xref: /illumos-gate/usr/src/uts/common/fs/nfs/nfs3_vnops.c (revision 628e3cbed6489fa1db545d8524a06cd6535af456)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 /*
22  * Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
23  * Use is subject to license terms.
24  */
25 
26 /*
27  *	Copyright (c) 1983,1984,1985,1986,1987,1988,1989 AT&T.
28  *	All rights reserved.
29  */
30 
31 #include <sys/param.h>
32 #include <sys/types.h>
33 #include <sys/systm.h>
34 #include <sys/cred.h>
35 #include <sys/time.h>
36 #include <sys/vnode.h>
37 #include <sys/vfs.h>
38 #include <sys/vfs_opreg.h>
39 #include <sys/file.h>
40 #include <sys/filio.h>
41 #include <sys/uio.h>
42 #include <sys/buf.h>
43 #include <sys/mman.h>
44 #include <sys/pathname.h>
45 #include <sys/dirent.h>
46 #include <sys/debug.h>
47 #include <sys/vmsystm.h>
48 #include <sys/fcntl.h>
49 #include <sys/flock.h>
50 #include <sys/swap.h>
51 #include <sys/errno.h>
52 #include <sys/strsubr.h>
53 #include <sys/sysmacros.h>
54 #include <sys/kmem.h>
55 #include <sys/cmn_err.h>
56 #include <sys/pathconf.h>
57 #include <sys/utsname.h>
58 #include <sys/dnlc.h>
59 #include <sys/acl.h>
60 #include <sys/systeminfo.h>
61 #include <sys/atomic.h>
62 #include <sys/policy.h>
63 #include <sys/sdt.h>
64 
65 #include <rpc/types.h>
66 #include <rpc/auth.h>
67 #include <rpc/clnt.h>
68 #include <rpc/rpc_rdma.h>
69 
70 #include <nfs/nfs.h>
71 #include <nfs/nfs_clnt.h>
72 #include <nfs/rnode.h>
73 #include <nfs/nfs_acl.h>
74 #include <nfs/lm.h>
75 
76 #include <vm/hat.h>
77 #include <vm/as.h>
78 #include <vm/page.h>
79 #include <vm/pvn.h>
80 #include <vm/seg.h>
81 #include <vm/seg_map.h>
82 #include <vm/seg_kpm.h>
83 #include <vm/seg_vn.h>
84 
85 #include <fs/fs_subr.h>
86 
87 #include <sys/ddi.h>
88 
89 static int	nfs3_rdwrlbn(vnode_t *, page_t *, u_offset_t, size_t, int,
90 			cred_t *);
91 static int	nfs3write(vnode_t *, caddr_t, u_offset_t, int, cred_t *,
92 			stable_how *);
93 static int	nfs3read(vnode_t *, caddr_t, offset_t, int, size_t *, cred_t *);
94 static int	nfs3setattr(vnode_t *, struct vattr *, int, cred_t *);
95 static int	nfs3_accessx(void *, int, cred_t *);
96 static int	nfs3lookup_dnlc(vnode_t *, char *, vnode_t **, cred_t *);
97 static int	nfs3lookup_otw(vnode_t *, char *, vnode_t **, cred_t *, int);
98 static int	nfs3create(vnode_t *, char *, struct vattr *, enum vcexcl,
99 			int, vnode_t **, cred_t *, int);
100 static int	nfs3excl_create_settimes(vnode_t *, struct vattr *, cred_t *);
101 static int	nfs3mknod(vnode_t *, char *, struct vattr *, enum vcexcl,
102 			int, vnode_t **, cred_t *);
103 static int	nfs3rename(vnode_t *, char *, vnode_t *, char *, cred_t *,
104 			caller_context_t *);
105 static int	do_nfs3readdir(vnode_t *, rddir_cache *, cred_t *);
106 static void	nfs3readdir(vnode_t *, rddir_cache *, cred_t *);
107 static void	nfs3readdirplus(vnode_t *, rddir_cache *, cred_t *);
108 static int	nfs3_bio(struct buf *, stable_how *, cred_t *);
109 static int	nfs3_getapage(vnode_t *, u_offset_t, size_t, uint_t *,
110 			page_t *[], size_t, struct seg *, caddr_t,
111 			enum seg_rw, cred_t *);
112 static void	nfs3_readahead(vnode_t *, u_offset_t, caddr_t, struct seg *,
113 			cred_t *);
114 static int	nfs3_sync_putapage(vnode_t *, page_t *, u_offset_t, size_t,
115 			int, cred_t *);
116 static int	nfs3_sync_pageio(vnode_t *, page_t *, u_offset_t, size_t,
117 			int, cred_t *);
118 static int	nfs3_commit(vnode_t *, offset3, count3, cred_t *);
119 static void	nfs3_set_mod(vnode_t *);
120 static void	nfs3_get_commit(vnode_t *);
121 static void	nfs3_get_commit_range(vnode_t *, u_offset_t, size_t);
122 #if 0 /* unused */
123 #ifdef DEBUG
124 static int	nfs3_no_uncommitted_pages(vnode_t *);
125 #endif
126 #endif /* unused */
127 static int	nfs3_putpage_commit(vnode_t *, offset_t, size_t, cred_t *);
128 static int	nfs3_commit_vp(vnode_t *, u_offset_t, size_t,  cred_t *);
129 static int	nfs3_sync_commit(vnode_t *, page_t *, offset3, count3,
130 			cred_t *);
131 static void	nfs3_async_commit(vnode_t *, page_t *, offset3, count3,
132 			cred_t *);
133 static void	nfs3_delmap_callback(struct as *, void *, uint_t);
134 
135 /*
136  * Error flags used to pass information about certain special errors
137  * which need to be handled specially.
138  */
139 #define	NFS_EOF			-98
140 #define	NFS_VERF_MISMATCH	-97
141 
142 /* ALIGN64 aligns the given buffer and adjust buffer size to 64 bit */
143 #define	ALIGN64(x, ptr, sz)						\
144 	x = ((uintptr_t)(ptr)) & (sizeof (uint64_t) - 1);		\
145 	if (x) {							\
146 		x = sizeof (uint64_t) - (x);				\
147 		sz -= (x);						\
148 		ptr += (x);						\
149 	}
150 
151 /*
152  * These are the vnode ops routines which implement the vnode interface to
153  * the networked file system.  These routines just take their parameters,
154  * make them look networkish by putting the right info into interface structs,
155  * and then calling the appropriate remote routine(s) to do the work.
156  *
157  * Note on directory name lookup cacheing:  If we detect a stale fhandle,
158  * we purge the directory cache relative to that vnode.  This way, the
159  * user won't get burned by the cache repeatedly.  See <nfs/rnode.h> for
160  * more details on rnode locking.
161  */
162 
163 static int	nfs3_open(vnode_t **, int, cred_t *, caller_context_t *);
164 static int	nfs3_close(vnode_t *, int, int, offset_t, cred_t *,
165 			caller_context_t *);
166 static int	nfs3_read(vnode_t *, struct uio *, int, cred_t *,
167 			caller_context_t *);
168 static int	nfs3_write(vnode_t *, struct uio *, int, cred_t *,
169 			caller_context_t *);
170 static int	nfs3_ioctl(vnode_t *, int, intptr_t, int, cred_t *, int *,
171 			caller_context_t *);
172 static int	nfs3_getattr(vnode_t *, struct vattr *, int, cred_t *,
173 			caller_context_t *);
174 static int	nfs3_setattr(vnode_t *, struct vattr *, int, cred_t *,
175 			caller_context_t *);
176 static int	nfs3_access(vnode_t *, int, int, cred_t *, caller_context_t *);
177 static int	nfs3_readlink(vnode_t *, struct uio *, cred_t *,
178 			caller_context_t *);
179 static int	nfs3_fsync(vnode_t *, int, cred_t *, caller_context_t *);
180 static void	nfs3_inactive(vnode_t *, cred_t *, caller_context_t *);
181 static int	nfs3_lookup(vnode_t *, char *, vnode_t **,
182 			struct pathname *, int, vnode_t *, cred_t *,
183 			caller_context_t *, int *, pathname_t *);
184 static int	nfs3_create(vnode_t *, char *, struct vattr *, enum vcexcl,
185 			int, vnode_t **, cred_t *, int, caller_context_t *,
186 			vsecattr_t *);
187 static int	nfs3_remove(vnode_t *, char *, cred_t *, caller_context_t *,
188 			int);
189 static int	nfs3_link(vnode_t *, vnode_t *, char *, cred_t *,
190 			caller_context_t *, int);
191 static int	nfs3_rename(vnode_t *, char *, vnode_t *, char *, cred_t *,
192 			caller_context_t *, int);
193 static int	nfs3_mkdir(vnode_t *, char *, struct vattr *, vnode_t **,
194 			cred_t *, caller_context_t *, int, vsecattr_t *);
195 static int	nfs3_rmdir(vnode_t *, char *, vnode_t *, cred_t *,
196 			caller_context_t *, int);
197 static int	nfs3_symlink(vnode_t *, char *, struct vattr *, char *,
198 			cred_t *, caller_context_t *, int);
199 static int	nfs3_readdir(vnode_t *, struct uio *, cred_t *, int *,
200 			caller_context_t *, int);
201 static int	nfs3_fid(vnode_t *, fid_t *, caller_context_t *);
202 static int	nfs3_rwlock(vnode_t *, int, caller_context_t *);
203 static void	nfs3_rwunlock(vnode_t *, int, caller_context_t *);
204 static int	nfs3_seek(vnode_t *, offset_t, offset_t *, caller_context_t *);
205 static int	nfs3_getpage(vnode_t *, offset_t, size_t, uint_t *,
206 			page_t *[], size_t, struct seg *, caddr_t,
207 			enum seg_rw, cred_t *, caller_context_t *);
208 static int	nfs3_putpage(vnode_t *, offset_t, size_t, int, cred_t *,
209 			caller_context_t *);
210 static int	nfs3_map(vnode_t *, offset_t, struct as *, caddr_t *, size_t,
211 			uchar_t, uchar_t, uint_t, cred_t *, caller_context_t *);
212 static int	nfs3_addmap(vnode_t *, offset_t, struct as *, caddr_t, size_t,
213 			uchar_t, uchar_t, uint_t, cred_t *, caller_context_t *);
214 static int	nfs3_frlock(vnode_t *, int, struct flock64 *, int, offset_t,
215 			struct flk_callback *, cred_t *, caller_context_t *);
216 static int	nfs3_space(vnode_t *, int, struct flock64 *, int, offset_t,
217 			cred_t *, caller_context_t *);
218 static int	nfs3_realvp(vnode_t *, vnode_t **, caller_context_t *);
219 static int	nfs3_delmap(vnode_t *, offset_t, struct as *, caddr_t, size_t,
220 			uint_t, uint_t, uint_t, cred_t *, caller_context_t *);
221 static int	nfs3_pathconf(vnode_t *, int, ulong_t *, cred_t *,
222 			caller_context_t *);
223 static int	nfs3_pageio(vnode_t *, page_t *, u_offset_t, size_t, int,
224 			cred_t *, caller_context_t *);
225 static void	nfs3_dispose(vnode_t *, page_t *, int, int, cred_t *,
226 			caller_context_t *);
227 static int	nfs3_setsecattr(vnode_t *, vsecattr_t *, int, cred_t *,
228 			caller_context_t *);
229 static int	nfs3_getsecattr(vnode_t *, vsecattr_t *, int, cred_t *,
230 			caller_context_t *);
231 static int	nfs3_shrlock(vnode_t *, int, struct shrlock *, int, cred_t *,
232 			caller_context_t *);
233 
234 struct vnodeops *nfs3_vnodeops;
235 
236 const fs_operation_def_t nfs3_vnodeops_template[] = {
237 	VOPNAME_OPEN,		{ .vop_open = nfs3_open },
238 	VOPNAME_CLOSE,		{ .vop_close = nfs3_close },
239 	VOPNAME_READ,		{ .vop_read = nfs3_read },
240 	VOPNAME_WRITE,		{ .vop_write = nfs3_write },
241 	VOPNAME_IOCTL,		{ .vop_ioctl = nfs3_ioctl },
242 	VOPNAME_GETATTR,	{ .vop_getattr = nfs3_getattr },
243 	VOPNAME_SETATTR,	{ .vop_setattr = nfs3_setattr },
244 	VOPNAME_ACCESS,		{ .vop_access = nfs3_access },
245 	VOPNAME_LOOKUP,		{ .vop_lookup = nfs3_lookup },
246 	VOPNAME_CREATE,		{ .vop_create = nfs3_create },
247 	VOPNAME_REMOVE,		{ .vop_remove = nfs3_remove },
248 	VOPNAME_LINK,		{ .vop_link = nfs3_link },
249 	VOPNAME_RENAME,		{ .vop_rename = nfs3_rename },
250 	VOPNAME_MKDIR,		{ .vop_mkdir = nfs3_mkdir },
251 	VOPNAME_RMDIR,		{ .vop_rmdir = nfs3_rmdir },
252 	VOPNAME_READDIR,	{ .vop_readdir = nfs3_readdir },
253 	VOPNAME_SYMLINK,	{ .vop_symlink = nfs3_symlink },
254 	VOPNAME_READLINK,	{ .vop_readlink = nfs3_readlink },
255 	VOPNAME_FSYNC,		{ .vop_fsync = nfs3_fsync },
256 	VOPNAME_INACTIVE,	{ .vop_inactive = nfs3_inactive },
257 	VOPNAME_FID,		{ .vop_fid = nfs3_fid },
258 	VOPNAME_RWLOCK,		{ .vop_rwlock = nfs3_rwlock },
259 	VOPNAME_RWUNLOCK,	{ .vop_rwunlock = nfs3_rwunlock },
260 	VOPNAME_SEEK,		{ .vop_seek = nfs3_seek },
261 	VOPNAME_FRLOCK,		{ .vop_frlock = nfs3_frlock },
262 	VOPNAME_SPACE,		{ .vop_space = nfs3_space },
263 	VOPNAME_REALVP,		{ .vop_realvp = nfs3_realvp },
264 	VOPNAME_GETPAGE,	{ .vop_getpage = nfs3_getpage },
265 	VOPNAME_PUTPAGE,	{ .vop_putpage = nfs3_putpage },
266 	VOPNAME_MAP,		{ .vop_map = nfs3_map },
267 	VOPNAME_ADDMAP,		{ .vop_addmap = nfs3_addmap },
268 	VOPNAME_DELMAP,		{ .vop_delmap = nfs3_delmap },
269 	/* no separate nfs3_dump */
270 	VOPNAME_DUMP,		{ .vop_dump = nfs_dump },
271 	VOPNAME_PATHCONF,	{ .vop_pathconf = nfs3_pathconf },
272 	VOPNAME_PAGEIO,		{ .vop_pageio = nfs3_pageio },
273 	VOPNAME_DISPOSE,	{ .vop_dispose = nfs3_dispose },
274 	VOPNAME_SETSECATTR,	{ .vop_setsecattr = nfs3_setsecattr },
275 	VOPNAME_GETSECATTR,	{ .vop_getsecattr = nfs3_getsecattr },
276 	VOPNAME_SHRLOCK,	{ .vop_shrlock = nfs3_shrlock },
277 	VOPNAME_VNEVENT, 	{ .vop_vnevent = fs_vnevent_support },
278 	NULL,			NULL
279 };
280 
281 /*
282  * XXX:  This is referenced in modstubs.s
283  */
284 struct vnodeops *
285 nfs3_getvnodeops(void)
286 {
287 	return (nfs3_vnodeops);
288 }
289 
290 /* ARGSUSED */
291 static int
292 nfs3_open(vnode_t **vpp, int flag, cred_t *cr, caller_context_t *ct)
293 {
294 	int error;
295 	struct vattr va;
296 	rnode_t *rp;
297 	vnode_t *vp;
298 
299 	vp = *vpp;
300 	if (nfs_zone() != VTOMI(vp)->mi_zone)
301 		return (EIO);
302 	rp = VTOR(vp);
303 	mutex_enter(&rp->r_statelock);
304 	if (rp->r_cred == NULL) {
305 		crhold(cr);
306 		rp->r_cred = cr;
307 	}
308 	mutex_exit(&rp->r_statelock);
309 
310 	/*
311 	 * If there is no cached data or if close-to-open
312 	 * consistency checking is turned off, we can avoid
313 	 * the over the wire getattr.  Otherwise, if the
314 	 * file system is mounted readonly, then just verify
315 	 * the caches are up to date using the normal mechanism.
316 	 * Else, if the file is not mmap'd, then just mark
317 	 * the attributes as timed out.  They will be refreshed
318 	 * and the caches validated prior to being used.
319 	 * Else, the file system is mounted writeable so
320 	 * force an over the wire GETATTR in order to ensure
321 	 * that all cached data is valid.
322 	 */
323 	if (vp->v_count > 1 ||
324 	    ((vn_has_cached_data(vp) || HAVE_RDDIR_CACHE(rp)) &&
325 	    !(VTOMI(vp)->mi_flags & MI_NOCTO))) {
326 		if (vn_is_readonly(vp))
327 			error = nfs3_validate_caches(vp, cr);
328 		else if (rp->r_mapcnt == 0 && vp->v_count == 1) {
329 			PURGE_ATTRCACHE(vp);
330 			error = 0;
331 		} else {
332 			va.va_mask = AT_ALL;
333 			error = nfs3_getattr_otw(vp, &va, cr);
334 		}
335 	} else
336 		error = 0;
337 
338 	return (error);
339 }
340 
341 /* ARGSUSED */
342 static int
343 nfs3_close(vnode_t *vp, int flag, int count, offset_t offset, cred_t *cr,
344 		caller_context_t *ct)
345 {
346 	rnode_t *rp;
347 	int error;
348 	struct vattr va;
349 
350 	/*
351 	 * zone_enter(2) prevents processes from changing zones with NFS files
352 	 * open; if we happen to get here from the wrong zone we can't do
353 	 * anything over the wire.
354 	 */
355 	if (VTOMI(vp)->mi_zone != nfs_zone()) {
356 		/*
357 		 * We could attempt to clean up locks, except we're sure
358 		 * that the current process didn't acquire any locks on
359 		 * the file: any attempt to lock a file belong to another zone
360 		 * will fail, and one can't lock an NFS file and then change
361 		 * zones, as that fails too.
362 		 *
363 		 * Returning an error here is the sane thing to do.  A
364 		 * subsequent call to VN_RELE() which translates to a
365 		 * nfs3_inactive() will clean up state: if the zone of the
366 		 * vnode's origin is still alive and kicking, an async worker
367 		 * thread will handle the request (from the correct zone), and
368 		 * everything (minus the commit and final nfs3_getattr_otw()
369 		 * call) should be OK. If the zone is going away
370 		 * nfs_async_inactive() will throw away cached pages inline.
371 		 */
372 		return (EIO);
373 	}
374 
375 	/*
376 	 * If we are using local locking for this filesystem, then
377 	 * release all of the SYSV style record locks.  Otherwise,
378 	 * we are doing network locking and we need to release all
379 	 * of the network locks.  All of the locks held by this
380 	 * process on this file are released no matter what the
381 	 * incoming reference count is.
382 	 */
383 	if (VTOMI(vp)->mi_flags & MI_LLOCK) {
384 		cleanlocks(vp, ttoproc(curthread)->p_pid, 0);
385 		cleanshares(vp, ttoproc(curthread)->p_pid);
386 	} else
387 		nfs_lockrelease(vp, flag, offset, cr);
388 
389 	if (count > 1)
390 		return (0);
391 
392 	/*
393 	 * If the file has been `unlinked', then purge the
394 	 * DNLC so that this vnode will get reycled quicker
395 	 * and the .nfs* file on the server will get removed.
396 	 */
397 	rp = VTOR(vp);
398 	if (rp->r_unldvp != NULL)
399 		dnlc_purge_vp(vp);
400 
401 	/*
402 	 * If the file was open for write and there are pages,
403 	 * then if the file system was mounted using the "no-close-
404 	 *	to-open" semantics, then start an asynchronous flush
405 	 *	of the all of the pages in the file.
406 	 * else the file system was not mounted using the "no-close-
407 	 *	to-open" semantics, then do a synchronous flush and
408 	 *	commit of all of the dirty and uncommitted pages.
409 	 *
410 	 * The asynchronous flush of the pages in the "nocto" path
411 	 * mostly just associates a cred pointer with the rnode so
412 	 * writes which happen later will have a better chance of
413 	 * working.  It also starts the data being written to the
414 	 * server, but without unnecessarily delaying the application.
415 	 */
416 	if ((flag & FWRITE) && vn_has_cached_data(vp)) {
417 		if (VTOMI(vp)->mi_flags & MI_NOCTO) {
418 			error = nfs3_putpage(vp, (offset_t)0, 0, B_ASYNC,
419 			    cr, ct);
420 			if (error == EAGAIN)
421 				error = 0;
422 		} else
423 			error = nfs3_putpage_commit(vp, (offset_t)0, 0, cr);
424 		if (!error) {
425 			mutex_enter(&rp->r_statelock);
426 			error = rp->r_error;
427 			rp->r_error = 0;
428 			mutex_exit(&rp->r_statelock);
429 		}
430 	} else {
431 		mutex_enter(&rp->r_statelock);
432 		error = rp->r_error;
433 		rp->r_error = 0;
434 		mutex_exit(&rp->r_statelock);
435 	}
436 
437 	/*
438 	 * If RWRITEATTR is set, then issue an over the wire GETATTR to
439 	 * refresh the attribute cache with a set of attributes which
440 	 * weren't returned from a WRITE.  This will enable the close-
441 	 * to-open processing to work.
442 	 */
443 	if (rp->r_flags & RWRITEATTR)
444 		(void) nfs3_getattr_otw(vp, &va, cr);
445 
446 	return (error);
447 }
448 
449 /* ARGSUSED */
450 static int
451 nfs3_directio_read(vnode_t *vp, struct uio *uiop, cred_t *cr)
452 {
453 	mntinfo_t *mi;
454 	READ3args args;
455 	READ3uiores res;
456 	int tsize;
457 	offset_t offset;
458 	ssize_t count;
459 	int error;
460 	int douprintf;
461 	failinfo_t fi;
462 	char *sv_hostname;
463 
464 	mi = VTOMI(vp);
465 	ASSERT(nfs_zone() == VTOMI(vp)->mi_zone);
466 	sv_hostname = VTOR(vp)->r_server->sv_hostname;
467 
468 	douprintf = 1;
469 	args.file = *VTOFH3(vp);
470 	fi.vp = vp;
471 	fi.fhp = (caddr_t)&args.file;
472 	fi.copyproc = nfs3copyfh;
473 	fi.lookupproc = nfs3lookup;
474 	fi.xattrdirproc = acl_getxattrdir3;
475 
476 	res.uiop = uiop;
477 
478 	res.wlist = NULL;
479 
480 	offset = uiop->uio_loffset;
481 	count = uiop->uio_resid;
482 
483 	do {
484 		if (mi->mi_io_kstats) {
485 			mutex_enter(&mi->mi_lock);
486 			kstat_runq_enter(KSTAT_IO_PTR(mi->mi_io_kstats));
487 			mutex_exit(&mi->mi_lock);
488 		}
489 
490 		do {
491 			tsize = MIN(mi->mi_tsize, count);
492 			args.offset = (offset3)offset;
493 			args.count = (count3)tsize;
494 			res.size = (uint_t)tsize;
495 			args.res_uiop = uiop;
496 			args.res_data_val_alt = NULL;
497 
498 			error = rfs3call(mi, NFSPROC3_READ,
499 			    xdr_READ3args, (caddr_t)&args,
500 			    xdr_READ3uiores, (caddr_t)&res, cr,
501 			    &douprintf, &res.status, 0, &fi);
502 		} while (error == ENFS_TRYAGAIN);
503 
504 		if (mi->mi_io_kstats) {
505 			mutex_enter(&mi->mi_lock);
506 			kstat_runq_exit(KSTAT_IO_PTR(mi->mi_io_kstats));
507 			mutex_exit(&mi->mi_lock);
508 		}
509 
510 		if (error)
511 			return (error);
512 
513 		error = geterrno3(res.status);
514 		if (error)
515 			return (error);
516 
517 		if (res.count != res.size) {
518 			zcmn_err(getzoneid(), CE_WARN,
519 "nfs3_directio_read: server %s returned incorrect amount",
520 			    sv_hostname);
521 			return (EIO);
522 		}
523 		count -= res.count;
524 		offset += res.count;
525 		if (mi->mi_io_kstats) {
526 			mutex_enter(&mi->mi_lock);
527 			KSTAT_IO_PTR(mi->mi_io_kstats)->reads++;
528 			KSTAT_IO_PTR(mi->mi_io_kstats)->nread += res.count;
529 			mutex_exit(&mi->mi_lock);
530 		}
531 		lwp_stat_update(LWP_STAT_INBLK, 1);
532 	} while (count && !res.eof);
533 
534 	return (0);
535 }
536 
537 /* ARGSUSED */
538 static int
539 nfs3_read(vnode_t *vp, struct uio *uiop, int ioflag, cred_t *cr,
540 	caller_context_t *ct)
541 {
542 	rnode_t *rp;
543 	u_offset_t off;
544 	offset_t diff;
545 	int on;
546 	size_t n;
547 	caddr_t base;
548 	uint_t flags;
549 	int error = 0;
550 	mntinfo_t *mi;
551 
552 	rp = VTOR(vp);
553 	mi = VTOMI(vp);
554 
555 	ASSERT(nfs_rw_lock_held(&rp->r_rwlock, RW_READER));
556 
557 	if (nfs_zone() != mi->mi_zone)
558 		return (EIO);
559 
560 	if (vp->v_type != VREG)
561 		return (EISDIR);
562 
563 	if (uiop->uio_resid == 0)
564 		return (0);
565 
566 	if (uiop->uio_loffset < 0 || uiop->uio_loffset + uiop->uio_resid < 0)
567 		return (EINVAL);
568 
569 	/*
570 	 * Bypass VM if caching has been disabled (e.g., locking) or if
571 	 * using client-side direct I/O and the file is not mmap'd and
572 	 * there are no cached pages.
573 	 */
574 	if ((vp->v_flag & VNOCACHE) ||
575 	    (((rp->r_flags & RDIRECTIO) || (mi->mi_flags & MI_DIRECTIO)) &&
576 	    rp->r_mapcnt == 0 && rp->r_inmap == 0 &&
577 	    !vn_has_cached_data(vp))) {
578 		return (nfs3_directio_read(vp, uiop, cr));
579 	}
580 
581 	do {
582 		off = uiop->uio_loffset & MAXBMASK; /* mapping offset */
583 		on = uiop->uio_loffset & MAXBOFFSET; /* Relative offset */
584 		n = MIN(MAXBSIZE - on, uiop->uio_resid);
585 
586 		error = nfs3_validate_caches(vp, cr);
587 		if (error)
588 			break;
589 
590 		mutex_enter(&rp->r_statelock);
591 		while (rp->r_flags & RINCACHEPURGE) {
592 			if (!cv_wait_sig(&rp->r_cv, &rp->r_statelock)) {
593 				mutex_exit(&rp->r_statelock);
594 				return (EINTR);
595 			}
596 		}
597 		diff = rp->r_size - uiop->uio_loffset;
598 		mutex_exit(&rp->r_statelock);
599 		if (diff <= 0)
600 			break;
601 		if (diff < n)
602 			n = (size_t)diff;
603 
604 		if (vpm_enable) {
605 			/*
606 			 * Copy data.
607 			 */
608 			error = vpm_data_copy(vp, off + on, n, uiop,
609 			    1, NULL, 0, S_READ);
610 		} else {
611 			base = segmap_getmapflt(segkmap, vp, off + on, n, 1,
612 			    S_READ);
613 
614 			error = uiomove(base + on, n, UIO_READ, uiop);
615 		}
616 
617 		if (!error) {
618 			/*
619 			 * If read a whole block or read to eof,
620 			 * won't need this buffer again soon.
621 			 */
622 			mutex_enter(&rp->r_statelock);
623 			if (n + on == MAXBSIZE ||
624 			    uiop->uio_loffset == rp->r_size)
625 				flags = SM_DONTNEED;
626 			else
627 				flags = 0;
628 			mutex_exit(&rp->r_statelock);
629 			if (vpm_enable) {
630 				error = vpm_sync_pages(vp, off, n, flags);
631 			} else {
632 				error = segmap_release(segkmap, base, flags);
633 			}
634 		} else {
635 			if (vpm_enable) {
636 				(void) vpm_sync_pages(vp, off, n, 0);
637 			} else {
638 				(void) segmap_release(segkmap, base, 0);
639 			}
640 		}
641 	} while (!error && uiop->uio_resid > 0);
642 
643 	return (error);
644 }
645 
646 /* ARGSUSED */
647 static int
648 nfs3_write(vnode_t *vp, struct uio *uiop, int ioflag, cred_t *cr,
649 	caller_context_t *ct)
650 {
651 	rlim64_t limit = uiop->uio_llimit;
652 	rnode_t *rp;
653 	u_offset_t off;
654 	caddr_t base;
655 	uint_t flags;
656 	int remainder;
657 	size_t n;
658 	int on;
659 	int error;
660 	int resid;
661 	offset_t offset;
662 	mntinfo_t *mi;
663 	uint_t bsize;
664 
665 	rp = VTOR(vp);
666 
667 	if (vp->v_type != VREG)
668 		return (EISDIR);
669 
670 	mi = VTOMI(vp);
671 	if (nfs_zone() != mi->mi_zone)
672 		return (EIO);
673 	if (uiop->uio_resid == 0)
674 		return (0);
675 
676 	if (ioflag & FAPPEND) {
677 		struct vattr va;
678 
679 		/*
680 		 * Must serialize if appending.
681 		 */
682 		if (nfs_rw_lock_held(&rp->r_rwlock, RW_READER)) {
683 			nfs_rw_exit(&rp->r_rwlock);
684 			if (nfs_rw_enter_sig(&rp->r_rwlock, RW_WRITER,
685 			    INTR(vp)))
686 				return (EINTR);
687 		}
688 
689 		va.va_mask = AT_SIZE;
690 		error = nfs3getattr(vp, &va, cr);
691 		if (error)
692 			return (error);
693 		uiop->uio_loffset = va.va_size;
694 	}
695 
696 	offset = uiop->uio_loffset + uiop->uio_resid;
697 
698 	if (uiop->uio_loffset < 0 || offset < 0)
699 		return (EINVAL);
700 
701 	if (limit == RLIM64_INFINITY || limit > MAXOFFSET_T)
702 		limit = MAXOFFSET_T;
703 
704 	/*
705 	 * Check to make sure that the process will not exceed
706 	 * its limit on file size.  It is okay to write up to
707 	 * the limit, but not beyond.  Thus, the write which
708 	 * reaches the limit will be short and the next write
709 	 * will return an error.
710 	 */
711 	remainder = 0;
712 	if (offset > limit) {
713 		remainder = offset - limit;
714 		uiop->uio_resid = limit - uiop->uio_loffset;
715 		if (uiop->uio_resid <= 0) {
716 			proc_t *p = ttoproc(curthread);
717 
718 			uiop->uio_resid += remainder;
719 			mutex_enter(&p->p_lock);
720 			(void) rctl_action(rctlproc_legacy[RLIMIT_FSIZE],
721 			    p->p_rctls, p, RCA_UNSAFE_SIGINFO);
722 			mutex_exit(&p->p_lock);
723 			return (EFBIG);
724 		}
725 	}
726 
727 	if (nfs_rw_enter_sig(&rp->r_lkserlock, RW_READER, INTR(vp)))
728 		return (EINTR);
729 
730 	/*
731 	 * Bypass VM if caching has been disabled (e.g., locking) or if
732 	 * using client-side direct I/O and the file is not mmap'd and
733 	 * there are no cached pages.
734 	 */
735 	if ((vp->v_flag & VNOCACHE) ||
736 	    (((rp->r_flags & RDIRECTIO) || (mi->mi_flags & MI_DIRECTIO)) &&
737 	    rp->r_mapcnt == 0 && rp->r_inmap == 0 &&
738 	    !vn_has_cached_data(vp))) {
739 		size_t bufsize;
740 		int count;
741 		u_offset_t org_offset;
742 		stable_how stab_comm;
743 
744 nfs3_fwrite:
745 		if (rp->r_flags & RSTALE) {
746 			resid = uiop->uio_resid;
747 			offset = uiop->uio_loffset;
748 			error = rp->r_error;
749 			goto bottom;
750 		}
751 		bufsize = MIN(uiop->uio_resid, mi->mi_stsize);
752 		base = kmem_alloc(bufsize, KM_SLEEP);
753 		do {
754 			if (ioflag & FDSYNC)
755 				stab_comm = DATA_SYNC;
756 			else
757 				stab_comm = FILE_SYNC;
758 			resid = uiop->uio_resid;
759 			offset = uiop->uio_loffset;
760 			count = MIN(uiop->uio_resid, bufsize);
761 			org_offset = uiop->uio_loffset;
762 			error = uiomove(base, count, UIO_WRITE, uiop);
763 			if (!error) {
764 				error = nfs3write(vp, base, org_offset,
765 				    count, cr, &stab_comm);
766 			}
767 		} while (!error && uiop->uio_resid > 0);
768 		kmem_free(base, bufsize);
769 		goto bottom;
770 	}
771 
772 
773 	bsize = vp->v_vfsp->vfs_bsize;
774 
775 	do {
776 		off = uiop->uio_loffset & MAXBMASK; /* mapping offset */
777 		on = uiop->uio_loffset & MAXBOFFSET; /* Relative offset */
778 		n = MIN(MAXBSIZE - on, uiop->uio_resid);
779 
780 		resid = uiop->uio_resid;
781 		offset = uiop->uio_loffset;
782 
783 		if (rp->r_flags & RSTALE) {
784 			error = rp->r_error;
785 			break;
786 		}
787 
788 		/*
789 		 * Don't create dirty pages faster than they
790 		 * can be cleaned so that the system doesn't
791 		 * get imbalanced.  If the async queue is
792 		 * maxed out, then wait for it to drain before
793 		 * creating more dirty pages.  Also, wait for
794 		 * any threads doing pagewalks in the vop_getattr
795 		 * entry points so that they don't block for
796 		 * long periods.
797 		 */
798 		mutex_enter(&rp->r_statelock);
799 		while ((mi->mi_max_threads != 0 &&
800 		    rp->r_awcount > 2 * mi->mi_max_threads) ||
801 		    rp->r_gcount > 0)
802 			cv_wait(&rp->r_cv, &rp->r_statelock);
803 		mutex_exit(&rp->r_statelock);
804 
805 		if (vpm_enable) {
806 			/*
807 			 * It will use kpm mappings, so no need to
808 			 * pass an address.
809 			 */
810 			error = writerp(rp, NULL, n, uiop, 0);
811 		} else  {
812 			if (segmap_kpm) {
813 				int pon = uiop->uio_loffset & PAGEOFFSET;
814 				size_t pn = MIN(PAGESIZE - pon,
815 				    uiop->uio_resid);
816 				int pagecreate;
817 
818 				mutex_enter(&rp->r_statelock);
819 				pagecreate = (pon == 0) && (pn == PAGESIZE ||
820 				    uiop->uio_loffset + pn >= rp->r_size);
821 				mutex_exit(&rp->r_statelock);
822 
823 				base = segmap_getmapflt(segkmap, vp, off + on,
824 				    pn, !pagecreate, S_WRITE);
825 
826 				error = writerp(rp, base + pon, n, uiop,
827 				    pagecreate);
828 
829 			} else {
830 				base = segmap_getmapflt(segkmap, vp, off + on,
831 				    n, 0, S_READ);
832 				error = writerp(rp, base + on, n, uiop, 0);
833 			}
834 		}
835 
836 		if (!error) {
837 			if (mi->mi_flags & MI_NOAC)
838 				flags = SM_WRITE;
839 			else if ((uiop->uio_loffset % bsize) == 0 ||
840 			    IS_SWAPVP(vp)) {
841 				/*
842 				 * Have written a whole block.
843 				 * Start an asynchronous write
844 				 * and mark the buffer to
845 				 * indicate that it won't be
846 				 * needed again soon.
847 				 */
848 				flags = SM_WRITE | SM_ASYNC | SM_DONTNEED;
849 			} else
850 				flags = 0;
851 			if ((ioflag & (FSYNC|FDSYNC)) ||
852 			    (rp->r_flags & ROUTOFSPACE)) {
853 				flags &= ~SM_ASYNC;
854 				flags |= SM_WRITE;
855 			}
856 			if (vpm_enable) {
857 				error = vpm_sync_pages(vp, off, n, flags);
858 			} else {
859 				error = segmap_release(segkmap, base, flags);
860 			}
861 		} else {
862 			if (vpm_enable) {
863 				(void) vpm_sync_pages(vp, off, n, 0);
864 			} else {
865 				(void) segmap_release(segkmap, base, 0);
866 			}
867 			/*
868 			 * In the event that we got an access error while
869 			 * faulting in a page for a write-only file just
870 			 * force a write.
871 			 */
872 			if (error == EACCES)
873 				goto nfs3_fwrite;
874 		}
875 	} while (!error && uiop->uio_resid > 0);
876 
877 bottom:
878 	if (error) {
879 		uiop->uio_resid = resid + remainder;
880 		uiop->uio_loffset = offset;
881 	} else
882 		uiop->uio_resid += remainder;
883 
884 	nfs_rw_exit(&rp->r_lkserlock);
885 
886 	return (error);
887 }
888 
889 /*
890  * Flags are composed of {B_ASYNC, B_INVAL, B_FREE, B_DONTNEED}
891  */
892 static int
893 nfs3_rdwrlbn(vnode_t *vp, page_t *pp, u_offset_t off, size_t len,
894 	int flags, cred_t *cr)
895 {
896 	struct buf *bp;
897 	int error;
898 	page_t *savepp;
899 	uchar_t fsdata;
900 	stable_how stab_comm;
901 
902 	ASSERT(nfs_zone() == VTOMI(vp)->mi_zone);
903 	bp = pageio_setup(pp, len, vp, flags);
904 	ASSERT(bp != NULL);
905 
906 	/*
907 	 * pageio_setup should have set b_addr to 0.  This
908 	 * is correct since we want to do I/O on a page
909 	 * boundary.  bp_mapin will use this addr to calculate
910 	 * an offset, and then set b_addr to the kernel virtual
911 	 * address it allocated for us.
912 	 */
913 	ASSERT(bp->b_un.b_addr == 0);
914 
915 	bp->b_edev = 0;
916 	bp->b_dev = 0;
917 	bp->b_lblkno = lbtodb(off);
918 	bp->b_file = vp;
919 	bp->b_offset = (offset_t)off;
920 	bp_mapin(bp);
921 
922 	/*
923 	 * Calculate the desired level of stability to write data
924 	 * on the server and then mark all of the pages to reflect
925 	 * this.
926 	 */
927 	if ((flags & (B_WRITE|B_ASYNC)) == (B_WRITE|B_ASYNC) &&
928 	    freemem > desfree) {
929 		stab_comm = UNSTABLE;
930 		fsdata = C_DELAYCOMMIT;
931 	} else {
932 		stab_comm = FILE_SYNC;
933 		fsdata = C_NOCOMMIT;
934 	}
935 
936 	savepp = pp;
937 	do {
938 		pp->p_fsdata = fsdata;
939 	} while ((pp = pp->p_next) != savepp);
940 
941 	error = nfs3_bio(bp, &stab_comm, cr);
942 
943 	bp_mapout(bp);
944 	pageio_done(bp);
945 
946 	/*
947 	 * If the server wrote pages in a more stable fashion than
948 	 * was requested, then clear all of the marks in the pages
949 	 * indicating that COMMIT operations were required.
950 	 */
951 	if (stab_comm != UNSTABLE && fsdata == C_DELAYCOMMIT) {
952 		do {
953 			pp->p_fsdata = C_NOCOMMIT;
954 		} while ((pp = pp->p_next) != savepp);
955 	}
956 
957 	return (error);
958 }
959 
960 /*
961  * Write to file.  Writes to remote server in largest size
962  * chunks that the server can handle.  Write is synchronous.
963  */
964 static int
965 nfs3write(vnode_t *vp, caddr_t base, u_offset_t offset, int count, cred_t *cr,
966 	stable_how *stab_comm)
967 {
968 	mntinfo_t *mi;
969 	WRITE3args args;
970 	WRITE3res res;
971 	int error;
972 	int tsize;
973 	rnode_t *rp;
974 	int douprintf;
975 
976 	rp = VTOR(vp);
977 	mi = VTOMI(vp);
978 
979 	ASSERT(nfs_zone() == mi->mi_zone);
980 
981 	args.file = *VTOFH3(vp);
982 	args.stable = *stab_comm;
983 
984 	*stab_comm = FILE_SYNC;
985 
986 	douprintf = 1;
987 
988 	do {
989 		if ((vp->v_flag & VNOCACHE) ||
990 		    (rp->r_flags & RDIRECTIO) ||
991 		    (mi->mi_flags & MI_DIRECTIO))
992 			tsize = MIN(mi->mi_stsize, count);
993 		else
994 			tsize = MIN(mi->mi_curwrite, count);
995 		args.offset = (offset3)offset;
996 		args.count = (count3)tsize;
997 		args.data.data_len = (uint_t)tsize;
998 		args.data.data_val = base;
999 
1000 		if (mi->mi_io_kstats) {
1001 			mutex_enter(&mi->mi_lock);
1002 			kstat_runq_enter(KSTAT_IO_PTR(mi->mi_io_kstats));
1003 			mutex_exit(&mi->mi_lock);
1004 		}
1005 		args.mblk = NULL;
1006 		do {
1007 			error = rfs3call(mi, NFSPROC3_WRITE,
1008 			    xdr_WRITE3args, (caddr_t)&args,
1009 			    xdr_WRITE3res, (caddr_t)&res, cr,
1010 			    &douprintf, &res.status, 0, NULL);
1011 		} while (error == ENFS_TRYAGAIN);
1012 		if (mi->mi_io_kstats) {
1013 			mutex_enter(&mi->mi_lock);
1014 			kstat_runq_exit(KSTAT_IO_PTR(mi->mi_io_kstats));
1015 			mutex_exit(&mi->mi_lock);
1016 		}
1017 
1018 		if (error)
1019 			return (error);
1020 		error = geterrno3(res.status);
1021 		if (!error) {
1022 			if (res.resok.count > args.count) {
1023 				zcmn_err(getzoneid(), CE_WARN,
1024 				    "nfs3write: server %s wrote %u, "
1025 				    "requested was %u",
1026 				    rp->r_server->sv_hostname,
1027 				    res.resok.count, args.count);
1028 				return (EIO);
1029 			}
1030 			if (res.resok.committed == UNSTABLE) {
1031 				*stab_comm = UNSTABLE;
1032 				if (args.stable == DATA_SYNC ||
1033 				    args.stable == FILE_SYNC) {
1034 					zcmn_err(getzoneid(), CE_WARN,
1035 			"nfs3write: server %s did not commit to stable storage",
1036 					    rp->r_server->sv_hostname);
1037 					return (EIO);
1038 				}
1039 			}
1040 			tsize = (int)res.resok.count;
1041 			count -= tsize;
1042 			base += tsize;
1043 			offset += tsize;
1044 			if (mi->mi_io_kstats) {
1045 				mutex_enter(&mi->mi_lock);
1046 				KSTAT_IO_PTR(mi->mi_io_kstats)->writes++;
1047 				KSTAT_IO_PTR(mi->mi_io_kstats)->nwritten +=
1048 				    tsize;
1049 				mutex_exit(&mi->mi_lock);
1050 			}
1051 			lwp_stat_update(LWP_STAT_OUBLK, 1);
1052 			mutex_enter(&rp->r_statelock);
1053 			if (rp->r_flags & RHAVEVERF) {
1054 				if (rp->r_verf != res.resok.verf) {
1055 					nfs3_set_mod(vp);
1056 					rp->r_verf = res.resok.verf;
1057 					/*
1058 					 * If the data was written UNSTABLE,
1059 					 * then might as well stop because
1060 					 * the whole block will have to get
1061 					 * rewritten anyway.
1062 					 */
1063 					if (*stab_comm == UNSTABLE) {
1064 						mutex_exit(&rp->r_statelock);
1065 						break;
1066 					}
1067 				}
1068 			} else {
1069 				rp->r_verf = res.resok.verf;
1070 				rp->r_flags |= RHAVEVERF;
1071 			}
1072 			/*
1073 			 * Mark the attribute cache as timed out and
1074 			 * set RWRITEATTR to indicate that the file
1075 			 * was modified with a WRITE operation and
1076 			 * that the attributes can not be trusted.
1077 			 */
1078 			PURGE_ATTRCACHE_LOCKED(rp);
1079 			rp->r_flags |= RWRITEATTR;
1080 			mutex_exit(&rp->r_statelock);
1081 		}
1082 	} while (!error && count);
1083 
1084 	return (error);
1085 }
1086 
1087 /*
1088  * Read from a file.  Reads data in largest chunks our interface can handle.
1089  */
1090 static int
1091 nfs3read(vnode_t *vp, caddr_t base, offset_t offset, int count,
1092 	size_t *residp, cred_t *cr)
1093 {
1094 	mntinfo_t *mi;
1095 	READ3args args;
1096 	READ3vres res;
1097 	int tsize;
1098 	int error;
1099 	int douprintf;
1100 	failinfo_t fi;
1101 	rnode_t *rp;
1102 	struct vattr va;
1103 	hrtime_t t;
1104 
1105 	rp = VTOR(vp);
1106 	mi = VTOMI(vp);
1107 	ASSERT(nfs_zone() == mi->mi_zone);
1108 	douprintf = 1;
1109 
1110 	args.file = *VTOFH3(vp);
1111 	fi.vp = vp;
1112 	fi.fhp = (caddr_t)&args.file;
1113 	fi.copyproc = nfs3copyfh;
1114 	fi.lookupproc = nfs3lookup;
1115 	fi.xattrdirproc = acl_getxattrdir3;
1116 
1117 	res.pov.fres.vp = vp;
1118 	res.pov.fres.vap = &va;
1119 
1120 	res.wlist = NULL;
1121 	*residp = count;
1122 	do {
1123 		if (mi->mi_io_kstats) {
1124 			mutex_enter(&mi->mi_lock);
1125 			kstat_runq_enter(KSTAT_IO_PTR(mi->mi_io_kstats));
1126 			mutex_exit(&mi->mi_lock);
1127 		}
1128 
1129 		do {
1130 			if ((vp->v_flag & VNOCACHE) ||
1131 			    (rp->r_flags & RDIRECTIO) ||
1132 			    (mi->mi_flags & MI_DIRECTIO))
1133 				tsize = MIN(mi->mi_tsize, count);
1134 			else
1135 				tsize = MIN(mi->mi_curread, count);
1136 			res.data.data_val = base;
1137 			res.data.data_len = tsize;
1138 			args.offset = (offset3)offset;
1139 			args.count = (count3)tsize;
1140 			args.res_uiop = NULL;
1141 			args.res_data_val_alt = base;
1142 
1143 			t = gethrtime();
1144 			error = rfs3call(mi, NFSPROC3_READ,
1145 			    xdr_READ3args, (caddr_t)&args,
1146 			    xdr_READ3vres, (caddr_t)&res, cr,
1147 			    &douprintf, &res.status, 0, &fi);
1148 		} while (error == ENFS_TRYAGAIN);
1149 
1150 		if (mi->mi_io_kstats) {
1151 			mutex_enter(&mi->mi_lock);
1152 			kstat_runq_exit(KSTAT_IO_PTR(mi->mi_io_kstats));
1153 			mutex_exit(&mi->mi_lock);
1154 		}
1155 
1156 		if (error)
1157 			return (error);
1158 
1159 		error = geterrno3(res.status);
1160 		if (error)
1161 			return (error);
1162 
1163 		if (res.count != res.data.data_len) {
1164 			zcmn_err(getzoneid(), CE_WARN,
1165 			    "nfs3read: server %s returned incorrect amount",
1166 			    rp->r_server->sv_hostname);
1167 			return (EIO);
1168 		}
1169 
1170 		count -= res.count;
1171 		*residp = count;
1172 		base += res.count;
1173 		offset += res.count;
1174 		if (mi->mi_io_kstats) {
1175 			mutex_enter(&mi->mi_lock);
1176 			KSTAT_IO_PTR(mi->mi_io_kstats)->reads++;
1177 			KSTAT_IO_PTR(mi->mi_io_kstats)->nread += res.count;
1178 			mutex_exit(&mi->mi_lock);
1179 		}
1180 		lwp_stat_update(LWP_STAT_INBLK, 1);
1181 	} while (count && !res.eof);
1182 
1183 	if (res.pov.attributes) {
1184 		mutex_enter(&rp->r_statelock);
1185 		if (!CACHE_VALID(rp, va.va_mtime, va.va_size)) {
1186 			mutex_exit(&rp->r_statelock);
1187 			PURGE_ATTRCACHE(vp);
1188 		} else {
1189 			if (rp->r_mtime <= t)
1190 				nfs_attrcache_va(vp, &va);
1191 			mutex_exit(&rp->r_statelock);
1192 		}
1193 	}
1194 
1195 	return (0);
1196 }
1197 
1198 /* ARGSUSED */
1199 static int
1200 nfs3_ioctl(vnode_t *vp, int cmd, intptr_t arg, int flag, cred_t *cr, int *rvalp,
1201 	caller_context_t *ct)
1202 {
1203 
1204 	if (nfs_zone() != VTOMI(vp)->mi_zone)
1205 		return (EIO);
1206 	switch (cmd) {
1207 		case _FIODIRECTIO:
1208 			return (nfs_directio(vp, (int)arg, cr));
1209 		default:
1210 			return (ENOTTY);
1211 	}
1212 }
1213 
1214 /* ARGSUSED */
1215 static int
1216 nfs3_getattr(vnode_t *vp, struct vattr *vap, int flags, cred_t *cr,
1217 	caller_context_t *ct)
1218 {
1219 	int error;
1220 	rnode_t *rp;
1221 
1222 	if (nfs_zone() != VTOMI(vp)->mi_zone)
1223 		return (EIO);
1224 	/*
1225 	 * If it has been specified that the return value will
1226 	 * just be used as a hint, and we are only being asked
1227 	 * for size, fsid or rdevid, then return the client's
1228 	 * notion of these values without checking to make sure
1229 	 * that the attribute cache is up to date.
1230 	 * The whole point is to avoid an over the wire GETATTR
1231 	 * call.
1232 	 */
1233 	rp = VTOR(vp);
1234 	if (flags & ATTR_HINT) {
1235 		if (vap->va_mask ==
1236 		    (vap->va_mask & (AT_SIZE | AT_FSID | AT_RDEV))) {
1237 			mutex_enter(&rp->r_statelock);
1238 			if (vap->va_mask | AT_SIZE)
1239 				vap->va_size = rp->r_size;
1240 			if (vap->va_mask | AT_FSID)
1241 				vap->va_fsid = rp->r_attr.va_fsid;
1242 			if (vap->va_mask | AT_RDEV)
1243 				vap->va_rdev = rp->r_attr.va_rdev;
1244 			mutex_exit(&rp->r_statelock);
1245 			return (0);
1246 		}
1247 	}
1248 
1249 	/*
1250 	 * Only need to flush pages if asking for the mtime
1251 	 * and if there any dirty pages or any outstanding
1252 	 * asynchronous (write) requests for this file.
1253 	 */
1254 	if (vap->va_mask & AT_MTIME) {
1255 		if (vn_has_cached_data(vp) &&
1256 		    ((rp->r_flags & RDIRTY) || rp->r_awcount > 0)) {
1257 			mutex_enter(&rp->r_statelock);
1258 			rp->r_gcount++;
1259 			mutex_exit(&rp->r_statelock);
1260 			error = nfs3_putpage(vp, (offset_t)0, 0, 0, cr, ct);
1261 			mutex_enter(&rp->r_statelock);
1262 			if (error && (error == ENOSPC || error == EDQUOT)) {
1263 				if (!rp->r_error)
1264 					rp->r_error = error;
1265 			}
1266 			if (--rp->r_gcount == 0)
1267 				cv_broadcast(&rp->r_cv);
1268 			mutex_exit(&rp->r_statelock);
1269 		}
1270 	}
1271 
1272 	return (nfs3getattr(vp, vap, cr));
1273 }
1274 
1275 /*ARGSUSED4*/
1276 static int
1277 nfs3_setattr(vnode_t *vp, struct vattr *vap, int flags, cred_t *cr,
1278 		caller_context_t *ct)
1279 {
1280 	int error;
1281 	struct vattr va;
1282 
1283 	if (vap->va_mask & AT_NOSET)
1284 		return (EINVAL);
1285 	if (nfs_zone() != VTOMI(vp)->mi_zone)
1286 		return (EIO);
1287 
1288 	va.va_mask = AT_UID | AT_MODE;
1289 	error = nfs3getattr(vp, &va, cr);
1290 	if (error)
1291 		return (error);
1292 
1293 	error = secpolicy_vnode_setattr(cr, vp, vap, &va, flags, nfs3_accessx,
1294 	    vp);
1295 	if (error)
1296 		return (error);
1297 
1298 	return (nfs3setattr(vp, vap, flags, cr));
1299 }
1300 
1301 static int
1302 nfs3setattr(vnode_t *vp, struct vattr *vap, int flags, cred_t *cr)
1303 {
1304 	int error;
1305 	uint_t mask;
1306 	SETATTR3args args;
1307 	SETATTR3res res;
1308 	int douprintf;
1309 	rnode_t *rp;
1310 	struct vattr va;
1311 	mode_t omode;
1312 	vsecattr_t *vsp;
1313 	hrtime_t t;
1314 
1315 	ASSERT(nfs_zone() == VTOMI(vp)->mi_zone);
1316 	mask = vap->va_mask;
1317 
1318 	rp = VTOR(vp);
1319 
1320 	/*
1321 	 * Only need to flush pages if there are any pages and
1322 	 * if the file is marked as dirty in some fashion.  The
1323 	 * file must be flushed so that we can accurately
1324 	 * determine the size of the file and the cached data
1325 	 * after the SETATTR returns.  A file is considered to
1326 	 * be dirty if it is either marked with RDIRTY, has
1327 	 * outstanding i/o's active, or is mmap'd.  In this
1328 	 * last case, we can't tell whether there are dirty
1329 	 * pages, so we flush just to be sure.
1330 	 */
1331 	if (vn_has_cached_data(vp) &&
1332 	    ((rp->r_flags & RDIRTY) ||
1333 	    rp->r_count > 0 ||
1334 	    rp->r_mapcnt > 0)) {
1335 		ASSERT(vp->v_type != VCHR);
1336 		error = nfs3_putpage(vp, (offset_t)0, 0, 0, cr, NULL);
1337 		if (error && (error == ENOSPC || error == EDQUOT)) {
1338 			mutex_enter(&rp->r_statelock);
1339 			if (!rp->r_error)
1340 				rp->r_error = error;
1341 			mutex_exit(&rp->r_statelock);
1342 		}
1343 	}
1344 
1345 	args.object = *RTOFH3(rp);
1346 	/*
1347 	 * If the intent is for the server to set the times,
1348 	 * there is no point in have the mask indicating set mtime or
1349 	 * atime, because the vap values may be junk, and so result
1350 	 * in an overflow error. Remove these flags from the vap mask
1351 	 * before calling in this case, and restore them afterwards.
1352 	 */
1353 	if ((mask & (AT_ATIME | AT_MTIME)) && !(flags & ATTR_UTIME)) {
1354 		/* Use server times, so don't set the args time fields */
1355 		vap->va_mask &= ~(AT_ATIME | AT_MTIME);
1356 		error = vattr_to_sattr3(vap, &args.new_attributes);
1357 		vap->va_mask |= (mask & (AT_ATIME | AT_MTIME));
1358 		if (mask & AT_ATIME) {
1359 			args.new_attributes.atime.set_it = SET_TO_SERVER_TIME;
1360 		}
1361 		if (mask & AT_MTIME) {
1362 			args.new_attributes.mtime.set_it = SET_TO_SERVER_TIME;
1363 		}
1364 	} else {
1365 		/* Either do not set times or use the client specified times */
1366 		error = vattr_to_sattr3(vap, &args.new_attributes);
1367 	}
1368 
1369 	if (error) {
1370 		/* req time field(s) overflow - return immediately */
1371 		return (error);
1372 	}
1373 
1374 	va.va_mask = AT_MODE | AT_CTIME;
1375 	error = nfs3getattr(vp, &va, cr);
1376 	if (error)
1377 		return (error);
1378 	omode = va.va_mode;
1379 
1380 tryagain:
1381 	if (mask & AT_SIZE) {
1382 		args.guard.check = TRUE;
1383 		args.guard.obj_ctime.seconds = va.va_ctime.tv_sec;
1384 		args.guard.obj_ctime.nseconds = va.va_ctime.tv_nsec;
1385 	} else
1386 		args.guard.check = FALSE;
1387 
1388 	douprintf = 1;
1389 
1390 	t = gethrtime();
1391 
1392 	error = rfs3call(VTOMI(vp), NFSPROC3_SETATTR,
1393 	    xdr_SETATTR3args, (caddr_t)&args,
1394 	    xdr_SETATTR3res, (caddr_t)&res, cr,
1395 	    &douprintf, &res.status, 0, NULL);
1396 
1397 	/*
1398 	 * Purge the access cache and ACL cache if changing either the
1399 	 * owner of the file, the group owner, or the mode.  These may
1400 	 * change the access permissions of the file, so purge old
1401 	 * information and start over again.
1402 	 */
1403 	if (mask & (AT_UID | AT_GID | AT_MODE)) {
1404 		(void) nfs_access_purge_rp(rp);
1405 		if (rp->r_secattr != NULL) {
1406 			mutex_enter(&rp->r_statelock);
1407 			vsp = rp->r_secattr;
1408 			rp->r_secattr = NULL;
1409 			mutex_exit(&rp->r_statelock);
1410 			if (vsp != NULL)
1411 				nfs_acl_free(vsp);
1412 		}
1413 	}
1414 
1415 	if (error) {
1416 		PURGE_ATTRCACHE(vp);
1417 		return (error);
1418 	}
1419 
1420 	error = geterrno3(res.status);
1421 	if (!error) {
1422 		/*
1423 		 * If changing the size of the file, invalidate
1424 		 * any local cached data which is no longer part
1425 		 * of the file.  We also possibly invalidate the
1426 		 * last page in the file.  We could use
1427 		 * pvn_vpzero(), but this would mark the page as
1428 		 * modified and require it to be written back to
1429 		 * the server for no particularly good reason.
1430 		 * This way, if we access it, then we bring it
1431 		 * back in.  A read should be cheaper than a
1432 		 * write.
1433 		 */
1434 		if (mask & AT_SIZE) {
1435 			nfs_invalidate_pages(vp,
1436 			    (vap->va_size & PAGEMASK), cr);
1437 		}
1438 		nfs3_cache_wcc_data(vp, &res.resok.obj_wcc, t, cr);
1439 		/*
1440 		 * Some servers will change the mode to clear the setuid
1441 		 * and setgid bits when changing the uid or gid.  The
1442 		 * client needs to compensate appropriately.
1443 		 */
1444 		if (mask & (AT_UID | AT_GID)) {
1445 			int terror;
1446 
1447 			va.va_mask = AT_MODE;
1448 			terror = nfs3getattr(vp, &va, cr);
1449 			if (!terror &&
1450 			    (((mask & AT_MODE) && va.va_mode != vap->va_mode) ||
1451 			    (!(mask & AT_MODE) && va.va_mode != omode))) {
1452 				va.va_mask = AT_MODE;
1453 				if (mask & AT_MODE)
1454 					va.va_mode = vap->va_mode;
1455 				else
1456 					va.va_mode = omode;
1457 				(void) nfs3setattr(vp, &va, 0, cr);
1458 			}
1459 		}
1460 	} else {
1461 		nfs3_cache_wcc_data(vp, &res.resfail.obj_wcc, t, cr);
1462 		/*
1463 		 * If we got back a "not synchronized" error, then
1464 		 * we need to retry with a new guard value.  The
1465 		 * guard value used is the change time.  If the
1466 		 * server returned post_op_attr, then we can just
1467 		 * retry because we have the latest attributes.
1468 		 * Otherwise, we issue a GETATTR to get the latest
1469 		 * attributes and then retry.  If we couldn't get
1470 		 * the attributes this way either, then we give
1471 		 * up because we can't complete the operation as
1472 		 * required.
1473 		 */
1474 		if (res.status == NFS3ERR_NOT_SYNC) {
1475 			va.va_mask = AT_CTIME;
1476 			if (nfs3getattr(vp, &va, cr) == 0)
1477 				goto tryagain;
1478 		}
1479 		PURGE_STALE_FH(error, vp, cr);
1480 	}
1481 
1482 	return (error);
1483 }
1484 
1485 static int
1486 nfs3_accessx(void *vp, int mode, cred_t *cr)
1487 {
1488 	ASSERT(nfs_zone() == VTOMI((vnode_t *)vp)->mi_zone);
1489 	return (nfs3_access(vp, mode, 0, cr, NULL));
1490 }
1491 
1492 /* ARGSUSED */
1493 static int
1494 nfs3_access(vnode_t *vp, int mode, int flags, cred_t *cr, caller_context_t *ct)
1495 {
1496 	int error;
1497 	ACCESS3args args;
1498 	ACCESS3res res;
1499 	int douprintf;
1500 	uint32 acc;
1501 	rnode_t *rp;
1502 	cred_t *cred, *ncr, *ncrfree = NULL;
1503 	failinfo_t fi;
1504 	nfs_access_type_t cacc;
1505 	hrtime_t t;
1506 
1507 	acc = 0;
1508 	if (nfs_zone() != VTOMI(vp)->mi_zone)
1509 		return (EIO);
1510 	if (mode & VREAD)
1511 		acc |= ACCESS3_READ;
1512 	if (mode & VWRITE) {
1513 		if (vn_is_readonly(vp) && !IS_DEVVP(vp))
1514 			return (EROFS);
1515 		if (vp->v_type == VDIR)
1516 			acc |= ACCESS3_DELETE;
1517 		acc |= ACCESS3_MODIFY | ACCESS3_EXTEND;
1518 	}
1519 	if (mode & VEXEC) {
1520 		if (vp->v_type == VDIR)
1521 			acc |= ACCESS3_LOOKUP;
1522 		else
1523 			acc |= ACCESS3_EXECUTE;
1524 	}
1525 
1526 	rp = VTOR(vp);
1527 	args.object = *VTOFH3(vp);
1528 	if (vp->v_type == VDIR) {
1529 		args.access = ACCESS3_READ | ACCESS3_DELETE | ACCESS3_MODIFY |
1530 		    ACCESS3_EXTEND | ACCESS3_LOOKUP;
1531 	} else {
1532 		args.access = ACCESS3_READ | ACCESS3_MODIFY | ACCESS3_EXTEND |
1533 		    ACCESS3_EXECUTE;
1534 	}
1535 	fi.vp = vp;
1536 	fi.fhp = (caddr_t)&args.object;
1537 	fi.copyproc = nfs3copyfh;
1538 	fi.lookupproc = nfs3lookup;
1539 	fi.xattrdirproc = acl_getxattrdir3;
1540 
1541 	cred = cr;
1542 	/*
1543 	 * ncr and ncrfree both initially
1544 	 * point to the memory area returned
1545 	 * by crnetadjust();
1546 	 * ncrfree not NULL when exiting means
1547 	 * that we need to release it
1548 	 */
1549 	ncr = crnetadjust(cred);
1550 	ncrfree = ncr;
1551 tryagain:
1552 	if (rp->r_acache != NULL) {
1553 		cacc = nfs_access_check(rp, acc, cred);
1554 		if (cacc == NFS_ACCESS_ALLOWED) {
1555 			if (ncrfree != NULL)
1556 				crfree(ncrfree);
1557 			return (0);
1558 		}
1559 		if (cacc == NFS_ACCESS_DENIED) {
1560 			/*
1561 			 * If the cred can be adjusted, try again
1562 			 * with the new cred.
1563 			 */
1564 			if (ncr != NULL) {
1565 				cred = ncr;
1566 				ncr = NULL;
1567 				goto tryagain;
1568 			}
1569 			if (ncrfree != NULL)
1570 				crfree(ncrfree);
1571 			return (EACCES);
1572 		}
1573 	}
1574 
1575 	douprintf = 1;
1576 
1577 	t = gethrtime();
1578 
1579 	error = rfs3call(VTOMI(vp), NFSPROC3_ACCESS,
1580 	    xdr_ACCESS3args, (caddr_t)&args,
1581 	    xdr_ACCESS3res, (caddr_t)&res, cred,
1582 	    &douprintf, &res.status, 0, &fi);
1583 
1584 	if (error) {
1585 		if (ncrfree != NULL)
1586 			crfree(ncrfree);
1587 		return (error);
1588 	}
1589 
1590 	error = geterrno3(res.status);
1591 	if (!error) {
1592 		nfs3_cache_post_op_attr(vp, &res.resok.obj_attributes, t, cr);
1593 		nfs_access_cache(rp, args.access, res.resok.access, cred);
1594 		/*
1595 		 * we just cached results with cred; if cred is the
1596 		 * adjusted credentials from crnetadjust, we do not want
1597 		 * to release them before exiting: hence setting ncrfree
1598 		 * to NULL
1599 		 */
1600 		if (cred != cr)
1601 			ncrfree = NULL;
1602 		if ((acc & res.resok.access) != acc) {
1603 			/*
1604 			 * If the cred can be adjusted, try again
1605 			 * with the new cred.
1606 			 */
1607 			if (ncr != NULL) {
1608 				cred = ncr;
1609 				ncr = NULL;
1610 				goto tryagain;
1611 			}
1612 			error = EACCES;
1613 		}
1614 	} else {
1615 		nfs3_cache_post_op_attr(vp, &res.resfail.obj_attributes, t, cr);
1616 		PURGE_STALE_FH(error, vp, cr);
1617 	}
1618 
1619 	if (ncrfree != NULL)
1620 		crfree(ncrfree);
1621 
1622 	return (error);
1623 }
1624 
1625 static int nfs3_do_symlink_cache = 1;
1626 
1627 /* ARGSUSED */
1628 static int
1629 nfs3_readlink(vnode_t *vp, struct uio *uiop, cred_t *cr, caller_context_t *ct)
1630 {
1631 	int error;
1632 	READLINK3args args;
1633 	READLINK3res res;
1634 	nfspath3 resdata_backup;
1635 	rnode_t *rp;
1636 	int douprintf;
1637 	int len;
1638 	failinfo_t fi;
1639 	hrtime_t t;
1640 
1641 	/*
1642 	 * Can't readlink anything other than a symbolic link.
1643 	 */
1644 	if (vp->v_type != VLNK)
1645 		return (EINVAL);
1646 	if (nfs_zone() != VTOMI(vp)->mi_zone)
1647 		return (EIO);
1648 
1649 	rp = VTOR(vp);
1650 	if (nfs3_do_symlink_cache && rp->r_symlink.contents != NULL) {
1651 		error = nfs3_validate_caches(vp, cr);
1652 		if (error)
1653 			return (error);
1654 		mutex_enter(&rp->r_statelock);
1655 		if (rp->r_symlink.contents != NULL) {
1656 			error = uiomove(rp->r_symlink.contents,
1657 			    rp->r_symlink.len, UIO_READ, uiop);
1658 			mutex_exit(&rp->r_statelock);
1659 			return (error);
1660 		}
1661 		mutex_exit(&rp->r_statelock);
1662 	}
1663 
1664 	args.symlink = *VTOFH3(vp);
1665 	fi.vp = vp;
1666 	fi.fhp = (caddr_t)&args.symlink;
1667 	fi.copyproc = nfs3copyfh;
1668 	fi.lookupproc = nfs3lookup;
1669 	fi.xattrdirproc = acl_getxattrdir3;
1670 
1671 	res.resok.data = kmem_alloc(MAXPATHLEN, KM_SLEEP);
1672 
1673 	resdata_backup = res.resok.data;
1674 
1675 	douprintf = 1;
1676 
1677 	t = gethrtime();
1678 
1679 	error = rfs3call(VTOMI(vp), NFSPROC3_READLINK,
1680 	    xdr_READLINK3args, (caddr_t)&args,
1681 	    xdr_READLINK3res, (caddr_t)&res, cr,
1682 	    &douprintf, &res.status, 0, &fi);
1683 
1684 	if (res.resok.data == nfs3nametoolong)
1685 		error = EINVAL;
1686 
1687 	if (error) {
1688 		kmem_free(resdata_backup, MAXPATHLEN);
1689 		return (error);
1690 	}
1691 
1692 	error = geterrno3(res.status);
1693 	if (!error) {
1694 		nfs3_cache_post_op_attr(vp, &res.resok.symlink_attributes, t,
1695 		    cr);
1696 		len = strlen(res.resok.data);
1697 		error = uiomove(res.resok.data, len, UIO_READ, uiop);
1698 		if (nfs3_do_symlink_cache && rp->r_symlink.contents == NULL) {
1699 			mutex_enter(&rp->r_statelock);
1700 				if (rp->r_symlink.contents == NULL) {
1701 				rp->r_symlink.contents = res.resok.data;
1702 				rp->r_symlink.len = len;
1703 				rp->r_symlink.size = MAXPATHLEN;
1704 				mutex_exit(&rp->r_statelock);
1705 			} else {
1706 				mutex_exit(&rp->r_statelock);
1707 
1708 				kmem_free((void *)res.resok.data, MAXPATHLEN);
1709 			}
1710 		} else {
1711 			kmem_free((void *)res.resok.data, MAXPATHLEN);
1712 		}
1713 	} else {
1714 		nfs3_cache_post_op_attr(vp,
1715 		    &res.resfail.symlink_attributes, t, cr);
1716 		PURGE_STALE_FH(error, vp, cr);
1717 
1718 		kmem_free((void *)res.resok.data, MAXPATHLEN);
1719 
1720 	}
1721 
1722 	/*
1723 	 * The over the wire error for attempting to readlink something
1724 	 * other than a symbolic link is ENXIO.  However, we need to
1725 	 * return EINVAL instead of ENXIO, so we map it here.
1726 	 */
1727 	return (error == ENXIO ? EINVAL : error);
1728 }
1729 
1730 /*
1731  * Flush local dirty pages to stable storage on the server.
1732  *
1733  * If FNODSYNC is specified, then there is nothing to do because
1734  * metadata changes are not cached on the client before being
1735  * sent to the server.
1736  */
1737 /* ARGSUSED */
1738 static int
1739 nfs3_fsync(vnode_t *vp, int syncflag, cred_t *cr, caller_context_t *ct)
1740 {
1741 	int error;
1742 
1743 	if ((syncflag & FNODSYNC) || IS_SWAPVP(vp))
1744 		return (0);
1745 	if (nfs_zone() != VTOMI(vp)->mi_zone)
1746 		return (EIO);
1747 
1748 	error = nfs3_putpage_commit(vp, (offset_t)0, 0, cr);
1749 	if (!error)
1750 		error = VTOR(vp)->r_error;
1751 	return (error);
1752 }
1753 
1754 /*
1755  * Weirdness: if the file was removed or the target of a rename
1756  * operation while it was open, it got renamed instead.  Here we
1757  * remove the renamed file.
1758  */
1759 /* ARGSUSED */
1760 static void
1761 nfs3_inactive(vnode_t *vp, cred_t *cr, caller_context_t *ct)
1762 {
1763 	rnode_t *rp;
1764 
1765 	ASSERT(vp != DNLC_NO_VNODE);
1766 
1767 	/*
1768 	 * If this is coming from the wrong zone, we let someone in the right
1769 	 * zone take care of it asynchronously.  We can get here due to
1770 	 * VN_RELE() being called from pageout() or fsflush().  This call may
1771 	 * potentially turn into an expensive no-op if, for instance, v_count
1772 	 * gets incremented in the meantime, but it's still correct.
1773 	 */
1774 	if (nfs_zone() != VTOMI(vp)->mi_zone) {
1775 		nfs_async_inactive(vp, cr, nfs3_inactive);
1776 		return;
1777 	}
1778 
1779 	rp = VTOR(vp);
1780 redo:
1781 	if (rp->r_unldvp != NULL) {
1782 		/*
1783 		 * Save the vnode pointer for the directory where the
1784 		 * unlinked-open file got renamed, then set it to NULL
1785 		 * to prevent another thread from getting here before
1786 		 * we're done with the remove.  While we have the
1787 		 * statelock, make local copies of the pertinent rnode
1788 		 * fields.  If we weren't to do this in an atomic way, the
1789 		 * the unl* fields could become inconsistent with respect
1790 		 * to each other due to a race condition between this
1791 		 * code and nfs_remove().  See bug report 1034328.
1792 		 */
1793 		mutex_enter(&rp->r_statelock);
1794 		if (rp->r_unldvp != NULL) {
1795 			vnode_t *unldvp;
1796 			char *unlname;
1797 			cred_t *unlcred;
1798 			REMOVE3args args;
1799 			REMOVE3res res;
1800 			int douprintf;
1801 			int error;
1802 			hrtime_t t;
1803 
1804 			unldvp = rp->r_unldvp;
1805 			rp->r_unldvp = NULL;
1806 			unlname = rp->r_unlname;
1807 			rp->r_unlname = NULL;
1808 			unlcred = rp->r_unlcred;
1809 			rp->r_unlcred = NULL;
1810 			mutex_exit(&rp->r_statelock);
1811 
1812 			/*
1813 			 * If there are any dirty pages left, then flush
1814 			 * them.  This is unfortunate because they just
1815 			 * may get thrown away during the remove operation,
1816 			 * but we have to do this for correctness.
1817 			 */
1818 			if (vn_has_cached_data(vp) &&
1819 			    ((rp->r_flags & RDIRTY) || rp->r_count > 0)) {
1820 				ASSERT(vp->v_type != VCHR);
1821 				error = nfs3_putpage(vp, (offset_t)0, 0, 0,
1822 				    cr, ct);
1823 				if (error) {
1824 					mutex_enter(&rp->r_statelock);
1825 					if (!rp->r_error)
1826 						rp->r_error = error;
1827 					mutex_exit(&rp->r_statelock);
1828 				}
1829 			}
1830 
1831 			/*
1832 			 * Do the remove operation on the renamed file
1833 			 */
1834 			setdiropargs3(&args.object, unlname, unldvp);
1835 
1836 			douprintf = 1;
1837 
1838 			t = gethrtime();
1839 
1840 			error = rfs3call(VTOMI(unldvp), NFSPROC3_REMOVE,
1841 			    xdr_diropargs3, (caddr_t)&args,
1842 			    xdr_REMOVE3res, (caddr_t)&res, unlcred,
1843 			    &douprintf, &res.status, 0, NULL);
1844 
1845 			if (error) {
1846 				PURGE_ATTRCACHE(unldvp);
1847 			} else {
1848 				error = geterrno3(res.status);
1849 				if (!error) {
1850 					nfs3_cache_wcc_data(unldvp,
1851 					    &res.resok.dir_wcc, t, cr);
1852 					if (HAVE_RDDIR_CACHE(VTOR(unldvp)))
1853 						nfs_purge_rddir_cache(unldvp);
1854 				} else {
1855 					nfs3_cache_wcc_data(unldvp,
1856 					    &res.resfail.dir_wcc, t, cr);
1857 					PURGE_STALE_FH(error, unldvp, cr);
1858 				}
1859 			}
1860 
1861 			/*
1862 			 * Release stuff held for the remove
1863 			 */
1864 			VN_RELE(unldvp);
1865 			kmem_free(unlname, MAXNAMELEN);
1866 			crfree(unlcred);
1867 			goto redo;
1868 		}
1869 		mutex_exit(&rp->r_statelock);
1870 	}
1871 
1872 	rp_addfree(rp, cr);
1873 }
1874 
1875 /*
1876  * Remote file system operations having to do with directory manipulation.
1877  */
1878 
1879 /* ARGSUSED */
1880 static int
1881 nfs3_lookup(vnode_t *dvp, char *nm, vnode_t **vpp, struct pathname *pnp,
1882 	int flags, vnode_t *rdir, cred_t *cr, caller_context_t *ct,
1883 	int *direntflags, pathname_t *realpnp)
1884 {
1885 	int error;
1886 	vnode_t *vp;
1887 	vnode_t *avp = NULL;
1888 	rnode_t *drp;
1889 
1890 	if (nfs_zone() != VTOMI(dvp)->mi_zone)
1891 		return (EPERM);
1892 
1893 	drp = VTOR(dvp);
1894 
1895 	/*
1896 	 * Are we looking up extended attributes?  If so, "dvp" is
1897 	 * the file or directory for which we want attributes, and
1898 	 * we need a lookup of the hidden attribute directory
1899 	 * before we lookup the rest of the path.
1900 	 */
1901 	if (flags & LOOKUP_XATTR) {
1902 		bool_t cflag = ((flags & CREATE_XATTR_DIR) != 0);
1903 		mntinfo_t *mi;
1904 
1905 		mi = VTOMI(dvp);
1906 		if (!(mi->mi_flags & MI_EXTATTR))
1907 			return (EINVAL);
1908 
1909 		if (nfs_rw_enter_sig(&drp->r_rwlock, RW_READER, INTR(dvp)))
1910 			return (EINTR);
1911 
1912 		(void) nfs3lookup_dnlc(dvp, XATTR_DIR_NAME, &avp, cr);
1913 		if (avp == NULL)
1914 			error = acl_getxattrdir3(dvp, &avp, cflag, cr, 0);
1915 		else
1916 			error = 0;
1917 
1918 		nfs_rw_exit(&drp->r_rwlock);
1919 
1920 		if (error) {
1921 			if (mi->mi_flags & MI_EXTATTR)
1922 				return (error);
1923 			return (EINVAL);
1924 		}
1925 		dvp = avp;
1926 		drp = VTOR(dvp);
1927 	}
1928 
1929 	if (nfs_rw_enter_sig(&drp->r_rwlock, RW_READER, INTR(dvp))) {
1930 		error = EINTR;
1931 		goto out;
1932 	}
1933 
1934 	error = nfs3lookup(dvp, nm, vpp, pnp, flags, rdir, cr, 0);
1935 
1936 	nfs_rw_exit(&drp->r_rwlock);
1937 
1938 	/*
1939 	 * If vnode is a device, create special vnode.
1940 	 */
1941 	if (!error && IS_DEVVP(*vpp)) {
1942 		vp = *vpp;
1943 		*vpp = specvp(vp, vp->v_rdev, vp->v_type, cr);
1944 		VN_RELE(vp);
1945 	}
1946 
1947 out:
1948 	if (avp != NULL)
1949 		VN_RELE(avp);
1950 
1951 	return (error);
1952 }
1953 
1954 static int nfs3_lookup_neg_cache = 1;
1955 
1956 #ifdef DEBUG
1957 static int nfs3_lookup_dnlc_hits = 0;
1958 static int nfs3_lookup_dnlc_misses = 0;
1959 static int nfs3_lookup_dnlc_neg_hits = 0;
1960 static int nfs3_lookup_dnlc_disappears = 0;
1961 static int nfs3_lookup_dnlc_lookups = 0;
1962 #endif
1963 
1964 /* ARGSUSED */
1965 int
1966 nfs3lookup(vnode_t *dvp, char *nm, vnode_t **vpp, struct pathname *pnp,
1967 	int flags, vnode_t *rdir, cred_t *cr, int rfscall_flags)
1968 {
1969 	int error;
1970 	rnode_t *drp;
1971 
1972 	ASSERT(nfs_zone() == VTOMI(dvp)->mi_zone);
1973 	/*
1974 	 * If lookup is for "", just return dvp.  Don't need
1975 	 * to send it over the wire, look it up in the dnlc,
1976 	 * or perform any access checks.
1977 	 */
1978 	if (*nm == '\0') {
1979 		VN_HOLD(dvp);
1980 		*vpp = dvp;
1981 		return (0);
1982 	}
1983 
1984 	/*
1985 	 * Can't do lookups in non-directories.
1986 	 */
1987 	if (dvp->v_type != VDIR)
1988 		return (ENOTDIR);
1989 
1990 	/*
1991 	 * If we're called with RFSCALL_SOFT, it's important that
1992 	 * the only rfscall is one we make directly; if we permit
1993 	 * an access call because we're looking up "." or validating
1994 	 * a dnlc hit, we'll deadlock because that rfscall will not
1995 	 * have the RFSCALL_SOFT set.
1996 	 */
1997 	if (rfscall_flags & RFSCALL_SOFT)
1998 		goto callit;
1999 
2000 	/*
2001 	 * If lookup is for ".", just return dvp.  Don't need
2002 	 * to send it over the wire or look it up in the dnlc,
2003 	 * just need to check access.
2004 	 */
2005 	if (strcmp(nm, ".") == 0) {
2006 		error = nfs3_access(dvp, VEXEC, 0, cr, NULL);
2007 		if (error)
2008 			return (error);
2009 		VN_HOLD(dvp);
2010 		*vpp = dvp;
2011 		return (0);
2012 	}
2013 
2014 	drp = VTOR(dvp);
2015 	if (!(drp->r_flags & RLOOKUP)) {
2016 		mutex_enter(&drp->r_statelock);
2017 		drp->r_flags |= RLOOKUP;
2018 		mutex_exit(&drp->r_statelock);
2019 	}
2020 
2021 	/*
2022 	 * Lookup this name in the DNLC.  If there was a valid entry,
2023 	 * then return the results of the lookup.
2024 	 */
2025 	error = nfs3lookup_dnlc(dvp, nm, vpp, cr);
2026 	if (error || *vpp != NULL)
2027 		return (error);
2028 
2029 callit:
2030 	error = nfs3lookup_otw(dvp, nm, vpp, cr, rfscall_flags);
2031 
2032 	return (error);
2033 }
2034 
2035 static int
2036 nfs3lookup_dnlc(vnode_t *dvp, char *nm, vnode_t **vpp, cred_t *cr)
2037 {
2038 	int error;
2039 	vnode_t *vp;
2040 
2041 	ASSERT(*nm != '\0');
2042 	ASSERT(nfs_zone() == VTOMI(dvp)->mi_zone);
2043 	/*
2044 	 * Lookup this name in the DNLC.  If successful, then validate
2045 	 * the caches and then recheck the DNLC.  The DNLC is rechecked
2046 	 * just in case this entry got invalidated during the call
2047 	 * to nfs3_validate_caches.
2048 	 *
2049 	 * An assumption is being made that it is safe to say that a
2050 	 * file exists which may not on the server.  Any operations to
2051 	 * the server will fail with ESTALE.
2052 	 */
2053 #ifdef DEBUG
2054 	nfs3_lookup_dnlc_lookups++;
2055 #endif
2056 	vp = dnlc_lookup(dvp, nm);
2057 	if (vp != NULL) {
2058 		VN_RELE(vp);
2059 		if (vp == DNLC_NO_VNODE && !vn_is_readonly(dvp)) {
2060 			PURGE_ATTRCACHE(dvp);
2061 		}
2062 		error = nfs3_validate_caches(dvp, cr);
2063 		if (error)
2064 			return (error);
2065 		vp = dnlc_lookup(dvp, nm);
2066 		if (vp != NULL) {
2067 			error = nfs3_access(dvp, VEXEC, 0, cr, NULL);
2068 			if (error) {
2069 				VN_RELE(vp);
2070 				return (error);
2071 			}
2072 			if (vp == DNLC_NO_VNODE) {
2073 				VN_RELE(vp);
2074 #ifdef DEBUG
2075 				nfs3_lookup_dnlc_neg_hits++;
2076 #endif
2077 				return (ENOENT);
2078 			}
2079 			*vpp = vp;
2080 #ifdef DEBUG
2081 			nfs3_lookup_dnlc_hits++;
2082 #endif
2083 			return (0);
2084 		}
2085 #ifdef DEBUG
2086 		nfs3_lookup_dnlc_disappears++;
2087 #endif
2088 	}
2089 #ifdef DEBUG
2090 	else
2091 		nfs3_lookup_dnlc_misses++;
2092 #endif
2093 
2094 	*vpp = NULL;
2095 
2096 	return (0);
2097 }
2098 
2099 static int
2100 nfs3lookup_otw(vnode_t *dvp, char *nm, vnode_t **vpp, cred_t *cr,
2101 	int rfscall_flags)
2102 {
2103 	int error;
2104 	LOOKUP3args args;
2105 	LOOKUP3vres res;
2106 	int douprintf;
2107 	struct vattr vattr;
2108 	struct vattr dvattr;
2109 	vnode_t *vp;
2110 	failinfo_t fi;
2111 	hrtime_t t;
2112 
2113 	ASSERT(*nm != '\0');
2114 	ASSERT(dvp->v_type == VDIR);
2115 	ASSERT(nfs_zone() == VTOMI(dvp)->mi_zone);
2116 
2117 	setdiropargs3(&args.what, nm, dvp);
2118 
2119 	fi.vp = dvp;
2120 	fi.fhp = (caddr_t)&args.what.dir;
2121 	fi.copyproc = nfs3copyfh;
2122 	fi.lookupproc = nfs3lookup;
2123 	fi.xattrdirproc = acl_getxattrdir3;
2124 	res.obj_attributes.fres.vp = dvp;
2125 	res.obj_attributes.fres.vap = &vattr;
2126 	res.dir_attributes.fres.vp = dvp;
2127 	res.dir_attributes.fres.vap = &dvattr;
2128 
2129 	douprintf = 1;
2130 
2131 	t = gethrtime();
2132 
2133 	error = rfs3call(VTOMI(dvp), NFSPROC3_LOOKUP,
2134 	    xdr_diropargs3, (caddr_t)&args,
2135 	    xdr_LOOKUP3vres, (caddr_t)&res, cr,
2136 	    &douprintf, &res.status, rfscall_flags, &fi);
2137 
2138 	if (error)
2139 		return (error);
2140 
2141 	nfs3_cache_post_op_vattr(dvp, &res.dir_attributes, t, cr);
2142 
2143 	error = geterrno3(res.status);
2144 	if (error) {
2145 		PURGE_STALE_FH(error, dvp, cr);
2146 		if (error == ENOENT && nfs3_lookup_neg_cache)
2147 			dnlc_enter(dvp, nm, DNLC_NO_VNODE);
2148 		return (error);
2149 	}
2150 
2151 	if (res.obj_attributes.attributes) {
2152 		vp = makenfs3node_va(&res.object, res.obj_attributes.fres.vap,
2153 		    dvp->v_vfsp, t, cr, VTOR(dvp)->r_path, nm);
2154 	} else {
2155 		vp = makenfs3node_va(&res.object, NULL,
2156 		    dvp->v_vfsp, t, cr, VTOR(dvp)->r_path, nm);
2157 		if (vp->v_type == VNON) {
2158 			vattr.va_mask = AT_TYPE;
2159 			error = nfs3getattr(vp, &vattr, cr);
2160 			if (error) {
2161 				VN_RELE(vp);
2162 				return (error);
2163 			}
2164 			vp->v_type = vattr.va_type;
2165 		}
2166 	}
2167 
2168 	if (!(rfscall_flags & RFSCALL_SOFT))
2169 		dnlc_update(dvp, nm, vp);
2170 
2171 	*vpp = vp;
2172 
2173 	return (error);
2174 }
2175 
2176 #ifdef DEBUG
2177 static int nfs3_create_misses = 0;
2178 #endif
2179 
2180 /* ARGSUSED */
2181 static int
2182 nfs3_create(vnode_t *dvp, char *nm, struct vattr *va, enum vcexcl exclusive,
2183 	int mode, vnode_t **vpp, cred_t *cr, int lfaware, caller_context_t *ct,
2184 	vsecattr_t *vsecp)
2185 {
2186 	int error;
2187 	vnode_t *vp;
2188 	rnode_t *rp;
2189 	struct vattr vattr;
2190 	rnode_t *drp;
2191 	vnode_t *tempvp;
2192 
2193 	drp = VTOR(dvp);
2194 	if (nfs_zone() != VTOMI(dvp)->mi_zone)
2195 		return (EPERM);
2196 	if (nfs_rw_enter_sig(&drp->r_rwlock, RW_WRITER, INTR(dvp)))
2197 		return (EINTR);
2198 
2199 top:
2200 	/*
2201 	 * We make a copy of the attributes because the caller does not
2202 	 * expect us to change what va points to.
2203 	 */
2204 	vattr = *va;
2205 
2206 	/*
2207 	 * If the pathname is "", just use dvp.  Don't need
2208 	 * to send it over the wire, look it up in the dnlc,
2209 	 * or perform any access checks.
2210 	 */
2211 	if (*nm == '\0') {
2212 		error = 0;
2213 		VN_HOLD(dvp);
2214 		vp = dvp;
2215 	/*
2216 	 * If the pathname is ".", just use dvp.  Don't need
2217 	 * to send it over the wire or look it up in the dnlc,
2218 	 * just need to check access.
2219 	 */
2220 	} else if (strcmp(nm, ".") == 0) {
2221 		error = nfs3_access(dvp, VEXEC, 0, cr, ct);
2222 		if (error) {
2223 			nfs_rw_exit(&drp->r_rwlock);
2224 			return (error);
2225 		}
2226 		VN_HOLD(dvp);
2227 		vp = dvp;
2228 	/*
2229 	 * We need to go over the wire, just to be sure whether the
2230 	 * file exists or not.  Using the DNLC can be dangerous in
2231 	 * this case when making a decision regarding existence.
2232 	 */
2233 	} else {
2234 		error = nfs3lookup_otw(dvp, nm, &vp, cr, 0);
2235 	}
2236 	if (!error) {
2237 		if (exclusive == EXCL)
2238 			error = EEXIST;
2239 		else if (vp->v_type == VDIR && (mode & VWRITE))
2240 			error = EISDIR;
2241 		else {
2242 			/*
2243 			 * If vnode is a device, create special vnode.
2244 			 */
2245 			if (IS_DEVVP(vp)) {
2246 				tempvp = vp;
2247 				vp = specvp(vp, vp->v_rdev, vp->v_type, cr);
2248 				VN_RELE(tempvp);
2249 			}
2250 			if (!(error = VOP_ACCESS(vp, mode, 0, cr, ct))) {
2251 				if ((vattr.va_mask & AT_SIZE) &&
2252 				    vp->v_type == VREG) {
2253 					rp = VTOR(vp);
2254 					/*
2255 					 * Check here for large file handled
2256 					 * by LF-unaware process (as
2257 					 * ufs_create() does)
2258 					 */
2259 					if (!(lfaware & FOFFMAX)) {
2260 						mutex_enter(&rp->r_statelock);
2261 						if (rp->r_size > MAXOFF32_T)
2262 							error = EOVERFLOW;
2263 						mutex_exit(&rp->r_statelock);
2264 					}
2265 					if (!error) {
2266 						vattr.va_mask = AT_SIZE;
2267 						error = nfs3setattr(vp,
2268 						    &vattr, 0, cr);
2269 					}
2270 				}
2271 			}
2272 		}
2273 		nfs_rw_exit(&drp->r_rwlock);
2274 		if (error) {
2275 			VN_RELE(vp);
2276 		} else {
2277 			/*
2278 			 * existing file got truncated, notify.
2279 			 */
2280 			vnevent_create(vp, ct);
2281 			*vpp = vp;
2282 		}
2283 		return (error);
2284 	}
2285 
2286 	dnlc_remove(dvp, nm);
2287 
2288 	/*
2289 	 * Decide what the group-id of the created file should be.
2290 	 * Set it in attribute list as advisory...
2291 	 */
2292 	error = setdirgid(dvp, &vattr.va_gid, cr);
2293 	if (error) {
2294 		nfs_rw_exit(&drp->r_rwlock);
2295 		return (error);
2296 	}
2297 	vattr.va_mask |= AT_GID;
2298 
2299 	ASSERT(vattr.va_mask & AT_TYPE);
2300 	if (vattr.va_type == VREG) {
2301 		ASSERT(vattr.va_mask & AT_MODE);
2302 		if (MANDMODE(vattr.va_mode)) {
2303 			nfs_rw_exit(&drp->r_rwlock);
2304 			return (EACCES);
2305 		}
2306 		error = nfs3create(dvp, nm, &vattr, exclusive, mode, vpp, cr,
2307 		    lfaware);
2308 		/*
2309 		 * If this is not an exclusive create, then the CREATE
2310 		 * request will be made with the GUARDED mode set.  This
2311 		 * means that the server will return EEXIST if the file
2312 		 * exists.  The file could exist because of a retransmitted
2313 		 * request.  In this case, we recover by starting over and
2314 		 * checking to see whether the file exists.  This second
2315 		 * time through it should and a CREATE request will not be
2316 		 * sent.
2317 		 *
2318 		 * This handles the problem of a dangling CREATE request
2319 		 * which contains attributes which indicate that the file
2320 		 * should be truncated.  This retransmitted request could
2321 		 * possibly truncate valid data in the file if not caught
2322 		 * by the duplicate request mechanism on the server or if
2323 		 * not caught by other means.  The scenario is:
2324 		 *
2325 		 * Client transmits CREATE request with size = 0
2326 		 * Client times out, retransmits request.
2327 		 * Response to the first request arrives from the server
2328 		 *  and the client proceeds on.
2329 		 * Client writes data to the file.
2330 		 * The server now processes retransmitted CREATE request
2331 		 *  and truncates file.
2332 		 *
2333 		 * The use of the GUARDED CREATE request prevents this from
2334 		 * happening because the retransmitted CREATE would fail
2335 		 * with EEXIST and would not truncate the file.
2336 		 */
2337 		if (error == EEXIST && exclusive == NONEXCL) {
2338 #ifdef DEBUG
2339 			nfs3_create_misses++;
2340 #endif
2341 			goto top;
2342 		}
2343 		nfs_rw_exit(&drp->r_rwlock);
2344 		return (error);
2345 	}
2346 	error = nfs3mknod(dvp, nm, &vattr, exclusive, mode, vpp, cr);
2347 	nfs_rw_exit(&drp->r_rwlock);
2348 	return (error);
2349 }
2350 
2351 /* ARGSUSED */
2352 static int
2353 nfs3create(vnode_t *dvp, char *nm, struct vattr *va, enum vcexcl exclusive,
2354 	int mode, vnode_t **vpp, cred_t *cr, int lfaware)
2355 {
2356 	int error;
2357 	CREATE3args args;
2358 	CREATE3res res;
2359 	int douprintf;
2360 	vnode_t *vp;
2361 	struct vattr vattr;
2362 	nfstime3 *verfp;
2363 	rnode_t *rp;
2364 	timestruc_t now;
2365 	hrtime_t t;
2366 
2367 	ASSERT(nfs_zone() == VTOMI(dvp)->mi_zone);
2368 	setdiropargs3(&args.where, nm, dvp);
2369 	if (exclusive == EXCL) {
2370 		args.how.mode = EXCLUSIVE;
2371 		/*
2372 		 * Construct the create verifier.  This verifier needs
2373 		 * to be unique between different clients.  It also needs
2374 		 * to vary for each exclusive create request generated
2375 		 * from the client to the server.
2376 		 *
2377 		 * The first attempt is made to use the hostid and a
2378 		 * unique number on the client.  If the hostid has not
2379 		 * been set, the high resolution time that the exclusive
2380 		 * create request is being made is used.  This will work
2381 		 * unless two different clients, both with the hostid
2382 		 * not set, attempt an exclusive create request on the
2383 		 * same file, at exactly the same clock time.  The
2384 		 * chances of this happening seem small enough to be
2385 		 * reasonable.
2386 		 */
2387 		verfp = (nfstime3 *)&args.how.createhow3_u.verf;
2388 		verfp->seconds = nfs_atoi(hw_serial);
2389 		if (verfp->seconds != 0)
2390 			verfp->nseconds = newnum();
2391 		else {
2392 			gethrestime(&now);
2393 			verfp->seconds = now.tv_sec;
2394 			verfp->nseconds = now.tv_nsec;
2395 		}
2396 		/*
2397 		 * Since the server will use this value for the mtime,
2398 		 * make sure that it can't overflow. Zero out the MSB.
2399 		 * The actual value does not matter here, only its uniqeness.
2400 		 */
2401 		verfp->seconds %= INT32_MAX;
2402 	} else {
2403 		/*
2404 		 * Issue the non-exclusive create in guarded mode.  This
2405 		 * may result in some false EEXIST responses for
2406 		 * retransmitted requests, but these will be handled at
2407 		 * a higher level.  By using GUARDED, duplicate requests
2408 		 * to do file truncation and possible access problems
2409 		 * can be avoided.
2410 		 */
2411 		args.how.mode = GUARDED;
2412 		error = vattr_to_sattr3(va,
2413 		    &args.how.createhow3_u.obj_attributes);
2414 		if (error) {
2415 			/* req time field(s) overflow - return immediately */
2416 			return (error);
2417 		}
2418 	}
2419 
2420 	douprintf = 1;
2421 
2422 	t = gethrtime();
2423 
2424 	error = rfs3call(VTOMI(dvp), NFSPROC3_CREATE,
2425 	    xdr_CREATE3args, (caddr_t)&args,
2426 	    xdr_CREATE3res, (caddr_t)&res, cr,
2427 	    &douprintf, &res.status, 0, NULL);
2428 
2429 	if (error) {
2430 		PURGE_ATTRCACHE(dvp);
2431 		return (error);
2432 	}
2433 
2434 	error = geterrno3(res.status);
2435 	if (!error) {
2436 		nfs3_cache_wcc_data(dvp, &res.resok.dir_wcc, t, cr);
2437 		if (HAVE_RDDIR_CACHE(VTOR(dvp)))
2438 			nfs_purge_rddir_cache(dvp);
2439 
2440 		/*
2441 		 * On exclusive create the times need to be explicitly
2442 		 * set to clear any potential verifier that may be stored
2443 		 * in one of these fields (see comment below).  This
2444 		 * is done here to cover the case where no post op attrs
2445 		 * were returned or a 'invalid' time was returned in
2446 		 * the attributes.
2447 		 */
2448 		if (exclusive == EXCL)
2449 			va->va_mask |= (AT_MTIME | AT_ATIME);
2450 
2451 		if (!res.resok.obj.handle_follows) {
2452 			error = nfs3lookup(dvp, nm, &vp, NULL, 0, NULL, cr, 0);
2453 			if (error)
2454 				return (error);
2455 		} else {
2456 			if (res.resok.obj_attributes.attributes) {
2457 				vp = makenfs3node(&res.resok.obj.handle,
2458 				    &res.resok.obj_attributes.attr,
2459 				    dvp->v_vfsp, t, cr, NULL, NULL);
2460 			} else {
2461 				vp = makenfs3node(&res.resok.obj.handle, NULL,
2462 				    dvp->v_vfsp, t, cr, NULL, NULL);
2463 
2464 				/*
2465 				 * On an exclusive create, it is possible
2466 				 * that attributes were returned but those
2467 				 * postop attributes failed to decode
2468 				 * properly.  If this is the case,
2469 				 * then most likely the atime or mtime
2470 				 * were invalid for our client; this
2471 				 * is caused by the server storing the
2472 				 * create verifier in one of the time
2473 				 * fields(most likely mtime).
2474 				 * So... we are going to setattr just the
2475 				 * atime/mtime to clear things up.
2476 				 */
2477 				if (exclusive == EXCL) {
2478 					if (error =
2479 					    nfs3excl_create_settimes(vp,
2480 					    va, cr)) {
2481 						/*
2482 						 * Setting the times failed.
2483 						 * Remove the file and return
2484 						 * the error.
2485 						 */
2486 						VN_RELE(vp);
2487 						(void) nfs3_remove(dvp,
2488 						    nm, cr, NULL, 0);
2489 						return (error);
2490 					}
2491 				}
2492 
2493 				/*
2494 				 * This handles the non-exclusive case
2495 				 * and the exclusive case where no post op
2496 				 * attrs were returned.
2497 				 */
2498 				if (vp->v_type == VNON) {
2499 					vattr.va_mask = AT_TYPE;
2500 					error = nfs3getattr(vp, &vattr, cr);
2501 					if (error) {
2502 						VN_RELE(vp);
2503 						return (error);
2504 					}
2505 					vp->v_type = vattr.va_type;
2506 				}
2507 			}
2508 			dnlc_update(dvp, nm, vp);
2509 		}
2510 
2511 		rp = VTOR(vp);
2512 
2513 		/*
2514 		 * Check here for large file handled by
2515 		 * LF-unaware process (as ufs_create() does)
2516 		 */
2517 		if ((va->va_mask & AT_SIZE) && vp->v_type == VREG &&
2518 		    !(lfaware & FOFFMAX)) {
2519 			mutex_enter(&rp->r_statelock);
2520 			if (rp->r_size > MAXOFF32_T) {
2521 				mutex_exit(&rp->r_statelock);
2522 				VN_RELE(vp);
2523 				return (EOVERFLOW);
2524 			}
2525 			mutex_exit(&rp->r_statelock);
2526 		}
2527 
2528 		if (exclusive == EXCL &&
2529 		    (va->va_mask & ~(AT_GID | AT_SIZE))) {
2530 			/*
2531 			 * If doing an exclusive create, then generate
2532 			 * a SETATTR to set the initial attributes.
2533 			 * Try to set the mtime and the atime to the
2534 			 * server's current time.  It is somewhat
2535 			 * expected that these fields will be used to
2536 			 * store the exclusive create cookie.  If not,
2537 			 * server implementors will need to know that
2538 			 * a SETATTR will follow an exclusive create
2539 			 * and the cookie should be destroyed if
2540 			 * appropriate. This work may have been done
2541 			 * earlier in this function if post op attrs
2542 			 * were not available.
2543 			 *
2544 			 * The AT_GID and AT_SIZE bits are turned off
2545 			 * so that the SETATTR request will not attempt
2546 			 * to process these.  The gid will be set
2547 			 * separately if appropriate.  The size is turned
2548 			 * off because it is assumed that a new file will
2549 			 * be created empty and if the file wasn't empty,
2550 			 * then the exclusive create will have failed
2551 			 * because the file must have existed already.
2552 			 * Therefore, no truncate operation is needed.
2553 			 */
2554 			va->va_mask &= ~(AT_GID | AT_SIZE);
2555 			error = nfs3setattr(vp, va, 0, cr);
2556 			if (error) {
2557 				/*
2558 				 * Couldn't correct the attributes of
2559 				 * the newly created file and the
2560 				 * attributes are wrong.  Remove the
2561 				 * file and return an error to the
2562 				 * application.
2563 				 */
2564 				VN_RELE(vp);
2565 				(void) nfs3_remove(dvp, nm, cr, NULL, 0);
2566 				return (error);
2567 			}
2568 		}
2569 
2570 		if (va->va_gid != rp->r_attr.va_gid) {
2571 			/*
2572 			 * If the gid on the file isn't right, then
2573 			 * generate a SETATTR to attempt to change
2574 			 * it.  This may or may not work, depending
2575 			 * upon the server's semantics for allowing
2576 			 * file ownership changes.
2577 			 */
2578 			va->va_mask = AT_GID;
2579 			(void) nfs3setattr(vp, va, 0, cr);
2580 		}
2581 
2582 		/*
2583 		 * If vnode is a device create special vnode
2584 		 */
2585 		if (IS_DEVVP(vp)) {
2586 			*vpp = specvp(vp, vp->v_rdev, vp->v_type, cr);
2587 			VN_RELE(vp);
2588 		} else
2589 			*vpp = vp;
2590 	} else {
2591 		nfs3_cache_wcc_data(dvp, &res.resfail.dir_wcc, t, cr);
2592 		PURGE_STALE_FH(error, dvp, cr);
2593 	}
2594 
2595 	return (error);
2596 }
2597 
2598 /*
2599  * Special setattr function to take care of rest of atime/mtime
2600  * after successful exclusive create.  This function exists to avoid
2601  * handling attributes from the server; exclusive the atime/mtime fields
2602  * may be 'invalid' in client's view and therefore can not be trusted.
2603  */
2604 static int
2605 nfs3excl_create_settimes(vnode_t *vp, struct vattr *vap, cred_t *cr)
2606 {
2607 	int error;
2608 	uint_t mask;
2609 	SETATTR3args args;
2610 	SETATTR3res res;
2611 	int douprintf;
2612 	rnode_t *rp;
2613 	hrtime_t t;
2614 
2615 	ASSERT(nfs_zone() == VTOMI(vp)->mi_zone);
2616 	/* save the caller's mask so that it can be reset later */
2617 	mask = vap->va_mask;
2618 
2619 	rp = VTOR(vp);
2620 
2621 	args.object = *RTOFH3(rp);
2622 	args.guard.check = FALSE;
2623 
2624 	/* Use the mask to initialize the arguments */
2625 	vap->va_mask = 0;
2626 	error = vattr_to_sattr3(vap, &args.new_attributes);
2627 
2628 	/* We want to set just atime/mtime on this request */
2629 	args.new_attributes.atime.set_it = SET_TO_SERVER_TIME;
2630 	args.new_attributes.mtime.set_it = SET_TO_SERVER_TIME;
2631 
2632 	douprintf = 1;
2633 
2634 	t = gethrtime();
2635 
2636 	error = rfs3call(VTOMI(vp), NFSPROC3_SETATTR,
2637 	    xdr_SETATTR3args, (caddr_t)&args,
2638 	    xdr_SETATTR3res, (caddr_t)&res, cr,
2639 	    &douprintf, &res.status, 0, NULL);
2640 
2641 	if (error) {
2642 		vap->va_mask = mask;
2643 		return (error);
2644 	}
2645 
2646 	error = geterrno3(res.status);
2647 	if (!error) {
2648 		/*
2649 		 * It is important to pick up the attributes.
2650 		 * Since this is the exclusive create path, the
2651 		 * attributes on the initial create were ignored
2652 		 * and we need these to have the correct info.
2653 		 */
2654 		nfs3_cache_wcc_data(vp, &res.resok.obj_wcc, t, cr);
2655 		/*
2656 		 * No need to do the atime/mtime work again so clear
2657 		 * the bits.
2658 		 */
2659 		mask &= ~(AT_ATIME | AT_MTIME);
2660 	} else {
2661 		nfs3_cache_wcc_data(vp, &res.resfail.obj_wcc, t, cr);
2662 	}
2663 
2664 	vap->va_mask = mask;
2665 
2666 	return (error);
2667 }
2668 
2669 /* ARGSUSED */
2670 static int
2671 nfs3mknod(vnode_t *dvp, char *nm, struct vattr *va, enum vcexcl exclusive,
2672 	int mode, vnode_t **vpp, cred_t *cr)
2673 {
2674 	int error;
2675 	MKNOD3args args;
2676 	MKNOD3res res;
2677 	int douprintf;
2678 	vnode_t *vp;
2679 	struct vattr vattr;
2680 	hrtime_t t;
2681 
2682 	ASSERT(nfs_zone() == VTOMI(dvp)->mi_zone);
2683 	switch (va->va_type) {
2684 	case VCHR:
2685 	case VBLK:
2686 		setdiropargs3(&args.where, nm, dvp);
2687 		args.what.type = (va->va_type == VCHR) ? NF3CHR : NF3BLK;
2688 		error = vattr_to_sattr3(va,
2689 		    &args.what.mknoddata3_u.device.dev_attributes);
2690 		if (error) {
2691 			/* req time field(s) overflow - return immediately */
2692 			return (error);
2693 		}
2694 		args.what.mknoddata3_u.device.spec.specdata1 =
2695 		    getmajor(va->va_rdev);
2696 		args.what.mknoddata3_u.device.spec.specdata2 =
2697 		    getminor(va->va_rdev);
2698 		break;
2699 
2700 	case VFIFO:
2701 	case VSOCK:
2702 		setdiropargs3(&args.where, nm, dvp);
2703 		args.what.type = (va->va_type == VFIFO) ? NF3FIFO : NF3SOCK;
2704 		error = vattr_to_sattr3(va,
2705 		    &args.what.mknoddata3_u.pipe_attributes);
2706 		if (error) {
2707 			/* req time field(s) overflow - return immediately */
2708 			return (error);
2709 		}
2710 		break;
2711 
2712 	default:
2713 		return (EINVAL);
2714 	}
2715 
2716 	douprintf = 1;
2717 
2718 	t = gethrtime();
2719 
2720 	error = rfs3call(VTOMI(dvp), NFSPROC3_MKNOD,
2721 	    xdr_MKNOD3args, (caddr_t)&args,
2722 	    xdr_MKNOD3res, (caddr_t)&res, cr,
2723 	    &douprintf, &res.status, 0, NULL);
2724 
2725 	if (error) {
2726 		PURGE_ATTRCACHE(dvp);
2727 		return (error);
2728 	}
2729 
2730 	error = geterrno3(res.status);
2731 	if (!error) {
2732 		nfs3_cache_wcc_data(dvp, &res.resok.dir_wcc, t, cr);
2733 		if (HAVE_RDDIR_CACHE(VTOR(dvp)))
2734 			nfs_purge_rddir_cache(dvp);
2735 
2736 		if (!res.resok.obj.handle_follows) {
2737 			error = nfs3lookup(dvp, nm, &vp, NULL, 0, NULL, cr, 0);
2738 			if (error)
2739 				return (error);
2740 		} else {
2741 			if (res.resok.obj_attributes.attributes) {
2742 				vp = makenfs3node(&res.resok.obj.handle,
2743 				    &res.resok.obj_attributes.attr,
2744 				    dvp->v_vfsp, t, cr, NULL, NULL);
2745 			} else {
2746 				vp = makenfs3node(&res.resok.obj.handle, NULL,
2747 				    dvp->v_vfsp, t, cr, NULL, NULL);
2748 				if (vp->v_type == VNON) {
2749 					vattr.va_mask = AT_TYPE;
2750 					error = nfs3getattr(vp, &vattr, cr);
2751 					if (error) {
2752 						VN_RELE(vp);
2753 						return (error);
2754 					}
2755 					vp->v_type = vattr.va_type;
2756 				}
2757 
2758 			}
2759 			dnlc_update(dvp, nm, vp);
2760 		}
2761 
2762 		if (va->va_gid != VTOR(vp)->r_attr.va_gid) {
2763 			va->va_mask = AT_GID;
2764 			(void) nfs3setattr(vp, va, 0, cr);
2765 		}
2766 
2767 		/*
2768 		 * If vnode is a device create special vnode
2769 		 */
2770 		if (IS_DEVVP(vp)) {
2771 			*vpp = specvp(vp, vp->v_rdev, vp->v_type, cr);
2772 			VN_RELE(vp);
2773 		} else
2774 			*vpp = vp;
2775 	} else {
2776 		nfs3_cache_wcc_data(dvp, &res.resfail.dir_wcc, t, cr);
2777 		PURGE_STALE_FH(error, dvp, cr);
2778 	}
2779 	return (error);
2780 }
2781 
2782 /*
2783  * Weirdness: if the vnode to be removed is open
2784  * we rename it instead of removing it and nfs_inactive
2785  * will remove the new name.
2786  */
2787 /* ARGSUSED */
2788 static int
2789 nfs3_remove(vnode_t *dvp, char *nm, cred_t *cr, caller_context_t *ct, int flags)
2790 {
2791 	int error;
2792 	REMOVE3args args;
2793 	REMOVE3res res;
2794 	vnode_t *vp;
2795 	char *tmpname;
2796 	int douprintf;
2797 	rnode_t *rp;
2798 	rnode_t *drp;
2799 	hrtime_t t;
2800 
2801 	if (nfs_zone() != VTOMI(dvp)->mi_zone)
2802 		return (EPERM);
2803 	drp = VTOR(dvp);
2804 	if (nfs_rw_enter_sig(&drp->r_rwlock, RW_WRITER, INTR(dvp)))
2805 		return (EINTR);
2806 
2807 	error = nfs3lookup(dvp, nm, &vp, NULL, 0, NULL, cr, 0);
2808 	if (error) {
2809 		nfs_rw_exit(&drp->r_rwlock);
2810 		return (error);
2811 	}
2812 
2813 	if (vp->v_type == VDIR && secpolicy_fs_linkdir(cr, dvp->v_vfsp)) {
2814 		VN_RELE(vp);
2815 		nfs_rw_exit(&drp->r_rwlock);
2816 		return (EPERM);
2817 	}
2818 
2819 	/*
2820 	 * First just remove the entry from the name cache, as it
2821 	 * is most likely the only entry for this vp.
2822 	 */
2823 	dnlc_remove(dvp, nm);
2824 
2825 	/*
2826 	 * If the file has a v_count > 1 then there may be more than one
2827 	 * entry in the name cache due multiple links or an open file,
2828 	 * but we don't have the real reference count so flush all
2829 	 * possible entries.
2830 	 */
2831 	if (vp->v_count > 1)
2832 		dnlc_purge_vp(vp);
2833 
2834 	/*
2835 	 * Now we have the real reference count on the vnode
2836 	 */
2837 	rp = VTOR(vp);
2838 	mutex_enter(&rp->r_statelock);
2839 	if (vp->v_count > 1 &&
2840 	    (rp->r_unldvp == NULL || strcmp(nm, rp->r_unlname) == 0)) {
2841 		mutex_exit(&rp->r_statelock);
2842 		tmpname = newname();
2843 		error = nfs3rename(dvp, nm, dvp, tmpname, cr, ct);
2844 		if (error)
2845 			kmem_free(tmpname, MAXNAMELEN);
2846 		else {
2847 			mutex_enter(&rp->r_statelock);
2848 			if (rp->r_unldvp == NULL) {
2849 				VN_HOLD(dvp);
2850 				rp->r_unldvp = dvp;
2851 				if (rp->r_unlcred != NULL)
2852 					crfree(rp->r_unlcred);
2853 				crhold(cr);
2854 				rp->r_unlcred = cr;
2855 				rp->r_unlname = tmpname;
2856 			} else {
2857 				kmem_free(rp->r_unlname, MAXNAMELEN);
2858 				rp->r_unlname = tmpname;
2859 			}
2860 			mutex_exit(&rp->r_statelock);
2861 		}
2862 	} else {
2863 		mutex_exit(&rp->r_statelock);
2864 		/*
2865 		 * We need to flush any dirty pages which happen to
2866 		 * be hanging around before removing the file.  This
2867 		 * shouldn't happen very often and mostly on file
2868 		 * systems mounted "nocto".
2869 		 */
2870 		if (vn_has_cached_data(vp) &&
2871 		    ((rp->r_flags & RDIRTY) || rp->r_count > 0)) {
2872 			error = nfs3_putpage(vp, (offset_t)0, 0, 0, cr, ct);
2873 			if (error && (error == ENOSPC || error == EDQUOT)) {
2874 				mutex_enter(&rp->r_statelock);
2875 				if (!rp->r_error)
2876 					rp->r_error = error;
2877 				mutex_exit(&rp->r_statelock);
2878 			}
2879 		}
2880 
2881 		setdiropargs3(&args.object, nm, dvp);
2882 
2883 		douprintf = 1;
2884 
2885 		t = gethrtime();
2886 
2887 		error = rfs3call(VTOMI(dvp), NFSPROC3_REMOVE,
2888 		    xdr_diropargs3, (caddr_t)&args,
2889 		    xdr_REMOVE3res, (caddr_t)&res, cr,
2890 		    &douprintf, &res.status, 0, NULL);
2891 
2892 		/*
2893 		 * The xattr dir may be gone after last attr is removed,
2894 		 * so flush it from dnlc.
2895 		 */
2896 		if (dvp->v_flag & V_XATTRDIR)
2897 			dnlc_purge_vp(dvp);
2898 
2899 		PURGE_ATTRCACHE(vp);
2900 
2901 		if (error) {
2902 			PURGE_ATTRCACHE(dvp);
2903 		} else {
2904 			error = geterrno3(res.status);
2905 			if (!error) {
2906 				nfs3_cache_wcc_data(dvp, &res.resok.dir_wcc, t,
2907 				    cr);
2908 				if (HAVE_RDDIR_CACHE(drp))
2909 					nfs_purge_rddir_cache(dvp);
2910 			} else {
2911 				nfs3_cache_wcc_data(dvp, &res.resfail.dir_wcc,
2912 				    t, cr);
2913 				PURGE_STALE_FH(error, dvp, cr);
2914 			}
2915 		}
2916 	}
2917 
2918 	if (error == 0) {
2919 		vnevent_remove(vp, dvp, nm, ct);
2920 	}
2921 	VN_RELE(vp);
2922 
2923 	nfs_rw_exit(&drp->r_rwlock);
2924 
2925 	return (error);
2926 }
2927 
2928 /* ARGSUSED */
2929 static int
2930 nfs3_link(vnode_t *tdvp, vnode_t *svp, char *tnm, cred_t *cr,
2931 	caller_context_t *ct, int flags)
2932 {
2933 	int error;
2934 	LINK3args args;
2935 	LINK3res res;
2936 	vnode_t *realvp;
2937 	int douprintf;
2938 	mntinfo_t *mi;
2939 	rnode_t *tdrp;
2940 	hrtime_t t;
2941 
2942 	if (nfs_zone() != VTOMI(tdvp)->mi_zone)
2943 		return (EPERM);
2944 	if (VOP_REALVP(svp, &realvp, ct) == 0)
2945 		svp = realvp;
2946 
2947 	mi = VTOMI(svp);
2948 
2949 	if (!(mi->mi_flags & MI_LINK))
2950 		return (EOPNOTSUPP);
2951 
2952 	args.file = *VTOFH3(svp);
2953 	setdiropargs3(&args.link, tnm, tdvp);
2954 
2955 	tdrp = VTOR(tdvp);
2956 	if (nfs_rw_enter_sig(&tdrp->r_rwlock, RW_WRITER, INTR(tdvp)))
2957 		return (EINTR);
2958 
2959 	dnlc_remove(tdvp, tnm);
2960 
2961 	douprintf = 1;
2962 
2963 	t = gethrtime();
2964 
2965 	error = rfs3call(mi, NFSPROC3_LINK,
2966 	    xdr_LINK3args, (caddr_t)&args,
2967 	    xdr_LINK3res, (caddr_t)&res, cr,
2968 	    &douprintf, &res.status, 0, NULL);
2969 
2970 	if (error) {
2971 		PURGE_ATTRCACHE(tdvp);
2972 		PURGE_ATTRCACHE(svp);
2973 		nfs_rw_exit(&tdrp->r_rwlock);
2974 		return (error);
2975 	}
2976 
2977 	error = geterrno3(res.status);
2978 
2979 	if (!error) {
2980 		nfs3_cache_post_op_attr(svp, &res.resok.file_attributes, t, cr);
2981 		nfs3_cache_wcc_data(tdvp, &res.resok.linkdir_wcc, t, cr);
2982 		if (HAVE_RDDIR_CACHE(tdrp))
2983 			nfs_purge_rddir_cache(tdvp);
2984 		dnlc_update(tdvp, tnm, svp);
2985 	} else {
2986 		nfs3_cache_post_op_attr(svp, &res.resfail.file_attributes, t,
2987 		    cr);
2988 		nfs3_cache_wcc_data(tdvp, &res.resfail.linkdir_wcc, t, cr);
2989 		if (error == EOPNOTSUPP) {
2990 			mutex_enter(&mi->mi_lock);
2991 			mi->mi_flags &= ~MI_LINK;
2992 			mutex_exit(&mi->mi_lock);
2993 		}
2994 	}
2995 
2996 	nfs_rw_exit(&tdrp->r_rwlock);
2997 
2998 	if (!error) {
2999 		/*
3000 		 * Notify the source file of this link operation.
3001 		 */
3002 		vnevent_link(svp, ct);
3003 	}
3004 	return (error);
3005 }
3006 
3007 /* ARGSUSED */
3008 static int
3009 nfs3_rename(vnode_t *odvp, char *onm, vnode_t *ndvp, char *nnm, cred_t *cr,
3010 	caller_context_t *ct, int flags)
3011 {
3012 	vnode_t *realvp;
3013 
3014 	if (nfs_zone() != VTOMI(odvp)->mi_zone)
3015 		return (EPERM);
3016 	if (VOP_REALVP(ndvp, &realvp, ct) == 0)
3017 		ndvp = realvp;
3018 
3019 	return (nfs3rename(odvp, onm, ndvp, nnm, cr, ct));
3020 }
3021 
3022 /*
3023  * nfs3rename does the real work of renaming in NFS Version 3.
3024  */
3025 static int
3026 nfs3rename(vnode_t *odvp, char *onm, vnode_t *ndvp, char *nnm, cred_t *cr,
3027     caller_context_t *ct)
3028 {
3029 	int error;
3030 	RENAME3args args;
3031 	RENAME3res res;
3032 	int douprintf;
3033 	vnode_t *nvp = NULL;
3034 	vnode_t *ovp = NULL;
3035 	char *tmpname;
3036 	rnode_t *rp;
3037 	rnode_t *odrp;
3038 	rnode_t *ndrp;
3039 	hrtime_t t;
3040 
3041 	ASSERT(nfs_zone() == VTOMI(odvp)->mi_zone);
3042 
3043 	if (strcmp(onm, ".") == 0 || strcmp(onm, "..") == 0 ||
3044 	    strcmp(nnm, ".") == 0 || strcmp(nnm, "..") == 0)
3045 		return (EINVAL);
3046 
3047 	odrp = VTOR(odvp);
3048 	ndrp = VTOR(ndvp);
3049 	if ((intptr_t)odrp < (intptr_t)ndrp) {
3050 		if (nfs_rw_enter_sig(&odrp->r_rwlock, RW_WRITER, INTR(odvp)))
3051 			return (EINTR);
3052 		if (nfs_rw_enter_sig(&ndrp->r_rwlock, RW_WRITER, INTR(ndvp))) {
3053 			nfs_rw_exit(&odrp->r_rwlock);
3054 			return (EINTR);
3055 		}
3056 	} else {
3057 		if (nfs_rw_enter_sig(&ndrp->r_rwlock, RW_WRITER, INTR(ndvp)))
3058 			return (EINTR);
3059 		if (nfs_rw_enter_sig(&odrp->r_rwlock, RW_WRITER, INTR(odvp))) {
3060 			nfs_rw_exit(&ndrp->r_rwlock);
3061 			return (EINTR);
3062 		}
3063 	}
3064 
3065 	/*
3066 	 * Lookup the target file.  If it exists, it needs to be
3067 	 * checked to see whether it is a mount point and whether
3068 	 * it is active (open).
3069 	 */
3070 	error = nfs3lookup(ndvp, nnm, &nvp, NULL, 0, NULL, cr, 0);
3071 	if (!error) {
3072 		/*
3073 		 * If this file has been mounted on, then just
3074 		 * return busy because renaming to it would remove
3075 		 * the mounted file system from the name space.
3076 		 */
3077 		if (vn_mountedvfs(nvp) != NULL) {
3078 			VN_RELE(nvp);
3079 			nfs_rw_exit(&odrp->r_rwlock);
3080 			nfs_rw_exit(&ndrp->r_rwlock);
3081 			return (EBUSY);
3082 		}
3083 
3084 		/*
3085 		 * Purge the name cache of all references to this vnode
3086 		 * so that we can check the reference count to infer
3087 		 * whether it is active or not.
3088 		 */
3089 		/*
3090 		 * First just remove the entry from the name cache, as it
3091 		 * is most likely the only entry for this vp.
3092 		 */
3093 		dnlc_remove(ndvp, nnm);
3094 		/*
3095 		 * If the file has a v_count > 1 then there may be more
3096 		 * than one entry in the name cache due multiple links
3097 		 * or an open file, but we don't have the real reference
3098 		 * count so flush all possible entries.
3099 		 */
3100 		if (nvp->v_count > 1)
3101 			dnlc_purge_vp(nvp);
3102 
3103 		/*
3104 		 * If the vnode is active and is not a directory,
3105 		 * arrange to rename it to a
3106 		 * temporary file so that it will continue to be
3107 		 * accessible.  This implements the "unlink-open-file"
3108 		 * semantics for the target of a rename operation.
3109 		 * Before doing this though, make sure that the
3110 		 * source and target files are not already the same.
3111 		 */
3112 		if (nvp->v_count > 1 && nvp->v_type != VDIR) {
3113 			/*
3114 			 * Lookup the source name.
3115 			 */
3116 			error = nfs3lookup(odvp, onm, &ovp, NULL, 0, NULL,
3117 			    cr, 0);
3118 
3119 			/*
3120 			 * The source name *should* already exist.
3121 			 */
3122 			if (error) {
3123 				VN_RELE(nvp);
3124 				nfs_rw_exit(&odrp->r_rwlock);
3125 				nfs_rw_exit(&ndrp->r_rwlock);
3126 				return (error);
3127 			}
3128 
3129 			/*
3130 			 * Compare the two vnodes.  If they are the same,
3131 			 * just release all held vnodes and return success.
3132 			 */
3133 			if (ovp == nvp) {
3134 				VN_RELE(ovp);
3135 				VN_RELE(nvp);
3136 				nfs_rw_exit(&odrp->r_rwlock);
3137 				nfs_rw_exit(&ndrp->r_rwlock);
3138 				return (0);
3139 			}
3140 
3141 			/*
3142 			 * Can't mix and match directories and non-
3143 			 * directories in rename operations.  We already
3144 			 * know that the target is not a directory.  If
3145 			 * the source is a directory, return an error.
3146 			 */
3147 			if (ovp->v_type == VDIR) {
3148 				VN_RELE(ovp);
3149 				VN_RELE(nvp);
3150 				nfs_rw_exit(&odrp->r_rwlock);
3151 				nfs_rw_exit(&ndrp->r_rwlock);
3152 				return (ENOTDIR);
3153 			}
3154 
3155 			/*
3156 			 * The target file exists, is not the same as
3157 			 * the source file, and is active.  Link it
3158 			 * to a temporary filename to avoid having
3159 			 * the server removing the file completely.
3160 			 */
3161 			tmpname = newname();
3162 			error = nfs3_link(ndvp, nvp, tmpname, cr, NULL, 0);
3163 			if (error == EOPNOTSUPP) {
3164 				error = nfs3_rename(ndvp, nnm, ndvp, tmpname,
3165 				    cr, NULL, 0);
3166 			}
3167 			if (error) {
3168 				kmem_free(tmpname, MAXNAMELEN);
3169 				VN_RELE(ovp);
3170 				VN_RELE(nvp);
3171 				nfs_rw_exit(&odrp->r_rwlock);
3172 				nfs_rw_exit(&ndrp->r_rwlock);
3173 				return (error);
3174 			}
3175 			rp = VTOR(nvp);
3176 			mutex_enter(&rp->r_statelock);
3177 			if (rp->r_unldvp == NULL) {
3178 				VN_HOLD(ndvp);
3179 				rp->r_unldvp = ndvp;
3180 				if (rp->r_unlcred != NULL)
3181 					crfree(rp->r_unlcred);
3182 				crhold(cr);
3183 				rp->r_unlcred = cr;
3184 				rp->r_unlname = tmpname;
3185 			} else {
3186 				kmem_free(rp->r_unlname, MAXNAMELEN);
3187 				rp->r_unlname = tmpname;
3188 			}
3189 			mutex_exit(&rp->r_statelock);
3190 		}
3191 	}
3192 
3193 	if (ovp == NULL) {
3194 		/*
3195 		 * When renaming directories to be a subdirectory of a
3196 		 * different parent, the dnlc entry for ".." will no
3197 		 * longer be valid, so it must be removed.
3198 		 *
3199 		 * We do a lookup here to determine whether we are renaming
3200 		 * a directory and we need to check if we are renaming
3201 		 * an unlinked file.  This might have already been done
3202 		 * in previous code, so we check ovp == NULL to avoid
3203 		 * doing it twice.
3204 		 */
3205 
3206 		error = nfs3lookup(odvp, onm, &ovp, NULL, 0, NULL, cr, 0);
3207 		/*
3208 		 * The source name *should* already exist.
3209 		 */
3210 		if (error) {
3211 			nfs_rw_exit(&odrp->r_rwlock);
3212 			nfs_rw_exit(&ndrp->r_rwlock);
3213 			if (nvp) {
3214 				VN_RELE(nvp);
3215 			}
3216 			return (error);
3217 		}
3218 		ASSERT(ovp != NULL);
3219 	}
3220 
3221 	dnlc_remove(odvp, onm);
3222 	dnlc_remove(ndvp, nnm);
3223 
3224 	setdiropargs3(&args.from, onm, odvp);
3225 	setdiropargs3(&args.to, nnm, ndvp);
3226 
3227 	douprintf = 1;
3228 
3229 	t = gethrtime();
3230 
3231 	error = rfs3call(VTOMI(odvp), NFSPROC3_RENAME,
3232 	    xdr_RENAME3args, (caddr_t)&args,
3233 	    xdr_RENAME3res, (caddr_t)&res, cr,
3234 	    &douprintf, &res.status, 0, NULL);
3235 
3236 	if (error) {
3237 		PURGE_ATTRCACHE(odvp);
3238 		PURGE_ATTRCACHE(ndvp);
3239 		VN_RELE(ovp);
3240 		nfs_rw_exit(&odrp->r_rwlock);
3241 		nfs_rw_exit(&ndrp->r_rwlock);
3242 		if (nvp) {
3243 			VN_RELE(nvp);
3244 		}
3245 		return (error);
3246 	}
3247 
3248 	error = geterrno3(res.status);
3249 
3250 	if (!error) {
3251 		nfs3_cache_wcc_data(odvp, &res.resok.fromdir_wcc, t, cr);
3252 		if (HAVE_RDDIR_CACHE(odrp))
3253 			nfs_purge_rddir_cache(odvp);
3254 		if (ndvp != odvp) {
3255 			nfs3_cache_wcc_data(ndvp, &res.resok.todir_wcc, t, cr);
3256 			if (HAVE_RDDIR_CACHE(ndrp))
3257 				nfs_purge_rddir_cache(ndvp);
3258 		}
3259 		/*
3260 		 * when renaming directories to be a subdirectory of a
3261 		 * different parent, the dnlc entry for ".." will no
3262 		 * longer be valid, so it must be removed
3263 		 */
3264 		rp = VTOR(ovp);
3265 		if (ndvp != odvp) {
3266 			if (ovp->v_type == VDIR) {
3267 				dnlc_remove(ovp, "..");
3268 				if (HAVE_RDDIR_CACHE(rp))
3269 					nfs_purge_rddir_cache(ovp);
3270 			}
3271 		}
3272 
3273 		/*
3274 		 * If we are renaming the unlinked file, update the
3275 		 * r_unldvp and r_unlname as needed.
3276 		 */
3277 		mutex_enter(&rp->r_statelock);
3278 		if (rp->r_unldvp != NULL) {
3279 			if (strcmp(rp->r_unlname, onm) == 0) {
3280 				(void) strncpy(rp->r_unlname, nnm, MAXNAMELEN);
3281 				rp->r_unlname[MAXNAMELEN - 1] = '\0';
3282 
3283 				if (ndvp != rp->r_unldvp) {
3284 					VN_RELE(rp->r_unldvp);
3285 					rp->r_unldvp = ndvp;
3286 					VN_HOLD(ndvp);
3287 				}
3288 			}
3289 		}
3290 		mutex_exit(&rp->r_statelock);
3291 	} else {
3292 		nfs3_cache_wcc_data(odvp, &res.resfail.fromdir_wcc, t, cr);
3293 		if (ndvp != odvp) {
3294 			nfs3_cache_wcc_data(ndvp, &res.resfail.todir_wcc, t,
3295 			    cr);
3296 		}
3297 		/*
3298 		 * System V defines rename to return EEXIST, not
3299 		 * ENOTEMPTY if the target directory is not empty.
3300 		 * Over the wire, the error is NFSERR_ENOTEMPTY
3301 		 * which geterrno maps to ENOTEMPTY.
3302 		 */
3303 		if (error == ENOTEMPTY)
3304 			error = EEXIST;
3305 	}
3306 
3307 	if (error == 0) {
3308 		if (nvp)
3309 			vnevent_rename_dest(nvp, ndvp, nnm, ct);
3310 
3311 		if (odvp != ndvp)
3312 			vnevent_rename_dest_dir(ndvp, ct);
3313 		ASSERT(ovp != NULL);
3314 		vnevent_rename_src(ovp, odvp, onm, ct);
3315 	}
3316 
3317 	if (nvp) {
3318 		VN_RELE(nvp);
3319 	}
3320 	VN_RELE(ovp);
3321 
3322 	nfs_rw_exit(&odrp->r_rwlock);
3323 	nfs_rw_exit(&ndrp->r_rwlock);
3324 
3325 	return (error);
3326 }
3327 
3328 /* ARGSUSED */
3329 static int
3330 nfs3_mkdir(vnode_t *dvp, char *nm, struct vattr *va, vnode_t **vpp, cred_t *cr,
3331 	caller_context_t *ct, int flags, vsecattr_t *vsecp)
3332 {
3333 	int error;
3334 	MKDIR3args args;
3335 	MKDIR3res res;
3336 	int douprintf;
3337 	struct vattr vattr;
3338 	vnode_t *vp;
3339 	rnode_t *drp;
3340 	hrtime_t t;
3341 
3342 	if (nfs_zone() != VTOMI(dvp)->mi_zone)
3343 		return (EPERM);
3344 	setdiropargs3(&args.where, nm, dvp);
3345 
3346 	/*
3347 	 * Decide what the group-id and set-gid bit of the created directory
3348 	 * should be.  May have to do a setattr to get the gid right.
3349 	 */
3350 	error = setdirgid(dvp, &va->va_gid, cr);
3351 	if (error)
3352 		return (error);
3353 	error = setdirmode(dvp, &va->va_mode, cr);
3354 	if (error)
3355 		return (error);
3356 	va->va_mask |= AT_MODE|AT_GID;
3357 
3358 	error = vattr_to_sattr3(va, &args.attributes);
3359 	if (error) {
3360 		/* req time field(s) overflow - return immediately */
3361 		return (error);
3362 	}
3363 
3364 	drp = VTOR(dvp);
3365 	if (nfs_rw_enter_sig(&drp->r_rwlock, RW_WRITER, INTR(dvp)))
3366 		return (EINTR);
3367 
3368 	dnlc_remove(dvp, nm);
3369 
3370 	douprintf = 1;
3371 
3372 	t = gethrtime();
3373 
3374 	error = rfs3call(VTOMI(dvp), NFSPROC3_MKDIR,
3375 	    xdr_MKDIR3args, (caddr_t)&args,
3376 	    xdr_MKDIR3res, (caddr_t)&res, cr,
3377 	    &douprintf, &res.status, 0, NULL);
3378 
3379 	if (error) {
3380 		PURGE_ATTRCACHE(dvp);
3381 		nfs_rw_exit(&drp->r_rwlock);
3382 		return (error);
3383 	}
3384 
3385 	error = geterrno3(res.status);
3386 	if (!error) {
3387 		nfs3_cache_wcc_data(dvp, &res.resok.dir_wcc, t, cr);
3388 		if (HAVE_RDDIR_CACHE(drp))
3389 			nfs_purge_rddir_cache(dvp);
3390 
3391 		if (!res.resok.obj.handle_follows) {
3392 			error = nfs3lookup(dvp, nm, &vp, NULL, 0, NULL, cr, 0);
3393 			if (error) {
3394 				nfs_rw_exit(&drp->r_rwlock);
3395 				return (error);
3396 			}
3397 		} else {
3398 			if (res.resok.obj_attributes.attributes) {
3399 				vp = makenfs3node(&res.resok.obj.handle,
3400 				    &res.resok.obj_attributes.attr,
3401 				    dvp->v_vfsp, t, cr, NULL, NULL);
3402 			} else {
3403 				vp = makenfs3node(&res.resok.obj.handle, NULL,
3404 				    dvp->v_vfsp, t, cr, NULL, NULL);
3405 				if (vp->v_type == VNON) {
3406 					vattr.va_mask = AT_TYPE;
3407 					error = nfs3getattr(vp, &vattr, cr);
3408 					if (error) {
3409 						VN_RELE(vp);
3410 						nfs_rw_exit(&drp->r_rwlock);
3411 						return (error);
3412 					}
3413 					vp->v_type = vattr.va_type;
3414 				}
3415 			}
3416 			dnlc_update(dvp, nm, vp);
3417 		}
3418 		if (va->va_gid != VTOR(vp)->r_attr.va_gid) {
3419 			va->va_mask = AT_GID;
3420 			(void) nfs3setattr(vp, va, 0, cr);
3421 		}
3422 		*vpp = vp;
3423 	} else {
3424 		nfs3_cache_wcc_data(dvp, &res.resfail.dir_wcc, t, cr);
3425 		PURGE_STALE_FH(error, dvp, cr);
3426 	}
3427 
3428 	nfs_rw_exit(&drp->r_rwlock);
3429 
3430 	return (error);
3431 }
3432 
3433 /* ARGSUSED */
3434 static int
3435 nfs3_rmdir(vnode_t *dvp, char *nm, vnode_t *cdir, cred_t *cr,
3436 	caller_context_t *ct, int flags)
3437 {
3438 	int error;
3439 	RMDIR3args args;
3440 	RMDIR3res res;
3441 	vnode_t *vp;
3442 	int douprintf;
3443 	rnode_t *drp;
3444 	hrtime_t t;
3445 
3446 	if (nfs_zone() != VTOMI(dvp)->mi_zone)
3447 		return (EPERM);
3448 	drp = VTOR(dvp);
3449 	if (nfs_rw_enter_sig(&drp->r_rwlock, RW_WRITER, INTR(dvp)))
3450 		return (EINTR);
3451 
3452 	/*
3453 	 * Attempt to prevent a rmdir(".") from succeeding.
3454 	 */
3455 	error = nfs3lookup(dvp, nm, &vp, NULL, 0, NULL, cr, 0);
3456 	if (error) {
3457 		nfs_rw_exit(&drp->r_rwlock);
3458 		return (error);
3459 	}
3460 
3461 	if (vp == cdir) {
3462 		VN_RELE(vp);
3463 		nfs_rw_exit(&drp->r_rwlock);
3464 		return (EINVAL);
3465 	}
3466 
3467 	setdiropargs3(&args.object, nm, dvp);
3468 
3469 	/*
3470 	 * First just remove the entry from the name cache, as it
3471 	 * is most likely an entry for this vp.
3472 	 */
3473 	dnlc_remove(dvp, nm);
3474 
3475 	/*
3476 	 * If there vnode reference count is greater than one, then
3477 	 * there may be additional references in the DNLC which will
3478 	 * need to be purged.  First, trying removing the entry for
3479 	 * the parent directory and see if that removes the additional
3480 	 * reference(s).  If that doesn't do it, then use dnlc_purge_vp
3481 	 * to completely remove any references to the directory which
3482 	 * might still exist in the DNLC.
3483 	 */
3484 	if (vp->v_count > 1) {
3485 		dnlc_remove(vp, "..");
3486 		if (vp->v_count > 1)
3487 			dnlc_purge_vp(vp);
3488 	}
3489 
3490 	douprintf = 1;
3491 
3492 	t = gethrtime();
3493 
3494 	error = rfs3call(VTOMI(dvp), NFSPROC3_RMDIR,
3495 	    xdr_diropargs3, (caddr_t)&args,
3496 	    xdr_RMDIR3res, (caddr_t)&res, cr,
3497 	    &douprintf, &res.status, 0, NULL);
3498 
3499 	PURGE_ATTRCACHE(vp);
3500 
3501 	if (error) {
3502 		PURGE_ATTRCACHE(dvp);
3503 		VN_RELE(vp);
3504 		nfs_rw_exit(&drp->r_rwlock);
3505 		return (error);
3506 	}
3507 
3508 	error = geterrno3(res.status);
3509 	if (!error) {
3510 		nfs3_cache_wcc_data(dvp, &res.resok.dir_wcc, t, cr);
3511 		if (HAVE_RDDIR_CACHE(drp))
3512 			nfs_purge_rddir_cache(dvp);
3513 		if (HAVE_RDDIR_CACHE(VTOR(vp)))
3514 			nfs_purge_rddir_cache(vp);
3515 	} else {
3516 		nfs3_cache_wcc_data(dvp, &res.resfail.dir_wcc, t, cr);
3517 		PURGE_STALE_FH(error, dvp, cr);
3518 		/*
3519 		 * System V defines rmdir to return EEXIST, not
3520 		 * ENOTEMPTY if the directory is not empty.  Over
3521 		 * the wire, the error is NFSERR_ENOTEMPTY which
3522 		 * geterrno maps to ENOTEMPTY.
3523 		 */
3524 		if (error == ENOTEMPTY)
3525 			error = EEXIST;
3526 	}
3527 
3528 	if (error == 0) {
3529 		vnevent_rmdir(vp, dvp, nm, ct);
3530 	}
3531 	VN_RELE(vp);
3532 
3533 	nfs_rw_exit(&drp->r_rwlock);
3534 
3535 	return (error);
3536 }
3537 
3538 /* ARGSUSED */
3539 static int
3540 nfs3_symlink(vnode_t *dvp, char *lnm, struct vattr *tva, char *tnm, cred_t *cr,
3541 	caller_context_t *ct, int flags)
3542 {
3543 	int error;
3544 	SYMLINK3args args;
3545 	SYMLINK3res res;
3546 	int douprintf;
3547 	mntinfo_t *mi;
3548 	vnode_t *vp;
3549 	rnode_t *rp;
3550 	char *contents;
3551 	rnode_t *drp;
3552 	hrtime_t t;
3553 
3554 	mi = VTOMI(dvp);
3555 
3556 	if (nfs_zone() != mi->mi_zone)
3557 		return (EPERM);
3558 	if (!(mi->mi_flags & MI_SYMLINK))
3559 		return (EOPNOTSUPP);
3560 
3561 	setdiropargs3(&args.where, lnm, dvp);
3562 	error = vattr_to_sattr3(tva, &args.symlink.symlink_attributes);
3563 	if (error) {
3564 		/* req time field(s) overflow - return immediately */
3565 		return (error);
3566 	}
3567 	args.symlink.symlink_data = tnm;
3568 
3569 	drp = VTOR(dvp);
3570 	if (nfs_rw_enter_sig(&drp->r_rwlock, RW_WRITER, INTR(dvp)))
3571 		return (EINTR);
3572 
3573 	dnlc_remove(dvp, lnm);
3574 
3575 	douprintf = 1;
3576 
3577 	t = gethrtime();
3578 
3579 	error = rfs3call(mi, NFSPROC3_SYMLINK,
3580 	    xdr_SYMLINK3args, (caddr_t)&args,
3581 	    xdr_SYMLINK3res, (caddr_t)&res, cr,
3582 	    &douprintf, &res.status, 0, NULL);
3583 
3584 	if (error) {
3585 		PURGE_ATTRCACHE(dvp);
3586 		nfs_rw_exit(&drp->r_rwlock);
3587 		return (error);
3588 	}
3589 
3590 	error = geterrno3(res.status);
3591 	if (!error) {
3592 		nfs3_cache_wcc_data(dvp, &res.resok.dir_wcc, t, cr);
3593 		if (HAVE_RDDIR_CACHE(drp))
3594 			nfs_purge_rddir_cache(dvp);
3595 
3596 		if (res.resok.obj.handle_follows) {
3597 			if (res.resok.obj_attributes.attributes) {
3598 				vp = makenfs3node(&res.resok.obj.handle,
3599 				    &res.resok.obj_attributes.attr,
3600 				    dvp->v_vfsp, t, cr, NULL, NULL);
3601 			} else {
3602 				vp = makenfs3node(&res.resok.obj.handle, NULL,
3603 				    dvp->v_vfsp, t, cr, NULL, NULL);
3604 				vp->v_type = VLNK;
3605 				vp->v_rdev = 0;
3606 			}
3607 			dnlc_update(dvp, lnm, vp);
3608 			rp = VTOR(vp);
3609 			if (nfs3_do_symlink_cache &&
3610 			    rp->r_symlink.contents == NULL) {
3611 
3612 				contents = kmem_alloc(MAXPATHLEN,
3613 				    KM_NOSLEEP);
3614 
3615 				if (contents != NULL) {
3616 					mutex_enter(&rp->r_statelock);
3617 					if (rp->r_symlink.contents == NULL) {
3618 						rp->r_symlink.len = strlen(tnm);
3619 						bcopy(tnm, contents,
3620 						    rp->r_symlink.len);
3621 						rp->r_symlink.contents =
3622 						    contents;
3623 						rp->r_symlink.size = MAXPATHLEN;
3624 						mutex_exit(&rp->r_statelock);
3625 					} else {
3626 						mutex_exit(&rp->r_statelock);
3627 						kmem_free((void *)contents,
3628 						    MAXPATHLEN);
3629 					}
3630 				}
3631 			}
3632 			VN_RELE(vp);
3633 		}
3634 	} else {
3635 		nfs3_cache_wcc_data(dvp, &res.resfail.dir_wcc, t, cr);
3636 		PURGE_STALE_FH(error, dvp, cr);
3637 		if (error == EOPNOTSUPP) {
3638 			mutex_enter(&mi->mi_lock);
3639 			mi->mi_flags &= ~MI_SYMLINK;
3640 			mutex_exit(&mi->mi_lock);
3641 		}
3642 	}
3643 
3644 	nfs_rw_exit(&drp->r_rwlock);
3645 
3646 	return (error);
3647 }
3648 
3649 #ifdef DEBUG
3650 static int nfs3_readdir_cache_hits = 0;
3651 static int nfs3_readdir_cache_shorts = 0;
3652 static int nfs3_readdir_cache_waits = 0;
3653 static int nfs3_readdir_cache_misses = 0;
3654 static int nfs3_readdir_readahead = 0;
3655 #endif
3656 
3657 static int nfs3_shrinkreaddir = 0;
3658 
3659 /*
3660  * Read directory entries.
3661  * There are some weird things to look out for here.  The uio_loffset
3662  * field is either 0 or it is the offset returned from a previous
3663  * readdir.  It is an opaque value used by the server to find the
3664  * correct directory block to read. The count field is the number
3665  * of blocks to read on the server.  This is advisory only, the server
3666  * may return only one block's worth of entries.  Entries may be compressed
3667  * on the server.
3668  */
3669 /* ARGSUSED */
3670 static int
3671 nfs3_readdir(vnode_t *vp, struct uio *uiop, cred_t *cr, int *eofp,
3672 	caller_context_t *ct, int flags)
3673 {
3674 	int error;
3675 	size_t count;
3676 	rnode_t *rp;
3677 	rddir_cache *rdc;
3678 	rddir_cache *nrdc;
3679 	rddir_cache *rrdc;
3680 #ifdef DEBUG
3681 	int missed;
3682 #endif
3683 	int doreadahead;
3684 	rddir_cache srdc;
3685 	avl_index_t where;
3686 
3687 	if (nfs_zone() != VTOMI(vp)->mi_zone)
3688 		return (EIO);
3689 	rp = VTOR(vp);
3690 
3691 	ASSERT(nfs_rw_lock_held(&rp->r_rwlock, RW_READER));
3692 
3693 	/*
3694 	 * Make sure that the directory cache is valid.
3695 	 */
3696 	if (HAVE_RDDIR_CACHE(rp)) {
3697 		if (nfs_disable_rddir_cache) {
3698 			/*
3699 			 * Setting nfs_disable_rddir_cache in /etc/system
3700 			 * allows interoperability with servers that do not
3701 			 * properly update the attributes of directories.
3702 			 * Any cached information gets purged before an
3703 			 * access is made to it.
3704 			 */
3705 			nfs_purge_rddir_cache(vp);
3706 		} else {
3707 			error = nfs3_validate_caches(vp, cr);
3708 			if (error)
3709 				return (error);
3710 		}
3711 	}
3712 
3713 	/*
3714 	 * It is possible that some servers may not be able to correctly
3715 	 * handle a large READDIR or READDIRPLUS request due to bugs in
3716 	 * their implementation.  In order to continue to interoperate
3717 	 * with them, this workaround is provided to limit the maximum
3718 	 * size of a READDIRPLUS request to 1024.  In any case, the request
3719 	 * size is limited to MAXBSIZE.
3720 	 */
3721 	count = MIN(uiop->uio_iov->iov_len,
3722 	    nfs3_shrinkreaddir ? 1024 : MAXBSIZE);
3723 
3724 	nrdc = NULL;
3725 #ifdef DEBUG
3726 	missed = 0;
3727 #endif
3728 top:
3729 	/*
3730 	 * Short circuit last readdir which always returns 0 bytes.
3731 	 * This can be done after the directory has been read through
3732 	 * completely at least once.  This will set r_direof which
3733 	 * can be used to find the value of the last cookie.
3734 	 */
3735 	mutex_enter(&rp->r_statelock);
3736 	if (rp->r_direof != NULL &&
3737 	    uiop->uio_loffset == rp->r_direof->nfs3_ncookie) {
3738 		mutex_exit(&rp->r_statelock);
3739 #ifdef DEBUG
3740 		nfs3_readdir_cache_shorts++;
3741 #endif
3742 		if (eofp)
3743 			*eofp = 1;
3744 		if (nrdc != NULL)
3745 			rddir_cache_rele(nrdc);
3746 		return (0);
3747 	}
3748 	/*
3749 	 * Look for a cache entry.  Cache entries are identified
3750 	 * by the NFS cookie value and the byte count requested.
3751 	 */
3752 	srdc.nfs3_cookie = uiop->uio_loffset;
3753 	srdc.buflen = count;
3754 	rdc = avl_find(&rp->r_dir, &srdc, &where);
3755 	if (rdc != NULL) {
3756 		rddir_cache_hold(rdc);
3757 		/*
3758 		 * If the cache entry is in the process of being
3759 		 * filled in, wait until this completes.  The
3760 		 * RDDIRWAIT bit is set to indicate that someone
3761 		 * is waiting and then the thread currently
3762 		 * filling the entry is done, it should do a
3763 		 * cv_broadcast to wakeup all of the threads
3764 		 * waiting for it to finish.
3765 		 */
3766 		if (rdc->flags & RDDIR) {
3767 			nfs_rw_exit(&rp->r_rwlock);
3768 			rdc->flags |= RDDIRWAIT;
3769 #ifdef DEBUG
3770 			nfs3_readdir_cache_waits++;
3771 #endif
3772 			if (!cv_wait_sig(&rdc->cv, &rp->r_statelock)) {
3773 				/*
3774 				 * We got interrupted, probably
3775 				 * the user typed ^C or an alarm
3776 				 * fired.  We free the new entry
3777 				 * if we allocated one.
3778 				 */
3779 				mutex_exit(&rp->r_statelock);
3780 				(void) nfs_rw_enter_sig(&rp->r_rwlock,
3781 				    RW_READER, FALSE);
3782 				rddir_cache_rele(rdc);
3783 				if (nrdc != NULL)
3784 					rddir_cache_rele(nrdc);
3785 				return (EINTR);
3786 			}
3787 			mutex_exit(&rp->r_statelock);
3788 			(void) nfs_rw_enter_sig(&rp->r_rwlock,
3789 			    RW_READER, FALSE);
3790 			rddir_cache_rele(rdc);
3791 			goto top;
3792 		}
3793 		/*
3794 		 * Check to see if a readdir is required to
3795 		 * fill the entry.  If so, mark this entry
3796 		 * as being filled, remove our reference,
3797 		 * and branch to the code to fill the entry.
3798 		 */
3799 		if (rdc->flags & RDDIRREQ) {
3800 			rdc->flags &= ~RDDIRREQ;
3801 			rdc->flags |= RDDIR;
3802 			if (nrdc != NULL)
3803 				rddir_cache_rele(nrdc);
3804 			nrdc = rdc;
3805 			mutex_exit(&rp->r_statelock);
3806 			goto bottom;
3807 		}
3808 #ifdef DEBUG
3809 		if (!missed)
3810 			nfs3_readdir_cache_hits++;
3811 #endif
3812 		/*
3813 		 * If an error occurred while attempting
3814 		 * to fill the cache entry, just return it.
3815 		 */
3816 		if (rdc->error) {
3817 			error = rdc->error;
3818 			mutex_exit(&rp->r_statelock);
3819 			rddir_cache_rele(rdc);
3820 			if (nrdc != NULL)
3821 				rddir_cache_rele(nrdc);
3822 			return (error);
3823 		}
3824 
3825 		/*
3826 		 * The cache entry is complete and good,
3827 		 * copyout the dirent structs to the calling
3828 		 * thread.
3829 		 */
3830 		error = uiomove(rdc->entries, rdc->entlen, UIO_READ, uiop);
3831 
3832 		/*
3833 		 * If no error occurred during the copyout,
3834 		 * update the offset in the uio struct to
3835 		 * contain the value of the next cookie
3836 		 * and set the eof value appropriately.
3837 		 */
3838 		if (!error) {
3839 			uiop->uio_loffset = rdc->nfs3_ncookie;
3840 			if (eofp)
3841 				*eofp = rdc->eof;
3842 		}
3843 
3844 		/*
3845 		 * Decide whether to do readahead.
3846 		 *
3847 		 * Don't if have already read to the end of
3848 		 * directory.  There is nothing more to read.
3849 		 *
3850 		 * Don't if the application is not doing
3851 		 * lookups in the directory.  The readahead
3852 		 * is only effective if the application can
3853 		 * be doing work while an async thread is
3854 		 * handling the over the wire request.
3855 		 */
3856 		if (rdc->eof) {
3857 			rp->r_direof = rdc;
3858 			doreadahead = FALSE;
3859 		} else if (!(rp->r_flags & RLOOKUP))
3860 			doreadahead = FALSE;
3861 		else
3862 			doreadahead = TRUE;
3863 
3864 		if (!doreadahead) {
3865 			mutex_exit(&rp->r_statelock);
3866 			rddir_cache_rele(rdc);
3867 			if (nrdc != NULL)
3868 				rddir_cache_rele(nrdc);
3869 			return (error);
3870 		}
3871 
3872 		/*
3873 		 * Check to see whether we found an entry
3874 		 * for the readahead.  If so, we don't need
3875 		 * to do anything further, so free the new
3876 		 * entry if one was allocated.  Otherwise,
3877 		 * allocate a new entry, add it to the cache,
3878 		 * and then initiate an asynchronous readdir
3879 		 * operation to fill it.
3880 		 */
3881 		srdc.nfs3_cookie = rdc->nfs3_ncookie;
3882 		srdc.buflen = count;
3883 		rrdc = avl_find(&rp->r_dir, &srdc, &where);
3884 		if (rrdc != NULL) {
3885 			if (nrdc != NULL)
3886 				rddir_cache_rele(nrdc);
3887 		} else {
3888 			if (nrdc != NULL)
3889 				rrdc = nrdc;
3890 			else {
3891 				rrdc = rddir_cache_alloc(KM_NOSLEEP);
3892 			}
3893 			if (rrdc != NULL) {
3894 				rrdc->nfs3_cookie = rdc->nfs3_ncookie;
3895 				rrdc->buflen = count;
3896 				avl_insert(&rp->r_dir, rrdc, where);
3897 				rddir_cache_hold(rrdc);
3898 				mutex_exit(&rp->r_statelock);
3899 				rddir_cache_rele(rdc);
3900 #ifdef DEBUG
3901 				nfs3_readdir_readahead++;
3902 #endif
3903 				nfs_async_readdir(vp, rrdc, cr, do_nfs3readdir);
3904 				return (error);
3905 			}
3906 		}
3907 
3908 		mutex_exit(&rp->r_statelock);
3909 		rddir_cache_rele(rdc);
3910 		return (error);
3911 	}
3912 
3913 	/*
3914 	 * Didn't find an entry in the cache.  Construct a new empty
3915 	 * entry and link it into the cache.  Other processes attempting
3916 	 * to access this entry will need to wait until it is filled in.
3917 	 *
3918 	 * Since kmem_alloc may block, another pass through the cache
3919 	 * will need to be taken to make sure that another process
3920 	 * hasn't already added an entry to the cache for this request.
3921 	 */
3922 	if (nrdc == NULL) {
3923 		mutex_exit(&rp->r_statelock);
3924 		nrdc = rddir_cache_alloc(KM_SLEEP);
3925 		nrdc->nfs3_cookie = uiop->uio_loffset;
3926 		nrdc->buflen = count;
3927 		goto top;
3928 	}
3929 
3930 	/*
3931 	 * Add this entry to the cache.
3932 	 */
3933 	avl_insert(&rp->r_dir, nrdc, where);
3934 	rddir_cache_hold(nrdc);
3935 	mutex_exit(&rp->r_statelock);
3936 
3937 bottom:
3938 #ifdef DEBUG
3939 	missed = 1;
3940 	nfs3_readdir_cache_misses++;
3941 #endif
3942 	/*
3943 	 * Do the readdir.  This routine decides whether to use
3944 	 * READDIR or READDIRPLUS.
3945 	 */
3946 	error = do_nfs3readdir(vp, nrdc, cr);
3947 
3948 	/*
3949 	 * If this operation failed, just return the error which occurred.
3950 	 */
3951 	if (error != 0)
3952 		return (error);
3953 
3954 	/*
3955 	 * Since the RPC operation will have taken sometime and blocked
3956 	 * this process, another pass through the cache will need to be
3957 	 * taken to find the correct cache entry.  It is possible that
3958 	 * the correct cache entry will not be there (although one was
3959 	 * added) because the directory changed during the RPC operation
3960 	 * and the readdir cache was flushed.  In this case, just start
3961 	 * over.  It is hoped that this will not happen too often... :-)
3962 	 */
3963 	nrdc = NULL;
3964 	goto top;
3965 	/* NOTREACHED */
3966 }
3967 
3968 static int
3969 do_nfs3readdir(vnode_t *vp, rddir_cache *rdc, cred_t *cr)
3970 {
3971 	int error;
3972 	rnode_t *rp;
3973 	mntinfo_t *mi;
3974 
3975 	rp = VTOR(vp);
3976 	mi = VTOMI(vp);
3977 	ASSERT(nfs_zone() == mi->mi_zone);
3978 	/*
3979 	 * Issue the proper request.
3980 	 *
3981 	 * If the server does not support READDIRPLUS, then use READDIR.
3982 	 *
3983 	 * Otherwise --
3984 	 * Issue a READDIRPLUS if reading to fill an empty cache or if
3985 	 * an application has performed a lookup in the directory which
3986 	 * required an over the wire lookup.  The use of READDIRPLUS
3987 	 * will help to (re)populate the DNLC.
3988 	 */
3989 	if (!(mi->mi_flags & MI_READDIRONLY) &&
3990 	    (rp->r_flags & (RLOOKUP | RREADDIRPLUS))) {
3991 		if (rp->r_flags & RREADDIRPLUS) {
3992 			mutex_enter(&rp->r_statelock);
3993 			rp->r_flags &= ~RREADDIRPLUS;
3994 			mutex_exit(&rp->r_statelock);
3995 		}
3996 		nfs3readdirplus(vp, rdc, cr);
3997 		if (rdc->error == EOPNOTSUPP)
3998 			nfs3readdir(vp, rdc, cr);
3999 	} else
4000 		nfs3readdir(vp, rdc, cr);
4001 
4002 	mutex_enter(&rp->r_statelock);
4003 	rdc->flags &= ~RDDIR;
4004 	if (rdc->flags & RDDIRWAIT) {
4005 		rdc->flags &= ~RDDIRWAIT;
4006 		cv_broadcast(&rdc->cv);
4007 	}
4008 	error = rdc->error;
4009 	if (error)
4010 		rdc->flags |= RDDIRREQ;
4011 	mutex_exit(&rp->r_statelock);
4012 
4013 	rddir_cache_rele(rdc);
4014 
4015 	return (error);
4016 }
4017 
4018 static void
4019 nfs3readdir(vnode_t *vp, rddir_cache *rdc, cred_t *cr)
4020 {
4021 	int error;
4022 	READDIR3args args;
4023 	READDIR3vres res;
4024 	vattr_t dva;
4025 	rnode_t *rp;
4026 	int douprintf;
4027 	failinfo_t fi, *fip = NULL;
4028 	mntinfo_t *mi;
4029 	hrtime_t t;
4030 
4031 	rp = VTOR(vp);
4032 	mi = VTOMI(vp);
4033 	ASSERT(nfs_zone() == mi->mi_zone);
4034 
4035 	args.dir = *RTOFH3(rp);
4036 	args.cookie = (cookie3)rdc->nfs3_cookie;
4037 	args.cookieverf = rp->r_cookieverf;
4038 	args.count = rdc->buflen;
4039 
4040 	/*
4041 	 * NFS client failover support
4042 	 * suppress failover unless we have a zero cookie
4043 	 */
4044 	if (args.cookie == (cookie3) 0) {
4045 		fi.vp = vp;
4046 		fi.fhp = (caddr_t)&args.dir;
4047 		fi.copyproc = nfs3copyfh;
4048 		fi.lookupproc = nfs3lookup;
4049 		fi.xattrdirproc = acl_getxattrdir3;
4050 		fip = &fi;
4051 	}
4052 
4053 #ifdef DEBUG
4054 	rdc->entries = rddir_cache_buf_alloc(rdc->buflen, KM_SLEEP);
4055 #else
4056 	rdc->entries = kmem_alloc(rdc->buflen, KM_SLEEP);
4057 #endif
4058 
4059 	res.entries = (dirent64_t *)rdc->entries;
4060 	res.entries_size = rdc->buflen;
4061 	res.dir_attributes.fres.vap = &dva;
4062 	res.dir_attributes.fres.vp = vp;
4063 	res.loff = rdc->nfs3_cookie;
4064 
4065 	douprintf = 1;
4066 
4067 	if (mi->mi_io_kstats) {
4068 		mutex_enter(&mi->mi_lock);
4069 		kstat_runq_enter(KSTAT_IO_PTR(mi->mi_io_kstats));
4070 		mutex_exit(&mi->mi_lock);
4071 	}
4072 
4073 	t = gethrtime();
4074 
4075 	error = rfs3call(VTOMI(vp), NFSPROC3_READDIR,
4076 	    xdr_READDIR3args, (caddr_t)&args,
4077 	    xdr_READDIR3vres, (caddr_t)&res, cr,
4078 	    &douprintf, &res.status, 0, fip);
4079 
4080 	if (mi->mi_io_kstats) {
4081 		mutex_enter(&mi->mi_lock);
4082 		kstat_runq_exit(KSTAT_IO_PTR(mi->mi_io_kstats));
4083 		mutex_exit(&mi->mi_lock);
4084 	}
4085 
4086 	if (error)
4087 		goto err;
4088 
4089 	nfs3_cache_post_op_vattr(vp, &res.dir_attributes, t, cr);
4090 
4091 	error = geterrno3(res.status);
4092 	if (error) {
4093 		PURGE_STALE_FH(error, vp, cr);
4094 		goto err;
4095 	}
4096 
4097 	if (mi->mi_io_kstats) {
4098 		mutex_enter(&mi->mi_lock);
4099 		KSTAT_IO_PTR(mi->mi_io_kstats)->reads++;
4100 		KSTAT_IO_PTR(mi->mi_io_kstats)->nread += res.size;
4101 		mutex_exit(&mi->mi_lock);
4102 	}
4103 
4104 	rdc->nfs3_ncookie = res.loff;
4105 	rp->r_cookieverf = res.cookieverf;
4106 	rdc->eof = res.eof ? 1 : 0;
4107 	rdc->entlen = res.size;
4108 	ASSERT(rdc->entlen <= rdc->buflen);
4109 	rdc->error = 0;
4110 	return;
4111 
4112 err:
4113 	kmem_free(rdc->entries, rdc->buflen);
4114 	rdc->entries = NULL;
4115 	rdc->error = error;
4116 }
4117 
4118 /*
4119  * Read directory entries.
4120  * There are some weird things to look out for here.  The uio_loffset
4121  * field is either 0 or it is the offset returned from a previous
4122  * readdir.  It is an opaque value used by the server to find the
4123  * correct directory block to read. The count field is the number
4124  * of blocks to read on the server.  This is advisory only, the server
4125  * may return only one block's worth of entries.  Entries may be compressed
4126  * on the server.
4127  */
4128 static void
4129 nfs3readdirplus(vnode_t *vp, rddir_cache *rdc, cred_t *cr)
4130 {
4131 	int error;
4132 	READDIRPLUS3args args;
4133 	READDIRPLUS3vres res;
4134 	vattr_t dva;
4135 	rnode_t *rp;
4136 	mntinfo_t *mi;
4137 	int douprintf;
4138 	failinfo_t fi, *fip = NULL;
4139 
4140 	rp = VTOR(vp);
4141 	mi = VTOMI(vp);
4142 	ASSERT(nfs_zone() == mi->mi_zone);
4143 
4144 	args.dir = *RTOFH3(rp);
4145 	args.cookie = (cookie3)rdc->nfs3_cookie;
4146 	args.cookieverf = rp->r_cookieverf;
4147 	args.dircount = rdc->buflen;
4148 	args.maxcount = mi->mi_tsize;
4149 
4150 	/*
4151 	 * NFS client failover support
4152 	 * suppress failover unless we have a zero cookie
4153 	 */
4154 	if (args.cookie == (cookie3)0) {
4155 		fi.vp = vp;
4156 		fi.fhp = (caddr_t)&args.dir;
4157 		fi.copyproc = nfs3copyfh;
4158 		fi.lookupproc = nfs3lookup;
4159 		fi.xattrdirproc = acl_getxattrdir3;
4160 		fip = &fi;
4161 	}
4162 
4163 #ifdef DEBUG
4164 	rdc->entries = rddir_cache_buf_alloc(rdc->buflen, KM_SLEEP);
4165 #else
4166 	rdc->entries = kmem_alloc(rdc->buflen, KM_SLEEP);
4167 #endif
4168 
4169 	res.entries = (dirent64_t *)rdc->entries;
4170 	res.entries_size = rdc->buflen;
4171 	res.dir_attributes.fres.vap = &dva;
4172 	res.dir_attributes.fres.vp = vp;
4173 	res.loff = rdc->nfs3_cookie;
4174 	res.credentials = cr;
4175 
4176 	douprintf = 1;
4177 
4178 	if (mi->mi_io_kstats) {
4179 		mutex_enter(&mi->mi_lock);
4180 		kstat_runq_enter(KSTAT_IO_PTR(mi->mi_io_kstats));
4181 		mutex_exit(&mi->mi_lock);
4182 	}
4183 
4184 	res.time = gethrtime();
4185 
4186 	error = rfs3call(mi, NFSPROC3_READDIRPLUS,
4187 	    xdr_READDIRPLUS3args, (caddr_t)&args,
4188 	    xdr_READDIRPLUS3vres, (caddr_t)&res, cr,
4189 	    &douprintf, &res.status, 0, fip);
4190 
4191 	if (mi->mi_io_kstats) {
4192 		mutex_enter(&mi->mi_lock);
4193 		kstat_runq_exit(KSTAT_IO_PTR(mi->mi_io_kstats));
4194 		mutex_exit(&mi->mi_lock);
4195 	}
4196 
4197 	if (error) {
4198 		goto err;
4199 	}
4200 
4201 	nfs3_cache_post_op_vattr(vp, &res.dir_attributes, res.time, cr);
4202 
4203 	error = geterrno3(res.status);
4204 	if (error) {
4205 		PURGE_STALE_FH(error, vp, cr);
4206 		if (error == EOPNOTSUPP) {
4207 			mutex_enter(&mi->mi_lock);
4208 			mi->mi_flags |= MI_READDIRONLY;
4209 			mutex_exit(&mi->mi_lock);
4210 		}
4211 		goto err;
4212 	}
4213 
4214 	if (mi->mi_io_kstats) {
4215 		mutex_enter(&mi->mi_lock);
4216 		KSTAT_IO_PTR(mi->mi_io_kstats)->reads++;
4217 		KSTAT_IO_PTR(mi->mi_io_kstats)->nread += res.size;
4218 		mutex_exit(&mi->mi_lock);
4219 	}
4220 
4221 	rdc->nfs3_ncookie = res.loff;
4222 	rp->r_cookieverf = res.cookieverf;
4223 	rdc->eof = res.eof ? 1 : 0;
4224 	rdc->entlen = res.size;
4225 	ASSERT(rdc->entlen <= rdc->buflen);
4226 	rdc->error = 0;
4227 
4228 	return;
4229 
4230 err:
4231 	kmem_free(rdc->entries, rdc->buflen);
4232 	rdc->entries = NULL;
4233 	rdc->error = error;
4234 }
4235 
4236 #ifdef DEBUG
4237 static int nfs3_bio_do_stop = 0;
4238 #endif
4239 
4240 static int
4241 nfs3_bio(struct buf *bp, stable_how *stab_comm, cred_t *cr)
4242 {
4243 	rnode_t *rp = VTOR(bp->b_vp);
4244 	int count;
4245 	int error;
4246 	cred_t *cred;
4247 	offset_t offset;
4248 
4249 	ASSERT(nfs_zone() == VTOMI(bp->b_vp)->mi_zone);
4250 	offset = ldbtob(bp->b_lblkno);
4251 
4252 	DTRACE_IO1(start, struct buf *, bp);
4253 
4254 	if (bp->b_flags & B_READ) {
4255 		mutex_enter(&rp->r_statelock);
4256 		if (rp->r_cred != NULL) {
4257 			cred = rp->r_cred;
4258 			crhold(cred);
4259 		} else {
4260 			rp->r_cred = cr;
4261 			crhold(cr);
4262 			cred = cr;
4263 			crhold(cred);
4264 		}
4265 		mutex_exit(&rp->r_statelock);
4266 	read_again:
4267 		error = bp->b_error = nfs3read(bp->b_vp, bp->b_un.b_addr,
4268 		    offset, bp->b_bcount, &bp->b_resid, cred);
4269 		crfree(cred);
4270 		if (!error) {
4271 			if (bp->b_resid) {
4272 				/*
4273 				 * Didn't get it all because we hit EOF,
4274 				 * zero all the memory beyond the EOF.
4275 				 */
4276 				/* bzero(rdaddr + */
4277 				bzero(bp->b_un.b_addr +
4278 				    bp->b_bcount - bp->b_resid, bp->b_resid);
4279 			}
4280 			mutex_enter(&rp->r_statelock);
4281 			if (bp->b_resid == bp->b_bcount &&
4282 			    offset >= rp->r_size) {
4283 				/*
4284 				 * We didn't read anything at all as we are
4285 				 * past EOF.  Return an error indicator back
4286 				 * but don't destroy the pages (yet).
4287 				 */
4288 				error = NFS_EOF;
4289 			}
4290 			mutex_exit(&rp->r_statelock);
4291 		} else if (error == EACCES) {
4292 			mutex_enter(&rp->r_statelock);
4293 			if (cred != cr) {
4294 				if (rp->r_cred != NULL)
4295 					crfree(rp->r_cred);
4296 				rp->r_cred = cr;
4297 				crhold(cr);
4298 				cred = cr;
4299 				crhold(cred);
4300 				mutex_exit(&rp->r_statelock);
4301 				goto read_again;
4302 			}
4303 			mutex_exit(&rp->r_statelock);
4304 		}
4305 	} else {
4306 		if (!(rp->r_flags & RSTALE)) {
4307 			mutex_enter(&rp->r_statelock);
4308 			if (rp->r_cred != NULL) {
4309 				cred = rp->r_cred;
4310 				crhold(cred);
4311 			} else {
4312 				rp->r_cred = cr;
4313 				crhold(cr);
4314 				cred = cr;
4315 				crhold(cred);
4316 			}
4317 			mutex_exit(&rp->r_statelock);
4318 		write_again:
4319 			mutex_enter(&rp->r_statelock);
4320 			count = MIN(bp->b_bcount, rp->r_size - offset);
4321 			mutex_exit(&rp->r_statelock);
4322 			if (count < 0)
4323 				cmn_err(CE_PANIC, "nfs3_bio: write count < 0");
4324 #ifdef DEBUG
4325 			if (count == 0) {
4326 				zcmn_err(getzoneid(), CE_WARN,
4327 				    "nfs3_bio: zero length write at %lld",
4328 				    offset);
4329 				nfs_printfhandle(&rp->r_fh);
4330 				if (nfs3_bio_do_stop)
4331 					debug_enter("nfs3_bio");
4332 			}
4333 #endif
4334 			error = nfs3write(bp->b_vp, bp->b_un.b_addr, offset,
4335 			    count, cred, stab_comm);
4336 			if (error == EACCES) {
4337 				mutex_enter(&rp->r_statelock);
4338 				if (cred != cr) {
4339 					if (rp->r_cred != NULL)
4340 						crfree(rp->r_cred);
4341 					rp->r_cred = cr;
4342 					crhold(cr);
4343 					crfree(cred);
4344 					cred = cr;
4345 					crhold(cred);
4346 					mutex_exit(&rp->r_statelock);
4347 					goto write_again;
4348 				}
4349 				mutex_exit(&rp->r_statelock);
4350 			}
4351 			bp->b_error = error;
4352 			if (error && error != EINTR) {
4353 				/*
4354 				 * Don't print EDQUOT errors on the console.
4355 				 * Don't print asynchronous EACCES errors.
4356 				 * Don't print EFBIG errors.
4357 				 * Print all other write errors.
4358 				 */
4359 				if (error != EDQUOT && error != EFBIG &&
4360 				    (error != EACCES ||
4361 				    !(bp->b_flags & B_ASYNC)))
4362 					nfs_write_error(bp->b_vp, error, cred);
4363 				/*
4364 				 * Update r_error and r_flags as appropriate.
4365 				 * If the error was ESTALE, then mark the
4366 				 * rnode as not being writeable and save
4367 				 * the error status.  Otherwise, save any
4368 				 * errors which occur from asynchronous
4369 				 * page invalidations.  Any errors occurring
4370 				 * from other operations should be saved
4371 				 * by the caller.
4372 				 */
4373 				mutex_enter(&rp->r_statelock);
4374 				if (error == ESTALE) {
4375 					rp->r_flags |= RSTALE;
4376 					if (!rp->r_error)
4377 						rp->r_error = error;
4378 				} else if (!rp->r_error &&
4379 				    (bp->b_flags &
4380 				    (B_INVAL|B_FORCE|B_ASYNC)) ==
4381 				    (B_INVAL|B_FORCE|B_ASYNC)) {
4382 					rp->r_error = error;
4383 				}
4384 				mutex_exit(&rp->r_statelock);
4385 			}
4386 			crfree(cred);
4387 		} else
4388 			error = rp->r_error;
4389 	}
4390 
4391 	if (error != 0 && error != NFS_EOF)
4392 		bp->b_flags |= B_ERROR;
4393 
4394 	DTRACE_IO1(done, struct buf *, bp);
4395 
4396 	return (error);
4397 }
4398 
4399 /* ARGSUSED */
4400 static int
4401 nfs3_fid(vnode_t *vp, fid_t *fidp, caller_context_t *ct)
4402 {
4403 	rnode_t *rp;
4404 
4405 	if (nfs_zone() != VTOMI(vp)->mi_zone)
4406 		return (EIO);
4407 	rp = VTOR(vp);
4408 
4409 	if (fidp->fid_len < (ushort_t)rp->r_fh.fh_len) {
4410 		fidp->fid_len = rp->r_fh.fh_len;
4411 		return (ENOSPC);
4412 	}
4413 	fidp->fid_len = rp->r_fh.fh_len;
4414 	bcopy(rp->r_fh.fh_buf, fidp->fid_data, fidp->fid_len);
4415 	return (0);
4416 }
4417 
4418 /* ARGSUSED2 */
4419 static int
4420 nfs3_rwlock(vnode_t *vp, int write_lock, caller_context_t *ctp)
4421 {
4422 	rnode_t *rp = VTOR(vp);
4423 
4424 	if (!write_lock) {
4425 		(void) nfs_rw_enter_sig(&rp->r_rwlock, RW_READER, FALSE);
4426 		return (V_WRITELOCK_FALSE);
4427 	}
4428 
4429 	if ((rp->r_flags & RDIRECTIO) || (VTOMI(vp)->mi_flags & MI_DIRECTIO)) {
4430 		(void) nfs_rw_enter_sig(&rp->r_rwlock, RW_READER, FALSE);
4431 		if (rp->r_mapcnt == 0 && !vn_has_cached_data(vp))
4432 			return (V_WRITELOCK_FALSE);
4433 		nfs_rw_exit(&rp->r_rwlock);
4434 	}
4435 
4436 	(void) nfs_rw_enter_sig(&rp->r_rwlock, RW_WRITER, FALSE);
4437 	return (V_WRITELOCK_TRUE);
4438 }
4439 
4440 /* ARGSUSED */
4441 static void
4442 nfs3_rwunlock(vnode_t *vp, int write_lock, caller_context_t *ctp)
4443 {
4444 	rnode_t *rp = VTOR(vp);
4445 
4446 	nfs_rw_exit(&rp->r_rwlock);
4447 }
4448 
4449 /* ARGSUSED */
4450 static int
4451 nfs3_seek(vnode_t *vp, offset_t ooff, offset_t *noffp, caller_context_t *ct)
4452 {
4453 
4454 	/*
4455 	 * Because we stuff the readdir cookie into the offset field
4456 	 * someone may attempt to do an lseek with the cookie which
4457 	 * we want to succeed.
4458 	 */
4459 	if (vp->v_type == VDIR)
4460 		return (0);
4461 	if (*noffp < 0)
4462 		return (EINVAL);
4463 	return (0);
4464 }
4465 
4466 /*
4467  * number of nfs3_bsize blocks to read ahead.
4468  */
4469 static int nfs3_nra = 4;
4470 
4471 #ifdef DEBUG
4472 static int nfs3_lostpage = 0;	/* number of times we lost original page */
4473 #endif
4474 
4475 /*
4476  * Return all the pages from [off..off+len) in file
4477  */
4478 /* ARGSUSED */
4479 static int
4480 nfs3_getpage(vnode_t *vp, offset_t off, size_t len, uint_t *protp,
4481 	page_t *pl[], size_t plsz, struct seg *seg, caddr_t addr,
4482 	enum seg_rw rw, cred_t *cr, caller_context_t *ct)
4483 {
4484 	rnode_t *rp;
4485 	int error;
4486 	mntinfo_t *mi;
4487 
4488 	if (vp->v_flag & VNOMAP)
4489 		return (ENOSYS);
4490 
4491 	if (nfs_zone() != VTOMI(vp)->mi_zone)
4492 		return (EIO);
4493 	if (protp != NULL)
4494 		*protp = PROT_ALL;
4495 
4496 	/*
4497 	 * Now valididate that the caches are up to date.
4498 	 */
4499 	error = nfs3_validate_caches(vp, cr);
4500 	if (error)
4501 		return (error);
4502 
4503 	rp = VTOR(vp);
4504 	mi = VTOMI(vp);
4505 retry:
4506 	mutex_enter(&rp->r_statelock);
4507 
4508 	/*
4509 	 * Don't create dirty pages faster than they
4510 	 * can be cleaned so that the system doesn't
4511 	 * get imbalanced.  If the async queue is
4512 	 * maxed out, then wait for it to drain before
4513 	 * creating more dirty pages.  Also, wait for
4514 	 * any threads doing pagewalks in the vop_getattr
4515 	 * entry points so that they don't block for
4516 	 * long periods.
4517 	 */
4518 	if (rw == S_CREATE) {
4519 		while ((mi->mi_max_threads != 0 &&
4520 		    rp->r_awcount > 2 * mi->mi_max_threads) ||
4521 		    rp->r_gcount > 0)
4522 			cv_wait(&rp->r_cv, &rp->r_statelock);
4523 	}
4524 
4525 	/*
4526 	 * If we are getting called as a side effect of an nfs_write()
4527 	 * operation the local file size might not be extended yet.
4528 	 * In this case we want to be able to return pages of zeroes.
4529 	 */
4530 	if (off + len > rp->r_size + PAGEOFFSET && seg != segkmap) {
4531 		mutex_exit(&rp->r_statelock);
4532 		return (EFAULT);		/* beyond EOF */
4533 	}
4534 
4535 	mutex_exit(&rp->r_statelock);
4536 
4537 	if (len <= PAGESIZE) {
4538 		error = nfs3_getapage(vp, off, len, protp, pl, plsz,
4539 		    seg, addr, rw, cr);
4540 	} else {
4541 		error = pvn_getpages(nfs3_getapage, vp, off, len, protp,
4542 		    pl, plsz, seg, addr, rw, cr);
4543 	}
4544 
4545 	switch (error) {
4546 	case NFS_EOF:
4547 		nfs_purge_caches(vp, NFS_NOPURGE_DNLC, cr);
4548 		goto retry;
4549 	case ESTALE:
4550 		PURGE_STALE_FH(error, vp, cr);
4551 	}
4552 
4553 	return (error);
4554 }
4555 
4556 /*
4557  * Called from pvn_getpages or nfs3_getpage to get a particular page.
4558  */
4559 /* ARGSUSED */
4560 static int
4561 nfs3_getapage(vnode_t *vp, u_offset_t off, size_t len, uint_t *protp,
4562 	page_t *pl[], size_t plsz, struct seg *seg, caddr_t addr,
4563 	enum seg_rw rw, cred_t *cr)
4564 {
4565 	rnode_t *rp;
4566 	uint_t bsize;
4567 	struct buf *bp;
4568 	page_t *pp;
4569 	u_offset_t lbn;
4570 	u_offset_t io_off;
4571 	u_offset_t blkoff;
4572 	u_offset_t rablkoff;
4573 	size_t io_len;
4574 	uint_t blksize;
4575 	int error;
4576 	int readahead;
4577 	int readahead_issued = 0;
4578 	int ra_window; /* readahead window */
4579 	page_t *pagefound;
4580 	page_t *savepp;
4581 
4582 	if (nfs_zone() != VTOMI(vp)->mi_zone)
4583 		return (EIO);
4584 	rp = VTOR(vp);
4585 	bsize = MAX(vp->v_vfsp->vfs_bsize, PAGESIZE);
4586 
4587 reread:
4588 	bp = NULL;
4589 	pp = NULL;
4590 	pagefound = NULL;
4591 
4592 	if (pl != NULL)
4593 		pl[0] = NULL;
4594 
4595 	error = 0;
4596 	lbn = off / bsize;
4597 	blkoff = lbn * bsize;
4598 
4599 	/*
4600 	 * Queueing up the readahead before doing the synchronous read
4601 	 * results in a significant increase in read throughput because
4602 	 * of the increased parallelism between the async threads and
4603 	 * the process context.
4604 	 */
4605 	if ((off & ((vp->v_vfsp->vfs_bsize) - 1)) == 0 &&
4606 	    rw != S_CREATE &&
4607 	    !(vp->v_flag & VNOCACHE)) {
4608 		mutex_enter(&rp->r_statelock);
4609 
4610 		/*
4611 		 * Calculate the number of readaheads to do.
4612 		 * a) No readaheads at offset = 0.
4613 		 * b) Do maximum(nfs3_nra) readaheads when the readahead
4614 		 *    window is closed.
4615 		 * c) Do readaheads between 1 to (nfs3_nra - 1) depending
4616 		 *    upon how far the readahead window is open or close.
4617 		 * d) No readaheads if rp->r_nextr is not within the scope
4618 		 *    of the readahead window (random i/o).
4619 		 */
4620 
4621 		if (off == 0)
4622 			readahead = 0;
4623 		else if (blkoff == rp->r_nextr)
4624 			readahead = nfs3_nra;
4625 		else if (rp->r_nextr > blkoff &&
4626 		    ((ra_window = (rp->r_nextr - blkoff) / bsize)
4627 		    <= (nfs3_nra - 1)))
4628 			readahead = nfs3_nra - ra_window;
4629 		else
4630 			readahead = 0;
4631 
4632 		rablkoff = rp->r_nextr;
4633 		while (readahead > 0 && rablkoff + bsize < rp->r_size) {
4634 			mutex_exit(&rp->r_statelock);
4635 			if (nfs_async_readahead(vp, rablkoff + bsize,
4636 			    addr + (rablkoff + bsize - off), seg, cr,
4637 			    nfs3_readahead) < 0) {
4638 				mutex_enter(&rp->r_statelock);
4639 				break;
4640 			}
4641 			readahead--;
4642 			rablkoff += bsize;
4643 			/*
4644 			 * Indicate that we did a readahead so
4645 			 * readahead offset is not updated
4646 			 * by the synchronous read below.
4647 			 */
4648 			readahead_issued = 1;
4649 			mutex_enter(&rp->r_statelock);
4650 			/*
4651 			 * set readahead offset to
4652 			 * offset of last async readahead
4653 			 * request.
4654 			 */
4655 			rp->r_nextr = rablkoff;
4656 		}
4657 		mutex_exit(&rp->r_statelock);
4658 	}
4659 
4660 again:
4661 	if ((pagefound = page_exists(vp, off)) == NULL) {
4662 		if (pl == NULL) {
4663 			(void) nfs_async_readahead(vp, blkoff, addr, seg, cr,
4664 			    nfs3_readahead);
4665 		} else if (rw == S_CREATE) {
4666 			/*
4667 			 * Block for this page is not allocated, or the offset
4668 			 * is beyond the current allocation size, or we're
4669 			 * allocating a swap slot and the page was not found,
4670 			 * so allocate it and return a zero page.
4671 			 */
4672 			if ((pp = page_create_va(vp, off,
4673 			    PAGESIZE, PG_WAIT, seg, addr)) == NULL)
4674 				cmn_err(CE_PANIC, "nfs3_getapage: page_create");
4675 			io_len = PAGESIZE;
4676 			mutex_enter(&rp->r_statelock);
4677 			rp->r_nextr = off + PAGESIZE;
4678 			mutex_exit(&rp->r_statelock);
4679 		} else {
4680 			/*
4681 			 * Need to go to server to get a BLOCK, exception to
4682 			 * that being while reading at offset = 0 or doing
4683 			 * random i/o, in that case read only a PAGE.
4684 			 */
4685 			mutex_enter(&rp->r_statelock);
4686 			if (blkoff < rp->r_size &&
4687 			    blkoff + bsize >= rp->r_size) {
4688 				/*
4689 				 * If only a block or less is left in
4690 				 * the file, read all that is remaining.
4691 				 */
4692 				if (rp->r_size <= off) {
4693 					/*
4694 					 * Trying to access beyond EOF,
4695 					 * set up to get at least one page.
4696 					 */
4697 					blksize = off + PAGESIZE - blkoff;
4698 				} else
4699 					blksize = rp->r_size - blkoff;
4700 			} else if ((off == 0) ||
4701 			    (off != rp->r_nextr && !readahead_issued)) {
4702 				blksize = PAGESIZE;
4703 				blkoff = off; /* block = page here */
4704 			} else
4705 				blksize = bsize;
4706 			mutex_exit(&rp->r_statelock);
4707 
4708 			pp = pvn_read_kluster(vp, off, seg, addr, &io_off,
4709 			    &io_len, blkoff, blksize, 0);
4710 
4711 			/*
4712 			 * Some other thread has entered the page,
4713 			 * so just use it.
4714 			 */
4715 			if (pp == NULL)
4716 				goto again;
4717 
4718 			/*
4719 			 * Now round the request size up to page boundaries.
4720 			 * This ensures that the entire page will be
4721 			 * initialized to zeroes if EOF is encountered.
4722 			 */
4723 			io_len = ptob(btopr(io_len));
4724 
4725 			bp = pageio_setup(pp, io_len, vp, B_READ);
4726 			ASSERT(bp != NULL);
4727 
4728 			/*
4729 			 * pageio_setup should have set b_addr to 0.  This
4730 			 * is correct since we want to do I/O on a page
4731 			 * boundary.  bp_mapin will use this addr to calculate
4732 			 * an offset, and then set b_addr to the kernel virtual
4733 			 * address it allocated for us.
4734 			 */
4735 			ASSERT(bp->b_un.b_addr == 0);
4736 
4737 			bp->b_edev = 0;
4738 			bp->b_dev = 0;
4739 			bp->b_lblkno = lbtodb(io_off);
4740 			bp->b_file = vp;
4741 			bp->b_offset = (offset_t)off;
4742 			bp_mapin(bp);
4743 
4744 			/*
4745 			 * If doing a write beyond what we believe is EOF,
4746 			 * don't bother trying to read the pages from the
4747 			 * server, we'll just zero the pages here.  We
4748 			 * don't check that the rw flag is S_WRITE here
4749 			 * because some implementations may attempt a
4750 			 * read access to the buffer before copying data.
4751 			 */
4752 			mutex_enter(&rp->r_statelock);
4753 			if (io_off >= rp->r_size && seg == segkmap) {
4754 				mutex_exit(&rp->r_statelock);
4755 				bzero(bp->b_un.b_addr, io_len);
4756 			} else {
4757 				mutex_exit(&rp->r_statelock);
4758 				error = nfs3_bio(bp, NULL, cr);
4759 			}
4760 
4761 			/*
4762 			 * Unmap the buffer before freeing it.
4763 			 */
4764 			bp_mapout(bp);
4765 			pageio_done(bp);
4766 
4767 			savepp = pp;
4768 			do {
4769 				pp->p_fsdata = C_NOCOMMIT;
4770 			} while ((pp = pp->p_next) != savepp);
4771 
4772 			if (error == NFS_EOF) {
4773 				/*
4774 				 * If doing a write system call just return
4775 				 * zeroed pages, else user tried to get pages
4776 				 * beyond EOF, return error.  We don't check
4777 				 * that the rw flag is S_WRITE here because
4778 				 * some implementations may attempt a read
4779 				 * access to the buffer before copying data.
4780 				 */
4781 				if (seg == segkmap)
4782 					error = 0;
4783 				else
4784 					error = EFAULT;
4785 			}
4786 
4787 			if (!readahead_issued && !error) {
4788 				mutex_enter(&rp->r_statelock);
4789 				rp->r_nextr = io_off + io_len;
4790 				mutex_exit(&rp->r_statelock);
4791 			}
4792 		}
4793 	}
4794 
4795 out:
4796 	if (pl == NULL)
4797 		return (error);
4798 
4799 	if (error) {
4800 		if (pp != NULL)
4801 			pvn_read_done(pp, B_ERROR);
4802 		return (error);
4803 	}
4804 
4805 	if (pagefound) {
4806 		se_t se = (rw == S_CREATE ? SE_EXCL : SE_SHARED);
4807 
4808 		/*
4809 		 * Page exists in the cache, acquire the appropriate lock.
4810 		 * If this fails, start all over again.
4811 		 */
4812 		if ((pp = page_lookup(vp, off, se)) == NULL) {
4813 #ifdef DEBUG
4814 			nfs3_lostpage++;
4815 #endif
4816 			goto reread;
4817 		}
4818 		pl[0] = pp;
4819 		pl[1] = NULL;
4820 		return (0);
4821 	}
4822 
4823 	if (pp != NULL)
4824 		pvn_plist_init(pp, pl, plsz, off, io_len, rw);
4825 
4826 	return (error);
4827 }
4828 
4829 static void
4830 nfs3_readahead(vnode_t *vp, u_offset_t blkoff, caddr_t addr, struct seg *seg,
4831 	cred_t *cr)
4832 {
4833 	int error;
4834 	page_t *pp;
4835 	u_offset_t io_off;
4836 	size_t io_len;
4837 	struct buf *bp;
4838 	uint_t bsize, blksize;
4839 	rnode_t *rp = VTOR(vp);
4840 	page_t *savepp;
4841 
4842 	ASSERT(nfs_zone() == VTOMI(vp)->mi_zone);
4843 	bsize = MAX(vp->v_vfsp->vfs_bsize, PAGESIZE);
4844 
4845 	mutex_enter(&rp->r_statelock);
4846 	if (blkoff < rp->r_size && blkoff + bsize > rp->r_size) {
4847 		/*
4848 		 * If less than a block left in file read less
4849 		 * than a block.
4850 		 */
4851 		blksize = rp->r_size - blkoff;
4852 	} else
4853 		blksize = bsize;
4854 	mutex_exit(&rp->r_statelock);
4855 
4856 	pp = pvn_read_kluster(vp, blkoff, segkmap, addr,
4857 	    &io_off, &io_len, blkoff, blksize, 1);
4858 	/*
4859 	 * The isra flag passed to the kluster function is 1, we may have
4860 	 * gotten a return value of NULL for a variety of reasons (# of free
4861 	 * pages < minfree, someone entered the page on the vnode etc). In all
4862 	 * cases, we want to punt on the readahead.
4863 	 */
4864 	if (pp == NULL)
4865 		return;
4866 
4867 	/*
4868 	 * Now round the request size up to page boundaries.
4869 	 * This ensures that the entire page will be
4870 	 * initialized to zeroes if EOF is encountered.
4871 	 */
4872 	io_len = ptob(btopr(io_len));
4873 
4874 	bp = pageio_setup(pp, io_len, vp, B_READ);
4875 	ASSERT(bp != NULL);
4876 
4877 	/*
4878 	 * pageio_setup should have set b_addr to 0.  This is correct since
4879 	 * we want to do I/O on a page boundary. bp_mapin() will use this addr
4880 	 * to calculate an offset, and then set b_addr to the kernel virtual
4881 	 * address it allocated for us.
4882 	 */
4883 	ASSERT(bp->b_un.b_addr == 0);
4884 
4885 	bp->b_edev = 0;
4886 	bp->b_dev = 0;
4887 	bp->b_lblkno = lbtodb(io_off);
4888 	bp->b_file = vp;
4889 	bp->b_offset = (offset_t)blkoff;
4890 	bp_mapin(bp);
4891 
4892 	/*
4893 	 * If doing a write beyond what we believe is EOF, don't bother trying
4894 	 * to read the pages from the server, we'll just zero the pages here.
4895 	 * We don't check that the rw flag is S_WRITE here because some
4896 	 * implementations may attempt a read access to the buffer before
4897 	 * copying data.
4898 	 */
4899 	mutex_enter(&rp->r_statelock);
4900 	if (io_off >= rp->r_size && seg == segkmap) {
4901 		mutex_exit(&rp->r_statelock);
4902 		bzero(bp->b_un.b_addr, io_len);
4903 		error = 0;
4904 	} else {
4905 		mutex_exit(&rp->r_statelock);
4906 		error = nfs3_bio(bp, NULL, cr);
4907 		if (error == NFS_EOF)
4908 			error = 0;
4909 	}
4910 
4911 	/*
4912 	 * Unmap the buffer before freeing it.
4913 	 */
4914 	bp_mapout(bp);
4915 	pageio_done(bp);
4916 
4917 	savepp = pp;
4918 	do {
4919 		pp->p_fsdata = C_NOCOMMIT;
4920 	} while ((pp = pp->p_next) != savepp);
4921 
4922 	pvn_read_done(pp, error ? B_READ | B_ERROR : B_READ);
4923 
4924 	/*
4925 	 * In case of error set readahead offset
4926 	 * to the lowest offset.
4927 	 * pvn_read_done() calls VN_DISPOSE to destroy the pages
4928 	 */
4929 	if (error && rp->r_nextr > io_off) {
4930 		mutex_enter(&rp->r_statelock);
4931 		if (rp->r_nextr > io_off)
4932 			rp->r_nextr = io_off;
4933 		mutex_exit(&rp->r_statelock);
4934 	}
4935 }
4936 
4937 /*
4938  * Flags are composed of {B_INVAL, B_FREE, B_DONTNEED, B_FORCE}
4939  * If len == 0, do from off to EOF.
4940  *
4941  * The normal cases should be len == 0 && off == 0 (entire vp list),
4942  * len == MAXBSIZE (from segmap_release actions), and len == PAGESIZE
4943  * (from pageout).
4944  */
4945 /* ARGSUSED */
4946 static int
4947 nfs3_putpage(vnode_t *vp, offset_t off, size_t len, int flags, cred_t *cr,
4948 	caller_context_t *ct)
4949 {
4950 	int error;
4951 	rnode_t *rp;
4952 
4953 	ASSERT(cr != NULL);
4954 
4955 	/*
4956 	 * XXX - Why should this check be made here?
4957 	 */
4958 	if (vp->v_flag & VNOMAP)
4959 		return (ENOSYS);
4960 	if (len == 0 && !(flags & B_INVAL) && vn_is_readonly(vp))
4961 		return (0);
4962 	if (!(flags & B_ASYNC) && nfs_zone() != VTOMI(vp)->mi_zone)
4963 		return (EIO);
4964 
4965 	rp = VTOR(vp);
4966 	mutex_enter(&rp->r_statelock);
4967 	rp->r_count++;
4968 	mutex_exit(&rp->r_statelock);
4969 	error = nfs_putpages(vp, off, len, flags, cr);
4970 	mutex_enter(&rp->r_statelock);
4971 	rp->r_count--;
4972 	cv_broadcast(&rp->r_cv);
4973 	mutex_exit(&rp->r_statelock);
4974 
4975 	return (error);
4976 }
4977 
4978 /*
4979  * Write out a single page, possibly klustering adjacent dirty pages.
4980  */
4981 int
4982 nfs3_putapage(vnode_t *vp, page_t *pp, u_offset_t *offp, size_t *lenp,
4983 	int flags, cred_t *cr)
4984 {
4985 	u_offset_t io_off;
4986 	u_offset_t lbn_off;
4987 	u_offset_t lbn;
4988 	size_t io_len;
4989 	uint_t bsize;
4990 	int error;
4991 	rnode_t *rp;
4992 
4993 	ASSERT(!vn_is_readonly(vp));
4994 	ASSERT(pp != NULL);
4995 	ASSERT(cr != NULL);
4996 	ASSERT((flags & B_ASYNC) || nfs_zone() == VTOMI(vp)->mi_zone);
4997 
4998 	rp = VTOR(vp);
4999 	ASSERT(rp->r_count > 0);
5000 
5001 	bsize = MAX(vp->v_vfsp->vfs_bsize, PAGESIZE);
5002 	lbn = pp->p_offset / bsize;
5003 	lbn_off = lbn * bsize;
5004 
5005 	/*
5006 	 * Find a kluster that fits in one block, or in
5007 	 * one page if pages are bigger than blocks.  If
5008 	 * there is less file space allocated than a whole
5009 	 * page, we'll shorten the i/o request below.
5010 	 */
5011 	pp = pvn_write_kluster(vp, pp, &io_off, &io_len, lbn_off,
5012 	    roundup(bsize, PAGESIZE), flags);
5013 
5014 	/*
5015 	 * pvn_write_kluster shouldn't have returned a page with offset
5016 	 * behind the original page we were given.  Verify that.
5017 	 */
5018 	ASSERT((pp->p_offset / bsize) >= lbn);
5019 
5020 	/*
5021 	 * Now pp will have the list of kept dirty pages marked for
5022 	 * write back.  It will also handle invalidation and freeing
5023 	 * of pages that are not dirty.  Check for page length rounding
5024 	 * problems.
5025 	 */
5026 	if (io_off + io_len > lbn_off + bsize) {
5027 		ASSERT((io_off + io_len) - (lbn_off + bsize) < PAGESIZE);
5028 		io_len = lbn_off + bsize - io_off;
5029 	}
5030 	/*
5031 	 * The RMODINPROGRESS flag makes sure that nfs(3)_bio() sees a
5032 	 * consistent value of r_size. RMODINPROGRESS is set in writerp().
5033 	 * When RMODINPROGRESS is set it indicates that a uiomove() is in
5034 	 * progress and the r_size has not been made consistent with the
5035 	 * new size of the file. When the uiomove() completes the r_size is
5036 	 * updated and the RMODINPROGRESS flag is cleared.
5037 	 *
5038 	 * The RMODINPROGRESS flag makes sure that nfs(3)_bio() sees a
5039 	 * consistent value of r_size. Without this handshaking, it is
5040 	 * possible that nfs(3)_bio() picks  up the old value of r_size
5041 	 * before the uiomove() in writerp() completes. This will result
5042 	 * in the write through nfs(3)_bio() being dropped.
5043 	 *
5044 	 * More precisely, there is a window between the time the uiomove()
5045 	 * completes and the time the r_size is updated. If a VOP_PUTPAGE()
5046 	 * operation intervenes in this window, the page will be picked up,
5047 	 * because it is dirty (it will be unlocked, unless it was
5048 	 * pagecreate'd). When the page is picked up as dirty, the dirty
5049 	 * bit is reset (pvn_getdirty()). In nfs(3)write(), r_size is
5050 	 * checked. This will still be the old size. Therefore the page will
5051 	 * not be written out. When segmap_release() calls VOP_PUTPAGE(),
5052 	 * the page will be found to be clean and the write will be dropped.
5053 	 */
5054 	if (rp->r_flags & RMODINPROGRESS) {
5055 		mutex_enter(&rp->r_statelock);
5056 		if ((rp->r_flags & RMODINPROGRESS) &&
5057 		    rp->r_modaddr + MAXBSIZE > io_off &&
5058 		    rp->r_modaddr < io_off + io_len) {
5059 			page_t *plist;
5060 			/*
5061 			 * A write is in progress for this region of the file.
5062 			 * If we did not detect RMODINPROGRESS here then this
5063 			 * path through nfs_putapage() would eventually go to
5064 			 * nfs(3)_bio() and may not write out all of the data
5065 			 * in the pages. We end up losing data. So we decide
5066 			 * to set the modified bit on each page in the page
5067 			 * list and mark the rnode with RDIRTY. This write
5068 			 * will be restarted at some later time.
5069 			 */
5070 			plist = pp;
5071 			while (plist != NULL) {
5072 				pp = plist;
5073 				page_sub(&plist, pp);
5074 				hat_setmod(pp);
5075 				page_io_unlock(pp);
5076 				page_unlock(pp);
5077 			}
5078 			rp->r_flags |= RDIRTY;
5079 			mutex_exit(&rp->r_statelock);
5080 			if (offp)
5081 				*offp = io_off;
5082 			if (lenp)
5083 				*lenp = io_len;
5084 			return (0);
5085 		}
5086 		mutex_exit(&rp->r_statelock);
5087 	}
5088 
5089 	if (flags & B_ASYNC) {
5090 		error = nfs_async_putapage(vp, pp, io_off, io_len, flags, cr,
5091 		    nfs3_sync_putapage);
5092 	} else
5093 		error = nfs3_sync_putapage(vp, pp, io_off, io_len, flags, cr);
5094 
5095 	if (offp)
5096 		*offp = io_off;
5097 	if (lenp)
5098 		*lenp = io_len;
5099 	return (error);
5100 }
5101 
5102 static int
5103 nfs3_sync_putapage(vnode_t *vp, page_t *pp, u_offset_t io_off, size_t io_len,
5104 	int flags, cred_t *cr)
5105 {
5106 	int error;
5107 	rnode_t *rp;
5108 
5109 	ASSERT(nfs_zone() == VTOMI(vp)->mi_zone);
5110 
5111 	flags |= B_WRITE;
5112 
5113 	error = nfs3_rdwrlbn(vp, pp, io_off, io_len, flags, cr);
5114 
5115 	rp = VTOR(vp);
5116 
5117 	if ((error == ENOSPC || error == EDQUOT || error == EFBIG ||
5118 	    error == EACCES) &&
5119 	    (flags & (B_INVAL|B_FORCE)) != (B_INVAL|B_FORCE)) {
5120 		if (!(rp->r_flags & ROUTOFSPACE)) {
5121 			mutex_enter(&rp->r_statelock);
5122 			rp->r_flags |= ROUTOFSPACE;
5123 			mutex_exit(&rp->r_statelock);
5124 		}
5125 		flags |= B_ERROR;
5126 		pvn_write_done(pp, flags);
5127 		/*
5128 		 * If this was not an async thread, then try again to
5129 		 * write out the pages, but this time, also destroy
5130 		 * them whether or not the write is successful.  This
5131 		 * will prevent memory from filling up with these
5132 		 * pages and destroying them is the only alternative
5133 		 * if they can't be written out.
5134 		 *
5135 		 * Don't do this if this is an async thread because
5136 		 * when the pages are unlocked in pvn_write_done,
5137 		 * some other thread could have come along, locked
5138 		 * them, and queued for an async thread.  It would be
5139 		 * possible for all of the async threads to be tied
5140 		 * up waiting to lock the pages again and they would
5141 		 * all already be locked and waiting for an async
5142 		 * thread to handle them.  Deadlock.
5143 		 */
5144 		if (!(flags & B_ASYNC)) {
5145 			error = nfs3_putpage(vp, io_off, io_len,
5146 			    B_INVAL | B_FORCE, cr, NULL);
5147 		}
5148 	} else {
5149 		if (error)
5150 			flags |= B_ERROR;
5151 		else if (rp->r_flags & ROUTOFSPACE) {
5152 			mutex_enter(&rp->r_statelock);
5153 			rp->r_flags &= ~ROUTOFSPACE;
5154 			mutex_exit(&rp->r_statelock);
5155 		}
5156 		pvn_write_done(pp, flags);
5157 		if (freemem < desfree)
5158 			(void) nfs3_commit_vp(vp, (u_offset_t)0, 0, cr);
5159 	}
5160 
5161 	return (error);
5162 }
5163 
5164 /* ARGSUSED */
5165 static int
5166 nfs3_map(vnode_t *vp, offset_t off, struct as *as, caddr_t *addrp,
5167 	size_t len, uchar_t prot, uchar_t maxprot, uint_t flags,
5168 	cred_t *cr, caller_context_t *ct)
5169 {
5170 	struct segvn_crargs vn_a;
5171 	int error;
5172 	rnode_t *rp;
5173 	struct vattr va;
5174 
5175 	if (nfs_zone() != VTOMI(vp)->mi_zone)
5176 		return (EIO);
5177 
5178 	if (vp->v_flag & VNOMAP)
5179 		return (ENOSYS);
5180 
5181 	if (off < 0 || off + len < 0)
5182 		return (ENXIO);
5183 
5184 	if (vp->v_type != VREG)
5185 		return (ENODEV);
5186 
5187 	/*
5188 	 * If there is cached data and if close-to-open consistency
5189 	 * checking is not turned off and if the file system is not
5190 	 * mounted readonly, then force an over the wire getattr.
5191 	 * Otherwise, just invoke nfs3getattr to get a copy of the
5192 	 * attributes.  The attribute cache will be used unless it
5193 	 * is timed out and if it is, then an over the wire getattr
5194 	 * will be issued.
5195 	 */
5196 	va.va_mask = AT_ALL;
5197 	if (vn_has_cached_data(vp) &&
5198 	    !(VTOMI(vp)->mi_flags & MI_NOCTO) && !vn_is_readonly(vp))
5199 		error = nfs3_getattr_otw(vp, &va, cr);
5200 	else
5201 		error = nfs3getattr(vp, &va, cr);
5202 	if (error)
5203 		return (error);
5204 
5205 	/*
5206 	 * Check to see if the vnode is currently marked as not cachable.
5207 	 * This means portions of the file are locked (through VOP_FRLOCK).
5208 	 * In this case the map request must be refused.  We use
5209 	 * rp->r_lkserlock to avoid a race with concurrent lock requests.
5210 	 */
5211 	rp = VTOR(vp);
5212 
5213 	/*
5214 	 * Atomically increment r_inmap after acquiring r_rwlock. The
5215 	 * idea here is to acquire r_rwlock to block read/write and
5216 	 * not to protect r_inmap. r_inmap will inform nfs3_read/write()
5217 	 * that we are in nfs3_map(). Now, r_rwlock is acquired in order
5218 	 * and we can prevent the deadlock that would have occurred
5219 	 * when nfs3_addmap() would have acquired it out of order.
5220 	 *
5221 	 * Since we are not protecting r_inmap by any lock, we do not
5222 	 * hold any lock when we decrement it. We atomically decrement
5223 	 * r_inmap after we release r_lkserlock.
5224 	 */
5225 
5226 	if (nfs_rw_enter_sig(&rp->r_rwlock, RW_WRITER, INTR(vp)))
5227 		return (EINTR);
5228 	atomic_add_int(&rp->r_inmap, 1);
5229 	nfs_rw_exit(&rp->r_rwlock);
5230 
5231 	if (nfs_rw_enter_sig(&rp->r_lkserlock, RW_READER, INTR(vp))) {
5232 		atomic_add_int(&rp->r_inmap, -1);
5233 		return (EINTR);
5234 	}
5235 
5236 	if (vp->v_flag & VNOCACHE) {
5237 		error = EAGAIN;
5238 		goto done;
5239 	}
5240 
5241 	/*
5242 	 * Don't allow concurrent locks and mapping if mandatory locking is
5243 	 * enabled.
5244 	 */
5245 	if ((flk_has_remote_locks(vp) || lm_has_sleep(vp)) &&
5246 	    MANDLOCK(vp, va.va_mode)) {
5247 		error = EAGAIN;
5248 		goto done;
5249 	}
5250 
5251 	as_rangelock(as);
5252 	error = choose_addr(as, addrp, len, off, ADDR_VACALIGN, flags);
5253 	if (error != 0) {
5254 		as_rangeunlock(as);
5255 		goto done;
5256 	}
5257 
5258 	vn_a.vp = vp;
5259 	vn_a.offset = off;
5260 	vn_a.type = (flags & MAP_TYPE);
5261 	vn_a.prot = (uchar_t)prot;
5262 	vn_a.maxprot = (uchar_t)maxprot;
5263 	vn_a.flags = (flags & ~MAP_TYPE);
5264 	vn_a.cred = cr;
5265 	vn_a.amp = NULL;
5266 	vn_a.szc = 0;
5267 	vn_a.lgrp_mem_policy_flags = 0;
5268 
5269 	error = as_map(as, *addrp, len, segvn_create, &vn_a);
5270 	as_rangeunlock(as);
5271 
5272 done:
5273 	nfs_rw_exit(&rp->r_lkserlock);
5274 	atomic_add_int(&rp->r_inmap, -1);
5275 	return (error);
5276 }
5277 
5278 /* ARGSUSED */
5279 static int
5280 nfs3_addmap(vnode_t *vp, offset_t off, struct as *as, caddr_t addr,
5281 	size_t len, uchar_t prot, uchar_t maxprot, uint_t flags,
5282 	cred_t *cr, caller_context_t *ct)
5283 {
5284 	rnode_t *rp;
5285 
5286 	if (vp->v_flag & VNOMAP)
5287 		return (ENOSYS);
5288 	if (nfs_zone() != VTOMI(vp)->mi_zone)
5289 		return (EIO);
5290 
5291 	rp = VTOR(vp);
5292 	atomic_add_long((ulong_t *)&rp->r_mapcnt, btopr(len));
5293 
5294 	return (0);
5295 }
5296 
5297 /* ARGSUSED */
5298 static int
5299 nfs3_frlock(vnode_t *vp, int cmd, struct flock64 *bfp, int flag,
5300 	offset_t offset, struct flk_callback *flk_cbp, cred_t *cr,
5301 	caller_context_t *ct)
5302 {
5303 	netobj lm_fh3;
5304 	int rc;
5305 	u_offset_t start, end;
5306 	rnode_t *rp;
5307 	int error = 0, intr = INTR(vp);
5308 
5309 	if (nfs_zone() != VTOMI(vp)->mi_zone)
5310 		return (EIO);
5311 	/* check for valid cmd parameter */
5312 	if (cmd != F_GETLK && cmd != F_SETLK && cmd != F_SETLKW)
5313 		return (EINVAL);
5314 
5315 	/* Verify l_type. */
5316 	switch (bfp->l_type) {
5317 	case F_RDLCK:
5318 		if (cmd != F_GETLK && !(flag & FREAD))
5319 			return (EBADF);
5320 		break;
5321 	case F_WRLCK:
5322 		if (cmd != F_GETLK && !(flag & FWRITE))
5323 			return (EBADF);
5324 		break;
5325 	case F_UNLCK:
5326 		intr = 0;
5327 		break;
5328 
5329 	default:
5330 		return (EINVAL);
5331 	}
5332 
5333 	/* check the validity of the lock range */
5334 	if (rc = flk_convert_lock_data(vp, bfp, &start, &end, offset))
5335 		return (rc);
5336 	if (rc = flk_check_lock_data(start, end, MAXEND))
5337 		return (rc);
5338 
5339 	/*
5340 	 * If the filesystem is mounted using local locking, pass the
5341 	 * request off to the local locking code.
5342 	 */
5343 	if (VTOMI(vp)->mi_flags & MI_LLOCK) {
5344 		if (cmd == F_SETLK || cmd == F_SETLKW) {
5345 			/*
5346 			 * For complete safety, we should be holding
5347 			 * r_lkserlock.  However, we can't call
5348 			 * lm_safelock and then fs_frlock while
5349 			 * holding r_lkserlock, so just invoke
5350 			 * lm_safelock and expect that this will
5351 			 * catch enough of the cases.
5352 			 */
5353 			if (!lm_safelock(vp, bfp, cr))
5354 				return (EAGAIN);
5355 		}
5356 		return (fs_frlock(vp, cmd, bfp, flag, offset, flk_cbp, cr, ct));
5357 	}
5358 
5359 	rp = VTOR(vp);
5360 
5361 	/*
5362 	 * Check whether the given lock request can proceed, given the
5363 	 * current file mappings.
5364 	 */
5365 	if (nfs_rw_enter_sig(&rp->r_lkserlock, RW_WRITER, intr))
5366 		return (EINTR);
5367 	if (cmd == F_SETLK || cmd == F_SETLKW) {
5368 		if (!lm_safelock(vp, bfp, cr)) {
5369 			rc = EAGAIN;
5370 			goto done;
5371 		}
5372 	}
5373 
5374 	/*
5375 	 * Flush the cache after waiting for async I/O to finish.  For new
5376 	 * locks, this is so that the process gets the latest bits from the
5377 	 * server.  For unlocks, this is so that other clients see the
5378 	 * latest bits once the file has been unlocked.  If currently dirty
5379 	 * pages can't be flushed, then don't allow a lock to be set.  But
5380 	 * allow unlocks to succeed, to avoid having orphan locks on the
5381 	 * server.
5382 	 */
5383 	if (cmd != F_GETLK) {
5384 		mutex_enter(&rp->r_statelock);
5385 		while (rp->r_count > 0) {
5386 			if (intr) {
5387 				klwp_t *lwp = ttolwp(curthread);
5388 
5389 				if (lwp != NULL)
5390 					lwp->lwp_nostop++;
5391 				if (cv_wait_sig(&rp->r_cv,
5392 				    &rp->r_statelock) == 0) {
5393 					if (lwp != NULL)
5394 						lwp->lwp_nostop--;
5395 					rc = EINTR;
5396 					break;
5397 				}
5398 				if (lwp != NULL)
5399 					lwp->lwp_nostop--;
5400 			} else
5401 				cv_wait(&rp->r_cv, &rp->r_statelock);
5402 		}
5403 		mutex_exit(&rp->r_statelock);
5404 		if (rc != 0)
5405 			goto done;
5406 		error = nfs3_putpage(vp, (offset_t)0, 0, B_INVAL, cr, ct);
5407 		if (error) {
5408 			if (error == ENOSPC || error == EDQUOT) {
5409 				mutex_enter(&rp->r_statelock);
5410 				if (!rp->r_error)
5411 					rp->r_error = error;
5412 				mutex_exit(&rp->r_statelock);
5413 			}
5414 			if (bfp->l_type != F_UNLCK) {
5415 				rc = ENOLCK;
5416 				goto done;
5417 			}
5418 		}
5419 	}
5420 
5421 	lm_fh3.n_len = VTOFH3(vp)->fh3_length;
5422 	lm_fh3.n_bytes = (char *)&(VTOFH3(vp)->fh3_u.data);
5423 
5424 	/*
5425 	 * Call the lock manager to do the real work of contacting
5426 	 * the server and obtaining the lock.
5427 	 */
5428 	rc = lm4_frlock(vp, cmd, bfp, flag, offset, cr, &lm_fh3, flk_cbp);
5429 
5430 	if (rc == 0)
5431 		nfs_lockcompletion(vp, cmd);
5432 
5433 done:
5434 	nfs_rw_exit(&rp->r_lkserlock);
5435 	return (rc);
5436 }
5437 
5438 /*
5439  * Free storage space associated with the specified vnode.  The portion
5440  * to be freed is specified by bfp->l_start and bfp->l_len (already
5441  * normalized to a "whence" of 0).
5442  *
5443  * This is an experimental facility whose continued existence is not
5444  * guaranteed.  Currently, we only support the special case
5445  * of l_len == 0, meaning free to end of file.
5446  */
5447 /* ARGSUSED */
5448 static int
5449 nfs3_space(vnode_t *vp, int cmd, struct flock64 *bfp, int flag,
5450 	offset_t offset, cred_t *cr, caller_context_t *ct)
5451 {
5452 	int error;
5453 
5454 	ASSERT(vp->v_type == VREG);
5455 	if (cmd != F_FREESP)
5456 		return (EINVAL);
5457 	if (nfs_zone() != VTOMI(vp)->mi_zone)
5458 		return (EIO);
5459 
5460 	error = convoff(vp, bfp, 0, offset);
5461 	if (!error) {
5462 		ASSERT(bfp->l_start >= 0);
5463 		if (bfp->l_len == 0) {
5464 			struct vattr va;
5465 
5466 			/*
5467 			 * ftruncate should not change the ctime and
5468 			 * mtime if we truncate the file to its
5469 			 * previous size.
5470 			 */
5471 			va.va_mask = AT_SIZE;
5472 			error = nfs3getattr(vp, &va, cr);
5473 			if (error || va.va_size == bfp->l_start)
5474 				return (error);
5475 			va.va_mask = AT_SIZE;
5476 			va.va_size = bfp->l_start;
5477 			error = nfs3setattr(vp, &va, 0, cr);
5478 		} else
5479 			error = EINVAL;
5480 	}
5481 
5482 	return (error);
5483 }
5484 
5485 /* ARGSUSED */
5486 static int
5487 nfs3_realvp(vnode_t *vp, vnode_t **vpp, caller_context_t *ct)
5488 {
5489 
5490 	return (EINVAL);
5491 }
5492 
5493 /*
5494  * Setup and add an address space callback to do the work of the delmap call.
5495  * The callback will (and must be) deleted in the actual callback function.
5496  *
5497  * This is done in order to take care of the problem that we have with holding
5498  * the address space's a_lock for a long period of time (e.g. if the NFS server
5499  * is down).  Callbacks will be executed in the address space code while the
5500  * a_lock is not held.	Holding the address space's a_lock causes things such
5501  * as ps and fork to hang because they are trying to acquire this lock as well.
5502  */
5503 /* ARGSUSED */
5504 static int
5505 nfs3_delmap(vnode_t *vp, offset_t off, struct as *as, caddr_t addr,
5506 	size_t len, uint_t prot, uint_t maxprot, uint_t flags,
5507 	cred_t *cr, caller_context_t *ct)
5508 {
5509 	int			caller_found;
5510 	int			error;
5511 	rnode_t			*rp;
5512 	nfs_delmap_args_t	*dmapp;
5513 	nfs_delmapcall_t	*delmap_call;
5514 
5515 	if (vp->v_flag & VNOMAP)
5516 		return (ENOSYS);
5517 	/*
5518 	 * A process may not change zones if it has NFS pages mmap'ed
5519 	 * in, so we can't legitimately get here from the wrong zone.
5520 	 */
5521 	ASSERT(nfs_zone() == VTOMI(vp)->mi_zone);
5522 
5523 	rp = VTOR(vp);
5524 
5525 	/*
5526 	 * The way that the address space of this process deletes its mapping
5527 	 * of this file is via the following call chains:
5528 	 * - as_free()->SEGOP_UNMAP()/segvn_unmap()->VOP_DELMAP()/nfs3_delmap()
5529 	 * - as_unmap()->SEGOP_UNMAP()/segvn_unmap()->VOP_DELMAP()/nfs3_delmap()
5530 	 *
5531 	 * With the use of address space callbacks we are allowed to drop the
5532 	 * address space lock, a_lock, while executing the NFS operations that
5533 	 * need to go over the wire.  Returning EAGAIN to the caller of this
5534 	 * function is what drives the execution of the callback that we add
5535 	 * below.  The callback will be executed by the address space code
5536 	 * after dropping the a_lock.  When the callback is finished, since
5537 	 * we dropped the a_lock, it must be re-acquired and segvn_unmap()
5538 	 * is called again on the same segment to finish the rest of the work
5539 	 * that needs to happen during unmapping.
5540 	 *
5541 	 * This action of calling back into the segment driver causes
5542 	 * nfs3_delmap() to get called again, but since the callback was
5543 	 * already executed at this point, it already did the work and there
5544 	 * is nothing left for us to do.
5545 	 *
5546 	 * To Summarize:
5547 	 * - The first time nfs3_delmap is called by the current thread is when
5548 	 * we add the caller associated with this delmap to the delmap caller
5549 	 * list, add the callback, and return EAGAIN.
5550 	 * - The second time in this call chain when nfs3_delmap is called we
5551 	 * will find this caller in the delmap caller list and realize there
5552 	 * is no more work to do thus removing this caller from the list and
5553 	 * returning the error that was set in the callback execution.
5554 	 */
5555 	caller_found = nfs_find_and_delete_delmapcall(rp, &error);
5556 	if (caller_found) {
5557 		/*
5558 		 * 'error' is from the actual delmap operations.  To avoid
5559 		 * hangs, we need to handle the return of EAGAIN differently
5560 		 * since this is what drives the callback execution.
5561 		 * In this case, we don't want to return EAGAIN and do the
5562 		 * callback execution because there are none to execute.
5563 		 */
5564 		if (error == EAGAIN)
5565 			return (0);
5566 		else
5567 			return (error);
5568 	}
5569 
5570 	/* current caller was not in the list */
5571 	delmap_call = nfs_init_delmapcall();
5572 
5573 	mutex_enter(&rp->r_statelock);
5574 	list_insert_tail(&rp->r_indelmap, delmap_call);
5575 	mutex_exit(&rp->r_statelock);
5576 
5577 	dmapp = kmem_alloc(sizeof (nfs_delmap_args_t), KM_SLEEP);
5578 
5579 	dmapp->vp = vp;
5580 	dmapp->off = off;
5581 	dmapp->addr = addr;
5582 	dmapp->len = len;
5583 	dmapp->prot = prot;
5584 	dmapp->maxprot = maxprot;
5585 	dmapp->flags = flags;
5586 	dmapp->cr = cr;
5587 	dmapp->caller = delmap_call;
5588 
5589 	error = as_add_callback(as, nfs3_delmap_callback, dmapp,
5590 	    AS_UNMAP_EVENT, addr, len, KM_SLEEP);
5591 
5592 	return (error ? error : EAGAIN);
5593 }
5594 
5595 /*
5596  * Remove some pages from an mmap'd vnode.  Just update the
5597  * count of pages.  If doing close-to-open, then flush and
5598  * commit all of the pages associated with this file.
5599  * Otherwise, start an asynchronous page flush to write out
5600  * any dirty pages.  This will also associate a credential
5601  * with the rnode which can be used to write the pages.
5602  */
5603 /* ARGSUSED */
5604 static void
5605 nfs3_delmap_callback(struct as *as, void *arg, uint_t event)
5606 {
5607 	int			error;
5608 	rnode_t			*rp;
5609 	mntinfo_t		*mi;
5610 	nfs_delmap_args_t	*dmapp = (nfs_delmap_args_t *)arg;
5611 
5612 	rp = VTOR(dmapp->vp);
5613 	mi = VTOMI(dmapp->vp);
5614 
5615 	atomic_add_long((ulong_t *)&rp->r_mapcnt, -btopr(dmapp->len));
5616 	ASSERT(rp->r_mapcnt >= 0);
5617 
5618 	/*
5619 	 * Initiate a page flush and potential commit if there are
5620 	 * pages, the file system was not mounted readonly, the segment
5621 	 * was mapped shared, and the pages themselves were writeable.
5622 	 */
5623 	if (vn_has_cached_data(dmapp->vp) && !vn_is_readonly(dmapp->vp) &&
5624 	    dmapp->flags == MAP_SHARED && (dmapp->maxprot & PROT_WRITE)) {
5625 		mutex_enter(&rp->r_statelock);
5626 		rp->r_flags |= RDIRTY;
5627 		mutex_exit(&rp->r_statelock);
5628 		/*
5629 		 * If this is a cross-zone access a sync putpage won't work, so
5630 		 * the best we can do is try an async putpage.  That seems
5631 		 * better than something more draconian such as discarding the
5632 		 * dirty pages.
5633 		 */
5634 		if ((mi->mi_flags & MI_NOCTO) ||
5635 		    nfs_zone() != mi->mi_zone)
5636 			error = nfs3_putpage(dmapp->vp, dmapp->off, dmapp->len,
5637 			    B_ASYNC, dmapp->cr, NULL);
5638 		else
5639 			error = nfs3_putpage_commit(dmapp->vp, dmapp->off,
5640 			    dmapp->len, dmapp->cr);
5641 		if (!error) {
5642 			mutex_enter(&rp->r_statelock);
5643 			error = rp->r_error;
5644 			rp->r_error = 0;
5645 			mutex_exit(&rp->r_statelock);
5646 		}
5647 	} else
5648 		error = 0;
5649 
5650 	if ((rp->r_flags & RDIRECTIO) || (mi->mi_flags & MI_DIRECTIO))
5651 		(void) nfs3_putpage(dmapp->vp, dmapp->off, dmapp->len,
5652 		    B_INVAL, dmapp->cr, NULL);
5653 
5654 	dmapp->caller->error = error;
5655 	(void) as_delete_callback(as, arg);
5656 	kmem_free(dmapp, sizeof (nfs_delmap_args_t));
5657 }
5658 
5659 static int nfs3_pathconf_disable_cache = 0;
5660 
5661 #ifdef DEBUG
5662 static int nfs3_pathconf_cache_hits = 0;
5663 static int nfs3_pathconf_cache_misses = 0;
5664 #endif
5665 
5666 /* ARGSUSED */
5667 static int
5668 nfs3_pathconf(vnode_t *vp, int cmd, ulong_t *valp, cred_t *cr,
5669 	caller_context_t *ct)
5670 {
5671 	int error;
5672 	PATHCONF3args args;
5673 	PATHCONF3res res;
5674 	int douprintf;
5675 	failinfo_t fi;
5676 	rnode_t *rp;
5677 	hrtime_t t;
5678 
5679 	if (nfs_zone() != VTOMI(vp)->mi_zone)
5680 		return (EIO);
5681 	/*
5682 	 * Large file spec - need to base answer on info stored
5683 	 * on original FSINFO response.
5684 	 */
5685 	if (cmd == _PC_FILESIZEBITS) {
5686 		unsigned long long ll;
5687 		long l = 1;
5688 
5689 		ll = VTOMI(vp)->mi_maxfilesize;
5690 
5691 		if (ll == 0) {
5692 			*valp = 0;
5693 			return (0);
5694 		}
5695 
5696 		if (ll & 0xffffffff00000000) {
5697 			l += 32; ll >>= 32;
5698 		}
5699 		if (ll & 0xffff0000) {
5700 			l += 16; ll >>= 16;
5701 		}
5702 		if (ll & 0xff00) {
5703 			l += 8; ll >>= 8;
5704 		}
5705 		if (ll & 0xf0) {
5706 			l += 4; ll >>= 4;
5707 		}
5708 		if (ll & 0xc) {
5709 			l += 2; ll >>= 2;
5710 		}
5711 		if (ll & 0x2)
5712 			l += 2;
5713 		else if (ll & 0x1)
5714 			l += 1;
5715 		*valp = l;
5716 		return (0);
5717 	}
5718 
5719 	if (cmd == _PC_ACL_ENABLED) {
5720 		*valp = _ACL_ACLENT_ENABLED;
5721 		return (0);
5722 	}
5723 
5724 	if (cmd == _PC_XATTR_EXISTS) {
5725 		error = 0;
5726 		*valp = 0;
5727 		if (vp->v_vfsp->vfs_flag & VFS_XATTR) {
5728 			vnode_t *avp;
5729 			rnode_t *rp;
5730 			int error = 0;
5731 			mntinfo_t *mi = VTOMI(vp);
5732 
5733 			if (!(mi->mi_flags & MI_EXTATTR))
5734 				return (0);
5735 
5736 			rp = VTOR(vp);
5737 			if (nfs_rw_enter_sig(&rp->r_rwlock, RW_READER,
5738 			    INTR(vp)))
5739 				return (EINTR);
5740 
5741 			error = nfs3lookup_dnlc(vp, XATTR_DIR_NAME, &avp, cr);
5742 			if (error || avp == NULL)
5743 				error = acl_getxattrdir3(vp, &avp, 0, cr, 0);
5744 
5745 			nfs_rw_exit(&rp->r_rwlock);
5746 
5747 			if (error == 0 && avp != NULL) {
5748 				error = do_xattr_exists_check(avp, valp, cr);
5749 				VN_RELE(avp);
5750 			} else if (error == ENOENT) {
5751 				error = 0;
5752 				*valp = 0;
5753 			}
5754 		}
5755 		return (error);
5756 	}
5757 
5758 	rp = VTOR(vp);
5759 	if (rp->r_pathconf != NULL) {
5760 		mutex_enter(&rp->r_statelock);
5761 		if (rp->r_pathconf != NULL && nfs3_pathconf_disable_cache) {
5762 			kmem_free(rp->r_pathconf, sizeof (*rp->r_pathconf));
5763 			rp->r_pathconf = NULL;
5764 		}
5765 		if (rp->r_pathconf != NULL) {
5766 			error = 0;
5767 			switch (cmd) {
5768 			case _PC_LINK_MAX:
5769 				*valp = rp->r_pathconf->link_max;
5770 				break;
5771 			case _PC_NAME_MAX:
5772 				*valp = rp->r_pathconf->name_max;
5773 				break;
5774 			case _PC_PATH_MAX:
5775 			case _PC_SYMLINK_MAX:
5776 				*valp = MAXPATHLEN;
5777 				break;
5778 			case _PC_CHOWN_RESTRICTED:
5779 				*valp = rp->r_pathconf->chown_restricted;
5780 				break;
5781 			case _PC_NO_TRUNC:
5782 				*valp = rp->r_pathconf->no_trunc;
5783 				break;
5784 			default:
5785 				error = EINVAL;
5786 				break;
5787 			}
5788 			mutex_exit(&rp->r_statelock);
5789 #ifdef DEBUG
5790 			nfs3_pathconf_cache_hits++;
5791 #endif
5792 			return (error);
5793 		}
5794 		mutex_exit(&rp->r_statelock);
5795 	}
5796 #ifdef DEBUG
5797 	nfs3_pathconf_cache_misses++;
5798 #endif
5799 
5800 	args.object = *VTOFH3(vp);
5801 	fi.vp = vp;
5802 	fi.fhp = (caddr_t)&args.object;
5803 	fi.copyproc = nfs3copyfh;
5804 	fi.lookupproc = nfs3lookup;
5805 	fi.xattrdirproc = acl_getxattrdir3;
5806 
5807 	douprintf = 1;
5808 
5809 	t = gethrtime();
5810 
5811 	error = rfs3call(VTOMI(vp), NFSPROC3_PATHCONF,
5812 	    xdr_nfs_fh3, (caddr_t)&args,
5813 	    xdr_PATHCONF3res, (caddr_t)&res, cr,
5814 	    &douprintf, &res.status, 0, &fi);
5815 
5816 	if (error)
5817 		return (error);
5818 
5819 	error = geterrno3(res.status);
5820 
5821 	if (!error) {
5822 		nfs3_cache_post_op_attr(vp, &res.resok.obj_attributes, t, cr);
5823 		if (!nfs3_pathconf_disable_cache) {
5824 			mutex_enter(&rp->r_statelock);
5825 			if (rp->r_pathconf == NULL) {
5826 				rp->r_pathconf = kmem_alloc(
5827 				    sizeof (*rp->r_pathconf), KM_NOSLEEP);
5828 				if (rp->r_pathconf != NULL)
5829 					*rp->r_pathconf = res.resok.info;
5830 			}
5831 			mutex_exit(&rp->r_statelock);
5832 		}
5833 		switch (cmd) {
5834 		case _PC_LINK_MAX:
5835 			*valp = res.resok.info.link_max;
5836 			break;
5837 		case _PC_NAME_MAX:
5838 			*valp = res.resok.info.name_max;
5839 			break;
5840 		case _PC_PATH_MAX:
5841 		case _PC_SYMLINK_MAX:
5842 			*valp = MAXPATHLEN;
5843 			break;
5844 		case _PC_CHOWN_RESTRICTED:
5845 			*valp = res.resok.info.chown_restricted;
5846 			break;
5847 		case _PC_NO_TRUNC:
5848 			*valp = res.resok.info.no_trunc;
5849 			break;
5850 		default:
5851 			return (EINVAL);
5852 		}
5853 	} else {
5854 		nfs3_cache_post_op_attr(vp, &res.resfail.obj_attributes, t, cr);
5855 		PURGE_STALE_FH(error, vp, cr);
5856 	}
5857 
5858 	return (error);
5859 }
5860 
5861 /*
5862  * Called by async thread to do synchronous pageio. Do the i/o, wait
5863  * for it to complete, and cleanup the page list when done.
5864  */
5865 static int
5866 nfs3_sync_pageio(vnode_t *vp, page_t *pp, u_offset_t io_off, size_t io_len,
5867 	int flags, cred_t *cr)
5868 {
5869 	int error;
5870 
5871 	ASSERT(nfs_zone() == VTOMI(vp)->mi_zone);
5872 	error = nfs3_rdwrlbn(vp, pp, io_off, io_len, flags, cr);
5873 	if (flags & B_READ)
5874 		pvn_read_done(pp, (error ? B_ERROR : 0) | flags);
5875 	else
5876 		pvn_write_done(pp, (error ? B_ERROR : 0) | flags);
5877 	return (error);
5878 }
5879 
5880 /* ARGSUSED */
5881 static int
5882 nfs3_pageio(vnode_t *vp, page_t *pp, u_offset_t io_off, size_t io_len,
5883 	int flags, cred_t *cr, caller_context_t *ct)
5884 {
5885 	int error;
5886 	rnode_t *rp;
5887 
5888 	if (pp == NULL)
5889 		return (EINVAL);
5890 	if (!(flags & B_ASYNC) && nfs_zone() != VTOMI(vp)->mi_zone)
5891 		return (EIO);
5892 
5893 	rp = VTOR(vp);
5894 	mutex_enter(&rp->r_statelock);
5895 	rp->r_count++;
5896 	mutex_exit(&rp->r_statelock);
5897 
5898 	if (flags & B_ASYNC) {
5899 		error = nfs_async_pageio(vp, pp, io_off, io_len, flags, cr,
5900 		    nfs3_sync_pageio);
5901 	} else
5902 		error = nfs3_rdwrlbn(vp, pp, io_off, io_len, flags, cr);
5903 	mutex_enter(&rp->r_statelock);
5904 	rp->r_count--;
5905 	cv_broadcast(&rp->r_cv);
5906 	mutex_exit(&rp->r_statelock);
5907 	return (error);
5908 }
5909 
5910 /* ARGSUSED */
5911 static void
5912 nfs3_dispose(vnode_t *vp, page_t *pp, int fl, int dn, cred_t *cr,
5913 	caller_context_t *ct)
5914 {
5915 	int error;
5916 	rnode_t *rp;
5917 	page_t *plist;
5918 	page_t *pptr;
5919 	offset3 offset;
5920 	count3 len;
5921 	k_sigset_t smask;
5922 
5923 	/*
5924 	 * We should get called with fl equal to either B_FREE or
5925 	 * B_INVAL.  Any other value is illegal.
5926 	 *
5927 	 * The page that we are either supposed to free or destroy
5928 	 * should be exclusive locked and its io lock should not
5929 	 * be held.
5930 	 */
5931 	ASSERT(fl == B_FREE || fl == B_INVAL);
5932 	ASSERT((PAGE_EXCL(pp) && !page_iolock_assert(pp)) || panicstr);
5933 	rp = VTOR(vp);
5934 
5935 	/*
5936 	 * If the page doesn't need to be committed or we shouldn't
5937 	 * even bother attempting to commit it, then just make sure
5938 	 * that the p_fsdata byte is clear and then either free or
5939 	 * destroy the page as appropriate.
5940 	 */
5941 	if (pp->p_fsdata == C_NOCOMMIT || (rp->r_flags & RSTALE)) {
5942 		pp->p_fsdata = C_NOCOMMIT;
5943 		if (fl == B_FREE)
5944 			page_free(pp, dn);
5945 		else
5946 			page_destroy(pp, dn);
5947 		return;
5948 	}
5949 
5950 	/*
5951 	 * If there is a page invalidation operation going on, then
5952 	 * if this is one of the pages being destroyed, then just
5953 	 * clear the p_fsdata byte and then either free or destroy
5954 	 * the page as appropriate.
5955 	 */
5956 	mutex_enter(&rp->r_statelock);
5957 	if ((rp->r_flags & RTRUNCATE) && pp->p_offset >= rp->r_truncaddr) {
5958 		mutex_exit(&rp->r_statelock);
5959 		pp->p_fsdata = C_NOCOMMIT;
5960 		if (fl == B_FREE)
5961 			page_free(pp, dn);
5962 		else
5963 			page_destroy(pp, dn);
5964 		return;
5965 	}
5966 
5967 	/*
5968 	 * If we are freeing this page and someone else is already
5969 	 * waiting to do a commit, then just unlock the page and
5970 	 * return.  That other thread will take care of commiting
5971 	 * this page.  The page can be freed sometime after the
5972 	 * commit has finished.  Otherwise, if the page is marked
5973 	 * as delay commit, then we may be getting called from
5974 	 * pvn_write_done, one page at a time.   This could result
5975 	 * in one commit per page, so we end up doing lots of small
5976 	 * commits instead of fewer larger commits.  This is bad,
5977 	 * we want do as few commits as possible.
5978 	 */
5979 	if (fl == B_FREE) {
5980 		if (rp->r_flags & RCOMMITWAIT) {
5981 			page_unlock(pp);
5982 			mutex_exit(&rp->r_statelock);
5983 			return;
5984 		}
5985 		if (pp->p_fsdata == C_DELAYCOMMIT) {
5986 			pp->p_fsdata = C_COMMIT;
5987 			page_unlock(pp);
5988 			mutex_exit(&rp->r_statelock);
5989 			return;
5990 		}
5991 	}
5992 
5993 	/*
5994 	 * Check to see if there is a signal which would prevent an
5995 	 * attempt to commit the pages from being successful.  If so,
5996 	 * then don't bother with all of the work to gather pages and
5997 	 * generate the unsuccessful RPC.  Just return from here and
5998 	 * let the page be committed at some later time.
5999 	 */
6000 	sigintr(&smask, VTOMI(vp)->mi_flags & MI_INT);
6001 	if (ttolwp(curthread) != NULL && ISSIG(curthread, JUSTLOOKING)) {
6002 		sigunintr(&smask);
6003 		page_unlock(pp);
6004 		mutex_exit(&rp->r_statelock);
6005 		return;
6006 	}
6007 	sigunintr(&smask);
6008 
6009 	/*
6010 	 * We are starting to need to commit pages, so let's try
6011 	 * to commit as many as possible at once to reduce the
6012 	 * overhead.
6013 	 *
6014 	 * Set the `commit inprogress' state bit.  We must
6015 	 * first wait until any current one finishes.  Then
6016 	 * we initialize the c_pages list with this page.
6017 	 */
6018 	while (rp->r_flags & RCOMMIT) {
6019 		rp->r_flags |= RCOMMITWAIT;
6020 		cv_wait(&rp->r_commit.c_cv, &rp->r_statelock);
6021 		rp->r_flags &= ~RCOMMITWAIT;
6022 	}
6023 	rp->r_flags |= RCOMMIT;
6024 	mutex_exit(&rp->r_statelock);
6025 	ASSERT(rp->r_commit.c_pages == NULL);
6026 	rp->r_commit.c_pages = pp;
6027 	rp->r_commit.c_commbase = (offset3)pp->p_offset;
6028 	rp->r_commit.c_commlen = PAGESIZE;
6029 
6030 	/*
6031 	 * Gather together all other pages which can be committed.
6032 	 * They will all be chained off r_commit.c_pages.
6033 	 */
6034 	nfs3_get_commit(vp);
6035 
6036 	/*
6037 	 * Clear the `commit inprogress' status and disconnect
6038 	 * the list of pages to be committed from the rnode.
6039 	 * At this same time, we also save the starting offset
6040 	 * and length of data to be committed on the server.
6041 	 */
6042 	plist = rp->r_commit.c_pages;
6043 	rp->r_commit.c_pages = NULL;
6044 	offset = rp->r_commit.c_commbase;
6045 	len = rp->r_commit.c_commlen;
6046 	mutex_enter(&rp->r_statelock);
6047 	rp->r_flags &= ~RCOMMIT;
6048 	cv_broadcast(&rp->r_commit.c_cv);
6049 	mutex_exit(&rp->r_statelock);
6050 
6051 	if (curproc == proc_pageout || curproc == proc_fsflush ||
6052 	    nfs_zone() != VTOMI(vp)->mi_zone) {
6053 		nfs_async_commit(vp, plist, offset, len, cr, nfs3_async_commit);
6054 		return;
6055 	}
6056 
6057 	/*
6058 	 * Actually generate the COMMIT3 over the wire operation.
6059 	 */
6060 	error = nfs3_commit(vp, offset, len, cr);
6061 
6062 	/*
6063 	 * If we got an error during the commit, just unlock all
6064 	 * of the pages.  The pages will get retransmitted to the
6065 	 * server during a putpage operation.
6066 	 */
6067 	if (error) {
6068 		while (plist != NULL) {
6069 			pptr = plist;
6070 			page_sub(&plist, pptr);
6071 			page_unlock(pptr);
6072 		}
6073 		return;
6074 	}
6075 
6076 	/*
6077 	 * We've tried as hard as we can to commit the data to stable
6078 	 * storage on the server.  We release the rest of the pages
6079 	 * and clear the commit required state.  They will be put
6080 	 * onto the tail of the cachelist if they are nolonger
6081 	 * mapped.
6082 	 */
6083 	while (plist != pp) {
6084 		pptr = plist;
6085 		page_sub(&plist, pptr);
6086 		pptr->p_fsdata = C_NOCOMMIT;
6087 		(void) page_release(pptr, 1);
6088 	}
6089 
6090 	/*
6091 	 * It is possible that nfs3_commit didn't return error but
6092 	 * some other thread has modified the page we are going
6093 	 * to free/destroy.
6094 	 *    In this case we need to rewrite the page. Do an explicit check
6095 	 * before attempting to free/destroy the page. If modified, needs to
6096 	 * be rewritten so unlock the page and return.
6097 	 */
6098 	if (hat_ismod(pp)) {
6099 		pp->p_fsdata = C_NOCOMMIT;
6100 		page_unlock(pp);
6101 		return;
6102 	}
6103 
6104 	/*
6105 	 * Now, as appropriate, either free or destroy the page
6106 	 * that we were called with.
6107 	 */
6108 	pp->p_fsdata = C_NOCOMMIT;
6109 	if (fl == B_FREE)
6110 		page_free(pp, dn);
6111 	else
6112 		page_destroy(pp, dn);
6113 }
6114 
6115 static int
6116 nfs3_commit(vnode_t *vp, offset3 offset, count3 count, cred_t *cr)
6117 {
6118 	int error;
6119 	rnode_t *rp;
6120 	COMMIT3args args;
6121 	COMMIT3res res;
6122 	int douprintf;
6123 	cred_t *cred;
6124 
6125 	rp = VTOR(vp);
6126 	ASSERT(nfs_zone() == VTOMI(vp)->mi_zone);
6127 
6128 	mutex_enter(&rp->r_statelock);
6129 	if (rp->r_cred != NULL) {
6130 		cred = rp->r_cred;
6131 		crhold(cred);
6132 	} else {
6133 		rp->r_cred = cr;
6134 		crhold(cr);
6135 		cred = cr;
6136 		crhold(cred);
6137 	}
6138 	mutex_exit(&rp->r_statelock);
6139 
6140 	args.file = *VTOFH3(vp);
6141 	args.offset = offset;
6142 	args.count = count;
6143 
6144 doitagain:
6145 	douprintf = 1;
6146 	error = rfs3call(VTOMI(vp), NFSPROC3_COMMIT,
6147 	    xdr_COMMIT3args, (caddr_t)&args,
6148 	    xdr_COMMIT3res, (caddr_t)&res, cred,
6149 	    &douprintf, &res.status, 0, NULL);
6150 
6151 	crfree(cred);
6152 
6153 	if (error)
6154 		return (error);
6155 
6156 	error = geterrno3(res.status);
6157 	if (!error) {
6158 		ASSERT(rp->r_flags & RHAVEVERF);
6159 		mutex_enter(&rp->r_statelock);
6160 		if (rp->r_verf == res.resok.verf) {
6161 			mutex_exit(&rp->r_statelock);
6162 			return (0);
6163 		}
6164 		nfs3_set_mod(vp);
6165 		rp->r_verf = res.resok.verf;
6166 		mutex_exit(&rp->r_statelock);
6167 		error = NFS_VERF_MISMATCH;
6168 	} else {
6169 		if (error == EACCES) {
6170 			mutex_enter(&rp->r_statelock);
6171 			if (cred != cr) {
6172 				if (rp->r_cred != NULL)
6173 					crfree(rp->r_cred);
6174 				rp->r_cred = cr;
6175 				crhold(cr);
6176 				cred = cr;
6177 				crhold(cred);
6178 				mutex_exit(&rp->r_statelock);
6179 				goto doitagain;
6180 			}
6181 			mutex_exit(&rp->r_statelock);
6182 		}
6183 		/*
6184 		 * Can't do a PURGE_STALE_FH here because this
6185 		 * can cause a deadlock.  nfs3_commit can
6186 		 * be called from nfs3_dispose which can be called
6187 		 * indirectly via pvn_vplist_dirty.  PURGE_STALE_FH
6188 		 * can call back to pvn_vplist_dirty.
6189 		 */
6190 		if (error == ESTALE) {
6191 			mutex_enter(&rp->r_statelock);
6192 			rp->r_flags |= RSTALE;
6193 			if (!rp->r_error)
6194 				rp->r_error = error;
6195 			mutex_exit(&rp->r_statelock);
6196 			PURGE_ATTRCACHE(vp);
6197 		} else {
6198 			mutex_enter(&rp->r_statelock);
6199 			if (!rp->r_error)
6200 				rp->r_error = error;
6201 			mutex_exit(&rp->r_statelock);
6202 		}
6203 	}
6204 
6205 	return (error);
6206 }
6207 
6208 static void
6209 nfs3_set_mod(vnode_t *vp)
6210 {
6211 	page_t *pp;
6212 	kmutex_t *vphm;
6213 
6214 	ASSERT(nfs_zone() == VTOMI(vp)->mi_zone);
6215 	vphm = page_vnode_mutex(vp);
6216 	mutex_enter(vphm);
6217 	if ((pp = vp->v_pages) != NULL) {
6218 		do {
6219 			if (pp->p_fsdata != C_NOCOMMIT) {
6220 				hat_setmod(pp);
6221 				pp->p_fsdata = C_NOCOMMIT;
6222 			}
6223 		} while ((pp = pp->p_vpnext) != vp->v_pages);
6224 	}
6225 	mutex_exit(vphm);
6226 }
6227 
6228 
6229 /*
6230  * This routine is used to gather together a page list of the pages
6231  * which are to be committed on the server.  This routine must not
6232  * be called if the calling thread holds any locked pages.
6233  *
6234  * The calling thread must have set RCOMMIT.  This bit is used to
6235  * serialize access to the commit structure in the rnode.  As long
6236  * as the thread has set RCOMMIT, then it can manipulate the commit
6237  * structure without requiring any other locks.
6238  */
6239 static void
6240 nfs3_get_commit(vnode_t *vp)
6241 {
6242 	rnode_t *rp;
6243 	page_t *pp;
6244 	kmutex_t *vphm;
6245 
6246 	rp = VTOR(vp);
6247 
6248 	ASSERT(rp->r_flags & RCOMMIT);
6249 
6250 	vphm = page_vnode_mutex(vp);
6251 	mutex_enter(vphm);
6252 
6253 	/*
6254 	 * If there are no pages associated with this vnode, then
6255 	 * just return.
6256 	 */
6257 	if ((pp = vp->v_pages) == NULL) {
6258 		mutex_exit(vphm);
6259 		return;
6260 	}
6261 
6262 	/*
6263 	 * Step through all of the pages associated with this vnode
6264 	 * looking for pages which need to be committed.
6265 	 */
6266 	do {
6267 		/*
6268 		 * If this page does not need to be committed or is
6269 		 * modified, then just skip it.
6270 		 */
6271 		if (pp->p_fsdata == C_NOCOMMIT || hat_ismod(pp))
6272 			continue;
6273 
6274 		/*
6275 		 * Attempt to lock the page.  If we can't, then
6276 		 * someone else is messing with it and we will
6277 		 * just skip it.
6278 		 */
6279 		if (!page_trylock(pp, SE_EXCL))
6280 			continue;
6281 
6282 		/*
6283 		 * If this page does not need to be committed or is
6284 		 * modified, then just skip it.  Recheck now that
6285 		 * the page is locked.
6286 		 */
6287 		if (pp->p_fsdata == C_NOCOMMIT || hat_ismod(pp)) {
6288 			page_unlock(pp);
6289 			continue;
6290 		}
6291 
6292 		if (PP_ISFREE(pp)) {
6293 			cmn_err(CE_PANIC, "nfs3_get_commit: %p is free",
6294 			    (void *)pp);
6295 		}
6296 
6297 		/*
6298 		 * The page needs to be committed and we locked it.
6299 		 * Update the base and length parameters and add it
6300 		 * to r_pages.
6301 		 */
6302 		if (rp->r_commit.c_pages == NULL) {
6303 			rp->r_commit.c_commbase = (offset3)pp->p_offset;
6304 			rp->r_commit.c_commlen = PAGESIZE;
6305 		} else if (pp->p_offset < rp->r_commit.c_commbase) {
6306 			rp->r_commit.c_commlen = rp->r_commit.c_commbase -
6307 			    (offset3)pp->p_offset + rp->r_commit.c_commlen;
6308 			rp->r_commit.c_commbase = (offset3)pp->p_offset;
6309 		} else if ((rp->r_commit.c_commbase + rp->r_commit.c_commlen)
6310 		    <= pp->p_offset) {
6311 			rp->r_commit.c_commlen = (offset3)pp->p_offset -
6312 			    rp->r_commit.c_commbase + PAGESIZE;
6313 		}
6314 		page_add(&rp->r_commit.c_pages, pp);
6315 	} while ((pp = pp->p_vpnext) != vp->v_pages);
6316 
6317 	mutex_exit(vphm);
6318 }
6319 
6320 /*
6321  * This routine is used to gather together a page list of the pages
6322  * which are to be committed on the server.  This routine must not
6323  * be called if the calling thread holds any locked pages.
6324  *
6325  * The calling thread must have set RCOMMIT.  This bit is used to
6326  * serialize access to the commit structure in the rnode.  As long
6327  * as the thread has set RCOMMIT, then it can manipulate the commit
6328  * structure without requiring any other locks.
6329  */
6330 static void
6331 nfs3_get_commit_range(vnode_t *vp, u_offset_t soff, size_t len)
6332 {
6333 
6334 	rnode_t *rp;
6335 	page_t *pp;
6336 	u_offset_t end;
6337 	u_offset_t off;
6338 
6339 	ASSERT(len != 0);
6340 
6341 	rp = VTOR(vp);
6342 
6343 	ASSERT(rp->r_flags & RCOMMIT);
6344 	ASSERT(nfs_zone() == VTOMI(vp)->mi_zone);
6345 
6346 	/*
6347 	 * If there are no pages associated with this vnode, then
6348 	 * just return.
6349 	 */
6350 	if ((pp = vp->v_pages) == NULL)
6351 		return;
6352 
6353 	/*
6354 	 * Calculate the ending offset.
6355 	 */
6356 	end = soff + len;
6357 
6358 	for (off = soff; off < end; off += PAGESIZE) {
6359 		/*
6360 		 * Lookup each page by vp, offset.
6361 		 */
6362 		if ((pp = page_lookup_nowait(vp, off, SE_EXCL)) == NULL)
6363 			continue;
6364 
6365 		/*
6366 		 * If this page does not need to be committed or is
6367 		 * modified, then just skip it.
6368 		 */
6369 		if (pp->p_fsdata == C_NOCOMMIT || hat_ismod(pp)) {
6370 			page_unlock(pp);
6371 			continue;
6372 		}
6373 
6374 		ASSERT(PP_ISFREE(pp) == 0);
6375 
6376 		/*
6377 		 * The page needs to be committed and we locked it.
6378 		 * Update the base and length parameters and add it
6379 		 * to r_pages.
6380 		 */
6381 		if (rp->r_commit.c_pages == NULL) {
6382 			rp->r_commit.c_commbase = (offset3)pp->p_offset;
6383 			rp->r_commit.c_commlen = PAGESIZE;
6384 		} else {
6385 			rp->r_commit.c_commlen = (offset3)pp->p_offset -
6386 			    rp->r_commit.c_commbase + PAGESIZE;
6387 		}
6388 		page_add(&rp->r_commit.c_pages, pp);
6389 	}
6390 }
6391 
6392 #if 0	/* unused */
6393 #ifdef DEBUG
6394 static int
6395 nfs3_no_uncommitted_pages(vnode_t *vp)
6396 {
6397 	page_t *pp;
6398 	kmutex_t *vphm;
6399 
6400 	vphm = page_vnode_mutex(vp);
6401 	mutex_enter(vphm);
6402 	if ((pp = vp->v_pages) != NULL) {
6403 		do {
6404 			if (pp->p_fsdata != C_NOCOMMIT) {
6405 				mutex_exit(vphm);
6406 				return (0);
6407 			}
6408 		} while ((pp = pp->p_vpnext) != vp->v_pages);
6409 	}
6410 	mutex_exit(vphm);
6411 
6412 	return (1);
6413 }
6414 #endif
6415 #endif
6416 
6417 static int
6418 nfs3_putpage_commit(vnode_t *vp, offset_t poff, size_t plen, cred_t *cr)
6419 {
6420 	int error;
6421 	writeverf3 write_verf;
6422 	rnode_t *rp = VTOR(vp);
6423 
6424 	ASSERT(nfs_zone() == VTOMI(vp)->mi_zone);
6425 	/*
6426 	 * Flush the data portion of the file and then commit any
6427 	 * portions which need to be committed.  This may need to
6428 	 * be done twice if the server has changed state since
6429 	 * data was last written.  The data will need to be
6430 	 * rewritten to the server and then a new commit done.
6431 	 *
6432 	 * In fact, this may need to be done several times if the
6433 	 * server is having problems and crashing while we are
6434 	 * attempting to do this.
6435 	 */
6436 
6437 top:
6438 	/*
6439 	 * Do a flush based on the poff and plen arguments.  This
6440 	 * will asynchronously write out any modified pages in the
6441 	 * range specified by (poff, plen).  This starts all of the
6442 	 * i/o operations which will be waited for in the next
6443 	 * call to nfs3_putpage
6444 	 */
6445 
6446 	mutex_enter(&rp->r_statelock);
6447 	write_verf = rp->r_verf;
6448 	mutex_exit(&rp->r_statelock);
6449 
6450 	error = nfs3_putpage(vp, poff, plen, B_ASYNC, cr, NULL);
6451 	if (error == EAGAIN)
6452 		error = 0;
6453 
6454 	/*
6455 	 * Do a flush based on the poff and plen arguments.  This
6456 	 * will synchronously write out any modified pages in the
6457 	 * range specified by (poff, plen) and wait until all of
6458 	 * the asynchronous i/o's in that range are done as well.
6459 	 */
6460 	if (!error)
6461 		error = nfs3_putpage(vp, poff, plen, 0, cr, NULL);
6462 
6463 	if (error)
6464 		return (error);
6465 
6466 	mutex_enter(&rp->r_statelock);
6467 	if (rp->r_verf != write_verf) {
6468 		mutex_exit(&rp->r_statelock);
6469 		goto top;
6470 	}
6471 	mutex_exit(&rp->r_statelock);
6472 
6473 	/*
6474 	 * Now commit any pages which might need to be committed.
6475 	 * If the error, NFS_VERF_MISMATCH, is returned, then
6476 	 * start over with the flush operation.
6477 	 */
6478 
6479 	error = nfs3_commit_vp(vp, poff, plen, cr);
6480 
6481 	if (error == NFS_VERF_MISMATCH)
6482 		goto top;
6483 
6484 	return (error);
6485 }
6486 
6487 static int
6488 nfs3_commit_vp(vnode_t *vp, u_offset_t poff, size_t plen, cred_t *cr)
6489 {
6490 	rnode_t *rp;
6491 	page_t *plist;
6492 	offset3 offset;
6493 	count3 len;
6494 
6495 
6496 	rp = VTOR(vp);
6497 
6498 	if (nfs_zone() != VTOMI(vp)->mi_zone)
6499 		return (EIO);
6500 	/*
6501 	 * Set the `commit inprogress' state bit.  We must
6502 	 * first wait until any current one finishes.
6503 	 */
6504 	mutex_enter(&rp->r_statelock);
6505 	while (rp->r_flags & RCOMMIT) {
6506 		rp->r_flags |= RCOMMITWAIT;
6507 		cv_wait(&rp->r_commit.c_cv, &rp->r_statelock);
6508 		rp->r_flags &= ~RCOMMITWAIT;
6509 	}
6510 	rp->r_flags |= RCOMMIT;
6511 	mutex_exit(&rp->r_statelock);
6512 
6513 	/*
6514 	 * Gather together all of the pages which need to be
6515 	 * committed.
6516 	 */
6517 	if (plen == 0)
6518 		nfs3_get_commit(vp);
6519 	else
6520 		nfs3_get_commit_range(vp, poff, plen);
6521 
6522 	/*
6523 	 * Clear the `commit inprogress' bit and disconnect the
6524 	 * page list which was gathered together in nfs3_get_commit.
6525 	 */
6526 	plist = rp->r_commit.c_pages;
6527 	rp->r_commit.c_pages = NULL;
6528 	offset = rp->r_commit.c_commbase;
6529 	len = rp->r_commit.c_commlen;
6530 	mutex_enter(&rp->r_statelock);
6531 	rp->r_flags &= ~RCOMMIT;
6532 	cv_broadcast(&rp->r_commit.c_cv);
6533 	mutex_exit(&rp->r_statelock);
6534 
6535 	/*
6536 	 * If any pages need to be committed, commit them and
6537 	 * then unlock them so that they can be freed some
6538 	 * time later.
6539 	 */
6540 	if (plist != NULL) {
6541 		/*
6542 		 * No error occurred during the flush portion
6543 		 * of this operation, so now attempt to commit
6544 		 * the data to stable storage on the server.
6545 		 *
6546 		 * This will unlock all of the pages on the list.
6547 		 */
6548 		return (nfs3_sync_commit(vp, plist, offset, len, cr));
6549 	}
6550 	return (0);
6551 }
6552 
6553 static int
6554 nfs3_sync_commit(vnode_t *vp, page_t *plist, offset3 offset, count3 count,
6555 	cred_t *cr)
6556 {
6557 	int error;
6558 	page_t *pp;
6559 
6560 	ASSERT(nfs_zone() == VTOMI(vp)->mi_zone);
6561 	error = nfs3_commit(vp, offset, count, cr);
6562 
6563 	/*
6564 	 * If we got an error, then just unlock all of the pages
6565 	 * on the list.
6566 	 */
6567 	if (error) {
6568 		while (plist != NULL) {
6569 			pp = plist;
6570 			page_sub(&plist, pp);
6571 			page_unlock(pp);
6572 		}
6573 		return (error);
6574 	}
6575 	/*
6576 	 * We've tried as hard as we can to commit the data to stable
6577 	 * storage on the server.  We just unlock the pages and clear
6578 	 * the commit required state.  They will get freed later.
6579 	 */
6580 	while (plist != NULL) {
6581 		pp = plist;
6582 		page_sub(&plist, pp);
6583 		pp->p_fsdata = C_NOCOMMIT;
6584 		page_unlock(pp);
6585 	}
6586 
6587 	return (error);
6588 }
6589 
6590 static void
6591 nfs3_async_commit(vnode_t *vp, page_t *plist, offset3 offset, count3 count,
6592 	cred_t *cr)
6593 {
6594 	ASSERT(nfs_zone() == VTOMI(vp)->mi_zone);
6595 	(void) nfs3_sync_commit(vp, plist, offset, count, cr);
6596 }
6597 
6598 /* ARGSUSED */
6599 static int
6600 nfs3_setsecattr(vnode_t *vp, vsecattr_t *vsecattr, int flag, cred_t *cr,
6601 	caller_context_t *ct)
6602 {
6603 	int error;
6604 	mntinfo_t *mi;
6605 
6606 	mi = VTOMI(vp);
6607 
6608 	if (nfs_zone() != mi->mi_zone)
6609 		return (EIO);
6610 
6611 	if (mi->mi_flags & MI_ACL) {
6612 		error = acl_setacl3(vp, vsecattr, flag, cr);
6613 		if (mi->mi_flags & MI_ACL)
6614 			return (error);
6615 	}
6616 
6617 	return (ENOSYS);
6618 }
6619 
6620 /* ARGSUSED */
6621 static int
6622 nfs3_getsecattr(vnode_t *vp, vsecattr_t *vsecattr, int flag, cred_t *cr,
6623 	caller_context_t *ct)
6624 {
6625 	int error;
6626 	mntinfo_t *mi;
6627 
6628 	mi = VTOMI(vp);
6629 
6630 	if (nfs_zone() != mi->mi_zone)
6631 		return (EIO);
6632 
6633 	if (mi->mi_flags & MI_ACL) {
6634 		error = acl_getacl3(vp, vsecattr, flag, cr);
6635 		if (mi->mi_flags & MI_ACL)
6636 			return (error);
6637 	}
6638 
6639 	return (fs_fab_acl(vp, vsecattr, flag, cr, ct));
6640 }
6641 
6642 /* ARGSUSED */
6643 static int
6644 nfs3_shrlock(vnode_t *vp, int cmd, struct shrlock *shr, int flag, cred_t *cr,
6645 	caller_context_t *ct)
6646 {
6647 	int error;
6648 	struct shrlock nshr;
6649 	struct nfs_owner nfs_owner;
6650 	netobj lm_fh3;
6651 
6652 	if (nfs_zone() != VTOMI(vp)->mi_zone)
6653 		return (EIO);
6654 
6655 	/*
6656 	 * check for valid cmd parameter
6657 	 */
6658 	if (cmd != F_SHARE && cmd != F_UNSHARE && cmd != F_HASREMOTELOCKS)
6659 		return (EINVAL);
6660 
6661 	/*
6662 	 * Check access permissions
6663 	 */
6664 	if (cmd == F_SHARE &&
6665 	    (((shr->s_access & F_RDACC) && !(flag & FREAD)) ||
6666 	    ((shr->s_access & F_WRACC) && !(flag & FWRITE))))
6667 		return (EBADF);
6668 
6669 	/*
6670 	 * If the filesystem is mounted using local locking, pass the
6671 	 * request off to the local share code.
6672 	 */
6673 	if (VTOMI(vp)->mi_flags & MI_LLOCK)
6674 		return (fs_shrlock(vp, cmd, shr, flag, cr, ct));
6675 
6676 	switch (cmd) {
6677 	case F_SHARE:
6678 	case F_UNSHARE:
6679 		lm_fh3.n_len = VTOFH3(vp)->fh3_length;
6680 		lm_fh3.n_bytes = (char *)&(VTOFH3(vp)->fh3_u.data);
6681 
6682 		/*
6683 		 * If passed an owner that is too large to fit in an
6684 		 * nfs_owner it is likely a recursive call from the
6685 		 * lock manager client and pass it straight through.  If
6686 		 * it is not a nfs_owner then simply return an error.
6687 		 */
6688 		if (shr->s_own_len > sizeof (nfs_owner.lowner)) {
6689 			if (((struct nfs_owner *)shr->s_owner)->magic !=
6690 			    NFS_OWNER_MAGIC)
6691 				return (EINVAL);
6692 
6693 			if (error = lm4_shrlock(vp, cmd, shr, flag, &lm_fh3)) {
6694 				error = set_errno(error);
6695 			}
6696 			return (error);
6697 		}
6698 		/*
6699 		 * Remote share reservations owner is a combination of
6700 		 * a magic number, hostname, and the local owner
6701 		 */
6702 		bzero(&nfs_owner, sizeof (nfs_owner));
6703 		nfs_owner.magic = NFS_OWNER_MAGIC;
6704 		(void) strncpy(nfs_owner.hname, uts_nodename(),
6705 		    sizeof (nfs_owner.hname));
6706 		bcopy(shr->s_owner, nfs_owner.lowner, shr->s_own_len);
6707 		nshr.s_access = shr->s_access;
6708 		nshr.s_deny = shr->s_deny;
6709 		nshr.s_sysid = 0;
6710 		nshr.s_pid = ttoproc(curthread)->p_pid;
6711 		nshr.s_own_len = sizeof (nfs_owner);
6712 		nshr.s_owner = (caddr_t)&nfs_owner;
6713 
6714 		if (error = lm4_shrlock(vp, cmd, &nshr, flag, &lm_fh3)) {
6715 			error = set_errno(error);
6716 		}
6717 
6718 		break;
6719 
6720 	case F_HASREMOTELOCKS:
6721 		/*
6722 		 * NFS client can't store remote locks itself
6723 		 */
6724 		shr->s_access = 0;
6725 		error = 0;
6726 		break;
6727 
6728 	default:
6729 		error = EINVAL;
6730 		break;
6731 	}
6732 
6733 	return (error);
6734 }
6735