xref: /titanic_44/usr/src/uts/common/fs/ufs/ufs_vnops.c (revision 0398691684c2596072212e4ca9d7033ad7ccfa54)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 /*
22  * Copyright 2007 Sun Microsystems, Inc.  All rights reserved.
23  * Use is subject to license terms.
24  */
25 
26 /*	Copyright (c) 1983, 1984, 1985, 1986, 1987, 1988, 1989 AT&T	*/
27 /*	  All Rights Reserved  	*/
28 
29 /*
30  * Portions of this source code were derived from Berkeley 4.3 BSD
31  * under license from the Regents of the University of California.
32  */
33 
34 #pragma ident	"%Z%%M%	%I%	%E% SMI"
35 
36 #include <sys/types.h>
37 #include <sys/t_lock.h>
38 #include <sys/ksynch.h>
39 #include <sys/param.h>
40 #include <sys/time.h>
41 #include <sys/systm.h>
42 #include <sys/sysmacros.h>
43 #include <sys/resource.h>
44 #include <sys/signal.h>
45 #include <sys/cred.h>
46 #include <sys/user.h>
47 #include <sys/buf.h>
48 #include <sys/vfs.h>
49 #include <sys/vfs_opreg.h>
50 #include <sys/vnode.h>
51 #include <sys/proc.h>
52 #include <sys/disp.h>
53 #include <sys/file.h>
54 #include <sys/fcntl.h>
55 #include <sys/flock.h>
56 #include <sys/atomic.h>
57 #include <sys/kmem.h>
58 #include <sys/uio.h>
59 #include <sys/dnlc.h>
60 #include <sys/conf.h>
61 #include <sys/mman.h>
62 #include <sys/pathname.h>
63 #include <sys/debug.h>
64 #include <sys/vmsystm.h>
65 #include <sys/cmn_err.h>
66 #include <sys/filio.h>
67 #include <sys/policy.h>
68 
69 #include <sys/fs/ufs_fs.h>
70 #include <sys/fs/ufs_lockfs.h>
71 #include <sys/fs/ufs_filio.h>
72 #include <sys/fs/ufs_inode.h>
73 #include <sys/fs/ufs_fsdir.h>
74 #include <sys/fs/ufs_quota.h>
75 #include <sys/fs/ufs_log.h>
76 #include <sys/fs/ufs_snap.h>
77 #include <sys/fs/ufs_trans.h>
78 #include <sys/fs/ufs_panic.h>
79 #include <sys/fs/ufs_bio.h>
80 #include <sys/dirent.h>		/* must be AFTER <sys/fs/fsdir.h>! */
81 #include <sys/errno.h>
82 #include <sys/fssnap_if.h>
83 #include <sys/unistd.h>
84 #include <sys/sunddi.h>
85 
86 #include <sys/filio.h>		/* _FIOIO */
87 
88 #include <vm/hat.h>
89 #include <vm/page.h>
90 #include <vm/pvn.h>
91 #include <vm/as.h>
92 #include <vm/seg.h>
93 #include <vm/seg_map.h>
94 #include <vm/seg_vn.h>
95 #include <vm/seg_kmem.h>
96 #include <vm/rm.h>
97 #include <sys/swap.h>
98 
99 #include <fs/fs_subr.h>
100 
101 static struct instats ins;
102 
103 static 	int ufs_getpage_ra(struct vnode *, u_offset_t, struct seg *, caddr_t);
104 static	int ufs_getpage_miss(struct vnode *, u_offset_t, size_t, struct seg *,
105 		caddr_t, struct page **, size_t, enum seg_rw, int);
106 static	int ufs_open(struct vnode **, int, struct cred *);
107 static	int ufs_close(struct vnode *, int, int, offset_t, struct cred *);
108 static	int ufs_read(struct vnode *, struct uio *, int, struct cred *,
109 			struct caller_context *);
110 static	int ufs_write(struct vnode *, struct uio *, int, struct cred *,
111 			struct caller_context *);
112 static	int ufs_ioctl(struct vnode *, int, intptr_t, int, struct cred *, int *);
113 static	int ufs_getattr(struct vnode *, struct vattr *, int, struct cred *);
114 static	int ufs_setattr(struct vnode *, struct vattr *, int, struct cred *,
115 			caller_context_t *);
116 static	int ufs_access(struct vnode *, int, int, struct cred *);
117 static	int ufs_lookup(struct vnode *, char *, struct vnode **,
118 		struct pathname *, int, struct vnode *, struct cred *);
119 static	int ufs_create(struct vnode *, char *, struct vattr *, enum vcexcl,
120 			int, struct vnode **, struct cred *, int);
121 static	int ufs_remove(struct vnode *, char *, struct cred *);
122 static	int ufs_link(struct vnode *, struct vnode *, char *, struct cred *);
123 static	int ufs_rename(struct vnode *, char *, struct vnode *, char *,
124 			struct cred *);
125 static	int ufs_mkdir(struct vnode *, char *, struct vattr *, struct vnode **,
126 			struct cred *);
127 static	int ufs_rmdir(struct vnode *, char *, struct vnode *, struct cred *);
128 static	int ufs_readdir(struct vnode *, struct uio *, struct cred *, int *);
129 static	int ufs_symlink(struct vnode *, char *, struct vattr *, char *,
130 			struct cred *);
131 static	int ufs_readlink(struct vnode *, struct uio *, struct cred *);
132 static	int ufs_fsync(struct vnode *, int, struct cred *);
133 static	void ufs_inactive(struct vnode *, struct cred *);
134 static	int ufs_fid(struct vnode *, struct fid *);
135 static	int ufs_rwlock(struct vnode *, int, caller_context_t *);
136 static	void ufs_rwunlock(struct vnode *, int, caller_context_t *);
137 static	int ufs_seek(struct vnode *, offset_t, offset_t *);
138 static	int ufs_frlock(struct vnode *, int, struct flock64 *, int, offset_t,
139 			struct flk_callback *, struct cred *);
140 static  int ufs_space(struct vnode *, int, struct flock64 *, int, offset_t,
141 		cred_t *, caller_context_t *);
142 static	int ufs_getpage(struct vnode *, offset_t, size_t, uint_t *,
143 		struct page **, size_t, struct seg *, caddr_t,
144 		enum seg_rw, struct cred *);
145 static	int ufs_putpage(struct vnode *, offset_t, size_t, int, struct cred *);
146 static	int ufs_putpages(struct vnode *, offset_t, size_t, int, struct cred *);
147 static	int ufs_map(struct vnode *, offset_t, struct as *, caddr_t *, size_t,
148 			uchar_t, uchar_t, uint_t, struct cred *);
149 static	int ufs_addmap(struct vnode *, offset_t, struct as *, caddr_t,  size_t,
150 			uchar_t, uchar_t, uint_t, struct cred *);
151 static	int ufs_delmap(struct vnode *, offset_t, struct as *, caddr_t,  size_t,
152 			uint_t, uint_t, uint_t, struct cred *);
153 static	int ufs_poll(vnode_t *, short, int, short *, struct pollhead **);
154 static	int ufs_dump(vnode_t *, caddr_t, int, int);
155 static	int ufs_l_pathconf(struct vnode *, int, ulong_t *, struct cred *);
156 static	int ufs_pageio(struct vnode *, struct page *, u_offset_t, size_t, int,
157 			struct cred *);
158 static	int ufs_dump(vnode_t *, caddr_t, int, int);
159 static	int ufs_dumpctl(vnode_t *, int, int *);
160 static	daddr32_t *save_dblks(struct inode *, struct ufsvfs *, daddr32_t *,
161 			daddr32_t *, int, int);
162 static	int ufs_getsecattr(struct vnode *, vsecattr_t *, int, struct cred *);
163 static	int ufs_setsecattr(struct vnode *, vsecattr_t *, int, struct cred *);
164 
165 extern int as_map_locked(struct as *, caddr_t, size_t, int ((*)()), void *);
166 
167 /*
168  * For lockfs: ulockfs begin/end is now inlined in the ufs_xxx functions.
169  *
170  * XXX - ULOCKFS in fs_pathconf and ufs_ioctl is not inlined yet.
171  */
172 struct vnodeops *ufs_vnodeops;
173 
174 /* NOTE: "not blkd" below  means that the operation isn't blocked by lockfs */
175 const fs_operation_def_t ufs_vnodeops_template[] = {
176 	VOPNAME_OPEN,		{ .vop_open = ufs_open },	/* not blkd */
177 	VOPNAME_CLOSE,		{ .vop_close = ufs_close },	/* not blkd */
178 	VOPNAME_READ,		{ .vop_read = ufs_read },
179 	VOPNAME_WRITE,		{ .vop_write = ufs_write },
180 	VOPNAME_IOCTL,		{ .vop_ioctl = ufs_ioctl },
181 	VOPNAME_GETATTR,	{ .vop_getattr = ufs_getattr },
182 	VOPNAME_SETATTR,	{ .vop_setattr = ufs_setattr },
183 	VOPNAME_ACCESS,		{ .vop_access = ufs_access },
184 	VOPNAME_LOOKUP,		{ .vop_lookup = ufs_lookup },
185 	VOPNAME_CREATE,		{ .vop_create = ufs_create },
186 	VOPNAME_REMOVE,		{ .vop_remove = ufs_remove },
187 	VOPNAME_LINK,		{ .vop_link = ufs_link },
188 	VOPNAME_RENAME,		{ .vop_rename = ufs_rename },
189 	VOPNAME_MKDIR,		{ .vop_mkdir = ufs_mkdir },
190 	VOPNAME_RMDIR,		{ .vop_rmdir = ufs_rmdir },
191 	VOPNAME_READDIR,	{ .vop_readdir = ufs_readdir },
192 	VOPNAME_SYMLINK,	{ .vop_symlink = ufs_symlink },
193 	VOPNAME_READLINK,	{ .vop_readlink = ufs_readlink },
194 	VOPNAME_FSYNC,		{ .vop_fsync = ufs_fsync },
195 	VOPNAME_INACTIVE,	{ .vop_inactive = ufs_inactive }, /* not blkd */
196 	VOPNAME_FID,		{ .vop_fid = ufs_fid },
197 	VOPNAME_RWLOCK,		{ .vop_rwlock = ufs_rwlock },	/* not blkd */
198 	VOPNAME_RWUNLOCK,	{ .vop_rwunlock = ufs_rwunlock }, /* not blkd */
199 	VOPNAME_SEEK,		{ .vop_seek = ufs_seek },
200 	VOPNAME_FRLOCK,		{ .vop_frlock = ufs_frlock },
201 	VOPNAME_SPACE,		{ .vop_space = ufs_space },
202 	VOPNAME_GETPAGE,	{ .vop_getpage = ufs_getpage },
203 	VOPNAME_PUTPAGE,	{ .vop_putpage = ufs_putpage },
204 	VOPNAME_MAP,		{ .vop_map = ufs_map },
205 	VOPNAME_ADDMAP,		{ .vop_addmap = ufs_addmap },	/* not blkd */
206 	VOPNAME_DELMAP,		{ .vop_delmap = ufs_delmap },	/* not blkd */
207 	VOPNAME_POLL,		{ .vop_poll = ufs_poll },	/* not blkd */
208 	VOPNAME_DUMP,		{ .vop_dump = ufs_dump },
209 	VOPNAME_PATHCONF,	{ .vop_pathconf = ufs_l_pathconf },
210 	VOPNAME_PAGEIO,		{ .vop_pageio = ufs_pageio },
211 	VOPNAME_DUMPCTL,	{ .vop_dumpctl = ufs_dumpctl },
212 	VOPNAME_GETSECATTR,	{ .vop_getsecattr = ufs_getsecattr },
213 	VOPNAME_SETSECATTR,	{ .vop_setsecattr = ufs_setsecattr },
214 	VOPNAME_VNEVENT,	{ .vop_vnevent = fs_vnevent_support },
215 	NULL,			NULL
216 };
217 
218 #define	MAX_BACKFILE_COUNT	9999
219 
220 /*
221  * Created by ufs_dumpctl() to store a file's disk block info into memory.
222  * Used by ufs_dump() to dump data to disk directly.
223  */
224 struct dump {
225 	struct inode	*ip;		/* the file we contain */
226 	daddr_t		fsbs;		/* number of blocks stored */
227 	struct timeval32 time;		/* time stamp for the struct */
228 	daddr32_t 	dblk[1];	/* place holder for block info */
229 };
230 
231 static struct dump *dump_info = NULL;
232 
233 /*
234  * Previously there was no special action required for ordinary files.
235  * (Devices are handled through the device file system.)
236  * Now we support Large Files and Large File API requires open to
237  * fail if file is large.
238  * We could take care to prevent data corruption
239  * by doing an atomic check of size and truncate if file is opened with
240  * FTRUNC flag set but traditionally this is being done by the vfs/vnode
241  * layers. So taking care of truncation here is a change in the existing
242  * semantics of VOP_OPEN and therefore we chose not to implement any thing
243  * here. The check for the size of the file > 2GB is being done at the
244  * vfs layer in routine vn_open().
245  */
246 
247 /* ARGSUSED */
248 static int
249 ufs_open(struct vnode **vpp, int flag, struct cred *cr)
250 {
251 	return (0);
252 }
253 
254 /*ARGSUSED*/
255 static int
256 ufs_close(struct vnode *vp, int flag, int count, offset_t offset,
257 	struct cred *cr)
258 {
259 	cleanlocks(vp, ttoproc(curthread)->p_pid, 0);
260 	cleanshares(vp, ttoproc(curthread)->p_pid);
261 
262 	/*
263 	 * Push partially filled cluster at last close.
264 	 * ``last close'' is approximated because the dnlc
265 	 * may have a hold on the vnode.
266 	 * Checking for VBAD here will also act as a forced umount check.
267 	 */
268 	if (vp->v_count <= 2 && vp->v_type != VBAD) {
269 		struct inode *ip = VTOI(vp);
270 		if (ip->i_delaylen) {
271 			ins.in_poc.value.ul++;
272 			(void) ufs_putpages(vp, ip->i_delayoff, ip->i_delaylen,
273 			    B_ASYNC | B_FREE, cr);
274 			ip->i_delaylen = 0;
275 		}
276 	}
277 
278 	return (0);
279 }
280 
281 /*ARGSUSED*/
282 static int
283 ufs_read(struct vnode *vp, struct uio *uiop, int ioflag, struct cred *cr,
284 	struct caller_context *ct)
285 {
286 	struct inode *ip = VTOI(vp);
287 	struct ufsvfs *ufsvfsp;
288 	struct ulockfs *ulp = NULL;
289 	int error = 0;
290 	int intrans = 0;
291 
292 	ASSERT(RW_READ_HELD(&ip->i_rwlock));
293 
294 	/*
295 	 * Mandatory locking needs to be done before ufs_lockfs_begin()
296 	 * and TRANS_BEGIN_SYNC() calls since mandatory locks can sleep.
297 	 */
298 	if (MANDLOCK(vp, ip->i_mode)) {
299 		/*
300 		 * ufs_getattr ends up being called by chklock
301 		 */
302 		error = chklock(vp, FREAD, uiop->uio_loffset,
303 		    uiop->uio_resid, uiop->uio_fmode, ct);
304 		if (error)
305 			goto out;
306 	}
307 
308 	ufsvfsp = ip->i_ufsvfs;
309 	error = ufs_lockfs_begin(ufsvfsp, &ulp, ULOCKFS_READ_MASK);
310 	if (error)
311 		goto out;
312 
313 	/*
314 	 * In the case that a directory is opened for reading as a file
315 	 * (eg "cat .") with the  O_RSYNC, O_SYNC and O_DSYNC flags set.
316 	 * The locking order had to be changed to avoid a deadlock with
317 	 * an update taking place on that directory at the same time.
318 	 */
319 	if ((ip->i_mode & IFMT) == IFDIR) {
320 
321 		rw_enter(&ip->i_contents, RW_READER);
322 		error = rdip(ip, uiop, ioflag, cr);
323 		rw_exit(&ip->i_contents);
324 
325 		if (error) {
326 			if (ulp)
327 				ufs_lockfs_end(ulp);
328 			goto out;
329 		}
330 
331 		if (ulp && (ioflag & FRSYNC) && (ioflag & (FSYNC | FDSYNC)) &&
332 		    TRANS_ISTRANS(ufsvfsp)) {
333 			rw_exit(&ip->i_rwlock);
334 			TRANS_BEGIN_SYNC(ufsvfsp, TOP_READ_SYNC, TOP_READ_SIZE,
335 			    error);
336 			ASSERT(!error);
337 			TRANS_END_SYNC(ufsvfsp, error, TOP_READ_SYNC,
338 			    TOP_READ_SIZE);
339 			rw_enter(&ip->i_rwlock, RW_READER);
340 		}
341 	} else {
342 		/*
343 		 * Only transact reads to files opened for sync-read and
344 		 * sync-write on a file system that is not write locked.
345 		 *
346 		 * The ``not write locked'' check prevents problems with
347 		 * enabling/disabling logging on a busy file system.  E.g.,
348 		 * logging exists at the beginning of the read but does not
349 		 * at the end.
350 		 *
351 		 */
352 		if (ulp && (ioflag & FRSYNC) && (ioflag & (FSYNC | FDSYNC)) &&
353 		    TRANS_ISTRANS(ufsvfsp)) {
354 			TRANS_BEGIN_SYNC(ufsvfsp, TOP_READ_SYNC, TOP_READ_SIZE,
355 			    error);
356 			ASSERT(!error);
357 			intrans = 1;
358 		}
359 
360 		rw_enter(&ip->i_contents, RW_READER);
361 		error = rdip(ip, uiop, ioflag, cr);
362 		rw_exit(&ip->i_contents);
363 
364 		if (intrans) {
365 			TRANS_END_SYNC(ufsvfsp, error, TOP_READ_SYNC,
366 			    TOP_READ_SIZE);
367 		}
368 	}
369 
370 	if (ulp) {
371 		ufs_lockfs_end(ulp);
372 	}
373 out:
374 
375 	return (error);
376 }
377 
378 extern	int	ufs_HW;		/* high water mark */
379 extern	int	ufs_LW;		/* low water mark */
380 int	ufs_WRITES = 1;		/* XXX - enable/disable */
381 int	ufs_throttles = 0;	/* throttling count */
382 int	ufs_allow_shared_writes = 1;	/* directio shared writes */
383 
384 static int
385 ufs_check_rewrite(struct inode *ip, struct uio *uiop, int ioflag)
386 {
387 	int	shared_write;
388 
389 	/*
390 	 * If the FDSYNC flag is set then ignore the global
391 	 * ufs_allow_shared_writes in this case.
392 	 */
393 	shared_write = (ioflag & FDSYNC) | ufs_allow_shared_writes;
394 
395 	/*
396 	 * Filter to determine if this request is suitable as a
397 	 * concurrent rewrite. This write must not allocate blocks
398 	 * by extending the file or filling in holes. No use trying
399 	 * through FSYNC descriptors as the inode will be synchronously
400 	 * updated after the write. The uio structure has not yet been
401 	 * checked for sanity, so assume nothing.
402 	 */
403 	return (((ip->i_mode & IFMT) == IFREG) && !(ioflag & FAPPEND) &&
404 	    (uiop->uio_loffset >= (offset_t)0) &&
405 	    (uiop->uio_loffset < ip->i_size) && (uiop->uio_resid > 0) &&
406 	    ((ip->i_size - uiop->uio_loffset) >= uiop->uio_resid) &&
407 	    !(ioflag & FSYNC) && !bmap_has_holes(ip) &&
408 	    shared_write);
409 }
410 
411 /*ARGSUSED*/
412 static int
413 ufs_write(struct vnode *vp, struct uio *uiop, int ioflag, cred_t *cr,
414 	caller_context_t *ct)
415 {
416 	struct inode *ip = VTOI(vp);
417 	struct ufsvfs *ufsvfsp;
418 	struct ulockfs *ulp;
419 	int retry = 1;
420 	int error, resv, resid = 0;
421 	int directio_status;
422 	int exclusive;
423 	int rewriteflg;
424 	long start_resid = uiop->uio_resid;
425 
426 	ASSERT(RW_LOCK_HELD(&ip->i_rwlock));
427 
428 retry_mandlock:
429 	/*
430 	 * Mandatory locking needs to be done before ufs_lockfs_begin()
431 	 * and TRANS_BEGIN_[A]SYNC() calls since mandatory locks can sleep.
432 	 * Check for forced unmounts normally done in ufs_lockfs_begin().
433 	 */
434 	if ((ufsvfsp = ip->i_ufsvfs) == NULL) {
435 		error = EIO;
436 		goto out;
437 	}
438 	if (MANDLOCK(vp, ip->i_mode)) {
439 
440 		ASSERT(RW_WRITE_HELD(&ip->i_rwlock));
441 
442 		/*
443 		 * ufs_getattr ends up being called by chklock
444 		 */
445 		error = chklock(vp, FWRITE, uiop->uio_loffset,
446 		    uiop->uio_resid, uiop->uio_fmode, ct);
447 		if (error)
448 			goto out;
449 	}
450 
451 	/* i_rwlock can change in chklock */
452 	exclusive = rw_write_held(&ip->i_rwlock);
453 	rewriteflg = ufs_check_rewrite(ip, uiop, ioflag);
454 
455 	/*
456 	 * Check for fast-path special case of directio re-writes.
457 	 */
458 	if ((ip->i_flag & IDIRECTIO || ufsvfsp->vfs_forcedirectio) &&
459 	    !exclusive && rewriteflg) {
460 
461 		error = ufs_lockfs_begin(ufsvfsp, &ulp, ULOCKFS_WRITE_MASK);
462 		if (error)
463 			goto out;
464 
465 		rw_enter(&ip->i_contents, RW_READER);
466 		error = ufs_directio_write(ip, uiop, ioflag, 1, cr,
467 		    &directio_status);
468 		if (directio_status == DIRECTIO_SUCCESS) {
469 			uint_t i_flag_save;
470 
471 			if (start_resid != uiop->uio_resid)
472 				error = 0;
473 			/*
474 			 * Special treatment of access times for re-writes.
475 			 * If IMOD is not already set, then convert it
476 			 * to IMODACC for this operation. This defers
477 			 * entering a delta into the log until the inode
478 			 * is flushed. This mimics what is done for read
479 			 * operations and inode access time.
480 			 */
481 			mutex_enter(&ip->i_tlock);
482 			i_flag_save = ip->i_flag;
483 			ip->i_flag |= IUPD | ICHG;
484 			ip->i_seq++;
485 			ITIMES_NOLOCK(ip);
486 			if ((i_flag_save & IMOD) == 0) {
487 				ip->i_flag &= ~IMOD;
488 				ip->i_flag |= IMODACC;
489 			}
490 			mutex_exit(&ip->i_tlock);
491 			rw_exit(&ip->i_contents);
492 			if (ulp)
493 				ufs_lockfs_end(ulp);
494 			goto out;
495 		}
496 		rw_exit(&ip->i_contents);
497 		if (ulp)
498 			ufs_lockfs_end(ulp);
499 	}
500 
501 	if (!exclusive && !rw_tryupgrade(&ip->i_rwlock)) {
502 		rw_exit(&ip->i_rwlock);
503 		rw_enter(&ip->i_rwlock, RW_WRITER);
504 		/*
505 		 * Mandatory locking could have been enabled
506 		 * after dropping the i_rwlock.
507 		 */
508 		if (MANDLOCK(vp, ip->i_mode))
509 			goto retry_mandlock;
510 	}
511 
512 	error = ufs_lockfs_begin(ufsvfsp, &ulp, ULOCKFS_WRITE_MASK);
513 	if (error)
514 		goto out;
515 
516 	/*
517 	 * Amount of log space needed for this write
518 	 */
519 	if (!rewriteflg || !(ioflag & FDSYNC))
520 		TRANS_WRITE_RESV(ip, uiop, ulp, &resv, &resid);
521 
522 	/*
523 	 * Throttle writes.
524 	 */
525 	if (ufs_WRITES && (ip->i_writes > ufs_HW)) {
526 		mutex_enter(&ip->i_tlock);
527 		while (ip->i_writes > ufs_HW) {
528 			ufs_throttles++;
529 			cv_wait(&ip->i_wrcv, &ip->i_tlock);
530 		}
531 		mutex_exit(&ip->i_tlock);
532 	}
533 
534 	/*
535 	 * Enter Transaction
536 	 *
537 	 * If the write is a rewrite there is no need to open a transaction
538 	 * if the FDSYNC flag is set and not the FSYNC.  In this case just
539 	 * set the IMODACC flag to modify do the update at a later time
540 	 * thus avoiding the overhead of the logging transaction that is
541 	 * not required.
542 	 */
543 	if (ioflag & (FSYNC|FDSYNC)) {
544 		if (ulp) {
545 			if (rewriteflg) {
546 				uint_t i_flag_save;
547 
548 				rw_enter(&ip->i_contents, RW_READER);
549 				mutex_enter(&ip->i_tlock);
550 				i_flag_save = ip->i_flag;
551 				ip->i_flag |= IUPD | ICHG;
552 				ip->i_seq++;
553 				ITIMES_NOLOCK(ip);
554 				if ((i_flag_save & IMOD) == 0) {
555 					ip->i_flag &= ~IMOD;
556 					ip->i_flag |= IMODACC;
557 				}
558 				mutex_exit(&ip->i_tlock);
559 				rw_exit(&ip->i_contents);
560 			} else {
561 				int terr = 0;
562 				TRANS_BEGIN_SYNC(ufsvfsp, TOP_WRITE_SYNC, resv,
563 				    terr);
564 				ASSERT(!terr);
565 			}
566 		}
567 	} else {
568 		if (ulp)
569 			TRANS_BEGIN_ASYNC(ufsvfsp, TOP_WRITE, resv);
570 	}
571 
572 	/*
573 	 * Write the file
574 	 */
575 	rw_enter(&ufsvfsp->vfs_dqrwlock, RW_READER);
576 	rw_enter(&ip->i_contents, RW_WRITER);
577 	if ((ioflag & FAPPEND) != 0 && (ip->i_mode & IFMT) == IFREG) {
578 		/*
579 		 * In append mode start at end of file.
580 		 */
581 		uiop->uio_loffset = ip->i_size;
582 	}
583 
584 	/*
585 	 * Mild optimisation, don't call ufs_trans_write() unless we have to
586 	 * Also, suppress file system full messages if we will retry.
587 	 */
588 	if (retry)
589 		ip->i_flag |= IQUIET;
590 	if (resid) {
591 		TRANS_WRITE(ip, uiop, ioflag, error, ulp, cr, resv, resid);
592 	} else {
593 		error = wrip(ip, uiop, ioflag, cr);
594 	}
595 	ip->i_flag &= ~IQUIET;
596 
597 	rw_exit(&ip->i_contents);
598 	rw_exit(&ufsvfsp->vfs_dqrwlock);
599 
600 	/*
601 	 * Leave Transaction
602 	 */
603 	if (ulp) {
604 		if (ioflag & (FSYNC|FDSYNC)) {
605 			if (!rewriteflg) {
606 				int terr = 0;
607 
608 				TRANS_END_SYNC(ufsvfsp, terr, TOP_WRITE_SYNC,
609 				    resv);
610 				if (error == 0)
611 					error = terr;
612 			}
613 		} else {
614 			TRANS_END_ASYNC(ufsvfsp, TOP_WRITE, resv);
615 		}
616 		ufs_lockfs_end(ulp);
617 	}
618 out:
619 	if ((error == ENOSPC) && retry && TRANS_ISTRANS(ufsvfsp)) {
620 		/*
621 		 * Any blocks tied up in pending deletes?
622 		 */
623 		ufs_delete_drain_wait(ufsvfsp, 1);
624 		retry = 0;
625 		goto retry_mandlock;
626 	}
627 
628 	if (error == ENOSPC && (start_resid != uiop->uio_resid))
629 		error = 0;
630 
631 	return (error);
632 }
633 
634 /*
635  * Don't cache write blocks to files with the sticky bit set.
636  * Used to keep swap files from blowing the page cache on a server.
637  */
638 int stickyhack = 1;
639 
640 /*
641  * Free behind hacks.  The pager is busted.
642  * XXX - need to pass the information down to writedone() in a flag like B_SEQ
643  * or B_FREE_IF_TIGHT_ON_MEMORY.
644  */
645 int	freebehind = 1;
646 int	smallfile = 0;
647 u_offset_t smallfile64 = 32 * 1024;
648 
649 /*
650  * While we should, in most cases, cache the pages for write, we
651  * may also want to cache the pages for read as long as they are
652  * frequently re-usable.
653  *
654  * If cache_read_ahead = 1, the pages for read will go to the tail
655  * of the cache list when they are released, otherwise go to the head.
656  */
657 int	cache_read_ahead = 0;
658 
659 /*
660  * Freebehind exists  so that as we read  large files  sequentially we
661  * don't consume most of memory with pages  from a few files. It takes
662  * longer to re-read from disk multiple small files as it does reading
663  * one large one sequentially.  As system  memory grows customers need
664  * to retain bigger chunks   of files in  memory.   The advent of  the
665  * cachelist opens up of the possibility freeing pages  to the head or
666  * tail of the list.
667  *
668  * Not freeing a page is a bet that the page will be read again before
669  * it's segmap slot is needed for something else. If we loose the bet,
670  * it means some  other thread is  burdened with the  page free we did
671  * not do. If we win we save a free and reclaim.
672  *
673  * Freeing it at the tail  vs the head of cachelist  is a bet that the
674  * page will survive until the next  read.  It's also saying that this
675  * page is more likely to  be re-used than a  page freed some time ago
676  * and never reclaimed.
677  *
678  * Freebehind maintains a  range of  file offset [smallfile1; smallfile2]
679  *
680  *            0 < offset < smallfile1 : pages are not freed.
681  *   smallfile1 < offset < smallfile2 : pages freed to tail of cachelist.
682  *   smallfile2 < offset              : pages freed to head of cachelist.
683  *
684  * The range  is  computed  at most  once  per second  and  depends on
685  * freemem  and  ncpus_online.  Both parameters  are   bounded to be
686  * >= smallfile && >= smallfile64.
687  *
688  * smallfile1 = (free memory / ncpu) / 1000
689  * smallfile2 = (free memory / ncpu) / 10
690  *
691  * A few examples values:
692  *
693  *       Free Mem (in Bytes) [smallfile1; smallfile2]  [smallfile1; smallfile2]
694  *                                 ncpus_online = 4          ncpus_online = 64
695  *       ------------------  -----------------------   -----------------------
696  *             1G                   [256K;  25M]               [32K; 1.5M]
697  *            10G                   [2.5M; 250M]              [156K; 15M]
698  *           100G                    [25M; 2.5G]              [1.5M; 150M]
699  *
700  */
701 
702 #define	SMALLFILE1_D 1000
703 #define	SMALLFILE2_D 10
704 static u_offset_t smallfile1 = 32 * 1024;
705 static u_offset_t smallfile2 = 32 * 1024;
706 static clock_t smallfile_update = 0; /* lbolt value of when to recompute */
707 uint_t smallfile1_d = SMALLFILE1_D;
708 uint_t smallfile2_d = SMALLFILE2_D;
709 
710 /*
711  * wrip does the real work of write requests for ufs.
712  */
713 int
714 wrip(struct inode *ip, struct uio *uio, int ioflag, struct cred *cr)
715 {
716 	rlim64_t limit = uio->uio_llimit;
717 	u_offset_t off;
718 	u_offset_t old_i_size;
719 	struct fs *fs;
720 	struct vnode *vp;
721 	struct ufsvfs *ufsvfsp;
722 	caddr_t base;
723 	long start_resid = uio->uio_resid;	/* save starting resid */
724 	long premove_resid;			/* resid before uiomove() */
725 	uint_t flags;
726 	int newpage;
727 	int iupdat_flag, directio_status;
728 	int n, on, mapon;
729 	int error, pagecreate;
730 	int do_dqrwlock;		/* drop/reacquire vfs_dqrwlock */
731 	int32_t	iblocks;
732 	int	new_iblocks;
733 
734 	/*
735 	 * ip->i_size is incremented before the uiomove
736 	 * is done on a write.  If the move fails (bad user
737 	 * address) reset ip->i_size.
738 	 * The better way would be to increment ip->i_size
739 	 * only if the uiomove succeeds.
740 	 */
741 	int i_size_changed = 0;
742 	o_mode_t type;
743 	int i_seq_needed = 0;
744 
745 	vp = ITOV(ip);
746 
747 	/*
748 	 * check for forced unmount - should not happen as
749 	 * the request passed the lockfs checks.
750 	 */
751 	if ((ufsvfsp = ip->i_ufsvfs) == NULL)
752 		return (EIO);
753 
754 	fs = ip->i_fs;
755 
756 	ASSERT(RW_WRITE_HELD(&ip->i_contents));
757 
758 	/* check for valid filetype */
759 	type = ip->i_mode & IFMT;
760 	if ((type != IFREG) && (type != IFDIR) && (type != IFATTRDIR) &&
761 	    (type != IFLNK) && (type != IFSHAD)) {
762 		return (EIO);
763 	}
764 
765 	/*
766 	 * the actual limit of UFS file size
767 	 * is UFS_MAXOFFSET_T
768 	 */
769 	if (limit == RLIM64_INFINITY || limit > MAXOFFSET_T)
770 		limit = MAXOFFSET_T;
771 
772 	if (uio->uio_loffset >= limit) {
773 		proc_t *p = ttoproc(curthread);
774 
775 		mutex_enter(&p->p_lock);
776 		(void) rctl_action(rctlproc_legacy[RLIMIT_FSIZE], p->p_rctls,
777 		    p, RCA_UNSAFE_SIGINFO);
778 		mutex_exit(&p->p_lock);
779 		return (EFBIG);
780 	}
781 
782 	/*
783 	 * if largefiles are disallowed, the limit is
784 	 * the pre-largefiles value of 2GB
785 	 */
786 	if (ufsvfsp->vfs_lfflags & UFS_LARGEFILES)
787 		limit = MIN(UFS_MAXOFFSET_T, limit);
788 	else
789 		limit = MIN(MAXOFF32_T, limit);
790 
791 	if (uio->uio_loffset < (offset_t)0) {
792 		return (EINVAL);
793 	}
794 	if (uio->uio_resid == 0) {
795 		return (0);
796 	}
797 
798 	if (uio->uio_loffset >= limit)
799 		return (EFBIG);
800 
801 	ip->i_flag |= INOACC;	/* don't update ref time in getpage */
802 
803 	if (ioflag & (FSYNC|FDSYNC)) {
804 		ip->i_flag |= ISYNC;
805 		iupdat_flag = 1;
806 	}
807 	/*
808 	 * Try to go direct
809 	 */
810 	if (ip->i_flag & IDIRECTIO || ufsvfsp->vfs_forcedirectio) {
811 		uio->uio_llimit = limit;
812 		error = ufs_directio_write(ip, uio, ioflag, 0, cr,
813 		    &directio_status);
814 		/*
815 		 * If ufs_directio wrote to the file or set the flags,
816 		 * we need to update i_seq, but it may be deferred.
817 		 */
818 		if (start_resid != uio->uio_resid ||
819 		    (ip->i_flag & (ICHG|IUPD))) {
820 			i_seq_needed = 1;
821 			ip->i_flag |= ISEQ;
822 		}
823 		if (directio_status == DIRECTIO_SUCCESS)
824 			goto out;
825 	}
826 
827 	/*
828 	 * Behavior with respect to dropping/reacquiring vfs_dqrwlock:
829 	 *
830 	 * o shadow inodes: vfs_dqrwlock is not held at all
831 	 * o quota updates: vfs_dqrwlock is read or write held
832 	 * o other updates: vfs_dqrwlock is read held
833 	 *
834 	 * The first case is the only one where we do not hold
835 	 * vfs_dqrwlock at all while entering wrip().
836 	 * We must make sure not to downgrade/drop vfs_dqrwlock if we
837 	 * have it as writer, i.e. if we are updating the quota inode.
838 	 * There is no potential deadlock scenario in this case as
839 	 * ufs_getpage() takes care of this and avoids reacquiring
840 	 * vfs_dqrwlock in that case.
841 	 *
842 	 * This check is done here since the above conditions do not change
843 	 * and we possibly loop below, so save a few cycles.
844 	 */
845 	if ((type == IFSHAD) ||
846 	    (rw_owner(&ufsvfsp->vfs_dqrwlock) == curthread)) {
847 			do_dqrwlock = 0;
848 	} else {
849 		do_dqrwlock = 1;
850 	}
851 
852 	/*
853 	 * Large Files: We cast MAXBMASK to offset_t
854 	 * inorder to mask out the higher bits. Since offset_t
855 	 * is a signed value, the high order bit set in MAXBMASK
856 	 * value makes it do the right thing by having all bits 1
857 	 * in the higher word. May be removed for _SOLARIS64_.
858 	 */
859 
860 	fs = ip->i_fs;
861 	do {
862 		u_offset_t uoff = uio->uio_loffset;
863 		off = uoff & (offset_t)MAXBMASK;
864 		mapon = (int)(uoff & (offset_t)MAXBOFFSET);
865 		on = (int)blkoff(fs, uoff);
866 		n = (int)MIN(fs->fs_bsize - on, uio->uio_resid);
867 		new_iblocks = 1;
868 
869 		if (type == IFREG && uoff + n >= limit) {
870 			if (uoff >= limit) {
871 				error = EFBIG;
872 				goto out;
873 			}
874 			/*
875 			 * since uoff + n >= limit,
876 			 * therefore n >= limit - uoff, and n is an int
877 			 * so it is safe to cast it to an int
878 			 */
879 			n = (int)(limit - (rlim64_t)uoff);
880 		}
881 		if (uoff + n > ip->i_size) {
882 			/*
883 			 * We are extending the length of the file.
884 			 * bmap is used so that we are sure that
885 			 * if we need to allocate new blocks, that it
886 			 * is done here before we up the file size.
887 			 */
888 			error = bmap_write(ip, uoff, (int)(on + n),
889 			    mapon == 0, NULL, cr);
890 			/*
891 			 * bmap_write never drops i_contents so if
892 			 * the flags are set it changed the file.
893 			 */
894 			if (ip->i_flag & (ICHG|IUPD)) {
895 				i_seq_needed = 1;
896 				ip->i_flag |= ISEQ;
897 			}
898 			if (error)
899 				break;
900 			/*
901 			 * There is a window of vulnerability here.
902 			 * The sequence of operations: allocate file
903 			 * system blocks, uiomove the data into pages,
904 			 * and then update the size of the file in the
905 			 * inode, must happen atomically.  However, due
906 			 * to current locking constraints, this can not
907 			 * be done.
908 			 */
909 			ASSERT(ip->i_writer == NULL);
910 			ip->i_writer = curthread;
911 			i_size_changed = 1;
912 			/*
913 			 * If we are writing from the beginning of
914 			 * the mapping, we can just create the
915 			 * pages without having to read them.
916 			 */
917 			pagecreate = (mapon == 0);
918 		} else if (n == MAXBSIZE) {
919 			/*
920 			 * Going to do a whole mappings worth,
921 			 * so we can just create the pages w/o
922 			 * having to read them in.  But before
923 			 * we do that, we need to make sure any
924 			 * needed blocks are allocated first.
925 			 */
926 			iblocks = ip->i_blocks;
927 			error = bmap_write(ip, uoff, (int)(on + n),
928 			    BI_ALLOC_ONLY, NULL, cr);
929 			/*
930 			 * bmap_write never drops i_contents so if
931 			 * the flags are set it changed the file.
932 			 */
933 			if (ip->i_flag & (ICHG|IUPD)) {
934 				i_seq_needed = 1;
935 				ip->i_flag |= ISEQ;
936 			}
937 			if (error)
938 				break;
939 			pagecreate = 1;
940 			/*
941 			 * check if the new created page needed the
942 			 * allocation of new disk blocks.
943 			 */
944 			if (iblocks == ip->i_blocks)
945 				new_iblocks = 0; /* no new blocks allocated */
946 		} else {
947 			pagecreate = 0;
948 			/*
949 			 * In sync mode flush the indirect blocks which
950 			 * may have been allocated and not written on
951 			 * disk. In above cases bmap_write will allocate
952 			 * in sync mode.
953 			 */
954 			if (ioflag & (FSYNC|FDSYNC)) {
955 				error = ufs_indirblk_sync(ip, uoff);
956 				if (error)
957 					break;
958 			}
959 		}
960 
961 		/*
962 		 * At this point we can enter ufs_getpage() in one
963 		 * of two ways:
964 		 * 1) segmap_getmapflt() calls ufs_getpage() when the
965 		 *    forcefault parameter is true (pagecreate == 0)
966 		 * 2) uiomove() causes a page fault.
967 		 *
968 		 * We have to drop the contents lock to prevent the VM
969 		 * system from trying to reaquire it in ufs_getpage()
970 		 * should the uiomove cause a pagefault.
971 		 *
972 		 * We have to drop the reader vfs_dqrwlock here as well.
973 		 */
974 		rw_exit(&ip->i_contents);
975 		if (do_dqrwlock) {
976 			ASSERT(RW_LOCK_HELD(&ufsvfsp->vfs_dqrwlock));
977 			ASSERT(!(RW_WRITE_HELD(&ufsvfsp->vfs_dqrwlock)));
978 			rw_exit(&ufsvfsp->vfs_dqrwlock);
979 		}
980 
981 		newpage = 0;
982 		premove_resid = uio->uio_resid;
983 		if (vpm_enable) {
984 			/*
985 			 * Copy data. If new pages are created, part of
986 			 * the page that is not written will be initizliazed
987 			 * with zeros.
988 			 */
989 			error = vpm_data_copy(vp, (off + mapon), (uint_t)n,
990 			    uio, !pagecreate, &newpage, 0, S_WRITE);
991 		} else {
992 
993 			base = segmap_getmapflt(segkmap, vp, (off + mapon),
994 			    (uint_t)n, !pagecreate, S_WRITE);
995 
996 			/*
997 			 * segmap_pagecreate() returns 1 if it calls
998 			 * page_create_va() to allocate any pages.
999 			 */
1000 
1001 			if (pagecreate)
1002 				newpage = segmap_pagecreate(segkmap, base,
1003 				    (size_t)n, 0);
1004 
1005 			error = uiomove(base + mapon, (long)n, UIO_WRITE, uio);
1006 		}
1007 
1008 		/*
1009 		 * If "newpage" is set, then a new page was created and it
1010 		 * does not contain valid data, so it needs to be initialized
1011 		 * at this point.
1012 		 * Otherwise the page contains old data, which was overwritten
1013 		 * partially or as a whole in uiomove.
1014 		 * If there is only one iovec structure within uio, then
1015 		 * on error uiomove will not be able to update uio->uio_loffset
1016 		 * and we would zero the whole page here!
1017 		 *
1018 		 * If uiomove fails because of an error, the old valid data
1019 		 * is kept instead of filling the rest of the page with zero's.
1020 		 */
1021 		if (!vpm_enable && newpage &&
1022 		    uio->uio_loffset < roundup(off + mapon + n, PAGESIZE)) {
1023 			/*
1024 			 * We created pages w/o initializing them completely,
1025 			 * thus we need to zero the part that wasn't set up.
1026 			 * This happens on most EOF write cases and if
1027 			 * we had some sort of error during the uiomove.
1028 			 */
1029 			int nzero, nmoved;
1030 
1031 			nmoved = (int)(uio->uio_loffset - (off + mapon));
1032 			ASSERT(nmoved >= 0 && nmoved <= n);
1033 			nzero = roundup(on + n, PAGESIZE) - nmoved;
1034 			ASSERT(nzero > 0 && mapon + nmoved + nzero <= MAXBSIZE);
1035 			(void) kzero(base + mapon + nmoved, (uint_t)nzero);
1036 		}
1037 
1038 		/*
1039 		 * Unlock the pages allocated by page_create_va()
1040 		 * in segmap_pagecreate()
1041 		 */
1042 		if (!vpm_enable && newpage)
1043 			segmap_pageunlock(segkmap, base, (size_t)n, S_WRITE);
1044 
1045 		/*
1046 		 * If the size of the file changed, then update the
1047 		 * size field in the inode now.  This can't be done
1048 		 * before the call to segmap_pageunlock or there is
1049 		 * a potential deadlock with callers to ufs_putpage().
1050 		 * They will be holding i_contents and trying to lock
1051 		 * a page, while this thread is holding a page locked
1052 		 * and trying to acquire i_contents.
1053 		 */
1054 		if (i_size_changed) {
1055 			rw_enter(&ip->i_contents, RW_WRITER);
1056 			old_i_size = ip->i_size;
1057 			UFS_SET_ISIZE(uoff + n, ip);
1058 			TRANS_INODE(ufsvfsp, ip);
1059 			/*
1060 			 * file has grown larger than 2GB. Set flag
1061 			 * in superblock to indicate this, if it
1062 			 * is not already set.
1063 			 */
1064 			if ((ip->i_size > MAXOFF32_T) &&
1065 			    !(fs->fs_flags & FSLARGEFILES)) {
1066 				ASSERT(ufsvfsp->vfs_lfflags & UFS_LARGEFILES);
1067 				mutex_enter(&ufsvfsp->vfs_lock);
1068 				fs->fs_flags |= FSLARGEFILES;
1069 				ufs_sbwrite(ufsvfsp);
1070 				mutex_exit(&ufsvfsp->vfs_lock);
1071 			}
1072 			mutex_enter(&ip->i_tlock);
1073 			ip->i_writer = NULL;
1074 			cv_broadcast(&ip->i_wrcv);
1075 			mutex_exit(&ip->i_tlock);
1076 			rw_exit(&ip->i_contents);
1077 		}
1078 
1079 		if (error) {
1080 			/*
1081 			 * If we failed on a write, we may have already
1082 			 * allocated file blocks as well as pages.  It's
1083 			 * hard to undo the block allocation, but we must
1084 			 * be sure to invalidate any pages that may have
1085 			 * been allocated.
1086 			 *
1087 			 * If the page was created without initialization
1088 			 * then we must check if it should be possible
1089 			 * to destroy the new page and to keep the old data
1090 			 * on the disk.
1091 			 *
1092 			 * It is possible to destroy the page without
1093 			 * having to write back its contents only when
1094 			 * - the size of the file keeps unchanged
1095 			 * - bmap_write() did not allocate new disk blocks
1096 			 *   it is possible to create big files using "seek" and
1097 			 *   write to the end of the file. A "write" to a
1098 			 *   position before the end of the file would not
1099 			 *   change the size of the file but it would allocate
1100 			 *   new disk blocks.
1101 			 * - uiomove intended to overwrite the whole page.
1102 			 * - a new page was created (newpage == 1).
1103 			 */
1104 
1105 			if (i_size_changed == 0 && new_iblocks == 0 &&
1106 			    newpage) {
1107 
1108 				/* unwind what uiomove eventually last did */
1109 				uio->uio_resid = premove_resid;
1110 
1111 				/*
1112 				 * destroy the page, do not write ambiguous
1113 				 * data to the disk.
1114 				 */
1115 				flags = SM_DESTROY;
1116 			} else {
1117 				/*
1118 				 * write the page back to the disk, if dirty,
1119 				 * and remove the page from the cache.
1120 				 */
1121 				flags = SM_INVAL;
1122 			}
1123 
1124 			if (vpm_enable) {
1125 				/*
1126 				 *  Flush pages.
1127 				 */
1128 				(void) vpm_sync_pages(vp, off, n, flags);
1129 			} else {
1130 				(void) segmap_release(segkmap, base, flags);
1131 			}
1132 		} else {
1133 			flags = 0;
1134 			/*
1135 			 * Force write back for synchronous write cases.
1136 			 */
1137 			if ((ioflag & (FSYNC|FDSYNC)) || type == IFDIR) {
1138 				/*
1139 				 * If the sticky bit is set but the
1140 				 * execute bit is not set, we do a
1141 				 * synchronous write back and free
1142 				 * the page when done.  We set up swap
1143 				 * files to be handled this way to
1144 				 * prevent servers from keeping around
1145 				 * the client's swap pages too long.
1146 				 * XXX - there ought to be a better way.
1147 				 */
1148 				if (IS_SWAPVP(vp)) {
1149 					flags = SM_WRITE | SM_FREE |
1150 					    SM_DONTNEED;
1151 					iupdat_flag = 0;
1152 				} else {
1153 					flags = SM_WRITE;
1154 				}
1155 			} else if (n + on == MAXBSIZE || IS_SWAPVP(vp)) {
1156 				/*
1157 				 * Have written a whole block.
1158 				 * Start an asynchronous write and
1159 				 * mark the buffer to indicate that
1160 				 * it won't be needed again soon.
1161 				 */
1162 				flags = SM_WRITE | SM_ASYNC | SM_DONTNEED;
1163 			}
1164 			if (vpm_enable) {
1165 				/*
1166 				 * Flush pages.
1167 				 */
1168 				error = vpm_sync_pages(vp, off, n, flags);
1169 			} else {
1170 				error = segmap_release(segkmap, base, flags);
1171 			}
1172 			/*
1173 			 * If the operation failed and is synchronous,
1174 			 * then we need to unwind what uiomove() last
1175 			 * did so we can potentially return an error to
1176 			 * the caller.  If this write operation was
1177 			 * done in two pieces and the first succeeded,
1178 			 * then we won't return an error for the second
1179 			 * piece that failed.  However, we only want to
1180 			 * return a resid value that reflects what was
1181 			 * really done.
1182 			 *
1183 			 * Failures for non-synchronous operations can
1184 			 * be ignored since the page subsystem will
1185 			 * retry the operation until it succeeds or the
1186 			 * file system is unmounted.
1187 			 */
1188 			if (error) {
1189 				if ((ioflag & (FSYNC | FDSYNC)) ||
1190 				    type == IFDIR) {
1191 					uio->uio_resid = premove_resid;
1192 				} else {
1193 					error = 0;
1194 				}
1195 			}
1196 		}
1197 
1198 		/*
1199 		 * Re-acquire contents lock.
1200 		 * If it was dropped, reacquire reader vfs_dqrwlock as well.
1201 		 */
1202 		if (do_dqrwlock)
1203 			rw_enter(&ufsvfsp->vfs_dqrwlock, RW_READER);
1204 		rw_enter(&ip->i_contents, RW_WRITER);
1205 
1206 		/*
1207 		 * If the uiomove() failed or if a synchronous
1208 		 * page push failed, fix up i_size.
1209 		 */
1210 		if (error) {
1211 			if (i_size_changed) {
1212 				/*
1213 				 * The uiomove failed, and we
1214 				 * allocated blocks,so get rid
1215 				 * of them.
1216 				 */
1217 				(void) ufs_itrunc(ip, old_i_size, 0, cr);
1218 			}
1219 		} else {
1220 			/*
1221 			 * XXX - Can this be out of the loop?
1222 			 */
1223 			ip->i_flag |= IUPD | ICHG;
1224 			/*
1225 			 * Only do one increase of i_seq for multiple
1226 			 * pieces.  Because we drop locks, record
1227 			 * the fact that we changed the timestamp and
1228 			 * are deferring the increase in case another thread
1229 			 * pushes our timestamp update.
1230 			 */
1231 			i_seq_needed = 1;
1232 			ip->i_flag |= ISEQ;
1233 			if (i_size_changed)
1234 				ip->i_flag |= IATTCHG;
1235 			if ((ip->i_mode & (IEXEC | (IEXEC >> 3) |
1236 			    (IEXEC >> 6))) != 0 &&
1237 			    (ip->i_mode & (ISUID | ISGID)) != 0 &&
1238 			    secpolicy_vnode_setid_retain(cr,
1239 			    (ip->i_mode & ISUID) != 0 && ip->i_uid == 0) != 0) {
1240 				/*
1241 				 * Clear Set-UID & Set-GID bits on
1242 				 * successful write if not privileged
1243 				 * and at least one of the execute bits
1244 				 * is set.  If we always clear Set-GID,
1245 				 * mandatory file and record locking is
1246 				 * unuseable.
1247 				 */
1248 				ip->i_mode &= ~(ISUID | ISGID);
1249 			}
1250 		}
1251 		/*
1252 		 * In the case the FDSYNC flag is set and this is a
1253 		 * "rewrite" we won't log a delta.
1254 		 * The FSYNC flag overrides all cases.
1255 		 */
1256 		if (!ufs_check_rewrite(ip, uio, ioflag) || !(ioflag & FDSYNC)) {
1257 			TRANS_INODE(ufsvfsp, ip);
1258 		}
1259 	} while (error == 0 && uio->uio_resid > 0 && n != 0);
1260 
1261 out:
1262 	/*
1263 	 * Make sure i_seq is increased at least once per write
1264 	 */
1265 	if (i_seq_needed) {
1266 		ip->i_seq++;
1267 		ip->i_flag &= ~ISEQ;	/* no longer deferred */
1268 	}
1269 
1270 	/*
1271 	 * Inode is updated according to this table -
1272 	 *
1273 	 *   FSYNC	  FDSYNC(posix.4)
1274 	 *   --------------------------
1275 	 *   always@	  IATTCHG|IBDWRITE
1276 	 *
1277 	 * @ - 	If we are doing synchronous write the only time we should
1278 	 *	not be sync'ing the ip here is if we have the stickyhack
1279 	 *	activated, the file is marked with the sticky bit and
1280 	 *	no exec bit, the file length has not been changed and
1281 	 *	no new blocks have been allocated during this write.
1282 	 */
1283 
1284 	if ((ip->i_flag & ISYNC) != 0) {
1285 		/*
1286 		 * we have eliminated nosync
1287 		 */
1288 		if ((ip->i_flag & (IATTCHG|IBDWRITE)) ||
1289 		    ((ioflag & FSYNC) && iupdat_flag)) {
1290 			ufs_iupdat(ip, 1);
1291 		}
1292 	}
1293 
1294 	/*
1295 	 * If we've already done a partial-write, terminate
1296 	 * the write but return no error unless the error is ENOSPC
1297 	 * because the caller can detect this and free resources and
1298 	 * try again.
1299 	 */
1300 	if ((start_resid != uio->uio_resid) && (error != ENOSPC))
1301 		error = 0;
1302 
1303 	ip->i_flag &= ~(INOACC | ISYNC);
1304 	ITIMES_NOLOCK(ip);
1305 	return (error);
1306 }
1307 
1308 /*
1309  * rdip does the real work of read requests for ufs.
1310  */
1311 int
1312 rdip(struct inode *ip, struct uio *uio, int ioflag, cred_t *cr)
1313 {
1314 	u_offset_t off;
1315 	caddr_t base;
1316 	struct fs *fs;
1317 	struct ufsvfs *ufsvfsp;
1318 	struct vnode *vp;
1319 	long oresid = uio->uio_resid;
1320 	u_offset_t n, on, mapon;
1321 	int error = 0;
1322 	int doupdate = 1;
1323 	uint_t flags;
1324 	int dofree, directio_status;
1325 	krw_t rwtype;
1326 	o_mode_t type;
1327 
1328 	vp = ITOV(ip);
1329 
1330 	ASSERT(RW_LOCK_HELD(&ip->i_contents));
1331 
1332 	ufsvfsp = ip->i_ufsvfs;
1333 
1334 	if (ufsvfsp == NULL)
1335 		return (EIO);
1336 
1337 	fs = ufsvfsp->vfs_fs;
1338 
1339 	/* check for valid filetype */
1340 	type = ip->i_mode & IFMT;
1341 	if ((type != IFREG) && (type != IFDIR) && (type != IFATTRDIR) &&
1342 	    (type != IFLNK) && (type != IFSHAD)) {
1343 		return (EIO);
1344 	}
1345 
1346 	if (uio->uio_loffset > UFS_MAXOFFSET_T) {
1347 		error = 0;
1348 		goto out;
1349 	}
1350 	if (uio->uio_loffset < (offset_t)0) {
1351 		return (EINVAL);
1352 	}
1353 	if (uio->uio_resid == 0) {
1354 		return (0);
1355 	}
1356 
1357 	if (!ULOCKFS_IS_NOIACC(ITOUL(ip)) && (fs->fs_ronly == 0) &&
1358 	    (!ufsvfsp->vfs_noatime)) {
1359 		mutex_enter(&ip->i_tlock);
1360 		ip->i_flag |= IACC;
1361 		mutex_exit(&ip->i_tlock);
1362 	}
1363 	/*
1364 	 * Try to go direct
1365 	 */
1366 	if (ip->i_flag & IDIRECTIO || ufsvfsp->vfs_forcedirectio) {
1367 		error = ufs_directio_read(ip, uio, cr, &directio_status);
1368 		if (directio_status == DIRECTIO_SUCCESS)
1369 			goto out;
1370 	}
1371 
1372 	rwtype = (rw_write_held(&ip->i_contents)?RW_WRITER:RW_READER);
1373 
1374 	do {
1375 		offset_t diff;
1376 		u_offset_t uoff = uio->uio_loffset;
1377 		off = uoff & (offset_t)MAXBMASK;
1378 		mapon = (u_offset_t)(uoff & (offset_t)MAXBOFFSET);
1379 		on = (u_offset_t)blkoff(fs, uoff);
1380 		n = MIN((u_offset_t)fs->fs_bsize - on,
1381 		    (u_offset_t)uio->uio_resid);
1382 
1383 		diff = ip->i_size - uoff;
1384 
1385 		if (diff <= (offset_t)0) {
1386 			error = 0;
1387 			goto out;
1388 		}
1389 		if (diff < (offset_t)n)
1390 			n = (int)diff;
1391 
1392 		/*
1393 		 * We update smallfile2 and smallfile1 at most every second.
1394 		 */
1395 		if (lbolt >= smallfile_update) {
1396 			uint64_t percpufreeb;
1397 			if (smallfile1_d == 0) smallfile1_d = SMALLFILE1_D;
1398 			if (smallfile2_d == 0) smallfile2_d = SMALLFILE2_D;
1399 			percpufreeb = ptob((uint64_t)freemem) / ncpus_online;
1400 			smallfile1 = percpufreeb / smallfile1_d;
1401 			smallfile2 = percpufreeb / smallfile2_d;
1402 			smallfile1 = MAX(smallfile1, smallfile);
1403 			smallfile1 = MAX(smallfile1, smallfile64);
1404 			smallfile2 = MAX(smallfile1, smallfile2);
1405 			smallfile_update = lbolt + hz;
1406 		}
1407 
1408 		dofree = freebehind &&
1409 		    ip->i_nextr == (off & PAGEMASK) && off > smallfile1;
1410 
1411 		/*
1412 		 * At this point we can enter ufs_getpage() in one of two
1413 		 * ways:
1414 		 * 1) segmap_getmapflt() calls ufs_getpage() when the
1415 		 *    forcefault parameter is true (value of 1 is passed)
1416 		 * 2) uiomove() causes a page fault.
1417 		 *
1418 		 * We cannot hold onto an i_contents reader lock without
1419 		 * risking deadlock in ufs_getpage() so drop a reader lock.
1420 		 * The ufs_getpage() dolock logic already allows for a
1421 		 * thread holding i_contents as writer to work properly
1422 		 * so we keep a writer lock.
1423 		 */
1424 		if (rwtype == RW_READER)
1425 			rw_exit(&ip->i_contents);
1426 
1427 		if (vpm_enable) {
1428 			/*
1429 			 * Copy data.
1430 			 */
1431 			error = vpm_data_copy(vp, (off + mapon), (uint_t)n,
1432 			    uio, 1, NULL, 0, S_READ);
1433 		} else {
1434 			base = segmap_getmapflt(segkmap, vp, (off + mapon),
1435 			    (uint_t)n, 1, S_READ);
1436 			error = uiomove(base + mapon, (long)n, UIO_READ, uio);
1437 		}
1438 
1439 		flags = 0;
1440 		if (!error) {
1441 			/*
1442 			 * If  reading sequential  we won't need  this
1443 			 * buffer again  soon.  For  offsets in  range
1444 			 * [smallfile1,  smallfile2] release the pages
1445 			 * at   the  tail  of the   cache list, larger
1446 			 * offsets are released at the head.
1447 			 */
1448 			if (dofree) {
1449 				flags = SM_FREE | SM_ASYNC;
1450 				if ((cache_read_ahead == 0) &&
1451 				    (off > smallfile2))
1452 					flags |=  SM_DONTNEED;
1453 			}
1454 			/*
1455 			 * In POSIX SYNC (FSYNC and FDSYNC) read mode,
1456 			 * we want to make sure that the page which has
1457 			 * been read, is written on disk if it is dirty.
1458 			 * And corresponding indirect blocks should also
1459 			 * be flushed out.
1460 			 */
1461 			if ((ioflag & FRSYNC) && (ioflag & (FSYNC|FDSYNC))) {
1462 				flags &= ~SM_ASYNC;
1463 				flags |= SM_WRITE;
1464 			}
1465 			if (vpm_enable) {
1466 				error = vpm_sync_pages(vp, off, n, flags);
1467 			} else {
1468 				error = segmap_release(segkmap, base, flags);
1469 			}
1470 		} else {
1471 			if (vpm_enable) {
1472 				(void) vpm_sync_pages(vp, off, n, flags);
1473 			} else {
1474 				(void) segmap_release(segkmap, base, flags);
1475 			}
1476 		}
1477 
1478 		if (rwtype == RW_READER)
1479 			rw_enter(&ip->i_contents, rwtype);
1480 	} while (error == 0 && uio->uio_resid > 0 && n != 0);
1481 out:
1482 	/*
1483 	 * Inode is updated according to this table if FRSYNC is set.
1484 	 *
1485 	 *   FSYNC	  FDSYNC(posix.4)
1486 	 *   --------------------------
1487 	 *   always	  IATTCHG|IBDWRITE
1488 	 */
1489 	/*
1490 	 * The inode is not updated if we're logging and the inode is a
1491 	 * directory with FRSYNC, FSYNC and FDSYNC flags set.
1492 	 */
1493 	if (ioflag & FRSYNC) {
1494 		if (TRANS_ISTRANS(ufsvfsp) && ((ip->i_mode & IFMT) == IFDIR)) {
1495 				doupdate = 0;
1496 		}
1497 		if (doupdate) {
1498 			if ((ioflag & FSYNC) ||
1499 			    ((ioflag & FDSYNC) &&
1500 			    (ip->i_flag & (IATTCHG|IBDWRITE)))) {
1501 				ufs_iupdat(ip, 1);
1502 			}
1503 		}
1504 	}
1505 	/*
1506 	 * If we've already done a partial read, terminate
1507 	 * the read but return no error.
1508 	 */
1509 	if (oresid != uio->uio_resid)
1510 		error = 0;
1511 	ITIMES(ip);
1512 
1513 	return (error);
1514 }
1515 
1516 /* ARGSUSED */
1517 static int
1518 ufs_ioctl(
1519 	struct vnode	*vp,
1520 	int		cmd,
1521 	intptr_t	arg,
1522 	int		flag,
1523 	struct cred	*cr,
1524 	int		*rvalp)
1525 {
1526 	struct lockfs	lockfs, lockfs_out;
1527 	struct ufsvfs	*ufsvfsp = VTOI(vp)->i_ufsvfs;
1528 	char		*comment, *original_comment;
1529 	struct fs	*fs;
1530 	struct ulockfs	*ulp;
1531 	offset_t	off;
1532 	extern int	maxphys;
1533 	int		error;
1534 	int		issync;
1535 	int		trans_size;
1536 
1537 
1538 	/*
1539 	 * forcibly unmounted
1540 	 */
1541 	if (ufsvfsp == NULL) {
1542 		return (EIO);
1543 	}
1544 
1545 	fs = ufsvfsp->vfs_fs;
1546 
1547 	if (cmd == Q_QUOTACTL) {
1548 		error = ufs_lockfs_begin(ufsvfsp, &ulp, ULOCKFS_QUOTA_MASK);
1549 		if (error)
1550 			return (error);
1551 
1552 		if (ulp) {
1553 			TRANS_BEGIN_ASYNC(ufsvfsp, TOP_QUOTA,
1554 			    TOP_SETQUOTA_SIZE(fs));
1555 		}
1556 
1557 		error = quotactl(vp, arg, flag, cr);
1558 
1559 		if (ulp) {
1560 			TRANS_END_ASYNC(ufsvfsp, TOP_QUOTA,
1561 			    TOP_SETQUOTA_SIZE(fs));
1562 			ufs_lockfs_end(ulp);
1563 		}
1564 		return (error);
1565 	}
1566 
1567 	switch (cmd) {
1568 		case _FIOLFS:
1569 			/*
1570 			 * file system locking
1571 			 */
1572 			if (secpolicy_fs_config(cr, ufsvfsp->vfs_vfs) != 0)
1573 				return (EPERM);
1574 
1575 			if ((flag & DATAMODEL_MASK) == DATAMODEL_NATIVE) {
1576 				if (copyin((caddr_t)arg, &lockfs,
1577 				    sizeof (struct lockfs)))
1578 					return (EFAULT);
1579 			}
1580 #ifdef _SYSCALL32_IMPL
1581 			else {
1582 				struct lockfs32	lockfs32;
1583 				/* Translate ILP32 lockfs to LP64 lockfs */
1584 				if (copyin((caddr_t)arg, &lockfs32,
1585 				    sizeof (struct lockfs32)))
1586 					return (EFAULT);
1587 				lockfs.lf_lock = (ulong_t)lockfs32.lf_lock;
1588 				lockfs.lf_flags = (ulong_t)lockfs32.lf_flags;
1589 				lockfs.lf_key = (ulong_t)lockfs32.lf_key;
1590 				lockfs.lf_comlen = (ulong_t)lockfs32.lf_comlen;
1591 				lockfs.lf_comment =
1592 				    (caddr_t)(uintptr_t)lockfs32.lf_comment;
1593 			}
1594 #endif /* _SYSCALL32_IMPL */
1595 
1596 			if (lockfs.lf_comlen) {
1597 				if (lockfs.lf_comlen > LOCKFS_MAXCOMMENTLEN)
1598 					return (ENAMETOOLONG);
1599 				comment =
1600 				    kmem_alloc(lockfs.lf_comlen, KM_SLEEP);
1601 				if (copyin(lockfs.lf_comment, comment,
1602 				    lockfs.lf_comlen)) {
1603 					kmem_free(comment, lockfs.lf_comlen);
1604 					return (EFAULT);
1605 				}
1606 				original_comment = lockfs.lf_comment;
1607 				lockfs.lf_comment = comment;
1608 			}
1609 			if ((error = ufs_fiolfs(vp, &lockfs, 0)) == 0) {
1610 				lockfs.lf_comment = original_comment;
1611 
1612 				if ((flag & DATAMODEL_MASK) ==
1613 				    DATAMODEL_NATIVE) {
1614 					(void) copyout(&lockfs, (caddr_t)arg,
1615 					    sizeof (struct lockfs));
1616 				}
1617 #ifdef _SYSCALL32_IMPL
1618 				else {
1619 					struct lockfs32	lockfs32;
1620 					/* Translate LP64 to ILP32 lockfs */
1621 					lockfs32.lf_lock =
1622 					    (uint32_t)lockfs.lf_lock;
1623 					lockfs32.lf_flags =
1624 					    (uint32_t)lockfs.lf_flags;
1625 					lockfs32.lf_key =
1626 					    (uint32_t)lockfs.lf_key;
1627 					lockfs32.lf_comlen =
1628 					    (uint32_t)lockfs.lf_comlen;
1629 					lockfs32.lf_comment =
1630 					    (uint32_t)(uintptr_t)
1631 					    lockfs.lf_comment;
1632 					(void) copyout(&lockfs32, (caddr_t)arg,
1633 					    sizeof (struct lockfs32));
1634 				}
1635 #endif /* _SYSCALL32_IMPL */
1636 
1637 			} else {
1638 				if (lockfs.lf_comlen)
1639 					kmem_free(comment, lockfs.lf_comlen);
1640 			}
1641 			return (error);
1642 
1643 		case _FIOLFSS:
1644 			/*
1645 			 * get file system locking status
1646 			 */
1647 
1648 			if ((flag & DATAMODEL_MASK) == DATAMODEL_NATIVE) {
1649 				if (copyin((caddr_t)arg, &lockfs,
1650 				    sizeof (struct lockfs)))
1651 					return (EFAULT);
1652 			}
1653 #ifdef _SYSCALL32_IMPL
1654 			else {
1655 				struct lockfs32	lockfs32;
1656 				/* Translate ILP32 lockfs to LP64 lockfs */
1657 				if (copyin((caddr_t)arg, &lockfs32,
1658 				    sizeof (struct lockfs32)))
1659 					return (EFAULT);
1660 				lockfs.lf_lock = (ulong_t)lockfs32.lf_lock;
1661 				lockfs.lf_flags = (ulong_t)lockfs32.lf_flags;
1662 				lockfs.lf_key = (ulong_t)lockfs32.lf_key;
1663 				lockfs.lf_comlen = (ulong_t)lockfs32.lf_comlen;
1664 				lockfs.lf_comment =
1665 				    (caddr_t)(uintptr_t)lockfs32.lf_comment;
1666 			}
1667 #endif /* _SYSCALL32_IMPL */
1668 
1669 			if (error =  ufs_fiolfss(vp, &lockfs_out))
1670 				return (error);
1671 			lockfs.lf_lock = lockfs_out.lf_lock;
1672 			lockfs.lf_key = lockfs_out.lf_key;
1673 			lockfs.lf_flags = lockfs_out.lf_flags;
1674 			lockfs.lf_comlen = MIN(lockfs.lf_comlen,
1675 			    lockfs_out.lf_comlen);
1676 
1677 			if ((flag & DATAMODEL_MASK) == DATAMODEL_NATIVE) {
1678 				if (copyout(&lockfs, (caddr_t)arg,
1679 				    sizeof (struct lockfs)))
1680 					return (EFAULT);
1681 			}
1682 #ifdef _SYSCALL32_IMPL
1683 			else {
1684 				/* Translate LP64 to ILP32 lockfs */
1685 				struct lockfs32	lockfs32;
1686 				lockfs32.lf_lock = (uint32_t)lockfs.lf_lock;
1687 				lockfs32.lf_flags = (uint32_t)lockfs.lf_flags;
1688 				lockfs32.lf_key = (uint32_t)lockfs.lf_key;
1689 				lockfs32.lf_comlen = (uint32_t)lockfs.lf_comlen;
1690 				lockfs32.lf_comment =
1691 				    (uint32_t)(uintptr_t)lockfs.lf_comment;
1692 				if (copyout(&lockfs32, (caddr_t)arg,
1693 				    sizeof (struct lockfs32)))
1694 					return (EFAULT);
1695 			}
1696 #endif /* _SYSCALL32_IMPL */
1697 
1698 			if (lockfs.lf_comlen &&
1699 			    lockfs.lf_comment && lockfs_out.lf_comment)
1700 				if (copyout(lockfs_out.lf_comment,
1701 				    lockfs.lf_comment, lockfs.lf_comlen))
1702 					return (EFAULT);
1703 			return (0);
1704 
1705 		case _FIOSATIME:
1706 			/*
1707 			 * set access time
1708 			 */
1709 
1710 			/*
1711 			 * if mounted w/o atime, return quietly.
1712 			 * I briefly thought about returning ENOSYS, but
1713 			 * figured that most apps would consider this fatal
1714 			 * but the idea is to make this as seamless as poss.
1715 			 */
1716 			if (ufsvfsp->vfs_noatime)
1717 				return (0);
1718 
1719 			error = ufs_lockfs_begin(ufsvfsp, &ulp,
1720 			    ULOCKFS_SETATTR_MASK);
1721 			if (error)
1722 				return (error);
1723 
1724 			if (ulp) {
1725 				trans_size = (int)TOP_SETATTR_SIZE(VTOI(vp));
1726 				TRANS_BEGIN_CSYNC(ufsvfsp, issync,
1727 				    TOP_SETATTR, trans_size);
1728 			}
1729 
1730 			error = ufs_fiosatime(vp, (struct timeval *)arg,
1731 			    flag, cr);
1732 
1733 			if (ulp) {
1734 				TRANS_END_CSYNC(ufsvfsp, error, issync,
1735 				    TOP_SETATTR, trans_size);
1736 				ufs_lockfs_end(ulp);
1737 			}
1738 			return (error);
1739 
1740 		case _FIOSDIO:
1741 			/*
1742 			 * set delayed-io
1743 			 */
1744 			return (ufs_fiosdio(vp, (uint_t *)arg, flag, cr));
1745 
1746 		case _FIOGDIO:
1747 			/*
1748 			 * get delayed-io
1749 			 */
1750 			return (ufs_fiogdio(vp, (uint_t *)arg, flag, cr));
1751 
1752 		case _FIOIO:
1753 			/*
1754 			 * inode open
1755 			 */
1756 			error = ufs_lockfs_begin(ufsvfsp, &ulp,
1757 			    ULOCKFS_VGET_MASK);
1758 			if (error)
1759 				return (error);
1760 
1761 			error = ufs_fioio(vp, (struct fioio *)arg, flag, cr);
1762 
1763 			if (ulp) {
1764 				ufs_lockfs_end(ulp);
1765 			}
1766 			return (error);
1767 
1768 		case _FIOFFS:
1769 			/*
1770 			 * file system flush (push w/invalidate)
1771 			 */
1772 			if ((caddr_t)arg != NULL)
1773 				return (EINVAL);
1774 			return (ufs_fioffs(vp, NULL, cr));
1775 
1776 		case _FIOISBUSY:
1777 			/*
1778 			 * Contract-private interface for Legato
1779 			 * Purge this vnode from the DNLC and decide
1780 			 * if this vnode is busy (*arg == 1) or not
1781 			 * (*arg == 0)
1782 			 */
1783 			if (secpolicy_fs_config(cr, ufsvfsp->vfs_vfs) != 0)
1784 				return (EPERM);
1785 			error = ufs_fioisbusy(vp, (int *)arg, cr);
1786 			return (error);
1787 
1788 		case _FIODIRECTIO:
1789 			return (ufs_fiodirectio(vp, (int)arg, cr));
1790 
1791 		case _FIOTUNE:
1792 			/*
1793 			 * Tune the file system (aka setting fs attributes)
1794 			 */
1795 			error = ufs_lockfs_begin(ufsvfsp, &ulp,
1796 			    ULOCKFS_SETATTR_MASK);
1797 			if (error)
1798 				return (error);
1799 
1800 			error = ufs_fiotune(vp, (struct fiotune *)arg, cr);
1801 
1802 			if (ulp)
1803 				ufs_lockfs_end(ulp);
1804 			return (error);
1805 
1806 		case _FIOLOGENABLE:
1807 			if (secpolicy_fs_config(cr, ufsvfsp->vfs_vfs) != 0)
1808 				return (EPERM);
1809 			return (ufs_fiologenable(vp, (void *)arg, cr, flag));
1810 
1811 		case _FIOLOGDISABLE:
1812 			if (secpolicy_fs_config(cr, ufsvfsp->vfs_vfs) != 0)
1813 				return (EPERM);
1814 			return (ufs_fiologdisable(vp, (void *)arg, cr, flag));
1815 
1816 		case _FIOISLOG:
1817 			return (ufs_fioislog(vp, (void *)arg, cr, flag));
1818 
1819 		case _FIOSNAPSHOTCREATE_MULTI:
1820 		{
1821 			struct fiosnapcreate_multi	fc, *fcp;
1822 			size_t	fcm_size;
1823 
1824 			if (copyin((void *)arg, &fc, sizeof (fc)))
1825 				return (EFAULT);
1826 			if (fc.backfilecount > MAX_BACKFILE_COUNT)
1827 				return (EINVAL);
1828 			fcm_size = sizeof (struct fiosnapcreate_multi) +
1829 			    (fc.backfilecount - 1) * sizeof (int);
1830 			fcp = (struct fiosnapcreate_multi *)
1831 			    kmem_alloc(fcm_size, KM_SLEEP);
1832 			if (copyin((void *)arg, fcp, fcm_size)) {
1833 				kmem_free(fcp, fcm_size);
1834 				return (EFAULT);
1835 			}
1836 			error = ufs_snap_create(vp, fcp, cr);
1837 			if (!error && copyout(fcp, (void *)arg, fcm_size))
1838 				error = EFAULT;
1839 			kmem_free(fcp, fcm_size);
1840 			return (error);
1841 		}
1842 
1843 		case _FIOSNAPSHOTDELETE:
1844 		{
1845 			struct fiosnapdelete	fc;
1846 
1847 			if (copyin((void *)arg, &fc, sizeof (fc)))
1848 				return (EFAULT);
1849 			error = ufs_snap_delete(vp, &fc, cr);
1850 			if (!error && copyout(&fc, (void *)arg, sizeof (fc)))
1851 				error = EFAULT;
1852 			return (error);
1853 		}
1854 
1855 		case _FIOGETSUPERBLOCK:
1856 			if (copyout(fs, (void *)arg, SBSIZE))
1857 				return (EFAULT);
1858 			return (0);
1859 
1860 		case _FIOGETMAXPHYS:
1861 			if (copyout(&maxphys, (void *)arg, sizeof (maxphys)))
1862 				return (EFAULT);
1863 			return (0);
1864 
1865 		/*
1866 		 * The following 3 ioctls are for TSufs support
1867 		 * although could potentially be used elsewhere
1868 		 */
1869 		case _FIO_SET_LUFS_DEBUG:
1870 			if (secpolicy_fs_config(cr, ufsvfsp->vfs_vfs) != 0)
1871 				return (EPERM);
1872 			lufs_debug = (uint32_t)arg;
1873 			return (0);
1874 
1875 		case _FIO_SET_LUFS_ERROR:
1876 			if (secpolicy_fs_config(cr, ufsvfsp->vfs_vfs) != 0)
1877 				return (EPERM);
1878 			TRANS_SETERROR(ufsvfsp);
1879 			return (0);
1880 
1881 		case _FIO_GET_TOP_STATS:
1882 		{
1883 			fio_lufs_stats_t *ls;
1884 			ml_unit_t *ul = ufsvfsp->vfs_log;
1885 
1886 			ls = kmem_zalloc(sizeof (*ls), KM_SLEEP);
1887 			ls->ls_debug = ul->un_debug; /* return debug value */
1888 			/* Copy stucture if statistics are being kept */
1889 			if (ul->un_logmap->mtm_tops) {
1890 				ls->ls_topstats = *(ul->un_logmap->mtm_tops);
1891 			}
1892 			error = 0;
1893 			if (copyout(ls, (void *)arg, sizeof (*ls)))
1894 				error = EFAULT;
1895 			kmem_free(ls, sizeof (*ls));
1896 			return (error);
1897 		}
1898 
1899 		case _FIO_SEEK_DATA:
1900 		case _FIO_SEEK_HOLE:
1901 			if (ddi_copyin((void *)arg, &off, sizeof (off), flag))
1902 				return (EFAULT);
1903 			/* offset paramater is in/out */
1904 			error = ufs_fio_holey(vp, cmd, &off);
1905 			if (error)
1906 				return (error);
1907 			if (ddi_copyout(&off, (void *)arg, sizeof (off), flag))
1908 				return (EFAULT);
1909 			return (0);
1910 
1911 		default:
1912 			return (ENOTTY);
1913 	}
1914 }
1915 
1916 /* ARGSUSED */
1917 static int
1918 ufs_getattr(struct vnode *vp, struct vattr *vap, int flags,
1919 	struct cred *cr)
1920 {
1921 	struct inode *ip = VTOI(vp);
1922 	struct ufsvfs *ufsvfsp;
1923 	int err;
1924 
1925 	if (vap->va_mask == AT_SIZE) {
1926 		/*
1927 		 * for performance, if only the size is requested don't bother
1928 		 * with anything else.
1929 		 */
1930 		UFS_GET_ISIZE(&vap->va_size, ip);
1931 		return (0);
1932 	}
1933 
1934 	/*
1935 	 * inlined lockfs checks
1936 	 */
1937 	ufsvfsp = ip->i_ufsvfs;
1938 	if ((ufsvfsp == NULL) || ULOCKFS_IS_HLOCK(&ufsvfsp->vfs_ulockfs)) {
1939 		err = EIO;
1940 		goto out;
1941 	}
1942 
1943 	rw_enter(&ip->i_contents, RW_READER);
1944 	/*
1945 	 * Return all the attributes.  This should be refined so
1946 	 * that it only returns what's asked for.
1947 	 */
1948 
1949 	/*
1950 	 * Copy from inode table.
1951 	 */
1952 	vap->va_type = vp->v_type;
1953 	vap->va_mode = ip->i_mode & MODEMASK;
1954 	/*
1955 	 * If there is an ACL and there is a mask entry, then do the
1956 	 * extra work that completes the equivalent of an acltomode(3)
1957 	 * call.  According to POSIX P1003.1e, the acl mask should be
1958 	 * returned in the group permissions field.
1959 	 *
1960 	 * - start with the original permission and mode bits (from above)
1961 	 * - clear the group owner bits
1962 	 * - add in the mask bits.
1963 	 */
1964 	if (ip->i_ufs_acl && ip->i_ufs_acl->aclass.acl_ismask) {
1965 		vap->va_mode &= ~((VREAD | VWRITE | VEXEC) >> 3);
1966 		vap->va_mode |=
1967 		    (ip->i_ufs_acl->aclass.acl_maskbits & PERMMASK) << 3;
1968 	}
1969 	vap->va_uid = ip->i_uid;
1970 	vap->va_gid = ip->i_gid;
1971 	vap->va_fsid = ip->i_dev;
1972 	vap->va_nodeid = (ino64_t)ip->i_number;
1973 	vap->va_nlink = ip->i_nlink;
1974 	vap->va_size = ip->i_size;
1975 	if (vp->v_type == VCHR || vp->v_type == VBLK)
1976 		vap->va_rdev = ip->i_rdev;
1977 	else
1978 		vap->va_rdev = 0;	/* not a b/c spec. */
1979 	mutex_enter(&ip->i_tlock);
1980 	ITIMES_NOLOCK(ip);	/* mark correct time in inode */
1981 	vap->va_seq = ip->i_seq;
1982 	vap->va_atime.tv_sec = (time_t)ip->i_atime.tv_sec;
1983 	vap->va_atime.tv_nsec = ip->i_atime.tv_usec*1000;
1984 	vap->va_mtime.tv_sec = (time_t)ip->i_mtime.tv_sec;
1985 	vap->va_mtime.tv_nsec = ip->i_mtime.tv_usec*1000;
1986 	vap->va_ctime.tv_sec = (time_t)ip->i_ctime.tv_sec;
1987 	vap->va_ctime.tv_nsec = ip->i_ctime.tv_usec*1000;
1988 	mutex_exit(&ip->i_tlock);
1989 
1990 	switch (ip->i_mode & IFMT) {
1991 
1992 	case IFBLK:
1993 		vap->va_blksize = MAXBSIZE;		/* was BLKDEV_IOSIZE */
1994 		break;
1995 
1996 	case IFCHR:
1997 		vap->va_blksize = MAXBSIZE;
1998 		break;
1999 
2000 	default:
2001 		vap->va_blksize = ip->i_fs->fs_bsize;
2002 		break;
2003 	}
2004 	vap->va_nblocks = (fsblkcnt64_t)ip->i_blocks;
2005 	rw_exit(&ip->i_contents);
2006 	err = 0;
2007 
2008 out:
2009 	return (err);
2010 }
2011 
2012 /*ARGSUSED4*/
2013 static int
2014 ufs_setattr(
2015 	struct vnode *vp,
2016 	struct vattr *vap,
2017 	int flags,
2018 	struct cred *cr,
2019 	caller_context_t *ct)
2020 {
2021 	struct inode *ip = VTOI(vp);
2022 	struct ufsvfs *ufsvfsp = ip->i_ufsvfs;
2023 	struct fs *fs;
2024 	struct ulockfs *ulp;
2025 	char *errmsg1;
2026 	char *errmsg2;
2027 	long blocks;
2028 	long int mask = vap->va_mask;
2029 	size_t len1, len2;
2030 	int issync;
2031 	int trans_size;
2032 	int dotrans;
2033 	int dorwlock;
2034 	int error;
2035 	int owner_change;
2036 	int dodqlock;
2037 	timestruc_t now;
2038 	vattr_t oldva;
2039 	int retry = 1;
2040 	int indeadlock;
2041 
2042 	/*
2043 	 * Cannot set these attributes.
2044 	 */
2045 	if (mask & AT_NOSET) {
2046 		error = EINVAL;
2047 		goto out;
2048 	}
2049 
2050 	/*
2051 	 * check for forced unmount
2052 	 */
2053 	if (ufsvfsp == NULL)
2054 		return (EIO);
2055 
2056 	fs = ufsvfsp->vfs_fs;
2057 	if (fs->fs_ronly != 0)
2058 		return (EROFS);
2059 
2060 again:
2061 	errmsg1 = NULL;
2062 	errmsg2 = NULL;
2063 	dotrans = 0;
2064 	dorwlock = 0;
2065 	dodqlock = 0;
2066 
2067 	error = ufs_lockfs_begin(ufsvfsp, &ulp, ULOCKFS_SETATTR_MASK);
2068 	if (error)
2069 		goto out;
2070 
2071 	/*
2072 	 * Acquire i_rwlock before TRANS_BEGIN_CSYNC() if this is a file.
2073 	 * This follows the protocol for read()/write().
2074 	 */
2075 	if (vp->v_type != VDIR) {
2076 		/*
2077 		 * ufs_tryirwlock uses rw_tryenter and checks for SLOCK to
2078 		 * avoid i_rwlock, ufs_lockfs_begin deadlock. If deadlock
2079 		 * possible, retries the operation.
2080 		 */
2081 		ufs_tryirwlock(&ip->i_rwlock, RW_WRITER, retry_file);
2082 		if (indeadlock) {
2083 			if (ulp)
2084 				ufs_lockfs_end(ulp);
2085 			goto again;
2086 		}
2087 		dorwlock = 1;
2088 	}
2089 
2090 	/*
2091 	 * Truncate file.  Must have write permission and not be a directory.
2092 	 */
2093 	if (mask & AT_SIZE) {
2094 		rw_enter(&ip->i_contents, RW_WRITER);
2095 		if (vp->v_type == VDIR) {
2096 			error = EISDIR;
2097 			goto update_inode;
2098 		}
2099 		if (error = ufs_iaccess(ip, IWRITE, cr))
2100 			goto update_inode;
2101 
2102 		rw_exit(&ip->i_contents);
2103 		error = TRANS_ITRUNC(ip, vap->va_size, 0, cr);
2104 		if (error) {
2105 			rw_enter(&ip->i_contents, RW_WRITER);
2106 			goto update_inode;
2107 		}
2108 	}
2109 
2110 	if (ulp) {
2111 		trans_size = (int)TOP_SETATTR_SIZE(ip);
2112 		TRANS_BEGIN_CSYNC(ufsvfsp, issync, TOP_SETATTR, trans_size);
2113 		++dotrans;
2114 	}
2115 
2116 	/*
2117 	 * Acquire i_rwlock after TRANS_BEGIN_CSYNC() if this is a directory.
2118 	 * This follows the protocol established by
2119 	 * ufs_link/create/remove/rename/mkdir/rmdir/symlink.
2120 	 */
2121 	if (vp->v_type == VDIR) {
2122 		ufs_tryirwlock_trans(&ip->i_rwlock, RW_WRITER, TOP_SETATTR,
2123 		    retry_dir);
2124 		if (indeadlock)
2125 			goto again;
2126 		dorwlock = 1;
2127 	}
2128 
2129 	/*
2130 	 * Grab quota lock if we are changing the file's owner.
2131 	 */
2132 	if (mask & AT_UID) {
2133 		rw_enter(&ufsvfsp->vfs_dqrwlock, RW_READER);
2134 		dodqlock = 1;
2135 	}
2136 	rw_enter(&ip->i_contents, RW_WRITER);
2137 
2138 	oldva.va_mode = ip->i_mode;
2139 	oldva.va_uid = ip->i_uid;
2140 	oldva.va_gid = ip->i_gid;
2141 
2142 	vap->va_mask &= ~AT_SIZE;
2143 	/*
2144 	 * ufs_iaccess is "close enough"; that's because it doesn't
2145 	 * map the defines.
2146 	 */
2147 	error = secpolicy_vnode_setattr(cr, vp, vap, &oldva, flags,
2148 	    ufs_iaccess, ip);
2149 	if (error)
2150 		goto update_inode;
2151 
2152 	mask = vap->va_mask;
2153 
2154 	/*
2155 	 * Change file access modes.
2156 	 */
2157 	if (mask & AT_MODE) {
2158 		ip->i_mode = (ip->i_mode & IFMT) | (vap->va_mode & ~IFMT);
2159 		TRANS_INODE(ufsvfsp, ip);
2160 		ip->i_flag |= ICHG;
2161 		if (stickyhack) {
2162 			mutex_enter(&vp->v_lock);
2163 			if ((ip->i_mode & (ISVTX | IEXEC | IFDIR)) == ISVTX)
2164 				vp->v_flag |= VSWAPLIKE;
2165 			else
2166 				vp->v_flag &= ~VSWAPLIKE;
2167 			mutex_exit(&vp->v_lock);
2168 		}
2169 	}
2170 	if (mask & (AT_UID|AT_GID)) {
2171 		if (mask & AT_UID) {
2172 			/*
2173 			 * Don't change ownership of the quota inode.
2174 			 */
2175 			if (ufsvfsp->vfs_qinod == ip) {
2176 				ASSERT(ufsvfsp->vfs_qflags & MQ_ENABLED);
2177 				error = EINVAL;
2178 				goto update_inode;
2179 			}
2180 
2181 			/*
2182 			 * No real ownership change.
2183 			 */
2184 			if (ip->i_uid == vap->va_uid) {
2185 				blocks = 0;
2186 				owner_change = 0;
2187 			}
2188 			/*
2189 			 * Remove the blocks and the file, from the old user's
2190 			 * quota.
2191 			 */
2192 			else {
2193 				blocks = ip->i_blocks;
2194 				owner_change = 1;
2195 
2196 				(void) chkdq(ip, -blocks, /* force */ 1, cr,
2197 				    (char **)NULL, (size_t *)NULL);
2198 				(void) chkiq(ufsvfsp, /* change */ -1, ip,
2199 				    (uid_t)ip->i_uid, /* force */ 1, cr,
2200 				    (char **)NULL, (size_t *)NULL);
2201 				dqrele(ip->i_dquot);
2202 			}
2203 
2204 			ip->i_uid = vap->va_uid;
2205 
2206 			/*
2207 			 * There is a real ownership change.
2208 			 */
2209 			if (owner_change) {
2210 				/*
2211 				 * Add the blocks and the file to the new
2212 				 * user's quota.
2213 				 */
2214 				ip->i_dquot = getinoquota(ip);
2215 				(void) chkdq(ip, blocks, /* force */ 1, cr,
2216 				    &errmsg1, &len1);
2217 				(void) chkiq(ufsvfsp, /* change */ 1,
2218 				    (struct inode *)NULL, (uid_t)ip->i_uid,
2219 				    /* force */ 1, cr, &errmsg2, &len2);
2220 			}
2221 		}
2222 		if (mask & AT_GID) {
2223 			ip->i_gid = vap->va_gid;
2224 		}
2225 		TRANS_INODE(ufsvfsp, ip);
2226 		ip->i_flag |= ICHG;
2227 	}
2228 	/*
2229 	 * Change file access or modified times.
2230 	 */
2231 	if (mask & (AT_ATIME|AT_MTIME)) {
2232 		/* Check that the time value is within ufs range */
2233 		if (((mask & AT_ATIME) && TIMESPEC_OVERFLOW(&vap->va_atime)) ||
2234 		    ((mask & AT_MTIME) && TIMESPEC_OVERFLOW(&vap->va_mtime))) {
2235 			error = EOVERFLOW;
2236 			goto update_inode;
2237 		}
2238 
2239 		/*
2240 		 * if the "noaccess" mount option is set and only atime
2241 		 * update is requested, do nothing. No error is returned.
2242 		 */
2243 		if ((ufsvfsp->vfs_noatime) &&
2244 		    ((mask & (AT_ATIME|AT_MTIME)) == AT_ATIME))
2245 			goto skip_atime;
2246 
2247 		if (mask & AT_ATIME) {
2248 			ip->i_atime.tv_sec = vap->va_atime.tv_sec;
2249 			ip->i_atime.tv_usec = vap->va_atime.tv_nsec / 1000;
2250 			ip->i_flag &= ~IACC;
2251 		}
2252 		if (mask & AT_MTIME) {
2253 			ip->i_mtime.tv_sec = vap->va_mtime.tv_sec;
2254 			ip->i_mtime.tv_usec = vap->va_mtime.tv_nsec / 1000;
2255 			/*
2256 			 * Allow ufs_putapage() to distinguish manual mtime
2257 			 * update from one done on the fly by e.g. write().
2258 			 */
2259 			ip->i_mtime_last = ip->i_mtime;
2260 
2261 			gethrestime(&now);
2262 			if (now.tv_sec > TIME32_MAX) {
2263 				/*
2264 				 * In 2038, ctime sticks forever..
2265 				 */
2266 				ip->i_ctime.tv_sec = TIME32_MAX;
2267 				ip->i_ctime.tv_usec = 0;
2268 			} else {
2269 				ip->i_ctime.tv_sec = now.tv_sec;
2270 				ip->i_ctime.tv_usec = now.tv_nsec / 1000;
2271 			}
2272 			ip->i_flag &= ~(IUPD|ICHG);
2273 			ip->i_flag |= IMODTIME;
2274 		}
2275 		TRANS_INODE(ufsvfsp, ip);
2276 		ip->i_flag |= IMOD;
2277 	}
2278 
2279 skip_atime:
2280 	/*
2281 	 * The presence of a shadow inode may indicate an ACL, but does
2282 	 * not imply an ACL.  Future FSD types should be handled here too
2283 	 * and check for the presence of the attribute-specific data
2284 	 * before referencing it.
2285 	 */
2286 	if (ip->i_shadow) {
2287 		/*
2288 		 * XXX if ufs_iupdat is changed to sandbagged write fix
2289 		 * ufs_acl_setattr to push ip to keep acls consistent
2290 		 *
2291 		 * Suppress out of inodes messages if we will retry.
2292 		 */
2293 		if (retry)
2294 			ip->i_flag |= IQUIET;
2295 		error = ufs_acl_setattr(ip, vap, cr);
2296 		ip->i_flag &= ~IQUIET;
2297 	}
2298 
2299 update_inode:
2300 	/*
2301 	 * Setattr always increases the sequence number
2302 	 */
2303 	ip->i_seq++;
2304 
2305 	/*
2306 	 * if nfsd and not logging; push synchronously
2307 	 */
2308 	if ((curthread->t_flag & T_DONTPEND) && !TRANS_ISTRANS(ufsvfsp)) {
2309 		ufs_iupdat(ip, 1);
2310 	} else {
2311 		ITIMES_NOLOCK(ip);
2312 	}
2313 
2314 	rw_exit(&ip->i_contents);
2315 	if (dodqlock) {
2316 		rw_exit(&ufsvfsp->vfs_dqrwlock);
2317 	}
2318 	if (dorwlock)
2319 		rw_exit(&ip->i_rwlock);
2320 
2321 	if (ulp) {
2322 		if (dotrans) {
2323 			int terr = 0;
2324 			TRANS_END_CSYNC(ufsvfsp, terr, issync, TOP_SETATTR,
2325 			    trans_size);
2326 			if (error == 0)
2327 				error = terr;
2328 		}
2329 		ufs_lockfs_end(ulp);
2330 	}
2331 out:
2332 	/*
2333 	 * If out of inodes or blocks, see if we can free something
2334 	 * up from the delete queue.
2335 	 */
2336 	if ((error == ENOSPC) && retry && TRANS_ISTRANS(ufsvfsp)) {
2337 		ufs_delete_drain_wait(ufsvfsp, 1);
2338 		retry = 0;
2339 		if (errmsg1 != NULL)
2340 			kmem_free(errmsg1, len1);
2341 		if (errmsg2 != NULL)
2342 			kmem_free(errmsg2, len2);
2343 		goto again;
2344 	}
2345 	if (errmsg1 != NULL) {
2346 		uprintf(errmsg1);
2347 		kmem_free(errmsg1, len1);
2348 	}
2349 	if (errmsg2 != NULL) {
2350 		uprintf(errmsg2);
2351 		kmem_free(errmsg2, len2);
2352 	}
2353 	return (error);
2354 }
2355 
2356 /*ARGSUSED*/
2357 static int
2358 ufs_access(struct vnode *vp, int mode, int flags, struct cred *cr)
2359 {
2360 	struct inode *ip = VTOI(vp);
2361 	int error;
2362 
2363 	if (ip->i_ufsvfs == NULL)
2364 		return (EIO);
2365 
2366 	rw_enter(&ip->i_contents, RW_READER);
2367 
2368 	/*
2369 	 * The ufs_iaccess function wants to be called with
2370 	 * mode bits expressed as "ufs specific" bits.
2371 	 * I.e., VWRITE|VREAD|VEXEC do not make sense to
2372 	 * ufs_iaccess() but IWRITE|IREAD|IEXEC do.
2373 	 * But since they're the same we just pass the vnode mode
2374 	 * bit but just verify that assumption at compile time.
2375 	 */
2376 #if IWRITE != VWRITE || IREAD != VREAD || IEXEC != VEXEC
2377 #error "ufs_access needs to map Vmodes to Imodes"
2378 #endif
2379 	error = ufs_iaccess(ip, mode, cr);
2380 
2381 	rw_exit(&ip->i_contents);
2382 
2383 	return (error);
2384 }
2385 
2386 /* ARGSUSED */
2387 static int
2388 ufs_readlink(struct vnode *vp, struct uio *uiop, struct cred *cr)
2389 {
2390 	struct inode *ip = VTOI(vp);
2391 	struct ufsvfs *ufsvfsp;
2392 	struct ulockfs *ulp;
2393 	int error;
2394 	int fastsymlink;
2395 
2396 	if (vp->v_type != VLNK) {
2397 		error = EINVAL;
2398 		goto nolockout;
2399 	}
2400 
2401 	/*
2402 	 * If the symbolic link is empty there is nothing to read.
2403 	 * Fast-track these empty symbolic links
2404 	 */
2405 	if (ip->i_size == 0) {
2406 		error = 0;
2407 		goto nolockout;
2408 	}
2409 
2410 	ufsvfsp = ip->i_ufsvfs;
2411 	error = ufs_lockfs_begin(ufsvfsp, &ulp, ULOCKFS_READLINK_MASK);
2412 	if (error)
2413 		goto nolockout;
2414 	/*
2415 	 * The ip->i_rwlock protects the data blocks used for FASTSYMLINK
2416 	 */
2417 again:
2418 	fastsymlink = 0;
2419 	if (ip->i_flag & IFASTSYMLNK) {
2420 		rw_enter(&ip->i_rwlock, RW_READER);
2421 		rw_enter(&ip->i_contents, RW_READER);
2422 		if (ip->i_flag & IFASTSYMLNK) {
2423 			if (!ULOCKFS_IS_NOIACC(ITOUL(ip)) &&
2424 			    (ip->i_fs->fs_ronly == 0) &&
2425 			    (!ufsvfsp->vfs_noatime)) {
2426 				mutex_enter(&ip->i_tlock);
2427 				ip->i_flag |= IACC;
2428 				mutex_exit(&ip->i_tlock);
2429 			}
2430 			error = uiomove((caddr_t)&ip->i_db[1],
2431 			    MIN(ip->i_size, uiop->uio_resid),
2432 			    UIO_READ, uiop);
2433 			ITIMES(ip);
2434 			++fastsymlink;
2435 		}
2436 		rw_exit(&ip->i_contents);
2437 		rw_exit(&ip->i_rwlock);
2438 	}
2439 	if (!fastsymlink) {
2440 		ssize_t size;	/* number of bytes read  */
2441 		caddr_t basep;	/* pointer to input data */
2442 		ino_t ino;
2443 		long  igen;
2444 		struct uio tuio;	/* temp uio struct */
2445 		struct uio *tuiop;
2446 		iovec_t tiov;		/* temp iovec struct */
2447 		char kbuf[FSL_SIZE];	/* buffer to hold fast symlink */
2448 		int tflag = 0;		/* flag to indicate temp vars used */
2449 
2450 		ino = ip->i_number;
2451 		igen = ip->i_gen;
2452 		size = uiop->uio_resid;
2453 		basep = uiop->uio_iov->iov_base;
2454 		tuiop = uiop;
2455 
2456 		rw_enter(&ip->i_rwlock, RW_WRITER);
2457 		rw_enter(&ip->i_contents, RW_WRITER);
2458 		if (ip->i_flag & IFASTSYMLNK) {
2459 			rw_exit(&ip->i_contents);
2460 			rw_exit(&ip->i_rwlock);
2461 			goto again;
2462 		}
2463 
2464 		/* can this be a fast symlink and is it a user buffer? */
2465 		if (ip->i_size <= FSL_SIZE &&
2466 		    (uiop->uio_segflg == UIO_USERSPACE ||
2467 		    uiop->uio_segflg == UIO_USERISPACE)) {
2468 
2469 			bzero(&tuio, sizeof (struct uio));
2470 			/*
2471 			 * setup a kernel buffer to read link into.  this
2472 			 * is to fix a race condition where the user buffer
2473 			 * got corrupted before copying it into the inode.
2474 			 */
2475 			size = ip->i_size;
2476 			tiov.iov_len = size;
2477 			tiov.iov_base = kbuf;
2478 			tuio.uio_iov = &tiov;
2479 			tuio.uio_iovcnt = 1;
2480 			tuio.uio_offset = uiop->uio_offset;
2481 			tuio.uio_segflg = UIO_SYSSPACE;
2482 			tuio.uio_fmode = uiop->uio_fmode;
2483 			tuio.uio_extflg = uiop->uio_extflg;
2484 			tuio.uio_limit = uiop->uio_limit;
2485 			tuio.uio_resid = size;
2486 
2487 			basep = tuio.uio_iov->iov_base;
2488 			tuiop = &tuio;
2489 			tflag = 1;
2490 		}
2491 
2492 		error = rdip(ip, tuiop, 0, cr);
2493 		if (!(error == 0 && ip->i_number == ino && ip->i_gen == igen)) {
2494 			rw_exit(&ip->i_contents);
2495 			rw_exit(&ip->i_rwlock);
2496 			goto out;
2497 		}
2498 
2499 		if (tflag == 0)
2500 			size -= uiop->uio_resid;
2501 
2502 		if ((tflag == 0 && ip->i_size <= FSL_SIZE &&
2503 		    ip->i_size == size) || (tflag == 1 &&
2504 		    tuio.uio_resid == 0)) {
2505 			error = kcopy(basep, &ip->i_db[1], ip->i_size);
2506 			if (error == 0) {
2507 				ip->i_flag |= IFASTSYMLNK;
2508 				/*
2509 				 * free page
2510 				 */
2511 				(void) VOP_PUTPAGE(ITOV(ip),
2512 				    (offset_t)0, PAGESIZE,
2513 				    (B_DONTNEED | B_FREE | B_FORCE | B_ASYNC),
2514 				    cr);
2515 			} else {
2516 				int i;
2517 				/* error, clear garbage left behind */
2518 				for (i = 1; i < NDADDR; i++)
2519 					ip->i_db[i] = 0;
2520 				for (i = 0; i < NIADDR; i++)
2521 					ip->i_ib[i] = 0;
2522 			}
2523 		}
2524 		if (tflag == 1) {
2525 			/* now, copy it into the user buffer */
2526 			error = uiomove((caddr_t)kbuf,
2527 			    MIN(size, uiop->uio_resid),
2528 			    UIO_READ, uiop);
2529 		}
2530 		rw_exit(&ip->i_contents);
2531 		rw_exit(&ip->i_rwlock);
2532 	}
2533 out:
2534 	if (ulp) {
2535 		ufs_lockfs_end(ulp);
2536 	}
2537 nolockout:
2538 	return (error);
2539 }
2540 
2541 /* ARGSUSED */
2542 static int
2543 ufs_fsync(struct vnode *vp, int syncflag, struct cred *cr)
2544 {
2545 	struct inode *ip = VTOI(vp);
2546 	struct ufsvfs *ufsvfsp = ip->i_ufsvfs;
2547 	struct ulockfs *ulp;
2548 	int error;
2549 
2550 	error = ufs_lockfs_begin(ufsvfsp, &ulp, ULOCKFS_FSYNC_MASK);
2551 	if (error)
2552 		return (error);
2553 
2554 	if (TRANS_ISTRANS(ufsvfsp)) {
2555 		/*
2556 		 * First push out any data pages
2557 		 */
2558 		if (vn_has_cached_data(vp) && !(syncflag & FNODSYNC) &&
2559 		    (vp->v_type != VCHR) && !(IS_SWAPVP(vp))) {
2560 			error = VOP_PUTPAGE(vp, (offset_t)0, (size_t)0,
2561 			    0, CRED());
2562 			if (error)
2563 				goto out;
2564 		}
2565 
2566 		/*
2567 		 * Delta any delayed inode times updates
2568 		 * and push inode to log.
2569 		 * All other inode deltas will have already been delta'd
2570 		 * and will be pushed during the commit.
2571 		 */
2572 		if (!(syncflag & FDSYNC) &&
2573 		    ((ip->i_flag & (IMOD|IMODACC)) == IMODACC)) {
2574 			if (ulp) {
2575 				TRANS_BEGIN_ASYNC(ufsvfsp, TOP_FSYNC,
2576 				    TOP_SYNCIP_SIZE);
2577 			}
2578 			rw_enter(&ip->i_contents, RW_READER);
2579 			mutex_enter(&ip->i_tlock);
2580 			ip->i_flag &= ~IMODTIME;
2581 			mutex_exit(&ip->i_tlock);
2582 			ufs_iupdat(ip, I_SYNC);
2583 			rw_exit(&ip->i_contents);
2584 			if (ulp) {
2585 				TRANS_END_ASYNC(ufsvfsp, TOP_FSYNC,
2586 				    TOP_SYNCIP_SIZE);
2587 			}
2588 		}
2589 
2590 		/*
2591 		 * Commit the Moby transaction
2592 		 *
2593 		 * Deltas have already been made so we just need to
2594 		 * commit them with a synchronous transaction.
2595 		 * TRANS_BEGIN_SYNC() will return an error
2596 		 * if there are no deltas to commit, for an
2597 		 * empty transaction.
2598 		 */
2599 		if (ulp) {
2600 			TRANS_BEGIN_SYNC(ufsvfsp, TOP_FSYNC, TOP_COMMIT_SIZE,
2601 			    error);
2602 			if (error) {
2603 				error = 0; /* commit wasn't needed */
2604 				goto out;
2605 			}
2606 			TRANS_END_SYNC(ufsvfsp, error, TOP_FSYNC,
2607 			    TOP_COMMIT_SIZE);
2608 		}
2609 	} else {	/* not logging */
2610 		if (!(IS_SWAPVP(vp)))
2611 			if (syncflag & FNODSYNC) {
2612 				/* Just update the inode only */
2613 				TRANS_IUPDAT(ip, 1);
2614 				error = 0;
2615 			} else if (syncflag & FDSYNC)
2616 				/* Do data-synchronous writes */
2617 				error = TRANS_SYNCIP(ip, 0, I_DSYNC, TOP_FSYNC);
2618 			else
2619 				/* Do synchronous writes */
2620 				error = TRANS_SYNCIP(ip, 0, I_SYNC, TOP_FSYNC);
2621 
2622 		rw_enter(&ip->i_contents, RW_WRITER);
2623 		if (!error)
2624 			error = ufs_sync_indir(ip);
2625 		rw_exit(&ip->i_contents);
2626 	}
2627 out:
2628 	if (ulp) {
2629 		ufs_lockfs_end(ulp);
2630 	}
2631 	return (error);
2632 }
2633 
2634 /*ARGSUSED*/
2635 static void
2636 ufs_inactive(struct vnode *vp, struct cred *cr)
2637 {
2638 	ufs_iinactive(VTOI(vp));
2639 }
2640 
2641 /*
2642  * Unix file system operations having to do with directory manipulation.
2643  */
2644 int ufs_lookup_idle_count = 2;	/* Number of inodes to idle each time */
2645 /* ARGSUSED */
2646 static int
2647 ufs_lookup(struct vnode *dvp, char *nm, struct vnode **vpp,
2648 	struct pathname *pnp, int flags, struct vnode *rdir, struct cred *cr)
2649 {
2650 	struct inode *ip;
2651 	struct inode *sip;
2652 	struct inode *xip;
2653 	struct ufsvfs *ufsvfsp;
2654 	struct ulockfs *ulp;
2655 	struct vnode *vp;
2656 	int error;
2657 
2658 	/*
2659 	 * Check flags for type of lookup (regular file or attribute file)
2660 	 */
2661 
2662 	ip = VTOI(dvp);
2663 
2664 	if (flags & LOOKUP_XATTR) {
2665 
2666 		/*
2667 		 * We don't allow recursive attributes...
2668 		 * Maybe someday we will.
2669 		 */
2670 		if ((ip->i_cflags & IXATTR)) {
2671 			return (EINVAL);
2672 		}
2673 
2674 		if ((vp = dnlc_lookup(dvp, XATTR_DIR_NAME)) == NULL) {
2675 			error = ufs_xattr_getattrdir(dvp, &sip, flags, cr);
2676 			if (error) {
2677 				*vpp = NULL;
2678 				goto out;
2679 			}
2680 
2681 			vp = ITOV(sip);
2682 			dnlc_update(dvp, XATTR_DIR_NAME, vp);
2683 		}
2684 
2685 		/*
2686 		 * Check accessibility of directory.
2687 		 */
2688 		if (vp == DNLC_NO_VNODE) {
2689 			VN_RELE(vp);
2690 			error = ENOENT;
2691 			goto out;
2692 		}
2693 		if ((error = ufs_iaccess(VTOI(vp), IEXEC, cr)) != 0) {
2694 			VN_RELE(vp);
2695 			goto out;
2696 		}
2697 
2698 		*vpp = vp;
2699 		return (0);
2700 	}
2701 
2702 	/*
2703 	 * Check for a null component, which we should treat as
2704 	 * looking at dvp from within it's parent, so we don't
2705 	 * need a call to ufs_iaccess(), as it has already been
2706 	 * done.
2707 	 */
2708 	if (nm[0] == 0) {
2709 		VN_HOLD(dvp);
2710 		error = 0;
2711 		*vpp = dvp;
2712 		goto out;
2713 	}
2714 
2715 	/*
2716 	 * Check for "." ie itself. this is a quick check and
2717 	 * avoids adding "." into the dnlc (which have been seen
2718 	 * to occupy >10% of the cache).
2719 	 */
2720 	if ((nm[0] == '.') && (nm[1] == 0)) {
2721 		/*
2722 		 * Don't return without checking accessibility
2723 		 * of the directory. We only need the lock if
2724 		 * we are going to return it.
2725 		 */
2726 		if ((error = ufs_iaccess(ip, IEXEC, cr)) == 0) {
2727 			VN_HOLD(dvp);
2728 			*vpp = dvp;
2729 		}
2730 		goto out;
2731 	}
2732 
2733 	/*
2734 	 * Fast path: Check the directory name lookup cache.
2735 	 */
2736 	if (vp = dnlc_lookup(dvp, nm)) {
2737 		/*
2738 		 * Check accessibility of directory.
2739 		 */
2740 		if ((error = ufs_iaccess(ip, IEXEC, cr)) != 0) {
2741 			VN_RELE(vp);
2742 			goto out;
2743 		}
2744 		if (vp == DNLC_NO_VNODE) {
2745 			VN_RELE(vp);
2746 			error = ENOENT;
2747 			goto out;
2748 		}
2749 		xip = VTOI(vp);
2750 		ulp = NULL;
2751 		goto fastpath;
2752 	}
2753 
2754 	/*
2755 	 * Keep the idle queue from getting too long by
2756 	 * idling two inodes before attempting to allocate another.
2757 	 *    This operation must be performed before entering
2758 	 *    lockfs or a transaction.
2759 	 */
2760 	if (ufs_idle_q.uq_ne > ufs_idle_q.uq_hiwat)
2761 		if ((curthread->t_flag & T_DONTBLOCK) == 0) {
2762 			ins.in_lidles.value.ul += ufs_lookup_idle_count;
2763 			ufs_idle_some(ufs_lookup_idle_count);
2764 		}
2765 
2766 retry_lookup:
2767 	ufsvfsp = ip->i_ufsvfs;
2768 	error = ufs_lockfs_begin(ufsvfsp, &ulp, ULOCKFS_LOOKUP_MASK);
2769 	if (error)
2770 		goto out;
2771 
2772 	error = ufs_dirlook(ip, nm, &xip, cr, 1);
2773 
2774 fastpath:
2775 	if (error == 0) {
2776 		ip = xip;
2777 		*vpp = ITOV(ip);
2778 
2779 		/*
2780 		 * If vnode is a device return special vnode instead.
2781 		 */
2782 		if (IS_DEVVP(*vpp)) {
2783 			struct vnode *newvp;
2784 
2785 			newvp = specvp(*vpp, (*vpp)->v_rdev, (*vpp)->v_type,
2786 			    cr);
2787 			VN_RELE(*vpp);
2788 			if (newvp == NULL)
2789 				error = ENOSYS;
2790 			else
2791 				*vpp = newvp;
2792 		}
2793 	}
2794 	if (ulp) {
2795 		ufs_lockfs_end(ulp);
2796 	}
2797 
2798 	if (error == EAGAIN)
2799 		goto retry_lookup;
2800 
2801 out:
2802 	return (error);
2803 }
2804 
2805 static int
2806 ufs_create(struct vnode *dvp, char *name, struct vattr *vap, enum vcexcl excl,
2807 	int mode, struct vnode **vpp, struct cred *cr, int flag)
2808 {
2809 	struct inode *ip;
2810 	struct inode *xip;
2811 	struct inode *dip;
2812 	struct vnode *xvp;
2813 	struct ufsvfs *ufsvfsp;
2814 	struct ulockfs *ulp;
2815 	int error;
2816 	int issync;
2817 	int truncflag;
2818 	int trans_size;
2819 	int noentry;
2820 	int defer_dip_seq_update = 0;	/* need to defer update of dip->i_seq */
2821 	int retry = 1;
2822 	int indeadlock;
2823 
2824 again:
2825 	ip = VTOI(dvp);
2826 	ufsvfsp = ip->i_ufsvfs;
2827 	truncflag = 0;
2828 
2829 	error = ufs_lockfs_begin(ufsvfsp, &ulp, ULOCKFS_CREATE_MASK);
2830 	if (error)
2831 		goto out;
2832 
2833 	if (ulp) {
2834 		trans_size = (int)TOP_CREATE_SIZE(ip);
2835 		TRANS_BEGIN_CSYNC(ufsvfsp, issync, TOP_CREATE, trans_size);
2836 	}
2837 
2838 	if ((vap->va_mode & VSVTX) && secpolicy_vnode_stky_modify(cr) != 0)
2839 		vap->va_mode &= ~VSVTX;
2840 
2841 	if (*name == '\0') {
2842 		/*
2843 		 * Null component name refers to the directory itself.
2844 		 */
2845 		VN_HOLD(dvp);
2846 		/*
2847 		 * Even though this is an error case, we need to grab the
2848 		 * quota lock since the error handling code below is common.
2849 		 */
2850 		rw_enter(&ufsvfsp->vfs_dqrwlock, RW_READER);
2851 		rw_enter(&ip->i_contents, RW_WRITER);
2852 		error = EEXIST;
2853 	} else {
2854 		xip = NULL;
2855 		noentry = 0;
2856 		/*
2857 		 * ufs_tryirwlock_trans uses rw_tryenter and checks for SLOCK
2858 		 * to avoid i_rwlock, ufs_lockfs_begin deadlock. If deadlock
2859 		 * possible, retries the operation.
2860 		 */
2861 		ufs_tryirwlock_trans(&ip->i_rwlock, RW_WRITER, TOP_CREATE,
2862 		    retry_dir);
2863 		if (indeadlock)
2864 			goto again;
2865 
2866 		xvp = dnlc_lookup(dvp, name);
2867 		if (xvp == DNLC_NO_VNODE) {
2868 			noentry = 1;
2869 			VN_RELE(xvp);
2870 			xvp = NULL;
2871 		}
2872 		if (xvp) {
2873 			rw_exit(&ip->i_rwlock);
2874 			if (error = ufs_iaccess(ip, IEXEC, cr)) {
2875 				VN_RELE(xvp);
2876 			} else {
2877 				error = EEXIST;
2878 				xip = VTOI(xvp);
2879 			}
2880 		} else {
2881 			/*
2882 			 * Suppress file system full message if we will retry
2883 			 */
2884 			error = ufs_direnter_cm(ip, name, DE_CREATE,
2885 			    vap, &xip, cr, (noentry | (retry ? IQUIET : 0)));
2886 			if (error == EAGAIN) {
2887 				if (ulp) {
2888 					TRANS_END_CSYNC(ufsvfsp, error, issync,
2889 					    TOP_CREATE, trans_size);
2890 					ufs_lockfs_end(ulp);
2891 				}
2892 				goto again;
2893 			}
2894 			rw_exit(&ip->i_rwlock);
2895 		}
2896 		ip = xip;
2897 		if (ip != NULL) {
2898 			rw_enter(&ufsvfsp->vfs_dqrwlock, RW_READER);
2899 			rw_enter(&ip->i_contents, RW_WRITER);
2900 		}
2901 	}
2902 
2903 	/*
2904 	 * If the file already exists and this is a non-exclusive create,
2905 	 * check permissions and allow access for non-directories.
2906 	 * Read-only create of an existing directory is also allowed.
2907 	 * We fail an exclusive create of anything which already exists.
2908 	 */
2909 	if (error == EEXIST) {
2910 		dip = VTOI(dvp);
2911 		if (excl == NONEXCL) {
2912 			if ((((ip->i_mode & IFMT) == IFDIR) ||
2913 			    ((ip->i_mode & IFMT) == IFATTRDIR)) &&
2914 			    (mode & IWRITE))
2915 				error = EISDIR;
2916 			else if (mode)
2917 				error = ufs_iaccess(ip, mode, cr);
2918 			else
2919 				error = 0;
2920 		}
2921 		if (error) {
2922 			rw_exit(&ip->i_contents);
2923 			rw_exit(&ufsvfsp->vfs_dqrwlock);
2924 			VN_RELE(ITOV(ip));
2925 			goto unlock;
2926 		}
2927 		/*
2928 		 * If the error EEXIST was set, then i_seq can not
2929 		 * have been updated. The sequence number interface
2930 		 * is defined such that a non-error VOP_CREATE must
2931 		 * increase the dir va_seq it by at least one. If we
2932 		 * have cleared the error, increase i_seq. Note that
2933 		 * we are increasing the dir i_seq and in rare cases
2934 		 * ip may actually be from the dvp, so we already have
2935 		 * the locks and it will not be subject to truncation.
2936 		 * In case we have to update i_seq of the parent
2937 		 * directory dip, we have to defer it till we have
2938 		 * released our locks on ip due to lock ordering requirements.
2939 		 */
2940 		if (ip != dip)
2941 			defer_dip_seq_update = 1;
2942 		else
2943 			ip->i_seq++;
2944 
2945 		if (((ip->i_mode & IFMT) == IFREG) &&
2946 		    (vap->va_mask & AT_SIZE) && vap->va_size == 0) {
2947 			/*
2948 			 * Truncate regular files, if requested by caller.
2949 			 * Grab i_rwlock to make sure no one else is
2950 			 * currently writing to the file (we promised
2951 			 * bmap we would do this).
2952 			 * Must get the locks in the correct order.
2953 			 */
2954 			if (ip->i_size == 0) {
2955 				ip->i_flag |= ICHG | IUPD;
2956 				ip->i_seq++;
2957 				TRANS_INODE(ufsvfsp, ip);
2958 			} else {
2959 				/*
2960 				 * Large Files: Why this check here?
2961 				 * Though we do it in vn_create() we really
2962 				 * want to guarantee that we do not destroy
2963 				 * Large file data by atomically checking
2964 				 * the size while holding the contents
2965 				 * lock.
2966 				 */
2967 				if (flag && !(flag & FOFFMAX) &&
2968 				    ((ip->i_mode & IFMT) == IFREG) &&
2969 				    (ip->i_size > (offset_t)MAXOFF32_T)) {
2970 					rw_exit(&ip->i_contents);
2971 					rw_exit(&ufsvfsp->vfs_dqrwlock);
2972 					error = EOVERFLOW;
2973 					goto unlock;
2974 				}
2975 				if (TRANS_ISTRANS(ufsvfsp))
2976 					truncflag++;
2977 				else {
2978 					rw_exit(&ip->i_contents);
2979 					rw_exit(&ufsvfsp->vfs_dqrwlock);
2980 					ufs_tryirwlock_trans(&ip->i_rwlock,
2981 					    RW_WRITER, TOP_CREATE,
2982 					    retry_file);
2983 					if (indeadlock) {
2984 						VN_RELE(ITOV(ip));
2985 						goto again;
2986 					}
2987 					rw_enter(&ufsvfsp->vfs_dqrwlock,
2988 					    RW_READER);
2989 					rw_enter(&ip->i_contents, RW_WRITER);
2990 					(void) ufs_itrunc(ip, (u_offset_t)0, 0,
2991 					    cr);
2992 					rw_exit(&ip->i_rwlock);
2993 				}
2994 
2995 			}
2996 			if (error == 0) {
2997 				vnevent_create(ITOV(ip));
2998 			}
2999 		}
3000 	}
3001 
3002 	if (error) {
3003 		if (ip != NULL) {
3004 			rw_exit(&ufsvfsp->vfs_dqrwlock);
3005 			rw_exit(&ip->i_contents);
3006 		}
3007 		goto unlock;
3008 	}
3009 
3010 	*vpp = ITOV(ip);
3011 	ITIMES(ip);
3012 	rw_exit(&ip->i_contents);
3013 	rw_exit(&ufsvfsp->vfs_dqrwlock);
3014 
3015 	/*
3016 	 * If vnode is a device return special vnode instead.
3017 	 */
3018 	if (!error && IS_DEVVP(*vpp)) {
3019 		struct vnode *newvp;
3020 
3021 		newvp = specvp(*vpp, (*vpp)->v_rdev, (*vpp)->v_type, cr);
3022 		VN_RELE(*vpp);
3023 		if (newvp == NULL) {
3024 			error = ENOSYS;
3025 			goto unlock;
3026 		}
3027 		truncflag = 0;
3028 		*vpp = newvp;
3029 	}
3030 unlock:
3031 
3032 	/*
3033 	 * Do the deferred update of the parent directory's sequence
3034 	 * number now.
3035 	 */
3036 	if (defer_dip_seq_update == 1) {
3037 		rw_enter(&dip->i_contents, RW_READER);
3038 		mutex_enter(&dip->i_tlock);
3039 		dip->i_seq++;
3040 		mutex_exit(&dip->i_tlock);
3041 		rw_exit(&dip->i_contents);
3042 	}
3043 
3044 	if (ulp) {
3045 		int terr = 0;
3046 
3047 		TRANS_END_CSYNC(ufsvfsp, terr, issync, TOP_CREATE,
3048 		    trans_size);
3049 
3050 		/*
3051 		 * If we haven't had a more interesting failure
3052 		 * already, then anything that might've happened
3053 		 * here should be reported.
3054 		 */
3055 		if (error == 0)
3056 			error = terr;
3057 	}
3058 
3059 	if (!error && truncflag) {
3060 		ufs_tryirwlock(&ip->i_rwlock, RW_WRITER, retry_trunc);
3061 		if (indeadlock) {
3062 			if (ulp)
3063 				ufs_lockfs_end(ulp);
3064 			VN_RELE(ITOV(ip));
3065 			goto again;
3066 		}
3067 		(void) TRANS_ITRUNC(ip, (u_offset_t)0, 0, cr);
3068 		rw_exit(&ip->i_rwlock);
3069 	}
3070 
3071 	if (ulp)
3072 		ufs_lockfs_end(ulp);
3073 
3074 	/*
3075 	 * If no inodes available, try to free one up out of the
3076 	 * pending delete queue.
3077 	 */
3078 	if ((error == ENOSPC) && retry && TRANS_ISTRANS(ufsvfsp)) {
3079 		ufs_delete_drain_wait(ufsvfsp, 1);
3080 		retry = 0;
3081 		goto again;
3082 	}
3083 
3084 out:
3085 	return (error);
3086 }
3087 
3088 extern int ufs_idle_max;
3089 /*ARGSUSED*/
3090 static int
3091 ufs_remove(struct vnode *vp, char *nm, struct cred *cr)
3092 {
3093 	struct inode *ip = VTOI(vp);
3094 	struct ufsvfs *ufsvfsp	= ip->i_ufsvfs;
3095 	struct ulockfs *ulp;
3096 	vnode_t *rmvp = NULL;	/* Vnode corresponding to name being removed */
3097 	int indeadlock;
3098 	int error;
3099 	int issync;
3100 	int trans_size;
3101 
3102 	/*
3103 	 * don't let the delete queue get too long
3104 	 */
3105 	if (ufsvfsp == NULL) {
3106 		error = EIO;
3107 		goto out;
3108 	}
3109 	if (ufsvfsp->vfs_delete.uq_ne > ufs_idle_max)
3110 		ufs_delete_drain(vp->v_vfsp, 1, 1);
3111 
3112 retry_remove:
3113 	error = ufs_lockfs_begin(ufsvfsp, &ulp, ULOCKFS_REMOVE_MASK);
3114 	if (error)
3115 		goto out;
3116 
3117 	if (ulp)
3118 		TRANS_BEGIN_CSYNC(ufsvfsp, issync, TOP_REMOVE,
3119 		    trans_size = (int)TOP_REMOVE_SIZE(VTOI(vp)));
3120 
3121 	/*
3122 	 * ufs_tryirwlock_trans uses rw_tryenter and checks for SLOCK
3123 	 * to avoid i_rwlock, ufs_lockfs_begin deadlock. If deadlock
3124 	 * possible, retries the operation.
3125 	 */
3126 	ufs_tryirwlock_trans(&ip->i_rwlock, RW_WRITER, TOP_REMOVE, retry);
3127 	if (indeadlock)
3128 		goto retry_remove;
3129 	error = ufs_dirremove(ip, nm, (struct inode *)0, (struct vnode *)0,
3130 	    DR_REMOVE, cr, &rmvp);
3131 	rw_exit(&ip->i_rwlock);
3132 
3133 	if (ulp) {
3134 		TRANS_END_CSYNC(ufsvfsp, error, issync, TOP_REMOVE, trans_size);
3135 		ufs_lockfs_end(ulp);
3136 	}
3137 
3138 	/*
3139 	 * This must be called after the remove transaction is closed.
3140 	 */
3141 	if (rmvp != NULL) {
3142 		/* Only send the event if there were no errors */
3143 		if (error == 0)
3144 			vnevent_remove(rmvp, vp, nm);
3145 		VN_RELE(rmvp);
3146 	}
3147 out:
3148 	return (error);
3149 }
3150 
3151 /*
3152  * Link a file or a directory.  Only privileged processes are allowed to
3153  * make links to directories.
3154  */
3155 static int
3156 ufs_link(struct vnode *tdvp, struct vnode *svp, char *tnm, struct cred *cr)
3157 {
3158 	struct inode *sip;
3159 	struct inode *tdp = VTOI(tdvp);
3160 	struct ufsvfs *ufsvfsp = tdp->i_ufsvfs;
3161 	struct ulockfs *ulp;
3162 	struct vnode *realvp;
3163 	int error;
3164 	int issync;
3165 	int trans_size;
3166 	int isdev;
3167 	int indeadlock;
3168 
3169 retry_link:
3170 	error = ufs_lockfs_begin(ufsvfsp, &ulp, ULOCKFS_LINK_MASK);
3171 	if (error)
3172 		goto out;
3173 
3174 	if (ulp)
3175 		TRANS_BEGIN_CSYNC(ufsvfsp, issync, TOP_LINK,
3176 		    trans_size = (int)TOP_LINK_SIZE(VTOI(tdvp)));
3177 
3178 	if (VOP_REALVP(svp, &realvp) == 0)
3179 		svp = realvp;
3180 
3181 	/*
3182 	 * Make sure link for extended attributes is valid
3183 	 * We only support hard linking of attr in ATTRDIR to ATTRDIR
3184 	 *
3185 	 * Make certain we don't attempt to look at a device node as
3186 	 * a ufs inode.
3187 	 */
3188 
3189 	isdev = IS_DEVVP(svp);
3190 	if (((isdev == 0) && ((VTOI(svp)->i_cflags & IXATTR) == 0) &&
3191 	    ((tdp->i_mode & IFMT) == IFATTRDIR)) ||
3192 	    ((isdev == 0) && (VTOI(svp)->i_cflags & IXATTR) &&
3193 	    ((tdp->i_mode & IFMT) == IFDIR))) {
3194 		error = EINVAL;
3195 		goto unlock;
3196 	}
3197 
3198 	sip = VTOI(svp);
3199 	if ((svp->v_type == VDIR &&
3200 	    secpolicy_fs_linkdir(cr, ufsvfsp->vfs_vfs) != 0) ||
3201 	    (sip->i_uid != crgetuid(cr) && secpolicy_basic_link(cr) != 0)) {
3202 		error = EPERM;
3203 		goto unlock;
3204 	}
3205 
3206 	/*
3207 	 * ufs_tryirwlock_trans uses rw_tryenter and checks for SLOCK
3208 	 * to avoid i_rwlock, ufs_lockfs_begin deadlock. If deadlock
3209 	 * possible, retries the operation.
3210 	 */
3211 	ufs_tryirwlock_trans(&tdp->i_rwlock, RW_WRITER, TOP_LINK, retry);
3212 	if (indeadlock)
3213 		goto retry_link;
3214 	error = ufs_direnter_lr(tdp, tnm, DE_LINK, (struct inode *)0,
3215 	    sip, cr, NULL);
3216 	rw_exit(&tdp->i_rwlock);
3217 
3218 unlock:
3219 	if (ulp) {
3220 		TRANS_END_CSYNC(ufsvfsp, error, issync, TOP_LINK, trans_size);
3221 		ufs_lockfs_end(ulp);
3222 	}
3223 
3224 	if (!error) {
3225 		vnevent_link(svp);
3226 	}
3227 out:
3228 	return (error);
3229 }
3230 
3231 uint64_t ufs_rename_retry_cnt;
3232 uint64_t ufs_rename_upgrade_retry_cnt;
3233 uint64_t ufs_rename_dircheck_retry_cnt;
3234 clock_t	 ufs_rename_backoff_delay = 1;
3235 
3236 /*
3237  * Rename a file or directory.
3238  * We are given the vnode and entry string of the source and the
3239  * vnode and entry string of the place we want to move the source
3240  * to (the target). The essential operation is:
3241  *	unlink(target);
3242  *	link(source, target);
3243  *	unlink(source);
3244  * but "atomically".  Can't do full commit without saving state in
3245  * the inode on disk, which isn't feasible at this time.  Best we
3246  * can do is always guarantee that the TARGET exists.
3247  */
3248 
3249 /*ARGSUSED*/
3250 static int
3251 ufs_rename(
3252 	struct vnode *sdvp,		/* old (source) parent vnode */
3253 	char *snm,			/* old (source) entry name */
3254 	struct vnode *tdvp,		/* new (target) parent vnode */
3255 	char *tnm,			/* new (target) entry name */
3256 	struct cred *cr)
3257 {
3258 	struct inode *sip = NULL;	/* source inode */
3259 	struct inode *ip = NULL;	/* check inode */
3260 	struct inode *sdp;		/* old (source) parent inode */
3261 	struct inode *tdp;		/* new (target) parent inode */
3262 	struct vnode *tvp = NULL;	/* target vnode, if it exists */
3263 	struct vnode *realvp;
3264 	struct ufsvfs *ufsvfsp;
3265 	struct ulockfs *ulp;
3266 	struct ufs_slot slot;
3267 	timestruc_t now;
3268 	int error;
3269 	int issync;
3270 	int trans_size;
3271 	krwlock_t *first_lock;
3272 	krwlock_t *second_lock;
3273 	krwlock_t *reverse_lock;
3274 
3275 	sdp = VTOI(sdvp);
3276 	slot.fbp = NULL;
3277 	ufsvfsp = sdp->i_ufsvfs;
3278 retry_rename:
3279 	error = ufs_lockfs_begin(ufsvfsp, &ulp, ULOCKFS_RENAME_MASK);
3280 	if (error)
3281 		goto out;
3282 
3283 	if (ulp)
3284 		TRANS_BEGIN_CSYNC(ufsvfsp, issync, TOP_RENAME,
3285 		    trans_size = (int)TOP_RENAME_SIZE(sdp));
3286 
3287 	if (VOP_REALVP(tdvp, &realvp) == 0)
3288 		tdvp = realvp;
3289 
3290 	tdp = VTOI(tdvp);
3291 
3292 
3293 	/*
3294 	 * We only allow renaming of attributes from ATTRDIR to ATTRDIR.
3295 	 */
3296 	if ((tdp->i_mode & IFMT) != (sdp->i_mode & IFMT)) {
3297 		error = EINVAL;
3298 		goto unlock;
3299 	}
3300 
3301 	/*
3302 	 * Look up inode of file we're supposed to rename.
3303 	 */
3304 	gethrestime(&now);
3305 	if (error = ufs_dirlook(sdp, snm, &sip, cr, 0)) {
3306 		if (error == EAGAIN) {
3307 			if (ulp) {
3308 				TRANS_END_CSYNC(ufsvfsp, error, issync,
3309 				    TOP_RENAME, trans_size);
3310 				ufs_lockfs_end(ulp);
3311 			}
3312 			goto retry_rename;
3313 		}
3314 
3315 		goto unlock;
3316 	}
3317 
3318 	/*
3319 	 * Lock both the source and target directories (they may be
3320 	 * the same) to provide the atomicity semantics that was
3321 	 * previously provided by the per file system vfs_rename_lock
3322 	 *
3323 	 * with vfs_rename_lock removed to allow simultaneous renames
3324 	 * within a file system, ufs_dircheckpath can deadlock while
3325 	 * traversing back to ensure that source is not a parent directory
3326 	 * of target parent directory. This is because we get into
3327 	 * ufs_dircheckpath with the sdp and tdp locks held as RW_WRITER.
3328 	 * If the tdp and sdp of the simultaneous renames happen to be
3329 	 * in the path of each other, it can lead to a deadlock. This
3330 	 * can be avoided by getting the locks as RW_READER here and then
3331 	 * upgrading to RW_WRITER after completing the ufs_dircheckpath.
3332 	 *
3333 	 * We hold the target directory's i_rwlock after calling
3334 	 * ufs_lockfs_begin but in many other operations (like ufs_readdir)
3335 	 * VOP_RWLOCK is explicitly called by the filesystem independent code
3336 	 * before calling the file system operation. In these cases the order
3337 	 * is reversed (i.e i_rwlock is taken first and then ufs_lockfs_begin
3338 	 * is called). This is fine as long as ufs_lockfs_begin acts as a VOP
3339 	 * counter but with ufs_quiesce setting the SLOCK bit this becomes a
3340 	 * synchronizing object which might lead to a deadlock. So we use
3341 	 * rw_tryenter instead of rw_enter. If we fail to get this lock and
3342 	 * find that SLOCK bit is set, we call ufs_lockfs_end and restart the
3343 	 * operation.
3344 	 */
3345 retry:
3346 	first_lock = &tdp->i_rwlock;
3347 	second_lock = &sdp->i_rwlock;
3348 retry_firstlock:
3349 	if (!rw_tryenter(first_lock, RW_READER)) {
3350 		/*
3351 		 * We didn't get the lock. Check if the SLOCK is set in the
3352 		 * ufsvfs. If yes, we might be in a deadlock. Safer to give up
3353 		 * and wait for SLOCK to be cleared.
3354 		 */
3355 
3356 		if (ulp && ULOCKFS_IS_SLOCK(ulp)) {
3357 			TRANS_END_CSYNC(ufsvfsp, error, issync, TOP_RENAME,
3358 			    trans_size);
3359 			ufs_lockfs_end(ulp);
3360 			goto retry_rename;
3361 
3362 		} else {
3363 			/*
3364 			 * SLOCK isn't set so this is a genuine synchronization
3365 			 * case. Let's try again after giving them a breather.
3366 			 */
3367 			delay(RETRY_LOCK_DELAY);
3368 			goto  retry_firstlock;
3369 		}
3370 	}
3371 	/*
3372 	 * Need to check if the tdp and sdp are same !!!
3373 	 */
3374 	if ((tdp != sdp) && (!rw_tryenter(second_lock, RW_READER))) {
3375 		/*
3376 		 * We didn't get the lock. Check if the SLOCK is set in the
3377 		 * ufsvfs. If yes, we might be in a deadlock. Safer to give up
3378 		 * and wait for SLOCK to be cleared.
3379 		 */
3380 
3381 		rw_exit(first_lock);
3382 		if (ulp && ULOCKFS_IS_SLOCK(ulp)) {
3383 			TRANS_END_CSYNC(ufsvfsp, error, issync, TOP_RENAME,
3384 			    trans_size);
3385 			ufs_lockfs_end(ulp);
3386 			goto retry_rename;
3387 
3388 		} else {
3389 			/*
3390 			 * So we couldn't get the second level peer lock *and*
3391 			 * the SLOCK bit isn't set. Too bad we can be
3392 			 * contentding with someone wanting these locks otherway
3393 			 * round. Reverse the locks in case there is a heavy
3394 			 * contention for the second level lock.
3395 			 */
3396 			reverse_lock = first_lock;
3397 			first_lock = second_lock;
3398 			second_lock = reverse_lock;
3399 			ufs_rename_retry_cnt++;
3400 			goto  retry_firstlock;
3401 		}
3402 	}
3403 
3404 	if (sip == tdp) {
3405 		error = EINVAL;
3406 		goto errout;
3407 	}
3408 	/*
3409 	 * Make sure we can delete the source entry.  This requires
3410 	 * write permission on the containing directory.
3411 	 * Check for sticky directories.
3412 	 */
3413 	rw_enter(&sdp->i_contents, RW_READER);
3414 	rw_enter(&sip->i_contents, RW_READER);
3415 	if ((error = ufs_iaccess(sdp, IWRITE, cr)) != 0 ||
3416 	    (error = ufs_sticky_remove_access(sdp, sip, cr)) != 0) {
3417 		rw_exit(&sip->i_contents);
3418 		rw_exit(&sdp->i_contents);
3419 		goto errout;
3420 	}
3421 
3422 	/*
3423 	 * If this is a rename of a directory and the parent is
3424 	 * different (".." must be changed), then the source
3425 	 * directory must not be in the directory hierarchy
3426 	 * above the target, as this would orphan everything
3427 	 * below the source directory.  Also the user must have
3428 	 * write permission in the source so as to be able to
3429 	 * change "..".
3430 	 */
3431 	if ((((sip->i_mode & IFMT) == IFDIR) ||
3432 	    ((sip->i_mode & IFMT) == IFATTRDIR)) && sdp != tdp) {
3433 		ino_t	inum;
3434 
3435 		if ((error = ufs_iaccess(sip, IWRITE, cr))) {
3436 			rw_exit(&sip->i_contents);
3437 			rw_exit(&sdp->i_contents);
3438 			goto errout;
3439 		}
3440 		inum = sip->i_number;
3441 		rw_exit(&sip->i_contents);
3442 		rw_exit(&sdp->i_contents);
3443 		if ((error = ufs_dircheckpath(inum, tdp, sdp, cr))) {
3444 			/*
3445 			 * If we got EAGAIN ufs_dircheckpath detected a
3446 			 * potential deadlock and backed out. We need
3447 			 * to retry the operation since sdp and tdp have
3448 			 * to be released to avoid the deadlock.
3449 			 */
3450 			if (error == EAGAIN) {
3451 				rw_exit(&tdp->i_rwlock);
3452 				if (tdp != sdp)
3453 					rw_exit(&sdp->i_rwlock);
3454 				delay(ufs_rename_backoff_delay);
3455 				ufs_rename_dircheck_retry_cnt++;
3456 				goto retry;
3457 			}
3458 			goto errout;
3459 		}
3460 	} else {
3461 		rw_exit(&sip->i_contents);
3462 		rw_exit(&sdp->i_contents);
3463 	}
3464 
3465 
3466 	/*
3467 	 * Check for renaming '.' or '..' or alias of '.'
3468 	 */
3469 	if (strcmp(snm, ".") == 0 || strcmp(snm, "..") == 0 || sdp == sip) {
3470 		error = EINVAL;
3471 		goto errout;
3472 	}
3473 
3474 	/*
3475 	 * Simultaneous renames can deadlock in ufs_dircheckpath since it
3476 	 * tries to traverse back the file tree with both tdp and sdp held
3477 	 * as RW_WRITER. To avoid that we have to hold the tdp and sdp locks
3478 	 * as RW_READERS  till ufs_dircheckpath is done.
3479 	 * Now that ufs_dircheckpath is done with, we can upgrade the locks
3480 	 * to RW_WRITER.
3481 	 */
3482 	if (!rw_tryupgrade(&tdp->i_rwlock)) {
3483 		/*
3484 		 * The upgrade failed. We got to give away the lock
3485 		 * as to avoid deadlocking with someone else who is
3486 		 * waiting for writer lock. With the lock gone, we
3487 		 * cannot be sure the checks done above will hold
3488 		 * good when we eventually get them back as writer.
3489 		 * So if we can't upgrade we drop the locks and retry
3490 		 * everything again.
3491 		 */
3492 		rw_exit(&tdp->i_rwlock);
3493 		if (tdp != sdp)
3494 			rw_exit(&sdp->i_rwlock);
3495 		delay(ufs_rename_backoff_delay);
3496 		ufs_rename_upgrade_retry_cnt++;
3497 		goto retry;
3498 	}
3499 	if (tdp != sdp) {
3500 		if (!rw_tryupgrade(&sdp->i_rwlock)) {
3501 			/*
3502 			 * The upgrade failed. We got to give away the lock
3503 			 * as to avoid deadlocking with someone else who is
3504 			 * waiting for writer lock. With the lock gone, we
3505 			 * cannot be sure the checks done above will hold
3506 			 * good when we eventually get them back as writer.
3507 			 * So if we can't upgrade we drop the locks and retry
3508 			 * everything again.
3509 			 */
3510 			rw_exit(&tdp->i_rwlock);
3511 			rw_exit(&sdp->i_rwlock);
3512 			delay(ufs_rename_backoff_delay);
3513 			ufs_rename_upgrade_retry_cnt++;
3514 			goto retry;
3515 		}
3516 	}
3517 
3518 	/*
3519 	 * Now that all the locks are held check to make sure another thread
3520 	 * didn't slip in and take out the sip.
3521 	 */
3522 	slot.status = NONE;
3523 	if ((sip->i_ctime.tv_usec * 1000) > now.tv_nsec ||
3524 	    sip->i_ctime.tv_sec > now.tv_sec) {
3525 		rw_enter(&sdp->i_ufsvfs->vfs_dqrwlock, RW_READER);
3526 		rw_enter(&sdp->i_contents, RW_WRITER);
3527 		error = ufs_dircheckforname(sdp, snm, strlen(snm), &slot,
3528 		    &ip, cr, 0);
3529 		rw_exit(&sdp->i_contents);
3530 		rw_exit(&sdp->i_ufsvfs->vfs_dqrwlock);
3531 		if (error) {
3532 			goto errout;
3533 		}
3534 		if (ip == NULL) {
3535 			error = ENOENT;
3536 			goto errout;
3537 		} else {
3538 			/*
3539 			 * If the inode was found need to drop the v_count
3540 			 * so as not to keep the filesystem from being
3541 			 * unmounted at a later time.
3542 			 */
3543 			VN_RELE(ITOV(ip));
3544 		}
3545 
3546 		/*
3547 		 * Release the slot.fbp that has the page mapped and
3548 		 * locked SE_SHARED, and could be used in in
3549 		 * ufs_direnter_lr() which needs to get the SE_EXCL lock
3550 		 * on said page.
3551 		 */
3552 		if (slot.fbp) {
3553 			fbrelse(slot.fbp, S_OTHER);
3554 			slot.fbp = NULL;
3555 		}
3556 	}
3557 
3558 	/*
3559 	 * Link source to the target.  If a target exists, return its
3560 	 * vnode pointer in tvp.  We'll release it after sending the
3561 	 * vnevent.
3562 	 */
3563 	if (error = ufs_direnter_lr(tdp, tnm, DE_RENAME, sdp, sip, cr, &tvp)) {
3564 		/*
3565 		 * ESAME isn't really an error; it indicates that the
3566 		 * operation should not be done because the source and target
3567 		 * are the same file, but that no error should be reported.
3568 		 */
3569 		if (error == ESAME)
3570 			error = 0;
3571 		goto errout;
3572 	}
3573 
3574 	/*
3575 	 * Unlink the source.
3576 	 * Remove the source entry.  ufs_dirremove() checks that the entry
3577 	 * still reflects sip, and returns an error if it doesn't.
3578 	 * If the entry has changed just forget about it.  Release
3579 	 * the source inode.
3580 	 */
3581 	if ((error = ufs_dirremove(sdp, snm, sip, (struct vnode *)0,
3582 	    DR_RENAME, cr, NULL)) == ENOENT)
3583 		error = 0;
3584 
3585 errout:
3586 	if (slot.fbp)
3587 		fbrelse(slot.fbp, S_OTHER);
3588 
3589 	rw_exit(&tdp->i_rwlock);
3590 	if (sdp != tdp) {
3591 		rw_exit(&sdp->i_rwlock);
3592 	}
3593 
3594 unlock:
3595 	if (ulp) {
3596 		TRANS_END_CSYNC(ufsvfsp, error, issync, TOP_RENAME, trans_size);
3597 		ufs_lockfs_end(ulp);
3598 	}
3599 
3600 	/*
3601 	 * If no errors, send the appropriate events on the source
3602 	 * and destination (a.k.a, target) vnodes, if they exist.
3603 	 * This has to be done after the rename transaction has closed.
3604 	 */
3605 	if (error == 0) {
3606 		if (tvp != NULL)
3607 			vnevent_rename_dest(tvp, tdvp, tnm);
3608 
3609 		/*
3610 		 * Notify the target directory of the rename event
3611 		 * if source and target directories are not same.
3612 		 */
3613 		if (sdvp != tdvp)
3614 			vnevent_rename_dest_dir(tdvp);
3615 
3616 		/*
3617 		 * Note that if ufs_direnter_lr() returned ESAME then
3618 		 * this event will still be sent.  This isn't expected
3619 		 * to be a problem for anticipated usage by consumers.
3620 		 */
3621 		if (sip != NULL)
3622 			vnevent_rename_src(ITOV(sip), sdvp, snm);
3623 	}
3624 
3625 	if (tvp != NULL)
3626 		VN_RELE(tvp);
3627 
3628 	if (sip != NULL)
3629 		VN_RELE(ITOV(sip));
3630 
3631 out:
3632 	return (error);
3633 }
3634 
3635 /*ARGSUSED*/
3636 static int
3637 ufs_mkdir(struct vnode *dvp, char *dirname, struct vattr *vap,
3638 	struct vnode **vpp, struct cred *cr)
3639 {
3640 	struct inode *ip;
3641 	struct inode *xip;
3642 	struct ufsvfs *ufsvfsp;
3643 	struct ulockfs *ulp;
3644 	int error;
3645 	int issync;
3646 	int trans_size;
3647 	int indeadlock;
3648 	int retry = 1;
3649 
3650 	ASSERT((vap->va_mask & (AT_TYPE|AT_MODE)) == (AT_TYPE|AT_MODE));
3651 
3652 	/*
3653 	 * Can't make directory in attr hidden dir
3654 	 */
3655 	if ((VTOI(dvp)->i_mode & IFMT) == IFATTRDIR)
3656 		return (EINVAL);
3657 
3658 again:
3659 	ip = VTOI(dvp);
3660 	ufsvfsp = ip->i_ufsvfs;
3661 	error = ufs_lockfs_begin(ufsvfsp, &ulp, ULOCKFS_MKDIR_MASK);
3662 	if (error)
3663 		goto out;
3664 	if (ulp)
3665 		TRANS_BEGIN_CSYNC(ufsvfsp, issync, TOP_MKDIR,
3666 		    trans_size = (int)TOP_MKDIR_SIZE(ip));
3667 
3668 	/*
3669 	 * ufs_tryirwlock_trans uses rw_tryenter and checks for SLOCK
3670 	 * to avoid i_rwlock, ufs_lockfs_begin deadlock. If deadlock
3671 	 * possible, retries the operation.
3672 	 */
3673 	ufs_tryirwlock_trans(&ip->i_rwlock, RW_WRITER, TOP_MKDIR, retry);
3674 	if (indeadlock)
3675 		goto again;
3676 
3677 	error = ufs_direnter_cm(ip, dirname, DE_MKDIR, vap, &xip, cr,
3678 	    (retry ? IQUIET : 0));
3679 	if (error == EAGAIN) {
3680 		if (ulp) {
3681 			TRANS_END_CSYNC(ufsvfsp, error, issync, TOP_MKDIR,
3682 			    trans_size);
3683 			ufs_lockfs_end(ulp);
3684 		}
3685 		goto again;
3686 	}
3687 
3688 	rw_exit(&ip->i_rwlock);
3689 	if (error == 0) {
3690 		ip = xip;
3691 		*vpp = ITOV(ip);
3692 	} else if (error == EEXIST)
3693 		VN_RELE(ITOV(xip));
3694 
3695 	if (ulp) {
3696 		int terr = 0;
3697 		TRANS_END_CSYNC(ufsvfsp, terr, issync, TOP_MKDIR, trans_size);
3698 		ufs_lockfs_end(ulp);
3699 		if (error == 0)
3700 			error = terr;
3701 	}
3702 out:
3703 	if ((error == ENOSPC) && retry && TRANS_ISTRANS(ufsvfsp)) {
3704 		ufs_delete_drain_wait(ufsvfsp, 1);
3705 		retry = 0;
3706 		goto again;
3707 	}
3708 
3709 	return (error);
3710 }
3711 
3712 /*ARGSUSED*/
3713 static int
3714 ufs_rmdir(struct vnode *vp, char *nm, struct vnode *cdir, struct cred *cr)
3715 {
3716 	struct inode *ip = VTOI(vp);
3717 	struct ufsvfs *ufsvfsp = ip->i_ufsvfs;
3718 	struct ulockfs *ulp;
3719 	vnode_t *rmvp = NULL;	/* Vnode of removed directory */
3720 	int error;
3721 	int issync;
3722 	int trans_size;
3723 	int indeadlock;
3724 
3725 	/*
3726 	 * don't let the delete queue get too long
3727 	 */
3728 	if (ufsvfsp == NULL) {
3729 		error = EIO;
3730 		goto out;
3731 	}
3732 	if (ufsvfsp->vfs_delete.uq_ne > ufs_idle_max)
3733 		ufs_delete_drain(vp->v_vfsp, 1, 1);
3734 
3735 retry_rmdir:
3736 	error = ufs_lockfs_begin(ufsvfsp, &ulp, ULOCKFS_RMDIR_MASK);
3737 	if (error)
3738 		goto out;
3739 
3740 	if (ulp)
3741 		TRANS_BEGIN_CSYNC(ufsvfsp, issync, TOP_RMDIR,
3742 		    trans_size = TOP_RMDIR_SIZE);
3743 
3744 	/*
3745 	 * ufs_tryirwlock_trans uses rw_tryenter and checks for SLOCK
3746 	 * to avoid i_rwlock, ufs_lockfs_begin deadlock. If deadlock
3747 	 * possible, retries the operation.
3748 	 */
3749 	ufs_tryirwlock_trans(&ip->i_rwlock, RW_WRITER, TOP_RMDIR, retry);
3750 	if (indeadlock)
3751 		goto retry_rmdir;
3752 	error = ufs_dirremove(ip, nm, (struct inode *)0, cdir, DR_RMDIR, cr,
3753 	    &rmvp);
3754 	rw_exit(&ip->i_rwlock);
3755 
3756 	if (ulp) {
3757 		TRANS_END_CSYNC(ufsvfsp, error, issync, TOP_RMDIR,
3758 		    trans_size);
3759 		ufs_lockfs_end(ulp);
3760 	}
3761 
3762 	/*
3763 	 * This must be done AFTER the rmdir transaction has closed.
3764 	 */
3765 	if (rmvp != NULL) {
3766 		/* Only send the event if there were no errors */
3767 		if (error == 0)
3768 			vnevent_rmdir(rmvp, vp, nm);
3769 		VN_RELE(rmvp);
3770 	}
3771 out:
3772 	return (error);
3773 }
3774 
3775 /* ARGSUSED */
3776 static int
3777 ufs_readdir(
3778 	struct vnode *vp,
3779 	struct uio *uiop,
3780 	struct cred *cr,
3781 	int *eofp)
3782 {
3783 	struct iovec *iovp;
3784 	struct inode *ip;
3785 	struct direct *idp;
3786 	struct dirent64 *odp;
3787 	struct fbuf *fbp;
3788 	struct ufsvfs *ufsvfsp;
3789 	struct ulockfs *ulp;
3790 	caddr_t outbuf;
3791 	size_t bufsize;
3792 	uint_t offset;
3793 	uint_t bytes_wanted, total_bytes_wanted;
3794 	int incount = 0;
3795 	int outcount = 0;
3796 	int error;
3797 
3798 	ip = VTOI(vp);
3799 	ASSERT(RW_READ_HELD(&ip->i_rwlock));
3800 
3801 	if (uiop->uio_loffset >= MAXOFF32_T) {
3802 		if (eofp)
3803 			*eofp = 1;
3804 		return (0);
3805 	}
3806 
3807 	/*
3808 	 * Check if we have been called with a valid iov_len
3809 	 * and bail out if not, otherwise we may potentially loop
3810 	 * forever further down.
3811 	 */
3812 	if (uiop->uio_iov->iov_len <= 0) {
3813 		error = EINVAL;
3814 		goto out;
3815 	}
3816 
3817 	/*
3818 	 * Large Files: When we come here we are guaranteed that
3819 	 * uio_offset can be used safely. The high word is zero.
3820 	 */
3821 
3822 	ufsvfsp = ip->i_ufsvfs;
3823 	error = ufs_lockfs_begin(ufsvfsp, &ulp, ULOCKFS_READDIR_MASK);
3824 	if (error)
3825 		goto out;
3826 
3827 	iovp = uiop->uio_iov;
3828 	total_bytes_wanted = iovp->iov_len;
3829 
3830 	/* Large Files: directory files should not be "large" */
3831 
3832 	ASSERT(ip->i_size <= MAXOFF32_T);
3833 
3834 	/* Force offset to be valid (to guard against bogus lseek() values) */
3835 	offset = (uint_t)uiop->uio_offset & ~(DIRBLKSIZ - 1);
3836 
3837 	/* Quit if at end of file or link count of zero (posix) */
3838 	if (offset >= (uint_t)ip->i_size || ip->i_nlink <= 0) {
3839 		if (eofp)
3840 			*eofp = 1;
3841 		error = 0;
3842 		goto unlock;
3843 	}
3844 
3845 	/*
3846 	 * Get space to change directory entries into fs independent format.
3847 	 * Do fast alloc for the most commonly used-request size (filesystem
3848 	 * block size).
3849 	 */
3850 	if (uiop->uio_segflg != UIO_SYSSPACE || uiop->uio_iovcnt != 1) {
3851 		bufsize = total_bytes_wanted;
3852 		outbuf = kmem_alloc(bufsize, KM_SLEEP);
3853 		odp = (struct dirent64 *)outbuf;
3854 	} else {
3855 		bufsize = total_bytes_wanted;
3856 		odp = (struct dirent64 *)iovp->iov_base;
3857 	}
3858 
3859 nextblk:
3860 	bytes_wanted = total_bytes_wanted;
3861 
3862 	/* Truncate request to file size */
3863 	if (offset + bytes_wanted > (int)ip->i_size)
3864 		bytes_wanted = (int)(ip->i_size - offset);
3865 
3866 	/* Comply with MAXBSIZE boundary restrictions of fbread() */
3867 	if ((offset & MAXBOFFSET) + bytes_wanted > MAXBSIZE)
3868 		bytes_wanted = MAXBSIZE - (offset & MAXBOFFSET);
3869 
3870 	/*
3871 	 * Read in the next chunk.
3872 	 * We are still holding the i_rwlock.
3873 	 */
3874 	error = fbread(vp, (offset_t)offset, bytes_wanted, S_OTHER, &fbp);
3875 
3876 	if (error)
3877 		goto update_inode;
3878 	if (!ULOCKFS_IS_NOIACC(ITOUL(ip)) && (ip->i_fs->fs_ronly == 0) &&
3879 	    (!ufsvfsp->vfs_noatime)) {
3880 		ip->i_flag |= IACC;
3881 	}
3882 	incount = 0;
3883 	idp = (struct direct *)fbp->fb_addr;
3884 	if (idp->d_ino == 0 && idp->d_reclen == 0 && idp->d_namlen == 0) {
3885 		cmn_err(CE_WARN, "ufs_readdir: bad dir, inumber = %llu, "
3886 		    "fs = %s\n",
3887 		    (u_longlong_t)ip->i_number, ufsvfsp->vfs_fs->fs_fsmnt);
3888 		fbrelse(fbp, S_OTHER);
3889 		error = ENXIO;
3890 		goto update_inode;
3891 	}
3892 	/* Transform to file-system independent format */
3893 	while (incount < bytes_wanted) {
3894 		/*
3895 		 * If the current directory entry is mangled, then skip
3896 		 * to the next block.  It would be nice to set the FSBAD
3897 		 * flag in the super-block so that a fsck is forced on
3898 		 * next reboot, but locking is a problem.
3899 		 */
3900 		if (idp->d_reclen & 0x3) {
3901 			offset = (offset + DIRBLKSIZ) & ~(DIRBLKSIZ-1);
3902 			break;
3903 		}
3904 
3905 		/* Skip to requested offset and skip empty entries */
3906 		if (idp->d_ino != 0 && offset >= (uint_t)uiop->uio_offset) {
3907 			ushort_t this_reclen =
3908 			    DIRENT64_RECLEN(idp->d_namlen);
3909 			/* Buffer too small for any entries */
3910 			if (!outcount && this_reclen > bufsize) {
3911 				fbrelse(fbp, S_OTHER);
3912 				error = EINVAL;
3913 				goto update_inode;
3914 			}
3915 			/* If would overrun the buffer, quit */
3916 			if (outcount + this_reclen > bufsize) {
3917 				break;
3918 			}
3919 			/* Take this entry */
3920 			odp->d_ino = (ino64_t)idp->d_ino;
3921 			odp->d_reclen = (ushort_t)this_reclen;
3922 			odp->d_off = (offset_t)(offset + idp->d_reclen);
3923 
3924 			/* use strncpy(9f) to zero out uninitialized bytes */
3925 
3926 			ASSERT(strlen(idp->d_name) + 1 <=
3927 			    DIRENT64_NAMELEN(this_reclen));
3928 			(void) strncpy(odp->d_name, idp->d_name,
3929 			    DIRENT64_NAMELEN(this_reclen));
3930 			outcount += odp->d_reclen;
3931 			odp = (struct dirent64 *)
3932 			    ((intptr_t)odp + odp->d_reclen);
3933 			ASSERT(outcount <= bufsize);
3934 		}
3935 		if (idp->d_reclen) {
3936 			incount += idp->d_reclen;
3937 			offset += idp->d_reclen;
3938 			idp = (struct direct *)((intptr_t)idp + idp->d_reclen);
3939 		} else {
3940 			offset = (offset + DIRBLKSIZ) & ~(DIRBLKSIZ-1);
3941 			break;
3942 		}
3943 	}
3944 	/* Release the chunk */
3945 	fbrelse(fbp, S_OTHER);
3946 
3947 	/* Read whole block, but got no entries, read another if not eof */
3948 
3949 	/*
3950 	 * Large Files: casting i_size to int here is not a problem
3951 	 * because directory sizes are always less than MAXOFF32_T.
3952 	 * See assertion above.
3953 	 */
3954 
3955 	if (offset < (int)ip->i_size && !outcount)
3956 		goto nextblk;
3957 
3958 	/* Copy out the entry data */
3959 	if (uiop->uio_segflg == UIO_SYSSPACE && uiop->uio_iovcnt == 1) {
3960 		iovp->iov_base += outcount;
3961 		iovp->iov_len -= outcount;
3962 		uiop->uio_resid -= outcount;
3963 		uiop->uio_offset = offset;
3964 	} else if ((error = uiomove(outbuf, (long)outcount, UIO_READ,
3965 	    uiop)) == 0)
3966 		uiop->uio_offset = offset;
3967 update_inode:
3968 	ITIMES(ip);
3969 	if (uiop->uio_segflg != UIO_SYSSPACE || uiop->uio_iovcnt != 1)
3970 		kmem_free(outbuf, bufsize);
3971 
3972 	if (eofp && error == 0)
3973 		*eofp = (uiop->uio_offset >= (int)ip->i_size);
3974 unlock:
3975 	if (ulp) {
3976 		ufs_lockfs_end(ulp);
3977 	}
3978 out:
3979 	return (error);
3980 }
3981 
3982 /*ARGSUSED*/
3983 static int
3984 ufs_symlink(
3985 	struct vnode *dvp,		/* ptr to parent dir vnode */
3986 	char *linkname,			/* name of symbolic link */
3987 	struct vattr *vap,		/* attributes */
3988 	char *target,			/* target path */
3989 	struct cred *cr)		/* user credentials */
3990 {
3991 	struct inode *ip, *dip = VTOI(dvp);
3992 	struct ufsvfs *ufsvfsp = dip->i_ufsvfs;
3993 	struct ulockfs *ulp;
3994 	int error;
3995 	int issync;
3996 	int trans_size;
3997 	int residual;
3998 	int ioflag;
3999 	int retry = 1;
4000 
4001 	/*
4002 	 * No symlinks in attrdirs at this time
4003 	 */
4004 	if ((VTOI(dvp)->i_mode & IFMT) == IFATTRDIR)
4005 		return (EINVAL);
4006 
4007 again:
4008 	ip = (struct inode *)NULL;
4009 	vap->va_type = VLNK;
4010 	vap->va_rdev = 0;
4011 
4012 	error = ufs_lockfs_begin(ufsvfsp, &ulp, ULOCKFS_SYMLINK_MASK);
4013 	if (error)
4014 		goto out;
4015 
4016 	if (ulp)
4017 		TRANS_BEGIN_CSYNC(ufsvfsp, issync, TOP_SYMLINK,
4018 		    trans_size = (int)TOP_SYMLINK_SIZE(dip));
4019 
4020 	/*
4021 	 * We must create the inode before the directory entry, to avoid
4022 	 * racing with readlink().  ufs_dirmakeinode requires that we
4023 	 * hold the quota lock as reader, and directory locks as writer.
4024 	 */
4025 
4026 	rw_enter(&dip->i_rwlock, RW_WRITER);
4027 	rw_enter(&ufsvfsp->vfs_dqrwlock, RW_READER);
4028 	rw_enter(&dip->i_contents, RW_WRITER);
4029 
4030 	/*
4031 	 * Suppress any out of inodes messages if we will retry on
4032 	 * ENOSP
4033 	 */
4034 	if (retry)
4035 		dip->i_flag |= IQUIET;
4036 
4037 	error = ufs_dirmakeinode(dip, &ip, vap, DE_SYMLINK, cr);
4038 
4039 	dip->i_flag &= ~IQUIET;
4040 
4041 	rw_exit(&dip->i_contents);
4042 	rw_exit(&ufsvfsp->vfs_dqrwlock);
4043 	rw_exit(&dip->i_rwlock);
4044 
4045 	if (error)
4046 		goto unlock;
4047 
4048 	/*
4049 	 * OK.  The inode has been created.  Write out the data of the
4050 	 * symbolic link.  Since symbolic links are metadata, and should
4051 	 * remain consistent across a system crash, we need to force the
4052 	 * data out synchronously.
4053 	 *
4054 	 * (This is a change from the semantics in earlier releases, which
4055 	 * only created symbolic links synchronously if the semi-documented
4056 	 * 'syncdir' option was set, or if we were being invoked by the NFS
4057 	 * server, which requires symbolic links to be created synchronously.)
4058 	 *
4059 	 * We need to pass in a pointer for the residual length; otherwise
4060 	 * ufs_rdwri() will always return EIO if it can't write the data,
4061 	 * even if the error was really ENOSPC or EDQUOT.
4062 	 */
4063 
4064 	ioflag = FWRITE | FDSYNC;
4065 	residual = 0;
4066 
4067 	rw_enter(&ufsvfsp->vfs_dqrwlock, RW_READER);
4068 	rw_enter(&ip->i_contents, RW_WRITER);
4069 
4070 	/*
4071 	 * Suppress file system full messages if we will retry
4072 	 */
4073 	if (retry)
4074 		ip->i_flag |= IQUIET;
4075 
4076 	error = ufs_rdwri(UIO_WRITE, ioflag, ip, target, strlen(target),
4077 	    (offset_t)0, UIO_SYSSPACE, &residual, cr);
4078 
4079 	ip->i_flag &= ~IQUIET;
4080 
4081 	if (error) {
4082 		rw_exit(&ip->i_contents);
4083 		rw_exit(&ufsvfsp->vfs_dqrwlock);
4084 		goto remove;
4085 	}
4086 
4087 	/*
4088 	 * If the link's data is small enough, we can cache it in the inode.
4089 	 * This is a "fast symbolic link".  We don't use the first direct
4090 	 * block because that's actually used to point at the symbolic link's
4091 	 * contents on disk; but we know that none of the other direct or
4092 	 * indirect blocks can be used because symbolic links are restricted
4093 	 * to be smaller than a file system block.
4094 	 */
4095 
4096 	ASSERT(MAXPATHLEN <= VBSIZE(ITOV(ip)));
4097 
4098 	if (ip->i_size > 0 && ip->i_size <= FSL_SIZE) {
4099 		if (kcopy(target, &ip->i_db[1], ip->i_size) == 0) {
4100 			ip->i_flag |= IFASTSYMLNK;
4101 		} else {
4102 			int i;
4103 			/* error, clear garbage left behind */
4104 			for (i = 1; i < NDADDR; i++)
4105 				ip->i_db[i] = 0;
4106 			for (i = 0; i < NIADDR; i++)
4107 				ip->i_ib[i] = 0;
4108 		}
4109 	}
4110 
4111 	rw_exit(&ip->i_contents);
4112 	rw_exit(&ufsvfsp->vfs_dqrwlock);
4113 
4114 	/*
4115 	 * OK.  We've successfully created the symbolic link.  All that
4116 	 * remains is to insert it into the appropriate directory.
4117 	 */
4118 
4119 	rw_enter(&dip->i_rwlock, RW_WRITER);
4120 	error = ufs_direnter_lr(dip, linkname, DE_SYMLINK, NULL, ip, cr, NULL);
4121 	rw_exit(&dip->i_rwlock);
4122 
4123 	/*
4124 	 * Fall through into remove-on-error code.  We're either done, or we
4125 	 * need to remove the inode (if we couldn't insert it).
4126 	 */
4127 
4128 remove:
4129 	if (error && (ip != NULL)) {
4130 		rw_enter(&ip->i_contents, RW_WRITER);
4131 		ip->i_nlink--;
4132 		ip->i_flag |= ICHG;
4133 		ip->i_seq++;
4134 		ufs_setreclaim(ip);
4135 		rw_exit(&ip->i_contents);
4136 	}
4137 
4138 unlock:
4139 	if (ip != NULL)
4140 		VN_RELE(ITOV(ip));
4141 
4142 	if (ulp) {
4143 		int terr = 0;
4144 
4145 		TRANS_END_CSYNC(ufsvfsp, terr, issync, TOP_SYMLINK,
4146 		    trans_size);
4147 		ufs_lockfs_end(ulp);
4148 		if (error == 0)
4149 			error = terr;
4150 	}
4151 
4152 	/*
4153 	 * We may have failed due to lack of an inode or of a block to
4154 	 * store the target in.  Try flushing the delete queue to free
4155 	 * logically-available things up and try again.
4156 	 */
4157 	if ((error == ENOSPC) && retry && TRANS_ISTRANS(ufsvfsp)) {
4158 		ufs_delete_drain_wait(ufsvfsp, 1);
4159 		retry = 0;
4160 		goto again;
4161 	}
4162 
4163 out:
4164 	return (error);
4165 }
4166 
4167 /*
4168  * Ufs specific routine used to do ufs io.
4169  */
4170 int
4171 ufs_rdwri(enum uio_rw rw, int ioflag, struct inode *ip, caddr_t base,
4172 	ssize_t len, offset_t offset, enum uio_seg seg, int *aresid,
4173 	struct cred *cr)
4174 {
4175 	struct uio auio;
4176 	struct iovec aiov;
4177 	int error;
4178 
4179 	ASSERT(RW_LOCK_HELD(&ip->i_contents));
4180 
4181 	bzero((caddr_t)&auio, sizeof (uio_t));
4182 	bzero((caddr_t)&aiov, sizeof (iovec_t));
4183 
4184 	aiov.iov_base = base;
4185 	aiov.iov_len = len;
4186 	auio.uio_iov = &aiov;
4187 	auio.uio_iovcnt = 1;
4188 	auio.uio_loffset = offset;
4189 	auio.uio_segflg = (short)seg;
4190 	auio.uio_resid = len;
4191 
4192 	if (rw == UIO_WRITE) {
4193 		auio.uio_fmode = FWRITE;
4194 		auio.uio_extflg = UIO_COPY_DEFAULT;
4195 		auio.uio_llimit = curproc->p_fsz_ctl;
4196 		error = wrip(ip, &auio, ioflag, cr);
4197 	} else {
4198 		auio.uio_fmode = FREAD;
4199 		auio.uio_extflg = UIO_COPY_CACHED;
4200 		auio.uio_llimit = MAXOFFSET_T;
4201 		error = rdip(ip, &auio, ioflag, cr);
4202 	}
4203 
4204 	if (aresid) {
4205 		*aresid = auio.uio_resid;
4206 	} else if (auio.uio_resid) {
4207 		error = EIO;
4208 	}
4209 	return (error);
4210 }
4211 
4212 static int
4213 ufs_fid(vp, fidp)
4214 	struct vnode *vp;
4215 	struct fid *fidp;
4216 {
4217 	struct ufid *ufid;
4218 	struct inode *ip = VTOI(vp);
4219 
4220 	if (ip->i_ufsvfs == NULL)
4221 		return (EIO);
4222 
4223 	if (fidp->fid_len < (sizeof (struct ufid) - sizeof (ushort_t))) {
4224 		fidp->fid_len = sizeof (struct ufid) - sizeof (ushort_t);
4225 		return (ENOSPC);
4226 	}
4227 
4228 	ufid = (struct ufid *)fidp;
4229 	bzero((char *)ufid, sizeof (struct ufid));
4230 	ufid->ufid_len = sizeof (struct ufid) - sizeof (ushort_t);
4231 	ufid->ufid_ino = ip->i_number;
4232 	ufid->ufid_gen = ip->i_gen;
4233 
4234 	return (0);
4235 }
4236 
4237 /* ARGSUSED2 */
4238 static int
4239 ufs_rwlock(struct vnode *vp, int write_lock, caller_context_t *ctp)
4240 {
4241 	struct inode	*ip = VTOI(vp);
4242 	struct ufsvfs	*ufsvfsp;
4243 	int		forcedirectio;
4244 
4245 	/*
4246 	 * Read case is easy.
4247 	 */
4248 	if (!write_lock) {
4249 		rw_enter(&ip->i_rwlock, RW_READER);
4250 		return (V_WRITELOCK_FALSE);
4251 	}
4252 
4253 	/*
4254 	 * Caller has requested a writer lock, but that inhibits any
4255 	 * concurrency in the VOPs that follow. Acquire the lock shared
4256 	 * and defer exclusive access until it is known to be needed in
4257 	 * other VOP handlers. Some cases can be determined here.
4258 	 */
4259 
4260 	/*
4261 	 * If directio is not set, there is no chance of concurrency,
4262 	 * so just acquire the lock exclusive. Beware of a forced
4263 	 * unmount before looking at the mount option.
4264 	 */
4265 	ufsvfsp = ip->i_ufsvfs;
4266 	forcedirectio = ufsvfsp ? ufsvfsp->vfs_forcedirectio : 0;
4267 	if (!(ip->i_flag & IDIRECTIO || forcedirectio) ||
4268 	    !ufs_allow_shared_writes) {
4269 		rw_enter(&ip->i_rwlock, RW_WRITER);
4270 		return (V_WRITELOCK_TRUE);
4271 	}
4272 
4273 	/*
4274 	 * Mandatory locking forces acquiring i_rwlock exclusive.
4275 	 */
4276 	if (MANDLOCK(vp, ip->i_mode)) {
4277 		rw_enter(&ip->i_rwlock, RW_WRITER);
4278 		return (V_WRITELOCK_TRUE);
4279 	}
4280 
4281 	/*
4282 	 * Acquire the lock shared in case a concurrent write follows.
4283 	 * Mandatory locking could have become enabled before the lock
4284 	 * was acquired. Re-check and upgrade if needed.
4285 	 */
4286 	rw_enter(&ip->i_rwlock, RW_READER);
4287 	if (MANDLOCK(vp, ip->i_mode)) {
4288 		rw_exit(&ip->i_rwlock);
4289 		rw_enter(&ip->i_rwlock, RW_WRITER);
4290 		return (V_WRITELOCK_TRUE);
4291 	}
4292 	return (V_WRITELOCK_FALSE);
4293 }
4294 
4295 /*ARGSUSED*/
4296 static void
4297 ufs_rwunlock(struct vnode *vp, int write_lock, caller_context_t *ctp)
4298 {
4299 	struct inode	*ip = VTOI(vp);
4300 
4301 	rw_exit(&ip->i_rwlock);
4302 }
4303 
4304 /* ARGSUSED */
4305 static int
4306 ufs_seek(struct vnode *vp, offset_t ooff, offset_t *noffp)
4307 {
4308 	return ((*noffp < 0 || *noffp > MAXOFFSET_T) ? EINVAL : 0);
4309 }
4310 
4311 /* ARGSUSED */
4312 static int
4313 ufs_frlock(struct vnode *vp, int cmd, struct flock64 *bfp, int flag,
4314 	offset_t offset, struct flk_callback *flk_cbp, struct cred *cr)
4315 {
4316 	struct inode *ip = VTOI(vp);
4317 
4318 	if (ip->i_ufsvfs == NULL)
4319 		return (EIO);
4320 
4321 	/*
4322 	 * If file is being mapped, disallow frlock.
4323 	 * XXX I am not holding tlock while checking i_mapcnt because the
4324 	 * current locking strategy drops all locks before calling fs_frlock.
4325 	 * So, mapcnt could change before we enter fs_frlock making is
4326 	 * meaningless to have held tlock in the first place.
4327 	 */
4328 	if (ip->i_mapcnt > 0 && MANDLOCK(vp, ip->i_mode))
4329 		return (EAGAIN);
4330 	return (fs_frlock(vp, cmd, bfp, flag, offset, flk_cbp, cr));
4331 }
4332 
4333 /* ARGSUSED */
4334 static int
4335 ufs_space(struct vnode *vp, int cmd, struct flock64 *bfp, int flag,
4336 	offset_t offset, cred_t *cr, caller_context_t *ct)
4337 {
4338 	struct ufsvfs *ufsvfsp = VTOI(vp)->i_ufsvfs;
4339 	struct ulockfs *ulp;
4340 	int error;
4341 
4342 	if ((error = convoff(vp, bfp, 0, offset)) == 0) {
4343 		if (cmd == F_FREESP) {
4344 			error = ufs_lockfs_begin(ufsvfsp, &ulp,
4345 			    ULOCKFS_SPACE_MASK);
4346 			if (error)
4347 				return (error);
4348 			error = ufs_freesp(vp, bfp, flag, cr);
4349 		} else if (cmd == F_ALLOCSP) {
4350 			error = ufs_lockfs_begin(ufsvfsp, &ulp,
4351 			    ULOCKFS_FALLOCATE_MASK);
4352 			if (error)
4353 				return (error);
4354 			error = ufs_allocsp(vp, bfp, cr);
4355 		} else
4356 			return (EINVAL); /* Command not handled here */
4357 
4358 		if (ulp)
4359 			ufs_lockfs_end(ulp);
4360 
4361 	}
4362 	return (error);
4363 }
4364 
4365 /*
4366  * Used to determine if read ahead should be done. Also used to
4367  * to determine when write back occurs.
4368  */
4369 #define	CLUSTSZ(ip)		((ip)->i_ufsvfs->vfs_ioclustsz)
4370 
4371 /*
4372  * A faster version of ufs_getpage.
4373  *
4374  * We optimize by inlining the pvn_getpages iterator, eliminating
4375  * calls to bmap_read if file doesn't have UFS holes, and avoiding
4376  * the overhead of page_exists().
4377  *
4378  * When files has UFS_HOLES and ufs_getpage is called with S_READ,
4379  * we set *protp to PROT_READ to avoid calling bmap_read. This approach
4380  * victimizes performance when a file with UFS holes is faulted
4381  * first in the S_READ mode, and then in the S_WRITE mode. We will get
4382  * two MMU faults in this case.
4383  *
4384  * XXX - the inode fields which control the sequential mode are not
4385  *	 protected by any mutex. The read ahead will act wild if
4386  *	 multiple processes will access the file concurrently and
4387  *	 some of them in sequential mode. One particulary bad case
4388  *	 is if another thread will change the value of i_nextrio between
4389  *	 the time this thread tests the i_nextrio value and then reads it
4390  *	 again to use it as the offset for the read ahead.
4391  */
4392 static int
4393 ufs_getpage(struct vnode *vp, offset_t off, size_t len, uint_t *protp,
4394 	page_t *plarr[], size_t plsz, struct seg *seg, caddr_t addr,
4395 	enum seg_rw rw, struct cred *cr)
4396 {
4397 	u_offset_t	uoff = (u_offset_t)off; /* type conversion */
4398 	u_offset_t	pgoff;
4399 	u_offset_t	eoff;
4400 	struct inode 	*ip = VTOI(vp);
4401 	struct ufsvfs	*ufsvfsp = ip->i_ufsvfs;
4402 	struct fs 	*fs;
4403 	struct ulockfs	*ulp;
4404 	page_t		**pl;
4405 	caddr_t		pgaddr;
4406 	krw_t		rwtype;
4407 	int 		err;
4408 	int		has_holes;
4409 	int		beyond_eof;
4410 	int		seqmode;
4411 	int		pgsize = PAGESIZE;
4412 	int		dolock;
4413 	int		do_qlock;
4414 	int		trans_size;
4415 
4416 	ASSERT((uoff & PAGEOFFSET) == 0);
4417 
4418 	if (protp)
4419 		*protp = PROT_ALL;
4420 
4421 	/*
4422 	 * Obey the lockfs protocol
4423 	 */
4424 	err = ufs_lockfs_begin_getpage(ufsvfsp, &ulp, seg,
4425 	    rw == S_READ || rw == S_EXEC, protp);
4426 	if (err)
4427 		goto out;
4428 
4429 	fs = ufsvfsp->vfs_fs;
4430 
4431 	if (ulp && (rw == S_CREATE || rw == S_WRITE) &&
4432 	    !(vp->v_flag & VISSWAP)) {
4433 		/*
4434 		 * Try to start a transaction, will return if blocking is
4435 		 * expected to occur and the address space is not the
4436 		 * kernel address space.
4437 		 */
4438 		trans_size = TOP_GETPAGE_SIZE(ip);
4439 		if (seg->s_as != &kas) {
4440 			TRANS_TRY_BEGIN_ASYNC(ufsvfsp, TOP_GETPAGE,
4441 			    trans_size, err)
4442 			if (err == EWOULDBLOCK) {
4443 				/*
4444 				 * Use EDEADLK here because the VM code
4445 				 * can normally never see this error.
4446 				 */
4447 				err = EDEADLK;
4448 				ufs_lockfs_end(ulp);
4449 				goto out;
4450 			}
4451 		} else {
4452 			TRANS_BEGIN_ASYNC(ufsvfsp, TOP_GETPAGE, trans_size);
4453 		}
4454 	}
4455 
4456 	if (vp->v_flag & VNOMAP) {
4457 		err = ENOSYS;
4458 		goto unlock;
4459 	}
4460 
4461 	seqmode = ip->i_nextr == uoff && rw != S_CREATE;
4462 
4463 	rwtype = RW_READER;		/* start as a reader */
4464 	dolock = (rw_owner(&ip->i_contents) != curthread);
4465 	/*
4466 	 * If this thread owns the lock, i.e., this thread grabbed it
4467 	 * as writer somewhere above, then we don't need to grab the
4468 	 * lock as reader in this routine.
4469 	 */
4470 	do_qlock = (rw_owner(&ufsvfsp->vfs_dqrwlock) != curthread);
4471 
4472 retrylock:
4473 	if (dolock) {
4474 		/*
4475 		 * Grab the quota lock if we need to call
4476 		 * bmap_write() below (with i_contents as writer).
4477 		 */
4478 		if (do_qlock && rwtype == RW_WRITER)
4479 			rw_enter(&ufsvfsp->vfs_dqrwlock, RW_READER);
4480 		rw_enter(&ip->i_contents, rwtype);
4481 	}
4482 
4483 	/*
4484 	 * We may be getting called as a side effect of a bmap using
4485 	 * fbread() when the blocks might be being allocated and the
4486 	 * size has not yet been up'ed.  In this case we want to be
4487 	 * able to return zero pages if we get back UFS_HOLE from
4488 	 * calling bmap for a non write case here.  We also might have
4489 	 * to read some frags from the disk into a page if we are
4490 	 * extending the number of frags for a given lbn in bmap().
4491 	 * Large Files: The read of i_size here is atomic because
4492 	 * i_contents is held here. If dolock is zero, the lock
4493 	 * is held in bmap routines.
4494 	 */
4495 	beyond_eof = uoff + len > ip->i_size + PAGEOFFSET;
4496 	if (beyond_eof && seg != segkmap) {
4497 		if (dolock) {
4498 			rw_exit(&ip->i_contents);
4499 			if (do_qlock && rwtype == RW_WRITER)
4500 				rw_exit(&ufsvfsp->vfs_dqrwlock);
4501 		}
4502 		err = EFAULT;
4503 		goto unlock;
4504 	}
4505 
4506 	/*
4507 	 * Must hold i_contents lock throughout the call to pvn_getpages
4508 	 * since locked pages are returned from each call to ufs_getapage.
4509 	 * Must *not* return locked pages and then try for contents lock
4510 	 * due to lock ordering requirements (inode > page)
4511 	 */
4512 
4513 	has_holes = bmap_has_holes(ip);
4514 
4515 	if ((rw == S_WRITE || rw == S_CREATE) && has_holes && !beyond_eof) {
4516 		int	blk_size;
4517 		u_offset_t offset;
4518 
4519 		/*
4520 		 * We must acquire the RW_WRITER lock in order to
4521 		 * call bmap_write().
4522 		 */
4523 		if (dolock && rwtype == RW_READER) {
4524 			rwtype = RW_WRITER;
4525 
4526 			/*
4527 			 * Grab the quota lock before
4528 			 * upgrading i_contents, but if we can't grab it
4529 			 * don't wait here due to lock order:
4530 			 * vfs_dqrwlock > i_contents.
4531 			 */
4532 			if (do_qlock &&
4533 			    rw_tryenter(&ufsvfsp->vfs_dqrwlock, RW_READER)
4534 			    == 0) {
4535 				rw_exit(&ip->i_contents);
4536 				goto retrylock;
4537 			}
4538 			if (!rw_tryupgrade(&ip->i_contents)) {
4539 				rw_exit(&ip->i_contents);
4540 				if (do_qlock)
4541 					rw_exit(&ufsvfsp->vfs_dqrwlock);
4542 				goto retrylock;
4543 			}
4544 		}
4545 
4546 		/*
4547 		 * May be allocating disk blocks for holes here as
4548 		 * a result of mmap faults. write(2) does the bmap_write
4549 		 * in rdip/wrip, not here. We are not dealing with frags
4550 		 * in this case.
4551 		 */
4552 		/*
4553 		 * Large Files: We cast fs_bmask field to offset_t
4554 		 * just as we do for MAXBMASK because uoff is a 64-bit
4555 		 * data type. fs_bmask will still be a 32-bit type
4556 		 * as we cannot change any ondisk data structures.
4557 		 */
4558 
4559 		offset = uoff & (offset_t)fs->fs_bmask;
4560 		while (offset < uoff + len) {
4561 			blk_size = (int)blksize(fs, ip, lblkno(fs, offset));
4562 			err = bmap_write(ip, offset, blk_size,
4563 			    BI_NORMAL, NULL, cr);
4564 			if (ip->i_flag & (ICHG|IUPD))
4565 				ip->i_seq++;
4566 			if (err)
4567 				goto update_inode;
4568 			offset += blk_size; /* XXX - make this contig */
4569 		}
4570 	}
4571 
4572 	/*
4573 	 * Can be a reader from now on.
4574 	 */
4575 	if (dolock && rwtype == RW_WRITER) {
4576 		rw_downgrade(&ip->i_contents);
4577 		/*
4578 		 * We can release vfs_dqrwlock early so do it, but make
4579 		 * sure we don't try to release it again at the bottom.
4580 		 */
4581 		if (do_qlock) {
4582 			rw_exit(&ufsvfsp->vfs_dqrwlock);
4583 			do_qlock = 0;
4584 		}
4585 	}
4586 
4587 	/*
4588 	 * We remove PROT_WRITE in cases when the file has UFS holes
4589 	 * because we don't  want to call bmap_read() to check each
4590 	 * page if it is backed with a disk block.
4591 	 */
4592 	if (protp && has_holes && rw != S_WRITE && rw != S_CREATE)
4593 		*protp &= ~PROT_WRITE;
4594 
4595 	err = 0;
4596 
4597 	/*
4598 	 * The loop looks up pages in the range [off, off + len).
4599 	 * For each page, we first check if we should initiate an asynchronous
4600 	 * read ahead before we call page_lookup (we may sleep in page_lookup
4601 	 * for a previously initiated disk read).
4602 	 */
4603 	eoff = (uoff + len);
4604 	for (pgoff = uoff, pgaddr = addr, pl = plarr;
4605 	    pgoff < eoff; /* empty */) {
4606 		page_t	*pp;
4607 		u_offset_t	nextrio;
4608 		se_t	se;
4609 		int retval;
4610 
4611 		se = ((rw == S_CREATE || rw == S_OTHER) ? SE_EXCL : SE_SHARED);
4612 
4613 		/* Handle async getpage (faultahead) */
4614 		if (plarr == NULL) {
4615 			ip->i_nextrio = pgoff;
4616 			(void) ufs_getpage_ra(vp, pgoff, seg, pgaddr);
4617 			pgoff += pgsize;
4618 			pgaddr += pgsize;
4619 			continue;
4620 		}
4621 		/*
4622 		 * Check if we should initiate read ahead of next cluster.
4623 		 * We call page_exists only when we need to confirm that
4624 		 * we have the current page before we initiate the read ahead.
4625 		 */
4626 		nextrio = ip->i_nextrio;
4627 		if (seqmode &&
4628 		    pgoff + CLUSTSZ(ip) >= nextrio && pgoff <= nextrio &&
4629 		    nextrio < ip->i_size && page_exists(vp, pgoff)) {
4630 			retval = ufs_getpage_ra(vp, pgoff, seg, pgaddr);
4631 			/*
4632 			 * We always read ahead the next cluster of data
4633 			 * starting from i_nextrio. If the page (vp,nextrio)
4634 			 * is actually in core at this point, the routine
4635 			 * ufs_getpage_ra() will stop pre-fetching data
4636 			 * until we read that page in a synchronized manner
4637 			 * through ufs_getpage_miss(). So, we should increase
4638 			 * i_nextrio if the page (vp, nextrio) exists.
4639 			 */
4640 			if ((retval == 0) && page_exists(vp, nextrio)) {
4641 				ip->i_nextrio = nextrio + pgsize;
4642 			}
4643 		}
4644 
4645 		if ((pp = page_lookup(vp, pgoff, se)) != NULL) {
4646 			/*
4647 			 * We found the page in the page cache.
4648 			 */
4649 			*pl++ = pp;
4650 			pgoff += pgsize;
4651 			pgaddr += pgsize;
4652 			len -= pgsize;
4653 			plsz -= pgsize;
4654 		} else  {
4655 			/*
4656 			 * We have to create the page, or read it from disk.
4657 			 */
4658 			if (err = ufs_getpage_miss(vp, pgoff, len, seg, pgaddr,
4659 			    pl, plsz, rw, seqmode))
4660 				goto error;
4661 
4662 			while (*pl != NULL) {
4663 				pl++;
4664 				pgoff += pgsize;
4665 				pgaddr += pgsize;
4666 				len -= pgsize;
4667 				plsz -= pgsize;
4668 			}
4669 		}
4670 	}
4671 
4672 	/*
4673 	 * Return pages up to plsz if they are in the page cache.
4674 	 * We cannot return pages if there is a chance that they are
4675 	 * backed with a UFS hole and rw is S_WRITE or S_CREATE.
4676 	 */
4677 	if (plarr && !(has_holes && (rw == S_WRITE || rw == S_CREATE))) {
4678 
4679 		ASSERT((protp == NULL) ||
4680 		    !(has_holes && (*protp & PROT_WRITE)));
4681 
4682 		eoff = pgoff + plsz;
4683 		while (pgoff < eoff) {
4684 			page_t		*pp;
4685 
4686 			if ((pp = page_lookup_nowait(vp, pgoff,
4687 			    SE_SHARED)) == NULL)
4688 				break;
4689 
4690 			*pl++ = pp;
4691 			pgoff += pgsize;
4692 			plsz -= pgsize;
4693 		}
4694 	}
4695 
4696 	if (plarr)
4697 		*pl = NULL;			/* Terminate page list */
4698 	ip->i_nextr = pgoff;
4699 
4700 error:
4701 	if (err && plarr) {
4702 		/*
4703 		 * Release any pages we have locked.
4704 		 */
4705 		while (pl > &plarr[0])
4706 			page_unlock(*--pl);
4707 
4708 		plarr[0] = NULL;
4709 	}
4710 
4711 update_inode:
4712 	/*
4713 	 * If the inode is not already marked for IACC (in rdip() for read)
4714 	 * and the inode is not marked for no access time update (in wrip()
4715 	 * for write) then update the inode access time and mod time now.
4716 	 */
4717 	if ((ip->i_flag & (IACC | INOACC)) == 0) {
4718 		if ((rw != S_OTHER) && (ip->i_mode & IFMT) != IFDIR) {
4719 			if (!ULOCKFS_IS_NOIACC(ITOUL(ip)) &&
4720 			    (fs->fs_ronly == 0) &&
4721 			    (!ufsvfsp->vfs_noatime)) {
4722 				mutex_enter(&ip->i_tlock);
4723 				ip->i_flag |= IACC;
4724 				ITIMES_NOLOCK(ip);
4725 				mutex_exit(&ip->i_tlock);
4726 			}
4727 		}
4728 	}
4729 
4730 	if (dolock) {
4731 		rw_exit(&ip->i_contents);
4732 		if (do_qlock && rwtype == RW_WRITER)
4733 			rw_exit(&ufsvfsp->vfs_dqrwlock);
4734 	}
4735 
4736 unlock:
4737 	if (ulp) {
4738 		if ((rw == S_CREATE || rw == S_WRITE) &&
4739 		    !(vp->v_flag & VISSWAP)) {
4740 			TRANS_END_ASYNC(ufsvfsp, TOP_GETPAGE, trans_size);
4741 		}
4742 		ufs_lockfs_end(ulp);
4743 	}
4744 out:
4745 	return (err);
4746 }
4747 
4748 /*
4749  * ufs_getpage_miss is called when ufs_getpage missed the page in the page
4750  * cache. The page is either read from the disk, or it's created.
4751  * A page is created (without disk read) if rw == S_CREATE, or if
4752  * the page is not backed with a real disk block (UFS hole).
4753  */
4754 /* ARGSUSED */
4755 static int
4756 ufs_getpage_miss(struct vnode *vp, u_offset_t off, size_t len, struct seg *seg,
4757 	caddr_t addr, page_t *pl[], size_t plsz, enum seg_rw rw, int seq)
4758 {
4759 	struct inode	*ip = VTOI(vp);
4760 	page_t		*pp;
4761 	daddr_t		bn;
4762 	size_t		io_len;
4763 	int		crpage = 0;
4764 	int		err;
4765 	int		contig;
4766 	int		bsize = ip->i_fs->fs_bsize;
4767 
4768 	/*
4769 	 * Figure out whether the page can be created, or must be
4770 	 * must be read from the disk.
4771 	 */
4772 	if (rw == S_CREATE)
4773 		crpage = 1;
4774 	else {
4775 		contig = 0;
4776 		if (err = bmap_read(ip, off, &bn, &contig))
4777 			return (err);
4778 
4779 		crpage = (bn == UFS_HOLE);
4780 
4781 		/*
4782 		 * If its also a fallocated block that hasn't been written to
4783 		 * yet, we will treat it just like a UFS_HOLE and create
4784 		 * a zero page for it
4785 		 */
4786 		if (ISFALLOCBLK(ip, bn))
4787 			crpage = 1;
4788 	}
4789 
4790 	if (crpage) {
4791 		if ((pp = page_create_va(vp, off, PAGESIZE, PG_WAIT, seg,
4792 		    addr)) == NULL) {
4793 			return (ufs_fault(vp,
4794 			    "ufs_getpage_miss: page_create == NULL"));
4795 		}
4796 
4797 		if (rw != S_CREATE)
4798 			pagezero(pp, 0, PAGESIZE);
4799 
4800 		io_len = PAGESIZE;
4801 	} else {
4802 		u_offset_t	io_off;
4803 		uint_t	xlen;
4804 		struct buf	*bp;
4805 		ufsvfs_t	*ufsvfsp = ip->i_ufsvfs;
4806 
4807 		/*
4808 		 * If access is not in sequential order, we read from disk
4809 		 * in bsize units.
4810 		 *
4811 		 * We limit the size of the transfer to bsize if we are reading
4812 		 * from the beginning of the file. Note in this situation we
4813 		 * will hedge our bets and initiate an async read ahead of
4814 		 * the second block.
4815 		 */
4816 		if (!seq || off == 0)
4817 			contig = MIN(contig, bsize);
4818 
4819 		pp = pvn_read_kluster(vp, off, seg, addr, &io_off,
4820 		    &io_len, off, contig, 0);
4821 
4822 		/*
4823 		 * Some other thread has entered the page.
4824 		 * ufs_getpage will retry page_lookup.
4825 		 */
4826 		if (pp == NULL) {
4827 			pl[0] = NULL;
4828 			return (0);
4829 		}
4830 
4831 		/*
4832 		 * Zero part of the page which we are not
4833 		 * going to read from the disk.
4834 		 */
4835 		xlen = io_len & PAGEOFFSET;
4836 		if (xlen != 0)
4837 			pagezero(pp->p_prev, xlen, PAGESIZE - xlen);
4838 
4839 		bp = pageio_setup(pp, io_len, ip->i_devvp, B_READ);
4840 		bp->b_edev = ip->i_dev;
4841 		bp->b_dev = cmpdev(ip->i_dev);
4842 		bp->b_blkno = bn;
4843 		bp->b_un.b_addr = (caddr_t)0;
4844 		bp->b_file = ip->i_vnode;
4845 		bp->b_offset = off;
4846 
4847 		if (ufsvfsp->vfs_log) {
4848 			lufs_read_strategy(ufsvfsp->vfs_log, bp);
4849 		} else if (ufsvfsp->vfs_snapshot) {
4850 			fssnap_strategy(&ufsvfsp->vfs_snapshot, bp);
4851 		} else {
4852 			ufsvfsp->vfs_iotstamp = lbolt;
4853 			ub.ub_getpages.value.ul++;
4854 			(void) bdev_strategy(bp);
4855 			lwp_stat_update(LWP_STAT_INBLK, 1);
4856 		}
4857 
4858 		ip->i_nextrio = off + ((io_len + PAGESIZE - 1) & PAGEMASK);
4859 
4860 		/*
4861 		 * If the file access is sequential, initiate read ahead
4862 		 * of the next cluster.
4863 		 */
4864 		if (seq && ip->i_nextrio < ip->i_size)
4865 			(void) ufs_getpage_ra(vp, off, seg, addr);
4866 		err = biowait(bp);
4867 		pageio_done(bp);
4868 
4869 		if (err) {
4870 			pvn_read_done(pp, B_ERROR);
4871 			return (err);
4872 		}
4873 	}
4874 
4875 	pvn_plist_init(pp, pl, plsz, off, io_len, rw);
4876 	return (0);
4877 }
4878 
4879 /*
4880  * Read ahead a cluster from the disk. Returns the length in bytes.
4881  */
4882 static int
4883 ufs_getpage_ra(struct vnode *vp, u_offset_t off, struct seg *seg, caddr_t addr)
4884 {
4885 	struct inode	*ip = VTOI(vp);
4886 	page_t		*pp;
4887 	u_offset_t	io_off = ip->i_nextrio;
4888 	ufsvfs_t	*ufsvfsp;
4889 	caddr_t		addr2 = addr + (io_off - off);
4890 	struct buf	*bp;
4891 	daddr_t		bn;
4892 	size_t		io_len;
4893 	int		err;
4894 	int		contig;
4895 	int		xlen;
4896 	int		bsize = ip->i_fs->fs_bsize;
4897 
4898 	/*
4899 	 * If the directio advisory is in effect on this file,
4900 	 * then do not do buffered read ahead. Read ahead makes
4901 	 * it more difficult on threads using directio as they
4902 	 * will be forced to flush the pages from this vnode.
4903 	 */
4904 	if ((ufsvfsp = ip->i_ufsvfs) == NULL)
4905 		return (0);
4906 	if (ip->i_flag & IDIRECTIO || ufsvfsp->vfs_forcedirectio)
4907 		return (0);
4908 
4909 	/*
4910 	 * Is this test needed?
4911 	 */
4912 	if (addr2 >= seg->s_base + seg->s_size)
4913 		return (0);
4914 
4915 	contig = 0;
4916 	err = bmap_read(ip, io_off, &bn, &contig);
4917 	/*
4918 	 * If its a UFS_HOLE or a fallocated block, do not perform
4919 	 * any read ahead's since there probably is nothing to read ahead
4920 	 */
4921 	if (err || bn == UFS_HOLE || ISFALLOCBLK(ip, bn))
4922 		return (0);
4923 
4924 	/*
4925 	 * Limit the transfer size to bsize if this is the 2nd block.
4926 	 */
4927 	if (io_off == (u_offset_t)bsize)
4928 		contig = MIN(contig, bsize);
4929 
4930 	if ((pp = pvn_read_kluster(vp, io_off, seg, addr2, &io_off,
4931 	    &io_len, io_off, contig, 1)) == NULL)
4932 		return (0);
4933 
4934 	/*
4935 	 * Zero part of page which we are not going to read from disk
4936 	 */
4937 	if ((xlen = (io_len & PAGEOFFSET)) > 0)
4938 		pagezero(pp->p_prev, xlen, PAGESIZE - xlen);
4939 
4940 	ip->i_nextrio = (io_off + io_len + PAGESIZE - 1) & PAGEMASK;
4941 
4942 	bp = pageio_setup(pp, io_len, ip->i_devvp, B_READ | B_ASYNC);
4943 	bp->b_edev = ip->i_dev;
4944 	bp->b_dev = cmpdev(ip->i_dev);
4945 	bp->b_blkno = bn;
4946 	bp->b_un.b_addr = (caddr_t)0;
4947 	bp->b_file = ip->i_vnode;
4948 	bp->b_offset = off;
4949 
4950 	if (ufsvfsp->vfs_log) {
4951 		lufs_read_strategy(ufsvfsp->vfs_log, bp);
4952 	} else if (ufsvfsp->vfs_snapshot) {
4953 		fssnap_strategy(&ufsvfsp->vfs_snapshot, bp);
4954 	} else {
4955 		ufsvfsp->vfs_iotstamp = lbolt;
4956 		ub.ub_getras.value.ul++;
4957 		(void) bdev_strategy(bp);
4958 		lwp_stat_update(LWP_STAT_INBLK, 1);
4959 	}
4960 
4961 	return (io_len);
4962 }
4963 
4964 int	ufs_delay = 1;
4965 /*
4966  * Flags are composed of {B_INVAL, B_FREE, B_DONTNEED, B_FORCE, B_ASYNC}
4967  *
4968  * LMXXX - the inode really ought to contain a pointer to one of these
4969  * async args.  Stuff gunk in there and just hand the whole mess off.
4970  * This would replace i_delaylen, i_delayoff.
4971  */
4972 /*ARGSUSED*/
4973 static int
4974 ufs_putpage(struct vnode *vp, offset_t off, size_t len, int flags,
4975 	struct cred *cr)
4976 {
4977 	struct inode *ip = VTOI(vp);
4978 	int err = 0;
4979 
4980 	if (vp->v_count == 0) {
4981 		return (ufs_fault(vp, "ufs_putpage: bad v_count == 0"));
4982 	}
4983 
4984 	/*
4985 	 * XXX - Why should this check be made here?
4986 	 */
4987 	if (vp->v_flag & VNOMAP) {
4988 		err = ENOSYS;
4989 		goto errout;
4990 	}
4991 
4992 	if (ip->i_ufsvfs == NULL) {
4993 		err = EIO;
4994 		goto errout;
4995 	}
4996 
4997 	if (flags & B_ASYNC) {
4998 		if (ufs_delay && len &&
4999 		    (flags & ~(B_ASYNC|B_DONTNEED|B_FREE)) == 0) {
5000 			mutex_enter(&ip->i_tlock);
5001 			/*
5002 			 * If nobody stalled, start a new cluster.
5003 			 */
5004 			if (ip->i_delaylen == 0) {
5005 				ip->i_delayoff = off;
5006 				ip->i_delaylen = len;
5007 				mutex_exit(&ip->i_tlock);
5008 				goto errout;
5009 			}
5010 			/*
5011 			 * If we have a full cluster or they are not contig,
5012 			 * then push last cluster and start over.
5013 			 */
5014 			if (ip->i_delaylen >= CLUSTSZ(ip) ||
5015 			    ip->i_delayoff + ip->i_delaylen != off) {
5016 				u_offset_t doff;
5017 				size_t dlen;
5018 
5019 				doff = ip->i_delayoff;
5020 				dlen = ip->i_delaylen;
5021 				ip->i_delayoff = off;
5022 				ip->i_delaylen = len;
5023 				mutex_exit(&ip->i_tlock);
5024 				err = ufs_putpages(vp, doff, dlen,
5025 				    flags, cr);
5026 				/* LMXXX - flags are new val, not old */
5027 				goto errout;
5028 			}
5029 			/*
5030 			 * There is something there, it's not full, and
5031 			 * it is contig.
5032 			 */
5033 			ip->i_delaylen += len;
5034 			mutex_exit(&ip->i_tlock);
5035 			goto errout;
5036 		}
5037 		/*
5038 		 * Must have weird flags or we are not clustering.
5039 		 */
5040 	}
5041 
5042 	err = ufs_putpages(vp, off, len, flags, cr);
5043 
5044 errout:
5045 	return (err);
5046 }
5047 
5048 /*
5049  * If len == 0, do from off to EOF.
5050  *
5051  * The normal cases should be len == 0 & off == 0 (entire vp list),
5052  * len == MAXBSIZE (from segmap_release actions), and len == PAGESIZE
5053  * (from pageout).
5054  */
5055 /*ARGSUSED*/
5056 static int
5057 ufs_putpages(
5058 	struct vnode *vp,
5059 	offset_t off,
5060 	size_t len,
5061 	int flags,
5062 	struct cred *cr)
5063 {
5064 	u_offset_t io_off;
5065 	u_offset_t eoff;
5066 	struct inode *ip = VTOI(vp);
5067 	page_t *pp;
5068 	size_t io_len;
5069 	int err = 0;
5070 	int dolock;
5071 
5072 	if (vp->v_count == 0)
5073 		return (ufs_fault(vp, "ufs_putpages: v_count == 0"));
5074 	/*
5075 	 * Acquire the readers/write inode lock before locking
5076 	 * any pages in this inode.
5077 	 * The inode lock is held during i/o.
5078 	 */
5079 	if (len == 0) {
5080 		mutex_enter(&ip->i_tlock);
5081 		ip->i_delayoff = ip->i_delaylen = 0;
5082 		mutex_exit(&ip->i_tlock);
5083 	}
5084 	dolock = (rw_owner(&ip->i_contents) != curthread);
5085 	if (dolock) {
5086 		/*
5087 		 * Must synchronize this thread and any possible thread
5088 		 * operating in the window of vulnerability in wrip().
5089 		 * It is dangerous to allow both a thread doing a putpage
5090 		 * and a thread writing, so serialize them.  The exception
5091 		 * is when the thread in wrip() does something which causes
5092 		 * a putpage operation.  Then, the thread must be allowed
5093 		 * to continue.  It may encounter a bmap_read problem in
5094 		 * ufs_putapage, but that is handled in ufs_putapage.
5095 		 * Allow async writers to proceed, we don't want to block
5096 		 * the pageout daemon.
5097 		 */
5098 		if (ip->i_writer == curthread)
5099 			rw_enter(&ip->i_contents, RW_READER);
5100 		else {
5101 			for (;;) {
5102 				rw_enter(&ip->i_contents, RW_READER);
5103 				mutex_enter(&ip->i_tlock);
5104 				/*
5105 				 * If there is no thread in the critical
5106 				 * section of wrip(), then proceed.
5107 				 * Otherwise, wait until there isn't one.
5108 				 */
5109 				if (ip->i_writer == NULL) {
5110 					mutex_exit(&ip->i_tlock);
5111 					break;
5112 				}
5113 				rw_exit(&ip->i_contents);
5114 				/*
5115 				 * Bounce async writers when we have a writer
5116 				 * working on this file so we don't deadlock
5117 				 * the pageout daemon.
5118 				 */
5119 				if (flags & B_ASYNC) {
5120 					mutex_exit(&ip->i_tlock);
5121 					return (0);
5122 				}
5123 				cv_wait(&ip->i_wrcv, &ip->i_tlock);
5124 				mutex_exit(&ip->i_tlock);
5125 			}
5126 		}
5127 	}
5128 
5129 	if (!vn_has_cached_data(vp)) {
5130 		if (dolock)
5131 			rw_exit(&ip->i_contents);
5132 		return (0);
5133 	}
5134 
5135 	if (len == 0) {
5136 		/*
5137 		 * Search the entire vp list for pages >= off.
5138 		 */
5139 		err = pvn_vplist_dirty(vp, (u_offset_t)off, ufs_putapage,
5140 		    flags, cr);
5141 	} else {
5142 		/*
5143 		 * Loop over all offsets in the range looking for
5144 		 * pages to deal with.
5145 		 */
5146 		if ((eoff = blkroundup(ip->i_fs, ip->i_size)) != 0)
5147 			eoff = MIN(off + len, eoff);
5148 		else
5149 			eoff = off + len;
5150 
5151 		for (io_off = off; io_off < eoff; io_off += io_len) {
5152 			/*
5153 			 * If we are not invalidating, synchronously
5154 			 * freeing or writing pages, use the routine
5155 			 * page_lookup_nowait() to prevent reclaiming
5156 			 * them from the free list.
5157 			 */
5158 			if ((flags & B_INVAL) || ((flags & B_ASYNC) == 0)) {
5159 				pp = page_lookup(vp, io_off,
5160 				    (flags & (B_INVAL | B_FREE)) ?
5161 				    SE_EXCL : SE_SHARED);
5162 			} else {
5163 				pp = page_lookup_nowait(vp, io_off,
5164 				    (flags & B_FREE) ? SE_EXCL : SE_SHARED);
5165 			}
5166 
5167 			if (pp == NULL || pvn_getdirty(pp, flags) == 0)
5168 				io_len = PAGESIZE;
5169 			else {
5170 				u_offset_t *io_offp = &io_off;
5171 
5172 				err = ufs_putapage(vp, pp, io_offp, &io_len,
5173 				    flags, cr);
5174 				if (err != 0)
5175 					break;
5176 				/*
5177 				 * "io_off" and "io_len" are returned as
5178 				 * the range of pages we actually wrote.
5179 				 * This allows us to skip ahead more quickly
5180 				 * since several pages may've been dealt
5181 				 * with by this iteration of the loop.
5182 				 */
5183 			}
5184 		}
5185 	}
5186 	if (err == 0 && off == 0 && (len == 0 || len >= ip->i_size)) {
5187 		/*
5188 		 * We have just sync'ed back all the pages on
5189 		 * the inode, turn off the IMODTIME flag.
5190 		 */
5191 		mutex_enter(&ip->i_tlock);
5192 		ip->i_flag &= ~IMODTIME;
5193 		mutex_exit(&ip->i_tlock);
5194 	}
5195 	if (dolock)
5196 		rw_exit(&ip->i_contents);
5197 	return (err);
5198 }
5199 
5200 static void
5201 ufs_iodone(buf_t *bp)
5202 {
5203 	struct inode *ip;
5204 
5205 	ASSERT((bp->b_pages->p_vnode != NULL) && !(bp->b_flags & B_READ));
5206 
5207 	bp->b_iodone = NULL;
5208 
5209 	ip = VTOI(bp->b_pages->p_vnode);
5210 
5211 	mutex_enter(&ip->i_tlock);
5212 	if (ip->i_writes >= ufs_LW) {
5213 		if ((ip->i_writes -= bp->b_bcount) <= ufs_LW)
5214 			if (ufs_WRITES)
5215 				cv_broadcast(&ip->i_wrcv); /* wake all up */
5216 	} else {
5217 		ip->i_writes -= bp->b_bcount;
5218 	}
5219 
5220 	mutex_exit(&ip->i_tlock);
5221 	iodone(bp);
5222 }
5223 
5224 /*
5225  * Write out a single page, possibly klustering adjacent
5226  * dirty pages.  The inode lock must be held.
5227  *
5228  * LMXXX - bsize < pagesize not done.
5229  */
5230 /*ARGSUSED*/
5231 int
5232 ufs_putapage(
5233 	struct vnode *vp,
5234 	page_t *pp,
5235 	u_offset_t *offp,
5236 	size_t *lenp,		/* return values */
5237 	int flags,
5238 	struct cred *cr)
5239 {
5240 	u_offset_t io_off;
5241 	u_offset_t off;
5242 	struct inode *ip = VTOI(vp);
5243 	struct ufsvfs *ufsvfsp = ip->i_ufsvfs;
5244 	struct fs *fs;
5245 	struct buf *bp;
5246 	size_t io_len;
5247 	daddr_t bn;
5248 	int err;
5249 	int contig;
5250 	int dotrans;
5251 
5252 	ASSERT(RW_LOCK_HELD(&ip->i_contents));
5253 
5254 	if (ufsvfsp == NULL) {
5255 		err = EIO;
5256 		goto out_trace;
5257 	}
5258 
5259 	fs = ip->i_fs;
5260 	ASSERT(fs->fs_ronly == 0);
5261 
5262 	/*
5263 	 * If the modified time on the inode has not already been
5264 	 * set elsewhere (e.g. for write) we set the time now.
5265 	 * This gives us approximate modified times for mmap'ed files
5266 	 * which are modified via stores in the user address space.
5267 	 * We _will_ override timestamps from setattr here, because
5268 	 * these can be arbitrary, not "approximate" (anywhere close
5269 	 * to "now"). So check whether the last timestamp update on
5270 	 * this file came from setattr.
5271 	 */
5272 	if ((ip->i_flag & IMODTIME) == 0 ||
5273 	    (ip->i_mtime.tv_sec == ip->i_mtime_last.tv_sec &&
5274 	    ip->i_mtime.tv_usec == ip->i_mtime_last.tv_usec)) {
5275 		mutex_enter(&ip->i_tlock);
5276 		ip->i_flag &= ~IMODTIME;
5277 		ip->i_flag |= IUPD;
5278 		ip->i_seq++;
5279 		ITIMES_NOLOCK(ip);
5280 		mutex_exit(&ip->i_tlock);
5281 	}
5282 
5283 	/*
5284 	 * Align the request to a block boundry (for old file systems),
5285 	 * and go ask bmap() how contiguous things are for this file.
5286 	 */
5287 	off = pp->p_offset & (offset_t)fs->fs_bmask;	/* block align it */
5288 	contig = 0;
5289 	err = bmap_read(ip, off, &bn, &contig);
5290 	if (err)
5291 		goto out;
5292 	if (bn == UFS_HOLE) {			/* putpage never allocates */
5293 		/*
5294 		 * logging device is in error mode; simply return EIO
5295 		 */
5296 		if (TRANS_ISERROR(ufsvfsp)) {
5297 			err = EIO;
5298 			goto out;
5299 		}
5300 		/*
5301 		 * Oops, the thread in the window in wrip() did some
5302 		 * sort of operation which caused a putpage in the bad
5303 		 * range.  In this case, just return an error which will
5304 		 * cause the software modified bit on the page to set
5305 		 * and the page will get written out again later.
5306 		 */
5307 		if (ip->i_writer == curthread) {
5308 			err = EIO;
5309 			goto out;
5310 		}
5311 		/*
5312 		 * If the pager is trying to push a page in the bad range
5313 		 * just tell him to try again later when things are better.
5314 		 */
5315 		if (flags & B_ASYNC) {
5316 			err = EAGAIN;
5317 			goto out;
5318 		}
5319 		err = ufs_fault(ITOV(ip), "ufs_putapage: bn == UFS_HOLE");
5320 		goto out;
5321 	}
5322 
5323 	/*
5324 	 * If it is an fallocate'd block, reverse the negativity since
5325 	 * we are now writing to it
5326 	 */
5327 	if (ISFALLOCBLK(ip, bn)) {
5328 		err = bmap_set_bn(vp, off, dbtofsb(fs, -bn));
5329 		if (err)
5330 			goto out;
5331 
5332 		bn = -bn;
5333 	}
5334 
5335 	/*
5336 	 * Take the length (of contiguous bytes) passed back from bmap()
5337 	 * and _try_ and get a set of pages covering that extent.
5338 	 */
5339 	pp = pvn_write_kluster(vp, pp, &io_off, &io_len, off, contig, flags);
5340 
5341 	/*
5342 	 * May have run out of memory and not clustered backwards.
5343 	 * off		p_offset
5344 	 * [  pp - 1  ][   pp   ]
5345 	 * [	block		]
5346 	 * We told bmap off, so we have to adjust the bn accordingly.
5347 	 */
5348 	if (io_off > off) {
5349 		bn += btod(io_off - off);
5350 		contig -= (io_off - off);
5351 	}
5352 
5353 	/*
5354 	 * bmap was carefull to tell us the right size so use that.
5355 	 * There might be unallocated frags at the end.
5356 	 * LMXXX - bzero the end of the page?  We must be writing after EOF.
5357 	 */
5358 	if (io_len > contig) {
5359 		ASSERT(io_len - contig < fs->fs_bsize);
5360 		io_len -= (io_len - contig);
5361 	}
5362 
5363 	/*
5364 	 * Handle the case where we are writing the last page after EOF.
5365 	 *
5366 	 * XXX - just a patch for i-mt3.
5367 	 */
5368 	if (io_len == 0) {
5369 		ASSERT(pp->p_offset >=
5370 		    (u_offset_t)(roundup(ip->i_size, PAGESIZE)));
5371 		io_len = PAGESIZE;
5372 	}
5373 
5374 	bp = pageio_setup(pp, io_len, ip->i_devvp, B_WRITE | flags);
5375 
5376 	ULOCKFS_SET_MOD(ITOUL(ip));
5377 
5378 	bp->b_edev = ip->i_dev;
5379 	bp->b_dev = cmpdev(ip->i_dev);
5380 	bp->b_blkno = bn;
5381 	bp->b_un.b_addr = (caddr_t)0;
5382 	bp->b_file = ip->i_vnode;
5383 
5384 	/*
5385 	 * File contents of shadow or quota inodes are metadata, and updates
5386 	 * to these need to be put into a logging transaction. All direct
5387 	 * callers in UFS do that, but fsflush can come here _before_ the
5388 	 * normal codepath, for example on updating ACL information that'd be
5389 	 * ufs_si_store()->ufs_rdwri()->wrip()->segmap_release()->VOP_PUTPAGE()
5390 	 * reaches this point.
5391 	 * We therefore need to test whether a transaction exists, and if not
5392 	 * create one - for fsflush.
5393 	 */
5394 	dotrans =
5395 	    (((ip->i_mode & IFMT) == IFSHAD || ufsvfsp->vfs_qinod == ip) &&
5396 	    ((curthread->t_flag & T_DONTBLOCK) == 0) &&
5397 	    (TRANS_ISTRANS(ufsvfsp)));
5398 
5399 	if (dotrans) {
5400 		curthread->t_flag |= T_DONTBLOCK;
5401 		TRANS_BEGIN_ASYNC(ufsvfsp, TOP_PUTPAGE, TOP_PUTPAGE_SIZE(ip));
5402 	}
5403 	if (TRANS_ISTRANS(ufsvfsp)) {
5404 		if ((ip->i_mode & IFMT) == IFSHAD) {
5405 			TRANS_BUF(ufsvfsp, 0, io_len, bp, DT_SHAD);
5406 		} else if (ufsvfsp->vfs_qinod == ip) {
5407 			TRANS_DELTA(ufsvfsp, ldbtob(bn), bp->b_bcount, DT_QR,
5408 			    0, 0);
5409 		}
5410 	}
5411 	if (dotrans) {
5412 		TRANS_END_ASYNC(ufsvfsp, TOP_PUTPAGE, TOP_PUTPAGE_SIZE(ip));
5413 		curthread->t_flag &= ~T_DONTBLOCK;
5414 	}
5415 
5416 	/* write throttle */
5417 
5418 	ASSERT(bp->b_iodone == NULL);
5419 	bp->b_iodone = (int (*)())ufs_iodone;
5420 	mutex_enter(&ip->i_tlock);
5421 	ip->i_writes += bp->b_bcount;
5422 	mutex_exit(&ip->i_tlock);
5423 
5424 	if (bp->b_flags & B_ASYNC) {
5425 		if (ufsvfsp->vfs_log) {
5426 			lufs_write_strategy(ufsvfsp->vfs_log, bp);
5427 		} else if (ufsvfsp->vfs_snapshot) {
5428 			fssnap_strategy(&ufsvfsp->vfs_snapshot, bp);
5429 		} else {
5430 			ufsvfsp->vfs_iotstamp = lbolt;
5431 			ub.ub_putasyncs.value.ul++;
5432 			(void) bdev_strategy(bp);
5433 			lwp_stat_update(LWP_STAT_OUBLK, 1);
5434 		}
5435 	} else {
5436 		if (ufsvfsp->vfs_log) {
5437 			lufs_write_strategy(ufsvfsp->vfs_log, bp);
5438 		} else if (ufsvfsp->vfs_snapshot) {
5439 			fssnap_strategy(&ufsvfsp->vfs_snapshot, bp);
5440 		} else {
5441 			ufsvfsp->vfs_iotstamp = lbolt;
5442 			ub.ub_putsyncs.value.ul++;
5443 			(void) bdev_strategy(bp);
5444 			lwp_stat_update(LWP_STAT_OUBLK, 1);
5445 		}
5446 		err = biowait(bp);
5447 		pageio_done(bp);
5448 		pvn_write_done(pp, ((err) ? B_ERROR : 0) | B_WRITE | flags);
5449 	}
5450 
5451 	pp = NULL;
5452 
5453 out:
5454 	if (err != 0 && pp != NULL)
5455 		pvn_write_done(pp, B_ERROR | B_WRITE | flags);
5456 
5457 	if (offp)
5458 		*offp = io_off;
5459 	if (lenp)
5460 		*lenp = io_len;
5461 out_trace:
5462 	return (err);
5463 }
5464 
5465 /* ARGSUSED */
5466 static int
5467 ufs_map(struct vnode *vp,
5468 	offset_t off,
5469 	struct as *as,
5470 	caddr_t *addrp,
5471 	size_t len,
5472 	uchar_t prot,
5473 	uchar_t maxprot,
5474 	uint_t flags,
5475 	struct cred *cr)
5476 {
5477 	struct segvn_crargs vn_a;
5478 	struct ufsvfs *ufsvfsp = VTOI(vp)->i_ufsvfs;
5479 	struct ulockfs *ulp;
5480 	int error;
5481 
5482 retry_map:
5483 	error = ufs_lockfs_begin(ufsvfsp, &ulp, ULOCKFS_MAP_MASK);
5484 	if (error)
5485 		goto out;
5486 
5487 	if (vp->v_flag & VNOMAP) {
5488 		error = ENOSYS;
5489 		goto unlock;
5490 	}
5491 
5492 	if (off < (offset_t)0 || (offset_t)(off + len) < (offset_t)0) {
5493 		error = ENXIO;
5494 		goto unlock;
5495 	}
5496 
5497 	if (vp->v_type != VREG) {
5498 		error = ENODEV;
5499 		goto unlock;
5500 	}
5501 
5502 	/*
5503 	 * If file is being locked, disallow mapping.
5504 	 */
5505 	if (vn_has_mandatory_locks(vp, VTOI(vp)->i_mode)) {
5506 		error = EAGAIN;
5507 		goto unlock;
5508 	}
5509 
5510 	as_rangelock(as);
5511 	if ((flags & MAP_FIXED) == 0) {
5512 		map_addr(addrp, len, off, 1, flags);
5513 		if (*addrp == NULL) {
5514 			as_rangeunlock(as);
5515 			error = ENOMEM;
5516 			goto unlock;
5517 		}
5518 	} else {
5519 		/*
5520 		 * User specified address - blow away any previous mappings
5521 		 */
5522 		(void) as_unmap(as, *addrp, len);
5523 	}
5524 
5525 	vn_a.vp = vp;
5526 	vn_a.offset = (u_offset_t)off;
5527 	vn_a.type = flags & MAP_TYPE;
5528 	vn_a.prot = prot;
5529 	vn_a.maxprot = maxprot;
5530 	vn_a.cred = cr;
5531 	vn_a.amp = NULL;
5532 	vn_a.flags = flags & ~MAP_TYPE;
5533 	vn_a.szc = 0;
5534 	vn_a.lgrp_mem_policy_flags = 0;
5535 
5536 retry_lock:
5537 	if (!AS_LOCK_TRYENTER(ias, &as->a_lock, RW_WRITER)) {
5538 		/*
5539 		 * We didn't get the lock. Check if the SLOCK is set in the
5540 		 * ufsvfs. If yes, we might be in a deadlock. Safer to give up
5541 		 * and wait for SLOCK to be cleared.
5542 		 */
5543 
5544 		if (ulp && ULOCKFS_IS_SLOCK(ulp)) {
5545 			as_rangeunlock(as);
5546 			ufs_lockfs_end(ulp);
5547 			goto retry_map;
5548 		} else {
5549 			/*
5550 			 * SLOCK isn't set so this is a genuine synchronization
5551 			 * case. Let's try again after giving them a breather.
5552 			 */
5553 			delay(RETRY_LOCK_DELAY);
5554 			goto  retry_lock;
5555 		}
5556 	}
5557 	error = as_map_locked(as, *addrp, len, segvn_create, &vn_a);
5558 	as_rangeunlock(as);
5559 
5560 unlock:
5561 	if (ulp) {
5562 		ufs_lockfs_end(ulp);
5563 	}
5564 out:
5565 	return (error);
5566 }
5567 
5568 /* ARGSUSED */
5569 static int
5570 ufs_addmap(struct vnode *vp,
5571 	offset_t off,
5572 	struct as *as,
5573 	caddr_t addr,
5574 	size_t	len,
5575 	uchar_t  prot,
5576 	uchar_t  maxprot,
5577 	uint_t    flags,
5578 	struct cred *cr)
5579 {
5580 	struct inode *ip = VTOI(vp);
5581 
5582 	if (vp->v_flag & VNOMAP) {
5583 		return (ENOSYS);
5584 	}
5585 
5586 	mutex_enter(&ip->i_tlock);
5587 	ip->i_mapcnt += btopr(len);
5588 	mutex_exit(&ip->i_tlock);
5589 	return (0);
5590 }
5591 
5592 /*ARGSUSED*/
5593 static int
5594 ufs_delmap(struct vnode *vp, offset_t off, struct as *as, caddr_t addr,
5595 	size_t len, uint_t prot,  uint_t maxprot,  uint_t flags,
5596 	struct cred *cr)
5597 {
5598 	struct inode *ip = VTOI(vp);
5599 
5600 	if (vp->v_flag & VNOMAP) {
5601 		return (ENOSYS);
5602 	}
5603 
5604 	mutex_enter(&ip->i_tlock);
5605 
5606 	ip->i_mapcnt -= btopr(len); 	/* Count released mappings */
5607 	ASSERT(ip->i_mapcnt >= 0);
5608 
5609 	/*
5610 	 * If there are cached pages on this vnode, a timestamp update
5611 	 * on the next fsflush run might be required to preserve mmap
5612 	 * semantics for mtime/atime updates.
5613 	 * We have to force this by clearing the IMODTIME flag here.
5614 	 */
5615 	if ((flags & MAP_SHARED) && (prot & PROT_WRITE) &&
5616 	    vn_has_cached_data(vp)) {
5617 		ip->i_flag &= ~IMODTIME;
5618 	}
5619 
5620 	mutex_exit(&ip->i_tlock);
5621 	return (0);
5622 }
5623 /*
5624  * Return the answer requested to poll() for non-device files
5625  */
5626 struct pollhead ufs_pollhd;
5627 
5628 /* ARGSUSED */
5629 int
5630 ufs_poll(vnode_t *vp, short ev, int any, short *revp, struct pollhead **phpp)
5631 {
5632 	struct ufsvfs	*ufsvfsp;
5633 
5634 	*revp = 0;
5635 	ufsvfsp = VTOI(vp)->i_ufsvfs;
5636 
5637 	if (!ufsvfsp) {
5638 		*revp = POLLHUP;
5639 		goto out;
5640 	}
5641 
5642 	if (ULOCKFS_IS_HLOCK(&ufsvfsp->vfs_ulockfs) ||
5643 	    ULOCKFS_IS_ELOCK(&ufsvfsp->vfs_ulockfs)) {
5644 		*revp |= POLLERR;
5645 
5646 	} else {
5647 		if ((ev & POLLOUT) && !ufsvfsp->vfs_fs->fs_ronly &&
5648 		    !ULOCKFS_IS_WLOCK(&ufsvfsp->vfs_ulockfs))
5649 			*revp |= POLLOUT;
5650 
5651 		if ((ev & POLLWRBAND) && !ufsvfsp->vfs_fs->fs_ronly &&
5652 		    !ULOCKFS_IS_WLOCK(&ufsvfsp->vfs_ulockfs))
5653 			*revp |= POLLWRBAND;
5654 
5655 		if (ev & POLLIN)
5656 			*revp |= POLLIN;
5657 
5658 		if (ev & POLLRDNORM)
5659 			*revp |= POLLRDNORM;
5660 
5661 		if (ev & POLLRDBAND)
5662 			*revp |= POLLRDBAND;
5663 	}
5664 
5665 	if ((ev & POLLPRI) && (*revp & (POLLERR|POLLHUP)))
5666 		*revp |= POLLPRI;
5667 out:
5668 	*phpp = !any && !*revp ? &ufs_pollhd : (struct pollhead *)NULL;
5669 
5670 	return (0);
5671 }
5672 
5673 /* ARGSUSED */
5674 static int
5675 ufs_l_pathconf(struct vnode *vp, int cmd, ulong_t *valp, struct cred *cr)
5676 {
5677 	struct ufsvfs	*ufsvfsp = VTOI(vp)->i_ufsvfs;
5678 	struct ulockfs	*ulp = NULL;
5679 	struct inode 	*sip = NULL;
5680 	int		error;
5681 	struct inode 	*ip = VTOI(vp);
5682 	int		issync;
5683 
5684 	error = ufs_lockfs_begin(ufsvfsp, &ulp, ULOCKFS_PATHCONF_MASK);
5685 	if (error)
5686 		return (error);
5687 
5688 	switch (cmd) {
5689 		/*
5690 		 * Have to handle _PC_NAME_MAX here, because the normal way
5691 		 * [fs_pathconf() -> VOP_STATVFS() -> ufs_statvfs()]
5692 		 * results in a lock ordering reversal between
5693 		 * ufs_lockfs_{begin,end}() and
5694 		 * ufs_thread_{suspend,continue}().
5695 		 *
5696 		 * Keep in sync with ufs_statvfs().
5697 		 */
5698 	case _PC_NAME_MAX:
5699 		*valp = MAXNAMLEN;
5700 		break;
5701 
5702 	case _PC_FILESIZEBITS:
5703 		if (ufsvfsp->vfs_lfflags & UFS_LARGEFILES)
5704 			*valp = UFS_FILESIZE_BITS;
5705 		else
5706 			*valp = 32;
5707 		break;
5708 
5709 	case _PC_XATTR_EXISTS:
5710 		if (vp->v_vfsp->vfs_flag & VFS_XATTR) {
5711 
5712 			error =
5713 			    ufs_xattr_getattrdir(vp, &sip, LOOKUP_XATTR, cr);
5714 			if (error ==  0 && sip != NULL) {
5715 				/* Start transaction */
5716 				if (ulp) {
5717 					TRANS_BEGIN_CSYNC(ufsvfsp, issync,
5718 					    TOP_RMDIR, TOP_RMDIR_SIZE);
5719 				}
5720 				/*
5721 				 * Is directory empty
5722 				 */
5723 				rw_enter(&sip->i_rwlock, RW_WRITER);
5724 				rw_enter(&sip->i_contents, RW_WRITER);
5725 				if (ufs_xattrdirempty(sip,
5726 				    sip->i_number, CRED())) {
5727 					rw_enter(&ip->i_contents, RW_WRITER);
5728 					ufs_unhook_shadow(ip, sip);
5729 					rw_exit(&ip->i_contents);
5730 
5731 					*valp = 0;
5732 
5733 				} else
5734 					*valp = 1;
5735 				rw_exit(&sip->i_contents);
5736 				rw_exit(&sip->i_rwlock);
5737 				if (ulp) {
5738 					TRANS_END_CSYNC(ufsvfsp, error, issync,
5739 					    TOP_RMDIR, TOP_RMDIR_SIZE);
5740 				}
5741 				VN_RELE(ITOV(sip));
5742 			} else if (error == ENOENT) {
5743 				*valp = 0;
5744 				error = 0;
5745 			}
5746 		} else {
5747 			error = fs_pathconf(vp, cmd, valp, cr);
5748 		}
5749 		break;
5750 
5751 	case _PC_ACL_ENABLED:
5752 		*valp = _ACL_ACLENT_ENABLED;
5753 		break;
5754 
5755 	case _PC_MIN_HOLE_SIZE:
5756 		*valp = (ulong_t)ip->i_fs->fs_bsize;
5757 		break;
5758 
5759 	default:
5760 		error = fs_pathconf(vp, cmd, valp, cr);
5761 	}
5762 
5763 	if (ulp != NULL) {
5764 		ufs_lockfs_end(ulp);
5765 	}
5766 	return (error);
5767 }
5768 
5769 int ufs_pageio_writes, ufs_pageio_reads;
5770 
5771 /*ARGSUSED*/
5772 static int
5773 ufs_pageio(struct vnode *vp, page_t *pp, u_offset_t io_off, size_t io_len,
5774 	int flags, struct cred *cr)
5775 {
5776 	struct inode *ip = VTOI(vp);
5777 	struct ufsvfs *ufsvfsp;
5778 	page_t *npp = NULL, *opp = NULL, *cpp = pp;
5779 	struct buf *bp;
5780 	daddr_t bn;
5781 	size_t done_len = 0, cur_len = 0;
5782 	int err = 0;
5783 	int contig = 0;
5784 	int dolock;
5785 	int vmpss = 0;
5786 	struct ulockfs *ulp;
5787 
5788 	if ((flags & B_READ) && pp != NULL && pp->p_vnode == vp &&
5789 	    vp->v_mpssdata != NULL) {
5790 		vmpss = 1;
5791 	}
5792 
5793 	dolock = (rw_owner(&ip->i_contents) != curthread);
5794 	/*
5795 	 * We need a better check.  Ideally, we would use another
5796 	 * vnodeops so that hlocked and forcibly unmounted file
5797 	 * systems would return EIO where appropriate and w/o the
5798 	 * need for these checks.
5799 	 */
5800 	if ((ufsvfsp = ip->i_ufsvfs) == NULL)
5801 		return (EIO);
5802 
5803 	/*
5804 	 * For vmpss (pp can be NULL) case respect the quiesce protocol.
5805 	 * ul_lock must be taken before locking pages so we can't use it here
5806 	 * if pp is non NULL because segvn already locked pages
5807 	 * SE_EXCL. Instead we rely on the fact that a forced umount or
5808 	 * applying a filesystem lock via ufs_fiolfs() will block in the
5809 	 * implicit call to ufs_flush() until we unlock the pages after the
5810 	 * return to segvn. Other ufs_quiesce() callers keep ufs_quiesce_pend
5811 	 * above 0 until they are done. We have to be careful not to increment
5812 	 * ul_vnops_cnt here after forceful unmount hlocks the file system.
5813 	 *
5814 	 * If pp is NULL use ul_lock to make sure we don't increment
5815 	 * ul_vnops_cnt after forceful unmount hlocks the file system.
5816 	 */
5817 	if (vmpss || pp == NULL) {
5818 		ulp = &ufsvfsp->vfs_ulockfs;
5819 		if (pp == NULL)
5820 			mutex_enter(&ulp->ul_lock);
5821 		if (ulp->ul_fs_lock & ULOCKFS_GETREAD_MASK) {
5822 			if (pp == NULL) {
5823 				mutex_exit(&ulp->ul_lock);
5824 			}
5825 			return (vmpss ? EIO : EINVAL);
5826 		}
5827 		atomic_add_long(&ulp->ul_vnops_cnt, 1);
5828 		if (pp == NULL)
5829 			mutex_exit(&ulp->ul_lock);
5830 		if (ufs_quiesce_pend) {
5831 			if (!atomic_add_long_nv(&ulp->ul_vnops_cnt, -1))
5832 				cv_broadcast(&ulp->ul_cv);
5833 			return (vmpss ? EIO : EINVAL);
5834 		}
5835 	}
5836 
5837 	if (dolock) {
5838 		/*
5839 		 * segvn may call VOP_PAGEIO() instead of VOP_GETPAGE() to
5840 		 * handle a fault against a segment that maps vnode pages with
5841 		 * large mappings.  Segvn creates pages and holds them locked
5842 		 * SE_EXCL during VOP_PAGEIO() call. In this case we have to
5843 		 * use rw_tryenter() to avoid a potential deadlock since in
5844 		 * lock order i_contents needs to be taken first.
5845 		 * Segvn will retry via VOP_GETPAGE() if VOP_PAGEIO() fails.
5846 		 */
5847 		if (!vmpss) {
5848 			rw_enter(&ip->i_contents, RW_READER);
5849 		} else if (!rw_tryenter(&ip->i_contents, RW_READER)) {
5850 			if (!atomic_add_long_nv(&ulp->ul_vnops_cnt, -1))
5851 				cv_broadcast(&ulp->ul_cv);
5852 			return (EDEADLK);
5853 		}
5854 	}
5855 
5856 	/*
5857 	 * Return an error to segvn because the pagefault request is beyond
5858 	 * PAGESIZE rounded EOF.
5859 	 */
5860 	if (vmpss && btopr(io_off + io_len) > btopr(ip->i_size)) {
5861 		if (dolock)
5862 			rw_exit(&ip->i_contents);
5863 		if (!atomic_add_long_nv(&ulp->ul_vnops_cnt, -1))
5864 			cv_broadcast(&ulp->ul_cv);
5865 		return (EFAULT);
5866 	}
5867 
5868 	if (pp == NULL) {
5869 		if (bmap_has_holes(ip)) {
5870 			err = ENOSYS;
5871 		} else {
5872 			err = EINVAL;
5873 		}
5874 		if (dolock)
5875 			rw_exit(&ip->i_contents);
5876 		if (!atomic_add_long_nv(&ulp->ul_vnops_cnt, -1))
5877 			cv_broadcast(&ulp->ul_cv);
5878 		return (err);
5879 	}
5880 
5881 	/*
5882 	 * Break the io request into chunks, one for each contiguous
5883 	 * stretch of disk blocks in the target file.
5884 	 */
5885 	while (done_len < io_len) {
5886 		ASSERT(cpp);
5887 		contig = 0;
5888 		if (err = bmap_read(ip, (u_offset_t)(io_off + done_len),
5889 		    &bn, &contig))
5890 			break;
5891 
5892 		if (bn == UFS_HOLE) {	/* No holey swapfiles */
5893 			if (vmpss) {
5894 				err = EFAULT;
5895 				break;
5896 			}
5897 			err = ufs_fault(ITOV(ip), "ufs_pageio: bn == UFS_HOLE");
5898 			break;
5899 		}
5900 
5901 		cur_len = MIN(io_len - done_len, contig);
5902 		/*
5903 		 * Zero out a page beyond EOF, when the last block of
5904 		 * a file is a UFS fragment so that ufs_pageio() can be used
5905 		 * instead of ufs_getpage() to handle faults against
5906 		 * segvn segments that use large pages.
5907 		 */
5908 		page_list_break(&cpp, &npp, btopr(cur_len));
5909 		if ((flags & B_READ) && (cur_len & PAGEOFFSET)) {
5910 			size_t xlen = cur_len & PAGEOFFSET;
5911 			pagezero(cpp->p_prev, xlen, PAGESIZE - xlen);
5912 		}
5913 
5914 		bp = pageio_setup(cpp, cur_len, ip->i_devvp, flags);
5915 		ASSERT(bp != NULL);
5916 
5917 		bp->b_edev = ip->i_dev;
5918 		bp->b_dev = cmpdev(ip->i_dev);
5919 		bp->b_blkno = bn;
5920 		bp->b_un.b_addr = (caddr_t)0;
5921 		bp->b_file = ip->i_vnode;
5922 
5923 		ufsvfsp->vfs_iotstamp = lbolt;
5924 		ub.ub_pageios.value.ul++;
5925 		if (ufsvfsp->vfs_snapshot)
5926 			fssnap_strategy(&(ufsvfsp->vfs_snapshot), bp);
5927 		else
5928 			(void) bdev_strategy(bp);
5929 
5930 		if (flags & B_READ)
5931 			ufs_pageio_reads++;
5932 		else
5933 			ufs_pageio_writes++;
5934 		if (flags & B_READ)
5935 			lwp_stat_update(LWP_STAT_INBLK, 1);
5936 		else
5937 			lwp_stat_update(LWP_STAT_OUBLK, 1);
5938 		/*
5939 		 * If the request is not B_ASYNC, wait for i/o to complete
5940 		 * and re-assemble the page list to return to the caller.
5941 		 * If it is B_ASYNC we leave the page list in pieces and
5942 		 * cleanup() will dispose of them.
5943 		 */
5944 		if ((flags & B_ASYNC) == 0) {
5945 			err = biowait(bp);
5946 			pageio_done(bp);
5947 			if (err)
5948 				break;
5949 			page_list_concat(&opp, &cpp);
5950 		}
5951 		cpp = npp;
5952 		npp = NULL;
5953 		if (flags & B_READ)
5954 			cur_len = P2ROUNDUP_TYPED(cur_len, PAGESIZE, size_t);
5955 		done_len += cur_len;
5956 	}
5957 	ASSERT(err || (cpp == NULL && npp == NULL && done_len == io_len));
5958 	if (err) {
5959 		if (flags & B_ASYNC) {
5960 			/* Cleanup unprocessed parts of list */
5961 			page_list_concat(&cpp, &npp);
5962 			if (flags & B_READ)
5963 				pvn_read_done(cpp, B_ERROR);
5964 			else
5965 				pvn_write_done(cpp, B_ERROR);
5966 		} else {
5967 			/* Re-assemble list and let caller clean up */
5968 			page_list_concat(&opp, &cpp);
5969 			page_list_concat(&opp, &npp);
5970 		}
5971 	}
5972 
5973 	if (vmpss && !(ip->i_flag & IACC) && !ULOCKFS_IS_NOIACC(ulp) &&
5974 	    ufsvfsp->vfs_fs->fs_ronly == 0 && !ufsvfsp->vfs_noatime) {
5975 		mutex_enter(&ip->i_tlock);
5976 		ip->i_flag |= IACC;
5977 		ITIMES_NOLOCK(ip);
5978 		mutex_exit(&ip->i_tlock);
5979 	}
5980 
5981 	if (dolock)
5982 		rw_exit(&ip->i_contents);
5983 	if (vmpss && !atomic_add_long_nv(&ulp->ul_vnops_cnt, -1))
5984 		cv_broadcast(&ulp->ul_cv);
5985 	return (err);
5986 }
5987 
5988 /*
5989  * Called when the kernel is in a frozen state to dump data
5990  * directly to the device. It uses a private dump data structure,
5991  * set up by dump_ctl, to locate the correct disk block to which to dump.
5992  */
5993 static int
5994 ufs_dump(vnode_t *vp, caddr_t addr, int ldbn, int dblks)
5995 {
5996 	u_offset_t	file_size;
5997 	struct inode    *ip = VTOI(vp);
5998 	struct fs	*fs = ip->i_fs;
5999 	daddr_t		dbn, lfsbn;
6000 	int		disk_blks = fs->fs_bsize >> DEV_BSHIFT;
6001 	int		error = 0;
6002 	int		ndbs, nfsbs;
6003 
6004 	/*
6005 	 * forced unmount case
6006 	 */
6007 	if (ip->i_ufsvfs == NULL)
6008 		return (EIO);
6009 	/*
6010 	 * Validate the inode that it has not been modified since
6011 	 * the dump structure is allocated.
6012 	 */
6013 	mutex_enter(&ip->i_tlock);
6014 	if ((dump_info == NULL) ||
6015 	    (dump_info->ip != ip) ||
6016 	    (dump_info->time.tv_sec != ip->i_mtime.tv_sec) ||
6017 	    (dump_info->time.tv_usec != ip->i_mtime.tv_usec)) {
6018 		mutex_exit(&ip->i_tlock);
6019 		return (-1);
6020 	}
6021 	mutex_exit(&ip->i_tlock);
6022 
6023 	/*
6024 	 * See that the file has room for this write
6025 	 */
6026 	UFS_GET_ISIZE(&file_size, ip);
6027 
6028 	if (ldbtob((offset_t)(ldbn + dblks)) > file_size)
6029 		return (ENOSPC);
6030 
6031 	/*
6032 	 * Find the physical disk block numbers from the dump
6033 	 * private data structure directly and write out the data
6034 	 * in contiguous block lumps
6035 	 */
6036 	while (dblks > 0 && !error) {
6037 		lfsbn = (daddr_t)lblkno(fs, ldbtob((offset_t)ldbn));
6038 		dbn = fsbtodb(fs, dump_info->dblk[lfsbn]) + ldbn % disk_blks;
6039 		nfsbs = 1;
6040 		ndbs = disk_blks - ldbn % disk_blks;
6041 		while (ndbs < dblks && fsbtodb(fs, dump_info->dblk[lfsbn +
6042 		    nfsbs]) == dbn + ndbs) {
6043 			nfsbs++;
6044 			ndbs += disk_blks;
6045 		}
6046 		if (ndbs > dblks)
6047 			ndbs = dblks;
6048 		error = bdev_dump(ip->i_dev, addr, dbn, ndbs);
6049 		addr += ldbtob((offset_t)ndbs);
6050 		dblks -= ndbs;
6051 		ldbn += ndbs;
6052 	}
6053 	return (error);
6054 
6055 }
6056 
6057 /*
6058  * Prepare the file system before and after the dump operation.
6059  *
6060  * action = DUMP_ALLOC:
6061  * Preparation before dump, allocate dump private data structure
6062  * to hold all the direct and indirect block info for dump.
6063  *
6064  * action = DUMP_FREE:
6065  * Clean up after dump, deallocate the dump private data structure.
6066  *
6067  * action = DUMP_SCAN:
6068  * Scan dump_info for *blkp DEV_BSIZE blocks of contig fs space;
6069  * if found, the starting file-relative DEV_BSIZE lbn is written
6070  * to *bklp; that lbn is intended for use with VOP_DUMP()
6071  */
6072 static int
6073 ufs_dumpctl(vnode_t *vp, int action, int *blkp)
6074 {
6075 	struct inode	*ip = VTOI(vp);
6076 	ufsvfs_t	*ufsvfsp = ip->i_ufsvfs;
6077 	struct fs	*fs;
6078 	daddr32_t	*dblk, *storeblk;
6079 	daddr32_t	*nextblk, *endblk;
6080 	struct buf	*bp;
6081 	int		i, entry, entries;
6082 	int		n, ncontig;
6083 
6084 	/*
6085 	 * check for forced unmount
6086 	 */
6087 	if (ufsvfsp == NULL)
6088 		return (EIO);
6089 
6090 	if (action == DUMP_ALLOC) {
6091 		/*
6092 		 * alloc and record dump_info
6093 		 */
6094 		if (dump_info != NULL)
6095 			return (EINVAL);
6096 
6097 		ASSERT(vp->v_type == VREG);
6098 		fs = ufsvfsp->vfs_fs;
6099 
6100 		rw_enter(&ip->i_contents, RW_READER);
6101 
6102 		if (bmap_has_holes(ip)) {
6103 			rw_exit(&ip->i_contents);
6104 			return (EFAULT);
6105 		}
6106 
6107 		/*
6108 		 * calculate and allocate space needed according to i_size
6109 		 */
6110 		entries = (int)lblkno(fs, blkroundup(fs, ip->i_size));
6111 		dump_info = kmem_alloc(sizeof (struct dump) +
6112 		    (entries - 1) * sizeof (daddr32_t), KM_NOSLEEP);
6113 		if (dump_info == NULL) {
6114 			rw_exit(&ip->i_contents);
6115 			return (ENOMEM);
6116 		}
6117 
6118 		/* Start saving the info */
6119 		dump_info->fsbs = entries;
6120 		dump_info->ip = ip;
6121 		storeblk = &dump_info->dblk[0];
6122 
6123 		/* Direct Blocks */
6124 		for (entry = 0; entry < NDADDR && entry < entries; entry++)
6125 			*storeblk++ = ip->i_db[entry];
6126 
6127 		/* Indirect Blocks */
6128 		for (i = 0; i < NIADDR; i++) {
6129 			int error = 0;
6130 
6131 			bp = UFS_BREAD(ufsvfsp,
6132 			    ip->i_dev, fsbtodb(fs, ip->i_ib[i]), fs->fs_bsize);
6133 			if (bp->b_flags & B_ERROR)
6134 				error = EIO;
6135 			else {
6136 				dblk = bp->b_un.b_daddr;
6137 				if ((storeblk = save_dblks(ip, ufsvfsp,
6138 				    storeblk, dblk, i, entries)) == NULL)
6139 					error = EIO;
6140 			}
6141 
6142 			brelse(bp);
6143 
6144 			if (error != 0) {
6145 				kmem_free(dump_info, sizeof (struct dump) +
6146 				    (entries - 1) * sizeof (daddr32_t));
6147 				rw_exit(&ip->i_contents);
6148 				dump_info = NULL;
6149 				return (error);
6150 			}
6151 		}
6152 		/* and time stamp the information */
6153 		mutex_enter(&ip->i_tlock);
6154 		dump_info->time = ip->i_mtime;
6155 		mutex_exit(&ip->i_tlock);
6156 
6157 		rw_exit(&ip->i_contents);
6158 	} else if (action == DUMP_FREE) {
6159 		/*
6160 		 * free dump_info
6161 		 */
6162 		if (dump_info == NULL)
6163 			return (EINVAL);
6164 		entries = dump_info->fsbs - 1;
6165 		kmem_free(dump_info, sizeof (struct dump) +
6166 		    entries * sizeof (daddr32_t));
6167 		dump_info = NULL;
6168 	} else if (action == DUMP_SCAN) {
6169 		/*
6170 		 * scan dump_info
6171 		 */
6172 		if (dump_info == NULL)
6173 			return (EINVAL);
6174 
6175 		dblk = dump_info->dblk;
6176 		nextblk = dblk + 1;
6177 		endblk = dblk + dump_info->fsbs - 1;
6178 		fs = ufsvfsp->vfs_fs;
6179 		ncontig = *blkp >> (fs->fs_bshift - DEV_BSHIFT);
6180 
6181 		/*
6182 		 * scan dblk[] entries; contig fs space is found when:
6183 		 * ((current blkno + frags per block) == next blkno)
6184 		 */
6185 		n = 0;
6186 		while (n < ncontig && dblk < endblk) {
6187 			if ((*dblk + fs->fs_frag) == *nextblk)
6188 				n++;
6189 			else
6190 				n = 0;
6191 			dblk++;
6192 			nextblk++;
6193 		}
6194 
6195 		/*
6196 		 * index is where size bytes of contig space begins;
6197 		 * conversion from index to the file's DEV_BSIZE lbn
6198 		 * is equivalent to:  (index * fs_bsize) / DEV_BSIZE
6199 		 */
6200 		if (n == ncontig) {
6201 			i = (dblk - dump_info->dblk) - ncontig;
6202 			*blkp = i << (fs->fs_bshift - DEV_BSHIFT);
6203 		} else
6204 			return (EFAULT);
6205 	}
6206 	return (0);
6207 }
6208 
6209 /*
6210  * Recursive helper function for ufs_dumpctl().  It follows the indirect file
6211  * system  blocks until it reaches the the disk block addresses, which are
6212  * then stored into the given buffer, storeblk.
6213  */
6214 static daddr32_t *
6215 save_dblks(struct inode *ip, struct ufsvfs *ufsvfsp,  daddr32_t *storeblk,
6216     daddr32_t *dblk, int level, int entries)
6217 {
6218 	struct fs	*fs = ufsvfsp->vfs_fs;
6219 	struct buf	*bp;
6220 	int		i;
6221 
6222 	if (level == 0) {
6223 		for (i = 0; i < NINDIR(fs); i++) {
6224 			if (storeblk - dump_info->dblk >= entries)
6225 				break;
6226 			*storeblk++ = dblk[i];
6227 		}
6228 		return (storeblk);
6229 	}
6230 	for (i = 0; i < NINDIR(fs); i++) {
6231 		if (storeblk - dump_info->dblk >= entries)
6232 			break;
6233 		bp = UFS_BREAD(ufsvfsp,
6234 		    ip->i_dev, fsbtodb(fs, dblk[i]), fs->fs_bsize);
6235 		if (bp->b_flags & B_ERROR) {
6236 			brelse(bp);
6237 			return (NULL);
6238 		}
6239 		storeblk = save_dblks(ip, ufsvfsp, storeblk, bp->b_un.b_daddr,
6240 		    level - 1, entries);
6241 		brelse(bp);
6242 
6243 		if (storeblk == NULL)
6244 			return (NULL);
6245 	}
6246 	return (storeblk);
6247 }
6248 
6249 /* ARGSUSED */
6250 static int
6251 ufs_getsecattr(struct vnode *vp, vsecattr_t *vsap, int flag,
6252 	struct cred *cr)
6253 {
6254 	struct inode	*ip = VTOI(vp);
6255 	struct ulockfs	*ulp;
6256 	struct ufsvfs	*ufsvfsp = ip->i_ufsvfs;
6257 	ulong_t		vsa_mask = vsap->vsa_mask;
6258 	int		err = EINVAL;
6259 
6260 	vsa_mask &= (VSA_ACL | VSA_ACLCNT | VSA_DFACL | VSA_DFACLCNT);
6261 
6262 	/*
6263 	 * Only grab locks if needed - they're not needed to check vsa_mask
6264 	 * or if the mask contains no acl flags.
6265 	 */
6266 	if (vsa_mask != 0) {
6267 		if (err = ufs_lockfs_begin(ufsvfsp, &ulp,
6268 		    ULOCKFS_GETATTR_MASK))
6269 			return (err);
6270 
6271 		rw_enter(&ip->i_contents, RW_READER);
6272 		err = ufs_acl_get(ip, vsap, flag, cr);
6273 		rw_exit(&ip->i_contents);
6274 
6275 		if (ulp)
6276 			ufs_lockfs_end(ulp);
6277 	}
6278 	return (err);
6279 }
6280 
6281 /* ARGSUSED */
6282 static int
6283 ufs_setsecattr(struct vnode *vp, vsecattr_t *vsap, int flag, struct cred *cr)
6284 {
6285 	struct inode	*ip = VTOI(vp);
6286 	struct ulockfs	*ulp = NULL;
6287 	struct ufsvfs	*ufsvfsp = VTOI(vp)->i_ufsvfs;
6288 	ulong_t		vsa_mask = vsap->vsa_mask;
6289 	int		err;
6290 	int		haverwlock = 1;
6291 	int		trans_size;
6292 	int		donetrans = 0;
6293 	int		retry = 1;
6294 
6295 	ASSERT(RW_LOCK_HELD(&ip->i_rwlock));
6296 
6297 	/* Abort now if the request is either empty or invalid. */
6298 	vsa_mask &= (VSA_ACL | VSA_ACLCNT | VSA_DFACL | VSA_DFACLCNT);
6299 	if ((vsa_mask == 0) ||
6300 	    ((vsap->vsa_aclentp == NULL) &&
6301 	    (vsap->vsa_dfaclentp == NULL))) {
6302 		err = EINVAL;
6303 		goto out;
6304 	}
6305 
6306 	/*
6307 	 * Following convention, if this is a directory then we acquire the
6308 	 * inode's i_rwlock after starting a UFS logging transaction;
6309 	 * otherwise, we acquire it beforehand. Since we were called (and
6310 	 * must therefore return) with the lock held, we will have to drop it,
6311 	 * and later reacquire it, if operating on a directory.
6312 	 */
6313 	if (vp->v_type == VDIR) {
6314 		rw_exit(&ip->i_rwlock);
6315 		haverwlock = 0;
6316 	} else {
6317 		/* Upgrade the lock if required. */
6318 		if (!rw_write_held(&ip->i_rwlock)) {
6319 			rw_exit(&ip->i_rwlock);
6320 			rw_enter(&ip->i_rwlock, RW_WRITER);
6321 		}
6322 	}
6323 
6324 again:
6325 	ASSERT(!(vp->v_type == VDIR && haverwlock));
6326 	if (err = ufs_lockfs_begin(ufsvfsp, &ulp, ULOCKFS_SETATTR_MASK)) {
6327 		ulp = NULL;
6328 		retry = 0;
6329 		goto out;
6330 	}
6331 
6332 	/*
6333 	 * Check that the file system supports this operation. Note that
6334 	 * ufs_lockfs_begin() will have checked that the file system had
6335 	 * not been forcibly unmounted.
6336 	 */
6337 	if (ufsvfsp->vfs_fs->fs_ronly) {
6338 		err = EROFS;
6339 		goto out;
6340 	}
6341 	if (ufsvfsp->vfs_nosetsec) {
6342 		err = ENOSYS;
6343 		goto out;
6344 	}
6345 
6346 	if (ulp) {
6347 		TRANS_BEGIN_ASYNC(ufsvfsp, TOP_SETSECATTR,
6348 		    trans_size = TOP_SETSECATTR_SIZE(VTOI(vp)));
6349 		donetrans = 1;
6350 	}
6351 
6352 	if (vp->v_type == VDIR) {
6353 		rw_enter(&ip->i_rwlock, RW_WRITER);
6354 		haverwlock = 1;
6355 	}
6356 
6357 	ASSERT(haverwlock);
6358 
6359 	/* Do the actual work. */
6360 	rw_enter(&ip->i_contents, RW_WRITER);
6361 	/*
6362 	 * Suppress out of inodes messages if we will retry.
6363 	 */
6364 	if (retry)
6365 		ip->i_flag |= IQUIET;
6366 	err = ufs_acl_set(ip, vsap, flag, cr);
6367 	ip->i_flag &= ~IQUIET;
6368 	rw_exit(&ip->i_contents);
6369 
6370 out:
6371 	if (ulp) {
6372 		if (donetrans) {
6373 			/*
6374 			 * top_end_async() can eventually call
6375 			 * top_end_sync(), which can block. We must
6376 			 * therefore observe the lock-ordering protocol
6377 			 * here as well.
6378 			 */
6379 			if (vp->v_type == VDIR) {
6380 				rw_exit(&ip->i_rwlock);
6381 				haverwlock = 0;
6382 			}
6383 			TRANS_END_ASYNC(ufsvfsp, TOP_SETSECATTR, trans_size);
6384 		}
6385 		ufs_lockfs_end(ulp);
6386 	}
6387 	/*
6388 	 * If no inodes available, try scaring a logically-
6389 	 * free one out of the delete queue to someplace
6390 	 * that we can find it.
6391 	 */
6392 	if ((err == ENOSPC) && retry && TRANS_ISTRANS(ufsvfsp)) {
6393 		ufs_delete_drain_wait(ufsvfsp, 1);
6394 		retry = 0;
6395 		if (vp->v_type == VDIR && haverwlock) {
6396 			rw_exit(&ip->i_rwlock);
6397 			haverwlock = 0;
6398 		}
6399 		goto again;
6400 	}
6401 	/*
6402 	 * If we need to reacquire the lock then it is safe to do so
6403 	 * as a reader. This is because ufs_rwunlock(), which will be
6404 	 * called by our caller after we return, does not differentiate
6405 	 * between shared and exclusive locks.
6406 	 */
6407 	if (!haverwlock) {
6408 		ASSERT(vp->v_type == VDIR);
6409 		rw_enter(&ip->i_rwlock, RW_READER);
6410 	}
6411 
6412 	return (err);
6413 }
6414