *ip = VTOI(vp);
4968 	struct ufsvfs *ufsvfsp = ip->i_ufsvfs;
4969 	struct fs *fs;
4970 	struct buf *bp;
4971 	size_t io_len;
4972 	daddr_t bn;
4973 	int err;
4974 	int contig;
4975 
4976 	ASSERT(RW_LOCK_HELD(&ip->i_contents));
4977 
4978 	TRACE_1(TR_FAC_UFS, TR_UFS_PUTAPAGE_START,
4979 		"ufs_putapage_start:vp %p", vp);
4980 
4981 	if (ufsvfsp == NULL) {
4982 		err = EIO;
4983 		goto out_trace;
4984 	}
4985 
4986 	fs = ip->i_fs;
4987 	ASSERT(fs->fs_ronly == 0);
4988 
4989 	/*
4990 	 * If the modified time on the inode has not already been
4991 	 * set elsewhere (e.g. for write/setattr) we set the time now.
4992 	 * This gives us approximate modified times for mmap'ed files
4993 	 * which are modified via stores in the user address space.
4994 	 */
4995 	if ((ip->i_flag & IMODTIME) == 0) {
4996 		mutex_enter(&ip->i_tlock);
4997 		ip->i_flag |= IUPD;
4998 		ip->i_seq++;
4999 		ITIMES_NOLOCK(ip);
5000 		mutex_exit(&ip->i_tlock);
5001 	}
5002 
5003 	/*
5004 	 * Align the request to a block boundry (for old file systems),
5005 	 * and go ask bmap() how contiguous things are for this file.
5006 	 */
5007 	off = pp->p_offset & (offset_t)fs->fs_bmask;	/* block align it */
5008 	contig = 0;
5009 	err = bmap_read(ip, off, &bn, &contig);
5010 	if (err)
5011 		goto out;
5012 	if (bn == UFS_HOLE) {			/* putpage never allocates */
5013 		/*
5014 		 * logging device is in error mode; simply return EIO
5015 		 */
5016 		if (TRANS_ISERROR(ufsvfsp)) {
5017 			err = EIO;
5018 			goto out;
5019 		}
5020 		/*
5021 		 * Oops, the thread in the window in wrip() did some
5022 		 * sort of operation which caused a putpage in the bad
5023 		 * range.  In this case, just return an error which will
5024 		 * cause the software modified bit on the page to set
5025 		 * and the page will get written out again later.
5026 		 */
5027 		if (ip->i_writer == curthread) {
5028 			err = EIO;
5029 			goto out;
5030 		}
5031 		/*
5032 		 * If the pager is trying to push a page in the bad range
5033 		 * just tell him to try again later when things are better.
5034 		 */
5035 		if (flags & B_ASYNC) {
5036 			err = EAGAIN;
5037 			goto out;
5038 		}
5039 		err = ufs_fault(ITOV(ip), "ufs_putapage: bn == UFS_HOLE");
5040 		goto out;
5041 	}
5042 
5043 	/*
5044 	 * Take the length (of contiguous bytes) passed back from bmap()
5045 	 * and _try_ and get a set of pages covering that extent.
5046 	 */
5047 	pp = pvn_write_kluster(vp, pp, &io_off, &io_len, off, contig, flags);
5048 
5049 	/*
5050 	 * May have run out of memory and not clustered backwards.
5051 	 * off		p_offset
5052 	 * [  pp - 1  ][   pp   ]
5053 	 * [	block		]
5054 	 * We told bmap off, so we have to adjust the bn accordingly.
5055 	 */
5056 	if (io_off > off) {
5057 		bn += btod(io_off - off);
5058 		contig -= (io_off - off);
5059 	}
5060 
5061 	/*
5062 	 * bmap was carefull to tell us the right size so use that.
5063 	 * There might be unallocated frags at the end.
5064 	 * LMXXX - bzero the end of the page?  We must be writing after EOF.
5065 	 */
5066 	if (io_len > contig) {
5067 		ASSERT(io_len - contig < fs->fs_bsize);
5068 		io_len -= (io_len - contig);
5069 	}
5070 
5071 	/*
5072 	 * Handle the case where we are writing the last page after EOF.
5073 	 *
5074 	 * XXX - just a patch for i-mt3.
5075 	 */
5076 	if (io_len == 0) {
5077 		ASSERT(pp->p_offset >= (u_offset_t)(roundup(ip->i_size,
5078 							    PAGESIZE)));
5079 		io_len = PAGESIZE;
5080 	}
5081 
5082 	bp = pageio_setup(pp, io_len, ip->i_devvp, B_WRITE | flags);
5083 
5084 	ULOCKFS_SET_MOD(ITOUL(ip));
5085 
5086 	bp->b_edev = ip->i_dev;
5087 	bp->b_dev = cmpdev(ip->i_dev);
5088 	bp->b_blkno = bn;
5089 	bp->b_un.b_addr = (caddr_t)0;
5090 	bp->b_file = ip->i_vnode;
5091 
5092 	if (TRANS_ISTRANS(ufsvfsp)) {
5093 		if ((ip->i_mode & IFMT) == IFSHAD) {
5094 			TRANS_BUF(ufsvfsp, 0, io_len, bp, DT_SHAD);
5095 		} else if (ufsvfsp->vfs_qinod == ip) {
5096 			TRANS_DELTA(ufsvfsp, ldbtob(bn), bp->b_bcount, DT_QR,
5097 			    0, 0);
5098 		}
5099 	}
5100 
5101 	/* write throttle */
5102 
5103 	ASSERT(bp->b_iodone == NULL);
5104 	bp->b_iodone = (int (*)())ufs_iodone;
5105 	mutex_enter(&ip->i_tlock);
5106 	ip->i_writes += bp->b_bcount;
5107 	mutex_exit(&ip->i_tlock);
5108 
5109 	if (bp->b_flags & B_ASYNC) {
5110 		if (ufsvfsp->vfs_log) {
5111 			lufs_write_strategy(ufsvfsp->vfs_log, bp);
5112 		} else if (ufsvfsp->vfs_snapshot) {
5113 			fssnap_strategy(&ufsvfsp->vfs_snapshot, bp);
5114 		} else {
5115 			ufsvfsp->vfs_iotstamp = lbolt;
5116 			ub.ub_putasyncs.value.ul++;
5117 			(void) bdev_strategy(bp);
5118 			lwp_stat_update(LWP_STAT_OUBLK, 1);
5119 		}
5120 	} else {
5121 		if (ufsvfsp->vfs_log) {
5122 			lufs_write_strategy(ufsvfsp->vfs_log, bp);
5123 		} else if (ufsvfsp->vfs_snapshot) {
5124 			fssnap_strategy(&ufsvfsp->vfs_snapshot, bp);
5125 		} else {
5126 			ufsvfsp->vfs_iotstamp = lbolt;
5127 			ub.ub_putsyncs.value.ul++;
5128 			(void) bdev_strategy(bp);
5129 			lwp_stat_update(LWP_STAT_OUBLK, 1);
5130 		}
5131 		err = biowait(bp);
5132 		pageio_done(bp);
5133 		pvn_write_done(pp, ((err) ? B_ERROR : 0) | B_WRITE | flags);
5134 	}
5135 
5136 	pp = NULL;
5137 
5138 out:
5139 	if (err != 0 && pp != NULL)
5140 		pvn_write_done(pp, B_ERROR | B_WRITE | flags);
5141 
5142 	if (offp)
5143 		*offp = io_off;
5144 	if (lenp)
5145 		*lenp = io_len;
5146 out_trace:
5147 	TRACE_2(TR_FAC_UFS, TR_UFS_PUTAPAGE_END,
5148 		"ufs_putapage_end:vp %p error %d", vp, err);
5149 	return (err);
5150 }
5151 
5152 /* ARGSUSED */
5153 static int
5154 ufs_map(struct vnode *vp,
5155 	offset_t off,
5156 	struct as *as,
5157 	caddr_t *addrp,
5158 	size_t len,
5159 	uchar_t prot,
5160 	uchar_t maxprot,
5161 	uint_t flags,
5162 	struct cred *cr)
5163 {
5164 	struct segvn_crargs vn_a;
5165 	struct ufsvfs *ufsvfsp = VTOI(vp)->i_ufsvfs;
5166 	struct ulockfs *ulp;
5167 	int error;
5168 
5169 	TRACE_1(TR_FAC_UFS, TR_UFS_MAP_START,
5170 		"ufs_map_start:vp %p", vp);
5171 
5172 	error = ufs_lockfs_begin(ufsvfsp, &ulp, ULOCKFS_MAP_MASK);
5173 	if (error)
5174 		goto out;
5175 
5176 	if (vp->v_flag & VNOMAP) {
5177 		error = ENOSYS;
5178 		goto unlock;
5179 	}
5180 
5181 	if (off < (offset_t)0 || (offset_t)(off + len) < (offset_t)0) {
5182 		error = ENXIO;
5183 		goto unlock;
5184 	}
5185 
5186 	if (vp->v_type != VREG) {
5187 		error = ENODEV;
5188 		goto unlock;
5189 	}
5190 
5191 	/*
5192 	 * If file is being locked, disallow mapping.
5193 	 */
5194 	if (vn_has_mandatory_locks(vp, VTOI(vp)->i_mode)) {
5195 		error = EAGAIN;
5196 		goto unlock;
5197 	}
5198 
5199 	as_rangelock(as);
5200 	if ((flags & MAP_FIXED) == 0) {
5201 		map_addr(addrp, len, off, 1, flags);
5202 		if (*addrp == NULL) {
5203 			as_rangeunlock(as);
5204 			error = ENOMEM;
5205 			goto unlock;
5206 		}
5207 	} else {
5208 		/*
5209 		 * User specified address - blow away any previous mappings
5210 		 */
5211 		(void) as_unmap(as, *addrp, len);
5212 	}
5213 
5214 	vn_a.vp = vp;
5215 	vn_a.offset = (u_offset_t)off;
5216 	vn_a.type = flags & MAP_TYPE;
5217 	vn_a.prot = prot;
5218 	vn_a.maxprot = maxprot;
5219 	vn_a.cred = cr;
5220 	vn_a.amp = NULL;
5221 	vn_a.flags = flags & ~MAP_TYPE;
5222 	vn_a.szc = 0;
5223 	vn_a.lgrp_mem_policy_flags = 0;
5224 
5225 	error = as_map(as, *addrp, len, segvn_create, &vn_a);
5226 	as_rangeunlock(as);
5227 
5228 unlock:
5229 	if (ulp) {
5230 		ufs_lockfs_end(ulp);
5231 	}
5232 out:
5233 	TRACE_2(TR_FAC_UFS, TR_UFS_MAP_END,
5234 		"ufs_map_end:vp %p error %d", vp, error);
5235 	return (error);
5236 }
5237 
5238 /* ARGSUSED */
5239 static int
5240 ufs_addmap(struct vnode *vp,
5241 	offset_t off,
5242 	struct as *as,
5243 	caddr_t addr,
5244 	size_t	len,
5245 	uchar_t  prot,
5246 	uchar_t  maxprot,
5247 	uint_t    flags,
5248 	struct cred *cr)
5249 {
5250 	struct inode *ip = VTOI(vp);
5251 
5252 	if (vp->v_flag & VNOMAP) {
5253 		return (ENOSYS);
5254 	}
5255 
5256 	mutex_enter(&ip->i_tlock);
5257 	ip->i_mapcnt += btopr(len);
5258 	mutex_exit(&ip->i_tlock);
5259 	return (0);
5260 }
5261 
5262 /*ARGSUSED*/
5263 static int
5264 ufs_delmap(struct vnode *vp, offset_t off, struct as *as, caddr_t addr,
5265 	size_t len, uint_t prot,  uint_t maxprot,  uint_t flags,
5266 	struct cred *cr)
5267 {
5268 	struct inode *ip = VTOI(vp);
5269 
5270 	if (vp->v_flag & VNOMAP) {
5271 		return (ENOSYS);
5272 	}
5273 
5274 	mutex_enter(&ip->i_tlock);
5275 	ip->i_mapcnt -= btopr(len); 	/* Count released mappings */
5276 	ASSERT(ip->i_mapcnt >= 0);
5277 	mutex_exit(&ip->i_tlock);
5278 	return (0);
5279 }
5280 /*
5281  * Return the answer requested to poll() for non-device files
5282  */
5283 struct pollhead ufs_pollhd;
5284 
5285 /* ARGSUSED */
5286 int
5287 ufs_poll(vnode_t *vp, short ev, int any, short *revp, struct pollhead **phpp)
5288 {
5289 	struct ufsvfs	*ufsvfsp;
5290 
5291 	*revp = 0;
5292 	ufsvfsp = VTOI(vp)->i_ufsvfs;
5293 
5294 	if (!ufsvfsp) {
5295 		*revp = POLLHUP;
5296 		goto out;
5297 	}
5298 
5299 	if (ULOCKFS_IS_HLOCK(&ufsvfsp->vfs_ulockfs) ||
5300 	    ULOCKFS_IS_ELOCK(&ufsvfsp->vfs_ulockfs)) {
5301 		*revp |= POLLERR;
5302 
5303 	} else {
5304 		if ((ev & POLLOUT) && !ufsvfsp->vfs_fs->fs_ronly &&
5305 		    !ULOCKFS_IS_WLOCK(&ufsvfsp->vfs_ulockfs))
5306 			*revp |= POLLOUT;
5307 
5308 		if ((ev & POLLWRBAND) && !ufsvfsp->vfs_fs->fs_ronly &&
5309 		    !ULOCKFS_IS_WLOCK(&ufsvfsp->vfs_ulockfs))
5310 			*revp |= POLLWRBAND;
5311 
5312 		if (ev & POLLIN)
5313 			*revp |= POLLIN;
5314 
5315 		if (ev & POLLRDNORM)
5316 			*revp |= POLLRDNORM;
5317 
5318 		if (ev & POLLRDBAND)
5319 			*revp |= POLLRDBAND;
5320 	}
5321 
5322 	if ((ev & POLLPRI) && (*revp & (POLLERR|POLLHUP)))
5323 		*revp |= POLLPRI;
5324 out:
5325 	*phpp = !any && !*revp ? &ufs_pollhd : (struct pollhead *)NULL;
5326 
5327 	return (0);
5328 }
5329 
5330 /* ARGSUSED */
5331 static int
5332 ufs_l_pathconf(struct vnode *vp, int cmd, ulong_t *valp, struct cred *cr)
5333 {
5334 	struct ufsvfs	*ufsvfsp = VTOI(vp)->i_ufsvfs;
5335 	struct ulockfs	*ulp = NULL;
5336 	struct inode 	*sip = NULL;
5337 	int		error;
5338 	struct inode 	*ip = VTOI(vp);
5339 	int		issync;
5340 
5341 	error = ufs_lockfs_begin(ufsvfsp, &ulp, ULOCKFS_PATHCONF_MASK);
5342 	if (error)
5343 		return (error);
5344 
5345 	switch (cmd) {
5346 		/*
5347 		 * Have to handle _PC_NAME_MAX here, because the normal way
5348 		 * [fs_pathconf() -> VOP_STATVFS() -> ufs_statvfs()]
5349 		 * results in a lock ordering reversal between
5350 		 * ufs_lockfs_{begin,end}() and
5351 		 * ufs_thread_{suspend,continue}().
5352 		 *
5353 		 * Keep in sync with ufs_statvfs().
5354 		 */
5355 	case _PC_NAME_MAX:
5356 		*valp = MAXNAMLEN;
5357 		break;
5358 
5359 	case _PC_FILESIZEBITS:
5360 		if (ufsvfsp->vfs_lfflags & UFS_LARGEFILES)
5361 			*valp = UFS_FILESIZE_BITS;
5362 		else
5363 			*valp = 32;
5364 		break;
5365 
5366 	case _PC_XATTR_EXISTS:
5367 		if (vp->v_vfsp->vfs_flag & VFS_XATTR) {
5368 
5369 			error = ufs_xattr_getattrdir(vp, &sip, LOOKUP_XATTR,
5370 							cr);
5371 			if (error ==  0 && sip != NULL) {
5372 				/* Start transaction */
5373 				if (ulp) {
5374 					TRANS_BEGIN_CSYNC(ufsvfsp, issync,
5375 					    TOP_RMDIR, TOP_RMDIR_SIZE);
5376 				}
5377 				/*
5378 				 * Is directory empty
5379 				 */
5380 				rw_enter(&sip->i_rwlock, RW_WRITER);
5381 				rw_enter(&sip->i_contents, RW_WRITER);
5382 				if (ufs_xattrdirempty(sip,
5383 						sip->i_number, CRED())) {
5384 					rw_enter(&ip->i_contents, RW_WRITER);
5385 					ufs_unhook_shadow(ip, sip);
5386 					rw_exit(&ip->i_contents);
5387 
5388 					*valp = 0;
5389 
5390 				} else
5391 					*valp = 1;
5392 				rw_exit(&sip->i_contents);
5393 				rw_exit(&sip->i_rwlock);
5394 				if (ulp) {
5395 					TRANS_END_CSYNC(ufsvfsp, error, issync,
5396 					    TOP_RMDIR, TOP_RMDIR_SIZE);
5397 				}
5398 				VN_RELE(ITOV(sip));
5399 			} else if (error == ENOENT) {
5400 				*valp = 0;
5401 				error = 0;
5402 			}
5403 		} else {
5404 			error = fs_pathconf(vp, cmd, valp, cr);
5405 		}
5406 		break;
5407 
5408 	case _PC_ACL_ENABLED:
5409 		*valp = _ACL_ACLENT_ENABLED;
5410 		break;
5411 
5412 	case _PC_MIN_HOLE_SIZE:
5413 		*valp = (ulong_t)ip->i_fs->fs_bsize;
5414 		break;
5415 
5416 	default:
5417 		error = fs_pathconf(vp, cmd, valp, cr);
5418 	}
5419 
5420 	if (ulp != NULL) {
5421 		ufs_lockfs_end(ulp);
5422 	}
5423 	return (error);
5424 }
5425 
5426 int ufs_pageio_writes, ufs_pageio_reads;
5427 
5428 /*ARGSUSED*/
5429 static int
5430 ufs_pageio(struct vnode *vp, page_t *pp, u_offset_t io_off, size_t io_len,
5431 	int flags, struct cred *cr)
5432 {
5433 	struct inode *ip = VTOI(vp);
5434 	struct ufsvfs *ufsvfsp;
5435 	page_t *npp = NULL, *opp = NULL, *cpp = pp;
5436 	struct buf *bp;
5437 	daddr_t bn;
5438 	size_t done_len = 0, cur_len = 0;
5439 	int err = 0;
5440 	int contig = 0;
5441 	int dolock;
5442 	int vmpss = 0;
5443 	struct ulockfs *ulp;
5444 
5445 	if ((flags & B_READ) && pp != NULL && pp->p_vnode == vp &&
5446 	    vp->v_mpssdata != NULL) {
5447 		vmpss = 1;
5448 	}
5449 
5450 	dolock = (rw_owner(&ip->i_contents) != curthread);
5451 	/*
5452 	 * We need a better check.  Ideally, we would use another
5453 	 * vnodeops so that hlocked and forcibly unmounted file
5454 	 * systems would return EIO where appropriate and w/o the
5455 	 * need for these checks.
5456 	 */
5457 	if ((ufsvfsp = ip->i_ufsvfs) == NULL)
5458 		return (EIO);
5459 
5460 	/*
5461 	 * For vmpss (pp can be NULL) case respect the quiesce protocol.
5462 	 * ul_lock must be taken before locking pages so we can't use it here
5463 	 * if pp is non NULL because segvn already locked pages
5464 	 * SE_EXCL. Instead we rely on the fact that a forced umount or
5465 	 * applying a filesystem lock via ufs_fiolfs() will block in the
5466 	 * implicit call to ufs_flush() until we unlock the pages after the
5467 	 * return to segvn. Other ufs_quiesce() callers keep ufs_quiesce_pend
5468 	 * above 0 until they are done. We have to be careful not to increment
5469 	 * ul_vnops_cnt here after forceful unmount hlocks the file system.
5470 	 *
5471 	 * If pp is NULL use ul_lock to make sure we don't increment
5472 	 * ul_vnops_cnt after forceful unmount hlocks the file system.
5473 	 */
5474 	if (vmpss || pp == NULL) {
5475 		ulp = &ufsvfsp->vfs_ulockfs;
5476 		if (pp == NULL)
5477 			mutex_enter(&ulp->ul_lock);
5478 		if (ulp->ul_fs_lock & ULOCKFS_GETREAD_MASK) {
5479 			if (pp == NULL) {
5480 				mutex_exit(&ulp->ul_lock);
5481 			}
5482 			return (vmpss ? EIO : EINVAL);
5483 		}
5484 		atomic_add_long(&ulp->ul_vnops_cnt, 1);
5485 		if (pp == NULL)
5486 			mutex_exit(&ulp->ul_lock);
5487 		if (ufs_quiesce_pend) {
5488 			if (!atomic_add_long_nv(&ulp->ul_vnops_cnt, -1))
5489 				cv_broadcast(&ulp->ul_cv);
5490 			return (vmpss ? EIO : EINVAL);
5491 		}
5492 	}
5493 
5494 	if (dolock) {
5495 		/*
5496 		 * segvn may call VOP_PAGEIO() instead of VOP_GETPAGE() to
5497 		 * handle a fault against a segment that maps vnode pages with
5498 		 * large mappings.  Segvn creates pages and holds them locked
5499 		 * SE_EXCL during VOP_PAGEIO() call. In this case we have to
5500 		 * use rw_tryenter() to avoid a potential deadlock since in
5501 		 * lock order i_contents needs to be taken first.
5502 		 * Segvn will retry via VOP_GETPAGE() if VOP_PAGEIO() fails.
5503 		 */
5504 		if (!vmpss) {
5505 			rw_enter(&ip->i_contents, RW_READER);
5506 		} else if (!rw_tryenter(&ip->i_contents, RW_READER)) {
5507 			if (!atomic_add_long_nv(&ulp->ul_vnops_cnt, -1))
5508 				cv_broadcast(&ulp->ul_cv);
5509 			return (EDEADLK);
5510 		}
5511 	}
5512 
5513 	/*
5514 	 * Return an error to segvn because the pagefault request is beyond
5515 	 * PAGESIZE rounded EOF.
5516 	 */
5517 	if (vmpss && btopr(io_off + io_len) > btopr(ip->i_size)) {
5518 		if (dolock)
5519 			rw_exit(&ip->i_contents);
5520 		if (!atomic_add_long_nv(&ulp->ul_vnops_cnt, -1))
5521 			cv_broadcast(&ulp->ul_cv);
5522 		return (EFAULT);
5523 	}
5524 
5525 	if (pp == NULL) {
5526 		if (bmap_has_holes(ip)) {
5527 			err = ENOSYS;
5528 		} else {
5529 			err = EINVAL;
5530 		}
5531 		if (dolock)
5532 			rw_exit(&ip->i_contents);
5533 		if (!atomic_add_long_nv(&ulp->ul_vnops_cnt, -1))
5534 			cv_broadcast(&ulp->ul_cv);
5535 		return (err);
5536 	}
5537 
5538 	/*
5539 	 * Break the io request into chunks, one for each contiguous
5540 	 * stretch of disk blocks in the target file.
5541 	 */
5542 	while (done_len < io_len) {
5543 		ASSERT(cpp);
5544 		contig = 0;
5545 		if (err = bmap_read(ip, (u_offset_t)(io_off + done_len),
5546 				    &bn, &contig))
5547 			break;
5548 
5549 		if (bn == UFS_HOLE) {	/* No holey swapfiles */
5550 			if (vmpss) {
5551 				err = EFAULT;
5552 				break;
5553 			}
5554 			err = ufs_fault(ITOV(ip), "ufs_pageio: bn == UFS_HOLE");
5555 			break;
5556 		}
5557 
5558 		cur_len = MIN(io_len - done_len, contig);
5559 		/*
5560 		 * Zero out a page beyond EOF, when the last block of
5561 		 * a file is a UFS fragment so that ufs_pageio() can be used
5562 		 * instead of ufs_getpage() to handle faults against
5563 		 * segvn segments that use large pages.
5564 		 */
5565 		page_list_break(&cpp, &npp, btopr(cur_len));
5566 		if ((flags & B_READ) && (cur_len & PAGEOFFSET)) {
5567 			size_t xlen = cur_len & PAGEOFFSET;
5568 			pagezero(cpp->p_prev, xlen, PAGESIZE - xlen);
5569 		}
5570 
5571 		bp = pageio_setup(cpp, cur_len, ip->i_devvp, flags);
5572 		ASSERT(bp != NULL);
5573 
5574 		bp->b_edev = ip->i_dev;
5575 		bp->b_dev = cmpdev(ip->i_dev);
5576 		bp->b_blkno = bn;
5577 		bp->b_un.b_addr = (caddr_t)0;
5578 		bp->b_file = ip->i_vnode;
5579 
5580 		ufsvfsp->vfs_iotstamp = lbolt;
5581 		ub.ub_pageios.value.ul++;
5582 		if (ufsvfsp->vfs_snapshot)
5583 			fssnap_strategy(&(ufsvfsp->vfs_snapshot), bp);
5584 		else
5585 			(void) bdev_strategy(bp);
5586 
5587 		if (flags & B_READ)
5588 			ufs_pageio_reads++;
5589 		else
5590 			ufs_pageio_writes++;
5591 		if (flags & B_READ)
5592 			lwp_stat_update(LWP_STAT_INBLK, 1);
5593 		else
5594 			lwp_stat_update(LWP_STAT_OUBLK, 1);
5595 		/*
5596 		 * If the request is not B_ASYNC, wait for i/o to complete
5597 		 * and re-assemble the page list to return to the caller.
5598 		 * If it is B_ASYNC we leave the page list in pieces and
5599 		 * cleanup() will dispose of them.
5600 		 */
5601 		if ((flags & B_ASYNC) == 0) {
5602 			err = biowait(bp);
5603 			pageio_done(bp);
5604 			if (err)
5605 				break;
5606 			page_list_concat(&opp, &cpp);
5607 		}
5608 		cpp = npp;
5609 		npp = NULL;
5610 		if (flags & B_READ)
5611 			cur_len = P2ROUNDUP_TYPED(cur_len, PAGESIZE, size_t);
5612 		done_len += cur_len;
5613 	}
5614 	ASSERT(err || (cpp == NULL && npp == NULL && done_len == io_len));
5615 	if (err) {
5616 		if (flags & B_ASYNC) {
5617 			/* Cleanup unprocessed parts of list */
5618 			page_list_concat(&cpp, &npp);
5619 			if (flags & B_READ)
5620 				pvn_read_done(cpp, B_ERROR);
5621 			else
5622 				pvn_write_done(cpp, B_ERROR);
5623 		} else {
5624 			/* Re-assemble list and let caller clean up */
5625 			page_list_concat(&opp, &cpp);
5626 			page_list_concat(&opp, &npp);
5627 		}
5628 	}
5629 
5630 	if (vmpss && !(ip->i_flag & IACC) && !ULOCKFS_IS_NOIACC(ulp) &&
5631 	    ufsvfsp->vfs_fs->fs_ronly == 0 && !ufsvfsp->vfs_noatime) {
5632 		mutex_enter(&ip->i_tlock);
5633 		ip->i_flag |= IACC;
5634 		ITIMES_NOLOCK(ip);
5635 		mutex_exit(&ip->i_tlock);
5636 	}
5637 
5638 	if (dolock)
5639 		rw_exit(&ip->i_contents);
5640 	if (vmpss && !atomic_add_long_nv(&ulp->ul_vnops_cnt, -1))
5641 		cv_broadcast(&ulp->ul_cv);
5642 	return (err);
5643 }
5644 
5645 /*
5646  * Called when the kernel is in a frozen state to dump data
5647  * directly to the device. It uses a private dump data structure,
5648  * set up by dump_ctl, to locate the correct disk block to which to dump.
5649  */
5650 static int
5651 ufs_dump(vnode_t *vp, caddr_t addr, int ldbn, int dblks)
5652 {
5653 	u_offset_t	file_size;
5654 	struct inode    *ip = VTOI(vp);
5655 	struct fs	*fs = ip->i_fs;
5656 	daddr_t		dbn, lfsbn;
5657 	int		disk_blks = fs->fs_bsize >> DEV_BSHIFT;
5658 	int		error = 0;
5659 	int		ndbs, nfsbs;
5660 
5661 	/*
5662 	 * forced unmount case
5663 	 */
5664 	if (ip->i_ufsvfs == NULL)
5665 		return (EIO);
5666 	/*
5667 	 * Validate the inode that it has not been modified since
5668 	 * the dump structure is allocated.
5669 	 */
5670 	mutex_enter(&ip->i_tlock);
5671 	if ((dump_info == NULL) ||
5672 	    (dump_info->ip != ip) ||
5673 	    (dump_info->time.tv_sec != ip->i_mtime.tv_sec) ||
5674 	    (dump_info->time.tv_usec != ip->i_mtime.tv_usec)) {
5675 		mutex_exit(&ip->i_tlock);
5676 		return (-1);
5677 	}
5678 	mutex_exit(&ip->i_tlock);
5679 
5680 	/*
5681 	 * See that the file has room for this write
5682 	 */
5683 	UFS_GET_ISIZE(&file_size, ip);
5684 
5685 	if (ldbtob((offset_t)(ldbn + dblks)) > file_size)
5686 		return (ENOSPC);
5687 
5688 	/*
5689 	 * Find the physical disk block numbers from the dump
5690 	 * private data structure directly and write out the data
5691 	 * in contiguous block lumps
5692 	 */
5693 	while (dblks > 0 && !error) {
5694 		lfsbn = (daddr_t)lblkno(fs, ldbtob((offset_t)ldbn));
5695 		dbn = fsbtodb(fs, dump_info->dblk[lfsbn]) + ldbn % disk_blks;
5696 		nfsbs = 1;
5697 		ndbs = disk_blks - ldbn % disk_blks;
5698 		while (ndbs < dblks && fsbtodb(fs, dump_info->dblk[lfsbn +
5699 		    nfsbs]) == dbn + ndbs) {
5700 			nfsbs++;
5701 			ndbs += disk_blks;
5702 		}
5703 		if (ndbs > dblks)
5704 			ndbs = dblks;
5705 		error = bdev_dump(ip->i_dev, addr, dbn, ndbs);
5706 		addr += ldbtob((offset_t)ndbs);
5707 		dblks -= ndbs;
5708 		ldbn += ndbs;
5709 	}
5710 	return (error);
5711 
5712 }
5713 
5714 /*
5715  * Prepare the file system before and after the dump operation.
5716  *
5717  * action = DUMP_ALLOC:
5718  * Preparation before dump, allocate dump private data structure
5719  * to hold all the direct and indirect block info for dump.
5720  *
5721  * action = DUMP_FREE:
5722  * Clean up after dump, deallocate the dump private data structure.
5723  *
5724  * action = DUMP_SCAN:
5725  * Scan dump_info for *blkp DEV_BSIZE blocks of contig fs space;
5726  * if found, the starting file-relative DEV_BSIZE lbn is written
5727  * to *bklp; that lbn is intended for use with VOP_DUMP()
5728  */
5729 static int
5730 ufs_dumpctl(vnode_t *vp, int action, int *blkp)
5731 {
5732 	struct inode	*ip = VTOI(vp);
5733 	ufsvfs_t	*ufsvfsp = ip->i_ufsvfs;
5734 	struct fs	*fs;
5735 	daddr32_t	*dblk, *storeblk;
5736 	daddr32_t	*nextblk, *endblk;
5737 	struct buf	*bp;
5738 	int		i, entry, entries;
5739 	int		n, ncontig;
5740 
5741 	/*
5742 	 * check for forced unmount
5743 	 */
5744 	if (ufsvfsp == NULL)
5745 		return (EIO);
5746 
5747 	if (action == DUMP_ALLOC) {
5748 		/*
5749 		 * alloc and record dump_info
5750 		 */
5751 		if (dump_info != NULL)
5752 			return (EINVAL);
5753 
5754 		ASSERT(vp->v_type == VREG);
5755 		fs = ufsvfsp->vfs_fs;
5756 
5757 		rw_enter(&ip->i_contents, RW_READER);
5758 
5759 		if (bmap_has_holes(ip)) {
5760 			rw_exit(&ip->i_contents);
5761 			return (EFAULT);
5762 		}
5763 
5764 		/*
5765 		 * calculate and allocate space needed according to i_size
5766 		 */
5767 		entries = (int)lblkno(fs, blkroundup(fs, ip->i_size));
5768 		if ((dump_info = (struct dump *)
5769 		    kmem_alloc(sizeof (struct dump) +
5770 		    (entries - 1) * sizeof (daddr32_t), KM_NOSLEEP)) == NULL) {
5771 			    rw_exit(&ip->i_contents);
5772 			    return (ENOMEM);
5773 		}
5774 
5775 		/* Start saving the info */
5776 		dump_info->fsbs = entries;
5777 		dump_info->ip = ip;
5778 		storeblk = &dump_info->dblk[0];
5779 
5780 		/* Direct Blocks */
5781 		for (entry = 0; entry < NDADDR && entry < entries; entry++)
5782 			*storeblk++ = ip->i_db[entry];
5783 
5784 		/* Indirect Blocks */
5785 		for (i = 0; i < NIADDR; i++) {
5786 			int error = 0;
5787 
5788 			bp = UFS_BREAD(ufsvfsp,
5789 				ip->i_dev, fsbtodb(fs, ip->i_ib[i]),
5790 				fs->fs_bsize);
5791 			if (bp->b_flags & B_ERROR)
5792 				error = EIO;
5793 			else {
5794 				dblk = bp->b_un.b_daddr;
5795 				if ((storeblk = save_dblks(ip, ufsvfsp,
5796 				    storeblk, dblk, i, entries)) == NULL)
5797 					error = EIO;
5798 			}
5799 
5800 			brelse(bp);
5801 
5802 			if (error != 0) {
5803 				kmem_free(dump_info, sizeof (struct dump) +
5804 				    (entries - 1) * sizeof (daddr32_t));
5805 				rw_exit(&ip->i_contents);
5806 				dump_info = NULL;
5807 				return (error);
5808 			}
5809 		}
5810 		/* and time stamp the information */
5811 		mutex_enter(&ip->i_tlock);
5812 		dump_info->time = ip->i_mtime;
5813 		mutex_exit(&ip->i_tlock);
5814 
5815 		rw_exit(&ip->i_contents);
5816 	} else if (action == DUMP_FREE) {
5817 		/*
5818 		 * free dump_info
5819 		 */
5820 		if (dump_info == NULL)
5821 			return (EINVAL);
5822 		entries = dump_info->fsbs - 1;
5823 		kmem_free(dump_info, sizeof (struct dump) +
5824 		    entries * sizeof (daddr32_t));
5825 		dump_info = NULL;
5826 	} else if (action == DUMP_SCAN) {
5827 		/*
5828 		 * scan dump_info
5829 		 */
5830 		if (dump_info == NULL)
5831 			return (EINVAL);
5832 
5833 		dblk = dump_info->dblk;
5834 		nextblk = dblk + 1;
5835 		endblk = dblk + dump_info->fsbs - 1;
5836 		fs = ufsvfsp->vfs_fs;
5837 		ncontig = *blkp >> (fs->fs_bshift - DEV_BSHIFT);
5838 
5839 		/*
5840 		 * scan dblk[] entries; contig fs space is found when:
5841 		 * ((current blkno + frags per block) == next blkno)
5842 		 */
5843 		n = 0;
5844 		while (n < ncontig && dblk < endblk) {
5845 			if ((*dblk + fs->fs_frag) == *nextblk)
5846 				n++;
5847 			else
5848 				n = 0;
5849 			dblk++;
5850 			nextblk++;
5851 		}
5852 
5853 		/*
5854 		 * index is where size bytes of contig space begins;
5855 		 * conversion from index to the file's DEV_BSIZE lbn
5856 		 * is equivalent to:  (index * fs_bsize) / DEV_BSIZE
5857 		 */
5858 		if (n == ncontig) {
5859 			i = (dblk - dump_info->dblk) - ncontig;
5860 			*blkp = i << (fs->fs_bshift - DEV_BSHIFT);
5861 		} else
5862 			return (EFAULT);
5863 	}
5864 	return (0);
5865 }
5866 
5867 /*
5868  * Recursive helper function for ufs_dumpctl().  It follows the indirect file
5869  * system  blocks until it reaches the the disk block addresses, which are
5870  * then stored into the given buffer, storeblk.
5871  */
5872 static daddr32_t *
5873 save_dblks(struct inode *ip, struct ufsvfs *ufsvfsp,  daddr32_t *storeblk,
5874     daddr32_t *dblk, int level, int entries)
5875 {
5876 	struct fs	*fs = ufsvfsp->vfs_fs;
5877 	struct buf	*bp;
5878 	int		i;
5879 
5880 	if (level == 0) {
5881 		for (i = 0; i < NINDIR(fs); i++) {
5882 			if (storeblk - dump_info->dblk >= entries)
5883 				break;
5884 			*storeblk++ = dblk[i];
5885 		}
5886 		return (storeblk);
5887 	}
5888 	for (i = 0; i < NINDIR(fs); i++) {
5889 		if (storeblk - dump_info->dblk >= entries)
5890 			break;
5891 		bp = UFS_BREAD(ufsvfsp,
5892 				ip->i_dev, fsbtodb(fs, dblk[i]), fs->fs_bsize);
5893 		if (bp->b_flags & B_ERROR) {
5894 			brelse(bp);
5895 			return (NULL);
5896 		}
5897 		storeblk = save_dblks(ip, ufsvfsp, storeblk, bp->b_un.b_daddr,
5898 		    level - 1, entries);
5899 		brelse(bp);
5900 
5901 		if (storeblk == NULL)
5902 			return (NULL);
5903 	}
5904 	return (storeblk);
5905 }
5906 
5907 /* ARGSUSED */
5908 static int
5909 ufs_getsecattr(struct vnode *vp, vsecattr_t *vsap, int flag,
5910 	struct cred *cr)
5911 {
5912 	struct inode	*ip = VTOI(vp);
5913 	struct ulockfs	*ulp;
5914 	struct ufsvfs	*ufsvfsp = ip->i_ufsvfs;
5915 	ulong_t		vsa_mask = vsap->vsa_mask;
5916 	int		err = EINVAL;
5917 
5918 	TRACE_3(TR_FAC_UFS, TR_UFS_GETSECATTR_START,
5919 	    "ufs_getsecattr_start:vp %p, vsap %p, flags %x", vp, vsap, flag);
5920 
5921 	vsa_mask &= (VSA_ACL | VSA_ACLCNT | VSA_DFACL | VSA_DFACLCNT);
5922 
5923 	/*
5924 	 * Only grab locks if needed - they're not needed to check vsa_mask
5925 	 * or if the mask contains no acl flags.
5926 	 */
5927 	if (vsa_mask != 0) {
5928 		if (err = ufs_lockfs_begin(ufsvfsp, &ulp,
5929 		    ULOCKFS_GETATTR_MASK))
5930 			return (err);
5931 
5932 		rw_enter(&ip->i_contents, RW_READER);
5933 		err = ufs_acl_get(ip, vsap, flag, cr);
5934 		rw_exit(&ip->i_contents);
5935 
5936 		if (ulp)
5937 			ufs_lockfs_end(ulp);
5938 	}
5939 	TRACE_1(TR_FAC_UFS, TR_UFS_GETSECATTR_END,
5940 	    "ufs_getsecattr_end:vp %p", vp);
5941 	return (err);
5942 }
5943 
5944 /* ARGSUSED */
5945 static int
5946 ufs_setsecattr(struct vnode *vp, vsecattr_t *vsap, int flag, struct cred *cr)
5947 {
5948 	struct inode	*ip = VTOI(vp);
5949 	struct ulockfs	*ulp = NULL;
5950 	struct ufsvfs	*ufsvfsp = VTOI(vp)->i_ufsvfs;
5951 	ulong_t		vsa_mask = vsap->vsa_mask;
5952 	int		err;
5953 	int		haverwlock = 1;
5954 	int		trans_size;
5955 	int		donetrans = 0;
5956 	int		retry = 1;
5957 
5958 
5959 	TRACE_3(TR_FAC_UFS, TR_UFS_SETSECATTR_START,
5960 	    "ufs_setsecattr_start:vp %p, vsap %p, flags %x", vp, vsap, flag);
5961 
5962 	ASSERT(RW_LOCK_HELD(&ip->i_rwlock));
5963 
5964 	/* Abort now if the request is either empty or invalid. */
5965 	vsa_mask &= (VSA_ACL | VSA_ACLCNT | VSA_DFACL | VSA_DFACLCNT);
5966 	if ((vsa_mask == 0) ||
5967 	    ((vsap->vsa_aclentp == NULL) &&
5968 	    (vsap->vsa_dfaclentp == NULL))) {
5969 		err = EINVAL;
5970 		goto out;
5971 	}
5972 
5973 	/*
5974 	 * Following convention, if this is a directory then we acquire the
5975 	 * inode's i_rwlock after starting a UFS logging transaction;
5976 	 * otherwise, we acquire it beforehand. Since we were called (and
5977 	 * must therefore return) with the lock held, we will have to drop it,
5978 	 * and later reacquire it, if operating on a directory.
5979 	 */
5980 	if (vp->v_type == VDIR) {
5981 		rw_exit(&ip->i_rwlock);
5982 		haverwlock = 0;
5983 	} else {
5984 		/* Upgrade the lock if required. */
5985 		if (!rw_write_held(&ip->i_rwlock)) {
5986 			rw_exit(&ip->i_rwlock);
5987 			rw_enter(&ip->i_rwlock, RW_WRITER);
5988 		}
5989 	}
5990 
5991 again:
5992 	ASSERT(!(vp->v_type == VDIR && haverwlock));
5993 	if (err = ufs_lockfs_begin(ufsvfsp, &ulp, ULOCKFS_SETATTR_MASK)) {
5994 		ulp = NULL;
5995 		retry = 0;
5996 		goto out;
5997 	}
5998 
5999 	/*
6000 	 * Check that the file system supports this operation. Note that
6001 	 * ufs_lockfs_begin() will have checked that the file system had
6002 	 * not been forcibly unmounted.
6003 	 */
6004 	if (ufsvfsp->vfs_fs->fs_ronly) {
6005 		err = EROFS;
6006 		goto out;
6007 	}
6008 	if (ufsvfsp->vfs_nosetsec) {
6009 		err = ENOSYS;
6010 		goto out;
6011 	}
6012 
6013 	if (ulp) {
6014 		TRANS_BEGIN_ASYNC(ufsvfsp, TOP_SETSECATTR,
6015 			trans_size = TOP_SETSECATTR_SIZE(VTOI(vp)));
6016 		donetrans = 1;
6017 	}
6018 
6019 	if (vp->v_type == VDIR) {
6020 		rw_enter(&ip->i_rwlock, RW_WRITER);
6021 		haverwlock = 1;
6022 	}
6023 
6024 	ASSERT(haverwlock);
6025 
6026 	/* Do the actual work. */
6027 	rw_enter(&ip->i_contents, RW_WRITER);
6028 	/*
6029 	 * Suppress out of inodes messages if we will retry.
6030 	 */
6031 	if (retry)
6032 		ip->i_flag |= IQUIET;
6033 	err = ufs_acl_set(ip, vsap, flag, cr);
6034 	ip->i_flag &= ~IQUIET;
6035 	rw_exit(&ip->i_contents);
6036 
6037 out:
6038 	if (ulp) {
6039 		if (donetrans) {
6040 			/*
6041 			 * top_end_async() can eventually call
6042 			 * top_end_sync(), which can block. We must
6043 			 * therefore observe the lock-ordering protocol
6044 			 * here as well.
6045 			 */
6046 			if (vp->v_type == VDIR) {
6047 				rw_exit(&ip->i_rwlock);
6048 				haverwlock = 0;
6049 			}
6050 			TRANS_END_ASYNC(ufsvfsp, TOP_SETSECATTR, trans_size);
6051 		}
6052 		ufs_lockfs_end(ulp);
6053 	}
6054 	/*
6055 	 * If no inodes available, try scaring a logically-
6056 	 * free one out of the delete queue to someplace
6057 	 * that we can find it.
6058 	 */
6059 	if ((err == ENOSPC) && retry && TRANS_ISTRANS(ufsvfsp)) {
6060 		ufs_delete_drain_wait(ufsvfsp, 1);
6061 		retry = 0;
6062 		if (vp->v_type == VDIR && haverwlock) {
6063 			rw_exit(&ip->i_rwlock);
6064 			haverwlock = 0;
6065 		}
6066 		goto again;
6067 	}
6068 	/*
6069 	 * If we need to reacquire the lock then it is safe to do so
6070 	 * as a reader. This is because ufs_rwunlock(), which will be
6071 	 * called by our caller after we return, does not differentiate
6072 	 * between shared and exclusive locks.
6073 	 */
6074 	if (!haverwlock) {
6075 		ASSERT(vp->v_type == VDIR);
6076 		rw_enter(&ip->i_rwlock, RW_READER);
6077 	}
6078 
6079 	TRACE_1(TR_FAC_UFS, TR_UFS_SETSECATTR_END,
6080 	    "ufs_setsecattr_end:vp %p", vp);
6081 	return (err);
6082 }
6083