xref: /illumos-gate/usr/src/uts/common/fs/ufs/ufs_vnops.c (revision a5652762e5f7bf683d19f18542e5e39df63bad79)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 /*
22  * Copyright 2006 Sun Microsystems, Inc.  All rights reserved.
23  * Use is subject to license terms.
24  */
25 
26 /*	Copyright (c) 1983, 1984, 1985, 1986, 1987, 1988, 1989 AT&T	*/
27 /*	  All Rights Reserved  	*/
28 
29 /*
30  * Portions of this source code were derived from Berkeley 4.3 BSD
31  * under license from the Regents of the University of California.
32  */
33 
34 #pragma ident	"%Z%%M%	%I%	%E% SMI"
35 
36 #include <sys/types.h>
37 #include <sys/t_lock.h>
38 #include <sys/ksynch.h>
39 #include <sys/param.h>
40 #include <sys/time.h>
41 #include <sys/systm.h>
42 #include <sys/sysmacros.h>
43 #include <sys/resource.h>
44 #include <sys/signal.h>
45 #include <sys/cred.h>
46 #include <sys/user.h>
47 #include <sys/buf.h>
48 #include <sys/vfs.h>
49 #include <sys/vnode.h>
50 #include <sys/proc.h>
51 #include <sys/disp.h>
52 #include <sys/file.h>
53 #include <sys/fcntl.h>
54 #include <sys/flock.h>
55 #include <sys/atomic.h>
56 #include <sys/kmem.h>
57 #include <sys/uio.h>
58 #include <sys/dnlc.h>
59 #include <sys/conf.h>
60 #include <sys/mman.h>
61 #include <sys/pathname.h>
62 #include <sys/debug.h>
63 #include <sys/vmsystm.h>
64 #include <sys/cmn_err.h>
65 #include <sys/vtrace.h>
66 #include <sys/filio.h>
67 #include <sys/policy.h>
68 
69 #include <sys/fs/ufs_fs.h>
70 #include <sys/fs/ufs_lockfs.h>
71 #include <sys/fs/ufs_filio.h>
72 #include <sys/fs/ufs_inode.h>
73 #include <sys/fs/ufs_fsdir.h>
74 #include <sys/fs/ufs_quota.h>
75 #include <sys/fs/ufs_log.h>
76 #include <sys/fs/ufs_snap.h>
77 #include <sys/fs/ufs_trans.h>
78 #include <sys/fs/ufs_panic.h>
79 #include <sys/fs/ufs_bio.h>
80 #include <sys/dirent.h>		/* must be AFTER <sys/fs/fsdir.h>! */
81 #include <sys/errno.h>
82 #include <sys/fssnap_if.h>
83 #include <sys/unistd.h>
84 #include <sys/sunddi.h>
85 
86 #include <sys/filio.h>		/* _FIOIO */
87 
88 #include <vm/hat.h>
89 #include <vm/page.h>
90 #include <vm/pvn.h>
91 #include <vm/as.h>
92 #include <vm/seg.h>
93 #include <vm/seg_map.h>
94 #include <vm/seg_vn.h>
95 #include <vm/seg_kmem.h>
96 #include <vm/rm.h>
97 #include <sys/swap.h>
98 
99 #include <fs/fs_subr.h>
100 
101 static struct instats ins;
102 
103 static 	int ufs_getpage_ra(struct vnode *, u_offset_t, struct seg *, caddr_t);
104 static	int ufs_getpage_miss(struct vnode *, u_offset_t, size_t, struct seg *,
105 		caddr_t, struct page **, size_t, enum seg_rw, int);
106 static	int ufs_open(struct vnode **, int, struct cred *);
107 static	int ufs_close(struct vnode *, int, int, offset_t, struct cred *);
108 static	int ufs_read(struct vnode *, struct uio *, int, struct cred *,
109 			struct caller_context *);
110 static	int ufs_write(struct vnode *, struct uio *, int, struct cred *,
111 			struct caller_context *);
112 static	int ufs_ioctl(struct vnode *, int, intptr_t, int, struct cred *, int *);
113 static	int ufs_getattr(struct vnode *, struct vattr *, int, struct cred *);
114 static	int ufs_setattr(struct vnode *, struct vattr *, int, struct cred *,
115 			caller_context_t *);
116 static	int ufs_access(struct vnode *, int, int, struct cred *);
117 static	int ufs_lookup(struct vnode *, char *, struct vnode **,
118 		struct pathname *, int, struct vnode *, struct cred *);
119 static	int ufs_create(struct vnode *, char *, struct vattr *, enum vcexcl,
120 			int, struct vnode **, struct cred *, int);
121 static	int ufs_remove(struct vnode *, char *, struct cred *);
122 static	int ufs_link(struct vnode *, struct vnode *, char *, struct cred *);
123 static	int ufs_rename(struct vnode *, char *, struct vnode *, char *,
124 			struct cred *);
125 static	int ufs_mkdir(struct vnode *, char *, struct vattr *, struct vnode **,
126 			struct cred *);
127 static	int ufs_rmdir(struct vnode *, char *, struct vnode *, struct cred *);
128 static	int ufs_readdir(struct vnode *, struct uio *, struct cred *, int *);
129 static	int ufs_symlink(struct vnode *, char *, struct vattr *, char *,
130 			struct cred *);
131 static	int ufs_readlink(struct vnode *, struct uio *, struct cred *);
132 static	int ufs_fsync(struct vnode *, int, struct cred *);
133 static	void ufs_inactive(struct vnode *, struct cred *);
134 static	int ufs_fid(struct vnode *, struct fid *);
135 static	int ufs_rwlock(struct vnode *, int, caller_context_t *);
136 static	void ufs_rwunlock(struct vnode *, int, caller_context_t *);
137 static	int ufs_seek(struct vnode *, offset_t, offset_t *);
138 static	int ufs_frlock(struct vnode *, int, struct flock64 *, int, offset_t,
139 			struct flk_callback *, struct cred *);
140 static  int ufs_space(struct vnode *, int, struct flock64 *, int, offset_t,
141 		cred_t *, caller_context_t *);
142 static	int ufs_getpage(struct vnode *, offset_t, size_t, uint_t *,
143 		struct page **, size_t, struct seg *, caddr_t,
144 		enum seg_rw, struct cred *);
145 static	int ufs_putpage(struct vnode *, offset_t, size_t, int, struct cred *);
146 static	int ufs_putpages(struct vnode *, offset_t, size_t, int, struct cred *);
147 static	int ufs_map(struct vnode *, offset_t, struct as *, caddr_t *, size_t,
148 			uchar_t, uchar_t, uint_t, struct cred *);
149 static	int ufs_addmap(struct vnode *, offset_t, struct as *, caddr_t,  size_t,
150 			uchar_t, uchar_t, uint_t, struct cred *);
151 static	int ufs_delmap(struct vnode *, offset_t, struct as *, caddr_t,  size_t,
152 			uint_t, uint_t, uint_t, struct cred *);
153 static	int ufs_poll(vnode_t *, short, int, short *, struct pollhead **);
154 static	int ufs_dump(vnode_t *, caddr_t, int, int);
155 static	int ufs_l_pathconf(struct vnode *, int, ulong_t *, struct cred *);
156 static	int ufs_pageio(struct vnode *, struct page *, u_offset_t, size_t, int,
157 			struct cred *);
158 static	int ufs_dump(vnode_t *, caddr_t, int, int);
159 static	int ufs_dumpctl(vnode_t *, int, int *);
160 static	daddr32_t *save_dblks(struct inode *, struct ufsvfs *, daddr32_t *,
161 			daddr32_t *, int, int);
162 static	int ufs_getsecattr(struct vnode *, vsecattr_t *, int, struct cred *);
163 static	int ufs_setsecattr(struct vnode *, vsecattr_t *, int, struct cred *);
164 
165 /*
166  * For lockfs: ulockfs begin/end is now inlined in the ufs_xxx functions.
167  *
168  * XXX - ULOCKFS in fs_pathconf and ufs_ioctl is not inlined yet.
169  */
170 struct vnodeops *ufs_vnodeops;
171 
172 const fs_operation_def_t ufs_vnodeops_template[] = {
173 	VOPNAME_OPEN, ufs_open,	/* will not be blocked by lockfs */
174 	VOPNAME_CLOSE, ufs_close,	/* will not be blocked by lockfs */
175 	VOPNAME_READ, ufs_read,
176 	VOPNAME_WRITE, ufs_write,
177 	VOPNAME_IOCTL, ufs_ioctl,
178 	VOPNAME_GETATTR, ufs_getattr,
179 	VOPNAME_SETATTR, ufs_setattr,
180 	VOPNAME_ACCESS, ufs_access,
181 	VOPNAME_LOOKUP, ufs_lookup,
182 	VOPNAME_CREATE, ufs_create,
183 	VOPNAME_REMOVE, ufs_remove,
184 	VOPNAME_LINK, ufs_link,
185 	VOPNAME_RENAME, ufs_rename,
186 	VOPNAME_MKDIR, ufs_mkdir,
187 	VOPNAME_RMDIR, ufs_rmdir,
188 	VOPNAME_READDIR, ufs_readdir,
189 	VOPNAME_SYMLINK, ufs_symlink,
190 	VOPNAME_READLINK, ufs_readlink,
191 	VOPNAME_FSYNC, ufs_fsync,
192 	VOPNAME_INACTIVE, (fs_generic_func_p) ufs_inactive,  /* not blocked */
193 	VOPNAME_FID, ufs_fid,
194 	VOPNAME_RWLOCK, ufs_rwlock, /* not blocked */
195 	VOPNAME_RWUNLOCK, (fs_generic_func_p) ufs_rwunlock,  /* not blocked */
196 	VOPNAME_SEEK, ufs_seek,
197 	VOPNAME_FRLOCK, ufs_frlock,
198 	VOPNAME_SPACE, ufs_space,
199 	VOPNAME_GETPAGE, ufs_getpage,
200 	VOPNAME_PUTPAGE, ufs_putpage,
201 	VOPNAME_MAP, (fs_generic_func_p) ufs_map,
202 	VOPNAME_ADDMAP, (fs_generic_func_p) ufs_addmap,	/* not blocked */
203 	VOPNAME_DELMAP, ufs_delmap,	/* will not be blocked by lockfs */
204 	VOPNAME_POLL, (fs_generic_func_p) ufs_poll,	/* not blocked */
205 	VOPNAME_DUMP, ufs_dump,
206 	VOPNAME_PATHCONF, ufs_l_pathconf,
207 	VOPNAME_PAGEIO, ufs_pageio,
208 	VOPNAME_DUMPCTL, ufs_dumpctl,
209 	VOPNAME_GETSECATTR, ufs_getsecattr,
210 	VOPNAME_SETSECATTR, ufs_setsecattr,
211 	VOPNAME_VNEVENT, fs_vnevent_support,
212 	NULL, NULL
213 };
214 
215 #define	MAX_BACKFILE_COUNT	9999
216 
217 /*
218  * Created by ufs_dumpctl() to store a file's disk block info into memory.
219  * Used by ufs_dump() to dump data to disk directly.
220  */
221 struct dump {
222 	struct inode	*ip;		/* the file we contain */
223 	daddr_t		fsbs;		/* number of blocks stored */
224 	struct timeval32 time;		/* time stamp for the struct */
225 	daddr32_t 	dblk[1];	/* place holder for block info */
226 };
227 
228 static struct dump *dump_info = NULL;
229 
230 /*
231  * Previously there was no special action required for ordinary files.
232  * (Devices are handled through the device file system.)
233  * Now we support Large Files and Large File API requires open to
234  * fail if file is large.
235  * We could take care to prevent data corruption
236  * by doing an atomic check of size and truncate if file is opened with
237  * FTRUNC flag set but traditionally this is being done by the vfs/vnode
238  * layers. So taking care of truncation here is a change in the existing
239  * semantics of VOP_OPEN and therefore we chose not to implement any thing
240  * here. The check for the size of the file > 2GB is being done at the
241  * vfs layer in routine vn_open().
242  */
243 
244 /* ARGSUSED */
245 static int
246 ufs_open(struct vnode **vpp, int flag, struct cred *cr)
247 {
248 	TRACE_1(TR_FAC_UFS, TR_UFS_OPEN, "ufs_open:vpp %p", vpp);
249 	return (0);
250 }
251 
252 /*ARGSUSED*/
253 static int
254 ufs_close(struct vnode *vp, int flag, int count, offset_t offset,
255 	struct cred *cr)
256 {
257 	TRACE_1(TR_FAC_UFS, TR_UFS_CLOSE, "ufs_close:vp %p", vp);
258 
259 	cleanlocks(vp, ttoproc(curthread)->p_pid, 0);
260 	cleanshares(vp, ttoproc(curthread)->p_pid);
261 
262 	/*
263 	 * Push partially filled cluster at last close.
264 	 * ``last close'' is approximated because the dnlc
265 	 * may have a hold on the vnode.
266 	 * Checking for VBAD here will also act as a forced umount check.
267 	 */
268 	if (vp->v_count <= 2 && vp->v_type != VBAD) {
269 		struct inode *ip = VTOI(vp);
270 		if (ip->i_delaylen) {
271 			ins.in_poc.value.ul++;
272 			(void) ufs_putpages(vp, ip->i_delayoff, ip->i_delaylen,
273 					B_ASYNC | B_FREE, cr);
274 			ip->i_delaylen = 0;
275 		}
276 	}
277 
278 	return (0);
279 }
280 
281 /*ARGSUSED*/
282 static int
283 ufs_read(struct vnode *vp, struct uio *uiop, int ioflag, struct cred *cr,
284 	struct caller_context *ct)
285 {
286 	struct inode *ip = VTOI(vp);
287 	struct ufsvfs *ufsvfsp;
288 	struct ulockfs *ulp = NULL;
289 	int error = 0;
290 	int intrans = 0;
291 
292 	ASSERT(RW_READ_HELD(&ip->i_rwlock));
293 	TRACE_3(TR_FAC_UFS, TR_UFS_READ_START,
294 		"ufs_read_start:vp %p uiop %p ioflag %x",
295 		vp, uiop, ioflag);
296 
297 	/*
298 	 * Mandatory locking needs to be done before ufs_lockfs_begin()
299 	 * and TRANS_BEGIN_SYNC() calls since mandatory locks can sleep.
300 	 */
301 	if (MANDLOCK(vp, ip->i_mode)) {
302 		/*
303 		 * ufs_getattr ends up being called by chklock
304 		 */
305 		error = chklock(vp, FREAD, uiop->uio_loffset,
306 				uiop->uio_resid, uiop->uio_fmode, ct);
307 		if (error)
308 			goto out;
309 	}
310 
311 	ufsvfsp = ip->i_ufsvfs;
312 	error = ufs_lockfs_begin(ufsvfsp, &ulp, ULOCKFS_READ_MASK);
313 	if (error)
314 		goto out;
315 
316 	/*
317 	 * In the case that a directory is opened for reading as a file
318 	 * (eg "cat .") with the  O_RSYNC, O_SYNC and O_DSYNC flags set.
319 	 * The locking order had to be changed to avoid a deadlock with
320 	 * an update taking place on that directory at the same time.
321 	 */
322 	if ((ip->i_mode & IFMT) == IFDIR) {
323 
324 		rw_enter(&ip->i_contents, RW_READER);
325 		error = rdip(ip, uiop, ioflag, cr);
326 		rw_exit(&ip->i_contents);
327 
328 		if (error) {
329 			if (ulp)
330 				ufs_lockfs_end(ulp);
331 			goto out;
332 		}
333 
334 		if (ulp && (ioflag & FRSYNC) && (ioflag & (FSYNC | FDSYNC)) &&
335 		    TRANS_ISTRANS(ufsvfsp)) {
336 			rw_exit(&ip->i_rwlock);
337 			TRANS_BEGIN_SYNC(ufsvfsp, TOP_READ_SYNC, TOP_READ_SIZE,
338 			    error);
339 			ASSERT(!error);
340 			TRANS_END_SYNC(ufsvfsp, error, TOP_READ_SYNC,
341 			    TOP_READ_SIZE);
342 			rw_enter(&ip->i_rwlock, RW_READER);
343 		}
344 	} else {
345 		/*
346 		 * Only transact reads to files opened for sync-read and
347 		 * sync-write on a file system that is not write locked.
348 		 *
349 		 * The ``not write locked'' check prevents problems with
350 		 * enabling/disabling logging on a busy file system.  E.g.,
351 		 * logging exists at the beginning of the read but does not
352 		 * at the end.
353 		 *
354 		 */
355 		if (ulp && (ioflag & FRSYNC) && (ioflag & (FSYNC | FDSYNC)) &&
356 		    TRANS_ISTRANS(ufsvfsp)) {
357 			TRANS_BEGIN_SYNC(ufsvfsp, TOP_READ_SYNC, TOP_READ_SIZE,
358 			    error);
359 			ASSERT(!error);
360 			intrans = 1;
361 		}
362 
363 		rw_enter(&ip->i_contents, RW_READER);
364 		error = rdip(ip, uiop, ioflag, cr);
365 		rw_exit(&ip->i_contents);
366 
367 		if (intrans) {
368 			TRANS_END_SYNC(ufsvfsp, error, TOP_READ_SYNC,
369 			    TOP_READ_SIZE);
370 		}
371 	}
372 
373 	if (ulp) {
374 		ufs_lockfs_end(ulp);
375 	}
376 out:
377 
378 	TRACE_2(TR_FAC_UFS, TR_UFS_READ_END,
379 		"ufs_read_end:vp %p error %d", vp, error);
380 	return (error);
381 }
382 
383 extern	int	ufs_HW;		/* high water mark */
384 extern	int	ufs_LW;		/* low water mark */
385 int	ufs_WRITES = 1;		/* XXX - enable/disable */
386 int	ufs_throttles = 0;	/* throttling count */
387 int	ufs_allow_shared_writes = 1;	/* directio shared writes */
388 
389 static int
390 ufs_check_rewrite(struct inode *ip, struct uio *uiop, int ioflag)
391 {
392 	int	shared_write;
393 
394 	/*
395 	 * If the FDSYNC flag is set then ignore the global
396 	 * ufs_allow_shared_writes in this case.
397 	 */
398 	shared_write = (ioflag & FDSYNC) | ufs_allow_shared_writes;
399 
400 	/*
401 	 * Filter to determine if this request is suitable as a
402 	 * concurrent rewrite. This write must not allocate blocks
403 	 * by extending the file or filling in holes. No use trying
404 	 * through FSYNC descriptors as the inode will be synchronously
405 	 * updated after the write. The uio structure has not yet been
406 	 * checked for sanity, so assume nothing.
407 	 */
408 	return (((ip->i_mode & IFMT) == IFREG) && !(ioflag & FAPPEND) &&
409 		(uiop->uio_loffset >= (offset_t)0) &&
410 		(uiop->uio_loffset < ip->i_size) && (uiop->uio_resid > 0) &&
411 		((ip->i_size - uiop->uio_loffset) >= uiop->uio_resid) &&
412 		!(ioflag & FSYNC) && !bmap_has_holes(ip) &&
413 		shared_write);
414 }
415 
416 /*ARGSUSED*/
417 static int
418 ufs_write(struct vnode *vp, struct uio *uiop, int ioflag, cred_t *cr,
419 	caller_context_t *ct)
420 {
421 	struct inode *ip = VTOI(vp);
422 	struct ufsvfs *ufsvfsp;
423 	struct ulockfs *ulp;
424 	int retry = 1;
425 	int error, resv, resid = 0;
426 	int directio_status;
427 	int exclusive;
428 	int rewriteflg;
429 	long start_resid = uiop->uio_resid;
430 
431 	TRACE_3(TR_FAC_UFS, TR_UFS_WRITE_START,
432 		"ufs_write_start:vp %p uiop %p ioflag %x",
433 		vp, uiop, ioflag);
434 
435 	ASSERT(RW_LOCK_HELD(&ip->i_rwlock));
436 
437 retry_mandlock:
438 	/*
439 	 * Mandatory locking needs to be done before ufs_lockfs_begin()
440 	 * and TRANS_BEGIN_[A]SYNC() calls since mandatory locks can sleep.
441 	 * Check for forced unmounts normally done in ufs_lockfs_begin().
442 	 */
443 	if ((ufsvfsp = ip->i_ufsvfs) == NULL) {
444 		error = EIO;
445 		goto out;
446 	}
447 	if (MANDLOCK(vp, ip->i_mode)) {
448 
449 		ASSERT(RW_WRITE_HELD(&ip->i_rwlock));
450 
451 		/*
452 		 * ufs_getattr ends up being called by chklock
453 		 */
454 		error = chklock(vp, FWRITE, uiop->uio_loffset,
455 				uiop->uio_resid, uiop->uio_fmode, ct);
456 		if (error)
457 			goto out;
458 	}
459 
460 	/* i_rwlock can change in chklock */
461 	exclusive = rw_write_held(&ip->i_rwlock);
462 	rewriteflg = ufs_check_rewrite(ip, uiop, ioflag);
463 
464 	/*
465 	 * Check for fast-path special case of directio re-writes.
466 	 */
467 	if ((ip->i_flag & IDIRECTIO || ufsvfsp->vfs_forcedirectio) &&
468 	    !exclusive && rewriteflg) {
469 
470 		error = ufs_lockfs_begin(ufsvfsp, &ulp, ULOCKFS_WRITE_MASK);
471 		if (error)
472 			goto out;
473 
474 		rw_enter(&ip->i_contents, RW_READER);
475 		error = ufs_directio_write(ip, uiop, ioflag, 1, cr,
476 			&directio_status);
477 		if (directio_status == DIRECTIO_SUCCESS) {
478 			uint_t i_flag_save;
479 
480 			if (start_resid != uiop->uio_resid)
481 				error = 0;
482 			/*
483 			 * Special treatment of access times for re-writes.
484 			 * If IMOD is not already set, then convert it
485 			 * to IMODACC for this operation. This defers
486 			 * entering a delta into the log until the inode
487 			 * is flushed. This mimics what is done for read
488 			 * operations and inode access time.
489 			 */
490 			mutex_enter(&ip->i_tlock);
491 			i_flag_save = ip->i_flag;
492 			ip->i_flag |= IUPD | ICHG;
493 			ip->i_seq++;
494 			ITIMES_NOLOCK(ip);
495 			if ((i_flag_save & IMOD) == 0) {
496 				ip->i_flag &= ~IMOD;
497 				ip->i_flag |= IMODACC;
498 			}
499 			mutex_exit(&ip->i_tlock);
500 			rw_exit(&ip->i_contents);
501 			if (ulp)
502 				ufs_lockfs_end(ulp);
503 			goto out;
504 		}
505 		rw_exit(&ip->i_contents);
506 		if (ulp)
507 			ufs_lockfs_end(ulp);
508 	}
509 
510 	if (!exclusive && !rw_tryupgrade(&ip->i_rwlock)) {
511 		rw_exit(&ip->i_rwlock);
512 		rw_enter(&ip->i_rwlock, RW_WRITER);
513 		/*
514 		 * Mandatory locking could have been enabled
515 		 * after dropping the i_rwlock.
516 		 */
517 		if (MANDLOCK(vp, ip->i_mode))
518 			goto retry_mandlock;
519 	}
520 
521 	error = ufs_lockfs_begin(ufsvfsp, &ulp, ULOCKFS_WRITE_MASK);
522 	if (error)
523 		goto out;
524 
525 	/*
526 	 * Amount of log space needed for this write
527 	 */
528 	if (!rewriteflg || !(ioflag & FDSYNC))
529 		TRANS_WRITE_RESV(ip, uiop, ulp, &resv, &resid);
530 
531 	/*
532 	 * Throttle writes.
533 	 */
534 	if (ufs_WRITES && (ip->i_writes > ufs_HW)) {
535 		mutex_enter(&ip->i_tlock);
536 		while (ip->i_writes > ufs_HW) {
537 			ufs_throttles++;
538 			cv_wait(&ip->i_wrcv, &ip->i_tlock);
539 		}
540 		mutex_exit(&ip->i_tlock);
541 	}
542 
543 	/*
544 	 * Enter Transaction
545 	 *
546 	 * If the write is a rewrite there is no need to open a transaction
547 	 * if the FDSYNC flag is set and not the FSYNC.  In this case just
548 	 * set the IMODACC flag to modify do the update at a later time
549 	 * thus avoiding the overhead of the logging transaction that is
550 	 * not required.
551 	 */
552 	if (ioflag & (FSYNC|FDSYNC)) {
553 		if (ulp) {
554 			if (rewriteflg) {
555 				uint_t i_flag_save;
556 
557 				rw_enter(&ip->i_contents, RW_READER);
558 				mutex_enter(&ip->i_tlock);
559 				i_flag_save = ip->i_flag;
560 				ip->i_flag |= IUPD | ICHG;
561 				ip->i_seq++;
562 				ITIMES_NOLOCK(ip);
563 				if ((i_flag_save & IMOD) == 0) {
564 					ip->i_flag &= ~IMOD;
565 					ip->i_flag |= IMODACC;
566 				}
567 				mutex_exit(&ip->i_tlock);
568 				rw_exit(&ip->i_contents);
569 			} else {
570 				int terr = 0;
571 				TRANS_BEGIN_SYNC(ufsvfsp, TOP_WRITE_SYNC, resv,
572 				    terr);
573 				ASSERT(!terr);
574 			}
575 		}
576 	} else {
577 		if (ulp)
578 			TRANS_BEGIN_ASYNC(ufsvfsp, TOP_WRITE, resv);
579 	}
580 
581 	/*
582 	 * Write the file
583 	 */
584 	rw_enter(&ufsvfsp->vfs_dqrwlock, RW_READER);
585 	rw_enter(&ip->i_contents, RW_WRITER);
586 	if ((ioflag & FAPPEND) != 0 && (ip->i_mode & IFMT) == IFREG) {
587 		/*
588 		 * In append mode start at end of file.
589 		 */
590 		uiop->uio_loffset = ip->i_size;
591 	}
592 
593 	/*
594 	 * Mild optimisation, don't call ufs_trans_write() unless we have to
595 	 * Also, suppress file system full messages if we will retry.
596 	 */
597 	if (retry)
598 		ip->i_flag |= IQUIET;
599 	if (resid) {
600 		TRANS_WRITE(ip, uiop, ioflag, error, ulp, cr, resv, resid);
601 	} else {
602 		error = wrip(ip, uiop, ioflag, cr);
603 	}
604 	ip->i_flag &= ~IQUIET;
605 
606 	rw_exit(&ip->i_contents);
607 	rw_exit(&ufsvfsp->vfs_dqrwlock);
608 
609 	/*
610 	 * Leave Transaction
611 	 */
612 	if (ulp) {
613 		if (ioflag & (FSYNC|FDSYNC)) {
614 			if (!rewriteflg) {
615 				int terr = 0;
616 
617 				TRANS_END_SYNC(ufsvfsp, terr, TOP_WRITE_SYNC,
618 					resv);
619 				if (error == 0)
620 					error = terr;
621 			}
622 		} else {
623 			TRANS_END_ASYNC(ufsvfsp, TOP_WRITE, resv);
624 		}
625 		ufs_lockfs_end(ulp);
626 	}
627 out:
628 	if ((error == ENOSPC) && retry && TRANS_ISTRANS(ufsvfsp)) {
629 		/*
630 		 * Any blocks tied up in pending deletes?
631 		 */
632 		ufs_delete_drain_wait(ufsvfsp, 1);
633 		retry = 0;
634 		goto retry_mandlock;
635 	}
636 
637 	if (error == ENOSPC && (start_resid != uiop->uio_resid))
638 		error = 0;
639 
640 	TRACE_2(TR_FAC_UFS, TR_UFS_WRITE_END,
641 		"ufs_write_end:vp %p error %d", vp, error);
642 	return (error);
643 }
644 
645 /*
646  * Don't cache write blocks to files with the sticky bit set.
647  * Used to keep swap files from blowing the page cache on a server.
648  */
649 int stickyhack = 1;
650 
651 /*
652  * Free behind hacks.  The pager is busted.
653  * XXX - need to pass the information down to writedone() in a flag like B_SEQ
654  * or B_FREE_IF_TIGHT_ON_MEMORY.
655  */
656 int	freebehind = 1;
657 int	smallfile = 0;
658 u_offset_t smallfile64 = 32 * 1024;
659 
660 /*
661  * While we should, in most cases, cache the pages for write, we
662  * may also want to cache the pages for read as long as they are
663  * frequently re-usable.
664  *
665  * If cache_read_ahead = 1, the pages for read will go to the tail
666  * of the cache list when they are released, otherwise go to the head.
667  */
668 int	cache_read_ahead = 0;
669 
670 /*
671  * Freebehind exists  so that as we read  large files  sequentially we
672  * don't consume most of memory with pages  from a few files. It takes
673  * longer to re-read from disk multiple small files as it does reading
674  * one large one sequentially.  As system  memory grows customers need
675  * to retain bigger chunks   of files in  memory.   The advent of  the
676  * cachelist opens up of the possibility freeing pages  to the head or
677  * tail of the list.
678  *
679  * Not freeing a page is a bet that the page will be read again before
680  * it's segmap slot is needed for something else. If we loose the bet,
681  * it means some  other thread is  burdened with the  page free we did
682  * not do. If we win we save a free and reclaim.
683  *
684  * Freeing it at the tail  vs the head of cachelist  is a bet that the
685  * page will survive until the next  read.  It's also saying that this
686  * page is more likely to  be re-used than a  page freed some time ago
687  * and never reclaimed.
688  *
689  * Freebehind maintains a  range of  file offset [smallfile1; smallfile2]
690  *
691  *            0 < offset < smallfile1 : pages are not freed.
692  *   smallfile1 < offset < smallfile2 : pages freed to tail of cachelist.
693  *   smallfile2 < offset              : pages freed to head of cachelist.
694  *
695  * The range  is  computed  at most  once  per second  and  depends on
696  * freemem  and  ncpus_online.  Both parameters  are   bounded to be
697  * >= smallfile && >= smallfile64.
698  *
699  * smallfile1 = (free memory / ncpu) / 1000
700  * smallfile2 = (free memory / ncpu) / 10
701  *
702  * A few examples values:
703  *
704  *       Free Mem (in Bytes) [smallfile1; smallfile2]  [smallfile1; smallfile2]
705  *                                 ncpus_online = 4          ncpus_online = 64
706  *       ------------------  -----------------------   -----------------------
707  *             1G                   [256K;  25M]               [32K; 1.5M]
708  *            10G                   [2.5M; 250M]              [156K; 15M]
709  *           100G                    [25M; 2.5G]              [1.5M; 150M]
710  *
711  */
712 
713 #define	SMALLFILE1_D 1000
714 #define	SMALLFILE2_D 10
715 static u_offset_t smallfile1 = 32 * 1024;
716 static u_offset_t smallfile2 = 32 * 1024;
717 static clock_t smallfile_update = 0; /* lbolt value of when to recompute */
718 uint_t smallfile1_d = SMALLFILE1_D;
719 uint_t smallfile2_d = SMALLFILE2_D;
720 
721 /*
722  * wrip does the real work of write requests for ufs.
723  */
724 int
725 wrip(struct inode *ip, struct uio *uio, int ioflag, struct cred *cr)
726 {
727 	rlim64_t limit = uio->uio_llimit;
728 	u_offset_t off;
729 	u_offset_t old_i_size;
730 	struct fs *fs;
731 	struct vnode *vp;
732 	struct ufsvfs *ufsvfsp;
733 	caddr_t base;
734 	long start_resid = uio->uio_resid;	/* save starting resid */
735 	long premove_resid;			/* resid before uiomove() */
736 	uint_t flags;
737 	int newpage;
738 	int iupdat_flag, directio_status;
739 	int n, on, mapon;
740 	int error, pagecreate;
741 	int do_dqrwlock;		/* drop/reacquire vfs_dqrwlock */
742 	int32_t	iblocks;
743 	int	new_iblocks;
744 
745 	/*
746 	 * ip->i_size is incremented before the uiomove
747 	 * is done on a write.  If the move fails (bad user
748 	 * address) reset ip->i_size.
749 	 * The better way would be to increment ip->i_size
750 	 * only if the uiomove succeeds.
751 	 */
752 	int i_size_changed = 0;
753 	o_mode_t type;
754 	int i_seq_needed = 0;
755 
756 	vp = ITOV(ip);
757 
758 	/*
759 	 * check for forced unmount - should not happen as
760 	 * the request passed the lockfs checks.
761 	 */
762 	if ((ufsvfsp = ip->i_ufsvfs) == NULL)
763 		return (EIO);
764 
765 	fs = ip->i_fs;
766 
767 	TRACE_1(TR_FAC_UFS, TR_UFS_RWIP_START,
768 		"ufs_wrip_start:vp %p", vp);
769 
770 	ASSERT(RW_WRITE_HELD(&ip->i_contents));
771 
772 	/* check for valid filetype */
773 	type = ip->i_mode & IFMT;
774 	if ((type != IFREG) && (type != IFDIR) && (type != IFATTRDIR) &&
775 	    (type != IFLNK) && (type != IFSHAD)) {
776 		return (EIO);
777 	}
778 
779 	/*
780 	 * the actual limit of UFS file size
781 	 * is UFS_MAXOFFSET_T
782 	 */
783 	if (limit == RLIM64_INFINITY || limit > MAXOFFSET_T)
784 		limit = MAXOFFSET_T;
785 
786 	if (uio->uio_loffset >= limit) {
787 		proc_t *p = ttoproc(curthread);
788 
789 		TRACE_2(TR_FAC_UFS, TR_UFS_RWIP_END,
790 			"ufs_wrip_end:vp %p error %d", vp, EINVAL);
791 
792 		mutex_enter(&p->p_lock);
793 		(void) rctl_action(rctlproc_legacy[RLIMIT_FSIZE], p->p_rctls,
794 		    p, RCA_UNSAFE_SIGINFO);
795 		mutex_exit(&p->p_lock);
796 		return (EFBIG);
797 	}
798 
799 	/*
800 	 * if largefiles are disallowed, the limit is
801 	 * the pre-largefiles value of 2GB
802 	 */
803 	if (ufsvfsp->vfs_lfflags & UFS_LARGEFILES)
804 		limit = MIN(UFS_MAXOFFSET_T, limit);
805 	else
806 		limit = MIN(MAXOFF32_T, limit);
807 
808 	if (uio->uio_loffset < (offset_t)0) {
809 		TRACE_2(TR_FAC_UFS, TR_UFS_RWIP_END,
810 			"ufs_wrip_end:vp %p error %d", vp, EINVAL);
811 		return (EINVAL);
812 	}
813 	if (uio->uio_resid == 0) {
814 		TRACE_2(TR_FAC_UFS, TR_UFS_RWIP_END,
815 			"ufs_wrip_end:vp %p error %d", vp, 0);
816 		return (0);
817 	}
818 
819 	if (uio->uio_loffset >= limit)
820 		return (EFBIG);
821 
822 	ip->i_flag |= INOACC;	/* don't update ref time in getpage */
823 
824 	if (ioflag & (FSYNC|FDSYNC)) {
825 		ip->i_flag |= ISYNC;
826 		iupdat_flag = 1;
827 	}
828 	/*
829 	 * Try to go direct
830 	 */
831 	if (ip->i_flag & IDIRECTIO || ufsvfsp->vfs_forcedirectio) {
832 		uio->uio_llimit = limit;
833 		error = ufs_directio_write(ip, uio, ioflag, 0, cr,
834 			&directio_status);
835 		/*
836 		 * If ufs_directio wrote to the file or set the flags,
837 		 * we need to update i_seq, but it may be deferred.
838 		 */
839 		if (start_resid != uio->uio_resid ||
840 					(ip->i_flag & (ICHG|IUPD))) {
841 			i_seq_needed = 1;
842 			ip->i_flag |= ISEQ;
843 		}
844 		if (directio_status == DIRECTIO_SUCCESS)
845 			goto out;
846 	}
847 
848 	/*
849 	 * Behavior with respect to dropping/reacquiring vfs_dqrwlock:
850 	 *
851 	 * o shadow inodes: vfs_dqrwlock is not held at all
852 	 * o quota updates: vfs_dqrwlock is read or write held
853 	 * o other updates: vfs_dqrwlock is read held
854 	 *
855 	 * The first case is the only one where we do not hold
856 	 * vfs_dqrwlock at all while entering wrip().
857 	 * We must make sure not to downgrade/drop vfs_dqrwlock if we
858 	 * have it as writer, i.e. if we are updating the quota inode.
859 	 * There is no potential deadlock scenario in this case as
860 	 * ufs_getpage() takes care of this and avoids reacquiring
861 	 * vfs_dqrwlock in that case.
862 	 *
863 	 * This check is done here since the above conditions do not change
864 	 * and we possibly loop below, so save a few cycles.
865 	 */
866 	if ((type == IFSHAD) ||
867 		(rw_owner(&ufsvfsp->vfs_dqrwlock) == curthread)) {
868 			do_dqrwlock = 0;
869 	} else {
870 		do_dqrwlock = 1;
871 	}
872 
873 	/*
874 	 * Large Files: We cast MAXBMASK to offset_t
875 	 * inorder to mask out the higher bits. Since offset_t
876 	 * is a signed value, the high order bit set in MAXBMASK
877 	 * value makes it do the right thing by having all bits 1
878 	 * in the higher word. May be removed for _SOLARIS64_.
879 	 */
880 
881 	fs = ip->i_fs;
882 	do {
883 		u_offset_t uoff = uio->uio_loffset;
884 		off = uoff & (offset_t)MAXBMASK;
885 		mapon = (int)(uoff & (offset_t)MAXBOFFSET);
886 		on = (int)blkoff(fs, uoff);
887 		n = (int)MIN(fs->fs_bsize - on, uio->uio_resid);
888 		new_iblocks = 1;
889 
890 		if (type == IFREG && uoff + n >= limit) {
891 			if (uoff >= limit) {
892 				error = EFBIG;
893 				goto out;
894 			}
895 			/*
896 			 * since uoff + n >= limit,
897 			 * therefore n >= limit - uoff, and n is an int
898 			 * so it is safe to cast it to an int
899 			 */
900 			n = (int)(limit - (rlim64_t)uoff);
901 		}
902 		if (uoff + n > ip->i_size) {
903 			/*
904 			 * We are extending the length of the file.
905 			 * bmap is used so that we are sure that
906 			 * if we need to allocate new blocks, that it
907 			 * is done here before we up the file size.
908 			 */
909 			error = bmap_write(ip, uoff, (int)(on + n),
910 			    mapon == 0, NULL, cr);
911 			/*
912 			 * bmap_write never drops i_contents so if
913 			 * the flags are set it changed the file.
914 			 */
915 			if (ip->i_flag & (ICHG|IUPD)) {
916 				i_seq_needed = 1;
917 				ip->i_flag |= ISEQ;
918 			}
919 			if (error)
920 				break;
921 			/*
922 			 * There is a window of vulnerability here.
923 			 * The sequence of operations: allocate file
924 			 * system blocks, uiomove the data into pages,
925 			 * and then update the size of the file in the
926 			 * inode, must happen atomically.  However, due
927 			 * to current locking constraints, this can not
928 			 * be done.
929 			 */
930 			ASSERT(ip->i_writer == NULL);
931 			ip->i_writer = curthread;
932 			i_size_changed = 1;
933 			/*
934 			 * If we are writing from the beginning of
935 			 * the mapping, we can just create the
936 			 * pages without having to read them.
937 			 */
938 			pagecreate = (mapon == 0);
939 		} else if (n == MAXBSIZE) {
940 			/*
941 			 * Going to do a whole mappings worth,
942 			 * so we can just create the pages w/o
943 			 * having to read them in.  But before
944 			 * we do that, we need to make sure any
945 			 * needed blocks are allocated first.
946 			 */
947 			iblocks = ip->i_blocks;
948 			error = bmap_write(ip, uoff, (int)(on + n),
949 			    BI_ALLOC_ONLY, NULL, cr);
950 			/*
951 			 * bmap_write never drops i_contents so if
952 			 * the flags are set it changed the file.
953 			 */
954 			if (ip->i_flag & (ICHG|IUPD)) {
955 				i_seq_needed = 1;
956 				ip->i_flag |= ISEQ;
957 			}
958 			if (error)
959 				break;
960 			pagecreate = 1;
961 			/*
962 			 * check if the new created page needed the
963 			 * allocation of new disk blocks.
964 			 */
965 			if (iblocks == ip->i_blocks)
966 				new_iblocks = 0; /* no new blocks allocated */
967 		} else {
968 			pagecreate = 0;
969 			/*
970 			 * In sync mode flush the indirect blocks which
971 			 * may have been allocated and not written on
972 			 * disk. In above cases bmap_write will allocate
973 			 * in sync mode.
974 			 */
975 			if (ioflag & (FSYNC|FDSYNC)) {
976 				error = ufs_indirblk_sync(ip, uoff);
977 				if (error)
978 					break;
979 			}
980 		}
981 
982 		/*
983 		 * At this point we can enter ufs_getpage() in one
984 		 * of two ways:
985 		 * 1) segmap_getmapflt() calls ufs_getpage() when the
986 		 *    forcefault parameter is true (pagecreate == 0)
987 		 * 2) uiomove() causes a page fault.
988 		 *
989 		 * We have to drop the contents lock to prevent the VM
990 		 * system from trying to reaquire it in ufs_getpage()
991 		 * should the uiomove cause a pagefault.
992 		 *
993 		 * We have to drop the reader vfs_dqrwlock here as well.
994 		 */
995 		rw_exit(&ip->i_contents);
996 		if (do_dqrwlock) {
997 			ASSERT(RW_LOCK_HELD(&ufsvfsp->vfs_dqrwlock));
998 			ASSERT(!(RW_WRITE_HELD(&ufsvfsp->vfs_dqrwlock)));
999 			rw_exit(&ufsvfsp->vfs_dqrwlock);
1000 		}
1001 
1002 		newpage = 0;
1003 		premove_resid = uio->uio_resid;
1004 		if (vpm_enable) {
1005 			/*
1006 			 * Copy data. If new pages are created, part of
1007 			 * the page that is not written will be initizliazed
1008 			 * with zeros.
1009 			 */
1010 			error = vpm_data_copy(vp, (off + mapon), (uint_t)n,
1011 				uio, !pagecreate, &newpage, 0, S_WRITE);
1012 		} else {
1013 
1014 			base = segmap_getmapflt(segkmap, vp, (off + mapon),
1015 					(uint_t)n, !pagecreate, S_WRITE);
1016 
1017 			/*
1018 			 * segmap_pagecreate() returns 1 if it calls
1019 			 * page_create_va() to allocate any pages.
1020 			 */
1021 
1022 			if (pagecreate)
1023 				newpage = segmap_pagecreate(segkmap, base,
1024 				    (size_t)n, 0);
1025 
1026 			error = uiomove(base + mapon, (long)n, UIO_WRITE, uio);
1027 		}
1028 
1029 		/*
1030 		 * If "newpage" is set, then a new page was created and it
1031 		 * does not contain valid data, so it needs to be initialized
1032 		 * at this point.
1033 		 * Otherwise the page contains old data, which was overwritten
1034 		 * partially or as a whole in uiomove.
1035 		 * If there is only one iovec structure within uio, then
1036 		 * on error uiomove will not be able to update uio->uio_loffset
1037 		 * and we would zero the whole page here!
1038 		 *
1039 		 * If uiomove fails because of an error, the old valid data
1040 		 * is kept instead of filling the rest of the page with zero's.
1041 		 */
1042 		if (!vpm_enable && newpage &&
1043 		    uio->uio_loffset < roundup(off + mapon + n, PAGESIZE)) {
1044 			/*
1045 			 * We created pages w/o initializing them completely,
1046 			 * thus we need to zero the part that wasn't set up.
1047 			 * This happens on most EOF write cases and if
1048 			 * we had some sort of error during the uiomove.
1049 			 */
1050 			int nzero, nmoved;
1051 
1052 			nmoved = (int)(uio->uio_loffset - (off + mapon));
1053 			ASSERT(nmoved >= 0 && nmoved <= n);
1054 			nzero = roundup(on + n, PAGESIZE) - nmoved;
1055 			ASSERT(nzero > 0 && mapon + nmoved + nzero <= MAXBSIZE);
1056 			(void) kzero(base + mapon + nmoved, (uint_t)nzero);
1057 		}
1058 
1059 		/*
1060 		 * Unlock the pages allocated by page_create_va()
1061 		 * in segmap_pagecreate()
1062 		 */
1063 		if (!vpm_enable && newpage)
1064 			segmap_pageunlock(segkmap, base, (size_t)n, S_WRITE);
1065 
1066 		/*
1067 		 * If the size of the file changed, then update the
1068 		 * size field in the inode now.  This can't be done
1069 		 * before the call to segmap_pageunlock or there is
1070 		 * a potential deadlock with callers to ufs_putpage().
1071 		 * They will be holding i_contents and trying to lock
1072 		 * a page, while this thread is holding a page locked
1073 		 * and trying to acquire i_contents.
1074 		 */
1075 		if (i_size_changed) {
1076 			rw_enter(&ip->i_contents, RW_WRITER);
1077 			old_i_size = ip->i_size;
1078 			UFS_SET_ISIZE(uoff + n, ip);
1079 			TRANS_INODE(ufsvfsp, ip);
1080 			/*
1081 			 * file has grown larger than 2GB. Set flag
1082 			 * in superblock to indicate this, if it
1083 			 * is not already set.
1084 			 */
1085 			if ((ip->i_size > MAXOFF32_T) &&
1086 			    !(fs->fs_flags & FSLARGEFILES)) {
1087 				ASSERT(ufsvfsp->vfs_lfflags & UFS_LARGEFILES);
1088 				mutex_enter(&ufsvfsp->vfs_lock);
1089 				fs->fs_flags |= FSLARGEFILES;
1090 				ufs_sbwrite(ufsvfsp);
1091 				mutex_exit(&ufsvfsp->vfs_lock);
1092 			}
1093 			mutex_enter(&ip->i_tlock);
1094 			ip->i_writer = NULL;
1095 			cv_broadcast(&ip->i_wrcv);
1096 			mutex_exit(&ip->i_tlock);
1097 			rw_exit(&ip->i_contents);
1098 		}
1099 
1100 		if (error) {
1101 			/*
1102 			 * If we failed on a write, we may have already
1103 			 * allocated file blocks as well as pages.  It's
1104 			 * hard to undo the block allocation, but we must
1105 			 * be sure to invalidate any pages that may have
1106 			 * been allocated.
1107 			 *
1108 			 * If the page was created without initialization
1109 			 * then we must check if it should be possible
1110 			 * to destroy the new page and to keep the old data
1111 			 * on the disk.
1112 			 *
1113 			 * It is possible to destroy the page without
1114 			 * having to write back its contents only when
1115 			 * - the size of the file keeps unchanged
1116 			 * - bmap_write() did not allocate new disk blocks
1117 			 *   it is possible to create big files using "seek" and
1118 			 *   write to the end of the file. A "write" to a
1119 			 *   position before the end of the file would not
1120 			 *   change the size of the file but it would allocate
1121 			 *   new disk blocks.
1122 			 * - uiomove intended to overwrite the whole page.
1123 			 * - a new page was created (newpage == 1).
1124 			 */
1125 
1126 			if (i_size_changed == 0 && new_iblocks == 0 &&
1127 			    newpage) {
1128 
1129 				/* unwind what uiomove eventually last did */
1130 				uio->uio_resid = premove_resid;
1131 
1132 				/*
1133 				 * destroy the page, do not write ambiguous
1134 				 * data to the disk.
1135 				 */
1136 				flags = SM_DESTROY;
1137 			} else {
1138 				/*
1139 				 * write the page back to the disk, if dirty,
1140 				 * and remove the page from the cache.
1141 				 */
1142 				flags = SM_INVAL;
1143 			}
1144 
1145 			if (vpm_enable) {
1146 				/*
1147 				 *  Flush pages.
1148 				 */
1149 				(void) vpm_sync_pages(vp, off, n, flags);
1150 			} else {
1151 				(void) segmap_release(segkmap, base, flags);
1152 			}
1153 		} else {
1154 			flags = 0;
1155 			/*
1156 			 * Force write back for synchronous write cases.
1157 			 */
1158 			if ((ioflag & (FSYNC|FDSYNC)) || type == IFDIR) {
1159 				/*
1160 				 * If the sticky bit is set but the
1161 				 * execute bit is not set, we do a
1162 				 * synchronous write back and free
1163 				 * the page when done.  We set up swap
1164 				 * files to be handled this way to
1165 				 * prevent servers from keeping around
1166 				 * the client's swap pages too long.
1167 				 * XXX - there ought to be a better way.
1168 				 */
1169 				if (IS_SWAPVP(vp)) {
1170 					flags = SM_WRITE | SM_FREE |
1171 					    SM_DONTNEED;
1172 					iupdat_flag = 0;
1173 				} else {
1174 					flags = SM_WRITE;
1175 				}
1176 			} else if (n + on == MAXBSIZE || IS_SWAPVP(vp)) {
1177 				/*
1178 				 * Have written a whole block.
1179 				 * Start an asynchronous write and
1180 				 * mark the buffer to indicate that
1181 				 * it won't be needed again soon.
1182 				 */
1183 				flags = SM_WRITE | SM_ASYNC | SM_DONTNEED;
1184 			}
1185 			if (vpm_enable) {
1186 				/*
1187 				 * Flush pages.
1188 				 */
1189 				(void) vpm_sync_pages(vp, off, n, flags);
1190 			} else {
1191 				(void) segmap_release(segkmap, base, flags);
1192 			}
1193 			/*
1194 			 * If the operation failed and is synchronous,
1195 			 * then we need to unwind what uiomove() last
1196 			 * did so we can potentially return an error to
1197 			 * the caller.  If this write operation was
1198 			 * done in two pieces and the first succeeded,
1199 			 * then we won't return an error for the second
1200 			 * piece that failed.  However, we only want to
1201 			 * return a resid value that reflects what was
1202 			 * really done.
1203 			 *
1204 			 * Failures for non-synchronous operations can
1205 			 * be ignored since the page subsystem will
1206 			 * retry the operation until it succeeds or the
1207 			 * file system is unmounted.
1208 			 */
1209 			if (error) {
1210 				if ((ioflag & (FSYNC | FDSYNC)) ||
1211 				    type == IFDIR) {
1212 					uio->uio_resid = premove_resid;
1213 				} else {
1214 					error = 0;
1215 				}
1216 			}
1217 		}
1218 
1219 		/*
1220 		 * Re-acquire contents lock.
1221 		 * If it was dropped, reacquire reader vfs_dqrwlock as well.
1222 		 */
1223 		if (do_dqrwlock)
1224 			rw_enter(&ufsvfsp->vfs_dqrwlock, RW_READER);
1225 		rw_enter(&ip->i_contents, RW_WRITER);
1226 
1227 		/*
1228 		 * If the uiomove() failed or if a synchronous
1229 		 * page push failed, fix up i_size.
1230 		 */
1231 		if (error) {
1232 			if (i_size_changed) {
1233 				/*
1234 				 * The uiomove failed, and we
1235 				 * allocated blocks,so get rid
1236 				 * of them.
1237 				 */
1238 				(void) ufs_itrunc(ip, old_i_size, 0, cr);
1239 			}
1240 		} else {
1241 			/*
1242 			 * XXX - Can this be out of the loop?
1243 			 */
1244 			ip->i_flag |= IUPD | ICHG;
1245 			/*
1246 			 * Only do one increase of i_seq for multiple
1247 			 * pieces.  Because we drop locks, record
1248 			 * the fact that we changed the timestamp and
1249 			 * are deferring the increase in case another thread
1250 			 * pushes our timestamp update.
1251 			 */
1252 			i_seq_needed = 1;
1253 			ip->i_flag |= ISEQ;
1254 			if (i_size_changed)
1255 				ip->i_flag |= IATTCHG;
1256 			if ((ip->i_mode & (IEXEC | (IEXEC >> 3) |
1257 			    (IEXEC >> 6))) != 0 &&
1258 			    (ip->i_mode & (ISUID | ISGID)) != 0 &&
1259 			    secpolicy_vnode_setid_retain(cr,
1260 			    (ip->i_mode & ISUID) != 0 && ip->i_uid == 0) != 0) {
1261 				/*
1262 				 * Clear Set-UID & Set-GID bits on
1263 				 * successful write if not privileged
1264 				 * and at least one of the execute bits
1265 				 * is set.  If we always clear Set-GID,
1266 				 * mandatory file and record locking is
1267 				 * unuseable.
1268 				 */
1269 				ip->i_mode &= ~(ISUID | ISGID);
1270 			}
1271 		}
1272 		/*
1273 		 * In the case the FDSYNC flag is set and this is a
1274 		 * "rewrite" we won't log a delta.
1275 		 * The FSYNC flag overrides all cases.
1276 		 */
1277 		if (!ufs_check_rewrite(ip, uio, ioflag) || !(ioflag & FDSYNC)) {
1278 			TRANS_INODE(ufsvfsp, ip);
1279 		}
1280 	} while (error == 0 && uio->uio_resid > 0 && n != 0);
1281 
1282 out:
1283 	/*
1284 	 * Make sure i_seq is increased at least once per write
1285 	 */
1286 	if (i_seq_needed) {
1287 		ip->i_seq++;
1288 		ip->i_flag &= ~ISEQ;	/* no longer deferred */
1289 	}
1290 
1291 	/*
1292 	 * Inode is updated according to this table -
1293 	 *
1294 	 *   FSYNC	  FDSYNC(posix.4)
1295 	 *   --------------------------
1296 	 *   always@	  IATTCHG|IBDWRITE
1297 	 *
1298 	 * @ - 	If we are doing synchronous write the only time we should
1299 	 *	not be sync'ing the ip here is if we have the stickyhack
1300 	 *	activated, the file is marked with the sticky bit and
1301 	 *	no exec bit, the file length has not been changed and
1302 	 *	no new blocks have been allocated during this write.
1303 	 */
1304 
1305 	if ((ip->i_flag & ISYNC) != 0) {
1306 		/*
1307 		 * we have eliminated nosync
1308 		 */
1309 		if ((ip->i_flag & (IATTCHG|IBDWRITE)) ||
1310 			((ioflag & FSYNC) && iupdat_flag)) {
1311 			ufs_iupdat(ip, 1);
1312 		}
1313 	}
1314 
1315 	/*
1316 	 * If we've already done a partial-write, terminate
1317 	 * the write but return no error unless the error is ENOSPC
1318 	 * because the caller can detect this and free resources and
1319 	 * try again.
1320 	 */
1321 	if ((start_resid != uio->uio_resid) && (error != ENOSPC))
1322 		error = 0;
1323 
1324 	ip->i_flag &= ~(INOACC | ISYNC);
1325 	ITIMES_NOLOCK(ip);
1326 	TRACE_2(TR_FAC_UFS, TR_UFS_RWIP_END,
1327 		"ufs_wrip_end:vp %p error %d", vp, error);
1328 	return (error);
1329 }
1330 
1331 /*
1332  * rdip does the real work of read requests for ufs.
1333  */
1334 int
1335 rdip(struct inode *ip, struct uio *uio, int ioflag, cred_t *cr)
1336 {
1337 	u_offset_t off;
1338 	caddr_t base;
1339 	struct fs *fs;
1340 	struct ufsvfs *ufsvfsp;
1341 	struct vnode *vp;
1342 	long oresid = uio->uio_resid;
1343 	u_offset_t n, on, mapon;
1344 	int error = 0;
1345 	int doupdate = 1;
1346 	uint_t flags;
1347 	int dofree, directio_status;
1348 	krw_t rwtype;
1349 	o_mode_t type;
1350 
1351 	vp = ITOV(ip);
1352 
1353 	TRACE_1(TR_FAC_UFS, TR_UFS_RWIP_START,
1354 		"ufs_rdip_start:vp %p", vp);
1355 
1356 	ASSERT(RW_LOCK_HELD(&ip->i_contents));
1357 
1358 	ufsvfsp = ip->i_ufsvfs;
1359 
1360 	if (ufsvfsp == NULL)
1361 		return (EIO);
1362 
1363 	fs = ufsvfsp->vfs_fs;
1364 
1365 	/* check for valid filetype */
1366 	type = ip->i_mode & IFMT;
1367 	if ((type != IFREG) && (type != IFDIR) && (type != IFATTRDIR) &&
1368 	    (type != IFLNK) && (type != IFSHAD)) {
1369 		return (EIO);
1370 	}
1371 
1372 	if (uio->uio_loffset > UFS_MAXOFFSET_T) {
1373 		TRACE_2(TR_FAC_UFS, TR_UFS_RWIP_END,
1374 			"ufs_rdip_end:vp %p error %d", vp, EINVAL);
1375 		error = 0;
1376 		goto out;
1377 	}
1378 	if (uio->uio_loffset < (offset_t)0) {
1379 		TRACE_2(TR_FAC_UFS, TR_UFS_RWIP_END,
1380 			"ufs_rdip_end:vp %p error %d", vp, EINVAL);
1381 		return (EINVAL);
1382 	}
1383 	if (uio->uio_resid == 0) {
1384 		TRACE_2(TR_FAC_UFS, TR_UFS_RWIP_END,
1385 			"ufs_rdip_end:vp %p error %d", vp, 0);
1386 		return (0);
1387 	}
1388 
1389 	if (!ULOCKFS_IS_NOIACC(ITOUL(ip)) && (fs->fs_ronly == 0) &&
1390 		(!ufsvfsp->vfs_noatime)) {
1391 		mutex_enter(&ip->i_tlock);
1392 		ip->i_flag |= IACC;
1393 		mutex_exit(&ip->i_tlock);
1394 	}
1395 	/*
1396 	 * Try to go direct
1397 	 */
1398 	if (ip->i_flag & IDIRECTIO || ufsvfsp->vfs_forcedirectio) {
1399 		error = ufs_directio_read(ip, uio, cr, &directio_status);
1400 		if (directio_status == DIRECTIO_SUCCESS)
1401 			goto out;
1402 	}
1403 
1404 	rwtype = (rw_write_held(&ip->i_contents)?RW_WRITER:RW_READER);
1405 
1406 	do {
1407 		offset_t diff;
1408 		u_offset_t uoff = uio->uio_loffset;
1409 		off = uoff & (offset_t)MAXBMASK;
1410 		mapon = (u_offset_t)(uoff & (offset_t)MAXBOFFSET);
1411 		on = (u_offset_t)blkoff(fs, uoff);
1412 		n = MIN((u_offset_t)fs->fs_bsize - on,
1413 			(u_offset_t)uio->uio_resid);
1414 
1415 		diff = ip->i_size - uoff;
1416 
1417 		if (diff <= (offset_t)0) {
1418 			error = 0;
1419 			goto out;
1420 		}
1421 		if (diff < (offset_t)n)
1422 			n = (int)diff;
1423 
1424 		/*
1425 		 * We update smallfile2 and smallfile1 at most every second.
1426 		 */
1427 		if (lbolt >= smallfile_update) {
1428 			uint64_t percpufreeb;
1429 			if (smallfile1_d == 0) smallfile1_d = SMALLFILE1_D;
1430 			if (smallfile2_d == 0) smallfile2_d = SMALLFILE2_D;
1431 			percpufreeb = ptob((uint64_t)freemem) / ncpus_online;
1432 			smallfile1 = percpufreeb / smallfile1_d;
1433 			smallfile2 = percpufreeb / smallfile2_d;
1434 			smallfile1 = MAX(smallfile1, smallfile);
1435 			smallfile1 = MAX(smallfile1, smallfile64);
1436 			smallfile2 = MAX(smallfile1, smallfile2);
1437 			smallfile_update = lbolt + hz;
1438 		}
1439 
1440 		dofree = freebehind &&
1441 		    ip->i_nextr == (off & PAGEMASK) && off > smallfile1;
1442 
1443 		/*
1444 		 * At this point we can enter ufs_getpage() in one of two
1445 		 * ways:
1446 		 * 1) segmap_getmapflt() calls ufs_getpage() when the
1447 		 *    forcefault parameter is true (value of 1 is passed)
1448 		 * 2) uiomove() causes a page fault.
1449 		 *
1450 		 * We cannot hold onto an i_contents reader lock without
1451 		 * risking deadlock in ufs_getpage() so drop a reader lock.
1452 		 * The ufs_getpage() dolock logic already allows for a
1453 		 * thread holding i_contents as writer to work properly
1454 		 * so we keep a writer lock.
1455 		 */
1456 		if (rwtype == RW_READER)
1457 			rw_exit(&ip->i_contents);
1458 
1459 		if (vpm_enable) {
1460 			/*
1461 			 * Copy data.
1462 			 */
1463 			error = vpm_data_copy(vp, (off + mapon), (uint_t)n,
1464 				uio, 1, NULL, 0, S_READ);
1465 		} else {
1466 			base = segmap_getmapflt(segkmap, vp, (off + mapon),
1467 					(uint_t)n, 1, S_READ);
1468 			error = uiomove(base + mapon, (long)n, UIO_READ, uio);
1469 		}
1470 
1471 		flags = 0;
1472 		if (!error) {
1473 			/*
1474 			 * If  reading sequential  we won't need  this
1475 			 * buffer again  soon.  For  offsets in  range
1476 			 * [smallfile1,  smallfile2] release the pages
1477 			 * at   the  tail  of the   cache list, larger
1478 			 * offsets are released at the head.
1479 			 */
1480 			if (dofree) {
1481 				flags = SM_FREE | SM_ASYNC;
1482 				if ((cache_read_ahead == 0) &&
1483 					(off > smallfile2))
1484 					flags |=  SM_DONTNEED;
1485 			}
1486 			/*
1487 			 * In POSIX SYNC (FSYNC and FDSYNC) read mode,
1488 			 * we want to make sure that the page which has
1489 			 * been read, is written on disk if it is dirty.
1490 			 * And corresponding indirect blocks should also
1491 			 * be flushed out.
1492 			 */
1493 			if ((ioflag & FRSYNC) && (ioflag & (FSYNC|FDSYNC))) {
1494 				flags &= ~SM_ASYNC;
1495 				flags |= SM_WRITE;
1496 			}
1497 			if (vpm_enable) {
1498 				error = vpm_sync_pages(vp, off, n, flags);
1499 			} else {
1500 				error = segmap_release(segkmap, base, flags);
1501 			}
1502 		} else {
1503 			if (vpm_enable) {
1504 				(void) vpm_sync_pages(vp, off, n, flags);
1505 			} else {
1506 				(void) segmap_release(segkmap, base, flags);
1507 			}
1508 		}
1509 
1510 		if (rwtype == RW_READER)
1511 			rw_enter(&ip->i_contents, rwtype);
1512 	} while (error == 0 && uio->uio_resid > 0 && n != 0);
1513 out:
1514 	/*
1515 	 * Inode is updated according to this table if FRSYNC is set.
1516 	 *
1517 	 *   FSYNC	  FDSYNC(posix.4)
1518 	 *   --------------------------
1519 	 *   always	  IATTCHG|IBDWRITE
1520 	 */
1521 	/*
1522 	 * The inode is not updated if we're logging and the inode is a
1523 	 * directory with FRSYNC, FSYNC and FDSYNC flags set.
1524 	 */
1525 	if (ioflag & FRSYNC) {
1526 		if (TRANS_ISTRANS(ufsvfsp) && ((ip->i_mode & IFMT) == IFDIR)) {
1527 				doupdate = 0;
1528 		}
1529 		if (doupdate) {
1530 			if ((ioflag & FSYNC) ||
1531 			    ((ioflag & FDSYNC) &&
1532 			    (ip->i_flag & (IATTCHG|IBDWRITE)))) {
1533 				ufs_iupdat(ip, 1);
1534 			}
1535 		}
1536 	}
1537 	/*
1538 	 * If we've already done a partial read, terminate
1539 	 * the read but return no error.
1540 	 */
1541 	if (oresid != uio->uio_resid)
1542 		error = 0;
1543 	ITIMES(ip);
1544 
1545 	TRACE_2(TR_FAC_UFS, TR_UFS_RWIP_END,
1546 		"ufs_rdip_end:vp %p error %d", vp, error);
1547 	return (error);
1548 }
1549 
1550 /* ARGSUSED */
1551 static int
1552 ufs_ioctl(
1553 	struct vnode	*vp,
1554 	int		cmd,
1555 	intptr_t	arg,
1556 	int		flag,
1557 	struct cred	*cr,
1558 	int		*rvalp)
1559 {
1560 	struct lockfs	lockfs, lockfs_out;
1561 	struct ufsvfs	*ufsvfsp = VTOI(vp)->i_ufsvfs;
1562 	char		*comment, *original_comment;
1563 	struct fs	*fs;
1564 	struct ulockfs	*ulp;
1565 	offset_t	off;
1566 	extern int	maxphys;
1567 	int		error;
1568 	int		issync;
1569 	int		trans_size;
1570 
1571 
1572 	/*
1573 	 * forcibly unmounted
1574 	 */
1575 	if (ufsvfsp == NULL) {
1576 		return (EIO);
1577 	}
1578 
1579 	fs = ufsvfsp->vfs_fs;
1580 
1581 	if (cmd == Q_QUOTACTL) {
1582 		error = ufs_lockfs_begin(ufsvfsp, &ulp, ULOCKFS_QUOTA_MASK);
1583 		if (error)
1584 			return (error);
1585 
1586 		if (ulp) {
1587 			TRANS_BEGIN_ASYNC(ufsvfsp, TOP_QUOTA,
1588 						TOP_SETQUOTA_SIZE(fs));
1589 		}
1590 
1591 		error = quotactl(vp, arg, flag, cr);
1592 
1593 		if (ulp) {
1594 			TRANS_END_ASYNC(ufsvfsp, TOP_QUOTA,
1595 						TOP_SETQUOTA_SIZE(fs));
1596 			ufs_lockfs_end(ulp);
1597 		}
1598 		return (error);
1599 	}
1600 
1601 	switch (cmd) {
1602 		case _FIOLFS:
1603 			/*
1604 			 * file system locking
1605 			 */
1606 			if (secpolicy_fs_config(cr, ufsvfsp->vfs_vfs) != 0)
1607 				return (EPERM);
1608 
1609 			if ((flag & DATAMODEL_MASK) == DATAMODEL_NATIVE) {
1610 				if (copyin((caddr_t)arg, &lockfs,
1611 						sizeof (struct lockfs)))
1612 					return (EFAULT);
1613 			}
1614 #ifdef _SYSCALL32_IMPL
1615 			else {
1616 				struct lockfs32	lockfs32;
1617 				/* Translate ILP32 lockfs to LP64 lockfs */
1618 				if (copyin((caddr_t)arg, &lockfs32,
1619 				    sizeof (struct lockfs32)))
1620 					return (EFAULT);
1621 				lockfs.lf_lock = (ulong_t)lockfs32.lf_lock;
1622 				lockfs.lf_flags = (ulong_t)lockfs32.lf_flags;
1623 				lockfs.lf_key = (ulong_t)lockfs32.lf_key;
1624 				lockfs.lf_comlen = (ulong_t)lockfs32.lf_comlen;
1625 				lockfs.lf_comment =
1626 					(caddr_t)(uintptr_t)lockfs32.lf_comment;
1627 			}
1628 #endif /* _SYSCALL32_IMPL */
1629 
1630 			if (lockfs.lf_comlen) {
1631 				if (lockfs.lf_comlen > LOCKFS_MAXCOMMENTLEN)
1632 					return (ENAMETOOLONG);
1633 				comment = kmem_alloc(lockfs.lf_comlen,
1634 						KM_SLEEP);
1635 				if (copyin(lockfs.lf_comment, comment,
1636 					lockfs.lf_comlen)) {
1637 					kmem_free(comment, lockfs.lf_comlen);
1638 					return (EFAULT);
1639 				}
1640 				original_comment = lockfs.lf_comment;
1641 				lockfs.lf_comment = comment;
1642 			}
1643 			if ((error = ufs_fiolfs(vp, &lockfs, 0)) == 0) {
1644 				lockfs.lf_comment = original_comment;
1645 
1646 				if ((flag & DATAMODEL_MASK) ==
1647 				    DATAMODEL_NATIVE) {
1648 					(void) copyout(&lockfs, (caddr_t)arg,
1649 					    sizeof (struct lockfs));
1650 				}
1651 #ifdef _SYSCALL32_IMPL
1652 				else {
1653 					struct lockfs32	lockfs32;
1654 					/* Translate LP64 to ILP32 lockfs */
1655 					lockfs32.lf_lock =
1656 					    (uint32_t)lockfs.lf_lock;
1657 					lockfs32.lf_flags =
1658 					    (uint32_t)lockfs.lf_flags;
1659 					lockfs32.lf_key =
1660 					    (uint32_t)lockfs.lf_key;
1661 					lockfs32.lf_comlen =
1662 					    (uint32_t)lockfs.lf_comlen;
1663 					lockfs32.lf_comment =
1664 					(uint32_t)(uintptr_t)lockfs.lf_comment;
1665 					(void) copyout(&lockfs32, (caddr_t)arg,
1666 					    sizeof (struct lockfs32));
1667 				}
1668 #endif /* _SYSCALL32_IMPL */
1669 
1670 			} else {
1671 				if (lockfs.lf_comlen)
1672 					kmem_free(comment, lockfs.lf_comlen);
1673 			}
1674 			return (error);
1675 
1676 		case _FIOLFSS:
1677 			/*
1678 			 * get file system locking status
1679 			 */
1680 
1681 			if ((flag & DATAMODEL_MASK) == DATAMODEL_NATIVE) {
1682 				if (copyin((caddr_t)arg, &lockfs,
1683 						sizeof (struct lockfs)))
1684 					return (EFAULT);
1685 			}
1686 #ifdef _SYSCALL32_IMPL
1687 			else {
1688 				struct lockfs32	lockfs32;
1689 				/* Translate ILP32 lockfs to LP64 lockfs */
1690 				if (copyin((caddr_t)arg, &lockfs32,
1691 						sizeof (struct lockfs32)))
1692 					return (EFAULT);
1693 				lockfs.lf_lock = (ulong_t)lockfs32.lf_lock;
1694 				lockfs.lf_flags = (ulong_t)lockfs32.lf_flags;
1695 				lockfs.lf_key = (ulong_t)lockfs32.lf_key;
1696 				lockfs.lf_comlen = (ulong_t)lockfs32.lf_comlen;
1697 				lockfs.lf_comment =
1698 					(caddr_t)(uintptr_t)lockfs32.lf_comment;
1699 			}
1700 #endif /* _SYSCALL32_IMPL */
1701 
1702 			if (error =  ufs_fiolfss(vp, &lockfs_out))
1703 				return (error);
1704 			lockfs.lf_lock = lockfs_out.lf_lock;
1705 			lockfs.lf_key = lockfs_out.lf_key;
1706 			lockfs.lf_flags = lockfs_out.lf_flags;
1707 			lockfs.lf_comlen = MIN(lockfs.lf_comlen,
1708 				lockfs_out.lf_comlen);
1709 
1710 			if ((flag & DATAMODEL_MASK) == DATAMODEL_NATIVE) {
1711 				if (copyout(&lockfs, (caddr_t)arg,
1712 						sizeof (struct lockfs)))
1713 					return (EFAULT);
1714 			}
1715 #ifdef _SYSCALL32_IMPL
1716 			else {
1717 				/* Translate LP64 to ILP32 lockfs */
1718 				struct lockfs32	lockfs32;
1719 				lockfs32.lf_lock = (uint32_t)lockfs.lf_lock;
1720 				lockfs32.lf_flags = (uint32_t)lockfs.lf_flags;
1721 				lockfs32.lf_key = (uint32_t)lockfs.lf_key;
1722 				lockfs32.lf_comlen = (uint32_t)lockfs.lf_comlen;
1723 				lockfs32.lf_comment =
1724 					(uint32_t)(uintptr_t)lockfs.lf_comment;
1725 				if (copyout(&lockfs32, (caddr_t)arg,
1726 					    sizeof (struct lockfs32)))
1727 					return (EFAULT);
1728 			}
1729 #endif /* _SYSCALL32_IMPL */
1730 
1731 			if (lockfs.lf_comlen &&
1732 			    lockfs.lf_comment && lockfs_out.lf_comment)
1733 				if (copyout(lockfs_out.lf_comment,
1734 					lockfs.lf_comment,
1735 					lockfs.lf_comlen))
1736 					return (EFAULT);
1737 			return (0);
1738 
1739 		case _FIOSATIME:
1740 			/*
1741 			 * set access time
1742 			 */
1743 
1744 			/*
1745 			 * if mounted w/o atime, return quietly.
1746 			 * I briefly thought about returning ENOSYS, but
1747 			 * figured that most apps would consider this fatal
1748 			 * but the idea is to make this as seamless as poss.
1749 			 */
1750 			if (ufsvfsp->vfs_noatime)
1751 				return (0);
1752 
1753 			error = ufs_lockfs_begin(ufsvfsp, &ulp,
1754 					ULOCKFS_SETATTR_MASK);
1755 			if (error)
1756 				return (error);
1757 
1758 			if (ulp) {
1759 				trans_size = (int)TOP_SETATTR_SIZE(VTOI(vp));
1760 				TRANS_BEGIN_CSYNC(ufsvfsp, issync,
1761 						TOP_SETATTR, trans_size);
1762 			}
1763 
1764 			error = ufs_fiosatime(vp, (struct timeval *)arg,
1765 					flag, cr);
1766 
1767 			if (ulp) {
1768 				TRANS_END_CSYNC(ufsvfsp, error, issync,
1769 						TOP_SETATTR, trans_size);
1770 				ufs_lockfs_end(ulp);
1771 			}
1772 			return (error);
1773 
1774 		case _FIOSDIO:
1775 			/*
1776 			 * set delayed-io
1777 			 */
1778 			return (ufs_fiosdio(vp, (uint_t *)arg, flag, cr));
1779 
1780 		case _FIOGDIO:
1781 			/*
1782 			 * get delayed-io
1783 			 */
1784 			return (ufs_fiogdio(vp, (uint_t *)arg, flag, cr));
1785 
1786 		case _FIOIO:
1787 			/*
1788 			 * inode open
1789 			 */
1790 			error = ufs_lockfs_begin(ufsvfsp, &ulp,
1791 					ULOCKFS_VGET_MASK);
1792 			if (error)
1793 				return (error);
1794 
1795 			error = ufs_fioio(vp, (struct fioio *)arg, flag, cr);
1796 
1797 			if (ulp) {
1798 				ufs_lockfs_end(ulp);
1799 			}
1800 			return (error);
1801 
1802 		case _FIOFFS:
1803 			/*
1804 			 * file system flush (push w/invalidate)
1805 			 */
1806 			if ((caddr_t)arg != NULL)
1807 				return (EINVAL);
1808 			return (ufs_fioffs(vp, NULL, cr));
1809 
1810 		case _FIOISBUSY:
1811 			/*
1812 			 * Contract-private interface for Legato
1813 			 * Purge this vnode from the DNLC and decide
1814 			 * if this vnode is busy (*arg == 1) or not
1815 			 * (*arg == 0)
1816 			 */
1817 			if (secpolicy_fs_config(cr, ufsvfsp->vfs_vfs) != 0)
1818 				return (EPERM);
1819 			error = ufs_fioisbusy(vp, (int *)arg, cr);
1820 			return (error);
1821 
1822 		case _FIODIRECTIO:
1823 			return (ufs_fiodirectio(vp, (int)arg, cr));
1824 
1825 		case _FIOTUNE:
1826 			/*
1827 			 * Tune the file system (aka setting fs attributes)
1828 			 */
1829 			error = ufs_lockfs_begin(ufsvfsp, &ulp,
1830 					ULOCKFS_SETATTR_MASK);
1831 			if (error)
1832 				return (error);
1833 
1834 			error = ufs_fiotune(vp, (struct fiotune *)arg, cr);
1835 
1836 			if (ulp)
1837 				ufs_lockfs_end(ulp);
1838 			return (error);
1839 
1840 		case _FIOLOGENABLE:
1841 			if (secpolicy_fs_config(cr, ufsvfsp->vfs_vfs) != 0)
1842 				return (EPERM);
1843 			return (ufs_fiologenable(vp, (void *)arg, cr, flag));
1844 
1845 		case _FIOLOGDISABLE:
1846 			if (secpolicy_fs_config(cr, ufsvfsp->vfs_vfs) != 0)
1847 				return (EPERM);
1848 			return (ufs_fiologdisable(vp, (void *)arg, cr, flag));
1849 
1850 		case _FIOISLOG:
1851 			return (ufs_fioislog(vp, (void *)arg, cr, flag));
1852 
1853 		case _FIOSNAPSHOTCREATE_MULTI:
1854 		{
1855 			struct fiosnapcreate_multi	fc, *fcp;
1856 			size_t	fcm_size;
1857 
1858 			if (copyin((void *)arg, &fc, sizeof (fc)))
1859 				return (EFAULT);
1860 			if (fc.backfilecount > MAX_BACKFILE_COUNT)
1861 				return (EINVAL);
1862 			fcm_size = sizeof (struct fiosnapcreate_multi) +
1863 			    (fc.backfilecount - 1) * sizeof (int);
1864 			fcp = (struct fiosnapcreate_multi *)
1865 			    kmem_alloc(fcm_size, KM_SLEEP);
1866 			if (copyin((void *)arg, fcp, fcm_size)) {
1867 				kmem_free(fcp, fcm_size);
1868 				return (EFAULT);
1869 			}
1870 			error = ufs_snap_create(vp, fcp, cr);
1871 			if (!error && copyout(fcp, (void *)arg, fcm_size))
1872 				error = EFAULT;
1873 			kmem_free(fcp, fcm_size);
1874 			return (error);
1875 		}
1876 
1877 		case _FIOSNAPSHOTDELETE:
1878 		{
1879 			struct fiosnapdelete	fc;
1880 
1881 			if (copyin((void *)arg, &fc, sizeof (fc)))
1882 				return (EFAULT);
1883 			error = ufs_snap_delete(vp, &fc, cr);
1884 			if (!error && copyout(&fc, (void *)arg, sizeof (fc)))
1885 				error = EFAULT;
1886 			return (error);
1887 		}
1888 
1889 		case _FIOGETSUPERBLOCK:
1890 			if (copyout(fs, (void *)arg, SBSIZE))
1891 				return (EFAULT);
1892 			return (0);
1893 
1894 		case _FIOGETMAXPHYS:
1895 			if (copyout(&maxphys, (void *)arg, sizeof (maxphys)))
1896 				return (EFAULT);
1897 			return (0);
1898 
1899 		/*
1900 		 * The following 3 ioctls are for TSufs support
1901 		 * although could potentially be used elsewhere
1902 		 */
1903 		case _FIO_SET_LUFS_DEBUG:
1904 			if (secpolicy_fs_config(cr, ufsvfsp->vfs_vfs) != 0)
1905 				return (EPERM);
1906 			lufs_debug = (uint32_t)arg;
1907 			return (0);
1908 
1909 		case _FIO_SET_LUFS_ERROR:
1910 			if (secpolicy_fs_config(cr, ufsvfsp->vfs_vfs) != 0)
1911 				return (EPERM);
1912 			TRANS_SETERROR(ufsvfsp);
1913 			return (0);
1914 
1915 		case _FIO_GET_TOP_STATS:
1916 		{
1917 			fio_lufs_stats_t *ls;
1918 			ml_unit_t *ul = ufsvfsp->vfs_log;
1919 
1920 			ls = kmem_zalloc(sizeof (*ls), KM_SLEEP);
1921 			ls->ls_debug = ul->un_debug; /* return debug value */
1922 			/* Copy stucture if statistics are being kept */
1923 			if (ul->un_logmap->mtm_tops) {
1924 				ls->ls_topstats = *(ul->un_logmap->mtm_tops);
1925 			}
1926 			error = 0;
1927 			if (copyout(ls, (void *)arg, sizeof (*ls)))
1928 				error = EFAULT;
1929 			kmem_free(ls, sizeof (*ls));
1930 			return (error);
1931 		}
1932 
1933 		case _FIO_SEEK_DATA:
1934 		case _FIO_SEEK_HOLE:
1935 			if (ddi_copyin((void *)arg, &off, sizeof (off), flag))
1936 				return (EFAULT);
1937 			/* offset paramater is in/out */
1938 			error = ufs_fio_holey(vp, cmd, &off);
1939 			if (error)
1940 				return (error);
1941 			if (ddi_copyout(&off, (void *)arg, sizeof (off), flag))
1942 				return (EFAULT);
1943 			return (0);
1944 
1945 		default:
1946 			return (ENOTTY);
1947 	}
1948 }
1949 
1950 /* ARGSUSED */
1951 static int
1952 ufs_getattr(struct vnode *vp, struct vattr *vap, int flags,
1953 	struct cred *cr)
1954 {
1955 	struct inode *ip = VTOI(vp);
1956 	struct ufsvfs *ufsvfsp;
1957 	int err;
1958 
1959 	TRACE_2(TR_FAC_UFS, TR_UFS_GETATTR_START,
1960 		"ufs_getattr_start:vp %p flags %x", vp, flags);
1961 
1962 	if (vap->va_mask == AT_SIZE) {
1963 		/*
1964 		 * for performance, if only the size is requested don't bother
1965 		 * with anything else.
1966 		 */
1967 		UFS_GET_ISIZE(&vap->va_size, ip);
1968 		TRACE_1(TR_FAC_UFS, TR_UFS_GETATTR_END,
1969 			"ufs_getattr_end:vp %p", vp);
1970 		return (0);
1971 	}
1972 
1973 	/*
1974 	 * inlined lockfs checks
1975 	 */
1976 	ufsvfsp = ip->i_ufsvfs;
1977 	if ((ufsvfsp == NULL) || ULOCKFS_IS_HLOCK(&ufsvfsp->vfs_ulockfs)) {
1978 		err = EIO;
1979 		goto out;
1980 	}
1981 
1982 	rw_enter(&ip->i_contents, RW_READER);
1983 	/*
1984 	 * Return all the attributes.  This should be refined so
1985 	 * that it only returns what's asked for.
1986 	 */
1987 
1988 	/*
1989 	 * Copy from inode table.
1990 	 */
1991 	vap->va_type = vp->v_type;
1992 	vap->va_mode = ip->i_mode & MODEMASK;
1993 	/*
1994 	 * If there is an ACL and there is a mask entry, then do the
1995 	 * extra work that completes the equivalent of an acltomode(3)
1996 	 * call.  According to POSIX P1003.1e, the acl mask should be
1997 	 * returned in the group permissions field.
1998 	 *
1999 	 * - start with the original permission and mode bits (from above)
2000 	 * - clear the group owner bits
2001 	 * - add in the mask bits.
2002 	 */
2003 	if (ip->i_ufs_acl && ip->i_ufs_acl->aclass.acl_ismask) {
2004 		vap->va_mode &= ~((VREAD | VWRITE | VEXEC) >> 3);
2005 		vap->va_mode |=
2006 		    (ip->i_ufs_acl->aclass.acl_maskbits & PERMMASK) << 3;
2007 	}
2008 	vap->va_uid = ip->i_uid;
2009 	vap->va_gid = ip->i_gid;
2010 	vap->va_fsid = ip->i_dev;
2011 	vap->va_nodeid = (ino64_t)ip->i_number;
2012 	vap->va_nlink = ip->i_nlink;
2013 	vap->va_size = ip->i_size;
2014 	if (vp->v_type == VCHR || vp->v_type == VBLK)
2015 		vap->va_rdev = ip->i_rdev;
2016 	else
2017 		vap->va_rdev = 0;	/* not a b/c spec. */
2018 	mutex_enter(&ip->i_tlock);
2019 	ITIMES_NOLOCK(ip);	/* mark correct time in inode */
2020 	vap->va_seq = ip->i_seq;
2021 	vap->va_atime.tv_sec = (time_t)ip->i_atime.tv_sec;
2022 	vap->va_atime.tv_nsec = ip->i_atime.tv_usec*1000;
2023 	vap->va_mtime.tv_sec = (time_t)ip->i_mtime.tv_sec;
2024 	vap->va_mtime.tv_nsec = ip->i_mtime.tv_usec*1000;
2025 	vap->va_ctime.tv_sec = (time_t)ip->i_ctime.tv_sec;
2026 	vap->va_ctime.tv_nsec = ip->i_ctime.tv_usec*1000;
2027 	mutex_exit(&ip->i_tlock);
2028 
2029 	switch (ip->i_mode & IFMT) {
2030 
2031 	case IFBLK:
2032 		vap->va_blksize = MAXBSIZE;		/* was BLKDEV_IOSIZE */
2033 		break;
2034 
2035 	case IFCHR:
2036 		vap->va_blksize = MAXBSIZE;
2037 		break;
2038 
2039 	default:
2040 		vap->va_blksize = ip->i_fs->fs_bsize;
2041 		break;
2042 	}
2043 	vap->va_nblocks = (fsblkcnt64_t)ip->i_blocks;
2044 	rw_exit(&ip->i_contents);
2045 	err = 0;
2046 
2047 out:
2048 	TRACE_1(TR_FAC_UFS, TR_UFS_GETATTR_END, "ufs_getattr_end:vp %p", vp);
2049 
2050 	return (err);
2051 }
2052 
2053 /*ARGSUSED4*/
2054 static int
2055 ufs_setattr(
2056 	struct vnode *vp,
2057 	struct vattr *vap,
2058 	int flags,
2059 	struct cred *cr,
2060 	caller_context_t *ct)
2061 {
2062 	struct inode *ip = VTOI(vp);
2063 	struct ufsvfs *ufsvfsp = ip->i_ufsvfs;
2064 	struct fs *fs;
2065 	struct ulockfs *ulp;
2066 	char *errmsg1;
2067 	char *errmsg2;
2068 	long blocks;
2069 	long int mask = vap->va_mask;
2070 	size_t len1, len2;
2071 	int issync;
2072 	int trans_size;
2073 	int dotrans;
2074 	int dorwlock;
2075 	int error;
2076 	int owner_change;
2077 	int dodqlock;
2078 	timestruc_t now;
2079 	vattr_t oldva;
2080 	int retry = 1;
2081 
2082 	TRACE_2(TR_FAC_UFS, TR_UFS_SETATTR_START,
2083 		"ufs_setattr_start:vp %p flags %x", vp, flags);
2084 
2085 	/*
2086 	 * Cannot set these attributes.
2087 	 */
2088 	if (mask & AT_NOSET) {
2089 		error = EINVAL;
2090 		goto out;
2091 	}
2092 
2093 	/*
2094 	 * check for forced unmount
2095 	 */
2096 	if (ufsvfsp == NULL)
2097 		return (EIO);
2098 
2099 	fs = ufsvfsp->vfs_fs;
2100 	if (fs->fs_ronly != 0)
2101 		return (EROFS);
2102 
2103 again:
2104 	errmsg1 = NULL;
2105 	errmsg2 = NULL;
2106 	dotrans = 0;
2107 	dorwlock = 0;
2108 	dodqlock = 0;
2109 
2110 	error = ufs_lockfs_begin(ufsvfsp, &ulp, ULOCKFS_SETATTR_MASK);
2111 	if (error)
2112 		goto out;
2113 
2114 	/*
2115 	 * Acquire i_rwlock before TRANS_BEGIN_CSYNC() if this is a file.
2116 	 * This follows the protocol for read()/write().
2117 	 */
2118 	if (vp->v_type != VDIR) {
2119 		rw_enter(&ip->i_rwlock, RW_WRITER);
2120 		dorwlock = 1;
2121 	}
2122 
2123 	/*
2124 	 * Truncate file.  Must have write permission and not be a directory.
2125 	 */
2126 	if (mask & AT_SIZE) {
2127 		rw_enter(&ip->i_contents, RW_WRITER);
2128 		if (vp->v_type == VDIR) {
2129 			error = EISDIR;
2130 			goto update_inode;
2131 		}
2132 		if (error = ufs_iaccess(ip, IWRITE, cr))
2133 			goto update_inode;
2134 
2135 		rw_exit(&ip->i_contents);
2136 		error = TRANS_ITRUNC(ip, vap->va_size, 0, cr);
2137 		if (error) {
2138 			rw_enter(&ip->i_contents, RW_WRITER);
2139 			goto update_inode;
2140 		}
2141 	}
2142 
2143 	if (ulp) {
2144 		trans_size = (int)TOP_SETATTR_SIZE(ip);
2145 		TRANS_BEGIN_CSYNC(ufsvfsp, issync, TOP_SETATTR, trans_size);
2146 		++dotrans;
2147 	}
2148 
2149 	/*
2150 	 * Acquire i_rwlock after TRANS_BEGIN_CSYNC() if this is a directory.
2151 	 * This follows the protocol established by
2152 	 * ufs_link/create/remove/rename/mkdir/rmdir/symlink.
2153 	 */
2154 	if (vp->v_type == VDIR) {
2155 		rw_enter(&ip->i_rwlock, RW_WRITER);
2156 		dorwlock = 1;
2157 	}
2158 
2159 	/*
2160 	 * Grab quota lock if we are changing the file's owner.
2161 	 */
2162 	if (mask & AT_UID) {
2163 		rw_enter(&ufsvfsp->vfs_dqrwlock, RW_READER);
2164 		dodqlock = 1;
2165 	}
2166 	rw_enter(&ip->i_contents, RW_WRITER);
2167 
2168 	oldva.va_mode = ip->i_mode;
2169 	oldva.va_uid = ip->i_uid;
2170 	oldva.va_gid = ip->i_gid;
2171 
2172 	vap->va_mask &= ~AT_SIZE;
2173 	/*
2174 	 * ufs_iaccess is "close enough"; that's because it doesn't
2175 	 * map the defines.
2176 	 */
2177 	error = secpolicy_vnode_setattr(cr, vp, vap, &oldva, flags,
2178 				ufs_iaccess, ip);
2179 	if (error)
2180 		goto update_inode;
2181 
2182 	mask = vap->va_mask;
2183 
2184 	/*
2185 	 * Change file access modes.
2186 	 */
2187 	if (mask & AT_MODE) {
2188 		ip->i_mode = (ip->i_mode & IFMT) | (vap->va_mode & ~IFMT);
2189 		TRANS_INODE(ufsvfsp, ip);
2190 		ip->i_flag |= ICHG;
2191 		if (stickyhack) {
2192 			mutex_enter(&vp->v_lock);
2193 			if ((ip->i_mode & (ISVTX | IEXEC | IFDIR)) == ISVTX)
2194 				vp->v_flag |= VSWAPLIKE;
2195 			else
2196 				vp->v_flag &= ~VSWAPLIKE;
2197 			mutex_exit(&vp->v_lock);
2198 		}
2199 	}
2200 	if (mask & (AT_UID|AT_GID)) {
2201 		if (mask & AT_UID) {
2202 			/*
2203 			 * Don't change ownership of the quota inode.
2204 			 */
2205 			if (ufsvfsp->vfs_qinod == ip) {
2206 				ASSERT(ufsvfsp->vfs_qflags & MQ_ENABLED);
2207 				error = EINVAL;
2208 				goto update_inode;
2209 			}
2210 
2211 			/*
2212 			 * No real ownership change.
2213 			 */
2214 			if (ip->i_uid == vap->va_uid) {
2215 				blocks = 0;
2216 				owner_change = 0;
2217 			}
2218 			/*
2219 			 * Remove the blocks and the file, from the old user's
2220 			 * quota.
2221 			 */
2222 			else {
2223 				blocks = ip->i_blocks;
2224 				owner_change = 1;
2225 
2226 				(void) chkdq(ip, -blocks, /* force */ 1, cr,
2227 						(char **)NULL, (size_t *)NULL);
2228 				(void) chkiq(ufsvfsp, /* change */ -1, ip,
2229 						(uid_t)ip->i_uid,
2230 						/* force */ 1, cr,
2231 						(char **)NULL, (size_t *)NULL);
2232 				dqrele(ip->i_dquot);
2233 			}
2234 
2235 			ip->i_uid = vap->va_uid;
2236 
2237 			/*
2238 			 * There is a real ownership change.
2239 			 */
2240 			if (owner_change) {
2241 				/*
2242 				 * Add the blocks and the file to the new
2243 				 * user's quota.
2244 				 */
2245 				ip->i_dquot = getinoquota(ip);
2246 				(void) chkdq(ip, blocks, /* force */ 1, cr,
2247 						&errmsg1, &len1);
2248 				(void) chkiq(ufsvfsp, /* change */ 1,
2249 						(struct inode *)NULL,
2250 						(uid_t)ip->i_uid,
2251 						/* force */ 1, cr,
2252 						&errmsg2, &len2);
2253 			}
2254 		}
2255 		if (mask & AT_GID) {
2256 			ip->i_gid = vap->va_gid;
2257 		}
2258 		TRANS_INODE(ufsvfsp, ip);
2259 		ip->i_flag |= ICHG;
2260 	}
2261 	/*
2262 	 * Change file access or modified times.
2263 	 */
2264 	if (mask & (AT_ATIME|AT_MTIME)) {
2265 		/* Check that the time value is within ufs range */
2266 		if (((mask & AT_ATIME) && TIMESPEC_OVERFLOW(&vap->va_atime)) ||
2267 		    ((mask & AT_MTIME) && TIMESPEC_OVERFLOW(&vap->va_mtime))) {
2268 			error = EOVERFLOW;
2269 			goto update_inode;
2270 		}
2271 
2272 		/*
2273 		 * if the "noaccess" mount option is set and only atime
2274 		 * update is requested, do nothing. No error is returned.
2275 		 */
2276 		if ((ufsvfsp->vfs_noatime) &&
2277 		    ((mask & (AT_ATIME|AT_MTIME)) == AT_ATIME))
2278 			goto skip_atime;
2279 
2280 		if (mask & AT_ATIME) {
2281 			ip->i_atime.tv_sec = vap->va_atime.tv_sec;
2282 			ip->i_atime.tv_usec = vap->va_atime.tv_nsec / 1000;
2283 			ip->i_flag &= ~IACC;
2284 		}
2285 		if (mask & AT_MTIME) {
2286 			ip->i_mtime.tv_sec = vap->va_mtime.tv_sec;
2287 			ip->i_mtime.tv_usec = vap->va_mtime.tv_nsec / 1000;
2288 			gethrestime(&now);
2289 			if (now.tv_sec > TIME32_MAX) {
2290 				/*
2291 				 * In 2038, ctime sticks forever..
2292 				 */
2293 				ip->i_ctime.tv_sec = TIME32_MAX;
2294 				ip->i_ctime.tv_usec = 0;
2295 			} else {
2296 				ip->i_ctime.tv_sec = now.tv_sec;
2297 				ip->i_ctime.tv_usec = now.tv_nsec / 1000;
2298 			}
2299 			ip->i_flag &= ~(IUPD|ICHG);
2300 			ip->i_flag |= IMODTIME;
2301 		}
2302 		TRANS_INODE(ufsvfsp, ip);
2303 		ip->i_flag |= IMOD;
2304 	}
2305 
2306 skip_atime:
2307 	/*
2308 	 * The presence of a shadow inode may indicate an ACL, but does
2309 	 * not imply an ACL.  Future FSD types should be handled here too
2310 	 * and check for the presence of the attribute-specific data
2311 	 * before referencing it.
2312 	 */
2313 	if (ip->i_shadow) {
2314 		/*
2315 		 * XXX if ufs_iupdat is changed to sandbagged write fix
2316 		 * ufs_acl_setattr to push ip to keep acls consistent
2317 		 *
2318 		 * Suppress out of inodes messages if we will retry.
2319 		 */
2320 		if (retry)
2321 			ip->i_flag |= IQUIET;
2322 		error = ufs_acl_setattr(ip, vap, cr);
2323 		ip->i_flag &= ~IQUIET;
2324 	}
2325 
2326 update_inode:
2327 	/*
2328 	 * Setattr always increases the sequence number
2329 	 */
2330 	ip->i_seq++;
2331 
2332 	/*
2333 	 * if nfsd and not logging; push synchronously
2334 	 */
2335 	if ((curthread->t_flag & T_DONTPEND) && !TRANS_ISTRANS(ufsvfsp)) {
2336 		ufs_iupdat(ip, 1);
2337 	} else {
2338 		ITIMES_NOLOCK(ip);
2339 	}
2340 
2341 	rw_exit(&ip->i_contents);
2342 	if (dodqlock) {
2343 		rw_exit(&ufsvfsp->vfs_dqrwlock);
2344 	}
2345 	if (dorwlock)
2346 		rw_exit(&ip->i_rwlock);
2347 
2348 	if (ulp) {
2349 		if (dotrans) {
2350 			int terr = 0;
2351 			TRANS_END_CSYNC(ufsvfsp, terr, issync, TOP_SETATTR,
2352 			    trans_size);
2353 			if (error == 0)
2354 				error = terr;
2355 		}
2356 		ufs_lockfs_end(ulp);
2357 	}
2358 out:
2359 	/*
2360 	 * If out of inodes or blocks, see if we can free something
2361 	 * up from the delete queue.
2362 	 */
2363 	if ((error == ENOSPC) && retry && TRANS_ISTRANS(ufsvfsp)) {
2364 		ufs_delete_drain_wait(ufsvfsp, 1);
2365 		retry = 0;
2366 		if (errmsg1 != NULL)
2367 			kmem_free(errmsg1, len1);
2368 		if (errmsg2 != NULL)
2369 			kmem_free(errmsg2, len2);
2370 		goto again;
2371 	}
2372 	TRACE_2(TR_FAC_UFS, TR_UFS_SETATTR_END,
2373 		"ufs_setattr_end:vp %p error %d", vp, error);
2374 	if (errmsg1 != NULL) {
2375 		uprintf(errmsg1);
2376 		kmem_free(errmsg1, len1);
2377 	}
2378 	if (errmsg2 != NULL) {
2379 		uprintf(errmsg2);
2380 		kmem_free(errmsg2, len2);
2381 	}
2382 	return (error);
2383 }
2384 
2385 /*ARGSUSED*/
2386 static int
2387 ufs_access(struct vnode *vp, int mode, int flags, struct cred *cr)
2388 {
2389 	struct inode *ip = VTOI(vp);
2390 	int error;
2391 
2392 	TRACE_3(TR_FAC_UFS, TR_UFS_ACCESS_START,
2393 		"ufs_access_start:vp %p mode %x flags %x", vp, mode, flags);
2394 
2395 	if (ip->i_ufsvfs == NULL)
2396 		return (EIO);
2397 
2398 	rw_enter(&ip->i_contents, RW_READER);
2399 
2400 	/*
2401 	 * The ufs_iaccess function wants to be called with
2402 	 * mode bits expressed as "ufs specific" bits.
2403 	 * I.e., VWRITE|VREAD|VEXEC do not make sense to
2404 	 * ufs_iaccess() but IWRITE|IREAD|IEXEC do.
2405 	 * But since they're the same we just pass the vnode mode
2406 	 * bit but just verify that assumption at compile time.
2407 	 */
2408 #if IWRITE != VWRITE || IREAD != VREAD || IEXEC != VEXEC
2409 #error "ufs_access needs to map Vmodes to Imodes"
2410 #endif
2411 	error = ufs_iaccess(ip, mode, cr);
2412 
2413 	rw_exit(&ip->i_contents);
2414 
2415 	TRACE_2(TR_FAC_UFS, TR_UFS_ACCESS_END,
2416 		"ufs_access_end:vp %p error %d", vp, error);
2417 	return (error);
2418 }
2419 
2420 /* ARGSUSED */
2421 static int
2422 ufs_readlink(struct vnode *vp, struct uio *uiop, struct cred *cr)
2423 {
2424 	struct inode *ip = VTOI(vp);
2425 	struct ufsvfs *ufsvfsp;
2426 	struct ulockfs *ulp;
2427 	int error;
2428 	int fastsymlink;
2429 
2430 	TRACE_2(TR_FAC_UFS, TR_UFS_READLINK_START,
2431 		"ufs_readlink_start:vp %p uiop %p", uiop, vp);
2432 
2433 	if (vp->v_type != VLNK) {
2434 		error = EINVAL;
2435 		goto nolockout;
2436 	}
2437 
2438 	/*
2439 	 * If the symbolic link is empty there is nothing to read.
2440 	 * Fast-track these empty symbolic links
2441 	 */
2442 	if (ip->i_size == 0) {
2443 		error = 0;
2444 		goto nolockout;
2445 	}
2446 
2447 	ufsvfsp = ip->i_ufsvfs;
2448 	error = ufs_lockfs_begin(ufsvfsp, &ulp, ULOCKFS_READLINK_MASK);
2449 	if (error)
2450 		goto nolockout;
2451 	/*
2452 	 * The ip->i_rwlock protects the data blocks used for FASTSYMLINK
2453 	 */
2454 again:
2455 	fastsymlink = 0;
2456 	if (ip->i_flag & IFASTSYMLNK) {
2457 		rw_enter(&ip->i_rwlock, RW_READER);
2458 		rw_enter(&ip->i_contents, RW_READER);
2459 		if (ip->i_flag & IFASTSYMLNK) {
2460 			if (!ULOCKFS_IS_NOIACC(ITOUL(ip)) &&
2461 			    (ip->i_fs->fs_ronly == 0) &&
2462 			    (!ufsvfsp->vfs_noatime)) {
2463 				mutex_enter(&ip->i_tlock);
2464 				ip->i_flag |= IACC;
2465 				mutex_exit(&ip->i_tlock);
2466 			}
2467 			error = uiomove((caddr_t)&ip->i_db[1],
2468 				MIN(ip->i_size, uiop->uio_resid),
2469 				UIO_READ, uiop);
2470 			ITIMES(ip);
2471 			++fastsymlink;
2472 		}
2473 		rw_exit(&ip->i_contents);
2474 		rw_exit(&ip->i_rwlock);
2475 	}
2476 	if (!fastsymlink) {
2477 		ssize_t size;	/* number of bytes read  */
2478 		caddr_t basep;	/* pointer to input data */
2479 		ino_t ino;
2480 		long  igen;
2481 		struct uio tuio;	/* temp uio struct */
2482 		struct uio *tuiop;
2483 		iovec_t tiov;		/* temp iovec struct */
2484 		char kbuf[FSL_SIZE];	/* buffer to hold fast symlink */
2485 		int tflag = 0;		/* flag to indicate temp vars used */
2486 
2487 		ino = ip->i_number;
2488 		igen = ip->i_gen;
2489 		size = uiop->uio_resid;
2490 		basep = uiop->uio_iov->iov_base;
2491 		tuiop = uiop;
2492 
2493 		rw_enter(&ip->i_rwlock, RW_WRITER);
2494 		rw_enter(&ip->i_contents, RW_WRITER);
2495 		if (ip->i_flag & IFASTSYMLNK) {
2496 			rw_exit(&ip->i_contents);
2497 			rw_exit(&ip->i_rwlock);
2498 			goto again;
2499 		}
2500 
2501 		/* can this be a fast symlink and is it a user buffer? */
2502 		if (ip->i_size <= FSL_SIZE &&
2503 		    (uiop->uio_segflg == UIO_USERSPACE ||
2504 		    uiop->uio_segflg == UIO_USERISPACE)) {
2505 
2506 			bzero(&tuio, sizeof (struct uio));
2507 			/*
2508 			 * setup a kernel buffer to read link into.  this
2509 			 * is to fix a race condition where the user buffer
2510 			 * got corrupted before copying it into the inode.
2511 			 */
2512 			size = ip->i_size;
2513 			tiov.iov_len = size;
2514 			tiov.iov_base = kbuf;
2515 			tuio.uio_iov = &tiov;
2516 			tuio.uio_iovcnt = 1;
2517 			tuio.uio_offset = uiop->uio_offset;
2518 			tuio.uio_segflg = UIO_SYSSPACE;
2519 			tuio.uio_fmode = uiop->uio_fmode;
2520 			tuio.uio_extflg = uiop->uio_extflg;
2521 			tuio.uio_limit = uiop->uio_limit;
2522 			tuio.uio_resid = size;
2523 
2524 			basep = tuio.uio_iov->iov_base;
2525 			tuiop = &tuio;
2526 			tflag = 1;
2527 		}
2528 
2529 		error = rdip(ip, tuiop, 0, cr);
2530 		if (!(error == 0 && ip->i_number == ino && ip->i_gen == igen)) {
2531 			rw_exit(&ip->i_contents);
2532 			rw_exit(&ip->i_rwlock);
2533 			goto out;
2534 		}
2535 
2536 		if (tflag == 0)
2537 			size -= uiop->uio_resid;
2538 
2539 		if ((tflag == 0 && ip->i_size <= FSL_SIZE &&
2540 		    ip->i_size == size) || (tflag == 1 &&
2541 		    tuio.uio_resid == 0)) {
2542 			error = kcopy(basep, &ip->i_db[1], ip->i_size);
2543 			if (error == 0) {
2544 				ip->i_flag |= IFASTSYMLNK;
2545 				/*
2546 				 * free page
2547 				 */
2548 				(void) VOP_PUTPAGE(ITOV(ip),
2549 				    (offset_t)0, PAGESIZE,
2550 				    (B_DONTNEED | B_FREE | B_FORCE | B_ASYNC),
2551 				    cr);
2552 			} else {
2553 				int i;
2554 				/* error, clear garbage left behind */
2555 				for (i = 1; i < NDADDR; i++)
2556 					ip->i_db[i] = 0;
2557 				for (i = 0; i < NIADDR; i++)
2558 					ip->i_ib[i] = 0;
2559 			}
2560 		}
2561 		if (tflag == 1) {
2562 			/* now, copy it into the user buffer */
2563 			error = uiomove((caddr_t)kbuf,
2564 				MIN(size, uiop->uio_resid),
2565 				UIO_READ, uiop);
2566 		}
2567 		rw_exit(&ip->i_contents);
2568 		rw_exit(&ip->i_rwlock);
2569 	}
2570 out:
2571 	if (ulp) {
2572 		ufs_lockfs_end(ulp);
2573 	}
2574 nolockout:
2575 	TRACE_2(TR_FAC_UFS, TR_UFS_READLINK_END,
2576 		"ufs_readlink_end:vp %p error %d", vp, error);
2577 
2578 	return (error);
2579 }
2580 
2581 /* ARGSUSED */
2582 static int
2583 ufs_fsync(struct vnode *vp, int syncflag, struct cred *cr)
2584 {
2585 	struct inode *ip = VTOI(vp);
2586 	struct ufsvfs *ufsvfsp = ip->i_ufsvfs;
2587 	struct ulockfs *ulp;
2588 	int error;
2589 
2590 	TRACE_1(TR_FAC_UFS, TR_UFS_FSYNC_START,
2591 		"ufs_fsync_start:vp %p", vp);
2592 
2593 	error = ufs_lockfs_begin(ufsvfsp, &ulp, ULOCKFS_FSYNC_MASK);
2594 	if (error)
2595 		return (error);
2596 
2597 	if (TRANS_ISTRANS(ufsvfsp)) {
2598 		/*
2599 		 * First push out any data pages
2600 		 */
2601 		if (vn_has_cached_data(vp) && !(syncflag & FNODSYNC) &&
2602 		    (vp->v_type != VCHR) && !(IS_SWAPVP(vp))) {
2603 			error = VOP_PUTPAGE(vp, (offset_t)0, (size_t)0,
2604 			    0, CRED());
2605 			if (error)
2606 				goto out;
2607 		}
2608 
2609 		/*
2610 		 * Delta any delayed inode times updates
2611 		 * and push inode to log.
2612 		 * All other inode deltas will have already been delta'd
2613 		 * and will be pushed during the commit.
2614 		 */
2615 		if (!(syncflag & FDSYNC) &&
2616 		    ((ip->i_flag & (IMOD|IMODACC)) == IMODACC)) {
2617 			if (ulp) {
2618 				TRANS_BEGIN_ASYNC(ufsvfsp, TOP_FSYNC,
2619 				    TOP_SYNCIP_SIZE);
2620 			}
2621 			rw_enter(&ip->i_contents, RW_READER);
2622 			mutex_enter(&ip->i_tlock);
2623 			ip->i_flag &= ~IMODTIME;
2624 			mutex_exit(&ip->i_tlock);
2625 			ufs_iupdat(ip, I_SYNC);
2626 			rw_exit(&ip->i_contents);
2627 			if (ulp) {
2628 				TRANS_END_ASYNC(ufsvfsp, TOP_FSYNC,
2629 				    TOP_SYNCIP_SIZE);
2630 			}
2631 		}
2632 
2633 		/*
2634 		 * Commit the Moby transaction
2635 		 *
2636 		 * Deltas have already been made so we just need to
2637 		 * commit them with a synchronous transaction.
2638 		 * TRANS_BEGIN_SYNC() will return an error
2639 		 * if there are no deltas to commit, for an
2640 		 * empty transaction.
2641 		 */
2642 		if (ulp) {
2643 			TRANS_BEGIN_SYNC(ufsvfsp, TOP_FSYNC, TOP_COMMIT_SIZE,
2644 			    error);
2645 			if (error) {
2646 				error = 0; /* commit wasn't needed */
2647 				goto out;
2648 			}
2649 			TRANS_END_SYNC(ufsvfsp, error, TOP_FSYNC,
2650 			    TOP_COMMIT_SIZE);
2651 		}
2652 	} else {	/* not logging */
2653 		if (!(IS_SWAPVP(vp)))
2654 			if (syncflag & FNODSYNC) {
2655 				/* Just update the inode only */
2656 				TRANS_IUPDAT(ip, 1);
2657 				error = 0;
2658 			} else if (syncflag & FDSYNC)
2659 				/* Do data-synchronous writes */
2660 				error = TRANS_SYNCIP(ip, 0, I_DSYNC, TOP_FSYNC);
2661 			else
2662 				/* Do synchronous writes */
2663 				error = TRANS_SYNCIP(ip, 0, I_SYNC, TOP_FSYNC);
2664 
2665 		rw_enter(&ip->i_contents, RW_WRITER);
2666 		if (!error)
2667 			error = ufs_sync_indir(ip);
2668 		rw_exit(&ip->i_contents);
2669 	}
2670 out:
2671 	if (ulp) {
2672 		ufs_lockfs_end(ulp);
2673 	}
2674 	TRACE_2(TR_FAC_UFS, TR_UFS_FSYNC_END,
2675 		"ufs_fsync_end:vp %p error %d", vp, error);
2676 	return (error);
2677 }
2678 
2679 /*ARGSUSED*/
2680 static void
2681 ufs_inactive(struct vnode *vp, struct cred *cr)
2682 {
2683 	ufs_iinactive(VTOI(vp));
2684 }
2685 
2686 /*
2687  * Unix file system operations having to do with directory manipulation.
2688  */
2689 int ufs_lookup_idle_count = 2;	/* Number of inodes to idle each time */
2690 /* ARGSUSED */
2691 static int
2692 ufs_lookup(struct vnode *dvp, char *nm, struct vnode **vpp,
2693 	struct pathname *pnp, int flags, struct vnode *rdir, struct cred *cr)
2694 {
2695 	struct inode *ip;
2696 	struct inode *sip;
2697 	struct inode *xip;
2698 	struct ufsvfs *ufsvfsp;
2699 	struct ulockfs *ulp;
2700 	struct vnode *vp;
2701 	int error;
2702 
2703 	TRACE_2(TR_FAC_UFS, TR_UFS_LOOKUP_START,
2704 		"ufs_lookup_start:dvp %p name %s", dvp, nm);
2705 
2706 
2707 	/*
2708 	 * Check flags for type of lookup (regular file or attribute file)
2709 	 */
2710 
2711 	ip = VTOI(dvp);
2712 
2713 	if (flags & LOOKUP_XATTR) {
2714 
2715 		/*
2716 		 * We don't allow recursive attributes...
2717 		 * Maybe someday we will.
2718 		 */
2719 		if ((ip->i_cflags & IXATTR)) {
2720 			return (EINVAL);
2721 		}
2722 
2723 		if ((vp = dnlc_lookup(dvp, XATTR_DIR_NAME)) == NULL) {
2724 			error = ufs_xattr_getattrdir(dvp, &sip, flags, cr);
2725 			if (error) {
2726 				*vpp = NULL;
2727 				goto out;
2728 			}
2729 
2730 			vp = ITOV(sip);
2731 			dnlc_update(dvp, XATTR_DIR_NAME, vp);
2732 		}
2733 
2734 		/*
2735 		 * Check accessibility of directory.
2736 		 */
2737 		if (vp == DNLC_NO_VNODE) {
2738 			VN_RELE(vp);
2739 			error = ENOENT;
2740 			goto out;
2741 		}
2742 		if ((error = ufs_iaccess(VTOI(vp), IEXEC, cr)) != 0) {
2743 			VN_RELE(vp);
2744 			goto out;
2745 		}
2746 
2747 		*vpp = vp;
2748 		return (0);
2749 	}
2750 
2751 	/*
2752 	 * Check for a null component, which we should treat as
2753 	 * looking at dvp from within it's parent, so we don't
2754 	 * need a call to ufs_iaccess(), as it has already been
2755 	 * done.
2756 	 */
2757 	if (nm[0] == 0) {
2758 		VN_HOLD(dvp);
2759 		error = 0;
2760 		*vpp = dvp;
2761 		goto out;
2762 	}
2763 
2764 	/*
2765 	 * Check for "." ie itself. this is a quick check and
2766 	 * avoids adding "." into the dnlc (which have been seen
2767 	 * to occupy >10% of the cache).
2768 	 */
2769 	if ((nm[0] == '.') && (nm[1] == 0)) {
2770 		/*
2771 		 * Don't return without checking accessibility
2772 		 * of the directory. We only need the lock if
2773 		 * we are going to return it.
2774 		 */
2775 		if ((error = ufs_iaccess(ip, IEXEC, cr)) == 0) {
2776 			VN_HOLD(dvp);
2777 			*vpp = dvp;
2778 		}
2779 		goto out;
2780 	}
2781 
2782 	/*
2783 	 * Fast path: Check the directory name lookup cache.
2784 	 */
2785 	if (vp = dnlc_lookup(dvp, nm)) {
2786 		/*
2787 		 * Check accessibility of directory.
2788 		 */
2789 		if ((error = ufs_iaccess(ip, IEXEC, cr)) != 0) {
2790 			VN_RELE(vp);
2791 			goto out;
2792 		}
2793 		if (vp == DNLC_NO_VNODE) {
2794 			VN_RELE(vp);
2795 			error = ENOENT;
2796 			goto out;
2797 		}
2798 		xip = VTOI(vp);
2799 		ulp = NULL;
2800 		goto fastpath;
2801 	}
2802 
2803 	/*
2804 	 * Keep the idle queue from getting too long by
2805 	 * idling two inodes before attempting to allocate another.
2806 	 *    This operation must be performed before entering
2807 	 *    lockfs or a transaction.
2808 	 */
2809 	if (ufs_idle_q.uq_ne > ufs_idle_q.uq_hiwat)
2810 		if ((curthread->t_flag & T_DONTBLOCK) == 0) {
2811 			ins.in_lidles.value.ul += ufs_lookup_idle_count;
2812 			ufs_idle_some(ufs_lookup_idle_count);
2813 		}
2814 
2815 	ufsvfsp = ip->i_ufsvfs;
2816 	error = ufs_lockfs_begin(ufsvfsp, &ulp, ULOCKFS_LOOKUP_MASK);
2817 	if (error)
2818 		goto out;
2819 
2820 	error = ufs_dirlook(ip, nm, &xip, cr, 1);
2821 
2822 fastpath:
2823 	if (error == 0) {
2824 		ip = xip;
2825 		*vpp = ITOV(ip);
2826 
2827 		/*
2828 		 * If vnode is a device return special vnode instead.
2829 		 */
2830 		if (IS_DEVVP(*vpp)) {
2831 			struct vnode *newvp;
2832 
2833 			newvp = specvp(*vpp, (*vpp)->v_rdev, (*vpp)->v_type,
2834 			    cr);
2835 			VN_RELE(*vpp);
2836 			if (newvp == NULL)
2837 				error = ENOSYS;
2838 			else
2839 				*vpp = newvp;
2840 		}
2841 	}
2842 	if (ulp) {
2843 		ufs_lockfs_end(ulp);
2844 	}
2845 
2846 out:
2847 	TRACE_3(TR_FAC_UFS, TR_UFS_LOOKUP_END,
2848 		"ufs_lookup_end:dvp %p name %s error %d", vpp, nm, error);
2849 	return (error);
2850 }
2851 
2852 static int
2853 ufs_create(struct vnode *dvp, char *name, struct vattr *vap, enum vcexcl excl,
2854 	int mode, struct vnode **vpp, struct cred *cr, int flag)
2855 {
2856 	struct inode *ip;
2857 	struct inode *xip;
2858 	struct inode *dip;
2859 	struct vnode *xvp;
2860 	struct ufsvfs *ufsvfsp;
2861 	struct ulockfs *ulp;
2862 	int error;
2863 	int issync;
2864 	int truncflag;
2865 	int trans_size;
2866 	int noentry;
2867 	int defer_dip_seq_update = 0;	/* need to defer update of dip->i_seq */
2868 	int retry = 1;
2869 
2870 	TRACE_1(TR_FAC_UFS, TR_UFS_CREATE_START,
2871 		"ufs_create_start:dvp %p", dvp);
2872 
2873 again:
2874 	ip = VTOI(dvp);
2875 	ufsvfsp = ip->i_ufsvfs;
2876 	truncflag = 0;
2877 
2878 	error = ufs_lockfs_begin(ufsvfsp, &ulp, ULOCKFS_CREATE_MASK);
2879 	if (error)
2880 		goto out;
2881 
2882 	if (ulp) {
2883 		trans_size = (int)TOP_CREATE_SIZE(ip);
2884 		TRANS_BEGIN_CSYNC(ufsvfsp, issync, TOP_CREATE, trans_size);
2885 	}
2886 
2887 	if ((vap->va_mode & VSVTX) && secpolicy_vnode_stky_modify(cr) != 0)
2888 		vap->va_mode &= ~VSVTX;
2889 
2890 	if (*name == '\0') {
2891 		/*
2892 		 * Null component name refers to the directory itself.
2893 		 */
2894 		VN_HOLD(dvp);
2895 		/*
2896 		 * Even though this is an error case, we need to grab the
2897 		 * quota lock since the error handling code below is common.
2898 		 */
2899 		rw_enter(&ufsvfsp->vfs_dqrwlock, RW_READER);
2900 		rw_enter(&ip->i_contents, RW_WRITER);
2901 		error = EEXIST;
2902 	} else {
2903 		xip = NULL;
2904 		noentry = 0;
2905 		rw_enter(&ip->i_rwlock, RW_WRITER);
2906 		xvp = dnlc_lookup(dvp, name);
2907 		if (xvp == DNLC_NO_VNODE) {
2908 			noentry = 1;
2909 			VN_RELE(xvp);
2910 			xvp = NULL;
2911 		}
2912 		if (xvp) {
2913 			rw_exit(&ip->i_rwlock);
2914 			if (error = ufs_iaccess(ip, IEXEC, cr)) {
2915 				VN_RELE(xvp);
2916 			} else {
2917 				error = EEXIST;
2918 				xip = VTOI(xvp);
2919 			}
2920 		} else {
2921 			/*
2922 			 * Suppress file system full message if we will retry
2923 			 */
2924 			error = ufs_direnter_cm(ip, name, DE_CREATE,
2925 				vap, &xip, cr,
2926 				(noentry | (retry ? IQUIET : 0)));
2927 			rw_exit(&ip->i_rwlock);
2928 		}
2929 		ip = xip;
2930 		if (ip != NULL) {
2931 			rw_enter(&ufsvfsp->vfs_dqrwlock, RW_READER);
2932 			rw_enter(&ip->i_contents, RW_WRITER);
2933 		}
2934 	}
2935 
2936 	/*
2937 	 * If the file already exists and this is a non-exclusive create,
2938 	 * check permissions and allow access for non-directories.
2939 	 * Read-only create of an existing directory is also allowed.
2940 	 * We fail an exclusive create of anything which already exists.
2941 	 */
2942 	if (error == EEXIST) {
2943 		dip = VTOI(dvp);
2944 		if (excl == NONEXCL) {
2945 			if ((((ip->i_mode & IFMT) == IFDIR) ||
2946 			    ((ip->i_mode & IFMT) == IFATTRDIR)) &&
2947 			    (mode & IWRITE))
2948 				error = EISDIR;
2949 			else if (mode)
2950 				error = ufs_iaccess(ip, mode, cr);
2951 			else
2952 				error = 0;
2953 		}
2954 		if (error) {
2955 			rw_exit(&ip->i_contents);
2956 			rw_exit(&ufsvfsp->vfs_dqrwlock);
2957 			VN_RELE(ITOV(ip));
2958 			goto unlock;
2959 		}
2960 		/*
2961 		 * If the error EEXIST was set, then i_seq can not
2962 		 * have been updated. The sequence number interface
2963 		 * is defined such that a non-error VOP_CREATE must
2964 		 * increase the dir va_seq it by at least one. If we
2965 		 * have cleared the error, increase i_seq. Note that
2966 		 * we are increasing the dir i_seq and in rare cases
2967 		 * ip may actually be from the dvp, so we already have
2968 		 * the locks and it will not be subject to truncation.
2969 		 * In case we have to update i_seq of the parent
2970 		 * directory dip, we have to defer it till we have
2971 		 * released our locks on ip due to lock ordering requirements.
2972 		 */
2973 		if (ip != dip)
2974 			defer_dip_seq_update = 1;
2975 		else
2976 			ip->i_seq++;
2977 
2978 		if (((ip->i_mode & IFMT) == IFREG) &&
2979 		    (vap->va_mask & AT_SIZE) && vap->va_size == 0) {
2980 			/*
2981 			 * Truncate regular files, if requested by caller.
2982 			 * Grab i_rwlock to make sure no one else is
2983 			 * currently writing to the file (we promised
2984 			 * bmap we would do this).
2985 			 * Must get the locks in the correct order.
2986 			 */
2987 			if (ip->i_size == 0) {
2988 				ip->i_flag |= ICHG | IUPD;
2989 				ip->i_seq++;
2990 				TRANS_INODE(ufsvfsp, ip);
2991 			} else {
2992 				/*
2993 				 * Large Files: Why this check here?
2994 				 * Though we do it in vn_create() we really
2995 				 * want to guarantee that we do not destroy
2996 				 * Large file data by atomically checking
2997 				 * the size while holding the contents
2998 				 * lock.
2999 				 */
3000 				if (flag && !(flag & FOFFMAX) &&
3001 				    ((ip->i_mode & IFMT) == IFREG) &&
3002 				    (ip->i_size > (offset_t)MAXOFF32_T)) {
3003 					rw_exit(&ip->i_contents);
3004 					rw_exit(&ufsvfsp->vfs_dqrwlock);
3005 					error = EOVERFLOW;
3006 					goto unlock;
3007 				}
3008 				if (TRANS_ISTRANS(ufsvfsp))
3009 					truncflag++;
3010 				else {
3011 					rw_exit(&ip->i_contents);
3012 					rw_exit(&ufsvfsp->vfs_dqrwlock);
3013 					rw_enter(&ip->i_rwlock, RW_WRITER);
3014 					rw_enter(&ufsvfsp->vfs_dqrwlock,
3015 							RW_READER);
3016 					rw_enter(&ip->i_contents, RW_WRITER);
3017 					(void) ufs_itrunc(ip, (u_offset_t)0, 0,
3018 								cr);
3019 					rw_exit(&ip->i_rwlock);
3020 				}
3021 			}
3022 		}
3023 	}
3024 
3025 	if (error) {
3026 		if (ip != NULL) {
3027 			rw_exit(&ufsvfsp->vfs_dqrwlock);
3028 			rw_exit(&ip->i_contents);
3029 		}
3030 		goto unlock;
3031 	}
3032 
3033 	*vpp = ITOV(ip);
3034 	ITIMES(ip);
3035 	rw_exit(&ip->i_contents);
3036 	rw_exit(&ufsvfsp->vfs_dqrwlock);
3037 
3038 	/*
3039 	 * If vnode is a device return special vnode instead.
3040 	 */
3041 	if (!error && IS_DEVVP(*vpp)) {
3042 		struct vnode *newvp;
3043 
3044 		newvp = specvp(*vpp, (*vpp)->v_rdev, (*vpp)->v_type, cr);
3045 		VN_RELE(*vpp);
3046 		if (newvp == NULL) {
3047 			error = ENOSYS;
3048 			goto unlock;
3049 		}
3050 		truncflag = 0;
3051 		*vpp = newvp;
3052 	}
3053 unlock:
3054 
3055 	/*
3056 	 * Do the deferred update of the parent directory's sequence
3057 	 * number now.
3058 	 */
3059 	if (defer_dip_seq_update == 1) {
3060 		rw_enter(&dip->i_contents, RW_READER);
3061 		mutex_enter(&dip->i_tlock);
3062 		dip->i_seq++;
3063 		mutex_exit(&dip->i_tlock);
3064 		rw_exit(&dip->i_contents);
3065 	}
3066 
3067 	if (ulp) {
3068 		int terr = 0;
3069 
3070 		TRANS_END_CSYNC(ufsvfsp, terr, issync, TOP_CREATE,
3071 		    trans_size);
3072 
3073 		/*
3074 		 * If we haven't had a more interesting failure
3075 		 * already, then anything that might've happened
3076 		 * here should be reported.
3077 		 */
3078 		if (error == 0)
3079 			error = terr;
3080 	}
3081 
3082 	if (!error && truncflag) {
3083 		rw_enter(&ip->i_rwlock, RW_WRITER);
3084 		(void) TRANS_ITRUNC(ip, (u_offset_t)0, 0, cr);
3085 		rw_exit(&ip->i_rwlock);
3086 	}
3087 
3088 	if (ulp)
3089 		ufs_lockfs_end(ulp);
3090 
3091 	/*
3092 	 * If no inodes available, try to free one up out of the
3093 	 * pending delete queue.
3094 	 */
3095 	if ((error == ENOSPC) && retry && TRANS_ISTRANS(ufsvfsp)) {
3096 		ufs_delete_drain_wait(ufsvfsp, 1);
3097 		retry = 0;
3098 		goto again;
3099 	}
3100 
3101 out:
3102 	TRACE_3(TR_FAC_UFS, TR_UFS_CREATE_END,
3103 		"ufs_create_end:dvp %p name %s error %d", vpp, name, error);
3104 	return (error);
3105 }
3106 
3107 extern int ufs_idle_max;
3108 /*ARGSUSED*/
3109 static int
3110 ufs_remove(struct vnode *vp, char *nm, struct cred *cr)
3111 {
3112 	struct inode *ip = VTOI(vp);
3113 	struct ufsvfs *ufsvfsp	= ip->i_ufsvfs;
3114 	struct ulockfs *ulp;
3115 	vnode_t *rmvp = NULL;	/* Vnode corresponding to name being removed */
3116 	int error;
3117 	int issync;
3118 	int trans_size;
3119 
3120 	TRACE_1(TR_FAC_UFS, TR_UFS_REMOVE_START,
3121 		"ufs_remove_start:vp %p", vp);
3122 
3123 	/*
3124 	 * don't let the delete queue get too long
3125 	 */
3126 	if (ufsvfsp == NULL) {
3127 		error = EIO;
3128 		goto out;
3129 	}
3130 	if (ufsvfsp->vfs_delete.uq_ne > ufs_idle_max)
3131 		ufs_delete_drain(vp->v_vfsp, 1, 1);
3132 
3133 	error = ufs_lockfs_begin(ufsvfsp, &ulp, ULOCKFS_REMOVE_MASK);
3134 	if (error)
3135 		goto out;
3136 
3137 	if (ulp)
3138 		TRANS_BEGIN_CSYNC(ufsvfsp, issync, TOP_REMOVE,
3139 		    trans_size = (int)TOP_REMOVE_SIZE(VTOI(vp)));
3140 
3141 	rw_enter(&ip->i_rwlock, RW_WRITER);
3142 	error = ufs_dirremove(ip, nm, (struct inode *)0, (struct vnode *)0,
3143 	    DR_REMOVE, cr, &rmvp);
3144 	rw_exit(&ip->i_rwlock);
3145 
3146 	if (ulp) {
3147 		TRANS_END_CSYNC(ufsvfsp, error, issync, TOP_REMOVE, trans_size);
3148 		ufs_lockfs_end(ulp);
3149 	}
3150 
3151 	/*
3152 	 * This must be called after the remove transaction is closed.
3153 	 */
3154 	if (rmvp != NULL) {
3155 		/* Only send the event if there were no errors */
3156 		if (error == 0)
3157 			vnevent_remove(rmvp);
3158 		VN_RELE(rmvp);
3159 	}
3160 out:
3161 	TRACE_3(TR_FAC_UFS, TR_UFS_REMOVE_END,
3162 		"ufs_remove_end:vp %p name %s error %d", vp, nm, error);
3163 	return (error);
3164 }
3165 
3166 /*
3167  * Link a file or a directory.  Only privileged processes are allowed to
3168  * make links to directories.
3169  */
3170 static int
3171 ufs_link(struct vnode *tdvp, struct vnode *svp, char *tnm, struct cred *cr)
3172 {
3173 	struct inode *sip;
3174 	struct inode *tdp = VTOI(tdvp);
3175 	struct ufsvfs *ufsvfsp = tdp->i_ufsvfs;
3176 	struct ulockfs *ulp;
3177 	struct vnode *realvp;
3178 	int error;
3179 	int issync;
3180 	int trans_size;
3181 	int isdev;
3182 
3183 	TRACE_1(TR_FAC_UFS, TR_UFS_LINK_START,
3184 		"ufs_link_start:tdvp %p", tdvp);
3185 
3186 	error = ufs_lockfs_begin(ufsvfsp, &ulp, ULOCKFS_LINK_MASK);
3187 	if (error)
3188 		goto out;
3189 
3190 	if (ulp)
3191 		TRANS_BEGIN_CSYNC(ufsvfsp, issync, TOP_LINK,
3192 		    trans_size = (int)TOP_LINK_SIZE(VTOI(tdvp)));
3193 
3194 	if (VOP_REALVP(svp, &realvp) == 0)
3195 		svp = realvp;
3196 
3197 	/*
3198 	 * Make sure link for extended attributes is valid
3199 	 * We only support hard linking of attr in ATTRDIR to ATTRDIR
3200 	 *
3201 	 * Make certain we don't attempt to look at a device node as
3202 	 * a ufs inode.
3203 	 */
3204 
3205 	isdev = IS_DEVVP(svp);
3206 	if (((isdev == 0) && ((VTOI(svp)->i_cflags & IXATTR) == 0) &&
3207 	    ((tdp->i_mode & IFMT) == IFATTRDIR)) ||
3208 	    ((isdev == 0) && (VTOI(svp)->i_cflags & IXATTR) &&
3209 	    ((tdp->i_mode & IFMT) == IFDIR))) {
3210 		error = EINVAL;
3211 		goto unlock;
3212 	}
3213 
3214 	sip = VTOI(svp);
3215 	if ((svp->v_type == VDIR &&
3216 	    secpolicy_fs_linkdir(cr, ufsvfsp->vfs_vfs) != 0) ||
3217 	    (sip->i_uid != crgetuid(cr) && secpolicy_basic_link(cr) != 0)) {
3218 		error = EPERM;
3219 		goto unlock;
3220 	}
3221 	rw_enter(&tdp->i_rwlock, RW_WRITER);
3222 	error = ufs_direnter_lr(tdp, tnm, DE_LINK, (struct inode *)0,
3223 	    sip, cr, NULL);
3224 	rw_exit(&tdp->i_rwlock);
3225 
3226 unlock:
3227 	if (ulp) {
3228 		TRANS_END_CSYNC(ufsvfsp, error, issync, TOP_LINK, trans_size);
3229 		ufs_lockfs_end(ulp);
3230 	}
3231 out:
3232 	TRACE_2(TR_FAC_UFS, TR_UFS_LINK_END,
3233 		"ufs_link_end:tdvp %p error %d", tdvp, error);
3234 	return (error);
3235 }
3236 
3237 uint64_t ufs_rename_retry_cnt;
3238 uint64_t ufs_rename_upgrade_retry_cnt;
3239 uint64_t ufs_rename_dircheck_retry_cnt;
3240 clock_t	 ufs_rename_backoff_delay = 1;
3241 
3242 /*
3243  * Rename a file or directory.
3244  * We are given the vnode and entry string of the source and the
3245  * vnode and entry string of the place we want to move the source
3246  * to (the target). The essential operation is:
3247  *	unlink(target);
3248  *	link(source, target);
3249  *	unlink(source);
3250  * but "atomically".  Can't do full commit without saving state in
3251  * the inode on disk, which isn't feasible at this time.  Best we
3252  * can do is always guarantee that the TARGET exists.
3253  */
3254 
3255 /*ARGSUSED*/
3256 static int
3257 ufs_rename(
3258 	struct vnode *sdvp,		/* old (source) parent vnode */
3259 	char *snm,			/* old (source) entry name */
3260 	struct vnode *tdvp,		/* new (target) parent vnode */
3261 	char *tnm,			/* new (target) entry name */
3262 	struct cred *cr)
3263 {
3264 	struct inode *sip = NULL;	/* source inode */
3265 	struct inode *ip = NULL;	/* check inode */
3266 	struct inode *sdp;		/* old (source) parent inode */
3267 	struct inode *tdp;		/* new (target) parent inode */
3268 	struct vnode *tvp = NULL;	/* target vnode, if it exists */
3269 	struct vnode *realvp;
3270 	struct ufsvfs *ufsvfsp;
3271 	struct ulockfs *ulp;
3272 	struct ufs_slot slot;
3273 	timestruc_t now;
3274 	int error;
3275 	int issync;
3276 	int trans_size;
3277 
3278 	TRACE_1(TR_FAC_UFS, TR_UFS_RENAME_START,
3279 		"ufs_rename_start:sdvp %p", sdvp);
3280 
3281 
3282 	sdp = VTOI(sdvp);
3283 	slot.fbp = NULL;
3284 	ufsvfsp = sdp->i_ufsvfs;
3285 	error = ufs_lockfs_begin(ufsvfsp, &ulp, ULOCKFS_RENAME_MASK);
3286 	if (error)
3287 		goto out;
3288 
3289 	if (ulp)
3290 		TRANS_BEGIN_CSYNC(ufsvfsp, issync, TOP_RENAME,
3291 		    trans_size = (int)TOP_RENAME_SIZE(sdp));
3292 
3293 	if (VOP_REALVP(tdvp, &realvp) == 0)
3294 		tdvp = realvp;
3295 
3296 	tdp = VTOI(tdvp);
3297 
3298 
3299 	/*
3300 	 * We only allow renaming of attributes from ATTRDIR to ATTRDIR.
3301 	 */
3302 	if ((tdp->i_mode & IFMT) != (sdp->i_mode & IFMT)) {
3303 		error = EINVAL;
3304 		goto unlock;
3305 	}
3306 
3307 	/*
3308 	 * Look up inode of file we're supposed to rename.
3309 	 */
3310 	gethrestime(&now);
3311 	if (error = ufs_dirlook(sdp, snm, &sip, cr, 0)) {
3312 		goto unlock;
3313 	}
3314 
3315 	/*
3316 	 * Lock both the source and target directories (they may be
3317 	 * the same) to provide the atomicity semantics that was
3318 	 * previously provided by the per file system vfs_rename_lock
3319 	 *
3320 	 * with vfs_rename_lock removed to allow simultaneous renames
3321 	 * within a file system, ufs_dircheckpath can deadlock while
3322 	 * traversing back to ensure that source is not a parent directory
3323 	 * of target parent directory. This is because we get into
3324 	 * ufs_dircheckpath with the sdp and tdp locks held as RW_WRITER.
3325 	 * If the tdp and sdp of the simultaneous renames happen to be
3326 	 * in the path of each other, it can lead to a deadlock. This
3327 	 * can be avoided by getting the locks as RW_READER here and then
3328 	 * upgrading to RW_WRITER after completing the ufs_dircheckpath.
3329 	 */
3330 retry:
3331 	rw_enter(&tdp->i_rwlock, RW_READER);
3332 	if (tdp != sdp) {
3333 		/*
3334 		 * We're locking 2 peer level locks, so must use tryenter
3335 		 * on the 2nd to avoid deadlocks that would occur
3336 		 * if we renamed a->b and b->a concurrently.
3337 		 */
3338 		if (!rw_tryenter(&sdp->i_rwlock, RW_READER)) {
3339 			/*
3340 			 * Reverse the lock grabs in case we have heavy
3341 			 * contention on the 2nd lock.
3342 			 */
3343 			rw_exit(&tdp->i_rwlock);
3344 			rw_enter(&sdp->i_rwlock, RW_READER);
3345 			if (!rw_tryenter(&tdp->i_rwlock, RW_READER)) {
3346 				ufs_rename_retry_cnt++;
3347 				rw_exit(&sdp->i_rwlock);
3348 				goto retry;
3349 			}
3350 		}
3351 	}
3352 
3353 	if (sip == tdp) {
3354 		error = EINVAL;
3355 		goto errout;
3356 	}
3357 	/*
3358 	 * Make sure we can delete the source entry.  This requires
3359 	 * write permission on the containing directory.
3360 	 * Check for sticky directories.
3361 	 */
3362 	rw_enter(&sdp->i_contents, RW_READER);
3363 	rw_enter(&sip->i_contents, RW_READER);
3364 	if ((error = ufs_iaccess(sdp, IWRITE, cr)) != 0 ||
3365 	    (error = ufs_sticky_remove_access(sdp, sip, cr)) != 0) {
3366 		rw_exit(&sip->i_contents);
3367 		rw_exit(&sdp->i_contents);
3368 		goto errout;
3369 	}
3370 
3371 	/*
3372 	 * If this is a rename of a directory and the parent is
3373 	 * different (".." must be changed), then the source
3374 	 * directory must not be in the directory hierarchy
3375 	 * above the target, as this would orphan everything
3376 	 * below the source directory.  Also the user must have
3377 	 * write permission in the source so as to be able to
3378 	 * change "..".
3379 	 */
3380 	if ((((sip->i_mode & IFMT) == IFDIR) ||
3381 	    ((sip->i_mode & IFMT) == IFATTRDIR)) && sdp != tdp) {
3382 		ino_t	inum;
3383 
3384 		if ((error = ufs_iaccess(sip, IWRITE, cr))) {
3385 			rw_exit(&sip->i_contents);
3386 			rw_exit(&sdp->i_contents);
3387 			goto errout;
3388 		}
3389 		inum = sip->i_number;
3390 		rw_exit(&sip->i_contents);
3391 		rw_exit(&sdp->i_contents);
3392 		if ((error = ufs_dircheckpath(inum, tdp, sdp, cr))) {
3393 			/*
3394 			 * If we got EAGAIN ufs_dircheckpath detected a
3395 			 * potential deadlock and backed out. We need
3396 			 * to retry the operation since sdp and tdp have
3397 			 * to be released to avoid the deadlock.
3398 			 */
3399 			if (error == EAGAIN) {
3400 				rw_exit(&tdp->i_rwlock);
3401 				if (tdp != sdp)
3402 					rw_exit(&sdp->i_rwlock);
3403 				delay(ufs_rename_backoff_delay);
3404 				ufs_rename_dircheck_retry_cnt++;
3405 				goto retry;
3406 			}
3407 			goto errout;
3408 		}
3409 	} else {
3410 		rw_exit(&sip->i_contents);
3411 		rw_exit(&sdp->i_contents);
3412 	}
3413 
3414 
3415 	/*
3416 	 * Check for renaming '.' or '..' or alias of '.'
3417 	 */
3418 	if (strcmp(snm, ".") == 0 || strcmp(snm, "..") == 0 || sdp == sip) {
3419 		error = EINVAL;
3420 		goto errout;
3421 	}
3422 
3423 	/*
3424 	 * Simultaneous renames can deadlock in ufs_dircheckpath since it
3425 	 * tries to traverse back the file tree with both tdp and sdp held
3426 	 * as RW_WRITER. To avoid that we have to hold the tdp and sdp locks
3427 	 * as RW_READERS  till ufs_dircheckpath is done.
3428 	 * Now that ufs_dircheckpath is done with, we can upgrade the locks
3429 	 * to RW_WRITER.
3430 	 */
3431 	if (!rw_tryupgrade(&tdp->i_rwlock)) {
3432 		/*
3433 		 * The upgrade failed. We got to give away the lock
3434 		 * as to avoid deadlocking with someone else who is
3435 		 * waiting for writer lock. With the lock gone, we
3436 		 * cannot be sure the checks done above will hold
3437 		 * good when we eventually get them back as writer.
3438 		 * So if we can't upgrade we drop the locks and retry
3439 		 * everything again.
3440 		 */
3441 		rw_exit(&tdp->i_rwlock);
3442 		if (tdp != sdp)
3443 			rw_exit(&sdp->i_rwlock);
3444 		delay(ufs_rename_backoff_delay);
3445 		ufs_rename_upgrade_retry_cnt++;
3446 		goto retry;
3447 	}
3448 	if (tdp != sdp) {
3449 		if (!rw_tryupgrade(&sdp->i_rwlock)) {
3450 			/*
3451 			 * The upgrade failed. We got to give away the lock
3452 			 * as to avoid deadlocking with someone else who is
3453 			 * waiting for writer lock. With the lock gone, we
3454 			 * cannot be sure the checks done above will hold
3455 			 * good when we eventually get them back as writer.
3456 			 * So if we can't upgrade we drop the locks and retry
3457 			 * everything again.
3458 			 */
3459 			rw_exit(&tdp->i_rwlock);
3460 			rw_exit(&sdp->i_rwlock);
3461 			delay(ufs_rename_backoff_delay);
3462 			ufs_rename_upgrade_retry_cnt++;
3463 			goto retry;
3464 		}
3465 	}
3466 
3467 	/*
3468 	 * Now that all the locks are held check to make sure another thread
3469 	 * didn't slip in and take out the sip.
3470 	 */
3471 	slot.status = NONE;
3472 	if ((sip->i_ctime.tv_usec * 1000) > now.tv_nsec ||
3473 	    sip->i_ctime.tv_sec > now.tv_sec) {
3474 		rw_enter(&sdp->i_ufsvfs->vfs_dqrwlock, RW_READER);
3475 		rw_enter(&sdp->i_contents, RW_WRITER);
3476 		error = ufs_dircheckforname(sdp, snm, strlen(snm), &slot,
3477 		    &ip, cr, 0);
3478 		rw_exit(&sdp->i_contents);
3479 		rw_exit(&sdp->i_ufsvfs->vfs_dqrwlock);
3480 		if (error) {
3481 			goto errout;
3482 		}
3483 		if (ip == NULL) {
3484 			error = ENOENT;
3485 			goto errout;
3486 		} else {
3487 			/*
3488 			 * If the inode was found need to drop the v_count
3489 			 * so as not to keep the filesystem from being
3490 			 * unmounted at a later time.
3491 			 */
3492 			VN_RELE(ITOV(ip));
3493 		}
3494 
3495 		/*
3496 		 * Release the slot.fbp that has the page mapped and
3497 		 * locked SE_SHARED, and could be used in in
3498 		 * ufs_direnter_lr() which needs to get the SE_EXCL lock
3499 		 * on said page.
3500 		 */
3501 		if (slot.fbp) {
3502 			fbrelse(slot.fbp, S_OTHER);
3503 			slot.fbp = NULL;
3504 		}
3505 	}
3506 
3507 	/*
3508 	 * Link source to the target.  If a target exists, return its
3509 	 * vnode pointer in tvp.  We'll release it after sending the
3510 	 * vnevent.
3511 	 */
3512 	if (error = ufs_direnter_lr(tdp, tnm, DE_RENAME, sdp, sip, cr, &tvp)) {
3513 		/*
3514 		 * ESAME isn't really an error; it indicates that the
3515 		 * operation should not be done because the source and target
3516 		 * are the same file, but that no error should be reported.
3517 		 */
3518 		if (error == ESAME)
3519 			error = 0;
3520 		goto errout;
3521 	}
3522 
3523 	/*
3524 	 * Unlink the source.
3525 	 * Remove the source entry.  ufs_dirremove() checks that the entry
3526 	 * still reflects sip, and returns an error if it doesn't.
3527 	 * If the entry has changed just forget about it.  Release
3528 	 * the source inode.
3529 	 */
3530 	if ((error = ufs_dirremove(sdp, snm, sip, (struct vnode *)0,
3531 	    DR_RENAME, cr, NULL)) == ENOENT)
3532 		error = 0;
3533 
3534 errout:
3535 	if (slot.fbp)
3536 		fbrelse(slot.fbp, S_OTHER);
3537 
3538 	rw_exit(&tdp->i_rwlock);
3539 	if (sdp != tdp) {
3540 		rw_exit(&sdp->i_rwlock);
3541 	}
3542 
3543 unlock:
3544 	if (ulp) {
3545 		TRANS_END_CSYNC(ufsvfsp, error, issync, TOP_RENAME, trans_size);
3546 		ufs_lockfs_end(ulp);
3547 	}
3548 
3549 	/*
3550 	 * If no errors, send the appropriate events on the source
3551 	 * and destination (a.k.a, target) vnodes, if they exist.
3552 	 * This has to be done after the rename transaction has closed.
3553 	 */
3554 	if (error == 0) {
3555 		if (tvp != NULL)
3556 			vnevent_rename_dest(tvp);
3557 		/*
3558 		 * Note that if ufs_direnter_lr() returned ESAME then
3559 		 * this event will still be sent.  This isn't expected
3560 		 * to be a problem for anticipated usage by consumers.
3561 		 */
3562 		if (sip != NULL)
3563 			vnevent_rename_src(ITOV(sip));
3564 	}
3565 
3566 	if (tvp != NULL)
3567 		VN_RELE(tvp);
3568 
3569 	if (sip != NULL)
3570 		VN_RELE(ITOV(sip));
3571 
3572 out:
3573 	TRACE_5(TR_FAC_UFS, TR_UFS_RENAME_END,
3574 		"ufs_rename_end:sdvp %p snm %s tdvp %p tnm %s error %d",
3575 			sdvp, snm, tdvp, tnm, error);
3576 	return (error);
3577 }
3578 
3579 /*ARGSUSED*/
3580 static int
3581 ufs_mkdir(struct vnode *dvp, char *dirname, struct vattr *vap,
3582 	struct vnode **vpp, struct cred *cr)
3583 {
3584 	struct inode *ip;
3585 	struct inode *xip;
3586 	struct ufsvfs *ufsvfsp;
3587 	struct ulockfs *ulp;
3588 	int error;
3589 	int issync;
3590 	int trans_size;
3591 	int retry = 1;
3592 
3593 	ASSERT((vap->va_mask & (AT_TYPE|AT_MODE)) == (AT_TYPE|AT_MODE));
3594 
3595 	TRACE_1(TR_FAC_UFS, TR_UFS_MKDIR_START,
3596 		"ufs_mkdir_start:dvp %p", dvp);
3597 
3598 	/*
3599 	 * Can't make directory in attr hidden dir
3600 	 */
3601 	if ((VTOI(dvp)->i_mode & IFMT) == IFATTRDIR)
3602 		return (EINVAL);
3603 
3604 again:
3605 	ip = VTOI(dvp);
3606 	ufsvfsp = ip->i_ufsvfs;
3607 	error = ufs_lockfs_begin(ufsvfsp, &ulp, ULOCKFS_MKDIR_MASK);
3608 	if (error)
3609 		goto out;
3610 	if (ulp)
3611 		TRANS_BEGIN_CSYNC(ufsvfsp, issync, TOP_MKDIR,
3612 		    trans_size = (int)TOP_MKDIR_SIZE(ip));
3613 
3614 	rw_enter(&ip->i_rwlock, RW_WRITER);
3615 
3616 	error = ufs_direnter_cm(ip, dirname, DE_MKDIR, vap, &xip, cr,
3617 		(retry ? IQUIET : 0));
3618 
3619 	rw_exit(&ip->i_rwlock);
3620 	if (error == 0) {
3621 		ip = xip;
3622 		*vpp = ITOV(ip);
3623 	} else if (error == EEXIST)
3624 		VN_RELE(ITOV(xip));
3625 
3626 	if (ulp) {
3627 		int terr = 0;
3628 		TRANS_END_CSYNC(ufsvfsp, terr, issync, TOP_MKDIR, trans_size);
3629 		ufs_lockfs_end(ulp);
3630 		if (error == 0)
3631 			error = terr;
3632 	}
3633 out:
3634 	if ((error == ENOSPC) && retry && TRANS_ISTRANS(ufsvfsp)) {
3635 		ufs_delete_drain_wait(ufsvfsp, 1);
3636 		retry = 0;
3637 		goto again;
3638 	}
3639 
3640 	TRACE_2(TR_FAC_UFS, TR_UFS_MKDIR_END,
3641 		"ufs_mkdir_end:dvp %p error %d", dvp, error);
3642 	return (error);
3643 }
3644 
3645 /*ARGSUSED*/
3646 static int
3647 ufs_rmdir(struct vnode *vp, char *nm, struct vnode *cdir, struct cred *cr)
3648 {
3649 	struct inode *ip = VTOI(vp);
3650 	struct ufsvfs *ufsvfsp = ip->i_ufsvfs;
3651 	struct ulockfs *ulp;
3652 	vnode_t *rmvp = NULL;	/* Vnode of removed directory */
3653 	int error;
3654 	int issync;
3655 
3656 	TRACE_1(TR_FAC_UFS, TR_UFS_RMDIR_START,
3657 		"ufs_rmdir_start:vp %p", vp);
3658 
3659 	/*
3660 	 * don't let the delete queue get too long
3661 	 */
3662 	if (ufsvfsp == NULL) {
3663 		error = EIO;
3664 		goto out;
3665 	}
3666 	if (ufsvfsp->vfs_delete.uq_ne > ufs_idle_max)
3667 		ufs_delete_drain(vp->v_vfsp, 1, 1);
3668 
3669 	error = ufs_lockfs_begin(ufsvfsp, &ulp, ULOCKFS_RMDIR_MASK);
3670 	if (error)
3671 		goto out;
3672 
3673 	if (ulp)
3674 		TRANS_BEGIN_CSYNC(ufsvfsp, issync, TOP_RMDIR, TOP_RMDIR_SIZE);
3675 
3676 	rw_enter(&ip->i_rwlock, RW_WRITER);
3677 	error = ufs_dirremove(ip, nm, (struct inode *)0, cdir, DR_RMDIR, cr,
3678 									&rmvp);
3679 	rw_exit(&ip->i_rwlock);
3680 
3681 	if (ulp) {
3682 		TRANS_END_CSYNC(ufsvfsp, error, issync, TOP_RMDIR,
3683 				TOP_RMDIR_SIZE);
3684 		ufs_lockfs_end(ulp);
3685 	}
3686 
3687 	/*
3688 	 * This must be done AFTER the rmdir transaction has closed.
3689 	 */
3690 	if (rmvp != NULL) {
3691 		/* Only send the event if there were no errors */
3692 		if (error == 0)
3693 			vnevent_rmdir(rmvp);
3694 		VN_RELE(rmvp);
3695 	}
3696 out:
3697 	TRACE_2(TR_FAC_UFS, TR_UFS_RMDIR_END,
3698 		"ufs_rmdir_end:vp %p error %d", vp, error);
3699 
3700 	return (error);
3701 }
3702 
3703 /* ARGSUSED */
3704 static int
3705 ufs_readdir(
3706 	struct vnode *vp,
3707 	struct uio *uiop,
3708 	struct cred *cr,
3709 	int *eofp)
3710 {
3711 	struct iovec *iovp;
3712 	struct inode *ip;
3713 	struct direct *idp;
3714 	struct dirent64 *odp;
3715 	struct fbuf *fbp;
3716 	struct ufsvfs *ufsvfsp;
3717 	struct ulockfs *ulp;
3718 	caddr_t outbuf;
3719 	size_t bufsize;
3720 	uint_t offset;
3721 	uint_t bytes_wanted, total_bytes_wanted;
3722 	int incount = 0;
3723 	int outcount = 0;
3724 	int error;
3725 
3726 	ip = VTOI(vp);
3727 	ASSERT(RW_READ_HELD(&ip->i_rwlock));
3728 
3729 	TRACE_2(TR_FAC_UFS, TR_UFS_READDIR_START,
3730 		"ufs_readdir_start:vp %p uiop %p", vp, uiop);
3731 
3732 	if (uiop->uio_loffset >= MAXOFF32_T) {
3733 		if (eofp)
3734 			*eofp = 1;
3735 		return (0);
3736 	}
3737 
3738 	/*
3739 	 * Check if we have been called with a valid iov_len
3740 	 * and bail out if not, otherwise we may potentially loop
3741 	 * forever further down.
3742 	 */
3743 	if (uiop->uio_iov->iov_len <= 0) {
3744 		error = EINVAL;
3745 		goto out;
3746 	}
3747 
3748 	/*
3749 	 * Large Files: When we come here we are guaranteed that
3750 	 * uio_offset can be used safely. The high word is zero.
3751 	 */
3752 
3753 	ufsvfsp = ip->i_ufsvfs;
3754 	error = ufs_lockfs_begin(ufsvfsp, &ulp, ULOCKFS_READDIR_MASK);
3755 	if (error)
3756 		goto out;
3757 
3758 	iovp = uiop->uio_iov;
3759 	total_bytes_wanted = iovp->iov_len;
3760 
3761 	/* Large Files: directory files should not be "large" */
3762 
3763 	ASSERT(ip->i_size <= MAXOFF32_T);
3764 
3765 	/* Force offset to be valid (to guard against bogus lseek() values) */
3766 	offset = (uint_t)uiop->uio_offset & ~(DIRBLKSIZ - 1);
3767 
3768 	/* Quit if at end of file or link count of zero (posix) */
3769 	if (offset >= (uint_t)ip->i_size || ip->i_nlink <= 0) {
3770 		if (eofp)
3771 			*eofp = 1;
3772 		error = 0;
3773 		goto unlock;
3774 	}
3775 
3776 	/*
3777 	 * Get space to change directory entries into fs independent format.
3778 	 * Do fast alloc for the most commonly used-request size (filesystem
3779 	 * block size).
3780 	 */
3781 	if (uiop->uio_segflg != UIO_SYSSPACE || uiop->uio_iovcnt != 1) {
3782 		bufsize = total_bytes_wanted;
3783 		outbuf = kmem_alloc(bufsize, KM_SLEEP);
3784 		odp = (struct dirent64 *)outbuf;
3785 	} else {
3786 		bufsize = total_bytes_wanted;
3787 		odp = (struct dirent64 *)iovp->iov_base;
3788 	}
3789 
3790 nextblk:
3791 	bytes_wanted = total_bytes_wanted;
3792 
3793 	/* Truncate request to file size */
3794 	if (offset + bytes_wanted > (int)ip->i_size)
3795 		bytes_wanted = (int)(ip->i_size - offset);
3796 
3797 	/* Comply with MAXBSIZE boundary restrictions of fbread() */
3798 	if ((offset & MAXBOFFSET) + bytes_wanted > MAXBSIZE)
3799 		bytes_wanted = MAXBSIZE - (offset & MAXBOFFSET);
3800 
3801 	/*
3802 	 * Read in the next chunk.
3803 	 * We are still holding the i_rwlock.
3804 	 */
3805 	error = fbread(vp, (offset_t)offset, bytes_wanted, S_OTHER, &fbp);
3806 
3807 	if (error)
3808 		goto update_inode;
3809 	if (!ULOCKFS_IS_NOIACC(ITOUL(ip)) && (ip->i_fs->fs_ronly == 0) &&
3810 	    (!ufsvfsp->vfs_noatime)) {
3811 		ip->i_flag |= IACC;
3812 	}
3813 	incount = 0;
3814 	idp = (struct direct *)fbp->fb_addr;
3815 	if (idp->d_ino == 0 && idp->d_reclen == 0 &&
3816 		idp->d_namlen == 0) {
3817 		cmn_err(CE_WARN, "ufs_readdir: bad dir, inumber = %llu, "
3818 			"fs = %s\n",
3819 			(u_longlong_t)ip->i_number, ufsvfsp->vfs_fs->fs_fsmnt);
3820 		fbrelse(fbp, S_OTHER);
3821 		error = ENXIO;
3822 		goto update_inode;
3823 	}
3824 	/* Transform to file-system independent format */
3825 	while (incount < bytes_wanted) {
3826 		/*
3827 		 * If the current directory entry is mangled, then skip
3828 		 * to the next block.  It would be nice to set the FSBAD
3829 		 * flag in the super-block so that a fsck is forced on
3830 		 * next reboot, but locking is a problem.
3831 		 */
3832 		if (idp->d_reclen & 0x3) {
3833 			offset = (offset + DIRBLKSIZ) & ~(DIRBLKSIZ-1);
3834 			break;
3835 		}
3836 
3837 		/* Skip to requested offset and skip empty entries */
3838 		if (idp->d_ino != 0 && offset >= (uint_t)uiop->uio_offset) {
3839 			ushort_t this_reclen =
3840 			    DIRENT64_RECLEN(idp->d_namlen);
3841 			/* Buffer too small for any entries */
3842 			if (!outcount && this_reclen > bufsize) {
3843 				fbrelse(fbp, S_OTHER);
3844 				error = EINVAL;
3845 				goto update_inode;
3846 			}
3847 			/* If would overrun the buffer, quit */
3848 			if (outcount + this_reclen > bufsize) {
3849 				break;
3850 			}
3851 			/* Take this entry */
3852 			odp->d_ino = (ino64_t)idp->d_ino;
3853 			odp->d_reclen = (ushort_t)this_reclen;
3854 			odp->d_off = (offset_t)(offset + idp->d_reclen);
3855 
3856 			/* use strncpy(9f) to zero out uninitialized bytes */
3857 
3858 			ASSERT(strlen(idp->d_name) + 1 <=
3859 			    DIRENT64_NAMELEN(this_reclen));
3860 			(void) strncpy(odp->d_name, idp->d_name,
3861 			    DIRENT64_NAMELEN(this_reclen));
3862 			outcount += odp->d_reclen;
3863 			odp = (struct dirent64 *)((intptr_t)odp +
3864 				    odp->d_reclen);
3865 			ASSERT(outcount <= bufsize);
3866 		}
3867 		if (idp->d_reclen) {
3868 			incount += idp->d_reclen;
3869 			offset += idp->d_reclen;
3870 			idp = (struct direct *)((intptr_t)idp + idp->d_reclen);
3871 		} else {
3872 			offset = (offset + DIRBLKSIZ) & ~(DIRBLKSIZ-1);
3873 			break;
3874 		}
3875 	}
3876 	/* Release the chunk */
3877 	fbrelse(fbp, S_OTHER);
3878 
3879 	/* Read whole block, but got no entries, read another if not eof */
3880 
3881 	/*
3882 	 * Large Files: casting i_size to int here is not a problem
3883 	 * because directory sizes are always less than MAXOFF32_T.
3884 	 * See assertion above.
3885 	 */
3886 
3887 	if (offset < (int)ip->i_size && !outcount)
3888 		goto nextblk;
3889 
3890 	/* Copy out the entry data */
3891 	if (uiop->uio_segflg == UIO_SYSSPACE && uiop->uio_iovcnt == 1) {
3892 		iovp->iov_base += outcount;
3893 		iovp->iov_len -= outcount;
3894 		uiop->uio_resid -= outcount;
3895 		uiop->uio_offset = offset;
3896 	} else if ((error = uiomove(outbuf, (long)outcount, UIO_READ,
3897 				    uiop)) == 0)
3898 		uiop->uio_offset = offset;
3899 update_inode:
3900 	ITIMES(ip);
3901 	if (uiop->uio_segflg != UIO_SYSSPACE || uiop->uio_iovcnt != 1)
3902 		kmem_free(outbuf, bufsize);
3903 
3904 	if (eofp && error == 0)
3905 		*eofp = (uiop->uio_offset >= (int)ip->i_size);
3906 unlock:
3907 	if (ulp) {
3908 		ufs_lockfs_end(ulp);
3909 	}
3910 out:
3911 	TRACE_2(TR_FAC_UFS, TR_UFS_READDIR_END,
3912 		"ufs_readdir_end:vp %p error %d", vp, error);
3913 	return (error);
3914 }
3915 
3916 /*ARGSUSED*/
3917 static int
3918 ufs_symlink(
3919 	struct vnode *dvp,		/* ptr to parent dir vnode */
3920 	char *linkname,			/* name of symbolic link */
3921 	struct vattr *vap,		/* attributes */
3922 	char *target,			/* target path */
3923 	struct cred *cr)		/* user credentials */
3924 {
3925 	struct inode *ip, *dip = VTOI(dvp);
3926 	struct ufsvfs *ufsvfsp = dip->i_ufsvfs;
3927 	struct ulockfs *ulp;
3928 	int error;
3929 	int issync;
3930 	int trans_size;
3931 	int residual;
3932 	int ioflag;
3933 	int retry = 1;
3934 
3935 	TRACE_1(TR_FAC_UFS, TR_UFS_SYMLINK_START,
3936 		"ufs_symlink_start:dvp %p", dvp);
3937 
3938 	/*
3939 	 * No symlinks in attrdirs at this time
3940 	 */
3941 	if ((VTOI(dvp)->i_mode & IFMT) == IFATTRDIR)
3942 		return (EINVAL);
3943 
3944 again:
3945 	ip = (struct inode *)NULL;
3946 	vap->va_type = VLNK;
3947 	vap->va_rdev = 0;
3948 
3949 	error = ufs_lockfs_begin(ufsvfsp, &ulp, ULOCKFS_SYMLINK_MASK);
3950 	if (error)
3951 		goto out;
3952 
3953 	if (ulp)
3954 		TRANS_BEGIN_CSYNC(ufsvfsp, issync, TOP_SYMLINK,
3955 		    trans_size = (int)TOP_SYMLINK_SIZE(dip));
3956 
3957 	/*
3958 	 * We must create the inode before the directory entry, to avoid
3959 	 * racing with readlink().  ufs_dirmakeinode requires that we
3960 	 * hold the quota lock as reader, and directory locks as writer.
3961 	 */
3962 
3963 	rw_enter(&dip->i_rwlock, RW_WRITER);
3964 	rw_enter(&ufsvfsp->vfs_dqrwlock, RW_READER);
3965 	rw_enter(&dip->i_contents, RW_WRITER);
3966 
3967 	/*
3968 	 * Suppress any out of inodes messages if we will retry on
3969 	 * ENOSP
3970 	 */
3971 	if (retry)
3972 		dip->i_flag |= IQUIET;
3973 
3974 	error = ufs_dirmakeinode(dip, &ip, vap, DE_SYMLINK, cr);
3975 
3976 	dip->i_flag &= ~IQUIET;
3977 
3978 	rw_exit(&dip->i_contents);
3979 	rw_exit(&ufsvfsp->vfs_dqrwlock);
3980 	rw_exit(&dip->i_rwlock);
3981 
3982 	if (error)
3983 		goto unlock;
3984 
3985 	/*
3986 	 * OK.  The inode has been created.  Write out the data of the
3987 	 * symbolic link.  Since symbolic links are metadata, and should
3988 	 * remain consistent across a system crash, we need to force the
3989 	 * data out synchronously.
3990 	 *
3991 	 * (This is a change from the semantics in earlier releases, which
3992 	 * only created symbolic links synchronously if the semi-documented
3993 	 * 'syncdir' option was set, or if we were being invoked by the NFS
3994 	 * server, which requires symbolic links to be created synchronously.)
3995 	 *
3996 	 * We need to pass in a pointer for the residual length; otherwise
3997 	 * ufs_rdwri() will always return EIO if it can't write the data,
3998 	 * even if the error was really ENOSPC or EDQUOT.
3999 	 */
4000 
4001 	ioflag = FWRITE | FDSYNC;
4002 	residual = 0;
4003 
4004 	rw_enter(&ufsvfsp->vfs_dqrwlock, RW_READER);
4005 	rw_enter(&ip->i_contents, RW_WRITER);
4006 
4007 	/*
4008 	 * Suppress file system full messages if we will retry
4009 	 */
4010 	if (retry)
4011 		ip->i_flag |= IQUIET;
4012 
4013 	error = ufs_rdwri(UIO_WRITE, ioflag, ip, target, strlen(target),
4014 	    (offset_t)0, UIO_SYSSPACE, &residual, cr);
4015 
4016 	ip->i_flag &= ~IQUIET;
4017 
4018 	if (error) {
4019 		rw_exit(&ip->i_contents);
4020 		rw_exit(&ufsvfsp->vfs_dqrwlock);
4021 		goto remove;
4022 	}
4023 
4024 	/*
4025 	 * If the link's data is small enough, we can cache it in the inode.
4026 	 * This is a "fast symbolic link".  We don't use the first direct
4027 	 * block because that's actually used to point at the symbolic link's
4028 	 * contents on disk; but we know that none of the other direct or
4029 	 * indirect blocks can be used because symbolic links are restricted
4030 	 * to be smaller than a file system block.
4031 	 */
4032 
4033 	ASSERT(MAXPATHLEN <= VBSIZE(ITOV(ip)));
4034 
4035 	if (ip->i_size > 0 && ip->i_size <= FSL_SIZE) {
4036 		if (kcopy(target, &ip->i_db[1], ip->i_size) == 0) {
4037 			ip->i_flag |= IFASTSYMLNK;
4038 		} else {
4039 			int i;
4040 			/* error, clear garbage left behind */
4041 			for (i = 1; i < NDADDR; i++)
4042 				ip->i_db[i] = 0;
4043 			for (i = 0; i < NIADDR; i++)
4044 				ip->i_ib[i] = 0;
4045 		}
4046 	}
4047 
4048 	rw_exit(&ip->i_contents);
4049 	rw_exit(&ufsvfsp->vfs_dqrwlock);
4050 
4051 	/*
4052 	 * OK.  We've successfully created the symbolic link.  All that
4053 	 * remains is to insert it into the appropriate directory.
4054 	 */
4055 
4056 	rw_enter(&dip->i_rwlock, RW_WRITER);
4057 	error = ufs_direnter_lr(dip, linkname, DE_SYMLINK, NULL, ip, cr, NULL);
4058 	rw_exit(&dip->i_rwlock);
4059 
4060 	/*
4061 	 * Fall through into remove-on-error code.  We're either done, or we
4062 	 * need to remove the inode (if we couldn't insert it).
4063 	 */
4064 
4065 remove:
4066 	if (error && (ip != NULL)) {
4067 		rw_enter(&ip->i_contents, RW_WRITER);
4068 		ip->i_nlink--;
4069 		ip->i_flag |= ICHG;
4070 		ip->i_seq++;
4071 		ufs_setreclaim(ip);
4072 		rw_exit(&ip->i_contents);
4073 	}
4074 
4075 unlock:
4076 	if (ip != NULL)
4077 		VN_RELE(ITOV(ip));
4078 
4079 	if (ulp) {
4080 		int terr = 0;
4081 
4082 		TRANS_END_CSYNC(ufsvfsp, terr, issync, TOP_SYMLINK,
4083 				trans_size);
4084 		ufs_lockfs_end(ulp);
4085 		if (error == 0)
4086 			error = terr;
4087 	}
4088 
4089 	/*
4090 	 * We may have failed due to lack of an inode or of a block to
4091 	 * store the target in.  Try flushing the delete queue to free
4092 	 * logically-available things up and try again.
4093 	 */
4094 	if ((error == ENOSPC) && retry && TRANS_ISTRANS(ufsvfsp)) {
4095 		ufs_delete_drain_wait(ufsvfsp, 1);
4096 		retry = 0;
4097 		goto again;
4098 	}
4099 
4100 out:
4101 	TRACE_2(TR_FAC_UFS, TR_UFS_SYMLINK_END,
4102 		"ufs_symlink_end:dvp %p error %d", dvp, error);
4103 	return (error);
4104 }
4105 
4106 /*
4107  * Ufs specific routine used to do ufs io.
4108  */
4109 int
4110 ufs_rdwri(enum uio_rw rw, int ioflag, struct inode *ip, caddr_t base,
4111 	ssize_t len, offset_t offset, enum uio_seg seg, int *aresid,
4112 	struct cred *cr)
4113 {
4114 	struct uio auio;
4115 	struct iovec aiov;
4116 	int error;
4117 
4118 	ASSERT(RW_LOCK_HELD(&ip->i_contents));
4119 
4120 	bzero((caddr_t)&auio, sizeof (uio_t));
4121 	bzero((caddr_t)&aiov, sizeof (iovec_t));
4122 
4123 	aiov.iov_base = base;
4124 	aiov.iov_len = len;
4125 	auio.uio_iov = &aiov;
4126 	auio.uio_iovcnt = 1;
4127 	auio.uio_loffset = offset;
4128 	auio.uio_segflg = (short)seg;
4129 	auio.uio_resid = len;
4130 
4131 	if (rw == UIO_WRITE) {
4132 		auio.uio_fmode = FWRITE;
4133 		auio.uio_extflg = UIO_COPY_DEFAULT;
4134 		auio.uio_llimit = curproc->p_fsz_ctl;
4135 		error = wrip(ip, &auio, ioflag, cr);
4136 	} else {
4137 		auio.uio_fmode = FREAD;
4138 		auio.uio_extflg = UIO_COPY_CACHED;
4139 		auio.uio_llimit = MAXOFFSET_T;
4140 		error = rdip(ip, &auio, ioflag, cr);
4141 	}
4142 
4143 	if (aresid) {
4144 		*aresid = auio.uio_resid;
4145 	} else if (auio.uio_resid) {
4146 		error = EIO;
4147 	}
4148 	return (error);
4149 }
4150 
4151 static int
4152 ufs_fid(vp, fidp)
4153 	struct vnode *vp;
4154 	struct fid *fidp;
4155 {
4156 	struct ufid *ufid;
4157 	struct inode *ip = VTOI(vp);
4158 
4159 	if (ip->i_ufsvfs == NULL)
4160 		return (EIO);
4161 
4162 	if (fidp->fid_len < (sizeof (struct ufid) - sizeof (ushort_t))) {
4163 		fidp->fid_len = sizeof (struct ufid) - sizeof (ushort_t);
4164 		return (ENOSPC);
4165 	}
4166 
4167 	ufid = (struct ufid *)fidp;
4168 	bzero((char *)ufid, sizeof (struct ufid));
4169 	ufid->ufid_len = sizeof (struct ufid) - sizeof (ushort_t);
4170 	ufid->ufid_ino = ip->i_number;
4171 	ufid->ufid_gen = ip->i_gen;
4172 
4173 	return (0);
4174 }
4175 
4176 /* ARGSUSED2 */
4177 static int
4178 ufs_rwlock(struct vnode *vp, int write_lock, caller_context_t *ctp)
4179 {
4180 	struct inode	*ip = VTOI(vp);
4181 	struct ufsvfs	*ufsvfsp;
4182 	int		forcedirectio;
4183 
4184 	/*
4185 	 * Read case is easy.
4186 	 */
4187 	if (!write_lock) {
4188 		rw_enter(&ip->i_rwlock, RW_READER);
4189 		return (V_WRITELOCK_FALSE);
4190 	}
4191 
4192 	/*
4193 	 * Caller has requested a writer lock, but that inhibits any
4194 	 * concurrency in the VOPs that follow. Acquire the lock shared
4195 	 * and defer exclusive access until it is known to be needed in
4196 	 * other VOP handlers. Some cases can be determined here.
4197 	 */
4198 
4199 	/*
4200 	 * If directio is not set, there is no chance of concurrency,
4201 	 * so just acquire the lock exclusive. Beware of a forced
4202 	 * unmount before looking at the mount option.
4203 	 */
4204 	ufsvfsp = ip->i_ufsvfs;
4205 	forcedirectio = ufsvfsp ? ufsvfsp->vfs_forcedirectio : 0;
4206 	if (!(ip->i_flag & IDIRECTIO || forcedirectio) ||
4207 	    !ufs_allow_shared_writes) {
4208 		rw_enter(&ip->i_rwlock, RW_WRITER);
4209 		return (V_WRITELOCK_TRUE);
4210 	}
4211 
4212 	/*
4213 	 * Mandatory locking forces acquiring i_rwlock exclusive.
4214 	 */
4215 	if (MANDLOCK(vp, ip->i_mode)) {
4216 		rw_enter(&ip->i_rwlock, RW_WRITER);
4217 		return (V_WRITELOCK_TRUE);
4218 	}
4219 
4220 	/*
4221 	 * Acquire the lock shared in case a concurrent write follows.
4222 	 * Mandatory locking could have become enabled before the lock
4223 	 * was acquired. Re-check and upgrade if needed.
4224 	 */
4225 	rw_enter(&ip->i_rwlock, RW_READER);
4226 	if (MANDLOCK(vp, ip->i_mode)) {
4227 		rw_exit(&ip->i_rwlock);
4228 		rw_enter(&ip->i_rwlock, RW_WRITER);
4229 		return (V_WRITELOCK_TRUE);
4230 	}
4231 	return (V_WRITELOCK_FALSE);
4232 }
4233 
4234 /*ARGSUSED*/
4235 static void
4236 ufs_rwunlock(struct vnode *vp, int write_lock, caller_context_t *ctp)
4237 {
4238 	struct inode	*ip = VTOI(vp);
4239 
4240 	rw_exit(&ip->i_rwlock);
4241 }
4242 
4243 /* ARGSUSED */
4244 static int
4245 ufs_seek(struct vnode *vp, offset_t ooff, offset_t *noffp)
4246 {
4247 	return ((*noffp < 0 || *noffp > MAXOFFSET_T) ? EINVAL : 0);
4248 }
4249 
4250 /* ARGSUSED */
4251 static int
4252 ufs_frlock(struct vnode *vp, int cmd, struct flock64 *bfp, int flag,
4253 	offset_t offset, struct flk_callback *flk_cbp, struct cred *cr)
4254 {
4255 	struct inode *ip = VTOI(vp);
4256 
4257 	if (ip->i_ufsvfs == NULL)
4258 		return (EIO);
4259 
4260 	/*
4261 	 * If file is being mapped, disallow frlock.
4262 	 * XXX I am not holding tlock while checking i_mapcnt because the
4263 	 * current locking strategy drops all locks before calling fs_frlock.
4264 	 * So, mapcnt could change before we enter fs_frlock making is
4265 	 * meaningless to have held tlock in the first place.
4266 	 */
4267 	if (ip->i_mapcnt > 0 && MANDLOCK(vp, ip->i_mode))
4268 		return (EAGAIN);
4269 	return (fs_frlock(vp, cmd, bfp, flag, offset, flk_cbp, cr));
4270 }
4271 
4272 /* ARGSUSED */
4273 static int
4274 ufs_space(struct vnode *vp, int cmd, struct flock64 *bfp, int flag,
4275 	offset_t offset, cred_t *cr, caller_context_t *ct)
4276 {
4277 	struct ufsvfs *ufsvfsp = VTOI(vp)->i_ufsvfs;
4278 	struct ulockfs *ulp;
4279 	int error;
4280 
4281 	if ((error = convoff(vp, bfp, 0, offset)) == 0) {
4282 		if (cmd == F_FREESP) {
4283 			error = ufs_lockfs_begin(ufsvfsp, &ulp,
4284 			    ULOCKFS_SPACE_MASK);
4285 			if (error)
4286 				return (error);
4287 			error = ufs_freesp(vp, bfp, flag, cr);
4288 		} else if (cmd == F_ALLOCSP) {
4289 			error = ufs_lockfs_begin(ufsvfsp, &ulp,
4290 			    ULOCKFS_FALLOCATE_MASK);
4291 			if (error)
4292 				return (error);
4293 			error = ufs_allocsp(vp, bfp, cr);
4294 		} else
4295 			return (EINVAL); /* Command not handled here */
4296 
4297 		if (ulp)
4298 			ufs_lockfs_end(ulp);
4299 
4300 	}
4301 	return (error);
4302 }
4303 
4304 /*
4305  * Used to determine if read ahead should be done. Also used to
4306  * to determine when write back occurs.
4307  */
4308 #define	CLUSTSZ(ip)		((ip)->i_ufsvfs->vfs_ioclustsz)
4309 
4310 /*
4311  * A faster version of ufs_getpage.
4312  *
4313  * We optimize by inlining the pvn_getpages iterator, eliminating
4314  * calls to bmap_read if file doesn't have UFS holes, and avoiding
4315  * the overhead of page_exists().
4316  *
4317  * When files has UFS_HOLES and ufs_getpage is called with S_READ,
4318  * we set *protp to PROT_READ to avoid calling bmap_read. This approach
4319  * victimizes performance when a file with UFS holes is faulted
4320  * first in the S_READ mode, and then in the S_WRITE mode. We will get
4321  * two MMU faults in this case.
4322  *
4323  * XXX - the inode fields which control the sequential mode are not
4324  *	 protected by any mutex. The read ahead will act wild if
4325  *	 multiple processes will access the file concurrently and
4326  *	 some of them in sequential mode. One particulary bad case
4327  *	 is if another thread will change the value of i_nextrio between
4328  *	 the time this thread tests the i_nextrio value and then reads it
4329  *	 again to use it as the offset for the read ahead.
4330  */
4331 static int
4332 ufs_getpage(struct vnode *vp, offset_t off, size_t len, uint_t *protp,
4333 	page_t *plarr[], size_t plsz, struct seg *seg, caddr_t addr,
4334 	enum seg_rw rw, struct cred *cr)
4335 {
4336 	u_offset_t	uoff = (u_offset_t)off; /* type conversion */
4337 	u_offset_t	pgoff;
4338 	u_offset_t	eoff;
4339 	struct inode 	*ip = VTOI(vp);
4340 	struct ufsvfs	*ufsvfsp = ip->i_ufsvfs;
4341 	struct fs 	*fs;
4342 	struct ulockfs	*ulp;
4343 	page_t		**pl;
4344 	caddr_t		pgaddr;
4345 	krw_t		rwtype;
4346 	int 		err;
4347 	int		has_holes;
4348 	int		beyond_eof;
4349 	int		seqmode;
4350 	int		pgsize = PAGESIZE;
4351 	int		dolock;
4352 	int		do_qlock;
4353 	int		trans_size;
4354 
4355 	TRACE_1(TR_FAC_UFS, TR_UFS_GETPAGE_START,
4356 		"ufs_getpage_start:vp %p", vp);
4357 
4358 	ASSERT((uoff & PAGEOFFSET) == 0);
4359 
4360 	if (protp)
4361 		*protp = PROT_ALL;
4362 
4363 	/*
4364 	 * Obey the lockfs protocol
4365 	 */
4366 	err = ufs_lockfs_begin_getpage(ufsvfsp, &ulp, seg,
4367 			rw == S_READ || rw == S_EXEC, protp);
4368 	if (err)
4369 		goto out;
4370 
4371 	fs = ufsvfsp->vfs_fs;
4372 
4373 	if (ulp && (rw == S_CREATE || rw == S_WRITE) &&
4374 	    !(vp->v_flag & VISSWAP)) {
4375 		/*
4376 		 * Try to start a transaction, will return if blocking is
4377 		 * expected to occur and the address space is not the
4378 		 * kernel address space.
4379 		 */
4380 		trans_size = TOP_GETPAGE_SIZE(ip);
4381 		if (seg->s_as != &kas) {
4382 			TRANS_TRY_BEGIN_ASYNC(ufsvfsp, TOP_GETPAGE,
4383 				trans_size, err)
4384 			if (err == EWOULDBLOCK) {
4385 				/*
4386 				 * Use EDEADLK here because the VM code
4387 				 * can normally never see this error.
4388 				 */
4389 				err = EDEADLK;
4390 				ufs_lockfs_end(ulp);
4391 				goto out;
4392 			}
4393 		} else {
4394 			TRANS_BEGIN_ASYNC(ufsvfsp, TOP_GETPAGE, trans_size);
4395 		}
4396 	}
4397 
4398 	if (vp->v_flag & VNOMAP) {
4399 		err = ENOSYS;
4400 		goto unlock;
4401 	}
4402 
4403 	seqmode = ip->i_nextr == uoff && rw != S_CREATE;
4404 
4405 	rwtype = RW_READER;		/* start as a reader */
4406 	dolock = (rw_owner(&ip->i_contents) != curthread);
4407 	/*
4408 	 * If this thread owns the lock, i.e., this thread grabbed it
4409 	 * as writer somewhere above, then we don't need to grab the
4410 	 * lock as reader in this routine.
4411 	 */
4412 	do_qlock = (rw_owner(&ufsvfsp->vfs_dqrwlock) != curthread);
4413 
4414 retrylock:
4415 	if (dolock) {
4416 		/*
4417 		 * Grab the quota lock if we need to call
4418 		 * bmap_write() below (with i_contents as writer).
4419 		 */
4420 		if (do_qlock && rwtype == RW_WRITER)
4421 			rw_enter(&ufsvfsp->vfs_dqrwlock, RW_READER);
4422 		rw_enter(&ip->i_contents, rwtype);
4423 	}
4424 
4425 	/*
4426 	 * We may be getting called as a side effect of a bmap using
4427 	 * fbread() when the blocks might be being allocated and the
4428 	 * size has not yet been up'ed.  In this case we want to be
4429 	 * able to return zero pages if we get back UFS_HOLE from
4430 	 * calling bmap for a non write case here.  We also might have
4431 	 * to read some frags from the disk into a page if we are
4432 	 * extending the number of frags for a given lbn in bmap().
4433 	 * Large Files: The read of i_size here is atomic because
4434 	 * i_contents is held here. If dolock is zero, the lock
4435 	 * is held in bmap routines.
4436 	 */
4437 	beyond_eof = uoff + len > ip->i_size + PAGEOFFSET;
4438 	if (beyond_eof && seg != segkmap) {
4439 		if (dolock) {
4440 			rw_exit(&ip->i_contents);
4441 			if (do_qlock && rwtype == RW_WRITER)
4442 				rw_exit(&ufsvfsp->vfs_dqrwlock);
4443 		}
4444 		err = EFAULT;
4445 		goto unlock;
4446 	}
4447 
4448 	/*
4449 	 * Must hold i_contents lock throughout the call to pvn_getpages
4450 	 * since locked pages are returned from each call to ufs_getapage.
4451 	 * Must *not* return locked pages and then try for contents lock
4452 	 * due to lock ordering requirements (inode > page)
4453 	 */
4454 
4455 	has_holes = bmap_has_holes(ip);
4456 
4457 	if ((rw == S_WRITE || rw == S_CREATE) && has_holes && !beyond_eof) {
4458 		int	blk_size;
4459 		u_offset_t offset;
4460 
4461 		/*
4462 		 * We must acquire the RW_WRITER lock in order to
4463 		 * call bmap_write().
4464 		 */
4465 		if (dolock && rwtype == RW_READER) {
4466 			rwtype = RW_WRITER;
4467 
4468 			/*
4469 			 * Grab the quota lock before
4470 			 * upgrading i_contents, but if we can't grab it
4471 			 * don't wait here due to lock order:
4472 			 * vfs_dqrwlock > i_contents.
4473 			 */
4474 			if (do_qlock && rw_tryenter(&ufsvfsp->vfs_dqrwlock,
4475 							RW_READER) == 0) {
4476 				rw_exit(&ip->i_contents);
4477 				goto retrylock;
4478 			}
4479 			if (!rw_tryupgrade(&ip->i_contents)) {
4480 				rw_exit(&ip->i_contents);
4481 				if (do_qlock)
4482 					rw_exit(&ufsvfsp->vfs_dqrwlock);
4483 				goto retrylock;
4484 			}
4485 		}
4486 
4487 		/*
4488 		 * May be allocating disk blocks for holes here as
4489 		 * a result of mmap faults. write(2) does the bmap_write
4490 		 * in rdip/wrip, not here. We are not dealing with frags
4491 		 * in this case.
4492 		 */
4493 		/*
4494 		 * Large Files: We cast fs_bmask field to offset_t
4495 		 * just as we do for MAXBMASK because uoff is a 64-bit
4496 		 * data type. fs_bmask will still be a 32-bit type
4497 		 * as we cannot change any ondisk data structures.
4498 		 */
4499 
4500 		offset = uoff & (offset_t)fs->fs_bmask;
4501 		while (offset < uoff + len) {
4502 			blk_size = (int)blksize(fs, ip, lblkno(fs, offset));
4503 			err = bmap_write(ip, offset, blk_size,
4504 			    BI_NORMAL, NULL, cr);
4505 			if (ip->i_flag & (ICHG|IUPD))
4506 				ip->i_seq++;
4507 			if (err)
4508 				goto update_inode;
4509 			offset += blk_size; /* XXX - make this contig */
4510 		}
4511 	}
4512 
4513 	/*
4514 	 * Can be a reader from now on.
4515 	 */
4516 	if (dolock && rwtype == RW_WRITER) {
4517 		rw_downgrade(&ip->i_contents);
4518 		/*
4519 		 * We can release vfs_dqrwlock early so do it, but make
4520 		 * sure we don't try to release it again at the bottom.
4521 		 */
4522 		if (do_qlock) {
4523 			rw_exit(&ufsvfsp->vfs_dqrwlock);
4524 			do_qlock = 0;
4525 		}
4526 	}
4527 
4528 	/*
4529 	 * We remove PROT_WRITE in cases when the file has UFS holes
4530 	 * because we don't  want to call bmap_read() to check each
4531 	 * page if it is backed with a disk block.
4532 	 */
4533 	if (protp && has_holes && rw != S_WRITE && rw != S_CREATE)
4534 		*protp &= ~PROT_WRITE;
4535 
4536 	err = 0;
4537 
4538 	/*
4539 	 * The loop looks up pages in the range [off, off + len).
4540 	 * For each page, we first check if we should initiate an asynchronous
4541 	 * read ahead before we call page_lookup (we may sleep in page_lookup
4542 	 * for a previously initiated disk read).
4543 	 */
4544 	eoff = (uoff + len);
4545 	for (pgoff = uoff, pgaddr = addr, pl = plarr;
4546 	    pgoff < eoff; /* empty */) {
4547 		page_t	*pp;
4548 		u_offset_t	nextrio;
4549 		se_t	se;
4550 		int retval;
4551 
4552 		se = ((rw == S_CREATE || rw == S_OTHER) ? SE_EXCL : SE_SHARED);
4553 
4554 		/* Handle async getpage (faultahead) */
4555 		if (plarr == NULL) {
4556 			ip->i_nextrio = pgoff;
4557 			(void) ufs_getpage_ra(vp, pgoff, seg, pgaddr);
4558 			pgoff += pgsize;
4559 			pgaddr += pgsize;
4560 			continue;
4561 		}
4562 		/*
4563 		 * Check if we should initiate read ahead of next cluster.
4564 		 * We call page_exists only when we need to confirm that
4565 		 * we have the current page before we initiate the read ahead.
4566 		 */
4567 		nextrio = ip->i_nextrio;
4568 		if (seqmode &&
4569 		    pgoff + CLUSTSZ(ip) >= nextrio && pgoff <= nextrio &&
4570 		    nextrio < ip->i_size && page_exists(vp, pgoff)) {
4571 			retval = ufs_getpage_ra(vp, pgoff, seg, pgaddr);
4572 			/*
4573 			 * We always read ahead the next cluster of data
4574 			 * starting from i_nextrio. If the page (vp,nextrio)
4575 			 * is actually in core at this point, the routine
4576 			 * ufs_getpage_ra() will stop pre-fetching data
4577 			 * until we read that page in a synchronized manner
4578 			 * through ufs_getpage_miss(). So, we should increase
4579 			 * i_nextrio if the page (vp, nextrio) exists.
4580 			 */
4581 			if ((retval == 0) && page_exists(vp, nextrio)) {
4582 				ip->i_nextrio = nextrio + pgsize;
4583 			}
4584 		}
4585 
4586 		if ((pp = page_lookup(vp, pgoff, se)) != NULL) {
4587 			/*
4588 			 * We found the page in the page cache.
4589 			 */
4590 			*pl++ = pp;
4591 			pgoff += pgsize;
4592 			pgaddr += pgsize;
4593 			len -= pgsize;
4594 			plsz -= pgsize;
4595 		} else  {
4596 			/*
4597 			 * We have to create the page, or read it from disk.
4598 			 */
4599 			if (err = ufs_getpage_miss(vp, pgoff, len, seg, pgaddr,
4600 			    pl, plsz, rw, seqmode))
4601 				goto error;
4602 
4603 			while (*pl != NULL) {
4604 				pl++;
4605 				pgoff += pgsize;
4606 				pgaddr += pgsize;
4607 				len -= pgsize;
4608 				plsz -= pgsize;
4609 			}
4610 		}
4611 	}
4612 
4613 	/*
4614 	 * Return pages up to plsz if they are in the page cache.
4615 	 * We cannot return pages if there is a chance that they are
4616 	 * backed with a UFS hole and rw is S_WRITE or S_CREATE.
4617 	 */
4618 	if (plarr && !(has_holes && (rw == S_WRITE || rw == S_CREATE))) {
4619 
4620 		ASSERT((protp == NULL) ||
4621 			!(has_holes && (*protp & PROT_WRITE)));
4622 
4623 		eoff = pgoff + plsz;
4624 		while (pgoff < eoff) {
4625 			page_t		*pp;
4626 
4627 			if ((pp = page_lookup_nowait(vp, pgoff,
4628 			    SE_SHARED)) == NULL)
4629 				break;
4630 
4631 			*pl++ = pp;
4632 			pgoff += pgsize;
4633 			plsz -= pgsize;
4634 		}
4635 	}
4636 
4637 	if (plarr)
4638 		*pl = NULL;			/* Terminate page list */
4639 	ip->i_nextr = pgoff;
4640 
4641 error:
4642 	if (err && plarr) {
4643 		/*
4644 		 * Release any pages we have locked.
4645 		 */
4646 		while (pl > &plarr[0])
4647 			page_unlock(*--pl);
4648 
4649 		plarr[0] = NULL;
4650 	}
4651 
4652 update_inode:
4653 	/*
4654 	 * If the inode is not already marked for IACC (in rdip() for read)
4655 	 * and the inode is not marked for no access time update (in wrip()
4656 	 * for write) then update the inode access time and mod time now.
4657 	 */
4658 	if ((ip->i_flag & (IACC | INOACC)) == 0) {
4659 		if ((rw != S_OTHER) && (ip->i_mode & IFMT) != IFDIR) {
4660 			if (!ULOCKFS_IS_NOIACC(ITOUL(ip)) &&
4661 			    (fs->fs_ronly == 0) &&
4662 			    (!ufsvfsp->vfs_noatime)) {
4663 				mutex_enter(&ip->i_tlock);
4664 				ip->i_flag |= IACC;
4665 				ITIMES_NOLOCK(ip);
4666 				mutex_exit(&ip->i_tlock);
4667 			}
4668 		}
4669 	}
4670 
4671 	if (dolock) {
4672 		rw_exit(&ip->i_contents);
4673 		if (do_qlock && rwtype == RW_WRITER)
4674 			rw_exit(&ufsvfsp->vfs_dqrwlock);
4675 	}
4676 
4677 unlock:
4678 	if (ulp) {
4679 		if ((rw == S_CREATE || rw == S_WRITE) &&
4680 		    !(vp->v_flag & VISSWAP)) {
4681 			TRANS_END_ASYNC(ufsvfsp, TOP_GETPAGE, trans_size);
4682 		}
4683 		ufs_lockfs_end(ulp);
4684 	}
4685 out:
4686 	TRACE_2(TR_FAC_UFS, TR_UFS_GETPAGE_END,
4687 		"ufs_getpage_end:vp %p error %d", vp, err);
4688 	return (err);
4689 }
4690 
4691 /*
4692  * ufs_getpage_miss is called when ufs_getpage missed the page in the page
4693  * cache. The page is either read from the disk, or it's created.
4694  * A page is created (without disk read) if rw == S_CREATE, or if
4695  * the page is not backed with a real disk block (UFS hole).
4696  */
4697 /* ARGSUSED */
4698 static int
4699 ufs_getpage_miss(struct vnode *vp, u_offset_t off, size_t len, struct seg *seg,
4700 	caddr_t addr, page_t *pl[], size_t plsz, enum seg_rw rw, int seq)
4701 {
4702 	struct inode	*ip = VTOI(vp);
4703 	page_t		*pp;
4704 	daddr_t		bn;
4705 	size_t		io_len;
4706 	int		crpage = 0;
4707 	int		err;
4708 	int		contig;
4709 	int		bsize = ip->i_fs->fs_bsize;
4710 
4711 	/*
4712 	 * Figure out whether the page can be created, or must be
4713 	 * must be read from the disk.
4714 	 */
4715 	if (rw == S_CREATE)
4716 		crpage = 1;
4717 	else {
4718 		contig = 0;
4719 		if (err = bmap_read(ip, off, &bn, &contig))
4720 			return (err);
4721 
4722 		crpage = (bn == UFS_HOLE);
4723 
4724 		/*
4725 		 * If its also a fallocated block that hasn't been written to
4726 		 * yet, we will treat it just like a UFS_HOLE and create
4727 		 * a zero page for it
4728 		 */
4729 		if (ISFALLOCBLK(ip, bn))
4730 			crpage = 1;
4731 	}
4732 
4733 	if (crpage) {
4734 		if ((pp = page_create_va(vp, off, PAGESIZE, PG_WAIT, seg,
4735 		    addr)) == NULL) {
4736 			return (ufs_fault(vp,
4737 				    "ufs_getpage_miss: page_create == NULL"));
4738 		}
4739 
4740 		if (rw != S_CREATE)
4741 			pagezero(pp, 0, PAGESIZE);
4742 
4743 		io_len = PAGESIZE;
4744 	} else {
4745 		u_offset_t	io_off;
4746 		uint_t	xlen;
4747 		struct buf	*bp;
4748 		ufsvfs_t	*ufsvfsp = ip->i_ufsvfs;
4749 
4750 		/*
4751 		 * If access is not in sequential order, we read from disk
4752 		 * in bsize units.
4753 		 *
4754 		 * We limit the size of the transfer to bsize if we are reading
4755 		 * from the beginning of the file. Note in this situation we
4756 		 * will hedge our bets and initiate an async read ahead of
4757 		 * the second block.
4758 		 */
4759 		if (!seq || off == 0)
4760 			contig = MIN(contig, bsize);
4761 
4762 		pp = pvn_read_kluster(vp, off, seg, addr, &io_off,
4763 		    &io_len, off, contig, 0);
4764 
4765 		/*
4766 		 * Some other thread has entered the page.
4767 		 * ufs_getpage will retry page_lookup.
4768 		 */
4769 		if (pp == NULL) {
4770 			pl[0] = NULL;
4771 			return (0);
4772 		}
4773 
4774 		/*
4775 		 * Zero part of the page which we are not
4776 		 * going to read from the disk.
4777 		 */
4778 		xlen = io_len & PAGEOFFSET;
4779 		if (xlen != 0)
4780 			pagezero(pp->p_prev, xlen, PAGESIZE - xlen);
4781 
4782 		bp = pageio_setup(pp, io_len, ip->i_devvp, B_READ);
4783 		bp->b_edev = ip->i_dev;
4784 		bp->b_dev = cmpdev(ip->i_dev);
4785 		bp->b_blkno = bn;
4786 		bp->b_un.b_addr = (caddr_t)0;
4787 		bp->b_file = ip->i_vnode;
4788 		bp->b_offset = off;
4789 
4790 		if (ufsvfsp->vfs_log) {
4791 			lufs_read_strategy(ufsvfsp->vfs_log, bp);
4792 		} else if (ufsvfsp->vfs_snapshot) {
4793 			fssnap_strategy(&ufsvfsp->vfs_snapshot, bp);
4794 		} else {
4795 			ufsvfsp->vfs_iotstamp = lbolt;
4796 			ub.ub_getpages.value.ul++;
4797 			(void) bdev_strategy(bp);
4798 			lwp_stat_update(LWP_STAT_INBLK, 1);
4799 		}
4800 
4801 		ip->i_nextrio = off + ((io_len + PAGESIZE - 1) & PAGEMASK);
4802 
4803 		/*
4804 		 * If the file access is sequential, initiate read ahead
4805 		 * of the next cluster.
4806 		 */
4807 		if (seq && ip->i_nextrio < ip->i_size)
4808 			(void) ufs_getpage_ra(vp, off, seg, addr);
4809 		err = biowait(bp);
4810 		pageio_done(bp);
4811 
4812 		if (err) {
4813 			pvn_read_done(pp, B_ERROR);
4814 			return (err);
4815 		}
4816 	}
4817 
4818 	pvn_plist_init(pp, pl, plsz, off, io_len, rw);
4819 	return (0);
4820 }
4821 
4822 /*
4823  * Read ahead a cluster from the disk. Returns the length in bytes.
4824  */
4825 static int
4826 ufs_getpage_ra(struct vnode *vp, u_offset_t off, struct seg *seg, caddr_t addr)
4827 {
4828 	struct inode	*ip = VTOI(vp);
4829 	page_t		*pp;
4830 	u_offset_t	io_off = ip->i_nextrio;
4831 	ufsvfs_t	*ufsvfsp;
4832 	caddr_t		addr2 = addr + (io_off - off);
4833 	struct buf	*bp;
4834 	daddr_t		bn;
4835 	size_t		io_len;
4836 	int		err;
4837 	int		contig;
4838 	int		xlen;
4839 	int		bsize = ip->i_fs->fs_bsize;
4840 
4841 	/*
4842 	 * If the directio advisory is in effect on this file,
4843 	 * then do not do buffered read ahead. Read ahead makes
4844 	 * it more difficult on threads using directio as they
4845 	 * will be forced to flush the pages from this vnode.
4846 	 */
4847 	if ((ufsvfsp = ip->i_ufsvfs) == NULL)
4848 		return (0);
4849 	if (ip->i_flag & IDIRECTIO || ufsvfsp->vfs_forcedirectio)
4850 		return (0);
4851 
4852 	/*
4853 	 * Is this test needed?
4854 	 */
4855 	if (addr2 >= seg->s_base + seg->s_size)
4856 		return (0);
4857 
4858 	contig = 0;
4859 	err = bmap_read(ip, io_off, &bn, &contig);
4860 	/*
4861 	 * If its a UFS_HOLE or a fallocated block, do not perform
4862 	 * any read ahead's since there probably is nothing to read ahead
4863 	 */
4864 	if (err || bn == UFS_HOLE || ISFALLOCBLK(ip, bn))
4865 		return (0);
4866 
4867 	/*
4868 	 * Limit the transfer size to bsize if this is the 2nd block.
4869 	 */
4870 	if (io_off == (u_offset_t)bsize)
4871 		contig = MIN(contig, bsize);
4872 
4873 	if ((pp = pvn_read_kluster(vp, io_off, seg, addr2, &io_off,
4874 	    &io_len, io_off, contig, 1)) == NULL)
4875 		return (0);
4876 
4877 	/*
4878 	 * Zero part of page which we are not going to read from disk
4879 	 */
4880 	if ((xlen = (io_len & PAGEOFFSET)) > 0)
4881 		pagezero(pp->p_prev, xlen, PAGESIZE - xlen);
4882 
4883 	ip->i_nextrio = (io_off + io_len + PAGESIZE - 1) & PAGEMASK;
4884 
4885 	bp = pageio_setup(pp, io_len, ip->i_devvp, B_READ | B_ASYNC);
4886 	bp->b_edev = ip->i_dev;
4887 	bp->b_dev = cmpdev(ip->i_dev);
4888 	bp->b_blkno = bn;
4889 	bp->b_un.b_addr = (caddr_t)0;
4890 	bp->b_file = ip->i_vnode;
4891 	bp->b_offset = off;
4892 
4893 	if (ufsvfsp->vfs_log) {
4894 		lufs_read_strategy(ufsvfsp->vfs_log, bp);
4895 	} else if (ufsvfsp->vfs_snapshot) {
4896 		fssnap_strategy(&ufsvfsp->vfs_snapshot, bp);
4897 	} else {
4898 		ufsvfsp->vfs_iotstamp = lbolt;
4899 		ub.ub_getras.value.ul++;
4900 		(void) bdev_strategy(bp);
4901 		lwp_stat_update(LWP_STAT_INBLK, 1);
4902 	}
4903 
4904 	return (io_len);
4905 }
4906 
4907 int	ufs_delay = 1;
4908 /*
4909  * Flags are composed of {B_INVAL, B_FREE, B_DONTNEED, B_FORCE, B_ASYNC}
4910  *
4911  * LMXXX - the inode really ought to contain a pointer to one of these
4912  * async args.  Stuff gunk in there and just hand the whole mess off.
4913  * This would replace i_delaylen, i_delayoff.
4914  */
4915 /*ARGSUSED*/
4916 static int
4917 ufs_putpage(struct vnode *vp, offset_t off, size_t len, int flags,
4918 	struct cred *cr)
4919 {
4920 	struct inode *ip = VTOI(vp);
4921 	int err = 0;
4922 
4923 	if (vp->v_count == 0) {
4924 		return (ufs_fault(vp, "ufs_putpage: bad v_count == 0"));
4925 	}
4926 
4927 	TRACE_1(TR_FAC_UFS, TR_UFS_PUTPAGE_START,
4928 		"ufs_putpage_start:vp %p", vp);
4929 
4930 	/*
4931 	 * XXX - Why should this check be made here?
4932 	 */
4933 	if (vp->v_flag & VNOMAP) {
4934 		err = ENOSYS;
4935 		goto errout;
4936 	}
4937 
4938 	if (ip->i_ufsvfs == NULL) {
4939 		err = EIO;
4940 		goto errout;
4941 	}
4942 
4943 	if (flags & B_ASYNC) {
4944 		if (ufs_delay && len &&
4945 		    (flags & ~(B_ASYNC|B_DONTNEED|B_FREE)) == 0) {
4946 			mutex_enter(&ip->i_tlock);
4947 			/*
4948 			 * If nobody stalled, start a new cluster.
4949 			 */
4950 			if (ip->i_delaylen == 0) {
4951 				ip->i_delayoff = off;
4952 				ip->i_delaylen = len;
4953 				mutex_exit(&ip->i_tlock);
4954 				goto errout;
4955 			}
4956 			/*
4957 			 * If we have a full cluster or they are not contig,
4958 			 * then push last cluster and start over.
4959 			 */
4960 			if (ip->i_delaylen >= CLUSTSZ(ip) ||
4961 			    ip->i_delayoff + ip->i_delaylen != off) {
4962 				u_offset_t doff;
4963 				size_t dlen;
4964 
4965 				doff = ip->i_delayoff;
4966 				dlen = ip->i_delaylen;
4967 				ip->i_delayoff = off;
4968 				ip->i_delaylen = len;
4969 				mutex_exit(&ip->i_tlock);
4970 				err = ufs_putpages(vp, doff, dlen,
4971 				    flags, cr);
4972 				/* LMXXX - flags are new val, not old */
4973 				goto errout;
4974 			}
4975 			/*
4976 			 * There is something there, it's not full, and
4977 			 * it is contig.
4978 			 */
4979 			ip->i_delaylen += len;
4980 			mutex_exit(&ip->i_tlock);
4981 			goto errout;
4982 		}
4983 		/*
4984 		 * Must have weird flags or we are not clustering.
4985 		 */
4986 	}
4987 
4988 	err = ufs_putpages(vp, off, len, flags, cr);
4989 
4990 errout:
4991 	TRACE_2(TR_FAC_UFS, TR_UFS_PUTPAGE_END,
4992 		"ufs_putpage_end:vp %p error %d", vp, err);
4993 	return (err);
4994 }
4995 
4996 /*
4997  * If len == 0, do from off to EOF.
4998  *
4999  * The normal cases should be len == 0 & off == 0 (entire vp list),
5000  * len == MAXBSIZE (from segmap_release actions), and len == PAGESIZE
5001  * (from pageout).
5002  */
5003 /*ARGSUSED*/
5004 static int
5005 ufs_putpages(
5006 	struct vnode *vp,
5007 	offset_t off,
5008 	size_t len,
5009 	int flags,
5010 	struct cred *cr)
5011 {
5012 	u_offset_t io_off;
5013 	u_offset_t eoff;
5014 	struct inode *ip = VTOI(vp);
5015 	page_t *pp;
5016 	size_t io_len;
5017 	int err = 0;
5018 	int dolock;
5019 
5020 	if (vp->v_count == 0)
5021 		return (ufs_fault(vp, "ufs_putpages: v_count == 0"));
5022 	/*
5023 	 * Acquire the readers/write inode lock before locking
5024 	 * any pages in this inode.
5025 	 * The inode lock is held during i/o.
5026 	 */
5027 	if (len == 0) {
5028 		mutex_enter(&ip->i_tlock);
5029 		ip->i_delayoff = ip->i_delaylen = 0;
5030 		mutex_exit(&ip->i_tlock);
5031 	}
5032 	dolock = (rw_owner(&ip->i_contents) != curthread);
5033 	if (dolock) {
5034 		/*
5035 		 * Must synchronize this thread and any possible thread
5036 		 * operating in the window of vulnerability in wrip().
5037 		 * It is dangerous to allow both a thread doing a putpage
5038 		 * and a thread writing, so serialize them.  The exception
5039 		 * is when the thread in wrip() does something which causes
5040 		 * a putpage operation.  Then, the thread must be allowed
5041 		 * to continue.  It may encounter a bmap_read problem in
5042 		 * ufs_putapage, but that is handled in ufs_putapage.
5043 		 * Allow async writers to proceed, we don't want to block
5044 		 * the pageout daemon.
5045 		 */
5046 		if (ip->i_writer == curthread)
5047 			rw_enter(&ip->i_contents, RW_READER);
5048 		else {
5049 			for (;;) {
5050 				rw_enter(&ip->i_contents, RW_READER);
5051 				mutex_enter(&ip->i_tlock);
5052 				/*
5053 				 * If there is no thread in the critical
5054 				 * section of wrip(), then proceed.
5055 				 * Otherwise, wait until there isn't one.
5056 				 */
5057 				if (ip->i_writer == NULL) {
5058 					mutex_exit(&ip->i_tlock);
5059 					break;
5060 				}
5061 				rw_exit(&ip->i_contents);
5062 				/*
5063 				 * Bounce async writers when we have a writer
5064 				 * working on this file so we don't deadlock
5065 				 * the pageout daemon.
5066 				 */
5067 				if (flags & B_ASYNC) {
5068 					mutex_exit(&ip->i_tlock);
5069 					return (0);
5070 				}
5071 				cv_wait(&ip->i_wrcv, &ip->i_tlock);
5072 				mutex_exit(&ip->i_tlock);
5073 			}
5074 		}
5075 	}
5076 
5077 	if (!vn_has_cached_data(vp)) {
5078 		if (dolock)
5079 			rw_exit(&ip->i_contents);
5080 		return (0);
5081 	}
5082 
5083 	if (len == 0) {
5084 		/*
5085 		 * Search the entire vp list for pages >= off.
5086 		 */
5087 		err = pvn_vplist_dirty(vp, (u_offset_t)off, ufs_putapage,
5088 					flags, cr);
5089 	} else {
5090 		/*
5091 		 * Loop over all offsets in the range looking for
5092 		 * pages to deal with.
5093 		 */
5094 		if ((eoff = blkroundup(ip->i_fs, ip->i_size)) != 0)
5095 			eoff = MIN(off + len, eoff);
5096 		else
5097 			eoff = off + len;
5098 
5099 		for (io_off = off; io_off < eoff; io_off += io_len) {
5100 			/*
5101 			 * If we are not invalidating, synchronously
5102 			 * freeing or writing pages, use the routine
5103 			 * page_lookup_nowait() to prevent reclaiming
5104 			 * them from the free list.
5105 			 */
5106 			if ((flags & B_INVAL) || ((flags & B_ASYNC) == 0)) {
5107 				pp = page_lookup(vp, io_off,
5108 					(flags & (B_INVAL | B_FREE)) ?
5109 					    SE_EXCL : SE_SHARED);
5110 			} else {
5111 				pp = page_lookup_nowait(vp, io_off,
5112 					(flags & B_FREE) ? SE_EXCL : SE_SHARED);
5113 			}
5114 
5115 			if (pp == NULL || pvn_getdirty(pp, flags) == 0)
5116 				io_len = PAGESIZE;
5117 			else {
5118 				u_offset_t *io_offp = &io_off;
5119 
5120 				err = ufs_putapage(vp, pp, io_offp, &io_len,
5121 				    flags, cr);
5122 				if (err != 0)
5123 					break;
5124 				/*
5125 				 * "io_off" and "io_len" are returned as
5126 				 * the range of pages we actually wrote.
5127 				 * This allows us to skip ahead more quickly
5128 				 * since several pages may've been dealt
5129 				 * with by this iteration of the loop.
5130 				 */
5131 			}
5132 		}
5133 	}
5134 	if (err == 0 && off == 0 && (len == 0 || len >= ip->i_size)) {
5135 		/*
5136 		 * We have just sync'ed back all the pages on
5137 		 * the inode, turn off the IMODTIME flag.
5138 		 */
5139 		mutex_enter(&ip->i_tlock);
5140 		ip->i_flag &= ~IMODTIME;
5141 		mutex_exit(&ip->i_tlock);
5142 	}
5143 	if (dolock)
5144 		rw_exit(&ip->i_contents);
5145 	return (err);
5146 }
5147 
5148 static void
5149 ufs_iodone(buf_t *bp)
5150 {
5151 	struct inode *ip;
5152 
5153 	ASSERT((bp->b_pages->p_vnode != NULL) && !(bp->b_flags & B_READ));
5154 
5155 	bp->b_iodone = NULL;
5156 
5157 	ip = VTOI(bp->b_pages->p_vnode);
5158 
5159 	mutex_enter(&ip->i_tlock);
5160 	if (ip->i_writes >= ufs_LW) {
5161 		if ((ip->i_writes -= bp->b_bcount) <= ufs_LW)
5162 			if (ufs_WRITES)
5163 				cv_broadcast(&ip->i_wrcv); /* wake all up */
5164 	} else {
5165 		ip->i_writes -= bp->b_bcount;
5166 	}
5167 
5168 	mutex_exit(&ip->i_tlock);
5169 	iodone(bp);
5170 }
5171 
5172 /*
5173  * Write out a single page, possibly klustering adjacent
5174  * dirty pages.  The inode lock must be held.
5175  *
5176  * LMXXX - bsize < pagesize not done.
5177  */
5178 /*ARGSUSED*/
5179 int
5180 ufs_putapage(
5181 	struct vnode *vp,
5182 	page_t *pp,
5183 	u_offset_t *offp,
5184 	size_t *lenp,		/* return values */
5185 	int flags,
5186 	struct cred *cr)
5187 {
5188 	u_offset_t io_off;
5189 	u_offset_t off;
5190 	struct inode *ip = VTOI(vp);
5191 	struct ufsvfs *ufsvfsp = ip->i_ufsvfs;
5192 	struct fs *fs;
5193 	struct buf *bp;
5194 	size_t io_len;
5195 	daddr_t bn;
5196 	int err;
5197 	int contig;
5198 
5199 	ASSERT(RW_LOCK_HELD(&ip->i_contents));
5200 
5201 	TRACE_1(TR_FAC_UFS, TR_UFS_PUTAPAGE_START,
5202 		"ufs_putapage_start:vp %p", vp);
5203 
5204 	if (ufsvfsp == NULL) {
5205 		err = EIO;
5206 		goto out_trace;
5207 	}
5208 
5209 	fs = ip->i_fs;
5210 	ASSERT(fs->fs_ronly == 0);
5211 
5212 	/*
5213 	 * If the modified time on the inode has not already been
5214 	 * set elsewhere (e.g. for write/setattr) we set the time now.
5215 	 * This gives us approximate modified times for mmap'ed files
5216 	 * which are modified via stores in the user address space.
5217 	 */
5218 	if ((ip->i_flag & IMODTIME) == 0) {
5219 		mutex_enter(&ip->i_tlock);
5220 		ip->i_flag |= IUPD;
5221 		ip->i_seq++;
5222 		ITIMES_NOLOCK(ip);
5223 		mutex_exit(&ip->i_tlock);
5224 	}
5225 
5226 	/*
5227 	 * Align the request to a block boundry (for old file systems),
5228 	 * and go ask bmap() how contiguous things are for this file.
5229 	 */
5230 	off = pp->p_offset & (offset_t)fs->fs_bmask;	/* block align it */
5231 	contig = 0;
5232 	err = bmap_read(ip, off, &bn, &contig);
5233 	if (err)
5234 		goto out;
5235 	if (bn == UFS_HOLE) {			/* putpage never allocates */
5236 		/*
5237 		 * logging device is in error mode; simply return EIO
5238 		 */
5239 		if (TRANS_ISERROR(ufsvfsp)) {
5240 			err = EIO;
5241 			goto out;
5242 		}
5243 		/*
5244 		 * Oops, the thread in the window in wrip() did some
5245 		 * sort of operation which caused a putpage in the bad
5246 		 * range.  In this case, just return an error which will
5247 		 * cause the software modified bit on the page to set
5248 		 * and the page will get written out again later.
5249 		 */
5250 		if (ip->i_writer == curthread) {
5251 			err = EIO;
5252 			goto out;
5253 		}
5254 		/*
5255 		 * If the pager is trying to push a page in the bad range
5256 		 * just tell him to try again later when things are better.
5257 		 */
5258 		if (flags & B_ASYNC) {
5259 			err = EAGAIN;
5260 			goto out;
5261 		}
5262 		err = ufs_fault(ITOV(ip), "ufs_putapage: bn == UFS_HOLE");
5263 		goto out;
5264 	}
5265 
5266 	/*
5267 	 * If it is an fallocate'd block, reverse the negativity since
5268 	 * we are now writing to it
5269 	 */
5270 	if (ISFALLOCBLK(ip, bn)) {
5271 		err = bmap_set_bn(vp, off, dbtofsb(fs, -bn));
5272 		if (err)
5273 			goto out;
5274 
5275 		bn = -bn;
5276 	}
5277 
5278 	/*
5279 	 * Take the length (of contiguous bytes) passed back from bmap()
5280 	 * and _try_ and get a set of pages covering that extent.
5281 	 */
5282 	pp = pvn_write_kluster(vp, pp, &io_off, &io_len, off, contig, flags);
5283 
5284 	/*
5285 	 * May have run out of memory and not clustered backwards.
5286 	 * off		p_offset
5287 	 * [  pp - 1  ][   pp   ]
5288 	 * [	block		]
5289 	 * We told bmap off, so we have to adjust the bn accordingly.
5290 	 */
5291 	if (io_off > off) {
5292 		bn += btod(io_off - off);
5293 		contig -= (io_off - off);
5294 	}
5295 
5296 	/*
5297 	 * bmap was carefull to tell us the right size so use that.
5298 	 * There might be unallocated frags at the end.
5299 	 * LMXXX - bzero the end of the page?  We must be writing after EOF.
5300 	 */
5301 	if (io_len > contig) {
5302 		ASSERT(io_len - contig < fs->fs_bsize);
5303 		io_len -= (io_len - contig);
5304 	}
5305 
5306 	/*
5307 	 * Handle the case where we are writing the last page after EOF.
5308 	 *
5309 	 * XXX - just a patch for i-mt3.
5310 	 */
5311 	if (io_len == 0) {
5312 		ASSERT(pp->p_offset >= (u_offset_t)(roundup(ip->i_size,
5313 							    PAGESIZE)));
5314 		io_len = PAGESIZE;
5315 	}
5316 
5317 	bp = pageio_setup(pp, io_len, ip->i_devvp, B_WRITE | flags);
5318 
5319 	ULOCKFS_SET_MOD(ITOUL(ip));
5320 
5321 	bp->b_edev = ip->i_dev;
5322 	bp->b_dev = cmpdev(ip->i_dev);
5323 	bp->b_blkno = bn;
5324 	bp->b_un.b_addr = (caddr_t)0;
5325 	bp->b_file = ip->i_vnode;
5326 
5327 	if (TRANS_ISTRANS(ufsvfsp)) {
5328 		if ((ip->i_mode & IFMT) == IFSHAD) {
5329 			TRANS_BUF(ufsvfsp, 0, io_len, bp, DT_SHAD);
5330 		} else if (ufsvfsp->vfs_qinod == ip) {
5331 			TRANS_DELTA(ufsvfsp, ldbtob(bn), bp->b_bcount, DT_QR,
5332 			    0, 0);
5333 		}
5334 	}
5335 
5336 	/* write throttle */
5337 
5338 	ASSERT(bp->b_iodone == NULL);
5339 	bp->b_iodone = (int (*)())ufs_iodone;
5340 	mutex_enter(&ip->i_tlock);
5341 	ip->i_writes += bp->b_bcount;
5342 	mutex_exit(&ip->i_tlock);
5343 
5344 	if (bp->b_flags & B_ASYNC) {
5345 		if (ufsvfsp->vfs_log) {
5346 			lufs_write_strategy(ufsvfsp->vfs_log, bp);
5347 		} else if (ufsvfsp->vfs_snapshot) {
5348 			fssnap_strategy(&ufsvfsp->vfs_snapshot, bp);
5349 		} else {
5350 			ufsvfsp->vfs_iotstamp = lbolt;
5351 			ub.ub_putasyncs.value.ul++;
5352 			(void) bdev_strategy(bp);
5353 			lwp_stat_update(LWP_STAT_OUBLK, 1);
5354 		}
5355 	} else {
5356 		if (ufsvfsp->vfs_log) {
5357 			lufs_write_strategy(ufsvfsp->vfs_log, bp);
5358 		} else if (ufsvfsp->vfs_snapshot) {
5359 			fssnap_strategy(&ufsvfsp->vfs_snapshot, bp);
5360 		} else {
5361 			ufsvfsp->vfs_iotstamp = lbolt;
5362 			ub.ub_putsyncs.value.ul++;
5363 			(void) bdev_strategy(bp);
5364 			lwp_stat_update(LWP_STAT_OUBLK, 1);
5365 		}
5366 		err = biowait(bp);
5367 		pageio_done(bp);
5368 		pvn_write_done(pp, ((err) ? B_ERROR : 0) | B_WRITE | flags);
5369 	}
5370 
5371 	pp = NULL;
5372 
5373 out:
5374 	if (err != 0 && pp != NULL)
5375 		pvn_write_done(pp, B_ERROR | B_WRITE | flags);
5376 
5377 	if (offp)
5378 		*offp = io_off;
5379 	if (lenp)
5380 		*lenp = io_len;
5381 out_trace:
5382 	TRACE_2(TR_FAC_UFS, TR_UFS_PUTAPAGE_END,
5383 		"ufs_putapage_end:vp %p error %d", vp, err);
5384 	return (err);
5385 }
5386 
5387 /* ARGSUSED */
5388 static int
5389 ufs_map(struct vnode *vp,
5390 	offset_t off,
5391 	struct as *as,
5392 	caddr_t *addrp,
5393 	size_t len,
5394 	uchar_t prot,
5395 	uchar_t maxprot,
5396 	uint_t flags,
5397 	struct cred *cr)
5398 {
5399 	struct segvn_crargs vn_a;
5400 	struct ufsvfs *ufsvfsp = VTOI(vp)->i_ufsvfs;
5401 	struct ulockfs *ulp;
5402 	int error;
5403 
5404 	TRACE_1(TR_FAC_UFS, TR_UFS_MAP_START,
5405 		"ufs_map_start:vp %p", vp);
5406 
5407 	error = ufs_lockfs_begin(ufsvfsp, &ulp, ULOCKFS_MAP_MASK);
5408 	if (error)
5409 		goto out;
5410 
5411 	if (vp->v_flag & VNOMAP) {
5412 		error = ENOSYS;
5413 		goto unlock;
5414 	}
5415 
5416 	if (off < (offset_t)0 || (offset_t)(off + len) < (offset_t)0) {
5417 		error = ENXIO;
5418 		goto unlock;
5419 	}
5420 
5421 	if (vp->v_type != VREG) {
5422 		error = ENODEV;
5423 		goto unlock;
5424 	}
5425 
5426 	/*
5427 	 * If file is being locked, disallow mapping.
5428 	 */
5429 	if (vn_has_mandatory_locks(vp, VTOI(vp)->i_mode)) {
5430 		error = EAGAIN;
5431 		goto unlock;
5432 	}
5433 
5434 	as_rangelock(as);
5435 	if ((flags & MAP_FIXED) == 0) {
5436 		map_addr(addrp, len, off, 1, flags);
5437 		if (*addrp == NULL) {
5438 			as_rangeunlock(as);
5439 			error = ENOMEM;
5440 			goto unlock;
5441 		}
5442 	} else {
5443 		/*
5444 		 * User specified address - blow away any previous mappings
5445 		 */
5446 		(void) as_unmap(as, *addrp, len);
5447 	}
5448 
5449 	vn_a.vp = vp;
5450 	vn_a.offset = (u_offset_t)off;
5451 	vn_a.type = flags & MAP_TYPE;
5452 	vn_a.prot = prot;
5453 	vn_a.maxprot = maxprot;
5454 	vn_a.cred = cr;
5455 	vn_a.amp = NULL;
5456 	vn_a.flags = flags & ~MAP_TYPE;
5457 	vn_a.szc = 0;
5458 	vn_a.lgrp_mem_policy_flags = 0;
5459 
5460 	error = as_map(as, *addrp, len, segvn_create, &vn_a);
5461 	as_rangeunlock(as);
5462 
5463 unlock:
5464 	if (ulp) {
5465 		ufs_lockfs_end(ulp);
5466 	}
5467 out:
5468 	TRACE_2(TR_FAC_UFS, TR_UFS_MAP_END,
5469 		"ufs_map_end:vp %p error %d", vp, error);
5470 	return (error);
5471 }
5472 
5473 /* ARGSUSED */
5474 static int
5475 ufs_addmap(struct vnode *vp,
5476 	offset_t off,
5477 	struct as *as,
5478 	caddr_t addr,
5479 	size_t	len,
5480 	uchar_t  prot,
5481 	uchar_t  maxprot,
5482 	uint_t    flags,
5483 	struct cred *cr)
5484 {
5485 	struct inode *ip = VTOI(vp);
5486 
5487 	if (vp->v_flag & VNOMAP) {
5488 		return (ENOSYS);
5489 	}
5490 
5491 	mutex_enter(&ip->i_tlock);
5492 	ip->i_mapcnt += btopr(len);
5493 	mutex_exit(&ip->i_tlock);
5494 	return (0);
5495 }
5496 
5497 /*ARGSUSED*/
5498 static int
5499 ufs_delmap(struct vnode *vp, offset_t off, struct as *as, caddr_t addr,
5500 	size_t len, uint_t prot,  uint_t maxprot,  uint_t flags,
5501 	struct cred *cr)
5502 {
5503 	struct inode *ip = VTOI(vp);
5504 
5505 	if (vp->v_flag & VNOMAP) {
5506 		return (ENOSYS);
5507 	}
5508 
5509 	mutex_enter(&ip->i_tlock);
5510 	ip->i_mapcnt -= btopr(len); 	/* Count released mappings */
5511 	ASSERT(ip->i_mapcnt >= 0);
5512 	mutex_exit(&ip->i_tlock);
5513 	return (0);
5514 }
5515 /*
5516  * Return the answer requested to poll() for non-device files
5517  */
5518 struct pollhead ufs_pollhd;
5519 
5520 /* ARGSUSED */
5521 int
5522 ufs_poll(vnode_t *vp, short ev, int any, short *revp, struct pollhead **phpp)
5523 {
5524 	struct ufsvfs	*ufsvfsp;
5525 
5526 	*revp = 0;
5527 	ufsvfsp = VTOI(vp)->i_ufsvfs;
5528 
5529 	if (!ufsvfsp) {
5530 		*revp = POLLHUP;
5531 		goto out;
5532 	}
5533 
5534 	if (ULOCKFS_IS_HLOCK(&ufsvfsp->vfs_ulockfs) ||
5535 	    ULOCKFS_IS_ELOCK(&ufsvfsp->vfs_ulockfs)) {
5536 		*revp |= POLLERR;
5537 
5538 	} else {
5539 		if ((ev & POLLOUT) && !ufsvfsp->vfs_fs->fs_ronly &&
5540 		    !ULOCKFS_IS_WLOCK(&ufsvfsp->vfs_ulockfs))
5541 			*revp |= POLLOUT;
5542 
5543 		if ((ev & POLLWRBAND) && !ufsvfsp->vfs_fs->fs_ronly &&
5544 		    !ULOCKFS_IS_WLOCK(&ufsvfsp->vfs_ulockfs))
5545 			*revp |= POLLWRBAND;
5546 
5547 		if (ev & POLLIN)
5548 			*revp |= POLLIN;
5549 
5550 		if (ev & POLLRDNORM)
5551 			*revp |= POLLRDNORM;
5552 
5553 		if (ev & POLLRDBAND)
5554 			*revp |= POLLRDBAND;
5555 	}
5556 
5557 	if ((ev & POLLPRI) && (*revp & (POLLERR|POLLHUP)))
5558 		*revp |= POLLPRI;
5559 out:
5560 	*phpp = !any && !*revp ? &ufs_pollhd : (struct pollhead *)NULL;
5561 
5562 	return (0);
5563 }
5564 
5565 /* ARGSUSED */
5566 static int
5567 ufs_l_pathconf(struct vnode *vp, int cmd, ulong_t *valp, struct cred *cr)
5568 {
5569 	struct ufsvfs	*ufsvfsp = VTOI(vp)->i_ufsvfs;
5570 	struct ulockfs	*ulp = NULL;
5571 	struct inode 	*sip = NULL;
5572 	int		error;
5573 	struct inode 	*ip = VTOI(vp);
5574 	int		issync;
5575 
5576 	error = ufs_lockfs_begin(ufsvfsp, &ulp, ULOCKFS_PATHCONF_MASK);
5577 	if (error)
5578 		return (error);
5579 
5580 	switch (cmd) {
5581 		/*
5582 		 * Have to handle _PC_NAME_MAX here, because the normal way
5583 		 * [fs_pathconf() -> VOP_STATVFS() -> ufs_statvfs()]
5584 		 * results in a lock ordering reversal between
5585 		 * ufs_lockfs_{begin,end}() and
5586 		 * ufs_thread_{suspend,continue}().
5587 		 *
5588 		 * Keep in sync with ufs_statvfs().
5589 		 */
5590 	case _PC_NAME_MAX:
5591 		*valp = MAXNAMLEN;
5592 		break;
5593 
5594 	case _PC_FILESIZEBITS:
5595 		if (ufsvfsp->vfs_lfflags & UFS_LARGEFILES)
5596 			*valp = UFS_FILESIZE_BITS;
5597 		else
5598 			*valp = 32;
5599 		break;
5600 
5601 	case _PC_XATTR_EXISTS:
5602 		if (vp->v_vfsp->vfs_flag & VFS_XATTR) {
5603 
5604 			error = ufs_xattr_getattrdir(vp, &sip, LOOKUP_XATTR,
5605 							cr);
5606 			if (error ==  0 && sip != NULL) {
5607 				/* Start transaction */
5608 				if (ulp) {
5609 					TRANS_BEGIN_CSYNC(ufsvfsp, issync,
5610 					    TOP_RMDIR, TOP_RMDIR_SIZE);
5611 				}
5612 				/*
5613 				 * Is directory empty
5614 				 */
5615 				rw_enter(&sip->i_rwlock, RW_WRITER);
5616 				rw_enter(&sip->i_contents, RW_WRITER);
5617 				if (ufs_xattrdirempty(sip,
5618 						sip->i_number, CRED())) {
5619 					rw_enter(&ip->i_contents, RW_WRITER);
5620 					ufs_unhook_shadow(ip, sip);
5621 					rw_exit(&ip->i_contents);
5622 
5623 					*valp = 0;
5624 
5625 				} else
5626 					*valp = 1;
5627 				rw_exit(&sip->i_contents);
5628 				rw_exit(&sip->i_rwlock);
5629 				if (ulp) {
5630 					TRANS_END_CSYNC(ufsvfsp, error, issync,
5631 					    TOP_RMDIR, TOP_RMDIR_SIZE);
5632 				}
5633 				VN_RELE(ITOV(sip));
5634 			} else if (error == ENOENT) {
5635 				*valp = 0;
5636 				error = 0;
5637 			}
5638 		} else {
5639 			error = fs_pathconf(vp, cmd, valp, cr);
5640 		}
5641 		break;
5642 
5643 	case _PC_ACL_ENABLED:
5644 		*valp = _ACL_ACLENT_ENABLED;
5645 		break;
5646 
5647 	case _PC_MIN_HOLE_SIZE:
5648 		*valp = (ulong_t)ip->i_fs->fs_bsize;
5649 		break;
5650 
5651 	default:
5652 		error = fs_pathconf(vp, cmd, valp, cr);
5653 	}
5654 
5655 	if (ulp != NULL) {
5656 		ufs_lockfs_end(ulp);
5657 	}
5658 	return (error);
5659 }
5660 
5661 int ufs_pageio_writes, ufs_pageio_reads;
5662 
5663 /*ARGSUSED*/
5664 static int
5665 ufs_pageio(struct vnode *vp, page_t *pp, u_offset_t io_off, size_t io_len,
5666 	int flags, struct cred *cr)
5667 {
5668 	struct inode *ip = VTOI(vp);
5669 	struct ufsvfs *ufsvfsp;
5670 	page_t *npp = NULL, *opp = NULL, *cpp = pp;
5671 	struct buf *bp;
5672 	daddr_t bn;
5673 	size_t done_len = 0, cur_len = 0;
5674 	int err = 0;
5675 	int contig = 0;
5676 	int dolock;
5677 	int vmpss = 0;
5678 	struct ulockfs *ulp;
5679 
5680 	if ((flags & B_READ) && pp != NULL && pp->p_vnode == vp &&
5681 	    vp->v_mpssdata != NULL) {
5682 		vmpss = 1;
5683 	}
5684 
5685 	dolock = (rw_owner(&ip->i_contents) != curthread);
5686 	/*
5687 	 * We need a better check.  Ideally, we would use another
5688 	 * vnodeops so that hlocked and forcibly unmounted file
5689 	 * systems would return EIO where appropriate and w/o the
5690 	 * need for these checks.
5691 	 */
5692 	if ((ufsvfsp = ip->i_ufsvfs) == NULL)
5693 		return (EIO);
5694 
5695 	/*
5696 	 * For vmpss (pp can be NULL) case respect the quiesce protocol.
5697 	 * ul_lock must be taken before locking pages so we can't use it here
5698 	 * if pp is non NULL because segvn already locked pages
5699 	 * SE_EXCL. Instead we rely on the fact that a forced umount or
5700 	 * applying a filesystem lock via ufs_fiolfs() will block in the
5701 	 * implicit call to ufs_flush() until we unlock the pages after the
5702 	 * return to segvn. Other ufs_quiesce() callers keep ufs_quiesce_pend
5703 	 * above 0 until they are done. We have to be careful not to increment
5704 	 * ul_vnops_cnt here after forceful unmount hlocks the file system.
5705 	 *
5706 	 * If pp is NULL use ul_lock to make sure we don't increment
5707 	 * ul_vnops_cnt after forceful unmount hlocks the file system.
5708 	 */
5709 	if (vmpss || pp == NULL) {
5710 		ulp = &ufsvfsp->vfs_ulockfs;
5711 		if (pp == NULL)
5712 			mutex_enter(&ulp->ul_lock);
5713 		if (ulp->ul_fs_lock & ULOCKFS_GETREAD_MASK) {
5714 			if (pp == NULL) {
5715 				mutex_exit(&ulp->ul_lock);
5716 			}
5717 			return (vmpss ? EIO : EINVAL);
5718 		}
5719 		atomic_add_long(&ulp->ul_vnops_cnt, 1);
5720 		if (pp == NULL)
5721 			mutex_exit(&ulp->ul_lock);
5722 		if (ufs_quiesce_pend) {
5723 			if (!atomic_add_long_nv(&ulp->ul_vnops_cnt, -1))
5724 				cv_broadcast(&ulp->ul_cv);
5725 			return (vmpss ? EIO : EINVAL);
5726 		}
5727 	}
5728 
5729 	if (dolock) {
5730 		/*
5731 		 * segvn may call VOP_PAGEIO() instead of VOP_GETPAGE() to
5732 		 * handle a fault against a segment that maps vnode pages with
5733 		 * large mappings.  Segvn creates pages and holds them locked
5734 		 * SE_EXCL during VOP_PAGEIO() call. In this case we have to
5735 		 * use rw_tryenter() to avoid a potential deadlock since in
5736 		 * lock order i_contents needs to be taken first.
5737 		 * Segvn will retry via VOP_GETPAGE() if VOP_PAGEIO() fails.
5738 		 */
5739 		if (!vmpss) {
5740 			rw_enter(&ip->i_contents, RW_READER);
5741 		} else if (!rw_tryenter(&ip->i_contents, RW_READER)) {
5742 			if (!atomic_add_long_nv(&ulp->ul_vnops_cnt, -1))
5743 				cv_broadcast(&ulp->ul_cv);
5744 			return (EDEADLK);
5745 		}
5746 	}
5747 
5748 	/*
5749 	 * Return an error to segvn because the pagefault request is beyond
5750 	 * PAGESIZE rounded EOF.
5751 	 */
5752 	if (vmpss && btopr(io_off + io_len) > btopr(ip->i_size)) {
5753 		if (dolock)
5754 			rw_exit(&ip->i_contents);
5755 		if (!atomic_add_long_nv(&ulp->ul_vnops_cnt, -1))
5756 			cv_broadcast(&ulp->ul_cv);
5757 		return (EFAULT);
5758 	}
5759 
5760 	if (pp == NULL) {
5761 		if (bmap_has_holes(ip)) {
5762 			err = ENOSYS;
5763 		} else {
5764 			err = EINVAL;
5765 		}
5766 		if (dolock)
5767 			rw_exit(&ip->i_contents);
5768 		if (!atomic_add_long_nv(&ulp->ul_vnops_cnt, -1))
5769 			cv_broadcast(&ulp->ul_cv);
5770 		return (err);
5771 	}
5772 
5773 	/*
5774 	 * Break the io request into chunks, one for each contiguous
5775 	 * stretch of disk blocks in the target file.
5776 	 */
5777 	while (done_len < io_len) {
5778 		ASSERT(cpp);
5779 		contig = 0;
5780 		if (err = bmap_read(ip, (u_offset_t)(io_off + done_len),
5781 				    &bn, &contig))
5782 			break;
5783 
5784 		if (bn == UFS_HOLE) {	/* No holey swapfiles */
5785 			if (vmpss) {
5786 				err = EFAULT;
5787 				break;
5788 			}
5789 			err = ufs_fault(ITOV(ip), "ufs_pageio: bn == UFS_HOLE");
5790 			break;
5791 		}
5792 
5793 		cur_len = MIN(io_len - done_len, contig);
5794 		/*
5795 		 * Zero out a page beyond EOF, when the last block of
5796 		 * a file is a UFS fragment so that ufs_pageio() can be used
5797 		 * instead of ufs_getpage() to handle faults against
5798 		 * segvn segments that use large pages.
5799 		 */
5800 		page_list_break(&cpp, &npp, btopr(cur_len));
5801 		if ((flags & B_READ) && (cur_len & PAGEOFFSET)) {
5802 			size_t xlen = cur_len & PAGEOFFSET;
5803 			pagezero(cpp->p_prev, xlen, PAGESIZE - xlen);
5804 		}
5805 
5806 		bp = pageio_setup(cpp, cur_len, ip->i_devvp, flags);
5807 		ASSERT(bp != NULL);
5808 
5809 		bp->b_edev = ip->i_dev;
5810 		bp->b_dev = cmpdev(ip->i_dev);
5811 		bp->b_blkno = bn;
5812 		bp->b_un.b_addr = (caddr_t)0;
5813 		bp->b_file = ip->i_vnode;
5814 
5815 		ufsvfsp->vfs_iotstamp = lbolt;
5816 		ub.ub_pageios.value.ul++;
5817 		if (ufsvfsp->vfs_snapshot)
5818 			fssnap_strategy(&(ufsvfsp->vfs_snapshot), bp);
5819 		else
5820 			(void) bdev_strategy(bp);
5821 
5822 		if (flags & B_READ)
5823 			ufs_pageio_reads++;
5824 		else
5825 			ufs_pageio_writes++;
5826 		if (flags & B_READ)
5827 			lwp_stat_update(LWP_STAT_INBLK, 1);
5828 		else
5829 			lwp_stat_update(LWP_STAT_OUBLK, 1);
5830 		/*
5831 		 * If the request is not B_ASYNC, wait for i/o to complete
5832 		 * and re-assemble the page list to return to the caller.
5833 		 * If it is B_ASYNC we leave the page list in pieces and
5834 		 * cleanup() will dispose of them.
5835 		 */
5836 		if ((flags & B_ASYNC) == 0) {
5837 			err = biowait(bp);
5838 			pageio_done(bp);
5839 			if (err)
5840 				break;
5841 			page_list_concat(&opp, &cpp);
5842 		}
5843 		cpp = npp;
5844 		npp = NULL;
5845 		if (flags & B_READ)
5846 			cur_len = P2ROUNDUP_TYPED(cur_len, PAGESIZE, size_t);
5847 		done_len += cur_len;
5848 	}
5849 	ASSERT(err || (cpp == NULL && npp == NULL && done_len == io_len));
5850 	if (err) {
5851 		if (flags & B_ASYNC) {
5852 			/* Cleanup unprocessed parts of list */
5853 			page_list_concat(&cpp, &npp);
5854 			if (flags & B_READ)
5855 				pvn_read_done(cpp, B_ERROR);
5856 			else
5857 				pvn_write_done(cpp, B_ERROR);
5858 		} else {
5859 			/* Re-assemble list and let caller clean up */
5860 			page_list_concat(&opp, &cpp);
5861 			page_list_concat(&opp, &npp);
5862 		}
5863 	}
5864 
5865 	if (vmpss && !(ip->i_flag & IACC) && !ULOCKFS_IS_NOIACC(ulp) &&
5866 	    ufsvfsp->vfs_fs->fs_ronly == 0 && !ufsvfsp->vfs_noatime) {
5867 		mutex_enter(&ip->i_tlock);
5868 		ip->i_flag |= IACC;
5869 		ITIMES_NOLOCK(ip);
5870 		mutex_exit(&ip->i_tlock);
5871 	}
5872 
5873 	if (dolock)
5874 		rw_exit(&ip->i_contents);
5875 	if (vmpss && !atomic_add_long_nv(&ulp->ul_vnops_cnt, -1))
5876 		cv_broadcast(&ulp->ul_cv);
5877 	return (err);
5878 }
5879 
5880 /*
5881  * Called when the kernel is in a frozen state to dump data
5882  * directly to the device. It uses a private dump data structure,
5883  * set up by dump_ctl, to locate the correct disk block to which to dump.
5884  */
5885 static int
5886 ufs_dump(vnode_t *vp, caddr_t addr, int ldbn, int dblks)
5887 {
5888 	u_offset_t	file_size;
5889 	struct inode    *ip = VTOI(vp);
5890 	struct fs	*fs = ip->i_fs;
5891 	daddr_t		dbn, lfsbn;
5892 	int		disk_blks = fs->fs_bsize >> DEV_BSHIFT;
5893 	int		error = 0;
5894 	int		ndbs, nfsbs;
5895 
5896 	/*
5897 	 * forced unmount case
5898 	 */
5899 	if (ip->i_ufsvfs == NULL)
5900 		return (EIO);
5901 	/*
5902 	 * Validate the inode that it has not been modified since
5903 	 * the dump structure is allocated.
5904 	 */
5905 	mutex_enter(&ip->i_tlock);
5906 	if ((dump_info == NULL) ||
5907 	    (dump_info->ip != ip) ||
5908 	    (dump_info->time.tv_sec != ip->i_mtime.tv_sec) ||
5909 	    (dump_info->time.tv_usec != ip->i_mtime.tv_usec)) {
5910 		mutex_exit(&ip->i_tlock);
5911 		return (-1);
5912 	}
5913 	mutex_exit(&ip->i_tlock);
5914 
5915 	/*
5916 	 * See that the file has room for this write
5917 	 */
5918 	UFS_GET_ISIZE(&file_size, ip);
5919 
5920 	if (ldbtob((offset_t)(ldbn + dblks)) > file_size)
5921 		return (ENOSPC);
5922 
5923 	/*
5924 	 * Find the physical disk block numbers from the dump
5925 	 * private data structure directly and write out the data
5926 	 * in contiguous block lumps
5927 	 */
5928 	while (dblks > 0 && !error) {
5929 		lfsbn = (daddr_t)lblkno(fs, ldbtob((offset_t)ldbn));
5930 		dbn = fsbtodb(fs, dump_info->dblk[lfsbn]) + ldbn % disk_blks;
5931 		nfsbs = 1;
5932 		ndbs = disk_blks - ldbn % disk_blks;
5933 		while (ndbs < dblks && fsbtodb(fs, dump_info->dblk[lfsbn +
5934 		    nfsbs]) == dbn + ndbs) {
5935 			nfsbs++;
5936 			ndbs += disk_blks;
5937 		}
5938 		if (ndbs > dblks)
5939 			ndbs = dblks;
5940 		error = bdev_dump(ip->i_dev, addr, dbn, ndbs);
5941 		addr += ldbtob((offset_t)ndbs);
5942 		dblks -= ndbs;
5943 		ldbn += ndbs;
5944 	}
5945 	return (error);
5946 
5947 }
5948 
5949 /*
5950  * Prepare the file system before and after the dump operation.
5951  *
5952  * action = DUMP_ALLOC:
5953  * Preparation before dump, allocate dump private data structure
5954  * to hold all the direct and indirect block info for dump.
5955  *
5956  * action = DUMP_FREE:
5957  * Clean up after dump, deallocate the dump private data structure.
5958  *
5959  * action = DUMP_SCAN:
5960  * Scan dump_info for *blkp DEV_BSIZE blocks of contig fs space;
5961  * if found, the starting file-relative DEV_BSIZE lbn is written
5962  * to *bklp; that lbn is intended for use with VOP_DUMP()
5963  */
5964 static int
5965 ufs_dumpctl(vnode_t *vp, int action, int *blkp)
5966 {
5967 	struct inode	*ip = VTOI(vp);
5968 	ufsvfs_t	*ufsvfsp = ip->i_ufsvfs;
5969 	struct fs	*fs;
5970 	daddr32_t	*dblk, *storeblk;
5971 	daddr32_t	*nextblk, *endblk;
5972 	struct buf	*bp;
5973 	int		i, entry, entries;
5974 	int		n, ncontig;
5975 
5976 	/*
5977 	 * check for forced unmount
5978 	 */
5979 	if (ufsvfsp == NULL)
5980 		return (EIO);
5981 
5982 	if (action == DUMP_ALLOC) {
5983 		/*
5984 		 * alloc and record dump_info
5985 		 */
5986 		if (dump_info != NULL)
5987 			return (EINVAL);
5988 
5989 		ASSERT(vp->v_type == VREG);
5990 		fs = ufsvfsp->vfs_fs;
5991 
5992 		rw_enter(&ip->i_contents, RW_READER);
5993 
5994 		if (bmap_has_holes(ip)) {
5995 			rw_exit(&ip->i_contents);
5996 			return (EFAULT);
5997 		}
5998 
5999 		/*
6000 		 * calculate and allocate space needed according to i_size
6001 		 */
6002 		entries = (int)lblkno(fs, blkroundup(fs, ip->i_size));
6003 		if ((dump_info = (struct dump *)
6004 		    kmem_alloc(sizeof (struct dump) +
6005 		    (entries - 1) * sizeof (daddr32_t), KM_NOSLEEP)) == NULL) {
6006 			    rw_exit(&ip->i_contents);
6007 			    return (ENOMEM);
6008 		}
6009 
6010 		/* Start saving the info */
6011 		dump_info->fsbs = entries;
6012 		dump_info->ip = ip;
6013 		storeblk = &dump_info->dblk[0];
6014 
6015 		/* Direct Blocks */
6016 		for (entry = 0; entry < NDADDR && entry < entries; entry++)
6017 			*storeblk++ = ip->i_db[entry];
6018 
6019 		/* Indirect Blocks */
6020 		for (i = 0; i < NIADDR; i++) {
6021 			int error = 0;
6022 
6023 			bp = UFS_BREAD(ufsvfsp,
6024 				ip->i_dev, fsbtodb(fs, ip->i_ib[i]),
6025 				fs->fs_bsize);
6026 			if (bp->b_flags & B_ERROR)
6027 				error = EIO;
6028 			else {
6029 				dblk = bp->b_un.b_daddr;
6030 				if ((storeblk = save_dblks(ip, ufsvfsp,
6031 				    storeblk, dblk, i, entries)) == NULL)
6032 					error = EIO;
6033 			}
6034 
6035 			brelse(bp);
6036 
6037 			if (error != 0) {
6038 				kmem_free(dump_info, sizeof (struct dump) +
6039 				    (entries - 1) * sizeof (daddr32_t));
6040 				rw_exit(&ip->i_contents);
6041 				dump_info = NULL;
6042 				return (error);
6043 			}
6044 		}
6045 		/* and time stamp the information */
6046 		mutex_enter(&ip->i_tlock);
6047 		dump_info->time = ip->i_mtime;
6048 		mutex_exit(&ip->i_tlock);
6049 
6050 		rw_exit(&ip->i_contents);
6051 	} else if (action == DUMP_FREE) {
6052 		/*
6053 		 * free dump_info
6054 		 */
6055 		if (dump_info == NULL)
6056 			return (EINVAL);
6057 		entries = dump_info->fsbs - 1;
6058 		kmem_free(dump_info, sizeof (struct dump) +
6059 		    entries * sizeof (daddr32_t));
6060 		dump_info = NULL;
6061 	} else if (action == DUMP_SCAN) {
6062 		/*
6063 		 * scan dump_info
6064 		 */
6065 		if (dump_info == NULL)
6066 			return (EINVAL);
6067 
6068 		dblk = dump_info->dblk;
6069 		nextblk = dblk + 1;
6070 		endblk = dblk + dump_info->fsbs - 1;
6071 		fs = ufsvfsp->vfs_fs;
6072 		ncontig = *blkp >> (fs->fs_bshift - DEV_BSHIFT);
6073 
6074 		/*
6075 		 * scan dblk[] entries; contig fs space is found when:
6076 		 * ((current blkno + frags per block) == next blkno)
6077 		 */
6078 		n = 0;
6079 		while (n < ncontig && dblk < endblk) {
6080 			if ((*dblk + fs->fs_frag) == *nextblk)
6081 				n++;
6082 			else
6083 				n = 0;
6084 			dblk++;
6085 			nextblk++;
6086 		}
6087 
6088 		/*
6089 		 * index is where size bytes of contig space begins;
6090 		 * conversion from index to the file's DEV_BSIZE lbn
6091 		 * is equivalent to:  (index * fs_bsize) / DEV_BSIZE
6092 		 */
6093 		if (n == ncontig) {
6094 			i = (dblk - dump_info->dblk) - ncontig;
6095 			*blkp = i << (fs->fs_bshift - DEV_BSHIFT);
6096 		} else
6097 			return (EFAULT);
6098 	}
6099 	return (0);
6100 }
6101 
6102 /*
6103  * Recursive helper function for ufs_dumpctl().  It follows the indirect file
6104  * system  blocks until it reaches the the disk block addresses, which are
6105  * then stored into the given buffer, storeblk.
6106  */
6107 static daddr32_t *
6108 save_dblks(struct inode *ip, struct ufsvfs *ufsvfsp,  daddr32_t *storeblk,
6109     daddr32_t *dblk, int level, int entries)
6110 {
6111 	struct fs	*fs = ufsvfsp->vfs_fs;
6112 	struct buf	*bp;
6113 	int		i;
6114 
6115 	if (level == 0) {
6116 		for (i = 0; i < NINDIR(fs); i++) {
6117 			if (storeblk - dump_info->dblk >= entries)
6118 				break;
6119 			*storeblk++ = dblk[i];
6120 		}
6121 		return (storeblk);
6122 	}
6123 	for (i = 0; i < NINDIR(fs); i++) {
6124 		if (storeblk - dump_info->dblk >= entries)
6125 			break;
6126 		bp = UFS_BREAD(ufsvfsp,
6127 				ip->i_dev, fsbtodb(fs, dblk[i]), fs->fs_bsize);
6128 		if (bp->b_flags & B_ERROR) {
6129 			brelse(bp);
6130 			return (NULL);
6131 		}
6132 		storeblk = save_dblks(ip, ufsvfsp, storeblk, bp->b_un.b_daddr,
6133 		    level - 1, entries);
6134 		brelse(bp);
6135 
6136 		if (storeblk == NULL)
6137 			return (NULL);
6138 	}
6139 	return (storeblk);
6140 }
6141 
6142 /* ARGSUSED */
6143 static int
6144 ufs_getsecattr(struct vnode *vp, vsecattr_t *vsap, int flag,
6145 	struct cred *cr)
6146 {
6147 	struct inode	*ip = VTOI(vp);
6148 	struct ulockfs	*ulp;
6149 	struct ufsvfs	*ufsvfsp = ip->i_ufsvfs;
6150 	ulong_t		vsa_mask = vsap->vsa_mask;
6151 	int		err = EINVAL;
6152 
6153 	TRACE_3(TR_FAC_UFS, TR_UFS_GETSECATTR_START,
6154 	    "ufs_getsecattr_start:vp %p, vsap %p, flags %x", vp, vsap, flag);
6155 
6156 	vsa_mask &= (VSA_ACL | VSA_ACLCNT | VSA_DFACL | VSA_DFACLCNT);
6157 
6158 	/*
6159 	 * Only grab locks if needed - they're not needed to check vsa_mask
6160 	 * or if the mask contains no acl flags.
6161 	 */
6162 	if (vsa_mask != 0) {
6163 		if (err = ufs_lockfs_begin(ufsvfsp, &ulp,
6164 		    ULOCKFS_GETATTR_MASK))
6165 			return (err);
6166 
6167 		rw_enter(&ip->i_contents, RW_READER);
6168 		err = ufs_acl_get(ip, vsap, flag, cr);
6169 		rw_exit(&ip->i_contents);
6170 
6171 		if (ulp)
6172 			ufs_lockfs_end(ulp);
6173 	}
6174 	TRACE_1(TR_FAC_UFS, TR_UFS_GETSECATTR_END,
6175 	    "ufs_getsecattr_end:vp %p", vp);
6176 	return (err);
6177 }
6178 
6179 /* ARGSUSED */
6180 static int
6181 ufs_setsecattr(struct vnode *vp, vsecattr_t *vsap, int flag, struct cred *cr)
6182 {
6183 	struct inode	*ip = VTOI(vp);
6184 	struct ulockfs	*ulp = NULL;
6185 	struct ufsvfs	*ufsvfsp = VTOI(vp)->i_ufsvfs;
6186 	ulong_t		vsa_mask = vsap->vsa_mask;
6187 	int		err;
6188 	int		haverwlock = 1;
6189 	int		trans_size;
6190 	int		donetrans = 0;
6191 	int		retry = 1;
6192 
6193 
6194 	TRACE_3(TR_FAC_UFS, TR_UFS_SETSECATTR_START,
6195 	    "ufs_setsecattr_start:vp %p, vsap %p, flags %x", vp, vsap, flag);
6196 
6197 	ASSERT(RW_LOCK_HELD(&ip->i_rwlock));
6198 
6199 	/* Abort now if the request is either empty or invalid. */
6200 	vsa_mask &= (VSA_ACL | VSA_ACLCNT | VSA_DFACL | VSA_DFACLCNT);
6201 	if ((vsa_mask == 0) ||
6202 	    ((vsap->vsa_aclentp == NULL) &&
6203 	    (vsap->vsa_dfaclentp == NULL))) {
6204 		err = EINVAL;
6205 		goto out;
6206 	}
6207 
6208 	/*
6209 	 * Following convention, if this is a directory then we acquire the
6210 	 * inode's i_rwlock after starting a UFS logging transaction;
6211 	 * otherwise, we acquire it beforehand. Since we were called (and
6212 	 * must therefore return) with the lock held, we will have to drop it,
6213 	 * and later reacquire it, if operating on a directory.
6214 	 */
6215 	if (vp->v_type == VDIR) {
6216 		rw_exit(&ip->i_rwlock);
6217 		haverwlock = 0;
6218 	} else {
6219 		/* Upgrade the lock if required. */
6220 		if (!rw_write_held(&ip->i_rwlock)) {
6221 			rw_exit(&ip->i_rwlock);
6222 			rw_enter(&ip->i_rwlock, RW_WRITER);
6223 		}
6224 	}
6225 
6226 again:
6227 	ASSERT(!(vp->v_type == VDIR && haverwlock));
6228 	if (err = ufs_lockfs_begin(ufsvfsp, &ulp, ULOCKFS_SETATTR_MASK)) {
6229 		ulp = NULL;
6230 		retry = 0;
6231 		goto out;
6232 	}
6233 
6234 	/*
6235 	 * Check that the file system supports this operation. Note that
6236 	 * ufs_lockfs_begin() will have checked that the file system had
6237 	 * not been forcibly unmounted.
6238 	 */
6239 	if (ufsvfsp->vfs_fs->fs_ronly) {
6240 		err = EROFS;
6241 		goto out;
6242 	}
6243 	if (ufsvfsp->vfs_nosetsec) {
6244 		err = ENOSYS;
6245 		goto out;
6246 	}
6247 
6248 	if (ulp) {
6249 		TRANS_BEGIN_ASYNC(ufsvfsp, TOP_SETSECATTR,
6250 			trans_size = TOP_SETSECATTR_SIZE(VTOI(vp)));
6251 		donetrans = 1;
6252 	}
6253 
6254 	if (vp->v_type == VDIR) {
6255 		rw_enter(&ip->i_rwlock, RW_WRITER);
6256 		haverwlock = 1;
6257 	}
6258 
6259 	ASSERT(haverwlock);
6260 
6261 	/* Do the actual work. */
6262 	rw_enter(&ip->i_contents, RW_WRITER);
6263 	/*
6264 	 * Suppress out of inodes messages if we will retry.
6265 	 */
6266 	if (retry)
6267 		ip->i_flag |= IQUIET;
6268 	err = ufs_acl_set(ip, vsap, flag, cr);
6269 	ip->i_flag &= ~IQUIET;
6270 	rw_exit(&ip->i_contents);
6271 
6272 out:
6273 	if (ulp) {
6274 		if (donetrans) {
6275 			/*
6276 			 * top_end_async() can eventually call
6277 			 * top_end_sync(), which can block. We must
6278 			 * therefore observe the lock-ordering protocol
6279 			 * here as well.
6280 			 */
6281 			if (vp->v_type == VDIR) {
6282 				rw_exit(&ip->i_rwlock);
6283 				haverwlock = 0;
6284 			}
6285 			TRANS_END_ASYNC(ufsvfsp, TOP_SETSECATTR, trans_size);
6286 		}
6287 		ufs_lockfs_end(ulp);
6288 	}
6289 	/*
6290 	 * If no inodes available, try scaring a logically-
6291 	 * free one out of the delete queue to someplace
6292 	 * that we can find it.
6293 	 */
6294 	if ((err == ENOSPC) && retry && TRANS_ISTRANS(ufsvfsp)) {
6295 		ufs_delete_drain_wait(ufsvfsp, 1);
6296 		retry = 0;
6297 		if (vp->v_type == VDIR && haverwlock) {
6298 			rw_exit(&ip->i_rwlock);
6299 			haverwlock = 0;
6300 		}
6301 		goto again;
6302 	}
6303 	/*
6304 	 * If we need to reacquire the lock then it is safe to do so
6305 	 * as a reader. This is because ufs_rwunlock(), which will be
6306 	 * called by our caller after we return, does not differentiate
6307 	 * between shared and exclusive locks.
6308 	 */
6309 	if (!haverwlock) {
6310 		ASSERT(vp->v_type == VDIR);
6311 		rw_enter(&ip->i_rwlock, RW_READER);
6312 	}
6313 
6314 	TRACE_1(TR_FAC_UFS, TR_UFS_SETSECATTR_END,
6315 	    "ufs_setsecattr_end:vp %p", vp);
6316 	return (err);
6317 }
6318