1 /*
   2  * CDDL HEADER START
   3  *
   4  * The contents of this file are subject to the terms of the
   5  * Common Development and Distribution License (the "License").
   6  * You may not use this file except in compliance with the License.
   7  *
   8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
   9  * or http://www.opensolaris.org/os/licensing.
  10  * See the License for the specific language governing permissions
  11  * and limitations under the License.
  12  *
  13  * When distributing Covered Code, include this CDDL HEADER in each
  14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
  15  * If applicable, add the following below this CDDL HEADER, with the
  16  * fields enclosed by brackets "[]" replaced with your own identifying
  17  * information: Portions Copyright [yyyy] [name of copyright owner]
  18  *
  19  * CDDL HEADER END
  20  */
  21 
  22 /*
  23  * Copyright (c) 1984, 2010, Oracle and/or its affiliates. All rights reserved.
  24  * Copyright 2015, Joyent, Inc.
  25  * Copyright (c) 2016 by Delphix. All rights reserved.
  26  */
  27 
  28 /*      Copyright (c) 1983, 1984, 1985, 1986, 1987, 1988, 1989 AT&T */
  29 /*        All Rights Reserved   */
  30 
  31 /*
  32  * Portions of this source code were derived from Berkeley 4.3 BSD
  33  * under license from the Regents of the University of California.
  34  */
  35 
  36 #include <sys/types.h>
  37 #include <sys/t_lock.h>
  38 #include <sys/ksynch.h>
  39 #include <sys/param.h>
  40 #include <sys/time.h>
  41 #include <sys/systm.h>
  42 #include <sys/sysmacros.h>
  43 #include <sys/resource.h>
  44 #include <sys/signal.h>
  45 #include <sys/cred.h>
  46 #include <sys/user.h>
  47 #include <sys/buf.h>
  48 #include <sys/vfs.h>
  49 #include <sys/vfs_opreg.h>
  50 #include <sys/vnode.h>
  51 #include <sys/proc.h>
  52 #include <sys/disp.h>
  53 #include <sys/file.h>
  54 #include <sys/fcntl.h>
  55 #include <sys/flock.h>
  56 #include <sys/atomic.h>
  57 #include <sys/kmem.h>
  58 #include <sys/uio.h>
  59 #include <sys/dnlc.h>
  60 #include <sys/conf.h>
  61 #include <sys/mman.h>
  62 #include <sys/pathname.h>
  63 #include <sys/debug.h>
  64 #include <sys/vmsystm.h>
  65 #include <sys/cmn_err.h>
  66 #include <sys/filio.h>
  67 #include <sys/policy.h>
  68 
  69 #include <sys/fs/ufs_fs.h>
  70 #include <sys/fs/ufs_lockfs.h>
  71 #include <sys/fs/ufs_filio.h>
  72 #include <sys/fs/ufs_inode.h>
  73 #include <sys/fs/ufs_fsdir.h>
  74 #include <sys/fs/ufs_quota.h>
  75 #include <sys/fs/ufs_log.h>
  76 #include <sys/fs/ufs_snap.h>
  77 #include <sys/fs/ufs_trans.h>
  78 #include <sys/fs/ufs_panic.h>
  79 #include <sys/fs/ufs_bio.h>
  80 #include <sys/dirent.h>           /* must be AFTER <sys/fs/fsdir.h>! */
  81 #include <sys/errno.h>
  82 #include <sys/fssnap_if.h>
  83 #include <sys/unistd.h>
  84 #include <sys/sunddi.h>
  85 
  86 #include <sys/filio.h>            /* _FIOIO */
  87 
  88 #include <vm/hat.h>
  89 #include <vm/page.h>
  90 #include <vm/pvn.h>
  91 #include <vm/as.h>
  92 #include <vm/seg.h>
  93 #include <vm/seg_map.h>
  94 #include <vm/seg_vn.h>
  95 #include <vm/seg_kmem.h>
  96 #include <vm/rm.h>
  97 #include <sys/swap.h>
  98 
  99 #include <fs/fs_subr.h>
 100 
 101 #include <sys/fs/decomp.h>
 102 
 103 static struct instats ins;
 104 
 105 static  int ufs_getpage_ra(struct vnode *, u_offset_t, struct seg *, caddr_t);
 106 static  int ufs_getpage_miss(struct vnode *, u_offset_t, size_t, struct seg *,
 107                 caddr_t, struct page **, size_t, enum seg_rw, int);
 108 static  int ufs_open(struct vnode **, int, struct cred *, caller_context_t *);
 109 static  int ufs_close(struct vnode *, int, int, offset_t, struct cred *,
 110                 caller_context_t *);
 111 static  int ufs_read(struct vnode *, struct uio *, int, struct cred *,
 112                 struct caller_context *);
 113 static  int ufs_write(struct vnode *, struct uio *, int, struct cred *,
 114                 struct caller_context *);
 115 static  int ufs_ioctl(struct vnode *, int, intptr_t, int, struct cred *,
 116                 int *, caller_context_t *);
 117 static  int ufs_getattr(struct vnode *, struct vattr *, int, struct cred *,
 118                 caller_context_t *);
 119 static  int ufs_setattr(struct vnode *, struct vattr *, int, struct cred *,
 120                 caller_context_t *);
 121 static  int ufs_access(struct vnode *, int, int, struct cred *,
 122                 caller_context_t *);
 123 static  int ufs_lookup(struct vnode *, char *, struct vnode **,
 124                 struct pathname *, int, struct vnode *, struct cred *,
 125                 caller_context_t *, int *, pathname_t *);
 126 static  int ufs_create(struct vnode *, char *, struct vattr *, enum vcexcl,
 127                 int, struct vnode **, struct cred *, int,
 128                 caller_context_t *, vsecattr_t  *);
 129 static  int ufs_remove(struct vnode *, char *, struct cred *,
 130                 caller_context_t *, int);
 131 static  int ufs_link(struct vnode *, struct vnode *, char *, struct cred *,
 132                 caller_context_t *, int);
 133 static  int ufs_rename(struct vnode *, char *, struct vnode *, char *,
 134                 struct cred *, caller_context_t *, int);
 135 static  int ufs_mkdir(struct vnode *, char *, struct vattr *, struct vnode **,
 136                 struct cred *, caller_context_t *, int, vsecattr_t *);
 137 static  int ufs_rmdir(struct vnode *, char *, struct vnode *, struct cred *,
 138                 caller_context_t *, int);
 139 static  int ufs_readdir(struct vnode *, struct uio *, struct cred *, int *,
 140                 caller_context_t *, int);
 141 static  int ufs_symlink(struct vnode *, char *, struct vattr *, char *,
 142                 struct cred *, caller_context_t *, int);
 143 static  int ufs_readlink(struct vnode *, struct uio *, struct cred *,
 144                 caller_context_t *);
 145 static  int ufs_fsync(struct vnode *, int, struct cred *, caller_context_t *);
 146 static  void ufs_inactive(struct vnode *, struct cred *, caller_context_t *);
 147 static  int ufs_fid(struct vnode *, struct fid *, caller_context_t *);
 148 static  int ufs_rwlock(struct vnode *, int, caller_context_t *);
 149 static  void ufs_rwunlock(struct vnode *, int, caller_context_t *);
 150 static  int ufs_seek(struct vnode *, offset_t, offset_t *, caller_context_t *);
 151 static  int ufs_frlock(struct vnode *, int, struct flock64 *, int, offset_t,
 152                 struct flk_callback *, struct cred *,
 153                 caller_context_t *);
 154 static  int ufs_space(struct vnode *, int, struct flock64 *, int, offset_t,
 155                 cred_t *, caller_context_t *);
 156 static  int ufs_getpage(struct vnode *, offset_t, size_t, uint_t *,
 157                 struct page **, size_t, struct seg *, caddr_t,
 158                 enum seg_rw, struct cred *, caller_context_t *);
 159 static  int ufs_putpage(struct vnode *, offset_t, size_t, int, struct cred *,
 160                 caller_context_t *);
 161 static  int ufs_putpages(struct vnode *, offset_t, size_t, int, struct cred *);
 162 static  int ufs_map(struct vnode *, offset_t, struct as *, caddr_t *, size_t,
 163                 uchar_t, uchar_t, uint_t, struct cred *, caller_context_t *);
 164 static  int ufs_addmap(struct vnode *, offset_t, struct as *, caddr_t,  size_t,
 165                 uchar_t, uchar_t, uint_t, struct cred *, caller_context_t *);
 166 static  int ufs_delmap(struct vnode *, offset_t, struct as *, caddr_t,  size_t,
 167                 uint_t, uint_t, uint_t, struct cred *, caller_context_t *);
 168 static  int ufs_poll(vnode_t *, short, int, short *, struct pollhead **,
 169                 caller_context_t *);
 170 static  int ufs_dump(vnode_t *, caddr_t, offset_t, offset_t,
 171     caller_context_t *);
 172 static  int ufs_l_pathconf(struct vnode *, int, ulong_t *, struct cred *,
 173                 caller_context_t *);
 174 static  int ufs_pageio(struct vnode *, struct page *, u_offset_t, size_t, int,
 175                 struct cred *, caller_context_t *);
 176 static  int ufs_dumpctl(vnode_t *, int, offset_t *, caller_context_t *);
 177 static  daddr32_t *save_dblks(struct inode *, struct ufsvfs *, daddr32_t *,
 178                 daddr32_t *, int, int);
 179 static  int ufs_getsecattr(struct vnode *, vsecattr_t *, int, struct cred *,
 180                 caller_context_t *);
 181 static  int ufs_setsecattr(struct vnode *, vsecattr_t *, int, struct cred *,
 182                 caller_context_t *);
 183 static  int ufs_priv_access(void *, int, struct cred *);
 184 static  int ufs_eventlookup(struct vnode *, char *, struct cred *,
 185     struct vnode **);
 186 extern int as_map_locked(struct as *, caddr_t, size_t, int ((*)()), void *);
 187 
 188 /*
 189  * For lockfs: ulockfs begin/end is now inlined in the ufs_xxx functions.
 190  *
 191  * XXX - ULOCKFS in fs_pathconf and ufs_ioctl is not inlined yet.
 192  */
 193 struct vnodeops *ufs_vnodeops;
 194 
 195 /* NOTE: "not blkd" below  means that the operation isn't blocked by lockfs */
 196 const fs_operation_def_t ufs_vnodeops_template[] = {
 197         VOPNAME_OPEN,           { .vop_open = ufs_open },       /* not blkd */
 198         VOPNAME_CLOSE,          { .vop_close = ufs_close },     /* not blkd */
 199         VOPNAME_READ,           { .vop_read = ufs_read },
 200         VOPNAME_WRITE,          { .vop_write = ufs_write },
 201         VOPNAME_IOCTL,          { .vop_ioctl = ufs_ioctl },
 202         VOPNAME_GETATTR,        { .vop_getattr = ufs_getattr },
 203         VOPNAME_SETATTR,        { .vop_setattr = ufs_setattr },
 204         VOPNAME_ACCESS,         { .vop_access = ufs_access },
 205         VOPNAME_LOOKUP,         { .vop_lookup = ufs_lookup },
 206         VOPNAME_CREATE,         { .vop_create = ufs_create },
 207         VOPNAME_REMOVE,         { .vop_remove = ufs_remove },
 208         VOPNAME_LINK,           { .vop_link = ufs_link },
 209         VOPNAME_RENAME,         { .vop_rename = ufs_rename },
 210         VOPNAME_MKDIR,          { .vop_mkdir = ufs_mkdir },
 211         VOPNAME_RMDIR,          { .vop_rmdir = ufs_rmdir },
 212         VOPNAME_READDIR,        { .vop_readdir = ufs_readdir },
 213         VOPNAME_SYMLINK,        { .vop_symlink = ufs_symlink },
 214         VOPNAME_READLINK,       { .vop_readlink = ufs_readlink },
 215         VOPNAME_FSYNC,          { .vop_fsync = ufs_fsync },
 216         VOPNAME_INACTIVE,       { .vop_inactive = ufs_inactive }, /* not blkd */
 217         VOPNAME_FID,            { .vop_fid = ufs_fid },
 218         VOPNAME_RWLOCK,         { .vop_rwlock = ufs_rwlock },   /* not blkd */
 219         VOPNAME_RWUNLOCK,       { .vop_rwunlock = ufs_rwunlock }, /* not blkd */
 220         VOPNAME_SEEK,           { .vop_seek = ufs_seek },
 221         VOPNAME_FRLOCK,         { .vop_frlock = ufs_frlock },
 222         VOPNAME_SPACE,          { .vop_space = ufs_space },
 223         VOPNAME_GETPAGE,        { .vop_getpage = ufs_getpage },
 224         VOPNAME_PUTPAGE,        { .vop_putpage = ufs_putpage },
 225         VOPNAME_MAP,            { .vop_map = ufs_map },
 226         VOPNAME_ADDMAP,         { .vop_addmap = ufs_addmap },   /* not blkd */
 227         VOPNAME_DELMAP,         { .vop_delmap = ufs_delmap },   /* not blkd */
 228         VOPNAME_POLL,           { .vop_poll = ufs_poll },       /* not blkd */
 229         VOPNAME_DUMP,           { .vop_dump = ufs_dump },
 230         VOPNAME_PATHCONF,       { .vop_pathconf = ufs_l_pathconf },
 231         VOPNAME_PAGEIO,         { .vop_pageio = ufs_pageio },
 232         VOPNAME_DUMPCTL,        { .vop_dumpctl = ufs_dumpctl },
 233         VOPNAME_GETSECATTR,     { .vop_getsecattr = ufs_getsecattr },
 234         VOPNAME_SETSECATTR,     { .vop_setsecattr = ufs_setsecattr },
 235         VOPNAME_VNEVENT,        { .vop_vnevent = fs_vnevent_support },
 236         NULL,                   NULL
 237 };
 238 
 239 #define MAX_BACKFILE_COUNT      9999
 240 
 241 /*
 242  * Created by ufs_dumpctl() to store a file's disk block info into memory.
 243  * Used by ufs_dump() to dump data to disk directly.
 244  */
 245 struct dump {
 246         struct inode    *ip;            /* the file we contain */
 247         daddr_t         fsbs;           /* number of blocks stored */
 248         struct timeval32 time;          /* time stamp for the struct */
 249         daddr32_t       dblk[1];        /* place holder for block info */
 250 };
 251 
 252 static struct dump *dump_info = NULL;
 253 
 254 /*
 255  * Previously there was no special action required for ordinary files.
 256  * (Devices are handled through the device file system.)
 257  * Now we support Large Files and Large File API requires open to
 258  * fail if file is large.
 259  * We could take care to prevent data corruption
 260  * by doing an atomic check of size and truncate if file is opened with
 261  * FTRUNC flag set but traditionally this is being done by the vfs/vnode
 262  * layers. So taking care of truncation here is a change in the existing
 263  * semantics of VOP_OPEN and therefore we chose not to implement any thing
 264  * here. The check for the size of the file > 2GB is being done at the
 265  * vfs layer in routine vn_open().
 266  */
 267 
 268 /* ARGSUSED */
 269 static int
 270 ufs_open(struct vnode **vpp, int flag, struct cred *cr, caller_context_t *ct)
 271 {
 272         return (0);
 273 }
 274 
 275 /*ARGSUSED*/
 276 static int
 277 ufs_close(struct vnode *vp, int flag, int count, offset_t offset,
 278         struct cred *cr, caller_context_t *ct)
 279 {
 280         cleanlocks(vp, ttoproc(curthread)->p_pid, 0);
 281         cleanshares(vp, ttoproc(curthread)->p_pid);
 282 
 283         /*
 284          * Push partially filled cluster at last close.
 285          * ``last close'' is approximated because the dnlc
 286          * may have a hold on the vnode.
 287          * Checking for VBAD here will also act as a forced umount check.
 288          */
 289         if (vp->v_count <= 2 && vp->v_type != VBAD) {
 290                 struct inode *ip = VTOI(vp);
 291                 if (ip->i_delaylen) {
 292                         ins.in_poc.value.ul++;
 293                         (void) ufs_putpages(vp, ip->i_delayoff, ip->i_delaylen,
 294                             B_ASYNC | B_FREE, cr);
 295                         ip->i_delaylen = 0;
 296                 }
 297         }
 298 
 299         return (0);
 300 }
 301 
 302 /*ARGSUSED*/
 303 static int
 304 ufs_read(struct vnode *vp, struct uio *uiop, int ioflag, struct cred *cr,
 305         struct caller_context *ct)
 306 {
 307         struct inode *ip = VTOI(vp);
 308         struct ufsvfs *ufsvfsp;
 309         struct ulockfs *ulp = NULL;
 310         int error = 0;
 311         int intrans = 0;
 312 
 313         ASSERT(RW_READ_HELD(&ip->i_rwlock));
 314 
 315         /*
 316          * Mandatory locking needs to be done before ufs_lockfs_begin()
 317          * and TRANS_BEGIN_SYNC() calls since mandatory locks can sleep.
 318          */
 319         if (MANDLOCK(vp, ip->i_mode)) {
 320                 /*
 321                  * ufs_getattr ends up being called by chklock
 322                  */
 323                 error = chklock(vp, FREAD, uiop->uio_loffset,
 324                     uiop->uio_resid, uiop->uio_fmode, ct);
 325                 if (error)
 326                         goto out;
 327         }
 328 
 329         ufsvfsp = ip->i_ufsvfs;
 330         error = ufs_lockfs_begin(ufsvfsp, &ulp, ULOCKFS_READ_MASK);
 331         if (error)
 332                 goto out;
 333 
 334         /*
 335          * In the case that a directory is opened for reading as a file
 336          * (eg "cat .") with the  O_RSYNC, O_SYNC and O_DSYNC flags set.
 337          * The locking order had to be changed to avoid a deadlock with
 338          * an update taking place on that directory at the same time.
 339          */
 340         if ((ip->i_mode & IFMT) == IFDIR) {
 341 
 342                 rw_enter(&ip->i_contents, RW_READER);
 343                 error = rdip(ip, uiop, ioflag, cr);
 344                 rw_exit(&ip->i_contents);
 345 
 346                 if (error) {
 347                         if (ulp)
 348                                 ufs_lockfs_end(ulp);
 349                         goto out;
 350                 }
 351 
 352                 if (ulp && (ioflag & FRSYNC) && (ioflag & (FSYNC | FDSYNC)) &&
 353                     TRANS_ISTRANS(ufsvfsp)) {
 354                         rw_exit(&ip->i_rwlock);
 355                         TRANS_BEGIN_SYNC(ufsvfsp, TOP_READ_SYNC, TOP_READ_SIZE,
 356                             error);
 357                         ASSERT(!error);
 358                         TRANS_END_SYNC(ufsvfsp, error, TOP_READ_SYNC,
 359                             TOP_READ_SIZE);
 360                         rw_enter(&ip->i_rwlock, RW_READER);
 361                 }
 362         } else {
 363                 /*
 364                  * Only transact reads to files opened for sync-read and
 365                  * sync-write on a file system that is not write locked.
 366                  *
 367                  * The ``not write locked'' check prevents problems with
 368                  * enabling/disabling logging on a busy file system.  E.g.,
 369                  * logging exists at the beginning of the read but does not
 370                  * at the end.
 371                  *
 372                  */
 373                 if (ulp && (ioflag & FRSYNC) && (ioflag & (FSYNC | FDSYNC)) &&
 374                     TRANS_ISTRANS(ufsvfsp)) {
 375                         TRANS_BEGIN_SYNC(ufsvfsp, TOP_READ_SYNC, TOP_READ_SIZE,
 376                             error);
 377                         ASSERT(!error);
 378                         intrans = 1;
 379                 }
 380 
 381                 rw_enter(&ip->i_contents, RW_READER);
 382                 error = rdip(ip, uiop, ioflag, cr);
 383                 rw_exit(&ip->i_contents);
 384 
 385                 if (intrans) {
 386                         TRANS_END_SYNC(ufsvfsp, error, TOP_READ_SYNC,
 387                             TOP_READ_SIZE);
 388                 }
 389         }
 390 
 391         if (ulp) {
 392                 ufs_lockfs_end(ulp);
 393         }
 394 out:
 395 
 396         return (error);
 397 }
 398 
 399 extern  int     ufs_HW;         /* high water mark */
 400 extern  int     ufs_LW;         /* low water mark */
 401 int     ufs_WRITES = 1;         /* XXX - enable/disable */
 402 int     ufs_throttles = 0;      /* throttling count */
 403 int     ufs_allow_shared_writes = 1;    /* directio shared writes */
 404 
 405 static int
 406 ufs_check_rewrite(struct inode *ip, struct uio *uiop, int ioflag)
 407 {
 408         int     shared_write;
 409 
 410         /*
 411          * If the FDSYNC flag is set then ignore the global
 412          * ufs_allow_shared_writes in this case.
 413          */
 414         shared_write = (ioflag & FDSYNC) | ufs_allow_shared_writes;
 415 
 416         /*
 417          * Filter to determine if this request is suitable as a
 418          * concurrent rewrite. This write must not allocate blocks
 419          * by extending the file or filling in holes. No use trying
 420          * through FSYNC descriptors as the inode will be synchronously
 421          * updated after the write. The uio structure has not yet been
 422          * checked for sanity, so assume nothing.
 423          */
 424         return (((ip->i_mode & IFMT) == IFREG) && !(ioflag & FAPPEND) &&
 425             (uiop->uio_loffset >= (offset_t)0) &&
 426             (uiop->uio_loffset < ip->i_size) && (uiop->uio_resid > 0) &&
 427             ((ip->i_size - uiop->uio_loffset) >= uiop->uio_resid) &&
 428             !(ioflag & FSYNC) && !bmap_has_holes(ip) &&
 429             shared_write);
 430 }
 431 
 432 /*ARGSUSED*/
 433 static int
 434 ufs_write(struct vnode *vp, struct uio *uiop, int ioflag, cred_t *cr,
 435         caller_context_t *ct)
 436 {
 437         struct inode *ip = VTOI(vp);
 438         struct ufsvfs *ufsvfsp;
 439         struct ulockfs *ulp;
 440         int retry = 1;
 441         int error, resv, resid = 0;
 442         int directio_status;
 443         int exclusive;
 444         int rewriteflg;
 445         long start_resid = uiop->uio_resid;
 446 
 447         ASSERT(RW_LOCK_HELD(&ip->i_rwlock));
 448 
 449 retry_mandlock:
 450         /*
 451          * Mandatory locking needs to be done before ufs_lockfs_begin()
 452          * and TRANS_BEGIN_[A]SYNC() calls since mandatory locks can sleep.
 453          * Check for forced unmounts normally done in ufs_lockfs_begin().
 454          */
 455         if ((ufsvfsp = ip->i_ufsvfs) == NULL) {
 456                 error = EIO;
 457                 goto out;
 458         }
 459         if (MANDLOCK(vp, ip->i_mode)) {
 460 
 461                 ASSERT(RW_WRITE_HELD(&ip->i_rwlock));
 462 
 463                 /*
 464                  * ufs_getattr ends up being called by chklock
 465                  */
 466                 error = chklock(vp, FWRITE, uiop->uio_loffset,
 467                     uiop->uio_resid, uiop->uio_fmode, ct);
 468                 if (error)
 469                         goto out;
 470         }
 471 
 472         /* i_rwlock can change in chklock */
 473         exclusive = rw_write_held(&ip->i_rwlock);
 474         rewriteflg = ufs_check_rewrite(ip, uiop, ioflag);
 475 
 476         /*
 477          * Check for fast-path special case of directio re-writes.
 478          */
 479         if ((ip->i_flag & IDIRECTIO || ufsvfsp->vfs_forcedirectio) &&
 480             !exclusive && rewriteflg) {
 481 
 482                 error = ufs_lockfs_begin(ufsvfsp, &ulp, ULOCKFS_WRITE_MASK);
 483                 if (error)
 484                         goto out;
 485 
 486                 rw_enter(&ip->i_contents, RW_READER);
 487                 error = ufs_directio_write(ip, uiop, ioflag, 1, cr,
 488                     &directio_status);
 489                 if (directio_status == DIRECTIO_SUCCESS) {
 490                         uint_t i_flag_save;
 491 
 492                         if (start_resid != uiop->uio_resid)
 493                                 error = 0;
 494                         /*
 495                          * Special treatment of access times for re-writes.
 496                          * If IMOD is not already set, then convert it
 497                          * to IMODACC for this operation. This defers
 498                          * entering a delta into the log until the inode
 499                          * is flushed. This mimics what is done for read
 500                          * operations and inode access time.
 501                          */
 502                         mutex_enter(&ip->i_tlock);
 503                         i_flag_save = ip->i_flag;
 504                         ip->i_flag |= IUPD | ICHG;
 505                         ip->i_seq++;
 506                         ITIMES_NOLOCK(ip);
 507                         if ((i_flag_save & IMOD) == 0) {
 508                                 ip->i_flag &= ~IMOD;
 509                                 ip->i_flag |= IMODACC;
 510                         }
 511                         mutex_exit(&ip->i_tlock);
 512                         rw_exit(&ip->i_contents);
 513                         if (ulp)
 514                                 ufs_lockfs_end(ulp);
 515                         goto out;
 516                 }
 517                 rw_exit(&ip->i_contents);
 518                 if (ulp)
 519                         ufs_lockfs_end(ulp);
 520         }
 521 
 522         if (!exclusive && !rw_tryupgrade(&ip->i_rwlock)) {
 523                 rw_exit(&ip->i_rwlock);
 524                 rw_enter(&ip->i_rwlock, RW_WRITER);
 525                 /*
 526                  * Mandatory locking could have been enabled
 527                  * after dropping the i_rwlock.
 528                  */
 529                 if (MANDLOCK(vp, ip->i_mode))
 530                         goto retry_mandlock;
 531         }
 532 
 533         error = ufs_lockfs_begin(ufsvfsp, &ulp, ULOCKFS_WRITE_MASK);
 534         if (error)
 535                 goto out;
 536 
 537         /*
 538          * Amount of log space needed for this write
 539          */
 540         if (!rewriteflg || !(ioflag & FDSYNC))
 541                 TRANS_WRITE_RESV(ip, uiop, ulp, &resv, &resid);
 542 
 543         /*
 544          * Throttle writes.
 545          */
 546         if (ufs_WRITES && (ip->i_writes > ufs_HW)) {
 547                 mutex_enter(&ip->i_tlock);
 548                 while (ip->i_writes > ufs_HW) {
 549                         ufs_throttles++;
 550                         cv_wait(&ip->i_wrcv, &ip->i_tlock);
 551                 }
 552                 mutex_exit(&ip->i_tlock);
 553         }
 554 
 555         /*
 556          * Enter Transaction
 557          *
 558          * If the write is a rewrite there is no need to open a transaction
 559          * if the FDSYNC flag is set and not the FSYNC.  In this case just
 560          * set the IMODACC flag to modify do the update at a later time
 561          * thus avoiding the overhead of the logging transaction that is
 562          * not required.
 563          */
 564         if (ioflag & (FSYNC|FDSYNC)) {
 565                 if (ulp) {
 566                         if (rewriteflg) {
 567                                 uint_t i_flag_save;
 568 
 569                                 rw_enter(&ip->i_contents, RW_READER);
 570                                 mutex_enter(&ip->i_tlock);
 571                                 i_flag_save = ip->i_flag;
 572                                 ip->i_flag |= IUPD | ICHG;
 573                                 ip->i_seq++;
 574                                 ITIMES_NOLOCK(ip);
 575                                 if ((i_flag_save & IMOD) == 0) {
 576                                         ip->i_flag &= ~IMOD;
 577                                         ip->i_flag |= IMODACC;
 578                                 }
 579                                 mutex_exit(&ip->i_tlock);
 580                                 rw_exit(&ip->i_contents);
 581                         } else {
 582                                 int terr = 0;
 583                                 TRANS_BEGIN_SYNC(ufsvfsp, TOP_WRITE_SYNC, resv,
 584                                     terr);
 585                                 ASSERT(!terr);
 586                         }
 587                 }
 588         } else {
 589                 if (ulp)
 590                         TRANS_BEGIN_ASYNC(ufsvfsp, TOP_WRITE, resv);
 591         }
 592 
 593         /*
 594          * Write the file
 595          */
 596         rw_enter(&ufsvfsp->vfs_dqrwlock, RW_READER);
 597         rw_enter(&ip->i_contents, RW_WRITER);
 598         if ((ioflag & FAPPEND) != 0 && (ip->i_mode & IFMT) == IFREG) {
 599                 /*
 600                  * In append mode start at end of file.
 601                  */
 602                 uiop->uio_loffset = ip->i_size;
 603         }
 604 
 605         /*
 606          * Mild optimisation, don't call ufs_trans_write() unless we have to
 607          * Also, suppress file system full messages if we will retry.
 608          */
 609         if (retry)
 610                 ip->i_flag |= IQUIET;
 611         if (resid) {
 612                 TRANS_WRITE(ip, uiop, ioflag, error, ulp, cr, resv, resid);
 613         } else {
 614                 error = wrip(ip, uiop, ioflag, cr);
 615         }
 616         ip->i_flag &= ~IQUIET;
 617 
 618         rw_exit(&ip->i_contents);
 619         rw_exit(&ufsvfsp->vfs_dqrwlock);
 620 
 621         /*
 622          * Leave Transaction
 623          */
 624         if (ulp) {
 625                 if (ioflag & (FSYNC|FDSYNC)) {
 626                         if (!rewriteflg) {
 627                                 int terr = 0;
 628 
 629                                 TRANS_END_SYNC(ufsvfsp, terr, TOP_WRITE_SYNC,
 630                                     resv);
 631                                 if (error == 0)
 632                                         error = terr;
 633                         }
 634                 } else {
 635                         TRANS_END_ASYNC(ufsvfsp, TOP_WRITE, resv);
 636                 }
 637                 ufs_lockfs_end(ulp);
 638         }
 639 out:
 640         if ((error == ENOSPC) && retry && TRANS_ISTRANS(ufsvfsp)) {
 641                 /*
 642                  * Any blocks tied up in pending deletes?
 643                  */
 644                 ufs_delete_drain_wait(ufsvfsp, 1);
 645                 retry = 0;
 646                 goto retry_mandlock;
 647         }
 648 
 649         if (error == ENOSPC && (start_resid != uiop->uio_resid))
 650                 error = 0;
 651 
 652         return (error);
 653 }
 654 
 655 /*
 656  * Don't cache write blocks to files with the sticky bit set.
 657  * Used to keep swap files from blowing the page cache on a server.
 658  */
 659 int stickyhack = 1;
 660 
 661 /*
 662  * Free behind hacks.  The pager is busted.
 663  * XXX - need to pass the information down to writedone() in a flag like B_SEQ
 664  * or B_FREE_IF_TIGHT_ON_MEMORY.
 665  */
 666 int     freebehind = 1;
 667 int     smallfile = 0;
 668 u_offset_t smallfile64 = 32 * 1024;
 669 
 670 /*
 671  * While we should, in most cases, cache the pages for write, we
 672  * may also want to cache the pages for read as long as they are
 673  * frequently re-usable.
 674  *
 675  * If cache_read_ahead = 1, the pages for read will go to the tail
 676  * of the cache list when they are released, otherwise go to the head.
 677  */
 678 int     cache_read_ahead = 0;
 679 
 680 /*
 681  * Freebehind exists  so that as we read  large files  sequentially we
 682  * don't consume most of memory with pages  from a few files. It takes
 683  * longer to re-read from disk multiple small files as it does reading
 684  * one large one sequentially.  As system  memory grows customers need
 685  * to retain bigger chunks   of files in  memory.   The advent of  the
 686  * cachelist opens up of the possibility freeing pages  to the head or
 687  * tail of the list.
 688  *
 689  * Not freeing a page is a bet that the page will be read again before
 690  * it's segmap slot is needed for something else. If we loose the bet,
 691  * it means some  other thread is  burdened with the  page free we did
 692  * not do. If we win we save a free and reclaim.
 693  *
 694  * Freeing it at the tail  vs the head of cachelist  is a bet that the
 695  * page will survive until the next  read.  It's also saying that this
 696  * page is more likely to  be re-used than a  page freed some time ago
 697  * and never reclaimed.
 698  *
 699  * Freebehind maintains a  range of  file offset [smallfile1; smallfile2]
 700  *
 701  *            0 < offset < smallfile1 : pages are not freed.
 702  *   smallfile1 < offset < smallfile2 : pages freed to tail of cachelist.
 703  *   smallfile2 < offset              : pages freed to head of cachelist.
 704  *
 705  * The range  is  computed  at most  once  per second  and  depends on
 706  * freemem  and  ncpus_online.  Both parameters  are   bounded to be
 707  * >= smallfile && >= smallfile64.
 708  *
 709  * smallfile1 = (free memory / ncpu) / 1000
 710  * smallfile2 = (free memory / ncpu) / 10
 711  *
 712  * A few examples values:
 713  *
 714  *       Free Mem (in Bytes) [smallfile1; smallfile2]  [smallfile1; smallfile2]
 715  *                                 ncpus_online = 4          ncpus_online = 64
 716  *       ------------------  -----------------------   -----------------------
 717  *             1G                   [256K;  25M]               [32K; 1.5M]
 718  *            10G                   [2.5M; 250M]              [156K; 15M]
 719  *           100G                    [25M; 2.5G]              [1.5M; 150M]
 720  *
 721  */
 722 
 723 #define SMALLFILE1_D 1000
 724 #define SMALLFILE2_D 10
 725 static u_offset_t smallfile1 = 32 * 1024;
 726 static u_offset_t smallfile2 = 32 * 1024;
 727 static clock_t smallfile_update = 0; /* lbolt value of when to recompute */
 728 uint_t smallfile1_d = SMALLFILE1_D;
 729 uint_t smallfile2_d = SMALLFILE2_D;
 730 
 731 /*
 732  * wrip does the real work of write requests for ufs.
 733  */
 734 int
 735 wrip(struct inode *ip, struct uio *uio, int ioflag, struct cred *cr)
 736 {
 737         rlim64_t limit = uio->uio_llimit;
 738         u_offset_t off;
 739         u_offset_t old_i_size;
 740         struct fs *fs;
 741         struct vnode *vp;
 742         struct ufsvfs *ufsvfsp;
 743         caddr_t base;
 744         long start_resid = uio->uio_resid;   /* save starting resid */
 745         long premove_resid;                     /* resid before uiomove() */
 746         uint_t flags;
 747         int newpage;
 748         int iupdat_flag, directio_status;
 749         int n, on, mapon;
 750         int error, pagecreate;
 751         int do_dqrwlock;                /* drop/reacquire vfs_dqrwlock */
 752         int32_t iblocks;
 753         int     new_iblocks;
 754 
 755         /*
 756          * ip->i_size is incremented before the uiomove
 757          * is done on a write.  If the move fails (bad user
 758          * address) reset ip->i_size.
 759          * The better way would be to increment ip->i_size
 760          * only if the uiomove succeeds.
 761          */
 762         int i_size_changed = 0;
 763         o_mode_t type;
 764         int i_seq_needed = 0;
 765 
 766         vp = ITOV(ip);
 767 
 768         /*
 769          * check for forced unmount - should not happen as
 770          * the request passed the lockfs checks.
 771          */
 772         if ((ufsvfsp = ip->i_ufsvfs) == NULL)
 773                 return (EIO);
 774 
 775         fs = ip->i_fs;
 776 
 777         ASSERT(RW_WRITE_HELD(&ip->i_contents));
 778 
 779         /* check for valid filetype */
 780         type = ip->i_mode & IFMT;
 781         if ((type != IFREG) && (type != IFDIR) && (type != IFATTRDIR) &&
 782             (type != IFLNK) && (type != IFSHAD)) {
 783                 return (EIO);
 784         }
 785 
 786         /*
 787          * the actual limit of UFS file size
 788          * is UFS_MAXOFFSET_T
 789          */
 790         if (limit == RLIM64_INFINITY || limit > MAXOFFSET_T)
 791                 limit = MAXOFFSET_T;
 792 
 793         if (uio->uio_loffset >= limit) {
 794                 proc_t *p = ttoproc(curthread);
 795 
 796                 mutex_enter(&p->p_lock);
 797                 (void) rctl_action(rctlproc_legacy[RLIMIT_FSIZE], p->p_rctls,
 798                     p, RCA_UNSAFE_SIGINFO);
 799                 mutex_exit(&p->p_lock);
 800                 return (EFBIG);
 801         }
 802 
 803         /*
 804          * if largefiles are disallowed, the limit is
 805          * the pre-largefiles value of 2GB
 806          */
 807         if (ufsvfsp->vfs_lfflags & UFS_LARGEFILES)
 808                 limit = MIN(UFS_MAXOFFSET_T, limit);
 809         else
 810                 limit = MIN(MAXOFF32_T, limit);
 811 
 812         if (uio->uio_loffset < (offset_t)0) {
 813                 return (EINVAL);
 814         }
 815         if (uio->uio_resid == 0) {
 816                 return (0);
 817         }
 818 
 819         if (uio->uio_loffset >= limit)
 820                 return (EFBIG);
 821 
 822         ip->i_flag |= INOACC;        /* don't update ref time in getpage */
 823 
 824         if (ioflag & (FSYNC|FDSYNC)) {
 825                 ip->i_flag |= ISYNC;
 826                 iupdat_flag = 1;
 827         }
 828         /*
 829          * Try to go direct
 830          */
 831         if (ip->i_flag & IDIRECTIO || ufsvfsp->vfs_forcedirectio) {
 832                 uio->uio_llimit = limit;
 833                 error = ufs_directio_write(ip, uio, ioflag, 0, cr,
 834                     &directio_status);
 835                 /*
 836                  * If ufs_directio wrote to the file or set the flags,
 837                  * we need to update i_seq, but it may be deferred.
 838                  */
 839                 if (start_resid != uio->uio_resid ||
 840                     (ip->i_flag & (ICHG|IUPD))) {
 841                         i_seq_needed = 1;
 842                         ip->i_flag |= ISEQ;
 843                 }
 844                 if (directio_status == DIRECTIO_SUCCESS)
 845                         goto out;
 846         }
 847 
 848         /*
 849          * Behavior with respect to dropping/reacquiring vfs_dqrwlock:
 850          *
 851          * o shadow inodes: vfs_dqrwlock is not held at all
 852          * o quota updates: vfs_dqrwlock is read or write held
 853          * o other updates: vfs_dqrwlock is read held
 854          *
 855          * The first case is the only one where we do not hold
 856          * vfs_dqrwlock at all while entering wrip().
 857          * We must make sure not to downgrade/drop vfs_dqrwlock if we
 858          * have it as writer, i.e. if we are updating the quota inode.
 859          * There is no potential deadlock scenario in this case as
 860          * ufs_getpage() takes care of this and avoids reacquiring
 861          * vfs_dqrwlock in that case.
 862          *
 863          * This check is done here since the above conditions do not change
 864          * and we possibly loop below, so save a few cycles.
 865          */
 866         if ((type == IFSHAD) ||
 867             (rw_owner(&ufsvfsp->vfs_dqrwlock) == curthread)) {
 868                 do_dqrwlock = 0;
 869         } else {
 870                 do_dqrwlock = 1;
 871         }
 872 
 873         /*
 874          * Large Files: We cast MAXBMASK to offset_t
 875          * inorder to mask out the higher bits. Since offset_t
 876          * is a signed value, the high order bit set in MAXBMASK
 877          * value makes it do the right thing by having all bits 1
 878          * in the higher word. May be removed for _SOLARIS64_.
 879          */
 880 
 881         fs = ip->i_fs;
 882         do {
 883                 u_offset_t uoff = uio->uio_loffset;
 884                 off = uoff & (offset_t)MAXBMASK;
 885                 mapon = (int)(uoff & (offset_t)MAXBOFFSET);
 886                 on = (int)blkoff(fs, uoff);
 887                 n = (int)MIN(fs->fs_bsize - on, uio->uio_resid);
 888                 new_iblocks = 1;
 889 
 890                 if (type == IFREG && uoff + n >= limit) {
 891                         if (uoff >= limit) {
 892                                 error = EFBIG;
 893                                 goto out;
 894                         }
 895                         /*
 896                          * since uoff + n >= limit,
 897                          * therefore n >= limit - uoff, and n is an int
 898                          * so it is safe to cast it to an int
 899                          */
 900                         n = (int)(limit - (rlim64_t)uoff);
 901                 }
 902                 if (uoff + n > ip->i_size) {
 903                         /*
 904                          * We are extending the length of the file.
 905                          * bmap is used so that we are sure that
 906                          * if we need to allocate new blocks, that it
 907                          * is done here before we up the file size.
 908                          */
 909                         error = bmap_write(ip, uoff, (int)(on + n),
 910                             mapon == 0, NULL, cr);
 911                         /*
 912                          * bmap_write never drops i_contents so if
 913                          * the flags are set it changed the file.
 914                          */
 915                         if (ip->i_flag & (ICHG|IUPD)) {
 916                                 i_seq_needed = 1;
 917                                 ip->i_flag |= ISEQ;
 918                         }
 919                         if (error)
 920                                 break;
 921                         /*
 922                          * There is a window of vulnerability here.
 923                          * The sequence of operations: allocate file
 924                          * system blocks, uiomove the data into pages,
 925                          * and then update the size of the file in the
 926                          * inode, must happen atomically.  However, due
 927                          * to current locking constraints, this can not
 928                          * be done.
 929                          */
 930                         ASSERT(ip->i_writer == NULL);
 931                         ip->i_writer = curthread;
 932                         i_size_changed = 1;
 933                         /*
 934                          * If we are writing from the beginning of
 935                          * the mapping, we can just create the
 936                          * pages without having to read them.
 937                          */
 938                         pagecreate = (mapon == 0);
 939                 } else if (n == MAXBSIZE) {
 940                         /*
 941                          * Going to do a whole mappings worth,
 942                          * so we can just create the pages w/o
 943                          * having to read them in.  But before
 944                          * we do that, we need to make sure any
 945                          * needed blocks are allocated first.
 946                          */
 947                         iblocks = ip->i_blocks;
 948                         error = bmap_write(ip, uoff, (int)(on + n),
 949                             BI_ALLOC_ONLY, NULL, cr);
 950                         /*
 951                          * bmap_write never drops i_contents so if
 952                          * the flags are set it changed the file.
 953                          */
 954                         if (ip->i_flag & (ICHG|IUPD)) {
 955                                 i_seq_needed = 1;
 956                                 ip->i_flag |= ISEQ;
 957                         }
 958                         if (error)
 959                                 break;
 960                         pagecreate = 1;
 961                         /*
 962                          * check if the new created page needed the
 963                          * allocation of new disk blocks.
 964                          */
 965                         if (iblocks == ip->i_blocks)
 966                                 new_iblocks = 0; /* no new blocks allocated */
 967                 } else {
 968                         pagecreate = 0;
 969                         /*
 970                          * In sync mode flush the indirect blocks which
 971                          * may have been allocated and not written on
 972                          * disk. In above cases bmap_write will allocate
 973                          * in sync mode.
 974                          */
 975                         if (ioflag & (FSYNC|FDSYNC)) {
 976                                 error = ufs_indirblk_sync(ip, uoff);
 977                                 if (error)
 978                                         break;
 979                         }
 980                 }
 981 
 982                 /*
 983                  * At this point we can enter ufs_getpage() in one
 984                  * of two ways:
 985                  * 1) segmap_getmapflt() calls ufs_getpage() when the
 986                  *    forcefault parameter is true (pagecreate == 0)
 987                  * 2) uiomove() causes a page fault.
 988                  *
 989                  * We have to drop the contents lock to prevent the VM
 990                  * system from trying to reacquire it in ufs_getpage()
 991                  * should the uiomove cause a pagefault.
 992                  *
 993                  * We have to drop the reader vfs_dqrwlock here as well.
 994                  */
 995                 rw_exit(&ip->i_contents);
 996                 if (do_dqrwlock) {
 997                         ASSERT(RW_LOCK_HELD(&ufsvfsp->vfs_dqrwlock));
 998                         ASSERT(!(RW_WRITE_HELD(&ufsvfsp->vfs_dqrwlock)));
 999                         rw_exit(&ufsvfsp->vfs_dqrwlock);
1000                 }
1001 
1002                 newpage = 0;
1003                 premove_resid = uio->uio_resid;
1004 
1005                 /*
1006                  * Touch the page and fault it in if it is not in core
1007                  * before segmap_getmapflt or vpm_data_copy can lock it.
1008                  * This is to avoid the deadlock if the buffer is mapped
1009                  * to the same file through mmap which we want to write.
1010                  */
1011                 uio_prefaultpages((long)n, uio);
1012 
1013                 if (vpm_enable) {
1014                         /*
1015                          * Copy data. If new pages are created, part of
1016                          * the page that is not written will be initizliazed
1017                          * with zeros.
1018                          */
1019                         error = vpm_data_copy(vp, (off + mapon), (uint_t)n,
1020                             uio, !pagecreate, &newpage, 0, S_WRITE);
1021                 } else {
1022 
1023                         base = segmap_getmapflt(segkmap, vp, (off + mapon),
1024                             (uint_t)n, !pagecreate, S_WRITE);
1025 
1026                         /*
1027                          * segmap_pagecreate() returns 1 if it calls
1028                          * page_create_va() to allocate any pages.
1029                          */
1030 
1031                         if (pagecreate)
1032                                 newpage = segmap_pagecreate(segkmap, base,
1033                                     (size_t)n, 0);
1034 
1035                         error = uiomove(base + mapon, (long)n, UIO_WRITE, uio);
1036                 }
1037 
1038                 /*
1039                  * If "newpage" is set, then a new page was created and it
1040                  * does not contain valid data, so it needs to be initialized
1041                  * at this point.
1042                  * Otherwise the page contains old data, which was overwritten
1043                  * partially or as a whole in uiomove.
1044                  * If there is only one iovec structure within uio, then
1045                  * on error uiomove will not be able to update uio->uio_loffset
1046                  * and we would zero the whole page here!
1047                  *
1048                  * If uiomove fails because of an error, the old valid data
1049                  * is kept instead of filling the rest of the page with zero's.
1050                  */
1051                 if (!vpm_enable && newpage &&
1052                     uio->uio_loffset < roundup(off + mapon + n, PAGESIZE)) {
1053                         /*
1054                          * We created pages w/o initializing them completely,
1055                          * thus we need to zero the part that wasn't set up.
1056                          * This happens on most EOF write cases and if
1057                          * we had some sort of error during the uiomove.
1058                          */
1059                         int nzero, nmoved;
1060 
1061                         nmoved = (int)(uio->uio_loffset - (off + mapon));
1062                         ASSERT(nmoved >= 0 && nmoved <= n);
1063                         nzero = roundup(on + n, PAGESIZE) - nmoved;
1064                         ASSERT(nzero > 0 && mapon + nmoved + nzero <= MAXBSIZE);
1065                         (void) kzero(base + mapon + nmoved, (uint_t)nzero);
1066                 }
1067 
1068                 /*
1069                  * Unlock the pages allocated by page_create_va()
1070                  * in segmap_pagecreate()
1071                  */
1072                 if (!vpm_enable && newpage)
1073                         segmap_pageunlock(segkmap, base, (size_t)n, S_WRITE);
1074 
1075                 /*
1076                  * If the size of the file changed, then update the
1077                  * size field in the inode now.  This can't be done
1078                  * before the call to segmap_pageunlock or there is
1079                  * a potential deadlock with callers to ufs_putpage().
1080                  * They will be holding i_contents and trying to lock
1081                  * a page, while this thread is holding a page locked
1082                  * and trying to acquire i_contents.
1083                  */
1084                 if (i_size_changed) {
1085                         rw_enter(&ip->i_contents, RW_WRITER);
1086                         old_i_size = ip->i_size;
1087                         UFS_SET_ISIZE(uoff + n, ip);
1088                         TRANS_INODE(ufsvfsp, ip);
1089                         /*
1090                          * file has grown larger than 2GB. Set flag
1091                          * in superblock to indicate this, if it
1092                          * is not already set.
1093                          */
1094                         if ((ip->i_size > MAXOFF32_T) &&
1095                             !(fs->fs_flags & FSLARGEFILES)) {
1096                                 ASSERT(ufsvfsp->vfs_lfflags & UFS_LARGEFILES);
1097                                 mutex_enter(&ufsvfsp->vfs_lock);
1098                                 fs->fs_flags |= FSLARGEFILES;
1099                                 ufs_sbwrite(ufsvfsp);
1100                                 mutex_exit(&ufsvfsp->vfs_lock);
1101                         }
1102                         mutex_enter(&ip->i_tlock);
1103                         ip->i_writer = NULL;
1104                         cv_broadcast(&ip->i_wrcv);
1105                         mutex_exit(&ip->i_tlock);
1106                         rw_exit(&ip->i_contents);
1107                 }
1108 
1109                 if (error) {
1110                         /*
1111                          * If we failed on a write, we may have already
1112                          * allocated file blocks as well as pages.  It's
1113                          * hard to undo the block allocation, but we must
1114                          * be sure to invalidate any pages that may have
1115                          * been allocated.
1116                          *
1117                          * If the page was created without initialization
1118                          * then we must check if it should be possible
1119                          * to destroy the new page and to keep the old data
1120                          * on the disk.
1121                          *
1122                          * It is possible to destroy the page without
1123                          * having to write back its contents only when
1124                          * - the size of the file keeps unchanged
1125                          * - bmap_write() did not allocate new disk blocks
1126                          *   it is possible to create big files using "seek" and
1127                          *   write to the end of the file. A "write" to a
1128                          *   position before the end of the file would not
1129                          *   change the size of the file but it would allocate
1130                          *   new disk blocks.
1131                          * - uiomove intended to overwrite the whole page.
1132                          * - a new page was created (newpage == 1).
1133                          */
1134 
1135                         if (i_size_changed == 0 && new_iblocks == 0 &&
1136                             newpage) {
1137 
1138                                 /* unwind what uiomove eventually last did */
1139                                 uio->uio_resid = premove_resid;
1140 
1141                                 /*
1142                                  * destroy the page, do not write ambiguous
1143                                  * data to the disk.
1144                                  */
1145                                 flags = SM_DESTROY;
1146                         } else {
1147                                 /*
1148                                  * write the page back to the disk, if dirty,
1149                                  * and remove the page from the cache.
1150                                  */
1151                                 flags = SM_INVAL;
1152                         }
1153 
1154                         if (vpm_enable) {
1155                                 /*
1156                                  *  Flush pages.
1157                                  */
1158                                 (void) vpm_sync_pages(vp, off, n, flags);
1159                         } else {
1160                                 (void) segmap_release(segkmap, base, flags);
1161                         }
1162                 } else {
1163                         flags = 0;
1164                         /*
1165                          * Force write back for synchronous write cases.
1166                          */
1167                         if ((ioflag & (FSYNC|FDSYNC)) || type == IFDIR) {
1168                                 /*
1169                                  * If the sticky bit is set but the
1170                                  * execute bit is not set, we do a
1171                                  * synchronous write back and free
1172                                  * the page when done.  We set up swap
1173                                  * files to be handled this way to
1174                                  * prevent servers from keeping around
1175                                  * the client's swap pages too long.
1176                                  * XXX - there ought to be a better way.
1177                                  */
1178                                 if (IS_SWAPVP(vp)) {
1179                                         flags = SM_WRITE | SM_FREE |
1180                                             SM_DONTNEED;
1181                                         iupdat_flag = 0;
1182                                 } else {
1183                                         flags = SM_WRITE;
1184                                 }
1185                         } else if (n + on == MAXBSIZE || IS_SWAPVP(vp)) {
1186                                 /*
1187                                  * Have written a whole block.
1188                                  * Start an asynchronous write and
1189                                  * mark the buffer to indicate that
1190                                  * it won't be needed again soon.
1191                                  */
1192                                 flags = SM_WRITE | SM_ASYNC | SM_DONTNEED;
1193                         }
1194                         if (vpm_enable) {
1195                                 /*
1196                                  * Flush pages.
1197                                  */
1198                                 error = vpm_sync_pages(vp, off, n, flags);
1199                         } else {
1200                                 error = segmap_release(segkmap, base, flags);
1201                         }
1202                         /*
1203                          * If the operation failed and is synchronous,
1204                          * then we need to unwind what uiomove() last
1205                          * did so we can potentially return an error to
1206                          * the caller.  If this write operation was
1207                          * done in two pieces and the first succeeded,
1208                          * then we won't return an error for the second
1209                          * piece that failed.  However, we only want to
1210                          * return a resid value that reflects what was
1211                          * really done.
1212                          *
1213                          * Failures for non-synchronous operations can
1214                          * be ignored since the page subsystem will
1215                          * retry the operation until it succeeds or the
1216                          * file system is unmounted.
1217                          */
1218                         if (error) {
1219                                 if ((ioflag & (FSYNC | FDSYNC)) ||
1220                                     type == IFDIR) {
1221                                         uio->uio_resid = premove_resid;
1222                                 } else {
1223                                         error = 0;
1224                                 }
1225                         }
1226                 }
1227 
1228                 /*
1229                  * Re-acquire contents lock.
1230                  * If it was dropped, reacquire reader vfs_dqrwlock as well.
1231                  */
1232                 if (do_dqrwlock)
1233                         rw_enter(&ufsvfsp->vfs_dqrwlock, RW_READER);
1234                 rw_enter(&ip->i_contents, RW_WRITER);
1235 
1236                 /*
1237                  * If the uiomove() failed or if a synchronous
1238                  * page push failed, fix up i_size.
1239                  */
1240                 if (error) {
1241                         if (i_size_changed) {
1242                                 /*
1243                                  * The uiomove failed, and we
1244                                  * allocated blocks,so get rid
1245                                  * of them.
1246                                  */
1247                                 (void) ufs_itrunc(ip, old_i_size, 0, cr);
1248                         }
1249                 } else {
1250                         /*
1251                          * XXX - Can this be out of the loop?
1252                          */
1253                         ip->i_flag |= IUPD | ICHG;
1254                         /*
1255                          * Only do one increase of i_seq for multiple
1256                          * pieces.  Because we drop locks, record
1257                          * the fact that we changed the timestamp and
1258                          * are deferring the increase in case another thread
1259                          * pushes our timestamp update.
1260                          */
1261                         i_seq_needed = 1;
1262                         ip->i_flag |= ISEQ;
1263                         if (i_size_changed)
1264                                 ip->i_flag |= IATTCHG;
1265                         if ((ip->i_mode & (IEXEC | (IEXEC >> 3) |
1266                             (IEXEC >> 6))) != 0 &&
1267                             (ip->i_mode & (ISUID | ISGID)) != 0 &&
1268                             secpolicy_vnode_setid_retain(cr,
1269                             (ip->i_mode & ISUID) != 0 && ip->i_uid == 0) != 0) {
1270                                 /*
1271                                  * Clear Set-UID & Set-GID bits on
1272                                  * successful write if not privileged
1273                                  * and at least one of the execute bits
1274                                  * is set.  If we always clear Set-GID,
1275                                  * mandatory file and record locking is
1276                                  * unuseable.
1277                                  */
1278                                 ip->i_mode &= ~(ISUID | ISGID);
1279                         }
1280                 }
1281                 /*
1282                  * In the case the FDSYNC flag is set and this is a
1283                  * "rewrite" we won't log a delta.
1284                  * The FSYNC flag overrides all cases.
1285                  */
1286                 if (!ufs_check_rewrite(ip, uio, ioflag) || !(ioflag & FDSYNC)) {
1287                         TRANS_INODE(ufsvfsp, ip);
1288                 }
1289         } while (error == 0 && uio->uio_resid > 0 && n != 0);
1290 
1291 out:
1292         /*
1293          * Make sure i_seq is increased at least once per write
1294          */
1295         if (i_seq_needed) {
1296                 ip->i_seq++;
1297                 ip->i_flag &= ~ISEQ;     /* no longer deferred */
1298         }
1299 
1300         /*
1301          * Inode is updated according to this table -
1302          *
1303          *   FSYNC        FDSYNC(posix.4)
1304          *   --------------------------
1305          *   always@      IATTCHG|IBDWRITE
1306          *
1307          * @ -  If we are doing synchronous write the only time we should
1308          *      not be sync'ing the ip here is if we have the stickyhack
1309          *      activated, the file is marked with the sticky bit and
1310          *      no exec bit, the file length has not been changed and
1311          *      no new blocks have been allocated during this write.
1312          */
1313 
1314         if ((ip->i_flag & ISYNC) != 0) {
1315                 /*
1316                  * we have eliminated nosync
1317                  */
1318                 if ((ip->i_flag & (IATTCHG|IBDWRITE)) ||
1319                     ((ioflag & FSYNC) && iupdat_flag)) {
1320                         ufs_iupdat(ip, 1);
1321                 }
1322         }
1323 
1324         /*
1325          * If we've already done a partial-write, terminate
1326          * the write but return no error unless the error is ENOSPC
1327          * because the caller can detect this and free resources and
1328          * try again.
1329          */
1330         if ((start_resid != uio->uio_resid) && (error != ENOSPC))
1331                 error = 0;
1332 
1333         ip->i_flag &= ~(INOACC | ISYNC);
1334         ITIMES_NOLOCK(ip);
1335         return (error);
1336 }
1337 
1338 /*
1339  * rdip does the real work of read requests for ufs.
1340  */
1341 int
1342 rdip(struct inode *ip, struct uio *uio, int ioflag, cred_t *cr)
1343 {
1344         u_offset_t off;
1345         caddr_t base;
1346         struct fs *fs;
1347         struct ufsvfs *ufsvfsp;
1348         struct vnode *vp;
1349         long oresid = uio->uio_resid;
1350         u_offset_t n, on, mapon;
1351         int error = 0;
1352         int doupdate = 1;
1353         uint_t flags;
1354         int dofree, directio_status;
1355         krw_t rwtype;
1356         o_mode_t type;
1357         clock_t now;
1358 
1359         vp = ITOV(ip);
1360 
1361         ASSERT(RW_LOCK_HELD(&ip->i_contents));
1362 
1363         ufsvfsp = ip->i_ufsvfs;
1364 
1365         if (ufsvfsp == NULL)
1366                 return (EIO);
1367 
1368         fs = ufsvfsp->vfs_fs;
1369 
1370         /* check for valid filetype */
1371         type = ip->i_mode & IFMT;
1372         if ((type != IFREG) && (type != IFDIR) && (type != IFATTRDIR) &&
1373             (type != IFLNK) && (type != IFSHAD)) {
1374                 return (EIO);
1375         }
1376 
1377         if (uio->uio_loffset > UFS_MAXOFFSET_T) {
1378                 error = 0;
1379                 goto out;
1380         }
1381         if (uio->uio_loffset < (offset_t)0) {
1382                 return (EINVAL);
1383         }
1384         if (uio->uio_resid == 0) {
1385                 return (0);
1386         }
1387 
1388         if (!ULOCKFS_IS_NOIACC(ITOUL(ip)) && (fs->fs_ronly == 0) &&
1389             (!ufsvfsp->vfs_noatime)) {
1390                 mutex_enter(&ip->i_tlock);
1391                 ip->i_flag |= IACC;
1392                 mutex_exit(&ip->i_tlock);
1393         }
1394         /*
1395          * Try to go direct
1396          */
1397         if (ip->i_flag & IDIRECTIO || ufsvfsp->vfs_forcedirectio) {
1398                 error = ufs_directio_read(ip, uio, cr, &directio_status);
1399                 if (directio_status == DIRECTIO_SUCCESS)
1400                         goto out;
1401         }
1402 
1403         rwtype = (rw_write_held(&ip->i_contents)?RW_WRITER:RW_READER);
1404 
1405         do {
1406                 offset_t diff;
1407                 u_offset_t uoff = uio->uio_loffset;
1408                 off = uoff & (offset_t)MAXBMASK;
1409                 mapon = (u_offset_t)(uoff & (offset_t)MAXBOFFSET);
1410                 on = (u_offset_t)blkoff(fs, uoff);
1411                 n = MIN((u_offset_t)fs->fs_bsize - on,
1412                     (u_offset_t)uio->uio_resid);
1413 
1414                 diff = ip->i_size - uoff;
1415 
1416                 if (diff <= (offset_t)0) {
1417                         error = 0;
1418                         goto out;
1419                 }
1420                 if (diff < (offset_t)n)
1421                         n = (int)diff;
1422 
1423                 /*
1424                  * We update smallfile2 and smallfile1 at most every second.
1425                  */
1426                 now = ddi_get_lbolt();
1427                 if (now >= smallfile_update) {
1428                         uint64_t percpufreeb;
1429                         if (smallfile1_d == 0) smallfile1_d = SMALLFILE1_D;
1430                         if (smallfile2_d == 0) smallfile2_d = SMALLFILE2_D;
1431                         percpufreeb = ptob((uint64_t)freemem) / ncpus_online;
1432                         smallfile1 = percpufreeb / smallfile1_d;
1433                         smallfile2 = percpufreeb / smallfile2_d;
1434                         smallfile1 = MAX(smallfile1, smallfile);
1435                         smallfile1 = MAX(smallfile1, smallfile64);
1436                         smallfile2 = MAX(smallfile1, smallfile2);
1437                         smallfile_update = now + hz;
1438                 }
1439 
1440                 dofree = freebehind &&
1441                     ip->i_nextr == (off & PAGEMASK) && off > smallfile1;
1442 
1443                 /*
1444                  * At this point we can enter ufs_getpage() in one of two
1445                  * ways:
1446                  * 1) segmap_getmapflt() calls ufs_getpage() when the
1447                  *    forcefault parameter is true (value of 1 is passed)
1448                  * 2) uiomove() causes a page fault.
1449                  *
1450                  * We cannot hold onto an i_contents reader lock without
1451                  * risking deadlock in ufs_getpage() so drop a reader lock.
1452                  * The ufs_getpage() dolock logic already allows for a
1453                  * thread holding i_contents as writer to work properly
1454                  * so we keep a writer lock.
1455                  */
1456                 if (rwtype == RW_READER)
1457                         rw_exit(&ip->i_contents);
1458 
1459                 if (vpm_enable) {
1460                         /*
1461                          * Copy data.
1462                          */
1463                         error = vpm_data_copy(vp, (off + mapon), (uint_t)n,
1464                             uio, 1, NULL, 0, S_READ);
1465                 } else {
1466                         base = segmap_getmapflt(segkmap, vp, (off + mapon),
1467                             (uint_t)n, 1, S_READ);
1468                         error = uiomove(base + mapon, (long)n, UIO_READ, uio);
1469                 }
1470 
1471                 flags = 0;
1472                 if (!error) {
1473                         /*
1474                          * If  reading sequential  we won't need  this
1475                          * buffer again  soon.  For  offsets in  range
1476                          * [smallfile1,  smallfile2] release the pages
1477                          * at   the  tail  of the   cache list, larger
1478                          * offsets are released at the head.
1479                          */
1480                         if (dofree) {
1481                                 flags = SM_FREE | SM_ASYNC;
1482                                 if ((cache_read_ahead == 0) &&
1483                                     (off > smallfile2))
1484                                         flags |=  SM_DONTNEED;
1485                         }
1486                         /*
1487                          * In POSIX SYNC (FSYNC and FDSYNC) read mode,
1488                          * we want to make sure that the page which has
1489                          * been read, is written on disk if it is dirty.
1490                          * And corresponding indirect blocks should also
1491                          * be flushed out.
1492                          */
1493                         if ((ioflag & FRSYNC) && (ioflag & (FSYNC|FDSYNC))) {
1494                                 flags &= ~SM_ASYNC;
1495                                 flags |= SM_WRITE;
1496                         }
1497                         if (vpm_enable) {
1498                                 error = vpm_sync_pages(vp, off, n, flags);
1499                         } else {
1500                                 error = segmap_release(segkmap, base, flags);
1501                         }
1502                 } else {
1503                         if (vpm_enable) {
1504                                 (void) vpm_sync_pages(vp, off, n, flags);
1505                         } else {
1506                                 (void) segmap_release(segkmap, base, flags);
1507                         }
1508                 }
1509 
1510                 if (rwtype == RW_READER)
1511                         rw_enter(&ip->i_contents, rwtype);
1512         } while (error == 0 && uio->uio_resid > 0 && n != 0);
1513 out:
1514         /*
1515          * Inode is updated according to this table if FRSYNC is set.
1516          *
1517          *   FSYNC        FDSYNC(posix.4)
1518          *   --------------------------
1519          *   always       IATTCHG|IBDWRITE
1520          */
1521         /*
1522          * The inode is not updated if we're logging and the inode is a
1523          * directory with FRSYNC, FSYNC and FDSYNC flags set.
1524          */
1525         if (ioflag & FRSYNC) {
1526                 if (TRANS_ISTRANS(ufsvfsp) && ((ip->i_mode & IFMT) == IFDIR)) {
1527                         doupdate = 0;
1528                 }
1529                 if (doupdate) {
1530                         if ((ioflag & FSYNC) ||
1531                             ((ioflag & FDSYNC) &&
1532                             (ip->i_flag & (IATTCHG|IBDWRITE)))) {
1533                                 ufs_iupdat(ip, 1);
1534                         }
1535                 }
1536         }
1537         /*
1538          * If we've already done a partial read, terminate
1539          * the read but return no error.
1540          */
1541         if (oresid != uio->uio_resid)
1542                 error = 0;
1543         ITIMES(ip);
1544 
1545         return (error);
1546 }
1547 
1548 /* ARGSUSED */
1549 static int
1550 ufs_ioctl(
1551         struct vnode    *vp,
1552         int             cmd,
1553         intptr_t        arg,
1554         int             flag,
1555         struct cred     *cr,
1556         int             *rvalp,
1557         caller_context_t *ct)
1558 {
1559         struct lockfs   lockfs, lockfs_out;
1560         struct ufsvfs   *ufsvfsp = VTOI(vp)->i_ufsvfs;
1561         char            *comment, *original_comment;
1562         struct fs       *fs;
1563         struct ulockfs  *ulp;
1564         offset_t        off;
1565         extern int      maxphys;
1566         int             error;
1567         int             issync;
1568         int             trans_size;
1569 
1570 
1571         /*
1572          * forcibly unmounted
1573          */
1574         if (ufsvfsp == NULL || vp->v_vfsp == NULL ||
1575             vp->v_vfsp->vfs_flag & VFS_UNMOUNTED)
1576                 return (EIO);
1577         fs = ufsvfsp->vfs_fs;
1578 
1579         if (cmd == Q_QUOTACTL) {
1580                 error = ufs_lockfs_begin(ufsvfsp, &ulp, ULOCKFS_QUOTA_MASK);
1581                 if (error)
1582                         return (error);
1583 
1584                 if (ulp) {
1585                         TRANS_BEGIN_ASYNC(ufsvfsp, TOP_QUOTA,
1586                             TOP_SETQUOTA_SIZE(fs));
1587                 }
1588 
1589                 error = quotactl(vp, arg, flag, cr);
1590 
1591                 if (ulp) {
1592                         TRANS_END_ASYNC(ufsvfsp, TOP_QUOTA,
1593                             TOP_SETQUOTA_SIZE(fs));
1594                         ufs_lockfs_end(ulp);
1595                 }
1596                 return (error);
1597         }
1598 
1599         switch (cmd) {
1600                 case _FIOLFS:
1601                         /*
1602                          * file system locking
1603                          */
1604                         if (secpolicy_fs_config(cr, ufsvfsp->vfs_vfs) != 0)
1605                                 return (EPERM);
1606 
1607                         if ((flag & DATAMODEL_MASK) == DATAMODEL_NATIVE) {
1608                                 if (copyin((caddr_t)arg, &lockfs,
1609                                     sizeof (struct lockfs)))
1610                                         return (EFAULT);
1611                         }
1612 #ifdef _SYSCALL32_IMPL
1613                         else {
1614                                 struct lockfs32 lockfs32;
1615                                 /* Translate ILP32 lockfs to LP64 lockfs */
1616                                 if (copyin((caddr_t)arg, &lockfs32,
1617                                     sizeof (struct lockfs32)))
1618                                         return (EFAULT);
1619                                 lockfs.lf_lock = (ulong_t)lockfs32.lf_lock;
1620                                 lockfs.lf_flags = (ulong_t)lockfs32.lf_flags;
1621                                 lockfs.lf_key = (ulong_t)lockfs32.lf_key;
1622                                 lockfs.lf_comlen = (ulong_t)lockfs32.lf_comlen;
1623                                 lockfs.lf_comment =
1624                                     (caddr_t)(uintptr_t)lockfs32.lf_comment;
1625                         }
1626 #endif /* _SYSCALL32_IMPL */
1627 
1628                         if (lockfs.lf_comlen) {
1629                                 if (lockfs.lf_comlen > LOCKFS_MAXCOMMENTLEN)
1630                                         return (ENAMETOOLONG);
1631                                 comment =
1632                                     kmem_alloc(lockfs.lf_comlen, KM_SLEEP);
1633                                 if (copyin(lockfs.lf_comment, comment,
1634                                     lockfs.lf_comlen)) {
1635                                         kmem_free(comment, lockfs.lf_comlen);
1636                                         return (EFAULT);
1637                                 }
1638                                 original_comment = lockfs.lf_comment;
1639                                 lockfs.lf_comment = comment;
1640                         }
1641                         if ((error = ufs_fiolfs(vp, &lockfs, 0)) == 0) {
1642                                 lockfs.lf_comment = original_comment;
1643 
1644                                 if ((flag & DATAMODEL_MASK) ==
1645                                     DATAMODEL_NATIVE) {
1646                                         (void) copyout(&lockfs, (caddr_t)arg,
1647                                             sizeof (struct lockfs));
1648                                 }
1649 #ifdef _SYSCALL32_IMPL
1650                                 else {
1651                                         struct lockfs32 lockfs32;
1652                                         /* Translate LP64 to ILP32 lockfs */
1653                                         lockfs32.lf_lock =
1654                                             (uint32_t)lockfs.lf_lock;
1655                                         lockfs32.lf_flags =
1656                                             (uint32_t)lockfs.lf_flags;
1657                                         lockfs32.lf_key =
1658                                             (uint32_t)lockfs.lf_key;
1659                                         lockfs32.lf_comlen =
1660                                             (uint32_t)lockfs.lf_comlen;
1661                                         lockfs32.lf_comment =
1662                                             (uint32_t)(uintptr_t)
1663                                             lockfs.lf_comment;
1664                                         (void) copyout(&lockfs32, (caddr_t)arg,
1665                                             sizeof (struct lockfs32));
1666                                 }
1667 #endif /* _SYSCALL32_IMPL */
1668 
1669                         } else {
1670                                 if (lockfs.lf_comlen)
1671                                         kmem_free(comment, lockfs.lf_comlen);
1672                         }
1673                         return (error);
1674 
1675                 case _FIOLFSS:
1676                         /*
1677                          * get file system locking status
1678                          */
1679 
1680                         if ((flag & DATAMODEL_MASK) == DATAMODEL_NATIVE) {
1681                                 if (copyin((caddr_t)arg, &lockfs,
1682                                     sizeof (struct lockfs)))
1683                                         return (EFAULT);
1684                         }
1685 #ifdef _SYSCALL32_IMPL
1686                         else {
1687                                 struct lockfs32 lockfs32;
1688                                 /* Translate ILP32 lockfs to LP64 lockfs */
1689                                 if (copyin((caddr_t)arg, &lockfs32,
1690                                     sizeof (struct lockfs32)))
1691                                         return (EFAULT);
1692                                 lockfs.lf_lock = (ulong_t)lockfs32.lf_lock;
1693                                 lockfs.lf_flags = (ulong_t)lockfs32.lf_flags;
1694                                 lockfs.lf_key = (ulong_t)lockfs32.lf_key;
1695                                 lockfs.lf_comlen = (ulong_t)lockfs32.lf_comlen;
1696                                 lockfs.lf_comment =
1697                                     (caddr_t)(uintptr_t)lockfs32.lf_comment;
1698                         }
1699 #endif /* _SYSCALL32_IMPL */
1700 
1701                         if (error =  ufs_fiolfss(vp, &lockfs_out))
1702                                 return (error);
1703                         lockfs.lf_lock = lockfs_out.lf_lock;
1704                         lockfs.lf_key = lockfs_out.lf_key;
1705                         lockfs.lf_flags = lockfs_out.lf_flags;
1706                         lockfs.lf_comlen = MIN(lockfs.lf_comlen,
1707                             lockfs_out.lf_comlen);
1708 
1709                         if ((flag & DATAMODEL_MASK) == DATAMODEL_NATIVE) {
1710                                 if (copyout(&lockfs, (caddr_t)arg,
1711                                     sizeof (struct lockfs)))
1712                                         return (EFAULT);
1713                         }
1714 #ifdef _SYSCALL32_IMPL
1715                         else {
1716                                 /* Translate LP64 to ILP32 lockfs */
1717                                 struct lockfs32 lockfs32;
1718                                 lockfs32.lf_lock = (uint32_t)lockfs.lf_lock;
1719                                 lockfs32.lf_flags = (uint32_t)lockfs.lf_flags;
1720                                 lockfs32.lf_key = (uint32_t)lockfs.lf_key;
1721                                 lockfs32.lf_comlen = (uint32_t)lockfs.lf_comlen;
1722                                 lockfs32.lf_comment =
1723                                     (uint32_t)(uintptr_t)lockfs.lf_comment;
1724                                 if (copyout(&lockfs32, (caddr_t)arg,
1725                                     sizeof (struct lockfs32)))
1726                                         return (EFAULT);
1727                         }
1728 #endif /* _SYSCALL32_IMPL */
1729 
1730                         if (lockfs.lf_comlen &&
1731                             lockfs.lf_comment && lockfs_out.lf_comment)
1732                                 if (copyout(lockfs_out.lf_comment,
1733                                     lockfs.lf_comment, lockfs.lf_comlen))
1734                                         return (EFAULT);
1735                         return (0);
1736 
1737                 case _FIOSATIME:
1738                         /*
1739                          * set access time
1740                          */
1741 
1742                         /*
1743                          * if mounted w/o atime, return quietly.
1744                          * I briefly thought about returning ENOSYS, but
1745                          * figured that most apps would consider this fatal
1746                          * but the idea is to make this as seamless as poss.
1747                          */
1748                         if (ufsvfsp->vfs_noatime)
1749                                 return (0);
1750 
1751                         error = ufs_lockfs_begin(ufsvfsp, &ulp,
1752                             ULOCKFS_SETATTR_MASK);
1753                         if (error)
1754                                 return (error);
1755 
1756                         if (ulp) {
1757                                 trans_size = (int)TOP_SETATTR_SIZE(VTOI(vp));
1758                                 TRANS_BEGIN_CSYNC(ufsvfsp, issync,
1759                                     TOP_SETATTR, trans_size);
1760                         }
1761 
1762                         error = ufs_fiosatime(vp, (struct timeval *)arg,
1763                             flag, cr);
1764 
1765                         if (ulp) {
1766                                 TRANS_END_CSYNC(ufsvfsp, error, issync,
1767                                     TOP_SETATTR, trans_size);
1768                                 ufs_lockfs_end(ulp);
1769                         }
1770                         return (error);
1771 
1772                 case _FIOSDIO:
1773                         /*
1774                          * set delayed-io
1775                          */
1776                         return (ufs_fiosdio(vp, (uint_t *)arg, flag, cr));
1777 
1778                 case _FIOGDIO:
1779                         /*
1780                          * get delayed-io
1781                          */
1782                         return (ufs_fiogdio(vp, (uint_t *)arg, flag, cr));
1783 
1784                 case _FIOIO:
1785                         /*
1786                          * inode open
1787                          */
1788                         error = ufs_lockfs_begin(ufsvfsp, &ulp,
1789                             ULOCKFS_VGET_MASK);
1790                         if (error)
1791                                 return (error);
1792 
1793                         error = ufs_fioio(vp, (struct fioio *)arg, flag, cr);
1794 
1795                         if (ulp) {
1796                                 ufs_lockfs_end(ulp);
1797                         }
1798                         return (error);
1799 
1800                 case _FIOFFS:
1801                         /*
1802                          * file system flush (push w/invalidate)
1803                          */
1804                         if ((caddr_t)arg != NULL)
1805                                 return (EINVAL);
1806                         return (ufs_fioffs(vp, NULL, cr));
1807 
1808                 case _FIOISBUSY:
1809                         /*
1810                          * Contract-private interface for Legato
1811                          * Purge this vnode from the DNLC and decide
1812                          * if this vnode is busy (*arg == 1) or not
1813                          * (*arg == 0)
1814                          */
1815                         if (secpolicy_fs_config(cr, ufsvfsp->vfs_vfs) != 0)
1816                                 return (EPERM);
1817                         error = ufs_fioisbusy(vp, (int *)arg, cr);
1818                         return (error);
1819 
1820                 case _FIODIRECTIO:
1821                         return (ufs_fiodirectio(vp, (int)arg, cr));
1822 
1823                 case _FIOTUNE:
1824                         /*
1825                          * Tune the file system (aka setting fs attributes)
1826                          */
1827                         error = ufs_lockfs_begin(ufsvfsp, &ulp,
1828                             ULOCKFS_SETATTR_MASK);
1829                         if (error)
1830                                 return (error);
1831 
1832                         error = ufs_fiotune(vp, (struct fiotune *)arg, cr);
1833 
1834                         if (ulp)
1835                                 ufs_lockfs_end(ulp);
1836                         return (error);
1837 
1838                 case _FIOLOGENABLE:
1839                         if (secpolicy_fs_config(cr, ufsvfsp->vfs_vfs) != 0)
1840                                 return (EPERM);
1841                         return (ufs_fiologenable(vp, (void *)arg, cr, flag));
1842 
1843                 case _FIOLOGDISABLE:
1844                         if (secpolicy_fs_config(cr, ufsvfsp->vfs_vfs) != 0)
1845                                 return (EPERM);
1846                         return (ufs_fiologdisable(vp, (void *)arg, cr, flag));
1847 
1848                 case _FIOISLOG:
1849                         return (ufs_fioislog(vp, (void *)arg, cr, flag));
1850 
1851                 case _FIOSNAPSHOTCREATE_MULTI:
1852                 {
1853                         struct fiosnapcreate_multi      fc, *fcp;
1854                         size_t  fcm_size;
1855 
1856                         if (copyin((void *)arg, &fc, sizeof (fc)))
1857                                 return (EFAULT);
1858                         if (fc.backfilecount > MAX_BACKFILE_COUNT)
1859                                 return (EINVAL);
1860                         fcm_size = sizeof (struct fiosnapcreate_multi) +
1861                             (fc.backfilecount - 1) * sizeof (int);
1862                         fcp = (struct fiosnapcreate_multi *)
1863                             kmem_alloc(fcm_size, KM_SLEEP);
1864                         if (copyin((void *)arg, fcp, fcm_size)) {
1865                                 kmem_free(fcp, fcm_size);
1866                                 return (EFAULT);
1867                         }
1868                         error = ufs_snap_create(vp, fcp, cr);
1869                         /*
1870                          * Do copyout even if there is an error because
1871                          * the details of error is stored in fcp.
1872                          */
1873                         if (copyout(fcp, (void *)arg, fcm_size))
1874                                 error = EFAULT;
1875                         kmem_free(fcp, fcm_size);
1876                         return (error);
1877                 }
1878 
1879                 case _FIOSNAPSHOTDELETE:
1880                 {
1881                         struct fiosnapdelete    fc;
1882 
1883                         if (copyin((void *)arg, &fc, sizeof (fc)))
1884                                 return (EFAULT);
1885                         error = ufs_snap_delete(vp, &fc, cr);
1886                         if (!error && copyout(&fc, (void *)arg, sizeof (fc)))
1887                                 error = EFAULT;
1888                         return (error);
1889                 }
1890 
1891                 case _FIOGETSUPERBLOCK:
1892                         if (copyout(fs, (void *)arg, SBSIZE))
1893                                 return (EFAULT);
1894                         return (0);
1895 
1896                 case _FIOGETMAXPHYS:
1897                         if (copyout(&maxphys, (void *)arg, sizeof (maxphys)))
1898                                 return (EFAULT);
1899                         return (0);
1900 
1901                 /*
1902                  * The following 3 ioctls are for TSufs support
1903                  * although could potentially be used elsewhere
1904                  */
1905                 case _FIO_SET_LUFS_DEBUG:
1906                         if (secpolicy_fs_config(cr, ufsvfsp->vfs_vfs) != 0)
1907                                 return (EPERM);
1908                         lufs_debug = (uint32_t)arg;
1909                         return (0);
1910 
1911                 case _FIO_SET_LUFS_ERROR:
1912                         if (secpolicy_fs_config(cr, ufsvfsp->vfs_vfs) != 0)
1913                                 return (EPERM);
1914                         TRANS_SETERROR(ufsvfsp);
1915                         return (0);
1916 
1917                 case _FIO_GET_TOP_STATS:
1918                 {
1919                         fio_lufs_stats_t *ls;
1920                         ml_unit_t *ul = ufsvfsp->vfs_log;
1921 
1922                         ls = kmem_zalloc(sizeof (*ls), KM_SLEEP);
1923                         ls->ls_debug = ul->un_debug; /* return debug value */
1924                         /* Copy stucture if statistics are being kept */
1925                         if (ul->un_logmap->mtm_tops) {
1926                                 ls->ls_topstats = *(ul->un_logmap->mtm_tops);
1927                         }
1928                         error = 0;
1929                         if (copyout(ls, (void *)arg, sizeof (*ls)))
1930                                 error = EFAULT;
1931                         kmem_free(ls, sizeof (*ls));
1932                         return (error);
1933                 }
1934 
1935                 case _FIO_SEEK_DATA:
1936                 case _FIO_SEEK_HOLE:
1937                         if (ddi_copyin((void *)arg, &off, sizeof (off), flag))
1938                                 return (EFAULT);
1939                         /* offset paramater is in/out */
1940                         error = ufs_fio_holey(vp, cmd, &off);
1941                         if (error)
1942                                 return (error);
1943                         if (ddi_copyout(&off, (void *)arg, sizeof (off), flag))
1944                                 return (EFAULT);
1945                         return (0);
1946 
1947                 case _FIO_COMPRESSED:
1948                 {
1949                         /*
1950                          * This is a project private ufs ioctl() to mark
1951                          * the inode as that belonging to a compressed
1952                          * file. This is used to mark individual
1953                          * compressed files in a miniroot archive.
1954                          * The files compressed in this manner are
1955                          * automatically decompressed by the dcfs filesystem
1956                          * (via an interception in ufs_lookup - see decompvp())
1957                          * which is layered on top of ufs on a system running
1958                          * from the archive. See uts/common/fs/dcfs for details.
1959                          * This ioctl only marks the file as compressed - the
1960                          * actual compression is done by fiocompress (a
1961                          * userland utility) which invokes this ioctl().
1962                          */
1963                         struct inode *ip = VTOI(vp);
1964 
1965                         error = ufs_lockfs_begin(ufsvfsp, &ulp,
1966                             ULOCKFS_SETATTR_MASK);
1967                         if (error)
1968                                 return (error);
1969 
1970                         if (ulp) {
1971                                 TRANS_BEGIN_ASYNC(ufsvfsp, TOP_IUPDAT,
1972                                     TOP_IUPDAT_SIZE(ip));
1973                         }
1974 
1975                         error = ufs_mark_compressed(vp);
1976 
1977                         if (ulp) {
1978                                 TRANS_END_ASYNC(ufsvfsp, TOP_IUPDAT,
1979                                     TOP_IUPDAT_SIZE(ip));
1980                                 ufs_lockfs_end(ulp);
1981                         }
1982 
1983                         return (error);
1984 
1985                 }
1986 
1987                 default:
1988                         return (ENOTTY);
1989         }
1990 }
1991 
1992 
1993 /* ARGSUSED */
1994 static int
1995 ufs_getattr(struct vnode *vp, struct vattr *vap, int flags,
1996         struct cred *cr, caller_context_t *ct)
1997 {
1998         struct inode *ip = VTOI(vp);
1999         struct ufsvfs *ufsvfsp;
2000         int err;
2001 
2002         if (vap->va_mask == AT_SIZE) {
2003                 /*
2004                  * for performance, if only the size is requested don't bother
2005                  * with anything else.
2006                  */
2007                 UFS_GET_ISIZE(&vap->va_size, ip);
2008                 return (0);
2009         }
2010 
2011         /*
2012          * inlined lockfs checks
2013          */
2014         ufsvfsp = ip->i_ufsvfs;
2015         if ((ufsvfsp == NULL) || ULOCKFS_IS_HLOCK(&ufsvfsp->vfs_ulockfs)) {
2016                 err = EIO;
2017                 goto out;
2018         }
2019 
2020         rw_enter(&ip->i_contents, RW_READER);
2021         /*
2022          * Return all the attributes.  This should be refined so
2023          * that it only returns what's asked for.
2024          */
2025 
2026         /*
2027          * Copy from inode table.
2028          */
2029         vap->va_type = vp->v_type;
2030         vap->va_mode = ip->i_mode & MODEMASK;
2031         /*
2032          * If there is an ACL and there is a mask entry, then do the
2033          * extra work that completes the equivalent of an acltomode(3)
2034          * call.  According to POSIX P1003.1e, the acl mask should be
2035          * returned in the group permissions field.
2036          *
2037          * - start with the original permission and mode bits (from above)
2038          * - clear the group owner bits
2039          * - add in the mask bits.
2040          */
2041         if (ip->i_ufs_acl && ip->i_ufs_acl->aclass.acl_ismask) {
2042                 vap->va_mode &= ~((VREAD | VWRITE | VEXEC) >> 3);
2043                 vap->va_mode |=
2044                     (ip->i_ufs_acl->aclass.acl_maskbits & PERMMASK) << 3;
2045         }
2046         vap->va_uid = ip->i_uid;
2047         vap->va_gid = ip->i_gid;
2048         vap->va_fsid = ip->i_dev;
2049         vap->va_nodeid = (ino64_t)ip->i_number;
2050         vap->va_nlink = ip->i_nlink;
2051         vap->va_size = ip->i_size;
2052         if (vp->v_type == VCHR || vp->v_type == VBLK)
2053                 vap->va_rdev = ip->i_rdev;
2054         else
2055                 vap->va_rdev = 0;    /* not a b/c spec. */
2056         mutex_enter(&ip->i_tlock);
2057         ITIMES_NOLOCK(ip);      /* mark correct time in inode */
2058         vap->va_seq = ip->i_seq;
2059         vap->va_atime.tv_sec = (time_t)ip->i_atime.tv_sec;
2060         vap->va_atime.tv_nsec = ip->i_atime.tv_usec*1000;
2061         vap->va_mtime.tv_sec = (time_t)ip->i_mtime.tv_sec;
2062         vap->va_mtime.tv_nsec = ip->i_mtime.tv_usec*1000;
2063         vap->va_ctime.tv_sec = (time_t)ip->i_ctime.tv_sec;
2064         vap->va_ctime.tv_nsec = ip->i_ctime.tv_usec*1000;
2065         mutex_exit(&ip->i_tlock);
2066 
2067         switch (ip->i_mode & IFMT) {
2068 
2069         case IFBLK:
2070                 vap->va_blksize = MAXBSIZE;          /* was BLKDEV_IOSIZE */
2071                 break;
2072 
2073         case IFCHR:
2074                 vap->va_blksize = MAXBSIZE;
2075                 break;
2076 
2077         default:
2078                 vap->va_blksize = ip->i_fs->fs_bsize;
2079                 break;
2080         }
2081         vap->va_nblocks = (fsblkcnt64_t)ip->i_blocks;
2082         rw_exit(&ip->i_contents);
2083         err = 0;
2084 
2085 out:
2086         return (err);
2087 }
2088 
2089 /*
2090  * Special wrapper to provide a callback for secpolicy_vnode_setattr().
2091  * The i_contents lock is already held by the caller and we need to
2092  * declare the inode as 'void *' argument.
2093  */
2094 static int
2095 ufs_priv_access(void *vip, int mode, struct cred *cr)
2096 {
2097         struct inode *ip = vip;
2098 
2099         return (ufs_iaccess(ip, mode, cr, 0));
2100 }
2101 
2102 /*ARGSUSED4*/
2103 static int
2104 ufs_setattr(
2105         struct vnode *vp,
2106         struct vattr *vap,
2107         int flags,
2108         struct cred *cr,
2109         caller_context_t *ct)
2110 {
2111         struct inode *ip = VTOI(vp);
2112         struct ufsvfs *ufsvfsp = ip->i_ufsvfs;
2113         struct fs *fs;
2114         struct ulockfs *ulp;
2115         char *errmsg1;
2116         char *errmsg2;
2117         long blocks;
2118         long int mask = vap->va_mask;
2119         size_t len1, len2;
2120         int issync;
2121         int trans_size;
2122         int dotrans;
2123         int dorwlock;
2124         int error;
2125         int owner_change;
2126         int dodqlock;
2127         timestruc_t now;
2128         vattr_t oldva;
2129         int retry = 1;
2130         int indeadlock;
2131 
2132         /*
2133          * Cannot set these attributes.
2134          */
2135         if ((mask & AT_NOSET) || (mask & AT_XVATTR))
2136                 return (EINVAL);
2137 
2138         /*
2139          * check for forced unmount
2140          */
2141         if (ufsvfsp == NULL)
2142                 return (EIO);
2143 
2144         fs = ufsvfsp->vfs_fs;
2145         if (fs->fs_ronly != 0)
2146                 return (EROFS);
2147 
2148 again:
2149         errmsg1 = NULL;
2150         errmsg2 = NULL;
2151         dotrans = 0;
2152         dorwlock = 0;
2153         dodqlock = 0;
2154 
2155         error = ufs_lockfs_begin(ufsvfsp, &ulp, ULOCKFS_SETATTR_MASK);
2156         if (error)
2157                 goto out;
2158 
2159         /*
2160          * Acquire i_rwlock before TRANS_BEGIN_CSYNC() if this is a file.
2161          * This follows the protocol for read()/write().
2162          */
2163         if (vp->v_type != VDIR) {
2164                 /*
2165                  * ufs_tryirwlock uses rw_tryenter and checks for SLOCK to
2166                  * avoid i_rwlock, ufs_lockfs_begin deadlock. If deadlock
2167                  * possible, retries the operation.
2168                  */
2169                 ufs_tryirwlock(&ip->i_rwlock, RW_WRITER, retry_file);
2170                 if (indeadlock) {
2171                         if (ulp)
2172                                 ufs_lockfs_end(ulp);
2173                         goto again;
2174                 }
2175                 dorwlock = 1;
2176         }
2177 
2178         /*
2179          * Truncate file.  Must have write permission and not be a directory.
2180          */
2181         if (mask & AT_SIZE) {
2182                 rw_enter(&ip->i_contents, RW_WRITER);
2183                 if (vp->v_type == VDIR) {
2184                         error = EISDIR;
2185                         goto update_inode;
2186                 }
2187                 if (error = ufs_iaccess(ip, IWRITE, cr, 0))
2188                         goto update_inode;
2189 
2190                 rw_exit(&ip->i_contents);
2191                 error = TRANS_ITRUNC(ip, vap->va_size, 0, cr);
2192                 if (error) {
2193                         rw_enter(&ip->i_contents, RW_WRITER);
2194                         goto update_inode;
2195                 }
2196 
2197                 if (error == 0 && vap->va_size)
2198                         vnevent_truncate(vp, ct);
2199         }
2200 
2201         if (ulp) {
2202                 trans_size = (int)TOP_SETATTR_SIZE(ip);
2203                 TRANS_BEGIN_CSYNC(ufsvfsp, issync, TOP_SETATTR, trans_size);
2204                 ++dotrans;
2205         }
2206 
2207         /*
2208          * Acquire i_rwlock after TRANS_BEGIN_CSYNC() if this is a directory.
2209          * This follows the protocol established by
2210          * ufs_link/create/remove/rename/mkdir/rmdir/symlink.
2211          */
2212         if (vp->v_type == VDIR) {
2213                 ufs_tryirwlock_trans(&ip->i_rwlock, RW_WRITER, TOP_SETATTR,
2214                     retry_dir);
2215                 if (indeadlock)
2216                         goto again;
2217                 dorwlock = 1;
2218         }
2219 
2220         /*
2221          * Grab quota lock if we are changing the file's owner.
2222          */
2223         if (mask & AT_UID) {
2224                 rw_enter(&ufsvfsp->vfs_dqrwlock, RW_READER);
2225                 dodqlock = 1;
2226         }
2227         rw_enter(&ip->i_contents, RW_WRITER);
2228 
2229         oldva.va_mode = ip->i_mode;
2230         oldva.va_uid = ip->i_uid;
2231         oldva.va_gid = ip->i_gid;
2232 
2233         vap->va_mask &= ~AT_SIZE;
2234 
2235         error = secpolicy_vnode_setattr(cr, vp, vap, &oldva, flags,
2236             ufs_priv_access, ip);
2237         if (error)
2238                 goto update_inode;
2239 
2240         mask = vap->va_mask;
2241 
2242         /*
2243          * Change file access modes.
2244          */
2245         if (mask & AT_MODE) {
2246                 ip->i_mode = (ip->i_mode & IFMT) | (vap->va_mode & ~IFMT);
2247                 TRANS_INODE(ufsvfsp, ip);
2248                 ip->i_flag |= ICHG;
2249                 if (stickyhack) {
2250                         mutex_enter(&vp->v_lock);
2251                         if ((ip->i_mode & (ISVTX | IEXEC | IFDIR)) == ISVTX)
2252                                 vp->v_flag |= VSWAPLIKE;
2253                         else
2254                                 vp->v_flag &= ~VSWAPLIKE;
2255                         mutex_exit(&vp->v_lock);
2256                 }
2257         }
2258         if (mask & (AT_UID|AT_GID)) {
2259                 if (mask & AT_UID) {
2260                         /*
2261                          * Don't change ownership of the quota inode.
2262                          */
2263                         if (ufsvfsp->vfs_qinod == ip) {
2264                                 ASSERT(ufsvfsp->vfs_qflags & MQ_ENABLED);
2265                                 error = EINVAL;
2266                                 goto update_inode;
2267                         }
2268 
2269                         /*
2270                          * No real ownership change.
2271                          */
2272                         if (ip->i_uid == vap->va_uid) {
2273                                 blocks = 0;
2274                                 owner_change = 0;
2275                         }
2276                         /*
2277                          * Remove the blocks and the file, from the old user's
2278                          * quota.
2279                          */
2280                         else {
2281                                 blocks = ip->i_blocks;
2282                                 owner_change = 1;
2283 
2284                                 (void) chkdq(ip, -blocks, /* force */ 1, cr,
2285                                     (char **)NULL, (size_t *)NULL);
2286                                 (void) chkiq(ufsvfsp, /* change */ -1, ip,
2287                                     (uid_t)ip->i_uid, /* force */ 1, cr,
2288                                     (char **)NULL, (size_t *)NULL);
2289                                 dqrele(ip->i_dquot);
2290                         }
2291 
2292                         ip->i_uid = vap->va_uid;
2293 
2294                         /*
2295                          * There is a real ownership change.
2296                          */
2297                         if (owner_change) {
2298                                 /*
2299                                  * Add the blocks and the file to the new
2300                                  * user's quota.
2301                                  */
2302                                 ip->i_dquot = getinoquota(ip);
2303                                 (void) chkdq(ip, blocks, /* force */ 1, cr,
2304                                     &errmsg1, &len1);
2305                                 (void) chkiq(ufsvfsp, /* change */ 1,
2306                                     (struct inode *)NULL, (uid_t)ip->i_uid,
2307                                     /* force */ 1, cr, &errmsg2, &len2);
2308                         }
2309                 }
2310                 if (mask & AT_GID) {
2311                         ip->i_gid = vap->va_gid;
2312                 }
2313                 TRANS_INODE(ufsvfsp, ip);
2314                 ip->i_flag |= ICHG;
2315         }
2316         /*
2317          * Change file access or modified times.
2318          */
2319         if (mask & (AT_ATIME|AT_MTIME)) {
2320                 /* Check that the time value is within ufs range */
2321                 if (((mask & AT_ATIME) && TIMESPEC_OVERFLOW(&vap->va_atime)) ||
2322                     ((mask & AT_MTIME) && TIMESPEC_OVERFLOW(&vap->va_mtime))) {
2323                         error = EOVERFLOW;
2324                         goto update_inode;
2325                 }
2326 
2327                 /*
2328                  * if the "noaccess" mount option is set and only atime
2329                  * update is requested, do nothing. No error is returned.
2330                  */
2331                 if ((ufsvfsp->vfs_noatime) &&
2332                     ((mask & (AT_ATIME|AT_MTIME)) == AT_ATIME))
2333                         goto skip_atime;
2334 
2335                 if (mask & AT_ATIME) {
2336                         ip->i_atime.tv_sec = vap->va_atime.tv_sec;
2337                         ip->i_atime.tv_usec = vap->va_atime.tv_nsec / 1000;
2338                         ip->i_flag &= ~IACC;
2339                 }
2340                 if (mask & AT_MTIME) {
2341                         ip->i_mtime.tv_sec = vap->va_mtime.tv_sec;
2342                         ip->i_mtime.tv_usec = vap->va_mtime.tv_nsec / 1000;
2343                         gethrestime(&now);
2344                         if (now.tv_sec > TIME32_MAX) {
2345                                 /*
2346                                  * In 2038, ctime sticks forever..
2347                                  */
2348                                 ip->i_ctime.tv_sec = TIME32_MAX;
2349                                 ip->i_ctime.tv_usec = 0;
2350                         } else {
2351                                 ip->i_ctime.tv_sec = now.tv_sec;
2352                                 ip->i_ctime.tv_usec = now.tv_nsec / 1000;
2353                         }
2354                         ip->i_flag &= ~(IUPD|ICHG);
2355                         ip->i_flag |= IMODTIME;
2356                 }
2357                 TRANS_INODE(ufsvfsp, ip);
2358                 ip->i_flag |= IMOD;
2359         }
2360 
2361 skip_atime:
2362         /*
2363          * The presence of a shadow inode may indicate an ACL, but does
2364          * not imply an ACL.  Future FSD types should be handled here too
2365          * and check for the presence of the attribute-specific data
2366          * before referencing it.
2367          */
2368         if (ip->i_shadow) {
2369                 /*
2370                  * XXX if ufs_iupdat is changed to sandbagged write fix
2371                  * ufs_acl_setattr to push ip to keep acls consistent
2372                  *
2373                  * Suppress out of inodes messages if we will retry.
2374                  */
2375                 if (retry)
2376                         ip->i_flag |= IQUIET;
2377                 error = ufs_acl_setattr(ip, vap, cr);
2378                 ip->i_flag &= ~IQUIET;
2379         }
2380 
2381 update_inode:
2382         /*
2383          * Setattr always increases the sequence number
2384          */
2385         ip->i_seq++;
2386 
2387         /*
2388          * if nfsd and not logging; push synchronously
2389          */
2390         if ((curthread->t_flag & T_DONTPEND) && !TRANS_ISTRANS(ufsvfsp)) {
2391                 ufs_iupdat(ip, 1);
2392         } else {
2393                 ITIMES_NOLOCK(ip);
2394         }
2395 
2396         rw_exit(&ip->i_contents);
2397         if (dodqlock) {
2398                 rw_exit(&ufsvfsp->vfs_dqrwlock);
2399         }
2400         if (dorwlock)
2401                 rw_exit(&ip->i_rwlock);
2402 
2403         if (ulp) {
2404                 if (dotrans) {
2405                         int terr = 0;
2406                         TRANS_END_CSYNC(ufsvfsp, terr, issync, TOP_SETATTR,
2407                             trans_size);
2408                         if (error == 0)
2409                                 error = terr;
2410                 }
2411                 ufs_lockfs_end(ulp);
2412         }
2413 out:
2414         /*
2415          * If out of inodes or blocks, see if we can free something
2416          * up from the delete queue.
2417          */
2418         if ((error == ENOSPC) && retry && TRANS_ISTRANS(ufsvfsp)) {
2419                 ufs_delete_drain_wait(ufsvfsp, 1);
2420                 retry = 0;
2421                 if (errmsg1 != NULL)
2422                         kmem_free(errmsg1, len1);
2423                 if (errmsg2 != NULL)
2424                         kmem_free(errmsg2, len2);
2425                 goto again;
2426         }
2427         if (errmsg1 != NULL) {
2428                 uprintf(errmsg1);
2429                 kmem_free(errmsg1, len1);
2430         }
2431         if (errmsg2 != NULL) {
2432                 uprintf(errmsg2);
2433                 kmem_free(errmsg2, len2);
2434         }
2435         return (error);
2436 }
2437 
2438 /*ARGSUSED*/
2439 static int
2440 ufs_access(struct vnode *vp, int mode, int flags, struct cred *cr,
2441         caller_context_t *ct)
2442 {
2443         struct inode *ip = VTOI(vp);
2444 
2445         if (ip->i_ufsvfs == NULL)
2446                 return (EIO);
2447 
2448         /*
2449          * The ufs_iaccess function wants to be called with
2450          * mode bits expressed as "ufs specific" bits.
2451          * I.e., VWRITE|VREAD|VEXEC do not make sense to
2452          * ufs_iaccess() but IWRITE|IREAD|IEXEC do.
2453          * But since they're the same we just pass the vnode mode
2454          * bit but just verify that assumption at compile time.
2455          */
2456 #if IWRITE != VWRITE || IREAD != VREAD || IEXEC != VEXEC
2457 #error "ufs_access needs to map Vmodes to Imodes"
2458 #endif
2459         return (ufs_iaccess(ip, mode, cr, 1));
2460 }
2461 
2462 /* ARGSUSED */
2463 static int
2464 ufs_readlink(struct vnode *vp, struct uio *uiop, struct cred *cr,
2465         caller_context_t *ct)
2466 {
2467         struct inode *ip = VTOI(vp);
2468         struct ufsvfs *ufsvfsp;
2469         struct ulockfs *ulp;
2470         int error;
2471         int fastsymlink;
2472 
2473         if (vp->v_type != VLNK) {
2474                 error = EINVAL;
2475                 goto nolockout;
2476         }
2477 
2478         /*
2479          * If the symbolic link is empty there is nothing to read.
2480          * Fast-track these empty symbolic links
2481          */
2482         if (ip->i_size == 0) {
2483                 error = 0;
2484                 goto nolockout;
2485         }
2486 
2487         ufsvfsp = ip->i_ufsvfs;
2488         error = ufs_lockfs_begin(ufsvfsp, &ulp, ULOCKFS_READLINK_MASK);
2489         if (error)
2490                 goto nolockout;
2491         /*
2492          * The ip->i_rwlock protects the data blocks used for FASTSYMLINK
2493          */
2494 again:
2495         fastsymlink = 0;
2496         if (ip->i_flag & IFASTSYMLNK) {
2497                 rw_enter(&ip->i_rwlock, RW_READER);
2498                 rw_enter(&ip->i_contents, RW_READER);
2499                 if (ip->i_flag & IFASTSYMLNK) {
2500                         if (!ULOCKFS_IS_NOIACC(ITOUL(ip)) &&
2501                             (ip->i_fs->fs_ronly == 0) &&
2502                             (!ufsvfsp->vfs_noatime)) {
2503                                 mutex_enter(&ip->i_tlock);
2504                                 ip->i_flag |= IACC;
2505                                 mutex_exit(&ip->i_tlock);
2506                         }
2507                         error = uiomove((caddr_t)&ip->i_db[1],
2508                             MIN(ip->i_size, uiop->uio_resid),
2509                             UIO_READ, uiop);
2510                         ITIMES(ip);
2511                         ++fastsymlink;
2512                 }
2513                 rw_exit(&ip->i_contents);
2514                 rw_exit(&ip->i_rwlock);
2515         }
2516         if (!fastsymlink) {
2517                 ssize_t size;   /* number of bytes read  */
2518                 caddr_t basep;  /* pointer to input data */
2519                 ino_t ino;
2520                 long  igen;
2521                 struct uio tuio;        /* temp uio struct */
2522                 struct uio *tuiop;
2523                 iovec_t tiov;           /* temp iovec struct */
2524                 char kbuf[FSL_SIZE];    /* buffer to hold fast symlink */
2525                 int tflag = 0;          /* flag to indicate temp vars used */
2526 
2527                 ino = ip->i_number;
2528                 igen = ip->i_gen;
2529                 size = uiop->uio_resid;
2530                 basep = uiop->uio_iov->iov_base;
2531                 tuiop = uiop;
2532 
2533                 rw_enter(&ip->i_rwlock, RW_WRITER);
2534                 rw_enter(&ip->i_contents, RW_WRITER);
2535                 if (ip->i_flag & IFASTSYMLNK) {
2536                         rw_exit(&ip->i_contents);
2537                         rw_exit(&ip->i_rwlock);
2538                         goto again;
2539                 }
2540 
2541                 /* can this be a fast symlink and is it a user buffer? */
2542                 if (ip->i_size <= FSL_SIZE &&
2543                     (uiop->uio_segflg == UIO_USERSPACE ||
2544                     uiop->uio_segflg == UIO_USERISPACE)) {
2545 
2546                         bzero(&tuio, sizeof (struct uio));
2547                         /*
2548                          * setup a kernel buffer to read link into.  this
2549                          * is to fix a race condition where the user buffer
2550                          * got corrupted before copying it into the inode.
2551                          */
2552                         size = ip->i_size;
2553                         tiov.iov_len = size;
2554                         tiov.iov_base = kbuf;
2555                         tuio.uio_iov = &tiov;
2556                         tuio.uio_iovcnt = 1;
2557                         tuio.uio_offset = uiop->uio_offset;
2558                         tuio.uio_segflg = UIO_SYSSPACE;
2559                         tuio.uio_fmode = uiop->uio_fmode;
2560                         tuio.uio_extflg = uiop->uio_extflg;
2561                         tuio.uio_limit = uiop->uio_limit;
2562                         tuio.uio_resid = size;
2563 
2564                         basep = tuio.uio_iov->iov_base;
2565                         tuiop = &tuio;
2566                         tflag = 1;
2567                 }
2568 
2569                 error = rdip(ip, tuiop, 0, cr);
2570                 if (!(error == 0 && ip->i_number == ino && ip->i_gen == igen)) {
2571                         rw_exit(&ip->i_contents);
2572                         rw_exit(&ip->i_rwlock);
2573                         goto out;
2574                 }
2575 
2576                 if (tflag == 0)
2577                         size -= uiop->uio_resid;
2578 
2579                 if ((tflag == 0 && ip->i_size <= FSL_SIZE &&
2580                     ip->i_size == size) || (tflag == 1 &&
2581                     tuio.uio_resid == 0)) {
2582                         error = kcopy(basep, &ip->i_db[1], ip->i_size);
2583                         if (error == 0) {
2584                                 ip->i_flag |= IFASTSYMLNK;
2585                                 /*
2586                                  * free page
2587                                  */
2588                                 (void) VOP_PUTPAGE(ITOV(ip),
2589                                     (offset_t)0, PAGESIZE,
2590                                     (B_DONTNEED | B_FREE | B_FORCE | B_ASYNC),
2591                                     cr, ct);
2592                         } else {
2593                                 int i;
2594                                 /* error, clear garbage left behind */
2595                                 for (i = 1; i < NDADDR; i++)
2596                                         ip->i_db[i] = 0;
2597                                 for (i = 0; i < NIADDR; i++)
2598                                         ip->i_ib[i] = 0;
2599                         }
2600                 }
2601                 if (tflag == 1) {
2602                         /* now, copy it into the user buffer */
2603                         error = uiomove((caddr_t)kbuf,
2604                             MIN(size, uiop->uio_resid),
2605                             UIO_READ, uiop);
2606                 }
2607                 rw_exit(&ip->i_contents);
2608                 rw_exit(&ip->i_rwlock);
2609         }
2610 out:
2611         if (ulp) {
2612                 ufs_lockfs_end(ulp);
2613         }
2614 nolockout:
2615         return (error);
2616 }
2617 
2618 /* ARGSUSED */
2619 static int
2620 ufs_fsync(struct vnode *vp, int syncflag, struct cred *cr,
2621         caller_context_t *ct)
2622 {
2623         struct inode *ip = VTOI(vp);
2624         struct ufsvfs *ufsvfsp = ip->i_ufsvfs;
2625         struct ulockfs *ulp;
2626         int error;
2627 
2628         error = ufs_lockfs_begin(ufsvfsp, &ulp, ULOCKFS_FSYNC_MASK);
2629         if (error)
2630                 return (error);
2631 
2632         if (TRANS_ISTRANS(ufsvfsp)) {
2633                 /*
2634                  * First push out any data pages
2635                  */
2636                 if (vn_has_cached_data(vp) && !(syncflag & FNODSYNC) &&
2637                     (vp->v_type != VCHR) && !(IS_SWAPVP(vp))) {
2638                         error = VOP_PUTPAGE(vp, (offset_t)0, (size_t)0,
2639                             0, CRED(), ct);
2640                         if (error)
2641                                 goto out;
2642                 }
2643 
2644                 /*
2645                  * Delta any delayed inode times updates
2646                  * and push inode to log.
2647                  * All other inode deltas will have already been delta'd
2648                  * and will be pushed during the commit.
2649                  */
2650                 if (!(syncflag & FDSYNC) &&
2651                     ((ip->i_flag & (IMOD|IMODACC)) == IMODACC)) {
2652                         if (ulp) {
2653                                 TRANS_BEGIN_ASYNC(ufsvfsp, TOP_FSYNC,
2654                                     TOP_SYNCIP_SIZE);
2655                         }
2656                         rw_enter(&ip->i_contents, RW_READER);
2657                         mutex_enter(&ip->i_tlock);
2658                         ip->i_flag &= ~IMODTIME;
2659                         mutex_exit(&ip->i_tlock);
2660                         ufs_iupdat(ip, I_SYNC);
2661                         rw_exit(&ip->i_contents);
2662                         if (ulp) {
2663                                 TRANS_END_ASYNC(ufsvfsp, TOP_FSYNC,
2664                                     TOP_SYNCIP_SIZE);
2665                         }
2666                 }
2667 
2668                 /*
2669                  * Commit the Moby transaction
2670                  *
2671                  * Deltas have already been made so we just need to
2672                  * commit them with a synchronous transaction.
2673                  * TRANS_BEGIN_SYNC() will return an error
2674                  * if there are no deltas to commit, for an
2675                  * empty transaction.
2676                  */
2677                 if (ulp) {
2678                         TRANS_BEGIN_SYNC(ufsvfsp, TOP_FSYNC, TOP_COMMIT_SIZE,
2679                             error);
2680                         if (error) {
2681                                 error = 0; /* commit wasn't needed */
2682                                 goto out;
2683                         }
2684                         TRANS_END_SYNC(ufsvfsp, error, TOP_FSYNC,
2685                             TOP_COMMIT_SIZE);
2686                 }
2687         } else {        /* not logging */
2688                 if (!(IS_SWAPVP(vp)))
2689                         if (syncflag & FNODSYNC) {
2690                                 /* Just update the inode only */
2691                                 TRANS_IUPDAT(ip, 1);
2692                                 error = 0;
2693                         } else if (syncflag & FDSYNC)
2694                                 /* Do data-synchronous writes */
2695                                 error = TRANS_SYNCIP(ip, 0, I_DSYNC, TOP_FSYNC);
2696                         else
2697                                 /* Do synchronous writes */
2698                                 error = TRANS_SYNCIP(ip, 0, I_SYNC, TOP_FSYNC);
2699 
2700                 rw_enter(&ip->i_contents, RW_WRITER);
2701                 if (!error)
2702                         error = ufs_sync_indir(ip);
2703                 rw_exit(&ip->i_contents);
2704         }
2705 out:
2706         if (ulp) {
2707                 ufs_lockfs_end(ulp);
2708         }
2709         return (error);
2710 }
2711 
2712 /*ARGSUSED*/
2713 static void
2714 ufs_inactive(struct vnode *vp, struct cred *cr, caller_context_t *ct)
2715 {
2716         ufs_iinactive(VTOI(vp));
2717 }
2718 
2719 /*
2720  * Unix file system operations having to do with directory manipulation.
2721  */
2722 int ufs_lookup_idle_count = 2;  /* Number of inodes to idle each time */
2723 /* ARGSUSED */
2724 static int
2725 ufs_lookup(struct vnode *dvp, char *nm, struct vnode **vpp,
2726         struct pathname *pnp, int flags, struct vnode *rdir, struct cred *cr,
2727         caller_context_t *ct, int *direntflags, pathname_t *realpnp)
2728 {
2729         struct inode *ip;
2730         struct inode *sip;
2731         struct inode *xip;
2732         struct ufsvfs *ufsvfsp;
2733         struct ulockfs *ulp;
2734         struct vnode *vp;
2735         int error;
2736 
2737         /*
2738          * Check flags for type of lookup (regular file or attribute file)
2739          */
2740 
2741         ip = VTOI(dvp);
2742 
2743         if (flags & LOOKUP_XATTR) {
2744 
2745                 /*
2746                  * If not mounted with XATTR support then return EINVAL
2747                  */
2748 
2749                 if (!(ip->i_ufsvfs->vfs_vfs->vfs_flag & VFS_XATTR))
2750                         return (EINVAL);
2751                 /*
2752                  * We don't allow recursive attributes...
2753                  * Maybe someday we will.
2754                  */
2755                 if ((ip->i_cflags & IXATTR)) {
2756                         return (EINVAL);
2757                 }
2758 
2759                 if ((vp = dnlc_lookup(dvp, XATTR_DIR_NAME)) == NULL) {
2760                         error = ufs_xattr_getattrdir(dvp, &sip, flags, cr);
2761                         if (error) {
2762                                 *vpp = NULL;
2763                                 goto out;
2764                         }
2765 
2766                         vp = ITOV(sip);
2767                         dnlc_update(dvp, XATTR_DIR_NAME, vp);
2768                 }
2769 
2770                 /*
2771                  * Check accessibility of directory.
2772                  */
2773                 if (vp == DNLC_NO_VNODE) {
2774                         VN_RELE(vp);
2775                         error = ENOENT;
2776                         goto out;
2777                 }
2778                 if ((error = ufs_iaccess(VTOI(vp), IEXEC, cr, 1)) != 0) {
2779                         VN_RELE(vp);
2780                         goto out;
2781                 }
2782 
2783                 *vpp = vp;
2784                 return (0);
2785         }
2786 
2787         /*
2788          * Check for a null component, which we should treat as
2789          * looking at dvp from within it's parent, so we don't
2790          * need a call to ufs_iaccess(), as it has already been
2791          * done.
2792          */
2793         if (nm[0] == 0) {
2794                 VN_HOLD(dvp);
2795                 error = 0;
2796                 *vpp = dvp;
2797                 goto out;
2798         }
2799 
2800         /*
2801          * Check for "." ie itself. this is a quick check and
2802          * avoids adding "." into the dnlc (which have been seen
2803          * to occupy >10% of the cache).
2804          */
2805         if ((nm[0] == '.') && (nm[1] == 0)) {
2806                 /*
2807                  * Don't return without checking accessibility
2808                  * of the directory. We only need the lock if
2809                  * we are going to return it.
2810                  */
2811                 if ((error = ufs_iaccess(ip, IEXEC, cr, 1)) == 0) {
2812                         VN_HOLD(dvp);
2813                         *vpp = dvp;
2814                 }
2815                 goto out;
2816         }
2817 
2818         /*
2819          * Fast path: Check the directory name lookup cache.
2820          */
2821         if (vp = dnlc_lookup(dvp, nm)) {
2822                 /*
2823                  * Check accessibility of directory.
2824                  */
2825                 if ((error = ufs_iaccess(ip, IEXEC, cr, 1)) != 0) {
2826                         VN_RELE(vp);
2827                         goto out;
2828                 }
2829                 if (vp == DNLC_NO_VNODE) {
2830                         VN_RELE(vp);
2831                         error = ENOENT;
2832                         goto out;
2833                 }
2834                 xip = VTOI(vp);
2835                 ulp = NULL;
2836                 goto fastpath;
2837         }
2838 
2839         /*
2840          * Keep the idle queue from getting too long by
2841          * idling two inodes before attempting to allocate another.
2842          *    This operation must be performed before entering
2843          *    lockfs or a transaction.
2844          */
2845         if (ufs_idle_q.uq_ne > ufs_idle_q.uq_hiwat)
2846                 if ((curthread->t_flag & T_DONTBLOCK) == 0) {
2847                         ins.in_lidles.value.ul += ufs_lookup_idle_count;
2848                         ufs_idle_some(ufs_lookup_idle_count);
2849                 }
2850 
2851 retry_lookup:
2852         /*
2853          * Check accessibility of directory.
2854          */
2855         if (error = ufs_diraccess(ip, IEXEC, cr))
2856                 goto out;
2857 
2858         ufsvfsp = ip->i_ufsvfs;
2859         error = ufs_lockfs_begin(ufsvfsp, &ulp, ULOCKFS_LOOKUP_MASK);
2860         if (error)
2861                 goto out;
2862 
2863         error = ufs_dirlook(ip, nm, &xip, cr, 1, 0);
2864 
2865 fastpath:
2866         if (error == 0) {
2867                 ip = xip;
2868                 *vpp = ITOV(ip);
2869 
2870                 /*
2871                  * If vnode is a device return special vnode instead.
2872                  */
2873                 if (IS_DEVVP(*vpp)) {
2874                         struct vnode *newvp;
2875 
2876                         newvp = specvp(*vpp, (*vpp)->v_rdev, (*vpp)->v_type,
2877                             cr);
2878                         VN_RELE(*vpp);
2879                         if (newvp == NULL)
2880                                 error = ENOSYS;
2881                         else
2882                                 *vpp = newvp;
2883                 } else if (ip->i_cflags & ICOMPRESS) {
2884                         struct vnode *newvp;
2885 
2886                         /*
2887                          * Compressed file, substitute dcfs vnode
2888                          */
2889                         newvp = decompvp(*vpp, cr, ct);
2890                         VN_RELE(*vpp);
2891                         if (newvp == NULL)
2892                                 error = ENOSYS;
2893                         else
2894                                 *vpp = newvp;
2895                 }
2896         }
2897         if (ulp) {
2898                 ufs_lockfs_end(ulp);
2899         }
2900 
2901         if (error == EAGAIN)
2902                 goto retry_lookup;
2903 
2904 out:
2905         return (error);
2906 }
2907 
2908 /*ARGSUSED*/
2909 static int
2910 ufs_create(struct vnode *dvp, char *name, struct vattr *vap, enum vcexcl excl,
2911         int mode, struct vnode **vpp, struct cred *cr, int flag,
2912         caller_context_t *ct, vsecattr_t *vsecp)
2913 {
2914         struct inode *ip;
2915         struct inode *xip;
2916         struct inode *dip;
2917         struct vnode *xvp;
2918         struct ufsvfs *ufsvfsp;
2919         struct ulockfs *ulp;
2920         int error;
2921         int issync;
2922         int truncflag;
2923         int trans_size;
2924         int noentry;
2925         int defer_dip_seq_update = 0;   /* need to defer update of dip->i_seq */
2926         int retry = 1;
2927         int indeadlock;
2928 
2929 again:
2930         ip = VTOI(dvp);
2931         ufsvfsp = ip->i_ufsvfs;
2932         truncflag = 0;
2933 
2934         error = ufs_lockfs_begin(ufsvfsp, &ulp, ULOCKFS_CREATE_MASK);
2935         if (error)
2936                 goto out;
2937 
2938         if (ulp) {
2939                 trans_size = (int)TOP_CREATE_SIZE(ip);
2940                 TRANS_BEGIN_CSYNC(ufsvfsp, issync, TOP_CREATE, trans_size);
2941         }
2942 
2943         if ((vap->va_mode & VSVTX) && secpolicy_vnode_stky_modify(cr) != 0)
2944                 vap->va_mode &= ~VSVTX;
2945 
2946         if (*name == '\0') {
2947                 /*
2948                  * Null component name refers to the directory itself.
2949                  */
2950                 VN_HOLD(dvp);
2951                 /*
2952                  * Even though this is an error case, we need to grab the
2953                  * quota lock since the error handling code below is common.
2954                  */
2955                 rw_enter(&ufsvfsp->vfs_dqrwlock, RW_READER);
2956                 rw_enter(&ip->i_contents, RW_WRITER);
2957                 error = EEXIST;
2958         } else {
2959                 xip = NULL;
2960                 noentry = 0;
2961                 /*
2962                  * ufs_tryirwlock_trans uses rw_tryenter and checks for SLOCK
2963                  * to avoid i_rwlock, ufs_lockfs_begin deadlock. If deadlock
2964                  * possible, retries the operation.
2965                  */
2966                 ufs_tryirwlock_trans(&ip->i_rwlock, RW_WRITER, TOP_CREATE,
2967                     retry_dir);
2968                 if (indeadlock)
2969                         goto again;
2970 
2971                 xvp = dnlc_lookup(dvp, name);
2972                 if (xvp == DNLC_NO_VNODE) {
2973                         noentry = 1;
2974                         VN_RELE(xvp);
2975                         xvp = NULL;
2976                 }
2977                 if (xvp) {
2978                         rw_exit(&ip->i_rwlock);
2979                         if (error = ufs_iaccess(ip, IEXEC, cr, 1)) {
2980                                 VN_RELE(xvp);
2981                         } else {
2982                                 error = EEXIST;
2983                                 xip = VTOI(xvp);
2984                         }
2985                 } else {
2986                         /*
2987                          * Suppress file system full message if we will retry
2988                          */
2989                         error = ufs_direnter_cm(ip, name, DE_CREATE,
2990                             vap, &xip, cr, (noentry | (retry ? IQUIET : 0)));
2991                         if (error == EAGAIN) {
2992                                 if (ulp) {
2993                                         TRANS_END_CSYNC(ufsvfsp, error, issync,
2994                                             TOP_CREATE, trans_size);
2995                                         ufs_lockfs_end(ulp);
2996                                 }
2997                                 goto again;
2998                         }
2999                         rw_exit(&ip->i_rwlock);
3000                 }
3001                 ip = xip;
3002                 if (ip != NULL) {
3003                         rw_enter(&ufsvfsp->vfs_dqrwlock, RW_READER);
3004                         rw_enter(&ip->i_contents, RW_WRITER);
3005                 }
3006         }
3007 
3008         /*
3009          * If the file already exists and this is a non-exclusive create,
3010          * check permissions and allow access for non-directories.
3011          * Read-only create of an existing directory is also allowed.
3012          * We fail an exclusive create of anything which already exists.
3013          */
3014         if (error == EEXIST) {
3015                 dip = VTOI(dvp);
3016                 if (excl == NONEXCL) {
3017                         if ((((ip->i_mode & IFMT) == IFDIR) ||
3018                             ((ip->i_mode & IFMT) == IFATTRDIR)) &&
3019                             (mode & IWRITE))
3020                                 error = EISDIR;
3021                         else if (mode)
3022                                 error = ufs_iaccess(ip, mode, cr, 0);
3023                         else
3024                                 error = 0;
3025                 }
3026                 if (error) {
3027                         rw_exit(&ip->i_contents);
3028                         rw_exit(&ufsvfsp->vfs_dqrwlock);
3029                         VN_RELE(ITOV(ip));
3030                         goto unlock;
3031                 }
3032                 /*
3033                  * If the error EEXIST was set, then i_seq can not
3034                  * have been updated. The sequence number interface
3035                  * is defined such that a non-error VOP_CREATE must
3036                  * increase the dir va_seq it by at least one. If we
3037                  * have cleared the error, increase i_seq. Note that
3038                  * we are increasing the dir i_seq and in rare cases
3039                  * ip may actually be from the dvp, so we already have
3040                  * the locks and it will not be subject to truncation.
3041                  * In case we have to update i_seq of the parent
3042                  * directory dip, we have to defer it till we have
3043                  * released our locks on ip due to lock ordering requirements.
3044                  */
3045                 if (ip != dip)
3046                         defer_dip_seq_update = 1;
3047                 else
3048                         ip->i_seq++;
3049 
3050                 if (((ip->i_mode & IFMT) == IFREG) &&
3051                     (vap->va_mask & AT_SIZE) && vap->va_size == 0) {
3052                         /*
3053                          * Truncate regular files, if requested by caller.
3054                          * Grab i_rwlock to make sure no one else is
3055                          * currently writing to the file (we promised
3056                          * bmap we would do this).
3057                          * Must get the locks in the correct order.
3058                          */
3059                         if (ip->i_size == 0) {
3060                                 ip->i_flag |= ICHG | IUPD;
3061                                 ip->i_seq++;
3062                                 TRANS_INODE(ufsvfsp, ip);
3063                         } else {
3064                                 /*
3065                                  * Large Files: Why this check here?
3066                                  * Though we do it in vn_create() we really
3067                                  * want to guarantee that we do not destroy
3068                                  * Large file data by atomically checking
3069                                  * the size while holding the contents
3070                                  * lock.
3071                                  */
3072                                 if (flag && !(flag & FOFFMAX) &&
3073                                     ((ip->i_mode & IFMT) == IFREG) &&
3074                                     (ip->i_size > (offset_t)MAXOFF32_T)) {
3075                                         rw_exit(&ip->i_contents);
3076                                         rw_exit(&ufsvfsp->vfs_dqrwlock);
3077                                         error = EOVERFLOW;
3078                                         goto unlock;
3079                                 }
3080                                 if (TRANS_ISTRANS(ufsvfsp))
3081                                         truncflag++;
3082                                 else {
3083                                         rw_exit(&ip->i_contents);
3084                                         rw_exit(&ufsvfsp->vfs_dqrwlock);
3085                                         ufs_tryirwlock_trans(&ip->i_rwlock,
3086                                             RW_WRITER, TOP_CREATE,
3087                                             retry_file);
3088                                         if (indeadlock) {
3089                                                 VN_RELE(ITOV(ip));
3090                                                 goto again;
3091                                         }
3092                                         rw_enter(&ufsvfsp->vfs_dqrwlock,
3093                                             RW_READER);
3094                                         rw_enter(&ip->i_contents, RW_WRITER);
3095                                         (void) ufs_itrunc(ip, (u_offset_t)0, 0,
3096                                             cr);
3097                                         rw_exit(&ip->i_rwlock);
3098                                 }
3099 
3100                         }
3101                         if (error == 0) {
3102                                 vnevent_create(ITOV(ip), ct);
3103                         }
3104                 }
3105         }
3106 
3107         if (error) {
3108                 if (ip != NULL) {
3109                         rw_exit(&ufsvfsp->vfs_dqrwlock);
3110                         rw_exit(&ip->i_contents);
3111                 }
3112                 goto unlock;
3113         }
3114 
3115         *vpp = ITOV(ip);
3116         ITIMES(ip);
3117         rw_exit(&ip->i_contents);
3118         rw_exit(&ufsvfsp->vfs_dqrwlock);
3119 
3120         /*
3121          * If vnode is a device return special vnode instead.
3122          */
3123         if (!error && IS_DEVVP(*vpp)) {
3124                 struct vnode *newvp;
3125 
3126                 newvp = specvp(*vpp, (*vpp)->v_rdev, (*vpp)->v_type, cr);
3127                 VN_RELE(*vpp);
3128                 if (newvp == NULL) {
3129                         error = ENOSYS;
3130                         goto unlock;
3131                 }
3132                 truncflag = 0;
3133                 *vpp = newvp;
3134         }
3135 unlock:
3136 
3137         /*
3138          * Do the deferred update of the parent directory's sequence
3139          * number now.
3140          */
3141         if (defer_dip_seq_update == 1) {
3142                 rw_enter(&dip->i_contents, RW_READER);
3143                 mutex_enter(&dip->i_tlock);
3144                 dip->i_seq++;
3145                 mutex_exit(&dip->i_tlock);
3146                 rw_exit(&dip->i_contents);
3147         }
3148 
3149         if (ulp) {
3150                 int terr = 0;
3151 
3152                 TRANS_END_CSYNC(ufsvfsp, terr, issync, TOP_CREATE,
3153                     trans_size);
3154 
3155                 /*
3156                  * If we haven't had a more interesting failure
3157                  * already, then anything that might've happened
3158                  * here should be reported.
3159                  */
3160                 if (error == 0)
3161                         error = terr;
3162         }
3163 
3164         if (!error && truncflag) {
3165                 ufs_tryirwlock(&ip->i_rwlock, RW_WRITER, retry_trunc);
3166                 if (indeadlock) {
3167                         if (ulp)
3168                                 ufs_lockfs_end(ulp);
3169                         VN_RELE(ITOV(ip));
3170                         goto again;
3171                 }
3172                 (void) TRANS_ITRUNC(ip, (u_offset_t)0, 0, cr);
3173                 rw_exit(&ip->i_rwlock);
3174         }
3175 
3176         if (ulp)
3177                 ufs_lockfs_end(ulp);
3178 
3179         /*
3180          * If no inodes available, try to free one up out of the
3181          * pending delete queue.
3182          */
3183         if ((error == ENOSPC) && retry && TRANS_ISTRANS(ufsvfsp)) {
3184                 ufs_delete_drain_wait(ufsvfsp, 1);
3185                 retry = 0;
3186                 goto again;
3187         }
3188 
3189 out:
3190         return (error);
3191 }
3192 
3193 extern int ufs_idle_max;
3194 /*ARGSUSED*/
3195 static int
3196 ufs_remove(struct vnode *vp, char *nm, struct cred *cr,
3197         caller_context_t *ct, int flags)
3198 {
3199         struct inode *ip = VTOI(vp);
3200         struct ufsvfs *ufsvfsp  = ip->i_ufsvfs;
3201         struct ulockfs *ulp;
3202         vnode_t *rmvp = NULL;   /* Vnode corresponding to name being removed */
3203         int indeadlock;
3204         int error;
3205         int issync;
3206         int trans_size;
3207 
3208         /*
3209          * don't let the delete queue get too long
3210          */
3211         if (ufsvfsp == NULL) {
3212                 error = EIO;
3213                 goto out;
3214         }
3215         if (ufsvfsp->vfs_delete.uq_ne > ufs_idle_max)
3216                 ufs_delete_drain(vp->v_vfsp, 1, 1);
3217 
3218         error = ufs_eventlookup(vp, nm, cr, &rmvp);
3219         if (rmvp != NULL) {
3220                 /* Only send the event if there were no errors */
3221                 if (error == 0)
3222                         vnevent_remove(rmvp, vp, nm, ct);
3223                 VN_RELE(rmvp);
3224         }
3225 
3226 retry_remove:
3227         error = ufs_lockfs_begin(ufsvfsp, &ulp, ULOCKFS_REMOVE_MASK);
3228         if (error)
3229                 goto out;
3230 
3231         if (ulp)
3232                 TRANS_BEGIN_CSYNC(ufsvfsp, issync, TOP_REMOVE,
3233                     trans_size = (int)TOP_REMOVE_SIZE(VTOI(vp)));
3234 
3235         /*
3236          * ufs_tryirwlock_trans uses rw_tryenter and checks for SLOCK
3237          * to avoid i_rwlock, ufs_lockfs_begin deadlock. If deadlock
3238          * possible, retries the operation.
3239          */
3240         ufs_tryirwlock_trans(&ip->i_rwlock, RW_WRITER, TOP_REMOVE, retry);
3241         if (indeadlock)
3242                 goto retry_remove;
3243         error = ufs_dirremove(ip, nm, (struct inode *)0, (struct vnode *)0,
3244             DR_REMOVE, cr);
3245         rw_exit(&ip->i_rwlock);
3246 
3247         if (ulp) {
3248                 TRANS_END_CSYNC(ufsvfsp, error, issync, TOP_REMOVE, trans_size);
3249                 ufs_lockfs_end(ulp);
3250         }
3251 
3252 out:
3253         return (error);
3254 }
3255 
3256 /*
3257  * Link a file or a directory.  Only privileged processes are allowed to
3258  * make links to directories.
3259  */
3260 /*ARGSUSED*/
3261 static int
3262 ufs_link(struct vnode *tdvp, struct vnode *svp, char *tnm, struct cred *cr,
3263         caller_context_t *ct, int flags)
3264 {
3265         struct inode *sip;
3266         struct inode *tdp = VTOI(tdvp);
3267         struct ufsvfs *ufsvfsp = tdp->i_ufsvfs;
3268         struct ulockfs *ulp;
3269         struct vnode *realvp;
3270         int error;
3271         int issync;
3272         int trans_size;
3273         int isdev;
3274         int indeadlock;
3275 
3276 retry_link:
3277         error = ufs_lockfs_begin(ufsvfsp, &ulp, ULOCKFS_LINK_MASK);
3278         if (error)
3279                 goto out;
3280 
3281         if (ulp)
3282                 TRANS_BEGIN_CSYNC(ufsvfsp, issync, TOP_LINK,
3283                     trans_size = (int)TOP_LINK_SIZE(VTOI(tdvp)));
3284 
3285         if (VOP_REALVP(svp, &realvp, ct) == 0)
3286                 svp = realvp;
3287 
3288         /*
3289          * Make sure link for extended attributes is valid
3290          * We only support hard linking of attr in ATTRDIR to ATTRDIR
3291          *
3292          * Make certain we don't attempt to look at a device node as
3293          * a ufs inode.
3294          */
3295 
3296         isdev = IS_DEVVP(svp);
3297         if (((isdev == 0) && ((VTOI(svp)->i_cflags & IXATTR) == 0) &&
3298             ((tdp->i_mode & IFMT) == IFATTRDIR)) ||
3299             ((isdev == 0) && (VTOI(svp)->i_cflags & IXATTR) &&
3300             ((tdp->i_mode & IFMT) == IFDIR))) {
3301                 error = EINVAL;
3302                 goto unlock;
3303         }
3304 
3305         sip = VTOI(svp);
3306         if ((svp->v_type == VDIR &&
3307             secpolicy_fs_linkdir(cr, ufsvfsp->vfs_vfs) != 0) ||
3308             (sip->i_uid != crgetuid(cr) && secpolicy_basic_link(cr) != 0)) {
3309                 error = EPERM;
3310                 goto unlock;
3311         }
3312 
3313         /*
3314          * ufs_tryirwlock_trans uses rw_tryenter and checks for SLOCK
3315          * to avoid i_rwlock, ufs_lockfs_begin deadlock. If deadlock
3316          * possible, retries the operation.
3317          */
3318         ufs_tryirwlock_trans(&tdp->i_rwlock, RW_WRITER, TOP_LINK, retry);
3319         if (indeadlock)
3320                 goto retry_link;
3321         error = ufs_direnter_lr(tdp, tnm, DE_LINK, (struct inode *)0,
3322             sip, cr);
3323         rw_exit(&tdp->i_rwlock);
3324 
3325 unlock:
3326         if (ulp) {
3327                 TRANS_END_CSYNC(ufsvfsp, error, issync, TOP_LINK, trans_size);
3328                 ufs_lockfs_end(ulp);
3329         }
3330 
3331         if (!error) {
3332                 vnevent_link(svp, ct);
3333         }
3334 out:
3335         return (error);
3336 }
3337 
3338 uint64_t ufs_rename_retry_cnt;
3339 uint64_t ufs_rename_upgrade_retry_cnt;
3340 uint64_t ufs_rename_dircheck_retry_cnt;
3341 clock_t  ufs_rename_backoff_delay = 1;
3342 
3343 /*
3344  * Rename a file or directory.
3345  * We are given the vnode and entry string of the source and the
3346  * vnode and entry string of the place we want to move the source
3347  * to (the target). The essential operation is:
3348  *      unlink(target);
3349  *      link(source, target);
3350  *      unlink(source);
3351  * but "atomically".  Can't do full commit without saving state in
3352  * the inode on disk, which isn't feasible at this time.  Best we
3353  * can do is always guarantee that the TARGET exists.
3354  */
3355 
3356 /*ARGSUSED*/
3357 static int
3358 ufs_rename(
3359         struct vnode *sdvp,             /* old (source) parent vnode */
3360         char *snm,                      /* old (source) entry name */
3361         struct vnode *tdvp,             /* new (target) parent vnode */
3362         char *tnm,                      /* new (target) entry name */
3363         struct cred *cr,
3364         caller_context_t *ct,
3365         int flags)
3366 {
3367         struct inode *sip = NULL;       /* source inode */
3368         struct inode *ip = NULL;        /* check inode */
3369         struct inode *sdp;              /* old (source) parent inode */
3370         struct inode *tdp;              /* new (target) parent inode */
3371         struct vnode *svp = NULL;       /* source vnode */
3372         struct vnode *tvp = NULL;       /* target vnode, if it exists */
3373         struct vnode *realvp;
3374         struct ufsvfs *ufsvfsp;
3375         struct ulockfs *ulp = NULL;
3376         struct ufs_slot slot;
3377         timestruc_t now;
3378         int error;
3379         int issync;
3380         int trans_size;
3381         krwlock_t *first_lock;
3382         krwlock_t *second_lock;
3383         krwlock_t *reverse_lock;
3384         int serr, terr;
3385 
3386         sdp = VTOI(sdvp);
3387         slot.fbp = NULL;
3388         ufsvfsp = sdp->i_ufsvfs;
3389 
3390         if (VOP_REALVP(tdvp, &realvp, ct) == 0)
3391                 tdvp = realvp;
3392 
3393         /* Must do this before taking locks in case of DNLC miss */
3394         terr = ufs_eventlookup(tdvp, tnm, cr, &tvp);
3395         serr = ufs_eventlookup(sdvp, snm, cr, &svp);
3396 
3397         if ((serr == 0) && ((terr == 0) || (terr == ENOENT))) {
3398                 if (tvp != NULL)
3399                         vnevent_pre_rename_dest(tvp, tdvp, tnm, ct);
3400 
3401                 /*
3402                  * Notify the target directory of the rename event
3403                  * if source and target directories are not the same.
3404                  */
3405                 if (sdvp != tdvp)
3406                         vnevent_pre_rename_dest_dir(tdvp, svp, tnm, ct);
3407 
3408                 if (svp != NULL)
3409                         vnevent_pre_rename_src(svp, sdvp, snm, ct);
3410         }
3411 
3412         if (svp != NULL)
3413                 VN_RELE(svp);
3414 
3415 retry_rename:
3416         error = ufs_lockfs_begin(ufsvfsp, &ulp, ULOCKFS_RENAME_MASK);
3417         if (error)
3418                 goto unlock;
3419 
3420         if (ulp)
3421                 TRANS_BEGIN_CSYNC(ufsvfsp, issync, TOP_RENAME,
3422                     trans_size = (int)TOP_RENAME_SIZE(sdp));
3423 
3424         if (VOP_REALVP(tdvp, &realvp, ct) == 0)
3425                 tdvp = realvp;
3426 
3427         tdp = VTOI(tdvp);
3428 
3429         /*
3430          * We only allow renaming of attributes from ATTRDIR to ATTRDIR.
3431          */
3432         if ((tdp->i_mode & IFMT) != (sdp->i_mode & IFMT)) {
3433                 error = EINVAL;
3434                 goto unlock;
3435         }
3436 
3437         /*
3438          * Check accessibility of directory.
3439          */
3440         if (error = ufs_diraccess(sdp, IEXEC, cr))
3441                 goto unlock;
3442 
3443         /*
3444          * Look up inode of file we're supposed to rename.
3445          */
3446         gethrestime(&now);
3447         if (error = ufs_dirlook(sdp, snm, &sip, cr, 0, 0)) {
3448                 if (error == EAGAIN) {
3449                         if (ulp) {
3450                                 TRANS_END_CSYNC(ufsvfsp, error, issync,
3451                                     TOP_RENAME, trans_size);
3452                                 ufs_lockfs_end(ulp);
3453                         }
3454                         goto retry_rename;
3455                 }
3456 
3457                 goto unlock;
3458         }
3459 
3460         /*
3461          * Lock both the source and target directories (they may be
3462          * the same) to provide the atomicity semantics that was
3463          * previously provided by the per file system vfs_rename_lock
3464          *
3465          * with vfs_rename_lock removed to allow simultaneous renames
3466          * within a file system, ufs_dircheckpath can deadlock while
3467          * traversing back to ensure that source is not a parent directory
3468          * of target parent directory. This is because we get into
3469          * ufs_dircheckpath with the sdp and tdp locks held as RW_WRITER.
3470          * If the tdp and sdp of the simultaneous renames happen to be
3471          * in the path of each other, it can lead to a deadlock. This
3472          * can be avoided by getting the locks as RW_READER here and then
3473          * upgrading to RW_WRITER after completing the ufs_dircheckpath.
3474          *
3475          * We hold the target directory's i_rwlock after calling
3476          * ufs_lockfs_begin but in many other operations (like ufs_readdir)
3477          * VOP_RWLOCK is explicitly called by the filesystem independent code
3478          * before calling the file system operation. In these cases the order
3479          * is reversed (i.e i_rwlock is taken first and then ufs_lockfs_begin
3480          * is called). This is fine as long as ufs_lockfs_begin acts as a VOP
3481          * counter but with ufs_quiesce setting the SLOCK bit this becomes a
3482          * synchronizing object which might lead to a deadlock. So we use
3483          * rw_tryenter instead of rw_enter. If we fail to get this lock and
3484          * find that SLOCK bit is set, we call ufs_lockfs_end and restart the
3485          * operation.
3486          */
3487 retry:
3488         first_lock = &tdp->i_rwlock;
3489         second_lock = &sdp->i_rwlock;
3490 retry_firstlock:
3491         if (!rw_tryenter(first_lock, RW_READER)) {
3492                 /*
3493                  * We didn't get the lock. Check if the SLOCK is set in the
3494                  * ufsvfs. If yes, we might be in a deadlock. Safer to give up
3495                  * and wait for SLOCK to be cleared.
3496                  */
3497 
3498                 if (ulp && ULOCKFS_IS_SLOCK(ulp)) {
3499                         TRANS_END_CSYNC(ufsvfsp, error, issync, TOP_RENAME,
3500                             trans_size);
3501                         ufs_lockfs_end(ulp);
3502                         goto retry_rename;
3503 
3504                 } else {
3505                         /*
3506                          * SLOCK isn't set so this is a genuine synchronization
3507                          * case. Let's try again after giving them a breather.
3508                          */
3509                         delay(RETRY_LOCK_DELAY);
3510                         goto  retry_firstlock;
3511                 }
3512         }
3513         /*
3514          * Need to check if the tdp and sdp are same !!!
3515          */
3516         if ((tdp != sdp) && (!rw_tryenter(second_lock, RW_READER))) {
3517                 /*
3518                  * We didn't get the lock. Check if the SLOCK is set in the
3519                  * ufsvfs. If yes, we might be in a deadlock. Safer to give up
3520                  * and wait for SLOCK to be cleared.
3521                  */
3522 
3523                 rw_exit(first_lock);
3524                 if (ulp && ULOCKFS_IS_SLOCK(ulp)) {
3525                         TRANS_END_CSYNC(ufsvfsp, error, issync, TOP_RENAME,
3526                             trans_size);
3527                         ufs_lockfs_end(ulp);
3528                         goto retry_rename;
3529 
3530                 } else {
3531                         /*
3532                          * So we couldn't get the second level peer lock *and*
3533                          * the SLOCK bit isn't set. Too bad we can be
3534                          * contentding with someone wanting these locks otherway
3535                          * round. Reverse the locks in case there is a heavy
3536                          * contention for the second level lock.
3537                          */
3538                         reverse_lock = first_lock;
3539                         first_lock = second_lock;
3540                         second_lock = reverse_lock;
3541                         ufs_rename_retry_cnt++;
3542                         goto  retry_firstlock;
3543                 }
3544         }
3545 
3546         if (sip == tdp) {
3547                 error = EINVAL;
3548                 goto errout;
3549         }
3550         /*
3551          * Make sure we can delete the source entry.  This requires
3552          * write permission on the containing directory.
3553          * Check for sticky directories.
3554          */
3555         rw_enter(&sdp->i_contents, RW_READER);
3556         rw_enter(&sip->i_contents, RW_READER);
3557         if ((error = ufs_iaccess(sdp, IWRITE, cr, 0)) != 0 ||
3558             (error = ufs_sticky_remove_access(sdp, sip, cr)) != 0) {
3559                 rw_exit(&sip->i_contents);
3560                 rw_exit(&sdp->i_contents);
3561                 goto errout;
3562         }
3563 
3564         /*
3565          * If this is a rename of a directory and the parent is
3566          * different (".." must be changed), then the source
3567          * directory must not be in the directory hierarchy
3568          * above the target, as this would orphan everything
3569          * below the source directory.  Also the user must have
3570          * write permission in the source so as to be able to
3571          * change "..".
3572          */
3573         if ((((sip->i_mode & IFMT) == IFDIR) ||
3574             ((sip->i_mode & IFMT) == IFATTRDIR)) && sdp != tdp) {
3575                 ino_t   inum;
3576 
3577                 if (error = ufs_iaccess(sip, IWRITE, cr, 0)) {
3578                         rw_exit(&sip->i_contents);
3579                         rw_exit(&sdp->i_contents);
3580                         goto errout;
3581                 }
3582                 inum = sip->i_number;
3583                 rw_exit(&sip->i_contents);
3584                 rw_exit(&sdp->i_contents);
3585                 if ((error = ufs_dircheckpath(inum, tdp, sdp, cr))) {
3586                         /*
3587                          * If we got EAGAIN ufs_dircheckpath detected a
3588                          * potential deadlock and backed out. We need
3589                          * to retry the operation since sdp and tdp have
3590                          * to be released to avoid the deadlock.
3591                          */
3592                         if (error == EAGAIN) {
3593                                 rw_exit(&tdp->i_rwlock);
3594                                 if (tdp != sdp)
3595                                         rw_exit(&sdp->i_rwlock);
3596                                 delay(ufs_rename_backoff_delay);
3597                                 ufs_rename_dircheck_retry_cnt++;
3598                                 goto retry;
3599                         }
3600                         goto errout;
3601                 }
3602         } else {
3603                 rw_exit(&sip->i_contents);
3604                 rw_exit(&sdp->i_contents);
3605         }
3606 
3607 
3608         /*
3609          * Check for renaming '.' or '..' or alias of '.'
3610          */
3611         if (strcmp(snm, ".") == 0 || strcmp(snm, "..") == 0 || sdp == sip) {
3612                 error = EINVAL;
3613                 goto errout;
3614         }
3615 
3616         /*
3617          * Simultaneous renames can deadlock in ufs_dircheckpath since it
3618          * tries to traverse back the file tree with both tdp and sdp held
3619          * as RW_WRITER. To avoid that we have to hold the tdp and sdp locks
3620          * as RW_READERS  till ufs_dircheckpath is done.
3621          * Now that ufs_dircheckpath is done with, we can upgrade the locks
3622          * to RW_WRITER.
3623          */
3624         if (!rw_tryupgrade(&tdp->i_rwlock)) {
3625                 /*
3626                  * The upgrade failed. We got to give away the lock
3627                  * as to avoid deadlocking with someone else who is
3628                  * waiting for writer lock. With the lock gone, we
3629                  * cannot be sure the checks done above will hold
3630                  * good when we eventually get them back as writer.
3631                  * So if we can't upgrade we drop the locks and retry
3632                  * everything again.
3633                  */
3634                 rw_exit(&tdp->i_rwlock);
3635                 if (tdp != sdp)
3636                         rw_exit(&sdp->i_rwlock);
3637                 delay(ufs_rename_backoff_delay);
3638                 ufs_rename_upgrade_retry_cnt++;
3639                 goto retry;
3640         }
3641         if (tdp != sdp) {
3642                 if (!rw_tryupgrade(&sdp->i_rwlock)) {
3643                         /*
3644                          * The upgrade failed. We got to give away the lock
3645                          * as to avoid deadlocking with someone else who is
3646                          * waiting for writer lock. With the lock gone, we
3647                          * cannot be sure the checks done above will hold
3648                          * good when we eventually get them back as writer.
3649                          * So if we can't upgrade we drop the locks and retry
3650                          * everything again.
3651                          */
3652                         rw_exit(&tdp->i_rwlock);
3653                         rw_exit(&sdp->i_rwlock);
3654                         delay(ufs_rename_backoff_delay);
3655                         ufs_rename_upgrade_retry_cnt++;
3656                         goto retry;
3657                 }
3658         }
3659 
3660         /*
3661          * Now that all the locks are held check to make sure another thread
3662          * didn't slip in and take out the sip.
3663          */
3664         slot.status = NONE;
3665         if ((sip->i_ctime.tv_usec * 1000) > now.tv_nsec ||
3666             sip->i_ctime.tv_sec > now.tv_sec) {
3667                 rw_enter(&sdp->i_ufsvfs->vfs_dqrwlock, RW_READER);
3668                 rw_enter(&sdp->i_contents, RW_WRITER);
3669                 error = ufs_dircheckforname(sdp, snm, strlen(snm), &slot,
3670                     &ip, cr, 0);
3671                 rw_exit(&sdp->i_contents);
3672                 rw_exit(&sdp->i_ufsvfs->vfs_dqrwlock);
3673                 if (error) {
3674                         goto errout;
3675                 }
3676                 if (ip == NULL) {
3677                         error = ENOENT;
3678                         goto errout;
3679                 } else {
3680                         /*
3681                          * If the inode was found need to drop the v_count
3682                          * so as not to keep the filesystem from being
3683                          * unmounted at a later time.
3684                          */
3685                         VN_RELE(ITOV(ip));
3686                 }
3687 
3688                 /*
3689                  * Release the slot.fbp that has the page mapped and
3690                  * locked SE_SHARED, and could be used in in
3691                  * ufs_direnter_lr() which needs to get the SE_EXCL lock
3692                  * on said page.
3693                  */
3694                 if (slot.fbp) {
3695                         fbrelse(slot.fbp, S_OTHER);
3696                         slot.fbp = NULL;
3697                 }
3698         }
3699 
3700         /*
3701          * Link source to the target.
3702          */
3703         if (error = ufs_direnter_lr(tdp, tnm, DE_RENAME, sdp, sip, cr)) {
3704                 /*
3705                  * ESAME isn't really an error; it indicates that the
3706                  * operation should not be done because the source and target
3707                  * are the same file, but that no error should be reported.
3708                  */
3709                 if (error == ESAME)
3710                         error = 0;
3711                 goto errout;
3712         }
3713 
3714         if (error == 0 && tvp != NULL)
3715                 vnevent_rename_dest(tvp, tdvp, tnm, ct);
3716 
3717         /*
3718          * Unlink the source.
3719          * Remove the source entry.  ufs_dirremove() checks that the entry
3720          * still reflects sip, and returns an error if it doesn't.
3721          * If the entry has changed just forget about it.  Release
3722          * the source inode.
3723          */
3724         if ((error = ufs_dirremove(sdp, snm, sip, (struct vnode *)0,
3725             DR_RENAME, cr)) == ENOENT)
3726                 error = 0;
3727 
3728         if (error == 0) {
3729                 vnevent_rename_src(ITOV(sip), sdvp, snm, ct);
3730                 /*
3731                  * Notify the target directory of the rename event
3732                  * if source and target directories are not the same.
3733                  */
3734                 if (sdvp != tdvp)
3735                         vnevent_rename_dest_dir(tdvp, ct);
3736         }
3737 
3738 errout:
3739         if (slot.fbp)
3740                 fbrelse(slot.fbp, S_OTHER);
3741 
3742         rw_exit(&tdp->i_rwlock);
3743         if (sdp != tdp) {
3744                 rw_exit(&sdp->i_rwlock);
3745         }
3746 
3747 unlock:
3748         if (tvp != NULL)
3749                 VN_RELE(tvp);
3750         if (sip != NULL)
3751                 VN_RELE(ITOV(sip));
3752 
3753         if (ulp) {
3754                 TRANS_END_CSYNC(ufsvfsp, error, issync, TOP_RENAME, trans_size);
3755                 ufs_lockfs_end(ulp);
3756         }
3757 
3758         return (error);
3759 }
3760 
3761 /*ARGSUSED*/
3762 static int
3763 ufs_mkdir(struct vnode *dvp, char *dirname, struct vattr *vap,
3764         struct vnode **vpp, struct cred *cr, caller_context_t *ct, int flags,
3765         vsecattr_t *vsecp)
3766 {
3767         struct inode *ip;
3768         struct inode *xip;
3769         struct ufsvfs *ufsvfsp;
3770         struct ulockfs *ulp;
3771         int error;
3772         int issync;
3773         int trans_size;
3774         int indeadlock;
3775         int retry = 1;
3776 
3777         ASSERT((vap->va_mask & (AT_TYPE|AT_MODE)) == (AT_TYPE|AT_MODE));
3778 
3779         /*
3780          * Can't make directory in attr hidden dir
3781          */
3782         if ((VTOI(dvp)->i_mode & IFMT) == IFATTRDIR)
3783                 return (EINVAL);
3784 
3785 again:
3786         ip = VTOI(dvp);
3787         ufsvfsp = ip->i_ufsvfs;
3788         error = ufs_lockfs_begin(ufsvfsp, &ulp, ULOCKFS_MKDIR_MASK);
3789         if (error)
3790                 goto out;
3791         if (ulp)
3792                 TRANS_BEGIN_CSYNC(ufsvfsp, issync, TOP_MKDIR,
3793                     trans_size = (int)TOP_MKDIR_SIZE(ip));
3794 
3795         /*
3796          * ufs_tryirwlock_trans uses rw_tryenter and checks for SLOCK
3797          * to avoid i_rwlock, ufs_lockfs_begin deadlock. If deadlock
3798          * possible, retries the operation.
3799          */
3800         ufs_tryirwlock_trans(&ip->i_rwlock, RW_WRITER, TOP_MKDIR, retry);
3801         if (indeadlock)
3802                 goto again;
3803 
3804         error = ufs_direnter_cm(ip, dirname, DE_MKDIR, vap, &xip, cr,
3805             (retry ? IQUIET : 0));
3806         if (error == EAGAIN) {
3807                 if (ulp) {
3808                         TRANS_END_CSYNC(ufsvfsp, error, issync, TOP_MKDIR,
3809                             trans_size);
3810                         ufs_lockfs_end(ulp);
3811                 }
3812                 goto again;
3813         }
3814 
3815         rw_exit(&ip->i_rwlock);
3816         if (error == 0) {
3817                 ip = xip;
3818                 *vpp = ITOV(ip);
3819         } else if (error == EEXIST)
3820                 VN_RELE(ITOV(xip));
3821 
3822         if (ulp) {
3823                 int terr = 0;
3824                 TRANS_END_CSYNC(ufsvfsp, terr, issync, TOP_MKDIR, trans_size);
3825                 ufs_lockfs_end(ulp);
3826                 if (error == 0)
3827                         error = terr;
3828         }
3829 out:
3830         if ((error == ENOSPC) && retry && TRANS_ISTRANS(ufsvfsp)) {
3831                 ufs_delete_drain_wait(ufsvfsp, 1);
3832                 retry = 0;
3833                 goto again;
3834         }
3835 
3836         return (error);
3837 }
3838 
3839 /*ARGSUSED*/
3840 static int
3841 ufs_rmdir(struct vnode *vp, char *nm, struct vnode *cdir, struct cred *cr,
3842         caller_context_t *ct, int flags)
3843 {
3844         struct inode *ip = VTOI(vp);
3845         struct ufsvfs *ufsvfsp = ip->i_ufsvfs;
3846         struct ulockfs *ulp;
3847         vnode_t *rmvp = NULL;   /* Vnode of removed directory */
3848         int error;
3849         int issync;
3850         int trans_size;
3851         int indeadlock;
3852 
3853         /*
3854          * don't let the delete queue get too long
3855          */
3856         if (ufsvfsp == NULL) {
3857                 error = EIO;
3858                 goto out;
3859         }
3860         if (ufsvfsp->vfs_delete.uq_ne > ufs_idle_max)
3861                 ufs_delete_drain(vp->v_vfsp, 1, 1);
3862 
3863         error = ufs_eventlookup(vp, nm, cr, &rmvp);
3864         if (rmvp != NULL) {
3865                 /* Only send the event if there were no errors */
3866                 if (error == 0)
3867                         vnevent_rmdir(rmvp, vp, nm, ct);
3868                 VN_RELE(rmvp);
3869         }
3870 
3871 retry_rmdir:
3872         error = ufs_lockfs_begin(ufsvfsp, &ulp, ULOCKFS_RMDIR_MASK);
3873         if (error)
3874                 goto out;
3875 
3876         if (ulp)
3877                 TRANS_BEGIN_CSYNC(ufsvfsp, issync, TOP_RMDIR,
3878                     trans_size = TOP_RMDIR_SIZE);
3879 
3880         /*
3881          * ufs_tryirwlock_trans uses rw_tryenter and checks for SLOCK
3882          * to avoid i_rwlock, ufs_lockfs_begin deadlock. If deadlock
3883          * possible, retries the operation.
3884          */
3885         ufs_tryirwlock_trans(&ip->i_rwlock, RW_WRITER, TOP_RMDIR, retry);
3886         if (indeadlock)
3887                 goto retry_rmdir;
3888         error = ufs_dirremove(ip, nm, (struct inode *)0, cdir, DR_RMDIR, cr);
3889 
3890         rw_exit(&ip->i_rwlock);
3891 
3892         if (ulp) {
3893                 TRANS_END_CSYNC(ufsvfsp, error, issync, TOP_RMDIR,
3894                     trans_size);
3895                 ufs_lockfs_end(ulp);
3896         }
3897 
3898 out:
3899         return (error);
3900 }
3901 
3902 /* ARGSUSED */
3903 static int
3904 ufs_readdir(
3905         struct vnode *vp,
3906         struct uio *uiop,
3907         struct cred *cr,
3908         int *eofp,
3909         caller_context_t *ct,
3910         int flags)
3911 {
3912         struct iovec *iovp;
3913         struct inode *ip;
3914         struct direct *idp;
3915         struct dirent64 *odp;
3916         struct fbuf *fbp;
3917         struct ufsvfs *ufsvfsp;
3918         struct ulockfs *ulp;
3919         caddr_t outbuf;
3920         size_t bufsize;
3921         uint_t offset;
3922         uint_t bytes_wanted, total_bytes_wanted;
3923         int incount = 0;
3924         int outcount = 0;
3925         int error;
3926 
3927         ip = VTOI(vp);
3928         ASSERT(RW_READ_HELD(&ip->i_rwlock));
3929 
3930         if (uiop->uio_loffset >= MAXOFF32_T) {
3931                 if (eofp)
3932                         *eofp = 1;
3933                 return (0);
3934         }
3935 
3936         /*
3937          * Check if we have been called with a valid iov_len
3938          * and bail out if not, otherwise we may potentially loop
3939          * forever further down.
3940          */
3941         if (uiop->uio_iov->iov_len <= 0) {
3942                 error = EINVAL;
3943                 goto out;
3944         }
3945 
3946         /*
3947          * Large Files: When we come here we are guaranteed that
3948          * uio_offset can be used safely. The high word is zero.
3949          */
3950 
3951         ufsvfsp = ip->i_ufsvfs;
3952         error = ufs_lockfs_begin(ufsvfsp, &ulp, ULOCKFS_READDIR_MASK);
3953         if (error)
3954                 goto out;
3955 
3956         iovp = uiop->uio_iov;
3957         total_bytes_wanted = iovp->iov_len;
3958 
3959         /* Large Files: directory files should not be "large" */
3960 
3961         ASSERT(ip->i_size <= MAXOFF32_T);
3962 
3963         /* Force offset to be valid (to guard against bogus lseek() values) */
3964         offset = (uint_t)uiop->uio_offset & ~(DIRBLKSIZ - 1);
3965 
3966         /* Quit if at end of file or link count of zero (posix) */
3967         if (offset >= (uint_t)ip->i_size || ip->i_nlink <= 0) {
3968                 if (eofp)
3969                         *eofp = 1;
3970                 error = 0;
3971                 goto unlock;
3972         }
3973 
3974         /*
3975          * Get space to change directory entries into fs independent format.
3976          * Do fast alloc for the most commonly used-request size (filesystem
3977          * block size).
3978          */
3979         if (uiop->uio_segflg != UIO_SYSSPACE || uiop->uio_iovcnt != 1) {
3980                 bufsize = total_bytes_wanted;
3981                 outbuf = kmem_alloc(bufsize, KM_SLEEP);
3982                 odp = (struct dirent64 *)outbuf;
3983         } else {
3984                 bufsize = total_bytes_wanted;
3985                 odp = (struct dirent64 *)iovp->iov_base;
3986         }
3987 
3988 nextblk:
3989         bytes_wanted = total_bytes_wanted;
3990 
3991         /* Truncate request to file size */
3992         if (offset + bytes_wanted > (int)ip->i_size)
3993                 bytes_wanted = (int)(ip->i_size - offset);
3994 
3995         /* Comply with MAXBSIZE boundary restrictions of fbread() */
3996         if ((offset & MAXBOFFSET) + bytes_wanted > MAXBSIZE)
3997                 bytes_wanted = MAXBSIZE - (offset & MAXBOFFSET);
3998 
3999         /*
4000          * Read in the next chunk.
4001          * We are still holding the i_rwlock.
4002          */
4003         error = fbread(vp, (offset_t)offset, bytes_wanted, S_OTHER, &fbp);
4004 
4005         if (error)
4006                 goto update_inode;
4007         if (!ULOCKFS_IS_NOIACC(ITOUL(ip)) && (ip->i_fs->fs_ronly == 0) &&
4008             (!ufsvfsp->vfs_noatime)) {
4009                 ip->i_flag |= IACC;
4010         }
4011         incount = 0;
4012         idp = (struct direct *)fbp->fb_addr;
4013         if (idp->d_ino == 0 && idp->d_reclen == 0 && idp->d_namlen == 0) {
4014                 cmn_err(CE_WARN, "ufs_readdir: bad dir, inumber = %llu, "
4015                     "fs = %s\n",
4016                     (u_longlong_t)ip->i_number, ufsvfsp->vfs_fs->fs_fsmnt);
4017                 fbrelse(fbp, S_OTHER);
4018                 error = ENXIO;
4019                 goto update_inode;
4020         }
4021         /* Transform to file-system independent format */
4022         while (incount < bytes_wanted) {
4023                 /*
4024                  * If the current directory entry is mangled, then skip
4025                  * to the next block.  It would be nice to set the FSBAD
4026                  * flag in the super-block so that a fsck is forced on
4027                  * next reboot, but locking is a problem.
4028                  */
4029                 if (idp->d_reclen & 0x3) {
4030                         offset = (offset + DIRBLKSIZ) & ~(DIRBLKSIZ-1);
4031                         break;
4032                 }
4033 
4034                 /* Skip to requested offset and skip empty entries */
4035                 if (idp->d_ino != 0 && offset >= (uint_t)uiop->uio_offset) {
4036                         ushort_t this_reclen =
4037                             DIRENT64_RECLEN(idp->d_namlen);
4038                         /* Buffer too small for any entries */
4039                         if (!outcount && this_reclen > bufsize) {
4040                                 fbrelse(fbp, S_OTHER);
4041                                 error = EINVAL;
4042                                 goto update_inode;
4043                         }
4044                         /* If would overrun the buffer, quit */
4045                         if (outcount + this_reclen > bufsize) {
4046                                 break;
4047                         }
4048                         /* Take this entry */
4049                         odp->d_ino = (ino64_t)idp->d_ino;
4050                         odp->d_reclen = (ushort_t)this_reclen;
4051                         odp->d_off = (offset_t)(offset + idp->d_reclen);
4052 
4053                         /* use strncpy(9f) to zero out uninitialized bytes */
4054 
4055                         ASSERT(strlen(idp->d_name) + 1 <=
4056                             DIRENT64_NAMELEN(this_reclen));
4057                         (void) strncpy(odp->d_name, idp->d_name,
4058                             DIRENT64_NAMELEN(this_reclen));
4059                         outcount += odp->d_reclen;
4060                         odp = (struct dirent64 *)
4061                             ((intptr_t)odp + odp->d_reclen);
4062                         ASSERT(outcount <= bufsize);
4063                 }
4064                 if (idp->d_reclen) {
4065                         incount += idp->d_reclen;
4066                         offset += idp->d_reclen;
4067                         idp = (struct direct *)((intptr_t)idp + idp->d_reclen);
4068                 } else {
4069                         offset = (offset + DIRBLKSIZ) & ~(DIRBLKSIZ-1);
4070                         break;
4071                 }
4072         }
4073         /* Release the chunk */
4074         fbrelse(fbp, S_OTHER);
4075 
4076         /* Read whole block, but got no entries, read another if not eof */
4077 
4078         /*
4079          * Large Files: casting i_size to int here is not a problem
4080          * because directory sizes are always less than MAXOFF32_T.
4081          * See assertion above.
4082          */
4083 
4084         if (offset < (int)ip->i_size && !outcount)
4085                 goto nextblk;
4086 
4087         /* Copy out the entry data */
4088         if (uiop->uio_segflg == UIO_SYSSPACE && uiop->uio_iovcnt == 1) {
4089                 iovp->iov_base += outcount;
4090                 iovp->iov_len -= outcount;
4091                 uiop->uio_resid -= outcount;
4092                 uiop->uio_offset = offset;
4093         } else if ((error = uiomove(outbuf, (long)outcount, UIO_READ,
4094             uiop)) == 0)
4095                 uiop->uio_offset = offset;
4096 update_inode:
4097         ITIMES(ip);
4098         if (uiop->uio_segflg != UIO_SYSSPACE || uiop->uio_iovcnt != 1)
4099                 kmem_free(outbuf, bufsize);
4100 
4101         if (eofp && error == 0)
4102                 *eofp = (uiop->uio_offset >= (int)ip->i_size);
4103 unlock:
4104         if (ulp) {
4105                 ufs_lockfs_end(ulp);
4106         }
4107 out:
4108         return (error);
4109 }
4110 
4111 /*ARGSUSED*/
4112 static int
4113 ufs_symlink(
4114         struct vnode *dvp,              /* ptr to parent dir vnode */
4115         char *linkname,                 /* name of symbolic link */
4116         struct vattr *vap,              /* attributes */
4117         char *target,                   /* target path */
4118         struct cred *cr,                /* user credentials */
4119         caller_context_t *ct,
4120         int flags)
4121 {
4122         struct inode *ip, *dip = VTOI(dvp);
4123         struct ufsvfs *ufsvfsp = dip->i_ufsvfs;
4124         struct ulockfs *ulp;
4125         int error;
4126         int issync;
4127         int trans_size;
4128         int residual;
4129         int ioflag;
4130         int retry = 1;
4131 
4132         /*
4133          * No symlinks in attrdirs at this time
4134          */
4135         if ((VTOI(dvp)->i_mode & IFMT) == IFATTRDIR)
4136                 return (EINVAL);
4137 
4138 again:
4139         ip = (struct inode *)NULL;
4140         vap->va_type = VLNK;
4141         vap->va_rdev = 0;
4142 
4143         error = ufs_lockfs_begin(ufsvfsp, &ulp, ULOCKFS_SYMLINK_MASK);
4144         if (error)
4145                 goto out;
4146 
4147         if (ulp)
4148                 TRANS_BEGIN_CSYNC(ufsvfsp, issync, TOP_SYMLINK,
4149                     trans_size = (int)TOP_SYMLINK_SIZE(dip));
4150 
4151         /*
4152          * We must create the inode before the directory entry, to avoid
4153          * racing with readlink().  ufs_dirmakeinode requires that we
4154          * hold the quota lock as reader, and directory locks as writer.
4155          */
4156 
4157         rw_enter(&dip->i_rwlock, RW_WRITER);
4158         rw_enter(&ufsvfsp->vfs_dqrwlock, RW_READER);
4159         rw_enter(&dip->i_contents, RW_WRITER);
4160 
4161         /*
4162          * Suppress any out of inodes messages if we will retry on
4163          * ENOSP
4164          */
4165         if (retry)
4166                 dip->i_flag |= IQUIET;
4167 
4168         error = ufs_dirmakeinode(dip, &ip, vap, DE_SYMLINK, cr);
4169 
4170         dip->i_flag &= ~IQUIET;
4171 
4172         rw_exit(&dip->i_contents);
4173         rw_exit(&ufsvfsp->vfs_dqrwlock);
4174         rw_exit(&dip->i_rwlock);
4175 
4176         if (error)
4177                 goto unlock;
4178 
4179         /*
4180          * OK.  The inode has been created.  Write out the data of the
4181          * symbolic link.  Since symbolic links are metadata, and should
4182          * remain consistent across a system crash, we need to force the
4183          * data out synchronously.
4184          *
4185          * (This is a change from the semantics in earlier releases, which
4186          * only created symbolic links synchronously if the semi-documented
4187          * 'syncdir' option was set, or if we were being invoked by the NFS
4188          * server, which requires symbolic links to be created synchronously.)
4189          *
4190          * We need to pass in a pointer for the residual length; otherwise
4191          * ufs_rdwri() will always return EIO if it can't write the data,
4192          * even if the error was really ENOSPC or EDQUOT.
4193          */
4194 
4195         ioflag = FWRITE | FDSYNC;
4196         residual = 0;
4197 
4198         rw_enter(&ufsvfsp->vfs_dqrwlock, RW_READER);
4199         rw_enter(&ip->i_contents, RW_WRITER);
4200 
4201         /*
4202          * Suppress file system full messages if we will retry
4203          */
4204         if (retry)
4205                 ip->i_flag |= IQUIET;
4206 
4207         error = ufs_rdwri(UIO_WRITE, ioflag, ip, target, strlen(target),
4208             (offset_t)0, UIO_SYSSPACE, &residual, cr);
4209 
4210         ip->i_flag &= ~IQUIET;
4211 
4212         if (error) {
4213                 rw_exit(&ip->i_contents);
4214                 rw_exit(&ufsvfsp->vfs_dqrwlock);
4215                 goto remove;
4216         }
4217 
4218         /*
4219          * If the link's data is small enough, we can cache it in the inode.
4220          * This is a "fast symbolic link".  We don't use the first direct
4221          * block because that's actually used to point at the symbolic link's
4222          * contents on disk; but we know that none of the other direct or
4223          * indirect blocks can be used because symbolic links are restricted
4224          * to be smaller than a file system block.
4225          */
4226 
4227         ASSERT(MAXPATHLEN <= VBSIZE(ITOV(ip)));
4228 
4229         if (ip->i_size > 0 && ip->i_size <= FSL_SIZE) {
4230                 if (kcopy(target, &ip->i_db[1], ip->i_size) == 0) {
4231                         ip->i_flag |= IFASTSYMLNK;
4232                 } else {
4233                         int i;
4234                         /* error, clear garbage left behind */
4235                         for (i = 1; i < NDADDR; i++)
4236                                 ip->i_db[i] = 0;
4237                         for (i = 0; i < NIADDR; i++)
4238                                 ip->i_ib[i] = 0;
4239                 }
4240         }
4241 
4242         rw_exit(&ip->i_contents);
4243         rw_exit(&ufsvfsp->vfs_dqrwlock);
4244 
4245         /*
4246          * OK.  We've successfully created the symbolic link.  All that
4247          * remains is to insert it into the appropriate directory.
4248          */
4249 
4250         rw_enter(&dip->i_rwlock, RW_WRITER);
4251         error = ufs_direnter_lr(dip, linkname, DE_SYMLINK, NULL, ip, cr);
4252         rw_exit(&dip->i_rwlock);
4253 
4254         /*
4255          * Fall through into remove-on-error code.  We're either done, or we
4256          * need to remove the inode (if we couldn't insert it).
4257          */
4258 
4259 remove:
4260         if (error && (ip != NULL)) {
4261                 rw_enter(&ip->i_contents, RW_WRITER);
4262                 ip->i_nlink--;
4263                 ip->i_flag |= ICHG;
4264                 ip->i_seq++;
4265                 ufs_setreclaim(ip);
4266                 rw_exit(&ip->i_contents);
4267         }
4268 
4269 unlock:
4270         if (ip != NULL)
4271                 VN_RELE(ITOV(ip));
4272 
4273         if (ulp) {
4274                 int terr = 0;
4275 
4276                 TRANS_END_CSYNC(ufsvfsp, terr, issync, TOP_SYMLINK,
4277                     trans_size);
4278                 ufs_lockfs_end(ulp);
4279                 if (error == 0)
4280                         error = terr;
4281         }
4282 
4283         /*
4284          * We may have failed due to lack of an inode or of a block to
4285          * store the target in.  Try flushing the delete queue to free
4286          * logically-available things up and try again.
4287          */
4288         if ((error == ENOSPC) && retry && TRANS_ISTRANS(ufsvfsp)) {
4289                 ufs_delete_drain_wait(ufsvfsp, 1);
4290                 retry = 0;
4291                 goto again;
4292         }
4293 
4294 out:
4295         return (error);
4296 }
4297 
4298 /*
4299  * Ufs specific routine used to do ufs io.
4300  */
4301 int
4302 ufs_rdwri(enum uio_rw rw, int ioflag, struct inode *ip, caddr_t base,
4303         ssize_t len, offset_t offset, enum uio_seg seg, int *aresid,
4304         struct cred *cr)
4305 {
4306         struct uio auio;
4307         struct iovec aiov;
4308         int error;
4309 
4310         ASSERT(RW_LOCK_HELD(&ip->i_contents));
4311 
4312         bzero((caddr_t)&auio, sizeof (uio_t));
4313         bzero((caddr_t)&aiov, sizeof (iovec_t));
4314 
4315         aiov.iov_base = base;
4316         aiov.iov_len = len;
4317         auio.uio_iov = &aiov;
4318         auio.uio_iovcnt = 1;
4319         auio.uio_loffset = offset;
4320         auio.uio_segflg = (short)seg;
4321         auio.uio_resid = len;
4322 
4323         if (rw == UIO_WRITE) {
4324                 auio.uio_fmode = FWRITE;
4325                 auio.uio_extflg = UIO_COPY_DEFAULT;
4326                 auio.uio_llimit = curproc->p_fsz_ctl;
4327                 error = wrip(ip, &auio, ioflag, cr);
4328         } else {
4329                 auio.uio_fmode = FREAD;
4330                 auio.uio_extflg = UIO_COPY_CACHED;
4331                 auio.uio_llimit = MAXOFFSET_T;
4332                 error = rdip(ip, &auio, ioflag, cr);
4333         }
4334 
4335         if (aresid) {
4336                 *aresid = auio.uio_resid;
4337         } else if (auio.uio_resid) {
4338                 error = EIO;
4339         }
4340         return (error);
4341 }
4342 
4343 /*ARGSUSED*/
4344 static int
4345 ufs_fid(struct vnode *vp, struct fid *fidp, caller_context_t *ct)
4346 {
4347         struct ufid *ufid;
4348         struct inode *ip = VTOI(vp);
4349 
4350         if (ip->i_ufsvfs == NULL)
4351                 return (EIO);
4352 
4353         if (fidp->fid_len < (sizeof (struct ufid) - sizeof (ushort_t))) {
4354                 fidp->fid_len = sizeof (struct ufid) - sizeof (ushort_t);
4355                 return (ENOSPC);
4356         }
4357 
4358         ufid = (struct ufid *)fidp;
4359         bzero((char *)ufid, sizeof (struct ufid));
4360         ufid->ufid_len = sizeof (struct ufid) - sizeof (ushort_t);
4361         ufid->ufid_ino = ip->i_number;
4362         ufid->ufid_gen = ip->i_gen;
4363 
4364         return (0);
4365 }
4366 
4367 /* ARGSUSED2 */
4368 static int
4369 ufs_rwlock(struct vnode *vp, int write_lock, caller_context_t *ctp)
4370 {
4371         struct inode    *ip = VTOI(vp);
4372         struct ufsvfs   *ufsvfsp;
4373         int             forcedirectio;
4374 
4375         /*
4376          * Read case is easy.
4377          */
4378         if (!write_lock) {
4379                 rw_enter(&ip->i_rwlock, RW_READER);
4380                 return (V_WRITELOCK_FALSE);
4381         }
4382 
4383         /*
4384          * Caller has requested a writer lock, but that inhibits any
4385          * concurrency in the VOPs that follow. Acquire the lock shared
4386          * and defer exclusive access until it is known to be needed in
4387          * other VOP handlers. Some cases can be determined here.
4388          */
4389 
4390         /*
4391          * If directio is not set, there is no chance of concurrency,
4392          * so just acquire the lock exclusive. Beware of a forced
4393          * unmount before looking at the mount option.
4394          */
4395         ufsvfsp = ip->i_ufsvfs;
4396         forcedirectio = ufsvfsp ? ufsvfsp->vfs_forcedirectio : 0;
4397         if (!(ip->i_flag & IDIRECTIO || forcedirectio) ||
4398             !ufs_allow_shared_writes) {
4399                 rw_enter(&ip->i_rwlock, RW_WRITER);
4400                 return (V_WRITELOCK_TRUE);
4401         }
4402 
4403         /*
4404          * Mandatory locking forces acquiring i_rwlock exclusive.
4405          */
4406         if (MANDLOCK(vp, ip->i_mode)) {
4407                 rw_enter(&ip->i_rwlock, RW_WRITER);
4408                 return (V_WRITELOCK_TRUE);
4409         }
4410 
4411         /*
4412          * Acquire the lock shared in case a concurrent write follows.
4413          * Mandatory locking could have become enabled before the lock
4414          * was acquired. Re-check and upgrade if needed.
4415          */
4416         rw_enter(&ip->i_rwlock, RW_READER);
4417         if (MANDLOCK(vp, ip->i_mode)) {
4418                 rw_exit(&ip->i_rwlock);
4419                 rw_enter(&ip->i_rwlock, RW_WRITER);
4420                 return (V_WRITELOCK_TRUE);
4421         }
4422         return (V_WRITELOCK_FALSE);
4423 }
4424 
4425 /*ARGSUSED*/
4426 static void
4427 ufs_rwunlock(struct vnode *vp, int write_lock, caller_context_t *ctp)
4428 {
4429         struct inode    *ip = VTOI(vp);
4430 
4431         rw_exit(&ip->i_rwlock);
4432 }
4433 
4434 /* ARGSUSED */
4435 static int
4436 ufs_seek(struct vnode *vp, offset_t ooff, offset_t *noffp,
4437         caller_context_t *ct)
4438 {
4439         return ((*noffp < 0 || *noffp > MAXOFFSET_T) ? EINVAL : 0);
4440 }
4441 
4442 /* ARGSUSED */
4443 static int
4444 ufs_frlock(struct vnode *vp, int cmd, struct flock64 *bfp, int flag,
4445         offset_t offset, struct flk_callback *flk_cbp, struct cred *cr,
4446         caller_context_t *ct)
4447 {
4448         struct inode *ip = VTOI(vp);
4449 
4450         if (ip->i_ufsvfs == NULL)
4451                 return (EIO);
4452 
4453         /*
4454          * If file is being mapped, disallow frlock.
4455          * XXX I am not holding tlock while checking i_mapcnt because the
4456          * current locking strategy drops all locks before calling fs_frlock.
4457          * So, mapcnt could change before we enter fs_frlock making is
4458          * meaningless to have held tlock in the first place.
4459          */
4460         if (ip->i_mapcnt > 0 && MANDLOCK(vp, ip->i_mode))
4461                 return (EAGAIN);
4462         return (fs_frlock(vp, cmd, bfp, flag, offset, flk_cbp, cr, ct));
4463 }
4464 
4465 /* ARGSUSED */
4466 static int
4467 ufs_space(struct vnode *vp, int cmd, struct flock64 *bfp, int flag,
4468         offset_t offset, cred_t *cr, caller_context_t *ct)
4469 {
4470         struct ufsvfs *ufsvfsp = VTOI(vp)->i_ufsvfs;
4471         struct ulockfs *ulp;
4472         int error;
4473 
4474         if ((error = convoff(vp, bfp, 0, offset)) == 0) {
4475                 if (cmd == F_FREESP) {
4476                         error = ufs_lockfs_begin(ufsvfsp, &ulp,
4477                             ULOCKFS_SPACE_MASK);
4478                         if (error)
4479                                 return (error);
4480                         error = ufs_freesp(vp, bfp, flag, cr);
4481 
4482                         if (error == 0 && bfp->l_start == 0)
4483                                 vnevent_truncate(vp, ct);
4484                 } else if (cmd == F_ALLOCSP) {
4485                         error = ufs_lockfs_begin(ufsvfsp, &ulp,
4486                             ULOCKFS_FALLOCATE_MASK);
4487                         if (error)
4488                                 return (error);
4489                         error = ufs_allocsp(vp, bfp, cr);
4490                 } else
4491                         return (EINVAL); /* Command not handled here */
4492 
4493                 if (ulp)
4494                         ufs_lockfs_end(ulp);
4495 
4496         }
4497         return (error);
4498 }
4499 
4500 /*
4501  * Used to determine if read ahead should be done. Also used to
4502  * to determine when write back occurs.
4503  */
4504 #define CLUSTSZ(ip)             ((ip)->i_ufsvfs->vfs_ioclustsz)
4505 
4506 /*
4507  * A faster version of ufs_getpage.
4508  *
4509  * We optimize by inlining the pvn_getpages iterator, eliminating
4510  * calls to bmap_read if file doesn't have UFS holes, and avoiding
4511  * the overhead of page_exists().
4512  *
4513  * When files has UFS_HOLES and ufs_getpage is called with S_READ,
4514  * we set *protp to PROT_READ to avoid calling bmap_read. This approach
4515  * victimizes performance when a file with UFS holes is faulted
4516  * first in the S_READ mode, and then in the S_WRITE mode. We will get
4517  * two MMU faults in this case.
4518  *
4519  * XXX - the inode fields which control the sequential mode are not
4520  *       protected by any mutex. The read ahead will act wild if
4521  *       multiple processes will access the file concurrently and
4522  *       some of them in sequential mode. One particulary bad case
4523  *       is if another thread will change the value of i_nextrio between
4524  *       the time this thread tests the i_nextrio value and then reads it
4525  *       again to use it as the offset for the read ahead.
4526  */
4527 /*ARGSUSED*/
4528 static int
4529 ufs_getpage(struct vnode *vp, offset_t off, size_t len, uint_t *protp,
4530         page_t *plarr[], size_t plsz, struct seg *seg, caddr_t addr,
4531         enum seg_rw rw, struct cred *cr, caller_context_t *ct)
4532 {
4533         u_offset_t      uoff = (u_offset_t)off; /* type conversion */
4534         u_offset_t      pgoff;
4535         u_offset_t      eoff;
4536         struct inode    *ip = VTOI(vp);
4537         struct ufsvfs   *ufsvfsp = ip->i_ufsvfs;
4538         struct fs       *fs;
4539         struct ulockfs  *ulp;
4540         page_t          **pl;
4541         caddr_t         pgaddr;
4542         krw_t           rwtype;
4543         int             err;
4544         int             has_holes;
4545         int             beyond_eof;
4546         int             seqmode;
4547         int             pgsize = PAGESIZE;
4548         int             dolock;
4549         int             do_qlock;
4550         int             trans_size;
4551 
4552         ASSERT((uoff & PAGEOFFSET) == 0);
4553 
4554         if (protp)
4555                 *protp = PROT_ALL;
4556 
4557         /*
4558          * Obey the lockfs protocol
4559          */
4560         err = ufs_lockfs_begin_getpage(ufsvfsp, &ulp, seg,
4561             rw == S_READ || rw == S_EXEC, protp);
4562         if (err)
4563                 goto out;
4564 
4565         fs = ufsvfsp->vfs_fs;
4566 
4567         if (ulp && (rw == S_CREATE || rw == S_WRITE) &&
4568             !(vp->v_flag & VISSWAP)) {
4569                 /*
4570                  * Try to start a transaction, will return if blocking is
4571                  * expected to occur and the address space is not the
4572                  * kernel address space.
4573                  */
4574                 trans_size = TOP_GETPAGE_SIZE(ip);
4575                 if (seg->s_as != &kas) {
4576                         TRANS_TRY_BEGIN_ASYNC(ufsvfsp, TOP_GETPAGE,
4577                             trans_size, err)
4578                         if (err == EWOULDBLOCK) {
4579                                 /*
4580                                  * Use EDEADLK here because the VM code
4581                                  * can normally never see this error.
4582                                  */
4583                                 err = EDEADLK;
4584                                 ufs_lockfs_end(ulp);
4585                                 goto out;
4586                         }
4587                 } else {
4588                         TRANS_BEGIN_ASYNC(ufsvfsp, TOP_GETPAGE, trans_size);
4589                 }
4590         }
4591 
4592         if (vp->v_flag & VNOMAP) {
4593                 err = ENOSYS;
4594                 goto unlock;
4595         }
4596 
4597         seqmode = ip->i_nextr == uoff && rw != S_CREATE;
4598 
4599         rwtype = RW_READER;             /* start as a reader */
4600         dolock = (rw_owner(&ip->i_contents) != curthread);
4601         /*
4602          * If this thread owns the lock, i.e., this thread grabbed it
4603          * as writer somewhere above, then we don't need to grab the
4604          * lock as reader in this routine.
4605          */
4606         do_qlock = (rw_owner(&ufsvfsp->vfs_dqrwlock) != curthread);
4607 
4608 retrylock:
4609         if (dolock) {
4610                 /*
4611                  * Grab the quota lock if we need to call
4612                  * bmap_write() below (with i_contents as writer).
4613                  */
4614                 if (do_qlock && rwtype == RW_WRITER)
4615                         rw_enter(&ufsvfsp->vfs_dqrwlock, RW_READER);
4616                 rw_enter(&ip->i_contents, rwtype);
4617         }
4618 
4619         /*
4620          * We may be getting called as a side effect of a bmap using
4621          * fbread() when the blocks might be being allocated and the
4622          * size has not yet been up'ed.  In this case we want to be
4623          * able to return zero pages if we get back UFS_HOLE from
4624          * calling bmap for a non write case here.  We also might have
4625          * to read some frags from the disk into a page if we are
4626          * extending the number of frags for a given lbn in bmap().
4627          * Large Files: The read of i_size here is atomic because
4628          * i_contents is held here. If dolock is zero, the lock
4629          * is held in bmap routines.
4630          */
4631         beyond_eof = uoff + len >
4632             P2ROUNDUP_TYPED(ip->i_size, PAGESIZE, u_offset_t);
4633         if (beyond_eof && seg != segkmap) {
4634                 if (dolock) {
4635                         rw_exit(&ip->i_contents);
4636                         if (do_qlock && rwtype == RW_WRITER)
4637                                 rw_exit(&ufsvfsp->vfs_dqrwlock);
4638                 }
4639                 err = EFAULT;
4640                 goto unlock;
4641         }
4642 
4643         /*
4644          * Must hold i_contents lock throughout the call to pvn_getpages
4645          * since locked pages are returned from each call to ufs_getapage.
4646          * Must *not* return locked pages and then try for contents lock
4647          * due to lock ordering requirements (inode > page)
4648          */
4649 
4650         has_holes = bmap_has_holes(ip);
4651 
4652         if ((rw == S_WRITE || rw == S_CREATE) && has_holes && !beyond_eof) {
4653                 int     blk_size;
4654                 u_offset_t offset;
4655 
4656                 /*
4657                  * We must acquire the RW_WRITER lock in order to
4658                  * call bmap_write().
4659                  */
4660                 if (dolock && rwtype == RW_READER) {
4661                         rwtype = RW_WRITER;
4662 
4663                         /*
4664                          * Grab the quota lock before
4665                          * upgrading i_contents, but if we can't grab it
4666                          * don't wait here due to lock order:
4667                          * vfs_dqrwlock > i_contents.
4668                          */
4669                         if (do_qlock &&
4670                             rw_tryenter(&ufsvfsp->vfs_dqrwlock, RW_READER)
4671                             == 0) {
4672                                 rw_exit(&ip->i_contents);
4673                                 goto retrylock;
4674                         }
4675                         if (!rw_tryupgrade(&ip->i_contents)) {
4676                                 rw_exit(&ip->i_contents);
4677                                 if (do_qlock)
4678                                         rw_exit(&ufsvfsp->vfs_dqrwlock);
4679                                 goto retrylock;
4680                         }
4681                 }
4682 
4683                 /*
4684                  * May be allocating disk blocks for holes here as
4685                  * a result of mmap faults. write(2) does the bmap_write
4686                  * in rdip/wrip, not here. We are not dealing with frags
4687                  * in this case.
4688                  */
4689                 /*
4690                  * Large Files: We cast fs_bmask field to offset_t
4691                  * just as we do for MAXBMASK because uoff is a 64-bit
4692                  * data type. fs_bmask will still be a 32-bit type
4693                  * as we cannot change any ondisk data structures.
4694                  */
4695 
4696                 offset = uoff & (offset_t)fs->fs_bmask;
4697                 while (offset < uoff + len) {
4698                         blk_size = (int)blksize(fs, ip, lblkno(fs, offset));
4699                         err = bmap_write(ip, offset, blk_size,
4700                             BI_NORMAL, NULL, cr);
4701                         if (ip->i_flag & (ICHG|IUPD))
4702                                 ip->i_seq++;
4703                         if (err)
4704                                 goto update_inode;
4705                         offset += blk_size; /* XXX - make this contig */
4706                 }
4707         }
4708 
4709         /*
4710          * Can be a reader from now on.
4711          */
4712         if (dolock && rwtype == RW_WRITER) {
4713                 rw_downgrade(&ip->i_contents);
4714                 /*
4715                  * We can release vfs_dqrwlock early so do it, but make
4716                  * sure we don't try to release it again at the bottom.
4717                  */
4718                 if (do_qlock) {
4719                         rw_exit(&ufsvfsp->vfs_dqrwlock);
4720                         do_qlock = 0;
4721                 }
4722         }
4723 
4724         /*
4725          * We remove PROT_WRITE in cases when the file has UFS holes
4726          * because we don't  want to call bmap_read() to check each
4727          * page if it is backed with a disk block.
4728          */
4729         if (protp && has_holes && rw != S_WRITE && rw != S_CREATE)
4730                 *protp &= ~PROT_WRITE;
4731 
4732         err = 0;
4733 
4734         /*
4735          * The loop looks up pages in the range [off, off + len).
4736          * For each page, we first check if we should initiate an asynchronous
4737          * read ahead before we call page_lookup (we may sleep in page_lookup
4738          * for a previously initiated disk read).
4739          */
4740         eoff = (uoff + len);
4741         for (pgoff = uoff, pgaddr = addr, pl = plarr;
4742             pgoff < eoff; /* empty */) {
4743                 page_t  *pp;
4744                 u_offset_t      nextrio;
4745                 se_t    se;
4746                 int retval;
4747 
4748                 se = ((rw == S_CREATE || rw == S_OTHER) ? SE_EXCL : SE_SHARED);
4749 
4750                 /* Handle async getpage (faultahead) */
4751                 if (plarr == NULL) {
4752                         ip->i_nextrio = pgoff;
4753                         (void) ufs_getpage_ra(vp, pgoff, seg, pgaddr);
4754                         pgoff += pgsize;
4755                         pgaddr += pgsize;
4756                         continue;
4757                 }
4758                 /*
4759                  * Check if we should initiate read ahead of next cluster.
4760                  * We call page_exists only when we need to confirm that
4761                  * we have the current page before we initiate the read ahead.
4762                  */
4763                 nextrio = ip->i_nextrio;
4764                 if (seqmode &&
4765                     pgoff + CLUSTSZ(ip) >= nextrio && pgoff <= nextrio &&
4766                     nextrio < ip->i_size && page_exists(vp, pgoff)) {
4767                         retval = ufs_getpage_ra(vp, pgoff, seg, pgaddr);
4768                         /*
4769                          * We always read ahead the next cluster of data
4770                          * starting from i_nextrio. If the page (vp,nextrio)
4771                          * is actually in core at this point, the routine
4772                          * ufs_getpage_ra() will stop pre-fetching data
4773                          * until we read that page in a synchronized manner
4774                          * through ufs_getpage_miss(). So, we should increase
4775                          * i_nextrio if the page (vp, nextrio) exists.
4776                          */
4777                         if ((retval == 0) && page_exists(vp, nextrio)) {
4778                                 ip->i_nextrio = nextrio + pgsize;
4779                         }
4780                 }
4781 
4782                 if ((pp = page_lookup(vp, pgoff, se)) != NULL) {
4783                         /*
4784                          * We found the page in the page cache.
4785                          */
4786                         *pl++ = pp;
4787                         pgoff += pgsize;
4788                         pgaddr += pgsize;
4789                         len -= pgsize;
4790                         plsz -= pgsize;
4791                 } else  {
4792                         /*
4793                          * We have to create the page, or read it from disk.
4794                          */
4795                         if (err = ufs_getpage_miss(vp, pgoff, len, seg, pgaddr,
4796                             pl, plsz, rw, seqmode))
4797                                 goto error;
4798 
4799                         while (*pl != NULL) {
4800                                 pl++;
4801                                 pgoff += pgsize;
4802                                 pgaddr += pgsize;
4803                                 len -= pgsize;
4804                                 plsz -= pgsize;
4805                         }
4806                 }
4807         }
4808 
4809         /*
4810          * Return pages up to plsz if they are in the page cache.
4811          * We cannot return pages if there is a chance that they are
4812          * backed with a UFS hole and rw is S_WRITE or S_CREATE.
4813          */
4814         if (plarr && !(has_holes && (rw == S_WRITE || rw == S_CREATE))) {
4815 
4816                 ASSERT((protp == NULL) ||
4817                     !(has_holes && (*protp & PROT_WRITE)));
4818 
4819                 eoff = pgoff + plsz;
4820                 while (pgoff < eoff) {
4821                         page_t          *pp;
4822 
4823                         if ((pp = page_lookup_nowait(vp, pgoff,
4824                             SE_SHARED)) == NULL)
4825                                 break;
4826 
4827                         *pl++ = pp;
4828                         pgoff += pgsize;
4829                         plsz -= pgsize;
4830                 }
4831         }
4832 
4833         if (plarr)
4834                 *pl = NULL;                     /* Terminate page list */
4835         ip->i_nextr = pgoff;
4836 
4837 error:
4838         if (err && plarr) {
4839                 /*
4840                  * Release any pages we have locked.
4841                  */
4842                 while (pl > &plarr[0])
4843                         page_unlock(*--pl);
4844 
4845                 plarr[0] = NULL;
4846         }
4847 
4848 update_inode:
4849         /*
4850          * If the inode is not already marked for IACC (in rdip() for read)
4851          * and the inode is not marked for no access time update (in wrip()
4852          * for write) then update the inode access time and mod time now.
4853          */
4854         if ((ip->i_flag & (IACC | INOACC)) == 0) {
4855                 if ((rw != S_OTHER) && (ip->i_mode & IFMT) != IFDIR) {
4856                         if (!ULOCKFS_IS_NOIACC(ITOUL(ip)) &&
4857                             (fs->fs_ronly == 0) &&
4858                             (!ufsvfsp->vfs_noatime)) {
4859                                 mutex_enter(&ip->i_tlock);
4860                                 ip->i_flag |= IACC;
4861                                 ITIMES_NOLOCK(ip);
4862                                 mutex_exit(&ip->i_tlock);
4863                         }
4864                 }
4865         }
4866 
4867         if (dolock) {
4868                 rw_exit(&ip->i_contents);
4869                 if (do_qlock && rwtype == RW_WRITER)
4870                         rw_exit(&ufsvfsp->vfs_dqrwlock);
4871         }
4872 
4873 unlock:
4874         if (ulp) {
4875                 if ((rw == S_CREATE || rw == S_WRITE) &&
4876                     !(vp->v_flag & VISSWAP)) {
4877                         TRANS_END_ASYNC(ufsvfsp, TOP_GETPAGE, trans_size);
4878                 }
4879                 ufs_lockfs_end(ulp);
4880         }
4881 out:
4882         return (err);
4883 }
4884 
4885 /*
4886  * ufs_getpage_miss is called when ufs_getpage missed the page in the page
4887  * cache. The page is either read from the disk, or it's created.
4888  * A page is created (without disk read) if rw == S_CREATE, or if
4889  * the page is not backed with a real disk block (UFS hole).
4890  */
4891 /* ARGSUSED */
4892 static int
4893 ufs_getpage_miss(struct vnode *vp, u_offset_t off, size_t len, struct seg *seg,
4894         caddr_t addr, page_t *pl[], size_t plsz, enum seg_rw rw, int seq)
4895 {
4896         struct inode    *ip = VTOI(vp);
4897         page_t          *pp;
4898         daddr_t         bn;
4899         size_t          io_len;
4900         int             crpage = 0;
4901         int             err;
4902         int             contig;
4903         int             bsize = ip->i_fs->fs_bsize;
4904 
4905         /*
4906          * Figure out whether the page can be created, or must be
4907          * must be read from the disk.
4908          */
4909         if (rw == S_CREATE)
4910                 crpage = 1;
4911         else {
4912                 contig = 0;
4913                 if (err = bmap_read(ip, off, &bn, &contig))
4914                         return (err);
4915 
4916                 crpage = (bn == UFS_HOLE);
4917 
4918                 /*
4919                  * If its also a fallocated block that hasn't been written to
4920                  * yet, we will treat it just like a UFS_HOLE and create
4921                  * a zero page for it
4922                  */
4923                 if (ISFALLOCBLK(ip, bn))
4924                         crpage = 1;
4925         }
4926 
4927         if (crpage) {
4928                 if ((pp = page_create_va(vp, off, PAGESIZE, PG_WAIT, seg,
4929                     addr)) == NULL) {
4930                         return (ufs_fault(vp,
4931                             "ufs_getpage_miss: page_create == NULL"));
4932                 }
4933 
4934                 if (rw != S_CREATE)
4935                         pagezero(pp, 0, PAGESIZE);
4936 
4937                 io_len = PAGESIZE;
4938         } else {
4939                 u_offset_t      io_off;
4940                 uint_t  xlen;
4941                 struct buf      *bp;
4942                 ufsvfs_t        *ufsvfsp = ip->i_ufsvfs;
4943 
4944                 /*
4945                  * If access is not in sequential order, we read from disk
4946                  * in bsize units.
4947                  *
4948                  * We limit the size of the transfer to bsize if we are reading
4949                  * from the beginning of the file. Note in this situation we
4950                  * will hedge our bets and initiate an async read ahead of
4951                  * the second block.
4952                  */
4953                 if (!seq || off == 0)
4954                         contig = MIN(contig, bsize);
4955 
4956                 pp = pvn_read_kluster(vp, off, seg, addr, &io_off,
4957                     &io_len, off, contig, 0);
4958 
4959                 /*
4960                  * Some other thread has entered the page.
4961                  * ufs_getpage will retry page_lookup.
4962                  */
4963                 if (pp == NULL) {
4964                         pl[0] = NULL;
4965                         return (0);
4966                 }
4967 
4968                 /*
4969                  * Zero part of the page which we are not
4970                  * going to read from the disk.
4971                  */
4972                 xlen = io_len & PAGEOFFSET;
4973                 if (xlen != 0)
4974                         pagezero(pp->p_prev, xlen, PAGESIZE - xlen);
4975 
4976                 bp = pageio_setup(pp, io_len, ip->i_devvp, B_READ);
4977                 bp->b_edev = ip->i_dev;
4978                 bp->b_dev = cmpdev(ip->i_dev);
4979                 bp->b_blkno = bn;
4980                 bp->b_un.b_addr = (caddr_t)0;
4981                 bp->b_file = ip->i_vnode;
4982                 bp->b_offset = off;
4983 
4984                 if (ufsvfsp->vfs_log) {
4985                         lufs_read_strategy(ufsvfsp->vfs_log, bp);
4986                 } else if (ufsvfsp->vfs_snapshot) {
4987                         fssnap_strategy(&ufsvfsp->vfs_snapshot, bp);
4988                 } else {
4989                         ufsvfsp->vfs_iotstamp = ddi_get_lbolt();
4990                         ub.ub_getpages.value.ul++;
4991                         (void) bdev_strategy(bp);
4992                         lwp_stat_update(LWP_STAT_INBLK, 1);
4993                 }
4994 
4995                 ip->i_nextrio = off + ((io_len + PAGESIZE - 1) & PAGEMASK);
4996 
4997                 /*
4998                  * If the file access is sequential, initiate read ahead
4999                  * of the next cluster.
5000                  */
5001                 if (seq && ip->i_nextrio < ip->i_size)
5002                         (void) ufs_getpage_ra(vp, off, seg, addr);
5003                 err = biowait(bp);
5004                 pageio_done(bp);
5005 
5006                 if (err) {
5007                         pvn_read_done(pp, B_ERROR);
5008                         return (err);
5009                 }
5010         }
5011 
5012         pvn_plist_init(pp, pl, plsz, off, io_len, rw);
5013         return (0);
5014 }
5015 
5016 /*
5017  * Read ahead a cluster from the disk. Returns the length in bytes.
5018  */
5019 static int
5020 ufs_getpage_ra(struct vnode *vp, u_offset_t off, struct seg *seg, caddr_t addr)
5021 {
5022         struct inode    *ip = VTOI(vp);
5023         page_t          *pp;
5024         u_offset_t      io_off = ip->i_nextrio;
5025         ufsvfs_t        *ufsvfsp;
5026         caddr_t         addr2 = addr + (io_off - off);
5027         struct buf      *bp;
5028         daddr_t         bn;
5029         size_t          io_len;
5030         int             err;
5031         int             contig;
5032         int             xlen;
5033         int             bsize = ip->i_fs->fs_bsize;
5034 
5035         /*
5036          * If the directio advisory is in effect on this file,
5037          * then do not do buffered read ahead. Read ahead makes
5038          * it more difficult on threads using directio as they
5039          * will be forced to flush the pages from this vnode.
5040          */
5041         if ((ufsvfsp = ip->i_ufsvfs) == NULL)
5042                 return (0);
5043         if (ip->i_flag & IDIRECTIO || ufsvfsp->vfs_forcedirectio)
5044                 return (0);
5045 
5046         /*
5047          * Is this test needed?
5048          */
5049         if (addr2 >= seg->s_base + seg->s_size)
5050                 return (0);
5051 
5052         contig = 0;
5053         err = bmap_read(ip, io_off, &bn, &contig);
5054         /*
5055          * If its a UFS_HOLE or a fallocated block, do not perform
5056          * any read ahead's since there probably is nothing to read ahead
5057          */
5058         if (err || bn == UFS_HOLE || ISFALLOCBLK(ip, bn))
5059                 return (0);
5060 
5061         /*
5062          * Limit the transfer size to bsize if this is the 2nd block.
5063          */
5064         if (io_off == (u_offset_t)bsize)
5065                 contig = MIN(contig, bsize);
5066 
5067         if ((pp = pvn_read_kluster(vp, io_off, seg, addr2, &io_off,
5068             &io_len, io_off, contig, 1)) == NULL)
5069                 return (0);
5070 
5071         /*
5072          * Zero part of page which we are not going to read from disk
5073          */
5074         if ((xlen = (io_len & PAGEOFFSET)) > 0)
5075                 pagezero(pp->p_prev, xlen, PAGESIZE - xlen);
5076 
5077         ip->i_nextrio = (io_off + io_len + PAGESIZE - 1) & PAGEMASK;
5078 
5079         bp = pageio_setup(pp, io_len, ip->i_devvp, B_READ | B_ASYNC);
5080         bp->b_edev = ip->i_dev;
5081         bp->b_dev = cmpdev(ip->i_dev);
5082         bp->b_blkno = bn;
5083         bp->b_un.b_addr = (caddr_t)0;
5084         bp->b_file = ip->i_vnode;
5085         bp->b_offset = off;
5086 
5087         if (ufsvfsp->vfs_log) {
5088                 lufs_read_strategy(ufsvfsp->vfs_log, bp);
5089         } else if (ufsvfsp->vfs_snapshot) {
5090                 fssnap_strategy(&ufsvfsp->vfs_snapshot, bp);
5091         } else {
5092                 ufsvfsp->vfs_iotstamp = ddi_get_lbolt();
5093                 ub.ub_getras.value.ul++;
5094                 (void) bdev_strategy(bp);
5095                 lwp_stat_update(LWP_STAT_INBLK, 1);
5096         }
5097 
5098         return (io_len);
5099 }
5100 
5101 int     ufs_delay = 1;
5102 /*
5103  * Flags are composed of {B_INVAL, B_FREE, B_DONTNEED, B_FORCE, B_ASYNC}
5104  *
5105  * LMXXX - the inode really ought to contain a pointer to one of these
5106  * async args.  Stuff gunk in there and just hand the whole mess off.
5107  * This would replace i_delaylen, i_delayoff.
5108  */
5109 /*ARGSUSED*/
5110 static int
5111 ufs_putpage(struct vnode *vp, offset_t off, size_t len, int flags,
5112         struct cred *cr, caller_context_t *ct)
5113 {
5114         struct inode *ip = VTOI(vp);
5115         int err = 0;
5116 
5117         if (vp->v_count == 0) {
5118                 return (ufs_fault(vp, "ufs_putpage: bad v_count == 0"));
5119         }
5120 
5121         /*
5122          * XXX - Why should this check be made here?
5123          */
5124         if (vp->v_flag & VNOMAP) {
5125                 err = ENOSYS;
5126                 goto errout;
5127         }
5128 
5129         if (ip->i_ufsvfs == NULL) {
5130                 err = EIO;
5131                 goto errout;
5132         }
5133 
5134         if (flags & B_ASYNC) {
5135                 if (ufs_delay && len &&
5136                     (flags & ~(B_ASYNC|B_DONTNEED|B_FREE)) == 0) {
5137                         mutex_enter(&ip->i_tlock);
5138                         /*
5139                          * If nobody stalled, start a new cluster.
5140                          */
5141                         if (ip->i_delaylen == 0) {
5142                                 ip->i_delayoff = off;
5143                                 ip->i_delaylen = len;
5144                                 mutex_exit(&ip->i_tlock);
5145                                 goto errout;
5146                         }
5147                         /*
5148                          * If we have a full cluster or they are not contig,
5149                          * then push last cluster and start over.
5150                          */
5151                         if (ip->i_delaylen >= CLUSTSZ(ip) ||
5152                             ip->i_delayoff + ip->i_delaylen != off) {
5153                                 u_offset_t doff;
5154                                 size_t dlen;
5155 
5156                                 doff = ip->i_delayoff;
5157                                 dlen = ip->i_delaylen;
5158                                 ip->i_delayoff = off;
5159                                 ip->i_delaylen = len;
5160                                 mutex_exit(&ip->i_tlock);
5161                                 err = ufs_putpages(vp, doff, dlen,
5162                                     flags, cr);
5163                                 /* LMXXX - flags are new val, not old */
5164                                 goto errout;
5165                         }
5166                         /*
5167                          * There is something there, it's not full, and
5168                          * it is contig.
5169                          */
5170                         ip->i_delaylen += len;
5171                         mutex_exit(&ip->i_tlock);
5172                         goto errout;
5173                 }
5174                 /*
5175                  * Must have weird flags or we are not clustering.
5176                  */
5177         }
5178 
5179         err = ufs_putpages(vp, off, len, flags, cr);
5180 
5181 errout:
5182         return (err);
5183 }
5184 
5185 /*
5186  * If len == 0, do from off to EOF.
5187  *
5188  * The normal cases should be len == 0 & off == 0 (entire vp list),
5189  * len == MAXBSIZE (from segmap_release actions), and len == PAGESIZE
5190  * (from pageout).
5191  */
5192 /*ARGSUSED*/
5193 static int
5194 ufs_putpages(
5195         struct vnode *vp,
5196         offset_t off,
5197         size_t len,
5198         int flags,
5199         struct cred *cr)
5200 {
5201         u_offset_t io_off;
5202         u_offset_t eoff;
5203         struct inode *ip = VTOI(vp);
5204         page_t *pp;
5205         size_t io_len;
5206         int err = 0;
5207         int dolock;
5208 
5209         if (vp->v_count == 0)
5210                 return (ufs_fault(vp, "ufs_putpages: v_count == 0"));
5211         /*
5212          * Acquire the readers/write inode lock before locking
5213          * any pages in this inode.
5214          * The inode lock is held during i/o.
5215          */
5216         if (len == 0) {
5217                 mutex_enter(&ip->i_tlock);
5218                 ip->i_delayoff = ip->i_delaylen = 0;
5219                 mutex_exit(&ip->i_tlock);
5220         }
5221         dolock = (rw_owner(&ip->i_contents) != curthread);
5222         if (dolock) {
5223                 /*
5224                  * Must synchronize this thread and any possible thread
5225                  * operating in the window of vulnerability in wrip().
5226                  * It is dangerous to allow both a thread doing a putpage
5227                  * and a thread writing, so serialize them.  The exception
5228                  * is when the thread in wrip() does something which causes
5229                  * a putpage operation.  Then, the thread must be allowed
5230                  * to continue.  It may encounter a bmap_read problem in
5231                  * ufs_putapage, but that is handled in ufs_putapage.
5232                  * Allow async writers to proceed, we don't want to block
5233                  * the pageout daemon.
5234                  */
5235                 if (ip->i_writer == curthread)
5236                         rw_enter(&ip->i_contents, RW_READER);
5237                 else {
5238                         for (;;) {
5239                                 rw_enter(&ip->i_contents, RW_READER);
5240                                 mutex_enter(&ip->i_tlock);
5241                                 /*
5242                                  * If there is no thread in the critical
5243                                  * section of wrip(), then proceed.
5244                                  * Otherwise, wait until there isn't one.
5245                                  */
5246                                 if (ip->i_writer == NULL) {
5247                                         mutex_exit(&ip->i_tlock);
5248                                         break;
5249                                 }
5250                                 rw_exit(&ip->i_contents);
5251                                 /*
5252                                  * Bounce async writers when we have a writer
5253                                  * working on this file so we don't deadlock
5254                                  * the pageout daemon.
5255                                  */
5256                                 if (flags & B_ASYNC) {
5257                                         mutex_exit(&ip->i_tlock);
5258                                         return (0);
5259                                 }
5260                                 cv_wait(&ip->i_wrcv, &ip->i_tlock);
5261                                 mutex_exit(&ip->i_tlock);
5262                         }
5263                 }
5264         }
5265 
5266         if (!vn_has_cached_data(vp)) {
5267                 if (dolock)
5268                         rw_exit(&ip->i_contents);
5269                 return (0);
5270         }
5271 
5272         if (len == 0) {
5273                 /*
5274                  * Search the entire vp list for pages >= off.
5275                  */
5276                 err = pvn_vplist_dirty(vp, (u_offset_t)off, ufs_putapage,
5277                     flags, cr);
5278         } else {
5279                 /*
5280                  * Loop over all offsets in the range looking for
5281                  * pages to deal with.
5282                  */
5283                 if ((eoff = blkroundup(ip->i_fs, ip->i_size)) != 0)
5284                         eoff = MIN(off + len, eoff);
5285                 else
5286                         eoff = off + len;
5287 
5288                 for (io_off = off; io_off < eoff; io_off += io_len) {
5289                         /*
5290                          * If we are not invalidating, synchronously
5291                          * freeing or writing pages, use the routine
5292                          * page_lookup_nowait() to prevent reclaiming
5293                          * them from the free list.
5294                          */
5295                         if ((flags & B_INVAL) || ((flags & B_ASYNC) == 0)) {
5296                                 pp = page_lookup(vp, io_off,
5297                                     (flags & (B_INVAL | B_FREE)) ?
5298                                     SE_EXCL : SE_SHARED);
5299                         } else {
5300                                 pp = page_lookup_nowait(vp, io_off,
5301                                     (flags & B_FREE) ? SE_EXCL : SE_SHARED);
5302                         }
5303 
5304                         if (pp == NULL || pvn_getdirty(pp, flags) == 0)
5305                                 io_len = PAGESIZE;
5306                         else {
5307                                 u_offset_t *io_offp = &io_off;
5308 
5309                                 err = ufs_putapage(vp, pp, io_offp, &io_len,
5310                                     flags, cr);
5311                                 if (err != 0)
5312                                         break;
5313                                 /*
5314                                  * "io_off" and "io_len" are returned as
5315                                  * the range of pages we actually wrote.
5316                                  * This allows us to skip ahead more quickly
5317                                  * since several pages may've been dealt
5318                                  * with by this iteration of the loop.
5319                                  */
5320                         }
5321                 }
5322         }
5323         if (err == 0 && off == 0 && (len == 0 || len >= ip->i_size)) {
5324                 /*
5325                  * We have just sync'ed back all the pages on
5326                  * the inode, turn off the IMODTIME flag.
5327                  */
5328                 mutex_enter(&ip->i_tlock);
5329                 ip->i_flag &= ~IMODTIME;
5330                 mutex_exit(&ip->i_tlock);
5331         }
5332         if (dolock)
5333                 rw_exit(&ip->i_contents);
5334         return (err);
5335 }
5336 
5337 static void
5338 ufs_iodone(buf_t *bp)
5339 {
5340         struct inode *ip;
5341 
5342         ASSERT((bp->b_pages->p_vnode != NULL) && !(bp->b_flags & B_READ));
5343 
5344         bp->b_iodone = NULL;
5345 
5346         ip = VTOI(bp->b_pages->p_vnode);
5347 
5348         mutex_enter(&ip->i_tlock);
5349         if (ip->i_writes >= ufs_LW) {
5350                 if ((ip->i_writes -= bp->b_bcount) <= ufs_LW)
5351                         if (ufs_WRITES)
5352                                 cv_broadcast(&ip->i_wrcv); /* wake all up */
5353         } else {
5354                 ip->i_writes -= bp->b_bcount;
5355         }
5356 
5357         mutex_exit(&ip->i_tlock);
5358         iodone(bp);
5359 }
5360 
5361 /*
5362  * Write out a single page, possibly klustering adjacent
5363  * dirty pages.  The inode lock must be held.
5364  *
5365  * LMXXX - bsize < pagesize not done.
5366  */
5367 /*ARGSUSED*/
5368 int
5369 ufs_putapage(
5370         struct vnode *vp,
5371         page_t *pp,
5372         u_offset_t *offp,
5373         size_t *lenp,           /* return values */
5374         int flags,
5375         struct cred *cr)
5376 {
5377         u_offset_t io_off;
5378         u_offset_t off;
5379         struct inode *ip = VTOI(vp);
5380         struct ufsvfs *ufsvfsp = ip->i_ufsvfs;
5381         struct fs *fs;
5382         struct buf *bp;
5383         size_t io_len;
5384         daddr_t bn;
5385         int err;
5386         int contig;
5387         int dotrans;
5388 
5389         ASSERT(RW_LOCK_HELD(&ip->i_contents));
5390 
5391         if (ufsvfsp == NULL) {
5392                 err = EIO;
5393                 goto out_trace;
5394         }
5395 
5396         fs = ip->i_fs;
5397         ASSERT(fs->fs_ronly == 0);
5398 
5399         /*
5400          * If the modified time on the inode has not already been
5401          * set elsewhere (e.g. for write/setattr) we set the time now.
5402          * This gives us approximate modified times for mmap'ed files
5403          * which are modified via stores in the user address space.
5404          */
5405         if ((ip->i_flag & IMODTIME) == 0) {
5406                 mutex_enter(&ip->i_tlock);
5407                 ip->i_flag |= IUPD;
5408                 ip->i_seq++;
5409                 ITIMES_NOLOCK(ip);
5410                 mutex_exit(&ip->i_tlock);
5411         }
5412 
5413         /*
5414          * Align the request to a block boundry (for old file systems),
5415          * and go ask bmap() how contiguous things are for this file.
5416          */
5417         off = pp->p_offset & (offset_t)fs->fs_bmask;  /* block align it */
5418         contig = 0;
5419         err = bmap_read(ip, off, &bn, &contig);
5420         if (err)
5421                 goto out;
5422         if (bn == UFS_HOLE) {                   /* putpage never allocates */
5423                 /*
5424                  * logging device is in error mode; simply return EIO
5425                  */
5426                 if (TRANS_ISERROR(ufsvfsp)) {
5427                         err = EIO;
5428                         goto out;
5429                 }
5430                 /*
5431                  * Oops, the thread in the window in wrip() did some
5432                  * sort of operation which caused a putpage in the bad
5433                  * range.  In this case, just return an error which will
5434                  * cause the software modified bit on the page to set
5435                  * and the page will get written out again later.
5436                  */
5437                 if (ip->i_writer == curthread) {
5438                         err = EIO;
5439                         goto out;
5440                 }
5441                 /*
5442                  * If the pager is trying to push a page in the bad range
5443                  * just tell it to try again later when things are better.
5444                  */
5445                 if (flags & B_ASYNC) {
5446                         err = EAGAIN;
5447                         goto out;
5448                 }
5449                 err = ufs_fault(ITOV(ip), "ufs_putapage: bn == UFS_HOLE");
5450                 goto out;
5451         }
5452 
5453         /*
5454          * If it is an fallocate'd block, reverse the negativity since
5455          * we are now writing to it
5456          */
5457         if (ISFALLOCBLK(ip, bn)) {
5458                 err = bmap_set_bn(vp, off, dbtofsb(fs, -bn));
5459                 if (err)
5460                         goto out;
5461 
5462                 bn = -bn;
5463         }
5464 
5465         /*
5466          * Take the length (of contiguous bytes) passed back from bmap()
5467          * and _try_ and get a set of pages covering that extent.
5468          */
5469         pp = pvn_write_kluster(vp, pp, &io_off, &io_len, off, contig, flags);
5470 
5471         /*
5472          * May have run out of memory and not clustered backwards.
5473          * off          p_offset
5474          * [  pp - 1  ][   pp   ]
5475          * [    block           ]
5476          * We told bmap off, so we have to adjust the bn accordingly.
5477          */
5478         if (io_off > off) {
5479                 bn += btod(io_off - off);
5480                 contig -= (io_off - off);
5481         }
5482 
5483         /*
5484          * bmap was carefull to tell us the right size so use that.
5485          * There might be unallocated frags at the end.
5486          * LMXXX - bzero the end of the page?  We must be writing after EOF.
5487          */
5488         if (io_len > contig) {
5489                 ASSERT(io_len - contig < fs->fs_bsize);
5490                 io_len -= (io_len - contig);
5491         }
5492 
5493         /*
5494          * Handle the case where we are writing the last page after EOF.
5495          *
5496          * XXX - just a patch for i-mt3.
5497          */
5498         if (io_len == 0) {
5499                 ASSERT(pp->p_offset >=
5500                     (u_offset_t)(roundup(ip->i_size, PAGESIZE)));
5501                 io_len = PAGESIZE;
5502         }
5503 
5504         bp = pageio_setup(pp, io_len, ip->i_devvp, B_WRITE | flags);
5505 
5506         ULOCKFS_SET_MOD(ITOUL(ip));
5507 
5508         bp->b_edev = ip->i_dev;
5509         bp->b_dev = cmpdev(ip->i_dev);
5510         bp->b_blkno = bn;
5511         bp->b_un.b_addr = (caddr_t)0;
5512         bp->b_file = ip->i_vnode;
5513 
5514         /*
5515          * File contents of shadow or quota inodes are metadata, and updates
5516          * to these need to be put into a logging transaction. All direct
5517          * callers in UFS do that, but fsflush can come here _before_ the
5518          * normal codepath. An example would be updating ACL information, for
5519          * which the normal codepath would be:
5520          *      ufs_si_store()
5521          *      ufs_rdwri()
5522          *      wrip()
5523          *      segmap_release()
5524          *      VOP_PUTPAGE()
5525          * Here, fsflush can pick up the dirty page before segmap_release()
5526          * forces it out. If that happens, there's no transaction.
5527          * We therefore need to test whether a transaction exists, and if not
5528          * create one - for fsflush.
5529          */
5530         dotrans =
5531             (((ip->i_mode & IFMT) == IFSHAD || ufsvfsp->vfs_qinod == ip) &&
5532             ((curthread->t_flag & T_DONTBLOCK) == 0) &&
5533             (TRANS_ISTRANS(ufsvfsp)));
5534 
5535         if (dotrans) {
5536                 curthread->t_flag |= T_DONTBLOCK;
5537                 TRANS_BEGIN_ASYNC(ufsvfsp, TOP_PUTPAGE, TOP_PUTPAGE_SIZE(ip));
5538         }
5539         if (TRANS_ISTRANS(ufsvfsp)) {
5540                 if ((ip->i_mode & IFMT) == IFSHAD) {
5541                         TRANS_BUF(ufsvfsp, 0, io_len, bp, DT_SHAD);
5542                 } else if (ufsvfsp->vfs_qinod == ip) {
5543                         TRANS_DELTA(ufsvfsp, ldbtob(bn), bp->b_bcount, DT_QR,
5544                             0, 0);
5545                 }
5546         }
5547         if (dotrans) {
5548                 TRANS_END_ASYNC(ufsvfsp, TOP_PUTPAGE, TOP_PUTPAGE_SIZE(ip));
5549                 curthread->t_flag &= ~T_DONTBLOCK;
5550         }
5551 
5552         /* write throttle */
5553 
5554         ASSERT(bp->b_iodone == NULL);
5555         bp->b_iodone = (int (*)())ufs_iodone;
5556         mutex_enter(&ip->i_tlock);
5557         ip->i_writes += bp->b_bcount;
5558         mutex_exit(&ip->i_tlock);
5559 
5560         if (bp->b_flags & B_ASYNC) {
5561                 if (ufsvfsp->vfs_log) {
5562                         lufs_write_strategy(ufsvfsp->vfs_log, bp);
5563                 } else if (ufsvfsp->vfs_snapshot) {
5564                         fssnap_strategy(&ufsvfsp->vfs_snapshot, bp);
5565                 } else {
5566                         ufsvfsp->vfs_iotstamp = ddi_get_lbolt();
5567                         ub.ub_putasyncs.value.ul++;
5568                         (void) bdev_strategy(bp);
5569                         lwp_stat_update(LWP_STAT_OUBLK, 1);
5570                 }
5571         } else {
5572                 if (ufsvfsp->vfs_log) {
5573                         lufs_write_strategy(ufsvfsp->vfs_log, bp);
5574                 } else if (ufsvfsp->vfs_snapshot) {
5575                         fssnap_strategy(&ufsvfsp->vfs_snapshot, bp);
5576                 } else {
5577                         ufsvfsp->vfs_iotstamp = ddi_get_lbolt();
5578                         ub.ub_putsyncs.value.ul++;
5579                         (void) bdev_strategy(bp);
5580                         lwp_stat_update(LWP_STAT_OUBLK, 1);
5581                 }
5582                 err = biowait(bp);
5583                 pageio_done(bp);
5584                 pvn_write_done(pp, ((err) ? B_ERROR : 0) | B_WRITE | flags);
5585         }
5586 
5587         pp = NULL;
5588 
5589 out:
5590         if (err != 0 && pp != NULL)
5591                 pvn_write_done(pp, B_ERROR | B_WRITE | flags);
5592 
5593         if (offp)
5594                 *offp = io_off;
5595         if (lenp)
5596                 *lenp = io_len;
5597 out_trace:
5598         return (err);
5599 }
5600 
5601 uint64_t ufs_map_alock_retry_cnt;
5602 uint64_t ufs_map_lockfs_retry_cnt;
5603 
5604 /* ARGSUSED */
5605 static int
5606 ufs_map(struct vnode *vp,
5607         offset_t off,
5608         struct as *as,
5609         caddr_t *addrp,
5610         size_t len,
5611         uchar_t prot,
5612         uchar_t maxprot,
5613         uint_t flags,
5614         struct cred *cr,
5615         caller_context_t *ct)
5616 {
5617         struct segvn_crargs vn_a;
5618         struct ufsvfs *ufsvfsp = VTOI(vp)->i_ufsvfs;
5619         struct ulockfs *ulp;
5620         int error, sig;
5621         k_sigset_t smask;
5622         caddr_t hint = *addrp;
5623 
5624         if (vp->v_flag & VNOMAP) {
5625                 error = ENOSYS;
5626                 goto out;
5627         }
5628 
5629         if (off < (offset_t)0 || (offset_t)(off + len) < (offset_t)0) {
5630                 error = ENXIO;
5631                 goto out;
5632         }
5633 
5634         if (vp->v_type != VREG) {
5635                 error = ENODEV;
5636                 goto out;
5637         }
5638 
5639 retry_map:
5640         *addrp = hint;
5641         /*
5642          * If file is being locked, disallow mapping.
5643          */
5644         if (vn_has_mandatory_locks(vp, VTOI(vp)->i_mode)) {
5645                 error = EAGAIN;
5646                 goto out;
5647         }
5648 
5649         as_rangelock(as);
5650         /*
5651          * Note that if we are retrying (because ufs_lockfs_trybegin failed in
5652          * the previous attempt), some other thread could have grabbed
5653          * the same VA range if MAP_FIXED is set. In that case, choose_addr
5654          * would unmap the valid VA range, that is ok.
5655          */
5656         error = choose_addr(as, addrp, len, off, ADDR_VACALIGN, flags);
5657         if (error != 0) {
5658                 as_rangeunlock(as);
5659                 goto out;
5660         }
5661 
5662         /*
5663          * a_lock has to be acquired before entering the lockfs protocol
5664          * because that is the order in which pagefault works. Also we cannot
5665          * block on a_lock here because this waiting writer will prevent
5666          * further readers like ufs_read from progressing and could cause
5667          * deadlock between ufs_read/ufs_map/pagefault when a quiesce is
5668          * pending.
5669          */
5670         while (!AS_LOCK_TRYENTER(as, RW_WRITER)) {
5671                 ufs_map_alock_retry_cnt++;
5672                 delay(RETRY_LOCK_DELAY);
5673         }
5674 
5675         /*
5676          * We can't hold as->a_lock and wait for lockfs to succeed because
5677          * the proc tools might hang on a_lock, so call ufs_lockfs_trybegin()
5678          * instead.
5679          */
5680         if (error = ufs_lockfs_trybegin(ufsvfsp, &ulp, ULOCKFS_MAP_MASK)) {
5681                 /*
5682                  * ufs_lockfs_trybegin() did not succeed. It is safer to give up
5683                  * as->a_lock and wait for ulp->ul_fs_lock status to change.
5684                  */
5685                 ufs_map_lockfs_retry_cnt++;
5686                 AS_LOCK_EXIT(as);
5687                 as_rangeunlock(as);
5688                 if (error == EIO)
5689                         goto out;
5690 
5691                 mutex_enter(&ulp->ul_lock);
5692                 while (ulp->ul_fs_lock & ULOCKFS_MAP_MASK) {
5693                         if (ULOCKFS_IS_SLOCK(ulp) || ufsvfsp->vfs_nointr) {
5694                                 cv_wait(&ulp->ul_cv, &ulp->ul_lock);
5695                         } else {
5696                                 sigintr(&smask, 1);
5697                                 sig = cv_wait_sig(&ulp->ul_cv, &ulp->ul_lock);
5698                                 sigunintr(&smask);
5699                                 if (((ulp->ul_fs_lock & ULOCKFS_MAP_MASK) &&
5700                                     !sig) || ufsvfsp->vfs_dontblock) {
5701                                         mutex_exit(&ulp->ul_lock);
5702                                         return (EINTR);
5703                                 }
5704                         }
5705                 }
5706                 mutex_exit(&ulp->ul_lock);
5707                 goto retry_map;
5708         }
5709 
5710         vn_a.vp = vp;
5711         vn_a.offset = (u_offset_t)off;
5712         vn_a.type = flags & MAP_TYPE;
5713         vn_a.prot = prot;
5714         vn_a.maxprot = maxprot;
5715         vn_a.cred = cr;
5716         vn_a.amp = NULL;
5717         vn_a.flags = flags & ~MAP_TYPE;
5718         vn_a.szc = 0;
5719         vn_a.lgrp_mem_policy_flags = 0;
5720 
5721         error = as_map_locked(as, *addrp, len, segvn_create, &vn_a);
5722         if (ulp)
5723                 ufs_lockfs_end(ulp);
5724         as_rangeunlock(as);
5725 out:
5726         return (error);
5727 }
5728 
5729 /* ARGSUSED */
5730 static int
5731 ufs_addmap(struct vnode *vp,
5732         offset_t off,
5733         struct as *as,
5734         caddr_t addr,
5735         size_t  len,
5736         uchar_t  prot,
5737         uchar_t  maxprot,
5738         uint_t    flags,
5739         struct cred *cr,
5740         caller_context_t *ct)
5741 {
5742         struct inode *ip = VTOI(vp);
5743 
5744         if (vp->v_flag & VNOMAP) {
5745                 return (ENOSYS);
5746         }
5747 
5748         mutex_enter(&ip->i_tlock);
5749         ip->i_mapcnt += btopr(len);
5750         mutex_exit(&ip->i_tlock);
5751         return (0);
5752 }
5753 
5754 /*ARGSUSED*/
5755 static int
5756 ufs_delmap(struct vnode *vp, offset_t off, struct as *as, caddr_t addr,
5757         size_t len, uint_t prot,  uint_t maxprot,  uint_t flags,
5758         struct cred *cr, caller_context_t *ct)
5759 {
5760         struct inode *ip = VTOI(vp);
5761 
5762         if (vp->v_flag & VNOMAP) {
5763                 return (ENOSYS);
5764         }
5765 
5766         mutex_enter(&ip->i_tlock);
5767         ip->i_mapcnt -= btopr(len);  /* Count released mappings */
5768         ASSERT(ip->i_mapcnt >= 0);
5769         mutex_exit(&ip->i_tlock);
5770         return (0);
5771 }
5772 /*
5773  * Return the answer requested to poll() for non-device files
5774  */
5775 struct pollhead ufs_pollhd;
5776 
5777 /* ARGSUSED */
5778 int
5779 ufs_poll(vnode_t *vp, short ev, int any, short *revp, struct pollhead **phpp,
5780         caller_context_t *ct)
5781 {
5782         struct ufsvfs   *ufsvfsp;
5783 
5784         *revp = 0;
5785         ufsvfsp = VTOI(vp)->i_ufsvfs;
5786 
5787         if (!ufsvfsp) {
5788                 *revp = POLLHUP;
5789                 goto out;
5790         }
5791 
5792         if (ULOCKFS_IS_HLOCK(&ufsvfsp->vfs_ulockfs) ||
5793             ULOCKFS_IS_ELOCK(&ufsvfsp->vfs_ulockfs)) {
5794                 *revp |= POLLERR;
5795 
5796         } else {
5797                 if ((ev & POLLOUT) && !ufsvfsp->vfs_fs->fs_ronly &&
5798                     !ULOCKFS_IS_WLOCK(&ufsvfsp->vfs_ulockfs))
5799                         *revp |= POLLOUT;
5800 
5801                 if ((ev & POLLWRBAND) && !ufsvfsp->vfs_fs->fs_ronly &&
5802                     !ULOCKFS_IS_WLOCK(&ufsvfsp->vfs_ulockfs))
5803                         *revp |= POLLWRBAND;
5804 
5805                 if (ev & POLLIN)
5806                         *revp |= POLLIN;
5807 
5808                 if (ev & POLLRDNORM)
5809                         *revp |= POLLRDNORM;
5810 
5811                 if (ev & POLLRDBAND)
5812                         *revp |= POLLRDBAND;
5813         }
5814 
5815         if ((ev & POLLPRI) && (*revp & (POLLERR|POLLHUP)))
5816                 *revp |= POLLPRI;
5817 out:
5818         *phpp = !any && !*revp ? &ufs_pollhd : (struct pollhead *)NULL;
5819 
5820         return (0);
5821 }
5822 
5823 /* ARGSUSED */
5824 static int
5825 ufs_l_pathconf(struct vnode *vp, int cmd, ulong_t *valp, struct cred *cr,
5826         caller_context_t *ct)
5827 {
5828         struct ufsvfs   *ufsvfsp = VTOI(vp)->i_ufsvfs;
5829         struct ulockfs  *ulp = NULL;
5830         struct inode    *sip = NULL;
5831         int             error;
5832         struct inode    *ip = VTOI(vp);
5833         int             issync;
5834 
5835         error = ufs_lockfs_begin(ufsvfsp, &ulp, ULOCKFS_PATHCONF_MASK);
5836         if (error)
5837                 return (error);
5838 
5839         switch (cmd) {
5840                 /*
5841                  * Have to handle _PC_NAME_MAX here, because the normal way
5842                  * [fs_pathconf() -> VOP_STATVFS() -> ufs_statvfs()]
5843                  * results in a lock ordering reversal between
5844                  * ufs_lockfs_{begin,end}() and
5845                  * ufs_thread_{suspend,continue}().
5846                  *
5847                  * Keep in sync with ufs_statvfs().
5848                  */
5849         case _PC_NAME_MAX:
5850                 *valp = MAXNAMLEN;
5851                 break;
5852 
5853         case _PC_FILESIZEBITS:
5854                 if (ufsvfsp->vfs_lfflags & UFS_LARGEFILES)
5855                         *valp = UFS_FILESIZE_BITS;
5856                 else
5857                         *valp = 32;
5858                 break;
5859 
5860         case _PC_XATTR_EXISTS:
5861                 if (vp->v_vfsp->vfs_flag & VFS_XATTR) {
5862 
5863                         error =
5864                             ufs_xattr_getattrdir(vp, &sip, LOOKUP_XATTR, cr);
5865                         if (error ==  0 && sip != NULL) {
5866                                 /* Start transaction */
5867                                 if (ulp) {
5868                                         TRANS_BEGIN_CSYNC(ufsvfsp, issync,
5869                                             TOP_RMDIR, TOP_RMDIR_SIZE);
5870                                 }
5871                                 /*
5872                                  * Is directory empty
5873                                  */
5874                                 rw_enter(&sip->i_rwlock, RW_WRITER);
5875                                 rw_enter(&sip->i_contents, RW_WRITER);
5876                                 if (ufs_xattrdirempty(sip,
5877                                     sip->i_number, CRED())) {
5878                                         rw_enter(&ip->i_contents, RW_WRITER);
5879                                         ufs_unhook_shadow(ip, sip);
5880                                         rw_exit(&ip->i_contents);
5881 
5882                                         *valp = 0;
5883 
5884                                 } else
5885                                         *valp = 1;
5886                                 rw_exit(&sip->i_contents);
5887                                 rw_exit(&sip->i_rwlock);
5888                                 if (ulp) {
5889                                         TRANS_END_CSYNC(ufsvfsp, error, issync,
5890                                             TOP_RMDIR, TOP_RMDIR_SIZE);
5891                                 }
5892                                 VN_RELE(ITOV(sip));
5893                         } else if (error == ENOENT) {
5894                                 *valp = 0;
5895                                 error = 0;
5896                         }
5897                 } else {
5898                         error = fs_pathconf(vp, cmd, valp, cr, ct);
5899                 }
5900                 break;
5901 
5902         case _PC_ACL_ENABLED:
5903                 *valp = _ACL_ACLENT_ENABLED;
5904                 break;
5905 
5906         case _PC_MIN_HOLE_SIZE:
5907                 *valp = (ulong_t)ip->i_fs->fs_bsize;
5908                 break;
5909 
5910         case _PC_SATTR_ENABLED:
5911         case _PC_SATTR_EXISTS:
5912                 *valp = vfs_has_feature(vp->v_vfsp, VFSFT_SYSATTR_VIEWS) &&
5913                     (vp->v_type == VREG || vp->v_type == VDIR);
5914                 break;
5915 
5916         case _PC_TIMESTAMP_RESOLUTION:
5917                 /*
5918                  * UFS keeps only microsecond timestamp resolution.
5919                  * This is historical and will probably never change.
5920                  */
5921                 *valp = 1000L;
5922                 break;
5923 
5924         default:
5925                 error = fs_pathconf(vp, cmd, valp, cr, ct);
5926                 break;
5927         }
5928 
5929         if (ulp != NULL) {
5930                 ufs_lockfs_end(ulp);
5931         }
5932         return (error);
5933 }
5934 
5935 int ufs_pageio_writes, ufs_pageio_reads;
5936 
5937 /*ARGSUSED*/
5938 static int
5939 ufs_pageio(struct vnode *vp, page_t *pp, u_offset_t io_off, size_t io_len,
5940         int flags, struct cred *cr, caller_context_t *ct)
5941 {
5942         struct inode *ip = VTOI(vp);
5943         struct ufsvfs *ufsvfsp;
5944         page_t *npp = NULL, *opp = NULL, *cpp = pp;
5945         struct buf *bp;
5946         daddr_t bn;
5947         size_t done_len = 0, cur_len = 0;
5948         int err = 0;
5949         int contig = 0;
5950         int dolock;
5951         int vmpss = 0;
5952         struct ulockfs *ulp;
5953 
5954         if ((flags & B_READ) && pp != NULL && pp->p_vnode == vp &&
5955             vp->v_mpssdata != NULL) {
5956                 vmpss = 1;
5957         }
5958 
5959         dolock = (rw_owner(&ip->i_contents) != curthread);
5960         /*
5961          * We need a better check.  Ideally, we would use another
5962          * vnodeops so that hlocked and forcibly unmounted file
5963          * systems would return EIO where appropriate and w/o the
5964          * need for these checks.
5965          */
5966         if ((ufsvfsp = ip->i_ufsvfs) == NULL)
5967                 return (EIO);
5968 
5969         /*
5970          * For vmpss (pp can be NULL) case respect the quiesce protocol.
5971          * ul_lock must be taken before locking pages so we can't use it here
5972          * if pp is non NULL because segvn already locked pages
5973          * SE_EXCL. Instead we rely on the fact that a forced umount or
5974          * applying a filesystem lock via ufs_fiolfs() will block in the
5975          * implicit call to ufs_flush() until we unlock the pages after the
5976          * return to segvn. Other ufs_quiesce() callers keep ufs_quiesce_pend
5977          * above 0 until they are done. We have to be careful not to increment
5978          * ul_vnops_cnt here after forceful unmount hlocks the file system.
5979          *
5980          * If pp is NULL use ul_lock to make sure we don't increment
5981          * ul_vnops_cnt after forceful unmount hlocks the file system.
5982          */
5983         if (vmpss || pp == NULL) {
5984                 ulp = &ufsvfsp->vfs_ulockfs;
5985                 if (pp == NULL)
5986                         mutex_enter(&ulp->ul_lock);
5987                 if (ulp->ul_fs_lock & ULOCKFS_GETREAD_MASK) {
5988                         if (pp == NULL) {
5989                                 mutex_exit(&ulp->ul_lock);
5990                         }
5991                         return (vmpss ? EIO : EINVAL);
5992                 }
5993                 atomic_inc_ulong(&ulp->ul_vnops_cnt);
5994                 if (pp == NULL)
5995                         mutex_exit(&ulp->ul_lock);
5996                 if (ufs_quiesce_pend) {
5997                         if (!atomic_dec_ulong_nv(&ulp->ul_vnops_cnt))
5998                                 cv_broadcast(&ulp->ul_cv);
5999                         return (vmpss ? EIO : EINVAL);
6000                 }
6001         }
6002 
6003         if (dolock) {
6004                 /*
6005                  * segvn may call VOP_PAGEIO() instead of VOP_GETPAGE() to
6006                  * handle a fault against a segment that maps vnode pages with
6007                  * large mappings.  Segvn creates pages and holds them locked
6008                  * SE_EXCL during VOP_PAGEIO() call. In this case we have to
6009                  * use rw_tryenter() to avoid a potential deadlock since in
6010                  * lock order i_contents needs to be taken first.
6011                  * Segvn will retry via VOP_GETPAGE() if VOP_PAGEIO() fails.
6012                  */
6013                 if (!vmpss) {
6014                         rw_enter(&ip->i_contents, RW_READER);
6015                 } else if (!rw_tryenter(&ip->i_contents, RW_READER)) {
6016                         if (!atomic_dec_ulong_nv(&ulp->ul_vnops_cnt))
6017                                 cv_broadcast(&ulp->ul_cv);
6018                         return (EDEADLK);
6019                 }
6020         }
6021 
6022         /*
6023          * Return an error to segvn because the pagefault request is beyond
6024          * PAGESIZE rounded EOF.
6025          */
6026         if (vmpss && btopr(io_off + io_len) > btopr(ip->i_size)) {
6027                 if (dolock)
6028                         rw_exit(&ip->i_contents);
6029                 if (!atomic_dec_ulong_nv(&ulp->ul_vnops_cnt))
6030                         cv_broadcast(&ulp->ul_cv);
6031                 return (EFAULT);
6032         }
6033 
6034         if (pp == NULL) {
6035                 if (bmap_has_holes(ip)) {
6036                         err = ENOSYS;
6037                 } else {
6038                         err = EINVAL;
6039                 }
6040                 if (dolock)
6041                         rw_exit(&ip->i_contents);
6042                 if (!atomic_dec_ulong_nv(&ulp->ul_vnops_cnt))
6043                         cv_broadcast(&ulp->ul_cv);
6044                 return (err);
6045         }
6046 
6047         /*
6048          * Break the io request into chunks, one for each contiguous
6049          * stretch of disk blocks in the target file.
6050          */
6051         while (done_len < io_len) {
6052                 ASSERT(cpp);
6053                 contig = 0;
6054                 if (err = bmap_read(ip, (u_offset_t)(io_off + done_len),
6055                     &bn, &contig))
6056                         break;
6057 
6058                 if (bn == UFS_HOLE) {   /* No holey swapfiles */
6059                         if (vmpss) {
6060                                 err = EFAULT;
6061                                 break;
6062                         }
6063                         err = ufs_fault(ITOV(ip), "ufs_pageio: bn == UFS_HOLE");
6064                         break;
6065                 }
6066 
6067                 cur_len = MIN(io_len - done_len, contig);
6068                 /*
6069                  * Zero out a page beyond EOF, when the last block of
6070                  * a file is a UFS fragment so that ufs_pageio() can be used
6071                  * instead of ufs_getpage() to handle faults against
6072                  * segvn segments that use large pages.
6073                  */
6074                 page_list_break(&cpp, &npp, btopr(cur_len));
6075                 if ((flags & B_READ) && (cur_len & PAGEOFFSET)) {
6076                         size_t xlen = cur_len & PAGEOFFSET;
6077                         pagezero(cpp->p_prev, xlen, PAGESIZE - xlen);
6078                 }
6079 
6080                 bp = pageio_setup(cpp, cur_len, ip->i_devvp, flags);
6081                 ASSERT(bp != NULL);
6082 
6083                 bp->b_edev = ip->i_dev;
6084                 bp->b_dev = cmpdev(ip->i_dev);
6085                 bp->b_blkno = bn;
6086                 bp->b_un.b_addr = (caddr_t)0;
6087                 bp->b_file = ip->i_vnode;
6088 
6089                 ufsvfsp->vfs_iotstamp = ddi_get_lbolt();
6090                 ub.ub_pageios.value.ul++;
6091                 if (ufsvfsp->vfs_snapshot)
6092                         fssnap_strategy(&(ufsvfsp->vfs_snapshot), bp);
6093                 else
6094                         (void) bdev_strategy(bp);
6095 
6096                 if (flags & B_READ)
6097                         ufs_pageio_reads++;
6098                 else
6099                         ufs_pageio_writes++;
6100                 if (flags & B_READ)
6101                         lwp_stat_update(LWP_STAT_INBLK, 1);
6102                 else
6103                         lwp_stat_update(LWP_STAT_OUBLK, 1);
6104                 /*
6105                  * If the request is not B_ASYNC, wait for i/o to complete
6106                  * and re-assemble the page list to return to the caller.
6107                  * If it is B_ASYNC we leave the page list in pieces and
6108                  * cleanup() will dispose of them.
6109                  */
6110                 if ((flags & B_ASYNC) == 0) {
6111                         err = biowait(bp);
6112                         pageio_done(bp);
6113                         if (err)
6114                                 break;
6115                         page_list_concat(&opp, &cpp);
6116                 }
6117                 cpp = npp;
6118                 npp = NULL;
6119                 if (flags & B_READ)
6120                         cur_len = P2ROUNDUP_TYPED(cur_len, PAGESIZE, size_t);
6121                 done_len += cur_len;
6122         }
6123         ASSERT(err || (cpp == NULL && npp == NULL && done_len == io_len));
6124         if (err) {
6125                 if (flags & B_ASYNC) {
6126                         /* Cleanup unprocessed parts of list */
6127                         page_list_concat(&cpp, &npp);
6128                         if (flags & B_READ)
6129                                 pvn_read_done(cpp, B_ERROR);
6130                         else
6131                                 pvn_write_done(cpp, B_ERROR);
6132                 } else {
6133                         /* Re-assemble list and let caller clean up */
6134                         page_list_concat(&opp, &cpp);
6135                         page_list_concat(&opp, &npp);
6136                 }
6137         }
6138 
6139         if (vmpss && !(ip->i_flag & IACC) && !ULOCKFS_IS_NOIACC(ulp) &&
6140             ufsvfsp->vfs_fs->fs_ronly == 0 && !ufsvfsp->vfs_noatime) {
6141                 mutex_enter(&ip->i_tlock);
6142                 ip->i_flag |= IACC;
6143                 ITIMES_NOLOCK(ip);
6144                 mutex_exit(&ip->i_tlock);
6145         }
6146 
6147         if (dolock)
6148                 rw_exit(&ip->i_contents);
6149         if (vmpss && !atomic_dec_ulong_nv(&ulp->ul_vnops_cnt))
6150                 cv_broadcast(&ulp->ul_cv);
6151         return (err);
6152 }
6153 
6154 /*
6155  * Called when the kernel is in a frozen state to dump data
6156  * directly to the device. It uses a private dump data structure,
6157  * set up by dump_ctl, to locate the correct disk block to which to dump.
6158  */
6159 /*ARGSUSED*/
6160 static int
6161 ufs_dump(vnode_t *vp, caddr_t addr, offset_t ldbn, offset_t dblks,
6162     caller_context_t *ct)
6163 {
6164         u_offset_t      file_size;
6165         struct inode    *ip = VTOI(vp);
6166         struct fs       *fs = ip->i_fs;
6167         daddr_t         dbn, lfsbn;
6168         int             disk_blks = fs->fs_bsize >> DEV_BSHIFT;
6169         int             error = 0;
6170         int             ndbs, nfsbs;
6171 
6172         /*
6173          * forced unmount case
6174          */
6175         if (ip->i_ufsvfs == NULL)
6176                 return (EIO);
6177         /*
6178          * Validate the inode that it has not been modified since
6179          * the dump structure is allocated.
6180          */
6181         mutex_enter(&ip->i_tlock);
6182         if ((dump_info == NULL) ||
6183             (dump_info->ip != ip) ||
6184             (dump_info->time.tv_sec != ip->i_mtime.tv_sec) ||
6185             (dump_info->time.tv_usec != ip->i_mtime.tv_usec)) {
6186                 mutex_exit(&ip->i_tlock);
6187                 return (-1);
6188         }
6189         mutex_exit(&ip->i_tlock);
6190 
6191         /*
6192          * See that the file has room for this write
6193          */
6194         UFS_GET_ISIZE(&file_size, ip);
6195 
6196         if (ldbtob(ldbn + dblks) > file_size)
6197                 return (ENOSPC);
6198 
6199         /*
6200          * Find the physical disk block numbers from the dump
6201          * private data structure directly and write out the data
6202          * in contiguous block lumps
6203          */
6204         while (dblks > 0 && !error) {
6205                 lfsbn = (daddr_t)lblkno(fs, ldbtob(ldbn));
6206                 dbn = fsbtodb(fs, dump_info->dblk[lfsbn]) + ldbn % disk_blks;
6207                 nfsbs = 1;
6208                 ndbs = disk_blks - ldbn % disk_blks;
6209                 while (ndbs < dblks && fsbtodb(fs, dump_info->dblk[lfsbn +
6210                     nfsbs]) == dbn + ndbs) {
6211                         nfsbs++;
6212                         ndbs += disk_blks;
6213                 }
6214                 if (ndbs > dblks)
6215                         ndbs = dblks;
6216                 error = bdev_dump(ip->i_dev, addr, dbn, ndbs);
6217                 addr += ldbtob((offset_t)ndbs);
6218                 dblks -= ndbs;
6219                 ldbn += ndbs;
6220         }
6221         return (error);
6222 
6223 }
6224 
6225 /*
6226  * Prepare the file system before and after the dump operation.
6227  *
6228  * action = DUMP_ALLOC:
6229  * Preparation before dump, allocate dump private data structure
6230  * to hold all the direct and indirect block info for dump.
6231  *
6232  * action = DUMP_FREE:
6233  * Clean up after dump, deallocate the dump private data structure.
6234  *
6235  * action = DUMP_SCAN:
6236  * Scan dump_info for *blkp DEV_BSIZE blocks of contig fs space;
6237  * if found, the starting file-relative DEV_BSIZE lbn is written
6238  * to *bklp; that lbn is intended for use with VOP_DUMP()
6239  */
6240 /*ARGSUSED*/
6241 static int
6242 ufs_dumpctl(vnode_t *vp, int action, offset_t *blkp, caller_context_t *ct)
6243 {
6244         struct inode    *ip = VTOI(vp);
6245         ufsvfs_t        *ufsvfsp = ip->i_ufsvfs;
6246         struct fs       *fs;
6247         daddr32_t       *dblk, *storeblk;
6248         daddr32_t       *nextblk, *endblk;
6249         struct buf      *bp;
6250         int             i, entry, entries;
6251         int             n, ncontig;
6252 
6253         /*
6254          * check for forced unmount
6255          */
6256         if (ufsvfsp == NULL)
6257                 return (EIO);
6258 
6259         if (action == DUMP_ALLOC) {
6260                 /*
6261                  * alloc and record dump_info
6262                  */
6263                 if (dump_info != NULL)
6264                         return (EINVAL);
6265 
6266                 ASSERT(vp->v_type == VREG);
6267                 fs = ufsvfsp->vfs_fs;
6268 
6269                 rw_enter(&ip->i_contents, RW_READER);
6270 
6271                 if (bmap_has_holes(ip)) {
6272                         rw_exit(&ip->i_contents);
6273                         return (EFAULT);
6274                 }
6275 
6276                 /*
6277                  * calculate and allocate space needed according to i_size
6278                  */
6279                 entries = (int)lblkno(fs, blkroundup(fs, ip->i_size));
6280                 dump_info = kmem_alloc(sizeof (struct dump) +
6281                     (entries - 1) * sizeof (daddr32_t), KM_NOSLEEP);
6282                 if (dump_info == NULL) {
6283                         rw_exit(&ip->i_contents);
6284                         return (ENOMEM);
6285                 }
6286 
6287                 /* Start saving the info */
6288                 dump_info->fsbs = entries;
6289                 dump_info->ip = ip;
6290                 storeblk = &dump_info->dblk[0];
6291 
6292                 /* Direct Blocks */
6293                 for (entry = 0; entry < NDADDR && entry < entries; entry++)
6294                         *storeblk++ = ip->i_db[entry];
6295 
6296                 /* Indirect Blocks */
6297                 for (i = 0; i < NIADDR; i++) {
6298                         int error = 0;
6299 
6300                         bp = UFS_BREAD(ufsvfsp,
6301                             ip->i_dev, fsbtodb(fs, ip->i_ib[i]), fs->fs_bsize);
6302                         if (bp->b_flags & B_ERROR)
6303                                 error = EIO;
6304                         else {
6305                                 dblk = bp->b_un.b_daddr;
6306                                 if ((storeblk = save_dblks(ip, ufsvfsp,
6307                                     storeblk, dblk, i, entries)) == NULL)
6308                                         error = EIO;
6309                         }
6310 
6311                         brelse(bp);
6312 
6313                         if (error != 0) {
6314                                 kmem_free(dump_info, sizeof (struct dump) +
6315                                     (entries - 1) * sizeof (daddr32_t));
6316                                 rw_exit(&ip->i_contents);
6317                                 dump_info = NULL;
6318                                 return (error);
6319                         }
6320                 }
6321                 /* and time stamp the information */
6322                 mutex_enter(&ip->i_tlock);
6323                 dump_info->time = ip->i_mtime;
6324                 mutex_exit(&ip->i_tlock);
6325 
6326                 rw_exit(&ip->i_contents);
6327         } else if (action == DUMP_FREE) {
6328                 /*
6329                  * free dump_info
6330                  */
6331                 if (dump_info == NULL)
6332                         return (EINVAL);
6333                 entries = dump_info->fsbs - 1;
6334                 kmem_free(dump_info, sizeof (struct dump) +
6335                     entries * sizeof (daddr32_t));
6336                 dump_info = NULL;
6337         } else if (action == DUMP_SCAN) {
6338                 /*
6339                  * scan dump_info
6340                  */
6341                 if (dump_info == NULL)
6342                         return (EINVAL);
6343 
6344                 dblk = dump_info->dblk;
6345                 nextblk = dblk + 1;
6346                 endblk = dblk + dump_info->fsbs - 1;
6347                 fs = ufsvfsp->vfs_fs;
6348                 ncontig = *blkp >> (fs->fs_bshift - DEV_BSHIFT);
6349 
6350                 /*
6351                  * scan dblk[] entries; contig fs space is found when:
6352                  * ((current blkno + frags per block) == next blkno)
6353                  */
6354                 n = 0;
6355                 while (n < ncontig && dblk < endblk) {
6356                         if ((*dblk + fs->fs_frag) == *nextblk)
6357                                 n++;
6358                         else
6359                                 n = 0;
6360                         dblk++;
6361                         nextblk++;
6362                 }
6363 
6364                 /*
6365                  * index is where size bytes of contig space begins;
6366                  * conversion from index to the file's DEV_BSIZE lbn
6367                  * is equivalent to:  (index * fs_bsize) / DEV_BSIZE
6368                  */
6369                 if (n == ncontig) {
6370                         i = (dblk - dump_info->dblk) - ncontig;
6371                         *blkp = i << (fs->fs_bshift - DEV_BSHIFT);
6372                 } else
6373                         return (EFAULT);
6374         }
6375         return (0);
6376 }
6377 
6378 /*
6379  * Recursive helper function for ufs_dumpctl().  It follows the indirect file
6380  * system  blocks until it reaches the the disk block addresses, which are
6381  * then stored into the given buffer, storeblk.
6382  */
6383 static daddr32_t *
6384 save_dblks(struct inode *ip, struct ufsvfs *ufsvfsp,  daddr32_t *storeblk,
6385     daddr32_t *dblk, int level, int entries)
6386 {
6387         struct fs       *fs = ufsvfsp->vfs_fs;
6388         struct buf      *bp;
6389         int             i;
6390 
6391         if (level == 0) {
6392                 for (i = 0; i < NINDIR(fs); i++) {
6393                         if (storeblk - dump_info->dblk >= entries)
6394                                 break;
6395                         *storeblk++ = dblk[i];
6396                 }
6397                 return (storeblk);
6398         }
6399         for (i = 0; i < NINDIR(fs); i++) {
6400                 if (storeblk - dump_info->dblk >= entries)
6401                         break;
6402                 bp = UFS_BREAD(ufsvfsp,
6403                     ip->i_dev, fsbtodb(fs, dblk[i]), fs->fs_bsize);
6404                 if (bp->b_flags & B_ERROR) {
6405                         brelse(bp);
6406                         return (NULL);
6407                 }
6408                 storeblk = save_dblks(ip, ufsvfsp, storeblk, bp->b_un.b_daddr,
6409                     level - 1, entries);
6410                 brelse(bp);
6411 
6412                 if (storeblk == NULL)
6413                         return (NULL);
6414         }
6415         return (storeblk);
6416 }
6417 
6418 /* ARGSUSED */
6419 static int
6420 ufs_getsecattr(struct vnode *vp, vsecattr_t *vsap, int flag,
6421         struct cred *cr, caller_context_t *ct)
6422 {
6423         struct inode    *ip = VTOI(vp);
6424         struct ulockfs  *ulp;
6425         struct ufsvfs   *ufsvfsp = ip->i_ufsvfs;
6426         ulong_t         vsa_mask = vsap->vsa_mask;
6427         int             err = EINVAL;
6428 
6429         vsa_mask &= (VSA_ACL | VSA_ACLCNT | VSA_DFACL | VSA_DFACLCNT);
6430 
6431         /*
6432          * Only grab locks if needed - they're not needed to check vsa_mask
6433          * or if the mask contains no acl flags.
6434          */
6435         if (vsa_mask != 0) {
6436                 if (err = ufs_lockfs_begin(ufsvfsp, &ulp,
6437                     ULOCKFS_GETATTR_MASK))
6438                         return (err);
6439 
6440                 rw_enter(&ip->i_contents, RW_READER);
6441                 err = ufs_acl_get(ip, vsap, flag, cr);
6442                 rw_exit(&ip->i_contents);
6443 
6444                 if (ulp)
6445                         ufs_lockfs_end(ulp);
6446         }
6447         return (err);
6448 }
6449 
6450 /* ARGSUSED */
6451 static int
6452 ufs_setsecattr(struct vnode *vp, vsecattr_t *vsap, int flag, struct cred *cr,
6453         caller_context_t *ct)
6454 {
6455         struct inode    *ip = VTOI(vp);
6456         struct ulockfs  *ulp = NULL;
6457         struct ufsvfs   *ufsvfsp = VTOI(vp)->i_ufsvfs;
6458         ulong_t         vsa_mask = vsap->vsa_mask;
6459         int             err;
6460         int             haverwlock = 1;
6461         int             trans_size;
6462         int             donetrans = 0;
6463         int             retry = 1;
6464 
6465         ASSERT(RW_LOCK_HELD(&ip->i_rwlock));
6466 
6467         /* Abort now if the request is either empty or invalid. */
6468         vsa_mask &= (VSA_ACL | VSA_ACLCNT | VSA_DFACL | VSA_DFACLCNT);
6469         if ((vsa_mask == 0) ||
6470             ((vsap->vsa_aclentp == NULL) &&
6471             (vsap->vsa_dfaclentp == NULL))) {
6472                 err = EINVAL;
6473                 goto out;
6474         }
6475 
6476         /*
6477          * Following convention, if this is a directory then we acquire the
6478          * inode's i_rwlock after starting a UFS logging transaction;
6479          * otherwise, we acquire it beforehand. Since we were called (and
6480          * must therefore return) with the lock held, we will have to drop it,
6481          * and later reacquire it, if operating on a directory.
6482          */
6483         if (vp->v_type == VDIR) {
6484                 rw_exit(&ip->i_rwlock);
6485                 haverwlock = 0;
6486         } else {
6487                 /* Upgrade the lock if required. */
6488                 if (!rw_write_held(&ip->i_rwlock)) {
6489                         rw_exit(&ip->i_rwlock);
6490                         rw_enter(&ip->i_rwlock, RW_WRITER);
6491                 }
6492         }
6493 
6494 again:
6495         ASSERT(!(vp->v_type == VDIR && haverwlock));
6496         if (err = ufs_lockfs_begin(ufsvfsp, &ulp, ULOCKFS_SETATTR_MASK)) {
6497                 ulp = NULL;
6498                 retry = 0;
6499                 goto out;
6500         }
6501 
6502         /*
6503          * Check that the file system supports this operation. Note that
6504          * ufs_lockfs_begin() will have checked that the file system had
6505          * not been forcibly unmounted.
6506          */
6507         if (ufsvfsp->vfs_fs->fs_ronly) {
6508                 err = EROFS;
6509                 goto out;
6510         }
6511         if (ufsvfsp->vfs_nosetsec) {
6512                 err = ENOSYS;
6513                 goto out;
6514         }
6515 
6516         if (ulp) {
6517                 TRANS_BEGIN_ASYNC(ufsvfsp, TOP_SETSECATTR,
6518                     trans_size = TOP_SETSECATTR_SIZE(VTOI(vp)));
6519                 donetrans = 1;
6520         }
6521 
6522         if (vp->v_type == VDIR) {
6523                 rw_enter(&ip->i_rwlock, RW_WRITER);
6524                 haverwlock = 1;
6525         }
6526 
6527         ASSERT(haverwlock);
6528 
6529         /* Do the actual work. */
6530         rw_enter(&ip->i_contents, RW_WRITER);
6531         /*
6532          * Suppress out of inodes messages if we will retry.
6533          */
6534         if (retry)
6535                 ip->i_flag |= IQUIET;
6536         err = ufs_acl_set(ip, vsap, flag, cr);
6537         ip->i_flag &= ~IQUIET;
6538         rw_exit(&ip->i_contents);
6539 
6540 out:
6541         if (ulp) {
6542                 if (donetrans) {
6543                         /*
6544                          * top_end_async() can eventually call
6545                          * top_end_sync(), which can block. We must
6546                          * therefore observe the lock-ordering protocol
6547                          * here as well.
6548                          */
6549                         if (vp->v_type == VDIR) {
6550                                 rw_exit(&ip->i_rwlock);
6551                                 haverwlock = 0;
6552                         }
6553                         TRANS_END_ASYNC(ufsvfsp, TOP_SETSECATTR, trans_size);
6554                 }
6555                 ufs_lockfs_end(ulp);
6556         }
6557         /*
6558          * If no inodes available, try scaring a logically-
6559          * free one out of the delete queue to someplace
6560          * that we can find it.
6561          */
6562         if ((err == ENOSPC) && retry && TRANS_ISTRANS(ufsvfsp)) {
6563                 ufs_delete_drain_wait(ufsvfsp, 1);
6564                 retry = 0;
6565                 if (vp->v_type == VDIR && haverwlock) {
6566                         rw_exit(&ip->i_rwlock);
6567                         haverwlock = 0;
6568                 }
6569                 goto again;
6570         }
6571         /*
6572          * If we need to reacquire the lock then it is safe to do so
6573          * as a reader. This is because ufs_rwunlock(), which will be
6574          * called by our caller after we return, does not differentiate
6575          * between shared and exclusive locks.
6576          */
6577         if (!haverwlock) {
6578                 ASSERT(vp->v_type == VDIR);
6579                 rw_enter(&ip->i_rwlock, RW_READER);
6580         }
6581 
6582         return (err);
6583 }
6584 
6585 /*
6586  * Locate the vnode to be used for an event notification. As this will
6587  * be called prior to the name space change perform basic verification
6588  * that the change will be allowed.
6589  */
6590 
6591 static int
6592 ufs_eventlookup(struct vnode *dvp, char *nm, struct cred *cr,
6593     struct vnode **vpp)
6594 {
6595         int     namlen;
6596         int     error;
6597         struct vnode    *vp;
6598         struct inode    *ip;
6599         struct inode    *xip;
6600         struct ufsvfs   *ufsvfsp;
6601         struct ulockfs  *ulp;
6602 
6603         ip = VTOI(dvp);
6604         *vpp = NULL;
6605 
6606         if ((namlen = strlen(nm)) == 0)
6607                 return (EINVAL);
6608 
6609         if (nm[0] == '.') {
6610                 if (namlen == 1)
6611                         return (EINVAL);
6612                 else if ((namlen == 2) && nm[1] == '.') {
6613                         return (EEXIST);
6614                 }
6615         }
6616 
6617         /*
6618          * Check accessibility and write access of parent directory as we
6619          * only want to post the event if we're able to make a change.
6620          */
6621         if (error = ufs_diraccess(ip, IEXEC|IWRITE, cr))
6622                 return (error);
6623 
6624         if (vp = dnlc_lookup(dvp, nm)) {
6625                 if (vp == DNLC_NO_VNODE) {
6626                         VN_RELE(vp);
6627                         return (ENOENT);
6628                 }
6629 
6630                 *vpp = vp;
6631                 return (0);
6632         }
6633 
6634         /*
6635          * Keep the idle queue from getting too long by idling two
6636          * inodes before attempting to allocate another.
6637          * This operation must be performed before entering lockfs
6638          * or a transaction.
6639          */
6640         if (ufs_idle_q.uq_ne > ufs_idle_q.uq_hiwat)
6641                 if ((curthread->t_flag & T_DONTBLOCK) == 0) {
6642                         ins.in_lidles.value.ul += ufs_lookup_idle_count;
6643                         ufs_idle_some(ufs_lookup_idle_count);
6644                 }
6645 
6646         ufsvfsp = ip->i_ufsvfs;
6647 
6648 retry_lookup:
6649         if (error = ufs_lockfs_begin(ufsvfsp, &ulp, ULOCKFS_LOOKUP_MASK))
6650                 return (error);
6651 
6652         if ((error = ufs_dirlook(ip, nm, &xip, cr, 1, 1)) == 0) {
6653                 vp = ITOV(xip);
6654                 *vpp = vp;
6655         }
6656 
6657         if (ulp) {
6658                 ufs_lockfs_end(ulp);
6659         }
6660 
6661         if (error == EAGAIN)
6662                 goto retry_lookup;
6663 
6664         return (error);
6665 }