xref: /illumos-gate/usr/src/uts/common/fs/nfs/nfs3_vnops.c (revision 20a7641f9918de8574b8b3b47dbe35c4bfc78df1)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 /*
22  * Copyright 2010 Sun Microsystems, Inc.  All rights reserved.
23  * Use is subject to license terms.
24  */
25 
26 /*
27  *	Copyright (c) 1983,1984,1985,1986,1987,1988,1989 AT&T.
28  *	All rights reserved.
29  */
30 
31 /*
32  * Copyright (c) 2013, Joyent, Inc. All rights reserved.
33  * Copyright 2015 Nexenta Systems, Inc.  All rights reserved.
34  * Copyright 2022 Oxide Computer Company
35  */
36 
37 #include <sys/param.h>
38 #include <sys/types.h>
39 #include <sys/systm.h>
40 #include <sys/cred.h>
41 #include <sys/time.h>
42 #include <sys/vnode.h>
43 #include <sys/vfs.h>
44 #include <sys/vfs_opreg.h>
45 #include <sys/file.h>
46 #include <sys/filio.h>
47 #include <sys/uio.h>
48 #include <sys/buf.h>
49 #include <sys/mman.h>
50 #include <sys/pathname.h>
51 #include <sys/dirent.h>
52 #include <sys/debug.h>
53 #include <sys/vmsystm.h>
54 #include <sys/fcntl.h>
55 #include <sys/flock.h>
56 #include <sys/swap.h>
57 #include <sys/errno.h>
58 #include <sys/strsubr.h>
59 #include <sys/sysmacros.h>
60 #include <sys/kmem.h>
61 #include <sys/cmn_err.h>
62 #include <sys/pathconf.h>
63 #include <sys/utsname.h>
64 #include <sys/dnlc.h>
65 #include <sys/acl.h>
66 #include <sys/systeminfo.h>
67 #include <sys/atomic.h>
68 #include <sys/policy.h>
69 #include <sys/sdt.h>
70 #include <sys/zone.h>
71 
72 #include <rpc/types.h>
73 #include <rpc/auth.h>
74 #include <rpc/clnt.h>
75 #include <rpc/rpc_rdma.h>
76 
77 #include <nfs/nfs.h>
78 #include <nfs/nfs_clnt.h>
79 #include <nfs/rnode.h>
80 #include <nfs/nfs_acl.h>
81 #include <nfs/lm.h>
82 
83 #include <vm/hat.h>
84 #include <vm/as.h>
85 #include <vm/page.h>
86 #include <vm/pvn.h>
87 #include <vm/seg.h>
88 #include <vm/seg_map.h>
89 #include <vm/seg_kpm.h>
90 #include <vm/seg_vn.h>
91 
92 #include <fs/fs_subr.h>
93 
94 #include <sys/ddi.h>
95 
96 static int	nfs3_rdwrlbn(vnode_t *, page_t *, u_offset_t, size_t, int,
97 			cred_t *);
98 static int	nfs3write(vnode_t *, caddr_t, u_offset_t, int, cred_t *,
99 			stable_how *);
100 static int	nfs3read(vnode_t *, caddr_t, offset_t, int, size_t *, cred_t *);
101 static int	nfs3setattr(vnode_t *, struct vattr *, int, cred_t *);
102 static int	nfs3_accessx(void *, int, cred_t *);
103 static int	nfs3lookup_dnlc(vnode_t *, char *, vnode_t **, cred_t *);
104 static int	nfs3lookup_otw(vnode_t *, char *, vnode_t **, cred_t *, int);
105 static int	nfs3create(vnode_t *, char *, struct vattr *, enum vcexcl,
106 			int, vnode_t **, cred_t *, int);
107 static int	nfs3excl_create_settimes(vnode_t *, struct vattr *, cred_t *);
108 static int	nfs3mknod(vnode_t *, char *, struct vattr *, enum vcexcl,
109 			int, vnode_t **, cred_t *);
110 static int	nfs3rename(vnode_t *, char *, vnode_t *, char *, cred_t *,
111 			caller_context_t *);
112 static int	do_nfs3readdir(vnode_t *, rddir_cache *, cred_t *);
113 static void	nfs3readdir(vnode_t *, rddir_cache *, cred_t *);
114 static void	nfs3readdirplus(vnode_t *, rddir_cache *, cred_t *);
115 static int	nfs3_bio(struct buf *, stable_how *, cred_t *);
116 static int	nfs3_getapage(vnode_t *, u_offset_t, size_t, uint_t *,
117 			page_t *[], size_t, struct seg *, caddr_t,
118 			enum seg_rw, cred_t *);
119 static void	nfs3_readahead(vnode_t *, u_offset_t, caddr_t, struct seg *,
120 			cred_t *);
121 static int	nfs3_sync_putapage(vnode_t *, page_t *, u_offset_t, size_t,
122 			int, cred_t *);
123 static int	nfs3_sync_pageio(vnode_t *, page_t *, u_offset_t, size_t,
124 			int, cred_t *);
125 static int	nfs3_commit(vnode_t *, offset3, count3, cred_t *);
126 static void	nfs3_set_mod(vnode_t *);
127 static void	nfs3_get_commit(vnode_t *);
128 static void	nfs3_get_commit_range(vnode_t *, u_offset_t, size_t);
129 static int	nfs3_putpage_commit(vnode_t *, offset_t, size_t, cred_t *);
130 static int	nfs3_commit_vp(vnode_t *, u_offset_t, size_t,  cred_t *);
131 static int	nfs3_sync_commit(vnode_t *, page_t *, offset3, count3,
132 			cred_t *);
133 static void	nfs3_async_commit(vnode_t *, page_t *, offset3, count3,
134 			cred_t *);
135 static void	nfs3_delmap_callback(struct as *, void *, uint_t);
136 
137 /*
138  * Error flags used to pass information about certain special errors
139  * which need to be handled specially.
140  */
141 #define	NFS_EOF			-98
142 #define	NFS_VERF_MISMATCH	-97
143 
144 /* ALIGN64 aligns the given buffer and adjust buffer size to 64 bit */
145 #define	ALIGN64(x, ptr, sz)						\
146 	x = ((uintptr_t)(ptr)) & (sizeof (uint64_t) - 1);		\
147 	if (x) {							\
148 		x = sizeof (uint64_t) - (x);				\
149 		sz -= (x);						\
150 		ptr += (x);						\
151 	}
152 
153 /*
154  * These are the vnode ops routines which implement the vnode interface to
155  * the networked file system.  These routines just take their parameters,
156  * make them look networkish by putting the right info into interface structs,
157  * and then calling the appropriate remote routine(s) to do the work.
158  *
159  * Note on directory name lookup cacheing:  If we detect a stale fhandle,
160  * we purge the directory cache relative to that vnode.  This way, the
161  * user won't get burned by the cache repeatedly.  See <nfs/rnode.h> for
162  * more details on rnode locking.
163  */
164 
165 static int	nfs3_open(vnode_t **, int, cred_t *, caller_context_t *);
166 static int	nfs3_close(vnode_t *, int, int, offset_t, cred_t *,
167 			caller_context_t *);
168 static int	nfs3_read(vnode_t *, struct uio *, int, cred_t *,
169 			caller_context_t *);
170 static int	nfs3_write(vnode_t *, struct uio *, int, cred_t *,
171 			caller_context_t *);
172 static int	nfs3_ioctl(vnode_t *, int, intptr_t, int, cred_t *, int *,
173 			caller_context_t *);
174 static int	nfs3_getattr(vnode_t *, struct vattr *, int, cred_t *,
175 			caller_context_t *);
176 static int	nfs3_setattr(vnode_t *, struct vattr *, int, cred_t *,
177 			caller_context_t *);
178 static int	nfs3_access(vnode_t *, int, int, cred_t *, caller_context_t *);
179 static int	nfs3_readlink(vnode_t *, struct uio *, cred_t *,
180 			caller_context_t *);
181 static int	nfs3_fsync(vnode_t *, int, cred_t *, caller_context_t *);
182 static void	nfs3_inactive(vnode_t *, cred_t *, caller_context_t *);
183 static int	nfs3_lookup(vnode_t *, char *, vnode_t **,
184 			struct pathname *, int, vnode_t *, cred_t *,
185 			caller_context_t *, int *, pathname_t *);
186 static int	nfs3_create(vnode_t *, char *, struct vattr *, enum vcexcl,
187 			int, vnode_t **, cred_t *, int, caller_context_t *,
188 			vsecattr_t *);
189 static int	nfs3_remove(vnode_t *, char *, cred_t *, caller_context_t *,
190 			int);
191 static int	nfs3_link(vnode_t *, vnode_t *, char *, cred_t *,
192 			caller_context_t *, int);
193 static int	nfs3_rename(vnode_t *, char *, vnode_t *, char *, cred_t *,
194 			caller_context_t *, int);
195 static int	nfs3_mkdir(vnode_t *, char *, struct vattr *, vnode_t **,
196 			cred_t *, caller_context_t *, int, vsecattr_t *);
197 static int	nfs3_rmdir(vnode_t *, char *, vnode_t *, cred_t *,
198 			caller_context_t *, int);
199 static int	nfs3_symlink(vnode_t *, char *, struct vattr *, char *,
200 			cred_t *, caller_context_t *, int);
201 static int	nfs3_readdir(vnode_t *, struct uio *, cred_t *, int *,
202 			caller_context_t *, int);
203 static int	nfs3_fid(vnode_t *, fid_t *, caller_context_t *);
204 static int	nfs3_rwlock(vnode_t *, int, caller_context_t *);
205 static void	nfs3_rwunlock(vnode_t *, int, caller_context_t *);
206 static int	nfs3_seek(vnode_t *, offset_t, offset_t *, caller_context_t *);
207 static int	nfs3_getpage(vnode_t *, offset_t, size_t, uint_t *,
208 			page_t *[], size_t, struct seg *, caddr_t,
209 			enum seg_rw, cred_t *, caller_context_t *);
210 static int	nfs3_putpage(vnode_t *, offset_t, size_t, int, cred_t *,
211 			caller_context_t *);
212 static int	nfs3_map(vnode_t *, offset_t, struct as *, caddr_t *, size_t,
213 			uchar_t, uchar_t, uint_t, cred_t *, caller_context_t *);
214 static int	nfs3_addmap(vnode_t *, offset_t, struct as *, caddr_t, size_t,
215 			uchar_t, uchar_t, uint_t, cred_t *, caller_context_t *);
216 static int	nfs3_frlock(vnode_t *, int, struct flock64 *, int, offset_t,
217 			struct flk_callback *, cred_t *, caller_context_t *);
218 static int	nfs3_space(vnode_t *, int, struct flock64 *, int, offset_t,
219 			cred_t *, caller_context_t *);
220 static int	nfs3_realvp(vnode_t *, vnode_t **, caller_context_t *);
221 static int	nfs3_delmap(vnode_t *, offset_t, struct as *, caddr_t, size_t,
222 			uint_t, uint_t, uint_t, cred_t *, caller_context_t *);
223 static int	nfs3_pathconf(vnode_t *, int, ulong_t *, cred_t *,
224 			caller_context_t *);
225 static int	nfs3_pageio(vnode_t *, page_t *, u_offset_t, size_t, int,
226 			cred_t *, caller_context_t *);
227 static void	nfs3_dispose(vnode_t *, page_t *, int, int, cred_t *,
228 			caller_context_t *);
229 static int	nfs3_setsecattr(vnode_t *, vsecattr_t *, int, cred_t *,
230 			caller_context_t *);
231 static int	nfs3_getsecattr(vnode_t *, vsecattr_t *, int, cred_t *,
232 			caller_context_t *);
233 static int	nfs3_shrlock(vnode_t *, int, struct shrlock *, int, cred_t *,
234 			caller_context_t *);
235 
236 struct vnodeops *nfs3_vnodeops;
237 
238 const fs_operation_def_t nfs3_vnodeops_template[] = {
239 	VOPNAME_OPEN,		{ .vop_open = nfs3_open },
240 	VOPNAME_CLOSE,		{ .vop_close = nfs3_close },
241 	VOPNAME_READ,		{ .vop_read = nfs3_read },
242 	VOPNAME_WRITE,		{ .vop_write = nfs3_write },
243 	VOPNAME_IOCTL,		{ .vop_ioctl = nfs3_ioctl },
244 	VOPNAME_GETATTR,	{ .vop_getattr = nfs3_getattr },
245 	VOPNAME_SETATTR,	{ .vop_setattr = nfs3_setattr },
246 	VOPNAME_ACCESS,		{ .vop_access = nfs3_access },
247 	VOPNAME_LOOKUP,		{ .vop_lookup = nfs3_lookup },
248 	VOPNAME_CREATE,		{ .vop_create = nfs3_create },
249 	VOPNAME_REMOVE,		{ .vop_remove = nfs3_remove },
250 	VOPNAME_LINK,		{ .vop_link = nfs3_link },
251 	VOPNAME_RENAME,		{ .vop_rename = nfs3_rename },
252 	VOPNAME_MKDIR,		{ .vop_mkdir = nfs3_mkdir },
253 	VOPNAME_RMDIR,		{ .vop_rmdir = nfs3_rmdir },
254 	VOPNAME_READDIR,	{ .vop_readdir = nfs3_readdir },
255 	VOPNAME_SYMLINK,	{ .vop_symlink = nfs3_symlink },
256 	VOPNAME_READLINK,	{ .vop_readlink = nfs3_readlink },
257 	VOPNAME_FSYNC,		{ .vop_fsync = nfs3_fsync },
258 	VOPNAME_INACTIVE,	{ .vop_inactive = nfs3_inactive },
259 	VOPNAME_FID,		{ .vop_fid = nfs3_fid },
260 	VOPNAME_RWLOCK,		{ .vop_rwlock = nfs3_rwlock },
261 	VOPNAME_RWUNLOCK,	{ .vop_rwunlock = nfs3_rwunlock },
262 	VOPNAME_SEEK,		{ .vop_seek = nfs3_seek },
263 	VOPNAME_FRLOCK,		{ .vop_frlock = nfs3_frlock },
264 	VOPNAME_SPACE,		{ .vop_space = nfs3_space },
265 	VOPNAME_REALVP,		{ .vop_realvp = nfs3_realvp },
266 	VOPNAME_GETPAGE,	{ .vop_getpage = nfs3_getpage },
267 	VOPNAME_PUTPAGE,	{ .vop_putpage = nfs3_putpage },
268 	VOPNAME_MAP,		{ .vop_map = nfs3_map },
269 	VOPNAME_ADDMAP,		{ .vop_addmap = nfs3_addmap },
270 	VOPNAME_DELMAP,		{ .vop_delmap = nfs3_delmap },
271 	/* no separate nfs3_dump */
272 	VOPNAME_DUMP,		{ .vop_dump = nfs_dump },
273 	VOPNAME_PATHCONF,	{ .vop_pathconf = nfs3_pathconf },
274 	VOPNAME_PAGEIO,		{ .vop_pageio = nfs3_pageio },
275 	VOPNAME_DISPOSE,	{ .vop_dispose = nfs3_dispose },
276 	VOPNAME_SETSECATTR,	{ .vop_setsecattr = nfs3_setsecattr },
277 	VOPNAME_GETSECATTR,	{ .vop_getsecattr = nfs3_getsecattr },
278 	VOPNAME_SHRLOCK,	{ .vop_shrlock = nfs3_shrlock },
279 	VOPNAME_VNEVENT,	{ .vop_vnevent = fs_vnevent_support },
280 	NULL,			NULL
281 };
282 
283 /*
284  * XXX:  This is referenced in modstubs.S
285  */
286 struct vnodeops *
287 nfs3_getvnodeops(void)
288 {
289 	return (nfs3_vnodeops);
290 }
291 
292 /* ARGSUSED */
293 static int
294 nfs3_open(vnode_t **vpp, int flag, cred_t *cr, caller_context_t *ct)
295 {
296 	int error;
297 	struct vattr va;
298 	rnode_t *rp;
299 	vnode_t *vp;
300 
301 	vp = *vpp;
302 	if (nfs_zone() != VTOMI(vp)->mi_zone)
303 		return (EIO);
304 	rp = VTOR(vp);
305 	mutex_enter(&rp->r_statelock);
306 	if (rp->r_cred == NULL) {
307 		crhold(cr);
308 		rp->r_cred = cr;
309 	}
310 	mutex_exit(&rp->r_statelock);
311 
312 	/*
313 	 * If there is no cached data or if close-to-open
314 	 * consistency checking is turned off, we can avoid
315 	 * the over the wire getattr.  Otherwise, if the
316 	 * file system is mounted readonly, then just verify
317 	 * the caches are up to date using the normal mechanism.
318 	 * Else, if the file is not mmap'd, then just mark
319 	 * the attributes as timed out.  They will be refreshed
320 	 * and the caches validated prior to being used.
321 	 * Else, the file system is mounted writeable so
322 	 * force an over the wire GETATTR in order to ensure
323 	 * that all cached data is valid.
324 	 */
325 	if (vp->v_count > 1 ||
326 	    ((vn_has_cached_data(vp) || HAVE_RDDIR_CACHE(rp)) &&
327 	    !(VTOMI(vp)->mi_flags & MI_NOCTO))) {
328 		if (vn_is_readonly(vp))
329 			error = nfs3_validate_caches(vp, cr);
330 		else if (rp->r_mapcnt == 0 && vp->v_count == 1) {
331 			PURGE_ATTRCACHE(vp);
332 			error = 0;
333 		} else {
334 			va.va_mask = AT_ALL;
335 			error = nfs3_getattr_otw(vp, &va, cr);
336 		}
337 	} else
338 		error = 0;
339 
340 	return (error);
341 }
342 
343 /* ARGSUSED */
344 static int
345 nfs3_close(vnode_t *vp, int flag, int count, offset_t offset, cred_t *cr,
346     caller_context_t *ct)
347 {
348 	rnode_t *rp;
349 	int error;
350 	struct vattr va;
351 
352 	/*
353 	 * zone_enter(2) prevents processes from changing zones with NFS files
354 	 * open; if we happen to get here from the wrong zone we can't do
355 	 * anything over the wire.
356 	 */
357 	if (VTOMI(vp)->mi_zone != nfs_zone()) {
358 		/*
359 		 * We could attempt to clean up locks, except we're sure
360 		 * that the current process didn't acquire any locks on
361 		 * the file: any attempt to lock a file belong to another zone
362 		 * will fail, and one can't lock an NFS file and then change
363 		 * zones, as that fails too.
364 		 *
365 		 * Returning an error here is the sane thing to do.  A
366 		 * subsequent call to VN_RELE() which translates to a
367 		 * nfs3_inactive() will clean up state: if the zone of the
368 		 * vnode's origin is still alive and kicking, an async worker
369 		 * thread will handle the request (from the correct zone), and
370 		 * everything (minus the commit and final nfs3_getattr_otw()
371 		 * call) should be OK. If the zone is going away
372 		 * nfs_async_inactive() will throw away cached pages inline.
373 		 */
374 		return (EIO);
375 	}
376 
377 	/*
378 	 * If we are using local locking for this filesystem, then
379 	 * release all of the SYSV style record locks.  Otherwise,
380 	 * we are doing network locking and we need to release all
381 	 * of the network locks.  All of the locks held by this
382 	 * process on this file are released no matter what the
383 	 * incoming reference count is.
384 	 */
385 	if (VTOMI(vp)->mi_flags & MI_LLOCK) {
386 		cleanlocks(vp, ttoproc(curthread)->p_pid, 0);
387 		cleanshares(vp, ttoproc(curthread)->p_pid);
388 	} else
389 		nfs_lockrelease(vp, flag, offset, cr);
390 
391 	if (count > 1)
392 		return (0);
393 
394 	/*
395 	 * If the file has been `unlinked', then purge the
396 	 * DNLC so that this vnode will get reycled quicker
397 	 * and the .nfs* file on the server will get removed.
398 	 */
399 	rp = VTOR(vp);
400 	if (rp->r_unldvp != NULL)
401 		dnlc_purge_vp(vp);
402 
403 	/*
404 	 * If the file was open for write and there are pages,
405 	 * then if the file system was mounted using the "no-close-
406 	 *	to-open" semantics, then start an asynchronous flush
407 	 *	of the all of the pages in the file.
408 	 * else the file system was not mounted using the "no-close-
409 	 *	to-open" semantics, then do a synchronous flush and
410 	 *	commit of all of the dirty and uncommitted pages.
411 	 *
412 	 * The asynchronous flush of the pages in the "nocto" path
413 	 * mostly just associates a cred pointer with the rnode so
414 	 * writes which happen later will have a better chance of
415 	 * working.  It also starts the data being written to the
416 	 * server, but without unnecessarily delaying the application.
417 	 */
418 	if ((flag & FWRITE) && vn_has_cached_data(vp)) {
419 		if (VTOMI(vp)->mi_flags & MI_NOCTO) {
420 			error = nfs3_putpage(vp, (offset_t)0, 0, B_ASYNC,
421 			    cr, ct);
422 			if (error == EAGAIN)
423 				error = 0;
424 		} else
425 			error = nfs3_putpage_commit(vp, (offset_t)0, 0, cr);
426 		if (!error) {
427 			mutex_enter(&rp->r_statelock);
428 			error = rp->r_error;
429 			rp->r_error = 0;
430 			mutex_exit(&rp->r_statelock);
431 		}
432 	} else {
433 		mutex_enter(&rp->r_statelock);
434 		error = rp->r_error;
435 		rp->r_error = 0;
436 		mutex_exit(&rp->r_statelock);
437 	}
438 
439 	/*
440 	 * If RWRITEATTR is set, then issue an over the wire GETATTR to
441 	 * refresh the attribute cache with a set of attributes which
442 	 * weren't returned from a WRITE.  This will enable the close-
443 	 * to-open processing to work.
444 	 */
445 	if (rp->r_flags & RWRITEATTR)
446 		(void) nfs3_getattr_otw(vp, &va, cr);
447 
448 	return (error);
449 }
450 
451 /* ARGSUSED */
452 static int
453 nfs3_directio_read(vnode_t *vp, struct uio *uiop, cred_t *cr)
454 {
455 	mntinfo_t *mi;
456 	READ3args args;
457 	READ3uiores res;
458 	int tsize;
459 	offset_t offset;
460 	ssize_t count;
461 	int error;
462 	int douprintf;
463 	failinfo_t fi;
464 	char *sv_hostname;
465 
466 	mi = VTOMI(vp);
467 	ASSERT(nfs_zone() == VTOMI(vp)->mi_zone);
468 	sv_hostname = VTOR(vp)->r_server->sv_hostname;
469 
470 	douprintf = 1;
471 	args.file = *VTOFH3(vp);
472 	fi.vp = vp;
473 	fi.fhp = (caddr_t)&args.file;
474 	fi.copyproc = nfs3copyfh;
475 	fi.lookupproc = nfs3lookup;
476 	fi.xattrdirproc = acl_getxattrdir3;
477 
478 	res.uiop = uiop;
479 
480 	res.wlist = NULL;
481 
482 	offset = uiop->uio_loffset;
483 	count = uiop->uio_resid;
484 
485 	do {
486 		if (mi->mi_io_kstats) {
487 			mutex_enter(&mi->mi_lock);
488 			kstat_runq_enter(KSTAT_IO_PTR(mi->mi_io_kstats));
489 			mutex_exit(&mi->mi_lock);
490 		}
491 
492 		do {
493 			tsize = MIN(mi->mi_tsize, count);
494 			args.offset = (offset3)offset;
495 			args.count = (count3)tsize;
496 			res.size = (uint_t)tsize;
497 			args.res_uiop = uiop;
498 			args.res_data_val_alt = NULL;
499 
500 			error = rfs3call(mi, NFSPROC3_READ,
501 			    xdr_READ3args, (caddr_t)&args,
502 			    xdr_READ3uiores, (caddr_t)&res, cr,
503 			    &douprintf, &res.status, 0, &fi);
504 		} while (error == ENFS_TRYAGAIN);
505 
506 		if (mi->mi_io_kstats) {
507 			mutex_enter(&mi->mi_lock);
508 			kstat_runq_exit(KSTAT_IO_PTR(mi->mi_io_kstats));
509 			mutex_exit(&mi->mi_lock);
510 		}
511 
512 		if (error)
513 			return (error);
514 
515 		error = geterrno3(res.status);
516 		if (error)
517 			return (error);
518 
519 		if (res.count != res.size) {
520 			zcmn_err(getzoneid(), CE_WARN,
521 "nfs3_directio_read: server %s returned incorrect amount",
522 			    sv_hostname);
523 			return (EIO);
524 		}
525 		count -= res.count;
526 		offset += res.count;
527 		if (mi->mi_io_kstats) {
528 			mutex_enter(&mi->mi_lock);
529 			KSTAT_IO_PTR(mi->mi_io_kstats)->reads++;
530 			KSTAT_IO_PTR(mi->mi_io_kstats)->nread += res.count;
531 			mutex_exit(&mi->mi_lock);
532 		}
533 		lwp_stat_update(LWP_STAT_INBLK, 1);
534 	} while (count && !res.eof);
535 
536 	return (0);
537 }
538 
539 /* ARGSUSED */
540 static int
541 nfs3_read(vnode_t *vp, struct uio *uiop, int ioflag, cred_t *cr,
542     caller_context_t *ct)
543 {
544 	rnode_t *rp;
545 	u_offset_t off;
546 	offset_t diff;
547 	int on;
548 	size_t n;
549 	caddr_t base;
550 	uint_t flags;
551 	int error = 0;
552 	mntinfo_t *mi;
553 
554 	rp = VTOR(vp);
555 	mi = VTOMI(vp);
556 
557 	ASSERT(nfs_rw_lock_held(&rp->r_rwlock, RW_READER));
558 
559 	if (nfs_zone() != mi->mi_zone)
560 		return (EIO);
561 
562 	if (vp->v_type != VREG)
563 		return (EISDIR);
564 
565 	if (uiop->uio_resid == 0)
566 		return (0);
567 
568 	if (uiop->uio_loffset < 0 || uiop->uio_loffset + uiop->uio_resid < 0)
569 		return (EINVAL);
570 
571 	/*
572 	 * Bypass VM if caching has been disabled (e.g., locking) or if
573 	 * using client-side direct I/O and the file is not mmap'd and
574 	 * there are no cached pages.
575 	 */
576 	if ((vp->v_flag & VNOCACHE) ||
577 	    (((rp->r_flags & RDIRECTIO) || (mi->mi_flags & MI_DIRECTIO)) &&
578 	    rp->r_mapcnt == 0 && rp->r_inmap == 0 &&
579 	    !vn_has_cached_data(vp))) {
580 		return (nfs3_directio_read(vp, uiop, cr));
581 	}
582 
583 	do {
584 		off = uiop->uio_loffset & MAXBMASK; /* mapping offset */
585 		on = uiop->uio_loffset & MAXBOFFSET; /* Relative offset */
586 		n = MIN(MAXBSIZE - on, uiop->uio_resid);
587 
588 		error = nfs3_validate_caches(vp, cr);
589 		if (error)
590 			break;
591 
592 		mutex_enter(&rp->r_statelock);
593 		while (rp->r_flags & RINCACHEPURGE) {
594 			if (!cv_wait_sig(&rp->r_cv, &rp->r_statelock)) {
595 				mutex_exit(&rp->r_statelock);
596 				return (EINTR);
597 			}
598 		}
599 		diff = rp->r_size - uiop->uio_loffset;
600 		mutex_exit(&rp->r_statelock);
601 		if (diff <= 0)
602 			break;
603 		if (diff < n)
604 			n = (size_t)diff;
605 
606 		if (vpm_enable) {
607 			/*
608 			 * Copy data.
609 			 */
610 			error = vpm_data_copy(vp, off + on, n, uiop,
611 			    1, NULL, 0, S_READ);
612 		} else {
613 			base = segmap_getmapflt(segkmap, vp, off + on, n, 1,
614 			    S_READ);
615 
616 			error = uiomove(base + on, n, UIO_READ, uiop);
617 		}
618 
619 		if (!error) {
620 			/*
621 			 * If read a whole block or read to eof,
622 			 * won't need this buffer again soon.
623 			 */
624 			mutex_enter(&rp->r_statelock);
625 			if (n + on == MAXBSIZE ||
626 			    uiop->uio_loffset == rp->r_size)
627 				flags = SM_DONTNEED;
628 			else
629 				flags = 0;
630 			mutex_exit(&rp->r_statelock);
631 			if (vpm_enable) {
632 				error = vpm_sync_pages(vp, off, n, flags);
633 			} else {
634 				error = segmap_release(segkmap, base, flags);
635 			}
636 		} else {
637 			if (vpm_enable) {
638 				(void) vpm_sync_pages(vp, off, n, 0);
639 			} else {
640 				(void) segmap_release(segkmap, base, 0);
641 			}
642 		}
643 	} while (!error && uiop->uio_resid > 0);
644 
645 	return (error);
646 }
647 
648 /* ARGSUSED */
649 static int
650 nfs3_write(vnode_t *vp, struct uio *uiop, int ioflag, cred_t *cr,
651     caller_context_t *ct)
652 {
653 	rlim64_t limit = uiop->uio_llimit;
654 	rnode_t *rp;
655 	u_offset_t off;
656 	caddr_t base;
657 	uint_t flags;
658 	int remainder;
659 	size_t n;
660 	int on;
661 	int error;
662 	int resid;
663 	offset_t offset;
664 	mntinfo_t *mi;
665 	uint_t bsize;
666 
667 	rp = VTOR(vp);
668 
669 	if (vp->v_type != VREG)
670 		return (EISDIR);
671 
672 	mi = VTOMI(vp);
673 	if (nfs_zone() != mi->mi_zone)
674 		return (EIO);
675 	if (uiop->uio_resid == 0)
676 		return (0);
677 
678 	if (ioflag & FAPPEND) {
679 		struct vattr va;
680 
681 		/*
682 		 * Must serialize if appending.
683 		 */
684 		if (nfs_rw_lock_held(&rp->r_rwlock, RW_READER)) {
685 			nfs_rw_exit(&rp->r_rwlock);
686 			if (nfs_rw_enter_sig(&rp->r_rwlock, RW_WRITER,
687 			    INTR(vp)))
688 				return (EINTR);
689 		}
690 
691 		va.va_mask = AT_SIZE;
692 		error = nfs3getattr(vp, &va, cr);
693 		if (error)
694 			return (error);
695 		uiop->uio_loffset = va.va_size;
696 	}
697 
698 	offset = uiop->uio_loffset + uiop->uio_resid;
699 
700 	if (uiop->uio_loffset < 0 || offset < 0)
701 		return (EINVAL);
702 
703 	if (limit == RLIM64_INFINITY || limit > MAXOFFSET_T)
704 		limit = MAXOFFSET_T;
705 
706 	/*
707 	 * Check to make sure that the process will not exceed
708 	 * its limit on file size.  It is okay to write up to
709 	 * the limit, but not beyond.  Thus, the write which
710 	 * reaches the limit will be short and the next write
711 	 * will return an error.
712 	 */
713 	remainder = 0;
714 	if (offset > limit) {
715 		remainder = offset - limit;
716 		uiop->uio_resid = limit - uiop->uio_loffset;
717 		if (uiop->uio_resid <= 0) {
718 			proc_t *p = ttoproc(curthread);
719 
720 			uiop->uio_resid += remainder;
721 			mutex_enter(&p->p_lock);
722 			(void) rctl_action(rctlproc_legacy[RLIMIT_FSIZE],
723 			    p->p_rctls, p, RCA_UNSAFE_SIGINFO);
724 			mutex_exit(&p->p_lock);
725 			return (EFBIG);
726 		}
727 	}
728 
729 	if (nfs_rw_enter_sig(&rp->r_lkserlock, RW_READER, INTR(vp)))
730 		return (EINTR);
731 
732 	/*
733 	 * Bypass VM if caching has been disabled (e.g., locking) or if
734 	 * using client-side direct I/O and the file is not mmap'd and
735 	 * there are no cached pages.
736 	 */
737 	if ((vp->v_flag & VNOCACHE) ||
738 	    (((rp->r_flags & RDIRECTIO) || (mi->mi_flags & MI_DIRECTIO)) &&
739 	    rp->r_mapcnt == 0 && rp->r_inmap == 0 &&
740 	    !vn_has_cached_data(vp))) {
741 		size_t bufsize;
742 		int count;
743 		u_offset_t org_offset;
744 		stable_how stab_comm;
745 
746 nfs3_fwrite:
747 		if (rp->r_flags & RSTALE) {
748 			resid = uiop->uio_resid;
749 			offset = uiop->uio_loffset;
750 			error = rp->r_error;
751 			/*
752 			 * A close may have cleared r_error, if so,
753 			 * propagate ESTALE error return properly
754 			 */
755 			if (error == 0)
756 				error = ESTALE;
757 			goto bottom;
758 		}
759 		bufsize = MIN(uiop->uio_resid, mi->mi_stsize);
760 		base = kmem_alloc(bufsize, KM_SLEEP);
761 		do {
762 			if (ioflag & FDSYNC)
763 				stab_comm = DATA_SYNC;
764 			else
765 				stab_comm = FILE_SYNC;
766 			resid = uiop->uio_resid;
767 			offset = uiop->uio_loffset;
768 			count = MIN(uiop->uio_resid, bufsize);
769 			org_offset = uiop->uio_loffset;
770 			error = uiomove(base, count, UIO_WRITE, uiop);
771 			if (!error) {
772 				error = nfs3write(vp, base, org_offset,
773 				    count, cr, &stab_comm);
774 			}
775 		} while (!error && uiop->uio_resid > 0);
776 		kmem_free(base, bufsize);
777 		goto bottom;
778 	}
779 
780 
781 	bsize = vp->v_vfsp->vfs_bsize;
782 
783 	do {
784 		off = uiop->uio_loffset & MAXBMASK; /* mapping offset */
785 		on = uiop->uio_loffset & MAXBOFFSET; /* Relative offset */
786 		n = MIN(MAXBSIZE - on, uiop->uio_resid);
787 
788 		resid = uiop->uio_resid;
789 		offset = uiop->uio_loffset;
790 
791 		if (rp->r_flags & RSTALE) {
792 			error = rp->r_error;
793 			/*
794 			 * A close may have cleared r_error, if so,
795 			 * propagate ESTALE error return properly
796 			 */
797 			if (error == 0)
798 				error = ESTALE;
799 			break;
800 		}
801 
802 		/*
803 		 * Don't create dirty pages faster than they
804 		 * can be cleaned so that the system doesn't
805 		 * get imbalanced.  If the async queue is
806 		 * maxed out, then wait for it to drain before
807 		 * creating more dirty pages.  Also, wait for
808 		 * any threads doing pagewalks in the vop_getattr
809 		 * entry points so that they don't block for
810 		 * long periods.
811 		 */
812 		mutex_enter(&rp->r_statelock);
813 		while ((mi->mi_max_threads != 0 &&
814 		    rp->r_awcount > 2 * mi->mi_max_threads) ||
815 		    rp->r_gcount > 0) {
816 			if (INTR(vp)) {
817 				klwp_t *lwp = ttolwp(curthread);
818 
819 				if (lwp != NULL)
820 					lwp->lwp_nostop++;
821 				if (!cv_wait_sig(&rp->r_cv, &rp->r_statelock)) {
822 					mutex_exit(&rp->r_statelock);
823 					if (lwp != NULL)
824 						lwp->lwp_nostop--;
825 					error = EINTR;
826 					goto bottom;
827 				}
828 				if (lwp != NULL)
829 					lwp->lwp_nostop--;
830 			} else
831 				cv_wait(&rp->r_cv, &rp->r_statelock);
832 		}
833 		mutex_exit(&rp->r_statelock);
834 
835 		/*
836 		 * Touch the page and fault it in if it is not in core
837 		 * before segmap_getmapflt or vpm_data_copy can lock it.
838 		 * This is to avoid the deadlock if the buffer is mapped
839 		 * to the same file through mmap which we want to write.
840 		 */
841 		uio_prefaultpages((long)n, uiop);
842 
843 		if (vpm_enable) {
844 			/*
845 			 * It will use kpm mappings, so no need to
846 			 * pass an address.
847 			 */
848 			error = writerp(rp, NULL, n, uiop, 0);
849 		} else  {
850 			if (segmap_kpm) {
851 				int pon = uiop->uio_loffset & PAGEOFFSET;
852 				size_t pn = MIN(PAGESIZE - pon,
853 				    uiop->uio_resid);
854 				int pagecreate;
855 
856 				mutex_enter(&rp->r_statelock);
857 				pagecreate = (pon == 0) && (pn == PAGESIZE ||
858 				    uiop->uio_loffset + pn >= rp->r_size);
859 				mutex_exit(&rp->r_statelock);
860 
861 				base = segmap_getmapflt(segkmap, vp, off + on,
862 				    pn, !pagecreate, S_WRITE);
863 
864 				error = writerp(rp, base + pon, n, uiop,
865 				    pagecreate);
866 
867 			} else {
868 				base = segmap_getmapflt(segkmap, vp, off + on,
869 				    n, 0, S_READ);
870 				error = writerp(rp, base + on, n, uiop, 0);
871 			}
872 		}
873 
874 		if (!error) {
875 			if (mi->mi_flags & MI_NOAC)
876 				flags = SM_WRITE;
877 			else if ((uiop->uio_loffset % bsize) == 0 ||
878 			    IS_SWAPVP(vp)) {
879 				/*
880 				 * Have written a whole block.
881 				 * Start an asynchronous write
882 				 * and mark the buffer to
883 				 * indicate that it won't be
884 				 * needed again soon.
885 				 */
886 				flags = SM_WRITE | SM_ASYNC | SM_DONTNEED;
887 			} else
888 				flags = 0;
889 			if ((ioflag & (FSYNC|FDSYNC)) ||
890 			    (rp->r_flags & ROUTOFSPACE)) {
891 				flags &= ~SM_ASYNC;
892 				flags |= SM_WRITE;
893 			}
894 			if (vpm_enable) {
895 				error = vpm_sync_pages(vp, off, n, flags);
896 			} else {
897 				error = segmap_release(segkmap, base, flags);
898 			}
899 		} else {
900 			if (vpm_enable) {
901 				(void) vpm_sync_pages(vp, off, n, 0);
902 			} else {
903 				(void) segmap_release(segkmap, base, 0);
904 			}
905 			/*
906 			 * In the event that we got an access error while
907 			 * faulting in a page for a write-only file just
908 			 * force a write.
909 			 */
910 			if (error == EACCES)
911 				goto nfs3_fwrite;
912 		}
913 	} while (!error && uiop->uio_resid > 0);
914 
915 bottom:
916 	if (error) {
917 		uiop->uio_resid = resid + remainder;
918 		uiop->uio_loffset = offset;
919 	} else
920 		uiop->uio_resid += remainder;
921 
922 	nfs_rw_exit(&rp->r_lkserlock);
923 
924 	return (error);
925 }
926 
927 /*
928  * Flags are composed of {B_ASYNC, B_INVAL, B_FREE, B_DONTNEED}
929  */
930 static int
931 nfs3_rdwrlbn(vnode_t *vp, page_t *pp, u_offset_t off, size_t len,
932     int flags, cred_t *cr)
933 {
934 	struct buf *bp;
935 	int error;
936 	page_t *savepp;
937 	uchar_t fsdata;
938 	stable_how stab_comm;
939 
940 	ASSERT(nfs_zone() == VTOMI(vp)->mi_zone);
941 	bp = pageio_setup(pp, len, vp, flags);
942 	ASSERT(bp != NULL);
943 
944 	/*
945 	 * pageio_setup should have set b_addr to 0.  This
946 	 * is correct since we want to do I/O on a page
947 	 * boundary.  bp_mapin will use this addr to calculate
948 	 * an offset, and then set b_addr to the kernel virtual
949 	 * address it allocated for us.
950 	 */
951 	ASSERT(bp->b_un.b_addr == 0);
952 
953 	bp->b_edev = 0;
954 	bp->b_dev = 0;
955 	bp->b_lblkno = lbtodb(off);
956 	bp->b_file = vp;
957 	bp->b_offset = (offset_t)off;
958 	bp_mapin(bp);
959 
960 	/*
961 	 * Calculate the desired level of stability to write data
962 	 * on the server and then mark all of the pages to reflect
963 	 * this.
964 	 */
965 	if ((flags & (B_WRITE|B_ASYNC)) == (B_WRITE|B_ASYNC) &&
966 	    freemem > desfree) {
967 		stab_comm = UNSTABLE;
968 		fsdata = C_DELAYCOMMIT;
969 	} else {
970 		stab_comm = FILE_SYNC;
971 		fsdata = C_NOCOMMIT;
972 	}
973 
974 	savepp = pp;
975 	do {
976 		pp->p_fsdata = fsdata;
977 	} while ((pp = pp->p_next) != savepp);
978 
979 	error = nfs3_bio(bp, &stab_comm, cr);
980 
981 	bp_mapout(bp);
982 	pageio_done(bp);
983 
984 	/*
985 	 * If the server wrote pages in a more stable fashion than
986 	 * was requested, then clear all of the marks in the pages
987 	 * indicating that COMMIT operations were required.
988 	 */
989 	if (stab_comm != UNSTABLE && fsdata == C_DELAYCOMMIT) {
990 		do {
991 			pp->p_fsdata = C_NOCOMMIT;
992 		} while ((pp = pp->p_next) != savepp);
993 	}
994 
995 	return (error);
996 }
997 
998 /*
999  * Write to file.  Writes to remote server in largest size
1000  * chunks that the server can handle.  Write is synchronous.
1001  */
1002 static int
1003 nfs3write(vnode_t *vp, caddr_t base, u_offset_t offset, int count, cred_t *cr,
1004     stable_how *stab_comm)
1005 {
1006 	mntinfo_t *mi;
1007 	WRITE3args args;
1008 	WRITE3res res;
1009 	int error;
1010 	int tsize;
1011 	rnode_t *rp;
1012 	int douprintf;
1013 
1014 	rp = VTOR(vp);
1015 	mi = VTOMI(vp);
1016 
1017 	ASSERT(nfs_zone() == mi->mi_zone);
1018 
1019 	args.file = *VTOFH3(vp);
1020 	args.stable = *stab_comm;
1021 
1022 	*stab_comm = FILE_SYNC;
1023 
1024 	douprintf = 1;
1025 
1026 	do {
1027 		if ((vp->v_flag & VNOCACHE) ||
1028 		    (rp->r_flags & RDIRECTIO) ||
1029 		    (mi->mi_flags & MI_DIRECTIO))
1030 			tsize = MIN(mi->mi_stsize, count);
1031 		else
1032 			tsize = MIN(mi->mi_curwrite, count);
1033 		args.offset = (offset3)offset;
1034 		args.count = (count3)tsize;
1035 		args.data.data_len = (uint_t)tsize;
1036 		args.data.data_val = base;
1037 
1038 		if (mi->mi_io_kstats) {
1039 			mutex_enter(&mi->mi_lock);
1040 			kstat_runq_enter(KSTAT_IO_PTR(mi->mi_io_kstats));
1041 			mutex_exit(&mi->mi_lock);
1042 		}
1043 		args.mblk = NULL;
1044 		do {
1045 			error = rfs3call(mi, NFSPROC3_WRITE,
1046 			    xdr_WRITE3args, (caddr_t)&args,
1047 			    xdr_WRITE3res, (caddr_t)&res, cr,
1048 			    &douprintf, &res.status, 0, NULL);
1049 		} while (error == ENFS_TRYAGAIN);
1050 		if (mi->mi_io_kstats) {
1051 			mutex_enter(&mi->mi_lock);
1052 			kstat_runq_exit(KSTAT_IO_PTR(mi->mi_io_kstats));
1053 			mutex_exit(&mi->mi_lock);
1054 		}
1055 
1056 		if (error)
1057 			return (error);
1058 		error = geterrno3(res.status);
1059 		if (!error) {
1060 			if (res.resok.count > args.count) {
1061 				zcmn_err(getzoneid(), CE_WARN,
1062 				    "nfs3write: server %s wrote %u, "
1063 				    "requested was %u",
1064 				    rp->r_server->sv_hostname,
1065 				    res.resok.count, args.count);
1066 				return (EIO);
1067 			}
1068 			if (res.resok.committed == UNSTABLE) {
1069 				*stab_comm = UNSTABLE;
1070 				if (args.stable == DATA_SYNC ||
1071 				    args.stable == FILE_SYNC) {
1072 					zcmn_err(getzoneid(), CE_WARN,
1073 			"nfs3write: server %s did not commit to stable storage",
1074 					    rp->r_server->sv_hostname);
1075 					return (EIO);
1076 				}
1077 			}
1078 			tsize = (int)res.resok.count;
1079 			count -= tsize;
1080 			base += tsize;
1081 			offset += tsize;
1082 			if (mi->mi_io_kstats) {
1083 				mutex_enter(&mi->mi_lock);
1084 				KSTAT_IO_PTR(mi->mi_io_kstats)->writes++;
1085 				KSTAT_IO_PTR(mi->mi_io_kstats)->nwritten +=
1086 				    tsize;
1087 				mutex_exit(&mi->mi_lock);
1088 			}
1089 			lwp_stat_update(LWP_STAT_OUBLK, 1);
1090 			mutex_enter(&rp->r_statelock);
1091 			if (rp->r_flags & RHAVEVERF) {
1092 				if (rp->r_verf != res.resok.verf) {
1093 					nfs3_set_mod(vp);
1094 					rp->r_verf = res.resok.verf;
1095 					/*
1096 					 * If the data was written UNSTABLE,
1097 					 * then might as well stop because
1098 					 * the whole block will have to get
1099 					 * rewritten anyway.
1100 					 */
1101 					if (*stab_comm == UNSTABLE) {
1102 						mutex_exit(&rp->r_statelock);
1103 						break;
1104 					}
1105 				}
1106 			} else {
1107 				rp->r_verf = res.resok.verf;
1108 				rp->r_flags |= RHAVEVERF;
1109 			}
1110 			/*
1111 			 * Mark the attribute cache as timed out and
1112 			 * set RWRITEATTR to indicate that the file
1113 			 * was modified with a WRITE operation and
1114 			 * that the attributes can not be trusted.
1115 			 */
1116 			PURGE_ATTRCACHE_LOCKED(rp);
1117 			rp->r_flags |= RWRITEATTR;
1118 			mutex_exit(&rp->r_statelock);
1119 		}
1120 	} while (!error && count);
1121 
1122 	return (error);
1123 }
1124 
1125 /*
1126  * Read from a file.  Reads data in largest chunks our interface can handle.
1127  */
1128 static int
1129 nfs3read(vnode_t *vp, caddr_t base, offset_t offset, int count, size_t *residp,
1130     cred_t *cr)
1131 {
1132 	mntinfo_t *mi;
1133 	READ3args args;
1134 	READ3vres res;
1135 	int tsize;
1136 	int error;
1137 	int douprintf;
1138 	failinfo_t fi;
1139 	rnode_t *rp;
1140 	struct vattr va;
1141 	hrtime_t t;
1142 
1143 	rp = VTOR(vp);
1144 	mi = VTOMI(vp);
1145 	ASSERT(nfs_zone() == mi->mi_zone);
1146 	douprintf = 1;
1147 
1148 	args.file = *VTOFH3(vp);
1149 	fi.vp = vp;
1150 	fi.fhp = (caddr_t)&args.file;
1151 	fi.copyproc = nfs3copyfh;
1152 	fi.lookupproc = nfs3lookup;
1153 	fi.xattrdirproc = acl_getxattrdir3;
1154 
1155 	res.pov.fres.vp = vp;
1156 	res.pov.fres.vap = &va;
1157 
1158 	res.wlist = NULL;
1159 	*residp = count;
1160 	do {
1161 		if (mi->mi_io_kstats) {
1162 			mutex_enter(&mi->mi_lock);
1163 			kstat_runq_enter(KSTAT_IO_PTR(mi->mi_io_kstats));
1164 			mutex_exit(&mi->mi_lock);
1165 		}
1166 
1167 		do {
1168 			if ((vp->v_flag & VNOCACHE) ||
1169 			    (rp->r_flags & RDIRECTIO) ||
1170 			    (mi->mi_flags & MI_DIRECTIO))
1171 				tsize = MIN(mi->mi_tsize, count);
1172 			else
1173 				tsize = MIN(mi->mi_curread, count);
1174 			res.data.data_val = base;
1175 			res.data.data_len = tsize;
1176 			args.offset = (offset3)offset;
1177 			args.count = (count3)tsize;
1178 			args.res_uiop = NULL;
1179 			args.res_data_val_alt = base;
1180 
1181 			t = gethrtime();
1182 			error = rfs3call(mi, NFSPROC3_READ,
1183 			    xdr_READ3args, (caddr_t)&args,
1184 			    xdr_READ3vres, (caddr_t)&res, cr,
1185 			    &douprintf, &res.status, 0, &fi);
1186 		} while (error == ENFS_TRYAGAIN);
1187 
1188 		if (mi->mi_io_kstats) {
1189 			mutex_enter(&mi->mi_lock);
1190 			kstat_runq_exit(KSTAT_IO_PTR(mi->mi_io_kstats));
1191 			mutex_exit(&mi->mi_lock);
1192 		}
1193 
1194 		if (error)
1195 			return (error);
1196 
1197 		error = geterrno3(res.status);
1198 		if (error)
1199 			return (error);
1200 
1201 		if (res.count != res.data.data_len) {
1202 			zcmn_err(getzoneid(), CE_WARN,
1203 			    "nfs3read: server %s returned incorrect amount",
1204 			    rp->r_server->sv_hostname);
1205 			return (EIO);
1206 		}
1207 
1208 		count -= res.count;
1209 		*residp = count;
1210 		base += res.count;
1211 		offset += res.count;
1212 		if (mi->mi_io_kstats) {
1213 			mutex_enter(&mi->mi_lock);
1214 			KSTAT_IO_PTR(mi->mi_io_kstats)->reads++;
1215 			KSTAT_IO_PTR(mi->mi_io_kstats)->nread += res.count;
1216 			mutex_exit(&mi->mi_lock);
1217 		}
1218 		lwp_stat_update(LWP_STAT_INBLK, 1);
1219 	} while (count && !res.eof);
1220 
1221 	if (res.pov.attributes) {
1222 		mutex_enter(&rp->r_statelock);
1223 		if (!CACHE_VALID(rp, va.va_mtime, va.va_size)) {
1224 			mutex_exit(&rp->r_statelock);
1225 			PURGE_ATTRCACHE(vp);
1226 		} else {
1227 			if (rp->r_mtime <= t)
1228 				nfs_attrcache_va(vp, &va);
1229 			mutex_exit(&rp->r_statelock);
1230 		}
1231 	}
1232 
1233 	return (0);
1234 }
1235 
1236 /* ARGSUSED */
1237 static int
1238 nfs3_ioctl(vnode_t *vp, int cmd, intptr_t arg, int flag, cred_t *cr, int *rvalp,
1239     caller_context_t *ct)
1240 {
1241 
1242 	if (nfs_zone() != VTOMI(vp)->mi_zone)
1243 		return (EIO);
1244 	switch (cmd) {
1245 		case _FIODIRECTIO:
1246 			return (nfs_directio(vp, (int)arg, cr));
1247 		default:
1248 			return (ENOTTY);
1249 	}
1250 }
1251 
1252 /* ARGSUSED */
1253 static int
1254 nfs3_getattr(vnode_t *vp, struct vattr *vap, int flags, cred_t *cr,
1255     caller_context_t *ct)
1256 {
1257 	int error;
1258 	rnode_t *rp;
1259 
1260 	if (nfs_zone() != VTOMI(vp)->mi_zone)
1261 		return (EIO);
1262 	/*
1263 	 * If it has been specified that the return value will
1264 	 * just be used as a hint, and we are only being asked
1265 	 * for size, fsid or rdevid, then return the client's
1266 	 * notion of these values without checking to make sure
1267 	 * that the attribute cache is up to date.
1268 	 * The whole point is to avoid an over the wire GETATTR
1269 	 * call.
1270 	 */
1271 	rp = VTOR(vp);
1272 	if (flags & ATTR_HINT) {
1273 		if (vap->va_mask ==
1274 		    (vap->va_mask & (AT_SIZE | AT_FSID | AT_RDEV))) {
1275 			mutex_enter(&rp->r_statelock);
1276 			if (vap->va_mask | AT_SIZE)
1277 				vap->va_size = rp->r_size;
1278 			if (vap->va_mask | AT_FSID)
1279 				vap->va_fsid = rp->r_attr.va_fsid;
1280 			if (vap->va_mask | AT_RDEV)
1281 				vap->va_rdev = rp->r_attr.va_rdev;
1282 			mutex_exit(&rp->r_statelock);
1283 			return (0);
1284 		}
1285 	}
1286 
1287 	/*
1288 	 * Only need to flush pages if asking for the mtime
1289 	 * and if there any dirty pages or any outstanding
1290 	 * asynchronous (write) requests for this file.
1291 	 */
1292 	if (vap->va_mask & AT_MTIME) {
1293 		if (vn_has_cached_data(vp) &&
1294 		    ((rp->r_flags & RDIRTY) || rp->r_awcount > 0)) {
1295 			mutex_enter(&rp->r_statelock);
1296 			rp->r_gcount++;
1297 			mutex_exit(&rp->r_statelock);
1298 			error = nfs3_putpage(vp, (offset_t)0, 0, 0, cr, ct);
1299 			mutex_enter(&rp->r_statelock);
1300 			if (error && (error == ENOSPC || error == EDQUOT)) {
1301 				if (!rp->r_error)
1302 					rp->r_error = error;
1303 			}
1304 			if (--rp->r_gcount == 0)
1305 				cv_broadcast(&rp->r_cv);
1306 			mutex_exit(&rp->r_statelock);
1307 		}
1308 	}
1309 
1310 	return (nfs3getattr(vp, vap, cr));
1311 }
1312 
1313 /*ARGSUSED4*/
1314 static int
1315 nfs3_setattr(vnode_t *vp, struct vattr *vap, int flags, cred_t *cr,
1316     caller_context_t *ct)
1317 {
1318 	int error;
1319 	struct vattr va;
1320 
1321 	if (vap->va_mask & AT_NOSET)
1322 		return (EINVAL);
1323 	if (nfs_zone() != VTOMI(vp)->mi_zone)
1324 		return (EIO);
1325 
1326 	va.va_mask = AT_UID | AT_MODE;
1327 	error = nfs3getattr(vp, &va, cr);
1328 	if (error)
1329 		return (error);
1330 
1331 	error = secpolicy_vnode_setattr(cr, vp, vap, &va, flags, nfs3_accessx,
1332 	    vp);
1333 	if (error)
1334 		return (error);
1335 
1336 	error = nfs3setattr(vp, vap, flags, cr);
1337 
1338 	if (error == 0 && (vap->va_mask & AT_SIZE) && vap->va_size == 0)
1339 		vnevent_truncate(vp, ct);
1340 
1341 	return (error);
1342 }
1343 
1344 static int
1345 nfs3setattr(vnode_t *vp, struct vattr *vap, int flags, cred_t *cr)
1346 {
1347 	int error;
1348 	uint_t mask;
1349 	SETATTR3args args;
1350 	SETATTR3res res;
1351 	int douprintf;
1352 	rnode_t *rp;
1353 	struct vattr va;
1354 	mode_t omode;
1355 	vsecattr_t *vsp;
1356 	hrtime_t t;
1357 
1358 	ASSERT(nfs_zone() == VTOMI(vp)->mi_zone);
1359 	mask = vap->va_mask;
1360 
1361 	rp = VTOR(vp);
1362 
1363 	/*
1364 	 * Only need to flush pages if there are any pages and
1365 	 * if the file is marked as dirty in some fashion.  The
1366 	 * file must be flushed so that we can accurately
1367 	 * determine the size of the file and the cached data
1368 	 * after the SETATTR returns.  A file is considered to
1369 	 * be dirty if it is either marked with RDIRTY, has
1370 	 * outstanding i/o's active, or is mmap'd.  In this
1371 	 * last case, we can't tell whether there are dirty
1372 	 * pages, so we flush just to be sure.
1373 	 */
1374 	if (vn_has_cached_data(vp) &&
1375 	    ((rp->r_flags & RDIRTY) ||
1376 	    rp->r_count > 0 ||
1377 	    rp->r_mapcnt > 0)) {
1378 		ASSERT(vp->v_type != VCHR);
1379 		error = nfs3_putpage(vp, (offset_t)0, 0, 0, cr, NULL);
1380 		if (error && (error == ENOSPC || error == EDQUOT)) {
1381 			mutex_enter(&rp->r_statelock);
1382 			if (!rp->r_error)
1383 				rp->r_error = error;
1384 			mutex_exit(&rp->r_statelock);
1385 		}
1386 	}
1387 
1388 	args.object = *RTOFH3(rp);
1389 	/*
1390 	 * If the intent is for the server to set the times,
1391 	 * there is no point in have the mask indicating set mtime or
1392 	 * atime, because the vap values may be junk, and so result
1393 	 * in an overflow error. Remove these flags from the vap mask
1394 	 * before calling in this case, and restore them afterwards.
1395 	 */
1396 	if ((mask & (AT_ATIME | AT_MTIME)) && !(flags & ATTR_UTIME)) {
1397 		/* Use server times, so don't set the args time fields */
1398 		vap->va_mask &= ~(AT_ATIME | AT_MTIME);
1399 		error = vattr_to_sattr3(vap, &args.new_attributes);
1400 		vap->va_mask |= (mask & (AT_ATIME | AT_MTIME));
1401 		if (mask & AT_ATIME) {
1402 			args.new_attributes.atime.set_it = SET_TO_SERVER_TIME;
1403 		}
1404 		if (mask & AT_MTIME) {
1405 			args.new_attributes.mtime.set_it = SET_TO_SERVER_TIME;
1406 		}
1407 	} else {
1408 		/* Either do not set times or use the client specified times */
1409 		error = vattr_to_sattr3(vap, &args.new_attributes);
1410 	}
1411 
1412 	if (error) {
1413 		/* req time field(s) overflow - return immediately */
1414 		return (error);
1415 	}
1416 
1417 	va.va_mask = AT_MODE | AT_CTIME;
1418 	error = nfs3getattr(vp, &va, cr);
1419 	if (error)
1420 		return (error);
1421 	omode = va.va_mode;
1422 
1423 tryagain:
1424 	if (mask & AT_SIZE) {
1425 		args.guard.check = TRUE;
1426 		args.guard.obj_ctime.seconds = va.va_ctime.tv_sec;
1427 		args.guard.obj_ctime.nseconds = va.va_ctime.tv_nsec;
1428 	} else
1429 		args.guard.check = FALSE;
1430 
1431 	douprintf = 1;
1432 
1433 	t = gethrtime();
1434 
1435 	error = rfs3call(VTOMI(vp), NFSPROC3_SETATTR,
1436 	    xdr_SETATTR3args, (caddr_t)&args,
1437 	    xdr_SETATTR3res, (caddr_t)&res, cr,
1438 	    &douprintf, &res.status, 0, NULL);
1439 
1440 	/*
1441 	 * Purge the access cache and ACL cache if changing either the
1442 	 * owner of the file, the group owner, or the mode.  These may
1443 	 * change the access permissions of the file, so purge old
1444 	 * information and start over again.
1445 	 */
1446 	if (mask & (AT_UID | AT_GID | AT_MODE)) {
1447 		(void) nfs_access_purge_rp(rp);
1448 		if (rp->r_secattr != NULL) {
1449 			mutex_enter(&rp->r_statelock);
1450 			vsp = rp->r_secattr;
1451 			rp->r_secattr = NULL;
1452 			mutex_exit(&rp->r_statelock);
1453 			if (vsp != NULL)
1454 				nfs_acl_free(vsp);
1455 		}
1456 	}
1457 
1458 	if (error) {
1459 		PURGE_ATTRCACHE(vp);
1460 		return (error);
1461 	}
1462 
1463 	error = geterrno3(res.status);
1464 	if (!error) {
1465 		/*
1466 		 * If changing the size of the file, invalidate
1467 		 * any local cached data which is no longer part
1468 		 * of the file.  We also possibly invalidate the
1469 		 * last page in the file.  We could use
1470 		 * pvn_vpzero(), but this would mark the page as
1471 		 * modified and require it to be written back to
1472 		 * the server for no particularly good reason.
1473 		 * This way, if we access it, then we bring it
1474 		 * back in.  A read should be cheaper than a
1475 		 * write.
1476 		 */
1477 		if (mask & AT_SIZE) {
1478 			nfs_invalidate_pages(vp,
1479 			    (vap->va_size & PAGEMASK), cr);
1480 		}
1481 		nfs3_cache_wcc_data(vp, &res.resok.obj_wcc, t, cr);
1482 		/*
1483 		 * Some servers will change the mode to clear the setuid
1484 		 * and setgid bits when changing the uid or gid.  The
1485 		 * client needs to compensate appropriately.
1486 		 */
1487 		if (mask & (AT_UID | AT_GID)) {
1488 			int terror;
1489 
1490 			va.va_mask = AT_MODE;
1491 			terror = nfs3getattr(vp, &va, cr);
1492 			if (!terror &&
1493 			    (((mask & AT_MODE) && va.va_mode != vap->va_mode) ||
1494 			    (!(mask & AT_MODE) && va.va_mode != omode))) {
1495 				va.va_mask = AT_MODE;
1496 				if (mask & AT_MODE)
1497 					va.va_mode = vap->va_mode;
1498 				else
1499 					va.va_mode = omode;
1500 				(void) nfs3setattr(vp, &va, 0, cr);
1501 			}
1502 		}
1503 	} else {
1504 		nfs3_cache_wcc_data(vp, &res.resfail.obj_wcc, t, cr);
1505 		/*
1506 		 * If we got back a "not synchronized" error, then
1507 		 * we need to retry with a new guard value.  The
1508 		 * guard value used is the change time.  If the
1509 		 * server returned post_op_attr, then we can just
1510 		 * retry because we have the latest attributes.
1511 		 * Otherwise, we issue a GETATTR to get the latest
1512 		 * attributes and then retry.  If we couldn't get
1513 		 * the attributes this way either, then we give
1514 		 * up because we can't complete the operation as
1515 		 * required.
1516 		 */
1517 		if (res.status == NFS3ERR_NOT_SYNC) {
1518 			va.va_mask = AT_CTIME;
1519 			if (nfs3getattr(vp, &va, cr) == 0)
1520 				goto tryagain;
1521 		}
1522 		PURGE_STALE_FH(error, vp, cr);
1523 	}
1524 
1525 	return (error);
1526 }
1527 
1528 static int
1529 nfs3_accessx(void *vp, int mode, cred_t *cr)
1530 {
1531 	ASSERT(nfs_zone() == VTOMI((vnode_t *)vp)->mi_zone);
1532 	return (nfs3_access(vp, mode, 0, cr, NULL));
1533 }
1534 
1535 /* ARGSUSED */
1536 static int
1537 nfs3_access(vnode_t *vp, int mode, int flags, cred_t *cr, caller_context_t *ct)
1538 {
1539 	int error;
1540 	ACCESS3args args;
1541 	ACCESS3res res;
1542 	int douprintf;
1543 	uint32 acc;
1544 	rnode_t *rp;
1545 	cred_t *cred, *ncr, *ncrfree = NULL;
1546 	failinfo_t fi;
1547 	nfs_access_type_t cacc;
1548 	hrtime_t t;
1549 
1550 	acc = 0;
1551 	if (nfs_zone() != VTOMI(vp)->mi_zone)
1552 		return (EIO);
1553 	if (mode & VREAD)
1554 		acc |= ACCESS3_READ;
1555 	if (mode & VWRITE) {
1556 		if (vn_is_readonly(vp) && !IS_DEVVP(vp))
1557 			return (EROFS);
1558 		if (vp->v_type == VDIR)
1559 			acc |= ACCESS3_DELETE;
1560 		acc |= ACCESS3_MODIFY | ACCESS3_EXTEND;
1561 	}
1562 	if (mode & VEXEC) {
1563 		if (vp->v_type == VDIR)
1564 			acc |= ACCESS3_LOOKUP;
1565 		else
1566 			acc |= ACCESS3_EXECUTE;
1567 	}
1568 
1569 	rp = VTOR(vp);
1570 	args.object = *VTOFH3(vp);
1571 	if (vp->v_type == VDIR) {
1572 		args.access = ACCESS3_READ | ACCESS3_DELETE | ACCESS3_MODIFY |
1573 		    ACCESS3_EXTEND | ACCESS3_LOOKUP;
1574 	} else {
1575 		args.access = ACCESS3_READ | ACCESS3_MODIFY | ACCESS3_EXTEND |
1576 		    ACCESS3_EXECUTE;
1577 	}
1578 	fi.vp = vp;
1579 	fi.fhp = (caddr_t)&args.object;
1580 	fi.copyproc = nfs3copyfh;
1581 	fi.lookupproc = nfs3lookup;
1582 	fi.xattrdirproc = acl_getxattrdir3;
1583 
1584 	cred = cr;
1585 	/*
1586 	 * ncr and ncrfree both initially
1587 	 * point to the memory area returned
1588 	 * by crnetadjust();
1589 	 * ncrfree not NULL when exiting means
1590 	 * that we need to release it
1591 	 */
1592 	ncr = crnetadjust(cred);
1593 	ncrfree = ncr;
1594 tryagain:
1595 	if (rp->r_acache != NULL) {
1596 		cacc = nfs_access_check(rp, acc, cred);
1597 		if (cacc == NFS_ACCESS_ALLOWED) {
1598 			if (ncrfree != NULL)
1599 				crfree(ncrfree);
1600 			return (0);
1601 		}
1602 		if (cacc == NFS_ACCESS_DENIED) {
1603 			/*
1604 			 * If the cred can be adjusted, try again
1605 			 * with the new cred.
1606 			 */
1607 			if (ncr != NULL) {
1608 				cred = ncr;
1609 				ncr = NULL;
1610 				goto tryagain;
1611 			}
1612 			if (ncrfree != NULL)
1613 				crfree(ncrfree);
1614 			return (EACCES);
1615 		}
1616 	}
1617 
1618 	douprintf = 1;
1619 
1620 	t = gethrtime();
1621 
1622 	error = rfs3call(VTOMI(vp), NFSPROC3_ACCESS,
1623 	    xdr_ACCESS3args, (caddr_t)&args,
1624 	    xdr_ACCESS3res, (caddr_t)&res, cred,
1625 	    &douprintf, &res.status, 0, &fi);
1626 
1627 	if (error) {
1628 		if (ncrfree != NULL)
1629 			crfree(ncrfree);
1630 		return (error);
1631 	}
1632 
1633 	error = geterrno3(res.status);
1634 	if (!error) {
1635 		nfs3_cache_post_op_attr(vp, &res.resok.obj_attributes, t, cr);
1636 		nfs_access_cache(rp, args.access, res.resok.access, cred);
1637 		/*
1638 		 * we just cached results with cred; if cred is the
1639 		 * adjusted credentials from crnetadjust, we do not want
1640 		 * to release them before exiting: hence setting ncrfree
1641 		 * to NULL
1642 		 */
1643 		if (cred != cr)
1644 			ncrfree = NULL;
1645 		if ((acc & res.resok.access) != acc) {
1646 			/*
1647 			 * If the cred can be adjusted, try again
1648 			 * with the new cred.
1649 			 */
1650 			if (ncr != NULL) {
1651 				cred = ncr;
1652 				ncr = NULL;
1653 				goto tryagain;
1654 			}
1655 			error = EACCES;
1656 		}
1657 	} else {
1658 		nfs3_cache_post_op_attr(vp, &res.resfail.obj_attributes, t, cr);
1659 		PURGE_STALE_FH(error, vp, cr);
1660 	}
1661 
1662 	if (ncrfree != NULL)
1663 		crfree(ncrfree);
1664 
1665 	return (error);
1666 }
1667 
1668 static int nfs3_do_symlink_cache = 1;
1669 
1670 /* ARGSUSED */
1671 static int
1672 nfs3_readlink(vnode_t *vp, struct uio *uiop, cred_t *cr, caller_context_t *ct)
1673 {
1674 	int error;
1675 	READLINK3args args;
1676 	READLINK3res res;
1677 	nfspath3 resdata_backup;
1678 	rnode_t *rp;
1679 	int douprintf;
1680 	int len;
1681 	failinfo_t fi;
1682 	hrtime_t t;
1683 
1684 	/*
1685 	 * Can't readlink anything other than a symbolic link.
1686 	 */
1687 	if (vp->v_type != VLNK)
1688 		return (EINVAL);
1689 	if (nfs_zone() != VTOMI(vp)->mi_zone)
1690 		return (EIO);
1691 
1692 	rp = VTOR(vp);
1693 	if (nfs3_do_symlink_cache && rp->r_symlink.contents != NULL) {
1694 		error = nfs3_validate_caches(vp, cr);
1695 		if (error)
1696 			return (error);
1697 		mutex_enter(&rp->r_statelock);
1698 		if (rp->r_symlink.contents != NULL) {
1699 			error = uiomove(rp->r_symlink.contents,
1700 			    rp->r_symlink.len, UIO_READ, uiop);
1701 			mutex_exit(&rp->r_statelock);
1702 			return (error);
1703 		}
1704 		mutex_exit(&rp->r_statelock);
1705 	}
1706 
1707 	args.symlink = *VTOFH3(vp);
1708 	fi.vp = vp;
1709 	fi.fhp = (caddr_t)&args.symlink;
1710 	fi.copyproc = nfs3copyfh;
1711 	fi.lookupproc = nfs3lookup;
1712 	fi.xattrdirproc = acl_getxattrdir3;
1713 
1714 	res.resok.data = kmem_alloc(MAXPATHLEN, KM_SLEEP);
1715 
1716 	resdata_backup = res.resok.data;
1717 
1718 	douprintf = 1;
1719 
1720 	t = gethrtime();
1721 
1722 	error = rfs3call(VTOMI(vp), NFSPROC3_READLINK,
1723 	    xdr_READLINK3args, (caddr_t)&args,
1724 	    xdr_READLINK3res, (caddr_t)&res, cr,
1725 	    &douprintf, &res.status, 0, &fi);
1726 
1727 	if (res.resok.data == nfs3nametoolong)
1728 		error = EINVAL;
1729 
1730 	if (error) {
1731 		kmem_free(resdata_backup, MAXPATHLEN);
1732 		return (error);
1733 	}
1734 
1735 	error = geterrno3(res.status);
1736 	if (!error) {
1737 		nfs3_cache_post_op_attr(vp, &res.resok.symlink_attributes, t,
1738 		    cr);
1739 		len = strlen(res.resok.data);
1740 		error = uiomove(res.resok.data, len, UIO_READ, uiop);
1741 		if (nfs3_do_symlink_cache && rp->r_symlink.contents == NULL) {
1742 			mutex_enter(&rp->r_statelock);
1743 				if (rp->r_symlink.contents == NULL) {
1744 				rp->r_symlink.contents = res.resok.data;
1745 				rp->r_symlink.len = len;
1746 				rp->r_symlink.size = MAXPATHLEN;
1747 				mutex_exit(&rp->r_statelock);
1748 			} else {
1749 				mutex_exit(&rp->r_statelock);
1750 
1751 				kmem_free((void *)res.resok.data, MAXPATHLEN);
1752 			}
1753 		} else {
1754 			kmem_free((void *)res.resok.data, MAXPATHLEN);
1755 		}
1756 	} else {
1757 		nfs3_cache_post_op_attr(vp,
1758 		    &res.resfail.symlink_attributes, t, cr);
1759 		PURGE_STALE_FH(error, vp, cr);
1760 
1761 		kmem_free((void *)res.resok.data, MAXPATHLEN);
1762 
1763 	}
1764 
1765 	/*
1766 	 * The over the wire error for attempting to readlink something
1767 	 * other than a symbolic link is ENXIO.  However, we need to
1768 	 * return EINVAL instead of ENXIO, so we map it here.
1769 	 */
1770 	return (error == ENXIO ? EINVAL : error);
1771 }
1772 
1773 /*
1774  * Flush local dirty pages to stable storage on the server.
1775  *
1776  * If FNODSYNC is specified, then there is nothing to do because
1777  * metadata changes are not cached on the client before being
1778  * sent to the server.
1779  */
1780 /* ARGSUSED */
1781 static int
1782 nfs3_fsync(vnode_t *vp, int syncflag, cred_t *cr, caller_context_t *ct)
1783 {
1784 	int error;
1785 
1786 	if ((syncflag & FNODSYNC) || IS_SWAPVP(vp))
1787 		return (0);
1788 	if (nfs_zone() != VTOMI(vp)->mi_zone)
1789 		return (EIO);
1790 
1791 	error = nfs3_putpage_commit(vp, (offset_t)0, 0, cr);
1792 	if (!error)
1793 		error = VTOR(vp)->r_error;
1794 	return (error);
1795 }
1796 
1797 /*
1798  * Weirdness: if the file was removed or the target of a rename
1799  * operation while it was open, it got renamed instead.  Here we
1800  * remove the renamed file.
1801  */
1802 /* ARGSUSED */
1803 static void
1804 nfs3_inactive(vnode_t *vp, cred_t *cr, caller_context_t *ct)
1805 {
1806 	rnode_t *rp;
1807 
1808 	ASSERT(vp != DNLC_NO_VNODE);
1809 
1810 	/*
1811 	 * If this is coming from the wrong zone, we let someone in the right
1812 	 * zone take care of it asynchronously.  We can get here due to
1813 	 * VN_RELE() being called from pageout() or fsflush().  This call may
1814 	 * potentially turn into an expensive no-op if, for instance, v_count
1815 	 * gets incremented in the meantime, but it's still correct.
1816 	 */
1817 	if (nfs_zone() != VTOMI(vp)->mi_zone) {
1818 		nfs_async_inactive(vp, cr, nfs3_inactive);
1819 		return;
1820 	}
1821 
1822 	rp = VTOR(vp);
1823 redo:
1824 	if (rp->r_unldvp != NULL) {
1825 		/*
1826 		 * Save the vnode pointer for the directory where the
1827 		 * unlinked-open file got renamed, then set it to NULL
1828 		 * to prevent another thread from getting here before
1829 		 * we're done with the remove.  While we have the
1830 		 * statelock, make local copies of the pertinent rnode
1831 		 * fields.  If we weren't to do this in an atomic way, the
1832 		 * the unl* fields could become inconsistent with respect
1833 		 * to each other due to a race condition between this
1834 		 * code and nfs_remove().  See bug report 1034328.
1835 		 */
1836 		mutex_enter(&rp->r_statelock);
1837 		if (rp->r_unldvp != NULL) {
1838 			vnode_t *unldvp;
1839 			char *unlname;
1840 			cred_t *unlcred;
1841 			REMOVE3args args;
1842 			REMOVE3res res;
1843 			int douprintf;
1844 			int error;
1845 			hrtime_t t;
1846 
1847 			unldvp = rp->r_unldvp;
1848 			rp->r_unldvp = NULL;
1849 			unlname = rp->r_unlname;
1850 			rp->r_unlname = NULL;
1851 			unlcred = rp->r_unlcred;
1852 			rp->r_unlcred = NULL;
1853 			mutex_exit(&rp->r_statelock);
1854 
1855 			/*
1856 			 * If there are any dirty pages left, then flush
1857 			 * them.  This is unfortunate because they just
1858 			 * may get thrown away during the remove operation,
1859 			 * but we have to do this for correctness.
1860 			 */
1861 			if (vn_has_cached_data(vp) &&
1862 			    ((rp->r_flags & RDIRTY) || rp->r_count > 0)) {
1863 				ASSERT(vp->v_type != VCHR);
1864 				error = nfs3_putpage(vp, (offset_t)0, 0, 0,
1865 				    cr, ct);
1866 				if (error) {
1867 					mutex_enter(&rp->r_statelock);
1868 					if (!rp->r_error)
1869 						rp->r_error = error;
1870 					mutex_exit(&rp->r_statelock);
1871 				}
1872 			}
1873 
1874 			/*
1875 			 * Do the remove operation on the renamed file
1876 			 */
1877 			setdiropargs3(&args.object, unlname, unldvp);
1878 
1879 			douprintf = 1;
1880 
1881 			t = gethrtime();
1882 
1883 			error = rfs3call(VTOMI(unldvp), NFSPROC3_REMOVE,
1884 			    xdr_diropargs3, (caddr_t)&args,
1885 			    xdr_REMOVE3res, (caddr_t)&res, unlcred,
1886 			    &douprintf, &res.status, 0, NULL);
1887 
1888 			if (error) {
1889 				PURGE_ATTRCACHE(unldvp);
1890 			} else {
1891 				error = geterrno3(res.status);
1892 				if (!error) {
1893 					nfs3_cache_wcc_data(unldvp,
1894 					    &res.resok.dir_wcc, t, cr);
1895 					if (HAVE_RDDIR_CACHE(VTOR(unldvp)))
1896 						nfs_purge_rddir_cache(unldvp);
1897 				} else {
1898 					nfs3_cache_wcc_data(unldvp,
1899 					    &res.resfail.dir_wcc, t, cr);
1900 					PURGE_STALE_FH(error, unldvp, cr);
1901 				}
1902 			}
1903 
1904 			/*
1905 			 * Release stuff held for the remove
1906 			 */
1907 			VN_RELE(unldvp);
1908 			kmem_free(unlname, MAXNAMELEN);
1909 			crfree(unlcred);
1910 			goto redo;
1911 		}
1912 		mutex_exit(&rp->r_statelock);
1913 	}
1914 
1915 	rp_addfree(rp, cr);
1916 }
1917 
1918 /*
1919  * Remote file system operations having to do with directory manipulation.
1920  */
1921 
1922 /* ARGSUSED */
1923 static int
1924 nfs3_lookup(vnode_t *dvp, char *nm, vnode_t **vpp, struct pathname *pnp,
1925     int flags, vnode_t *rdir, cred_t *cr, caller_context_t *ct,
1926     int *direntflags, pathname_t *realpnp)
1927 {
1928 	int error;
1929 	vnode_t *vp;
1930 	vnode_t *avp = NULL;
1931 	rnode_t *drp;
1932 
1933 	if (nfs_zone() != VTOMI(dvp)->mi_zone)
1934 		return (EPERM);
1935 
1936 	drp = VTOR(dvp);
1937 
1938 	/*
1939 	 * Are we looking up extended attributes?  If so, "dvp" is
1940 	 * the file or directory for which we want attributes, and
1941 	 * we need a lookup of the hidden attribute directory
1942 	 * before we lookup the rest of the path.
1943 	 */
1944 	if (flags & LOOKUP_XATTR) {
1945 		bool_t cflag = ((flags & CREATE_XATTR_DIR) != 0);
1946 		mntinfo_t *mi;
1947 
1948 		mi = VTOMI(dvp);
1949 		if (!(mi->mi_flags & MI_EXTATTR))
1950 			return (EINVAL);
1951 
1952 		if (nfs_rw_enter_sig(&drp->r_rwlock, RW_READER, INTR(dvp)))
1953 			return (EINTR);
1954 
1955 		(void) nfs3lookup_dnlc(dvp, XATTR_DIR_NAME, &avp, cr);
1956 		if (avp == NULL)
1957 			error = acl_getxattrdir3(dvp, &avp, cflag, cr, 0);
1958 		else
1959 			error = 0;
1960 
1961 		nfs_rw_exit(&drp->r_rwlock);
1962 
1963 		if (error) {
1964 			if (mi->mi_flags & MI_EXTATTR)
1965 				return (error);
1966 			return (EINVAL);
1967 		}
1968 		dvp = avp;
1969 		drp = VTOR(dvp);
1970 	}
1971 
1972 	if (nfs_rw_enter_sig(&drp->r_rwlock, RW_READER, INTR(dvp))) {
1973 		error = EINTR;
1974 		goto out;
1975 	}
1976 
1977 	error = nfs3lookup(dvp, nm, vpp, pnp, flags, rdir, cr, 0);
1978 
1979 	nfs_rw_exit(&drp->r_rwlock);
1980 
1981 	/*
1982 	 * If vnode is a device, create special vnode.
1983 	 */
1984 	if (!error && IS_DEVVP(*vpp)) {
1985 		vp = *vpp;
1986 		*vpp = specvp(vp, vp->v_rdev, vp->v_type, cr);
1987 		VN_RELE(vp);
1988 	}
1989 
1990 out:
1991 	if (avp != NULL)
1992 		VN_RELE(avp);
1993 
1994 	return (error);
1995 }
1996 
1997 static int nfs3_lookup_neg_cache = 1;
1998 
1999 #ifdef DEBUG
2000 static int nfs3_lookup_dnlc_hits = 0;
2001 static int nfs3_lookup_dnlc_misses = 0;
2002 static int nfs3_lookup_dnlc_neg_hits = 0;
2003 static int nfs3_lookup_dnlc_disappears = 0;
2004 static int nfs3_lookup_dnlc_lookups = 0;
2005 #endif
2006 
2007 /* ARGSUSED */
2008 int
2009 nfs3lookup(vnode_t *dvp, char *nm, vnode_t **vpp, struct pathname *pnp,
2010     int flags, vnode_t *rdir, cred_t *cr, int rfscall_flags)
2011 {
2012 	int error;
2013 	rnode_t *drp;
2014 
2015 	ASSERT(nfs_zone() == VTOMI(dvp)->mi_zone);
2016 	/*
2017 	 * If lookup is for "", just return dvp.  Don't need
2018 	 * to send it over the wire, look it up in the dnlc,
2019 	 * or perform any access checks.
2020 	 */
2021 	if (*nm == '\0') {
2022 		VN_HOLD(dvp);
2023 		*vpp = dvp;
2024 		return (0);
2025 	}
2026 
2027 	/*
2028 	 * Can't do lookups in non-directories.
2029 	 */
2030 	if (dvp->v_type != VDIR)
2031 		return (ENOTDIR);
2032 
2033 	/*
2034 	 * If we're called with RFSCALL_SOFT, it's important that
2035 	 * the only rfscall is one we make directly; if we permit
2036 	 * an access call because we're looking up "." or validating
2037 	 * a dnlc hit, we'll deadlock because that rfscall will not
2038 	 * have the RFSCALL_SOFT set.
2039 	 */
2040 	if (rfscall_flags & RFSCALL_SOFT)
2041 		goto callit;
2042 
2043 	/*
2044 	 * If lookup is for ".", just return dvp.  Don't need
2045 	 * to send it over the wire or look it up in the dnlc,
2046 	 * just need to check access.
2047 	 */
2048 	if (strcmp(nm, ".") == 0) {
2049 		error = nfs3_access(dvp, VEXEC, 0, cr, NULL);
2050 		if (error)
2051 			return (error);
2052 		VN_HOLD(dvp);
2053 		*vpp = dvp;
2054 		return (0);
2055 	}
2056 
2057 	drp = VTOR(dvp);
2058 	if (!(drp->r_flags & RLOOKUP)) {
2059 		mutex_enter(&drp->r_statelock);
2060 		drp->r_flags |= RLOOKUP;
2061 		mutex_exit(&drp->r_statelock);
2062 	}
2063 
2064 	/*
2065 	 * Lookup this name in the DNLC.  If there was a valid entry,
2066 	 * then return the results of the lookup.
2067 	 */
2068 	error = nfs3lookup_dnlc(dvp, nm, vpp, cr);
2069 	if (error || *vpp != NULL)
2070 		return (error);
2071 
2072 callit:
2073 	error = nfs3lookup_otw(dvp, nm, vpp, cr, rfscall_flags);
2074 
2075 	return (error);
2076 }
2077 
2078 static int
2079 nfs3lookup_dnlc(vnode_t *dvp, char *nm, vnode_t **vpp, cred_t *cr)
2080 {
2081 	int error;
2082 	vnode_t *vp;
2083 
2084 	ASSERT(*nm != '\0');
2085 	ASSERT(nfs_zone() == VTOMI(dvp)->mi_zone);
2086 	/*
2087 	 * Lookup this name in the DNLC.  If successful, then validate
2088 	 * the caches and then recheck the DNLC.  The DNLC is rechecked
2089 	 * just in case this entry got invalidated during the call
2090 	 * to nfs3_validate_caches.
2091 	 *
2092 	 * An assumption is being made that it is safe to say that a
2093 	 * file exists which may not on the server.  Any operations to
2094 	 * the server will fail with ESTALE.
2095 	 */
2096 #ifdef DEBUG
2097 	nfs3_lookup_dnlc_lookups++;
2098 #endif
2099 	vp = dnlc_lookup(dvp, nm);
2100 	if (vp != NULL) {
2101 		VN_RELE(vp);
2102 		if (vp == DNLC_NO_VNODE && !vn_is_readonly(dvp)) {
2103 			PURGE_ATTRCACHE(dvp);
2104 		}
2105 		error = nfs3_validate_caches(dvp, cr);
2106 		if (error)
2107 			return (error);
2108 		vp = dnlc_lookup(dvp, nm);
2109 		if (vp != NULL) {
2110 			error = nfs3_access(dvp, VEXEC, 0, cr, NULL);
2111 			if (error) {
2112 				VN_RELE(vp);
2113 				return (error);
2114 			}
2115 			if (vp == DNLC_NO_VNODE) {
2116 				VN_RELE(vp);
2117 #ifdef DEBUG
2118 				nfs3_lookup_dnlc_neg_hits++;
2119 #endif
2120 				return (ENOENT);
2121 			}
2122 			*vpp = vp;
2123 #ifdef DEBUG
2124 			nfs3_lookup_dnlc_hits++;
2125 #endif
2126 			return (0);
2127 		}
2128 #ifdef DEBUG
2129 		nfs3_lookup_dnlc_disappears++;
2130 #endif
2131 	}
2132 #ifdef DEBUG
2133 	else
2134 		nfs3_lookup_dnlc_misses++;
2135 #endif
2136 
2137 	*vpp = NULL;
2138 
2139 	return (0);
2140 }
2141 
2142 static int
2143 nfs3lookup_otw(vnode_t *dvp, char *nm, vnode_t **vpp, cred_t *cr,
2144     int rfscall_flags)
2145 {
2146 	int error;
2147 	LOOKUP3args args;
2148 	LOOKUP3vres res;
2149 	int douprintf;
2150 	struct vattr vattr;
2151 	struct vattr dvattr;
2152 	vnode_t *vp;
2153 	failinfo_t fi;
2154 	hrtime_t t;
2155 
2156 	ASSERT(*nm != '\0');
2157 	ASSERT(dvp->v_type == VDIR);
2158 	ASSERT(nfs_zone() == VTOMI(dvp)->mi_zone);
2159 
2160 	setdiropargs3(&args.what, nm, dvp);
2161 
2162 	fi.vp = dvp;
2163 	fi.fhp = (caddr_t)&args.what.dir;
2164 	fi.copyproc = nfs3copyfh;
2165 	fi.lookupproc = nfs3lookup;
2166 	fi.xattrdirproc = acl_getxattrdir3;
2167 	res.obj_attributes.fres.vp = dvp;
2168 	res.obj_attributes.fres.vap = &vattr;
2169 	res.dir_attributes.fres.vp = dvp;
2170 	res.dir_attributes.fres.vap = &dvattr;
2171 
2172 	douprintf = 1;
2173 
2174 	t = gethrtime();
2175 
2176 	error = rfs3call(VTOMI(dvp), NFSPROC3_LOOKUP,
2177 	    xdr_diropargs3, (caddr_t)&args,
2178 	    xdr_LOOKUP3vres, (caddr_t)&res, cr,
2179 	    &douprintf, &res.status, rfscall_flags, &fi);
2180 
2181 	if (error)
2182 		return (error);
2183 
2184 	nfs3_cache_post_op_vattr(dvp, &res.dir_attributes, t, cr);
2185 
2186 	error = geterrno3(res.status);
2187 	if (error) {
2188 		PURGE_STALE_FH(error, dvp, cr);
2189 		if (error == ENOENT && nfs3_lookup_neg_cache)
2190 			dnlc_enter(dvp, nm, DNLC_NO_VNODE);
2191 		return (error);
2192 	}
2193 
2194 	if (res.obj_attributes.attributes) {
2195 		vp = makenfs3node_va(&res.object, res.obj_attributes.fres.vap,
2196 		    dvp->v_vfsp, t, cr, VTOR(dvp)->r_path, nm);
2197 	} else {
2198 		vp = makenfs3node_va(&res.object, NULL,
2199 		    dvp->v_vfsp, t, cr, VTOR(dvp)->r_path, nm);
2200 		if (vp->v_type == VNON) {
2201 			vattr.va_mask = AT_TYPE;
2202 			error = nfs3getattr(vp, &vattr, cr);
2203 			if (error) {
2204 				VN_RELE(vp);
2205 				return (error);
2206 			}
2207 			vp->v_type = vattr.va_type;
2208 		}
2209 	}
2210 
2211 	if (!(rfscall_flags & RFSCALL_SOFT))
2212 		dnlc_update(dvp, nm, vp);
2213 
2214 	*vpp = vp;
2215 
2216 	return (error);
2217 }
2218 
2219 #ifdef DEBUG
2220 static int nfs3_create_misses = 0;
2221 #endif
2222 
2223 /* ARGSUSED */
2224 static int
2225 nfs3_create(vnode_t *dvp, char *nm, struct vattr *va, enum vcexcl exclusive,
2226     int mode, vnode_t **vpp, cred_t *cr, int lfaware, caller_context_t *ct,
2227     vsecattr_t *vsecp)
2228 {
2229 	int error;
2230 	vnode_t *vp;
2231 	rnode_t *rp;
2232 	struct vattr vattr;
2233 	rnode_t *drp;
2234 	vnode_t *tempvp;
2235 
2236 	drp = VTOR(dvp);
2237 	if (nfs_zone() != VTOMI(dvp)->mi_zone)
2238 		return (EPERM);
2239 	if (nfs_rw_enter_sig(&drp->r_rwlock, RW_WRITER, INTR(dvp)))
2240 		return (EINTR);
2241 
2242 top:
2243 	/*
2244 	 * We make a copy of the attributes because the caller does not
2245 	 * expect us to change what va points to.
2246 	 */
2247 	vattr = *va;
2248 
2249 	/*
2250 	 * If the pathname is "", just use dvp.  Don't need
2251 	 * to send it over the wire, look it up in the dnlc,
2252 	 * or perform any access checks.
2253 	 */
2254 	if (*nm == '\0') {
2255 		error = 0;
2256 		VN_HOLD(dvp);
2257 		vp = dvp;
2258 	/*
2259 	 * If the pathname is ".", just use dvp.  Don't need
2260 	 * to send it over the wire or look it up in the dnlc,
2261 	 * just need to check access.
2262 	 */
2263 	} else if (strcmp(nm, ".") == 0) {
2264 		error = nfs3_access(dvp, VEXEC, 0, cr, ct);
2265 		if (error) {
2266 			nfs_rw_exit(&drp->r_rwlock);
2267 			return (error);
2268 		}
2269 		VN_HOLD(dvp);
2270 		vp = dvp;
2271 	/*
2272 	 * We need to go over the wire, just to be sure whether the
2273 	 * file exists or not.  Using the DNLC can be dangerous in
2274 	 * this case when making a decision regarding existence.
2275 	 */
2276 	} else {
2277 		error = nfs3lookup_otw(dvp, nm, &vp, cr, 0);
2278 	}
2279 	if (!error) {
2280 		if (exclusive == EXCL)
2281 			error = EEXIST;
2282 		else if (vp->v_type == VDIR && (mode & VWRITE))
2283 			error = EISDIR;
2284 		else {
2285 			/*
2286 			 * If vnode is a device, create special vnode.
2287 			 */
2288 			if (IS_DEVVP(vp)) {
2289 				tempvp = vp;
2290 				vp = specvp(vp, vp->v_rdev, vp->v_type, cr);
2291 				VN_RELE(tempvp);
2292 			}
2293 			if (!(error = VOP_ACCESS(vp, mode, 0, cr, ct))) {
2294 				if ((vattr.va_mask & AT_SIZE) &&
2295 				    vp->v_type == VREG) {
2296 					rp = VTOR(vp);
2297 					/*
2298 					 * Check here for large file handled
2299 					 * by LF-unaware process (as
2300 					 * ufs_create() does)
2301 					 */
2302 					if (!(lfaware & FOFFMAX)) {
2303 						mutex_enter(&rp->r_statelock);
2304 						if (rp->r_size > MAXOFF32_T)
2305 							error = EOVERFLOW;
2306 						mutex_exit(&rp->r_statelock);
2307 					}
2308 					if (!error) {
2309 						vattr.va_mask = AT_SIZE;
2310 						error = nfs3setattr(vp,
2311 						    &vattr, 0, cr);
2312 
2313 						/*
2314 						 * Existing file was truncated;
2315 						 * emit a create event.
2316 						 */
2317 						vnevent_create(vp, ct);
2318 					}
2319 				}
2320 			}
2321 		}
2322 		nfs_rw_exit(&drp->r_rwlock);
2323 		if (error) {
2324 			VN_RELE(vp);
2325 		} else {
2326 			*vpp = vp;
2327 		}
2328 
2329 		return (error);
2330 	}
2331 
2332 	dnlc_remove(dvp, nm);
2333 
2334 	/*
2335 	 * Decide what the group-id of the created file should be.
2336 	 * Set it in attribute list as advisory...
2337 	 */
2338 	error = setdirgid(dvp, &vattr.va_gid, cr);
2339 	if (error) {
2340 		nfs_rw_exit(&drp->r_rwlock);
2341 		return (error);
2342 	}
2343 	vattr.va_mask |= AT_GID;
2344 
2345 	ASSERT(vattr.va_mask & AT_TYPE);
2346 	if (vattr.va_type == VREG) {
2347 		ASSERT(vattr.va_mask & AT_MODE);
2348 		if (MANDMODE(vattr.va_mode)) {
2349 			nfs_rw_exit(&drp->r_rwlock);
2350 			return (EACCES);
2351 		}
2352 		error = nfs3create(dvp, nm, &vattr, exclusive, mode, vpp, cr,
2353 		    lfaware);
2354 		/*
2355 		 * If this is not an exclusive create, then the CREATE
2356 		 * request will be made with the GUARDED mode set.  This
2357 		 * means that the server will return EEXIST if the file
2358 		 * exists.  The file could exist because of a retransmitted
2359 		 * request.  In this case, we recover by starting over and
2360 		 * checking to see whether the file exists.  This second
2361 		 * time through it should and a CREATE request will not be
2362 		 * sent.
2363 		 *
2364 		 * This handles the problem of a dangling CREATE request
2365 		 * which contains attributes which indicate that the file
2366 		 * should be truncated.  This retransmitted request could
2367 		 * possibly truncate valid data in the file if not caught
2368 		 * by the duplicate request mechanism on the server or if
2369 		 * not caught by other means.  The scenario is:
2370 		 *
2371 		 * Client transmits CREATE request with size = 0
2372 		 * Client times out, retransmits request.
2373 		 * Response to the first request arrives from the server
2374 		 *  and the client proceeds on.
2375 		 * Client writes data to the file.
2376 		 * The server now processes retransmitted CREATE request
2377 		 *  and truncates file.
2378 		 *
2379 		 * The use of the GUARDED CREATE request prevents this from
2380 		 * happening because the retransmitted CREATE would fail
2381 		 * with EEXIST and would not truncate the file.
2382 		 */
2383 		if (error == EEXIST && exclusive == NONEXCL) {
2384 #ifdef DEBUG
2385 			nfs3_create_misses++;
2386 #endif
2387 			goto top;
2388 		}
2389 		nfs_rw_exit(&drp->r_rwlock);
2390 		return (error);
2391 	}
2392 	error = nfs3mknod(dvp, nm, &vattr, exclusive, mode, vpp, cr);
2393 	nfs_rw_exit(&drp->r_rwlock);
2394 	return (error);
2395 }
2396 
2397 /* ARGSUSED */
2398 static int
2399 nfs3create(vnode_t *dvp, char *nm, struct vattr *va, enum vcexcl exclusive,
2400     int mode, vnode_t **vpp, cred_t *cr, int lfaware)
2401 {
2402 	int error;
2403 	CREATE3args args;
2404 	CREATE3res res;
2405 	int douprintf;
2406 	vnode_t *vp;
2407 	struct vattr vattr;
2408 	nfstime3 *verfp;
2409 	rnode_t *rp;
2410 	timestruc_t now;
2411 	hrtime_t t;
2412 
2413 	ASSERT(nfs_zone() == VTOMI(dvp)->mi_zone);
2414 	setdiropargs3(&args.where, nm, dvp);
2415 	if (exclusive == EXCL) {
2416 		args.how.mode = EXCLUSIVE;
2417 		/*
2418 		 * Construct the create verifier.  This verifier needs
2419 		 * to be unique between different clients.  It also needs
2420 		 * to vary for each exclusive create request generated
2421 		 * from the client to the server.
2422 		 *
2423 		 * The first attempt is made to use the hostid and a
2424 		 * unique number on the client.  If the hostid has not
2425 		 * been set, the high resolution time that the exclusive
2426 		 * create request is being made is used.  This will work
2427 		 * unless two different clients, both with the hostid
2428 		 * not set, attempt an exclusive create request on the
2429 		 * same file, at exactly the same clock time.  The
2430 		 * chances of this happening seem small enough to be
2431 		 * reasonable.
2432 		 */
2433 		verfp = (nfstime3 *)&args.how.createhow3_u.verf;
2434 		verfp->seconds = zone_get_hostid(NULL);
2435 		if (verfp->seconds != 0)
2436 			verfp->nseconds = newnum();
2437 		else {
2438 			gethrestime(&now);
2439 			verfp->seconds = now.tv_sec;
2440 			verfp->nseconds = now.tv_nsec;
2441 		}
2442 		/*
2443 		 * Since the server will use this value for the mtime,
2444 		 * make sure that it can't overflow. Zero out the MSB.
2445 		 * The actual value does not matter here, only its uniqeness.
2446 		 */
2447 		verfp->seconds %= INT32_MAX;
2448 	} else {
2449 		/*
2450 		 * Issue the non-exclusive create in guarded mode.  This
2451 		 * may result in some false EEXIST responses for
2452 		 * retransmitted requests, but these will be handled at
2453 		 * a higher level.  By using GUARDED, duplicate requests
2454 		 * to do file truncation and possible access problems
2455 		 * can be avoided.
2456 		 */
2457 		args.how.mode = GUARDED;
2458 		error = vattr_to_sattr3(va,
2459 		    &args.how.createhow3_u.obj_attributes);
2460 		if (error) {
2461 			/* req time field(s) overflow - return immediately */
2462 			return (error);
2463 		}
2464 	}
2465 
2466 	douprintf = 1;
2467 
2468 	t = gethrtime();
2469 
2470 	error = rfs3call(VTOMI(dvp), NFSPROC3_CREATE,
2471 	    xdr_CREATE3args, (caddr_t)&args,
2472 	    xdr_CREATE3res, (caddr_t)&res, cr,
2473 	    &douprintf, &res.status, 0, NULL);
2474 
2475 	if (error) {
2476 		PURGE_ATTRCACHE(dvp);
2477 		return (error);
2478 	}
2479 
2480 	error = geterrno3(res.status);
2481 	if (!error) {
2482 		nfs3_cache_wcc_data(dvp, &res.resok.dir_wcc, t, cr);
2483 		if (HAVE_RDDIR_CACHE(VTOR(dvp)))
2484 			nfs_purge_rddir_cache(dvp);
2485 
2486 		/*
2487 		 * On exclusive create the times need to be explicitly
2488 		 * set to clear any potential verifier that may be stored
2489 		 * in one of these fields (see comment below).  This
2490 		 * is done here to cover the case where no post op attrs
2491 		 * were returned or a 'invalid' time was returned in
2492 		 * the attributes.
2493 		 */
2494 		if (exclusive == EXCL)
2495 			va->va_mask |= (AT_MTIME | AT_ATIME);
2496 
2497 		if (!res.resok.obj.handle_follows) {
2498 			error = nfs3lookup(dvp, nm, &vp, NULL, 0, NULL, cr, 0);
2499 			if (error)
2500 				return (error);
2501 		} else {
2502 			if (res.resok.obj_attributes.attributes) {
2503 				vp = makenfs3node(&res.resok.obj.handle,
2504 				    &res.resok.obj_attributes.attr,
2505 				    dvp->v_vfsp, t, cr, NULL, NULL);
2506 			} else {
2507 				vp = makenfs3node(&res.resok.obj.handle, NULL,
2508 				    dvp->v_vfsp, t, cr, NULL, NULL);
2509 
2510 				/*
2511 				 * On an exclusive create, it is possible
2512 				 * that attributes were returned but those
2513 				 * postop attributes failed to decode
2514 				 * properly.  If this is the case,
2515 				 * then most likely the atime or mtime
2516 				 * were invalid for our client; this
2517 				 * is caused by the server storing the
2518 				 * create verifier in one of the time
2519 				 * fields(most likely mtime).
2520 				 * So... we are going to setattr just the
2521 				 * atime/mtime to clear things up.
2522 				 */
2523 				if (exclusive == EXCL) {
2524 					if (error =
2525 					    nfs3excl_create_settimes(vp,
2526 					    va, cr)) {
2527 						/*
2528 						 * Setting the times failed.
2529 						 * Remove the file and return
2530 						 * the error.
2531 						 */
2532 						VN_RELE(vp);
2533 						(void) nfs3_remove(dvp,
2534 						    nm, cr, NULL, 0);
2535 						return (error);
2536 					}
2537 				}
2538 
2539 				/*
2540 				 * This handles the non-exclusive case
2541 				 * and the exclusive case where no post op
2542 				 * attrs were returned.
2543 				 */
2544 				if (vp->v_type == VNON) {
2545 					vattr.va_mask = AT_TYPE;
2546 					error = nfs3getattr(vp, &vattr, cr);
2547 					if (error) {
2548 						VN_RELE(vp);
2549 						return (error);
2550 					}
2551 					vp->v_type = vattr.va_type;
2552 				}
2553 			}
2554 			dnlc_update(dvp, nm, vp);
2555 		}
2556 
2557 		rp = VTOR(vp);
2558 
2559 		/*
2560 		 * Check here for large file handled by
2561 		 * LF-unaware process (as ufs_create() does)
2562 		 */
2563 		if ((va->va_mask & AT_SIZE) && vp->v_type == VREG &&
2564 		    !(lfaware & FOFFMAX)) {
2565 			mutex_enter(&rp->r_statelock);
2566 			if (rp->r_size > MAXOFF32_T) {
2567 				mutex_exit(&rp->r_statelock);
2568 				VN_RELE(vp);
2569 				return (EOVERFLOW);
2570 			}
2571 			mutex_exit(&rp->r_statelock);
2572 		}
2573 
2574 		if (exclusive == EXCL &&
2575 		    (va->va_mask & ~(AT_GID | AT_SIZE))) {
2576 			/*
2577 			 * If doing an exclusive create, then generate
2578 			 * a SETATTR to set the initial attributes.
2579 			 * Try to set the mtime and the atime to the
2580 			 * server's current time.  It is somewhat
2581 			 * expected that these fields will be used to
2582 			 * store the exclusive create cookie.  If not,
2583 			 * server implementors will need to know that
2584 			 * a SETATTR will follow an exclusive create
2585 			 * and the cookie should be destroyed if
2586 			 * appropriate. This work may have been done
2587 			 * earlier in this function if post op attrs
2588 			 * were not available.
2589 			 *
2590 			 * The AT_GID and AT_SIZE bits are turned off
2591 			 * so that the SETATTR request will not attempt
2592 			 * to process these.  The gid will be set
2593 			 * separately if appropriate.  The size is turned
2594 			 * off because it is assumed that a new file will
2595 			 * be created empty and if the file wasn't empty,
2596 			 * then the exclusive create will have failed
2597 			 * because the file must have existed already.
2598 			 * Therefore, no truncate operation is needed.
2599 			 */
2600 			va->va_mask &= ~(AT_GID | AT_SIZE);
2601 			error = nfs3setattr(vp, va, 0, cr);
2602 			if (error) {
2603 				/*
2604 				 * Couldn't correct the attributes of
2605 				 * the newly created file and the
2606 				 * attributes are wrong.  Remove the
2607 				 * file and return an error to the
2608 				 * application.
2609 				 */
2610 				VN_RELE(vp);
2611 				(void) nfs3_remove(dvp, nm, cr, NULL, 0);
2612 				return (error);
2613 			}
2614 		}
2615 
2616 		if (va->va_gid != rp->r_attr.va_gid) {
2617 			/*
2618 			 * If the gid on the file isn't right, then
2619 			 * generate a SETATTR to attempt to change
2620 			 * it.  This may or may not work, depending
2621 			 * upon the server's semantics for allowing
2622 			 * file ownership changes.
2623 			 */
2624 			va->va_mask = AT_GID;
2625 			(void) nfs3setattr(vp, va, 0, cr);
2626 		}
2627 
2628 		/*
2629 		 * If vnode is a device create special vnode
2630 		 */
2631 		if (IS_DEVVP(vp)) {
2632 			*vpp = specvp(vp, vp->v_rdev, vp->v_type, cr);
2633 			VN_RELE(vp);
2634 		} else
2635 			*vpp = vp;
2636 	} else {
2637 		nfs3_cache_wcc_data(dvp, &res.resfail.dir_wcc, t, cr);
2638 		PURGE_STALE_FH(error, dvp, cr);
2639 	}
2640 
2641 	return (error);
2642 }
2643 
2644 /*
2645  * Special setattr function to take care of rest of atime/mtime
2646  * after successful exclusive create.  This function exists to avoid
2647  * handling attributes from the server; exclusive the atime/mtime fields
2648  * may be 'invalid' in client's view and therefore can not be trusted.
2649  */
2650 static int
2651 nfs3excl_create_settimes(vnode_t *vp, struct vattr *vap, cred_t *cr)
2652 {
2653 	int error;
2654 	uint_t mask;
2655 	SETATTR3args args;
2656 	SETATTR3res res;
2657 	int douprintf;
2658 	rnode_t *rp;
2659 	hrtime_t t;
2660 
2661 	ASSERT(nfs_zone() == VTOMI(vp)->mi_zone);
2662 	/* save the caller's mask so that it can be reset later */
2663 	mask = vap->va_mask;
2664 
2665 	rp = VTOR(vp);
2666 
2667 	args.object = *RTOFH3(rp);
2668 	args.guard.check = FALSE;
2669 
2670 	/* Use the mask to initialize the arguments */
2671 	vap->va_mask = 0;
2672 	error = vattr_to_sattr3(vap, &args.new_attributes);
2673 
2674 	/* We want to set just atime/mtime on this request */
2675 	args.new_attributes.atime.set_it = SET_TO_SERVER_TIME;
2676 	args.new_attributes.mtime.set_it = SET_TO_SERVER_TIME;
2677 
2678 	douprintf = 1;
2679 
2680 	t = gethrtime();
2681 
2682 	error = rfs3call(VTOMI(vp), NFSPROC3_SETATTR,
2683 	    xdr_SETATTR3args, (caddr_t)&args,
2684 	    xdr_SETATTR3res, (caddr_t)&res, cr,
2685 	    &douprintf, &res.status, 0, NULL);
2686 
2687 	if (error) {
2688 		vap->va_mask = mask;
2689 		return (error);
2690 	}
2691 
2692 	error = geterrno3(res.status);
2693 	if (!error) {
2694 		/*
2695 		 * It is important to pick up the attributes.
2696 		 * Since this is the exclusive create path, the
2697 		 * attributes on the initial create were ignored
2698 		 * and we need these to have the correct info.
2699 		 */
2700 		nfs3_cache_wcc_data(vp, &res.resok.obj_wcc, t, cr);
2701 		/*
2702 		 * No need to do the atime/mtime work again so clear
2703 		 * the bits.
2704 		 */
2705 		mask &= ~(AT_ATIME | AT_MTIME);
2706 	} else {
2707 		nfs3_cache_wcc_data(vp, &res.resfail.obj_wcc, t, cr);
2708 	}
2709 
2710 	vap->va_mask = mask;
2711 
2712 	return (error);
2713 }
2714 
2715 /* ARGSUSED */
2716 static int
2717 nfs3mknod(vnode_t *dvp, char *nm, struct vattr *va, enum vcexcl exclusive,
2718     int mode, vnode_t **vpp, cred_t *cr)
2719 {
2720 	int error;
2721 	MKNOD3args args;
2722 	MKNOD3res res;
2723 	int douprintf;
2724 	vnode_t *vp;
2725 	struct vattr vattr;
2726 	hrtime_t t;
2727 
2728 	ASSERT(nfs_zone() == VTOMI(dvp)->mi_zone);
2729 	switch (va->va_type) {
2730 	case VCHR:
2731 	case VBLK:
2732 		setdiropargs3(&args.where, nm, dvp);
2733 		args.what.type = (va->va_type == VCHR) ? NF3CHR : NF3BLK;
2734 		error = vattr_to_sattr3(va,
2735 		    &args.what.mknoddata3_u.device.dev_attributes);
2736 		if (error) {
2737 			/* req time field(s) overflow - return immediately */
2738 			return (error);
2739 		}
2740 		args.what.mknoddata3_u.device.spec.specdata1 =
2741 		    getmajor(va->va_rdev);
2742 		args.what.mknoddata3_u.device.spec.specdata2 =
2743 		    getminor(va->va_rdev);
2744 		break;
2745 
2746 	case VFIFO:
2747 	case VSOCK:
2748 		setdiropargs3(&args.where, nm, dvp);
2749 		args.what.type = (va->va_type == VFIFO) ? NF3FIFO : NF3SOCK;
2750 		error = vattr_to_sattr3(va,
2751 		    &args.what.mknoddata3_u.pipe_attributes);
2752 		if (error) {
2753 			/* req time field(s) overflow - return immediately */
2754 			return (error);
2755 		}
2756 		break;
2757 
2758 	default:
2759 		return (EINVAL);
2760 	}
2761 
2762 	douprintf = 1;
2763 
2764 	t = gethrtime();
2765 
2766 	error = rfs3call(VTOMI(dvp), NFSPROC3_MKNOD,
2767 	    xdr_MKNOD3args, (caddr_t)&args,
2768 	    xdr_MKNOD3res, (caddr_t)&res, cr,
2769 	    &douprintf, &res.status, 0, NULL);
2770 
2771 	if (error) {
2772 		PURGE_ATTRCACHE(dvp);
2773 		return (error);
2774 	}
2775 
2776 	error = geterrno3(res.status);
2777 	if (!error) {
2778 		nfs3_cache_wcc_data(dvp, &res.resok.dir_wcc, t, cr);
2779 		if (HAVE_RDDIR_CACHE(VTOR(dvp)))
2780 			nfs_purge_rddir_cache(dvp);
2781 
2782 		if (!res.resok.obj.handle_follows) {
2783 			error = nfs3lookup(dvp, nm, &vp, NULL, 0, NULL, cr, 0);
2784 			if (error)
2785 				return (error);
2786 		} else {
2787 			if (res.resok.obj_attributes.attributes) {
2788 				vp = makenfs3node(&res.resok.obj.handle,
2789 				    &res.resok.obj_attributes.attr,
2790 				    dvp->v_vfsp, t, cr, NULL, NULL);
2791 			} else {
2792 				vp = makenfs3node(&res.resok.obj.handle, NULL,
2793 				    dvp->v_vfsp, t, cr, NULL, NULL);
2794 				if (vp->v_type == VNON) {
2795 					vattr.va_mask = AT_TYPE;
2796 					error = nfs3getattr(vp, &vattr, cr);
2797 					if (error) {
2798 						VN_RELE(vp);
2799 						return (error);
2800 					}
2801 					vp->v_type = vattr.va_type;
2802 				}
2803 
2804 			}
2805 			dnlc_update(dvp, nm, vp);
2806 		}
2807 
2808 		if (va->va_gid != VTOR(vp)->r_attr.va_gid) {
2809 			va->va_mask = AT_GID;
2810 			(void) nfs3setattr(vp, va, 0, cr);
2811 		}
2812 
2813 		/*
2814 		 * If vnode is a device create special vnode
2815 		 */
2816 		if (IS_DEVVP(vp)) {
2817 			*vpp = specvp(vp, vp->v_rdev, vp->v_type, cr);
2818 			VN_RELE(vp);
2819 		} else
2820 			*vpp = vp;
2821 	} else {
2822 		nfs3_cache_wcc_data(dvp, &res.resfail.dir_wcc, t, cr);
2823 		PURGE_STALE_FH(error, dvp, cr);
2824 	}
2825 	return (error);
2826 }
2827 
2828 /*
2829  * Weirdness: if the vnode to be removed is open
2830  * we rename it instead of removing it and nfs_inactive
2831  * will remove the new name.
2832  */
2833 /* ARGSUSED */
2834 static int
2835 nfs3_remove(vnode_t *dvp, char *nm, cred_t *cr, caller_context_t *ct, int flags)
2836 {
2837 	int error;
2838 	REMOVE3args args;
2839 	REMOVE3res res;
2840 	vnode_t *vp;
2841 	char *tmpname;
2842 	int douprintf;
2843 	rnode_t *rp;
2844 	rnode_t *drp;
2845 	hrtime_t t;
2846 
2847 	if (nfs_zone() != VTOMI(dvp)->mi_zone)
2848 		return (EPERM);
2849 	drp = VTOR(dvp);
2850 	if (nfs_rw_enter_sig(&drp->r_rwlock, RW_WRITER, INTR(dvp)))
2851 		return (EINTR);
2852 
2853 	error = nfs3lookup(dvp, nm, &vp, NULL, 0, NULL, cr, 0);
2854 	if (error) {
2855 		nfs_rw_exit(&drp->r_rwlock);
2856 		return (error);
2857 	}
2858 
2859 	if (vp->v_type == VDIR && secpolicy_fs_linkdir(cr, dvp->v_vfsp)) {
2860 		VN_RELE(vp);
2861 		nfs_rw_exit(&drp->r_rwlock);
2862 		return (EPERM);
2863 	}
2864 
2865 	/*
2866 	 * First just remove the entry from the name cache, as it
2867 	 * is most likely the only entry for this vp.
2868 	 */
2869 	dnlc_remove(dvp, nm);
2870 
2871 	/*
2872 	 * If the file has a v_count > 1 then there may be more than one
2873 	 * entry in the name cache due multiple links or an open file,
2874 	 * but we don't have the real reference count so flush all
2875 	 * possible entries.
2876 	 */
2877 	if (vp->v_count > 1)
2878 		dnlc_purge_vp(vp);
2879 
2880 	/*
2881 	 * Now we have the real reference count on the vnode
2882 	 */
2883 	rp = VTOR(vp);
2884 	mutex_enter(&rp->r_statelock);
2885 	if (vp->v_count > 1 &&
2886 	    (rp->r_unldvp == NULL || strcmp(nm, rp->r_unlname) == 0)) {
2887 		mutex_exit(&rp->r_statelock);
2888 		tmpname = newname();
2889 		error = nfs3rename(dvp, nm, dvp, tmpname, cr, ct);
2890 		if (error)
2891 			kmem_free(tmpname, MAXNAMELEN);
2892 		else {
2893 			mutex_enter(&rp->r_statelock);
2894 			if (rp->r_unldvp == NULL) {
2895 				VN_HOLD(dvp);
2896 				rp->r_unldvp = dvp;
2897 				if (rp->r_unlcred != NULL)
2898 					crfree(rp->r_unlcred);
2899 				crhold(cr);
2900 				rp->r_unlcred = cr;
2901 				rp->r_unlname = tmpname;
2902 			} else {
2903 				kmem_free(rp->r_unlname, MAXNAMELEN);
2904 				rp->r_unlname = tmpname;
2905 			}
2906 			mutex_exit(&rp->r_statelock);
2907 		}
2908 	} else {
2909 		mutex_exit(&rp->r_statelock);
2910 		/*
2911 		 * We need to flush any dirty pages which happen to
2912 		 * be hanging around before removing the file.  This
2913 		 * shouldn't happen very often and mostly on file
2914 		 * systems mounted "nocto".
2915 		 */
2916 		if (vn_has_cached_data(vp) &&
2917 		    ((rp->r_flags & RDIRTY) || rp->r_count > 0)) {
2918 			error = nfs3_putpage(vp, (offset_t)0, 0, 0, cr, ct);
2919 			if (error && (error == ENOSPC || error == EDQUOT)) {
2920 				mutex_enter(&rp->r_statelock);
2921 				if (!rp->r_error)
2922 					rp->r_error = error;
2923 				mutex_exit(&rp->r_statelock);
2924 			}
2925 		}
2926 
2927 		setdiropargs3(&args.object, nm, dvp);
2928 
2929 		douprintf = 1;
2930 
2931 		t = gethrtime();
2932 
2933 		error = rfs3call(VTOMI(dvp), NFSPROC3_REMOVE,
2934 		    xdr_diropargs3, (caddr_t)&args,
2935 		    xdr_REMOVE3res, (caddr_t)&res, cr,
2936 		    &douprintf, &res.status, 0, NULL);
2937 
2938 		/*
2939 		 * The xattr dir may be gone after last attr is removed,
2940 		 * so flush it from dnlc.
2941 		 */
2942 		if (dvp->v_flag & V_XATTRDIR)
2943 			dnlc_purge_vp(dvp);
2944 
2945 		PURGE_ATTRCACHE(vp);
2946 
2947 		if (error) {
2948 			PURGE_ATTRCACHE(dvp);
2949 		} else {
2950 			error = geterrno3(res.status);
2951 			if (!error) {
2952 				nfs3_cache_wcc_data(dvp, &res.resok.dir_wcc, t,
2953 				    cr);
2954 				if (HAVE_RDDIR_CACHE(drp))
2955 					nfs_purge_rddir_cache(dvp);
2956 			} else {
2957 				nfs3_cache_wcc_data(dvp, &res.resfail.dir_wcc,
2958 				    t, cr);
2959 				PURGE_STALE_FH(error, dvp, cr);
2960 			}
2961 		}
2962 	}
2963 
2964 	if (error == 0) {
2965 		vnevent_remove(vp, dvp, nm, ct);
2966 	}
2967 	VN_RELE(vp);
2968 
2969 	nfs_rw_exit(&drp->r_rwlock);
2970 
2971 	return (error);
2972 }
2973 
2974 /* ARGSUSED */
2975 static int
2976 nfs3_link(vnode_t *tdvp, vnode_t *svp, char *tnm, cred_t *cr,
2977     caller_context_t *ct, int flags)
2978 {
2979 	int error;
2980 	LINK3args args;
2981 	LINK3res res;
2982 	vnode_t *realvp;
2983 	int douprintf;
2984 	mntinfo_t *mi;
2985 	rnode_t *tdrp;
2986 	hrtime_t t;
2987 
2988 	if (nfs_zone() != VTOMI(tdvp)->mi_zone)
2989 		return (EPERM);
2990 	if (VOP_REALVP(svp, &realvp, ct) == 0)
2991 		svp = realvp;
2992 
2993 	mi = VTOMI(svp);
2994 
2995 	if (!(mi->mi_flags & MI_LINK))
2996 		return (EOPNOTSUPP);
2997 
2998 	args.file = *VTOFH3(svp);
2999 	setdiropargs3(&args.link, tnm, tdvp);
3000 
3001 	tdrp = VTOR(tdvp);
3002 	if (nfs_rw_enter_sig(&tdrp->r_rwlock, RW_WRITER, INTR(tdvp)))
3003 		return (EINTR);
3004 
3005 	dnlc_remove(tdvp, tnm);
3006 
3007 	douprintf = 1;
3008 
3009 	t = gethrtime();
3010 
3011 	error = rfs3call(mi, NFSPROC3_LINK,
3012 	    xdr_LINK3args, (caddr_t)&args,
3013 	    xdr_LINK3res, (caddr_t)&res, cr,
3014 	    &douprintf, &res.status, 0, NULL);
3015 
3016 	if (error) {
3017 		PURGE_ATTRCACHE(tdvp);
3018 		PURGE_ATTRCACHE(svp);
3019 		nfs_rw_exit(&tdrp->r_rwlock);
3020 		return (error);
3021 	}
3022 
3023 	error = geterrno3(res.status);
3024 
3025 	if (!error) {
3026 		nfs3_cache_post_op_attr(svp, &res.resok.file_attributes, t, cr);
3027 		nfs3_cache_wcc_data(tdvp, &res.resok.linkdir_wcc, t, cr);
3028 		if (HAVE_RDDIR_CACHE(tdrp))
3029 			nfs_purge_rddir_cache(tdvp);
3030 		dnlc_update(tdvp, tnm, svp);
3031 	} else {
3032 		nfs3_cache_post_op_attr(svp, &res.resfail.file_attributes, t,
3033 		    cr);
3034 		nfs3_cache_wcc_data(tdvp, &res.resfail.linkdir_wcc, t, cr);
3035 		if (error == EOPNOTSUPP) {
3036 			mutex_enter(&mi->mi_lock);
3037 			mi->mi_flags &= ~MI_LINK;
3038 			mutex_exit(&mi->mi_lock);
3039 		}
3040 	}
3041 
3042 	nfs_rw_exit(&tdrp->r_rwlock);
3043 
3044 	if (!error) {
3045 		/*
3046 		 * Notify the source file of this link operation.
3047 		 */
3048 		vnevent_link(svp, ct);
3049 	}
3050 	return (error);
3051 }
3052 
3053 /* ARGSUSED */
3054 static int
3055 nfs3_rename(vnode_t *odvp, char *onm, vnode_t *ndvp, char *nnm, cred_t *cr,
3056     caller_context_t *ct, int flags)
3057 {
3058 	vnode_t *realvp;
3059 
3060 	if (nfs_zone() != VTOMI(odvp)->mi_zone)
3061 		return (EPERM);
3062 	if (VOP_REALVP(ndvp, &realvp, ct) == 0)
3063 		ndvp = realvp;
3064 
3065 	return (nfs3rename(odvp, onm, ndvp, nnm, cr, ct));
3066 }
3067 
3068 /*
3069  * nfs3rename does the real work of renaming in NFS Version 3.
3070  */
3071 static int
3072 nfs3rename(vnode_t *odvp, char *onm, vnode_t *ndvp, char *nnm, cred_t *cr,
3073     caller_context_t *ct)
3074 {
3075 	int error;
3076 	RENAME3args args;
3077 	RENAME3res res;
3078 	int douprintf;
3079 	vnode_t *nvp = NULL;
3080 	vnode_t *ovp = NULL;
3081 	char *tmpname;
3082 	rnode_t *rp;
3083 	rnode_t *odrp;
3084 	rnode_t *ndrp;
3085 	hrtime_t t;
3086 
3087 	ASSERT(nfs_zone() == VTOMI(odvp)->mi_zone);
3088 
3089 	if (strcmp(onm, ".") == 0 || strcmp(onm, "..") == 0 ||
3090 	    strcmp(nnm, ".") == 0 || strcmp(nnm, "..") == 0)
3091 		return (EINVAL);
3092 
3093 	odrp = VTOR(odvp);
3094 	ndrp = VTOR(ndvp);
3095 	if ((intptr_t)odrp < (intptr_t)ndrp) {
3096 		if (nfs_rw_enter_sig(&odrp->r_rwlock, RW_WRITER, INTR(odvp)))
3097 			return (EINTR);
3098 		if (nfs_rw_enter_sig(&ndrp->r_rwlock, RW_WRITER, INTR(ndvp))) {
3099 			nfs_rw_exit(&odrp->r_rwlock);
3100 			return (EINTR);
3101 		}
3102 	} else {
3103 		if (nfs_rw_enter_sig(&ndrp->r_rwlock, RW_WRITER, INTR(ndvp)))
3104 			return (EINTR);
3105 		if (nfs_rw_enter_sig(&odrp->r_rwlock, RW_WRITER, INTR(odvp))) {
3106 			nfs_rw_exit(&ndrp->r_rwlock);
3107 			return (EINTR);
3108 		}
3109 	}
3110 
3111 	/*
3112 	 * Lookup the target file.  If it exists, it needs to be
3113 	 * checked to see whether it is a mount point and whether
3114 	 * it is active (open).
3115 	 */
3116 	error = nfs3lookup(ndvp, nnm, &nvp, NULL, 0, NULL, cr, 0);
3117 	if (!error) {
3118 		/*
3119 		 * If this file has been mounted on, then just
3120 		 * return busy because renaming to it would remove
3121 		 * the mounted file system from the name space.
3122 		 */
3123 		if (vn_mountedvfs(nvp) != NULL) {
3124 			VN_RELE(nvp);
3125 			nfs_rw_exit(&odrp->r_rwlock);
3126 			nfs_rw_exit(&ndrp->r_rwlock);
3127 			return (EBUSY);
3128 		}
3129 
3130 		/*
3131 		 * Purge the name cache of all references to this vnode
3132 		 * so that we can check the reference count to infer
3133 		 * whether it is active or not.
3134 		 */
3135 		/*
3136 		 * First just remove the entry from the name cache, as it
3137 		 * is most likely the only entry for this vp.
3138 		 */
3139 		dnlc_remove(ndvp, nnm);
3140 		/*
3141 		 * If the file has a v_count > 1 then there may be more
3142 		 * than one entry in the name cache due multiple links
3143 		 * or an open file, but we don't have the real reference
3144 		 * count so flush all possible entries.
3145 		 */
3146 		if (nvp->v_count > 1)
3147 			dnlc_purge_vp(nvp);
3148 
3149 		/*
3150 		 * If the vnode is active and is not a directory,
3151 		 * arrange to rename it to a
3152 		 * temporary file so that it will continue to be
3153 		 * accessible.  This implements the "unlink-open-file"
3154 		 * semantics for the target of a rename operation.
3155 		 * Before doing this though, make sure that the
3156 		 * source and target files are not already the same.
3157 		 */
3158 		if (nvp->v_count > 1 && nvp->v_type != VDIR) {
3159 			/*
3160 			 * Lookup the source name.
3161 			 */
3162 			error = nfs3lookup(odvp, onm, &ovp, NULL, 0, NULL,
3163 			    cr, 0);
3164 
3165 			/*
3166 			 * The source name *should* already exist.
3167 			 */
3168 			if (error) {
3169 				VN_RELE(nvp);
3170 				nfs_rw_exit(&odrp->r_rwlock);
3171 				nfs_rw_exit(&ndrp->r_rwlock);
3172 				return (error);
3173 			}
3174 
3175 			/*
3176 			 * Compare the two vnodes.  If they are the same,
3177 			 * just release all held vnodes and return success.
3178 			 */
3179 			if (ovp == nvp) {
3180 				VN_RELE(ovp);
3181 				VN_RELE(nvp);
3182 				nfs_rw_exit(&odrp->r_rwlock);
3183 				nfs_rw_exit(&ndrp->r_rwlock);
3184 				return (0);
3185 			}
3186 
3187 			/*
3188 			 * Can't mix and match directories and non-
3189 			 * directories in rename operations.  We already
3190 			 * know that the target is not a directory.  If
3191 			 * the source is a directory, return an error.
3192 			 */
3193 			if (ovp->v_type == VDIR) {
3194 				VN_RELE(ovp);
3195 				VN_RELE(nvp);
3196 				nfs_rw_exit(&odrp->r_rwlock);
3197 				nfs_rw_exit(&ndrp->r_rwlock);
3198 				return (ENOTDIR);
3199 			}
3200 
3201 			/*
3202 			 * The target file exists, is not the same as
3203 			 * the source file, and is active.  Link it
3204 			 * to a temporary filename to avoid having
3205 			 * the server removing the file completely.
3206 			 */
3207 			tmpname = newname();
3208 			error = nfs3_link(ndvp, nvp, tmpname, cr, NULL, 0);
3209 			if (error == EOPNOTSUPP) {
3210 				error = nfs3_rename(ndvp, nnm, ndvp, tmpname,
3211 				    cr, NULL, 0);
3212 			}
3213 			if (error) {
3214 				kmem_free(tmpname, MAXNAMELEN);
3215 				VN_RELE(ovp);
3216 				VN_RELE(nvp);
3217 				nfs_rw_exit(&odrp->r_rwlock);
3218 				nfs_rw_exit(&ndrp->r_rwlock);
3219 				return (error);
3220 			}
3221 			rp = VTOR(nvp);
3222 			mutex_enter(&rp->r_statelock);
3223 			if (rp->r_unldvp == NULL) {
3224 				VN_HOLD(ndvp);
3225 				rp->r_unldvp = ndvp;
3226 				if (rp->r_unlcred != NULL)
3227 					crfree(rp->r_unlcred);
3228 				crhold(cr);
3229 				rp->r_unlcred = cr;
3230 				rp->r_unlname = tmpname;
3231 			} else {
3232 				kmem_free(rp->r_unlname, MAXNAMELEN);
3233 				rp->r_unlname = tmpname;
3234 			}
3235 			mutex_exit(&rp->r_statelock);
3236 		}
3237 	}
3238 
3239 	if (ovp == NULL) {
3240 		/*
3241 		 * When renaming directories to be a subdirectory of a
3242 		 * different parent, the dnlc entry for ".." will no
3243 		 * longer be valid, so it must be removed.
3244 		 *
3245 		 * We do a lookup here to determine whether we are renaming
3246 		 * a directory and we need to check if we are renaming
3247 		 * an unlinked file.  This might have already been done
3248 		 * in previous code, so we check ovp == NULL to avoid
3249 		 * doing it twice.
3250 		 */
3251 
3252 		error = nfs3lookup(odvp, onm, &ovp, NULL, 0, NULL, cr, 0);
3253 		/*
3254 		 * The source name *should* already exist.
3255 		 */
3256 		if (error) {
3257 			nfs_rw_exit(&odrp->r_rwlock);
3258 			nfs_rw_exit(&ndrp->r_rwlock);
3259 			if (nvp) {
3260 				VN_RELE(nvp);
3261 			}
3262 			return (error);
3263 		}
3264 		ASSERT(ovp != NULL);
3265 	}
3266 
3267 	dnlc_remove(odvp, onm);
3268 	dnlc_remove(ndvp, nnm);
3269 
3270 	setdiropargs3(&args.from, onm, odvp);
3271 	setdiropargs3(&args.to, nnm, ndvp);
3272 
3273 	douprintf = 1;
3274 
3275 	t = gethrtime();
3276 
3277 	error = rfs3call(VTOMI(odvp), NFSPROC3_RENAME,
3278 	    xdr_RENAME3args, (caddr_t)&args,
3279 	    xdr_RENAME3res, (caddr_t)&res, cr,
3280 	    &douprintf, &res.status, 0, NULL);
3281 
3282 	if (error) {
3283 		PURGE_ATTRCACHE(odvp);
3284 		PURGE_ATTRCACHE(ndvp);
3285 		VN_RELE(ovp);
3286 		nfs_rw_exit(&odrp->r_rwlock);
3287 		nfs_rw_exit(&ndrp->r_rwlock);
3288 		if (nvp) {
3289 			VN_RELE(nvp);
3290 		}
3291 		return (error);
3292 	}
3293 
3294 	error = geterrno3(res.status);
3295 
3296 	if (!error) {
3297 		nfs3_cache_wcc_data(odvp, &res.resok.fromdir_wcc, t, cr);
3298 		if (HAVE_RDDIR_CACHE(odrp))
3299 			nfs_purge_rddir_cache(odvp);
3300 		if (ndvp != odvp) {
3301 			nfs3_cache_wcc_data(ndvp, &res.resok.todir_wcc, t, cr);
3302 			if (HAVE_RDDIR_CACHE(ndrp))
3303 				nfs_purge_rddir_cache(ndvp);
3304 		}
3305 		/*
3306 		 * when renaming directories to be a subdirectory of a
3307 		 * different parent, the dnlc entry for ".." will no
3308 		 * longer be valid, so it must be removed
3309 		 */
3310 		rp = VTOR(ovp);
3311 		if (ndvp != odvp) {
3312 			if (ovp->v_type == VDIR) {
3313 				dnlc_remove(ovp, "..");
3314 				if (HAVE_RDDIR_CACHE(rp))
3315 					nfs_purge_rddir_cache(ovp);
3316 			}
3317 		}
3318 
3319 		/*
3320 		 * If we are renaming the unlinked file, update the
3321 		 * r_unldvp and r_unlname as needed.
3322 		 */
3323 		mutex_enter(&rp->r_statelock);
3324 		if (rp->r_unldvp != NULL) {
3325 			if (strcmp(rp->r_unlname, onm) == 0) {
3326 				(void) strncpy(rp->r_unlname, nnm, MAXNAMELEN);
3327 				rp->r_unlname[MAXNAMELEN - 1] = '\0';
3328 
3329 				if (ndvp != rp->r_unldvp) {
3330 					VN_RELE(rp->r_unldvp);
3331 					rp->r_unldvp = ndvp;
3332 					VN_HOLD(ndvp);
3333 				}
3334 			}
3335 		}
3336 		mutex_exit(&rp->r_statelock);
3337 	} else {
3338 		nfs3_cache_wcc_data(odvp, &res.resfail.fromdir_wcc, t, cr);
3339 		if (ndvp != odvp) {
3340 			nfs3_cache_wcc_data(ndvp, &res.resfail.todir_wcc, t,
3341 			    cr);
3342 		}
3343 		/*
3344 		 * System V defines rename to return EEXIST, not
3345 		 * ENOTEMPTY if the target directory is not empty.
3346 		 * Over the wire, the error is NFSERR_ENOTEMPTY
3347 		 * which geterrno maps to ENOTEMPTY.
3348 		 */
3349 		if (error == ENOTEMPTY)
3350 			error = EEXIST;
3351 	}
3352 
3353 	if (error == 0) {
3354 		if (nvp)
3355 			vnevent_rename_dest(nvp, ndvp, nnm, ct);
3356 
3357 		if (odvp != ndvp)
3358 			vnevent_rename_dest_dir(ndvp, ct);
3359 		ASSERT(ovp != NULL);
3360 		vnevent_rename_src(ovp, odvp, onm, ct);
3361 	}
3362 
3363 	if (nvp) {
3364 		VN_RELE(nvp);
3365 	}
3366 	VN_RELE(ovp);
3367 
3368 	nfs_rw_exit(&odrp->r_rwlock);
3369 	nfs_rw_exit(&ndrp->r_rwlock);
3370 
3371 	return (error);
3372 }
3373 
3374 /* ARGSUSED */
3375 static int
3376 nfs3_mkdir(vnode_t *dvp, char *nm, struct vattr *va, vnode_t **vpp, cred_t *cr,
3377     caller_context_t *ct, int flags, vsecattr_t *vsecp)
3378 {
3379 	int error;
3380 	MKDIR3args args;
3381 	MKDIR3res res;
3382 	int douprintf;
3383 	struct vattr vattr;
3384 	vnode_t *vp;
3385 	rnode_t *drp;
3386 	hrtime_t t;
3387 
3388 	if (nfs_zone() != VTOMI(dvp)->mi_zone)
3389 		return (EPERM);
3390 	setdiropargs3(&args.where, nm, dvp);
3391 
3392 	/*
3393 	 * Decide what the group-id and set-gid bit of the created directory
3394 	 * should be.  May have to do a setattr to get the gid right.
3395 	 */
3396 	error = setdirgid(dvp, &va->va_gid, cr);
3397 	if (error)
3398 		return (error);
3399 	error = setdirmode(dvp, &va->va_mode, cr);
3400 	if (error)
3401 		return (error);
3402 	va->va_mask |= AT_MODE|AT_GID;
3403 
3404 	error = vattr_to_sattr3(va, &args.attributes);
3405 	if (error) {
3406 		/* req time field(s) overflow - return immediately */
3407 		return (error);
3408 	}
3409 
3410 	drp = VTOR(dvp);
3411 	if (nfs_rw_enter_sig(&drp->r_rwlock, RW_WRITER, INTR(dvp)))
3412 		return (EINTR);
3413 
3414 	dnlc_remove(dvp, nm);
3415 
3416 	douprintf = 1;
3417 
3418 	t = gethrtime();
3419 
3420 	error = rfs3call(VTOMI(dvp), NFSPROC3_MKDIR,
3421 	    xdr_MKDIR3args, (caddr_t)&args,
3422 	    xdr_MKDIR3res, (caddr_t)&res, cr,
3423 	    &douprintf, &res.status, 0, NULL);
3424 
3425 	if (error) {
3426 		PURGE_ATTRCACHE(dvp);
3427 		nfs_rw_exit(&drp->r_rwlock);
3428 		return (error);
3429 	}
3430 
3431 	error = geterrno3(res.status);
3432 	if (!error) {
3433 		nfs3_cache_wcc_data(dvp, &res.resok.dir_wcc, t, cr);
3434 		if (HAVE_RDDIR_CACHE(drp))
3435 			nfs_purge_rddir_cache(dvp);
3436 
3437 		if (!res.resok.obj.handle_follows) {
3438 			error = nfs3lookup(dvp, nm, &vp, NULL, 0, NULL, cr, 0);
3439 			if (error) {
3440 				nfs_rw_exit(&drp->r_rwlock);
3441 				return (error);
3442 			}
3443 		} else {
3444 			if (res.resok.obj_attributes.attributes) {
3445 				vp = makenfs3node(&res.resok.obj.handle,
3446 				    &res.resok.obj_attributes.attr,
3447 				    dvp->v_vfsp, t, cr, NULL, NULL);
3448 			} else {
3449 				vp = makenfs3node(&res.resok.obj.handle, NULL,
3450 				    dvp->v_vfsp, t, cr, NULL, NULL);
3451 				if (vp->v_type == VNON) {
3452 					vattr.va_mask = AT_TYPE;
3453 					error = nfs3getattr(vp, &vattr, cr);
3454 					if (error) {
3455 						VN_RELE(vp);
3456 						nfs_rw_exit(&drp->r_rwlock);
3457 						return (error);
3458 					}
3459 					vp->v_type = vattr.va_type;
3460 				}
3461 			}
3462 			dnlc_update(dvp, nm, vp);
3463 		}
3464 		if (va->va_gid != VTOR(vp)->r_attr.va_gid) {
3465 			va->va_mask = AT_GID;
3466 			(void) nfs3setattr(vp, va, 0, cr);
3467 		}
3468 		*vpp = vp;
3469 	} else {
3470 		nfs3_cache_wcc_data(dvp, &res.resfail.dir_wcc, t, cr);
3471 		PURGE_STALE_FH(error, dvp, cr);
3472 	}
3473 
3474 	nfs_rw_exit(&drp->r_rwlock);
3475 
3476 	return (error);
3477 }
3478 
3479 /* ARGSUSED */
3480 static int
3481 nfs3_rmdir(vnode_t *dvp, char *nm, vnode_t *cdir, cred_t *cr,
3482     caller_context_t *ct, int flags)
3483 {
3484 	int error;
3485 	RMDIR3args args;
3486 	RMDIR3res res;
3487 	vnode_t *vp;
3488 	int douprintf;
3489 	rnode_t *drp;
3490 	hrtime_t t;
3491 
3492 	if (nfs_zone() != VTOMI(dvp)->mi_zone)
3493 		return (EPERM);
3494 	drp = VTOR(dvp);
3495 	if (nfs_rw_enter_sig(&drp->r_rwlock, RW_WRITER, INTR(dvp)))
3496 		return (EINTR);
3497 
3498 	/*
3499 	 * Attempt to prevent a rmdir(".") from succeeding.
3500 	 */
3501 	error = nfs3lookup(dvp, nm, &vp, NULL, 0, NULL, cr, 0);
3502 	if (error) {
3503 		nfs_rw_exit(&drp->r_rwlock);
3504 		return (error);
3505 	}
3506 
3507 	if (vp == cdir) {
3508 		VN_RELE(vp);
3509 		nfs_rw_exit(&drp->r_rwlock);
3510 		return (EINVAL);
3511 	}
3512 
3513 	setdiropargs3(&args.object, nm, dvp);
3514 
3515 	/*
3516 	 * First just remove the entry from the name cache, as it
3517 	 * is most likely an entry for this vp.
3518 	 */
3519 	dnlc_remove(dvp, nm);
3520 
3521 	/*
3522 	 * If there vnode reference count is greater than one, then
3523 	 * there may be additional references in the DNLC which will
3524 	 * need to be purged.  First, trying removing the entry for
3525 	 * the parent directory and see if that removes the additional
3526 	 * reference(s).  If that doesn't do it, then use dnlc_purge_vp
3527 	 * to completely remove any references to the directory which
3528 	 * might still exist in the DNLC.
3529 	 */
3530 	if (vp->v_count > 1) {
3531 		dnlc_remove(vp, "..");
3532 		if (vp->v_count > 1)
3533 			dnlc_purge_vp(vp);
3534 	}
3535 
3536 	douprintf = 1;
3537 
3538 	t = gethrtime();
3539 
3540 	error = rfs3call(VTOMI(dvp), NFSPROC3_RMDIR,
3541 	    xdr_diropargs3, (caddr_t)&args,
3542 	    xdr_RMDIR3res, (caddr_t)&res, cr,
3543 	    &douprintf, &res.status, 0, NULL);
3544 
3545 	PURGE_ATTRCACHE(vp);
3546 
3547 	if (error) {
3548 		PURGE_ATTRCACHE(dvp);
3549 		VN_RELE(vp);
3550 		nfs_rw_exit(&drp->r_rwlock);
3551 		return (error);
3552 	}
3553 
3554 	error = geterrno3(res.status);
3555 	if (!error) {
3556 		nfs3_cache_wcc_data(dvp, &res.resok.dir_wcc, t, cr);
3557 		if (HAVE_RDDIR_CACHE(drp))
3558 			nfs_purge_rddir_cache(dvp);
3559 		if (HAVE_RDDIR_CACHE(VTOR(vp)))
3560 			nfs_purge_rddir_cache(vp);
3561 	} else {
3562 		nfs3_cache_wcc_data(dvp, &res.resfail.dir_wcc, t, cr);
3563 		PURGE_STALE_FH(error, dvp, cr);
3564 		/*
3565 		 * System V defines rmdir to return EEXIST, not
3566 		 * ENOTEMPTY if the directory is not empty.  Over
3567 		 * the wire, the error is NFSERR_ENOTEMPTY which
3568 		 * geterrno maps to ENOTEMPTY.
3569 		 */
3570 		if (error == ENOTEMPTY)
3571 			error = EEXIST;
3572 	}
3573 
3574 	if (error == 0) {
3575 		vnevent_rmdir(vp, dvp, nm, ct);
3576 	}
3577 	VN_RELE(vp);
3578 
3579 	nfs_rw_exit(&drp->r_rwlock);
3580 
3581 	return (error);
3582 }
3583 
3584 /* ARGSUSED */
3585 static int
3586 nfs3_symlink(vnode_t *dvp, char *lnm, struct vattr *tva, char *tnm, cred_t *cr,
3587     caller_context_t *ct, int flags)
3588 {
3589 	int error;
3590 	SYMLINK3args args;
3591 	SYMLINK3res res;
3592 	int douprintf;
3593 	mntinfo_t *mi;
3594 	vnode_t *vp;
3595 	rnode_t *rp;
3596 	char *contents;
3597 	rnode_t *drp;
3598 	hrtime_t t;
3599 
3600 	mi = VTOMI(dvp);
3601 
3602 	if (nfs_zone() != mi->mi_zone)
3603 		return (EPERM);
3604 	if (!(mi->mi_flags & MI_SYMLINK))
3605 		return (EOPNOTSUPP);
3606 
3607 	setdiropargs3(&args.where, lnm, dvp);
3608 	error = vattr_to_sattr3(tva, &args.symlink.symlink_attributes);
3609 	if (error) {
3610 		/* req time field(s) overflow - return immediately */
3611 		return (error);
3612 	}
3613 	args.symlink.symlink_data = tnm;
3614 
3615 	drp = VTOR(dvp);
3616 	if (nfs_rw_enter_sig(&drp->r_rwlock, RW_WRITER, INTR(dvp)))
3617 		return (EINTR);
3618 
3619 	dnlc_remove(dvp, lnm);
3620 
3621 	douprintf = 1;
3622 
3623 	t = gethrtime();
3624 
3625 	error = rfs3call(mi, NFSPROC3_SYMLINK,
3626 	    xdr_SYMLINK3args, (caddr_t)&args,
3627 	    xdr_SYMLINK3res, (caddr_t)&res, cr,
3628 	    &douprintf, &res.status, 0, NULL);
3629 
3630 	if (error) {
3631 		PURGE_ATTRCACHE(dvp);
3632 		nfs_rw_exit(&drp->r_rwlock);
3633 		return (error);
3634 	}
3635 
3636 	error = geterrno3(res.status);
3637 	if (!error) {
3638 		nfs3_cache_wcc_data(dvp, &res.resok.dir_wcc, t, cr);
3639 		if (HAVE_RDDIR_CACHE(drp))
3640 			nfs_purge_rddir_cache(dvp);
3641 
3642 		if (res.resok.obj.handle_follows) {
3643 			if (res.resok.obj_attributes.attributes) {
3644 				vp = makenfs3node(&res.resok.obj.handle,
3645 				    &res.resok.obj_attributes.attr,
3646 				    dvp->v_vfsp, t, cr, NULL, NULL);
3647 			} else {
3648 				vp = makenfs3node(&res.resok.obj.handle, NULL,
3649 				    dvp->v_vfsp, t, cr, NULL, NULL);
3650 				vp->v_type = VLNK;
3651 				vp->v_rdev = 0;
3652 			}
3653 			dnlc_update(dvp, lnm, vp);
3654 			rp = VTOR(vp);
3655 			if (nfs3_do_symlink_cache &&
3656 			    rp->r_symlink.contents == NULL) {
3657 
3658 				contents = kmem_alloc(MAXPATHLEN,
3659 				    KM_NOSLEEP);
3660 
3661 				if (contents != NULL) {
3662 					mutex_enter(&rp->r_statelock);
3663 					if (rp->r_symlink.contents == NULL) {
3664 						rp->r_symlink.len = strlen(tnm);
3665 						bcopy(tnm, contents,
3666 						    rp->r_symlink.len);
3667 						rp->r_symlink.contents =
3668 						    contents;
3669 						rp->r_symlink.size = MAXPATHLEN;
3670 						mutex_exit(&rp->r_statelock);
3671 					} else {
3672 						mutex_exit(&rp->r_statelock);
3673 						kmem_free((void *)contents,
3674 						    MAXPATHLEN);
3675 					}
3676 				}
3677 			}
3678 			VN_RELE(vp);
3679 		}
3680 	} else {
3681 		nfs3_cache_wcc_data(dvp, &res.resfail.dir_wcc, t, cr);
3682 		PURGE_STALE_FH(error, dvp, cr);
3683 		if (error == EOPNOTSUPP) {
3684 			mutex_enter(&mi->mi_lock);
3685 			mi->mi_flags &= ~MI_SYMLINK;
3686 			mutex_exit(&mi->mi_lock);
3687 		}
3688 	}
3689 
3690 	nfs_rw_exit(&drp->r_rwlock);
3691 
3692 	return (error);
3693 }
3694 
3695 #ifdef DEBUG
3696 static int nfs3_readdir_cache_hits = 0;
3697 static int nfs3_readdir_cache_shorts = 0;
3698 static int nfs3_readdir_cache_waits = 0;
3699 static int nfs3_readdir_cache_misses = 0;
3700 static int nfs3_readdir_readahead = 0;
3701 #endif
3702 
3703 static int nfs3_shrinkreaddir = 0;
3704 
3705 /*
3706  * Read directory entries.
3707  * There are some weird things to look out for here.  The uio_loffset
3708  * field is either 0 or it is the offset returned from a previous
3709  * readdir.  It is an opaque value used by the server to find the
3710  * correct directory block to read. The count field is the number
3711  * of blocks to read on the server.  This is advisory only, the server
3712  * may return only one block's worth of entries.  Entries may be compressed
3713  * on the server.
3714  */
3715 /* ARGSUSED */
3716 static int
3717 nfs3_readdir(vnode_t *vp, struct uio *uiop, cred_t *cr, int *eofp,
3718     caller_context_t *ct, int flags)
3719 {
3720 	int error;
3721 	size_t count;
3722 	rnode_t *rp;
3723 	rddir_cache *rdc;
3724 	rddir_cache *nrdc;
3725 	rddir_cache *rrdc;
3726 #ifdef DEBUG
3727 	int missed;
3728 #endif
3729 	int doreadahead;
3730 	rddir_cache srdc;
3731 	avl_index_t where;
3732 
3733 	if (nfs_zone() != VTOMI(vp)->mi_zone)
3734 		return (EIO);
3735 	rp = VTOR(vp);
3736 
3737 	ASSERT(nfs_rw_lock_held(&rp->r_rwlock, RW_READER));
3738 
3739 	/*
3740 	 * Make sure that the directory cache is valid.
3741 	 */
3742 	if (HAVE_RDDIR_CACHE(rp)) {
3743 		if (nfs_disable_rddir_cache) {
3744 			/*
3745 			 * Setting nfs_disable_rddir_cache in /etc/system
3746 			 * allows interoperability with servers that do not
3747 			 * properly update the attributes of directories.
3748 			 * Any cached information gets purged before an
3749 			 * access is made to it.
3750 			 */
3751 			nfs_purge_rddir_cache(vp);
3752 		} else {
3753 			error = nfs3_validate_caches(vp, cr);
3754 			if (error)
3755 				return (error);
3756 		}
3757 	}
3758 
3759 	/*
3760 	 * It is possible that some servers may not be able to correctly
3761 	 * handle a large READDIR or READDIRPLUS request due to bugs in
3762 	 * their implementation.  In order to continue to interoperate
3763 	 * with them, this workaround is provided to limit the maximum
3764 	 * size of a READDIRPLUS request to 1024.  In any case, the request
3765 	 * size is limited to MAXBSIZE.
3766 	 */
3767 	count = MIN(uiop->uio_iov->iov_len,
3768 	    nfs3_shrinkreaddir ? 1024 : MAXBSIZE);
3769 
3770 	nrdc = NULL;
3771 #ifdef DEBUG
3772 	missed = 0;
3773 #endif
3774 top:
3775 	/*
3776 	 * Short circuit last readdir which always returns 0 bytes.
3777 	 * This can be done after the directory has been read through
3778 	 * completely at least once.  This will set r_direof which
3779 	 * can be used to find the value of the last cookie.
3780 	 */
3781 	mutex_enter(&rp->r_statelock);
3782 	if (rp->r_direof != NULL &&
3783 	    uiop->uio_loffset == rp->r_direof->nfs3_ncookie) {
3784 		mutex_exit(&rp->r_statelock);
3785 #ifdef DEBUG
3786 		nfs3_readdir_cache_shorts++;
3787 #endif
3788 		if (eofp)
3789 			*eofp = 1;
3790 		if (nrdc != NULL)
3791 			rddir_cache_rele(nrdc);
3792 		return (0);
3793 	}
3794 	/*
3795 	 * Look for a cache entry.  Cache entries are identified
3796 	 * by the NFS cookie value and the byte count requested.
3797 	 */
3798 	srdc.nfs3_cookie = uiop->uio_loffset;
3799 	srdc.buflen = count;
3800 	rdc = avl_find(&rp->r_dir, &srdc, &where);
3801 	if (rdc != NULL) {
3802 		rddir_cache_hold(rdc);
3803 		/*
3804 		 * If the cache entry is in the process of being
3805 		 * filled in, wait until this completes.  The
3806 		 * RDDIRWAIT bit is set to indicate that someone
3807 		 * is waiting and then the thread currently
3808 		 * filling the entry is done, it should do a
3809 		 * cv_broadcast to wakeup all of the threads
3810 		 * waiting for it to finish.
3811 		 */
3812 		if (rdc->flags & RDDIR) {
3813 			nfs_rw_exit(&rp->r_rwlock);
3814 			rdc->flags |= RDDIRWAIT;
3815 #ifdef DEBUG
3816 			nfs3_readdir_cache_waits++;
3817 #endif
3818 			if (!cv_wait_sig(&rdc->cv, &rp->r_statelock)) {
3819 				/*
3820 				 * We got interrupted, probably
3821 				 * the user typed ^C or an alarm
3822 				 * fired.  We free the new entry
3823 				 * if we allocated one.
3824 				 */
3825 				mutex_exit(&rp->r_statelock);
3826 				(void) nfs_rw_enter_sig(&rp->r_rwlock,
3827 				    RW_READER, FALSE);
3828 				rddir_cache_rele(rdc);
3829 				if (nrdc != NULL)
3830 					rddir_cache_rele(nrdc);
3831 				return (EINTR);
3832 			}
3833 			mutex_exit(&rp->r_statelock);
3834 			(void) nfs_rw_enter_sig(&rp->r_rwlock,
3835 			    RW_READER, FALSE);
3836 			rddir_cache_rele(rdc);
3837 			goto top;
3838 		}
3839 		/*
3840 		 * Check to see if a readdir is required to
3841 		 * fill the entry.  If so, mark this entry
3842 		 * as being filled, remove our reference,
3843 		 * and branch to the code to fill the entry.
3844 		 */
3845 		if (rdc->flags & RDDIRREQ) {
3846 			rdc->flags &= ~RDDIRREQ;
3847 			rdc->flags |= RDDIR;
3848 			if (nrdc != NULL)
3849 				rddir_cache_rele(nrdc);
3850 			nrdc = rdc;
3851 			mutex_exit(&rp->r_statelock);
3852 			goto bottom;
3853 		}
3854 #ifdef DEBUG
3855 		if (!missed)
3856 			nfs3_readdir_cache_hits++;
3857 #endif
3858 		/*
3859 		 * If an error occurred while attempting
3860 		 * to fill the cache entry, just return it.
3861 		 */
3862 		if (rdc->error) {
3863 			error = rdc->error;
3864 			mutex_exit(&rp->r_statelock);
3865 			rddir_cache_rele(rdc);
3866 			if (nrdc != NULL)
3867 				rddir_cache_rele(nrdc);
3868 			return (error);
3869 		}
3870 
3871 		/*
3872 		 * The cache entry is complete and good,
3873 		 * copyout the dirent structs to the calling
3874 		 * thread.
3875 		 */
3876 		error = uiomove(rdc->entries, rdc->entlen, UIO_READ, uiop);
3877 
3878 		/*
3879 		 * If no error occurred during the copyout,
3880 		 * update the offset in the uio struct to
3881 		 * contain the value of the next cookie
3882 		 * and set the eof value appropriately.
3883 		 */
3884 		if (!error) {
3885 			uiop->uio_loffset = rdc->nfs3_ncookie;
3886 			if (eofp)
3887 				*eofp = rdc->eof;
3888 		}
3889 
3890 		/*
3891 		 * Decide whether to do readahead.
3892 		 *
3893 		 * Don't if have already read to the end of
3894 		 * directory.  There is nothing more to read.
3895 		 *
3896 		 * Don't if the application is not doing
3897 		 * lookups in the directory.  The readahead
3898 		 * is only effective if the application can
3899 		 * be doing work while an async thread is
3900 		 * handling the over the wire request.
3901 		 */
3902 		if (rdc->eof) {
3903 			rp->r_direof = rdc;
3904 			doreadahead = FALSE;
3905 		} else if (!(rp->r_flags & RLOOKUP))
3906 			doreadahead = FALSE;
3907 		else
3908 			doreadahead = TRUE;
3909 
3910 		if (!doreadahead) {
3911 			mutex_exit(&rp->r_statelock);
3912 			rddir_cache_rele(rdc);
3913 			if (nrdc != NULL)
3914 				rddir_cache_rele(nrdc);
3915 			return (error);
3916 		}
3917 
3918 		/*
3919 		 * Check to see whether we found an entry
3920 		 * for the readahead.  If so, we don't need
3921 		 * to do anything further, so free the new
3922 		 * entry if one was allocated.  Otherwise,
3923 		 * allocate a new entry, add it to the cache,
3924 		 * and then initiate an asynchronous readdir
3925 		 * operation to fill it.
3926 		 */
3927 		srdc.nfs3_cookie = rdc->nfs3_ncookie;
3928 		srdc.buflen = count;
3929 		rrdc = avl_find(&rp->r_dir, &srdc, &where);
3930 		if (rrdc != NULL) {
3931 			if (nrdc != NULL)
3932 				rddir_cache_rele(nrdc);
3933 		} else {
3934 			if (nrdc != NULL)
3935 				rrdc = nrdc;
3936 			else {
3937 				rrdc = rddir_cache_alloc(KM_NOSLEEP);
3938 			}
3939 			if (rrdc != NULL) {
3940 				rrdc->nfs3_cookie = rdc->nfs3_ncookie;
3941 				rrdc->buflen = count;
3942 				avl_insert(&rp->r_dir, rrdc, where);
3943 				rddir_cache_hold(rrdc);
3944 				mutex_exit(&rp->r_statelock);
3945 				rddir_cache_rele(rdc);
3946 #ifdef DEBUG
3947 				nfs3_readdir_readahead++;
3948 #endif
3949 				nfs_async_readdir(vp, rrdc, cr, do_nfs3readdir);
3950 				return (error);
3951 			}
3952 		}
3953 
3954 		mutex_exit(&rp->r_statelock);
3955 		rddir_cache_rele(rdc);
3956 		return (error);
3957 	}
3958 
3959 	/*
3960 	 * Didn't find an entry in the cache.  Construct a new empty
3961 	 * entry and link it into the cache.  Other processes attempting
3962 	 * to access this entry will need to wait until it is filled in.
3963 	 *
3964 	 * Since kmem_alloc may block, another pass through the cache
3965 	 * will need to be taken to make sure that another process
3966 	 * hasn't already added an entry to the cache for this request.
3967 	 */
3968 	if (nrdc == NULL) {
3969 		mutex_exit(&rp->r_statelock);
3970 		nrdc = rddir_cache_alloc(KM_SLEEP);
3971 		nrdc->nfs3_cookie = uiop->uio_loffset;
3972 		nrdc->buflen = count;
3973 		goto top;
3974 	}
3975 
3976 	/*
3977 	 * Add this entry to the cache.
3978 	 */
3979 	avl_insert(&rp->r_dir, nrdc, where);
3980 	rddir_cache_hold(nrdc);
3981 	mutex_exit(&rp->r_statelock);
3982 
3983 bottom:
3984 #ifdef DEBUG
3985 	missed = 1;
3986 	nfs3_readdir_cache_misses++;
3987 #endif
3988 	/*
3989 	 * Do the readdir.  This routine decides whether to use
3990 	 * READDIR or READDIRPLUS.
3991 	 */
3992 	error = do_nfs3readdir(vp, nrdc, cr);
3993 
3994 	/*
3995 	 * If this operation failed, just return the error which occurred.
3996 	 */
3997 	if (error != 0)
3998 		return (error);
3999 
4000 	/*
4001 	 * Since the RPC operation will have taken sometime and blocked
4002 	 * this process, another pass through the cache will need to be
4003 	 * taken to find the correct cache entry.  It is possible that
4004 	 * the correct cache entry will not be there (although one was
4005 	 * added) because the directory changed during the RPC operation
4006 	 * and the readdir cache was flushed.  In this case, just start
4007 	 * over.  It is hoped that this will not happen too often... :-)
4008 	 */
4009 	nrdc = NULL;
4010 	goto top;
4011 	/* NOTREACHED */
4012 }
4013 
4014 static int
4015 do_nfs3readdir(vnode_t *vp, rddir_cache *rdc, cred_t *cr)
4016 {
4017 	int error;
4018 	rnode_t *rp;
4019 	mntinfo_t *mi;
4020 
4021 	rp = VTOR(vp);
4022 	mi = VTOMI(vp);
4023 	ASSERT(nfs_zone() == mi->mi_zone);
4024 	/*
4025 	 * Issue the proper request.
4026 	 *
4027 	 * If the server does not support READDIRPLUS, then use READDIR.
4028 	 *
4029 	 * Otherwise --
4030 	 * Issue a READDIRPLUS if reading to fill an empty cache or if
4031 	 * an application has performed a lookup in the directory which
4032 	 * required an over the wire lookup.  The use of READDIRPLUS
4033 	 * will help to (re)populate the DNLC.
4034 	 */
4035 	if (!(mi->mi_flags & MI_READDIRONLY) &&
4036 	    (rp->r_flags & (RLOOKUP | RREADDIRPLUS))) {
4037 		if (rp->r_flags & RREADDIRPLUS) {
4038 			mutex_enter(&rp->r_statelock);
4039 			rp->r_flags &= ~RREADDIRPLUS;
4040 			mutex_exit(&rp->r_statelock);
4041 		}
4042 		nfs3readdirplus(vp, rdc, cr);
4043 		if (rdc->error == EOPNOTSUPP)
4044 			nfs3readdir(vp, rdc, cr);
4045 	} else
4046 		nfs3readdir(vp, rdc, cr);
4047 
4048 	mutex_enter(&rp->r_statelock);
4049 	rdc->flags &= ~RDDIR;
4050 	if (rdc->flags & RDDIRWAIT) {
4051 		rdc->flags &= ~RDDIRWAIT;
4052 		cv_broadcast(&rdc->cv);
4053 	}
4054 	error = rdc->error;
4055 	if (error)
4056 		rdc->flags |= RDDIRREQ;
4057 	mutex_exit(&rp->r_statelock);
4058 
4059 	rddir_cache_rele(rdc);
4060 
4061 	return (error);
4062 }
4063 
4064 static void
4065 nfs3readdir(vnode_t *vp, rddir_cache *rdc, cred_t *cr)
4066 {
4067 	int error;
4068 	READDIR3args args;
4069 	READDIR3vres res;
4070 	vattr_t dva;
4071 	rnode_t *rp;
4072 	int douprintf;
4073 	failinfo_t fi, *fip = NULL;
4074 	mntinfo_t *mi;
4075 	hrtime_t t;
4076 
4077 	rp = VTOR(vp);
4078 	mi = VTOMI(vp);
4079 	ASSERT(nfs_zone() == mi->mi_zone);
4080 
4081 	args.dir = *RTOFH3(rp);
4082 	args.cookie = (cookie3)rdc->nfs3_cookie;
4083 	args.cookieverf = rp->r_cookieverf;
4084 	args.count = rdc->buflen;
4085 
4086 	/*
4087 	 * NFS client failover support
4088 	 * suppress failover unless we have a zero cookie
4089 	 */
4090 	if (args.cookie == (cookie3) 0) {
4091 		fi.vp = vp;
4092 		fi.fhp = (caddr_t)&args.dir;
4093 		fi.copyproc = nfs3copyfh;
4094 		fi.lookupproc = nfs3lookup;
4095 		fi.xattrdirproc = acl_getxattrdir3;
4096 		fip = &fi;
4097 	}
4098 
4099 #ifdef DEBUG
4100 	rdc->entries = rddir_cache_buf_alloc(rdc->buflen, KM_SLEEP);
4101 #else
4102 	rdc->entries = kmem_alloc(rdc->buflen, KM_SLEEP);
4103 #endif
4104 
4105 	res.entries = (dirent64_t *)rdc->entries;
4106 	res.entries_size = rdc->buflen;
4107 	res.dir_attributes.fres.vap = &dva;
4108 	res.dir_attributes.fres.vp = vp;
4109 	res.loff = rdc->nfs3_cookie;
4110 
4111 	douprintf = 1;
4112 
4113 	if (mi->mi_io_kstats) {
4114 		mutex_enter(&mi->mi_lock);
4115 		kstat_runq_enter(KSTAT_IO_PTR(mi->mi_io_kstats));
4116 		mutex_exit(&mi->mi_lock);
4117 	}
4118 
4119 	t = gethrtime();
4120 
4121 	error = rfs3call(VTOMI(vp), NFSPROC3_READDIR,
4122 	    xdr_READDIR3args, (caddr_t)&args,
4123 	    xdr_READDIR3vres, (caddr_t)&res, cr,
4124 	    &douprintf, &res.status, 0, fip);
4125 
4126 	if (mi->mi_io_kstats) {
4127 		mutex_enter(&mi->mi_lock);
4128 		kstat_runq_exit(KSTAT_IO_PTR(mi->mi_io_kstats));
4129 		mutex_exit(&mi->mi_lock);
4130 	}
4131 
4132 	if (error)
4133 		goto err;
4134 
4135 	nfs3_cache_post_op_vattr(vp, &res.dir_attributes, t, cr);
4136 
4137 	error = geterrno3(res.status);
4138 	if (error) {
4139 		PURGE_STALE_FH(error, vp, cr);
4140 		goto err;
4141 	}
4142 
4143 	if (mi->mi_io_kstats) {
4144 		mutex_enter(&mi->mi_lock);
4145 		KSTAT_IO_PTR(mi->mi_io_kstats)->reads++;
4146 		KSTAT_IO_PTR(mi->mi_io_kstats)->nread += res.size;
4147 		mutex_exit(&mi->mi_lock);
4148 	}
4149 
4150 	rdc->nfs3_ncookie = res.loff;
4151 	rp->r_cookieverf = res.cookieverf;
4152 	rdc->eof = res.eof ? 1 : 0;
4153 	rdc->entlen = res.size;
4154 	ASSERT(rdc->entlen <= rdc->buflen);
4155 	rdc->error = 0;
4156 	return;
4157 
4158 err:
4159 	kmem_free(rdc->entries, rdc->buflen);
4160 	rdc->entries = NULL;
4161 	rdc->error = error;
4162 }
4163 
4164 /*
4165  * Read directory entries.
4166  * There are some weird things to look out for here.  The uio_loffset
4167  * field is either 0 or it is the offset returned from a previous
4168  * readdir.  It is an opaque value used by the server to find the
4169  * correct directory block to read. The count field is the number
4170  * of blocks to read on the server.  This is advisory only, the server
4171  * may return only one block's worth of entries.  Entries may be compressed
4172  * on the server.
4173  */
4174 static void
4175 nfs3readdirplus(vnode_t *vp, rddir_cache *rdc, cred_t *cr)
4176 {
4177 	int error;
4178 	READDIRPLUS3args args;
4179 	READDIRPLUS3vres res;
4180 	vattr_t dva;
4181 	rnode_t *rp;
4182 	mntinfo_t *mi;
4183 	int douprintf;
4184 	failinfo_t fi, *fip = NULL;
4185 
4186 	rp = VTOR(vp);
4187 	mi = VTOMI(vp);
4188 	ASSERT(nfs_zone() == mi->mi_zone);
4189 
4190 	args.dir = *RTOFH3(rp);
4191 	args.cookie = (cookie3)rdc->nfs3_cookie;
4192 	args.cookieverf = rp->r_cookieverf;
4193 	args.dircount = rdc->buflen;
4194 	args.maxcount = mi->mi_tsize;
4195 
4196 	/*
4197 	 * NFS client failover support
4198 	 * suppress failover unless we have a zero cookie
4199 	 */
4200 	if (args.cookie == (cookie3)0) {
4201 		fi.vp = vp;
4202 		fi.fhp = (caddr_t)&args.dir;
4203 		fi.copyproc = nfs3copyfh;
4204 		fi.lookupproc = nfs3lookup;
4205 		fi.xattrdirproc = acl_getxattrdir3;
4206 		fip = &fi;
4207 	}
4208 
4209 #ifdef DEBUG
4210 	rdc->entries = rddir_cache_buf_alloc(rdc->buflen, KM_SLEEP);
4211 #else
4212 	rdc->entries = kmem_alloc(rdc->buflen, KM_SLEEP);
4213 #endif
4214 
4215 	res.entries = (dirent64_t *)rdc->entries;
4216 	res.entries_size = rdc->buflen;
4217 	res.dir_attributes.fres.vap = &dva;
4218 	res.dir_attributes.fres.vp = vp;
4219 	res.loff = rdc->nfs3_cookie;
4220 	res.credentials = cr;
4221 
4222 	douprintf = 1;
4223 
4224 	if (mi->mi_io_kstats) {
4225 		mutex_enter(&mi->mi_lock);
4226 		kstat_runq_enter(KSTAT_IO_PTR(mi->mi_io_kstats));
4227 		mutex_exit(&mi->mi_lock);
4228 	}
4229 
4230 	res.time = gethrtime();
4231 
4232 	error = rfs3call(mi, NFSPROC3_READDIRPLUS,
4233 	    xdr_READDIRPLUS3args, (caddr_t)&args,
4234 	    xdr_READDIRPLUS3vres, (caddr_t)&res, cr,
4235 	    &douprintf, &res.status, 0, fip);
4236 
4237 	if (mi->mi_io_kstats) {
4238 		mutex_enter(&mi->mi_lock);
4239 		kstat_runq_exit(KSTAT_IO_PTR(mi->mi_io_kstats));
4240 		mutex_exit(&mi->mi_lock);
4241 	}
4242 
4243 	if (error) {
4244 		goto err;
4245 	}
4246 
4247 	nfs3_cache_post_op_vattr(vp, &res.dir_attributes, res.time, cr);
4248 
4249 	error = geterrno3(res.status);
4250 	if (error) {
4251 		PURGE_STALE_FH(error, vp, cr);
4252 		if (error == EOPNOTSUPP) {
4253 			mutex_enter(&mi->mi_lock);
4254 			mi->mi_flags |= MI_READDIRONLY;
4255 			mutex_exit(&mi->mi_lock);
4256 		}
4257 		goto err;
4258 	}
4259 
4260 	if (mi->mi_io_kstats) {
4261 		mutex_enter(&mi->mi_lock);
4262 		KSTAT_IO_PTR(mi->mi_io_kstats)->reads++;
4263 		KSTAT_IO_PTR(mi->mi_io_kstats)->nread += res.size;
4264 		mutex_exit(&mi->mi_lock);
4265 	}
4266 
4267 	rdc->nfs3_ncookie = res.loff;
4268 	rp->r_cookieverf = res.cookieverf;
4269 	rdc->eof = res.eof ? 1 : 0;
4270 	rdc->entlen = res.size;
4271 	ASSERT(rdc->entlen <= rdc->buflen);
4272 	rdc->error = 0;
4273 
4274 	return;
4275 
4276 err:
4277 	kmem_free(rdc->entries, rdc->buflen);
4278 	rdc->entries = NULL;
4279 	rdc->error = error;
4280 }
4281 
4282 #ifdef DEBUG
4283 static int nfs3_bio_do_stop = 0;
4284 #endif
4285 
4286 static int
4287 nfs3_bio(struct buf *bp, stable_how *stab_comm, cred_t *cr)
4288 {
4289 	rnode_t *rp = VTOR(bp->b_vp);
4290 	int count;
4291 	int error;
4292 	cred_t *cred;
4293 	offset_t offset;
4294 
4295 	ASSERT(nfs_zone() == VTOMI(bp->b_vp)->mi_zone);
4296 	offset = ldbtob(bp->b_lblkno);
4297 
4298 	DTRACE_IO1(start, struct buf *, bp);
4299 
4300 	if (bp->b_flags & B_READ) {
4301 		mutex_enter(&rp->r_statelock);
4302 		if (rp->r_cred != NULL) {
4303 			cred = rp->r_cred;
4304 			crhold(cred);
4305 		} else {
4306 			rp->r_cred = cr;
4307 			crhold(cr);
4308 			cred = cr;
4309 			crhold(cred);
4310 		}
4311 		mutex_exit(&rp->r_statelock);
4312 	read_again:
4313 		error = bp->b_error = nfs3read(bp->b_vp, bp->b_un.b_addr,
4314 		    offset, bp->b_bcount, &bp->b_resid, cred);
4315 		crfree(cred);
4316 		if (!error) {
4317 			if (bp->b_resid) {
4318 				/*
4319 				 * Didn't get it all because we hit EOF,
4320 				 * zero all the memory beyond the EOF.
4321 				 */
4322 				/* bzero(rdaddr + */
4323 				bzero(bp->b_un.b_addr +
4324 				    bp->b_bcount - bp->b_resid, bp->b_resid);
4325 			}
4326 			mutex_enter(&rp->r_statelock);
4327 			if (bp->b_resid == bp->b_bcount &&
4328 			    offset >= rp->r_size) {
4329 				/*
4330 				 * We didn't read anything at all as we are
4331 				 * past EOF.  Return an error indicator back
4332 				 * but don't destroy the pages (yet).
4333 				 */
4334 				error = NFS_EOF;
4335 			}
4336 			mutex_exit(&rp->r_statelock);
4337 		} else if (error == EACCES) {
4338 			mutex_enter(&rp->r_statelock);
4339 			if (cred != cr) {
4340 				if (rp->r_cred != NULL)
4341 					crfree(rp->r_cred);
4342 				rp->r_cred = cr;
4343 				crhold(cr);
4344 				cred = cr;
4345 				crhold(cred);
4346 				mutex_exit(&rp->r_statelock);
4347 				goto read_again;
4348 			}
4349 			mutex_exit(&rp->r_statelock);
4350 		}
4351 	} else {
4352 		if (!(rp->r_flags & RSTALE)) {
4353 			mutex_enter(&rp->r_statelock);
4354 			if (rp->r_cred != NULL) {
4355 				cred = rp->r_cred;
4356 				crhold(cred);
4357 			} else {
4358 				rp->r_cred = cr;
4359 				crhold(cr);
4360 				cred = cr;
4361 				crhold(cred);
4362 			}
4363 			mutex_exit(&rp->r_statelock);
4364 		write_again:
4365 			mutex_enter(&rp->r_statelock);
4366 			count = MIN(bp->b_bcount, rp->r_size - offset);
4367 			mutex_exit(&rp->r_statelock);
4368 			if (count < 0)
4369 				cmn_err(CE_PANIC, "nfs3_bio: write count < 0");
4370 #ifdef DEBUG
4371 			if (count == 0) {
4372 				zcmn_err(getzoneid(), CE_WARN,
4373 				    "nfs3_bio: zero length write at %lld",
4374 				    offset);
4375 				nfs_printfhandle(&rp->r_fh);
4376 				if (nfs3_bio_do_stop)
4377 					debug_enter("nfs3_bio");
4378 			}
4379 #endif
4380 			error = nfs3write(bp->b_vp, bp->b_un.b_addr, offset,
4381 			    count, cred, stab_comm);
4382 			if (error == EACCES) {
4383 				mutex_enter(&rp->r_statelock);
4384 				if (cred != cr) {
4385 					if (rp->r_cred != NULL)
4386 						crfree(rp->r_cred);
4387 					rp->r_cred = cr;
4388 					crhold(cr);
4389 					crfree(cred);
4390 					cred = cr;
4391 					crhold(cred);
4392 					mutex_exit(&rp->r_statelock);
4393 					goto write_again;
4394 				}
4395 				mutex_exit(&rp->r_statelock);
4396 			}
4397 			bp->b_error = error;
4398 			if (error && error != EINTR) {
4399 				/*
4400 				 * Don't print EDQUOT errors on the console.
4401 				 * Don't print asynchronous EACCES errors.
4402 				 * Don't print EFBIG errors.
4403 				 * Print all other write errors.
4404 				 */
4405 				if (error != EDQUOT && error != EFBIG &&
4406 				    (error != EACCES ||
4407 				    !(bp->b_flags & B_ASYNC)))
4408 					nfs_write_error(bp->b_vp, error, cred);
4409 				/*
4410 				 * Update r_error and r_flags as appropriate.
4411 				 * If the error was ESTALE, then mark the
4412 				 * rnode as not being writeable and save
4413 				 * the error status.  Otherwise, save any
4414 				 * errors which occur from asynchronous
4415 				 * page invalidations.  Any errors occurring
4416 				 * from other operations should be saved
4417 				 * by the caller.
4418 				 */
4419 				mutex_enter(&rp->r_statelock);
4420 				if (error == ESTALE) {
4421 					rp->r_flags |= RSTALE;
4422 					if (!rp->r_error)
4423 						rp->r_error = error;
4424 				} else if (!rp->r_error &&
4425 				    (bp->b_flags &
4426 				    (B_INVAL|B_FORCE|B_ASYNC)) ==
4427 				    (B_INVAL|B_FORCE|B_ASYNC)) {
4428 					rp->r_error = error;
4429 				}
4430 				mutex_exit(&rp->r_statelock);
4431 			}
4432 			crfree(cred);
4433 		} else {
4434 			error = rp->r_error;
4435 			/*
4436 			 * A close may have cleared r_error, if so,
4437 			 * propagate ESTALE error return properly
4438 			 */
4439 			if (error == 0)
4440 				error = ESTALE;
4441 		}
4442 	}
4443 
4444 	if (error != 0 && error != NFS_EOF)
4445 		bp->b_flags |= B_ERROR;
4446 
4447 	DTRACE_IO1(done, struct buf *, bp);
4448 
4449 	return (error);
4450 }
4451 
4452 /* ARGSUSED */
4453 static int
4454 nfs3_fid(vnode_t *vp, fid_t *fidp, caller_context_t *ct)
4455 {
4456 	rnode_t *rp;
4457 
4458 	if (nfs_zone() != VTOMI(vp)->mi_zone)
4459 		return (EIO);
4460 	rp = VTOR(vp);
4461 
4462 	if (fidp->fid_len < (ushort_t)rp->r_fh.fh_len) {
4463 		fidp->fid_len = rp->r_fh.fh_len;
4464 		return (ENOSPC);
4465 	}
4466 	fidp->fid_len = rp->r_fh.fh_len;
4467 	bcopy(rp->r_fh.fh_buf, fidp->fid_data, fidp->fid_len);
4468 	return (0);
4469 }
4470 
4471 /* ARGSUSED2 */
4472 static int
4473 nfs3_rwlock(vnode_t *vp, int write_lock, caller_context_t *ctp)
4474 {
4475 	rnode_t *rp = VTOR(vp);
4476 
4477 	if (!write_lock) {
4478 		(void) nfs_rw_enter_sig(&rp->r_rwlock, RW_READER, FALSE);
4479 		return (V_WRITELOCK_FALSE);
4480 	}
4481 
4482 	if ((rp->r_flags & RDIRECTIO) || (VTOMI(vp)->mi_flags & MI_DIRECTIO)) {
4483 		(void) nfs_rw_enter_sig(&rp->r_rwlock, RW_READER, FALSE);
4484 		if (rp->r_mapcnt == 0 && !vn_has_cached_data(vp))
4485 			return (V_WRITELOCK_FALSE);
4486 		nfs_rw_exit(&rp->r_rwlock);
4487 	}
4488 
4489 	(void) nfs_rw_enter_sig(&rp->r_rwlock, RW_WRITER, FALSE);
4490 	return (V_WRITELOCK_TRUE);
4491 }
4492 
4493 /* ARGSUSED */
4494 static void
4495 nfs3_rwunlock(vnode_t *vp, int write_lock, caller_context_t *ctp)
4496 {
4497 	rnode_t *rp = VTOR(vp);
4498 
4499 	nfs_rw_exit(&rp->r_rwlock);
4500 }
4501 
4502 /* ARGSUSED */
4503 static int
4504 nfs3_seek(vnode_t *vp, offset_t ooff, offset_t *noffp, caller_context_t *ct)
4505 {
4506 
4507 	/*
4508 	 * Because we stuff the readdir cookie into the offset field
4509 	 * someone may attempt to do an lseek with the cookie which
4510 	 * we want to succeed.
4511 	 */
4512 	if (vp->v_type == VDIR)
4513 		return (0);
4514 	if (*noffp < 0)
4515 		return (EINVAL);
4516 	return (0);
4517 }
4518 
4519 /*
4520  * number of nfs3_bsize blocks to read ahead.
4521  */
4522 static int nfs3_nra = 4;
4523 
4524 #ifdef DEBUG
4525 static int nfs3_lostpage = 0;	/* number of times we lost original page */
4526 #endif
4527 
4528 /*
4529  * Return all the pages from [off..off+len) in file
4530  */
4531 /* ARGSUSED */
4532 static int
4533 nfs3_getpage(vnode_t *vp, offset_t off, size_t len, uint_t *protp,
4534     page_t *pl[], size_t plsz, struct seg *seg, caddr_t addr,
4535     enum seg_rw rw, cred_t *cr, caller_context_t *ct)
4536 {
4537 	rnode_t *rp;
4538 	int error;
4539 	mntinfo_t *mi;
4540 
4541 	if (vp->v_flag & VNOMAP)
4542 		return (ENOSYS);
4543 
4544 	if (nfs_zone() != VTOMI(vp)->mi_zone)
4545 		return (EIO);
4546 	if (protp != NULL)
4547 		*protp = PROT_ALL;
4548 
4549 	/*
4550 	 * Now valididate that the caches are up to date.
4551 	 */
4552 	error = nfs3_validate_caches(vp, cr);
4553 	if (error)
4554 		return (error);
4555 
4556 	rp = VTOR(vp);
4557 	mi = VTOMI(vp);
4558 retry:
4559 	mutex_enter(&rp->r_statelock);
4560 
4561 	/*
4562 	 * Don't create dirty pages faster than they
4563 	 * can be cleaned so that the system doesn't
4564 	 * get imbalanced.  If the async queue is
4565 	 * maxed out, then wait for it to drain before
4566 	 * creating more dirty pages.  Also, wait for
4567 	 * any threads doing pagewalks in the vop_getattr
4568 	 * entry points so that they don't block for
4569 	 * long periods.
4570 	 */
4571 	if (rw == S_CREATE) {
4572 		while ((mi->mi_max_threads != 0 &&
4573 		    rp->r_awcount > 2 * mi->mi_max_threads) ||
4574 		    rp->r_gcount > 0)
4575 			cv_wait(&rp->r_cv, &rp->r_statelock);
4576 	}
4577 
4578 	/*
4579 	 * If we are getting called as a side effect of an nfs_write()
4580 	 * operation the local file size might not be extended yet.
4581 	 * In this case we want to be able to return pages of zeroes.
4582 	 */
4583 	if (off + len > rp->r_size + PAGEOFFSET && seg != segkmap) {
4584 		mutex_exit(&rp->r_statelock);
4585 		return (EFAULT);		/* beyond EOF */
4586 	}
4587 
4588 	mutex_exit(&rp->r_statelock);
4589 
4590 	error = pvn_getpages(nfs3_getapage, vp, off, len, protp,
4591 	    pl, plsz, seg, addr, rw, cr);
4592 
4593 	switch (error) {
4594 	case NFS_EOF:
4595 		nfs_purge_caches(vp, NFS_NOPURGE_DNLC, cr);
4596 		goto retry;
4597 	case ESTALE:
4598 		PURGE_STALE_FH(error, vp, cr);
4599 	}
4600 
4601 	return (error);
4602 }
4603 
4604 /*
4605  * Called from pvn_getpages to get a particular page.
4606  */
4607 /* ARGSUSED */
4608 static int
4609 nfs3_getapage(vnode_t *vp, u_offset_t off, size_t len, uint_t *protp,
4610     page_t *pl[], size_t plsz, struct seg *seg, caddr_t addr,
4611     enum seg_rw rw, cred_t *cr)
4612 {
4613 	rnode_t *rp;
4614 	uint_t bsize;
4615 	struct buf *bp;
4616 	page_t *pp;
4617 	u_offset_t lbn;
4618 	u_offset_t io_off;
4619 	u_offset_t blkoff;
4620 	u_offset_t rablkoff;
4621 	size_t io_len;
4622 	uint_t blksize;
4623 	int error;
4624 	int readahead;
4625 	int readahead_issued = 0;
4626 	int ra_window; /* readahead window */
4627 	page_t *pagefound;
4628 	page_t *savepp;
4629 
4630 	if (nfs_zone() != VTOMI(vp)->mi_zone)
4631 		return (EIO);
4632 	rp = VTOR(vp);
4633 	bsize = MAX(vp->v_vfsp->vfs_bsize, PAGESIZE);
4634 
4635 reread:
4636 	bp = NULL;
4637 	pp = NULL;
4638 	pagefound = NULL;
4639 
4640 	if (pl != NULL)
4641 		pl[0] = NULL;
4642 
4643 	error = 0;
4644 	lbn = off / bsize;
4645 	blkoff = lbn * bsize;
4646 
4647 	/*
4648 	 * Queueing up the readahead before doing the synchronous read
4649 	 * results in a significant increase in read throughput because
4650 	 * of the increased parallelism between the async threads and
4651 	 * the process context.
4652 	 */
4653 	if ((off & ((vp->v_vfsp->vfs_bsize) - 1)) == 0 &&
4654 	    rw != S_CREATE &&
4655 	    !(vp->v_flag & VNOCACHE)) {
4656 		mutex_enter(&rp->r_statelock);
4657 
4658 		/*
4659 		 * Calculate the number of readaheads to do.
4660 		 * a) No readaheads at offset = 0.
4661 		 * b) Do maximum(nfs3_nra) readaheads when the readahead
4662 		 *    window is closed.
4663 		 * c) Do readaheads between 1 to (nfs3_nra - 1) depending
4664 		 *    upon how far the readahead window is open or close.
4665 		 * d) No readaheads if rp->r_nextr is not within the scope
4666 		 *    of the readahead window (random i/o).
4667 		 */
4668 
4669 		if (off == 0)
4670 			readahead = 0;
4671 		else if (blkoff == rp->r_nextr)
4672 			readahead = nfs3_nra;
4673 		else if (rp->r_nextr > blkoff &&
4674 		    ((ra_window = (rp->r_nextr - blkoff) / bsize)
4675 		    <= (nfs3_nra - 1)))
4676 			readahead = nfs3_nra - ra_window;
4677 		else
4678 			readahead = 0;
4679 
4680 		rablkoff = rp->r_nextr;
4681 		while (readahead > 0 && rablkoff + bsize < rp->r_size) {
4682 			mutex_exit(&rp->r_statelock);
4683 			if (nfs_async_readahead(vp, rablkoff + bsize,
4684 			    addr + (rablkoff + bsize - off), seg, cr,
4685 			    nfs3_readahead) < 0) {
4686 				mutex_enter(&rp->r_statelock);
4687 				break;
4688 			}
4689 			readahead--;
4690 			rablkoff += bsize;
4691 			/*
4692 			 * Indicate that we did a readahead so
4693 			 * readahead offset is not updated
4694 			 * by the synchronous read below.
4695 			 */
4696 			readahead_issued = 1;
4697 			mutex_enter(&rp->r_statelock);
4698 			/*
4699 			 * set readahead offset to
4700 			 * offset of last async readahead
4701 			 * request.
4702 			 */
4703 			rp->r_nextr = rablkoff;
4704 		}
4705 		mutex_exit(&rp->r_statelock);
4706 	}
4707 
4708 again:
4709 	if ((pagefound = page_exists(vp, off)) == NULL) {
4710 		if (pl == NULL) {
4711 			(void) nfs_async_readahead(vp, blkoff, addr, seg, cr,
4712 			    nfs3_readahead);
4713 		} else if (rw == S_CREATE) {
4714 			/*
4715 			 * Block for this page is not allocated, or the offset
4716 			 * is beyond the current allocation size, or we're
4717 			 * allocating a swap slot and the page was not found,
4718 			 * so allocate it and return a zero page.
4719 			 */
4720 			if ((pp = page_create_va(vp, off,
4721 			    PAGESIZE, PG_WAIT, seg, addr)) == NULL)
4722 				cmn_err(CE_PANIC, "nfs3_getapage: page_create");
4723 			io_len = PAGESIZE;
4724 			mutex_enter(&rp->r_statelock);
4725 			rp->r_nextr = off + PAGESIZE;
4726 			mutex_exit(&rp->r_statelock);
4727 		} else {
4728 			/*
4729 			 * Need to go to server to get a BLOCK, exception to
4730 			 * that being while reading at offset = 0 or doing
4731 			 * random i/o, in that case read only a PAGE.
4732 			 */
4733 			mutex_enter(&rp->r_statelock);
4734 			if (blkoff < rp->r_size &&
4735 			    blkoff + bsize >= rp->r_size) {
4736 				/*
4737 				 * If only a block or less is left in
4738 				 * the file, read all that is remaining.
4739 				 */
4740 				if (rp->r_size <= off) {
4741 					/*
4742 					 * Trying to access beyond EOF,
4743 					 * set up to get at least one page.
4744 					 */
4745 					blksize = off + PAGESIZE - blkoff;
4746 				} else
4747 					blksize = rp->r_size - blkoff;
4748 			} else if ((off == 0) ||
4749 			    (off != rp->r_nextr && !readahead_issued)) {
4750 				blksize = PAGESIZE;
4751 				blkoff = off; /* block = page here */
4752 			} else
4753 				blksize = bsize;
4754 			mutex_exit(&rp->r_statelock);
4755 
4756 			pp = pvn_read_kluster(vp, off, seg, addr, &io_off,
4757 			    &io_len, blkoff, blksize, 0);
4758 
4759 			/*
4760 			 * Some other thread has entered the page,
4761 			 * so just use it.
4762 			 */
4763 			if (pp == NULL)
4764 				goto again;
4765 
4766 			/*
4767 			 * Now round the request size up to page boundaries.
4768 			 * This ensures that the entire page will be
4769 			 * initialized to zeroes if EOF is encountered.
4770 			 */
4771 			io_len = ptob(btopr(io_len));
4772 
4773 			bp = pageio_setup(pp, io_len, vp, B_READ);
4774 			ASSERT(bp != NULL);
4775 
4776 			/*
4777 			 * pageio_setup should have set b_addr to 0.  This
4778 			 * is correct since we want to do I/O on a page
4779 			 * boundary.  bp_mapin will use this addr to calculate
4780 			 * an offset, and then set b_addr to the kernel virtual
4781 			 * address it allocated for us.
4782 			 */
4783 			ASSERT(bp->b_un.b_addr == 0);
4784 
4785 			bp->b_edev = 0;
4786 			bp->b_dev = 0;
4787 			bp->b_lblkno = lbtodb(io_off);
4788 			bp->b_file = vp;
4789 			bp->b_offset = (offset_t)off;
4790 			bp_mapin(bp);
4791 
4792 			/*
4793 			 * If doing a write beyond what we believe is EOF,
4794 			 * don't bother trying to read the pages from the
4795 			 * server, we'll just zero the pages here.  We
4796 			 * don't check that the rw flag is S_WRITE here
4797 			 * because some implementations may attempt a
4798 			 * read access to the buffer before copying data.
4799 			 */
4800 			mutex_enter(&rp->r_statelock);
4801 			if (io_off >= rp->r_size && seg == segkmap) {
4802 				mutex_exit(&rp->r_statelock);
4803 				bzero(bp->b_un.b_addr, io_len);
4804 			} else {
4805 				mutex_exit(&rp->r_statelock);
4806 				error = nfs3_bio(bp, NULL, cr);
4807 			}
4808 
4809 			/*
4810 			 * Unmap the buffer before freeing it.
4811 			 */
4812 			bp_mapout(bp);
4813 			pageio_done(bp);
4814 
4815 			savepp = pp;
4816 			do {
4817 				pp->p_fsdata = C_NOCOMMIT;
4818 			} while ((pp = pp->p_next) != savepp);
4819 
4820 			if (error == NFS_EOF) {
4821 				/*
4822 				 * If doing a write system call just return
4823 				 * zeroed pages, else user tried to get pages
4824 				 * beyond EOF, return error.  We don't check
4825 				 * that the rw flag is S_WRITE here because
4826 				 * some implementations may attempt a read
4827 				 * access to the buffer before copying data.
4828 				 */
4829 				if (seg == segkmap)
4830 					error = 0;
4831 				else
4832 					error = EFAULT;
4833 			}
4834 
4835 			if (!readahead_issued && !error) {
4836 				mutex_enter(&rp->r_statelock);
4837 				rp->r_nextr = io_off + io_len;
4838 				mutex_exit(&rp->r_statelock);
4839 			}
4840 		}
4841 	}
4842 
4843 out:
4844 	if (pl == NULL)
4845 		return (error);
4846 
4847 	if (error) {
4848 		if (pp != NULL)
4849 			pvn_read_done(pp, B_ERROR);
4850 		return (error);
4851 	}
4852 
4853 	if (pagefound) {
4854 		se_t se = (rw == S_CREATE ? SE_EXCL : SE_SHARED);
4855 
4856 		/*
4857 		 * Page exists in the cache, acquire the appropriate lock.
4858 		 * If this fails, start all over again.
4859 		 */
4860 		if ((pp = page_lookup(vp, off, se)) == NULL) {
4861 #ifdef DEBUG
4862 			nfs3_lostpage++;
4863 #endif
4864 			goto reread;
4865 		}
4866 		pl[0] = pp;
4867 		pl[1] = NULL;
4868 		return (0);
4869 	}
4870 
4871 	if (pp != NULL)
4872 		pvn_plist_init(pp, pl, plsz, off, io_len, rw);
4873 
4874 	return (error);
4875 }
4876 
4877 static void
4878 nfs3_readahead(vnode_t *vp, u_offset_t blkoff, caddr_t addr, struct seg *seg,
4879     cred_t *cr)
4880 {
4881 	int error;
4882 	page_t *pp;
4883 	u_offset_t io_off;
4884 	size_t io_len;
4885 	struct buf *bp;
4886 	uint_t bsize, blksize;
4887 	rnode_t *rp = VTOR(vp);
4888 	page_t *savepp;
4889 
4890 	ASSERT(nfs_zone() == VTOMI(vp)->mi_zone);
4891 	bsize = MAX(vp->v_vfsp->vfs_bsize, PAGESIZE);
4892 
4893 	mutex_enter(&rp->r_statelock);
4894 	if (blkoff < rp->r_size && blkoff + bsize > rp->r_size) {
4895 		/*
4896 		 * If less than a block left in file read less
4897 		 * than a block.
4898 		 */
4899 		blksize = rp->r_size - blkoff;
4900 	} else
4901 		blksize = bsize;
4902 	mutex_exit(&rp->r_statelock);
4903 
4904 	pp = pvn_read_kluster(vp, blkoff, segkmap, addr,
4905 	    &io_off, &io_len, blkoff, blksize, 1);
4906 	/*
4907 	 * The isra flag passed to the kluster function is 1, we may have
4908 	 * gotten a return value of NULL for a variety of reasons (# of free
4909 	 * pages < minfree, someone entered the page on the vnode etc). In all
4910 	 * cases, we want to punt on the readahead.
4911 	 */
4912 	if (pp == NULL)
4913 		return;
4914 
4915 	/*
4916 	 * Now round the request size up to page boundaries.
4917 	 * This ensures that the entire page will be
4918 	 * initialized to zeroes if EOF is encountered.
4919 	 */
4920 	io_len = ptob(btopr(io_len));
4921 
4922 	bp = pageio_setup(pp, io_len, vp, B_READ);
4923 	ASSERT(bp != NULL);
4924 
4925 	/*
4926 	 * pageio_setup should have set b_addr to 0.  This is correct since
4927 	 * we want to do I/O on a page boundary. bp_mapin() will use this addr
4928 	 * to calculate an offset, and then set b_addr to the kernel virtual
4929 	 * address it allocated for us.
4930 	 */
4931 	ASSERT(bp->b_un.b_addr == 0);
4932 
4933 	bp->b_edev = 0;
4934 	bp->b_dev = 0;
4935 	bp->b_lblkno = lbtodb(io_off);
4936 	bp->b_file = vp;
4937 	bp->b_offset = (offset_t)blkoff;
4938 	bp_mapin(bp);
4939 
4940 	/*
4941 	 * If doing a write beyond what we believe is EOF, don't bother trying
4942 	 * to read the pages from the server, we'll just zero the pages here.
4943 	 * We don't check that the rw flag is S_WRITE here because some
4944 	 * implementations may attempt a read access to the buffer before
4945 	 * copying data.
4946 	 */
4947 	mutex_enter(&rp->r_statelock);
4948 	if (io_off >= rp->r_size && seg == segkmap) {
4949 		mutex_exit(&rp->r_statelock);
4950 		bzero(bp->b_un.b_addr, io_len);
4951 		error = 0;
4952 	} else {
4953 		mutex_exit(&rp->r_statelock);
4954 		error = nfs3_bio(bp, NULL, cr);
4955 		if (error == NFS_EOF)
4956 			error = 0;
4957 	}
4958 
4959 	/*
4960 	 * Unmap the buffer before freeing it.
4961 	 */
4962 	bp_mapout(bp);
4963 	pageio_done(bp);
4964 
4965 	savepp = pp;
4966 	do {
4967 		pp->p_fsdata = C_NOCOMMIT;
4968 	} while ((pp = pp->p_next) != savepp);
4969 
4970 	pvn_read_done(pp, error ? B_READ | B_ERROR : B_READ);
4971 
4972 	/*
4973 	 * In case of error set readahead offset
4974 	 * to the lowest offset.
4975 	 * pvn_read_done() calls VN_DISPOSE to destroy the pages
4976 	 */
4977 	if (error && rp->r_nextr > io_off) {
4978 		mutex_enter(&rp->r_statelock);
4979 		if (rp->r_nextr > io_off)
4980 			rp->r_nextr = io_off;
4981 		mutex_exit(&rp->r_statelock);
4982 	}
4983 }
4984 
4985 /*
4986  * Flags are composed of {B_INVAL, B_FREE, B_DONTNEED, B_FORCE}
4987  * If len == 0, do from off to EOF.
4988  *
4989  * The normal cases should be len == 0 && off == 0 (entire vp list),
4990  * len == MAXBSIZE (from segmap_release actions), and len == PAGESIZE
4991  * (from pageout).
4992  */
4993 /* ARGSUSED */
4994 static int
4995 nfs3_putpage(vnode_t *vp, offset_t off, size_t len, int flags, cred_t *cr,
4996     caller_context_t *ct)
4997 {
4998 	int error;
4999 	rnode_t *rp;
5000 
5001 	ASSERT(cr != NULL);
5002 
5003 	/*
5004 	 * XXX - Why should this check be made here?
5005 	 */
5006 	if (vp->v_flag & VNOMAP)
5007 		return (ENOSYS);
5008 	if (len == 0 && !(flags & B_INVAL) && vn_is_readonly(vp))
5009 		return (0);
5010 	if (!(flags & B_ASYNC) && nfs_zone() != VTOMI(vp)->mi_zone)
5011 		return (EIO);
5012 
5013 	rp = VTOR(vp);
5014 	mutex_enter(&rp->r_statelock);
5015 	rp->r_count++;
5016 	mutex_exit(&rp->r_statelock);
5017 	error = nfs_putpages(vp, off, len, flags, cr);
5018 	mutex_enter(&rp->r_statelock);
5019 	rp->r_count--;
5020 	cv_broadcast(&rp->r_cv);
5021 	mutex_exit(&rp->r_statelock);
5022 
5023 	return (error);
5024 }
5025 
5026 /*
5027  * Write out a single page, possibly klustering adjacent dirty pages.
5028  */
5029 int
5030 nfs3_putapage(vnode_t *vp, page_t *pp, u_offset_t *offp, size_t *lenp,
5031     int flags, cred_t *cr)
5032 {
5033 	u_offset_t io_off;
5034 	u_offset_t lbn_off;
5035 	u_offset_t lbn;
5036 	size_t io_len;
5037 	uint_t bsize;
5038 	int error;
5039 	rnode_t *rp;
5040 
5041 	ASSERT(!vn_is_readonly(vp));
5042 	ASSERT(pp != NULL);
5043 	ASSERT(cr != NULL);
5044 	ASSERT((flags & B_ASYNC) || nfs_zone() == VTOMI(vp)->mi_zone);
5045 
5046 	rp = VTOR(vp);
5047 	ASSERT(rp->r_count > 0);
5048 
5049 	bsize = MAX(vp->v_vfsp->vfs_bsize, PAGESIZE);
5050 	lbn = pp->p_offset / bsize;
5051 	lbn_off = lbn * bsize;
5052 
5053 	/*
5054 	 * Find a kluster that fits in one block, or in
5055 	 * one page if pages are bigger than blocks.  If
5056 	 * there is less file space allocated than a whole
5057 	 * page, we'll shorten the i/o request below.
5058 	 */
5059 	pp = pvn_write_kluster(vp, pp, &io_off, &io_len, lbn_off,
5060 	    roundup(bsize, PAGESIZE), flags);
5061 
5062 	/*
5063 	 * pvn_write_kluster shouldn't have returned a page with offset
5064 	 * behind the original page we were given.  Verify that.
5065 	 */
5066 	ASSERT((pp->p_offset / bsize) >= lbn);
5067 
5068 	/*
5069 	 * Now pp will have the list of kept dirty pages marked for
5070 	 * write back.  It will also handle invalidation and freeing
5071 	 * of pages that are not dirty.  Check for page length rounding
5072 	 * problems.
5073 	 */
5074 	if (io_off + io_len > lbn_off + bsize) {
5075 		ASSERT((io_off + io_len) - (lbn_off + bsize) < PAGESIZE);
5076 		io_len = lbn_off + bsize - io_off;
5077 	}
5078 	/*
5079 	 * The RMODINPROGRESS flag makes sure that nfs(3)_bio() sees a
5080 	 * consistent value of r_size. RMODINPROGRESS is set in writerp().
5081 	 * When RMODINPROGRESS is set it indicates that a uiomove() is in
5082 	 * progress and the r_size has not been made consistent with the
5083 	 * new size of the file. When the uiomove() completes the r_size is
5084 	 * updated and the RMODINPROGRESS flag is cleared.
5085 	 *
5086 	 * The RMODINPROGRESS flag makes sure that nfs(3)_bio() sees a
5087 	 * consistent value of r_size. Without this handshaking, it is
5088 	 * possible that nfs(3)_bio() picks  up the old value of r_size
5089 	 * before the uiomove() in writerp() completes. This will result
5090 	 * in the write through nfs(3)_bio() being dropped.
5091 	 *
5092 	 * More precisely, there is a window between the time the uiomove()
5093 	 * completes and the time the r_size is updated. If a VOP_PUTPAGE()
5094 	 * operation intervenes in this window, the page will be picked up,
5095 	 * because it is dirty (it will be unlocked, unless it was
5096 	 * pagecreate'd). When the page is picked up as dirty, the dirty
5097 	 * bit is reset (pvn_getdirty()). In nfs(3)write(), r_size is
5098 	 * checked. This will still be the old size. Therefore the page will
5099 	 * not be written out. When segmap_release() calls VOP_PUTPAGE(),
5100 	 * the page will be found to be clean and the write will be dropped.
5101 	 */
5102 	if (rp->r_flags & RMODINPROGRESS) {
5103 		mutex_enter(&rp->r_statelock);
5104 		if ((rp->r_flags & RMODINPROGRESS) &&
5105 		    rp->r_modaddr + MAXBSIZE > io_off &&
5106 		    rp->r_modaddr < io_off + io_len) {
5107 			page_t *plist;
5108 			/*
5109 			 * A write is in progress for this region of the file.
5110 			 * If we did not detect RMODINPROGRESS here then this
5111 			 * path through nfs_putapage() would eventually go to
5112 			 * nfs(3)_bio() and may not write out all of the data
5113 			 * in the pages. We end up losing data. So we decide
5114 			 * to set the modified bit on each page in the page
5115 			 * list and mark the rnode with RDIRTY. This write
5116 			 * will be restarted at some later time.
5117 			 */
5118 			plist = pp;
5119 			while (plist != NULL) {
5120 				pp = plist;
5121 				page_sub(&plist, pp);
5122 				hat_setmod(pp);
5123 				page_io_unlock(pp);
5124 				page_unlock(pp);
5125 			}
5126 			rp->r_flags |= RDIRTY;
5127 			mutex_exit(&rp->r_statelock);
5128 			if (offp)
5129 				*offp = io_off;
5130 			if (lenp)
5131 				*lenp = io_len;
5132 			return (0);
5133 		}
5134 		mutex_exit(&rp->r_statelock);
5135 	}
5136 
5137 	if (flags & B_ASYNC) {
5138 		error = nfs_async_putapage(vp, pp, io_off, io_len, flags, cr,
5139 		    nfs3_sync_putapage);
5140 	} else
5141 		error = nfs3_sync_putapage(vp, pp, io_off, io_len, flags, cr);
5142 
5143 	if (offp)
5144 		*offp = io_off;
5145 	if (lenp)
5146 		*lenp = io_len;
5147 	return (error);
5148 }
5149 
5150 static int
5151 nfs3_sync_putapage(vnode_t *vp, page_t *pp, u_offset_t io_off, size_t io_len,
5152     int flags, cred_t *cr)
5153 {
5154 	int error;
5155 	rnode_t *rp;
5156 
5157 	ASSERT(nfs_zone() == VTOMI(vp)->mi_zone);
5158 
5159 	flags |= B_WRITE;
5160 
5161 	error = nfs3_rdwrlbn(vp, pp, io_off, io_len, flags, cr);
5162 
5163 	rp = VTOR(vp);
5164 
5165 	if ((error == ENOSPC || error == EDQUOT || error == EFBIG ||
5166 	    error == EACCES) &&
5167 	    (flags & (B_INVAL|B_FORCE)) != (B_INVAL|B_FORCE)) {
5168 		if (!(rp->r_flags & ROUTOFSPACE)) {
5169 			mutex_enter(&rp->r_statelock);
5170 			rp->r_flags |= ROUTOFSPACE;
5171 			mutex_exit(&rp->r_statelock);
5172 		}
5173 		flags |= B_ERROR;
5174 		pvn_write_done(pp, flags);
5175 		/*
5176 		 * If this was not an async thread, then try again to
5177 		 * write out the pages, but this time, also destroy
5178 		 * them whether or not the write is successful.  This
5179 		 * will prevent memory from filling up with these
5180 		 * pages and destroying them is the only alternative
5181 		 * if they can't be written out.
5182 		 *
5183 		 * Don't do this if this is an async thread because
5184 		 * when the pages are unlocked in pvn_write_done,
5185 		 * some other thread could have come along, locked
5186 		 * them, and queued for an async thread.  It would be
5187 		 * possible for all of the async threads to be tied
5188 		 * up waiting to lock the pages again and they would
5189 		 * all already be locked and waiting for an async
5190 		 * thread to handle them.  Deadlock.
5191 		 */
5192 		if (!(flags & B_ASYNC)) {
5193 			error = nfs3_putpage(vp, io_off, io_len,
5194 			    B_INVAL | B_FORCE, cr, NULL);
5195 		}
5196 	} else {
5197 		if (error)
5198 			flags |= B_ERROR;
5199 		else if (rp->r_flags & ROUTOFSPACE) {
5200 			mutex_enter(&rp->r_statelock);
5201 			rp->r_flags &= ~ROUTOFSPACE;
5202 			mutex_exit(&rp->r_statelock);
5203 		}
5204 		pvn_write_done(pp, flags);
5205 		if (freemem < desfree)
5206 			(void) nfs3_commit_vp(vp, (u_offset_t)0, 0, cr);
5207 	}
5208 
5209 	return (error);
5210 }
5211 
5212 /* ARGSUSED */
5213 static int
5214 nfs3_map(vnode_t *vp, offset_t off, struct as *as, caddr_t *addrp,
5215     size_t len, uchar_t prot, uchar_t maxprot, uint_t flags,
5216     cred_t *cr, caller_context_t *ct)
5217 {
5218 	struct segvn_crargs vn_a;
5219 	int error;
5220 	rnode_t *rp;
5221 	struct vattr va;
5222 
5223 	if (nfs_zone() != VTOMI(vp)->mi_zone)
5224 		return (EIO);
5225 
5226 	if (vp->v_flag & VNOMAP)
5227 		return (ENOSYS);
5228 
5229 	if (off < 0 || off + len < 0)
5230 		return (ENXIO);
5231 
5232 	if (vp->v_type != VREG)
5233 		return (ENODEV);
5234 
5235 	/*
5236 	 * If there is cached data and if close-to-open consistency
5237 	 * checking is not turned off and if the file system is not
5238 	 * mounted readonly, then force an over the wire getattr.
5239 	 * Otherwise, just invoke nfs3getattr to get a copy of the
5240 	 * attributes.  The attribute cache will be used unless it
5241 	 * is timed out and if it is, then an over the wire getattr
5242 	 * will be issued.
5243 	 */
5244 	va.va_mask = AT_ALL;
5245 	if (vn_has_cached_data(vp) &&
5246 	    !(VTOMI(vp)->mi_flags & MI_NOCTO) && !vn_is_readonly(vp))
5247 		error = nfs3_getattr_otw(vp, &va, cr);
5248 	else
5249 		error = nfs3getattr(vp, &va, cr);
5250 	if (error)
5251 		return (error);
5252 
5253 	/*
5254 	 * Check to see if the vnode is currently marked as not cachable.
5255 	 * This means portions of the file are locked (through VOP_FRLOCK).
5256 	 * In this case the map request must be refused.  We use
5257 	 * rp->r_lkserlock to avoid a race with concurrent lock requests.
5258 	 */
5259 	rp = VTOR(vp);
5260 
5261 	/*
5262 	 * Atomically increment r_inmap after acquiring r_rwlock. The
5263 	 * idea here is to acquire r_rwlock to block read/write and
5264 	 * not to protect r_inmap. r_inmap will inform nfs3_read/write()
5265 	 * that we are in nfs3_map(). Now, r_rwlock is acquired in order
5266 	 * and we can prevent the deadlock that would have occurred
5267 	 * when nfs3_addmap() would have acquired it out of order.
5268 	 *
5269 	 * Since we are not protecting r_inmap by any lock, we do not
5270 	 * hold any lock when we decrement it. We atomically decrement
5271 	 * r_inmap after we release r_lkserlock.
5272 	 */
5273 
5274 	if (nfs_rw_enter_sig(&rp->r_rwlock, RW_WRITER, INTR(vp)))
5275 		return (EINTR);
5276 	atomic_inc_uint(&rp->r_inmap);
5277 	nfs_rw_exit(&rp->r_rwlock);
5278 
5279 	if (nfs_rw_enter_sig(&rp->r_lkserlock, RW_READER, INTR(vp))) {
5280 		atomic_dec_uint(&rp->r_inmap);
5281 		return (EINTR);
5282 	}
5283 
5284 	if (vp->v_flag & VNOCACHE) {
5285 		error = EAGAIN;
5286 		goto done;
5287 	}
5288 
5289 	/*
5290 	 * Don't allow concurrent locks and mapping if mandatory locking is
5291 	 * enabled.
5292 	 */
5293 	if ((flk_has_remote_locks(vp) || lm_has_sleep(vp)) &&
5294 	    MANDLOCK(vp, va.va_mode)) {
5295 		error = EAGAIN;
5296 		goto done;
5297 	}
5298 
5299 	as_rangelock(as);
5300 	error = choose_addr(as, addrp, len, off, ADDR_VACALIGN, flags);
5301 	if (error != 0) {
5302 		as_rangeunlock(as);
5303 		goto done;
5304 	}
5305 
5306 	vn_a.vp = vp;
5307 	vn_a.offset = off;
5308 	vn_a.type = (flags & MAP_TYPE);
5309 	vn_a.prot = (uchar_t)prot;
5310 	vn_a.maxprot = (uchar_t)maxprot;
5311 	vn_a.flags = (flags & ~MAP_TYPE);
5312 	vn_a.cred = cr;
5313 	vn_a.amp = NULL;
5314 	vn_a.szc = 0;
5315 	vn_a.lgrp_mem_policy_flags = 0;
5316 
5317 	error = as_map(as, *addrp, len, segvn_create, &vn_a);
5318 	as_rangeunlock(as);
5319 
5320 done:
5321 	nfs_rw_exit(&rp->r_lkserlock);
5322 	atomic_dec_uint(&rp->r_inmap);
5323 	return (error);
5324 }
5325 
5326 /* ARGSUSED */
5327 static int
5328 nfs3_addmap(vnode_t *vp, offset_t off, struct as *as, caddr_t addr,
5329     size_t len, uchar_t prot, uchar_t maxprot, uint_t flags,
5330     cred_t *cr, caller_context_t *ct)
5331 {
5332 	rnode_t *rp;
5333 
5334 	if (vp->v_flag & VNOMAP)
5335 		return (ENOSYS);
5336 	if (nfs_zone() != VTOMI(vp)->mi_zone)
5337 		return (EIO);
5338 
5339 	rp = VTOR(vp);
5340 	atomic_add_long((ulong_t *)&rp->r_mapcnt, btopr(len));
5341 
5342 	return (0);
5343 }
5344 
5345 /* ARGSUSED */
5346 static int
5347 nfs3_frlock(vnode_t *vp, int cmd, struct flock64 *bfp, int flag,
5348     offset_t offset, struct flk_callback *flk_cbp, cred_t *cr,
5349     caller_context_t *ct)
5350 {
5351 	netobj lm_fh3;
5352 	int rc;
5353 	u_offset_t start, end;
5354 	rnode_t *rp;
5355 	int error = 0, intr = INTR(vp);
5356 
5357 	if (nfs_zone() != VTOMI(vp)->mi_zone)
5358 		return (EIO);
5359 
5360 	/* check for valid cmd parameter */
5361 	switch (cmd) {
5362 	case F_FLOCK:
5363 	case F_FLOCKW:
5364 	case F_OFD_GETLK:
5365 	case F_OFD_SETLK:
5366 	case F_OFD_SETLKW:
5367 		return (EOPNOTSUPP);
5368 	case F_GETLK:
5369 	case F_SETLK:
5370 	case F_SETLKW:
5371 		break;
5372 	default:
5373 		return (EINVAL);
5374 	}
5375 
5376 	/* Verify l_type. */
5377 	switch (bfp->l_type) {
5378 	case F_RDLCK:
5379 		if (cmd != F_GETLK && !(flag & FREAD))
5380 			return (EBADF);
5381 		break;
5382 	case F_WRLCK:
5383 		if (cmd != F_GETLK && !(flag & FWRITE))
5384 			return (EBADF);
5385 		break;
5386 	case F_UNLCK:
5387 		intr = 0;
5388 		break;
5389 
5390 	default:
5391 		return (EINVAL);
5392 	}
5393 
5394 	/* check the validity of the lock range */
5395 	if (rc = flk_convert_lock_data(vp, bfp, &start, &end, offset))
5396 		return (rc);
5397 	if (rc = flk_check_lock_data(start, end, MAXEND))
5398 		return (rc);
5399 
5400 	/*
5401 	 * If the filesystem is mounted using local locking, pass the
5402 	 * request off to the local locking code.
5403 	 */
5404 	if (VTOMI(vp)->mi_flags & MI_LLOCK) {
5405 		if (cmd == F_SETLK || cmd == F_SETLKW) {
5406 			/*
5407 			 * For complete safety, we should be holding
5408 			 * r_lkserlock.  However, we can't call
5409 			 * lm_safelock and then fs_frlock while
5410 			 * holding r_lkserlock, so just invoke
5411 			 * lm_safelock and expect that this will
5412 			 * catch enough of the cases.
5413 			 */
5414 			if (!lm_safelock(vp, bfp, cr))
5415 				return (EAGAIN);
5416 		}
5417 		return (fs_frlock(vp, cmd, bfp, flag, offset, flk_cbp, cr, ct));
5418 	}
5419 
5420 	rp = VTOR(vp);
5421 
5422 	/*
5423 	 * Check whether the given lock request can proceed, given the
5424 	 * current file mappings.
5425 	 */
5426 	if (nfs_rw_enter_sig(&rp->r_lkserlock, RW_WRITER, intr))
5427 		return (EINTR);
5428 	if (cmd == F_SETLK || cmd == F_SETLKW) {
5429 		if (!lm_safelock(vp, bfp, cr)) {
5430 			rc = EAGAIN;
5431 			goto done;
5432 		}
5433 	}
5434 
5435 	/*
5436 	 * Flush the cache after waiting for async I/O to finish.  For new
5437 	 * locks, this is so that the process gets the latest bits from the
5438 	 * server.  For unlocks, this is so that other clients see the
5439 	 * latest bits once the file has been unlocked.  If currently dirty
5440 	 * pages can't be flushed, then don't allow a lock to be set.  But
5441 	 * allow unlocks to succeed, to avoid having orphan locks on the
5442 	 * server.
5443 	 */
5444 	if (cmd != F_GETLK) {
5445 		mutex_enter(&rp->r_statelock);
5446 		while (rp->r_count > 0) {
5447 			if (intr) {
5448 				klwp_t *lwp = ttolwp(curthread);
5449 
5450 				if (lwp != NULL)
5451 					lwp->lwp_nostop++;
5452 				if (cv_wait_sig(&rp->r_cv,
5453 				    &rp->r_statelock) == 0) {
5454 					if (lwp != NULL)
5455 						lwp->lwp_nostop--;
5456 					rc = EINTR;
5457 					break;
5458 				}
5459 				if (lwp != NULL)
5460 					lwp->lwp_nostop--;
5461 			} else
5462 				cv_wait(&rp->r_cv, &rp->r_statelock);
5463 		}
5464 		mutex_exit(&rp->r_statelock);
5465 		if (rc != 0)
5466 			goto done;
5467 		error = nfs3_putpage(vp, (offset_t)0, 0, B_INVAL, cr, ct);
5468 		if (error) {
5469 			if (error == ENOSPC || error == EDQUOT) {
5470 				mutex_enter(&rp->r_statelock);
5471 				if (!rp->r_error)
5472 					rp->r_error = error;
5473 				mutex_exit(&rp->r_statelock);
5474 			}
5475 			if (bfp->l_type != F_UNLCK) {
5476 				rc = ENOLCK;
5477 				goto done;
5478 			}
5479 		}
5480 	}
5481 
5482 	lm_fh3.n_len = VTOFH3(vp)->fh3_length;
5483 	lm_fh3.n_bytes = (char *)&(VTOFH3(vp)->fh3_u.data);
5484 
5485 	/*
5486 	 * Call the lock manager to do the real work of contacting
5487 	 * the server and obtaining the lock.
5488 	 */
5489 	rc = lm4_frlock(vp, cmd, bfp, flag, offset, cr, &lm_fh3, flk_cbp);
5490 
5491 	if (rc == 0)
5492 		nfs_lockcompletion(vp, cmd);
5493 
5494 done:
5495 	nfs_rw_exit(&rp->r_lkserlock);
5496 	return (rc);
5497 }
5498 
5499 /*
5500  * Free storage space associated with the specified vnode.  The portion
5501  * to be freed is specified by bfp->l_start and bfp->l_len (already
5502  * normalized to a "whence" of 0).
5503  *
5504  * This is an experimental facility whose continued existence is not
5505  * guaranteed.  Currently, we only support the special case
5506  * of l_len == 0, meaning free to end of file.
5507  */
5508 /* ARGSUSED */
5509 static int
5510 nfs3_space(vnode_t *vp, int cmd, struct flock64 *bfp, int flag,
5511     offset_t offset, cred_t *cr, caller_context_t *ct)
5512 {
5513 	int error;
5514 
5515 	ASSERT(vp->v_type == VREG);
5516 	if (cmd != F_FREESP)
5517 		return (EINVAL);
5518 	if (nfs_zone() != VTOMI(vp)->mi_zone)
5519 		return (EIO);
5520 
5521 	error = convoff(vp, bfp, 0, offset);
5522 	if (!error) {
5523 		ASSERT(bfp->l_start >= 0);
5524 		if (bfp->l_len == 0) {
5525 			struct vattr va;
5526 
5527 			/*
5528 			 * ftruncate should not change the ctime and
5529 			 * mtime if we truncate the file to its
5530 			 * previous size.
5531 			 */
5532 			va.va_mask = AT_SIZE;
5533 			error = nfs3getattr(vp, &va, cr);
5534 			if (error || va.va_size == bfp->l_start)
5535 				return (error);
5536 			va.va_mask = AT_SIZE;
5537 			va.va_size = bfp->l_start;
5538 			error = nfs3setattr(vp, &va, 0, cr);
5539 
5540 			if (error == 0 && bfp->l_start == 0)
5541 				vnevent_truncate(vp, ct);
5542 		} else
5543 			error = EINVAL;
5544 	}
5545 
5546 	return (error);
5547 }
5548 
5549 /* ARGSUSED */
5550 static int
5551 nfs3_realvp(vnode_t *vp, vnode_t **vpp, caller_context_t *ct)
5552 {
5553 
5554 	return (EINVAL);
5555 }
5556 
5557 /*
5558  * Setup and add an address space callback to do the work of the delmap call.
5559  * The callback will (and must be) deleted in the actual callback function.
5560  *
5561  * This is done in order to take care of the problem that we have with holding
5562  * the address space's a_lock for a long period of time (e.g. if the NFS server
5563  * is down).  Callbacks will be executed in the address space code while the
5564  * a_lock is not held.	Holding the address space's a_lock causes things such
5565  * as ps and fork to hang because they are trying to acquire this lock as well.
5566  */
5567 /* ARGSUSED */
5568 static int
5569 nfs3_delmap(vnode_t *vp, offset_t off, struct as *as, caddr_t addr,
5570     size_t len, uint_t prot, uint_t maxprot, uint_t flags,
5571     cred_t *cr, caller_context_t *ct)
5572 {
5573 	int			caller_found;
5574 	int			error;
5575 	rnode_t			*rp;
5576 	nfs_delmap_args_t	*dmapp;
5577 	nfs_delmapcall_t	*delmap_call;
5578 
5579 	if (vp->v_flag & VNOMAP)
5580 		return (ENOSYS);
5581 	/*
5582 	 * A process may not change zones if it has NFS pages mmap'ed
5583 	 * in, so we can't legitimately get here from the wrong zone.
5584 	 */
5585 	ASSERT(nfs_zone() == VTOMI(vp)->mi_zone);
5586 
5587 	rp = VTOR(vp);
5588 
5589 	/*
5590 	 * The way that the address space of this process deletes its mapping
5591 	 * of this file is via the following call chains:
5592 	 * - as_free()->SEGOP_UNMAP()/segvn_unmap()->VOP_DELMAP()/nfs3_delmap()
5593 	 * - as_unmap()->SEGOP_UNMAP()/segvn_unmap()->VOP_DELMAP()/nfs3_delmap()
5594 	 *
5595 	 * With the use of address space callbacks we are allowed to drop the
5596 	 * address space lock, a_lock, while executing the NFS operations that
5597 	 * need to go over the wire.  Returning EAGAIN to the caller of this
5598 	 * function is what drives the execution of the callback that we add
5599 	 * below.  The callback will be executed by the address space code
5600 	 * after dropping the a_lock.  When the callback is finished, since
5601 	 * we dropped the a_lock, it must be re-acquired and segvn_unmap()
5602 	 * is called again on the same segment to finish the rest of the work
5603 	 * that needs to happen during unmapping.
5604 	 *
5605 	 * This action of calling back into the segment driver causes
5606 	 * nfs3_delmap() to get called again, but since the callback was
5607 	 * already executed at this point, it already did the work and there
5608 	 * is nothing left for us to do.
5609 	 *
5610 	 * To Summarize:
5611 	 * - The first time nfs3_delmap is called by the current thread is when
5612 	 * we add the caller associated with this delmap to the delmap caller
5613 	 * list, add the callback, and return EAGAIN.
5614 	 * - The second time in this call chain when nfs3_delmap is called we
5615 	 * will find this caller in the delmap caller list and realize there
5616 	 * is no more work to do thus removing this caller from the list and
5617 	 * returning the error that was set in the callback execution.
5618 	 */
5619 	caller_found = nfs_find_and_delete_delmapcall(rp, &error);
5620 	if (caller_found) {
5621 		/*
5622 		 * 'error' is from the actual delmap operations.  To avoid
5623 		 * hangs, we need to handle the return of EAGAIN differently
5624 		 * since this is what drives the callback execution.
5625 		 * In this case, we don't want to return EAGAIN and do the
5626 		 * callback execution because there are none to execute.
5627 		 */
5628 		if (error == EAGAIN)
5629 			return (0);
5630 		else
5631 			return (error);
5632 	}
5633 
5634 	/* current caller was not in the list */
5635 	delmap_call = nfs_init_delmapcall();
5636 
5637 	mutex_enter(&rp->r_statelock);
5638 	list_insert_tail(&rp->r_indelmap, delmap_call);
5639 	mutex_exit(&rp->r_statelock);
5640 
5641 	dmapp = kmem_alloc(sizeof (nfs_delmap_args_t), KM_SLEEP);
5642 
5643 	dmapp->vp = vp;
5644 	dmapp->off = off;
5645 	dmapp->addr = addr;
5646 	dmapp->len = len;
5647 	dmapp->prot = prot;
5648 	dmapp->maxprot = maxprot;
5649 	dmapp->flags = flags;
5650 	dmapp->cr = cr;
5651 	dmapp->caller = delmap_call;
5652 
5653 	error = as_add_callback(as, nfs3_delmap_callback, dmapp,
5654 	    AS_UNMAP_EVENT, addr, len, KM_SLEEP);
5655 
5656 	return (error ? error : EAGAIN);
5657 }
5658 
5659 /*
5660  * Remove some pages from an mmap'd vnode.  Just update the
5661  * count of pages.  If doing close-to-open, then flush and
5662  * commit all of the pages associated with this file.
5663  * Otherwise, start an asynchronous page flush to write out
5664  * any dirty pages.  This will also associate a credential
5665  * with the rnode which can be used to write the pages.
5666  */
5667 /* ARGSUSED */
5668 static void
5669 nfs3_delmap_callback(struct as *as, void *arg, uint_t event)
5670 {
5671 	int			error;
5672 	rnode_t			*rp;
5673 	mntinfo_t		*mi;
5674 	nfs_delmap_args_t	*dmapp = (nfs_delmap_args_t *)arg;
5675 
5676 	rp = VTOR(dmapp->vp);
5677 	mi = VTOMI(dmapp->vp);
5678 
5679 	atomic_add_long((ulong_t *)&rp->r_mapcnt, -btopr(dmapp->len));
5680 	ASSERT(rp->r_mapcnt >= 0);
5681 
5682 	/*
5683 	 * Initiate a page flush and potential commit if there are
5684 	 * pages, the file system was not mounted readonly, the segment
5685 	 * was mapped shared, and the pages themselves were writeable.
5686 	 */
5687 	if (vn_has_cached_data(dmapp->vp) && !vn_is_readonly(dmapp->vp) &&
5688 	    dmapp->flags == MAP_SHARED && (dmapp->maxprot & PROT_WRITE)) {
5689 		mutex_enter(&rp->r_statelock);
5690 		rp->r_flags |= RDIRTY;
5691 		mutex_exit(&rp->r_statelock);
5692 		/*
5693 		 * If this is a cross-zone access a sync putpage won't work, so
5694 		 * the best we can do is try an async putpage.  That seems
5695 		 * better than something more draconian such as discarding the
5696 		 * dirty pages.
5697 		 */
5698 		if ((mi->mi_flags & MI_NOCTO) ||
5699 		    nfs_zone() != mi->mi_zone)
5700 			error = nfs3_putpage(dmapp->vp, dmapp->off, dmapp->len,
5701 			    B_ASYNC, dmapp->cr, NULL);
5702 		else
5703 			error = nfs3_putpage_commit(dmapp->vp, dmapp->off,
5704 			    dmapp->len, dmapp->cr);
5705 		if (!error) {
5706 			mutex_enter(&rp->r_statelock);
5707 			error = rp->r_error;
5708 			rp->r_error = 0;
5709 			mutex_exit(&rp->r_statelock);
5710 		}
5711 	} else
5712 		error = 0;
5713 
5714 	if ((rp->r_flags & RDIRECTIO) || (mi->mi_flags & MI_DIRECTIO))
5715 		(void) nfs3_putpage(dmapp->vp, dmapp->off, dmapp->len,
5716 		    B_INVAL, dmapp->cr, NULL);
5717 
5718 	dmapp->caller->error = error;
5719 	(void) as_delete_callback(as, arg);
5720 	kmem_free(dmapp, sizeof (nfs_delmap_args_t));
5721 }
5722 
5723 static int nfs3_pathconf_disable_cache = 0;
5724 
5725 #ifdef DEBUG
5726 static int nfs3_pathconf_cache_hits = 0;
5727 static int nfs3_pathconf_cache_misses = 0;
5728 #endif
5729 
5730 /* ARGSUSED */
5731 static int
5732 nfs3_pathconf(vnode_t *vp, int cmd, ulong_t *valp, cred_t *cr,
5733     caller_context_t *ct)
5734 {
5735 	int error;
5736 	PATHCONF3args args;
5737 	PATHCONF3res res;
5738 	int douprintf;
5739 	failinfo_t fi;
5740 	rnode_t *rp;
5741 	hrtime_t t;
5742 
5743 	if (nfs_zone() != VTOMI(vp)->mi_zone)
5744 		return (EIO);
5745 	/*
5746 	 * Large file spec - need to base answer on info stored
5747 	 * on original FSINFO response.
5748 	 */
5749 	if (cmd == _PC_FILESIZEBITS) {
5750 		unsigned long long ll;
5751 		long l = 1;
5752 
5753 		ll = VTOMI(vp)->mi_maxfilesize;
5754 
5755 		if (ll == 0) {
5756 			*valp = 0;
5757 			return (0);
5758 		}
5759 
5760 		if (ll & 0xffffffff00000000) {
5761 			l += 32; ll >>= 32;
5762 		}
5763 		if (ll & 0xffff0000) {
5764 			l += 16; ll >>= 16;
5765 		}
5766 		if (ll & 0xff00) {
5767 			l += 8; ll >>= 8;
5768 		}
5769 		if (ll & 0xf0) {
5770 			l += 4; ll >>= 4;
5771 		}
5772 		if (ll & 0xc) {
5773 			l += 2; ll >>= 2;
5774 		}
5775 		if (ll & 0x2)
5776 			l += 2;
5777 		else if (ll & 0x1)
5778 			l += 1;
5779 		*valp = l;
5780 		return (0);
5781 	}
5782 
5783 	if (cmd == _PC_ACL_ENABLED) {
5784 		*valp = _ACL_ACLENT_ENABLED;
5785 		return (0);
5786 	}
5787 
5788 	if (cmd == _PC_XATTR_EXISTS) {
5789 		error = 0;
5790 		*valp = 0;
5791 		if (vp->v_vfsp->vfs_flag & VFS_XATTR) {
5792 			vnode_t *avp;
5793 			rnode_t *rp;
5794 			int error = 0;
5795 			mntinfo_t *mi = VTOMI(vp);
5796 
5797 			if (!(mi->mi_flags & MI_EXTATTR))
5798 				return (0);
5799 
5800 			rp = VTOR(vp);
5801 			if (nfs_rw_enter_sig(&rp->r_rwlock, RW_READER,
5802 			    INTR(vp)))
5803 				return (EINTR);
5804 
5805 			error = nfs3lookup_dnlc(vp, XATTR_DIR_NAME, &avp, cr);
5806 			if (error || avp == NULL)
5807 				error = acl_getxattrdir3(vp, &avp, 0, cr, 0);
5808 
5809 			nfs_rw_exit(&rp->r_rwlock);
5810 
5811 			if (error == 0 && avp != NULL) {
5812 				error = do_xattr_exists_check(avp, valp, cr);
5813 				VN_RELE(avp);
5814 			} else if (error == ENOENT) {
5815 				error = 0;
5816 				*valp = 0;
5817 			}
5818 		}
5819 		return (error);
5820 	}
5821 
5822 	rp = VTOR(vp);
5823 	if (rp->r_pathconf != NULL) {
5824 		mutex_enter(&rp->r_statelock);
5825 		if (rp->r_pathconf != NULL && nfs3_pathconf_disable_cache) {
5826 			kmem_free(rp->r_pathconf, sizeof (*rp->r_pathconf));
5827 			rp->r_pathconf = NULL;
5828 		}
5829 		if (rp->r_pathconf != NULL) {
5830 			error = 0;
5831 			switch (cmd) {
5832 			case _PC_LINK_MAX:
5833 				*valp = rp->r_pathconf->link_max;
5834 				break;
5835 			case _PC_NAME_MAX:
5836 				*valp = rp->r_pathconf->name_max;
5837 				break;
5838 			case _PC_PATH_MAX:
5839 			case _PC_SYMLINK_MAX:
5840 				*valp = MAXPATHLEN;
5841 				break;
5842 			case _PC_CHOWN_RESTRICTED:
5843 				*valp = rp->r_pathconf->chown_restricted;
5844 				break;
5845 			case _PC_NO_TRUNC:
5846 				*valp = rp->r_pathconf->no_trunc;
5847 				break;
5848 			default:
5849 				error = EINVAL;
5850 				break;
5851 			}
5852 			mutex_exit(&rp->r_statelock);
5853 #ifdef DEBUG
5854 			nfs3_pathconf_cache_hits++;
5855 #endif
5856 			return (error);
5857 		}
5858 		mutex_exit(&rp->r_statelock);
5859 	}
5860 #ifdef DEBUG
5861 	nfs3_pathconf_cache_misses++;
5862 #endif
5863 
5864 	args.object = *VTOFH3(vp);
5865 	fi.vp = vp;
5866 	fi.fhp = (caddr_t)&args.object;
5867 	fi.copyproc = nfs3copyfh;
5868 	fi.lookupproc = nfs3lookup;
5869 	fi.xattrdirproc = acl_getxattrdir3;
5870 
5871 	douprintf = 1;
5872 
5873 	t = gethrtime();
5874 
5875 	error = rfs3call(VTOMI(vp), NFSPROC3_PATHCONF,
5876 	    xdr_nfs_fh3, (caddr_t)&args,
5877 	    xdr_PATHCONF3res, (caddr_t)&res, cr,
5878 	    &douprintf, &res.status, 0, &fi);
5879 
5880 	if (error)
5881 		return (error);
5882 
5883 	error = geterrno3(res.status);
5884 
5885 	if (!error) {
5886 		nfs3_cache_post_op_attr(vp, &res.resok.obj_attributes, t, cr);
5887 		if (!nfs3_pathconf_disable_cache) {
5888 			mutex_enter(&rp->r_statelock);
5889 			if (rp->r_pathconf == NULL) {
5890 				rp->r_pathconf = kmem_alloc(
5891 				    sizeof (*rp->r_pathconf), KM_NOSLEEP);
5892 				if (rp->r_pathconf != NULL)
5893 					*rp->r_pathconf = res.resok.info;
5894 			}
5895 			mutex_exit(&rp->r_statelock);
5896 		}
5897 		switch (cmd) {
5898 		case _PC_LINK_MAX:
5899 			*valp = res.resok.info.link_max;
5900 			break;
5901 		case _PC_NAME_MAX:
5902 			*valp = res.resok.info.name_max;
5903 			break;
5904 		case _PC_PATH_MAX:
5905 		case _PC_SYMLINK_MAX:
5906 			*valp = MAXPATHLEN;
5907 			break;
5908 		case _PC_CHOWN_RESTRICTED:
5909 			*valp = res.resok.info.chown_restricted;
5910 			break;
5911 		case _PC_NO_TRUNC:
5912 			*valp = res.resok.info.no_trunc;
5913 			break;
5914 		default:
5915 			return (EINVAL);
5916 		}
5917 	} else {
5918 		nfs3_cache_post_op_attr(vp, &res.resfail.obj_attributes, t, cr);
5919 		PURGE_STALE_FH(error, vp, cr);
5920 	}
5921 
5922 	return (error);
5923 }
5924 
5925 /*
5926  * Called by async thread to do synchronous pageio. Do the i/o, wait
5927  * for it to complete, and cleanup the page list when done.
5928  */
5929 static int
5930 nfs3_sync_pageio(vnode_t *vp, page_t *pp, u_offset_t io_off, size_t io_len,
5931     int flags, cred_t *cr)
5932 {
5933 	int error;
5934 
5935 	ASSERT(nfs_zone() == VTOMI(vp)->mi_zone);
5936 	error = nfs3_rdwrlbn(vp, pp, io_off, io_len, flags, cr);
5937 	if (flags & B_READ)
5938 		pvn_read_done(pp, (error ? B_ERROR : 0) | flags);
5939 	else
5940 		pvn_write_done(pp, (error ? B_ERROR : 0) | flags);
5941 	return (error);
5942 }
5943 
5944 /* ARGSUSED */
5945 static int
5946 nfs3_pageio(vnode_t *vp, page_t *pp, u_offset_t io_off, size_t io_len,
5947     int flags, cred_t *cr, caller_context_t *ct)
5948 {
5949 	int error;
5950 	rnode_t *rp;
5951 
5952 	if (pp == NULL)
5953 		return (EINVAL);
5954 	if (!(flags & B_ASYNC) && nfs_zone() != VTOMI(vp)->mi_zone)
5955 		return (EIO);
5956 
5957 	rp = VTOR(vp);
5958 	mutex_enter(&rp->r_statelock);
5959 	rp->r_count++;
5960 	mutex_exit(&rp->r_statelock);
5961 
5962 	if (flags & B_ASYNC) {
5963 		error = nfs_async_pageio(vp, pp, io_off, io_len, flags, cr,
5964 		    nfs3_sync_pageio);
5965 	} else
5966 		error = nfs3_rdwrlbn(vp, pp, io_off, io_len, flags, cr);
5967 	mutex_enter(&rp->r_statelock);
5968 	rp->r_count--;
5969 	cv_broadcast(&rp->r_cv);
5970 	mutex_exit(&rp->r_statelock);
5971 	return (error);
5972 }
5973 
5974 /* ARGSUSED */
5975 static void
5976 nfs3_dispose(vnode_t *vp, page_t *pp, int fl, int dn, cred_t *cr,
5977     caller_context_t *ct)
5978 {
5979 	int error;
5980 	rnode_t *rp;
5981 	page_t *plist;
5982 	page_t *pptr;
5983 	offset3 offset;
5984 	count3 len;
5985 	k_sigset_t smask;
5986 
5987 	/*
5988 	 * We should get called with fl equal to either B_FREE or
5989 	 * B_INVAL.  Any other value is illegal.
5990 	 *
5991 	 * The page that we are either supposed to free or destroy
5992 	 * should be exclusive locked and its io lock should not
5993 	 * be held.
5994 	 */
5995 	ASSERT(fl == B_FREE || fl == B_INVAL);
5996 	ASSERT((PAGE_EXCL(pp) && !page_iolock_assert(pp)) || panicstr);
5997 	rp = VTOR(vp);
5998 
5999 	/*
6000 	 * If the page doesn't need to be committed or we shouldn't
6001 	 * even bother attempting to commit it, then just make sure
6002 	 * that the p_fsdata byte is clear and then either free or
6003 	 * destroy the page as appropriate.
6004 	 */
6005 	if (pp->p_fsdata == C_NOCOMMIT || (rp->r_flags & RSTALE)) {
6006 		pp->p_fsdata = C_NOCOMMIT;
6007 		if (fl == B_FREE)
6008 			page_free(pp, dn);
6009 		else
6010 			page_destroy(pp, dn);
6011 		return;
6012 	}
6013 
6014 	/*
6015 	 * If there is a page invalidation operation going on, then
6016 	 * if this is one of the pages being destroyed, then just
6017 	 * clear the p_fsdata byte and then either free or destroy
6018 	 * the page as appropriate.
6019 	 */
6020 	mutex_enter(&rp->r_statelock);
6021 	if ((rp->r_flags & RTRUNCATE) && pp->p_offset >= rp->r_truncaddr) {
6022 		mutex_exit(&rp->r_statelock);
6023 		pp->p_fsdata = C_NOCOMMIT;
6024 		if (fl == B_FREE)
6025 			page_free(pp, dn);
6026 		else
6027 			page_destroy(pp, dn);
6028 		return;
6029 	}
6030 
6031 	/*
6032 	 * If we are freeing this page and someone else is already
6033 	 * waiting to do a commit, then just unlock the page and
6034 	 * return.  That other thread will take care of commiting
6035 	 * this page.  The page can be freed sometime after the
6036 	 * commit has finished.  Otherwise, if the page is marked
6037 	 * as delay commit, then we may be getting called from
6038 	 * pvn_write_done, one page at a time.   This could result
6039 	 * in one commit per page, so we end up doing lots of small
6040 	 * commits instead of fewer larger commits.  This is bad,
6041 	 * we want do as few commits as possible.
6042 	 */
6043 	if (fl == B_FREE) {
6044 		if (rp->r_flags & RCOMMITWAIT) {
6045 			page_unlock(pp);
6046 			mutex_exit(&rp->r_statelock);
6047 			return;
6048 		}
6049 		if (pp->p_fsdata == C_DELAYCOMMIT) {
6050 			pp->p_fsdata = C_COMMIT;
6051 			page_unlock(pp);
6052 			mutex_exit(&rp->r_statelock);
6053 			return;
6054 		}
6055 	}
6056 
6057 	/*
6058 	 * Check to see if there is a signal which would prevent an
6059 	 * attempt to commit the pages from being successful.  If so,
6060 	 * then don't bother with all of the work to gather pages and
6061 	 * generate the unsuccessful RPC.  Just return from here and
6062 	 * let the page be committed at some later time.
6063 	 */
6064 	sigintr(&smask, VTOMI(vp)->mi_flags & MI_INT);
6065 	if (ttolwp(curthread) != NULL && ISSIG(curthread, JUSTLOOKING)) {
6066 		sigunintr(&smask);
6067 		page_unlock(pp);
6068 		mutex_exit(&rp->r_statelock);
6069 		return;
6070 	}
6071 	sigunintr(&smask);
6072 
6073 	/*
6074 	 * We are starting to need to commit pages, so let's try
6075 	 * to commit as many as possible at once to reduce the
6076 	 * overhead.
6077 	 *
6078 	 * Set the `commit inprogress' state bit.  We must
6079 	 * first wait until any current one finishes.  Then
6080 	 * we initialize the c_pages list with this page.
6081 	 */
6082 	while (rp->r_flags & RCOMMIT) {
6083 		rp->r_flags |= RCOMMITWAIT;
6084 		cv_wait(&rp->r_commit.c_cv, &rp->r_statelock);
6085 		rp->r_flags &= ~RCOMMITWAIT;
6086 	}
6087 	rp->r_flags |= RCOMMIT;
6088 	mutex_exit(&rp->r_statelock);
6089 	ASSERT(rp->r_commit.c_pages == NULL);
6090 	rp->r_commit.c_pages = pp;
6091 	rp->r_commit.c_commbase = (offset3)pp->p_offset;
6092 	rp->r_commit.c_commlen = PAGESIZE;
6093 
6094 	/*
6095 	 * Gather together all other pages which can be committed.
6096 	 * They will all be chained off r_commit.c_pages.
6097 	 */
6098 	nfs3_get_commit(vp);
6099 
6100 	/*
6101 	 * Clear the `commit inprogress' status and disconnect
6102 	 * the list of pages to be committed from the rnode.
6103 	 * At this same time, we also save the starting offset
6104 	 * and length of data to be committed on the server.
6105 	 */
6106 	plist = rp->r_commit.c_pages;
6107 	rp->r_commit.c_pages = NULL;
6108 	offset = rp->r_commit.c_commbase;
6109 	len = rp->r_commit.c_commlen;
6110 	mutex_enter(&rp->r_statelock);
6111 	rp->r_flags &= ~RCOMMIT;
6112 	cv_broadcast(&rp->r_commit.c_cv);
6113 	mutex_exit(&rp->r_statelock);
6114 
6115 	if (curproc == proc_pageout || curproc == proc_fsflush ||
6116 	    nfs_zone() != VTOMI(vp)->mi_zone) {
6117 		nfs_async_commit(vp, plist, offset, len, cr, nfs3_async_commit);
6118 		return;
6119 	}
6120 
6121 	/*
6122 	 * Actually generate the COMMIT3 over the wire operation.
6123 	 */
6124 	error = nfs3_commit(vp, offset, len, cr);
6125 
6126 	/*
6127 	 * If we got an error during the commit, just unlock all
6128 	 * of the pages.  The pages will get retransmitted to the
6129 	 * server during a putpage operation.
6130 	 */
6131 	if (error) {
6132 		while (plist != NULL) {
6133 			pptr = plist;
6134 			page_sub(&plist, pptr);
6135 			page_unlock(pptr);
6136 		}
6137 		return;
6138 	}
6139 
6140 	/*
6141 	 * We've tried as hard as we can to commit the data to stable
6142 	 * storage on the server.  We release the rest of the pages
6143 	 * and clear the commit required state.  They will be put
6144 	 * onto the tail of the cachelist if they are nolonger
6145 	 * mapped.
6146 	 */
6147 	while (plist != pp) {
6148 		pptr = plist;
6149 		page_sub(&plist, pptr);
6150 		pptr->p_fsdata = C_NOCOMMIT;
6151 		(void) page_release(pptr, 1);
6152 	}
6153 
6154 	/*
6155 	 * It is possible that nfs3_commit didn't return error but
6156 	 * some other thread has modified the page we are going
6157 	 * to free/destroy.
6158 	 *    In this case we need to rewrite the page. Do an explicit check
6159 	 * before attempting to free/destroy the page. If modified, needs to
6160 	 * be rewritten so unlock the page and return.
6161 	 */
6162 	if (hat_ismod(pp)) {
6163 		pp->p_fsdata = C_NOCOMMIT;
6164 		page_unlock(pp);
6165 		return;
6166 	}
6167 
6168 	/*
6169 	 * Now, as appropriate, either free or destroy the page
6170 	 * that we were called with.
6171 	 */
6172 	pp->p_fsdata = C_NOCOMMIT;
6173 	if (fl == B_FREE)
6174 		page_free(pp, dn);
6175 	else
6176 		page_destroy(pp, dn);
6177 }
6178 
6179 static int
6180 nfs3_commit(vnode_t *vp, offset3 offset, count3 count, cred_t *cr)
6181 {
6182 	int error;
6183 	rnode_t *rp;
6184 	COMMIT3args args;
6185 	COMMIT3res res;
6186 	int douprintf;
6187 	cred_t *cred;
6188 
6189 	rp = VTOR(vp);
6190 	ASSERT(nfs_zone() == VTOMI(vp)->mi_zone);
6191 
6192 	mutex_enter(&rp->r_statelock);
6193 	if (rp->r_cred != NULL) {
6194 		cred = rp->r_cred;
6195 		crhold(cred);
6196 	} else {
6197 		rp->r_cred = cr;
6198 		crhold(cr);
6199 		cred = cr;
6200 		crhold(cred);
6201 	}
6202 	mutex_exit(&rp->r_statelock);
6203 
6204 	args.file = *VTOFH3(vp);
6205 	args.offset = offset;
6206 	args.count = count;
6207 
6208 doitagain:
6209 	douprintf = 1;
6210 	error = rfs3call(VTOMI(vp), NFSPROC3_COMMIT,
6211 	    xdr_COMMIT3args, (caddr_t)&args,
6212 	    xdr_COMMIT3res, (caddr_t)&res, cred,
6213 	    &douprintf, &res.status, 0, NULL);
6214 
6215 	crfree(cred);
6216 
6217 	if (error)
6218 		return (error);
6219 
6220 	error = geterrno3(res.status);
6221 	if (!error) {
6222 		ASSERT(rp->r_flags & RHAVEVERF);
6223 		mutex_enter(&rp->r_statelock);
6224 		if (rp->r_verf == res.resok.verf) {
6225 			mutex_exit(&rp->r_statelock);
6226 			return (0);
6227 		}
6228 		nfs3_set_mod(vp);
6229 		rp->r_verf = res.resok.verf;
6230 		mutex_exit(&rp->r_statelock);
6231 		error = NFS_VERF_MISMATCH;
6232 	} else {
6233 		if (error == EACCES) {
6234 			mutex_enter(&rp->r_statelock);
6235 			if (cred != cr) {
6236 				if (rp->r_cred != NULL)
6237 					crfree(rp->r_cred);
6238 				rp->r_cred = cr;
6239 				crhold(cr);
6240 				cred = cr;
6241 				crhold(cred);
6242 				mutex_exit(&rp->r_statelock);
6243 				goto doitagain;
6244 			}
6245 			mutex_exit(&rp->r_statelock);
6246 		}
6247 		/*
6248 		 * Can't do a PURGE_STALE_FH here because this
6249 		 * can cause a deadlock.  nfs3_commit can
6250 		 * be called from nfs3_dispose which can be called
6251 		 * indirectly via pvn_vplist_dirty.  PURGE_STALE_FH
6252 		 * can call back to pvn_vplist_dirty.
6253 		 */
6254 		if (error == ESTALE) {
6255 			mutex_enter(&rp->r_statelock);
6256 			rp->r_flags |= RSTALE;
6257 			if (!rp->r_error)
6258 				rp->r_error = error;
6259 			mutex_exit(&rp->r_statelock);
6260 			PURGE_ATTRCACHE(vp);
6261 		} else {
6262 			mutex_enter(&rp->r_statelock);
6263 			if (!rp->r_error)
6264 				rp->r_error = error;
6265 			mutex_exit(&rp->r_statelock);
6266 		}
6267 	}
6268 
6269 	return (error);
6270 }
6271 
6272 static void
6273 nfs3_set_mod(vnode_t *vp)
6274 {
6275 	ASSERT(nfs_zone() == VTOMI(vp)->mi_zone);
6276 
6277 	pvn_vplist_setdirty(vp, nfs_setmod_check);
6278 }
6279 
6280 /*
6281  * This routine is used to gather together a page list of the pages
6282  * which are to be committed on the server.  This routine must not
6283  * be called if the calling thread holds any locked pages.
6284  *
6285  * The calling thread must have set RCOMMIT.  This bit is used to
6286  * serialize access to the commit structure in the rnode.  As long
6287  * as the thread has set RCOMMIT, then it can manipulate the commit
6288  * structure without requiring any other locks.
6289  */
6290 static void
6291 nfs3_get_commit(vnode_t *vp)
6292 {
6293 	rnode_t *rp;
6294 	page_t *pp;
6295 	kmutex_t *vphm;
6296 
6297 	rp = VTOR(vp);
6298 
6299 	ASSERT(rp->r_flags & RCOMMIT);
6300 
6301 	vphm = page_vnode_mutex(vp);
6302 	mutex_enter(vphm);
6303 
6304 	/*
6305 	 * If there are no pages associated with this vnode, then
6306 	 * just return.
6307 	 */
6308 	if ((pp = vp->v_pages) == NULL) {
6309 		mutex_exit(vphm);
6310 		return;
6311 	}
6312 
6313 	/*
6314 	 * Step through all of the pages associated with this vnode
6315 	 * looking for pages which need to be committed.
6316 	 */
6317 	do {
6318 		/* Skip marker pages. */
6319 		if (pp->p_hash == PVN_VPLIST_HASH_TAG)
6320 			continue;
6321 
6322 		/*
6323 		 * If this page does not need to be committed or is
6324 		 * modified, then just skip it.
6325 		 */
6326 		if (pp->p_fsdata == C_NOCOMMIT || hat_ismod(pp))
6327 			continue;
6328 
6329 		/*
6330 		 * Attempt to lock the page.  If we can't, then
6331 		 * someone else is messing with it and we will
6332 		 * just skip it.
6333 		 */
6334 		if (!page_trylock(pp, SE_EXCL))
6335 			continue;
6336 
6337 		/*
6338 		 * If this page does not need to be committed or is
6339 		 * modified, then just skip it.  Recheck now that
6340 		 * the page is locked.
6341 		 */
6342 		if (pp->p_fsdata == C_NOCOMMIT || hat_ismod(pp)) {
6343 			page_unlock(pp);
6344 			continue;
6345 		}
6346 
6347 		if (PP_ISFREE(pp)) {
6348 			cmn_err(CE_PANIC, "nfs3_get_commit: %p is free",
6349 			    (void *)pp);
6350 		}
6351 
6352 		/*
6353 		 * The page needs to be committed and we locked it.
6354 		 * Update the base and length parameters and add it
6355 		 * to r_pages.
6356 		 */
6357 		if (rp->r_commit.c_pages == NULL) {
6358 			rp->r_commit.c_commbase = (offset3)pp->p_offset;
6359 			rp->r_commit.c_commlen = PAGESIZE;
6360 		} else if (pp->p_offset < rp->r_commit.c_commbase) {
6361 			rp->r_commit.c_commlen = rp->r_commit.c_commbase -
6362 			    (offset3)pp->p_offset + rp->r_commit.c_commlen;
6363 			rp->r_commit.c_commbase = (offset3)pp->p_offset;
6364 		} else if ((rp->r_commit.c_commbase + rp->r_commit.c_commlen)
6365 		    <= pp->p_offset) {
6366 			rp->r_commit.c_commlen = (offset3)pp->p_offset -
6367 			    rp->r_commit.c_commbase + PAGESIZE;
6368 		}
6369 		page_add(&rp->r_commit.c_pages, pp);
6370 	} while ((pp = pp->p_vpnext) != vp->v_pages);
6371 
6372 	mutex_exit(vphm);
6373 }
6374 
6375 /*
6376  * This routine is used to gather together a page list of the pages
6377  * which are to be committed on the server.  This routine must not
6378  * be called if the calling thread holds any locked pages.
6379  *
6380  * The calling thread must have set RCOMMIT.  This bit is used to
6381  * serialize access to the commit structure in the rnode.  As long
6382  * as the thread has set RCOMMIT, then it can manipulate the commit
6383  * structure without requiring any other locks.
6384  */
6385 static void
6386 nfs3_get_commit_range(vnode_t *vp, u_offset_t soff, size_t len)
6387 {
6388 
6389 	rnode_t *rp;
6390 	page_t *pp;
6391 	u_offset_t end;
6392 	u_offset_t off;
6393 
6394 	ASSERT(len != 0);
6395 
6396 	rp = VTOR(vp);
6397 
6398 	ASSERT(rp->r_flags & RCOMMIT);
6399 	ASSERT(nfs_zone() == VTOMI(vp)->mi_zone);
6400 
6401 	/*
6402 	 * If there are no pages associated with this vnode, then
6403 	 * just return.
6404 	 */
6405 	if ((pp = vp->v_pages) == NULL)
6406 		return;
6407 
6408 	/*
6409 	 * Calculate the ending offset.
6410 	 */
6411 	end = soff + len;
6412 
6413 	for (off = soff; off < end; off += PAGESIZE) {
6414 		/*
6415 		 * Lookup each page by vp, offset.
6416 		 */
6417 		if ((pp = page_lookup_nowait(vp, off, SE_EXCL)) == NULL)
6418 			continue;
6419 
6420 		/*
6421 		 * If this page does not need to be committed or is
6422 		 * modified, then just skip it.
6423 		 */
6424 		if (pp->p_fsdata == C_NOCOMMIT || hat_ismod(pp)) {
6425 			page_unlock(pp);
6426 			continue;
6427 		}
6428 
6429 		ASSERT(PP_ISFREE(pp) == 0);
6430 
6431 		/*
6432 		 * The page needs to be committed and we locked it.
6433 		 * Update the base and length parameters and add it
6434 		 * to r_pages.
6435 		 */
6436 		if (rp->r_commit.c_pages == NULL) {
6437 			rp->r_commit.c_commbase = (offset3)pp->p_offset;
6438 			rp->r_commit.c_commlen = PAGESIZE;
6439 		} else {
6440 			rp->r_commit.c_commlen = (offset3)pp->p_offset -
6441 			    rp->r_commit.c_commbase + PAGESIZE;
6442 		}
6443 		page_add(&rp->r_commit.c_pages, pp);
6444 	}
6445 }
6446 
6447 static int
6448 nfs3_putpage_commit(vnode_t *vp, offset_t poff, size_t plen, cred_t *cr)
6449 {
6450 	int error;
6451 	writeverf3 write_verf;
6452 	rnode_t *rp = VTOR(vp);
6453 
6454 	ASSERT(nfs_zone() == VTOMI(vp)->mi_zone);
6455 	/*
6456 	 * Flush the data portion of the file and then commit any
6457 	 * portions which need to be committed.  This may need to
6458 	 * be done twice if the server has changed state since
6459 	 * data was last written.  The data will need to be
6460 	 * rewritten to the server and then a new commit done.
6461 	 *
6462 	 * In fact, this may need to be done several times if the
6463 	 * server is having problems and crashing while we are
6464 	 * attempting to do this.
6465 	 */
6466 
6467 top:
6468 	/*
6469 	 * Do a flush based on the poff and plen arguments.  This
6470 	 * will asynchronously write out any modified pages in the
6471 	 * range specified by (poff, plen).  This starts all of the
6472 	 * i/o operations which will be waited for in the next
6473 	 * call to nfs3_putpage
6474 	 */
6475 
6476 	mutex_enter(&rp->r_statelock);
6477 	write_verf = rp->r_verf;
6478 	mutex_exit(&rp->r_statelock);
6479 
6480 	error = nfs3_putpage(vp, poff, plen, B_ASYNC, cr, NULL);
6481 	if (error == EAGAIN)
6482 		error = 0;
6483 
6484 	/*
6485 	 * Do a flush based on the poff and plen arguments.  This
6486 	 * will synchronously write out any modified pages in the
6487 	 * range specified by (poff, plen) and wait until all of
6488 	 * the asynchronous i/o's in that range are done as well.
6489 	 */
6490 	if (!error)
6491 		error = nfs3_putpage(vp, poff, plen, 0, cr, NULL);
6492 
6493 	if (error)
6494 		return (error);
6495 
6496 	mutex_enter(&rp->r_statelock);
6497 	if (rp->r_verf != write_verf) {
6498 		mutex_exit(&rp->r_statelock);
6499 		goto top;
6500 	}
6501 	mutex_exit(&rp->r_statelock);
6502 
6503 	/*
6504 	 * Now commit any pages which might need to be committed.
6505 	 * If the error, NFS_VERF_MISMATCH, is returned, then
6506 	 * start over with the flush operation.
6507 	 */
6508 
6509 	error = nfs3_commit_vp(vp, poff, plen, cr);
6510 
6511 	if (error == NFS_VERF_MISMATCH)
6512 		goto top;
6513 
6514 	return (error);
6515 }
6516 
6517 static int
6518 nfs3_commit_vp(vnode_t *vp, u_offset_t poff, size_t plen, cred_t *cr)
6519 {
6520 	rnode_t *rp;
6521 	page_t *plist;
6522 	offset3 offset;
6523 	count3 len;
6524 
6525 
6526 	rp = VTOR(vp);
6527 
6528 	if (nfs_zone() != VTOMI(vp)->mi_zone)
6529 		return (EIO);
6530 	/*
6531 	 * Set the `commit inprogress' state bit.  We must
6532 	 * first wait until any current one finishes.
6533 	 */
6534 	mutex_enter(&rp->r_statelock);
6535 	while (rp->r_flags & RCOMMIT) {
6536 		rp->r_flags |= RCOMMITWAIT;
6537 		cv_wait(&rp->r_commit.c_cv, &rp->r_statelock);
6538 		rp->r_flags &= ~RCOMMITWAIT;
6539 	}
6540 	rp->r_flags |= RCOMMIT;
6541 	mutex_exit(&rp->r_statelock);
6542 
6543 	/*
6544 	 * Gather together all of the pages which need to be
6545 	 * committed.
6546 	 */
6547 	if (plen == 0)
6548 		nfs3_get_commit(vp);
6549 	else
6550 		nfs3_get_commit_range(vp, poff, plen);
6551 
6552 	/*
6553 	 * Clear the `commit inprogress' bit and disconnect the
6554 	 * page list which was gathered together in nfs3_get_commit.
6555 	 */
6556 	plist = rp->r_commit.c_pages;
6557 	rp->r_commit.c_pages = NULL;
6558 	offset = rp->r_commit.c_commbase;
6559 	len = rp->r_commit.c_commlen;
6560 	mutex_enter(&rp->r_statelock);
6561 	rp->r_flags &= ~RCOMMIT;
6562 	cv_broadcast(&rp->r_commit.c_cv);
6563 	mutex_exit(&rp->r_statelock);
6564 
6565 	/*
6566 	 * If any pages need to be committed, commit them and
6567 	 * then unlock them so that they can be freed some
6568 	 * time later.
6569 	 */
6570 	if (plist != NULL) {
6571 		/*
6572 		 * No error occurred during the flush portion
6573 		 * of this operation, so now attempt to commit
6574 		 * the data to stable storage on the server.
6575 		 *
6576 		 * This will unlock all of the pages on the list.
6577 		 */
6578 		return (nfs3_sync_commit(vp, plist, offset, len, cr));
6579 	}
6580 	return (0);
6581 }
6582 
6583 static int
6584 nfs3_sync_commit(vnode_t *vp, page_t *plist, offset3 offset, count3 count,
6585     cred_t *cr)
6586 {
6587 	int error;
6588 	page_t *pp;
6589 
6590 	ASSERT(nfs_zone() == VTOMI(vp)->mi_zone);
6591 	error = nfs3_commit(vp, offset, count, cr);
6592 
6593 	/*
6594 	 * If we got an error, then just unlock all of the pages
6595 	 * on the list.
6596 	 */
6597 	if (error) {
6598 		while (plist != NULL) {
6599 			pp = plist;
6600 			page_sub(&plist, pp);
6601 			page_unlock(pp);
6602 		}
6603 		return (error);
6604 	}
6605 	/*
6606 	 * We've tried as hard as we can to commit the data to stable
6607 	 * storage on the server.  We just unlock the pages and clear
6608 	 * the commit required state.  They will get freed later.
6609 	 */
6610 	while (plist != NULL) {
6611 		pp = plist;
6612 		page_sub(&plist, pp);
6613 		pp->p_fsdata = C_NOCOMMIT;
6614 		page_unlock(pp);
6615 	}
6616 
6617 	return (error);
6618 }
6619 
6620 static void
6621 nfs3_async_commit(vnode_t *vp, page_t *plist, offset3 offset, count3 count,
6622     cred_t *cr)
6623 {
6624 	ASSERT(nfs_zone() == VTOMI(vp)->mi_zone);
6625 	(void) nfs3_sync_commit(vp, plist, offset, count, cr);
6626 }
6627 
6628 /* ARGSUSED */
6629 static int
6630 nfs3_setsecattr(vnode_t *vp, vsecattr_t *vsecattr, int flag, cred_t *cr,
6631     caller_context_t *ct)
6632 {
6633 	int error;
6634 	mntinfo_t *mi;
6635 
6636 	mi = VTOMI(vp);
6637 
6638 	if (nfs_zone() != mi->mi_zone)
6639 		return (EIO);
6640 
6641 	if (mi->mi_flags & MI_ACL) {
6642 		error = acl_setacl3(vp, vsecattr, flag, cr);
6643 		if (mi->mi_flags & MI_ACL)
6644 			return (error);
6645 	}
6646 
6647 	return (ENOSYS);
6648 }
6649 
6650 /* ARGSUSED */
6651 static int
6652 nfs3_getsecattr(vnode_t *vp, vsecattr_t *vsecattr, int flag, cred_t *cr,
6653     caller_context_t *ct)
6654 {
6655 	int error;
6656 	mntinfo_t *mi;
6657 
6658 	mi = VTOMI(vp);
6659 
6660 	if (nfs_zone() != mi->mi_zone)
6661 		return (EIO);
6662 
6663 	if (mi->mi_flags & MI_ACL) {
6664 		error = acl_getacl3(vp, vsecattr, flag, cr);
6665 		if (mi->mi_flags & MI_ACL)
6666 			return (error);
6667 	}
6668 
6669 	return (fs_fab_acl(vp, vsecattr, flag, cr, ct));
6670 }
6671 
6672 /* ARGSUSED */
6673 static int
6674 nfs3_shrlock(vnode_t *vp, int cmd, struct shrlock *shr, int flag, cred_t *cr,
6675     caller_context_t *ct)
6676 {
6677 	int error;
6678 	struct shrlock nshr;
6679 	struct nfs_owner nfs_owner;
6680 	netobj lm_fh3;
6681 
6682 	if (nfs_zone() != VTOMI(vp)->mi_zone)
6683 		return (EIO);
6684 
6685 	/*
6686 	 * check for valid cmd parameter
6687 	 */
6688 	if (cmd != F_SHARE && cmd != F_UNSHARE && cmd != F_HASREMOTELOCKS)
6689 		return (EINVAL);
6690 
6691 	/*
6692 	 * Check access permissions
6693 	 */
6694 	if (cmd == F_SHARE &&
6695 	    (((shr->s_access & F_RDACC) && !(flag & FREAD)) ||
6696 	    ((shr->s_access & F_WRACC) && !(flag & FWRITE))))
6697 		return (EBADF);
6698 
6699 	/*
6700 	 * If the filesystem is mounted using local locking, pass the
6701 	 * request off to the local share code.
6702 	 */
6703 	if (VTOMI(vp)->mi_flags & MI_LLOCK)
6704 		return (fs_shrlock(vp, cmd, shr, flag, cr, ct));
6705 
6706 	switch (cmd) {
6707 	case F_SHARE:
6708 	case F_UNSHARE:
6709 		lm_fh3.n_len = VTOFH3(vp)->fh3_length;
6710 		lm_fh3.n_bytes = (char *)&(VTOFH3(vp)->fh3_u.data);
6711 
6712 		/*
6713 		 * If passed an owner that is too large to fit in an
6714 		 * nfs_owner it is likely a recursive call from the
6715 		 * lock manager client and pass it straight through.  If
6716 		 * it is not a nfs_owner then simply return an error.
6717 		 */
6718 		if (shr->s_own_len > sizeof (nfs_owner.lowner)) {
6719 			if (((struct nfs_owner *)shr->s_owner)->magic !=
6720 			    NFS_OWNER_MAGIC)
6721 				return (EINVAL);
6722 
6723 			if (error = lm4_shrlock(vp, cmd, shr, flag, &lm_fh3)) {
6724 				error = set_errno(error);
6725 			}
6726 			return (error);
6727 		}
6728 		/*
6729 		 * Remote share reservations owner is a combination of
6730 		 * a magic number, hostname, and the local owner
6731 		 */
6732 		bzero(&nfs_owner, sizeof (nfs_owner));
6733 		nfs_owner.magic = NFS_OWNER_MAGIC;
6734 		(void) strncpy(nfs_owner.hname, uts_nodename(),
6735 		    sizeof (nfs_owner.hname));
6736 		bcopy(shr->s_owner, nfs_owner.lowner, shr->s_own_len);
6737 		nshr.s_access = shr->s_access;
6738 		nshr.s_deny = shr->s_deny;
6739 		nshr.s_sysid = 0;
6740 		nshr.s_pid = ttoproc(curthread)->p_pid;
6741 		nshr.s_own_len = sizeof (nfs_owner);
6742 		nshr.s_owner = (caddr_t)&nfs_owner;
6743 
6744 		if (error = lm4_shrlock(vp, cmd, &nshr, flag, &lm_fh3)) {
6745 			error = set_errno(error);
6746 		}
6747 
6748 		break;
6749 
6750 	case F_HASREMOTELOCKS:
6751 		/*
6752 		 * NFS client can't store remote locks itself
6753 		 */
6754 		shr->s_access = 0;
6755 		error = 0;
6756 		break;
6757 
6758 	default:
6759 		error = EINVAL;
6760 		break;
6761 	}
6762 
6763 	return (error);
6764 }
6765