xref: /titanic_41/usr/src/uts/common/fs/nfs/nfs3_vnops.c (revision bda1f129971950880940a17bab0bf096d5744b0c)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 /*
22  * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
23  * Use is subject to license terms.
24  */
25 
26 /*
27  *	Copyright (c) 1983,1984,1985,1986,1987,1988,1989 AT&T.
28  *	All rights reserved.
29  */
30 
31 #include <sys/param.h>
32 #include <sys/types.h>
33 #include <sys/systm.h>
34 #include <sys/cred.h>
35 #include <sys/time.h>
36 #include <sys/vnode.h>
37 #include <sys/vfs.h>
38 #include <sys/vfs_opreg.h>
39 #include <sys/file.h>
40 #include <sys/filio.h>
41 #include <sys/uio.h>
42 #include <sys/buf.h>
43 #include <sys/mman.h>
44 #include <sys/pathname.h>
45 #include <sys/dirent.h>
46 #include <sys/debug.h>
47 #include <sys/vmsystm.h>
48 #include <sys/fcntl.h>
49 #include <sys/flock.h>
50 #include <sys/swap.h>
51 #include <sys/errno.h>
52 #include <sys/strsubr.h>
53 #include <sys/sysmacros.h>
54 #include <sys/kmem.h>
55 #include <sys/cmn_err.h>
56 #include <sys/pathconf.h>
57 #include <sys/utsname.h>
58 #include <sys/dnlc.h>
59 #include <sys/acl.h>
60 #include <sys/systeminfo.h>
61 #include <sys/atomic.h>
62 #include <sys/policy.h>
63 #include <sys/sdt.h>
64 #include <sys/zone.h>
65 
66 #include <rpc/types.h>
67 #include <rpc/auth.h>
68 #include <rpc/clnt.h>
69 #include <rpc/rpc_rdma.h>
70 
71 #include <nfs/nfs.h>
72 #include <nfs/nfs_clnt.h>
73 #include <nfs/rnode.h>
74 #include <nfs/nfs_acl.h>
75 #include <nfs/lm.h>
76 
77 #include <vm/hat.h>
78 #include <vm/as.h>
79 #include <vm/page.h>
80 #include <vm/pvn.h>
81 #include <vm/seg.h>
82 #include <vm/seg_map.h>
83 #include <vm/seg_kpm.h>
84 #include <vm/seg_vn.h>
85 
86 #include <fs/fs_subr.h>
87 
88 #include <sys/ddi.h>
89 
90 static int	nfs3_rdwrlbn(vnode_t *, page_t *, u_offset_t, size_t, int,
91 			cred_t *);
92 static int	nfs3write(vnode_t *, caddr_t, u_offset_t, int, cred_t *,
93 			stable_how *);
94 static int	nfs3read(vnode_t *, caddr_t, offset_t, int, size_t *, cred_t *);
95 static int	nfs3setattr(vnode_t *, struct vattr *, int, cred_t *);
96 static int	nfs3_accessx(void *, int, cred_t *);
97 static int	nfs3lookup_dnlc(vnode_t *, char *, vnode_t **, cred_t *);
98 static int	nfs3lookup_otw(vnode_t *, char *, vnode_t **, cred_t *, int);
99 static int	nfs3create(vnode_t *, char *, struct vattr *, enum vcexcl,
100 			int, vnode_t **, cred_t *, int);
101 static int	nfs3excl_create_settimes(vnode_t *, struct vattr *, cred_t *);
102 static int	nfs3mknod(vnode_t *, char *, struct vattr *, enum vcexcl,
103 			int, vnode_t **, cred_t *);
104 static int	nfs3rename(vnode_t *, char *, vnode_t *, char *, cred_t *,
105 			caller_context_t *);
106 static int	do_nfs3readdir(vnode_t *, rddir_cache *, cred_t *);
107 static void	nfs3readdir(vnode_t *, rddir_cache *, cred_t *);
108 static void	nfs3readdirplus(vnode_t *, rddir_cache *, cred_t *);
109 static int	nfs3_bio(struct buf *, stable_how *, cred_t *);
110 static int	nfs3_getapage(vnode_t *, u_offset_t, size_t, uint_t *,
111 			page_t *[], size_t, struct seg *, caddr_t,
112 			enum seg_rw, cred_t *);
113 static void	nfs3_readahead(vnode_t *, u_offset_t, caddr_t, struct seg *,
114 			cred_t *);
115 static int	nfs3_sync_putapage(vnode_t *, page_t *, u_offset_t, size_t,
116 			int, cred_t *);
117 static int	nfs3_sync_pageio(vnode_t *, page_t *, u_offset_t, size_t,
118 			int, cred_t *);
119 static int	nfs3_commit(vnode_t *, offset3, count3, cred_t *);
120 static void	nfs3_set_mod(vnode_t *);
121 static void	nfs3_get_commit(vnode_t *);
122 static void	nfs3_get_commit_range(vnode_t *, u_offset_t, size_t);
123 #if 0 /* unused */
124 #ifdef DEBUG
125 static int	nfs3_no_uncommitted_pages(vnode_t *);
126 #endif
127 #endif /* unused */
128 static int	nfs3_putpage_commit(vnode_t *, offset_t, size_t, cred_t *);
129 static int	nfs3_commit_vp(vnode_t *, u_offset_t, size_t,  cred_t *);
130 static int	nfs3_sync_commit(vnode_t *, page_t *, offset3, count3,
131 			cred_t *);
132 static void	nfs3_async_commit(vnode_t *, page_t *, offset3, count3,
133 			cred_t *);
134 static void	nfs3_delmap_callback(struct as *, void *, uint_t);
135 
136 /*
137  * Error flags used to pass information about certain special errors
138  * which need to be handled specially.
139  */
140 #define	NFS_EOF			-98
141 #define	NFS_VERF_MISMATCH	-97
142 
143 /* ALIGN64 aligns the given buffer and adjust buffer size to 64 bit */
144 #define	ALIGN64(x, ptr, sz)						\
145 	x = ((uintptr_t)(ptr)) & (sizeof (uint64_t) - 1);		\
146 	if (x) {							\
147 		x = sizeof (uint64_t) - (x);				\
148 		sz -= (x);						\
149 		ptr += (x);						\
150 	}
151 
152 /*
153  * These are the vnode ops routines which implement the vnode interface to
154  * the networked file system.  These routines just take their parameters,
155  * make them look networkish by putting the right info into interface structs,
156  * and then calling the appropriate remote routine(s) to do the work.
157  *
158  * Note on directory name lookup cacheing:  If we detect a stale fhandle,
159  * we purge the directory cache relative to that vnode.  This way, the
160  * user won't get burned by the cache repeatedly.  See <nfs/rnode.h> for
161  * more details on rnode locking.
162  */
163 
164 static int	nfs3_open(vnode_t **, int, cred_t *, caller_context_t *);
165 static int	nfs3_close(vnode_t *, int, int, offset_t, cred_t *,
166 			caller_context_t *);
167 static int	nfs3_read(vnode_t *, struct uio *, int, cred_t *,
168 			caller_context_t *);
169 static int	nfs3_write(vnode_t *, struct uio *, int, cred_t *,
170 			caller_context_t *);
171 static int	nfs3_ioctl(vnode_t *, int, intptr_t, int, cred_t *, int *,
172 			caller_context_t *);
173 static int	nfs3_getattr(vnode_t *, struct vattr *, int, cred_t *,
174 			caller_context_t *);
175 static int	nfs3_setattr(vnode_t *, struct vattr *, int, cred_t *,
176 			caller_context_t *);
177 static int	nfs3_access(vnode_t *, int, int, cred_t *, caller_context_t *);
178 static int	nfs3_readlink(vnode_t *, struct uio *, cred_t *,
179 			caller_context_t *);
180 static int	nfs3_fsync(vnode_t *, int, cred_t *, caller_context_t *);
181 static void	nfs3_inactive(vnode_t *, cred_t *, caller_context_t *);
182 static int	nfs3_lookup(vnode_t *, char *, vnode_t **,
183 			struct pathname *, int, vnode_t *, cred_t *,
184 			caller_context_t *, int *, pathname_t *);
185 static int	nfs3_create(vnode_t *, char *, struct vattr *, enum vcexcl,
186 			int, vnode_t **, cred_t *, int, caller_context_t *,
187 			vsecattr_t *);
188 static int	nfs3_remove(vnode_t *, char *, cred_t *, caller_context_t *,
189 			int);
190 static int	nfs3_link(vnode_t *, vnode_t *, char *, cred_t *,
191 			caller_context_t *, int);
192 static int	nfs3_rename(vnode_t *, char *, vnode_t *, char *, cred_t *,
193 			caller_context_t *, int);
194 static int	nfs3_mkdir(vnode_t *, char *, struct vattr *, vnode_t **,
195 			cred_t *, caller_context_t *, int, vsecattr_t *);
196 static int	nfs3_rmdir(vnode_t *, char *, vnode_t *, cred_t *,
197 			caller_context_t *, int);
198 static int	nfs3_symlink(vnode_t *, char *, struct vattr *, char *,
199 			cred_t *, caller_context_t *, int);
200 static int	nfs3_readdir(vnode_t *, struct uio *, cred_t *, int *,
201 			caller_context_t *, int);
202 static int	nfs3_fid(vnode_t *, fid_t *, caller_context_t *);
203 static int	nfs3_rwlock(vnode_t *, int, caller_context_t *);
204 static void	nfs3_rwunlock(vnode_t *, int, caller_context_t *);
205 static int	nfs3_seek(vnode_t *, offset_t, offset_t *, caller_context_t *);
206 static int	nfs3_getpage(vnode_t *, offset_t, size_t, uint_t *,
207 			page_t *[], size_t, struct seg *, caddr_t,
208 			enum seg_rw, cred_t *, caller_context_t *);
209 static int	nfs3_putpage(vnode_t *, offset_t, size_t, int, cred_t *,
210 			caller_context_t *);
211 static int	nfs3_map(vnode_t *, offset_t, struct as *, caddr_t *, size_t,
212 			uchar_t, uchar_t, uint_t, cred_t *, caller_context_t *);
213 static int	nfs3_addmap(vnode_t *, offset_t, struct as *, caddr_t, size_t,
214 			uchar_t, uchar_t, uint_t, cred_t *, caller_context_t *);
215 static int	nfs3_frlock(vnode_t *, int, struct flock64 *, int, offset_t,
216 			struct flk_callback *, cred_t *, caller_context_t *);
217 static int	nfs3_space(vnode_t *, int, struct flock64 *, int, offset_t,
218 			cred_t *, caller_context_t *);
219 static int	nfs3_realvp(vnode_t *, vnode_t **, caller_context_t *);
220 static int	nfs3_delmap(vnode_t *, offset_t, struct as *, caddr_t, size_t,
221 			uint_t, uint_t, uint_t, cred_t *, caller_context_t *);
222 static int	nfs3_pathconf(vnode_t *, int, ulong_t *, cred_t *,
223 			caller_context_t *);
224 static int	nfs3_pageio(vnode_t *, page_t *, u_offset_t, size_t, int,
225 			cred_t *, caller_context_t *);
226 static void	nfs3_dispose(vnode_t *, page_t *, int, int, cred_t *,
227 			caller_context_t *);
228 static int	nfs3_setsecattr(vnode_t *, vsecattr_t *, int, cred_t *,
229 			caller_context_t *);
230 static int	nfs3_getsecattr(vnode_t *, vsecattr_t *, int, cred_t *,
231 			caller_context_t *);
232 static int	nfs3_shrlock(vnode_t *, int, struct shrlock *, int, cred_t *,
233 			caller_context_t *);
234 
235 struct vnodeops *nfs3_vnodeops;
236 
237 const fs_operation_def_t nfs3_vnodeops_template[] = {
238 	VOPNAME_OPEN,		{ .vop_open = nfs3_open },
239 	VOPNAME_CLOSE,		{ .vop_close = nfs3_close },
240 	VOPNAME_READ,		{ .vop_read = nfs3_read },
241 	VOPNAME_WRITE,		{ .vop_write = nfs3_write },
242 	VOPNAME_IOCTL,		{ .vop_ioctl = nfs3_ioctl },
243 	VOPNAME_GETATTR,	{ .vop_getattr = nfs3_getattr },
244 	VOPNAME_SETATTR,	{ .vop_setattr = nfs3_setattr },
245 	VOPNAME_ACCESS,		{ .vop_access = nfs3_access },
246 	VOPNAME_LOOKUP,		{ .vop_lookup = nfs3_lookup },
247 	VOPNAME_CREATE,		{ .vop_create = nfs3_create },
248 	VOPNAME_REMOVE,		{ .vop_remove = nfs3_remove },
249 	VOPNAME_LINK,		{ .vop_link = nfs3_link },
250 	VOPNAME_RENAME,		{ .vop_rename = nfs3_rename },
251 	VOPNAME_MKDIR,		{ .vop_mkdir = nfs3_mkdir },
252 	VOPNAME_RMDIR,		{ .vop_rmdir = nfs3_rmdir },
253 	VOPNAME_READDIR,	{ .vop_readdir = nfs3_readdir },
254 	VOPNAME_SYMLINK,	{ .vop_symlink = nfs3_symlink },
255 	VOPNAME_READLINK,	{ .vop_readlink = nfs3_readlink },
256 	VOPNAME_FSYNC,		{ .vop_fsync = nfs3_fsync },
257 	VOPNAME_INACTIVE,	{ .vop_inactive = nfs3_inactive },
258 	VOPNAME_FID,		{ .vop_fid = nfs3_fid },
259 	VOPNAME_RWLOCK,		{ .vop_rwlock = nfs3_rwlock },
260 	VOPNAME_RWUNLOCK,	{ .vop_rwunlock = nfs3_rwunlock },
261 	VOPNAME_SEEK,		{ .vop_seek = nfs3_seek },
262 	VOPNAME_FRLOCK,		{ .vop_frlock = nfs3_frlock },
263 	VOPNAME_SPACE,		{ .vop_space = nfs3_space },
264 	VOPNAME_REALVP,		{ .vop_realvp = nfs3_realvp },
265 	VOPNAME_GETPAGE,	{ .vop_getpage = nfs3_getpage },
266 	VOPNAME_PUTPAGE,	{ .vop_putpage = nfs3_putpage },
267 	VOPNAME_MAP,		{ .vop_map = nfs3_map },
268 	VOPNAME_ADDMAP,		{ .vop_addmap = nfs3_addmap },
269 	VOPNAME_DELMAP,		{ .vop_delmap = nfs3_delmap },
270 	/* no separate nfs3_dump */
271 	VOPNAME_DUMP,		{ .vop_dump = nfs_dump },
272 	VOPNAME_PATHCONF,	{ .vop_pathconf = nfs3_pathconf },
273 	VOPNAME_PAGEIO,		{ .vop_pageio = nfs3_pageio },
274 	VOPNAME_DISPOSE,	{ .vop_dispose = nfs3_dispose },
275 	VOPNAME_SETSECATTR,	{ .vop_setsecattr = nfs3_setsecattr },
276 	VOPNAME_GETSECATTR,	{ .vop_getsecattr = nfs3_getsecattr },
277 	VOPNAME_SHRLOCK,	{ .vop_shrlock = nfs3_shrlock },
278 	VOPNAME_VNEVENT, 	{ .vop_vnevent = fs_vnevent_support },
279 	NULL,			NULL
280 };
281 
282 /*
283  * XXX:  This is referenced in modstubs.s
284  */
285 struct vnodeops *
286 nfs3_getvnodeops(void)
287 {
288 	return (nfs3_vnodeops);
289 }
290 
291 /* ARGSUSED */
292 static int
293 nfs3_open(vnode_t **vpp, int flag, cred_t *cr, caller_context_t *ct)
294 {
295 	int error;
296 	struct vattr va;
297 	rnode_t *rp;
298 	vnode_t *vp;
299 
300 	vp = *vpp;
301 	if (nfs_zone() != VTOMI(vp)->mi_zone)
302 		return (EIO);
303 	rp = VTOR(vp);
304 	mutex_enter(&rp->r_statelock);
305 	if (rp->r_cred == NULL) {
306 		crhold(cr);
307 		rp->r_cred = cr;
308 	}
309 	mutex_exit(&rp->r_statelock);
310 
311 	/*
312 	 * If there is no cached data or if close-to-open
313 	 * consistency checking is turned off, we can avoid
314 	 * the over the wire getattr.  Otherwise, if the
315 	 * file system is mounted readonly, then just verify
316 	 * the caches are up to date using the normal mechanism.
317 	 * Else, if the file is not mmap'd, then just mark
318 	 * the attributes as timed out.  They will be refreshed
319 	 * and the caches validated prior to being used.
320 	 * Else, the file system is mounted writeable so
321 	 * force an over the wire GETATTR in order to ensure
322 	 * that all cached data is valid.
323 	 */
324 	if (vp->v_count > 1 ||
325 	    ((vn_has_cached_data(vp) || HAVE_RDDIR_CACHE(rp)) &&
326 	    !(VTOMI(vp)->mi_flags & MI_NOCTO))) {
327 		if (vn_is_readonly(vp))
328 			error = nfs3_validate_caches(vp, cr);
329 		else if (rp->r_mapcnt == 0 && vp->v_count == 1) {
330 			PURGE_ATTRCACHE(vp);
331 			error = 0;
332 		} else {
333 			va.va_mask = AT_ALL;
334 			error = nfs3_getattr_otw(vp, &va, cr);
335 		}
336 	} else
337 		error = 0;
338 
339 	return (error);
340 }
341 
342 /* ARGSUSED */
343 static int
344 nfs3_close(vnode_t *vp, int flag, int count, offset_t offset, cred_t *cr,
345 		caller_context_t *ct)
346 {
347 	rnode_t *rp;
348 	int error;
349 	struct vattr va;
350 
351 	/*
352 	 * zone_enter(2) prevents processes from changing zones with NFS files
353 	 * open; if we happen to get here from the wrong zone we can't do
354 	 * anything over the wire.
355 	 */
356 	if (VTOMI(vp)->mi_zone != nfs_zone()) {
357 		/*
358 		 * We could attempt to clean up locks, except we're sure
359 		 * that the current process didn't acquire any locks on
360 		 * the file: any attempt to lock a file belong to another zone
361 		 * will fail, and one can't lock an NFS file and then change
362 		 * zones, as that fails too.
363 		 *
364 		 * Returning an error here is the sane thing to do.  A
365 		 * subsequent call to VN_RELE() which translates to a
366 		 * nfs3_inactive() will clean up state: if the zone of the
367 		 * vnode's origin is still alive and kicking, an async worker
368 		 * thread will handle the request (from the correct zone), and
369 		 * everything (minus the commit and final nfs3_getattr_otw()
370 		 * call) should be OK. If the zone is going away
371 		 * nfs_async_inactive() will throw away cached pages inline.
372 		 */
373 		return (EIO);
374 	}
375 
376 	/*
377 	 * If we are using local locking for this filesystem, then
378 	 * release all of the SYSV style record locks.  Otherwise,
379 	 * we are doing network locking and we need to release all
380 	 * of the network locks.  All of the locks held by this
381 	 * process on this file are released no matter what the
382 	 * incoming reference count is.
383 	 */
384 	if (VTOMI(vp)->mi_flags & MI_LLOCK) {
385 		cleanlocks(vp, ttoproc(curthread)->p_pid, 0);
386 		cleanshares(vp, ttoproc(curthread)->p_pid);
387 	} else
388 		nfs_lockrelease(vp, flag, offset, cr);
389 
390 	if (count > 1)
391 		return (0);
392 
393 	/*
394 	 * If the file has been `unlinked', then purge the
395 	 * DNLC so that this vnode will get reycled quicker
396 	 * and the .nfs* file on the server will get removed.
397 	 */
398 	rp = VTOR(vp);
399 	if (rp->r_unldvp != NULL)
400 		dnlc_purge_vp(vp);
401 
402 	/*
403 	 * If the file was open for write and there are pages,
404 	 * then if the file system was mounted using the "no-close-
405 	 *	to-open" semantics, then start an asynchronous flush
406 	 *	of the all of the pages in the file.
407 	 * else the file system was not mounted using the "no-close-
408 	 *	to-open" semantics, then do a synchronous flush and
409 	 *	commit of all of the dirty and uncommitted pages.
410 	 *
411 	 * The asynchronous flush of the pages in the "nocto" path
412 	 * mostly just associates a cred pointer with the rnode so
413 	 * writes which happen later will have a better chance of
414 	 * working.  It also starts the data being written to the
415 	 * server, but without unnecessarily delaying the application.
416 	 */
417 	if ((flag & FWRITE) && vn_has_cached_data(vp)) {
418 		if (VTOMI(vp)->mi_flags & MI_NOCTO) {
419 			error = nfs3_putpage(vp, (offset_t)0, 0, B_ASYNC,
420 			    cr, ct);
421 			if (error == EAGAIN)
422 				error = 0;
423 		} else
424 			error = nfs3_putpage_commit(vp, (offset_t)0, 0, cr);
425 		if (!error) {
426 			mutex_enter(&rp->r_statelock);
427 			error = rp->r_error;
428 			rp->r_error = 0;
429 			mutex_exit(&rp->r_statelock);
430 		}
431 	} else {
432 		mutex_enter(&rp->r_statelock);
433 		error = rp->r_error;
434 		rp->r_error = 0;
435 		mutex_exit(&rp->r_statelock);
436 	}
437 
438 	/*
439 	 * If RWRITEATTR is set, then issue an over the wire GETATTR to
440 	 * refresh the attribute cache with a set of attributes which
441 	 * weren't returned from a WRITE.  This will enable the close-
442 	 * to-open processing to work.
443 	 */
444 	if (rp->r_flags & RWRITEATTR)
445 		(void) nfs3_getattr_otw(vp, &va, cr);
446 
447 	return (error);
448 }
449 
450 /* ARGSUSED */
451 static int
452 nfs3_directio_read(vnode_t *vp, struct uio *uiop, cred_t *cr)
453 {
454 	mntinfo_t *mi;
455 	READ3args args;
456 	READ3uiores res;
457 	int tsize;
458 	offset_t offset;
459 	ssize_t count;
460 	int error;
461 	int douprintf;
462 	failinfo_t fi;
463 	char *sv_hostname;
464 
465 	mi = VTOMI(vp);
466 	ASSERT(nfs_zone() == VTOMI(vp)->mi_zone);
467 	sv_hostname = VTOR(vp)->r_server->sv_hostname;
468 
469 	douprintf = 1;
470 	args.file = *VTOFH3(vp);
471 	fi.vp = vp;
472 	fi.fhp = (caddr_t)&args.file;
473 	fi.copyproc = nfs3copyfh;
474 	fi.lookupproc = nfs3lookup;
475 	fi.xattrdirproc = acl_getxattrdir3;
476 
477 	res.uiop = uiop;
478 
479 	res.wlist = NULL;
480 
481 	offset = uiop->uio_loffset;
482 	count = uiop->uio_resid;
483 
484 	do {
485 		if (mi->mi_io_kstats) {
486 			mutex_enter(&mi->mi_lock);
487 			kstat_runq_enter(KSTAT_IO_PTR(mi->mi_io_kstats));
488 			mutex_exit(&mi->mi_lock);
489 		}
490 
491 		do {
492 			tsize = MIN(mi->mi_tsize, count);
493 			args.offset = (offset3)offset;
494 			args.count = (count3)tsize;
495 			res.size = (uint_t)tsize;
496 			args.res_uiop = uiop;
497 			args.res_data_val_alt = NULL;
498 
499 			error = rfs3call(mi, NFSPROC3_READ,
500 			    xdr_READ3args, (caddr_t)&args,
501 			    xdr_READ3uiores, (caddr_t)&res, cr,
502 			    &douprintf, &res.status, 0, &fi);
503 		} while (error == ENFS_TRYAGAIN);
504 
505 		if (mi->mi_io_kstats) {
506 			mutex_enter(&mi->mi_lock);
507 			kstat_runq_exit(KSTAT_IO_PTR(mi->mi_io_kstats));
508 			mutex_exit(&mi->mi_lock);
509 		}
510 
511 		if (error)
512 			return (error);
513 
514 		error = geterrno3(res.status);
515 		if (error)
516 			return (error);
517 
518 		if (res.count != res.size) {
519 			zcmn_err(getzoneid(), CE_WARN,
520 "nfs3_directio_read: server %s returned incorrect amount",
521 			    sv_hostname);
522 			return (EIO);
523 		}
524 		count -= res.count;
525 		offset += res.count;
526 		if (mi->mi_io_kstats) {
527 			mutex_enter(&mi->mi_lock);
528 			KSTAT_IO_PTR(mi->mi_io_kstats)->reads++;
529 			KSTAT_IO_PTR(mi->mi_io_kstats)->nread += res.count;
530 			mutex_exit(&mi->mi_lock);
531 		}
532 		lwp_stat_update(LWP_STAT_INBLK, 1);
533 	} while (count && !res.eof);
534 
535 	return (0);
536 }
537 
538 /* ARGSUSED */
539 static int
540 nfs3_read(vnode_t *vp, struct uio *uiop, int ioflag, cred_t *cr,
541 	caller_context_t *ct)
542 {
543 	rnode_t *rp;
544 	u_offset_t off;
545 	offset_t diff;
546 	int on;
547 	size_t n;
548 	caddr_t base;
549 	uint_t flags;
550 	int error = 0;
551 	mntinfo_t *mi;
552 
553 	rp = VTOR(vp);
554 	mi = VTOMI(vp);
555 
556 	ASSERT(nfs_rw_lock_held(&rp->r_rwlock, RW_READER));
557 
558 	if (nfs_zone() != mi->mi_zone)
559 		return (EIO);
560 
561 	if (vp->v_type != VREG)
562 		return (EISDIR);
563 
564 	if (uiop->uio_resid == 0)
565 		return (0);
566 
567 	if (uiop->uio_loffset < 0 || uiop->uio_loffset + uiop->uio_resid < 0)
568 		return (EINVAL);
569 
570 	/*
571 	 * Bypass VM if caching has been disabled (e.g., locking) or if
572 	 * using client-side direct I/O and the file is not mmap'd and
573 	 * there are no cached pages.
574 	 */
575 	if ((vp->v_flag & VNOCACHE) ||
576 	    (((rp->r_flags & RDIRECTIO) || (mi->mi_flags & MI_DIRECTIO)) &&
577 	    rp->r_mapcnt == 0 && rp->r_inmap == 0 &&
578 	    !vn_has_cached_data(vp))) {
579 		return (nfs3_directio_read(vp, uiop, cr));
580 	}
581 
582 	do {
583 		off = uiop->uio_loffset & MAXBMASK; /* mapping offset */
584 		on = uiop->uio_loffset & MAXBOFFSET; /* Relative offset */
585 		n = MIN(MAXBSIZE - on, uiop->uio_resid);
586 
587 		error = nfs3_validate_caches(vp, cr);
588 		if (error)
589 			break;
590 
591 		mutex_enter(&rp->r_statelock);
592 		while (rp->r_flags & RINCACHEPURGE) {
593 			if (!cv_wait_sig(&rp->r_cv, &rp->r_statelock)) {
594 				mutex_exit(&rp->r_statelock);
595 				return (EINTR);
596 			}
597 		}
598 		diff = rp->r_size - uiop->uio_loffset;
599 		mutex_exit(&rp->r_statelock);
600 		if (diff <= 0)
601 			break;
602 		if (diff < n)
603 			n = (size_t)diff;
604 
605 		if (vpm_enable) {
606 			/*
607 			 * Copy data.
608 			 */
609 			error = vpm_data_copy(vp, off + on, n, uiop,
610 			    1, NULL, 0, S_READ);
611 		} else {
612 			base = segmap_getmapflt(segkmap, vp, off + on, n, 1,
613 			    S_READ);
614 
615 			error = uiomove(base + on, n, UIO_READ, uiop);
616 		}
617 
618 		if (!error) {
619 			/*
620 			 * If read a whole block or read to eof,
621 			 * won't need this buffer again soon.
622 			 */
623 			mutex_enter(&rp->r_statelock);
624 			if (n + on == MAXBSIZE ||
625 			    uiop->uio_loffset == rp->r_size)
626 				flags = SM_DONTNEED;
627 			else
628 				flags = 0;
629 			mutex_exit(&rp->r_statelock);
630 			if (vpm_enable) {
631 				error = vpm_sync_pages(vp, off, n, flags);
632 			} else {
633 				error = segmap_release(segkmap, base, flags);
634 			}
635 		} else {
636 			if (vpm_enable) {
637 				(void) vpm_sync_pages(vp, off, n, 0);
638 			} else {
639 				(void) segmap_release(segkmap, base, 0);
640 			}
641 		}
642 	} while (!error && uiop->uio_resid > 0);
643 
644 	return (error);
645 }
646 
647 /* ARGSUSED */
648 static int
649 nfs3_write(vnode_t *vp, struct uio *uiop, int ioflag, cred_t *cr,
650 	caller_context_t *ct)
651 {
652 	rlim64_t limit = uiop->uio_llimit;
653 	rnode_t *rp;
654 	u_offset_t off;
655 	caddr_t base;
656 	uint_t flags;
657 	int remainder;
658 	size_t n;
659 	int on;
660 	int error;
661 	int resid;
662 	offset_t offset;
663 	mntinfo_t *mi;
664 	uint_t bsize;
665 
666 	rp = VTOR(vp);
667 
668 	if (vp->v_type != VREG)
669 		return (EISDIR);
670 
671 	mi = VTOMI(vp);
672 	if (nfs_zone() != mi->mi_zone)
673 		return (EIO);
674 	if (uiop->uio_resid == 0)
675 		return (0);
676 
677 	if (ioflag & FAPPEND) {
678 		struct vattr va;
679 
680 		/*
681 		 * Must serialize if appending.
682 		 */
683 		if (nfs_rw_lock_held(&rp->r_rwlock, RW_READER)) {
684 			nfs_rw_exit(&rp->r_rwlock);
685 			if (nfs_rw_enter_sig(&rp->r_rwlock, RW_WRITER,
686 			    INTR(vp)))
687 				return (EINTR);
688 		}
689 
690 		va.va_mask = AT_SIZE;
691 		error = nfs3getattr(vp, &va, cr);
692 		if (error)
693 			return (error);
694 		uiop->uio_loffset = va.va_size;
695 	}
696 
697 	offset = uiop->uio_loffset + uiop->uio_resid;
698 
699 	if (uiop->uio_loffset < 0 || offset < 0)
700 		return (EINVAL);
701 
702 	if (limit == RLIM64_INFINITY || limit > MAXOFFSET_T)
703 		limit = MAXOFFSET_T;
704 
705 	/*
706 	 * Check to make sure that the process will not exceed
707 	 * its limit on file size.  It is okay to write up to
708 	 * the limit, but not beyond.  Thus, the write which
709 	 * reaches the limit will be short and the next write
710 	 * will return an error.
711 	 */
712 	remainder = 0;
713 	if (offset > limit) {
714 		remainder = offset - limit;
715 		uiop->uio_resid = limit - uiop->uio_loffset;
716 		if (uiop->uio_resid <= 0) {
717 			proc_t *p = ttoproc(curthread);
718 
719 			uiop->uio_resid += remainder;
720 			mutex_enter(&p->p_lock);
721 			(void) rctl_action(rctlproc_legacy[RLIMIT_FSIZE],
722 			    p->p_rctls, p, RCA_UNSAFE_SIGINFO);
723 			mutex_exit(&p->p_lock);
724 			return (EFBIG);
725 		}
726 	}
727 
728 	if (nfs_rw_enter_sig(&rp->r_lkserlock, RW_READER, INTR(vp)))
729 		return (EINTR);
730 
731 	/*
732 	 * Bypass VM if caching has been disabled (e.g., locking) or if
733 	 * using client-side direct I/O and the file is not mmap'd and
734 	 * there are no cached pages.
735 	 */
736 	if ((vp->v_flag & VNOCACHE) ||
737 	    (((rp->r_flags & RDIRECTIO) || (mi->mi_flags & MI_DIRECTIO)) &&
738 	    rp->r_mapcnt == 0 && rp->r_inmap == 0 &&
739 	    !vn_has_cached_data(vp))) {
740 		size_t bufsize;
741 		int count;
742 		u_offset_t org_offset;
743 		stable_how stab_comm;
744 
745 nfs3_fwrite:
746 		if (rp->r_flags & RSTALE) {
747 			resid = uiop->uio_resid;
748 			offset = uiop->uio_loffset;
749 			error = rp->r_error;
750 			goto bottom;
751 		}
752 		bufsize = MIN(uiop->uio_resid, mi->mi_stsize);
753 		base = kmem_alloc(bufsize, KM_SLEEP);
754 		do {
755 			if (ioflag & FDSYNC)
756 				stab_comm = DATA_SYNC;
757 			else
758 				stab_comm = FILE_SYNC;
759 			resid = uiop->uio_resid;
760 			offset = uiop->uio_loffset;
761 			count = MIN(uiop->uio_resid, bufsize);
762 			org_offset = uiop->uio_loffset;
763 			error = uiomove(base, count, UIO_WRITE, uiop);
764 			if (!error) {
765 				error = nfs3write(vp, base, org_offset,
766 				    count, cr, &stab_comm);
767 			}
768 		} while (!error && uiop->uio_resid > 0);
769 		kmem_free(base, bufsize);
770 		goto bottom;
771 	}
772 
773 
774 	bsize = vp->v_vfsp->vfs_bsize;
775 
776 	do {
777 		off = uiop->uio_loffset & MAXBMASK; /* mapping offset */
778 		on = uiop->uio_loffset & MAXBOFFSET; /* Relative offset */
779 		n = MIN(MAXBSIZE - on, uiop->uio_resid);
780 
781 		resid = uiop->uio_resid;
782 		offset = uiop->uio_loffset;
783 
784 		if (rp->r_flags & RSTALE) {
785 			error = rp->r_error;
786 			break;
787 		}
788 
789 		/*
790 		 * Don't create dirty pages faster than they
791 		 * can be cleaned so that the system doesn't
792 		 * get imbalanced.  If the async queue is
793 		 * maxed out, then wait for it to drain before
794 		 * creating more dirty pages.  Also, wait for
795 		 * any threads doing pagewalks in the vop_getattr
796 		 * entry points so that they don't block for
797 		 * long periods.
798 		 */
799 		mutex_enter(&rp->r_statelock);
800 		while ((mi->mi_max_threads != 0 &&
801 		    rp->r_awcount > 2 * mi->mi_max_threads) ||
802 		    rp->r_gcount > 0)
803 			cv_wait(&rp->r_cv, &rp->r_statelock);
804 		mutex_exit(&rp->r_statelock);
805 
806 		/*
807 		 * Touch the page and fault it in if it is not in core
808 		 * before segmap_getmapflt or vpm_data_copy can lock it.
809 		 * This is to avoid the deadlock if the buffer is mapped
810 		 * to the same file through mmap which we want to write.
811 		 */
812 		uio_prefaultpages((long)n, uiop);
813 
814 		if (vpm_enable) {
815 			/*
816 			 * It will use kpm mappings, so no need to
817 			 * pass an address.
818 			 */
819 			error = writerp(rp, NULL, n, uiop, 0);
820 		} else  {
821 			if (segmap_kpm) {
822 				int pon = uiop->uio_loffset & PAGEOFFSET;
823 				size_t pn = MIN(PAGESIZE - pon,
824 				    uiop->uio_resid);
825 				int pagecreate;
826 
827 				mutex_enter(&rp->r_statelock);
828 				pagecreate = (pon == 0) && (pn == PAGESIZE ||
829 				    uiop->uio_loffset + pn >= rp->r_size);
830 				mutex_exit(&rp->r_statelock);
831 
832 				base = segmap_getmapflt(segkmap, vp, off + on,
833 				    pn, !pagecreate, S_WRITE);
834 
835 				error = writerp(rp, base + pon, n, uiop,
836 				    pagecreate);
837 
838 			} else {
839 				base = segmap_getmapflt(segkmap, vp, off + on,
840 				    n, 0, S_READ);
841 				error = writerp(rp, base + on, n, uiop, 0);
842 			}
843 		}
844 
845 		if (!error) {
846 			if (mi->mi_flags & MI_NOAC)
847 				flags = SM_WRITE;
848 			else if ((uiop->uio_loffset % bsize) == 0 ||
849 			    IS_SWAPVP(vp)) {
850 				/*
851 				 * Have written a whole block.
852 				 * Start an asynchronous write
853 				 * and mark the buffer to
854 				 * indicate that it won't be
855 				 * needed again soon.
856 				 */
857 				flags = SM_WRITE | SM_ASYNC | SM_DONTNEED;
858 			} else
859 				flags = 0;
860 			if ((ioflag & (FSYNC|FDSYNC)) ||
861 			    (rp->r_flags & ROUTOFSPACE)) {
862 				flags &= ~SM_ASYNC;
863 				flags |= SM_WRITE;
864 			}
865 			if (vpm_enable) {
866 				error = vpm_sync_pages(vp, off, n, flags);
867 			} else {
868 				error = segmap_release(segkmap, base, flags);
869 			}
870 		} else {
871 			if (vpm_enable) {
872 				(void) vpm_sync_pages(vp, off, n, 0);
873 			} else {
874 				(void) segmap_release(segkmap, base, 0);
875 			}
876 			/*
877 			 * In the event that we got an access error while
878 			 * faulting in a page for a write-only file just
879 			 * force a write.
880 			 */
881 			if (error == EACCES)
882 				goto nfs3_fwrite;
883 		}
884 	} while (!error && uiop->uio_resid > 0);
885 
886 bottom:
887 	if (error) {
888 		uiop->uio_resid = resid + remainder;
889 		uiop->uio_loffset = offset;
890 	} else
891 		uiop->uio_resid += remainder;
892 
893 	nfs_rw_exit(&rp->r_lkserlock);
894 
895 	return (error);
896 }
897 
898 /*
899  * Flags are composed of {B_ASYNC, B_INVAL, B_FREE, B_DONTNEED}
900  */
901 static int
902 nfs3_rdwrlbn(vnode_t *vp, page_t *pp, u_offset_t off, size_t len,
903 	int flags, cred_t *cr)
904 {
905 	struct buf *bp;
906 	int error;
907 	page_t *savepp;
908 	uchar_t fsdata;
909 	stable_how stab_comm;
910 
911 	ASSERT(nfs_zone() == VTOMI(vp)->mi_zone);
912 	bp = pageio_setup(pp, len, vp, flags);
913 	ASSERT(bp != NULL);
914 
915 	/*
916 	 * pageio_setup should have set b_addr to 0.  This
917 	 * is correct since we want to do I/O on a page
918 	 * boundary.  bp_mapin will use this addr to calculate
919 	 * an offset, and then set b_addr to the kernel virtual
920 	 * address it allocated for us.
921 	 */
922 	ASSERT(bp->b_un.b_addr == 0);
923 
924 	bp->b_edev = 0;
925 	bp->b_dev = 0;
926 	bp->b_lblkno = lbtodb(off);
927 	bp->b_file = vp;
928 	bp->b_offset = (offset_t)off;
929 	bp_mapin(bp);
930 
931 	/*
932 	 * Calculate the desired level of stability to write data
933 	 * on the server and then mark all of the pages to reflect
934 	 * this.
935 	 */
936 	if ((flags & (B_WRITE|B_ASYNC)) == (B_WRITE|B_ASYNC) &&
937 	    freemem > desfree) {
938 		stab_comm = UNSTABLE;
939 		fsdata = C_DELAYCOMMIT;
940 	} else {
941 		stab_comm = FILE_SYNC;
942 		fsdata = C_NOCOMMIT;
943 	}
944 
945 	savepp = pp;
946 	do {
947 		pp->p_fsdata = fsdata;
948 	} while ((pp = pp->p_next) != savepp);
949 
950 	error = nfs3_bio(bp, &stab_comm, cr);
951 
952 	bp_mapout(bp);
953 	pageio_done(bp);
954 
955 	/*
956 	 * If the server wrote pages in a more stable fashion than
957 	 * was requested, then clear all of the marks in the pages
958 	 * indicating that COMMIT operations were required.
959 	 */
960 	if (stab_comm != UNSTABLE && fsdata == C_DELAYCOMMIT) {
961 		do {
962 			pp->p_fsdata = C_NOCOMMIT;
963 		} while ((pp = pp->p_next) != savepp);
964 	}
965 
966 	return (error);
967 }
968 
969 /*
970  * Write to file.  Writes to remote server in largest size
971  * chunks that the server can handle.  Write is synchronous.
972  */
973 static int
974 nfs3write(vnode_t *vp, caddr_t base, u_offset_t offset, int count, cred_t *cr,
975 	stable_how *stab_comm)
976 {
977 	mntinfo_t *mi;
978 	WRITE3args args;
979 	WRITE3res res;
980 	int error;
981 	int tsize;
982 	rnode_t *rp;
983 	int douprintf;
984 
985 	rp = VTOR(vp);
986 	mi = VTOMI(vp);
987 
988 	ASSERT(nfs_zone() == mi->mi_zone);
989 
990 	args.file = *VTOFH3(vp);
991 	args.stable = *stab_comm;
992 
993 	*stab_comm = FILE_SYNC;
994 
995 	douprintf = 1;
996 
997 	do {
998 		if ((vp->v_flag & VNOCACHE) ||
999 		    (rp->r_flags & RDIRECTIO) ||
1000 		    (mi->mi_flags & MI_DIRECTIO))
1001 			tsize = MIN(mi->mi_stsize, count);
1002 		else
1003 			tsize = MIN(mi->mi_curwrite, count);
1004 		args.offset = (offset3)offset;
1005 		args.count = (count3)tsize;
1006 		args.data.data_len = (uint_t)tsize;
1007 		args.data.data_val = base;
1008 
1009 		if (mi->mi_io_kstats) {
1010 			mutex_enter(&mi->mi_lock);
1011 			kstat_runq_enter(KSTAT_IO_PTR(mi->mi_io_kstats));
1012 			mutex_exit(&mi->mi_lock);
1013 		}
1014 		args.mblk = NULL;
1015 		do {
1016 			error = rfs3call(mi, NFSPROC3_WRITE,
1017 			    xdr_WRITE3args, (caddr_t)&args,
1018 			    xdr_WRITE3res, (caddr_t)&res, cr,
1019 			    &douprintf, &res.status, 0, NULL);
1020 		} while (error == ENFS_TRYAGAIN);
1021 		if (mi->mi_io_kstats) {
1022 			mutex_enter(&mi->mi_lock);
1023 			kstat_runq_exit(KSTAT_IO_PTR(mi->mi_io_kstats));
1024 			mutex_exit(&mi->mi_lock);
1025 		}
1026 
1027 		if (error)
1028 			return (error);
1029 		error = geterrno3(res.status);
1030 		if (!error) {
1031 			if (res.resok.count > args.count) {
1032 				zcmn_err(getzoneid(), CE_WARN,
1033 				    "nfs3write: server %s wrote %u, "
1034 				    "requested was %u",
1035 				    rp->r_server->sv_hostname,
1036 				    res.resok.count, args.count);
1037 				return (EIO);
1038 			}
1039 			if (res.resok.committed == UNSTABLE) {
1040 				*stab_comm = UNSTABLE;
1041 				if (args.stable == DATA_SYNC ||
1042 				    args.stable == FILE_SYNC) {
1043 					zcmn_err(getzoneid(), CE_WARN,
1044 			"nfs3write: server %s did not commit to stable storage",
1045 					    rp->r_server->sv_hostname);
1046 					return (EIO);
1047 				}
1048 			}
1049 			tsize = (int)res.resok.count;
1050 			count -= tsize;
1051 			base += tsize;
1052 			offset += tsize;
1053 			if (mi->mi_io_kstats) {
1054 				mutex_enter(&mi->mi_lock);
1055 				KSTAT_IO_PTR(mi->mi_io_kstats)->writes++;
1056 				KSTAT_IO_PTR(mi->mi_io_kstats)->nwritten +=
1057 				    tsize;
1058 				mutex_exit(&mi->mi_lock);
1059 			}
1060 			lwp_stat_update(LWP_STAT_OUBLK, 1);
1061 			mutex_enter(&rp->r_statelock);
1062 			if (rp->r_flags & RHAVEVERF) {
1063 				if (rp->r_verf != res.resok.verf) {
1064 					nfs3_set_mod(vp);
1065 					rp->r_verf = res.resok.verf;
1066 					/*
1067 					 * If the data was written UNSTABLE,
1068 					 * then might as well stop because
1069 					 * the whole block will have to get
1070 					 * rewritten anyway.
1071 					 */
1072 					if (*stab_comm == UNSTABLE) {
1073 						mutex_exit(&rp->r_statelock);
1074 						break;
1075 					}
1076 				}
1077 			} else {
1078 				rp->r_verf = res.resok.verf;
1079 				rp->r_flags |= RHAVEVERF;
1080 			}
1081 			/*
1082 			 * Mark the attribute cache as timed out and
1083 			 * set RWRITEATTR to indicate that the file
1084 			 * was modified with a WRITE operation and
1085 			 * that the attributes can not be trusted.
1086 			 */
1087 			PURGE_ATTRCACHE_LOCKED(rp);
1088 			rp->r_flags |= RWRITEATTR;
1089 			mutex_exit(&rp->r_statelock);
1090 		}
1091 	} while (!error && count);
1092 
1093 	return (error);
1094 }
1095 
1096 /*
1097  * Read from a file.  Reads data in largest chunks our interface can handle.
1098  */
1099 static int
1100 nfs3read(vnode_t *vp, caddr_t base, offset_t offset, int count,
1101 	size_t *residp, cred_t *cr)
1102 {
1103 	mntinfo_t *mi;
1104 	READ3args args;
1105 	READ3vres res;
1106 	int tsize;
1107 	int error;
1108 	int douprintf;
1109 	failinfo_t fi;
1110 	rnode_t *rp;
1111 	struct vattr va;
1112 	hrtime_t t;
1113 
1114 	rp = VTOR(vp);
1115 	mi = VTOMI(vp);
1116 	ASSERT(nfs_zone() == mi->mi_zone);
1117 	douprintf = 1;
1118 
1119 	args.file = *VTOFH3(vp);
1120 	fi.vp = vp;
1121 	fi.fhp = (caddr_t)&args.file;
1122 	fi.copyproc = nfs3copyfh;
1123 	fi.lookupproc = nfs3lookup;
1124 	fi.xattrdirproc = acl_getxattrdir3;
1125 
1126 	res.pov.fres.vp = vp;
1127 	res.pov.fres.vap = &va;
1128 
1129 	res.wlist = NULL;
1130 	*residp = count;
1131 	do {
1132 		if (mi->mi_io_kstats) {
1133 			mutex_enter(&mi->mi_lock);
1134 			kstat_runq_enter(KSTAT_IO_PTR(mi->mi_io_kstats));
1135 			mutex_exit(&mi->mi_lock);
1136 		}
1137 
1138 		do {
1139 			if ((vp->v_flag & VNOCACHE) ||
1140 			    (rp->r_flags & RDIRECTIO) ||
1141 			    (mi->mi_flags & MI_DIRECTIO))
1142 				tsize = MIN(mi->mi_tsize, count);
1143 			else
1144 				tsize = MIN(mi->mi_curread, count);
1145 			res.data.data_val = base;
1146 			res.data.data_len = tsize;
1147 			args.offset = (offset3)offset;
1148 			args.count = (count3)tsize;
1149 			args.res_uiop = NULL;
1150 			args.res_data_val_alt = base;
1151 
1152 			t = gethrtime();
1153 			error = rfs3call(mi, NFSPROC3_READ,
1154 			    xdr_READ3args, (caddr_t)&args,
1155 			    xdr_READ3vres, (caddr_t)&res, cr,
1156 			    &douprintf, &res.status, 0, &fi);
1157 		} while (error == ENFS_TRYAGAIN);
1158 
1159 		if (mi->mi_io_kstats) {
1160 			mutex_enter(&mi->mi_lock);
1161 			kstat_runq_exit(KSTAT_IO_PTR(mi->mi_io_kstats));
1162 			mutex_exit(&mi->mi_lock);
1163 		}
1164 
1165 		if (error)
1166 			return (error);
1167 
1168 		error = geterrno3(res.status);
1169 		if (error)
1170 			return (error);
1171 
1172 		if (res.count != res.data.data_len) {
1173 			zcmn_err(getzoneid(), CE_WARN,
1174 			    "nfs3read: server %s returned incorrect amount",
1175 			    rp->r_server->sv_hostname);
1176 			return (EIO);
1177 		}
1178 
1179 		count -= res.count;
1180 		*residp = count;
1181 		base += res.count;
1182 		offset += res.count;
1183 		if (mi->mi_io_kstats) {
1184 			mutex_enter(&mi->mi_lock);
1185 			KSTAT_IO_PTR(mi->mi_io_kstats)->reads++;
1186 			KSTAT_IO_PTR(mi->mi_io_kstats)->nread += res.count;
1187 			mutex_exit(&mi->mi_lock);
1188 		}
1189 		lwp_stat_update(LWP_STAT_INBLK, 1);
1190 	} while (count && !res.eof);
1191 
1192 	if (res.pov.attributes) {
1193 		mutex_enter(&rp->r_statelock);
1194 		if (!CACHE_VALID(rp, va.va_mtime, va.va_size)) {
1195 			mutex_exit(&rp->r_statelock);
1196 			PURGE_ATTRCACHE(vp);
1197 		} else {
1198 			if (rp->r_mtime <= t)
1199 				nfs_attrcache_va(vp, &va);
1200 			mutex_exit(&rp->r_statelock);
1201 		}
1202 	}
1203 
1204 	return (0);
1205 }
1206 
1207 /* ARGSUSED */
1208 static int
1209 nfs3_ioctl(vnode_t *vp, int cmd, intptr_t arg, int flag, cred_t *cr, int *rvalp,
1210 	caller_context_t *ct)
1211 {
1212 
1213 	if (nfs_zone() != VTOMI(vp)->mi_zone)
1214 		return (EIO);
1215 	switch (cmd) {
1216 		case _FIODIRECTIO:
1217 			return (nfs_directio(vp, (int)arg, cr));
1218 		default:
1219 			return (ENOTTY);
1220 	}
1221 }
1222 
1223 /* ARGSUSED */
1224 static int
1225 nfs3_getattr(vnode_t *vp, struct vattr *vap, int flags, cred_t *cr,
1226 	caller_context_t *ct)
1227 {
1228 	int error;
1229 	rnode_t *rp;
1230 
1231 	if (nfs_zone() != VTOMI(vp)->mi_zone)
1232 		return (EIO);
1233 	/*
1234 	 * If it has been specified that the return value will
1235 	 * just be used as a hint, and we are only being asked
1236 	 * for size, fsid or rdevid, then return the client's
1237 	 * notion of these values without checking to make sure
1238 	 * that the attribute cache is up to date.
1239 	 * The whole point is to avoid an over the wire GETATTR
1240 	 * call.
1241 	 */
1242 	rp = VTOR(vp);
1243 	if (flags & ATTR_HINT) {
1244 		if (vap->va_mask ==
1245 		    (vap->va_mask & (AT_SIZE | AT_FSID | AT_RDEV))) {
1246 			mutex_enter(&rp->r_statelock);
1247 			if (vap->va_mask | AT_SIZE)
1248 				vap->va_size = rp->r_size;
1249 			if (vap->va_mask | AT_FSID)
1250 				vap->va_fsid = rp->r_attr.va_fsid;
1251 			if (vap->va_mask | AT_RDEV)
1252 				vap->va_rdev = rp->r_attr.va_rdev;
1253 			mutex_exit(&rp->r_statelock);
1254 			return (0);
1255 		}
1256 	}
1257 
1258 	/*
1259 	 * Only need to flush pages if asking for the mtime
1260 	 * and if there any dirty pages or any outstanding
1261 	 * asynchronous (write) requests for this file.
1262 	 */
1263 	if (vap->va_mask & AT_MTIME) {
1264 		if (vn_has_cached_data(vp) &&
1265 		    ((rp->r_flags & RDIRTY) || rp->r_awcount > 0)) {
1266 			mutex_enter(&rp->r_statelock);
1267 			rp->r_gcount++;
1268 			mutex_exit(&rp->r_statelock);
1269 			error = nfs3_putpage(vp, (offset_t)0, 0, 0, cr, ct);
1270 			mutex_enter(&rp->r_statelock);
1271 			if (error && (error == ENOSPC || error == EDQUOT)) {
1272 				if (!rp->r_error)
1273 					rp->r_error = error;
1274 			}
1275 			if (--rp->r_gcount == 0)
1276 				cv_broadcast(&rp->r_cv);
1277 			mutex_exit(&rp->r_statelock);
1278 		}
1279 	}
1280 
1281 	return (nfs3getattr(vp, vap, cr));
1282 }
1283 
1284 /*ARGSUSED4*/
1285 static int
1286 nfs3_setattr(vnode_t *vp, struct vattr *vap, int flags, cred_t *cr,
1287 		caller_context_t *ct)
1288 {
1289 	int error;
1290 	struct vattr va;
1291 
1292 	if (vap->va_mask & AT_NOSET)
1293 		return (EINVAL);
1294 	if (nfs_zone() != VTOMI(vp)->mi_zone)
1295 		return (EIO);
1296 
1297 	va.va_mask = AT_UID | AT_MODE;
1298 	error = nfs3getattr(vp, &va, cr);
1299 	if (error)
1300 		return (error);
1301 
1302 	error = secpolicy_vnode_setattr(cr, vp, vap, &va, flags, nfs3_accessx,
1303 	    vp);
1304 	if (error)
1305 		return (error);
1306 
1307 	return (nfs3setattr(vp, vap, flags, cr));
1308 }
1309 
1310 static int
1311 nfs3setattr(vnode_t *vp, struct vattr *vap, int flags, cred_t *cr)
1312 {
1313 	int error;
1314 	uint_t mask;
1315 	SETATTR3args args;
1316 	SETATTR3res res;
1317 	int douprintf;
1318 	rnode_t *rp;
1319 	struct vattr va;
1320 	mode_t omode;
1321 	vsecattr_t *vsp;
1322 	hrtime_t t;
1323 
1324 	ASSERT(nfs_zone() == VTOMI(vp)->mi_zone);
1325 	mask = vap->va_mask;
1326 
1327 	rp = VTOR(vp);
1328 
1329 	/*
1330 	 * Only need to flush pages if there are any pages and
1331 	 * if the file is marked as dirty in some fashion.  The
1332 	 * file must be flushed so that we can accurately
1333 	 * determine the size of the file and the cached data
1334 	 * after the SETATTR returns.  A file is considered to
1335 	 * be dirty if it is either marked with RDIRTY, has
1336 	 * outstanding i/o's active, or is mmap'd.  In this
1337 	 * last case, we can't tell whether there are dirty
1338 	 * pages, so we flush just to be sure.
1339 	 */
1340 	if (vn_has_cached_data(vp) &&
1341 	    ((rp->r_flags & RDIRTY) ||
1342 	    rp->r_count > 0 ||
1343 	    rp->r_mapcnt > 0)) {
1344 		ASSERT(vp->v_type != VCHR);
1345 		error = nfs3_putpage(vp, (offset_t)0, 0, 0, cr, NULL);
1346 		if (error && (error == ENOSPC || error == EDQUOT)) {
1347 			mutex_enter(&rp->r_statelock);
1348 			if (!rp->r_error)
1349 				rp->r_error = error;
1350 			mutex_exit(&rp->r_statelock);
1351 		}
1352 	}
1353 
1354 	args.object = *RTOFH3(rp);
1355 	/*
1356 	 * If the intent is for the server to set the times,
1357 	 * there is no point in have the mask indicating set mtime or
1358 	 * atime, because the vap values may be junk, and so result
1359 	 * in an overflow error. Remove these flags from the vap mask
1360 	 * before calling in this case, and restore them afterwards.
1361 	 */
1362 	if ((mask & (AT_ATIME | AT_MTIME)) && !(flags & ATTR_UTIME)) {
1363 		/* Use server times, so don't set the args time fields */
1364 		vap->va_mask &= ~(AT_ATIME | AT_MTIME);
1365 		error = vattr_to_sattr3(vap, &args.new_attributes);
1366 		vap->va_mask |= (mask & (AT_ATIME | AT_MTIME));
1367 		if (mask & AT_ATIME) {
1368 			args.new_attributes.atime.set_it = SET_TO_SERVER_TIME;
1369 		}
1370 		if (mask & AT_MTIME) {
1371 			args.new_attributes.mtime.set_it = SET_TO_SERVER_TIME;
1372 		}
1373 	} else {
1374 		/* Either do not set times or use the client specified times */
1375 		error = vattr_to_sattr3(vap, &args.new_attributes);
1376 	}
1377 
1378 	if (error) {
1379 		/* req time field(s) overflow - return immediately */
1380 		return (error);
1381 	}
1382 
1383 	va.va_mask = AT_MODE | AT_CTIME;
1384 	error = nfs3getattr(vp, &va, cr);
1385 	if (error)
1386 		return (error);
1387 	omode = va.va_mode;
1388 
1389 tryagain:
1390 	if (mask & AT_SIZE) {
1391 		args.guard.check = TRUE;
1392 		args.guard.obj_ctime.seconds = va.va_ctime.tv_sec;
1393 		args.guard.obj_ctime.nseconds = va.va_ctime.tv_nsec;
1394 	} else
1395 		args.guard.check = FALSE;
1396 
1397 	douprintf = 1;
1398 
1399 	t = gethrtime();
1400 
1401 	error = rfs3call(VTOMI(vp), NFSPROC3_SETATTR,
1402 	    xdr_SETATTR3args, (caddr_t)&args,
1403 	    xdr_SETATTR3res, (caddr_t)&res, cr,
1404 	    &douprintf, &res.status, 0, NULL);
1405 
1406 	/*
1407 	 * Purge the access cache and ACL cache if changing either the
1408 	 * owner of the file, the group owner, or the mode.  These may
1409 	 * change the access permissions of the file, so purge old
1410 	 * information and start over again.
1411 	 */
1412 	if (mask & (AT_UID | AT_GID | AT_MODE)) {
1413 		(void) nfs_access_purge_rp(rp);
1414 		if (rp->r_secattr != NULL) {
1415 			mutex_enter(&rp->r_statelock);
1416 			vsp = rp->r_secattr;
1417 			rp->r_secattr = NULL;
1418 			mutex_exit(&rp->r_statelock);
1419 			if (vsp != NULL)
1420 				nfs_acl_free(vsp);
1421 		}
1422 	}
1423 
1424 	if (error) {
1425 		PURGE_ATTRCACHE(vp);
1426 		return (error);
1427 	}
1428 
1429 	error = geterrno3(res.status);
1430 	if (!error) {
1431 		/*
1432 		 * If changing the size of the file, invalidate
1433 		 * any local cached data which is no longer part
1434 		 * of the file.  We also possibly invalidate the
1435 		 * last page in the file.  We could use
1436 		 * pvn_vpzero(), but this would mark the page as
1437 		 * modified and require it to be written back to
1438 		 * the server for no particularly good reason.
1439 		 * This way, if we access it, then we bring it
1440 		 * back in.  A read should be cheaper than a
1441 		 * write.
1442 		 */
1443 		if (mask & AT_SIZE) {
1444 			nfs_invalidate_pages(vp,
1445 			    (vap->va_size & PAGEMASK), cr);
1446 		}
1447 		nfs3_cache_wcc_data(vp, &res.resok.obj_wcc, t, cr);
1448 		/*
1449 		 * Some servers will change the mode to clear the setuid
1450 		 * and setgid bits when changing the uid or gid.  The
1451 		 * client needs to compensate appropriately.
1452 		 */
1453 		if (mask & (AT_UID | AT_GID)) {
1454 			int terror;
1455 
1456 			va.va_mask = AT_MODE;
1457 			terror = nfs3getattr(vp, &va, cr);
1458 			if (!terror &&
1459 			    (((mask & AT_MODE) && va.va_mode != vap->va_mode) ||
1460 			    (!(mask & AT_MODE) && va.va_mode != omode))) {
1461 				va.va_mask = AT_MODE;
1462 				if (mask & AT_MODE)
1463 					va.va_mode = vap->va_mode;
1464 				else
1465 					va.va_mode = omode;
1466 				(void) nfs3setattr(vp, &va, 0, cr);
1467 			}
1468 		}
1469 	} else {
1470 		nfs3_cache_wcc_data(vp, &res.resfail.obj_wcc, t, cr);
1471 		/*
1472 		 * If we got back a "not synchronized" error, then
1473 		 * we need to retry with a new guard value.  The
1474 		 * guard value used is the change time.  If the
1475 		 * server returned post_op_attr, then we can just
1476 		 * retry because we have the latest attributes.
1477 		 * Otherwise, we issue a GETATTR to get the latest
1478 		 * attributes and then retry.  If we couldn't get
1479 		 * the attributes this way either, then we give
1480 		 * up because we can't complete the operation as
1481 		 * required.
1482 		 */
1483 		if (res.status == NFS3ERR_NOT_SYNC) {
1484 			va.va_mask = AT_CTIME;
1485 			if (nfs3getattr(vp, &va, cr) == 0)
1486 				goto tryagain;
1487 		}
1488 		PURGE_STALE_FH(error, vp, cr);
1489 	}
1490 
1491 	return (error);
1492 }
1493 
1494 static int
1495 nfs3_accessx(void *vp, int mode, cred_t *cr)
1496 {
1497 	ASSERT(nfs_zone() == VTOMI((vnode_t *)vp)->mi_zone);
1498 	return (nfs3_access(vp, mode, 0, cr, NULL));
1499 }
1500 
1501 /* ARGSUSED */
1502 static int
1503 nfs3_access(vnode_t *vp, int mode, int flags, cred_t *cr, caller_context_t *ct)
1504 {
1505 	int error;
1506 	ACCESS3args args;
1507 	ACCESS3res res;
1508 	int douprintf;
1509 	uint32 acc;
1510 	rnode_t *rp;
1511 	cred_t *cred, *ncr, *ncrfree = NULL;
1512 	failinfo_t fi;
1513 	nfs_access_type_t cacc;
1514 	hrtime_t t;
1515 
1516 	acc = 0;
1517 	if (nfs_zone() != VTOMI(vp)->mi_zone)
1518 		return (EIO);
1519 	if (mode & VREAD)
1520 		acc |= ACCESS3_READ;
1521 	if (mode & VWRITE) {
1522 		if (vn_is_readonly(vp) && !IS_DEVVP(vp))
1523 			return (EROFS);
1524 		if (vp->v_type == VDIR)
1525 			acc |= ACCESS3_DELETE;
1526 		acc |= ACCESS3_MODIFY | ACCESS3_EXTEND;
1527 	}
1528 	if (mode & VEXEC) {
1529 		if (vp->v_type == VDIR)
1530 			acc |= ACCESS3_LOOKUP;
1531 		else
1532 			acc |= ACCESS3_EXECUTE;
1533 	}
1534 
1535 	rp = VTOR(vp);
1536 	args.object = *VTOFH3(vp);
1537 	if (vp->v_type == VDIR) {
1538 		args.access = ACCESS3_READ | ACCESS3_DELETE | ACCESS3_MODIFY |
1539 		    ACCESS3_EXTEND | ACCESS3_LOOKUP;
1540 	} else {
1541 		args.access = ACCESS3_READ | ACCESS3_MODIFY | ACCESS3_EXTEND |
1542 		    ACCESS3_EXECUTE;
1543 	}
1544 	fi.vp = vp;
1545 	fi.fhp = (caddr_t)&args.object;
1546 	fi.copyproc = nfs3copyfh;
1547 	fi.lookupproc = nfs3lookup;
1548 	fi.xattrdirproc = acl_getxattrdir3;
1549 
1550 	cred = cr;
1551 	/*
1552 	 * ncr and ncrfree both initially
1553 	 * point to the memory area returned
1554 	 * by crnetadjust();
1555 	 * ncrfree not NULL when exiting means
1556 	 * that we need to release it
1557 	 */
1558 	ncr = crnetadjust(cred);
1559 	ncrfree = ncr;
1560 tryagain:
1561 	if (rp->r_acache != NULL) {
1562 		cacc = nfs_access_check(rp, acc, cred);
1563 		if (cacc == NFS_ACCESS_ALLOWED) {
1564 			if (ncrfree != NULL)
1565 				crfree(ncrfree);
1566 			return (0);
1567 		}
1568 		if (cacc == NFS_ACCESS_DENIED) {
1569 			/*
1570 			 * If the cred can be adjusted, try again
1571 			 * with the new cred.
1572 			 */
1573 			if (ncr != NULL) {
1574 				cred = ncr;
1575 				ncr = NULL;
1576 				goto tryagain;
1577 			}
1578 			if (ncrfree != NULL)
1579 				crfree(ncrfree);
1580 			return (EACCES);
1581 		}
1582 	}
1583 
1584 	douprintf = 1;
1585 
1586 	t = gethrtime();
1587 
1588 	error = rfs3call(VTOMI(vp), NFSPROC3_ACCESS,
1589 	    xdr_ACCESS3args, (caddr_t)&args,
1590 	    xdr_ACCESS3res, (caddr_t)&res, cred,
1591 	    &douprintf, &res.status, 0, &fi);
1592 
1593 	if (error) {
1594 		if (ncrfree != NULL)
1595 			crfree(ncrfree);
1596 		return (error);
1597 	}
1598 
1599 	error = geterrno3(res.status);
1600 	if (!error) {
1601 		nfs3_cache_post_op_attr(vp, &res.resok.obj_attributes, t, cr);
1602 		nfs_access_cache(rp, args.access, res.resok.access, cred);
1603 		/*
1604 		 * we just cached results with cred; if cred is the
1605 		 * adjusted credentials from crnetadjust, we do not want
1606 		 * to release them before exiting: hence setting ncrfree
1607 		 * to NULL
1608 		 */
1609 		if (cred != cr)
1610 			ncrfree = NULL;
1611 		if ((acc & res.resok.access) != acc) {
1612 			/*
1613 			 * If the cred can be adjusted, try again
1614 			 * with the new cred.
1615 			 */
1616 			if (ncr != NULL) {
1617 				cred = ncr;
1618 				ncr = NULL;
1619 				goto tryagain;
1620 			}
1621 			error = EACCES;
1622 		}
1623 	} else {
1624 		nfs3_cache_post_op_attr(vp, &res.resfail.obj_attributes, t, cr);
1625 		PURGE_STALE_FH(error, vp, cr);
1626 	}
1627 
1628 	if (ncrfree != NULL)
1629 		crfree(ncrfree);
1630 
1631 	return (error);
1632 }
1633 
1634 static int nfs3_do_symlink_cache = 1;
1635 
1636 /* ARGSUSED */
1637 static int
1638 nfs3_readlink(vnode_t *vp, struct uio *uiop, cred_t *cr, caller_context_t *ct)
1639 {
1640 	int error;
1641 	READLINK3args args;
1642 	READLINK3res res;
1643 	nfspath3 resdata_backup;
1644 	rnode_t *rp;
1645 	int douprintf;
1646 	int len;
1647 	failinfo_t fi;
1648 	hrtime_t t;
1649 
1650 	/*
1651 	 * Can't readlink anything other than a symbolic link.
1652 	 */
1653 	if (vp->v_type != VLNK)
1654 		return (EINVAL);
1655 	if (nfs_zone() != VTOMI(vp)->mi_zone)
1656 		return (EIO);
1657 
1658 	rp = VTOR(vp);
1659 	if (nfs3_do_symlink_cache && rp->r_symlink.contents != NULL) {
1660 		error = nfs3_validate_caches(vp, cr);
1661 		if (error)
1662 			return (error);
1663 		mutex_enter(&rp->r_statelock);
1664 		if (rp->r_symlink.contents != NULL) {
1665 			error = uiomove(rp->r_symlink.contents,
1666 			    rp->r_symlink.len, UIO_READ, uiop);
1667 			mutex_exit(&rp->r_statelock);
1668 			return (error);
1669 		}
1670 		mutex_exit(&rp->r_statelock);
1671 	}
1672 
1673 	args.symlink = *VTOFH3(vp);
1674 	fi.vp = vp;
1675 	fi.fhp = (caddr_t)&args.symlink;
1676 	fi.copyproc = nfs3copyfh;
1677 	fi.lookupproc = nfs3lookup;
1678 	fi.xattrdirproc = acl_getxattrdir3;
1679 
1680 	res.resok.data = kmem_alloc(MAXPATHLEN, KM_SLEEP);
1681 
1682 	resdata_backup = res.resok.data;
1683 
1684 	douprintf = 1;
1685 
1686 	t = gethrtime();
1687 
1688 	error = rfs3call(VTOMI(vp), NFSPROC3_READLINK,
1689 	    xdr_READLINK3args, (caddr_t)&args,
1690 	    xdr_READLINK3res, (caddr_t)&res, cr,
1691 	    &douprintf, &res.status, 0, &fi);
1692 
1693 	if (res.resok.data == nfs3nametoolong)
1694 		error = EINVAL;
1695 
1696 	if (error) {
1697 		kmem_free(resdata_backup, MAXPATHLEN);
1698 		return (error);
1699 	}
1700 
1701 	error = geterrno3(res.status);
1702 	if (!error) {
1703 		nfs3_cache_post_op_attr(vp, &res.resok.symlink_attributes, t,
1704 		    cr);
1705 		len = strlen(res.resok.data);
1706 		error = uiomove(res.resok.data, len, UIO_READ, uiop);
1707 		if (nfs3_do_symlink_cache && rp->r_symlink.contents == NULL) {
1708 			mutex_enter(&rp->r_statelock);
1709 				if (rp->r_symlink.contents == NULL) {
1710 				rp->r_symlink.contents = res.resok.data;
1711 				rp->r_symlink.len = len;
1712 				rp->r_symlink.size = MAXPATHLEN;
1713 				mutex_exit(&rp->r_statelock);
1714 			} else {
1715 				mutex_exit(&rp->r_statelock);
1716 
1717 				kmem_free((void *)res.resok.data, MAXPATHLEN);
1718 			}
1719 		} else {
1720 			kmem_free((void *)res.resok.data, MAXPATHLEN);
1721 		}
1722 	} else {
1723 		nfs3_cache_post_op_attr(vp,
1724 		    &res.resfail.symlink_attributes, t, cr);
1725 		PURGE_STALE_FH(error, vp, cr);
1726 
1727 		kmem_free((void *)res.resok.data, MAXPATHLEN);
1728 
1729 	}
1730 
1731 	/*
1732 	 * The over the wire error for attempting to readlink something
1733 	 * other than a symbolic link is ENXIO.  However, we need to
1734 	 * return EINVAL instead of ENXIO, so we map it here.
1735 	 */
1736 	return (error == ENXIO ? EINVAL : error);
1737 }
1738 
1739 /*
1740  * Flush local dirty pages to stable storage on the server.
1741  *
1742  * If FNODSYNC is specified, then there is nothing to do because
1743  * metadata changes are not cached on the client before being
1744  * sent to the server.
1745  */
1746 /* ARGSUSED */
1747 static int
1748 nfs3_fsync(vnode_t *vp, int syncflag, cred_t *cr, caller_context_t *ct)
1749 {
1750 	int error;
1751 
1752 	if ((syncflag & FNODSYNC) || IS_SWAPVP(vp))
1753 		return (0);
1754 	if (nfs_zone() != VTOMI(vp)->mi_zone)
1755 		return (EIO);
1756 
1757 	error = nfs3_putpage_commit(vp, (offset_t)0, 0, cr);
1758 	if (!error)
1759 		error = VTOR(vp)->r_error;
1760 	return (error);
1761 }
1762 
1763 /*
1764  * Weirdness: if the file was removed or the target of a rename
1765  * operation while it was open, it got renamed instead.  Here we
1766  * remove the renamed file.
1767  */
1768 /* ARGSUSED */
1769 static void
1770 nfs3_inactive(vnode_t *vp, cred_t *cr, caller_context_t *ct)
1771 {
1772 	rnode_t *rp;
1773 
1774 	ASSERT(vp != DNLC_NO_VNODE);
1775 
1776 	/*
1777 	 * If this is coming from the wrong zone, we let someone in the right
1778 	 * zone take care of it asynchronously.  We can get here due to
1779 	 * VN_RELE() being called from pageout() or fsflush().  This call may
1780 	 * potentially turn into an expensive no-op if, for instance, v_count
1781 	 * gets incremented in the meantime, but it's still correct.
1782 	 */
1783 	if (nfs_zone() != VTOMI(vp)->mi_zone) {
1784 		nfs_async_inactive(vp, cr, nfs3_inactive);
1785 		return;
1786 	}
1787 
1788 	rp = VTOR(vp);
1789 redo:
1790 	if (rp->r_unldvp != NULL) {
1791 		/*
1792 		 * Save the vnode pointer for the directory where the
1793 		 * unlinked-open file got renamed, then set it to NULL
1794 		 * to prevent another thread from getting here before
1795 		 * we're done with the remove.  While we have the
1796 		 * statelock, make local copies of the pertinent rnode
1797 		 * fields.  If we weren't to do this in an atomic way, the
1798 		 * the unl* fields could become inconsistent with respect
1799 		 * to each other due to a race condition between this
1800 		 * code and nfs_remove().  See bug report 1034328.
1801 		 */
1802 		mutex_enter(&rp->r_statelock);
1803 		if (rp->r_unldvp != NULL) {
1804 			vnode_t *unldvp;
1805 			char *unlname;
1806 			cred_t *unlcred;
1807 			REMOVE3args args;
1808 			REMOVE3res res;
1809 			int douprintf;
1810 			int error;
1811 			hrtime_t t;
1812 
1813 			unldvp = rp->r_unldvp;
1814 			rp->r_unldvp = NULL;
1815 			unlname = rp->r_unlname;
1816 			rp->r_unlname = NULL;
1817 			unlcred = rp->r_unlcred;
1818 			rp->r_unlcred = NULL;
1819 			mutex_exit(&rp->r_statelock);
1820 
1821 			/*
1822 			 * If there are any dirty pages left, then flush
1823 			 * them.  This is unfortunate because they just
1824 			 * may get thrown away during the remove operation,
1825 			 * but we have to do this for correctness.
1826 			 */
1827 			if (vn_has_cached_data(vp) &&
1828 			    ((rp->r_flags & RDIRTY) || rp->r_count > 0)) {
1829 				ASSERT(vp->v_type != VCHR);
1830 				error = nfs3_putpage(vp, (offset_t)0, 0, 0,
1831 				    cr, ct);
1832 				if (error) {
1833 					mutex_enter(&rp->r_statelock);
1834 					if (!rp->r_error)
1835 						rp->r_error = error;
1836 					mutex_exit(&rp->r_statelock);
1837 				}
1838 			}
1839 
1840 			/*
1841 			 * Do the remove operation on the renamed file
1842 			 */
1843 			setdiropargs3(&args.object, unlname, unldvp);
1844 
1845 			douprintf = 1;
1846 
1847 			t = gethrtime();
1848 
1849 			error = rfs3call(VTOMI(unldvp), NFSPROC3_REMOVE,
1850 			    xdr_diropargs3, (caddr_t)&args,
1851 			    xdr_REMOVE3res, (caddr_t)&res, unlcred,
1852 			    &douprintf, &res.status, 0, NULL);
1853 
1854 			if (error) {
1855 				PURGE_ATTRCACHE(unldvp);
1856 			} else {
1857 				error = geterrno3(res.status);
1858 				if (!error) {
1859 					nfs3_cache_wcc_data(unldvp,
1860 					    &res.resok.dir_wcc, t, cr);
1861 					if (HAVE_RDDIR_CACHE(VTOR(unldvp)))
1862 						nfs_purge_rddir_cache(unldvp);
1863 				} else {
1864 					nfs3_cache_wcc_data(unldvp,
1865 					    &res.resfail.dir_wcc, t, cr);
1866 					PURGE_STALE_FH(error, unldvp, cr);
1867 				}
1868 			}
1869 
1870 			/*
1871 			 * Release stuff held for the remove
1872 			 */
1873 			VN_RELE(unldvp);
1874 			kmem_free(unlname, MAXNAMELEN);
1875 			crfree(unlcred);
1876 			goto redo;
1877 		}
1878 		mutex_exit(&rp->r_statelock);
1879 	}
1880 
1881 	rp_addfree(rp, cr);
1882 }
1883 
1884 /*
1885  * Remote file system operations having to do with directory manipulation.
1886  */
1887 
1888 /* ARGSUSED */
1889 static int
1890 nfs3_lookup(vnode_t *dvp, char *nm, vnode_t **vpp, struct pathname *pnp,
1891 	int flags, vnode_t *rdir, cred_t *cr, caller_context_t *ct,
1892 	int *direntflags, pathname_t *realpnp)
1893 {
1894 	int error;
1895 	vnode_t *vp;
1896 	vnode_t *avp = NULL;
1897 	rnode_t *drp;
1898 
1899 	if (nfs_zone() != VTOMI(dvp)->mi_zone)
1900 		return (EPERM);
1901 
1902 	drp = VTOR(dvp);
1903 
1904 	/*
1905 	 * Are we looking up extended attributes?  If so, "dvp" is
1906 	 * the file or directory for which we want attributes, and
1907 	 * we need a lookup of the hidden attribute directory
1908 	 * before we lookup the rest of the path.
1909 	 */
1910 	if (flags & LOOKUP_XATTR) {
1911 		bool_t cflag = ((flags & CREATE_XATTR_DIR) != 0);
1912 		mntinfo_t *mi;
1913 
1914 		mi = VTOMI(dvp);
1915 		if (!(mi->mi_flags & MI_EXTATTR))
1916 			return (EINVAL);
1917 
1918 		if (nfs_rw_enter_sig(&drp->r_rwlock, RW_READER, INTR(dvp)))
1919 			return (EINTR);
1920 
1921 		(void) nfs3lookup_dnlc(dvp, XATTR_DIR_NAME, &avp, cr);
1922 		if (avp == NULL)
1923 			error = acl_getxattrdir3(dvp, &avp, cflag, cr, 0);
1924 		else
1925 			error = 0;
1926 
1927 		nfs_rw_exit(&drp->r_rwlock);
1928 
1929 		if (error) {
1930 			if (mi->mi_flags & MI_EXTATTR)
1931 				return (error);
1932 			return (EINVAL);
1933 		}
1934 		dvp = avp;
1935 		drp = VTOR(dvp);
1936 	}
1937 
1938 	if (nfs_rw_enter_sig(&drp->r_rwlock, RW_READER, INTR(dvp))) {
1939 		error = EINTR;
1940 		goto out;
1941 	}
1942 
1943 	error = nfs3lookup(dvp, nm, vpp, pnp, flags, rdir, cr, 0);
1944 
1945 	nfs_rw_exit(&drp->r_rwlock);
1946 
1947 	/*
1948 	 * If vnode is a device, create special vnode.
1949 	 */
1950 	if (!error && IS_DEVVP(*vpp)) {
1951 		vp = *vpp;
1952 		*vpp = specvp(vp, vp->v_rdev, vp->v_type, cr);
1953 		VN_RELE(vp);
1954 	}
1955 
1956 out:
1957 	if (avp != NULL)
1958 		VN_RELE(avp);
1959 
1960 	return (error);
1961 }
1962 
1963 static int nfs3_lookup_neg_cache = 1;
1964 
1965 #ifdef DEBUG
1966 static int nfs3_lookup_dnlc_hits = 0;
1967 static int nfs3_lookup_dnlc_misses = 0;
1968 static int nfs3_lookup_dnlc_neg_hits = 0;
1969 static int nfs3_lookup_dnlc_disappears = 0;
1970 static int nfs3_lookup_dnlc_lookups = 0;
1971 #endif
1972 
1973 /* ARGSUSED */
1974 int
1975 nfs3lookup(vnode_t *dvp, char *nm, vnode_t **vpp, struct pathname *pnp,
1976 	int flags, vnode_t *rdir, cred_t *cr, int rfscall_flags)
1977 {
1978 	int error;
1979 	rnode_t *drp;
1980 
1981 	ASSERT(nfs_zone() == VTOMI(dvp)->mi_zone);
1982 	/*
1983 	 * If lookup is for "", just return dvp.  Don't need
1984 	 * to send it over the wire, look it up in the dnlc,
1985 	 * or perform any access checks.
1986 	 */
1987 	if (*nm == '\0') {
1988 		VN_HOLD(dvp);
1989 		*vpp = dvp;
1990 		return (0);
1991 	}
1992 
1993 	/*
1994 	 * Can't do lookups in non-directories.
1995 	 */
1996 	if (dvp->v_type != VDIR)
1997 		return (ENOTDIR);
1998 
1999 	/*
2000 	 * If we're called with RFSCALL_SOFT, it's important that
2001 	 * the only rfscall is one we make directly; if we permit
2002 	 * an access call because we're looking up "." or validating
2003 	 * a dnlc hit, we'll deadlock because that rfscall will not
2004 	 * have the RFSCALL_SOFT set.
2005 	 */
2006 	if (rfscall_flags & RFSCALL_SOFT)
2007 		goto callit;
2008 
2009 	/*
2010 	 * If lookup is for ".", just return dvp.  Don't need
2011 	 * to send it over the wire or look it up in the dnlc,
2012 	 * just need to check access.
2013 	 */
2014 	if (strcmp(nm, ".") == 0) {
2015 		error = nfs3_access(dvp, VEXEC, 0, cr, NULL);
2016 		if (error)
2017 			return (error);
2018 		VN_HOLD(dvp);
2019 		*vpp = dvp;
2020 		return (0);
2021 	}
2022 
2023 	drp = VTOR(dvp);
2024 	if (!(drp->r_flags & RLOOKUP)) {
2025 		mutex_enter(&drp->r_statelock);
2026 		drp->r_flags |= RLOOKUP;
2027 		mutex_exit(&drp->r_statelock);
2028 	}
2029 
2030 	/*
2031 	 * Lookup this name in the DNLC.  If there was a valid entry,
2032 	 * then return the results of the lookup.
2033 	 */
2034 	error = nfs3lookup_dnlc(dvp, nm, vpp, cr);
2035 	if (error || *vpp != NULL)
2036 		return (error);
2037 
2038 callit:
2039 	error = nfs3lookup_otw(dvp, nm, vpp, cr, rfscall_flags);
2040 
2041 	return (error);
2042 }
2043 
2044 static int
2045 nfs3lookup_dnlc(vnode_t *dvp, char *nm, vnode_t **vpp, cred_t *cr)
2046 {
2047 	int error;
2048 	vnode_t *vp;
2049 
2050 	ASSERT(*nm != '\0');
2051 	ASSERT(nfs_zone() == VTOMI(dvp)->mi_zone);
2052 	/*
2053 	 * Lookup this name in the DNLC.  If successful, then validate
2054 	 * the caches and then recheck the DNLC.  The DNLC is rechecked
2055 	 * just in case this entry got invalidated during the call
2056 	 * to nfs3_validate_caches.
2057 	 *
2058 	 * An assumption is being made that it is safe to say that a
2059 	 * file exists which may not on the server.  Any operations to
2060 	 * the server will fail with ESTALE.
2061 	 */
2062 #ifdef DEBUG
2063 	nfs3_lookup_dnlc_lookups++;
2064 #endif
2065 	vp = dnlc_lookup(dvp, nm);
2066 	if (vp != NULL) {
2067 		VN_RELE(vp);
2068 		if (vp == DNLC_NO_VNODE && !vn_is_readonly(dvp)) {
2069 			PURGE_ATTRCACHE(dvp);
2070 		}
2071 		error = nfs3_validate_caches(dvp, cr);
2072 		if (error)
2073 			return (error);
2074 		vp = dnlc_lookup(dvp, nm);
2075 		if (vp != NULL) {
2076 			error = nfs3_access(dvp, VEXEC, 0, cr, NULL);
2077 			if (error) {
2078 				VN_RELE(vp);
2079 				return (error);
2080 			}
2081 			if (vp == DNLC_NO_VNODE) {
2082 				VN_RELE(vp);
2083 #ifdef DEBUG
2084 				nfs3_lookup_dnlc_neg_hits++;
2085 #endif
2086 				return (ENOENT);
2087 			}
2088 			*vpp = vp;
2089 #ifdef DEBUG
2090 			nfs3_lookup_dnlc_hits++;
2091 #endif
2092 			return (0);
2093 		}
2094 #ifdef DEBUG
2095 		nfs3_lookup_dnlc_disappears++;
2096 #endif
2097 	}
2098 #ifdef DEBUG
2099 	else
2100 		nfs3_lookup_dnlc_misses++;
2101 #endif
2102 
2103 	*vpp = NULL;
2104 
2105 	return (0);
2106 }
2107 
2108 static int
2109 nfs3lookup_otw(vnode_t *dvp, char *nm, vnode_t **vpp, cred_t *cr,
2110 	int rfscall_flags)
2111 {
2112 	int error;
2113 	LOOKUP3args args;
2114 	LOOKUP3vres res;
2115 	int douprintf;
2116 	struct vattr vattr;
2117 	struct vattr dvattr;
2118 	vnode_t *vp;
2119 	failinfo_t fi;
2120 	hrtime_t t;
2121 
2122 	ASSERT(*nm != '\0');
2123 	ASSERT(dvp->v_type == VDIR);
2124 	ASSERT(nfs_zone() == VTOMI(dvp)->mi_zone);
2125 
2126 	setdiropargs3(&args.what, nm, dvp);
2127 
2128 	fi.vp = dvp;
2129 	fi.fhp = (caddr_t)&args.what.dir;
2130 	fi.copyproc = nfs3copyfh;
2131 	fi.lookupproc = nfs3lookup;
2132 	fi.xattrdirproc = acl_getxattrdir3;
2133 	res.obj_attributes.fres.vp = dvp;
2134 	res.obj_attributes.fres.vap = &vattr;
2135 	res.dir_attributes.fres.vp = dvp;
2136 	res.dir_attributes.fres.vap = &dvattr;
2137 
2138 	douprintf = 1;
2139 
2140 	t = gethrtime();
2141 
2142 	error = rfs3call(VTOMI(dvp), NFSPROC3_LOOKUP,
2143 	    xdr_diropargs3, (caddr_t)&args,
2144 	    xdr_LOOKUP3vres, (caddr_t)&res, cr,
2145 	    &douprintf, &res.status, rfscall_flags, &fi);
2146 
2147 	if (error)
2148 		return (error);
2149 
2150 	nfs3_cache_post_op_vattr(dvp, &res.dir_attributes, t, cr);
2151 
2152 	error = geterrno3(res.status);
2153 	if (error) {
2154 		PURGE_STALE_FH(error, dvp, cr);
2155 		if (error == ENOENT && nfs3_lookup_neg_cache)
2156 			dnlc_enter(dvp, nm, DNLC_NO_VNODE);
2157 		return (error);
2158 	}
2159 
2160 	if (res.obj_attributes.attributes) {
2161 		vp = makenfs3node_va(&res.object, res.obj_attributes.fres.vap,
2162 		    dvp->v_vfsp, t, cr, VTOR(dvp)->r_path, nm);
2163 	} else {
2164 		vp = makenfs3node_va(&res.object, NULL,
2165 		    dvp->v_vfsp, t, cr, VTOR(dvp)->r_path, nm);
2166 		if (vp->v_type == VNON) {
2167 			vattr.va_mask = AT_TYPE;
2168 			error = nfs3getattr(vp, &vattr, cr);
2169 			if (error) {
2170 				VN_RELE(vp);
2171 				return (error);
2172 			}
2173 			vp->v_type = vattr.va_type;
2174 		}
2175 	}
2176 
2177 	if (!(rfscall_flags & RFSCALL_SOFT))
2178 		dnlc_update(dvp, nm, vp);
2179 
2180 	*vpp = vp;
2181 
2182 	return (error);
2183 }
2184 
2185 #ifdef DEBUG
2186 static int nfs3_create_misses = 0;
2187 #endif
2188 
2189 /* ARGSUSED */
2190 static int
2191 nfs3_create(vnode_t *dvp, char *nm, struct vattr *va, enum vcexcl exclusive,
2192 	int mode, vnode_t **vpp, cred_t *cr, int lfaware, caller_context_t *ct,
2193 	vsecattr_t *vsecp)
2194 {
2195 	int error;
2196 	vnode_t *vp;
2197 	rnode_t *rp;
2198 	struct vattr vattr;
2199 	rnode_t *drp;
2200 	vnode_t *tempvp;
2201 
2202 	drp = VTOR(dvp);
2203 	if (nfs_zone() != VTOMI(dvp)->mi_zone)
2204 		return (EPERM);
2205 	if (nfs_rw_enter_sig(&drp->r_rwlock, RW_WRITER, INTR(dvp)))
2206 		return (EINTR);
2207 
2208 top:
2209 	/*
2210 	 * We make a copy of the attributes because the caller does not
2211 	 * expect us to change what va points to.
2212 	 */
2213 	vattr = *va;
2214 
2215 	/*
2216 	 * If the pathname is "", just use dvp.  Don't need
2217 	 * to send it over the wire, look it up in the dnlc,
2218 	 * or perform any access checks.
2219 	 */
2220 	if (*nm == '\0') {
2221 		error = 0;
2222 		VN_HOLD(dvp);
2223 		vp = dvp;
2224 	/*
2225 	 * If the pathname is ".", just use dvp.  Don't need
2226 	 * to send it over the wire or look it up in the dnlc,
2227 	 * just need to check access.
2228 	 */
2229 	} else if (strcmp(nm, ".") == 0) {
2230 		error = nfs3_access(dvp, VEXEC, 0, cr, ct);
2231 		if (error) {
2232 			nfs_rw_exit(&drp->r_rwlock);
2233 			return (error);
2234 		}
2235 		VN_HOLD(dvp);
2236 		vp = dvp;
2237 	/*
2238 	 * We need to go over the wire, just to be sure whether the
2239 	 * file exists or not.  Using the DNLC can be dangerous in
2240 	 * this case when making a decision regarding existence.
2241 	 */
2242 	} else {
2243 		error = nfs3lookup_otw(dvp, nm, &vp, cr, 0);
2244 	}
2245 	if (!error) {
2246 		if (exclusive == EXCL)
2247 			error = EEXIST;
2248 		else if (vp->v_type == VDIR && (mode & VWRITE))
2249 			error = EISDIR;
2250 		else {
2251 			/*
2252 			 * If vnode is a device, create special vnode.
2253 			 */
2254 			if (IS_DEVVP(vp)) {
2255 				tempvp = vp;
2256 				vp = specvp(vp, vp->v_rdev, vp->v_type, cr);
2257 				VN_RELE(tempvp);
2258 			}
2259 			if (!(error = VOP_ACCESS(vp, mode, 0, cr, ct))) {
2260 				if ((vattr.va_mask & AT_SIZE) &&
2261 				    vp->v_type == VREG) {
2262 					rp = VTOR(vp);
2263 					/*
2264 					 * Check here for large file handled
2265 					 * by LF-unaware process (as
2266 					 * ufs_create() does)
2267 					 */
2268 					if (!(lfaware & FOFFMAX)) {
2269 						mutex_enter(&rp->r_statelock);
2270 						if (rp->r_size > MAXOFF32_T)
2271 							error = EOVERFLOW;
2272 						mutex_exit(&rp->r_statelock);
2273 					}
2274 					if (!error) {
2275 						vattr.va_mask = AT_SIZE;
2276 						error = nfs3setattr(vp,
2277 						    &vattr, 0, cr);
2278 					}
2279 				}
2280 			}
2281 		}
2282 		nfs_rw_exit(&drp->r_rwlock);
2283 		if (error) {
2284 			VN_RELE(vp);
2285 		} else {
2286 			/*
2287 			 * existing file got truncated, notify.
2288 			 */
2289 			vnevent_create(vp, ct);
2290 			*vpp = vp;
2291 		}
2292 		return (error);
2293 	}
2294 
2295 	dnlc_remove(dvp, nm);
2296 
2297 	/*
2298 	 * Decide what the group-id of the created file should be.
2299 	 * Set it in attribute list as advisory...
2300 	 */
2301 	error = setdirgid(dvp, &vattr.va_gid, cr);
2302 	if (error) {
2303 		nfs_rw_exit(&drp->r_rwlock);
2304 		return (error);
2305 	}
2306 	vattr.va_mask |= AT_GID;
2307 
2308 	ASSERT(vattr.va_mask & AT_TYPE);
2309 	if (vattr.va_type == VREG) {
2310 		ASSERT(vattr.va_mask & AT_MODE);
2311 		if (MANDMODE(vattr.va_mode)) {
2312 			nfs_rw_exit(&drp->r_rwlock);
2313 			return (EACCES);
2314 		}
2315 		error = nfs3create(dvp, nm, &vattr, exclusive, mode, vpp, cr,
2316 		    lfaware);
2317 		/*
2318 		 * If this is not an exclusive create, then the CREATE
2319 		 * request will be made with the GUARDED mode set.  This
2320 		 * means that the server will return EEXIST if the file
2321 		 * exists.  The file could exist because of a retransmitted
2322 		 * request.  In this case, we recover by starting over and
2323 		 * checking to see whether the file exists.  This second
2324 		 * time through it should and a CREATE request will not be
2325 		 * sent.
2326 		 *
2327 		 * This handles the problem of a dangling CREATE request
2328 		 * which contains attributes which indicate that the file
2329 		 * should be truncated.  This retransmitted request could
2330 		 * possibly truncate valid data in the file if not caught
2331 		 * by the duplicate request mechanism on the server or if
2332 		 * not caught by other means.  The scenario is:
2333 		 *
2334 		 * Client transmits CREATE request with size = 0
2335 		 * Client times out, retransmits request.
2336 		 * Response to the first request arrives from the server
2337 		 *  and the client proceeds on.
2338 		 * Client writes data to the file.
2339 		 * The server now processes retransmitted CREATE request
2340 		 *  and truncates file.
2341 		 *
2342 		 * The use of the GUARDED CREATE request prevents this from
2343 		 * happening because the retransmitted CREATE would fail
2344 		 * with EEXIST and would not truncate the file.
2345 		 */
2346 		if (error == EEXIST && exclusive == NONEXCL) {
2347 #ifdef DEBUG
2348 			nfs3_create_misses++;
2349 #endif
2350 			goto top;
2351 		}
2352 		nfs_rw_exit(&drp->r_rwlock);
2353 		return (error);
2354 	}
2355 	error = nfs3mknod(dvp, nm, &vattr, exclusive, mode, vpp, cr);
2356 	nfs_rw_exit(&drp->r_rwlock);
2357 	return (error);
2358 }
2359 
2360 /* ARGSUSED */
2361 static int
2362 nfs3create(vnode_t *dvp, char *nm, struct vattr *va, enum vcexcl exclusive,
2363 	int mode, vnode_t **vpp, cred_t *cr, int lfaware)
2364 {
2365 	int error;
2366 	CREATE3args args;
2367 	CREATE3res res;
2368 	int douprintf;
2369 	vnode_t *vp;
2370 	struct vattr vattr;
2371 	nfstime3 *verfp;
2372 	rnode_t *rp;
2373 	timestruc_t now;
2374 	hrtime_t t;
2375 
2376 	ASSERT(nfs_zone() == VTOMI(dvp)->mi_zone);
2377 	setdiropargs3(&args.where, nm, dvp);
2378 	if (exclusive == EXCL) {
2379 		args.how.mode = EXCLUSIVE;
2380 		/*
2381 		 * Construct the create verifier.  This verifier needs
2382 		 * to be unique between different clients.  It also needs
2383 		 * to vary for each exclusive create request generated
2384 		 * from the client to the server.
2385 		 *
2386 		 * The first attempt is made to use the hostid and a
2387 		 * unique number on the client.  If the hostid has not
2388 		 * been set, the high resolution time that the exclusive
2389 		 * create request is being made is used.  This will work
2390 		 * unless two different clients, both with the hostid
2391 		 * not set, attempt an exclusive create request on the
2392 		 * same file, at exactly the same clock time.  The
2393 		 * chances of this happening seem small enough to be
2394 		 * reasonable.
2395 		 */
2396 		verfp = (nfstime3 *)&args.how.createhow3_u.verf;
2397 		verfp->seconds = zone_get_hostid(NULL);
2398 		if (verfp->seconds != 0)
2399 			verfp->nseconds = newnum();
2400 		else {
2401 			gethrestime(&now);
2402 			verfp->seconds = now.tv_sec;
2403 			verfp->nseconds = now.tv_nsec;
2404 		}
2405 		/*
2406 		 * Since the server will use this value for the mtime,
2407 		 * make sure that it can't overflow. Zero out the MSB.
2408 		 * The actual value does not matter here, only its uniqeness.
2409 		 */
2410 		verfp->seconds %= INT32_MAX;
2411 	} else {
2412 		/*
2413 		 * Issue the non-exclusive create in guarded mode.  This
2414 		 * may result in some false EEXIST responses for
2415 		 * retransmitted requests, but these will be handled at
2416 		 * a higher level.  By using GUARDED, duplicate requests
2417 		 * to do file truncation and possible access problems
2418 		 * can be avoided.
2419 		 */
2420 		args.how.mode = GUARDED;
2421 		error = vattr_to_sattr3(va,
2422 		    &args.how.createhow3_u.obj_attributes);
2423 		if (error) {
2424 			/* req time field(s) overflow - return immediately */
2425 			return (error);
2426 		}
2427 	}
2428 
2429 	douprintf = 1;
2430 
2431 	t = gethrtime();
2432 
2433 	error = rfs3call(VTOMI(dvp), NFSPROC3_CREATE,
2434 	    xdr_CREATE3args, (caddr_t)&args,
2435 	    xdr_CREATE3res, (caddr_t)&res, cr,
2436 	    &douprintf, &res.status, 0, NULL);
2437 
2438 	if (error) {
2439 		PURGE_ATTRCACHE(dvp);
2440 		return (error);
2441 	}
2442 
2443 	error = geterrno3(res.status);
2444 	if (!error) {
2445 		nfs3_cache_wcc_data(dvp, &res.resok.dir_wcc, t, cr);
2446 		if (HAVE_RDDIR_CACHE(VTOR(dvp)))
2447 			nfs_purge_rddir_cache(dvp);
2448 
2449 		/*
2450 		 * On exclusive create the times need to be explicitly
2451 		 * set to clear any potential verifier that may be stored
2452 		 * in one of these fields (see comment below).  This
2453 		 * is done here to cover the case where no post op attrs
2454 		 * were returned or a 'invalid' time was returned in
2455 		 * the attributes.
2456 		 */
2457 		if (exclusive == EXCL)
2458 			va->va_mask |= (AT_MTIME | AT_ATIME);
2459 
2460 		if (!res.resok.obj.handle_follows) {
2461 			error = nfs3lookup(dvp, nm, &vp, NULL, 0, NULL, cr, 0);
2462 			if (error)
2463 				return (error);
2464 		} else {
2465 			if (res.resok.obj_attributes.attributes) {
2466 				vp = makenfs3node(&res.resok.obj.handle,
2467 				    &res.resok.obj_attributes.attr,
2468 				    dvp->v_vfsp, t, cr, NULL, NULL);
2469 			} else {
2470 				vp = makenfs3node(&res.resok.obj.handle, NULL,
2471 				    dvp->v_vfsp, t, cr, NULL, NULL);
2472 
2473 				/*
2474 				 * On an exclusive create, it is possible
2475 				 * that attributes were returned but those
2476 				 * postop attributes failed to decode
2477 				 * properly.  If this is the case,
2478 				 * then most likely the atime or mtime
2479 				 * were invalid for our client; this
2480 				 * is caused by the server storing the
2481 				 * create verifier in one of the time
2482 				 * fields(most likely mtime).
2483 				 * So... we are going to setattr just the
2484 				 * atime/mtime to clear things up.
2485 				 */
2486 				if (exclusive == EXCL) {
2487 					if (error =
2488 					    nfs3excl_create_settimes(vp,
2489 					    va, cr)) {
2490 						/*
2491 						 * Setting the times failed.
2492 						 * Remove the file and return
2493 						 * the error.
2494 						 */
2495 						VN_RELE(vp);
2496 						(void) nfs3_remove(dvp,
2497 						    nm, cr, NULL, 0);
2498 						return (error);
2499 					}
2500 				}
2501 
2502 				/*
2503 				 * This handles the non-exclusive case
2504 				 * and the exclusive case where no post op
2505 				 * attrs were returned.
2506 				 */
2507 				if (vp->v_type == VNON) {
2508 					vattr.va_mask = AT_TYPE;
2509 					error = nfs3getattr(vp, &vattr, cr);
2510 					if (error) {
2511 						VN_RELE(vp);
2512 						return (error);
2513 					}
2514 					vp->v_type = vattr.va_type;
2515 				}
2516 			}
2517 			dnlc_update(dvp, nm, vp);
2518 		}
2519 
2520 		rp = VTOR(vp);
2521 
2522 		/*
2523 		 * Check here for large file handled by
2524 		 * LF-unaware process (as ufs_create() does)
2525 		 */
2526 		if ((va->va_mask & AT_SIZE) && vp->v_type == VREG &&
2527 		    !(lfaware & FOFFMAX)) {
2528 			mutex_enter(&rp->r_statelock);
2529 			if (rp->r_size > MAXOFF32_T) {
2530 				mutex_exit(&rp->r_statelock);
2531 				VN_RELE(vp);
2532 				return (EOVERFLOW);
2533 			}
2534 			mutex_exit(&rp->r_statelock);
2535 		}
2536 
2537 		if (exclusive == EXCL &&
2538 		    (va->va_mask & ~(AT_GID | AT_SIZE))) {
2539 			/*
2540 			 * If doing an exclusive create, then generate
2541 			 * a SETATTR to set the initial attributes.
2542 			 * Try to set the mtime and the atime to the
2543 			 * server's current time.  It is somewhat
2544 			 * expected that these fields will be used to
2545 			 * store the exclusive create cookie.  If not,
2546 			 * server implementors will need to know that
2547 			 * a SETATTR will follow an exclusive create
2548 			 * and the cookie should be destroyed if
2549 			 * appropriate. This work may have been done
2550 			 * earlier in this function if post op attrs
2551 			 * were not available.
2552 			 *
2553 			 * The AT_GID and AT_SIZE bits are turned off
2554 			 * so that the SETATTR request will not attempt
2555 			 * to process these.  The gid will be set
2556 			 * separately if appropriate.  The size is turned
2557 			 * off because it is assumed that a new file will
2558 			 * be created empty and if the file wasn't empty,
2559 			 * then the exclusive create will have failed
2560 			 * because the file must have existed already.
2561 			 * Therefore, no truncate operation is needed.
2562 			 */
2563 			va->va_mask &= ~(AT_GID | AT_SIZE);
2564 			error = nfs3setattr(vp, va, 0, cr);
2565 			if (error) {
2566 				/*
2567 				 * Couldn't correct the attributes of
2568 				 * the newly created file and the
2569 				 * attributes are wrong.  Remove the
2570 				 * file and return an error to the
2571 				 * application.
2572 				 */
2573 				VN_RELE(vp);
2574 				(void) nfs3_remove(dvp, nm, cr, NULL, 0);
2575 				return (error);
2576 			}
2577 		}
2578 
2579 		if (va->va_gid != rp->r_attr.va_gid) {
2580 			/*
2581 			 * If the gid on the file isn't right, then
2582 			 * generate a SETATTR to attempt to change
2583 			 * it.  This may or may not work, depending
2584 			 * upon the server's semantics for allowing
2585 			 * file ownership changes.
2586 			 */
2587 			va->va_mask = AT_GID;
2588 			(void) nfs3setattr(vp, va, 0, cr);
2589 		}
2590 
2591 		/*
2592 		 * If vnode is a device create special vnode
2593 		 */
2594 		if (IS_DEVVP(vp)) {
2595 			*vpp = specvp(vp, vp->v_rdev, vp->v_type, cr);
2596 			VN_RELE(vp);
2597 		} else
2598 			*vpp = vp;
2599 	} else {
2600 		nfs3_cache_wcc_data(dvp, &res.resfail.dir_wcc, t, cr);
2601 		PURGE_STALE_FH(error, dvp, cr);
2602 	}
2603 
2604 	return (error);
2605 }
2606 
2607 /*
2608  * Special setattr function to take care of rest of atime/mtime
2609  * after successful exclusive create.  This function exists to avoid
2610  * handling attributes from the server; exclusive the atime/mtime fields
2611  * may be 'invalid' in client's view and therefore can not be trusted.
2612  */
2613 static int
2614 nfs3excl_create_settimes(vnode_t *vp, struct vattr *vap, cred_t *cr)
2615 {
2616 	int error;
2617 	uint_t mask;
2618 	SETATTR3args args;
2619 	SETATTR3res res;
2620 	int douprintf;
2621 	rnode_t *rp;
2622 	hrtime_t t;
2623 
2624 	ASSERT(nfs_zone() == VTOMI(vp)->mi_zone);
2625 	/* save the caller's mask so that it can be reset later */
2626 	mask = vap->va_mask;
2627 
2628 	rp = VTOR(vp);
2629 
2630 	args.object = *RTOFH3(rp);
2631 	args.guard.check = FALSE;
2632 
2633 	/* Use the mask to initialize the arguments */
2634 	vap->va_mask = 0;
2635 	error = vattr_to_sattr3(vap, &args.new_attributes);
2636 
2637 	/* We want to set just atime/mtime on this request */
2638 	args.new_attributes.atime.set_it = SET_TO_SERVER_TIME;
2639 	args.new_attributes.mtime.set_it = SET_TO_SERVER_TIME;
2640 
2641 	douprintf = 1;
2642 
2643 	t = gethrtime();
2644 
2645 	error = rfs3call(VTOMI(vp), NFSPROC3_SETATTR,
2646 	    xdr_SETATTR3args, (caddr_t)&args,
2647 	    xdr_SETATTR3res, (caddr_t)&res, cr,
2648 	    &douprintf, &res.status, 0, NULL);
2649 
2650 	if (error) {
2651 		vap->va_mask = mask;
2652 		return (error);
2653 	}
2654 
2655 	error = geterrno3(res.status);
2656 	if (!error) {
2657 		/*
2658 		 * It is important to pick up the attributes.
2659 		 * Since this is the exclusive create path, the
2660 		 * attributes on the initial create were ignored
2661 		 * and we need these to have the correct info.
2662 		 */
2663 		nfs3_cache_wcc_data(vp, &res.resok.obj_wcc, t, cr);
2664 		/*
2665 		 * No need to do the atime/mtime work again so clear
2666 		 * the bits.
2667 		 */
2668 		mask &= ~(AT_ATIME | AT_MTIME);
2669 	} else {
2670 		nfs3_cache_wcc_data(vp, &res.resfail.obj_wcc, t, cr);
2671 	}
2672 
2673 	vap->va_mask = mask;
2674 
2675 	return (error);
2676 }
2677 
2678 /* ARGSUSED */
2679 static int
2680 nfs3mknod(vnode_t *dvp, char *nm, struct vattr *va, enum vcexcl exclusive,
2681 	int mode, vnode_t **vpp, cred_t *cr)
2682 {
2683 	int error;
2684 	MKNOD3args args;
2685 	MKNOD3res res;
2686 	int douprintf;
2687 	vnode_t *vp;
2688 	struct vattr vattr;
2689 	hrtime_t t;
2690 
2691 	ASSERT(nfs_zone() == VTOMI(dvp)->mi_zone);
2692 	switch (va->va_type) {
2693 	case VCHR:
2694 	case VBLK:
2695 		setdiropargs3(&args.where, nm, dvp);
2696 		args.what.type = (va->va_type == VCHR) ? NF3CHR : NF3BLK;
2697 		error = vattr_to_sattr3(va,
2698 		    &args.what.mknoddata3_u.device.dev_attributes);
2699 		if (error) {
2700 			/* req time field(s) overflow - return immediately */
2701 			return (error);
2702 		}
2703 		args.what.mknoddata3_u.device.spec.specdata1 =
2704 		    getmajor(va->va_rdev);
2705 		args.what.mknoddata3_u.device.spec.specdata2 =
2706 		    getminor(va->va_rdev);
2707 		break;
2708 
2709 	case VFIFO:
2710 	case VSOCK:
2711 		setdiropargs3(&args.where, nm, dvp);
2712 		args.what.type = (va->va_type == VFIFO) ? NF3FIFO : NF3SOCK;
2713 		error = vattr_to_sattr3(va,
2714 		    &args.what.mknoddata3_u.pipe_attributes);
2715 		if (error) {
2716 			/* req time field(s) overflow - return immediately */
2717 			return (error);
2718 		}
2719 		break;
2720 
2721 	default:
2722 		return (EINVAL);
2723 	}
2724 
2725 	douprintf = 1;
2726 
2727 	t = gethrtime();
2728 
2729 	error = rfs3call(VTOMI(dvp), NFSPROC3_MKNOD,
2730 	    xdr_MKNOD3args, (caddr_t)&args,
2731 	    xdr_MKNOD3res, (caddr_t)&res, cr,
2732 	    &douprintf, &res.status, 0, NULL);
2733 
2734 	if (error) {
2735 		PURGE_ATTRCACHE(dvp);
2736 		return (error);
2737 	}
2738 
2739 	error = geterrno3(res.status);
2740 	if (!error) {
2741 		nfs3_cache_wcc_data(dvp, &res.resok.dir_wcc, t, cr);
2742 		if (HAVE_RDDIR_CACHE(VTOR(dvp)))
2743 			nfs_purge_rddir_cache(dvp);
2744 
2745 		if (!res.resok.obj.handle_follows) {
2746 			error = nfs3lookup(dvp, nm, &vp, NULL, 0, NULL, cr, 0);
2747 			if (error)
2748 				return (error);
2749 		} else {
2750 			if (res.resok.obj_attributes.attributes) {
2751 				vp = makenfs3node(&res.resok.obj.handle,
2752 				    &res.resok.obj_attributes.attr,
2753 				    dvp->v_vfsp, t, cr, NULL, NULL);
2754 			} else {
2755 				vp = makenfs3node(&res.resok.obj.handle, NULL,
2756 				    dvp->v_vfsp, t, cr, NULL, NULL);
2757 				if (vp->v_type == VNON) {
2758 					vattr.va_mask = AT_TYPE;
2759 					error = nfs3getattr(vp, &vattr, cr);
2760 					if (error) {
2761 						VN_RELE(vp);
2762 						return (error);
2763 					}
2764 					vp->v_type = vattr.va_type;
2765 				}
2766 
2767 			}
2768 			dnlc_update(dvp, nm, vp);
2769 		}
2770 
2771 		if (va->va_gid != VTOR(vp)->r_attr.va_gid) {
2772 			va->va_mask = AT_GID;
2773 			(void) nfs3setattr(vp, va, 0, cr);
2774 		}
2775 
2776 		/*
2777 		 * If vnode is a device create special vnode
2778 		 */
2779 		if (IS_DEVVP(vp)) {
2780 			*vpp = specvp(vp, vp->v_rdev, vp->v_type, cr);
2781 			VN_RELE(vp);
2782 		} else
2783 			*vpp = vp;
2784 	} else {
2785 		nfs3_cache_wcc_data(dvp, &res.resfail.dir_wcc, t, cr);
2786 		PURGE_STALE_FH(error, dvp, cr);
2787 	}
2788 	return (error);
2789 }
2790 
2791 /*
2792  * Weirdness: if the vnode to be removed is open
2793  * we rename it instead of removing it and nfs_inactive
2794  * will remove the new name.
2795  */
2796 /* ARGSUSED */
2797 static int
2798 nfs3_remove(vnode_t *dvp, char *nm, cred_t *cr, caller_context_t *ct, int flags)
2799 {
2800 	int error;
2801 	REMOVE3args args;
2802 	REMOVE3res res;
2803 	vnode_t *vp;
2804 	char *tmpname;
2805 	int douprintf;
2806 	rnode_t *rp;
2807 	rnode_t *drp;
2808 	hrtime_t t;
2809 
2810 	if (nfs_zone() != VTOMI(dvp)->mi_zone)
2811 		return (EPERM);
2812 	drp = VTOR(dvp);
2813 	if (nfs_rw_enter_sig(&drp->r_rwlock, RW_WRITER, INTR(dvp)))
2814 		return (EINTR);
2815 
2816 	error = nfs3lookup(dvp, nm, &vp, NULL, 0, NULL, cr, 0);
2817 	if (error) {
2818 		nfs_rw_exit(&drp->r_rwlock);
2819 		return (error);
2820 	}
2821 
2822 	if (vp->v_type == VDIR && secpolicy_fs_linkdir(cr, dvp->v_vfsp)) {
2823 		VN_RELE(vp);
2824 		nfs_rw_exit(&drp->r_rwlock);
2825 		return (EPERM);
2826 	}
2827 
2828 	/*
2829 	 * First just remove the entry from the name cache, as it
2830 	 * is most likely the only entry for this vp.
2831 	 */
2832 	dnlc_remove(dvp, nm);
2833 
2834 	/*
2835 	 * If the file has a v_count > 1 then there may be more than one
2836 	 * entry in the name cache due multiple links or an open file,
2837 	 * but we don't have the real reference count so flush all
2838 	 * possible entries.
2839 	 */
2840 	if (vp->v_count > 1)
2841 		dnlc_purge_vp(vp);
2842 
2843 	/*
2844 	 * Now we have the real reference count on the vnode
2845 	 */
2846 	rp = VTOR(vp);
2847 	mutex_enter(&rp->r_statelock);
2848 	if (vp->v_count > 1 &&
2849 	    (rp->r_unldvp == NULL || strcmp(nm, rp->r_unlname) == 0)) {
2850 		mutex_exit(&rp->r_statelock);
2851 		tmpname = newname();
2852 		error = nfs3rename(dvp, nm, dvp, tmpname, cr, ct);
2853 		if (error)
2854 			kmem_free(tmpname, MAXNAMELEN);
2855 		else {
2856 			mutex_enter(&rp->r_statelock);
2857 			if (rp->r_unldvp == NULL) {
2858 				VN_HOLD(dvp);
2859 				rp->r_unldvp = dvp;
2860 				if (rp->r_unlcred != NULL)
2861 					crfree(rp->r_unlcred);
2862 				crhold(cr);
2863 				rp->r_unlcred = cr;
2864 				rp->r_unlname = tmpname;
2865 			} else {
2866 				kmem_free(rp->r_unlname, MAXNAMELEN);
2867 				rp->r_unlname = tmpname;
2868 			}
2869 			mutex_exit(&rp->r_statelock);
2870 		}
2871 	} else {
2872 		mutex_exit(&rp->r_statelock);
2873 		/*
2874 		 * We need to flush any dirty pages which happen to
2875 		 * be hanging around before removing the file.  This
2876 		 * shouldn't happen very often and mostly on file
2877 		 * systems mounted "nocto".
2878 		 */
2879 		if (vn_has_cached_data(vp) &&
2880 		    ((rp->r_flags & RDIRTY) || rp->r_count > 0)) {
2881 			error = nfs3_putpage(vp, (offset_t)0, 0, 0, cr, ct);
2882 			if (error && (error == ENOSPC || error == EDQUOT)) {
2883 				mutex_enter(&rp->r_statelock);
2884 				if (!rp->r_error)
2885 					rp->r_error = error;
2886 				mutex_exit(&rp->r_statelock);
2887 			}
2888 		}
2889 
2890 		setdiropargs3(&args.object, nm, dvp);
2891 
2892 		douprintf = 1;
2893 
2894 		t = gethrtime();
2895 
2896 		error = rfs3call(VTOMI(dvp), NFSPROC3_REMOVE,
2897 		    xdr_diropargs3, (caddr_t)&args,
2898 		    xdr_REMOVE3res, (caddr_t)&res, cr,
2899 		    &douprintf, &res.status, 0, NULL);
2900 
2901 		/*
2902 		 * The xattr dir may be gone after last attr is removed,
2903 		 * so flush it from dnlc.
2904 		 */
2905 		if (dvp->v_flag & V_XATTRDIR)
2906 			dnlc_purge_vp(dvp);
2907 
2908 		PURGE_ATTRCACHE(vp);
2909 
2910 		if (error) {
2911 			PURGE_ATTRCACHE(dvp);
2912 		} else {
2913 			error = geterrno3(res.status);
2914 			if (!error) {
2915 				nfs3_cache_wcc_data(dvp, &res.resok.dir_wcc, t,
2916 				    cr);
2917 				if (HAVE_RDDIR_CACHE(drp))
2918 					nfs_purge_rddir_cache(dvp);
2919 			} else {
2920 				nfs3_cache_wcc_data(dvp, &res.resfail.dir_wcc,
2921 				    t, cr);
2922 				PURGE_STALE_FH(error, dvp, cr);
2923 			}
2924 		}
2925 	}
2926 
2927 	if (error == 0) {
2928 		vnevent_remove(vp, dvp, nm, ct);
2929 	}
2930 	VN_RELE(vp);
2931 
2932 	nfs_rw_exit(&drp->r_rwlock);
2933 
2934 	return (error);
2935 }
2936 
2937 /* ARGSUSED */
2938 static int
2939 nfs3_link(vnode_t *tdvp, vnode_t *svp, char *tnm, cred_t *cr,
2940 	caller_context_t *ct, int flags)
2941 {
2942 	int error;
2943 	LINK3args args;
2944 	LINK3res res;
2945 	vnode_t *realvp;
2946 	int douprintf;
2947 	mntinfo_t *mi;
2948 	rnode_t *tdrp;
2949 	hrtime_t t;
2950 
2951 	if (nfs_zone() != VTOMI(tdvp)->mi_zone)
2952 		return (EPERM);
2953 	if (VOP_REALVP(svp, &realvp, ct) == 0)
2954 		svp = realvp;
2955 
2956 	mi = VTOMI(svp);
2957 
2958 	if (!(mi->mi_flags & MI_LINK))
2959 		return (EOPNOTSUPP);
2960 
2961 	args.file = *VTOFH3(svp);
2962 	setdiropargs3(&args.link, tnm, tdvp);
2963 
2964 	tdrp = VTOR(tdvp);
2965 	if (nfs_rw_enter_sig(&tdrp->r_rwlock, RW_WRITER, INTR(tdvp)))
2966 		return (EINTR);
2967 
2968 	dnlc_remove(tdvp, tnm);
2969 
2970 	douprintf = 1;
2971 
2972 	t = gethrtime();
2973 
2974 	error = rfs3call(mi, NFSPROC3_LINK,
2975 	    xdr_LINK3args, (caddr_t)&args,
2976 	    xdr_LINK3res, (caddr_t)&res, cr,
2977 	    &douprintf, &res.status, 0, NULL);
2978 
2979 	if (error) {
2980 		PURGE_ATTRCACHE(tdvp);
2981 		PURGE_ATTRCACHE(svp);
2982 		nfs_rw_exit(&tdrp->r_rwlock);
2983 		return (error);
2984 	}
2985 
2986 	error = geterrno3(res.status);
2987 
2988 	if (!error) {
2989 		nfs3_cache_post_op_attr(svp, &res.resok.file_attributes, t, cr);
2990 		nfs3_cache_wcc_data(tdvp, &res.resok.linkdir_wcc, t, cr);
2991 		if (HAVE_RDDIR_CACHE(tdrp))
2992 			nfs_purge_rddir_cache(tdvp);
2993 		dnlc_update(tdvp, tnm, svp);
2994 	} else {
2995 		nfs3_cache_post_op_attr(svp, &res.resfail.file_attributes, t,
2996 		    cr);
2997 		nfs3_cache_wcc_data(tdvp, &res.resfail.linkdir_wcc, t, cr);
2998 		if (error == EOPNOTSUPP) {
2999 			mutex_enter(&mi->mi_lock);
3000 			mi->mi_flags &= ~MI_LINK;
3001 			mutex_exit(&mi->mi_lock);
3002 		}
3003 	}
3004 
3005 	nfs_rw_exit(&tdrp->r_rwlock);
3006 
3007 	if (!error) {
3008 		/*
3009 		 * Notify the source file of this link operation.
3010 		 */
3011 		vnevent_link(svp, ct);
3012 	}
3013 	return (error);
3014 }
3015 
3016 /* ARGSUSED */
3017 static int
3018 nfs3_rename(vnode_t *odvp, char *onm, vnode_t *ndvp, char *nnm, cred_t *cr,
3019 	caller_context_t *ct, int flags)
3020 {
3021 	vnode_t *realvp;
3022 
3023 	if (nfs_zone() != VTOMI(odvp)->mi_zone)
3024 		return (EPERM);
3025 	if (VOP_REALVP(ndvp, &realvp, ct) == 0)
3026 		ndvp = realvp;
3027 
3028 	return (nfs3rename(odvp, onm, ndvp, nnm, cr, ct));
3029 }
3030 
3031 /*
3032  * nfs3rename does the real work of renaming in NFS Version 3.
3033  */
3034 static int
3035 nfs3rename(vnode_t *odvp, char *onm, vnode_t *ndvp, char *nnm, cred_t *cr,
3036     caller_context_t *ct)
3037 {
3038 	int error;
3039 	RENAME3args args;
3040 	RENAME3res res;
3041 	int douprintf;
3042 	vnode_t *nvp = NULL;
3043 	vnode_t *ovp = NULL;
3044 	char *tmpname;
3045 	rnode_t *rp;
3046 	rnode_t *odrp;
3047 	rnode_t *ndrp;
3048 	hrtime_t t;
3049 
3050 	ASSERT(nfs_zone() == VTOMI(odvp)->mi_zone);
3051 
3052 	if (strcmp(onm, ".") == 0 || strcmp(onm, "..") == 0 ||
3053 	    strcmp(nnm, ".") == 0 || strcmp(nnm, "..") == 0)
3054 		return (EINVAL);
3055 
3056 	odrp = VTOR(odvp);
3057 	ndrp = VTOR(ndvp);
3058 	if ((intptr_t)odrp < (intptr_t)ndrp) {
3059 		if (nfs_rw_enter_sig(&odrp->r_rwlock, RW_WRITER, INTR(odvp)))
3060 			return (EINTR);
3061 		if (nfs_rw_enter_sig(&ndrp->r_rwlock, RW_WRITER, INTR(ndvp))) {
3062 			nfs_rw_exit(&odrp->r_rwlock);
3063 			return (EINTR);
3064 		}
3065 	} else {
3066 		if (nfs_rw_enter_sig(&ndrp->r_rwlock, RW_WRITER, INTR(ndvp)))
3067 			return (EINTR);
3068 		if (nfs_rw_enter_sig(&odrp->r_rwlock, RW_WRITER, INTR(odvp))) {
3069 			nfs_rw_exit(&ndrp->r_rwlock);
3070 			return (EINTR);
3071 		}
3072 	}
3073 
3074 	/*
3075 	 * Lookup the target file.  If it exists, it needs to be
3076 	 * checked to see whether it is a mount point and whether
3077 	 * it is active (open).
3078 	 */
3079 	error = nfs3lookup(ndvp, nnm, &nvp, NULL, 0, NULL, cr, 0);
3080 	if (!error) {
3081 		/*
3082 		 * If this file has been mounted on, then just
3083 		 * return busy because renaming to it would remove
3084 		 * the mounted file system from the name space.
3085 		 */
3086 		if (vn_mountedvfs(nvp) != NULL) {
3087 			VN_RELE(nvp);
3088 			nfs_rw_exit(&odrp->r_rwlock);
3089 			nfs_rw_exit(&ndrp->r_rwlock);
3090 			return (EBUSY);
3091 		}
3092 
3093 		/*
3094 		 * Purge the name cache of all references to this vnode
3095 		 * so that we can check the reference count to infer
3096 		 * whether it is active or not.
3097 		 */
3098 		/*
3099 		 * First just remove the entry from the name cache, as it
3100 		 * is most likely the only entry for this vp.
3101 		 */
3102 		dnlc_remove(ndvp, nnm);
3103 		/*
3104 		 * If the file has a v_count > 1 then there may be more
3105 		 * than one entry in the name cache due multiple links
3106 		 * or an open file, but we don't have the real reference
3107 		 * count so flush all possible entries.
3108 		 */
3109 		if (nvp->v_count > 1)
3110 			dnlc_purge_vp(nvp);
3111 
3112 		/*
3113 		 * If the vnode is active and is not a directory,
3114 		 * arrange to rename it to a
3115 		 * temporary file so that it will continue to be
3116 		 * accessible.  This implements the "unlink-open-file"
3117 		 * semantics for the target of a rename operation.
3118 		 * Before doing this though, make sure that the
3119 		 * source and target files are not already the same.
3120 		 */
3121 		if (nvp->v_count > 1 && nvp->v_type != VDIR) {
3122 			/*
3123 			 * Lookup the source name.
3124 			 */
3125 			error = nfs3lookup(odvp, onm, &ovp, NULL, 0, NULL,
3126 			    cr, 0);
3127 
3128 			/*
3129 			 * The source name *should* already exist.
3130 			 */
3131 			if (error) {
3132 				VN_RELE(nvp);
3133 				nfs_rw_exit(&odrp->r_rwlock);
3134 				nfs_rw_exit(&ndrp->r_rwlock);
3135 				return (error);
3136 			}
3137 
3138 			/*
3139 			 * Compare the two vnodes.  If they are the same,
3140 			 * just release all held vnodes and return success.
3141 			 */
3142 			if (ovp == nvp) {
3143 				VN_RELE(ovp);
3144 				VN_RELE(nvp);
3145 				nfs_rw_exit(&odrp->r_rwlock);
3146 				nfs_rw_exit(&ndrp->r_rwlock);
3147 				return (0);
3148 			}
3149 
3150 			/*
3151 			 * Can't mix and match directories and non-
3152 			 * directories in rename operations.  We already
3153 			 * know that the target is not a directory.  If
3154 			 * the source is a directory, return an error.
3155 			 */
3156 			if (ovp->v_type == VDIR) {
3157 				VN_RELE(ovp);
3158 				VN_RELE(nvp);
3159 				nfs_rw_exit(&odrp->r_rwlock);
3160 				nfs_rw_exit(&ndrp->r_rwlock);
3161 				return (ENOTDIR);
3162 			}
3163 
3164 			/*
3165 			 * The target file exists, is not the same as
3166 			 * the source file, and is active.  Link it
3167 			 * to a temporary filename to avoid having
3168 			 * the server removing the file completely.
3169 			 */
3170 			tmpname = newname();
3171 			error = nfs3_link(ndvp, nvp, tmpname, cr, NULL, 0);
3172 			if (error == EOPNOTSUPP) {
3173 				error = nfs3_rename(ndvp, nnm, ndvp, tmpname,
3174 				    cr, NULL, 0);
3175 			}
3176 			if (error) {
3177 				kmem_free(tmpname, MAXNAMELEN);
3178 				VN_RELE(ovp);
3179 				VN_RELE(nvp);
3180 				nfs_rw_exit(&odrp->r_rwlock);
3181 				nfs_rw_exit(&ndrp->r_rwlock);
3182 				return (error);
3183 			}
3184 			rp = VTOR(nvp);
3185 			mutex_enter(&rp->r_statelock);
3186 			if (rp->r_unldvp == NULL) {
3187 				VN_HOLD(ndvp);
3188 				rp->r_unldvp = ndvp;
3189 				if (rp->r_unlcred != NULL)
3190 					crfree(rp->r_unlcred);
3191 				crhold(cr);
3192 				rp->r_unlcred = cr;
3193 				rp->r_unlname = tmpname;
3194 			} else {
3195 				kmem_free(rp->r_unlname, MAXNAMELEN);
3196 				rp->r_unlname = tmpname;
3197 			}
3198 			mutex_exit(&rp->r_statelock);
3199 		}
3200 	}
3201 
3202 	if (ovp == NULL) {
3203 		/*
3204 		 * When renaming directories to be a subdirectory of a
3205 		 * different parent, the dnlc entry for ".." will no
3206 		 * longer be valid, so it must be removed.
3207 		 *
3208 		 * We do a lookup here to determine whether we are renaming
3209 		 * a directory and we need to check if we are renaming
3210 		 * an unlinked file.  This might have already been done
3211 		 * in previous code, so we check ovp == NULL to avoid
3212 		 * doing it twice.
3213 		 */
3214 
3215 		error = nfs3lookup(odvp, onm, &ovp, NULL, 0, NULL, cr, 0);
3216 		/*
3217 		 * The source name *should* already exist.
3218 		 */
3219 		if (error) {
3220 			nfs_rw_exit(&odrp->r_rwlock);
3221 			nfs_rw_exit(&ndrp->r_rwlock);
3222 			if (nvp) {
3223 				VN_RELE(nvp);
3224 			}
3225 			return (error);
3226 		}
3227 		ASSERT(ovp != NULL);
3228 	}
3229 
3230 	dnlc_remove(odvp, onm);
3231 	dnlc_remove(ndvp, nnm);
3232 
3233 	setdiropargs3(&args.from, onm, odvp);
3234 	setdiropargs3(&args.to, nnm, ndvp);
3235 
3236 	douprintf = 1;
3237 
3238 	t = gethrtime();
3239 
3240 	error = rfs3call(VTOMI(odvp), NFSPROC3_RENAME,
3241 	    xdr_RENAME3args, (caddr_t)&args,
3242 	    xdr_RENAME3res, (caddr_t)&res, cr,
3243 	    &douprintf, &res.status, 0, NULL);
3244 
3245 	if (error) {
3246 		PURGE_ATTRCACHE(odvp);
3247 		PURGE_ATTRCACHE(ndvp);
3248 		VN_RELE(ovp);
3249 		nfs_rw_exit(&odrp->r_rwlock);
3250 		nfs_rw_exit(&ndrp->r_rwlock);
3251 		if (nvp) {
3252 			VN_RELE(nvp);
3253 		}
3254 		return (error);
3255 	}
3256 
3257 	error = geterrno3(res.status);
3258 
3259 	if (!error) {
3260 		nfs3_cache_wcc_data(odvp, &res.resok.fromdir_wcc, t, cr);
3261 		if (HAVE_RDDIR_CACHE(odrp))
3262 			nfs_purge_rddir_cache(odvp);
3263 		if (ndvp != odvp) {
3264 			nfs3_cache_wcc_data(ndvp, &res.resok.todir_wcc, t, cr);
3265 			if (HAVE_RDDIR_CACHE(ndrp))
3266 				nfs_purge_rddir_cache(ndvp);
3267 		}
3268 		/*
3269 		 * when renaming directories to be a subdirectory of a
3270 		 * different parent, the dnlc entry for ".." will no
3271 		 * longer be valid, so it must be removed
3272 		 */
3273 		rp = VTOR(ovp);
3274 		if (ndvp != odvp) {
3275 			if (ovp->v_type == VDIR) {
3276 				dnlc_remove(ovp, "..");
3277 				if (HAVE_RDDIR_CACHE(rp))
3278 					nfs_purge_rddir_cache(ovp);
3279 			}
3280 		}
3281 
3282 		/*
3283 		 * If we are renaming the unlinked file, update the
3284 		 * r_unldvp and r_unlname as needed.
3285 		 */
3286 		mutex_enter(&rp->r_statelock);
3287 		if (rp->r_unldvp != NULL) {
3288 			if (strcmp(rp->r_unlname, onm) == 0) {
3289 				(void) strncpy(rp->r_unlname, nnm, MAXNAMELEN);
3290 				rp->r_unlname[MAXNAMELEN - 1] = '\0';
3291 
3292 				if (ndvp != rp->r_unldvp) {
3293 					VN_RELE(rp->r_unldvp);
3294 					rp->r_unldvp = ndvp;
3295 					VN_HOLD(ndvp);
3296 				}
3297 			}
3298 		}
3299 		mutex_exit(&rp->r_statelock);
3300 	} else {
3301 		nfs3_cache_wcc_data(odvp, &res.resfail.fromdir_wcc, t, cr);
3302 		if (ndvp != odvp) {
3303 			nfs3_cache_wcc_data(ndvp, &res.resfail.todir_wcc, t,
3304 			    cr);
3305 		}
3306 		/*
3307 		 * System V defines rename to return EEXIST, not
3308 		 * ENOTEMPTY if the target directory is not empty.
3309 		 * Over the wire, the error is NFSERR_ENOTEMPTY
3310 		 * which geterrno maps to ENOTEMPTY.
3311 		 */
3312 		if (error == ENOTEMPTY)
3313 			error = EEXIST;
3314 	}
3315 
3316 	if (error == 0) {
3317 		if (nvp)
3318 			vnevent_rename_dest(nvp, ndvp, nnm, ct);
3319 
3320 		if (odvp != ndvp)
3321 			vnevent_rename_dest_dir(ndvp, ct);
3322 		ASSERT(ovp != NULL);
3323 		vnevent_rename_src(ovp, odvp, onm, ct);
3324 	}
3325 
3326 	if (nvp) {
3327 		VN_RELE(nvp);
3328 	}
3329 	VN_RELE(ovp);
3330 
3331 	nfs_rw_exit(&odrp->r_rwlock);
3332 	nfs_rw_exit(&ndrp->r_rwlock);
3333 
3334 	return (error);
3335 }
3336 
3337 /* ARGSUSED */
3338 static int
3339 nfs3_mkdir(vnode_t *dvp, char *nm, struct vattr *va, vnode_t **vpp, cred_t *cr,
3340 	caller_context_t *ct, int flags, vsecattr_t *vsecp)
3341 {
3342 	int error;
3343 	MKDIR3args args;
3344 	MKDIR3res res;
3345 	int douprintf;
3346 	struct vattr vattr;
3347 	vnode_t *vp;
3348 	rnode_t *drp;
3349 	hrtime_t t;
3350 
3351 	if (nfs_zone() != VTOMI(dvp)->mi_zone)
3352 		return (EPERM);
3353 	setdiropargs3(&args.where, nm, dvp);
3354 
3355 	/*
3356 	 * Decide what the group-id and set-gid bit of the created directory
3357 	 * should be.  May have to do a setattr to get the gid right.
3358 	 */
3359 	error = setdirgid(dvp, &va->va_gid, cr);
3360 	if (error)
3361 		return (error);
3362 	error = setdirmode(dvp, &va->va_mode, cr);
3363 	if (error)
3364 		return (error);
3365 	va->va_mask |= AT_MODE|AT_GID;
3366 
3367 	error = vattr_to_sattr3(va, &args.attributes);
3368 	if (error) {
3369 		/* req time field(s) overflow - return immediately */
3370 		return (error);
3371 	}
3372 
3373 	drp = VTOR(dvp);
3374 	if (nfs_rw_enter_sig(&drp->r_rwlock, RW_WRITER, INTR(dvp)))
3375 		return (EINTR);
3376 
3377 	dnlc_remove(dvp, nm);
3378 
3379 	douprintf = 1;
3380 
3381 	t = gethrtime();
3382 
3383 	error = rfs3call(VTOMI(dvp), NFSPROC3_MKDIR,
3384 	    xdr_MKDIR3args, (caddr_t)&args,
3385 	    xdr_MKDIR3res, (caddr_t)&res, cr,
3386 	    &douprintf, &res.status, 0, NULL);
3387 
3388 	if (error) {
3389 		PURGE_ATTRCACHE(dvp);
3390 		nfs_rw_exit(&drp->r_rwlock);
3391 		return (error);
3392 	}
3393 
3394 	error = geterrno3(res.status);
3395 	if (!error) {
3396 		nfs3_cache_wcc_data(dvp, &res.resok.dir_wcc, t, cr);
3397 		if (HAVE_RDDIR_CACHE(drp))
3398 			nfs_purge_rddir_cache(dvp);
3399 
3400 		if (!res.resok.obj.handle_follows) {
3401 			error = nfs3lookup(dvp, nm, &vp, NULL, 0, NULL, cr, 0);
3402 			if (error) {
3403 				nfs_rw_exit(&drp->r_rwlock);
3404 				return (error);
3405 			}
3406 		} else {
3407 			if (res.resok.obj_attributes.attributes) {
3408 				vp = makenfs3node(&res.resok.obj.handle,
3409 				    &res.resok.obj_attributes.attr,
3410 				    dvp->v_vfsp, t, cr, NULL, NULL);
3411 			} else {
3412 				vp = makenfs3node(&res.resok.obj.handle, NULL,
3413 				    dvp->v_vfsp, t, cr, NULL, NULL);
3414 				if (vp->v_type == VNON) {
3415 					vattr.va_mask = AT_TYPE;
3416 					error = nfs3getattr(vp, &vattr, cr);
3417 					if (error) {
3418 						VN_RELE(vp);
3419 						nfs_rw_exit(&drp->r_rwlock);
3420 						return (error);
3421 					}
3422 					vp->v_type = vattr.va_type;
3423 				}
3424 			}
3425 			dnlc_update(dvp, nm, vp);
3426 		}
3427 		if (va->va_gid != VTOR(vp)->r_attr.va_gid) {
3428 			va->va_mask = AT_GID;
3429 			(void) nfs3setattr(vp, va, 0, cr);
3430 		}
3431 		*vpp = vp;
3432 	} else {
3433 		nfs3_cache_wcc_data(dvp, &res.resfail.dir_wcc, t, cr);
3434 		PURGE_STALE_FH(error, dvp, cr);
3435 	}
3436 
3437 	nfs_rw_exit(&drp->r_rwlock);
3438 
3439 	return (error);
3440 }
3441 
3442 /* ARGSUSED */
3443 static int
3444 nfs3_rmdir(vnode_t *dvp, char *nm, vnode_t *cdir, cred_t *cr,
3445 	caller_context_t *ct, int flags)
3446 {
3447 	int error;
3448 	RMDIR3args args;
3449 	RMDIR3res res;
3450 	vnode_t *vp;
3451 	int douprintf;
3452 	rnode_t *drp;
3453 	hrtime_t t;
3454 
3455 	if (nfs_zone() != VTOMI(dvp)->mi_zone)
3456 		return (EPERM);
3457 	drp = VTOR(dvp);
3458 	if (nfs_rw_enter_sig(&drp->r_rwlock, RW_WRITER, INTR(dvp)))
3459 		return (EINTR);
3460 
3461 	/*
3462 	 * Attempt to prevent a rmdir(".") from succeeding.
3463 	 */
3464 	error = nfs3lookup(dvp, nm, &vp, NULL, 0, NULL, cr, 0);
3465 	if (error) {
3466 		nfs_rw_exit(&drp->r_rwlock);
3467 		return (error);
3468 	}
3469 
3470 	if (vp == cdir) {
3471 		VN_RELE(vp);
3472 		nfs_rw_exit(&drp->r_rwlock);
3473 		return (EINVAL);
3474 	}
3475 
3476 	setdiropargs3(&args.object, nm, dvp);
3477 
3478 	/*
3479 	 * First just remove the entry from the name cache, as it
3480 	 * is most likely an entry for this vp.
3481 	 */
3482 	dnlc_remove(dvp, nm);
3483 
3484 	/*
3485 	 * If there vnode reference count is greater than one, then
3486 	 * there may be additional references in the DNLC which will
3487 	 * need to be purged.  First, trying removing the entry for
3488 	 * the parent directory and see if that removes the additional
3489 	 * reference(s).  If that doesn't do it, then use dnlc_purge_vp
3490 	 * to completely remove any references to the directory which
3491 	 * might still exist in the DNLC.
3492 	 */
3493 	if (vp->v_count > 1) {
3494 		dnlc_remove(vp, "..");
3495 		if (vp->v_count > 1)
3496 			dnlc_purge_vp(vp);
3497 	}
3498 
3499 	douprintf = 1;
3500 
3501 	t = gethrtime();
3502 
3503 	error = rfs3call(VTOMI(dvp), NFSPROC3_RMDIR,
3504 	    xdr_diropargs3, (caddr_t)&args,
3505 	    xdr_RMDIR3res, (caddr_t)&res, cr,
3506 	    &douprintf, &res.status, 0, NULL);
3507 
3508 	PURGE_ATTRCACHE(vp);
3509 
3510 	if (error) {
3511 		PURGE_ATTRCACHE(dvp);
3512 		VN_RELE(vp);
3513 		nfs_rw_exit(&drp->r_rwlock);
3514 		return (error);
3515 	}
3516 
3517 	error = geterrno3(res.status);
3518 	if (!error) {
3519 		nfs3_cache_wcc_data(dvp, &res.resok.dir_wcc, t, cr);
3520 		if (HAVE_RDDIR_CACHE(drp))
3521 			nfs_purge_rddir_cache(dvp);
3522 		if (HAVE_RDDIR_CACHE(VTOR(vp)))
3523 			nfs_purge_rddir_cache(vp);
3524 	} else {
3525 		nfs3_cache_wcc_data(dvp, &res.resfail.dir_wcc, t, cr);
3526 		PURGE_STALE_FH(error, dvp, cr);
3527 		/*
3528 		 * System V defines rmdir to return EEXIST, not
3529 		 * ENOTEMPTY if the directory is not empty.  Over
3530 		 * the wire, the error is NFSERR_ENOTEMPTY which
3531 		 * geterrno maps to ENOTEMPTY.
3532 		 */
3533 		if (error == ENOTEMPTY)
3534 			error = EEXIST;
3535 	}
3536 
3537 	if (error == 0) {
3538 		vnevent_rmdir(vp, dvp, nm, ct);
3539 	}
3540 	VN_RELE(vp);
3541 
3542 	nfs_rw_exit(&drp->r_rwlock);
3543 
3544 	return (error);
3545 }
3546 
3547 /* ARGSUSED */
3548 static int
3549 nfs3_symlink(vnode_t *dvp, char *lnm, struct vattr *tva, char *tnm, cred_t *cr,
3550 	caller_context_t *ct, int flags)
3551 {
3552 	int error;
3553 	SYMLINK3args args;
3554 	SYMLINK3res res;
3555 	int douprintf;
3556 	mntinfo_t *mi;
3557 	vnode_t *vp;
3558 	rnode_t *rp;
3559 	char *contents;
3560 	rnode_t *drp;
3561 	hrtime_t t;
3562 
3563 	mi = VTOMI(dvp);
3564 
3565 	if (nfs_zone() != mi->mi_zone)
3566 		return (EPERM);
3567 	if (!(mi->mi_flags & MI_SYMLINK))
3568 		return (EOPNOTSUPP);
3569 
3570 	setdiropargs3(&args.where, lnm, dvp);
3571 	error = vattr_to_sattr3(tva, &args.symlink.symlink_attributes);
3572 	if (error) {
3573 		/* req time field(s) overflow - return immediately */
3574 		return (error);
3575 	}
3576 	args.symlink.symlink_data = tnm;
3577 
3578 	drp = VTOR(dvp);
3579 	if (nfs_rw_enter_sig(&drp->r_rwlock, RW_WRITER, INTR(dvp)))
3580 		return (EINTR);
3581 
3582 	dnlc_remove(dvp, lnm);
3583 
3584 	douprintf = 1;
3585 
3586 	t = gethrtime();
3587 
3588 	error = rfs3call(mi, NFSPROC3_SYMLINK,
3589 	    xdr_SYMLINK3args, (caddr_t)&args,
3590 	    xdr_SYMLINK3res, (caddr_t)&res, cr,
3591 	    &douprintf, &res.status, 0, NULL);
3592 
3593 	if (error) {
3594 		PURGE_ATTRCACHE(dvp);
3595 		nfs_rw_exit(&drp->r_rwlock);
3596 		return (error);
3597 	}
3598 
3599 	error = geterrno3(res.status);
3600 	if (!error) {
3601 		nfs3_cache_wcc_data(dvp, &res.resok.dir_wcc, t, cr);
3602 		if (HAVE_RDDIR_CACHE(drp))
3603 			nfs_purge_rddir_cache(dvp);
3604 
3605 		if (res.resok.obj.handle_follows) {
3606 			if (res.resok.obj_attributes.attributes) {
3607 				vp = makenfs3node(&res.resok.obj.handle,
3608 				    &res.resok.obj_attributes.attr,
3609 				    dvp->v_vfsp, t, cr, NULL, NULL);
3610 			} else {
3611 				vp = makenfs3node(&res.resok.obj.handle, NULL,
3612 				    dvp->v_vfsp, t, cr, NULL, NULL);
3613 				vp->v_type = VLNK;
3614 				vp->v_rdev = 0;
3615 			}
3616 			dnlc_update(dvp, lnm, vp);
3617 			rp = VTOR(vp);
3618 			if (nfs3_do_symlink_cache &&
3619 			    rp->r_symlink.contents == NULL) {
3620 
3621 				contents = kmem_alloc(MAXPATHLEN,
3622 				    KM_NOSLEEP);
3623 
3624 				if (contents != NULL) {
3625 					mutex_enter(&rp->r_statelock);
3626 					if (rp->r_symlink.contents == NULL) {
3627 						rp->r_symlink.len = strlen(tnm);
3628 						bcopy(tnm, contents,
3629 						    rp->r_symlink.len);
3630 						rp->r_symlink.contents =
3631 						    contents;
3632 						rp->r_symlink.size = MAXPATHLEN;
3633 						mutex_exit(&rp->r_statelock);
3634 					} else {
3635 						mutex_exit(&rp->r_statelock);
3636 						kmem_free((void *)contents,
3637 						    MAXPATHLEN);
3638 					}
3639 				}
3640 			}
3641 			VN_RELE(vp);
3642 		}
3643 	} else {
3644 		nfs3_cache_wcc_data(dvp, &res.resfail.dir_wcc, t, cr);
3645 		PURGE_STALE_FH(error, dvp, cr);
3646 		if (error == EOPNOTSUPP) {
3647 			mutex_enter(&mi->mi_lock);
3648 			mi->mi_flags &= ~MI_SYMLINK;
3649 			mutex_exit(&mi->mi_lock);
3650 		}
3651 	}
3652 
3653 	nfs_rw_exit(&drp->r_rwlock);
3654 
3655 	return (error);
3656 }
3657 
3658 #ifdef DEBUG
3659 static int nfs3_readdir_cache_hits = 0;
3660 static int nfs3_readdir_cache_shorts = 0;
3661 static int nfs3_readdir_cache_waits = 0;
3662 static int nfs3_readdir_cache_misses = 0;
3663 static int nfs3_readdir_readahead = 0;
3664 #endif
3665 
3666 static int nfs3_shrinkreaddir = 0;
3667 
3668 /*
3669  * Read directory entries.
3670  * There are some weird things to look out for here.  The uio_loffset
3671  * field is either 0 or it is the offset returned from a previous
3672  * readdir.  It is an opaque value used by the server to find the
3673  * correct directory block to read. The count field is the number
3674  * of blocks to read on the server.  This is advisory only, the server
3675  * may return only one block's worth of entries.  Entries may be compressed
3676  * on the server.
3677  */
3678 /* ARGSUSED */
3679 static int
3680 nfs3_readdir(vnode_t *vp, struct uio *uiop, cred_t *cr, int *eofp,
3681 	caller_context_t *ct, int flags)
3682 {
3683 	int error;
3684 	size_t count;
3685 	rnode_t *rp;
3686 	rddir_cache *rdc;
3687 	rddir_cache *nrdc;
3688 	rddir_cache *rrdc;
3689 #ifdef DEBUG
3690 	int missed;
3691 #endif
3692 	int doreadahead;
3693 	rddir_cache srdc;
3694 	avl_index_t where;
3695 
3696 	if (nfs_zone() != VTOMI(vp)->mi_zone)
3697 		return (EIO);
3698 	rp = VTOR(vp);
3699 
3700 	ASSERT(nfs_rw_lock_held(&rp->r_rwlock, RW_READER));
3701 
3702 	/*
3703 	 * Make sure that the directory cache is valid.
3704 	 */
3705 	if (HAVE_RDDIR_CACHE(rp)) {
3706 		if (nfs_disable_rddir_cache) {
3707 			/*
3708 			 * Setting nfs_disable_rddir_cache in /etc/system
3709 			 * allows interoperability with servers that do not
3710 			 * properly update the attributes of directories.
3711 			 * Any cached information gets purged before an
3712 			 * access is made to it.
3713 			 */
3714 			nfs_purge_rddir_cache(vp);
3715 		} else {
3716 			error = nfs3_validate_caches(vp, cr);
3717 			if (error)
3718 				return (error);
3719 		}
3720 	}
3721 
3722 	/*
3723 	 * It is possible that some servers may not be able to correctly
3724 	 * handle a large READDIR or READDIRPLUS request due to bugs in
3725 	 * their implementation.  In order to continue to interoperate
3726 	 * with them, this workaround is provided to limit the maximum
3727 	 * size of a READDIRPLUS request to 1024.  In any case, the request
3728 	 * size is limited to MAXBSIZE.
3729 	 */
3730 	count = MIN(uiop->uio_iov->iov_len,
3731 	    nfs3_shrinkreaddir ? 1024 : MAXBSIZE);
3732 
3733 	nrdc = NULL;
3734 #ifdef DEBUG
3735 	missed = 0;
3736 #endif
3737 top:
3738 	/*
3739 	 * Short circuit last readdir which always returns 0 bytes.
3740 	 * This can be done after the directory has been read through
3741 	 * completely at least once.  This will set r_direof which
3742 	 * can be used to find the value of the last cookie.
3743 	 */
3744 	mutex_enter(&rp->r_statelock);
3745 	if (rp->r_direof != NULL &&
3746 	    uiop->uio_loffset == rp->r_direof->nfs3_ncookie) {
3747 		mutex_exit(&rp->r_statelock);
3748 #ifdef DEBUG
3749 		nfs3_readdir_cache_shorts++;
3750 #endif
3751 		if (eofp)
3752 			*eofp = 1;
3753 		if (nrdc != NULL)
3754 			rddir_cache_rele(nrdc);
3755 		return (0);
3756 	}
3757 	/*
3758 	 * Look for a cache entry.  Cache entries are identified
3759 	 * by the NFS cookie value and the byte count requested.
3760 	 */
3761 	srdc.nfs3_cookie = uiop->uio_loffset;
3762 	srdc.buflen = count;
3763 	rdc = avl_find(&rp->r_dir, &srdc, &where);
3764 	if (rdc != NULL) {
3765 		rddir_cache_hold(rdc);
3766 		/*
3767 		 * If the cache entry is in the process of being
3768 		 * filled in, wait until this completes.  The
3769 		 * RDDIRWAIT bit is set to indicate that someone
3770 		 * is waiting and then the thread currently
3771 		 * filling the entry is done, it should do a
3772 		 * cv_broadcast to wakeup all of the threads
3773 		 * waiting for it to finish.
3774 		 */
3775 		if (rdc->flags & RDDIR) {
3776 			nfs_rw_exit(&rp->r_rwlock);
3777 			rdc->flags |= RDDIRWAIT;
3778 #ifdef DEBUG
3779 			nfs3_readdir_cache_waits++;
3780 #endif
3781 			if (!cv_wait_sig(&rdc->cv, &rp->r_statelock)) {
3782 				/*
3783 				 * We got interrupted, probably
3784 				 * the user typed ^C or an alarm
3785 				 * fired.  We free the new entry
3786 				 * if we allocated one.
3787 				 */
3788 				mutex_exit(&rp->r_statelock);
3789 				(void) nfs_rw_enter_sig(&rp->r_rwlock,
3790 				    RW_READER, FALSE);
3791 				rddir_cache_rele(rdc);
3792 				if (nrdc != NULL)
3793 					rddir_cache_rele(nrdc);
3794 				return (EINTR);
3795 			}
3796 			mutex_exit(&rp->r_statelock);
3797 			(void) nfs_rw_enter_sig(&rp->r_rwlock,
3798 			    RW_READER, FALSE);
3799 			rddir_cache_rele(rdc);
3800 			goto top;
3801 		}
3802 		/*
3803 		 * Check to see if a readdir is required to
3804 		 * fill the entry.  If so, mark this entry
3805 		 * as being filled, remove our reference,
3806 		 * and branch to the code to fill the entry.
3807 		 */
3808 		if (rdc->flags & RDDIRREQ) {
3809 			rdc->flags &= ~RDDIRREQ;
3810 			rdc->flags |= RDDIR;
3811 			if (nrdc != NULL)
3812 				rddir_cache_rele(nrdc);
3813 			nrdc = rdc;
3814 			mutex_exit(&rp->r_statelock);
3815 			goto bottom;
3816 		}
3817 #ifdef DEBUG
3818 		if (!missed)
3819 			nfs3_readdir_cache_hits++;
3820 #endif
3821 		/*
3822 		 * If an error occurred while attempting
3823 		 * to fill the cache entry, just return it.
3824 		 */
3825 		if (rdc->error) {
3826 			error = rdc->error;
3827 			mutex_exit(&rp->r_statelock);
3828 			rddir_cache_rele(rdc);
3829 			if (nrdc != NULL)
3830 				rddir_cache_rele(nrdc);
3831 			return (error);
3832 		}
3833 
3834 		/*
3835 		 * The cache entry is complete and good,
3836 		 * copyout the dirent structs to the calling
3837 		 * thread.
3838 		 */
3839 		error = uiomove(rdc->entries, rdc->entlen, UIO_READ, uiop);
3840 
3841 		/*
3842 		 * If no error occurred during the copyout,
3843 		 * update the offset in the uio struct to
3844 		 * contain the value of the next cookie
3845 		 * and set the eof value appropriately.
3846 		 */
3847 		if (!error) {
3848 			uiop->uio_loffset = rdc->nfs3_ncookie;
3849 			if (eofp)
3850 				*eofp = rdc->eof;
3851 		}
3852 
3853 		/*
3854 		 * Decide whether to do readahead.
3855 		 *
3856 		 * Don't if have already read to the end of
3857 		 * directory.  There is nothing more to read.
3858 		 *
3859 		 * Don't if the application is not doing
3860 		 * lookups in the directory.  The readahead
3861 		 * is only effective if the application can
3862 		 * be doing work while an async thread is
3863 		 * handling the over the wire request.
3864 		 */
3865 		if (rdc->eof) {
3866 			rp->r_direof = rdc;
3867 			doreadahead = FALSE;
3868 		} else if (!(rp->r_flags & RLOOKUP))
3869 			doreadahead = FALSE;
3870 		else
3871 			doreadahead = TRUE;
3872 
3873 		if (!doreadahead) {
3874 			mutex_exit(&rp->r_statelock);
3875 			rddir_cache_rele(rdc);
3876 			if (nrdc != NULL)
3877 				rddir_cache_rele(nrdc);
3878 			return (error);
3879 		}
3880 
3881 		/*
3882 		 * Check to see whether we found an entry
3883 		 * for the readahead.  If so, we don't need
3884 		 * to do anything further, so free the new
3885 		 * entry if one was allocated.  Otherwise,
3886 		 * allocate a new entry, add it to the cache,
3887 		 * and then initiate an asynchronous readdir
3888 		 * operation to fill it.
3889 		 */
3890 		srdc.nfs3_cookie = rdc->nfs3_ncookie;
3891 		srdc.buflen = count;
3892 		rrdc = avl_find(&rp->r_dir, &srdc, &where);
3893 		if (rrdc != NULL) {
3894 			if (nrdc != NULL)
3895 				rddir_cache_rele(nrdc);
3896 		} else {
3897 			if (nrdc != NULL)
3898 				rrdc = nrdc;
3899 			else {
3900 				rrdc = rddir_cache_alloc(KM_NOSLEEP);
3901 			}
3902 			if (rrdc != NULL) {
3903 				rrdc->nfs3_cookie = rdc->nfs3_ncookie;
3904 				rrdc->buflen = count;
3905 				avl_insert(&rp->r_dir, rrdc, where);
3906 				rddir_cache_hold(rrdc);
3907 				mutex_exit(&rp->r_statelock);
3908 				rddir_cache_rele(rdc);
3909 #ifdef DEBUG
3910 				nfs3_readdir_readahead++;
3911 #endif
3912 				nfs_async_readdir(vp, rrdc, cr, do_nfs3readdir);
3913 				return (error);
3914 			}
3915 		}
3916 
3917 		mutex_exit(&rp->r_statelock);
3918 		rddir_cache_rele(rdc);
3919 		return (error);
3920 	}
3921 
3922 	/*
3923 	 * Didn't find an entry in the cache.  Construct a new empty
3924 	 * entry and link it into the cache.  Other processes attempting
3925 	 * to access this entry will need to wait until it is filled in.
3926 	 *
3927 	 * Since kmem_alloc may block, another pass through the cache
3928 	 * will need to be taken to make sure that another process
3929 	 * hasn't already added an entry to the cache for this request.
3930 	 */
3931 	if (nrdc == NULL) {
3932 		mutex_exit(&rp->r_statelock);
3933 		nrdc = rddir_cache_alloc(KM_SLEEP);
3934 		nrdc->nfs3_cookie = uiop->uio_loffset;
3935 		nrdc->buflen = count;
3936 		goto top;
3937 	}
3938 
3939 	/*
3940 	 * Add this entry to the cache.
3941 	 */
3942 	avl_insert(&rp->r_dir, nrdc, where);
3943 	rddir_cache_hold(nrdc);
3944 	mutex_exit(&rp->r_statelock);
3945 
3946 bottom:
3947 #ifdef DEBUG
3948 	missed = 1;
3949 	nfs3_readdir_cache_misses++;
3950 #endif
3951 	/*
3952 	 * Do the readdir.  This routine decides whether to use
3953 	 * READDIR or READDIRPLUS.
3954 	 */
3955 	error = do_nfs3readdir(vp, nrdc, cr);
3956 
3957 	/*
3958 	 * If this operation failed, just return the error which occurred.
3959 	 */
3960 	if (error != 0)
3961 		return (error);
3962 
3963 	/*
3964 	 * Since the RPC operation will have taken sometime and blocked
3965 	 * this process, another pass through the cache will need to be
3966 	 * taken to find the correct cache entry.  It is possible that
3967 	 * the correct cache entry will not be there (although one was
3968 	 * added) because the directory changed during the RPC operation
3969 	 * and the readdir cache was flushed.  In this case, just start
3970 	 * over.  It is hoped that this will not happen too often... :-)
3971 	 */
3972 	nrdc = NULL;
3973 	goto top;
3974 	/* NOTREACHED */
3975 }
3976 
3977 static int
3978 do_nfs3readdir(vnode_t *vp, rddir_cache *rdc, cred_t *cr)
3979 {
3980 	int error;
3981 	rnode_t *rp;
3982 	mntinfo_t *mi;
3983 
3984 	rp = VTOR(vp);
3985 	mi = VTOMI(vp);
3986 	ASSERT(nfs_zone() == mi->mi_zone);
3987 	/*
3988 	 * Issue the proper request.
3989 	 *
3990 	 * If the server does not support READDIRPLUS, then use READDIR.
3991 	 *
3992 	 * Otherwise --
3993 	 * Issue a READDIRPLUS if reading to fill an empty cache or if
3994 	 * an application has performed a lookup in the directory which
3995 	 * required an over the wire lookup.  The use of READDIRPLUS
3996 	 * will help to (re)populate the DNLC.
3997 	 */
3998 	if (!(mi->mi_flags & MI_READDIRONLY) &&
3999 	    (rp->r_flags & (RLOOKUP | RREADDIRPLUS))) {
4000 		if (rp->r_flags & RREADDIRPLUS) {
4001 			mutex_enter(&rp->r_statelock);
4002 			rp->r_flags &= ~RREADDIRPLUS;
4003 			mutex_exit(&rp->r_statelock);
4004 		}
4005 		nfs3readdirplus(vp, rdc, cr);
4006 		if (rdc->error == EOPNOTSUPP)
4007 			nfs3readdir(vp, rdc, cr);
4008 	} else
4009 		nfs3readdir(vp, rdc, cr);
4010 
4011 	mutex_enter(&rp->r_statelock);
4012 	rdc->flags &= ~RDDIR;
4013 	if (rdc->flags & RDDIRWAIT) {
4014 		rdc->flags &= ~RDDIRWAIT;
4015 		cv_broadcast(&rdc->cv);
4016 	}
4017 	error = rdc->error;
4018 	if (error)
4019 		rdc->flags |= RDDIRREQ;
4020 	mutex_exit(&rp->r_statelock);
4021 
4022 	rddir_cache_rele(rdc);
4023 
4024 	return (error);
4025 }
4026 
4027 static void
4028 nfs3readdir(vnode_t *vp, rddir_cache *rdc, cred_t *cr)
4029 {
4030 	int error;
4031 	READDIR3args args;
4032 	READDIR3vres res;
4033 	vattr_t dva;
4034 	rnode_t *rp;
4035 	int douprintf;
4036 	failinfo_t fi, *fip = NULL;
4037 	mntinfo_t *mi;
4038 	hrtime_t t;
4039 
4040 	rp = VTOR(vp);
4041 	mi = VTOMI(vp);
4042 	ASSERT(nfs_zone() == mi->mi_zone);
4043 
4044 	args.dir = *RTOFH3(rp);
4045 	args.cookie = (cookie3)rdc->nfs3_cookie;
4046 	args.cookieverf = rp->r_cookieverf;
4047 	args.count = rdc->buflen;
4048 
4049 	/*
4050 	 * NFS client failover support
4051 	 * suppress failover unless we have a zero cookie
4052 	 */
4053 	if (args.cookie == (cookie3) 0) {
4054 		fi.vp = vp;
4055 		fi.fhp = (caddr_t)&args.dir;
4056 		fi.copyproc = nfs3copyfh;
4057 		fi.lookupproc = nfs3lookup;
4058 		fi.xattrdirproc = acl_getxattrdir3;
4059 		fip = &fi;
4060 	}
4061 
4062 #ifdef DEBUG
4063 	rdc->entries = rddir_cache_buf_alloc(rdc->buflen, KM_SLEEP);
4064 #else
4065 	rdc->entries = kmem_alloc(rdc->buflen, KM_SLEEP);
4066 #endif
4067 
4068 	res.entries = (dirent64_t *)rdc->entries;
4069 	res.entries_size = rdc->buflen;
4070 	res.dir_attributes.fres.vap = &dva;
4071 	res.dir_attributes.fres.vp = vp;
4072 	res.loff = rdc->nfs3_cookie;
4073 
4074 	douprintf = 1;
4075 
4076 	if (mi->mi_io_kstats) {
4077 		mutex_enter(&mi->mi_lock);
4078 		kstat_runq_enter(KSTAT_IO_PTR(mi->mi_io_kstats));
4079 		mutex_exit(&mi->mi_lock);
4080 	}
4081 
4082 	t = gethrtime();
4083 
4084 	error = rfs3call(VTOMI(vp), NFSPROC3_READDIR,
4085 	    xdr_READDIR3args, (caddr_t)&args,
4086 	    xdr_READDIR3vres, (caddr_t)&res, cr,
4087 	    &douprintf, &res.status, 0, fip);
4088 
4089 	if (mi->mi_io_kstats) {
4090 		mutex_enter(&mi->mi_lock);
4091 		kstat_runq_exit(KSTAT_IO_PTR(mi->mi_io_kstats));
4092 		mutex_exit(&mi->mi_lock);
4093 	}
4094 
4095 	if (error)
4096 		goto err;
4097 
4098 	nfs3_cache_post_op_vattr(vp, &res.dir_attributes, t, cr);
4099 
4100 	error = geterrno3(res.status);
4101 	if (error) {
4102 		PURGE_STALE_FH(error, vp, cr);
4103 		goto err;
4104 	}
4105 
4106 	if (mi->mi_io_kstats) {
4107 		mutex_enter(&mi->mi_lock);
4108 		KSTAT_IO_PTR(mi->mi_io_kstats)->reads++;
4109 		KSTAT_IO_PTR(mi->mi_io_kstats)->nread += res.size;
4110 		mutex_exit(&mi->mi_lock);
4111 	}
4112 
4113 	rdc->nfs3_ncookie = res.loff;
4114 	rp->r_cookieverf = res.cookieverf;
4115 	rdc->eof = res.eof ? 1 : 0;
4116 	rdc->entlen = res.size;
4117 	ASSERT(rdc->entlen <= rdc->buflen);
4118 	rdc->error = 0;
4119 	return;
4120 
4121 err:
4122 	kmem_free(rdc->entries, rdc->buflen);
4123 	rdc->entries = NULL;
4124 	rdc->error = error;
4125 }
4126 
4127 /*
4128  * Read directory entries.
4129  * There are some weird things to look out for here.  The uio_loffset
4130  * field is either 0 or it is the offset returned from a previous
4131  * readdir.  It is an opaque value used by the server to find the
4132  * correct directory block to read. The count field is the number
4133  * of blocks to read on the server.  This is advisory only, the server
4134  * may return only one block's worth of entries.  Entries may be compressed
4135  * on the server.
4136  */
4137 static void
4138 nfs3readdirplus(vnode_t *vp, rddir_cache *rdc, cred_t *cr)
4139 {
4140 	int error;
4141 	READDIRPLUS3args args;
4142 	READDIRPLUS3vres res;
4143 	vattr_t dva;
4144 	rnode_t *rp;
4145 	mntinfo_t *mi;
4146 	int douprintf;
4147 	failinfo_t fi, *fip = NULL;
4148 
4149 	rp = VTOR(vp);
4150 	mi = VTOMI(vp);
4151 	ASSERT(nfs_zone() == mi->mi_zone);
4152 
4153 	args.dir = *RTOFH3(rp);
4154 	args.cookie = (cookie3)rdc->nfs3_cookie;
4155 	args.cookieverf = rp->r_cookieverf;
4156 	args.dircount = rdc->buflen;
4157 	args.maxcount = mi->mi_tsize;
4158 
4159 	/*
4160 	 * NFS client failover support
4161 	 * suppress failover unless we have a zero cookie
4162 	 */
4163 	if (args.cookie == (cookie3)0) {
4164 		fi.vp = vp;
4165 		fi.fhp = (caddr_t)&args.dir;
4166 		fi.copyproc = nfs3copyfh;
4167 		fi.lookupproc = nfs3lookup;
4168 		fi.xattrdirproc = acl_getxattrdir3;
4169 		fip = &fi;
4170 	}
4171 
4172 #ifdef DEBUG
4173 	rdc->entries = rddir_cache_buf_alloc(rdc->buflen, KM_SLEEP);
4174 #else
4175 	rdc->entries = kmem_alloc(rdc->buflen, KM_SLEEP);
4176 #endif
4177 
4178 	res.entries = (dirent64_t *)rdc->entries;
4179 	res.entries_size = rdc->buflen;
4180 	res.dir_attributes.fres.vap = &dva;
4181 	res.dir_attributes.fres.vp = vp;
4182 	res.loff = rdc->nfs3_cookie;
4183 	res.credentials = cr;
4184 
4185 	douprintf = 1;
4186 
4187 	if (mi->mi_io_kstats) {
4188 		mutex_enter(&mi->mi_lock);
4189 		kstat_runq_enter(KSTAT_IO_PTR(mi->mi_io_kstats));
4190 		mutex_exit(&mi->mi_lock);
4191 	}
4192 
4193 	res.time = gethrtime();
4194 
4195 	error = rfs3call(mi, NFSPROC3_READDIRPLUS,
4196 	    xdr_READDIRPLUS3args, (caddr_t)&args,
4197 	    xdr_READDIRPLUS3vres, (caddr_t)&res, cr,
4198 	    &douprintf, &res.status, 0, fip);
4199 
4200 	if (mi->mi_io_kstats) {
4201 		mutex_enter(&mi->mi_lock);
4202 		kstat_runq_exit(KSTAT_IO_PTR(mi->mi_io_kstats));
4203 		mutex_exit(&mi->mi_lock);
4204 	}
4205 
4206 	if (error) {
4207 		goto err;
4208 	}
4209 
4210 	nfs3_cache_post_op_vattr(vp, &res.dir_attributes, res.time, cr);
4211 
4212 	error = geterrno3(res.status);
4213 	if (error) {
4214 		PURGE_STALE_FH(error, vp, cr);
4215 		if (error == EOPNOTSUPP) {
4216 			mutex_enter(&mi->mi_lock);
4217 			mi->mi_flags |= MI_READDIRONLY;
4218 			mutex_exit(&mi->mi_lock);
4219 		}
4220 		goto err;
4221 	}
4222 
4223 	if (mi->mi_io_kstats) {
4224 		mutex_enter(&mi->mi_lock);
4225 		KSTAT_IO_PTR(mi->mi_io_kstats)->reads++;
4226 		KSTAT_IO_PTR(mi->mi_io_kstats)->nread += res.size;
4227 		mutex_exit(&mi->mi_lock);
4228 	}
4229 
4230 	rdc->nfs3_ncookie = res.loff;
4231 	rp->r_cookieverf = res.cookieverf;
4232 	rdc->eof = res.eof ? 1 : 0;
4233 	rdc->entlen = res.size;
4234 	ASSERT(rdc->entlen <= rdc->buflen);
4235 	rdc->error = 0;
4236 
4237 	return;
4238 
4239 err:
4240 	kmem_free(rdc->entries, rdc->buflen);
4241 	rdc->entries = NULL;
4242 	rdc->error = error;
4243 }
4244 
4245 #ifdef DEBUG
4246 static int nfs3_bio_do_stop = 0;
4247 #endif
4248 
4249 static int
4250 nfs3_bio(struct buf *bp, stable_how *stab_comm, cred_t *cr)
4251 {
4252 	rnode_t *rp = VTOR(bp->b_vp);
4253 	int count;
4254 	int error;
4255 	cred_t *cred;
4256 	offset_t offset;
4257 
4258 	ASSERT(nfs_zone() == VTOMI(bp->b_vp)->mi_zone);
4259 	offset = ldbtob(bp->b_lblkno);
4260 
4261 	DTRACE_IO1(start, struct buf *, bp);
4262 
4263 	if (bp->b_flags & B_READ) {
4264 		mutex_enter(&rp->r_statelock);
4265 		if (rp->r_cred != NULL) {
4266 			cred = rp->r_cred;
4267 			crhold(cred);
4268 		} else {
4269 			rp->r_cred = cr;
4270 			crhold(cr);
4271 			cred = cr;
4272 			crhold(cred);
4273 		}
4274 		mutex_exit(&rp->r_statelock);
4275 	read_again:
4276 		error = bp->b_error = nfs3read(bp->b_vp, bp->b_un.b_addr,
4277 		    offset, bp->b_bcount, &bp->b_resid, cred);
4278 		crfree(cred);
4279 		if (!error) {
4280 			if (bp->b_resid) {
4281 				/*
4282 				 * Didn't get it all because we hit EOF,
4283 				 * zero all the memory beyond the EOF.
4284 				 */
4285 				/* bzero(rdaddr + */
4286 				bzero(bp->b_un.b_addr +
4287 				    bp->b_bcount - bp->b_resid, bp->b_resid);
4288 			}
4289 			mutex_enter(&rp->r_statelock);
4290 			if (bp->b_resid == bp->b_bcount &&
4291 			    offset >= rp->r_size) {
4292 				/*
4293 				 * We didn't read anything at all as we are
4294 				 * past EOF.  Return an error indicator back
4295 				 * but don't destroy the pages (yet).
4296 				 */
4297 				error = NFS_EOF;
4298 			}
4299 			mutex_exit(&rp->r_statelock);
4300 		} else if (error == EACCES) {
4301 			mutex_enter(&rp->r_statelock);
4302 			if (cred != cr) {
4303 				if (rp->r_cred != NULL)
4304 					crfree(rp->r_cred);
4305 				rp->r_cred = cr;
4306 				crhold(cr);
4307 				cred = cr;
4308 				crhold(cred);
4309 				mutex_exit(&rp->r_statelock);
4310 				goto read_again;
4311 			}
4312 			mutex_exit(&rp->r_statelock);
4313 		}
4314 	} else {
4315 		if (!(rp->r_flags & RSTALE)) {
4316 			mutex_enter(&rp->r_statelock);
4317 			if (rp->r_cred != NULL) {
4318 				cred = rp->r_cred;
4319 				crhold(cred);
4320 			} else {
4321 				rp->r_cred = cr;
4322 				crhold(cr);
4323 				cred = cr;
4324 				crhold(cred);
4325 			}
4326 			mutex_exit(&rp->r_statelock);
4327 		write_again:
4328 			mutex_enter(&rp->r_statelock);
4329 			count = MIN(bp->b_bcount, rp->r_size - offset);
4330 			mutex_exit(&rp->r_statelock);
4331 			if (count < 0)
4332 				cmn_err(CE_PANIC, "nfs3_bio: write count < 0");
4333 #ifdef DEBUG
4334 			if (count == 0) {
4335 				zcmn_err(getzoneid(), CE_WARN,
4336 				    "nfs3_bio: zero length write at %lld",
4337 				    offset);
4338 				nfs_printfhandle(&rp->r_fh);
4339 				if (nfs3_bio_do_stop)
4340 					debug_enter("nfs3_bio");
4341 			}
4342 #endif
4343 			error = nfs3write(bp->b_vp, bp->b_un.b_addr, offset,
4344 			    count, cred, stab_comm);
4345 			if (error == EACCES) {
4346 				mutex_enter(&rp->r_statelock);
4347 				if (cred != cr) {
4348 					if (rp->r_cred != NULL)
4349 						crfree(rp->r_cred);
4350 					rp->r_cred = cr;
4351 					crhold(cr);
4352 					crfree(cred);
4353 					cred = cr;
4354 					crhold(cred);
4355 					mutex_exit(&rp->r_statelock);
4356 					goto write_again;
4357 				}
4358 				mutex_exit(&rp->r_statelock);
4359 			}
4360 			bp->b_error = error;
4361 			if (error && error != EINTR) {
4362 				/*
4363 				 * Don't print EDQUOT errors on the console.
4364 				 * Don't print asynchronous EACCES errors.
4365 				 * Don't print EFBIG errors.
4366 				 * Print all other write errors.
4367 				 */
4368 				if (error != EDQUOT && error != EFBIG &&
4369 				    (error != EACCES ||
4370 				    !(bp->b_flags & B_ASYNC)))
4371 					nfs_write_error(bp->b_vp, error, cred);
4372 				/*
4373 				 * Update r_error and r_flags as appropriate.
4374 				 * If the error was ESTALE, then mark the
4375 				 * rnode as not being writeable and save
4376 				 * the error status.  Otherwise, save any
4377 				 * errors which occur from asynchronous
4378 				 * page invalidations.  Any errors occurring
4379 				 * from other operations should be saved
4380 				 * by the caller.
4381 				 */
4382 				mutex_enter(&rp->r_statelock);
4383 				if (error == ESTALE) {
4384 					rp->r_flags |= RSTALE;
4385 					if (!rp->r_error)
4386 						rp->r_error = error;
4387 				} else if (!rp->r_error &&
4388 				    (bp->b_flags &
4389 				    (B_INVAL|B_FORCE|B_ASYNC)) ==
4390 				    (B_INVAL|B_FORCE|B_ASYNC)) {
4391 					rp->r_error = error;
4392 				}
4393 				mutex_exit(&rp->r_statelock);
4394 			}
4395 			crfree(cred);
4396 		} else
4397 			error = rp->r_error;
4398 	}
4399 
4400 	if (error != 0 && error != NFS_EOF)
4401 		bp->b_flags |= B_ERROR;
4402 
4403 	DTRACE_IO1(done, struct buf *, bp);
4404 
4405 	return (error);
4406 }
4407 
4408 /* ARGSUSED */
4409 static int
4410 nfs3_fid(vnode_t *vp, fid_t *fidp, caller_context_t *ct)
4411 {
4412 	rnode_t *rp;
4413 
4414 	if (nfs_zone() != VTOMI(vp)->mi_zone)
4415 		return (EIO);
4416 	rp = VTOR(vp);
4417 
4418 	if (fidp->fid_len < (ushort_t)rp->r_fh.fh_len) {
4419 		fidp->fid_len = rp->r_fh.fh_len;
4420 		return (ENOSPC);
4421 	}
4422 	fidp->fid_len = rp->r_fh.fh_len;
4423 	bcopy(rp->r_fh.fh_buf, fidp->fid_data, fidp->fid_len);
4424 	return (0);
4425 }
4426 
4427 /* ARGSUSED2 */
4428 static int
4429 nfs3_rwlock(vnode_t *vp, int write_lock, caller_context_t *ctp)
4430 {
4431 	rnode_t *rp = VTOR(vp);
4432 
4433 	if (!write_lock) {
4434 		(void) nfs_rw_enter_sig(&rp->r_rwlock, RW_READER, FALSE);
4435 		return (V_WRITELOCK_FALSE);
4436 	}
4437 
4438 	if ((rp->r_flags & RDIRECTIO) || (VTOMI(vp)->mi_flags & MI_DIRECTIO)) {
4439 		(void) nfs_rw_enter_sig(&rp->r_rwlock, RW_READER, FALSE);
4440 		if (rp->r_mapcnt == 0 && !vn_has_cached_data(vp))
4441 			return (V_WRITELOCK_FALSE);
4442 		nfs_rw_exit(&rp->r_rwlock);
4443 	}
4444 
4445 	(void) nfs_rw_enter_sig(&rp->r_rwlock, RW_WRITER, FALSE);
4446 	return (V_WRITELOCK_TRUE);
4447 }
4448 
4449 /* ARGSUSED */
4450 static void
4451 nfs3_rwunlock(vnode_t *vp, int write_lock, caller_context_t *ctp)
4452 {
4453 	rnode_t *rp = VTOR(vp);
4454 
4455 	nfs_rw_exit(&rp->r_rwlock);
4456 }
4457 
4458 /* ARGSUSED */
4459 static int
4460 nfs3_seek(vnode_t *vp, offset_t ooff, offset_t *noffp, caller_context_t *ct)
4461 {
4462 
4463 	/*
4464 	 * Because we stuff the readdir cookie into the offset field
4465 	 * someone may attempt to do an lseek with the cookie which
4466 	 * we want to succeed.
4467 	 */
4468 	if (vp->v_type == VDIR)
4469 		return (0);
4470 	if (*noffp < 0)
4471 		return (EINVAL);
4472 	return (0);
4473 }
4474 
4475 /*
4476  * number of nfs3_bsize blocks to read ahead.
4477  */
4478 static int nfs3_nra = 4;
4479 
4480 #ifdef DEBUG
4481 static int nfs3_lostpage = 0;	/* number of times we lost original page */
4482 #endif
4483 
4484 /*
4485  * Return all the pages from [off..off+len) in file
4486  */
4487 /* ARGSUSED */
4488 static int
4489 nfs3_getpage(vnode_t *vp, offset_t off, size_t len, uint_t *protp,
4490 	page_t *pl[], size_t plsz, struct seg *seg, caddr_t addr,
4491 	enum seg_rw rw, cred_t *cr, caller_context_t *ct)
4492 {
4493 	rnode_t *rp;
4494 	int error;
4495 	mntinfo_t *mi;
4496 
4497 	if (vp->v_flag & VNOMAP)
4498 		return (ENOSYS);
4499 
4500 	if (nfs_zone() != VTOMI(vp)->mi_zone)
4501 		return (EIO);
4502 	if (protp != NULL)
4503 		*protp = PROT_ALL;
4504 
4505 	/*
4506 	 * Now valididate that the caches are up to date.
4507 	 */
4508 	error = nfs3_validate_caches(vp, cr);
4509 	if (error)
4510 		return (error);
4511 
4512 	rp = VTOR(vp);
4513 	mi = VTOMI(vp);
4514 retry:
4515 	mutex_enter(&rp->r_statelock);
4516 
4517 	/*
4518 	 * Don't create dirty pages faster than they
4519 	 * can be cleaned so that the system doesn't
4520 	 * get imbalanced.  If the async queue is
4521 	 * maxed out, then wait for it to drain before
4522 	 * creating more dirty pages.  Also, wait for
4523 	 * any threads doing pagewalks in the vop_getattr
4524 	 * entry points so that they don't block for
4525 	 * long periods.
4526 	 */
4527 	if (rw == S_CREATE) {
4528 		while ((mi->mi_max_threads != 0 &&
4529 		    rp->r_awcount > 2 * mi->mi_max_threads) ||
4530 		    rp->r_gcount > 0)
4531 			cv_wait(&rp->r_cv, &rp->r_statelock);
4532 	}
4533 
4534 	/*
4535 	 * If we are getting called as a side effect of an nfs_write()
4536 	 * operation the local file size might not be extended yet.
4537 	 * In this case we want to be able to return pages of zeroes.
4538 	 */
4539 	if (off + len > rp->r_size + PAGEOFFSET && seg != segkmap) {
4540 		mutex_exit(&rp->r_statelock);
4541 		return (EFAULT);		/* beyond EOF */
4542 	}
4543 
4544 	mutex_exit(&rp->r_statelock);
4545 
4546 	if (len <= PAGESIZE) {
4547 		error = nfs3_getapage(vp, off, len, protp, pl, plsz,
4548 		    seg, addr, rw, cr);
4549 	} else {
4550 		error = pvn_getpages(nfs3_getapage, vp, off, len, protp,
4551 		    pl, plsz, seg, addr, rw, cr);
4552 	}
4553 
4554 	switch (error) {
4555 	case NFS_EOF:
4556 		nfs_purge_caches(vp, NFS_NOPURGE_DNLC, cr);
4557 		goto retry;
4558 	case ESTALE:
4559 		PURGE_STALE_FH(error, vp, cr);
4560 	}
4561 
4562 	return (error);
4563 }
4564 
4565 /*
4566  * Called from pvn_getpages or nfs3_getpage to get a particular page.
4567  */
4568 /* ARGSUSED */
4569 static int
4570 nfs3_getapage(vnode_t *vp, u_offset_t off, size_t len, uint_t *protp,
4571 	page_t *pl[], size_t plsz, struct seg *seg, caddr_t addr,
4572 	enum seg_rw rw, cred_t *cr)
4573 {
4574 	rnode_t *rp;
4575 	uint_t bsize;
4576 	struct buf *bp;
4577 	page_t *pp;
4578 	u_offset_t lbn;
4579 	u_offset_t io_off;
4580 	u_offset_t blkoff;
4581 	u_offset_t rablkoff;
4582 	size_t io_len;
4583 	uint_t blksize;
4584 	int error;
4585 	int readahead;
4586 	int readahead_issued = 0;
4587 	int ra_window; /* readahead window */
4588 	page_t *pagefound;
4589 	page_t *savepp;
4590 
4591 	if (nfs_zone() != VTOMI(vp)->mi_zone)
4592 		return (EIO);
4593 	rp = VTOR(vp);
4594 	bsize = MAX(vp->v_vfsp->vfs_bsize, PAGESIZE);
4595 
4596 reread:
4597 	bp = NULL;
4598 	pp = NULL;
4599 	pagefound = NULL;
4600 
4601 	if (pl != NULL)
4602 		pl[0] = NULL;
4603 
4604 	error = 0;
4605 	lbn = off / bsize;
4606 	blkoff = lbn * bsize;
4607 
4608 	/*
4609 	 * Queueing up the readahead before doing the synchronous read
4610 	 * results in a significant increase in read throughput because
4611 	 * of the increased parallelism between the async threads and
4612 	 * the process context.
4613 	 */
4614 	if ((off & ((vp->v_vfsp->vfs_bsize) - 1)) == 0 &&
4615 	    rw != S_CREATE &&
4616 	    !(vp->v_flag & VNOCACHE)) {
4617 		mutex_enter(&rp->r_statelock);
4618 
4619 		/*
4620 		 * Calculate the number of readaheads to do.
4621 		 * a) No readaheads at offset = 0.
4622 		 * b) Do maximum(nfs3_nra) readaheads when the readahead
4623 		 *    window is closed.
4624 		 * c) Do readaheads between 1 to (nfs3_nra - 1) depending
4625 		 *    upon how far the readahead window is open or close.
4626 		 * d) No readaheads if rp->r_nextr is not within the scope
4627 		 *    of the readahead window (random i/o).
4628 		 */
4629 
4630 		if (off == 0)
4631 			readahead = 0;
4632 		else if (blkoff == rp->r_nextr)
4633 			readahead = nfs3_nra;
4634 		else if (rp->r_nextr > blkoff &&
4635 		    ((ra_window = (rp->r_nextr - blkoff) / bsize)
4636 		    <= (nfs3_nra - 1)))
4637 			readahead = nfs3_nra - ra_window;
4638 		else
4639 			readahead = 0;
4640 
4641 		rablkoff = rp->r_nextr;
4642 		while (readahead > 0 && rablkoff + bsize < rp->r_size) {
4643 			mutex_exit(&rp->r_statelock);
4644 			if (nfs_async_readahead(vp, rablkoff + bsize,
4645 			    addr + (rablkoff + bsize - off), seg, cr,
4646 			    nfs3_readahead) < 0) {
4647 				mutex_enter(&rp->r_statelock);
4648 				break;
4649 			}
4650 			readahead--;
4651 			rablkoff += bsize;
4652 			/*
4653 			 * Indicate that we did a readahead so
4654 			 * readahead offset is not updated
4655 			 * by the synchronous read below.
4656 			 */
4657 			readahead_issued = 1;
4658 			mutex_enter(&rp->r_statelock);
4659 			/*
4660 			 * set readahead offset to
4661 			 * offset of last async readahead
4662 			 * request.
4663 			 */
4664 			rp->r_nextr = rablkoff;
4665 		}
4666 		mutex_exit(&rp->r_statelock);
4667 	}
4668 
4669 again:
4670 	if ((pagefound = page_exists(vp, off)) == NULL) {
4671 		if (pl == NULL) {
4672 			(void) nfs_async_readahead(vp, blkoff, addr, seg, cr,
4673 			    nfs3_readahead);
4674 		} else if (rw == S_CREATE) {
4675 			/*
4676 			 * Block for this page is not allocated, or the offset
4677 			 * is beyond the current allocation size, or we're
4678 			 * allocating a swap slot and the page was not found,
4679 			 * so allocate it and return a zero page.
4680 			 */
4681 			if ((pp = page_create_va(vp, off,
4682 			    PAGESIZE, PG_WAIT, seg, addr)) == NULL)
4683 				cmn_err(CE_PANIC, "nfs3_getapage: page_create");
4684 			io_len = PAGESIZE;
4685 			mutex_enter(&rp->r_statelock);
4686 			rp->r_nextr = off + PAGESIZE;
4687 			mutex_exit(&rp->r_statelock);
4688 		} else {
4689 			/*
4690 			 * Need to go to server to get a BLOCK, exception to
4691 			 * that being while reading at offset = 0 or doing
4692 			 * random i/o, in that case read only a PAGE.
4693 			 */
4694 			mutex_enter(&rp->r_statelock);
4695 			if (blkoff < rp->r_size &&
4696 			    blkoff + bsize >= rp->r_size) {
4697 				/*
4698 				 * If only a block or less is left in
4699 				 * the file, read all that is remaining.
4700 				 */
4701 				if (rp->r_size <= off) {
4702 					/*
4703 					 * Trying to access beyond EOF,
4704 					 * set up to get at least one page.
4705 					 */
4706 					blksize = off + PAGESIZE - blkoff;
4707 				} else
4708 					blksize = rp->r_size - blkoff;
4709 			} else if ((off == 0) ||
4710 			    (off != rp->r_nextr && !readahead_issued)) {
4711 				blksize = PAGESIZE;
4712 				blkoff = off; /* block = page here */
4713 			} else
4714 				blksize = bsize;
4715 			mutex_exit(&rp->r_statelock);
4716 
4717 			pp = pvn_read_kluster(vp, off, seg, addr, &io_off,
4718 			    &io_len, blkoff, blksize, 0);
4719 
4720 			/*
4721 			 * Some other thread has entered the page,
4722 			 * so just use it.
4723 			 */
4724 			if (pp == NULL)
4725 				goto again;
4726 
4727 			/*
4728 			 * Now round the request size up to page boundaries.
4729 			 * This ensures that the entire page will be
4730 			 * initialized to zeroes if EOF is encountered.
4731 			 */
4732 			io_len = ptob(btopr(io_len));
4733 
4734 			bp = pageio_setup(pp, io_len, vp, B_READ);
4735 			ASSERT(bp != NULL);
4736 
4737 			/*
4738 			 * pageio_setup should have set b_addr to 0.  This
4739 			 * is correct since we want to do I/O on a page
4740 			 * boundary.  bp_mapin will use this addr to calculate
4741 			 * an offset, and then set b_addr to the kernel virtual
4742 			 * address it allocated for us.
4743 			 */
4744 			ASSERT(bp->b_un.b_addr == 0);
4745 
4746 			bp->b_edev = 0;
4747 			bp->b_dev = 0;
4748 			bp->b_lblkno = lbtodb(io_off);
4749 			bp->b_file = vp;
4750 			bp->b_offset = (offset_t)off;
4751 			bp_mapin(bp);
4752 
4753 			/*
4754 			 * If doing a write beyond what we believe is EOF,
4755 			 * don't bother trying to read the pages from the
4756 			 * server, we'll just zero the pages here.  We
4757 			 * don't check that the rw flag is S_WRITE here
4758 			 * because some implementations may attempt a
4759 			 * read access to the buffer before copying data.
4760 			 */
4761 			mutex_enter(&rp->r_statelock);
4762 			if (io_off >= rp->r_size && seg == segkmap) {
4763 				mutex_exit(&rp->r_statelock);
4764 				bzero(bp->b_un.b_addr, io_len);
4765 			} else {
4766 				mutex_exit(&rp->r_statelock);
4767 				error = nfs3_bio(bp, NULL, cr);
4768 			}
4769 
4770 			/*
4771 			 * Unmap the buffer before freeing it.
4772 			 */
4773 			bp_mapout(bp);
4774 			pageio_done(bp);
4775 
4776 			savepp = pp;
4777 			do {
4778 				pp->p_fsdata = C_NOCOMMIT;
4779 			} while ((pp = pp->p_next) != savepp);
4780 
4781 			if (error == NFS_EOF) {
4782 				/*
4783 				 * If doing a write system call just return
4784 				 * zeroed pages, else user tried to get pages
4785 				 * beyond EOF, return error.  We don't check
4786 				 * that the rw flag is S_WRITE here because
4787 				 * some implementations may attempt a read
4788 				 * access to the buffer before copying data.
4789 				 */
4790 				if (seg == segkmap)
4791 					error = 0;
4792 				else
4793 					error = EFAULT;
4794 			}
4795 
4796 			if (!readahead_issued && !error) {
4797 				mutex_enter(&rp->r_statelock);
4798 				rp->r_nextr = io_off + io_len;
4799 				mutex_exit(&rp->r_statelock);
4800 			}
4801 		}
4802 	}
4803 
4804 out:
4805 	if (pl == NULL)
4806 		return (error);
4807 
4808 	if (error) {
4809 		if (pp != NULL)
4810 			pvn_read_done(pp, B_ERROR);
4811 		return (error);
4812 	}
4813 
4814 	if (pagefound) {
4815 		se_t se = (rw == S_CREATE ? SE_EXCL : SE_SHARED);
4816 
4817 		/*
4818 		 * Page exists in the cache, acquire the appropriate lock.
4819 		 * If this fails, start all over again.
4820 		 */
4821 		if ((pp = page_lookup(vp, off, se)) == NULL) {
4822 #ifdef DEBUG
4823 			nfs3_lostpage++;
4824 #endif
4825 			goto reread;
4826 		}
4827 		pl[0] = pp;
4828 		pl[1] = NULL;
4829 		return (0);
4830 	}
4831 
4832 	if (pp != NULL)
4833 		pvn_plist_init(pp, pl, plsz, off, io_len, rw);
4834 
4835 	return (error);
4836 }
4837 
4838 static void
4839 nfs3_readahead(vnode_t *vp, u_offset_t blkoff, caddr_t addr, struct seg *seg,
4840 	cred_t *cr)
4841 {
4842 	int error;
4843 	page_t *pp;
4844 	u_offset_t io_off;
4845 	size_t io_len;
4846 	struct buf *bp;
4847 	uint_t bsize, blksize;
4848 	rnode_t *rp = VTOR(vp);
4849 	page_t *savepp;
4850 
4851 	ASSERT(nfs_zone() == VTOMI(vp)->mi_zone);
4852 	bsize = MAX(vp->v_vfsp->vfs_bsize, PAGESIZE);
4853 
4854 	mutex_enter(&rp->r_statelock);
4855 	if (blkoff < rp->r_size && blkoff + bsize > rp->r_size) {
4856 		/*
4857 		 * If less than a block left in file read less
4858 		 * than a block.
4859 		 */
4860 		blksize = rp->r_size - blkoff;
4861 	} else
4862 		blksize = bsize;
4863 	mutex_exit(&rp->r_statelock);
4864 
4865 	pp = pvn_read_kluster(vp, blkoff, segkmap, addr,
4866 	    &io_off, &io_len, blkoff, blksize, 1);
4867 	/*
4868 	 * The isra flag passed to the kluster function is 1, we may have
4869 	 * gotten a return value of NULL for a variety of reasons (# of free
4870 	 * pages < minfree, someone entered the page on the vnode etc). In all
4871 	 * cases, we want to punt on the readahead.
4872 	 */
4873 	if (pp == NULL)
4874 		return;
4875 
4876 	/*
4877 	 * Now round the request size up to page boundaries.
4878 	 * This ensures that the entire page will be
4879 	 * initialized to zeroes if EOF is encountered.
4880 	 */
4881 	io_len = ptob(btopr(io_len));
4882 
4883 	bp = pageio_setup(pp, io_len, vp, B_READ);
4884 	ASSERT(bp != NULL);
4885 
4886 	/*
4887 	 * pageio_setup should have set b_addr to 0.  This is correct since
4888 	 * we want to do I/O on a page boundary. bp_mapin() will use this addr
4889 	 * to calculate an offset, and then set b_addr to the kernel virtual
4890 	 * address it allocated for us.
4891 	 */
4892 	ASSERT(bp->b_un.b_addr == 0);
4893 
4894 	bp->b_edev = 0;
4895 	bp->b_dev = 0;
4896 	bp->b_lblkno = lbtodb(io_off);
4897 	bp->b_file = vp;
4898 	bp->b_offset = (offset_t)blkoff;
4899 	bp_mapin(bp);
4900 
4901 	/*
4902 	 * If doing a write beyond what we believe is EOF, don't bother trying
4903 	 * to read the pages from the server, we'll just zero the pages here.
4904 	 * We don't check that the rw flag is S_WRITE here because some
4905 	 * implementations may attempt a read access to the buffer before
4906 	 * copying data.
4907 	 */
4908 	mutex_enter(&rp->r_statelock);
4909 	if (io_off >= rp->r_size && seg == segkmap) {
4910 		mutex_exit(&rp->r_statelock);
4911 		bzero(bp->b_un.b_addr, io_len);
4912 		error = 0;
4913 	} else {
4914 		mutex_exit(&rp->r_statelock);
4915 		error = nfs3_bio(bp, NULL, cr);
4916 		if (error == NFS_EOF)
4917 			error = 0;
4918 	}
4919 
4920 	/*
4921 	 * Unmap the buffer before freeing it.
4922 	 */
4923 	bp_mapout(bp);
4924 	pageio_done(bp);
4925 
4926 	savepp = pp;
4927 	do {
4928 		pp->p_fsdata = C_NOCOMMIT;
4929 	} while ((pp = pp->p_next) != savepp);
4930 
4931 	pvn_read_done(pp, error ? B_READ | B_ERROR : B_READ);
4932 
4933 	/*
4934 	 * In case of error set readahead offset
4935 	 * to the lowest offset.
4936 	 * pvn_read_done() calls VN_DISPOSE to destroy the pages
4937 	 */
4938 	if (error && rp->r_nextr > io_off) {
4939 		mutex_enter(&rp->r_statelock);
4940 		if (rp->r_nextr > io_off)
4941 			rp->r_nextr = io_off;
4942 		mutex_exit(&rp->r_statelock);
4943 	}
4944 }
4945 
4946 /*
4947  * Flags are composed of {B_INVAL, B_FREE, B_DONTNEED, B_FORCE}
4948  * If len == 0, do from off to EOF.
4949  *
4950  * The normal cases should be len == 0 && off == 0 (entire vp list),
4951  * len == MAXBSIZE (from segmap_release actions), and len == PAGESIZE
4952  * (from pageout).
4953  */
4954 /* ARGSUSED */
4955 static int
4956 nfs3_putpage(vnode_t *vp, offset_t off, size_t len, int flags, cred_t *cr,
4957 	caller_context_t *ct)
4958 {
4959 	int error;
4960 	rnode_t *rp;
4961 
4962 	ASSERT(cr != NULL);
4963 
4964 	/*
4965 	 * XXX - Why should this check be made here?
4966 	 */
4967 	if (vp->v_flag & VNOMAP)
4968 		return (ENOSYS);
4969 	if (len == 0 && !(flags & B_INVAL) && vn_is_readonly(vp))
4970 		return (0);
4971 	if (!(flags & B_ASYNC) && nfs_zone() != VTOMI(vp)->mi_zone)
4972 		return (EIO);
4973 
4974 	rp = VTOR(vp);
4975 	mutex_enter(&rp->r_statelock);
4976 	rp->r_count++;
4977 	mutex_exit(&rp->r_statelock);
4978 	error = nfs_putpages(vp, off, len, flags, cr);
4979 	mutex_enter(&rp->r_statelock);
4980 	rp->r_count--;
4981 	cv_broadcast(&rp->r_cv);
4982 	mutex_exit(&rp->r_statelock);
4983 
4984 	return (error);
4985 }
4986 
4987 /*
4988  * Write out a single page, possibly klustering adjacent dirty pages.
4989  */
4990 int
4991 nfs3_putapage(vnode_t *vp, page_t *pp, u_offset_t *offp, size_t *lenp,
4992 	int flags, cred_t *cr)
4993 {
4994 	u_offset_t io_off;
4995 	u_offset_t lbn_off;
4996 	u_offset_t lbn;
4997 	size_t io_len;
4998 	uint_t bsize;
4999 	int error;
5000 	rnode_t *rp;
5001 
5002 	ASSERT(!vn_is_readonly(vp));
5003 	ASSERT(pp != NULL);
5004 	ASSERT(cr != NULL);
5005 	ASSERT((flags & B_ASYNC) || nfs_zone() == VTOMI(vp)->mi_zone);
5006 
5007 	rp = VTOR(vp);
5008 	ASSERT(rp->r_count > 0);
5009 
5010 	bsize = MAX(vp->v_vfsp->vfs_bsize, PAGESIZE);
5011 	lbn = pp->p_offset / bsize;
5012 	lbn_off = lbn * bsize;
5013 
5014 	/*
5015 	 * Find a kluster that fits in one block, or in
5016 	 * one page if pages are bigger than blocks.  If
5017 	 * there is less file space allocated than a whole
5018 	 * page, we'll shorten the i/o request below.
5019 	 */
5020 	pp = pvn_write_kluster(vp, pp, &io_off, &io_len, lbn_off,
5021 	    roundup(bsize, PAGESIZE), flags);
5022 
5023 	/*
5024 	 * pvn_write_kluster shouldn't have returned a page with offset
5025 	 * behind the original page we were given.  Verify that.
5026 	 */
5027 	ASSERT((pp->p_offset / bsize) >= lbn);
5028 
5029 	/*
5030 	 * Now pp will have the list of kept dirty pages marked for
5031 	 * write back.  It will also handle invalidation and freeing
5032 	 * of pages that are not dirty.  Check for page length rounding
5033 	 * problems.
5034 	 */
5035 	if (io_off + io_len > lbn_off + bsize) {
5036 		ASSERT((io_off + io_len) - (lbn_off + bsize) < PAGESIZE);
5037 		io_len = lbn_off + bsize - io_off;
5038 	}
5039 	/*
5040 	 * The RMODINPROGRESS flag makes sure that nfs(3)_bio() sees a
5041 	 * consistent value of r_size. RMODINPROGRESS is set in writerp().
5042 	 * When RMODINPROGRESS is set it indicates that a uiomove() is in
5043 	 * progress and the r_size has not been made consistent with the
5044 	 * new size of the file. When the uiomove() completes the r_size is
5045 	 * updated and the RMODINPROGRESS flag is cleared.
5046 	 *
5047 	 * The RMODINPROGRESS flag makes sure that nfs(3)_bio() sees a
5048 	 * consistent value of r_size. Without this handshaking, it is
5049 	 * possible that nfs(3)_bio() picks  up the old value of r_size
5050 	 * before the uiomove() in writerp() completes. This will result
5051 	 * in the write through nfs(3)_bio() being dropped.
5052 	 *
5053 	 * More precisely, there is a window between the time the uiomove()
5054 	 * completes and the time the r_size is updated. If a VOP_PUTPAGE()
5055 	 * operation intervenes in this window, the page will be picked up,
5056 	 * because it is dirty (it will be unlocked, unless it was
5057 	 * pagecreate'd). When the page is picked up as dirty, the dirty
5058 	 * bit is reset (pvn_getdirty()). In nfs(3)write(), r_size is
5059 	 * checked. This will still be the old size. Therefore the page will
5060 	 * not be written out. When segmap_release() calls VOP_PUTPAGE(),
5061 	 * the page will be found to be clean and the write will be dropped.
5062 	 */
5063 	if (rp->r_flags & RMODINPROGRESS) {
5064 		mutex_enter(&rp->r_statelock);
5065 		if ((rp->r_flags & RMODINPROGRESS) &&
5066 		    rp->r_modaddr + MAXBSIZE > io_off &&
5067 		    rp->r_modaddr < io_off + io_len) {
5068 			page_t *plist;
5069 			/*
5070 			 * A write is in progress for this region of the file.
5071 			 * If we did not detect RMODINPROGRESS here then this
5072 			 * path through nfs_putapage() would eventually go to
5073 			 * nfs(3)_bio() and may not write out all of the data
5074 			 * in the pages. We end up losing data. So we decide
5075 			 * to set the modified bit on each page in the page
5076 			 * list and mark the rnode with RDIRTY. This write
5077 			 * will be restarted at some later time.
5078 			 */
5079 			plist = pp;
5080 			while (plist != NULL) {
5081 				pp = plist;
5082 				page_sub(&plist, pp);
5083 				hat_setmod(pp);
5084 				page_io_unlock(pp);
5085 				page_unlock(pp);
5086 			}
5087 			rp->r_flags |= RDIRTY;
5088 			mutex_exit(&rp->r_statelock);
5089 			if (offp)
5090 				*offp = io_off;
5091 			if (lenp)
5092 				*lenp = io_len;
5093 			return (0);
5094 		}
5095 		mutex_exit(&rp->r_statelock);
5096 	}
5097 
5098 	if (flags & B_ASYNC) {
5099 		error = nfs_async_putapage(vp, pp, io_off, io_len, flags, cr,
5100 		    nfs3_sync_putapage);
5101 	} else
5102 		error = nfs3_sync_putapage(vp, pp, io_off, io_len, flags, cr);
5103 
5104 	if (offp)
5105 		*offp = io_off;
5106 	if (lenp)
5107 		*lenp = io_len;
5108 	return (error);
5109 }
5110 
5111 static int
5112 nfs3_sync_putapage(vnode_t *vp, page_t *pp, u_offset_t io_off, size_t io_len,
5113 	int flags, cred_t *cr)
5114 {
5115 	int error;
5116 	rnode_t *rp;
5117 
5118 	ASSERT(nfs_zone() == VTOMI(vp)->mi_zone);
5119 
5120 	flags |= B_WRITE;
5121 
5122 	error = nfs3_rdwrlbn(vp, pp, io_off, io_len, flags, cr);
5123 
5124 	rp = VTOR(vp);
5125 
5126 	if ((error == ENOSPC || error == EDQUOT || error == EFBIG ||
5127 	    error == EACCES) &&
5128 	    (flags & (B_INVAL|B_FORCE)) != (B_INVAL|B_FORCE)) {
5129 		if (!(rp->r_flags & ROUTOFSPACE)) {
5130 			mutex_enter(&rp->r_statelock);
5131 			rp->r_flags |= ROUTOFSPACE;
5132 			mutex_exit(&rp->r_statelock);
5133 		}
5134 		flags |= B_ERROR;
5135 		pvn_write_done(pp, flags);
5136 		/*
5137 		 * If this was not an async thread, then try again to
5138 		 * write out the pages, but this time, also destroy
5139 		 * them whether or not the write is successful.  This
5140 		 * will prevent memory from filling up with these
5141 		 * pages and destroying them is the only alternative
5142 		 * if they can't be written out.
5143 		 *
5144 		 * Don't do this if this is an async thread because
5145 		 * when the pages are unlocked in pvn_write_done,
5146 		 * some other thread could have come along, locked
5147 		 * them, and queued for an async thread.  It would be
5148 		 * possible for all of the async threads to be tied
5149 		 * up waiting to lock the pages again and they would
5150 		 * all already be locked and waiting for an async
5151 		 * thread to handle them.  Deadlock.
5152 		 */
5153 		if (!(flags & B_ASYNC)) {
5154 			error = nfs3_putpage(vp, io_off, io_len,
5155 			    B_INVAL | B_FORCE, cr, NULL);
5156 		}
5157 	} else {
5158 		if (error)
5159 			flags |= B_ERROR;
5160 		else if (rp->r_flags & ROUTOFSPACE) {
5161 			mutex_enter(&rp->r_statelock);
5162 			rp->r_flags &= ~ROUTOFSPACE;
5163 			mutex_exit(&rp->r_statelock);
5164 		}
5165 		pvn_write_done(pp, flags);
5166 		if (freemem < desfree)
5167 			(void) nfs3_commit_vp(vp, (u_offset_t)0, 0, cr);
5168 	}
5169 
5170 	return (error);
5171 }
5172 
5173 /* ARGSUSED */
5174 static int
5175 nfs3_map(vnode_t *vp, offset_t off, struct as *as, caddr_t *addrp,
5176 	size_t len, uchar_t prot, uchar_t maxprot, uint_t flags,
5177 	cred_t *cr, caller_context_t *ct)
5178 {
5179 	struct segvn_crargs vn_a;
5180 	int error;
5181 	rnode_t *rp;
5182 	struct vattr va;
5183 
5184 	if (nfs_zone() != VTOMI(vp)->mi_zone)
5185 		return (EIO);
5186 
5187 	if (vp->v_flag & VNOMAP)
5188 		return (ENOSYS);
5189 
5190 	if (off < 0 || off + len < 0)
5191 		return (ENXIO);
5192 
5193 	if (vp->v_type != VREG)
5194 		return (ENODEV);
5195 
5196 	/*
5197 	 * If there is cached data and if close-to-open consistency
5198 	 * checking is not turned off and if the file system is not
5199 	 * mounted readonly, then force an over the wire getattr.
5200 	 * Otherwise, just invoke nfs3getattr to get a copy of the
5201 	 * attributes.  The attribute cache will be used unless it
5202 	 * is timed out and if it is, then an over the wire getattr
5203 	 * will be issued.
5204 	 */
5205 	va.va_mask = AT_ALL;
5206 	if (vn_has_cached_data(vp) &&
5207 	    !(VTOMI(vp)->mi_flags & MI_NOCTO) && !vn_is_readonly(vp))
5208 		error = nfs3_getattr_otw(vp, &va, cr);
5209 	else
5210 		error = nfs3getattr(vp, &va, cr);
5211 	if (error)
5212 		return (error);
5213 
5214 	/*
5215 	 * Check to see if the vnode is currently marked as not cachable.
5216 	 * This means portions of the file are locked (through VOP_FRLOCK).
5217 	 * In this case the map request must be refused.  We use
5218 	 * rp->r_lkserlock to avoid a race with concurrent lock requests.
5219 	 */
5220 	rp = VTOR(vp);
5221 
5222 	/*
5223 	 * Atomically increment r_inmap after acquiring r_rwlock. The
5224 	 * idea here is to acquire r_rwlock to block read/write and
5225 	 * not to protect r_inmap. r_inmap will inform nfs3_read/write()
5226 	 * that we are in nfs3_map(). Now, r_rwlock is acquired in order
5227 	 * and we can prevent the deadlock that would have occurred
5228 	 * when nfs3_addmap() would have acquired it out of order.
5229 	 *
5230 	 * Since we are not protecting r_inmap by any lock, we do not
5231 	 * hold any lock when we decrement it. We atomically decrement
5232 	 * r_inmap after we release r_lkserlock.
5233 	 */
5234 
5235 	if (nfs_rw_enter_sig(&rp->r_rwlock, RW_WRITER, INTR(vp)))
5236 		return (EINTR);
5237 	atomic_add_int(&rp->r_inmap, 1);
5238 	nfs_rw_exit(&rp->r_rwlock);
5239 
5240 	if (nfs_rw_enter_sig(&rp->r_lkserlock, RW_READER, INTR(vp))) {
5241 		atomic_add_int(&rp->r_inmap, -1);
5242 		return (EINTR);
5243 	}
5244 
5245 	if (vp->v_flag & VNOCACHE) {
5246 		error = EAGAIN;
5247 		goto done;
5248 	}
5249 
5250 	/*
5251 	 * Don't allow concurrent locks and mapping if mandatory locking is
5252 	 * enabled.
5253 	 */
5254 	if ((flk_has_remote_locks(vp) || lm_has_sleep(vp)) &&
5255 	    MANDLOCK(vp, va.va_mode)) {
5256 		error = EAGAIN;
5257 		goto done;
5258 	}
5259 
5260 	as_rangelock(as);
5261 	error = choose_addr(as, addrp, len, off, ADDR_VACALIGN, flags);
5262 	if (error != 0) {
5263 		as_rangeunlock(as);
5264 		goto done;
5265 	}
5266 
5267 	vn_a.vp = vp;
5268 	vn_a.offset = off;
5269 	vn_a.type = (flags & MAP_TYPE);
5270 	vn_a.prot = (uchar_t)prot;
5271 	vn_a.maxprot = (uchar_t)maxprot;
5272 	vn_a.flags = (flags & ~MAP_TYPE);
5273 	vn_a.cred = cr;
5274 	vn_a.amp = NULL;
5275 	vn_a.szc = 0;
5276 	vn_a.lgrp_mem_policy_flags = 0;
5277 
5278 	error = as_map(as, *addrp, len, segvn_create, &vn_a);
5279 	as_rangeunlock(as);
5280 
5281 done:
5282 	nfs_rw_exit(&rp->r_lkserlock);
5283 	atomic_add_int(&rp->r_inmap, -1);
5284 	return (error);
5285 }
5286 
5287 /* ARGSUSED */
5288 static int
5289 nfs3_addmap(vnode_t *vp, offset_t off, struct as *as, caddr_t addr,
5290 	size_t len, uchar_t prot, uchar_t maxprot, uint_t flags,
5291 	cred_t *cr, caller_context_t *ct)
5292 {
5293 	rnode_t *rp;
5294 
5295 	if (vp->v_flag & VNOMAP)
5296 		return (ENOSYS);
5297 	if (nfs_zone() != VTOMI(vp)->mi_zone)
5298 		return (EIO);
5299 
5300 	rp = VTOR(vp);
5301 	atomic_add_long((ulong_t *)&rp->r_mapcnt, btopr(len));
5302 
5303 	return (0);
5304 }
5305 
5306 /* ARGSUSED */
5307 static int
5308 nfs3_frlock(vnode_t *vp, int cmd, struct flock64 *bfp, int flag,
5309 	offset_t offset, struct flk_callback *flk_cbp, cred_t *cr,
5310 	caller_context_t *ct)
5311 {
5312 	netobj lm_fh3;
5313 	int rc;
5314 	u_offset_t start, end;
5315 	rnode_t *rp;
5316 	int error = 0, intr = INTR(vp);
5317 
5318 	if (nfs_zone() != VTOMI(vp)->mi_zone)
5319 		return (EIO);
5320 	/* check for valid cmd parameter */
5321 	if (cmd != F_GETLK && cmd != F_SETLK && cmd != F_SETLKW)
5322 		return (EINVAL);
5323 
5324 	/* Verify l_type. */
5325 	switch (bfp->l_type) {
5326 	case F_RDLCK:
5327 		if (cmd != F_GETLK && !(flag & FREAD))
5328 			return (EBADF);
5329 		break;
5330 	case F_WRLCK:
5331 		if (cmd != F_GETLK && !(flag & FWRITE))
5332 			return (EBADF);
5333 		break;
5334 	case F_UNLCK:
5335 		intr = 0;
5336 		break;
5337 
5338 	default:
5339 		return (EINVAL);
5340 	}
5341 
5342 	/* check the validity of the lock range */
5343 	if (rc = flk_convert_lock_data(vp, bfp, &start, &end, offset))
5344 		return (rc);
5345 	if (rc = flk_check_lock_data(start, end, MAXEND))
5346 		return (rc);
5347 
5348 	/*
5349 	 * If the filesystem is mounted using local locking, pass the
5350 	 * request off to the local locking code.
5351 	 */
5352 	if (VTOMI(vp)->mi_flags & MI_LLOCK) {
5353 		if (cmd == F_SETLK || cmd == F_SETLKW) {
5354 			/*
5355 			 * For complete safety, we should be holding
5356 			 * r_lkserlock.  However, we can't call
5357 			 * lm_safelock and then fs_frlock while
5358 			 * holding r_lkserlock, so just invoke
5359 			 * lm_safelock and expect that this will
5360 			 * catch enough of the cases.
5361 			 */
5362 			if (!lm_safelock(vp, bfp, cr))
5363 				return (EAGAIN);
5364 		}
5365 		return (fs_frlock(vp, cmd, bfp, flag, offset, flk_cbp, cr, ct));
5366 	}
5367 
5368 	rp = VTOR(vp);
5369 
5370 	/*
5371 	 * Check whether the given lock request can proceed, given the
5372 	 * current file mappings.
5373 	 */
5374 	if (nfs_rw_enter_sig(&rp->r_lkserlock, RW_WRITER, intr))
5375 		return (EINTR);
5376 	if (cmd == F_SETLK || cmd == F_SETLKW) {
5377 		if (!lm_safelock(vp, bfp, cr)) {
5378 			rc = EAGAIN;
5379 			goto done;
5380 		}
5381 	}
5382 
5383 	/*
5384 	 * Flush the cache after waiting for async I/O to finish.  For new
5385 	 * locks, this is so that the process gets the latest bits from the
5386 	 * server.  For unlocks, this is so that other clients see the
5387 	 * latest bits once the file has been unlocked.  If currently dirty
5388 	 * pages can't be flushed, then don't allow a lock to be set.  But
5389 	 * allow unlocks to succeed, to avoid having orphan locks on the
5390 	 * server.
5391 	 */
5392 	if (cmd != F_GETLK) {
5393 		mutex_enter(&rp->r_statelock);
5394 		while (rp->r_count > 0) {
5395 			if (intr) {
5396 				klwp_t *lwp = ttolwp(curthread);
5397 
5398 				if (lwp != NULL)
5399 					lwp->lwp_nostop++;
5400 				if (cv_wait_sig(&rp->r_cv,
5401 				    &rp->r_statelock) == 0) {
5402 					if (lwp != NULL)
5403 						lwp->lwp_nostop--;
5404 					rc = EINTR;
5405 					break;
5406 				}
5407 				if (lwp != NULL)
5408 					lwp->lwp_nostop--;
5409 			} else
5410 				cv_wait(&rp->r_cv, &rp->r_statelock);
5411 		}
5412 		mutex_exit(&rp->r_statelock);
5413 		if (rc != 0)
5414 			goto done;
5415 		error = nfs3_putpage(vp, (offset_t)0, 0, B_INVAL, cr, ct);
5416 		if (error) {
5417 			if (error == ENOSPC || error == EDQUOT) {
5418 				mutex_enter(&rp->r_statelock);
5419 				if (!rp->r_error)
5420 					rp->r_error = error;
5421 				mutex_exit(&rp->r_statelock);
5422 			}
5423 			if (bfp->l_type != F_UNLCK) {
5424 				rc = ENOLCK;
5425 				goto done;
5426 			}
5427 		}
5428 	}
5429 
5430 	lm_fh3.n_len = VTOFH3(vp)->fh3_length;
5431 	lm_fh3.n_bytes = (char *)&(VTOFH3(vp)->fh3_u.data);
5432 
5433 	/*
5434 	 * Call the lock manager to do the real work of contacting
5435 	 * the server and obtaining the lock.
5436 	 */
5437 	rc = lm4_frlock(vp, cmd, bfp, flag, offset, cr, &lm_fh3, flk_cbp);
5438 
5439 	if (rc == 0)
5440 		nfs_lockcompletion(vp, cmd);
5441 
5442 done:
5443 	nfs_rw_exit(&rp->r_lkserlock);
5444 	return (rc);
5445 }
5446 
5447 /*
5448  * Free storage space associated with the specified vnode.  The portion
5449  * to be freed is specified by bfp->l_start and bfp->l_len (already
5450  * normalized to a "whence" of 0).
5451  *
5452  * This is an experimental facility whose continued existence is not
5453  * guaranteed.  Currently, we only support the special case
5454  * of l_len == 0, meaning free to end of file.
5455  */
5456 /* ARGSUSED */
5457 static int
5458 nfs3_space(vnode_t *vp, int cmd, struct flock64 *bfp, int flag,
5459 	offset_t offset, cred_t *cr, caller_context_t *ct)
5460 {
5461 	int error;
5462 
5463 	ASSERT(vp->v_type == VREG);
5464 	if (cmd != F_FREESP)
5465 		return (EINVAL);
5466 	if (nfs_zone() != VTOMI(vp)->mi_zone)
5467 		return (EIO);
5468 
5469 	error = convoff(vp, bfp, 0, offset);
5470 	if (!error) {
5471 		ASSERT(bfp->l_start >= 0);
5472 		if (bfp->l_len == 0) {
5473 			struct vattr va;
5474 
5475 			/*
5476 			 * ftruncate should not change the ctime and
5477 			 * mtime if we truncate the file to its
5478 			 * previous size.
5479 			 */
5480 			va.va_mask = AT_SIZE;
5481 			error = nfs3getattr(vp, &va, cr);
5482 			if (error || va.va_size == bfp->l_start)
5483 				return (error);
5484 			va.va_mask = AT_SIZE;
5485 			va.va_size = bfp->l_start;
5486 			error = nfs3setattr(vp, &va, 0, cr);
5487 		} else
5488 			error = EINVAL;
5489 	}
5490 
5491 	return (error);
5492 }
5493 
5494 /* ARGSUSED */
5495 static int
5496 nfs3_realvp(vnode_t *vp, vnode_t **vpp, caller_context_t *ct)
5497 {
5498 
5499 	return (EINVAL);
5500 }
5501 
5502 /*
5503  * Setup and add an address space callback to do the work of the delmap call.
5504  * The callback will (and must be) deleted in the actual callback function.
5505  *
5506  * This is done in order to take care of the problem that we have with holding
5507  * the address space's a_lock for a long period of time (e.g. if the NFS server
5508  * is down).  Callbacks will be executed in the address space code while the
5509  * a_lock is not held.	Holding the address space's a_lock causes things such
5510  * as ps and fork to hang because they are trying to acquire this lock as well.
5511  */
5512 /* ARGSUSED */
5513 static int
5514 nfs3_delmap(vnode_t *vp, offset_t off, struct as *as, caddr_t addr,
5515 	size_t len, uint_t prot, uint_t maxprot, uint_t flags,
5516 	cred_t *cr, caller_context_t *ct)
5517 {
5518 	int			caller_found;
5519 	int			error;
5520 	rnode_t			*rp;
5521 	nfs_delmap_args_t	*dmapp;
5522 	nfs_delmapcall_t	*delmap_call;
5523 
5524 	if (vp->v_flag & VNOMAP)
5525 		return (ENOSYS);
5526 	/*
5527 	 * A process may not change zones if it has NFS pages mmap'ed
5528 	 * in, so we can't legitimately get here from the wrong zone.
5529 	 */
5530 	ASSERT(nfs_zone() == VTOMI(vp)->mi_zone);
5531 
5532 	rp = VTOR(vp);
5533 
5534 	/*
5535 	 * The way that the address space of this process deletes its mapping
5536 	 * of this file is via the following call chains:
5537 	 * - as_free()->SEGOP_UNMAP()/segvn_unmap()->VOP_DELMAP()/nfs3_delmap()
5538 	 * - as_unmap()->SEGOP_UNMAP()/segvn_unmap()->VOP_DELMAP()/nfs3_delmap()
5539 	 *
5540 	 * With the use of address space callbacks we are allowed to drop the
5541 	 * address space lock, a_lock, while executing the NFS operations that
5542 	 * need to go over the wire.  Returning EAGAIN to the caller of this
5543 	 * function is what drives the execution of the callback that we add
5544 	 * below.  The callback will be executed by the address space code
5545 	 * after dropping the a_lock.  When the callback is finished, since
5546 	 * we dropped the a_lock, it must be re-acquired and segvn_unmap()
5547 	 * is called again on the same segment to finish the rest of the work
5548 	 * that needs to happen during unmapping.
5549 	 *
5550 	 * This action of calling back into the segment driver causes
5551 	 * nfs3_delmap() to get called again, but since the callback was
5552 	 * already executed at this point, it already did the work and there
5553 	 * is nothing left for us to do.
5554 	 *
5555 	 * To Summarize:
5556 	 * - The first time nfs3_delmap is called by the current thread is when
5557 	 * we add the caller associated with this delmap to the delmap caller
5558 	 * list, add the callback, and return EAGAIN.
5559 	 * - The second time in this call chain when nfs3_delmap is called we
5560 	 * will find this caller in the delmap caller list and realize there
5561 	 * is no more work to do thus removing this caller from the list and
5562 	 * returning the error that was set in the callback execution.
5563 	 */
5564 	caller_found = nfs_find_and_delete_delmapcall(rp, &error);
5565 	if (caller_found) {
5566 		/*
5567 		 * 'error' is from the actual delmap operations.  To avoid
5568 		 * hangs, we need to handle the return of EAGAIN differently
5569 		 * since this is what drives the callback execution.
5570 		 * In this case, we don't want to return EAGAIN and do the
5571 		 * callback execution because there are none to execute.
5572 		 */
5573 		if (error == EAGAIN)
5574 			return (0);
5575 		else
5576 			return (error);
5577 	}
5578 
5579 	/* current caller was not in the list */
5580 	delmap_call = nfs_init_delmapcall();
5581 
5582 	mutex_enter(&rp->r_statelock);
5583 	list_insert_tail(&rp->r_indelmap, delmap_call);
5584 	mutex_exit(&rp->r_statelock);
5585 
5586 	dmapp = kmem_alloc(sizeof (nfs_delmap_args_t), KM_SLEEP);
5587 
5588 	dmapp->vp = vp;
5589 	dmapp->off = off;
5590 	dmapp->addr = addr;
5591 	dmapp->len = len;
5592 	dmapp->prot = prot;
5593 	dmapp->maxprot = maxprot;
5594 	dmapp->flags = flags;
5595 	dmapp->cr = cr;
5596 	dmapp->caller = delmap_call;
5597 
5598 	error = as_add_callback(as, nfs3_delmap_callback, dmapp,
5599 	    AS_UNMAP_EVENT, addr, len, KM_SLEEP);
5600 
5601 	return (error ? error : EAGAIN);
5602 }
5603 
5604 /*
5605  * Remove some pages from an mmap'd vnode.  Just update the
5606  * count of pages.  If doing close-to-open, then flush and
5607  * commit all of the pages associated with this file.
5608  * Otherwise, start an asynchronous page flush to write out
5609  * any dirty pages.  This will also associate a credential
5610  * with the rnode which can be used to write the pages.
5611  */
5612 /* ARGSUSED */
5613 static void
5614 nfs3_delmap_callback(struct as *as, void *arg, uint_t event)
5615 {
5616 	int			error;
5617 	rnode_t			*rp;
5618 	mntinfo_t		*mi;
5619 	nfs_delmap_args_t	*dmapp = (nfs_delmap_args_t *)arg;
5620 
5621 	rp = VTOR(dmapp->vp);
5622 	mi = VTOMI(dmapp->vp);
5623 
5624 	atomic_add_long((ulong_t *)&rp->r_mapcnt, -btopr(dmapp->len));
5625 	ASSERT(rp->r_mapcnt >= 0);
5626 
5627 	/*
5628 	 * Initiate a page flush and potential commit if there are
5629 	 * pages, the file system was not mounted readonly, the segment
5630 	 * was mapped shared, and the pages themselves were writeable.
5631 	 */
5632 	if (vn_has_cached_data(dmapp->vp) && !vn_is_readonly(dmapp->vp) &&
5633 	    dmapp->flags == MAP_SHARED && (dmapp->maxprot & PROT_WRITE)) {
5634 		mutex_enter(&rp->r_statelock);
5635 		rp->r_flags |= RDIRTY;
5636 		mutex_exit(&rp->r_statelock);
5637 		/*
5638 		 * If this is a cross-zone access a sync putpage won't work, so
5639 		 * the best we can do is try an async putpage.  That seems
5640 		 * better than something more draconian such as discarding the
5641 		 * dirty pages.
5642 		 */
5643 		if ((mi->mi_flags & MI_NOCTO) ||
5644 		    nfs_zone() != mi->mi_zone)
5645 			error = nfs3_putpage(dmapp->vp, dmapp->off, dmapp->len,
5646 			    B_ASYNC, dmapp->cr, NULL);
5647 		else
5648 			error = nfs3_putpage_commit(dmapp->vp, dmapp->off,
5649 			    dmapp->len, dmapp->cr);
5650 		if (!error) {
5651 			mutex_enter(&rp->r_statelock);
5652 			error = rp->r_error;
5653 			rp->r_error = 0;
5654 			mutex_exit(&rp->r_statelock);
5655 		}
5656 	} else
5657 		error = 0;
5658 
5659 	if ((rp->r_flags & RDIRECTIO) || (mi->mi_flags & MI_DIRECTIO))
5660 		(void) nfs3_putpage(dmapp->vp, dmapp->off, dmapp->len,
5661 		    B_INVAL, dmapp->cr, NULL);
5662 
5663 	dmapp->caller->error = error;
5664 	(void) as_delete_callback(as, arg);
5665 	kmem_free(dmapp, sizeof (nfs_delmap_args_t));
5666 }
5667 
5668 static int nfs3_pathconf_disable_cache = 0;
5669 
5670 #ifdef DEBUG
5671 static int nfs3_pathconf_cache_hits = 0;
5672 static int nfs3_pathconf_cache_misses = 0;
5673 #endif
5674 
5675 /* ARGSUSED */
5676 static int
5677 nfs3_pathconf(vnode_t *vp, int cmd, ulong_t *valp, cred_t *cr,
5678 	caller_context_t *ct)
5679 {
5680 	int error;
5681 	PATHCONF3args args;
5682 	PATHCONF3res res;
5683 	int douprintf;
5684 	failinfo_t fi;
5685 	rnode_t *rp;
5686 	hrtime_t t;
5687 
5688 	if (nfs_zone() != VTOMI(vp)->mi_zone)
5689 		return (EIO);
5690 	/*
5691 	 * Large file spec - need to base answer on info stored
5692 	 * on original FSINFO response.
5693 	 */
5694 	if (cmd == _PC_FILESIZEBITS) {
5695 		unsigned long long ll;
5696 		long l = 1;
5697 
5698 		ll = VTOMI(vp)->mi_maxfilesize;
5699 
5700 		if (ll == 0) {
5701 			*valp = 0;
5702 			return (0);
5703 		}
5704 
5705 		if (ll & 0xffffffff00000000) {
5706 			l += 32; ll >>= 32;
5707 		}
5708 		if (ll & 0xffff0000) {
5709 			l += 16; ll >>= 16;
5710 		}
5711 		if (ll & 0xff00) {
5712 			l += 8; ll >>= 8;
5713 		}
5714 		if (ll & 0xf0) {
5715 			l += 4; ll >>= 4;
5716 		}
5717 		if (ll & 0xc) {
5718 			l += 2; ll >>= 2;
5719 		}
5720 		if (ll & 0x2)
5721 			l += 2;
5722 		else if (ll & 0x1)
5723 			l += 1;
5724 		*valp = l;
5725 		return (0);
5726 	}
5727 
5728 	if (cmd == _PC_ACL_ENABLED) {
5729 		*valp = _ACL_ACLENT_ENABLED;
5730 		return (0);
5731 	}
5732 
5733 	if (cmd == _PC_XATTR_EXISTS) {
5734 		error = 0;
5735 		*valp = 0;
5736 		if (vp->v_vfsp->vfs_flag & VFS_XATTR) {
5737 			vnode_t *avp;
5738 			rnode_t *rp;
5739 			int error = 0;
5740 			mntinfo_t *mi = VTOMI(vp);
5741 
5742 			if (!(mi->mi_flags & MI_EXTATTR))
5743 				return (0);
5744 
5745 			rp = VTOR(vp);
5746 			if (nfs_rw_enter_sig(&rp->r_rwlock, RW_READER,
5747 			    INTR(vp)))
5748 				return (EINTR);
5749 
5750 			error = nfs3lookup_dnlc(vp, XATTR_DIR_NAME, &avp, cr);
5751 			if (error || avp == NULL)
5752 				error = acl_getxattrdir3(vp, &avp, 0, cr, 0);
5753 
5754 			nfs_rw_exit(&rp->r_rwlock);
5755 
5756 			if (error == 0 && avp != NULL) {
5757 				error = do_xattr_exists_check(avp, valp, cr);
5758 				VN_RELE(avp);
5759 			} else if (error == ENOENT) {
5760 				error = 0;
5761 				*valp = 0;
5762 			}
5763 		}
5764 		return (error);
5765 	}
5766 
5767 	rp = VTOR(vp);
5768 	if (rp->r_pathconf != NULL) {
5769 		mutex_enter(&rp->r_statelock);
5770 		if (rp->r_pathconf != NULL && nfs3_pathconf_disable_cache) {
5771 			kmem_free(rp->r_pathconf, sizeof (*rp->r_pathconf));
5772 			rp->r_pathconf = NULL;
5773 		}
5774 		if (rp->r_pathconf != NULL) {
5775 			error = 0;
5776 			switch (cmd) {
5777 			case _PC_LINK_MAX:
5778 				*valp = rp->r_pathconf->link_max;
5779 				break;
5780 			case _PC_NAME_MAX:
5781 				*valp = rp->r_pathconf->name_max;
5782 				break;
5783 			case _PC_PATH_MAX:
5784 			case _PC_SYMLINK_MAX:
5785 				*valp = MAXPATHLEN;
5786 				break;
5787 			case _PC_CHOWN_RESTRICTED:
5788 				*valp = rp->r_pathconf->chown_restricted;
5789 				break;
5790 			case _PC_NO_TRUNC:
5791 				*valp = rp->r_pathconf->no_trunc;
5792 				break;
5793 			default:
5794 				error = EINVAL;
5795 				break;
5796 			}
5797 			mutex_exit(&rp->r_statelock);
5798 #ifdef DEBUG
5799 			nfs3_pathconf_cache_hits++;
5800 #endif
5801 			return (error);
5802 		}
5803 		mutex_exit(&rp->r_statelock);
5804 	}
5805 #ifdef DEBUG
5806 	nfs3_pathconf_cache_misses++;
5807 #endif
5808 
5809 	args.object = *VTOFH3(vp);
5810 	fi.vp = vp;
5811 	fi.fhp = (caddr_t)&args.object;
5812 	fi.copyproc = nfs3copyfh;
5813 	fi.lookupproc = nfs3lookup;
5814 	fi.xattrdirproc = acl_getxattrdir3;
5815 
5816 	douprintf = 1;
5817 
5818 	t = gethrtime();
5819 
5820 	error = rfs3call(VTOMI(vp), NFSPROC3_PATHCONF,
5821 	    xdr_nfs_fh3, (caddr_t)&args,
5822 	    xdr_PATHCONF3res, (caddr_t)&res, cr,
5823 	    &douprintf, &res.status, 0, &fi);
5824 
5825 	if (error)
5826 		return (error);
5827 
5828 	error = geterrno3(res.status);
5829 
5830 	if (!error) {
5831 		nfs3_cache_post_op_attr(vp, &res.resok.obj_attributes, t, cr);
5832 		if (!nfs3_pathconf_disable_cache) {
5833 			mutex_enter(&rp->r_statelock);
5834 			if (rp->r_pathconf == NULL) {
5835 				rp->r_pathconf = kmem_alloc(
5836 				    sizeof (*rp->r_pathconf), KM_NOSLEEP);
5837 				if (rp->r_pathconf != NULL)
5838 					*rp->r_pathconf = res.resok.info;
5839 			}
5840 			mutex_exit(&rp->r_statelock);
5841 		}
5842 		switch (cmd) {
5843 		case _PC_LINK_MAX:
5844 			*valp = res.resok.info.link_max;
5845 			break;
5846 		case _PC_NAME_MAX:
5847 			*valp = res.resok.info.name_max;
5848 			break;
5849 		case _PC_PATH_MAX:
5850 		case _PC_SYMLINK_MAX:
5851 			*valp = MAXPATHLEN;
5852 			break;
5853 		case _PC_CHOWN_RESTRICTED:
5854 			*valp = res.resok.info.chown_restricted;
5855 			break;
5856 		case _PC_NO_TRUNC:
5857 			*valp = res.resok.info.no_trunc;
5858 			break;
5859 		default:
5860 			return (EINVAL);
5861 		}
5862 	} else {
5863 		nfs3_cache_post_op_attr(vp, &res.resfail.obj_attributes, t, cr);
5864 		PURGE_STALE_FH(error, vp, cr);
5865 	}
5866 
5867 	return (error);
5868 }
5869 
5870 /*
5871  * Called by async thread to do synchronous pageio. Do the i/o, wait
5872  * for it to complete, and cleanup the page list when done.
5873  */
5874 static int
5875 nfs3_sync_pageio(vnode_t *vp, page_t *pp, u_offset_t io_off, size_t io_len,
5876 	int flags, cred_t *cr)
5877 {
5878 	int error;
5879 
5880 	ASSERT(nfs_zone() == VTOMI(vp)->mi_zone);
5881 	error = nfs3_rdwrlbn(vp, pp, io_off, io_len, flags, cr);
5882 	if (flags & B_READ)
5883 		pvn_read_done(pp, (error ? B_ERROR : 0) | flags);
5884 	else
5885 		pvn_write_done(pp, (error ? B_ERROR : 0) | flags);
5886 	return (error);
5887 }
5888 
5889 /* ARGSUSED */
5890 static int
5891 nfs3_pageio(vnode_t *vp, page_t *pp, u_offset_t io_off, size_t io_len,
5892 	int flags, cred_t *cr, caller_context_t *ct)
5893 {
5894 	int error;
5895 	rnode_t *rp;
5896 
5897 	if (pp == NULL)
5898 		return (EINVAL);
5899 	if (!(flags & B_ASYNC) && nfs_zone() != VTOMI(vp)->mi_zone)
5900 		return (EIO);
5901 
5902 	rp = VTOR(vp);
5903 	mutex_enter(&rp->r_statelock);
5904 	rp->r_count++;
5905 	mutex_exit(&rp->r_statelock);
5906 
5907 	if (flags & B_ASYNC) {
5908 		error = nfs_async_pageio(vp, pp, io_off, io_len, flags, cr,
5909 		    nfs3_sync_pageio);
5910 	} else
5911 		error = nfs3_rdwrlbn(vp, pp, io_off, io_len, flags, cr);
5912 	mutex_enter(&rp->r_statelock);
5913 	rp->r_count--;
5914 	cv_broadcast(&rp->r_cv);
5915 	mutex_exit(&rp->r_statelock);
5916 	return (error);
5917 }
5918 
5919 /* ARGSUSED */
5920 static void
5921 nfs3_dispose(vnode_t *vp, page_t *pp, int fl, int dn, cred_t *cr,
5922 	caller_context_t *ct)
5923 {
5924 	int error;
5925 	rnode_t *rp;
5926 	page_t *plist;
5927 	page_t *pptr;
5928 	offset3 offset;
5929 	count3 len;
5930 	k_sigset_t smask;
5931 
5932 	/*
5933 	 * We should get called with fl equal to either B_FREE or
5934 	 * B_INVAL.  Any other value is illegal.
5935 	 *
5936 	 * The page that we are either supposed to free or destroy
5937 	 * should be exclusive locked and its io lock should not
5938 	 * be held.
5939 	 */
5940 	ASSERT(fl == B_FREE || fl == B_INVAL);
5941 	ASSERT((PAGE_EXCL(pp) && !page_iolock_assert(pp)) || panicstr);
5942 	rp = VTOR(vp);
5943 
5944 	/*
5945 	 * If the page doesn't need to be committed or we shouldn't
5946 	 * even bother attempting to commit it, then just make sure
5947 	 * that the p_fsdata byte is clear and then either free or
5948 	 * destroy the page as appropriate.
5949 	 */
5950 	if (pp->p_fsdata == C_NOCOMMIT || (rp->r_flags & RSTALE)) {
5951 		pp->p_fsdata = C_NOCOMMIT;
5952 		if (fl == B_FREE)
5953 			page_free(pp, dn);
5954 		else
5955 			page_destroy(pp, dn);
5956 		return;
5957 	}
5958 
5959 	/*
5960 	 * If there is a page invalidation operation going on, then
5961 	 * if this is one of the pages being destroyed, then just
5962 	 * clear the p_fsdata byte and then either free or destroy
5963 	 * the page as appropriate.
5964 	 */
5965 	mutex_enter(&rp->r_statelock);
5966 	if ((rp->r_flags & RTRUNCATE) && pp->p_offset >= rp->r_truncaddr) {
5967 		mutex_exit(&rp->r_statelock);
5968 		pp->p_fsdata = C_NOCOMMIT;
5969 		if (fl == B_FREE)
5970 			page_free(pp, dn);
5971 		else
5972 			page_destroy(pp, dn);
5973 		return;
5974 	}
5975 
5976 	/*
5977 	 * If we are freeing this page and someone else is already
5978 	 * waiting to do a commit, then just unlock the page and
5979 	 * return.  That other thread will take care of commiting
5980 	 * this page.  The page can be freed sometime after the
5981 	 * commit has finished.  Otherwise, if the page is marked
5982 	 * as delay commit, then we may be getting called from
5983 	 * pvn_write_done, one page at a time.   This could result
5984 	 * in one commit per page, so we end up doing lots of small
5985 	 * commits instead of fewer larger commits.  This is bad,
5986 	 * we want do as few commits as possible.
5987 	 */
5988 	if (fl == B_FREE) {
5989 		if (rp->r_flags & RCOMMITWAIT) {
5990 			page_unlock(pp);
5991 			mutex_exit(&rp->r_statelock);
5992 			return;
5993 		}
5994 		if (pp->p_fsdata == C_DELAYCOMMIT) {
5995 			pp->p_fsdata = C_COMMIT;
5996 			page_unlock(pp);
5997 			mutex_exit(&rp->r_statelock);
5998 			return;
5999 		}
6000 	}
6001 
6002 	/*
6003 	 * Check to see if there is a signal which would prevent an
6004 	 * attempt to commit the pages from being successful.  If so,
6005 	 * then don't bother with all of the work to gather pages and
6006 	 * generate the unsuccessful RPC.  Just return from here and
6007 	 * let the page be committed at some later time.
6008 	 */
6009 	sigintr(&smask, VTOMI(vp)->mi_flags & MI_INT);
6010 	if (ttolwp(curthread) != NULL && ISSIG(curthread, JUSTLOOKING)) {
6011 		sigunintr(&smask);
6012 		page_unlock(pp);
6013 		mutex_exit(&rp->r_statelock);
6014 		return;
6015 	}
6016 	sigunintr(&smask);
6017 
6018 	/*
6019 	 * We are starting to need to commit pages, so let's try
6020 	 * to commit as many as possible at once to reduce the
6021 	 * overhead.
6022 	 *
6023 	 * Set the `commit inprogress' state bit.  We must
6024 	 * first wait until any current one finishes.  Then
6025 	 * we initialize the c_pages list with this page.
6026 	 */
6027 	while (rp->r_flags & RCOMMIT) {
6028 		rp->r_flags |= RCOMMITWAIT;
6029 		cv_wait(&rp->r_commit.c_cv, &rp->r_statelock);
6030 		rp->r_flags &= ~RCOMMITWAIT;
6031 	}
6032 	rp->r_flags |= RCOMMIT;
6033 	mutex_exit(&rp->r_statelock);
6034 	ASSERT(rp->r_commit.c_pages == NULL);
6035 	rp->r_commit.c_pages = pp;
6036 	rp->r_commit.c_commbase = (offset3)pp->p_offset;
6037 	rp->r_commit.c_commlen = PAGESIZE;
6038 
6039 	/*
6040 	 * Gather together all other pages which can be committed.
6041 	 * They will all be chained off r_commit.c_pages.
6042 	 */
6043 	nfs3_get_commit(vp);
6044 
6045 	/*
6046 	 * Clear the `commit inprogress' status and disconnect
6047 	 * the list of pages to be committed from the rnode.
6048 	 * At this same time, we also save the starting offset
6049 	 * and length of data to be committed on the server.
6050 	 */
6051 	plist = rp->r_commit.c_pages;
6052 	rp->r_commit.c_pages = NULL;
6053 	offset = rp->r_commit.c_commbase;
6054 	len = rp->r_commit.c_commlen;
6055 	mutex_enter(&rp->r_statelock);
6056 	rp->r_flags &= ~RCOMMIT;
6057 	cv_broadcast(&rp->r_commit.c_cv);
6058 	mutex_exit(&rp->r_statelock);
6059 
6060 	if (curproc == proc_pageout || curproc == proc_fsflush ||
6061 	    nfs_zone() != VTOMI(vp)->mi_zone) {
6062 		nfs_async_commit(vp, plist, offset, len, cr, nfs3_async_commit);
6063 		return;
6064 	}
6065 
6066 	/*
6067 	 * Actually generate the COMMIT3 over the wire operation.
6068 	 */
6069 	error = nfs3_commit(vp, offset, len, cr);
6070 
6071 	/*
6072 	 * If we got an error during the commit, just unlock all
6073 	 * of the pages.  The pages will get retransmitted to the
6074 	 * server during a putpage operation.
6075 	 */
6076 	if (error) {
6077 		while (plist != NULL) {
6078 			pptr = plist;
6079 			page_sub(&plist, pptr);
6080 			page_unlock(pptr);
6081 		}
6082 		return;
6083 	}
6084 
6085 	/*
6086 	 * We've tried as hard as we can to commit the data to stable
6087 	 * storage on the server.  We release the rest of the pages
6088 	 * and clear the commit required state.  They will be put
6089 	 * onto the tail of the cachelist if they are nolonger
6090 	 * mapped.
6091 	 */
6092 	while (plist != pp) {
6093 		pptr = plist;
6094 		page_sub(&plist, pptr);
6095 		pptr->p_fsdata = C_NOCOMMIT;
6096 		(void) page_release(pptr, 1);
6097 	}
6098 
6099 	/*
6100 	 * It is possible that nfs3_commit didn't return error but
6101 	 * some other thread has modified the page we are going
6102 	 * to free/destroy.
6103 	 *    In this case we need to rewrite the page. Do an explicit check
6104 	 * before attempting to free/destroy the page. If modified, needs to
6105 	 * be rewritten so unlock the page and return.
6106 	 */
6107 	if (hat_ismod(pp)) {
6108 		pp->p_fsdata = C_NOCOMMIT;
6109 		page_unlock(pp);
6110 		return;
6111 	}
6112 
6113 	/*
6114 	 * Now, as appropriate, either free or destroy the page
6115 	 * that we were called with.
6116 	 */
6117 	pp->p_fsdata = C_NOCOMMIT;
6118 	if (fl == B_FREE)
6119 		page_free(pp, dn);
6120 	else
6121 		page_destroy(pp, dn);
6122 }
6123 
6124 static int
6125 nfs3_commit(vnode_t *vp, offset3 offset, count3 count, cred_t *cr)
6126 {
6127 	int error;
6128 	rnode_t *rp;
6129 	COMMIT3args args;
6130 	COMMIT3res res;
6131 	int douprintf;
6132 	cred_t *cred;
6133 
6134 	rp = VTOR(vp);
6135 	ASSERT(nfs_zone() == VTOMI(vp)->mi_zone);
6136 
6137 	mutex_enter(&rp->r_statelock);
6138 	if (rp->r_cred != NULL) {
6139 		cred = rp->r_cred;
6140 		crhold(cred);
6141 	} else {
6142 		rp->r_cred = cr;
6143 		crhold(cr);
6144 		cred = cr;
6145 		crhold(cred);
6146 	}
6147 	mutex_exit(&rp->r_statelock);
6148 
6149 	args.file = *VTOFH3(vp);
6150 	args.offset = offset;
6151 	args.count = count;
6152 
6153 doitagain:
6154 	douprintf = 1;
6155 	error = rfs3call(VTOMI(vp), NFSPROC3_COMMIT,
6156 	    xdr_COMMIT3args, (caddr_t)&args,
6157 	    xdr_COMMIT3res, (caddr_t)&res, cred,
6158 	    &douprintf, &res.status, 0, NULL);
6159 
6160 	crfree(cred);
6161 
6162 	if (error)
6163 		return (error);
6164 
6165 	error = geterrno3(res.status);
6166 	if (!error) {
6167 		ASSERT(rp->r_flags & RHAVEVERF);
6168 		mutex_enter(&rp->r_statelock);
6169 		if (rp->r_verf == res.resok.verf) {
6170 			mutex_exit(&rp->r_statelock);
6171 			return (0);
6172 		}
6173 		nfs3_set_mod(vp);
6174 		rp->r_verf = res.resok.verf;
6175 		mutex_exit(&rp->r_statelock);
6176 		error = NFS_VERF_MISMATCH;
6177 	} else {
6178 		if (error == EACCES) {
6179 			mutex_enter(&rp->r_statelock);
6180 			if (cred != cr) {
6181 				if (rp->r_cred != NULL)
6182 					crfree(rp->r_cred);
6183 				rp->r_cred = cr;
6184 				crhold(cr);
6185 				cred = cr;
6186 				crhold(cred);
6187 				mutex_exit(&rp->r_statelock);
6188 				goto doitagain;
6189 			}
6190 			mutex_exit(&rp->r_statelock);
6191 		}
6192 		/*
6193 		 * Can't do a PURGE_STALE_FH here because this
6194 		 * can cause a deadlock.  nfs3_commit can
6195 		 * be called from nfs3_dispose which can be called
6196 		 * indirectly via pvn_vplist_dirty.  PURGE_STALE_FH
6197 		 * can call back to pvn_vplist_dirty.
6198 		 */
6199 		if (error == ESTALE) {
6200 			mutex_enter(&rp->r_statelock);
6201 			rp->r_flags |= RSTALE;
6202 			if (!rp->r_error)
6203 				rp->r_error = error;
6204 			mutex_exit(&rp->r_statelock);
6205 			PURGE_ATTRCACHE(vp);
6206 		} else {
6207 			mutex_enter(&rp->r_statelock);
6208 			if (!rp->r_error)
6209 				rp->r_error = error;
6210 			mutex_exit(&rp->r_statelock);
6211 		}
6212 	}
6213 
6214 	return (error);
6215 }
6216 
6217 static void
6218 nfs3_set_mod(vnode_t *vp)
6219 {
6220 	page_t *pp;
6221 	kmutex_t *vphm;
6222 
6223 	ASSERT(nfs_zone() == VTOMI(vp)->mi_zone);
6224 	vphm = page_vnode_mutex(vp);
6225 	mutex_enter(vphm);
6226 	if ((pp = vp->v_pages) != NULL) {
6227 		do {
6228 			if (pp->p_fsdata != C_NOCOMMIT) {
6229 				hat_setmod(pp);
6230 				pp->p_fsdata = C_NOCOMMIT;
6231 			}
6232 		} while ((pp = pp->p_vpnext) != vp->v_pages);
6233 	}
6234 	mutex_exit(vphm);
6235 }
6236 
6237 
6238 /*
6239  * This routine is used to gather together a page list of the pages
6240  * which are to be committed on the server.  This routine must not
6241  * be called if the calling thread holds any locked pages.
6242  *
6243  * The calling thread must have set RCOMMIT.  This bit is used to
6244  * serialize access to the commit structure in the rnode.  As long
6245  * as the thread has set RCOMMIT, then it can manipulate the commit
6246  * structure without requiring any other locks.
6247  */
6248 static void
6249 nfs3_get_commit(vnode_t *vp)
6250 {
6251 	rnode_t *rp;
6252 	page_t *pp;
6253 	kmutex_t *vphm;
6254 
6255 	rp = VTOR(vp);
6256 
6257 	ASSERT(rp->r_flags & RCOMMIT);
6258 
6259 	vphm = page_vnode_mutex(vp);
6260 	mutex_enter(vphm);
6261 
6262 	/*
6263 	 * If there are no pages associated with this vnode, then
6264 	 * just return.
6265 	 */
6266 	if ((pp = vp->v_pages) == NULL) {
6267 		mutex_exit(vphm);
6268 		return;
6269 	}
6270 
6271 	/*
6272 	 * Step through all of the pages associated with this vnode
6273 	 * looking for pages which need to be committed.
6274 	 */
6275 	do {
6276 		/*
6277 		 * If this page does not need to be committed or is
6278 		 * modified, then just skip it.
6279 		 */
6280 		if (pp->p_fsdata == C_NOCOMMIT || hat_ismod(pp))
6281 			continue;
6282 
6283 		/*
6284 		 * Attempt to lock the page.  If we can't, then
6285 		 * someone else is messing with it and we will
6286 		 * just skip it.
6287 		 */
6288 		if (!page_trylock(pp, SE_EXCL))
6289 			continue;
6290 
6291 		/*
6292 		 * If this page does not need to be committed or is
6293 		 * modified, then just skip it.  Recheck now that
6294 		 * the page is locked.
6295 		 */
6296 		if (pp->p_fsdata == C_NOCOMMIT || hat_ismod(pp)) {
6297 			page_unlock(pp);
6298 			continue;
6299 		}
6300 
6301 		if (PP_ISFREE(pp)) {
6302 			cmn_err(CE_PANIC, "nfs3_get_commit: %p is free",
6303 			    (void *)pp);
6304 		}
6305 
6306 		/*
6307 		 * The page needs to be committed and we locked it.
6308 		 * Update the base and length parameters and add it
6309 		 * to r_pages.
6310 		 */
6311 		if (rp->r_commit.c_pages == NULL) {
6312 			rp->r_commit.c_commbase = (offset3)pp->p_offset;
6313 			rp->r_commit.c_commlen = PAGESIZE;
6314 		} else if (pp->p_offset < rp->r_commit.c_commbase) {
6315 			rp->r_commit.c_commlen = rp->r_commit.c_commbase -
6316 			    (offset3)pp->p_offset + rp->r_commit.c_commlen;
6317 			rp->r_commit.c_commbase = (offset3)pp->p_offset;
6318 		} else if ((rp->r_commit.c_commbase + rp->r_commit.c_commlen)
6319 		    <= pp->p_offset) {
6320 			rp->r_commit.c_commlen = (offset3)pp->p_offset -
6321 			    rp->r_commit.c_commbase + PAGESIZE;
6322 		}
6323 		page_add(&rp->r_commit.c_pages, pp);
6324 	} while ((pp = pp->p_vpnext) != vp->v_pages);
6325 
6326 	mutex_exit(vphm);
6327 }
6328 
6329 /*
6330  * This routine is used to gather together a page list of the pages
6331  * which are to be committed on the server.  This routine must not
6332  * be called if the calling thread holds any locked pages.
6333  *
6334  * The calling thread must have set RCOMMIT.  This bit is used to
6335  * serialize access to the commit structure in the rnode.  As long
6336  * as the thread has set RCOMMIT, then it can manipulate the commit
6337  * structure without requiring any other locks.
6338  */
6339 static void
6340 nfs3_get_commit_range(vnode_t *vp, u_offset_t soff, size_t len)
6341 {
6342 
6343 	rnode_t *rp;
6344 	page_t *pp;
6345 	u_offset_t end;
6346 	u_offset_t off;
6347 
6348 	ASSERT(len != 0);
6349 
6350 	rp = VTOR(vp);
6351 
6352 	ASSERT(rp->r_flags & RCOMMIT);
6353 	ASSERT(nfs_zone() == VTOMI(vp)->mi_zone);
6354 
6355 	/*
6356 	 * If there are no pages associated with this vnode, then
6357 	 * just return.
6358 	 */
6359 	if ((pp = vp->v_pages) == NULL)
6360 		return;
6361 
6362 	/*
6363 	 * Calculate the ending offset.
6364 	 */
6365 	end = soff + len;
6366 
6367 	for (off = soff; off < end; off += PAGESIZE) {
6368 		/*
6369 		 * Lookup each page by vp, offset.
6370 		 */
6371 		if ((pp = page_lookup_nowait(vp, off, SE_EXCL)) == NULL)
6372 			continue;
6373 
6374 		/*
6375 		 * If this page does not need to be committed or is
6376 		 * modified, then just skip it.
6377 		 */
6378 		if (pp->p_fsdata == C_NOCOMMIT || hat_ismod(pp)) {
6379 			page_unlock(pp);
6380 			continue;
6381 		}
6382 
6383 		ASSERT(PP_ISFREE(pp) == 0);
6384 
6385 		/*
6386 		 * The page needs to be committed and we locked it.
6387 		 * Update the base and length parameters and add it
6388 		 * to r_pages.
6389 		 */
6390 		if (rp->r_commit.c_pages == NULL) {
6391 			rp->r_commit.c_commbase = (offset3)pp->p_offset;
6392 			rp->r_commit.c_commlen = PAGESIZE;
6393 		} else {
6394 			rp->r_commit.c_commlen = (offset3)pp->p_offset -
6395 			    rp->r_commit.c_commbase + PAGESIZE;
6396 		}
6397 		page_add(&rp->r_commit.c_pages, pp);
6398 	}
6399 }
6400 
6401 #if 0	/* unused */
6402 #ifdef DEBUG
6403 static int
6404 nfs3_no_uncommitted_pages(vnode_t *vp)
6405 {
6406 	page_t *pp;
6407 	kmutex_t *vphm;
6408 
6409 	vphm = page_vnode_mutex(vp);
6410 	mutex_enter(vphm);
6411 	if ((pp = vp->v_pages) != NULL) {
6412 		do {
6413 			if (pp->p_fsdata != C_NOCOMMIT) {
6414 				mutex_exit(vphm);
6415 				return (0);
6416 			}
6417 		} while ((pp = pp->p_vpnext) != vp->v_pages);
6418 	}
6419 	mutex_exit(vphm);
6420 
6421 	return (1);
6422 }
6423 #endif
6424 #endif
6425 
6426 static int
6427 nfs3_putpage_commit(vnode_t *vp, offset_t poff, size_t plen, cred_t *cr)
6428 {
6429 	int error;
6430 	writeverf3 write_verf;
6431 	rnode_t *rp = VTOR(vp);
6432 
6433 	ASSERT(nfs_zone() == VTOMI(vp)->mi_zone);
6434 	/*
6435 	 * Flush the data portion of the file and then commit any
6436 	 * portions which need to be committed.  This may need to
6437 	 * be done twice if the server has changed state since
6438 	 * data was last written.  The data will need to be
6439 	 * rewritten to the server and then a new commit done.
6440 	 *
6441 	 * In fact, this may need to be done several times if the
6442 	 * server is having problems and crashing while we are
6443 	 * attempting to do this.
6444 	 */
6445 
6446 top:
6447 	/*
6448 	 * Do a flush based on the poff and plen arguments.  This
6449 	 * will asynchronously write out any modified pages in the
6450 	 * range specified by (poff, plen).  This starts all of the
6451 	 * i/o operations which will be waited for in the next
6452 	 * call to nfs3_putpage
6453 	 */
6454 
6455 	mutex_enter(&rp->r_statelock);
6456 	write_verf = rp->r_verf;
6457 	mutex_exit(&rp->r_statelock);
6458 
6459 	error = nfs3_putpage(vp, poff, plen, B_ASYNC, cr, NULL);
6460 	if (error == EAGAIN)
6461 		error = 0;
6462 
6463 	/*
6464 	 * Do a flush based on the poff and plen arguments.  This
6465 	 * will synchronously write out any modified pages in the
6466 	 * range specified by (poff, plen) and wait until all of
6467 	 * the asynchronous i/o's in that range are done as well.
6468 	 */
6469 	if (!error)
6470 		error = nfs3_putpage(vp, poff, plen, 0, cr, NULL);
6471 
6472 	if (error)
6473 		return (error);
6474 
6475 	mutex_enter(&rp->r_statelock);
6476 	if (rp->r_verf != write_verf) {
6477 		mutex_exit(&rp->r_statelock);
6478 		goto top;
6479 	}
6480 	mutex_exit(&rp->r_statelock);
6481 
6482 	/*
6483 	 * Now commit any pages which might need to be committed.
6484 	 * If the error, NFS_VERF_MISMATCH, is returned, then
6485 	 * start over with the flush operation.
6486 	 */
6487 
6488 	error = nfs3_commit_vp(vp, poff, plen, cr);
6489 
6490 	if (error == NFS_VERF_MISMATCH)
6491 		goto top;
6492 
6493 	return (error);
6494 }
6495 
6496 static int
6497 nfs3_commit_vp(vnode_t *vp, u_offset_t poff, size_t plen, cred_t *cr)
6498 {
6499 	rnode_t *rp;
6500 	page_t *plist;
6501 	offset3 offset;
6502 	count3 len;
6503 
6504 
6505 	rp = VTOR(vp);
6506 
6507 	if (nfs_zone() != VTOMI(vp)->mi_zone)
6508 		return (EIO);
6509 	/*
6510 	 * Set the `commit inprogress' state bit.  We must
6511 	 * first wait until any current one finishes.
6512 	 */
6513 	mutex_enter(&rp->r_statelock);
6514 	while (rp->r_flags & RCOMMIT) {
6515 		rp->r_flags |= RCOMMITWAIT;
6516 		cv_wait(&rp->r_commit.c_cv, &rp->r_statelock);
6517 		rp->r_flags &= ~RCOMMITWAIT;
6518 	}
6519 	rp->r_flags |= RCOMMIT;
6520 	mutex_exit(&rp->r_statelock);
6521 
6522 	/*
6523 	 * Gather together all of the pages which need to be
6524 	 * committed.
6525 	 */
6526 	if (plen == 0)
6527 		nfs3_get_commit(vp);
6528 	else
6529 		nfs3_get_commit_range(vp, poff, plen);
6530 
6531 	/*
6532 	 * Clear the `commit inprogress' bit and disconnect the
6533 	 * page list which was gathered together in nfs3_get_commit.
6534 	 */
6535 	plist = rp->r_commit.c_pages;
6536 	rp->r_commit.c_pages = NULL;
6537 	offset = rp->r_commit.c_commbase;
6538 	len = rp->r_commit.c_commlen;
6539 	mutex_enter(&rp->r_statelock);
6540 	rp->r_flags &= ~RCOMMIT;
6541 	cv_broadcast(&rp->r_commit.c_cv);
6542 	mutex_exit(&rp->r_statelock);
6543 
6544 	/*
6545 	 * If any pages need to be committed, commit them and
6546 	 * then unlock them so that they can be freed some
6547 	 * time later.
6548 	 */
6549 	if (plist != NULL) {
6550 		/*
6551 		 * No error occurred during the flush portion
6552 		 * of this operation, so now attempt to commit
6553 		 * the data to stable storage on the server.
6554 		 *
6555 		 * This will unlock all of the pages on the list.
6556 		 */
6557 		return (nfs3_sync_commit(vp, plist, offset, len, cr));
6558 	}
6559 	return (0);
6560 }
6561 
6562 static int
6563 nfs3_sync_commit(vnode_t *vp, page_t *plist, offset3 offset, count3 count,
6564 	cred_t *cr)
6565 {
6566 	int error;
6567 	page_t *pp;
6568 
6569 	ASSERT(nfs_zone() == VTOMI(vp)->mi_zone);
6570 	error = nfs3_commit(vp, offset, count, cr);
6571 
6572 	/*
6573 	 * If we got an error, then just unlock all of the pages
6574 	 * on the list.
6575 	 */
6576 	if (error) {
6577 		while (plist != NULL) {
6578 			pp = plist;
6579 			page_sub(&plist, pp);
6580 			page_unlock(pp);
6581 		}
6582 		return (error);
6583 	}
6584 	/*
6585 	 * We've tried as hard as we can to commit the data to stable
6586 	 * storage on the server.  We just unlock the pages and clear
6587 	 * the commit required state.  They will get freed later.
6588 	 */
6589 	while (plist != NULL) {
6590 		pp = plist;
6591 		page_sub(&plist, pp);
6592 		pp->p_fsdata = C_NOCOMMIT;
6593 		page_unlock(pp);
6594 	}
6595 
6596 	return (error);
6597 }
6598 
6599 static void
6600 nfs3_async_commit(vnode_t *vp, page_t *plist, offset3 offset, count3 count,
6601 	cred_t *cr)
6602 {
6603 	ASSERT(nfs_zone() == VTOMI(vp)->mi_zone);
6604 	(void) nfs3_sync_commit(vp, plist, offset, count, cr);
6605 }
6606 
6607 /* ARGSUSED */
6608 static int
6609 nfs3_setsecattr(vnode_t *vp, vsecattr_t *vsecattr, int flag, cred_t *cr,
6610 	caller_context_t *ct)
6611 {
6612 	int error;
6613 	mntinfo_t *mi;
6614 
6615 	mi = VTOMI(vp);
6616 
6617 	if (nfs_zone() != mi->mi_zone)
6618 		return (EIO);
6619 
6620 	if (mi->mi_flags & MI_ACL) {
6621 		error = acl_setacl3(vp, vsecattr, flag, cr);
6622 		if (mi->mi_flags & MI_ACL)
6623 			return (error);
6624 	}
6625 
6626 	return (ENOSYS);
6627 }
6628 
6629 /* ARGSUSED */
6630 static int
6631 nfs3_getsecattr(vnode_t *vp, vsecattr_t *vsecattr, int flag, cred_t *cr,
6632 	caller_context_t *ct)
6633 {
6634 	int error;
6635 	mntinfo_t *mi;
6636 
6637 	mi = VTOMI(vp);
6638 
6639 	if (nfs_zone() != mi->mi_zone)
6640 		return (EIO);
6641 
6642 	if (mi->mi_flags & MI_ACL) {
6643 		error = acl_getacl3(vp, vsecattr, flag, cr);
6644 		if (mi->mi_flags & MI_ACL)
6645 			return (error);
6646 	}
6647 
6648 	return (fs_fab_acl(vp, vsecattr, flag, cr, ct));
6649 }
6650 
6651 /* ARGSUSED */
6652 static int
6653 nfs3_shrlock(vnode_t *vp, int cmd, struct shrlock *shr, int flag, cred_t *cr,
6654 	caller_context_t *ct)
6655 {
6656 	int error;
6657 	struct shrlock nshr;
6658 	struct nfs_owner nfs_owner;
6659 	netobj lm_fh3;
6660 
6661 	if (nfs_zone() != VTOMI(vp)->mi_zone)
6662 		return (EIO);
6663 
6664 	/*
6665 	 * check for valid cmd parameter
6666 	 */
6667 	if (cmd != F_SHARE && cmd != F_UNSHARE && cmd != F_HASREMOTELOCKS)
6668 		return (EINVAL);
6669 
6670 	/*
6671 	 * Check access permissions
6672 	 */
6673 	if (cmd == F_SHARE &&
6674 	    (((shr->s_access & F_RDACC) && !(flag & FREAD)) ||
6675 	    ((shr->s_access & F_WRACC) && !(flag & FWRITE))))
6676 		return (EBADF);
6677 
6678 	/*
6679 	 * If the filesystem is mounted using local locking, pass the
6680 	 * request off to the local share code.
6681 	 */
6682 	if (VTOMI(vp)->mi_flags & MI_LLOCK)
6683 		return (fs_shrlock(vp, cmd, shr, flag, cr, ct));
6684 
6685 	switch (cmd) {
6686 	case F_SHARE:
6687 	case F_UNSHARE:
6688 		lm_fh3.n_len = VTOFH3(vp)->fh3_length;
6689 		lm_fh3.n_bytes = (char *)&(VTOFH3(vp)->fh3_u.data);
6690 
6691 		/*
6692 		 * If passed an owner that is too large to fit in an
6693 		 * nfs_owner it is likely a recursive call from the
6694 		 * lock manager client and pass it straight through.  If
6695 		 * it is not a nfs_owner then simply return an error.
6696 		 */
6697 		if (shr->s_own_len > sizeof (nfs_owner.lowner)) {
6698 			if (((struct nfs_owner *)shr->s_owner)->magic !=
6699 			    NFS_OWNER_MAGIC)
6700 				return (EINVAL);
6701 
6702 			if (error = lm4_shrlock(vp, cmd, shr, flag, &lm_fh3)) {
6703 				error = set_errno(error);
6704 			}
6705 			return (error);
6706 		}
6707 		/*
6708 		 * Remote share reservations owner is a combination of
6709 		 * a magic number, hostname, and the local owner
6710 		 */
6711 		bzero(&nfs_owner, sizeof (nfs_owner));
6712 		nfs_owner.magic = NFS_OWNER_MAGIC;
6713 		(void) strncpy(nfs_owner.hname, uts_nodename(),
6714 		    sizeof (nfs_owner.hname));
6715 		bcopy(shr->s_owner, nfs_owner.lowner, shr->s_own_len);
6716 		nshr.s_access = shr->s_access;
6717 		nshr.s_deny = shr->s_deny;
6718 		nshr.s_sysid = 0;
6719 		nshr.s_pid = ttoproc(curthread)->p_pid;
6720 		nshr.s_own_len = sizeof (nfs_owner);
6721 		nshr.s_owner = (caddr_t)&nfs_owner;
6722 
6723 		if (error = lm4_shrlock(vp, cmd, &nshr, flag, &lm_fh3)) {
6724 			error = set_errno(error);
6725 		}
6726 
6727 		break;
6728 
6729 	case F_HASREMOTELOCKS:
6730 		/*
6731 		 * NFS client can't store remote locks itself
6732 		 */
6733 		shr->s_access = 0;
6734 		error = 0;
6735 		break;
6736 
6737 	default:
6738 		error = EINVAL;
6739 		break;
6740 	}
6741 
6742 	return (error);
6743 }
6744