xref: /titanic_50/usr/src/uts/common/fs/nfs/nfs3_vnops.c (revision da2e3ebdc1edfbc5028edf1354e7dd2fa69a7968)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 /*
22  * Copyright 2007 Sun Microsystems, Inc.  All rights reserved.
23  * Use is subject to license terms.
24  */
25 
26 /*
27  *	Copyright (c) 1983,1984,1985,1986,1987,1988,1989 AT&T.
28  *	All rights reserved.
29  */
30 
31 #pragma ident	"%Z%%M%	%I%	%E% SMI"
32 
33 #include <sys/param.h>
34 #include <sys/types.h>
35 #include <sys/systm.h>
36 #include <sys/cred.h>
37 #include <sys/time.h>
38 #include <sys/vnode.h>
39 #include <sys/vfs.h>
40 #include <sys/vfs_opreg.h>
41 #include <sys/file.h>
42 #include <sys/filio.h>
43 #include <sys/uio.h>
44 #include <sys/buf.h>
45 #include <sys/mman.h>
46 #include <sys/pathname.h>
47 #include <sys/dirent.h>
48 #include <sys/debug.h>
49 #include <sys/vmsystm.h>
50 #include <sys/fcntl.h>
51 #include <sys/flock.h>
52 #include <sys/swap.h>
53 #include <sys/errno.h>
54 #include <sys/strsubr.h>
55 #include <sys/sysmacros.h>
56 #include <sys/kmem.h>
57 #include <sys/cmn_err.h>
58 #include <sys/pathconf.h>
59 #include <sys/utsname.h>
60 #include <sys/dnlc.h>
61 #include <sys/acl.h>
62 #include <sys/systeminfo.h>
63 #include <sys/atomic.h>
64 #include <sys/policy.h>
65 #include <sys/sdt.h>
66 
67 #include <rpc/types.h>
68 #include <rpc/auth.h>
69 #include <rpc/clnt.h>
70 
71 #include <nfs/nfs.h>
72 #include <nfs/nfs_clnt.h>
73 #include <nfs/rnode.h>
74 #include <nfs/nfs_acl.h>
75 #include <nfs/lm.h>
76 
77 #include <vm/hat.h>
78 #include <vm/as.h>
79 #include <vm/page.h>
80 #include <vm/pvn.h>
81 #include <vm/seg.h>
82 #include <vm/seg_map.h>
83 #include <vm/seg_kpm.h>
84 #include <vm/seg_vn.h>
85 
86 #include <fs/fs_subr.h>
87 
88 #include <sys/ddi.h>
89 
90 static int	nfs3_rdwrlbn(vnode_t *, page_t *, u_offset_t, size_t, int,
91 			cred_t *);
92 static int	nfs3write(vnode_t *, caddr_t, u_offset_t, int, cred_t *,
93 			stable_how *);
94 static int	nfs3read(vnode_t *, caddr_t, offset_t, int, size_t *, cred_t *);
95 static int	nfs3setattr(vnode_t *, struct vattr *, int, cred_t *);
96 static int	nfs3_accessx(void *, int, cred_t *);
97 static int	nfs3lookup_dnlc(vnode_t *, char *, vnode_t **, cred_t *);
98 static int	nfs3lookup_otw(vnode_t *, char *, vnode_t **, cred_t *, int);
99 static int	nfs3create(vnode_t *, char *, struct vattr *, enum vcexcl,
100 			int, vnode_t **, cred_t *, int);
101 static int	nfs3excl_create_settimes(vnode_t *, struct vattr *, cred_t *);
102 static int	nfs3mknod(vnode_t *, char *, struct vattr *, enum vcexcl,
103 			int, vnode_t **, cred_t *);
104 static int	nfs3rename(vnode_t *, char *, vnode_t *, char *, cred_t *);
105 static int	do_nfs3readdir(vnode_t *, rddir_cache *, cred_t *);
106 static void	nfs3readdir(vnode_t *, rddir_cache *, cred_t *);
107 static void	nfs3readdirplus(vnode_t *, rddir_cache *, cred_t *);
108 static int	nfs3_bio(struct buf *, stable_how *, cred_t *);
109 static int	nfs3_getapage(vnode_t *, u_offset_t, size_t, uint_t *,
110 			page_t *[], size_t, struct seg *, caddr_t,
111 			enum seg_rw, cred_t *);
112 static void	nfs3_readahead(vnode_t *, u_offset_t, caddr_t, struct seg *,
113 			cred_t *);
114 static int	nfs3_sync_putapage(vnode_t *, page_t *, u_offset_t, size_t,
115 			int, cred_t *);
116 static int	nfs3_sync_pageio(vnode_t *, page_t *, u_offset_t, size_t,
117 			int, cred_t *);
118 static int	nfs3_commit(vnode_t *, offset3, count3, cred_t *);
119 static void	nfs3_set_mod(vnode_t *);
120 static void	nfs3_get_commit(vnode_t *);
121 static void	nfs3_get_commit_range(vnode_t *, u_offset_t, size_t);
122 #if 0 /* unused */
123 #ifdef DEBUG
124 static int	nfs3_no_uncommitted_pages(vnode_t *);
125 #endif
126 #endif /* unused */
127 static int	nfs3_putpage_commit(vnode_t *, offset_t, size_t, cred_t *);
128 static int	nfs3_commit_vp(vnode_t *, u_offset_t, size_t,  cred_t *);
129 static int	nfs3_sync_commit(vnode_t *, page_t *, offset3, count3,
130 			cred_t *);
131 static void	nfs3_async_commit(vnode_t *, page_t *, offset3, count3,
132 			cred_t *);
133 static void	nfs3_delmap_callback(struct as *, void *, uint_t);
134 
135 /*
136  * Error flags used to pass information about certain special errors
137  * which need to be handled specially.
138  */
139 #define	NFS_EOF			-98
140 #define	NFS_VERF_MISMATCH	-97
141 
142 /* ALIGN64 aligns the given buffer and adjust buffer size to 64 bit */
143 #define	ALIGN64(x, ptr, sz)						\
144 	x = ((uintptr_t)(ptr)) & (sizeof (uint64_t) - 1);		\
145 	if (x) {							\
146 		x = sizeof (uint64_t) - (x);				\
147 		sz -= (x);						\
148 		ptr += (x);						\
149 	}
150 
151 /*
152  * These are the vnode ops routines which implement the vnode interface to
153  * the networked file system.  These routines just take their parameters,
154  * make them look networkish by putting the right info into interface structs,
155  * and then calling the appropriate remote routine(s) to do the work.
156  *
157  * Note on directory name lookup cacheing:  If we detect a stale fhandle,
158  * we purge the directory cache relative to that vnode.  This way, the
159  * user won't get burned by the cache repeatedly.  See <nfs/rnode.h> for
160  * more details on rnode locking.
161  */
162 
163 static int	nfs3_open(vnode_t **, int, cred_t *);
164 static int	nfs3_close(vnode_t *, int, int, offset_t, cred_t *);
165 static int	nfs3_read(vnode_t *, struct uio *, int, cred_t *,
166 			caller_context_t *);
167 static int	nfs3_write(vnode_t *, struct uio *, int, cred_t *,
168 			caller_context_t *);
169 static int	nfs3_ioctl(vnode_t *, int, intptr_t, int, cred_t *, int *);
170 static int	nfs3_getattr(vnode_t *, struct vattr *, int, cred_t *);
171 static int	nfs3_setattr(vnode_t *, struct vattr *, int, cred_t *,
172 			caller_context_t *);
173 static int	nfs3_access(vnode_t *, int, int, cred_t *);
174 static int	nfs3_readlink(vnode_t *, struct uio *, cred_t *);
175 static int	nfs3_fsync(vnode_t *, int, cred_t *);
176 static void	nfs3_inactive(vnode_t *, cred_t *);
177 static int	nfs3_lookup(vnode_t *, char *, vnode_t **,
178 			struct pathname *, int, vnode_t *, cred_t *);
179 static int	nfs3_create(vnode_t *, char *, struct vattr *, enum vcexcl,
180 			int, vnode_t **, cred_t *, int);
181 static int	nfs3_remove(vnode_t *, char *, cred_t *);
182 static int	nfs3_link(vnode_t *, vnode_t *, char *, cred_t *);
183 static int	nfs3_rename(vnode_t *, char *, vnode_t *, char *, cred_t *);
184 static int	nfs3_mkdir(vnode_t *, char *, struct vattr *,
185 			vnode_t **, cred_t *);
186 static int	nfs3_rmdir(vnode_t *, char *, vnode_t *, cred_t *);
187 static int	nfs3_symlink(vnode_t *, char *, struct vattr *, char *,
188 			cred_t *);
189 static int	nfs3_readdir(vnode_t *, struct uio *, cred_t *, int *);
190 static int	nfs3_fid(vnode_t *, fid_t *);
191 static int	nfs3_rwlock(vnode_t *, int, caller_context_t *);
192 static void	nfs3_rwunlock(vnode_t *, int, caller_context_t *);
193 static int	nfs3_seek(vnode_t *, offset_t, offset_t *);
194 static int	nfs3_getpage(vnode_t *, offset_t, size_t, uint_t *,
195 			page_t *[], size_t, struct seg *, caddr_t,
196 			enum seg_rw, cred_t *);
197 static int	nfs3_putpage(vnode_t *, offset_t, size_t, int, cred_t *);
198 static int	nfs3_map(vnode_t *, offset_t, struct as *, caddr_t *,
199 			size_t, uchar_t, uchar_t, uint_t, cred_t *);
200 static int	nfs3_addmap(vnode_t *, offset_t, struct as *, caddr_t,
201 			size_t, uchar_t, uchar_t, uint_t, cred_t *);
202 static int	nfs3_frlock(vnode_t *, int, struct flock64 *, int, offset_t,
203 			struct flk_callback *, cred_t *);
204 static int	nfs3_space(vnode_t *, int, struct flock64 *, int, offset_t,
205 			cred_t *, caller_context_t *);
206 static int	nfs3_realvp(vnode_t *, vnode_t **);
207 static int	nfs3_delmap(vnode_t *, offset_t, struct as *, caddr_t,
208 			size_t, uint_t, uint_t, uint_t, cred_t *);
209 static int	nfs3_pathconf(vnode_t *, int, ulong_t *, cred_t *);
210 static int	nfs3_pageio(vnode_t *, page_t *, u_offset_t, size_t, int,
211 			cred_t *);
212 static void	nfs3_dispose(vnode_t *, page_t *, int, int, cred_t *);
213 static int	nfs3_setsecattr(vnode_t *, vsecattr_t *, int, cred_t *);
214 static int	nfs3_getsecattr(vnode_t *, vsecattr_t *, int, cred_t *);
215 static int	nfs3_shrlock(vnode_t *, int, struct shrlock *, int, cred_t *);
216 
217 struct vnodeops *nfs3_vnodeops;
218 
219 const fs_operation_def_t nfs3_vnodeops_template[] = {
220 	VOPNAME_OPEN,		{ .vop_open = nfs3_open },
221 	VOPNAME_CLOSE,		{ .vop_close = nfs3_close },
222 	VOPNAME_READ,		{ .vop_read = nfs3_read },
223 	VOPNAME_WRITE,		{ .vop_write = nfs3_write },
224 	VOPNAME_IOCTL,		{ .vop_ioctl = nfs3_ioctl },
225 	VOPNAME_GETATTR,	{ .vop_getattr = nfs3_getattr },
226 	VOPNAME_SETATTR,	{ .vop_setattr = nfs3_setattr },
227 	VOPNAME_ACCESS,		{ .vop_access = nfs3_access },
228 	VOPNAME_LOOKUP,		{ .vop_lookup = nfs3_lookup },
229 	VOPNAME_CREATE,		{ .vop_create = nfs3_create },
230 	VOPNAME_REMOVE,		{ .vop_remove = nfs3_remove },
231 	VOPNAME_LINK,		{ .vop_link = nfs3_link },
232 	VOPNAME_RENAME,		{ .vop_rename = nfs3_rename },
233 	VOPNAME_MKDIR,		{ .vop_mkdir = nfs3_mkdir },
234 	VOPNAME_RMDIR,		{ .vop_rmdir = nfs3_rmdir },
235 	VOPNAME_READDIR,	{ .vop_readdir = nfs3_readdir },
236 	VOPNAME_SYMLINK,	{ .vop_symlink = nfs3_symlink },
237 	VOPNAME_READLINK,	{ .vop_readlink = nfs3_readlink },
238 	VOPNAME_FSYNC,		{ .vop_fsync = nfs3_fsync },
239 	VOPNAME_INACTIVE,	{ .vop_inactive = nfs3_inactive },
240 	VOPNAME_FID,		{ .vop_fid = nfs3_fid },
241 	VOPNAME_RWLOCK,		{ .vop_rwlock = nfs3_rwlock },
242 	VOPNAME_RWUNLOCK,	{ .vop_rwunlock = nfs3_rwunlock },
243 	VOPNAME_SEEK,		{ .vop_seek = nfs3_seek },
244 	VOPNAME_FRLOCK,		{ .vop_frlock = nfs3_frlock },
245 	VOPNAME_SPACE,		{ .vop_space = nfs3_space },
246 	VOPNAME_REALVP,		{ .vop_realvp = nfs3_realvp },
247 	VOPNAME_GETPAGE,	{ .vop_getpage = nfs3_getpage },
248 	VOPNAME_PUTPAGE,	{ .vop_putpage = nfs3_putpage },
249 	VOPNAME_MAP,		{ .vop_map = nfs3_map },
250 	VOPNAME_ADDMAP,		{ .vop_addmap = nfs3_addmap },
251 	VOPNAME_DELMAP,		{ .vop_delmap = nfs3_delmap },
252 	/* no separate nfs3_dump */
253 	VOPNAME_DUMP,		{ .vop_dump = nfs_dump },
254 	VOPNAME_PATHCONF,	{ .vop_pathconf = nfs3_pathconf },
255 	VOPNAME_PAGEIO,		{ .vop_pageio = nfs3_pageio },
256 	VOPNAME_DISPOSE,	{ .vop_dispose = nfs3_dispose },
257 	VOPNAME_SETSECATTR,	{ .vop_setsecattr = nfs3_setsecattr },
258 	VOPNAME_GETSECATTR,	{ .vop_getsecattr = nfs3_getsecattr },
259 	VOPNAME_SHRLOCK,	{ .vop_shrlock = nfs3_shrlock },
260 	VOPNAME_VNEVENT, 	{ .vop_vnevent = fs_vnevent_support },
261 	NULL,			NULL
262 };
263 
264 /*
265  * XXX:  This is referenced in modstubs.s
266  */
267 struct vnodeops *
268 nfs3_getvnodeops(void)
269 {
270 	return (nfs3_vnodeops);
271 }
272 
273 /* ARGSUSED */
274 static int
275 nfs3_open(vnode_t **vpp, int flag, cred_t *cr)
276 {
277 	int error;
278 	struct vattr va;
279 	rnode_t *rp;
280 	vnode_t *vp;
281 
282 	vp = *vpp;
283 	if (nfs_zone() != VTOMI(vp)->mi_zone)
284 		return (EIO);
285 	rp = VTOR(vp);
286 	mutex_enter(&rp->r_statelock);
287 	if (rp->r_cred == NULL) {
288 		crhold(cr);
289 		rp->r_cred = cr;
290 	}
291 	mutex_exit(&rp->r_statelock);
292 
293 	/*
294 	 * If there is no cached data or if close-to-open
295 	 * consistency checking is turned off, we can avoid
296 	 * the over the wire getattr.  Otherwise, if the
297 	 * file system is mounted readonly, then just verify
298 	 * the caches are up to date using the normal mechanism.
299 	 * Else, if the file is not mmap'd, then just mark
300 	 * the attributes as timed out.  They will be refreshed
301 	 * and the caches validated prior to being used.
302 	 * Else, the file system is mounted writeable so
303 	 * force an over the wire GETATTR in order to ensure
304 	 * that all cached data is valid.
305 	 */
306 	if (vp->v_count > 1 ||
307 	    ((vn_has_cached_data(vp) || HAVE_RDDIR_CACHE(rp)) &&
308 	    !(VTOMI(vp)->mi_flags & MI_NOCTO))) {
309 		if (vn_is_readonly(vp))
310 			error = nfs3_validate_caches(vp, cr);
311 		else if (rp->r_mapcnt == 0 && vp->v_count == 1) {
312 			PURGE_ATTRCACHE(vp);
313 			error = 0;
314 		} else {
315 			va.va_mask = AT_ALL;
316 			error = nfs3_getattr_otw(vp, &va, cr);
317 		}
318 	} else
319 		error = 0;
320 
321 	return (error);
322 }
323 
324 static int
325 nfs3_close(vnode_t *vp, int flag, int count, offset_t offset, cred_t *cr)
326 {
327 	rnode_t *rp;
328 	int error;
329 	struct vattr va;
330 
331 	/*
332 	 * zone_enter(2) prevents processes from changing zones with NFS files
333 	 * open; if we happen to get here from the wrong zone we can't do
334 	 * anything over the wire.
335 	 */
336 	if (VTOMI(vp)->mi_zone != nfs_zone()) {
337 		/*
338 		 * We could attempt to clean up locks, except we're sure
339 		 * that the current process didn't acquire any locks on
340 		 * the file: any attempt to lock a file belong to another zone
341 		 * will fail, and one can't lock an NFS file and then change
342 		 * zones, as that fails too.
343 		 *
344 		 * Returning an error here is the sane thing to do.  A
345 		 * subsequent call to VN_RELE() which translates to a
346 		 * nfs3_inactive() will clean up state: if the zone of the
347 		 * vnode's origin is still alive and kicking, an async worker
348 		 * thread will handle the request (from the correct zone), and
349 		 * everything (minus the commit and final nfs3_getattr_otw()
350 		 * call) should be OK. If the zone is going away
351 		 * nfs_async_inactive() will throw away cached pages inline.
352 		 */
353 		return (EIO);
354 	}
355 
356 	/*
357 	 * If we are using local locking for this filesystem, then
358 	 * release all of the SYSV style record locks.  Otherwise,
359 	 * we are doing network locking and we need to release all
360 	 * of the network locks.  All of the locks held by this
361 	 * process on this file are released no matter what the
362 	 * incoming reference count is.
363 	 */
364 	if (VTOMI(vp)->mi_flags & MI_LLOCK) {
365 		cleanlocks(vp, ttoproc(curthread)->p_pid, 0);
366 		cleanshares(vp, ttoproc(curthread)->p_pid);
367 	} else
368 		nfs_lockrelease(vp, flag, offset, cr);
369 
370 	if (count > 1)
371 		return (0);
372 
373 	/*
374 	 * If the file has been `unlinked', then purge the
375 	 * DNLC so that this vnode will get reycled quicker
376 	 * and the .nfs* file on the server will get removed.
377 	 */
378 	rp = VTOR(vp);
379 	if (rp->r_unldvp != NULL)
380 		dnlc_purge_vp(vp);
381 
382 	/*
383 	 * If the file was open for write and there are pages,
384 	 * then if the file system was mounted using the "no-close-
385 	 *	to-open" semantics, then start an asynchronous flush
386 	 *	of the all of the pages in the file.
387 	 * else the file system was not mounted using the "no-close-
388 	 *	to-open" semantics, then do a synchronous flush and
389 	 *	commit of all of the dirty and uncommitted pages.
390 	 *
391 	 * The asynchronous flush of the pages in the "nocto" path
392 	 * mostly just associates a cred pointer with the rnode so
393 	 * writes which happen later will have a better chance of
394 	 * working.  It also starts the data being written to the
395 	 * server, but without unnecessarily delaying the application.
396 	 */
397 	if ((flag & FWRITE) && vn_has_cached_data(vp)) {
398 		if (VTOMI(vp)->mi_flags & MI_NOCTO) {
399 			error = nfs3_putpage(vp, (offset_t)0, 0, B_ASYNC, cr);
400 			if (error == EAGAIN)
401 				error = 0;
402 		} else
403 			error = nfs3_putpage_commit(vp, (offset_t)0, 0, cr);
404 		if (!error) {
405 			mutex_enter(&rp->r_statelock);
406 			error = rp->r_error;
407 			rp->r_error = 0;
408 			mutex_exit(&rp->r_statelock);
409 		}
410 	} else {
411 		mutex_enter(&rp->r_statelock);
412 		error = rp->r_error;
413 		rp->r_error = 0;
414 		mutex_exit(&rp->r_statelock);
415 	}
416 
417 	/*
418 	 * If RWRITEATTR is set, then issue an over the wire GETATTR to
419 	 * refresh the attribute cache with a set of attributes which
420 	 * weren't returned from a WRITE.  This will enable the close-
421 	 * to-open processing to work.
422 	 */
423 	if (rp->r_flags & RWRITEATTR)
424 		(void) nfs3_getattr_otw(vp, &va, cr);
425 
426 	return (error);
427 }
428 
429 /* ARGSUSED */
430 static int
431 nfs3_directio_read(vnode_t *vp, struct uio *uiop, cred_t *cr)
432 {
433 	mntinfo_t *mi;
434 	READ3args args;
435 	READ3uiores res;
436 	int tsize;
437 	offset_t offset;
438 	ssize_t count;
439 	int error;
440 	int douprintf;
441 	failinfo_t fi;
442 	char *sv_hostname;
443 
444 	mi = VTOMI(vp);
445 	ASSERT(nfs_zone() == VTOMI(vp)->mi_zone);
446 	sv_hostname = VTOR(vp)->r_server->sv_hostname;
447 
448 	douprintf = 1;
449 	args.file = *VTOFH3(vp);
450 	fi.vp = vp;
451 	fi.fhp = (caddr_t)&args.file;
452 	fi.copyproc = nfs3copyfh;
453 	fi.lookupproc = nfs3lookup;
454 	fi.xattrdirproc = acl_getxattrdir3;
455 
456 	res.uiop = uiop;
457 
458 	offset = uiop->uio_loffset;
459 	count = uiop->uio_resid;
460 
461 	do {
462 		if (mi->mi_io_kstats) {
463 			mutex_enter(&mi->mi_lock);
464 			kstat_runq_enter(KSTAT_IO_PTR(mi->mi_io_kstats));
465 			mutex_exit(&mi->mi_lock);
466 		}
467 
468 		do {
469 			tsize = MIN(mi->mi_tsize, count);
470 			args.offset = (offset3)offset;
471 			args.count = (count3)tsize;
472 			res.size = (uint_t)tsize;
473 			error = rfs3call(mi, NFSPROC3_READ,
474 				    xdr_READ3args, (caddr_t)&args,
475 				    xdr_READ3uiores, (caddr_t)&res, cr,
476 				    &douprintf, &res.status, 0, &fi);
477 		} while (error == ENFS_TRYAGAIN);
478 
479 		if (mi->mi_io_kstats) {
480 			mutex_enter(&mi->mi_lock);
481 			kstat_runq_exit(KSTAT_IO_PTR(mi->mi_io_kstats));
482 			mutex_exit(&mi->mi_lock);
483 		}
484 
485 		if (error)
486 			return (error);
487 
488 		error = geterrno3(res.status);
489 		if (error)
490 			return (error);
491 
492 		if (res.count != res.size) {
493 			zcmn_err(getzoneid(), CE_WARN,
494 "nfs3_directio_read: server %s returned incorrect amount",
495 					sv_hostname);
496 			return (EIO);
497 		}
498 		count -= res.count;
499 		offset += res.count;
500 		if (mi->mi_io_kstats) {
501 			mutex_enter(&mi->mi_lock);
502 			KSTAT_IO_PTR(mi->mi_io_kstats)->reads++;
503 			KSTAT_IO_PTR(mi->mi_io_kstats)->nread += res.count;
504 			mutex_exit(&mi->mi_lock);
505 		}
506 		lwp_stat_update(LWP_STAT_INBLK, 1);
507 	} while (count && !res.eof);
508 
509 	return (0);
510 }
511 
512 /* ARGSUSED */
513 static int
514 nfs3_read(vnode_t *vp, struct uio *uiop, int ioflag, cred_t *cr,
515 	caller_context_t *ct)
516 {
517 	rnode_t *rp;
518 	u_offset_t off;
519 	offset_t diff;
520 	int on;
521 	size_t n;
522 	caddr_t base;
523 	uint_t flags;
524 	int error = 0;
525 	mntinfo_t *mi;
526 
527 	rp = VTOR(vp);
528 	mi = VTOMI(vp);
529 
530 	ASSERT(nfs_rw_lock_held(&rp->r_rwlock, RW_READER));
531 
532 	if (nfs_zone() != mi->mi_zone)
533 		return (EIO);
534 
535 	if (vp->v_type != VREG)
536 		return (EISDIR);
537 
538 	if (uiop->uio_resid == 0)
539 		return (0);
540 
541 	if (uiop->uio_loffset < 0 || uiop->uio_loffset + uiop->uio_resid < 0)
542 		return (EINVAL);
543 
544 	/*
545 	 * Bypass VM if caching has been disabled (e.g., locking) or if
546 	 * using client-side direct I/O and the file is not mmap'd and
547 	 * there are no cached pages.
548 	 */
549 	if ((vp->v_flag & VNOCACHE) ||
550 	    (((rp->r_flags & RDIRECTIO) || (mi->mi_flags & MI_DIRECTIO)) &&
551 	    rp->r_mapcnt == 0 && !vn_has_cached_data(vp))) {
552 		return (nfs3_directio_read(vp, uiop, cr));
553 	}
554 
555 	do {
556 		off = uiop->uio_loffset & MAXBMASK; /* mapping offset */
557 		on = uiop->uio_loffset & MAXBOFFSET; /* Relative offset */
558 		n = MIN(MAXBSIZE - on, uiop->uio_resid);
559 
560 		error = nfs3_validate_caches(vp, cr);
561 		if (error)
562 			break;
563 
564 		mutex_enter(&rp->r_statelock);
565 		diff = rp->r_size - uiop->uio_loffset;
566 		mutex_exit(&rp->r_statelock);
567 		if (diff <= 0)
568 			break;
569 		if (diff < n)
570 			n = (size_t)diff;
571 
572 		if (vpm_enable) {
573 			/*
574 			 * Copy data.
575 			 */
576 			error = vpm_data_copy(vp, off + on, n, uiop,
577 						1, NULL, 0, S_READ);
578 		} else {
579 			base = segmap_getmapflt(segkmap, vp, off + on, n, 1,
580 							S_READ);
581 
582 			error = uiomove(base + on, n, UIO_READ, uiop);
583 		}
584 
585 		if (!error) {
586 			/*
587 			 * If read a whole block or read to eof,
588 			 * won't need this buffer again soon.
589 			 */
590 			mutex_enter(&rp->r_statelock);
591 			if (n + on == MAXBSIZE ||
592 			    uiop->uio_loffset == rp->r_size)
593 				flags = SM_DONTNEED;
594 			else
595 				flags = 0;
596 			mutex_exit(&rp->r_statelock);
597 			if (vpm_enable) {
598 				error = vpm_sync_pages(vp, off, n, flags);
599 			} else {
600 				error = segmap_release(segkmap, base, flags);
601 			}
602 		} else {
603 			if (vpm_enable) {
604 				(void) vpm_sync_pages(vp, off, n, 0);
605 			} else {
606 				(void) segmap_release(segkmap, base, 0);
607 			}
608 		}
609 	} while (!error && uiop->uio_resid > 0);
610 
611 	return (error);
612 }
613 
614 /* ARGSUSED */
615 static int
616 nfs3_write(vnode_t *vp, struct uio *uiop, int ioflag, cred_t *cr,
617 	caller_context_t *ct)
618 {
619 	rlim64_t limit = uiop->uio_llimit;
620 	rnode_t *rp;
621 	u_offset_t off;
622 	caddr_t base;
623 	uint_t flags;
624 	int remainder;
625 	size_t n;
626 	int on;
627 	int error;
628 	int resid;
629 	offset_t offset;
630 	mntinfo_t *mi;
631 	uint_t bsize;
632 
633 	rp = VTOR(vp);
634 
635 	if (vp->v_type != VREG)
636 		return (EISDIR);
637 
638 	mi = VTOMI(vp);
639 	if (nfs_zone() != mi->mi_zone)
640 		return (EIO);
641 	if (uiop->uio_resid == 0)
642 		return (0);
643 
644 	if (ioflag & FAPPEND) {
645 		struct vattr va;
646 
647 		/*
648 		 * Must serialize if appending.
649 		 */
650 		if (nfs_rw_lock_held(&rp->r_rwlock, RW_READER)) {
651 			nfs_rw_exit(&rp->r_rwlock);
652 			if (nfs_rw_enter_sig(&rp->r_rwlock, RW_WRITER,
653 			    INTR(vp)))
654 				return (EINTR);
655 		}
656 
657 		va.va_mask = AT_SIZE;
658 		error = nfs3getattr(vp, &va, cr);
659 		if (error)
660 			return (error);
661 		uiop->uio_loffset = va.va_size;
662 	}
663 
664 	offset = uiop->uio_loffset + uiop->uio_resid;
665 
666 	if (uiop->uio_loffset < 0 || offset < 0)
667 		return (EINVAL);
668 
669 	if (limit == RLIM64_INFINITY || limit > MAXOFFSET_T)
670 		limit = MAXOFFSET_T;
671 
672 	/*
673 	 * Check to make sure that the process will not exceed
674 	 * its limit on file size.  It is okay to write up to
675 	 * the limit, but not beyond.  Thus, the write which
676 	 * reaches the limit will be short and the next write
677 	 * will return an error.
678 	 */
679 	remainder = 0;
680 	if (offset > limit) {
681 		remainder = offset - limit;
682 		uiop->uio_resid = limit - uiop->uio_loffset;
683 		if (uiop->uio_resid <= 0) {
684 			proc_t *p = ttoproc(curthread);
685 
686 			uiop->uio_resid += remainder;
687 			mutex_enter(&p->p_lock);
688 			(void) rctl_action(rctlproc_legacy[RLIMIT_FSIZE],
689 			    p->p_rctls, p, RCA_UNSAFE_SIGINFO);
690 			mutex_exit(&p->p_lock);
691 			return (EFBIG);
692 		}
693 	}
694 
695 	if (nfs_rw_enter_sig(&rp->r_lkserlock, RW_READER, INTR(vp)))
696 		return (EINTR);
697 
698 	/*
699 	 * Bypass VM if caching has been disabled (e.g., locking) or if
700 	 * using client-side direct I/O and the file is not mmap'd and
701 	 * there are no cached pages.
702 	 */
703 	if ((vp->v_flag & VNOCACHE) ||
704 	    (((rp->r_flags & RDIRECTIO) || (mi->mi_flags & MI_DIRECTIO)) &&
705 	    rp->r_mapcnt == 0 && !vn_has_cached_data(vp))) {
706 		size_t bufsize;
707 		int count;
708 		u_offset_t org_offset;
709 		stable_how stab_comm;
710 
711 nfs3_fwrite:
712 		if (rp->r_flags & RSTALE) {
713 			resid = uiop->uio_resid;
714 			offset = uiop->uio_loffset;
715 			error = rp->r_error;
716 			goto bottom;
717 		}
718 		bufsize = MIN(uiop->uio_resid, mi->mi_stsize);
719 		base = kmem_alloc(bufsize, KM_SLEEP);
720 		do {
721 			if (ioflag & FDSYNC)
722 				stab_comm = DATA_SYNC;
723 			else
724 				stab_comm = FILE_SYNC;
725 			resid = uiop->uio_resid;
726 			offset = uiop->uio_loffset;
727 			count = MIN(uiop->uio_resid, bufsize);
728 			org_offset = uiop->uio_loffset;
729 			error = uiomove(base, count, UIO_WRITE, uiop);
730 			if (!error) {
731 				error = nfs3write(vp, base, org_offset,
732 				    count, cr, &stab_comm);
733 			}
734 		} while (!error && uiop->uio_resid > 0);
735 		kmem_free(base, bufsize);
736 		goto bottom;
737 	}
738 
739 
740 	bsize = vp->v_vfsp->vfs_bsize;
741 
742 	do {
743 		off = uiop->uio_loffset & MAXBMASK; /* mapping offset */
744 		on = uiop->uio_loffset & MAXBOFFSET; /* Relative offset */
745 		n = MIN(MAXBSIZE - on, uiop->uio_resid);
746 
747 		resid = uiop->uio_resid;
748 		offset = uiop->uio_loffset;
749 
750 		if (rp->r_flags & RSTALE) {
751 			error = rp->r_error;
752 			break;
753 		}
754 
755 		/*
756 		 * Don't create dirty pages faster than they
757 		 * can be cleaned so that the system doesn't
758 		 * get imbalanced.  If the async queue is
759 		 * maxed out, then wait for it to drain before
760 		 * creating more dirty pages.  Also, wait for
761 		 * any threads doing pagewalks in the vop_getattr
762 		 * entry points so that they don't block for
763 		 * long periods.
764 		 */
765 		mutex_enter(&rp->r_statelock);
766 		while ((mi->mi_max_threads != 0 &&
767 		    rp->r_awcount > 2 * mi->mi_max_threads) ||
768 		    rp->r_gcount > 0)
769 			cv_wait(&rp->r_cv, &rp->r_statelock);
770 		mutex_exit(&rp->r_statelock);
771 
772 		if (vpm_enable) {
773 			/*
774 			 * It will use kpm mappings, so no need to
775 			 * pass an address.
776 			 */
777 			error = writerp(rp, NULL, n, uiop, 0);
778 		} else  {
779 			if (segmap_kpm) {
780 				int pon = uiop->uio_loffset & PAGEOFFSET;
781 				size_t pn = MIN(PAGESIZE - pon,
782 							uiop->uio_resid);
783 				int pagecreate;
784 
785 				mutex_enter(&rp->r_statelock);
786 				pagecreate = (pon == 0) && (pn == PAGESIZE ||
787 					uiop->uio_loffset + pn >= rp->r_size);
788 				mutex_exit(&rp->r_statelock);
789 
790 				base = segmap_getmapflt(segkmap, vp, off + on,
791 						pn, !pagecreate, S_WRITE);
792 
793 				error = writerp(rp, base + pon, n, uiop,
794 								pagecreate);
795 
796 			} else {
797 				base = segmap_getmapflt(segkmap, vp, off + on,
798 							n, 0, S_READ);
799 				error = writerp(rp, base + on, n, uiop, 0);
800 			}
801 		}
802 
803 		if (!error) {
804 			if (mi->mi_flags & MI_NOAC)
805 				flags = SM_WRITE;
806 			else if ((uiop->uio_loffset % bsize) == 0 ||
807 			    IS_SWAPVP(vp)) {
808 				/*
809 				 * Have written a whole block.
810 				 * Start an asynchronous write
811 				 * and mark the buffer to
812 				 * indicate that it won't be
813 				 * needed again soon.
814 				 */
815 				flags = SM_WRITE | SM_ASYNC | SM_DONTNEED;
816 			} else
817 				flags = 0;
818 			if ((ioflag & (FSYNC|FDSYNC)) ||
819 			    (rp->r_flags & ROUTOFSPACE)) {
820 				flags &= ~SM_ASYNC;
821 				flags |= SM_WRITE;
822 			}
823 			if (vpm_enable) {
824 				error = vpm_sync_pages(vp, off, n, flags);
825 			} else {
826 				error = segmap_release(segkmap, base, flags);
827 			}
828 		} else {
829 			if (vpm_enable) {
830 				(void) vpm_sync_pages(vp, off, n, 0);
831 			} else {
832 				(void) segmap_release(segkmap, base, 0);
833 			}
834 			/*
835 			 * In the event that we got an access error while
836 			 * faulting in a page for a write-only file just
837 			 * force a write.
838 			 */
839 			if (error == EACCES)
840 				goto nfs3_fwrite;
841 		}
842 	} while (!error && uiop->uio_resid > 0);
843 
844 bottom:
845 	if (error) {
846 		uiop->uio_resid = resid + remainder;
847 		uiop->uio_loffset = offset;
848 	} else
849 		uiop->uio_resid += remainder;
850 
851 	nfs_rw_exit(&rp->r_lkserlock);
852 
853 	return (error);
854 }
855 
856 /*
857  * Flags are composed of {B_ASYNC, B_INVAL, B_FREE, B_DONTNEED}
858  */
859 static int
860 nfs3_rdwrlbn(vnode_t *vp, page_t *pp, u_offset_t off, size_t len,
861 	int flags, cred_t *cr)
862 {
863 	struct buf *bp;
864 	int error;
865 	page_t *savepp;
866 	uchar_t fsdata;
867 	stable_how stab_comm;
868 
869 	ASSERT(nfs_zone() == VTOMI(vp)->mi_zone);
870 	bp = pageio_setup(pp, len, vp, flags);
871 	ASSERT(bp != NULL);
872 
873 	/*
874 	 * pageio_setup should have set b_addr to 0.  This
875 	 * is correct since we want to do I/O on a page
876 	 * boundary.  bp_mapin will use this addr to calculate
877 	 * an offset, and then set b_addr to the kernel virtual
878 	 * address it allocated for us.
879 	 */
880 	ASSERT(bp->b_un.b_addr == 0);
881 
882 	bp->b_edev = 0;
883 	bp->b_dev = 0;
884 	bp->b_lblkno = lbtodb(off);
885 	bp->b_file = vp;
886 	bp->b_offset = (offset_t)off;
887 	bp_mapin(bp);
888 
889 	/*
890 	 * Calculate the desired level of stability to write data
891 	 * on the server and then mark all of the pages to reflect
892 	 * this.
893 	 */
894 	if ((flags & (B_WRITE|B_ASYNC)) == (B_WRITE|B_ASYNC) &&
895 	    freemem > desfree) {
896 		stab_comm = UNSTABLE;
897 		fsdata = C_DELAYCOMMIT;
898 	} else {
899 		stab_comm = FILE_SYNC;
900 		fsdata = C_NOCOMMIT;
901 	}
902 
903 	savepp = pp;
904 	do {
905 		pp->p_fsdata = fsdata;
906 	} while ((pp = pp->p_next) != savepp);
907 
908 	error = nfs3_bio(bp, &stab_comm, cr);
909 
910 	bp_mapout(bp);
911 	pageio_done(bp);
912 
913 	/*
914 	 * If the server wrote pages in a more stable fashion than
915 	 * was requested, then clear all of the marks in the pages
916 	 * indicating that COMMIT operations were required.
917 	 */
918 	if (stab_comm != UNSTABLE && fsdata == C_DELAYCOMMIT) {
919 		do {
920 			pp->p_fsdata = C_NOCOMMIT;
921 		} while ((pp = pp->p_next) != savepp);
922 	}
923 
924 	return (error);
925 }
926 
927 /*
928  * Write to file.  Writes to remote server in largest size
929  * chunks that the server can handle.  Write is synchronous.
930  */
931 static int
932 nfs3write(vnode_t *vp, caddr_t base, u_offset_t offset, int count, cred_t *cr,
933 	stable_how *stab_comm)
934 {
935 	mntinfo_t *mi;
936 	WRITE3args args;
937 	WRITE3res res;
938 	int error;
939 	int tsize;
940 	rnode_t *rp;
941 	int douprintf;
942 
943 	rp = VTOR(vp);
944 	mi = VTOMI(vp);
945 
946 	ASSERT(nfs_zone() == mi->mi_zone);
947 
948 	args.file = *VTOFH3(vp);
949 	args.stable = *stab_comm;
950 
951 	*stab_comm = FILE_SYNC;
952 
953 	douprintf = 1;
954 
955 	do {
956 		if ((vp->v_flag & VNOCACHE) ||
957 		    (rp->r_flags & RDIRECTIO) ||
958 		    (mi->mi_flags & MI_DIRECTIO))
959 			tsize = MIN(mi->mi_stsize, count);
960 		else
961 			tsize = MIN(mi->mi_curwrite, count);
962 		args.offset = (offset3)offset;
963 		args.count = (count3)tsize;
964 		args.data.data_len = (uint_t)tsize;
965 		args.data.data_val = base;
966 
967 		if (mi->mi_io_kstats) {
968 			mutex_enter(&mi->mi_lock);
969 			kstat_runq_enter(KSTAT_IO_PTR(mi->mi_io_kstats));
970 			mutex_exit(&mi->mi_lock);
971 		}
972 		args.mblk = NULL;
973 		do {
974 			error = rfs3call(mi, NFSPROC3_WRITE,
975 			    xdr_WRITE3args, (caddr_t)&args,
976 			    xdr_WRITE3res, (caddr_t)&res, cr,
977 			    &douprintf, &res.status, 0, NULL);
978 		} while (error == ENFS_TRYAGAIN);
979 		if (mi->mi_io_kstats) {
980 			mutex_enter(&mi->mi_lock);
981 			kstat_runq_exit(KSTAT_IO_PTR(mi->mi_io_kstats));
982 			mutex_exit(&mi->mi_lock);
983 		}
984 
985 		if (error)
986 			return (error);
987 		error = geterrno3(res.status);
988 		if (!error) {
989 			if (res.resok.count > args.count) {
990 				zcmn_err(getzoneid(), CE_WARN,
991 				    "nfs3write: server %s wrote %u, "
992 				    "requested was %u",
993 				    rp->r_server->sv_hostname,
994 				    res.resok.count, args.count);
995 				return (EIO);
996 			}
997 			if (res.resok.committed == UNSTABLE) {
998 				*stab_comm = UNSTABLE;
999 				if (args.stable == DATA_SYNC ||
1000 				    args.stable == FILE_SYNC) {
1001 					zcmn_err(getzoneid(), CE_WARN,
1002 			"nfs3write: server %s did not commit to stable storage",
1003 					    rp->r_server->sv_hostname);
1004 					return (EIO);
1005 				}
1006 			}
1007 			tsize = (int)res.resok.count;
1008 			count -= tsize;
1009 			base += tsize;
1010 			offset += tsize;
1011 			if (mi->mi_io_kstats) {
1012 				mutex_enter(&mi->mi_lock);
1013 				KSTAT_IO_PTR(mi->mi_io_kstats)->writes++;
1014 				KSTAT_IO_PTR(mi->mi_io_kstats)->nwritten +=
1015 				    tsize;
1016 				mutex_exit(&mi->mi_lock);
1017 			}
1018 			lwp_stat_update(LWP_STAT_OUBLK, 1);
1019 			mutex_enter(&rp->r_statelock);
1020 			if (rp->r_flags & RHAVEVERF) {
1021 				if (rp->r_verf != res.resok.verf) {
1022 					nfs3_set_mod(vp);
1023 					rp->r_verf = res.resok.verf;
1024 					/*
1025 					 * If the data was written UNSTABLE,
1026 					 * then might as well stop because
1027 					 * the whole block will have to get
1028 					 * rewritten anyway.
1029 					 */
1030 					if (*stab_comm == UNSTABLE) {
1031 						mutex_exit(&rp->r_statelock);
1032 						break;
1033 					}
1034 				}
1035 			} else {
1036 				rp->r_verf = res.resok.verf;
1037 				rp->r_flags |= RHAVEVERF;
1038 			}
1039 			/*
1040 			 * Mark the attribute cache as timed out and
1041 			 * set RWRITEATTR to indicate that the file
1042 			 * was modified with a WRITE operation and
1043 			 * that the attributes can not be trusted.
1044 			 */
1045 			PURGE_ATTRCACHE_LOCKED(rp);
1046 			rp->r_flags |= RWRITEATTR;
1047 			mutex_exit(&rp->r_statelock);
1048 		}
1049 	} while (!error && count);
1050 
1051 	return (error);
1052 }
1053 
1054 /*
1055  * Read from a file.  Reads data in largest chunks our interface can handle.
1056  */
1057 static int
1058 nfs3read(vnode_t *vp, caddr_t base, offset_t offset, int count,
1059 	size_t *residp, cred_t *cr)
1060 {
1061 	mntinfo_t *mi;
1062 	READ3args args;
1063 	READ3vres res;
1064 	int tsize;
1065 	int error;
1066 	int douprintf;
1067 	failinfo_t fi;
1068 	rnode_t *rp;
1069 	struct vattr va;
1070 	hrtime_t t;
1071 
1072 	rp = VTOR(vp);
1073 	mi = VTOMI(vp);
1074 	ASSERT(nfs_zone() == mi->mi_zone);
1075 	douprintf = 1;
1076 
1077 	args.file = *VTOFH3(vp);
1078 	fi.vp = vp;
1079 	fi.fhp = (caddr_t)&args.file;
1080 	fi.copyproc = nfs3copyfh;
1081 	fi.lookupproc = nfs3lookup;
1082 	fi.xattrdirproc = acl_getxattrdir3;
1083 
1084 	res.pov.fres.vp = vp;
1085 	res.pov.fres.vap = &va;
1086 
1087 	*residp = count;
1088 	do {
1089 		if (mi->mi_io_kstats) {
1090 			mutex_enter(&mi->mi_lock);
1091 			kstat_runq_enter(KSTAT_IO_PTR(mi->mi_io_kstats));
1092 			mutex_exit(&mi->mi_lock);
1093 		}
1094 
1095 		do {
1096 			if ((vp->v_flag & VNOCACHE) ||
1097 			    (rp->r_flags & RDIRECTIO) ||
1098 			    (mi->mi_flags & MI_DIRECTIO))
1099 				tsize = MIN(mi->mi_tsize, count);
1100 			else
1101 				tsize = MIN(mi->mi_curread, count);
1102 			res.data.data_val = base;
1103 			res.data.data_len = tsize;
1104 			args.offset = (offset3)offset;
1105 			args.count = (count3)tsize;
1106 			t = gethrtime();
1107 			error = rfs3call(mi, NFSPROC3_READ,
1108 			    xdr_READ3args, (caddr_t)&args,
1109 			    xdr_READ3vres, (caddr_t)&res, cr,
1110 			    &douprintf, &res.status, 0, &fi);
1111 		} while (error == ENFS_TRYAGAIN);
1112 
1113 		if (mi->mi_io_kstats) {
1114 			mutex_enter(&mi->mi_lock);
1115 			kstat_runq_exit(KSTAT_IO_PTR(mi->mi_io_kstats));
1116 			mutex_exit(&mi->mi_lock);
1117 		}
1118 
1119 		if (error)
1120 			return (error);
1121 
1122 		error = geterrno3(res.status);
1123 		if (error)
1124 			return (error);
1125 
1126 		if (res.count != res.data.data_len) {
1127 			zcmn_err(getzoneid(), CE_WARN,
1128 				"nfs3read: server %s returned incorrect amount",
1129 				rp->r_server->sv_hostname);
1130 			return (EIO);
1131 		}
1132 
1133 		count -= res.count;
1134 		*residp = count;
1135 		base += res.count;
1136 		offset += res.count;
1137 		if (mi->mi_io_kstats) {
1138 			mutex_enter(&mi->mi_lock);
1139 			KSTAT_IO_PTR(mi->mi_io_kstats)->reads++;
1140 			KSTAT_IO_PTR(mi->mi_io_kstats)->nread += res.count;
1141 			mutex_exit(&mi->mi_lock);
1142 		}
1143 		lwp_stat_update(LWP_STAT_INBLK, 1);
1144 	} while (count && !res.eof);
1145 
1146 	if (res.pov.attributes) {
1147 		mutex_enter(&rp->r_statelock);
1148 		if (!CACHE_VALID(rp, va.va_mtime, va.va_size)) {
1149 			mutex_exit(&rp->r_statelock);
1150 			PURGE_ATTRCACHE(vp);
1151 		} else {
1152 			if (rp->r_mtime <= t)
1153 				nfs_attrcache_va(vp, &va);
1154 			mutex_exit(&rp->r_statelock);
1155 		}
1156 	}
1157 
1158 	return (0);
1159 }
1160 
1161 /* ARGSUSED */
1162 static int
1163 nfs3_ioctl(vnode_t *vp, int cmd, intptr_t arg, int flag, cred_t *cr, int *rvalp)
1164 {
1165 
1166 	if (nfs_zone() != VTOMI(vp)->mi_zone)
1167 		return (EIO);
1168 	switch (cmd) {
1169 		case _FIODIRECTIO:
1170 			return (nfs_directio(vp, (int)arg, cr));
1171 		default:
1172 			return (ENOTTY);
1173 	}
1174 }
1175 
1176 static int
1177 nfs3_getattr(vnode_t *vp, struct vattr *vap, int flags, cred_t *cr)
1178 {
1179 	int error;
1180 	rnode_t *rp;
1181 
1182 	if (nfs_zone() != VTOMI(vp)->mi_zone)
1183 		return (EIO);
1184 	/*
1185 	 * If it has been specified that the return value will
1186 	 * just be used as a hint, and we are only being asked
1187 	 * for size, fsid or rdevid, then return the client's
1188 	 * notion of these values without checking to make sure
1189 	 * that the attribute cache is up to date.
1190 	 * The whole point is to avoid an over the wire GETATTR
1191 	 * call.
1192 	 */
1193 	rp = VTOR(vp);
1194 	if (flags & ATTR_HINT) {
1195 		if (vap->va_mask ==
1196 		    (vap->va_mask & (AT_SIZE | AT_FSID | AT_RDEV))) {
1197 			mutex_enter(&rp->r_statelock);
1198 			if (vap->va_mask | AT_SIZE)
1199 				vap->va_size = rp->r_size;
1200 			if (vap->va_mask | AT_FSID)
1201 				vap->va_fsid = rp->r_attr.va_fsid;
1202 			if (vap->va_mask | AT_RDEV)
1203 				vap->va_rdev = rp->r_attr.va_rdev;
1204 			mutex_exit(&rp->r_statelock);
1205 			return (0);
1206 		}
1207 	}
1208 
1209 	/*
1210 	 * Only need to flush pages if asking for the mtime
1211 	 * and if there any dirty pages or any outstanding
1212 	 * asynchronous (write) requests for this file.
1213 	 */
1214 	if (vap->va_mask & AT_MTIME) {
1215 		if (vn_has_cached_data(vp) &&
1216 		    ((rp->r_flags & RDIRTY) || rp->r_awcount > 0)) {
1217 			mutex_enter(&rp->r_statelock);
1218 			rp->r_gcount++;
1219 			mutex_exit(&rp->r_statelock);
1220 			error = nfs3_putpage(vp, (offset_t)0, 0, 0, cr);
1221 			mutex_enter(&rp->r_statelock);
1222 			if (error && (error == ENOSPC || error == EDQUOT)) {
1223 				if (!rp->r_error)
1224 					rp->r_error = error;
1225 			}
1226 			if (--rp->r_gcount == 0)
1227 				cv_broadcast(&rp->r_cv);
1228 			mutex_exit(&rp->r_statelock);
1229 		}
1230 	}
1231 
1232 	return (nfs3getattr(vp, vap, cr));
1233 }
1234 
1235 /*ARGSUSED4*/
1236 static int
1237 nfs3_setattr(vnode_t *vp, struct vattr *vap, int flags, cred_t *cr,
1238 		caller_context_t *ct)
1239 {
1240 	int error;
1241 	struct vattr va;
1242 
1243 	if (vap->va_mask & AT_NOSET)
1244 		return (EINVAL);
1245 	if (nfs_zone() != VTOMI(vp)->mi_zone)
1246 		return (EIO);
1247 
1248 	va.va_mask = AT_UID | AT_MODE;
1249 	error = nfs3getattr(vp, &va, cr);
1250 	if (error)
1251 		return (error);
1252 
1253 	error = secpolicy_vnode_setattr(cr, vp, vap, &va, flags, nfs3_accessx,
1254 		vp);
1255 	if (error)
1256 		return (error);
1257 
1258 	return (nfs3setattr(vp, vap, flags, cr));
1259 }
1260 
1261 static int
1262 nfs3setattr(vnode_t *vp, struct vattr *vap, int flags, cred_t *cr)
1263 {
1264 	int error;
1265 	uint_t mask;
1266 	SETATTR3args args;
1267 	SETATTR3res res;
1268 	int douprintf;
1269 	rnode_t *rp;
1270 	struct vattr va;
1271 	mode_t omode;
1272 	vsecattr_t *vsp;
1273 	hrtime_t t;
1274 
1275 	ASSERT(nfs_zone() == VTOMI(vp)->mi_zone);
1276 	mask = vap->va_mask;
1277 
1278 	rp = VTOR(vp);
1279 
1280 	/*
1281 	 * Only need to flush pages if there are any pages and
1282 	 * if the file is marked as dirty in some fashion.  The
1283 	 * file must be flushed so that we can accurately
1284 	 * determine the size of the file and the cached data
1285 	 * after the SETATTR returns.  A file is considered to
1286 	 * be dirty if it is either marked with RDIRTY, has
1287 	 * outstanding i/o's active, or is mmap'd.  In this
1288 	 * last case, we can't tell whether there are dirty
1289 	 * pages, so we flush just to be sure.
1290 	 */
1291 	if (vn_has_cached_data(vp) &&
1292 	    ((rp->r_flags & RDIRTY) ||
1293 	    rp->r_count > 0 ||
1294 	    rp->r_mapcnt > 0)) {
1295 		ASSERT(vp->v_type != VCHR);
1296 		error = nfs3_putpage(vp, (offset_t)0, 0, 0, cr);
1297 		if (error && (error == ENOSPC || error == EDQUOT)) {
1298 			mutex_enter(&rp->r_statelock);
1299 			if (!rp->r_error)
1300 				rp->r_error = error;
1301 			mutex_exit(&rp->r_statelock);
1302 		}
1303 	}
1304 
1305 	args.object = *RTOFH3(rp);
1306 	/*
1307 	 * If the intent is for the server to set the times,
1308 	 * there is no point in have the mask indicating set mtime or
1309 	 * atime, because the vap values may be junk, and so result
1310 	 * in an overflow error. Remove these flags from the vap mask
1311 	 * before calling in this case, and restore them afterwards.
1312 	 */
1313 	if ((mask & (AT_ATIME | AT_MTIME)) && !(flags & ATTR_UTIME)) {
1314 		/* Use server times, so don't set the args time fields */
1315 		vap->va_mask &= ~(AT_ATIME | AT_MTIME);
1316 		error = vattr_to_sattr3(vap, &args.new_attributes);
1317 		vap->va_mask |= (mask & (AT_ATIME | AT_MTIME));
1318 		if (mask & AT_ATIME) {
1319 			args.new_attributes.atime.set_it = SET_TO_SERVER_TIME;
1320 		}
1321 		if (mask & AT_MTIME) {
1322 			args.new_attributes.mtime.set_it = SET_TO_SERVER_TIME;
1323 		}
1324 	} else {
1325 		/* Either do not set times or use the client specified times */
1326 		error = vattr_to_sattr3(vap, &args.new_attributes);
1327 	}
1328 
1329 	if (error) {
1330 		/* req time field(s) overflow - return immediately */
1331 		return (error);
1332 	}
1333 
1334 	va.va_mask = AT_MODE | AT_CTIME;
1335 	error = nfs3getattr(vp, &va, cr);
1336 	if (error)
1337 		return (error);
1338 	omode = va.va_mode;
1339 
1340 tryagain:
1341 	if (mask & AT_SIZE) {
1342 		args.guard.check = TRUE;
1343 		args.guard.obj_ctime.seconds = va.va_ctime.tv_sec;
1344 		args.guard.obj_ctime.nseconds = va.va_ctime.tv_nsec;
1345 	} else
1346 		args.guard.check = FALSE;
1347 
1348 	douprintf = 1;
1349 
1350 	t = gethrtime();
1351 
1352 	error = rfs3call(VTOMI(vp), NFSPROC3_SETATTR,
1353 	    xdr_SETATTR3args, (caddr_t)&args,
1354 	    xdr_SETATTR3res, (caddr_t)&res, cr,
1355 	    &douprintf, &res.status, 0, NULL);
1356 
1357 	/*
1358 	 * Purge the access cache and ACL cache if changing either the
1359 	 * owner of the file, the group owner, or the mode.  These may
1360 	 * change the access permissions of the file, so purge old
1361 	 * information and start over again.
1362 	 */
1363 	if (mask & (AT_UID | AT_GID | AT_MODE)) {
1364 		(void) nfs_access_purge_rp(rp);
1365 		if (rp->r_secattr != NULL) {
1366 			mutex_enter(&rp->r_statelock);
1367 			vsp = rp->r_secattr;
1368 			rp->r_secattr = NULL;
1369 			mutex_exit(&rp->r_statelock);
1370 			if (vsp != NULL)
1371 				nfs_acl_free(vsp);
1372 		}
1373 	}
1374 
1375 	if (error) {
1376 		PURGE_ATTRCACHE(vp);
1377 		return (error);
1378 	}
1379 
1380 	error = geterrno3(res.status);
1381 	if (!error) {
1382 		/*
1383 		 * If changing the size of the file, invalidate
1384 		 * any local cached data which is no longer part
1385 		 * of the file.  We also possibly invalidate the
1386 		 * last page in the file.  We could use
1387 		 * pvn_vpzero(), but this would mark the page as
1388 		 * modified and require it to be written back to
1389 		 * the server for no particularly good reason.
1390 		 * This way, if we access it, then we bring it
1391 		 * back in.  A read should be cheaper than a
1392 		 * write.
1393 		 */
1394 		if (mask & AT_SIZE) {
1395 			nfs_invalidate_pages(vp,
1396 			    (vap->va_size & PAGEMASK), cr);
1397 		}
1398 		nfs3_cache_wcc_data(vp, &res.resok.obj_wcc, t, cr);
1399 		/*
1400 		 * Some servers will change the mode to clear the setuid
1401 		 * and setgid bits when changing the uid or gid.  The
1402 		 * client needs to compensate appropriately.
1403 		 */
1404 		if (mask & (AT_UID | AT_GID)) {
1405 			int terror;
1406 
1407 			va.va_mask = AT_MODE;
1408 			terror = nfs3getattr(vp, &va, cr);
1409 			if (!terror &&
1410 			    (((mask & AT_MODE) && va.va_mode != vap->va_mode) ||
1411 			    (!(mask & AT_MODE) && va.va_mode != omode))) {
1412 				va.va_mask = AT_MODE;
1413 				if (mask & AT_MODE)
1414 					va.va_mode = vap->va_mode;
1415 				else
1416 					va.va_mode = omode;
1417 				(void) nfs3setattr(vp, &va, 0, cr);
1418 			}
1419 		}
1420 	} else {
1421 		nfs3_cache_wcc_data(vp, &res.resfail.obj_wcc, t, cr);
1422 		/*
1423 		 * If we got back a "not synchronized" error, then
1424 		 * we need to retry with a new guard value.  The
1425 		 * guard value used is the change time.  If the
1426 		 * server returned post_op_attr, then we can just
1427 		 * retry because we have the latest attributes.
1428 		 * Otherwise, we issue a GETATTR to get the latest
1429 		 * attributes and then retry.  If we couldn't get
1430 		 * the attributes this way either, then we give
1431 		 * up because we can't complete the operation as
1432 		 * required.
1433 		 */
1434 		if (res.status == NFS3ERR_NOT_SYNC) {
1435 			va.va_mask = AT_CTIME;
1436 			if (nfs3getattr(vp, &va, cr) == 0)
1437 				goto tryagain;
1438 		}
1439 		PURGE_STALE_FH(error, vp, cr);
1440 	}
1441 
1442 	return (error);
1443 }
1444 
1445 static int
1446 nfs3_accessx(void *vp, int mode, cred_t *cr)
1447 {
1448 	ASSERT(nfs_zone() == VTOMI((vnode_t *)vp)->mi_zone);
1449 	return (nfs3_access(vp, mode, 0, cr));
1450 }
1451 
1452 /* ARGSUSED */
1453 static int
1454 nfs3_access(vnode_t *vp, int mode, int flags, cred_t *cr)
1455 {
1456 	int error;
1457 	ACCESS3args args;
1458 	ACCESS3res res;
1459 	int douprintf;
1460 	uint32 acc;
1461 	rnode_t *rp;
1462 	cred_t *cred, *ncr, *ncrfree = NULL;
1463 	failinfo_t fi;
1464 	nfs_access_type_t cacc;
1465 	hrtime_t t;
1466 
1467 	acc = 0;
1468 	if (nfs_zone() != VTOMI(vp)->mi_zone)
1469 		return (EIO);
1470 	if (mode & VREAD)
1471 		acc |= ACCESS3_READ;
1472 	if (mode & VWRITE) {
1473 		if (vn_is_readonly(vp) && !IS_DEVVP(vp))
1474 			return (EROFS);
1475 		if (vp->v_type == VDIR)
1476 			acc |= ACCESS3_DELETE;
1477 		acc |= ACCESS3_MODIFY | ACCESS3_EXTEND;
1478 	}
1479 	if (mode & VEXEC) {
1480 		if (vp->v_type == VDIR)
1481 			acc |= ACCESS3_LOOKUP;
1482 		else
1483 			acc |= ACCESS3_EXECUTE;
1484 	}
1485 
1486 	rp = VTOR(vp);
1487 	args.object = *VTOFH3(vp);
1488 	if (vp->v_type == VDIR) {
1489 		args.access = ACCESS3_READ | ACCESS3_DELETE | ACCESS3_MODIFY |
1490 		    ACCESS3_EXTEND | ACCESS3_LOOKUP;
1491 	} else {
1492 		args.access = ACCESS3_READ | ACCESS3_MODIFY | ACCESS3_EXTEND |
1493 		    ACCESS3_EXECUTE;
1494 	}
1495 	fi.vp = vp;
1496 	fi.fhp = (caddr_t)&args.object;
1497 	fi.copyproc = nfs3copyfh;
1498 	fi.lookupproc = nfs3lookup;
1499 	fi.xattrdirproc = acl_getxattrdir3;
1500 
1501 	cred = cr;
1502 	/*
1503 	 * ncr and ncrfree both initially
1504 	 * point to the memory area returned
1505 	 * by crnetadjust();
1506 	 * ncrfree not NULL when exiting means
1507 	 * that we need to release it
1508 	 */
1509 	ncr = crnetadjust(cred);
1510 	ncrfree = ncr;
1511 tryagain:
1512 	if (rp->r_acache != NULL) {
1513 		cacc = nfs_access_check(rp, acc, cred);
1514 		if (cacc == NFS_ACCESS_ALLOWED) {
1515 			if (ncrfree != NULL)
1516 				crfree(ncrfree);
1517 			return (0);
1518 		}
1519 		if (cacc == NFS_ACCESS_DENIED) {
1520 			/*
1521 			 * If the cred can be adjusted, try again
1522 			 * with the new cred.
1523 			 */
1524 			if (ncr != NULL) {
1525 				cred = ncr;
1526 				ncr = NULL;
1527 				goto tryagain;
1528 			}
1529 			if (ncrfree != NULL)
1530 				crfree(ncrfree);
1531 			return (EACCES);
1532 		}
1533 	}
1534 
1535 	douprintf = 1;
1536 
1537 	t = gethrtime();
1538 
1539 	error = rfs3call(VTOMI(vp), NFSPROC3_ACCESS,
1540 	    xdr_ACCESS3args, (caddr_t)&args,
1541 	    xdr_ACCESS3res, (caddr_t)&res, cred,
1542 	    &douprintf, &res.status, 0, &fi);
1543 
1544 	if (error) {
1545 		if (ncrfree != NULL)
1546 			crfree(ncrfree);
1547 		return (error);
1548 	}
1549 
1550 	error = geterrno3(res.status);
1551 	if (!error) {
1552 		nfs3_cache_post_op_attr(vp, &res.resok.obj_attributes, t, cr);
1553 		nfs_access_cache(rp, args.access, res.resok.access, cred);
1554 		/*
1555 		 * we just cached results with cred; if cred is the
1556 		 * adjusted credentials from crnetadjust, we do not want
1557 		 * to release them before exiting: hence setting ncrfree
1558 		 * to NULL
1559 		 */
1560 		if (cred != cr)
1561 			ncrfree = NULL;
1562 		if ((acc & res.resok.access) != acc) {
1563 			/*
1564 			 * If the cred can be adjusted, try again
1565 			 * with the new cred.
1566 			 */
1567 			if (ncr != NULL) {
1568 				cred = ncr;
1569 				ncr = NULL;
1570 				goto tryagain;
1571 			}
1572 			error = EACCES;
1573 		}
1574 	} else {
1575 		nfs3_cache_post_op_attr(vp, &res.resfail.obj_attributes, t, cr);
1576 		PURGE_STALE_FH(error, vp, cr);
1577 	}
1578 
1579 	if (ncrfree != NULL)
1580 		crfree(ncrfree);
1581 
1582 	return (error);
1583 }
1584 
1585 static int nfs3_do_symlink_cache = 1;
1586 
1587 static int
1588 nfs3_readlink(vnode_t *vp, struct uio *uiop, cred_t *cr)
1589 {
1590 	int error;
1591 	READLINK3args args;
1592 	READLINK3res res;
1593 	nfspath3 resdata_backup;
1594 	rnode_t *rp;
1595 	int douprintf;
1596 	int len;
1597 	failinfo_t fi;
1598 	hrtime_t t;
1599 
1600 	/*
1601 	 * Can't readlink anything other than a symbolic link.
1602 	 */
1603 	if (vp->v_type != VLNK)
1604 		return (EINVAL);
1605 	if (nfs_zone() != VTOMI(vp)->mi_zone)
1606 		return (EIO);
1607 
1608 	rp = VTOR(vp);
1609 	if (nfs3_do_symlink_cache && rp->r_symlink.contents != NULL) {
1610 		error = nfs3_validate_caches(vp, cr);
1611 		if (error)
1612 			return (error);
1613 		mutex_enter(&rp->r_statelock);
1614 		if (rp->r_symlink.contents != NULL) {
1615 			error = uiomove(rp->r_symlink.contents,
1616 			    rp->r_symlink.len, UIO_READ, uiop);
1617 			mutex_exit(&rp->r_statelock);
1618 			return (error);
1619 		}
1620 		mutex_exit(&rp->r_statelock);
1621 	}
1622 
1623 	args.symlink = *VTOFH3(vp);
1624 	fi.vp = vp;
1625 	fi.fhp = (caddr_t)&args.symlink;
1626 	fi.copyproc = nfs3copyfh;
1627 	fi.lookupproc = nfs3lookup;
1628 	fi.xattrdirproc = acl_getxattrdir3;
1629 
1630 	res.resok.data = kmem_alloc(MAXPATHLEN, KM_SLEEP);
1631 
1632 	resdata_backup = res.resok.data;
1633 
1634 	douprintf = 1;
1635 
1636 	t = gethrtime();
1637 
1638 	error = rfs3call(VTOMI(vp), NFSPROC3_READLINK,
1639 	    xdr_nfs_fh3, (caddr_t)&args,
1640 	    xdr_READLINK3res, (caddr_t)&res, cr,
1641 	    &douprintf, &res.status, 0, &fi);
1642 
1643 	if (res.resok.data == nfs3nametoolong)
1644 		error = EINVAL;
1645 
1646 	if (error) {
1647 		kmem_free(resdata_backup, MAXPATHLEN);
1648 		return (error);
1649 	}
1650 
1651 	error = geterrno3(res.status);
1652 	if (!error) {
1653 		nfs3_cache_post_op_attr(vp, &res.resok.symlink_attributes, t,
1654 		    cr);
1655 		len = strlen(res.resok.data);
1656 		error = uiomove(res.resok.data, len, UIO_READ, uiop);
1657 		if (nfs3_do_symlink_cache && rp->r_symlink.contents == NULL) {
1658 			mutex_enter(&rp->r_statelock);
1659 				if (rp->r_symlink.contents == NULL) {
1660 				rp->r_symlink.contents = res.resok.data;
1661 				rp->r_symlink.len = len;
1662 				rp->r_symlink.size = MAXPATHLEN;
1663 				mutex_exit(&rp->r_statelock);
1664 			} else {
1665 				mutex_exit(&rp->r_statelock);
1666 
1667 				kmem_free((void *)res.resok.data, MAXPATHLEN);
1668 			}
1669 		} else {
1670 			kmem_free((void *)res.resok.data, MAXPATHLEN);
1671 		}
1672 	} else {
1673 		nfs3_cache_post_op_attr(vp,
1674 		    &res.resfail.symlink_attributes, t, cr);
1675 		PURGE_STALE_FH(error, vp, cr);
1676 
1677 		kmem_free((void *)res.resok.data, MAXPATHLEN);
1678 
1679 	}
1680 
1681 	/*
1682 	 * The over the wire error for attempting to readlink something
1683 	 * other than a symbolic link is ENXIO.  However, we need to
1684 	 * return EINVAL instead of ENXIO, so we map it here.
1685 	 */
1686 	return (error == ENXIO ? EINVAL : error);
1687 }
1688 
1689 /*
1690  * Flush local dirty pages to stable storage on the server.
1691  *
1692  * If FNODSYNC is specified, then there is nothing to do because
1693  * metadata changes are not cached on the client before being
1694  * sent to the server.
1695  */
1696 static int
1697 nfs3_fsync(vnode_t *vp, int syncflag, cred_t *cr)
1698 {
1699 	int error;
1700 
1701 	if ((syncflag & FNODSYNC) || IS_SWAPVP(vp))
1702 		return (0);
1703 	if (nfs_zone() != VTOMI(vp)->mi_zone)
1704 		return (EIO);
1705 
1706 	error = nfs3_putpage_commit(vp, (offset_t)0, 0, cr);
1707 	if (!error)
1708 		error = VTOR(vp)->r_error;
1709 	return (error);
1710 }
1711 
1712 /*
1713  * Weirdness: if the file was removed or the target of a rename
1714  * operation while it was open, it got renamed instead.  Here we
1715  * remove the renamed file.
1716  */
1717 static void
1718 nfs3_inactive(vnode_t *vp, cred_t *cr)
1719 {
1720 	rnode_t *rp;
1721 
1722 	ASSERT(vp != DNLC_NO_VNODE);
1723 
1724 	/*
1725 	 * If this is coming from the wrong zone, we let someone in the right
1726 	 * zone take care of it asynchronously.  We can get here due to
1727 	 * VN_RELE() being called from pageout() or fsflush().  This call may
1728 	 * potentially turn into an expensive no-op if, for instance, v_count
1729 	 * gets incremented in the meantime, but it's still correct.
1730 	 */
1731 	if (nfs_zone() != VTOMI(vp)->mi_zone) {
1732 		nfs_async_inactive(vp, cr, nfs3_inactive);
1733 		return;
1734 	}
1735 
1736 	rp = VTOR(vp);
1737 redo:
1738 	if (rp->r_unldvp != NULL) {
1739 		/*
1740 		 * Save the vnode pointer for the directory where the
1741 		 * unlinked-open file got renamed, then set it to NULL
1742 		 * to prevent another thread from getting here before
1743 		 * we're done with the remove.  While we have the
1744 		 * statelock, make local copies of the pertinent rnode
1745 		 * fields.  If we weren't to do this in an atomic way, the
1746 		 * the unl* fields could become inconsistent with respect
1747 		 * to each other due to a race condition between this
1748 		 * code and nfs_remove().  See bug report 1034328.
1749 		 */
1750 		mutex_enter(&rp->r_statelock);
1751 		if (rp->r_unldvp != NULL) {
1752 			vnode_t *unldvp;
1753 			char *unlname;
1754 			cred_t *unlcred;
1755 			REMOVE3args args;
1756 			REMOVE3res res;
1757 			int douprintf;
1758 			int error;
1759 			hrtime_t t;
1760 
1761 			unldvp = rp->r_unldvp;
1762 			rp->r_unldvp = NULL;
1763 			unlname = rp->r_unlname;
1764 			rp->r_unlname = NULL;
1765 			unlcred = rp->r_unlcred;
1766 			rp->r_unlcred = NULL;
1767 			mutex_exit(&rp->r_statelock);
1768 
1769 			/*
1770 			 * If there are any dirty pages left, then flush
1771 			 * them.  This is unfortunate because they just
1772 			 * may get thrown away during the remove operation,
1773 			 * but we have to do this for correctness.
1774 			 */
1775 			if (vn_has_cached_data(vp) &&
1776 			    ((rp->r_flags & RDIRTY) || rp->r_count > 0)) {
1777 				ASSERT(vp->v_type != VCHR);
1778 				error = nfs3_putpage(vp, (offset_t)0, 0, 0, cr);
1779 				if (error) {
1780 					mutex_enter(&rp->r_statelock);
1781 					if (!rp->r_error)
1782 						rp->r_error = error;
1783 					mutex_exit(&rp->r_statelock);
1784 				}
1785 			}
1786 
1787 			/*
1788 			 * Do the remove operation on the renamed file
1789 			 */
1790 			setdiropargs3(&args.object, unlname, unldvp);
1791 
1792 			douprintf = 1;
1793 
1794 			t = gethrtime();
1795 
1796 			error = rfs3call(VTOMI(unldvp), NFSPROC3_REMOVE,
1797 			    xdr_diropargs3, (caddr_t)&args,
1798 			    xdr_REMOVE3res, (caddr_t)&res, unlcred,
1799 			    &douprintf, &res.status, 0, NULL);
1800 
1801 			if (error) {
1802 				PURGE_ATTRCACHE(unldvp);
1803 			} else {
1804 				error = geterrno3(res.status);
1805 				if (!error) {
1806 					nfs3_cache_wcc_data(unldvp,
1807 					    &res.resok.dir_wcc, t, cr);
1808 					if (HAVE_RDDIR_CACHE(VTOR(unldvp)))
1809 						nfs_purge_rddir_cache(unldvp);
1810 				} else {
1811 					nfs3_cache_wcc_data(unldvp,
1812 					    &res.resfail.dir_wcc, t, cr);
1813 					PURGE_STALE_FH(error, unldvp, cr);
1814 				}
1815 			}
1816 
1817 			/*
1818 			 * Release stuff held for the remove
1819 			 */
1820 			VN_RELE(unldvp);
1821 			kmem_free(unlname, MAXNAMELEN);
1822 			crfree(unlcred);
1823 			goto redo;
1824 		}
1825 		mutex_exit(&rp->r_statelock);
1826 	}
1827 
1828 	rp_addfree(rp, cr);
1829 }
1830 
1831 /*
1832  * Remote file system operations having to do with directory manipulation.
1833  */
1834 
1835 static int
1836 nfs3_lookup(vnode_t *dvp, char *nm, vnode_t **vpp, struct pathname *pnp,
1837 	int flags, vnode_t *rdir, cred_t *cr)
1838 {
1839 	int error;
1840 	vnode_t *vp;
1841 	vnode_t *avp = NULL;
1842 	rnode_t *drp;
1843 
1844 	if (nfs_zone() != VTOMI(dvp)->mi_zone)
1845 		return (EPERM);
1846 
1847 	drp = VTOR(dvp);
1848 
1849 	/*
1850 	 * Are we looking up extended attributes?  If so, "dvp" is
1851 	 * the file or directory for which we want attributes, and
1852 	 * we need a lookup of the hidden attribute directory
1853 	 * before we lookup the rest of the path.
1854 	 */
1855 	if (flags & LOOKUP_XATTR) {
1856 		bool_t cflag = ((flags & CREATE_XATTR_DIR) != 0);
1857 		mntinfo_t *mi;
1858 
1859 		mi = VTOMI(dvp);
1860 		if (!(mi->mi_flags & MI_EXTATTR))
1861 			return (EINVAL);
1862 
1863 		if (nfs_rw_enter_sig(&drp->r_rwlock, RW_READER, INTR(dvp)))
1864 			return (EINTR);
1865 
1866 		(void) nfs3lookup_dnlc(dvp, XATTR_DIR_NAME, &avp, cr);
1867 		if (avp == NULL)
1868 			error = acl_getxattrdir3(dvp, &avp, cflag, cr, 0);
1869 		else
1870 			error = 0;
1871 
1872 		nfs_rw_exit(&drp->r_rwlock);
1873 
1874 		if (error) {
1875 			if (mi->mi_flags & MI_EXTATTR)
1876 				return (error);
1877 			return (EINVAL);
1878 		}
1879 		dvp = avp;
1880 		drp = VTOR(dvp);
1881 	}
1882 
1883 	if (nfs_rw_enter_sig(&drp->r_rwlock, RW_READER, INTR(dvp))) {
1884 		error = EINTR;
1885 		goto out;
1886 	}
1887 
1888 	error = nfs3lookup(dvp, nm, vpp, pnp, flags, rdir, cr, 0);
1889 
1890 	nfs_rw_exit(&drp->r_rwlock);
1891 
1892 	/*
1893 	 * If vnode is a device, create special vnode.
1894 	 */
1895 	if (!error && IS_DEVVP(*vpp)) {
1896 		vp = *vpp;
1897 		*vpp = specvp(vp, vp->v_rdev, vp->v_type, cr);
1898 		VN_RELE(vp);
1899 	}
1900 
1901 out:
1902 	if (avp != NULL)
1903 		VN_RELE(avp);
1904 
1905 	return (error);
1906 }
1907 
1908 static int nfs3_lookup_neg_cache = 1;
1909 
1910 #ifdef DEBUG
1911 static int nfs3_lookup_dnlc_hits = 0;
1912 static int nfs3_lookup_dnlc_misses = 0;
1913 static int nfs3_lookup_dnlc_neg_hits = 0;
1914 static int nfs3_lookup_dnlc_disappears = 0;
1915 static int nfs3_lookup_dnlc_lookups = 0;
1916 #endif
1917 
1918 /* ARGSUSED */
1919 int
1920 nfs3lookup(vnode_t *dvp, char *nm, vnode_t **vpp, struct pathname *pnp,
1921 	int flags, vnode_t *rdir, cred_t *cr, int rfscall_flags)
1922 {
1923 	int error;
1924 	rnode_t *drp;
1925 
1926 	ASSERT(nfs_zone() == VTOMI(dvp)->mi_zone);
1927 	/*
1928 	 * If lookup is for "", just return dvp.  Don't need
1929 	 * to send it over the wire, look it up in the dnlc,
1930 	 * or perform any access checks.
1931 	 */
1932 	if (*nm == '\0') {
1933 		VN_HOLD(dvp);
1934 		*vpp = dvp;
1935 		return (0);
1936 	}
1937 
1938 	/*
1939 	 * Can't do lookups in non-directories.
1940 	 */
1941 	if (dvp->v_type != VDIR)
1942 		return (ENOTDIR);
1943 
1944 	/*
1945 	 * If we're called with RFSCALL_SOFT, it's important that
1946 	 * the only rfscall is one we make directly; if we permit
1947 	 * an access call because we're looking up "." or validating
1948 	 * a dnlc hit, we'll deadlock because that rfscall will not
1949 	 * have the RFSCALL_SOFT set.
1950 	 */
1951 	if (rfscall_flags & RFSCALL_SOFT)
1952 		goto callit;
1953 
1954 	/*
1955 	 * If lookup is for ".", just return dvp.  Don't need
1956 	 * to send it over the wire or look it up in the dnlc,
1957 	 * just need to check access.
1958 	 */
1959 	if (strcmp(nm, ".") == 0) {
1960 		error = nfs3_access(dvp, VEXEC, 0, cr);
1961 		if (error)
1962 			return (error);
1963 		VN_HOLD(dvp);
1964 		*vpp = dvp;
1965 		return (0);
1966 	}
1967 
1968 	drp = VTOR(dvp);
1969 	if (!(drp->r_flags & RLOOKUP)) {
1970 		mutex_enter(&drp->r_statelock);
1971 		drp->r_flags |= RLOOKUP;
1972 		mutex_exit(&drp->r_statelock);
1973 	}
1974 
1975 	/*
1976 	 * Lookup this name in the DNLC.  If there was a valid entry,
1977 	 * then return the results of the lookup.
1978 	 */
1979 	error = nfs3lookup_dnlc(dvp, nm, vpp, cr);
1980 	if (error || *vpp != NULL)
1981 		return (error);
1982 
1983 callit:
1984 	error = nfs3lookup_otw(dvp, nm, vpp, cr, rfscall_flags);
1985 
1986 	return (error);
1987 }
1988 
1989 static int
1990 nfs3lookup_dnlc(vnode_t *dvp, char *nm, vnode_t **vpp, cred_t *cr)
1991 {
1992 	int error;
1993 	vnode_t *vp;
1994 
1995 	ASSERT(*nm != '\0');
1996 	ASSERT(nfs_zone() == VTOMI(dvp)->mi_zone);
1997 	/*
1998 	 * Lookup this name in the DNLC.  If successful, then validate
1999 	 * the caches and then recheck the DNLC.  The DNLC is rechecked
2000 	 * just in case this entry got invalidated during the call
2001 	 * to nfs3_validate_caches.
2002 	 *
2003 	 * An assumption is being made that it is safe to say that a
2004 	 * file exists which may not on the server.  Any operations to
2005 	 * the server will fail with ESTALE.
2006 	 */
2007 #ifdef DEBUG
2008 	nfs3_lookup_dnlc_lookups++;
2009 #endif
2010 	vp = dnlc_lookup(dvp, nm);
2011 	if (vp != NULL) {
2012 		VN_RELE(vp);
2013 		if (vp == DNLC_NO_VNODE && !vn_is_readonly(dvp)) {
2014 			PURGE_ATTRCACHE(dvp);
2015 		}
2016 		error = nfs3_validate_caches(dvp, cr);
2017 		if (error)
2018 			return (error);
2019 		vp = dnlc_lookup(dvp, nm);
2020 		if (vp != NULL) {
2021 			error = nfs3_access(dvp, VEXEC, 0, cr);
2022 			if (error) {
2023 				VN_RELE(vp);
2024 				return (error);
2025 			}
2026 			if (vp == DNLC_NO_VNODE) {
2027 				VN_RELE(vp);
2028 #ifdef DEBUG
2029 				nfs3_lookup_dnlc_neg_hits++;
2030 #endif
2031 				return (ENOENT);
2032 			}
2033 			*vpp = vp;
2034 #ifdef DEBUG
2035 			nfs3_lookup_dnlc_hits++;
2036 #endif
2037 			return (0);
2038 		}
2039 #ifdef DEBUG
2040 		nfs3_lookup_dnlc_disappears++;
2041 #endif
2042 	}
2043 #ifdef DEBUG
2044 	else
2045 		nfs3_lookup_dnlc_misses++;
2046 #endif
2047 
2048 	*vpp = NULL;
2049 
2050 	return (0);
2051 }
2052 
2053 static int
2054 nfs3lookup_otw(vnode_t *dvp, char *nm, vnode_t **vpp, cred_t *cr,
2055 	int rfscall_flags)
2056 {
2057 	int error;
2058 	LOOKUP3args args;
2059 	LOOKUP3vres res;
2060 	int douprintf;
2061 	struct vattr vattr;
2062 	struct vattr dvattr;
2063 	vnode_t *vp;
2064 	failinfo_t fi;
2065 	hrtime_t t;
2066 
2067 	ASSERT(*nm != '\0');
2068 	ASSERT(dvp->v_type == VDIR);
2069 	ASSERT(nfs_zone() == VTOMI(dvp)->mi_zone);
2070 
2071 	setdiropargs3(&args.what, nm, dvp);
2072 
2073 	fi.vp = dvp;
2074 	fi.fhp = (caddr_t)&args.what.dir;
2075 	fi.copyproc = nfs3copyfh;
2076 	fi.lookupproc = nfs3lookup;
2077 	fi.xattrdirproc = acl_getxattrdir3;
2078 	res.obj_attributes.fres.vp = dvp;
2079 	res.obj_attributes.fres.vap = &vattr;
2080 	res.dir_attributes.fres.vp = dvp;
2081 	res.dir_attributes.fres.vap = &dvattr;
2082 
2083 	douprintf = 1;
2084 
2085 	t = gethrtime();
2086 
2087 	error = rfs3call(VTOMI(dvp), NFSPROC3_LOOKUP,
2088 	    xdr_diropargs3, (caddr_t)&args,
2089 	    xdr_LOOKUP3vres, (caddr_t)&res, cr,
2090 	    &douprintf, &res.status, rfscall_flags, &fi);
2091 
2092 	if (error)
2093 		return (error);
2094 
2095 	nfs3_cache_post_op_vattr(dvp, &res.dir_attributes, t, cr);
2096 
2097 	error = geterrno3(res.status);
2098 	if (error) {
2099 		PURGE_STALE_FH(error, dvp, cr);
2100 		if (error == ENOENT && nfs3_lookup_neg_cache)
2101 			dnlc_enter(dvp, nm, DNLC_NO_VNODE);
2102 		return (error);
2103 	}
2104 
2105 	if (res.obj_attributes.attributes) {
2106 		vp = makenfs3node_va(&res.object, res.obj_attributes.fres.vap,
2107 				dvp->v_vfsp, t, cr, VTOR(dvp)->r_path, nm);
2108 	} else {
2109 		vp = makenfs3node_va(&res.object, NULL,
2110 				dvp->v_vfsp, t, cr, VTOR(dvp)->r_path, nm);
2111 		if (vp->v_type == VNON) {
2112 			vattr.va_mask = AT_TYPE;
2113 			error = nfs3getattr(vp, &vattr, cr);
2114 			if (error) {
2115 				VN_RELE(vp);
2116 				return (error);
2117 			}
2118 			vp->v_type = vattr.va_type;
2119 		}
2120 	}
2121 
2122 	if (!(rfscall_flags & RFSCALL_SOFT))
2123 		dnlc_update(dvp, nm, vp);
2124 
2125 	*vpp = vp;
2126 
2127 	return (error);
2128 }
2129 
2130 #ifdef DEBUG
2131 static int nfs3_create_misses = 0;
2132 #endif
2133 
2134 /* ARGSUSED */
2135 static int
2136 nfs3_create(vnode_t *dvp, char *nm, struct vattr *va, enum vcexcl exclusive,
2137 	int mode, vnode_t **vpp, cred_t *cr, int lfaware)
2138 {
2139 	int error;
2140 	vnode_t *vp;
2141 	rnode_t *rp;
2142 	struct vattr vattr;
2143 	rnode_t *drp;
2144 	vnode_t *tempvp;
2145 
2146 	drp = VTOR(dvp);
2147 	if (nfs_zone() != VTOMI(dvp)->mi_zone)
2148 		return (EPERM);
2149 	if (nfs_rw_enter_sig(&drp->r_rwlock, RW_WRITER, INTR(dvp)))
2150 		return (EINTR);
2151 
2152 top:
2153 	/*
2154 	 * We make a copy of the attributes because the caller does not
2155 	 * expect us to change what va points to.
2156 	 */
2157 	vattr = *va;
2158 
2159 	/*
2160 	 * If the pathname is "", just use dvp.  Don't need
2161 	 * to send it over the wire, look it up in the dnlc,
2162 	 * or perform any access checks.
2163 	 */
2164 	if (*nm == '\0') {
2165 		error = 0;
2166 		VN_HOLD(dvp);
2167 		vp = dvp;
2168 	/*
2169 	 * If the pathname is ".", just use dvp.  Don't need
2170 	 * to send it over the wire or look it up in the dnlc,
2171 	 * just need to check access.
2172 	 */
2173 	} else if (strcmp(nm, ".") == 0) {
2174 		error = nfs3_access(dvp, VEXEC, 0, cr);
2175 		if (error) {
2176 			nfs_rw_exit(&drp->r_rwlock);
2177 			return (error);
2178 		}
2179 		VN_HOLD(dvp);
2180 		vp = dvp;
2181 	/*
2182 	 * We need to go over the wire, just to be sure whether the
2183 	 * file exists or not.  Using the DNLC can be dangerous in
2184 	 * this case when making a decision regarding existence.
2185 	 */
2186 	} else {
2187 		error = nfs3lookup_otw(dvp, nm, &vp, cr, 0);
2188 	}
2189 	if (!error) {
2190 		if (exclusive == EXCL)
2191 			error = EEXIST;
2192 		else if (vp->v_type == VDIR && (mode & VWRITE))
2193 			error = EISDIR;
2194 		else {
2195 			/*
2196 			 * If vnode is a device, create special vnode.
2197 			 */
2198 			if (IS_DEVVP(vp)) {
2199 				tempvp = vp;
2200 				vp = specvp(vp, vp->v_rdev, vp->v_type, cr);
2201 				VN_RELE(tempvp);
2202 			}
2203 			if (!(error = VOP_ACCESS(vp, mode, 0, cr))) {
2204 				if ((vattr.va_mask & AT_SIZE) &&
2205 				    vp->v_type == VREG) {
2206 					rp = VTOR(vp);
2207 					/*
2208 					 * Check here for large file handled
2209 					 * by LF-unaware process (as
2210 					 * ufs_create() does)
2211 					 */
2212 					if (!(lfaware & FOFFMAX)) {
2213 						mutex_enter(&rp->r_statelock);
2214 						if (rp->r_size > MAXOFF32_T)
2215 							error = EOVERFLOW;
2216 						mutex_exit(&rp->r_statelock);
2217 					}
2218 					if (!error) {
2219 						vattr.va_mask = AT_SIZE;
2220 						error = nfs3setattr(vp,
2221 						    &vattr, 0, cr);
2222 					}
2223 				}
2224 			}
2225 		}
2226 		nfs_rw_exit(&drp->r_rwlock);
2227 		if (error) {
2228 			VN_RELE(vp);
2229 		} else {
2230 			/*
2231 			 * existing file got truncated, notify.
2232 			 */
2233 			vnevent_create(vp);
2234 			*vpp = vp;
2235 		}
2236 		return (error);
2237 	}
2238 
2239 	dnlc_remove(dvp, nm);
2240 
2241 	/*
2242 	 * Decide what the group-id of the created file should be.
2243 	 * Set it in attribute list as advisory...
2244 	 */
2245 	error = setdirgid(dvp, &vattr.va_gid, cr);
2246 	if (error) {
2247 		nfs_rw_exit(&drp->r_rwlock);
2248 		return (error);
2249 	}
2250 	vattr.va_mask |= AT_GID;
2251 
2252 	ASSERT(vattr.va_mask & AT_TYPE);
2253 	if (vattr.va_type == VREG) {
2254 		ASSERT(vattr.va_mask & AT_MODE);
2255 		if (MANDMODE(vattr.va_mode)) {
2256 			nfs_rw_exit(&drp->r_rwlock);
2257 			return (EACCES);
2258 		}
2259 		error = nfs3create(dvp, nm, &vattr, exclusive, mode, vpp, cr,
2260 		    lfaware);
2261 		/*
2262 		 * If this is not an exclusive create, then the CREATE
2263 		 * request will be made with the GUARDED mode set.  This
2264 		 * means that the server will return EEXIST if the file
2265 		 * exists.  The file could exist because of a retransmitted
2266 		 * request.  In this case, we recover by starting over and
2267 		 * checking to see whether the file exists.  This second
2268 		 * time through it should and a CREATE request will not be
2269 		 * sent.
2270 		 *
2271 		 * This handles the problem of a dangling CREATE request
2272 		 * which contains attributes which indicate that the file
2273 		 * should be truncated.  This retransmitted request could
2274 		 * possibly truncate valid data in the file if not caught
2275 		 * by the duplicate request mechanism on the server or if
2276 		 * not caught by other means.  The scenario is:
2277 		 *
2278 		 * Client transmits CREATE request with size = 0
2279 		 * Client times out, retransmits request.
2280 		 * Response to the first request arrives from the server
2281 		 *  and the client proceeds on.
2282 		 * Client writes data to the file.
2283 		 * The server now processes retransmitted CREATE request
2284 		 *  and truncates file.
2285 		 *
2286 		 * The use of the GUARDED CREATE request prevents this from
2287 		 * happening because the retransmitted CREATE would fail
2288 		 * with EEXIST and would not truncate the file.
2289 		 */
2290 		if (error == EEXIST && exclusive == NONEXCL) {
2291 #ifdef DEBUG
2292 			nfs3_create_misses++;
2293 #endif
2294 			goto top;
2295 		}
2296 		nfs_rw_exit(&drp->r_rwlock);
2297 		return (error);
2298 	}
2299 	error = nfs3mknod(dvp, nm, &vattr, exclusive, mode, vpp, cr);
2300 	nfs_rw_exit(&drp->r_rwlock);
2301 	return (error);
2302 }
2303 
2304 /* ARGSUSED */
2305 static int
2306 nfs3create(vnode_t *dvp, char *nm, struct vattr *va, enum vcexcl exclusive,
2307 	int mode, vnode_t **vpp, cred_t *cr, int lfaware)
2308 {
2309 	int error;
2310 	CREATE3args args;
2311 	CREATE3res res;
2312 	int douprintf;
2313 	vnode_t *vp;
2314 	struct vattr vattr;
2315 	nfstime3 *verfp;
2316 	rnode_t *rp;
2317 	timestruc_t now;
2318 	hrtime_t t;
2319 
2320 	ASSERT(nfs_zone() == VTOMI(dvp)->mi_zone);
2321 	setdiropargs3(&args.where, nm, dvp);
2322 	if (exclusive == EXCL) {
2323 		args.how.mode = EXCLUSIVE;
2324 		/*
2325 		 * Construct the create verifier.  This verifier needs
2326 		 * to be unique between different clients.  It also needs
2327 		 * to vary for each exclusive create request generated
2328 		 * from the client to the server.
2329 		 *
2330 		 * The first attempt is made to use the hostid and a
2331 		 * unique number on the client.  If the hostid has not
2332 		 * been set, the high resolution time that the exclusive
2333 		 * create request is being made is used.  This will work
2334 		 * unless two different clients, both with the hostid
2335 		 * not set, attempt an exclusive create request on the
2336 		 * same file, at exactly the same clock time.  The
2337 		 * chances of this happening seem small enough to be
2338 		 * reasonable.
2339 		 */
2340 		verfp = (nfstime3 *)&args.how.createhow3_u.verf;
2341 		verfp->seconds = nfs_atoi(hw_serial);
2342 		if (verfp->seconds != 0)
2343 			verfp->nseconds = newnum();
2344 		else {
2345 			gethrestime(&now);
2346 			verfp->seconds = now.tv_sec;
2347 			verfp->nseconds = now.tv_nsec;
2348 		}
2349 		/*
2350 		 * Since the server will use this value for the mtime,
2351 		 * make sure that it can't overflow. Zero out the MSB.
2352 		 * The actual value does not matter here, only its uniqeness.
2353 		 */
2354 		verfp->seconds %= INT32_MAX;
2355 	} else {
2356 		/*
2357 		 * Issue the non-exclusive create in guarded mode.  This
2358 		 * may result in some false EEXIST responses for
2359 		 * retransmitted requests, but these will be handled at
2360 		 * a higher level.  By using GUARDED, duplicate requests
2361 		 * to do file truncation and possible access problems
2362 		 * can be avoided.
2363 		 */
2364 		args.how.mode = GUARDED;
2365 		error = vattr_to_sattr3(va,
2366 				&args.how.createhow3_u.obj_attributes);
2367 		if (error) {
2368 			/* req time field(s) overflow - return immediately */
2369 			return (error);
2370 		}
2371 	}
2372 
2373 	douprintf = 1;
2374 
2375 	t = gethrtime();
2376 
2377 	error = rfs3call(VTOMI(dvp), NFSPROC3_CREATE,
2378 	    xdr_CREATE3args, (caddr_t)&args,
2379 	    xdr_CREATE3res, (caddr_t)&res, cr,
2380 	    &douprintf, &res.status, 0, NULL);
2381 
2382 	if (error) {
2383 		PURGE_ATTRCACHE(dvp);
2384 		return (error);
2385 	}
2386 
2387 	error = geterrno3(res.status);
2388 	if (!error) {
2389 		nfs3_cache_wcc_data(dvp, &res.resok.dir_wcc, t, cr);
2390 		if (HAVE_RDDIR_CACHE(VTOR(dvp)))
2391 			nfs_purge_rddir_cache(dvp);
2392 
2393 		/*
2394 		 * On exclusive create the times need to be explicitly
2395 		 * set to clear any potential verifier that may be stored
2396 		 * in one of these fields (see comment below).  This
2397 		 * is done here to cover the case where no post op attrs
2398 		 * were returned or a 'invalid' time was returned in
2399 		 * the attributes.
2400 		 */
2401 		if (exclusive == EXCL)
2402 			va->va_mask |= (AT_MTIME | AT_ATIME);
2403 
2404 		if (!res.resok.obj.handle_follows) {
2405 			error = nfs3lookup(dvp, nm, &vp, NULL, 0, NULL, cr, 0);
2406 			if (error)
2407 				return (error);
2408 		} else {
2409 			if (res.resok.obj_attributes.attributes) {
2410 				vp = makenfs3node(&res.resok.obj.handle,
2411 				    &res.resok.obj_attributes.attr,
2412 				    dvp->v_vfsp, t, cr, NULL, NULL);
2413 			} else {
2414 				vp = makenfs3node(&res.resok.obj.handle, NULL,
2415 				    dvp->v_vfsp, t, cr, NULL, NULL);
2416 
2417 				/*
2418 				 * On an exclusive create, it is possible
2419 				 * that attributes were returned but those
2420 				 * postop attributes failed to decode
2421 				 * properly.  If this is the case,
2422 				 * then most likely the atime or mtime
2423 				 * were invalid for our client; this
2424 				 * is caused by the server storing the
2425 				 * create verifier in one of the time
2426 				 * fields(most likely mtime).
2427 				 * So... we are going to setattr just the
2428 				 * atime/mtime to clear things up.
2429 				 */
2430 				if (exclusive == EXCL) {
2431 					if (error =
2432 						nfs3excl_create_settimes(vp,
2433 							va, cr)) {
2434 						/*
2435 						 * Setting the times failed.
2436 						 * Remove the file and return
2437 						 * the error.
2438 						 */
2439 						VN_RELE(vp);
2440 						(void) nfs3_remove(dvp,
2441 							nm, cr);
2442 						return (error);
2443 					}
2444 				}
2445 
2446 				/*
2447 				 * This handles the non-exclusive case
2448 				 * and the exclusive case where no post op
2449 				 * attrs were returned.
2450 				 */
2451 				if (vp->v_type == VNON) {
2452 					vattr.va_mask = AT_TYPE;
2453 					error = nfs3getattr(vp, &vattr, cr);
2454 					if (error) {
2455 						VN_RELE(vp);
2456 						return (error);
2457 					}
2458 					vp->v_type = vattr.va_type;
2459 				}
2460 			}
2461 			dnlc_update(dvp, nm, vp);
2462 		}
2463 
2464 		rp = VTOR(vp);
2465 
2466 		/*
2467 		 * Check here for large file handled by
2468 		 * LF-unaware process (as ufs_create() does)
2469 		 */
2470 		if ((va->va_mask & AT_SIZE) && vp->v_type == VREG &&
2471 		    !(lfaware & FOFFMAX)) {
2472 			mutex_enter(&rp->r_statelock);
2473 			if (rp->r_size > MAXOFF32_T) {
2474 				mutex_exit(&rp->r_statelock);
2475 				VN_RELE(vp);
2476 				return (EOVERFLOW);
2477 			}
2478 			mutex_exit(&rp->r_statelock);
2479 		}
2480 
2481 		if (exclusive == EXCL &&
2482 			(va->va_mask & ~(AT_GID | AT_SIZE))) {
2483 			/*
2484 			 * If doing an exclusive create, then generate
2485 			 * a SETATTR to set the initial attributes.
2486 			 * Try to set the mtime and the atime to the
2487 			 * server's current time.  It is somewhat
2488 			 * expected that these fields will be used to
2489 			 * store the exclusive create cookie.  If not,
2490 			 * server implementors will need to know that
2491 			 * a SETATTR will follow an exclusive create
2492 			 * and the cookie should be destroyed if
2493 			 * appropriate. This work may have been done
2494 			 * earlier in this function if post op attrs
2495 			 * were not available.
2496 			 *
2497 			 * The AT_GID and AT_SIZE bits are turned off
2498 			 * so that the SETATTR request will not attempt
2499 			 * to process these.  The gid will be set
2500 			 * separately if appropriate.  The size is turned
2501 			 * off because it is assumed that a new file will
2502 			 * be created empty and if the file wasn't empty,
2503 			 * then the exclusive create will have failed
2504 			 * because the file must have existed already.
2505 			 * Therefore, no truncate operation is needed.
2506 			 */
2507 			va->va_mask &= ~(AT_GID | AT_SIZE);
2508 			error = nfs3setattr(vp, va, 0, cr);
2509 			if (error) {
2510 				/*
2511 				 * Couldn't correct the attributes of
2512 				 * the newly created file and the
2513 				 * attributes are wrong.  Remove the
2514 				 * file and return an error to the
2515 				 * application.
2516 				 */
2517 				VN_RELE(vp);
2518 				(void) nfs3_remove(dvp, nm, cr);
2519 				return (error);
2520 			}
2521 		}
2522 
2523 		if (va->va_gid != rp->r_attr.va_gid) {
2524 			/*
2525 			 * If the gid on the file isn't right, then
2526 			 * generate a SETATTR to attempt to change
2527 			 * it.  This may or may not work, depending
2528 			 * upon the server's semantics for allowing
2529 			 * file ownership changes.
2530 			 */
2531 			va->va_mask = AT_GID;
2532 			(void) nfs3setattr(vp, va, 0, cr);
2533 		}
2534 
2535 		/*
2536 		 * If vnode is a device create special vnode
2537 		 */
2538 		if (IS_DEVVP(vp)) {
2539 			*vpp = specvp(vp, vp->v_rdev, vp->v_type, cr);
2540 			VN_RELE(vp);
2541 		} else
2542 			*vpp = vp;
2543 	} else {
2544 		nfs3_cache_wcc_data(dvp, &res.resfail.dir_wcc, t, cr);
2545 		PURGE_STALE_FH(error, dvp, cr);
2546 	}
2547 
2548 	return (error);
2549 }
2550 
2551 /*
2552  * Special setattr function to take care of rest of atime/mtime
2553  * after successful exclusive create.  This function exists to avoid
2554  * handling attributes from the server; exclusive the atime/mtime fields
2555  * may be 'invalid' in client's view and therefore can not be trusted.
2556  */
2557 static int
2558 nfs3excl_create_settimes(vnode_t *vp, struct vattr *vap, cred_t *cr)
2559 {
2560 	int error;
2561 	uint_t mask;
2562 	SETATTR3args args;
2563 	SETATTR3res res;
2564 	int douprintf;
2565 	rnode_t *rp;
2566 	hrtime_t t;
2567 
2568 	ASSERT(nfs_zone() == VTOMI(vp)->mi_zone);
2569 	/* save the caller's mask so that it can be reset later */
2570 	mask = vap->va_mask;
2571 
2572 	rp = VTOR(vp);
2573 
2574 	args.object = *RTOFH3(rp);
2575 	args.guard.check = FALSE;
2576 
2577 	/* Use the mask to initialize the arguments */
2578 	vap->va_mask = 0;
2579 	error = vattr_to_sattr3(vap, &args.new_attributes);
2580 
2581 	/* We want to set just atime/mtime on this request */
2582 	args.new_attributes.atime.set_it = SET_TO_SERVER_TIME;
2583 	args.new_attributes.mtime.set_it = SET_TO_SERVER_TIME;
2584 
2585 	douprintf = 1;
2586 
2587 	t = gethrtime();
2588 
2589 	error = rfs3call(VTOMI(vp), NFSPROC3_SETATTR,
2590 	    xdr_SETATTR3args, (caddr_t)&args,
2591 	    xdr_SETATTR3res, (caddr_t)&res, cr,
2592 	    &douprintf, &res.status, 0, NULL);
2593 
2594 	if (error) {
2595 		vap->va_mask = mask;
2596 		return (error);
2597 	}
2598 
2599 	error = geterrno3(res.status);
2600 	if (!error) {
2601 		/*
2602 		 * It is important to pick up the attributes.
2603 		 * Since this is the exclusive create path, the
2604 		 * attributes on the initial create were ignored
2605 		 * and we need these to have the correct info.
2606 		 */
2607 		nfs3_cache_wcc_data(vp, &res.resok.obj_wcc, t, cr);
2608 		/*
2609 		 * No need to do the atime/mtime work again so clear
2610 		 * the bits.
2611 		 */
2612 		mask &= ~(AT_ATIME | AT_MTIME);
2613 	} else {
2614 		nfs3_cache_wcc_data(vp, &res.resfail.obj_wcc, t, cr);
2615 	}
2616 
2617 	vap->va_mask = mask;
2618 
2619 	return (error);
2620 }
2621 
2622 /* ARGSUSED */
2623 static int
2624 nfs3mknod(vnode_t *dvp, char *nm, struct vattr *va, enum vcexcl exclusive,
2625 	int mode, vnode_t **vpp, cred_t *cr)
2626 {
2627 	int error;
2628 	MKNOD3args args;
2629 	MKNOD3res res;
2630 	int douprintf;
2631 	vnode_t *vp;
2632 	struct vattr vattr;
2633 	hrtime_t t;
2634 
2635 	ASSERT(nfs_zone() == VTOMI(dvp)->mi_zone);
2636 	switch (va->va_type) {
2637 	case VCHR:
2638 	case VBLK:
2639 		setdiropargs3(&args.where, nm, dvp);
2640 		args.what.type = (va->va_type == VCHR) ? NF3CHR : NF3BLK;
2641 		error = vattr_to_sattr3(va,
2642 		    &args.what.mknoddata3_u.device.dev_attributes);
2643 		if (error) {
2644 			/* req time field(s) overflow - return immediately */
2645 			return (error);
2646 		}
2647 		args.what.mknoddata3_u.device.spec.specdata1 =
2648 		    getmajor(va->va_rdev);
2649 		args.what.mknoddata3_u.device.spec.specdata2 =
2650 		    getminor(va->va_rdev);
2651 		break;
2652 
2653 	case VFIFO:
2654 	case VSOCK:
2655 		setdiropargs3(&args.where, nm, dvp);
2656 		args.what.type = (va->va_type == VFIFO) ? NF3FIFO : NF3SOCK;
2657 		error = vattr_to_sattr3(va,
2658 				&args.what.mknoddata3_u.pipe_attributes);
2659 		if (error) {
2660 			/* req time field(s) overflow - return immediately */
2661 			return (error);
2662 		}
2663 		break;
2664 
2665 	default:
2666 		return (EINVAL);
2667 	}
2668 
2669 	douprintf = 1;
2670 
2671 	t = gethrtime();
2672 
2673 	error = rfs3call(VTOMI(dvp), NFSPROC3_MKNOD,
2674 	    xdr_MKNOD3args, (caddr_t)&args,
2675 	    xdr_MKNOD3res, (caddr_t)&res, cr,
2676 	    &douprintf, &res.status, 0, NULL);
2677 
2678 	if (error) {
2679 		PURGE_ATTRCACHE(dvp);
2680 		return (error);
2681 	}
2682 
2683 	error = geterrno3(res.status);
2684 	if (!error) {
2685 		nfs3_cache_wcc_data(dvp, &res.resok.dir_wcc, t, cr);
2686 		if (HAVE_RDDIR_CACHE(VTOR(dvp)))
2687 			nfs_purge_rddir_cache(dvp);
2688 
2689 		if (!res.resok.obj.handle_follows) {
2690 			error = nfs3lookup(dvp, nm, &vp, NULL, 0, NULL, cr, 0);
2691 			if (error)
2692 				return (error);
2693 		} else {
2694 			if (res.resok.obj_attributes.attributes) {
2695 				vp = makenfs3node(&res.resok.obj.handle,
2696 				    &res.resok.obj_attributes.attr,
2697 				    dvp->v_vfsp, t, cr, NULL, NULL);
2698 			} else {
2699 				vp = makenfs3node(&res.resok.obj.handle, NULL,
2700 				    dvp->v_vfsp, t, cr, NULL, NULL);
2701 				if (vp->v_type == VNON) {
2702 					vattr.va_mask = AT_TYPE;
2703 					error = nfs3getattr(vp, &vattr, cr);
2704 					if (error) {
2705 						VN_RELE(vp);
2706 						return (error);
2707 					}
2708 					vp->v_type = vattr.va_type;
2709 				}
2710 
2711 			}
2712 			dnlc_update(dvp, nm, vp);
2713 		}
2714 
2715 		if (va->va_gid != VTOR(vp)->r_attr.va_gid) {
2716 			va->va_mask = AT_GID;
2717 			(void) nfs3setattr(vp, va, 0, cr);
2718 		}
2719 
2720 		/*
2721 		 * If vnode is a device create special vnode
2722 		 */
2723 		if (IS_DEVVP(vp)) {
2724 			*vpp = specvp(vp, vp->v_rdev, vp->v_type, cr);
2725 			VN_RELE(vp);
2726 		} else
2727 			*vpp = vp;
2728 	} else {
2729 		nfs3_cache_wcc_data(dvp, &res.resfail.dir_wcc, t, cr);
2730 		PURGE_STALE_FH(error, dvp, cr);
2731 	}
2732 	return (error);
2733 }
2734 
2735 /*
2736  * Weirdness: if the vnode to be removed is open
2737  * we rename it instead of removing it and nfs_inactive
2738  * will remove the new name.
2739  */
2740 static int
2741 nfs3_remove(vnode_t *dvp, char *nm, cred_t *cr)
2742 {
2743 	int error;
2744 	REMOVE3args args;
2745 	REMOVE3res res;
2746 	vnode_t *vp;
2747 	char *tmpname;
2748 	int douprintf;
2749 	rnode_t *rp;
2750 	rnode_t *drp;
2751 	hrtime_t t;
2752 
2753 	if (nfs_zone() != VTOMI(dvp)->mi_zone)
2754 		return (EPERM);
2755 	drp = VTOR(dvp);
2756 	if (nfs_rw_enter_sig(&drp->r_rwlock, RW_WRITER, INTR(dvp)))
2757 		return (EINTR);
2758 
2759 	error = nfs3lookup(dvp, nm, &vp, NULL, 0, NULL, cr, 0);
2760 	if (error) {
2761 		nfs_rw_exit(&drp->r_rwlock);
2762 		return (error);
2763 	}
2764 
2765 	if (vp->v_type == VDIR && secpolicy_fs_linkdir(cr, dvp->v_vfsp)) {
2766 		VN_RELE(vp);
2767 		nfs_rw_exit(&drp->r_rwlock);
2768 		return (EPERM);
2769 	}
2770 
2771 	/*
2772 	 * First just remove the entry from the name cache, as it
2773 	 * is most likely the only entry for this vp.
2774 	 */
2775 	dnlc_remove(dvp, nm);
2776 
2777 	/*
2778 	 * If the file has a v_count > 1 then there may be more than one
2779 	 * entry in the name cache due multiple links or an open file,
2780 	 * but we don't have the real reference count so flush all
2781 	 * possible entries.
2782 	 */
2783 	if (vp->v_count > 1)
2784 		dnlc_purge_vp(vp);
2785 
2786 	/*
2787 	 * Now we have the real reference count on the vnode
2788 	 */
2789 	rp = VTOR(vp);
2790 	mutex_enter(&rp->r_statelock);
2791 	if (vp->v_count > 1 &&
2792 	    (rp->r_unldvp == NULL || strcmp(nm, rp->r_unlname) == 0)) {
2793 		mutex_exit(&rp->r_statelock);
2794 		tmpname = newname();
2795 		error = nfs3rename(dvp, nm, dvp, tmpname, cr);
2796 		if (error)
2797 			kmem_free(tmpname, MAXNAMELEN);
2798 		else {
2799 			mutex_enter(&rp->r_statelock);
2800 			if (rp->r_unldvp == NULL) {
2801 				VN_HOLD(dvp);
2802 				rp->r_unldvp = dvp;
2803 				if (rp->r_unlcred != NULL)
2804 					crfree(rp->r_unlcred);
2805 				crhold(cr);
2806 				rp->r_unlcred = cr;
2807 				rp->r_unlname = tmpname;
2808 			} else {
2809 				kmem_free(rp->r_unlname, MAXNAMELEN);
2810 				rp->r_unlname = tmpname;
2811 			}
2812 			mutex_exit(&rp->r_statelock);
2813 		}
2814 	} else {
2815 		mutex_exit(&rp->r_statelock);
2816 		/*
2817 		 * We need to flush any dirty pages which happen to
2818 		 * be hanging around before removing the file.  This
2819 		 * shouldn't happen very often and mostly on file
2820 		 * systems mounted "nocto".
2821 		 */
2822 		if (vn_has_cached_data(vp) &&
2823 		    ((rp->r_flags & RDIRTY) || rp->r_count > 0)) {
2824 			error = nfs3_putpage(vp, (offset_t)0, 0, 0, cr);
2825 			if (error && (error == ENOSPC || error == EDQUOT)) {
2826 				mutex_enter(&rp->r_statelock);
2827 				if (!rp->r_error)
2828 					rp->r_error = error;
2829 				mutex_exit(&rp->r_statelock);
2830 			}
2831 		}
2832 
2833 		setdiropargs3(&args.object, nm, dvp);
2834 
2835 		douprintf = 1;
2836 
2837 		t = gethrtime();
2838 
2839 		error = rfs3call(VTOMI(dvp), NFSPROC3_REMOVE,
2840 		    xdr_diropargs3, (caddr_t)&args,
2841 		    xdr_REMOVE3res, (caddr_t)&res, cr,
2842 		    &douprintf, &res.status, 0, NULL);
2843 
2844 		/*
2845 		 * The xattr dir may be gone after last attr is removed,
2846 		 * so flush it from dnlc.
2847 		 */
2848 		if (dvp->v_flag & V_XATTRDIR)
2849 			dnlc_purge_vp(dvp);
2850 
2851 		PURGE_ATTRCACHE(vp);
2852 
2853 		if (error) {
2854 			PURGE_ATTRCACHE(dvp);
2855 		} else {
2856 			error = geterrno3(res.status);
2857 			if (!error) {
2858 				nfs3_cache_wcc_data(dvp, &res.resok.dir_wcc, t,
2859 				    cr);
2860 				if (HAVE_RDDIR_CACHE(drp))
2861 					nfs_purge_rddir_cache(dvp);
2862 			} else {
2863 				nfs3_cache_wcc_data(dvp, &res.resfail.dir_wcc,
2864 				    t, cr);
2865 				PURGE_STALE_FH(error, dvp, cr);
2866 			}
2867 		}
2868 	}
2869 
2870 	if (error == 0) {
2871 		vnevent_remove(vp, dvp, nm);
2872 	}
2873 	VN_RELE(vp);
2874 
2875 	nfs_rw_exit(&drp->r_rwlock);
2876 
2877 	return (error);
2878 }
2879 
2880 static int
2881 nfs3_link(vnode_t *tdvp, vnode_t *svp, char *tnm, cred_t *cr)
2882 {
2883 	int error;
2884 	LINK3args args;
2885 	LINK3res res;
2886 	vnode_t *realvp;
2887 	int douprintf;
2888 	mntinfo_t *mi;
2889 	rnode_t *tdrp;
2890 	hrtime_t t;
2891 
2892 	if (nfs_zone() != VTOMI(tdvp)->mi_zone)
2893 		return (EPERM);
2894 	if (VOP_REALVP(svp, &realvp) == 0)
2895 		svp = realvp;
2896 
2897 	mi = VTOMI(svp);
2898 
2899 	if (!(mi->mi_flags & MI_LINK))
2900 		return (EOPNOTSUPP);
2901 
2902 	args.file = *VTOFH3(svp);
2903 	setdiropargs3(&args.link, tnm, tdvp);
2904 
2905 	tdrp = VTOR(tdvp);
2906 	if (nfs_rw_enter_sig(&tdrp->r_rwlock, RW_WRITER, INTR(tdvp)))
2907 		return (EINTR);
2908 
2909 	dnlc_remove(tdvp, tnm);
2910 
2911 	douprintf = 1;
2912 
2913 	t = gethrtime();
2914 
2915 	error = rfs3call(mi, NFSPROC3_LINK,
2916 	    xdr_LINK3args, (caddr_t)&args,
2917 	    xdr_LINK3res, (caddr_t)&res, cr,
2918 	    &douprintf, &res.status, 0, NULL);
2919 
2920 	if (error) {
2921 		PURGE_ATTRCACHE(tdvp);
2922 		PURGE_ATTRCACHE(svp);
2923 		nfs_rw_exit(&tdrp->r_rwlock);
2924 		return (error);
2925 	}
2926 
2927 	error = geterrno3(res.status);
2928 
2929 	if (!error) {
2930 		nfs3_cache_post_op_attr(svp, &res.resok.file_attributes, t, cr);
2931 		nfs3_cache_wcc_data(tdvp, &res.resok.linkdir_wcc, t, cr);
2932 		if (HAVE_RDDIR_CACHE(tdrp))
2933 			nfs_purge_rddir_cache(tdvp);
2934 		dnlc_update(tdvp, tnm, svp);
2935 	} else {
2936 		nfs3_cache_post_op_attr(svp, &res.resfail.file_attributes, t,
2937 		    cr);
2938 		nfs3_cache_wcc_data(tdvp, &res.resfail.linkdir_wcc, t, cr);
2939 		if (error == EOPNOTSUPP) {
2940 			mutex_enter(&mi->mi_lock);
2941 			mi->mi_flags &= ~MI_LINK;
2942 			mutex_exit(&mi->mi_lock);
2943 		}
2944 	}
2945 
2946 	nfs_rw_exit(&tdrp->r_rwlock);
2947 
2948 	if (!error) {
2949 		/*
2950 		 * Notify the source file of this link operation.
2951 		 */
2952 		vnevent_link(svp);
2953 	}
2954 	return (error);
2955 }
2956 
2957 static int
2958 nfs3_rename(vnode_t *odvp, char *onm, vnode_t *ndvp, char *nnm, cred_t *cr)
2959 {
2960 	vnode_t *realvp;
2961 
2962 	if (nfs_zone() != VTOMI(odvp)->mi_zone)
2963 		return (EPERM);
2964 	if (VOP_REALVP(ndvp, &realvp) == 0)
2965 		ndvp = realvp;
2966 
2967 	return (nfs3rename(odvp, onm, ndvp, nnm, cr));
2968 }
2969 
2970 /*
2971  * nfs3rename does the real work of renaming in NFS Version 3.
2972  */
2973 static int
2974 nfs3rename(vnode_t *odvp, char *onm, vnode_t *ndvp, char *nnm, cred_t *cr)
2975 {
2976 	int error;
2977 	RENAME3args args;
2978 	RENAME3res res;
2979 	int douprintf;
2980 	vnode_t *nvp = NULL;
2981 	vnode_t *ovp = NULL;
2982 	char *tmpname;
2983 	rnode_t *rp;
2984 	rnode_t *odrp;
2985 	rnode_t *ndrp;
2986 	hrtime_t t;
2987 
2988 	ASSERT(nfs_zone() == VTOMI(odvp)->mi_zone);
2989 
2990 	if (strcmp(onm, ".") == 0 || strcmp(onm, "..") == 0 ||
2991 	    strcmp(nnm, ".") == 0 || strcmp(nnm, "..") == 0)
2992 		return (EINVAL);
2993 
2994 	odrp = VTOR(odvp);
2995 	ndrp = VTOR(ndvp);
2996 	if ((intptr_t)odrp < (intptr_t)ndrp) {
2997 		if (nfs_rw_enter_sig(&odrp->r_rwlock, RW_WRITER, INTR(odvp)))
2998 			return (EINTR);
2999 		if (nfs_rw_enter_sig(&ndrp->r_rwlock, RW_WRITER, INTR(ndvp))) {
3000 			nfs_rw_exit(&odrp->r_rwlock);
3001 			return (EINTR);
3002 		}
3003 	} else {
3004 		if (nfs_rw_enter_sig(&ndrp->r_rwlock, RW_WRITER, INTR(ndvp)))
3005 			return (EINTR);
3006 		if (nfs_rw_enter_sig(&odrp->r_rwlock, RW_WRITER, INTR(odvp))) {
3007 			nfs_rw_exit(&ndrp->r_rwlock);
3008 			return (EINTR);
3009 		}
3010 	}
3011 
3012 	/*
3013 	 * Lookup the target file.  If it exists, it needs to be
3014 	 * checked to see whether it is a mount point and whether
3015 	 * it is active (open).
3016 	 */
3017 	error = nfs3lookup(ndvp, nnm, &nvp, NULL, 0, NULL, cr, 0);
3018 	if (!error) {
3019 		/*
3020 		 * If this file has been mounted on, then just
3021 		 * return busy because renaming to it would remove
3022 		 * the mounted file system from the name space.
3023 		 */
3024 		if (vn_mountedvfs(nvp) != NULL) {
3025 			VN_RELE(nvp);
3026 			nfs_rw_exit(&odrp->r_rwlock);
3027 			nfs_rw_exit(&ndrp->r_rwlock);
3028 			return (EBUSY);
3029 		}
3030 
3031 		/*
3032 		 * Purge the name cache of all references to this vnode
3033 		 * so that we can check the reference count to infer
3034 		 * whether it is active or not.
3035 		 */
3036 		/*
3037 		 * First just remove the entry from the name cache, as it
3038 		 * is most likely the only entry for this vp.
3039 		 */
3040 		dnlc_remove(ndvp, nnm);
3041 		/*
3042 		 * If the file has a v_count > 1 then there may be more
3043 		 * than one entry in the name cache due multiple links
3044 		 * or an open file, but we don't have the real reference
3045 		 * count so flush all possible entries.
3046 		 */
3047 		if (nvp->v_count > 1)
3048 			dnlc_purge_vp(nvp);
3049 
3050 		/*
3051 		 * If the vnode is active and is not a directory,
3052 		 * arrange to rename it to a
3053 		 * temporary file so that it will continue to be
3054 		 * accessible.  This implements the "unlink-open-file"
3055 		 * semantics for the target of a rename operation.
3056 		 * Before doing this though, make sure that the
3057 		 * source and target files are not already the same.
3058 		 */
3059 		if (nvp->v_count > 1 && nvp->v_type != VDIR) {
3060 			/*
3061 			 * Lookup the source name.
3062 			 */
3063 			error = nfs3lookup(odvp, onm, &ovp, NULL, 0, NULL,
3064 			    cr, 0);
3065 
3066 			/*
3067 			 * The source name *should* already exist.
3068 			 */
3069 			if (error) {
3070 				VN_RELE(nvp);
3071 				nfs_rw_exit(&odrp->r_rwlock);
3072 				nfs_rw_exit(&ndrp->r_rwlock);
3073 				return (error);
3074 			}
3075 
3076 			/*
3077 			 * Compare the two vnodes.  If they are the same,
3078 			 * just release all held vnodes and return success.
3079 			 */
3080 			if (ovp == nvp) {
3081 				VN_RELE(ovp);
3082 				VN_RELE(nvp);
3083 				nfs_rw_exit(&odrp->r_rwlock);
3084 				nfs_rw_exit(&ndrp->r_rwlock);
3085 				return (0);
3086 			}
3087 
3088 			/*
3089 			 * Can't mix and match directories and non-
3090 			 * directories in rename operations.  We already
3091 			 * know that the target is not a directory.  If
3092 			 * the source is a directory, return an error.
3093 			 */
3094 			if (ovp->v_type == VDIR) {
3095 				VN_RELE(ovp);
3096 				VN_RELE(nvp);
3097 				nfs_rw_exit(&odrp->r_rwlock);
3098 				nfs_rw_exit(&ndrp->r_rwlock);
3099 				return (ENOTDIR);
3100 			}
3101 
3102 			/*
3103 			 * The target file exists, is not the same as
3104 			 * the source file, and is active.  Link it
3105 			 * to a temporary filename to avoid having
3106 			 * the server removing the file completely.
3107 			 */
3108 			tmpname = newname();
3109 			error = nfs3_link(ndvp, nvp, tmpname, cr);
3110 			if (error == EOPNOTSUPP) {
3111 				error = nfs3_rename(ndvp, nnm, ndvp, tmpname,
3112 				    cr);
3113 			}
3114 			if (error) {
3115 				kmem_free(tmpname, MAXNAMELEN);
3116 				VN_RELE(ovp);
3117 				VN_RELE(nvp);
3118 				nfs_rw_exit(&odrp->r_rwlock);
3119 				nfs_rw_exit(&ndrp->r_rwlock);
3120 				return (error);
3121 			}
3122 			rp = VTOR(nvp);
3123 			mutex_enter(&rp->r_statelock);
3124 			if (rp->r_unldvp == NULL) {
3125 				VN_HOLD(ndvp);
3126 				rp->r_unldvp = ndvp;
3127 				if (rp->r_unlcred != NULL)
3128 					crfree(rp->r_unlcred);
3129 				crhold(cr);
3130 				rp->r_unlcred = cr;
3131 				rp->r_unlname = tmpname;
3132 			} else {
3133 				kmem_free(rp->r_unlname, MAXNAMELEN);
3134 				rp->r_unlname = tmpname;
3135 			}
3136 			mutex_exit(&rp->r_statelock);
3137 		}
3138 	}
3139 
3140 	if (ovp == NULL) {
3141 		/*
3142 		 * When renaming directories to be a subdirectory of a
3143 		 * different parent, the dnlc entry for ".." will no
3144 		 * longer be valid, so it must be removed.
3145 		 *
3146 		 * We do a lookup here to determine whether we are renaming
3147 		 * a directory and we need to check if we are renaming
3148 		 * an unlinked file.  This might have already been done
3149 		 * in previous code, so we check ovp == NULL to avoid
3150 		 * doing it twice.
3151 		 */
3152 
3153 		error = nfs3lookup(odvp, onm, &ovp, NULL, 0, NULL, cr, 0);
3154 		/*
3155 		 * The source name *should* already exist.
3156 		 */
3157 		if (error) {
3158 			nfs_rw_exit(&odrp->r_rwlock);
3159 			nfs_rw_exit(&ndrp->r_rwlock);
3160 			if (nvp) {
3161 				VN_RELE(nvp);
3162 			}
3163 			return (error);
3164 		}
3165 		ASSERT(ovp != NULL);
3166 	}
3167 
3168 	dnlc_remove(odvp, onm);
3169 	dnlc_remove(ndvp, nnm);
3170 
3171 	setdiropargs3(&args.from, onm, odvp);
3172 	setdiropargs3(&args.to, nnm, ndvp);
3173 
3174 	douprintf = 1;
3175 
3176 	t = gethrtime();
3177 
3178 	error = rfs3call(VTOMI(odvp), NFSPROC3_RENAME,
3179 	    xdr_RENAME3args, (caddr_t)&args,
3180 	    xdr_RENAME3res, (caddr_t)&res, cr,
3181 	    &douprintf, &res.status, 0, NULL);
3182 
3183 	if (error) {
3184 		PURGE_ATTRCACHE(odvp);
3185 		PURGE_ATTRCACHE(ndvp);
3186 		VN_RELE(ovp);
3187 		nfs_rw_exit(&odrp->r_rwlock);
3188 		nfs_rw_exit(&ndrp->r_rwlock);
3189 		if (nvp) {
3190 			VN_RELE(nvp);
3191 		}
3192 		return (error);
3193 	}
3194 
3195 	error = geterrno3(res.status);
3196 
3197 	if (!error) {
3198 		nfs3_cache_wcc_data(odvp, &res.resok.fromdir_wcc, t, cr);
3199 		if (HAVE_RDDIR_CACHE(odrp))
3200 			nfs_purge_rddir_cache(odvp);
3201 		if (ndvp != odvp) {
3202 			nfs3_cache_wcc_data(ndvp, &res.resok.todir_wcc, t, cr);
3203 			if (HAVE_RDDIR_CACHE(ndrp))
3204 				nfs_purge_rddir_cache(ndvp);
3205 		}
3206 		/*
3207 		 * when renaming directories to be a subdirectory of a
3208 		 * different parent, the dnlc entry for ".." will no
3209 		 * longer be valid, so it must be removed
3210 		 */
3211 		rp = VTOR(ovp);
3212 		if (ndvp != odvp) {
3213 			if (ovp->v_type == VDIR) {
3214 				dnlc_remove(ovp, "..");
3215 				if (HAVE_RDDIR_CACHE(rp))
3216 					nfs_purge_rddir_cache(ovp);
3217 			}
3218 		}
3219 
3220 		/*
3221 		 * If we are renaming the unlinked file, update the
3222 		 * r_unldvp and r_unlname as needed.
3223 		 */
3224 		mutex_enter(&rp->r_statelock);
3225 		if (rp->r_unldvp != NULL) {
3226 			if (strcmp(rp->r_unlname, onm) == 0) {
3227 				(void) strncpy(rp->r_unlname, nnm, MAXNAMELEN);
3228 				rp->r_unlname[MAXNAMELEN - 1] = '\0';
3229 
3230 				if (ndvp != rp->r_unldvp) {
3231 					VN_RELE(rp->r_unldvp);
3232 					rp->r_unldvp = ndvp;
3233 					VN_HOLD(ndvp);
3234 				}
3235 			}
3236 		}
3237 		mutex_exit(&rp->r_statelock);
3238 	} else {
3239 		nfs3_cache_wcc_data(odvp, &res.resfail.fromdir_wcc, t, cr);
3240 		if (ndvp != odvp) {
3241 			nfs3_cache_wcc_data(ndvp, &res.resfail.todir_wcc, t,
3242 			    cr);
3243 		}
3244 		/*
3245 		 * System V defines rename to return EEXIST, not
3246 		 * ENOTEMPTY if the target directory is not empty.
3247 		 * Over the wire, the error is NFSERR_ENOTEMPTY
3248 		 * which geterrno maps to ENOTEMPTY.
3249 		 */
3250 		if (error == ENOTEMPTY)
3251 			error = EEXIST;
3252 	}
3253 
3254 	if (error == 0) {
3255 		if (nvp)
3256 			vnevent_rename_dest(nvp, ndvp, nnm);
3257 
3258 		if (odvp != ndvp)
3259 			vnevent_rename_dest_dir(ndvp);
3260 		ASSERT(ovp != NULL);
3261 		vnevent_rename_src(ovp, odvp, onm);
3262 	}
3263 
3264 	if (nvp) {
3265 		VN_RELE(nvp);
3266 	}
3267 	VN_RELE(ovp);
3268 
3269 	nfs_rw_exit(&odrp->r_rwlock);
3270 	nfs_rw_exit(&ndrp->r_rwlock);
3271 
3272 	return (error);
3273 }
3274 
3275 static int
3276 nfs3_mkdir(vnode_t *dvp, char *nm, struct vattr *va, vnode_t **vpp, cred_t *cr)
3277 {
3278 	int error;
3279 	MKDIR3args args;
3280 	MKDIR3res res;
3281 	int douprintf;
3282 	struct vattr vattr;
3283 	vnode_t *vp;
3284 	rnode_t *drp;
3285 	hrtime_t t;
3286 
3287 	if (nfs_zone() != VTOMI(dvp)->mi_zone)
3288 		return (EPERM);
3289 	setdiropargs3(&args.where, nm, dvp);
3290 
3291 	/*
3292 	 * Decide what the group-id and set-gid bit of the created directory
3293 	 * should be.  May have to do a setattr to get the gid right.
3294 	 */
3295 	error = setdirgid(dvp, &va->va_gid, cr);
3296 	if (error)
3297 		return (error);
3298 	error = setdirmode(dvp, &va->va_mode, cr);
3299 	if (error)
3300 		return (error);
3301 	va->va_mask |= AT_MODE|AT_GID;
3302 
3303 	error = vattr_to_sattr3(va, &args.attributes);
3304 	if (error) {
3305 		/* req time field(s) overflow - return immediately */
3306 		return (error);
3307 	}
3308 
3309 	drp = VTOR(dvp);
3310 	if (nfs_rw_enter_sig(&drp->r_rwlock, RW_WRITER, INTR(dvp)))
3311 		return (EINTR);
3312 
3313 	dnlc_remove(dvp, nm);
3314 
3315 	douprintf = 1;
3316 
3317 	t = gethrtime();
3318 
3319 	error = rfs3call(VTOMI(dvp), NFSPROC3_MKDIR,
3320 	    xdr_MKDIR3args, (caddr_t)&args,
3321 	    xdr_MKDIR3res, (caddr_t)&res, cr,
3322 	    &douprintf, &res.status, 0, NULL);
3323 
3324 	if (error) {
3325 		PURGE_ATTRCACHE(dvp);
3326 		nfs_rw_exit(&drp->r_rwlock);
3327 		return (error);
3328 	}
3329 
3330 	error = geterrno3(res.status);
3331 	if (!error) {
3332 		nfs3_cache_wcc_data(dvp, &res.resok.dir_wcc, t, cr);
3333 		if (HAVE_RDDIR_CACHE(drp))
3334 			nfs_purge_rddir_cache(dvp);
3335 
3336 		if (!res.resok.obj.handle_follows) {
3337 			error = nfs3lookup(dvp, nm, &vp, NULL, 0, NULL, cr, 0);
3338 			if (error) {
3339 				nfs_rw_exit(&drp->r_rwlock);
3340 				return (error);
3341 			}
3342 		} else {
3343 			if (res.resok.obj_attributes.attributes) {
3344 				vp = makenfs3node(&res.resok.obj.handle,
3345 				    &res.resok.obj_attributes.attr,
3346 				    dvp->v_vfsp, t, cr, NULL, NULL);
3347 			} else {
3348 				vp = makenfs3node(&res.resok.obj.handle, NULL,
3349 				    dvp->v_vfsp, t, cr, NULL, NULL);
3350 				if (vp->v_type == VNON) {
3351 					vattr.va_mask = AT_TYPE;
3352 					error = nfs3getattr(vp, &vattr, cr);
3353 					if (error) {
3354 						VN_RELE(vp);
3355 						nfs_rw_exit(&drp->r_rwlock);
3356 						return (error);
3357 					}
3358 					vp->v_type = vattr.va_type;
3359 				}
3360 			}
3361 			dnlc_update(dvp, nm, vp);
3362 		}
3363 		if (va->va_gid != VTOR(vp)->r_attr.va_gid) {
3364 			va->va_mask = AT_GID;
3365 			(void) nfs3setattr(vp, va, 0, cr);
3366 		}
3367 		*vpp = vp;
3368 	} else {
3369 		nfs3_cache_wcc_data(dvp, &res.resfail.dir_wcc, t, cr);
3370 		PURGE_STALE_FH(error, dvp, cr);
3371 	}
3372 
3373 	nfs_rw_exit(&drp->r_rwlock);
3374 
3375 	return (error);
3376 }
3377 
3378 static int
3379 nfs3_rmdir(vnode_t *dvp, char *nm, vnode_t *cdir, cred_t *cr)
3380 {
3381 	int error;
3382 	RMDIR3args args;
3383 	RMDIR3res res;
3384 	vnode_t *vp;
3385 	int douprintf;
3386 	rnode_t *drp;
3387 	hrtime_t t;
3388 
3389 	if (nfs_zone() != VTOMI(dvp)->mi_zone)
3390 		return (EPERM);
3391 	drp = VTOR(dvp);
3392 	if (nfs_rw_enter_sig(&drp->r_rwlock, RW_WRITER, INTR(dvp)))
3393 		return (EINTR);
3394 
3395 	/*
3396 	 * Attempt to prevent a rmdir(".") from succeeding.
3397 	 */
3398 	error = nfs3lookup(dvp, nm, &vp, NULL, 0, NULL, cr, 0);
3399 	if (error) {
3400 		nfs_rw_exit(&drp->r_rwlock);
3401 		return (error);
3402 	}
3403 
3404 	if (vp == cdir) {
3405 		VN_RELE(vp);
3406 		nfs_rw_exit(&drp->r_rwlock);
3407 		return (EINVAL);
3408 	}
3409 
3410 	setdiropargs3(&args.object, nm, dvp);
3411 
3412 	/*
3413 	 * First just remove the entry from the name cache, as it
3414 	 * is most likely an entry for this vp.
3415 	 */
3416 	dnlc_remove(dvp, nm);
3417 
3418 	/*
3419 	 * If there vnode reference count is greater than one, then
3420 	 * there may be additional references in the DNLC which will
3421 	 * need to be purged.  First, trying removing the entry for
3422 	 * the parent directory and see if that removes the additional
3423 	 * reference(s).  If that doesn't do it, then use dnlc_purge_vp
3424 	 * to completely remove any references to the directory which
3425 	 * might still exist in the DNLC.
3426 	 */
3427 	if (vp->v_count > 1) {
3428 		dnlc_remove(vp, "..");
3429 		if (vp->v_count > 1)
3430 			dnlc_purge_vp(vp);
3431 	}
3432 
3433 	douprintf = 1;
3434 
3435 	t = gethrtime();
3436 
3437 	error = rfs3call(VTOMI(dvp), NFSPROC3_RMDIR,
3438 	    xdr_diropargs3, (caddr_t)&args,
3439 	    xdr_RMDIR3res, (caddr_t)&res, cr,
3440 	    &douprintf, &res.status, 0, NULL);
3441 
3442 	PURGE_ATTRCACHE(vp);
3443 
3444 	if (error) {
3445 		PURGE_ATTRCACHE(dvp);
3446 		VN_RELE(vp);
3447 		nfs_rw_exit(&drp->r_rwlock);
3448 		return (error);
3449 	}
3450 
3451 	error = geterrno3(res.status);
3452 	if (!error) {
3453 		nfs3_cache_wcc_data(dvp, &res.resok.dir_wcc, t, cr);
3454 		if (HAVE_RDDIR_CACHE(drp))
3455 			nfs_purge_rddir_cache(dvp);
3456 		if (HAVE_RDDIR_CACHE(VTOR(vp)))
3457 			nfs_purge_rddir_cache(vp);
3458 	} else {
3459 		nfs3_cache_wcc_data(dvp, &res.resfail.dir_wcc, t, cr);
3460 		PURGE_STALE_FH(error, dvp, cr);
3461 		/*
3462 		 * System V defines rmdir to return EEXIST, not
3463 		 * ENOTEMPTY if the directory is not empty.  Over
3464 		 * the wire, the error is NFSERR_ENOTEMPTY which
3465 		 * geterrno maps to ENOTEMPTY.
3466 		 */
3467 		if (error == ENOTEMPTY)
3468 			error = EEXIST;
3469 	}
3470 
3471 	if (error == 0) {
3472 		vnevent_rmdir(vp, dvp, nm);
3473 	}
3474 	VN_RELE(vp);
3475 
3476 	nfs_rw_exit(&drp->r_rwlock);
3477 
3478 	return (error);
3479 }
3480 
3481 static int
3482 nfs3_symlink(vnode_t *dvp, char *lnm, struct vattr *tva, char *tnm, cred_t *cr)
3483 {
3484 	int error;
3485 	SYMLINK3args args;
3486 	SYMLINK3res res;
3487 	int douprintf;
3488 	mntinfo_t *mi;
3489 	vnode_t *vp;
3490 	rnode_t *rp;
3491 	char *contents;
3492 	rnode_t *drp;
3493 	hrtime_t t;
3494 
3495 	mi = VTOMI(dvp);
3496 
3497 	if (nfs_zone() != mi->mi_zone)
3498 		return (EPERM);
3499 	if (!(mi->mi_flags & MI_SYMLINK))
3500 		return (EOPNOTSUPP);
3501 
3502 	setdiropargs3(&args.where, lnm, dvp);
3503 	error = vattr_to_sattr3(tva, &args.symlink.symlink_attributes);
3504 	if (error) {
3505 		/* req time field(s) overflow - return immediately */
3506 		return (error);
3507 	}
3508 	args.symlink.symlink_data = tnm;
3509 
3510 	drp = VTOR(dvp);
3511 	if (nfs_rw_enter_sig(&drp->r_rwlock, RW_WRITER, INTR(dvp)))
3512 		return (EINTR);
3513 
3514 	dnlc_remove(dvp, lnm);
3515 
3516 	douprintf = 1;
3517 
3518 	t = gethrtime();
3519 
3520 	error = rfs3call(mi, NFSPROC3_SYMLINK,
3521 	    xdr_SYMLINK3args, (caddr_t)&args,
3522 	    xdr_SYMLINK3res, (caddr_t)&res, cr,
3523 	    &douprintf, &res.status, 0, NULL);
3524 
3525 	if (error) {
3526 		PURGE_ATTRCACHE(dvp);
3527 		nfs_rw_exit(&drp->r_rwlock);
3528 		return (error);
3529 	}
3530 
3531 	error = geterrno3(res.status);
3532 	if (!error) {
3533 		nfs3_cache_wcc_data(dvp, &res.resok.dir_wcc, t, cr);
3534 		if (HAVE_RDDIR_CACHE(drp))
3535 			nfs_purge_rddir_cache(dvp);
3536 
3537 		if (res.resok.obj.handle_follows) {
3538 			if (res.resok.obj_attributes.attributes) {
3539 				vp = makenfs3node(&res.resok.obj.handle,
3540 				    &res.resok.obj_attributes.attr,
3541 				    dvp->v_vfsp, t, cr, NULL, NULL);
3542 			} else {
3543 				vp = makenfs3node(&res.resok.obj.handle, NULL,
3544 				    dvp->v_vfsp, t, cr, NULL, NULL);
3545 				vp->v_type = VLNK;
3546 				vp->v_rdev = 0;
3547 			}
3548 			dnlc_update(dvp, lnm, vp);
3549 			rp = VTOR(vp);
3550 			if (nfs3_do_symlink_cache &&
3551 			    rp->r_symlink.contents == NULL) {
3552 
3553 				contents = kmem_alloc(MAXPATHLEN,
3554 				    KM_NOSLEEP);
3555 
3556 				if (contents != NULL) {
3557 					mutex_enter(&rp->r_statelock);
3558 					if (rp->r_symlink.contents == NULL) {
3559 						rp->r_symlink.len = strlen(tnm);
3560 						bcopy(tnm, contents,
3561 						    rp->r_symlink.len);
3562 						rp->r_symlink.contents =
3563 						    contents;
3564 						rp->r_symlink.size = MAXPATHLEN;
3565 						mutex_exit(&rp->r_statelock);
3566 					} else {
3567 						mutex_exit(&rp->r_statelock);
3568 						kmem_free((void *)contents,
3569 							    MAXPATHLEN);
3570 					}
3571 				}
3572 			}
3573 			VN_RELE(vp);
3574 		}
3575 	} else {
3576 		nfs3_cache_wcc_data(dvp, &res.resfail.dir_wcc, t, cr);
3577 		PURGE_STALE_FH(error, dvp, cr);
3578 		if (error == EOPNOTSUPP) {
3579 			mutex_enter(&mi->mi_lock);
3580 			mi->mi_flags &= ~MI_SYMLINK;
3581 			mutex_exit(&mi->mi_lock);
3582 		}
3583 	}
3584 
3585 	nfs_rw_exit(&drp->r_rwlock);
3586 
3587 	return (error);
3588 }
3589 
3590 #ifdef DEBUG
3591 static int nfs3_readdir_cache_hits = 0;
3592 static int nfs3_readdir_cache_shorts = 0;
3593 static int nfs3_readdir_cache_waits = 0;
3594 static int nfs3_readdir_cache_misses = 0;
3595 static int nfs3_readdir_readahead = 0;
3596 #endif
3597 
3598 static int nfs3_shrinkreaddir = 0;
3599 
3600 /*
3601  * Read directory entries.
3602  * There are some weird things to look out for here.  The uio_loffset
3603  * field is either 0 or it is the offset returned from a previous
3604  * readdir.  It is an opaque value used by the server to find the
3605  * correct directory block to read. The count field is the number
3606  * of blocks to read on the server.  This is advisory only, the server
3607  * may return only one block's worth of entries.  Entries may be compressed
3608  * on the server.
3609  */
3610 static int
3611 nfs3_readdir(vnode_t *vp, struct uio *uiop, cred_t *cr, int *eofp)
3612 {
3613 	int error;
3614 	size_t count;
3615 	rnode_t *rp;
3616 	rddir_cache *rdc;
3617 	rddir_cache *nrdc;
3618 	rddir_cache *rrdc;
3619 #ifdef DEBUG
3620 	int missed;
3621 #endif
3622 	int doreadahead;
3623 	rddir_cache srdc;
3624 	avl_index_t where;
3625 
3626 	if (nfs_zone() != VTOMI(vp)->mi_zone)
3627 		return (EIO);
3628 	rp = VTOR(vp);
3629 
3630 	ASSERT(nfs_rw_lock_held(&rp->r_rwlock, RW_READER));
3631 
3632 	/*
3633 	 * Make sure that the directory cache is valid.
3634 	 */
3635 	if (HAVE_RDDIR_CACHE(rp)) {
3636 		if (nfs_disable_rddir_cache) {
3637 			/*
3638 			 * Setting nfs_disable_rddir_cache in /etc/system
3639 			 * allows interoperability with servers that do not
3640 			 * properly update the attributes of directories.
3641 			 * Any cached information gets purged before an
3642 			 * access is made to it.
3643 			 */
3644 			nfs_purge_rddir_cache(vp);
3645 		} else {
3646 			error = nfs3_validate_caches(vp, cr);
3647 			if (error)
3648 				return (error);
3649 		}
3650 	}
3651 
3652 	/*
3653 	 * It is possible that some servers may not be able to correctly
3654 	 * handle a large READDIR or READDIRPLUS request due to bugs in
3655 	 * their implementation.  In order to continue to interoperate
3656 	 * with them, this workaround is provided to limit the maximum
3657 	 * size of a READDIRPLUS request to 1024.  In any case, the request
3658 	 * size is limited to MAXBSIZE.
3659 	 */
3660 	count = MIN(uiop->uio_iov->iov_len,
3661 	    nfs3_shrinkreaddir ? 1024 : MAXBSIZE);
3662 
3663 	nrdc = NULL;
3664 #ifdef DEBUG
3665 	missed = 0;
3666 #endif
3667 top:
3668 	/*
3669 	 * Short circuit last readdir which always returns 0 bytes.
3670 	 * This can be done after the directory has been read through
3671 	 * completely at least once.  This will set r_direof which
3672 	 * can be used to find the value of the last cookie.
3673 	 */
3674 	mutex_enter(&rp->r_statelock);
3675 	if (rp->r_direof != NULL &&
3676 	    uiop->uio_loffset == rp->r_direof->nfs3_ncookie) {
3677 		mutex_exit(&rp->r_statelock);
3678 #ifdef DEBUG
3679 		nfs3_readdir_cache_shorts++;
3680 #endif
3681 		if (eofp)
3682 			*eofp = 1;
3683 		if (nrdc != NULL)
3684 			rddir_cache_rele(nrdc);
3685 		return (0);
3686 	}
3687 	/*
3688 	 * Look for a cache entry.  Cache entries are identified
3689 	 * by the NFS cookie value and the byte count requested.
3690 	 */
3691 	srdc.nfs3_cookie = uiop->uio_loffset;
3692 	srdc.buflen = count;
3693 	rdc = avl_find(&rp->r_dir, &srdc, &where);
3694 	if (rdc != NULL) {
3695 		rddir_cache_hold(rdc);
3696 		/*
3697 		 * If the cache entry is in the process of being
3698 		 * filled in, wait until this completes.  The
3699 		 * RDDIRWAIT bit is set to indicate that someone
3700 		 * is waiting and then the thread currently
3701 		 * filling the entry is done, it should do a
3702 		 * cv_broadcast to wakeup all of the threads
3703 		 * waiting for it to finish.
3704 		 */
3705 		if (rdc->flags & RDDIR) {
3706 			nfs_rw_exit(&rp->r_rwlock);
3707 			rdc->flags |= RDDIRWAIT;
3708 #ifdef DEBUG
3709 			nfs3_readdir_cache_waits++;
3710 #endif
3711 			if (!cv_wait_sig(&rdc->cv, &rp->r_statelock)) {
3712 				/*
3713 				 * We got interrupted, probably
3714 				 * the user typed ^C or an alarm
3715 				 * fired.  We free the new entry
3716 				 * if we allocated one.
3717 				 */
3718 				mutex_exit(&rp->r_statelock);
3719 				(void) nfs_rw_enter_sig(&rp->r_rwlock,
3720 					RW_READER, FALSE);
3721 				rddir_cache_rele(rdc);
3722 				if (nrdc != NULL)
3723 					rddir_cache_rele(nrdc);
3724 				return (EINTR);
3725 			}
3726 			mutex_exit(&rp->r_statelock);
3727 			(void) nfs_rw_enter_sig(&rp->r_rwlock,
3728 				RW_READER, FALSE);
3729 			rddir_cache_rele(rdc);
3730 			goto top;
3731 		}
3732 		/*
3733 		 * Check to see if a readdir is required to
3734 		 * fill the entry.  If so, mark this entry
3735 		 * as being filled, remove our reference,
3736 		 * and branch to the code to fill the entry.
3737 		 */
3738 		if (rdc->flags & RDDIRREQ) {
3739 			rdc->flags &= ~RDDIRREQ;
3740 			rdc->flags |= RDDIR;
3741 			if (nrdc != NULL)
3742 				rddir_cache_rele(nrdc);
3743 			nrdc = rdc;
3744 			mutex_exit(&rp->r_statelock);
3745 			goto bottom;
3746 		}
3747 #ifdef DEBUG
3748 		if (!missed)
3749 			nfs3_readdir_cache_hits++;
3750 #endif
3751 		/*
3752 		 * If an error occurred while attempting
3753 		 * to fill the cache entry, just return it.
3754 		 */
3755 		if (rdc->error) {
3756 			error = rdc->error;
3757 			mutex_exit(&rp->r_statelock);
3758 			rddir_cache_rele(rdc);
3759 			if (nrdc != NULL)
3760 				rddir_cache_rele(nrdc);
3761 			return (error);
3762 		}
3763 
3764 		/*
3765 		 * The cache entry is complete and good,
3766 		 * copyout the dirent structs to the calling
3767 		 * thread.
3768 		 */
3769 		error = uiomove(rdc->entries, rdc->entlen, UIO_READ, uiop);
3770 
3771 		/*
3772 		 * If no error occurred during the copyout,
3773 		 * update the offset in the uio struct to
3774 		 * contain the value of the next cookie
3775 		 * and set the eof value appropriately.
3776 		 */
3777 		if (!error) {
3778 			uiop->uio_loffset = rdc->nfs3_ncookie;
3779 			if (eofp)
3780 				*eofp = rdc->eof;
3781 		}
3782 
3783 		/*
3784 		 * Decide whether to do readahead.
3785 		 *
3786 		 * Don't if have already read to the end of
3787 		 * directory.  There is nothing more to read.
3788 		 *
3789 		 * Don't if the application is not doing
3790 		 * lookups in the directory.  The readahead
3791 		 * is only effective if the application can
3792 		 * be doing work while an async thread is
3793 		 * handling the over the wire request.
3794 		 */
3795 		if (rdc->eof) {
3796 			rp->r_direof = rdc;
3797 			doreadahead = FALSE;
3798 		} else if (!(rp->r_flags & RLOOKUP))
3799 			doreadahead = FALSE;
3800 		else
3801 			doreadahead = TRUE;
3802 
3803 		if (!doreadahead) {
3804 			mutex_exit(&rp->r_statelock);
3805 			rddir_cache_rele(rdc);
3806 			if (nrdc != NULL)
3807 				rddir_cache_rele(nrdc);
3808 			return (error);
3809 		}
3810 
3811 		/*
3812 		 * Check to see whether we found an entry
3813 		 * for the readahead.  If so, we don't need
3814 		 * to do anything further, so free the new
3815 		 * entry if one was allocated.  Otherwise,
3816 		 * allocate a new entry, add it to the cache,
3817 		 * and then initiate an asynchronous readdir
3818 		 * operation to fill it.
3819 		 */
3820 		srdc.nfs3_cookie = rdc->nfs3_ncookie;
3821 		srdc.buflen = count;
3822 		rrdc = avl_find(&rp->r_dir, &srdc, &where);
3823 		if (rrdc != NULL) {
3824 			if (nrdc != NULL)
3825 				rddir_cache_rele(nrdc);
3826 		} else {
3827 			if (nrdc != NULL)
3828 				rrdc = nrdc;
3829 			else {
3830 				rrdc = rddir_cache_alloc(KM_NOSLEEP);
3831 			}
3832 			if (rrdc != NULL) {
3833 				rrdc->nfs3_cookie = rdc->nfs3_ncookie;
3834 				rrdc->buflen = count;
3835 				avl_insert(&rp->r_dir, rrdc, where);
3836 				rddir_cache_hold(rrdc);
3837 				mutex_exit(&rp->r_statelock);
3838 				rddir_cache_rele(rdc);
3839 #ifdef DEBUG
3840 				nfs3_readdir_readahead++;
3841 #endif
3842 				nfs_async_readdir(vp, rrdc, cr, do_nfs3readdir);
3843 				return (error);
3844 			}
3845 		}
3846 
3847 		mutex_exit(&rp->r_statelock);
3848 		rddir_cache_rele(rdc);
3849 		return (error);
3850 	}
3851 
3852 	/*
3853 	 * Didn't find an entry in the cache.  Construct a new empty
3854 	 * entry and link it into the cache.  Other processes attempting
3855 	 * to access this entry will need to wait until it is filled in.
3856 	 *
3857 	 * Since kmem_alloc may block, another pass through the cache
3858 	 * will need to be taken to make sure that another process
3859 	 * hasn't already added an entry to the cache for this request.
3860 	 */
3861 	if (nrdc == NULL) {
3862 		mutex_exit(&rp->r_statelock);
3863 		nrdc = rddir_cache_alloc(KM_SLEEP);
3864 		nrdc->nfs3_cookie = uiop->uio_loffset;
3865 		nrdc->buflen = count;
3866 		goto top;
3867 	}
3868 
3869 	/*
3870 	 * Add this entry to the cache.
3871 	 */
3872 	avl_insert(&rp->r_dir, nrdc, where);
3873 	rddir_cache_hold(nrdc);
3874 	mutex_exit(&rp->r_statelock);
3875 
3876 bottom:
3877 #ifdef DEBUG
3878 	missed = 1;
3879 	nfs3_readdir_cache_misses++;
3880 #endif
3881 	/*
3882 	 * Do the readdir.  This routine decides whether to use
3883 	 * READDIR or READDIRPLUS.
3884 	 */
3885 	error = do_nfs3readdir(vp, nrdc, cr);
3886 
3887 	/*
3888 	 * If this operation failed, just return the error which occurred.
3889 	 */
3890 	if (error != 0)
3891 		return (error);
3892 
3893 	/*
3894 	 * Since the RPC operation will have taken sometime and blocked
3895 	 * this process, another pass through the cache will need to be
3896 	 * taken to find the correct cache entry.  It is possible that
3897 	 * the correct cache entry will not be there (although one was
3898 	 * added) because the directory changed during the RPC operation
3899 	 * and the readdir cache was flushed.  In this case, just start
3900 	 * over.  It is hoped that this will not happen too often... :-)
3901 	 */
3902 	nrdc = NULL;
3903 	goto top;
3904 	/* NOTREACHED */
3905 }
3906 
3907 static int
3908 do_nfs3readdir(vnode_t *vp, rddir_cache *rdc, cred_t *cr)
3909 {
3910 	int error;
3911 	rnode_t *rp;
3912 	mntinfo_t *mi;
3913 
3914 	rp = VTOR(vp);
3915 	mi = VTOMI(vp);
3916 	ASSERT(nfs_zone() == mi->mi_zone);
3917 	/*
3918 	 * Issue the proper request.
3919 	 *
3920 	 * If the server does not support READDIRPLUS, then use READDIR.
3921 	 *
3922 	 * Otherwise --
3923 	 * Issue a READDIRPLUS if reading to fill an empty cache or if
3924 	 * an application has performed a lookup in the directory which
3925 	 * required an over the wire lookup.  The use of READDIRPLUS
3926 	 * will help to (re)populate the DNLC.
3927 	 */
3928 	if (!(mi->mi_flags & MI_READDIRONLY) &&
3929 	    (rp->r_flags & (RLOOKUP | RREADDIRPLUS))) {
3930 		if (rp->r_flags & RREADDIRPLUS) {
3931 			mutex_enter(&rp->r_statelock);
3932 			rp->r_flags &= ~RREADDIRPLUS;
3933 			mutex_exit(&rp->r_statelock);
3934 		}
3935 		nfs3readdirplus(vp, rdc, cr);
3936 		if (rdc->error == EOPNOTSUPP)
3937 			nfs3readdir(vp, rdc, cr);
3938 	} else
3939 		nfs3readdir(vp, rdc, cr);
3940 
3941 	mutex_enter(&rp->r_statelock);
3942 	rdc->flags &= ~RDDIR;
3943 	if (rdc->flags & RDDIRWAIT) {
3944 		rdc->flags &= ~RDDIRWAIT;
3945 		cv_broadcast(&rdc->cv);
3946 	}
3947 	error = rdc->error;
3948 	if (error)
3949 		rdc->flags |= RDDIRREQ;
3950 	mutex_exit(&rp->r_statelock);
3951 
3952 	rddir_cache_rele(rdc);
3953 
3954 	return (error);
3955 }
3956 
3957 static void
3958 nfs3readdir(vnode_t *vp, rddir_cache *rdc, cred_t *cr)
3959 {
3960 	int error;
3961 	READDIR3args args;
3962 	READDIR3vres res;
3963 	vattr_t dva;
3964 	rnode_t *rp;
3965 	int douprintf;
3966 	failinfo_t fi, *fip = NULL;
3967 	mntinfo_t *mi;
3968 	hrtime_t t;
3969 
3970 	rp = VTOR(vp);
3971 	mi = VTOMI(vp);
3972 	ASSERT(nfs_zone() == mi->mi_zone);
3973 
3974 	args.dir = *RTOFH3(rp);
3975 	args.cookie = (cookie3)rdc->nfs3_cookie;
3976 	args.cookieverf = rp->r_cookieverf;
3977 	args.count = rdc->buflen;
3978 
3979 	/*
3980 	 * NFS client failover support
3981 	 * suppress failover unless we have a zero cookie
3982 	 */
3983 	if (args.cookie == (cookie3) 0) {
3984 		fi.vp = vp;
3985 		fi.fhp = (caddr_t)&args.dir;
3986 		fi.copyproc = nfs3copyfh;
3987 		fi.lookupproc = nfs3lookup;
3988 		fi.xattrdirproc = acl_getxattrdir3;
3989 		fip = &fi;
3990 	}
3991 
3992 #ifdef DEBUG
3993 	rdc->entries = rddir_cache_buf_alloc(rdc->buflen, KM_SLEEP);
3994 #else
3995 	rdc->entries = kmem_alloc(rdc->buflen, KM_SLEEP);
3996 #endif
3997 
3998 	res.entries = (dirent64_t *)rdc->entries;
3999 	res.entries_size = rdc->buflen;
4000 	res.dir_attributes.fres.vap = &dva;
4001 	res.dir_attributes.fres.vp = vp;
4002 	res.loff = rdc->nfs3_cookie;
4003 
4004 	douprintf = 1;
4005 
4006 	if (mi->mi_io_kstats) {
4007 		mutex_enter(&mi->mi_lock);
4008 		kstat_runq_enter(KSTAT_IO_PTR(mi->mi_io_kstats));
4009 		mutex_exit(&mi->mi_lock);
4010 	}
4011 
4012 	t = gethrtime();
4013 
4014 	error = rfs3call(VTOMI(vp), NFSPROC3_READDIR,
4015 	    xdr_READDIR3args, (caddr_t)&args,
4016 	    xdr_READDIR3vres, (caddr_t)&res, cr,
4017 	    &douprintf, &res.status, 0, fip);
4018 
4019 	if (mi->mi_io_kstats) {
4020 		mutex_enter(&mi->mi_lock);
4021 		kstat_runq_exit(KSTAT_IO_PTR(mi->mi_io_kstats));
4022 		mutex_exit(&mi->mi_lock);
4023 	}
4024 
4025 	if (error)
4026 		goto err;
4027 
4028 	nfs3_cache_post_op_vattr(vp, &res.dir_attributes, t, cr);
4029 
4030 	error = geterrno3(res.status);
4031 	if (error) {
4032 		PURGE_STALE_FH(error, vp, cr);
4033 		goto err;
4034 	}
4035 
4036 	if (mi->mi_io_kstats) {
4037 		mutex_enter(&mi->mi_lock);
4038 		KSTAT_IO_PTR(mi->mi_io_kstats)->reads++;
4039 		KSTAT_IO_PTR(mi->mi_io_kstats)->nread += res.size;
4040 		mutex_exit(&mi->mi_lock);
4041 	}
4042 
4043 	rdc->nfs3_ncookie = res.loff;
4044 	rp->r_cookieverf = res.cookieverf;
4045 	rdc->eof = res.eof ? 1 : 0;
4046 	rdc->entlen = res.size;
4047 	ASSERT(rdc->entlen <= rdc->buflen);
4048 	rdc->error = 0;
4049 	return;
4050 
4051 err:
4052 	kmem_free(rdc->entries, rdc->buflen);
4053 	rdc->entries = NULL;
4054 	rdc->error = error;
4055 }
4056 
4057 /*
4058  * Read directory entries.
4059  * There are some weird things to look out for here.  The uio_loffset
4060  * field is either 0 or it is the offset returned from a previous
4061  * readdir.  It is an opaque value used by the server to find the
4062  * correct directory block to read. The count field is the number
4063  * of blocks to read on the server.  This is advisory only, the server
4064  * may return only one block's worth of entries.  Entries may be compressed
4065  * on the server.
4066  */
4067 static void
4068 nfs3readdirplus(vnode_t *vp, rddir_cache *rdc, cred_t *cr)
4069 {
4070 	int error;
4071 	READDIRPLUS3args args;
4072 	READDIRPLUS3vres res;
4073 	vattr_t dva;
4074 	rnode_t *rp;
4075 	mntinfo_t *mi;
4076 	int douprintf;
4077 	failinfo_t fi, *fip = NULL;
4078 
4079 	rp = VTOR(vp);
4080 	mi = VTOMI(vp);
4081 	ASSERT(nfs_zone() == mi->mi_zone);
4082 
4083 	args.dir = *RTOFH3(rp);
4084 	args.cookie = (cookie3)rdc->nfs3_cookie;
4085 	args.cookieverf = rp->r_cookieverf;
4086 	args.dircount = rdc->buflen;
4087 	args.maxcount = mi->mi_tsize;
4088 
4089 	/*
4090 	 * NFS client failover support
4091 	 * suppress failover unless we have a zero cookie
4092 	 */
4093 	if (args.cookie == (cookie3)0) {
4094 		fi.vp = vp;
4095 		fi.fhp = (caddr_t)&args.dir;
4096 		fi.copyproc = nfs3copyfh;
4097 		fi.lookupproc = nfs3lookup;
4098 		fi.xattrdirproc = acl_getxattrdir3;
4099 		fip = &fi;
4100 	}
4101 
4102 #ifdef DEBUG
4103 	rdc->entries = rddir_cache_buf_alloc(rdc->buflen, KM_SLEEP);
4104 #else
4105 	rdc->entries = kmem_alloc(rdc->buflen, KM_SLEEP);
4106 #endif
4107 
4108 	res.entries = (dirent64_t *)rdc->entries;
4109 	res.entries_size = rdc->buflen;
4110 	res.dir_attributes.fres.vap = &dva;
4111 	res.dir_attributes.fres.vp = vp;
4112 	res.loff = rdc->nfs3_cookie;
4113 	res.credentials = cr;
4114 
4115 	douprintf = 1;
4116 
4117 	if (mi->mi_io_kstats) {
4118 		mutex_enter(&mi->mi_lock);
4119 		kstat_runq_enter(KSTAT_IO_PTR(mi->mi_io_kstats));
4120 		mutex_exit(&mi->mi_lock);
4121 	}
4122 
4123 	res.time = gethrtime();
4124 
4125 	error = rfs3call(mi, NFSPROC3_READDIRPLUS,
4126 	    xdr_READDIRPLUS3args, (caddr_t)&args,
4127 	    xdr_READDIRPLUS3vres, (caddr_t)&res, cr,
4128 	    &douprintf, &res.status, 0, fip);
4129 
4130 	if (mi->mi_io_kstats) {
4131 		mutex_enter(&mi->mi_lock);
4132 		kstat_runq_exit(KSTAT_IO_PTR(mi->mi_io_kstats));
4133 		mutex_exit(&mi->mi_lock);
4134 	}
4135 
4136 	if (error) {
4137 		goto err;
4138 	}
4139 
4140 	nfs3_cache_post_op_vattr(vp, &res.dir_attributes, res.time, cr);
4141 
4142 	error = geterrno3(res.status);
4143 	if (error) {
4144 		PURGE_STALE_FH(error, vp, cr);
4145 		if (error == EOPNOTSUPP) {
4146 			mutex_enter(&mi->mi_lock);
4147 			mi->mi_flags |= MI_READDIRONLY;
4148 			mutex_exit(&mi->mi_lock);
4149 		}
4150 		goto err;
4151 	}
4152 
4153 	if (mi->mi_io_kstats) {
4154 		mutex_enter(&mi->mi_lock);
4155 		KSTAT_IO_PTR(mi->mi_io_kstats)->reads++;
4156 		KSTAT_IO_PTR(mi->mi_io_kstats)->nread += res.size;
4157 		mutex_exit(&mi->mi_lock);
4158 	}
4159 
4160 	rdc->nfs3_ncookie = res.loff;
4161 	rp->r_cookieverf = res.cookieverf;
4162 	rdc->eof = res.eof ? 1 : 0;
4163 	rdc->entlen = res.size;
4164 	ASSERT(rdc->entlen <= rdc->buflen);
4165 	rdc->error = 0;
4166 
4167 	return;
4168 
4169 err:
4170 	kmem_free(rdc->entries, rdc->buflen);
4171 	rdc->entries = NULL;
4172 	rdc->error = error;
4173 }
4174 
4175 #ifdef DEBUG
4176 static int nfs3_bio_do_stop = 0;
4177 #endif
4178 
4179 static int
4180 nfs3_bio(struct buf *bp, stable_how *stab_comm, cred_t *cr)
4181 {
4182 	rnode_t *rp = VTOR(bp->b_vp);
4183 	int count;
4184 	int error;
4185 	cred_t *cred;
4186 	offset_t offset;
4187 
4188 	ASSERT(nfs_zone() == VTOMI(bp->b_vp)->mi_zone);
4189 	offset = ldbtob(bp->b_lblkno);
4190 
4191 	DTRACE_IO1(start, struct buf *, bp);
4192 
4193 	if (bp->b_flags & B_READ) {
4194 		mutex_enter(&rp->r_statelock);
4195 		if (rp->r_cred != NULL) {
4196 			cred = rp->r_cred;
4197 			crhold(cred);
4198 		} else {
4199 			rp->r_cred = cr;
4200 			crhold(cr);
4201 			cred = cr;
4202 			crhold(cred);
4203 		}
4204 		mutex_exit(&rp->r_statelock);
4205 	read_again:
4206 		error = bp->b_error = nfs3read(bp->b_vp, bp->b_un.b_addr,
4207 		    offset, bp->b_bcount, &bp->b_resid, cred);
4208 		crfree(cred);
4209 		if (!error) {
4210 			if (bp->b_resid) {
4211 				/*
4212 				 * Didn't get it all because we hit EOF,
4213 				 * zero all the memory beyond the EOF.
4214 				 */
4215 				/* bzero(rdaddr + */
4216 				bzero(bp->b_un.b_addr +
4217 				    bp->b_bcount - bp->b_resid, bp->b_resid);
4218 			}
4219 			mutex_enter(&rp->r_statelock);
4220 			if (bp->b_resid == bp->b_bcount &&
4221 			    offset >= rp->r_size) {
4222 				/*
4223 				 * We didn't read anything at all as we are
4224 				 * past EOF.  Return an error indicator back
4225 				 * but don't destroy the pages (yet).
4226 				 */
4227 				error = NFS_EOF;
4228 			}
4229 			mutex_exit(&rp->r_statelock);
4230 		} else if (error == EACCES) {
4231 			mutex_enter(&rp->r_statelock);
4232 			if (cred != cr) {
4233 				if (rp->r_cred != NULL)
4234 					crfree(rp->r_cred);
4235 				rp->r_cred = cr;
4236 				crhold(cr);
4237 				cred = cr;
4238 				crhold(cred);
4239 				mutex_exit(&rp->r_statelock);
4240 				goto read_again;
4241 			}
4242 			mutex_exit(&rp->r_statelock);
4243 		}
4244 	} else {
4245 		if (!(rp->r_flags & RSTALE)) {
4246 			mutex_enter(&rp->r_statelock);
4247 			if (rp->r_cred != NULL) {
4248 				cred = rp->r_cred;
4249 				crhold(cred);
4250 			} else {
4251 				rp->r_cred = cr;
4252 				crhold(cr);
4253 				cred = cr;
4254 				crhold(cred);
4255 			}
4256 			mutex_exit(&rp->r_statelock);
4257 		write_again:
4258 			mutex_enter(&rp->r_statelock);
4259 			count = MIN(bp->b_bcount, rp->r_size - offset);
4260 			mutex_exit(&rp->r_statelock);
4261 			if (count < 0)
4262 				cmn_err(CE_PANIC, "nfs3_bio: write count < 0");
4263 #ifdef DEBUG
4264 			if (count == 0) {
4265 				zcmn_err(getzoneid(), CE_WARN,
4266 				    "nfs3_bio: zero length write at %lld",
4267 				    offset);
4268 				nfs_printfhandle(&rp->r_fh);
4269 				if (nfs3_bio_do_stop)
4270 					debug_enter("nfs3_bio");
4271 			}
4272 #endif
4273 			error = nfs3write(bp->b_vp, bp->b_un.b_addr, offset,
4274 			    count, cred, stab_comm);
4275 			if (error == EACCES) {
4276 				mutex_enter(&rp->r_statelock);
4277 				if (cred != cr) {
4278 					if (rp->r_cred != NULL)
4279 						crfree(rp->r_cred);
4280 					rp->r_cred = cr;
4281 					crhold(cr);
4282 					crfree(cred);
4283 					cred = cr;
4284 					crhold(cred);
4285 					mutex_exit(&rp->r_statelock);
4286 					goto write_again;
4287 				}
4288 				mutex_exit(&rp->r_statelock);
4289 			}
4290 			bp->b_error = error;
4291 			if (error && error != EINTR) {
4292 				/*
4293 				 * Don't print EDQUOT errors on the console.
4294 				 * Don't print asynchronous EACCES errors.
4295 				 * Don't print EFBIG errors.
4296 				 * Print all other write errors.
4297 				 */
4298 				if (error != EDQUOT && error != EFBIG &&
4299 				    (error != EACCES ||
4300 				    !(bp->b_flags & B_ASYNC)))
4301 					nfs_write_error(bp->b_vp, error, cred);
4302 				/*
4303 				 * Update r_error and r_flags as appropriate.
4304 				 * If the error was ESTALE, then mark the
4305 				 * rnode as not being writeable and save
4306 				 * the error status.  Otherwise, save any
4307 				 * errors which occur from asynchronous
4308 				 * page invalidations.  Any errors occurring
4309 				 * from other operations should be saved
4310 				 * by the caller.
4311 				 */
4312 				mutex_enter(&rp->r_statelock);
4313 				if (error == ESTALE) {
4314 					rp->r_flags |= RSTALE;
4315 					if (!rp->r_error)
4316 						rp->r_error = error;
4317 				} else if (!rp->r_error &&
4318 				    (bp->b_flags &
4319 				    (B_INVAL|B_FORCE|B_ASYNC)) ==
4320 				    (B_INVAL|B_FORCE|B_ASYNC)) {
4321 					rp->r_error = error;
4322 				}
4323 				mutex_exit(&rp->r_statelock);
4324 			}
4325 			crfree(cred);
4326 		} else
4327 			error = rp->r_error;
4328 	}
4329 
4330 	if (error != 0 && error != NFS_EOF)
4331 		bp->b_flags |= B_ERROR;
4332 
4333 	DTRACE_IO1(done, struct buf *, bp);
4334 
4335 	return (error);
4336 }
4337 
4338 static int
4339 nfs3_fid(vnode_t *vp, fid_t *fidp)
4340 {
4341 	rnode_t *rp;
4342 
4343 	if (nfs_zone() != VTOMI(vp)->mi_zone)
4344 		return (EIO);
4345 	rp = VTOR(vp);
4346 
4347 	if (fidp->fid_len < (ushort_t)rp->r_fh.fh_len) {
4348 		fidp->fid_len = rp->r_fh.fh_len;
4349 		return (ENOSPC);
4350 	}
4351 	fidp->fid_len = rp->r_fh.fh_len;
4352 	bcopy(rp->r_fh.fh_buf, fidp->fid_data, fidp->fid_len);
4353 	return (0);
4354 }
4355 
4356 /* ARGSUSED2 */
4357 static int
4358 nfs3_rwlock(vnode_t *vp, int write_lock, caller_context_t *ctp)
4359 {
4360 	rnode_t *rp = VTOR(vp);
4361 
4362 	if (!write_lock) {
4363 		(void) nfs_rw_enter_sig(&rp->r_rwlock, RW_READER, FALSE);
4364 		return (V_WRITELOCK_FALSE);
4365 	}
4366 
4367 	if ((rp->r_flags & RDIRECTIO) || (VTOMI(vp)->mi_flags & MI_DIRECTIO)) {
4368 		(void) nfs_rw_enter_sig(&rp->r_rwlock, RW_READER, FALSE);
4369 		if (rp->r_mapcnt == 0 && !vn_has_cached_data(vp))
4370 			return (V_WRITELOCK_FALSE);
4371 		nfs_rw_exit(&rp->r_rwlock);
4372 	}
4373 
4374 	(void) nfs_rw_enter_sig(&rp->r_rwlock, RW_WRITER, FALSE);
4375 	return (V_WRITELOCK_TRUE);
4376 }
4377 
4378 /* ARGSUSED */
4379 static void
4380 nfs3_rwunlock(vnode_t *vp, int write_lock, caller_context_t *ctp)
4381 {
4382 	rnode_t *rp = VTOR(vp);
4383 
4384 	nfs_rw_exit(&rp->r_rwlock);
4385 }
4386 
4387 /* ARGSUSED */
4388 static int
4389 nfs3_seek(vnode_t *vp, offset_t ooff, offset_t *noffp)
4390 {
4391 
4392 	/*
4393 	 * Because we stuff the readdir cookie into the offset field
4394 	 * someone may attempt to do an lseek with the cookie which
4395 	 * we want to succeed.
4396 	 */
4397 	if (vp->v_type == VDIR)
4398 		return (0);
4399 	if (*noffp < 0)
4400 		return (EINVAL);
4401 	return (0);
4402 }
4403 
4404 /*
4405  * number of nfs3_bsize blocks to read ahead.
4406  */
4407 static int nfs3_nra = 4;
4408 
4409 #ifdef DEBUG
4410 static int nfs3_lostpage = 0;	/* number of times we lost original page */
4411 #endif
4412 
4413 /*
4414  * Return all the pages from [off..off+len) in file
4415  */
4416 static int
4417 nfs3_getpage(vnode_t *vp, offset_t off, size_t len, uint_t *protp,
4418 	page_t *pl[], size_t plsz, struct seg *seg, caddr_t addr,
4419 	enum seg_rw rw, cred_t *cr)
4420 {
4421 	rnode_t *rp;
4422 	int error;
4423 	mntinfo_t *mi;
4424 
4425 	if (vp->v_flag & VNOMAP)
4426 		return (ENOSYS);
4427 
4428 	if (nfs_zone() != VTOMI(vp)->mi_zone)
4429 		return (EIO);
4430 	if (protp != NULL)
4431 		*protp = PROT_ALL;
4432 
4433 	/*
4434 	 * Now valididate that the caches are up to date.
4435 	 */
4436 	error = nfs3_validate_caches(vp, cr);
4437 	if (error)
4438 		return (error);
4439 
4440 	rp = VTOR(vp);
4441 	mi = VTOMI(vp);
4442 retry:
4443 	mutex_enter(&rp->r_statelock);
4444 
4445 	/*
4446 	 * Don't create dirty pages faster than they
4447 	 * can be cleaned so that the system doesn't
4448 	 * get imbalanced.  If the async queue is
4449 	 * maxed out, then wait for it to drain before
4450 	 * creating more dirty pages.  Also, wait for
4451 	 * any threads doing pagewalks in the vop_getattr
4452 	 * entry points so that they don't block for
4453 	 * long periods.
4454 	 */
4455 	if (rw == S_CREATE) {
4456 		while ((mi->mi_max_threads != 0 &&
4457 		    rp->r_awcount > 2 * mi->mi_max_threads) ||
4458 		    rp->r_gcount > 0)
4459 			cv_wait(&rp->r_cv, &rp->r_statelock);
4460 	}
4461 
4462 	/*
4463 	 * If we are getting called as a side effect of an nfs_write()
4464 	 * operation the local file size might not be extended yet.
4465 	 * In this case we want to be able to return pages of zeroes.
4466 	 */
4467 	if (off + len > rp->r_size + PAGEOFFSET && seg != segkmap) {
4468 		mutex_exit(&rp->r_statelock);
4469 		return (EFAULT);		/* beyond EOF */
4470 	}
4471 
4472 	mutex_exit(&rp->r_statelock);
4473 
4474 	if (len <= PAGESIZE) {
4475 		error = nfs3_getapage(vp, off, len, protp, pl, plsz,
4476 		    seg, addr, rw, cr);
4477 	} else {
4478 		error = pvn_getpages(nfs3_getapage, vp, off, len, protp,
4479 		    pl, plsz, seg, addr, rw, cr);
4480 	}
4481 
4482 	switch (error) {
4483 	case NFS_EOF:
4484 		nfs_purge_caches(vp, NFS_NOPURGE_DNLC, cr);
4485 		goto retry;
4486 	case ESTALE:
4487 		PURGE_STALE_FH(error, vp, cr);
4488 	}
4489 
4490 	return (error);
4491 }
4492 
4493 /*
4494  * Called from pvn_getpages or nfs3_getpage to get a particular page.
4495  */
4496 /* ARGSUSED */
4497 static int
4498 nfs3_getapage(vnode_t *vp, u_offset_t off, size_t len, uint_t *protp,
4499 	page_t *pl[], size_t plsz, struct seg *seg, caddr_t addr,
4500 	enum seg_rw rw, cred_t *cr)
4501 {
4502 	rnode_t *rp;
4503 	uint_t bsize;
4504 	struct buf *bp;
4505 	page_t *pp;
4506 	u_offset_t lbn;
4507 	u_offset_t io_off;
4508 	u_offset_t blkoff;
4509 	u_offset_t rablkoff;
4510 	size_t io_len;
4511 	uint_t blksize;
4512 	int error;
4513 	int readahead;
4514 	int readahead_issued = 0;
4515 	int ra_window; /* readahead window */
4516 	page_t *pagefound;
4517 	page_t *savepp;
4518 
4519 	if (nfs_zone() != VTOMI(vp)->mi_zone)
4520 		return (EIO);
4521 	rp = VTOR(vp);
4522 	bsize = MAX(vp->v_vfsp->vfs_bsize, PAGESIZE);
4523 
4524 reread:
4525 	bp = NULL;
4526 	pp = NULL;
4527 	pagefound = NULL;
4528 
4529 	if (pl != NULL)
4530 		pl[0] = NULL;
4531 
4532 	error = 0;
4533 	lbn = off / bsize;
4534 	blkoff = lbn * bsize;
4535 
4536 	/*
4537 	 * Queueing up the readahead before doing the synchronous read
4538 	 * results in a significant increase in read throughput because
4539 	 * of the increased parallelism between the async threads and
4540 	 * the process context.
4541 	 */
4542 	if ((off & ((vp->v_vfsp->vfs_bsize) - 1)) == 0 &&
4543 	    rw != S_CREATE &&
4544 	    !(vp->v_flag & VNOCACHE)) {
4545 		mutex_enter(&rp->r_statelock);
4546 
4547 		/*
4548 		 * Calculate the number of readaheads to do.
4549 		 * a) No readaheads at offset = 0.
4550 		 * b) Do maximum(nfs3_nra) readaheads when the readahead
4551 		 *    window is closed.
4552 		 * c) Do readaheads between 1 to (nfs3_nra - 1) depending
4553 		 *    upon how far the readahead window is open or close.
4554 		 * d) No readaheads if rp->r_nextr is not within the scope
4555 		 *    of the readahead window (random i/o).
4556 		 */
4557 
4558 		if (off == 0)
4559 			readahead = 0;
4560 		else if (blkoff == rp->r_nextr)
4561 			readahead = nfs3_nra;
4562 		else if (rp->r_nextr > blkoff &&
4563 				((ra_window = (rp->r_nextr - blkoff) / bsize)
4564 					<= (nfs3_nra - 1)))
4565 			readahead = nfs3_nra - ra_window;
4566 		else
4567 			readahead = 0;
4568 
4569 		rablkoff = rp->r_nextr;
4570 		while (readahead > 0 && rablkoff + bsize < rp->r_size) {
4571 			mutex_exit(&rp->r_statelock);
4572 			if (nfs_async_readahead(vp, rablkoff + bsize,
4573 			    addr + (rablkoff + bsize - off), seg, cr,
4574 			    nfs3_readahead) < 0) {
4575 				mutex_enter(&rp->r_statelock);
4576 				break;
4577 			}
4578 			readahead--;
4579 			rablkoff += bsize;
4580 			/*
4581 			 * Indicate that we did a readahead so
4582 			 * readahead offset is not updated
4583 			 * by the synchronous read below.
4584 			 */
4585 			readahead_issued = 1;
4586 			mutex_enter(&rp->r_statelock);
4587 			/*
4588 			 * set readahead offset to
4589 			 * offset of last async readahead
4590 			 * request.
4591 			 */
4592 			rp->r_nextr = rablkoff;
4593 		}
4594 		mutex_exit(&rp->r_statelock);
4595 	}
4596 
4597 again:
4598 	if ((pagefound = page_exists(vp, off)) == NULL) {
4599 		if (pl == NULL) {
4600 			(void) nfs_async_readahead(vp, blkoff, addr, seg, cr,
4601 			    nfs3_readahead);
4602 		} else if (rw == S_CREATE) {
4603 			/*
4604 			 * Block for this page is not allocated, or the offset
4605 			 * is beyond the current allocation size, or we're
4606 			 * allocating a swap slot and the page was not found,
4607 			 * so allocate it and return a zero page.
4608 			 */
4609 			if ((pp = page_create_va(vp, off,
4610 			    PAGESIZE, PG_WAIT, seg, addr)) == NULL)
4611 				cmn_err(CE_PANIC, "nfs3_getapage: page_create");
4612 			io_len = PAGESIZE;
4613 			mutex_enter(&rp->r_statelock);
4614 			rp->r_nextr = off + PAGESIZE;
4615 			mutex_exit(&rp->r_statelock);
4616 		} else {
4617 			/*
4618 			 * Need to go to server to get a BLOCK, exception to
4619 			 * that being while reading at offset = 0 or doing
4620 			 * random i/o, in that case read only a PAGE.
4621 			 */
4622 			mutex_enter(&rp->r_statelock);
4623 			if (blkoff < rp->r_size &&
4624 			    blkoff + bsize >= rp->r_size) {
4625 				/*
4626 				 * If only a block or less is left in
4627 				 * the file, read all that is remaining.
4628 				 */
4629 				if (rp->r_size <= off) {
4630 					/*
4631 					 * Trying to access beyond EOF,
4632 					 * set up to get at least one page.
4633 					 */
4634 					blksize = off + PAGESIZE - blkoff;
4635 				} else
4636 					blksize = rp->r_size - blkoff;
4637 			} else if ((off == 0) ||
4638 				(off != rp->r_nextr && !readahead_issued)) {
4639 				blksize = PAGESIZE;
4640 				blkoff = off; /* block = page here */
4641 			} else
4642 				blksize = bsize;
4643 			mutex_exit(&rp->r_statelock);
4644 
4645 			pp = pvn_read_kluster(vp, off, seg, addr, &io_off,
4646 			    &io_len, blkoff, blksize, 0);
4647 
4648 			/*
4649 			 * Some other thread has entered the page,
4650 			 * so just use it.
4651 			 */
4652 			if (pp == NULL)
4653 				goto again;
4654 
4655 			/*
4656 			 * Now round the request size up to page boundaries.
4657 			 * This ensures that the entire page will be
4658 			 * initialized to zeroes if EOF is encountered.
4659 			 */
4660 			io_len = ptob(btopr(io_len));
4661 
4662 			bp = pageio_setup(pp, io_len, vp, B_READ);
4663 			ASSERT(bp != NULL);
4664 
4665 			/*
4666 			 * pageio_setup should have set b_addr to 0.  This
4667 			 * is correct since we want to do I/O on a page
4668 			 * boundary.  bp_mapin will use this addr to calculate
4669 			 * an offset, and then set b_addr to the kernel virtual
4670 			 * address it allocated for us.
4671 			 */
4672 			ASSERT(bp->b_un.b_addr == 0);
4673 
4674 			bp->b_edev = 0;
4675 			bp->b_dev = 0;
4676 			bp->b_lblkno = lbtodb(io_off);
4677 			bp->b_file = vp;
4678 			bp->b_offset = (offset_t)off;
4679 			bp_mapin(bp);
4680 
4681 			/*
4682 			 * If doing a write beyond what we believe is EOF,
4683 			 * don't bother trying to read the pages from the
4684 			 * server, we'll just zero the pages here.  We
4685 			 * don't check that the rw flag is S_WRITE here
4686 			 * because some implementations may attempt a
4687 			 * read access to the buffer before copying data.
4688 			 */
4689 			mutex_enter(&rp->r_statelock);
4690 			if (io_off >= rp->r_size && seg == segkmap) {
4691 				mutex_exit(&rp->r_statelock);
4692 				bzero(bp->b_un.b_addr, io_len);
4693 			} else {
4694 				mutex_exit(&rp->r_statelock);
4695 				error = nfs3_bio(bp, NULL, cr);
4696 			}
4697 
4698 			/*
4699 			 * Unmap the buffer before freeing it.
4700 			 */
4701 			bp_mapout(bp);
4702 			pageio_done(bp);
4703 
4704 			savepp = pp;
4705 			do {
4706 				pp->p_fsdata = C_NOCOMMIT;
4707 			} while ((pp = pp->p_next) != savepp);
4708 
4709 			if (error == NFS_EOF) {
4710 				/*
4711 				 * If doing a write system call just return
4712 				 * zeroed pages, else user tried to get pages
4713 				 * beyond EOF, return error.  We don't check
4714 				 * that the rw flag is S_WRITE here because
4715 				 * some implementations may attempt a read
4716 				 * access to the buffer before copying data.
4717 				 */
4718 				if (seg == segkmap)
4719 					error = 0;
4720 				else
4721 					error = EFAULT;
4722 			}
4723 
4724 			if (!readahead_issued && !error) {
4725 				mutex_enter(&rp->r_statelock);
4726 				rp->r_nextr = io_off + io_len;
4727 				mutex_exit(&rp->r_statelock);
4728 			}
4729 		}
4730 	}
4731 
4732 out:
4733 	if (pl == NULL)
4734 		return (error);
4735 
4736 	if (error) {
4737 		if (pp != NULL)
4738 			pvn_read_done(pp, B_ERROR);
4739 		return (error);
4740 	}
4741 
4742 	if (pagefound) {
4743 		se_t se = (rw == S_CREATE ? SE_EXCL : SE_SHARED);
4744 
4745 		/*
4746 		 * Page exists in the cache, acquire the appropriate lock.
4747 		 * If this fails, start all over again.
4748 		 */
4749 		if ((pp = page_lookup(vp, off, se)) == NULL) {
4750 #ifdef DEBUG
4751 			nfs3_lostpage++;
4752 #endif
4753 			goto reread;
4754 		}
4755 		pl[0] = pp;
4756 		pl[1] = NULL;
4757 		return (0);
4758 	}
4759 
4760 	if (pp != NULL)
4761 		pvn_plist_init(pp, pl, plsz, off, io_len, rw);
4762 
4763 	return (error);
4764 }
4765 
4766 static void
4767 nfs3_readahead(vnode_t *vp, u_offset_t blkoff, caddr_t addr, struct seg *seg,
4768 	cred_t *cr)
4769 {
4770 	int error;
4771 	page_t *pp;
4772 	u_offset_t io_off;
4773 	size_t io_len;
4774 	struct buf *bp;
4775 	uint_t bsize, blksize;
4776 	rnode_t *rp = VTOR(vp);
4777 	page_t *savepp;
4778 
4779 	ASSERT(nfs_zone() == VTOMI(vp)->mi_zone);
4780 	bsize = MAX(vp->v_vfsp->vfs_bsize, PAGESIZE);
4781 
4782 	mutex_enter(&rp->r_statelock);
4783 	if (blkoff < rp->r_size && blkoff + bsize > rp->r_size) {
4784 		/*
4785 		 * If less than a block left in file read less
4786 		 * than a block.
4787 		 */
4788 		blksize = rp->r_size - blkoff;
4789 	} else
4790 		blksize = bsize;
4791 	mutex_exit(&rp->r_statelock);
4792 
4793 	pp = pvn_read_kluster(vp, blkoff, segkmap, addr,
4794 	    &io_off, &io_len, blkoff, blksize, 1);
4795 	/*
4796 	 * The isra flag passed to the kluster function is 1, we may have
4797 	 * gotten a return value of NULL for a variety of reasons (# of free
4798 	 * pages < minfree, someone entered the page on the vnode etc). In all
4799 	 * cases, we want to punt on the readahead.
4800 	 */
4801 	if (pp == NULL)
4802 		return;
4803 
4804 	/*
4805 	 * Now round the request size up to page boundaries.
4806 	 * This ensures that the entire page will be
4807 	 * initialized to zeroes if EOF is encountered.
4808 	 */
4809 	io_len = ptob(btopr(io_len));
4810 
4811 	bp = pageio_setup(pp, io_len, vp, B_READ);
4812 	ASSERT(bp != NULL);
4813 
4814 	/*
4815 	 * pageio_setup should have set b_addr to 0.  This is correct since
4816 	 * we want to do I/O on a page boundary. bp_mapin() will use this addr
4817 	 * to calculate an offset, and then set b_addr to the kernel virtual
4818 	 * address it allocated for us.
4819 	 */
4820 	ASSERT(bp->b_un.b_addr == 0);
4821 
4822 	bp->b_edev = 0;
4823 	bp->b_dev = 0;
4824 	bp->b_lblkno = lbtodb(io_off);
4825 	bp->b_file = vp;
4826 	bp->b_offset = (offset_t)blkoff;
4827 	bp_mapin(bp);
4828 
4829 	/*
4830 	 * If doing a write beyond what we believe is EOF, don't bother trying
4831 	 * to read the pages from the server, we'll just zero the pages here.
4832 	 * We don't check that the rw flag is S_WRITE here because some
4833 	 * implementations may attempt a read access to the buffer before
4834 	 * copying data.
4835 	 */
4836 	mutex_enter(&rp->r_statelock);
4837 	if (io_off >= rp->r_size && seg == segkmap) {
4838 		mutex_exit(&rp->r_statelock);
4839 		bzero(bp->b_un.b_addr, io_len);
4840 		error = 0;
4841 	} else {
4842 		mutex_exit(&rp->r_statelock);
4843 		error = nfs3_bio(bp, NULL, cr);
4844 		if (error == NFS_EOF)
4845 			error = 0;
4846 	}
4847 
4848 	/*
4849 	 * Unmap the buffer before freeing it.
4850 	 */
4851 	bp_mapout(bp);
4852 	pageio_done(bp);
4853 
4854 	savepp = pp;
4855 	do {
4856 		pp->p_fsdata = C_NOCOMMIT;
4857 	} while ((pp = pp->p_next) != savepp);
4858 
4859 	pvn_read_done(pp, error ? B_READ | B_ERROR : B_READ);
4860 
4861 	/*
4862 	 * In case of error set readahead offset
4863 	 * to the lowest offset.
4864 	 * pvn_read_done() calls VN_DISPOSE to destroy the pages
4865 	 */
4866 	if (error && rp->r_nextr > io_off) {
4867 		mutex_enter(&rp->r_statelock);
4868 		if (rp->r_nextr > io_off)
4869 			rp->r_nextr = io_off;
4870 		mutex_exit(&rp->r_statelock);
4871 	}
4872 }
4873 
4874 /*
4875  * Flags are composed of {B_INVAL, B_FREE, B_DONTNEED, B_FORCE}
4876  * If len == 0, do from off to EOF.
4877  *
4878  * The normal cases should be len == 0 && off == 0 (entire vp list),
4879  * len == MAXBSIZE (from segmap_release actions), and len == PAGESIZE
4880  * (from pageout).
4881  */
4882 static int
4883 nfs3_putpage(vnode_t *vp, offset_t off, size_t len, int flags, cred_t *cr)
4884 {
4885 	int error;
4886 	rnode_t *rp;
4887 
4888 	ASSERT(cr != NULL);
4889 
4890 	/*
4891 	 * XXX - Why should this check be made here?
4892 	 */
4893 	if (vp->v_flag & VNOMAP)
4894 		return (ENOSYS);
4895 	if (len == 0 && !(flags & B_INVAL) && vn_is_readonly(vp))
4896 		return (0);
4897 	if (!(flags & B_ASYNC) && nfs_zone() != VTOMI(vp)->mi_zone)
4898 		return (EIO);
4899 
4900 	rp = VTOR(vp);
4901 	mutex_enter(&rp->r_statelock);
4902 	rp->r_count++;
4903 	mutex_exit(&rp->r_statelock);
4904 	error = nfs_putpages(vp, off, len, flags, cr);
4905 	mutex_enter(&rp->r_statelock);
4906 	rp->r_count--;
4907 	cv_broadcast(&rp->r_cv);
4908 	mutex_exit(&rp->r_statelock);
4909 
4910 	return (error);
4911 }
4912 
4913 /*
4914  * Write out a single page, possibly klustering adjacent dirty pages.
4915  */
4916 int
4917 nfs3_putapage(vnode_t *vp, page_t *pp, u_offset_t *offp, size_t *lenp,
4918 	int flags, cred_t *cr)
4919 {
4920 	u_offset_t io_off;
4921 	u_offset_t lbn_off;
4922 	u_offset_t lbn;
4923 	size_t io_len;
4924 	uint_t bsize;
4925 	int error;
4926 	rnode_t *rp;
4927 
4928 	ASSERT(!vn_is_readonly(vp));
4929 	ASSERT(pp != NULL);
4930 	ASSERT(cr != NULL);
4931 	ASSERT((flags & B_ASYNC) || nfs_zone() == VTOMI(vp)->mi_zone);
4932 
4933 	rp = VTOR(vp);
4934 	ASSERT(rp->r_count > 0);
4935 
4936 	bsize = MAX(vp->v_vfsp->vfs_bsize, PAGESIZE);
4937 	lbn = pp->p_offset / bsize;
4938 	lbn_off = lbn * bsize;
4939 
4940 	/*
4941 	 * Find a kluster that fits in one block, or in
4942 	 * one page if pages are bigger than blocks.  If
4943 	 * there is less file space allocated than a whole
4944 	 * page, we'll shorten the i/o request below.
4945 	 */
4946 	pp = pvn_write_kluster(vp, pp, &io_off, &io_len, lbn_off,
4947 	    roundup(bsize, PAGESIZE), flags);
4948 
4949 	/*
4950 	 * pvn_write_kluster shouldn't have returned a page with offset
4951 	 * behind the original page we were given.  Verify that.
4952 	 */
4953 	ASSERT((pp->p_offset / bsize) >= lbn);
4954 
4955 	/*
4956 	 * Now pp will have the list of kept dirty pages marked for
4957 	 * write back.  It will also handle invalidation and freeing
4958 	 * of pages that are not dirty.  Check for page length rounding
4959 	 * problems.
4960 	 */
4961 	if (io_off + io_len > lbn_off + bsize) {
4962 		ASSERT((io_off + io_len) - (lbn_off + bsize) < PAGESIZE);
4963 		io_len = lbn_off + bsize - io_off;
4964 	}
4965 	/*
4966 	 * The RMODINPROGRESS flag makes sure that nfs(3)_bio() sees a
4967 	 * consistent value of r_size. RMODINPROGRESS is set in writerp().
4968 	 * When RMODINPROGRESS is set it indicates that a uiomove() is in
4969 	 * progress and the r_size has not been made consistent with the
4970 	 * new size of the file. When the uiomove() completes the r_size is
4971 	 * updated and the RMODINPROGRESS flag is cleared.
4972 	 *
4973 	 * The RMODINPROGRESS flag makes sure that nfs(3)_bio() sees a
4974 	 * consistent value of r_size. Without this handshaking, it is
4975 	 * possible that nfs(3)_bio() picks  up the old value of r_size
4976 	 * before the uiomove() in writerp() completes. This will result
4977 	 * in the write through nfs(3)_bio() being dropped.
4978 	 *
4979 	 * More precisely, there is a window between the time the uiomove()
4980 	 * completes and the time the r_size is updated. If a VOP_PUTPAGE()
4981 	 * operation intervenes in this window, the page will be picked up,
4982 	 * because it is dirty (it will be unlocked, unless it was
4983 	 * pagecreate'd). When the page is picked up as dirty, the dirty
4984 	 * bit is reset (pvn_getdirty()). In nfs(3)write(), r_size is
4985 	 * checked. This will still be the old size. Therefore the page will
4986 	 * not be written out. When segmap_release() calls VOP_PUTPAGE(),
4987 	 * the page will be found to be clean and the write will be dropped.
4988 	 */
4989 	if (rp->r_flags & RMODINPROGRESS) {
4990 		mutex_enter(&rp->r_statelock);
4991 		if ((rp->r_flags & RMODINPROGRESS) &&
4992 		    rp->r_modaddr + MAXBSIZE > io_off &&
4993 		    rp->r_modaddr < io_off + io_len) {
4994 			page_t *plist;
4995 			/*
4996 			 * A write is in progress for this region of the file.
4997 			 * If we did not detect RMODINPROGRESS here then this
4998 			 * path through nfs_putapage() would eventually go to
4999 			 * nfs(3)_bio() and may not write out all of the data
5000 			 * in the pages. We end up losing data. So we decide
5001 			 * to set the modified bit on each page in the page
5002 			 * list and mark the rnode with RDIRTY. This write
5003 			 * will be restarted at some later time.
5004 			 */
5005 			plist = pp;
5006 			while (plist != NULL) {
5007 				pp = plist;
5008 				page_sub(&plist, pp);
5009 				hat_setmod(pp);
5010 				page_io_unlock(pp);
5011 				page_unlock(pp);
5012 			}
5013 			rp->r_flags |= RDIRTY;
5014 			mutex_exit(&rp->r_statelock);
5015 			if (offp)
5016 				*offp = io_off;
5017 			if (lenp)
5018 				*lenp = io_len;
5019 			return (0);
5020 		}
5021 		mutex_exit(&rp->r_statelock);
5022 	}
5023 
5024 	if (flags & B_ASYNC) {
5025 		error = nfs_async_putapage(vp, pp, io_off, io_len, flags, cr,
5026 		    nfs3_sync_putapage);
5027 	} else
5028 		error = nfs3_sync_putapage(vp, pp, io_off, io_len, flags, cr);
5029 
5030 	if (offp)
5031 		*offp = io_off;
5032 	if (lenp)
5033 		*lenp = io_len;
5034 	return (error);
5035 }
5036 
5037 static int
5038 nfs3_sync_putapage(vnode_t *vp, page_t *pp, u_offset_t io_off, size_t io_len,
5039 	int flags, cred_t *cr)
5040 {
5041 	int error;
5042 	rnode_t *rp;
5043 
5044 	ASSERT(nfs_zone() == VTOMI(vp)->mi_zone);
5045 
5046 	flags |= B_WRITE;
5047 
5048 	error = nfs3_rdwrlbn(vp, pp, io_off, io_len, flags, cr);
5049 
5050 	rp = VTOR(vp);
5051 
5052 	if ((error == ENOSPC || error == EDQUOT || error == EFBIG ||
5053 	    error == EACCES) &&
5054 	    (flags & (B_INVAL|B_FORCE)) != (B_INVAL|B_FORCE)) {
5055 		if (!(rp->r_flags & ROUTOFSPACE)) {
5056 			mutex_enter(&rp->r_statelock);
5057 			rp->r_flags |= ROUTOFSPACE;
5058 			mutex_exit(&rp->r_statelock);
5059 		}
5060 		flags |= B_ERROR;
5061 		pvn_write_done(pp, flags);
5062 		/*
5063 		 * If this was not an async thread, then try again to
5064 		 * write out the pages, but this time, also destroy
5065 		 * them whether or not the write is successful.  This
5066 		 * will prevent memory from filling up with these
5067 		 * pages and destroying them is the only alternative
5068 		 * if they can't be written out.
5069 		 *
5070 		 * Don't do this if this is an async thread because
5071 		 * when the pages are unlocked in pvn_write_done,
5072 		 * some other thread could have come along, locked
5073 		 * them, and queued for an async thread.  It would be
5074 		 * possible for all of the async threads to be tied
5075 		 * up waiting to lock the pages again and they would
5076 		 * all already be locked and waiting for an async
5077 		 * thread to handle them.  Deadlock.
5078 		 */
5079 		if (!(flags & B_ASYNC)) {
5080 			error = nfs3_putpage(vp, io_off, io_len,
5081 			    B_INVAL | B_FORCE, cr);
5082 		}
5083 	} else {
5084 		if (error)
5085 			flags |= B_ERROR;
5086 		else if (rp->r_flags & ROUTOFSPACE) {
5087 			mutex_enter(&rp->r_statelock);
5088 			rp->r_flags &= ~ROUTOFSPACE;
5089 			mutex_exit(&rp->r_statelock);
5090 		}
5091 		pvn_write_done(pp, flags);
5092 		if (freemem < desfree)
5093 			(void) nfs3_commit_vp(vp, (u_offset_t)0, 0, cr);
5094 	}
5095 
5096 	return (error);
5097 }
5098 
5099 static int
5100 nfs3_map(vnode_t *vp, offset_t off, struct as *as, caddr_t *addrp,
5101 	size_t len, uchar_t prot, uchar_t maxprot, uint_t flags, cred_t *cr)
5102 {
5103 	struct segvn_crargs vn_a;
5104 	int error;
5105 	rnode_t *rp;
5106 	struct vattr va;
5107 
5108 	if (nfs_zone() != VTOMI(vp)->mi_zone)
5109 		return (EIO);
5110 
5111 	if (vp->v_flag & VNOMAP)
5112 		return (ENOSYS);
5113 
5114 	if (off < 0 || off + len < 0)
5115 		return (ENXIO);
5116 
5117 	if (vp->v_type != VREG)
5118 		return (ENODEV);
5119 
5120 	/*
5121 	 * If there is cached data and if close-to-open consistency
5122 	 * checking is not turned off and if the file system is not
5123 	 * mounted readonly, then force an over the wire getattr.
5124 	 * Otherwise, just invoke nfs3getattr to get a copy of the
5125 	 * attributes.  The attribute cache will be used unless it
5126 	 * is timed out and if it is, then an over the wire getattr
5127 	 * will be issued.
5128 	 */
5129 	va.va_mask = AT_ALL;
5130 	if (vn_has_cached_data(vp) &&
5131 	    !(VTOMI(vp)->mi_flags & MI_NOCTO) && !vn_is_readonly(vp))
5132 		error = nfs3_getattr_otw(vp, &va, cr);
5133 	else
5134 		error = nfs3getattr(vp, &va, cr);
5135 	if (error)
5136 		return (error);
5137 
5138 	/*
5139 	 * Check to see if the vnode is currently marked as not cachable.
5140 	 * This means portions of the file are locked (through VOP_FRLOCK).
5141 	 * In this case the map request must be refused.  We use
5142 	 * rp->r_lkserlock to avoid a race with concurrent lock requests.
5143 	 */
5144 	rp = VTOR(vp);
5145 	if (nfs_rw_enter_sig(&rp->r_lkserlock, RW_READER, INTR(vp)))
5146 		return (EINTR);
5147 
5148 	if (vp->v_flag & VNOCACHE) {
5149 		error = EAGAIN;
5150 		goto done;
5151 	}
5152 
5153 	/*
5154 	 * Don't allow concurrent locks and mapping if mandatory locking is
5155 	 * enabled.
5156 	 */
5157 	if ((flk_has_remote_locks(vp) || lm_has_sleep(vp)) &&
5158 	    MANDLOCK(vp, va.va_mode)) {
5159 		error = EAGAIN;
5160 		goto done;
5161 	}
5162 
5163 	as_rangelock(as);
5164 	if (!(flags & MAP_FIXED)) {
5165 		map_addr(addrp, len, off, 1, flags);
5166 		if (*addrp == NULL) {
5167 			as_rangeunlock(as);
5168 			error = ENOMEM;
5169 			goto done;
5170 		}
5171 	} else {
5172 		/*
5173 		 * User specified address - blow away any previous mappings
5174 		 */
5175 		(void) as_unmap(as, *addrp, len);
5176 	}
5177 
5178 	vn_a.vp = vp;
5179 	vn_a.offset = off;
5180 	vn_a.type = (flags & MAP_TYPE);
5181 	vn_a.prot = (uchar_t)prot;
5182 	vn_a.maxprot = (uchar_t)maxprot;
5183 	vn_a.flags = (flags & ~MAP_TYPE);
5184 	vn_a.cred = cr;
5185 	vn_a.amp = NULL;
5186 	vn_a.szc = 0;
5187 	vn_a.lgrp_mem_policy_flags = 0;
5188 
5189 	error = as_map(as, *addrp, len, segvn_create, &vn_a);
5190 	as_rangeunlock(as);
5191 
5192 done:
5193 	nfs_rw_exit(&rp->r_lkserlock);
5194 	return (error);
5195 }
5196 
5197 /* ARGSUSED */
5198 static int
5199 nfs3_addmap(vnode_t *vp, offset_t off, struct as *as, caddr_t addr,
5200 	size_t len, uchar_t prot, uchar_t maxprot, uint_t flags, cred_t *cr)
5201 {
5202 	rnode_t *rp;
5203 
5204 	if (vp->v_flag & VNOMAP)
5205 		return (ENOSYS);
5206 	if (nfs_zone() != VTOMI(vp)->mi_zone)
5207 		return (EIO);
5208 
5209 	/*
5210 	 * Need to hold rwlock while incrementing the mapcnt so that
5211 	 * mmap'ing can be serialized with writes so that the caching
5212 	 * can be handled correctly.
5213 	 */
5214 	rp = VTOR(vp);
5215 	if (nfs_rw_enter_sig(&rp->r_rwlock, RW_WRITER, INTR(vp)))
5216 		return (EINTR);
5217 	atomic_add_long((ulong_t *)&rp->r_mapcnt, btopr(len));
5218 	nfs_rw_exit(&rp->r_rwlock);
5219 
5220 	return (0);
5221 }
5222 
5223 static int
5224 nfs3_frlock(vnode_t *vp, int cmd, struct flock64 *bfp, int flag,
5225 	offset_t offset, struct flk_callback *flk_cbp, cred_t *cr)
5226 {
5227 	netobj lm_fh3;
5228 	int rc;
5229 	u_offset_t start, end;
5230 	rnode_t *rp;
5231 	int error = 0, intr = INTR(vp);
5232 
5233 	if (nfs_zone() != VTOMI(vp)->mi_zone)
5234 		return (EIO);
5235 	/* check for valid cmd parameter */
5236 	if (cmd != F_GETLK && cmd != F_SETLK && cmd != F_SETLKW)
5237 		return (EINVAL);
5238 
5239 	/* Verify l_type. */
5240 	switch (bfp->l_type) {
5241 	case F_RDLCK:
5242 		if (cmd != F_GETLK && !(flag & FREAD))
5243 			return (EBADF);
5244 		break;
5245 	case F_WRLCK:
5246 		if (cmd != F_GETLK && !(flag & FWRITE))
5247 			return (EBADF);
5248 		break;
5249 	case F_UNLCK:
5250 		intr = 0;
5251 		break;
5252 
5253 	default:
5254 		return (EINVAL);
5255 	}
5256 
5257 	/* check the validity of the lock range */
5258 	if (rc = flk_convert_lock_data(vp, bfp, &start, &end, offset))
5259 		return (rc);
5260 	if (rc = flk_check_lock_data(start, end, MAXEND))
5261 		return (rc);
5262 
5263 	/*
5264 	 * If the filesystem is mounted using local locking, pass the
5265 	 * request off to the local locking code.
5266 	 */
5267 	if (VTOMI(vp)->mi_flags & MI_LLOCK) {
5268 		if (cmd == F_SETLK || cmd == F_SETLKW) {
5269 			/*
5270 			 * For complete safety, we should be holding
5271 			 * r_lkserlock.  However, we can't call
5272 			 * lm_safelock and then fs_frlock while
5273 			 * holding r_lkserlock, so just invoke
5274 			 * lm_safelock and expect that this will
5275 			 * catch enough of the cases.
5276 			 */
5277 			if (!lm_safelock(vp, bfp, cr))
5278 				return (EAGAIN);
5279 		}
5280 		return (fs_frlock(vp, cmd, bfp, flag, offset, flk_cbp, cr));
5281 	}
5282 
5283 	rp = VTOR(vp);
5284 
5285 	/*
5286 	 * Check whether the given lock request can proceed, given the
5287 	 * current file mappings.
5288 	 */
5289 	if (nfs_rw_enter_sig(&rp->r_lkserlock, RW_WRITER, intr))
5290 		return (EINTR);
5291 	if (cmd == F_SETLK || cmd == F_SETLKW) {
5292 		if (!lm_safelock(vp, bfp, cr)) {
5293 			rc = EAGAIN;
5294 			goto done;
5295 		}
5296 	}
5297 
5298 	/*
5299 	 * Flush the cache after waiting for async I/O to finish.  For new
5300 	 * locks, this is so that the process gets the latest bits from the
5301 	 * server.  For unlocks, this is so that other clients see the
5302 	 * latest bits once the file has been unlocked.  If currently dirty
5303 	 * pages can't be flushed, then don't allow a lock to be set.  But
5304 	 * allow unlocks to succeed, to avoid having orphan locks on the
5305 	 * server.
5306 	 */
5307 	if (cmd != F_GETLK) {
5308 		mutex_enter(&rp->r_statelock);
5309 		while (rp->r_count > 0) {
5310 		    if (intr) {
5311 			klwp_t *lwp = ttolwp(curthread);
5312 
5313 			if (lwp != NULL)
5314 				lwp->lwp_nostop++;
5315 			if (cv_wait_sig(&rp->r_cv, &rp->r_statelock) == 0) {
5316 				if (lwp != NULL)
5317 					lwp->lwp_nostop--;
5318 				rc = EINTR;
5319 				break;
5320 			}
5321 			if (lwp != NULL)
5322 				lwp->lwp_nostop--;
5323 		    } else
5324 			cv_wait(&rp->r_cv, &rp->r_statelock);
5325 		}
5326 		mutex_exit(&rp->r_statelock);
5327 		if (rc != 0)
5328 			goto done;
5329 		error = nfs3_putpage(vp, (offset_t)0, 0, B_INVAL, cr);
5330 		if (error) {
5331 			if (error == ENOSPC || error == EDQUOT) {
5332 				mutex_enter(&rp->r_statelock);
5333 				if (!rp->r_error)
5334 					rp->r_error = error;
5335 				mutex_exit(&rp->r_statelock);
5336 			}
5337 			if (bfp->l_type != F_UNLCK) {
5338 				rc = ENOLCK;
5339 				goto done;
5340 			}
5341 		}
5342 	}
5343 
5344 	lm_fh3.n_len = VTOFH3(vp)->fh3_length;
5345 	lm_fh3.n_bytes = (char *)&(VTOFH3(vp)->fh3_u.data);
5346 
5347 	/*
5348 	 * Call the lock manager to do the real work of contacting
5349 	 * the server and obtaining the lock.
5350 	 */
5351 	rc = lm4_frlock(vp, cmd, bfp, flag, offset, cr, &lm_fh3, flk_cbp);
5352 
5353 	if (rc == 0)
5354 		nfs_lockcompletion(vp, cmd);
5355 
5356 done:
5357 	nfs_rw_exit(&rp->r_lkserlock);
5358 	return (rc);
5359 }
5360 
5361 /*
5362  * Free storage space associated with the specified vnode.  The portion
5363  * to be freed is specified by bfp->l_start and bfp->l_len (already
5364  * normalized to a "whence" of 0).
5365  *
5366  * This is an experimental facility whose continued existence is not
5367  * guaranteed.  Currently, we only support the special case
5368  * of l_len == 0, meaning free to end of file.
5369  */
5370 /* ARGSUSED */
5371 static int
5372 nfs3_space(vnode_t *vp, int cmd, struct flock64 *bfp, int flag,
5373 	offset_t offset, cred_t *cr, caller_context_t *ct)
5374 {
5375 	int error;
5376 
5377 	ASSERT(vp->v_type == VREG);
5378 	if (cmd != F_FREESP)
5379 		return (EINVAL);
5380 	if (nfs_zone() != VTOMI(vp)->mi_zone)
5381 		return (EIO);
5382 
5383 	error = convoff(vp, bfp, 0, offset);
5384 	if (!error) {
5385 		ASSERT(bfp->l_start >= 0);
5386 		if (bfp->l_len == 0) {
5387 			struct vattr va;
5388 
5389 			/*
5390 			 * ftruncate should not change the ctime and
5391 			 * mtime if we truncate the file to its
5392 			 * previous size.
5393 			 */
5394 			va.va_mask = AT_SIZE;
5395 			error = nfs3getattr(vp, &va, cr);
5396 			if (error || va.va_size == bfp->l_start)
5397 				return (error);
5398 			va.va_mask = AT_SIZE;
5399 			va.va_size = bfp->l_start;
5400 			error = nfs3setattr(vp, &va, 0, cr);
5401 		} else
5402 			error = EINVAL;
5403 	}
5404 
5405 	return (error);
5406 }
5407 
5408 /* ARGSUSED */
5409 static int
5410 nfs3_realvp(vnode_t *vp, vnode_t **vpp)
5411 {
5412 
5413 	return (EINVAL);
5414 }
5415 
5416 /*
5417  * Setup and add an address space callback to do the work of the delmap call.
5418  * The callback will (and must be) deleted in the actual callback function.
5419  *
5420  * This is done in order to take care of the problem that we have with holding
5421  * the address space's a_lock for a long period of time (e.g. if the NFS server
5422  * is down).  Callbacks will be executed in the address space code while the
5423  * a_lock is not held.	Holding the address space's a_lock causes things such
5424  * as ps and fork to hang because they are trying to acquire this lock as well.
5425  */
5426 /* ARGSUSED */
5427 static int
5428 nfs3_delmap(vnode_t *vp, offset_t off, struct as *as, caddr_t addr,
5429 	size_t len, uint_t prot, uint_t maxprot, uint_t flags, cred_t *cr)
5430 {
5431 	int			caller_found;
5432 	int			error;
5433 	rnode_t			*rp;
5434 	nfs_delmap_args_t	*dmapp;
5435 	nfs_delmapcall_t	*delmap_call;
5436 
5437 	if (vp->v_flag & VNOMAP)
5438 		return (ENOSYS);
5439 	/*
5440 	 * A process may not change zones if it has NFS pages mmap'ed
5441 	 * in, so we can't legitimately get here from the wrong zone.
5442 	 */
5443 	ASSERT(nfs_zone() == VTOMI(vp)->mi_zone);
5444 
5445 	rp = VTOR(vp);
5446 
5447 	/*
5448 	 * The way that the address space of this process deletes its mapping
5449 	 * of this file is via the following call chains:
5450 	 * - as_free()->SEGOP_UNMAP()/segvn_unmap()->VOP_DELMAP()/nfs3_delmap()
5451 	 * - as_unmap()->SEGOP_UNMAP()/segvn_unmap()->VOP_DELMAP()/nfs3_delmap()
5452 	 *
5453 	 * With the use of address space callbacks we are allowed to drop the
5454 	 * address space lock, a_lock, while executing the NFS operations that
5455 	 * need to go over the wire.  Returning EAGAIN to the caller of this
5456 	 * function is what drives the execution of the callback that we add
5457 	 * below.  The callback will be executed by the address space code
5458 	 * after dropping the a_lock.  When the callback is finished, since
5459 	 * we dropped the a_lock, it must be re-acquired and segvn_unmap()
5460 	 * is called again on the same segment to finish the rest of the work
5461 	 * that needs to happen during unmapping.
5462 	 *
5463 	 * This action of calling back into the segment driver causes
5464 	 * nfs3_delmap() to get called again, but since the callback was
5465 	 * already executed at this point, it already did the work and there
5466 	 * is nothing left for us to do.
5467 	 *
5468 	 * To Summarize:
5469 	 * - The first time nfs3_delmap is called by the current thread is when
5470 	 * we add the caller associated with this delmap to the delmap caller
5471 	 * list, add the callback, and return EAGAIN.
5472 	 * - The second time in this call chain when nfs3_delmap is called we
5473 	 * will find this caller in the delmap caller list and realize there
5474 	 * is no more work to do thus removing this caller from the list and
5475 	 * returning the error that was set in the callback execution.
5476 	 */
5477 	caller_found = nfs_find_and_delete_delmapcall(rp, &error);
5478 	if (caller_found) {
5479 		/*
5480 		 * 'error' is from the actual delmap operations.  To avoid
5481 		 * hangs, we need to handle the return of EAGAIN differently
5482 		 * since this is what drives the callback execution.
5483 		 * In this case, we don't want to return EAGAIN and do the
5484 		 * callback execution because there are none to execute.
5485 		 */
5486 		if (error == EAGAIN)
5487 			return (0);
5488 		else
5489 			return (error);
5490 	}
5491 
5492 	/* current caller was not in the list */
5493 	delmap_call = nfs_init_delmapcall();
5494 
5495 	mutex_enter(&rp->r_statelock);
5496 	list_insert_tail(&rp->r_indelmap, delmap_call);
5497 	mutex_exit(&rp->r_statelock);
5498 
5499 	dmapp = kmem_alloc(sizeof (nfs_delmap_args_t), KM_SLEEP);
5500 
5501 	dmapp->vp = vp;
5502 	dmapp->off = off;
5503 	dmapp->addr = addr;
5504 	dmapp->len = len;
5505 	dmapp->prot = prot;
5506 	dmapp->maxprot = maxprot;
5507 	dmapp->flags = flags;
5508 	dmapp->cr = cr;
5509 	dmapp->caller = delmap_call;
5510 
5511 	error = as_add_callback(as, nfs3_delmap_callback, dmapp,
5512 	AS_UNMAP_EVENT, addr, len, KM_SLEEP);
5513 
5514 	return (error ? error : EAGAIN);
5515 }
5516 
5517 /*
5518  * Remove some pages from an mmap'd vnode.  Just update the
5519  * count of pages.  If doing close-to-open, then flush and
5520  * commit all of the pages associated with this file.
5521  * Otherwise, start an asynchronous page flush to write out
5522  * any dirty pages.  This will also associate a credential
5523  * with the rnode which can be used to write the pages.
5524  */
5525 /* ARGSUSED */
5526 static void
5527 nfs3_delmap_callback(struct as *as, void *arg, uint_t event)
5528 {
5529 	int			error;
5530 	rnode_t			*rp;
5531 	mntinfo_t		*mi;
5532 	nfs_delmap_args_t	*dmapp = (nfs_delmap_args_t *)arg;
5533 
5534 	rp = VTOR(dmapp->vp);
5535 	mi = VTOMI(dmapp->vp);
5536 
5537 	atomic_add_long((ulong_t *)&rp->r_mapcnt, -btopr(dmapp->len));
5538 	ASSERT(rp->r_mapcnt >= 0);
5539 
5540 	/*
5541 	 * Initiate a page flush and potential commit if there are
5542 	 * pages, the file system was not mounted readonly, the segment
5543 	 * was mapped shared, and the pages themselves were writeable.
5544 	 */
5545 	if (vn_has_cached_data(dmapp->vp) && !vn_is_readonly(dmapp->vp) &&
5546 	    dmapp->flags == MAP_SHARED && (dmapp->maxprot & PROT_WRITE)) {
5547 		mutex_enter(&rp->r_statelock);
5548 		rp->r_flags |= RDIRTY;
5549 		mutex_exit(&rp->r_statelock);
5550 		/*
5551 		 * If this is a cross-zone access a sync putpage won't work, so
5552 		 * the best we can do is try an async putpage.  That seems
5553 		 * better than something more draconian such as discarding the
5554 		 * dirty pages.
5555 		 */
5556 		if ((mi->mi_flags & MI_NOCTO) ||
5557 		    nfs_zone() != mi->mi_zone)
5558 			error = nfs3_putpage(dmapp->vp, dmapp->off, dmapp->len,
5559 			    B_ASYNC, dmapp->cr);
5560 		else
5561 			error = nfs3_putpage_commit(dmapp->vp, dmapp->off,
5562 			    dmapp->len, dmapp->cr);
5563 		if (!error) {
5564 			mutex_enter(&rp->r_statelock);
5565 			error = rp->r_error;
5566 			rp->r_error = 0;
5567 			mutex_exit(&rp->r_statelock);
5568 		}
5569 	} else
5570 		error = 0;
5571 
5572 	if ((rp->r_flags & RDIRECTIO) || (mi->mi_flags & MI_DIRECTIO))
5573 		(void) nfs3_putpage(dmapp->vp, dmapp->off, dmapp->len,
5574 		    B_INVAL, dmapp->cr);
5575 
5576 	dmapp->caller->error = error;
5577 	(void) as_delete_callback(as, arg);
5578 	kmem_free(dmapp, sizeof (nfs_delmap_args_t));
5579 }
5580 
5581 static int nfs3_pathconf_disable_cache = 0;
5582 
5583 #ifdef DEBUG
5584 static int nfs3_pathconf_cache_hits = 0;
5585 static int nfs3_pathconf_cache_misses = 0;
5586 #endif
5587 
5588 static int
5589 nfs3_pathconf(vnode_t *vp, int cmd, ulong_t *valp, cred_t *cr)
5590 {
5591 	int error;
5592 	PATHCONF3args args;
5593 	PATHCONF3res res;
5594 	int douprintf;
5595 	failinfo_t fi;
5596 	rnode_t *rp;
5597 	hrtime_t t;
5598 
5599 	if (nfs_zone() != VTOMI(vp)->mi_zone)
5600 		return (EIO);
5601 	/*
5602 	 * Large file spec - need to base answer on info stored
5603 	 * on original FSINFO response.
5604 	 */
5605 	if (cmd == _PC_FILESIZEBITS) {
5606 		unsigned long long ll;
5607 		long l = 1;
5608 
5609 		ll = VTOMI(vp)->mi_maxfilesize;
5610 
5611 		if (ll == 0) {
5612 			*valp = 0;
5613 			return (0);
5614 		}
5615 
5616 		if (ll & 0xffffffff00000000) {
5617 			l += 32; ll >>= 32;
5618 		}
5619 		if (ll & 0xffff0000) {
5620 			l += 16; ll >>= 16;
5621 		}
5622 		if (ll & 0xff00) {
5623 			l += 8; ll >>= 8;
5624 		}
5625 		if (ll & 0xf0) {
5626 			l += 4; ll >>= 4;
5627 		}
5628 		if (ll & 0xc) {
5629 			l += 2; ll >>= 2;
5630 		}
5631 		if (ll & 0x2)
5632 			l += 2;
5633 		else if (ll & 0x1)
5634 			l += 1;
5635 		*valp = l;
5636 		return (0);
5637 	}
5638 
5639 	if (cmd == _PC_ACL_ENABLED) {
5640 		*valp = _ACL_ACLENT_ENABLED;
5641 		return (0);
5642 	}
5643 
5644 	if (cmd == _PC_XATTR_EXISTS) {
5645 		error = 0;
5646 		*valp = 0;
5647 		if (vp->v_vfsp->vfs_flag & VFS_XATTR) {
5648 			vnode_t *avp;
5649 			rnode_t *rp;
5650 			int error = 0;
5651 			mntinfo_t *mi = VTOMI(vp);
5652 
5653 			if (!(mi->mi_flags & MI_EXTATTR))
5654 				return (0);
5655 
5656 			rp = VTOR(vp);
5657 			if (nfs_rw_enter_sig(&rp->r_rwlock, RW_READER,
5658 			    INTR(vp)))
5659 				return (EINTR);
5660 
5661 			error = nfs3lookup_dnlc(vp, XATTR_DIR_NAME, &avp, cr);
5662 			if (error || avp == NULL)
5663 				error = acl_getxattrdir3(vp, &avp, 0, cr, 0);
5664 
5665 			nfs_rw_exit(&rp->r_rwlock);
5666 
5667 			if (error == 0 && avp != NULL) {
5668 				VN_RELE(avp);
5669 				*valp = 1;
5670 			} else if (error == ENOENT)
5671 				error = 0;
5672 		}
5673 		return (error);
5674 	}
5675 
5676 	rp = VTOR(vp);
5677 	if (rp->r_pathconf != NULL) {
5678 		mutex_enter(&rp->r_statelock);
5679 		if (rp->r_pathconf != NULL && nfs3_pathconf_disable_cache) {
5680 			kmem_free(rp->r_pathconf, sizeof (*rp->r_pathconf));
5681 			rp->r_pathconf = NULL;
5682 		}
5683 		if (rp->r_pathconf != NULL) {
5684 			error = 0;
5685 			switch (cmd) {
5686 			case _PC_LINK_MAX:
5687 				*valp = rp->r_pathconf->link_max;
5688 				break;
5689 			case _PC_NAME_MAX:
5690 				*valp = rp->r_pathconf->name_max;
5691 				break;
5692 			case _PC_PATH_MAX:
5693 			case _PC_SYMLINK_MAX:
5694 				*valp = MAXPATHLEN;
5695 				break;
5696 			case _PC_CHOWN_RESTRICTED:
5697 				*valp = rp->r_pathconf->chown_restricted;
5698 				break;
5699 			case _PC_NO_TRUNC:
5700 				*valp = rp->r_pathconf->no_trunc;
5701 				break;
5702 			default:
5703 				error = EINVAL;
5704 				break;
5705 			}
5706 			mutex_exit(&rp->r_statelock);
5707 #ifdef DEBUG
5708 			nfs3_pathconf_cache_hits++;
5709 #endif
5710 			return (error);
5711 		}
5712 		mutex_exit(&rp->r_statelock);
5713 	}
5714 #ifdef DEBUG
5715 	nfs3_pathconf_cache_misses++;
5716 #endif
5717 
5718 	args.object = *VTOFH3(vp);
5719 	fi.vp = vp;
5720 	fi.fhp = (caddr_t)&args.object;
5721 	fi.copyproc = nfs3copyfh;
5722 	fi.lookupproc = nfs3lookup;
5723 	fi.xattrdirproc = acl_getxattrdir3;
5724 
5725 	douprintf = 1;
5726 
5727 	t = gethrtime();
5728 
5729 	error = rfs3call(VTOMI(vp), NFSPROC3_PATHCONF,
5730 	    xdr_nfs_fh3, (caddr_t)&args,
5731 	    xdr_PATHCONF3res, (caddr_t)&res, cr,
5732 	    &douprintf, &res.status, 0, &fi);
5733 
5734 	if (error)
5735 		return (error);
5736 
5737 	error = geterrno3(res.status);
5738 
5739 	if (!error) {
5740 		nfs3_cache_post_op_attr(vp, &res.resok.obj_attributes, t, cr);
5741 		if (!nfs3_pathconf_disable_cache) {
5742 			mutex_enter(&rp->r_statelock);
5743 			if (rp->r_pathconf == NULL) {
5744 				rp->r_pathconf = kmem_alloc(
5745 				    sizeof (*rp->r_pathconf), KM_NOSLEEP);
5746 				if (rp->r_pathconf != NULL)
5747 					*rp->r_pathconf = res.resok.info;
5748 			}
5749 			mutex_exit(&rp->r_statelock);
5750 		}
5751 		switch (cmd) {
5752 		case _PC_LINK_MAX:
5753 			*valp = res.resok.info.link_max;
5754 			break;
5755 		case _PC_NAME_MAX:
5756 			*valp = res.resok.info.name_max;
5757 			break;
5758 		case _PC_PATH_MAX:
5759 		case _PC_SYMLINK_MAX:
5760 			*valp = MAXPATHLEN;
5761 			break;
5762 		case _PC_CHOWN_RESTRICTED:
5763 			*valp = res.resok.info.chown_restricted;
5764 			break;
5765 		case _PC_NO_TRUNC:
5766 			*valp = res.resok.info.no_trunc;
5767 			break;
5768 		default:
5769 			return (EINVAL);
5770 		}
5771 	} else {
5772 		nfs3_cache_post_op_attr(vp, &res.resfail.obj_attributes, t, cr);
5773 		PURGE_STALE_FH(error, vp, cr);
5774 	}
5775 
5776 	return (error);
5777 }
5778 
5779 /*
5780  * Called by async thread to do synchronous pageio. Do the i/o, wait
5781  * for it to complete, and cleanup the page list when done.
5782  */
5783 static int
5784 nfs3_sync_pageio(vnode_t *vp, page_t *pp, u_offset_t io_off, size_t io_len,
5785 	int flags, cred_t *cr)
5786 {
5787 	int error;
5788 
5789 	ASSERT(nfs_zone() == VTOMI(vp)->mi_zone);
5790 	error = nfs3_rdwrlbn(vp, pp, io_off, io_len, flags, cr);
5791 	if (flags & B_READ)
5792 		pvn_read_done(pp, (error ? B_ERROR : 0) | flags);
5793 	else
5794 		pvn_write_done(pp, (error ? B_ERROR : 0) | flags);
5795 	return (error);
5796 }
5797 
5798 static int
5799 nfs3_pageio(vnode_t *vp, page_t *pp, u_offset_t io_off, size_t io_len,
5800 	int flags, cred_t *cr)
5801 {
5802 	int error;
5803 	rnode_t *rp;
5804 
5805 	if (pp == NULL)
5806 		return (EINVAL);
5807 	if (!(flags & B_ASYNC) && nfs_zone() != VTOMI(vp)->mi_zone)
5808 		return (EIO);
5809 
5810 	rp = VTOR(vp);
5811 	mutex_enter(&rp->r_statelock);
5812 	rp->r_count++;
5813 	mutex_exit(&rp->r_statelock);
5814 
5815 	if (flags & B_ASYNC) {
5816 		error = nfs_async_pageio(vp, pp, io_off, io_len, flags, cr,
5817 		    nfs3_sync_pageio);
5818 	} else
5819 		error = nfs3_rdwrlbn(vp, pp, io_off, io_len, flags, cr);
5820 	mutex_enter(&rp->r_statelock);
5821 	rp->r_count--;
5822 	cv_broadcast(&rp->r_cv);
5823 	mutex_exit(&rp->r_statelock);
5824 	return (error);
5825 }
5826 
5827 static void
5828 nfs3_dispose(vnode_t *vp, page_t *pp, int fl, int dn, cred_t *cr)
5829 {
5830 	int error;
5831 	rnode_t *rp;
5832 	page_t *plist;
5833 	page_t *pptr;
5834 	offset3 offset;
5835 	count3 len;
5836 	k_sigset_t smask;
5837 
5838 	/*
5839 	 * We should get called with fl equal to either B_FREE or
5840 	 * B_INVAL.  Any other value is illegal.
5841 	 *
5842 	 * The page that we are either supposed to free or destroy
5843 	 * should be exclusive locked and its io lock should not
5844 	 * be held.
5845 	 */
5846 	ASSERT(fl == B_FREE || fl == B_INVAL);
5847 	ASSERT((PAGE_EXCL(pp) && !page_iolock_assert(pp)) || panicstr);
5848 	rp = VTOR(vp);
5849 
5850 	/*
5851 	 * If the page doesn't need to be committed or we shouldn't
5852 	 * even bother attempting to commit it, then just make sure
5853 	 * that the p_fsdata byte is clear and then either free or
5854 	 * destroy the page as appropriate.
5855 	 */
5856 	if (pp->p_fsdata == C_NOCOMMIT || (rp->r_flags & RSTALE)) {
5857 		pp->p_fsdata = C_NOCOMMIT;
5858 		if (fl == B_FREE)
5859 			page_free(pp, dn);
5860 		else
5861 			page_destroy(pp, dn);
5862 		return;
5863 	}
5864 
5865 	/*
5866 	 * If there is a page invalidation operation going on, then
5867 	 * if this is one of the pages being destroyed, then just
5868 	 * clear the p_fsdata byte and then either free or destroy
5869 	 * the page as appropriate.
5870 	 */
5871 	mutex_enter(&rp->r_statelock);
5872 	if ((rp->r_flags & RTRUNCATE) && pp->p_offset >= rp->r_truncaddr) {
5873 		mutex_exit(&rp->r_statelock);
5874 		pp->p_fsdata = C_NOCOMMIT;
5875 		if (fl == B_FREE)
5876 			page_free(pp, dn);
5877 		else
5878 			page_destroy(pp, dn);
5879 		return;
5880 	}
5881 
5882 	/*
5883 	 * If we are freeing this page and someone else is already
5884 	 * waiting to do a commit, then just unlock the page and
5885 	 * return.  That other thread will take care of commiting
5886 	 * this page.  The page can be freed sometime after the
5887 	 * commit has finished.  Otherwise, if the page is marked
5888 	 * as delay commit, then we may be getting called from
5889 	 * pvn_write_done, one page at a time.   This could result
5890 	 * in one commit per page, so we end up doing lots of small
5891 	 * commits instead of fewer larger commits.  This is bad,
5892 	 * we want do as few commits as possible.
5893 	 */
5894 	if (fl == B_FREE) {
5895 		if (rp->r_flags & RCOMMITWAIT) {
5896 			page_unlock(pp);
5897 			mutex_exit(&rp->r_statelock);
5898 			return;
5899 		}
5900 		if (pp->p_fsdata == C_DELAYCOMMIT) {
5901 			pp->p_fsdata = C_COMMIT;
5902 			page_unlock(pp);
5903 			mutex_exit(&rp->r_statelock);
5904 			return;
5905 		}
5906 	}
5907 
5908 	/*
5909 	 * Check to see if there is a signal which would prevent an
5910 	 * attempt to commit the pages from being successful.  If so,
5911 	 * then don't bother with all of the work to gather pages and
5912 	 * generate the unsuccessful RPC.  Just return from here and
5913 	 * let the page be committed at some later time.
5914 	 */
5915 	sigintr(&smask, VTOMI(vp)->mi_flags & MI_INT);
5916 	if (ttolwp(curthread) != NULL && ISSIG(curthread, JUSTLOOKING)) {
5917 		sigunintr(&smask);
5918 		page_unlock(pp);
5919 		mutex_exit(&rp->r_statelock);
5920 		return;
5921 	}
5922 	sigunintr(&smask);
5923 
5924 	/*
5925 	 * We are starting to need to commit pages, so let's try
5926 	 * to commit as many as possible at once to reduce the
5927 	 * overhead.
5928 	 *
5929 	 * Set the `commit inprogress' state bit.  We must
5930 	 * first wait until any current one finishes.  Then
5931 	 * we initialize the c_pages list with this page.
5932 	 */
5933 	while (rp->r_flags & RCOMMIT) {
5934 		rp->r_flags |= RCOMMITWAIT;
5935 		cv_wait(&rp->r_commit.c_cv, &rp->r_statelock);
5936 		rp->r_flags &= ~RCOMMITWAIT;
5937 	}
5938 	rp->r_flags |= RCOMMIT;
5939 	mutex_exit(&rp->r_statelock);
5940 	ASSERT(rp->r_commit.c_pages == NULL);
5941 	rp->r_commit.c_pages = pp;
5942 	rp->r_commit.c_commbase = (offset3)pp->p_offset;
5943 	rp->r_commit.c_commlen = PAGESIZE;
5944 
5945 	/*
5946 	 * Gather together all other pages which can be committed.
5947 	 * They will all be chained off r_commit.c_pages.
5948 	 */
5949 	nfs3_get_commit(vp);
5950 
5951 	/*
5952 	 * Clear the `commit inprogress' status and disconnect
5953 	 * the list of pages to be committed from the rnode.
5954 	 * At this same time, we also save the starting offset
5955 	 * and length of data to be committed on the server.
5956 	 */
5957 	plist = rp->r_commit.c_pages;
5958 	rp->r_commit.c_pages = NULL;
5959 	offset = rp->r_commit.c_commbase;
5960 	len = rp->r_commit.c_commlen;
5961 	mutex_enter(&rp->r_statelock);
5962 	rp->r_flags &= ~RCOMMIT;
5963 	cv_broadcast(&rp->r_commit.c_cv);
5964 	mutex_exit(&rp->r_statelock);
5965 
5966 	if (curproc == proc_pageout || curproc == proc_fsflush ||
5967 	    nfs_zone() != VTOMI(vp)->mi_zone) {
5968 		nfs_async_commit(vp, plist, offset, len, cr, nfs3_async_commit);
5969 		return;
5970 	}
5971 
5972 	/*
5973 	 * Actually generate the COMMIT3 over the wire operation.
5974 	 */
5975 	error = nfs3_commit(vp, offset, len, cr);
5976 
5977 	/*
5978 	 * If we got an error during the commit, just unlock all
5979 	 * of the pages.  The pages will get retransmitted to the
5980 	 * server during a putpage operation.
5981 	 */
5982 	if (error) {
5983 		while (plist != NULL) {
5984 			pptr = plist;
5985 			page_sub(&plist, pptr);
5986 			page_unlock(pptr);
5987 		}
5988 		return;
5989 	}
5990 
5991 	/*
5992 	 * We've tried as hard as we can to commit the data to stable
5993 	 * storage on the server.  We release the rest of the pages
5994 	 * and clear the commit required state.  They will be put
5995 	 * onto the tail of the cachelist if they are nolonger
5996 	 * mapped.
5997 	 */
5998 	while (plist != pp) {
5999 		pptr = plist;
6000 		page_sub(&plist, pptr);
6001 		pptr->p_fsdata = C_NOCOMMIT;
6002 		(void) page_release(pptr, 1);
6003 	}
6004 
6005 	/*
6006 	 * It is possible that nfs3_commit didn't return error but
6007 	 * some other thread has modified the page we are going
6008 	 * to free/destroy.
6009 	 *    In this case we need to rewrite the page. Do an explicit check
6010 	 * before attempting to free/destroy the page. If modified, needs to
6011 	 * be rewritten so unlock the page and return.
6012 	 */
6013 	if (hat_ismod(pp)) {
6014 		pp->p_fsdata = C_NOCOMMIT;
6015 		page_unlock(pp);
6016 		return;
6017 	}
6018 
6019 	/*
6020 	 * Now, as appropriate, either free or destroy the page
6021 	 * that we were called with.
6022 	 */
6023 	pp->p_fsdata = C_NOCOMMIT;
6024 	if (fl == B_FREE)
6025 		page_free(pp, dn);
6026 	else
6027 		page_destroy(pp, dn);
6028 }
6029 
6030 static int
6031 nfs3_commit(vnode_t *vp, offset3 offset, count3 count, cred_t *cr)
6032 {
6033 	int error;
6034 	rnode_t *rp;
6035 	COMMIT3args args;
6036 	COMMIT3res res;
6037 	int douprintf;
6038 	cred_t *cred;
6039 
6040 	rp = VTOR(vp);
6041 	ASSERT(nfs_zone() == VTOMI(vp)->mi_zone);
6042 
6043 	mutex_enter(&rp->r_statelock);
6044 	if (rp->r_cred != NULL) {
6045 		cred = rp->r_cred;
6046 		crhold(cred);
6047 	} else {
6048 		rp->r_cred = cr;
6049 		crhold(cr);
6050 		cred = cr;
6051 		crhold(cred);
6052 	}
6053 	mutex_exit(&rp->r_statelock);
6054 
6055 	args.file = *VTOFH3(vp);
6056 	args.offset = offset;
6057 	args.count = count;
6058 
6059 doitagain:
6060 	douprintf = 1;
6061 	error = rfs3call(VTOMI(vp), NFSPROC3_COMMIT,
6062 	    xdr_COMMIT3args, (caddr_t)&args,
6063 	    xdr_COMMIT3res, (caddr_t)&res, cred,
6064 	    &douprintf, &res.status, 0, NULL);
6065 
6066 	crfree(cred);
6067 
6068 	if (error)
6069 		return (error);
6070 
6071 	error = geterrno3(res.status);
6072 	if (!error) {
6073 		ASSERT(rp->r_flags & RHAVEVERF);
6074 		mutex_enter(&rp->r_statelock);
6075 		if (rp->r_verf == res.resok.verf) {
6076 			mutex_exit(&rp->r_statelock);
6077 			return (0);
6078 		}
6079 		nfs3_set_mod(vp);
6080 		rp->r_verf = res.resok.verf;
6081 		mutex_exit(&rp->r_statelock);
6082 		error = NFS_VERF_MISMATCH;
6083 	} else {
6084 		if (error == EACCES) {
6085 			mutex_enter(&rp->r_statelock);
6086 			if (cred != cr) {
6087 				if (rp->r_cred != NULL)
6088 					crfree(rp->r_cred);
6089 				rp->r_cred = cr;
6090 				crhold(cr);
6091 				cred = cr;
6092 				crhold(cred);
6093 				mutex_exit(&rp->r_statelock);
6094 				goto doitagain;
6095 			}
6096 			mutex_exit(&rp->r_statelock);
6097 		}
6098 		/*
6099 		 * Can't do a PURGE_STALE_FH here because this
6100 		 * can cause a deadlock.  nfs3_commit can
6101 		 * be called from nfs3_dispose which can be called
6102 		 * indirectly via pvn_vplist_dirty.  PURGE_STALE_FH
6103 		 * can call back to pvn_vplist_dirty.
6104 		 */
6105 		if (error == ESTALE) {
6106 			mutex_enter(&rp->r_statelock);
6107 			rp->r_flags |= RSTALE;
6108 			if (!rp->r_error)
6109 				rp->r_error = error;
6110 			mutex_exit(&rp->r_statelock);
6111 			PURGE_ATTRCACHE(vp);
6112 		} else {
6113 			mutex_enter(&rp->r_statelock);
6114 			if (!rp->r_error)
6115 				rp->r_error = error;
6116 			mutex_exit(&rp->r_statelock);
6117 		}
6118 	}
6119 
6120 	return (error);
6121 }
6122 
6123 static void
6124 nfs3_set_mod(vnode_t *vp)
6125 {
6126 	page_t *pp;
6127 	kmutex_t *vphm;
6128 
6129 	ASSERT(nfs_zone() == VTOMI(vp)->mi_zone);
6130 	vphm = page_vnode_mutex(vp);
6131 	mutex_enter(vphm);
6132 	if ((pp = vp->v_pages) != NULL) {
6133 		do {
6134 			if (pp->p_fsdata != C_NOCOMMIT) {
6135 				hat_setmod(pp);
6136 				pp->p_fsdata = C_NOCOMMIT;
6137 			}
6138 		} while ((pp = pp->p_vpnext) != vp->v_pages);
6139 	}
6140 	mutex_exit(vphm);
6141 }
6142 
6143 
6144 /*
6145  * This routine is used to gather together a page list of the pages
6146  * which are to be committed on the server.  This routine must not
6147  * be called if the calling thread holds any locked pages.
6148  *
6149  * The calling thread must have set RCOMMIT.  This bit is used to
6150  * serialize access to the commit structure in the rnode.  As long
6151  * as the thread has set RCOMMIT, then it can manipulate the commit
6152  * structure without requiring any other locks.
6153  */
6154 static void
6155 nfs3_get_commit(vnode_t *vp)
6156 {
6157 	rnode_t *rp;
6158 	page_t *pp;
6159 	kmutex_t *vphm;
6160 
6161 	rp = VTOR(vp);
6162 
6163 	ASSERT(rp->r_flags & RCOMMIT);
6164 
6165 	vphm = page_vnode_mutex(vp);
6166 	mutex_enter(vphm);
6167 
6168 	/*
6169 	 * If there are no pages associated with this vnode, then
6170 	 * just return.
6171 	 */
6172 	if ((pp = vp->v_pages) == NULL) {
6173 		mutex_exit(vphm);
6174 		return;
6175 	}
6176 
6177 	/*
6178 	 * Step through all of the pages associated with this vnode
6179 	 * looking for pages which need to be committed.
6180 	 */
6181 	do {
6182 		/*
6183 		 * If this page does not need to be committed or is
6184 		 * modified, then just skip it.
6185 		 */
6186 		if (pp->p_fsdata == C_NOCOMMIT || hat_ismod(pp))
6187 			continue;
6188 
6189 		/*
6190 		 * Attempt to lock the page.  If we can't, then
6191 		 * someone else is messing with it and we will
6192 		 * just skip it.
6193 		 */
6194 		if (!page_trylock(pp, SE_EXCL))
6195 			continue;
6196 
6197 		/*
6198 		 * If this page does not need to be committed or is
6199 		 * modified, then just skip it.  Recheck now that
6200 		 * the page is locked.
6201 		 */
6202 		if (pp->p_fsdata == C_NOCOMMIT || hat_ismod(pp)) {
6203 			page_unlock(pp);
6204 			continue;
6205 		}
6206 
6207 		if (PP_ISFREE(pp)) {
6208 			cmn_err(CE_PANIC, "nfs3_get_commit: %p is free",
6209 			    (void *)pp);
6210 		}
6211 
6212 		/*
6213 		 * The page needs to be committed and we locked it.
6214 		 * Update the base and length parameters and add it
6215 		 * to r_pages.
6216 		 */
6217 		if (rp->r_commit.c_pages == NULL) {
6218 			rp->r_commit.c_commbase = (offset3)pp->p_offset;
6219 			rp->r_commit.c_commlen = PAGESIZE;
6220 		} else if (pp->p_offset < rp->r_commit.c_commbase) {
6221 			rp->r_commit.c_commlen = rp->r_commit.c_commbase -
6222 			    (offset3)pp->p_offset + rp->r_commit.c_commlen;
6223 			rp->r_commit.c_commbase = (offset3)pp->p_offset;
6224 		} else if ((rp->r_commit.c_commbase + rp->r_commit.c_commlen)
6225 			    <= pp->p_offset) {
6226 			rp->r_commit.c_commlen = (offset3)pp->p_offset -
6227 			    rp->r_commit.c_commbase + PAGESIZE;
6228 		}
6229 		page_add(&rp->r_commit.c_pages, pp);
6230 	} while ((pp = pp->p_vpnext) != vp->v_pages);
6231 
6232 	mutex_exit(vphm);
6233 }
6234 
6235 /*
6236  * This routine is used to gather together a page list of the pages
6237  * which are to be committed on the server.  This routine must not
6238  * be called if the calling thread holds any locked pages.
6239  *
6240  * The calling thread must have set RCOMMIT.  This bit is used to
6241  * serialize access to the commit structure in the rnode.  As long
6242  * as the thread has set RCOMMIT, then it can manipulate the commit
6243  * structure without requiring any other locks.
6244  */
6245 static void
6246 nfs3_get_commit_range(vnode_t *vp, u_offset_t soff, size_t len)
6247 {
6248 
6249 	rnode_t *rp;
6250 	page_t *pp;
6251 	u_offset_t end;
6252 	u_offset_t off;
6253 
6254 	ASSERT(len != 0);
6255 
6256 	rp = VTOR(vp);
6257 
6258 	ASSERT(rp->r_flags & RCOMMIT);
6259 	ASSERT(nfs_zone() == VTOMI(vp)->mi_zone);
6260 
6261 	/*
6262 	 * If there are no pages associated with this vnode, then
6263 	 * just return.
6264 	 */
6265 	if ((pp = vp->v_pages) == NULL)
6266 		return;
6267 
6268 	/*
6269 	 * Calculate the ending offset.
6270 	 */
6271 	end = soff + len;
6272 
6273 	for (off = soff; off < end; off += PAGESIZE) {
6274 		/*
6275 		 * Lookup each page by vp, offset.
6276 		 */
6277 		if ((pp = page_lookup_nowait(vp, off, SE_EXCL)) == NULL)
6278 			continue;
6279 
6280 		/*
6281 		 * If this page does not need to be committed or is
6282 		 * modified, then just skip it.
6283 		 */
6284 		if (pp->p_fsdata == C_NOCOMMIT || hat_ismod(pp)) {
6285 			page_unlock(pp);
6286 			continue;
6287 		}
6288 
6289 		ASSERT(PP_ISFREE(pp) == 0);
6290 
6291 		/*
6292 		 * The page needs to be committed and we locked it.
6293 		 * Update the base and length parameters and add it
6294 		 * to r_pages.
6295 		 */
6296 		if (rp->r_commit.c_pages == NULL) {
6297 			rp->r_commit.c_commbase = (offset3)pp->p_offset;
6298 			rp->r_commit.c_commlen = PAGESIZE;
6299 		} else {
6300 			rp->r_commit.c_commlen = (offset3)pp->p_offset -
6301 					rp->r_commit.c_commbase + PAGESIZE;
6302 		}
6303 		page_add(&rp->r_commit.c_pages, pp);
6304 	}
6305 }
6306 
6307 #if 0	/* unused */
6308 #ifdef DEBUG
6309 static int
6310 nfs3_no_uncommitted_pages(vnode_t *vp)
6311 {
6312 	page_t *pp;
6313 	kmutex_t *vphm;
6314 
6315 	vphm = page_vnode_mutex(vp);
6316 	mutex_enter(vphm);
6317 	if ((pp = vp->v_pages) != NULL) {
6318 		do {
6319 			if (pp->p_fsdata != C_NOCOMMIT) {
6320 				mutex_exit(vphm);
6321 				return (0);
6322 			}
6323 		} while ((pp = pp->p_vpnext) != vp->v_pages);
6324 	}
6325 	mutex_exit(vphm);
6326 
6327 	return (1);
6328 }
6329 #endif
6330 #endif
6331 
6332 static int
6333 nfs3_putpage_commit(vnode_t *vp, offset_t poff, size_t plen, cred_t *cr)
6334 {
6335 	int error;
6336 	writeverf3 write_verf;
6337 	rnode_t *rp = VTOR(vp);
6338 
6339 	ASSERT(nfs_zone() == VTOMI(vp)->mi_zone);
6340 	/*
6341 	 * Flush the data portion of the file and then commit any
6342 	 * portions which need to be committed.  This may need to
6343 	 * be done twice if the server has changed state since
6344 	 * data was last written.  The data will need to be
6345 	 * rewritten to the server and then a new commit done.
6346 	 *
6347 	 * In fact, this may need to be done several times if the
6348 	 * server is having problems and crashing while we are
6349 	 * attempting to do this.
6350 	 */
6351 
6352 top:
6353 	/*
6354 	 * Do a flush based on the poff and plen arguments.  This
6355 	 * will asynchronously write out any modified pages in the
6356 	 * range specified by (poff, plen).  This starts all of the
6357 	 * i/o operations which will be waited for in the next
6358 	 * call to nfs3_putpage
6359 	 */
6360 
6361 	mutex_enter(&rp->r_statelock);
6362 	write_verf = rp->r_verf;
6363 	mutex_exit(&rp->r_statelock);
6364 
6365 	error = nfs3_putpage(vp, poff, plen, B_ASYNC, cr);
6366 	if (error == EAGAIN)
6367 		error = 0;
6368 
6369 	/*
6370 	 * Do a flush based on the poff and plen arguments.  This
6371 	 * will synchronously write out any modified pages in the
6372 	 * range specified by (poff, plen) and wait until all of
6373 	 * the asynchronous i/o's in that range are done as well.
6374 	 */
6375 	if (!error)
6376 		error = nfs3_putpage(vp, poff, plen, 0, cr);
6377 
6378 	if (error)
6379 		return (error);
6380 
6381 	mutex_enter(&rp->r_statelock);
6382 	if (rp->r_verf != write_verf) {
6383 		mutex_exit(&rp->r_statelock);
6384 		goto top;
6385 	}
6386 	mutex_exit(&rp->r_statelock);
6387 
6388 	/*
6389 	 * Now commit any pages which might need to be committed.
6390 	 * If the error, NFS_VERF_MISMATCH, is returned, then
6391 	 * start over with the flush operation.
6392 	 */
6393 
6394 	error = nfs3_commit_vp(vp, poff, plen, cr);
6395 
6396 	if (error == NFS_VERF_MISMATCH)
6397 		goto top;
6398 
6399 	return (error);
6400 }
6401 
6402 static int
6403 nfs3_commit_vp(vnode_t *vp, u_offset_t poff, size_t plen, cred_t *cr)
6404 {
6405 	rnode_t *rp;
6406 	page_t *plist;
6407 	offset3 offset;
6408 	count3 len;
6409 
6410 
6411 	rp = VTOR(vp);
6412 
6413 	if (nfs_zone() != VTOMI(vp)->mi_zone)
6414 		return (EIO);
6415 	/*
6416 	 * Set the `commit inprogress' state bit.  We must
6417 	 * first wait until any current one finishes.
6418 	 */
6419 	mutex_enter(&rp->r_statelock);
6420 	while (rp->r_flags & RCOMMIT) {
6421 		rp->r_flags |= RCOMMITWAIT;
6422 		cv_wait(&rp->r_commit.c_cv, &rp->r_statelock);
6423 		rp->r_flags &= ~RCOMMITWAIT;
6424 	}
6425 	rp->r_flags |= RCOMMIT;
6426 	mutex_exit(&rp->r_statelock);
6427 
6428 	/*
6429 	 * Gather together all of the pages which need to be
6430 	 * committed.
6431 	 */
6432 	if (plen == 0)
6433 		nfs3_get_commit(vp);
6434 	else
6435 		nfs3_get_commit_range(vp, poff, plen);
6436 
6437 	/*
6438 	 * Clear the `commit inprogress' bit and disconnect the
6439 	 * page list which was gathered together in nfs3_get_commit.
6440 	 */
6441 	plist = rp->r_commit.c_pages;
6442 	rp->r_commit.c_pages = NULL;
6443 	offset = rp->r_commit.c_commbase;
6444 	len = rp->r_commit.c_commlen;
6445 	mutex_enter(&rp->r_statelock);
6446 	rp->r_flags &= ~RCOMMIT;
6447 	cv_broadcast(&rp->r_commit.c_cv);
6448 	mutex_exit(&rp->r_statelock);
6449 
6450 	/*
6451 	 * If any pages need to be committed, commit them and
6452 	 * then unlock them so that they can be freed some
6453 	 * time later.
6454 	 */
6455 	if (plist != NULL) {
6456 		/*
6457 		 * No error occurred during the flush portion
6458 		 * of this operation, so now attempt to commit
6459 		 * the data to stable storage on the server.
6460 		 *
6461 		 * This will unlock all of the pages on the list.
6462 		 */
6463 		return (nfs3_sync_commit(vp, plist, offset, len, cr));
6464 	}
6465 	return (0);
6466 }
6467 
6468 static int
6469 nfs3_sync_commit(vnode_t *vp, page_t *plist, offset3 offset, count3 count,
6470 	cred_t *cr)
6471 {
6472 	int error;
6473 	page_t *pp;
6474 
6475 	ASSERT(nfs_zone() == VTOMI(vp)->mi_zone);
6476 	error = nfs3_commit(vp, offset, count, cr);
6477 
6478 	/*
6479 	 * If we got an error, then just unlock all of the pages
6480 	 * on the list.
6481 	 */
6482 	if (error) {
6483 		while (plist != NULL) {
6484 			pp = plist;
6485 			page_sub(&plist, pp);
6486 			page_unlock(pp);
6487 		}
6488 		return (error);
6489 	}
6490 	/*
6491 	 * We've tried as hard as we can to commit the data to stable
6492 	 * storage on the server.  We just unlock the pages and clear
6493 	 * the commit required state.  They will get freed later.
6494 	 */
6495 	while (plist != NULL) {
6496 		pp = plist;
6497 		page_sub(&plist, pp);
6498 		pp->p_fsdata = C_NOCOMMIT;
6499 		page_unlock(pp);
6500 	}
6501 
6502 	return (error);
6503 }
6504 
6505 static void
6506 nfs3_async_commit(vnode_t *vp, page_t *plist, offset3 offset, count3 count,
6507 	cred_t *cr)
6508 {
6509 	ASSERT(nfs_zone() == VTOMI(vp)->mi_zone);
6510 	(void) nfs3_sync_commit(vp, plist, offset, count, cr);
6511 }
6512 
6513 static int
6514 nfs3_setsecattr(vnode_t *vp, vsecattr_t *vsecattr, int flag, cred_t *cr)
6515 {
6516 	int error;
6517 	mntinfo_t *mi;
6518 
6519 	mi = VTOMI(vp);
6520 
6521 	if (nfs_zone() != mi->mi_zone)
6522 		return (EIO);
6523 
6524 	if (mi->mi_flags & MI_ACL) {
6525 		error = acl_setacl3(vp, vsecattr, flag, cr);
6526 		if (mi->mi_flags & MI_ACL)
6527 			return (error);
6528 	}
6529 
6530 	return (ENOSYS);
6531 }
6532 
6533 static int
6534 nfs3_getsecattr(vnode_t *vp, vsecattr_t *vsecattr, int flag, cred_t *cr)
6535 {
6536 	int error;
6537 	mntinfo_t *mi;
6538 
6539 	mi = VTOMI(vp);
6540 
6541 	if (nfs_zone() != mi->mi_zone)
6542 		return (EIO);
6543 
6544 	if (mi->mi_flags & MI_ACL) {
6545 		error = acl_getacl3(vp, vsecattr, flag, cr);
6546 		if (mi->mi_flags & MI_ACL)
6547 			return (error);
6548 	}
6549 
6550 	return (fs_fab_acl(vp, vsecattr, flag, cr));
6551 }
6552 
6553 static int
6554 nfs3_shrlock(vnode_t *vp, int cmd, struct shrlock *shr, int flag, cred_t *cr)
6555 {
6556 	int error;
6557 	struct shrlock nshr;
6558 	struct nfs_owner nfs_owner;
6559 	netobj lm_fh3;
6560 
6561 	if (nfs_zone() != VTOMI(vp)->mi_zone)
6562 		return (EIO);
6563 
6564 	/*
6565 	 * check for valid cmd parameter
6566 	 */
6567 	if (cmd != F_SHARE && cmd != F_UNSHARE && cmd != F_HASREMOTELOCKS)
6568 		return (EINVAL);
6569 
6570 	/*
6571 	 * Check access permissions
6572 	 */
6573 	if (cmd == F_SHARE &&
6574 	    (((shr->s_access & F_RDACC) && !(flag & FREAD)) ||
6575 	    ((shr->s_access & F_WRACC) && !(flag & FWRITE))))
6576 		return (EBADF);
6577 
6578 	/*
6579 	 * If the filesystem is mounted using local locking, pass the
6580 	 * request off to the local share code.
6581 	 */
6582 	if (VTOMI(vp)->mi_flags & MI_LLOCK)
6583 		return (fs_shrlock(vp, cmd, shr, flag, cr));
6584 
6585 	switch (cmd) {
6586 	case F_SHARE:
6587 	case F_UNSHARE:
6588 		lm_fh3.n_len = VTOFH3(vp)->fh3_length;
6589 		lm_fh3.n_bytes = (char *)&(VTOFH3(vp)->fh3_u.data);
6590 
6591 		/*
6592 		 * If passed an owner that is too large to fit in an
6593 		 * nfs_owner it is likely a recursive call from the
6594 		 * lock manager client and pass it straight through.  If
6595 		 * it is not a nfs_owner then simply return an error.
6596 		 */
6597 		if (shr->s_own_len > sizeof (nfs_owner.lowner)) {
6598 			if (((struct nfs_owner *)shr->s_owner)->magic !=
6599 			    NFS_OWNER_MAGIC)
6600 				return (EINVAL);
6601 
6602 			if (error = lm4_shrlock(vp, cmd, shr, flag, &lm_fh3)) {
6603 				error = set_errno(error);
6604 			}
6605 			return (error);
6606 		}
6607 		/*
6608 		 * Remote share reservations owner is a combination of
6609 		 * a magic number, hostname, and the local owner
6610 		 */
6611 		bzero(&nfs_owner, sizeof (nfs_owner));
6612 		nfs_owner.magic = NFS_OWNER_MAGIC;
6613 		(void) strncpy(nfs_owner.hname, uts_nodename(),
6614 		    sizeof (nfs_owner.hname));
6615 		bcopy(shr->s_owner, nfs_owner.lowner, shr->s_own_len);
6616 		nshr.s_access = shr->s_access;
6617 		nshr.s_deny = shr->s_deny;
6618 		nshr.s_sysid = 0;
6619 		nshr.s_pid = ttoproc(curthread)->p_pid;
6620 		nshr.s_own_len = sizeof (nfs_owner);
6621 		nshr.s_owner = (caddr_t)&nfs_owner;
6622 
6623 		if (error = lm4_shrlock(vp, cmd, &nshr, flag, &lm_fh3)) {
6624 			error = set_errno(error);
6625 		}
6626 
6627 		break;
6628 
6629 	case F_HASREMOTELOCKS:
6630 		/*
6631 		 * NFS client can't store remote locks itself
6632 		 */
6633 		shr->s_access = 0;
6634 		error = 0;
6635 		break;
6636 
6637 	default:
6638 		error = EINVAL;
6639 		break;
6640 	}
6641 
6642 	return (error);
6643 }
6644