xref: /titanic_41/usr/src/uts/common/fs/nfs/nfs_vnops.c (revision 56d930ae56e5cfc2442f5214a7b2c47f08a2b920)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 /*
22  * Copyright 2007 Sun Microsystems, Inc.  All rights reserved.
23  * Use is subject to license terms.
24  *
25  *	Copyright (c) 1983,1984,1985,1986,1987,1988,1989 AT&T.
26  *	All rights reserved.
27  */
28 
29 #pragma ident	"%Z%%M%	%I%	%E% SMI"
30 
31 #include <sys/param.h>
32 #include <sys/types.h>
33 #include <sys/systm.h>
34 #include <sys/cred.h>
35 #include <sys/time.h>
36 #include <sys/vnode.h>
37 #include <sys/vfs.h>
38 #include <sys/vfs_opreg.h>
39 #include <sys/file.h>
40 #include <sys/filio.h>
41 #include <sys/uio.h>
42 #include <sys/buf.h>
43 #include <sys/mman.h>
44 #include <sys/pathname.h>
45 #include <sys/dirent.h>
46 #include <sys/debug.h>
47 #include <sys/vmsystm.h>
48 #include <sys/fcntl.h>
49 #include <sys/flock.h>
50 #include <sys/swap.h>
51 #include <sys/errno.h>
52 #include <sys/strsubr.h>
53 #include <sys/sysmacros.h>
54 #include <sys/kmem.h>
55 #include <sys/cmn_err.h>
56 #include <sys/pathconf.h>
57 #include <sys/utsname.h>
58 #include <sys/dnlc.h>
59 #include <sys/acl.h>
60 #include <sys/atomic.h>
61 #include <sys/policy.h>
62 #include <sys/sdt.h>
63 
64 #include <rpc/types.h>
65 #include <rpc/auth.h>
66 #include <rpc/clnt.h>
67 
68 #include <nfs/nfs.h>
69 #include <nfs/nfs_clnt.h>
70 #include <nfs/rnode.h>
71 #include <nfs/nfs_acl.h>
72 #include <nfs/lm.h>
73 
74 #include <vm/hat.h>
75 #include <vm/as.h>
76 #include <vm/page.h>
77 #include <vm/pvn.h>
78 #include <vm/seg.h>
79 #include <vm/seg_map.h>
80 #include <vm/seg_kpm.h>
81 #include <vm/seg_vn.h>
82 
83 #include <fs/fs_subr.h>
84 
85 #include <sys/ddi.h>
86 
87 static int	nfs_rdwrlbn(vnode_t *, page_t *, u_offset_t, size_t, int,
88 			cred_t *);
89 static int	nfswrite(vnode_t *, caddr_t, uint_t, int, cred_t *);
90 static int	nfsread(vnode_t *, caddr_t, uint_t, int, size_t *, cred_t *);
91 static int	nfssetattr(vnode_t *, struct vattr *, int, cred_t *);
92 static int	nfslookup_dnlc(vnode_t *, char *, vnode_t **, cred_t *);
93 static int	nfslookup_otw(vnode_t *, char *, vnode_t **, cred_t *, int);
94 static int	nfsrename(vnode_t *, char *, vnode_t *, char *, cred_t *);
95 static int	nfsreaddir(vnode_t *, rddir_cache *, cred_t *);
96 static int	nfs_bio(struct buf *, cred_t *);
97 static int	nfs_getapage(vnode_t *, u_offset_t, size_t, uint_t *,
98 			page_t *[], size_t, struct seg *, caddr_t,
99 			enum seg_rw, cred_t *);
100 static void	nfs_readahead(vnode_t *, u_offset_t, caddr_t, struct seg *,
101 			cred_t *);
102 static int	nfs_sync_putapage(vnode_t *, page_t *, u_offset_t, size_t,
103 			int, cred_t *);
104 static int	nfs_sync_pageio(vnode_t *, page_t *, u_offset_t, size_t,
105 			int, cred_t *);
106 static void	nfs_delmap_callback(struct as *, void *, uint_t);
107 
108 /*
109  * Error flags used to pass information about certain special errors
110  * which need to be handled specially.
111  */
112 #define	NFS_EOF			-98
113 
114 /*
115  * These are the vnode ops routines which implement the vnode interface to
116  * the networked file system.  These routines just take their parameters,
117  * make them look networkish by putting the right info into interface structs,
118  * and then calling the appropriate remote routine(s) to do the work.
119  *
120  * Note on directory name lookup cacheing:  If we detect a stale fhandle,
121  * we purge the directory cache relative to that vnode.  This way, the
122  * user won't get burned by the cache repeatedly.  See <nfs/rnode.h> for
123  * more details on rnode locking.
124  */
125 
126 static int	nfs_open(vnode_t **, int, cred_t *);
127 static int	nfs_close(vnode_t *, int, int, offset_t, cred_t *);
128 static int	nfs_read(vnode_t *, struct uio *, int, cred_t *,
129 			caller_context_t *);
130 static int	nfs_write(vnode_t *, struct uio *, int, cred_t *,
131 			caller_context_t *);
132 static int	nfs_ioctl(vnode_t *, int, intptr_t, int, cred_t *, int *);
133 static int	nfs_getattr(vnode_t *, struct vattr *, int, cred_t *);
134 static int	nfs_setattr(vnode_t *, struct vattr *, int, cred_t *,
135 			caller_context_t *);
136 static int	nfs_access(vnode_t *, int, int, cred_t *);
137 static int	nfs_accessx(void *, int, cred_t *);
138 static int	nfs_readlink(vnode_t *, struct uio *, cred_t *);
139 static int	nfs_fsync(vnode_t *, int, cred_t *);
140 static void	nfs_inactive(vnode_t *, cred_t *);
141 static int	nfs_lookup(vnode_t *, char *, vnode_t **, struct pathname *,
142 			int, vnode_t *, cred_t *);
143 static int	nfs_create(vnode_t *, char *, struct vattr *, enum vcexcl,
144 			int, vnode_t **, cred_t *, int);
145 static int	nfs_remove(vnode_t *, char *, cred_t *);
146 static int	nfs_link(vnode_t *, vnode_t *, char *, cred_t *);
147 static int	nfs_rename(vnode_t *, char *, vnode_t *, char *, cred_t *);
148 static int	nfs_mkdir(vnode_t *, char *, struct vattr *,
149 			vnode_t **, cred_t *);
150 static int	nfs_rmdir(vnode_t *, char *, vnode_t *, cred_t *);
151 static int	nfs_symlink(vnode_t *, char *, struct vattr *, char *,
152 			cred_t *);
153 static int	nfs_readdir(vnode_t *, struct uio *, cred_t *, int *);
154 static int	nfs_fid(vnode_t *, fid_t *);
155 static int	nfs_rwlock(vnode_t *, int, caller_context_t *);
156 static void	nfs_rwunlock(vnode_t *, int, caller_context_t *);
157 static int	nfs_seek(vnode_t *, offset_t, offset_t *);
158 static int	nfs_getpage(vnode_t *, offset_t, size_t, uint_t *,
159 			page_t *[], size_t, struct seg *, caddr_t,
160 			enum seg_rw, cred_t *);
161 static int	nfs_putpage(vnode_t *, offset_t, size_t, int, cred_t *);
162 static int	nfs_map(vnode_t *, offset_t, struct as *, caddr_t *,
163 			size_t, uchar_t, uchar_t, uint_t, cred_t *);
164 static int	nfs_addmap(vnode_t *, offset_t, struct as *, caddr_t,
165 			size_t, uchar_t, uchar_t, uint_t, cred_t *);
166 static int	nfs_frlock(vnode_t *, int, struct flock64 *, int, offset_t,
167 			struct flk_callback *, cred_t *);
168 static int	nfs_space(vnode_t *, int, struct flock64 *, int, offset_t,
169 			cred_t *, caller_context_t *);
170 static int	nfs_realvp(vnode_t *, vnode_t **);
171 static int	nfs_delmap(vnode_t *, offset_t, struct as *, caddr_t,
172 			size_t, uint_t, uint_t, uint_t, cred_t *);
173 static int	nfs_pathconf(vnode_t *, int, ulong_t *, cred_t *);
174 static int	nfs_pageio(vnode_t *, page_t *, u_offset_t, size_t, int,
175 			cred_t *);
176 static int	nfs_setsecattr(vnode_t *, vsecattr_t *, int, cred_t *);
177 static int	nfs_getsecattr(vnode_t *, vsecattr_t *, int, cred_t *);
178 static int	nfs_shrlock(vnode_t *, int, struct shrlock *, int, cred_t *);
179 
180 struct vnodeops *nfs_vnodeops;
181 
182 const fs_operation_def_t nfs_vnodeops_template[] = {
183 	VOPNAME_OPEN,		{ .vop_open = nfs_open },
184 	VOPNAME_CLOSE,		{ .vop_close = nfs_close },
185 	VOPNAME_READ,		{ .vop_read = nfs_read },
186 	VOPNAME_WRITE,		{ .vop_write = nfs_write },
187 	VOPNAME_IOCTL,		{ .vop_ioctl = nfs_ioctl },
188 	VOPNAME_GETATTR,	{ .vop_getattr = nfs_getattr },
189 	VOPNAME_SETATTR,	{ .vop_setattr = nfs_setattr },
190 	VOPNAME_ACCESS,		{ .vop_access = nfs_access },
191 	VOPNAME_LOOKUP,		{ .vop_lookup = nfs_lookup },
192 	VOPNAME_CREATE,		{ .vop_create = nfs_create },
193 	VOPNAME_REMOVE,		{ .vop_remove = nfs_remove },
194 	VOPNAME_LINK,		{ .vop_link = nfs_link },
195 	VOPNAME_RENAME,		{ .vop_rename = nfs_rename },
196 	VOPNAME_MKDIR,		{ .vop_mkdir = nfs_mkdir },
197 	VOPNAME_RMDIR,		{ .vop_rmdir = nfs_rmdir },
198 	VOPNAME_READDIR,	{ .vop_readdir = nfs_readdir },
199 	VOPNAME_SYMLINK,	{ .vop_symlink = nfs_symlink },
200 	VOPNAME_READLINK,	{ .vop_readlink = nfs_readlink },
201 	VOPNAME_FSYNC,		{ .vop_fsync = nfs_fsync },
202 	VOPNAME_INACTIVE,	{ .vop_inactive = nfs_inactive },
203 	VOPNAME_FID,		{ .vop_fid = nfs_fid },
204 	VOPNAME_RWLOCK,		{ .vop_rwlock = nfs_rwlock },
205 	VOPNAME_RWUNLOCK,	{ .vop_rwunlock = nfs_rwunlock },
206 	VOPNAME_SEEK,		{ .vop_seek = nfs_seek },
207 	VOPNAME_FRLOCK,		{ .vop_frlock = nfs_frlock },
208 	VOPNAME_SPACE,		{ .vop_space = nfs_space },
209 	VOPNAME_REALVP,		{ .vop_realvp = nfs_realvp },
210 	VOPNAME_GETPAGE,	{ .vop_getpage = nfs_getpage },
211 	VOPNAME_PUTPAGE,	{ .vop_putpage = nfs_putpage },
212 	VOPNAME_MAP,		{ .vop_map = nfs_map },
213 	VOPNAME_ADDMAP,		{ .vop_addmap = nfs_addmap },
214 	VOPNAME_DELMAP,		{ .vop_delmap = nfs_delmap },
215 	VOPNAME_DUMP,		{ .vop_dump = nfs_dump },
216 	VOPNAME_PATHCONF,	{ .vop_pathconf = nfs_pathconf },
217 	VOPNAME_PAGEIO,		{ .vop_pageio = nfs_pageio },
218 	VOPNAME_SETSECATTR,	{ .vop_setsecattr = nfs_setsecattr },
219 	VOPNAME_GETSECATTR,	{ .vop_getsecattr = nfs_getsecattr },
220 	VOPNAME_SHRLOCK,	{ .vop_shrlock = nfs_shrlock },
221 	NULL,			NULL
222 };
223 
224 /*
225  * XXX:  This is referenced in modstubs.s
226  */
227 struct vnodeops *
228 nfs_getvnodeops(void)
229 {
230 	return (nfs_vnodeops);
231 }
232 
233 /* ARGSUSED */
234 static int
235 nfs_open(vnode_t **vpp, int flag, cred_t *cr)
236 {
237 	int error;
238 	struct vattr va;
239 	rnode_t *rp;
240 	vnode_t *vp;
241 
242 	vp = *vpp;
243 	rp = VTOR(vp);
244 	if (nfs_zone() != VTOMI(vp)->mi_zone)
245 		return (EIO);
246 	mutex_enter(&rp->r_statelock);
247 	if (rp->r_cred == NULL) {
248 		crhold(cr);
249 		rp->r_cred = cr;
250 	}
251 	mutex_exit(&rp->r_statelock);
252 
253 	/*
254 	 * If there is no cached data or if close-to-open
255 	 * consistency checking is turned off, we can avoid
256 	 * the over the wire getattr.  Otherwise, if the
257 	 * file system is mounted readonly, then just verify
258 	 * the caches are up to date using the normal mechanism.
259 	 * Else, if the file is not mmap'd, then just mark
260 	 * the attributes as timed out.  They will be refreshed
261 	 * and the caches validated prior to being used.
262 	 * Else, the file system is mounted writeable so
263 	 * force an over the wire GETATTR in order to ensure
264 	 * that all cached data is valid.
265 	 */
266 	if (vp->v_count > 1 ||
267 	    ((vn_has_cached_data(vp) || HAVE_RDDIR_CACHE(rp)) &&
268 	    !(VTOMI(vp)->mi_flags & MI_NOCTO))) {
269 		if (vn_is_readonly(vp))
270 			error = nfs_validate_caches(vp, cr);
271 		else if (rp->r_mapcnt == 0 && vp->v_count == 1) {
272 			PURGE_ATTRCACHE(vp);
273 			error = 0;
274 		} else {
275 			va.va_mask = AT_ALL;
276 			error = nfs_getattr_otw(vp, &va, cr);
277 		}
278 	} else
279 		error = 0;
280 
281 	return (error);
282 }
283 
284 static int
285 nfs_close(vnode_t *vp, int flag, int count, offset_t offset, cred_t *cr)
286 {
287 	rnode_t *rp;
288 	int error;
289 	struct vattr va;
290 
291 	/*
292 	 * zone_enter(2) prevents processes from changing zones with NFS files
293 	 * open; if we happen to get here from the wrong zone we can't do
294 	 * anything over the wire.
295 	 */
296 	if (VTOMI(vp)->mi_zone != nfs_zone()) {
297 		/*
298 		 * We could attempt to clean up locks, except we're sure
299 		 * that the current process didn't acquire any locks on
300 		 * the file: any attempt to lock a file belong to another zone
301 		 * will fail, and one can't lock an NFS file and then change
302 		 * zones, as that fails too.
303 		 *
304 		 * Returning an error here is the sane thing to do.  A
305 		 * subsequent call to VN_RELE() which translates to a
306 		 * nfs_inactive() will clean up state: if the zone of the
307 		 * vnode's origin is still alive and kicking, an async worker
308 		 * thread will handle the request (from the correct zone), and
309 		 * everything (minus the final nfs_getattr_otw() call) should
310 		 * be OK. If the zone is going away nfs_async_inactive() will
311 		 * throw away cached pages inline.
312 		 */
313 		return (EIO);
314 	}
315 
316 	/*
317 	 * If we are using local locking for this filesystem, then
318 	 * release all of the SYSV style record locks.  Otherwise,
319 	 * we are doing network locking and we need to release all
320 	 * of the network locks.  All of the locks held by this
321 	 * process on this file are released no matter what the
322 	 * incoming reference count is.
323 	 */
324 	if (VTOMI(vp)->mi_flags & MI_LLOCK) {
325 		cleanlocks(vp, ttoproc(curthread)->p_pid, 0);
326 		cleanshares(vp, ttoproc(curthread)->p_pid);
327 	} else
328 		nfs_lockrelease(vp, flag, offset, cr);
329 
330 	if (count > 1)
331 		return (0);
332 
333 	/*
334 	 * If the file has been `unlinked', then purge the
335 	 * DNLC so that this vnode will get reycled quicker
336 	 * and the .nfs* file on the server will get removed.
337 	 */
338 	rp = VTOR(vp);
339 	if (rp->r_unldvp != NULL)
340 		dnlc_purge_vp(vp);
341 
342 	/*
343 	 * If the file was open for write and there are pages,
344 	 * then if the file system was mounted using the "no-close-
345 	 *	to-open" semantics, then start an asynchronous flush
346 	 *	of the all of the pages in the file.
347 	 * else the file system was not mounted using the "no-close-
348 	 *	to-open" semantics, then do a synchronous flush and
349 	 *	commit of all of the dirty and uncommitted pages.
350 	 *
351 	 * The asynchronous flush of the pages in the "nocto" path
352 	 * mostly just associates a cred pointer with the rnode so
353 	 * writes which happen later will have a better chance of
354 	 * working.  It also starts the data being written to the
355 	 * server, but without unnecessarily delaying the application.
356 	 */
357 	if ((flag & FWRITE) && vn_has_cached_data(vp)) {
358 		if ((VTOMI(vp)->mi_flags & MI_NOCTO)) {
359 			error = nfs_putpage(vp, (offset_t)0, 0, B_ASYNC, cr);
360 			if (error == EAGAIN)
361 				error = 0;
362 		} else
363 			error = nfs_putpage(vp, (offset_t)0, 0, 0, cr);
364 		if (!error) {
365 			mutex_enter(&rp->r_statelock);
366 			error = rp->r_error;
367 			rp->r_error = 0;
368 			mutex_exit(&rp->r_statelock);
369 		}
370 	} else {
371 		mutex_enter(&rp->r_statelock);
372 		error = rp->r_error;
373 		rp->r_error = 0;
374 		mutex_exit(&rp->r_statelock);
375 	}
376 
377 	/*
378 	 * If RWRITEATTR is set, then issue an over the wire GETATTR to
379 	 * refresh the attribute cache with a set of attributes which
380 	 * weren't returned from a WRITE.  This will enable the close-
381 	 * to-open processing to work.
382 	 */
383 	if (rp->r_flags & RWRITEATTR)
384 		(void) nfs_getattr_otw(vp, &va, cr);
385 
386 	return (error);
387 }
388 
389 /* ARGSUSED */
390 static int
391 nfs_read(vnode_t *vp, struct uio *uiop, int ioflag, cred_t *cr,
392 	caller_context_t *ct)
393 {
394 	rnode_t *rp;
395 	u_offset_t off;
396 	offset_t diff;
397 	int on;
398 	size_t n;
399 	caddr_t base;
400 	uint_t flags;
401 	int error;
402 	mntinfo_t *mi;
403 
404 	rp = VTOR(vp);
405 	mi = VTOMI(vp);
406 
407 	if (nfs_zone() != mi->mi_zone)
408 		return (EIO);
409 
410 	ASSERT(nfs_rw_lock_held(&rp->r_rwlock, RW_READER));
411 
412 	if (vp->v_type != VREG)
413 		return (EISDIR);
414 
415 	if (uiop->uio_resid == 0)
416 		return (0);
417 
418 	if (uiop->uio_loffset > MAXOFF32_T)
419 		return (EFBIG);
420 
421 	if (uiop->uio_loffset < 0 ||
422 	    uiop->uio_loffset + uiop->uio_resid > MAXOFF32_T)
423 		return (EINVAL);
424 
425 	/*
426 	 * Bypass VM if caching has been disabled (e.g., locking) or if
427 	 * using client-side direct I/O and the file is not mmap'd and
428 	 * there are no cached pages.
429 	 */
430 	if ((vp->v_flag & VNOCACHE) ||
431 	    (((rp->r_flags & RDIRECTIO) || (mi->mi_flags & MI_DIRECTIO)) &&
432 	    rp->r_mapcnt == 0 && !vn_has_cached_data(vp))) {
433 		size_t bufsize;
434 		size_t resid = 0;
435 
436 		/*
437 		 * Let's try to do read in as large a chunk as we can
438 		 * (Filesystem (NFS client) bsize if possible/needed).
439 		 * For V3, this is 32K and for V2, this is 8K.
440 		 */
441 		bufsize = MIN(uiop->uio_resid, VTOMI(vp)->mi_curread);
442 		base = kmem_alloc(bufsize, KM_SLEEP);
443 		do {
444 			n = MIN(uiop->uio_resid, bufsize);
445 			error = nfsread(vp, base, uiop->uio_offset, n,
446 			    &resid, cr);
447 			if (!error) {
448 				n -= resid;
449 				error = uiomove(base, n, UIO_READ, uiop);
450 			}
451 		} while (!error && uiop->uio_resid > 0 && n > 0);
452 		kmem_free(base, bufsize);
453 		return (error);
454 	}
455 
456 	error = 0;
457 
458 	do {
459 		off = uiop->uio_loffset & MAXBMASK; /* mapping offset */
460 		on = uiop->uio_loffset & MAXBOFFSET; /* Relative offset */
461 		n = MIN(MAXBSIZE - on, uiop->uio_resid);
462 
463 		error = nfs_validate_caches(vp, cr);
464 		if (error)
465 			break;
466 
467 		mutex_enter(&rp->r_statelock);
468 		diff = rp->r_size - uiop->uio_loffset;
469 		mutex_exit(&rp->r_statelock);
470 		if (diff <= 0)
471 			break;
472 		if (diff < n)
473 			n = (size_t)diff;
474 
475 		if (vpm_enable) {
476 			/*
477 			 * Copy data.
478 			 */
479 			error = vpm_data_copy(vp, off + on, n, uiop,
480 						1, NULL, 0, S_READ);
481 		} else {
482 			base = segmap_getmapflt(segkmap, vp, off + on, n,
483 								1, S_READ);
484 			error = uiomove(base + on, n, UIO_READ, uiop);
485 		}
486 
487 		if (!error) {
488 			/*
489 			 * If read a whole block or read to eof,
490 			 * won't need this buffer again soon.
491 			 */
492 			mutex_enter(&rp->r_statelock);
493 			if (n + on == MAXBSIZE ||
494 			    uiop->uio_loffset == rp->r_size)
495 				flags = SM_DONTNEED;
496 			else
497 				flags = 0;
498 			mutex_exit(&rp->r_statelock);
499 			if (vpm_enable) {
500 				error = vpm_sync_pages(vp, off, n, flags);
501 			} else {
502 				error = segmap_release(segkmap, base, flags);
503 			}
504 		} else {
505 			if (vpm_enable) {
506 				(void) vpm_sync_pages(vp, off, n, 0);
507 			} else {
508 				(void) segmap_release(segkmap, base, 0);
509 			}
510 		}
511 	} while (!error && uiop->uio_resid > 0);
512 
513 	return (error);
514 }
515 
516 /* ARGSUSED */
517 static int
518 nfs_write(vnode_t *vp, struct uio *uiop, int ioflag, cred_t *cr,
519 	caller_context_t *ct)
520 {
521 	rnode_t *rp;
522 	u_offset_t off;
523 	caddr_t base;
524 	uint_t flags;
525 	int remainder;
526 	size_t n;
527 	int on;
528 	int error;
529 	int resid;
530 	offset_t offset;
531 	rlim_t limit;
532 	mntinfo_t *mi;
533 
534 	rp = VTOR(vp);
535 
536 	mi = VTOMI(vp);
537 	if (nfs_zone() != mi->mi_zone)
538 		return (EIO);
539 	if (vp->v_type != VREG)
540 		return (EISDIR);
541 
542 	if (uiop->uio_resid == 0)
543 		return (0);
544 
545 	if (ioflag & FAPPEND) {
546 		struct vattr va;
547 
548 		/*
549 		 * Must serialize if appending.
550 		 */
551 		if (nfs_rw_lock_held(&rp->r_rwlock, RW_READER)) {
552 			nfs_rw_exit(&rp->r_rwlock);
553 			if (nfs_rw_enter_sig(&rp->r_rwlock, RW_WRITER,
554 			    INTR(vp)))
555 				return (EINTR);
556 		}
557 
558 		va.va_mask = AT_SIZE;
559 		error = nfsgetattr(vp, &va, cr);
560 		if (error)
561 			return (error);
562 		uiop->uio_loffset = va.va_size;
563 	}
564 
565 	if (uiop->uio_loffset > MAXOFF32_T)
566 		return (EFBIG);
567 
568 	offset = uiop->uio_loffset + uiop->uio_resid;
569 
570 	if (uiop->uio_loffset < 0 || offset > MAXOFF32_T)
571 		return (EINVAL);
572 
573 	if (uiop->uio_llimit > (rlim64_t)MAXOFF32_T) {
574 		limit = MAXOFF32_T;
575 	} else {
576 		limit = (rlim_t)uiop->uio_llimit;
577 	}
578 
579 	/*
580 	 * Check to make sure that the process will not exceed
581 	 * its limit on file size.  It is okay to write up to
582 	 * the limit, but not beyond.  Thus, the write which
583 	 * reaches the limit will be short and the next write
584 	 * will return an error.
585 	 */
586 	remainder = 0;
587 	if (offset > limit) {
588 		remainder = offset - limit;
589 		uiop->uio_resid = limit - uiop->uio_offset;
590 		if (uiop->uio_resid <= 0) {
591 			proc_t *p = ttoproc(curthread);
592 
593 			uiop->uio_resid += remainder;
594 			mutex_enter(&p->p_lock);
595 			(void) rctl_action(rctlproc_legacy[RLIMIT_FSIZE],
596 			    p->p_rctls, p, RCA_UNSAFE_SIGINFO);
597 			mutex_exit(&p->p_lock);
598 			return (EFBIG);
599 		}
600 	}
601 
602 	if (nfs_rw_enter_sig(&rp->r_lkserlock, RW_READER, INTR(vp)))
603 		return (EINTR);
604 
605 	/*
606 	 * Bypass VM if caching has been disabled (e.g., locking) or if
607 	 * using client-side direct I/O and the file is not mmap'd and
608 	 * there are no cached pages.
609 	 */
610 	if ((vp->v_flag & VNOCACHE) ||
611 	    (((rp->r_flags & RDIRECTIO) || (mi->mi_flags & MI_DIRECTIO)) &&
612 	    rp->r_mapcnt == 0 && !vn_has_cached_data(vp))) {
613 		size_t bufsize;
614 		int count;
615 		uint_t org_offset;
616 
617 nfs_fwrite:
618 		if (rp->r_flags & RSTALE) {
619 			resid = uiop->uio_resid;
620 			offset = uiop->uio_loffset;
621 			error = rp->r_error;
622 			goto bottom;
623 		}
624 		bufsize = MIN(uiop->uio_resid, mi->mi_curwrite);
625 		base = kmem_alloc(bufsize, KM_SLEEP);
626 		do {
627 			resid = uiop->uio_resid;
628 			offset = uiop->uio_loffset;
629 			count = MIN(uiop->uio_resid, bufsize);
630 			org_offset = uiop->uio_offset;
631 			error = uiomove(base, count, UIO_WRITE, uiop);
632 			if (!error) {
633 				error = nfswrite(vp, base, org_offset,
634 				    count, cr);
635 			}
636 		} while (!error && uiop->uio_resid > 0);
637 		kmem_free(base, bufsize);
638 		goto bottom;
639 	}
640 
641 	do {
642 		off = uiop->uio_loffset & MAXBMASK; /* mapping offset */
643 		on = uiop->uio_loffset & MAXBOFFSET; /* Relative offset */
644 		n = MIN(MAXBSIZE - on, uiop->uio_resid);
645 
646 		resid = uiop->uio_resid;
647 		offset = uiop->uio_loffset;
648 
649 		if (rp->r_flags & RSTALE) {
650 			error = rp->r_error;
651 			break;
652 		}
653 
654 		/*
655 		 * Don't create dirty pages faster than they
656 		 * can be cleaned so that the system doesn't
657 		 * get imbalanced.  If the async queue is
658 		 * maxed out, then wait for it to drain before
659 		 * creating more dirty pages.  Also, wait for
660 		 * any threads doing pagewalks in the vop_getattr
661 		 * entry points so that they don't block for
662 		 * long periods.
663 		 */
664 		mutex_enter(&rp->r_statelock);
665 		while ((mi->mi_max_threads != 0 &&
666 		    rp->r_awcount > 2 * mi->mi_max_threads) ||
667 		    rp->r_gcount > 0)
668 			cv_wait(&rp->r_cv, &rp->r_statelock);
669 		mutex_exit(&rp->r_statelock);
670 
671 		if (vpm_enable) {
672 			/*
673 			 * It will use kpm mappings, so no need to
674 			 * pass an address.
675 			 */
676 			error = writerp(rp, NULL, n, uiop, 0);
677 		} else  {
678 			if (segmap_kpm) {
679 				int pon = uiop->uio_loffset & PAGEOFFSET;
680 				size_t pn = MIN(PAGESIZE - pon,
681 							uiop->uio_resid);
682 				int pagecreate;
683 
684 				mutex_enter(&rp->r_statelock);
685 				pagecreate = (pon == 0) && (pn == PAGESIZE ||
686 					uiop->uio_loffset + pn >= rp->r_size);
687 				mutex_exit(&rp->r_statelock);
688 
689 				base = segmap_getmapflt(segkmap, vp, off + on,
690 						pn, !pagecreate, S_WRITE);
691 
692 				error = writerp(rp, base + pon, n, uiop,
693 								pagecreate);
694 
695 			} else {
696 				base = segmap_getmapflt(segkmap, vp, off + on,
697 							n, 0, S_READ);
698 				error = writerp(rp, base + on, n, uiop, 0);
699 			}
700 		}
701 
702 		if (!error) {
703 			if (mi->mi_flags & MI_NOAC)
704 				flags = SM_WRITE;
705 			else if (n + on == MAXBSIZE || IS_SWAPVP(vp)) {
706 				/*
707 				 * Have written a whole block.
708 				 * Start an asynchronous write
709 				 * and mark the buffer to
710 				 * indicate that it won't be
711 				 * needed again soon.
712 				 */
713 				flags = SM_WRITE | SM_ASYNC | SM_DONTNEED;
714 			} else
715 				flags = 0;
716 			if ((ioflag & (FSYNC|FDSYNC)) ||
717 			    (rp->r_flags & ROUTOFSPACE)) {
718 				flags &= ~SM_ASYNC;
719 				flags |= SM_WRITE;
720 			}
721 			if (vpm_enable) {
722 				error = vpm_sync_pages(vp, off, n, flags);
723 			} else {
724 				error = segmap_release(segkmap, base, flags);
725 			}
726 		} else {
727 			if (vpm_enable) {
728 				(void) vpm_sync_pages(vp, off, n, 0);
729 			} else {
730 				(void) segmap_release(segkmap, base, 0);
731 			}
732 			/*
733 			 * In the event that we got an access error while
734 			 * faulting in a page for a write-only file just
735 			 * force a write.
736 			 */
737 			if (error == EACCES)
738 				goto nfs_fwrite;
739 		}
740 	} while (!error && uiop->uio_resid > 0);
741 
742 bottom:
743 	if (error) {
744 		uiop->uio_resid = resid + remainder;
745 		uiop->uio_loffset = offset;
746 	} else
747 		uiop->uio_resid += remainder;
748 
749 	nfs_rw_exit(&rp->r_lkserlock);
750 
751 	return (error);
752 }
753 
754 /*
755  * Flags are composed of {B_ASYNC, B_INVAL, B_FREE, B_DONTNEED}
756  */
757 static int
758 nfs_rdwrlbn(vnode_t *vp, page_t *pp, u_offset_t off, size_t len,
759 	int flags, cred_t *cr)
760 {
761 	struct buf *bp;
762 	int error;
763 
764 	ASSERT(nfs_zone() == VTOMI(vp)->mi_zone);
765 	bp = pageio_setup(pp, len, vp, flags);
766 	ASSERT(bp != NULL);
767 
768 	/*
769 	 * pageio_setup should have set b_addr to 0.  This
770 	 * is correct since we want to do I/O on a page
771 	 * boundary.  bp_mapin will use this addr to calculate
772 	 * an offset, and then set b_addr to the kernel virtual
773 	 * address it allocated for us.
774 	 */
775 	ASSERT(bp->b_un.b_addr == 0);
776 
777 	bp->b_edev = 0;
778 	bp->b_dev = 0;
779 	bp->b_lblkno = lbtodb(off);
780 	bp->b_file = vp;
781 	bp->b_offset = (offset_t)off;
782 	bp_mapin(bp);
783 
784 	error = nfs_bio(bp, cr);
785 
786 	bp_mapout(bp);
787 	pageio_done(bp);
788 
789 	return (error);
790 }
791 
792 /*
793  * Write to file.  Writes to remote server in largest size
794  * chunks that the server can handle.  Write is synchronous.
795  */
796 static int
797 nfswrite(vnode_t *vp, caddr_t base, uint_t offset, int count, cred_t *cr)
798 {
799 	rnode_t *rp;
800 	mntinfo_t *mi;
801 	struct nfswriteargs wa;
802 	struct nfsattrstat ns;
803 	int error;
804 	int tsize;
805 	int douprintf;
806 
807 	douprintf = 1;
808 
809 	rp = VTOR(vp);
810 	mi = VTOMI(vp);
811 
812 	ASSERT(nfs_zone() == mi->mi_zone);
813 
814 	wa.wa_args = &wa.wa_args_buf;
815 	wa.wa_fhandle = *VTOFH(vp);
816 
817 	do {
818 		tsize = MIN(mi->mi_curwrite, count);
819 		wa.wa_data = base;
820 		wa.wa_begoff = offset;
821 		wa.wa_totcount = tsize;
822 		wa.wa_count = tsize;
823 		wa.wa_offset = offset;
824 
825 		if (mi->mi_io_kstats) {
826 			mutex_enter(&mi->mi_lock);
827 			kstat_runq_enter(KSTAT_IO_PTR(mi->mi_io_kstats));
828 			mutex_exit(&mi->mi_lock);
829 		}
830 		wa.wa_mblk = NULL;
831 		do {
832 			error = rfs2call(mi, RFS_WRITE,
833 			    xdr_writeargs, (caddr_t)&wa,
834 			    xdr_attrstat, (caddr_t)&ns, cr,
835 			    &douprintf, &ns.ns_status, 0, NULL);
836 		} while (error == ENFS_TRYAGAIN);
837 		if (mi->mi_io_kstats) {
838 			mutex_enter(&mi->mi_lock);
839 			kstat_runq_exit(KSTAT_IO_PTR(mi->mi_io_kstats));
840 			mutex_exit(&mi->mi_lock);
841 		}
842 
843 		if (!error) {
844 			error = geterrno(ns.ns_status);
845 			/*
846 			 * Can't check for stale fhandle and purge caches
847 			 * here because pages are held by nfs_getpage.
848 			 * Just mark the attribute cache as timed out
849 			 * and set RWRITEATTR to indicate that the file
850 			 * was modified with a WRITE operation.
851 			 */
852 			if (!error) {
853 				count -= tsize;
854 				base += tsize;
855 				offset += tsize;
856 				if (mi->mi_io_kstats) {
857 					mutex_enter(&mi->mi_lock);
858 				    KSTAT_IO_PTR(mi->mi_io_kstats)->writes++;
859 				    KSTAT_IO_PTR(mi->mi_io_kstats)->nwritten +=
860 					    tsize;
861 					mutex_exit(&mi->mi_lock);
862 				}
863 				lwp_stat_update(LWP_STAT_OUBLK, 1);
864 				mutex_enter(&rp->r_statelock);
865 				PURGE_ATTRCACHE_LOCKED(rp);
866 				rp->r_flags |= RWRITEATTR;
867 				mutex_exit(&rp->r_statelock);
868 			}
869 		}
870 	} while (!error && count);
871 
872 	return (error);
873 }
874 
875 /*
876  * Read from a file.  Reads data in largest chunks our interface can handle.
877  */
878 static int
879 nfsread(vnode_t *vp, caddr_t base, uint_t offset, int count, size_t *residp,
880 	cred_t *cr)
881 {
882 	mntinfo_t *mi;
883 	struct nfsreadargs ra;
884 	struct nfsrdresult rr;
885 	int tsize;
886 	int error;
887 	int douprintf;
888 	failinfo_t fi;
889 	rnode_t *rp;
890 	struct vattr va;
891 	hrtime_t t;
892 
893 	rp = VTOR(vp);
894 	mi = VTOMI(vp);
895 
896 	ASSERT(nfs_zone() == mi->mi_zone);
897 
898 	douprintf = 1;
899 
900 	ra.ra_fhandle = *VTOFH(vp);
901 
902 	fi.vp = vp;
903 	fi.fhp = (caddr_t)&ra.ra_fhandle;
904 	fi.copyproc = nfscopyfh;
905 	fi.lookupproc = nfslookup;
906 	fi.xattrdirproc = acl_getxattrdir2;
907 
908 	do {
909 		if (mi->mi_io_kstats) {
910 			mutex_enter(&mi->mi_lock);
911 			kstat_runq_enter(KSTAT_IO_PTR(mi->mi_io_kstats));
912 			mutex_exit(&mi->mi_lock);
913 		}
914 
915 		do {
916 			tsize = MIN(mi->mi_curread, count);
917 			rr.rr_data = base;
918 			ra.ra_offset = offset;
919 			ra.ra_totcount = tsize;
920 			ra.ra_count = tsize;
921 			t = gethrtime();
922 			error = rfs2call(mi, RFS_READ,
923 			    xdr_readargs, (caddr_t)&ra,
924 			    xdr_rdresult, (caddr_t)&rr, cr,
925 			    &douprintf, &rr.rr_status, 0, &fi);
926 		} while (error == ENFS_TRYAGAIN);
927 
928 		if (mi->mi_io_kstats) {
929 			mutex_enter(&mi->mi_lock);
930 			kstat_runq_exit(KSTAT_IO_PTR(mi->mi_io_kstats));
931 			mutex_exit(&mi->mi_lock);
932 		}
933 
934 		if (!error) {
935 			error = geterrno(rr.rr_status);
936 			if (!error) {
937 				count -= rr.rr_count;
938 				base += rr.rr_count;
939 				offset += rr.rr_count;
940 				if (mi->mi_io_kstats) {
941 					mutex_enter(&mi->mi_lock);
942 					KSTAT_IO_PTR(mi->mi_io_kstats)->reads++;
943 					KSTAT_IO_PTR(mi->mi_io_kstats)->nread +=
944 					    rr.rr_count;
945 					mutex_exit(&mi->mi_lock);
946 				}
947 				lwp_stat_update(LWP_STAT_INBLK, 1);
948 			}
949 		}
950 	} while (!error && count && rr.rr_count == tsize);
951 
952 	*residp = count;
953 
954 	if (!error) {
955 		/*
956 		 * Since no error occurred, we have the current
957 		 * attributes and we need to do a cache check and then
958 		 * potentially update the cached attributes.  We can't
959 		 * use the normal attribute check and cache mechanisms
960 		 * because they might cause a cache flush which would
961 		 * deadlock.  Instead, we just check the cache to see
962 		 * if the attributes have changed.  If it is, then we
963 		 * just mark the attributes as out of date.  The next
964 		 * time that the attributes are checked, they will be
965 		 * out of date, new attributes will be fetched, and
966 		 * the page cache will be flushed.  If the attributes
967 		 * weren't changed, then we just update the cached
968 		 * attributes with these attributes.
969 		 */
970 		/*
971 		 * If NFS_ACL is supported on the server, then the
972 		 * attributes returned by server may have minimal
973 		 * permissions sometimes denying access to users having
974 		 * proper access.  To get the proper attributes, mark
975 		 * the attributes as expired so that they will be
976 		 * regotten via the NFS_ACL GETATTR2 procedure.
977 		 */
978 		error = nattr_to_vattr(vp, &rr.rr_attr, &va);
979 		mutex_enter(&rp->r_statelock);
980 		if (error || !CACHE_VALID(rp, va.va_mtime, va.va_size) ||
981 		    (mi->mi_flags & MI_ACL)) {
982 			mutex_exit(&rp->r_statelock);
983 			PURGE_ATTRCACHE(vp);
984 		} else {
985 			if (rp->r_mtime <= t) {
986 				nfs_attrcache_va(vp, &va);
987 			}
988 			mutex_exit(&rp->r_statelock);
989 		}
990 	}
991 
992 	return (error);
993 }
994 
995 /* ARGSUSED */
996 static int
997 nfs_ioctl(vnode_t *vp, int cmd, intptr_t arg, int flag, cred_t *cr, int *rvalp)
998 {
999 
1000 	if (nfs_zone() != VTOMI(vp)->mi_zone)
1001 		return (EIO);
1002 	switch (cmd) {
1003 		case _FIODIRECTIO:
1004 			return (nfs_directio(vp, (int)arg, cr));
1005 		default:
1006 			return (ENOTTY);
1007 	}
1008 }
1009 
1010 static int
1011 nfs_getattr(vnode_t *vp, struct vattr *vap, int flags, cred_t *cr)
1012 {
1013 	int error;
1014 	rnode_t *rp;
1015 
1016 	if (nfs_zone() != VTOMI(vp)->mi_zone)
1017 		return (EIO);
1018 	/*
1019 	 * If it has been specified that the return value will
1020 	 * just be used as a hint, and we are only being asked
1021 	 * for size, fsid or rdevid, then return the client's
1022 	 * notion of these values without checking to make sure
1023 	 * that the attribute cache is up to date.
1024 	 * The whole point is to avoid an over the wire GETATTR
1025 	 * call.
1026 	 */
1027 	rp = VTOR(vp);
1028 	if (flags & ATTR_HINT) {
1029 		if (vap->va_mask ==
1030 		    (vap->va_mask & (AT_SIZE | AT_FSID | AT_RDEV))) {
1031 			mutex_enter(&rp->r_statelock);
1032 			if (vap->va_mask | AT_SIZE)
1033 				vap->va_size = rp->r_size;
1034 			if (vap->va_mask | AT_FSID)
1035 				vap->va_fsid = rp->r_attr.va_fsid;
1036 			if (vap->va_mask | AT_RDEV)
1037 				vap->va_rdev = rp->r_attr.va_rdev;
1038 			mutex_exit(&rp->r_statelock);
1039 			return (0);
1040 		}
1041 	}
1042 
1043 	/*
1044 	 * Only need to flush pages if asking for the mtime
1045 	 * and if there any dirty pages or any outstanding
1046 	 * asynchronous (write) requests for this file.
1047 	 */
1048 	if (vap->va_mask & AT_MTIME) {
1049 		if (vn_has_cached_data(vp) &&
1050 		    ((rp->r_flags & RDIRTY) || rp->r_awcount > 0)) {
1051 			mutex_enter(&rp->r_statelock);
1052 			rp->r_gcount++;
1053 			mutex_exit(&rp->r_statelock);
1054 			error = nfs_putpage(vp, (offset_t)0, 0, 0, cr);
1055 			mutex_enter(&rp->r_statelock);
1056 			if (error && (error == ENOSPC || error == EDQUOT)) {
1057 				if (!rp->r_error)
1058 					rp->r_error = error;
1059 			}
1060 			if (--rp->r_gcount == 0)
1061 				cv_broadcast(&rp->r_cv);
1062 			mutex_exit(&rp->r_statelock);
1063 		}
1064 	}
1065 
1066 	return (nfsgetattr(vp, vap, cr));
1067 }
1068 
1069 /*ARGSUSED4*/
1070 static int
1071 nfs_setattr(vnode_t *vp, struct vattr *vap, int flags, cred_t *cr,
1072 		caller_context_t *ct)
1073 {
1074 	int error;
1075 	uint_t mask;
1076 	struct vattr va;
1077 
1078 	mask = vap->va_mask;
1079 
1080 	if (mask & AT_NOSET)
1081 		return (EINVAL);
1082 
1083 	if ((mask & AT_SIZE) &&
1084 	    vap->va_type == VREG &&
1085 	    vap->va_size > MAXOFF32_T)
1086 		return (EFBIG);
1087 
1088 	if (nfs_zone() != VTOMI(vp)->mi_zone)
1089 		return (EIO);
1090 
1091 	va.va_mask = AT_UID | AT_MODE;
1092 
1093 	error = nfsgetattr(vp, &va, cr);
1094 	if (error)
1095 		return (error);
1096 
1097 	error = secpolicy_vnode_setattr(cr, vp, vap, &va, flags, nfs_accessx,
1098 			vp);
1099 
1100 	if (error)
1101 		return (error);
1102 
1103 	return (nfssetattr(vp, vap, flags, cr));
1104 }
1105 
1106 static int
1107 nfssetattr(vnode_t *vp, struct vattr *vap, int flags, cred_t *cr)
1108 {
1109 	int error;
1110 	uint_t mask;
1111 	struct nfssaargs args;
1112 	struct nfsattrstat ns;
1113 	int douprintf;
1114 	rnode_t *rp;
1115 	struct vattr va;
1116 	mode_t omode;
1117 	mntinfo_t *mi;
1118 	vsecattr_t *vsp;
1119 	hrtime_t t;
1120 
1121 	mask = vap->va_mask;
1122 
1123 	ASSERT(nfs_zone() == VTOMI(vp)->mi_zone);
1124 
1125 	rp = VTOR(vp);
1126 
1127 	/*
1128 	 * Only need to flush pages if there are any pages and
1129 	 * if the file is marked as dirty in some fashion.  The
1130 	 * file must be flushed so that we can accurately
1131 	 * determine the size of the file and the cached data
1132 	 * after the SETATTR returns.  A file is considered to
1133 	 * be dirty if it is either marked with RDIRTY, has
1134 	 * outstanding i/o's active, or is mmap'd.  In this
1135 	 * last case, we can't tell whether there are dirty
1136 	 * pages, so we flush just to be sure.
1137 	 */
1138 	if (vn_has_cached_data(vp) &&
1139 	    ((rp->r_flags & RDIRTY) ||
1140 	    rp->r_count > 0 ||
1141 	    rp->r_mapcnt > 0)) {
1142 		ASSERT(vp->v_type != VCHR);
1143 		error = nfs_putpage(vp, (offset_t)0, 0, 0, cr);
1144 		if (error && (error == ENOSPC || error == EDQUOT)) {
1145 			mutex_enter(&rp->r_statelock);
1146 			if (!rp->r_error)
1147 				rp->r_error = error;
1148 			mutex_exit(&rp->r_statelock);
1149 		}
1150 	}
1151 
1152 	/*
1153 	 * If the system call was utime(2) or utimes(2) and the
1154 	 * application did not specify the times, then set the
1155 	 * mtime nanosecond field to 1 billion.  This will get
1156 	 * translated from 1 billion nanoseconds to 1 million
1157 	 * microseconds in the over the wire request.  The
1158 	 * server will use 1 million in the microsecond field
1159 	 * to tell whether both the mtime and atime should be
1160 	 * set to the server's current time.
1161 	 *
1162 	 * This is an overload of the protocol and should be
1163 	 * documented in the NFS Version 2 protocol specification.
1164 	 */
1165 	if ((mask & AT_MTIME) && !(flags & ATTR_UTIME)) {
1166 		vap->va_mtime.tv_nsec = 1000000000;
1167 		if (NFS_TIME_T_OK(vap->va_mtime.tv_sec) &&
1168 		    NFS_TIME_T_OK(vap->va_atime.tv_sec)) {
1169 			error = vattr_to_sattr(vap, &args.saa_sa);
1170 		} else {
1171 			/*
1172 			 * Use server times. vap time values will not be used.
1173 			 * To ensure no time overflow, make sure vap has
1174 			 * valid values, but retain the original values.
1175 			 */
1176 			timestruc_t	mtime = vap->va_mtime;
1177 			timestruc_t	atime = vap->va_atime;
1178 			time_t		now;
1179 
1180 			now = gethrestime_sec();
1181 			if (NFS_TIME_T_OK(now)) {
1182 				/* Just in case server does not know of this */
1183 				vap->va_mtime.tv_sec = now;
1184 				vap->va_atime.tv_sec = now;
1185 			} else {
1186 				vap->va_mtime.tv_sec = 0;
1187 				vap->va_atime.tv_sec = 0;
1188 			}
1189 			error = vattr_to_sattr(vap, &args.saa_sa);
1190 			/* set vap times back on */
1191 			vap->va_mtime = mtime;
1192 			vap->va_atime = atime;
1193 		}
1194 	} else {
1195 		/* Either do not set times or use the client specified times */
1196 		error = vattr_to_sattr(vap, &args.saa_sa);
1197 	}
1198 	if (error) {
1199 		/* req time field(s) overflow - return immediately */
1200 		return (error);
1201 	}
1202 	args.saa_fh = *VTOFH(vp);
1203 
1204 	va.va_mask = AT_MODE;
1205 	error = nfsgetattr(vp, &va, cr);
1206 	if (error)
1207 		return (error);
1208 	omode = va.va_mode;
1209 
1210 	mi = VTOMI(vp);
1211 
1212 	douprintf = 1;
1213 
1214 	t = gethrtime();
1215 
1216 	error = rfs2call(mi, RFS_SETATTR,
1217 	    xdr_saargs, (caddr_t)&args,
1218 	    xdr_attrstat, (caddr_t)&ns, cr,
1219 	    &douprintf, &ns.ns_status, 0, NULL);
1220 
1221 	/*
1222 	 * Purge the access cache and ACL cache if changing either the
1223 	 * owner of the file, the group owner, or the mode.  These may
1224 	 * change the access permissions of the file, so purge old
1225 	 * information and start over again.
1226 	 */
1227 	if ((mask & (AT_UID | AT_GID | AT_MODE)) && (mi->mi_flags & MI_ACL)) {
1228 		(void) nfs_access_purge_rp(rp);
1229 		if (rp->r_secattr != NULL) {
1230 			mutex_enter(&rp->r_statelock);
1231 			vsp = rp->r_secattr;
1232 			rp->r_secattr = NULL;
1233 			mutex_exit(&rp->r_statelock);
1234 			if (vsp != NULL)
1235 				nfs_acl_free(vsp);
1236 		}
1237 	}
1238 
1239 	if (!error) {
1240 		error = geterrno(ns.ns_status);
1241 		if (!error) {
1242 			/*
1243 			 * If changing the size of the file, invalidate
1244 			 * any local cached data which is no longer part
1245 			 * of the file.  We also possibly invalidate the
1246 			 * last page in the file.  We could use
1247 			 * pvn_vpzero(), but this would mark the page as
1248 			 * modified and require it to be written back to
1249 			 * the server for no particularly good reason.
1250 			 * This way, if we access it, then we bring it
1251 			 * back in.  A read should be cheaper than a
1252 			 * write.
1253 			 */
1254 			if (mask & AT_SIZE) {
1255 				nfs_invalidate_pages(vp,
1256 				    (vap->va_size & PAGEMASK), cr);
1257 			}
1258 			(void) nfs_cache_fattr(vp, &ns.ns_attr, &va, t, cr);
1259 			/*
1260 			 * If NFS_ACL is supported on the server, then the
1261 			 * attributes returned by server may have minimal
1262 			 * permissions sometimes denying access to users having
1263 			 * proper access.  To get the proper attributes, mark
1264 			 * the attributes as expired so that they will be
1265 			 * regotten via the NFS_ACL GETATTR2 procedure.
1266 			 */
1267 			if (mi->mi_flags & MI_ACL) {
1268 				PURGE_ATTRCACHE(vp);
1269 			}
1270 			/*
1271 			 * This next check attempts to deal with NFS
1272 			 * servers which can not handle increasing
1273 			 * the size of the file via setattr.  Most
1274 			 * of these servers do not return an error,
1275 			 * but do not change the size of the file.
1276 			 * Hence, this check and then attempt to set
1277 			 * the file size by writing 1 byte at the
1278 			 * offset of the end of the file that we need.
1279 			 */
1280 			if ((mask & AT_SIZE) &&
1281 			    ns.ns_attr.na_size < (uint32_t)vap->va_size) {
1282 				char zb = '\0';
1283 
1284 				error = nfswrite(vp, &zb,
1285 				    vap->va_size - sizeof (zb),
1286 				    sizeof (zb), cr);
1287 			}
1288 			/*
1289 			 * Some servers will change the mode to clear the setuid
1290 			 * and setgid bits when changing the uid or gid.  The
1291 			 * client needs to compensate appropriately.
1292 			 */
1293 			if (mask & (AT_UID | AT_GID)) {
1294 				int terror;
1295 
1296 				va.va_mask = AT_MODE;
1297 				terror = nfsgetattr(vp, &va, cr);
1298 				if (!terror &&
1299 				    (((mask & AT_MODE) &&
1300 				    va.va_mode != vap->va_mode) ||
1301 				    (!(mask & AT_MODE) &&
1302 				    va.va_mode != omode))) {
1303 					va.va_mask = AT_MODE;
1304 					if (mask & AT_MODE)
1305 						va.va_mode = vap->va_mode;
1306 					else
1307 						va.va_mode = omode;
1308 					(void) nfssetattr(vp, &va, 0, cr);
1309 				}
1310 			}
1311 		} else {
1312 			PURGE_ATTRCACHE(vp);
1313 			PURGE_STALE_FH(error, vp, cr);
1314 		}
1315 	} else {
1316 		PURGE_ATTRCACHE(vp);
1317 	}
1318 
1319 	return (error);
1320 }
1321 
1322 static int
1323 nfs_accessx(void *vp, int mode, cred_t *cr)
1324 {
1325 	ASSERT(nfs_zone() == VTOMI((vnode_t *)vp)->mi_zone);
1326 	return (nfs_access(vp, mode, 0, cr));
1327 }
1328 
1329 static int
1330 nfs_access(vnode_t *vp, int mode, int flags, cred_t *cr)
1331 {
1332 	struct vattr va;
1333 	int error;
1334 	mntinfo_t *mi;
1335 	int shift = 0;
1336 
1337 	mi = VTOMI(vp);
1338 
1339 	if (nfs_zone() != mi->mi_zone)
1340 		return (EIO);
1341 	if (mi->mi_flags & MI_ACL) {
1342 		error = acl_access2(vp, mode, flags, cr);
1343 		if (mi->mi_flags & MI_ACL)
1344 			return (error);
1345 	}
1346 
1347 	va.va_mask = AT_MODE | AT_UID | AT_GID;
1348 	error = nfsgetattr(vp, &va, cr);
1349 	if (error)
1350 		return (error);
1351 
1352 	/*
1353 	 * Disallow write attempts on read-only
1354 	 * file systems, unless the file is a
1355 	 * device node.
1356 	 */
1357 	if ((mode & VWRITE) && vn_is_readonly(vp) && !IS_DEVVP(vp))
1358 		return (EROFS);
1359 
1360 	/*
1361 	 * Disallow attempts to access mandatory lock files.
1362 	 */
1363 	if ((mode & (VWRITE | VREAD | VEXEC)) &&
1364 	    MANDLOCK(vp, va.va_mode))
1365 		return (EACCES);
1366 
1367 	/*
1368 	 * Access check is based on only
1369 	 * one of owner, group, public.
1370 	 * If not owner, then check group.
1371 	 * If not a member of the group,
1372 	 * then check public access.
1373 	 */
1374 	if (crgetuid(cr) != va.va_uid) {
1375 		shift += 3;
1376 		if (!groupmember(va.va_gid, cr))
1377 			shift += 3;
1378 	}
1379 found:
1380 	mode &= ~(va.va_mode << shift);
1381 	if (mode == 0)
1382 		return (0);
1383 
1384 	return (secpolicy_vnode_access(cr, vp, va.va_uid, mode));
1385 }
1386 
1387 static int nfs_do_symlink_cache = 1;
1388 
1389 static int
1390 nfs_readlink(vnode_t *vp, struct uio *uiop, cred_t *cr)
1391 {
1392 	int error;
1393 	struct nfsrdlnres rl;
1394 	rnode_t *rp;
1395 	int douprintf;
1396 	failinfo_t fi;
1397 
1398 	/*
1399 	 * We want to be consistent with UFS semantics so we will return
1400 	 * EINVAL instead of ENXIO. This violates the XNFS spec and
1401 	 * the RFC 1094, which are wrong any way. BUGID 1138002.
1402 	 */
1403 	if (vp->v_type != VLNK)
1404 		return (EINVAL);
1405 
1406 	if (nfs_zone() != VTOMI(vp)->mi_zone)
1407 		return (EIO);
1408 
1409 	rp = VTOR(vp);
1410 	if (nfs_do_symlink_cache && rp->r_symlink.contents != NULL) {
1411 		error = nfs_validate_caches(vp, cr);
1412 		if (error)
1413 			return (error);
1414 		mutex_enter(&rp->r_statelock);
1415 		if (rp->r_symlink.contents != NULL) {
1416 			error = uiomove(rp->r_symlink.contents,
1417 			    rp->r_symlink.len, UIO_READ, uiop);
1418 			mutex_exit(&rp->r_statelock);
1419 			return (error);
1420 		}
1421 		mutex_exit(&rp->r_statelock);
1422 	}
1423 
1424 
1425 	rl.rl_data = kmem_alloc(NFS_MAXPATHLEN, KM_SLEEP);
1426 
1427 	fi.vp = vp;
1428 	fi.fhp = NULL;		/* no need to update, filehandle not copied */
1429 	fi.copyproc = nfscopyfh;
1430 	fi.lookupproc = nfslookup;
1431 	fi.xattrdirproc = acl_getxattrdir2;
1432 
1433 	douprintf = 1;
1434 
1435 	error = rfs2call(VTOMI(vp), RFS_READLINK,
1436 	    xdr_fhandle, (caddr_t)VTOFH(vp),
1437 	    xdr_rdlnres, (caddr_t)&rl, cr,
1438 	    &douprintf, &rl.rl_status, 0, &fi);
1439 
1440 	if (error) {
1441 
1442 		kmem_free((void *)rl.rl_data, NFS_MAXPATHLEN);
1443 		return (error);
1444 	}
1445 
1446 	error = geterrno(rl.rl_status);
1447 	if (!error) {
1448 		error = uiomove(rl.rl_data, (int)rl.rl_count, UIO_READ, uiop);
1449 		if (nfs_do_symlink_cache && rp->r_symlink.contents == NULL) {
1450 			mutex_enter(&rp->r_statelock);
1451 			if (rp->r_symlink.contents == NULL) {
1452 				rp->r_symlink.contents = rl.rl_data;
1453 				rp->r_symlink.len = (int)rl.rl_count;
1454 				rp->r_symlink.size = NFS_MAXPATHLEN;
1455 				mutex_exit(&rp->r_statelock);
1456 			} else {
1457 				mutex_exit(&rp->r_statelock);
1458 
1459 				kmem_free((void *)rl.rl_data,
1460 				    NFS_MAXPATHLEN);
1461 			}
1462 		} else {
1463 
1464 			kmem_free((void *)rl.rl_data, NFS_MAXPATHLEN);
1465 		}
1466 	} else {
1467 		PURGE_STALE_FH(error, vp, cr);
1468 
1469 		kmem_free((void *)rl.rl_data, NFS_MAXPATHLEN);
1470 	}
1471 
1472 	/*
1473 	 * Conform to UFS semantics (see comment above)
1474 	 */
1475 	return (error == ENXIO ? EINVAL : error);
1476 }
1477 
1478 /*
1479  * Flush local dirty pages to stable storage on the server.
1480  *
1481  * If FNODSYNC is specified, then there is nothing to do because
1482  * metadata changes are not cached on the client before being
1483  * sent to the server.
1484  */
1485 static int
1486 nfs_fsync(vnode_t *vp, int syncflag, cred_t *cr)
1487 {
1488 	int error;
1489 
1490 	if ((syncflag & FNODSYNC) || IS_SWAPVP(vp))
1491 		return (0);
1492 
1493 	if (nfs_zone() != VTOMI(vp)->mi_zone)
1494 		return (EIO);
1495 
1496 	error = nfs_putpage(vp, (offset_t)0, 0, 0, cr);
1497 	if (!error)
1498 		error = VTOR(vp)->r_error;
1499 	return (error);
1500 }
1501 
1502 
1503 /*
1504  * Weirdness: if the file was removed or the target of a rename
1505  * operation while it was open, it got renamed instead.  Here we
1506  * remove the renamed file.
1507  */
1508 static void
1509 nfs_inactive(vnode_t *vp, cred_t *cr)
1510 {
1511 	rnode_t *rp;
1512 
1513 	ASSERT(vp != DNLC_NO_VNODE);
1514 
1515 	/*
1516 	 * If this is coming from the wrong zone, we let someone in the right
1517 	 * zone take care of it asynchronously.  We can get here due to
1518 	 * VN_RELE() being called from pageout() or fsflush().  This call may
1519 	 * potentially turn into an expensive no-op if, for instance, v_count
1520 	 * gets incremented in the meantime, but it's still correct.
1521 	 */
1522 	if (nfs_zone() != VTOMI(vp)->mi_zone) {
1523 		nfs_async_inactive(vp, cr, nfs_inactive);
1524 		return;
1525 	}
1526 
1527 	rp = VTOR(vp);
1528 redo:
1529 	if (rp->r_unldvp != NULL) {
1530 		/*
1531 		 * Save the vnode pointer for the directory where the
1532 		 * unlinked-open file got renamed, then set it to NULL
1533 		 * to prevent another thread from getting here before
1534 		 * we're done with the remove.  While we have the
1535 		 * statelock, make local copies of the pertinent rnode
1536 		 * fields.  If we weren't to do this in an atomic way, the
1537 		 * the unl* fields could become inconsistent with respect
1538 		 * to each other due to a race condition between this
1539 		 * code and nfs_remove().  See bug report 1034328.
1540 		 */
1541 		mutex_enter(&rp->r_statelock);
1542 		if (rp->r_unldvp != NULL) {
1543 			vnode_t *unldvp;
1544 			char *unlname;
1545 			cred_t *unlcred;
1546 			struct nfsdiropargs da;
1547 			enum nfsstat status;
1548 			int douprintf;
1549 			int error;
1550 
1551 			unldvp = rp->r_unldvp;
1552 			rp->r_unldvp = NULL;
1553 			unlname = rp->r_unlname;
1554 			rp->r_unlname = NULL;
1555 			unlcred = rp->r_unlcred;
1556 			rp->r_unlcred = NULL;
1557 			mutex_exit(&rp->r_statelock);
1558 
1559 			/*
1560 			 * If there are any dirty pages left, then flush
1561 			 * them.  This is unfortunate because they just
1562 			 * may get thrown away during the remove operation,
1563 			 * but we have to do this for correctness.
1564 			 */
1565 			if (vn_has_cached_data(vp) &&
1566 			    ((rp->r_flags & RDIRTY) || rp->r_count > 0)) {
1567 				ASSERT(vp->v_type != VCHR);
1568 				error = nfs_putpage(vp, (offset_t)0, 0, 0, cr);
1569 				if (error) {
1570 					mutex_enter(&rp->r_statelock);
1571 					if (!rp->r_error)
1572 						rp->r_error = error;
1573 					mutex_exit(&rp->r_statelock);
1574 				}
1575 			}
1576 
1577 			/*
1578 			 * Do the remove operation on the renamed file
1579 			 */
1580 			setdiropargs(&da, unlname, unldvp);
1581 
1582 			douprintf = 1;
1583 
1584 			(void) rfs2call(VTOMI(unldvp), RFS_REMOVE,
1585 			    xdr_diropargs, (caddr_t)&da,
1586 			    xdr_enum, (caddr_t)&status, unlcred,
1587 			    &douprintf, &status, 0, NULL);
1588 
1589 			if (HAVE_RDDIR_CACHE(VTOR(unldvp)))
1590 				nfs_purge_rddir_cache(unldvp);
1591 			PURGE_ATTRCACHE(unldvp);
1592 
1593 			/*
1594 			 * Release stuff held for the remove
1595 			 */
1596 			VN_RELE(unldvp);
1597 			kmem_free(unlname, MAXNAMELEN);
1598 			crfree(unlcred);
1599 			goto redo;
1600 		}
1601 		mutex_exit(&rp->r_statelock);
1602 	}
1603 
1604 	rp_addfree(rp, cr);
1605 }
1606 
1607 /*
1608  * Remote file system operations having to do with directory manipulation.
1609  */
1610 
1611 static int
1612 nfs_lookup(vnode_t *dvp, char *nm, vnode_t **vpp, struct pathname *pnp,
1613 	int flags, vnode_t *rdir, cred_t *cr)
1614 {
1615 	int error;
1616 	vnode_t *vp;
1617 	vnode_t *avp = NULL;
1618 	rnode_t *drp;
1619 
1620 	if (nfs_zone() != VTOMI(dvp)->mi_zone)
1621 		return (EPERM);
1622 
1623 	drp = VTOR(dvp);
1624 
1625 	/*
1626 	 * Are we looking up extended attributes?  If so, "dvp" is
1627 	 * the file or directory for which we want attributes, and
1628 	 * we need a lookup of the hidden attribute directory
1629 	 * before we lookup the rest of the path.
1630 	 */
1631 	if (flags & LOOKUP_XATTR) {
1632 		bool_t cflag = ((flags & CREATE_XATTR_DIR) != 0);
1633 		mntinfo_t *mi;
1634 
1635 		mi = VTOMI(dvp);
1636 		if (!(mi->mi_flags & MI_EXTATTR))
1637 			return (EINVAL);
1638 
1639 		if (nfs_rw_enter_sig(&drp->r_rwlock, RW_READER, INTR(dvp)))
1640 			return (EINTR);
1641 
1642 		(void) nfslookup_dnlc(dvp, XATTR_DIR_NAME, &avp, cr);
1643 		if (avp == NULL)
1644 			error = acl_getxattrdir2(dvp, &avp, cflag, cr, 0);
1645 		else
1646 			error = 0;
1647 
1648 		nfs_rw_exit(&drp->r_rwlock);
1649 
1650 		if (error) {
1651 			if (mi->mi_flags & MI_EXTATTR)
1652 				return (error);
1653 			return (EINVAL);
1654 		}
1655 		dvp = avp;
1656 		drp = VTOR(dvp);
1657 	}
1658 
1659 	if (nfs_rw_enter_sig(&drp->r_rwlock, RW_READER, INTR(dvp))) {
1660 		error = EINTR;
1661 		goto out;
1662 	}
1663 
1664 	error = nfslookup(dvp, nm, vpp, pnp, flags, rdir, cr, 0);
1665 
1666 	nfs_rw_exit(&drp->r_rwlock);
1667 
1668 	/*
1669 	 * If vnode is a device, create special vnode.
1670 	 */
1671 	if (!error && IS_DEVVP(*vpp)) {
1672 		vp = *vpp;
1673 		*vpp = specvp(vp, vp->v_rdev, vp->v_type, cr);
1674 		VN_RELE(vp);
1675 	}
1676 
1677 out:
1678 	if (avp != NULL)
1679 		VN_RELE(avp);
1680 
1681 	return (error);
1682 }
1683 
1684 static int nfs_lookup_neg_cache = 1;
1685 
1686 #ifdef DEBUG
1687 static int nfs_lookup_dnlc_hits = 0;
1688 static int nfs_lookup_dnlc_misses = 0;
1689 static int nfs_lookup_dnlc_neg_hits = 0;
1690 static int nfs_lookup_dnlc_disappears = 0;
1691 static int nfs_lookup_dnlc_lookups = 0;
1692 #endif
1693 
1694 /* ARGSUSED */
1695 int
1696 nfslookup(vnode_t *dvp, char *nm, vnode_t **vpp, struct pathname *pnp,
1697 	int flags, vnode_t *rdir, cred_t *cr, int rfscall_flags)
1698 {
1699 	int error;
1700 
1701 	ASSERT(nfs_zone() == VTOMI(dvp)->mi_zone);
1702 
1703 	/*
1704 	 * If lookup is for "", just return dvp.  Don't need
1705 	 * to send it over the wire, look it up in the dnlc,
1706 	 * or perform any access checks.
1707 	 */
1708 	if (*nm == '\0') {
1709 		VN_HOLD(dvp);
1710 		*vpp = dvp;
1711 		return (0);
1712 	}
1713 
1714 	/*
1715 	 * Can't do lookups in non-directories.
1716 	 */
1717 	if (dvp->v_type != VDIR)
1718 		return (ENOTDIR);
1719 
1720 	/*
1721 	 * If we're called with RFSCALL_SOFT, it's important that
1722 	 * the only rfscall is one we make directly; if we permit
1723 	 * an access call because we're looking up "." or validating
1724 	 * a dnlc hit, we'll deadlock because that rfscall will not
1725 	 * have the RFSCALL_SOFT set.
1726 	 */
1727 	if (rfscall_flags & RFSCALL_SOFT)
1728 		goto callit;
1729 
1730 	/*
1731 	 * If lookup is for ".", just return dvp.  Don't need
1732 	 * to send it over the wire or look it up in the dnlc,
1733 	 * just need to check access.
1734 	 */
1735 	if (strcmp(nm, ".") == 0) {
1736 		error = nfs_access(dvp, VEXEC, 0, cr);
1737 		if (error)
1738 			return (error);
1739 		VN_HOLD(dvp);
1740 		*vpp = dvp;
1741 		return (0);
1742 	}
1743 
1744 	/*
1745 	 * Lookup this name in the DNLC.  If there was a valid entry,
1746 	 * then return the results of the lookup.
1747 	 */
1748 	error = nfslookup_dnlc(dvp, nm, vpp, cr);
1749 	if (error || *vpp != NULL)
1750 		return (error);
1751 
1752 callit:
1753 	error = nfslookup_otw(dvp, nm, vpp, cr, rfscall_flags);
1754 
1755 	return (error);
1756 }
1757 
1758 static int
1759 nfslookup_dnlc(vnode_t *dvp, char *nm, vnode_t **vpp, cred_t *cr)
1760 {
1761 	int error;
1762 	vnode_t *vp;
1763 
1764 	ASSERT(*nm != '\0');
1765 	ASSERT(nfs_zone() == VTOMI(dvp)->mi_zone);
1766 
1767 	/*
1768 	 * Lookup this name in the DNLC.  If successful, then validate
1769 	 * the caches and then recheck the DNLC.  The DNLC is rechecked
1770 	 * just in case this entry got invalidated during the call
1771 	 * to nfs_validate_caches.
1772 	 *
1773 	 * An assumption is being made that it is safe to say that a
1774 	 * file exists which may not on the server.  Any operations to
1775 	 * the server will fail with ESTALE.
1776 	 */
1777 #ifdef DEBUG
1778 	nfs_lookup_dnlc_lookups++;
1779 #endif
1780 	vp = dnlc_lookup(dvp, nm);
1781 	if (vp != NULL) {
1782 		VN_RELE(vp);
1783 		if (vp == DNLC_NO_VNODE && !vn_is_readonly(dvp)) {
1784 			PURGE_ATTRCACHE(dvp);
1785 		}
1786 		error = nfs_validate_caches(dvp, cr);
1787 		if (error)
1788 			return (error);
1789 		vp = dnlc_lookup(dvp, nm);
1790 		if (vp != NULL) {
1791 			error = nfs_access(dvp, VEXEC, 0, cr);
1792 			if (error) {
1793 				VN_RELE(vp);
1794 				return (error);
1795 			}
1796 			if (vp == DNLC_NO_VNODE) {
1797 				VN_RELE(vp);
1798 #ifdef DEBUG
1799 				nfs_lookup_dnlc_neg_hits++;
1800 #endif
1801 				return (ENOENT);
1802 			}
1803 			*vpp = vp;
1804 #ifdef DEBUG
1805 			nfs_lookup_dnlc_hits++;
1806 #endif
1807 			return (0);
1808 		}
1809 #ifdef DEBUG
1810 		nfs_lookup_dnlc_disappears++;
1811 #endif
1812 	}
1813 #ifdef DEBUG
1814 	else
1815 		nfs_lookup_dnlc_misses++;
1816 #endif
1817 
1818 	*vpp = NULL;
1819 
1820 	return (0);
1821 }
1822 
1823 static int
1824 nfslookup_otw(vnode_t *dvp, char *nm, vnode_t **vpp, cred_t *cr,
1825 	int rfscall_flags)
1826 {
1827 	int error;
1828 	struct nfsdiropargs da;
1829 	struct nfsdiropres dr;
1830 	int douprintf;
1831 	failinfo_t fi;
1832 	hrtime_t t;
1833 
1834 	ASSERT(*nm != '\0');
1835 	ASSERT(dvp->v_type == VDIR);
1836 	ASSERT(nfs_zone() == VTOMI(dvp)->mi_zone);
1837 
1838 	setdiropargs(&da, nm, dvp);
1839 
1840 	fi.vp = dvp;
1841 	fi.fhp = NULL;		/* no need to update, filehandle not copied */
1842 	fi.copyproc = nfscopyfh;
1843 	fi.lookupproc = nfslookup;
1844 	fi.xattrdirproc = acl_getxattrdir2;
1845 
1846 	douprintf = 1;
1847 
1848 	t = gethrtime();
1849 
1850 	error = rfs2call(VTOMI(dvp), RFS_LOOKUP,
1851 	    xdr_diropargs, (caddr_t)&da,
1852 	    xdr_diropres, (caddr_t)&dr, cr,
1853 	    &douprintf, &dr.dr_status, rfscall_flags, &fi);
1854 
1855 	if (!error) {
1856 		error = geterrno(dr.dr_status);
1857 		if (!error) {
1858 			*vpp = makenfsnode(&dr.dr_fhandle, &dr.dr_attr,
1859 			    dvp->v_vfsp, t, cr, VTOR(dvp)->r_path, nm);
1860 			/*
1861 			 * If NFS_ACL is supported on the server, then the
1862 			 * attributes returned by server may have minimal
1863 			 * permissions sometimes denying access to users having
1864 			 * proper access.  To get the proper attributes, mark
1865 			 * the attributes as expired so that they will be
1866 			 * regotten via the NFS_ACL GETATTR2 procedure.
1867 			 */
1868 			if (VTOMI(*vpp)->mi_flags & MI_ACL) {
1869 				PURGE_ATTRCACHE(*vpp);
1870 			}
1871 			if (!(rfscall_flags & RFSCALL_SOFT))
1872 				dnlc_update(dvp, nm, *vpp);
1873 		} else {
1874 			PURGE_STALE_FH(error, dvp, cr);
1875 			if (error == ENOENT && nfs_lookup_neg_cache)
1876 				dnlc_enter(dvp, nm, DNLC_NO_VNODE);
1877 		}
1878 	}
1879 
1880 	return (error);
1881 }
1882 
1883 /* ARGSUSED */
1884 static int
1885 nfs_create(vnode_t *dvp, char *nm, struct vattr *va, enum vcexcl exclusive,
1886 	int mode, vnode_t **vpp, cred_t *cr, int lfaware)
1887 {
1888 	int error;
1889 	struct nfscreatargs args;
1890 	struct nfsdiropres dr;
1891 	int douprintf;
1892 	vnode_t *vp;
1893 	rnode_t *rp;
1894 	struct vattr vattr;
1895 	rnode_t *drp;
1896 	vnode_t *tempvp;
1897 	hrtime_t t;
1898 
1899 	drp = VTOR(dvp);
1900 
1901 	if (nfs_zone() != VTOMI(dvp)->mi_zone)
1902 		return (EPERM);
1903 	if (nfs_rw_enter_sig(&drp->r_rwlock, RW_WRITER, INTR(dvp)))
1904 		return (EINTR);
1905 
1906 	/*
1907 	 * We make a copy of the attributes because the caller does not
1908 	 * expect us to change what va points to.
1909 	 */
1910 	vattr = *va;
1911 
1912 	/*
1913 	 * If the pathname is "", just use dvp.  Don't need
1914 	 * to send it over the wire, look it up in the dnlc,
1915 	 * or perform any access checks.
1916 	 */
1917 	if (*nm == '\0') {
1918 		error = 0;
1919 		VN_HOLD(dvp);
1920 		vp = dvp;
1921 	/*
1922 	 * If the pathname is ".", just use dvp.  Don't need
1923 	 * to send it over the wire or look it up in the dnlc,
1924 	 * just need to check access.
1925 	 */
1926 	} else if (strcmp(nm, ".") == 0) {
1927 		error = nfs_access(dvp, VEXEC, 0, cr);
1928 		if (error) {
1929 			nfs_rw_exit(&drp->r_rwlock);
1930 			return (error);
1931 		}
1932 		VN_HOLD(dvp);
1933 		vp = dvp;
1934 	/*
1935 	 * We need to go over the wire, just to be sure whether the
1936 	 * file exists or not.  Using the DNLC can be dangerous in
1937 	 * this case when making a decision regarding existence.
1938 	 */
1939 	} else {
1940 		error = nfslookup_otw(dvp, nm, &vp, cr, 0);
1941 	}
1942 	if (!error) {
1943 		if (exclusive == EXCL)
1944 			error = EEXIST;
1945 		else if (vp->v_type == VDIR && (mode & VWRITE))
1946 			error = EISDIR;
1947 		else {
1948 			/*
1949 			 * If vnode is a device, create special vnode.
1950 			 */
1951 			if (IS_DEVVP(vp)) {
1952 				tempvp = vp;
1953 				vp = specvp(vp, vp->v_rdev, vp->v_type, cr);
1954 				VN_RELE(tempvp);
1955 			}
1956 			if (!(error = VOP_ACCESS(vp, mode, 0, cr))) {
1957 				if ((vattr.va_mask & AT_SIZE) &&
1958 				    vp->v_type == VREG) {
1959 					vattr.va_mask = AT_SIZE;
1960 					error = nfssetattr(vp, &vattr, 0, cr);
1961 				}
1962 			}
1963 		}
1964 		nfs_rw_exit(&drp->r_rwlock);
1965 		if (error) {
1966 			VN_RELE(vp);
1967 		} else
1968 			*vpp = vp;
1969 		return (error);
1970 	}
1971 
1972 	ASSERT(vattr.va_mask & AT_TYPE);
1973 	if (vattr.va_type == VREG) {
1974 		ASSERT(vattr.va_mask & AT_MODE);
1975 		if (MANDMODE(vattr.va_mode)) {
1976 			nfs_rw_exit(&drp->r_rwlock);
1977 			return (EACCES);
1978 		}
1979 	}
1980 
1981 	dnlc_remove(dvp, nm);
1982 
1983 	setdiropargs(&args.ca_da, nm, dvp);
1984 
1985 	/*
1986 	 * Decide what the group-id of the created file should be.
1987 	 * Set it in attribute list as advisory...then do a setattr
1988 	 * if the server didn't get it right the first time.
1989 	 */
1990 	error = setdirgid(dvp, &vattr.va_gid, cr);
1991 	if (error) {
1992 		nfs_rw_exit(&drp->r_rwlock);
1993 		return (error);
1994 	}
1995 	vattr.va_mask |= AT_GID;
1996 
1997 	/*
1998 	 * This is a completely gross hack to make mknod
1999 	 * work over the wire until we can wack the protocol
2000 	 */
2001 #define	IFCHR		0020000		/* character special */
2002 #define	IFBLK		0060000		/* block special */
2003 #define	IFSOCK		0140000		/* socket */
2004 
2005 	/*
2006 	 * dev_t is uint_t in 5.x and short in 4.x. Both 4.x
2007 	 * supports 8 bit majors. 5.x supports 14 bit majors. 5.x supports 18
2008 	 * bits in the minor number where 4.x supports 8 bits.  If the 5.x
2009 	 * minor/major numbers <= 8 bits long, compress the device
2010 	 * number before sending it. Otherwise, the 4.x server will not
2011 	 * create the device with the correct device number and nothing can be
2012 	 * done about this.
2013 	 */
2014 	if (vattr.va_type == VCHR || vattr.va_type == VBLK) {
2015 		dev_t d = vattr.va_rdev;
2016 		dev32_t dev32;
2017 
2018 		if (vattr.va_type == VCHR)
2019 			vattr.va_mode |= IFCHR;
2020 		else
2021 			vattr.va_mode |= IFBLK;
2022 
2023 		(void) cmpldev(&dev32, d);
2024 		if (dev32 & ~((SO4_MAXMAJ << L_BITSMINOR32) | SO4_MAXMIN))
2025 			vattr.va_size = (u_offset_t)dev32;
2026 		else
2027 			vattr.va_size = (u_offset_t)nfsv2_cmpdev(d);
2028 
2029 		vattr.va_mask |= AT_MODE|AT_SIZE;
2030 	} else if (vattr.va_type == VFIFO) {
2031 		vattr.va_mode |= IFCHR;		/* xtra kludge for namedpipe */
2032 		vattr.va_size = (u_offset_t)NFS_FIFO_DEV;	/* blech */
2033 		vattr.va_mask |= AT_MODE|AT_SIZE;
2034 	} else if (vattr.va_type == VSOCK) {
2035 		vattr.va_mode |= IFSOCK;
2036 		/*
2037 		 * To avoid triggering bugs in the servers set AT_SIZE
2038 		 * (all other RFS_CREATE calls set this).
2039 		 */
2040 		vattr.va_size = 0;
2041 		vattr.va_mask |= AT_MODE|AT_SIZE;
2042 	}
2043 
2044 	args.ca_sa = &args.ca_sa_buf;
2045 	error = vattr_to_sattr(&vattr, args.ca_sa);
2046 	if (error) {
2047 		/* req time field(s) overflow - return immediately */
2048 		nfs_rw_exit(&drp->r_rwlock);
2049 		return (error);
2050 	}
2051 
2052 	douprintf = 1;
2053 
2054 	t = gethrtime();
2055 
2056 	error = rfs2call(VTOMI(dvp), RFS_CREATE,
2057 	    xdr_creatargs, (caddr_t)&args,
2058 	    xdr_diropres, (caddr_t)&dr, cr,
2059 	    &douprintf, &dr.dr_status, 0, NULL);
2060 
2061 	PURGE_ATTRCACHE(dvp);	/* mod time changed */
2062 
2063 	if (!error) {
2064 		error = geterrno(dr.dr_status);
2065 		if (!error) {
2066 			if (HAVE_RDDIR_CACHE(drp))
2067 				nfs_purge_rddir_cache(dvp);
2068 			vp = makenfsnode(&dr.dr_fhandle, &dr.dr_attr,
2069 			    dvp->v_vfsp, t, cr, NULL, NULL);
2070 			/*
2071 			 * If NFS_ACL is supported on the server, then the
2072 			 * attributes returned by server may have minimal
2073 			 * permissions sometimes denying access to users having
2074 			 * proper access.  To get the proper attributes, mark
2075 			 * the attributes as expired so that they will be
2076 			 * regotten via the NFS_ACL GETATTR2 procedure.
2077 			 */
2078 			if (VTOMI(vp)->mi_flags & MI_ACL) {
2079 				PURGE_ATTRCACHE(vp);
2080 			}
2081 			dnlc_update(dvp, nm, vp);
2082 			rp = VTOR(vp);
2083 			if (vattr.va_size == 0) {
2084 				mutex_enter(&rp->r_statelock);
2085 				rp->r_size = 0;
2086 				mutex_exit(&rp->r_statelock);
2087 				if (vn_has_cached_data(vp)) {
2088 					ASSERT(vp->v_type != VCHR);
2089 					nfs_invalidate_pages(vp,
2090 					    (u_offset_t)0, cr);
2091 				}
2092 			}
2093 
2094 			/*
2095 			 * Make sure the gid was set correctly.
2096 			 * If not, try to set it (but don't lose
2097 			 * any sleep over it).
2098 			 */
2099 			if (vattr.va_gid != rp->r_attr.va_gid) {
2100 				vattr.va_mask = AT_GID;
2101 				(void) nfssetattr(vp, &vattr, 0, cr);
2102 			}
2103 
2104 			/*
2105 			 * If vnode is a device create special vnode
2106 			 */
2107 			if (IS_DEVVP(vp)) {
2108 				*vpp = specvp(vp, vp->v_rdev, vp->v_type, cr);
2109 				VN_RELE(vp);
2110 			} else
2111 				*vpp = vp;
2112 		} else {
2113 			PURGE_STALE_FH(error, dvp, cr);
2114 		}
2115 	}
2116 
2117 	nfs_rw_exit(&drp->r_rwlock);
2118 
2119 	return (error);
2120 }
2121 
2122 /*
2123  * Weirdness: if the vnode to be removed is open
2124  * we rename it instead of removing it and nfs_inactive
2125  * will remove the new name.
2126  */
2127 static int
2128 nfs_remove(vnode_t *dvp, char *nm, cred_t *cr)
2129 {
2130 	int error;
2131 	struct nfsdiropargs da;
2132 	enum nfsstat status;
2133 	vnode_t *vp;
2134 	char *tmpname;
2135 	int douprintf;
2136 	rnode_t *rp;
2137 	rnode_t *drp;
2138 
2139 	if (nfs_zone() != VTOMI(dvp)->mi_zone)
2140 		return (EPERM);
2141 	drp = VTOR(dvp);
2142 	if (nfs_rw_enter_sig(&drp->r_rwlock, RW_WRITER, INTR(dvp)))
2143 		return (EINTR);
2144 
2145 	error = nfslookup(dvp, nm, &vp, NULL, 0, NULL, cr, 0);
2146 	if (error) {
2147 		nfs_rw_exit(&drp->r_rwlock);
2148 		return (error);
2149 	}
2150 
2151 	if (vp->v_type == VDIR && secpolicy_fs_linkdir(cr, dvp->v_vfsp)) {
2152 		VN_RELE(vp);
2153 		nfs_rw_exit(&drp->r_rwlock);
2154 		return (EPERM);
2155 	}
2156 
2157 	/*
2158 	 * First just remove the entry from the name cache, as it
2159 	 * is most likely the only entry for this vp.
2160 	 */
2161 	dnlc_remove(dvp, nm);
2162 
2163 	/*
2164 	 * If the file has a v_count > 1 then there may be more than one
2165 	 * entry in the name cache due multiple links or an open file,
2166 	 * but we don't have the real reference count so flush all
2167 	 * possible entries.
2168 	 */
2169 	if (vp->v_count > 1)
2170 		dnlc_purge_vp(vp);
2171 
2172 	/*
2173 	 * Now we have the real reference count on the vnode
2174 	 */
2175 	rp = VTOR(vp);
2176 	mutex_enter(&rp->r_statelock);
2177 	if (vp->v_count > 1 &&
2178 	    (rp->r_unldvp == NULL || strcmp(nm, rp->r_unlname) == 0)) {
2179 		mutex_exit(&rp->r_statelock);
2180 		tmpname = newname();
2181 		error = nfsrename(dvp, nm, dvp, tmpname, cr);
2182 		if (error)
2183 			kmem_free(tmpname, MAXNAMELEN);
2184 		else {
2185 			mutex_enter(&rp->r_statelock);
2186 			if (rp->r_unldvp == NULL) {
2187 				VN_HOLD(dvp);
2188 				rp->r_unldvp = dvp;
2189 				if (rp->r_unlcred != NULL)
2190 					crfree(rp->r_unlcred);
2191 				crhold(cr);
2192 				rp->r_unlcred = cr;
2193 				rp->r_unlname = tmpname;
2194 			} else {
2195 				kmem_free(rp->r_unlname, MAXNAMELEN);
2196 				rp->r_unlname = tmpname;
2197 			}
2198 			mutex_exit(&rp->r_statelock);
2199 		}
2200 	} else {
2201 		mutex_exit(&rp->r_statelock);
2202 		/*
2203 		 * We need to flush any dirty pages which happen to
2204 		 * be hanging around before removing the file.  This
2205 		 * shouldn't happen very often and mostly on file
2206 		 * systems mounted "nocto".
2207 		 */
2208 		if (vn_has_cached_data(vp) &&
2209 		    ((rp->r_flags & RDIRTY) || rp->r_count > 0)) {
2210 			error = nfs_putpage(vp, (offset_t)0, 0, 0, cr);
2211 			if (error && (error == ENOSPC || error == EDQUOT)) {
2212 				mutex_enter(&rp->r_statelock);
2213 				if (!rp->r_error)
2214 					rp->r_error = error;
2215 				mutex_exit(&rp->r_statelock);
2216 			}
2217 		}
2218 
2219 		setdiropargs(&da, nm, dvp);
2220 
2221 		douprintf = 1;
2222 
2223 		error = rfs2call(VTOMI(dvp), RFS_REMOVE,
2224 		    xdr_diropargs, (caddr_t)&da,
2225 		    xdr_enum, (caddr_t)&status, cr,
2226 		    &douprintf, &status, 0, NULL);
2227 
2228 		/*
2229 		 * The xattr dir may be gone after last attr is removed,
2230 		 * so flush it from dnlc.
2231 		 */
2232 		if (dvp->v_flag & V_XATTRDIR)
2233 			dnlc_purge_vp(dvp);
2234 
2235 		PURGE_ATTRCACHE(dvp);	/* mod time changed */
2236 		PURGE_ATTRCACHE(vp);	/* link count changed */
2237 
2238 		if (!error) {
2239 			error = geterrno(status);
2240 			if (!error) {
2241 				if (HAVE_RDDIR_CACHE(drp))
2242 					nfs_purge_rddir_cache(dvp);
2243 			} else {
2244 				PURGE_STALE_FH(error, dvp, cr);
2245 			}
2246 		}
2247 	}
2248 
2249 	VN_RELE(vp);
2250 
2251 	nfs_rw_exit(&drp->r_rwlock);
2252 
2253 	return (error);
2254 }
2255 
2256 static int
2257 nfs_link(vnode_t *tdvp, vnode_t *svp, char *tnm, cred_t *cr)
2258 {
2259 	int error;
2260 	struct nfslinkargs args;
2261 	enum nfsstat status;
2262 	vnode_t *realvp;
2263 	int douprintf;
2264 	rnode_t *tdrp;
2265 
2266 	if (nfs_zone() != VTOMI(tdvp)->mi_zone)
2267 		return (EPERM);
2268 	if (VOP_REALVP(svp, &realvp) == 0)
2269 		svp = realvp;
2270 
2271 	args.la_from = VTOFH(svp);
2272 	setdiropargs(&args.la_to, tnm, tdvp);
2273 
2274 	tdrp = VTOR(tdvp);
2275 	if (nfs_rw_enter_sig(&tdrp->r_rwlock, RW_WRITER, INTR(tdvp)))
2276 		return (EINTR);
2277 
2278 	dnlc_remove(tdvp, tnm);
2279 
2280 	douprintf = 1;
2281 
2282 	error = rfs2call(VTOMI(svp), RFS_LINK,
2283 	    xdr_linkargs, (caddr_t)&args,
2284 	    xdr_enum, (caddr_t)&status, cr,
2285 	    &douprintf, &status, 0, NULL);
2286 
2287 	PURGE_ATTRCACHE(tdvp);	/* mod time changed */
2288 	PURGE_ATTRCACHE(svp);	/* link count changed */
2289 
2290 	if (!error) {
2291 		error = geterrno(status);
2292 		if (!error) {
2293 			if (HAVE_RDDIR_CACHE(tdrp))
2294 				nfs_purge_rddir_cache(tdvp);
2295 		}
2296 	}
2297 
2298 	nfs_rw_exit(&tdrp->r_rwlock);
2299 
2300 	return (error);
2301 }
2302 
2303 static int
2304 nfs_rename(vnode_t *odvp, char *onm, vnode_t *ndvp, char *nnm, cred_t *cr)
2305 {
2306 	vnode_t *realvp;
2307 
2308 	if (nfs_zone() != VTOMI(odvp)->mi_zone)
2309 		return (EPERM);
2310 	if (VOP_REALVP(ndvp, &realvp) == 0)
2311 		ndvp = realvp;
2312 
2313 	return (nfsrename(odvp, onm, ndvp, nnm, cr));
2314 }
2315 
2316 /*
2317  * nfsrename does the real work of renaming in NFS Version 2.
2318  */
2319 static int
2320 nfsrename(vnode_t *odvp, char *onm, vnode_t *ndvp, char *nnm, cred_t *cr)
2321 {
2322 	int error;
2323 	enum nfsstat status;
2324 	struct nfsrnmargs args;
2325 	int douprintf;
2326 	vnode_t *nvp;
2327 	vnode_t *ovp = NULL;
2328 	char *tmpname;
2329 	rnode_t *rp;
2330 	rnode_t *odrp;
2331 	rnode_t *ndrp;
2332 
2333 	ASSERT(nfs_zone() == VTOMI(odvp)->mi_zone);
2334 	if (strcmp(onm, ".") == 0 || strcmp(onm, "..") == 0 ||
2335 	    strcmp(nnm, ".") == 0 || strcmp(nnm, "..") == 0)
2336 		return (EINVAL);
2337 
2338 	odrp = VTOR(odvp);
2339 	ndrp = VTOR(ndvp);
2340 	if ((intptr_t)odrp < (intptr_t)ndrp) {
2341 		if (nfs_rw_enter_sig(&odrp->r_rwlock, RW_WRITER, INTR(odvp)))
2342 			return (EINTR);
2343 		if (nfs_rw_enter_sig(&ndrp->r_rwlock, RW_WRITER, INTR(ndvp))) {
2344 			nfs_rw_exit(&odrp->r_rwlock);
2345 			return (EINTR);
2346 		}
2347 	} else {
2348 		if (nfs_rw_enter_sig(&ndrp->r_rwlock, RW_WRITER, INTR(ndvp)))
2349 			return (EINTR);
2350 		if (nfs_rw_enter_sig(&odrp->r_rwlock, RW_WRITER, INTR(odvp))) {
2351 			nfs_rw_exit(&ndrp->r_rwlock);
2352 			return (EINTR);
2353 		}
2354 	}
2355 
2356 	/*
2357 	 * Lookup the target file.  If it exists, it needs to be
2358 	 * checked to see whether it is a mount point and whether
2359 	 * it is active (open).
2360 	 */
2361 	error = nfslookup(ndvp, nnm, &nvp, NULL, 0, NULL, cr, 0);
2362 	if (!error) {
2363 		/*
2364 		 * If this file has been mounted on, then just
2365 		 * return busy because renaming to it would remove
2366 		 * the mounted file system from the name space.
2367 		 */
2368 		if (vn_mountedvfs(nvp) != NULL) {
2369 			VN_RELE(nvp);
2370 			nfs_rw_exit(&odrp->r_rwlock);
2371 			nfs_rw_exit(&ndrp->r_rwlock);
2372 			return (EBUSY);
2373 		}
2374 
2375 		/*
2376 		 * Purge the name cache of all references to this vnode
2377 		 * so that we can check the reference count to infer
2378 		 * whether it is active or not.
2379 		 */
2380 		/*
2381 		 * First just remove the entry from the name cache, as it
2382 		 * is most likely the only entry for this vp.
2383 		 */
2384 		dnlc_remove(ndvp, nnm);
2385 		/*
2386 		 * If the file has a v_count > 1 then there may be more
2387 		 * than one entry in the name cache due multiple links
2388 		 * or an open file, but we don't have the real reference
2389 		 * count so flush all possible entries.
2390 		 */
2391 		if (nvp->v_count > 1)
2392 			dnlc_purge_vp(nvp);
2393 
2394 		/*
2395 		 * If the vnode is active and is not a directory,
2396 		 * arrange to rename it to a
2397 		 * temporary file so that it will continue to be
2398 		 * accessible.  This implements the "unlink-open-file"
2399 		 * semantics for the target of a rename operation.
2400 		 * Before doing this though, make sure that the
2401 		 * source and target files are not already the same.
2402 		 */
2403 		if (nvp->v_count > 1 && nvp->v_type != VDIR) {
2404 			/*
2405 			 * Lookup the source name.
2406 			 */
2407 			error = nfslookup(odvp, onm, &ovp, NULL, 0, NULL,
2408 			    cr, 0);
2409 
2410 			/*
2411 			 * The source name *should* already exist.
2412 			 */
2413 			if (error) {
2414 				VN_RELE(nvp);
2415 				nfs_rw_exit(&odrp->r_rwlock);
2416 				nfs_rw_exit(&ndrp->r_rwlock);
2417 				return (error);
2418 			}
2419 
2420 			/*
2421 			 * Compare the two vnodes.  If they are the same,
2422 			 * just release all held vnodes and return success.
2423 			 */
2424 			if (ovp == nvp) {
2425 				VN_RELE(ovp);
2426 				VN_RELE(nvp);
2427 				nfs_rw_exit(&odrp->r_rwlock);
2428 				nfs_rw_exit(&ndrp->r_rwlock);
2429 				return (0);
2430 			}
2431 
2432 			/*
2433 			 * Can't mix and match directories and non-
2434 			 * directories in rename operations.  We already
2435 			 * know that the target is not a directory.  If
2436 			 * the source is a directory, return an error.
2437 			 */
2438 			if (ovp->v_type == VDIR) {
2439 				VN_RELE(ovp);
2440 				VN_RELE(nvp);
2441 				nfs_rw_exit(&odrp->r_rwlock);
2442 				nfs_rw_exit(&ndrp->r_rwlock);
2443 				return (ENOTDIR);
2444 			}
2445 
2446 			/*
2447 			 * The target file exists, is not the same as
2448 			 * the source file, and is active.  Link it
2449 			 * to a temporary filename to avoid having
2450 			 * the server removing the file completely.
2451 			 */
2452 			tmpname = newname();
2453 			error = nfs_link(ndvp, nvp, tmpname, cr);
2454 			if (error == EOPNOTSUPP) {
2455 				error = nfs_rename(ndvp, nnm, ndvp, tmpname,
2456 				    cr);
2457 			}
2458 			if (error) {
2459 				kmem_free(tmpname, MAXNAMELEN);
2460 				VN_RELE(ovp);
2461 				VN_RELE(nvp);
2462 				nfs_rw_exit(&odrp->r_rwlock);
2463 				nfs_rw_exit(&ndrp->r_rwlock);
2464 				return (error);
2465 			}
2466 			rp = VTOR(nvp);
2467 			mutex_enter(&rp->r_statelock);
2468 			if (rp->r_unldvp == NULL) {
2469 				VN_HOLD(ndvp);
2470 				rp->r_unldvp = ndvp;
2471 				if (rp->r_unlcred != NULL)
2472 					crfree(rp->r_unlcred);
2473 				crhold(cr);
2474 				rp->r_unlcred = cr;
2475 				rp->r_unlname = tmpname;
2476 			} else {
2477 				kmem_free(rp->r_unlname, MAXNAMELEN);
2478 				rp->r_unlname = tmpname;
2479 			}
2480 			mutex_exit(&rp->r_statelock);
2481 		}
2482 
2483 		VN_RELE(nvp);
2484 	}
2485 
2486 	if (ovp == NULL) {
2487 		/*
2488 		 * When renaming directories to be a subdirectory of a
2489 		 * different parent, the dnlc entry for ".." will no
2490 		 * longer be valid, so it must be removed.
2491 		 *
2492 		 * We do a lookup here to determine whether we are renaming
2493 		 * a directory and we need to check if we are renaming
2494 		 * an unlinked file.  This might have already been done
2495 		 * in previous code, so we check ovp == NULL to avoid
2496 		 * doing it twice.
2497 		 */
2498 
2499 		error = nfslookup(odvp, onm, &ovp, NULL, 0, NULL, cr, 0);
2500 
2501 		/*
2502 		 * The source name *should* already exist.
2503 		 */
2504 		if (error) {
2505 			nfs_rw_exit(&odrp->r_rwlock);
2506 			nfs_rw_exit(&ndrp->r_rwlock);
2507 			return (error);
2508 		}
2509 		ASSERT(ovp != NULL);
2510 	}
2511 
2512 	dnlc_remove(odvp, onm);
2513 	dnlc_remove(ndvp, nnm);
2514 
2515 	setdiropargs(&args.rna_from, onm, odvp);
2516 	setdiropargs(&args.rna_to, nnm, ndvp);
2517 
2518 	douprintf = 1;
2519 
2520 	error = rfs2call(VTOMI(odvp), RFS_RENAME,
2521 	    xdr_rnmargs, (caddr_t)&args,
2522 	    xdr_enum, (caddr_t)&status, cr,
2523 	    &douprintf, &status, 0, NULL);
2524 
2525 	PURGE_ATTRCACHE(odvp);	/* mod time changed */
2526 	PURGE_ATTRCACHE(ndvp);	/* mod time changed */
2527 
2528 	if (!error) {
2529 		error = geterrno(status);
2530 		if (!error) {
2531 			if (HAVE_RDDIR_CACHE(odrp))
2532 				nfs_purge_rddir_cache(odvp);
2533 			if (HAVE_RDDIR_CACHE(ndrp))
2534 				nfs_purge_rddir_cache(ndvp);
2535 			/*
2536 			 * when renaming directories to be a subdirectory of a
2537 			 * different parent, the dnlc entry for ".." will no
2538 			 * longer be valid, so it must be removed
2539 			 */
2540 			rp = VTOR(ovp);
2541 			if (ndvp != odvp) {
2542 				if (ovp->v_type == VDIR) {
2543 					dnlc_remove(ovp, "..");
2544 					if (HAVE_RDDIR_CACHE(rp))
2545 						nfs_purge_rddir_cache(ovp);
2546 				}
2547 			}
2548 
2549 			/*
2550 			 * If we are renaming the unlinked file, update the
2551 			 * r_unldvp and r_unlname as needed.
2552 			 */
2553 			mutex_enter(&rp->r_statelock);
2554 			if (rp->r_unldvp != NULL) {
2555 				if (strcmp(rp->r_unlname, onm) == 0) {
2556 					(void) strncpy(rp->r_unlname,
2557 						    nnm, MAXNAMELEN);
2558 					rp->r_unlname[MAXNAMELEN - 1] = '\0';
2559 
2560 					if (ndvp != rp->r_unldvp) {
2561 						VN_RELE(rp->r_unldvp);
2562 						rp->r_unldvp = ndvp;
2563 						VN_HOLD(ndvp);
2564 					}
2565 				}
2566 			}
2567 			mutex_exit(&rp->r_statelock);
2568 		} else {
2569 			/*
2570 			 * System V defines rename to return EEXIST, not
2571 			 * ENOTEMPTY if the target directory is not empty.
2572 			 * Over the wire, the error is NFSERR_ENOTEMPTY
2573 			 * which geterrno maps to ENOTEMPTY.
2574 			 */
2575 			if (error == ENOTEMPTY)
2576 				error = EEXIST;
2577 		}
2578 	}
2579 
2580 	VN_RELE(ovp);
2581 
2582 	nfs_rw_exit(&odrp->r_rwlock);
2583 	nfs_rw_exit(&ndrp->r_rwlock);
2584 
2585 	return (error);
2586 }
2587 
2588 static int
2589 nfs_mkdir(vnode_t *dvp, char *nm, struct vattr *va, vnode_t **vpp, cred_t *cr)
2590 {
2591 	int error;
2592 	struct nfscreatargs args;
2593 	struct nfsdiropres dr;
2594 	int douprintf;
2595 	rnode_t *drp;
2596 	hrtime_t t;
2597 
2598 	if (nfs_zone() != VTOMI(dvp)->mi_zone)
2599 		return (EPERM);
2600 
2601 	setdiropargs(&args.ca_da, nm, dvp);
2602 
2603 	/*
2604 	 * Decide what the group-id and set-gid bit of the created directory
2605 	 * should be.  May have to do a setattr to get the gid right.
2606 	 */
2607 	error = setdirgid(dvp, &va->va_gid, cr);
2608 	if (error)
2609 		return (error);
2610 	error = setdirmode(dvp, &va->va_mode, cr);
2611 	if (error)
2612 		return (error);
2613 	va->va_mask |= AT_MODE|AT_GID;
2614 
2615 	args.ca_sa = &args.ca_sa_buf;
2616 	error = vattr_to_sattr(va, args.ca_sa);
2617 	if (error) {
2618 		/* req time field(s) overflow - return immediately */
2619 		return (error);
2620 	}
2621 
2622 	drp = VTOR(dvp);
2623 	if (nfs_rw_enter_sig(&drp->r_rwlock, RW_WRITER, INTR(dvp)))
2624 		return (EINTR);
2625 
2626 	dnlc_remove(dvp, nm);
2627 
2628 	douprintf = 1;
2629 
2630 	t = gethrtime();
2631 
2632 	error = rfs2call(VTOMI(dvp), RFS_MKDIR,
2633 	    xdr_creatargs, (caddr_t)&args,
2634 	    xdr_diropres, (caddr_t)&dr, cr,
2635 	    &douprintf, &dr.dr_status, 0, NULL);
2636 
2637 	PURGE_ATTRCACHE(dvp);	/* mod time changed */
2638 
2639 	if (!error) {
2640 		error = geterrno(dr.dr_status);
2641 		if (!error) {
2642 			if (HAVE_RDDIR_CACHE(drp))
2643 				nfs_purge_rddir_cache(dvp);
2644 			/*
2645 			 * The attributes returned by RFS_MKDIR can not
2646 			 * be depended upon, so mark the attribute cache
2647 			 * as purged.  A subsequent GETATTR will get the
2648 			 * correct attributes from the server.
2649 			 */
2650 			*vpp = makenfsnode(&dr.dr_fhandle, &dr.dr_attr,
2651 			    dvp->v_vfsp, t, cr, NULL, NULL);
2652 			PURGE_ATTRCACHE(*vpp);
2653 			dnlc_update(dvp, nm, *vpp);
2654 
2655 			/*
2656 			 * Make sure the gid was set correctly.
2657 			 * If not, try to set it (but don't lose
2658 			 * any sleep over it).
2659 			 */
2660 			if (va->va_gid != VTOR(*vpp)->r_attr.va_gid) {
2661 				va->va_mask = AT_GID;
2662 				(void) nfssetattr(*vpp, va, 0, cr);
2663 			}
2664 		} else {
2665 			PURGE_STALE_FH(error, dvp, cr);
2666 		}
2667 	}
2668 
2669 	nfs_rw_exit(&drp->r_rwlock);
2670 
2671 	return (error);
2672 }
2673 
2674 static int
2675 nfs_rmdir(vnode_t *dvp, char *nm, vnode_t *cdir, cred_t *cr)
2676 {
2677 	int error;
2678 	enum nfsstat status;
2679 	struct nfsdiropargs da;
2680 	vnode_t *vp;
2681 	int douprintf;
2682 	rnode_t *drp;
2683 
2684 	if (nfs_zone() != VTOMI(dvp)->mi_zone)
2685 		return (EPERM);
2686 	drp = VTOR(dvp);
2687 	if (nfs_rw_enter_sig(&drp->r_rwlock, RW_WRITER, INTR(dvp)))
2688 		return (EINTR);
2689 
2690 	/*
2691 	 * Attempt to prevent a rmdir(".") from succeeding.
2692 	 */
2693 	error = nfslookup(dvp, nm, &vp, NULL, 0, NULL, cr, 0);
2694 	if (error) {
2695 		nfs_rw_exit(&drp->r_rwlock);
2696 		return (error);
2697 	}
2698 
2699 	if (vp == cdir) {
2700 		VN_RELE(vp);
2701 		nfs_rw_exit(&drp->r_rwlock);
2702 		return (EINVAL);
2703 	}
2704 
2705 	setdiropargs(&da, nm, dvp);
2706 
2707 	/*
2708 	 * First just remove the entry from the name cache, as it
2709 	 * is most likely an entry for this vp.
2710 	 */
2711 	dnlc_remove(dvp, nm);
2712 
2713 	/*
2714 	 * If there vnode reference count is greater than one, then
2715 	 * there may be additional references in the DNLC which will
2716 	 * need to be purged.  First, trying removing the entry for
2717 	 * the parent directory and see if that removes the additional
2718 	 * reference(s).  If that doesn't do it, then use dnlc_purge_vp
2719 	 * to completely remove any references to the directory which
2720 	 * might still exist in the DNLC.
2721 	 */
2722 	if (vp->v_count > 1) {
2723 		dnlc_remove(vp, "..");
2724 		if (vp->v_count > 1)
2725 			dnlc_purge_vp(vp);
2726 	}
2727 
2728 	douprintf = 1;
2729 
2730 	error = rfs2call(VTOMI(dvp), RFS_RMDIR,
2731 	    xdr_diropargs, (caddr_t)&da,
2732 	    xdr_enum, (caddr_t)&status, cr,
2733 	    &douprintf, &status, 0, NULL);
2734 
2735 	PURGE_ATTRCACHE(dvp);	/* mod time changed */
2736 
2737 	if (error) {
2738 		VN_RELE(vp);
2739 		nfs_rw_exit(&drp->r_rwlock);
2740 		return (error);
2741 	}
2742 
2743 	error = geterrno(status);
2744 	if (!error) {
2745 		if (HAVE_RDDIR_CACHE(drp))
2746 			nfs_purge_rddir_cache(dvp);
2747 		if (HAVE_RDDIR_CACHE(VTOR(vp)))
2748 			nfs_purge_rddir_cache(vp);
2749 	} else {
2750 		PURGE_STALE_FH(error, dvp, cr);
2751 		/*
2752 		 * System V defines rmdir to return EEXIST, not
2753 		 * ENOTEMPTY if the directory is not empty.  Over
2754 		 * the wire, the error is NFSERR_ENOTEMPTY which
2755 		 * geterrno maps to ENOTEMPTY.
2756 		 */
2757 		if (error == ENOTEMPTY)
2758 			error = EEXIST;
2759 	}
2760 
2761 	VN_RELE(vp);
2762 
2763 	nfs_rw_exit(&drp->r_rwlock);
2764 
2765 	return (error);
2766 }
2767 
2768 static int
2769 nfs_symlink(vnode_t *dvp, char *lnm, struct vattr *tva, char *tnm, cred_t *cr)
2770 {
2771 	int error;
2772 	struct nfsslargs args;
2773 	enum nfsstat status;
2774 	int douprintf;
2775 	rnode_t *drp;
2776 
2777 	if (nfs_zone() != VTOMI(dvp)->mi_zone)
2778 		return (EPERM);
2779 	setdiropargs(&args.sla_from, lnm, dvp);
2780 	args.sla_sa = &args.sla_sa_buf;
2781 	error = vattr_to_sattr(tva, args.sla_sa);
2782 	if (error) {
2783 		/* req time field(s) overflow - return immediately */
2784 		return (error);
2785 	}
2786 	args.sla_tnm = tnm;
2787 
2788 	drp = VTOR(dvp);
2789 	if (nfs_rw_enter_sig(&drp->r_rwlock, RW_WRITER, INTR(dvp)))
2790 		return (EINTR);
2791 
2792 	dnlc_remove(dvp, lnm);
2793 
2794 	douprintf = 1;
2795 
2796 	error = rfs2call(VTOMI(dvp), RFS_SYMLINK,
2797 	    xdr_slargs, (caddr_t)&args,
2798 	    xdr_enum, (caddr_t)&status, cr,
2799 	    &douprintf, &status, 0, NULL);
2800 
2801 	PURGE_ATTRCACHE(dvp);	/* mod time changed */
2802 
2803 	if (!error) {
2804 		error = geterrno(status);
2805 		if (!error) {
2806 			if (HAVE_RDDIR_CACHE(drp))
2807 				nfs_purge_rddir_cache(dvp);
2808 		} else {
2809 			PURGE_STALE_FH(error, dvp, cr);
2810 		}
2811 	}
2812 
2813 	nfs_rw_exit(&drp->r_rwlock);
2814 
2815 	return (error);
2816 }
2817 
2818 #ifdef DEBUG
2819 static int nfs_readdir_cache_hits = 0;
2820 static int nfs_readdir_cache_shorts = 0;
2821 static int nfs_readdir_cache_waits = 0;
2822 static int nfs_readdir_cache_misses = 0;
2823 static int nfs_readdir_readahead = 0;
2824 #endif
2825 
2826 static int nfs_shrinkreaddir = 0;
2827 
2828 /*
2829  * Read directory entries.
2830  * There are some weird things to look out for here.  The uio_offset
2831  * field is either 0 or it is the offset returned from a previous
2832  * readdir.  It is an opaque value used by the server to find the
2833  * correct directory block to read. The count field is the number
2834  * of blocks to read on the server.  This is advisory only, the server
2835  * may return only one block's worth of entries.  Entries may be compressed
2836  * on the server.
2837  */
2838 static int
2839 nfs_readdir(vnode_t *vp, struct uio *uiop, cred_t *cr, int *eofp)
2840 {
2841 	int error;
2842 	size_t count;
2843 	rnode_t *rp;
2844 	rddir_cache *rdc;
2845 	rddir_cache *nrdc;
2846 	rddir_cache *rrdc;
2847 #ifdef DEBUG
2848 	int missed;
2849 #endif
2850 	rddir_cache srdc;
2851 	avl_index_t where;
2852 
2853 	rp = VTOR(vp);
2854 
2855 	ASSERT(nfs_rw_lock_held(&rp->r_rwlock, RW_READER));
2856 	if (nfs_zone() != VTOMI(vp)->mi_zone)
2857 		return (EIO);
2858 	/*
2859 	 * Make sure that the directory cache is valid.
2860 	 */
2861 	if (HAVE_RDDIR_CACHE(rp)) {
2862 		if (nfs_disable_rddir_cache) {
2863 			/*
2864 			 * Setting nfs_disable_rddir_cache in /etc/system
2865 			 * allows interoperability with servers that do not
2866 			 * properly update the attributes of directories.
2867 			 * Any cached information gets purged before an
2868 			 * access is made to it.
2869 			 */
2870 			nfs_purge_rddir_cache(vp);
2871 		} else {
2872 			error = nfs_validate_caches(vp, cr);
2873 			if (error)
2874 				return (error);
2875 		}
2876 	}
2877 
2878 	/*
2879 	 * UGLINESS: SunOS 3.2 servers apparently cannot always handle an
2880 	 * RFS_READDIR request with rda_count set to more than 0x400. So
2881 	 * we reduce the request size here purely for compatibility.
2882 	 *
2883 	 * In general, this is no longer required.  However, if a server
2884 	 * is discovered which can not handle requests larger than 1024,
2885 	 * nfs_shrinkreaddir can be set to 1 to enable this backwards
2886 	 * compatibility.
2887 	 *
2888 	 * In any case, the request size is limited to NFS_MAXDATA bytes.
2889 	 */
2890 	count = MIN(uiop->uio_iov->iov_len,
2891 	    nfs_shrinkreaddir ? 0x400 : NFS_MAXDATA);
2892 
2893 	nrdc = NULL;
2894 #ifdef DEBUG
2895 	missed = 0;
2896 #endif
2897 top:
2898 	/*
2899 	 * Short circuit last readdir which always returns 0 bytes.
2900 	 * This can be done after the directory has been read through
2901 	 * completely at least once.  This will set r_direof which
2902 	 * can be used to find the value of the last cookie.
2903 	 */
2904 	mutex_enter(&rp->r_statelock);
2905 	if (rp->r_direof != NULL &&
2906 	    uiop->uio_offset == rp->r_direof->nfs_ncookie) {
2907 		mutex_exit(&rp->r_statelock);
2908 #ifdef DEBUG
2909 		nfs_readdir_cache_shorts++;
2910 #endif
2911 		if (eofp)
2912 			*eofp = 1;
2913 		if (nrdc != NULL)
2914 			rddir_cache_rele(nrdc);
2915 		return (0);
2916 	}
2917 	/*
2918 	 * Look for a cache entry.  Cache entries are identified
2919 	 * by the NFS cookie value and the byte count requested.
2920 	 */
2921 	srdc.nfs_cookie = uiop->uio_offset;
2922 	srdc.buflen = count;
2923 	rdc = avl_find(&rp->r_dir, &srdc, &where);
2924 	if (rdc != NULL) {
2925 		rddir_cache_hold(rdc);
2926 		/*
2927 		 * If the cache entry is in the process of being
2928 		 * filled in, wait until this completes.  The
2929 		 * RDDIRWAIT bit is set to indicate that someone
2930 		 * is waiting and then the thread currently
2931 		 * filling the entry is done, it should do a
2932 		 * cv_broadcast to wakeup all of the threads
2933 		 * waiting for it to finish.
2934 		 */
2935 		if (rdc->flags & RDDIR) {
2936 			nfs_rw_exit(&rp->r_rwlock);
2937 			rdc->flags |= RDDIRWAIT;
2938 #ifdef DEBUG
2939 			nfs_readdir_cache_waits++;
2940 #endif
2941 			if (!cv_wait_sig(&rdc->cv, &rp->r_statelock)) {
2942 				/*
2943 				 * We got interrupted, probably
2944 				 * the user typed ^C or an alarm
2945 				 * fired.  We free the new entry
2946 				 * if we allocated one.
2947 				 */
2948 				mutex_exit(&rp->r_statelock);
2949 				(void) nfs_rw_enter_sig(&rp->r_rwlock,
2950 					RW_READER, FALSE);
2951 				rddir_cache_rele(rdc);
2952 				if (nrdc != NULL)
2953 					rddir_cache_rele(nrdc);
2954 				return (EINTR);
2955 			}
2956 			mutex_exit(&rp->r_statelock);
2957 			(void) nfs_rw_enter_sig(&rp->r_rwlock,
2958 				RW_READER, FALSE);
2959 			rddir_cache_rele(rdc);
2960 			goto top;
2961 		}
2962 		/*
2963 		 * Check to see if a readdir is required to
2964 		 * fill the entry.  If so, mark this entry
2965 		 * as being filled, remove our reference,
2966 		 * and branch to the code to fill the entry.
2967 		 */
2968 		if (rdc->flags & RDDIRREQ) {
2969 			rdc->flags &= ~RDDIRREQ;
2970 			rdc->flags |= RDDIR;
2971 			if (nrdc != NULL)
2972 				rddir_cache_rele(nrdc);
2973 			nrdc = rdc;
2974 			mutex_exit(&rp->r_statelock);
2975 			goto bottom;
2976 		}
2977 #ifdef DEBUG
2978 		if (!missed)
2979 			nfs_readdir_cache_hits++;
2980 #endif
2981 		/*
2982 		 * If an error occurred while attempting
2983 		 * to fill the cache entry, just return it.
2984 		 */
2985 		if (rdc->error) {
2986 			error = rdc->error;
2987 			mutex_exit(&rp->r_statelock);
2988 			rddir_cache_rele(rdc);
2989 			if (nrdc != NULL)
2990 				rddir_cache_rele(nrdc);
2991 			return (error);
2992 		}
2993 
2994 		/*
2995 		 * The cache entry is complete and good,
2996 		 * copyout the dirent structs to the calling
2997 		 * thread.
2998 		 */
2999 		error = uiomove(rdc->entries, rdc->entlen, UIO_READ, uiop);
3000 
3001 		/*
3002 		 * If no error occurred during the copyout,
3003 		 * update the offset in the uio struct to
3004 		 * contain the value of the next cookie
3005 		 * and set the eof value appropriately.
3006 		 */
3007 		if (!error) {
3008 			uiop->uio_offset = rdc->nfs_ncookie;
3009 			if (eofp)
3010 				*eofp = rdc->eof;
3011 		}
3012 
3013 		/*
3014 		 * Decide whether to do readahead.  Don't if
3015 		 * have already read to the end of directory.
3016 		 */
3017 		if (rdc->eof) {
3018 			rp->r_direof = rdc;
3019 			mutex_exit(&rp->r_statelock);
3020 			rddir_cache_rele(rdc);
3021 			if (nrdc != NULL)
3022 				rddir_cache_rele(nrdc);
3023 			return (error);
3024 		}
3025 
3026 		/*
3027 		 * Check to see whether we found an entry
3028 		 * for the readahead.  If so, we don't need
3029 		 * to do anything further, so free the new
3030 		 * entry if one was allocated.  Otherwise,
3031 		 * allocate a new entry, add it to the cache,
3032 		 * and then initiate an asynchronous readdir
3033 		 * operation to fill it.
3034 		 */
3035 		srdc.nfs_cookie = rdc->nfs_ncookie;
3036 		srdc.buflen = count;
3037 		rrdc = avl_find(&rp->r_dir, &srdc, &where);
3038 		if (rrdc != NULL) {
3039 			if (nrdc != NULL)
3040 				rddir_cache_rele(nrdc);
3041 		} else {
3042 			if (nrdc != NULL)
3043 				rrdc = nrdc;
3044 			else {
3045 				rrdc = rddir_cache_alloc(KM_NOSLEEP);
3046 			}
3047 			if (rrdc != NULL) {
3048 				rrdc->nfs_cookie = rdc->nfs_ncookie;
3049 				rrdc->buflen = count;
3050 				avl_insert(&rp->r_dir, rrdc, where);
3051 				rddir_cache_hold(rrdc);
3052 				mutex_exit(&rp->r_statelock);
3053 				rddir_cache_rele(rdc);
3054 #ifdef DEBUG
3055 				nfs_readdir_readahead++;
3056 #endif
3057 				nfs_async_readdir(vp, rrdc, cr, nfsreaddir);
3058 				return (error);
3059 			}
3060 		}
3061 
3062 		mutex_exit(&rp->r_statelock);
3063 		rddir_cache_rele(rdc);
3064 		return (error);
3065 	}
3066 
3067 	/*
3068 	 * Didn't find an entry in the cache.  Construct a new empty
3069 	 * entry and link it into the cache.  Other processes attempting
3070 	 * to access this entry will need to wait until it is filled in.
3071 	 *
3072 	 * Since kmem_alloc may block, another pass through the cache
3073 	 * will need to be taken to make sure that another process
3074 	 * hasn't already added an entry to the cache for this request.
3075 	 */
3076 	if (nrdc == NULL) {
3077 		mutex_exit(&rp->r_statelock);
3078 		nrdc = rddir_cache_alloc(KM_SLEEP);
3079 		nrdc->nfs_cookie = uiop->uio_offset;
3080 		nrdc->buflen = count;
3081 		goto top;
3082 	}
3083 
3084 	/*
3085 	 * Add this entry to the cache.
3086 	 */
3087 	avl_insert(&rp->r_dir, nrdc, where);
3088 	rddir_cache_hold(nrdc);
3089 	mutex_exit(&rp->r_statelock);
3090 
3091 bottom:
3092 #ifdef DEBUG
3093 	missed = 1;
3094 	nfs_readdir_cache_misses++;
3095 #endif
3096 	/*
3097 	 * Do the readdir.
3098 	 */
3099 	error = nfsreaddir(vp, nrdc, cr);
3100 
3101 	/*
3102 	 * If this operation failed, just return the error which occurred.
3103 	 */
3104 	if (error != 0)
3105 		return (error);
3106 
3107 	/*
3108 	 * Since the RPC operation will have taken sometime and blocked
3109 	 * this process, another pass through the cache will need to be
3110 	 * taken to find the correct cache entry.  It is possible that
3111 	 * the correct cache entry will not be there (although one was
3112 	 * added) because the directory changed during the RPC operation
3113 	 * and the readdir cache was flushed.  In this case, just start
3114 	 * over.  It is hoped that this will not happen too often... :-)
3115 	 */
3116 	nrdc = NULL;
3117 	goto top;
3118 	/* NOTREACHED */
3119 }
3120 
3121 static int
3122 nfsreaddir(vnode_t *vp, rddir_cache *rdc, cred_t *cr)
3123 {
3124 	int error;
3125 	struct nfsrddirargs rda;
3126 	struct nfsrddirres rd;
3127 	rnode_t *rp;
3128 	mntinfo_t *mi;
3129 	uint_t count;
3130 	int douprintf;
3131 	failinfo_t fi, *fip;
3132 
3133 	ASSERT(nfs_zone() == VTOMI(vp)->mi_zone);
3134 	count = rdc->buflen;
3135 
3136 	rp = VTOR(vp);
3137 	mi = VTOMI(vp);
3138 
3139 	rda.rda_fh = *VTOFH(vp);
3140 	rda.rda_offset = rdc->nfs_cookie;
3141 
3142 	/*
3143 	 * NFS client failover support
3144 	 * suppress failover unless we have a zero cookie
3145 	 */
3146 	if (rdc->nfs_cookie == (off_t)0) {
3147 		fi.vp = vp;
3148 		fi.fhp = (caddr_t)&rda.rda_fh;
3149 		fi.copyproc = nfscopyfh;
3150 		fi.lookupproc = nfslookup;
3151 		fi.xattrdirproc = acl_getxattrdir2;
3152 		fip = &fi;
3153 	} else {
3154 		fip = NULL;
3155 	}
3156 
3157 	rd.rd_entries = kmem_alloc(rdc->buflen, KM_SLEEP);
3158 	rd.rd_size = count;
3159 	rd.rd_offset = rda.rda_offset;
3160 
3161 	douprintf = 1;
3162 
3163 	if (mi->mi_io_kstats) {
3164 		mutex_enter(&mi->mi_lock);
3165 		kstat_runq_enter(KSTAT_IO_PTR(mi->mi_io_kstats));
3166 		mutex_exit(&mi->mi_lock);
3167 	}
3168 
3169 	do {
3170 		rda.rda_count = MIN(count, mi->mi_curread);
3171 		error = rfs2call(mi, RFS_READDIR,
3172 		    xdr_rddirargs, (caddr_t)&rda,
3173 		    xdr_getrddirres, (caddr_t)&rd, cr,
3174 		    &douprintf, &rd.rd_status, 0, fip);
3175 	} while (error == ENFS_TRYAGAIN);
3176 
3177 	if (mi->mi_io_kstats) {
3178 		mutex_enter(&mi->mi_lock);
3179 		kstat_runq_exit(KSTAT_IO_PTR(mi->mi_io_kstats));
3180 		mutex_exit(&mi->mi_lock);
3181 	}
3182 
3183 	/*
3184 	 * Since we are actually doing a READDIR RPC, we must have
3185 	 * exclusive access to the cache entry being filled.  Thus,
3186 	 * it is safe to update all fields except for the flags
3187 	 * field.  The r_statelock in the rnode must be held to
3188 	 * prevent two different threads from simultaneously
3189 	 * attempting to update the flags field.  This can happen
3190 	 * if we are turning off RDDIR and the other thread is
3191 	 * trying to set RDDIRWAIT.
3192 	 */
3193 	ASSERT(rdc->flags & RDDIR);
3194 	if (!error) {
3195 		error = geterrno(rd.rd_status);
3196 		if (!error) {
3197 			rdc->nfs_ncookie = rd.rd_offset;
3198 			rdc->eof = rd.rd_eof ? 1 : 0;
3199 			rdc->entlen = rd.rd_size;
3200 			ASSERT(rdc->entlen <= rdc->buflen);
3201 #ifdef DEBUG
3202 			rdc->entries = rddir_cache_buf_alloc(rdc->buflen,
3203 			    KM_SLEEP);
3204 #else
3205 			rdc->entries = kmem_alloc(rdc->buflen, KM_SLEEP);
3206 #endif
3207 			bcopy(rd.rd_entries, rdc->entries, rdc->entlen);
3208 			rdc->error = 0;
3209 			if (mi->mi_io_kstats) {
3210 				mutex_enter(&mi->mi_lock);
3211 				KSTAT_IO_PTR(mi->mi_io_kstats)->reads++;
3212 				KSTAT_IO_PTR(mi->mi_io_kstats)->nread +=
3213 				    rd.rd_size;
3214 				mutex_exit(&mi->mi_lock);
3215 			}
3216 		} else {
3217 			PURGE_STALE_FH(error, vp, cr);
3218 		}
3219 	}
3220 	if (error) {
3221 		rdc->entries = NULL;
3222 		rdc->error = error;
3223 	}
3224 	kmem_free(rd.rd_entries, rdc->buflen);
3225 
3226 	mutex_enter(&rp->r_statelock);
3227 	rdc->flags &= ~RDDIR;
3228 	if (rdc->flags & RDDIRWAIT) {
3229 		rdc->flags &= ~RDDIRWAIT;
3230 		cv_broadcast(&rdc->cv);
3231 	}
3232 	if (error)
3233 		rdc->flags |= RDDIRREQ;
3234 	mutex_exit(&rp->r_statelock);
3235 
3236 	rddir_cache_rele(rdc);
3237 
3238 	return (error);
3239 }
3240 
3241 #ifdef DEBUG
3242 static int nfs_bio_do_stop = 0;
3243 #endif
3244 
3245 static int
3246 nfs_bio(struct buf *bp, cred_t *cr)
3247 {
3248 	rnode_t *rp = VTOR(bp->b_vp);
3249 	int count;
3250 	int error;
3251 	cred_t *cred;
3252 	uint_t offset;
3253 
3254 	DTRACE_IO1(start, struct buf *, bp);
3255 
3256 	ASSERT(nfs_zone() == VTOMI(bp->b_vp)->mi_zone);
3257 	offset = dbtob(bp->b_blkno);
3258 
3259 	if (bp->b_flags & B_READ) {
3260 		mutex_enter(&rp->r_statelock);
3261 		if (rp->r_cred != NULL) {
3262 			cred = rp->r_cred;
3263 			crhold(cred);
3264 		} else {
3265 			rp->r_cred = cr;
3266 			crhold(cr);
3267 			cred = cr;
3268 			crhold(cred);
3269 		}
3270 		mutex_exit(&rp->r_statelock);
3271 	read_again:
3272 		error = bp->b_error = nfsread(bp->b_vp, bp->b_un.b_addr,
3273 		    offset, bp->b_bcount, &bp->b_resid, cred);
3274 		crfree(cred);
3275 		if (!error) {
3276 			if (bp->b_resid) {
3277 				/*
3278 				 * Didn't get it all because we hit EOF,
3279 				 * zero all the memory beyond the EOF.
3280 				 */
3281 				/* bzero(rdaddr + */
3282 				bzero(bp->b_un.b_addr +
3283 				    bp->b_bcount - bp->b_resid, bp->b_resid);
3284 			}
3285 			mutex_enter(&rp->r_statelock);
3286 			if (bp->b_resid == bp->b_bcount &&
3287 			    offset >= rp->r_size) {
3288 				/*
3289 				 * We didn't read anything at all as we are
3290 				 * past EOF.  Return an error indicator back
3291 				 * but don't destroy the pages (yet).
3292 				 */
3293 				error = NFS_EOF;
3294 			}
3295 			mutex_exit(&rp->r_statelock);
3296 		} else if (error == EACCES) {
3297 			mutex_enter(&rp->r_statelock);
3298 			if (cred != cr) {
3299 				if (rp->r_cred != NULL)
3300 					crfree(rp->r_cred);
3301 				rp->r_cred = cr;
3302 				crhold(cr);
3303 				cred = cr;
3304 				crhold(cred);
3305 				mutex_exit(&rp->r_statelock);
3306 				goto read_again;
3307 			}
3308 			mutex_exit(&rp->r_statelock);
3309 		}
3310 	} else {
3311 		if (!(rp->r_flags & RSTALE)) {
3312 			mutex_enter(&rp->r_statelock);
3313 			if (rp->r_cred != NULL) {
3314 				cred = rp->r_cred;
3315 				crhold(cred);
3316 			} else {
3317 				rp->r_cred = cr;
3318 				crhold(cr);
3319 				cred = cr;
3320 				crhold(cred);
3321 			}
3322 			mutex_exit(&rp->r_statelock);
3323 		write_again:
3324 			mutex_enter(&rp->r_statelock);
3325 			count = MIN(bp->b_bcount, rp->r_size - offset);
3326 			mutex_exit(&rp->r_statelock);
3327 			if (count < 0)
3328 				cmn_err(CE_PANIC, "nfs_bio: write count < 0");
3329 #ifdef DEBUG
3330 			if (count == 0) {
3331 				zcmn_err(getzoneid(), CE_WARN,
3332 				    "nfs_bio: zero length write at %d",
3333 				    offset);
3334 				nfs_printfhandle(&rp->r_fh);
3335 				if (nfs_bio_do_stop)
3336 					debug_enter("nfs_bio");
3337 			}
3338 #endif
3339 			error = nfswrite(bp->b_vp, bp->b_un.b_addr, offset,
3340 			    count, cred);
3341 			if (error == EACCES) {
3342 				mutex_enter(&rp->r_statelock);
3343 				if (cred != cr) {
3344 					if (rp->r_cred != NULL)
3345 						crfree(rp->r_cred);
3346 					rp->r_cred = cr;
3347 					crhold(cr);
3348 					crfree(cred);
3349 					cred = cr;
3350 					crhold(cred);
3351 					mutex_exit(&rp->r_statelock);
3352 					goto write_again;
3353 				}
3354 				mutex_exit(&rp->r_statelock);
3355 			}
3356 			bp->b_error = error;
3357 			if (error && error != EINTR) {
3358 				/*
3359 				 * Don't print EDQUOT errors on the console.
3360 				 * Don't print asynchronous EACCES errors.
3361 				 * Don't print EFBIG errors.
3362 				 * Print all other write errors.
3363 				 */
3364 				if (error != EDQUOT && error != EFBIG &&
3365 				    (error != EACCES ||
3366 				    !(bp->b_flags & B_ASYNC)))
3367 					nfs_write_error(bp->b_vp, error, cred);
3368 				/*
3369 				 * Update r_error and r_flags as appropriate.
3370 				 * If the error was ESTALE, then mark the
3371 				 * rnode as not being writeable and save
3372 				 * the error status.  Otherwise, save any
3373 				 * errors which occur from asynchronous
3374 				 * page invalidations.  Any errors occurring
3375 				 * from other operations should be saved
3376 				 * by the caller.
3377 				 */
3378 				mutex_enter(&rp->r_statelock);
3379 				if (error == ESTALE) {
3380 					rp->r_flags |= RSTALE;
3381 					if (!rp->r_error)
3382 						rp->r_error = error;
3383 				} else if (!rp->r_error &&
3384 				    (bp->b_flags &
3385 				    (B_INVAL|B_FORCE|B_ASYNC)) ==
3386 				    (B_INVAL|B_FORCE|B_ASYNC)) {
3387 					rp->r_error = error;
3388 				}
3389 				mutex_exit(&rp->r_statelock);
3390 			}
3391 			crfree(cred);
3392 		} else
3393 			error = rp->r_error;
3394 	}
3395 
3396 	if (error != 0 && error != NFS_EOF)
3397 		bp->b_flags |= B_ERROR;
3398 
3399 	DTRACE_IO1(done, struct buf *, bp);
3400 
3401 	return (error);
3402 }
3403 
3404 static int
3405 nfs_fid(vnode_t *vp, fid_t *fidp)
3406 {
3407 	struct nfs_fid *fp;
3408 	rnode_t *rp;
3409 
3410 	rp = VTOR(vp);
3411 
3412 	if (fidp->fid_len < (sizeof (struct nfs_fid) - sizeof (short))) {
3413 		fidp->fid_len = sizeof (struct nfs_fid) - sizeof (short);
3414 		return (ENOSPC);
3415 	}
3416 	fp = (struct nfs_fid *)fidp;
3417 	fp->nf_pad = 0;
3418 	fp->nf_len = sizeof (struct nfs_fid) - sizeof (short);
3419 	bcopy(rp->r_fh.fh_buf, fp->nf_data, NFS_FHSIZE);
3420 	return (0);
3421 }
3422 
3423 /* ARGSUSED2 */
3424 static int
3425 nfs_rwlock(vnode_t *vp, int write_lock, caller_context_t *ctp)
3426 {
3427 	rnode_t *rp = VTOR(vp);
3428 
3429 	if (!write_lock) {
3430 		(void) nfs_rw_enter_sig(&rp->r_rwlock, RW_READER, FALSE);
3431 		return (V_WRITELOCK_FALSE);
3432 	}
3433 
3434 	if ((rp->r_flags & RDIRECTIO) || (VTOMI(vp)->mi_flags & MI_DIRECTIO)) {
3435 		(void) nfs_rw_enter_sig(&rp->r_rwlock, RW_READER, FALSE);
3436 		if (rp->r_mapcnt == 0 && !vn_has_cached_data(vp))
3437 			return (V_WRITELOCK_FALSE);
3438 		nfs_rw_exit(&rp->r_rwlock);
3439 	}
3440 
3441 	(void) nfs_rw_enter_sig(&rp->r_rwlock, RW_WRITER, FALSE);
3442 	return (V_WRITELOCK_TRUE);
3443 }
3444 
3445 /* ARGSUSED */
3446 static void
3447 nfs_rwunlock(vnode_t *vp, int write_lock, caller_context_t *ctp)
3448 {
3449 	rnode_t *rp = VTOR(vp);
3450 
3451 	nfs_rw_exit(&rp->r_rwlock);
3452 }
3453 
3454 /* ARGSUSED */
3455 static int
3456 nfs_seek(vnode_t *vp, offset_t ooff, offset_t *noffp)
3457 {
3458 
3459 	/*
3460 	 * Because we stuff the readdir cookie into the offset field
3461 	 * someone may attempt to do an lseek with the cookie which
3462 	 * we want to succeed.
3463 	 */
3464 	if (vp->v_type == VDIR)
3465 		return (0);
3466 	if (*noffp < 0 || *noffp > MAXOFF32_T)
3467 		return (EINVAL);
3468 	return (0);
3469 }
3470 
3471 /*
3472  * number of NFS_MAXDATA blocks to read ahead
3473  * optimized for 100 base-T.
3474  */
3475 static int nfs_nra = 4;
3476 
3477 #ifdef DEBUG
3478 static int nfs_lostpage = 0;	/* number of times we lost original page */
3479 #endif
3480 
3481 /*
3482  * Return all the pages from [off..off+len) in file
3483  */
3484 static int
3485 nfs_getpage(vnode_t *vp, offset_t off, size_t len, uint_t *protp,
3486 	page_t *pl[], size_t plsz, struct seg *seg, caddr_t addr,
3487 	enum seg_rw rw, cred_t *cr)
3488 {
3489 	rnode_t *rp;
3490 	int error;
3491 	mntinfo_t *mi;
3492 
3493 	if (vp->v_flag & VNOMAP)
3494 		return (ENOSYS);
3495 
3496 	ASSERT(off <= MAXOFF32_T);
3497 	if (nfs_zone() != VTOMI(vp)->mi_zone)
3498 		return (EIO);
3499 	if (protp != NULL)
3500 		*protp = PROT_ALL;
3501 
3502 	/*
3503 	 * Now valididate that the caches are up to date.
3504 	 */
3505 	error = nfs_validate_caches(vp, cr);
3506 	if (error)
3507 		return (error);
3508 
3509 	rp = VTOR(vp);
3510 	mi = VTOMI(vp);
3511 retry:
3512 	mutex_enter(&rp->r_statelock);
3513 
3514 	/*
3515 	 * Don't create dirty pages faster than they
3516 	 * can be cleaned so that the system doesn't
3517 	 * get imbalanced.  If the async queue is
3518 	 * maxed out, then wait for it to drain before
3519 	 * creating more dirty pages.  Also, wait for
3520 	 * any threads doing pagewalks in the vop_getattr
3521 	 * entry points so that they don't block for
3522 	 * long periods.
3523 	 */
3524 	if (rw == S_CREATE) {
3525 		while ((mi->mi_max_threads != 0 &&
3526 		    rp->r_awcount > 2 * mi->mi_max_threads) ||
3527 		    rp->r_gcount > 0)
3528 			cv_wait(&rp->r_cv, &rp->r_statelock);
3529 	}
3530 
3531 	/*
3532 	 * If we are getting called as a side effect of an nfs_write()
3533 	 * operation the local file size might not be extended yet.
3534 	 * In this case we want to be able to return pages of zeroes.
3535 	 */
3536 	if (off + len > rp->r_size + PAGEOFFSET && seg != segkmap) {
3537 		mutex_exit(&rp->r_statelock);
3538 		return (EFAULT);		/* beyond EOF */
3539 	}
3540 
3541 	mutex_exit(&rp->r_statelock);
3542 
3543 	if (len <= PAGESIZE) {
3544 		error = nfs_getapage(vp, off, len, protp, pl, plsz,
3545 		    seg, addr, rw, cr);
3546 	} else {
3547 		error = pvn_getpages(nfs_getapage, vp, off, len, protp,
3548 		    pl, plsz, seg, addr, rw, cr);
3549 	}
3550 
3551 	switch (error) {
3552 	case NFS_EOF:
3553 		nfs_purge_caches(vp, NFS_NOPURGE_DNLC, cr);
3554 		goto retry;
3555 	case ESTALE:
3556 		PURGE_STALE_FH(error, vp, cr);
3557 	}
3558 
3559 	return (error);
3560 }
3561 
3562 /*
3563  * Called from pvn_getpages or nfs_getpage to get a particular page.
3564  */
3565 /* ARGSUSED */
3566 static int
3567 nfs_getapage(vnode_t *vp, u_offset_t off, size_t len, uint_t *protp,
3568 	page_t *pl[], size_t plsz, struct seg *seg, caddr_t addr,
3569 	enum seg_rw rw, cred_t *cr)
3570 {
3571 	rnode_t *rp;
3572 	uint_t bsize;
3573 	struct buf *bp;
3574 	page_t *pp;
3575 	u_offset_t lbn;
3576 	u_offset_t io_off;
3577 	u_offset_t blkoff;
3578 	u_offset_t rablkoff;
3579 	size_t io_len;
3580 	uint_t blksize;
3581 	int error;
3582 	int readahead;
3583 	int readahead_issued = 0;
3584 	int ra_window; /* readahead window */
3585 	page_t *pagefound;
3586 
3587 	if (nfs_zone() != VTOMI(vp)->mi_zone)
3588 		return (EIO);
3589 	rp = VTOR(vp);
3590 	bsize = MAX(vp->v_vfsp->vfs_bsize, PAGESIZE);
3591 
3592 reread:
3593 	bp = NULL;
3594 	pp = NULL;
3595 	pagefound = NULL;
3596 
3597 	if (pl != NULL)
3598 		pl[0] = NULL;
3599 
3600 	error = 0;
3601 	lbn = off / bsize;
3602 	blkoff = lbn * bsize;
3603 
3604 	/*
3605 	 * Queueing up the readahead before doing the synchronous read
3606 	 * results in a significant increase in read throughput because
3607 	 * of the increased parallelism between the async threads and
3608 	 * the process context.
3609 	 */
3610 	if ((off & ((vp->v_vfsp->vfs_bsize) - 1)) == 0 &&
3611 	    rw != S_CREATE &&
3612 	    !(vp->v_flag & VNOCACHE)) {
3613 		mutex_enter(&rp->r_statelock);
3614 
3615 		/*
3616 		 * Calculate the number of readaheads to do.
3617 		 * a) No readaheads at offset = 0.
3618 		 * b) Do maximum(nfs_nra) readaheads when the readahead
3619 		 *    window is closed.
3620 		 * c) Do readaheads between 1 to (nfs_nra - 1) depending
3621 		 *    upon how far the readahead window is open or close.
3622 		 * d) No readaheads if rp->r_nextr is not within the scope
3623 		 *    of the readahead window (random i/o).
3624 		 */
3625 
3626 		if (off == 0)
3627 			readahead = 0;
3628 		else if (blkoff == rp->r_nextr)
3629 			readahead = nfs_nra;
3630 		else if (rp->r_nextr > blkoff &&
3631 				((ra_window = (rp->r_nextr - blkoff) / bsize)
3632 					<= (nfs_nra - 1)))
3633 			readahead = nfs_nra - ra_window;
3634 		else
3635 			readahead = 0;
3636 
3637 		rablkoff = rp->r_nextr;
3638 		while (readahead > 0 && rablkoff + bsize < rp->r_size) {
3639 			mutex_exit(&rp->r_statelock);
3640 			if (nfs_async_readahead(vp, rablkoff + bsize,
3641 			    addr + (rablkoff + bsize - off), seg, cr,
3642 			    nfs_readahead) < 0) {
3643 				mutex_enter(&rp->r_statelock);
3644 				break;
3645 			}
3646 			readahead--;
3647 			rablkoff += bsize;
3648 			/*
3649 			 * Indicate that we did a readahead so
3650 			 * readahead offset is not updated
3651 			 * by the synchronous read below.
3652 			 */
3653 			readahead_issued = 1;
3654 			mutex_enter(&rp->r_statelock);
3655 			/*
3656 			 * set readahead offset to
3657 			 * offset of last async readahead
3658 			 * request.
3659 			 */
3660 			rp->r_nextr = rablkoff;
3661 		}
3662 		mutex_exit(&rp->r_statelock);
3663 	}
3664 
3665 again:
3666 	if ((pagefound = page_exists(vp, off)) == NULL) {
3667 		if (pl == NULL) {
3668 			(void) nfs_async_readahead(vp, blkoff, addr, seg, cr,
3669 			    nfs_readahead);
3670 		} else if (rw == S_CREATE) {
3671 			/*
3672 			 * Block for this page is not allocated, or the offset
3673 			 * is beyond the current allocation size, or we're
3674 			 * allocating a swap slot and the page was not found,
3675 			 * so allocate it and return a zero page.
3676 			 */
3677 			if ((pp = page_create_va(vp, off,
3678 			    PAGESIZE, PG_WAIT, seg, addr)) == NULL)
3679 				cmn_err(CE_PANIC, "nfs_getapage: page_create");
3680 			io_len = PAGESIZE;
3681 			mutex_enter(&rp->r_statelock);
3682 			rp->r_nextr = off + PAGESIZE;
3683 			mutex_exit(&rp->r_statelock);
3684 		} else {
3685 			/*
3686 			 * Need to go to server to get a BLOCK, exception to
3687 			 * that being while reading at offset = 0 or doing
3688 			 * random i/o, in that case read only a PAGE.
3689 			 */
3690 			mutex_enter(&rp->r_statelock);
3691 			if (blkoff < rp->r_size &&
3692 			    blkoff + bsize >= rp->r_size) {
3693 				/*
3694 				 * If only a block or less is left in
3695 				 * the file, read all that is remaining.
3696 				 */
3697 				if (rp->r_size <= off) {
3698 					/*
3699 					 * Trying to access beyond EOF,
3700 					 * set up to get at least one page.
3701 					 */
3702 					blksize = off + PAGESIZE - blkoff;
3703 				} else
3704 					blksize = rp->r_size - blkoff;
3705 			} else if ((off == 0) ||
3706 				(off != rp->r_nextr && !readahead_issued)) {
3707 				blksize = PAGESIZE;
3708 				blkoff = off; /* block = page here */
3709 			} else
3710 				blksize = bsize;
3711 			mutex_exit(&rp->r_statelock);
3712 
3713 			pp = pvn_read_kluster(vp, off, seg, addr, &io_off,
3714 			    &io_len, blkoff, blksize, 0);
3715 
3716 			/*
3717 			 * Some other thread has entered the page,
3718 			 * so just use it.
3719 			 */
3720 			if (pp == NULL)
3721 				goto again;
3722 
3723 			/*
3724 			 * Now round the request size up to page boundaries.
3725 			 * This ensures that the entire page will be
3726 			 * initialized to zeroes if EOF is encountered.
3727 			 */
3728 			io_len = ptob(btopr(io_len));
3729 
3730 			bp = pageio_setup(pp, io_len, vp, B_READ);
3731 			ASSERT(bp != NULL);
3732 
3733 			/*
3734 			 * pageio_setup should have set b_addr to 0.  This
3735 			 * is correct since we want to do I/O on a page
3736 			 * boundary.  bp_mapin will use this addr to calculate
3737 			 * an offset, and then set b_addr to the kernel virtual
3738 			 * address it allocated for us.
3739 			 */
3740 			ASSERT(bp->b_un.b_addr == 0);
3741 
3742 			bp->b_edev = 0;
3743 			bp->b_dev = 0;
3744 			bp->b_lblkno = lbtodb(io_off);
3745 			bp->b_file = vp;
3746 			bp->b_offset = (offset_t)off;
3747 			bp_mapin(bp);
3748 
3749 			/*
3750 			 * If doing a write beyond what we believe is EOF,
3751 			 * don't bother trying to read the pages from the
3752 			 * server, we'll just zero the pages here.  We
3753 			 * don't check that the rw flag is S_WRITE here
3754 			 * because some implementations may attempt a
3755 			 * read access to the buffer before copying data.
3756 			 */
3757 			mutex_enter(&rp->r_statelock);
3758 			if (io_off >= rp->r_size && seg == segkmap) {
3759 				mutex_exit(&rp->r_statelock);
3760 				bzero(bp->b_un.b_addr, io_len);
3761 			} else {
3762 				mutex_exit(&rp->r_statelock);
3763 				error = nfs_bio(bp, cr);
3764 			}
3765 
3766 			/*
3767 			 * Unmap the buffer before freeing it.
3768 			 */
3769 			bp_mapout(bp);
3770 			pageio_done(bp);
3771 
3772 			if (error == NFS_EOF) {
3773 				/*
3774 				 * If doing a write system call just return
3775 				 * zeroed pages, else user tried to get pages
3776 				 * beyond EOF, return error.  We don't check
3777 				 * that the rw flag is S_WRITE here because
3778 				 * some implementations may attempt a read
3779 				 * access to the buffer before copying data.
3780 				 */
3781 				if (seg == segkmap)
3782 					error = 0;
3783 				else
3784 					error = EFAULT;
3785 			}
3786 
3787 			if (!readahead_issued && !error) {
3788 			    mutex_enter(&rp->r_statelock);
3789 			    rp->r_nextr = io_off + io_len;
3790 			    mutex_exit(&rp->r_statelock);
3791 			}
3792 		}
3793 	}
3794 
3795 out:
3796 	if (pl == NULL)
3797 		return (error);
3798 
3799 	if (error) {
3800 		if (pp != NULL)
3801 			pvn_read_done(pp, B_ERROR);
3802 		return (error);
3803 	}
3804 
3805 	if (pagefound) {
3806 		se_t se = (rw == S_CREATE ? SE_EXCL : SE_SHARED);
3807 
3808 		/*
3809 		 * Page exists in the cache, acquire the appropriate lock.
3810 		 * If this fails, start all over again.
3811 		 */
3812 		if ((pp = page_lookup(vp, off, se)) == NULL) {
3813 #ifdef DEBUG
3814 			nfs_lostpage++;
3815 #endif
3816 			goto reread;
3817 		}
3818 		pl[0] = pp;
3819 		pl[1] = NULL;
3820 		return (0);
3821 	}
3822 
3823 	if (pp != NULL)
3824 		pvn_plist_init(pp, pl, plsz, off, io_len, rw);
3825 
3826 	return (error);
3827 }
3828 
3829 static void
3830 nfs_readahead(vnode_t *vp, u_offset_t blkoff, caddr_t addr, struct seg *seg,
3831 	cred_t *cr)
3832 {
3833 	int error;
3834 	page_t *pp;
3835 	u_offset_t io_off;
3836 	size_t io_len;
3837 	struct buf *bp;
3838 	uint_t bsize, blksize;
3839 	rnode_t *rp = VTOR(vp);
3840 
3841 	ASSERT(nfs_zone() == VTOMI(vp)->mi_zone);
3842 
3843 	bsize = MAX(vp->v_vfsp->vfs_bsize, PAGESIZE);
3844 
3845 	mutex_enter(&rp->r_statelock);
3846 	if (blkoff < rp->r_size && blkoff + bsize > rp->r_size) {
3847 		/*
3848 		 * If less than a block left in file read less
3849 		 * than a block.
3850 		 */
3851 		blksize = rp->r_size - blkoff;
3852 	} else
3853 		blksize = bsize;
3854 	mutex_exit(&rp->r_statelock);
3855 
3856 	pp = pvn_read_kluster(vp, blkoff, segkmap, addr,
3857 	    &io_off, &io_len, blkoff, blksize, 1);
3858 	/*
3859 	 * The isra flag passed to the kluster function is 1, we may have
3860 	 * gotten a return value of NULL for a variety of reasons (# of free
3861 	 * pages < minfree, someone entered the page on the vnode etc). In all
3862 	 * cases, we want to punt on the readahead.
3863 	 */
3864 	if (pp == NULL)
3865 		return;
3866 
3867 	/*
3868 	 * Now round the request size up to page boundaries.
3869 	 * This ensures that the entire page will be
3870 	 * initialized to zeroes if EOF is encountered.
3871 	 */
3872 	io_len = ptob(btopr(io_len));
3873 
3874 	bp = pageio_setup(pp, io_len, vp, B_READ);
3875 	ASSERT(bp != NULL);
3876 
3877 	/*
3878 	 * pageio_setup should have set b_addr to 0.  This is correct since
3879 	 * we want to do I/O on a page boundary. bp_mapin() will use this addr
3880 	 * to calculate an offset, and then set b_addr to the kernel virtual
3881 	 * address it allocated for us.
3882 	 */
3883 	ASSERT(bp->b_un.b_addr == 0);
3884 
3885 	bp->b_edev = 0;
3886 	bp->b_dev = 0;
3887 	bp->b_lblkno = lbtodb(io_off);
3888 	bp->b_file = vp;
3889 	bp->b_offset = (offset_t)blkoff;
3890 	bp_mapin(bp);
3891 
3892 	/*
3893 	 * If doing a write beyond what we believe is EOF, don't bother trying
3894 	 * to read the pages from the server, we'll just zero the pages here.
3895 	 * We don't check that the rw flag is S_WRITE here because some
3896 	 * implementations may attempt a read access to the buffer before
3897 	 * copying data.
3898 	 */
3899 	mutex_enter(&rp->r_statelock);
3900 	if (io_off >= rp->r_size && seg == segkmap) {
3901 		mutex_exit(&rp->r_statelock);
3902 		bzero(bp->b_un.b_addr, io_len);
3903 		error = 0;
3904 	} else {
3905 		mutex_exit(&rp->r_statelock);
3906 		error = nfs_bio(bp, cr);
3907 		if (error == NFS_EOF)
3908 			error = 0;
3909 	}
3910 
3911 	/*
3912 	 * Unmap the buffer before freeing it.
3913 	 */
3914 	bp_mapout(bp);
3915 	pageio_done(bp);
3916 
3917 	pvn_read_done(pp, error ? B_READ | B_ERROR : B_READ);
3918 
3919 	/*
3920 	 * In case of error set readahead offset
3921 	 * to the lowest offset.
3922 	 * pvn_read_done() calls VN_DISPOSE to destroy the pages
3923 	 */
3924 	if (error && rp->r_nextr > io_off) {
3925 		mutex_enter(&rp->r_statelock);
3926 		if (rp->r_nextr > io_off)
3927 			rp->r_nextr = io_off;
3928 		mutex_exit(&rp->r_statelock);
3929 	}
3930 }
3931 
3932 /*
3933  * Flags are composed of {B_INVAL, B_FREE, B_DONTNEED, B_FORCE}
3934  * If len == 0, do from off to EOF.
3935  *
3936  * The normal cases should be len == 0 && off == 0 (entire vp list),
3937  * len == MAXBSIZE (from segmap_release actions), and len == PAGESIZE
3938  * (from pageout).
3939  */
3940 static int
3941 nfs_putpage(vnode_t *vp, offset_t off, size_t len, int flags, cred_t *cr)
3942 {
3943 	int error;
3944 	rnode_t *rp;
3945 
3946 	ASSERT(cr != NULL);
3947 
3948 	/*
3949 	 * XXX - Why should this check be made here?
3950 	 */
3951 	if (vp->v_flag & VNOMAP)
3952 		return (ENOSYS);
3953 
3954 	if (len == 0 && !(flags & B_INVAL) && vn_is_readonly(vp))
3955 		return (0);
3956 
3957 	if (!(flags & B_ASYNC) && nfs_zone() != VTOMI(vp)->mi_zone)
3958 		return (EIO);
3959 	ASSERT(off <= MAXOFF32_T);
3960 
3961 	rp = VTOR(vp);
3962 	mutex_enter(&rp->r_statelock);
3963 	rp->r_count++;
3964 	mutex_exit(&rp->r_statelock);
3965 	error = nfs_putpages(vp, off, len, flags, cr);
3966 	mutex_enter(&rp->r_statelock);
3967 	rp->r_count--;
3968 	cv_broadcast(&rp->r_cv);
3969 	mutex_exit(&rp->r_statelock);
3970 
3971 	return (error);
3972 }
3973 
3974 /*
3975  * Write out a single page, possibly klustering adjacent dirty pages.
3976  */
3977 int
3978 nfs_putapage(vnode_t *vp, page_t *pp, u_offset_t *offp, size_t *lenp,
3979 	int flags, cred_t *cr)
3980 {
3981 	u_offset_t io_off;
3982 	u_offset_t lbn_off;
3983 	u_offset_t lbn;
3984 	size_t io_len;
3985 	uint_t bsize;
3986 	int error;
3987 	rnode_t *rp;
3988 
3989 	ASSERT(!vn_is_readonly(vp));
3990 	ASSERT(pp != NULL);
3991 	ASSERT(cr != NULL);
3992 	ASSERT((flags & B_ASYNC) || nfs_zone() == VTOMI(vp)->mi_zone);
3993 
3994 	rp = VTOR(vp);
3995 	ASSERT(rp->r_count > 0);
3996 
3997 	ASSERT(pp->p_offset <= MAXOFF32_T);
3998 
3999 	bsize = MAX(vp->v_vfsp->vfs_bsize, PAGESIZE);
4000 	lbn = pp->p_offset / bsize;
4001 	lbn_off = lbn * bsize;
4002 
4003 	/*
4004 	 * Find a kluster that fits in one block, or in
4005 	 * one page if pages are bigger than blocks.  If
4006 	 * there is less file space allocated than a whole
4007 	 * page, we'll shorten the i/o request below.
4008 	 */
4009 	pp = pvn_write_kluster(vp, pp, &io_off, &io_len, lbn_off,
4010 	    roundup(bsize, PAGESIZE), flags);
4011 
4012 	/*
4013 	 * pvn_write_kluster shouldn't have returned a page with offset
4014 	 * behind the original page we were given.  Verify that.
4015 	 */
4016 	ASSERT((pp->p_offset / bsize) >= lbn);
4017 
4018 	/*
4019 	 * Now pp will have the list of kept dirty pages marked for
4020 	 * write back.  It will also handle invalidation and freeing
4021 	 * of pages that are not dirty.  Check for page length rounding
4022 	 * problems.
4023 	 */
4024 	if (io_off + io_len > lbn_off + bsize) {
4025 		ASSERT((io_off + io_len) - (lbn_off + bsize) < PAGESIZE);
4026 		io_len = lbn_off + bsize - io_off;
4027 	}
4028 	/*
4029 	 * The RMODINPROGRESS flag makes sure that nfs(3)_bio() sees a
4030 	 * consistent value of r_size. RMODINPROGRESS is set in writerp().
4031 	 * When RMODINPROGRESS is set it indicates that a uiomove() is in
4032 	 * progress and the r_size has not been made consistent with the
4033 	 * new size of the file. When the uiomove() completes the r_size is
4034 	 * updated and the RMODINPROGRESS flag is cleared.
4035 	 *
4036 	 * The RMODINPROGRESS flag makes sure that nfs(3)_bio() sees a
4037 	 * consistent value of r_size. Without this handshaking, it is
4038 	 * possible that nfs(3)_bio() picks  up the old value of r_size
4039 	 * before the uiomove() in writerp() completes. This will result
4040 	 * in the write through nfs(3)_bio() being dropped.
4041 	 *
4042 	 * More precisely, there is a window between the time the uiomove()
4043 	 * completes and the time the r_size is updated. If a VOP_PUTPAGE()
4044 	 * operation intervenes in this window, the page will be picked up,
4045 	 * because it is dirty (it will be unlocked, unless it was
4046 	 * pagecreate'd). When the page is picked up as dirty, the dirty
4047 	 * bit is reset (pvn_getdirty()). In nfs(3)write(), r_size is
4048 	 * checked. This will still be the old size. Therefore the page will
4049 	 * not be written out. When segmap_release() calls VOP_PUTPAGE(),
4050 	 * the page will be found to be clean and the write will be dropped.
4051 	 */
4052 	if (rp->r_flags & RMODINPROGRESS) {
4053 		mutex_enter(&rp->r_statelock);
4054 		if ((rp->r_flags & RMODINPROGRESS) &&
4055 		    rp->r_modaddr + MAXBSIZE > io_off &&
4056 		    rp->r_modaddr < io_off + io_len) {
4057 			page_t *plist;
4058 			/*
4059 			 * A write is in progress for this region of the file.
4060 			 * If we did not detect RMODINPROGRESS here then this
4061 			 * path through nfs_putapage() would eventually go to
4062 			 * nfs(3)_bio() and may not write out all of the data
4063 			 * in the pages. We end up losing data. So we decide
4064 			 * to set the modified bit on each page in the page
4065 			 * list and mark the rnode with RDIRTY. This write
4066 			 * will be restarted at some later time.
4067 			 */
4068 			plist = pp;
4069 			while (plist != NULL) {
4070 				pp = plist;
4071 				page_sub(&plist, pp);
4072 				hat_setmod(pp);
4073 				page_io_unlock(pp);
4074 				page_unlock(pp);
4075 			}
4076 			rp->r_flags |= RDIRTY;
4077 			mutex_exit(&rp->r_statelock);
4078 			if (offp)
4079 				*offp = io_off;
4080 			if (lenp)
4081 				*lenp = io_len;
4082 			return (0);
4083 		}
4084 		mutex_exit(&rp->r_statelock);
4085 	}
4086 
4087 	if (flags & B_ASYNC) {
4088 		error = nfs_async_putapage(vp, pp, io_off, io_len, flags, cr,
4089 		    nfs_sync_putapage);
4090 	} else
4091 		error = nfs_sync_putapage(vp, pp, io_off, io_len, flags, cr);
4092 
4093 	if (offp)
4094 		*offp = io_off;
4095 	if (lenp)
4096 		*lenp = io_len;
4097 	return (error);
4098 }
4099 
4100 static int
4101 nfs_sync_putapage(vnode_t *vp, page_t *pp, u_offset_t io_off, size_t io_len,
4102 	int flags, cred_t *cr)
4103 {
4104 	int error;
4105 	rnode_t *rp;
4106 
4107 	flags |= B_WRITE;
4108 
4109 	ASSERT(nfs_zone() == VTOMI(vp)->mi_zone);
4110 	error = nfs_rdwrlbn(vp, pp, io_off, io_len, flags, cr);
4111 
4112 	rp = VTOR(vp);
4113 
4114 	if ((error == ENOSPC || error == EDQUOT || error == EACCES) &&
4115 	    (flags & (B_INVAL|B_FORCE)) != (B_INVAL|B_FORCE)) {
4116 		if (!(rp->r_flags & ROUTOFSPACE)) {
4117 			mutex_enter(&rp->r_statelock);
4118 			rp->r_flags |= ROUTOFSPACE;
4119 			mutex_exit(&rp->r_statelock);
4120 		}
4121 		flags |= B_ERROR;
4122 		pvn_write_done(pp, flags);
4123 		/*
4124 		 * If this was not an async thread, then try again to
4125 		 * write out the pages, but this time, also destroy
4126 		 * them whether or not the write is successful.  This
4127 		 * will prevent memory from filling up with these
4128 		 * pages and destroying them is the only alternative
4129 		 * if they can't be written out.
4130 		 *
4131 		 * Don't do this if this is an async thread because
4132 		 * when the pages are unlocked in pvn_write_done,
4133 		 * some other thread could have come along, locked
4134 		 * them, and queued for an async thread.  It would be
4135 		 * possible for all of the async threads to be tied
4136 		 * up waiting to lock the pages again and they would
4137 		 * all already be locked and waiting for an async
4138 		 * thread to handle them.  Deadlock.
4139 		 */
4140 		if (!(flags & B_ASYNC)) {
4141 			error = nfs_putpage(vp, io_off, io_len,
4142 			    B_INVAL | B_FORCE, cr);
4143 		}
4144 	} else {
4145 		if (error)
4146 			flags |= B_ERROR;
4147 		else if (rp->r_flags & ROUTOFSPACE) {
4148 			mutex_enter(&rp->r_statelock);
4149 			rp->r_flags &= ~ROUTOFSPACE;
4150 			mutex_exit(&rp->r_statelock);
4151 		}
4152 		pvn_write_done(pp, flags);
4153 	}
4154 
4155 	return (error);
4156 }
4157 
4158 static int
4159 nfs_map(vnode_t *vp, offset_t off, struct as *as, caddr_t *addrp,
4160 	size_t len, uchar_t prot, uchar_t maxprot, uint_t flags, cred_t *cr)
4161 {
4162 	struct segvn_crargs vn_a;
4163 	int error;
4164 	rnode_t *rp;
4165 	struct vattr va;
4166 
4167 	if (nfs_zone() != VTOMI(vp)->mi_zone)
4168 		return (EIO);
4169 
4170 	if (vp->v_flag & VNOMAP)
4171 		return (ENOSYS);
4172 
4173 	if (off > MAXOFF32_T)
4174 		return (EFBIG);
4175 
4176 	if (off < 0 || off + len < 0)
4177 		return (ENXIO);
4178 
4179 	if (vp->v_type != VREG)
4180 		return (ENODEV);
4181 
4182 	/*
4183 	 * If there is cached data and if close-to-open consistency
4184 	 * checking is not turned off and if the file system is not
4185 	 * mounted readonly, then force an over the wire getattr.
4186 	 * Otherwise, just invoke nfsgetattr to get a copy of the
4187 	 * attributes.  The attribute cache will be used unless it
4188 	 * is timed out and if it is, then an over the wire getattr
4189 	 * will be issued.
4190 	 */
4191 	va.va_mask = AT_ALL;
4192 	if (vn_has_cached_data(vp) &&
4193 	    !(VTOMI(vp)->mi_flags & MI_NOCTO) && !vn_is_readonly(vp))
4194 		error = nfs_getattr_otw(vp, &va, cr);
4195 	else
4196 		error = nfsgetattr(vp, &va, cr);
4197 	if (error)
4198 		return (error);
4199 
4200 	/*
4201 	 * Check to see if the vnode is currently marked as not cachable.
4202 	 * This means portions of the file are locked (through VOP_FRLOCK).
4203 	 * In this case the map request must be refused.  We use
4204 	 * rp->r_lkserlock to avoid a race with concurrent lock requests.
4205 	 */
4206 	rp = VTOR(vp);
4207 	if (nfs_rw_enter_sig(&rp->r_lkserlock, RW_READER, INTR(vp)))
4208 		return (EINTR);
4209 
4210 	if (vp->v_flag & VNOCACHE) {
4211 		error = EAGAIN;
4212 		goto done;
4213 	}
4214 
4215 	/*
4216 	 * Don't allow concurrent locks and mapping if mandatory locking is
4217 	 * enabled.
4218 	 */
4219 	if ((flk_has_remote_locks(vp) || lm_has_sleep(vp)) &&
4220 	    MANDLOCK(vp, va.va_mode)) {
4221 		error = EAGAIN;
4222 		goto done;
4223 	}
4224 
4225 	as_rangelock(as);
4226 	if (!(flags & MAP_FIXED)) {
4227 		map_addr(addrp, len, off, 1, flags);
4228 		if (*addrp == NULL) {
4229 			as_rangeunlock(as);
4230 			error = ENOMEM;
4231 			goto done;
4232 		}
4233 	} else {
4234 		/*
4235 		 * User specified address - blow away any previous mappings
4236 		 */
4237 		(void) as_unmap(as, *addrp, len);
4238 	}
4239 
4240 	vn_a.vp = vp;
4241 	vn_a.offset = off;
4242 	vn_a.type = (flags & MAP_TYPE);
4243 	vn_a.prot = (uchar_t)prot;
4244 	vn_a.maxprot = (uchar_t)maxprot;
4245 	vn_a.flags = (flags & ~MAP_TYPE);
4246 	vn_a.cred = cr;
4247 	vn_a.amp = NULL;
4248 	vn_a.szc = 0;
4249 	vn_a.lgrp_mem_policy_flags = 0;
4250 
4251 	error = as_map(as, *addrp, len, segvn_create, &vn_a);
4252 	as_rangeunlock(as);
4253 
4254 done:
4255 	nfs_rw_exit(&rp->r_lkserlock);
4256 	return (error);
4257 }
4258 
4259 /* ARGSUSED */
4260 static int
4261 nfs_addmap(vnode_t *vp, offset_t off, struct as *as, caddr_t addr,
4262 	size_t len, uchar_t prot, uchar_t maxprot, uint_t flags, cred_t *cr)
4263 {
4264 	rnode_t *rp;
4265 
4266 	if (vp->v_flag & VNOMAP)
4267 		return (ENOSYS);
4268 	if (nfs_zone() != VTOMI(vp)->mi_zone)
4269 		return (EIO);
4270 
4271 	/*
4272 	 * Need to hold rwlock while incrementing the mapcnt so that
4273 	 * mmap'ing can be serialized with writes so that the caching
4274 	 * can be handled correctly.
4275 	 */
4276 	rp = VTOR(vp);
4277 	if (nfs_rw_enter_sig(&rp->r_rwlock, RW_WRITER, INTR(vp)))
4278 		return (EINTR);
4279 	atomic_add_long((ulong_t *)&rp->r_mapcnt, btopr(len));
4280 	nfs_rw_exit(&rp->r_rwlock);
4281 
4282 	return (0);
4283 }
4284 
4285 static int
4286 nfs_frlock(vnode_t *vp, int cmd, struct flock64 *bfp, int flag,
4287 	offset_t offset, struct flk_callback *flk_cbp, cred_t *cr)
4288 {
4289 	netobj lm_fh;
4290 	int rc;
4291 	u_offset_t start, end;
4292 	rnode_t *rp;
4293 	int error = 0, intr = INTR(vp);
4294 
4295 	/* check for valid cmd parameter */
4296 	if (cmd != F_GETLK && cmd != F_SETLK && cmd != F_SETLKW)
4297 		return (EINVAL);
4298 	if (nfs_zone() != VTOMI(vp)->mi_zone)
4299 		return (EIO);
4300 
4301 	/* Verify l_type. */
4302 	switch (bfp->l_type) {
4303 	case F_RDLCK:
4304 		if (cmd != F_GETLK && !(flag & FREAD))
4305 			return (EBADF);
4306 		break;
4307 	case F_WRLCK:
4308 		if (cmd != F_GETLK && !(flag & FWRITE))
4309 			return (EBADF);
4310 		break;
4311 	case F_UNLCK:
4312 		intr = 0;
4313 		break;
4314 
4315 	default:
4316 		return (EINVAL);
4317 	}
4318 
4319 	/* check the validity of the lock range */
4320 	if (rc = flk_convert_lock_data(vp, bfp, &start, &end, offset))
4321 		return (rc);
4322 	if (rc = flk_check_lock_data(start, end, MAXOFF32_T))
4323 		return (rc);
4324 
4325 	/*
4326 	 * If the filesystem is mounted using local locking, pass the
4327 	 * request off to the local locking code.
4328 	 */
4329 	if (VTOMI(vp)->mi_flags & MI_LLOCK) {
4330 		if (offset > MAXOFF32_T)
4331 			return (EFBIG);
4332 		if (cmd == F_SETLK || cmd == F_SETLKW) {
4333 			/*
4334 			 * For complete safety, we should be holding
4335 			 * r_lkserlock.  However, we can't call
4336 			 * lm_safelock and then fs_frlock while
4337 			 * holding r_lkserlock, so just invoke
4338 			 * lm_safelock and expect that this will
4339 			 * catch enough of the cases.
4340 			 */
4341 			if (!lm_safelock(vp, bfp, cr))
4342 				return (EAGAIN);
4343 		}
4344 		return (fs_frlock(vp, cmd, bfp, flag, offset, flk_cbp, cr));
4345 	}
4346 
4347 	rp = VTOR(vp);
4348 
4349 	/*
4350 	 * Check whether the given lock request can proceed, given the
4351 	 * current file mappings.
4352 	 */
4353 	if (nfs_rw_enter_sig(&rp->r_lkserlock, RW_WRITER, intr))
4354 		return (EINTR);
4355 	if (cmd == F_SETLK || cmd == F_SETLKW) {
4356 		if (!lm_safelock(vp, bfp, cr)) {
4357 			rc = EAGAIN;
4358 			goto done;
4359 		}
4360 	}
4361 
4362 	/*
4363 	 * Flush the cache after waiting for async I/O to finish.  For new
4364 	 * locks, this is so that the process gets the latest bits from the
4365 	 * server.  For unlocks, this is so that other clients see the
4366 	 * latest bits once the file has been unlocked.  If currently dirty
4367 	 * pages can't be flushed, then don't allow a lock to be set.  But
4368 	 * allow unlocks to succeed, to avoid having orphan locks on the
4369 	 * server.
4370 	 */
4371 	if (cmd != F_GETLK) {
4372 		mutex_enter(&rp->r_statelock);
4373 		while (rp->r_count > 0) {
4374 		    if (intr) {
4375 			klwp_t *lwp = ttolwp(curthread);
4376 
4377 			if (lwp != NULL)
4378 				lwp->lwp_nostop++;
4379 			if (cv_wait_sig(&rp->r_cv, &rp->r_statelock) == 0) {
4380 				if (lwp != NULL)
4381 					lwp->lwp_nostop--;
4382 				rc = EINTR;
4383 				break;
4384 			}
4385 			if (lwp != NULL)
4386 				lwp->lwp_nostop--;
4387 		    } else
4388 			cv_wait(&rp->r_cv, &rp->r_statelock);
4389 		}
4390 		mutex_exit(&rp->r_statelock);
4391 		if (rc != 0)
4392 			goto done;
4393 		error = nfs_putpage(vp, (offset_t)0, 0, B_INVAL, cr);
4394 		if (error) {
4395 			if (error == ENOSPC || error == EDQUOT) {
4396 				mutex_enter(&rp->r_statelock);
4397 				if (!rp->r_error)
4398 					rp->r_error = error;
4399 				mutex_exit(&rp->r_statelock);
4400 			}
4401 			if (bfp->l_type != F_UNLCK) {
4402 				rc = ENOLCK;
4403 				goto done;
4404 			}
4405 		}
4406 	}
4407 
4408 	lm_fh.n_len = sizeof (fhandle_t);
4409 	lm_fh.n_bytes = (char *)VTOFH(vp);
4410 
4411 	/*
4412 	 * Call the lock manager to do the real work of contacting
4413 	 * the server and obtaining the lock.
4414 	 */
4415 	rc = lm_frlock(vp, cmd, bfp, flag, offset, cr, &lm_fh, flk_cbp);
4416 
4417 	if (rc == 0)
4418 		nfs_lockcompletion(vp, cmd);
4419 
4420 done:
4421 	nfs_rw_exit(&rp->r_lkserlock);
4422 	return (rc);
4423 }
4424 
4425 /*
4426  * Free storage space associated with the specified vnode.  The portion
4427  * to be freed is specified by bfp->l_start and bfp->l_len (already
4428  * normalized to a "whence" of 0).
4429  *
4430  * This is an experimental facility whose continued existence is not
4431  * guaranteed.  Currently, we only support the special case
4432  * of l_len == 0, meaning free to end of file.
4433  */
4434 /* ARGSUSED */
4435 static int
4436 nfs_space(vnode_t *vp, int cmd, struct flock64 *bfp, int flag,
4437 	offset_t offset, cred_t *cr, caller_context_t *ct)
4438 {
4439 	int error;
4440 
4441 	ASSERT(vp->v_type == VREG);
4442 	if (cmd != F_FREESP)
4443 		return (EINVAL);
4444 
4445 	if (offset > MAXOFF32_T)
4446 		return (EFBIG);
4447 
4448 	if ((bfp->l_start > MAXOFF32_T) || (bfp->l_end > MAXOFF32_T) ||
4449 	    (bfp->l_len > MAXOFF32_T))
4450 		return (EFBIG);
4451 
4452 	if (nfs_zone() != VTOMI(vp)->mi_zone)
4453 		return (EIO);
4454 
4455 	error = convoff(vp, bfp, 0, offset);
4456 	if (!error) {
4457 		ASSERT(bfp->l_start >= 0);
4458 		if (bfp->l_len == 0) {
4459 			struct vattr va;
4460 
4461 			/*
4462 			 * ftruncate should not change the ctime and
4463 			 * mtime if we truncate the file to its
4464 			 * previous size.
4465 			 */
4466 			va.va_mask = AT_SIZE;
4467 			error = nfsgetattr(vp, &va, cr);
4468 			if (error || va.va_size == bfp->l_start)
4469 				return (error);
4470 			va.va_mask = AT_SIZE;
4471 			va.va_size = bfp->l_start;
4472 			error = nfssetattr(vp, &va, 0, cr);
4473 		} else
4474 			error = EINVAL;
4475 	}
4476 
4477 	return (error);
4478 }
4479 
4480 /* ARGSUSED */
4481 static int
4482 nfs_realvp(vnode_t *vp, vnode_t **vpp)
4483 {
4484 
4485 	return (EINVAL);
4486 }
4487 
4488 /*
4489  * Setup and add an address space callback to do the work of the delmap call.
4490  * The callback will (and must be) deleted in the actual callback function.
4491  *
4492  * This is done in order to take care of the problem that we have with holding
4493  * the address space's a_lock for a long period of time (e.g. if the NFS server
4494  * is down).  Callbacks will be executed in the address space code while the
4495  * a_lock is not held.	Holding the address space's a_lock causes things such
4496  * as ps and fork to hang because they are trying to acquire this lock as well.
4497  */
4498 /* ARGSUSED */
4499 static int
4500 nfs_delmap(vnode_t *vp, offset_t off, struct as *as, caddr_t addr,
4501 	size_t len, uint_t prot, uint_t maxprot, uint_t flags, cred_t *cr)
4502 {
4503 	int			caller_found;
4504 	int			error;
4505 	rnode_t			*rp;
4506 	nfs_delmap_args_t	*dmapp;
4507 	nfs_delmapcall_t	*delmap_call;
4508 
4509 	if (vp->v_flag & VNOMAP)
4510 		return (ENOSYS);
4511 	/*
4512 	 * A process may not change zones if it has NFS pages mmap'ed
4513 	 * in, so we can't legitimately get here from the wrong zone.
4514 	 */
4515 	ASSERT(nfs_zone() == VTOMI(vp)->mi_zone);
4516 
4517 	rp = VTOR(vp);
4518 
4519 	/*
4520 	 * The way that the address space of this process deletes its mapping
4521 	 * of this file is via the following call chains:
4522 	 * - as_free()->SEGOP_UNMAP()/segvn_unmap()->VOP_DELMAP()/nfs_delmap()
4523 	 * - as_unmap()->SEGOP_UNMAP()/segvn_unmap()->VOP_DELMAP()/nfs_delmap()
4524 	 *
4525 	 * With the use of address space callbacks we are allowed to drop the
4526 	 * address space lock, a_lock, while executing the NFS operations that
4527 	 * need to go over the wire.  Returning EAGAIN to the caller of this
4528 	 * function is what drives the execution of the callback that we add
4529 	 * below.  The callback will be executed by the address space code
4530 	 * after dropping the a_lock.  When the callback is finished, since
4531 	 * we dropped the a_lock, it must be re-acquired and segvn_unmap()
4532 	 * is called again on the same segment to finish the rest of the work
4533 	 * that needs to happen during unmapping.
4534 	 *
4535 	 * This action of calling back into the segment driver causes
4536 	 * nfs_delmap() to get called again, but since the callback was
4537 	 * already executed at this point, it already did the work and there
4538 	 * is nothing left for us to do.
4539 	 *
4540 	 * To Summarize:
4541 	 * - The first time nfs_delmap is called by the current thread is when
4542 	 * we add the caller associated with this delmap to the delmap caller
4543 	 * list, add the callback, and return EAGAIN.
4544 	 * - The second time in this call chain when nfs_delmap is called we
4545 	 * will find this caller in the delmap caller list and realize there
4546 	 * is no more work to do thus removing this caller from the list and
4547 	 * returning the error that was set in the callback execution.
4548 	 */
4549 	caller_found = nfs_find_and_delete_delmapcall(rp, &error);
4550 	if (caller_found) {
4551 		/*
4552 		 * 'error' is from the actual delmap operations.  To avoid
4553 		 * hangs, we need to handle the return of EAGAIN differently
4554 		 * since this is what drives the callback execution.
4555 		 * In this case, we don't want to return EAGAIN and do the
4556 		 * callback execution because there are none to execute.
4557 		 */
4558 		if (error == EAGAIN)
4559 			return (0);
4560 		else
4561 			return (error);
4562 	}
4563 
4564 	/* current caller was not in the list */
4565 	delmap_call = nfs_init_delmapcall();
4566 
4567 	mutex_enter(&rp->r_statelock);
4568 	list_insert_tail(&rp->r_indelmap, delmap_call);
4569 	mutex_exit(&rp->r_statelock);
4570 
4571 	dmapp = kmem_alloc(sizeof (nfs_delmap_args_t), KM_SLEEP);
4572 
4573 	dmapp->vp = vp;
4574 	dmapp->off = off;
4575 	dmapp->addr = addr;
4576 	dmapp->len = len;
4577 	dmapp->prot = prot;
4578 	dmapp->maxprot = maxprot;
4579 	dmapp->flags = flags;
4580 	dmapp->cr = cr;
4581 	dmapp->caller = delmap_call;
4582 
4583 	error = as_add_callback(as, nfs_delmap_callback, dmapp,
4584 	    AS_UNMAP_EVENT, addr, len, KM_SLEEP);
4585 
4586 	return (error ? error : EAGAIN);
4587 }
4588 
4589 /*
4590  * Remove some pages from an mmap'd vnode.  Just update the
4591  * count of pages.  If doing close-to-open, then flush all
4592  * of the pages associated with this file.  Otherwise, start
4593  * an asynchronous page flush to write out any dirty pages.
4594  * This will also associate a credential with the rnode which
4595  * can be used to write the pages.
4596  */
4597 /* ARGSUSED */
4598 static void
4599 nfs_delmap_callback(struct as *as, void *arg, uint_t event)
4600 {
4601 	int			error;
4602 	rnode_t			*rp;
4603 	mntinfo_t		*mi;
4604 	nfs_delmap_args_t	*dmapp = (nfs_delmap_args_t *)arg;
4605 
4606 	rp = VTOR(dmapp->vp);
4607 	mi = VTOMI(dmapp->vp);
4608 
4609 	atomic_add_long((ulong_t *)&rp->r_mapcnt, -btopr(dmapp->len));
4610 	ASSERT(rp->r_mapcnt >= 0);
4611 
4612 	/*
4613 	 * Initiate a page flush if there are pages, the file system
4614 	 * was not mounted readonly, the segment was mapped shared, and
4615 	 * the pages themselves were writeable.
4616 	 */
4617 	if (vn_has_cached_data(dmapp->vp) && !vn_is_readonly(dmapp->vp) &&
4618 	    dmapp->flags == MAP_SHARED && (dmapp->maxprot & PROT_WRITE)) {
4619 		mutex_enter(&rp->r_statelock);
4620 		rp->r_flags |= RDIRTY;
4621 		mutex_exit(&rp->r_statelock);
4622 		/*
4623 		 * If this is a cross-zone access a sync putpage won't work, so
4624 		 * the best we can do is try an async putpage.  That seems
4625 		 * better than something more draconian such as discarding the
4626 		 * dirty pages.
4627 		 */
4628 		if ((mi->mi_flags & MI_NOCTO) ||
4629 		    nfs_zone() != mi->mi_zone)
4630 			error = nfs_putpage(dmapp->vp, dmapp->off, dmapp->len,
4631 			    B_ASYNC, dmapp->cr);
4632 		else
4633 			error = nfs_putpage(dmapp->vp, dmapp->off, dmapp->len,
4634 			    0, dmapp->cr);
4635 		if (!error) {
4636 			mutex_enter(&rp->r_statelock);
4637 			error = rp->r_error;
4638 			rp->r_error = 0;
4639 			mutex_exit(&rp->r_statelock);
4640 		}
4641 	} else
4642 		error = 0;
4643 
4644 	if ((rp->r_flags & RDIRECTIO) || (mi->mi_flags & MI_DIRECTIO))
4645 		(void) nfs_putpage(dmapp->vp, dmapp->off, dmapp->len,
4646 		    B_INVAL, dmapp->cr);
4647 
4648 	dmapp->caller->error = error;
4649 	(void) as_delete_callback(as, arg);
4650 	kmem_free(dmapp, sizeof (nfs_delmap_args_t));
4651 }
4652 
4653 /* ARGSUSED */
4654 static int
4655 nfs_pathconf(vnode_t *vp, int cmd, ulong_t *valp, cred_t *cr)
4656 {
4657 	int error = 0;
4658 
4659 	if (nfs_zone() != VTOMI(vp)->mi_zone)
4660 		return (EIO);
4661 	/*
4662 	 * This looks a little weird because it's written in a general
4663 	 * manner but we make little use of cases.  If cntl() ever gets
4664 	 * widely used, the outer switch will make more sense.
4665 	 */
4666 
4667 	switch (cmd) {
4668 
4669 	/*
4670 	 * Large file spec - need to base answer new query with
4671 	 * hardcoded constant based on the protocol.
4672 	 */
4673 	case _PC_FILESIZEBITS:
4674 		*valp = 32;
4675 		return (0);
4676 
4677 	case _PC_LINK_MAX:
4678 	case _PC_NAME_MAX:
4679 	case _PC_PATH_MAX:
4680 	case _PC_SYMLINK_MAX:
4681 	case _PC_CHOWN_RESTRICTED:
4682 	case _PC_NO_TRUNC: {
4683 		mntinfo_t *mi;
4684 		struct pathcnf *pc;
4685 
4686 		if ((mi = VTOMI(vp)) == NULL || (pc = mi->mi_pathconf) == NULL)
4687 			return (EINVAL);
4688 		error = _PC_ISSET(cmd, pc->pc_mask);    /* error or bool */
4689 		switch (cmd) {
4690 		case _PC_LINK_MAX:
4691 			*valp = pc->pc_link_max;
4692 			break;
4693 		case _PC_NAME_MAX:
4694 			*valp = pc->pc_name_max;
4695 			break;
4696 		case _PC_PATH_MAX:
4697 		case _PC_SYMLINK_MAX:
4698 			*valp = pc->pc_path_max;
4699 			break;
4700 		case _PC_CHOWN_RESTRICTED:
4701 			/*
4702 			 * if we got here, error is really a boolean which
4703 			 * indicates whether cmd is set or not.
4704 			 */
4705 			*valp = error ? 1 : 0;	/* see above */
4706 			error = 0;
4707 			break;
4708 		case _PC_NO_TRUNC:
4709 			/*
4710 			 * if we got here, error is really a boolean which
4711 			 * indicates whether cmd is set or not.
4712 			 */
4713 			*valp = error ? 1 : 0;	/* see above */
4714 			error = 0;
4715 			break;
4716 		}
4717 		return (error ? EINVAL : 0);
4718 	    }
4719 
4720 	case _PC_XATTR_EXISTS:
4721 		*valp = 0;
4722 		if (vp->v_vfsp->vfs_flag & VFS_XATTR) {
4723 			vnode_t *avp;
4724 			rnode_t *rp;
4725 			mntinfo_t *mi = VTOMI(vp);
4726 
4727 			if (!(mi->mi_flags & MI_EXTATTR))
4728 				return (0);
4729 
4730 			rp = VTOR(vp);
4731 			if (nfs_rw_enter_sig(&rp->r_rwlock, RW_READER,
4732 			    INTR(vp)))
4733 				return (EINTR);
4734 
4735 			error = nfslookup_dnlc(vp, XATTR_DIR_NAME, &avp, cr);
4736 			if (error || avp == NULL)
4737 				error = acl_getxattrdir2(vp, &avp, 0, cr, 0);
4738 
4739 			nfs_rw_exit(&rp->r_rwlock);
4740 
4741 			if (error == 0 && avp != NULL) {
4742 				VN_RELE(avp);
4743 				*valp = 1;
4744 			}
4745 		}
4746 		return (error ? EINVAL : 0);
4747 
4748 	case _PC_ACL_ENABLED:
4749 		*valp = _ACL_ACLENT_ENABLED;
4750 		return (0);
4751 
4752 	default:
4753 		return (EINVAL);
4754 	}
4755 }
4756 
4757 /*
4758  * Called by async thread to do synchronous pageio. Do the i/o, wait
4759  * for it to complete, and cleanup the page list when done.
4760  */
4761 static int
4762 nfs_sync_pageio(vnode_t *vp, page_t *pp, u_offset_t io_off, size_t io_len,
4763 	int flags, cred_t *cr)
4764 {
4765 	int error;
4766 
4767 	ASSERT(nfs_zone() == VTOMI(vp)->mi_zone);
4768 	error = nfs_rdwrlbn(vp, pp, io_off, io_len, flags, cr);
4769 	if (flags & B_READ)
4770 		pvn_read_done(pp, (error ? B_ERROR : 0) | flags);
4771 	else
4772 		pvn_write_done(pp, (error ? B_ERROR : 0) | flags);
4773 	return (error);
4774 }
4775 
4776 static int
4777 nfs_pageio(vnode_t *vp, page_t *pp, u_offset_t io_off, size_t io_len,
4778 	int flags, cred_t *cr)
4779 {
4780 	int error;
4781 	rnode_t *rp;
4782 
4783 	if (pp == NULL)
4784 		return (EINVAL);
4785 
4786 	if (io_off > MAXOFF32_T)
4787 		return (EFBIG);
4788 	if (nfs_zone() != VTOMI(vp)->mi_zone)
4789 		return (EIO);
4790 	rp = VTOR(vp);
4791 	mutex_enter(&rp->r_statelock);
4792 	rp->r_count++;
4793 	mutex_exit(&rp->r_statelock);
4794 
4795 	if (flags & B_ASYNC) {
4796 		error = nfs_async_pageio(vp, pp, io_off, io_len, flags, cr,
4797 		    nfs_sync_pageio);
4798 	} else
4799 		error = nfs_rdwrlbn(vp, pp, io_off, io_len, flags, cr);
4800 	mutex_enter(&rp->r_statelock);
4801 	rp->r_count--;
4802 	cv_broadcast(&rp->r_cv);
4803 	mutex_exit(&rp->r_statelock);
4804 	return (error);
4805 }
4806 
4807 static int
4808 nfs_setsecattr(vnode_t *vp, vsecattr_t *vsecattr, int flag, cred_t *cr)
4809 {
4810 	int error;
4811 	mntinfo_t *mi;
4812 
4813 	mi = VTOMI(vp);
4814 
4815 	if (nfs_zone() != mi->mi_zone)
4816 		return (EIO);
4817 	if (mi->mi_flags & MI_ACL) {
4818 		error = acl_setacl2(vp, vsecattr, flag, cr);
4819 		if (mi->mi_flags & MI_ACL)
4820 			return (error);
4821 	}
4822 
4823 	return (ENOSYS);
4824 }
4825 
4826 static int
4827 nfs_getsecattr(vnode_t *vp, vsecattr_t *vsecattr, int flag, cred_t *cr)
4828 {
4829 	int error;
4830 	mntinfo_t *mi;
4831 
4832 	mi = VTOMI(vp);
4833 
4834 	if (nfs_zone() != mi->mi_zone)
4835 		return (EIO);
4836 	if (mi->mi_flags & MI_ACL) {
4837 		error = acl_getacl2(vp, vsecattr, flag, cr);
4838 		if (mi->mi_flags & MI_ACL)
4839 			return (error);
4840 	}
4841 
4842 	return (fs_fab_acl(vp, vsecattr, flag, cr));
4843 }
4844 
4845 static int
4846 nfs_shrlock(vnode_t *vp, int cmd, struct shrlock *shr, int flag, cred_t *cr)
4847 {
4848 	int error;
4849 	struct shrlock nshr;
4850 	struct nfs_owner nfs_owner;
4851 	netobj lm_fh;
4852 
4853 	if (nfs_zone() != VTOMI(vp)->mi_zone)
4854 		return (EIO);
4855 
4856 	/*
4857 	 * check for valid cmd parameter
4858 	 */
4859 	if (cmd != F_SHARE && cmd != F_UNSHARE && cmd != F_HASREMOTELOCKS)
4860 		return (EINVAL);
4861 
4862 	/*
4863 	 * Check access permissions
4864 	 */
4865 	if (cmd == F_SHARE &&
4866 	    (((shr->s_access & F_RDACC) && !(flag & FREAD)) ||
4867 	    ((shr->s_access & F_WRACC) && !(flag & FWRITE))))
4868 		return (EBADF);
4869 
4870 	/*
4871 	 * If the filesystem is mounted using local locking, pass the
4872 	 * request off to the local share code.
4873 	 */
4874 	if (VTOMI(vp)->mi_flags & MI_LLOCK)
4875 		return (fs_shrlock(vp, cmd, shr, flag, cr));
4876 
4877 	switch (cmd) {
4878 	case F_SHARE:
4879 	case F_UNSHARE:
4880 		lm_fh.n_len = sizeof (fhandle_t);
4881 		lm_fh.n_bytes = (char *)VTOFH(vp);
4882 
4883 		/*
4884 		 * If passed an owner that is too large to fit in an
4885 		 * nfs_owner it is likely a recursive call from the
4886 		 * lock manager client and pass it straight through.  If
4887 		 * it is not a nfs_owner then simply return an error.
4888 		 */
4889 		if (shr->s_own_len > sizeof (nfs_owner.lowner)) {
4890 			if (((struct nfs_owner *)shr->s_owner)->magic !=
4891 			    NFS_OWNER_MAGIC)
4892 				return (EINVAL);
4893 
4894 			if (error = lm_shrlock(vp, cmd, shr, flag, &lm_fh)) {
4895 				error = set_errno(error);
4896 			}
4897 			return (error);
4898 		}
4899 		/*
4900 		 * Remote share reservations owner is a combination of
4901 		 * a magic number, hostname, and the local owner
4902 		 */
4903 		bzero(&nfs_owner, sizeof (nfs_owner));
4904 		nfs_owner.magic = NFS_OWNER_MAGIC;
4905 		(void) strncpy(nfs_owner.hname, uts_nodename(),
4906 		    sizeof (nfs_owner.hname));
4907 		bcopy(shr->s_owner, nfs_owner.lowner, shr->s_own_len);
4908 		nshr.s_access = shr->s_access;
4909 		nshr.s_deny = shr->s_deny;
4910 		nshr.s_sysid = 0;
4911 		nshr.s_pid = ttoproc(curthread)->p_pid;
4912 		nshr.s_own_len = sizeof (nfs_owner);
4913 		nshr.s_owner = (caddr_t)&nfs_owner;
4914 
4915 		if (error = lm_shrlock(vp, cmd, &nshr, flag, &lm_fh)) {
4916 			error = set_errno(error);
4917 		}
4918 
4919 		break;
4920 
4921 	case F_HASREMOTELOCKS:
4922 		/*
4923 		 * NFS client can't store remote locks itself
4924 		 */
4925 		shr->s_access = 0;
4926 		error = 0;
4927 		break;
4928 
4929 	default:
4930 		error = EINVAL;
4931 		break;
4932 	}
4933 
4934 	return (error);
4935 }
4936