xref: /titanic_51/usr/src/uts/common/fs/nfs/nfs3_vnops.c (revision 5bcb2410e22040dbbccab2a152aa4926640c489a)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 /*
22  * Copyright 2010 Sun Microsystems, Inc.  All rights reserved.
23  * Use is subject to license terms.
24  */
25 
26 /*
27  *	Copyright (c) 1983,1984,1985,1986,1987,1988,1989 AT&T.
28  *	All rights reserved.
29  */
30 
31 #include <sys/param.h>
32 #include <sys/types.h>
33 #include <sys/systm.h>
34 #include <sys/cred.h>
35 #include <sys/time.h>
36 #include <sys/vnode.h>
37 #include <sys/vfs.h>
38 #include <sys/vfs_opreg.h>
39 #include <sys/file.h>
40 #include <sys/filio.h>
41 #include <sys/uio.h>
42 #include <sys/buf.h>
43 #include <sys/mman.h>
44 #include <sys/pathname.h>
45 #include <sys/dirent.h>
46 #include <sys/debug.h>
47 #include <sys/vmsystm.h>
48 #include <sys/fcntl.h>
49 #include <sys/flock.h>
50 #include <sys/swap.h>
51 #include <sys/errno.h>
52 #include <sys/strsubr.h>
53 #include <sys/sysmacros.h>
54 #include <sys/kmem.h>
55 #include <sys/cmn_err.h>
56 #include <sys/pathconf.h>
57 #include <sys/utsname.h>
58 #include <sys/dnlc.h>
59 #include <sys/acl.h>
60 #include <sys/systeminfo.h>
61 #include <sys/atomic.h>
62 #include <sys/policy.h>
63 #include <sys/sdt.h>
64 #include <sys/zone.h>
65 
66 #include <rpc/types.h>
67 #include <rpc/auth.h>
68 #include <rpc/clnt.h>
69 #include <rpc/rpc_rdma.h>
70 
71 #include <nfs/nfs.h>
72 #include <nfs/nfs_clnt.h>
73 #include <nfs/rnode.h>
74 #include <nfs/nfs_acl.h>
75 #include <nfs/lm.h>
76 
77 #include <vm/hat.h>
78 #include <vm/as.h>
79 #include <vm/page.h>
80 #include <vm/pvn.h>
81 #include <vm/seg.h>
82 #include <vm/seg_map.h>
83 #include <vm/seg_kpm.h>
84 #include <vm/seg_vn.h>
85 
86 #include <fs/fs_subr.h>
87 
88 #include <sys/ddi.h>
89 
90 static int	nfs3_rdwrlbn(vnode_t *, page_t *, u_offset_t, size_t, int,
91 			cred_t *);
92 static int	nfs3write(vnode_t *, caddr_t, u_offset_t, int, cred_t *,
93 			stable_how *);
94 static int	nfs3read(vnode_t *, caddr_t, offset_t, int, size_t *, cred_t *);
95 static int	nfs3setattr(vnode_t *, struct vattr *, int, cred_t *);
96 static int	nfs3_accessx(void *, int, cred_t *);
97 static int	nfs3lookup_dnlc(vnode_t *, char *, vnode_t **, cred_t *);
98 static int	nfs3lookup_otw(vnode_t *, char *, vnode_t **, cred_t *, int);
99 static int	nfs3create(vnode_t *, char *, struct vattr *, enum vcexcl,
100 			int, vnode_t **, cred_t *, int);
101 static int	nfs3excl_create_settimes(vnode_t *, struct vattr *, cred_t *);
102 static int	nfs3mknod(vnode_t *, char *, struct vattr *, enum vcexcl,
103 			int, vnode_t **, cred_t *);
104 static int	nfs3rename(vnode_t *, char *, vnode_t *, char *, cred_t *,
105 			caller_context_t *);
106 static int	do_nfs3readdir(vnode_t *, rddir_cache *, cred_t *);
107 static void	nfs3readdir(vnode_t *, rddir_cache *, cred_t *);
108 static void	nfs3readdirplus(vnode_t *, rddir_cache *, cred_t *);
109 static int	nfs3_bio(struct buf *, stable_how *, cred_t *);
110 static int	nfs3_getapage(vnode_t *, u_offset_t, size_t, uint_t *,
111 			page_t *[], size_t, struct seg *, caddr_t,
112 			enum seg_rw, cred_t *);
113 static void	nfs3_readahead(vnode_t *, u_offset_t, caddr_t, struct seg *,
114 			cred_t *);
115 static int	nfs3_sync_putapage(vnode_t *, page_t *, u_offset_t, size_t,
116 			int, cred_t *);
117 static int	nfs3_sync_pageio(vnode_t *, page_t *, u_offset_t, size_t,
118 			int, cred_t *);
119 static int	nfs3_commit(vnode_t *, offset3, count3, cred_t *);
120 static void	nfs3_set_mod(vnode_t *);
121 static void	nfs3_get_commit(vnode_t *);
122 static void	nfs3_get_commit_range(vnode_t *, u_offset_t, size_t);
123 static int	nfs3_putpage_commit(vnode_t *, offset_t, size_t, cred_t *);
124 static int	nfs3_commit_vp(vnode_t *, u_offset_t, size_t,  cred_t *);
125 static int	nfs3_sync_commit(vnode_t *, page_t *, offset3, count3,
126 			cred_t *);
127 static void	nfs3_async_commit(vnode_t *, page_t *, offset3, count3,
128 			cred_t *);
129 static void	nfs3_delmap_callback(struct as *, void *, uint_t);
130 
131 /*
132  * Error flags used to pass information about certain special errors
133  * which need to be handled specially.
134  */
135 #define	NFS_EOF			-98
136 #define	NFS_VERF_MISMATCH	-97
137 
138 /* ALIGN64 aligns the given buffer and adjust buffer size to 64 bit */
139 #define	ALIGN64(x, ptr, sz)						\
140 	x = ((uintptr_t)(ptr)) & (sizeof (uint64_t) - 1);		\
141 	if (x) {							\
142 		x = sizeof (uint64_t) - (x);				\
143 		sz -= (x);						\
144 		ptr += (x);						\
145 	}
146 
147 /*
148  * These are the vnode ops routines which implement the vnode interface to
149  * the networked file system.  These routines just take their parameters,
150  * make them look networkish by putting the right info into interface structs,
151  * and then calling the appropriate remote routine(s) to do the work.
152  *
153  * Note on directory name lookup cacheing:  If we detect a stale fhandle,
154  * we purge the directory cache relative to that vnode.  This way, the
155  * user won't get burned by the cache repeatedly.  See <nfs/rnode.h> for
156  * more details on rnode locking.
157  */
158 
159 static int	nfs3_open(vnode_t **, int, cred_t *, caller_context_t *);
160 static int	nfs3_close(vnode_t *, int, int, offset_t, cred_t *,
161 			caller_context_t *);
162 static int	nfs3_read(vnode_t *, struct uio *, int, cred_t *,
163 			caller_context_t *);
164 static int	nfs3_write(vnode_t *, struct uio *, int, cred_t *,
165 			caller_context_t *);
166 static int	nfs3_ioctl(vnode_t *, int, intptr_t, int, cred_t *, int *,
167 			caller_context_t *);
168 static int	nfs3_getattr(vnode_t *, struct vattr *, int, cred_t *,
169 			caller_context_t *);
170 static int	nfs3_setattr(vnode_t *, struct vattr *, int, cred_t *,
171 			caller_context_t *);
172 static int	nfs3_access(vnode_t *, int, int, cred_t *, caller_context_t *);
173 static int	nfs3_readlink(vnode_t *, struct uio *, cred_t *,
174 			caller_context_t *);
175 static int	nfs3_fsync(vnode_t *, int, cred_t *, caller_context_t *);
176 static void	nfs3_inactive(vnode_t *, cred_t *, caller_context_t *);
177 static int	nfs3_lookup(vnode_t *, char *, vnode_t **,
178 			struct pathname *, int, vnode_t *, cred_t *,
179 			caller_context_t *, int *, pathname_t *);
180 static int	nfs3_create(vnode_t *, char *, struct vattr *, enum vcexcl,
181 			int, vnode_t **, cred_t *, int, caller_context_t *,
182 			vsecattr_t *);
183 static int	nfs3_remove(vnode_t *, char *, cred_t *, caller_context_t *,
184 			int);
185 static int	nfs3_link(vnode_t *, vnode_t *, char *, cred_t *,
186 			caller_context_t *, int);
187 static int	nfs3_rename(vnode_t *, char *, vnode_t *, char *, cred_t *,
188 			caller_context_t *, int);
189 static int	nfs3_mkdir(vnode_t *, char *, struct vattr *, vnode_t **,
190 			cred_t *, caller_context_t *, int, vsecattr_t *);
191 static int	nfs3_rmdir(vnode_t *, char *, vnode_t *, cred_t *,
192 			caller_context_t *, int);
193 static int	nfs3_symlink(vnode_t *, char *, struct vattr *, char *,
194 			cred_t *, caller_context_t *, int);
195 static int	nfs3_readdir(vnode_t *, struct uio *, cred_t *, int *,
196 			caller_context_t *, int);
197 static int	nfs3_fid(vnode_t *, fid_t *, caller_context_t *);
198 static int	nfs3_rwlock(vnode_t *, int, caller_context_t *);
199 static void	nfs3_rwunlock(vnode_t *, int, caller_context_t *);
200 static int	nfs3_seek(vnode_t *, offset_t, offset_t *, caller_context_t *);
201 static int	nfs3_getpage(vnode_t *, offset_t, size_t, uint_t *,
202 			page_t *[], size_t, struct seg *, caddr_t,
203 			enum seg_rw, cred_t *, caller_context_t *);
204 static int	nfs3_putpage(vnode_t *, offset_t, size_t, int, cred_t *,
205 			caller_context_t *);
206 static int	nfs3_map(vnode_t *, offset_t, struct as *, caddr_t *, size_t,
207 			uchar_t, uchar_t, uint_t, cred_t *, caller_context_t *);
208 static int	nfs3_addmap(vnode_t *, offset_t, struct as *, caddr_t, size_t,
209 			uchar_t, uchar_t, uint_t, cred_t *, caller_context_t *);
210 static int	nfs3_frlock(vnode_t *, int, struct flock64 *, int, offset_t,
211 			struct flk_callback *, cred_t *, caller_context_t *);
212 static int	nfs3_space(vnode_t *, int, struct flock64 *, int, offset_t,
213 			cred_t *, caller_context_t *);
214 static int	nfs3_realvp(vnode_t *, vnode_t **, caller_context_t *);
215 static int	nfs3_delmap(vnode_t *, offset_t, struct as *, caddr_t, size_t,
216 			uint_t, uint_t, uint_t, cred_t *, caller_context_t *);
217 static int	nfs3_pathconf(vnode_t *, int, ulong_t *, cred_t *,
218 			caller_context_t *);
219 static int	nfs3_pageio(vnode_t *, page_t *, u_offset_t, size_t, int,
220 			cred_t *, caller_context_t *);
221 static void	nfs3_dispose(vnode_t *, page_t *, int, int, cred_t *,
222 			caller_context_t *);
223 static int	nfs3_setsecattr(vnode_t *, vsecattr_t *, int, cred_t *,
224 			caller_context_t *);
225 static int	nfs3_getsecattr(vnode_t *, vsecattr_t *, int, cred_t *,
226 			caller_context_t *);
227 static int	nfs3_shrlock(vnode_t *, int, struct shrlock *, int, cred_t *,
228 			caller_context_t *);
229 
230 struct vnodeops *nfs3_vnodeops;
231 
232 const fs_operation_def_t nfs3_vnodeops_template[] = {
233 	VOPNAME_OPEN,		{ .vop_open = nfs3_open },
234 	VOPNAME_CLOSE,		{ .vop_close = nfs3_close },
235 	VOPNAME_READ,		{ .vop_read = nfs3_read },
236 	VOPNAME_WRITE,		{ .vop_write = nfs3_write },
237 	VOPNAME_IOCTL,		{ .vop_ioctl = nfs3_ioctl },
238 	VOPNAME_GETATTR,	{ .vop_getattr = nfs3_getattr },
239 	VOPNAME_SETATTR,	{ .vop_setattr = nfs3_setattr },
240 	VOPNAME_ACCESS,		{ .vop_access = nfs3_access },
241 	VOPNAME_LOOKUP,		{ .vop_lookup = nfs3_lookup },
242 	VOPNAME_CREATE,		{ .vop_create = nfs3_create },
243 	VOPNAME_REMOVE,		{ .vop_remove = nfs3_remove },
244 	VOPNAME_LINK,		{ .vop_link = nfs3_link },
245 	VOPNAME_RENAME,		{ .vop_rename = nfs3_rename },
246 	VOPNAME_MKDIR,		{ .vop_mkdir = nfs3_mkdir },
247 	VOPNAME_RMDIR,		{ .vop_rmdir = nfs3_rmdir },
248 	VOPNAME_READDIR,	{ .vop_readdir = nfs3_readdir },
249 	VOPNAME_SYMLINK,	{ .vop_symlink = nfs3_symlink },
250 	VOPNAME_READLINK,	{ .vop_readlink = nfs3_readlink },
251 	VOPNAME_FSYNC,		{ .vop_fsync = nfs3_fsync },
252 	VOPNAME_INACTIVE,	{ .vop_inactive = nfs3_inactive },
253 	VOPNAME_FID,		{ .vop_fid = nfs3_fid },
254 	VOPNAME_RWLOCK,		{ .vop_rwlock = nfs3_rwlock },
255 	VOPNAME_RWUNLOCK,	{ .vop_rwunlock = nfs3_rwunlock },
256 	VOPNAME_SEEK,		{ .vop_seek = nfs3_seek },
257 	VOPNAME_FRLOCK,		{ .vop_frlock = nfs3_frlock },
258 	VOPNAME_SPACE,		{ .vop_space = nfs3_space },
259 	VOPNAME_REALVP,		{ .vop_realvp = nfs3_realvp },
260 	VOPNAME_GETPAGE,	{ .vop_getpage = nfs3_getpage },
261 	VOPNAME_PUTPAGE,	{ .vop_putpage = nfs3_putpage },
262 	VOPNAME_MAP,		{ .vop_map = nfs3_map },
263 	VOPNAME_ADDMAP,		{ .vop_addmap = nfs3_addmap },
264 	VOPNAME_DELMAP,		{ .vop_delmap = nfs3_delmap },
265 	/* no separate nfs3_dump */
266 	VOPNAME_DUMP,		{ .vop_dump = nfs_dump },
267 	VOPNAME_PATHCONF,	{ .vop_pathconf = nfs3_pathconf },
268 	VOPNAME_PAGEIO,		{ .vop_pageio = nfs3_pageio },
269 	VOPNAME_DISPOSE,	{ .vop_dispose = nfs3_dispose },
270 	VOPNAME_SETSECATTR,	{ .vop_setsecattr = nfs3_setsecattr },
271 	VOPNAME_GETSECATTR,	{ .vop_getsecattr = nfs3_getsecattr },
272 	VOPNAME_SHRLOCK,	{ .vop_shrlock = nfs3_shrlock },
273 	VOPNAME_VNEVENT, 	{ .vop_vnevent = fs_vnevent_support },
274 	NULL,			NULL
275 };
276 
277 /*
278  * XXX:  This is referenced in modstubs.s
279  */
280 struct vnodeops *
281 nfs3_getvnodeops(void)
282 {
283 	return (nfs3_vnodeops);
284 }
285 
286 /* ARGSUSED */
287 static int
288 nfs3_open(vnode_t **vpp, int flag, cred_t *cr, caller_context_t *ct)
289 {
290 	int error;
291 	struct vattr va;
292 	rnode_t *rp;
293 	vnode_t *vp;
294 
295 	vp = *vpp;
296 	if (nfs_zone() != VTOMI(vp)->mi_zone)
297 		return (EIO);
298 	rp = VTOR(vp);
299 	mutex_enter(&rp->r_statelock);
300 	if (rp->r_cred == NULL) {
301 		crhold(cr);
302 		rp->r_cred = cr;
303 	}
304 	mutex_exit(&rp->r_statelock);
305 
306 	/*
307 	 * If there is no cached data or if close-to-open
308 	 * consistency checking is turned off, we can avoid
309 	 * the over the wire getattr.  Otherwise, if the
310 	 * file system is mounted readonly, then just verify
311 	 * the caches are up to date using the normal mechanism.
312 	 * Else, if the file is not mmap'd, then just mark
313 	 * the attributes as timed out.  They will be refreshed
314 	 * and the caches validated prior to being used.
315 	 * Else, the file system is mounted writeable so
316 	 * force an over the wire GETATTR in order to ensure
317 	 * that all cached data is valid.
318 	 */
319 	if (vp->v_count > 1 ||
320 	    ((vn_has_cached_data(vp) || HAVE_RDDIR_CACHE(rp)) &&
321 	    !(VTOMI(vp)->mi_flags & MI_NOCTO))) {
322 		if (vn_is_readonly(vp))
323 			error = nfs3_validate_caches(vp, cr);
324 		else if (rp->r_mapcnt == 0 && vp->v_count == 1) {
325 			PURGE_ATTRCACHE(vp);
326 			error = 0;
327 		} else {
328 			va.va_mask = AT_ALL;
329 			error = nfs3_getattr_otw(vp, &va, cr);
330 		}
331 	} else
332 		error = 0;
333 
334 	return (error);
335 }
336 
337 /* ARGSUSED */
338 static int
339 nfs3_close(vnode_t *vp, int flag, int count, offset_t offset, cred_t *cr,
340 		caller_context_t *ct)
341 {
342 	rnode_t *rp;
343 	int error;
344 	struct vattr va;
345 
346 	/*
347 	 * zone_enter(2) prevents processes from changing zones with NFS files
348 	 * open; if we happen to get here from the wrong zone we can't do
349 	 * anything over the wire.
350 	 */
351 	if (VTOMI(vp)->mi_zone != nfs_zone()) {
352 		/*
353 		 * We could attempt to clean up locks, except we're sure
354 		 * that the current process didn't acquire any locks on
355 		 * the file: any attempt to lock a file belong to another zone
356 		 * will fail, and one can't lock an NFS file and then change
357 		 * zones, as that fails too.
358 		 *
359 		 * Returning an error here is the sane thing to do.  A
360 		 * subsequent call to VN_RELE() which translates to a
361 		 * nfs3_inactive() will clean up state: if the zone of the
362 		 * vnode's origin is still alive and kicking, an async worker
363 		 * thread will handle the request (from the correct zone), and
364 		 * everything (minus the commit and final nfs3_getattr_otw()
365 		 * call) should be OK. If the zone is going away
366 		 * nfs_async_inactive() will throw away cached pages inline.
367 		 */
368 		return (EIO);
369 	}
370 
371 	/*
372 	 * If we are using local locking for this filesystem, then
373 	 * release all of the SYSV style record locks.  Otherwise,
374 	 * we are doing network locking and we need to release all
375 	 * of the network locks.  All of the locks held by this
376 	 * process on this file are released no matter what the
377 	 * incoming reference count is.
378 	 */
379 	if (VTOMI(vp)->mi_flags & MI_LLOCK) {
380 		cleanlocks(vp, ttoproc(curthread)->p_pid, 0);
381 		cleanshares(vp, ttoproc(curthread)->p_pid);
382 	} else
383 		nfs_lockrelease(vp, flag, offset, cr);
384 
385 	if (count > 1)
386 		return (0);
387 
388 	/*
389 	 * If the file has been `unlinked', then purge the
390 	 * DNLC so that this vnode will get reycled quicker
391 	 * and the .nfs* file on the server will get removed.
392 	 */
393 	rp = VTOR(vp);
394 	if (rp->r_unldvp != NULL)
395 		dnlc_purge_vp(vp);
396 
397 	/*
398 	 * If the file was open for write and there are pages,
399 	 * then if the file system was mounted using the "no-close-
400 	 *	to-open" semantics, then start an asynchronous flush
401 	 *	of the all of the pages in the file.
402 	 * else the file system was not mounted using the "no-close-
403 	 *	to-open" semantics, then do a synchronous flush and
404 	 *	commit of all of the dirty and uncommitted pages.
405 	 *
406 	 * The asynchronous flush of the pages in the "nocto" path
407 	 * mostly just associates a cred pointer with the rnode so
408 	 * writes which happen later will have a better chance of
409 	 * working.  It also starts the data being written to the
410 	 * server, but without unnecessarily delaying the application.
411 	 */
412 	if ((flag & FWRITE) && vn_has_cached_data(vp)) {
413 		if (VTOMI(vp)->mi_flags & MI_NOCTO) {
414 			error = nfs3_putpage(vp, (offset_t)0, 0, B_ASYNC,
415 			    cr, ct);
416 			if (error == EAGAIN)
417 				error = 0;
418 		} else
419 			error = nfs3_putpage_commit(vp, (offset_t)0, 0, cr);
420 		if (!error) {
421 			mutex_enter(&rp->r_statelock);
422 			error = rp->r_error;
423 			rp->r_error = 0;
424 			mutex_exit(&rp->r_statelock);
425 		}
426 	} else {
427 		mutex_enter(&rp->r_statelock);
428 		error = rp->r_error;
429 		rp->r_error = 0;
430 		mutex_exit(&rp->r_statelock);
431 	}
432 
433 	/*
434 	 * If RWRITEATTR is set, then issue an over the wire GETATTR to
435 	 * refresh the attribute cache with a set of attributes which
436 	 * weren't returned from a WRITE.  This will enable the close-
437 	 * to-open processing to work.
438 	 */
439 	if (rp->r_flags & RWRITEATTR)
440 		(void) nfs3_getattr_otw(vp, &va, cr);
441 
442 	return (error);
443 }
444 
445 /* ARGSUSED */
446 static int
447 nfs3_directio_read(vnode_t *vp, struct uio *uiop, cred_t *cr)
448 {
449 	mntinfo_t *mi;
450 	READ3args args;
451 	READ3uiores res;
452 	int tsize;
453 	offset_t offset;
454 	ssize_t count;
455 	int error;
456 	int douprintf;
457 	failinfo_t fi;
458 	char *sv_hostname;
459 
460 	mi = VTOMI(vp);
461 	ASSERT(nfs_zone() == VTOMI(vp)->mi_zone);
462 	sv_hostname = VTOR(vp)->r_server->sv_hostname;
463 
464 	douprintf = 1;
465 	args.file = *VTOFH3(vp);
466 	fi.vp = vp;
467 	fi.fhp = (caddr_t)&args.file;
468 	fi.copyproc = nfs3copyfh;
469 	fi.lookupproc = nfs3lookup;
470 	fi.xattrdirproc = acl_getxattrdir3;
471 
472 	res.uiop = uiop;
473 
474 	res.wlist = NULL;
475 
476 	offset = uiop->uio_loffset;
477 	count = uiop->uio_resid;
478 
479 	do {
480 		if (mi->mi_io_kstats) {
481 			mutex_enter(&mi->mi_lock);
482 			kstat_runq_enter(KSTAT_IO_PTR(mi->mi_io_kstats));
483 			mutex_exit(&mi->mi_lock);
484 		}
485 
486 		do {
487 			tsize = MIN(mi->mi_tsize, count);
488 			args.offset = (offset3)offset;
489 			args.count = (count3)tsize;
490 			res.size = (uint_t)tsize;
491 			args.res_uiop = uiop;
492 			args.res_data_val_alt = NULL;
493 
494 			error = rfs3call(mi, NFSPROC3_READ,
495 			    xdr_READ3args, (caddr_t)&args,
496 			    xdr_READ3uiores, (caddr_t)&res, cr,
497 			    &douprintf, &res.status, 0, &fi);
498 		} while (error == ENFS_TRYAGAIN);
499 
500 		if (mi->mi_io_kstats) {
501 			mutex_enter(&mi->mi_lock);
502 			kstat_runq_exit(KSTAT_IO_PTR(mi->mi_io_kstats));
503 			mutex_exit(&mi->mi_lock);
504 		}
505 
506 		if (error)
507 			return (error);
508 
509 		error = geterrno3(res.status);
510 		if (error)
511 			return (error);
512 
513 		if (res.count != res.size) {
514 			zcmn_err(getzoneid(), CE_WARN,
515 "nfs3_directio_read: server %s returned incorrect amount",
516 			    sv_hostname);
517 			return (EIO);
518 		}
519 		count -= res.count;
520 		offset += res.count;
521 		if (mi->mi_io_kstats) {
522 			mutex_enter(&mi->mi_lock);
523 			KSTAT_IO_PTR(mi->mi_io_kstats)->reads++;
524 			KSTAT_IO_PTR(mi->mi_io_kstats)->nread += res.count;
525 			mutex_exit(&mi->mi_lock);
526 		}
527 		lwp_stat_update(LWP_STAT_INBLK, 1);
528 	} while (count && !res.eof);
529 
530 	return (0);
531 }
532 
533 /* ARGSUSED */
534 static int
535 nfs3_read(vnode_t *vp, struct uio *uiop, int ioflag, cred_t *cr,
536 	caller_context_t *ct)
537 {
538 	rnode_t *rp;
539 	u_offset_t off;
540 	offset_t diff;
541 	int on;
542 	size_t n;
543 	caddr_t base;
544 	uint_t flags;
545 	int error = 0;
546 	mntinfo_t *mi;
547 
548 	rp = VTOR(vp);
549 	mi = VTOMI(vp);
550 
551 	ASSERT(nfs_rw_lock_held(&rp->r_rwlock, RW_READER));
552 
553 	if (nfs_zone() != mi->mi_zone)
554 		return (EIO);
555 
556 	if (vp->v_type != VREG)
557 		return (EISDIR);
558 
559 	if (uiop->uio_resid == 0)
560 		return (0);
561 
562 	if (uiop->uio_loffset < 0 || uiop->uio_loffset + uiop->uio_resid < 0)
563 		return (EINVAL);
564 
565 	/*
566 	 * Bypass VM if caching has been disabled (e.g., locking) or if
567 	 * using client-side direct I/O and the file is not mmap'd and
568 	 * there are no cached pages.
569 	 */
570 	if ((vp->v_flag & VNOCACHE) ||
571 	    (((rp->r_flags & RDIRECTIO) || (mi->mi_flags & MI_DIRECTIO)) &&
572 	    rp->r_mapcnt == 0 && rp->r_inmap == 0 &&
573 	    !vn_has_cached_data(vp))) {
574 		return (nfs3_directio_read(vp, uiop, cr));
575 	}
576 
577 	do {
578 		off = uiop->uio_loffset & MAXBMASK; /* mapping offset */
579 		on = uiop->uio_loffset & MAXBOFFSET; /* Relative offset */
580 		n = MIN(MAXBSIZE - on, uiop->uio_resid);
581 
582 		error = nfs3_validate_caches(vp, cr);
583 		if (error)
584 			break;
585 
586 		mutex_enter(&rp->r_statelock);
587 		while (rp->r_flags & RINCACHEPURGE) {
588 			if (!cv_wait_sig(&rp->r_cv, &rp->r_statelock)) {
589 				mutex_exit(&rp->r_statelock);
590 				return (EINTR);
591 			}
592 		}
593 		diff = rp->r_size - uiop->uio_loffset;
594 		mutex_exit(&rp->r_statelock);
595 		if (diff <= 0)
596 			break;
597 		if (diff < n)
598 			n = (size_t)diff;
599 
600 		if (vpm_enable) {
601 			/*
602 			 * Copy data.
603 			 */
604 			error = vpm_data_copy(vp, off + on, n, uiop,
605 			    1, NULL, 0, S_READ);
606 		} else {
607 			base = segmap_getmapflt(segkmap, vp, off + on, n, 1,
608 			    S_READ);
609 
610 			error = uiomove(base + on, n, UIO_READ, uiop);
611 		}
612 
613 		if (!error) {
614 			/*
615 			 * If read a whole block or read to eof,
616 			 * won't need this buffer again soon.
617 			 */
618 			mutex_enter(&rp->r_statelock);
619 			if (n + on == MAXBSIZE ||
620 			    uiop->uio_loffset == rp->r_size)
621 				flags = SM_DONTNEED;
622 			else
623 				flags = 0;
624 			mutex_exit(&rp->r_statelock);
625 			if (vpm_enable) {
626 				error = vpm_sync_pages(vp, off, n, flags);
627 			} else {
628 				error = segmap_release(segkmap, base, flags);
629 			}
630 		} else {
631 			if (vpm_enable) {
632 				(void) vpm_sync_pages(vp, off, n, 0);
633 			} else {
634 				(void) segmap_release(segkmap, base, 0);
635 			}
636 		}
637 	} while (!error && uiop->uio_resid > 0);
638 
639 	return (error);
640 }
641 
642 /* ARGSUSED */
643 static int
644 nfs3_write(vnode_t *vp, struct uio *uiop, int ioflag, cred_t *cr,
645 	caller_context_t *ct)
646 {
647 	rlim64_t limit = uiop->uio_llimit;
648 	rnode_t *rp;
649 	u_offset_t off;
650 	caddr_t base;
651 	uint_t flags;
652 	int remainder;
653 	size_t n;
654 	int on;
655 	int error;
656 	int resid;
657 	offset_t offset;
658 	mntinfo_t *mi;
659 	uint_t bsize;
660 
661 	rp = VTOR(vp);
662 
663 	if (vp->v_type != VREG)
664 		return (EISDIR);
665 
666 	mi = VTOMI(vp);
667 	if (nfs_zone() != mi->mi_zone)
668 		return (EIO);
669 	if (uiop->uio_resid == 0)
670 		return (0);
671 
672 	if (ioflag & FAPPEND) {
673 		struct vattr va;
674 
675 		/*
676 		 * Must serialize if appending.
677 		 */
678 		if (nfs_rw_lock_held(&rp->r_rwlock, RW_READER)) {
679 			nfs_rw_exit(&rp->r_rwlock);
680 			if (nfs_rw_enter_sig(&rp->r_rwlock, RW_WRITER,
681 			    INTR(vp)))
682 				return (EINTR);
683 		}
684 
685 		va.va_mask = AT_SIZE;
686 		error = nfs3getattr(vp, &va, cr);
687 		if (error)
688 			return (error);
689 		uiop->uio_loffset = va.va_size;
690 	}
691 
692 	offset = uiop->uio_loffset + uiop->uio_resid;
693 
694 	if (uiop->uio_loffset < 0 || offset < 0)
695 		return (EINVAL);
696 
697 	if (limit == RLIM64_INFINITY || limit > MAXOFFSET_T)
698 		limit = MAXOFFSET_T;
699 
700 	/*
701 	 * Check to make sure that the process will not exceed
702 	 * its limit on file size.  It is okay to write up to
703 	 * the limit, but not beyond.  Thus, the write which
704 	 * reaches the limit will be short and the next write
705 	 * will return an error.
706 	 */
707 	remainder = 0;
708 	if (offset > limit) {
709 		remainder = offset - limit;
710 		uiop->uio_resid = limit - uiop->uio_loffset;
711 		if (uiop->uio_resid <= 0) {
712 			proc_t *p = ttoproc(curthread);
713 
714 			uiop->uio_resid += remainder;
715 			mutex_enter(&p->p_lock);
716 			(void) rctl_action(rctlproc_legacy[RLIMIT_FSIZE],
717 			    p->p_rctls, p, RCA_UNSAFE_SIGINFO);
718 			mutex_exit(&p->p_lock);
719 			return (EFBIG);
720 		}
721 	}
722 
723 	if (nfs_rw_enter_sig(&rp->r_lkserlock, RW_READER, INTR(vp)))
724 		return (EINTR);
725 
726 	/*
727 	 * Bypass VM if caching has been disabled (e.g., locking) or if
728 	 * using client-side direct I/O and the file is not mmap'd and
729 	 * there are no cached pages.
730 	 */
731 	if ((vp->v_flag & VNOCACHE) ||
732 	    (((rp->r_flags & RDIRECTIO) || (mi->mi_flags & MI_DIRECTIO)) &&
733 	    rp->r_mapcnt == 0 && rp->r_inmap == 0 &&
734 	    !vn_has_cached_data(vp))) {
735 		size_t bufsize;
736 		int count;
737 		u_offset_t org_offset;
738 		stable_how stab_comm;
739 
740 nfs3_fwrite:
741 		if (rp->r_flags & RSTALE) {
742 			resid = uiop->uio_resid;
743 			offset = uiop->uio_loffset;
744 			error = rp->r_error;
745 			/*
746 			 * A close may have cleared r_error, if so,
747 			 * propagate ESTALE error return properly
748 			 */
749 			if (error == 0)
750 				error = ESTALE;
751 			goto bottom;
752 		}
753 		bufsize = MIN(uiop->uio_resid, mi->mi_stsize);
754 		base = kmem_alloc(bufsize, KM_SLEEP);
755 		do {
756 			if (ioflag & FDSYNC)
757 				stab_comm = DATA_SYNC;
758 			else
759 				stab_comm = FILE_SYNC;
760 			resid = uiop->uio_resid;
761 			offset = uiop->uio_loffset;
762 			count = MIN(uiop->uio_resid, bufsize);
763 			org_offset = uiop->uio_loffset;
764 			error = uiomove(base, count, UIO_WRITE, uiop);
765 			if (!error) {
766 				error = nfs3write(vp, base, org_offset,
767 				    count, cr, &stab_comm);
768 			}
769 		} while (!error && uiop->uio_resid > 0);
770 		kmem_free(base, bufsize);
771 		goto bottom;
772 	}
773 
774 
775 	bsize = vp->v_vfsp->vfs_bsize;
776 
777 	do {
778 		off = uiop->uio_loffset & MAXBMASK; /* mapping offset */
779 		on = uiop->uio_loffset & MAXBOFFSET; /* Relative offset */
780 		n = MIN(MAXBSIZE - on, uiop->uio_resid);
781 
782 		resid = uiop->uio_resid;
783 		offset = uiop->uio_loffset;
784 
785 		if (rp->r_flags & RSTALE) {
786 			error = rp->r_error;
787 			/*
788 			 * A close may have cleared r_error, if so,
789 			 * propagate ESTALE error return properly
790 			 */
791 			if (error == 0)
792 				error = ESTALE;
793 			break;
794 		}
795 
796 		/*
797 		 * Don't create dirty pages faster than they
798 		 * can be cleaned so that the system doesn't
799 		 * get imbalanced.  If the async queue is
800 		 * maxed out, then wait for it to drain before
801 		 * creating more dirty pages.  Also, wait for
802 		 * any threads doing pagewalks in the vop_getattr
803 		 * entry points so that they don't block for
804 		 * long periods.
805 		 */
806 		mutex_enter(&rp->r_statelock);
807 		while ((mi->mi_max_threads != 0 &&
808 		    rp->r_awcount > 2 * mi->mi_max_threads) ||
809 		    rp->r_gcount > 0) {
810 			if (INTR(vp)) {
811 				klwp_t *lwp = ttolwp(curthread);
812 
813 				if (lwp != NULL)
814 					lwp->lwp_nostop++;
815 				if (!cv_wait_sig(&rp->r_cv, &rp->r_statelock)) {
816 					mutex_exit(&rp->r_statelock);
817 					if (lwp != NULL)
818 						lwp->lwp_nostop--;
819 					error = EINTR;
820 					goto bottom;
821 				}
822 				if (lwp != NULL)
823 					lwp->lwp_nostop--;
824 			} else
825 				cv_wait(&rp->r_cv, &rp->r_statelock);
826 		}
827 		mutex_exit(&rp->r_statelock);
828 
829 		/*
830 		 * Touch the page and fault it in if it is not in core
831 		 * before segmap_getmapflt or vpm_data_copy can lock it.
832 		 * This is to avoid the deadlock if the buffer is mapped
833 		 * to the same file through mmap which we want to write.
834 		 */
835 		uio_prefaultpages((long)n, uiop);
836 
837 		if (vpm_enable) {
838 			/*
839 			 * It will use kpm mappings, so no need to
840 			 * pass an address.
841 			 */
842 			error = writerp(rp, NULL, n, uiop, 0);
843 		} else  {
844 			if (segmap_kpm) {
845 				int pon = uiop->uio_loffset & PAGEOFFSET;
846 				size_t pn = MIN(PAGESIZE - pon,
847 				    uiop->uio_resid);
848 				int pagecreate;
849 
850 				mutex_enter(&rp->r_statelock);
851 				pagecreate = (pon == 0) && (pn == PAGESIZE ||
852 				    uiop->uio_loffset + pn >= rp->r_size);
853 				mutex_exit(&rp->r_statelock);
854 
855 				base = segmap_getmapflt(segkmap, vp, off + on,
856 				    pn, !pagecreate, S_WRITE);
857 
858 				error = writerp(rp, base + pon, n, uiop,
859 				    pagecreate);
860 
861 			} else {
862 				base = segmap_getmapflt(segkmap, vp, off + on,
863 				    n, 0, S_READ);
864 				error = writerp(rp, base + on, n, uiop, 0);
865 			}
866 		}
867 
868 		if (!error) {
869 			if (mi->mi_flags & MI_NOAC)
870 				flags = SM_WRITE;
871 			else if ((uiop->uio_loffset % bsize) == 0 ||
872 			    IS_SWAPVP(vp)) {
873 				/*
874 				 * Have written a whole block.
875 				 * Start an asynchronous write
876 				 * and mark the buffer to
877 				 * indicate that it won't be
878 				 * needed again soon.
879 				 */
880 				flags = SM_WRITE | SM_ASYNC | SM_DONTNEED;
881 			} else
882 				flags = 0;
883 			if ((ioflag & (FSYNC|FDSYNC)) ||
884 			    (rp->r_flags & ROUTOFSPACE)) {
885 				flags &= ~SM_ASYNC;
886 				flags |= SM_WRITE;
887 			}
888 			if (vpm_enable) {
889 				error = vpm_sync_pages(vp, off, n, flags);
890 			} else {
891 				error = segmap_release(segkmap, base, flags);
892 			}
893 		} else {
894 			if (vpm_enable) {
895 				(void) vpm_sync_pages(vp, off, n, 0);
896 			} else {
897 				(void) segmap_release(segkmap, base, 0);
898 			}
899 			/*
900 			 * In the event that we got an access error while
901 			 * faulting in a page for a write-only file just
902 			 * force a write.
903 			 */
904 			if (error == EACCES)
905 				goto nfs3_fwrite;
906 		}
907 	} while (!error && uiop->uio_resid > 0);
908 
909 bottom:
910 	if (error) {
911 		uiop->uio_resid = resid + remainder;
912 		uiop->uio_loffset = offset;
913 	} else
914 		uiop->uio_resid += remainder;
915 
916 	nfs_rw_exit(&rp->r_lkserlock);
917 
918 	return (error);
919 }
920 
921 /*
922  * Flags are composed of {B_ASYNC, B_INVAL, B_FREE, B_DONTNEED}
923  */
924 static int
925 nfs3_rdwrlbn(vnode_t *vp, page_t *pp, u_offset_t off, size_t len,
926 	int flags, cred_t *cr)
927 {
928 	struct buf *bp;
929 	int error;
930 	page_t *savepp;
931 	uchar_t fsdata;
932 	stable_how stab_comm;
933 
934 	ASSERT(nfs_zone() == VTOMI(vp)->mi_zone);
935 	bp = pageio_setup(pp, len, vp, flags);
936 	ASSERT(bp != NULL);
937 
938 	/*
939 	 * pageio_setup should have set b_addr to 0.  This
940 	 * is correct since we want to do I/O on a page
941 	 * boundary.  bp_mapin will use this addr to calculate
942 	 * an offset, and then set b_addr to the kernel virtual
943 	 * address it allocated for us.
944 	 */
945 	ASSERT(bp->b_un.b_addr == 0);
946 
947 	bp->b_edev = 0;
948 	bp->b_dev = 0;
949 	bp->b_lblkno = lbtodb(off);
950 	bp->b_file = vp;
951 	bp->b_offset = (offset_t)off;
952 	bp_mapin(bp);
953 
954 	/*
955 	 * Calculate the desired level of stability to write data
956 	 * on the server and then mark all of the pages to reflect
957 	 * this.
958 	 */
959 	if ((flags & (B_WRITE|B_ASYNC)) == (B_WRITE|B_ASYNC) &&
960 	    freemem > desfree) {
961 		stab_comm = UNSTABLE;
962 		fsdata = C_DELAYCOMMIT;
963 	} else {
964 		stab_comm = FILE_SYNC;
965 		fsdata = C_NOCOMMIT;
966 	}
967 
968 	savepp = pp;
969 	do {
970 		pp->p_fsdata = fsdata;
971 	} while ((pp = pp->p_next) != savepp);
972 
973 	error = nfs3_bio(bp, &stab_comm, cr);
974 
975 	bp_mapout(bp);
976 	pageio_done(bp);
977 
978 	/*
979 	 * If the server wrote pages in a more stable fashion than
980 	 * was requested, then clear all of the marks in the pages
981 	 * indicating that COMMIT operations were required.
982 	 */
983 	if (stab_comm != UNSTABLE && fsdata == C_DELAYCOMMIT) {
984 		do {
985 			pp->p_fsdata = C_NOCOMMIT;
986 		} while ((pp = pp->p_next) != savepp);
987 	}
988 
989 	return (error);
990 }
991 
992 /*
993  * Write to file.  Writes to remote server in largest size
994  * chunks that the server can handle.  Write is synchronous.
995  */
996 static int
997 nfs3write(vnode_t *vp, caddr_t base, u_offset_t offset, int count, cred_t *cr,
998 	stable_how *stab_comm)
999 {
1000 	mntinfo_t *mi;
1001 	WRITE3args args;
1002 	WRITE3res res;
1003 	int error;
1004 	int tsize;
1005 	rnode_t *rp;
1006 	int douprintf;
1007 
1008 	rp = VTOR(vp);
1009 	mi = VTOMI(vp);
1010 
1011 	ASSERT(nfs_zone() == mi->mi_zone);
1012 
1013 	args.file = *VTOFH3(vp);
1014 	args.stable = *stab_comm;
1015 
1016 	*stab_comm = FILE_SYNC;
1017 
1018 	douprintf = 1;
1019 
1020 	do {
1021 		if ((vp->v_flag & VNOCACHE) ||
1022 		    (rp->r_flags & RDIRECTIO) ||
1023 		    (mi->mi_flags & MI_DIRECTIO))
1024 			tsize = MIN(mi->mi_stsize, count);
1025 		else
1026 			tsize = MIN(mi->mi_curwrite, count);
1027 		args.offset = (offset3)offset;
1028 		args.count = (count3)tsize;
1029 		args.data.data_len = (uint_t)tsize;
1030 		args.data.data_val = base;
1031 
1032 		if (mi->mi_io_kstats) {
1033 			mutex_enter(&mi->mi_lock);
1034 			kstat_runq_enter(KSTAT_IO_PTR(mi->mi_io_kstats));
1035 			mutex_exit(&mi->mi_lock);
1036 		}
1037 		args.mblk = NULL;
1038 		do {
1039 			error = rfs3call(mi, NFSPROC3_WRITE,
1040 			    xdr_WRITE3args, (caddr_t)&args,
1041 			    xdr_WRITE3res, (caddr_t)&res, cr,
1042 			    &douprintf, &res.status, 0, NULL);
1043 		} while (error == ENFS_TRYAGAIN);
1044 		if (mi->mi_io_kstats) {
1045 			mutex_enter(&mi->mi_lock);
1046 			kstat_runq_exit(KSTAT_IO_PTR(mi->mi_io_kstats));
1047 			mutex_exit(&mi->mi_lock);
1048 		}
1049 
1050 		if (error)
1051 			return (error);
1052 		error = geterrno3(res.status);
1053 		if (!error) {
1054 			if (res.resok.count > args.count) {
1055 				zcmn_err(getzoneid(), CE_WARN,
1056 				    "nfs3write: server %s wrote %u, "
1057 				    "requested was %u",
1058 				    rp->r_server->sv_hostname,
1059 				    res.resok.count, args.count);
1060 				return (EIO);
1061 			}
1062 			if (res.resok.committed == UNSTABLE) {
1063 				*stab_comm = UNSTABLE;
1064 				if (args.stable == DATA_SYNC ||
1065 				    args.stable == FILE_SYNC) {
1066 					zcmn_err(getzoneid(), CE_WARN,
1067 			"nfs3write: server %s did not commit to stable storage",
1068 					    rp->r_server->sv_hostname);
1069 					return (EIO);
1070 				}
1071 			}
1072 			tsize = (int)res.resok.count;
1073 			count -= tsize;
1074 			base += tsize;
1075 			offset += tsize;
1076 			if (mi->mi_io_kstats) {
1077 				mutex_enter(&mi->mi_lock);
1078 				KSTAT_IO_PTR(mi->mi_io_kstats)->writes++;
1079 				KSTAT_IO_PTR(mi->mi_io_kstats)->nwritten +=
1080 				    tsize;
1081 				mutex_exit(&mi->mi_lock);
1082 			}
1083 			lwp_stat_update(LWP_STAT_OUBLK, 1);
1084 			mutex_enter(&rp->r_statelock);
1085 			if (rp->r_flags & RHAVEVERF) {
1086 				if (rp->r_verf != res.resok.verf) {
1087 					nfs3_set_mod(vp);
1088 					rp->r_verf = res.resok.verf;
1089 					/*
1090 					 * If the data was written UNSTABLE,
1091 					 * then might as well stop because
1092 					 * the whole block will have to get
1093 					 * rewritten anyway.
1094 					 */
1095 					if (*stab_comm == UNSTABLE) {
1096 						mutex_exit(&rp->r_statelock);
1097 						break;
1098 					}
1099 				}
1100 			} else {
1101 				rp->r_verf = res.resok.verf;
1102 				rp->r_flags |= RHAVEVERF;
1103 			}
1104 			/*
1105 			 * Mark the attribute cache as timed out and
1106 			 * set RWRITEATTR to indicate that the file
1107 			 * was modified with a WRITE operation and
1108 			 * that the attributes can not be trusted.
1109 			 */
1110 			PURGE_ATTRCACHE_LOCKED(rp);
1111 			rp->r_flags |= RWRITEATTR;
1112 			mutex_exit(&rp->r_statelock);
1113 		}
1114 	} while (!error && count);
1115 
1116 	return (error);
1117 }
1118 
1119 /*
1120  * Read from a file.  Reads data in largest chunks our interface can handle.
1121  */
1122 static int
1123 nfs3read(vnode_t *vp, caddr_t base, offset_t offset, int count,
1124 	size_t *residp, cred_t *cr)
1125 {
1126 	mntinfo_t *mi;
1127 	READ3args args;
1128 	READ3vres res;
1129 	int tsize;
1130 	int error;
1131 	int douprintf;
1132 	failinfo_t fi;
1133 	rnode_t *rp;
1134 	struct vattr va;
1135 	hrtime_t t;
1136 
1137 	rp = VTOR(vp);
1138 	mi = VTOMI(vp);
1139 	ASSERT(nfs_zone() == mi->mi_zone);
1140 	douprintf = 1;
1141 
1142 	args.file = *VTOFH3(vp);
1143 	fi.vp = vp;
1144 	fi.fhp = (caddr_t)&args.file;
1145 	fi.copyproc = nfs3copyfh;
1146 	fi.lookupproc = nfs3lookup;
1147 	fi.xattrdirproc = acl_getxattrdir3;
1148 
1149 	res.pov.fres.vp = vp;
1150 	res.pov.fres.vap = &va;
1151 
1152 	res.wlist = NULL;
1153 	*residp = count;
1154 	do {
1155 		if (mi->mi_io_kstats) {
1156 			mutex_enter(&mi->mi_lock);
1157 			kstat_runq_enter(KSTAT_IO_PTR(mi->mi_io_kstats));
1158 			mutex_exit(&mi->mi_lock);
1159 		}
1160 
1161 		do {
1162 			if ((vp->v_flag & VNOCACHE) ||
1163 			    (rp->r_flags & RDIRECTIO) ||
1164 			    (mi->mi_flags & MI_DIRECTIO))
1165 				tsize = MIN(mi->mi_tsize, count);
1166 			else
1167 				tsize = MIN(mi->mi_curread, count);
1168 			res.data.data_val = base;
1169 			res.data.data_len = tsize;
1170 			args.offset = (offset3)offset;
1171 			args.count = (count3)tsize;
1172 			args.res_uiop = NULL;
1173 			args.res_data_val_alt = base;
1174 
1175 			t = gethrtime();
1176 			error = rfs3call(mi, NFSPROC3_READ,
1177 			    xdr_READ3args, (caddr_t)&args,
1178 			    xdr_READ3vres, (caddr_t)&res, cr,
1179 			    &douprintf, &res.status, 0, &fi);
1180 		} while (error == ENFS_TRYAGAIN);
1181 
1182 		if (mi->mi_io_kstats) {
1183 			mutex_enter(&mi->mi_lock);
1184 			kstat_runq_exit(KSTAT_IO_PTR(mi->mi_io_kstats));
1185 			mutex_exit(&mi->mi_lock);
1186 		}
1187 
1188 		if (error)
1189 			return (error);
1190 
1191 		error = geterrno3(res.status);
1192 		if (error)
1193 			return (error);
1194 
1195 		if (res.count != res.data.data_len) {
1196 			zcmn_err(getzoneid(), CE_WARN,
1197 			    "nfs3read: server %s returned incorrect amount",
1198 			    rp->r_server->sv_hostname);
1199 			return (EIO);
1200 		}
1201 
1202 		count -= res.count;
1203 		*residp = count;
1204 		base += res.count;
1205 		offset += res.count;
1206 		if (mi->mi_io_kstats) {
1207 			mutex_enter(&mi->mi_lock);
1208 			KSTAT_IO_PTR(mi->mi_io_kstats)->reads++;
1209 			KSTAT_IO_PTR(mi->mi_io_kstats)->nread += res.count;
1210 			mutex_exit(&mi->mi_lock);
1211 		}
1212 		lwp_stat_update(LWP_STAT_INBLK, 1);
1213 	} while (count && !res.eof);
1214 
1215 	if (res.pov.attributes) {
1216 		mutex_enter(&rp->r_statelock);
1217 		if (!CACHE_VALID(rp, va.va_mtime, va.va_size)) {
1218 			mutex_exit(&rp->r_statelock);
1219 			PURGE_ATTRCACHE(vp);
1220 		} else {
1221 			if (rp->r_mtime <= t)
1222 				nfs_attrcache_va(vp, &va);
1223 			mutex_exit(&rp->r_statelock);
1224 		}
1225 	}
1226 
1227 	return (0);
1228 }
1229 
1230 /* ARGSUSED */
1231 static int
1232 nfs3_ioctl(vnode_t *vp, int cmd, intptr_t arg, int flag, cred_t *cr, int *rvalp,
1233 	caller_context_t *ct)
1234 {
1235 
1236 	if (nfs_zone() != VTOMI(vp)->mi_zone)
1237 		return (EIO);
1238 	switch (cmd) {
1239 		case _FIODIRECTIO:
1240 			return (nfs_directio(vp, (int)arg, cr));
1241 		default:
1242 			return (ENOTTY);
1243 	}
1244 }
1245 
1246 /* ARGSUSED */
1247 static int
1248 nfs3_getattr(vnode_t *vp, struct vattr *vap, int flags, cred_t *cr,
1249 	caller_context_t *ct)
1250 {
1251 	int error;
1252 	rnode_t *rp;
1253 
1254 	if (nfs_zone() != VTOMI(vp)->mi_zone)
1255 		return (EIO);
1256 	/*
1257 	 * If it has been specified that the return value will
1258 	 * just be used as a hint, and we are only being asked
1259 	 * for size, fsid or rdevid, then return the client's
1260 	 * notion of these values without checking to make sure
1261 	 * that the attribute cache is up to date.
1262 	 * The whole point is to avoid an over the wire GETATTR
1263 	 * call.
1264 	 */
1265 	rp = VTOR(vp);
1266 	if (flags & ATTR_HINT) {
1267 		if (vap->va_mask ==
1268 		    (vap->va_mask & (AT_SIZE | AT_FSID | AT_RDEV))) {
1269 			mutex_enter(&rp->r_statelock);
1270 			if (vap->va_mask | AT_SIZE)
1271 				vap->va_size = rp->r_size;
1272 			if (vap->va_mask | AT_FSID)
1273 				vap->va_fsid = rp->r_attr.va_fsid;
1274 			if (vap->va_mask | AT_RDEV)
1275 				vap->va_rdev = rp->r_attr.va_rdev;
1276 			mutex_exit(&rp->r_statelock);
1277 			return (0);
1278 		}
1279 	}
1280 
1281 	/*
1282 	 * Only need to flush pages if asking for the mtime
1283 	 * and if there any dirty pages or any outstanding
1284 	 * asynchronous (write) requests for this file.
1285 	 */
1286 	if (vap->va_mask & AT_MTIME) {
1287 		if (vn_has_cached_data(vp) &&
1288 		    ((rp->r_flags & RDIRTY) || rp->r_awcount > 0)) {
1289 			mutex_enter(&rp->r_statelock);
1290 			rp->r_gcount++;
1291 			mutex_exit(&rp->r_statelock);
1292 			error = nfs3_putpage(vp, (offset_t)0, 0, 0, cr, ct);
1293 			mutex_enter(&rp->r_statelock);
1294 			if (error && (error == ENOSPC || error == EDQUOT)) {
1295 				if (!rp->r_error)
1296 					rp->r_error = error;
1297 			}
1298 			if (--rp->r_gcount == 0)
1299 				cv_broadcast(&rp->r_cv);
1300 			mutex_exit(&rp->r_statelock);
1301 		}
1302 	}
1303 
1304 	return (nfs3getattr(vp, vap, cr));
1305 }
1306 
1307 /*ARGSUSED4*/
1308 static int
1309 nfs3_setattr(vnode_t *vp, struct vattr *vap, int flags, cred_t *cr,
1310 		caller_context_t *ct)
1311 {
1312 	int error;
1313 	struct vattr va;
1314 
1315 	if (vap->va_mask & AT_NOSET)
1316 		return (EINVAL);
1317 	if (nfs_zone() != VTOMI(vp)->mi_zone)
1318 		return (EIO);
1319 
1320 	va.va_mask = AT_UID | AT_MODE;
1321 	error = nfs3getattr(vp, &va, cr);
1322 	if (error)
1323 		return (error);
1324 
1325 	error = secpolicy_vnode_setattr(cr, vp, vap, &va, flags, nfs3_accessx,
1326 	    vp);
1327 	if (error)
1328 		return (error);
1329 
1330 	return (nfs3setattr(vp, vap, flags, cr));
1331 }
1332 
1333 static int
1334 nfs3setattr(vnode_t *vp, struct vattr *vap, int flags, cred_t *cr)
1335 {
1336 	int error;
1337 	uint_t mask;
1338 	SETATTR3args args;
1339 	SETATTR3res res;
1340 	int douprintf;
1341 	rnode_t *rp;
1342 	struct vattr va;
1343 	mode_t omode;
1344 	vsecattr_t *vsp;
1345 	hrtime_t t;
1346 
1347 	ASSERT(nfs_zone() == VTOMI(vp)->mi_zone);
1348 	mask = vap->va_mask;
1349 
1350 	rp = VTOR(vp);
1351 
1352 	/*
1353 	 * Only need to flush pages if there are any pages and
1354 	 * if the file is marked as dirty in some fashion.  The
1355 	 * file must be flushed so that we can accurately
1356 	 * determine the size of the file and the cached data
1357 	 * after the SETATTR returns.  A file is considered to
1358 	 * be dirty if it is either marked with RDIRTY, has
1359 	 * outstanding i/o's active, or is mmap'd.  In this
1360 	 * last case, we can't tell whether there are dirty
1361 	 * pages, so we flush just to be sure.
1362 	 */
1363 	if (vn_has_cached_data(vp) &&
1364 	    ((rp->r_flags & RDIRTY) ||
1365 	    rp->r_count > 0 ||
1366 	    rp->r_mapcnt > 0)) {
1367 		ASSERT(vp->v_type != VCHR);
1368 		error = nfs3_putpage(vp, (offset_t)0, 0, 0, cr, NULL);
1369 		if (error && (error == ENOSPC || error == EDQUOT)) {
1370 			mutex_enter(&rp->r_statelock);
1371 			if (!rp->r_error)
1372 				rp->r_error = error;
1373 			mutex_exit(&rp->r_statelock);
1374 		}
1375 	}
1376 
1377 	args.object = *RTOFH3(rp);
1378 	/*
1379 	 * If the intent is for the server to set the times,
1380 	 * there is no point in have the mask indicating set mtime or
1381 	 * atime, because the vap values may be junk, and so result
1382 	 * in an overflow error. Remove these flags from the vap mask
1383 	 * before calling in this case, and restore them afterwards.
1384 	 */
1385 	if ((mask & (AT_ATIME | AT_MTIME)) && !(flags & ATTR_UTIME)) {
1386 		/* Use server times, so don't set the args time fields */
1387 		vap->va_mask &= ~(AT_ATIME | AT_MTIME);
1388 		error = vattr_to_sattr3(vap, &args.new_attributes);
1389 		vap->va_mask |= (mask & (AT_ATIME | AT_MTIME));
1390 		if (mask & AT_ATIME) {
1391 			args.new_attributes.atime.set_it = SET_TO_SERVER_TIME;
1392 		}
1393 		if (mask & AT_MTIME) {
1394 			args.new_attributes.mtime.set_it = SET_TO_SERVER_TIME;
1395 		}
1396 	} else {
1397 		/* Either do not set times or use the client specified times */
1398 		error = vattr_to_sattr3(vap, &args.new_attributes);
1399 	}
1400 
1401 	if (error) {
1402 		/* req time field(s) overflow - return immediately */
1403 		return (error);
1404 	}
1405 
1406 	va.va_mask = AT_MODE | AT_CTIME;
1407 	error = nfs3getattr(vp, &va, cr);
1408 	if (error)
1409 		return (error);
1410 	omode = va.va_mode;
1411 
1412 tryagain:
1413 	if (mask & AT_SIZE) {
1414 		args.guard.check = TRUE;
1415 		args.guard.obj_ctime.seconds = va.va_ctime.tv_sec;
1416 		args.guard.obj_ctime.nseconds = va.va_ctime.tv_nsec;
1417 	} else
1418 		args.guard.check = FALSE;
1419 
1420 	douprintf = 1;
1421 
1422 	t = gethrtime();
1423 
1424 	error = rfs3call(VTOMI(vp), NFSPROC3_SETATTR,
1425 	    xdr_SETATTR3args, (caddr_t)&args,
1426 	    xdr_SETATTR3res, (caddr_t)&res, cr,
1427 	    &douprintf, &res.status, 0, NULL);
1428 
1429 	/*
1430 	 * Purge the access cache and ACL cache if changing either the
1431 	 * owner of the file, the group owner, or the mode.  These may
1432 	 * change the access permissions of the file, so purge old
1433 	 * information and start over again.
1434 	 */
1435 	if (mask & (AT_UID | AT_GID | AT_MODE)) {
1436 		(void) nfs_access_purge_rp(rp);
1437 		if (rp->r_secattr != NULL) {
1438 			mutex_enter(&rp->r_statelock);
1439 			vsp = rp->r_secattr;
1440 			rp->r_secattr = NULL;
1441 			mutex_exit(&rp->r_statelock);
1442 			if (vsp != NULL)
1443 				nfs_acl_free(vsp);
1444 		}
1445 	}
1446 
1447 	if (error) {
1448 		PURGE_ATTRCACHE(vp);
1449 		return (error);
1450 	}
1451 
1452 	error = geterrno3(res.status);
1453 	if (!error) {
1454 		/*
1455 		 * If changing the size of the file, invalidate
1456 		 * any local cached data which is no longer part
1457 		 * of the file.  We also possibly invalidate the
1458 		 * last page in the file.  We could use
1459 		 * pvn_vpzero(), but this would mark the page as
1460 		 * modified and require it to be written back to
1461 		 * the server for no particularly good reason.
1462 		 * This way, if we access it, then we bring it
1463 		 * back in.  A read should be cheaper than a
1464 		 * write.
1465 		 */
1466 		if (mask & AT_SIZE) {
1467 			nfs_invalidate_pages(vp,
1468 			    (vap->va_size & PAGEMASK), cr);
1469 		}
1470 		nfs3_cache_wcc_data(vp, &res.resok.obj_wcc, t, cr);
1471 		/*
1472 		 * Some servers will change the mode to clear the setuid
1473 		 * and setgid bits when changing the uid or gid.  The
1474 		 * client needs to compensate appropriately.
1475 		 */
1476 		if (mask & (AT_UID | AT_GID)) {
1477 			int terror;
1478 
1479 			va.va_mask = AT_MODE;
1480 			terror = nfs3getattr(vp, &va, cr);
1481 			if (!terror &&
1482 			    (((mask & AT_MODE) && va.va_mode != vap->va_mode) ||
1483 			    (!(mask & AT_MODE) && va.va_mode != omode))) {
1484 				va.va_mask = AT_MODE;
1485 				if (mask & AT_MODE)
1486 					va.va_mode = vap->va_mode;
1487 				else
1488 					va.va_mode = omode;
1489 				(void) nfs3setattr(vp, &va, 0, cr);
1490 			}
1491 		}
1492 	} else {
1493 		nfs3_cache_wcc_data(vp, &res.resfail.obj_wcc, t, cr);
1494 		/*
1495 		 * If we got back a "not synchronized" error, then
1496 		 * we need to retry with a new guard value.  The
1497 		 * guard value used is the change time.  If the
1498 		 * server returned post_op_attr, then we can just
1499 		 * retry because we have the latest attributes.
1500 		 * Otherwise, we issue a GETATTR to get the latest
1501 		 * attributes and then retry.  If we couldn't get
1502 		 * the attributes this way either, then we give
1503 		 * up because we can't complete the operation as
1504 		 * required.
1505 		 */
1506 		if (res.status == NFS3ERR_NOT_SYNC) {
1507 			va.va_mask = AT_CTIME;
1508 			if (nfs3getattr(vp, &va, cr) == 0)
1509 				goto tryagain;
1510 		}
1511 		PURGE_STALE_FH(error, vp, cr);
1512 	}
1513 
1514 	return (error);
1515 }
1516 
1517 static int
1518 nfs3_accessx(void *vp, int mode, cred_t *cr)
1519 {
1520 	ASSERT(nfs_zone() == VTOMI((vnode_t *)vp)->mi_zone);
1521 	return (nfs3_access(vp, mode, 0, cr, NULL));
1522 }
1523 
1524 /* ARGSUSED */
1525 static int
1526 nfs3_access(vnode_t *vp, int mode, int flags, cred_t *cr, caller_context_t *ct)
1527 {
1528 	int error;
1529 	ACCESS3args args;
1530 	ACCESS3res res;
1531 	int douprintf;
1532 	uint32 acc;
1533 	rnode_t *rp;
1534 	cred_t *cred, *ncr, *ncrfree = NULL;
1535 	failinfo_t fi;
1536 	nfs_access_type_t cacc;
1537 	hrtime_t t;
1538 
1539 	acc = 0;
1540 	if (nfs_zone() != VTOMI(vp)->mi_zone)
1541 		return (EIO);
1542 	if (mode & VREAD)
1543 		acc |= ACCESS3_READ;
1544 	if (mode & VWRITE) {
1545 		if (vn_is_readonly(vp) && !IS_DEVVP(vp))
1546 			return (EROFS);
1547 		if (vp->v_type == VDIR)
1548 			acc |= ACCESS3_DELETE;
1549 		acc |= ACCESS3_MODIFY | ACCESS3_EXTEND;
1550 	}
1551 	if (mode & VEXEC) {
1552 		if (vp->v_type == VDIR)
1553 			acc |= ACCESS3_LOOKUP;
1554 		else
1555 			acc |= ACCESS3_EXECUTE;
1556 	}
1557 
1558 	rp = VTOR(vp);
1559 	args.object = *VTOFH3(vp);
1560 	if (vp->v_type == VDIR) {
1561 		args.access = ACCESS3_READ | ACCESS3_DELETE | ACCESS3_MODIFY |
1562 		    ACCESS3_EXTEND | ACCESS3_LOOKUP;
1563 	} else {
1564 		args.access = ACCESS3_READ | ACCESS3_MODIFY | ACCESS3_EXTEND |
1565 		    ACCESS3_EXECUTE;
1566 	}
1567 	fi.vp = vp;
1568 	fi.fhp = (caddr_t)&args.object;
1569 	fi.copyproc = nfs3copyfh;
1570 	fi.lookupproc = nfs3lookup;
1571 	fi.xattrdirproc = acl_getxattrdir3;
1572 
1573 	cred = cr;
1574 	/*
1575 	 * ncr and ncrfree both initially
1576 	 * point to the memory area returned
1577 	 * by crnetadjust();
1578 	 * ncrfree not NULL when exiting means
1579 	 * that we need to release it
1580 	 */
1581 	ncr = crnetadjust(cred);
1582 	ncrfree = ncr;
1583 tryagain:
1584 	if (rp->r_acache != NULL) {
1585 		cacc = nfs_access_check(rp, acc, cred);
1586 		if (cacc == NFS_ACCESS_ALLOWED) {
1587 			if (ncrfree != NULL)
1588 				crfree(ncrfree);
1589 			return (0);
1590 		}
1591 		if (cacc == NFS_ACCESS_DENIED) {
1592 			/*
1593 			 * If the cred can be adjusted, try again
1594 			 * with the new cred.
1595 			 */
1596 			if (ncr != NULL) {
1597 				cred = ncr;
1598 				ncr = NULL;
1599 				goto tryagain;
1600 			}
1601 			if (ncrfree != NULL)
1602 				crfree(ncrfree);
1603 			return (EACCES);
1604 		}
1605 	}
1606 
1607 	douprintf = 1;
1608 
1609 	t = gethrtime();
1610 
1611 	error = rfs3call(VTOMI(vp), NFSPROC3_ACCESS,
1612 	    xdr_ACCESS3args, (caddr_t)&args,
1613 	    xdr_ACCESS3res, (caddr_t)&res, cred,
1614 	    &douprintf, &res.status, 0, &fi);
1615 
1616 	if (error) {
1617 		if (ncrfree != NULL)
1618 			crfree(ncrfree);
1619 		return (error);
1620 	}
1621 
1622 	error = geterrno3(res.status);
1623 	if (!error) {
1624 		nfs3_cache_post_op_attr(vp, &res.resok.obj_attributes, t, cr);
1625 		nfs_access_cache(rp, args.access, res.resok.access, cred);
1626 		/*
1627 		 * we just cached results with cred; if cred is the
1628 		 * adjusted credentials from crnetadjust, we do not want
1629 		 * to release them before exiting: hence setting ncrfree
1630 		 * to NULL
1631 		 */
1632 		if (cred != cr)
1633 			ncrfree = NULL;
1634 		if ((acc & res.resok.access) != acc) {
1635 			/*
1636 			 * If the cred can be adjusted, try again
1637 			 * with the new cred.
1638 			 */
1639 			if (ncr != NULL) {
1640 				cred = ncr;
1641 				ncr = NULL;
1642 				goto tryagain;
1643 			}
1644 			error = EACCES;
1645 		}
1646 	} else {
1647 		nfs3_cache_post_op_attr(vp, &res.resfail.obj_attributes, t, cr);
1648 		PURGE_STALE_FH(error, vp, cr);
1649 	}
1650 
1651 	if (ncrfree != NULL)
1652 		crfree(ncrfree);
1653 
1654 	return (error);
1655 }
1656 
1657 static int nfs3_do_symlink_cache = 1;
1658 
1659 /* ARGSUSED */
1660 static int
1661 nfs3_readlink(vnode_t *vp, struct uio *uiop, cred_t *cr, caller_context_t *ct)
1662 {
1663 	int error;
1664 	READLINK3args args;
1665 	READLINK3res res;
1666 	nfspath3 resdata_backup;
1667 	rnode_t *rp;
1668 	int douprintf;
1669 	int len;
1670 	failinfo_t fi;
1671 	hrtime_t t;
1672 
1673 	/*
1674 	 * Can't readlink anything other than a symbolic link.
1675 	 */
1676 	if (vp->v_type != VLNK)
1677 		return (EINVAL);
1678 	if (nfs_zone() != VTOMI(vp)->mi_zone)
1679 		return (EIO);
1680 
1681 	rp = VTOR(vp);
1682 	if (nfs3_do_symlink_cache && rp->r_symlink.contents != NULL) {
1683 		error = nfs3_validate_caches(vp, cr);
1684 		if (error)
1685 			return (error);
1686 		mutex_enter(&rp->r_statelock);
1687 		if (rp->r_symlink.contents != NULL) {
1688 			error = uiomove(rp->r_symlink.contents,
1689 			    rp->r_symlink.len, UIO_READ, uiop);
1690 			mutex_exit(&rp->r_statelock);
1691 			return (error);
1692 		}
1693 		mutex_exit(&rp->r_statelock);
1694 	}
1695 
1696 	args.symlink = *VTOFH3(vp);
1697 	fi.vp = vp;
1698 	fi.fhp = (caddr_t)&args.symlink;
1699 	fi.copyproc = nfs3copyfh;
1700 	fi.lookupproc = nfs3lookup;
1701 	fi.xattrdirproc = acl_getxattrdir3;
1702 
1703 	res.resok.data = kmem_alloc(MAXPATHLEN, KM_SLEEP);
1704 
1705 	resdata_backup = res.resok.data;
1706 
1707 	douprintf = 1;
1708 
1709 	t = gethrtime();
1710 
1711 	error = rfs3call(VTOMI(vp), NFSPROC3_READLINK,
1712 	    xdr_READLINK3args, (caddr_t)&args,
1713 	    xdr_READLINK3res, (caddr_t)&res, cr,
1714 	    &douprintf, &res.status, 0, &fi);
1715 
1716 	if (res.resok.data == nfs3nametoolong)
1717 		error = EINVAL;
1718 
1719 	if (error) {
1720 		kmem_free(resdata_backup, MAXPATHLEN);
1721 		return (error);
1722 	}
1723 
1724 	error = geterrno3(res.status);
1725 	if (!error) {
1726 		nfs3_cache_post_op_attr(vp, &res.resok.symlink_attributes, t,
1727 		    cr);
1728 		len = strlen(res.resok.data);
1729 		error = uiomove(res.resok.data, len, UIO_READ, uiop);
1730 		if (nfs3_do_symlink_cache && rp->r_symlink.contents == NULL) {
1731 			mutex_enter(&rp->r_statelock);
1732 				if (rp->r_symlink.contents == NULL) {
1733 				rp->r_symlink.contents = res.resok.data;
1734 				rp->r_symlink.len = len;
1735 				rp->r_symlink.size = MAXPATHLEN;
1736 				mutex_exit(&rp->r_statelock);
1737 			} else {
1738 				mutex_exit(&rp->r_statelock);
1739 
1740 				kmem_free((void *)res.resok.data, MAXPATHLEN);
1741 			}
1742 		} else {
1743 			kmem_free((void *)res.resok.data, MAXPATHLEN);
1744 		}
1745 	} else {
1746 		nfs3_cache_post_op_attr(vp,
1747 		    &res.resfail.symlink_attributes, t, cr);
1748 		PURGE_STALE_FH(error, vp, cr);
1749 
1750 		kmem_free((void *)res.resok.data, MAXPATHLEN);
1751 
1752 	}
1753 
1754 	/*
1755 	 * The over the wire error for attempting to readlink something
1756 	 * other than a symbolic link is ENXIO.  However, we need to
1757 	 * return EINVAL instead of ENXIO, so we map it here.
1758 	 */
1759 	return (error == ENXIO ? EINVAL : error);
1760 }
1761 
1762 /*
1763  * Flush local dirty pages to stable storage on the server.
1764  *
1765  * If FNODSYNC is specified, then there is nothing to do because
1766  * metadata changes are not cached on the client before being
1767  * sent to the server.
1768  */
1769 /* ARGSUSED */
1770 static int
1771 nfs3_fsync(vnode_t *vp, int syncflag, cred_t *cr, caller_context_t *ct)
1772 {
1773 	int error;
1774 
1775 	if ((syncflag & FNODSYNC) || IS_SWAPVP(vp))
1776 		return (0);
1777 	if (nfs_zone() != VTOMI(vp)->mi_zone)
1778 		return (EIO);
1779 
1780 	error = nfs3_putpage_commit(vp, (offset_t)0, 0, cr);
1781 	if (!error)
1782 		error = VTOR(vp)->r_error;
1783 	return (error);
1784 }
1785 
1786 /*
1787  * Weirdness: if the file was removed or the target of a rename
1788  * operation while it was open, it got renamed instead.  Here we
1789  * remove the renamed file.
1790  */
1791 /* ARGSUSED */
1792 static void
1793 nfs3_inactive(vnode_t *vp, cred_t *cr, caller_context_t *ct)
1794 {
1795 	rnode_t *rp;
1796 
1797 	ASSERT(vp != DNLC_NO_VNODE);
1798 
1799 	/*
1800 	 * If this is coming from the wrong zone, we let someone in the right
1801 	 * zone take care of it asynchronously.  We can get here due to
1802 	 * VN_RELE() being called from pageout() or fsflush().  This call may
1803 	 * potentially turn into an expensive no-op if, for instance, v_count
1804 	 * gets incremented in the meantime, but it's still correct.
1805 	 */
1806 	if (nfs_zone() != VTOMI(vp)->mi_zone) {
1807 		nfs_async_inactive(vp, cr, nfs3_inactive);
1808 		return;
1809 	}
1810 
1811 	rp = VTOR(vp);
1812 redo:
1813 	if (rp->r_unldvp != NULL) {
1814 		/*
1815 		 * Save the vnode pointer for the directory where the
1816 		 * unlinked-open file got renamed, then set it to NULL
1817 		 * to prevent another thread from getting here before
1818 		 * we're done with the remove.  While we have the
1819 		 * statelock, make local copies of the pertinent rnode
1820 		 * fields.  If we weren't to do this in an atomic way, the
1821 		 * the unl* fields could become inconsistent with respect
1822 		 * to each other due to a race condition between this
1823 		 * code and nfs_remove().  See bug report 1034328.
1824 		 */
1825 		mutex_enter(&rp->r_statelock);
1826 		if (rp->r_unldvp != NULL) {
1827 			vnode_t *unldvp;
1828 			char *unlname;
1829 			cred_t *unlcred;
1830 			REMOVE3args args;
1831 			REMOVE3res res;
1832 			int douprintf;
1833 			int error;
1834 			hrtime_t t;
1835 
1836 			unldvp = rp->r_unldvp;
1837 			rp->r_unldvp = NULL;
1838 			unlname = rp->r_unlname;
1839 			rp->r_unlname = NULL;
1840 			unlcred = rp->r_unlcred;
1841 			rp->r_unlcred = NULL;
1842 			mutex_exit(&rp->r_statelock);
1843 
1844 			/*
1845 			 * If there are any dirty pages left, then flush
1846 			 * them.  This is unfortunate because they just
1847 			 * may get thrown away during the remove operation,
1848 			 * but we have to do this for correctness.
1849 			 */
1850 			if (vn_has_cached_data(vp) &&
1851 			    ((rp->r_flags & RDIRTY) || rp->r_count > 0)) {
1852 				ASSERT(vp->v_type != VCHR);
1853 				error = nfs3_putpage(vp, (offset_t)0, 0, 0,
1854 				    cr, ct);
1855 				if (error) {
1856 					mutex_enter(&rp->r_statelock);
1857 					if (!rp->r_error)
1858 						rp->r_error = error;
1859 					mutex_exit(&rp->r_statelock);
1860 				}
1861 			}
1862 
1863 			/*
1864 			 * Do the remove operation on the renamed file
1865 			 */
1866 			setdiropargs3(&args.object, unlname, unldvp);
1867 
1868 			douprintf = 1;
1869 
1870 			t = gethrtime();
1871 
1872 			error = rfs3call(VTOMI(unldvp), NFSPROC3_REMOVE,
1873 			    xdr_diropargs3, (caddr_t)&args,
1874 			    xdr_REMOVE3res, (caddr_t)&res, unlcred,
1875 			    &douprintf, &res.status, 0, NULL);
1876 
1877 			if (error) {
1878 				PURGE_ATTRCACHE(unldvp);
1879 			} else {
1880 				error = geterrno3(res.status);
1881 				if (!error) {
1882 					nfs3_cache_wcc_data(unldvp,
1883 					    &res.resok.dir_wcc, t, cr);
1884 					if (HAVE_RDDIR_CACHE(VTOR(unldvp)))
1885 						nfs_purge_rddir_cache(unldvp);
1886 				} else {
1887 					nfs3_cache_wcc_data(unldvp,
1888 					    &res.resfail.dir_wcc, t, cr);
1889 					PURGE_STALE_FH(error, unldvp, cr);
1890 				}
1891 			}
1892 
1893 			/*
1894 			 * Release stuff held for the remove
1895 			 */
1896 			VN_RELE(unldvp);
1897 			kmem_free(unlname, MAXNAMELEN);
1898 			crfree(unlcred);
1899 			goto redo;
1900 		}
1901 		mutex_exit(&rp->r_statelock);
1902 	}
1903 
1904 	rp_addfree(rp, cr);
1905 }
1906 
1907 /*
1908  * Remote file system operations having to do with directory manipulation.
1909  */
1910 
1911 /* ARGSUSED */
1912 static int
1913 nfs3_lookup(vnode_t *dvp, char *nm, vnode_t **vpp, struct pathname *pnp,
1914 	int flags, vnode_t *rdir, cred_t *cr, caller_context_t *ct,
1915 	int *direntflags, pathname_t *realpnp)
1916 {
1917 	int error;
1918 	vnode_t *vp;
1919 	vnode_t *avp = NULL;
1920 	rnode_t *drp;
1921 
1922 	if (nfs_zone() != VTOMI(dvp)->mi_zone)
1923 		return (EPERM);
1924 
1925 	drp = VTOR(dvp);
1926 
1927 	/*
1928 	 * Are we looking up extended attributes?  If so, "dvp" is
1929 	 * the file or directory for which we want attributes, and
1930 	 * we need a lookup of the hidden attribute directory
1931 	 * before we lookup the rest of the path.
1932 	 */
1933 	if (flags & LOOKUP_XATTR) {
1934 		bool_t cflag = ((flags & CREATE_XATTR_DIR) != 0);
1935 		mntinfo_t *mi;
1936 
1937 		mi = VTOMI(dvp);
1938 		if (!(mi->mi_flags & MI_EXTATTR))
1939 			return (EINVAL);
1940 
1941 		if (nfs_rw_enter_sig(&drp->r_rwlock, RW_READER, INTR(dvp)))
1942 			return (EINTR);
1943 
1944 		(void) nfs3lookup_dnlc(dvp, XATTR_DIR_NAME, &avp, cr);
1945 		if (avp == NULL)
1946 			error = acl_getxattrdir3(dvp, &avp, cflag, cr, 0);
1947 		else
1948 			error = 0;
1949 
1950 		nfs_rw_exit(&drp->r_rwlock);
1951 
1952 		if (error) {
1953 			if (mi->mi_flags & MI_EXTATTR)
1954 				return (error);
1955 			return (EINVAL);
1956 		}
1957 		dvp = avp;
1958 		drp = VTOR(dvp);
1959 	}
1960 
1961 	if (nfs_rw_enter_sig(&drp->r_rwlock, RW_READER, INTR(dvp))) {
1962 		error = EINTR;
1963 		goto out;
1964 	}
1965 
1966 	error = nfs3lookup(dvp, nm, vpp, pnp, flags, rdir, cr, 0);
1967 
1968 	nfs_rw_exit(&drp->r_rwlock);
1969 
1970 	/*
1971 	 * If vnode is a device, create special vnode.
1972 	 */
1973 	if (!error && IS_DEVVP(*vpp)) {
1974 		vp = *vpp;
1975 		*vpp = specvp(vp, vp->v_rdev, vp->v_type, cr);
1976 		VN_RELE(vp);
1977 	}
1978 
1979 out:
1980 	if (avp != NULL)
1981 		VN_RELE(avp);
1982 
1983 	return (error);
1984 }
1985 
1986 static int nfs3_lookup_neg_cache = 1;
1987 
1988 #ifdef DEBUG
1989 static int nfs3_lookup_dnlc_hits = 0;
1990 static int nfs3_lookup_dnlc_misses = 0;
1991 static int nfs3_lookup_dnlc_neg_hits = 0;
1992 static int nfs3_lookup_dnlc_disappears = 0;
1993 static int nfs3_lookup_dnlc_lookups = 0;
1994 #endif
1995 
1996 /* ARGSUSED */
1997 int
1998 nfs3lookup(vnode_t *dvp, char *nm, vnode_t **vpp, struct pathname *pnp,
1999 	int flags, vnode_t *rdir, cred_t *cr, int rfscall_flags)
2000 {
2001 	int error;
2002 	rnode_t *drp;
2003 
2004 	ASSERT(nfs_zone() == VTOMI(dvp)->mi_zone);
2005 	/*
2006 	 * If lookup is for "", just return dvp.  Don't need
2007 	 * to send it over the wire, look it up in the dnlc,
2008 	 * or perform any access checks.
2009 	 */
2010 	if (*nm == '\0') {
2011 		VN_HOLD(dvp);
2012 		*vpp = dvp;
2013 		return (0);
2014 	}
2015 
2016 	/*
2017 	 * Can't do lookups in non-directories.
2018 	 */
2019 	if (dvp->v_type != VDIR)
2020 		return (ENOTDIR);
2021 
2022 	/*
2023 	 * If we're called with RFSCALL_SOFT, it's important that
2024 	 * the only rfscall is one we make directly; if we permit
2025 	 * an access call because we're looking up "." or validating
2026 	 * a dnlc hit, we'll deadlock because that rfscall will not
2027 	 * have the RFSCALL_SOFT set.
2028 	 */
2029 	if (rfscall_flags & RFSCALL_SOFT)
2030 		goto callit;
2031 
2032 	/*
2033 	 * If lookup is for ".", just return dvp.  Don't need
2034 	 * to send it over the wire or look it up in the dnlc,
2035 	 * just need to check access.
2036 	 */
2037 	if (strcmp(nm, ".") == 0) {
2038 		error = nfs3_access(dvp, VEXEC, 0, cr, NULL);
2039 		if (error)
2040 			return (error);
2041 		VN_HOLD(dvp);
2042 		*vpp = dvp;
2043 		return (0);
2044 	}
2045 
2046 	drp = VTOR(dvp);
2047 	if (!(drp->r_flags & RLOOKUP)) {
2048 		mutex_enter(&drp->r_statelock);
2049 		drp->r_flags |= RLOOKUP;
2050 		mutex_exit(&drp->r_statelock);
2051 	}
2052 
2053 	/*
2054 	 * Lookup this name in the DNLC.  If there was a valid entry,
2055 	 * then return the results of the lookup.
2056 	 */
2057 	error = nfs3lookup_dnlc(dvp, nm, vpp, cr);
2058 	if (error || *vpp != NULL)
2059 		return (error);
2060 
2061 callit:
2062 	error = nfs3lookup_otw(dvp, nm, vpp, cr, rfscall_flags);
2063 
2064 	return (error);
2065 }
2066 
2067 static int
2068 nfs3lookup_dnlc(vnode_t *dvp, char *nm, vnode_t **vpp, cred_t *cr)
2069 {
2070 	int error;
2071 	vnode_t *vp;
2072 
2073 	ASSERT(*nm != '\0');
2074 	ASSERT(nfs_zone() == VTOMI(dvp)->mi_zone);
2075 	/*
2076 	 * Lookup this name in the DNLC.  If successful, then validate
2077 	 * the caches and then recheck the DNLC.  The DNLC is rechecked
2078 	 * just in case this entry got invalidated during the call
2079 	 * to nfs3_validate_caches.
2080 	 *
2081 	 * An assumption is being made that it is safe to say that a
2082 	 * file exists which may not on the server.  Any operations to
2083 	 * the server will fail with ESTALE.
2084 	 */
2085 #ifdef DEBUG
2086 	nfs3_lookup_dnlc_lookups++;
2087 #endif
2088 	vp = dnlc_lookup(dvp, nm);
2089 	if (vp != NULL) {
2090 		VN_RELE(vp);
2091 		if (vp == DNLC_NO_VNODE && !vn_is_readonly(dvp)) {
2092 			PURGE_ATTRCACHE(dvp);
2093 		}
2094 		error = nfs3_validate_caches(dvp, cr);
2095 		if (error)
2096 			return (error);
2097 		vp = dnlc_lookup(dvp, nm);
2098 		if (vp != NULL) {
2099 			error = nfs3_access(dvp, VEXEC, 0, cr, NULL);
2100 			if (error) {
2101 				VN_RELE(vp);
2102 				return (error);
2103 			}
2104 			if (vp == DNLC_NO_VNODE) {
2105 				VN_RELE(vp);
2106 #ifdef DEBUG
2107 				nfs3_lookup_dnlc_neg_hits++;
2108 #endif
2109 				return (ENOENT);
2110 			}
2111 			*vpp = vp;
2112 #ifdef DEBUG
2113 			nfs3_lookup_dnlc_hits++;
2114 #endif
2115 			return (0);
2116 		}
2117 #ifdef DEBUG
2118 		nfs3_lookup_dnlc_disappears++;
2119 #endif
2120 	}
2121 #ifdef DEBUG
2122 	else
2123 		nfs3_lookup_dnlc_misses++;
2124 #endif
2125 
2126 	*vpp = NULL;
2127 
2128 	return (0);
2129 }
2130 
2131 static int
2132 nfs3lookup_otw(vnode_t *dvp, char *nm, vnode_t **vpp, cred_t *cr,
2133 	int rfscall_flags)
2134 {
2135 	int error;
2136 	LOOKUP3args args;
2137 	LOOKUP3vres res;
2138 	int douprintf;
2139 	struct vattr vattr;
2140 	struct vattr dvattr;
2141 	vnode_t *vp;
2142 	failinfo_t fi;
2143 	hrtime_t t;
2144 
2145 	ASSERT(*nm != '\0');
2146 	ASSERT(dvp->v_type == VDIR);
2147 	ASSERT(nfs_zone() == VTOMI(dvp)->mi_zone);
2148 
2149 	setdiropargs3(&args.what, nm, dvp);
2150 
2151 	fi.vp = dvp;
2152 	fi.fhp = (caddr_t)&args.what.dir;
2153 	fi.copyproc = nfs3copyfh;
2154 	fi.lookupproc = nfs3lookup;
2155 	fi.xattrdirproc = acl_getxattrdir3;
2156 	res.obj_attributes.fres.vp = dvp;
2157 	res.obj_attributes.fres.vap = &vattr;
2158 	res.dir_attributes.fres.vp = dvp;
2159 	res.dir_attributes.fres.vap = &dvattr;
2160 
2161 	douprintf = 1;
2162 
2163 	t = gethrtime();
2164 
2165 	error = rfs3call(VTOMI(dvp), NFSPROC3_LOOKUP,
2166 	    xdr_diropargs3, (caddr_t)&args,
2167 	    xdr_LOOKUP3vres, (caddr_t)&res, cr,
2168 	    &douprintf, &res.status, rfscall_flags, &fi);
2169 
2170 	if (error)
2171 		return (error);
2172 
2173 	nfs3_cache_post_op_vattr(dvp, &res.dir_attributes, t, cr);
2174 
2175 	error = geterrno3(res.status);
2176 	if (error) {
2177 		PURGE_STALE_FH(error, dvp, cr);
2178 		if (error == ENOENT && nfs3_lookup_neg_cache)
2179 			dnlc_enter(dvp, nm, DNLC_NO_VNODE);
2180 		return (error);
2181 	}
2182 
2183 	if (res.obj_attributes.attributes) {
2184 		vp = makenfs3node_va(&res.object, res.obj_attributes.fres.vap,
2185 		    dvp->v_vfsp, t, cr, VTOR(dvp)->r_path, nm);
2186 	} else {
2187 		vp = makenfs3node_va(&res.object, NULL,
2188 		    dvp->v_vfsp, t, cr, VTOR(dvp)->r_path, nm);
2189 		if (vp->v_type == VNON) {
2190 			vattr.va_mask = AT_TYPE;
2191 			error = nfs3getattr(vp, &vattr, cr);
2192 			if (error) {
2193 				VN_RELE(vp);
2194 				return (error);
2195 			}
2196 			vp->v_type = vattr.va_type;
2197 		}
2198 	}
2199 
2200 	if (!(rfscall_flags & RFSCALL_SOFT))
2201 		dnlc_update(dvp, nm, vp);
2202 
2203 	*vpp = vp;
2204 
2205 	return (error);
2206 }
2207 
2208 #ifdef DEBUG
2209 static int nfs3_create_misses = 0;
2210 #endif
2211 
2212 /* ARGSUSED */
2213 static int
2214 nfs3_create(vnode_t *dvp, char *nm, struct vattr *va, enum vcexcl exclusive,
2215 	int mode, vnode_t **vpp, cred_t *cr, int lfaware, caller_context_t *ct,
2216 	vsecattr_t *vsecp)
2217 {
2218 	int error;
2219 	vnode_t *vp;
2220 	rnode_t *rp;
2221 	struct vattr vattr;
2222 	rnode_t *drp;
2223 	vnode_t *tempvp;
2224 
2225 	drp = VTOR(dvp);
2226 	if (nfs_zone() != VTOMI(dvp)->mi_zone)
2227 		return (EPERM);
2228 	if (nfs_rw_enter_sig(&drp->r_rwlock, RW_WRITER, INTR(dvp)))
2229 		return (EINTR);
2230 
2231 top:
2232 	/*
2233 	 * We make a copy of the attributes because the caller does not
2234 	 * expect us to change what va points to.
2235 	 */
2236 	vattr = *va;
2237 
2238 	/*
2239 	 * If the pathname is "", just use dvp.  Don't need
2240 	 * to send it over the wire, look it up in the dnlc,
2241 	 * or perform any access checks.
2242 	 */
2243 	if (*nm == '\0') {
2244 		error = 0;
2245 		VN_HOLD(dvp);
2246 		vp = dvp;
2247 	/*
2248 	 * If the pathname is ".", just use dvp.  Don't need
2249 	 * to send it over the wire or look it up in the dnlc,
2250 	 * just need to check access.
2251 	 */
2252 	} else if (strcmp(nm, ".") == 0) {
2253 		error = nfs3_access(dvp, VEXEC, 0, cr, ct);
2254 		if (error) {
2255 			nfs_rw_exit(&drp->r_rwlock);
2256 			return (error);
2257 		}
2258 		VN_HOLD(dvp);
2259 		vp = dvp;
2260 	/*
2261 	 * We need to go over the wire, just to be sure whether the
2262 	 * file exists or not.  Using the DNLC can be dangerous in
2263 	 * this case when making a decision regarding existence.
2264 	 */
2265 	} else {
2266 		error = nfs3lookup_otw(dvp, nm, &vp, cr, 0);
2267 	}
2268 	if (!error) {
2269 		if (exclusive == EXCL)
2270 			error = EEXIST;
2271 		else if (vp->v_type == VDIR && (mode & VWRITE))
2272 			error = EISDIR;
2273 		else {
2274 			/*
2275 			 * If vnode is a device, create special vnode.
2276 			 */
2277 			if (IS_DEVVP(vp)) {
2278 				tempvp = vp;
2279 				vp = specvp(vp, vp->v_rdev, vp->v_type, cr);
2280 				VN_RELE(tempvp);
2281 			}
2282 			if (!(error = VOP_ACCESS(vp, mode, 0, cr, ct))) {
2283 				if ((vattr.va_mask & AT_SIZE) &&
2284 				    vp->v_type == VREG) {
2285 					rp = VTOR(vp);
2286 					/*
2287 					 * Check here for large file handled
2288 					 * by LF-unaware process (as
2289 					 * ufs_create() does)
2290 					 */
2291 					if (!(lfaware & FOFFMAX)) {
2292 						mutex_enter(&rp->r_statelock);
2293 						if (rp->r_size > MAXOFF32_T)
2294 							error = EOVERFLOW;
2295 						mutex_exit(&rp->r_statelock);
2296 					}
2297 					if (!error) {
2298 						vattr.va_mask = AT_SIZE;
2299 						error = nfs3setattr(vp,
2300 						    &vattr, 0, cr);
2301 					}
2302 				}
2303 			}
2304 		}
2305 		nfs_rw_exit(&drp->r_rwlock);
2306 		if (error) {
2307 			VN_RELE(vp);
2308 		} else {
2309 			/*
2310 			 * existing file got truncated, notify.
2311 			 */
2312 			vnevent_create(vp, ct);
2313 			*vpp = vp;
2314 		}
2315 		return (error);
2316 	}
2317 
2318 	dnlc_remove(dvp, nm);
2319 
2320 	/*
2321 	 * Decide what the group-id of the created file should be.
2322 	 * Set it in attribute list as advisory...
2323 	 */
2324 	error = setdirgid(dvp, &vattr.va_gid, cr);
2325 	if (error) {
2326 		nfs_rw_exit(&drp->r_rwlock);
2327 		return (error);
2328 	}
2329 	vattr.va_mask |= AT_GID;
2330 
2331 	ASSERT(vattr.va_mask & AT_TYPE);
2332 	if (vattr.va_type == VREG) {
2333 		ASSERT(vattr.va_mask & AT_MODE);
2334 		if (MANDMODE(vattr.va_mode)) {
2335 			nfs_rw_exit(&drp->r_rwlock);
2336 			return (EACCES);
2337 		}
2338 		error = nfs3create(dvp, nm, &vattr, exclusive, mode, vpp, cr,
2339 		    lfaware);
2340 		/*
2341 		 * If this is not an exclusive create, then the CREATE
2342 		 * request will be made with the GUARDED mode set.  This
2343 		 * means that the server will return EEXIST if the file
2344 		 * exists.  The file could exist because of a retransmitted
2345 		 * request.  In this case, we recover by starting over and
2346 		 * checking to see whether the file exists.  This second
2347 		 * time through it should and a CREATE request will not be
2348 		 * sent.
2349 		 *
2350 		 * This handles the problem of a dangling CREATE request
2351 		 * which contains attributes which indicate that the file
2352 		 * should be truncated.  This retransmitted request could
2353 		 * possibly truncate valid data in the file if not caught
2354 		 * by the duplicate request mechanism on the server or if
2355 		 * not caught by other means.  The scenario is:
2356 		 *
2357 		 * Client transmits CREATE request with size = 0
2358 		 * Client times out, retransmits request.
2359 		 * Response to the first request arrives from the server
2360 		 *  and the client proceeds on.
2361 		 * Client writes data to the file.
2362 		 * The server now processes retransmitted CREATE request
2363 		 *  and truncates file.
2364 		 *
2365 		 * The use of the GUARDED CREATE request prevents this from
2366 		 * happening because the retransmitted CREATE would fail
2367 		 * with EEXIST and would not truncate the file.
2368 		 */
2369 		if (error == EEXIST && exclusive == NONEXCL) {
2370 #ifdef DEBUG
2371 			nfs3_create_misses++;
2372 #endif
2373 			goto top;
2374 		}
2375 		nfs_rw_exit(&drp->r_rwlock);
2376 		return (error);
2377 	}
2378 	error = nfs3mknod(dvp, nm, &vattr, exclusive, mode, vpp, cr);
2379 	nfs_rw_exit(&drp->r_rwlock);
2380 	return (error);
2381 }
2382 
2383 /* ARGSUSED */
2384 static int
2385 nfs3create(vnode_t *dvp, char *nm, struct vattr *va, enum vcexcl exclusive,
2386 	int mode, vnode_t **vpp, cred_t *cr, int lfaware)
2387 {
2388 	int error;
2389 	CREATE3args args;
2390 	CREATE3res res;
2391 	int douprintf;
2392 	vnode_t *vp;
2393 	struct vattr vattr;
2394 	nfstime3 *verfp;
2395 	rnode_t *rp;
2396 	timestruc_t now;
2397 	hrtime_t t;
2398 
2399 	ASSERT(nfs_zone() == VTOMI(dvp)->mi_zone);
2400 	setdiropargs3(&args.where, nm, dvp);
2401 	if (exclusive == EXCL) {
2402 		args.how.mode = EXCLUSIVE;
2403 		/*
2404 		 * Construct the create verifier.  This verifier needs
2405 		 * to be unique between different clients.  It also needs
2406 		 * to vary for each exclusive create request generated
2407 		 * from the client to the server.
2408 		 *
2409 		 * The first attempt is made to use the hostid and a
2410 		 * unique number on the client.  If the hostid has not
2411 		 * been set, the high resolution time that the exclusive
2412 		 * create request is being made is used.  This will work
2413 		 * unless two different clients, both with the hostid
2414 		 * not set, attempt an exclusive create request on the
2415 		 * same file, at exactly the same clock time.  The
2416 		 * chances of this happening seem small enough to be
2417 		 * reasonable.
2418 		 */
2419 		verfp = (nfstime3 *)&args.how.createhow3_u.verf;
2420 		verfp->seconds = zone_get_hostid(NULL);
2421 		if (verfp->seconds != 0)
2422 			verfp->nseconds = newnum();
2423 		else {
2424 			gethrestime(&now);
2425 			verfp->seconds = now.tv_sec;
2426 			verfp->nseconds = now.tv_nsec;
2427 		}
2428 		/*
2429 		 * Since the server will use this value for the mtime,
2430 		 * make sure that it can't overflow. Zero out the MSB.
2431 		 * The actual value does not matter here, only its uniqeness.
2432 		 */
2433 		verfp->seconds %= INT32_MAX;
2434 	} else {
2435 		/*
2436 		 * Issue the non-exclusive create in guarded mode.  This
2437 		 * may result in some false EEXIST responses for
2438 		 * retransmitted requests, but these will be handled at
2439 		 * a higher level.  By using GUARDED, duplicate requests
2440 		 * to do file truncation and possible access problems
2441 		 * can be avoided.
2442 		 */
2443 		args.how.mode = GUARDED;
2444 		error = vattr_to_sattr3(va,
2445 		    &args.how.createhow3_u.obj_attributes);
2446 		if (error) {
2447 			/* req time field(s) overflow - return immediately */
2448 			return (error);
2449 		}
2450 	}
2451 
2452 	douprintf = 1;
2453 
2454 	t = gethrtime();
2455 
2456 	error = rfs3call(VTOMI(dvp), NFSPROC3_CREATE,
2457 	    xdr_CREATE3args, (caddr_t)&args,
2458 	    xdr_CREATE3res, (caddr_t)&res, cr,
2459 	    &douprintf, &res.status, 0, NULL);
2460 
2461 	if (error) {
2462 		PURGE_ATTRCACHE(dvp);
2463 		return (error);
2464 	}
2465 
2466 	error = geterrno3(res.status);
2467 	if (!error) {
2468 		nfs3_cache_wcc_data(dvp, &res.resok.dir_wcc, t, cr);
2469 		if (HAVE_RDDIR_CACHE(VTOR(dvp)))
2470 			nfs_purge_rddir_cache(dvp);
2471 
2472 		/*
2473 		 * On exclusive create the times need to be explicitly
2474 		 * set to clear any potential verifier that may be stored
2475 		 * in one of these fields (see comment below).  This
2476 		 * is done here to cover the case where no post op attrs
2477 		 * were returned or a 'invalid' time was returned in
2478 		 * the attributes.
2479 		 */
2480 		if (exclusive == EXCL)
2481 			va->va_mask |= (AT_MTIME | AT_ATIME);
2482 
2483 		if (!res.resok.obj.handle_follows) {
2484 			error = nfs3lookup(dvp, nm, &vp, NULL, 0, NULL, cr, 0);
2485 			if (error)
2486 				return (error);
2487 		} else {
2488 			if (res.resok.obj_attributes.attributes) {
2489 				vp = makenfs3node(&res.resok.obj.handle,
2490 				    &res.resok.obj_attributes.attr,
2491 				    dvp->v_vfsp, t, cr, NULL, NULL);
2492 			} else {
2493 				vp = makenfs3node(&res.resok.obj.handle, NULL,
2494 				    dvp->v_vfsp, t, cr, NULL, NULL);
2495 
2496 				/*
2497 				 * On an exclusive create, it is possible
2498 				 * that attributes were returned but those
2499 				 * postop attributes failed to decode
2500 				 * properly.  If this is the case,
2501 				 * then most likely the atime or mtime
2502 				 * were invalid for our client; this
2503 				 * is caused by the server storing the
2504 				 * create verifier in one of the time
2505 				 * fields(most likely mtime).
2506 				 * So... we are going to setattr just the
2507 				 * atime/mtime to clear things up.
2508 				 */
2509 				if (exclusive == EXCL) {
2510 					if (error =
2511 					    nfs3excl_create_settimes(vp,
2512 					    va, cr)) {
2513 						/*
2514 						 * Setting the times failed.
2515 						 * Remove the file and return
2516 						 * the error.
2517 						 */
2518 						VN_RELE(vp);
2519 						(void) nfs3_remove(dvp,
2520 						    nm, cr, NULL, 0);
2521 						return (error);
2522 					}
2523 				}
2524 
2525 				/*
2526 				 * This handles the non-exclusive case
2527 				 * and the exclusive case where no post op
2528 				 * attrs were returned.
2529 				 */
2530 				if (vp->v_type == VNON) {
2531 					vattr.va_mask = AT_TYPE;
2532 					error = nfs3getattr(vp, &vattr, cr);
2533 					if (error) {
2534 						VN_RELE(vp);
2535 						return (error);
2536 					}
2537 					vp->v_type = vattr.va_type;
2538 				}
2539 			}
2540 			dnlc_update(dvp, nm, vp);
2541 		}
2542 
2543 		rp = VTOR(vp);
2544 
2545 		/*
2546 		 * Check here for large file handled by
2547 		 * LF-unaware process (as ufs_create() does)
2548 		 */
2549 		if ((va->va_mask & AT_SIZE) && vp->v_type == VREG &&
2550 		    !(lfaware & FOFFMAX)) {
2551 			mutex_enter(&rp->r_statelock);
2552 			if (rp->r_size > MAXOFF32_T) {
2553 				mutex_exit(&rp->r_statelock);
2554 				VN_RELE(vp);
2555 				return (EOVERFLOW);
2556 			}
2557 			mutex_exit(&rp->r_statelock);
2558 		}
2559 
2560 		if (exclusive == EXCL &&
2561 		    (va->va_mask & ~(AT_GID | AT_SIZE))) {
2562 			/*
2563 			 * If doing an exclusive create, then generate
2564 			 * a SETATTR to set the initial attributes.
2565 			 * Try to set the mtime and the atime to the
2566 			 * server's current time.  It is somewhat
2567 			 * expected that these fields will be used to
2568 			 * store the exclusive create cookie.  If not,
2569 			 * server implementors will need to know that
2570 			 * a SETATTR will follow an exclusive create
2571 			 * and the cookie should be destroyed if
2572 			 * appropriate. This work may have been done
2573 			 * earlier in this function if post op attrs
2574 			 * were not available.
2575 			 *
2576 			 * The AT_GID and AT_SIZE bits are turned off
2577 			 * so that the SETATTR request will not attempt
2578 			 * to process these.  The gid will be set
2579 			 * separately if appropriate.  The size is turned
2580 			 * off because it is assumed that a new file will
2581 			 * be created empty and if the file wasn't empty,
2582 			 * then the exclusive create will have failed
2583 			 * because the file must have existed already.
2584 			 * Therefore, no truncate operation is needed.
2585 			 */
2586 			va->va_mask &= ~(AT_GID | AT_SIZE);
2587 			error = nfs3setattr(vp, va, 0, cr);
2588 			if (error) {
2589 				/*
2590 				 * Couldn't correct the attributes of
2591 				 * the newly created file and the
2592 				 * attributes are wrong.  Remove the
2593 				 * file and return an error to the
2594 				 * application.
2595 				 */
2596 				VN_RELE(vp);
2597 				(void) nfs3_remove(dvp, nm, cr, NULL, 0);
2598 				return (error);
2599 			}
2600 		}
2601 
2602 		if (va->va_gid != rp->r_attr.va_gid) {
2603 			/*
2604 			 * If the gid on the file isn't right, then
2605 			 * generate a SETATTR to attempt to change
2606 			 * it.  This may or may not work, depending
2607 			 * upon the server's semantics for allowing
2608 			 * file ownership changes.
2609 			 */
2610 			va->va_mask = AT_GID;
2611 			(void) nfs3setattr(vp, va, 0, cr);
2612 		}
2613 
2614 		/*
2615 		 * If vnode is a device create special vnode
2616 		 */
2617 		if (IS_DEVVP(vp)) {
2618 			*vpp = specvp(vp, vp->v_rdev, vp->v_type, cr);
2619 			VN_RELE(vp);
2620 		} else
2621 			*vpp = vp;
2622 	} else {
2623 		nfs3_cache_wcc_data(dvp, &res.resfail.dir_wcc, t, cr);
2624 		PURGE_STALE_FH(error, dvp, cr);
2625 	}
2626 
2627 	return (error);
2628 }
2629 
2630 /*
2631  * Special setattr function to take care of rest of atime/mtime
2632  * after successful exclusive create.  This function exists to avoid
2633  * handling attributes from the server; exclusive the atime/mtime fields
2634  * may be 'invalid' in client's view and therefore can not be trusted.
2635  */
2636 static int
2637 nfs3excl_create_settimes(vnode_t *vp, struct vattr *vap, cred_t *cr)
2638 {
2639 	int error;
2640 	uint_t mask;
2641 	SETATTR3args args;
2642 	SETATTR3res res;
2643 	int douprintf;
2644 	rnode_t *rp;
2645 	hrtime_t t;
2646 
2647 	ASSERT(nfs_zone() == VTOMI(vp)->mi_zone);
2648 	/* save the caller's mask so that it can be reset later */
2649 	mask = vap->va_mask;
2650 
2651 	rp = VTOR(vp);
2652 
2653 	args.object = *RTOFH3(rp);
2654 	args.guard.check = FALSE;
2655 
2656 	/* Use the mask to initialize the arguments */
2657 	vap->va_mask = 0;
2658 	error = vattr_to_sattr3(vap, &args.new_attributes);
2659 
2660 	/* We want to set just atime/mtime on this request */
2661 	args.new_attributes.atime.set_it = SET_TO_SERVER_TIME;
2662 	args.new_attributes.mtime.set_it = SET_TO_SERVER_TIME;
2663 
2664 	douprintf = 1;
2665 
2666 	t = gethrtime();
2667 
2668 	error = rfs3call(VTOMI(vp), NFSPROC3_SETATTR,
2669 	    xdr_SETATTR3args, (caddr_t)&args,
2670 	    xdr_SETATTR3res, (caddr_t)&res, cr,
2671 	    &douprintf, &res.status, 0, NULL);
2672 
2673 	if (error) {
2674 		vap->va_mask = mask;
2675 		return (error);
2676 	}
2677 
2678 	error = geterrno3(res.status);
2679 	if (!error) {
2680 		/*
2681 		 * It is important to pick up the attributes.
2682 		 * Since this is the exclusive create path, the
2683 		 * attributes on the initial create were ignored
2684 		 * and we need these to have the correct info.
2685 		 */
2686 		nfs3_cache_wcc_data(vp, &res.resok.obj_wcc, t, cr);
2687 		/*
2688 		 * No need to do the atime/mtime work again so clear
2689 		 * the bits.
2690 		 */
2691 		mask &= ~(AT_ATIME | AT_MTIME);
2692 	} else {
2693 		nfs3_cache_wcc_data(vp, &res.resfail.obj_wcc, t, cr);
2694 	}
2695 
2696 	vap->va_mask = mask;
2697 
2698 	return (error);
2699 }
2700 
2701 /* ARGSUSED */
2702 static int
2703 nfs3mknod(vnode_t *dvp, char *nm, struct vattr *va, enum vcexcl exclusive,
2704 	int mode, vnode_t **vpp, cred_t *cr)
2705 {
2706 	int error;
2707 	MKNOD3args args;
2708 	MKNOD3res res;
2709 	int douprintf;
2710 	vnode_t *vp;
2711 	struct vattr vattr;
2712 	hrtime_t t;
2713 
2714 	ASSERT(nfs_zone() == VTOMI(dvp)->mi_zone);
2715 	switch (va->va_type) {
2716 	case VCHR:
2717 	case VBLK:
2718 		setdiropargs3(&args.where, nm, dvp);
2719 		args.what.type = (va->va_type == VCHR) ? NF3CHR : NF3BLK;
2720 		error = vattr_to_sattr3(va,
2721 		    &args.what.mknoddata3_u.device.dev_attributes);
2722 		if (error) {
2723 			/* req time field(s) overflow - return immediately */
2724 			return (error);
2725 		}
2726 		args.what.mknoddata3_u.device.spec.specdata1 =
2727 		    getmajor(va->va_rdev);
2728 		args.what.mknoddata3_u.device.spec.specdata2 =
2729 		    getminor(va->va_rdev);
2730 		break;
2731 
2732 	case VFIFO:
2733 	case VSOCK:
2734 		setdiropargs3(&args.where, nm, dvp);
2735 		args.what.type = (va->va_type == VFIFO) ? NF3FIFO : NF3SOCK;
2736 		error = vattr_to_sattr3(va,
2737 		    &args.what.mknoddata3_u.pipe_attributes);
2738 		if (error) {
2739 			/* req time field(s) overflow - return immediately */
2740 			return (error);
2741 		}
2742 		break;
2743 
2744 	default:
2745 		return (EINVAL);
2746 	}
2747 
2748 	douprintf = 1;
2749 
2750 	t = gethrtime();
2751 
2752 	error = rfs3call(VTOMI(dvp), NFSPROC3_MKNOD,
2753 	    xdr_MKNOD3args, (caddr_t)&args,
2754 	    xdr_MKNOD3res, (caddr_t)&res, cr,
2755 	    &douprintf, &res.status, 0, NULL);
2756 
2757 	if (error) {
2758 		PURGE_ATTRCACHE(dvp);
2759 		return (error);
2760 	}
2761 
2762 	error = geterrno3(res.status);
2763 	if (!error) {
2764 		nfs3_cache_wcc_data(dvp, &res.resok.dir_wcc, t, cr);
2765 		if (HAVE_RDDIR_CACHE(VTOR(dvp)))
2766 			nfs_purge_rddir_cache(dvp);
2767 
2768 		if (!res.resok.obj.handle_follows) {
2769 			error = nfs3lookup(dvp, nm, &vp, NULL, 0, NULL, cr, 0);
2770 			if (error)
2771 				return (error);
2772 		} else {
2773 			if (res.resok.obj_attributes.attributes) {
2774 				vp = makenfs3node(&res.resok.obj.handle,
2775 				    &res.resok.obj_attributes.attr,
2776 				    dvp->v_vfsp, t, cr, NULL, NULL);
2777 			} else {
2778 				vp = makenfs3node(&res.resok.obj.handle, NULL,
2779 				    dvp->v_vfsp, t, cr, NULL, NULL);
2780 				if (vp->v_type == VNON) {
2781 					vattr.va_mask = AT_TYPE;
2782 					error = nfs3getattr(vp, &vattr, cr);
2783 					if (error) {
2784 						VN_RELE(vp);
2785 						return (error);
2786 					}
2787 					vp->v_type = vattr.va_type;
2788 				}
2789 
2790 			}
2791 			dnlc_update(dvp, nm, vp);
2792 		}
2793 
2794 		if (va->va_gid != VTOR(vp)->r_attr.va_gid) {
2795 			va->va_mask = AT_GID;
2796 			(void) nfs3setattr(vp, va, 0, cr);
2797 		}
2798 
2799 		/*
2800 		 * If vnode is a device create special vnode
2801 		 */
2802 		if (IS_DEVVP(vp)) {
2803 			*vpp = specvp(vp, vp->v_rdev, vp->v_type, cr);
2804 			VN_RELE(vp);
2805 		} else
2806 			*vpp = vp;
2807 	} else {
2808 		nfs3_cache_wcc_data(dvp, &res.resfail.dir_wcc, t, cr);
2809 		PURGE_STALE_FH(error, dvp, cr);
2810 	}
2811 	return (error);
2812 }
2813 
2814 /*
2815  * Weirdness: if the vnode to be removed is open
2816  * we rename it instead of removing it and nfs_inactive
2817  * will remove the new name.
2818  */
2819 /* ARGSUSED */
2820 static int
2821 nfs3_remove(vnode_t *dvp, char *nm, cred_t *cr, caller_context_t *ct, int flags)
2822 {
2823 	int error;
2824 	REMOVE3args args;
2825 	REMOVE3res res;
2826 	vnode_t *vp;
2827 	char *tmpname;
2828 	int douprintf;
2829 	rnode_t *rp;
2830 	rnode_t *drp;
2831 	hrtime_t t;
2832 
2833 	if (nfs_zone() != VTOMI(dvp)->mi_zone)
2834 		return (EPERM);
2835 	drp = VTOR(dvp);
2836 	if (nfs_rw_enter_sig(&drp->r_rwlock, RW_WRITER, INTR(dvp)))
2837 		return (EINTR);
2838 
2839 	error = nfs3lookup(dvp, nm, &vp, NULL, 0, NULL, cr, 0);
2840 	if (error) {
2841 		nfs_rw_exit(&drp->r_rwlock);
2842 		return (error);
2843 	}
2844 
2845 	if (vp->v_type == VDIR && secpolicy_fs_linkdir(cr, dvp->v_vfsp)) {
2846 		VN_RELE(vp);
2847 		nfs_rw_exit(&drp->r_rwlock);
2848 		return (EPERM);
2849 	}
2850 
2851 	/*
2852 	 * First just remove the entry from the name cache, as it
2853 	 * is most likely the only entry for this vp.
2854 	 */
2855 	dnlc_remove(dvp, nm);
2856 
2857 	/*
2858 	 * If the file has a v_count > 1 then there may be more than one
2859 	 * entry in the name cache due multiple links or an open file,
2860 	 * but we don't have the real reference count so flush all
2861 	 * possible entries.
2862 	 */
2863 	if (vp->v_count > 1)
2864 		dnlc_purge_vp(vp);
2865 
2866 	/*
2867 	 * Now we have the real reference count on the vnode
2868 	 */
2869 	rp = VTOR(vp);
2870 	mutex_enter(&rp->r_statelock);
2871 	if (vp->v_count > 1 &&
2872 	    (rp->r_unldvp == NULL || strcmp(nm, rp->r_unlname) == 0)) {
2873 		mutex_exit(&rp->r_statelock);
2874 		tmpname = newname();
2875 		error = nfs3rename(dvp, nm, dvp, tmpname, cr, ct);
2876 		if (error)
2877 			kmem_free(tmpname, MAXNAMELEN);
2878 		else {
2879 			mutex_enter(&rp->r_statelock);
2880 			if (rp->r_unldvp == NULL) {
2881 				VN_HOLD(dvp);
2882 				rp->r_unldvp = dvp;
2883 				if (rp->r_unlcred != NULL)
2884 					crfree(rp->r_unlcred);
2885 				crhold(cr);
2886 				rp->r_unlcred = cr;
2887 				rp->r_unlname = tmpname;
2888 			} else {
2889 				kmem_free(rp->r_unlname, MAXNAMELEN);
2890 				rp->r_unlname = tmpname;
2891 			}
2892 			mutex_exit(&rp->r_statelock);
2893 		}
2894 	} else {
2895 		mutex_exit(&rp->r_statelock);
2896 		/*
2897 		 * We need to flush any dirty pages which happen to
2898 		 * be hanging around before removing the file.  This
2899 		 * shouldn't happen very often and mostly on file
2900 		 * systems mounted "nocto".
2901 		 */
2902 		if (vn_has_cached_data(vp) &&
2903 		    ((rp->r_flags & RDIRTY) || rp->r_count > 0)) {
2904 			error = nfs3_putpage(vp, (offset_t)0, 0, 0, cr, ct);
2905 			if (error && (error == ENOSPC || error == EDQUOT)) {
2906 				mutex_enter(&rp->r_statelock);
2907 				if (!rp->r_error)
2908 					rp->r_error = error;
2909 				mutex_exit(&rp->r_statelock);
2910 			}
2911 		}
2912 
2913 		setdiropargs3(&args.object, nm, dvp);
2914 
2915 		douprintf = 1;
2916 
2917 		t = gethrtime();
2918 
2919 		error = rfs3call(VTOMI(dvp), NFSPROC3_REMOVE,
2920 		    xdr_diropargs3, (caddr_t)&args,
2921 		    xdr_REMOVE3res, (caddr_t)&res, cr,
2922 		    &douprintf, &res.status, 0, NULL);
2923 
2924 		/*
2925 		 * The xattr dir may be gone after last attr is removed,
2926 		 * so flush it from dnlc.
2927 		 */
2928 		if (dvp->v_flag & V_XATTRDIR)
2929 			dnlc_purge_vp(dvp);
2930 
2931 		PURGE_ATTRCACHE(vp);
2932 
2933 		if (error) {
2934 			PURGE_ATTRCACHE(dvp);
2935 		} else {
2936 			error = geterrno3(res.status);
2937 			if (!error) {
2938 				nfs3_cache_wcc_data(dvp, &res.resok.dir_wcc, t,
2939 				    cr);
2940 				if (HAVE_RDDIR_CACHE(drp))
2941 					nfs_purge_rddir_cache(dvp);
2942 			} else {
2943 				nfs3_cache_wcc_data(dvp, &res.resfail.dir_wcc,
2944 				    t, cr);
2945 				PURGE_STALE_FH(error, dvp, cr);
2946 			}
2947 		}
2948 	}
2949 
2950 	if (error == 0) {
2951 		vnevent_remove(vp, dvp, nm, ct);
2952 	}
2953 	VN_RELE(vp);
2954 
2955 	nfs_rw_exit(&drp->r_rwlock);
2956 
2957 	return (error);
2958 }
2959 
2960 /* ARGSUSED */
2961 static int
2962 nfs3_link(vnode_t *tdvp, vnode_t *svp, char *tnm, cred_t *cr,
2963 	caller_context_t *ct, int flags)
2964 {
2965 	int error;
2966 	LINK3args args;
2967 	LINK3res res;
2968 	vnode_t *realvp;
2969 	int douprintf;
2970 	mntinfo_t *mi;
2971 	rnode_t *tdrp;
2972 	hrtime_t t;
2973 
2974 	if (nfs_zone() != VTOMI(tdvp)->mi_zone)
2975 		return (EPERM);
2976 	if (VOP_REALVP(svp, &realvp, ct) == 0)
2977 		svp = realvp;
2978 
2979 	mi = VTOMI(svp);
2980 
2981 	if (!(mi->mi_flags & MI_LINK))
2982 		return (EOPNOTSUPP);
2983 
2984 	args.file = *VTOFH3(svp);
2985 	setdiropargs3(&args.link, tnm, tdvp);
2986 
2987 	tdrp = VTOR(tdvp);
2988 	if (nfs_rw_enter_sig(&tdrp->r_rwlock, RW_WRITER, INTR(tdvp)))
2989 		return (EINTR);
2990 
2991 	dnlc_remove(tdvp, tnm);
2992 
2993 	douprintf = 1;
2994 
2995 	t = gethrtime();
2996 
2997 	error = rfs3call(mi, NFSPROC3_LINK,
2998 	    xdr_LINK3args, (caddr_t)&args,
2999 	    xdr_LINK3res, (caddr_t)&res, cr,
3000 	    &douprintf, &res.status, 0, NULL);
3001 
3002 	if (error) {
3003 		PURGE_ATTRCACHE(tdvp);
3004 		PURGE_ATTRCACHE(svp);
3005 		nfs_rw_exit(&tdrp->r_rwlock);
3006 		return (error);
3007 	}
3008 
3009 	error = geterrno3(res.status);
3010 
3011 	if (!error) {
3012 		nfs3_cache_post_op_attr(svp, &res.resok.file_attributes, t, cr);
3013 		nfs3_cache_wcc_data(tdvp, &res.resok.linkdir_wcc, t, cr);
3014 		if (HAVE_RDDIR_CACHE(tdrp))
3015 			nfs_purge_rddir_cache(tdvp);
3016 		dnlc_update(tdvp, tnm, svp);
3017 	} else {
3018 		nfs3_cache_post_op_attr(svp, &res.resfail.file_attributes, t,
3019 		    cr);
3020 		nfs3_cache_wcc_data(tdvp, &res.resfail.linkdir_wcc, t, cr);
3021 		if (error == EOPNOTSUPP) {
3022 			mutex_enter(&mi->mi_lock);
3023 			mi->mi_flags &= ~MI_LINK;
3024 			mutex_exit(&mi->mi_lock);
3025 		}
3026 	}
3027 
3028 	nfs_rw_exit(&tdrp->r_rwlock);
3029 
3030 	if (!error) {
3031 		/*
3032 		 * Notify the source file of this link operation.
3033 		 */
3034 		vnevent_link(svp, ct);
3035 	}
3036 	return (error);
3037 }
3038 
3039 /* ARGSUSED */
3040 static int
3041 nfs3_rename(vnode_t *odvp, char *onm, vnode_t *ndvp, char *nnm, cred_t *cr,
3042 	caller_context_t *ct, int flags)
3043 {
3044 	vnode_t *realvp;
3045 
3046 	if (nfs_zone() != VTOMI(odvp)->mi_zone)
3047 		return (EPERM);
3048 	if (VOP_REALVP(ndvp, &realvp, ct) == 0)
3049 		ndvp = realvp;
3050 
3051 	return (nfs3rename(odvp, onm, ndvp, nnm, cr, ct));
3052 }
3053 
3054 /*
3055  * nfs3rename does the real work of renaming in NFS Version 3.
3056  */
3057 static int
3058 nfs3rename(vnode_t *odvp, char *onm, vnode_t *ndvp, char *nnm, cred_t *cr,
3059     caller_context_t *ct)
3060 {
3061 	int error;
3062 	RENAME3args args;
3063 	RENAME3res res;
3064 	int douprintf;
3065 	vnode_t *nvp = NULL;
3066 	vnode_t *ovp = NULL;
3067 	char *tmpname;
3068 	rnode_t *rp;
3069 	rnode_t *odrp;
3070 	rnode_t *ndrp;
3071 	hrtime_t t;
3072 
3073 	ASSERT(nfs_zone() == VTOMI(odvp)->mi_zone);
3074 
3075 	if (strcmp(onm, ".") == 0 || strcmp(onm, "..") == 0 ||
3076 	    strcmp(nnm, ".") == 0 || strcmp(nnm, "..") == 0)
3077 		return (EINVAL);
3078 
3079 	odrp = VTOR(odvp);
3080 	ndrp = VTOR(ndvp);
3081 	if ((intptr_t)odrp < (intptr_t)ndrp) {
3082 		if (nfs_rw_enter_sig(&odrp->r_rwlock, RW_WRITER, INTR(odvp)))
3083 			return (EINTR);
3084 		if (nfs_rw_enter_sig(&ndrp->r_rwlock, RW_WRITER, INTR(ndvp))) {
3085 			nfs_rw_exit(&odrp->r_rwlock);
3086 			return (EINTR);
3087 		}
3088 	} else {
3089 		if (nfs_rw_enter_sig(&ndrp->r_rwlock, RW_WRITER, INTR(ndvp)))
3090 			return (EINTR);
3091 		if (nfs_rw_enter_sig(&odrp->r_rwlock, RW_WRITER, INTR(odvp))) {
3092 			nfs_rw_exit(&ndrp->r_rwlock);
3093 			return (EINTR);
3094 		}
3095 	}
3096 
3097 	/*
3098 	 * Lookup the target file.  If it exists, it needs to be
3099 	 * checked to see whether it is a mount point and whether
3100 	 * it is active (open).
3101 	 */
3102 	error = nfs3lookup(ndvp, nnm, &nvp, NULL, 0, NULL, cr, 0);
3103 	if (!error) {
3104 		/*
3105 		 * If this file has been mounted on, then just
3106 		 * return busy because renaming to it would remove
3107 		 * the mounted file system from the name space.
3108 		 */
3109 		if (vn_mountedvfs(nvp) != NULL) {
3110 			VN_RELE(nvp);
3111 			nfs_rw_exit(&odrp->r_rwlock);
3112 			nfs_rw_exit(&ndrp->r_rwlock);
3113 			return (EBUSY);
3114 		}
3115 
3116 		/*
3117 		 * Purge the name cache of all references to this vnode
3118 		 * so that we can check the reference count to infer
3119 		 * whether it is active or not.
3120 		 */
3121 		/*
3122 		 * First just remove the entry from the name cache, as it
3123 		 * is most likely the only entry for this vp.
3124 		 */
3125 		dnlc_remove(ndvp, nnm);
3126 		/*
3127 		 * If the file has a v_count > 1 then there may be more
3128 		 * than one entry in the name cache due multiple links
3129 		 * or an open file, but we don't have the real reference
3130 		 * count so flush all possible entries.
3131 		 */
3132 		if (nvp->v_count > 1)
3133 			dnlc_purge_vp(nvp);
3134 
3135 		/*
3136 		 * If the vnode is active and is not a directory,
3137 		 * arrange to rename it to a
3138 		 * temporary file so that it will continue to be
3139 		 * accessible.  This implements the "unlink-open-file"
3140 		 * semantics for the target of a rename operation.
3141 		 * Before doing this though, make sure that the
3142 		 * source and target files are not already the same.
3143 		 */
3144 		if (nvp->v_count > 1 && nvp->v_type != VDIR) {
3145 			/*
3146 			 * Lookup the source name.
3147 			 */
3148 			error = nfs3lookup(odvp, onm, &ovp, NULL, 0, NULL,
3149 			    cr, 0);
3150 
3151 			/*
3152 			 * The source name *should* already exist.
3153 			 */
3154 			if (error) {
3155 				VN_RELE(nvp);
3156 				nfs_rw_exit(&odrp->r_rwlock);
3157 				nfs_rw_exit(&ndrp->r_rwlock);
3158 				return (error);
3159 			}
3160 
3161 			/*
3162 			 * Compare the two vnodes.  If they are the same,
3163 			 * just release all held vnodes and return success.
3164 			 */
3165 			if (ovp == nvp) {
3166 				VN_RELE(ovp);
3167 				VN_RELE(nvp);
3168 				nfs_rw_exit(&odrp->r_rwlock);
3169 				nfs_rw_exit(&ndrp->r_rwlock);
3170 				return (0);
3171 			}
3172 
3173 			/*
3174 			 * Can't mix and match directories and non-
3175 			 * directories in rename operations.  We already
3176 			 * know that the target is not a directory.  If
3177 			 * the source is a directory, return an error.
3178 			 */
3179 			if (ovp->v_type == VDIR) {
3180 				VN_RELE(ovp);
3181 				VN_RELE(nvp);
3182 				nfs_rw_exit(&odrp->r_rwlock);
3183 				nfs_rw_exit(&ndrp->r_rwlock);
3184 				return (ENOTDIR);
3185 			}
3186 
3187 			/*
3188 			 * The target file exists, is not the same as
3189 			 * the source file, and is active.  Link it
3190 			 * to a temporary filename to avoid having
3191 			 * the server removing the file completely.
3192 			 */
3193 			tmpname = newname();
3194 			error = nfs3_link(ndvp, nvp, tmpname, cr, NULL, 0);
3195 			if (error == EOPNOTSUPP) {
3196 				error = nfs3_rename(ndvp, nnm, ndvp, tmpname,
3197 				    cr, NULL, 0);
3198 			}
3199 			if (error) {
3200 				kmem_free(tmpname, MAXNAMELEN);
3201 				VN_RELE(ovp);
3202 				VN_RELE(nvp);
3203 				nfs_rw_exit(&odrp->r_rwlock);
3204 				nfs_rw_exit(&ndrp->r_rwlock);
3205 				return (error);
3206 			}
3207 			rp = VTOR(nvp);
3208 			mutex_enter(&rp->r_statelock);
3209 			if (rp->r_unldvp == NULL) {
3210 				VN_HOLD(ndvp);
3211 				rp->r_unldvp = ndvp;
3212 				if (rp->r_unlcred != NULL)
3213 					crfree(rp->r_unlcred);
3214 				crhold(cr);
3215 				rp->r_unlcred = cr;
3216 				rp->r_unlname = tmpname;
3217 			} else {
3218 				kmem_free(rp->r_unlname, MAXNAMELEN);
3219 				rp->r_unlname = tmpname;
3220 			}
3221 			mutex_exit(&rp->r_statelock);
3222 		}
3223 	}
3224 
3225 	if (ovp == NULL) {
3226 		/*
3227 		 * When renaming directories to be a subdirectory of a
3228 		 * different parent, the dnlc entry for ".." will no
3229 		 * longer be valid, so it must be removed.
3230 		 *
3231 		 * We do a lookup here to determine whether we are renaming
3232 		 * a directory and we need to check if we are renaming
3233 		 * an unlinked file.  This might have already been done
3234 		 * in previous code, so we check ovp == NULL to avoid
3235 		 * doing it twice.
3236 		 */
3237 
3238 		error = nfs3lookup(odvp, onm, &ovp, NULL, 0, NULL, cr, 0);
3239 		/*
3240 		 * The source name *should* already exist.
3241 		 */
3242 		if (error) {
3243 			nfs_rw_exit(&odrp->r_rwlock);
3244 			nfs_rw_exit(&ndrp->r_rwlock);
3245 			if (nvp) {
3246 				VN_RELE(nvp);
3247 			}
3248 			return (error);
3249 		}
3250 		ASSERT(ovp != NULL);
3251 	}
3252 
3253 	dnlc_remove(odvp, onm);
3254 	dnlc_remove(ndvp, nnm);
3255 
3256 	setdiropargs3(&args.from, onm, odvp);
3257 	setdiropargs3(&args.to, nnm, ndvp);
3258 
3259 	douprintf = 1;
3260 
3261 	t = gethrtime();
3262 
3263 	error = rfs3call(VTOMI(odvp), NFSPROC3_RENAME,
3264 	    xdr_RENAME3args, (caddr_t)&args,
3265 	    xdr_RENAME3res, (caddr_t)&res, cr,
3266 	    &douprintf, &res.status, 0, NULL);
3267 
3268 	if (error) {
3269 		PURGE_ATTRCACHE(odvp);
3270 		PURGE_ATTRCACHE(ndvp);
3271 		VN_RELE(ovp);
3272 		nfs_rw_exit(&odrp->r_rwlock);
3273 		nfs_rw_exit(&ndrp->r_rwlock);
3274 		if (nvp) {
3275 			VN_RELE(nvp);
3276 		}
3277 		return (error);
3278 	}
3279 
3280 	error = geterrno3(res.status);
3281 
3282 	if (!error) {
3283 		nfs3_cache_wcc_data(odvp, &res.resok.fromdir_wcc, t, cr);
3284 		if (HAVE_RDDIR_CACHE(odrp))
3285 			nfs_purge_rddir_cache(odvp);
3286 		if (ndvp != odvp) {
3287 			nfs3_cache_wcc_data(ndvp, &res.resok.todir_wcc, t, cr);
3288 			if (HAVE_RDDIR_CACHE(ndrp))
3289 				nfs_purge_rddir_cache(ndvp);
3290 		}
3291 		/*
3292 		 * when renaming directories to be a subdirectory of a
3293 		 * different parent, the dnlc entry for ".." will no
3294 		 * longer be valid, so it must be removed
3295 		 */
3296 		rp = VTOR(ovp);
3297 		if (ndvp != odvp) {
3298 			if (ovp->v_type == VDIR) {
3299 				dnlc_remove(ovp, "..");
3300 				if (HAVE_RDDIR_CACHE(rp))
3301 					nfs_purge_rddir_cache(ovp);
3302 			}
3303 		}
3304 
3305 		/*
3306 		 * If we are renaming the unlinked file, update the
3307 		 * r_unldvp and r_unlname as needed.
3308 		 */
3309 		mutex_enter(&rp->r_statelock);
3310 		if (rp->r_unldvp != NULL) {
3311 			if (strcmp(rp->r_unlname, onm) == 0) {
3312 				(void) strncpy(rp->r_unlname, nnm, MAXNAMELEN);
3313 				rp->r_unlname[MAXNAMELEN - 1] = '\0';
3314 
3315 				if (ndvp != rp->r_unldvp) {
3316 					VN_RELE(rp->r_unldvp);
3317 					rp->r_unldvp = ndvp;
3318 					VN_HOLD(ndvp);
3319 				}
3320 			}
3321 		}
3322 		mutex_exit(&rp->r_statelock);
3323 	} else {
3324 		nfs3_cache_wcc_data(odvp, &res.resfail.fromdir_wcc, t, cr);
3325 		if (ndvp != odvp) {
3326 			nfs3_cache_wcc_data(ndvp, &res.resfail.todir_wcc, t,
3327 			    cr);
3328 		}
3329 		/*
3330 		 * System V defines rename to return EEXIST, not
3331 		 * ENOTEMPTY if the target directory is not empty.
3332 		 * Over the wire, the error is NFSERR_ENOTEMPTY
3333 		 * which geterrno maps to ENOTEMPTY.
3334 		 */
3335 		if (error == ENOTEMPTY)
3336 			error = EEXIST;
3337 	}
3338 
3339 	if (error == 0) {
3340 		if (nvp)
3341 			vnevent_rename_dest(nvp, ndvp, nnm, ct);
3342 
3343 		if (odvp != ndvp)
3344 			vnevent_rename_dest_dir(ndvp, ct);
3345 		ASSERT(ovp != NULL);
3346 		vnevent_rename_src(ovp, odvp, onm, ct);
3347 	}
3348 
3349 	if (nvp) {
3350 		VN_RELE(nvp);
3351 	}
3352 	VN_RELE(ovp);
3353 
3354 	nfs_rw_exit(&odrp->r_rwlock);
3355 	nfs_rw_exit(&ndrp->r_rwlock);
3356 
3357 	return (error);
3358 }
3359 
3360 /* ARGSUSED */
3361 static int
3362 nfs3_mkdir(vnode_t *dvp, char *nm, struct vattr *va, vnode_t **vpp, cred_t *cr,
3363 	caller_context_t *ct, int flags, vsecattr_t *vsecp)
3364 {
3365 	int error;
3366 	MKDIR3args args;
3367 	MKDIR3res res;
3368 	int douprintf;
3369 	struct vattr vattr;
3370 	vnode_t *vp;
3371 	rnode_t *drp;
3372 	hrtime_t t;
3373 
3374 	if (nfs_zone() != VTOMI(dvp)->mi_zone)
3375 		return (EPERM);
3376 	setdiropargs3(&args.where, nm, dvp);
3377 
3378 	/*
3379 	 * Decide what the group-id and set-gid bit of the created directory
3380 	 * should be.  May have to do a setattr to get the gid right.
3381 	 */
3382 	error = setdirgid(dvp, &va->va_gid, cr);
3383 	if (error)
3384 		return (error);
3385 	error = setdirmode(dvp, &va->va_mode, cr);
3386 	if (error)
3387 		return (error);
3388 	va->va_mask |= AT_MODE|AT_GID;
3389 
3390 	error = vattr_to_sattr3(va, &args.attributes);
3391 	if (error) {
3392 		/* req time field(s) overflow - return immediately */
3393 		return (error);
3394 	}
3395 
3396 	drp = VTOR(dvp);
3397 	if (nfs_rw_enter_sig(&drp->r_rwlock, RW_WRITER, INTR(dvp)))
3398 		return (EINTR);
3399 
3400 	dnlc_remove(dvp, nm);
3401 
3402 	douprintf = 1;
3403 
3404 	t = gethrtime();
3405 
3406 	error = rfs3call(VTOMI(dvp), NFSPROC3_MKDIR,
3407 	    xdr_MKDIR3args, (caddr_t)&args,
3408 	    xdr_MKDIR3res, (caddr_t)&res, cr,
3409 	    &douprintf, &res.status, 0, NULL);
3410 
3411 	if (error) {
3412 		PURGE_ATTRCACHE(dvp);
3413 		nfs_rw_exit(&drp->r_rwlock);
3414 		return (error);
3415 	}
3416 
3417 	error = geterrno3(res.status);
3418 	if (!error) {
3419 		nfs3_cache_wcc_data(dvp, &res.resok.dir_wcc, t, cr);
3420 		if (HAVE_RDDIR_CACHE(drp))
3421 			nfs_purge_rddir_cache(dvp);
3422 
3423 		if (!res.resok.obj.handle_follows) {
3424 			error = nfs3lookup(dvp, nm, &vp, NULL, 0, NULL, cr, 0);
3425 			if (error) {
3426 				nfs_rw_exit(&drp->r_rwlock);
3427 				return (error);
3428 			}
3429 		} else {
3430 			if (res.resok.obj_attributes.attributes) {
3431 				vp = makenfs3node(&res.resok.obj.handle,
3432 				    &res.resok.obj_attributes.attr,
3433 				    dvp->v_vfsp, t, cr, NULL, NULL);
3434 			} else {
3435 				vp = makenfs3node(&res.resok.obj.handle, NULL,
3436 				    dvp->v_vfsp, t, cr, NULL, NULL);
3437 				if (vp->v_type == VNON) {
3438 					vattr.va_mask = AT_TYPE;
3439 					error = nfs3getattr(vp, &vattr, cr);
3440 					if (error) {
3441 						VN_RELE(vp);
3442 						nfs_rw_exit(&drp->r_rwlock);
3443 						return (error);
3444 					}
3445 					vp->v_type = vattr.va_type;
3446 				}
3447 			}
3448 			dnlc_update(dvp, nm, vp);
3449 		}
3450 		if (va->va_gid != VTOR(vp)->r_attr.va_gid) {
3451 			va->va_mask = AT_GID;
3452 			(void) nfs3setattr(vp, va, 0, cr);
3453 		}
3454 		*vpp = vp;
3455 	} else {
3456 		nfs3_cache_wcc_data(dvp, &res.resfail.dir_wcc, t, cr);
3457 		PURGE_STALE_FH(error, dvp, cr);
3458 	}
3459 
3460 	nfs_rw_exit(&drp->r_rwlock);
3461 
3462 	return (error);
3463 }
3464 
3465 /* ARGSUSED */
3466 static int
3467 nfs3_rmdir(vnode_t *dvp, char *nm, vnode_t *cdir, cred_t *cr,
3468 	caller_context_t *ct, int flags)
3469 {
3470 	int error;
3471 	RMDIR3args args;
3472 	RMDIR3res res;
3473 	vnode_t *vp;
3474 	int douprintf;
3475 	rnode_t *drp;
3476 	hrtime_t t;
3477 
3478 	if (nfs_zone() != VTOMI(dvp)->mi_zone)
3479 		return (EPERM);
3480 	drp = VTOR(dvp);
3481 	if (nfs_rw_enter_sig(&drp->r_rwlock, RW_WRITER, INTR(dvp)))
3482 		return (EINTR);
3483 
3484 	/*
3485 	 * Attempt to prevent a rmdir(".") from succeeding.
3486 	 */
3487 	error = nfs3lookup(dvp, nm, &vp, NULL, 0, NULL, cr, 0);
3488 	if (error) {
3489 		nfs_rw_exit(&drp->r_rwlock);
3490 		return (error);
3491 	}
3492 
3493 	if (vp == cdir) {
3494 		VN_RELE(vp);
3495 		nfs_rw_exit(&drp->r_rwlock);
3496 		return (EINVAL);
3497 	}
3498 
3499 	setdiropargs3(&args.object, nm, dvp);
3500 
3501 	/*
3502 	 * First just remove the entry from the name cache, as it
3503 	 * is most likely an entry for this vp.
3504 	 */
3505 	dnlc_remove(dvp, nm);
3506 
3507 	/*
3508 	 * If there vnode reference count is greater than one, then
3509 	 * there may be additional references in the DNLC which will
3510 	 * need to be purged.  First, trying removing the entry for
3511 	 * the parent directory and see if that removes the additional
3512 	 * reference(s).  If that doesn't do it, then use dnlc_purge_vp
3513 	 * to completely remove any references to the directory which
3514 	 * might still exist in the DNLC.
3515 	 */
3516 	if (vp->v_count > 1) {
3517 		dnlc_remove(vp, "..");
3518 		if (vp->v_count > 1)
3519 			dnlc_purge_vp(vp);
3520 	}
3521 
3522 	douprintf = 1;
3523 
3524 	t = gethrtime();
3525 
3526 	error = rfs3call(VTOMI(dvp), NFSPROC3_RMDIR,
3527 	    xdr_diropargs3, (caddr_t)&args,
3528 	    xdr_RMDIR3res, (caddr_t)&res, cr,
3529 	    &douprintf, &res.status, 0, NULL);
3530 
3531 	PURGE_ATTRCACHE(vp);
3532 
3533 	if (error) {
3534 		PURGE_ATTRCACHE(dvp);
3535 		VN_RELE(vp);
3536 		nfs_rw_exit(&drp->r_rwlock);
3537 		return (error);
3538 	}
3539 
3540 	error = geterrno3(res.status);
3541 	if (!error) {
3542 		nfs3_cache_wcc_data(dvp, &res.resok.dir_wcc, t, cr);
3543 		if (HAVE_RDDIR_CACHE(drp))
3544 			nfs_purge_rddir_cache(dvp);
3545 		if (HAVE_RDDIR_CACHE(VTOR(vp)))
3546 			nfs_purge_rddir_cache(vp);
3547 	} else {
3548 		nfs3_cache_wcc_data(dvp, &res.resfail.dir_wcc, t, cr);
3549 		PURGE_STALE_FH(error, dvp, cr);
3550 		/*
3551 		 * System V defines rmdir to return EEXIST, not
3552 		 * ENOTEMPTY if the directory is not empty.  Over
3553 		 * the wire, the error is NFSERR_ENOTEMPTY which
3554 		 * geterrno maps to ENOTEMPTY.
3555 		 */
3556 		if (error == ENOTEMPTY)
3557 			error = EEXIST;
3558 	}
3559 
3560 	if (error == 0) {
3561 		vnevent_rmdir(vp, dvp, nm, ct);
3562 	}
3563 	VN_RELE(vp);
3564 
3565 	nfs_rw_exit(&drp->r_rwlock);
3566 
3567 	return (error);
3568 }
3569 
3570 /* ARGSUSED */
3571 static int
3572 nfs3_symlink(vnode_t *dvp, char *lnm, struct vattr *tva, char *tnm, cred_t *cr,
3573 	caller_context_t *ct, int flags)
3574 {
3575 	int error;
3576 	SYMLINK3args args;
3577 	SYMLINK3res res;
3578 	int douprintf;
3579 	mntinfo_t *mi;
3580 	vnode_t *vp;
3581 	rnode_t *rp;
3582 	char *contents;
3583 	rnode_t *drp;
3584 	hrtime_t t;
3585 
3586 	mi = VTOMI(dvp);
3587 
3588 	if (nfs_zone() != mi->mi_zone)
3589 		return (EPERM);
3590 	if (!(mi->mi_flags & MI_SYMLINK))
3591 		return (EOPNOTSUPP);
3592 
3593 	setdiropargs3(&args.where, lnm, dvp);
3594 	error = vattr_to_sattr3(tva, &args.symlink.symlink_attributes);
3595 	if (error) {
3596 		/* req time field(s) overflow - return immediately */
3597 		return (error);
3598 	}
3599 	args.symlink.symlink_data = tnm;
3600 
3601 	drp = VTOR(dvp);
3602 	if (nfs_rw_enter_sig(&drp->r_rwlock, RW_WRITER, INTR(dvp)))
3603 		return (EINTR);
3604 
3605 	dnlc_remove(dvp, lnm);
3606 
3607 	douprintf = 1;
3608 
3609 	t = gethrtime();
3610 
3611 	error = rfs3call(mi, NFSPROC3_SYMLINK,
3612 	    xdr_SYMLINK3args, (caddr_t)&args,
3613 	    xdr_SYMLINK3res, (caddr_t)&res, cr,
3614 	    &douprintf, &res.status, 0, NULL);
3615 
3616 	if (error) {
3617 		PURGE_ATTRCACHE(dvp);
3618 		nfs_rw_exit(&drp->r_rwlock);
3619 		return (error);
3620 	}
3621 
3622 	error = geterrno3(res.status);
3623 	if (!error) {
3624 		nfs3_cache_wcc_data(dvp, &res.resok.dir_wcc, t, cr);
3625 		if (HAVE_RDDIR_CACHE(drp))
3626 			nfs_purge_rddir_cache(dvp);
3627 
3628 		if (res.resok.obj.handle_follows) {
3629 			if (res.resok.obj_attributes.attributes) {
3630 				vp = makenfs3node(&res.resok.obj.handle,
3631 				    &res.resok.obj_attributes.attr,
3632 				    dvp->v_vfsp, t, cr, NULL, NULL);
3633 			} else {
3634 				vp = makenfs3node(&res.resok.obj.handle, NULL,
3635 				    dvp->v_vfsp, t, cr, NULL, NULL);
3636 				vp->v_type = VLNK;
3637 				vp->v_rdev = 0;
3638 			}
3639 			dnlc_update(dvp, lnm, vp);
3640 			rp = VTOR(vp);
3641 			if (nfs3_do_symlink_cache &&
3642 			    rp->r_symlink.contents == NULL) {
3643 
3644 				contents = kmem_alloc(MAXPATHLEN,
3645 				    KM_NOSLEEP);
3646 
3647 				if (contents != NULL) {
3648 					mutex_enter(&rp->r_statelock);
3649 					if (rp->r_symlink.contents == NULL) {
3650 						rp->r_symlink.len = strlen(tnm);
3651 						bcopy(tnm, contents,
3652 						    rp->r_symlink.len);
3653 						rp->r_symlink.contents =
3654 						    contents;
3655 						rp->r_symlink.size = MAXPATHLEN;
3656 						mutex_exit(&rp->r_statelock);
3657 					} else {
3658 						mutex_exit(&rp->r_statelock);
3659 						kmem_free((void *)contents,
3660 						    MAXPATHLEN);
3661 					}
3662 				}
3663 			}
3664 			VN_RELE(vp);
3665 		}
3666 	} else {
3667 		nfs3_cache_wcc_data(dvp, &res.resfail.dir_wcc, t, cr);
3668 		PURGE_STALE_FH(error, dvp, cr);
3669 		if (error == EOPNOTSUPP) {
3670 			mutex_enter(&mi->mi_lock);
3671 			mi->mi_flags &= ~MI_SYMLINK;
3672 			mutex_exit(&mi->mi_lock);
3673 		}
3674 	}
3675 
3676 	nfs_rw_exit(&drp->r_rwlock);
3677 
3678 	return (error);
3679 }
3680 
3681 #ifdef DEBUG
3682 static int nfs3_readdir_cache_hits = 0;
3683 static int nfs3_readdir_cache_shorts = 0;
3684 static int nfs3_readdir_cache_waits = 0;
3685 static int nfs3_readdir_cache_misses = 0;
3686 static int nfs3_readdir_readahead = 0;
3687 #endif
3688 
3689 static int nfs3_shrinkreaddir = 0;
3690 
3691 /*
3692  * Read directory entries.
3693  * There are some weird things to look out for here.  The uio_loffset
3694  * field is either 0 or it is the offset returned from a previous
3695  * readdir.  It is an opaque value used by the server to find the
3696  * correct directory block to read. The count field is the number
3697  * of blocks to read on the server.  This is advisory only, the server
3698  * may return only one block's worth of entries.  Entries may be compressed
3699  * on the server.
3700  */
3701 /* ARGSUSED */
3702 static int
3703 nfs3_readdir(vnode_t *vp, struct uio *uiop, cred_t *cr, int *eofp,
3704 	caller_context_t *ct, int flags)
3705 {
3706 	int error;
3707 	size_t count;
3708 	rnode_t *rp;
3709 	rddir_cache *rdc;
3710 	rddir_cache *nrdc;
3711 	rddir_cache *rrdc;
3712 #ifdef DEBUG
3713 	int missed;
3714 #endif
3715 	int doreadahead;
3716 	rddir_cache srdc;
3717 	avl_index_t where;
3718 
3719 	if (nfs_zone() != VTOMI(vp)->mi_zone)
3720 		return (EIO);
3721 	rp = VTOR(vp);
3722 
3723 	ASSERT(nfs_rw_lock_held(&rp->r_rwlock, RW_READER));
3724 
3725 	/*
3726 	 * Make sure that the directory cache is valid.
3727 	 */
3728 	if (HAVE_RDDIR_CACHE(rp)) {
3729 		if (nfs_disable_rddir_cache) {
3730 			/*
3731 			 * Setting nfs_disable_rddir_cache in /etc/system
3732 			 * allows interoperability with servers that do not
3733 			 * properly update the attributes of directories.
3734 			 * Any cached information gets purged before an
3735 			 * access is made to it.
3736 			 */
3737 			nfs_purge_rddir_cache(vp);
3738 		} else {
3739 			error = nfs3_validate_caches(vp, cr);
3740 			if (error)
3741 				return (error);
3742 		}
3743 	}
3744 
3745 	/*
3746 	 * It is possible that some servers may not be able to correctly
3747 	 * handle a large READDIR or READDIRPLUS request due to bugs in
3748 	 * their implementation.  In order to continue to interoperate
3749 	 * with them, this workaround is provided to limit the maximum
3750 	 * size of a READDIRPLUS request to 1024.  In any case, the request
3751 	 * size is limited to MAXBSIZE.
3752 	 */
3753 	count = MIN(uiop->uio_iov->iov_len,
3754 	    nfs3_shrinkreaddir ? 1024 : MAXBSIZE);
3755 
3756 	nrdc = NULL;
3757 #ifdef DEBUG
3758 	missed = 0;
3759 #endif
3760 top:
3761 	/*
3762 	 * Short circuit last readdir which always returns 0 bytes.
3763 	 * This can be done after the directory has been read through
3764 	 * completely at least once.  This will set r_direof which
3765 	 * can be used to find the value of the last cookie.
3766 	 */
3767 	mutex_enter(&rp->r_statelock);
3768 	if (rp->r_direof != NULL &&
3769 	    uiop->uio_loffset == rp->r_direof->nfs3_ncookie) {
3770 		mutex_exit(&rp->r_statelock);
3771 #ifdef DEBUG
3772 		nfs3_readdir_cache_shorts++;
3773 #endif
3774 		if (eofp)
3775 			*eofp = 1;
3776 		if (nrdc != NULL)
3777 			rddir_cache_rele(nrdc);
3778 		return (0);
3779 	}
3780 	/*
3781 	 * Look for a cache entry.  Cache entries are identified
3782 	 * by the NFS cookie value and the byte count requested.
3783 	 */
3784 	srdc.nfs3_cookie = uiop->uio_loffset;
3785 	srdc.buflen = count;
3786 	rdc = avl_find(&rp->r_dir, &srdc, &where);
3787 	if (rdc != NULL) {
3788 		rddir_cache_hold(rdc);
3789 		/*
3790 		 * If the cache entry is in the process of being
3791 		 * filled in, wait until this completes.  The
3792 		 * RDDIRWAIT bit is set to indicate that someone
3793 		 * is waiting and then the thread currently
3794 		 * filling the entry is done, it should do a
3795 		 * cv_broadcast to wakeup all of the threads
3796 		 * waiting for it to finish.
3797 		 */
3798 		if (rdc->flags & RDDIR) {
3799 			nfs_rw_exit(&rp->r_rwlock);
3800 			rdc->flags |= RDDIRWAIT;
3801 #ifdef DEBUG
3802 			nfs3_readdir_cache_waits++;
3803 #endif
3804 			if (!cv_wait_sig(&rdc->cv, &rp->r_statelock)) {
3805 				/*
3806 				 * We got interrupted, probably
3807 				 * the user typed ^C or an alarm
3808 				 * fired.  We free the new entry
3809 				 * if we allocated one.
3810 				 */
3811 				mutex_exit(&rp->r_statelock);
3812 				(void) nfs_rw_enter_sig(&rp->r_rwlock,
3813 				    RW_READER, FALSE);
3814 				rddir_cache_rele(rdc);
3815 				if (nrdc != NULL)
3816 					rddir_cache_rele(nrdc);
3817 				return (EINTR);
3818 			}
3819 			mutex_exit(&rp->r_statelock);
3820 			(void) nfs_rw_enter_sig(&rp->r_rwlock,
3821 			    RW_READER, FALSE);
3822 			rddir_cache_rele(rdc);
3823 			goto top;
3824 		}
3825 		/*
3826 		 * Check to see if a readdir is required to
3827 		 * fill the entry.  If so, mark this entry
3828 		 * as being filled, remove our reference,
3829 		 * and branch to the code to fill the entry.
3830 		 */
3831 		if (rdc->flags & RDDIRREQ) {
3832 			rdc->flags &= ~RDDIRREQ;
3833 			rdc->flags |= RDDIR;
3834 			if (nrdc != NULL)
3835 				rddir_cache_rele(nrdc);
3836 			nrdc = rdc;
3837 			mutex_exit(&rp->r_statelock);
3838 			goto bottom;
3839 		}
3840 #ifdef DEBUG
3841 		if (!missed)
3842 			nfs3_readdir_cache_hits++;
3843 #endif
3844 		/*
3845 		 * If an error occurred while attempting
3846 		 * to fill the cache entry, just return it.
3847 		 */
3848 		if (rdc->error) {
3849 			error = rdc->error;
3850 			mutex_exit(&rp->r_statelock);
3851 			rddir_cache_rele(rdc);
3852 			if (nrdc != NULL)
3853 				rddir_cache_rele(nrdc);
3854 			return (error);
3855 		}
3856 
3857 		/*
3858 		 * The cache entry is complete and good,
3859 		 * copyout the dirent structs to the calling
3860 		 * thread.
3861 		 */
3862 		error = uiomove(rdc->entries, rdc->entlen, UIO_READ, uiop);
3863 
3864 		/*
3865 		 * If no error occurred during the copyout,
3866 		 * update the offset in the uio struct to
3867 		 * contain the value of the next cookie
3868 		 * and set the eof value appropriately.
3869 		 */
3870 		if (!error) {
3871 			uiop->uio_loffset = rdc->nfs3_ncookie;
3872 			if (eofp)
3873 				*eofp = rdc->eof;
3874 		}
3875 
3876 		/*
3877 		 * Decide whether to do readahead.
3878 		 *
3879 		 * Don't if have already read to the end of
3880 		 * directory.  There is nothing more to read.
3881 		 *
3882 		 * Don't if the application is not doing
3883 		 * lookups in the directory.  The readahead
3884 		 * is only effective if the application can
3885 		 * be doing work while an async thread is
3886 		 * handling the over the wire request.
3887 		 */
3888 		if (rdc->eof) {
3889 			rp->r_direof = rdc;
3890 			doreadahead = FALSE;
3891 		} else if (!(rp->r_flags & RLOOKUP))
3892 			doreadahead = FALSE;
3893 		else
3894 			doreadahead = TRUE;
3895 
3896 		if (!doreadahead) {
3897 			mutex_exit(&rp->r_statelock);
3898 			rddir_cache_rele(rdc);
3899 			if (nrdc != NULL)
3900 				rddir_cache_rele(nrdc);
3901 			return (error);
3902 		}
3903 
3904 		/*
3905 		 * Check to see whether we found an entry
3906 		 * for the readahead.  If so, we don't need
3907 		 * to do anything further, so free the new
3908 		 * entry if one was allocated.  Otherwise,
3909 		 * allocate a new entry, add it to the cache,
3910 		 * and then initiate an asynchronous readdir
3911 		 * operation to fill it.
3912 		 */
3913 		srdc.nfs3_cookie = rdc->nfs3_ncookie;
3914 		srdc.buflen = count;
3915 		rrdc = avl_find(&rp->r_dir, &srdc, &where);
3916 		if (rrdc != NULL) {
3917 			if (nrdc != NULL)
3918 				rddir_cache_rele(nrdc);
3919 		} else {
3920 			if (nrdc != NULL)
3921 				rrdc = nrdc;
3922 			else {
3923 				rrdc = rddir_cache_alloc(KM_NOSLEEP);
3924 			}
3925 			if (rrdc != NULL) {
3926 				rrdc->nfs3_cookie = rdc->nfs3_ncookie;
3927 				rrdc->buflen = count;
3928 				avl_insert(&rp->r_dir, rrdc, where);
3929 				rddir_cache_hold(rrdc);
3930 				mutex_exit(&rp->r_statelock);
3931 				rddir_cache_rele(rdc);
3932 #ifdef DEBUG
3933 				nfs3_readdir_readahead++;
3934 #endif
3935 				nfs_async_readdir(vp, rrdc, cr, do_nfs3readdir);
3936 				return (error);
3937 			}
3938 		}
3939 
3940 		mutex_exit(&rp->r_statelock);
3941 		rddir_cache_rele(rdc);
3942 		return (error);
3943 	}
3944 
3945 	/*
3946 	 * Didn't find an entry in the cache.  Construct a new empty
3947 	 * entry and link it into the cache.  Other processes attempting
3948 	 * to access this entry will need to wait until it is filled in.
3949 	 *
3950 	 * Since kmem_alloc may block, another pass through the cache
3951 	 * will need to be taken to make sure that another process
3952 	 * hasn't already added an entry to the cache for this request.
3953 	 */
3954 	if (nrdc == NULL) {
3955 		mutex_exit(&rp->r_statelock);
3956 		nrdc = rddir_cache_alloc(KM_SLEEP);
3957 		nrdc->nfs3_cookie = uiop->uio_loffset;
3958 		nrdc->buflen = count;
3959 		goto top;
3960 	}
3961 
3962 	/*
3963 	 * Add this entry to the cache.
3964 	 */
3965 	avl_insert(&rp->r_dir, nrdc, where);
3966 	rddir_cache_hold(nrdc);
3967 	mutex_exit(&rp->r_statelock);
3968 
3969 bottom:
3970 #ifdef DEBUG
3971 	missed = 1;
3972 	nfs3_readdir_cache_misses++;
3973 #endif
3974 	/*
3975 	 * Do the readdir.  This routine decides whether to use
3976 	 * READDIR or READDIRPLUS.
3977 	 */
3978 	error = do_nfs3readdir(vp, nrdc, cr);
3979 
3980 	/*
3981 	 * If this operation failed, just return the error which occurred.
3982 	 */
3983 	if (error != 0)
3984 		return (error);
3985 
3986 	/*
3987 	 * Since the RPC operation will have taken sometime and blocked
3988 	 * this process, another pass through the cache will need to be
3989 	 * taken to find the correct cache entry.  It is possible that
3990 	 * the correct cache entry will not be there (although one was
3991 	 * added) because the directory changed during the RPC operation
3992 	 * and the readdir cache was flushed.  In this case, just start
3993 	 * over.  It is hoped that this will not happen too often... :-)
3994 	 */
3995 	nrdc = NULL;
3996 	goto top;
3997 	/* NOTREACHED */
3998 }
3999 
4000 static int
4001 do_nfs3readdir(vnode_t *vp, rddir_cache *rdc, cred_t *cr)
4002 {
4003 	int error;
4004 	rnode_t *rp;
4005 	mntinfo_t *mi;
4006 
4007 	rp = VTOR(vp);
4008 	mi = VTOMI(vp);
4009 	ASSERT(nfs_zone() == mi->mi_zone);
4010 	/*
4011 	 * Issue the proper request.
4012 	 *
4013 	 * If the server does not support READDIRPLUS, then use READDIR.
4014 	 *
4015 	 * Otherwise --
4016 	 * Issue a READDIRPLUS if reading to fill an empty cache or if
4017 	 * an application has performed a lookup in the directory which
4018 	 * required an over the wire lookup.  The use of READDIRPLUS
4019 	 * will help to (re)populate the DNLC.
4020 	 */
4021 	if (!(mi->mi_flags & MI_READDIRONLY) &&
4022 	    (rp->r_flags & (RLOOKUP | RREADDIRPLUS))) {
4023 		if (rp->r_flags & RREADDIRPLUS) {
4024 			mutex_enter(&rp->r_statelock);
4025 			rp->r_flags &= ~RREADDIRPLUS;
4026 			mutex_exit(&rp->r_statelock);
4027 		}
4028 		nfs3readdirplus(vp, rdc, cr);
4029 		if (rdc->error == EOPNOTSUPP)
4030 			nfs3readdir(vp, rdc, cr);
4031 	} else
4032 		nfs3readdir(vp, rdc, cr);
4033 
4034 	mutex_enter(&rp->r_statelock);
4035 	rdc->flags &= ~RDDIR;
4036 	if (rdc->flags & RDDIRWAIT) {
4037 		rdc->flags &= ~RDDIRWAIT;
4038 		cv_broadcast(&rdc->cv);
4039 	}
4040 	error = rdc->error;
4041 	if (error)
4042 		rdc->flags |= RDDIRREQ;
4043 	mutex_exit(&rp->r_statelock);
4044 
4045 	rddir_cache_rele(rdc);
4046 
4047 	return (error);
4048 }
4049 
4050 static void
4051 nfs3readdir(vnode_t *vp, rddir_cache *rdc, cred_t *cr)
4052 {
4053 	int error;
4054 	READDIR3args args;
4055 	READDIR3vres res;
4056 	vattr_t dva;
4057 	rnode_t *rp;
4058 	int douprintf;
4059 	failinfo_t fi, *fip = NULL;
4060 	mntinfo_t *mi;
4061 	hrtime_t t;
4062 
4063 	rp = VTOR(vp);
4064 	mi = VTOMI(vp);
4065 	ASSERT(nfs_zone() == mi->mi_zone);
4066 
4067 	args.dir = *RTOFH3(rp);
4068 	args.cookie = (cookie3)rdc->nfs3_cookie;
4069 	args.cookieverf = rp->r_cookieverf;
4070 	args.count = rdc->buflen;
4071 
4072 	/*
4073 	 * NFS client failover support
4074 	 * suppress failover unless we have a zero cookie
4075 	 */
4076 	if (args.cookie == (cookie3) 0) {
4077 		fi.vp = vp;
4078 		fi.fhp = (caddr_t)&args.dir;
4079 		fi.copyproc = nfs3copyfh;
4080 		fi.lookupproc = nfs3lookup;
4081 		fi.xattrdirproc = acl_getxattrdir3;
4082 		fip = &fi;
4083 	}
4084 
4085 #ifdef DEBUG
4086 	rdc->entries = rddir_cache_buf_alloc(rdc->buflen, KM_SLEEP);
4087 #else
4088 	rdc->entries = kmem_alloc(rdc->buflen, KM_SLEEP);
4089 #endif
4090 
4091 	res.entries = (dirent64_t *)rdc->entries;
4092 	res.entries_size = rdc->buflen;
4093 	res.dir_attributes.fres.vap = &dva;
4094 	res.dir_attributes.fres.vp = vp;
4095 	res.loff = rdc->nfs3_cookie;
4096 
4097 	douprintf = 1;
4098 
4099 	if (mi->mi_io_kstats) {
4100 		mutex_enter(&mi->mi_lock);
4101 		kstat_runq_enter(KSTAT_IO_PTR(mi->mi_io_kstats));
4102 		mutex_exit(&mi->mi_lock);
4103 	}
4104 
4105 	t = gethrtime();
4106 
4107 	error = rfs3call(VTOMI(vp), NFSPROC3_READDIR,
4108 	    xdr_READDIR3args, (caddr_t)&args,
4109 	    xdr_READDIR3vres, (caddr_t)&res, cr,
4110 	    &douprintf, &res.status, 0, fip);
4111 
4112 	if (mi->mi_io_kstats) {
4113 		mutex_enter(&mi->mi_lock);
4114 		kstat_runq_exit(KSTAT_IO_PTR(mi->mi_io_kstats));
4115 		mutex_exit(&mi->mi_lock);
4116 	}
4117 
4118 	if (error)
4119 		goto err;
4120 
4121 	nfs3_cache_post_op_vattr(vp, &res.dir_attributes, t, cr);
4122 
4123 	error = geterrno3(res.status);
4124 	if (error) {
4125 		PURGE_STALE_FH(error, vp, cr);
4126 		goto err;
4127 	}
4128 
4129 	if (mi->mi_io_kstats) {
4130 		mutex_enter(&mi->mi_lock);
4131 		KSTAT_IO_PTR(mi->mi_io_kstats)->reads++;
4132 		KSTAT_IO_PTR(mi->mi_io_kstats)->nread += res.size;
4133 		mutex_exit(&mi->mi_lock);
4134 	}
4135 
4136 	rdc->nfs3_ncookie = res.loff;
4137 	rp->r_cookieverf = res.cookieverf;
4138 	rdc->eof = res.eof ? 1 : 0;
4139 	rdc->entlen = res.size;
4140 	ASSERT(rdc->entlen <= rdc->buflen);
4141 	rdc->error = 0;
4142 	return;
4143 
4144 err:
4145 	kmem_free(rdc->entries, rdc->buflen);
4146 	rdc->entries = NULL;
4147 	rdc->error = error;
4148 }
4149 
4150 /*
4151  * Read directory entries.
4152  * There are some weird things to look out for here.  The uio_loffset
4153  * field is either 0 or it is the offset returned from a previous
4154  * readdir.  It is an opaque value used by the server to find the
4155  * correct directory block to read. The count field is the number
4156  * of blocks to read on the server.  This is advisory only, the server
4157  * may return only one block's worth of entries.  Entries may be compressed
4158  * on the server.
4159  */
4160 static void
4161 nfs3readdirplus(vnode_t *vp, rddir_cache *rdc, cred_t *cr)
4162 {
4163 	int error;
4164 	READDIRPLUS3args args;
4165 	READDIRPLUS3vres res;
4166 	vattr_t dva;
4167 	rnode_t *rp;
4168 	mntinfo_t *mi;
4169 	int douprintf;
4170 	failinfo_t fi, *fip = NULL;
4171 
4172 	rp = VTOR(vp);
4173 	mi = VTOMI(vp);
4174 	ASSERT(nfs_zone() == mi->mi_zone);
4175 
4176 	args.dir = *RTOFH3(rp);
4177 	args.cookie = (cookie3)rdc->nfs3_cookie;
4178 	args.cookieverf = rp->r_cookieverf;
4179 	args.dircount = rdc->buflen;
4180 	args.maxcount = mi->mi_tsize;
4181 
4182 	/*
4183 	 * NFS client failover support
4184 	 * suppress failover unless we have a zero cookie
4185 	 */
4186 	if (args.cookie == (cookie3)0) {
4187 		fi.vp = vp;
4188 		fi.fhp = (caddr_t)&args.dir;
4189 		fi.copyproc = nfs3copyfh;
4190 		fi.lookupproc = nfs3lookup;
4191 		fi.xattrdirproc = acl_getxattrdir3;
4192 		fip = &fi;
4193 	}
4194 
4195 #ifdef DEBUG
4196 	rdc->entries = rddir_cache_buf_alloc(rdc->buflen, KM_SLEEP);
4197 #else
4198 	rdc->entries = kmem_alloc(rdc->buflen, KM_SLEEP);
4199 #endif
4200 
4201 	res.entries = (dirent64_t *)rdc->entries;
4202 	res.entries_size = rdc->buflen;
4203 	res.dir_attributes.fres.vap = &dva;
4204 	res.dir_attributes.fres.vp = vp;
4205 	res.loff = rdc->nfs3_cookie;
4206 	res.credentials = cr;
4207 
4208 	douprintf = 1;
4209 
4210 	if (mi->mi_io_kstats) {
4211 		mutex_enter(&mi->mi_lock);
4212 		kstat_runq_enter(KSTAT_IO_PTR(mi->mi_io_kstats));
4213 		mutex_exit(&mi->mi_lock);
4214 	}
4215 
4216 	res.time = gethrtime();
4217 
4218 	error = rfs3call(mi, NFSPROC3_READDIRPLUS,
4219 	    xdr_READDIRPLUS3args, (caddr_t)&args,
4220 	    xdr_READDIRPLUS3vres, (caddr_t)&res, cr,
4221 	    &douprintf, &res.status, 0, fip);
4222 
4223 	if (mi->mi_io_kstats) {
4224 		mutex_enter(&mi->mi_lock);
4225 		kstat_runq_exit(KSTAT_IO_PTR(mi->mi_io_kstats));
4226 		mutex_exit(&mi->mi_lock);
4227 	}
4228 
4229 	if (error) {
4230 		goto err;
4231 	}
4232 
4233 	nfs3_cache_post_op_vattr(vp, &res.dir_attributes, res.time, cr);
4234 
4235 	error = geterrno3(res.status);
4236 	if (error) {
4237 		PURGE_STALE_FH(error, vp, cr);
4238 		if (error == EOPNOTSUPP) {
4239 			mutex_enter(&mi->mi_lock);
4240 			mi->mi_flags |= MI_READDIRONLY;
4241 			mutex_exit(&mi->mi_lock);
4242 		}
4243 		goto err;
4244 	}
4245 
4246 	if (mi->mi_io_kstats) {
4247 		mutex_enter(&mi->mi_lock);
4248 		KSTAT_IO_PTR(mi->mi_io_kstats)->reads++;
4249 		KSTAT_IO_PTR(mi->mi_io_kstats)->nread += res.size;
4250 		mutex_exit(&mi->mi_lock);
4251 	}
4252 
4253 	rdc->nfs3_ncookie = res.loff;
4254 	rp->r_cookieverf = res.cookieverf;
4255 	rdc->eof = res.eof ? 1 : 0;
4256 	rdc->entlen = res.size;
4257 	ASSERT(rdc->entlen <= rdc->buflen);
4258 	rdc->error = 0;
4259 
4260 	return;
4261 
4262 err:
4263 	kmem_free(rdc->entries, rdc->buflen);
4264 	rdc->entries = NULL;
4265 	rdc->error = error;
4266 }
4267 
4268 #ifdef DEBUG
4269 static int nfs3_bio_do_stop = 0;
4270 #endif
4271 
4272 static int
4273 nfs3_bio(struct buf *bp, stable_how *stab_comm, cred_t *cr)
4274 {
4275 	rnode_t *rp = VTOR(bp->b_vp);
4276 	int count;
4277 	int error;
4278 	cred_t *cred;
4279 	offset_t offset;
4280 
4281 	ASSERT(nfs_zone() == VTOMI(bp->b_vp)->mi_zone);
4282 	offset = ldbtob(bp->b_lblkno);
4283 
4284 	DTRACE_IO1(start, struct buf *, bp);
4285 
4286 	if (bp->b_flags & B_READ) {
4287 		mutex_enter(&rp->r_statelock);
4288 		if (rp->r_cred != NULL) {
4289 			cred = rp->r_cred;
4290 			crhold(cred);
4291 		} else {
4292 			rp->r_cred = cr;
4293 			crhold(cr);
4294 			cred = cr;
4295 			crhold(cred);
4296 		}
4297 		mutex_exit(&rp->r_statelock);
4298 	read_again:
4299 		error = bp->b_error = nfs3read(bp->b_vp, bp->b_un.b_addr,
4300 		    offset, bp->b_bcount, &bp->b_resid, cred);
4301 		crfree(cred);
4302 		if (!error) {
4303 			if (bp->b_resid) {
4304 				/*
4305 				 * Didn't get it all because we hit EOF,
4306 				 * zero all the memory beyond the EOF.
4307 				 */
4308 				/* bzero(rdaddr + */
4309 				bzero(bp->b_un.b_addr +
4310 				    bp->b_bcount - bp->b_resid, bp->b_resid);
4311 			}
4312 			mutex_enter(&rp->r_statelock);
4313 			if (bp->b_resid == bp->b_bcount &&
4314 			    offset >= rp->r_size) {
4315 				/*
4316 				 * We didn't read anything at all as we are
4317 				 * past EOF.  Return an error indicator back
4318 				 * but don't destroy the pages (yet).
4319 				 */
4320 				error = NFS_EOF;
4321 			}
4322 			mutex_exit(&rp->r_statelock);
4323 		} else if (error == EACCES) {
4324 			mutex_enter(&rp->r_statelock);
4325 			if (cred != cr) {
4326 				if (rp->r_cred != NULL)
4327 					crfree(rp->r_cred);
4328 				rp->r_cred = cr;
4329 				crhold(cr);
4330 				cred = cr;
4331 				crhold(cred);
4332 				mutex_exit(&rp->r_statelock);
4333 				goto read_again;
4334 			}
4335 			mutex_exit(&rp->r_statelock);
4336 		}
4337 	} else {
4338 		if (!(rp->r_flags & RSTALE)) {
4339 			mutex_enter(&rp->r_statelock);
4340 			if (rp->r_cred != NULL) {
4341 				cred = rp->r_cred;
4342 				crhold(cred);
4343 			} else {
4344 				rp->r_cred = cr;
4345 				crhold(cr);
4346 				cred = cr;
4347 				crhold(cred);
4348 			}
4349 			mutex_exit(&rp->r_statelock);
4350 		write_again:
4351 			mutex_enter(&rp->r_statelock);
4352 			count = MIN(bp->b_bcount, rp->r_size - offset);
4353 			mutex_exit(&rp->r_statelock);
4354 			if (count < 0)
4355 				cmn_err(CE_PANIC, "nfs3_bio: write count < 0");
4356 #ifdef DEBUG
4357 			if (count == 0) {
4358 				zcmn_err(getzoneid(), CE_WARN,
4359 				    "nfs3_bio: zero length write at %lld",
4360 				    offset);
4361 				nfs_printfhandle(&rp->r_fh);
4362 				if (nfs3_bio_do_stop)
4363 					debug_enter("nfs3_bio");
4364 			}
4365 #endif
4366 			error = nfs3write(bp->b_vp, bp->b_un.b_addr, offset,
4367 			    count, cred, stab_comm);
4368 			if (error == EACCES) {
4369 				mutex_enter(&rp->r_statelock);
4370 				if (cred != cr) {
4371 					if (rp->r_cred != NULL)
4372 						crfree(rp->r_cred);
4373 					rp->r_cred = cr;
4374 					crhold(cr);
4375 					crfree(cred);
4376 					cred = cr;
4377 					crhold(cred);
4378 					mutex_exit(&rp->r_statelock);
4379 					goto write_again;
4380 				}
4381 				mutex_exit(&rp->r_statelock);
4382 			}
4383 			bp->b_error = error;
4384 			if (error && error != EINTR) {
4385 				/*
4386 				 * Don't print EDQUOT errors on the console.
4387 				 * Don't print asynchronous EACCES errors.
4388 				 * Don't print EFBIG errors.
4389 				 * Print all other write errors.
4390 				 */
4391 				if (error != EDQUOT && error != EFBIG &&
4392 				    (error != EACCES ||
4393 				    !(bp->b_flags & B_ASYNC)))
4394 					nfs_write_error(bp->b_vp, error, cred);
4395 				/*
4396 				 * Update r_error and r_flags as appropriate.
4397 				 * If the error was ESTALE, then mark the
4398 				 * rnode as not being writeable and save
4399 				 * the error status.  Otherwise, save any
4400 				 * errors which occur from asynchronous
4401 				 * page invalidations.  Any errors occurring
4402 				 * from other operations should be saved
4403 				 * by the caller.
4404 				 */
4405 				mutex_enter(&rp->r_statelock);
4406 				if (error == ESTALE) {
4407 					rp->r_flags |= RSTALE;
4408 					if (!rp->r_error)
4409 						rp->r_error = error;
4410 				} else if (!rp->r_error &&
4411 				    (bp->b_flags &
4412 				    (B_INVAL|B_FORCE|B_ASYNC)) ==
4413 				    (B_INVAL|B_FORCE|B_ASYNC)) {
4414 					rp->r_error = error;
4415 				}
4416 				mutex_exit(&rp->r_statelock);
4417 			}
4418 			crfree(cred);
4419 		} else {
4420 			error = rp->r_error;
4421 			/*
4422 			 * A close may have cleared r_error, if so,
4423 			 * propagate ESTALE error return properly
4424 			 */
4425 			if (error == 0)
4426 				error = ESTALE;
4427 		}
4428 	}
4429 
4430 	if (error != 0 && error != NFS_EOF)
4431 		bp->b_flags |= B_ERROR;
4432 
4433 	DTRACE_IO1(done, struct buf *, bp);
4434 
4435 	return (error);
4436 }
4437 
4438 /* ARGSUSED */
4439 static int
4440 nfs3_fid(vnode_t *vp, fid_t *fidp, caller_context_t *ct)
4441 {
4442 	rnode_t *rp;
4443 
4444 	if (nfs_zone() != VTOMI(vp)->mi_zone)
4445 		return (EIO);
4446 	rp = VTOR(vp);
4447 
4448 	if (fidp->fid_len < (ushort_t)rp->r_fh.fh_len) {
4449 		fidp->fid_len = rp->r_fh.fh_len;
4450 		return (ENOSPC);
4451 	}
4452 	fidp->fid_len = rp->r_fh.fh_len;
4453 	bcopy(rp->r_fh.fh_buf, fidp->fid_data, fidp->fid_len);
4454 	return (0);
4455 }
4456 
4457 /* ARGSUSED2 */
4458 static int
4459 nfs3_rwlock(vnode_t *vp, int write_lock, caller_context_t *ctp)
4460 {
4461 	rnode_t *rp = VTOR(vp);
4462 
4463 	if (!write_lock) {
4464 		(void) nfs_rw_enter_sig(&rp->r_rwlock, RW_READER, FALSE);
4465 		return (V_WRITELOCK_FALSE);
4466 	}
4467 
4468 	if ((rp->r_flags & RDIRECTIO) || (VTOMI(vp)->mi_flags & MI_DIRECTIO)) {
4469 		(void) nfs_rw_enter_sig(&rp->r_rwlock, RW_READER, FALSE);
4470 		if (rp->r_mapcnt == 0 && !vn_has_cached_data(vp))
4471 			return (V_WRITELOCK_FALSE);
4472 		nfs_rw_exit(&rp->r_rwlock);
4473 	}
4474 
4475 	(void) nfs_rw_enter_sig(&rp->r_rwlock, RW_WRITER, FALSE);
4476 	return (V_WRITELOCK_TRUE);
4477 }
4478 
4479 /* ARGSUSED */
4480 static void
4481 nfs3_rwunlock(vnode_t *vp, int write_lock, caller_context_t *ctp)
4482 {
4483 	rnode_t *rp = VTOR(vp);
4484 
4485 	nfs_rw_exit(&rp->r_rwlock);
4486 }
4487 
4488 /* ARGSUSED */
4489 static int
4490 nfs3_seek(vnode_t *vp, offset_t ooff, offset_t *noffp, caller_context_t *ct)
4491 {
4492 
4493 	/*
4494 	 * Because we stuff the readdir cookie into the offset field
4495 	 * someone may attempt to do an lseek with the cookie which
4496 	 * we want to succeed.
4497 	 */
4498 	if (vp->v_type == VDIR)
4499 		return (0);
4500 	if (*noffp < 0)
4501 		return (EINVAL);
4502 	return (0);
4503 }
4504 
4505 /*
4506  * number of nfs3_bsize blocks to read ahead.
4507  */
4508 static int nfs3_nra = 4;
4509 
4510 #ifdef DEBUG
4511 static int nfs3_lostpage = 0;	/* number of times we lost original page */
4512 #endif
4513 
4514 /*
4515  * Return all the pages from [off..off+len) in file
4516  */
4517 /* ARGSUSED */
4518 static int
4519 nfs3_getpage(vnode_t *vp, offset_t off, size_t len, uint_t *protp,
4520 	page_t *pl[], size_t plsz, struct seg *seg, caddr_t addr,
4521 	enum seg_rw rw, cred_t *cr, caller_context_t *ct)
4522 {
4523 	rnode_t *rp;
4524 	int error;
4525 	mntinfo_t *mi;
4526 
4527 	if (vp->v_flag & VNOMAP)
4528 		return (ENOSYS);
4529 
4530 	if (nfs_zone() != VTOMI(vp)->mi_zone)
4531 		return (EIO);
4532 	if (protp != NULL)
4533 		*protp = PROT_ALL;
4534 
4535 	/*
4536 	 * Now valididate that the caches are up to date.
4537 	 */
4538 	error = nfs3_validate_caches(vp, cr);
4539 	if (error)
4540 		return (error);
4541 
4542 	rp = VTOR(vp);
4543 	mi = VTOMI(vp);
4544 retry:
4545 	mutex_enter(&rp->r_statelock);
4546 
4547 	/*
4548 	 * Don't create dirty pages faster than they
4549 	 * can be cleaned so that the system doesn't
4550 	 * get imbalanced.  If the async queue is
4551 	 * maxed out, then wait for it to drain before
4552 	 * creating more dirty pages.  Also, wait for
4553 	 * any threads doing pagewalks in the vop_getattr
4554 	 * entry points so that they don't block for
4555 	 * long periods.
4556 	 */
4557 	if (rw == S_CREATE) {
4558 		while ((mi->mi_max_threads != 0 &&
4559 		    rp->r_awcount > 2 * mi->mi_max_threads) ||
4560 		    rp->r_gcount > 0)
4561 			cv_wait(&rp->r_cv, &rp->r_statelock);
4562 	}
4563 
4564 	/*
4565 	 * If we are getting called as a side effect of an nfs_write()
4566 	 * operation the local file size might not be extended yet.
4567 	 * In this case we want to be able to return pages of zeroes.
4568 	 */
4569 	if (off + len > rp->r_size + PAGEOFFSET && seg != segkmap) {
4570 		mutex_exit(&rp->r_statelock);
4571 		return (EFAULT);		/* beyond EOF */
4572 	}
4573 
4574 	mutex_exit(&rp->r_statelock);
4575 
4576 	if (len <= PAGESIZE) {
4577 		error = nfs3_getapage(vp, off, len, protp, pl, plsz,
4578 		    seg, addr, rw, cr);
4579 	} else {
4580 		error = pvn_getpages(nfs3_getapage, vp, off, len, protp,
4581 		    pl, plsz, seg, addr, rw, cr);
4582 	}
4583 
4584 	switch (error) {
4585 	case NFS_EOF:
4586 		nfs_purge_caches(vp, NFS_NOPURGE_DNLC, cr);
4587 		goto retry;
4588 	case ESTALE:
4589 		PURGE_STALE_FH(error, vp, cr);
4590 	}
4591 
4592 	return (error);
4593 }
4594 
4595 /*
4596  * Called from pvn_getpages or nfs3_getpage to get a particular page.
4597  */
4598 /* ARGSUSED */
4599 static int
4600 nfs3_getapage(vnode_t *vp, u_offset_t off, size_t len, uint_t *protp,
4601 	page_t *pl[], size_t plsz, struct seg *seg, caddr_t addr,
4602 	enum seg_rw rw, cred_t *cr)
4603 {
4604 	rnode_t *rp;
4605 	uint_t bsize;
4606 	struct buf *bp;
4607 	page_t *pp;
4608 	u_offset_t lbn;
4609 	u_offset_t io_off;
4610 	u_offset_t blkoff;
4611 	u_offset_t rablkoff;
4612 	size_t io_len;
4613 	uint_t blksize;
4614 	int error;
4615 	int readahead;
4616 	int readahead_issued = 0;
4617 	int ra_window; /* readahead window */
4618 	page_t *pagefound;
4619 	page_t *savepp;
4620 
4621 	if (nfs_zone() != VTOMI(vp)->mi_zone)
4622 		return (EIO);
4623 	rp = VTOR(vp);
4624 	bsize = MAX(vp->v_vfsp->vfs_bsize, PAGESIZE);
4625 
4626 reread:
4627 	bp = NULL;
4628 	pp = NULL;
4629 	pagefound = NULL;
4630 
4631 	if (pl != NULL)
4632 		pl[0] = NULL;
4633 
4634 	error = 0;
4635 	lbn = off / bsize;
4636 	blkoff = lbn * bsize;
4637 
4638 	/*
4639 	 * Queueing up the readahead before doing the synchronous read
4640 	 * results in a significant increase in read throughput because
4641 	 * of the increased parallelism between the async threads and
4642 	 * the process context.
4643 	 */
4644 	if ((off & ((vp->v_vfsp->vfs_bsize) - 1)) == 0 &&
4645 	    rw != S_CREATE &&
4646 	    !(vp->v_flag & VNOCACHE)) {
4647 		mutex_enter(&rp->r_statelock);
4648 
4649 		/*
4650 		 * Calculate the number of readaheads to do.
4651 		 * a) No readaheads at offset = 0.
4652 		 * b) Do maximum(nfs3_nra) readaheads when the readahead
4653 		 *    window is closed.
4654 		 * c) Do readaheads between 1 to (nfs3_nra - 1) depending
4655 		 *    upon how far the readahead window is open or close.
4656 		 * d) No readaheads if rp->r_nextr is not within the scope
4657 		 *    of the readahead window (random i/o).
4658 		 */
4659 
4660 		if (off == 0)
4661 			readahead = 0;
4662 		else if (blkoff == rp->r_nextr)
4663 			readahead = nfs3_nra;
4664 		else if (rp->r_nextr > blkoff &&
4665 		    ((ra_window = (rp->r_nextr - blkoff) / bsize)
4666 		    <= (nfs3_nra - 1)))
4667 			readahead = nfs3_nra - ra_window;
4668 		else
4669 			readahead = 0;
4670 
4671 		rablkoff = rp->r_nextr;
4672 		while (readahead > 0 && rablkoff + bsize < rp->r_size) {
4673 			mutex_exit(&rp->r_statelock);
4674 			if (nfs_async_readahead(vp, rablkoff + bsize,
4675 			    addr + (rablkoff + bsize - off), seg, cr,
4676 			    nfs3_readahead) < 0) {
4677 				mutex_enter(&rp->r_statelock);
4678 				break;
4679 			}
4680 			readahead--;
4681 			rablkoff += bsize;
4682 			/*
4683 			 * Indicate that we did a readahead so
4684 			 * readahead offset is not updated
4685 			 * by the synchronous read below.
4686 			 */
4687 			readahead_issued = 1;
4688 			mutex_enter(&rp->r_statelock);
4689 			/*
4690 			 * set readahead offset to
4691 			 * offset of last async readahead
4692 			 * request.
4693 			 */
4694 			rp->r_nextr = rablkoff;
4695 		}
4696 		mutex_exit(&rp->r_statelock);
4697 	}
4698 
4699 again:
4700 	if ((pagefound = page_exists(vp, off)) == NULL) {
4701 		if (pl == NULL) {
4702 			(void) nfs_async_readahead(vp, blkoff, addr, seg, cr,
4703 			    nfs3_readahead);
4704 		} else if (rw == S_CREATE) {
4705 			/*
4706 			 * Block for this page is not allocated, or the offset
4707 			 * is beyond the current allocation size, or we're
4708 			 * allocating a swap slot and the page was not found,
4709 			 * so allocate it and return a zero page.
4710 			 */
4711 			if ((pp = page_create_va(vp, off,
4712 			    PAGESIZE, PG_WAIT, seg, addr)) == NULL)
4713 				cmn_err(CE_PANIC, "nfs3_getapage: page_create");
4714 			io_len = PAGESIZE;
4715 			mutex_enter(&rp->r_statelock);
4716 			rp->r_nextr = off + PAGESIZE;
4717 			mutex_exit(&rp->r_statelock);
4718 		} else {
4719 			/*
4720 			 * Need to go to server to get a BLOCK, exception to
4721 			 * that being while reading at offset = 0 or doing
4722 			 * random i/o, in that case read only a PAGE.
4723 			 */
4724 			mutex_enter(&rp->r_statelock);
4725 			if (blkoff < rp->r_size &&
4726 			    blkoff + bsize >= rp->r_size) {
4727 				/*
4728 				 * If only a block or less is left in
4729 				 * the file, read all that is remaining.
4730 				 */
4731 				if (rp->r_size <= off) {
4732 					/*
4733 					 * Trying to access beyond EOF,
4734 					 * set up to get at least one page.
4735 					 */
4736 					blksize = off + PAGESIZE - blkoff;
4737 				} else
4738 					blksize = rp->r_size - blkoff;
4739 			} else if ((off == 0) ||
4740 			    (off != rp->r_nextr && !readahead_issued)) {
4741 				blksize = PAGESIZE;
4742 				blkoff = off; /* block = page here */
4743 			} else
4744 				blksize = bsize;
4745 			mutex_exit(&rp->r_statelock);
4746 
4747 			pp = pvn_read_kluster(vp, off, seg, addr, &io_off,
4748 			    &io_len, blkoff, blksize, 0);
4749 
4750 			/*
4751 			 * Some other thread has entered the page,
4752 			 * so just use it.
4753 			 */
4754 			if (pp == NULL)
4755 				goto again;
4756 
4757 			/*
4758 			 * Now round the request size up to page boundaries.
4759 			 * This ensures that the entire page will be
4760 			 * initialized to zeroes if EOF is encountered.
4761 			 */
4762 			io_len = ptob(btopr(io_len));
4763 
4764 			bp = pageio_setup(pp, io_len, vp, B_READ);
4765 			ASSERT(bp != NULL);
4766 
4767 			/*
4768 			 * pageio_setup should have set b_addr to 0.  This
4769 			 * is correct since we want to do I/O on a page
4770 			 * boundary.  bp_mapin will use this addr to calculate
4771 			 * an offset, and then set b_addr to the kernel virtual
4772 			 * address it allocated for us.
4773 			 */
4774 			ASSERT(bp->b_un.b_addr == 0);
4775 
4776 			bp->b_edev = 0;
4777 			bp->b_dev = 0;
4778 			bp->b_lblkno = lbtodb(io_off);
4779 			bp->b_file = vp;
4780 			bp->b_offset = (offset_t)off;
4781 			bp_mapin(bp);
4782 
4783 			/*
4784 			 * If doing a write beyond what we believe is EOF,
4785 			 * don't bother trying to read the pages from the
4786 			 * server, we'll just zero the pages here.  We
4787 			 * don't check that the rw flag is S_WRITE here
4788 			 * because some implementations may attempt a
4789 			 * read access to the buffer before copying data.
4790 			 */
4791 			mutex_enter(&rp->r_statelock);
4792 			if (io_off >= rp->r_size && seg == segkmap) {
4793 				mutex_exit(&rp->r_statelock);
4794 				bzero(bp->b_un.b_addr, io_len);
4795 			} else {
4796 				mutex_exit(&rp->r_statelock);
4797 				error = nfs3_bio(bp, NULL, cr);
4798 			}
4799 
4800 			/*
4801 			 * Unmap the buffer before freeing it.
4802 			 */
4803 			bp_mapout(bp);
4804 			pageio_done(bp);
4805 
4806 			savepp = pp;
4807 			do {
4808 				pp->p_fsdata = C_NOCOMMIT;
4809 			} while ((pp = pp->p_next) != savepp);
4810 
4811 			if (error == NFS_EOF) {
4812 				/*
4813 				 * If doing a write system call just return
4814 				 * zeroed pages, else user tried to get pages
4815 				 * beyond EOF, return error.  We don't check
4816 				 * that the rw flag is S_WRITE here because
4817 				 * some implementations may attempt a read
4818 				 * access to the buffer before copying data.
4819 				 */
4820 				if (seg == segkmap)
4821 					error = 0;
4822 				else
4823 					error = EFAULT;
4824 			}
4825 
4826 			if (!readahead_issued && !error) {
4827 				mutex_enter(&rp->r_statelock);
4828 				rp->r_nextr = io_off + io_len;
4829 				mutex_exit(&rp->r_statelock);
4830 			}
4831 		}
4832 	}
4833 
4834 out:
4835 	if (pl == NULL)
4836 		return (error);
4837 
4838 	if (error) {
4839 		if (pp != NULL)
4840 			pvn_read_done(pp, B_ERROR);
4841 		return (error);
4842 	}
4843 
4844 	if (pagefound) {
4845 		se_t se = (rw == S_CREATE ? SE_EXCL : SE_SHARED);
4846 
4847 		/*
4848 		 * Page exists in the cache, acquire the appropriate lock.
4849 		 * If this fails, start all over again.
4850 		 */
4851 		if ((pp = page_lookup(vp, off, se)) == NULL) {
4852 #ifdef DEBUG
4853 			nfs3_lostpage++;
4854 #endif
4855 			goto reread;
4856 		}
4857 		pl[0] = pp;
4858 		pl[1] = NULL;
4859 		return (0);
4860 	}
4861 
4862 	if (pp != NULL)
4863 		pvn_plist_init(pp, pl, plsz, off, io_len, rw);
4864 
4865 	return (error);
4866 }
4867 
4868 static void
4869 nfs3_readahead(vnode_t *vp, u_offset_t blkoff, caddr_t addr, struct seg *seg,
4870 	cred_t *cr)
4871 {
4872 	int error;
4873 	page_t *pp;
4874 	u_offset_t io_off;
4875 	size_t io_len;
4876 	struct buf *bp;
4877 	uint_t bsize, blksize;
4878 	rnode_t *rp = VTOR(vp);
4879 	page_t *savepp;
4880 
4881 	ASSERT(nfs_zone() == VTOMI(vp)->mi_zone);
4882 	bsize = MAX(vp->v_vfsp->vfs_bsize, PAGESIZE);
4883 
4884 	mutex_enter(&rp->r_statelock);
4885 	if (blkoff < rp->r_size && blkoff + bsize > rp->r_size) {
4886 		/*
4887 		 * If less than a block left in file read less
4888 		 * than a block.
4889 		 */
4890 		blksize = rp->r_size - blkoff;
4891 	} else
4892 		blksize = bsize;
4893 	mutex_exit(&rp->r_statelock);
4894 
4895 	pp = pvn_read_kluster(vp, blkoff, segkmap, addr,
4896 	    &io_off, &io_len, blkoff, blksize, 1);
4897 	/*
4898 	 * The isra flag passed to the kluster function is 1, we may have
4899 	 * gotten a return value of NULL for a variety of reasons (# of free
4900 	 * pages < minfree, someone entered the page on the vnode etc). In all
4901 	 * cases, we want to punt on the readahead.
4902 	 */
4903 	if (pp == NULL)
4904 		return;
4905 
4906 	/*
4907 	 * Now round the request size up to page boundaries.
4908 	 * This ensures that the entire page will be
4909 	 * initialized to zeroes if EOF is encountered.
4910 	 */
4911 	io_len = ptob(btopr(io_len));
4912 
4913 	bp = pageio_setup(pp, io_len, vp, B_READ);
4914 	ASSERT(bp != NULL);
4915 
4916 	/*
4917 	 * pageio_setup should have set b_addr to 0.  This is correct since
4918 	 * we want to do I/O on a page boundary. bp_mapin() will use this addr
4919 	 * to calculate an offset, and then set b_addr to the kernel virtual
4920 	 * address it allocated for us.
4921 	 */
4922 	ASSERT(bp->b_un.b_addr == 0);
4923 
4924 	bp->b_edev = 0;
4925 	bp->b_dev = 0;
4926 	bp->b_lblkno = lbtodb(io_off);
4927 	bp->b_file = vp;
4928 	bp->b_offset = (offset_t)blkoff;
4929 	bp_mapin(bp);
4930 
4931 	/*
4932 	 * If doing a write beyond what we believe is EOF, don't bother trying
4933 	 * to read the pages from the server, we'll just zero the pages here.
4934 	 * We don't check that the rw flag is S_WRITE here because some
4935 	 * implementations may attempt a read access to the buffer before
4936 	 * copying data.
4937 	 */
4938 	mutex_enter(&rp->r_statelock);
4939 	if (io_off >= rp->r_size && seg == segkmap) {
4940 		mutex_exit(&rp->r_statelock);
4941 		bzero(bp->b_un.b_addr, io_len);
4942 		error = 0;
4943 	} else {
4944 		mutex_exit(&rp->r_statelock);
4945 		error = nfs3_bio(bp, NULL, cr);
4946 		if (error == NFS_EOF)
4947 			error = 0;
4948 	}
4949 
4950 	/*
4951 	 * Unmap the buffer before freeing it.
4952 	 */
4953 	bp_mapout(bp);
4954 	pageio_done(bp);
4955 
4956 	savepp = pp;
4957 	do {
4958 		pp->p_fsdata = C_NOCOMMIT;
4959 	} while ((pp = pp->p_next) != savepp);
4960 
4961 	pvn_read_done(pp, error ? B_READ | B_ERROR : B_READ);
4962 
4963 	/*
4964 	 * In case of error set readahead offset
4965 	 * to the lowest offset.
4966 	 * pvn_read_done() calls VN_DISPOSE to destroy the pages
4967 	 */
4968 	if (error && rp->r_nextr > io_off) {
4969 		mutex_enter(&rp->r_statelock);
4970 		if (rp->r_nextr > io_off)
4971 			rp->r_nextr = io_off;
4972 		mutex_exit(&rp->r_statelock);
4973 	}
4974 }
4975 
4976 /*
4977  * Flags are composed of {B_INVAL, B_FREE, B_DONTNEED, B_FORCE}
4978  * If len == 0, do from off to EOF.
4979  *
4980  * The normal cases should be len == 0 && off == 0 (entire vp list),
4981  * len == MAXBSIZE (from segmap_release actions), and len == PAGESIZE
4982  * (from pageout).
4983  */
4984 /* ARGSUSED */
4985 static int
4986 nfs3_putpage(vnode_t *vp, offset_t off, size_t len, int flags, cred_t *cr,
4987 	caller_context_t *ct)
4988 {
4989 	int error;
4990 	rnode_t *rp;
4991 
4992 	ASSERT(cr != NULL);
4993 
4994 	/*
4995 	 * XXX - Why should this check be made here?
4996 	 */
4997 	if (vp->v_flag & VNOMAP)
4998 		return (ENOSYS);
4999 	if (len == 0 && !(flags & B_INVAL) && vn_is_readonly(vp))
5000 		return (0);
5001 	if (!(flags & B_ASYNC) && nfs_zone() != VTOMI(vp)->mi_zone)
5002 		return (EIO);
5003 
5004 	rp = VTOR(vp);
5005 	mutex_enter(&rp->r_statelock);
5006 	rp->r_count++;
5007 	mutex_exit(&rp->r_statelock);
5008 	error = nfs_putpages(vp, off, len, flags, cr);
5009 	mutex_enter(&rp->r_statelock);
5010 	rp->r_count--;
5011 	cv_broadcast(&rp->r_cv);
5012 	mutex_exit(&rp->r_statelock);
5013 
5014 	return (error);
5015 }
5016 
5017 /*
5018  * Write out a single page, possibly klustering adjacent dirty pages.
5019  */
5020 int
5021 nfs3_putapage(vnode_t *vp, page_t *pp, u_offset_t *offp, size_t *lenp,
5022 	int flags, cred_t *cr)
5023 {
5024 	u_offset_t io_off;
5025 	u_offset_t lbn_off;
5026 	u_offset_t lbn;
5027 	size_t io_len;
5028 	uint_t bsize;
5029 	int error;
5030 	rnode_t *rp;
5031 
5032 	ASSERT(!vn_is_readonly(vp));
5033 	ASSERT(pp != NULL);
5034 	ASSERT(cr != NULL);
5035 	ASSERT((flags & B_ASYNC) || nfs_zone() == VTOMI(vp)->mi_zone);
5036 
5037 	rp = VTOR(vp);
5038 	ASSERT(rp->r_count > 0);
5039 
5040 	bsize = MAX(vp->v_vfsp->vfs_bsize, PAGESIZE);
5041 	lbn = pp->p_offset / bsize;
5042 	lbn_off = lbn * bsize;
5043 
5044 	/*
5045 	 * Find a kluster that fits in one block, or in
5046 	 * one page if pages are bigger than blocks.  If
5047 	 * there is less file space allocated than a whole
5048 	 * page, we'll shorten the i/o request below.
5049 	 */
5050 	pp = pvn_write_kluster(vp, pp, &io_off, &io_len, lbn_off,
5051 	    roundup(bsize, PAGESIZE), flags);
5052 
5053 	/*
5054 	 * pvn_write_kluster shouldn't have returned a page with offset
5055 	 * behind the original page we were given.  Verify that.
5056 	 */
5057 	ASSERT((pp->p_offset / bsize) >= lbn);
5058 
5059 	/*
5060 	 * Now pp will have the list of kept dirty pages marked for
5061 	 * write back.  It will also handle invalidation and freeing
5062 	 * of pages that are not dirty.  Check for page length rounding
5063 	 * problems.
5064 	 */
5065 	if (io_off + io_len > lbn_off + bsize) {
5066 		ASSERT((io_off + io_len) - (lbn_off + bsize) < PAGESIZE);
5067 		io_len = lbn_off + bsize - io_off;
5068 	}
5069 	/*
5070 	 * The RMODINPROGRESS flag makes sure that nfs(3)_bio() sees a
5071 	 * consistent value of r_size. RMODINPROGRESS is set in writerp().
5072 	 * When RMODINPROGRESS is set it indicates that a uiomove() is in
5073 	 * progress and the r_size has not been made consistent with the
5074 	 * new size of the file. When the uiomove() completes the r_size is
5075 	 * updated and the RMODINPROGRESS flag is cleared.
5076 	 *
5077 	 * The RMODINPROGRESS flag makes sure that nfs(3)_bio() sees a
5078 	 * consistent value of r_size. Without this handshaking, it is
5079 	 * possible that nfs(3)_bio() picks  up the old value of r_size
5080 	 * before the uiomove() in writerp() completes. This will result
5081 	 * in the write through nfs(3)_bio() being dropped.
5082 	 *
5083 	 * More precisely, there is a window between the time the uiomove()
5084 	 * completes and the time the r_size is updated. If a VOP_PUTPAGE()
5085 	 * operation intervenes in this window, the page will be picked up,
5086 	 * because it is dirty (it will be unlocked, unless it was
5087 	 * pagecreate'd). When the page is picked up as dirty, the dirty
5088 	 * bit is reset (pvn_getdirty()). In nfs(3)write(), r_size is
5089 	 * checked. This will still be the old size. Therefore the page will
5090 	 * not be written out. When segmap_release() calls VOP_PUTPAGE(),
5091 	 * the page will be found to be clean and the write will be dropped.
5092 	 */
5093 	if (rp->r_flags & RMODINPROGRESS) {
5094 		mutex_enter(&rp->r_statelock);
5095 		if ((rp->r_flags & RMODINPROGRESS) &&
5096 		    rp->r_modaddr + MAXBSIZE > io_off &&
5097 		    rp->r_modaddr < io_off + io_len) {
5098 			page_t *plist;
5099 			/*
5100 			 * A write is in progress for this region of the file.
5101 			 * If we did not detect RMODINPROGRESS here then this
5102 			 * path through nfs_putapage() would eventually go to
5103 			 * nfs(3)_bio() and may not write out all of the data
5104 			 * in the pages. We end up losing data. So we decide
5105 			 * to set the modified bit on each page in the page
5106 			 * list and mark the rnode with RDIRTY. This write
5107 			 * will be restarted at some later time.
5108 			 */
5109 			plist = pp;
5110 			while (plist != NULL) {
5111 				pp = plist;
5112 				page_sub(&plist, pp);
5113 				hat_setmod(pp);
5114 				page_io_unlock(pp);
5115 				page_unlock(pp);
5116 			}
5117 			rp->r_flags |= RDIRTY;
5118 			mutex_exit(&rp->r_statelock);
5119 			if (offp)
5120 				*offp = io_off;
5121 			if (lenp)
5122 				*lenp = io_len;
5123 			return (0);
5124 		}
5125 		mutex_exit(&rp->r_statelock);
5126 	}
5127 
5128 	if (flags & B_ASYNC) {
5129 		error = nfs_async_putapage(vp, pp, io_off, io_len, flags, cr,
5130 		    nfs3_sync_putapage);
5131 	} else
5132 		error = nfs3_sync_putapage(vp, pp, io_off, io_len, flags, cr);
5133 
5134 	if (offp)
5135 		*offp = io_off;
5136 	if (lenp)
5137 		*lenp = io_len;
5138 	return (error);
5139 }
5140 
5141 static int
5142 nfs3_sync_putapage(vnode_t *vp, page_t *pp, u_offset_t io_off, size_t io_len,
5143 	int flags, cred_t *cr)
5144 {
5145 	int error;
5146 	rnode_t *rp;
5147 
5148 	ASSERT(nfs_zone() == VTOMI(vp)->mi_zone);
5149 
5150 	flags |= B_WRITE;
5151 
5152 	error = nfs3_rdwrlbn(vp, pp, io_off, io_len, flags, cr);
5153 
5154 	rp = VTOR(vp);
5155 
5156 	if ((error == ENOSPC || error == EDQUOT || error == EFBIG ||
5157 	    error == EACCES) &&
5158 	    (flags & (B_INVAL|B_FORCE)) != (B_INVAL|B_FORCE)) {
5159 		if (!(rp->r_flags & ROUTOFSPACE)) {
5160 			mutex_enter(&rp->r_statelock);
5161 			rp->r_flags |= ROUTOFSPACE;
5162 			mutex_exit(&rp->r_statelock);
5163 		}
5164 		flags |= B_ERROR;
5165 		pvn_write_done(pp, flags);
5166 		/*
5167 		 * If this was not an async thread, then try again to
5168 		 * write out the pages, but this time, also destroy
5169 		 * them whether or not the write is successful.  This
5170 		 * will prevent memory from filling up with these
5171 		 * pages and destroying them is the only alternative
5172 		 * if they can't be written out.
5173 		 *
5174 		 * Don't do this if this is an async thread because
5175 		 * when the pages are unlocked in pvn_write_done,
5176 		 * some other thread could have come along, locked
5177 		 * them, and queued for an async thread.  It would be
5178 		 * possible for all of the async threads to be tied
5179 		 * up waiting to lock the pages again and they would
5180 		 * all already be locked and waiting for an async
5181 		 * thread to handle them.  Deadlock.
5182 		 */
5183 		if (!(flags & B_ASYNC)) {
5184 			error = nfs3_putpage(vp, io_off, io_len,
5185 			    B_INVAL | B_FORCE, cr, NULL);
5186 		}
5187 	} else {
5188 		if (error)
5189 			flags |= B_ERROR;
5190 		else if (rp->r_flags & ROUTOFSPACE) {
5191 			mutex_enter(&rp->r_statelock);
5192 			rp->r_flags &= ~ROUTOFSPACE;
5193 			mutex_exit(&rp->r_statelock);
5194 		}
5195 		pvn_write_done(pp, flags);
5196 		if (freemem < desfree)
5197 			(void) nfs3_commit_vp(vp, (u_offset_t)0, 0, cr);
5198 	}
5199 
5200 	return (error);
5201 }
5202 
5203 /* ARGSUSED */
5204 static int
5205 nfs3_map(vnode_t *vp, offset_t off, struct as *as, caddr_t *addrp,
5206 	size_t len, uchar_t prot, uchar_t maxprot, uint_t flags,
5207 	cred_t *cr, caller_context_t *ct)
5208 {
5209 	struct segvn_crargs vn_a;
5210 	int error;
5211 	rnode_t *rp;
5212 	struct vattr va;
5213 
5214 	if (nfs_zone() != VTOMI(vp)->mi_zone)
5215 		return (EIO);
5216 
5217 	if (vp->v_flag & VNOMAP)
5218 		return (ENOSYS);
5219 
5220 	if (off < 0 || off + len < 0)
5221 		return (ENXIO);
5222 
5223 	if (vp->v_type != VREG)
5224 		return (ENODEV);
5225 
5226 	/*
5227 	 * If there is cached data and if close-to-open consistency
5228 	 * checking is not turned off and if the file system is not
5229 	 * mounted readonly, then force an over the wire getattr.
5230 	 * Otherwise, just invoke nfs3getattr to get a copy of the
5231 	 * attributes.  The attribute cache will be used unless it
5232 	 * is timed out and if it is, then an over the wire getattr
5233 	 * will be issued.
5234 	 */
5235 	va.va_mask = AT_ALL;
5236 	if (vn_has_cached_data(vp) &&
5237 	    !(VTOMI(vp)->mi_flags & MI_NOCTO) && !vn_is_readonly(vp))
5238 		error = nfs3_getattr_otw(vp, &va, cr);
5239 	else
5240 		error = nfs3getattr(vp, &va, cr);
5241 	if (error)
5242 		return (error);
5243 
5244 	/*
5245 	 * Check to see if the vnode is currently marked as not cachable.
5246 	 * This means portions of the file are locked (through VOP_FRLOCK).
5247 	 * In this case the map request must be refused.  We use
5248 	 * rp->r_lkserlock to avoid a race with concurrent lock requests.
5249 	 */
5250 	rp = VTOR(vp);
5251 
5252 	/*
5253 	 * Atomically increment r_inmap after acquiring r_rwlock. The
5254 	 * idea here is to acquire r_rwlock to block read/write and
5255 	 * not to protect r_inmap. r_inmap will inform nfs3_read/write()
5256 	 * that we are in nfs3_map(). Now, r_rwlock is acquired in order
5257 	 * and we can prevent the deadlock that would have occurred
5258 	 * when nfs3_addmap() would have acquired it out of order.
5259 	 *
5260 	 * Since we are not protecting r_inmap by any lock, we do not
5261 	 * hold any lock when we decrement it. We atomically decrement
5262 	 * r_inmap after we release r_lkserlock.
5263 	 */
5264 
5265 	if (nfs_rw_enter_sig(&rp->r_rwlock, RW_WRITER, INTR(vp)))
5266 		return (EINTR);
5267 	atomic_add_int(&rp->r_inmap, 1);
5268 	nfs_rw_exit(&rp->r_rwlock);
5269 
5270 	if (nfs_rw_enter_sig(&rp->r_lkserlock, RW_READER, INTR(vp))) {
5271 		atomic_add_int(&rp->r_inmap, -1);
5272 		return (EINTR);
5273 	}
5274 
5275 	if (vp->v_flag & VNOCACHE) {
5276 		error = EAGAIN;
5277 		goto done;
5278 	}
5279 
5280 	/*
5281 	 * Don't allow concurrent locks and mapping if mandatory locking is
5282 	 * enabled.
5283 	 */
5284 	if ((flk_has_remote_locks(vp) || lm_has_sleep(vp)) &&
5285 	    MANDLOCK(vp, va.va_mode)) {
5286 		error = EAGAIN;
5287 		goto done;
5288 	}
5289 
5290 	as_rangelock(as);
5291 	error = choose_addr(as, addrp, len, off, ADDR_VACALIGN, flags);
5292 	if (error != 0) {
5293 		as_rangeunlock(as);
5294 		goto done;
5295 	}
5296 
5297 	vn_a.vp = vp;
5298 	vn_a.offset = off;
5299 	vn_a.type = (flags & MAP_TYPE);
5300 	vn_a.prot = (uchar_t)prot;
5301 	vn_a.maxprot = (uchar_t)maxprot;
5302 	vn_a.flags = (flags & ~MAP_TYPE);
5303 	vn_a.cred = cr;
5304 	vn_a.amp = NULL;
5305 	vn_a.szc = 0;
5306 	vn_a.lgrp_mem_policy_flags = 0;
5307 
5308 	error = as_map(as, *addrp, len, segvn_create, &vn_a);
5309 	as_rangeunlock(as);
5310 
5311 done:
5312 	nfs_rw_exit(&rp->r_lkserlock);
5313 	atomic_add_int(&rp->r_inmap, -1);
5314 	return (error);
5315 }
5316 
5317 /* ARGSUSED */
5318 static int
5319 nfs3_addmap(vnode_t *vp, offset_t off, struct as *as, caddr_t addr,
5320 	size_t len, uchar_t prot, uchar_t maxprot, uint_t flags,
5321 	cred_t *cr, caller_context_t *ct)
5322 {
5323 	rnode_t *rp;
5324 
5325 	if (vp->v_flag & VNOMAP)
5326 		return (ENOSYS);
5327 	if (nfs_zone() != VTOMI(vp)->mi_zone)
5328 		return (EIO);
5329 
5330 	rp = VTOR(vp);
5331 	atomic_add_long((ulong_t *)&rp->r_mapcnt, btopr(len));
5332 
5333 	return (0);
5334 }
5335 
5336 /* ARGSUSED */
5337 static int
5338 nfs3_frlock(vnode_t *vp, int cmd, struct flock64 *bfp, int flag,
5339 	offset_t offset, struct flk_callback *flk_cbp, cred_t *cr,
5340 	caller_context_t *ct)
5341 {
5342 	netobj lm_fh3;
5343 	int rc;
5344 	u_offset_t start, end;
5345 	rnode_t *rp;
5346 	int error = 0, intr = INTR(vp);
5347 
5348 	if (nfs_zone() != VTOMI(vp)->mi_zone)
5349 		return (EIO);
5350 	/* check for valid cmd parameter */
5351 	if (cmd != F_GETLK && cmd != F_SETLK && cmd != F_SETLKW)
5352 		return (EINVAL);
5353 
5354 	/* Verify l_type. */
5355 	switch (bfp->l_type) {
5356 	case F_RDLCK:
5357 		if (cmd != F_GETLK && !(flag & FREAD))
5358 			return (EBADF);
5359 		break;
5360 	case F_WRLCK:
5361 		if (cmd != F_GETLK && !(flag & FWRITE))
5362 			return (EBADF);
5363 		break;
5364 	case F_UNLCK:
5365 		intr = 0;
5366 		break;
5367 
5368 	default:
5369 		return (EINVAL);
5370 	}
5371 
5372 	/* check the validity of the lock range */
5373 	if (rc = flk_convert_lock_data(vp, bfp, &start, &end, offset))
5374 		return (rc);
5375 	if (rc = flk_check_lock_data(start, end, MAXEND))
5376 		return (rc);
5377 
5378 	/*
5379 	 * If the filesystem is mounted using local locking, pass the
5380 	 * request off to the local locking code.
5381 	 */
5382 	if (VTOMI(vp)->mi_flags & MI_LLOCK) {
5383 		if (cmd == F_SETLK || cmd == F_SETLKW) {
5384 			/*
5385 			 * For complete safety, we should be holding
5386 			 * r_lkserlock.  However, we can't call
5387 			 * lm_safelock and then fs_frlock while
5388 			 * holding r_lkserlock, so just invoke
5389 			 * lm_safelock and expect that this will
5390 			 * catch enough of the cases.
5391 			 */
5392 			if (!lm_safelock(vp, bfp, cr))
5393 				return (EAGAIN);
5394 		}
5395 		return (fs_frlock(vp, cmd, bfp, flag, offset, flk_cbp, cr, ct));
5396 	}
5397 
5398 	rp = VTOR(vp);
5399 
5400 	/*
5401 	 * Check whether the given lock request can proceed, given the
5402 	 * current file mappings.
5403 	 */
5404 	if (nfs_rw_enter_sig(&rp->r_lkserlock, RW_WRITER, intr))
5405 		return (EINTR);
5406 	if (cmd == F_SETLK || cmd == F_SETLKW) {
5407 		if (!lm_safelock(vp, bfp, cr)) {
5408 			rc = EAGAIN;
5409 			goto done;
5410 		}
5411 	}
5412 
5413 	/*
5414 	 * Flush the cache after waiting for async I/O to finish.  For new
5415 	 * locks, this is so that the process gets the latest bits from the
5416 	 * server.  For unlocks, this is so that other clients see the
5417 	 * latest bits once the file has been unlocked.  If currently dirty
5418 	 * pages can't be flushed, then don't allow a lock to be set.  But
5419 	 * allow unlocks to succeed, to avoid having orphan locks on the
5420 	 * server.
5421 	 */
5422 	if (cmd != F_GETLK) {
5423 		mutex_enter(&rp->r_statelock);
5424 		while (rp->r_count > 0) {
5425 			if (intr) {
5426 				klwp_t *lwp = ttolwp(curthread);
5427 
5428 				if (lwp != NULL)
5429 					lwp->lwp_nostop++;
5430 				if (cv_wait_sig(&rp->r_cv,
5431 				    &rp->r_statelock) == 0) {
5432 					if (lwp != NULL)
5433 						lwp->lwp_nostop--;
5434 					rc = EINTR;
5435 					break;
5436 				}
5437 				if (lwp != NULL)
5438 					lwp->lwp_nostop--;
5439 			} else
5440 				cv_wait(&rp->r_cv, &rp->r_statelock);
5441 		}
5442 		mutex_exit(&rp->r_statelock);
5443 		if (rc != 0)
5444 			goto done;
5445 		error = nfs3_putpage(vp, (offset_t)0, 0, B_INVAL, cr, ct);
5446 		if (error) {
5447 			if (error == ENOSPC || error == EDQUOT) {
5448 				mutex_enter(&rp->r_statelock);
5449 				if (!rp->r_error)
5450 					rp->r_error = error;
5451 				mutex_exit(&rp->r_statelock);
5452 			}
5453 			if (bfp->l_type != F_UNLCK) {
5454 				rc = ENOLCK;
5455 				goto done;
5456 			}
5457 		}
5458 	}
5459 
5460 	lm_fh3.n_len = VTOFH3(vp)->fh3_length;
5461 	lm_fh3.n_bytes = (char *)&(VTOFH3(vp)->fh3_u.data);
5462 
5463 	/*
5464 	 * Call the lock manager to do the real work of contacting
5465 	 * the server and obtaining the lock.
5466 	 */
5467 	rc = lm4_frlock(vp, cmd, bfp, flag, offset, cr, &lm_fh3, flk_cbp);
5468 
5469 	if (rc == 0)
5470 		nfs_lockcompletion(vp, cmd);
5471 
5472 done:
5473 	nfs_rw_exit(&rp->r_lkserlock);
5474 	return (rc);
5475 }
5476 
5477 /*
5478  * Free storage space associated with the specified vnode.  The portion
5479  * to be freed is specified by bfp->l_start and bfp->l_len (already
5480  * normalized to a "whence" of 0).
5481  *
5482  * This is an experimental facility whose continued existence is not
5483  * guaranteed.  Currently, we only support the special case
5484  * of l_len == 0, meaning free to end of file.
5485  */
5486 /* ARGSUSED */
5487 static int
5488 nfs3_space(vnode_t *vp, int cmd, struct flock64 *bfp, int flag,
5489 	offset_t offset, cred_t *cr, caller_context_t *ct)
5490 {
5491 	int error;
5492 
5493 	ASSERT(vp->v_type == VREG);
5494 	if (cmd != F_FREESP)
5495 		return (EINVAL);
5496 	if (nfs_zone() != VTOMI(vp)->mi_zone)
5497 		return (EIO);
5498 
5499 	error = convoff(vp, bfp, 0, offset);
5500 	if (!error) {
5501 		ASSERT(bfp->l_start >= 0);
5502 		if (bfp->l_len == 0) {
5503 			struct vattr va;
5504 
5505 			/*
5506 			 * ftruncate should not change the ctime and
5507 			 * mtime if we truncate the file to its
5508 			 * previous size.
5509 			 */
5510 			va.va_mask = AT_SIZE;
5511 			error = nfs3getattr(vp, &va, cr);
5512 			if (error || va.va_size == bfp->l_start)
5513 				return (error);
5514 			va.va_mask = AT_SIZE;
5515 			va.va_size = bfp->l_start;
5516 			error = nfs3setattr(vp, &va, 0, cr);
5517 		} else
5518 			error = EINVAL;
5519 	}
5520 
5521 	return (error);
5522 }
5523 
5524 /* ARGSUSED */
5525 static int
5526 nfs3_realvp(vnode_t *vp, vnode_t **vpp, caller_context_t *ct)
5527 {
5528 
5529 	return (EINVAL);
5530 }
5531 
5532 /*
5533  * Setup and add an address space callback to do the work of the delmap call.
5534  * The callback will (and must be) deleted in the actual callback function.
5535  *
5536  * This is done in order to take care of the problem that we have with holding
5537  * the address space's a_lock for a long period of time (e.g. if the NFS server
5538  * is down).  Callbacks will be executed in the address space code while the
5539  * a_lock is not held.	Holding the address space's a_lock causes things such
5540  * as ps and fork to hang because they are trying to acquire this lock as well.
5541  */
5542 /* ARGSUSED */
5543 static int
5544 nfs3_delmap(vnode_t *vp, offset_t off, struct as *as, caddr_t addr,
5545 	size_t len, uint_t prot, uint_t maxprot, uint_t flags,
5546 	cred_t *cr, caller_context_t *ct)
5547 {
5548 	int			caller_found;
5549 	int			error;
5550 	rnode_t			*rp;
5551 	nfs_delmap_args_t	*dmapp;
5552 	nfs_delmapcall_t	*delmap_call;
5553 
5554 	if (vp->v_flag & VNOMAP)
5555 		return (ENOSYS);
5556 	/*
5557 	 * A process may not change zones if it has NFS pages mmap'ed
5558 	 * in, so we can't legitimately get here from the wrong zone.
5559 	 */
5560 	ASSERT(nfs_zone() == VTOMI(vp)->mi_zone);
5561 
5562 	rp = VTOR(vp);
5563 
5564 	/*
5565 	 * The way that the address space of this process deletes its mapping
5566 	 * of this file is via the following call chains:
5567 	 * - as_free()->SEGOP_UNMAP()/segvn_unmap()->VOP_DELMAP()/nfs3_delmap()
5568 	 * - as_unmap()->SEGOP_UNMAP()/segvn_unmap()->VOP_DELMAP()/nfs3_delmap()
5569 	 *
5570 	 * With the use of address space callbacks we are allowed to drop the
5571 	 * address space lock, a_lock, while executing the NFS operations that
5572 	 * need to go over the wire.  Returning EAGAIN to the caller of this
5573 	 * function is what drives the execution of the callback that we add
5574 	 * below.  The callback will be executed by the address space code
5575 	 * after dropping the a_lock.  When the callback is finished, since
5576 	 * we dropped the a_lock, it must be re-acquired and segvn_unmap()
5577 	 * is called again on the same segment to finish the rest of the work
5578 	 * that needs to happen during unmapping.
5579 	 *
5580 	 * This action of calling back into the segment driver causes
5581 	 * nfs3_delmap() to get called again, but since the callback was
5582 	 * already executed at this point, it already did the work and there
5583 	 * is nothing left for us to do.
5584 	 *
5585 	 * To Summarize:
5586 	 * - The first time nfs3_delmap is called by the current thread is when
5587 	 * we add the caller associated with this delmap to the delmap caller
5588 	 * list, add the callback, and return EAGAIN.
5589 	 * - The second time in this call chain when nfs3_delmap is called we
5590 	 * will find this caller in the delmap caller list and realize there
5591 	 * is no more work to do thus removing this caller from the list and
5592 	 * returning the error that was set in the callback execution.
5593 	 */
5594 	caller_found = nfs_find_and_delete_delmapcall(rp, &error);
5595 	if (caller_found) {
5596 		/*
5597 		 * 'error' is from the actual delmap operations.  To avoid
5598 		 * hangs, we need to handle the return of EAGAIN differently
5599 		 * since this is what drives the callback execution.
5600 		 * In this case, we don't want to return EAGAIN and do the
5601 		 * callback execution because there are none to execute.
5602 		 */
5603 		if (error == EAGAIN)
5604 			return (0);
5605 		else
5606 			return (error);
5607 	}
5608 
5609 	/* current caller was not in the list */
5610 	delmap_call = nfs_init_delmapcall();
5611 
5612 	mutex_enter(&rp->r_statelock);
5613 	list_insert_tail(&rp->r_indelmap, delmap_call);
5614 	mutex_exit(&rp->r_statelock);
5615 
5616 	dmapp = kmem_alloc(sizeof (nfs_delmap_args_t), KM_SLEEP);
5617 
5618 	dmapp->vp = vp;
5619 	dmapp->off = off;
5620 	dmapp->addr = addr;
5621 	dmapp->len = len;
5622 	dmapp->prot = prot;
5623 	dmapp->maxprot = maxprot;
5624 	dmapp->flags = flags;
5625 	dmapp->cr = cr;
5626 	dmapp->caller = delmap_call;
5627 
5628 	error = as_add_callback(as, nfs3_delmap_callback, dmapp,
5629 	    AS_UNMAP_EVENT, addr, len, KM_SLEEP);
5630 
5631 	return (error ? error : EAGAIN);
5632 }
5633 
5634 /*
5635  * Remove some pages from an mmap'd vnode.  Just update the
5636  * count of pages.  If doing close-to-open, then flush and
5637  * commit all of the pages associated with this file.
5638  * Otherwise, start an asynchronous page flush to write out
5639  * any dirty pages.  This will also associate a credential
5640  * with the rnode which can be used to write the pages.
5641  */
5642 /* ARGSUSED */
5643 static void
5644 nfs3_delmap_callback(struct as *as, void *arg, uint_t event)
5645 {
5646 	int			error;
5647 	rnode_t			*rp;
5648 	mntinfo_t		*mi;
5649 	nfs_delmap_args_t	*dmapp = (nfs_delmap_args_t *)arg;
5650 
5651 	rp = VTOR(dmapp->vp);
5652 	mi = VTOMI(dmapp->vp);
5653 
5654 	atomic_add_long((ulong_t *)&rp->r_mapcnt, -btopr(dmapp->len));
5655 	ASSERT(rp->r_mapcnt >= 0);
5656 
5657 	/*
5658 	 * Initiate a page flush and potential commit if there are
5659 	 * pages, the file system was not mounted readonly, the segment
5660 	 * was mapped shared, and the pages themselves were writeable.
5661 	 */
5662 	if (vn_has_cached_data(dmapp->vp) && !vn_is_readonly(dmapp->vp) &&
5663 	    dmapp->flags == MAP_SHARED && (dmapp->maxprot & PROT_WRITE)) {
5664 		mutex_enter(&rp->r_statelock);
5665 		rp->r_flags |= RDIRTY;
5666 		mutex_exit(&rp->r_statelock);
5667 		/*
5668 		 * If this is a cross-zone access a sync putpage won't work, so
5669 		 * the best we can do is try an async putpage.  That seems
5670 		 * better than something more draconian such as discarding the
5671 		 * dirty pages.
5672 		 */
5673 		if ((mi->mi_flags & MI_NOCTO) ||
5674 		    nfs_zone() != mi->mi_zone)
5675 			error = nfs3_putpage(dmapp->vp, dmapp->off, dmapp->len,
5676 			    B_ASYNC, dmapp->cr, NULL);
5677 		else
5678 			error = nfs3_putpage_commit(dmapp->vp, dmapp->off,
5679 			    dmapp->len, dmapp->cr);
5680 		if (!error) {
5681 			mutex_enter(&rp->r_statelock);
5682 			error = rp->r_error;
5683 			rp->r_error = 0;
5684 			mutex_exit(&rp->r_statelock);
5685 		}
5686 	} else
5687 		error = 0;
5688 
5689 	if ((rp->r_flags & RDIRECTIO) || (mi->mi_flags & MI_DIRECTIO))
5690 		(void) nfs3_putpage(dmapp->vp, dmapp->off, dmapp->len,
5691 		    B_INVAL, dmapp->cr, NULL);
5692 
5693 	dmapp->caller->error = error;
5694 	(void) as_delete_callback(as, arg);
5695 	kmem_free(dmapp, sizeof (nfs_delmap_args_t));
5696 }
5697 
5698 static int nfs3_pathconf_disable_cache = 0;
5699 
5700 #ifdef DEBUG
5701 static int nfs3_pathconf_cache_hits = 0;
5702 static int nfs3_pathconf_cache_misses = 0;
5703 #endif
5704 
5705 /* ARGSUSED */
5706 static int
5707 nfs3_pathconf(vnode_t *vp, int cmd, ulong_t *valp, cred_t *cr,
5708 	caller_context_t *ct)
5709 {
5710 	int error;
5711 	PATHCONF3args args;
5712 	PATHCONF3res res;
5713 	int douprintf;
5714 	failinfo_t fi;
5715 	rnode_t *rp;
5716 	hrtime_t t;
5717 
5718 	if (nfs_zone() != VTOMI(vp)->mi_zone)
5719 		return (EIO);
5720 	/*
5721 	 * Large file spec - need to base answer on info stored
5722 	 * on original FSINFO response.
5723 	 */
5724 	if (cmd == _PC_FILESIZEBITS) {
5725 		unsigned long long ll;
5726 		long l = 1;
5727 
5728 		ll = VTOMI(vp)->mi_maxfilesize;
5729 
5730 		if (ll == 0) {
5731 			*valp = 0;
5732 			return (0);
5733 		}
5734 
5735 		if (ll & 0xffffffff00000000) {
5736 			l += 32; ll >>= 32;
5737 		}
5738 		if (ll & 0xffff0000) {
5739 			l += 16; ll >>= 16;
5740 		}
5741 		if (ll & 0xff00) {
5742 			l += 8; ll >>= 8;
5743 		}
5744 		if (ll & 0xf0) {
5745 			l += 4; ll >>= 4;
5746 		}
5747 		if (ll & 0xc) {
5748 			l += 2; ll >>= 2;
5749 		}
5750 		if (ll & 0x2)
5751 			l += 2;
5752 		else if (ll & 0x1)
5753 			l += 1;
5754 		*valp = l;
5755 		return (0);
5756 	}
5757 
5758 	if (cmd == _PC_ACL_ENABLED) {
5759 		*valp = _ACL_ACLENT_ENABLED;
5760 		return (0);
5761 	}
5762 
5763 	if (cmd == _PC_XATTR_EXISTS) {
5764 		error = 0;
5765 		*valp = 0;
5766 		if (vp->v_vfsp->vfs_flag & VFS_XATTR) {
5767 			vnode_t *avp;
5768 			rnode_t *rp;
5769 			int error = 0;
5770 			mntinfo_t *mi = VTOMI(vp);
5771 
5772 			if (!(mi->mi_flags & MI_EXTATTR))
5773 				return (0);
5774 
5775 			rp = VTOR(vp);
5776 			if (nfs_rw_enter_sig(&rp->r_rwlock, RW_READER,
5777 			    INTR(vp)))
5778 				return (EINTR);
5779 
5780 			error = nfs3lookup_dnlc(vp, XATTR_DIR_NAME, &avp, cr);
5781 			if (error || avp == NULL)
5782 				error = acl_getxattrdir3(vp, &avp, 0, cr, 0);
5783 
5784 			nfs_rw_exit(&rp->r_rwlock);
5785 
5786 			if (error == 0 && avp != NULL) {
5787 				error = do_xattr_exists_check(avp, valp, cr);
5788 				VN_RELE(avp);
5789 			} else if (error == ENOENT) {
5790 				error = 0;
5791 				*valp = 0;
5792 			}
5793 		}
5794 		return (error);
5795 	}
5796 
5797 	rp = VTOR(vp);
5798 	if (rp->r_pathconf != NULL) {
5799 		mutex_enter(&rp->r_statelock);
5800 		if (rp->r_pathconf != NULL && nfs3_pathconf_disable_cache) {
5801 			kmem_free(rp->r_pathconf, sizeof (*rp->r_pathconf));
5802 			rp->r_pathconf = NULL;
5803 		}
5804 		if (rp->r_pathconf != NULL) {
5805 			error = 0;
5806 			switch (cmd) {
5807 			case _PC_LINK_MAX:
5808 				*valp = rp->r_pathconf->link_max;
5809 				break;
5810 			case _PC_NAME_MAX:
5811 				*valp = rp->r_pathconf->name_max;
5812 				break;
5813 			case _PC_PATH_MAX:
5814 			case _PC_SYMLINK_MAX:
5815 				*valp = MAXPATHLEN;
5816 				break;
5817 			case _PC_CHOWN_RESTRICTED:
5818 				*valp = rp->r_pathconf->chown_restricted;
5819 				break;
5820 			case _PC_NO_TRUNC:
5821 				*valp = rp->r_pathconf->no_trunc;
5822 				break;
5823 			default:
5824 				error = EINVAL;
5825 				break;
5826 			}
5827 			mutex_exit(&rp->r_statelock);
5828 #ifdef DEBUG
5829 			nfs3_pathconf_cache_hits++;
5830 #endif
5831 			return (error);
5832 		}
5833 		mutex_exit(&rp->r_statelock);
5834 	}
5835 #ifdef DEBUG
5836 	nfs3_pathconf_cache_misses++;
5837 #endif
5838 
5839 	args.object = *VTOFH3(vp);
5840 	fi.vp = vp;
5841 	fi.fhp = (caddr_t)&args.object;
5842 	fi.copyproc = nfs3copyfh;
5843 	fi.lookupproc = nfs3lookup;
5844 	fi.xattrdirproc = acl_getxattrdir3;
5845 
5846 	douprintf = 1;
5847 
5848 	t = gethrtime();
5849 
5850 	error = rfs3call(VTOMI(vp), NFSPROC3_PATHCONF,
5851 	    xdr_nfs_fh3, (caddr_t)&args,
5852 	    xdr_PATHCONF3res, (caddr_t)&res, cr,
5853 	    &douprintf, &res.status, 0, &fi);
5854 
5855 	if (error)
5856 		return (error);
5857 
5858 	error = geterrno3(res.status);
5859 
5860 	if (!error) {
5861 		nfs3_cache_post_op_attr(vp, &res.resok.obj_attributes, t, cr);
5862 		if (!nfs3_pathconf_disable_cache) {
5863 			mutex_enter(&rp->r_statelock);
5864 			if (rp->r_pathconf == NULL) {
5865 				rp->r_pathconf = kmem_alloc(
5866 				    sizeof (*rp->r_pathconf), KM_NOSLEEP);
5867 				if (rp->r_pathconf != NULL)
5868 					*rp->r_pathconf = res.resok.info;
5869 			}
5870 			mutex_exit(&rp->r_statelock);
5871 		}
5872 		switch (cmd) {
5873 		case _PC_LINK_MAX:
5874 			*valp = res.resok.info.link_max;
5875 			break;
5876 		case _PC_NAME_MAX:
5877 			*valp = res.resok.info.name_max;
5878 			break;
5879 		case _PC_PATH_MAX:
5880 		case _PC_SYMLINK_MAX:
5881 			*valp = MAXPATHLEN;
5882 			break;
5883 		case _PC_CHOWN_RESTRICTED:
5884 			*valp = res.resok.info.chown_restricted;
5885 			break;
5886 		case _PC_NO_TRUNC:
5887 			*valp = res.resok.info.no_trunc;
5888 			break;
5889 		default:
5890 			return (EINVAL);
5891 		}
5892 	} else {
5893 		nfs3_cache_post_op_attr(vp, &res.resfail.obj_attributes, t, cr);
5894 		PURGE_STALE_FH(error, vp, cr);
5895 	}
5896 
5897 	return (error);
5898 }
5899 
5900 /*
5901  * Called by async thread to do synchronous pageio. Do the i/o, wait
5902  * for it to complete, and cleanup the page list when done.
5903  */
5904 static int
5905 nfs3_sync_pageio(vnode_t *vp, page_t *pp, u_offset_t io_off, size_t io_len,
5906 	int flags, cred_t *cr)
5907 {
5908 	int error;
5909 
5910 	ASSERT(nfs_zone() == VTOMI(vp)->mi_zone);
5911 	error = nfs3_rdwrlbn(vp, pp, io_off, io_len, flags, cr);
5912 	if (flags & B_READ)
5913 		pvn_read_done(pp, (error ? B_ERROR : 0) | flags);
5914 	else
5915 		pvn_write_done(pp, (error ? B_ERROR : 0) | flags);
5916 	return (error);
5917 }
5918 
5919 /* ARGSUSED */
5920 static int
5921 nfs3_pageio(vnode_t *vp, page_t *pp, u_offset_t io_off, size_t io_len,
5922 	int flags, cred_t *cr, caller_context_t *ct)
5923 {
5924 	int error;
5925 	rnode_t *rp;
5926 
5927 	if (pp == NULL)
5928 		return (EINVAL);
5929 	if (!(flags & B_ASYNC) && nfs_zone() != VTOMI(vp)->mi_zone)
5930 		return (EIO);
5931 
5932 	rp = VTOR(vp);
5933 	mutex_enter(&rp->r_statelock);
5934 	rp->r_count++;
5935 	mutex_exit(&rp->r_statelock);
5936 
5937 	if (flags & B_ASYNC) {
5938 		error = nfs_async_pageio(vp, pp, io_off, io_len, flags, cr,
5939 		    nfs3_sync_pageio);
5940 	} else
5941 		error = nfs3_rdwrlbn(vp, pp, io_off, io_len, flags, cr);
5942 	mutex_enter(&rp->r_statelock);
5943 	rp->r_count--;
5944 	cv_broadcast(&rp->r_cv);
5945 	mutex_exit(&rp->r_statelock);
5946 	return (error);
5947 }
5948 
5949 /* ARGSUSED */
5950 static void
5951 nfs3_dispose(vnode_t *vp, page_t *pp, int fl, int dn, cred_t *cr,
5952 	caller_context_t *ct)
5953 {
5954 	int error;
5955 	rnode_t *rp;
5956 	page_t *plist;
5957 	page_t *pptr;
5958 	offset3 offset;
5959 	count3 len;
5960 	k_sigset_t smask;
5961 
5962 	/*
5963 	 * We should get called with fl equal to either B_FREE or
5964 	 * B_INVAL.  Any other value is illegal.
5965 	 *
5966 	 * The page that we are either supposed to free or destroy
5967 	 * should be exclusive locked and its io lock should not
5968 	 * be held.
5969 	 */
5970 	ASSERT(fl == B_FREE || fl == B_INVAL);
5971 	ASSERT((PAGE_EXCL(pp) && !page_iolock_assert(pp)) || panicstr);
5972 	rp = VTOR(vp);
5973 
5974 	/*
5975 	 * If the page doesn't need to be committed or we shouldn't
5976 	 * even bother attempting to commit it, then just make sure
5977 	 * that the p_fsdata byte is clear and then either free or
5978 	 * destroy the page as appropriate.
5979 	 */
5980 	if (pp->p_fsdata == C_NOCOMMIT || (rp->r_flags & RSTALE)) {
5981 		pp->p_fsdata = C_NOCOMMIT;
5982 		if (fl == B_FREE)
5983 			page_free(pp, dn);
5984 		else
5985 			page_destroy(pp, dn);
5986 		return;
5987 	}
5988 
5989 	/*
5990 	 * If there is a page invalidation operation going on, then
5991 	 * if this is one of the pages being destroyed, then just
5992 	 * clear the p_fsdata byte and then either free or destroy
5993 	 * the page as appropriate.
5994 	 */
5995 	mutex_enter(&rp->r_statelock);
5996 	if ((rp->r_flags & RTRUNCATE) && pp->p_offset >= rp->r_truncaddr) {
5997 		mutex_exit(&rp->r_statelock);
5998 		pp->p_fsdata = C_NOCOMMIT;
5999 		if (fl == B_FREE)
6000 			page_free(pp, dn);
6001 		else
6002 			page_destroy(pp, dn);
6003 		return;
6004 	}
6005 
6006 	/*
6007 	 * If we are freeing this page and someone else is already
6008 	 * waiting to do a commit, then just unlock the page and
6009 	 * return.  That other thread will take care of commiting
6010 	 * this page.  The page can be freed sometime after the
6011 	 * commit has finished.  Otherwise, if the page is marked
6012 	 * as delay commit, then we may be getting called from
6013 	 * pvn_write_done, one page at a time.   This could result
6014 	 * in one commit per page, so we end up doing lots of small
6015 	 * commits instead of fewer larger commits.  This is bad,
6016 	 * we want do as few commits as possible.
6017 	 */
6018 	if (fl == B_FREE) {
6019 		if (rp->r_flags & RCOMMITWAIT) {
6020 			page_unlock(pp);
6021 			mutex_exit(&rp->r_statelock);
6022 			return;
6023 		}
6024 		if (pp->p_fsdata == C_DELAYCOMMIT) {
6025 			pp->p_fsdata = C_COMMIT;
6026 			page_unlock(pp);
6027 			mutex_exit(&rp->r_statelock);
6028 			return;
6029 		}
6030 	}
6031 
6032 	/*
6033 	 * Check to see if there is a signal which would prevent an
6034 	 * attempt to commit the pages from being successful.  If so,
6035 	 * then don't bother with all of the work to gather pages and
6036 	 * generate the unsuccessful RPC.  Just return from here and
6037 	 * let the page be committed at some later time.
6038 	 */
6039 	sigintr(&smask, VTOMI(vp)->mi_flags & MI_INT);
6040 	if (ttolwp(curthread) != NULL && ISSIG(curthread, JUSTLOOKING)) {
6041 		sigunintr(&smask);
6042 		page_unlock(pp);
6043 		mutex_exit(&rp->r_statelock);
6044 		return;
6045 	}
6046 	sigunintr(&smask);
6047 
6048 	/*
6049 	 * We are starting to need to commit pages, so let's try
6050 	 * to commit as many as possible at once to reduce the
6051 	 * overhead.
6052 	 *
6053 	 * Set the `commit inprogress' state bit.  We must
6054 	 * first wait until any current one finishes.  Then
6055 	 * we initialize the c_pages list with this page.
6056 	 */
6057 	while (rp->r_flags & RCOMMIT) {
6058 		rp->r_flags |= RCOMMITWAIT;
6059 		cv_wait(&rp->r_commit.c_cv, &rp->r_statelock);
6060 		rp->r_flags &= ~RCOMMITWAIT;
6061 	}
6062 	rp->r_flags |= RCOMMIT;
6063 	mutex_exit(&rp->r_statelock);
6064 	ASSERT(rp->r_commit.c_pages == NULL);
6065 	rp->r_commit.c_pages = pp;
6066 	rp->r_commit.c_commbase = (offset3)pp->p_offset;
6067 	rp->r_commit.c_commlen = PAGESIZE;
6068 
6069 	/*
6070 	 * Gather together all other pages which can be committed.
6071 	 * They will all be chained off r_commit.c_pages.
6072 	 */
6073 	nfs3_get_commit(vp);
6074 
6075 	/*
6076 	 * Clear the `commit inprogress' status and disconnect
6077 	 * the list of pages to be committed from the rnode.
6078 	 * At this same time, we also save the starting offset
6079 	 * and length of data to be committed on the server.
6080 	 */
6081 	plist = rp->r_commit.c_pages;
6082 	rp->r_commit.c_pages = NULL;
6083 	offset = rp->r_commit.c_commbase;
6084 	len = rp->r_commit.c_commlen;
6085 	mutex_enter(&rp->r_statelock);
6086 	rp->r_flags &= ~RCOMMIT;
6087 	cv_broadcast(&rp->r_commit.c_cv);
6088 	mutex_exit(&rp->r_statelock);
6089 
6090 	if (curproc == proc_pageout || curproc == proc_fsflush ||
6091 	    nfs_zone() != VTOMI(vp)->mi_zone) {
6092 		nfs_async_commit(vp, plist, offset, len, cr, nfs3_async_commit);
6093 		return;
6094 	}
6095 
6096 	/*
6097 	 * Actually generate the COMMIT3 over the wire operation.
6098 	 */
6099 	error = nfs3_commit(vp, offset, len, cr);
6100 
6101 	/*
6102 	 * If we got an error during the commit, just unlock all
6103 	 * of the pages.  The pages will get retransmitted to the
6104 	 * server during a putpage operation.
6105 	 */
6106 	if (error) {
6107 		while (plist != NULL) {
6108 			pptr = plist;
6109 			page_sub(&plist, pptr);
6110 			page_unlock(pptr);
6111 		}
6112 		return;
6113 	}
6114 
6115 	/*
6116 	 * We've tried as hard as we can to commit the data to stable
6117 	 * storage on the server.  We release the rest of the pages
6118 	 * and clear the commit required state.  They will be put
6119 	 * onto the tail of the cachelist if they are nolonger
6120 	 * mapped.
6121 	 */
6122 	while (plist != pp) {
6123 		pptr = plist;
6124 		page_sub(&plist, pptr);
6125 		pptr->p_fsdata = C_NOCOMMIT;
6126 		(void) page_release(pptr, 1);
6127 	}
6128 
6129 	/*
6130 	 * It is possible that nfs3_commit didn't return error but
6131 	 * some other thread has modified the page we are going
6132 	 * to free/destroy.
6133 	 *    In this case we need to rewrite the page. Do an explicit check
6134 	 * before attempting to free/destroy the page. If modified, needs to
6135 	 * be rewritten so unlock the page and return.
6136 	 */
6137 	if (hat_ismod(pp)) {
6138 		pp->p_fsdata = C_NOCOMMIT;
6139 		page_unlock(pp);
6140 		return;
6141 	}
6142 
6143 	/*
6144 	 * Now, as appropriate, either free or destroy the page
6145 	 * that we were called with.
6146 	 */
6147 	pp->p_fsdata = C_NOCOMMIT;
6148 	if (fl == B_FREE)
6149 		page_free(pp, dn);
6150 	else
6151 		page_destroy(pp, dn);
6152 }
6153 
6154 static int
6155 nfs3_commit(vnode_t *vp, offset3 offset, count3 count, cred_t *cr)
6156 {
6157 	int error;
6158 	rnode_t *rp;
6159 	COMMIT3args args;
6160 	COMMIT3res res;
6161 	int douprintf;
6162 	cred_t *cred;
6163 
6164 	rp = VTOR(vp);
6165 	ASSERT(nfs_zone() == VTOMI(vp)->mi_zone);
6166 
6167 	mutex_enter(&rp->r_statelock);
6168 	if (rp->r_cred != NULL) {
6169 		cred = rp->r_cred;
6170 		crhold(cred);
6171 	} else {
6172 		rp->r_cred = cr;
6173 		crhold(cr);
6174 		cred = cr;
6175 		crhold(cred);
6176 	}
6177 	mutex_exit(&rp->r_statelock);
6178 
6179 	args.file = *VTOFH3(vp);
6180 	args.offset = offset;
6181 	args.count = count;
6182 
6183 doitagain:
6184 	douprintf = 1;
6185 	error = rfs3call(VTOMI(vp), NFSPROC3_COMMIT,
6186 	    xdr_COMMIT3args, (caddr_t)&args,
6187 	    xdr_COMMIT3res, (caddr_t)&res, cred,
6188 	    &douprintf, &res.status, 0, NULL);
6189 
6190 	crfree(cred);
6191 
6192 	if (error)
6193 		return (error);
6194 
6195 	error = geterrno3(res.status);
6196 	if (!error) {
6197 		ASSERT(rp->r_flags & RHAVEVERF);
6198 		mutex_enter(&rp->r_statelock);
6199 		if (rp->r_verf == res.resok.verf) {
6200 			mutex_exit(&rp->r_statelock);
6201 			return (0);
6202 		}
6203 		nfs3_set_mod(vp);
6204 		rp->r_verf = res.resok.verf;
6205 		mutex_exit(&rp->r_statelock);
6206 		error = NFS_VERF_MISMATCH;
6207 	} else {
6208 		if (error == EACCES) {
6209 			mutex_enter(&rp->r_statelock);
6210 			if (cred != cr) {
6211 				if (rp->r_cred != NULL)
6212 					crfree(rp->r_cred);
6213 				rp->r_cred = cr;
6214 				crhold(cr);
6215 				cred = cr;
6216 				crhold(cred);
6217 				mutex_exit(&rp->r_statelock);
6218 				goto doitagain;
6219 			}
6220 			mutex_exit(&rp->r_statelock);
6221 		}
6222 		/*
6223 		 * Can't do a PURGE_STALE_FH here because this
6224 		 * can cause a deadlock.  nfs3_commit can
6225 		 * be called from nfs3_dispose which can be called
6226 		 * indirectly via pvn_vplist_dirty.  PURGE_STALE_FH
6227 		 * can call back to pvn_vplist_dirty.
6228 		 */
6229 		if (error == ESTALE) {
6230 			mutex_enter(&rp->r_statelock);
6231 			rp->r_flags |= RSTALE;
6232 			if (!rp->r_error)
6233 				rp->r_error = error;
6234 			mutex_exit(&rp->r_statelock);
6235 			PURGE_ATTRCACHE(vp);
6236 		} else {
6237 			mutex_enter(&rp->r_statelock);
6238 			if (!rp->r_error)
6239 				rp->r_error = error;
6240 			mutex_exit(&rp->r_statelock);
6241 		}
6242 	}
6243 
6244 	return (error);
6245 }
6246 
6247 static void
6248 nfs3_set_mod(vnode_t *vp)
6249 {
6250 	ASSERT(nfs_zone() == VTOMI(vp)->mi_zone);
6251 
6252 	pvn_vplist_setdirty(vp, nfs_setmod_check);
6253 }
6254 
6255 /*
6256  * This routine is used to gather together a page list of the pages
6257  * which are to be committed on the server.  This routine must not
6258  * be called if the calling thread holds any locked pages.
6259  *
6260  * The calling thread must have set RCOMMIT.  This bit is used to
6261  * serialize access to the commit structure in the rnode.  As long
6262  * as the thread has set RCOMMIT, then it can manipulate the commit
6263  * structure without requiring any other locks.
6264  */
6265 static void
6266 nfs3_get_commit(vnode_t *vp)
6267 {
6268 	rnode_t *rp;
6269 	page_t *pp;
6270 	kmutex_t *vphm;
6271 
6272 	rp = VTOR(vp);
6273 
6274 	ASSERT(rp->r_flags & RCOMMIT);
6275 
6276 	vphm = page_vnode_mutex(vp);
6277 	mutex_enter(vphm);
6278 
6279 	/*
6280 	 * If there are no pages associated with this vnode, then
6281 	 * just return.
6282 	 */
6283 	if ((pp = vp->v_pages) == NULL) {
6284 		mutex_exit(vphm);
6285 		return;
6286 	}
6287 
6288 	/*
6289 	 * Step through all of the pages associated with this vnode
6290 	 * looking for pages which need to be committed.
6291 	 */
6292 	do {
6293 		/* Skip marker pages. */
6294 		if (pp->p_hash == PVN_VPLIST_HASH_TAG)
6295 			continue;
6296 
6297 		/*
6298 		 * If this page does not need to be committed or is
6299 		 * modified, then just skip it.
6300 		 */
6301 		if (pp->p_fsdata == C_NOCOMMIT || hat_ismod(pp))
6302 			continue;
6303 
6304 		/*
6305 		 * Attempt to lock the page.  If we can't, then
6306 		 * someone else is messing with it and we will
6307 		 * just skip it.
6308 		 */
6309 		if (!page_trylock(pp, SE_EXCL))
6310 			continue;
6311 
6312 		/*
6313 		 * If this page does not need to be committed or is
6314 		 * modified, then just skip it.  Recheck now that
6315 		 * the page is locked.
6316 		 */
6317 		if (pp->p_fsdata == C_NOCOMMIT || hat_ismod(pp)) {
6318 			page_unlock(pp);
6319 			continue;
6320 		}
6321 
6322 		if (PP_ISFREE(pp)) {
6323 			cmn_err(CE_PANIC, "nfs3_get_commit: %p is free",
6324 			    (void *)pp);
6325 		}
6326 
6327 		/*
6328 		 * The page needs to be committed and we locked it.
6329 		 * Update the base and length parameters and add it
6330 		 * to r_pages.
6331 		 */
6332 		if (rp->r_commit.c_pages == NULL) {
6333 			rp->r_commit.c_commbase = (offset3)pp->p_offset;
6334 			rp->r_commit.c_commlen = PAGESIZE;
6335 		} else if (pp->p_offset < rp->r_commit.c_commbase) {
6336 			rp->r_commit.c_commlen = rp->r_commit.c_commbase -
6337 			    (offset3)pp->p_offset + rp->r_commit.c_commlen;
6338 			rp->r_commit.c_commbase = (offset3)pp->p_offset;
6339 		} else if ((rp->r_commit.c_commbase + rp->r_commit.c_commlen)
6340 		    <= pp->p_offset) {
6341 			rp->r_commit.c_commlen = (offset3)pp->p_offset -
6342 			    rp->r_commit.c_commbase + PAGESIZE;
6343 		}
6344 		page_add(&rp->r_commit.c_pages, pp);
6345 	} while ((pp = pp->p_vpnext) != vp->v_pages);
6346 
6347 	mutex_exit(vphm);
6348 }
6349 
6350 /*
6351  * This routine is used to gather together a page list of the pages
6352  * which are to be committed on the server.  This routine must not
6353  * be called if the calling thread holds any locked pages.
6354  *
6355  * The calling thread must have set RCOMMIT.  This bit is used to
6356  * serialize access to the commit structure in the rnode.  As long
6357  * as the thread has set RCOMMIT, then it can manipulate the commit
6358  * structure without requiring any other locks.
6359  */
6360 static void
6361 nfs3_get_commit_range(vnode_t *vp, u_offset_t soff, size_t len)
6362 {
6363 
6364 	rnode_t *rp;
6365 	page_t *pp;
6366 	u_offset_t end;
6367 	u_offset_t off;
6368 
6369 	ASSERT(len != 0);
6370 
6371 	rp = VTOR(vp);
6372 
6373 	ASSERT(rp->r_flags & RCOMMIT);
6374 	ASSERT(nfs_zone() == VTOMI(vp)->mi_zone);
6375 
6376 	/*
6377 	 * If there are no pages associated with this vnode, then
6378 	 * just return.
6379 	 */
6380 	if ((pp = vp->v_pages) == NULL)
6381 		return;
6382 
6383 	/*
6384 	 * Calculate the ending offset.
6385 	 */
6386 	end = soff + len;
6387 
6388 	for (off = soff; off < end; off += PAGESIZE) {
6389 		/*
6390 		 * Lookup each page by vp, offset.
6391 		 */
6392 		if ((pp = page_lookup_nowait(vp, off, SE_EXCL)) == NULL)
6393 			continue;
6394 
6395 		/*
6396 		 * If this page does not need to be committed or is
6397 		 * modified, then just skip it.
6398 		 */
6399 		if (pp->p_fsdata == C_NOCOMMIT || hat_ismod(pp)) {
6400 			page_unlock(pp);
6401 			continue;
6402 		}
6403 
6404 		ASSERT(PP_ISFREE(pp) == 0);
6405 
6406 		/*
6407 		 * The page needs to be committed and we locked it.
6408 		 * Update the base and length parameters and add it
6409 		 * to r_pages.
6410 		 */
6411 		if (rp->r_commit.c_pages == NULL) {
6412 			rp->r_commit.c_commbase = (offset3)pp->p_offset;
6413 			rp->r_commit.c_commlen = PAGESIZE;
6414 		} else {
6415 			rp->r_commit.c_commlen = (offset3)pp->p_offset -
6416 			    rp->r_commit.c_commbase + PAGESIZE;
6417 		}
6418 		page_add(&rp->r_commit.c_pages, pp);
6419 	}
6420 }
6421 
6422 static int
6423 nfs3_putpage_commit(vnode_t *vp, offset_t poff, size_t plen, cred_t *cr)
6424 {
6425 	int error;
6426 	writeverf3 write_verf;
6427 	rnode_t *rp = VTOR(vp);
6428 
6429 	ASSERT(nfs_zone() == VTOMI(vp)->mi_zone);
6430 	/*
6431 	 * Flush the data portion of the file and then commit any
6432 	 * portions which need to be committed.  This may need to
6433 	 * be done twice if the server has changed state since
6434 	 * data was last written.  The data will need to be
6435 	 * rewritten to the server and then a new commit done.
6436 	 *
6437 	 * In fact, this may need to be done several times if the
6438 	 * server is having problems and crashing while we are
6439 	 * attempting to do this.
6440 	 */
6441 
6442 top:
6443 	/*
6444 	 * Do a flush based on the poff and plen arguments.  This
6445 	 * will asynchronously write out any modified pages in the
6446 	 * range specified by (poff, plen).  This starts all of the
6447 	 * i/o operations which will be waited for in the next
6448 	 * call to nfs3_putpage
6449 	 */
6450 
6451 	mutex_enter(&rp->r_statelock);
6452 	write_verf = rp->r_verf;
6453 	mutex_exit(&rp->r_statelock);
6454 
6455 	error = nfs3_putpage(vp, poff, plen, B_ASYNC, cr, NULL);
6456 	if (error == EAGAIN)
6457 		error = 0;
6458 
6459 	/*
6460 	 * Do a flush based on the poff and plen arguments.  This
6461 	 * will synchronously write out any modified pages in the
6462 	 * range specified by (poff, plen) and wait until all of
6463 	 * the asynchronous i/o's in that range are done as well.
6464 	 */
6465 	if (!error)
6466 		error = nfs3_putpage(vp, poff, plen, 0, cr, NULL);
6467 
6468 	if (error)
6469 		return (error);
6470 
6471 	mutex_enter(&rp->r_statelock);
6472 	if (rp->r_verf != write_verf) {
6473 		mutex_exit(&rp->r_statelock);
6474 		goto top;
6475 	}
6476 	mutex_exit(&rp->r_statelock);
6477 
6478 	/*
6479 	 * Now commit any pages which might need to be committed.
6480 	 * If the error, NFS_VERF_MISMATCH, is returned, then
6481 	 * start over with the flush operation.
6482 	 */
6483 
6484 	error = nfs3_commit_vp(vp, poff, plen, cr);
6485 
6486 	if (error == NFS_VERF_MISMATCH)
6487 		goto top;
6488 
6489 	return (error);
6490 }
6491 
6492 static int
6493 nfs3_commit_vp(vnode_t *vp, u_offset_t poff, size_t plen, cred_t *cr)
6494 {
6495 	rnode_t *rp;
6496 	page_t *plist;
6497 	offset3 offset;
6498 	count3 len;
6499 
6500 
6501 	rp = VTOR(vp);
6502 
6503 	if (nfs_zone() != VTOMI(vp)->mi_zone)
6504 		return (EIO);
6505 	/*
6506 	 * Set the `commit inprogress' state bit.  We must
6507 	 * first wait until any current one finishes.
6508 	 */
6509 	mutex_enter(&rp->r_statelock);
6510 	while (rp->r_flags & RCOMMIT) {
6511 		rp->r_flags |= RCOMMITWAIT;
6512 		cv_wait(&rp->r_commit.c_cv, &rp->r_statelock);
6513 		rp->r_flags &= ~RCOMMITWAIT;
6514 	}
6515 	rp->r_flags |= RCOMMIT;
6516 	mutex_exit(&rp->r_statelock);
6517 
6518 	/*
6519 	 * Gather together all of the pages which need to be
6520 	 * committed.
6521 	 */
6522 	if (plen == 0)
6523 		nfs3_get_commit(vp);
6524 	else
6525 		nfs3_get_commit_range(vp, poff, plen);
6526 
6527 	/*
6528 	 * Clear the `commit inprogress' bit and disconnect the
6529 	 * page list which was gathered together in nfs3_get_commit.
6530 	 */
6531 	plist = rp->r_commit.c_pages;
6532 	rp->r_commit.c_pages = NULL;
6533 	offset = rp->r_commit.c_commbase;
6534 	len = rp->r_commit.c_commlen;
6535 	mutex_enter(&rp->r_statelock);
6536 	rp->r_flags &= ~RCOMMIT;
6537 	cv_broadcast(&rp->r_commit.c_cv);
6538 	mutex_exit(&rp->r_statelock);
6539 
6540 	/*
6541 	 * If any pages need to be committed, commit them and
6542 	 * then unlock them so that they can be freed some
6543 	 * time later.
6544 	 */
6545 	if (plist != NULL) {
6546 		/*
6547 		 * No error occurred during the flush portion
6548 		 * of this operation, so now attempt to commit
6549 		 * the data to stable storage on the server.
6550 		 *
6551 		 * This will unlock all of the pages on the list.
6552 		 */
6553 		return (nfs3_sync_commit(vp, plist, offset, len, cr));
6554 	}
6555 	return (0);
6556 }
6557 
6558 static int
6559 nfs3_sync_commit(vnode_t *vp, page_t *plist, offset3 offset, count3 count,
6560 	cred_t *cr)
6561 {
6562 	int error;
6563 	page_t *pp;
6564 
6565 	ASSERT(nfs_zone() == VTOMI(vp)->mi_zone);
6566 	error = nfs3_commit(vp, offset, count, cr);
6567 
6568 	/*
6569 	 * If we got an error, then just unlock all of the pages
6570 	 * on the list.
6571 	 */
6572 	if (error) {
6573 		while (plist != NULL) {
6574 			pp = plist;
6575 			page_sub(&plist, pp);
6576 			page_unlock(pp);
6577 		}
6578 		return (error);
6579 	}
6580 	/*
6581 	 * We've tried as hard as we can to commit the data to stable
6582 	 * storage on the server.  We just unlock the pages and clear
6583 	 * the commit required state.  They will get freed later.
6584 	 */
6585 	while (plist != NULL) {
6586 		pp = plist;
6587 		page_sub(&plist, pp);
6588 		pp->p_fsdata = C_NOCOMMIT;
6589 		page_unlock(pp);
6590 	}
6591 
6592 	return (error);
6593 }
6594 
6595 static void
6596 nfs3_async_commit(vnode_t *vp, page_t *plist, offset3 offset, count3 count,
6597 	cred_t *cr)
6598 {
6599 	ASSERT(nfs_zone() == VTOMI(vp)->mi_zone);
6600 	(void) nfs3_sync_commit(vp, plist, offset, count, cr);
6601 }
6602 
6603 /* ARGSUSED */
6604 static int
6605 nfs3_setsecattr(vnode_t *vp, vsecattr_t *vsecattr, int flag, cred_t *cr,
6606 	caller_context_t *ct)
6607 {
6608 	int error;
6609 	mntinfo_t *mi;
6610 
6611 	mi = VTOMI(vp);
6612 
6613 	if (nfs_zone() != mi->mi_zone)
6614 		return (EIO);
6615 
6616 	if (mi->mi_flags & MI_ACL) {
6617 		error = acl_setacl3(vp, vsecattr, flag, cr);
6618 		if (mi->mi_flags & MI_ACL)
6619 			return (error);
6620 	}
6621 
6622 	return (ENOSYS);
6623 }
6624 
6625 /* ARGSUSED */
6626 static int
6627 nfs3_getsecattr(vnode_t *vp, vsecattr_t *vsecattr, int flag, cred_t *cr,
6628 	caller_context_t *ct)
6629 {
6630 	int error;
6631 	mntinfo_t *mi;
6632 
6633 	mi = VTOMI(vp);
6634 
6635 	if (nfs_zone() != mi->mi_zone)
6636 		return (EIO);
6637 
6638 	if (mi->mi_flags & MI_ACL) {
6639 		error = acl_getacl3(vp, vsecattr, flag, cr);
6640 		if (mi->mi_flags & MI_ACL)
6641 			return (error);
6642 	}
6643 
6644 	return (fs_fab_acl(vp, vsecattr, flag, cr, ct));
6645 }
6646 
6647 /* ARGSUSED */
6648 static int
6649 nfs3_shrlock(vnode_t *vp, int cmd, struct shrlock *shr, int flag, cred_t *cr,
6650 	caller_context_t *ct)
6651 {
6652 	int error;
6653 	struct shrlock nshr;
6654 	struct nfs_owner nfs_owner;
6655 	netobj lm_fh3;
6656 
6657 	if (nfs_zone() != VTOMI(vp)->mi_zone)
6658 		return (EIO);
6659 
6660 	/*
6661 	 * check for valid cmd parameter
6662 	 */
6663 	if (cmd != F_SHARE && cmd != F_UNSHARE && cmd != F_HASREMOTELOCKS)
6664 		return (EINVAL);
6665 
6666 	/*
6667 	 * Check access permissions
6668 	 */
6669 	if (cmd == F_SHARE &&
6670 	    (((shr->s_access & F_RDACC) && !(flag & FREAD)) ||
6671 	    ((shr->s_access & F_WRACC) && !(flag & FWRITE))))
6672 		return (EBADF);
6673 
6674 	/*
6675 	 * If the filesystem is mounted using local locking, pass the
6676 	 * request off to the local share code.
6677 	 */
6678 	if (VTOMI(vp)->mi_flags & MI_LLOCK)
6679 		return (fs_shrlock(vp, cmd, shr, flag, cr, ct));
6680 
6681 	switch (cmd) {
6682 	case F_SHARE:
6683 	case F_UNSHARE:
6684 		lm_fh3.n_len = VTOFH3(vp)->fh3_length;
6685 		lm_fh3.n_bytes = (char *)&(VTOFH3(vp)->fh3_u.data);
6686 
6687 		/*
6688 		 * If passed an owner that is too large to fit in an
6689 		 * nfs_owner it is likely a recursive call from the
6690 		 * lock manager client and pass it straight through.  If
6691 		 * it is not a nfs_owner then simply return an error.
6692 		 */
6693 		if (shr->s_own_len > sizeof (nfs_owner.lowner)) {
6694 			if (((struct nfs_owner *)shr->s_owner)->magic !=
6695 			    NFS_OWNER_MAGIC)
6696 				return (EINVAL);
6697 
6698 			if (error = lm4_shrlock(vp, cmd, shr, flag, &lm_fh3)) {
6699 				error = set_errno(error);
6700 			}
6701 			return (error);
6702 		}
6703 		/*
6704 		 * Remote share reservations owner is a combination of
6705 		 * a magic number, hostname, and the local owner
6706 		 */
6707 		bzero(&nfs_owner, sizeof (nfs_owner));
6708 		nfs_owner.magic = NFS_OWNER_MAGIC;
6709 		(void) strncpy(nfs_owner.hname, uts_nodename(),
6710 		    sizeof (nfs_owner.hname));
6711 		bcopy(shr->s_owner, nfs_owner.lowner, shr->s_own_len);
6712 		nshr.s_access = shr->s_access;
6713 		nshr.s_deny = shr->s_deny;
6714 		nshr.s_sysid = 0;
6715 		nshr.s_pid = ttoproc(curthread)->p_pid;
6716 		nshr.s_own_len = sizeof (nfs_owner);
6717 		nshr.s_owner = (caddr_t)&nfs_owner;
6718 
6719 		if (error = lm4_shrlock(vp, cmd, &nshr, flag, &lm_fh3)) {
6720 			error = set_errno(error);
6721 		}
6722 
6723 		break;
6724 
6725 	case F_HASREMOTELOCKS:
6726 		/*
6727 		 * NFS client can't store remote locks itself
6728 		 */
6729 		shr->s_access = 0;
6730 		error = 0;
6731 		break;
6732 
6733 	default:
6734 		error = EINVAL;
6735 		break;
6736 	}
6737 
6738 	return (error);
6739 }
6740