xref: /illumos-gate/usr/src/uts/common/fs/ufs/ufs_vnops.c (revision 02e56f3f)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License, Version 1.0 only
6  * (the "License").  You may not use this file except in compliance
7  * with the License.
8  *
9  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
10  * or http://www.opensolaris.org/os/licensing.
11  * See the License for the specific language governing permissions
12  * and limitations under the License.
13  *
14  * When distributing Covered Code, include this CDDL HEADER in each
15  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
16  * If applicable, add the following below this CDDL HEADER, with the
17  * fields enclosed by brackets "[]" replaced with your own identifying
18  * information: Portions Copyright [yyyy] [name of copyright owner]
19  *
20  * CDDL HEADER END
21  */
22 /*
23  * Copyright 2005 Sun Microsystems, Inc.  All rights reserved.
24  * Use is subject to license terms.
25  */
26 
27 /*	Copyright (c) 1983, 1984, 1985, 1986, 1987, 1988, 1989 AT&T	*/
28 /*	  All Rights Reserved  	*/
29 
30 /*
31  * Portions of this source code were derived from Berkeley 4.3 BSD
32  * under license from the Regents of the University of California.
33  */
34 
35 #pragma ident	"%Z%%M%	%I%	%E% SMI"
36 
37 #include <sys/types.h>
38 #include <sys/t_lock.h>
39 #include <sys/ksynch.h>
40 #include <sys/param.h>
41 #include <sys/time.h>
42 #include <sys/systm.h>
43 #include <sys/sysmacros.h>
44 #include <sys/resource.h>
45 #include <sys/signal.h>
46 #include <sys/cred.h>
47 #include <sys/user.h>
48 #include <sys/buf.h>
49 #include <sys/vfs.h>
50 #include <sys/vnode.h>
51 #include <sys/proc.h>
52 #include <sys/disp.h>
53 #include <sys/file.h>
54 #include <sys/fcntl.h>
55 #include <sys/flock.h>
56 #include <sys/atomic.h>
57 #include <sys/kmem.h>
58 #include <sys/uio.h>
59 #include <sys/dnlc.h>
60 #include <sys/conf.h>
61 #include <sys/mman.h>
62 #include <sys/pathname.h>
63 #include <sys/debug.h>
64 #include <sys/vmsystm.h>
65 #include <sys/cmn_err.h>
66 #include <sys/vtrace.h>
67 #include <sys/filio.h>
68 #include <sys/policy.h>
69 
70 #include <sys/fs/ufs_fs.h>
71 #include <sys/fs/ufs_lockfs.h>
72 #include <sys/fs/ufs_filio.h>
73 #include <sys/fs/ufs_inode.h>
74 #include <sys/fs/ufs_fsdir.h>
75 #include <sys/fs/ufs_quota.h>
76 #include <sys/fs/ufs_log.h>
77 #include <sys/fs/ufs_snap.h>
78 #include <sys/fs/ufs_trans.h>
79 #include <sys/fs/ufs_panic.h>
80 #include <sys/fs/ufs_bio.h>
81 #include <sys/dirent.h>		/* must be AFTER <sys/fs/fsdir.h>! */
82 #include <sys/errno.h>
83 #include <sys/fssnap_if.h>
84 #include <sys/unistd.h>
85 #include <sys/sunddi.h>
86 
87 #include <sys/filio.h>		/* _FIOIO */
88 
89 #include <vm/hat.h>
90 #include <vm/page.h>
91 #include <vm/pvn.h>
92 #include <vm/as.h>
93 #include <vm/seg.h>
94 #include <vm/seg_map.h>
95 #include <vm/seg_vn.h>
96 #include <vm/seg_kmem.h>
97 #include <vm/rm.h>
98 #include <sys/swap.h>
99 
100 #include <fs/fs_subr.h>
101 
102 static struct instats ins;
103 
104 static 	int ufs_getpage_ra(struct vnode *, u_offset_t, struct seg *, caddr_t);
105 static	int ufs_getpage_miss(struct vnode *, u_offset_t, size_t, struct seg *,
106 		caddr_t, struct page **, size_t, enum seg_rw, int);
107 static	int ufs_open(struct vnode **, int, struct cred *);
108 static	int ufs_close(struct vnode *, int, int, offset_t, struct cred *);
109 static	int ufs_read(struct vnode *, struct uio *, int, struct cred *,
110 			struct caller_context *);
111 static	int ufs_write(struct vnode *, struct uio *, int, struct cred *,
112 			struct caller_context *);
113 static	int ufs_ioctl(struct vnode *, int, intptr_t, int, struct cred *, int *);
114 static	int ufs_getattr(struct vnode *, struct vattr *, int, struct cred *);
115 static	int ufs_setattr(struct vnode *, struct vattr *, int, struct cred *,
116 			caller_context_t *);
117 static	int ufs_access(struct vnode *, int, int, struct cred *);
118 static	int ufs_lookup(struct vnode *, char *, struct vnode **,
119 		struct pathname *, int, struct vnode *, struct cred *);
120 static	int ufs_create(struct vnode *, char *, struct vattr *, enum vcexcl,
121 			int, struct vnode **, struct cred *, int);
122 static	int ufs_remove(struct vnode *, char *, struct cred *);
123 static	int ufs_link(struct vnode *, struct vnode *, char *, struct cred *);
124 static	int ufs_rename(struct vnode *, char *, struct vnode *, char *,
125 			struct cred *);
126 static	int ufs_mkdir(struct vnode *, char *, struct vattr *, struct vnode **,
127 			struct cred *);
128 static	int ufs_rmdir(struct vnode *, char *, struct vnode *, struct cred *);
129 static	int ufs_readdir(struct vnode *, struct uio *, struct cred *, int *);
130 static	int ufs_symlink(struct vnode *, char *, struct vattr *, char *,
131 			struct cred *);
132 static	int ufs_readlink(struct vnode *, struct uio *, struct cred *);
133 static	int ufs_fsync(struct vnode *, int, struct cred *);
134 static	void ufs_inactive(struct vnode *, struct cred *);
135 static	int ufs_fid(struct vnode *, struct fid *);
136 static	int ufs_rwlock(struct vnode *, int, caller_context_t *);
137 static	void ufs_rwunlock(struct vnode *, int, caller_context_t *);
138 static	int ufs_seek(struct vnode *, offset_t, offset_t *);
139 static	int ufs_frlock(struct vnode *, int, struct flock64 *, int, offset_t,
140 			struct flk_callback *, struct cred *);
141 static  int ufs_space(struct vnode *, int, struct flock64 *, int, offset_t,
142 		cred_t *, caller_context_t *);
143 static	int ufs_getpage(struct vnode *, offset_t, size_t, uint_t *,
144 		struct page **, size_t, struct seg *, caddr_t,
145 		enum seg_rw, struct cred *);
146 static	int ufs_putpage(struct vnode *, offset_t, size_t, int, struct cred *);
147 static	int ufs_putpages(struct vnode *, offset_t, size_t, int, struct cred *);
148 static	int ufs_map(struct vnode *, offset_t, struct as *, caddr_t *, size_t,
149 			uchar_t, uchar_t, uint_t, struct cred *);
150 static	int ufs_addmap(struct vnode *, offset_t, struct as *, caddr_t,  size_t,
151 			uchar_t, uchar_t, uint_t, struct cred *);
152 static	int ufs_delmap(struct vnode *, offset_t, struct as *, caddr_t,  size_t,
153 			uint_t, uint_t, uint_t, struct cred *);
154 static	int ufs_poll(vnode_t *, short, int, short *, struct pollhead **);
155 static	int ufs_dump(vnode_t *, caddr_t, int, int);
156 static	int ufs_l_pathconf(struct vnode *, int, ulong_t *, struct cred *);
157 static	int ufs_pageio(struct vnode *, struct page *, u_offset_t, size_t, int,
158 			struct cred *);
159 static	int ufs_dump(vnode_t *, caddr_t, int, int);
160 static	int ufs_dumpctl(vnode_t *, int, int *);
161 static	daddr32_t *save_dblks(struct inode *, struct ufsvfs *, daddr32_t *,
162 			daddr32_t *, int, int);
163 static	int ufs_getsecattr(struct vnode *, vsecattr_t *, int, struct cred *);
164 static	int ufs_setsecattr(struct vnode *, vsecattr_t *, int, struct cred *);
165 
166 /*
167  * For lockfs: ulockfs begin/end is now inlined in the ufs_xxx functions.
168  *
169  * XXX - ULOCKFS in fs_pathconf and ufs_ioctl is not inlined yet.
170  */
171 struct vnodeops *ufs_vnodeops;
172 
173 const fs_operation_def_t ufs_vnodeops_template[] = {
174 	VOPNAME_OPEN, ufs_open,	/* will not be blocked by lockfs */
175 	VOPNAME_CLOSE, ufs_close,	/* will not be blocked by lockfs */
176 	VOPNAME_READ, ufs_read,
177 	VOPNAME_WRITE, ufs_write,
178 	VOPNAME_IOCTL, ufs_ioctl,
179 	VOPNAME_GETATTR, ufs_getattr,
180 	VOPNAME_SETATTR, ufs_setattr,
181 	VOPNAME_ACCESS, ufs_access,
182 	VOPNAME_LOOKUP, ufs_lookup,
183 	VOPNAME_CREATE, ufs_create,
184 	VOPNAME_REMOVE, ufs_remove,
185 	VOPNAME_LINK, ufs_link,
186 	VOPNAME_RENAME, ufs_rename,
187 	VOPNAME_MKDIR, ufs_mkdir,
188 	VOPNAME_RMDIR, ufs_rmdir,
189 	VOPNAME_READDIR, ufs_readdir,
190 	VOPNAME_SYMLINK, ufs_symlink,
191 	VOPNAME_READLINK, ufs_readlink,
192 	VOPNAME_FSYNC, ufs_fsync,
193 	VOPNAME_INACTIVE, (fs_generic_func_p) ufs_inactive,  /* not blocked */
194 	VOPNAME_FID, ufs_fid,
195 	VOPNAME_RWLOCK, ufs_rwlock, /* not blocked */
196 	VOPNAME_RWUNLOCK, (fs_generic_func_p) ufs_rwunlock,  /* not blocked */
197 	VOPNAME_SEEK, ufs_seek,
198 	VOPNAME_FRLOCK, ufs_frlock,
199 	VOPNAME_SPACE, ufs_space,
200 	VOPNAME_GETPAGE, ufs_getpage,
201 	VOPNAME_PUTPAGE, ufs_putpage,
202 	VOPNAME_MAP, (fs_generic_func_p) ufs_map,
203 	VOPNAME_ADDMAP, (fs_generic_func_p) ufs_addmap,	/* not blocked */
204 	VOPNAME_DELMAP, ufs_delmap,	/* will not be blocked by lockfs */
205 	VOPNAME_POLL, (fs_generic_func_p) ufs_poll,	/* not blocked */
206 	VOPNAME_DUMP, ufs_dump,
207 	VOPNAME_PATHCONF, ufs_l_pathconf,
208 	VOPNAME_PAGEIO, ufs_pageio,
209 	VOPNAME_DUMPCTL, ufs_dumpctl,
210 	VOPNAME_GETSECATTR, ufs_getsecattr,
211 	VOPNAME_SETSECATTR, ufs_setsecattr,
212 	VOPNAME_VNEVENT, fs_vnevent_support,
213 	NULL, NULL
214 };
215 
216 #define	MAX_BACKFILE_COUNT	9999
217 
218 /*
219  * Created by ufs_dumpctl() to store a file's disk block info into memory.
220  * Used by ufs_dump() to dump data to disk directly.
221  */
222 struct dump {
223 	struct inode	*ip;		/* the file we contain */
224 	daddr_t		fsbs;		/* number of blocks stored */
225 	struct timeval32 time;		/* time stamp for the struct */
226 	daddr32_t 	dblk[1];	/* place holder for block info */
227 };
228 
229 static struct dump *dump_info = NULL;
230 
231 /*
232  * Previously there was no special action required for ordinary files.
233  * (Devices are handled through the device file system.)
234  * Now we support Large Files and Large File API requires open to
235  * fail if file is large.
236  * We could take care to prevent data corruption
237  * by doing an atomic check of size and truncate if file is opened with
238  * FTRUNC flag set but traditionally this is being done by the vfs/vnode
239  * layers. So taking care of truncation here is a change in the existing
240  * semantics of VOP_OPEN and therefore we chose not to implement any thing
241  * here. The check for the size of the file > 2GB is being done at the
242  * vfs layer in routine vn_open().
243  */
244 
245 /* ARGSUSED */
246 static int
247 ufs_open(struct vnode **vpp, int flag, struct cred *cr)
248 {
249 	TRACE_1(TR_FAC_UFS, TR_UFS_OPEN, "ufs_open:vpp %p", vpp);
250 	return (0);
251 }
252 
253 /*ARGSUSED*/
254 static int
255 ufs_close(struct vnode *vp, int flag, int count, offset_t offset,
256 	struct cred *cr)
257 {
258 	TRACE_1(TR_FAC_UFS, TR_UFS_CLOSE, "ufs_close:vp %p", vp);
259 
260 	cleanlocks(vp, ttoproc(curthread)->p_pid, 0);
261 	cleanshares(vp, ttoproc(curthread)->p_pid);
262 
263 	/*
264 	 * Push partially filled cluster at last close.
265 	 * ``last close'' is approximated because the dnlc
266 	 * may have a hold on the vnode.
267 	 * Checking for VBAD here will also act as a forced umount check.
268 	 */
269 	if (vp->v_count <= 2 && vp->v_type != VBAD) {
270 		struct inode *ip = VTOI(vp);
271 		if (ip->i_delaylen) {
272 			ins.in_poc.value.ul++;
273 			(void) ufs_putpages(vp, ip->i_delayoff, ip->i_delaylen,
274 					B_ASYNC | B_FREE, cr);
275 			ip->i_delaylen = 0;
276 		}
277 	}
278 
279 	return (0);
280 }
281 
282 /*ARGSUSED*/
283 static int
284 ufs_read(struct vnode *vp, struct uio *uiop, int ioflag, struct cred *cr,
285 	struct caller_context *ct)
286 {
287 	struct inode *ip = VTOI(vp);
288 	struct ufsvfs *ufsvfsp;
289 	struct ulockfs *ulp = NULL;
290 	int error = 0;
291 	int intrans = 0;
292 
293 	ASSERT(RW_READ_HELD(&ip->i_rwlock));
294 	TRACE_3(TR_FAC_UFS, TR_UFS_READ_START,
295 		"ufs_read_start:vp %p uiop %p ioflag %x",
296 		vp, uiop, ioflag);
297 
298 	/*
299 	 * Mandatory locking needs to be done before ufs_lockfs_begin()
300 	 * and TRANS_BEGIN_SYNC() calls since mandatory locks can sleep.
301 	 */
302 	if (MANDLOCK(vp, ip->i_mode)) {
303 		/*
304 		 * ufs_getattr ends up being called by chklock
305 		 */
306 		error = chklock(vp, FREAD, uiop->uio_loffset,
307 				uiop->uio_resid, uiop->uio_fmode, ct);
308 		if (error)
309 			goto out;
310 	}
311 
312 	ufsvfsp = ip->i_ufsvfs;
313 	error = ufs_lockfs_begin(ufsvfsp, &ulp, ULOCKFS_READ_MASK);
314 	if (error)
315 		goto out;
316 
317 	/*
318 	 * In the case that a directory is opened for reading as a file
319 	 * (eg "cat .") with the  O_RSYNC, O_SYNC and O_DSYNC flags set.
320 	 * The locking order had to be changed to avoid a deadlock with
321 	 * an update taking place on that directory at the same time.
322 	 */
323 	if ((ip->i_mode & IFMT) == IFDIR) {
324 
325 		rw_enter(&ip->i_contents, RW_READER);
326 		error = rdip(ip, uiop, ioflag, cr);
327 		rw_exit(&ip->i_contents);
328 
329 		if (error) {
330 			if (ulp)
331 				ufs_lockfs_end(ulp);
332 			goto out;
333 		}
334 
335 		if (ulp && (ioflag & FRSYNC) && (ioflag & (FSYNC | FDSYNC)) &&
336 		    TRANS_ISTRANS(ufsvfsp)) {
337 			rw_exit(&ip->i_rwlock);
338 			TRANS_BEGIN_SYNC(ufsvfsp, TOP_READ_SYNC, TOP_READ_SIZE,
339 			    error);
340 			ASSERT(!error);
341 			TRANS_END_SYNC(ufsvfsp, error, TOP_READ_SYNC,
342 			    TOP_READ_SIZE);
343 			rw_enter(&ip->i_rwlock, RW_READER);
344 		}
345 	} else {
346 		/*
347 		 * Only transact reads to files opened for sync-read and
348 		 * sync-write on a file system that is not write locked.
349 		 *
350 		 * The ``not write locked'' check prevents problems with
351 		 * enabling/disabling logging on a busy file system.  E.g.,
352 		 * logging exists at the beginning of the read but does not
353 		 * at the end.
354 		 *
355 		 */
356 		if (ulp && (ioflag & FRSYNC) && (ioflag & (FSYNC | FDSYNC)) &&
357 		    TRANS_ISTRANS(ufsvfsp)) {
358 			TRANS_BEGIN_SYNC(ufsvfsp, TOP_READ_SYNC, TOP_READ_SIZE,
359 			    error);
360 			ASSERT(!error);
361 			intrans = 1;
362 		}
363 
364 		rw_enter(&ip->i_contents, RW_READER);
365 		error = rdip(ip, uiop, ioflag, cr);
366 		rw_exit(&ip->i_contents);
367 
368 		if (intrans) {
369 			TRANS_END_SYNC(ufsvfsp, error, TOP_READ_SYNC,
370 			    TOP_READ_SIZE);
371 		}
372 	}
373 
374 	if (ulp) {
375 		ufs_lockfs_end(ulp);
376 	}
377 out:
378 
379 	TRACE_2(TR_FAC_UFS, TR_UFS_READ_END,
380 		"ufs_read_end:vp %p error %d", vp, error);
381 	return (error);
382 }
383 
384 extern	int	ufs_HW;		/* high water mark */
385 extern	int	ufs_LW;		/* low water mark */
386 int	ufs_WRITES = 1;		/* XXX - enable/disable */
387 int	ufs_throttles = 0;	/* throttling count */
388 int	ufs_allow_shared_writes = 1;	/* directio shared writes */
389 
390 static int
391 ufs_check_rewrite(struct inode *ip, struct uio *uiop, int ioflag)
392 {
393 
394 	/*
395 	 * Filter to determine if this request is suitable as a
396 	 * concurrent rewrite. This write must not allocate blocks
397 	 * by extending the file or filling in holes. No use trying
398 	 * through FSYNC descriptors as the inode will be synchronously
399 	 * updated after the write. The uio structure has not yet been
400 	 * checked for sanity, so assume nothing.
401 	 */
402 	return (((ip->i_mode & IFMT) == IFREG) && !(ioflag & FAPPEND) &&
403 		(uiop->uio_loffset >= (offset_t)0) &&
404 		(uiop->uio_loffset < ip->i_size) && (uiop->uio_resid > 0) &&
405 		((ip->i_size - uiop->uio_loffset) >= uiop->uio_resid) &&
406 		!(ioflag & FSYNC) && !bmap_has_holes(ip) &&
407 		ufs_allow_shared_writes);
408 }
409 
410 /*ARGSUSED*/
411 static int
412 ufs_write(struct vnode *vp, struct uio *uiop, int ioflag, cred_t *cr,
413 	caller_context_t *ct)
414 {
415 	struct inode *ip = VTOI(vp);
416 	struct ufsvfs *ufsvfsp;
417 	struct ulockfs *ulp;
418 	int retry = 1;
419 	int error, resv, resid = 0;
420 	int directio_status;
421 	int exclusive;
422 	long start_resid = uiop->uio_resid;
423 
424 	TRACE_3(TR_FAC_UFS, TR_UFS_WRITE_START,
425 		"ufs_write_start:vp %p uiop %p ioflag %x",
426 		vp, uiop, ioflag);
427 
428 	ASSERT(RW_LOCK_HELD(&ip->i_rwlock));
429 
430 retry_mandlock:
431 	/*
432 	 * Mandatory locking needs to be done before ufs_lockfs_begin()
433 	 * and TRANS_BEGIN_[A]SYNC() calls since mandatory locks can sleep.
434 	 * Check for forced unmounts normally done in ufs_lockfs_begin().
435 	 */
436 	if ((ufsvfsp = ip->i_ufsvfs) == NULL) {
437 		error = EIO;
438 		goto out;
439 	}
440 	if (MANDLOCK(vp, ip->i_mode)) {
441 
442 		ASSERT(RW_WRITE_HELD(&ip->i_rwlock));
443 
444 		/*
445 		 * ufs_getattr ends up being called by chklock
446 		 */
447 		error = chklock(vp, FWRITE, uiop->uio_loffset,
448 				uiop->uio_resid, uiop->uio_fmode, ct);
449 		if (error)
450 			goto out;
451 	}
452 
453 	/* i_rwlock can change in chklock */
454 	exclusive = rw_write_held(&ip->i_rwlock);
455 
456 	/*
457 	 * Check for fast-path special case of directio re-writes.
458 	 */
459 	if ((ip->i_flag & IDIRECTIO || ufsvfsp->vfs_forcedirectio) &&
460 	    !exclusive && ufs_check_rewrite(ip, uiop, ioflag)) {
461 
462 		error = ufs_lockfs_begin(ufsvfsp, &ulp, ULOCKFS_WRITE_MASK);
463 		if (error)
464 			goto out;
465 
466 		rw_enter(&ip->i_contents, RW_READER);
467 		error = ufs_directio_write(ip, uiop, ioflag, 1, cr,
468 			&directio_status);
469 		if (directio_status == DIRECTIO_SUCCESS) {
470 			uint_t i_flag_save;
471 
472 			if (start_resid != uiop->uio_resid)
473 				error = 0;
474 			/*
475 			 * Special treatment of access times for re-writes.
476 			 * If IMOD is not already set, then convert it
477 			 * to IMODACC for this operation. This defers
478 			 * entering a delta into the log until the inode
479 			 * is flushed. This mimics what is done for read
480 			 * operations and inode access time.
481 			 */
482 			mutex_enter(&ip->i_tlock);
483 			i_flag_save = ip->i_flag;
484 			ip->i_flag |= IUPD | ICHG;
485 			ip->i_seq++;
486 			ITIMES_NOLOCK(ip);
487 			if ((i_flag_save & IMOD) == 0) {
488 				ip->i_flag &= ~IMOD;
489 				ip->i_flag |= IMODACC;
490 			}
491 			mutex_exit(&ip->i_tlock);
492 			rw_exit(&ip->i_contents);
493 			if (ulp)
494 				ufs_lockfs_end(ulp);
495 			goto out;
496 		}
497 		rw_exit(&ip->i_contents);
498 		if (ulp)
499 			ufs_lockfs_end(ulp);
500 	}
501 
502 	if (!exclusive && !rw_tryupgrade(&ip->i_rwlock)) {
503 		rw_exit(&ip->i_rwlock);
504 		rw_enter(&ip->i_rwlock, RW_WRITER);
505 		/*
506 		 * Mandatory locking could have been enabled
507 		 * after dropping the i_rwlock.
508 		 */
509 		if (MANDLOCK(vp, ip->i_mode))
510 			goto retry_mandlock;
511 	}
512 
513 	error = ufs_lockfs_begin(ufsvfsp, &ulp, ULOCKFS_WRITE_MASK);
514 	if (error)
515 		goto out;
516 
517 	/*
518 	 * Amount of log space needed for this write
519 	 */
520 	TRANS_WRITE_RESV(ip, uiop, ulp, &resv, &resid);
521 
522 	/*
523 	 * Throttle writes.
524 	 */
525 	if (ufs_WRITES && (ip->i_writes > ufs_HW)) {
526 		mutex_enter(&ip->i_tlock);
527 		while (ip->i_writes > ufs_HW) {
528 			ufs_throttles++;
529 			cv_wait(&ip->i_wrcv, &ip->i_tlock);
530 		}
531 		mutex_exit(&ip->i_tlock);
532 	}
533 
534 	/*
535 	 * Enter Transaction
536 	 */
537 	if (ioflag & (FSYNC|FDSYNC)) {
538 		if (ulp) {
539 			int terr = 0;
540 			TRANS_BEGIN_SYNC(ufsvfsp, TOP_WRITE_SYNC, resv, terr);
541 			ASSERT(!terr);
542 		}
543 	} else {
544 		if (ulp)
545 			TRANS_BEGIN_ASYNC(ufsvfsp, TOP_WRITE, resv);
546 	}
547 
548 	/*
549 	 * Write the file
550 	 */
551 	rw_enter(&ufsvfsp->vfs_dqrwlock, RW_READER);
552 	rw_enter(&ip->i_contents, RW_WRITER);
553 	if ((ioflag & FAPPEND) != 0 && (ip->i_mode & IFMT) == IFREG) {
554 		/*
555 		 * In append mode start at end of file.
556 		 */
557 		uiop->uio_loffset = ip->i_size;
558 	}
559 
560 	/*
561 	 * Mild optimisation, don't call ufs_trans_write() unless we have to
562 	 * Also, suppress file system full messages if we will retry.
563 	 */
564 	if (retry)
565 		ip->i_flag |= IQUIET;
566 	if (resid) {
567 		TRANS_WRITE(ip, uiop, ioflag, error, ulp, cr, resv, resid);
568 	} else {
569 		error = wrip(ip, uiop, ioflag, cr);
570 	}
571 	ip->i_flag &= ~IQUIET;
572 
573 	rw_exit(&ip->i_contents);
574 	rw_exit(&ufsvfsp->vfs_dqrwlock);
575 
576 	/*
577 	 * Leave Transaction
578 	 */
579 	if (ulp) {
580 		if (ioflag & (FSYNC|FDSYNC)) {
581 			int terr = 0;
582 			TRANS_END_SYNC(ufsvfsp, terr, TOP_WRITE_SYNC, resv);
583 			if (error == 0)
584 				error = terr;
585 		} else {
586 			TRANS_END_ASYNC(ufsvfsp, TOP_WRITE, resv);
587 		}
588 		ufs_lockfs_end(ulp);
589 	}
590 out:
591 	if ((error == ENOSPC) && retry && TRANS_ISTRANS(ufsvfsp)) {
592 		/*
593 		 * Any blocks tied up in pending deletes?
594 		 */
595 		ufs_delete_drain_wait(ufsvfsp, 1);
596 		retry = 0;
597 		goto retry_mandlock;
598 	}
599 
600 	if (error == ENOSPC && (start_resid != uiop->uio_resid))
601 		error = 0;
602 
603 	TRACE_2(TR_FAC_UFS, TR_UFS_WRITE_END,
604 		"ufs_write_end:vp %p error %d", vp, error);
605 	return (error);
606 }
607 
608 /*
609  * Don't cache write blocks to files with the sticky bit set.
610  * Used to keep swap files from blowing the page cache on a server.
611  */
612 int stickyhack = 1;
613 
614 /*
615  * Free behind hacks.  The pager is busted.
616  * XXX - need to pass the information down to writedone() in a flag like B_SEQ
617  * or B_FREE_IF_TIGHT_ON_MEMORY.
618  */
619 int	freebehind = 1;
620 int	smallfile = 0;
621 u_offset_t smallfile64 = 32 * 1024;
622 
623 /*
624  * While we should, in most cases, cache the pages for write, we
625  * may also want to cache the pages for read as long as they are
626  * frequently re-usable.
627  *
628  * If cache_read_ahead = 1, the pages for read will go to the tail
629  * of the cache list when they are released, otherwise go to the head.
630  */
631 int	cache_read_ahead = 0;
632 
633 /*
634  * Freebehind exists  so that as we read  large files  sequentially we
635  * don't consume most of memory with pages  from a few files. It takes
636  * longer to re-read from disk multiple small files as it does reading
637  * one large one sequentially.  As system  memory grows customers need
638  * to retain bigger chunks   of files in  memory.   The advent of  the
639  * cachelist opens up of the possibility freeing pages  to the head or
640  * tail of the list.
641  *
642  * Not freeing a page is a bet that the page will be read again before
643  * it's segmap slot is needed for something else. If we loose the bet,
644  * it means some  other thread is  burdened with the  page free we did
645  * not do. If we win we save a free and reclaim.
646  *
647  * Freeing it at the tail  vs the head of cachelist  is a bet that the
648  * page will survive until the next  read.  It's also saying that this
649  * page is more likely to  be re-used than a  page freed some time ago
650  * and never reclaimed.
651  *
652  * Freebehind maintains a  range of  file offset [smallfile1; smallfile2]
653  *
654  *            0 < offset < smallfile1 : pages are not freed.
655  *   smallfile1 < offset < smallfile2 : pages freed to tail of cachelist.
656  *   smallfile2 < offset              : pages freed to head of cachelist.
657  *
658  * The range  is  computed  at most  once  per second  and  depends on
659  * freemem  and  ncpus_online.  Both parameters  are   bounded to be
660  * >= smallfile && >= smallfile64.
661  *
662  * smallfile1 = (free memory / ncpu) / 1000
663  * smallfile2 = (free memory / ncpu) / 10
664  *
665  * A few examples values:
666  *
667  *       Free Mem (in Bytes) [smallfile1; smallfile2]  [smallfile1; smallfile2]
668  *                                 ncpus_online = 4          ncpus_online = 64
669  *       ------------------  -----------------------   -----------------------
670  *             1G                   [256K;  25M]               [32K; 1.5M]
671  *            10G                   [2.5M; 250M]              [156K; 15M]
672  *           100G                    [25M; 2.5G]              [1.5M; 150M]
673  *
674  */
675 
676 #define	SMALLFILE1_D 1000
677 #define	SMALLFILE2_D 10
678 static u_offset_t smallfile1 = 32 * 1024;
679 static u_offset_t smallfile2 = 32 * 1024;
680 static clock_t smallfile_update = 0; /* lbolt value of when to recompute */
681 uint_t smallfile1_d = SMALLFILE1_D;
682 uint_t smallfile2_d = SMALLFILE2_D;
683 
684 /*
685  * wrip does the real work of write requests for ufs.
686  */
687 int
688 wrip(struct inode *ip, struct uio *uio, int ioflag, struct cred *cr)
689 {
690 	rlim64_t limit = uio->uio_llimit;
691 	u_offset_t off;
692 	u_offset_t old_i_size;
693 	struct fs *fs;
694 	struct vnode *vp;
695 	struct ufsvfs *ufsvfsp;
696 	caddr_t base;
697 	long start_resid = uio->uio_resid;	/* save starting resid */
698 	long premove_resid;			/* resid before uiomove() */
699 	uint_t flags;
700 	int newpage;
701 	int iupdat_flag, directio_status;
702 	int n, on, mapon;
703 	int error, pagecreate;
704 	int do_dqrwlock;		/* drop/reacquire vfs_dqrwlock */
705 	int32_t	iblocks;
706 	int	new_iblocks;
707 
708 	/*
709 	 * ip->i_size is incremented before the uiomove
710 	 * is done on a write.  If the move fails (bad user
711 	 * address) reset ip->i_size.
712 	 * The better way would be to increment ip->i_size
713 	 * only if the uiomove succeeds.
714 	 */
715 	int i_size_changed = 0;
716 	o_mode_t type;
717 	int i_seq_needed = 0;
718 
719 	vp = ITOV(ip);
720 
721 	/*
722 	 * check for forced unmount - should not happen as
723 	 * the request passed the lockfs checks.
724 	 */
725 	if ((ufsvfsp = ip->i_ufsvfs) == NULL)
726 		return (EIO);
727 
728 	fs = ip->i_fs;
729 
730 	TRACE_1(TR_FAC_UFS, TR_UFS_RWIP_START,
731 		"ufs_wrip_start:vp %p", vp);
732 
733 	ASSERT(RW_WRITE_HELD(&ip->i_contents));
734 
735 	/* check for valid filetype */
736 	type = ip->i_mode & IFMT;
737 	if ((type != IFREG) && (type != IFDIR) && (type != IFATTRDIR) &&
738 	    (type != IFLNK) && (type != IFSHAD)) {
739 		return (EIO);
740 	}
741 
742 	/*
743 	 * the actual limit of UFS file size
744 	 * is UFS_MAXOFFSET_T
745 	 */
746 	if (limit == RLIM64_INFINITY || limit > MAXOFFSET_T)
747 		limit = MAXOFFSET_T;
748 
749 	if (uio->uio_loffset >= limit) {
750 		proc_t *p = ttoproc(curthread);
751 
752 		TRACE_2(TR_FAC_UFS, TR_UFS_RWIP_END,
753 			"ufs_wrip_end:vp %p error %d", vp, EINVAL);
754 
755 		mutex_enter(&p->p_lock);
756 		(void) rctl_action(rctlproc_legacy[RLIMIT_FSIZE], p->p_rctls,
757 		    p, RCA_UNSAFE_SIGINFO);
758 		mutex_exit(&p->p_lock);
759 		return (EFBIG);
760 	}
761 
762 	/*
763 	 * if largefiles are disallowed, the limit is
764 	 * the pre-largefiles value of 2GB
765 	 */
766 	if (ufsvfsp->vfs_lfflags & UFS_LARGEFILES)
767 		limit = MIN(UFS_MAXOFFSET_T, limit);
768 	else
769 		limit = MIN(MAXOFF32_T, limit);
770 
771 	if (uio->uio_loffset < (offset_t)0) {
772 		TRACE_2(TR_FAC_UFS, TR_UFS_RWIP_END,
773 			"ufs_wrip_end:vp %p error %d", vp, EINVAL);
774 		return (EINVAL);
775 	}
776 	if (uio->uio_resid == 0) {
777 		TRACE_2(TR_FAC_UFS, TR_UFS_RWIP_END,
778 			"ufs_wrip_end:vp %p error %d", vp, 0);
779 		return (0);
780 	}
781 
782 	if (uio->uio_loffset >= limit)
783 		return (EFBIG);
784 
785 	ip->i_flag |= INOACC;	/* don't update ref time in getpage */
786 
787 	if (ioflag & (FSYNC|FDSYNC)) {
788 		ip->i_flag |= ISYNC;
789 		iupdat_flag = 1;
790 	}
791 	/*
792 	 * Try to go direct
793 	 */
794 	if (ip->i_flag & IDIRECTIO || ufsvfsp->vfs_forcedirectio) {
795 		uio->uio_llimit = limit;
796 		error = ufs_directio_write(ip, uio, ioflag, 0, cr,
797 			&directio_status);
798 		/*
799 		 * If ufs_directio wrote to the file or set the flags,
800 		 * we need to update i_seq, but it may be deferred.
801 		 */
802 		if (start_resid != uio->uio_resid ||
803 					(ip->i_flag & (ICHG|IUPD))) {
804 			i_seq_needed = 1;
805 			ip->i_flag |= ISEQ;
806 		}
807 		if (directio_status == DIRECTIO_SUCCESS)
808 			goto out;
809 	}
810 
811 	/*
812 	 * Behavior with respect to dropping/reacquiring vfs_dqrwlock:
813 	 *
814 	 * o shadow inodes: vfs_dqrwlock is not held at all
815 	 * o quota updates: vfs_dqrwlock is read or write held
816 	 * o other updates: vfs_dqrwlock is read held
817 	 *
818 	 * The first case is the only one where we do not hold
819 	 * vfs_dqrwlock at all while entering wrip().
820 	 * We must make sure not to downgrade/drop vfs_dqrwlock if we
821 	 * have it as writer, i.e. if we are updating the quota inode.
822 	 * There is no potential deadlock scenario in this case as
823 	 * ufs_getpage() takes care of this and avoids reacquiring
824 	 * vfs_dqrwlock in that case.
825 	 *
826 	 * This check is done here since the above conditions do not change
827 	 * and we possibly loop below, so save a few cycles.
828 	 */
829 	if ((type == IFSHAD) ||
830 		(rw_owner(&ufsvfsp->vfs_dqrwlock) == curthread)) {
831 			do_dqrwlock = 0;
832 	} else {
833 		do_dqrwlock = 1;
834 	}
835 
836 	/*
837 	 * Large Files: We cast MAXBMASK to offset_t
838 	 * inorder to mask out the higher bits. Since offset_t
839 	 * is a signed value, the high order bit set in MAXBMASK
840 	 * value makes it do the right thing by having all bits 1
841 	 * in the higher word. May be removed for _SOLARIS64_.
842 	 */
843 
844 	fs = ip->i_fs;
845 	do {
846 		u_offset_t uoff = uio->uio_loffset;
847 		off = uoff & (offset_t)MAXBMASK;
848 		mapon = (int)(uoff & (offset_t)MAXBOFFSET);
849 		on = (int)blkoff(fs, uoff);
850 		n = (int)MIN(fs->fs_bsize - on, uio->uio_resid);
851 		new_iblocks = 1;
852 
853 		if (type == IFREG && uoff + n >= limit) {
854 			if (uoff >= limit) {
855 				error = EFBIG;
856 				goto out;
857 			}
858 			/*
859 			 * since uoff + n >= limit,
860 			 * therefore n >= limit - uoff, and n is an int
861 			 * so it is safe to cast it to an int
862 			 */
863 			n = (int)(limit - (rlim64_t)uoff);
864 		}
865 		if (uoff + n > ip->i_size) {
866 			/*
867 			 * We are extending the length of the file.
868 			 * bmap is used so that we are sure that
869 			 * if we need to allocate new blocks, that it
870 			 * is done here before we up the file size.
871 			 */
872 			error = bmap_write(ip, uoff, (int)(on + n),
873 							mapon == 0, cr);
874 			/*
875 			 * bmap_write never drops i_contents so if
876 			 * the flags are set it changed the file.
877 			 */
878 			if (ip->i_flag & (ICHG|IUPD)) {
879 				i_seq_needed = 1;
880 				ip->i_flag |= ISEQ;
881 			}
882 			if (error)
883 				break;
884 			/*
885 			 * There is a window of vulnerability here.
886 			 * The sequence of operations: allocate file
887 			 * system blocks, uiomove the data into pages,
888 			 * and then update the size of the file in the
889 			 * inode, must happen atomically.  However, due
890 			 * to current locking constraints, this can not
891 			 * be done.
892 			 */
893 			ASSERT(ip->i_writer == NULL);
894 			ip->i_writer = curthread;
895 			i_size_changed = 1;
896 			/*
897 			 * If we are writing from the beginning of
898 			 * the mapping, we can just create the
899 			 * pages without having to read them.
900 			 */
901 			pagecreate = (mapon == 0);
902 		} else if (n == MAXBSIZE) {
903 			/*
904 			 * Going to do a whole mappings worth,
905 			 * so we can just create the pages w/o
906 			 * having to read them in.  But before
907 			 * we do that, we need to make sure any
908 			 * needed blocks are allocated first.
909 			 */
910 			iblocks = ip->i_blocks;
911 			error = bmap_write(ip, uoff, (int)(on + n), 1, cr);
912 			/*
913 			 * bmap_write never drops i_contents so if
914 			 * the flags are set it changed the file.
915 			 */
916 			if (ip->i_flag & (ICHG|IUPD)) {
917 				i_seq_needed = 1;
918 				ip->i_flag |= ISEQ;
919 			}
920 			if (error)
921 				break;
922 			pagecreate = 1;
923 			/*
924 			 * check if the new created page needed the
925 			 * allocation of new disk blocks.
926 			 */
927 			if (iblocks == ip->i_blocks)
928 				new_iblocks = 0; /* no new blocks allocated */
929 		} else {
930 			pagecreate = 0;
931 			/*
932 			 * In sync mode flush the indirect blocks which
933 			 * may have been allocated and not written on
934 			 * disk. In above cases bmap_write will allocate
935 			 * in sync mode.
936 			 */
937 			if (ioflag & (FSYNC|FDSYNC)) {
938 				error = ufs_indirblk_sync(ip, uoff);
939 				if (error)
940 					break;
941 			}
942 		}
943 
944 		/*
945 		 * At this point we can enter ufs_getpage() in one
946 		 * of two ways:
947 		 * 1) segmap_getmapflt() calls ufs_getpage() when the
948 		 *    forcefault parameter is true (pagecreate == 0)
949 		 * 2) uiomove() causes a page fault.
950 		 *
951 		 * We have to drop the contents lock to prevent the VM
952 		 * system from trying to reaquire it in ufs_getpage()
953 		 * should the uiomove cause a pagefault.
954 		 *
955 		 * We have to drop the reader vfs_dqrwlock here as well.
956 		 */
957 		rw_exit(&ip->i_contents);
958 		if (do_dqrwlock) {
959 			ASSERT(RW_LOCK_HELD(&ufsvfsp->vfs_dqrwlock));
960 			ASSERT(!(RW_WRITE_HELD(&ufsvfsp->vfs_dqrwlock)));
961 			rw_exit(&ufsvfsp->vfs_dqrwlock);
962 		}
963 
964 		base = segmap_getmapflt(segkmap, vp, (off + mapon),
965 					(uint_t)n, !pagecreate, S_WRITE);
966 
967 		/*
968 		 * segmap_pagecreate() returns 1 if it calls
969 		 * page_create_va() to allocate any pages.
970 		 */
971 		newpage = 0;
972 
973 		if (pagecreate)
974 			newpage = segmap_pagecreate(segkmap, base,
975 			    (size_t)n, 0);
976 
977 		premove_resid = uio->uio_resid;
978 		error = uiomove(base + mapon, (long)n, UIO_WRITE, uio);
979 
980 		/*
981 		 * If "newpage" is set, then a new page was created and it
982 		 * does not contain valid data, so it needs to be initialized
983 		 * at this point.
984 		 * Otherwise the page contains old data, which was overwritten
985 		 * partially or as a whole in uiomove.
986 		 * If there is only one iovec structure within uio, then
987 		 * on error uiomove will not be able to update uio->uio_loffset
988 		 * and we would zero the whole page here!
989 		 *
990 		 * If uiomove fails because of an error, the old valid data
991 		 * is kept instead of filling the rest of the page with zero's.
992 		 */
993 		if (newpage &&
994 		    uio->uio_loffset < roundup(off + mapon + n, PAGESIZE)) {
995 			/*
996 			 * We created pages w/o initializing them completely,
997 			 * thus we need to zero the part that wasn't set up.
998 			 * This happens on most EOF write cases and if
999 			 * we had some sort of error during the uiomove.
1000 			 */
1001 			int nzero, nmoved;
1002 
1003 			nmoved = (int)(uio->uio_loffset - (off + mapon));
1004 			ASSERT(nmoved >= 0 && nmoved <= n);
1005 			nzero = roundup(on + n, PAGESIZE) - nmoved;
1006 			ASSERT(nzero > 0 && mapon + nmoved + nzero <= MAXBSIZE);
1007 			(void) kzero(base + mapon + nmoved, (uint_t)nzero);
1008 		}
1009 
1010 		/*
1011 		 * Unlock the pages allocated by page_create_va()
1012 		 * in segmap_pagecreate()
1013 		 */
1014 		if (newpage)
1015 			segmap_pageunlock(segkmap, base, (size_t)n, S_WRITE);
1016 
1017 		/*
1018 		 * If the size of the file changed, then update the
1019 		 * size field in the inode now.  This can't be done
1020 		 * before the call to segmap_pageunlock or there is
1021 		 * a potential deadlock with callers to ufs_putpage().
1022 		 * They will be holding i_contents and trying to lock
1023 		 * a page, while this thread is holding a page locked
1024 		 * and trying to acquire i_contents.
1025 		 */
1026 		if (i_size_changed) {
1027 			rw_enter(&ip->i_contents, RW_WRITER);
1028 			old_i_size = ip->i_size;
1029 			UFS_SET_ISIZE(uoff + n, ip);
1030 			TRANS_INODE(ufsvfsp, ip);
1031 			/*
1032 			 * file has grown larger than 2GB. Set flag
1033 			 * in superblock to indicate this, if it
1034 			 * is not already set.
1035 			 */
1036 			if ((ip->i_size > MAXOFF32_T) &&
1037 			    !(fs->fs_flags & FSLARGEFILES)) {
1038 				ASSERT(ufsvfsp->vfs_lfflags & UFS_LARGEFILES);
1039 				mutex_enter(&ufsvfsp->vfs_lock);
1040 				fs->fs_flags |= FSLARGEFILES;
1041 				ufs_sbwrite(ufsvfsp);
1042 				mutex_exit(&ufsvfsp->vfs_lock);
1043 			}
1044 			mutex_enter(&ip->i_tlock);
1045 			ip->i_writer = NULL;
1046 			cv_broadcast(&ip->i_wrcv);
1047 			mutex_exit(&ip->i_tlock);
1048 			rw_exit(&ip->i_contents);
1049 		}
1050 
1051 		if (error) {
1052 			/*
1053 			 * If we failed on a write, we may have already
1054 			 * allocated file blocks as well as pages.  It's
1055 			 * hard to undo the block allocation, but we must
1056 			 * be sure to invalidate any pages that may have
1057 			 * been allocated.
1058 			 *
1059 			 * If the page was created without initialization
1060 			 * then we must check if it should be possible
1061 			 * to destroy the new page and to keep the old data
1062 			 * on the disk.
1063 			 *
1064 			 * It is possible to destroy the page without
1065 			 * having to write back its contents only when
1066 			 * - the size of the file keeps unchanged
1067 			 * - bmap_write() did not allocate new disk blocks
1068 			 *   it is possible to create big files using "seek" and
1069 			 *   write to the end of the file. A "write" to a
1070 			 *   position before the end of the file would not
1071 			 *   change the size of the file but it would allocate
1072 			 *   new disk blocks.
1073 			 * - uiomove intended to overwrite the whole page.
1074 			 * - a new page was created (newpage == 1).
1075 			 */
1076 
1077 			if (i_size_changed == 0 && new_iblocks == 0 &&
1078 			    newpage) {
1079 
1080 				/* unwind what uiomove eventually last did */
1081 				uio->uio_resid = premove_resid;
1082 
1083 				/*
1084 				 * destroy the page, do not write ambiguous
1085 				 * data to the disk.
1086 				 */
1087 				flags = SM_DESTROY;
1088 			} else {
1089 				/*
1090 				 * write the page back to the disk, if dirty,
1091 				 * and remove the page from the cache.
1092 				 */
1093 				flags = SM_INVAL;
1094 			}
1095 			(void) segmap_release(segkmap, base, flags);
1096 		} else {
1097 			flags = 0;
1098 			/*
1099 			 * Force write back for synchronous write cases.
1100 			 */
1101 			if ((ioflag & (FSYNC|FDSYNC)) || type == IFDIR) {
1102 				/*
1103 				 * If the sticky bit is set but the
1104 				 * execute bit is not set, we do a
1105 				 * synchronous write back and free
1106 				 * the page when done.  We set up swap
1107 				 * files to be handled this way to
1108 				 * prevent servers from keeping around
1109 				 * the client's swap pages too long.
1110 				 * XXX - there ought to be a better way.
1111 				 */
1112 				if (IS_SWAPVP(vp)) {
1113 					flags = SM_WRITE | SM_FREE |
1114 					    SM_DONTNEED;
1115 					iupdat_flag = 0;
1116 				} else {
1117 					flags = SM_WRITE;
1118 				}
1119 			} else if (n + on == MAXBSIZE || IS_SWAPVP(vp)) {
1120 				/*
1121 				 * Have written a whole block.
1122 				 * Start an asynchronous write and
1123 				 * mark the buffer to indicate that
1124 				 * it won't be needed again soon.
1125 				 */
1126 				flags = SM_WRITE | SM_ASYNC | SM_DONTNEED;
1127 			}
1128 			error = segmap_release(segkmap, base, flags);
1129 			/*
1130 			 * If the operation failed and is synchronous,
1131 			 * then we need to unwind what uiomove() last
1132 			 * did so we can potentially return an error to
1133 			 * the caller.  If this write operation was
1134 			 * done in two pieces and the first succeeded,
1135 			 * then we won't return an error for the second
1136 			 * piece that failed.  However, we only want to
1137 			 * return a resid value that reflects what was
1138 			 * really done.
1139 			 *
1140 			 * Failures for non-synchronous operations can
1141 			 * be ignored since the page subsystem will
1142 			 * retry the operation until it succeeds or the
1143 			 * file system is unmounted.
1144 			 */
1145 			if (error) {
1146 				if ((ioflag & (FSYNC | FDSYNC)) ||
1147 				    type == IFDIR) {
1148 					uio->uio_resid = premove_resid;
1149 				} else {
1150 					error = 0;
1151 				}
1152 			}
1153 		}
1154 
1155 		/*
1156 		 * Re-acquire contents lock.
1157 		 * If it was dropped, reacquire reader vfs_dqrwlock as well.
1158 		 */
1159 		if (do_dqrwlock)
1160 			rw_enter(&ufsvfsp->vfs_dqrwlock, RW_READER);
1161 		rw_enter(&ip->i_contents, RW_WRITER);
1162 
1163 		/*
1164 		 * If the uiomove() failed or if a synchronous
1165 		 * page push failed, fix up i_size.
1166 		 */
1167 		if (error) {
1168 			if (i_size_changed) {
1169 				/*
1170 				 * The uiomove failed, and we
1171 				 * allocated blocks,so get rid
1172 				 * of them.
1173 				 */
1174 				(void) ufs_itrunc(ip, old_i_size, 0, cr);
1175 			}
1176 		} else {
1177 			/*
1178 			 * XXX - Can this be out of the loop?
1179 			 */
1180 			ip->i_flag |= IUPD | ICHG;
1181 			/*
1182 			 * Only do one increase of i_seq for multiple
1183 			 * pieces.  Because we drop locks, record
1184 			 * the fact that we changed the timestamp and
1185 			 * are deferring the increase in case another thread
1186 			 * pushes our timestamp update.
1187 			 */
1188 			i_seq_needed = 1;
1189 			ip->i_flag |= ISEQ;
1190 			if (i_size_changed)
1191 				ip->i_flag |= IATTCHG;
1192 			if ((ip->i_mode & (IEXEC | (IEXEC >> 3) |
1193 			    (IEXEC >> 6))) != 0 &&
1194 			    (ip->i_mode & (ISUID | ISGID)) != 0 &&
1195 			    secpolicy_vnode_setid_retain(cr,
1196 			    (ip->i_mode & ISUID) != 0 && ip->i_uid == 0) != 0) {
1197 				/*
1198 				 * Clear Set-UID & Set-GID bits on
1199 				 * successful write if not privileged
1200 				 * and at least one of the execute bits
1201 				 * is set.  If we always clear Set-GID,
1202 				 * mandatory file and record locking is
1203 				 * unuseable.
1204 				 */
1205 				ip->i_mode &= ~(ISUID | ISGID);
1206 			}
1207 		}
1208 		TRANS_INODE(ufsvfsp, ip);
1209 	} while (error == 0 && uio->uio_resid > 0 && n != 0);
1210 
1211 out:
1212 	/*
1213 	 * Make sure i_seq is increased at least once per write
1214 	 */
1215 	if (i_seq_needed) {
1216 		ip->i_seq++;
1217 		ip->i_flag &= ~ISEQ;	/* no longer deferred */
1218 	}
1219 
1220 	/*
1221 	 * Inode is updated according to this table -
1222 	 *
1223 	 *   FSYNC	  FDSYNC(posix.4)
1224 	 *   --------------------------
1225 	 *   always@	  IATTCHG|IBDWRITE
1226 	 *
1227 	 * @ - 	If we are doing synchronous write the only time we should
1228 	 *	not be sync'ing the ip here is if we have the stickyhack
1229 	 *	activated, the file is marked with the sticky bit and
1230 	 *	no exec bit, the file length has not been changed and
1231 	 *	no new blocks have been allocated during this write.
1232 	 */
1233 
1234 	if ((ip->i_flag & ISYNC) != 0) {
1235 		/*
1236 		 * we have eliminated nosync
1237 		 */
1238 		if ((ip->i_flag & (IATTCHG|IBDWRITE)) ||
1239 			((ioflag & FSYNC) && iupdat_flag)) {
1240 			ufs_iupdat(ip, 1);
1241 		}
1242 	}
1243 
1244 	/*
1245 	 * If we've already done a partial-write, terminate
1246 	 * the write but return no error unless the error is ENOSPC
1247 	 * because the caller can detect this and free resources and
1248 	 * try again.
1249 	 */
1250 	if ((start_resid != uio->uio_resid) && (error != ENOSPC))
1251 		error = 0;
1252 
1253 	ip->i_flag &= ~(INOACC | ISYNC);
1254 	ITIMES_NOLOCK(ip);
1255 	TRACE_2(TR_FAC_UFS, TR_UFS_RWIP_END,
1256 		"ufs_wrip_end:vp %p error %d", vp, error);
1257 	return (error);
1258 }
1259 
1260 /*
1261  * rdip does the real work of read requests for ufs.
1262  */
1263 int
1264 rdip(struct inode *ip, struct uio *uio, int ioflag, cred_t *cr)
1265 {
1266 	u_offset_t off;
1267 	caddr_t base;
1268 	struct fs *fs;
1269 	struct ufsvfs *ufsvfsp;
1270 	struct vnode *vp;
1271 	long oresid = uio->uio_resid;
1272 	u_offset_t n, on, mapon;
1273 	int error = 0;
1274 	int doupdate = 1;
1275 	uint_t flags;
1276 	int dofree, directio_status;
1277 	krw_t rwtype;
1278 	o_mode_t type;
1279 
1280 	vp = ITOV(ip);
1281 
1282 	TRACE_1(TR_FAC_UFS, TR_UFS_RWIP_START,
1283 		"ufs_rdip_start:vp %p", vp);
1284 
1285 	ASSERT(RW_LOCK_HELD(&ip->i_contents));
1286 
1287 	ufsvfsp = ip->i_ufsvfs;
1288 
1289 	if (ufsvfsp == NULL)
1290 		return (EIO);
1291 
1292 	fs = ufsvfsp->vfs_fs;
1293 
1294 	/* check for valid filetype */
1295 	type = ip->i_mode & IFMT;
1296 	if ((type != IFREG) && (type != IFDIR) && (type != IFATTRDIR) &&
1297 	    (type != IFLNK) && (type != IFSHAD)) {
1298 		return (EIO);
1299 	}
1300 
1301 	if (uio->uio_loffset > UFS_MAXOFFSET_T) {
1302 		TRACE_2(TR_FAC_UFS, TR_UFS_RWIP_END,
1303 			"ufs_rdip_end:vp %p error %d", vp, EINVAL);
1304 		error = 0;
1305 		goto out;
1306 	}
1307 	if (uio->uio_loffset < (offset_t)0) {
1308 		TRACE_2(TR_FAC_UFS, TR_UFS_RWIP_END,
1309 			"ufs_rdip_end:vp %p error %d", vp, EINVAL);
1310 		return (EINVAL);
1311 	}
1312 	if (uio->uio_resid == 0) {
1313 		TRACE_2(TR_FAC_UFS, TR_UFS_RWIP_END,
1314 			"ufs_rdip_end:vp %p error %d", vp, 0);
1315 		return (0);
1316 	}
1317 
1318 	if (!ULOCKFS_IS_NOIACC(ITOUL(ip)) && (fs->fs_ronly == 0) &&
1319 		(!ufsvfsp->vfs_noatime)) {
1320 		mutex_enter(&ip->i_tlock);
1321 		ip->i_flag |= IACC;
1322 		mutex_exit(&ip->i_tlock);
1323 	}
1324 	/*
1325 	 * Try to go direct
1326 	 */
1327 	if (ip->i_flag & IDIRECTIO || ufsvfsp->vfs_forcedirectio) {
1328 		error = ufs_directio_read(ip, uio, cr, &directio_status);
1329 		if (directio_status == DIRECTIO_SUCCESS)
1330 			goto out;
1331 	}
1332 
1333 	rwtype = (rw_write_held(&ip->i_contents)?RW_WRITER:RW_READER);
1334 
1335 	do {
1336 		offset_t diff;
1337 		u_offset_t uoff = uio->uio_loffset;
1338 		off = uoff & (offset_t)MAXBMASK;
1339 		mapon = (u_offset_t)(uoff & (offset_t)MAXBOFFSET);
1340 		on = (u_offset_t)blkoff(fs, uoff);
1341 		n = MIN((u_offset_t)fs->fs_bsize - on,
1342 			(u_offset_t)uio->uio_resid);
1343 
1344 		diff = ip->i_size - uoff;
1345 
1346 		if (diff <= (offset_t)0) {
1347 			error = 0;
1348 			goto out;
1349 		}
1350 		if (diff < (offset_t)n)
1351 			n = (int)diff;
1352 
1353 		/*
1354 		 * We update smallfile2 and smallfile1 at most every second.
1355 		 */
1356 		if (lbolt >= smallfile_update) {
1357 			uint64_t percpufreeb;
1358 			if (smallfile1_d == 0) smallfile1_d = SMALLFILE1_D;
1359 			if (smallfile2_d == 0) smallfile2_d = SMALLFILE2_D;
1360 			percpufreeb = ptob((uint64_t)freemem) / ncpus_online;
1361 			smallfile1 = percpufreeb / smallfile1_d;
1362 			smallfile2 = percpufreeb / smallfile2_d;
1363 			smallfile1 = MAX(smallfile1, smallfile);
1364 			smallfile1 = MAX(smallfile1, smallfile64);
1365 			smallfile2 = MAX(smallfile1, smallfile2);
1366 			smallfile_update = lbolt + hz;
1367 		}
1368 
1369 		dofree = freebehind &&
1370 		    ip->i_nextr == (off & PAGEMASK) && off > smallfile1;
1371 
1372 		/*
1373 		 * At this point we can enter ufs_getpage() in one of two
1374 		 * ways:
1375 		 * 1) segmap_getmapflt() calls ufs_getpage() when the
1376 		 *    forcefault parameter is true (value of 1 is passed)
1377 		 * 2) uiomove() causes a page fault.
1378 		 *
1379 		 * We cannot hold onto an i_contents reader lock without
1380 		 * risking deadlock in ufs_getpage() so drop a reader lock.
1381 		 * The ufs_getpage() dolock logic already allows for a
1382 		 * thread holding i_contents as writer to work properly
1383 		 * so we keep a writer lock.
1384 		 */
1385 		if (rwtype == RW_READER)
1386 			rw_exit(&ip->i_contents);
1387 		base = segmap_getmapflt(segkmap, vp, (off + mapon),
1388 					(uint_t)n, 1, S_READ);
1389 
1390 		error = uiomove(base + mapon, (long)n, UIO_READ, uio);
1391 
1392 		flags = 0;
1393 		if (!error) {
1394 			/*
1395 			 * If  reading sequential  we won't need  this
1396 			 * buffer again  soon.  For  offsets in  range
1397 			 * [smallfile1,  smallfile2] release the pages
1398 			 * at   the  tail  of the   cache list, larger
1399 			 * offsets are released at the head.
1400 			 */
1401 			if (dofree) {
1402 				flags = SM_FREE | SM_ASYNC;
1403 				if ((cache_read_ahead == 0) &&
1404 					(off > smallfile2))
1405 					flags |=  SM_DONTNEED;
1406 			}
1407 			/*
1408 			 * In POSIX SYNC (FSYNC and FDSYNC) read mode,
1409 			 * we want to make sure that the page which has
1410 			 * been read, is written on disk if it is dirty.
1411 			 * And corresponding indirect blocks should also
1412 			 * be flushed out.
1413 			 */
1414 			if ((ioflag & FRSYNC) && (ioflag & (FSYNC|FDSYNC))) {
1415 				flags &= ~SM_ASYNC;
1416 				flags |= SM_WRITE;
1417 			}
1418 			error = segmap_release(segkmap, base, flags);
1419 		} else
1420 			(void) segmap_release(segkmap, base, flags);
1421 
1422 		if (rwtype == RW_READER)
1423 			rw_enter(&ip->i_contents, rwtype);
1424 	} while (error == 0 && uio->uio_resid > 0 && n != 0);
1425 out:
1426 	/*
1427 	 * Inode is updated according to this table if FRSYNC is set.
1428 	 *
1429 	 *   FSYNC	  FDSYNC(posix.4)
1430 	 *   --------------------------
1431 	 *   always	  IATTCHG|IBDWRITE
1432 	 */
1433 	/*
1434 	 * The inode is not updated if we're logging and the inode is a
1435 	 * directory with FRSYNC, FSYNC and FDSYNC flags set.
1436 	 */
1437 	if (ioflag & FRSYNC) {
1438 		if (TRANS_ISTRANS(ufsvfsp) && ((ip->i_mode & IFMT) == IFDIR)) {
1439 				doupdate = 0;
1440 		}
1441 		if (doupdate) {
1442 			if ((ioflag & FSYNC) ||
1443 			    ((ioflag & FDSYNC) &&
1444 			    (ip->i_flag & (IATTCHG|IBDWRITE)))) {
1445 				ufs_iupdat(ip, 1);
1446 			}
1447 		}
1448 	}
1449 	/*
1450 	 * If we've already done a partial read, terminate
1451 	 * the read but return no error.
1452 	 */
1453 	if (oresid != uio->uio_resid)
1454 		error = 0;
1455 	ITIMES(ip);
1456 
1457 	TRACE_2(TR_FAC_UFS, TR_UFS_RWIP_END,
1458 		"ufs_rdip_end:vp %p error %d", vp, error);
1459 	return (error);
1460 }
1461 
1462 /* ARGSUSED */
1463 static int
1464 ufs_ioctl(
1465 	struct vnode	*vp,
1466 	int		cmd,
1467 	intptr_t	arg,
1468 	int		flag,
1469 	struct cred	*cr,
1470 	int		*rvalp)
1471 {
1472 	struct lockfs	lockfs, lockfs_out;
1473 	struct ufsvfs	*ufsvfsp = VTOI(vp)->i_ufsvfs;
1474 	char		*comment, *original_comment;
1475 	struct fs	*fs;
1476 	struct ulockfs	*ulp;
1477 	offset_t	off;
1478 	extern int	maxphys;
1479 	int		error;
1480 	int		issync;
1481 	int		trans_size;
1482 
1483 
1484 	/*
1485 	 * forcibly unmounted
1486 	 */
1487 	if (ufsvfsp == NULL) {
1488 		return (EIO);
1489 	}
1490 
1491 	fs = ufsvfsp->vfs_fs;
1492 
1493 	if (cmd == Q_QUOTACTL) {
1494 		error = ufs_lockfs_begin(ufsvfsp, &ulp, ULOCKFS_QUOTA_MASK);
1495 		if (error)
1496 			return (error);
1497 
1498 		if (ulp) {
1499 			TRANS_BEGIN_ASYNC(ufsvfsp, TOP_QUOTA,
1500 						TOP_SETQUOTA_SIZE(fs));
1501 		}
1502 
1503 		error = quotactl(vp, arg, flag, cr);
1504 
1505 		if (ulp) {
1506 			TRANS_END_ASYNC(ufsvfsp, TOP_QUOTA,
1507 						TOP_SETQUOTA_SIZE(fs));
1508 			ufs_lockfs_end(ulp);
1509 		}
1510 		return (error);
1511 	}
1512 
1513 	switch (cmd) {
1514 		case _FIOLFS:
1515 			/*
1516 			 * file system locking
1517 			 */
1518 			if (secpolicy_fs_config(cr, ufsvfsp->vfs_vfs) != 0)
1519 				return (EPERM);
1520 
1521 			if ((flag & DATAMODEL_MASK) == DATAMODEL_NATIVE) {
1522 				if (copyin((caddr_t)arg, &lockfs,
1523 						sizeof (struct lockfs)))
1524 					return (EFAULT);
1525 			}
1526 #ifdef _SYSCALL32_IMPL
1527 			else {
1528 				struct lockfs32	lockfs32;
1529 				/* Translate ILP32 lockfs to LP64 lockfs */
1530 				if (copyin((caddr_t)arg, &lockfs32,
1531 				    sizeof (struct lockfs32)))
1532 					return (EFAULT);
1533 				lockfs.lf_lock = (ulong_t)lockfs32.lf_lock;
1534 				lockfs.lf_flags = (ulong_t)lockfs32.lf_flags;
1535 				lockfs.lf_key = (ulong_t)lockfs32.lf_key;
1536 				lockfs.lf_comlen = (ulong_t)lockfs32.lf_comlen;
1537 				lockfs.lf_comment =
1538 					(caddr_t)(uintptr_t)lockfs32.lf_comment;
1539 			}
1540 #endif /* _SYSCALL32_IMPL */
1541 
1542 			if (lockfs.lf_comlen) {
1543 				if (lockfs.lf_comlen > LOCKFS_MAXCOMMENTLEN)
1544 					return (ENAMETOOLONG);
1545 				comment = kmem_alloc(lockfs.lf_comlen,
1546 						KM_SLEEP);
1547 				if (copyin(lockfs.lf_comment, comment,
1548 					lockfs.lf_comlen)) {
1549 					kmem_free(comment, lockfs.lf_comlen);
1550 					return (EFAULT);
1551 				}
1552 				original_comment = lockfs.lf_comment;
1553 				lockfs.lf_comment = comment;
1554 			}
1555 			if ((error = ufs_fiolfs(vp, &lockfs, 0)) == 0) {
1556 				lockfs.lf_comment = original_comment;
1557 
1558 				if ((flag & DATAMODEL_MASK) ==
1559 				    DATAMODEL_NATIVE) {
1560 					(void) copyout(&lockfs, (caddr_t)arg,
1561 					    sizeof (struct lockfs));
1562 				}
1563 #ifdef _SYSCALL32_IMPL
1564 				else {
1565 					struct lockfs32	lockfs32;
1566 					/* Translate LP64 to ILP32 lockfs */
1567 					lockfs32.lf_lock =
1568 					    (uint32_t)lockfs.lf_lock;
1569 					lockfs32.lf_flags =
1570 					    (uint32_t)lockfs.lf_flags;
1571 					lockfs32.lf_key =
1572 					    (uint32_t)lockfs.lf_key;
1573 					lockfs32.lf_comlen =
1574 					    (uint32_t)lockfs.lf_comlen;
1575 					lockfs32.lf_comment =
1576 					(uint32_t)(uintptr_t)lockfs.lf_comment;
1577 					(void) copyout(&lockfs32, (caddr_t)arg,
1578 					    sizeof (struct lockfs32));
1579 				}
1580 #endif /* _SYSCALL32_IMPL */
1581 
1582 			} else {
1583 				if (lockfs.lf_comlen)
1584 					kmem_free(comment, lockfs.lf_comlen);
1585 			}
1586 			return (error);
1587 
1588 		case _FIOLFSS:
1589 			/*
1590 			 * get file system locking status
1591 			 */
1592 
1593 			if ((flag & DATAMODEL_MASK) == DATAMODEL_NATIVE) {
1594 				if (copyin((caddr_t)arg, &lockfs,
1595 						sizeof (struct lockfs)))
1596 					return (EFAULT);
1597 			}
1598 #ifdef _SYSCALL32_IMPL
1599 			else {
1600 				struct lockfs32	lockfs32;
1601 				/* Translate ILP32 lockfs to LP64 lockfs */
1602 				if (copyin((caddr_t)arg, &lockfs32,
1603 						sizeof (struct lockfs32)))
1604 					return (EFAULT);
1605 				lockfs.lf_lock = (ulong_t)lockfs32.lf_lock;
1606 				lockfs.lf_flags = (ulong_t)lockfs32.lf_flags;
1607 				lockfs.lf_key = (ulong_t)lockfs32.lf_key;
1608 				lockfs.lf_comlen = (ulong_t)lockfs32.lf_comlen;
1609 				lockfs.lf_comment =
1610 					(caddr_t)(uintptr_t)lockfs32.lf_comment;
1611 			}
1612 #endif /* _SYSCALL32_IMPL */
1613 
1614 			if (error =  ufs_fiolfss(vp, &lockfs_out))
1615 				return (error);
1616 			lockfs.lf_lock = lockfs_out.lf_lock;
1617 			lockfs.lf_key = lockfs_out.lf_key;
1618 			lockfs.lf_flags = lockfs_out.lf_flags;
1619 			lockfs.lf_comlen = MIN(lockfs.lf_comlen,
1620 				lockfs_out.lf_comlen);
1621 
1622 			if ((flag & DATAMODEL_MASK) == DATAMODEL_NATIVE) {
1623 				if (copyout(&lockfs, (caddr_t)arg,
1624 						sizeof (struct lockfs)))
1625 					return (EFAULT);
1626 			}
1627 #ifdef _SYSCALL32_IMPL
1628 			else {
1629 				/* Translate LP64 to ILP32 lockfs */
1630 				struct lockfs32	lockfs32;
1631 				lockfs32.lf_lock = (uint32_t)lockfs.lf_lock;
1632 				lockfs32.lf_flags = (uint32_t)lockfs.lf_flags;
1633 				lockfs32.lf_key = (uint32_t)lockfs.lf_key;
1634 				lockfs32.lf_comlen = (uint32_t)lockfs.lf_comlen;
1635 				lockfs32.lf_comment =
1636 					(uint32_t)(uintptr_t)lockfs.lf_comment;
1637 				if (copyout(&lockfs32, (caddr_t)arg,
1638 					    sizeof (struct lockfs32)))
1639 					return (EFAULT);
1640 			}
1641 #endif /* _SYSCALL32_IMPL */
1642 
1643 			if (lockfs.lf_comlen &&
1644 			    lockfs.lf_comment && lockfs_out.lf_comment)
1645 				if (copyout(lockfs_out.lf_comment,
1646 					lockfs.lf_comment,
1647 					lockfs.lf_comlen))
1648 					return (EFAULT);
1649 			return (0);
1650 
1651 		case _FIOSATIME:
1652 			/*
1653 			 * set access time
1654 			 */
1655 
1656 			/*
1657 			 * if mounted w/o atime, return quietly.
1658 			 * I briefly thought about returning ENOSYS, but
1659 			 * figured that most apps would consider this fatal
1660 			 * but the idea is to make this as seamless as poss.
1661 			 */
1662 			if (ufsvfsp->vfs_noatime)
1663 				return (0);
1664 
1665 			error = ufs_lockfs_begin(ufsvfsp, &ulp,
1666 					ULOCKFS_SETATTR_MASK);
1667 			if (error)
1668 				return (error);
1669 
1670 			if (ulp) {
1671 				trans_size = (int)TOP_SETATTR_SIZE(VTOI(vp));
1672 				TRANS_BEGIN_CSYNC(ufsvfsp, issync,
1673 						TOP_SETATTR, trans_size);
1674 			}
1675 
1676 			error = ufs_fiosatime(vp, (struct timeval *)arg,
1677 					flag, cr);
1678 
1679 			if (ulp) {
1680 				TRANS_END_CSYNC(ufsvfsp, error, issync,
1681 						TOP_SETATTR, trans_size);
1682 				ufs_lockfs_end(ulp);
1683 			}
1684 			return (error);
1685 
1686 		case _FIOSDIO:
1687 			/*
1688 			 * set delayed-io
1689 			 */
1690 			return (ufs_fiosdio(vp, (uint_t *)arg, flag, cr));
1691 
1692 		case _FIOGDIO:
1693 			/*
1694 			 * get delayed-io
1695 			 */
1696 			return (ufs_fiogdio(vp, (uint_t *)arg, flag, cr));
1697 
1698 		case _FIOIO:
1699 			/*
1700 			 * inode open
1701 			 */
1702 			error = ufs_lockfs_begin(ufsvfsp, &ulp,
1703 					ULOCKFS_VGET_MASK);
1704 			if (error)
1705 				return (error);
1706 
1707 			error = ufs_fioio(vp, (struct fioio *)arg, flag, cr);
1708 
1709 			if (ulp) {
1710 				ufs_lockfs_end(ulp);
1711 			}
1712 			return (error);
1713 
1714 		case _FIOFFS:
1715 			/*
1716 			 * file system flush (push w/invalidate)
1717 			 */
1718 			if ((caddr_t)arg != NULL)
1719 				return (EINVAL);
1720 			return (ufs_fioffs(vp, NULL, cr));
1721 
1722 		case _FIOISBUSY:
1723 			/*
1724 			 * Contract-private interface for Legato
1725 			 * Purge this vnode from the DNLC and decide
1726 			 * if this vnode is busy (*arg == 1) or not
1727 			 * (*arg == 0)
1728 			 */
1729 			if (secpolicy_fs_config(cr, ufsvfsp->vfs_vfs) != 0)
1730 				return (EPERM);
1731 			error = ufs_fioisbusy(vp, (int *)arg, cr);
1732 			return (error);
1733 
1734 		case _FIODIRECTIO:
1735 			return (ufs_fiodirectio(vp, (int)arg, cr));
1736 
1737 		case _FIOTUNE:
1738 			/*
1739 			 * Tune the file system (aka setting fs attributes)
1740 			 */
1741 			error = ufs_lockfs_begin(ufsvfsp, &ulp,
1742 					ULOCKFS_SETATTR_MASK);
1743 			if (error)
1744 				return (error);
1745 
1746 			error = ufs_fiotune(vp, (struct fiotune *)arg, cr);
1747 
1748 			if (ulp)
1749 				ufs_lockfs_end(ulp);
1750 			return (error);
1751 
1752 		case _FIOLOGENABLE:
1753 			if (secpolicy_fs_config(cr, ufsvfsp->vfs_vfs) != 0)
1754 				return (EPERM);
1755 			return (ufs_fiologenable(vp, (void *)arg, cr, flag));
1756 
1757 		case _FIOLOGDISABLE:
1758 			if (secpolicy_fs_config(cr, ufsvfsp->vfs_vfs) != 0)
1759 				return (EPERM);
1760 			return (ufs_fiologdisable(vp, (void *)arg, cr, flag));
1761 
1762 		case _FIOISLOG:
1763 			return (ufs_fioislog(vp, (void *)arg, cr, flag));
1764 
1765 		case _FIOSNAPSHOTCREATE_MULTI:
1766 		{
1767 			struct fiosnapcreate_multi	fc, *fcp;
1768 			size_t	fcm_size;
1769 
1770 			if (copyin((void *)arg, &fc, sizeof (fc)))
1771 				return (EFAULT);
1772 			if (fc.backfilecount > MAX_BACKFILE_COUNT)
1773 				return (EINVAL);
1774 			fcm_size = sizeof (struct fiosnapcreate_multi) +
1775 			    (fc.backfilecount - 1) * sizeof (int);
1776 			fcp = (struct fiosnapcreate_multi *)
1777 			    kmem_alloc(fcm_size, KM_SLEEP);
1778 			if (copyin((void *)arg, fcp, fcm_size)) {
1779 				kmem_free(fcp, fcm_size);
1780 				return (EFAULT);
1781 			}
1782 			error = ufs_snap_create(vp, fcp, cr);
1783 			if (!error && copyout(fcp, (void *)arg, fcm_size))
1784 				error = EFAULT;
1785 			kmem_free(fcp, fcm_size);
1786 			return (error);
1787 		}
1788 
1789 		case _FIOSNAPSHOTDELETE:
1790 		{
1791 			struct fiosnapdelete	fc;
1792 
1793 			if (copyin((void *)arg, &fc, sizeof (fc)))
1794 				return (EFAULT);
1795 			error = ufs_snap_delete(vp, &fc, cr);
1796 			if (!error && copyout(&fc, (void *)arg, sizeof (fc)))
1797 				error = EFAULT;
1798 			return (error);
1799 		}
1800 
1801 		case _FIOGETSUPERBLOCK:
1802 			if (copyout(fs, (void *)arg, SBSIZE))
1803 				return (EFAULT);
1804 			return (0);
1805 
1806 		case _FIOGETMAXPHYS:
1807 			if (copyout(&maxphys, (void *)arg, sizeof (maxphys)))
1808 				return (EFAULT);
1809 			return (0);
1810 
1811 		/*
1812 		 * The following 3 ioctls are for TSufs support
1813 		 * although could potentially be used elsewhere
1814 		 */
1815 		case _FIO_SET_LUFS_DEBUG:
1816 			if (secpolicy_fs_config(cr, ufsvfsp->vfs_vfs) != 0)
1817 				return (EPERM);
1818 			lufs_debug = (uint32_t)arg;
1819 			return (0);
1820 
1821 		case _FIO_SET_LUFS_ERROR:
1822 			if (secpolicy_fs_config(cr, ufsvfsp->vfs_vfs) != 0)
1823 				return (EPERM);
1824 			TRANS_SETERROR(ufsvfsp);
1825 			return (0);
1826 
1827 		case _FIO_GET_TOP_STATS:
1828 		{
1829 			fio_lufs_stats_t *ls;
1830 			ml_unit_t *ul = ufsvfsp->vfs_log;
1831 
1832 			ls = kmem_zalloc(sizeof (*ls), KM_SLEEP);
1833 			ls->ls_debug = ul->un_debug; /* return debug value */
1834 			/* Copy stucture if statistics are being kept */
1835 			if (ul->un_logmap->mtm_tops) {
1836 				ls->ls_topstats = *(ul->un_logmap->mtm_tops);
1837 			}
1838 			error = 0;
1839 			if (copyout(ls, (void *)arg, sizeof (*ls)))
1840 				error = EFAULT;
1841 			kmem_free(ls, sizeof (*ls));
1842 			return (error);
1843 		}
1844 
1845 		case _FIO_SEEK_DATA:
1846 		case _FIO_SEEK_HOLE:
1847 			if (ddi_copyin((void *)arg, &off, sizeof (off), flag))
1848 				return (EFAULT);
1849 			/* offset paramater is in/out */
1850 			error = ufs_fio_holey(vp, cmd, &off);
1851 			if (error)
1852 				return (error);
1853 			if (ddi_copyout(&off, (void *)arg, sizeof (off), flag))
1854 				return (EFAULT);
1855 			return (0);
1856 
1857 		default:
1858 			return (ENOTTY);
1859 	}
1860 }
1861 
1862 /* ARGSUSED */
1863 static int
1864 ufs_getattr(struct vnode *vp, struct vattr *vap, int flags,
1865 	struct cred *cr)
1866 {
1867 	struct inode *ip = VTOI(vp);
1868 	struct ufsvfs *ufsvfsp;
1869 	int err;
1870 
1871 	TRACE_2(TR_FAC_UFS, TR_UFS_GETATTR_START,
1872 		"ufs_getattr_start:vp %p flags %x", vp, flags);
1873 
1874 	if (vap->va_mask == AT_SIZE) {
1875 		/*
1876 		 * for performance, if only the size is requested don't bother
1877 		 * with anything else.
1878 		 */
1879 		UFS_GET_ISIZE(&vap->va_size, ip);
1880 		TRACE_1(TR_FAC_UFS, TR_UFS_GETATTR_END,
1881 			"ufs_getattr_end:vp %p", vp);
1882 		return (0);
1883 	}
1884 
1885 	/*
1886 	 * inlined lockfs checks
1887 	 */
1888 	ufsvfsp = ip->i_ufsvfs;
1889 	if ((ufsvfsp == NULL) || ULOCKFS_IS_HLOCK(&ufsvfsp->vfs_ulockfs)) {
1890 		err = EIO;
1891 		goto out;
1892 	}
1893 
1894 	rw_enter(&ip->i_contents, RW_READER);
1895 	/*
1896 	 * Return all the attributes.  This should be refined so
1897 	 * that it only returns what's asked for.
1898 	 */
1899 
1900 	/*
1901 	 * Copy from inode table.
1902 	 */
1903 	vap->va_type = vp->v_type;
1904 	vap->va_mode = ip->i_mode & MODEMASK;
1905 	/*
1906 	 * If there is an ACL and there is a mask entry, then do the
1907 	 * extra work that completes the equivalent of an acltomode(3)
1908 	 * call.  According to POSIX P1003.1e, the acl mask should be
1909 	 * returned in the group permissions field.
1910 	 *
1911 	 * - start with the original permission and mode bits (from above)
1912 	 * - clear the group owner bits
1913 	 * - add in the mask bits.
1914 	 */
1915 	if (ip->i_ufs_acl && ip->i_ufs_acl->aclass.acl_ismask) {
1916 		vap->va_mode &= ~((VREAD | VWRITE | VEXEC) >> 3);
1917 		vap->va_mode |=
1918 		    (ip->i_ufs_acl->aclass.acl_maskbits & PERMMASK) << 3;
1919 	}
1920 	vap->va_uid = ip->i_uid;
1921 	vap->va_gid = ip->i_gid;
1922 	vap->va_fsid = ip->i_dev;
1923 	vap->va_nodeid = (ino64_t)ip->i_number;
1924 	vap->va_nlink = ip->i_nlink;
1925 	vap->va_size = ip->i_size;
1926 	if (vp->v_type == VCHR || vp->v_type == VBLK)
1927 		vap->va_rdev = ip->i_rdev;
1928 	else
1929 		vap->va_rdev = 0;	/* not a b/c spec. */
1930 	mutex_enter(&ip->i_tlock);
1931 	ITIMES_NOLOCK(ip);	/* mark correct time in inode */
1932 	vap->va_seq = ip->i_seq;
1933 	vap->va_atime.tv_sec = (time_t)ip->i_atime.tv_sec;
1934 	vap->va_atime.tv_nsec = ip->i_atime.tv_usec*1000;
1935 	vap->va_mtime.tv_sec = (time_t)ip->i_mtime.tv_sec;
1936 	vap->va_mtime.tv_nsec = ip->i_mtime.tv_usec*1000;
1937 	vap->va_ctime.tv_sec = (time_t)ip->i_ctime.tv_sec;
1938 	vap->va_ctime.tv_nsec = ip->i_ctime.tv_usec*1000;
1939 	mutex_exit(&ip->i_tlock);
1940 
1941 	switch (ip->i_mode & IFMT) {
1942 
1943 	case IFBLK:
1944 		vap->va_blksize = MAXBSIZE;		/* was BLKDEV_IOSIZE */
1945 		break;
1946 
1947 	case IFCHR:
1948 		vap->va_blksize = MAXBSIZE;
1949 		break;
1950 
1951 	default:
1952 		vap->va_blksize = ip->i_fs->fs_bsize;
1953 		break;
1954 	}
1955 	vap->va_nblocks = (fsblkcnt64_t)ip->i_blocks;
1956 	rw_exit(&ip->i_contents);
1957 	err = 0;
1958 
1959 out:
1960 	TRACE_1(TR_FAC_UFS, TR_UFS_GETATTR_END, "ufs_getattr_end:vp %p", vp);
1961 
1962 	return (err);
1963 }
1964 
1965 /*ARGSUSED4*/
1966 static int
1967 ufs_setattr(
1968 	struct vnode *vp,
1969 	struct vattr *vap,
1970 	int flags,
1971 	struct cred *cr,
1972 	caller_context_t *ct)
1973 {
1974 	struct inode *ip = VTOI(vp);
1975 	struct ufsvfs *ufsvfsp = ip->i_ufsvfs;
1976 	struct fs *fs;
1977 	struct ulockfs *ulp;
1978 	char *errmsg1;
1979 	char *errmsg2;
1980 	long blocks;
1981 	long int mask = vap->va_mask;
1982 	size_t len1, len2;
1983 	int issync;
1984 	int trans_size;
1985 	int dotrans;
1986 	int dorwlock;
1987 	int error;
1988 	int owner_change;
1989 	int dodqlock;
1990 	timestruc_t now;
1991 	vattr_t oldva;
1992 	int retry = 1;
1993 
1994 	TRACE_2(TR_FAC_UFS, TR_UFS_SETATTR_START,
1995 		"ufs_setattr_start:vp %p flags %x", vp, flags);
1996 
1997 	/*
1998 	 * Cannot set these attributes.
1999 	 */
2000 	if (mask & AT_NOSET) {
2001 		error = EINVAL;
2002 		goto out;
2003 	}
2004 
2005 	/*
2006 	 * check for forced unmount
2007 	 */
2008 	if (ufsvfsp == NULL)
2009 		return (EIO);
2010 
2011 	fs = ufsvfsp->vfs_fs;
2012 	if (fs->fs_ronly != 0)
2013 		return (EROFS);
2014 
2015 again:
2016 	errmsg1 = NULL;
2017 	errmsg2 = NULL;
2018 	dotrans = 0;
2019 	dorwlock = 0;
2020 	dodqlock = 0;
2021 
2022 	error = ufs_lockfs_begin(ufsvfsp, &ulp, ULOCKFS_SETATTR_MASK);
2023 	if (error)
2024 		goto out;
2025 
2026 	/*
2027 	 * Acquire i_rwlock before TRANS_BEGIN_CSYNC() if this is a file.
2028 	 * This follows the protocol for read()/write().
2029 	 */
2030 	if (vp->v_type != VDIR) {
2031 		rw_enter(&ip->i_rwlock, RW_WRITER);
2032 		dorwlock = 1;
2033 	}
2034 
2035 	/*
2036 	 * Truncate file.  Must have write permission and not be a directory.
2037 	 */
2038 	if (mask & AT_SIZE) {
2039 		rw_enter(&ip->i_contents, RW_WRITER);
2040 		if (vp->v_type == VDIR) {
2041 			error = EISDIR;
2042 			goto update_inode;
2043 		}
2044 		if (error = ufs_iaccess(ip, IWRITE, cr))
2045 			goto update_inode;
2046 
2047 		rw_exit(&ip->i_contents);
2048 		error = TRANS_ITRUNC(ip, vap->va_size, 0, cr);
2049 		if (error) {
2050 			rw_enter(&ip->i_contents, RW_WRITER);
2051 			goto update_inode;
2052 		}
2053 	}
2054 
2055 	if (ulp) {
2056 		trans_size = (int)TOP_SETATTR_SIZE(ip);
2057 		TRANS_BEGIN_CSYNC(ufsvfsp, issync, TOP_SETATTR, trans_size);
2058 		++dotrans;
2059 	}
2060 
2061 	/*
2062 	 * Acquire i_rwlock after TRANS_BEGIN_CSYNC() if this is a directory.
2063 	 * This follows the protocol established by
2064 	 * ufs_link/create/remove/rename/mkdir/rmdir/symlink.
2065 	 */
2066 	if (vp->v_type == VDIR) {
2067 		rw_enter(&ip->i_rwlock, RW_WRITER);
2068 		dorwlock = 1;
2069 	}
2070 
2071 	/*
2072 	 * Grab quota lock if we are changing the file's owner.
2073 	 */
2074 	if (mask & AT_UID) {
2075 		rw_enter(&ufsvfsp->vfs_dqrwlock, RW_READER);
2076 		dodqlock = 1;
2077 	}
2078 	rw_enter(&ip->i_contents, RW_WRITER);
2079 
2080 	oldva.va_mode = ip->i_mode;
2081 	oldva.va_uid = ip->i_uid;
2082 	oldva.va_gid = ip->i_gid;
2083 
2084 	vap->va_mask &= ~AT_SIZE;
2085 	/*
2086 	 * ufs_iaccess is "close enough"; that's because it doesn't
2087 	 * map the defines.
2088 	 */
2089 	error = secpolicy_vnode_setattr(cr, vp, vap, &oldva, flags,
2090 				ufs_iaccess, ip);
2091 	if (error)
2092 		goto update_inode;
2093 
2094 	mask = vap->va_mask;
2095 
2096 	/*
2097 	 * Change file access modes.
2098 	 */
2099 	if (mask & AT_MODE) {
2100 		ip->i_mode = (ip->i_mode & IFMT) | (vap->va_mode & ~IFMT);
2101 		TRANS_INODE(ufsvfsp, ip);
2102 		ip->i_flag |= ICHG;
2103 		if (stickyhack) {
2104 			mutex_enter(&vp->v_lock);
2105 			if ((ip->i_mode & (ISVTX | IEXEC | IFDIR)) == ISVTX)
2106 				vp->v_flag |= VSWAPLIKE;
2107 			else
2108 				vp->v_flag &= ~VSWAPLIKE;
2109 			mutex_exit(&vp->v_lock);
2110 		}
2111 	}
2112 	if (mask & (AT_UID|AT_GID)) {
2113 		if (mask & AT_UID) {
2114 			/*
2115 			 * Don't change ownership of the quota inode.
2116 			 */
2117 			if (ufsvfsp->vfs_qinod == ip) {
2118 				ASSERT(ufsvfsp->vfs_qflags & MQ_ENABLED);
2119 				error = EINVAL;
2120 				goto update_inode;
2121 			}
2122 
2123 			/*
2124 			 * No real ownership change.
2125 			 */
2126 			if (ip->i_uid == vap->va_uid) {
2127 				blocks = 0;
2128 				owner_change = 0;
2129 			}
2130 			/*
2131 			 * Remove the blocks and the file, from the old user's
2132 			 * quota.
2133 			 */
2134 			else {
2135 				blocks = ip->i_blocks;
2136 				owner_change = 1;
2137 
2138 				(void) chkdq(ip, -blocks, /* force */ 1, cr,
2139 						(char **)NULL, (size_t *)NULL);
2140 				(void) chkiq(ufsvfsp, /* change */ -1, ip,
2141 						(uid_t)ip->i_uid,
2142 						/* force */ 1, cr,
2143 						(char **)NULL, (size_t *)NULL);
2144 				dqrele(ip->i_dquot);
2145 			}
2146 
2147 			ip->i_uid = vap->va_uid;
2148 
2149 			/*
2150 			 * There is a real ownership change.
2151 			 */
2152 			if (owner_change) {
2153 				/*
2154 				 * Add the blocks and the file to the new
2155 				 * user's quota.
2156 				 */
2157 				ip->i_dquot = getinoquota(ip);
2158 				(void) chkdq(ip, blocks, /* force */ 1, cr,
2159 						&errmsg1, &len1);
2160 				(void) chkiq(ufsvfsp, /* change */ 1,
2161 						(struct inode *)NULL,
2162 						(uid_t)ip->i_uid,
2163 						/* force */ 1, cr,
2164 						&errmsg2, &len2);
2165 			}
2166 		}
2167 		if (mask & AT_GID) {
2168 			ip->i_gid = vap->va_gid;
2169 		}
2170 		TRANS_INODE(ufsvfsp, ip);
2171 		ip->i_flag |= ICHG;
2172 	}
2173 	/*
2174 	 * Change file access or modified times.
2175 	 */
2176 	if (mask & (AT_ATIME|AT_MTIME)) {
2177 		/* Check that the time value is within ufs range */
2178 		if (((mask & AT_ATIME) && TIMESPEC_OVERFLOW(&vap->va_atime)) ||
2179 		    ((mask & AT_MTIME) && TIMESPEC_OVERFLOW(&vap->va_mtime))) {
2180 			error = EOVERFLOW;
2181 			goto update_inode;
2182 		}
2183 
2184 		/*
2185 		 * if the "noaccess" mount option is set and only atime
2186 		 * update is requested, do nothing. No error is returned.
2187 		 */
2188 		if ((ufsvfsp->vfs_noatime) &&
2189 		    ((mask & (AT_ATIME|AT_MTIME)) == AT_ATIME))
2190 			goto skip_atime;
2191 
2192 		if (mask & AT_ATIME) {
2193 			ip->i_atime.tv_sec = vap->va_atime.tv_sec;
2194 			ip->i_atime.tv_usec = vap->va_atime.tv_nsec / 1000;
2195 			ip->i_flag &= ~IACC;
2196 		}
2197 		if (mask & AT_MTIME) {
2198 			ip->i_mtime.tv_sec = vap->va_mtime.tv_sec;
2199 			ip->i_mtime.tv_usec = vap->va_mtime.tv_nsec / 1000;
2200 			gethrestime(&now);
2201 			if (now.tv_sec > TIME32_MAX) {
2202 				/*
2203 				 * In 2038, ctime sticks forever..
2204 				 */
2205 				ip->i_ctime.tv_sec = TIME32_MAX;
2206 				ip->i_ctime.tv_usec = 0;
2207 			} else {
2208 				ip->i_ctime.tv_sec = now.tv_sec;
2209 				ip->i_ctime.tv_usec = now.tv_nsec / 1000;
2210 			}
2211 			ip->i_flag &= ~(IUPD|ICHG);
2212 			ip->i_flag |= IMODTIME;
2213 		}
2214 		TRANS_INODE(ufsvfsp, ip);
2215 		ip->i_flag |= IMOD;
2216 	}
2217 
2218 skip_atime:
2219 	/*
2220 	 * The presence of a shadow inode may indicate an ACL, but does
2221 	 * not imply an ACL.  Future FSD types should be handled here too
2222 	 * and check for the presence of the attribute-specific data
2223 	 * before referencing it.
2224 	 */
2225 	if (ip->i_shadow) {
2226 		/*
2227 		 * XXX if ufs_iupdat is changed to sandbagged write fix
2228 		 * ufs_acl_setattr to push ip to keep acls consistent
2229 		 *
2230 		 * Suppress out of inodes messages if we will retry.
2231 		 */
2232 		if (retry)
2233 			ip->i_flag |= IQUIET;
2234 		error = ufs_acl_setattr(ip, vap, cr);
2235 		ip->i_flag &= ~IQUIET;
2236 	}
2237 
2238 update_inode:
2239 	/*
2240 	 * Setattr always increases the sequence number
2241 	 */
2242 	ip->i_seq++;
2243 
2244 	/*
2245 	 * if nfsd and not logging; push synchronously
2246 	 */
2247 	if ((curthread->t_flag & T_DONTPEND) && !TRANS_ISTRANS(ufsvfsp)) {
2248 		ufs_iupdat(ip, 1);
2249 	} else {
2250 		ITIMES_NOLOCK(ip);
2251 	}
2252 
2253 	rw_exit(&ip->i_contents);
2254 	if (dodqlock) {
2255 		rw_exit(&ufsvfsp->vfs_dqrwlock);
2256 	}
2257 	if (dorwlock)
2258 		rw_exit(&ip->i_rwlock);
2259 
2260 	if (ulp) {
2261 		if (dotrans) {
2262 			int terr = 0;
2263 			TRANS_END_CSYNC(ufsvfsp, terr, issync, TOP_SETATTR,
2264 			    trans_size);
2265 			if (error == 0)
2266 				error = terr;
2267 		}
2268 		ufs_lockfs_end(ulp);
2269 	}
2270 out:
2271 	/*
2272 	 * If out of inodes or blocks, see if we can free something
2273 	 * up from the delete queue.
2274 	 */
2275 	if ((error == ENOSPC) && retry && TRANS_ISTRANS(ufsvfsp)) {
2276 		ufs_delete_drain_wait(ufsvfsp, 1);
2277 		retry = 0;
2278 		if (errmsg1 != NULL)
2279 			kmem_free(errmsg1, len1);
2280 		if (errmsg2 != NULL)
2281 			kmem_free(errmsg2, len2);
2282 		goto again;
2283 	}
2284 	TRACE_2(TR_FAC_UFS, TR_UFS_SETATTR_END,
2285 		"ufs_setattr_end:vp %p error %d", vp, error);
2286 	if (errmsg1 != NULL) {
2287 		uprintf(errmsg1);
2288 		kmem_free(errmsg1, len1);
2289 	}
2290 	if (errmsg2 != NULL) {
2291 		uprintf(errmsg2);
2292 		kmem_free(errmsg2, len2);
2293 	}
2294 	return (error);
2295 }
2296 
2297 /*ARGSUSED*/
2298 static int
2299 ufs_access(struct vnode *vp, int mode, int flags, struct cred *cr)
2300 {
2301 	struct inode *ip = VTOI(vp);
2302 	int error;
2303 
2304 	TRACE_3(TR_FAC_UFS, TR_UFS_ACCESS_START,
2305 		"ufs_access_start:vp %p mode %x flags %x", vp, mode, flags);
2306 
2307 	if (ip->i_ufsvfs == NULL)
2308 		return (EIO);
2309 
2310 	rw_enter(&ip->i_contents, RW_READER);
2311 
2312 	/*
2313 	 * The ufs_iaccess function wants to be called with
2314 	 * mode bits expressed as "ufs specific" bits.
2315 	 * I.e., VWRITE|VREAD|VEXEC do not make sense to
2316 	 * ufs_iaccess() but IWRITE|IREAD|IEXEC do.
2317 	 * But since they're the same we just pass the vnode mode
2318 	 * bit but just verify that assumption at compile time.
2319 	 */
2320 #if IWRITE != VWRITE || IREAD != VREAD || IEXEC != VEXEC
2321 #error "ufs_access needs to map Vmodes to Imodes"
2322 #endif
2323 	error = ufs_iaccess(ip, mode, cr);
2324 
2325 	rw_exit(&ip->i_contents);
2326 
2327 	TRACE_2(TR_FAC_UFS, TR_UFS_ACCESS_END,
2328 		"ufs_access_end:vp %p error %d", vp, error);
2329 	return (error);
2330 }
2331 
2332 /* ARGSUSED */
2333 static int
2334 ufs_readlink(struct vnode *vp, struct uio *uiop, struct cred *cr)
2335 {
2336 	struct inode *ip = VTOI(vp);
2337 	struct ufsvfs *ufsvfsp;
2338 	struct ulockfs *ulp;
2339 	int error;
2340 	int fastsymlink;
2341 
2342 	TRACE_2(TR_FAC_UFS, TR_UFS_READLINK_START,
2343 		"ufs_readlink_start:vp %p uiop %p", uiop, vp);
2344 
2345 	if (vp->v_type != VLNK) {
2346 		error = EINVAL;
2347 		goto nolockout;
2348 	}
2349 
2350 	/*
2351 	 * If the symbolic link is empty there is nothing to read.
2352 	 * Fast-track these empty symbolic links
2353 	 */
2354 	if (ip->i_size == 0) {
2355 		error = 0;
2356 		goto nolockout;
2357 	}
2358 
2359 	ufsvfsp = ip->i_ufsvfs;
2360 	error = ufs_lockfs_begin(ufsvfsp, &ulp, ULOCKFS_READLINK_MASK);
2361 	if (error)
2362 		goto nolockout;
2363 	/*
2364 	 * The ip->i_rwlock protects the data blocks used for FASTSYMLINK
2365 	 */
2366 again:
2367 	fastsymlink = 0;
2368 	if (ip->i_flag & IFASTSYMLNK) {
2369 		rw_enter(&ip->i_rwlock, RW_READER);
2370 		rw_enter(&ip->i_contents, RW_READER);
2371 		if (ip->i_flag & IFASTSYMLNK) {
2372 			if (!ULOCKFS_IS_NOIACC(ITOUL(ip)) &&
2373 			    (ip->i_fs->fs_ronly == 0) &&
2374 			    (!ufsvfsp->vfs_noatime)) {
2375 				mutex_enter(&ip->i_tlock);
2376 				ip->i_flag |= IACC;
2377 				mutex_exit(&ip->i_tlock);
2378 			}
2379 			error = uiomove((caddr_t)&ip->i_db[1],
2380 				MIN(ip->i_size, uiop->uio_resid),
2381 				UIO_READ, uiop);
2382 			ITIMES(ip);
2383 			++fastsymlink;
2384 		}
2385 		rw_exit(&ip->i_contents);
2386 		rw_exit(&ip->i_rwlock);
2387 	}
2388 	if (!fastsymlink) {
2389 		ssize_t size;	/* number of bytes read  */
2390 		caddr_t basep;	/* pointer to input data */
2391 		ino_t ino;
2392 		long  igen;
2393 		struct uio tuio;	/* temp uio struct */
2394 		struct uio *tuiop;
2395 		iovec_t tiov;		/* temp iovec struct */
2396 		char kbuf[FSL_SIZE];	/* buffer to hold fast symlink */
2397 		int tflag = 0;		/* flag to indicate temp vars used */
2398 
2399 		ino = ip->i_number;
2400 		igen = ip->i_gen;
2401 		size = uiop->uio_resid;
2402 		basep = uiop->uio_iov->iov_base;
2403 		tuiop = uiop;
2404 
2405 		rw_enter(&ip->i_rwlock, RW_WRITER);
2406 		rw_enter(&ip->i_contents, RW_WRITER);
2407 		if (ip->i_flag & IFASTSYMLNK) {
2408 			rw_exit(&ip->i_contents);
2409 			rw_exit(&ip->i_rwlock);
2410 			goto again;
2411 		}
2412 
2413 		/* can this be a fast symlink and is it a user buffer? */
2414 		if (ip->i_size <= FSL_SIZE &&
2415 		    (uiop->uio_segflg == UIO_USERSPACE ||
2416 		    uiop->uio_segflg == UIO_USERISPACE)) {
2417 
2418 			bzero(&tuio, sizeof (struct uio));
2419 			/*
2420 			 * setup a kernel buffer to read link into.  this
2421 			 * is to fix a race condition where the user buffer
2422 			 * got corrupted before copying it into the inode.
2423 			 */
2424 			size = ip->i_size;
2425 			tiov.iov_len = size;
2426 			tiov.iov_base = kbuf;
2427 			tuio.uio_iov = &tiov;
2428 			tuio.uio_iovcnt = 1;
2429 			tuio.uio_offset = uiop->uio_offset;
2430 			tuio.uio_segflg = UIO_SYSSPACE;
2431 			tuio.uio_fmode = uiop->uio_fmode;
2432 			tuio.uio_extflg = uiop->uio_extflg;
2433 			tuio.uio_limit = uiop->uio_limit;
2434 			tuio.uio_resid = size;
2435 
2436 			basep = tuio.uio_iov->iov_base;
2437 			tuiop = &tuio;
2438 			tflag = 1;
2439 		}
2440 
2441 		error = rdip(ip, tuiop, 0, cr);
2442 		if (!(error == 0 && ip->i_number == ino && ip->i_gen == igen)) {
2443 			rw_exit(&ip->i_contents);
2444 			rw_exit(&ip->i_rwlock);
2445 			goto out;
2446 		}
2447 
2448 		if (tflag == 0)
2449 			size -= uiop->uio_resid;
2450 
2451 		if ((tflag == 0 && ip->i_size <= FSL_SIZE &&
2452 		    ip->i_size == size) || (tflag == 1 &&
2453 		    tuio.uio_resid == 0)) {
2454 			error = kcopy(basep, &ip->i_db[1], ip->i_size);
2455 			if (error == 0) {
2456 				ip->i_flag |= IFASTSYMLNK;
2457 				/*
2458 				 * free page
2459 				 */
2460 				(void) VOP_PUTPAGE(ITOV(ip),
2461 				    (offset_t)0, PAGESIZE,
2462 				    (B_DONTNEED | B_FREE | B_FORCE | B_ASYNC),
2463 				    cr);
2464 			} else {
2465 				int i;
2466 				/* error, clear garbage left behind */
2467 				for (i = 1; i < NDADDR; i++)
2468 					ip->i_db[i] = 0;
2469 				for (i = 0; i < NIADDR; i++)
2470 					ip->i_ib[i] = 0;
2471 			}
2472 		}
2473 		if (tflag == 1) {
2474 			/* now, copy it into the user buffer */
2475 			error = uiomove((caddr_t)kbuf,
2476 				MIN(size, uiop->uio_resid),
2477 				UIO_READ, uiop);
2478 		}
2479 		rw_exit(&ip->i_contents);
2480 		rw_exit(&ip->i_rwlock);
2481 	}
2482 out:
2483 	if (ulp) {
2484 		ufs_lockfs_end(ulp);
2485 	}
2486 nolockout:
2487 	TRACE_2(TR_FAC_UFS, TR_UFS_READLINK_END,
2488 		"ufs_readlink_end:vp %p error %d", vp, error);
2489 
2490 	return (error);
2491 }
2492 
2493 /* ARGSUSED */
2494 static int
2495 ufs_fsync(struct vnode *vp, int syncflag, struct cred *cr)
2496 {
2497 	struct inode *ip = VTOI(vp);
2498 	struct ufsvfs *ufsvfsp = ip->i_ufsvfs;
2499 	struct ulockfs *ulp;
2500 	int error;
2501 
2502 	TRACE_1(TR_FAC_UFS, TR_UFS_FSYNC_START,
2503 		"ufs_fsync_start:vp %p", vp);
2504 
2505 	error = ufs_lockfs_begin(ufsvfsp, &ulp, ULOCKFS_FSYNC_MASK);
2506 	if (error)
2507 		return (error);
2508 
2509 	if (TRANS_ISTRANS(ufsvfsp)) {
2510 		/*
2511 		 * First push out any data pages
2512 		 */
2513 		if (vn_has_cached_data(vp) && !(syncflag & FNODSYNC) &&
2514 		    (vp->v_type != VCHR) && !(IS_SWAPVP(vp))) {
2515 			error = VOP_PUTPAGE(vp, (offset_t)0, (size_t)0,
2516 			    0, CRED());
2517 			if (error)
2518 				goto out;
2519 		}
2520 
2521 		/*
2522 		 * Delta any delayed inode times updates
2523 		 * and push inode to log.
2524 		 * All other inode deltas will have already been delta'd
2525 		 * and will be pushed during the commit.
2526 		 */
2527 		if (!(syncflag & FDSYNC) &&
2528 		    ((ip->i_flag & (IMOD|IMODACC)) == IMODACC)) {
2529 			if (ulp) {
2530 				TRANS_BEGIN_ASYNC(ufsvfsp, TOP_FSYNC,
2531 				    TOP_SYNCIP_SIZE);
2532 			}
2533 			rw_enter(&ip->i_contents, RW_READER);
2534 			mutex_enter(&ip->i_tlock);
2535 			ip->i_flag &= ~IMODTIME;
2536 			mutex_exit(&ip->i_tlock);
2537 			ufs_iupdat(ip, I_SYNC);
2538 			rw_exit(&ip->i_contents);
2539 			if (ulp) {
2540 				TRANS_END_ASYNC(ufsvfsp, TOP_FSYNC,
2541 				    TOP_SYNCIP_SIZE);
2542 			}
2543 		}
2544 
2545 		/*
2546 		 * Commit the Moby transaction
2547 		 *
2548 		 * Deltas have already been made so we just need to
2549 		 * commit them with a synchronous transaction.
2550 		 * TRANS_BEGIN_SYNC() will return an error
2551 		 * if there are no deltas to commit, for an
2552 		 * empty transaction.
2553 		 */
2554 		if (ulp) {
2555 			TRANS_BEGIN_SYNC(ufsvfsp, TOP_FSYNC, TOP_COMMIT_SIZE,
2556 			    error);
2557 			if (error) {
2558 				error = 0; /* commit wasn't needed */
2559 				goto out;
2560 			}
2561 			TRANS_END_SYNC(ufsvfsp, error, TOP_FSYNC,
2562 			    TOP_COMMIT_SIZE);
2563 		}
2564 	} else {	/* not logging */
2565 		if (!(IS_SWAPVP(vp)))
2566 			if (syncflag & FNODSYNC) {
2567 				/* Just update the inode only */
2568 				TRANS_IUPDAT(ip, 1);
2569 				error = 0;
2570 			} else if (syncflag & FDSYNC)
2571 				/* Do data-synchronous writes */
2572 				error = TRANS_SYNCIP(ip, 0, I_DSYNC, TOP_FSYNC);
2573 			else
2574 				/* Do synchronous writes */
2575 				error = TRANS_SYNCIP(ip, 0, I_SYNC, TOP_FSYNC);
2576 
2577 		rw_enter(&ip->i_contents, RW_WRITER);
2578 		if (!error)
2579 			error = ufs_sync_indir(ip);
2580 		rw_exit(&ip->i_contents);
2581 	}
2582 out:
2583 	if (ulp) {
2584 		ufs_lockfs_end(ulp);
2585 	}
2586 	TRACE_2(TR_FAC_UFS, TR_UFS_FSYNC_END,
2587 		"ufs_fsync_end:vp %p error %d", vp, error);
2588 	return (error);
2589 }
2590 
2591 /*ARGSUSED*/
2592 static void
2593 ufs_inactive(struct vnode *vp, struct cred *cr)
2594 {
2595 	ufs_iinactive(VTOI(vp));
2596 }
2597 
2598 /*
2599  * Unix file system operations having to do with directory manipulation.
2600  */
2601 int ufs_lookup_idle_count = 2;	/* Number of inodes to idle each time */
2602 /* ARGSUSED */
2603 static int
2604 ufs_lookup(struct vnode *dvp, char *nm, struct vnode **vpp,
2605 	struct pathname *pnp, int flags, struct vnode *rdir, struct cred *cr)
2606 {
2607 	struct inode *ip;
2608 	struct inode *sip;
2609 	struct inode *xip;
2610 	struct ufsvfs *ufsvfsp;
2611 	struct ulockfs *ulp;
2612 	struct vnode *vp;
2613 	int error;
2614 
2615 	TRACE_2(TR_FAC_UFS, TR_UFS_LOOKUP_START,
2616 		"ufs_lookup_start:dvp %p name %s", dvp, nm);
2617 
2618 
2619 	/*
2620 	 * Check flags for type of lookup (regular file or attribute file)
2621 	 */
2622 
2623 	ip = VTOI(dvp);
2624 
2625 	if (flags & LOOKUP_XATTR) {
2626 
2627 		/*
2628 		 * We don't allow recursive attributes...
2629 		 * Maybe someday we will.
2630 		 */
2631 		if ((ip->i_cflags & IXATTR)) {
2632 			return (EINVAL);
2633 		}
2634 
2635 		if ((vp = dnlc_lookup(dvp, XATTR_DIR_NAME)) == NULL) {
2636 			error = ufs_xattr_getattrdir(dvp, &sip, flags, cr);
2637 			if (error) {
2638 				*vpp = NULL;
2639 				goto out;
2640 			}
2641 
2642 			vp = ITOV(sip);
2643 			dnlc_update(dvp, XATTR_DIR_NAME, vp);
2644 		}
2645 
2646 		/*
2647 		 * Check accessibility of directory.
2648 		 */
2649 		if (vp == DNLC_NO_VNODE) {
2650 			VN_RELE(vp);
2651 			error = ENOENT;
2652 			goto out;
2653 		}
2654 		if ((error = ufs_iaccess(VTOI(vp), IEXEC, cr)) != 0) {
2655 			VN_RELE(vp);
2656 			goto out;
2657 		}
2658 
2659 		*vpp = vp;
2660 		return (0);
2661 	}
2662 
2663 	/*
2664 	 * Check for a null component, which we should treat as
2665 	 * looking at dvp from within it's parent, so we don't
2666 	 * need a call to ufs_iaccess(), as it has already been
2667 	 * done.
2668 	 */
2669 	if (nm[0] == 0) {
2670 		VN_HOLD(dvp);
2671 		error = 0;
2672 		*vpp = dvp;
2673 		goto out;
2674 	}
2675 
2676 	/*
2677 	 * Check for "." ie itself. this is a quick check and
2678 	 * avoids adding "." into the dnlc (which have been seen
2679 	 * to occupy >10% of the cache).
2680 	 */
2681 	if ((nm[0] == '.') && (nm[1] == 0)) {
2682 		/*
2683 		 * Don't return without checking accessibility
2684 		 * of the directory. We only need the lock if
2685 		 * we are going to return it.
2686 		 */
2687 		if ((error = ufs_iaccess(ip, IEXEC, cr)) == 0) {
2688 			VN_HOLD(dvp);
2689 			*vpp = dvp;
2690 		}
2691 		goto out;
2692 	}
2693 
2694 	/*
2695 	 * Fast path: Check the directory name lookup cache.
2696 	 */
2697 	if (vp = dnlc_lookup(dvp, nm)) {
2698 		/*
2699 		 * Check accessibility of directory.
2700 		 */
2701 		if ((error = ufs_iaccess(ip, IEXEC, cr)) != 0) {
2702 			VN_RELE(vp);
2703 			goto out;
2704 		}
2705 		if (vp == DNLC_NO_VNODE) {
2706 			VN_RELE(vp);
2707 			error = ENOENT;
2708 			goto out;
2709 		}
2710 		xip = VTOI(vp);
2711 		ulp = NULL;
2712 		goto fastpath;
2713 	}
2714 
2715 	/*
2716 	 * Keep the idle queue from getting too long by
2717 	 * idling two inodes before attempting to allocate another.
2718 	 *    This operation must be performed before entering
2719 	 *    lockfs or a transaction.
2720 	 */
2721 	if (ufs_idle_q.uq_ne > ufs_idle_q.uq_hiwat)
2722 		if ((curthread->t_flag & T_DONTBLOCK) == 0) {
2723 			ins.in_lidles.value.ul += ufs_lookup_idle_count;
2724 			ufs_idle_some(ufs_lookup_idle_count);
2725 		}
2726 
2727 	ufsvfsp = ip->i_ufsvfs;
2728 	error = ufs_lockfs_begin(ufsvfsp, &ulp, ULOCKFS_LOOKUP_MASK);
2729 	if (error)
2730 		goto out;
2731 
2732 	error = ufs_dirlook(ip, nm, &xip, cr, 1);
2733 
2734 fastpath:
2735 	if (error == 0) {
2736 		ip = xip;
2737 		*vpp = ITOV(ip);
2738 
2739 		/*
2740 		 * If vnode is a device return special vnode instead.
2741 		 */
2742 		if (IS_DEVVP(*vpp)) {
2743 			struct vnode *newvp;
2744 
2745 			newvp = specvp(*vpp, (*vpp)->v_rdev, (*vpp)->v_type,
2746 			    cr);
2747 			VN_RELE(*vpp);
2748 			if (newvp == NULL)
2749 				error = ENOSYS;
2750 			else
2751 				*vpp = newvp;
2752 		}
2753 	}
2754 	if (ulp) {
2755 		ufs_lockfs_end(ulp);
2756 	}
2757 
2758 out:
2759 	TRACE_3(TR_FAC_UFS, TR_UFS_LOOKUP_END,
2760 		"ufs_lookup_end:dvp %p name %s error %d", vpp, nm, error);
2761 	return (error);
2762 }
2763 
2764 static int
2765 ufs_create(struct vnode *dvp, char *name, struct vattr *vap, enum vcexcl excl,
2766 	int mode, struct vnode **vpp, struct cred *cr, int flag)
2767 {
2768 	struct inode *ip;
2769 	struct inode *xip;
2770 	struct inode *dip;
2771 	struct vnode *xvp;
2772 	struct ufsvfs *ufsvfsp;
2773 	struct ulockfs *ulp;
2774 	int error;
2775 	int issync;
2776 	int truncflag;
2777 	int trans_size;
2778 	int noentry;
2779 	int defer_dip_seq_update = 0;	/* need to defer update of dip->i_seq */
2780 	int retry = 1;
2781 
2782 	TRACE_1(TR_FAC_UFS, TR_UFS_CREATE_START,
2783 		"ufs_create_start:dvp %p", dvp);
2784 
2785 again:
2786 	ip = VTOI(dvp);
2787 	ufsvfsp = ip->i_ufsvfs;
2788 	truncflag = 0;
2789 
2790 	error = ufs_lockfs_begin(ufsvfsp, &ulp, ULOCKFS_CREATE_MASK);
2791 	if (error)
2792 		goto out;
2793 
2794 	if (ulp) {
2795 		trans_size = (int)TOP_CREATE_SIZE(ip);
2796 		TRANS_BEGIN_CSYNC(ufsvfsp, issync, TOP_CREATE, trans_size);
2797 	}
2798 
2799 	if ((vap->va_mode & VSVTX) && secpolicy_vnode_stky_modify(cr) != 0)
2800 		vap->va_mode &= ~VSVTX;
2801 
2802 	if (*name == '\0') {
2803 		/*
2804 		 * Null component name refers to the directory itself.
2805 		 */
2806 		VN_HOLD(dvp);
2807 		/*
2808 		 * Even though this is an error case, we need to grab the
2809 		 * quota lock since the error handling code below is common.
2810 		 */
2811 		rw_enter(&ufsvfsp->vfs_dqrwlock, RW_READER);
2812 		rw_enter(&ip->i_contents, RW_WRITER);
2813 		error = EEXIST;
2814 	} else {
2815 		xip = NULL;
2816 		noentry = 0;
2817 		rw_enter(&ip->i_rwlock, RW_WRITER);
2818 		xvp = dnlc_lookup(dvp, name);
2819 		if (xvp == DNLC_NO_VNODE) {
2820 			noentry = 1;
2821 			VN_RELE(xvp);
2822 			xvp = NULL;
2823 		}
2824 		if (xvp) {
2825 			rw_exit(&ip->i_rwlock);
2826 			if (error = ufs_iaccess(ip, IEXEC, cr)) {
2827 				VN_RELE(xvp);
2828 			} else {
2829 				error = EEXIST;
2830 				xip = VTOI(xvp);
2831 			}
2832 		} else {
2833 			/*
2834 			 * Suppress file system full message if we will retry
2835 			 */
2836 			error = ufs_direnter_cm(ip, name, DE_CREATE,
2837 				vap, &xip, cr,
2838 				(noentry | (retry ? IQUIET : 0)));
2839 			rw_exit(&ip->i_rwlock);
2840 		}
2841 		ip = xip;
2842 		if (ip != NULL) {
2843 			rw_enter(&ufsvfsp->vfs_dqrwlock, RW_READER);
2844 			rw_enter(&ip->i_contents, RW_WRITER);
2845 		}
2846 	}
2847 
2848 	/*
2849 	 * If the file already exists and this is a non-exclusive create,
2850 	 * check permissions and allow access for non-directories.
2851 	 * Read-only create of an existing directory is also allowed.
2852 	 * We fail an exclusive create of anything which already exists.
2853 	 */
2854 	if (error == EEXIST) {
2855 		dip = VTOI(dvp);
2856 		if (excl == NONEXCL) {
2857 			if ((((ip->i_mode & IFMT) == IFDIR) ||
2858 			    ((ip->i_mode & IFMT) == IFATTRDIR)) &&
2859 			    (mode & IWRITE))
2860 				error = EISDIR;
2861 			else if (mode)
2862 				error = ufs_iaccess(ip, mode, cr);
2863 			else
2864 				error = 0;
2865 		}
2866 		if (error) {
2867 			rw_exit(&ip->i_contents);
2868 			rw_exit(&ufsvfsp->vfs_dqrwlock);
2869 			VN_RELE(ITOV(ip));
2870 			goto unlock;
2871 		}
2872 		/*
2873 		 * If the error EEXIST was set, then i_seq can not
2874 		 * have been updated. The sequence number interface
2875 		 * is defined such that a non-error VOP_CREATE must
2876 		 * increase the dir va_seq it by at least one. If we
2877 		 * have cleared the error, increase i_seq. Note that
2878 		 * we are increasing the dir i_seq and in rare cases
2879 		 * ip may actually be from the dvp, so we already have
2880 		 * the locks and it will not be subject to truncation.
2881 		 * In case we have to update i_seq of the parent
2882 		 * directory dip, we have to defer it till we have
2883 		 * released our locks on ip due to lock ordering requirements.
2884 		 */
2885 		if (ip != dip)
2886 			defer_dip_seq_update = 1;
2887 		else
2888 			ip->i_seq++;
2889 
2890 		if (((ip->i_mode & IFMT) == IFREG) &&
2891 		    (vap->va_mask & AT_SIZE) && vap->va_size == 0) {
2892 			/*
2893 			 * Truncate regular files, if requested by caller.
2894 			 * Grab i_rwlock to make sure no one else is
2895 			 * currently writing to the file (we promised
2896 			 * bmap we would do this).
2897 			 * Must get the locks in the correct order.
2898 			 */
2899 			if (ip->i_size == 0) {
2900 				ip->i_flag |= ICHG | IUPD;
2901 				ip->i_seq++;
2902 				TRANS_INODE(ufsvfsp, ip);
2903 			} else {
2904 				/*
2905 				 * Large Files: Why this check here?
2906 				 * Though we do it in vn_create() we really
2907 				 * want to guarantee that we do not destroy
2908 				 * Large file data by atomically checking
2909 				 * the size while holding the contents
2910 				 * lock.
2911 				 */
2912 				if (flag && !(flag & FOFFMAX) &&
2913 				    ((ip->i_mode & IFMT) == IFREG) &&
2914 				    (ip->i_size > (offset_t)MAXOFF32_T)) {
2915 					rw_exit(&ip->i_contents);
2916 					rw_exit(&ufsvfsp->vfs_dqrwlock);
2917 					error = EOVERFLOW;
2918 					goto unlock;
2919 				}
2920 				if (TRANS_ISTRANS(ufsvfsp))
2921 					truncflag++;
2922 				else {
2923 					rw_exit(&ip->i_contents);
2924 					rw_exit(&ufsvfsp->vfs_dqrwlock);
2925 					rw_enter(&ip->i_rwlock, RW_WRITER);
2926 					rw_enter(&ufsvfsp->vfs_dqrwlock,
2927 							RW_READER);
2928 					rw_enter(&ip->i_contents, RW_WRITER);
2929 					(void) ufs_itrunc(ip, (u_offset_t)0, 0,
2930 								cr);
2931 					rw_exit(&ip->i_rwlock);
2932 				}
2933 			}
2934 		}
2935 	}
2936 
2937 	if (error) {
2938 		if (ip != NULL) {
2939 			rw_exit(&ufsvfsp->vfs_dqrwlock);
2940 			rw_exit(&ip->i_contents);
2941 		}
2942 		goto unlock;
2943 	}
2944 
2945 	*vpp = ITOV(ip);
2946 	ITIMES(ip);
2947 	rw_exit(&ip->i_contents);
2948 	rw_exit(&ufsvfsp->vfs_dqrwlock);
2949 
2950 	/*
2951 	 * If vnode is a device return special vnode instead.
2952 	 */
2953 	if (!error && IS_DEVVP(*vpp)) {
2954 		struct vnode *newvp;
2955 
2956 		newvp = specvp(*vpp, (*vpp)->v_rdev, (*vpp)->v_type, cr);
2957 		VN_RELE(*vpp);
2958 		if (newvp == NULL) {
2959 			error = ENOSYS;
2960 			goto unlock;
2961 		}
2962 		truncflag = 0;
2963 		*vpp = newvp;
2964 	}
2965 unlock:
2966 
2967 	/*
2968 	 * Do the deferred update of the parent directory's sequence
2969 	 * number now.
2970 	 */
2971 	if (defer_dip_seq_update == 1) {
2972 		rw_enter(&dip->i_contents, RW_READER);
2973 		mutex_enter(&dip->i_tlock);
2974 		dip->i_seq++;
2975 		mutex_exit(&dip->i_tlock);
2976 		rw_exit(&dip->i_contents);
2977 	}
2978 
2979 	if (ulp) {
2980 		int terr = 0;
2981 
2982 		TRANS_END_CSYNC(ufsvfsp, terr, issync, TOP_CREATE,
2983 		    trans_size);
2984 
2985 		/*
2986 		 * If we haven't had a more interesting failure
2987 		 * already, then anything that might've happened
2988 		 * here should be reported.
2989 		 */
2990 		if (error == 0)
2991 			error = terr;
2992 	}
2993 
2994 	if (!error && truncflag) {
2995 		rw_enter(&ip->i_rwlock, RW_WRITER);
2996 		(void) TRANS_ITRUNC(ip, (u_offset_t)0, 0, cr);
2997 		rw_exit(&ip->i_rwlock);
2998 	}
2999 
3000 	if (ulp)
3001 		ufs_lockfs_end(ulp);
3002 
3003 	/*
3004 	 * If no inodes available, try to free one up out of the
3005 	 * pending delete queue.
3006 	 */
3007 	if ((error == ENOSPC) && retry && TRANS_ISTRANS(ufsvfsp)) {
3008 		ufs_delete_drain_wait(ufsvfsp, 1);
3009 		retry = 0;
3010 		goto again;
3011 	}
3012 
3013 out:
3014 	TRACE_3(TR_FAC_UFS, TR_UFS_CREATE_END,
3015 		"ufs_create_end:dvp %p name %s error %d", vpp, name, error);
3016 	return (error);
3017 }
3018 
3019 extern int ufs_idle_max;
3020 /*ARGSUSED*/
3021 static int
3022 ufs_remove(struct vnode *vp, char *nm, struct cred *cr)
3023 {
3024 	struct inode *ip = VTOI(vp);
3025 	struct ufsvfs *ufsvfsp	= ip->i_ufsvfs;
3026 	struct ulockfs *ulp;
3027 	vnode_t *rmvp = NULL;	/* Vnode corresponding to name being removed */
3028 	int error;
3029 	int issync;
3030 	int trans_size;
3031 
3032 	TRACE_1(TR_FAC_UFS, TR_UFS_REMOVE_START,
3033 		"ufs_remove_start:vp %p", vp);
3034 
3035 	/*
3036 	 * don't let the delete queue get too long
3037 	 */
3038 	if (ufsvfsp == NULL) {
3039 		error = EIO;
3040 		goto out;
3041 	}
3042 	if (ufsvfsp->vfs_delete.uq_ne > ufs_idle_max)
3043 		ufs_delete_drain(vp->v_vfsp, 1, 1);
3044 
3045 	error = ufs_lockfs_begin(ufsvfsp, &ulp, ULOCKFS_REMOVE_MASK);
3046 	if (error)
3047 		goto out;
3048 
3049 	if (ulp)
3050 		TRANS_BEGIN_CSYNC(ufsvfsp, issync, TOP_REMOVE,
3051 		    trans_size = (int)TOP_REMOVE_SIZE(VTOI(vp)));
3052 
3053 	rw_enter(&ip->i_rwlock, RW_WRITER);
3054 	error = ufs_dirremove(ip, nm, (struct inode *)0, (struct vnode *)0,
3055 	    DR_REMOVE, cr, &rmvp);
3056 	rw_exit(&ip->i_rwlock);
3057 
3058 	if (ulp) {
3059 		TRANS_END_CSYNC(ufsvfsp, error, issync, TOP_REMOVE, trans_size);
3060 		ufs_lockfs_end(ulp);
3061 	}
3062 
3063 	/*
3064 	 * This must be called after the remove transaction is closed.
3065 	 */
3066 	if (rmvp != NULL) {
3067 		/* Only send the event if there were no errors */
3068 		if (error == 0)
3069 			vnevent_remove(rmvp);
3070 		VN_RELE(rmvp);
3071 	}
3072 out:
3073 	TRACE_3(TR_FAC_UFS, TR_UFS_REMOVE_END,
3074 		"ufs_remove_end:vp %p name %s error %d", vp, nm, error);
3075 	return (error);
3076 }
3077 
3078 /*
3079  * Link a file or a directory.  Only privileged processes are allowed to
3080  * make links to directories.
3081  */
3082 static int
3083 ufs_link(struct vnode *tdvp, struct vnode *svp, char *tnm, struct cred *cr)
3084 {
3085 	struct inode *sip;
3086 	struct inode *tdp = VTOI(tdvp);
3087 	struct ufsvfs *ufsvfsp = tdp->i_ufsvfs;
3088 	struct ulockfs *ulp;
3089 	struct vnode *realvp;
3090 	int error;
3091 	int issync;
3092 	int trans_size;
3093 	int isdev;
3094 
3095 	TRACE_1(TR_FAC_UFS, TR_UFS_LINK_START,
3096 		"ufs_link_start:tdvp %p", tdvp);
3097 
3098 	error = ufs_lockfs_begin(ufsvfsp, &ulp, ULOCKFS_LINK_MASK);
3099 	if (error)
3100 		goto out;
3101 
3102 	if (ulp)
3103 		TRANS_BEGIN_CSYNC(ufsvfsp, issync, TOP_LINK,
3104 		    trans_size = (int)TOP_LINK_SIZE(VTOI(tdvp)));
3105 
3106 	if (VOP_REALVP(svp, &realvp) == 0)
3107 		svp = realvp;
3108 
3109 	/*
3110 	 * Make sure link for extended attributes is valid
3111 	 * We only support hard linking of attr in ATTRDIR to ATTRDIR
3112 	 *
3113 	 * Make certain we don't attempt to look at a device node as
3114 	 * a ufs inode.
3115 	 */
3116 
3117 	isdev = IS_DEVVP(svp);
3118 	if (((isdev == 0) && ((VTOI(svp)->i_cflags & IXATTR) == 0) &&
3119 	    ((tdp->i_mode & IFMT) == IFATTRDIR)) ||
3120 	    ((isdev == 0) && (VTOI(svp)->i_cflags & IXATTR) &&
3121 	    ((tdp->i_mode & IFMT) == IFDIR))) {
3122 		error = EINVAL;
3123 		goto unlock;
3124 	}
3125 
3126 	sip = VTOI(svp);
3127 	if ((svp->v_type == VDIR &&
3128 	    secpolicy_fs_linkdir(cr, ufsvfsp->vfs_vfs) != 0) ||
3129 	    (sip->i_uid != crgetuid(cr) && secpolicy_basic_link(cr) != 0)) {
3130 		error = EPERM;
3131 		goto unlock;
3132 	}
3133 	rw_enter(&tdp->i_rwlock, RW_WRITER);
3134 	error = ufs_direnter_lr(tdp, tnm, DE_LINK, (struct inode *)0,
3135 	    sip, cr, NULL);
3136 	rw_exit(&tdp->i_rwlock);
3137 
3138 unlock:
3139 	if (ulp) {
3140 		TRANS_END_CSYNC(ufsvfsp, error, issync, TOP_LINK, trans_size);
3141 		ufs_lockfs_end(ulp);
3142 	}
3143 out:
3144 	TRACE_2(TR_FAC_UFS, TR_UFS_LINK_END,
3145 		"ufs_link_end:tdvp %p error %d", tdvp, error);
3146 	return (error);
3147 }
3148 
3149 uint64_t ufs_rename_retry_cnt;
3150 uint64_t ufs_rename_upgrade_retry_cnt;
3151 uint64_t ufs_rename_dircheck_retry_cnt;
3152 clock_t	 ufs_rename_backoff_delay = 1;
3153 
3154 /*
3155  * Rename a file or directory.
3156  * We are given the vnode and entry string of the source and the
3157  * vnode and entry string of the place we want to move the source
3158  * to (the target). The essential operation is:
3159  *	unlink(target);
3160  *	link(source, target);
3161  *	unlink(source);
3162  * but "atomically".  Can't do full commit without saving state in
3163  * the inode on disk, which isn't feasible at this time.  Best we
3164  * can do is always guarantee that the TARGET exists.
3165  */
3166 /*ARGSUSED*/
3167 static int
3168 ufs_rename(
3169 	struct vnode *sdvp,		/* old (source) parent vnode */
3170 	char *snm,			/* old (source) entry name */
3171 	struct vnode *tdvp,		/* new (target) parent vnode */
3172 	char *tnm,			/* new (target) entry name */
3173 	struct cred *cr)
3174 {
3175 	struct inode *sip = NULL;	/* source inode */
3176 	struct inode *sdp;		/* old (source) parent inode */
3177 	struct inode *tdp;		/* new (target) parent inode */
3178 	struct vnode *tvp = NULL;	/* target vnode, if it exists */
3179 	struct vnode *realvp;
3180 	struct ufsvfs *ufsvfsp;
3181 	struct ulockfs *ulp;
3182 	int error;
3183 	int issync;
3184 	int trans_size;
3185 
3186 	TRACE_1(TR_FAC_UFS, TR_UFS_RENAME_START,
3187 		"ufs_rename_start:sdvp %p", sdvp);
3188 
3189 
3190 	sdp = VTOI(sdvp);
3191 	ufsvfsp = sdp->i_ufsvfs;
3192 	error = ufs_lockfs_begin(ufsvfsp, &ulp, ULOCKFS_RENAME_MASK);
3193 	if (error)
3194 		goto out;
3195 
3196 	if (ulp)
3197 		TRANS_BEGIN_CSYNC(ufsvfsp, issync, TOP_RENAME,
3198 		    trans_size = (int)TOP_RENAME_SIZE(sdp));
3199 
3200 	if (VOP_REALVP(tdvp, &realvp) == 0)
3201 		tdvp = realvp;
3202 
3203 	tdp = VTOI(tdvp);
3204 
3205 	/*
3206 	 * We only allow renaming of attributes from ATTRDIR to ATTRDIR.
3207 	 */
3208 	if ((tdp->i_mode & IFMT) != (sdp->i_mode & IFMT)) {
3209 		error = EINVAL;
3210 		goto unlock;
3211 	}
3212 
3213 	/*
3214 	 * Look up inode of file we're supposed to rename.
3215 	 */
3216 	if (error = ufs_dirlook(sdp, snm, &sip, cr, 0)) {
3217 		goto unlock;
3218 	}
3219 
3220 	/*
3221 	 * Lock both the source and target directories (they may be
3222 	 * the same) to provide the atomicity semantics that was
3223 	 * previously provided by the per file system vfs_rename_lock
3224 	 *
3225 	 * with vfs_rename_lock removed to allow simultaneous renames
3226 	 * within a file system, ufs_dircheckpath can deadlock while
3227 	 * traversing back to ensure that source is not a parent directory
3228 	 * of target parent directory. This is because we get into
3229 	 * ufs_dircheckpath with the sdp and tdp locks held as RW_WRITER.
3230 	 * If the tdp and sdp of the simultaneous renames happen to be
3231 	 * in the path of each other, it can lead to a deadlock. This
3232 	 * can be avoided by getting the locks as RW_READER here and then
3233 	 * upgrading to RW_WRITER after completing the ufs_dircheckpath.
3234 	 */
3235 retry:
3236 	rw_enter(&tdp->i_rwlock, RW_READER);
3237 	if (tdp != sdp) {
3238 		/*
3239 		 * We're locking 2 peer level locks, so must use tryenter
3240 		 * on the 2nd to avoid deadlocks that would occur
3241 		 * if we renamed a->b and b->a concurrently.
3242 		 */
3243 		if (!rw_tryenter(&sdp->i_rwlock, RW_READER)) {
3244 			/*
3245 			 * Reverse the lock grabs in case we have heavy
3246 			 * contention on the 2nd lock.
3247 			 */
3248 			rw_exit(&tdp->i_rwlock);
3249 			rw_enter(&sdp->i_rwlock, RW_READER);
3250 			if (!rw_tryenter(&tdp->i_rwlock, RW_READER)) {
3251 				ufs_rename_retry_cnt++;
3252 				rw_exit(&sdp->i_rwlock);
3253 				goto retry;
3254 			}
3255 		}
3256 	}
3257 
3258 	if (sip == tdp) {
3259 		error = EINVAL;
3260 		goto errout;
3261 	}
3262 	/*
3263 	 * Make sure we can delete the source entry.  This requires
3264 	 * write permission on the containing directory.
3265 	 * Check for sticky directories.
3266 	 */
3267 	rw_enter(&sdp->i_contents, RW_READER);
3268 	rw_enter(&sip->i_contents, RW_READER);
3269 	if ((error = ufs_iaccess(sdp, IWRITE, cr)) != 0 ||
3270 	    (error = ufs_sticky_remove_access(sdp, sip, cr)) != 0) {
3271 		rw_exit(&sip->i_contents);
3272 		rw_exit(&sdp->i_contents);
3273 		goto errout;
3274 	}
3275 
3276 	/*
3277 	 * If this is a rename of a directory and the parent is
3278 	 * different (".." must be changed), then the source
3279 	 * directory must not be in the directory hierarchy
3280 	 * above the target, as this would orphan everything
3281 	 * below the source directory.  Also the user must have
3282 	 * write permission in the source so as to be able to
3283 	 * change "..".
3284 	 */
3285 	if ((((sip->i_mode & IFMT) == IFDIR) ||
3286 	    ((sip->i_mode & IFMT) == IFATTRDIR)) && sdp != tdp) {
3287 		ino_t	inum;
3288 
3289 		if ((error = ufs_iaccess(sip, IWRITE, cr))) {
3290 			rw_exit(&sip->i_contents);
3291 			rw_exit(&sdp->i_contents);
3292 			goto errout;
3293 		}
3294 		inum = sip->i_number;
3295 		rw_exit(&sip->i_contents);
3296 		rw_exit(&sdp->i_contents);
3297 		if ((error = ufs_dircheckpath(inum, tdp, sdp, cr))) {
3298 			/*
3299 			 * If we got EAGAIN ufs_dircheckpath detected a
3300 			 * potential deadlock and backed out. We need
3301 			 * to retry the operation since sdp and tdp have
3302 			 * to be released to avoid the deadlock.
3303 			 */
3304 			if (error == EAGAIN) {
3305 				rw_exit(&tdp->i_rwlock);
3306 				if (tdp != sdp)
3307 					rw_exit(&sdp->i_rwlock);
3308 				delay(ufs_rename_backoff_delay);
3309 				ufs_rename_dircheck_retry_cnt++;
3310 				goto retry;
3311 			}
3312 			goto errout;
3313 		}
3314 	} else {
3315 		rw_exit(&sip->i_contents);
3316 		rw_exit(&sdp->i_contents);
3317 	}
3318 
3319 
3320 	/*
3321 	 * Check for renaming '.' or '..' or alias of '.'
3322 	 */
3323 	if (strcmp(snm, ".") == 0 || strcmp(snm, "..") == 0 || sdp == sip) {
3324 		error = EINVAL;
3325 		goto errout;
3326 	}
3327 
3328 	/*
3329 	 * Simultaneous renames can deadlock in ufs_dircheckpath since it
3330 	 * tries to traverse back the file tree with both tdp and sdp held
3331 	 * as RW_WRITER. To avoid that we have to hold the tdp and sdp locks
3332 	 * as RW_READERS  till ufs_dircheckpath is done.
3333 	 * Now that ufs_dircheckpath is done with, we can upgrade the locks
3334 	 * to RW_WRITER.
3335 	 */
3336 	if (!rw_tryupgrade(&tdp->i_rwlock)) {
3337 		/*
3338 		 * The upgrade failed. We got to give away the lock
3339 		 * as to avoid deadlocking with someone else who is
3340 		 * waiting for writer lock. With the lock gone, we
3341 		 * cannot be sure the checks done above will hold
3342 		 * good when we eventually get them back as writer.
3343 		 * So if we can't upgrade we drop the locks and retry
3344 		 * everything again.
3345 		 */
3346 		rw_exit(&tdp->i_rwlock);
3347 		if (tdp != sdp)
3348 			rw_exit(&sdp->i_rwlock);
3349 		delay(ufs_rename_backoff_delay);
3350 		ufs_rename_upgrade_retry_cnt++;
3351 		goto retry;
3352 	}
3353 	if (tdp != sdp) {
3354 		if (!rw_tryupgrade(&sdp->i_rwlock)) {
3355 			/*
3356 			 * The upgrade failed. We got to give away the lock
3357 			 * as to avoid deadlocking with someone else who is
3358 			 * waiting for writer lock. With the lock gone, we
3359 			 * cannot be sure the checks done above will hold
3360 			 * good when we eventually get them back as writer.
3361 			 * So if we can't upgrade we drop the locks and retry
3362 			 * everything again.
3363 			 */
3364 			rw_exit(&tdp->i_rwlock);
3365 			rw_exit(&sdp->i_rwlock);
3366 			delay(ufs_rename_backoff_delay);
3367 			ufs_rename_upgrade_retry_cnt++;
3368 			goto retry;
3369 		}
3370 	}
3371 	/*
3372 	 * Link source to the target.  If a target exists, return its
3373 	 * vnode pointer in tvp.  We'll release it after sending the
3374 	 * vnevent.
3375 	 */
3376 	if (error = ufs_direnter_lr(tdp, tnm, DE_RENAME, sdp, sip, cr, &tvp)) {
3377 		/*
3378 		 * ESAME isn't really an error; it indicates that the
3379 		 * operation should not be done because the source and target
3380 		 * are the same file, but that no error should be reported.
3381 		 */
3382 		if (error == ESAME)
3383 			error = 0;
3384 		goto errout;
3385 	}
3386 
3387 	/*
3388 	 * Unlink the source.
3389 	 * Remove the source entry.  ufs_dirremove() checks that the entry
3390 	 * still reflects sip, and returns an error if it doesn't.
3391 	 * If the entry has changed just forget about it.  Release
3392 	 * the source inode.
3393 	 */
3394 	if ((error = ufs_dirremove(sdp, snm, sip, (struct vnode *)0,
3395 	    DR_RENAME, cr, NULL)) == ENOENT)
3396 		error = 0;
3397 
3398 errout:
3399 	rw_exit(&tdp->i_rwlock);
3400 	if (sdp != tdp) {
3401 		rw_exit(&sdp->i_rwlock);
3402 	}
3403 
3404 unlock:
3405 	if (ulp) {
3406 		TRANS_END_CSYNC(ufsvfsp, error, issync, TOP_RENAME, trans_size);
3407 		ufs_lockfs_end(ulp);
3408 	}
3409 
3410 	/*
3411 	 * If no errors, send the appropriate events on the source
3412 	 * and destination (a.k.a, target) vnodes, if they exist.
3413 	 * This has to be done after the rename transaction has closed.
3414 	 */
3415 	if (error == 0) {
3416 		if (tvp != NULL)
3417 			vnevent_rename_dest(tvp);
3418 		/*
3419 		 * Note that if ufs_direnter_lr() returned ESAME then
3420 		 * this event will still be sent.  This isn't expected
3421 		 * to be a problem for anticipated usage by consumers.
3422 		 */
3423 		if (sip != NULL)
3424 			vnevent_rename_src(ITOV(sip));
3425 	}
3426 
3427 	if (tvp != NULL)
3428 		VN_RELE(tvp);
3429 
3430 	if (sip != NULL)
3431 		VN_RELE(ITOV(sip));
3432 
3433 out:
3434 	TRACE_5(TR_FAC_UFS, TR_UFS_RENAME_END,
3435 		"ufs_rename_end:sdvp %p snm %s tdvp %p tnm %s error %d",
3436 			sdvp, snm, tdvp, tnm, error);
3437 	return (error);
3438 }
3439 
3440 /*ARGSUSED*/
3441 static int
3442 ufs_mkdir(struct vnode *dvp, char *dirname, struct vattr *vap,
3443 	struct vnode **vpp, struct cred *cr)
3444 {
3445 	struct inode *ip;
3446 	struct inode *xip;
3447 	struct ufsvfs *ufsvfsp;
3448 	struct ulockfs *ulp;
3449 	int error;
3450 	int issync;
3451 	int trans_size;
3452 	int retry = 1;
3453 
3454 	ASSERT((vap->va_mask & (AT_TYPE|AT_MODE)) == (AT_TYPE|AT_MODE));
3455 
3456 	TRACE_1(TR_FAC_UFS, TR_UFS_MKDIR_START,
3457 		"ufs_mkdir_start:dvp %p", dvp);
3458 
3459 	/*
3460 	 * Can't make directory in attr hidden dir
3461 	 */
3462 	if ((VTOI(dvp)->i_mode & IFMT) == IFATTRDIR)
3463 		return (EINVAL);
3464 
3465 again:
3466 	ip = VTOI(dvp);
3467 	ufsvfsp = ip->i_ufsvfs;
3468 	error = ufs_lockfs_begin(ufsvfsp, &ulp, ULOCKFS_MKDIR_MASK);
3469 	if (error)
3470 		goto out;
3471 	if (ulp)
3472 		TRANS_BEGIN_CSYNC(ufsvfsp, issync, TOP_MKDIR,
3473 		    trans_size = (int)TOP_MKDIR_SIZE(ip));
3474 
3475 	rw_enter(&ip->i_rwlock, RW_WRITER);
3476 
3477 	error = ufs_direnter_cm(ip, dirname, DE_MKDIR, vap, &xip, cr,
3478 		(retry ? IQUIET : 0));
3479 
3480 	rw_exit(&ip->i_rwlock);
3481 	if (error == 0) {
3482 		ip = xip;
3483 		*vpp = ITOV(ip);
3484 	} else if (error == EEXIST)
3485 		VN_RELE(ITOV(xip));
3486 
3487 	if (ulp) {
3488 		int terr = 0;
3489 		TRANS_END_CSYNC(ufsvfsp, terr, issync, TOP_MKDIR, trans_size);
3490 		ufs_lockfs_end(ulp);
3491 		if (error == 0)
3492 			error = terr;
3493 	}
3494 out:
3495 	if ((error == ENOSPC) && retry && TRANS_ISTRANS(ufsvfsp)) {
3496 		ufs_delete_drain_wait(ufsvfsp, 1);
3497 		retry = 0;
3498 		goto again;
3499 	}
3500 
3501 	TRACE_2(TR_FAC_UFS, TR_UFS_MKDIR_END,
3502 		"ufs_mkdir_end:dvp %p error %d", dvp, error);
3503 	return (error);
3504 }
3505 
3506 /*ARGSUSED*/
3507 static int
3508 ufs_rmdir(struct vnode *vp, char *nm, struct vnode *cdir, struct cred *cr)
3509 {
3510 	struct inode *ip = VTOI(vp);
3511 	struct ufsvfs *ufsvfsp = ip->i_ufsvfs;
3512 	struct ulockfs *ulp;
3513 	vnode_t *rmvp = NULL;	/* Vnode of removed directory */
3514 	int error;
3515 	int issync;
3516 
3517 	TRACE_1(TR_FAC_UFS, TR_UFS_RMDIR_START,
3518 		"ufs_rmdir_start:vp %p", vp);
3519 
3520 	/*
3521 	 * don't let the delete queue get too long
3522 	 */
3523 	if (ufsvfsp == NULL) {
3524 		error = EIO;
3525 		goto out;
3526 	}
3527 	if (ufsvfsp->vfs_delete.uq_ne > ufs_idle_max)
3528 		ufs_delete_drain(vp->v_vfsp, 1, 1);
3529 
3530 	error = ufs_lockfs_begin(ufsvfsp, &ulp, ULOCKFS_RMDIR_MASK);
3531 	if (error)
3532 		goto out;
3533 
3534 	if (ulp)
3535 		TRANS_BEGIN_CSYNC(ufsvfsp, issync, TOP_RMDIR, TOP_RMDIR_SIZE);
3536 
3537 	rw_enter(&ip->i_rwlock, RW_WRITER);
3538 	error = ufs_dirremove(ip, nm, (struct inode *)0, cdir, DR_RMDIR, cr,
3539 									&rmvp);
3540 	rw_exit(&ip->i_rwlock);
3541 
3542 	if (ulp) {
3543 		TRANS_END_CSYNC(ufsvfsp, error, issync, TOP_RMDIR,
3544 				TOP_RMDIR_SIZE);
3545 		ufs_lockfs_end(ulp);
3546 	}
3547 
3548 	/*
3549 	 * This must be done AFTER the rmdir transaction has closed.
3550 	 */
3551 	if (rmvp != NULL) {
3552 		/* Only send the event if there were no errors */
3553 		if (error == 0)
3554 			vnevent_rmdir(rmvp);
3555 		VN_RELE(rmvp);
3556 	}
3557 out:
3558 	TRACE_2(TR_FAC_UFS, TR_UFS_RMDIR_END,
3559 		"ufs_rmdir_end:vp %p error %d", vp, error);
3560 
3561 	return (error);
3562 }
3563 
3564 /* ARGSUSED */
3565 static int
3566 ufs_readdir(
3567 	struct vnode *vp,
3568 	struct uio *uiop,
3569 	struct cred *cr,
3570 	int *eofp)
3571 {
3572 	struct iovec *iovp;
3573 	struct inode *ip;
3574 	struct direct *idp;
3575 	struct dirent64 *odp;
3576 	struct fbuf *fbp;
3577 	struct ufsvfs *ufsvfsp;
3578 	struct ulockfs *ulp;
3579 	caddr_t outbuf;
3580 	size_t bufsize;
3581 	uint_t offset;
3582 	uint_t bytes_wanted, total_bytes_wanted;
3583 	int incount = 0;
3584 	int outcount = 0;
3585 	int error;
3586 
3587 	ip = VTOI(vp);
3588 	ASSERT(RW_READ_HELD(&ip->i_rwlock));
3589 
3590 	TRACE_2(TR_FAC_UFS, TR_UFS_READDIR_START,
3591 		"ufs_readdir_start:vp %p uiop %p", vp, uiop);
3592 
3593 	if (uiop->uio_loffset >= MAXOFF32_T) {
3594 		if (eofp)
3595 			*eofp = 1;
3596 		return (0);
3597 	}
3598 
3599 	/*
3600 	 * Check if we have been called with a valid iov_len
3601 	 * and bail out if not, otherwise we may potentially loop
3602 	 * forever further down.
3603 	 */
3604 	if (uiop->uio_iov->iov_len <= 0) {
3605 		error = EINVAL;
3606 		goto out;
3607 	}
3608 
3609 	/*
3610 	 * Large Files: When we come here we are guaranteed that
3611 	 * uio_offset can be used safely. The high word is zero.
3612 	 */
3613 
3614 	ufsvfsp = ip->i_ufsvfs;
3615 	error = ufs_lockfs_begin(ufsvfsp, &ulp, ULOCKFS_READDIR_MASK);
3616 	if (error)
3617 		goto out;
3618 
3619 	iovp = uiop->uio_iov;
3620 	total_bytes_wanted = iovp->iov_len;
3621 
3622 	/* Large Files: directory files should not be "large" */
3623 
3624 	ASSERT(ip->i_size <= MAXOFF32_T);
3625 
3626 	/* Force offset to be valid (to guard against bogus lseek() values) */
3627 	offset = (uint_t)uiop->uio_offset & ~(DIRBLKSIZ - 1);
3628 
3629 	/* Quit if at end of file or link count of zero (posix) */
3630 	if (offset >= (uint_t)ip->i_size || ip->i_nlink <= 0) {
3631 		if (eofp)
3632 			*eofp = 1;
3633 		error = 0;
3634 		goto unlock;
3635 	}
3636 
3637 	/*
3638 	 * Get space to change directory entries into fs independent format.
3639 	 * Do fast alloc for the most commonly used-request size (filesystem
3640 	 * block size).
3641 	 */
3642 	if (uiop->uio_segflg != UIO_SYSSPACE || uiop->uio_iovcnt != 1) {
3643 		bufsize = total_bytes_wanted;
3644 		outbuf = kmem_alloc(bufsize, KM_SLEEP);
3645 		odp = (struct dirent64 *)outbuf;
3646 	} else {
3647 		bufsize = total_bytes_wanted;
3648 		odp = (struct dirent64 *)iovp->iov_base;
3649 	}
3650 
3651 nextblk:
3652 	bytes_wanted = total_bytes_wanted;
3653 
3654 	/* Truncate request to file size */
3655 	if (offset + bytes_wanted > (int)ip->i_size)
3656 		bytes_wanted = (int)(ip->i_size - offset);
3657 
3658 	/* Comply with MAXBSIZE boundary restrictions of fbread() */
3659 	if ((offset & MAXBOFFSET) + bytes_wanted > MAXBSIZE)
3660 		bytes_wanted = MAXBSIZE - (offset & MAXBOFFSET);
3661 
3662 	/*
3663 	 * Read in the next chunk.
3664 	 * We are still holding the i_rwlock.
3665 	 */
3666 	error = fbread(vp, (offset_t)offset, bytes_wanted, S_OTHER, &fbp);
3667 
3668 	if (error)
3669 		goto update_inode;
3670 	if (!ULOCKFS_IS_NOIACC(ITOUL(ip)) && (ip->i_fs->fs_ronly == 0) &&
3671 	    (!ufsvfsp->vfs_noatime)) {
3672 		ip->i_flag |= IACC;
3673 	}
3674 	incount = 0;
3675 	idp = (struct direct *)fbp->fb_addr;
3676 	if (idp->d_ino == 0 && idp->d_reclen == 0 &&
3677 		idp->d_namlen == 0) {
3678 		cmn_err(CE_WARN, "ufs_readdir: bad dir, inumber = %llu, "
3679 			"fs = %s\n",
3680 			(u_longlong_t)ip->i_number, ufsvfsp->vfs_fs->fs_fsmnt);
3681 		fbrelse(fbp, S_OTHER);
3682 		error = ENXIO;
3683 		goto update_inode;
3684 	}
3685 	/* Transform to file-system independent format */
3686 	while (incount < bytes_wanted) {
3687 		/*
3688 		 * If the current directory entry is mangled, then skip
3689 		 * to the next block.  It would be nice to set the FSBAD
3690 		 * flag in the super-block so that a fsck is forced on
3691 		 * next reboot, but locking is a problem.
3692 		 */
3693 		if (idp->d_reclen & 0x3) {
3694 			offset = (offset + DIRBLKSIZ) & ~(DIRBLKSIZ-1);
3695 			break;
3696 		}
3697 
3698 		/* Skip to requested offset and skip empty entries */
3699 		if (idp->d_ino != 0 && offset >= (uint_t)uiop->uio_offset) {
3700 			ushort_t this_reclen =
3701 			    DIRENT64_RECLEN(idp->d_namlen);
3702 			/* Buffer too small for any entries */
3703 			if (!outcount && this_reclen > bufsize) {
3704 				fbrelse(fbp, S_OTHER);
3705 				error = EINVAL;
3706 				goto update_inode;
3707 			}
3708 			/* If would overrun the buffer, quit */
3709 			if (outcount + this_reclen > bufsize) {
3710 				break;
3711 			}
3712 			/* Take this entry */
3713 			odp->d_ino = (ino64_t)idp->d_ino;
3714 			odp->d_reclen = (ushort_t)this_reclen;
3715 			odp->d_off = (offset_t)(offset + idp->d_reclen);
3716 
3717 			/* use strncpy(9f) to zero out uninitialized bytes */
3718 
3719 			ASSERT(strlen(idp->d_name) + 1 <=
3720 			    DIRENT64_NAMELEN(this_reclen));
3721 			(void) strncpy(odp->d_name, idp->d_name,
3722 			    DIRENT64_NAMELEN(this_reclen));
3723 			outcount += odp->d_reclen;
3724 			odp = (struct dirent64 *)((intptr_t)odp +
3725 				    odp->d_reclen);
3726 			ASSERT(outcount <= bufsize);
3727 		}
3728 		if (idp->d_reclen) {
3729 			incount += idp->d_reclen;
3730 			offset += idp->d_reclen;
3731 			idp = (struct direct *)((intptr_t)idp + idp->d_reclen);
3732 		} else {
3733 			offset = (offset + DIRBLKSIZ) & ~(DIRBLKSIZ-1);
3734 			break;
3735 		}
3736 	}
3737 	/* Release the chunk */
3738 	fbrelse(fbp, S_OTHER);
3739 
3740 	/* Read whole block, but got no entries, read another if not eof */
3741 
3742 	/*
3743 	 * Large Files: casting i_size to int here is not a problem
3744 	 * because directory sizes are always less than MAXOFF32_T.
3745 	 * See assertion above.
3746 	 */
3747 
3748 	if (offset < (int)ip->i_size && !outcount)
3749 		goto nextblk;
3750 
3751 	/* Copy out the entry data */
3752 	if (uiop->uio_segflg == UIO_SYSSPACE && uiop->uio_iovcnt == 1) {
3753 		iovp->iov_base += outcount;
3754 		iovp->iov_len -= outcount;
3755 		uiop->uio_resid -= outcount;
3756 		uiop->uio_offset = offset;
3757 	} else if ((error = uiomove(outbuf, (long)outcount, UIO_READ,
3758 				    uiop)) == 0)
3759 		uiop->uio_offset = offset;
3760 update_inode:
3761 	ITIMES(ip);
3762 	if (uiop->uio_segflg != UIO_SYSSPACE || uiop->uio_iovcnt != 1)
3763 		kmem_free(outbuf, bufsize);
3764 
3765 	if (eofp && error == 0)
3766 		*eofp = (uiop->uio_offset >= (int)ip->i_size);
3767 unlock:
3768 	if (ulp) {
3769 		ufs_lockfs_end(ulp);
3770 	}
3771 out:
3772 	TRACE_2(TR_FAC_UFS, TR_UFS_READDIR_END,
3773 		"ufs_readdir_end:vp %p error %d", vp, error);
3774 	return (error);
3775 }
3776 
3777 /*ARGSUSED*/
3778 static int
3779 ufs_symlink(
3780 	struct vnode *dvp,		/* ptr to parent dir vnode */
3781 	char *linkname,			/* name of symbolic link */
3782 	struct vattr *vap,		/* attributes */
3783 	char *target,			/* target path */
3784 	struct cred *cr)		/* user credentials */
3785 {
3786 	struct inode *ip, *dip = VTOI(dvp);
3787 	struct ufsvfs *ufsvfsp = dip->i_ufsvfs;
3788 	struct ulockfs *ulp;
3789 	int error;
3790 	int issync;
3791 	int trans_size;
3792 	int residual;
3793 	int ioflag;
3794 	int retry = 1;
3795 
3796 	TRACE_1(TR_FAC_UFS, TR_UFS_SYMLINK_START,
3797 		"ufs_symlink_start:dvp %p", dvp);
3798 
3799 	/*
3800 	 * No symlinks in attrdirs at this time
3801 	 */
3802 	if ((VTOI(dvp)->i_mode & IFMT) == IFATTRDIR)
3803 		return (EINVAL);
3804 
3805 again:
3806 	ip = (struct inode *)NULL;
3807 	vap->va_type = VLNK;
3808 	vap->va_rdev = 0;
3809 
3810 	error = ufs_lockfs_begin(ufsvfsp, &ulp, ULOCKFS_SYMLINK_MASK);
3811 	if (error)
3812 		goto out;
3813 
3814 	if (ulp)
3815 		TRANS_BEGIN_CSYNC(ufsvfsp, issync, TOP_SYMLINK,
3816 		    trans_size = (int)TOP_SYMLINK_SIZE(dip));
3817 
3818 	/*
3819 	 * We must create the inode before the directory entry, to avoid
3820 	 * racing with readlink().  ufs_dirmakeinode requires that we
3821 	 * hold the quota lock as reader, and directory locks as writer.
3822 	 */
3823 
3824 	rw_enter(&dip->i_rwlock, RW_WRITER);
3825 	rw_enter(&ufsvfsp->vfs_dqrwlock, RW_READER);
3826 	rw_enter(&dip->i_contents, RW_WRITER);
3827 
3828 	/*
3829 	 * Suppress any out of inodes messages if we will retry on
3830 	 * ENOSP
3831 	 */
3832 	if (retry)
3833 		dip->i_flag |= IQUIET;
3834 
3835 	error = ufs_dirmakeinode(dip, &ip, vap, DE_SYMLINK, cr);
3836 
3837 	dip->i_flag &= ~IQUIET;
3838 
3839 	rw_exit(&dip->i_contents);
3840 	rw_exit(&ufsvfsp->vfs_dqrwlock);
3841 	rw_exit(&dip->i_rwlock);
3842 
3843 	if (error)
3844 		goto unlock;
3845 
3846 	/*
3847 	 * OK.  The inode has been created.  Write out the data of the
3848 	 * symbolic link.  Since symbolic links are metadata, and should
3849 	 * remain consistent across a system crash, we need to force the
3850 	 * data out synchronously.
3851 	 *
3852 	 * (This is a change from the semantics in earlier releases, which
3853 	 * only created symbolic links synchronously if the semi-documented
3854 	 * 'syncdir' option was set, or if we were being invoked by the NFS
3855 	 * server, which requires symbolic links to be created synchronously.)
3856 	 *
3857 	 * We need to pass in a pointer for the residual length; otherwise
3858 	 * ufs_rdwri() will always return EIO if it can't write the data,
3859 	 * even if the error was really ENOSPC or EDQUOT.
3860 	 */
3861 
3862 	ioflag = FWRITE | FDSYNC;
3863 	residual = 0;
3864 
3865 	rw_enter(&ufsvfsp->vfs_dqrwlock, RW_READER);
3866 	rw_enter(&ip->i_contents, RW_WRITER);
3867 
3868 	/*
3869 	 * Suppress file system full messages if we will retry
3870 	 */
3871 	if (retry)
3872 		ip->i_flag |= IQUIET;
3873 
3874 	error = ufs_rdwri(UIO_WRITE, ioflag, ip, target, strlen(target),
3875 	    (offset_t)0, UIO_SYSSPACE, &residual, cr);
3876 
3877 	ip->i_flag &= ~IQUIET;
3878 
3879 	if (error) {
3880 		rw_exit(&ip->i_contents);
3881 		rw_exit(&ufsvfsp->vfs_dqrwlock);
3882 		goto remove;
3883 	}
3884 
3885 	/*
3886 	 * If the link's data is small enough, we can cache it in the inode.
3887 	 * This is a "fast symbolic link".  We don't use the first direct
3888 	 * block because that's actually used to point at the symbolic link's
3889 	 * contents on disk; but we know that none of the other direct or
3890 	 * indirect blocks can be used because symbolic links are restricted
3891 	 * to be smaller than a file system block.
3892 	 */
3893 
3894 	ASSERT(MAXPATHLEN <= VBSIZE(ITOV(ip)));
3895 
3896 	if (ip->i_size > 0 && ip->i_size <= FSL_SIZE) {
3897 		if (kcopy(target, &ip->i_db[1], ip->i_size) == 0) {
3898 			ip->i_flag |= IFASTSYMLNK;
3899 		} else {
3900 			int i;
3901 			/* error, clear garbage left behind */
3902 			for (i = 1; i < NDADDR; i++)
3903 				ip->i_db[i] = 0;
3904 			for (i = 0; i < NIADDR; i++)
3905 				ip->i_ib[i] = 0;
3906 		}
3907 	}
3908 
3909 	rw_exit(&ip->i_contents);
3910 	rw_exit(&ufsvfsp->vfs_dqrwlock);
3911 
3912 	/*
3913 	 * OK.  We've successfully created the symbolic link.  All that
3914 	 * remains is to insert it into the appropriate directory.
3915 	 */
3916 
3917 	rw_enter(&dip->i_rwlock, RW_WRITER);
3918 	error = ufs_direnter_lr(dip, linkname, DE_SYMLINK, NULL, ip, cr, NULL);
3919 	rw_exit(&dip->i_rwlock);
3920 
3921 	/*
3922 	 * Fall through into remove-on-error code.  We're either done, or we
3923 	 * need to remove the inode (if we couldn't insert it).
3924 	 */
3925 
3926 remove:
3927 	if (error && (ip != NULL)) {
3928 		rw_enter(&ip->i_contents, RW_WRITER);
3929 		ip->i_nlink--;
3930 		ip->i_flag |= ICHG;
3931 		ip->i_seq++;
3932 		ufs_setreclaim(ip);
3933 		rw_exit(&ip->i_contents);
3934 	}
3935 
3936 unlock:
3937 	if (ip != NULL)
3938 		VN_RELE(ITOV(ip));
3939 
3940 	if (ulp) {
3941 		int terr = 0;
3942 
3943 		TRANS_END_CSYNC(ufsvfsp, terr, issync, TOP_SYMLINK,
3944 				trans_size);
3945 		ufs_lockfs_end(ulp);
3946 		if (error == 0)
3947 			error = terr;
3948 	}
3949 
3950 	/*
3951 	 * We may have failed due to lack of an inode or of a block to
3952 	 * store the target in.  Try flushing the delete queue to free
3953 	 * logically-available things up and try again.
3954 	 */
3955 	if ((error == ENOSPC) && retry && TRANS_ISTRANS(ufsvfsp)) {
3956 		ufs_delete_drain_wait(ufsvfsp, 1);
3957 		retry = 0;
3958 		goto again;
3959 	}
3960 
3961 out:
3962 	TRACE_2(TR_FAC_UFS, TR_UFS_SYMLINK_END,
3963 		"ufs_symlink_end:dvp %p error %d", dvp, error);
3964 	return (error);
3965 }
3966 
3967 /*
3968  * Ufs specific routine used to do ufs io.
3969  */
3970 int
3971 ufs_rdwri(enum uio_rw rw, int ioflag, struct inode *ip, caddr_t base,
3972 	ssize_t len, offset_t offset, enum uio_seg seg, int *aresid,
3973 	struct cred *cr)
3974 {
3975 	struct uio auio;
3976 	struct iovec aiov;
3977 	int error;
3978 
3979 	ASSERT(RW_LOCK_HELD(&ip->i_contents));
3980 
3981 	bzero((caddr_t)&auio, sizeof (uio_t));
3982 	bzero((caddr_t)&aiov, sizeof (iovec_t));
3983 
3984 	aiov.iov_base = base;
3985 	aiov.iov_len = len;
3986 	auio.uio_iov = &aiov;
3987 	auio.uio_iovcnt = 1;
3988 	auio.uio_loffset = offset;
3989 	auio.uio_segflg = (short)seg;
3990 	auio.uio_resid = len;
3991 
3992 	if (rw == UIO_WRITE) {
3993 		auio.uio_fmode = FWRITE;
3994 		auio.uio_extflg = UIO_COPY_DEFAULT;
3995 		auio.uio_llimit = curproc->p_fsz_ctl;
3996 		error = wrip(ip, &auio, ioflag, cr);
3997 	} else {
3998 		auio.uio_fmode = FREAD;
3999 		auio.uio_extflg = UIO_COPY_CACHED;
4000 		auio.uio_llimit = MAXOFFSET_T;
4001 		error = rdip(ip, &auio, ioflag, cr);
4002 	}
4003 
4004 	if (aresid) {
4005 		*aresid = auio.uio_resid;
4006 	} else if (auio.uio_resid) {
4007 		error = EIO;
4008 	}
4009 	return (error);
4010 }
4011 
4012 static int
4013 ufs_fid(vp, fidp)
4014 	struct vnode *vp;
4015 	struct fid *fidp;
4016 {
4017 	struct ufid *ufid;
4018 	struct inode *ip = VTOI(vp);
4019 
4020 	if (ip->i_ufsvfs == NULL)
4021 		return (EIO);
4022 
4023 	if (fidp->fid_len < (sizeof (struct ufid) - sizeof (ushort_t))) {
4024 		fidp->fid_len = sizeof (struct ufid) - sizeof (ushort_t);
4025 		return (ENOSPC);
4026 	}
4027 
4028 	ufid = (struct ufid *)fidp;
4029 	bzero((char *)ufid, sizeof (struct ufid));
4030 	ufid->ufid_len = sizeof (struct ufid) - sizeof (ushort_t);
4031 	ufid->ufid_ino = ip->i_number;
4032 	ufid->ufid_gen = ip->i_gen;
4033 
4034 	return (0);
4035 }
4036 
4037 /* ARGSUSED2 */
4038 static int
4039 ufs_rwlock(struct vnode *vp, int write_lock, caller_context_t *ctp)
4040 {
4041 	struct inode	*ip = VTOI(vp);
4042 	struct ufsvfs	*ufsvfsp;
4043 	int		forcedirectio;
4044 
4045 	/*
4046 	 * Read case is easy.
4047 	 */
4048 	if (!write_lock) {
4049 		rw_enter(&ip->i_rwlock, RW_READER);
4050 		return (V_WRITELOCK_FALSE);
4051 	}
4052 
4053 	/*
4054 	 * Caller has requested a writer lock, but that inhibits any
4055 	 * concurrency in the VOPs that follow. Acquire the lock shared
4056 	 * and defer exclusive access until it is known to be needed in
4057 	 * other VOP handlers. Some cases can be determined here.
4058 	 */
4059 
4060 	/*
4061 	 * If directio is not set, there is no chance of concurrency,
4062 	 * so just acquire the lock exclusive. Beware of a forced
4063 	 * unmount before looking at the mount option.
4064 	 */
4065 	ufsvfsp = ip->i_ufsvfs;
4066 	forcedirectio = ufsvfsp ? ufsvfsp->vfs_forcedirectio : 0;
4067 	if (!(ip->i_flag & IDIRECTIO || forcedirectio) ||
4068 	    !ufs_allow_shared_writes) {
4069 		rw_enter(&ip->i_rwlock, RW_WRITER);
4070 		return (V_WRITELOCK_TRUE);
4071 	}
4072 
4073 	/*
4074 	 * Mandatory locking forces acquiring i_rwlock exclusive.
4075 	 */
4076 	if (MANDLOCK(vp, ip->i_mode)) {
4077 		rw_enter(&ip->i_rwlock, RW_WRITER);
4078 		return (V_WRITELOCK_TRUE);
4079 	}
4080 
4081 	/*
4082 	 * Acquire the lock shared in case a concurrent write follows.
4083 	 * Mandatory locking could have become enabled before the lock
4084 	 * was acquired. Re-check and upgrade if needed.
4085 	 */
4086 	rw_enter(&ip->i_rwlock, RW_READER);
4087 	if (MANDLOCK(vp, ip->i_mode)) {
4088 		rw_exit(&ip->i_rwlock);
4089 		rw_enter(&ip->i_rwlock, RW_WRITER);
4090 		return (V_WRITELOCK_TRUE);
4091 	}
4092 	return (V_WRITELOCK_FALSE);
4093 }
4094 
4095 /*ARGSUSED*/
4096 static void
4097 ufs_rwunlock(struct vnode *vp, int write_lock, caller_context_t *ctp)
4098 {
4099 	struct inode	*ip = VTOI(vp);
4100 
4101 	rw_exit(&ip->i_rwlock);
4102 }
4103 
4104 /* ARGSUSED */
4105 static int
4106 ufs_seek(struct vnode *vp, offset_t ooff, offset_t *noffp)
4107 {
4108 	return ((*noffp < 0 || *noffp > MAXOFFSET_T) ? EINVAL : 0);
4109 }
4110 
4111 /* ARGSUSED */
4112 static int
4113 ufs_frlock(struct vnode *vp, int cmd, struct flock64 *bfp, int flag,
4114 	offset_t offset, struct flk_callback *flk_cbp, struct cred *cr)
4115 {
4116 	struct inode *ip = VTOI(vp);
4117 
4118 	if (ip->i_ufsvfs == NULL)
4119 		return (EIO);
4120 
4121 	/*
4122 	 * If file is being mapped, disallow frlock.
4123 	 * XXX I am not holding tlock while checking i_mapcnt because the
4124 	 * current locking strategy drops all locks before calling fs_frlock.
4125 	 * So, mapcnt could change before we enter fs_frlock making is
4126 	 * meaningless to have held tlock in the first place.
4127 	 */
4128 	if (ip->i_mapcnt > 0 && MANDLOCK(vp, ip->i_mode))
4129 		return (EAGAIN);
4130 	return (fs_frlock(vp, cmd, bfp, flag, offset, flk_cbp, cr));
4131 }
4132 
4133 /* ARGSUSED */
4134 static int
4135 ufs_space(
4136 	struct vnode *vp,
4137 	int cmd,
4138 	struct flock64 *bfp,
4139 	int flag,
4140 	offset_t offset,
4141 	cred_t *cr,
4142 	caller_context_t *ct)
4143 {
4144 	struct ufsvfs *ufsvfsp	= VTOI(vp)->i_ufsvfs;
4145 	struct ulockfs *ulp;
4146 	int error;
4147 
4148 	error = ufs_lockfs_begin(ufsvfsp, &ulp, ULOCKFS_SPACE_MASK);
4149 	if (error)
4150 		return (error);
4151 
4152 
4153 	if (cmd != F_FREESP)
4154 		error =  EINVAL;
4155 	else if ((error = convoff(vp, bfp, 0, offset)) == 0)
4156 		error = ufs_freesp(vp, bfp, flag, cr);
4157 
4158 	if (ulp)
4159 		ufs_lockfs_end(ulp);
4160 	return (error);
4161 }
4162 
4163 /*
4164  * Used to determine if read ahead should be done. Also used to
4165  * to determine when write back occurs.
4166  */
4167 #define	CLUSTSZ(ip)		((ip)->i_ufsvfs->vfs_ioclustsz)
4168 
4169 /*
4170  * A faster version of ufs_getpage.
4171  *
4172  * We optimize by inlining the pvn_getpages iterator, eliminating
4173  * calls to bmap_read if file doesn't have UFS holes, and avoiding
4174  * the overhead of page_exists().
4175  *
4176  * When files has UFS_HOLES and ufs_getpage is called with S_READ,
4177  * we set *protp to PROT_READ to avoid calling bmap_read. This approach
4178  * victimizes performance when a file with UFS holes is faulted
4179  * first in the S_READ mode, and then in the S_WRITE mode. We will get
4180  * two MMU faults in this case.
4181  *
4182  * XXX - the inode fields which control the sequential mode are not
4183  *	 protected by any mutex. The read ahead will act wild if
4184  *	 multiple processes will access the file concurrently and
4185  *	 some of them in sequential mode. One particulary bad case
4186  *	 is if another thread will change the value of i_nextrio between
4187  *	 the time this thread tests the i_nextrio value and then reads it
4188  *	 again to use it as the offset for the read ahead.
4189  */
4190 static int
4191 ufs_getpage(struct vnode *vp, offset_t off, size_t len, uint_t *protp,
4192 	page_t *plarr[], size_t plsz, struct seg *seg, caddr_t addr,
4193 	enum seg_rw rw, struct cred *cr)
4194 {
4195 	u_offset_t	uoff = (u_offset_t)off; /* type conversion */
4196 	u_offset_t	pgoff;
4197 	u_offset_t	eoff;
4198 	struct inode 	*ip = VTOI(vp);
4199 	struct ufsvfs	*ufsvfsp = ip->i_ufsvfs;
4200 	struct fs 	*fs;
4201 	struct ulockfs	*ulp;
4202 	page_t		**pl;
4203 	caddr_t		pgaddr;
4204 	krw_t		rwtype;
4205 	int 		err;
4206 	int		has_holes;
4207 	int		beyond_eof;
4208 	int		seqmode;
4209 	int		pgsize = PAGESIZE;
4210 	int		dolock;
4211 	int		do_qlock;
4212 	int		trans_size;
4213 
4214 	TRACE_1(TR_FAC_UFS, TR_UFS_GETPAGE_START,
4215 		"ufs_getpage_start:vp %p", vp);
4216 
4217 	ASSERT((uoff & PAGEOFFSET) == 0);
4218 
4219 	if (protp)
4220 		*protp = PROT_ALL;
4221 
4222 	/*
4223 	 * Obey the lockfs protocol
4224 	 */
4225 	err = ufs_lockfs_begin_getpage(ufsvfsp, &ulp, seg,
4226 			rw == S_READ || rw == S_EXEC, protp);
4227 	if (err)
4228 		goto out;
4229 
4230 	fs = ufsvfsp->vfs_fs;
4231 
4232 	if (ulp && (rw == S_CREATE || rw == S_WRITE) &&
4233 	    !(vp->v_flag & VISSWAP)) {
4234 		/*
4235 		 * Try to start a transaction, will return if blocking is
4236 		 * expected to occur and the address space is not the
4237 		 * kernel address space.
4238 		 */
4239 		trans_size = TOP_GETPAGE_SIZE(ip);
4240 		if (seg->s_as != &kas) {
4241 			TRANS_TRY_BEGIN_ASYNC(ufsvfsp, TOP_GETPAGE,
4242 				trans_size, err)
4243 			if (err == EWOULDBLOCK) {
4244 				/*
4245 				 * Use EDEADLK here because the VM code
4246 				 * can normally never see this error.
4247 				 */
4248 				err = EDEADLK;
4249 				ufs_lockfs_end(ulp);
4250 				goto out;
4251 			}
4252 		} else {
4253 			TRANS_BEGIN_ASYNC(ufsvfsp, TOP_GETPAGE, trans_size);
4254 		}
4255 	}
4256 
4257 	if (vp->v_flag & VNOMAP) {
4258 		err = ENOSYS;
4259 		goto unlock;
4260 	}
4261 
4262 	seqmode = ip->i_nextr == uoff && rw != S_CREATE;
4263 
4264 	rwtype = RW_READER;		/* start as a reader */
4265 	dolock = (rw_owner(&ip->i_contents) != curthread);
4266 	/*
4267 	 * If this thread owns the lock, i.e., this thread grabbed it
4268 	 * as writer somewhere above, then we don't need to grab the
4269 	 * lock as reader in this routine.
4270 	 */
4271 	do_qlock = (rw_owner(&ufsvfsp->vfs_dqrwlock) != curthread);
4272 
4273 retrylock:
4274 	if (dolock) {
4275 		/*
4276 		 * Grab the quota lock if we need to call
4277 		 * bmap_write() below (with i_contents as writer).
4278 		 */
4279 		if (do_qlock && rwtype == RW_WRITER)
4280 			rw_enter(&ufsvfsp->vfs_dqrwlock, RW_READER);
4281 		rw_enter(&ip->i_contents, rwtype);
4282 	}
4283 
4284 	/*
4285 	 * We may be getting called as a side effect of a bmap using
4286 	 * fbread() when the blocks might be being allocated and the
4287 	 * size has not yet been up'ed.  In this case we want to be
4288 	 * able to return zero pages if we get back UFS_HOLE from
4289 	 * calling bmap for a non write case here.  We also might have
4290 	 * to read some frags from the disk into a page if we are
4291 	 * extending the number of frags for a given lbn in bmap().
4292 	 * Large Files: The read of i_size here is atomic because
4293 	 * i_contents is held here. If dolock is zero, the lock
4294 	 * is held in bmap routines.
4295 	 */
4296 	beyond_eof = uoff + len > ip->i_size + PAGEOFFSET;
4297 	if (beyond_eof && seg != segkmap) {
4298 		if (dolock) {
4299 			rw_exit(&ip->i_contents);
4300 			if (do_qlock && rwtype == RW_WRITER)
4301 				rw_exit(&ufsvfsp->vfs_dqrwlock);
4302 		}
4303 		err = EFAULT;
4304 		goto unlock;
4305 	}
4306 
4307 	/*
4308 	 * Must hold i_contents lock throughout the call to pvn_getpages
4309 	 * since locked pages are returned from each call to ufs_getapage.
4310 	 * Must *not* return locked pages and then try for contents lock
4311 	 * due to lock ordering requirements (inode > page)
4312 	 */
4313 
4314 	has_holes = bmap_has_holes(ip);
4315 
4316 	if ((rw == S_WRITE || rw == S_CREATE) && has_holes && !beyond_eof) {
4317 		int	blk_size;
4318 		u_offset_t offset;
4319 
4320 		/*
4321 		 * We must acquire the RW_WRITER lock in order to
4322 		 * call bmap_write().
4323 		 */
4324 		if (dolock && rwtype == RW_READER) {
4325 			rwtype = RW_WRITER;
4326 
4327 			/*
4328 			 * Grab the quota lock before
4329 			 * upgrading i_contents, but if we can't grab it
4330 			 * don't wait here due to lock order:
4331 			 * vfs_dqrwlock > i_contents.
4332 			 */
4333 			if (do_qlock && rw_tryenter(&ufsvfsp->vfs_dqrwlock,
4334 							RW_READER) == 0) {
4335 				rw_exit(&ip->i_contents);
4336 				goto retrylock;
4337 			}
4338 			if (!rw_tryupgrade(&ip->i_contents)) {
4339 				rw_exit(&ip->i_contents);
4340 				if (do_qlock)
4341 					rw_exit(&ufsvfsp->vfs_dqrwlock);
4342 				goto retrylock;
4343 			}
4344 		}
4345 
4346 		/*
4347 		 * May be allocating disk blocks for holes here as
4348 		 * a result of mmap faults. write(2) does the bmap_write
4349 		 * in rdip/wrip, not here. We are not dealing with frags
4350 		 * in this case.
4351 		 */
4352 		/*
4353 		 * Large Files: We cast fs_bmask field to offset_t
4354 		 * just as we do for MAXBMASK because uoff is a 64-bit
4355 		 * data type. fs_bmask will still be a 32-bit type
4356 		 * as we cannot change any ondisk data structures.
4357 		 */
4358 
4359 		offset = uoff & (offset_t)fs->fs_bmask;
4360 		while (offset < uoff + len) {
4361 			blk_size = (int)blksize(fs, ip, lblkno(fs, offset));
4362 			err = bmap_write(ip, offset, blk_size, 0, cr);
4363 			if (ip->i_flag & (ICHG|IUPD))
4364 				ip->i_seq++;
4365 			if (err)
4366 				goto update_inode;
4367 			offset += blk_size; /* XXX - make this contig */
4368 		}
4369 	}
4370 
4371 	/*
4372 	 * Can be a reader from now on.
4373 	 */
4374 	if (dolock && rwtype == RW_WRITER) {
4375 		rw_downgrade(&ip->i_contents);
4376 		/*
4377 		 * We can release vfs_dqrwlock early so do it, but make
4378 		 * sure we don't try to release it again at the bottom.
4379 		 */
4380 		if (do_qlock) {
4381 			rw_exit(&ufsvfsp->vfs_dqrwlock);
4382 			do_qlock = 0;
4383 		}
4384 	}
4385 
4386 	/*
4387 	 * We remove PROT_WRITE in cases when the file has UFS holes
4388 	 * because we don't  want to call bmap_read() to check each
4389 	 * page if it is backed with a disk block.
4390 	 */
4391 	if (protp && has_holes && rw != S_WRITE && rw != S_CREATE)
4392 		*protp &= ~PROT_WRITE;
4393 
4394 	err = 0;
4395 
4396 	/*
4397 	 * The loop looks up pages in the range [off, off + len).
4398 	 * For each page, we first check if we should initiate an asynchronous
4399 	 * read ahead before we call page_lookup (we may sleep in page_lookup
4400 	 * for a previously initiated disk read).
4401 	 */
4402 	eoff = (uoff + len);
4403 	for (pgoff = uoff, pgaddr = addr, pl = plarr;
4404 	    pgoff < eoff; /* empty */) {
4405 		page_t	*pp;
4406 		u_offset_t	nextrio;
4407 		se_t	se;
4408 		int retval;
4409 
4410 		se = ((rw == S_CREATE || rw == S_OTHER) ? SE_EXCL : SE_SHARED);
4411 
4412 		/* Handle async getpage (faultahead) */
4413 		if (plarr == NULL) {
4414 			ip->i_nextrio = pgoff;
4415 			(void) ufs_getpage_ra(vp, pgoff, seg, pgaddr);
4416 			pgoff += pgsize;
4417 			pgaddr += pgsize;
4418 			continue;
4419 		}
4420 		/*
4421 		 * Check if we should initiate read ahead of next cluster.
4422 		 * We call page_exists only when we need to confirm that
4423 		 * we have the current page before we initiate the read ahead.
4424 		 */
4425 		nextrio = ip->i_nextrio;
4426 		if (seqmode &&
4427 		    pgoff + CLUSTSZ(ip) >= nextrio && pgoff <= nextrio &&
4428 		    nextrio < ip->i_size && page_exists(vp, pgoff)) {
4429 			retval = ufs_getpage_ra(vp, pgoff, seg, pgaddr);
4430 			/*
4431 			 * We always read ahead the next cluster of data
4432 			 * starting from i_nextrio. If the page (vp,nextrio)
4433 			 * is actually in core at this point, the routine
4434 			 * ufs_getpage_ra() will stop pre-fetching data
4435 			 * until we read that page in a synchronized manner
4436 			 * through ufs_getpage_miss(). So, we should increase
4437 			 * i_nextrio if the page (vp, nextrio) exists.
4438 			 */
4439 			if ((retval == 0) && page_exists(vp, nextrio)) {
4440 				ip->i_nextrio = nextrio + pgsize;
4441 			}
4442 		}
4443 
4444 		if ((pp = page_lookup(vp, pgoff, se)) != NULL) {
4445 			/*
4446 			 * We found the page in the page cache.
4447 			 */
4448 			*pl++ = pp;
4449 			pgoff += pgsize;
4450 			pgaddr += pgsize;
4451 			len -= pgsize;
4452 			plsz -= pgsize;
4453 		} else  {
4454 			/*
4455 			 * We have to create the page, or read it from disk.
4456 			 */
4457 			if (err = ufs_getpage_miss(vp, pgoff, len, seg, pgaddr,
4458 			    pl, plsz, rw, seqmode))
4459 				goto error;
4460 
4461 			while (*pl != NULL) {
4462 				pl++;
4463 				pgoff += pgsize;
4464 				pgaddr += pgsize;
4465 				len -= pgsize;
4466 				plsz -= pgsize;
4467 			}
4468 		}
4469 	}
4470 
4471 	/*
4472 	 * Return pages up to plsz if they are in the page cache.
4473 	 * We cannot return pages if there is a chance that they are
4474 	 * backed with a UFS hole and rw is S_WRITE or S_CREATE.
4475 	 */
4476 	if (plarr && !(has_holes && (rw == S_WRITE || rw == S_CREATE))) {
4477 
4478 		ASSERT((protp == NULL) ||
4479 			!(has_holes && (*protp & PROT_WRITE)));
4480 
4481 		eoff = pgoff + plsz;
4482 		while (pgoff < eoff) {
4483 			page_t		*pp;
4484 
4485 			if ((pp = page_lookup_nowait(vp, pgoff,
4486 			    SE_SHARED)) == NULL)
4487 				break;
4488 
4489 			*pl++ = pp;
4490 			pgoff += pgsize;
4491 			plsz -= pgsize;
4492 		}
4493 	}
4494 
4495 	if (plarr)
4496 		*pl = NULL;			/* Terminate page list */
4497 	ip->i_nextr = pgoff;
4498 
4499 error:
4500 	if (err && plarr) {
4501 		/*
4502 		 * Release any pages we have locked.
4503 		 */
4504 		while (pl > &plarr[0])
4505 			page_unlock(*--pl);
4506 
4507 		plarr[0] = NULL;
4508 	}
4509 
4510 update_inode:
4511 	/*
4512 	 * If the inode is not already marked for IACC (in rdip() for read)
4513 	 * and the inode is not marked for no access time update (in wrip()
4514 	 * for write) then update the inode access time and mod time now.
4515 	 */
4516 	if ((ip->i_flag & (IACC | INOACC)) == 0) {
4517 		if ((rw != S_OTHER) && (ip->i_mode & IFMT) != IFDIR) {
4518 			if (!ULOCKFS_IS_NOIACC(ITOUL(ip)) &&
4519 			    (fs->fs_ronly == 0) &&
4520 			    (!ufsvfsp->vfs_noatime)) {
4521 				mutex_enter(&ip->i_tlock);
4522 				ip->i_flag |= IACC;
4523 				ITIMES_NOLOCK(ip);
4524 				mutex_exit(&ip->i_tlock);
4525 			}
4526 		}
4527 	}
4528 
4529 	if (dolock) {
4530 		rw_exit(&ip->i_contents);
4531 		if (do_qlock && rwtype == RW_WRITER)
4532 			rw_exit(&ufsvfsp->vfs_dqrwlock);
4533 	}
4534 
4535 unlock:
4536 	if (ulp) {
4537 		if ((rw == S_CREATE || rw == S_WRITE) &&
4538 		    !(vp->v_flag & VISSWAP)) {
4539 			TRANS_END_ASYNC(ufsvfsp, TOP_GETPAGE, trans_size);
4540 		}
4541 		ufs_lockfs_end(ulp);
4542 	}
4543 out:
4544 	TRACE_2(TR_FAC_UFS, TR_UFS_GETPAGE_END,
4545 		"ufs_getpage_end:vp %p error %d", vp, err);
4546 	return (err);
4547 }
4548 
4549 /*
4550  * ufs_getpage_miss is called when ufs_getpage missed the page in the page
4551  * cache. The page is either read from the disk, or it's created.
4552  * A page is created (without disk read) if rw == S_CREATE, or if
4553  * the page is not backed with a real disk block (UFS hole).
4554  */
4555 /* ARGSUSED */
4556 static int
4557 ufs_getpage_miss(struct vnode *vp, u_offset_t off, size_t len, struct seg *seg,
4558 	caddr_t addr, page_t *pl[], size_t plsz, enum seg_rw rw, int seq)
4559 {
4560 	struct inode	*ip = VTOI(vp);
4561 	page_t		*pp;
4562 	daddr_t		bn;
4563 	size_t		io_len;
4564 	int		crpage;
4565 	int		err;
4566 	int		contig;
4567 	int		bsize = ip->i_fs->fs_bsize;
4568 
4569 	/*
4570 	 * Figure out whether the page can be created, or must be
4571 	 * must be read from the disk.
4572 	 */
4573 	if (rw == S_CREATE)
4574 		crpage = 1;
4575 	else {
4576 		contig = 0;
4577 		if (err = bmap_read(ip, off, &bn, &contig))
4578 			return (err);
4579 		crpage = (bn == UFS_HOLE);
4580 	}
4581 
4582 	if (crpage) {
4583 		if ((pp = page_create_va(vp, off, PAGESIZE, PG_WAIT, seg,
4584 		    addr)) == NULL) {
4585 			return (ufs_fault(vp,
4586 				    "ufs_getpage_miss: page_create == NULL"));
4587 		}
4588 
4589 		if (rw != S_CREATE)
4590 			pagezero(pp, 0, PAGESIZE);
4591 		io_len = PAGESIZE;
4592 	} else {
4593 		u_offset_t	io_off;
4594 		uint_t	xlen;
4595 		struct buf	*bp;
4596 		ufsvfs_t	*ufsvfsp = ip->i_ufsvfs;
4597 
4598 		/*
4599 		 * If access is not in sequential order, we read from disk
4600 		 * in bsize units.
4601 		 *
4602 		 * We limit the size of the transfer to bsize if we are reading
4603 		 * from the beginning of the file. Note in this situation we
4604 		 * will hedge our bets and initiate an async read ahead of
4605 		 * the second block.
4606 		 */
4607 		if (!seq || off == 0)
4608 			contig = MIN(contig, bsize);
4609 
4610 		pp = pvn_read_kluster(vp, off, seg, addr, &io_off,
4611 		    &io_len, off, contig, 0);
4612 
4613 		/*
4614 		 * Some other thread has entered the page.
4615 		 * ufs_getpage will retry page_lookup.
4616 		 */
4617 		if (pp == NULL) {
4618 			pl[0] = NULL;
4619 			return (0);
4620 		}
4621 
4622 		/*
4623 		 * Zero part of the page which we are not
4624 		 * going to read from the disk.
4625 		 */
4626 		xlen = io_len & PAGEOFFSET;
4627 		if (xlen != 0)
4628 			pagezero(pp->p_prev, xlen, PAGESIZE - xlen);
4629 
4630 		bp = pageio_setup(pp, io_len, ip->i_devvp, B_READ);
4631 		bp->b_edev = ip->i_dev;
4632 		bp->b_dev = cmpdev(ip->i_dev);
4633 		bp->b_blkno = bn;
4634 		bp->b_un.b_addr = (caddr_t)0;
4635 		bp->b_file = ip->i_vnode;
4636 		bp->b_offset = off;
4637 
4638 		if (ufsvfsp->vfs_log) {
4639 			lufs_read_strategy(ufsvfsp->vfs_log, bp);
4640 		} else if (ufsvfsp->vfs_snapshot) {
4641 			fssnap_strategy(&ufsvfsp->vfs_snapshot, bp);
4642 		} else {
4643 			ufsvfsp->vfs_iotstamp = lbolt;
4644 			ub.ub_getpages.value.ul++;
4645 			(void) bdev_strategy(bp);
4646 			lwp_stat_update(LWP_STAT_INBLK, 1);
4647 		}
4648 
4649 		ip->i_nextrio = off + ((io_len + PAGESIZE - 1) & PAGEMASK);
4650 
4651 		/*
4652 		 * If the file access is sequential, initiate read ahead
4653 		 * of the next cluster.
4654 		 */
4655 		if (seq && ip->i_nextrio < ip->i_size)
4656 			(void) ufs_getpage_ra(vp, off, seg, addr);
4657 		err = biowait(bp);
4658 		pageio_done(bp);
4659 
4660 		if (err) {
4661 			pvn_read_done(pp, B_ERROR);
4662 			return (err);
4663 		}
4664 	}
4665 
4666 	pvn_plist_init(pp, pl, plsz, off, io_len, rw);
4667 	return (0);
4668 }
4669 
4670 /*
4671  * Read ahead a cluster from the disk. Returns the length in bytes.
4672  */
4673 static int
4674 ufs_getpage_ra(struct vnode *vp, u_offset_t off, struct seg *seg, caddr_t addr)
4675 {
4676 	struct inode	*ip = VTOI(vp);
4677 	page_t		*pp;
4678 	u_offset_t	io_off = ip->i_nextrio;
4679 	ufsvfs_t	*ufsvfsp;
4680 	caddr_t		addr2 = addr + (io_off - off);
4681 	struct buf	*bp;
4682 	daddr_t		bn;
4683 	size_t		io_len;
4684 	int		contig;
4685 	int		xlen;
4686 	int		bsize = ip->i_fs->fs_bsize;
4687 
4688 	/*
4689 	 * If the directio advisory is in effect on this file,
4690 	 * then do not do buffered read ahead. Read ahead makes
4691 	 * it more difficult on threads using directio as they
4692 	 * will be forced to flush the pages from this vnode.
4693 	 */
4694 	if ((ufsvfsp = ip->i_ufsvfs) == NULL)
4695 		return (0);
4696 	if (ip->i_flag & IDIRECTIO || ufsvfsp->vfs_forcedirectio)
4697 		return (0);
4698 
4699 	/*
4700 	 * Is this test needed?
4701 	 */
4702 	if (addr2 >= seg->s_base + seg->s_size)
4703 		return (0);
4704 
4705 	contig = 0;
4706 	if (bmap_read(ip, io_off, &bn, &contig) != 0 || bn == UFS_HOLE)
4707 		return (0);
4708 
4709 	/*
4710 	 * Limit the transfer size to bsize if this is the 2nd block.
4711 	 */
4712 	if (io_off == (u_offset_t)bsize)
4713 		contig = MIN(contig, bsize);
4714 
4715 	if ((pp = pvn_read_kluster(vp, io_off, seg, addr2, &io_off,
4716 	    &io_len, io_off, contig, 1)) == NULL)
4717 		return (0);
4718 
4719 	/*
4720 	 * Zero part of page which we are not going to read from disk
4721 	 */
4722 	if ((xlen = (io_len & PAGEOFFSET)) > 0)
4723 		pagezero(pp->p_prev, xlen, PAGESIZE - xlen);
4724 
4725 	ip->i_nextrio = (io_off + io_len + PAGESIZE - 1) & PAGEMASK;
4726 
4727 	bp = pageio_setup(pp, io_len, ip->i_devvp, B_READ | B_ASYNC);
4728 	bp->b_edev = ip->i_dev;
4729 	bp->b_dev = cmpdev(ip->i_dev);
4730 	bp->b_blkno = bn;
4731 	bp->b_un.b_addr = (caddr_t)0;
4732 	bp->b_file = ip->i_vnode;
4733 	bp->b_offset = off;
4734 
4735 	if (ufsvfsp->vfs_log) {
4736 		lufs_read_strategy(ufsvfsp->vfs_log, bp);
4737 	} else if (ufsvfsp->vfs_snapshot) {
4738 		fssnap_strategy(&ufsvfsp->vfs_snapshot, bp);
4739 	} else {
4740 		ufsvfsp->vfs_iotstamp = lbolt;
4741 		ub.ub_getras.value.ul++;
4742 		(void) bdev_strategy(bp);
4743 		lwp_stat_update(LWP_STAT_INBLK, 1);
4744 	}
4745 
4746 	return (io_len);
4747 }
4748 
4749 int	ufs_delay = 1;
4750 /*
4751  * Flags are composed of {B_INVAL, B_FREE, B_DONTNEED, B_FORCE, B_ASYNC}
4752  *
4753  * LMXXX - the inode really ought to contain a pointer to one of these
4754  * async args.  Stuff gunk in there and just hand the whole mess off.
4755  * This would replace i_delaylen, i_delayoff.
4756  */
4757 /*ARGSUSED*/
4758 static int
4759 ufs_putpage(struct vnode *vp, offset_t off, size_t len, int flags,
4760 	struct cred *cr)
4761 {
4762 	struct inode *ip = VTOI(vp);
4763 	int err = 0;
4764 
4765 	if (vp->v_count == 0) {
4766 		return (ufs_fault(vp, "ufs_putpage: bad v_count == 0"));
4767 	}
4768 
4769 	TRACE_1(TR_FAC_UFS, TR_UFS_PUTPAGE_START,
4770 		"ufs_putpage_start:vp %p", vp);
4771 
4772 	/*
4773 	 * XXX - Why should this check be made here?
4774 	 */
4775 	if (vp->v_flag & VNOMAP) {
4776 		err = ENOSYS;
4777 		goto errout;
4778 	}
4779 
4780 	if (ip->i_ufsvfs == NULL) {
4781 		err = EIO;
4782 		goto errout;
4783 	}
4784 
4785 	if (flags & B_ASYNC) {
4786 		if (ufs_delay && len &&
4787 		    (flags & ~(B_ASYNC|B_DONTNEED|B_FREE)) == 0) {
4788 			mutex_enter(&ip->i_tlock);
4789 			/*
4790 			 * If nobody stalled, start a new cluster.
4791 			 */
4792 			if (ip->i_delaylen == 0) {
4793 				ip->i_delayoff = off;
4794 				ip->i_delaylen = len;
4795 				mutex_exit(&ip->i_tlock);
4796 				goto errout;
4797 			}
4798 			/*
4799 			 * If we have a full cluster or they are not contig,
4800 			 * then push last cluster and start over.
4801 			 */
4802 			if (ip->i_delaylen >= CLUSTSZ(ip) ||
4803 			    ip->i_delayoff + ip->i_delaylen != off) {
4804 				u_offset_t doff;
4805 				size_t dlen;
4806 
4807 				doff = ip->i_delayoff;
4808 				dlen = ip->i_delaylen;
4809 				ip->i_delayoff = off;
4810 				ip->i_delaylen = len;
4811 				mutex_exit(&ip->i_tlock);
4812 				err = ufs_putpages(vp, doff, dlen,
4813 				    flags, cr);
4814 				/* LMXXX - flags are new val, not old */
4815 				goto errout;
4816 			}
4817 			/*
4818 			 * There is something there, it's not full, and
4819 			 * it is contig.
4820 			 */
4821 			ip->i_delaylen += len;
4822 			mutex_exit(&ip->i_tlock);
4823 			goto errout;
4824 		}
4825 		/*
4826 		 * Must have weird flags or we are not clustering.
4827 		 */
4828 	}
4829 
4830 	err = ufs_putpages(vp, off, len, flags, cr);
4831 
4832 errout:
4833 	TRACE_2(TR_FAC_UFS, TR_UFS_PUTPAGE_END,
4834 		"ufs_putpage_end:vp %p error %d", vp, err);
4835 	return (err);
4836 }
4837 
4838 /*
4839  * If len == 0, do from off to EOF.
4840  *
4841  * The normal cases should be len == 0 & off == 0 (entire vp list),
4842  * len == MAXBSIZE (from segmap_release actions), and len == PAGESIZE
4843  * (from pageout).
4844  */
4845 /*ARGSUSED*/
4846 static int
4847 ufs_putpages(
4848 	struct vnode *vp,
4849 	offset_t off,
4850 	size_t len,
4851 	int flags,
4852 	struct cred *cr)
4853 {
4854 	u_offset_t io_off;
4855 	u_offset_t eoff;
4856 	struct inode *ip = VTOI(vp);
4857 	page_t *pp;
4858 	size_t io_len;
4859 	int err = 0;
4860 	int dolock;
4861 
4862 	if (vp->v_count == 0)
4863 		return (ufs_fault(vp, "ufs_putpages: v_count == 0"));
4864 	/*
4865 	 * Acquire the readers/write inode lock before locking
4866 	 * any pages in this inode.
4867 	 * The inode lock is held during i/o.
4868 	 */
4869 	if (len == 0) {
4870 		mutex_enter(&ip->i_tlock);
4871 		ip->i_delayoff = ip->i_delaylen = 0;
4872 		mutex_exit(&ip->i_tlock);
4873 	}
4874 	dolock = (rw_owner(&ip->i_contents) != curthread);
4875 	if (dolock) {
4876 		/*
4877 		 * Must synchronize this thread and any possible thread
4878 		 * operating in the window of vulnerability in wrip().
4879 		 * It is dangerous to allow both a thread doing a putpage
4880 		 * and a thread writing, so serialize them.  The exception
4881 		 * is when the thread in wrip() does something which causes
4882 		 * a putpage operation.  Then, the thread must be allowed
4883 		 * to continue.  It may encounter a bmap_read problem in
4884 		 * ufs_putapage, but that is handled in ufs_putapage.
4885 		 * Allow async writers to proceed, we don't want to block
4886 		 * the pageout daemon.
4887 		 */
4888 		if (ip->i_writer == curthread)
4889 			rw_enter(&ip->i_contents, RW_READER);
4890 		else {
4891 			for (;;) {
4892 				rw_enter(&ip->i_contents, RW_READER);
4893 				mutex_enter(&ip->i_tlock);
4894 				/*
4895 				 * If there is no thread in the critical
4896 				 * section of wrip(), then proceed.
4897 				 * Otherwise, wait until there isn't one.
4898 				 */
4899 				if (ip->i_writer == NULL) {
4900 					mutex_exit(&ip->i_tlock);
4901 					break;
4902 				}
4903 				rw_exit(&ip->i_contents);
4904 				/*
4905 				 * Bounce async writers when we have a writer
4906 				 * working on this file so we don't deadlock
4907 				 * the pageout daemon.
4908 				 */
4909 				if (flags & B_ASYNC) {
4910 					mutex_exit(&ip->i_tlock);
4911 					return (0);
4912 				}
4913 				cv_wait(&ip->i_wrcv, &ip->i_tlock);
4914 				mutex_exit(&ip->i_tlock);
4915 			}
4916 		}
4917 	}
4918 
4919 	if (!vn_has_cached_data(vp)) {
4920 		if (dolock)
4921 			rw_exit(&ip->i_contents);
4922 		return (0);
4923 	}
4924 
4925 	if (len == 0) {
4926 		/*
4927 		 * Search the entire vp list for pages >= off.
4928 		 */
4929 		err = pvn_vplist_dirty(vp, (u_offset_t)off, ufs_putapage,
4930 					flags, cr);
4931 	} else {
4932 		/*
4933 		 * Loop over all offsets in the range looking for
4934 		 * pages to deal with.
4935 		 */
4936 		if ((eoff = blkroundup(ip->i_fs, ip->i_size)) != 0)
4937 			eoff = MIN(off + len, eoff);
4938 		else
4939 			eoff = off + len;
4940 
4941 		for (io_off = off; io_off < eoff; io_off += io_len) {
4942 			/*
4943 			 * If we are not invalidating, synchronously
4944 			 * freeing or writing pages, use the routine
4945 			 * page_lookup_nowait() to prevent reclaiming
4946 			 * them from the free list.
4947 			 */
4948 			if ((flags & B_INVAL) || ((flags & B_ASYNC) == 0)) {
4949 				pp = page_lookup(vp, io_off,
4950 					(flags & (B_INVAL | B_FREE)) ?
4951 					    SE_EXCL : SE_SHARED);
4952 			} else {
4953 				pp = page_lookup_nowait(vp, io_off,
4954 					(flags & B_FREE) ? SE_EXCL : SE_SHARED);
4955 			}
4956 
4957 			if (pp == NULL || pvn_getdirty(pp, flags) == 0)
4958 				io_len = PAGESIZE;
4959 			else {
4960 				u_offset_t *io_offp = &io_off;
4961 
4962 				err = ufs_putapage(vp, pp, io_offp, &io_len,
4963 				    flags, cr);
4964 				if (err != 0)
4965 					break;
4966 				/*
4967 				 * "io_off" and "io_len" are returned as
4968 				 * the range of pages we actually wrote.
4969 				 * This allows us to skip ahead more quickly
4970 				 * since several pages may've been dealt
4971 				 * with by this iteration of the loop.
4972 				 */
4973 			}
4974 		}
4975 	}
4976 	if (err == 0 && off == 0 && (len == 0 || len >= ip->i_size)) {
4977 		/*
4978 		 * We have just sync'ed back all the pages on
4979 		 * the inode, turn off the IMODTIME flag.
4980 		 */
4981 		mutex_enter(&ip->i_tlock);
4982 		ip->i_flag &= ~IMODTIME;
4983 		mutex_exit(&ip->i_tlock);
4984 	}
4985 	if (dolock)
4986 		rw_exit(&ip->i_contents);
4987 	return (err);
4988 }
4989 
4990 static void
4991 ufs_iodone(buf_t *bp)
4992 {
4993 	struct inode *ip;
4994 
4995 	ASSERT((bp->b_pages->p_vnode != NULL) && !(bp->b_flags & B_READ));
4996 
4997 	bp->b_iodone = NULL;
4998 
4999 	ip = VTOI(bp->b_pages->p_vnode);
5000 
5001 	mutex_enter(&ip->i_tlock);
5002 	if (ip->i_writes >= ufs_LW) {
5003 		if ((ip->i_writes -= bp->b_bcount) <= ufs_LW)
5004 			if (ufs_WRITES)
5005 				cv_broadcast(&ip->i_wrcv); /* wake all up */
5006 	} else {
5007 		ip->i_writes -= bp->b_bcount;
5008 	}
5009 
5010 	mutex_exit(&ip->i_tlock);
5011 	iodone(bp);
5012 }
5013 
5014 /*
5015  * Write out a single page, possibly klustering adjacent
5016  * dirty pages.  The inode lock must be held.
5017  *
5018  * LMXXX - bsize < pagesize not done.
5019  */
5020 /*ARGSUSED*/
5021 int
5022 ufs_putapage(
5023 	struct vnode *vp,
5024 	page_t *pp,
5025 	u_offset_t *offp,
5026 	size_t *lenp,		/* return values */
5027 	int flags,
5028 	struct cred *cr)
5029 {
5030 	u_offset_t io_off;
5031 	u_offset_t off;
5032 	struct inode *ip = VTOI(vp);
5033 	struct ufsvfs *ufsvfsp = ip->i_ufsvfs;
5034 	struct fs *fs;
5035 	struct buf *bp;
5036 	size_t io_len;
5037 	daddr_t bn;
5038 	int err;
5039 	int contig;
5040 
5041 	ASSERT(RW_LOCK_HELD(&ip->i_contents));
5042 
5043 	TRACE_1(TR_FAC_UFS, TR_UFS_PUTAPAGE_START,
5044 		"ufs_putapage_start:vp %p", vp);
5045 
5046 	if (ufsvfsp == NULL) {
5047 		err = EIO;
5048 		goto out_trace;
5049 	}
5050 
5051 	fs = ip->i_fs;
5052 	ASSERT(fs->fs_ronly == 0);
5053 
5054 	/*
5055 	 * If the modified time on the inode has not already been
5056 	 * set elsewhere (e.g. for write/setattr) we set the time now.
5057 	 * This gives us approximate modified times for mmap'ed files
5058 	 * which are modified via stores in the user address space.
5059 	 */
5060 	if ((ip->i_flag & IMODTIME) == 0) {
5061 		mutex_enter(&ip->i_tlock);
5062 		ip->i_flag |= IUPD;
5063 		ip->i_seq++;
5064 		ITIMES_NOLOCK(ip);
5065 		mutex_exit(&ip->i_tlock);
5066 	}
5067 
5068 	/*
5069 	 * Align the request to a block boundry (for old file systems),
5070 	 * and go ask bmap() how contiguous things are for this file.
5071 	 */
5072 	off = pp->p_offset & (offset_t)fs->fs_bmask;	/* block align it */
5073 	contig = 0;
5074 	err = bmap_read(ip, off, &bn, &contig);
5075 	if (err)
5076 		goto out;
5077 	if (bn == UFS_HOLE) {			/* putpage never allocates */
5078 		/*
5079 		 * logging device is in error mode; simply return EIO
5080 		 */
5081 		if (TRANS_ISERROR(ufsvfsp)) {
5082 			err = EIO;
5083 			goto out;
5084 		}
5085 		/*
5086 		 * Oops, the thread in the window in wrip() did some
5087 		 * sort of operation which caused a putpage in the bad
5088 		 * range.  In this case, just return an error which will
5089 		 * cause the software modified bit on the page to set
5090 		 * and the page will get written out again later.
5091 		 */
5092 		if (ip->i_writer == curthread) {
5093 			err = EIO;
5094 			goto out;
5095 		}
5096 		/*
5097 		 * If the pager is trying to push a page in the bad range
5098 		 * just tell him to try again later when things are better.
5099 		 */
5100 		if (flags & B_ASYNC) {
5101 			err = EAGAIN;
5102 			goto out;
5103 		}
5104 		err = ufs_fault(ITOV(ip), "ufs_putapage: bn == UFS_HOLE");
5105 		goto out;
5106 	}
5107 
5108 	/*
5109 	 * Take the length (of contiguous bytes) passed back from bmap()
5110 	 * and _try_ and get a set of pages covering that extent.
5111 	 */
5112 	pp = pvn_write_kluster(vp, pp, &io_off, &io_len, off, contig, flags);
5113 
5114 	/*
5115 	 * May have run out of memory and not clustered backwards.
5116 	 * off		p_offset
5117 	 * [  pp - 1  ][   pp   ]
5118 	 * [	block		]
5119 	 * We told bmap off, so we have to adjust the bn accordingly.
5120 	 */
5121 	if (io_off > off) {
5122 		bn += btod(io_off - off);
5123 		contig -= (io_off - off);
5124 	}
5125 
5126 	/*
5127 	 * bmap was carefull to tell us the right size so use that.
5128 	 * There might be unallocated frags at the end.
5129 	 * LMXXX - bzero the end of the page?  We must be writing after EOF.
5130 	 */
5131 	if (io_len > contig) {
5132 		ASSERT(io_len - contig < fs->fs_bsize);
5133 		io_len -= (io_len - contig);
5134 	}
5135 
5136 	/*
5137 	 * Handle the case where we are writing the last page after EOF.
5138 	 *
5139 	 * XXX - just a patch for i-mt3.
5140 	 */
5141 	if (io_len == 0) {
5142 		ASSERT(pp->p_offset >= (u_offset_t)(roundup(ip->i_size,
5143 							    PAGESIZE)));
5144 		io_len = PAGESIZE;
5145 	}
5146 
5147 	bp = pageio_setup(pp, io_len, ip->i_devvp, B_WRITE | flags);
5148 
5149 	ULOCKFS_SET_MOD(ITOUL(ip));
5150 
5151 	bp->b_edev = ip->i_dev;
5152 	bp->b_dev = cmpdev(ip->i_dev);
5153 	bp->b_blkno = bn;
5154 	bp->b_un.b_addr = (caddr_t)0;
5155 	bp->b_file = ip->i_vnode;
5156 
5157 	if (TRANS_ISTRANS(ufsvfsp)) {
5158 		if ((ip->i_mode & IFMT) == IFSHAD) {
5159 			TRANS_BUF(ufsvfsp, 0, io_len, bp, DT_SHAD);
5160 		} else if (ufsvfsp->vfs_qinod == ip) {
5161 			TRANS_DELTA(ufsvfsp, ldbtob(bn), bp->b_bcount, DT_QR,
5162 			    0, 0);
5163 		}
5164 	}
5165 
5166 	/* write throttle */
5167 
5168 	ASSERT(bp->b_iodone == NULL);
5169 	bp->b_iodone = (int (*)())ufs_iodone;
5170 	mutex_enter(&ip->i_tlock);
5171 	ip->i_writes += bp->b_bcount;
5172 	mutex_exit(&ip->i_tlock);
5173 
5174 	if (bp->b_flags & B_ASYNC) {
5175 		if (ufsvfsp->vfs_log) {
5176 			lufs_write_strategy(ufsvfsp->vfs_log, bp);
5177 		} else if (ufsvfsp->vfs_snapshot) {
5178 			fssnap_strategy(&ufsvfsp->vfs_snapshot, bp);
5179 		} else {
5180 			ufsvfsp->vfs_iotstamp = lbolt;
5181 			ub.ub_putasyncs.value.ul++;
5182 			(void) bdev_strategy(bp);
5183 			lwp_stat_update(LWP_STAT_OUBLK, 1);
5184 		}
5185 	} else {
5186 		if (ufsvfsp->vfs_log) {
5187 			lufs_write_strategy(ufsvfsp->vfs_log, bp);
5188 		} else if (ufsvfsp->vfs_snapshot) {
5189 			fssnap_strategy(&ufsvfsp->vfs_snapshot, bp);
5190 		} else {
5191 			ufsvfsp->vfs_iotstamp = lbolt;
5192 			ub.ub_putsyncs.value.ul++;
5193 			(void) bdev_strategy(bp);
5194 			lwp_stat_update(LWP_STAT_OUBLK, 1);
5195 		}
5196 		err = biowait(bp);
5197 		pageio_done(bp);
5198 		pvn_write_done(pp, ((err) ? B_ERROR : 0) | B_WRITE | flags);
5199 	}
5200 
5201 	pp = NULL;
5202 
5203 out:
5204 	if (err != 0 && pp != NULL)
5205 		pvn_write_done(pp, B_ERROR | B_WRITE | flags);
5206 
5207 	if (offp)
5208 		*offp = io_off;
5209 	if (lenp)
5210 		*lenp = io_len;
5211 out_trace:
5212 	TRACE_2(TR_FAC_UFS, TR_UFS_PUTAPAGE_END,
5213 		"ufs_putapage_end:vp %p error %d", vp, err);
5214 	return (err);
5215 }
5216 
5217 /* ARGSUSED */
5218 static int
5219 ufs_map(struct vnode *vp,
5220 	offset_t off,
5221 	struct as *as,
5222 	caddr_t *addrp,
5223 	size_t len,
5224 	uchar_t prot,
5225 	uchar_t maxprot,
5226 	uint_t flags,
5227 	struct cred *cr)
5228 {
5229 	struct segvn_crargs vn_a;
5230 	struct ufsvfs *ufsvfsp = VTOI(vp)->i_ufsvfs;
5231 	struct ulockfs *ulp;
5232 	int error;
5233 
5234 	TRACE_1(TR_FAC_UFS, TR_UFS_MAP_START,
5235 		"ufs_map_start:vp %p", vp);
5236 
5237 	error = ufs_lockfs_begin(ufsvfsp, &ulp, ULOCKFS_MAP_MASK);
5238 	if (error)
5239 		goto out;
5240 
5241 	if (vp->v_flag & VNOMAP) {
5242 		error = ENOSYS;
5243 		goto unlock;
5244 	}
5245 
5246 	if (off < (offset_t)0 || (offset_t)(off + len) < (offset_t)0) {
5247 		error = ENXIO;
5248 		goto unlock;
5249 	}
5250 
5251 	if (vp->v_type != VREG) {
5252 		error = ENODEV;
5253 		goto unlock;
5254 	}
5255 
5256 	/*
5257 	 * If file is being locked, disallow mapping.
5258 	 */
5259 	if (vn_has_mandatory_locks(vp, VTOI(vp)->i_mode)) {
5260 		error = EAGAIN;
5261 		goto unlock;
5262 	}
5263 
5264 	as_rangelock(as);
5265 	if ((flags & MAP_FIXED) == 0) {
5266 		map_addr(addrp, len, off, 1, flags);
5267 		if (*addrp == NULL) {
5268 			as_rangeunlock(as);
5269 			error = ENOMEM;
5270 			goto unlock;
5271 		}
5272 	} else {
5273 		/*
5274 		 * User specified address - blow away any previous mappings
5275 		 */
5276 		(void) as_unmap(as, *addrp, len);
5277 	}
5278 
5279 	vn_a.vp = vp;
5280 	vn_a.offset = (u_offset_t)off;
5281 	vn_a.type = flags & MAP_TYPE;
5282 	vn_a.prot = prot;
5283 	vn_a.maxprot = maxprot;
5284 	vn_a.cred = cr;
5285 	vn_a.amp = NULL;
5286 	vn_a.flags = flags & ~MAP_TYPE;
5287 	vn_a.szc = 0;
5288 	vn_a.lgrp_mem_policy_flags = 0;
5289 
5290 	error = as_map(as, *addrp, len, segvn_create, &vn_a);
5291 	as_rangeunlock(as);
5292 
5293 unlock:
5294 	if (ulp) {
5295 		ufs_lockfs_end(ulp);
5296 	}
5297 out:
5298 	TRACE_2(TR_FAC_UFS, TR_UFS_MAP_END,
5299 		"ufs_map_end:vp %p error %d", vp, error);
5300 	return (error);
5301 }
5302 
5303 /* ARGSUSED */
5304 static int
5305 ufs_addmap(struct vnode *vp,
5306 	offset_t off,
5307 	struct as *as,
5308 	caddr_t addr,
5309 	size_t	len,
5310 	uchar_t  prot,
5311 	uchar_t  maxprot,
5312 	uint_t    flags,
5313 	struct cred *cr)
5314 {
5315 	struct inode *ip = VTOI(vp);
5316 
5317 	if (vp->v_flag & VNOMAP) {
5318 		return (ENOSYS);
5319 	}
5320 
5321 	mutex_enter(&ip->i_tlock);
5322 	ip->i_mapcnt += btopr(len);
5323 	mutex_exit(&ip->i_tlock);
5324 	return (0);
5325 }
5326 
5327 /*ARGSUSED*/
5328 static int
5329 ufs_delmap(struct vnode *vp, offset_t off, struct as *as, caddr_t addr,
5330 	size_t len, uint_t prot,  uint_t maxprot,  uint_t flags,
5331 	struct cred *cr)
5332 {
5333 	struct inode *ip = VTOI(vp);
5334 
5335 	if (vp->v_flag & VNOMAP) {
5336 		return (ENOSYS);
5337 	}
5338 
5339 	mutex_enter(&ip->i_tlock);
5340 	ip->i_mapcnt -= btopr(len); 	/* Count released mappings */
5341 	ASSERT(ip->i_mapcnt >= 0);
5342 	mutex_exit(&ip->i_tlock);
5343 	return (0);
5344 }
5345 /*
5346  * Return the answer requested to poll() for non-device files
5347  */
5348 struct pollhead ufs_pollhd;
5349 
5350 /* ARGSUSED */
5351 int
5352 ufs_poll(vnode_t *vp, short ev, int any, short *revp, struct pollhead **phpp)
5353 {
5354 	struct ufsvfs	*ufsvfsp;
5355 
5356 	*revp = 0;
5357 	ufsvfsp = VTOI(vp)->i_ufsvfs;
5358 
5359 	if (!ufsvfsp) {
5360 		*revp = POLLHUP;
5361 		goto out;
5362 	}
5363 
5364 	if (ULOCKFS_IS_HLOCK(&ufsvfsp->vfs_ulockfs) ||
5365 	    ULOCKFS_IS_ELOCK(&ufsvfsp->vfs_ulockfs)) {
5366 		*revp |= POLLERR;
5367 
5368 	} else {
5369 		if ((ev & POLLOUT) && !ufsvfsp->vfs_fs->fs_ronly &&
5370 		    !ULOCKFS_IS_WLOCK(&ufsvfsp->vfs_ulockfs))
5371 			*revp |= POLLOUT;
5372 
5373 		if ((ev & POLLWRBAND) && !ufsvfsp->vfs_fs->fs_ronly &&
5374 		    !ULOCKFS_IS_WLOCK(&ufsvfsp->vfs_ulockfs))
5375 			*revp |= POLLWRBAND;
5376 
5377 		if (ev & POLLIN)
5378 			*revp |= POLLIN;
5379 
5380 		if (ev & POLLRDNORM)
5381 			*revp |= POLLRDNORM;
5382 
5383 		if (ev & POLLRDBAND)
5384 			*revp |= POLLRDBAND;
5385 	}
5386 
5387 	if ((ev & POLLPRI) && (*revp & (POLLERR|POLLHUP)))
5388 		*revp |= POLLPRI;
5389 out:
5390 	*phpp = !any && !*revp ? &ufs_pollhd : (struct pollhead *)NULL;
5391 
5392 	return (0);
5393 }
5394 
5395 /* ARGSUSED */
5396 static int
5397 ufs_l_pathconf(struct vnode *vp, int cmd, ulong_t *valp, struct cred *cr)
5398 {
5399 	struct ufsvfs	*ufsvfsp = VTOI(vp)->i_ufsvfs;
5400 	struct ulockfs	*ulp = NULL;
5401 	struct inode 	*sip = NULL;
5402 	int		error;
5403 	struct inode 	*ip = VTOI(vp);
5404 	int		issync;
5405 
5406 	error = ufs_lockfs_begin(ufsvfsp, &ulp, ULOCKFS_PATHCONF_MASK);
5407 	if (error)
5408 		return (error);
5409 
5410 	switch (cmd) {
5411 		/*
5412 		 * Have to handle _PC_NAME_MAX here, because the normal way
5413 		 * [fs_pathconf() -> VOP_STATVFS() -> ufs_statvfs()]
5414 		 * results in a lock ordering reversal between
5415 		 * ufs_lockfs_{begin,end}() and
5416 		 * ufs_thread_{suspend,continue}().
5417 		 *
5418 		 * Keep in sync with ufs_statvfs().
5419 		 */
5420 	case _PC_NAME_MAX:
5421 		*valp = MAXNAMLEN;
5422 		break;
5423 
5424 	case _PC_FILESIZEBITS:
5425 		if (ufsvfsp->vfs_lfflags & UFS_LARGEFILES)
5426 			*valp = UFS_FILESIZE_BITS;
5427 		else
5428 			*valp = 32;
5429 		break;
5430 
5431 	case _PC_XATTR_EXISTS:
5432 		if (vp->v_vfsp->vfs_flag & VFS_XATTR) {
5433 
5434 			error = ufs_xattr_getattrdir(vp, &sip, LOOKUP_XATTR,
5435 							cr);
5436 			if (error ==  0 && sip != NULL) {
5437 				/* Start transaction */
5438 				if (ulp) {
5439 					TRANS_BEGIN_CSYNC(ufsvfsp, issync,
5440 					    TOP_RMDIR, TOP_RMDIR_SIZE);
5441 				}
5442 				/*
5443 				 * Is directory empty
5444 				 */
5445 				rw_enter(&sip->i_rwlock, RW_WRITER);
5446 				rw_enter(&sip->i_contents, RW_WRITER);
5447 				if (ufs_xattrdirempty(sip,
5448 						sip->i_number, CRED())) {
5449 					rw_enter(&ip->i_contents, RW_WRITER);
5450 					ufs_unhook_shadow(ip, sip);
5451 					rw_exit(&ip->i_contents);
5452 
5453 					*valp = 0;
5454 
5455 				} else
5456 					*valp = 1;
5457 				rw_exit(&sip->i_contents);
5458 				rw_exit(&sip->i_rwlock);
5459 				if (ulp) {
5460 					TRANS_END_CSYNC(ufsvfsp, error, issync,
5461 					    TOP_RMDIR, TOP_RMDIR_SIZE);
5462 				}
5463 				VN_RELE(ITOV(sip));
5464 			} else if (error == ENOENT) {
5465 				*valp = 0;
5466 				error = 0;
5467 			}
5468 		} else {
5469 			error = fs_pathconf(vp, cmd, valp, cr);
5470 		}
5471 		break;
5472 
5473 	case _PC_ACL_ENABLED:
5474 		*valp = _ACL_ACLENT_ENABLED;
5475 		break;
5476 
5477 	case _PC_MIN_HOLE_SIZE:
5478 		*valp = (ulong_t)ip->i_fs->fs_bsize;
5479 		break;
5480 
5481 	default:
5482 		error = fs_pathconf(vp, cmd, valp, cr);
5483 	}
5484 
5485 	if (ulp != NULL) {
5486 		ufs_lockfs_end(ulp);
5487 	}
5488 	return (error);
5489 }
5490 
5491 int ufs_pageio_writes, ufs_pageio_reads;
5492 
5493 /*ARGSUSED*/
5494 static int
5495 ufs_pageio(struct vnode *vp, page_t *pp, u_offset_t io_off, size_t io_len,
5496 	int flags, struct cred *cr)
5497 {
5498 	struct inode *ip = VTOI(vp);
5499 	struct ufsvfs *ufsvfsp;
5500 	page_t *npp = NULL, *opp = NULL, *cpp = pp;
5501 	struct buf *bp;
5502 	daddr_t bn;
5503 	size_t done_len = 0, cur_len = 0;
5504 	int err = 0;
5505 	int contig = 0;
5506 	int dolock;
5507 	int vmpss = 0;
5508 	struct ulockfs *ulp;
5509 
5510 	if ((flags & B_READ) && pp != NULL && pp->p_vnode == vp &&
5511 	    vp->v_mpssdata != NULL) {
5512 		vmpss = 1;
5513 	}
5514 
5515 	dolock = (rw_owner(&ip->i_contents) != curthread);
5516 	/*
5517 	 * We need a better check.  Ideally, we would use another
5518 	 * vnodeops so that hlocked and forcibly unmounted file
5519 	 * systems would return EIO where appropriate and w/o the
5520 	 * need for these checks.
5521 	 */
5522 	if ((ufsvfsp = ip->i_ufsvfs) == NULL)
5523 		return (EIO);
5524 
5525 	/*
5526 	 * For vmpss (pp can be NULL) case respect the quiesce protocol.
5527 	 * ul_lock must be taken before locking pages so we can't use it here
5528 	 * if pp is non NULL because segvn already locked pages
5529 	 * SE_EXCL. Instead we rely on the fact that a forced umount or
5530 	 * applying a filesystem lock via ufs_fiolfs() will block in the
5531 	 * implicit call to ufs_flush() until we unlock the pages after the
5532 	 * return to segvn. Other ufs_quiesce() callers keep ufs_quiesce_pend
5533 	 * above 0 until they are done. We have to be careful not to increment
5534 	 * ul_vnops_cnt here after forceful unmount hlocks the file system.
5535 	 *
5536 	 * If pp is NULL use ul_lock to make sure we don't increment
5537 	 * ul_vnops_cnt after forceful unmount hlocks the file system.
5538 	 */
5539 	if (vmpss || pp == NULL) {
5540 		ulp = &ufsvfsp->vfs_ulockfs;
5541 		if (pp == NULL)
5542 			mutex_enter(&ulp->ul_lock);
5543 		if (ulp->ul_fs_lock & ULOCKFS_GETREAD_MASK) {
5544 			if (pp == NULL) {
5545 				mutex_exit(&ulp->ul_lock);
5546 			}
5547 			return (vmpss ? EIO : EINVAL);
5548 		}
5549 		atomic_add_long(&ulp->ul_vnops_cnt, 1);
5550 		if (pp == NULL)
5551 			mutex_exit(&ulp->ul_lock);
5552 		if (ufs_quiesce_pend) {
5553 			if (!atomic_add_long_nv(&ulp->ul_vnops_cnt, -1))
5554 				cv_broadcast(&ulp->ul_cv);
5555 			return (vmpss ? EIO : EINVAL);
5556 		}
5557 	}
5558 
5559 	if (dolock) {
5560 		/*
5561 		 * segvn may call VOP_PAGEIO() instead of VOP_GETPAGE() to
5562 		 * handle a fault against a segment that maps vnode pages with
5563 		 * large mappings.  Segvn creates pages and holds them locked
5564 		 * SE_EXCL during VOP_PAGEIO() call. In this case we have to
5565 		 * use rw_tryenter() to avoid a potential deadlock since in
5566 		 * lock order i_contents needs to be taken first.
5567 		 * Segvn will retry via VOP_GETPAGE() if VOP_PAGEIO() fails.
5568 		 */
5569 		if (!vmpss) {
5570 			rw_enter(&ip->i_contents, RW_READER);
5571 		} else if (!rw_tryenter(&ip->i_contents, RW_READER)) {
5572 			if (!atomic_add_long_nv(&ulp->ul_vnops_cnt, -1))
5573 				cv_broadcast(&ulp->ul_cv);
5574 			return (EDEADLK);
5575 		}
5576 	}
5577 
5578 	/*
5579 	 * Return an error to segvn because the pagefault request is beyond
5580 	 * PAGESIZE rounded EOF.
5581 	 */
5582 	if (vmpss && btopr(io_off + io_len) > btopr(ip->i_size)) {
5583 		if (dolock)
5584 			rw_exit(&ip->i_contents);
5585 		if (!atomic_add_long_nv(&ulp->ul_vnops_cnt, -1))
5586 			cv_broadcast(&ulp->ul_cv);
5587 		return (EFAULT);
5588 	}
5589 
5590 	if (pp == NULL) {
5591 		if (bmap_has_holes(ip)) {
5592 			err = ENOSYS;
5593 		} else {
5594 			err = EINVAL;
5595 		}
5596 		if (dolock)
5597 			rw_exit(&ip->i_contents);
5598 		if (!atomic_add_long_nv(&ulp->ul_vnops_cnt, -1))
5599 			cv_broadcast(&ulp->ul_cv);
5600 		return (err);
5601 	}
5602 
5603 	/*
5604 	 * Break the io request into chunks, one for each contiguous
5605 	 * stretch of disk blocks in the target file.
5606 	 */
5607 	while (done_len < io_len) {
5608 		ASSERT(cpp);
5609 		contig = 0;
5610 		if (err = bmap_read(ip, (u_offset_t)(io_off + done_len),
5611 				    &bn, &contig))
5612 			break;
5613 
5614 		if (bn == UFS_HOLE) {	/* No holey swapfiles */
5615 			if (vmpss) {
5616 				err = EFAULT;
5617 				break;
5618 			}
5619 			err = ufs_fault(ITOV(ip), "ufs_pageio: bn == UFS_HOLE");
5620 			break;
5621 		}
5622 
5623 		cur_len = MIN(io_len - done_len, contig);
5624 		/*
5625 		 * Zero out a page beyond EOF, when the last block of
5626 		 * a file is a UFS fragment so that ufs_pageio() can be used
5627 		 * instead of ufs_getpage() to handle faults against
5628 		 * segvn segments that use large pages.
5629 		 */
5630 		page_list_break(&cpp, &npp, btopr(cur_len));
5631 		if ((flags & B_READ) && (cur_len & PAGEOFFSET)) {
5632 			size_t xlen = cur_len & PAGEOFFSET;
5633 			pagezero(cpp->p_prev, xlen, PAGESIZE - xlen);
5634 		}
5635 
5636 		bp = pageio_setup(cpp, cur_len, ip->i_devvp, flags);
5637 		ASSERT(bp != NULL);
5638 
5639 		bp->b_edev = ip->i_dev;
5640 		bp->b_dev = cmpdev(ip->i_dev);
5641 		bp->b_blkno = bn;
5642 		bp->b_un.b_addr = (caddr_t)0;
5643 		bp->b_file = ip->i_vnode;
5644 
5645 		ufsvfsp->vfs_iotstamp = lbolt;
5646 		ub.ub_pageios.value.ul++;
5647 		if (ufsvfsp->vfs_snapshot)
5648 			fssnap_strategy(&(ufsvfsp->vfs_snapshot), bp);
5649 		else
5650 			(void) bdev_strategy(bp);
5651 
5652 		if (flags & B_READ)
5653 			ufs_pageio_reads++;
5654 		else
5655 			ufs_pageio_writes++;
5656 		if (flags & B_READ)
5657 			lwp_stat_update(LWP_STAT_INBLK, 1);
5658 		else
5659 			lwp_stat_update(LWP_STAT_OUBLK, 1);
5660 		/*
5661 		 * If the request is not B_ASYNC, wait for i/o to complete
5662 		 * and re-assemble the page list to return to the caller.
5663 		 * If it is B_ASYNC we leave the page list in pieces and
5664 		 * cleanup() will dispose of them.
5665 		 */
5666 		if ((flags & B_ASYNC) == 0) {
5667 			err = biowait(bp);
5668 			pageio_done(bp);
5669 			if (err)
5670 				break;
5671 			page_list_concat(&opp, &cpp);
5672 		}
5673 		cpp = npp;
5674 		npp = NULL;
5675 		if (flags & B_READ)
5676 			cur_len = P2ROUNDUP_TYPED(cur_len, PAGESIZE, size_t);
5677 		done_len += cur_len;
5678 	}
5679 	ASSERT(err || (cpp == NULL && npp == NULL && done_len == io_len));
5680 	if (err) {
5681 		if (flags & B_ASYNC) {
5682 			/* Cleanup unprocessed parts of list */
5683 			page_list_concat(&cpp, &npp);
5684 			if (flags & B_READ)
5685 				pvn_read_done(cpp, B_ERROR);
5686 			else
5687 				pvn_write_done(cpp, B_ERROR);
5688 		} else {
5689 			/* Re-assemble list and let caller clean up */
5690 			page_list_concat(&opp, &cpp);
5691 			page_list_concat(&opp, &npp);
5692 		}
5693 	}
5694 
5695 	if (vmpss && !(ip->i_flag & IACC) && !ULOCKFS_IS_NOIACC(ulp) &&
5696 	    ufsvfsp->vfs_fs->fs_ronly == 0 && !ufsvfsp->vfs_noatime) {
5697 		mutex_enter(&ip->i_tlock);
5698 		ip->i_flag |= IACC;
5699 		ITIMES_NOLOCK(ip);
5700 		mutex_exit(&ip->i_tlock);
5701 	}
5702 
5703 	if (dolock)
5704 		rw_exit(&ip->i_contents);
5705 	if (vmpss && !atomic_add_long_nv(&ulp->ul_vnops_cnt, -1))
5706 		cv_broadcast(&ulp->ul_cv);
5707 	return (err);
5708 }
5709 
5710 /*
5711  * Called when the kernel is in a frozen state to dump data
5712  * directly to the device. It uses a private dump data structure,
5713  * set up by dump_ctl, to locate the correct disk block to which to dump.
5714  */
5715 static int
5716 ufs_dump(vnode_t *vp, caddr_t addr, int ldbn, int dblks)
5717 {
5718 	u_offset_t	file_size;
5719 	struct inode    *ip = VTOI(vp);
5720 	struct fs	*fs = ip->i_fs;
5721 	daddr_t		dbn, lfsbn;
5722 	int		disk_blks = fs->fs_bsize >> DEV_BSHIFT;
5723 	int		error = 0;
5724 	int		ndbs, nfsbs;
5725 
5726 	/*
5727 	 * forced unmount case
5728 	 */
5729 	if (ip->i_ufsvfs == NULL)
5730 		return (EIO);
5731 	/*
5732 	 * Validate the inode that it has not been modified since
5733 	 * the dump structure is allocated.
5734 	 */
5735 	mutex_enter(&ip->i_tlock);
5736 	if ((dump_info == NULL) ||
5737 	    (dump_info->ip != ip) ||
5738 	    (dump_info->time.tv_sec != ip->i_mtime.tv_sec) ||
5739 	    (dump_info->time.tv_usec != ip->i_mtime.tv_usec)) {
5740 		mutex_exit(&ip->i_tlock);
5741 		return (-1);
5742 	}
5743 	mutex_exit(&ip->i_tlock);
5744 
5745 	/*
5746 	 * See that the file has room for this write
5747 	 */
5748 	UFS_GET_ISIZE(&file_size, ip);
5749 
5750 	if (ldbtob((offset_t)(ldbn + dblks)) > file_size)
5751 		return (ENOSPC);
5752 
5753 	/*
5754 	 * Find the physical disk block numbers from the dump
5755 	 * private data structure directly and write out the data
5756 	 * in contiguous block lumps
5757 	 */
5758 	while (dblks > 0 && !error) {
5759 		lfsbn = (daddr_t)lblkno(fs, ldbtob((offset_t)ldbn));
5760 		dbn = fsbtodb(fs, dump_info->dblk[lfsbn]) + ldbn % disk_blks;
5761 		nfsbs = 1;
5762 		ndbs = disk_blks - ldbn % disk_blks;
5763 		while (ndbs < dblks && fsbtodb(fs, dump_info->dblk[lfsbn +
5764 		    nfsbs]) == dbn + ndbs) {
5765 			nfsbs++;
5766 			ndbs += disk_blks;
5767 		}
5768 		if (ndbs > dblks)
5769 			ndbs = dblks;
5770 		error = bdev_dump(ip->i_dev, addr, dbn, ndbs);
5771 		addr += ldbtob((offset_t)ndbs);
5772 		dblks -= ndbs;
5773 		ldbn += ndbs;
5774 	}
5775 	return (error);
5776 
5777 }
5778 
5779 /*
5780  * Prepare the file system before and after the dump operation.
5781  *
5782  * action = DUMP_ALLOC:
5783  * Preparation before dump, allocate dump private data structure
5784  * to hold all the direct and indirect block info for dump.
5785  *
5786  * action = DUMP_FREE:
5787  * Clean up after dump, deallocate the dump private data structure.
5788  *
5789  * action = DUMP_SCAN:
5790  * Scan dump_info for *blkp DEV_BSIZE blocks of contig fs space;
5791  * if found, the starting file-relative DEV_BSIZE lbn is written
5792  * to *bklp; that lbn is intended for use with VOP_DUMP()
5793  */
5794 static int
5795 ufs_dumpctl(vnode_t *vp, int action, int *blkp)
5796 {
5797 	struct inode	*ip = VTOI(vp);
5798 	ufsvfs_t	*ufsvfsp = ip->i_ufsvfs;
5799 	struct fs	*fs;
5800 	daddr32_t	*dblk, *storeblk;
5801 	daddr32_t	*nextblk, *endblk;
5802 	struct buf	*bp;
5803 	int		i, entry, entries;
5804 	int		n, ncontig;
5805 
5806 	/*
5807 	 * check for forced unmount
5808 	 */
5809 	if (ufsvfsp == NULL)
5810 		return (EIO);
5811 
5812 	if (action == DUMP_ALLOC) {
5813 		/*
5814 		 * alloc and record dump_info
5815 		 */
5816 		if (dump_info != NULL)
5817 			return (EINVAL);
5818 
5819 		ASSERT(vp->v_type == VREG);
5820 		fs = ufsvfsp->vfs_fs;
5821 
5822 		rw_enter(&ip->i_contents, RW_READER);
5823 
5824 		if (bmap_has_holes(ip)) {
5825 			rw_exit(&ip->i_contents);
5826 			return (EFAULT);
5827 		}
5828 
5829 		/*
5830 		 * calculate and allocate space needed according to i_size
5831 		 */
5832 		entries = (int)lblkno(fs, blkroundup(fs, ip->i_size));
5833 		if ((dump_info = (struct dump *)
5834 		    kmem_alloc(sizeof (struct dump) +
5835 		    (entries - 1) * sizeof (daddr32_t), KM_NOSLEEP)) == NULL) {
5836 			    rw_exit(&ip->i_contents);
5837 			    return (ENOMEM);
5838 		}
5839 
5840 		/* Start saving the info */
5841 		dump_info->fsbs = entries;
5842 		dump_info->ip = ip;
5843 		storeblk = &dump_info->dblk[0];
5844 
5845 		/* Direct Blocks */
5846 		for (entry = 0; entry < NDADDR && entry < entries; entry++)
5847 			*storeblk++ = ip->i_db[entry];
5848 
5849 		/* Indirect Blocks */
5850 		for (i = 0; i < NIADDR; i++) {
5851 			int error = 0;
5852 
5853 			bp = UFS_BREAD(ufsvfsp,
5854 				ip->i_dev, fsbtodb(fs, ip->i_ib[i]),
5855 				fs->fs_bsize);
5856 			if (bp->b_flags & B_ERROR)
5857 				error = EIO;
5858 			else {
5859 				dblk = bp->b_un.b_daddr;
5860 				if ((storeblk = save_dblks(ip, ufsvfsp,
5861 				    storeblk, dblk, i, entries)) == NULL)
5862 					error = EIO;
5863 			}
5864 
5865 			brelse(bp);
5866 
5867 			if (error != 0) {
5868 				kmem_free(dump_info, sizeof (struct dump) +
5869 				    (entries - 1) * sizeof (daddr32_t));
5870 				rw_exit(&ip->i_contents);
5871 				dump_info = NULL;
5872 				return (error);
5873 			}
5874 		}
5875 		/* and time stamp the information */
5876 		mutex_enter(&ip->i_tlock);
5877 		dump_info->time = ip->i_mtime;
5878 		mutex_exit(&ip->i_tlock);
5879 
5880 		rw_exit(&ip->i_contents);
5881 	} else if (action == DUMP_FREE) {
5882 		/*
5883 		 * free dump_info
5884 		 */
5885 		if (dump_info == NULL)
5886 			return (EINVAL);
5887 		entries = dump_info->fsbs - 1;
5888 		kmem_free(dump_info, sizeof (struct dump) +
5889 		    entries * sizeof (daddr32_t));
5890 		dump_info = NULL;
5891 	} else if (action == DUMP_SCAN) {
5892 		/*
5893 		 * scan dump_info
5894 		 */
5895 		if (dump_info == NULL)
5896 			return (EINVAL);
5897 
5898 		dblk = dump_info->dblk;
5899 		nextblk = dblk + 1;
5900 		endblk = dblk + dump_info->fsbs - 1;
5901 		fs = ufsvfsp->vfs_fs;
5902 		ncontig = *blkp >> (fs->fs_bshift - DEV_BSHIFT);
5903 
5904 		/*
5905 		 * scan dblk[] entries; contig fs space is found when:
5906 		 * ((current blkno + frags per block) == next blkno)
5907 		 */
5908 		n = 0;
5909 		while (n < ncontig && dblk < endblk) {
5910 			if ((*dblk + fs->fs_frag) == *nextblk)
5911 				n++;
5912 			else
5913 				n = 0;
5914 			dblk++;
5915 			nextblk++;
5916 		}
5917 
5918 		/*
5919 		 * index is where size bytes of contig space begins;
5920 		 * conversion from index to the file's DEV_BSIZE lbn
5921 		 * is equivalent to:  (index * fs_bsize) / DEV_BSIZE
5922 		 */
5923 		if (n == ncontig) {
5924 			i = (dblk - dump_info->dblk) - ncontig;
5925 			*blkp = i << (fs->fs_bshift - DEV_BSHIFT);
5926 		} else
5927 			return (EFAULT);
5928 	}
5929 	return (0);
5930 }
5931 
5932 /*
5933  * Recursive helper function for ufs_dumpctl().  It follows the indirect file
5934  * system  blocks until it reaches the the disk block addresses, which are
5935  * then stored into the given buffer, storeblk.
5936  */
5937 static daddr32_t *
5938 save_dblks(struct inode *ip, struct ufsvfs *ufsvfsp,  daddr32_t *storeblk,
5939     daddr32_t *dblk, int level, int entries)
5940 {
5941 	struct fs	*fs = ufsvfsp->vfs_fs;
5942 	struct buf	*bp;
5943 	int		i;
5944 
5945 	if (level == 0) {
5946 		for (i = 0; i < NINDIR(fs); i++) {
5947 			if (storeblk - dump_info->dblk >= entries)
5948 				break;
5949 			*storeblk++ = dblk[i];
5950 		}
5951 		return (storeblk);
5952 	}
5953 	for (i = 0; i < NINDIR(fs); i++) {
5954 		if (storeblk - dump_info->dblk >= entries)
5955 			break;
5956 		bp = UFS_BREAD(ufsvfsp,
5957 				ip->i_dev, fsbtodb(fs, dblk[i]), fs->fs_bsize);
5958 		if (bp->b_flags & B_ERROR) {
5959 			brelse(bp);
5960 			return (NULL);
5961 		}
5962 		storeblk = save_dblks(ip, ufsvfsp, storeblk, bp->b_un.b_daddr,
5963 		    level - 1, entries);
5964 		brelse(bp);
5965 
5966 		if (storeblk == NULL)
5967 			return (NULL);
5968 	}
5969 	return (storeblk);
5970 }
5971 
5972 /* ARGSUSED */
5973 static int
5974 ufs_getsecattr(struct vnode *vp, vsecattr_t *vsap, int flag,
5975 	struct cred *cr)
5976 {
5977 	struct inode	*ip = VTOI(vp);
5978 	struct ulockfs	*ulp;
5979 	struct ufsvfs	*ufsvfsp = ip->i_ufsvfs;
5980 	ulong_t		vsa_mask = vsap->vsa_mask;
5981 	int		err = EINVAL;
5982 
5983 	TRACE_3(TR_FAC_UFS, TR_UFS_GETSECATTR_START,
5984 	    "ufs_getsecattr_start:vp %p, vsap %p, flags %x", vp, vsap, flag);
5985 
5986 	vsa_mask &= (VSA_ACL | VSA_ACLCNT | VSA_DFACL | VSA_DFACLCNT);
5987 
5988 	/*
5989 	 * Only grab locks if needed - they're not needed to check vsa_mask
5990 	 * or if the mask contains no acl flags.
5991 	 */
5992 	if (vsa_mask != 0) {
5993 		if (err = ufs_lockfs_begin(ufsvfsp, &ulp,
5994 		    ULOCKFS_GETATTR_MASK))
5995 			return (err);
5996 
5997 		rw_enter(&ip->i_contents, RW_READER);
5998 		err = ufs_acl_get(ip, vsap, flag, cr);
5999 		rw_exit(&ip->i_contents);
6000 
6001 		if (ulp)
6002 			ufs_lockfs_end(ulp);
6003 	}
6004 	TRACE_1(TR_FAC_UFS, TR_UFS_GETSECATTR_END,
6005 	    "ufs_getsecattr_end:vp %p", vp);
6006 	return (err);
6007 }
6008 
6009 /* ARGSUSED */
6010 static int
6011 ufs_setsecattr(struct vnode *vp, vsecattr_t *vsap, int flag, struct cred *cr)
6012 {
6013 	struct inode	*ip = VTOI(vp);
6014 	struct ulockfs	*ulp = NULL;
6015 	struct ufsvfs	*ufsvfsp = VTOI(vp)->i_ufsvfs;
6016 	ulong_t		vsa_mask = vsap->vsa_mask;
6017 	int		err;
6018 	int		haverwlock = 1;
6019 	int		trans_size;
6020 	int		donetrans = 0;
6021 	int		retry = 1;
6022 
6023 
6024 	TRACE_3(TR_FAC_UFS, TR_UFS_SETSECATTR_START,
6025 	    "ufs_setsecattr_start:vp %p, vsap %p, flags %x", vp, vsap, flag);
6026 
6027 	ASSERT(RW_LOCK_HELD(&ip->i_rwlock));
6028 
6029 	/* Abort now if the request is either empty or invalid. */
6030 	vsa_mask &= (VSA_ACL | VSA_ACLCNT | VSA_DFACL | VSA_DFACLCNT);
6031 	if ((vsa_mask == 0) ||
6032 	    ((vsap->vsa_aclentp == NULL) &&
6033 	    (vsap->vsa_dfaclentp == NULL))) {
6034 		err = EINVAL;
6035 		goto out;
6036 	}
6037 
6038 	/*
6039 	 * Following convention, if this is a directory then we acquire the
6040 	 * inode's i_rwlock after starting a UFS logging transaction;
6041 	 * otherwise, we acquire it beforehand. Since we were called (and
6042 	 * must therefore return) with the lock held, we will have to drop it,
6043 	 * and later reacquire it, if operating on a directory.
6044 	 */
6045 	if (vp->v_type == VDIR) {
6046 		rw_exit(&ip->i_rwlock);
6047 		haverwlock = 0;
6048 	} else {
6049 		/* Upgrade the lock if required. */
6050 		if (!rw_write_held(&ip->i_rwlock)) {
6051 			rw_exit(&ip->i_rwlock);
6052 			rw_enter(&ip->i_rwlock, RW_WRITER);
6053 		}
6054 	}
6055 
6056 again:
6057 	ASSERT(!(vp->v_type == VDIR && haverwlock));
6058 	if (err = ufs_lockfs_begin(ufsvfsp, &ulp, ULOCKFS_SETATTR_MASK)) {
6059 		ulp = NULL;
6060 		retry = 0;
6061 		goto out;
6062 	}
6063 
6064 	/*
6065 	 * Check that the file system supports this operation. Note that
6066 	 * ufs_lockfs_begin() will have checked that the file system had
6067 	 * not been forcibly unmounted.
6068 	 */
6069 	if (ufsvfsp->vfs_fs->fs_ronly) {
6070 		err = EROFS;
6071 		goto out;
6072 	}
6073 	if (ufsvfsp->vfs_nosetsec) {
6074 		err = ENOSYS;
6075 		goto out;
6076 	}
6077 
6078 	if (ulp) {
6079 		TRANS_BEGIN_ASYNC(ufsvfsp, TOP_SETSECATTR,
6080 			trans_size = TOP_SETSECATTR_SIZE(VTOI(vp)));
6081 		donetrans = 1;
6082 	}
6083 
6084 	if (vp->v_type == VDIR) {
6085 		rw_enter(&ip->i_rwlock, RW_WRITER);
6086 		haverwlock = 1;
6087 	}
6088 
6089 	ASSERT(haverwlock);
6090 
6091 	/* Do the actual work. */
6092 	rw_enter(&ip->i_contents, RW_WRITER);
6093 	/*
6094 	 * Suppress out of inodes messages if we will retry.
6095 	 */
6096 	if (retry)
6097 		ip->i_flag |= IQUIET;
6098 	err = ufs_acl_set(ip, vsap, flag, cr);
6099 	ip->i_flag &= ~IQUIET;
6100 	rw_exit(&ip->i_contents);
6101 
6102 out:
6103 	if (ulp) {
6104 		if (donetrans) {
6105 			/*
6106 			 * top_end_async() can eventually call
6107 			 * top_end_sync(), which can block. We must
6108 			 * therefore observe the lock-ordering protocol
6109 			 * here as well.
6110 			 */
6111 			if (vp->v_type == VDIR) {
6112 				rw_exit(&ip->i_rwlock);
6113 				haverwlock = 0;
6114 			}
6115 			TRANS_END_ASYNC(ufsvfsp, TOP_SETSECATTR, trans_size);
6116 		}
6117 		ufs_lockfs_end(ulp);
6118 	}
6119 	/*
6120 	 * If no inodes available, try scaring a logically-
6121 	 * free one out of the delete queue to someplace
6122 	 * that we can find it.
6123 	 */
6124 	if ((err == ENOSPC) && retry && TRANS_ISTRANS(ufsvfsp)) {
6125 		ufs_delete_drain_wait(ufsvfsp, 1);
6126 		retry = 0;
6127 		if (vp->v_type == VDIR && haverwlock) {
6128 			rw_exit(&ip->i_rwlock);
6129 			haverwlock = 0;
6130 		}
6131 		goto again;
6132 	}
6133 	/*
6134 	 * If we need to reacquire the lock then it is safe to do so
6135 	 * as a reader. This is because ufs_rwunlock(), which will be
6136 	 * called by our caller after we return, does not differentiate
6137 	 * between shared and exclusive locks.
6138 	 */
6139 	if (!haverwlock) {
6140 		ASSERT(vp->v_type == VDIR);
6141 		rw_enter(&ip->i_rwlock, RW_READER);
6142 	}
6143 
6144 	TRACE_1(TR_FAC_UFS, TR_UFS_SETSECATTR_END,
6145 	    "ufs_setsecattr_end:vp %p", vp);
6146 	return (err);
6147 }
6148