xref: /illumos-gate/usr/src/uts/common/fs/nfs/nfs3_vnops.c (revision 74e7dc986c89efca1f2e4451c7a572e05e4a6e4f)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 /*
22  * Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
23  * Use is subject to license terms.
24  */
25 
26 /*
27  *	Copyright (c) 1983,1984,1985,1986,1987,1988,1989 AT&T.
28  *	All rights reserved.
29  */
30 
31 #include <sys/param.h>
32 #include <sys/types.h>
33 #include <sys/systm.h>
34 #include <sys/cred.h>
35 #include <sys/time.h>
36 #include <sys/vnode.h>
37 #include <sys/vfs.h>
38 #include <sys/vfs_opreg.h>
39 #include <sys/file.h>
40 #include <sys/filio.h>
41 #include <sys/uio.h>
42 #include <sys/buf.h>
43 #include <sys/mman.h>
44 #include <sys/pathname.h>
45 #include <sys/dirent.h>
46 #include <sys/debug.h>
47 #include <sys/vmsystm.h>
48 #include <sys/fcntl.h>
49 #include <sys/flock.h>
50 #include <sys/swap.h>
51 #include <sys/errno.h>
52 #include <sys/strsubr.h>
53 #include <sys/sysmacros.h>
54 #include <sys/kmem.h>
55 #include <sys/cmn_err.h>
56 #include <sys/pathconf.h>
57 #include <sys/utsname.h>
58 #include <sys/dnlc.h>
59 #include <sys/acl.h>
60 #include <sys/systeminfo.h>
61 #include <sys/atomic.h>
62 #include <sys/policy.h>
63 #include <sys/sdt.h>
64 
65 #include <rpc/types.h>
66 #include <rpc/auth.h>
67 #include <rpc/clnt.h>
68 #include <rpc/rpc_rdma.h>
69 
70 #include <nfs/nfs.h>
71 #include <nfs/nfs_clnt.h>
72 #include <nfs/rnode.h>
73 #include <nfs/nfs_acl.h>
74 #include <nfs/lm.h>
75 
76 #include <vm/hat.h>
77 #include <vm/as.h>
78 #include <vm/page.h>
79 #include <vm/pvn.h>
80 #include <vm/seg.h>
81 #include <vm/seg_map.h>
82 #include <vm/seg_kpm.h>
83 #include <vm/seg_vn.h>
84 
85 #include <fs/fs_subr.h>
86 
87 #include <sys/ddi.h>
88 
89 static int	nfs3_rdwrlbn(vnode_t *, page_t *, u_offset_t, size_t, int,
90 			cred_t *);
91 static int	nfs3write(vnode_t *, caddr_t, u_offset_t, int, cred_t *,
92 			stable_how *);
93 static int	nfs3read(vnode_t *, caddr_t, offset_t, int, size_t *, cred_t *);
94 static int	nfs3setattr(vnode_t *, struct vattr *, int, cred_t *);
95 static int	nfs3_accessx(void *, int, cred_t *);
96 static int	nfs3lookup_dnlc(vnode_t *, char *, vnode_t **, cred_t *);
97 static int	nfs3lookup_otw(vnode_t *, char *, vnode_t **, cred_t *, int);
98 static int	nfs3create(vnode_t *, char *, struct vattr *, enum vcexcl,
99 			int, vnode_t **, cred_t *, int);
100 static int	nfs3excl_create_settimes(vnode_t *, struct vattr *, cred_t *);
101 static int	nfs3mknod(vnode_t *, char *, struct vattr *, enum vcexcl,
102 			int, vnode_t **, cred_t *);
103 static int	nfs3rename(vnode_t *, char *, vnode_t *, char *, cred_t *,
104 			caller_context_t *);
105 static int	do_nfs3readdir(vnode_t *, rddir_cache *, cred_t *);
106 static void	nfs3readdir(vnode_t *, rddir_cache *, cred_t *);
107 static void	nfs3readdirplus(vnode_t *, rddir_cache *, cred_t *);
108 static int	nfs3_bio(struct buf *, stable_how *, cred_t *);
109 static int	nfs3_getapage(vnode_t *, u_offset_t, size_t, uint_t *,
110 			page_t *[], size_t, struct seg *, caddr_t,
111 			enum seg_rw, cred_t *);
112 static void	nfs3_readahead(vnode_t *, u_offset_t, caddr_t, struct seg *,
113 			cred_t *);
114 static int	nfs3_sync_putapage(vnode_t *, page_t *, u_offset_t, size_t,
115 			int, cred_t *);
116 static int	nfs3_sync_pageio(vnode_t *, page_t *, u_offset_t, size_t,
117 			int, cred_t *);
118 static int	nfs3_commit(vnode_t *, offset3, count3, cred_t *);
119 static void	nfs3_set_mod(vnode_t *);
120 static void	nfs3_get_commit(vnode_t *);
121 static void	nfs3_get_commit_range(vnode_t *, u_offset_t, size_t);
122 #if 0 /* unused */
123 #ifdef DEBUG
124 static int	nfs3_no_uncommitted_pages(vnode_t *);
125 #endif
126 #endif /* unused */
127 static int	nfs3_putpage_commit(vnode_t *, offset_t, size_t, cred_t *);
128 static int	nfs3_commit_vp(vnode_t *, u_offset_t, size_t,  cred_t *);
129 static int	nfs3_sync_commit(vnode_t *, page_t *, offset3, count3,
130 			cred_t *);
131 static void	nfs3_async_commit(vnode_t *, page_t *, offset3, count3,
132 			cred_t *);
133 static void	nfs3_delmap_callback(struct as *, void *, uint_t);
134 
135 /*
136  * Error flags used to pass information about certain special errors
137  * which need to be handled specially.
138  */
139 #define	NFS_EOF			-98
140 #define	NFS_VERF_MISMATCH	-97
141 
142 /* ALIGN64 aligns the given buffer and adjust buffer size to 64 bit */
143 #define	ALIGN64(x, ptr, sz)						\
144 	x = ((uintptr_t)(ptr)) & (sizeof (uint64_t) - 1);		\
145 	if (x) {							\
146 		x = sizeof (uint64_t) - (x);				\
147 		sz -= (x);						\
148 		ptr += (x);						\
149 	}
150 
151 /*
152  * These are the vnode ops routines which implement the vnode interface to
153  * the networked file system.  These routines just take their parameters,
154  * make them look networkish by putting the right info into interface structs,
155  * and then calling the appropriate remote routine(s) to do the work.
156  *
157  * Note on directory name lookup cacheing:  If we detect a stale fhandle,
158  * we purge the directory cache relative to that vnode.  This way, the
159  * user won't get burned by the cache repeatedly.  See <nfs/rnode.h> for
160  * more details on rnode locking.
161  */
162 
163 static int	nfs3_open(vnode_t **, int, cred_t *, caller_context_t *);
164 static int	nfs3_close(vnode_t *, int, int, offset_t, cred_t *,
165 			caller_context_t *);
166 static int	nfs3_read(vnode_t *, struct uio *, int, cred_t *,
167 			caller_context_t *);
168 static int	nfs3_write(vnode_t *, struct uio *, int, cred_t *,
169 			caller_context_t *);
170 static int	nfs3_ioctl(vnode_t *, int, intptr_t, int, cred_t *, int *,
171 			caller_context_t *);
172 static int	nfs3_getattr(vnode_t *, struct vattr *, int, cred_t *,
173 			caller_context_t *);
174 static int	nfs3_setattr(vnode_t *, struct vattr *, int, cred_t *,
175 			caller_context_t *);
176 static int	nfs3_access(vnode_t *, int, int, cred_t *, caller_context_t *);
177 static int	nfs3_readlink(vnode_t *, struct uio *, cred_t *,
178 			caller_context_t *);
179 static int	nfs3_fsync(vnode_t *, int, cred_t *, caller_context_t *);
180 static void	nfs3_inactive(vnode_t *, cred_t *, caller_context_t *);
181 static int	nfs3_lookup(vnode_t *, char *, vnode_t **,
182 			struct pathname *, int, vnode_t *, cred_t *,
183 			caller_context_t *, int *, pathname_t *);
184 static int	nfs3_create(vnode_t *, char *, struct vattr *, enum vcexcl,
185 			int, vnode_t **, cred_t *, int, caller_context_t *,
186 			vsecattr_t *);
187 static int	nfs3_remove(vnode_t *, char *, cred_t *, caller_context_t *,
188 			int);
189 static int	nfs3_link(vnode_t *, vnode_t *, char *, cred_t *,
190 			caller_context_t *, int);
191 static int	nfs3_rename(vnode_t *, char *, vnode_t *, char *, cred_t *,
192 			caller_context_t *, int);
193 static int	nfs3_mkdir(vnode_t *, char *, struct vattr *, vnode_t **,
194 			cred_t *, caller_context_t *, int, vsecattr_t *);
195 static int	nfs3_rmdir(vnode_t *, char *, vnode_t *, cred_t *,
196 			caller_context_t *, int);
197 static int	nfs3_symlink(vnode_t *, char *, struct vattr *, char *,
198 			cred_t *, caller_context_t *, int);
199 static int	nfs3_readdir(vnode_t *, struct uio *, cred_t *, int *,
200 			caller_context_t *, int);
201 static int	nfs3_fid(vnode_t *, fid_t *, caller_context_t *);
202 static int	nfs3_rwlock(vnode_t *, int, caller_context_t *);
203 static void	nfs3_rwunlock(vnode_t *, int, caller_context_t *);
204 static int	nfs3_seek(vnode_t *, offset_t, offset_t *, caller_context_t *);
205 static int	nfs3_getpage(vnode_t *, offset_t, size_t, uint_t *,
206 			page_t *[], size_t, struct seg *, caddr_t,
207 			enum seg_rw, cred_t *, caller_context_t *);
208 static int	nfs3_putpage(vnode_t *, offset_t, size_t, int, cred_t *,
209 			caller_context_t *);
210 static int	nfs3_map(vnode_t *, offset_t, struct as *, caddr_t *, size_t,
211 			uchar_t, uchar_t, uint_t, cred_t *, caller_context_t *);
212 static int	nfs3_addmap(vnode_t *, offset_t, struct as *, caddr_t, size_t,
213 			uchar_t, uchar_t, uint_t, cred_t *, caller_context_t *);
214 static int	nfs3_frlock(vnode_t *, int, struct flock64 *, int, offset_t,
215 			struct flk_callback *, cred_t *, caller_context_t *);
216 static int	nfs3_space(vnode_t *, int, struct flock64 *, int, offset_t,
217 			cred_t *, caller_context_t *);
218 static int	nfs3_realvp(vnode_t *, vnode_t **, caller_context_t *);
219 static int	nfs3_delmap(vnode_t *, offset_t, struct as *, caddr_t, size_t,
220 			uint_t, uint_t, uint_t, cred_t *, caller_context_t *);
221 static int	nfs3_pathconf(vnode_t *, int, ulong_t *, cred_t *,
222 			caller_context_t *);
223 static int	nfs3_pageio(vnode_t *, page_t *, u_offset_t, size_t, int,
224 			cred_t *, caller_context_t *);
225 static void	nfs3_dispose(vnode_t *, page_t *, int, int, cred_t *,
226 			caller_context_t *);
227 static int	nfs3_setsecattr(vnode_t *, vsecattr_t *, int, cred_t *,
228 			caller_context_t *);
229 static int	nfs3_getsecattr(vnode_t *, vsecattr_t *, int, cred_t *,
230 			caller_context_t *);
231 static int	nfs3_shrlock(vnode_t *, int, struct shrlock *, int, cred_t *,
232 			caller_context_t *);
233 
234 struct vnodeops *nfs3_vnodeops;
235 
236 const fs_operation_def_t nfs3_vnodeops_template[] = {
237 	VOPNAME_OPEN,		{ .vop_open = nfs3_open },
238 	VOPNAME_CLOSE,		{ .vop_close = nfs3_close },
239 	VOPNAME_READ,		{ .vop_read = nfs3_read },
240 	VOPNAME_WRITE,		{ .vop_write = nfs3_write },
241 	VOPNAME_IOCTL,		{ .vop_ioctl = nfs3_ioctl },
242 	VOPNAME_GETATTR,	{ .vop_getattr = nfs3_getattr },
243 	VOPNAME_SETATTR,	{ .vop_setattr = nfs3_setattr },
244 	VOPNAME_ACCESS,		{ .vop_access = nfs3_access },
245 	VOPNAME_LOOKUP,		{ .vop_lookup = nfs3_lookup },
246 	VOPNAME_CREATE,		{ .vop_create = nfs3_create },
247 	VOPNAME_REMOVE,		{ .vop_remove = nfs3_remove },
248 	VOPNAME_LINK,		{ .vop_link = nfs3_link },
249 	VOPNAME_RENAME,		{ .vop_rename = nfs3_rename },
250 	VOPNAME_MKDIR,		{ .vop_mkdir = nfs3_mkdir },
251 	VOPNAME_RMDIR,		{ .vop_rmdir = nfs3_rmdir },
252 	VOPNAME_READDIR,	{ .vop_readdir = nfs3_readdir },
253 	VOPNAME_SYMLINK,	{ .vop_symlink = nfs3_symlink },
254 	VOPNAME_READLINK,	{ .vop_readlink = nfs3_readlink },
255 	VOPNAME_FSYNC,		{ .vop_fsync = nfs3_fsync },
256 	VOPNAME_INACTIVE,	{ .vop_inactive = nfs3_inactive },
257 	VOPNAME_FID,		{ .vop_fid = nfs3_fid },
258 	VOPNAME_RWLOCK,		{ .vop_rwlock = nfs3_rwlock },
259 	VOPNAME_RWUNLOCK,	{ .vop_rwunlock = nfs3_rwunlock },
260 	VOPNAME_SEEK,		{ .vop_seek = nfs3_seek },
261 	VOPNAME_FRLOCK,		{ .vop_frlock = nfs3_frlock },
262 	VOPNAME_SPACE,		{ .vop_space = nfs3_space },
263 	VOPNAME_REALVP,		{ .vop_realvp = nfs3_realvp },
264 	VOPNAME_GETPAGE,	{ .vop_getpage = nfs3_getpage },
265 	VOPNAME_PUTPAGE,	{ .vop_putpage = nfs3_putpage },
266 	VOPNAME_MAP,		{ .vop_map = nfs3_map },
267 	VOPNAME_ADDMAP,		{ .vop_addmap = nfs3_addmap },
268 	VOPNAME_DELMAP,		{ .vop_delmap = nfs3_delmap },
269 	/* no separate nfs3_dump */
270 	VOPNAME_DUMP,		{ .vop_dump = nfs_dump },
271 	VOPNAME_PATHCONF,	{ .vop_pathconf = nfs3_pathconf },
272 	VOPNAME_PAGEIO,		{ .vop_pageio = nfs3_pageio },
273 	VOPNAME_DISPOSE,	{ .vop_dispose = nfs3_dispose },
274 	VOPNAME_SETSECATTR,	{ .vop_setsecattr = nfs3_setsecattr },
275 	VOPNAME_GETSECATTR,	{ .vop_getsecattr = nfs3_getsecattr },
276 	VOPNAME_SHRLOCK,	{ .vop_shrlock = nfs3_shrlock },
277 	VOPNAME_VNEVENT, 	{ .vop_vnevent = fs_vnevent_support },
278 	NULL,			NULL
279 };
280 
281 /*
282  * XXX:  This is referenced in modstubs.s
283  */
284 struct vnodeops *
285 nfs3_getvnodeops(void)
286 {
287 	return (nfs3_vnodeops);
288 }
289 
290 /* ARGSUSED */
291 static int
292 nfs3_open(vnode_t **vpp, int flag, cred_t *cr, caller_context_t *ct)
293 {
294 	int error;
295 	struct vattr va;
296 	rnode_t *rp;
297 	vnode_t *vp;
298 
299 	vp = *vpp;
300 	if (nfs_zone() != VTOMI(vp)->mi_zone)
301 		return (EIO);
302 	rp = VTOR(vp);
303 	mutex_enter(&rp->r_statelock);
304 	if (rp->r_cred == NULL) {
305 		crhold(cr);
306 		rp->r_cred = cr;
307 	}
308 	mutex_exit(&rp->r_statelock);
309 
310 	/*
311 	 * If there is no cached data or if close-to-open
312 	 * consistency checking is turned off, we can avoid
313 	 * the over the wire getattr.  Otherwise, if the
314 	 * file system is mounted readonly, then just verify
315 	 * the caches are up to date using the normal mechanism.
316 	 * Else, if the file is not mmap'd, then just mark
317 	 * the attributes as timed out.  They will be refreshed
318 	 * and the caches validated prior to being used.
319 	 * Else, the file system is mounted writeable so
320 	 * force an over the wire GETATTR in order to ensure
321 	 * that all cached data is valid.
322 	 */
323 	if (vp->v_count > 1 ||
324 	    ((vn_has_cached_data(vp) || HAVE_RDDIR_CACHE(rp)) &&
325 	    !(VTOMI(vp)->mi_flags & MI_NOCTO))) {
326 		if (vn_is_readonly(vp))
327 			error = nfs3_validate_caches(vp, cr);
328 		else if (rp->r_mapcnt == 0 && vp->v_count == 1) {
329 			PURGE_ATTRCACHE(vp);
330 			error = 0;
331 		} else {
332 			va.va_mask = AT_ALL;
333 			error = nfs3_getattr_otw(vp, &va, cr);
334 		}
335 	} else
336 		error = 0;
337 
338 	return (error);
339 }
340 
341 /* ARGSUSED */
342 static int
343 nfs3_close(vnode_t *vp, int flag, int count, offset_t offset, cred_t *cr,
344 		caller_context_t *ct)
345 {
346 	rnode_t *rp;
347 	int error;
348 	struct vattr va;
349 
350 	/*
351 	 * zone_enter(2) prevents processes from changing zones with NFS files
352 	 * open; if we happen to get here from the wrong zone we can't do
353 	 * anything over the wire.
354 	 */
355 	if (VTOMI(vp)->mi_zone != nfs_zone()) {
356 		/*
357 		 * We could attempt to clean up locks, except we're sure
358 		 * that the current process didn't acquire any locks on
359 		 * the file: any attempt to lock a file belong to another zone
360 		 * will fail, and one can't lock an NFS file and then change
361 		 * zones, as that fails too.
362 		 *
363 		 * Returning an error here is the sane thing to do.  A
364 		 * subsequent call to VN_RELE() which translates to a
365 		 * nfs3_inactive() will clean up state: if the zone of the
366 		 * vnode's origin is still alive and kicking, an async worker
367 		 * thread will handle the request (from the correct zone), and
368 		 * everything (minus the commit and final nfs3_getattr_otw()
369 		 * call) should be OK. If the zone is going away
370 		 * nfs_async_inactive() will throw away cached pages inline.
371 		 */
372 		return (EIO);
373 	}
374 
375 	/*
376 	 * If we are using local locking for this filesystem, then
377 	 * release all of the SYSV style record locks.  Otherwise,
378 	 * we are doing network locking and we need to release all
379 	 * of the network locks.  All of the locks held by this
380 	 * process on this file are released no matter what the
381 	 * incoming reference count is.
382 	 */
383 	if (VTOMI(vp)->mi_flags & MI_LLOCK) {
384 		cleanlocks(vp, ttoproc(curthread)->p_pid, 0);
385 		cleanshares(vp, ttoproc(curthread)->p_pid);
386 	} else
387 		nfs_lockrelease(vp, flag, offset, cr);
388 
389 	if (count > 1)
390 		return (0);
391 
392 	/*
393 	 * If the file has been `unlinked', then purge the
394 	 * DNLC so that this vnode will get reycled quicker
395 	 * and the .nfs* file on the server will get removed.
396 	 */
397 	rp = VTOR(vp);
398 	if (rp->r_unldvp != NULL)
399 		dnlc_purge_vp(vp);
400 
401 	/*
402 	 * If the file was open for write and there are pages,
403 	 * then if the file system was mounted using the "no-close-
404 	 *	to-open" semantics, then start an asynchronous flush
405 	 *	of the all of the pages in the file.
406 	 * else the file system was not mounted using the "no-close-
407 	 *	to-open" semantics, then do a synchronous flush and
408 	 *	commit of all of the dirty and uncommitted pages.
409 	 *
410 	 * The asynchronous flush of the pages in the "nocto" path
411 	 * mostly just associates a cred pointer with the rnode so
412 	 * writes which happen later will have a better chance of
413 	 * working.  It also starts the data being written to the
414 	 * server, but without unnecessarily delaying the application.
415 	 */
416 	if ((flag & FWRITE) && vn_has_cached_data(vp)) {
417 		if (VTOMI(vp)->mi_flags & MI_NOCTO) {
418 			error = nfs3_putpage(vp, (offset_t)0, 0, B_ASYNC,
419 			    cr, ct);
420 			if (error == EAGAIN)
421 				error = 0;
422 		} else
423 			error = nfs3_putpage_commit(vp, (offset_t)0, 0, cr);
424 		if (!error) {
425 			mutex_enter(&rp->r_statelock);
426 			error = rp->r_error;
427 			rp->r_error = 0;
428 			mutex_exit(&rp->r_statelock);
429 		}
430 	} else {
431 		mutex_enter(&rp->r_statelock);
432 		error = rp->r_error;
433 		rp->r_error = 0;
434 		mutex_exit(&rp->r_statelock);
435 	}
436 
437 	/*
438 	 * If RWRITEATTR is set, then issue an over the wire GETATTR to
439 	 * refresh the attribute cache with a set of attributes which
440 	 * weren't returned from a WRITE.  This will enable the close-
441 	 * to-open processing to work.
442 	 */
443 	if (rp->r_flags & RWRITEATTR)
444 		(void) nfs3_getattr_otw(vp, &va, cr);
445 
446 	return (error);
447 }
448 
449 /* ARGSUSED */
450 static int
451 nfs3_directio_read(vnode_t *vp, struct uio *uiop, cred_t *cr)
452 {
453 	mntinfo_t *mi;
454 	READ3args args;
455 	READ3uiores res;
456 	int tsize;
457 	offset_t offset;
458 	ssize_t count;
459 	int error;
460 	int douprintf;
461 	failinfo_t fi;
462 	char *sv_hostname;
463 
464 	mi = VTOMI(vp);
465 	ASSERT(nfs_zone() == VTOMI(vp)->mi_zone);
466 	sv_hostname = VTOR(vp)->r_server->sv_hostname;
467 
468 	douprintf = 1;
469 	args.file = *VTOFH3(vp);
470 	fi.vp = vp;
471 	fi.fhp = (caddr_t)&args.file;
472 	fi.copyproc = nfs3copyfh;
473 	fi.lookupproc = nfs3lookup;
474 	fi.xattrdirproc = acl_getxattrdir3;
475 
476 	res.uiop = uiop;
477 
478 	res.wlist = NULL;
479 
480 	offset = uiop->uio_loffset;
481 	count = uiop->uio_resid;
482 
483 	do {
484 		if (mi->mi_io_kstats) {
485 			mutex_enter(&mi->mi_lock);
486 			kstat_runq_enter(KSTAT_IO_PTR(mi->mi_io_kstats));
487 			mutex_exit(&mi->mi_lock);
488 		}
489 
490 		do {
491 			tsize = MIN(mi->mi_tsize, count);
492 			args.offset = (offset3)offset;
493 			args.count = (count3)tsize;
494 			res.size = (uint_t)tsize;
495 			args.res_uiop = uiop;
496 			args.res_data_val_alt = NULL;
497 
498 			error = rfs3call(mi, NFSPROC3_READ,
499 			    xdr_READ3args, (caddr_t)&args,
500 			    xdr_READ3uiores, (caddr_t)&res, cr,
501 			    &douprintf, &res.status, 0, &fi);
502 		} while (error == ENFS_TRYAGAIN);
503 
504 		if (mi->mi_io_kstats) {
505 			mutex_enter(&mi->mi_lock);
506 			kstat_runq_exit(KSTAT_IO_PTR(mi->mi_io_kstats));
507 			mutex_exit(&mi->mi_lock);
508 		}
509 
510 		if (error)
511 			return (error);
512 
513 		error = geterrno3(res.status);
514 		if (error)
515 			return (error);
516 
517 		if (res.count != res.size) {
518 			zcmn_err(getzoneid(), CE_WARN,
519 "nfs3_directio_read: server %s returned incorrect amount",
520 			    sv_hostname);
521 			return (EIO);
522 		}
523 		count -= res.count;
524 		offset += res.count;
525 		if (mi->mi_io_kstats) {
526 			mutex_enter(&mi->mi_lock);
527 			KSTAT_IO_PTR(mi->mi_io_kstats)->reads++;
528 			KSTAT_IO_PTR(mi->mi_io_kstats)->nread += res.count;
529 			mutex_exit(&mi->mi_lock);
530 		}
531 		lwp_stat_update(LWP_STAT_INBLK, 1);
532 	} while (count && !res.eof);
533 
534 	return (0);
535 }
536 
537 /* ARGSUSED */
538 static int
539 nfs3_read(vnode_t *vp, struct uio *uiop, int ioflag, cred_t *cr,
540 	caller_context_t *ct)
541 {
542 	rnode_t *rp;
543 	u_offset_t off;
544 	offset_t diff;
545 	int on;
546 	size_t n;
547 	caddr_t base;
548 	uint_t flags;
549 	int error = 0;
550 	mntinfo_t *mi;
551 
552 	rp = VTOR(vp);
553 	mi = VTOMI(vp);
554 
555 	ASSERT(nfs_rw_lock_held(&rp->r_rwlock, RW_READER));
556 
557 	if (nfs_zone() != mi->mi_zone)
558 		return (EIO);
559 
560 	if (vp->v_type != VREG)
561 		return (EISDIR);
562 
563 	if (uiop->uio_resid == 0)
564 		return (0);
565 
566 	if (uiop->uio_loffset < 0 || uiop->uio_loffset + uiop->uio_resid < 0)
567 		return (EINVAL);
568 
569 	/*
570 	 * Bypass VM if caching has been disabled (e.g., locking) or if
571 	 * using client-side direct I/O and the file is not mmap'd and
572 	 * there are no cached pages.
573 	 */
574 	if ((vp->v_flag & VNOCACHE) ||
575 	    (((rp->r_flags & RDIRECTIO) || (mi->mi_flags & MI_DIRECTIO)) &&
576 	    rp->r_mapcnt == 0 && !vn_has_cached_data(vp))) {
577 		return (nfs3_directio_read(vp, uiop, cr));
578 	}
579 
580 	do {
581 		off = uiop->uio_loffset & MAXBMASK; /* mapping offset */
582 		on = uiop->uio_loffset & MAXBOFFSET; /* Relative offset */
583 		n = MIN(MAXBSIZE - on, uiop->uio_resid);
584 
585 		error = nfs3_validate_caches(vp, cr);
586 		if (error)
587 			break;
588 
589 		mutex_enter(&rp->r_statelock);
590 		while (rp->r_flags & RINCACHEPURGE) {
591 			if (!cv_wait_sig(&rp->r_cv, &rp->r_statelock)) {
592 				mutex_exit(&rp->r_statelock);
593 				return (EINTR);
594 			}
595 		}
596 		diff = rp->r_size - uiop->uio_loffset;
597 		mutex_exit(&rp->r_statelock);
598 		if (diff <= 0)
599 			break;
600 		if (diff < n)
601 			n = (size_t)diff;
602 
603 		if (vpm_enable) {
604 			/*
605 			 * Copy data.
606 			 */
607 			error = vpm_data_copy(vp, off + on, n, uiop,
608 			    1, NULL, 0, S_READ);
609 		} else {
610 			base = segmap_getmapflt(segkmap, vp, off + on, n, 1,
611 			    S_READ);
612 
613 			error = uiomove(base + on, n, UIO_READ, uiop);
614 		}
615 
616 		if (!error) {
617 			/*
618 			 * If read a whole block or read to eof,
619 			 * won't need this buffer again soon.
620 			 */
621 			mutex_enter(&rp->r_statelock);
622 			if (n + on == MAXBSIZE ||
623 			    uiop->uio_loffset == rp->r_size)
624 				flags = SM_DONTNEED;
625 			else
626 				flags = 0;
627 			mutex_exit(&rp->r_statelock);
628 			if (vpm_enable) {
629 				error = vpm_sync_pages(vp, off, n, flags);
630 			} else {
631 				error = segmap_release(segkmap, base, flags);
632 			}
633 		} else {
634 			if (vpm_enable) {
635 				(void) vpm_sync_pages(vp, off, n, 0);
636 			} else {
637 				(void) segmap_release(segkmap, base, 0);
638 			}
639 		}
640 	} while (!error && uiop->uio_resid > 0);
641 
642 	return (error);
643 }
644 
645 /* ARGSUSED */
646 static int
647 nfs3_write(vnode_t *vp, struct uio *uiop, int ioflag, cred_t *cr,
648 	caller_context_t *ct)
649 {
650 	rlim64_t limit = uiop->uio_llimit;
651 	rnode_t *rp;
652 	u_offset_t off;
653 	caddr_t base;
654 	uint_t flags;
655 	int remainder;
656 	size_t n;
657 	int on;
658 	int error;
659 	int resid;
660 	offset_t offset;
661 	mntinfo_t *mi;
662 	uint_t bsize;
663 
664 	rp = VTOR(vp);
665 
666 	if (vp->v_type != VREG)
667 		return (EISDIR);
668 
669 	mi = VTOMI(vp);
670 	if (nfs_zone() != mi->mi_zone)
671 		return (EIO);
672 	if (uiop->uio_resid == 0)
673 		return (0);
674 
675 	if (ioflag & FAPPEND) {
676 		struct vattr va;
677 
678 		/*
679 		 * Must serialize if appending.
680 		 */
681 		if (nfs_rw_lock_held(&rp->r_rwlock, RW_READER)) {
682 			nfs_rw_exit(&rp->r_rwlock);
683 			if (nfs_rw_enter_sig(&rp->r_rwlock, RW_WRITER,
684 			    INTR(vp)))
685 				return (EINTR);
686 		}
687 
688 		va.va_mask = AT_SIZE;
689 		error = nfs3getattr(vp, &va, cr);
690 		if (error)
691 			return (error);
692 		uiop->uio_loffset = va.va_size;
693 	}
694 
695 	offset = uiop->uio_loffset + uiop->uio_resid;
696 
697 	if (uiop->uio_loffset < 0 || offset < 0)
698 		return (EINVAL);
699 
700 	if (limit == RLIM64_INFINITY || limit > MAXOFFSET_T)
701 		limit = MAXOFFSET_T;
702 
703 	/*
704 	 * Check to make sure that the process will not exceed
705 	 * its limit on file size.  It is okay to write up to
706 	 * the limit, but not beyond.  Thus, the write which
707 	 * reaches the limit will be short and the next write
708 	 * will return an error.
709 	 */
710 	remainder = 0;
711 	if (offset > limit) {
712 		remainder = offset - limit;
713 		uiop->uio_resid = limit - uiop->uio_loffset;
714 		if (uiop->uio_resid <= 0) {
715 			proc_t *p = ttoproc(curthread);
716 
717 			uiop->uio_resid += remainder;
718 			mutex_enter(&p->p_lock);
719 			(void) rctl_action(rctlproc_legacy[RLIMIT_FSIZE],
720 			    p->p_rctls, p, RCA_UNSAFE_SIGINFO);
721 			mutex_exit(&p->p_lock);
722 			return (EFBIG);
723 		}
724 	}
725 
726 	if (nfs_rw_enter_sig(&rp->r_lkserlock, RW_READER, INTR(vp)))
727 		return (EINTR);
728 
729 	/*
730 	 * Bypass VM if caching has been disabled (e.g., locking) or if
731 	 * using client-side direct I/O and the file is not mmap'd and
732 	 * there are no cached pages.
733 	 */
734 	if ((vp->v_flag & VNOCACHE) ||
735 	    (((rp->r_flags & RDIRECTIO) || (mi->mi_flags & MI_DIRECTIO)) &&
736 	    rp->r_mapcnt == 0 && !vn_has_cached_data(vp))) {
737 		size_t bufsize;
738 		int count;
739 		u_offset_t org_offset;
740 		stable_how stab_comm;
741 
742 nfs3_fwrite:
743 		if (rp->r_flags & RSTALE) {
744 			resid = uiop->uio_resid;
745 			offset = uiop->uio_loffset;
746 			error = rp->r_error;
747 			goto bottom;
748 		}
749 		bufsize = MIN(uiop->uio_resid, mi->mi_stsize);
750 		base = kmem_alloc(bufsize, KM_SLEEP);
751 		do {
752 			if (ioflag & FDSYNC)
753 				stab_comm = DATA_SYNC;
754 			else
755 				stab_comm = FILE_SYNC;
756 			resid = uiop->uio_resid;
757 			offset = uiop->uio_loffset;
758 			count = MIN(uiop->uio_resid, bufsize);
759 			org_offset = uiop->uio_loffset;
760 			error = uiomove(base, count, UIO_WRITE, uiop);
761 			if (!error) {
762 				error = nfs3write(vp, base, org_offset,
763 				    count, cr, &stab_comm);
764 			}
765 		} while (!error && uiop->uio_resid > 0);
766 		kmem_free(base, bufsize);
767 		goto bottom;
768 	}
769 
770 
771 	bsize = vp->v_vfsp->vfs_bsize;
772 
773 	do {
774 		off = uiop->uio_loffset & MAXBMASK; /* mapping offset */
775 		on = uiop->uio_loffset & MAXBOFFSET; /* Relative offset */
776 		n = MIN(MAXBSIZE - on, uiop->uio_resid);
777 
778 		resid = uiop->uio_resid;
779 		offset = uiop->uio_loffset;
780 
781 		if (rp->r_flags & RSTALE) {
782 			error = rp->r_error;
783 			break;
784 		}
785 
786 		/*
787 		 * Don't create dirty pages faster than they
788 		 * can be cleaned so that the system doesn't
789 		 * get imbalanced.  If the async queue is
790 		 * maxed out, then wait for it to drain before
791 		 * creating more dirty pages.  Also, wait for
792 		 * any threads doing pagewalks in the vop_getattr
793 		 * entry points so that they don't block for
794 		 * long periods.
795 		 */
796 		mutex_enter(&rp->r_statelock);
797 		while ((mi->mi_max_threads != 0 &&
798 		    rp->r_awcount > 2 * mi->mi_max_threads) ||
799 		    rp->r_gcount > 0)
800 			cv_wait(&rp->r_cv, &rp->r_statelock);
801 		mutex_exit(&rp->r_statelock);
802 
803 		if (vpm_enable) {
804 			/*
805 			 * It will use kpm mappings, so no need to
806 			 * pass an address.
807 			 */
808 			error = writerp(rp, NULL, n, uiop, 0);
809 		} else  {
810 			if (segmap_kpm) {
811 				int pon = uiop->uio_loffset & PAGEOFFSET;
812 				size_t pn = MIN(PAGESIZE - pon,
813 				    uiop->uio_resid);
814 				int pagecreate;
815 
816 				mutex_enter(&rp->r_statelock);
817 				pagecreate = (pon == 0) && (pn == PAGESIZE ||
818 				    uiop->uio_loffset + pn >= rp->r_size);
819 				mutex_exit(&rp->r_statelock);
820 
821 				base = segmap_getmapflt(segkmap, vp, off + on,
822 				    pn, !pagecreate, S_WRITE);
823 
824 				error = writerp(rp, base + pon, n, uiop,
825 				    pagecreate);
826 
827 			} else {
828 				base = segmap_getmapflt(segkmap, vp, off + on,
829 				    n, 0, S_READ);
830 				error = writerp(rp, base + on, n, uiop, 0);
831 			}
832 		}
833 
834 		if (!error) {
835 			if (mi->mi_flags & MI_NOAC)
836 				flags = SM_WRITE;
837 			else if ((uiop->uio_loffset % bsize) == 0 ||
838 			    IS_SWAPVP(vp)) {
839 				/*
840 				 * Have written a whole block.
841 				 * Start an asynchronous write
842 				 * and mark the buffer to
843 				 * indicate that it won't be
844 				 * needed again soon.
845 				 */
846 				flags = SM_WRITE | SM_ASYNC | SM_DONTNEED;
847 			} else
848 				flags = 0;
849 			if ((ioflag & (FSYNC|FDSYNC)) ||
850 			    (rp->r_flags & ROUTOFSPACE)) {
851 				flags &= ~SM_ASYNC;
852 				flags |= SM_WRITE;
853 			}
854 			if (vpm_enable) {
855 				error = vpm_sync_pages(vp, off, n, flags);
856 			} else {
857 				error = segmap_release(segkmap, base, flags);
858 			}
859 		} else {
860 			if (vpm_enable) {
861 				(void) vpm_sync_pages(vp, off, n, 0);
862 			} else {
863 				(void) segmap_release(segkmap, base, 0);
864 			}
865 			/*
866 			 * In the event that we got an access error while
867 			 * faulting in a page for a write-only file just
868 			 * force a write.
869 			 */
870 			if (error == EACCES)
871 				goto nfs3_fwrite;
872 		}
873 	} while (!error && uiop->uio_resid > 0);
874 
875 bottom:
876 	if (error) {
877 		uiop->uio_resid = resid + remainder;
878 		uiop->uio_loffset = offset;
879 	} else
880 		uiop->uio_resid += remainder;
881 
882 	nfs_rw_exit(&rp->r_lkserlock);
883 
884 	return (error);
885 }
886 
887 /*
888  * Flags are composed of {B_ASYNC, B_INVAL, B_FREE, B_DONTNEED}
889  */
890 static int
891 nfs3_rdwrlbn(vnode_t *vp, page_t *pp, u_offset_t off, size_t len,
892 	int flags, cred_t *cr)
893 {
894 	struct buf *bp;
895 	int error;
896 	page_t *savepp;
897 	uchar_t fsdata;
898 	stable_how stab_comm;
899 
900 	ASSERT(nfs_zone() == VTOMI(vp)->mi_zone);
901 	bp = pageio_setup(pp, len, vp, flags);
902 	ASSERT(bp != NULL);
903 
904 	/*
905 	 * pageio_setup should have set b_addr to 0.  This
906 	 * is correct since we want to do I/O on a page
907 	 * boundary.  bp_mapin will use this addr to calculate
908 	 * an offset, and then set b_addr to the kernel virtual
909 	 * address it allocated for us.
910 	 */
911 	ASSERT(bp->b_un.b_addr == 0);
912 
913 	bp->b_edev = 0;
914 	bp->b_dev = 0;
915 	bp->b_lblkno = lbtodb(off);
916 	bp->b_file = vp;
917 	bp->b_offset = (offset_t)off;
918 	bp_mapin(bp);
919 
920 	/*
921 	 * Calculate the desired level of stability to write data
922 	 * on the server and then mark all of the pages to reflect
923 	 * this.
924 	 */
925 	if ((flags & (B_WRITE|B_ASYNC)) == (B_WRITE|B_ASYNC) &&
926 	    freemem > desfree) {
927 		stab_comm = UNSTABLE;
928 		fsdata = C_DELAYCOMMIT;
929 	} else {
930 		stab_comm = FILE_SYNC;
931 		fsdata = C_NOCOMMIT;
932 	}
933 
934 	savepp = pp;
935 	do {
936 		pp->p_fsdata = fsdata;
937 	} while ((pp = pp->p_next) != savepp);
938 
939 	error = nfs3_bio(bp, &stab_comm, cr);
940 
941 	bp_mapout(bp);
942 	pageio_done(bp);
943 
944 	/*
945 	 * If the server wrote pages in a more stable fashion than
946 	 * was requested, then clear all of the marks in the pages
947 	 * indicating that COMMIT operations were required.
948 	 */
949 	if (stab_comm != UNSTABLE && fsdata == C_DELAYCOMMIT) {
950 		do {
951 			pp->p_fsdata = C_NOCOMMIT;
952 		} while ((pp = pp->p_next) != savepp);
953 	}
954 
955 	return (error);
956 }
957 
958 /*
959  * Write to file.  Writes to remote server in largest size
960  * chunks that the server can handle.  Write is synchronous.
961  */
962 static int
963 nfs3write(vnode_t *vp, caddr_t base, u_offset_t offset, int count, cred_t *cr,
964 	stable_how *stab_comm)
965 {
966 	mntinfo_t *mi;
967 	WRITE3args args;
968 	WRITE3res res;
969 	int error;
970 	int tsize;
971 	rnode_t *rp;
972 	int douprintf;
973 
974 	rp = VTOR(vp);
975 	mi = VTOMI(vp);
976 
977 	ASSERT(nfs_zone() == mi->mi_zone);
978 
979 	args.file = *VTOFH3(vp);
980 	args.stable = *stab_comm;
981 
982 	*stab_comm = FILE_SYNC;
983 
984 	douprintf = 1;
985 
986 	do {
987 		if ((vp->v_flag & VNOCACHE) ||
988 		    (rp->r_flags & RDIRECTIO) ||
989 		    (mi->mi_flags & MI_DIRECTIO))
990 			tsize = MIN(mi->mi_stsize, count);
991 		else
992 			tsize = MIN(mi->mi_curwrite, count);
993 		args.offset = (offset3)offset;
994 		args.count = (count3)tsize;
995 		args.data.data_len = (uint_t)tsize;
996 		args.data.data_val = base;
997 
998 		if (mi->mi_io_kstats) {
999 			mutex_enter(&mi->mi_lock);
1000 			kstat_runq_enter(KSTAT_IO_PTR(mi->mi_io_kstats));
1001 			mutex_exit(&mi->mi_lock);
1002 		}
1003 		args.mblk = NULL;
1004 		do {
1005 			error = rfs3call(mi, NFSPROC3_WRITE,
1006 			    xdr_WRITE3args, (caddr_t)&args,
1007 			    xdr_WRITE3res, (caddr_t)&res, cr,
1008 			    &douprintf, &res.status, 0, NULL);
1009 		} while (error == ENFS_TRYAGAIN);
1010 		if (mi->mi_io_kstats) {
1011 			mutex_enter(&mi->mi_lock);
1012 			kstat_runq_exit(KSTAT_IO_PTR(mi->mi_io_kstats));
1013 			mutex_exit(&mi->mi_lock);
1014 		}
1015 
1016 		if (error)
1017 			return (error);
1018 		error = geterrno3(res.status);
1019 		if (!error) {
1020 			if (res.resok.count > args.count) {
1021 				zcmn_err(getzoneid(), CE_WARN,
1022 				    "nfs3write: server %s wrote %u, "
1023 				    "requested was %u",
1024 				    rp->r_server->sv_hostname,
1025 				    res.resok.count, args.count);
1026 				return (EIO);
1027 			}
1028 			if (res.resok.committed == UNSTABLE) {
1029 				*stab_comm = UNSTABLE;
1030 				if (args.stable == DATA_SYNC ||
1031 				    args.stable == FILE_SYNC) {
1032 					zcmn_err(getzoneid(), CE_WARN,
1033 			"nfs3write: server %s did not commit to stable storage",
1034 					    rp->r_server->sv_hostname);
1035 					return (EIO);
1036 				}
1037 			}
1038 			tsize = (int)res.resok.count;
1039 			count -= tsize;
1040 			base += tsize;
1041 			offset += tsize;
1042 			if (mi->mi_io_kstats) {
1043 				mutex_enter(&mi->mi_lock);
1044 				KSTAT_IO_PTR(mi->mi_io_kstats)->writes++;
1045 				KSTAT_IO_PTR(mi->mi_io_kstats)->nwritten +=
1046 				    tsize;
1047 				mutex_exit(&mi->mi_lock);
1048 			}
1049 			lwp_stat_update(LWP_STAT_OUBLK, 1);
1050 			mutex_enter(&rp->r_statelock);
1051 			if (rp->r_flags & RHAVEVERF) {
1052 				if (rp->r_verf != res.resok.verf) {
1053 					nfs3_set_mod(vp);
1054 					rp->r_verf = res.resok.verf;
1055 					/*
1056 					 * If the data was written UNSTABLE,
1057 					 * then might as well stop because
1058 					 * the whole block will have to get
1059 					 * rewritten anyway.
1060 					 */
1061 					if (*stab_comm == UNSTABLE) {
1062 						mutex_exit(&rp->r_statelock);
1063 						break;
1064 					}
1065 				}
1066 			} else {
1067 				rp->r_verf = res.resok.verf;
1068 				rp->r_flags |= RHAVEVERF;
1069 			}
1070 			/*
1071 			 * Mark the attribute cache as timed out and
1072 			 * set RWRITEATTR to indicate that the file
1073 			 * was modified with a WRITE operation and
1074 			 * that the attributes can not be trusted.
1075 			 */
1076 			PURGE_ATTRCACHE_LOCKED(rp);
1077 			rp->r_flags |= RWRITEATTR;
1078 			mutex_exit(&rp->r_statelock);
1079 		}
1080 	} while (!error && count);
1081 
1082 	return (error);
1083 }
1084 
1085 /*
1086  * Read from a file.  Reads data in largest chunks our interface can handle.
1087  */
1088 static int
1089 nfs3read(vnode_t *vp, caddr_t base, offset_t offset, int count,
1090 	size_t *residp, cred_t *cr)
1091 {
1092 	mntinfo_t *mi;
1093 	READ3args args;
1094 	READ3vres res;
1095 	int tsize;
1096 	int error;
1097 	int douprintf;
1098 	failinfo_t fi;
1099 	rnode_t *rp;
1100 	struct vattr va;
1101 	hrtime_t t;
1102 
1103 	rp = VTOR(vp);
1104 	mi = VTOMI(vp);
1105 	ASSERT(nfs_zone() == mi->mi_zone);
1106 	douprintf = 1;
1107 
1108 	args.file = *VTOFH3(vp);
1109 	fi.vp = vp;
1110 	fi.fhp = (caddr_t)&args.file;
1111 	fi.copyproc = nfs3copyfh;
1112 	fi.lookupproc = nfs3lookup;
1113 	fi.xattrdirproc = acl_getxattrdir3;
1114 
1115 	res.pov.fres.vp = vp;
1116 	res.pov.fres.vap = &va;
1117 
1118 	res.wlist = NULL;
1119 	*residp = count;
1120 	do {
1121 		if (mi->mi_io_kstats) {
1122 			mutex_enter(&mi->mi_lock);
1123 			kstat_runq_enter(KSTAT_IO_PTR(mi->mi_io_kstats));
1124 			mutex_exit(&mi->mi_lock);
1125 		}
1126 
1127 		do {
1128 			if ((vp->v_flag & VNOCACHE) ||
1129 			    (rp->r_flags & RDIRECTIO) ||
1130 			    (mi->mi_flags & MI_DIRECTIO))
1131 				tsize = MIN(mi->mi_tsize, count);
1132 			else
1133 				tsize = MIN(mi->mi_curread, count);
1134 			res.data.data_val = base;
1135 			res.data.data_len = tsize;
1136 			args.offset = (offset3)offset;
1137 			args.count = (count3)tsize;
1138 			args.res_uiop = NULL;
1139 			args.res_data_val_alt = base;
1140 
1141 			t = gethrtime();
1142 			error = rfs3call(mi, NFSPROC3_READ,
1143 			    xdr_READ3args, (caddr_t)&args,
1144 			    xdr_READ3vres, (caddr_t)&res, cr,
1145 			    &douprintf, &res.status, 0, &fi);
1146 		} while (error == ENFS_TRYAGAIN);
1147 
1148 		if (mi->mi_io_kstats) {
1149 			mutex_enter(&mi->mi_lock);
1150 			kstat_runq_exit(KSTAT_IO_PTR(mi->mi_io_kstats));
1151 			mutex_exit(&mi->mi_lock);
1152 		}
1153 
1154 		if (error)
1155 			return (error);
1156 
1157 		error = geterrno3(res.status);
1158 		if (error)
1159 			return (error);
1160 
1161 		if (res.count != res.data.data_len) {
1162 			zcmn_err(getzoneid(), CE_WARN,
1163 			    "nfs3read: server %s returned incorrect amount",
1164 			    rp->r_server->sv_hostname);
1165 			return (EIO);
1166 		}
1167 
1168 		count -= res.count;
1169 		*residp = count;
1170 		base += res.count;
1171 		offset += res.count;
1172 		if (mi->mi_io_kstats) {
1173 			mutex_enter(&mi->mi_lock);
1174 			KSTAT_IO_PTR(mi->mi_io_kstats)->reads++;
1175 			KSTAT_IO_PTR(mi->mi_io_kstats)->nread += res.count;
1176 			mutex_exit(&mi->mi_lock);
1177 		}
1178 		lwp_stat_update(LWP_STAT_INBLK, 1);
1179 	} while (count && !res.eof);
1180 
1181 	if (res.pov.attributes) {
1182 		mutex_enter(&rp->r_statelock);
1183 		if (!CACHE_VALID(rp, va.va_mtime, va.va_size)) {
1184 			mutex_exit(&rp->r_statelock);
1185 			PURGE_ATTRCACHE(vp);
1186 		} else {
1187 			if (rp->r_mtime <= t)
1188 				nfs_attrcache_va(vp, &va);
1189 			mutex_exit(&rp->r_statelock);
1190 		}
1191 	}
1192 
1193 	return (0);
1194 }
1195 
1196 /* ARGSUSED */
1197 static int
1198 nfs3_ioctl(vnode_t *vp, int cmd, intptr_t arg, int flag, cred_t *cr, int *rvalp,
1199 	caller_context_t *ct)
1200 {
1201 
1202 	if (nfs_zone() != VTOMI(vp)->mi_zone)
1203 		return (EIO);
1204 	switch (cmd) {
1205 		case _FIODIRECTIO:
1206 			return (nfs_directio(vp, (int)arg, cr));
1207 		default:
1208 			return (ENOTTY);
1209 	}
1210 }
1211 
1212 /* ARGSUSED */
1213 static int
1214 nfs3_getattr(vnode_t *vp, struct vattr *vap, int flags, cred_t *cr,
1215 	caller_context_t *ct)
1216 {
1217 	int error;
1218 	rnode_t *rp;
1219 
1220 	if (nfs_zone() != VTOMI(vp)->mi_zone)
1221 		return (EIO);
1222 	/*
1223 	 * If it has been specified that the return value will
1224 	 * just be used as a hint, and we are only being asked
1225 	 * for size, fsid or rdevid, then return the client's
1226 	 * notion of these values without checking to make sure
1227 	 * that the attribute cache is up to date.
1228 	 * The whole point is to avoid an over the wire GETATTR
1229 	 * call.
1230 	 */
1231 	rp = VTOR(vp);
1232 	if (flags & ATTR_HINT) {
1233 		if (vap->va_mask ==
1234 		    (vap->va_mask & (AT_SIZE | AT_FSID | AT_RDEV))) {
1235 			mutex_enter(&rp->r_statelock);
1236 			if (vap->va_mask | AT_SIZE)
1237 				vap->va_size = rp->r_size;
1238 			if (vap->va_mask | AT_FSID)
1239 				vap->va_fsid = rp->r_attr.va_fsid;
1240 			if (vap->va_mask | AT_RDEV)
1241 				vap->va_rdev = rp->r_attr.va_rdev;
1242 			mutex_exit(&rp->r_statelock);
1243 			return (0);
1244 		}
1245 	}
1246 
1247 	/*
1248 	 * Only need to flush pages if asking for the mtime
1249 	 * and if there any dirty pages or any outstanding
1250 	 * asynchronous (write) requests for this file.
1251 	 */
1252 	if (vap->va_mask & AT_MTIME) {
1253 		if (vn_has_cached_data(vp) &&
1254 		    ((rp->r_flags & RDIRTY) || rp->r_awcount > 0)) {
1255 			mutex_enter(&rp->r_statelock);
1256 			rp->r_gcount++;
1257 			mutex_exit(&rp->r_statelock);
1258 			error = nfs3_putpage(vp, (offset_t)0, 0, 0, cr, ct);
1259 			mutex_enter(&rp->r_statelock);
1260 			if (error && (error == ENOSPC || error == EDQUOT)) {
1261 				if (!rp->r_error)
1262 					rp->r_error = error;
1263 			}
1264 			if (--rp->r_gcount == 0)
1265 				cv_broadcast(&rp->r_cv);
1266 			mutex_exit(&rp->r_statelock);
1267 		}
1268 	}
1269 
1270 	return (nfs3getattr(vp, vap, cr));
1271 }
1272 
1273 /*ARGSUSED4*/
1274 static int
1275 nfs3_setattr(vnode_t *vp, struct vattr *vap, int flags, cred_t *cr,
1276 		caller_context_t *ct)
1277 {
1278 	int error;
1279 	struct vattr va;
1280 
1281 	if (vap->va_mask & AT_NOSET)
1282 		return (EINVAL);
1283 	if (nfs_zone() != VTOMI(vp)->mi_zone)
1284 		return (EIO);
1285 
1286 	va.va_mask = AT_UID | AT_MODE;
1287 	error = nfs3getattr(vp, &va, cr);
1288 	if (error)
1289 		return (error);
1290 
1291 	error = secpolicy_vnode_setattr(cr, vp, vap, &va, flags, nfs3_accessx,
1292 	    vp);
1293 	if (error)
1294 		return (error);
1295 
1296 	return (nfs3setattr(vp, vap, flags, cr));
1297 }
1298 
1299 static int
1300 nfs3setattr(vnode_t *vp, struct vattr *vap, int flags, cred_t *cr)
1301 {
1302 	int error;
1303 	uint_t mask;
1304 	SETATTR3args args;
1305 	SETATTR3res res;
1306 	int douprintf;
1307 	rnode_t *rp;
1308 	struct vattr va;
1309 	mode_t omode;
1310 	vsecattr_t *vsp;
1311 	hrtime_t t;
1312 
1313 	ASSERT(nfs_zone() == VTOMI(vp)->mi_zone);
1314 	mask = vap->va_mask;
1315 
1316 	rp = VTOR(vp);
1317 
1318 	/*
1319 	 * Only need to flush pages if there are any pages and
1320 	 * if the file is marked as dirty in some fashion.  The
1321 	 * file must be flushed so that we can accurately
1322 	 * determine the size of the file and the cached data
1323 	 * after the SETATTR returns.  A file is considered to
1324 	 * be dirty if it is either marked with RDIRTY, has
1325 	 * outstanding i/o's active, or is mmap'd.  In this
1326 	 * last case, we can't tell whether there are dirty
1327 	 * pages, so we flush just to be sure.
1328 	 */
1329 	if (vn_has_cached_data(vp) &&
1330 	    ((rp->r_flags & RDIRTY) ||
1331 	    rp->r_count > 0 ||
1332 	    rp->r_mapcnt > 0)) {
1333 		ASSERT(vp->v_type != VCHR);
1334 		error = nfs3_putpage(vp, (offset_t)0, 0, 0, cr, NULL);
1335 		if (error && (error == ENOSPC || error == EDQUOT)) {
1336 			mutex_enter(&rp->r_statelock);
1337 			if (!rp->r_error)
1338 				rp->r_error = error;
1339 			mutex_exit(&rp->r_statelock);
1340 		}
1341 	}
1342 
1343 	args.object = *RTOFH3(rp);
1344 	/*
1345 	 * If the intent is for the server to set the times,
1346 	 * there is no point in have the mask indicating set mtime or
1347 	 * atime, because the vap values may be junk, and so result
1348 	 * in an overflow error. Remove these flags from the vap mask
1349 	 * before calling in this case, and restore them afterwards.
1350 	 */
1351 	if ((mask & (AT_ATIME | AT_MTIME)) && !(flags & ATTR_UTIME)) {
1352 		/* Use server times, so don't set the args time fields */
1353 		vap->va_mask &= ~(AT_ATIME | AT_MTIME);
1354 		error = vattr_to_sattr3(vap, &args.new_attributes);
1355 		vap->va_mask |= (mask & (AT_ATIME | AT_MTIME));
1356 		if (mask & AT_ATIME) {
1357 			args.new_attributes.atime.set_it = SET_TO_SERVER_TIME;
1358 		}
1359 		if (mask & AT_MTIME) {
1360 			args.new_attributes.mtime.set_it = SET_TO_SERVER_TIME;
1361 		}
1362 	} else {
1363 		/* Either do not set times or use the client specified times */
1364 		error = vattr_to_sattr3(vap, &args.new_attributes);
1365 	}
1366 
1367 	if (error) {
1368 		/* req time field(s) overflow - return immediately */
1369 		return (error);
1370 	}
1371 
1372 	va.va_mask = AT_MODE | AT_CTIME;
1373 	error = nfs3getattr(vp, &va, cr);
1374 	if (error)
1375 		return (error);
1376 	omode = va.va_mode;
1377 
1378 tryagain:
1379 	if (mask & AT_SIZE) {
1380 		args.guard.check = TRUE;
1381 		args.guard.obj_ctime.seconds = va.va_ctime.tv_sec;
1382 		args.guard.obj_ctime.nseconds = va.va_ctime.tv_nsec;
1383 	} else
1384 		args.guard.check = FALSE;
1385 
1386 	douprintf = 1;
1387 
1388 	t = gethrtime();
1389 
1390 	error = rfs3call(VTOMI(vp), NFSPROC3_SETATTR,
1391 	    xdr_SETATTR3args, (caddr_t)&args,
1392 	    xdr_SETATTR3res, (caddr_t)&res, cr,
1393 	    &douprintf, &res.status, 0, NULL);
1394 
1395 	/*
1396 	 * Purge the access cache and ACL cache if changing either the
1397 	 * owner of the file, the group owner, or the mode.  These may
1398 	 * change the access permissions of the file, so purge old
1399 	 * information and start over again.
1400 	 */
1401 	if (mask & (AT_UID | AT_GID | AT_MODE)) {
1402 		(void) nfs_access_purge_rp(rp);
1403 		if (rp->r_secattr != NULL) {
1404 			mutex_enter(&rp->r_statelock);
1405 			vsp = rp->r_secattr;
1406 			rp->r_secattr = NULL;
1407 			mutex_exit(&rp->r_statelock);
1408 			if (vsp != NULL)
1409 				nfs_acl_free(vsp);
1410 		}
1411 	}
1412 
1413 	if (error) {
1414 		PURGE_ATTRCACHE(vp);
1415 		return (error);
1416 	}
1417 
1418 	error = geterrno3(res.status);
1419 	if (!error) {
1420 		/*
1421 		 * If changing the size of the file, invalidate
1422 		 * any local cached data which is no longer part
1423 		 * of the file.  We also possibly invalidate the
1424 		 * last page in the file.  We could use
1425 		 * pvn_vpzero(), but this would mark the page as
1426 		 * modified and require it to be written back to
1427 		 * the server for no particularly good reason.
1428 		 * This way, if we access it, then we bring it
1429 		 * back in.  A read should be cheaper than a
1430 		 * write.
1431 		 */
1432 		if (mask & AT_SIZE) {
1433 			nfs_invalidate_pages(vp,
1434 			    (vap->va_size & PAGEMASK), cr);
1435 		}
1436 		nfs3_cache_wcc_data(vp, &res.resok.obj_wcc, t, cr);
1437 		/*
1438 		 * Some servers will change the mode to clear the setuid
1439 		 * and setgid bits when changing the uid or gid.  The
1440 		 * client needs to compensate appropriately.
1441 		 */
1442 		if (mask & (AT_UID | AT_GID)) {
1443 			int terror;
1444 
1445 			va.va_mask = AT_MODE;
1446 			terror = nfs3getattr(vp, &va, cr);
1447 			if (!terror &&
1448 			    (((mask & AT_MODE) && va.va_mode != vap->va_mode) ||
1449 			    (!(mask & AT_MODE) && va.va_mode != omode))) {
1450 				va.va_mask = AT_MODE;
1451 				if (mask & AT_MODE)
1452 					va.va_mode = vap->va_mode;
1453 				else
1454 					va.va_mode = omode;
1455 				(void) nfs3setattr(vp, &va, 0, cr);
1456 			}
1457 		}
1458 	} else {
1459 		nfs3_cache_wcc_data(vp, &res.resfail.obj_wcc, t, cr);
1460 		/*
1461 		 * If we got back a "not synchronized" error, then
1462 		 * we need to retry with a new guard value.  The
1463 		 * guard value used is the change time.  If the
1464 		 * server returned post_op_attr, then we can just
1465 		 * retry because we have the latest attributes.
1466 		 * Otherwise, we issue a GETATTR to get the latest
1467 		 * attributes and then retry.  If we couldn't get
1468 		 * the attributes this way either, then we give
1469 		 * up because we can't complete the operation as
1470 		 * required.
1471 		 */
1472 		if (res.status == NFS3ERR_NOT_SYNC) {
1473 			va.va_mask = AT_CTIME;
1474 			if (nfs3getattr(vp, &va, cr) == 0)
1475 				goto tryagain;
1476 		}
1477 		PURGE_STALE_FH(error, vp, cr);
1478 	}
1479 
1480 	return (error);
1481 }
1482 
1483 static int
1484 nfs3_accessx(void *vp, int mode, cred_t *cr)
1485 {
1486 	ASSERT(nfs_zone() == VTOMI((vnode_t *)vp)->mi_zone);
1487 	return (nfs3_access(vp, mode, 0, cr, NULL));
1488 }
1489 
1490 /* ARGSUSED */
1491 static int
1492 nfs3_access(vnode_t *vp, int mode, int flags, cred_t *cr, caller_context_t *ct)
1493 {
1494 	int error;
1495 	ACCESS3args args;
1496 	ACCESS3res res;
1497 	int douprintf;
1498 	uint32 acc;
1499 	rnode_t *rp;
1500 	cred_t *cred, *ncr, *ncrfree = NULL;
1501 	failinfo_t fi;
1502 	nfs_access_type_t cacc;
1503 	hrtime_t t;
1504 
1505 	acc = 0;
1506 	if (nfs_zone() != VTOMI(vp)->mi_zone)
1507 		return (EIO);
1508 	if (mode & VREAD)
1509 		acc |= ACCESS3_READ;
1510 	if (mode & VWRITE) {
1511 		if (vn_is_readonly(vp) && !IS_DEVVP(vp))
1512 			return (EROFS);
1513 		if (vp->v_type == VDIR)
1514 			acc |= ACCESS3_DELETE;
1515 		acc |= ACCESS3_MODIFY | ACCESS3_EXTEND;
1516 	}
1517 	if (mode & VEXEC) {
1518 		if (vp->v_type == VDIR)
1519 			acc |= ACCESS3_LOOKUP;
1520 		else
1521 			acc |= ACCESS3_EXECUTE;
1522 	}
1523 
1524 	rp = VTOR(vp);
1525 	args.object = *VTOFH3(vp);
1526 	if (vp->v_type == VDIR) {
1527 		args.access = ACCESS3_READ | ACCESS3_DELETE | ACCESS3_MODIFY |
1528 		    ACCESS3_EXTEND | ACCESS3_LOOKUP;
1529 	} else {
1530 		args.access = ACCESS3_READ | ACCESS3_MODIFY | ACCESS3_EXTEND |
1531 		    ACCESS3_EXECUTE;
1532 	}
1533 	fi.vp = vp;
1534 	fi.fhp = (caddr_t)&args.object;
1535 	fi.copyproc = nfs3copyfh;
1536 	fi.lookupproc = nfs3lookup;
1537 	fi.xattrdirproc = acl_getxattrdir3;
1538 
1539 	cred = cr;
1540 	/*
1541 	 * ncr and ncrfree both initially
1542 	 * point to the memory area returned
1543 	 * by crnetadjust();
1544 	 * ncrfree not NULL when exiting means
1545 	 * that we need to release it
1546 	 */
1547 	ncr = crnetadjust(cred);
1548 	ncrfree = ncr;
1549 tryagain:
1550 	if (rp->r_acache != NULL) {
1551 		cacc = nfs_access_check(rp, acc, cred);
1552 		if (cacc == NFS_ACCESS_ALLOWED) {
1553 			if (ncrfree != NULL)
1554 				crfree(ncrfree);
1555 			return (0);
1556 		}
1557 		if (cacc == NFS_ACCESS_DENIED) {
1558 			/*
1559 			 * If the cred can be adjusted, try again
1560 			 * with the new cred.
1561 			 */
1562 			if (ncr != NULL) {
1563 				cred = ncr;
1564 				ncr = NULL;
1565 				goto tryagain;
1566 			}
1567 			if (ncrfree != NULL)
1568 				crfree(ncrfree);
1569 			return (EACCES);
1570 		}
1571 	}
1572 
1573 	douprintf = 1;
1574 
1575 	t = gethrtime();
1576 
1577 	error = rfs3call(VTOMI(vp), NFSPROC3_ACCESS,
1578 	    xdr_ACCESS3args, (caddr_t)&args,
1579 	    xdr_ACCESS3res, (caddr_t)&res, cred,
1580 	    &douprintf, &res.status, 0, &fi);
1581 
1582 	if (error) {
1583 		if (ncrfree != NULL)
1584 			crfree(ncrfree);
1585 		return (error);
1586 	}
1587 
1588 	error = geterrno3(res.status);
1589 	if (!error) {
1590 		nfs3_cache_post_op_attr(vp, &res.resok.obj_attributes, t, cr);
1591 		nfs_access_cache(rp, args.access, res.resok.access, cred);
1592 		/*
1593 		 * we just cached results with cred; if cred is the
1594 		 * adjusted credentials from crnetadjust, we do not want
1595 		 * to release them before exiting: hence setting ncrfree
1596 		 * to NULL
1597 		 */
1598 		if (cred != cr)
1599 			ncrfree = NULL;
1600 		if ((acc & res.resok.access) != acc) {
1601 			/*
1602 			 * If the cred can be adjusted, try again
1603 			 * with the new cred.
1604 			 */
1605 			if (ncr != NULL) {
1606 				cred = ncr;
1607 				ncr = NULL;
1608 				goto tryagain;
1609 			}
1610 			error = EACCES;
1611 		}
1612 	} else {
1613 		nfs3_cache_post_op_attr(vp, &res.resfail.obj_attributes, t, cr);
1614 		PURGE_STALE_FH(error, vp, cr);
1615 	}
1616 
1617 	if (ncrfree != NULL)
1618 		crfree(ncrfree);
1619 
1620 	return (error);
1621 }
1622 
1623 static int nfs3_do_symlink_cache = 1;
1624 
1625 /* ARGSUSED */
1626 static int
1627 nfs3_readlink(vnode_t *vp, struct uio *uiop, cred_t *cr, caller_context_t *ct)
1628 {
1629 	int error;
1630 	READLINK3args args;
1631 	READLINK3res res;
1632 	nfspath3 resdata_backup;
1633 	rnode_t *rp;
1634 	int douprintf;
1635 	int len;
1636 	failinfo_t fi;
1637 	hrtime_t t;
1638 
1639 	/*
1640 	 * Can't readlink anything other than a symbolic link.
1641 	 */
1642 	if (vp->v_type != VLNK)
1643 		return (EINVAL);
1644 	if (nfs_zone() != VTOMI(vp)->mi_zone)
1645 		return (EIO);
1646 
1647 	rp = VTOR(vp);
1648 	if (nfs3_do_symlink_cache && rp->r_symlink.contents != NULL) {
1649 		error = nfs3_validate_caches(vp, cr);
1650 		if (error)
1651 			return (error);
1652 		mutex_enter(&rp->r_statelock);
1653 		if (rp->r_symlink.contents != NULL) {
1654 			error = uiomove(rp->r_symlink.contents,
1655 			    rp->r_symlink.len, UIO_READ, uiop);
1656 			mutex_exit(&rp->r_statelock);
1657 			return (error);
1658 		}
1659 		mutex_exit(&rp->r_statelock);
1660 	}
1661 
1662 	args.symlink = *VTOFH3(vp);
1663 	fi.vp = vp;
1664 	fi.fhp = (caddr_t)&args.symlink;
1665 	fi.copyproc = nfs3copyfh;
1666 	fi.lookupproc = nfs3lookup;
1667 	fi.xattrdirproc = acl_getxattrdir3;
1668 
1669 	res.resok.data = kmem_alloc(MAXPATHLEN, KM_SLEEP);
1670 
1671 	resdata_backup = res.resok.data;
1672 
1673 	douprintf = 1;
1674 
1675 	t = gethrtime();
1676 
1677 	error = rfs3call(VTOMI(vp), NFSPROC3_READLINK,
1678 	    xdr_READLINK3args, (caddr_t)&args,
1679 	    xdr_READLINK3res, (caddr_t)&res, cr,
1680 	    &douprintf, &res.status, 0, &fi);
1681 
1682 	if (res.resok.data == nfs3nametoolong)
1683 		error = EINVAL;
1684 
1685 	if (error) {
1686 		kmem_free(resdata_backup, MAXPATHLEN);
1687 		return (error);
1688 	}
1689 
1690 	error = geterrno3(res.status);
1691 	if (!error) {
1692 		nfs3_cache_post_op_attr(vp, &res.resok.symlink_attributes, t,
1693 		    cr);
1694 		len = strlen(res.resok.data);
1695 		error = uiomove(res.resok.data, len, UIO_READ, uiop);
1696 		if (nfs3_do_symlink_cache && rp->r_symlink.contents == NULL) {
1697 			mutex_enter(&rp->r_statelock);
1698 				if (rp->r_symlink.contents == NULL) {
1699 				rp->r_symlink.contents = res.resok.data;
1700 				rp->r_symlink.len = len;
1701 				rp->r_symlink.size = MAXPATHLEN;
1702 				mutex_exit(&rp->r_statelock);
1703 			} else {
1704 				mutex_exit(&rp->r_statelock);
1705 
1706 				kmem_free((void *)res.resok.data, MAXPATHLEN);
1707 			}
1708 		} else {
1709 			kmem_free((void *)res.resok.data, MAXPATHLEN);
1710 		}
1711 	} else {
1712 		nfs3_cache_post_op_attr(vp,
1713 		    &res.resfail.symlink_attributes, t, cr);
1714 		PURGE_STALE_FH(error, vp, cr);
1715 
1716 		kmem_free((void *)res.resok.data, MAXPATHLEN);
1717 
1718 	}
1719 
1720 	/*
1721 	 * The over the wire error for attempting to readlink something
1722 	 * other than a symbolic link is ENXIO.  However, we need to
1723 	 * return EINVAL instead of ENXIO, so we map it here.
1724 	 */
1725 	return (error == ENXIO ? EINVAL : error);
1726 }
1727 
1728 /*
1729  * Flush local dirty pages to stable storage on the server.
1730  *
1731  * If FNODSYNC is specified, then there is nothing to do because
1732  * metadata changes are not cached on the client before being
1733  * sent to the server.
1734  */
1735 /* ARGSUSED */
1736 static int
1737 nfs3_fsync(vnode_t *vp, int syncflag, cred_t *cr, caller_context_t *ct)
1738 {
1739 	int error;
1740 
1741 	if ((syncflag & FNODSYNC) || IS_SWAPVP(vp))
1742 		return (0);
1743 	if (nfs_zone() != VTOMI(vp)->mi_zone)
1744 		return (EIO);
1745 
1746 	error = nfs3_putpage_commit(vp, (offset_t)0, 0, cr);
1747 	if (!error)
1748 		error = VTOR(vp)->r_error;
1749 	return (error);
1750 }
1751 
1752 /*
1753  * Weirdness: if the file was removed or the target of a rename
1754  * operation while it was open, it got renamed instead.  Here we
1755  * remove the renamed file.
1756  */
1757 /* ARGSUSED */
1758 static void
1759 nfs3_inactive(vnode_t *vp, cred_t *cr, caller_context_t *ct)
1760 {
1761 	rnode_t *rp;
1762 
1763 	ASSERT(vp != DNLC_NO_VNODE);
1764 
1765 	/*
1766 	 * If this is coming from the wrong zone, we let someone in the right
1767 	 * zone take care of it asynchronously.  We can get here due to
1768 	 * VN_RELE() being called from pageout() or fsflush().  This call may
1769 	 * potentially turn into an expensive no-op if, for instance, v_count
1770 	 * gets incremented in the meantime, but it's still correct.
1771 	 */
1772 	if (nfs_zone() != VTOMI(vp)->mi_zone) {
1773 		nfs_async_inactive(vp, cr, nfs3_inactive);
1774 		return;
1775 	}
1776 
1777 	rp = VTOR(vp);
1778 redo:
1779 	if (rp->r_unldvp != NULL) {
1780 		/*
1781 		 * Save the vnode pointer for the directory where the
1782 		 * unlinked-open file got renamed, then set it to NULL
1783 		 * to prevent another thread from getting here before
1784 		 * we're done with the remove.  While we have the
1785 		 * statelock, make local copies of the pertinent rnode
1786 		 * fields.  If we weren't to do this in an atomic way, the
1787 		 * the unl* fields could become inconsistent with respect
1788 		 * to each other due to a race condition between this
1789 		 * code and nfs_remove().  See bug report 1034328.
1790 		 */
1791 		mutex_enter(&rp->r_statelock);
1792 		if (rp->r_unldvp != NULL) {
1793 			vnode_t *unldvp;
1794 			char *unlname;
1795 			cred_t *unlcred;
1796 			REMOVE3args args;
1797 			REMOVE3res res;
1798 			int douprintf;
1799 			int error;
1800 			hrtime_t t;
1801 
1802 			unldvp = rp->r_unldvp;
1803 			rp->r_unldvp = NULL;
1804 			unlname = rp->r_unlname;
1805 			rp->r_unlname = NULL;
1806 			unlcred = rp->r_unlcred;
1807 			rp->r_unlcred = NULL;
1808 			mutex_exit(&rp->r_statelock);
1809 
1810 			/*
1811 			 * If there are any dirty pages left, then flush
1812 			 * them.  This is unfortunate because they just
1813 			 * may get thrown away during the remove operation,
1814 			 * but we have to do this for correctness.
1815 			 */
1816 			if (vn_has_cached_data(vp) &&
1817 			    ((rp->r_flags & RDIRTY) || rp->r_count > 0)) {
1818 				ASSERT(vp->v_type != VCHR);
1819 				error = nfs3_putpage(vp, (offset_t)0, 0, 0,
1820 				    cr, ct);
1821 				if (error) {
1822 					mutex_enter(&rp->r_statelock);
1823 					if (!rp->r_error)
1824 						rp->r_error = error;
1825 					mutex_exit(&rp->r_statelock);
1826 				}
1827 			}
1828 
1829 			/*
1830 			 * Do the remove operation on the renamed file
1831 			 */
1832 			setdiropargs3(&args.object, unlname, unldvp);
1833 
1834 			douprintf = 1;
1835 
1836 			t = gethrtime();
1837 
1838 			error = rfs3call(VTOMI(unldvp), NFSPROC3_REMOVE,
1839 			    xdr_diropargs3, (caddr_t)&args,
1840 			    xdr_REMOVE3res, (caddr_t)&res, unlcred,
1841 			    &douprintf, &res.status, 0, NULL);
1842 
1843 			if (error) {
1844 				PURGE_ATTRCACHE(unldvp);
1845 			} else {
1846 				error = geterrno3(res.status);
1847 				if (!error) {
1848 					nfs3_cache_wcc_data(unldvp,
1849 					    &res.resok.dir_wcc, t, cr);
1850 					if (HAVE_RDDIR_CACHE(VTOR(unldvp)))
1851 						nfs_purge_rddir_cache(unldvp);
1852 				} else {
1853 					nfs3_cache_wcc_data(unldvp,
1854 					    &res.resfail.dir_wcc, t, cr);
1855 					PURGE_STALE_FH(error, unldvp, cr);
1856 				}
1857 			}
1858 
1859 			/*
1860 			 * Release stuff held for the remove
1861 			 */
1862 			VN_RELE(unldvp);
1863 			kmem_free(unlname, MAXNAMELEN);
1864 			crfree(unlcred);
1865 			goto redo;
1866 		}
1867 		mutex_exit(&rp->r_statelock);
1868 	}
1869 
1870 	rp_addfree(rp, cr);
1871 }
1872 
1873 /*
1874  * Remote file system operations having to do with directory manipulation.
1875  */
1876 
1877 /* ARGSUSED */
1878 static int
1879 nfs3_lookup(vnode_t *dvp, char *nm, vnode_t **vpp, struct pathname *pnp,
1880 	int flags, vnode_t *rdir, cred_t *cr, caller_context_t *ct,
1881 	int *direntflags, pathname_t *realpnp)
1882 {
1883 	int error;
1884 	vnode_t *vp;
1885 	vnode_t *avp = NULL;
1886 	rnode_t *drp;
1887 
1888 	if (nfs_zone() != VTOMI(dvp)->mi_zone)
1889 		return (EPERM);
1890 
1891 	drp = VTOR(dvp);
1892 
1893 	/*
1894 	 * Are we looking up extended attributes?  If so, "dvp" is
1895 	 * the file or directory for which we want attributes, and
1896 	 * we need a lookup of the hidden attribute directory
1897 	 * before we lookup the rest of the path.
1898 	 */
1899 	if (flags & LOOKUP_XATTR) {
1900 		bool_t cflag = ((flags & CREATE_XATTR_DIR) != 0);
1901 		mntinfo_t *mi;
1902 
1903 		mi = VTOMI(dvp);
1904 		if (!(mi->mi_flags & MI_EXTATTR))
1905 			return (EINVAL);
1906 
1907 		if (nfs_rw_enter_sig(&drp->r_rwlock, RW_READER, INTR(dvp)))
1908 			return (EINTR);
1909 
1910 		(void) nfs3lookup_dnlc(dvp, XATTR_DIR_NAME, &avp, cr);
1911 		if (avp == NULL)
1912 			error = acl_getxattrdir3(dvp, &avp, cflag, cr, 0);
1913 		else
1914 			error = 0;
1915 
1916 		nfs_rw_exit(&drp->r_rwlock);
1917 
1918 		if (error) {
1919 			if (mi->mi_flags & MI_EXTATTR)
1920 				return (error);
1921 			return (EINVAL);
1922 		}
1923 		dvp = avp;
1924 		drp = VTOR(dvp);
1925 	}
1926 
1927 	if (nfs_rw_enter_sig(&drp->r_rwlock, RW_READER, INTR(dvp))) {
1928 		error = EINTR;
1929 		goto out;
1930 	}
1931 
1932 	error = nfs3lookup(dvp, nm, vpp, pnp, flags, rdir, cr, 0);
1933 
1934 	nfs_rw_exit(&drp->r_rwlock);
1935 
1936 	/*
1937 	 * If vnode is a device, create special vnode.
1938 	 */
1939 	if (!error && IS_DEVVP(*vpp)) {
1940 		vp = *vpp;
1941 		*vpp = specvp(vp, vp->v_rdev, vp->v_type, cr);
1942 		VN_RELE(vp);
1943 	}
1944 
1945 out:
1946 	if (avp != NULL)
1947 		VN_RELE(avp);
1948 
1949 	return (error);
1950 }
1951 
1952 static int nfs3_lookup_neg_cache = 1;
1953 
1954 #ifdef DEBUG
1955 static int nfs3_lookup_dnlc_hits = 0;
1956 static int nfs3_lookup_dnlc_misses = 0;
1957 static int nfs3_lookup_dnlc_neg_hits = 0;
1958 static int nfs3_lookup_dnlc_disappears = 0;
1959 static int nfs3_lookup_dnlc_lookups = 0;
1960 #endif
1961 
1962 /* ARGSUSED */
1963 int
1964 nfs3lookup(vnode_t *dvp, char *nm, vnode_t **vpp, struct pathname *pnp,
1965 	int flags, vnode_t *rdir, cred_t *cr, int rfscall_flags)
1966 {
1967 	int error;
1968 	rnode_t *drp;
1969 
1970 	ASSERT(nfs_zone() == VTOMI(dvp)->mi_zone);
1971 	/*
1972 	 * If lookup is for "", just return dvp.  Don't need
1973 	 * to send it over the wire, look it up in the dnlc,
1974 	 * or perform any access checks.
1975 	 */
1976 	if (*nm == '\0') {
1977 		VN_HOLD(dvp);
1978 		*vpp = dvp;
1979 		return (0);
1980 	}
1981 
1982 	/*
1983 	 * Can't do lookups in non-directories.
1984 	 */
1985 	if (dvp->v_type != VDIR)
1986 		return (ENOTDIR);
1987 
1988 	/*
1989 	 * If we're called with RFSCALL_SOFT, it's important that
1990 	 * the only rfscall is one we make directly; if we permit
1991 	 * an access call because we're looking up "." or validating
1992 	 * a dnlc hit, we'll deadlock because that rfscall will not
1993 	 * have the RFSCALL_SOFT set.
1994 	 */
1995 	if (rfscall_flags & RFSCALL_SOFT)
1996 		goto callit;
1997 
1998 	/*
1999 	 * If lookup is for ".", just return dvp.  Don't need
2000 	 * to send it over the wire or look it up in the dnlc,
2001 	 * just need to check access.
2002 	 */
2003 	if (strcmp(nm, ".") == 0) {
2004 		error = nfs3_access(dvp, VEXEC, 0, cr, NULL);
2005 		if (error)
2006 			return (error);
2007 		VN_HOLD(dvp);
2008 		*vpp = dvp;
2009 		return (0);
2010 	}
2011 
2012 	drp = VTOR(dvp);
2013 	if (!(drp->r_flags & RLOOKUP)) {
2014 		mutex_enter(&drp->r_statelock);
2015 		drp->r_flags |= RLOOKUP;
2016 		mutex_exit(&drp->r_statelock);
2017 	}
2018 
2019 	/*
2020 	 * Lookup this name in the DNLC.  If there was a valid entry,
2021 	 * then return the results of the lookup.
2022 	 */
2023 	error = nfs3lookup_dnlc(dvp, nm, vpp, cr);
2024 	if (error || *vpp != NULL)
2025 		return (error);
2026 
2027 callit:
2028 	error = nfs3lookup_otw(dvp, nm, vpp, cr, rfscall_flags);
2029 
2030 	return (error);
2031 }
2032 
2033 static int
2034 nfs3lookup_dnlc(vnode_t *dvp, char *nm, vnode_t **vpp, cred_t *cr)
2035 {
2036 	int error;
2037 	vnode_t *vp;
2038 
2039 	ASSERT(*nm != '\0');
2040 	ASSERT(nfs_zone() == VTOMI(dvp)->mi_zone);
2041 	/*
2042 	 * Lookup this name in the DNLC.  If successful, then validate
2043 	 * the caches and then recheck the DNLC.  The DNLC is rechecked
2044 	 * just in case this entry got invalidated during the call
2045 	 * to nfs3_validate_caches.
2046 	 *
2047 	 * An assumption is being made that it is safe to say that a
2048 	 * file exists which may not on the server.  Any operations to
2049 	 * the server will fail with ESTALE.
2050 	 */
2051 #ifdef DEBUG
2052 	nfs3_lookup_dnlc_lookups++;
2053 #endif
2054 	vp = dnlc_lookup(dvp, nm);
2055 	if (vp != NULL) {
2056 		VN_RELE(vp);
2057 		if (vp == DNLC_NO_VNODE && !vn_is_readonly(dvp)) {
2058 			PURGE_ATTRCACHE(dvp);
2059 		}
2060 		error = nfs3_validate_caches(dvp, cr);
2061 		if (error)
2062 			return (error);
2063 		vp = dnlc_lookup(dvp, nm);
2064 		if (vp != NULL) {
2065 			error = nfs3_access(dvp, VEXEC, 0, cr, NULL);
2066 			if (error) {
2067 				VN_RELE(vp);
2068 				return (error);
2069 			}
2070 			if (vp == DNLC_NO_VNODE) {
2071 				VN_RELE(vp);
2072 #ifdef DEBUG
2073 				nfs3_lookup_dnlc_neg_hits++;
2074 #endif
2075 				return (ENOENT);
2076 			}
2077 			*vpp = vp;
2078 #ifdef DEBUG
2079 			nfs3_lookup_dnlc_hits++;
2080 #endif
2081 			return (0);
2082 		}
2083 #ifdef DEBUG
2084 		nfs3_lookup_dnlc_disappears++;
2085 #endif
2086 	}
2087 #ifdef DEBUG
2088 	else
2089 		nfs3_lookup_dnlc_misses++;
2090 #endif
2091 
2092 	*vpp = NULL;
2093 
2094 	return (0);
2095 }
2096 
2097 static int
2098 nfs3lookup_otw(vnode_t *dvp, char *nm, vnode_t **vpp, cred_t *cr,
2099 	int rfscall_flags)
2100 {
2101 	int error;
2102 	LOOKUP3args args;
2103 	LOOKUP3vres res;
2104 	int douprintf;
2105 	struct vattr vattr;
2106 	struct vattr dvattr;
2107 	vnode_t *vp;
2108 	failinfo_t fi;
2109 	hrtime_t t;
2110 
2111 	ASSERT(*nm != '\0');
2112 	ASSERT(dvp->v_type == VDIR);
2113 	ASSERT(nfs_zone() == VTOMI(dvp)->mi_zone);
2114 
2115 	setdiropargs3(&args.what, nm, dvp);
2116 
2117 	fi.vp = dvp;
2118 	fi.fhp = (caddr_t)&args.what.dir;
2119 	fi.copyproc = nfs3copyfh;
2120 	fi.lookupproc = nfs3lookup;
2121 	fi.xattrdirproc = acl_getxattrdir3;
2122 	res.obj_attributes.fres.vp = dvp;
2123 	res.obj_attributes.fres.vap = &vattr;
2124 	res.dir_attributes.fres.vp = dvp;
2125 	res.dir_attributes.fres.vap = &dvattr;
2126 
2127 	douprintf = 1;
2128 
2129 	t = gethrtime();
2130 
2131 	error = rfs3call(VTOMI(dvp), NFSPROC3_LOOKUP,
2132 	    xdr_diropargs3, (caddr_t)&args,
2133 	    xdr_LOOKUP3vres, (caddr_t)&res, cr,
2134 	    &douprintf, &res.status, rfscall_flags, &fi);
2135 
2136 	if (error)
2137 		return (error);
2138 
2139 	nfs3_cache_post_op_vattr(dvp, &res.dir_attributes, t, cr);
2140 
2141 	error = geterrno3(res.status);
2142 	if (error) {
2143 		PURGE_STALE_FH(error, dvp, cr);
2144 		if (error == ENOENT && nfs3_lookup_neg_cache)
2145 			dnlc_enter(dvp, nm, DNLC_NO_VNODE);
2146 		return (error);
2147 	}
2148 
2149 	if (res.obj_attributes.attributes) {
2150 		vp = makenfs3node_va(&res.object, res.obj_attributes.fres.vap,
2151 		    dvp->v_vfsp, t, cr, VTOR(dvp)->r_path, nm);
2152 	} else {
2153 		vp = makenfs3node_va(&res.object, NULL,
2154 		    dvp->v_vfsp, t, cr, VTOR(dvp)->r_path, nm);
2155 		if (vp->v_type == VNON) {
2156 			vattr.va_mask = AT_TYPE;
2157 			error = nfs3getattr(vp, &vattr, cr);
2158 			if (error) {
2159 				VN_RELE(vp);
2160 				return (error);
2161 			}
2162 			vp->v_type = vattr.va_type;
2163 		}
2164 	}
2165 
2166 	if (!(rfscall_flags & RFSCALL_SOFT))
2167 		dnlc_update(dvp, nm, vp);
2168 
2169 	*vpp = vp;
2170 
2171 	return (error);
2172 }
2173 
2174 #ifdef DEBUG
2175 static int nfs3_create_misses = 0;
2176 #endif
2177 
2178 /* ARGSUSED */
2179 static int
2180 nfs3_create(vnode_t *dvp, char *nm, struct vattr *va, enum vcexcl exclusive,
2181 	int mode, vnode_t **vpp, cred_t *cr, int lfaware, caller_context_t *ct,
2182 	vsecattr_t *vsecp)
2183 {
2184 	int error;
2185 	vnode_t *vp;
2186 	rnode_t *rp;
2187 	struct vattr vattr;
2188 	rnode_t *drp;
2189 	vnode_t *tempvp;
2190 
2191 	drp = VTOR(dvp);
2192 	if (nfs_zone() != VTOMI(dvp)->mi_zone)
2193 		return (EPERM);
2194 	if (nfs_rw_enter_sig(&drp->r_rwlock, RW_WRITER, INTR(dvp)))
2195 		return (EINTR);
2196 
2197 top:
2198 	/*
2199 	 * We make a copy of the attributes because the caller does not
2200 	 * expect us to change what va points to.
2201 	 */
2202 	vattr = *va;
2203 
2204 	/*
2205 	 * If the pathname is "", just use dvp.  Don't need
2206 	 * to send it over the wire, look it up in the dnlc,
2207 	 * or perform any access checks.
2208 	 */
2209 	if (*nm == '\0') {
2210 		error = 0;
2211 		VN_HOLD(dvp);
2212 		vp = dvp;
2213 	/*
2214 	 * If the pathname is ".", just use dvp.  Don't need
2215 	 * to send it over the wire or look it up in the dnlc,
2216 	 * just need to check access.
2217 	 */
2218 	} else if (strcmp(nm, ".") == 0) {
2219 		error = nfs3_access(dvp, VEXEC, 0, cr, ct);
2220 		if (error) {
2221 			nfs_rw_exit(&drp->r_rwlock);
2222 			return (error);
2223 		}
2224 		VN_HOLD(dvp);
2225 		vp = dvp;
2226 	/*
2227 	 * We need to go over the wire, just to be sure whether the
2228 	 * file exists or not.  Using the DNLC can be dangerous in
2229 	 * this case when making a decision regarding existence.
2230 	 */
2231 	} else {
2232 		error = nfs3lookup_otw(dvp, nm, &vp, cr, 0);
2233 	}
2234 	if (!error) {
2235 		if (exclusive == EXCL)
2236 			error = EEXIST;
2237 		else if (vp->v_type == VDIR && (mode & VWRITE))
2238 			error = EISDIR;
2239 		else {
2240 			/*
2241 			 * If vnode is a device, create special vnode.
2242 			 */
2243 			if (IS_DEVVP(vp)) {
2244 				tempvp = vp;
2245 				vp = specvp(vp, vp->v_rdev, vp->v_type, cr);
2246 				VN_RELE(tempvp);
2247 			}
2248 			if (!(error = VOP_ACCESS(vp, mode, 0, cr, ct))) {
2249 				if ((vattr.va_mask & AT_SIZE) &&
2250 				    vp->v_type == VREG) {
2251 					rp = VTOR(vp);
2252 					/*
2253 					 * Check here for large file handled
2254 					 * by LF-unaware process (as
2255 					 * ufs_create() does)
2256 					 */
2257 					if (!(lfaware & FOFFMAX)) {
2258 						mutex_enter(&rp->r_statelock);
2259 						if (rp->r_size > MAXOFF32_T)
2260 							error = EOVERFLOW;
2261 						mutex_exit(&rp->r_statelock);
2262 					}
2263 					if (!error) {
2264 						vattr.va_mask = AT_SIZE;
2265 						error = nfs3setattr(vp,
2266 						    &vattr, 0, cr);
2267 					}
2268 				}
2269 			}
2270 		}
2271 		nfs_rw_exit(&drp->r_rwlock);
2272 		if (error) {
2273 			VN_RELE(vp);
2274 		} else {
2275 			/*
2276 			 * existing file got truncated, notify.
2277 			 */
2278 			vnevent_create(vp, ct);
2279 			*vpp = vp;
2280 		}
2281 		return (error);
2282 	}
2283 
2284 	dnlc_remove(dvp, nm);
2285 
2286 	/*
2287 	 * Decide what the group-id of the created file should be.
2288 	 * Set it in attribute list as advisory...
2289 	 */
2290 	error = setdirgid(dvp, &vattr.va_gid, cr);
2291 	if (error) {
2292 		nfs_rw_exit(&drp->r_rwlock);
2293 		return (error);
2294 	}
2295 	vattr.va_mask |= AT_GID;
2296 
2297 	ASSERT(vattr.va_mask & AT_TYPE);
2298 	if (vattr.va_type == VREG) {
2299 		ASSERT(vattr.va_mask & AT_MODE);
2300 		if (MANDMODE(vattr.va_mode)) {
2301 			nfs_rw_exit(&drp->r_rwlock);
2302 			return (EACCES);
2303 		}
2304 		error = nfs3create(dvp, nm, &vattr, exclusive, mode, vpp, cr,
2305 		    lfaware);
2306 		/*
2307 		 * If this is not an exclusive create, then the CREATE
2308 		 * request will be made with the GUARDED mode set.  This
2309 		 * means that the server will return EEXIST if the file
2310 		 * exists.  The file could exist because of a retransmitted
2311 		 * request.  In this case, we recover by starting over and
2312 		 * checking to see whether the file exists.  This second
2313 		 * time through it should and a CREATE request will not be
2314 		 * sent.
2315 		 *
2316 		 * This handles the problem of a dangling CREATE request
2317 		 * which contains attributes which indicate that the file
2318 		 * should be truncated.  This retransmitted request could
2319 		 * possibly truncate valid data in the file if not caught
2320 		 * by the duplicate request mechanism on the server or if
2321 		 * not caught by other means.  The scenario is:
2322 		 *
2323 		 * Client transmits CREATE request with size = 0
2324 		 * Client times out, retransmits request.
2325 		 * Response to the first request arrives from the server
2326 		 *  and the client proceeds on.
2327 		 * Client writes data to the file.
2328 		 * The server now processes retransmitted CREATE request
2329 		 *  and truncates file.
2330 		 *
2331 		 * The use of the GUARDED CREATE request prevents this from
2332 		 * happening because the retransmitted CREATE would fail
2333 		 * with EEXIST and would not truncate the file.
2334 		 */
2335 		if (error == EEXIST && exclusive == NONEXCL) {
2336 #ifdef DEBUG
2337 			nfs3_create_misses++;
2338 #endif
2339 			goto top;
2340 		}
2341 		nfs_rw_exit(&drp->r_rwlock);
2342 		return (error);
2343 	}
2344 	error = nfs3mknod(dvp, nm, &vattr, exclusive, mode, vpp, cr);
2345 	nfs_rw_exit(&drp->r_rwlock);
2346 	return (error);
2347 }
2348 
2349 /* ARGSUSED */
2350 static int
2351 nfs3create(vnode_t *dvp, char *nm, struct vattr *va, enum vcexcl exclusive,
2352 	int mode, vnode_t **vpp, cred_t *cr, int lfaware)
2353 {
2354 	int error;
2355 	CREATE3args args;
2356 	CREATE3res res;
2357 	int douprintf;
2358 	vnode_t *vp;
2359 	struct vattr vattr;
2360 	nfstime3 *verfp;
2361 	rnode_t *rp;
2362 	timestruc_t now;
2363 	hrtime_t t;
2364 
2365 	ASSERT(nfs_zone() == VTOMI(dvp)->mi_zone);
2366 	setdiropargs3(&args.where, nm, dvp);
2367 	if (exclusive == EXCL) {
2368 		args.how.mode = EXCLUSIVE;
2369 		/*
2370 		 * Construct the create verifier.  This verifier needs
2371 		 * to be unique between different clients.  It also needs
2372 		 * to vary for each exclusive create request generated
2373 		 * from the client to the server.
2374 		 *
2375 		 * The first attempt is made to use the hostid and a
2376 		 * unique number on the client.  If the hostid has not
2377 		 * been set, the high resolution time that the exclusive
2378 		 * create request is being made is used.  This will work
2379 		 * unless two different clients, both with the hostid
2380 		 * not set, attempt an exclusive create request on the
2381 		 * same file, at exactly the same clock time.  The
2382 		 * chances of this happening seem small enough to be
2383 		 * reasonable.
2384 		 */
2385 		verfp = (nfstime3 *)&args.how.createhow3_u.verf;
2386 		verfp->seconds = nfs_atoi(hw_serial);
2387 		if (verfp->seconds != 0)
2388 			verfp->nseconds = newnum();
2389 		else {
2390 			gethrestime(&now);
2391 			verfp->seconds = now.tv_sec;
2392 			verfp->nseconds = now.tv_nsec;
2393 		}
2394 		/*
2395 		 * Since the server will use this value for the mtime,
2396 		 * make sure that it can't overflow. Zero out the MSB.
2397 		 * The actual value does not matter here, only its uniqeness.
2398 		 */
2399 		verfp->seconds %= INT32_MAX;
2400 	} else {
2401 		/*
2402 		 * Issue the non-exclusive create in guarded mode.  This
2403 		 * may result in some false EEXIST responses for
2404 		 * retransmitted requests, but these will be handled at
2405 		 * a higher level.  By using GUARDED, duplicate requests
2406 		 * to do file truncation and possible access problems
2407 		 * can be avoided.
2408 		 */
2409 		args.how.mode = GUARDED;
2410 		error = vattr_to_sattr3(va,
2411 		    &args.how.createhow3_u.obj_attributes);
2412 		if (error) {
2413 			/* req time field(s) overflow - return immediately */
2414 			return (error);
2415 		}
2416 	}
2417 
2418 	douprintf = 1;
2419 
2420 	t = gethrtime();
2421 
2422 	error = rfs3call(VTOMI(dvp), NFSPROC3_CREATE,
2423 	    xdr_CREATE3args, (caddr_t)&args,
2424 	    xdr_CREATE3res, (caddr_t)&res, cr,
2425 	    &douprintf, &res.status, 0, NULL);
2426 
2427 	if (error) {
2428 		PURGE_ATTRCACHE(dvp);
2429 		return (error);
2430 	}
2431 
2432 	error = geterrno3(res.status);
2433 	if (!error) {
2434 		nfs3_cache_wcc_data(dvp, &res.resok.dir_wcc, t, cr);
2435 		if (HAVE_RDDIR_CACHE(VTOR(dvp)))
2436 			nfs_purge_rddir_cache(dvp);
2437 
2438 		/*
2439 		 * On exclusive create the times need to be explicitly
2440 		 * set to clear any potential verifier that may be stored
2441 		 * in one of these fields (see comment below).  This
2442 		 * is done here to cover the case where no post op attrs
2443 		 * were returned or a 'invalid' time was returned in
2444 		 * the attributes.
2445 		 */
2446 		if (exclusive == EXCL)
2447 			va->va_mask |= (AT_MTIME | AT_ATIME);
2448 
2449 		if (!res.resok.obj.handle_follows) {
2450 			error = nfs3lookup(dvp, nm, &vp, NULL, 0, NULL, cr, 0);
2451 			if (error)
2452 				return (error);
2453 		} else {
2454 			if (res.resok.obj_attributes.attributes) {
2455 				vp = makenfs3node(&res.resok.obj.handle,
2456 				    &res.resok.obj_attributes.attr,
2457 				    dvp->v_vfsp, t, cr, NULL, NULL);
2458 			} else {
2459 				vp = makenfs3node(&res.resok.obj.handle, NULL,
2460 				    dvp->v_vfsp, t, cr, NULL, NULL);
2461 
2462 				/*
2463 				 * On an exclusive create, it is possible
2464 				 * that attributes were returned but those
2465 				 * postop attributes failed to decode
2466 				 * properly.  If this is the case,
2467 				 * then most likely the atime or mtime
2468 				 * were invalid for our client; this
2469 				 * is caused by the server storing the
2470 				 * create verifier in one of the time
2471 				 * fields(most likely mtime).
2472 				 * So... we are going to setattr just the
2473 				 * atime/mtime to clear things up.
2474 				 */
2475 				if (exclusive == EXCL) {
2476 					if (error =
2477 					    nfs3excl_create_settimes(vp,
2478 					    va, cr)) {
2479 						/*
2480 						 * Setting the times failed.
2481 						 * Remove the file and return
2482 						 * the error.
2483 						 */
2484 						VN_RELE(vp);
2485 						(void) nfs3_remove(dvp,
2486 						    nm, cr, NULL, 0);
2487 						return (error);
2488 					}
2489 				}
2490 
2491 				/*
2492 				 * This handles the non-exclusive case
2493 				 * and the exclusive case where no post op
2494 				 * attrs were returned.
2495 				 */
2496 				if (vp->v_type == VNON) {
2497 					vattr.va_mask = AT_TYPE;
2498 					error = nfs3getattr(vp, &vattr, cr);
2499 					if (error) {
2500 						VN_RELE(vp);
2501 						return (error);
2502 					}
2503 					vp->v_type = vattr.va_type;
2504 				}
2505 			}
2506 			dnlc_update(dvp, nm, vp);
2507 		}
2508 
2509 		rp = VTOR(vp);
2510 
2511 		/*
2512 		 * Check here for large file handled by
2513 		 * LF-unaware process (as ufs_create() does)
2514 		 */
2515 		if ((va->va_mask & AT_SIZE) && vp->v_type == VREG &&
2516 		    !(lfaware & FOFFMAX)) {
2517 			mutex_enter(&rp->r_statelock);
2518 			if (rp->r_size > MAXOFF32_T) {
2519 				mutex_exit(&rp->r_statelock);
2520 				VN_RELE(vp);
2521 				return (EOVERFLOW);
2522 			}
2523 			mutex_exit(&rp->r_statelock);
2524 		}
2525 
2526 		if (exclusive == EXCL &&
2527 		    (va->va_mask & ~(AT_GID | AT_SIZE))) {
2528 			/*
2529 			 * If doing an exclusive create, then generate
2530 			 * a SETATTR to set the initial attributes.
2531 			 * Try to set the mtime and the atime to the
2532 			 * server's current time.  It is somewhat
2533 			 * expected that these fields will be used to
2534 			 * store the exclusive create cookie.  If not,
2535 			 * server implementors will need to know that
2536 			 * a SETATTR will follow an exclusive create
2537 			 * and the cookie should be destroyed if
2538 			 * appropriate. This work may have been done
2539 			 * earlier in this function if post op attrs
2540 			 * were not available.
2541 			 *
2542 			 * The AT_GID and AT_SIZE bits are turned off
2543 			 * so that the SETATTR request will not attempt
2544 			 * to process these.  The gid will be set
2545 			 * separately if appropriate.  The size is turned
2546 			 * off because it is assumed that a new file will
2547 			 * be created empty and if the file wasn't empty,
2548 			 * then the exclusive create will have failed
2549 			 * because the file must have existed already.
2550 			 * Therefore, no truncate operation is needed.
2551 			 */
2552 			va->va_mask &= ~(AT_GID | AT_SIZE);
2553 			error = nfs3setattr(vp, va, 0, cr);
2554 			if (error) {
2555 				/*
2556 				 * Couldn't correct the attributes of
2557 				 * the newly created file and the
2558 				 * attributes are wrong.  Remove the
2559 				 * file and return an error to the
2560 				 * application.
2561 				 */
2562 				VN_RELE(vp);
2563 				(void) nfs3_remove(dvp, nm, cr, NULL, 0);
2564 				return (error);
2565 			}
2566 		}
2567 
2568 		if (va->va_gid != rp->r_attr.va_gid) {
2569 			/*
2570 			 * If the gid on the file isn't right, then
2571 			 * generate a SETATTR to attempt to change
2572 			 * it.  This may or may not work, depending
2573 			 * upon the server's semantics for allowing
2574 			 * file ownership changes.
2575 			 */
2576 			va->va_mask = AT_GID;
2577 			(void) nfs3setattr(vp, va, 0, cr);
2578 		}
2579 
2580 		/*
2581 		 * If vnode is a device create special vnode
2582 		 */
2583 		if (IS_DEVVP(vp)) {
2584 			*vpp = specvp(vp, vp->v_rdev, vp->v_type, cr);
2585 			VN_RELE(vp);
2586 		} else
2587 			*vpp = vp;
2588 	} else {
2589 		nfs3_cache_wcc_data(dvp, &res.resfail.dir_wcc, t, cr);
2590 		PURGE_STALE_FH(error, dvp, cr);
2591 	}
2592 
2593 	return (error);
2594 }
2595 
2596 /*
2597  * Special setattr function to take care of rest of atime/mtime
2598  * after successful exclusive create.  This function exists to avoid
2599  * handling attributes from the server; exclusive the atime/mtime fields
2600  * may be 'invalid' in client's view and therefore can not be trusted.
2601  */
2602 static int
2603 nfs3excl_create_settimes(vnode_t *vp, struct vattr *vap, cred_t *cr)
2604 {
2605 	int error;
2606 	uint_t mask;
2607 	SETATTR3args args;
2608 	SETATTR3res res;
2609 	int douprintf;
2610 	rnode_t *rp;
2611 	hrtime_t t;
2612 
2613 	ASSERT(nfs_zone() == VTOMI(vp)->mi_zone);
2614 	/* save the caller's mask so that it can be reset later */
2615 	mask = vap->va_mask;
2616 
2617 	rp = VTOR(vp);
2618 
2619 	args.object = *RTOFH3(rp);
2620 	args.guard.check = FALSE;
2621 
2622 	/* Use the mask to initialize the arguments */
2623 	vap->va_mask = 0;
2624 	error = vattr_to_sattr3(vap, &args.new_attributes);
2625 
2626 	/* We want to set just atime/mtime on this request */
2627 	args.new_attributes.atime.set_it = SET_TO_SERVER_TIME;
2628 	args.new_attributes.mtime.set_it = SET_TO_SERVER_TIME;
2629 
2630 	douprintf = 1;
2631 
2632 	t = gethrtime();
2633 
2634 	error = rfs3call(VTOMI(vp), NFSPROC3_SETATTR,
2635 	    xdr_SETATTR3args, (caddr_t)&args,
2636 	    xdr_SETATTR3res, (caddr_t)&res, cr,
2637 	    &douprintf, &res.status, 0, NULL);
2638 
2639 	if (error) {
2640 		vap->va_mask = mask;
2641 		return (error);
2642 	}
2643 
2644 	error = geterrno3(res.status);
2645 	if (!error) {
2646 		/*
2647 		 * It is important to pick up the attributes.
2648 		 * Since this is the exclusive create path, the
2649 		 * attributes on the initial create were ignored
2650 		 * and we need these to have the correct info.
2651 		 */
2652 		nfs3_cache_wcc_data(vp, &res.resok.obj_wcc, t, cr);
2653 		/*
2654 		 * No need to do the atime/mtime work again so clear
2655 		 * the bits.
2656 		 */
2657 		mask &= ~(AT_ATIME | AT_MTIME);
2658 	} else {
2659 		nfs3_cache_wcc_data(vp, &res.resfail.obj_wcc, t, cr);
2660 	}
2661 
2662 	vap->va_mask = mask;
2663 
2664 	return (error);
2665 }
2666 
2667 /* ARGSUSED */
2668 static int
2669 nfs3mknod(vnode_t *dvp, char *nm, struct vattr *va, enum vcexcl exclusive,
2670 	int mode, vnode_t **vpp, cred_t *cr)
2671 {
2672 	int error;
2673 	MKNOD3args args;
2674 	MKNOD3res res;
2675 	int douprintf;
2676 	vnode_t *vp;
2677 	struct vattr vattr;
2678 	hrtime_t t;
2679 
2680 	ASSERT(nfs_zone() == VTOMI(dvp)->mi_zone);
2681 	switch (va->va_type) {
2682 	case VCHR:
2683 	case VBLK:
2684 		setdiropargs3(&args.where, nm, dvp);
2685 		args.what.type = (va->va_type == VCHR) ? NF3CHR : NF3BLK;
2686 		error = vattr_to_sattr3(va,
2687 		    &args.what.mknoddata3_u.device.dev_attributes);
2688 		if (error) {
2689 			/* req time field(s) overflow - return immediately */
2690 			return (error);
2691 		}
2692 		args.what.mknoddata3_u.device.spec.specdata1 =
2693 		    getmajor(va->va_rdev);
2694 		args.what.mknoddata3_u.device.spec.specdata2 =
2695 		    getminor(va->va_rdev);
2696 		break;
2697 
2698 	case VFIFO:
2699 	case VSOCK:
2700 		setdiropargs3(&args.where, nm, dvp);
2701 		args.what.type = (va->va_type == VFIFO) ? NF3FIFO : NF3SOCK;
2702 		error = vattr_to_sattr3(va,
2703 		    &args.what.mknoddata3_u.pipe_attributes);
2704 		if (error) {
2705 			/* req time field(s) overflow - return immediately */
2706 			return (error);
2707 		}
2708 		break;
2709 
2710 	default:
2711 		return (EINVAL);
2712 	}
2713 
2714 	douprintf = 1;
2715 
2716 	t = gethrtime();
2717 
2718 	error = rfs3call(VTOMI(dvp), NFSPROC3_MKNOD,
2719 	    xdr_MKNOD3args, (caddr_t)&args,
2720 	    xdr_MKNOD3res, (caddr_t)&res, cr,
2721 	    &douprintf, &res.status, 0, NULL);
2722 
2723 	if (error) {
2724 		PURGE_ATTRCACHE(dvp);
2725 		return (error);
2726 	}
2727 
2728 	error = geterrno3(res.status);
2729 	if (!error) {
2730 		nfs3_cache_wcc_data(dvp, &res.resok.dir_wcc, t, cr);
2731 		if (HAVE_RDDIR_CACHE(VTOR(dvp)))
2732 			nfs_purge_rddir_cache(dvp);
2733 
2734 		if (!res.resok.obj.handle_follows) {
2735 			error = nfs3lookup(dvp, nm, &vp, NULL, 0, NULL, cr, 0);
2736 			if (error)
2737 				return (error);
2738 		} else {
2739 			if (res.resok.obj_attributes.attributes) {
2740 				vp = makenfs3node(&res.resok.obj.handle,
2741 				    &res.resok.obj_attributes.attr,
2742 				    dvp->v_vfsp, t, cr, NULL, NULL);
2743 			} else {
2744 				vp = makenfs3node(&res.resok.obj.handle, NULL,
2745 				    dvp->v_vfsp, t, cr, NULL, NULL);
2746 				if (vp->v_type == VNON) {
2747 					vattr.va_mask = AT_TYPE;
2748 					error = nfs3getattr(vp, &vattr, cr);
2749 					if (error) {
2750 						VN_RELE(vp);
2751 						return (error);
2752 					}
2753 					vp->v_type = vattr.va_type;
2754 				}
2755 
2756 			}
2757 			dnlc_update(dvp, nm, vp);
2758 		}
2759 
2760 		if (va->va_gid != VTOR(vp)->r_attr.va_gid) {
2761 			va->va_mask = AT_GID;
2762 			(void) nfs3setattr(vp, va, 0, cr);
2763 		}
2764 
2765 		/*
2766 		 * If vnode is a device create special vnode
2767 		 */
2768 		if (IS_DEVVP(vp)) {
2769 			*vpp = specvp(vp, vp->v_rdev, vp->v_type, cr);
2770 			VN_RELE(vp);
2771 		} else
2772 			*vpp = vp;
2773 	} else {
2774 		nfs3_cache_wcc_data(dvp, &res.resfail.dir_wcc, t, cr);
2775 		PURGE_STALE_FH(error, dvp, cr);
2776 	}
2777 	return (error);
2778 }
2779 
2780 /*
2781  * Weirdness: if the vnode to be removed is open
2782  * we rename it instead of removing it and nfs_inactive
2783  * will remove the new name.
2784  */
2785 /* ARGSUSED */
2786 static int
2787 nfs3_remove(vnode_t *dvp, char *nm, cred_t *cr, caller_context_t *ct, int flags)
2788 {
2789 	int error;
2790 	REMOVE3args args;
2791 	REMOVE3res res;
2792 	vnode_t *vp;
2793 	char *tmpname;
2794 	int douprintf;
2795 	rnode_t *rp;
2796 	rnode_t *drp;
2797 	hrtime_t t;
2798 
2799 	if (nfs_zone() != VTOMI(dvp)->mi_zone)
2800 		return (EPERM);
2801 	drp = VTOR(dvp);
2802 	if (nfs_rw_enter_sig(&drp->r_rwlock, RW_WRITER, INTR(dvp)))
2803 		return (EINTR);
2804 
2805 	error = nfs3lookup(dvp, nm, &vp, NULL, 0, NULL, cr, 0);
2806 	if (error) {
2807 		nfs_rw_exit(&drp->r_rwlock);
2808 		return (error);
2809 	}
2810 
2811 	if (vp->v_type == VDIR && secpolicy_fs_linkdir(cr, dvp->v_vfsp)) {
2812 		VN_RELE(vp);
2813 		nfs_rw_exit(&drp->r_rwlock);
2814 		return (EPERM);
2815 	}
2816 
2817 	/*
2818 	 * First just remove the entry from the name cache, as it
2819 	 * is most likely the only entry for this vp.
2820 	 */
2821 	dnlc_remove(dvp, nm);
2822 
2823 	/*
2824 	 * If the file has a v_count > 1 then there may be more than one
2825 	 * entry in the name cache due multiple links or an open file,
2826 	 * but we don't have the real reference count so flush all
2827 	 * possible entries.
2828 	 */
2829 	if (vp->v_count > 1)
2830 		dnlc_purge_vp(vp);
2831 
2832 	/*
2833 	 * Now we have the real reference count on the vnode
2834 	 */
2835 	rp = VTOR(vp);
2836 	mutex_enter(&rp->r_statelock);
2837 	if (vp->v_count > 1 &&
2838 	    (rp->r_unldvp == NULL || strcmp(nm, rp->r_unlname) == 0)) {
2839 		mutex_exit(&rp->r_statelock);
2840 		tmpname = newname();
2841 		error = nfs3rename(dvp, nm, dvp, tmpname, cr, ct);
2842 		if (error)
2843 			kmem_free(tmpname, MAXNAMELEN);
2844 		else {
2845 			mutex_enter(&rp->r_statelock);
2846 			if (rp->r_unldvp == NULL) {
2847 				VN_HOLD(dvp);
2848 				rp->r_unldvp = dvp;
2849 				if (rp->r_unlcred != NULL)
2850 					crfree(rp->r_unlcred);
2851 				crhold(cr);
2852 				rp->r_unlcred = cr;
2853 				rp->r_unlname = tmpname;
2854 			} else {
2855 				kmem_free(rp->r_unlname, MAXNAMELEN);
2856 				rp->r_unlname = tmpname;
2857 			}
2858 			mutex_exit(&rp->r_statelock);
2859 		}
2860 	} else {
2861 		mutex_exit(&rp->r_statelock);
2862 		/*
2863 		 * We need to flush any dirty pages which happen to
2864 		 * be hanging around before removing the file.  This
2865 		 * shouldn't happen very often and mostly on file
2866 		 * systems mounted "nocto".
2867 		 */
2868 		if (vn_has_cached_data(vp) &&
2869 		    ((rp->r_flags & RDIRTY) || rp->r_count > 0)) {
2870 			error = nfs3_putpage(vp, (offset_t)0, 0, 0, cr, ct);
2871 			if (error && (error == ENOSPC || error == EDQUOT)) {
2872 				mutex_enter(&rp->r_statelock);
2873 				if (!rp->r_error)
2874 					rp->r_error = error;
2875 				mutex_exit(&rp->r_statelock);
2876 			}
2877 		}
2878 
2879 		setdiropargs3(&args.object, nm, dvp);
2880 
2881 		douprintf = 1;
2882 
2883 		t = gethrtime();
2884 
2885 		error = rfs3call(VTOMI(dvp), NFSPROC3_REMOVE,
2886 		    xdr_diropargs3, (caddr_t)&args,
2887 		    xdr_REMOVE3res, (caddr_t)&res, cr,
2888 		    &douprintf, &res.status, 0, NULL);
2889 
2890 		/*
2891 		 * The xattr dir may be gone after last attr is removed,
2892 		 * so flush it from dnlc.
2893 		 */
2894 		if (dvp->v_flag & V_XATTRDIR)
2895 			dnlc_purge_vp(dvp);
2896 
2897 		PURGE_ATTRCACHE(vp);
2898 
2899 		if (error) {
2900 			PURGE_ATTRCACHE(dvp);
2901 		} else {
2902 			error = geterrno3(res.status);
2903 			if (!error) {
2904 				nfs3_cache_wcc_data(dvp, &res.resok.dir_wcc, t,
2905 				    cr);
2906 				if (HAVE_RDDIR_CACHE(drp))
2907 					nfs_purge_rddir_cache(dvp);
2908 			} else {
2909 				nfs3_cache_wcc_data(dvp, &res.resfail.dir_wcc,
2910 				    t, cr);
2911 				PURGE_STALE_FH(error, dvp, cr);
2912 			}
2913 		}
2914 	}
2915 
2916 	if (error == 0) {
2917 		vnevent_remove(vp, dvp, nm, ct);
2918 	}
2919 	VN_RELE(vp);
2920 
2921 	nfs_rw_exit(&drp->r_rwlock);
2922 
2923 	return (error);
2924 }
2925 
2926 /* ARGSUSED */
2927 static int
2928 nfs3_link(vnode_t *tdvp, vnode_t *svp, char *tnm, cred_t *cr,
2929 	caller_context_t *ct, int flags)
2930 {
2931 	int error;
2932 	LINK3args args;
2933 	LINK3res res;
2934 	vnode_t *realvp;
2935 	int douprintf;
2936 	mntinfo_t *mi;
2937 	rnode_t *tdrp;
2938 	hrtime_t t;
2939 
2940 	if (nfs_zone() != VTOMI(tdvp)->mi_zone)
2941 		return (EPERM);
2942 	if (VOP_REALVP(svp, &realvp, ct) == 0)
2943 		svp = realvp;
2944 
2945 	mi = VTOMI(svp);
2946 
2947 	if (!(mi->mi_flags & MI_LINK))
2948 		return (EOPNOTSUPP);
2949 
2950 	args.file = *VTOFH3(svp);
2951 	setdiropargs3(&args.link, tnm, tdvp);
2952 
2953 	tdrp = VTOR(tdvp);
2954 	if (nfs_rw_enter_sig(&tdrp->r_rwlock, RW_WRITER, INTR(tdvp)))
2955 		return (EINTR);
2956 
2957 	dnlc_remove(tdvp, tnm);
2958 
2959 	douprintf = 1;
2960 
2961 	t = gethrtime();
2962 
2963 	error = rfs3call(mi, NFSPROC3_LINK,
2964 	    xdr_LINK3args, (caddr_t)&args,
2965 	    xdr_LINK3res, (caddr_t)&res, cr,
2966 	    &douprintf, &res.status, 0, NULL);
2967 
2968 	if (error) {
2969 		PURGE_ATTRCACHE(tdvp);
2970 		PURGE_ATTRCACHE(svp);
2971 		nfs_rw_exit(&tdrp->r_rwlock);
2972 		return (error);
2973 	}
2974 
2975 	error = geterrno3(res.status);
2976 
2977 	if (!error) {
2978 		nfs3_cache_post_op_attr(svp, &res.resok.file_attributes, t, cr);
2979 		nfs3_cache_wcc_data(tdvp, &res.resok.linkdir_wcc, t, cr);
2980 		if (HAVE_RDDIR_CACHE(tdrp))
2981 			nfs_purge_rddir_cache(tdvp);
2982 		dnlc_update(tdvp, tnm, svp);
2983 	} else {
2984 		nfs3_cache_post_op_attr(svp, &res.resfail.file_attributes, t,
2985 		    cr);
2986 		nfs3_cache_wcc_data(tdvp, &res.resfail.linkdir_wcc, t, cr);
2987 		if (error == EOPNOTSUPP) {
2988 			mutex_enter(&mi->mi_lock);
2989 			mi->mi_flags &= ~MI_LINK;
2990 			mutex_exit(&mi->mi_lock);
2991 		}
2992 	}
2993 
2994 	nfs_rw_exit(&tdrp->r_rwlock);
2995 
2996 	if (!error) {
2997 		/*
2998 		 * Notify the source file of this link operation.
2999 		 */
3000 		vnevent_link(svp, ct);
3001 	}
3002 	return (error);
3003 }
3004 
3005 /* ARGSUSED */
3006 static int
3007 nfs3_rename(vnode_t *odvp, char *onm, vnode_t *ndvp, char *nnm, cred_t *cr,
3008 	caller_context_t *ct, int flags)
3009 {
3010 	vnode_t *realvp;
3011 
3012 	if (nfs_zone() != VTOMI(odvp)->mi_zone)
3013 		return (EPERM);
3014 	if (VOP_REALVP(ndvp, &realvp, ct) == 0)
3015 		ndvp = realvp;
3016 
3017 	return (nfs3rename(odvp, onm, ndvp, nnm, cr, ct));
3018 }
3019 
3020 /*
3021  * nfs3rename does the real work of renaming in NFS Version 3.
3022  */
3023 static int
3024 nfs3rename(vnode_t *odvp, char *onm, vnode_t *ndvp, char *nnm, cred_t *cr,
3025     caller_context_t *ct)
3026 {
3027 	int error;
3028 	RENAME3args args;
3029 	RENAME3res res;
3030 	int douprintf;
3031 	vnode_t *nvp = NULL;
3032 	vnode_t *ovp = NULL;
3033 	char *tmpname;
3034 	rnode_t *rp;
3035 	rnode_t *odrp;
3036 	rnode_t *ndrp;
3037 	hrtime_t t;
3038 
3039 	ASSERT(nfs_zone() == VTOMI(odvp)->mi_zone);
3040 
3041 	if (strcmp(onm, ".") == 0 || strcmp(onm, "..") == 0 ||
3042 	    strcmp(nnm, ".") == 0 || strcmp(nnm, "..") == 0)
3043 		return (EINVAL);
3044 
3045 	odrp = VTOR(odvp);
3046 	ndrp = VTOR(ndvp);
3047 	if ((intptr_t)odrp < (intptr_t)ndrp) {
3048 		if (nfs_rw_enter_sig(&odrp->r_rwlock, RW_WRITER, INTR(odvp)))
3049 			return (EINTR);
3050 		if (nfs_rw_enter_sig(&ndrp->r_rwlock, RW_WRITER, INTR(ndvp))) {
3051 			nfs_rw_exit(&odrp->r_rwlock);
3052 			return (EINTR);
3053 		}
3054 	} else {
3055 		if (nfs_rw_enter_sig(&ndrp->r_rwlock, RW_WRITER, INTR(ndvp)))
3056 			return (EINTR);
3057 		if (nfs_rw_enter_sig(&odrp->r_rwlock, RW_WRITER, INTR(odvp))) {
3058 			nfs_rw_exit(&ndrp->r_rwlock);
3059 			return (EINTR);
3060 		}
3061 	}
3062 
3063 	/*
3064 	 * Lookup the target file.  If it exists, it needs to be
3065 	 * checked to see whether it is a mount point and whether
3066 	 * it is active (open).
3067 	 */
3068 	error = nfs3lookup(ndvp, nnm, &nvp, NULL, 0, NULL, cr, 0);
3069 	if (!error) {
3070 		/*
3071 		 * If this file has been mounted on, then just
3072 		 * return busy because renaming to it would remove
3073 		 * the mounted file system from the name space.
3074 		 */
3075 		if (vn_mountedvfs(nvp) != NULL) {
3076 			VN_RELE(nvp);
3077 			nfs_rw_exit(&odrp->r_rwlock);
3078 			nfs_rw_exit(&ndrp->r_rwlock);
3079 			return (EBUSY);
3080 		}
3081 
3082 		/*
3083 		 * Purge the name cache of all references to this vnode
3084 		 * so that we can check the reference count to infer
3085 		 * whether it is active or not.
3086 		 */
3087 		/*
3088 		 * First just remove the entry from the name cache, as it
3089 		 * is most likely the only entry for this vp.
3090 		 */
3091 		dnlc_remove(ndvp, nnm);
3092 		/*
3093 		 * If the file has a v_count > 1 then there may be more
3094 		 * than one entry in the name cache due multiple links
3095 		 * or an open file, but we don't have the real reference
3096 		 * count so flush all possible entries.
3097 		 */
3098 		if (nvp->v_count > 1)
3099 			dnlc_purge_vp(nvp);
3100 
3101 		/*
3102 		 * If the vnode is active and is not a directory,
3103 		 * arrange to rename it to a
3104 		 * temporary file so that it will continue to be
3105 		 * accessible.  This implements the "unlink-open-file"
3106 		 * semantics for the target of a rename operation.
3107 		 * Before doing this though, make sure that the
3108 		 * source and target files are not already the same.
3109 		 */
3110 		if (nvp->v_count > 1 && nvp->v_type != VDIR) {
3111 			/*
3112 			 * Lookup the source name.
3113 			 */
3114 			error = nfs3lookup(odvp, onm, &ovp, NULL, 0, NULL,
3115 			    cr, 0);
3116 
3117 			/*
3118 			 * The source name *should* already exist.
3119 			 */
3120 			if (error) {
3121 				VN_RELE(nvp);
3122 				nfs_rw_exit(&odrp->r_rwlock);
3123 				nfs_rw_exit(&ndrp->r_rwlock);
3124 				return (error);
3125 			}
3126 
3127 			/*
3128 			 * Compare the two vnodes.  If they are the same,
3129 			 * just release all held vnodes and return success.
3130 			 */
3131 			if (ovp == nvp) {
3132 				VN_RELE(ovp);
3133 				VN_RELE(nvp);
3134 				nfs_rw_exit(&odrp->r_rwlock);
3135 				nfs_rw_exit(&ndrp->r_rwlock);
3136 				return (0);
3137 			}
3138 
3139 			/*
3140 			 * Can't mix and match directories and non-
3141 			 * directories in rename operations.  We already
3142 			 * know that the target is not a directory.  If
3143 			 * the source is a directory, return an error.
3144 			 */
3145 			if (ovp->v_type == VDIR) {
3146 				VN_RELE(ovp);
3147 				VN_RELE(nvp);
3148 				nfs_rw_exit(&odrp->r_rwlock);
3149 				nfs_rw_exit(&ndrp->r_rwlock);
3150 				return (ENOTDIR);
3151 			}
3152 
3153 			/*
3154 			 * The target file exists, is not the same as
3155 			 * the source file, and is active.  Link it
3156 			 * to a temporary filename to avoid having
3157 			 * the server removing the file completely.
3158 			 */
3159 			tmpname = newname();
3160 			error = nfs3_link(ndvp, nvp, tmpname, cr, NULL, 0);
3161 			if (error == EOPNOTSUPP) {
3162 				error = nfs3_rename(ndvp, nnm, ndvp, tmpname,
3163 				    cr, NULL, 0);
3164 			}
3165 			if (error) {
3166 				kmem_free(tmpname, MAXNAMELEN);
3167 				VN_RELE(ovp);
3168 				VN_RELE(nvp);
3169 				nfs_rw_exit(&odrp->r_rwlock);
3170 				nfs_rw_exit(&ndrp->r_rwlock);
3171 				return (error);
3172 			}
3173 			rp = VTOR(nvp);
3174 			mutex_enter(&rp->r_statelock);
3175 			if (rp->r_unldvp == NULL) {
3176 				VN_HOLD(ndvp);
3177 				rp->r_unldvp = ndvp;
3178 				if (rp->r_unlcred != NULL)
3179 					crfree(rp->r_unlcred);
3180 				crhold(cr);
3181 				rp->r_unlcred = cr;
3182 				rp->r_unlname = tmpname;
3183 			} else {
3184 				kmem_free(rp->r_unlname, MAXNAMELEN);
3185 				rp->r_unlname = tmpname;
3186 			}
3187 			mutex_exit(&rp->r_statelock);
3188 		}
3189 	}
3190 
3191 	if (ovp == NULL) {
3192 		/*
3193 		 * When renaming directories to be a subdirectory of a
3194 		 * different parent, the dnlc entry for ".." will no
3195 		 * longer be valid, so it must be removed.
3196 		 *
3197 		 * We do a lookup here to determine whether we are renaming
3198 		 * a directory and we need to check if we are renaming
3199 		 * an unlinked file.  This might have already been done
3200 		 * in previous code, so we check ovp == NULL to avoid
3201 		 * doing it twice.
3202 		 */
3203 
3204 		error = nfs3lookup(odvp, onm, &ovp, NULL, 0, NULL, cr, 0);
3205 		/*
3206 		 * The source name *should* already exist.
3207 		 */
3208 		if (error) {
3209 			nfs_rw_exit(&odrp->r_rwlock);
3210 			nfs_rw_exit(&ndrp->r_rwlock);
3211 			if (nvp) {
3212 				VN_RELE(nvp);
3213 			}
3214 			return (error);
3215 		}
3216 		ASSERT(ovp != NULL);
3217 	}
3218 
3219 	dnlc_remove(odvp, onm);
3220 	dnlc_remove(ndvp, nnm);
3221 
3222 	setdiropargs3(&args.from, onm, odvp);
3223 	setdiropargs3(&args.to, nnm, ndvp);
3224 
3225 	douprintf = 1;
3226 
3227 	t = gethrtime();
3228 
3229 	error = rfs3call(VTOMI(odvp), NFSPROC3_RENAME,
3230 	    xdr_RENAME3args, (caddr_t)&args,
3231 	    xdr_RENAME3res, (caddr_t)&res, cr,
3232 	    &douprintf, &res.status, 0, NULL);
3233 
3234 	if (error) {
3235 		PURGE_ATTRCACHE(odvp);
3236 		PURGE_ATTRCACHE(ndvp);
3237 		VN_RELE(ovp);
3238 		nfs_rw_exit(&odrp->r_rwlock);
3239 		nfs_rw_exit(&ndrp->r_rwlock);
3240 		if (nvp) {
3241 			VN_RELE(nvp);
3242 		}
3243 		return (error);
3244 	}
3245 
3246 	error = geterrno3(res.status);
3247 
3248 	if (!error) {
3249 		nfs3_cache_wcc_data(odvp, &res.resok.fromdir_wcc, t, cr);
3250 		if (HAVE_RDDIR_CACHE(odrp))
3251 			nfs_purge_rddir_cache(odvp);
3252 		if (ndvp != odvp) {
3253 			nfs3_cache_wcc_data(ndvp, &res.resok.todir_wcc, t, cr);
3254 			if (HAVE_RDDIR_CACHE(ndrp))
3255 				nfs_purge_rddir_cache(ndvp);
3256 		}
3257 		/*
3258 		 * when renaming directories to be a subdirectory of a
3259 		 * different parent, the dnlc entry for ".." will no
3260 		 * longer be valid, so it must be removed
3261 		 */
3262 		rp = VTOR(ovp);
3263 		if (ndvp != odvp) {
3264 			if (ovp->v_type == VDIR) {
3265 				dnlc_remove(ovp, "..");
3266 				if (HAVE_RDDIR_CACHE(rp))
3267 					nfs_purge_rddir_cache(ovp);
3268 			}
3269 		}
3270 
3271 		/*
3272 		 * If we are renaming the unlinked file, update the
3273 		 * r_unldvp and r_unlname as needed.
3274 		 */
3275 		mutex_enter(&rp->r_statelock);
3276 		if (rp->r_unldvp != NULL) {
3277 			if (strcmp(rp->r_unlname, onm) == 0) {
3278 				(void) strncpy(rp->r_unlname, nnm, MAXNAMELEN);
3279 				rp->r_unlname[MAXNAMELEN - 1] = '\0';
3280 
3281 				if (ndvp != rp->r_unldvp) {
3282 					VN_RELE(rp->r_unldvp);
3283 					rp->r_unldvp = ndvp;
3284 					VN_HOLD(ndvp);
3285 				}
3286 			}
3287 		}
3288 		mutex_exit(&rp->r_statelock);
3289 	} else {
3290 		nfs3_cache_wcc_data(odvp, &res.resfail.fromdir_wcc, t, cr);
3291 		if (ndvp != odvp) {
3292 			nfs3_cache_wcc_data(ndvp, &res.resfail.todir_wcc, t,
3293 			    cr);
3294 		}
3295 		/*
3296 		 * System V defines rename to return EEXIST, not
3297 		 * ENOTEMPTY if the target directory is not empty.
3298 		 * Over the wire, the error is NFSERR_ENOTEMPTY
3299 		 * which geterrno maps to ENOTEMPTY.
3300 		 */
3301 		if (error == ENOTEMPTY)
3302 			error = EEXIST;
3303 	}
3304 
3305 	if (error == 0) {
3306 		if (nvp)
3307 			vnevent_rename_dest(nvp, ndvp, nnm, ct);
3308 
3309 		if (odvp != ndvp)
3310 			vnevent_rename_dest_dir(ndvp, ct);
3311 		ASSERT(ovp != NULL);
3312 		vnevent_rename_src(ovp, odvp, onm, ct);
3313 	}
3314 
3315 	if (nvp) {
3316 		VN_RELE(nvp);
3317 	}
3318 	VN_RELE(ovp);
3319 
3320 	nfs_rw_exit(&odrp->r_rwlock);
3321 	nfs_rw_exit(&ndrp->r_rwlock);
3322 
3323 	return (error);
3324 }
3325 
3326 /* ARGSUSED */
3327 static int
3328 nfs3_mkdir(vnode_t *dvp, char *nm, struct vattr *va, vnode_t **vpp, cred_t *cr,
3329 	caller_context_t *ct, int flags, vsecattr_t *vsecp)
3330 {
3331 	int error;
3332 	MKDIR3args args;
3333 	MKDIR3res res;
3334 	int douprintf;
3335 	struct vattr vattr;
3336 	vnode_t *vp;
3337 	rnode_t *drp;
3338 	hrtime_t t;
3339 
3340 	if (nfs_zone() != VTOMI(dvp)->mi_zone)
3341 		return (EPERM);
3342 	setdiropargs3(&args.where, nm, dvp);
3343 
3344 	/*
3345 	 * Decide what the group-id and set-gid bit of the created directory
3346 	 * should be.  May have to do a setattr to get the gid right.
3347 	 */
3348 	error = setdirgid(dvp, &va->va_gid, cr);
3349 	if (error)
3350 		return (error);
3351 	error = setdirmode(dvp, &va->va_mode, cr);
3352 	if (error)
3353 		return (error);
3354 	va->va_mask |= AT_MODE|AT_GID;
3355 
3356 	error = vattr_to_sattr3(va, &args.attributes);
3357 	if (error) {
3358 		/* req time field(s) overflow - return immediately */
3359 		return (error);
3360 	}
3361 
3362 	drp = VTOR(dvp);
3363 	if (nfs_rw_enter_sig(&drp->r_rwlock, RW_WRITER, INTR(dvp)))
3364 		return (EINTR);
3365 
3366 	dnlc_remove(dvp, nm);
3367 
3368 	douprintf = 1;
3369 
3370 	t = gethrtime();
3371 
3372 	error = rfs3call(VTOMI(dvp), NFSPROC3_MKDIR,
3373 	    xdr_MKDIR3args, (caddr_t)&args,
3374 	    xdr_MKDIR3res, (caddr_t)&res, cr,
3375 	    &douprintf, &res.status, 0, NULL);
3376 
3377 	if (error) {
3378 		PURGE_ATTRCACHE(dvp);
3379 		nfs_rw_exit(&drp->r_rwlock);
3380 		return (error);
3381 	}
3382 
3383 	error = geterrno3(res.status);
3384 	if (!error) {
3385 		nfs3_cache_wcc_data(dvp, &res.resok.dir_wcc, t, cr);
3386 		if (HAVE_RDDIR_CACHE(drp))
3387 			nfs_purge_rddir_cache(dvp);
3388 
3389 		if (!res.resok.obj.handle_follows) {
3390 			error = nfs3lookup(dvp, nm, &vp, NULL, 0, NULL, cr, 0);
3391 			if (error) {
3392 				nfs_rw_exit(&drp->r_rwlock);
3393 				return (error);
3394 			}
3395 		} else {
3396 			if (res.resok.obj_attributes.attributes) {
3397 				vp = makenfs3node(&res.resok.obj.handle,
3398 				    &res.resok.obj_attributes.attr,
3399 				    dvp->v_vfsp, t, cr, NULL, NULL);
3400 			} else {
3401 				vp = makenfs3node(&res.resok.obj.handle, NULL,
3402 				    dvp->v_vfsp, t, cr, NULL, NULL);
3403 				if (vp->v_type == VNON) {
3404 					vattr.va_mask = AT_TYPE;
3405 					error = nfs3getattr(vp, &vattr, cr);
3406 					if (error) {
3407 						VN_RELE(vp);
3408 						nfs_rw_exit(&drp->r_rwlock);
3409 						return (error);
3410 					}
3411 					vp->v_type = vattr.va_type;
3412 				}
3413 			}
3414 			dnlc_update(dvp, nm, vp);
3415 		}
3416 		if (va->va_gid != VTOR(vp)->r_attr.va_gid) {
3417 			va->va_mask = AT_GID;
3418 			(void) nfs3setattr(vp, va, 0, cr);
3419 		}
3420 		*vpp = vp;
3421 	} else {
3422 		nfs3_cache_wcc_data(dvp, &res.resfail.dir_wcc, t, cr);
3423 		PURGE_STALE_FH(error, dvp, cr);
3424 	}
3425 
3426 	nfs_rw_exit(&drp->r_rwlock);
3427 
3428 	return (error);
3429 }
3430 
3431 /* ARGSUSED */
3432 static int
3433 nfs3_rmdir(vnode_t *dvp, char *nm, vnode_t *cdir, cred_t *cr,
3434 	caller_context_t *ct, int flags)
3435 {
3436 	int error;
3437 	RMDIR3args args;
3438 	RMDIR3res res;
3439 	vnode_t *vp;
3440 	int douprintf;
3441 	rnode_t *drp;
3442 	hrtime_t t;
3443 
3444 	if (nfs_zone() != VTOMI(dvp)->mi_zone)
3445 		return (EPERM);
3446 	drp = VTOR(dvp);
3447 	if (nfs_rw_enter_sig(&drp->r_rwlock, RW_WRITER, INTR(dvp)))
3448 		return (EINTR);
3449 
3450 	/*
3451 	 * Attempt to prevent a rmdir(".") from succeeding.
3452 	 */
3453 	error = nfs3lookup(dvp, nm, &vp, NULL, 0, NULL, cr, 0);
3454 	if (error) {
3455 		nfs_rw_exit(&drp->r_rwlock);
3456 		return (error);
3457 	}
3458 
3459 	if (vp == cdir) {
3460 		VN_RELE(vp);
3461 		nfs_rw_exit(&drp->r_rwlock);
3462 		return (EINVAL);
3463 	}
3464 
3465 	setdiropargs3(&args.object, nm, dvp);
3466 
3467 	/*
3468 	 * First just remove the entry from the name cache, as it
3469 	 * is most likely an entry for this vp.
3470 	 */
3471 	dnlc_remove(dvp, nm);
3472 
3473 	/*
3474 	 * If there vnode reference count is greater than one, then
3475 	 * there may be additional references in the DNLC which will
3476 	 * need to be purged.  First, trying removing the entry for
3477 	 * the parent directory and see if that removes the additional
3478 	 * reference(s).  If that doesn't do it, then use dnlc_purge_vp
3479 	 * to completely remove any references to the directory which
3480 	 * might still exist in the DNLC.
3481 	 */
3482 	if (vp->v_count > 1) {
3483 		dnlc_remove(vp, "..");
3484 		if (vp->v_count > 1)
3485 			dnlc_purge_vp(vp);
3486 	}
3487 
3488 	douprintf = 1;
3489 
3490 	t = gethrtime();
3491 
3492 	error = rfs3call(VTOMI(dvp), NFSPROC3_RMDIR,
3493 	    xdr_diropargs3, (caddr_t)&args,
3494 	    xdr_RMDIR3res, (caddr_t)&res, cr,
3495 	    &douprintf, &res.status, 0, NULL);
3496 
3497 	PURGE_ATTRCACHE(vp);
3498 
3499 	if (error) {
3500 		PURGE_ATTRCACHE(dvp);
3501 		VN_RELE(vp);
3502 		nfs_rw_exit(&drp->r_rwlock);
3503 		return (error);
3504 	}
3505 
3506 	error = geterrno3(res.status);
3507 	if (!error) {
3508 		nfs3_cache_wcc_data(dvp, &res.resok.dir_wcc, t, cr);
3509 		if (HAVE_RDDIR_CACHE(drp))
3510 			nfs_purge_rddir_cache(dvp);
3511 		if (HAVE_RDDIR_CACHE(VTOR(vp)))
3512 			nfs_purge_rddir_cache(vp);
3513 	} else {
3514 		nfs3_cache_wcc_data(dvp, &res.resfail.dir_wcc, t, cr);
3515 		PURGE_STALE_FH(error, dvp, cr);
3516 		/*
3517 		 * System V defines rmdir to return EEXIST, not
3518 		 * ENOTEMPTY if the directory is not empty.  Over
3519 		 * the wire, the error is NFSERR_ENOTEMPTY which
3520 		 * geterrno maps to ENOTEMPTY.
3521 		 */
3522 		if (error == ENOTEMPTY)
3523 			error = EEXIST;
3524 	}
3525 
3526 	if (error == 0) {
3527 		vnevent_rmdir(vp, dvp, nm, ct);
3528 	}
3529 	VN_RELE(vp);
3530 
3531 	nfs_rw_exit(&drp->r_rwlock);
3532 
3533 	return (error);
3534 }
3535 
3536 /* ARGSUSED */
3537 static int
3538 nfs3_symlink(vnode_t *dvp, char *lnm, struct vattr *tva, char *tnm, cred_t *cr,
3539 	caller_context_t *ct, int flags)
3540 {
3541 	int error;
3542 	SYMLINK3args args;
3543 	SYMLINK3res res;
3544 	int douprintf;
3545 	mntinfo_t *mi;
3546 	vnode_t *vp;
3547 	rnode_t *rp;
3548 	char *contents;
3549 	rnode_t *drp;
3550 	hrtime_t t;
3551 
3552 	mi = VTOMI(dvp);
3553 
3554 	if (nfs_zone() != mi->mi_zone)
3555 		return (EPERM);
3556 	if (!(mi->mi_flags & MI_SYMLINK))
3557 		return (EOPNOTSUPP);
3558 
3559 	setdiropargs3(&args.where, lnm, dvp);
3560 	error = vattr_to_sattr3(tva, &args.symlink.symlink_attributes);
3561 	if (error) {
3562 		/* req time field(s) overflow - return immediately */
3563 		return (error);
3564 	}
3565 	args.symlink.symlink_data = tnm;
3566 
3567 	drp = VTOR(dvp);
3568 	if (nfs_rw_enter_sig(&drp->r_rwlock, RW_WRITER, INTR(dvp)))
3569 		return (EINTR);
3570 
3571 	dnlc_remove(dvp, lnm);
3572 
3573 	douprintf = 1;
3574 
3575 	t = gethrtime();
3576 
3577 	error = rfs3call(mi, NFSPROC3_SYMLINK,
3578 	    xdr_SYMLINK3args, (caddr_t)&args,
3579 	    xdr_SYMLINK3res, (caddr_t)&res, cr,
3580 	    &douprintf, &res.status, 0, NULL);
3581 
3582 	if (error) {
3583 		PURGE_ATTRCACHE(dvp);
3584 		nfs_rw_exit(&drp->r_rwlock);
3585 		return (error);
3586 	}
3587 
3588 	error = geterrno3(res.status);
3589 	if (!error) {
3590 		nfs3_cache_wcc_data(dvp, &res.resok.dir_wcc, t, cr);
3591 		if (HAVE_RDDIR_CACHE(drp))
3592 			nfs_purge_rddir_cache(dvp);
3593 
3594 		if (res.resok.obj.handle_follows) {
3595 			if (res.resok.obj_attributes.attributes) {
3596 				vp = makenfs3node(&res.resok.obj.handle,
3597 				    &res.resok.obj_attributes.attr,
3598 				    dvp->v_vfsp, t, cr, NULL, NULL);
3599 			} else {
3600 				vp = makenfs3node(&res.resok.obj.handle, NULL,
3601 				    dvp->v_vfsp, t, cr, NULL, NULL);
3602 				vp->v_type = VLNK;
3603 				vp->v_rdev = 0;
3604 			}
3605 			dnlc_update(dvp, lnm, vp);
3606 			rp = VTOR(vp);
3607 			if (nfs3_do_symlink_cache &&
3608 			    rp->r_symlink.contents == NULL) {
3609 
3610 				contents = kmem_alloc(MAXPATHLEN,
3611 				    KM_NOSLEEP);
3612 
3613 				if (contents != NULL) {
3614 					mutex_enter(&rp->r_statelock);
3615 					if (rp->r_symlink.contents == NULL) {
3616 						rp->r_symlink.len = strlen(tnm);
3617 						bcopy(tnm, contents,
3618 						    rp->r_symlink.len);
3619 						rp->r_symlink.contents =
3620 						    contents;
3621 						rp->r_symlink.size = MAXPATHLEN;
3622 						mutex_exit(&rp->r_statelock);
3623 					} else {
3624 						mutex_exit(&rp->r_statelock);
3625 						kmem_free((void *)contents,
3626 						    MAXPATHLEN);
3627 					}
3628 				}
3629 			}
3630 			VN_RELE(vp);
3631 		}
3632 	} else {
3633 		nfs3_cache_wcc_data(dvp, &res.resfail.dir_wcc, t, cr);
3634 		PURGE_STALE_FH(error, dvp, cr);
3635 		if (error == EOPNOTSUPP) {
3636 			mutex_enter(&mi->mi_lock);
3637 			mi->mi_flags &= ~MI_SYMLINK;
3638 			mutex_exit(&mi->mi_lock);
3639 		}
3640 	}
3641 
3642 	nfs_rw_exit(&drp->r_rwlock);
3643 
3644 	return (error);
3645 }
3646 
3647 #ifdef DEBUG
3648 static int nfs3_readdir_cache_hits = 0;
3649 static int nfs3_readdir_cache_shorts = 0;
3650 static int nfs3_readdir_cache_waits = 0;
3651 static int nfs3_readdir_cache_misses = 0;
3652 static int nfs3_readdir_readahead = 0;
3653 #endif
3654 
3655 static int nfs3_shrinkreaddir = 0;
3656 
3657 /*
3658  * Read directory entries.
3659  * There are some weird things to look out for here.  The uio_loffset
3660  * field is either 0 or it is the offset returned from a previous
3661  * readdir.  It is an opaque value used by the server to find the
3662  * correct directory block to read. The count field is the number
3663  * of blocks to read on the server.  This is advisory only, the server
3664  * may return only one block's worth of entries.  Entries may be compressed
3665  * on the server.
3666  */
3667 /* ARGSUSED */
3668 static int
3669 nfs3_readdir(vnode_t *vp, struct uio *uiop, cred_t *cr, int *eofp,
3670 	caller_context_t *ct, int flags)
3671 {
3672 	int error;
3673 	size_t count;
3674 	rnode_t *rp;
3675 	rddir_cache *rdc;
3676 	rddir_cache *nrdc;
3677 	rddir_cache *rrdc;
3678 #ifdef DEBUG
3679 	int missed;
3680 #endif
3681 	int doreadahead;
3682 	rddir_cache srdc;
3683 	avl_index_t where;
3684 
3685 	if (nfs_zone() != VTOMI(vp)->mi_zone)
3686 		return (EIO);
3687 	rp = VTOR(vp);
3688 
3689 	ASSERT(nfs_rw_lock_held(&rp->r_rwlock, RW_READER));
3690 
3691 	/*
3692 	 * Make sure that the directory cache is valid.
3693 	 */
3694 	if (HAVE_RDDIR_CACHE(rp)) {
3695 		if (nfs_disable_rddir_cache) {
3696 			/*
3697 			 * Setting nfs_disable_rddir_cache in /etc/system
3698 			 * allows interoperability with servers that do not
3699 			 * properly update the attributes of directories.
3700 			 * Any cached information gets purged before an
3701 			 * access is made to it.
3702 			 */
3703 			nfs_purge_rddir_cache(vp);
3704 		} else {
3705 			error = nfs3_validate_caches(vp, cr);
3706 			if (error)
3707 				return (error);
3708 		}
3709 	}
3710 
3711 	/*
3712 	 * It is possible that some servers may not be able to correctly
3713 	 * handle a large READDIR or READDIRPLUS request due to bugs in
3714 	 * their implementation.  In order to continue to interoperate
3715 	 * with them, this workaround is provided to limit the maximum
3716 	 * size of a READDIRPLUS request to 1024.  In any case, the request
3717 	 * size is limited to MAXBSIZE.
3718 	 */
3719 	count = MIN(uiop->uio_iov->iov_len,
3720 	    nfs3_shrinkreaddir ? 1024 : MAXBSIZE);
3721 
3722 	nrdc = NULL;
3723 #ifdef DEBUG
3724 	missed = 0;
3725 #endif
3726 top:
3727 	/*
3728 	 * Short circuit last readdir which always returns 0 bytes.
3729 	 * This can be done after the directory has been read through
3730 	 * completely at least once.  This will set r_direof which
3731 	 * can be used to find the value of the last cookie.
3732 	 */
3733 	mutex_enter(&rp->r_statelock);
3734 	if (rp->r_direof != NULL &&
3735 	    uiop->uio_loffset == rp->r_direof->nfs3_ncookie) {
3736 		mutex_exit(&rp->r_statelock);
3737 #ifdef DEBUG
3738 		nfs3_readdir_cache_shorts++;
3739 #endif
3740 		if (eofp)
3741 			*eofp = 1;
3742 		if (nrdc != NULL)
3743 			rddir_cache_rele(nrdc);
3744 		return (0);
3745 	}
3746 	/*
3747 	 * Look for a cache entry.  Cache entries are identified
3748 	 * by the NFS cookie value and the byte count requested.
3749 	 */
3750 	srdc.nfs3_cookie = uiop->uio_loffset;
3751 	srdc.buflen = count;
3752 	rdc = avl_find(&rp->r_dir, &srdc, &where);
3753 	if (rdc != NULL) {
3754 		rddir_cache_hold(rdc);
3755 		/*
3756 		 * If the cache entry is in the process of being
3757 		 * filled in, wait until this completes.  The
3758 		 * RDDIRWAIT bit is set to indicate that someone
3759 		 * is waiting and then the thread currently
3760 		 * filling the entry is done, it should do a
3761 		 * cv_broadcast to wakeup all of the threads
3762 		 * waiting for it to finish.
3763 		 */
3764 		if (rdc->flags & RDDIR) {
3765 			nfs_rw_exit(&rp->r_rwlock);
3766 			rdc->flags |= RDDIRWAIT;
3767 #ifdef DEBUG
3768 			nfs3_readdir_cache_waits++;
3769 #endif
3770 			if (!cv_wait_sig(&rdc->cv, &rp->r_statelock)) {
3771 				/*
3772 				 * We got interrupted, probably
3773 				 * the user typed ^C or an alarm
3774 				 * fired.  We free the new entry
3775 				 * if we allocated one.
3776 				 */
3777 				mutex_exit(&rp->r_statelock);
3778 				(void) nfs_rw_enter_sig(&rp->r_rwlock,
3779 				    RW_READER, FALSE);
3780 				rddir_cache_rele(rdc);
3781 				if (nrdc != NULL)
3782 					rddir_cache_rele(nrdc);
3783 				return (EINTR);
3784 			}
3785 			mutex_exit(&rp->r_statelock);
3786 			(void) nfs_rw_enter_sig(&rp->r_rwlock,
3787 			    RW_READER, FALSE);
3788 			rddir_cache_rele(rdc);
3789 			goto top;
3790 		}
3791 		/*
3792 		 * Check to see if a readdir is required to
3793 		 * fill the entry.  If so, mark this entry
3794 		 * as being filled, remove our reference,
3795 		 * and branch to the code to fill the entry.
3796 		 */
3797 		if (rdc->flags & RDDIRREQ) {
3798 			rdc->flags &= ~RDDIRREQ;
3799 			rdc->flags |= RDDIR;
3800 			if (nrdc != NULL)
3801 				rddir_cache_rele(nrdc);
3802 			nrdc = rdc;
3803 			mutex_exit(&rp->r_statelock);
3804 			goto bottom;
3805 		}
3806 #ifdef DEBUG
3807 		if (!missed)
3808 			nfs3_readdir_cache_hits++;
3809 #endif
3810 		/*
3811 		 * If an error occurred while attempting
3812 		 * to fill the cache entry, just return it.
3813 		 */
3814 		if (rdc->error) {
3815 			error = rdc->error;
3816 			mutex_exit(&rp->r_statelock);
3817 			rddir_cache_rele(rdc);
3818 			if (nrdc != NULL)
3819 				rddir_cache_rele(nrdc);
3820 			return (error);
3821 		}
3822 
3823 		/*
3824 		 * The cache entry is complete and good,
3825 		 * copyout the dirent structs to the calling
3826 		 * thread.
3827 		 */
3828 		error = uiomove(rdc->entries, rdc->entlen, UIO_READ, uiop);
3829 
3830 		/*
3831 		 * If no error occurred during the copyout,
3832 		 * update the offset in the uio struct to
3833 		 * contain the value of the next cookie
3834 		 * and set the eof value appropriately.
3835 		 */
3836 		if (!error) {
3837 			uiop->uio_loffset = rdc->nfs3_ncookie;
3838 			if (eofp)
3839 				*eofp = rdc->eof;
3840 		}
3841 
3842 		/*
3843 		 * Decide whether to do readahead.
3844 		 *
3845 		 * Don't if have already read to the end of
3846 		 * directory.  There is nothing more to read.
3847 		 *
3848 		 * Don't if the application is not doing
3849 		 * lookups in the directory.  The readahead
3850 		 * is only effective if the application can
3851 		 * be doing work while an async thread is
3852 		 * handling the over the wire request.
3853 		 */
3854 		if (rdc->eof) {
3855 			rp->r_direof = rdc;
3856 			doreadahead = FALSE;
3857 		} else if (!(rp->r_flags & RLOOKUP))
3858 			doreadahead = FALSE;
3859 		else
3860 			doreadahead = TRUE;
3861 
3862 		if (!doreadahead) {
3863 			mutex_exit(&rp->r_statelock);
3864 			rddir_cache_rele(rdc);
3865 			if (nrdc != NULL)
3866 				rddir_cache_rele(nrdc);
3867 			return (error);
3868 		}
3869 
3870 		/*
3871 		 * Check to see whether we found an entry
3872 		 * for the readahead.  If so, we don't need
3873 		 * to do anything further, so free the new
3874 		 * entry if one was allocated.  Otherwise,
3875 		 * allocate a new entry, add it to the cache,
3876 		 * and then initiate an asynchronous readdir
3877 		 * operation to fill it.
3878 		 */
3879 		srdc.nfs3_cookie = rdc->nfs3_ncookie;
3880 		srdc.buflen = count;
3881 		rrdc = avl_find(&rp->r_dir, &srdc, &where);
3882 		if (rrdc != NULL) {
3883 			if (nrdc != NULL)
3884 				rddir_cache_rele(nrdc);
3885 		} else {
3886 			if (nrdc != NULL)
3887 				rrdc = nrdc;
3888 			else {
3889 				rrdc = rddir_cache_alloc(KM_NOSLEEP);
3890 			}
3891 			if (rrdc != NULL) {
3892 				rrdc->nfs3_cookie = rdc->nfs3_ncookie;
3893 				rrdc->buflen = count;
3894 				avl_insert(&rp->r_dir, rrdc, where);
3895 				rddir_cache_hold(rrdc);
3896 				mutex_exit(&rp->r_statelock);
3897 				rddir_cache_rele(rdc);
3898 #ifdef DEBUG
3899 				nfs3_readdir_readahead++;
3900 #endif
3901 				nfs_async_readdir(vp, rrdc, cr, do_nfs3readdir);
3902 				return (error);
3903 			}
3904 		}
3905 
3906 		mutex_exit(&rp->r_statelock);
3907 		rddir_cache_rele(rdc);
3908 		return (error);
3909 	}
3910 
3911 	/*
3912 	 * Didn't find an entry in the cache.  Construct a new empty
3913 	 * entry and link it into the cache.  Other processes attempting
3914 	 * to access this entry will need to wait until it is filled in.
3915 	 *
3916 	 * Since kmem_alloc may block, another pass through the cache
3917 	 * will need to be taken to make sure that another process
3918 	 * hasn't already added an entry to the cache for this request.
3919 	 */
3920 	if (nrdc == NULL) {
3921 		mutex_exit(&rp->r_statelock);
3922 		nrdc = rddir_cache_alloc(KM_SLEEP);
3923 		nrdc->nfs3_cookie = uiop->uio_loffset;
3924 		nrdc->buflen = count;
3925 		goto top;
3926 	}
3927 
3928 	/*
3929 	 * Add this entry to the cache.
3930 	 */
3931 	avl_insert(&rp->r_dir, nrdc, where);
3932 	rddir_cache_hold(nrdc);
3933 	mutex_exit(&rp->r_statelock);
3934 
3935 bottom:
3936 #ifdef DEBUG
3937 	missed = 1;
3938 	nfs3_readdir_cache_misses++;
3939 #endif
3940 	/*
3941 	 * Do the readdir.  This routine decides whether to use
3942 	 * READDIR or READDIRPLUS.
3943 	 */
3944 	error = do_nfs3readdir(vp, nrdc, cr);
3945 
3946 	/*
3947 	 * If this operation failed, just return the error which occurred.
3948 	 */
3949 	if (error != 0)
3950 		return (error);
3951 
3952 	/*
3953 	 * Since the RPC operation will have taken sometime and blocked
3954 	 * this process, another pass through the cache will need to be
3955 	 * taken to find the correct cache entry.  It is possible that
3956 	 * the correct cache entry will not be there (although one was
3957 	 * added) because the directory changed during the RPC operation
3958 	 * and the readdir cache was flushed.  In this case, just start
3959 	 * over.  It is hoped that this will not happen too often... :-)
3960 	 */
3961 	nrdc = NULL;
3962 	goto top;
3963 	/* NOTREACHED */
3964 }
3965 
3966 static int
3967 do_nfs3readdir(vnode_t *vp, rddir_cache *rdc, cred_t *cr)
3968 {
3969 	int error;
3970 	rnode_t *rp;
3971 	mntinfo_t *mi;
3972 
3973 	rp = VTOR(vp);
3974 	mi = VTOMI(vp);
3975 	ASSERT(nfs_zone() == mi->mi_zone);
3976 	/*
3977 	 * Issue the proper request.
3978 	 *
3979 	 * If the server does not support READDIRPLUS, then use READDIR.
3980 	 *
3981 	 * Otherwise --
3982 	 * Issue a READDIRPLUS if reading to fill an empty cache or if
3983 	 * an application has performed a lookup in the directory which
3984 	 * required an over the wire lookup.  The use of READDIRPLUS
3985 	 * will help to (re)populate the DNLC.
3986 	 */
3987 	if (!(mi->mi_flags & MI_READDIRONLY) &&
3988 	    (rp->r_flags & (RLOOKUP | RREADDIRPLUS))) {
3989 		if (rp->r_flags & RREADDIRPLUS) {
3990 			mutex_enter(&rp->r_statelock);
3991 			rp->r_flags &= ~RREADDIRPLUS;
3992 			mutex_exit(&rp->r_statelock);
3993 		}
3994 		nfs3readdirplus(vp, rdc, cr);
3995 		if (rdc->error == EOPNOTSUPP)
3996 			nfs3readdir(vp, rdc, cr);
3997 	} else
3998 		nfs3readdir(vp, rdc, cr);
3999 
4000 	mutex_enter(&rp->r_statelock);
4001 	rdc->flags &= ~RDDIR;
4002 	if (rdc->flags & RDDIRWAIT) {
4003 		rdc->flags &= ~RDDIRWAIT;
4004 		cv_broadcast(&rdc->cv);
4005 	}
4006 	error = rdc->error;
4007 	if (error)
4008 		rdc->flags |= RDDIRREQ;
4009 	mutex_exit(&rp->r_statelock);
4010 
4011 	rddir_cache_rele(rdc);
4012 
4013 	return (error);
4014 }
4015 
4016 static void
4017 nfs3readdir(vnode_t *vp, rddir_cache *rdc, cred_t *cr)
4018 {
4019 	int error;
4020 	READDIR3args args;
4021 	READDIR3vres res;
4022 	vattr_t dva;
4023 	rnode_t *rp;
4024 	int douprintf;
4025 	failinfo_t fi, *fip = NULL;
4026 	mntinfo_t *mi;
4027 	hrtime_t t;
4028 
4029 	rp = VTOR(vp);
4030 	mi = VTOMI(vp);
4031 	ASSERT(nfs_zone() == mi->mi_zone);
4032 
4033 	args.dir = *RTOFH3(rp);
4034 	args.cookie = (cookie3)rdc->nfs3_cookie;
4035 	args.cookieverf = rp->r_cookieverf;
4036 	args.count = rdc->buflen;
4037 
4038 	/*
4039 	 * NFS client failover support
4040 	 * suppress failover unless we have a zero cookie
4041 	 */
4042 	if (args.cookie == (cookie3) 0) {
4043 		fi.vp = vp;
4044 		fi.fhp = (caddr_t)&args.dir;
4045 		fi.copyproc = nfs3copyfh;
4046 		fi.lookupproc = nfs3lookup;
4047 		fi.xattrdirproc = acl_getxattrdir3;
4048 		fip = &fi;
4049 	}
4050 
4051 #ifdef DEBUG
4052 	rdc->entries = rddir_cache_buf_alloc(rdc->buflen, KM_SLEEP);
4053 #else
4054 	rdc->entries = kmem_alloc(rdc->buflen, KM_SLEEP);
4055 #endif
4056 
4057 	res.entries = (dirent64_t *)rdc->entries;
4058 	res.entries_size = rdc->buflen;
4059 	res.dir_attributes.fres.vap = &dva;
4060 	res.dir_attributes.fres.vp = vp;
4061 	res.loff = rdc->nfs3_cookie;
4062 
4063 	douprintf = 1;
4064 
4065 	if (mi->mi_io_kstats) {
4066 		mutex_enter(&mi->mi_lock);
4067 		kstat_runq_enter(KSTAT_IO_PTR(mi->mi_io_kstats));
4068 		mutex_exit(&mi->mi_lock);
4069 	}
4070 
4071 	t = gethrtime();
4072 
4073 	error = rfs3call(VTOMI(vp), NFSPROC3_READDIR,
4074 	    xdr_READDIR3args, (caddr_t)&args,
4075 	    xdr_READDIR3vres, (caddr_t)&res, cr,
4076 	    &douprintf, &res.status, 0, fip);
4077 
4078 	if (mi->mi_io_kstats) {
4079 		mutex_enter(&mi->mi_lock);
4080 		kstat_runq_exit(KSTAT_IO_PTR(mi->mi_io_kstats));
4081 		mutex_exit(&mi->mi_lock);
4082 	}
4083 
4084 	if (error)
4085 		goto err;
4086 
4087 	nfs3_cache_post_op_vattr(vp, &res.dir_attributes, t, cr);
4088 
4089 	error = geterrno3(res.status);
4090 	if (error) {
4091 		PURGE_STALE_FH(error, vp, cr);
4092 		goto err;
4093 	}
4094 
4095 	if (mi->mi_io_kstats) {
4096 		mutex_enter(&mi->mi_lock);
4097 		KSTAT_IO_PTR(mi->mi_io_kstats)->reads++;
4098 		KSTAT_IO_PTR(mi->mi_io_kstats)->nread += res.size;
4099 		mutex_exit(&mi->mi_lock);
4100 	}
4101 
4102 	rdc->nfs3_ncookie = res.loff;
4103 	rp->r_cookieverf = res.cookieverf;
4104 	rdc->eof = res.eof ? 1 : 0;
4105 	rdc->entlen = res.size;
4106 	ASSERT(rdc->entlen <= rdc->buflen);
4107 	rdc->error = 0;
4108 	return;
4109 
4110 err:
4111 	kmem_free(rdc->entries, rdc->buflen);
4112 	rdc->entries = NULL;
4113 	rdc->error = error;
4114 }
4115 
4116 /*
4117  * Read directory entries.
4118  * There are some weird things to look out for here.  The uio_loffset
4119  * field is either 0 or it is the offset returned from a previous
4120  * readdir.  It is an opaque value used by the server to find the
4121  * correct directory block to read. The count field is the number
4122  * of blocks to read on the server.  This is advisory only, the server
4123  * may return only one block's worth of entries.  Entries may be compressed
4124  * on the server.
4125  */
4126 static void
4127 nfs3readdirplus(vnode_t *vp, rddir_cache *rdc, cred_t *cr)
4128 {
4129 	int error;
4130 	READDIRPLUS3args args;
4131 	READDIRPLUS3vres res;
4132 	vattr_t dva;
4133 	rnode_t *rp;
4134 	mntinfo_t *mi;
4135 	int douprintf;
4136 	failinfo_t fi, *fip = NULL;
4137 
4138 	rp = VTOR(vp);
4139 	mi = VTOMI(vp);
4140 	ASSERT(nfs_zone() == mi->mi_zone);
4141 
4142 	args.dir = *RTOFH3(rp);
4143 	args.cookie = (cookie3)rdc->nfs3_cookie;
4144 	args.cookieverf = rp->r_cookieverf;
4145 	args.dircount = rdc->buflen;
4146 	args.maxcount = mi->mi_tsize;
4147 
4148 	/*
4149 	 * NFS client failover support
4150 	 * suppress failover unless we have a zero cookie
4151 	 */
4152 	if (args.cookie == (cookie3)0) {
4153 		fi.vp = vp;
4154 		fi.fhp = (caddr_t)&args.dir;
4155 		fi.copyproc = nfs3copyfh;
4156 		fi.lookupproc = nfs3lookup;
4157 		fi.xattrdirproc = acl_getxattrdir3;
4158 		fip = &fi;
4159 	}
4160 
4161 #ifdef DEBUG
4162 	rdc->entries = rddir_cache_buf_alloc(rdc->buflen, KM_SLEEP);
4163 #else
4164 	rdc->entries = kmem_alloc(rdc->buflen, KM_SLEEP);
4165 #endif
4166 
4167 	res.entries = (dirent64_t *)rdc->entries;
4168 	res.entries_size = rdc->buflen;
4169 	res.dir_attributes.fres.vap = &dva;
4170 	res.dir_attributes.fres.vp = vp;
4171 	res.loff = rdc->nfs3_cookie;
4172 	res.credentials = cr;
4173 
4174 	douprintf = 1;
4175 
4176 	if (mi->mi_io_kstats) {
4177 		mutex_enter(&mi->mi_lock);
4178 		kstat_runq_enter(KSTAT_IO_PTR(mi->mi_io_kstats));
4179 		mutex_exit(&mi->mi_lock);
4180 	}
4181 
4182 	res.time = gethrtime();
4183 
4184 	error = rfs3call(mi, NFSPROC3_READDIRPLUS,
4185 	    xdr_READDIRPLUS3args, (caddr_t)&args,
4186 	    xdr_READDIRPLUS3vres, (caddr_t)&res, cr,
4187 	    &douprintf, &res.status, 0, fip);
4188 
4189 	if (mi->mi_io_kstats) {
4190 		mutex_enter(&mi->mi_lock);
4191 		kstat_runq_exit(KSTAT_IO_PTR(mi->mi_io_kstats));
4192 		mutex_exit(&mi->mi_lock);
4193 	}
4194 
4195 	if (error) {
4196 		goto err;
4197 	}
4198 
4199 	nfs3_cache_post_op_vattr(vp, &res.dir_attributes, res.time, cr);
4200 
4201 	error = geterrno3(res.status);
4202 	if (error) {
4203 		PURGE_STALE_FH(error, vp, cr);
4204 		if (error == EOPNOTSUPP) {
4205 			mutex_enter(&mi->mi_lock);
4206 			mi->mi_flags |= MI_READDIRONLY;
4207 			mutex_exit(&mi->mi_lock);
4208 		}
4209 		goto err;
4210 	}
4211 
4212 	if (mi->mi_io_kstats) {
4213 		mutex_enter(&mi->mi_lock);
4214 		KSTAT_IO_PTR(mi->mi_io_kstats)->reads++;
4215 		KSTAT_IO_PTR(mi->mi_io_kstats)->nread += res.size;
4216 		mutex_exit(&mi->mi_lock);
4217 	}
4218 
4219 	rdc->nfs3_ncookie = res.loff;
4220 	rp->r_cookieverf = res.cookieverf;
4221 	rdc->eof = res.eof ? 1 : 0;
4222 	rdc->entlen = res.size;
4223 	ASSERT(rdc->entlen <= rdc->buflen);
4224 	rdc->error = 0;
4225 
4226 	return;
4227 
4228 err:
4229 	kmem_free(rdc->entries, rdc->buflen);
4230 	rdc->entries = NULL;
4231 	rdc->error = error;
4232 }
4233 
4234 #ifdef DEBUG
4235 static int nfs3_bio_do_stop = 0;
4236 #endif
4237 
4238 static int
4239 nfs3_bio(struct buf *bp, stable_how *stab_comm, cred_t *cr)
4240 {
4241 	rnode_t *rp = VTOR(bp->b_vp);
4242 	int count;
4243 	int error;
4244 	cred_t *cred;
4245 	offset_t offset;
4246 
4247 	ASSERT(nfs_zone() == VTOMI(bp->b_vp)->mi_zone);
4248 	offset = ldbtob(bp->b_lblkno);
4249 
4250 	DTRACE_IO1(start, struct buf *, bp);
4251 
4252 	if (bp->b_flags & B_READ) {
4253 		mutex_enter(&rp->r_statelock);
4254 		if (rp->r_cred != NULL) {
4255 			cred = rp->r_cred;
4256 			crhold(cred);
4257 		} else {
4258 			rp->r_cred = cr;
4259 			crhold(cr);
4260 			cred = cr;
4261 			crhold(cred);
4262 		}
4263 		mutex_exit(&rp->r_statelock);
4264 	read_again:
4265 		error = bp->b_error = nfs3read(bp->b_vp, bp->b_un.b_addr,
4266 		    offset, bp->b_bcount, &bp->b_resid, cred);
4267 		crfree(cred);
4268 		if (!error) {
4269 			if (bp->b_resid) {
4270 				/*
4271 				 * Didn't get it all because we hit EOF,
4272 				 * zero all the memory beyond the EOF.
4273 				 */
4274 				/* bzero(rdaddr + */
4275 				bzero(bp->b_un.b_addr +
4276 				    bp->b_bcount - bp->b_resid, bp->b_resid);
4277 			}
4278 			mutex_enter(&rp->r_statelock);
4279 			if (bp->b_resid == bp->b_bcount &&
4280 			    offset >= rp->r_size) {
4281 				/*
4282 				 * We didn't read anything at all as we are
4283 				 * past EOF.  Return an error indicator back
4284 				 * but don't destroy the pages (yet).
4285 				 */
4286 				error = NFS_EOF;
4287 			}
4288 			mutex_exit(&rp->r_statelock);
4289 		} else if (error == EACCES) {
4290 			mutex_enter(&rp->r_statelock);
4291 			if (cred != cr) {
4292 				if (rp->r_cred != NULL)
4293 					crfree(rp->r_cred);
4294 				rp->r_cred = cr;
4295 				crhold(cr);
4296 				cred = cr;
4297 				crhold(cred);
4298 				mutex_exit(&rp->r_statelock);
4299 				goto read_again;
4300 			}
4301 			mutex_exit(&rp->r_statelock);
4302 		}
4303 	} else {
4304 		if (!(rp->r_flags & RSTALE)) {
4305 			mutex_enter(&rp->r_statelock);
4306 			if (rp->r_cred != NULL) {
4307 				cred = rp->r_cred;
4308 				crhold(cred);
4309 			} else {
4310 				rp->r_cred = cr;
4311 				crhold(cr);
4312 				cred = cr;
4313 				crhold(cred);
4314 			}
4315 			mutex_exit(&rp->r_statelock);
4316 		write_again:
4317 			mutex_enter(&rp->r_statelock);
4318 			count = MIN(bp->b_bcount, rp->r_size - offset);
4319 			mutex_exit(&rp->r_statelock);
4320 			if (count < 0)
4321 				cmn_err(CE_PANIC, "nfs3_bio: write count < 0");
4322 #ifdef DEBUG
4323 			if (count == 0) {
4324 				zcmn_err(getzoneid(), CE_WARN,
4325 				    "nfs3_bio: zero length write at %lld",
4326 				    offset);
4327 				nfs_printfhandle(&rp->r_fh);
4328 				if (nfs3_bio_do_stop)
4329 					debug_enter("nfs3_bio");
4330 			}
4331 #endif
4332 			error = nfs3write(bp->b_vp, bp->b_un.b_addr, offset,
4333 			    count, cred, stab_comm);
4334 			if (error == EACCES) {
4335 				mutex_enter(&rp->r_statelock);
4336 				if (cred != cr) {
4337 					if (rp->r_cred != NULL)
4338 						crfree(rp->r_cred);
4339 					rp->r_cred = cr;
4340 					crhold(cr);
4341 					crfree(cred);
4342 					cred = cr;
4343 					crhold(cred);
4344 					mutex_exit(&rp->r_statelock);
4345 					goto write_again;
4346 				}
4347 				mutex_exit(&rp->r_statelock);
4348 			}
4349 			bp->b_error = error;
4350 			if (error && error != EINTR) {
4351 				/*
4352 				 * Don't print EDQUOT errors on the console.
4353 				 * Don't print asynchronous EACCES errors.
4354 				 * Don't print EFBIG errors.
4355 				 * Print all other write errors.
4356 				 */
4357 				if (error != EDQUOT && error != EFBIG &&
4358 				    (error != EACCES ||
4359 				    !(bp->b_flags & B_ASYNC)))
4360 					nfs_write_error(bp->b_vp, error, cred);
4361 				/*
4362 				 * Update r_error and r_flags as appropriate.
4363 				 * If the error was ESTALE, then mark the
4364 				 * rnode as not being writeable and save
4365 				 * the error status.  Otherwise, save any
4366 				 * errors which occur from asynchronous
4367 				 * page invalidations.  Any errors occurring
4368 				 * from other operations should be saved
4369 				 * by the caller.
4370 				 */
4371 				mutex_enter(&rp->r_statelock);
4372 				if (error == ESTALE) {
4373 					rp->r_flags |= RSTALE;
4374 					if (!rp->r_error)
4375 						rp->r_error = error;
4376 				} else if (!rp->r_error &&
4377 				    (bp->b_flags &
4378 				    (B_INVAL|B_FORCE|B_ASYNC)) ==
4379 				    (B_INVAL|B_FORCE|B_ASYNC)) {
4380 					rp->r_error = error;
4381 				}
4382 				mutex_exit(&rp->r_statelock);
4383 			}
4384 			crfree(cred);
4385 		} else
4386 			error = rp->r_error;
4387 	}
4388 
4389 	if (error != 0 && error != NFS_EOF)
4390 		bp->b_flags |= B_ERROR;
4391 
4392 	DTRACE_IO1(done, struct buf *, bp);
4393 
4394 	return (error);
4395 }
4396 
4397 /* ARGSUSED */
4398 static int
4399 nfs3_fid(vnode_t *vp, fid_t *fidp, caller_context_t *ct)
4400 {
4401 	rnode_t *rp;
4402 
4403 	if (nfs_zone() != VTOMI(vp)->mi_zone)
4404 		return (EIO);
4405 	rp = VTOR(vp);
4406 
4407 	if (fidp->fid_len < (ushort_t)rp->r_fh.fh_len) {
4408 		fidp->fid_len = rp->r_fh.fh_len;
4409 		return (ENOSPC);
4410 	}
4411 	fidp->fid_len = rp->r_fh.fh_len;
4412 	bcopy(rp->r_fh.fh_buf, fidp->fid_data, fidp->fid_len);
4413 	return (0);
4414 }
4415 
4416 /* ARGSUSED2 */
4417 static int
4418 nfs3_rwlock(vnode_t *vp, int write_lock, caller_context_t *ctp)
4419 {
4420 	rnode_t *rp = VTOR(vp);
4421 
4422 	if (!write_lock) {
4423 		(void) nfs_rw_enter_sig(&rp->r_rwlock, RW_READER, FALSE);
4424 		return (V_WRITELOCK_FALSE);
4425 	}
4426 
4427 	if ((rp->r_flags & RDIRECTIO) || (VTOMI(vp)->mi_flags & MI_DIRECTIO)) {
4428 		(void) nfs_rw_enter_sig(&rp->r_rwlock, RW_READER, FALSE);
4429 		if (rp->r_mapcnt == 0 && !vn_has_cached_data(vp))
4430 			return (V_WRITELOCK_FALSE);
4431 		nfs_rw_exit(&rp->r_rwlock);
4432 	}
4433 
4434 	(void) nfs_rw_enter_sig(&rp->r_rwlock, RW_WRITER, FALSE);
4435 	return (V_WRITELOCK_TRUE);
4436 }
4437 
4438 /* ARGSUSED */
4439 static void
4440 nfs3_rwunlock(vnode_t *vp, int write_lock, caller_context_t *ctp)
4441 {
4442 	rnode_t *rp = VTOR(vp);
4443 
4444 	nfs_rw_exit(&rp->r_rwlock);
4445 }
4446 
4447 /* ARGSUSED */
4448 static int
4449 nfs3_seek(vnode_t *vp, offset_t ooff, offset_t *noffp, caller_context_t *ct)
4450 {
4451 
4452 	/*
4453 	 * Because we stuff the readdir cookie into the offset field
4454 	 * someone may attempt to do an lseek with the cookie which
4455 	 * we want to succeed.
4456 	 */
4457 	if (vp->v_type == VDIR)
4458 		return (0);
4459 	if (*noffp < 0)
4460 		return (EINVAL);
4461 	return (0);
4462 }
4463 
4464 /*
4465  * number of nfs3_bsize blocks to read ahead.
4466  */
4467 static int nfs3_nra = 4;
4468 
4469 #ifdef DEBUG
4470 static int nfs3_lostpage = 0;	/* number of times we lost original page */
4471 #endif
4472 
4473 /*
4474  * Return all the pages from [off..off+len) in file
4475  */
4476 /* ARGSUSED */
4477 static int
4478 nfs3_getpage(vnode_t *vp, offset_t off, size_t len, uint_t *protp,
4479 	page_t *pl[], size_t plsz, struct seg *seg, caddr_t addr,
4480 	enum seg_rw rw, cred_t *cr, caller_context_t *ct)
4481 {
4482 	rnode_t *rp;
4483 	int error;
4484 	mntinfo_t *mi;
4485 
4486 	if (vp->v_flag & VNOMAP)
4487 		return (ENOSYS);
4488 
4489 	if (nfs_zone() != VTOMI(vp)->mi_zone)
4490 		return (EIO);
4491 	if (protp != NULL)
4492 		*protp = PROT_ALL;
4493 
4494 	/*
4495 	 * Now valididate that the caches are up to date.
4496 	 */
4497 	error = nfs3_validate_caches(vp, cr);
4498 	if (error)
4499 		return (error);
4500 
4501 	rp = VTOR(vp);
4502 	mi = VTOMI(vp);
4503 retry:
4504 	mutex_enter(&rp->r_statelock);
4505 
4506 	/*
4507 	 * Don't create dirty pages faster than they
4508 	 * can be cleaned so that the system doesn't
4509 	 * get imbalanced.  If the async queue is
4510 	 * maxed out, then wait for it to drain before
4511 	 * creating more dirty pages.  Also, wait for
4512 	 * any threads doing pagewalks in the vop_getattr
4513 	 * entry points so that they don't block for
4514 	 * long periods.
4515 	 */
4516 	if (rw == S_CREATE) {
4517 		while ((mi->mi_max_threads != 0 &&
4518 		    rp->r_awcount > 2 * mi->mi_max_threads) ||
4519 		    rp->r_gcount > 0)
4520 			cv_wait(&rp->r_cv, &rp->r_statelock);
4521 	}
4522 
4523 	/*
4524 	 * If we are getting called as a side effect of an nfs_write()
4525 	 * operation the local file size might not be extended yet.
4526 	 * In this case we want to be able to return pages of zeroes.
4527 	 */
4528 	if (off + len > rp->r_size + PAGEOFFSET && seg != segkmap) {
4529 		mutex_exit(&rp->r_statelock);
4530 		return (EFAULT);		/* beyond EOF */
4531 	}
4532 
4533 	mutex_exit(&rp->r_statelock);
4534 
4535 	if (len <= PAGESIZE) {
4536 		error = nfs3_getapage(vp, off, len, protp, pl, plsz,
4537 		    seg, addr, rw, cr);
4538 	} else {
4539 		error = pvn_getpages(nfs3_getapage, vp, off, len, protp,
4540 		    pl, plsz, seg, addr, rw, cr);
4541 	}
4542 
4543 	switch (error) {
4544 	case NFS_EOF:
4545 		nfs_purge_caches(vp, NFS_NOPURGE_DNLC, cr);
4546 		goto retry;
4547 	case ESTALE:
4548 		PURGE_STALE_FH(error, vp, cr);
4549 	}
4550 
4551 	return (error);
4552 }
4553 
4554 /*
4555  * Called from pvn_getpages or nfs3_getpage to get a particular page.
4556  */
4557 /* ARGSUSED */
4558 static int
4559 nfs3_getapage(vnode_t *vp, u_offset_t off, size_t len, uint_t *protp,
4560 	page_t *pl[], size_t plsz, struct seg *seg, caddr_t addr,
4561 	enum seg_rw rw, cred_t *cr)
4562 {
4563 	rnode_t *rp;
4564 	uint_t bsize;
4565 	struct buf *bp;
4566 	page_t *pp;
4567 	u_offset_t lbn;
4568 	u_offset_t io_off;
4569 	u_offset_t blkoff;
4570 	u_offset_t rablkoff;
4571 	size_t io_len;
4572 	uint_t blksize;
4573 	int error;
4574 	int readahead;
4575 	int readahead_issued = 0;
4576 	int ra_window; /* readahead window */
4577 	page_t *pagefound;
4578 	page_t *savepp;
4579 
4580 	if (nfs_zone() != VTOMI(vp)->mi_zone)
4581 		return (EIO);
4582 	rp = VTOR(vp);
4583 	bsize = MAX(vp->v_vfsp->vfs_bsize, PAGESIZE);
4584 
4585 reread:
4586 	bp = NULL;
4587 	pp = NULL;
4588 	pagefound = NULL;
4589 
4590 	if (pl != NULL)
4591 		pl[0] = NULL;
4592 
4593 	error = 0;
4594 	lbn = off / bsize;
4595 	blkoff = lbn * bsize;
4596 
4597 	/*
4598 	 * Queueing up the readahead before doing the synchronous read
4599 	 * results in a significant increase in read throughput because
4600 	 * of the increased parallelism between the async threads and
4601 	 * the process context.
4602 	 */
4603 	if ((off & ((vp->v_vfsp->vfs_bsize) - 1)) == 0 &&
4604 	    rw != S_CREATE &&
4605 	    !(vp->v_flag & VNOCACHE)) {
4606 		mutex_enter(&rp->r_statelock);
4607 
4608 		/*
4609 		 * Calculate the number of readaheads to do.
4610 		 * a) No readaheads at offset = 0.
4611 		 * b) Do maximum(nfs3_nra) readaheads when the readahead
4612 		 *    window is closed.
4613 		 * c) Do readaheads between 1 to (nfs3_nra - 1) depending
4614 		 *    upon how far the readahead window is open or close.
4615 		 * d) No readaheads if rp->r_nextr is not within the scope
4616 		 *    of the readahead window (random i/o).
4617 		 */
4618 
4619 		if (off == 0)
4620 			readahead = 0;
4621 		else if (blkoff == rp->r_nextr)
4622 			readahead = nfs3_nra;
4623 		else if (rp->r_nextr > blkoff &&
4624 		    ((ra_window = (rp->r_nextr - blkoff) / bsize)
4625 		    <= (nfs3_nra - 1)))
4626 			readahead = nfs3_nra - ra_window;
4627 		else
4628 			readahead = 0;
4629 
4630 		rablkoff = rp->r_nextr;
4631 		while (readahead > 0 && rablkoff + bsize < rp->r_size) {
4632 			mutex_exit(&rp->r_statelock);
4633 			if (nfs_async_readahead(vp, rablkoff + bsize,
4634 			    addr + (rablkoff + bsize - off), seg, cr,
4635 			    nfs3_readahead) < 0) {
4636 				mutex_enter(&rp->r_statelock);
4637 				break;
4638 			}
4639 			readahead--;
4640 			rablkoff += bsize;
4641 			/*
4642 			 * Indicate that we did a readahead so
4643 			 * readahead offset is not updated
4644 			 * by the synchronous read below.
4645 			 */
4646 			readahead_issued = 1;
4647 			mutex_enter(&rp->r_statelock);
4648 			/*
4649 			 * set readahead offset to
4650 			 * offset of last async readahead
4651 			 * request.
4652 			 */
4653 			rp->r_nextr = rablkoff;
4654 		}
4655 		mutex_exit(&rp->r_statelock);
4656 	}
4657 
4658 again:
4659 	if ((pagefound = page_exists(vp, off)) == NULL) {
4660 		if (pl == NULL) {
4661 			(void) nfs_async_readahead(vp, blkoff, addr, seg, cr,
4662 			    nfs3_readahead);
4663 		} else if (rw == S_CREATE) {
4664 			/*
4665 			 * Block for this page is not allocated, or the offset
4666 			 * is beyond the current allocation size, or we're
4667 			 * allocating a swap slot and the page was not found,
4668 			 * so allocate it and return a zero page.
4669 			 */
4670 			if ((pp = page_create_va(vp, off,
4671 			    PAGESIZE, PG_WAIT, seg, addr)) == NULL)
4672 				cmn_err(CE_PANIC, "nfs3_getapage: page_create");
4673 			io_len = PAGESIZE;
4674 			mutex_enter(&rp->r_statelock);
4675 			rp->r_nextr = off + PAGESIZE;
4676 			mutex_exit(&rp->r_statelock);
4677 		} else {
4678 			/*
4679 			 * Need to go to server to get a BLOCK, exception to
4680 			 * that being while reading at offset = 0 or doing
4681 			 * random i/o, in that case read only a PAGE.
4682 			 */
4683 			mutex_enter(&rp->r_statelock);
4684 			if (blkoff < rp->r_size &&
4685 			    blkoff + bsize >= rp->r_size) {
4686 				/*
4687 				 * If only a block or less is left in
4688 				 * the file, read all that is remaining.
4689 				 */
4690 				if (rp->r_size <= off) {
4691 					/*
4692 					 * Trying to access beyond EOF,
4693 					 * set up to get at least one page.
4694 					 */
4695 					blksize = off + PAGESIZE - blkoff;
4696 				} else
4697 					blksize = rp->r_size - blkoff;
4698 			} else if ((off == 0) ||
4699 			    (off != rp->r_nextr && !readahead_issued)) {
4700 				blksize = PAGESIZE;
4701 				blkoff = off; /* block = page here */
4702 			} else
4703 				blksize = bsize;
4704 			mutex_exit(&rp->r_statelock);
4705 
4706 			pp = pvn_read_kluster(vp, off, seg, addr, &io_off,
4707 			    &io_len, blkoff, blksize, 0);
4708 
4709 			/*
4710 			 * Some other thread has entered the page,
4711 			 * so just use it.
4712 			 */
4713 			if (pp == NULL)
4714 				goto again;
4715 
4716 			/*
4717 			 * Now round the request size up to page boundaries.
4718 			 * This ensures that the entire page will be
4719 			 * initialized to zeroes if EOF is encountered.
4720 			 */
4721 			io_len = ptob(btopr(io_len));
4722 
4723 			bp = pageio_setup(pp, io_len, vp, B_READ);
4724 			ASSERT(bp != NULL);
4725 
4726 			/*
4727 			 * pageio_setup should have set b_addr to 0.  This
4728 			 * is correct since we want to do I/O on a page
4729 			 * boundary.  bp_mapin will use this addr to calculate
4730 			 * an offset, and then set b_addr to the kernel virtual
4731 			 * address it allocated for us.
4732 			 */
4733 			ASSERT(bp->b_un.b_addr == 0);
4734 
4735 			bp->b_edev = 0;
4736 			bp->b_dev = 0;
4737 			bp->b_lblkno = lbtodb(io_off);
4738 			bp->b_file = vp;
4739 			bp->b_offset = (offset_t)off;
4740 			bp_mapin(bp);
4741 
4742 			/*
4743 			 * If doing a write beyond what we believe is EOF,
4744 			 * don't bother trying to read the pages from the
4745 			 * server, we'll just zero the pages here.  We
4746 			 * don't check that the rw flag is S_WRITE here
4747 			 * because some implementations may attempt a
4748 			 * read access to the buffer before copying data.
4749 			 */
4750 			mutex_enter(&rp->r_statelock);
4751 			if (io_off >= rp->r_size && seg == segkmap) {
4752 				mutex_exit(&rp->r_statelock);
4753 				bzero(bp->b_un.b_addr, io_len);
4754 			} else {
4755 				mutex_exit(&rp->r_statelock);
4756 				error = nfs3_bio(bp, NULL, cr);
4757 			}
4758 
4759 			/*
4760 			 * Unmap the buffer before freeing it.
4761 			 */
4762 			bp_mapout(bp);
4763 			pageio_done(bp);
4764 
4765 			savepp = pp;
4766 			do {
4767 				pp->p_fsdata = C_NOCOMMIT;
4768 			} while ((pp = pp->p_next) != savepp);
4769 
4770 			if (error == NFS_EOF) {
4771 				/*
4772 				 * If doing a write system call just return
4773 				 * zeroed pages, else user tried to get pages
4774 				 * beyond EOF, return error.  We don't check
4775 				 * that the rw flag is S_WRITE here because
4776 				 * some implementations may attempt a read
4777 				 * access to the buffer before copying data.
4778 				 */
4779 				if (seg == segkmap)
4780 					error = 0;
4781 				else
4782 					error = EFAULT;
4783 			}
4784 
4785 			if (!readahead_issued && !error) {
4786 				mutex_enter(&rp->r_statelock);
4787 				rp->r_nextr = io_off + io_len;
4788 				mutex_exit(&rp->r_statelock);
4789 			}
4790 		}
4791 	}
4792 
4793 out:
4794 	if (pl == NULL)
4795 		return (error);
4796 
4797 	if (error) {
4798 		if (pp != NULL)
4799 			pvn_read_done(pp, B_ERROR);
4800 		return (error);
4801 	}
4802 
4803 	if (pagefound) {
4804 		se_t se = (rw == S_CREATE ? SE_EXCL : SE_SHARED);
4805 
4806 		/*
4807 		 * Page exists in the cache, acquire the appropriate lock.
4808 		 * If this fails, start all over again.
4809 		 */
4810 		if ((pp = page_lookup(vp, off, se)) == NULL) {
4811 #ifdef DEBUG
4812 			nfs3_lostpage++;
4813 #endif
4814 			goto reread;
4815 		}
4816 		pl[0] = pp;
4817 		pl[1] = NULL;
4818 		return (0);
4819 	}
4820 
4821 	if (pp != NULL)
4822 		pvn_plist_init(pp, pl, plsz, off, io_len, rw);
4823 
4824 	return (error);
4825 }
4826 
4827 static void
4828 nfs3_readahead(vnode_t *vp, u_offset_t blkoff, caddr_t addr, struct seg *seg,
4829 	cred_t *cr)
4830 {
4831 	int error;
4832 	page_t *pp;
4833 	u_offset_t io_off;
4834 	size_t io_len;
4835 	struct buf *bp;
4836 	uint_t bsize, blksize;
4837 	rnode_t *rp = VTOR(vp);
4838 	page_t *savepp;
4839 
4840 	ASSERT(nfs_zone() == VTOMI(vp)->mi_zone);
4841 	bsize = MAX(vp->v_vfsp->vfs_bsize, PAGESIZE);
4842 
4843 	mutex_enter(&rp->r_statelock);
4844 	if (blkoff < rp->r_size && blkoff + bsize > rp->r_size) {
4845 		/*
4846 		 * If less than a block left in file read less
4847 		 * than a block.
4848 		 */
4849 		blksize = rp->r_size - blkoff;
4850 	} else
4851 		blksize = bsize;
4852 	mutex_exit(&rp->r_statelock);
4853 
4854 	pp = pvn_read_kluster(vp, blkoff, segkmap, addr,
4855 	    &io_off, &io_len, blkoff, blksize, 1);
4856 	/*
4857 	 * The isra flag passed to the kluster function is 1, we may have
4858 	 * gotten a return value of NULL for a variety of reasons (# of free
4859 	 * pages < minfree, someone entered the page on the vnode etc). In all
4860 	 * cases, we want to punt on the readahead.
4861 	 */
4862 	if (pp == NULL)
4863 		return;
4864 
4865 	/*
4866 	 * Now round the request size up to page boundaries.
4867 	 * This ensures that the entire page will be
4868 	 * initialized to zeroes if EOF is encountered.
4869 	 */
4870 	io_len = ptob(btopr(io_len));
4871 
4872 	bp = pageio_setup(pp, io_len, vp, B_READ);
4873 	ASSERT(bp != NULL);
4874 
4875 	/*
4876 	 * pageio_setup should have set b_addr to 0.  This is correct since
4877 	 * we want to do I/O on a page boundary. bp_mapin() will use this addr
4878 	 * to calculate an offset, and then set b_addr to the kernel virtual
4879 	 * address it allocated for us.
4880 	 */
4881 	ASSERT(bp->b_un.b_addr == 0);
4882 
4883 	bp->b_edev = 0;
4884 	bp->b_dev = 0;
4885 	bp->b_lblkno = lbtodb(io_off);
4886 	bp->b_file = vp;
4887 	bp->b_offset = (offset_t)blkoff;
4888 	bp_mapin(bp);
4889 
4890 	/*
4891 	 * If doing a write beyond what we believe is EOF, don't bother trying
4892 	 * to read the pages from the server, we'll just zero the pages here.
4893 	 * We don't check that the rw flag is S_WRITE here because some
4894 	 * implementations may attempt a read access to the buffer before
4895 	 * copying data.
4896 	 */
4897 	mutex_enter(&rp->r_statelock);
4898 	if (io_off >= rp->r_size && seg == segkmap) {
4899 		mutex_exit(&rp->r_statelock);
4900 		bzero(bp->b_un.b_addr, io_len);
4901 		error = 0;
4902 	} else {
4903 		mutex_exit(&rp->r_statelock);
4904 		error = nfs3_bio(bp, NULL, cr);
4905 		if (error == NFS_EOF)
4906 			error = 0;
4907 	}
4908 
4909 	/*
4910 	 * Unmap the buffer before freeing it.
4911 	 */
4912 	bp_mapout(bp);
4913 	pageio_done(bp);
4914 
4915 	savepp = pp;
4916 	do {
4917 		pp->p_fsdata = C_NOCOMMIT;
4918 	} while ((pp = pp->p_next) != savepp);
4919 
4920 	pvn_read_done(pp, error ? B_READ | B_ERROR : B_READ);
4921 
4922 	/*
4923 	 * In case of error set readahead offset
4924 	 * to the lowest offset.
4925 	 * pvn_read_done() calls VN_DISPOSE to destroy the pages
4926 	 */
4927 	if (error && rp->r_nextr > io_off) {
4928 		mutex_enter(&rp->r_statelock);
4929 		if (rp->r_nextr > io_off)
4930 			rp->r_nextr = io_off;
4931 		mutex_exit(&rp->r_statelock);
4932 	}
4933 }
4934 
4935 /*
4936  * Flags are composed of {B_INVAL, B_FREE, B_DONTNEED, B_FORCE}
4937  * If len == 0, do from off to EOF.
4938  *
4939  * The normal cases should be len == 0 && off == 0 (entire vp list),
4940  * len == MAXBSIZE (from segmap_release actions), and len == PAGESIZE
4941  * (from pageout).
4942  */
4943 /* ARGSUSED */
4944 static int
4945 nfs3_putpage(vnode_t *vp, offset_t off, size_t len, int flags, cred_t *cr,
4946 	caller_context_t *ct)
4947 {
4948 	int error;
4949 	rnode_t *rp;
4950 
4951 	ASSERT(cr != NULL);
4952 
4953 	/*
4954 	 * XXX - Why should this check be made here?
4955 	 */
4956 	if (vp->v_flag & VNOMAP)
4957 		return (ENOSYS);
4958 	if (len == 0 && !(flags & B_INVAL) && vn_is_readonly(vp))
4959 		return (0);
4960 	if (!(flags & B_ASYNC) && nfs_zone() != VTOMI(vp)->mi_zone)
4961 		return (EIO);
4962 
4963 	rp = VTOR(vp);
4964 	mutex_enter(&rp->r_statelock);
4965 	rp->r_count++;
4966 	mutex_exit(&rp->r_statelock);
4967 	error = nfs_putpages(vp, off, len, flags, cr);
4968 	mutex_enter(&rp->r_statelock);
4969 	rp->r_count--;
4970 	cv_broadcast(&rp->r_cv);
4971 	mutex_exit(&rp->r_statelock);
4972 
4973 	return (error);
4974 }
4975 
4976 /*
4977  * Write out a single page, possibly klustering adjacent dirty pages.
4978  */
4979 int
4980 nfs3_putapage(vnode_t *vp, page_t *pp, u_offset_t *offp, size_t *lenp,
4981 	int flags, cred_t *cr)
4982 {
4983 	u_offset_t io_off;
4984 	u_offset_t lbn_off;
4985 	u_offset_t lbn;
4986 	size_t io_len;
4987 	uint_t bsize;
4988 	int error;
4989 	rnode_t *rp;
4990 
4991 	ASSERT(!vn_is_readonly(vp));
4992 	ASSERT(pp != NULL);
4993 	ASSERT(cr != NULL);
4994 	ASSERT((flags & B_ASYNC) || nfs_zone() == VTOMI(vp)->mi_zone);
4995 
4996 	rp = VTOR(vp);
4997 	ASSERT(rp->r_count > 0);
4998 
4999 	bsize = MAX(vp->v_vfsp->vfs_bsize, PAGESIZE);
5000 	lbn = pp->p_offset / bsize;
5001 	lbn_off = lbn * bsize;
5002 
5003 	/*
5004 	 * Find a kluster that fits in one block, or in
5005 	 * one page if pages are bigger than blocks.  If
5006 	 * there is less file space allocated than a whole
5007 	 * page, we'll shorten the i/o request below.
5008 	 */
5009 	pp = pvn_write_kluster(vp, pp, &io_off, &io_len, lbn_off,
5010 	    roundup(bsize, PAGESIZE), flags);
5011 
5012 	/*
5013 	 * pvn_write_kluster shouldn't have returned a page with offset
5014 	 * behind the original page we were given.  Verify that.
5015 	 */
5016 	ASSERT((pp->p_offset / bsize) >= lbn);
5017 
5018 	/*
5019 	 * Now pp will have the list of kept dirty pages marked for
5020 	 * write back.  It will also handle invalidation and freeing
5021 	 * of pages that are not dirty.  Check for page length rounding
5022 	 * problems.
5023 	 */
5024 	if (io_off + io_len > lbn_off + bsize) {
5025 		ASSERT((io_off + io_len) - (lbn_off + bsize) < PAGESIZE);
5026 		io_len = lbn_off + bsize - io_off;
5027 	}
5028 	/*
5029 	 * The RMODINPROGRESS flag makes sure that nfs(3)_bio() sees a
5030 	 * consistent value of r_size. RMODINPROGRESS is set in writerp().
5031 	 * When RMODINPROGRESS is set it indicates that a uiomove() is in
5032 	 * progress and the r_size has not been made consistent with the
5033 	 * new size of the file. When the uiomove() completes the r_size is
5034 	 * updated and the RMODINPROGRESS flag is cleared.
5035 	 *
5036 	 * The RMODINPROGRESS flag makes sure that nfs(3)_bio() sees a
5037 	 * consistent value of r_size. Without this handshaking, it is
5038 	 * possible that nfs(3)_bio() picks  up the old value of r_size
5039 	 * before the uiomove() in writerp() completes. This will result
5040 	 * in the write through nfs(3)_bio() being dropped.
5041 	 *
5042 	 * More precisely, there is a window between the time the uiomove()
5043 	 * completes and the time the r_size is updated. If a VOP_PUTPAGE()
5044 	 * operation intervenes in this window, the page will be picked up,
5045 	 * because it is dirty (it will be unlocked, unless it was
5046 	 * pagecreate'd). When the page is picked up as dirty, the dirty
5047 	 * bit is reset (pvn_getdirty()). In nfs(3)write(), r_size is
5048 	 * checked. This will still be the old size. Therefore the page will
5049 	 * not be written out. When segmap_release() calls VOP_PUTPAGE(),
5050 	 * the page will be found to be clean and the write will be dropped.
5051 	 */
5052 	if (rp->r_flags & RMODINPROGRESS) {
5053 		mutex_enter(&rp->r_statelock);
5054 		if ((rp->r_flags & RMODINPROGRESS) &&
5055 		    rp->r_modaddr + MAXBSIZE > io_off &&
5056 		    rp->r_modaddr < io_off + io_len) {
5057 			page_t *plist;
5058 			/*
5059 			 * A write is in progress for this region of the file.
5060 			 * If we did not detect RMODINPROGRESS here then this
5061 			 * path through nfs_putapage() would eventually go to
5062 			 * nfs(3)_bio() and may not write out all of the data
5063 			 * in the pages. We end up losing data. So we decide
5064 			 * to set the modified bit on each page in the page
5065 			 * list and mark the rnode with RDIRTY. This write
5066 			 * will be restarted at some later time.
5067 			 */
5068 			plist = pp;
5069 			while (plist != NULL) {
5070 				pp = plist;
5071 				page_sub(&plist, pp);
5072 				hat_setmod(pp);
5073 				page_io_unlock(pp);
5074 				page_unlock(pp);
5075 			}
5076 			rp->r_flags |= RDIRTY;
5077 			mutex_exit(&rp->r_statelock);
5078 			if (offp)
5079 				*offp = io_off;
5080 			if (lenp)
5081 				*lenp = io_len;
5082 			return (0);
5083 		}
5084 		mutex_exit(&rp->r_statelock);
5085 	}
5086 
5087 	if (flags & B_ASYNC) {
5088 		error = nfs_async_putapage(vp, pp, io_off, io_len, flags, cr,
5089 		    nfs3_sync_putapage);
5090 	} else
5091 		error = nfs3_sync_putapage(vp, pp, io_off, io_len, flags, cr);
5092 
5093 	if (offp)
5094 		*offp = io_off;
5095 	if (lenp)
5096 		*lenp = io_len;
5097 	return (error);
5098 }
5099 
5100 static int
5101 nfs3_sync_putapage(vnode_t *vp, page_t *pp, u_offset_t io_off, size_t io_len,
5102 	int flags, cred_t *cr)
5103 {
5104 	int error;
5105 	rnode_t *rp;
5106 
5107 	ASSERT(nfs_zone() == VTOMI(vp)->mi_zone);
5108 
5109 	flags |= B_WRITE;
5110 
5111 	error = nfs3_rdwrlbn(vp, pp, io_off, io_len, flags, cr);
5112 
5113 	rp = VTOR(vp);
5114 
5115 	if ((error == ENOSPC || error == EDQUOT || error == EFBIG ||
5116 	    error == EACCES) &&
5117 	    (flags & (B_INVAL|B_FORCE)) != (B_INVAL|B_FORCE)) {
5118 		if (!(rp->r_flags & ROUTOFSPACE)) {
5119 			mutex_enter(&rp->r_statelock);
5120 			rp->r_flags |= ROUTOFSPACE;
5121 			mutex_exit(&rp->r_statelock);
5122 		}
5123 		flags |= B_ERROR;
5124 		pvn_write_done(pp, flags);
5125 		/*
5126 		 * If this was not an async thread, then try again to
5127 		 * write out the pages, but this time, also destroy
5128 		 * them whether or not the write is successful.  This
5129 		 * will prevent memory from filling up with these
5130 		 * pages and destroying them is the only alternative
5131 		 * if they can't be written out.
5132 		 *
5133 		 * Don't do this if this is an async thread because
5134 		 * when the pages are unlocked in pvn_write_done,
5135 		 * some other thread could have come along, locked
5136 		 * them, and queued for an async thread.  It would be
5137 		 * possible for all of the async threads to be tied
5138 		 * up waiting to lock the pages again and they would
5139 		 * all already be locked and waiting for an async
5140 		 * thread to handle them.  Deadlock.
5141 		 */
5142 		if (!(flags & B_ASYNC)) {
5143 			error = nfs3_putpage(vp, io_off, io_len,
5144 			    B_INVAL | B_FORCE, cr, NULL);
5145 		}
5146 	} else {
5147 		if (error)
5148 			flags |= B_ERROR;
5149 		else if (rp->r_flags & ROUTOFSPACE) {
5150 			mutex_enter(&rp->r_statelock);
5151 			rp->r_flags &= ~ROUTOFSPACE;
5152 			mutex_exit(&rp->r_statelock);
5153 		}
5154 		pvn_write_done(pp, flags);
5155 		if (freemem < desfree)
5156 			(void) nfs3_commit_vp(vp, (u_offset_t)0, 0, cr);
5157 	}
5158 
5159 	return (error);
5160 }
5161 
5162 /* ARGSUSED */
5163 static int
5164 nfs3_map(vnode_t *vp, offset_t off, struct as *as, caddr_t *addrp,
5165 	size_t len, uchar_t prot, uchar_t maxprot, uint_t flags,
5166 	cred_t *cr, caller_context_t *ct)
5167 {
5168 	struct segvn_crargs vn_a;
5169 	int error;
5170 	rnode_t *rp;
5171 	struct vattr va;
5172 
5173 	if (nfs_zone() != VTOMI(vp)->mi_zone)
5174 		return (EIO);
5175 
5176 	if (vp->v_flag & VNOMAP)
5177 		return (ENOSYS);
5178 
5179 	if (off < 0 || off + len < 0)
5180 		return (ENXIO);
5181 
5182 	if (vp->v_type != VREG)
5183 		return (ENODEV);
5184 
5185 	/*
5186 	 * If there is cached data and if close-to-open consistency
5187 	 * checking is not turned off and if the file system is not
5188 	 * mounted readonly, then force an over the wire getattr.
5189 	 * Otherwise, just invoke nfs3getattr to get a copy of the
5190 	 * attributes.  The attribute cache will be used unless it
5191 	 * is timed out and if it is, then an over the wire getattr
5192 	 * will be issued.
5193 	 */
5194 	va.va_mask = AT_ALL;
5195 	if (vn_has_cached_data(vp) &&
5196 	    !(VTOMI(vp)->mi_flags & MI_NOCTO) && !vn_is_readonly(vp))
5197 		error = nfs3_getattr_otw(vp, &va, cr);
5198 	else
5199 		error = nfs3getattr(vp, &va, cr);
5200 	if (error)
5201 		return (error);
5202 
5203 	/*
5204 	 * Check to see if the vnode is currently marked as not cachable.
5205 	 * This means portions of the file are locked (through VOP_FRLOCK).
5206 	 * In this case the map request must be refused.  We use
5207 	 * rp->r_lkserlock to avoid a race with concurrent lock requests.
5208 	 */
5209 	rp = VTOR(vp);
5210 	if (nfs_rw_enter_sig(&rp->r_lkserlock, RW_READER, INTR(vp)))
5211 		return (EINTR);
5212 
5213 	if (vp->v_flag & VNOCACHE) {
5214 		error = EAGAIN;
5215 		goto done;
5216 	}
5217 
5218 	/*
5219 	 * Don't allow concurrent locks and mapping if mandatory locking is
5220 	 * enabled.
5221 	 */
5222 	if ((flk_has_remote_locks(vp) || lm_has_sleep(vp)) &&
5223 	    MANDLOCK(vp, va.va_mode)) {
5224 		error = EAGAIN;
5225 		goto done;
5226 	}
5227 
5228 	as_rangelock(as);
5229 	error = choose_addr(as, addrp, len, off, ADDR_VACALIGN, flags);
5230 	if (error != 0) {
5231 		as_rangeunlock(as);
5232 		goto done;
5233 	}
5234 
5235 	vn_a.vp = vp;
5236 	vn_a.offset = off;
5237 	vn_a.type = (flags & MAP_TYPE);
5238 	vn_a.prot = (uchar_t)prot;
5239 	vn_a.maxprot = (uchar_t)maxprot;
5240 	vn_a.flags = (flags & ~MAP_TYPE);
5241 	vn_a.cred = cr;
5242 	vn_a.amp = NULL;
5243 	vn_a.szc = 0;
5244 	vn_a.lgrp_mem_policy_flags = 0;
5245 
5246 	error = as_map(as, *addrp, len, segvn_create, &vn_a);
5247 	as_rangeunlock(as);
5248 
5249 done:
5250 	nfs_rw_exit(&rp->r_lkserlock);
5251 	return (error);
5252 }
5253 
5254 /* ARGSUSED */
5255 static int
5256 nfs3_addmap(vnode_t *vp, offset_t off, struct as *as, caddr_t addr,
5257 	size_t len, uchar_t prot, uchar_t maxprot, uint_t flags,
5258 	cred_t *cr, caller_context_t *ct)
5259 {
5260 	rnode_t *rp;
5261 
5262 	if (vp->v_flag & VNOMAP)
5263 		return (ENOSYS);
5264 	if (nfs_zone() != VTOMI(vp)->mi_zone)
5265 		return (EIO);
5266 
5267 	/*
5268 	 * Need to hold rwlock while incrementing the mapcnt so that
5269 	 * mmap'ing can be serialized with writes so that the caching
5270 	 * can be handled correctly.
5271 	 */
5272 	rp = VTOR(vp);
5273 	if (nfs_rw_enter_sig(&rp->r_rwlock, RW_WRITER, INTR(vp)))
5274 		return (EINTR);
5275 	atomic_add_long((ulong_t *)&rp->r_mapcnt, btopr(len));
5276 	nfs_rw_exit(&rp->r_rwlock);
5277 
5278 	return (0);
5279 }
5280 
5281 /* ARGSUSED */
5282 static int
5283 nfs3_frlock(vnode_t *vp, int cmd, struct flock64 *bfp, int flag,
5284 	offset_t offset, struct flk_callback *flk_cbp, cred_t *cr,
5285 	caller_context_t *ct)
5286 {
5287 	netobj lm_fh3;
5288 	int rc;
5289 	u_offset_t start, end;
5290 	rnode_t *rp;
5291 	int error = 0, intr = INTR(vp);
5292 
5293 	if (nfs_zone() != VTOMI(vp)->mi_zone)
5294 		return (EIO);
5295 	/* check for valid cmd parameter */
5296 	if (cmd != F_GETLK && cmd != F_SETLK && cmd != F_SETLKW)
5297 		return (EINVAL);
5298 
5299 	/* Verify l_type. */
5300 	switch (bfp->l_type) {
5301 	case F_RDLCK:
5302 		if (cmd != F_GETLK && !(flag & FREAD))
5303 			return (EBADF);
5304 		break;
5305 	case F_WRLCK:
5306 		if (cmd != F_GETLK && !(flag & FWRITE))
5307 			return (EBADF);
5308 		break;
5309 	case F_UNLCK:
5310 		intr = 0;
5311 		break;
5312 
5313 	default:
5314 		return (EINVAL);
5315 	}
5316 
5317 	/* check the validity of the lock range */
5318 	if (rc = flk_convert_lock_data(vp, bfp, &start, &end, offset))
5319 		return (rc);
5320 	if (rc = flk_check_lock_data(start, end, MAXEND))
5321 		return (rc);
5322 
5323 	/*
5324 	 * If the filesystem is mounted using local locking, pass the
5325 	 * request off to the local locking code.
5326 	 */
5327 	if (VTOMI(vp)->mi_flags & MI_LLOCK) {
5328 		if (cmd == F_SETLK || cmd == F_SETLKW) {
5329 			/*
5330 			 * For complete safety, we should be holding
5331 			 * r_lkserlock.  However, we can't call
5332 			 * lm_safelock and then fs_frlock while
5333 			 * holding r_lkserlock, so just invoke
5334 			 * lm_safelock and expect that this will
5335 			 * catch enough of the cases.
5336 			 */
5337 			if (!lm_safelock(vp, bfp, cr))
5338 				return (EAGAIN);
5339 		}
5340 		return (fs_frlock(vp, cmd, bfp, flag, offset, flk_cbp, cr, ct));
5341 	}
5342 
5343 	rp = VTOR(vp);
5344 
5345 	/*
5346 	 * Check whether the given lock request can proceed, given the
5347 	 * current file mappings.
5348 	 */
5349 	if (nfs_rw_enter_sig(&rp->r_lkserlock, RW_WRITER, intr))
5350 		return (EINTR);
5351 	if (cmd == F_SETLK || cmd == F_SETLKW) {
5352 		if (!lm_safelock(vp, bfp, cr)) {
5353 			rc = EAGAIN;
5354 			goto done;
5355 		}
5356 	}
5357 
5358 	/*
5359 	 * Flush the cache after waiting for async I/O to finish.  For new
5360 	 * locks, this is so that the process gets the latest bits from the
5361 	 * server.  For unlocks, this is so that other clients see the
5362 	 * latest bits once the file has been unlocked.  If currently dirty
5363 	 * pages can't be flushed, then don't allow a lock to be set.  But
5364 	 * allow unlocks to succeed, to avoid having orphan locks on the
5365 	 * server.
5366 	 */
5367 	if (cmd != F_GETLK) {
5368 		mutex_enter(&rp->r_statelock);
5369 		while (rp->r_count > 0) {
5370 			if (intr) {
5371 				klwp_t *lwp = ttolwp(curthread);
5372 
5373 				if (lwp != NULL)
5374 					lwp->lwp_nostop++;
5375 				if (cv_wait_sig(&rp->r_cv,
5376 				    &rp->r_statelock) == 0) {
5377 					if (lwp != NULL)
5378 						lwp->lwp_nostop--;
5379 					rc = EINTR;
5380 					break;
5381 				}
5382 				if (lwp != NULL)
5383 					lwp->lwp_nostop--;
5384 			} else
5385 				cv_wait(&rp->r_cv, &rp->r_statelock);
5386 		}
5387 		mutex_exit(&rp->r_statelock);
5388 		if (rc != 0)
5389 			goto done;
5390 		error = nfs3_putpage(vp, (offset_t)0, 0, B_INVAL, cr, ct);
5391 		if (error) {
5392 			if (error == ENOSPC || error == EDQUOT) {
5393 				mutex_enter(&rp->r_statelock);
5394 				if (!rp->r_error)
5395 					rp->r_error = error;
5396 				mutex_exit(&rp->r_statelock);
5397 			}
5398 			if (bfp->l_type != F_UNLCK) {
5399 				rc = ENOLCK;
5400 				goto done;
5401 			}
5402 		}
5403 	}
5404 
5405 	lm_fh3.n_len = VTOFH3(vp)->fh3_length;
5406 	lm_fh3.n_bytes = (char *)&(VTOFH3(vp)->fh3_u.data);
5407 
5408 	/*
5409 	 * Call the lock manager to do the real work of contacting
5410 	 * the server and obtaining the lock.
5411 	 */
5412 	rc = lm4_frlock(vp, cmd, bfp, flag, offset, cr, &lm_fh3, flk_cbp);
5413 
5414 	if (rc == 0)
5415 		nfs_lockcompletion(vp, cmd);
5416 
5417 done:
5418 	nfs_rw_exit(&rp->r_lkserlock);
5419 	return (rc);
5420 }
5421 
5422 /*
5423  * Free storage space associated with the specified vnode.  The portion
5424  * to be freed is specified by bfp->l_start and bfp->l_len (already
5425  * normalized to a "whence" of 0).
5426  *
5427  * This is an experimental facility whose continued existence is not
5428  * guaranteed.  Currently, we only support the special case
5429  * of l_len == 0, meaning free to end of file.
5430  */
5431 /* ARGSUSED */
5432 static int
5433 nfs3_space(vnode_t *vp, int cmd, struct flock64 *bfp, int flag,
5434 	offset_t offset, cred_t *cr, caller_context_t *ct)
5435 {
5436 	int error;
5437 
5438 	ASSERT(vp->v_type == VREG);
5439 	if (cmd != F_FREESP)
5440 		return (EINVAL);
5441 	if (nfs_zone() != VTOMI(vp)->mi_zone)
5442 		return (EIO);
5443 
5444 	error = convoff(vp, bfp, 0, offset);
5445 	if (!error) {
5446 		ASSERT(bfp->l_start >= 0);
5447 		if (bfp->l_len == 0) {
5448 			struct vattr va;
5449 
5450 			/*
5451 			 * ftruncate should not change the ctime and
5452 			 * mtime if we truncate the file to its
5453 			 * previous size.
5454 			 */
5455 			va.va_mask = AT_SIZE;
5456 			error = nfs3getattr(vp, &va, cr);
5457 			if (error || va.va_size == bfp->l_start)
5458 				return (error);
5459 			va.va_mask = AT_SIZE;
5460 			va.va_size = bfp->l_start;
5461 			error = nfs3setattr(vp, &va, 0, cr);
5462 		} else
5463 			error = EINVAL;
5464 	}
5465 
5466 	return (error);
5467 }
5468 
5469 /* ARGSUSED */
5470 static int
5471 nfs3_realvp(vnode_t *vp, vnode_t **vpp, caller_context_t *ct)
5472 {
5473 
5474 	return (EINVAL);
5475 }
5476 
5477 /*
5478  * Setup and add an address space callback to do the work of the delmap call.
5479  * The callback will (and must be) deleted in the actual callback function.
5480  *
5481  * This is done in order to take care of the problem that we have with holding
5482  * the address space's a_lock for a long period of time (e.g. if the NFS server
5483  * is down).  Callbacks will be executed in the address space code while the
5484  * a_lock is not held.	Holding the address space's a_lock causes things such
5485  * as ps and fork to hang because they are trying to acquire this lock as well.
5486  */
5487 /* ARGSUSED */
5488 static int
5489 nfs3_delmap(vnode_t *vp, offset_t off, struct as *as, caddr_t addr,
5490 	size_t len, uint_t prot, uint_t maxprot, uint_t flags,
5491 	cred_t *cr, caller_context_t *ct)
5492 {
5493 	int			caller_found;
5494 	int			error;
5495 	rnode_t			*rp;
5496 	nfs_delmap_args_t	*dmapp;
5497 	nfs_delmapcall_t	*delmap_call;
5498 
5499 	if (vp->v_flag & VNOMAP)
5500 		return (ENOSYS);
5501 	/*
5502 	 * A process may not change zones if it has NFS pages mmap'ed
5503 	 * in, so we can't legitimately get here from the wrong zone.
5504 	 */
5505 	ASSERT(nfs_zone() == VTOMI(vp)->mi_zone);
5506 
5507 	rp = VTOR(vp);
5508 
5509 	/*
5510 	 * The way that the address space of this process deletes its mapping
5511 	 * of this file is via the following call chains:
5512 	 * - as_free()->SEGOP_UNMAP()/segvn_unmap()->VOP_DELMAP()/nfs3_delmap()
5513 	 * - as_unmap()->SEGOP_UNMAP()/segvn_unmap()->VOP_DELMAP()/nfs3_delmap()
5514 	 *
5515 	 * With the use of address space callbacks we are allowed to drop the
5516 	 * address space lock, a_lock, while executing the NFS operations that
5517 	 * need to go over the wire.  Returning EAGAIN to the caller of this
5518 	 * function is what drives the execution of the callback that we add
5519 	 * below.  The callback will be executed by the address space code
5520 	 * after dropping the a_lock.  When the callback is finished, since
5521 	 * we dropped the a_lock, it must be re-acquired and segvn_unmap()
5522 	 * is called again on the same segment to finish the rest of the work
5523 	 * that needs to happen during unmapping.
5524 	 *
5525 	 * This action of calling back into the segment driver causes
5526 	 * nfs3_delmap() to get called again, but since the callback was
5527 	 * already executed at this point, it already did the work and there
5528 	 * is nothing left for us to do.
5529 	 *
5530 	 * To Summarize:
5531 	 * - The first time nfs3_delmap is called by the current thread is when
5532 	 * we add the caller associated with this delmap to the delmap caller
5533 	 * list, add the callback, and return EAGAIN.
5534 	 * - The second time in this call chain when nfs3_delmap is called we
5535 	 * will find this caller in the delmap caller list and realize there
5536 	 * is no more work to do thus removing this caller from the list and
5537 	 * returning the error that was set in the callback execution.
5538 	 */
5539 	caller_found = nfs_find_and_delete_delmapcall(rp, &error);
5540 	if (caller_found) {
5541 		/*
5542 		 * 'error' is from the actual delmap operations.  To avoid
5543 		 * hangs, we need to handle the return of EAGAIN differently
5544 		 * since this is what drives the callback execution.
5545 		 * In this case, we don't want to return EAGAIN and do the
5546 		 * callback execution because there are none to execute.
5547 		 */
5548 		if (error == EAGAIN)
5549 			return (0);
5550 		else
5551 			return (error);
5552 	}
5553 
5554 	/* current caller was not in the list */
5555 	delmap_call = nfs_init_delmapcall();
5556 
5557 	mutex_enter(&rp->r_statelock);
5558 	list_insert_tail(&rp->r_indelmap, delmap_call);
5559 	mutex_exit(&rp->r_statelock);
5560 
5561 	dmapp = kmem_alloc(sizeof (nfs_delmap_args_t), KM_SLEEP);
5562 
5563 	dmapp->vp = vp;
5564 	dmapp->off = off;
5565 	dmapp->addr = addr;
5566 	dmapp->len = len;
5567 	dmapp->prot = prot;
5568 	dmapp->maxprot = maxprot;
5569 	dmapp->flags = flags;
5570 	dmapp->cr = cr;
5571 	dmapp->caller = delmap_call;
5572 
5573 	error = as_add_callback(as, nfs3_delmap_callback, dmapp,
5574 	    AS_UNMAP_EVENT, addr, len, KM_SLEEP);
5575 
5576 	return (error ? error : EAGAIN);
5577 }
5578 
5579 /*
5580  * Remove some pages from an mmap'd vnode.  Just update the
5581  * count of pages.  If doing close-to-open, then flush and
5582  * commit all of the pages associated with this file.
5583  * Otherwise, start an asynchronous page flush to write out
5584  * any dirty pages.  This will also associate a credential
5585  * with the rnode which can be used to write the pages.
5586  */
5587 /* ARGSUSED */
5588 static void
5589 nfs3_delmap_callback(struct as *as, void *arg, uint_t event)
5590 {
5591 	int			error;
5592 	rnode_t			*rp;
5593 	mntinfo_t		*mi;
5594 	nfs_delmap_args_t	*dmapp = (nfs_delmap_args_t *)arg;
5595 
5596 	rp = VTOR(dmapp->vp);
5597 	mi = VTOMI(dmapp->vp);
5598 
5599 	atomic_add_long((ulong_t *)&rp->r_mapcnt, -btopr(dmapp->len));
5600 	ASSERT(rp->r_mapcnt >= 0);
5601 
5602 	/*
5603 	 * Initiate a page flush and potential commit if there are
5604 	 * pages, the file system was not mounted readonly, the segment
5605 	 * was mapped shared, and the pages themselves were writeable.
5606 	 */
5607 	if (vn_has_cached_data(dmapp->vp) && !vn_is_readonly(dmapp->vp) &&
5608 	    dmapp->flags == MAP_SHARED && (dmapp->maxprot & PROT_WRITE)) {
5609 		mutex_enter(&rp->r_statelock);
5610 		rp->r_flags |= RDIRTY;
5611 		mutex_exit(&rp->r_statelock);
5612 		/*
5613 		 * If this is a cross-zone access a sync putpage won't work, so
5614 		 * the best we can do is try an async putpage.  That seems
5615 		 * better than something more draconian such as discarding the
5616 		 * dirty pages.
5617 		 */
5618 		if ((mi->mi_flags & MI_NOCTO) ||
5619 		    nfs_zone() != mi->mi_zone)
5620 			error = nfs3_putpage(dmapp->vp, dmapp->off, dmapp->len,
5621 			    B_ASYNC, dmapp->cr, NULL);
5622 		else
5623 			error = nfs3_putpage_commit(dmapp->vp, dmapp->off,
5624 			    dmapp->len, dmapp->cr);
5625 		if (!error) {
5626 			mutex_enter(&rp->r_statelock);
5627 			error = rp->r_error;
5628 			rp->r_error = 0;
5629 			mutex_exit(&rp->r_statelock);
5630 		}
5631 	} else
5632 		error = 0;
5633 
5634 	if ((rp->r_flags & RDIRECTIO) || (mi->mi_flags & MI_DIRECTIO))
5635 		(void) nfs3_putpage(dmapp->vp, dmapp->off, dmapp->len,
5636 		    B_INVAL, dmapp->cr, NULL);
5637 
5638 	dmapp->caller->error = error;
5639 	(void) as_delete_callback(as, arg);
5640 	kmem_free(dmapp, sizeof (nfs_delmap_args_t));
5641 }
5642 
5643 static int nfs3_pathconf_disable_cache = 0;
5644 
5645 #ifdef DEBUG
5646 static int nfs3_pathconf_cache_hits = 0;
5647 static int nfs3_pathconf_cache_misses = 0;
5648 #endif
5649 
5650 /* ARGSUSED */
5651 static int
5652 nfs3_pathconf(vnode_t *vp, int cmd, ulong_t *valp, cred_t *cr,
5653 	caller_context_t *ct)
5654 {
5655 	int error;
5656 	PATHCONF3args args;
5657 	PATHCONF3res res;
5658 	int douprintf;
5659 	failinfo_t fi;
5660 	rnode_t *rp;
5661 	hrtime_t t;
5662 
5663 	if (nfs_zone() != VTOMI(vp)->mi_zone)
5664 		return (EIO);
5665 	/*
5666 	 * Large file spec - need to base answer on info stored
5667 	 * on original FSINFO response.
5668 	 */
5669 	if (cmd == _PC_FILESIZEBITS) {
5670 		unsigned long long ll;
5671 		long l = 1;
5672 
5673 		ll = VTOMI(vp)->mi_maxfilesize;
5674 
5675 		if (ll == 0) {
5676 			*valp = 0;
5677 			return (0);
5678 		}
5679 
5680 		if (ll & 0xffffffff00000000) {
5681 			l += 32; ll >>= 32;
5682 		}
5683 		if (ll & 0xffff0000) {
5684 			l += 16; ll >>= 16;
5685 		}
5686 		if (ll & 0xff00) {
5687 			l += 8; ll >>= 8;
5688 		}
5689 		if (ll & 0xf0) {
5690 			l += 4; ll >>= 4;
5691 		}
5692 		if (ll & 0xc) {
5693 			l += 2; ll >>= 2;
5694 		}
5695 		if (ll & 0x2)
5696 			l += 2;
5697 		else if (ll & 0x1)
5698 			l += 1;
5699 		*valp = l;
5700 		return (0);
5701 	}
5702 
5703 	if (cmd == _PC_ACL_ENABLED) {
5704 		*valp = _ACL_ACLENT_ENABLED;
5705 		return (0);
5706 	}
5707 
5708 	if (cmd == _PC_XATTR_EXISTS) {
5709 		error = 0;
5710 		*valp = 0;
5711 		if (vp->v_vfsp->vfs_flag & VFS_XATTR) {
5712 			vnode_t *avp;
5713 			rnode_t *rp;
5714 			int error = 0;
5715 			mntinfo_t *mi = VTOMI(vp);
5716 
5717 			if (!(mi->mi_flags & MI_EXTATTR))
5718 				return (0);
5719 
5720 			rp = VTOR(vp);
5721 			if (nfs_rw_enter_sig(&rp->r_rwlock, RW_READER,
5722 			    INTR(vp)))
5723 				return (EINTR);
5724 
5725 			error = nfs3lookup_dnlc(vp, XATTR_DIR_NAME, &avp, cr);
5726 			if (error || avp == NULL)
5727 				error = acl_getxattrdir3(vp, &avp, 0, cr, 0);
5728 
5729 			nfs_rw_exit(&rp->r_rwlock);
5730 
5731 			if (error == 0 && avp != NULL) {
5732 				error = do_xattr_exists_check(avp, valp, cr);
5733 				VN_RELE(avp);
5734 			} else if (error == ENOENT) {
5735 				error = 0;
5736 				*valp = 0;
5737 			}
5738 		}
5739 		return (error);
5740 	}
5741 
5742 	rp = VTOR(vp);
5743 	if (rp->r_pathconf != NULL) {
5744 		mutex_enter(&rp->r_statelock);
5745 		if (rp->r_pathconf != NULL && nfs3_pathconf_disable_cache) {
5746 			kmem_free(rp->r_pathconf, sizeof (*rp->r_pathconf));
5747 			rp->r_pathconf = NULL;
5748 		}
5749 		if (rp->r_pathconf != NULL) {
5750 			error = 0;
5751 			switch (cmd) {
5752 			case _PC_LINK_MAX:
5753 				*valp = rp->r_pathconf->link_max;
5754 				break;
5755 			case _PC_NAME_MAX:
5756 				*valp = rp->r_pathconf->name_max;
5757 				break;
5758 			case _PC_PATH_MAX:
5759 			case _PC_SYMLINK_MAX:
5760 				*valp = MAXPATHLEN;
5761 				break;
5762 			case _PC_CHOWN_RESTRICTED:
5763 				*valp = rp->r_pathconf->chown_restricted;
5764 				break;
5765 			case _PC_NO_TRUNC:
5766 				*valp = rp->r_pathconf->no_trunc;
5767 				break;
5768 			default:
5769 				error = EINVAL;
5770 				break;
5771 			}
5772 			mutex_exit(&rp->r_statelock);
5773 #ifdef DEBUG
5774 			nfs3_pathconf_cache_hits++;
5775 #endif
5776 			return (error);
5777 		}
5778 		mutex_exit(&rp->r_statelock);
5779 	}
5780 #ifdef DEBUG
5781 	nfs3_pathconf_cache_misses++;
5782 #endif
5783 
5784 	args.object = *VTOFH3(vp);
5785 	fi.vp = vp;
5786 	fi.fhp = (caddr_t)&args.object;
5787 	fi.copyproc = nfs3copyfh;
5788 	fi.lookupproc = nfs3lookup;
5789 	fi.xattrdirproc = acl_getxattrdir3;
5790 
5791 	douprintf = 1;
5792 
5793 	t = gethrtime();
5794 
5795 	error = rfs3call(VTOMI(vp), NFSPROC3_PATHCONF,
5796 	    xdr_nfs_fh3, (caddr_t)&args,
5797 	    xdr_PATHCONF3res, (caddr_t)&res, cr,
5798 	    &douprintf, &res.status, 0, &fi);
5799 
5800 	if (error)
5801 		return (error);
5802 
5803 	error = geterrno3(res.status);
5804 
5805 	if (!error) {
5806 		nfs3_cache_post_op_attr(vp, &res.resok.obj_attributes, t, cr);
5807 		if (!nfs3_pathconf_disable_cache) {
5808 			mutex_enter(&rp->r_statelock);
5809 			if (rp->r_pathconf == NULL) {
5810 				rp->r_pathconf = kmem_alloc(
5811 				    sizeof (*rp->r_pathconf), KM_NOSLEEP);
5812 				if (rp->r_pathconf != NULL)
5813 					*rp->r_pathconf = res.resok.info;
5814 			}
5815 			mutex_exit(&rp->r_statelock);
5816 		}
5817 		switch (cmd) {
5818 		case _PC_LINK_MAX:
5819 			*valp = res.resok.info.link_max;
5820 			break;
5821 		case _PC_NAME_MAX:
5822 			*valp = res.resok.info.name_max;
5823 			break;
5824 		case _PC_PATH_MAX:
5825 		case _PC_SYMLINK_MAX:
5826 			*valp = MAXPATHLEN;
5827 			break;
5828 		case _PC_CHOWN_RESTRICTED:
5829 			*valp = res.resok.info.chown_restricted;
5830 			break;
5831 		case _PC_NO_TRUNC:
5832 			*valp = res.resok.info.no_trunc;
5833 			break;
5834 		default:
5835 			return (EINVAL);
5836 		}
5837 	} else {
5838 		nfs3_cache_post_op_attr(vp, &res.resfail.obj_attributes, t, cr);
5839 		PURGE_STALE_FH(error, vp, cr);
5840 	}
5841 
5842 	return (error);
5843 }
5844 
5845 /*
5846  * Called by async thread to do synchronous pageio. Do the i/o, wait
5847  * for it to complete, and cleanup the page list when done.
5848  */
5849 static int
5850 nfs3_sync_pageio(vnode_t *vp, page_t *pp, u_offset_t io_off, size_t io_len,
5851 	int flags, cred_t *cr)
5852 {
5853 	int error;
5854 
5855 	ASSERT(nfs_zone() == VTOMI(vp)->mi_zone);
5856 	error = nfs3_rdwrlbn(vp, pp, io_off, io_len, flags, cr);
5857 	if (flags & B_READ)
5858 		pvn_read_done(pp, (error ? B_ERROR : 0) | flags);
5859 	else
5860 		pvn_write_done(pp, (error ? B_ERROR : 0) | flags);
5861 	return (error);
5862 }
5863 
5864 /* ARGSUSED */
5865 static int
5866 nfs3_pageio(vnode_t *vp, page_t *pp, u_offset_t io_off, size_t io_len,
5867 	int flags, cred_t *cr, caller_context_t *ct)
5868 {
5869 	int error;
5870 	rnode_t *rp;
5871 
5872 	if (pp == NULL)
5873 		return (EINVAL);
5874 	if (!(flags & B_ASYNC) && nfs_zone() != VTOMI(vp)->mi_zone)
5875 		return (EIO);
5876 
5877 	rp = VTOR(vp);
5878 	mutex_enter(&rp->r_statelock);
5879 	rp->r_count++;
5880 	mutex_exit(&rp->r_statelock);
5881 
5882 	if (flags & B_ASYNC) {
5883 		error = nfs_async_pageio(vp, pp, io_off, io_len, flags, cr,
5884 		    nfs3_sync_pageio);
5885 	} else
5886 		error = nfs3_rdwrlbn(vp, pp, io_off, io_len, flags, cr);
5887 	mutex_enter(&rp->r_statelock);
5888 	rp->r_count--;
5889 	cv_broadcast(&rp->r_cv);
5890 	mutex_exit(&rp->r_statelock);
5891 	return (error);
5892 }
5893 
5894 /* ARGSUSED */
5895 static void
5896 nfs3_dispose(vnode_t *vp, page_t *pp, int fl, int dn, cred_t *cr,
5897 	caller_context_t *ct)
5898 {
5899 	int error;
5900 	rnode_t *rp;
5901 	page_t *plist;
5902 	page_t *pptr;
5903 	offset3 offset;
5904 	count3 len;
5905 	k_sigset_t smask;
5906 
5907 	/*
5908 	 * We should get called with fl equal to either B_FREE or
5909 	 * B_INVAL.  Any other value is illegal.
5910 	 *
5911 	 * The page that we are either supposed to free or destroy
5912 	 * should be exclusive locked and its io lock should not
5913 	 * be held.
5914 	 */
5915 	ASSERT(fl == B_FREE || fl == B_INVAL);
5916 	ASSERT((PAGE_EXCL(pp) && !page_iolock_assert(pp)) || panicstr);
5917 	rp = VTOR(vp);
5918 
5919 	/*
5920 	 * If the page doesn't need to be committed or we shouldn't
5921 	 * even bother attempting to commit it, then just make sure
5922 	 * that the p_fsdata byte is clear and then either free or
5923 	 * destroy the page as appropriate.
5924 	 */
5925 	if (pp->p_fsdata == C_NOCOMMIT || (rp->r_flags & RSTALE)) {
5926 		pp->p_fsdata = C_NOCOMMIT;
5927 		if (fl == B_FREE)
5928 			page_free(pp, dn);
5929 		else
5930 			page_destroy(pp, dn);
5931 		return;
5932 	}
5933 
5934 	/*
5935 	 * If there is a page invalidation operation going on, then
5936 	 * if this is one of the pages being destroyed, then just
5937 	 * clear the p_fsdata byte and then either free or destroy
5938 	 * the page as appropriate.
5939 	 */
5940 	mutex_enter(&rp->r_statelock);
5941 	if ((rp->r_flags & RTRUNCATE) && pp->p_offset >= rp->r_truncaddr) {
5942 		mutex_exit(&rp->r_statelock);
5943 		pp->p_fsdata = C_NOCOMMIT;
5944 		if (fl == B_FREE)
5945 			page_free(pp, dn);
5946 		else
5947 			page_destroy(pp, dn);
5948 		return;
5949 	}
5950 
5951 	/*
5952 	 * If we are freeing this page and someone else is already
5953 	 * waiting to do a commit, then just unlock the page and
5954 	 * return.  That other thread will take care of commiting
5955 	 * this page.  The page can be freed sometime after the
5956 	 * commit has finished.  Otherwise, if the page is marked
5957 	 * as delay commit, then we may be getting called from
5958 	 * pvn_write_done, one page at a time.   This could result
5959 	 * in one commit per page, so we end up doing lots of small
5960 	 * commits instead of fewer larger commits.  This is bad,
5961 	 * we want do as few commits as possible.
5962 	 */
5963 	if (fl == B_FREE) {
5964 		if (rp->r_flags & RCOMMITWAIT) {
5965 			page_unlock(pp);
5966 			mutex_exit(&rp->r_statelock);
5967 			return;
5968 		}
5969 		if (pp->p_fsdata == C_DELAYCOMMIT) {
5970 			pp->p_fsdata = C_COMMIT;
5971 			page_unlock(pp);
5972 			mutex_exit(&rp->r_statelock);
5973 			return;
5974 		}
5975 	}
5976 
5977 	/*
5978 	 * Check to see if there is a signal which would prevent an
5979 	 * attempt to commit the pages from being successful.  If so,
5980 	 * then don't bother with all of the work to gather pages and
5981 	 * generate the unsuccessful RPC.  Just return from here and
5982 	 * let the page be committed at some later time.
5983 	 */
5984 	sigintr(&smask, VTOMI(vp)->mi_flags & MI_INT);
5985 	if (ttolwp(curthread) != NULL && ISSIG(curthread, JUSTLOOKING)) {
5986 		sigunintr(&smask);
5987 		page_unlock(pp);
5988 		mutex_exit(&rp->r_statelock);
5989 		return;
5990 	}
5991 	sigunintr(&smask);
5992 
5993 	/*
5994 	 * We are starting to need to commit pages, so let's try
5995 	 * to commit as many as possible at once to reduce the
5996 	 * overhead.
5997 	 *
5998 	 * Set the `commit inprogress' state bit.  We must
5999 	 * first wait until any current one finishes.  Then
6000 	 * we initialize the c_pages list with this page.
6001 	 */
6002 	while (rp->r_flags & RCOMMIT) {
6003 		rp->r_flags |= RCOMMITWAIT;
6004 		cv_wait(&rp->r_commit.c_cv, &rp->r_statelock);
6005 		rp->r_flags &= ~RCOMMITWAIT;
6006 	}
6007 	rp->r_flags |= RCOMMIT;
6008 	mutex_exit(&rp->r_statelock);
6009 	ASSERT(rp->r_commit.c_pages == NULL);
6010 	rp->r_commit.c_pages = pp;
6011 	rp->r_commit.c_commbase = (offset3)pp->p_offset;
6012 	rp->r_commit.c_commlen = PAGESIZE;
6013 
6014 	/*
6015 	 * Gather together all other pages which can be committed.
6016 	 * They will all be chained off r_commit.c_pages.
6017 	 */
6018 	nfs3_get_commit(vp);
6019 
6020 	/*
6021 	 * Clear the `commit inprogress' status and disconnect
6022 	 * the list of pages to be committed from the rnode.
6023 	 * At this same time, we also save the starting offset
6024 	 * and length of data to be committed on the server.
6025 	 */
6026 	plist = rp->r_commit.c_pages;
6027 	rp->r_commit.c_pages = NULL;
6028 	offset = rp->r_commit.c_commbase;
6029 	len = rp->r_commit.c_commlen;
6030 	mutex_enter(&rp->r_statelock);
6031 	rp->r_flags &= ~RCOMMIT;
6032 	cv_broadcast(&rp->r_commit.c_cv);
6033 	mutex_exit(&rp->r_statelock);
6034 
6035 	if (curproc == proc_pageout || curproc == proc_fsflush ||
6036 	    nfs_zone() != VTOMI(vp)->mi_zone) {
6037 		nfs_async_commit(vp, plist, offset, len, cr, nfs3_async_commit);
6038 		return;
6039 	}
6040 
6041 	/*
6042 	 * Actually generate the COMMIT3 over the wire operation.
6043 	 */
6044 	error = nfs3_commit(vp, offset, len, cr);
6045 
6046 	/*
6047 	 * If we got an error during the commit, just unlock all
6048 	 * of the pages.  The pages will get retransmitted to the
6049 	 * server during a putpage operation.
6050 	 */
6051 	if (error) {
6052 		while (plist != NULL) {
6053 			pptr = plist;
6054 			page_sub(&plist, pptr);
6055 			page_unlock(pptr);
6056 		}
6057 		return;
6058 	}
6059 
6060 	/*
6061 	 * We've tried as hard as we can to commit the data to stable
6062 	 * storage on the server.  We release the rest of the pages
6063 	 * and clear the commit required state.  They will be put
6064 	 * onto the tail of the cachelist if they are nolonger
6065 	 * mapped.
6066 	 */
6067 	while (plist != pp) {
6068 		pptr = plist;
6069 		page_sub(&plist, pptr);
6070 		pptr->p_fsdata = C_NOCOMMIT;
6071 		(void) page_release(pptr, 1);
6072 	}
6073 
6074 	/*
6075 	 * It is possible that nfs3_commit didn't return error but
6076 	 * some other thread has modified the page we are going
6077 	 * to free/destroy.
6078 	 *    In this case we need to rewrite the page. Do an explicit check
6079 	 * before attempting to free/destroy the page. If modified, needs to
6080 	 * be rewritten so unlock the page and return.
6081 	 */
6082 	if (hat_ismod(pp)) {
6083 		pp->p_fsdata = C_NOCOMMIT;
6084 		page_unlock(pp);
6085 		return;
6086 	}
6087 
6088 	/*
6089 	 * Now, as appropriate, either free or destroy the page
6090 	 * that we were called with.
6091 	 */
6092 	pp->p_fsdata = C_NOCOMMIT;
6093 	if (fl == B_FREE)
6094 		page_free(pp, dn);
6095 	else
6096 		page_destroy(pp, dn);
6097 }
6098 
6099 static int
6100 nfs3_commit(vnode_t *vp, offset3 offset, count3 count, cred_t *cr)
6101 {
6102 	int error;
6103 	rnode_t *rp;
6104 	COMMIT3args args;
6105 	COMMIT3res res;
6106 	int douprintf;
6107 	cred_t *cred;
6108 
6109 	rp = VTOR(vp);
6110 	ASSERT(nfs_zone() == VTOMI(vp)->mi_zone);
6111 
6112 	mutex_enter(&rp->r_statelock);
6113 	if (rp->r_cred != NULL) {
6114 		cred = rp->r_cred;
6115 		crhold(cred);
6116 	} else {
6117 		rp->r_cred = cr;
6118 		crhold(cr);
6119 		cred = cr;
6120 		crhold(cred);
6121 	}
6122 	mutex_exit(&rp->r_statelock);
6123 
6124 	args.file = *VTOFH3(vp);
6125 	args.offset = offset;
6126 	args.count = count;
6127 
6128 doitagain:
6129 	douprintf = 1;
6130 	error = rfs3call(VTOMI(vp), NFSPROC3_COMMIT,
6131 	    xdr_COMMIT3args, (caddr_t)&args,
6132 	    xdr_COMMIT3res, (caddr_t)&res, cred,
6133 	    &douprintf, &res.status, 0, NULL);
6134 
6135 	crfree(cred);
6136 
6137 	if (error)
6138 		return (error);
6139 
6140 	error = geterrno3(res.status);
6141 	if (!error) {
6142 		ASSERT(rp->r_flags & RHAVEVERF);
6143 		mutex_enter(&rp->r_statelock);
6144 		if (rp->r_verf == res.resok.verf) {
6145 			mutex_exit(&rp->r_statelock);
6146 			return (0);
6147 		}
6148 		nfs3_set_mod(vp);
6149 		rp->r_verf = res.resok.verf;
6150 		mutex_exit(&rp->r_statelock);
6151 		error = NFS_VERF_MISMATCH;
6152 	} else {
6153 		if (error == EACCES) {
6154 			mutex_enter(&rp->r_statelock);
6155 			if (cred != cr) {
6156 				if (rp->r_cred != NULL)
6157 					crfree(rp->r_cred);
6158 				rp->r_cred = cr;
6159 				crhold(cr);
6160 				cred = cr;
6161 				crhold(cred);
6162 				mutex_exit(&rp->r_statelock);
6163 				goto doitagain;
6164 			}
6165 			mutex_exit(&rp->r_statelock);
6166 		}
6167 		/*
6168 		 * Can't do a PURGE_STALE_FH here because this
6169 		 * can cause a deadlock.  nfs3_commit can
6170 		 * be called from nfs3_dispose which can be called
6171 		 * indirectly via pvn_vplist_dirty.  PURGE_STALE_FH
6172 		 * can call back to pvn_vplist_dirty.
6173 		 */
6174 		if (error == ESTALE) {
6175 			mutex_enter(&rp->r_statelock);
6176 			rp->r_flags |= RSTALE;
6177 			if (!rp->r_error)
6178 				rp->r_error = error;
6179 			mutex_exit(&rp->r_statelock);
6180 			PURGE_ATTRCACHE(vp);
6181 		} else {
6182 			mutex_enter(&rp->r_statelock);
6183 			if (!rp->r_error)
6184 				rp->r_error = error;
6185 			mutex_exit(&rp->r_statelock);
6186 		}
6187 	}
6188 
6189 	return (error);
6190 }
6191 
6192 static void
6193 nfs3_set_mod(vnode_t *vp)
6194 {
6195 	page_t *pp;
6196 	kmutex_t *vphm;
6197 
6198 	ASSERT(nfs_zone() == VTOMI(vp)->mi_zone);
6199 	vphm = page_vnode_mutex(vp);
6200 	mutex_enter(vphm);
6201 	if ((pp = vp->v_pages) != NULL) {
6202 		do {
6203 			if (pp->p_fsdata != C_NOCOMMIT) {
6204 				hat_setmod(pp);
6205 				pp->p_fsdata = C_NOCOMMIT;
6206 			}
6207 		} while ((pp = pp->p_vpnext) != vp->v_pages);
6208 	}
6209 	mutex_exit(vphm);
6210 }
6211 
6212 
6213 /*
6214  * This routine is used to gather together a page list of the pages
6215  * which are to be committed on the server.  This routine must not
6216  * be called if the calling thread holds any locked pages.
6217  *
6218  * The calling thread must have set RCOMMIT.  This bit is used to
6219  * serialize access to the commit structure in the rnode.  As long
6220  * as the thread has set RCOMMIT, then it can manipulate the commit
6221  * structure without requiring any other locks.
6222  */
6223 static void
6224 nfs3_get_commit(vnode_t *vp)
6225 {
6226 	rnode_t *rp;
6227 	page_t *pp;
6228 	kmutex_t *vphm;
6229 
6230 	rp = VTOR(vp);
6231 
6232 	ASSERT(rp->r_flags & RCOMMIT);
6233 
6234 	vphm = page_vnode_mutex(vp);
6235 	mutex_enter(vphm);
6236 
6237 	/*
6238 	 * If there are no pages associated with this vnode, then
6239 	 * just return.
6240 	 */
6241 	if ((pp = vp->v_pages) == NULL) {
6242 		mutex_exit(vphm);
6243 		return;
6244 	}
6245 
6246 	/*
6247 	 * Step through all of the pages associated with this vnode
6248 	 * looking for pages which need to be committed.
6249 	 */
6250 	do {
6251 		/*
6252 		 * If this page does not need to be committed or is
6253 		 * modified, then just skip it.
6254 		 */
6255 		if (pp->p_fsdata == C_NOCOMMIT || hat_ismod(pp))
6256 			continue;
6257 
6258 		/*
6259 		 * Attempt to lock the page.  If we can't, then
6260 		 * someone else is messing with it and we will
6261 		 * just skip it.
6262 		 */
6263 		if (!page_trylock(pp, SE_EXCL))
6264 			continue;
6265 
6266 		/*
6267 		 * If this page does not need to be committed or is
6268 		 * modified, then just skip it.  Recheck now that
6269 		 * the page is locked.
6270 		 */
6271 		if (pp->p_fsdata == C_NOCOMMIT || hat_ismod(pp)) {
6272 			page_unlock(pp);
6273 			continue;
6274 		}
6275 
6276 		if (PP_ISFREE(pp)) {
6277 			cmn_err(CE_PANIC, "nfs3_get_commit: %p is free",
6278 			    (void *)pp);
6279 		}
6280 
6281 		/*
6282 		 * The page needs to be committed and we locked it.
6283 		 * Update the base and length parameters and add it
6284 		 * to r_pages.
6285 		 */
6286 		if (rp->r_commit.c_pages == NULL) {
6287 			rp->r_commit.c_commbase = (offset3)pp->p_offset;
6288 			rp->r_commit.c_commlen = PAGESIZE;
6289 		} else if (pp->p_offset < rp->r_commit.c_commbase) {
6290 			rp->r_commit.c_commlen = rp->r_commit.c_commbase -
6291 			    (offset3)pp->p_offset + rp->r_commit.c_commlen;
6292 			rp->r_commit.c_commbase = (offset3)pp->p_offset;
6293 		} else if ((rp->r_commit.c_commbase + rp->r_commit.c_commlen)
6294 		    <= pp->p_offset) {
6295 			rp->r_commit.c_commlen = (offset3)pp->p_offset -
6296 			    rp->r_commit.c_commbase + PAGESIZE;
6297 		}
6298 		page_add(&rp->r_commit.c_pages, pp);
6299 	} while ((pp = pp->p_vpnext) != vp->v_pages);
6300 
6301 	mutex_exit(vphm);
6302 }
6303 
6304 /*
6305  * This routine is used to gather together a page list of the pages
6306  * which are to be committed on the server.  This routine must not
6307  * be called if the calling thread holds any locked pages.
6308  *
6309  * The calling thread must have set RCOMMIT.  This bit is used to
6310  * serialize access to the commit structure in the rnode.  As long
6311  * as the thread has set RCOMMIT, then it can manipulate the commit
6312  * structure without requiring any other locks.
6313  */
6314 static void
6315 nfs3_get_commit_range(vnode_t *vp, u_offset_t soff, size_t len)
6316 {
6317 
6318 	rnode_t *rp;
6319 	page_t *pp;
6320 	u_offset_t end;
6321 	u_offset_t off;
6322 
6323 	ASSERT(len != 0);
6324 
6325 	rp = VTOR(vp);
6326 
6327 	ASSERT(rp->r_flags & RCOMMIT);
6328 	ASSERT(nfs_zone() == VTOMI(vp)->mi_zone);
6329 
6330 	/*
6331 	 * If there are no pages associated with this vnode, then
6332 	 * just return.
6333 	 */
6334 	if ((pp = vp->v_pages) == NULL)
6335 		return;
6336 
6337 	/*
6338 	 * Calculate the ending offset.
6339 	 */
6340 	end = soff + len;
6341 
6342 	for (off = soff; off < end; off += PAGESIZE) {
6343 		/*
6344 		 * Lookup each page by vp, offset.
6345 		 */
6346 		if ((pp = page_lookup_nowait(vp, off, SE_EXCL)) == NULL)
6347 			continue;
6348 
6349 		/*
6350 		 * If this page does not need to be committed or is
6351 		 * modified, then just skip it.
6352 		 */
6353 		if (pp->p_fsdata == C_NOCOMMIT || hat_ismod(pp)) {
6354 			page_unlock(pp);
6355 			continue;
6356 		}
6357 
6358 		ASSERT(PP_ISFREE(pp) == 0);
6359 
6360 		/*
6361 		 * The page needs to be committed and we locked it.
6362 		 * Update the base and length parameters and add it
6363 		 * to r_pages.
6364 		 */
6365 		if (rp->r_commit.c_pages == NULL) {
6366 			rp->r_commit.c_commbase = (offset3)pp->p_offset;
6367 			rp->r_commit.c_commlen = PAGESIZE;
6368 		} else {
6369 			rp->r_commit.c_commlen = (offset3)pp->p_offset -
6370 			    rp->r_commit.c_commbase + PAGESIZE;
6371 		}
6372 		page_add(&rp->r_commit.c_pages, pp);
6373 	}
6374 }
6375 
6376 #if 0	/* unused */
6377 #ifdef DEBUG
6378 static int
6379 nfs3_no_uncommitted_pages(vnode_t *vp)
6380 {
6381 	page_t *pp;
6382 	kmutex_t *vphm;
6383 
6384 	vphm = page_vnode_mutex(vp);
6385 	mutex_enter(vphm);
6386 	if ((pp = vp->v_pages) != NULL) {
6387 		do {
6388 			if (pp->p_fsdata != C_NOCOMMIT) {
6389 				mutex_exit(vphm);
6390 				return (0);
6391 			}
6392 		} while ((pp = pp->p_vpnext) != vp->v_pages);
6393 	}
6394 	mutex_exit(vphm);
6395 
6396 	return (1);
6397 }
6398 #endif
6399 #endif
6400 
6401 static int
6402 nfs3_putpage_commit(vnode_t *vp, offset_t poff, size_t plen, cred_t *cr)
6403 {
6404 	int error;
6405 	writeverf3 write_verf;
6406 	rnode_t *rp = VTOR(vp);
6407 
6408 	ASSERT(nfs_zone() == VTOMI(vp)->mi_zone);
6409 	/*
6410 	 * Flush the data portion of the file and then commit any
6411 	 * portions which need to be committed.  This may need to
6412 	 * be done twice if the server has changed state since
6413 	 * data was last written.  The data will need to be
6414 	 * rewritten to the server and then a new commit done.
6415 	 *
6416 	 * In fact, this may need to be done several times if the
6417 	 * server is having problems and crashing while we are
6418 	 * attempting to do this.
6419 	 */
6420 
6421 top:
6422 	/*
6423 	 * Do a flush based on the poff and plen arguments.  This
6424 	 * will asynchronously write out any modified pages in the
6425 	 * range specified by (poff, plen).  This starts all of the
6426 	 * i/o operations which will be waited for in the next
6427 	 * call to nfs3_putpage
6428 	 */
6429 
6430 	mutex_enter(&rp->r_statelock);
6431 	write_verf = rp->r_verf;
6432 	mutex_exit(&rp->r_statelock);
6433 
6434 	error = nfs3_putpage(vp, poff, plen, B_ASYNC, cr, NULL);
6435 	if (error == EAGAIN)
6436 		error = 0;
6437 
6438 	/*
6439 	 * Do a flush based on the poff and plen arguments.  This
6440 	 * will synchronously write out any modified pages in the
6441 	 * range specified by (poff, plen) and wait until all of
6442 	 * the asynchronous i/o's in that range are done as well.
6443 	 */
6444 	if (!error)
6445 		error = nfs3_putpage(vp, poff, plen, 0, cr, NULL);
6446 
6447 	if (error)
6448 		return (error);
6449 
6450 	mutex_enter(&rp->r_statelock);
6451 	if (rp->r_verf != write_verf) {
6452 		mutex_exit(&rp->r_statelock);
6453 		goto top;
6454 	}
6455 	mutex_exit(&rp->r_statelock);
6456 
6457 	/*
6458 	 * Now commit any pages which might need to be committed.
6459 	 * If the error, NFS_VERF_MISMATCH, is returned, then
6460 	 * start over with the flush operation.
6461 	 */
6462 
6463 	error = nfs3_commit_vp(vp, poff, plen, cr);
6464 
6465 	if (error == NFS_VERF_MISMATCH)
6466 		goto top;
6467 
6468 	return (error);
6469 }
6470 
6471 static int
6472 nfs3_commit_vp(vnode_t *vp, u_offset_t poff, size_t plen, cred_t *cr)
6473 {
6474 	rnode_t *rp;
6475 	page_t *plist;
6476 	offset3 offset;
6477 	count3 len;
6478 
6479 
6480 	rp = VTOR(vp);
6481 
6482 	if (nfs_zone() != VTOMI(vp)->mi_zone)
6483 		return (EIO);
6484 	/*
6485 	 * Set the `commit inprogress' state bit.  We must
6486 	 * first wait until any current one finishes.
6487 	 */
6488 	mutex_enter(&rp->r_statelock);
6489 	while (rp->r_flags & RCOMMIT) {
6490 		rp->r_flags |= RCOMMITWAIT;
6491 		cv_wait(&rp->r_commit.c_cv, &rp->r_statelock);
6492 		rp->r_flags &= ~RCOMMITWAIT;
6493 	}
6494 	rp->r_flags |= RCOMMIT;
6495 	mutex_exit(&rp->r_statelock);
6496 
6497 	/*
6498 	 * Gather together all of the pages which need to be
6499 	 * committed.
6500 	 */
6501 	if (plen == 0)
6502 		nfs3_get_commit(vp);
6503 	else
6504 		nfs3_get_commit_range(vp, poff, plen);
6505 
6506 	/*
6507 	 * Clear the `commit inprogress' bit and disconnect the
6508 	 * page list which was gathered together in nfs3_get_commit.
6509 	 */
6510 	plist = rp->r_commit.c_pages;
6511 	rp->r_commit.c_pages = NULL;
6512 	offset = rp->r_commit.c_commbase;
6513 	len = rp->r_commit.c_commlen;
6514 	mutex_enter(&rp->r_statelock);
6515 	rp->r_flags &= ~RCOMMIT;
6516 	cv_broadcast(&rp->r_commit.c_cv);
6517 	mutex_exit(&rp->r_statelock);
6518 
6519 	/*
6520 	 * If any pages need to be committed, commit them and
6521 	 * then unlock them so that they can be freed some
6522 	 * time later.
6523 	 */
6524 	if (plist != NULL) {
6525 		/*
6526 		 * No error occurred during the flush portion
6527 		 * of this operation, so now attempt to commit
6528 		 * the data to stable storage on the server.
6529 		 *
6530 		 * This will unlock all of the pages on the list.
6531 		 */
6532 		return (nfs3_sync_commit(vp, plist, offset, len, cr));
6533 	}
6534 	return (0);
6535 }
6536 
6537 static int
6538 nfs3_sync_commit(vnode_t *vp, page_t *plist, offset3 offset, count3 count,
6539 	cred_t *cr)
6540 {
6541 	int error;
6542 	page_t *pp;
6543 
6544 	ASSERT(nfs_zone() == VTOMI(vp)->mi_zone);
6545 	error = nfs3_commit(vp, offset, count, cr);
6546 
6547 	/*
6548 	 * If we got an error, then just unlock all of the pages
6549 	 * on the list.
6550 	 */
6551 	if (error) {
6552 		while (plist != NULL) {
6553 			pp = plist;
6554 			page_sub(&plist, pp);
6555 			page_unlock(pp);
6556 		}
6557 		return (error);
6558 	}
6559 	/*
6560 	 * We've tried as hard as we can to commit the data to stable
6561 	 * storage on the server.  We just unlock the pages and clear
6562 	 * the commit required state.  They will get freed later.
6563 	 */
6564 	while (plist != NULL) {
6565 		pp = plist;
6566 		page_sub(&plist, pp);
6567 		pp->p_fsdata = C_NOCOMMIT;
6568 		page_unlock(pp);
6569 	}
6570 
6571 	return (error);
6572 }
6573 
6574 static void
6575 nfs3_async_commit(vnode_t *vp, page_t *plist, offset3 offset, count3 count,
6576 	cred_t *cr)
6577 {
6578 	ASSERT(nfs_zone() == VTOMI(vp)->mi_zone);
6579 	(void) nfs3_sync_commit(vp, plist, offset, count, cr);
6580 }
6581 
6582 /* ARGSUSED */
6583 static int
6584 nfs3_setsecattr(vnode_t *vp, vsecattr_t *vsecattr, int flag, cred_t *cr,
6585 	caller_context_t *ct)
6586 {
6587 	int error;
6588 	mntinfo_t *mi;
6589 
6590 	mi = VTOMI(vp);
6591 
6592 	if (nfs_zone() != mi->mi_zone)
6593 		return (EIO);
6594 
6595 	if (mi->mi_flags & MI_ACL) {
6596 		error = acl_setacl3(vp, vsecattr, flag, cr);
6597 		if (mi->mi_flags & MI_ACL)
6598 			return (error);
6599 	}
6600 
6601 	return (ENOSYS);
6602 }
6603 
6604 /* ARGSUSED */
6605 static int
6606 nfs3_getsecattr(vnode_t *vp, vsecattr_t *vsecattr, int flag, cred_t *cr,
6607 	caller_context_t *ct)
6608 {
6609 	int error;
6610 	mntinfo_t *mi;
6611 
6612 	mi = VTOMI(vp);
6613 
6614 	if (nfs_zone() != mi->mi_zone)
6615 		return (EIO);
6616 
6617 	if (mi->mi_flags & MI_ACL) {
6618 		error = acl_getacl3(vp, vsecattr, flag, cr);
6619 		if (mi->mi_flags & MI_ACL)
6620 			return (error);
6621 	}
6622 
6623 	return (fs_fab_acl(vp, vsecattr, flag, cr, ct));
6624 }
6625 
6626 /* ARGSUSED */
6627 static int
6628 nfs3_shrlock(vnode_t *vp, int cmd, struct shrlock *shr, int flag, cred_t *cr,
6629 	caller_context_t *ct)
6630 {
6631 	int error;
6632 	struct shrlock nshr;
6633 	struct nfs_owner nfs_owner;
6634 	netobj lm_fh3;
6635 
6636 	if (nfs_zone() != VTOMI(vp)->mi_zone)
6637 		return (EIO);
6638 
6639 	/*
6640 	 * check for valid cmd parameter
6641 	 */
6642 	if (cmd != F_SHARE && cmd != F_UNSHARE && cmd != F_HASREMOTELOCKS)
6643 		return (EINVAL);
6644 
6645 	/*
6646 	 * Check access permissions
6647 	 */
6648 	if (cmd == F_SHARE &&
6649 	    (((shr->s_access & F_RDACC) && !(flag & FREAD)) ||
6650 	    ((shr->s_access & F_WRACC) && !(flag & FWRITE))))
6651 		return (EBADF);
6652 
6653 	/*
6654 	 * If the filesystem is mounted using local locking, pass the
6655 	 * request off to the local share code.
6656 	 */
6657 	if (VTOMI(vp)->mi_flags & MI_LLOCK)
6658 		return (fs_shrlock(vp, cmd, shr, flag, cr, ct));
6659 
6660 	switch (cmd) {
6661 	case F_SHARE:
6662 	case F_UNSHARE:
6663 		lm_fh3.n_len = VTOFH3(vp)->fh3_length;
6664 		lm_fh3.n_bytes = (char *)&(VTOFH3(vp)->fh3_u.data);
6665 
6666 		/*
6667 		 * If passed an owner that is too large to fit in an
6668 		 * nfs_owner it is likely a recursive call from the
6669 		 * lock manager client and pass it straight through.  If
6670 		 * it is not a nfs_owner then simply return an error.
6671 		 */
6672 		if (shr->s_own_len > sizeof (nfs_owner.lowner)) {
6673 			if (((struct nfs_owner *)shr->s_owner)->magic !=
6674 			    NFS_OWNER_MAGIC)
6675 				return (EINVAL);
6676 
6677 			if (error = lm4_shrlock(vp, cmd, shr, flag, &lm_fh3)) {
6678 				error = set_errno(error);
6679 			}
6680 			return (error);
6681 		}
6682 		/*
6683 		 * Remote share reservations owner is a combination of
6684 		 * a magic number, hostname, and the local owner
6685 		 */
6686 		bzero(&nfs_owner, sizeof (nfs_owner));
6687 		nfs_owner.magic = NFS_OWNER_MAGIC;
6688 		(void) strncpy(nfs_owner.hname, uts_nodename(),
6689 		    sizeof (nfs_owner.hname));
6690 		bcopy(shr->s_owner, nfs_owner.lowner, shr->s_own_len);
6691 		nshr.s_access = shr->s_access;
6692 		nshr.s_deny = shr->s_deny;
6693 		nshr.s_sysid = 0;
6694 		nshr.s_pid = ttoproc(curthread)->p_pid;
6695 		nshr.s_own_len = sizeof (nfs_owner);
6696 		nshr.s_owner = (caddr_t)&nfs_owner;
6697 
6698 		if (error = lm4_shrlock(vp, cmd, &nshr, flag, &lm_fh3)) {
6699 			error = set_errno(error);
6700 		}
6701 
6702 		break;
6703 
6704 	case F_HASREMOTELOCKS:
6705 		/*
6706 		 * NFS client can't store remote locks itself
6707 		 */
6708 		shr->s_access = 0;
6709 		error = 0;
6710 		break;
6711 
6712 	default:
6713 		error = EINVAL;
6714 		break;
6715 	}
6716 
6717 	return (error);
6718 }
6719