xref: /titanic_51/usr/src/uts/common/fs/ufs/ufs_vnops.c (revision 1a7c1b724419d3cb5fa6eea75123c6b2060ba31b)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License, Version 1.0 only
6  * (the "License").  You may not use this file except in compliance
7  * with the License.
8  *
9  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
10  * or http://www.opensolaris.org/os/licensing.
11  * See the License for the specific language governing permissions
12  * and limitations under the License.
13  *
14  * When distributing Covered Code, include this CDDL HEADER in each
15  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
16  * If applicable, add the following below this CDDL HEADER, with the
17  * fields enclosed by brackets "[]" replaced with your own identifying
18  * information: Portions Copyright [yyyy] [name of copyright owner]
19  *
20  * CDDL HEADER END
21  */
22 /*
23  * Copyright 2005 Sun Microsystems, Inc.  All rights reserved.
24  * Use is subject to license terms.
25  */
26 
27 /*	Copyright (c) 1983, 1984, 1985, 1986, 1987, 1988, 1989 AT&T	*/
28 /*	  All Rights Reserved  	*/
29 
30 /*
31  * Portions of this source code were derived from Berkeley 4.3 BSD
32  * under license from the Regents of the University of California.
33  */
34 
35 #pragma ident	"%Z%%M%	%I%	%E% SMI"
36 
37 #include <sys/types.h>
38 #include <sys/t_lock.h>
39 #include <sys/ksynch.h>
40 #include <sys/param.h>
41 #include <sys/time.h>
42 #include <sys/systm.h>
43 #include <sys/sysmacros.h>
44 #include <sys/resource.h>
45 #include <sys/signal.h>
46 #include <sys/cred.h>
47 #include <sys/user.h>
48 #include <sys/buf.h>
49 #include <sys/vfs.h>
50 #include <sys/vnode.h>
51 #include <sys/proc.h>
52 #include <sys/disp.h>
53 #include <sys/file.h>
54 #include <sys/fcntl.h>
55 #include <sys/flock.h>
56 #include <sys/kmem.h>
57 #include <sys/uio.h>
58 #include <sys/dnlc.h>
59 #include <sys/conf.h>
60 #include <sys/mman.h>
61 #include <sys/pathname.h>
62 #include <sys/debug.h>
63 #include <sys/vmsystm.h>
64 #include <sys/cmn_err.h>
65 #include <sys/vtrace.h>
66 #include <sys/filio.h>
67 #include <sys/policy.h>
68 
69 #include <sys/fs/ufs_fs.h>
70 #include <sys/fs/ufs_lockfs.h>
71 #include <sys/fs/ufs_filio.h>
72 #include <sys/fs/ufs_inode.h>
73 #include <sys/fs/ufs_fsdir.h>
74 #include <sys/fs/ufs_quota.h>
75 #include <sys/fs/ufs_log.h>
76 #include <sys/fs/ufs_snap.h>
77 #include <sys/fs/ufs_trans.h>
78 #include <sys/fs/ufs_panic.h>
79 #include <sys/fs/ufs_bio.h>
80 #include <sys/dirent.h>		/* must be AFTER <sys/fs/fsdir.h>! */
81 #include <sys/errno.h>
82 #include <sys/fssnap_if.h>
83 #include <sys/unistd.h>
84 #include <sys/sunddi.h>
85 
86 #include <sys/filio.h>		/* _FIOIO */
87 
88 #include <vm/hat.h>
89 #include <vm/page.h>
90 #include <vm/pvn.h>
91 #include <vm/as.h>
92 #include <vm/seg.h>
93 #include <vm/seg_map.h>
94 #include <vm/seg_vn.h>
95 #include <vm/seg_kmem.h>
96 #include <vm/rm.h>
97 #include <sys/swap.h>
98 
99 #include <fs/fs_subr.h>
100 
101 static struct instats ins;
102 
103 static 	int ufs_getpage_ra(struct vnode *, u_offset_t, struct seg *, caddr_t);
104 static	int ufs_getpage_miss(struct vnode *, u_offset_t, size_t, struct seg *,
105 		caddr_t, struct page **, size_t, enum seg_rw, int);
106 static	int ufs_open(struct vnode **, int, struct cred *);
107 static	int ufs_close(struct vnode *, int, int, offset_t, struct cred *);
108 static	int ufs_read(struct vnode *, struct uio *, int, struct cred *,
109 			struct caller_context *);
110 static	int ufs_write(struct vnode *, struct uio *, int, struct cred *,
111 			struct caller_context *);
112 static	int ufs_ioctl(struct vnode *, int, intptr_t, int, struct cred *, int *);
113 static	int ufs_getattr(struct vnode *, struct vattr *, int, struct cred *);
114 static	int ufs_setattr(struct vnode *, struct vattr *, int, struct cred *,
115 			caller_context_t *);
116 static	int ufs_access(struct vnode *, int, int, struct cred *);
117 static	int ufs_lookup(struct vnode *, char *, struct vnode **,
118 		struct pathname *, int, struct vnode *, struct cred *);
119 static	int ufs_create(struct vnode *, char *, struct vattr *, enum vcexcl,
120 			int, struct vnode **, struct cred *, int);
121 static	int ufs_remove(struct vnode *, char *, struct cred *);
122 static	int ufs_link(struct vnode *, struct vnode *, char *, struct cred *);
123 static	int ufs_rename(struct vnode *, char *, struct vnode *, char *,
124 			struct cred *);
125 static	int ufs_mkdir(struct vnode *, char *, struct vattr *, struct vnode **,
126 			struct cred *);
127 static	int ufs_rmdir(struct vnode *, char *, struct vnode *, struct cred *);
128 static	int ufs_readdir(struct vnode *, struct uio *, struct cred *, int *);
129 static	int ufs_symlink(struct vnode *, char *, struct vattr *, char *,
130 			struct cred *);
131 static	int ufs_readlink(struct vnode *, struct uio *, struct cred *);
132 static	int ufs_fsync(struct vnode *, int, struct cred *);
133 static	void ufs_inactive(struct vnode *, struct cred *);
134 static	int ufs_fid(struct vnode *, struct fid *);
135 static	int ufs_rwlock(struct vnode *, int, caller_context_t *);
136 static	void ufs_rwunlock(struct vnode *, int, caller_context_t *);
137 static	int ufs_seek(struct vnode *, offset_t, offset_t *);
138 static	int ufs_frlock(struct vnode *, int, struct flock64 *, int, offset_t,
139 			struct flk_callback *, struct cred *);
140 static  int ufs_space(struct vnode *, int, struct flock64 *, int, offset_t,
141 		cred_t *, caller_context_t *);
142 static	int ufs_getpage(struct vnode *, offset_t, size_t, uint_t *,
143 		struct page **, size_t, struct seg *, caddr_t,
144 		enum seg_rw, struct cred *);
145 static	int ufs_putpage(struct vnode *, offset_t, size_t, int, struct cred *);
146 static	int ufs_putpages(struct vnode *, offset_t, size_t, int, struct cred *);
147 static	int ufs_map(struct vnode *, offset_t, struct as *, caddr_t *, size_t,
148 			uchar_t, uchar_t, uint_t, struct cred *);
149 static	int ufs_addmap(struct vnode *, offset_t, struct as *, caddr_t,  size_t,
150 			uchar_t, uchar_t, uint_t, struct cred *);
151 static	int ufs_delmap(struct vnode *, offset_t, struct as *, caddr_t,  size_t,
152 			uint_t, uint_t, uint_t, struct cred *);
153 static	int ufs_poll(vnode_t *, short, int, short *, struct pollhead **);
154 static	int ufs_dump(vnode_t *, caddr_t, int, int);
155 static	int ufs_l_pathconf(struct vnode *, int, ulong_t *, struct cred *);
156 static	int ufs_pageio(struct vnode *, struct page *, u_offset_t, size_t, int,
157 			struct cred *);
158 static	int ufs_dump(vnode_t *, caddr_t, int, int);
159 static	int ufs_dumpctl(vnode_t *, int, int *);
160 static	daddr32_t *save_dblks(struct inode *, struct ufsvfs *, daddr32_t *,
161 			daddr32_t *, int, int);
162 static	int ufs_getsecattr(struct vnode *, vsecattr_t *, int, struct cred *);
163 static	int ufs_setsecattr(struct vnode *, vsecattr_t *, int, struct cred *);
164 
165 /*
166  * For lockfs: ulockfs begin/end is now inlined in the ufs_xxx functions.
167  *
168  * XXX - ULOCKFS in fs_pathconf and ufs_ioctl is not inlined yet.
169  */
170 struct vnodeops *ufs_vnodeops;
171 
172 const fs_operation_def_t ufs_vnodeops_template[] = {
173 	VOPNAME_OPEN, ufs_open,	/* will not be blocked by lockfs */
174 	VOPNAME_CLOSE, ufs_close,	/* will not be blocked by lockfs */
175 	VOPNAME_READ, ufs_read,
176 	VOPNAME_WRITE, ufs_write,
177 	VOPNAME_IOCTL, ufs_ioctl,
178 	VOPNAME_GETATTR, ufs_getattr,
179 	VOPNAME_SETATTR, ufs_setattr,
180 	VOPNAME_ACCESS, ufs_access,
181 	VOPNAME_LOOKUP, ufs_lookup,
182 	VOPNAME_CREATE, ufs_create,
183 	VOPNAME_REMOVE, ufs_remove,
184 	VOPNAME_LINK, ufs_link,
185 	VOPNAME_RENAME, ufs_rename,
186 	VOPNAME_MKDIR, ufs_mkdir,
187 	VOPNAME_RMDIR, ufs_rmdir,
188 	VOPNAME_READDIR, ufs_readdir,
189 	VOPNAME_SYMLINK, ufs_symlink,
190 	VOPNAME_READLINK, ufs_readlink,
191 	VOPNAME_FSYNC, ufs_fsync,
192 	VOPNAME_INACTIVE, (fs_generic_func_p) ufs_inactive,  /* not blocked */
193 	VOPNAME_FID, ufs_fid,
194 	VOPNAME_RWLOCK, ufs_rwlock, /* not blocked */
195 	VOPNAME_RWUNLOCK, (fs_generic_func_p) ufs_rwunlock,  /* not blocked */
196 	VOPNAME_SEEK, ufs_seek,
197 	VOPNAME_FRLOCK, ufs_frlock,
198 	VOPNAME_SPACE, ufs_space,
199 	VOPNAME_GETPAGE, ufs_getpage,
200 	VOPNAME_PUTPAGE, ufs_putpage,
201 	VOPNAME_MAP, (fs_generic_func_p) ufs_map,
202 	VOPNAME_ADDMAP, (fs_generic_func_p) ufs_addmap,	/* not blocked */
203 	VOPNAME_DELMAP, ufs_delmap,	/* will not be blocked by lockfs */
204 	VOPNAME_POLL, (fs_generic_func_p) ufs_poll,	/* not blocked */
205 	VOPNAME_DUMP, ufs_dump,
206 	VOPNAME_PATHCONF, ufs_l_pathconf,
207 	VOPNAME_PAGEIO, ufs_pageio,
208 	VOPNAME_DUMPCTL, ufs_dumpctl,
209 	VOPNAME_GETSECATTR, ufs_getsecattr,
210 	VOPNAME_SETSECATTR, ufs_setsecattr,
211 	VOPNAME_VNEVENT, fs_vnevent_support,
212 	NULL, NULL
213 };
214 
215 #define	MAX_BACKFILE_COUNT	9999
216 
217 /*
218  * Created by ufs_dumpctl() to store a file's disk block info into memory.
219  * Used by ufs_dump() to dump data to disk directly.
220  */
221 struct dump {
222 	struct inode	*ip;		/* the file we contain */
223 	daddr_t		fsbs;		/* number of blocks stored */
224 	struct timeval32 time;		/* time stamp for the struct */
225 	daddr32_t 	dblk[1];	/* place holder for block info */
226 };
227 
228 static struct dump *dump_info = NULL;
229 
230 /*
231  * Previously there was no special action required for ordinary files.
232  * (Devices are handled through the device file system.)
233  * Now we support Large Files and Large File API requires open to
234  * fail if file is large.
235  * We could take care to prevent data corruption
236  * by doing an atomic check of size and truncate if file is opened with
237  * FTRUNC flag set but traditionally this is being done by the vfs/vnode
238  * layers. So taking care of truncation here is a change in the existing
239  * semantics of VOP_OPEN and therefore we chose not to implement any thing
240  * here. The check for the size of the file > 2GB is being done at the
241  * vfs layer in routine vn_open().
242  */
243 
244 /* ARGSUSED */
245 static int
246 ufs_open(struct vnode **vpp, int flag, struct cred *cr)
247 {
248 	TRACE_1(TR_FAC_UFS, TR_UFS_OPEN, "ufs_open:vpp %p", vpp);
249 	return (0);
250 }
251 
252 /*ARGSUSED*/
253 static int
254 ufs_close(struct vnode *vp, int flag, int count, offset_t offset,
255 	struct cred *cr)
256 {
257 	TRACE_1(TR_FAC_UFS, TR_UFS_CLOSE, "ufs_close:vp %p", vp);
258 
259 	cleanlocks(vp, ttoproc(curthread)->p_pid, 0);
260 	cleanshares(vp, ttoproc(curthread)->p_pid);
261 
262 	/*
263 	 * Push partially filled cluster at last close.
264 	 * ``last close'' is approximated because the dnlc
265 	 * may have a hold on the vnode.
266 	 * Checking for VBAD here will also act as a forced umount check.
267 	 */
268 	if (vp->v_count <= 2 && vp->v_type != VBAD) {
269 		struct inode *ip = VTOI(vp);
270 		if (ip->i_delaylen) {
271 			ins.in_poc.value.ul++;
272 			(void) ufs_putpages(vp, ip->i_delayoff, ip->i_delaylen,
273 					B_ASYNC | B_FREE, cr);
274 			ip->i_delaylen = 0;
275 		}
276 	}
277 
278 	return (0);
279 }
280 
281 /*ARGSUSED*/
282 static int
283 ufs_read(struct vnode *vp, struct uio *uiop, int ioflag, struct cred *cr,
284 	struct caller_context *ct)
285 {
286 	struct inode *ip = VTOI(vp);
287 	struct ufsvfs *ufsvfsp;
288 	struct ulockfs *ulp = NULL;
289 	int error = 0;
290 	int intrans = 0;
291 
292 	ASSERT(RW_READ_HELD(&ip->i_rwlock));
293 	TRACE_3(TR_FAC_UFS, TR_UFS_READ_START,
294 		"ufs_read_start:vp %p uiop %p ioflag %x",
295 		vp, uiop, ioflag);
296 
297 	/*
298 	 * Mandatory locking needs to be done before ufs_lockfs_begin()
299 	 * and TRANS_BEGIN_SYNC() calls since mandatory locks can sleep.
300 	 */
301 	if (MANDLOCK(vp, ip->i_mode)) {
302 		/*
303 		 * ufs_getattr ends up being called by chklock
304 		 */
305 		error = chklock(vp, FREAD, uiop->uio_loffset,
306 				uiop->uio_resid, uiop->uio_fmode, ct);
307 		if (error)
308 			goto out;
309 	}
310 
311 	ufsvfsp = ip->i_ufsvfs;
312 	error = ufs_lockfs_begin(ufsvfsp, &ulp, ULOCKFS_READ_MASK);
313 	if (error)
314 		goto out;
315 
316 	/*
317 	 * In the case that a directory is opened for reading as a file
318 	 * (eg "cat .") with the  O_RSYNC, O_SYNC and O_DSYNC flags set.
319 	 * The locking order had to be changed to avoid a deadlock with
320 	 * an update taking place on that directory at the same time.
321 	 */
322 	if ((ip->i_mode & IFMT) == IFDIR) {
323 
324 		rw_enter(&ip->i_contents, RW_READER);
325 		error = rdip(ip, uiop, ioflag, cr);
326 		rw_exit(&ip->i_contents);
327 
328 		if (error) {
329 			if (ulp)
330 				ufs_lockfs_end(ulp);
331 			goto out;
332 		}
333 
334 		if (ulp && (ioflag & FRSYNC) && (ioflag & (FSYNC | FDSYNC)) &&
335 		    TRANS_ISTRANS(ufsvfsp)) {
336 			rw_exit(&ip->i_rwlock);
337 			TRANS_BEGIN_SYNC(ufsvfsp, TOP_READ_SYNC, TOP_READ_SIZE,
338 			    error);
339 			ASSERT(!error);
340 			TRANS_END_SYNC(ufsvfsp, error, TOP_READ_SYNC,
341 			    TOP_READ_SIZE);
342 			rw_enter(&ip->i_rwlock, RW_READER);
343 		}
344 	} else {
345 		/*
346 		 * Only transact reads to files opened for sync-read and
347 		 * sync-write on a file system that is not write locked.
348 		 *
349 		 * The ``not write locked'' check prevents problems with
350 		 * enabling/disabling logging on a busy file system.  E.g.,
351 		 * logging exists at the beginning of the read but does not
352 		 * at the end.
353 		 *
354 		 */
355 		if (ulp && (ioflag & FRSYNC) && (ioflag & (FSYNC | FDSYNC)) &&
356 		    TRANS_ISTRANS(ufsvfsp)) {
357 			TRANS_BEGIN_SYNC(ufsvfsp, TOP_READ_SYNC, TOP_READ_SIZE,
358 			    error);
359 			ASSERT(!error);
360 			intrans = 1;
361 		}
362 
363 		rw_enter(&ip->i_contents, RW_READER);
364 		error = rdip(ip, uiop, ioflag, cr);
365 		rw_exit(&ip->i_contents);
366 
367 		if (intrans) {
368 			TRANS_END_SYNC(ufsvfsp, error, TOP_READ_SYNC,
369 			    TOP_READ_SIZE);
370 		}
371 	}
372 
373 	if (ulp) {
374 		ufs_lockfs_end(ulp);
375 	}
376 out:
377 
378 	TRACE_2(TR_FAC_UFS, TR_UFS_READ_END,
379 		"ufs_read_end:vp %p error %d", vp, error);
380 	return (error);
381 }
382 
383 extern	int	ufs_HW;		/* high water mark */
384 extern	int	ufs_LW;		/* low water mark */
385 int	ufs_WRITES = 1;		/* XXX - enable/disable */
386 int	ufs_throttles = 0;	/* throttling count */
387 int	ufs_allow_shared_writes = 1;	/* directio shared writes */
388 
389 static int
390 ufs_check_rewrite(struct inode *ip, struct uio *uiop, int ioflag)
391 {
392 
393 	/*
394 	 * Filter to determine if this request is suitable as a
395 	 * concurrent rewrite. This write must not allocate blocks
396 	 * by extending the file or filling in holes. No use trying
397 	 * through FSYNC descriptors as the inode will be synchronously
398 	 * updated after the write. The uio structure has not yet been
399 	 * checked for sanity, so assume nothing.
400 	 */
401 	return (((ip->i_mode & IFMT) == IFREG) && !(ioflag & FAPPEND) &&
402 		(uiop->uio_loffset >= (offset_t)0) &&
403 		(uiop->uio_loffset < ip->i_size) && (uiop->uio_resid > 0) &&
404 		((ip->i_size - uiop->uio_loffset) >= uiop->uio_resid) &&
405 		!(ioflag & FSYNC) && !bmap_has_holes(ip) &&
406 		ufs_allow_shared_writes);
407 }
408 
409 /*ARGSUSED*/
410 static int
411 ufs_write(struct vnode *vp, struct uio *uiop, int ioflag, cred_t *cr,
412 	caller_context_t *ct)
413 {
414 	struct inode *ip = VTOI(vp);
415 	struct ufsvfs *ufsvfsp;
416 	struct ulockfs *ulp;
417 	int retry = 1;
418 	int error, resv, resid = 0;
419 	int directio_status;
420 	int exclusive;
421 	long start_resid = uiop->uio_resid;
422 
423 	TRACE_3(TR_FAC_UFS, TR_UFS_WRITE_START,
424 		"ufs_write_start:vp %p uiop %p ioflag %x",
425 		vp, uiop, ioflag);
426 
427 	ASSERT(RW_LOCK_HELD(&ip->i_rwlock));
428 
429 retry_mandlock:
430 	/*
431 	 * Mandatory locking needs to be done before ufs_lockfs_begin()
432 	 * and TRANS_BEGIN_[A]SYNC() calls since mandatory locks can sleep.
433 	 * Check for forced unmounts normally done in ufs_lockfs_begin().
434 	 */
435 	if ((ufsvfsp = ip->i_ufsvfs) == NULL) {
436 		error = EIO;
437 		goto out;
438 	}
439 	if (MANDLOCK(vp, ip->i_mode)) {
440 
441 		ASSERT(RW_WRITE_HELD(&ip->i_rwlock));
442 
443 		/*
444 		 * ufs_getattr ends up being called by chklock
445 		 */
446 		error = chklock(vp, FWRITE, uiop->uio_loffset,
447 				uiop->uio_resid, uiop->uio_fmode, ct);
448 		if (error)
449 			goto out;
450 	}
451 
452 	/* i_rwlock can change in chklock */
453 	exclusive = rw_write_held(&ip->i_rwlock);
454 
455 	/*
456 	 * Check for fast-path special case of directio re-writes.
457 	 */
458 	if ((ip->i_flag & IDIRECTIO || ufsvfsp->vfs_forcedirectio) &&
459 	    !exclusive && ufs_check_rewrite(ip, uiop, ioflag)) {
460 
461 		error = ufs_lockfs_begin(ufsvfsp, &ulp, ULOCKFS_WRITE_MASK);
462 		if (error)
463 			goto out;
464 
465 		rw_enter(&ip->i_contents, RW_READER);
466 		error = ufs_directio_write(ip, uiop, ioflag, 1, cr,
467 			&directio_status);
468 		if (directio_status == DIRECTIO_SUCCESS) {
469 			uint_t i_flag_save;
470 
471 			if (start_resid != uiop->uio_resid)
472 				error = 0;
473 			/*
474 			 * Special treatment of access times for re-writes.
475 			 * If IMOD is not already set, then convert it
476 			 * to IMODACC for this operation. This defers
477 			 * entering a delta into the log until the inode
478 			 * is flushed. This mimics what is done for read
479 			 * operations and inode access time.
480 			 */
481 			mutex_enter(&ip->i_tlock);
482 			i_flag_save = ip->i_flag;
483 			ip->i_flag |= IUPD | ICHG;
484 			ip->i_seq++;
485 			ITIMES_NOLOCK(ip);
486 			if ((i_flag_save & IMOD) == 0) {
487 				ip->i_flag &= ~IMOD;
488 				ip->i_flag |= IMODACC;
489 			}
490 			mutex_exit(&ip->i_tlock);
491 			rw_exit(&ip->i_contents);
492 			if (ulp)
493 				ufs_lockfs_end(ulp);
494 			goto out;
495 		}
496 		rw_exit(&ip->i_contents);
497 		if (ulp)
498 			ufs_lockfs_end(ulp);
499 	}
500 
501 	if (!exclusive && !rw_tryupgrade(&ip->i_rwlock)) {
502 		rw_exit(&ip->i_rwlock);
503 		rw_enter(&ip->i_rwlock, RW_WRITER);
504 		/*
505 		 * Mandatory locking could have been enabled
506 		 * after dropping the i_rwlock.
507 		 */
508 		if (MANDLOCK(vp, ip->i_mode))
509 			goto retry_mandlock;
510 	}
511 
512 	error = ufs_lockfs_begin(ufsvfsp, &ulp, ULOCKFS_WRITE_MASK);
513 	if (error)
514 		goto out;
515 
516 	/*
517 	 * Amount of log space needed for this write
518 	 */
519 	TRANS_WRITE_RESV(ip, uiop, ulp, &resv, &resid);
520 
521 	/*
522 	 * Throttle writes.
523 	 */
524 	if (ufs_WRITES && (ip->i_writes > ufs_HW)) {
525 		mutex_enter(&ip->i_tlock);
526 		while (ip->i_writes > ufs_HW) {
527 			ufs_throttles++;
528 			cv_wait(&ip->i_wrcv, &ip->i_tlock);
529 		}
530 		mutex_exit(&ip->i_tlock);
531 	}
532 
533 	/*
534 	 * Enter Transaction
535 	 */
536 	if (ioflag & (FSYNC|FDSYNC)) {
537 		if (ulp) {
538 			int terr = 0;
539 			TRANS_BEGIN_SYNC(ufsvfsp, TOP_WRITE_SYNC, resv, terr);
540 			ASSERT(!terr);
541 		}
542 	} else {
543 		if (ulp)
544 			TRANS_BEGIN_ASYNC(ufsvfsp, TOP_WRITE, resv);
545 	}
546 
547 	/*
548 	 * Write the file
549 	 */
550 	rw_enter(&ufsvfsp->vfs_dqrwlock, RW_READER);
551 	rw_enter(&ip->i_contents, RW_WRITER);
552 	if ((ioflag & FAPPEND) != 0 && (ip->i_mode & IFMT) == IFREG) {
553 		/*
554 		 * In append mode start at end of file.
555 		 */
556 		uiop->uio_loffset = ip->i_size;
557 	}
558 
559 	/*
560 	 * Mild optimisation, don't call ufs_trans_write() unless we have to
561 	 * Also, suppress file system full messages if we will retry.
562 	 */
563 	if (retry)
564 		ip->i_flag |= IQUIET;
565 	if (resid) {
566 		TRANS_WRITE(ip, uiop, ioflag, error, ulp, cr, resv, resid);
567 	} else {
568 		error = wrip(ip, uiop, ioflag, cr);
569 	}
570 	ip->i_flag &= ~IQUIET;
571 
572 	rw_exit(&ip->i_contents);
573 	rw_exit(&ufsvfsp->vfs_dqrwlock);
574 
575 	/*
576 	 * Leave Transaction
577 	 */
578 	if (ulp) {
579 		if (ioflag & (FSYNC|FDSYNC)) {
580 			int terr = 0;
581 			TRANS_END_SYNC(ufsvfsp, terr, TOP_WRITE_SYNC, resv);
582 			if (error == 0)
583 				error = terr;
584 		} else {
585 			TRANS_END_ASYNC(ufsvfsp, TOP_WRITE, resv);
586 		}
587 		ufs_lockfs_end(ulp);
588 	}
589 out:
590 	if ((error == ENOSPC) && retry && TRANS_ISTRANS(ufsvfsp)) {
591 		/*
592 		 * Any blocks tied up in pending deletes?
593 		 */
594 		ufs_delete_drain_wait(ufsvfsp, 1);
595 		retry = 0;
596 		goto retry_mandlock;
597 	}
598 
599 	if (error == ENOSPC && (start_resid != uiop->uio_resid))
600 		error = 0;
601 
602 	TRACE_2(TR_FAC_UFS, TR_UFS_WRITE_END,
603 		"ufs_write_end:vp %p error %d", vp, error);
604 	return (error);
605 }
606 
607 /*
608  * Don't cache write blocks to files with the sticky bit set.
609  * Used to keep swap files from blowing the page cache on a server.
610  */
611 int stickyhack = 1;
612 
613 /*
614  * Free behind hacks.  The pager is busted.
615  * XXX - need to pass the information down to writedone() in a flag like B_SEQ
616  * or B_FREE_IF_TIGHT_ON_MEMORY.
617  */
618 int	freebehind = 1;
619 int	smallfile = 32 * 1024;
620 
621 /*
622  * While we should, in most cases, cache the pages for write, we
623  * may also want to cache the pages for read as long as they are
624  * frequently re-usable.
625  *
626  * If cache_read_ahead = 1, the pages for read will go to the tail
627  * of the cache list when they are released, otherwise go to the head.
628  */
629 int	cache_read_ahead = 0;
630 
631 /*
632  * wrip does the real work of write requests for ufs.
633  */
634 int
635 wrip(struct inode *ip, struct uio *uio, int ioflag, struct cred *cr)
636 {
637 	rlim64_t limit = uio->uio_llimit;
638 	u_offset_t off;
639 	u_offset_t old_i_size;
640 	struct fs *fs;
641 	struct vnode *vp;
642 	struct ufsvfs *ufsvfsp;
643 	caddr_t base;
644 	long start_resid = uio->uio_resid;	/* save starting resid */
645 	long premove_resid;			/* resid before uiomove() */
646 	uint_t flags;
647 	int newpage;
648 	int iupdat_flag, directio_status;
649 	int n, on, mapon;
650 	int error, pagecreate;
651 	int do_dqrwlock;		/* drop/reacquire vfs_dqrwlock */
652 	int32_t	iblocks;
653 	int	new_iblocks;
654 
655 	/*
656 	 * ip->i_size is incremented before the uiomove
657 	 * is done on a write.  If the move fails (bad user
658 	 * address) reset ip->i_size.
659 	 * The better way would be to increment ip->i_size
660 	 * only if the uiomove succeeds.
661 	 */
662 	int i_size_changed = 0;
663 	o_mode_t type;
664 	int i_seq_needed = 0;
665 
666 	vp = ITOV(ip);
667 
668 	/*
669 	 * check for forced unmount - should not happen as
670 	 * the request passed the lockfs checks.
671 	 */
672 	if ((ufsvfsp = ip->i_ufsvfs) == NULL)
673 		return (EIO);
674 
675 	fs = ip->i_fs;
676 
677 	TRACE_1(TR_FAC_UFS, TR_UFS_RWIP_START,
678 		"ufs_wrip_start:vp %p", vp);
679 
680 	ASSERT(RW_WRITE_HELD(&ip->i_contents));
681 
682 	/* check for valid filetype */
683 	type = ip->i_mode & IFMT;
684 	if ((type != IFREG) && (type != IFDIR) && (type != IFATTRDIR) &&
685 	    (type != IFLNK) && (type != IFSHAD)) {
686 		return (EIO);
687 	}
688 
689 	/*
690 	 * the actual limit of UFS file size
691 	 * is UFS_MAXOFFSET_T
692 	 */
693 	if (limit == RLIM64_INFINITY || limit > MAXOFFSET_T)
694 		limit = MAXOFFSET_T;
695 
696 	if (uio->uio_loffset >= limit) {
697 		proc_t *p = ttoproc(curthread);
698 
699 		TRACE_2(TR_FAC_UFS, TR_UFS_RWIP_END,
700 			"ufs_wrip_end:vp %p error %d", vp, EINVAL);
701 
702 		mutex_enter(&p->p_lock);
703 		(void) rctl_action(rctlproc_legacy[RLIMIT_FSIZE], p->p_rctls,
704 		    p, RCA_UNSAFE_SIGINFO);
705 		mutex_exit(&p->p_lock);
706 		return (EFBIG);
707 	}
708 
709 	/*
710 	 * if largefiles are disallowed, the limit is
711 	 * the pre-largefiles value of 2GB
712 	 */
713 	if (ufsvfsp->vfs_lfflags & UFS_LARGEFILES)
714 		limit = MIN(UFS_MAXOFFSET_T, limit);
715 	else
716 		limit = MIN(MAXOFF32_T, limit);
717 
718 	if (uio->uio_loffset < (offset_t)0) {
719 		TRACE_2(TR_FAC_UFS, TR_UFS_RWIP_END,
720 			"ufs_wrip_end:vp %p error %d", vp, EINVAL);
721 		return (EINVAL);
722 	}
723 	if (uio->uio_resid == 0) {
724 		TRACE_2(TR_FAC_UFS, TR_UFS_RWIP_END,
725 			"ufs_wrip_end:vp %p error %d", vp, 0);
726 		return (0);
727 	}
728 
729 	if (uio->uio_loffset >= limit)
730 		return (EFBIG);
731 
732 	ip->i_flag |= INOACC;	/* don't update ref time in getpage */
733 
734 	if (ioflag & (FSYNC|FDSYNC)) {
735 		ip->i_flag |= ISYNC;
736 		iupdat_flag = 1;
737 	}
738 	/*
739 	 * Try to go direct
740 	 */
741 	if (ip->i_flag & IDIRECTIO || ufsvfsp->vfs_forcedirectio) {
742 		uio->uio_llimit = limit;
743 		error = ufs_directio_write(ip, uio, ioflag, 0, cr,
744 			&directio_status);
745 		/*
746 		 * If ufs_directio wrote to the file or set the flags,
747 		 * we need to update i_seq, but it may be deferred.
748 		 */
749 		if (start_resid != uio->uio_resid ||
750 					(ip->i_flag & (ICHG|IUPD))) {
751 			i_seq_needed = 1;
752 			ip->i_flag |= ISEQ;
753 		}
754 		if (directio_status == DIRECTIO_SUCCESS)
755 			goto out;
756 	}
757 
758 	/*
759 	 * Behavior with respect to dropping/reacquiring vfs_dqrwlock:
760 	 *
761 	 * o shadow inodes: vfs_dqrwlock is not held at all
762 	 * o quota updates: vfs_dqrwlock is read or write held
763 	 * o other updates: vfs_dqrwlock is read held
764 	 *
765 	 * The first case is the only one where we do not hold
766 	 * vfs_dqrwlock at all while entering wrip().
767 	 * We must make sure not to downgrade/drop vfs_dqrwlock if we
768 	 * have it as writer, i.e. if we are updating the quota inode.
769 	 * There is no potential deadlock scenario in this case as
770 	 * ufs_getpage() takes care of this and avoids reacquiring
771 	 * vfs_dqrwlock in that case.
772 	 *
773 	 * This check is done here since the above conditions do not change
774 	 * and we possibly loop below, so save a few cycles.
775 	 */
776 	if ((type == IFSHAD) ||
777 		(rw_owner(&ufsvfsp->vfs_dqrwlock) == curthread)) {
778 			do_dqrwlock = 0;
779 	} else {
780 		do_dqrwlock = 1;
781 	}
782 
783 	/*
784 	 * Large Files: We cast MAXBMASK to offset_t
785 	 * inorder to mask out the higher bits. Since offset_t
786 	 * is a signed value, the high order bit set in MAXBMASK
787 	 * value makes it do the right thing by having all bits 1
788 	 * in the higher word. May be removed for _SOLARIS64_.
789 	 */
790 
791 	fs = ip->i_fs;
792 	do {
793 		u_offset_t uoff = uio->uio_loffset;
794 		off = uoff & (offset_t)MAXBMASK;
795 		mapon = (int)(uoff & (offset_t)MAXBOFFSET);
796 		on = (int)blkoff(fs, uoff);
797 		n = (int)MIN(fs->fs_bsize - on, uio->uio_resid);
798 		new_iblocks = 1;
799 
800 		if (type == IFREG && uoff + n >= limit) {
801 			if (uoff >= limit) {
802 				error = EFBIG;
803 				goto out;
804 			}
805 			/*
806 			 * since uoff + n >= limit,
807 			 * therefore n >= limit - uoff, and n is an int
808 			 * so it is safe to cast it to an int
809 			 */
810 			n = (int)(limit - (rlim64_t)uoff);
811 		}
812 		if (uoff + n > ip->i_size) {
813 			/*
814 			 * We are extending the length of the file.
815 			 * bmap is used so that we are sure that
816 			 * if we need to allocate new blocks, that it
817 			 * is done here before we up the file size.
818 			 */
819 			error = bmap_write(ip, uoff, (int)(on + n),
820 							mapon == 0, cr);
821 			/*
822 			 * bmap_write never drops i_contents so if
823 			 * the flags are set it changed the file.
824 			 */
825 			if (ip->i_flag & (ICHG|IUPD)) {
826 				i_seq_needed = 1;
827 				ip->i_flag |= ISEQ;
828 			}
829 			if (error)
830 				break;
831 			/*
832 			 * There is a window of vulnerability here.
833 			 * The sequence of operations: allocate file
834 			 * system blocks, uiomove the data into pages,
835 			 * and then update the size of the file in the
836 			 * inode, must happen atomically.  However, due
837 			 * to current locking constraints, this can not
838 			 * be done.
839 			 */
840 			ASSERT(ip->i_writer == NULL);
841 			ip->i_writer = curthread;
842 			i_size_changed = 1;
843 			/*
844 			 * If we are writing from the beginning of
845 			 * the mapping, we can just create the
846 			 * pages without having to read them.
847 			 */
848 			pagecreate = (mapon == 0);
849 		} else if (n == MAXBSIZE) {
850 			/*
851 			 * Going to do a whole mappings worth,
852 			 * so we can just create the pages w/o
853 			 * having to read them in.  But before
854 			 * we do that, we need to make sure any
855 			 * needed blocks are allocated first.
856 			 */
857 			iblocks = ip->i_blocks;
858 			error = bmap_write(ip, uoff, (int)(on + n), 1, cr);
859 			/*
860 			 * bmap_write never drops i_contents so if
861 			 * the flags are set it changed the file.
862 			 */
863 			if (ip->i_flag & (ICHG|IUPD)) {
864 				i_seq_needed = 1;
865 				ip->i_flag |= ISEQ;
866 			}
867 			if (error)
868 				break;
869 			pagecreate = 1;
870 			/*
871 			 * check if the new created page needed the
872 			 * allocation of new disk blocks.
873 			 */
874 			if (iblocks == ip->i_blocks)
875 				new_iblocks = 0; /* no new blocks allocated */
876 		} else {
877 			pagecreate = 0;
878 			/*
879 			 * In sync mode flush the indirect blocks which
880 			 * may have been allocated and not written on
881 			 * disk. In above cases bmap_write will allocate
882 			 * in sync mode.
883 			 */
884 			if (ioflag & (FSYNC|FDSYNC)) {
885 				error = ufs_indirblk_sync(ip, uoff);
886 				if (error)
887 					break;
888 			}
889 		}
890 
891 		/*
892 		 * At this point we can enter ufs_getpage() in one
893 		 * of two ways:
894 		 * 1) segmap_getmapflt() calls ufs_getpage() when the
895 		 *    forcefault parameter is true (pagecreate == 0)
896 		 * 2) uiomove() causes a page fault.
897 		 *
898 		 * We have to drop the contents lock to prevent the VM
899 		 * system from trying to reaquire it in ufs_getpage()
900 		 * should the uiomove cause a pagefault.
901 		 *
902 		 * We have to drop the reader vfs_dqrwlock here as well.
903 		 */
904 		rw_exit(&ip->i_contents);
905 		if (do_dqrwlock) {
906 			ASSERT(RW_LOCK_HELD(&ufsvfsp->vfs_dqrwlock));
907 			ASSERT(!(RW_WRITE_HELD(&ufsvfsp->vfs_dqrwlock)));
908 			rw_exit(&ufsvfsp->vfs_dqrwlock);
909 		}
910 
911 		base = segmap_getmapflt(segkmap, vp, (off + mapon),
912 					(uint_t)n, !pagecreate, S_WRITE);
913 
914 		/*
915 		 * segmap_pagecreate() returns 1 if it calls
916 		 * page_create_va() to allocate any pages.
917 		 */
918 		newpage = 0;
919 
920 		if (pagecreate)
921 			newpage = segmap_pagecreate(segkmap, base,
922 			    (size_t)n, 0);
923 
924 		premove_resid = uio->uio_resid;
925 		error = uiomove(base + mapon, (long)n, UIO_WRITE, uio);
926 
927 		/*
928 		 * If "newpage" is set, then a new page was created and it
929 		 * does not contain valid data, so it needs to be initialized
930 		 * at this point.
931 		 * Otherwise the page contains old data, which was overwritten
932 		 * partially or as a whole in uiomove.
933 		 * If there is only one iovec structure within uio, then
934 		 * on error uiomove will not be able to update uio->uio_loffset
935 		 * and we would zero the whole page here!
936 		 *
937 		 * If uiomove fails because of an error, the old valid data
938 		 * is kept instead of filling the rest of the page with zero's.
939 		 */
940 		if (newpage &&
941 		    uio->uio_loffset < roundup(off + mapon + n, PAGESIZE)) {
942 			/*
943 			 * We created pages w/o initializing them completely,
944 			 * thus we need to zero the part that wasn't set up.
945 			 * This happens on most EOF write cases and if
946 			 * we had some sort of error during the uiomove.
947 			 */
948 			int nzero, nmoved;
949 
950 			nmoved = (int)(uio->uio_loffset - (off + mapon));
951 			ASSERT(nmoved >= 0 && nmoved <= n);
952 			nzero = roundup(on + n, PAGESIZE) - nmoved;
953 			ASSERT(nzero > 0 && mapon + nmoved + nzero <= MAXBSIZE);
954 			(void) kzero(base + mapon + nmoved, (uint_t)nzero);
955 		}
956 
957 		/*
958 		 * Unlock the pages allocated by page_create_va()
959 		 * in segmap_pagecreate()
960 		 */
961 		if (newpage)
962 			segmap_pageunlock(segkmap, base, (size_t)n, S_WRITE);
963 
964 		/*
965 		 * If the size of the file changed, then update the
966 		 * size field in the inode now.  This can't be done
967 		 * before the call to segmap_pageunlock or there is
968 		 * a potential deadlock with callers to ufs_putpage().
969 		 * They will be holding i_contents and trying to lock
970 		 * a page, while this thread is holding a page locked
971 		 * and trying to acquire i_contents.
972 		 */
973 		if (i_size_changed) {
974 			rw_enter(&ip->i_contents, RW_WRITER);
975 			old_i_size = ip->i_size;
976 			UFS_SET_ISIZE(uoff + n, ip);
977 			TRANS_INODE(ufsvfsp, ip);
978 			/*
979 			 * file has grown larger than 2GB. Set flag
980 			 * in superblock to indicate this, if it
981 			 * is not already set.
982 			 */
983 			if ((ip->i_size > MAXOFF32_T) &&
984 			    !(fs->fs_flags & FSLARGEFILES)) {
985 				ASSERT(ufsvfsp->vfs_lfflags & UFS_LARGEFILES);
986 				mutex_enter(&ufsvfsp->vfs_lock);
987 				fs->fs_flags |= FSLARGEFILES;
988 				ufs_sbwrite(ufsvfsp);
989 				mutex_exit(&ufsvfsp->vfs_lock);
990 			}
991 			mutex_enter(&ip->i_tlock);
992 			ip->i_writer = NULL;
993 			cv_broadcast(&ip->i_wrcv);
994 			mutex_exit(&ip->i_tlock);
995 			rw_exit(&ip->i_contents);
996 		}
997 
998 		if (error) {
999 			/*
1000 			 * If we failed on a write, we may have already
1001 			 * allocated file blocks as well as pages.  It's
1002 			 * hard to undo the block allocation, but we must
1003 			 * be sure to invalidate any pages that may have
1004 			 * been allocated.
1005 			 *
1006 			 * If the page was created without initialization
1007 			 * then we must check if it should be possible
1008 			 * to destroy the new page and to keep the old data
1009 			 * on the disk.
1010 			 *
1011 			 * It is possible to destroy the page without
1012 			 * having to write back its contents only when
1013 			 * - the size of the file keeps unchanged
1014 			 * - bmap_write() did not allocate new disk blocks
1015 			 *   it is possible to create big files using "seek" and
1016 			 *   write to the end of the file. A "write" to a
1017 			 *   position before the end of the file would not
1018 			 *   change the size of the file but it would allocate
1019 			 *   new disk blocks.
1020 			 * - uiomove intended to overwrite the whole page.
1021 			 * - a new page was created (newpage == 1).
1022 			 */
1023 
1024 			if (i_size_changed == 0 && new_iblocks == 0 &&
1025 			    newpage) {
1026 
1027 				/* unwind what uiomove eventually last did */
1028 				uio->uio_resid = premove_resid;
1029 
1030 				/*
1031 				 * destroy the page, do not write ambiguous
1032 				 * data to the disk.
1033 				 */
1034 				flags = SM_DESTROY;
1035 			} else {
1036 				/*
1037 				 * write the page back to the disk, if dirty,
1038 				 * and remove the page from the cache.
1039 				 */
1040 				flags = SM_INVAL;
1041 			}
1042 			(void) segmap_release(segkmap, base, flags);
1043 		} else {
1044 			flags = 0;
1045 			/*
1046 			 * Force write back for synchronous write cases.
1047 			 */
1048 			if ((ioflag & (FSYNC|FDSYNC)) || type == IFDIR) {
1049 				/*
1050 				 * If the sticky bit is set but the
1051 				 * execute bit is not set, we do a
1052 				 * synchronous write back and free
1053 				 * the page when done.  We set up swap
1054 				 * files to be handled this way to
1055 				 * prevent servers from keeping around
1056 				 * the client's swap pages too long.
1057 				 * XXX - there ought to be a better way.
1058 				 */
1059 				if (IS_SWAPVP(vp)) {
1060 					flags = SM_WRITE | SM_FREE |
1061 					    SM_DONTNEED;
1062 					iupdat_flag = 0;
1063 				} else {
1064 					flags = SM_WRITE;
1065 				}
1066 			} else if (n + on == MAXBSIZE || IS_SWAPVP(vp)) {
1067 				/*
1068 				 * Have written a whole block.
1069 				 * Start an asynchronous write and
1070 				 * mark the buffer to indicate that
1071 				 * it won't be needed again soon.
1072 				 */
1073 				flags = SM_WRITE | SM_ASYNC | SM_DONTNEED;
1074 			}
1075 			error = segmap_release(segkmap, base, flags);
1076 			/*
1077 			 * If the operation failed and is synchronous,
1078 			 * then we need to unwind what uiomove() last
1079 			 * did so we can potentially return an error to
1080 			 * the caller.  If this write operation was
1081 			 * done in two pieces and the first succeeded,
1082 			 * then we won't return an error for the second
1083 			 * piece that failed.  However, we only want to
1084 			 * return a resid value that reflects what was
1085 			 * really done.
1086 			 *
1087 			 * Failures for non-synchronous operations can
1088 			 * be ignored since the page subsystem will
1089 			 * retry the operation until it succeeds or the
1090 			 * file system is unmounted.
1091 			 */
1092 			if (error) {
1093 				if ((ioflag & (FSYNC | FDSYNC)) ||
1094 				    type == IFDIR) {
1095 					uio->uio_resid = premove_resid;
1096 				} else {
1097 					error = 0;
1098 				}
1099 			}
1100 		}
1101 
1102 		/*
1103 		 * Re-acquire contents lock.
1104 		 * If it was dropped, reacquire reader vfs_dqrwlock as well.
1105 		 */
1106 		if (do_dqrwlock)
1107 			rw_enter(&ufsvfsp->vfs_dqrwlock, RW_READER);
1108 		rw_enter(&ip->i_contents, RW_WRITER);
1109 
1110 		/*
1111 		 * If the uiomove() failed or if a synchronous
1112 		 * page push failed, fix up i_size.
1113 		 */
1114 		if (error) {
1115 			if (i_size_changed) {
1116 				/*
1117 				 * The uiomove failed, and we
1118 				 * allocated blocks,so get rid
1119 				 * of them.
1120 				 */
1121 				(void) ufs_itrunc(ip, old_i_size, 0, cr);
1122 			}
1123 		} else {
1124 			/*
1125 			 * XXX - Can this be out of the loop?
1126 			 */
1127 			ip->i_flag |= IUPD | ICHG;
1128 			/*
1129 			 * Only do one increase of i_seq for multiple
1130 			 * pieces.  Because we drop locks, record
1131 			 * the fact that we changed the timestamp and
1132 			 * are deferring the increase in case another thread
1133 			 * pushes our timestamp update.
1134 			 */
1135 			i_seq_needed = 1;
1136 			ip->i_flag |= ISEQ;
1137 			if (i_size_changed)
1138 				ip->i_flag |= IATTCHG;
1139 			if ((ip->i_mode & (IEXEC | (IEXEC >> 3) |
1140 			    (IEXEC >> 6))) != 0 &&
1141 			    (ip->i_mode & (ISUID | ISGID)) != 0 &&
1142 			    secpolicy_vnode_setid_retain(cr,
1143 			    (ip->i_mode & ISUID) != 0 && ip->i_uid == 0) != 0) {
1144 				/*
1145 				 * Clear Set-UID & Set-GID bits on
1146 				 * successful write if not privileged
1147 				 * and at least one of the execute bits
1148 				 * is set.  If we always clear Set-GID,
1149 				 * mandatory file and record locking is
1150 				 * unuseable.
1151 				 */
1152 				ip->i_mode &= ~(ISUID | ISGID);
1153 			}
1154 		}
1155 		TRANS_INODE(ufsvfsp, ip);
1156 	} while (error == 0 && uio->uio_resid > 0 && n != 0);
1157 
1158 out:
1159 	/*
1160 	 * Make sure i_seq is increased at least once per write
1161 	 */
1162 	if (i_seq_needed) {
1163 		ip->i_seq++;
1164 		ip->i_flag &= ~ISEQ;	/* no longer deferred */
1165 	}
1166 
1167 	/*
1168 	 * Inode is updated according to this table -
1169 	 *
1170 	 *   FSYNC	  FDSYNC(posix.4)
1171 	 *   --------------------------
1172 	 *   always@	  IATTCHG|IBDWRITE
1173 	 *
1174 	 * @ - 	If we are doing synchronous write the only time we should
1175 	 *	not be sync'ing the ip here is if we have the stickyhack
1176 	 *	activated, the file is marked with the sticky bit and
1177 	 *	no exec bit, the file length has not been changed and
1178 	 *	no new blocks have been allocated during this write.
1179 	 */
1180 
1181 	if ((ip->i_flag & ISYNC) != 0) {
1182 		/*
1183 		 * we have eliminated nosync
1184 		 */
1185 		if ((ip->i_flag & (IATTCHG|IBDWRITE)) ||
1186 			((ioflag & FSYNC) && iupdat_flag)) {
1187 			ufs_iupdat(ip, 1);
1188 		}
1189 	}
1190 
1191 	/*
1192 	 * If we've already done a partial-write, terminate
1193 	 * the write but return no error unless the error is ENOSPC
1194 	 * because the caller can detect this and free resources and
1195 	 * try again.
1196 	 */
1197 	if ((start_resid != uio->uio_resid) && (error != ENOSPC))
1198 		error = 0;
1199 
1200 	ip->i_flag &= ~(INOACC | ISYNC);
1201 	ITIMES_NOLOCK(ip);
1202 	TRACE_2(TR_FAC_UFS, TR_UFS_RWIP_END,
1203 		"ufs_wrip_end:vp %p error %d", vp, error);
1204 	return (error);
1205 }
1206 
1207 /*
1208  * rdip does the real work of read requests for ufs.
1209  */
1210 int
1211 rdip(struct inode *ip, struct uio *uio, int ioflag, cred_t *cr)
1212 {
1213 	u_offset_t off;
1214 	caddr_t base;
1215 	struct fs *fs;
1216 	struct ufsvfs *ufsvfsp;
1217 	struct vnode *vp;
1218 	long oresid = uio->uio_resid;
1219 	u_offset_t n, on, mapon;
1220 	int error = 0;
1221 	int doupdate = 1;
1222 	uint_t flags, cachemode;
1223 	int dofree, directio_status;
1224 	krw_t rwtype;
1225 	o_mode_t type;
1226 
1227 	vp = ITOV(ip);
1228 
1229 	TRACE_1(TR_FAC_UFS, TR_UFS_RWIP_START,
1230 		"ufs_rdip_start:vp %p", vp);
1231 
1232 	ASSERT(RW_LOCK_HELD(&ip->i_contents));
1233 
1234 	ufsvfsp = ip->i_ufsvfs;
1235 
1236 	if (ufsvfsp == NULL)
1237 		return (EIO);
1238 
1239 	fs = ufsvfsp->vfs_fs;
1240 
1241 	/* check for valid filetype */
1242 	type = ip->i_mode & IFMT;
1243 	if ((type != IFREG) && (type != IFDIR) && (type != IFATTRDIR) &&
1244 	    (type != IFLNK) && (type != IFSHAD)) {
1245 		return (EIO);
1246 	}
1247 
1248 	if (uio->uio_loffset > UFS_MAXOFFSET_T) {
1249 		TRACE_2(TR_FAC_UFS, TR_UFS_RWIP_END,
1250 			"ufs_rdip_end:vp %p error %d", vp, EINVAL);
1251 		error = 0;
1252 		goto out;
1253 	}
1254 	if (uio->uio_loffset < (offset_t)0) {
1255 		TRACE_2(TR_FAC_UFS, TR_UFS_RWIP_END,
1256 			"ufs_rdip_end:vp %p error %d", vp, EINVAL);
1257 		return (EINVAL);
1258 	}
1259 	if (uio->uio_resid == 0) {
1260 		TRACE_2(TR_FAC_UFS, TR_UFS_RWIP_END,
1261 			"ufs_rdip_end:vp %p error %d", vp, 0);
1262 		return (0);
1263 	}
1264 
1265 	if (!ULOCKFS_IS_NOIACC(ITOUL(ip)) && (fs->fs_ronly == 0) &&
1266 		(!ufsvfsp->vfs_noatime)) {
1267 		mutex_enter(&ip->i_tlock);
1268 		ip->i_flag |= IACC;
1269 		mutex_exit(&ip->i_tlock);
1270 	}
1271 	/*
1272 	 * Try to go direct
1273 	 */
1274 	if (ip->i_flag & IDIRECTIO || ufsvfsp->vfs_forcedirectio) {
1275 		error = ufs_directio_read(ip, uio, cr, &directio_status);
1276 		if (directio_status == DIRECTIO_SUCCESS)
1277 			goto out;
1278 	}
1279 
1280 	rwtype = (rw_write_held(&ip->i_contents)?RW_WRITER:RW_READER);
1281 
1282 	/*
1283 	 * If cache_read_ahead is enabled, we will
1284 	 * release the pages at the tail of the cache
1285 	 * list, otherwise we will put them at the head.
1286 	 */
1287 	if (cache_read_ahead)
1288 		cachemode = SM_FREE | SM_ASYNC;
1289 	else
1290 		cachemode = SM_FREE | SM_DONTNEED | SM_ASYNC;
1291 
1292 	do {
1293 		offset_t diff;
1294 		u_offset_t uoff = uio->uio_loffset;
1295 		off = uoff & (offset_t)MAXBMASK;
1296 		mapon = (u_offset_t)(uoff & (offset_t)MAXBOFFSET);
1297 		on = (u_offset_t)blkoff(fs, uoff);
1298 		n = MIN((u_offset_t)fs->fs_bsize - on,
1299 			(u_offset_t)uio->uio_resid);
1300 
1301 		diff = ip->i_size - uoff;
1302 
1303 		if (diff <= (offset_t)0) {
1304 			error = 0;
1305 			goto out;
1306 		}
1307 		if (diff < (offset_t)n)
1308 			n = (int)diff;
1309 		dofree = freebehind &&
1310 		    ip->i_nextr == (off & PAGEMASK) && off > smallfile;
1311 
1312 		/*
1313 		 * At this point we can enter ufs_getpage() in one of two
1314 		 * ways:
1315 		 * 1) segmap_getmapflt() calls ufs_getpage() when the
1316 		 *    forcefault parameter is true (value of 1 is passed)
1317 		 * 2) uiomove() causes a page fault.
1318 		 *
1319 		 * We cannot hold onto an i_contents reader lock without
1320 		 * risking deadlock in ufs_getpage() so drop a reader lock.
1321 		 * The ufs_getpage() dolock logic already allows for a
1322 		 * thread holding i_contents as writer to work properly
1323 		 * so we keep a writer lock.
1324 		 */
1325 		if (rwtype == RW_READER)
1326 			rw_exit(&ip->i_contents);
1327 		base = segmap_getmapflt(segkmap, vp, (off + mapon),
1328 					(uint_t)n, 1, S_READ);
1329 
1330 		error = uiomove(base + mapon, (long)n, UIO_READ, uio);
1331 
1332 		flags = 0;
1333 		if (!error) {
1334 			/*
1335 			 * If reading sequential we won't need
1336 			 * this buffer again soon.
1337 			 */
1338 			if (dofree) {
1339 				flags = cachemode;
1340 			}
1341 			/*
1342 			 * In POSIX SYNC (FSYNC and FDSYNC) read mode,
1343 			 * we want to make sure that the page which has
1344 			 * been read, is written on disk if it is dirty.
1345 			 * And corresponding indirect blocks should also
1346 			 * be flushed out.
1347 			 */
1348 			if ((ioflag & FRSYNC) && (ioflag & (FSYNC|FDSYNC))) {
1349 				flags &= ~SM_ASYNC;
1350 				flags |= SM_WRITE;
1351 			}
1352 			error = segmap_release(segkmap, base, flags);
1353 		} else
1354 			(void) segmap_release(segkmap, base, flags);
1355 
1356 		if (rwtype == RW_READER)
1357 			rw_enter(&ip->i_contents, rwtype);
1358 	} while (error == 0 && uio->uio_resid > 0 && n != 0);
1359 out:
1360 	/*
1361 	 * Inode is updated according to this table if FRSYNC is set.
1362 	 *
1363 	 *   FSYNC	  FDSYNC(posix.4)
1364 	 *   --------------------------
1365 	 *   always	  IATTCHG|IBDWRITE
1366 	 */
1367 	/*
1368 	 * The inode is not updated if we're logging and the inode is a
1369 	 * directory with FRSYNC, FSYNC and FDSYNC flags set.
1370 	 */
1371 	if (ioflag & FRSYNC) {
1372 		if (TRANS_ISTRANS(ufsvfsp) && ((ip->i_mode & IFMT) == IFDIR)) {
1373 				doupdate = 0;
1374 		}
1375 		if (doupdate) {
1376 			if ((ioflag & FSYNC) ||
1377 			    ((ioflag & FDSYNC) &&
1378 			    (ip->i_flag & (IATTCHG|IBDWRITE)))) {
1379 				ufs_iupdat(ip, 1);
1380 			}
1381 		}
1382 	}
1383 	/*
1384 	 * If we've already done a partial read, terminate
1385 	 * the read but return no error.
1386 	 */
1387 	if (oresid != uio->uio_resid)
1388 		error = 0;
1389 	ITIMES(ip);
1390 
1391 	TRACE_2(TR_FAC_UFS, TR_UFS_RWIP_END,
1392 		"ufs_rdip_end:vp %p error %d", vp, error);
1393 	return (error);
1394 }
1395 
1396 /* ARGSUSED */
1397 static int
1398 ufs_ioctl(
1399 	struct vnode	*vp,
1400 	int		cmd,
1401 	intptr_t	arg,
1402 	int		flag,
1403 	struct cred	*cr,
1404 	int		*rvalp)
1405 {
1406 	struct lockfs	lockfs, lockfs_out;
1407 	struct ufsvfs	*ufsvfsp = VTOI(vp)->i_ufsvfs;
1408 	char		*comment, *original_comment;
1409 	struct fs	*fs;
1410 	struct ulockfs	*ulp;
1411 	offset_t	off;
1412 	extern int	maxphys;
1413 	int		error;
1414 	int		issync;
1415 	int		trans_size;
1416 
1417 
1418 	/*
1419 	 * forcibly unmounted
1420 	 */
1421 	if (ufsvfsp == NULL) {
1422 		return (EIO);
1423 	}
1424 
1425 	fs = ufsvfsp->vfs_fs;
1426 
1427 	if (cmd == Q_QUOTACTL) {
1428 		error = ufs_lockfs_begin(ufsvfsp, &ulp, ULOCKFS_QUOTA_MASK);
1429 		if (error)
1430 			return (error);
1431 
1432 		if (ulp) {
1433 			TRANS_BEGIN_ASYNC(ufsvfsp, TOP_QUOTA,
1434 						TOP_SETQUOTA_SIZE(fs));
1435 		}
1436 
1437 		error = quotactl(vp, arg, flag, cr);
1438 
1439 		if (ulp) {
1440 			TRANS_END_ASYNC(ufsvfsp, TOP_QUOTA,
1441 						TOP_SETQUOTA_SIZE(fs));
1442 			ufs_lockfs_end(ulp);
1443 		}
1444 		return (error);
1445 	}
1446 
1447 	switch (cmd) {
1448 		case _FIOLFS:
1449 			/*
1450 			 * file system locking
1451 			 */
1452 			if (secpolicy_fs_config(cr, ufsvfsp->vfs_vfs) != 0)
1453 				return (EPERM);
1454 
1455 			if ((flag & DATAMODEL_MASK) == DATAMODEL_NATIVE) {
1456 				if (copyin((caddr_t)arg, &lockfs,
1457 						sizeof (struct lockfs)))
1458 					return (EFAULT);
1459 			}
1460 #ifdef _SYSCALL32_IMPL
1461 			else {
1462 				struct lockfs32	lockfs32;
1463 				/* Translate ILP32 lockfs to LP64 lockfs */
1464 				if (copyin((caddr_t)arg, &lockfs32,
1465 				    sizeof (struct lockfs32)))
1466 					return (EFAULT);
1467 				lockfs.lf_lock = (ulong_t)lockfs32.lf_lock;
1468 				lockfs.lf_flags = (ulong_t)lockfs32.lf_flags;
1469 				lockfs.lf_key = (ulong_t)lockfs32.lf_key;
1470 				lockfs.lf_comlen = (ulong_t)lockfs32.lf_comlen;
1471 				lockfs.lf_comment =
1472 					(caddr_t)(uintptr_t)lockfs32.lf_comment;
1473 			}
1474 #endif /* _SYSCALL32_IMPL */
1475 
1476 			if (lockfs.lf_comlen) {
1477 				if (lockfs.lf_comlen > LOCKFS_MAXCOMMENTLEN)
1478 					return (ENAMETOOLONG);
1479 				comment = kmem_alloc(lockfs.lf_comlen,
1480 						KM_SLEEP);
1481 				if (copyin(lockfs.lf_comment, comment,
1482 					lockfs.lf_comlen)) {
1483 					kmem_free(comment, lockfs.lf_comlen);
1484 					return (EFAULT);
1485 				}
1486 				original_comment = lockfs.lf_comment;
1487 				lockfs.lf_comment = comment;
1488 			}
1489 			if ((error = ufs_fiolfs(vp, &lockfs, 0)) == 0) {
1490 				lockfs.lf_comment = original_comment;
1491 
1492 				if ((flag & DATAMODEL_MASK) ==
1493 				    DATAMODEL_NATIVE) {
1494 					(void) copyout(&lockfs, (caddr_t)arg,
1495 					    sizeof (struct lockfs));
1496 				}
1497 #ifdef _SYSCALL32_IMPL
1498 				else {
1499 					struct lockfs32	lockfs32;
1500 					/* Translate LP64 to ILP32 lockfs */
1501 					lockfs32.lf_lock =
1502 					    (uint32_t)lockfs.lf_lock;
1503 					lockfs32.lf_flags =
1504 					    (uint32_t)lockfs.lf_flags;
1505 					lockfs32.lf_key =
1506 					    (uint32_t)lockfs.lf_key;
1507 					lockfs32.lf_comlen =
1508 					    (uint32_t)lockfs.lf_comlen;
1509 					lockfs32.lf_comment =
1510 					(uint32_t)(uintptr_t)lockfs.lf_comment;
1511 					(void) copyout(&lockfs32, (caddr_t)arg,
1512 					    sizeof (struct lockfs32));
1513 				}
1514 #endif /* _SYSCALL32_IMPL */
1515 
1516 			} else {
1517 				if (lockfs.lf_comlen)
1518 					kmem_free(comment, lockfs.lf_comlen);
1519 			}
1520 			return (error);
1521 
1522 		case _FIOLFSS:
1523 			/*
1524 			 * get file system locking status
1525 			 */
1526 
1527 			if ((flag & DATAMODEL_MASK) == DATAMODEL_NATIVE) {
1528 				if (copyin((caddr_t)arg, &lockfs,
1529 						sizeof (struct lockfs)))
1530 					return (EFAULT);
1531 			}
1532 #ifdef _SYSCALL32_IMPL
1533 			else {
1534 				struct lockfs32	lockfs32;
1535 				/* Translate ILP32 lockfs to LP64 lockfs */
1536 				if (copyin((caddr_t)arg, &lockfs32,
1537 						sizeof (struct lockfs32)))
1538 					return (EFAULT);
1539 				lockfs.lf_lock = (ulong_t)lockfs32.lf_lock;
1540 				lockfs.lf_flags = (ulong_t)lockfs32.lf_flags;
1541 				lockfs.lf_key = (ulong_t)lockfs32.lf_key;
1542 				lockfs.lf_comlen = (ulong_t)lockfs32.lf_comlen;
1543 				lockfs.lf_comment =
1544 					(caddr_t)(uintptr_t)lockfs32.lf_comment;
1545 			}
1546 #endif /* _SYSCALL32_IMPL */
1547 
1548 			if (error =  ufs_fiolfss(vp, &lockfs_out))
1549 				return (error);
1550 			lockfs.lf_lock = lockfs_out.lf_lock;
1551 			lockfs.lf_key = lockfs_out.lf_key;
1552 			lockfs.lf_flags = lockfs_out.lf_flags;
1553 			lockfs.lf_comlen = MIN(lockfs.lf_comlen,
1554 				lockfs_out.lf_comlen);
1555 
1556 			if ((flag & DATAMODEL_MASK) == DATAMODEL_NATIVE) {
1557 				if (copyout(&lockfs, (caddr_t)arg,
1558 						sizeof (struct lockfs)))
1559 					return (EFAULT);
1560 			}
1561 #ifdef _SYSCALL32_IMPL
1562 			else {
1563 				/* Translate LP64 to ILP32 lockfs */
1564 				struct lockfs32	lockfs32;
1565 				lockfs32.lf_lock = (uint32_t)lockfs.lf_lock;
1566 				lockfs32.lf_flags = (uint32_t)lockfs.lf_flags;
1567 				lockfs32.lf_key = (uint32_t)lockfs.lf_key;
1568 				lockfs32.lf_comlen = (uint32_t)lockfs.lf_comlen;
1569 				lockfs32.lf_comment =
1570 					(uint32_t)(uintptr_t)lockfs.lf_comment;
1571 				if (copyout(&lockfs32, (caddr_t)arg,
1572 					    sizeof (struct lockfs32)))
1573 					return (EFAULT);
1574 			}
1575 #endif /* _SYSCALL32_IMPL */
1576 
1577 			if (lockfs.lf_comlen &&
1578 			    lockfs.lf_comment && lockfs_out.lf_comment)
1579 				if (copyout(lockfs_out.lf_comment,
1580 					lockfs.lf_comment,
1581 					lockfs.lf_comlen))
1582 					return (EFAULT);
1583 			return (0);
1584 
1585 		case _FIOSATIME:
1586 			/*
1587 			 * set access time
1588 			 */
1589 
1590 			/*
1591 			 * if mounted w/o atime, return quietly.
1592 			 * I briefly thought about returning ENOSYS, but
1593 			 * figured that most apps would consider this fatal
1594 			 * but the idea is to make this as seamless as poss.
1595 			 */
1596 			if (ufsvfsp->vfs_noatime)
1597 				return (0);
1598 
1599 			error = ufs_lockfs_begin(ufsvfsp, &ulp,
1600 					ULOCKFS_SETATTR_MASK);
1601 			if (error)
1602 				return (error);
1603 
1604 			if (ulp) {
1605 				trans_size = (int)TOP_SETATTR_SIZE(VTOI(vp));
1606 				TRANS_BEGIN_CSYNC(ufsvfsp, issync,
1607 						TOP_SETATTR, trans_size);
1608 			}
1609 
1610 			error = ufs_fiosatime(vp, (struct timeval *)arg,
1611 					flag, cr);
1612 
1613 			if (ulp) {
1614 				TRANS_END_CSYNC(ufsvfsp, error, issync,
1615 						TOP_SETATTR, trans_size);
1616 				ufs_lockfs_end(ulp);
1617 			}
1618 			return (error);
1619 
1620 		case _FIOSDIO:
1621 			/*
1622 			 * set delayed-io
1623 			 */
1624 			return (ufs_fiosdio(vp, (uint_t *)arg, flag, cr));
1625 
1626 		case _FIOGDIO:
1627 			/*
1628 			 * get delayed-io
1629 			 */
1630 			return (ufs_fiogdio(vp, (uint_t *)arg, flag, cr));
1631 
1632 		case _FIOIO:
1633 			/*
1634 			 * inode open
1635 			 */
1636 			error = ufs_lockfs_begin(ufsvfsp, &ulp,
1637 					ULOCKFS_VGET_MASK);
1638 			if (error)
1639 				return (error);
1640 
1641 			error = ufs_fioio(vp, (struct fioio *)arg, flag, cr);
1642 
1643 			if (ulp) {
1644 				ufs_lockfs_end(ulp);
1645 			}
1646 			return (error);
1647 
1648 		case _FIOFFS:
1649 			/*
1650 			 * file system flush (push w/invalidate)
1651 			 */
1652 			if ((caddr_t)arg != NULL)
1653 				return (EINVAL);
1654 			return (ufs_fioffs(vp, NULL, cr));
1655 
1656 		case _FIOISBUSY:
1657 			/*
1658 			 * Contract-private interface for Legato
1659 			 * Purge this vnode from the DNLC and decide
1660 			 * if this vnode is busy (*arg == 1) or not
1661 			 * (*arg == 0)
1662 			 */
1663 			if (secpolicy_fs_config(cr, ufsvfsp->vfs_vfs) != 0)
1664 				return (EPERM);
1665 			error = ufs_fioisbusy(vp, (int *)arg, cr);
1666 			return (error);
1667 
1668 		case _FIODIRECTIO:
1669 			return (ufs_fiodirectio(vp, (int)arg, cr));
1670 
1671 		case _FIOTUNE:
1672 			/*
1673 			 * Tune the file system (aka setting fs attributes)
1674 			 */
1675 			error = ufs_lockfs_begin(ufsvfsp, &ulp,
1676 					ULOCKFS_SETATTR_MASK);
1677 			if (error)
1678 				return (error);
1679 
1680 			error = ufs_fiotune(vp, (struct fiotune *)arg, cr);
1681 
1682 			if (ulp)
1683 				ufs_lockfs_end(ulp);
1684 			return (error);
1685 
1686 		case _FIOLOGENABLE:
1687 			if (secpolicy_fs_config(cr, ufsvfsp->vfs_vfs) != 0)
1688 				return (EPERM);
1689 			return (ufs_fiologenable(vp, (void *)arg, cr, flag));
1690 
1691 		case _FIOLOGDISABLE:
1692 			if (secpolicy_fs_config(cr, ufsvfsp->vfs_vfs) != 0)
1693 				return (EPERM);
1694 			return (ufs_fiologdisable(vp, (void *)arg, cr, flag));
1695 
1696 		case _FIOISLOG:
1697 			return (ufs_fioislog(vp, (void *)arg, cr, flag));
1698 
1699 		case _FIOSNAPSHOTCREATE_MULTI:
1700 		{
1701 			struct fiosnapcreate_multi	fc, *fcp;
1702 			size_t	fcm_size;
1703 
1704 			if (copyin((void *)arg, &fc, sizeof (fc)))
1705 				return (EFAULT);
1706 			if (fc.backfilecount > MAX_BACKFILE_COUNT)
1707 				return (EINVAL);
1708 			fcm_size = sizeof (struct fiosnapcreate_multi) +
1709 			    (fc.backfilecount - 1) * sizeof (int);
1710 			fcp = (struct fiosnapcreate_multi *)
1711 			    kmem_alloc(fcm_size, KM_SLEEP);
1712 			if (copyin((void *)arg, fcp, fcm_size)) {
1713 				kmem_free(fcp, fcm_size);
1714 				return (EFAULT);
1715 			}
1716 			error = ufs_snap_create(vp, fcp, cr);
1717 			if (!error && copyout(fcp, (void *)arg, fcm_size))
1718 				error = EFAULT;
1719 			kmem_free(fcp, fcm_size);
1720 			return (error);
1721 		}
1722 
1723 		case _FIOSNAPSHOTDELETE:
1724 		{
1725 			struct fiosnapdelete	fc;
1726 
1727 			if (copyin((void *)arg, &fc, sizeof (fc)))
1728 				return (EFAULT);
1729 			error = ufs_snap_delete(vp, &fc, cr);
1730 			if (!error && copyout(&fc, (void *)arg, sizeof (fc)))
1731 				error = EFAULT;
1732 			return (error);
1733 		}
1734 
1735 		case _FIOGETSUPERBLOCK:
1736 			if (copyout(fs, (void *)arg, SBSIZE))
1737 				return (EFAULT);
1738 			return (0);
1739 
1740 		case _FIOGETMAXPHYS:
1741 			if (copyout(&maxphys, (void *)arg, sizeof (maxphys)))
1742 				return (EFAULT);
1743 			return (0);
1744 
1745 		/*
1746 		 * The following 3 ioctls are for TSufs support
1747 		 * although could potentially be used elsewhere
1748 		 */
1749 		case _FIO_SET_LUFS_DEBUG:
1750 			if (secpolicy_fs_config(cr, ufsvfsp->vfs_vfs) != 0)
1751 				return (EPERM);
1752 			lufs_debug = (uint32_t)arg;
1753 			return (0);
1754 
1755 		case _FIO_SET_LUFS_ERROR:
1756 			if (secpolicy_fs_config(cr, ufsvfsp->vfs_vfs) != 0)
1757 				return (EPERM);
1758 			TRANS_SETERROR(ufsvfsp);
1759 			return (0);
1760 
1761 		case _FIO_GET_TOP_STATS:
1762 		{
1763 			fio_lufs_stats_t *ls;
1764 			ml_unit_t *ul = ufsvfsp->vfs_log;
1765 
1766 			ls = kmem_zalloc(sizeof (*ls), KM_SLEEP);
1767 			ls->ls_debug = ul->un_debug; /* return debug value */
1768 			/* Copy stucture if statistics are being kept */
1769 			if (ul->un_logmap->mtm_tops) {
1770 				ls->ls_topstats = *(ul->un_logmap->mtm_tops);
1771 			}
1772 			error = 0;
1773 			if (copyout(ls, (void *)arg, sizeof (*ls)))
1774 				error = EFAULT;
1775 			kmem_free(ls, sizeof (*ls));
1776 			return (error);
1777 		}
1778 
1779 		case _FIO_SEEK_DATA:
1780 		case _FIO_SEEK_HOLE:
1781 			if (ddi_copyin((void *)arg, &off, sizeof (off), flag))
1782 				return (EFAULT);
1783 			/* offset paramater is in/out */
1784 			error = ufs_fio_holey(vp, cmd, &off);
1785 			if (error)
1786 				return (error);
1787 			if (ddi_copyout(&off, (void *)arg, sizeof (off), flag))
1788 				return (EFAULT);
1789 			return (0);
1790 
1791 		default:
1792 			return (ENOTTY);
1793 	}
1794 }
1795 
1796 /* ARGSUSED */
1797 static int
1798 ufs_getattr(struct vnode *vp, struct vattr *vap, int flags,
1799 	struct cred *cr)
1800 {
1801 	struct inode *ip = VTOI(vp);
1802 	struct ufsvfs *ufsvfsp;
1803 	int err;
1804 
1805 	TRACE_2(TR_FAC_UFS, TR_UFS_GETATTR_START,
1806 		"ufs_getattr_start:vp %p flags %x", vp, flags);
1807 
1808 	if (vap->va_mask == AT_SIZE) {
1809 		/*
1810 		 * for performance, if only the size is requested don't bother
1811 		 * with anything else.
1812 		 */
1813 		UFS_GET_ISIZE(&vap->va_size, ip);
1814 		TRACE_1(TR_FAC_UFS, TR_UFS_GETATTR_END,
1815 			"ufs_getattr_end:vp %p", vp);
1816 		return (0);
1817 	}
1818 
1819 	/*
1820 	 * inlined lockfs checks
1821 	 */
1822 	ufsvfsp = ip->i_ufsvfs;
1823 	if ((ufsvfsp == NULL) || ULOCKFS_IS_HLOCK(&ufsvfsp->vfs_ulockfs)) {
1824 		err = EIO;
1825 		goto out;
1826 	}
1827 
1828 	rw_enter(&ip->i_contents, RW_READER);
1829 	/*
1830 	 * Return all the attributes.  This should be refined so
1831 	 * that it only returns what's asked for.
1832 	 */
1833 
1834 	/*
1835 	 * Copy from inode table.
1836 	 */
1837 	vap->va_type = vp->v_type;
1838 	vap->va_mode = ip->i_mode & MODEMASK;
1839 	/*
1840 	 * If there is an ACL and there is a mask entry, then do the
1841 	 * extra work that completes the equivalent of an acltomode(3)
1842 	 * call.  According to POSIX P1003.1e, the acl mask should be
1843 	 * returned in the group permissions field.
1844 	 *
1845 	 * - start with the original permission and mode bits (from above)
1846 	 * - clear the group owner bits
1847 	 * - add in the mask bits.
1848 	 */
1849 	if (ip->i_ufs_acl && ip->i_ufs_acl->aclass.acl_ismask) {
1850 		vap->va_mode &= ~((VREAD | VWRITE | VEXEC) >> 3);
1851 		vap->va_mode |=
1852 		    (ip->i_ufs_acl->aclass.acl_maskbits & PERMMASK) << 3;
1853 	}
1854 	vap->va_uid = ip->i_uid;
1855 	vap->va_gid = ip->i_gid;
1856 	vap->va_fsid = ip->i_dev;
1857 	vap->va_nodeid = (ino64_t)ip->i_number;
1858 	vap->va_nlink = ip->i_nlink;
1859 	vap->va_size = ip->i_size;
1860 	if (vp->v_type == VCHR || vp->v_type == VBLK)
1861 		vap->va_rdev = ip->i_rdev;
1862 	else
1863 		vap->va_rdev = 0;	/* not a b/c spec. */
1864 	mutex_enter(&ip->i_tlock);
1865 	ITIMES_NOLOCK(ip);	/* mark correct time in inode */
1866 	vap->va_seq = ip->i_seq;
1867 	vap->va_atime.tv_sec = (time_t)ip->i_atime.tv_sec;
1868 	vap->va_atime.tv_nsec = ip->i_atime.tv_usec*1000;
1869 	vap->va_mtime.tv_sec = (time_t)ip->i_mtime.tv_sec;
1870 	vap->va_mtime.tv_nsec = ip->i_mtime.tv_usec*1000;
1871 	vap->va_ctime.tv_sec = (time_t)ip->i_ctime.tv_sec;
1872 	vap->va_ctime.tv_nsec = ip->i_ctime.tv_usec*1000;
1873 	mutex_exit(&ip->i_tlock);
1874 
1875 	switch (ip->i_mode & IFMT) {
1876 
1877 	case IFBLK:
1878 		vap->va_blksize = MAXBSIZE;		/* was BLKDEV_IOSIZE */
1879 		break;
1880 
1881 	case IFCHR:
1882 		vap->va_blksize = MAXBSIZE;
1883 		break;
1884 
1885 	default:
1886 		vap->va_blksize = ip->i_fs->fs_bsize;
1887 		break;
1888 	}
1889 	vap->va_nblocks = (fsblkcnt64_t)ip->i_blocks;
1890 	rw_exit(&ip->i_contents);
1891 	err = 0;
1892 
1893 out:
1894 	TRACE_1(TR_FAC_UFS, TR_UFS_GETATTR_END, "ufs_getattr_end:vp %p", vp);
1895 
1896 	return (err);
1897 }
1898 
1899 /*ARGSUSED4*/
1900 static int
1901 ufs_setattr(
1902 	struct vnode *vp,
1903 	struct vattr *vap,
1904 	int flags,
1905 	struct cred *cr,
1906 	caller_context_t *ct)
1907 {
1908 	struct inode *ip = VTOI(vp);
1909 	struct ufsvfs *ufsvfsp = ip->i_ufsvfs;
1910 	struct fs *fs;
1911 	struct ulockfs *ulp;
1912 	char *errmsg1;
1913 	char *errmsg2;
1914 	long blocks;
1915 	long int mask = vap->va_mask;
1916 	size_t len1, len2;
1917 	int issync;
1918 	int trans_size;
1919 	int dotrans;
1920 	int dorwlock;
1921 	int error;
1922 	int owner_change;
1923 	int dodqlock;
1924 	timestruc_t now;
1925 	vattr_t oldva;
1926 	int retry = 1;
1927 
1928 	TRACE_2(TR_FAC_UFS, TR_UFS_SETATTR_START,
1929 		"ufs_setattr_start:vp %p flags %x", vp, flags);
1930 
1931 	/*
1932 	 * Cannot set these attributes.
1933 	 */
1934 	if (mask & AT_NOSET) {
1935 		error = EINVAL;
1936 		goto out;
1937 	}
1938 
1939 	/*
1940 	 * check for forced unmount
1941 	 */
1942 	if (ufsvfsp == NULL)
1943 		return (EIO);
1944 
1945 	fs = ufsvfsp->vfs_fs;
1946 	if (fs->fs_ronly != 0)
1947 		return (EROFS);
1948 
1949 again:
1950 	errmsg1 = NULL;
1951 	errmsg2 = NULL;
1952 	dotrans = 0;
1953 	dorwlock = 0;
1954 	dodqlock = 0;
1955 
1956 	error = ufs_lockfs_begin(ufsvfsp, &ulp, ULOCKFS_SETATTR_MASK);
1957 	if (error)
1958 		goto out;
1959 
1960 	/*
1961 	 * Acquire i_rwlock before TRANS_BEGIN_CSYNC() if this is a file.
1962 	 * This follows the protocol for read()/write().
1963 	 */
1964 	if (vp->v_type != VDIR) {
1965 		rw_enter(&ip->i_rwlock, RW_WRITER);
1966 		dorwlock = 1;
1967 	}
1968 
1969 	/*
1970 	 * Truncate file.  Must have write permission and not be a directory.
1971 	 */
1972 	if (mask & AT_SIZE) {
1973 		rw_enter(&ip->i_contents, RW_WRITER);
1974 		if (vp->v_type == VDIR) {
1975 			error = EISDIR;
1976 			goto update_inode;
1977 		}
1978 		if (error = ufs_iaccess(ip, IWRITE, cr))
1979 			goto update_inode;
1980 
1981 		rw_exit(&ip->i_contents);
1982 		error = TRANS_ITRUNC(ip, vap->va_size, 0, cr);
1983 		if (error) {
1984 			rw_enter(&ip->i_contents, RW_WRITER);
1985 			goto update_inode;
1986 		}
1987 	}
1988 
1989 	if (ulp) {
1990 		trans_size = (int)TOP_SETATTR_SIZE(ip);
1991 		TRANS_BEGIN_CSYNC(ufsvfsp, issync, TOP_SETATTR, trans_size);
1992 		++dotrans;
1993 	}
1994 
1995 	/*
1996 	 * Acquire i_rwlock after TRANS_BEGIN_CSYNC() if this is a directory.
1997 	 * This follows the protocol established by
1998 	 * ufs_link/create/remove/rename/mkdir/rmdir/symlink.
1999 	 */
2000 	if (vp->v_type == VDIR) {
2001 		rw_enter(&ip->i_rwlock, RW_WRITER);
2002 		dorwlock = 1;
2003 	}
2004 
2005 	/*
2006 	 * Grab quota lock if we are changing the file's owner.
2007 	 */
2008 	if (mask & AT_UID) {
2009 		rw_enter(&ufsvfsp->vfs_dqrwlock, RW_READER);
2010 		dodqlock = 1;
2011 	}
2012 	rw_enter(&ip->i_contents, RW_WRITER);
2013 
2014 	oldva.va_mode = ip->i_mode;
2015 	oldva.va_uid = ip->i_uid;
2016 	oldva.va_gid = ip->i_gid;
2017 
2018 	vap->va_mask &= ~AT_SIZE;
2019 	/*
2020 	 * ufs_iaccess is "close enough"; that's because it doesn't
2021 	 * map the defines.
2022 	 */
2023 	error = secpolicy_vnode_setattr(cr, vp, vap, &oldva, flags,
2024 				ufs_iaccess, ip);
2025 	if (error)
2026 		goto update_inode;
2027 
2028 	mask = vap->va_mask;
2029 
2030 	/*
2031 	 * Change file access modes.
2032 	 */
2033 	if (mask & AT_MODE) {
2034 		ip->i_mode = (ip->i_mode & IFMT) | (vap->va_mode & ~IFMT);
2035 		TRANS_INODE(ufsvfsp, ip);
2036 		ip->i_flag |= ICHG;
2037 		if (stickyhack) {
2038 			mutex_enter(&vp->v_lock);
2039 			if ((ip->i_mode & (ISVTX | IEXEC | IFDIR)) == ISVTX)
2040 				vp->v_flag |= VSWAPLIKE;
2041 			else
2042 				vp->v_flag &= ~VSWAPLIKE;
2043 			mutex_exit(&vp->v_lock);
2044 		}
2045 	}
2046 	if (mask & (AT_UID|AT_GID)) {
2047 		if (mask & AT_UID) {
2048 			/*
2049 			 * Don't change ownership of the quota inode.
2050 			 */
2051 			if (ufsvfsp->vfs_qinod == ip) {
2052 				ASSERT(ufsvfsp->vfs_qflags & MQ_ENABLED);
2053 				error = EINVAL;
2054 				goto update_inode;
2055 			}
2056 
2057 			/*
2058 			 * No real ownership change.
2059 			 */
2060 			if (ip->i_uid == vap->va_uid) {
2061 				blocks = 0;
2062 				owner_change = 0;
2063 			}
2064 			/*
2065 			 * Remove the blocks and the file, from the old user's
2066 			 * quota.
2067 			 */
2068 			else {
2069 				blocks = ip->i_blocks;
2070 				owner_change = 1;
2071 
2072 				(void) chkdq(ip, -blocks, /* force */ 1, cr,
2073 						(char **)NULL, (size_t *)NULL);
2074 				(void) chkiq(ufsvfsp, /* change */ -1, ip,
2075 						(uid_t)ip->i_uid,
2076 						/* force */ 1, cr,
2077 						(char **)NULL, (size_t *)NULL);
2078 				dqrele(ip->i_dquot);
2079 			}
2080 
2081 			ip->i_uid = vap->va_uid;
2082 
2083 			/*
2084 			 * There is a real ownership change.
2085 			 */
2086 			if (owner_change) {
2087 				/*
2088 				 * Add the blocks and the file to the new
2089 				 * user's quota.
2090 				 */
2091 				ip->i_dquot = getinoquota(ip);
2092 				(void) chkdq(ip, blocks, /* force */ 1, cr,
2093 						&errmsg1, &len1);
2094 				(void) chkiq(ufsvfsp, /* change */ 1,
2095 						(struct inode *)NULL,
2096 						(uid_t)ip->i_uid,
2097 						/* force */ 1, cr,
2098 						&errmsg2, &len2);
2099 			}
2100 		}
2101 		if (mask & AT_GID) {
2102 			ip->i_gid = vap->va_gid;
2103 		}
2104 		TRANS_INODE(ufsvfsp, ip);
2105 		ip->i_flag |= ICHG;
2106 	}
2107 	/*
2108 	 * Change file access or modified times.
2109 	 */
2110 	if (mask & (AT_ATIME|AT_MTIME)) {
2111 		/* Check that the time value is within ufs range */
2112 		if (((mask & AT_ATIME) && TIMESPEC_OVERFLOW(&vap->va_atime)) ||
2113 		    ((mask & AT_MTIME) && TIMESPEC_OVERFLOW(&vap->va_mtime))) {
2114 			error = EOVERFLOW;
2115 			goto update_inode;
2116 		}
2117 
2118 		/*
2119 		 * if the "noaccess" mount option is set and only atime
2120 		 * update is requested, do nothing. No error is returned.
2121 		 */
2122 		if ((ufsvfsp->vfs_noatime) &&
2123 		    ((mask & (AT_ATIME|AT_MTIME)) == AT_ATIME))
2124 			goto skip_atime;
2125 
2126 		if (mask & AT_ATIME) {
2127 			ip->i_atime.tv_sec = vap->va_atime.tv_sec;
2128 			ip->i_atime.tv_usec = vap->va_atime.tv_nsec / 1000;
2129 			ip->i_flag &= ~IACC;
2130 		}
2131 		if (mask & AT_MTIME) {
2132 			ip->i_mtime.tv_sec = vap->va_mtime.tv_sec;
2133 			ip->i_mtime.tv_usec = vap->va_mtime.tv_nsec / 1000;
2134 			gethrestime(&now);
2135 			if (now.tv_sec > TIME32_MAX) {
2136 				/*
2137 				 * In 2038, ctime sticks forever..
2138 				 */
2139 				ip->i_ctime.tv_sec = TIME32_MAX;
2140 				ip->i_ctime.tv_usec = 0;
2141 			} else {
2142 				ip->i_ctime.tv_sec = now.tv_sec;
2143 				ip->i_ctime.tv_usec = now.tv_nsec / 1000;
2144 			}
2145 			ip->i_flag &= ~(IUPD|ICHG);
2146 			ip->i_flag |= IMODTIME;
2147 		}
2148 		TRANS_INODE(ufsvfsp, ip);
2149 		ip->i_flag |= IMOD;
2150 	}
2151 
2152 skip_atime:
2153 	/*
2154 	 * The presence of a shadow inode may indicate an ACL, but does
2155 	 * not imply an ACL.  Future FSD types should be handled here too
2156 	 * and check for the presence of the attribute-specific data
2157 	 * before referencing it.
2158 	 */
2159 	if (ip->i_shadow) {
2160 		/*
2161 		 * XXX if ufs_iupdat is changed to sandbagged write fix
2162 		 * ufs_acl_setattr to push ip to keep acls consistent
2163 		 *
2164 		 * Suppress out of inodes messages if we will retry.
2165 		 */
2166 		if (retry)
2167 			ip->i_flag |= IQUIET;
2168 		error = ufs_acl_setattr(ip, vap, cr);
2169 		ip->i_flag &= ~IQUIET;
2170 	}
2171 
2172 update_inode:
2173 	/*
2174 	 * Setattr always increases the sequence number
2175 	 */
2176 	ip->i_seq++;
2177 
2178 	/*
2179 	 * if nfsd and not logging; push synchronously
2180 	 */
2181 	if ((curthread->t_flag & T_DONTPEND) && !TRANS_ISTRANS(ufsvfsp)) {
2182 		ufs_iupdat(ip, 1);
2183 	} else {
2184 		ITIMES_NOLOCK(ip);
2185 	}
2186 
2187 	rw_exit(&ip->i_contents);
2188 	if (dodqlock) {
2189 		rw_exit(&ufsvfsp->vfs_dqrwlock);
2190 	}
2191 	if (dorwlock)
2192 		rw_exit(&ip->i_rwlock);
2193 
2194 	if (ulp) {
2195 		if (dotrans) {
2196 			int terr = 0;
2197 			TRANS_END_CSYNC(ufsvfsp, terr, issync, TOP_SETATTR,
2198 			    trans_size);
2199 			if (error == 0)
2200 				error = terr;
2201 		}
2202 		ufs_lockfs_end(ulp);
2203 	}
2204 out:
2205 	/*
2206 	 * If out of inodes or blocks, see if we can free something
2207 	 * up from the delete queue.
2208 	 */
2209 	if ((error == ENOSPC) && retry && TRANS_ISTRANS(ufsvfsp)) {
2210 		ufs_delete_drain_wait(ufsvfsp, 1);
2211 		retry = 0;
2212 		if (errmsg1 != NULL)
2213 			kmem_free(errmsg1, len1);
2214 		if (errmsg2 != NULL)
2215 			kmem_free(errmsg2, len2);
2216 		goto again;
2217 	}
2218 	TRACE_2(TR_FAC_UFS, TR_UFS_SETATTR_END,
2219 		"ufs_setattr_end:vp %p error %d", vp, error);
2220 	if (errmsg1 != NULL) {
2221 		uprintf(errmsg1);
2222 		kmem_free(errmsg1, len1);
2223 	}
2224 	if (errmsg2 != NULL) {
2225 		uprintf(errmsg2);
2226 		kmem_free(errmsg2, len2);
2227 	}
2228 	return (error);
2229 }
2230 
2231 /*ARGSUSED*/
2232 static int
2233 ufs_access(struct vnode *vp, int mode, int flags, struct cred *cr)
2234 {
2235 	struct inode *ip = VTOI(vp);
2236 	int error;
2237 
2238 	TRACE_3(TR_FAC_UFS, TR_UFS_ACCESS_START,
2239 		"ufs_access_start:vp %p mode %x flags %x", vp, mode, flags);
2240 
2241 	if (ip->i_ufsvfs == NULL)
2242 		return (EIO);
2243 
2244 	rw_enter(&ip->i_contents, RW_READER);
2245 
2246 	/*
2247 	 * The ufs_iaccess function wants to be called with
2248 	 * mode bits expressed as "ufs specific" bits.
2249 	 * I.e., VWRITE|VREAD|VEXEC do not make sense to
2250 	 * ufs_iaccess() but IWRITE|IREAD|IEXEC do.
2251 	 * But since they're the same we just pass the vnode mode
2252 	 * bit but just verify that assumption at compile time.
2253 	 */
2254 #if IWRITE != VWRITE || IREAD != VREAD || IEXEC != VEXEC
2255 #error "ufs_access needs to map Vmodes to Imodes"
2256 #endif
2257 	error = ufs_iaccess(ip, mode, cr);
2258 
2259 	rw_exit(&ip->i_contents);
2260 
2261 	TRACE_2(TR_FAC_UFS, TR_UFS_ACCESS_END,
2262 		"ufs_access_end:vp %p error %d", vp, error);
2263 	return (error);
2264 }
2265 
2266 /* ARGSUSED */
2267 static int
2268 ufs_readlink(struct vnode *vp, struct uio *uiop, struct cred *cr)
2269 {
2270 	struct inode *ip = VTOI(vp);
2271 	struct ufsvfs *ufsvfsp;
2272 	struct ulockfs *ulp;
2273 	int error;
2274 	int fastsymlink;
2275 
2276 	TRACE_2(TR_FAC_UFS, TR_UFS_READLINK_START,
2277 		"ufs_readlink_start:vp %p uiop %p", uiop, vp);
2278 
2279 	if (vp->v_type != VLNK) {
2280 		error = EINVAL;
2281 		goto nolockout;
2282 	}
2283 
2284 	/*
2285 	 * If the symbolic link is empty there is nothing to read.
2286 	 * Fast-track these empty symbolic links
2287 	 */
2288 	if (ip->i_size == 0) {
2289 		error = 0;
2290 		goto nolockout;
2291 	}
2292 
2293 	ufsvfsp = ip->i_ufsvfs;
2294 	error = ufs_lockfs_begin(ufsvfsp, &ulp, ULOCKFS_READLINK_MASK);
2295 	if (error)
2296 		goto nolockout;
2297 	/*
2298 	 * The ip->i_rwlock protects the data blocks used for FASTSYMLINK
2299 	 */
2300 again:
2301 	fastsymlink = 0;
2302 	if (ip->i_flag & IFASTSYMLNK) {
2303 		rw_enter(&ip->i_rwlock, RW_READER);
2304 		rw_enter(&ip->i_contents, RW_READER);
2305 		if (ip->i_flag & IFASTSYMLNK) {
2306 			if (!ULOCKFS_IS_NOIACC(ITOUL(ip)) &&
2307 			    (ip->i_fs->fs_ronly == 0) &&
2308 			    (!ufsvfsp->vfs_noatime)) {
2309 				mutex_enter(&ip->i_tlock);
2310 				ip->i_flag |= IACC;
2311 				mutex_exit(&ip->i_tlock);
2312 			}
2313 			error = uiomove((caddr_t)&ip->i_db[1],
2314 				MIN(ip->i_size, uiop->uio_resid),
2315 				UIO_READ, uiop);
2316 			ITIMES(ip);
2317 			++fastsymlink;
2318 		}
2319 		rw_exit(&ip->i_contents);
2320 		rw_exit(&ip->i_rwlock);
2321 	}
2322 	if (!fastsymlink) {
2323 		ssize_t size;	/* number of bytes read  */
2324 		caddr_t basep;	/* pointer to input data */
2325 		ino_t ino;
2326 		long  igen;
2327 		struct uio tuio;	/* temp uio struct */
2328 		struct uio *tuiop;
2329 		iovec_t tiov;		/* temp iovec struct */
2330 		char kbuf[FSL_SIZE];	/* buffer to hold fast symlink */
2331 		int tflag = 0;		/* flag to indicate temp vars used */
2332 
2333 		ino = ip->i_number;
2334 		igen = ip->i_gen;
2335 		size = uiop->uio_resid;
2336 		basep = uiop->uio_iov->iov_base;
2337 		tuiop = uiop;
2338 
2339 		rw_enter(&ip->i_rwlock, RW_WRITER);
2340 		rw_enter(&ip->i_contents, RW_WRITER);
2341 		if (ip->i_flag & IFASTSYMLNK) {
2342 			rw_exit(&ip->i_contents);
2343 			rw_exit(&ip->i_rwlock);
2344 			goto again;
2345 		}
2346 
2347 		/* can this be a fast symlink and is it a user buffer? */
2348 		if (ip->i_size <= FSL_SIZE &&
2349 		    (uiop->uio_segflg == UIO_USERSPACE ||
2350 		    uiop->uio_segflg == UIO_USERISPACE)) {
2351 
2352 			bzero(&tuio, sizeof (struct uio));
2353 			/*
2354 			 * setup a kernel buffer to read link into.  this
2355 			 * is to fix a race condition where the user buffer
2356 			 * got corrupted before copying it into the inode.
2357 			 */
2358 			size = ip->i_size;
2359 			tiov.iov_len = size;
2360 			tiov.iov_base = kbuf;
2361 			tuio.uio_iov = &tiov;
2362 			tuio.uio_iovcnt = 1;
2363 			tuio.uio_offset = uiop->uio_offset;
2364 			tuio.uio_segflg = UIO_SYSSPACE;
2365 			tuio.uio_fmode = uiop->uio_fmode;
2366 			tuio.uio_extflg = uiop->uio_extflg;
2367 			tuio.uio_limit = uiop->uio_limit;
2368 			tuio.uio_resid = size;
2369 
2370 			basep = tuio.uio_iov->iov_base;
2371 			tuiop = &tuio;
2372 			tflag = 1;
2373 		}
2374 
2375 		error = rdip(ip, tuiop, 0, cr);
2376 		if (!(error == 0 && ip->i_number == ino && ip->i_gen == igen)) {
2377 			rw_exit(&ip->i_contents);
2378 			rw_exit(&ip->i_rwlock);
2379 			goto out;
2380 		}
2381 
2382 		if (tflag == 0)
2383 			size -= uiop->uio_resid;
2384 
2385 		if ((tflag == 0 && ip->i_size <= FSL_SIZE &&
2386 		    ip->i_size == size) || (tflag == 1 &&
2387 		    tuio.uio_resid == 0)) {
2388 			error = kcopy(basep, &ip->i_db[1], ip->i_size);
2389 			if (error == 0) {
2390 				ip->i_flag |= IFASTSYMLNK;
2391 				/*
2392 				 * free page
2393 				 */
2394 				(void) VOP_PUTPAGE(ITOV(ip),
2395 				    (offset_t)0, PAGESIZE,
2396 				    (B_DONTNEED | B_FREE | B_FORCE | B_ASYNC),
2397 				    cr);
2398 			} else {
2399 				int i;
2400 				/* error, clear garbage left behind */
2401 				for (i = 1; i < NDADDR; i++)
2402 					ip->i_db[i] = 0;
2403 				for (i = 0; i < NIADDR; i++)
2404 					ip->i_ib[i] = 0;
2405 			}
2406 		}
2407 		if (tflag == 1) {
2408 			/* now, copy it into the user buffer */
2409 			error = uiomove((caddr_t)kbuf,
2410 				MIN(size, uiop->uio_resid),
2411 				UIO_READ, uiop);
2412 		}
2413 		rw_exit(&ip->i_contents);
2414 		rw_exit(&ip->i_rwlock);
2415 	}
2416 out:
2417 	if (ulp) {
2418 		ufs_lockfs_end(ulp);
2419 	}
2420 nolockout:
2421 	TRACE_2(TR_FAC_UFS, TR_UFS_READLINK_END,
2422 		"ufs_readlink_end:vp %p error %d", vp, error);
2423 
2424 	return (error);
2425 }
2426 
2427 /* ARGSUSED */
2428 static int
2429 ufs_fsync(struct vnode *vp, int syncflag, struct cred *cr)
2430 {
2431 	struct inode *ip = VTOI(vp);
2432 	struct ufsvfs *ufsvfsp = ip->i_ufsvfs;
2433 	struct ulockfs *ulp;
2434 	int error;
2435 
2436 	TRACE_1(TR_FAC_UFS, TR_UFS_FSYNC_START,
2437 		"ufs_fsync_start:vp %p", vp);
2438 
2439 	error = ufs_lockfs_begin(ufsvfsp, &ulp, ULOCKFS_FSYNC_MASK);
2440 	if (error)
2441 		return (error);
2442 
2443 	if (TRANS_ISTRANS(ufsvfsp)) {
2444 		/*
2445 		 * First push out any data pages
2446 		 */
2447 		if (vn_has_cached_data(vp) && !(syncflag & FNODSYNC) &&
2448 		    (vp->v_type != VCHR) && !(IS_SWAPVP(vp))) {
2449 			error = VOP_PUTPAGE(vp, (offset_t)0, (size_t)0,
2450 			    0, CRED());
2451 			if (error)
2452 				goto out;
2453 		}
2454 
2455 		/*
2456 		 * Delta any delayed inode times updates
2457 		 * and push inode to log.
2458 		 * All other inode deltas will have already been delta'd
2459 		 * and will be pushed during the commit.
2460 		 */
2461 		if (!(syncflag & FDSYNC) &&
2462 		    ((ip->i_flag & (IMOD|IMODACC)) == IMODACC)) {
2463 			if (ulp) {
2464 				TRANS_BEGIN_ASYNC(ufsvfsp, TOP_FSYNC,
2465 				    TOP_SYNCIP_SIZE);
2466 			}
2467 			rw_enter(&ip->i_contents, RW_READER);
2468 			mutex_enter(&ip->i_tlock);
2469 			ip->i_flag &= ~IMODTIME;
2470 			mutex_exit(&ip->i_tlock);
2471 			ufs_iupdat(ip, I_SYNC);
2472 			rw_exit(&ip->i_contents);
2473 			if (ulp) {
2474 				TRANS_END_ASYNC(ufsvfsp, TOP_FSYNC,
2475 				    TOP_SYNCIP_SIZE);
2476 			}
2477 		}
2478 
2479 		/*
2480 		 * Commit the Moby transaction
2481 		 *
2482 		 * Deltas have already been made so we just need to
2483 		 * commit them with a synchronous transaction.
2484 		 * TRANS_BEGIN_SYNC() will return an error
2485 		 * if there are no deltas to commit, for an
2486 		 * empty transaction.
2487 		 */
2488 		if (ulp) {
2489 			TRANS_BEGIN_SYNC(ufsvfsp, TOP_FSYNC, TOP_COMMIT_SIZE,
2490 			    error);
2491 			if (error) {
2492 				error = 0; /* commit wasn't needed */
2493 				goto out;
2494 			}
2495 			TRANS_END_SYNC(ufsvfsp, error, TOP_FSYNC,
2496 			    TOP_COMMIT_SIZE);
2497 		}
2498 	} else {	/* not logging */
2499 		if (!(IS_SWAPVP(vp)))
2500 			if (syncflag & FNODSYNC) {
2501 				/* Just update the inode only */
2502 				TRANS_IUPDAT(ip, 1);
2503 				error = 0;
2504 			} else if (syncflag & FDSYNC)
2505 				/* Do data-synchronous writes */
2506 				error = TRANS_SYNCIP(ip, 0, I_DSYNC, TOP_FSYNC);
2507 			else
2508 				/* Do synchronous writes */
2509 				error = TRANS_SYNCIP(ip, 0, I_SYNC, TOP_FSYNC);
2510 
2511 		rw_enter(&ip->i_contents, RW_WRITER);
2512 		if (!error)
2513 			error = ufs_sync_indir(ip);
2514 		rw_exit(&ip->i_contents);
2515 	}
2516 out:
2517 	if (ulp) {
2518 		ufs_lockfs_end(ulp);
2519 	}
2520 	TRACE_2(TR_FAC_UFS, TR_UFS_FSYNC_END,
2521 		"ufs_fsync_end:vp %p error %d", vp, error);
2522 	return (error);
2523 }
2524 
2525 /*ARGSUSED*/
2526 static void
2527 ufs_inactive(struct vnode *vp, struct cred *cr)
2528 {
2529 	ufs_iinactive(VTOI(vp));
2530 }
2531 
2532 /*
2533  * Unix file system operations having to do with directory manipulation.
2534  */
2535 int ufs_lookup_idle_count = 2;	/* Number of inodes to idle each time */
2536 /* ARGSUSED */
2537 static int
2538 ufs_lookup(struct vnode *dvp, char *nm, struct vnode **vpp,
2539 	struct pathname *pnp, int flags, struct vnode *rdir, struct cred *cr)
2540 {
2541 	struct inode *ip;
2542 	struct inode *sip;
2543 	struct inode *xip;
2544 	struct ufsvfs *ufsvfsp;
2545 	struct ulockfs *ulp;
2546 	struct vnode *vp;
2547 	int error;
2548 
2549 	TRACE_2(TR_FAC_UFS, TR_UFS_LOOKUP_START,
2550 		"ufs_lookup_start:dvp %p name %s", dvp, nm);
2551 
2552 
2553 	/*
2554 	 * Check flags for type of lookup (regular file or attribute file)
2555 	 */
2556 
2557 	ip = VTOI(dvp);
2558 
2559 	if (flags & LOOKUP_XATTR) {
2560 
2561 		/*
2562 		 * We don't allow recursive attributes...
2563 		 * Maybe someday we will.
2564 		 */
2565 		if ((ip->i_cflags & IXATTR)) {
2566 			return (EINVAL);
2567 		}
2568 
2569 		if ((vp = dnlc_lookup(dvp, XATTR_DIR_NAME)) == NULL) {
2570 			error = ufs_xattr_getattrdir(dvp, &sip, flags, cr);
2571 			if (error) {
2572 				*vpp = NULL;
2573 				goto out;
2574 			}
2575 
2576 			vp = ITOV(sip);
2577 			dnlc_update(dvp, XATTR_DIR_NAME, vp);
2578 		}
2579 
2580 		/*
2581 		 * Check accessibility of directory.
2582 		 */
2583 		if (vp == DNLC_NO_VNODE) {
2584 			VN_RELE(vp);
2585 			error = ENOENT;
2586 			goto out;
2587 		}
2588 		if ((error = ufs_iaccess(VTOI(vp), IEXEC, cr)) != 0) {
2589 			VN_RELE(vp);
2590 			goto out;
2591 		}
2592 
2593 		*vpp = vp;
2594 		return (0);
2595 	}
2596 
2597 	/*
2598 	 * Check for a null component, which we should treat as
2599 	 * looking at dvp from within it's parent, so we don't
2600 	 * need a call to ufs_iaccess(), as it has already been
2601 	 * done.
2602 	 */
2603 	if (nm[0] == 0) {
2604 		VN_HOLD(dvp);
2605 		error = 0;
2606 		*vpp = dvp;
2607 		goto out;
2608 	}
2609 
2610 	/*
2611 	 * Check for "." ie itself. this is a quick check and
2612 	 * avoids adding "." into the dnlc (which have been seen
2613 	 * to occupy >10% of the cache).
2614 	 */
2615 	if ((nm[0] == '.') && (nm[1] == 0)) {
2616 		/*
2617 		 * Don't return without checking accessibility
2618 		 * of the directory. We only need the lock if
2619 		 * we are going to return it.
2620 		 */
2621 		if ((error = ufs_iaccess(ip, IEXEC, cr)) == 0) {
2622 			VN_HOLD(dvp);
2623 			*vpp = dvp;
2624 		}
2625 		goto out;
2626 	}
2627 
2628 	/*
2629 	 * Fast path: Check the directory name lookup cache.
2630 	 */
2631 	if (vp = dnlc_lookup(dvp, nm)) {
2632 		/*
2633 		 * Check accessibility of directory.
2634 		 */
2635 		if ((error = ufs_iaccess(ip, IEXEC, cr)) != 0) {
2636 			VN_RELE(vp);
2637 			goto out;
2638 		}
2639 		if (vp == DNLC_NO_VNODE) {
2640 			VN_RELE(vp);
2641 			error = ENOENT;
2642 			goto out;
2643 		}
2644 		xip = VTOI(vp);
2645 		ulp = NULL;
2646 		goto fastpath;
2647 	}
2648 
2649 	/*
2650 	 * Keep the idle queue from getting too long by
2651 	 * idling two inodes before attempting to allocate another.
2652 	 *    This operation must be performed before entering
2653 	 *    lockfs or a transaction.
2654 	 */
2655 	if (ufs_idle_q.uq_ne > ufs_idle_q.uq_hiwat)
2656 		if ((curthread->t_flag & T_DONTBLOCK) == 0) {
2657 			ins.in_lidles.value.ul += ufs_lookup_idle_count;
2658 			ufs_idle_some(ufs_lookup_idle_count);
2659 		}
2660 
2661 	ufsvfsp = ip->i_ufsvfs;
2662 	error = ufs_lockfs_begin(ufsvfsp, &ulp, ULOCKFS_LOOKUP_MASK);
2663 	if (error)
2664 		goto out;
2665 
2666 	error = ufs_dirlook(ip, nm, &xip, cr, 1);
2667 
2668 fastpath:
2669 	if (error == 0) {
2670 		ip = xip;
2671 		*vpp = ITOV(ip);
2672 
2673 		/*
2674 		 * If vnode is a device return special vnode instead.
2675 		 */
2676 		if (IS_DEVVP(*vpp)) {
2677 			struct vnode *newvp;
2678 
2679 			newvp = specvp(*vpp, (*vpp)->v_rdev, (*vpp)->v_type,
2680 			    cr);
2681 			VN_RELE(*vpp);
2682 			if (newvp == NULL)
2683 				error = ENOSYS;
2684 			else
2685 				*vpp = newvp;
2686 		}
2687 	}
2688 	if (ulp) {
2689 		ufs_lockfs_end(ulp);
2690 	}
2691 
2692 out:
2693 	TRACE_3(TR_FAC_UFS, TR_UFS_LOOKUP_END,
2694 		"ufs_lookup_end:dvp %p name %s error %d", vpp, nm, error);
2695 	return (error);
2696 }
2697 
2698 static int
2699 ufs_create(struct vnode *dvp, char *name, struct vattr *vap, enum vcexcl excl,
2700 	int mode, struct vnode **vpp, struct cred *cr, int flag)
2701 {
2702 	struct inode *ip;
2703 	struct inode *xip;
2704 	struct inode *dip;
2705 	struct vnode *xvp;
2706 	struct ufsvfs *ufsvfsp;
2707 	struct ulockfs *ulp;
2708 	int error;
2709 	int issync;
2710 	int truncflag;
2711 	int trans_size;
2712 	int noentry;
2713 	int defer_dip_seq_update = 0;	/* need to defer update of dip->i_seq */
2714 	int retry = 1;
2715 
2716 	TRACE_1(TR_FAC_UFS, TR_UFS_CREATE_START,
2717 		"ufs_create_start:dvp %p", dvp);
2718 
2719 again:
2720 	ip = VTOI(dvp);
2721 	ufsvfsp = ip->i_ufsvfs;
2722 	truncflag = 0;
2723 
2724 	error = ufs_lockfs_begin(ufsvfsp, &ulp, ULOCKFS_CREATE_MASK);
2725 	if (error)
2726 		goto out;
2727 
2728 	if (ulp) {
2729 		trans_size = (int)TOP_CREATE_SIZE(ip);
2730 		TRANS_BEGIN_CSYNC(ufsvfsp, issync, TOP_CREATE, trans_size);
2731 	}
2732 
2733 	if ((vap->va_mode & VSVTX) && secpolicy_vnode_stky_modify(cr) != 0)
2734 		vap->va_mode &= ~VSVTX;
2735 
2736 	if (*name == '\0') {
2737 		/*
2738 		 * Null component name refers to the directory itself.
2739 		 */
2740 		VN_HOLD(dvp);
2741 		/*
2742 		 * Even though this is an error case, we need to grab the
2743 		 * quota lock since the error handling code below is common.
2744 		 */
2745 		rw_enter(&ufsvfsp->vfs_dqrwlock, RW_READER);
2746 		rw_enter(&ip->i_contents, RW_WRITER);
2747 		error = EEXIST;
2748 	} else {
2749 		xip = NULL;
2750 		noentry = 0;
2751 		rw_enter(&ip->i_rwlock, RW_WRITER);
2752 		xvp = dnlc_lookup(dvp, name);
2753 		if (xvp == DNLC_NO_VNODE) {
2754 			noentry = 1;
2755 			VN_RELE(xvp);
2756 			xvp = NULL;
2757 		}
2758 		if (xvp) {
2759 			rw_exit(&ip->i_rwlock);
2760 			if (error = ufs_iaccess(ip, IEXEC, cr)) {
2761 				VN_RELE(xvp);
2762 			} else {
2763 				error = EEXIST;
2764 				xip = VTOI(xvp);
2765 			}
2766 		} else {
2767 			/*
2768 			 * Suppress file system full message if we will retry
2769 			 */
2770 			error = ufs_direnter_cm(ip, name, DE_CREATE,
2771 				vap, &xip, cr,
2772 				(noentry | (retry ? IQUIET : 0)));
2773 			rw_exit(&ip->i_rwlock);
2774 		}
2775 		ip = xip;
2776 		if (ip != NULL) {
2777 			rw_enter(&ufsvfsp->vfs_dqrwlock, RW_READER);
2778 			rw_enter(&ip->i_contents, RW_WRITER);
2779 		}
2780 	}
2781 
2782 	/*
2783 	 * If the file already exists and this is a non-exclusive create,
2784 	 * check permissions and allow access for non-directories.
2785 	 * Read-only create of an existing directory is also allowed.
2786 	 * We fail an exclusive create of anything which already exists.
2787 	 */
2788 	if (error == EEXIST) {
2789 		dip = VTOI(dvp);
2790 		if (excl == NONEXCL) {
2791 			if ((((ip->i_mode & IFMT) == IFDIR) ||
2792 			    ((ip->i_mode & IFMT) == IFATTRDIR)) &&
2793 			    (mode & IWRITE))
2794 				error = EISDIR;
2795 			else if (mode)
2796 				error = ufs_iaccess(ip, mode, cr);
2797 			else
2798 				error = 0;
2799 		}
2800 		if (error) {
2801 			rw_exit(&ip->i_contents);
2802 			rw_exit(&ufsvfsp->vfs_dqrwlock);
2803 			VN_RELE(ITOV(ip));
2804 			goto unlock;
2805 		}
2806 		/*
2807 		 * If the error EEXIST was set, then i_seq can not
2808 		 * have been updated. The sequence number interface
2809 		 * is defined such that a non-error VOP_CREATE must
2810 		 * increase the dir va_seq it by at least one. If we
2811 		 * have cleared the error, increase i_seq. Note that
2812 		 * we are increasing the dir i_seq and in rare cases
2813 		 * ip may actually be from the dvp, so we already have
2814 		 * the locks and it will not be subject to truncation.
2815 		 * In case we have to update i_seq of the parent
2816 		 * directory dip, we have to defer it till we have
2817 		 * released our locks on ip due to lock ordering requirements.
2818 		 */
2819 		if (ip != dip)
2820 			defer_dip_seq_update = 1;
2821 		else
2822 			ip->i_seq++;
2823 
2824 		if (((ip->i_mode & IFMT) == IFREG) &&
2825 		    (vap->va_mask & AT_SIZE) && vap->va_size == 0) {
2826 			/*
2827 			 * Truncate regular files, if requested by caller.
2828 			 * Grab i_rwlock to make sure no one else is
2829 			 * currently writing to the file (we promised
2830 			 * bmap we would do this).
2831 			 * Must get the locks in the correct order.
2832 			 */
2833 			if (ip->i_size == 0) {
2834 				ip->i_flag |= ICHG | IUPD;
2835 				ip->i_seq++;
2836 				TRANS_INODE(ufsvfsp, ip);
2837 			} else {
2838 				/*
2839 				 * Large Files: Why this check here?
2840 				 * Though we do it in vn_create() we really
2841 				 * want to guarantee that we do not destroy
2842 				 * Large file data by atomically checking
2843 				 * the size while holding the contents
2844 				 * lock.
2845 				 */
2846 				if (flag && !(flag & FOFFMAX) &&
2847 				    ((ip->i_mode & IFMT) == IFREG) &&
2848 				    (ip->i_size > (offset_t)MAXOFF32_T)) {
2849 					rw_exit(&ip->i_contents);
2850 					rw_exit(&ufsvfsp->vfs_dqrwlock);
2851 					error = EOVERFLOW;
2852 					goto unlock;
2853 				}
2854 				if (TRANS_ISTRANS(ufsvfsp))
2855 					truncflag++;
2856 				else {
2857 					rw_exit(&ip->i_contents);
2858 					rw_exit(&ufsvfsp->vfs_dqrwlock);
2859 					rw_enter(&ip->i_rwlock, RW_WRITER);
2860 					rw_enter(&ufsvfsp->vfs_dqrwlock,
2861 							RW_READER);
2862 					rw_enter(&ip->i_contents, RW_WRITER);
2863 					(void) ufs_itrunc(ip, (u_offset_t)0, 0,
2864 								cr);
2865 					rw_exit(&ip->i_rwlock);
2866 				}
2867 			}
2868 		}
2869 	}
2870 
2871 	if (error) {
2872 		if (ip != NULL) {
2873 			rw_exit(&ufsvfsp->vfs_dqrwlock);
2874 			rw_exit(&ip->i_contents);
2875 		}
2876 		goto unlock;
2877 	}
2878 
2879 	*vpp = ITOV(ip);
2880 	ITIMES(ip);
2881 	rw_exit(&ip->i_contents);
2882 	rw_exit(&ufsvfsp->vfs_dqrwlock);
2883 
2884 	/*
2885 	 * If vnode is a device return special vnode instead.
2886 	 */
2887 	if (!error && IS_DEVVP(*vpp)) {
2888 		struct vnode *newvp;
2889 
2890 		newvp = specvp(*vpp, (*vpp)->v_rdev, (*vpp)->v_type, cr);
2891 		VN_RELE(*vpp);
2892 		if (newvp == NULL) {
2893 			error = ENOSYS;
2894 			goto unlock;
2895 		}
2896 		truncflag = 0;
2897 		*vpp = newvp;
2898 	}
2899 unlock:
2900 
2901 	/*
2902 	 * Do the deferred update of the parent directory's sequence
2903 	 * number now.
2904 	 */
2905 	if (defer_dip_seq_update == 1) {
2906 		rw_enter(&dip->i_contents, RW_READER);
2907 		mutex_enter(&dip->i_tlock);
2908 		dip->i_seq++;
2909 		mutex_exit(&dip->i_tlock);
2910 		rw_exit(&dip->i_contents);
2911 	}
2912 
2913 	if (ulp) {
2914 		int terr = 0;
2915 
2916 		TRANS_END_CSYNC(ufsvfsp, terr, issync, TOP_CREATE,
2917 		    trans_size);
2918 
2919 		/*
2920 		 * If we haven't had a more interesting failure
2921 		 * already, then anything that might've happened
2922 		 * here should be reported.
2923 		 */
2924 		if (error == 0)
2925 			error = terr;
2926 	}
2927 
2928 	if (!error && truncflag) {
2929 		rw_enter(&ip->i_rwlock, RW_WRITER);
2930 		(void) TRANS_ITRUNC(ip, (u_offset_t)0, 0, cr);
2931 		rw_exit(&ip->i_rwlock);
2932 	}
2933 
2934 	if (ulp)
2935 		ufs_lockfs_end(ulp);
2936 
2937 	/*
2938 	 * If no inodes available, try to free one up out of the
2939 	 * pending delete queue.
2940 	 */
2941 	if ((error == ENOSPC) && retry && TRANS_ISTRANS(ufsvfsp)) {
2942 		ufs_delete_drain_wait(ufsvfsp, 1);
2943 		retry = 0;
2944 		goto again;
2945 	}
2946 
2947 out:
2948 	TRACE_3(TR_FAC_UFS, TR_UFS_CREATE_END,
2949 		"ufs_create_end:dvp %p name %s error %d", vpp, name, error);
2950 	return (error);
2951 }
2952 
2953 extern int ufs_idle_max;
2954 /*ARGSUSED*/
2955 static int
2956 ufs_remove(struct vnode *vp, char *nm, struct cred *cr)
2957 {
2958 	struct inode *ip = VTOI(vp);
2959 	struct ufsvfs *ufsvfsp	= ip->i_ufsvfs;
2960 	struct ulockfs *ulp;
2961 	vnode_t *rmvp = NULL;	/* Vnode corresponding to name being removed */
2962 	int error;
2963 	int issync;
2964 	int trans_size;
2965 
2966 	TRACE_1(TR_FAC_UFS, TR_UFS_REMOVE_START,
2967 		"ufs_remove_start:vp %p", vp);
2968 
2969 	/*
2970 	 * don't let the delete queue get too long
2971 	 */
2972 	if (ufsvfsp == NULL) {
2973 		error = EIO;
2974 		goto out;
2975 	}
2976 	if (ufsvfsp->vfs_delete.uq_ne > ufs_idle_max)
2977 		ufs_delete_drain(vp->v_vfsp, 1, 1);
2978 
2979 	error = ufs_lockfs_begin(ufsvfsp, &ulp, ULOCKFS_REMOVE_MASK);
2980 	if (error)
2981 		goto out;
2982 
2983 	if (ulp)
2984 		TRANS_BEGIN_CSYNC(ufsvfsp, issync, TOP_REMOVE,
2985 		    trans_size = (int)TOP_REMOVE_SIZE(VTOI(vp)));
2986 
2987 	rw_enter(&ip->i_rwlock, RW_WRITER);
2988 	error = ufs_dirremove(ip, nm, (struct inode *)0, (struct vnode *)0,
2989 	    DR_REMOVE, cr, &rmvp);
2990 	rw_exit(&ip->i_rwlock);
2991 
2992 	if (ulp) {
2993 		TRANS_END_CSYNC(ufsvfsp, error, issync, TOP_REMOVE, trans_size);
2994 		ufs_lockfs_end(ulp);
2995 	}
2996 
2997 	/*
2998 	 * This must be called after the remove transaction is closed.
2999 	 */
3000 	if (rmvp != NULL) {
3001 		/* Only send the event if there were no errors */
3002 		if (error == 0)
3003 			vnevent_remove(rmvp);
3004 		VN_RELE(rmvp);
3005 	}
3006 out:
3007 	TRACE_3(TR_FAC_UFS, TR_UFS_REMOVE_END,
3008 		"ufs_remove_end:vp %p name %s error %d", vp, nm, error);
3009 	return (error);
3010 }
3011 
3012 /*
3013  * Link a file or a directory.  Only privileged processes are allowed to
3014  * make links to directories.
3015  */
3016 static int
3017 ufs_link(struct vnode *tdvp, struct vnode *svp, char *tnm, struct cred *cr)
3018 {
3019 	struct inode *sip;
3020 	struct inode *tdp = VTOI(tdvp);
3021 	struct ufsvfs *ufsvfsp = tdp->i_ufsvfs;
3022 	struct ulockfs *ulp;
3023 	struct vnode *realvp;
3024 	int error;
3025 	int issync;
3026 	int trans_size;
3027 	int isdev;
3028 
3029 	TRACE_1(TR_FAC_UFS, TR_UFS_LINK_START,
3030 		"ufs_link_start:tdvp %p", tdvp);
3031 
3032 	error = ufs_lockfs_begin(ufsvfsp, &ulp, ULOCKFS_LINK_MASK);
3033 	if (error)
3034 		goto out;
3035 
3036 	if (ulp)
3037 		TRANS_BEGIN_CSYNC(ufsvfsp, issync, TOP_LINK,
3038 		    trans_size = (int)TOP_LINK_SIZE(VTOI(tdvp)));
3039 
3040 	if (VOP_REALVP(svp, &realvp) == 0)
3041 		svp = realvp;
3042 
3043 	/*
3044 	 * Make sure link for extended attributes is valid
3045 	 * We only support hard linking of attr in ATTRDIR to ATTRDIR
3046 	 *
3047 	 * Make certain we don't attempt to look at a device node as
3048 	 * a ufs inode.
3049 	 */
3050 
3051 	isdev = IS_DEVVP(svp);
3052 	if (((isdev == 0) && ((VTOI(svp)->i_cflags & IXATTR) == 0) &&
3053 	    ((tdp->i_mode & IFMT) == IFATTRDIR)) ||
3054 	    ((isdev == 0) && (VTOI(svp)->i_cflags & IXATTR) &&
3055 	    ((tdp->i_mode & IFMT) == IFDIR))) {
3056 		error = EINVAL;
3057 		goto unlock;
3058 	}
3059 
3060 	sip = VTOI(svp);
3061 	if ((svp->v_type == VDIR &&
3062 	    secpolicy_fs_linkdir(cr, ufsvfsp->vfs_vfs) != 0) ||
3063 	    (sip->i_uid != crgetuid(cr) && secpolicy_basic_link(cr) != 0)) {
3064 		error = EPERM;
3065 		goto unlock;
3066 	}
3067 	rw_enter(&tdp->i_rwlock, RW_WRITER);
3068 	error = ufs_direnter_lr(tdp, tnm, DE_LINK, (struct inode *)0,
3069 	    sip, cr, NULL);
3070 	rw_exit(&tdp->i_rwlock);
3071 
3072 unlock:
3073 	if (ulp) {
3074 		TRANS_END_CSYNC(ufsvfsp, error, issync, TOP_LINK, trans_size);
3075 		ufs_lockfs_end(ulp);
3076 	}
3077 out:
3078 	TRACE_2(TR_FAC_UFS, TR_UFS_LINK_END,
3079 		"ufs_link_end:tdvp %p error %d", tdvp, error);
3080 	return (error);
3081 }
3082 
3083 uint64_t ufs_rename_retry_cnt;
3084 uint64_t ufs_rename_upgrade_retry_cnt;
3085 uint64_t ufs_rename_dircheck_retry_cnt;
3086 clock_t	 ufs_rename_backoff_delay = 1;
3087 
3088 /*
3089  * Rename a file or directory.
3090  * We are given the vnode and entry string of the source and the
3091  * vnode and entry string of the place we want to move the source
3092  * to (the target). The essential operation is:
3093  *	unlink(target);
3094  *	link(source, target);
3095  *	unlink(source);
3096  * but "atomically".  Can't do full commit without saving state in
3097  * the inode on disk, which isn't feasible at this time.  Best we
3098  * can do is always guarantee that the TARGET exists.
3099  */
3100 /*ARGSUSED*/
3101 static int
3102 ufs_rename(
3103 	struct vnode *sdvp,		/* old (source) parent vnode */
3104 	char *snm,			/* old (source) entry name */
3105 	struct vnode *tdvp,		/* new (target) parent vnode */
3106 	char *tnm,			/* new (target) entry name */
3107 	struct cred *cr)
3108 {
3109 	struct inode *sip = NULL;	/* source inode */
3110 	struct inode *sdp;		/* old (source) parent inode */
3111 	struct inode *tdp;		/* new (target) parent inode */
3112 	struct vnode *tvp = NULL;	/* target vnode, if it exists */
3113 	struct vnode *realvp;
3114 	struct ufsvfs *ufsvfsp;
3115 	struct ulockfs *ulp;
3116 	int error;
3117 	int issync;
3118 	int trans_size;
3119 
3120 	TRACE_1(TR_FAC_UFS, TR_UFS_RENAME_START,
3121 		"ufs_rename_start:sdvp %p", sdvp);
3122 
3123 
3124 	sdp = VTOI(sdvp);
3125 	ufsvfsp = sdp->i_ufsvfs;
3126 	error = ufs_lockfs_begin(ufsvfsp, &ulp, ULOCKFS_RENAME_MASK);
3127 	if (error)
3128 		goto out;
3129 
3130 	if (ulp)
3131 		TRANS_BEGIN_CSYNC(ufsvfsp, issync, TOP_RENAME,
3132 		    trans_size = (int)TOP_RENAME_SIZE(sdp));
3133 
3134 	if (VOP_REALVP(tdvp, &realvp) == 0)
3135 		tdvp = realvp;
3136 
3137 	tdp = VTOI(tdvp);
3138 
3139 	/*
3140 	 * We only allow renaming of attributes from ATTRDIR to ATTRDIR.
3141 	 */
3142 	if ((tdp->i_mode & IFMT) != (sdp->i_mode & IFMT)) {
3143 		error = EINVAL;
3144 		goto unlock;
3145 	}
3146 
3147 	/*
3148 	 * Look up inode of file we're supposed to rename.
3149 	 */
3150 	if (error = ufs_dirlook(sdp, snm, &sip, cr, 0)) {
3151 		goto unlock;
3152 	}
3153 
3154 	/*
3155 	 * Lock both the source and target directories (they may be
3156 	 * the same) to provide the atomicity semantics that was
3157 	 * previously provided by the per file system vfs_rename_lock
3158 	 *
3159 	 * with vfs_rename_lock removed to allow simultaneous renames
3160 	 * within a file system, ufs_dircheckpath can deadlock while
3161 	 * traversing back to ensure that source is not a parent directory
3162 	 * of target parent directory. This is because we get into
3163 	 * ufs_dircheckpath with the sdp and tdp locks held as RW_WRITER.
3164 	 * If the tdp and sdp of the simultaneous renames happen to be
3165 	 * in the path of each other, it can lead to a deadlock. This
3166 	 * can be avoided by getting the locks as RW_READER here and then
3167 	 * upgrading to RW_WRITER after completing the ufs_dircheckpath.
3168 	 */
3169 retry:
3170 	rw_enter(&tdp->i_rwlock, RW_READER);
3171 	if (tdp != sdp) {
3172 		/*
3173 		 * We're locking 2 peer level locks, so must use tryenter
3174 		 * on the 2nd to avoid deadlocks that would occur
3175 		 * if we renamed a->b and b->a concurrently.
3176 		 */
3177 		if (!rw_tryenter(&sdp->i_rwlock, RW_READER)) {
3178 			/*
3179 			 * Reverse the lock grabs in case we have heavy
3180 			 * contention on the 2nd lock.
3181 			 */
3182 			rw_exit(&tdp->i_rwlock);
3183 			rw_enter(&sdp->i_rwlock, RW_READER);
3184 			if (!rw_tryenter(&tdp->i_rwlock, RW_READER)) {
3185 				ufs_rename_retry_cnt++;
3186 				rw_exit(&sdp->i_rwlock);
3187 				goto retry;
3188 			}
3189 		}
3190 	}
3191 
3192 	if (sip == tdp) {
3193 		error = EINVAL;
3194 		goto errout;
3195 	}
3196 	/*
3197 	 * Make sure we can delete the source entry.  This requires
3198 	 * write permission on the containing directory.
3199 	 * Check for sticky directories.
3200 	 */
3201 	rw_enter(&sdp->i_contents, RW_READER);
3202 	rw_enter(&sip->i_contents, RW_READER);
3203 	if ((error = ufs_iaccess(sdp, IWRITE, cr)) != 0 ||
3204 	    (error = ufs_sticky_remove_access(sdp, sip, cr)) != 0) {
3205 		rw_exit(&sip->i_contents);
3206 		rw_exit(&sdp->i_contents);
3207 		goto errout;
3208 	}
3209 
3210 	/*
3211 	 * If this is a rename of a directory and the parent is
3212 	 * different (".." must be changed), then the source
3213 	 * directory must not be in the directory hierarchy
3214 	 * above the target, as this would orphan everything
3215 	 * below the source directory.  Also the user must have
3216 	 * write permission in the source so as to be able to
3217 	 * change "..".
3218 	 */
3219 	if ((((sip->i_mode & IFMT) == IFDIR) ||
3220 	    ((sip->i_mode & IFMT) == IFATTRDIR)) && sdp != tdp) {
3221 		ino_t	inum;
3222 
3223 		if ((error = ufs_iaccess(sip, IWRITE, cr))) {
3224 			rw_exit(&sip->i_contents);
3225 			rw_exit(&sdp->i_contents);
3226 			goto errout;
3227 		}
3228 		inum = sip->i_number;
3229 		rw_exit(&sip->i_contents);
3230 		rw_exit(&sdp->i_contents);
3231 		if ((error = ufs_dircheckpath(inum, tdp, sdp, cr))) {
3232 			/*
3233 			 * If we got EAGAIN ufs_dircheckpath detected a
3234 			 * potential deadlock and backed out. We need
3235 			 * to retry the operation since sdp and tdp have
3236 			 * to be released to avoid the deadlock.
3237 			 */
3238 			if (error == EAGAIN) {
3239 				rw_exit(&tdp->i_rwlock);
3240 				if (tdp != sdp)
3241 					rw_exit(&sdp->i_rwlock);
3242 				delay(ufs_rename_backoff_delay);
3243 				ufs_rename_dircheck_retry_cnt++;
3244 				goto retry;
3245 			}
3246 			goto errout;
3247 		}
3248 	} else {
3249 		rw_exit(&sip->i_contents);
3250 		rw_exit(&sdp->i_contents);
3251 	}
3252 
3253 
3254 	/*
3255 	 * Check for renaming '.' or '..' or alias of '.'
3256 	 */
3257 	if (strcmp(snm, ".") == 0 || strcmp(snm, "..") == 0 || sdp == sip) {
3258 		error = EINVAL;
3259 		goto errout;
3260 	}
3261 
3262 	/*
3263 	 * Simultaneous renames can deadlock in ufs_dircheckpath since it
3264 	 * tries to traverse back the file tree with both tdp and sdp held
3265 	 * as RW_WRITER. To avoid that we have to hold the tdp and sdp locks
3266 	 * as RW_READERS  till ufs_dircheckpath is done.
3267 	 * Now that ufs_dircheckpath is done with, we can upgrade the locks
3268 	 * to RW_WRITER.
3269 	 */
3270 	if (!rw_tryupgrade(&tdp->i_rwlock)) {
3271 		/*
3272 		 * The upgrade failed. We got to give away the lock
3273 		 * as to avoid deadlocking with someone else who is
3274 		 * waiting for writer lock. With the lock gone, we
3275 		 * cannot be sure the checks done above will hold
3276 		 * good when we eventually get them back as writer.
3277 		 * So if we can't upgrade we drop the locks and retry
3278 		 * everything again.
3279 		 */
3280 		rw_exit(&tdp->i_rwlock);
3281 		if (tdp != sdp)
3282 			rw_exit(&sdp->i_rwlock);
3283 		delay(ufs_rename_backoff_delay);
3284 		ufs_rename_upgrade_retry_cnt++;
3285 		goto retry;
3286 	}
3287 	if (tdp != sdp) {
3288 		if (!rw_tryupgrade(&sdp->i_rwlock)) {
3289 			/*
3290 			 * The upgrade failed. We got to give away the lock
3291 			 * as to avoid deadlocking with someone else who is
3292 			 * waiting for writer lock. With the lock gone, we
3293 			 * cannot be sure the checks done above will hold
3294 			 * good when we eventually get them back as writer.
3295 			 * So if we can't upgrade we drop the locks and retry
3296 			 * everything again.
3297 			 */
3298 			rw_exit(&tdp->i_rwlock);
3299 			rw_exit(&sdp->i_rwlock);
3300 			delay(ufs_rename_backoff_delay);
3301 			ufs_rename_upgrade_retry_cnt++;
3302 			goto retry;
3303 		}
3304 	}
3305 	/*
3306 	 * Link source to the target.  If a target exists, return its
3307 	 * vnode pointer in tvp.  We'll release it after sending the
3308 	 * vnevent.
3309 	 */
3310 	if (error = ufs_direnter_lr(tdp, tnm, DE_RENAME, sdp, sip, cr, &tvp)) {
3311 		/*
3312 		 * ESAME isn't really an error; it indicates that the
3313 		 * operation should not be done because the source and target
3314 		 * are the same file, but that no error should be reported.
3315 		 */
3316 		if (error == ESAME)
3317 			error = 0;
3318 		goto errout;
3319 	}
3320 
3321 	/*
3322 	 * Unlink the source.
3323 	 * Remove the source entry.  ufs_dirremove() checks that the entry
3324 	 * still reflects sip, and returns an error if it doesn't.
3325 	 * If the entry has changed just forget about it.  Release
3326 	 * the source inode.
3327 	 */
3328 	if ((error = ufs_dirremove(sdp, snm, sip, (struct vnode *)0,
3329 	    DR_RENAME, cr, NULL)) == ENOENT)
3330 		error = 0;
3331 
3332 errout:
3333 	rw_exit(&tdp->i_rwlock);
3334 	if (sdp != tdp) {
3335 		rw_exit(&sdp->i_rwlock);
3336 	}
3337 
3338 unlock:
3339 	if (ulp) {
3340 		TRANS_END_CSYNC(ufsvfsp, error, issync, TOP_RENAME, trans_size);
3341 		ufs_lockfs_end(ulp);
3342 	}
3343 
3344 	/*
3345 	 * If no errors, send the appropriate events on the source
3346 	 * and destination (a.k.a, target) vnodes, if they exist.
3347 	 * This has to be done after the rename transaction has closed.
3348 	 */
3349 	if (error == 0) {
3350 		if (tvp != NULL)
3351 			vnevent_rename_dest(tvp);
3352 		/*
3353 		 * Note that if ufs_direnter_lr() returned ESAME then
3354 		 * this event will still be sent.  This isn't expected
3355 		 * to be a problem for anticipated usage by consumers.
3356 		 */
3357 		if (sip != NULL)
3358 			vnevent_rename_src(ITOV(sip));
3359 	}
3360 
3361 	if (tvp != NULL)
3362 		VN_RELE(tvp);
3363 
3364 	if (sip != NULL)
3365 		VN_RELE(ITOV(sip));
3366 
3367 out:
3368 	TRACE_5(TR_FAC_UFS, TR_UFS_RENAME_END,
3369 		"ufs_rename_end:sdvp %p snm %s tdvp %p tnm %s error %d",
3370 			sdvp, snm, tdvp, tnm, error);
3371 	return (error);
3372 }
3373 
3374 /*ARGSUSED*/
3375 static int
3376 ufs_mkdir(struct vnode *dvp, char *dirname, struct vattr *vap,
3377 	struct vnode **vpp, struct cred *cr)
3378 {
3379 	struct inode *ip;
3380 	struct inode *xip;
3381 	struct ufsvfs *ufsvfsp;
3382 	struct ulockfs *ulp;
3383 	int error;
3384 	int issync;
3385 	int trans_size;
3386 	int retry = 1;
3387 
3388 	ASSERT((vap->va_mask & (AT_TYPE|AT_MODE)) == (AT_TYPE|AT_MODE));
3389 
3390 	TRACE_1(TR_FAC_UFS, TR_UFS_MKDIR_START,
3391 		"ufs_mkdir_start:dvp %p", dvp);
3392 
3393 	/*
3394 	 * Can't make directory in attr hidden dir
3395 	 */
3396 	if ((VTOI(dvp)->i_mode & IFMT) == IFATTRDIR)
3397 		return (EINVAL);
3398 
3399 again:
3400 	ip = VTOI(dvp);
3401 	ufsvfsp = ip->i_ufsvfs;
3402 	error = ufs_lockfs_begin(ufsvfsp, &ulp, ULOCKFS_MKDIR_MASK);
3403 	if (error)
3404 		goto out;
3405 	if (ulp)
3406 		TRANS_BEGIN_CSYNC(ufsvfsp, issync, TOP_MKDIR,
3407 		    trans_size = (int)TOP_MKDIR_SIZE(ip));
3408 
3409 	rw_enter(&ip->i_rwlock, RW_WRITER);
3410 
3411 	error = ufs_direnter_cm(ip, dirname, DE_MKDIR, vap, &xip, cr,
3412 		(retry ? IQUIET : 0));
3413 
3414 	rw_exit(&ip->i_rwlock);
3415 	if (error == 0) {
3416 		ip = xip;
3417 		*vpp = ITOV(ip);
3418 	} else if (error == EEXIST)
3419 		VN_RELE(ITOV(xip));
3420 
3421 	if (ulp) {
3422 		int terr = 0;
3423 		TRANS_END_CSYNC(ufsvfsp, terr, issync, TOP_MKDIR, trans_size);
3424 		ufs_lockfs_end(ulp);
3425 		if (error == 0)
3426 			error = terr;
3427 	}
3428 out:
3429 	if ((error == ENOSPC) && retry && TRANS_ISTRANS(ufsvfsp)) {
3430 		ufs_delete_drain_wait(ufsvfsp, 1);
3431 		retry = 0;
3432 		goto again;
3433 	}
3434 
3435 	TRACE_2(TR_FAC_UFS, TR_UFS_MKDIR_END,
3436 		"ufs_mkdir_end:dvp %p error %d", dvp, error);
3437 	return (error);
3438 }
3439 
3440 /*ARGSUSED*/
3441 static int
3442 ufs_rmdir(struct vnode *vp, char *nm, struct vnode *cdir, struct cred *cr)
3443 {
3444 	struct inode *ip = VTOI(vp);
3445 	struct ufsvfs *ufsvfsp = ip->i_ufsvfs;
3446 	struct ulockfs *ulp;
3447 	vnode_t *rmvp = NULL;	/* Vnode of removed directory */
3448 	int error;
3449 	int issync;
3450 
3451 	TRACE_1(TR_FAC_UFS, TR_UFS_RMDIR_START,
3452 		"ufs_rmdir_start:vp %p", vp);
3453 
3454 	/*
3455 	 * don't let the delete queue get too long
3456 	 */
3457 	if (ufsvfsp == NULL) {
3458 		error = EIO;
3459 		goto out;
3460 	}
3461 	if (ufsvfsp->vfs_delete.uq_ne > ufs_idle_max)
3462 		ufs_delete_drain(vp->v_vfsp, 1, 1);
3463 
3464 	error = ufs_lockfs_begin(ufsvfsp, &ulp, ULOCKFS_RMDIR_MASK);
3465 	if (error)
3466 		goto out;
3467 
3468 	if (ulp)
3469 		TRANS_BEGIN_CSYNC(ufsvfsp, issync, TOP_RMDIR, TOP_RMDIR_SIZE);
3470 
3471 	rw_enter(&ip->i_rwlock, RW_WRITER);
3472 	error = ufs_dirremove(ip, nm, (struct inode *)0, cdir, DR_RMDIR, cr,
3473 									&rmvp);
3474 	rw_exit(&ip->i_rwlock);
3475 
3476 	if (ulp) {
3477 		TRANS_END_CSYNC(ufsvfsp, error, issync, TOP_RMDIR,
3478 				TOP_RMDIR_SIZE);
3479 		ufs_lockfs_end(ulp);
3480 	}
3481 
3482 	/*
3483 	 * This must be done AFTER the rmdir transaction has closed.
3484 	 */
3485 	if (rmvp != NULL) {
3486 		/* Only send the event if there were no errors */
3487 		if (error == 0)
3488 			vnevent_rmdir(rmvp);
3489 		VN_RELE(rmvp);
3490 	}
3491 out:
3492 	TRACE_2(TR_FAC_UFS, TR_UFS_RMDIR_END,
3493 		"ufs_rmdir_end:vp %p error %d", vp, error);
3494 
3495 	return (error);
3496 }
3497 
3498 /* ARGSUSED */
3499 static int
3500 ufs_readdir(
3501 	struct vnode *vp,
3502 	struct uio *uiop,
3503 	struct cred *cr,
3504 	int *eofp)
3505 {
3506 	struct iovec *iovp;
3507 	struct inode *ip;
3508 	struct direct *idp;
3509 	struct dirent64 *odp;
3510 	struct fbuf *fbp;
3511 	struct ufsvfs *ufsvfsp;
3512 	struct ulockfs *ulp;
3513 	caddr_t outbuf;
3514 	size_t bufsize;
3515 	uint_t offset;
3516 	uint_t bytes_wanted, total_bytes_wanted;
3517 	int incount = 0;
3518 	int outcount = 0;
3519 	int error;
3520 
3521 	ip = VTOI(vp);
3522 	ASSERT(RW_READ_HELD(&ip->i_rwlock));
3523 
3524 	TRACE_2(TR_FAC_UFS, TR_UFS_READDIR_START,
3525 		"ufs_readdir_start:vp %p uiop %p", vp, uiop);
3526 
3527 	if (uiop->uio_loffset >= MAXOFF32_T) {
3528 		if (eofp)
3529 			*eofp = 1;
3530 		return (0);
3531 	}
3532 
3533 	/*
3534 	 * Check if we have been called with a valid iov_len
3535 	 * and bail out if not, otherwise we may potentially loop
3536 	 * forever further down.
3537 	 */
3538 	if (uiop->uio_iov->iov_len <= 0) {
3539 		error = EINVAL;
3540 		goto out;
3541 	}
3542 
3543 	/*
3544 	 * Large Files: When we come here we are guaranteed that
3545 	 * uio_offset can be used safely. The high word is zero.
3546 	 */
3547 
3548 	ufsvfsp = ip->i_ufsvfs;
3549 	error = ufs_lockfs_begin(ufsvfsp, &ulp, ULOCKFS_READDIR_MASK);
3550 	if (error)
3551 		goto out;
3552 
3553 	iovp = uiop->uio_iov;
3554 	total_bytes_wanted = iovp->iov_len;
3555 
3556 	/* Large Files: directory files should not be "large" */
3557 
3558 	ASSERT(ip->i_size <= MAXOFF32_T);
3559 
3560 	/* Force offset to be valid (to guard against bogus lseek() values) */
3561 	offset = (uint_t)uiop->uio_offset & ~(DIRBLKSIZ - 1);
3562 
3563 	/* Quit if at end of file or link count of zero (posix) */
3564 	if (offset >= (uint_t)ip->i_size || ip->i_nlink <= 0) {
3565 		if (eofp)
3566 			*eofp = 1;
3567 		error = 0;
3568 		goto unlock;
3569 	}
3570 
3571 	/*
3572 	 * Get space to change directory entries into fs independent format.
3573 	 * Do fast alloc for the most commonly used-request size (filesystem
3574 	 * block size).
3575 	 */
3576 	if (uiop->uio_segflg != UIO_SYSSPACE || uiop->uio_iovcnt != 1) {
3577 		bufsize = total_bytes_wanted;
3578 		outbuf = kmem_alloc(bufsize, KM_SLEEP);
3579 		odp = (struct dirent64 *)outbuf;
3580 	} else {
3581 		bufsize = total_bytes_wanted;
3582 		odp = (struct dirent64 *)iovp->iov_base;
3583 	}
3584 
3585 nextblk:
3586 	bytes_wanted = total_bytes_wanted;
3587 
3588 	/* Truncate request to file size */
3589 	if (offset + bytes_wanted > (int)ip->i_size)
3590 		bytes_wanted = (int)(ip->i_size - offset);
3591 
3592 	/* Comply with MAXBSIZE boundary restrictions of fbread() */
3593 	if ((offset & MAXBOFFSET) + bytes_wanted > MAXBSIZE)
3594 		bytes_wanted = MAXBSIZE - (offset & MAXBOFFSET);
3595 
3596 	/*
3597 	 * Read in the next chunk.
3598 	 * We are still holding the i_rwlock.
3599 	 */
3600 	error = fbread(vp, (offset_t)offset, bytes_wanted, S_OTHER, &fbp);
3601 
3602 	if (error)
3603 		goto update_inode;
3604 	if (!ULOCKFS_IS_NOIACC(ITOUL(ip)) && (ip->i_fs->fs_ronly == 0) &&
3605 	    (!ufsvfsp->vfs_noatime)) {
3606 		ip->i_flag |= IACC;
3607 	}
3608 	incount = 0;
3609 	idp = (struct direct *)fbp->fb_addr;
3610 	if (idp->d_ino == 0 && idp->d_reclen == 0 &&
3611 		idp->d_namlen == 0) {
3612 		cmn_err(CE_WARN, "ufs_readdir: bad dir, inumber = %llu, "
3613 			"fs = %s\n",
3614 			(u_longlong_t)ip->i_number, ufsvfsp->vfs_fs->fs_fsmnt);
3615 		fbrelse(fbp, S_OTHER);
3616 		error = ENXIO;
3617 		goto update_inode;
3618 	}
3619 	/* Transform to file-system independent format */
3620 	while (incount < bytes_wanted) {
3621 		/*
3622 		 * If the current directory entry is mangled, then skip
3623 		 * to the next block.  It would be nice to set the FSBAD
3624 		 * flag in the super-block so that a fsck is forced on
3625 		 * next reboot, but locking is a problem.
3626 		 */
3627 		if (idp->d_reclen & 0x3) {
3628 			offset = (offset + DIRBLKSIZ) & ~(DIRBLKSIZ-1);
3629 			break;
3630 		}
3631 
3632 		/* Skip to requested offset and skip empty entries */
3633 		if (idp->d_ino != 0 && offset >= (uint_t)uiop->uio_offset) {
3634 			ushort_t this_reclen =
3635 			    DIRENT64_RECLEN(idp->d_namlen);
3636 			/* Buffer too small for any entries */
3637 			if (!outcount && this_reclen > bufsize) {
3638 				fbrelse(fbp, S_OTHER);
3639 				error = EINVAL;
3640 				goto update_inode;
3641 			}
3642 			/* If would overrun the buffer, quit */
3643 			if (outcount + this_reclen > bufsize) {
3644 				break;
3645 			}
3646 			/* Take this entry */
3647 			odp->d_ino = (ino64_t)idp->d_ino;
3648 			odp->d_reclen = (ushort_t)this_reclen;
3649 			odp->d_off = (offset_t)(offset + idp->d_reclen);
3650 
3651 			/* use strncpy(9f) to zero out uninitialized bytes */
3652 
3653 			ASSERT(strlen(idp->d_name) + 1 <=
3654 			    DIRENT64_NAMELEN(this_reclen));
3655 			(void) strncpy(odp->d_name, idp->d_name,
3656 			    DIRENT64_NAMELEN(this_reclen));
3657 			outcount += odp->d_reclen;
3658 			odp = (struct dirent64 *)((intptr_t)odp +
3659 				    odp->d_reclen);
3660 			ASSERT(outcount <= bufsize);
3661 		}
3662 		if (idp->d_reclen) {
3663 			incount += idp->d_reclen;
3664 			offset += idp->d_reclen;
3665 			idp = (struct direct *)((intptr_t)idp + idp->d_reclen);
3666 		} else {
3667 			offset = (offset + DIRBLKSIZ) & ~(DIRBLKSIZ-1);
3668 			break;
3669 		}
3670 	}
3671 	/* Release the chunk */
3672 	fbrelse(fbp, S_OTHER);
3673 
3674 	/* Read whole block, but got no entries, read another if not eof */
3675 
3676 	/*
3677 	 * Large Files: casting i_size to int here is not a problem
3678 	 * because directory sizes are always less than MAXOFF32_T.
3679 	 * See assertion above.
3680 	 */
3681 
3682 	if (offset < (int)ip->i_size && !outcount)
3683 		goto nextblk;
3684 
3685 	/* Copy out the entry data */
3686 	if (uiop->uio_segflg == UIO_SYSSPACE && uiop->uio_iovcnt == 1) {
3687 		iovp->iov_base += outcount;
3688 		iovp->iov_len -= outcount;
3689 		uiop->uio_resid -= outcount;
3690 		uiop->uio_offset = offset;
3691 	} else if ((error = uiomove(outbuf, (long)outcount, UIO_READ,
3692 				    uiop)) == 0)
3693 		uiop->uio_offset = offset;
3694 update_inode:
3695 	ITIMES(ip);
3696 	if (uiop->uio_segflg != UIO_SYSSPACE || uiop->uio_iovcnt != 1)
3697 		kmem_free(outbuf, bufsize);
3698 
3699 	if (eofp && error == 0)
3700 		*eofp = (uiop->uio_offset >= (int)ip->i_size);
3701 unlock:
3702 	if (ulp) {
3703 		ufs_lockfs_end(ulp);
3704 	}
3705 out:
3706 	TRACE_2(TR_FAC_UFS, TR_UFS_READDIR_END,
3707 		"ufs_readdir_end:vp %p error %d", vp, error);
3708 	return (error);
3709 }
3710 
3711 /*ARGSUSED*/
3712 static int
3713 ufs_symlink(
3714 	struct vnode *dvp,		/* ptr to parent dir vnode */
3715 	char *linkname,			/* name of symbolic link */
3716 	struct vattr *vap,		/* attributes */
3717 	char *target,			/* target path */
3718 	struct cred *cr)		/* user credentials */
3719 {
3720 	struct inode *ip, *dip = VTOI(dvp);
3721 	struct ufsvfs *ufsvfsp = dip->i_ufsvfs;
3722 	struct ulockfs *ulp;
3723 	int error;
3724 	int issync;
3725 	int trans_size;
3726 	int residual;
3727 	int ioflag;
3728 	int retry = 1;
3729 
3730 	TRACE_1(TR_FAC_UFS, TR_UFS_SYMLINK_START,
3731 		"ufs_symlink_start:dvp %p", dvp);
3732 
3733 	/*
3734 	 * No symlinks in attrdirs at this time
3735 	 */
3736 	if ((VTOI(dvp)->i_mode & IFMT) == IFATTRDIR)
3737 		return (EINVAL);
3738 
3739 again:
3740 	ip = (struct inode *)NULL;
3741 	vap->va_type = VLNK;
3742 	vap->va_rdev = 0;
3743 
3744 	error = ufs_lockfs_begin(ufsvfsp, &ulp, ULOCKFS_SYMLINK_MASK);
3745 	if (error)
3746 		goto out;
3747 
3748 	if (ulp)
3749 		TRANS_BEGIN_CSYNC(ufsvfsp, issync, TOP_SYMLINK,
3750 		    trans_size = (int)TOP_SYMLINK_SIZE(dip));
3751 
3752 	/*
3753 	 * We must create the inode before the directory entry, to avoid
3754 	 * racing with readlink().  ufs_dirmakeinode requires that we
3755 	 * hold the quota lock as reader, and directory locks as writer.
3756 	 */
3757 
3758 	rw_enter(&dip->i_rwlock, RW_WRITER);
3759 	rw_enter(&ufsvfsp->vfs_dqrwlock, RW_READER);
3760 	rw_enter(&dip->i_contents, RW_WRITER);
3761 
3762 	/*
3763 	 * Suppress any out of inodes messages if we will retry on
3764 	 * ENOSP
3765 	 */
3766 	if (retry)
3767 		dip->i_flag |= IQUIET;
3768 
3769 	error = ufs_dirmakeinode(dip, &ip, vap, DE_SYMLINK, cr);
3770 
3771 	dip->i_flag &= ~IQUIET;
3772 
3773 	rw_exit(&dip->i_contents);
3774 	rw_exit(&ufsvfsp->vfs_dqrwlock);
3775 	rw_exit(&dip->i_rwlock);
3776 
3777 	if (error)
3778 		goto unlock;
3779 
3780 	/*
3781 	 * OK.  The inode has been created.  Write out the data of the
3782 	 * symbolic link.  Since symbolic links are metadata, and should
3783 	 * remain consistent across a system crash, we need to force the
3784 	 * data out synchronously.
3785 	 *
3786 	 * (This is a change from the semantics in earlier releases, which
3787 	 * only created symbolic links synchronously if the semi-documented
3788 	 * 'syncdir' option was set, or if we were being invoked by the NFS
3789 	 * server, which requires symbolic links to be created synchronously.)
3790 	 *
3791 	 * We need to pass in a pointer for the residual length; otherwise
3792 	 * ufs_rdwri() will always return EIO if it can't write the data,
3793 	 * even if the error was really ENOSPC or EDQUOT.
3794 	 */
3795 
3796 	ioflag = FWRITE | FDSYNC;
3797 	residual = 0;
3798 
3799 	rw_enter(&ufsvfsp->vfs_dqrwlock, RW_READER);
3800 	rw_enter(&ip->i_contents, RW_WRITER);
3801 
3802 	/*
3803 	 * Suppress file system full messages if we will retry
3804 	 */
3805 	if (retry)
3806 		ip->i_flag |= IQUIET;
3807 
3808 	error = ufs_rdwri(UIO_WRITE, ioflag, ip, target, strlen(target),
3809 	    (offset_t)0, UIO_SYSSPACE, &residual, cr);
3810 
3811 	ip->i_flag &= ~IQUIET;
3812 
3813 	if (error) {
3814 		rw_exit(&ip->i_contents);
3815 		rw_exit(&ufsvfsp->vfs_dqrwlock);
3816 		goto remove;
3817 	}
3818 
3819 	/*
3820 	 * If the link's data is small enough, we can cache it in the inode.
3821 	 * This is a "fast symbolic link".  We don't use the first direct
3822 	 * block because that's actually used to point at the symbolic link's
3823 	 * contents on disk; but we know that none of the other direct or
3824 	 * indirect blocks can be used because symbolic links are restricted
3825 	 * to be smaller than a file system block.
3826 	 */
3827 
3828 	ASSERT(MAXPATHLEN <= VBSIZE(ITOV(ip)));
3829 
3830 	if (ip->i_size > 0 && ip->i_size <= FSL_SIZE) {
3831 		if (kcopy(target, &ip->i_db[1], ip->i_size) == 0) {
3832 			ip->i_flag |= IFASTSYMLNK;
3833 		} else {
3834 			int i;
3835 			/* error, clear garbage left behind */
3836 			for (i = 1; i < NDADDR; i++)
3837 				ip->i_db[i] = 0;
3838 			for (i = 0; i < NIADDR; i++)
3839 				ip->i_ib[i] = 0;
3840 		}
3841 	}
3842 
3843 	rw_exit(&ip->i_contents);
3844 	rw_exit(&ufsvfsp->vfs_dqrwlock);
3845 
3846 	/*
3847 	 * OK.  We've successfully created the symbolic link.  All that
3848 	 * remains is to insert it into the appropriate directory.
3849 	 */
3850 
3851 	rw_enter(&dip->i_rwlock, RW_WRITER);
3852 	error = ufs_direnter_lr(dip, linkname, DE_SYMLINK, NULL, ip, cr, NULL);
3853 	rw_exit(&dip->i_rwlock);
3854 
3855 	/*
3856 	 * Fall through into remove-on-error code.  We're either done, or we
3857 	 * need to remove the inode (if we couldn't insert it).
3858 	 */
3859 
3860 remove:
3861 	if (error && (ip != NULL)) {
3862 		rw_enter(&ip->i_contents, RW_WRITER);
3863 		ip->i_nlink--;
3864 		ip->i_flag |= ICHG;
3865 		ip->i_seq++;
3866 		ufs_setreclaim(ip);
3867 		rw_exit(&ip->i_contents);
3868 	}
3869 
3870 unlock:
3871 	if (ip != NULL)
3872 		VN_RELE(ITOV(ip));
3873 
3874 	if (ulp) {
3875 		int terr = 0;
3876 
3877 		TRANS_END_CSYNC(ufsvfsp, terr, issync, TOP_SYMLINK,
3878 				trans_size);
3879 		ufs_lockfs_end(ulp);
3880 		if (error == 0)
3881 			error = terr;
3882 	}
3883 
3884 	/*
3885 	 * We may have failed due to lack of an inode or of a block to
3886 	 * store the target in.  Try flushing the delete queue to free
3887 	 * logically-available things up and try again.
3888 	 */
3889 	if ((error == ENOSPC) && retry && TRANS_ISTRANS(ufsvfsp)) {
3890 		ufs_delete_drain_wait(ufsvfsp, 1);
3891 		retry = 0;
3892 		goto again;
3893 	}
3894 
3895 out:
3896 	TRACE_2(TR_FAC_UFS, TR_UFS_SYMLINK_END,
3897 		"ufs_symlink_end:dvp %p error %d", dvp, error);
3898 	return (error);
3899 }
3900 
3901 /*
3902  * Ufs specific routine used to do ufs io.
3903  */
3904 int
3905 ufs_rdwri(enum uio_rw rw, int ioflag, struct inode *ip, caddr_t base,
3906 	ssize_t len, offset_t offset, enum uio_seg seg, int *aresid,
3907 	struct cred *cr)
3908 {
3909 	struct uio auio;
3910 	struct iovec aiov;
3911 	int error;
3912 
3913 	ASSERT(RW_LOCK_HELD(&ip->i_contents));
3914 
3915 	bzero((caddr_t)&auio, sizeof (uio_t));
3916 	bzero((caddr_t)&aiov, sizeof (iovec_t));
3917 
3918 	aiov.iov_base = base;
3919 	aiov.iov_len = len;
3920 	auio.uio_iov = &aiov;
3921 	auio.uio_iovcnt = 1;
3922 	auio.uio_loffset = offset;
3923 	auio.uio_segflg = (short)seg;
3924 	auio.uio_resid = len;
3925 
3926 	if (rw == UIO_WRITE) {
3927 		auio.uio_fmode = FWRITE;
3928 		auio.uio_extflg = UIO_COPY_DEFAULT;
3929 		auio.uio_llimit = curproc->p_fsz_ctl;
3930 		error = wrip(ip, &auio, ioflag, cr);
3931 	} else {
3932 		auio.uio_fmode = FREAD;
3933 		auio.uio_extflg = UIO_COPY_CACHED;
3934 		auio.uio_llimit = MAXOFFSET_T;
3935 		error = rdip(ip, &auio, ioflag, cr);
3936 	}
3937 
3938 	if (aresid) {
3939 		*aresid = auio.uio_resid;
3940 	} else if (auio.uio_resid) {
3941 		error = EIO;
3942 	}
3943 	return (error);
3944 }
3945 
3946 static int
3947 ufs_fid(vp, fidp)
3948 	struct vnode *vp;
3949 	struct fid *fidp;
3950 {
3951 	struct ufid *ufid;
3952 	struct inode *ip = VTOI(vp);
3953 
3954 	if (ip->i_ufsvfs == NULL)
3955 		return (EIO);
3956 
3957 	if (fidp->fid_len < (sizeof (struct ufid) - sizeof (ushort_t))) {
3958 		fidp->fid_len = sizeof (struct ufid) - sizeof (ushort_t);
3959 		return (ENOSPC);
3960 	}
3961 
3962 	ufid = (struct ufid *)fidp;
3963 	bzero((char *)ufid, sizeof (struct ufid));
3964 	ufid->ufid_len = sizeof (struct ufid) - sizeof (ushort_t);
3965 	ufid->ufid_ino = ip->i_number;
3966 	ufid->ufid_gen = ip->i_gen;
3967 
3968 	return (0);
3969 }
3970 
3971 /* ARGSUSED2 */
3972 static int
3973 ufs_rwlock(struct vnode *vp, int write_lock, caller_context_t *ctp)
3974 {
3975 	struct inode	*ip = VTOI(vp);
3976 	struct ufsvfs	*ufsvfsp;
3977 	int		forcedirectio;
3978 
3979 	/*
3980 	 * Read case is easy.
3981 	 */
3982 	if (!write_lock) {
3983 		rw_enter(&ip->i_rwlock, RW_READER);
3984 		return (V_WRITELOCK_FALSE);
3985 	}
3986 
3987 	/*
3988 	 * Caller has requested a writer lock, but that inhibits any
3989 	 * concurrency in the VOPs that follow. Acquire the lock shared
3990 	 * and defer exclusive access until it is known to be needed in
3991 	 * other VOP handlers. Some cases can be determined here.
3992 	 */
3993 
3994 	/*
3995 	 * If directio is not set, there is no chance of concurrency,
3996 	 * so just acquire the lock exclusive. Beware of a forced
3997 	 * unmount before looking at the mount option.
3998 	 */
3999 	ufsvfsp = ip->i_ufsvfs;
4000 	forcedirectio = ufsvfsp ? ufsvfsp->vfs_forcedirectio : 0;
4001 	if (!(ip->i_flag & IDIRECTIO || forcedirectio) ||
4002 	    !ufs_allow_shared_writes) {
4003 		rw_enter(&ip->i_rwlock, RW_WRITER);
4004 		return (V_WRITELOCK_TRUE);
4005 	}
4006 
4007 	/*
4008 	 * Mandatory locking forces acquiring i_rwlock exclusive.
4009 	 */
4010 	if (MANDLOCK(vp, ip->i_mode)) {
4011 		rw_enter(&ip->i_rwlock, RW_WRITER);
4012 		return (V_WRITELOCK_TRUE);
4013 	}
4014 
4015 	/*
4016 	 * Acquire the lock shared in case a concurrent write follows.
4017 	 * Mandatory locking could have become enabled before the lock
4018 	 * was acquired. Re-check and upgrade if needed.
4019 	 */
4020 	rw_enter(&ip->i_rwlock, RW_READER);
4021 	if (MANDLOCK(vp, ip->i_mode)) {
4022 		rw_exit(&ip->i_rwlock);
4023 		rw_enter(&ip->i_rwlock, RW_WRITER);
4024 		return (V_WRITELOCK_TRUE);
4025 	}
4026 	return (V_WRITELOCK_FALSE);
4027 }
4028 
4029 /*ARGSUSED*/
4030 static void
4031 ufs_rwunlock(struct vnode *vp, int write_lock, caller_context_t *ctp)
4032 {
4033 	struct inode	*ip = VTOI(vp);
4034 
4035 	rw_exit(&ip->i_rwlock);
4036 }
4037 
4038 /* ARGSUSED */
4039 static int
4040 ufs_seek(struct vnode *vp, offset_t ooff, offset_t *noffp)
4041 {
4042 	return ((*noffp < 0 || *noffp > MAXOFFSET_T) ? EINVAL : 0);
4043 }
4044 
4045 /* ARGSUSED */
4046 static int
4047 ufs_frlock(struct vnode *vp, int cmd, struct flock64 *bfp, int flag,
4048 	offset_t offset, struct flk_callback *flk_cbp, struct cred *cr)
4049 {
4050 	struct inode *ip = VTOI(vp);
4051 
4052 	if (ip->i_ufsvfs == NULL)
4053 		return (EIO);
4054 
4055 	/*
4056 	 * If file is being mapped, disallow frlock.
4057 	 * XXX I am not holding tlock while checking i_mapcnt because the
4058 	 * current locking strategy drops all locks before calling fs_frlock.
4059 	 * So, mapcnt could change before we enter fs_frlock making is
4060 	 * meaningless to have held tlock in the first place.
4061 	 */
4062 	if (ip->i_mapcnt > 0 && MANDLOCK(vp, ip->i_mode))
4063 		return (EAGAIN);
4064 	return (fs_frlock(vp, cmd, bfp, flag, offset, flk_cbp, cr));
4065 }
4066 
4067 /* ARGSUSED */
4068 static int
4069 ufs_space(
4070 	struct vnode *vp,
4071 	int cmd,
4072 	struct flock64 *bfp,
4073 	int flag,
4074 	offset_t offset,
4075 	cred_t *cr,
4076 	caller_context_t *ct)
4077 {
4078 	struct ufsvfs *ufsvfsp	= VTOI(vp)->i_ufsvfs;
4079 	struct ulockfs *ulp;
4080 	int error;
4081 
4082 	error = ufs_lockfs_begin(ufsvfsp, &ulp, ULOCKFS_SPACE_MASK);
4083 	if (error)
4084 		return (error);
4085 
4086 
4087 	if (cmd != F_FREESP)
4088 		error =  EINVAL;
4089 	else if ((error = convoff(vp, bfp, 0, offset)) == 0)
4090 		error = ufs_freesp(vp, bfp, flag, cr);
4091 
4092 	if (ulp)
4093 		ufs_lockfs_end(ulp);
4094 	return (error);
4095 }
4096 
4097 /*
4098  * Used to determine if read ahead should be done. Also used to
4099  * to determine when write back occurs.
4100  */
4101 #define	CLUSTSZ(ip)		((ip)->i_ufsvfs->vfs_ioclustsz)
4102 
4103 /*
4104  * A faster version of ufs_getpage.
4105  *
4106  * We optimize by inlining the pvn_getpages iterator, eliminating
4107  * calls to bmap_read if file doesn't have UFS holes, and avoiding
4108  * the overhead of page_exists().
4109  *
4110  * When files has UFS_HOLES and ufs_getpage is called with S_READ,
4111  * we set *protp to PROT_READ to avoid calling bmap_read. This approach
4112  * victimizes performance when a file with UFS holes is faulted
4113  * first in the S_READ mode, and then in the S_WRITE mode. We will get
4114  * two MMU faults in this case.
4115  *
4116  * XXX - the inode fields which control the sequential mode are not
4117  *	 protected by any mutex. The read ahead will act wild if
4118  *	 multiple processes will access the file concurrently and
4119  *	 some of them in sequential mode. One particulary bad case
4120  *	 is if another thread will change the value of i_nextrio between
4121  *	 the time this thread tests the i_nextrio value and then reads it
4122  *	 again to use it as the offset for the read ahead.
4123  */
4124 static int
4125 ufs_getpage(struct vnode *vp, offset_t off, size_t len, uint_t *protp,
4126 	page_t *plarr[], size_t plsz, struct seg *seg, caddr_t addr,
4127 	enum seg_rw rw, struct cred *cr)
4128 {
4129 	u_offset_t	uoff = (u_offset_t)off; /* type conversion */
4130 	u_offset_t	pgoff;
4131 	u_offset_t	eoff;
4132 	struct inode 	*ip = VTOI(vp);
4133 	struct ufsvfs	*ufsvfsp = ip->i_ufsvfs;
4134 	struct fs 	*fs;
4135 	struct ulockfs	*ulp;
4136 	page_t		**pl;
4137 	caddr_t		pgaddr;
4138 	krw_t		rwtype;
4139 	int 		err;
4140 	int		has_holes;
4141 	int		beyond_eof;
4142 	int		seqmode;
4143 	int		pgsize = PAGESIZE;
4144 	int		dolock;
4145 	int		do_qlock;
4146 	int		trans_size;
4147 
4148 	TRACE_1(TR_FAC_UFS, TR_UFS_GETPAGE_START,
4149 		"ufs_getpage_start:vp %p", vp);
4150 
4151 	ASSERT((uoff & PAGEOFFSET) == 0);
4152 
4153 	if (protp)
4154 		*protp = PROT_ALL;
4155 
4156 	/*
4157 	 * Obey the lockfs protocol
4158 	 */
4159 	err = ufs_lockfs_begin_getpage(ufsvfsp, &ulp, seg,
4160 			rw == S_READ || rw == S_EXEC, protp);
4161 	if (err)
4162 		goto out;
4163 
4164 	fs = ufsvfsp->vfs_fs;
4165 
4166 	if (ulp && (rw == S_CREATE || rw == S_WRITE) &&
4167 	    !(vp->v_flag & VISSWAP)) {
4168 		/*
4169 		 * Try to start a transaction, will return if blocking is
4170 		 * expected to occur and the address space is not the
4171 		 * kernel address space.
4172 		 */
4173 		trans_size = TOP_GETPAGE_SIZE(ip);
4174 		if (seg->s_as != &kas) {
4175 			TRANS_TRY_BEGIN_ASYNC(ufsvfsp, TOP_GETPAGE,
4176 				trans_size, err)
4177 			if (err == EWOULDBLOCK) {
4178 				/*
4179 				 * Use EDEADLK here because the VM code
4180 				 * can normally never see this error.
4181 				 */
4182 				err = EDEADLK;
4183 				ufs_lockfs_end(ulp);
4184 				goto out;
4185 			}
4186 		} else {
4187 			TRANS_BEGIN_ASYNC(ufsvfsp, TOP_GETPAGE, trans_size);
4188 		}
4189 	}
4190 
4191 	if (vp->v_flag & VNOMAP) {
4192 		err = ENOSYS;
4193 		goto unlock;
4194 	}
4195 
4196 	seqmode = ip->i_nextr == uoff && rw != S_CREATE;
4197 
4198 	rwtype = RW_READER;		/* start as a reader */
4199 	dolock = (rw_owner(&ip->i_contents) != curthread);
4200 	/*
4201 	 * If this thread owns the lock, i.e., this thread grabbed it
4202 	 * as writer somewhere above, then we don't need to grab the
4203 	 * lock as reader in this routine.
4204 	 */
4205 	do_qlock = (rw_owner(&ufsvfsp->vfs_dqrwlock) != curthread);
4206 
4207 retrylock:
4208 	if (dolock) {
4209 		/*
4210 		 * Grab the quota lock if we need to call
4211 		 * bmap_write() below (with i_contents as writer).
4212 		 */
4213 		if (do_qlock && rwtype == RW_WRITER)
4214 			rw_enter(&ufsvfsp->vfs_dqrwlock, RW_READER);
4215 		rw_enter(&ip->i_contents, rwtype);
4216 	}
4217 
4218 	/*
4219 	 * We may be getting called as a side effect of a bmap using
4220 	 * fbread() when the blocks might be being allocated and the
4221 	 * size has not yet been up'ed.  In this case we want to be
4222 	 * able to return zero pages if we get back UFS_HOLE from
4223 	 * calling bmap for a non write case here.  We also might have
4224 	 * to read some frags from the disk into a page if we are
4225 	 * extending the number of frags for a given lbn in bmap().
4226 	 * Large Files: The read of i_size here is atomic because
4227 	 * i_contents is held here. If dolock is zero, the lock
4228 	 * is held in bmap routines.
4229 	 */
4230 	beyond_eof = uoff + len > ip->i_size + PAGEOFFSET;
4231 	if (beyond_eof && seg != segkmap) {
4232 		if (dolock) {
4233 			rw_exit(&ip->i_contents);
4234 			if (do_qlock && rwtype == RW_WRITER)
4235 				rw_exit(&ufsvfsp->vfs_dqrwlock);
4236 		}
4237 		err = EFAULT;
4238 		goto unlock;
4239 	}
4240 
4241 	/*
4242 	 * Must hold i_contents lock throughout the call to pvn_getpages
4243 	 * since locked pages are returned from each call to ufs_getapage.
4244 	 * Must *not* return locked pages and then try for contents lock
4245 	 * due to lock ordering requirements (inode > page)
4246 	 */
4247 
4248 	has_holes = bmap_has_holes(ip);
4249 
4250 	if ((rw == S_WRITE || rw == S_CREATE) && has_holes && !beyond_eof) {
4251 		int	blk_size;
4252 		u_offset_t offset;
4253 
4254 		/*
4255 		 * We must acquire the RW_WRITER lock in order to
4256 		 * call bmap_write().
4257 		 */
4258 		if (dolock && rwtype == RW_READER) {
4259 			rwtype = RW_WRITER;
4260 
4261 			/*
4262 			 * Grab the quota lock before
4263 			 * upgrading i_contents, but if we can't grab it
4264 			 * don't wait here due to lock order:
4265 			 * vfs_dqrwlock > i_contents.
4266 			 */
4267 			if (do_qlock && rw_tryenter(&ufsvfsp->vfs_dqrwlock,
4268 							RW_READER) == 0) {
4269 				rw_exit(&ip->i_contents);
4270 				goto retrylock;
4271 			}
4272 			if (!rw_tryupgrade(&ip->i_contents)) {
4273 				rw_exit(&ip->i_contents);
4274 				if (do_qlock)
4275 					rw_exit(&ufsvfsp->vfs_dqrwlock);
4276 				goto retrylock;
4277 			}
4278 		}
4279 
4280 		/*
4281 		 * May be allocating disk blocks for holes here as
4282 		 * a result of mmap faults. write(2) does the bmap_write
4283 		 * in rdip/wrip, not here. We are not dealing with frags
4284 		 * in this case.
4285 		 */
4286 		/*
4287 		 * Large Files: We cast fs_bmask field to offset_t
4288 		 * just as we do for MAXBMASK because uoff is a 64-bit
4289 		 * data type. fs_bmask will still be a 32-bit type
4290 		 * as we cannot change any ondisk data structures.
4291 		 */
4292 
4293 		offset = uoff & (offset_t)fs->fs_bmask;
4294 		while (offset < uoff + len) {
4295 			blk_size = (int)blksize(fs, ip, lblkno(fs, offset));
4296 			err = bmap_write(ip, offset, blk_size, 0, cr);
4297 			if (ip->i_flag & (ICHG|IUPD))
4298 				ip->i_seq++;
4299 			if (err)
4300 				goto update_inode;
4301 			offset += blk_size; /* XXX - make this contig */
4302 		}
4303 	}
4304 
4305 	/*
4306 	 * Can be a reader from now on.
4307 	 */
4308 	if (dolock && rwtype == RW_WRITER) {
4309 		rw_downgrade(&ip->i_contents);
4310 		/*
4311 		 * We can release vfs_dqrwlock early so do it, but make
4312 		 * sure we don't try to release it again at the bottom.
4313 		 */
4314 		if (do_qlock) {
4315 			rw_exit(&ufsvfsp->vfs_dqrwlock);
4316 			do_qlock = 0;
4317 		}
4318 	}
4319 
4320 	/*
4321 	 * We remove PROT_WRITE in cases when the file has UFS holes
4322 	 * because we don't  want to call bmap_read() to check each
4323 	 * page if it is backed with a disk block.
4324 	 */
4325 	if (protp && has_holes && rw != S_WRITE && rw != S_CREATE)
4326 		*protp &= ~PROT_WRITE;
4327 
4328 	err = 0;
4329 
4330 	/*
4331 	 * The loop looks up pages in the range [off, off + len).
4332 	 * For each page, we first check if we should initiate an asynchronous
4333 	 * read ahead before we call page_lookup (we may sleep in page_lookup
4334 	 * for a previously initiated disk read).
4335 	 */
4336 	eoff = (uoff + len);
4337 	for (pgoff = uoff, pgaddr = addr, pl = plarr;
4338 	    pgoff < eoff; /* empty */) {
4339 		page_t	*pp;
4340 		u_offset_t	nextrio;
4341 		se_t	se;
4342 		int retval;
4343 
4344 		se = ((rw == S_CREATE || rw == S_OTHER) ? SE_EXCL : SE_SHARED);
4345 
4346 		/* Handle async getpage (faultahead) */
4347 		if (plarr == NULL) {
4348 			ip->i_nextrio = pgoff;
4349 			(void) ufs_getpage_ra(vp, pgoff, seg, pgaddr);
4350 			pgoff += pgsize;
4351 			pgaddr += pgsize;
4352 			continue;
4353 		}
4354 		/*
4355 		 * Check if we should initiate read ahead of next cluster.
4356 		 * We call page_exists only when we need to confirm that
4357 		 * we have the current page before we initiate the read ahead.
4358 		 */
4359 		nextrio = ip->i_nextrio;
4360 		if (seqmode &&
4361 		    pgoff + CLUSTSZ(ip) >= nextrio && pgoff <= nextrio &&
4362 		    nextrio < ip->i_size && page_exists(vp, pgoff)) {
4363 			retval = ufs_getpage_ra(vp, pgoff, seg, pgaddr);
4364 			/*
4365 			 * We always read ahead the next cluster of data
4366 			 * starting from i_nextrio. If the page (vp,nextrio)
4367 			 * is actually in core at this point, the routine
4368 			 * ufs_getpage_ra() will stop pre-fetching data
4369 			 * until we read that page in a synchronized manner
4370 			 * through ufs_getpage_miss(). So, we should increase
4371 			 * i_nextrio if the page (vp, nextrio) exists.
4372 			 */
4373 			if ((retval == 0) && page_exists(vp, nextrio)) {
4374 				ip->i_nextrio = nextrio + pgsize;
4375 			}
4376 		}
4377 
4378 		if ((pp = page_lookup(vp, pgoff, se)) != NULL) {
4379 			/*
4380 			 * We found the page in the page cache.
4381 			 */
4382 			*pl++ = pp;
4383 			pgoff += pgsize;
4384 			pgaddr += pgsize;
4385 			len -= pgsize;
4386 			plsz -= pgsize;
4387 		} else  {
4388 			/*
4389 			 * We have to create the page, or read it from disk.
4390 			 */
4391 			if (err = ufs_getpage_miss(vp, pgoff, len, seg, pgaddr,
4392 			    pl, plsz, rw, seqmode))
4393 				goto error;
4394 
4395 			while (*pl != NULL) {
4396 				pl++;
4397 				pgoff += pgsize;
4398 				pgaddr += pgsize;
4399 				len -= pgsize;
4400 				plsz -= pgsize;
4401 			}
4402 		}
4403 	}
4404 
4405 	/*
4406 	 * Return pages up to plsz if they are in the page cache.
4407 	 * We cannot return pages if there is a chance that they are
4408 	 * backed with a UFS hole and rw is S_WRITE or S_CREATE.
4409 	 */
4410 	if (plarr && !(has_holes && (rw == S_WRITE || rw == S_CREATE))) {
4411 
4412 		ASSERT((protp == NULL) ||
4413 			!(has_holes && (*protp & PROT_WRITE)));
4414 
4415 		eoff = pgoff + plsz;
4416 		while (pgoff < eoff) {
4417 			page_t		*pp;
4418 
4419 			if ((pp = page_lookup_nowait(vp, pgoff,
4420 			    SE_SHARED)) == NULL)
4421 				break;
4422 
4423 			*pl++ = pp;
4424 			pgoff += pgsize;
4425 			plsz -= pgsize;
4426 		}
4427 	}
4428 
4429 	if (plarr)
4430 		*pl = NULL;			/* Terminate page list */
4431 	ip->i_nextr = pgoff;
4432 
4433 error:
4434 	if (err && plarr) {
4435 		/*
4436 		 * Release any pages we have locked.
4437 		 */
4438 		while (pl > &plarr[0])
4439 			page_unlock(*--pl);
4440 
4441 		plarr[0] = NULL;
4442 	}
4443 
4444 update_inode:
4445 	/*
4446 	 * If the inode is not already marked for IACC (in rdip() for read)
4447 	 * and the inode is not marked for no access time update (in wrip()
4448 	 * for write) then update the inode access time and mod time now.
4449 	 */
4450 	if ((ip->i_flag & (IACC | INOACC)) == 0) {
4451 		if ((rw != S_OTHER) && (ip->i_mode & IFMT) != IFDIR) {
4452 			if (!ULOCKFS_IS_NOIACC(ITOUL(ip)) &&
4453 			    (fs->fs_ronly == 0) &&
4454 			    (!ufsvfsp->vfs_noatime)) {
4455 				mutex_enter(&ip->i_tlock);
4456 				ip->i_flag |= IACC;
4457 				ITIMES_NOLOCK(ip);
4458 				mutex_exit(&ip->i_tlock);
4459 			}
4460 		}
4461 	}
4462 
4463 	if (dolock) {
4464 		rw_exit(&ip->i_contents);
4465 		if (do_qlock && rwtype == RW_WRITER)
4466 			rw_exit(&ufsvfsp->vfs_dqrwlock);
4467 	}
4468 
4469 unlock:
4470 	if (ulp) {
4471 		if ((rw == S_CREATE || rw == S_WRITE) &&
4472 		    !(vp->v_flag & VISSWAP)) {
4473 			TRANS_END_ASYNC(ufsvfsp, TOP_GETPAGE, trans_size);
4474 		}
4475 		ufs_lockfs_end(ulp);
4476 	}
4477 out:
4478 	TRACE_2(TR_FAC_UFS, TR_UFS_GETPAGE_END,
4479 		"ufs_getpage_end:vp %p error %d", vp, err);
4480 	return (err);
4481 }
4482 
4483 /*
4484  * ufs_getpage_miss is called when ufs_getpage missed the page in the page
4485  * cache. The page is either read from the disk, or it's created.
4486  * A page is created (without disk read) if rw == S_CREATE, or if
4487  * the page is not backed with a real disk block (UFS hole).
4488  */
4489 /* ARGSUSED */
4490 static int
4491 ufs_getpage_miss(struct vnode *vp, u_offset_t off, size_t len, struct seg *seg,
4492 	caddr_t addr, page_t *pl[], size_t plsz, enum seg_rw rw, int seq)
4493 {
4494 	struct inode	*ip = VTOI(vp);
4495 	page_t		*pp;
4496 	daddr_t		bn;
4497 	size_t		io_len;
4498 	int		crpage;
4499 	int		err;
4500 	int		contig;
4501 	int		bsize = ip->i_fs->fs_bsize;
4502 
4503 	/*
4504 	 * Figure out whether the page can be created, or must be
4505 	 * must be read from the disk.
4506 	 */
4507 	if (rw == S_CREATE)
4508 		crpage = 1;
4509 	else {
4510 		contig = 0;
4511 		if (err = bmap_read(ip, off, &bn, &contig))
4512 			return (err);
4513 		crpage = (bn == UFS_HOLE);
4514 	}
4515 
4516 	if (crpage) {
4517 		if ((pp = page_create_va(vp, off, PAGESIZE, PG_WAIT, seg,
4518 		    addr)) == NULL) {
4519 			return (ufs_fault(vp,
4520 				    "ufs_getpage_miss: page_create == NULL"));
4521 		}
4522 
4523 		if (rw != S_CREATE)
4524 			pagezero(pp, 0, PAGESIZE);
4525 		io_len = PAGESIZE;
4526 	} else {
4527 		u_offset_t	io_off;
4528 		uint_t	xlen;
4529 		struct buf	*bp;
4530 		ufsvfs_t	*ufsvfsp = ip->i_ufsvfs;
4531 
4532 		/*
4533 		 * If access is not in sequential order, we read from disk
4534 		 * in bsize units.
4535 		 *
4536 		 * We limit the size of the transfer to bsize if we are reading
4537 		 * from the beginning of the file. Note in this situation we
4538 		 * will hedge our bets and initiate an async read ahead of
4539 		 * the second block.
4540 		 */
4541 		if (!seq || off == 0)
4542 			contig = MIN(contig, bsize);
4543 
4544 		pp = pvn_read_kluster(vp, off, seg, addr, &io_off,
4545 		    &io_len, off, contig, 0);
4546 
4547 		/*
4548 		 * Some other thread has entered the page.
4549 		 * ufs_getpage will retry page_lookup.
4550 		 */
4551 		if (pp == NULL) {
4552 			pl[0] = NULL;
4553 			return (0);
4554 		}
4555 
4556 		/*
4557 		 * Zero part of the page which we are not
4558 		 * going to read from the disk.
4559 		 */
4560 		xlen = io_len & PAGEOFFSET;
4561 		if (xlen != 0)
4562 			pagezero(pp->p_prev, xlen, PAGESIZE - xlen);
4563 
4564 		bp = pageio_setup(pp, io_len, ip->i_devvp, B_READ);
4565 		bp->b_edev = ip->i_dev;
4566 		bp->b_dev = cmpdev(ip->i_dev);
4567 		bp->b_blkno = bn;
4568 		bp->b_un.b_addr = (caddr_t)0;
4569 		bp->b_file = ip->i_vnode;
4570 		bp->b_offset = off;
4571 
4572 		if (ufsvfsp->vfs_log) {
4573 			lufs_read_strategy(ufsvfsp->vfs_log, bp);
4574 		} else if (ufsvfsp->vfs_snapshot) {
4575 			fssnap_strategy(&ufsvfsp->vfs_snapshot, bp);
4576 		} else {
4577 			ufsvfsp->vfs_iotstamp = lbolt;
4578 			ub.ub_getpages.value.ul++;
4579 			(void) bdev_strategy(bp);
4580 			lwp_stat_update(LWP_STAT_INBLK, 1);
4581 		}
4582 
4583 		ip->i_nextrio = off + ((io_len + PAGESIZE - 1) & PAGEMASK);
4584 
4585 		/*
4586 		 * If the file access is sequential, initiate read ahead
4587 		 * of the next cluster.
4588 		 */
4589 		if (seq && ip->i_nextrio < ip->i_size)
4590 			(void) ufs_getpage_ra(vp, off, seg, addr);
4591 		err = biowait(bp);
4592 		pageio_done(bp);
4593 
4594 		if (err) {
4595 			pvn_read_done(pp, B_ERROR);
4596 			return (err);
4597 		}
4598 	}
4599 
4600 	pvn_plist_init(pp, pl, plsz, off, io_len, rw);
4601 	return (0);
4602 }
4603 
4604 /*
4605  * Read ahead a cluster from the disk. Returns the length in bytes.
4606  */
4607 static int
4608 ufs_getpage_ra(struct vnode *vp, u_offset_t off, struct seg *seg, caddr_t addr)
4609 {
4610 	struct inode	*ip = VTOI(vp);
4611 	page_t		*pp;
4612 	u_offset_t	io_off = ip->i_nextrio;
4613 	ufsvfs_t	*ufsvfsp;
4614 	caddr_t		addr2 = addr + (io_off - off);
4615 	struct buf	*bp;
4616 	daddr_t		bn;
4617 	size_t		io_len;
4618 	int		contig;
4619 	int		xlen;
4620 	int		bsize = ip->i_fs->fs_bsize;
4621 
4622 	/*
4623 	 * If the directio advisory is in effect on this file,
4624 	 * then do not do buffered read ahead. Read ahead makes
4625 	 * it more difficult on threads using directio as they
4626 	 * will be forced to flush the pages from this vnode.
4627 	 */
4628 	if ((ufsvfsp = ip->i_ufsvfs) == NULL)
4629 		return (0);
4630 	if (ip->i_flag & IDIRECTIO || ufsvfsp->vfs_forcedirectio)
4631 		return (0);
4632 
4633 	/*
4634 	 * Is this test needed?
4635 	 */
4636 	if (addr2 >= seg->s_base + seg->s_size)
4637 		return (0);
4638 
4639 	contig = 0;
4640 	if (bmap_read(ip, io_off, &bn, &contig) != 0 || bn == UFS_HOLE)
4641 		return (0);
4642 
4643 	/*
4644 	 * Limit the transfer size to bsize if this is the 2nd block.
4645 	 */
4646 	if (io_off == (u_offset_t)bsize)
4647 		contig = MIN(contig, bsize);
4648 
4649 	if ((pp = pvn_read_kluster(vp, io_off, seg, addr2, &io_off,
4650 	    &io_len, io_off, contig, 1)) == NULL)
4651 		return (0);
4652 
4653 	/*
4654 	 * Zero part of page which we are not going to read from disk
4655 	 */
4656 	if ((xlen = (io_len & PAGEOFFSET)) > 0)
4657 		pagezero(pp->p_prev, xlen, PAGESIZE - xlen);
4658 
4659 	ip->i_nextrio = (io_off + io_len + PAGESIZE - 1) & PAGEMASK;
4660 
4661 	bp = pageio_setup(pp, io_len, ip->i_devvp, B_READ | B_ASYNC);
4662 	bp->b_edev = ip->i_dev;
4663 	bp->b_dev = cmpdev(ip->i_dev);
4664 	bp->b_blkno = bn;
4665 	bp->b_un.b_addr = (caddr_t)0;
4666 	bp->b_file = ip->i_vnode;
4667 	bp->b_offset = off;
4668 
4669 	if (ufsvfsp->vfs_log) {
4670 		lufs_read_strategy(ufsvfsp->vfs_log, bp);
4671 	} else if (ufsvfsp->vfs_snapshot) {
4672 		fssnap_strategy(&ufsvfsp->vfs_snapshot, bp);
4673 	} else {
4674 		ufsvfsp->vfs_iotstamp = lbolt;
4675 		ub.ub_getras.value.ul++;
4676 		(void) bdev_strategy(bp);
4677 		lwp_stat_update(LWP_STAT_INBLK, 1);
4678 	}
4679 
4680 	return (io_len);
4681 }
4682 
4683 int	ufs_delay = 1;
4684 /*
4685  * Flags are composed of {B_INVAL, B_FREE, B_DONTNEED, B_FORCE, B_ASYNC}
4686  *
4687  * LMXXX - the inode really ought to contain a pointer to one of these
4688  * async args.  Stuff gunk in there and just hand the whole mess off.
4689  * This would replace i_delaylen, i_delayoff.
4690  */
4691 /*ARGSUSED*/
4692 static int
4693 ufs_putpage(struct vnode *vp, offset_t off, size_t len, int flags,
4694 	struct cred *cr)
4695 {
4696 	struct inode *ip = VTOI(vp);
4697 	int err = 0;
4698 
4699 	if (vp->v_count == 0) {
4700 		return (ufs_fault(vp, "ufs_putpage: bad v_count == 0"));
4701 	}
4702 
4703 	TRACE_1(TR_FAC_UFS, TR_UFS_PUTPAGE_START,
4704 		"ufs_putpage_start:vp %p", vp);
4705 
4706 	/*
4707 	 * XXX - Why should this check be made here?
4708 	 */
4709 	if (vp->v_flag & VNOMAP) {
4710 		err = ENOSYS;
4711 		goto errout;
4712 	}
4713 
4714 	if (ip->i_ufsvfs == NULL) {
4715 		err = EIO;
4716 		goto errout;
4717 	}
4718 
4719 	if (flags & B_ASYNC) {
4720 		if (ufs_delay && len &&
4721 		    (flags & ~(B_ASYNC|B_DONTNEED|B_FREE)) == 0) {
4722 			mutex_enter(&ip->i_tlock);
4723 			/*
4724 			 * If nobody stalled, start a new cluster.
4725 			 */
4726 			if (ip->i_delaylen == 0) {
4727 				ip->i_delayoff = off;
4728 				ip->i_delaylen = len;
4729 				mutex_exit(&ip->i_tlock);
4730 				goto errout;
4731 			}
4732 			/*
4733 			 * If we have a full cluster or they are not contig,
4734 			 * then push last cluster and start over.
4735 			 */
4736 			if (ip->i_delaylen >= CLUSTSZ(ip) ||
4737 			    ip->i_delayoff + ip->i_delaylen != off) {
4738 				u_offset_t doff;
4739 				size_t dlen;
4740 
4741 				doff = ip->i_delayoff;
4742 				dlen = ip->i_delaylen;
4743 				ip->i_delayoff = off;
4744 				ip->i_delaylen = len;
4745 				mutex_exit(&ip->i_tlock);
4746 				err = ufs_putpages(vp, doff, dlen,
4747 				    flags, cr);
4748 				/* LMXXX - flags are new val, not old */
4749 				goto errout;
4750 			}
4751 			/*
4752 			 * There is something there, it's not full, and
4753 			 * it is contig.
4754 			 */
4755 			ip->i_delaylen += len;
4756 			mutex_exit(&ip->i_tlock);
4757 			goto errout;
4758 		}
4759 		/*
4760 		 * Must have weird flags or we are not clustering.
4761 		 */
4762 	}
4763 
4764 	err = ufs_putpages(vp, off, len, flags, cr);
4765 
4766 errout:
4767 	TRACE_2(TR_FAC_UFS, TR_UFS_PUTPAGE_END,
4768 		"ufs_putpage_end:vp %p error %d", vp, err);
4769 	return (err);
4770 }
4771 
4772 /*
4773  * If len == 0, do from off to EOF.
4774  *
4775  * The normal cases should be len == 0 & off == 0 (entire vp list),
4776  * len == MAXBSIZE (from segmap_release actions), and len == PAGESIZE
4777  * (from pageout).
4778  */
4779 /*ARGSUSED*/
4780 static int
4781 ufs_putpages(
4782 	struct vnode *vp,
4783 	offset_t off,
4784 	size_t len,
4785 	int flags,
4786 	struct cred *cr)
4787 {
4788 	u_offset_t io_off;
4789 	u_offset_t eoff;
4790 	struct inode *ip = VTOI(vp);
4791 	page_t *pp;
4792 	size_t io_len;
4793 	int err = 0;
4794 	int dolock;
4795 
4796 	if (vp->v_count == 0)
4797 		return (ufs_fault(vp, "ufs_putpages: v_count == 0"));
4798 	/*
4799 	 * Acquire the readers/write inode lock before locking
4800 	 * any pages in this inode.
4801 	 * The inode lock is held during i/o.
4802 	 */
4803 	if (len == 0) {
4804 		mutex_enter(&ip->i_tlock);
4805 		ip->i_delayoff = ip->i_delaylen = 0;
4806 		mutex_exit(&ip->i_tlock);
4807 	}
4808 	dolock = (rw_owner(&ip->i_contents) != curthread);
4809 	if (dolock) {
4810 		/*
4811 		 * Must synchronize this thread and any possible thread
4812 		 * operating in the window of vulnerability in wrip().
4813 		 * It is dangerous to allow both a thread doing a putpage
4814 		 * and a thread writing, so serialize them.  The exception
4815 		 * is when the thread in wrip() does something which causes
4816 		 * a putpage operation.  Then, the thread must be allowed
4817 		 * to continue.  It may encounter a bmap_read problem in
4818 		 * ufs_putapage, but that is handled in ufs_putapage.
4819 		 * Allow async writers to proceed, we don't want to block
4820 		 * the pageout daemon.
4821 		 */
4822 		if (ip->i_writer == curthread)
4823 			rw_enter(&ip->i_contents, RW_READER);
4824 		else {
4825 			for (;;) {
4826 				rw_enter(&ip->i_contents, RW_READER);
4827 				mutex_enter(&ip->i_tlock);
4828 				/*
4829 				 * If there is no thread in the critical
4830 				 * section of wrip(), then proceed.
4831 				 * Otherwise, wait until there isn't one.
4832 				 */
4833 				if (ip->i_writer == NULL) {
4834 					mutex_exit(&ip->i_tlock);
4835 					break;
4836 				}
4837 				rw_exit(&ip->i_contents);
4838 				/*
4839 				 * Bounce async writers when we have a writer
4840 				 * working on this file so we don't deadlock
4841 				 * the pageout daemon.
4842 				 */
4843 				if (flags & B_ASYNC) {
4844 					mutex_exit(&ip->i_tlock);
4845 					return (0);
4846 				}
4847 				cv_wait(&ip->i_wrcv, &ip->i_tlock);
4848 				mutex_exit(&ip->i_tlock);
4849 			}
4850 		}
4851 	}
4852 
4853 	if (!vn_has_cached_data(vp)) {
4854 		if (dolock)
4855 			rw_exit(&ip->i_contents);
4856 		return (0);
4857 	}
4858 
4859 	if (len == 0) {
4860 		/*
4861 		 * Search the entire vp list for pages >= off.
4862 		 */
4863 		err = pvn_vplist_dirty(vp, (u_offset_t)off, ufs_putapage,
4864 					flags, cr);
4865 	} else {
4866 		/*
4867 		 * Loop over all offsets in the range looking for
4868 		 * pages to deal with.
4869 		 */
4870 		if ((eoff = blkroundup(ip->i_fs, ip->i_size)) != 0)
4871 			eoff = MIN(off + len, eoff);
4872 		else
4873 			eoff = off + len;
4874 
4875 		for (io_off = off; io_off < eoff; io_off += io_len) {
4876 			/*
4877 			 * If we are not invalidating, synchronously
4878 			 * freeing or writing pages, use the routine
4879 			 * page_lookup_nowait() to prevent reclaiming
4880 			 * them from the free list.
4881 			 */
4882 			if ((flags & B_INVAL) || ((flags & B_ASYNC) == 0)) {
4883 				pp = page_lookup(vp, io_off,
4884 					(flags & (B_INVAL | B_FREE)) ?
4885 					    SE_EXCL : SE_SHARED);
4886 			} else {
4887 				pp = page_lookup_nowait(vp, io_off,
4888 					(flags & B_FREE) ? SE_EXCL : SE_SHARED);
4889 			}
4890 
4891 			if (pp == NULL || pvn_getdirty(pp, flags) == 0)
4892 				io_len = PAGESIZE;
4893 			else {
4894 				u_offset_t *io_offp = &io_off;
4895 
4896 				err = ufs_putapage(vp, pp, io_offp, &io_len,
4897 				    flags, cr);
4898 				if (err != 0)
4899 					break;
4900 				/*
4901 				 * "io_off" and "io_len" are returned as
4902 				 * the range of pages we actually wrote.
4903 				 * This allows us to skip ahead more quickly
4904 				 * since several pages may've been dealt
4905 				 * with by this iteration of the loop.
4906 				 */
4907 			}
4908 		}
4909 	}
4910 	if (err == 0 && off == 0 && (len == 0 || len >= ip->i_size)) {
4911 		/*
4912 		 * We have just sync'ed back all the pages on
4913 		 * the inode, turn off the IMODTIME flag.
4914 		 */
4915 		mutex_enter(&ip->i_tlock);
4916 		ip->i_flag &= ~IMODTIME;
4917 		mutex_exit(&ip->i_tlock);
4918 	}
4919 	if (dolock)
4920 		rw_exit(&ip->i_contents);
4921 	return (err);
4922 }
4923 
4924 static void
4925 ufs_iodone(buf_t *bp)
4926 {
4927 	struct inode *ip;
4928 
4929 	ASSERT((bp->b_pages->p_vnode != NULL) && !(bp->b_flags & B_READ));
4930 
4931 	bp->b_iodone = NULL;
4932 
4933 	ip = VTOI(bp->b_pages->p_vnode);
4934 
4935 	mutex_enter(&ip->i_tlock);
4936 	if (ip->i_writes >= ufs_LW) {
4937 		if ((ip->i_writes -= bp->b_bcount) <= ufs_LW)
4938 			if (ufs_WRITES)
4939 				cv_broadcast(&ip->i_wrcv); /* wake all up */
4940 	} else {
4941 		ip->i_writes -= bp->b_bcount;
4942 	}
4943 
4944 	mutex_exit(&ip->i_tlock);
4945 	iodone(bp);
4946 }
4947 
4948 /*
4949  * Write out a single page, possibly klustering adjacent
4950  * dirty pages.  The inode lock must be held.
4951  *
4952  * LMXXX - bsize < pagesize not done.
4953  */
4954 /*ARGSUSED*/
4955 int
4956 ufs_putapage(
4957 	struct vnode *vp,
4958 	page_t *pp,
4959 	u_offset_t *offp,
4960 	size_t *lenp,		/* return values */
4961 	int flags,
4962 	struct cred *cr)
4963 {
4964 	u_offset_t io_off;
4965 	u_offset_t off;
4966 	struct inode *ip = VTOI(vp);
4967 	struct ufsvfs *ufsvfsp = ip->i_ufsvfs;
4968 	struct fs *fs;
4969 	struct buf *bp;
4970 	size_t io_len;
4971 	daddr_t bn;
4972 	int err;
4973 	int contig;
4974 
4975 	ASSERT(RW_LOCK_HELD(&ip->i_contents));
4976 
4977 	TRACE_1(TR_FAC_UFS, TR_UFS_PUTAPAGE_START,
4978 		"ufs_putapage_start:vp %p", vp);
4979 
4980 	if (ufsvfsp == NULL) {
4981 		err = EIO;
4982 		goto out_trace;
4983 	}
4984 
4985 	fs = ip->i_fs;
4986 	ASSERT(fs->fs_ronly == 0);
4987 
4988 	/*
4989 	 * If the modified time on the inode has not already been
4990 	 * set elsewhere (e.g. for write/setattr) we set the time now.
4991 	 * This gives us approximate modified times for mmap'ed files
4992 	 * which are modified via stores in the user address space.
4993 	 */
4994 	if ((ip->i_flag & IMODTIME) == 0) {
4995 		mutex_enter(&ip->i_tlock);
4996 		ip->i_flag |= IUPD;
4997 		ip->i_seq++;
4998 		ITIMES_NOLOCK(ip);
4999 		mutex_exit(&ip->i_tlock);
5000 	}
5001 
5002 	/*
5003 	 * Align the request to a block boundry (for old file systems),
5004 	 * and go ask bmap() how contiguous things are for this file.
5005 	 */
5006 	off = pp->p_offset & (offset_t)fs->fs_bmask;	/* block align it */
5007 	contig = 0;
5008 	err = bmap_read(ip, off, &bn, &contig);
5009 	if (err)
5010 		goto out;
5011 	if (bn == UFS_HOLE) {			/* putpage never allocates */
5012 		/*
5013 		 * logging device is in error mode; simply return EIO
5014 		 */
5015 		if (TRANS_ISERROR(ufsvfsp)) {
5016 			err = EIO;
5017 			goto out;
5018 		}
5019 		/*
5020 		 * Oops, the thread in the window in wrip() did some
5021 		 * sort of operation which caused a putpage in the bad
5022 		 * range.  In this case, just return an error which will
5023 		 * cause the software modified bit on the page to set
5024 		 * and the page will get written out again later.
5025 		 */
5026 		if (ip->i_writer == curthread) {
5027 			err = EIO;
5028 			goto out;
5029 		}
5030 		/*
5031 		 * If the pager is trying to push a page in the bad range
5032 		 * just tell him to try again later when things are better.
5033 		 */
5034 		if (flags & B_ASYNC) {
5035 			err = EAGAIN;
5036 			goto out;
5037 		}
5038 		err = ufs_fault(ITOV(ip), "ufs_putapage: bn == UFS_HOLE");
5039 		goto out;
5040 	}
5041 
5042 	/*
5043 	 * Take the length (of contiguous bytes) passed back from bmap()
5044 	 * and _try_ and get a set of pages covering that extent.
5045 	 */
5046 	pp = pvn_write_kluster(vp, pp, &io_off, &io_len, off, contig, flags);
5047 
5048 	/*
5049 	 * May have run out of memory and not clustered backwards.
5050 	 * off		p_offset
5051 	 * [  pp - 1  ][   pp   ]
5052 	 * [	block		]
5053 	 * We told bmap off, so we have to adjust the bn accordingly.
5054 	 */
5055 	if (io_off > off) {
5056 		bn += btod(io_off - off);
5057 		contig -= (io_off - off);
5058 	}
5059 
5060 	/*
5061 	 * bmap was carefull to tell us the right size so use that.
5062 	 * There might be unallocated frags at the end.
5063 	 * LMXXX - bzero the end of the page?  We must be writing after EOF.
5064 	 */
5065 	if (io_len > contig) {
5066 		ASSERT(io_len - contig < fs->fs_bsize);
5067 		io_len -= (io_len - contig);
5068 	}
5069 
5070 	/*
5071 	 * Handle the case where we are writing the last page after EOF.
5072 	 *
5073 	 * XXX - just a patch for i-mt3.
5074 	 */
5075 	if (io_len == 0) {
5076 		ASSERT(pp->p_offset >= (u_offset_t)(roundup(ip->i_size,
5077 							    PAGESIZE)));
5078 		io_len = PAGESIZE;
5079 	}
5080 
5081 	bp = pageio_setup(pp, io_len, ip->i_devvp, B_WRITE | flags);
5082 
5083 	ULOCKFS_SET_MOD(ITOUL(ip));
5084 
5085 	bp->b_edev = ip->i_dev;
5086 	bp->b_dev = cmpdev(ip->i_dev);
5087 	bp->b_blkno = bn;
5088 	bp->b_un.b_addr = (caddr_t)0;
5089 	bp->b_file = ip->i_vnode;
5090 
5091 	if (TRANS_ISTRANS(ufsvfsp)) {
5092 		if ((ip->i_mode & IFMT) == IFSHAD) {
5093 			TRANS_BUF(ufsvfsp, 0, io_len, bp, DT_SHAD);
5094 		} else if (ufsvfsp->vfs_qinod == ip) {
5095 			TRANS_DELTA(ufsvfsp, ldbtob(bn), bp->b_bcount, DT_QR,
5096 			    0, 0);
5097 		}
5098 	}
5099 
5100 	/* write throttle */
5101 
5102 	ASSERT(bp->b_iodone == NULL);
5103 	bp->b_iodone = (int (*)())ufs_iodone;
5104 	mutex_enter(&ip->i_tlock);
5105 	ip->i_writes += bp->b_bcount;
5106 	mutex_exit(&ip->i_tlock);
5107 
5108 	if (bp->b_flags & B_ASYNC) {
5109 		if (ufsvfsp->vfs_log) {
5110 			lufs_write_strategy(ufsvfsp->vfs_log, bp);
5111 		} else if (ufsvfsp->vfs_snapshot) {
5112 			fssnap_strategy(&ufsvfsp->vfs_snapshot, bp);
5113 		} else {
5114 			ufsvfsp->vfs_iotstamp = lbolt;
5115 			ub.ub_putasyncs.value.ul++;
5116 			(void) bdev_strategy(bp);
5117 			lwp_stat_update(LWP_STAT_OUBLK, 1);
5118 		}
5119 	} else {
5120 		if (ufsvfsp->vfs_log) {
5121 			lufs_write_strategy(ufsvfsp->vfs_log, bp);
5122 		} else if (ufsvfsp->vfs_snapshot) {
5123 			fssnap_strategy(&ufsvfsp->vfs_snapshot, bp);
5124 		} else {
5125 			ufsvfsp->vfs_iotstamp = lbolt;
5126 			ub.ub_putsyncs.value.ul++;
5127 			(void) bdev_strategy(bp);
5128 			lwp_stat_update(LWP_STAT_OUBLK, 1);
5129 		}
5130 		err = biowait(bp);
5131 		pageio_done(bp);
5132 		pvn_write_done(pp, ((err) ? B_ERROR : 0) | B_WRITE | flags);
5133 	}
5134 
5135 	pp = NULL;
5136 
5137 out:
5138 	if (err != 0 && pp != NULL)
5139 		pvn_write_done(pp, B_ERROR | B_WRITE | flags);
5140 
5141 	if (offp)
5142 		*offp = io_off;
5143 	if (lenp)
5144 		*lenp = io_len;
5145 out_trace:
5146 	TRACE_2(TR_FAC_UFS, TR_UFS_PUTAPAGE_END,
5147 		"ufs_putapage_end:vp %p error %d", vp, err);
5148 	return (err);
5149 }
5150 
5151 /* ARGSUSED */
5152 static int
5153 ufs_map(struct vnode *vp,
5154 	offset_t off,
5155 	struct as *as,
5156 	caddr_t *addrp,
5157 	size_t len,
5158 	uchar_t prot,
5159 	uchar_t maxprot,
5160 	uint_t flags,
5161 	struct cred *cr)
5162 {
5163 	struct segvn_crargs vn_a;
5164 	struct ufsvfs *ufsvfsp = VTOI(vp)->i_ufsvfs;
5165 	struct ulockfs *ulp;
5166 	int error;
5167 
5168 	TRACE_1(TR_FAC_UFS, TR_UFS_MAP_START,
5169 		"ufs_map_start:vp %p", vp);
5170 
5171 	error = ufs_lockfs_begin(ufsvfsp, &ulp, ULOCKFS_MAP_MASK);
5172 	if (error)
5173 		goto out;
5174 
5175 	if (vp->v_flag & VNOMAP) {
5176 		error = ENOSYS;
5177 		goto unlock;
5178 	}
5179 
5180 	if (off < (offset_t)0 || (offset_t)(off + len) < (offset_t)0) {
5181 		error = ENXIO;
5182 		goto unlock;
5183 	}
5184 
5185 	if (vp->v_type != VREG) {
5186 		error = ENODEV;
5187 		goto unlock;
5188 	}
5189 
5190 	/*
5191 	 * If file is being locked, disallow mapping.
5192 	 */
5193 	if (vn_has_mandatory_locks(vp, VTOI(vp)->i_mode)) {
5194 		error = EAGAIN;
5195 		goto unlock;
5196 	}
5197 
5198 	as_rangelock(as);
5199 	if ((flags & MAP_FIXED) == 0) {
5200 		map_addr(addrp, len, off, 1, flags);
5201 		if (*addrp == NULL) {
5202 			as_rangeunlock(as);
5203 			error = ENOMEM;
5204 			goto unlock;
5205 		}
5206 	} else {
5207 		/*
5208 		 * User specified address - blow away any previous mappings
5209 		 */
5210 		(void) as_unmap(as, *addrp, len);
5211 	}
5212 
5213 	vn_a.vp = vp;
5214 	vn_a.offset = (u_offset_t)off;
5215 	vn_a.type = flags & MAP_TYPE;
5216 	vn_a.prot = prot;
5217 	vn_a.maxprot = maxprot;
5218 	vn_a.cred = cr;
5219 	vn_a.amp = NULL;
5220 	vn_a.flags = flags & ~MAP_TYPE;
5221 	vn_a.szc = 0;
5222 	vn_a.lgrp_mem_policy_flags = 0;
5223 
5224 	error = as_map(as, *addrp, len, segvn_create, &vn_a);
5225 	as_rangeunlock(as);
5226 
5227 unlock:
5228 	if (ulp) {
5229 		ufs_lockfs_end(ulp);
5230 	}
5231 out:
5232 	TRACE_2(TR_FAC_UFS, TR_UFS_MAP_END,
5233 		"ufs_map_end:vp %p error %d", vp, error);
5234 	return (error);
5235 }
5236 
5237 /* ARGSUSED */
5238 static int
5239 ufs_addmap(struct vnode *vp,
5240 	offset_t off,
5241 	struct as *as,
5242 	caddr_t addr,
5243 	size_t	len,
5244 	uchar_t  prot,
5245 	uchar_t  maxprot,
5246 	uint_t    flags,
5247 	struct cred *cr)
5248 {
5249 	struct inode *ip = VTOI(vp);
5250 
5251 	if (vp->v_flag & VNOMAP) {
5252 		return (ENOSYS);
5253 	}
5254 
5255 	mutex_enter(&ip->i_tlock);
5256 	ip->i_mapcnt += btopr(len);
5257 	mutex_exit(&ip->i_tlock);
5258 	return (0);
5259 }
5260 
5261 /*ARGSUSED*/
5262 static int
5263 ufs_delmap(struct vnode *vp, offset_t off, struct as *as, caddr_t addr,
5264 	size_t len, uint_t prot,  uint_t maxprot,  uint_t flags,
5265 	struct cred *cr)
5266 {
5267 	struct inode *ip = VTOI(vp);
5268 
5269 	if (vp->v_flag & VNOMAP) {
5270 		return (ENOSYS);
5271 	}
5272 
5273 	mutex_enter(&ip->i_tlock);
5274 	ip->i_mapcnt -= btopr(len); 	/* Count released mappings */
5275 	ASSERT(ip->i_mapcnt >= 0);
5276 	mutex_exit(&ip->i_tlock);
5277 	return (0);
5278 }
5279 /*
5280  * Return the answer requested to poll() for non-device files
5281  */
5282 struct pollhead ufs_pollhd;
5283 
5284 /* ARGSUSED */
5285 int
5286 ufs_poll(vnode_t *vp, short ev, int any, short *revp, struct pollhead **phpp)
5287 {
5288 	struct ufsvfs	*ufsvfsp;
5289 
5290 	*revp = 0;
5291 	ufsvfsp = VTOI(vp)->i_ufsvfs;
5292 
5293 	if (!ufsvfsp) {
5294 		*revp = POLLHUP;
5295 		goto out;
5296 	}
5297 
5298 	if (ULOCKFS_IS_HLOCK(&ufsvfsp->vfs_ulockfs) ||
5299 	    ULOCKFS_IS_ELOCK(&ufsvfsp->vfs_ulockfs)) {
5300 		*revp |= POLLERR;
5301 
5302 	} else {
5303 		if ((ev & POLLOUT) && !ufsvfsp->vfs_fs->fs_ronly &&
5304 		    !ULOCKFS_IS_WLOCK(&ufsvfsp->vfs_ulockfs))
5305 			*revp |= POLLOUT;
5306 
5307 		if ((ev & POLLWRBAND) && !ufsvfsp->vfs_fs->fs_ronly &&
5308 		    !ULOCKFS_IS_WLOCK(&ufsvfsp->vfs_ulockfs))
5309 			*revp |= POLLWRBAND;
5310 
5311 		if (ev & POLLIN)
5312 			*revp |= POLLIN;
5313 
5314 		if (ev & POLLRDNORM)
5315 			*revp |= POLLRDNORM;
5316 
5317 		if (ev & POLLRDBAND)
5318 			*revp |= POLLRDBAND;
5319 	}
5320 
5321 	if ((ev & POLLPRI) && (*revp & (POLLERR|POLLHUP)))
5322 		*revp |= POLLPRI;
5323 out:
5324 	*phpp = !any && !*revp ? &ufs_pollhd : (struct pollhead *)NULL;
5325 
5326 	return (0);
5327 }
5328 
5329 /* ARGSUSED */
5330 static int
5331 ufs_l_pathconf(struct vnode *vp, int cmd, ulong_t *valp, struct cred *cr)
5332 {
5333 	struct ufsvfs	*ufsvfsp = VTOI(vp)->i_ufsvfs;
5334 	struct ulockfs	*ulp = NULL;
5335 	struct inode 	*sip = NULL;
5336 	int		error;
5337 	struct inode 	*ip = VTOI(vp);
5338 	int		issync;
5339 
5340 	error = ufs_lockfs_begin(ufsvfsp, &ulp, ULOCKFS_PATHCONF_MASK);
5341 	if (error)
5342 		return (error);
5343 
5344 	switch (cmd) {
5345 		/*
5346 		 * Have to handle _PC_NAME_MAX here, because the normal way
5347 		 * [fs_pathconf() -> VOP_STATVFS() -> ufs_statvfs()]
5348 		 * results in a lock ordering reversal between
5349 		 * ufs_lockfs_{begin,end}() and
5350 		 * ufs_thread_{suspend,continue}().
5351 		 *
5352 		 * Keep in sync with ufs_statvfs().
5353 		 */
5354 	case _PC_NAME_MAX:
5355 		*valp = MAXNAMLEN;
5356 		break;
5357 
5358 	case _PC_FILESIZEBITS:
5359 		if (ufsvfsp->vfs_lfflags & UFS_LARGEFILES)
5360 			*valp = UFS_FILESIZE_BITS;
5361 		else
5362 			*valp = 32;
5363 		break;
5364 
5365 	case _PC_XATTR_EXISTS:
5366 		if (vp->v_vfsp->vfs_flag & VFS_XATTR) {
5367 
5368 			error = ufs_xattr_getattrdir(vp, &sip, LOOKUP_XATTR,
5369 							cr);
5370 			if (error ==  0 && sip != NULL) {
5371 				/* Start transaction */
5372 				if (ulp) {
5373 					TRANS_BEGIN_CSYNC(ufsvfsp, issync,
5374 					    TOP_RMDIR, TOP_RMDIR_SIZE);
5375 				}
5376 				/*
5377 				 * Is directory empty
5378 				 */
5379 				rw_enter(&sip->i_rwlock, RW_WRITER);
5380 				rw_enter(&sip->i_contents, RW_WRITER);
5381 				if (ufs_xattrdirempty(sip,
5382 						sip->i_number, CRED())) {
5383 					rw_enter(&ip->i_contents, RW_WRITER);
5384 					ufs_unhook_shadow(ip, sip);
5385 					rw_exit(&ip->i_contents);
5386 
5387 					*valp = 0;
5388 
5389 				} else
5390 					*valp = 1;
5391 				rw_exit(&sip->i_contents);
5392 				rw_exit(&sip->i_rwlock);
5393 				if (ulp) {
5394 					TRANS_END_CSYNC(ufsvfsp, error, issync,
5395 					    TOP_RMDIR, TOP_RMDIR_SIZE);
5396 				}
5397 				VN_RELE(ITOV(sip));
5398 			} else if (error == ENOENT) {
5399 				*valp = 0;
5400 				error = 0;
5401 			}
5402 		} else {
5403 			error = fs_pathconf(vp, cmd, valp, cr);
5404 		}
5405 		break;
5406 
5407 	case _PC_ACL_ENABLED:
5408 		*valp = _ACL_ACLENT_ENABLED;
5409 		break;
5410 
5411 	case _PC_MIN_HOLE_SIZE:
5412 		*valp = (ulong_t)ip->i_fs->fs_bsize;
5413 		break;
5414 
5415 	default:
5416 		error = fs_pathconf(vp, cmd, valp, cr);
5417 	}
5418 
5419 	if (ulp != NULL) {
5420 		ufs_lockfs_end(ulp);
5421 	}
5422 	return (error);
5423 }
5424 
5425 int ufs_pageio_writes, ufs_pageio_reads;
5426 
5427 /*ARGSUSED*/
5428 static int
5429 ufs_pageio(struct vnode *vp, page_t *pp, u_offset_t io_off, size_t io_len,
5430 	int flags, struct cred *cr)
5431 {
5432 	struct inode *ip = VTOI(vp);
5433 	struct ufsvfs *ufsvfsp;
5434 	page_t *npp = NULL, *opp = NULL, *cpp = pp;
5435 	struct buf *bp;
5436 	daddr_t bn;
5437 	size_t done_len = 0, cur_len = 0;
5438 	int err = 0;
5439 	int contig = 0;
5440 	int dolock;
5441 	int vmpss = 0;
5442 
5443 	if ((flags & B_READ) && pp != NULL && pp->p_vnode == vp &&
5444 	    vp->v_mpssdata != NULL) {
5445 		vmpss = 1;
5446 	}
5447 
5448 	dolock = (rw_owner(&ip->i_contents) != curthread);
5449 	/*
5450 	 * We need a better check.  Ideally, we would use another
5451 	 * vnodeops so that hlocked and forcibly unmounted file
5452 	 * systems would return EIO where appropriate and w/o the
5453 	 * need for these checks.
5454 	 */
5455 	if ((ufsvfsp = ip->i_ufsvfs) == NULL)
5456 		return (EIO);
5457 
5458 	if (dolock) {
5459 		/*
5460 		 * segvn may call VOP_PAGEIO() instead of VOP_GETPAGE() to
5461 		 * handle a fault against a segment that maps vnode pages with
5462 		 * large mappings.  Segvn creates pages and holds them locked
5463 		 * SE_EXCL during VOP_PAGEIO() call. In this case we have to
5464 		 * use rw_tryenter() to avoid a potential deadlock since in
5465 		 * lock order i_contents needs to be taken first.
5466 		 * Segvn will retry via VOP_GETPAGE() if VOP_PAGEIO() fails.
5467 		 */
5468 		if (!vmpss) {
5469 			rw_enter(&ip->i_contents, RW_READER);
5470 		} else if (!rw_tryenter(&ip->i_contents, RW_READER)) {
5471 			return (EDEADLK);
5472 		}
5473 	}
5474 
5475 	/*
5476 	 * Return an error to segvn because the pagefault request is beyond
5477 	 * PAGESIZE rounded EOF.
5478 	 */
5479 	if (vmpss && btopr(io_off + io_len) > btopr(ip->i_size)) {
5480 		if (dolock)
5481 			rw_exit(&ip->i_contents);
5482 		return (EFAULT);
5483 	}
5484 
5485 	if (pp == NULL) {
5486 		if (bmap_has_holes(ip)) {
5487 			err = ENOSYS;
5488 		} else {
5489 			err = EINVAL;
5490 		}
5491 		if (dolock)
5492 			rw_exit(&ip->i_contents);
5493 		return (err);
5494 	}
5495 
5496 	/*
5497 	 * Break the io request into chunks, one for each contiguous
5498 	 * stretch of disk blocks in the target file.
5499 	 */
5500 	while (done_len < io_len) {
5501 		ASSERT(cpp);
5502 		contig = 0;
5503 		if (err = bmap_read(ip, (u_offset_t)(io_off + done_len),
5504 				    &bn, &contig))
5505 			break;
5506 
5507 		if (bn == UFS_HOLE) {	/* No holey swapfiles */
5508 			if (vmpss) {
5509 				err = EFAULT;
5510 				break;
5511 			}
5512 			err = ufs_fault(ITOV(ip), "ufs_pageio: bn == UFS_HOLE");
5513 			break;
5514 		}
5515 
5516 		cur_len = MIN(io_len - done_len, contig);
5517 		/*
5518 		 * Zero out a page beyond EOF, when the last block of
5519 		 * a file is a UFS fragment so that ufs_pageio() can be used
5520 		 * instead of ufs_getpage() to handle faults against
5521 		 * segvn segments that use large pages.
5522 		 */
5523 		page_list_break(&cpp, &npp, btopr(cur_len));
5524 		if ((flags & B_READ) && (cur_len & PAGEOFFSET)) {
5525 			size_t xlen = cur_len & PAGEOFFSET;
5526 			pagezero(cpp->p_prev, xlen, PAGESIZE - xlen);
5527 		}
5528 
5529 		bp = pageio_setup(cpp, cur_len, ip->i_devvp, flags);
5530 		ASSERT(bp != NULL);
5531 
5532 		bp->b_edev = ip->i_dev;
5533 		bp->b_dev = cmpdev(ip->i_dev);
5534 		bp->b_blkno = bn;
5535 		bp->b_un.b_addr = (caddr_t)0;
5536 		bp->b_file = ip->i_vnode;
5537 
5538 		ufsvfsp->vfs_iotstamp = lbolt;
5539 		ub.ub_pageios.value.ul++;
5540 		if (ufsvfsp->vfs_snapshot)
5541 			fssnap_strategy(&(ufsvfsp->vfs_snapshot), bp);
5542 		else
5543 			(void) bdev_strategy(bp);
5544 
5545 		if (flags & B_READ)
5546 			ufs_pageio_reads++;
5547 		else
5548 			ufs_pageio_writes++;
5549 		if (flags & B_READ)
5550 			lwp_stat_update(LWP_STAT_INBLK, 1);
5551 		else
5552 			lwp_stat_update(LWP_STAT_OUBLK, 1);
5553 		/*
5554 		 * If the request is not B_ASYNC, wait for i/o to complete
5555 		 * and re-assemble the page list to return to the caller.
5556 		 * If it is B_ASYNC we leave the page list in pieces and
5557 		 * cleanup() will dispose of them.
5558 		 */
5559 		if ((flags & B_ASYNC) == 0) {
5560 			err = biowait(bp);
5561 			pageio_done(bp);
5562 			if (err)
5563 				break;
5564 			page_list_concat(&opp, &cpp);
5565 		}
5566 		cpp = npp;
5567 		npp = NULL;
5568 		if (flags & B_READ)
5569 			cur_len = P2ROUNDUP_TYPED(cur_len, PAGESIZE, size_t);
5570 		done_len += cur_len;
5571 	}
5572 	ASSERT(err || (cpp == NULL && npp == NULL && done_len == io_len));
5573 	if (err) {
5574 		if (flags & B_ASYNC) {
5575 			/* Cleanup unprocessed parts of list */
5576 			page_list_concat(&cpp, &npp);
5577 			if (flags & B_READ)
5578 				pvn_read_done(cpp, B_ERROR);
5579 			else
5580 				pvn_write_done(cpp, B_ERROR);
5581 		} else {
5582 			/* Re-assemble list and let caller clean up */
5583 			page_list_concat(&opp, &cpp);
5584 			page_list_concat(&opp, &npp);
5585 		}
5586 	}
5587 	if (dolock)
5588 		rw_exit(&ip->i_contents);
5589 	return (err);
5590 }
5591 
5592 /*
5593  * Called when the kernel is in a frozen state to dump data
5594  * directly to the device. It uses a private dump data structure,
5595  * set up by dump_ctl, to locate the correct disk block to which to dump.
5596  */
5597 static int
5598 ufs_dump(vnode_t *vp, caddr_t addr, int ldbn, int dblks)
5599 {
5600 	u_offset_t	file_size;
5601 	struct inode    *ip = VTOI(vp);
5602 	struct fs	*fs = ip->i_fs;
5603 	daddr_t		dbn, lfsbn;
5604 	int		disk_blks = fs->fs_bsize >> DEV_BSHIFT;
5605 	int		error = 0;
5606 	int		ndbs, nfsbs;
5607 
5608 	/*
5609 	 * forced unmount case
5610 	 */
5611 	if (ip->i_ufsvfs == NULL)
5612 		return (EIO);
5613 	/*
5614 	 * Validate the inode that it has not been modified since
5615 	 * the dump structure is allocated.
5616 	 */
5617 	mutex_enter(&ip->i_tlock);
5618 	if ((dump_info == NULL) ||
5619 	    (dump_info->ip != ip) ||
5620 	    (dump_info->time.tv_sec != ip->i_mtime.tv_sec) ||
5621 	    (dump_info->time.tv_usec != ip->i_mtime.tv_usec)) {
5622 		mutex_exit(&ip->i_tlock);
5623 		return (-1);
5624 	}
5625 	mutex_exit(&ip->i_tlock);
5626 
5627 	/*
5628 	 * See that the file has room for this write
5629 	 */
5630 	UFS_GET_ISIZE(&file_size, ip);
5631 
5632 	if (ldbtob((offset_t)(ldbn + dblks)) > file_size)
5633 		return (ENOSPC);
5634 
5635 	/*
5636 	 * Find the physical disk block numbers from the dump
5637 	 * private data structure directly and write out the data
5638 	 * in contiguous block lumps
5639 	 */
5640 	while (dblks > 0 && !error) {
5641 		lfsbn = (daddr_t)lblkno(fs, ldbtob((offset_t)ldbn));
5642 		dbn = fsbtodb(fs, dump_info->dblk[lfsbn]) + ldbn % disk_blks;
5643 		nfsbs = 1;
5644 		ndbs = disk_blks - ldbn % disk_blks;
5645 		while (ndbs < dblks && fsbtodb(fs, dump_info->dblk[lfsbn +
5646 		    nfsbs]) == dbn + ndbs) {
5647 			nfsbs++;
5648 			ndbs += disk_blks;
5649 		}
5650 		if (ndbs > dblks)
5651 			ndbs = dblks;
5652 		error = bdev_dump(ip->i_dev, addr, dbn, ndbs);
5653 		addr += ldbtob((offset_t)ndbs);
5654 		dblks -= ndbs;
5655 		ldbn += ndbs;
5656 	}
5657 	return (error);
5658 
5659 }
5660 
5661 /*
5662  * Prepare the file system before and after the dump operation.
5663  *
5664  * action = DUMP_ALLOC:
5665  * Preparation before dump, allocate dump private data structure
5666  * to hold all the direct and indirect block info for dump.
5667  *
5668  * action = DUMP_FREE:
5669  * Clean up after dump, deallocate the dump private data structure.
5670  *
5671  * action = DUMP_SCAN:
5672  * Scan dump_info for *blkp DEV_BSIZE blocks of contig fs space;
5673  * if found, the starting file-relative DEV_BSIZE lbn is written
5674  * to *bklp; that lbn is intended for use with VOP_DUMP()
5675  */
5676 static int
5677 ufs_dumpctl(vnode_t *vp, int action, int *blkp)
5678 {
5679 	struct inode	*ip = VTOI(vp);
5680 	ufsvfs_t	*ufsvfsp = ip->i_ufsvfs;
5681 	struct fs	*fs;
5682 	daddr32_t	*dblk, *storeblk;
5683 	daddr32_t	*nextblk, *endblk;
5684 	struct buf	*bp;
5685 	int		i, entry, entries;
5686 	int		n, ncontig;
5687 
5688 	/*
5689 	 * check for forced unmount
5690 	 */
5691 	if (ufsvfsp == NULL)
5692 		return (EIO);
5693 
5694 	if (action == DUMP_ALLOC) {
5695 		/*
5696 		 * alloc and record dump_info
5697 		 */
5698 		if (dump_info != NULL)
5699 			return (EINVAL);
5700 
5701 		ASSERT(vp->v_type == VREG);
5702 		fs = ufsvfsp->vfs_fs;
5703 
5704 		rw_enter(&ip->i_contents, RW_READER);
5705 
5706 		if (bmap_has_holes(ip)) {
5707 			rw_exit(&ip->i_contents);
5708 			return (EFAULT);
5709 		}
5710 
5711 		/*
5712 		 * calculate and allocate space needed according to i_size
5713 		 */
5714 		entries = (int)lblkno(fs, blkroundup(fs, ip->i_size));
5715 		if ((dump_info = (struct dump *)
5716 		    kmem_alloc(sizeof (struct dump) +
5717 		    (entries - 1) * sizeof (daddr32_t), KM_NOSLEEP)) == NULL) {
5718 			    rw_exit(&ip->i_contents);
5719 			    return (ENOMEM);
5720 		}
5721 
5722 		/* Start saving the info */
5723 		dump_info->fsbs = entries;
5724 		dump_info->ip = ip;
5725 		storeblk = &dump_info->dblk[0];
5726 
5727 		/* Direct Blocks */
5728 		for (entry = 0; entry < NDADDR && entry < entries; entry++)
5729 			*storeblk++ = ip->i_db[entry];
5730 
5731 		/* Indirect Blocks */
5732 		for (i = 0; i < NIADDR; i++) {
5733 			int error = 0;
5734 
5735 			bp = UFS_BREAD(ufsvfsp,
5736 				ip->i_dev, fsbtodb(fs, ip->i_ib[i]),
5737 				fs->fs_bsize);
5738 			if (bp->b_flags & B_ERROR)
5739 				error = EIO;
5740 			else {
5741 				dblk = bp->b_un.b_daddr;
5742 				if ((storeblk = save_dblks(ip, ufsvfsp,
5743 				    storeblk, dblk, i, entries)) == NULL)
5744 					error = EIO;
5745 			}
5746 
5747 			brelse(bp);
5748 
5749 			if (error != 0) {
5750 				kmem_free(dump_info, sizeof (struct dump) +
5751 				    (entries - 1) * sizeof (daddr32_t));
5752 				rw_exit(&ip->i_contents);
5753 				dump_info = NULL;
5754 				return (error);
5755 			}
5756 		}
5757 		/* and time stamp the information */
5758 		mutex_enter(&ip->i_tlock);
5759 		dump_info->time = ip->i_mtime;
5760 		mutex_exit(&ip->i_tlock);
5761 
5762 		rw_exit(&ip->i_contents);
5763 	} else if (action == DUMP_FREE) {
5764 		/*
5765 		 * free dump_info
5766 		 */
5767 		if (dump_info == NULL)
5768 			return (EINVAL);
5769 		entries = dump_info->fsbs - 1;
5770 		kmem_free(dump_info, sizeof (struct dump) +
5771 		    entries * sizeof (daddr32_t));
5772 		dump_info = NULL;
5773 	} else if (action == DUMP_SCAN) {
5774 		/*
5775 		 * scan dump_info
5776 		 */
5777 		if (dump_info == NULL)
5778 			return (EINVAL);
5779 
5780 		dblk = dump_info->dblk;
5781 		nextblk = dblk + 1;
5782 		endblk = dblk + dump_info->fsbs - 1;
5783 		fs = ufsvfsp->vfs_fs;
5784 		ncontig = *blkp >> (fs->fs_bshift - DEV_BSHIFT);
5785 
5786 		/*
5787 		 * scan dblk[] entries; contig fs space is found when:
5788 		 * ((current blkno + frags per block) == next blkno)
5789 		 */
5790 		n = 0;
5791 		while (n < ncontig && dblk < endblk) {
5792 			if ((*dblk + fs->fs_frag) == *nextblk)
5793 				n++;
5794 			else
5795 				n = 0;
5796 			dblk++;
5797 			nextblk++;
5798 		}
5799 
5800 		/*
5801 		 * index is where size bytes of contig space begins;
5802 		 * conversion from index to the file's DEV_BSIZE lbn
5803 		 * is equivalent to:  (index * fs_bsize) / DEV_BSIZE
5804 		 */
5805 		if (n == ncontig) {
5806 			i = (dblk - dump_info->dblk) - ncontig;
5807 			*blkp = i << (fs->fs_bshift - DEV_BSHIFT);
5808 		} else
5809 			return (EFAULT);
5810 	}
5811 	return (0);
5812 }
5813 
5814 /*
5815  * Recursive helper function for ufs_dumpctl().  It follows the indirect file
5816  * system  blocks until it reaches the the disk block addresses, which are
5817  * then stored into the given buffer, storeblk.
5818  */
5819 static daddr32_t *
5820 save_dblks(struct inode *ip, struct ufsvfs *ufsvfsp,  daddr32_t *storeblk,
5821     daddr32_t *dblk, int level, int entries)
5822 {
5823 	struct fs	*fs = ufsvfsp->vfs_fs;
5824 	struct buf	*bp;
5825 	int		i;
5826 
5827 	if (level == 0) {
5828 		for (i = 0; i < NINDIR(fs); i++) {
5829 			if (storeblk - dump_info->dblk >= entries)
5830 				break;
5831 			*storeblk++ = dblk[i];
5832 		}
5833 		return (storeblk);
5834 	}
5835 	for (i = 0; i < NINDIR(fs); i++) {
5836 		if (storeblk - dump_info->dblk >= entries)
5837 			break;
5838 		bp = UFS_BREAD(ufsvfsp,
5839 				ip->i_dev, fsbtodb(fs, dblk[i]), fs->fs_bsize);
5840 		if (bp->b_flags & B_ERROR) {
5841 			brelse(bp);
5842 			return (NULL);
5843 		}
5844 		storeblk = save_dblks(ip, ufsvfsp, storeblk, bp->b_un.b_daddr,
5845 		    level - 1, entries);
5846 		brelse(bp);
5847 
5848 		if (storeblk == NULL)
5849 			return (NULL);
5850 	}
5851 	return (storeblk);
5852 }
5853 
5854 /* ARGSUSED */
5855 static int
5856 ufs_getsecattr(struct vnode *vp, vsecattr_t *vsap, int flag,
5857 	struct cred *cr)
5858 {
5859 	struct inode	*ip = VTOI(vp);
5860 	struct ulockfs	*ulp;
5861 	struct ufsvfs	*ufsvfsp = ip->i_ufsvfs;
5862 	ulong_t		vsa_mask = vsap->vsa_mask;
5863 	int		err = EINVAL;
5864 
5865 	TRACE_3(TR_FAC_UFS, TR_UFS_GETSECATTR_START,
5866 	    "ufs_getsecattr_start:vp %p, vsap %p, flags %x", vp, vsap, flag);
5867 
5868 	vsa_mask &= (VSA_ACL | VSA_ACLCNT | VSA_DFACL | VSA_DFACLCNT);
5869 
5870 	/*
5871 	 * Only grab locks if needed - they're not needed to check vsa_mask
5872 	 * or if the mask contains no acl flags.
5873 	 */
5874 	if (vsa_mask != 0) {
5875 		if (err = ufs_lockfs_begin(ufsvfsp, &ulp,
5876 		    ULOCKFS_GETATTR_MASK))
5877 			return (err);
5878 
5879 		rw_enter(&ip->i_contents, RW_READER);
5880 		err = ufs_acl_get(ip, vsap, flag, cr);
5881 		rw_exit(&ip->i_contents);
5882 
5883 		if (ulp)
5884 			ufs_lockfs_end(ulp);
5885 	}
5886 	TRACE_1(TR_FAC_UFS, TR_UFS_GETSECATTR_END,
5887 	    "ufs_getsecattr_end:vp %p", vp);
5888 	return (err);
5889 }
5890 
5891 /* ARGSUSED */
5892 static int
5893 ufs_setsecattr(struct vnode *vp, vsecattr_t *vsap, int flag, struct cred *cr)
5894 {
5895 	struct inode	*ip = VTOI(vp);
5896 	struct ulockfs	*ulp = NULL;
5897 	struct ufsvfs	*ufsvfsp = VTOI(vp)->i_ufsvfs;
5898 	ulong_t		vsa_mask = vsap->vsa_mask;
5899 	int		err;
5900 	int		haverwlock = 1;
5901 	int		trans_size;
5902 	int		donetrans = 0;
5903 	int		retry = 1;
5904 
5905 
5906 	TRACE_3(TR_FAC_UFS, TR_UFS_SETSECATTR_START,
5907 	    "ufs_setsecattr_start:vp %p, vsap %p, flags %x", vp, vsap, flag);
5908 
5909 	ASSERT(RW_LOCK_HELD(&ip->i_rwlock));
5910 
5911 	/* Abort now if the request is either empty or invalid. */
5912 	vsa_mask &= (VSA_ACL | VSA_ACLCNT | VSA_DFACL | VSA_DFACLCNT);
5913 	if ((vsa_mask == 0) ||
5914 	    ((vsap->vsa_aclentp == NULL) &&
5915 	    (vsap->vsa_dfaclentp == NULL))) {
5916 		err = EINVAL;
5917 		goto out;
5918 	}
5919 
5920 	/*
5921 	 * Following convention, if this is a directory then we acquire the
5922 	 * inode's i_rwlock after starting a UFS logging transaction;
5923 	 * otherwise, we acquire it beforehand. Since we were called (and
5924 	 * must therefore return) with the lock held, we will have to drop it,
5925 	 * and later reacquire it, if operating on a directory.
5926 	 */
5927 	if (vp->v_type == VDIR) {
5928 		rw_exit(&ip->i_rwlock);
5929 		haverwlock = 0;
5930 	} else {
5931 		/* Upgrade the lock if required. */
5932 		if (!rw_write_held(&ip->i_rwlock)) {
5933 			rw_exit(&ip->i_rwlock);
5934 			rw_enter(&ip->i_rwlock, RW_WRITER);
5935 		}
5936 	}
5937 
5938 again:
5939 	ASSERT(!(vp->v_type == VDIR && haverwlock));
5940 	if (err = ufs_lockfs_begin(ufsvfsp, &ulp, ULOCKFS_SETATTR_MASK)) {
5941 		ulp = NULL;
5942 		retry = 0;
5943 		goto out;
5944 	}
5945 
5946 	/*
5947 	 * Check that the file system supports this operation. Note that
5948 	 * ufs_lockfs_begin() will have checked that the file system had
5949 	 * not been forcibly unmounted.
5950 	 */
5951 	if (ufsvfsp->vfs_fs->fs_ronly) {
5952 		err = EROFS;
5953 		goto out;
5954 	}
5955 	if (ufsvfsp->vfs_nosetsec) {
5956 		err = ENOSYS;
5957 		goto out;
5958 	}
5959 
5960 	if (ulp) {
5961 		TRANS_BEGIN_ASYNC(ufsvfsp, TOP_SETSECATTR,
5962 			trans_size = TOP_SETSECATTR_SIZE(VTOI(vp)));
5963 		donetrans = 1;
5964 	}
5965 
5966 	if (vp->v_type == VDIR) {
5967 		rw_enter(&ip->i_rwlock, RW_WRITER);
5968 		haverwlock = 1;
5969 	}
5970 
5971 	ASSERT(haverwlock);
5972 
5973 	/* Do the actual work. */
5974 	rw_enter(&ip->i_contents, RW_WRITER);
5975 	/*
5976 	 * Suppress out of inodes messages if we will retry.
5977 	 */
5978 	if (retry)
5979 		ip->i_flag |= IQUIET;
5980 	err = ufs_acl_set(ip, vsap, flag, cr);
5981 	ip->i_flag &= ~IQUIET;
5982 	rw_exit(&ip->i_contents);
5983 
5984 out:
5985 	if (ulp) {
5986 		if (donetrans) {
5987 			/*
5988 			 * top_end_async() can eventually call
5989 			 * top_end_sync(), which can block. We must
5990 			 * therefore observe the lock-ordering protocol
5991 			 * here as well.
5992 			 */
5993 			if (vp->v_type == VDIR) {
5994 				rw_exit(&ip->i_rwlock);
5995 				haverwlock = 0;
5996 			}
5997 			TRANS_END_ASYNC(ufsvfsp, TOP_SETSECATTR, trans_size);
5998 		}
5999 		ufs_lockfs_end(ulp);
6000 	}
6001 	/*
6002 	 * If no inodes available, try scaring a logically-
6003 	 * free one out of the delete queue to someplace
6004 	 * that we can find it.
6005 	 */
6006 	if ((err == ENOSPC) && retry && TRANS_ISTRANS(ufsvfsp)) {
6007 		ufs_delete_drain_wait(ufsvfsp, 1);
6008 		retry = 0;
6009 		if (vp->v_type == VDIR && haverwlock) {
6010 			rw_exit(&ip->i_rwlock);
6011 			haverwlock = 0;
6012 		}
6013 		goto again;
6014 	}
6015 	/*
6016 	 * If we need to reacquire the lock then it is safe to do so
6017 	 * as a reader. This is because ufs_rwunlock(), which will be
6018 	 * called by our caller after we return, does not differentiate
6019 	 * between shared and exclusive locks.
6020 	 */
6021 	if (!haverwlock) {
6022 		ASSERT(vp->v_type == VDIR);
6023 		rw_enter(&ip->i_rwlock, RW_READER);
6024 	}
6025 
6026 	TRACE_1(TR_FAC_UFS, TR_UFS_SETSECATTR_END,
6027 	    "ufs_setsecattr_end:vp %p", vp);
6028 	return (err);
6029 }
6030