xref: /illumos-gate/usr/src/uts/common/fs/nfs/nfs3_vnops.c (revision bc37da3a)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 /*
22  * Copyright 2007 Sun Microsystems, Inc.  All rights reserved.
23  * Use is subject to license terms.
24  */
25 
26 /*
27  *	Copyright (c) 1983,1984,1985,1986,1987,1988,1989 AT&T.
28  *	All rights reserved.
29  */
30 
31 #pragma ident	"%Z%%M%	%I%	%E% SMI"
32 
33 #include <sys/param.h>
34 #include <sys/types.h>
35 #include <sys/systm.h>
36 #include <sys/cred.h>
37 #include <sys/time.h>
38 #include <sys/vnode.h>
39 #include <sys/vfs.h>
40 #include <sys/vfs_opreg.h>
41 #include <sys/file.h>
42 #include <sys/filio.h>
43 #include <sys/uio.h>
44 #include <sys/buf.h>
45 #include <sys/mman.h>
46 #include <sys/pathname.h>
47 #include <sys/dirent.h>
48 #include <sys/debug.h>
49 #include <sys/vmsystm.h>
50 #include <sys/fcntl.h>
51 #include <sys/flock.h>
52 #include <sys/swap.h>
53 #include <sys/errno.h>
54 #include <sys/strsubr.h>
55 #include <sys/sysmacros.h>
56 #include <sys/kmem.h>
57 #include <sys/cmn_err.h>
58 #include <sys/pathconf.h>
59 #include <sys/utsname.h>
60 #include <sys/dnlc.h>
61 #include <sys/acl.h>
62 #include <sys/systeminfo.h>
63 #include <sys/atomic.h>
64 #include <sys/policy.h>
65 #include <sys/sdt.h>
66 
67 #include <rpc/types.h>
68 #include <rpc/auth.h>
69 #include <rpc/clnt.h>
70 
71 #include <nfs/nfs.h>
72 #include <nfs/nfs_clnt.h>
73 #include <nfs/rnode.h>
74 #include <nfs/nfs_acl.h>
75 #include <nfs/lm.h>
76 
77 #include <vm/hat.h>
78 #include <vm/as.h>
79 #include <vm/page.h>
80 #include <vm/pvn.h>
81 #include <vm/seg.h>
82 #include <vm/seg_map.h>
83 #include <vm/seg_kpm.h>
84 #include <vm/seg_vn.h>
85 
86 #include <fs/fs_subr.h>
87 
88 #include <sys/ddi.h>
89 
90 static int	nfs3_rdwrlbn(vnode_t *, page_t *, u_offset_t, size_t, int,
91 			cred_t *);
92 static int	nfs3write(vnode_t *, caddr_t, u_offset_t, int, cred_t *,
93 			stable_how *);
94 static int	nfs3read(vnode_t *, caddr_t, offset_t, int, size_t *, cred_t *);
95 static int	nfs3setattr(vnode_t *, struct vattr *, int, cred_t *);
96 static int	nfs3_accessx(void *, int, cred_t *);
97 static int	nfs3lookup_dnlc(vnode_t *, char *, vnode_t **, cred_t *);
98 static int	nfs3lookup_otw(vnode_t *, char *, vnode_t **, cred_t *, int);
99 static int	nfs3create(vnode_t *, char *, struct vattr *, enum vcexcl,
100 			int, vnode_t **, cred_t *, int);
101 static int	nfs3excl_create_settimes(vnode_t *, struct vattr *, cred_t *);
102 static int	nfs3mknod(vnode_t *, char *, struct vattr *, enum vcexcl,
103 			int, vnode_t **, cred_t *);
104 static int	nfs3rename(vnode_t *, char *, vnode_t *, char *, cred_t *,
105 			caller_context_t *);
106 static int	do_nfs3readdir(vnode_t *, rddir_cache *, cred_t *);
107 static void	nfs3readdir(vnode_t *, rddir_cache *, cred_t *);
108 static void	nfs3readdirplus(vnode_t *, rddir_cache *, cred_t *);
109 static int	nfs3_bio(struct buf *, stable_how *, cred_t *);
110 static int	nfs3_getapage(vnode_t *, u_offset_t, size_t, uint_t *,
111 			page_t *[], size_t, struct seg *, caddr_t,
112 			enum seg_rw, cred_t *);
113 static void	nfs3_readahead(vnode_t *, u_offset_t, caddr_t, struct seg *,
114 			cred_t *);
115 static int	nfs3_sync_putapage(vnode_t *, page_t *, u_offset_t, size_t,
116 			int, cred_t *);
117 static int	nfs3_sync_pageio(vnode_t *, page_t *, u_offset_t, size_t,
118 			int, cred_t *);
119 static int	nfs3_commit(vnode_t *, offset3, count3, cred_t *);
120 static void	nfs3_set_mod(vnode_t *);
121 static void	nfs3_get_commit(vnode_t *);
122 static void	nfs3_get_commit_range(vnode_t *, u_offset_t, size_t);
123 #if 0 /* unused */
124 #ifdef DEBUG
125 static int	nfs3_no_uncommitted_pages(vnode_t *);
126 #endif
127 #endif /* unused */
128 static int	nfs3_putpage_commit(vnode_t *, offset_t, size_t, cred_t *);
129 static int	nfs3_commit_vp(vnode_t *, u_offset_t, size_t,  cred_t *);
130 static int	nfs3_sync_commit(vnode_t *, page_t *, offset3, count3,
131 			cred_t *);
132 static void	nfs3_async_commit(vnode_t *, page_t *, offset3, count3,
133 			cred_t *);
134 static void	nfs3_delmap_callback(struct as *, void *, uint_t);
135 
136 /*
137  * Error flags used to pass information about certain special errors
138  * which need to be handled specially.
139  */
140 #define	NFS_EOF			-98
141 #define	NFS_VERF_MISMATCH	-97
142 
143 /* ALIGN64 aligns the given buffer and adjust buffer size to 64 bit */
144 #define	ALIGN64(x, ptr, sz)						\
145 	x = ((uintptr_t)(ptr)) & (sizeof (uint64_t) - 1);		\
146 	if (x) {							\
147 		x = sizeof (uint64_t) - (x);				\
148 		sz -= (x);						\
149 		ptr += (x);						\
150 	}
151 
152 /*
153  * These are the vnode ops routines which implement the vnode interface to
154  * the networked file system.  These routines just take their parameters,
155  * make them look networkish by putting the right info into interface structs,
156  * and then calling the appropriate remote routine(s) to do the work.
157  *
158  * Note on directory name lookup cacheing:  If we detect a stale fhandle,
159  * we purge the directory cache relative to that vnode.  This way, the
160  * user won't get burned by the cache repeatedly.  See <nfs/rnode.h> for
161  * more details on rnode locking.
162  */
163 
164 static int	nfs3_open(vnode_t **, int, cred_t *, caller_context_t *);
165 static int	nfs3_close(vnode_t *, int, int, offset_t, cred_t *,
166 			caller_context_t *);
167 static int	nfs3_read(vnode_t *, struct uio *, int, cred_t *,
168 			caller_context_t *);
169 static int	nfs3_write(vnode_t *, struct uio *, int, cred_t *,
170 			caller_context_t *);
171 static int	nfs3_ioctl(vnode_t *, int, intptr_t, int, cred_t *, int *,
172 			caller_context_t *);
173 static int	nfs3_getattr(vnode_t *, struct vattr *, int, cred_t *,
174 			caller_context_t *);
175 static int	nfs3_setattr(vnode_t *, struct vattr *, int, cred_t *,
176 			caller_context_t *);
177 static int	nfs3_access(vnode_t *, int, int, cred_t *, caller_context_t *);
178 static int	nfs3_readlink(vnode_t *, struct uio *, cred_t *,
179 			caller_context_t *);
180 static int	nfs3_fsync(vnode_t *, int, cred_t *, caller_context_t *);
181 static void	nfs3_inactive(vnode_t *, cred_t *, caller_context_t *);
182 static int	nfs3_lookup(vnode_t *, char *, vnode_t **,
183 			struct pathname *, int, vnode_t *, cred_t *,
184 			caller_context_t *, int *, pathname_t *);
185 static int	nfs3_create(vnode_t *, char *, struct vattr *, enum vcexcl,
186 			int, vnode_t **, cred_t *, int, caller_context_t *,
187 			vsecattr_t *);
188 static int	nfs3_remove(vnode_t *, char *, cred_t *, caller_context_t *,
189 			int);
190 static int	nfs3_link(vnode_t *, vnode_t *, char *, cred_t *,
191 			caller_context_t *, int);
192 static int	nfs3_rename(vnode_t *, char *, vnode_t *, char *, cred_t *,
193 			caller_context_t *, int);
194 static int	nfs3_mkdir(vnode_t *, char *, struct vattr *, vnode_t **,
195 			cred_t *, caller_context_t *, int, vsecattr_t *);
196 static int	nfs3_rmdir(vnode_t *, char *, vnode_t *, cred_t *,
197 			caller_context_t *, int);
198 static int	nfs3_symlink(vnode_t *, char *, struct vattr *, char *,
199 			cred_t *, caller_context_t *, int);
200 static int	nfs3_readdir(vnode_t *, struct uio *, cred_t *, int *,
201 			caller_context_t *, int);
202 static int	nfs3_fid(vnode_t *, fid_t *, caller_context_t *);
203 static int	nfs3_rwlock(vnode_t *, int, caller_context_t *);
204 static void	nfs3_rwunlock(vnode_t *, int, caller_context_t *);
205 static int	nfs3_seek(vnode_t *, offset_t, offset_t *, caller_context_t *);
206 static int	nfs3_getpage(vnode_t *, offset_t, size_t, uint_t *,
207 			page_t *[], size_t, struct seg *, caddr_t,
208 			enum seg_rw, cred_t *, caller_context_t *);
209 static int	nfs3_putpage(vnode_t *, offset_t, size_t, int, cred_t *,
210 			caller_context_t *);
211 static int	nfs3_map(vnode_t *, offset_t, struct as *, caddr_t *, size_t,
212 			uchar_t, uchar_t, uint_t, cred_t *, caller_context_t *);
213 static int	nfs3_addmap(vnode_t *, offset_t, struct as *, caddr_t, size_t,
214 			uchar_t, uchar_t, uint_t, cred_t *, caller_context_t *);
215 static int	nfs3_frlock(vnode_t *, int, struct flock64 *, int, offset_t,
216 			struct flk_callback *, cred_t *, caller_context_t *);
217 static int	nfs3_space(vnode_t *, int, struct flock64 *, int, offset_t,
218 			cred_t *, caller_context_t *);
219 static int	nfs3_realvp(vnode_t *, vnode_t **, caller_context_t *);
220 static int	nfs3_delmap(vnode_t *, offset_t, struct as *, caddr_t, size_t,
221 			uint_t, uint_t, uint_t, cred_t *, caller_context_t *);
222 static int	nfs3_pathconf(vnode_t *, int, ulong_t *, cred_t *,
223 			caller_context_t *);
224 static int	nfs3_pageio(vnode_t *, page_t *, u_offset_t, size_t, int,
225 			cred_t *, caller_context_t *);
226 static void	nfs3_dispose(vnode_t *, page_t *, int, int, cred_t *,
227 			caller_context_t *);
228 static int	nfs3_setsecattr(vnode_t *, vsecattr_t *, int, cred_t *,
229 			caller_context_t *);
230 static int	nfs3_getsecattr(vnode_t *, vsecattr_t *, int, cred_t *,
231 			caller_context_t *);
232 static int	nfs3_shrlock(vnode_t *, int, struct shrlock *, int, cred_t *,
233 			caller_context_t *);
234 
235 struct vnodeops *nfs3_vnodeops;
236 
237 const fs_operation_def_t nfs3_vnodeops_template[] = {
238 	VOPNAME_OPEN,		{ .vop_open = nfs3_open },
239 	VOPNAME_CLOSE,		{ .vop_close = nfs3_close },
240 	VOPNAME_READ,		{ .vop_read = nfs3_read },
241 	VOPNAME_WRITE,		{ .vop_write = nfs3_write },
242 	VOPNAME_IOCTL,		{ .vop_ioctl = nfs3_ioctl },
243 	VOPNAME_GETATTR,	{ .vop_getattr = nfs3_getattr },
244 	VOPNAME_SETATTR,	{ .vop_setattr = nfs3_setattr },
245 	VOPNAME_ACCESS,		{ .vop_access = nfs3_access },
246 	VOPNAME_LOOKUP,		{ .vop_lookup = nfs3_lookup },
247 	VOPNAME_CREATE,		{ .vop_create = nfs3_create },
248 	VOPNAME_REMOVE,		{ .vop_remove = nfs3_remove },
249 	VOPNAME_LINK,		{ .vop_link = nfs3_link },
250 	VOPNAME_RENAME,		{ .vop_rename = nfs3_rename },
251 	VOPNAME_MKDIR,		{ .vop_mkdir = nfs3_mkdir },
252 	VOPNAME_RMDIR,		{ .vop_rmdir = nfs3_rmdir },
253 	VOPNAME_READDIR,	{ .vop_readdir = nfs3_readdir },
254 	VOPNAME_SYMLINK,	{ .vop_symlink = nfs3_symlink },
255 	VOPNAME_READLINK,	{ .vop_readlink = nfs3_readlink },
256 	VOPNAME_FSYNC,		{ .vop_fsync = nfs3_fsync },
257 	VOPNAME_INACTIVE,	{ .vop_inactive = nfs3_inactive },
258 	VOPNAME_FID,		{ .vop_fid = nfs3_fid },
259 	VOPNAME_RWLOCK,		{ .vop_rwlock = nfs3_rwlock },
260 	VOPNAME_RWUNLOCK,	{ .vop_rwunlock = nfs3_rwunlock },
261 	VOPNAME_SEEK,		{ .vop_seek = nfs3_seek },
262 	VOPNAME_FRLOCK,		{ .vop_frlock = nfs3_frlock },
263 	VOPNAME_SPACE,		{ .vop_space = nfs3_space },
264 	VOPNAME_REALVP,		{ .vop_realvp = nfs3_realvp },
265 	VOPNAME_GETPAGE,	{ .vop_getpage = nfs3_getpage },
266 	VOPNAME_PUTPAGE,	{ .vop_putpage = nfs3_putpage },
267 	VOPNAME_MAP,		{ .vop_map = nfs3_map },
268 	VOPNAME_ADDMAP,		{ .vop_addmap = nfs3_addmap },
269 	VOPNAME_DELMAP,		{ .vop_delmap = nfs3_delmap },
270 	/* no separate nfs3_dump */
271 	VOPNAME_DUMP,		{ .vop_dump = nfs_dump },
272 	VOPNAME_PATHCONF,	{ .vop_pathconf = nfs3_pathconf },
273 	VOPNAME_PAGEIO,		{ .vop_pageio = nfs3_pageio },
274 	VOPNAME_DISPOSE,	{ .vop_dispose = nfs3_dispose },
275 	VOPNAME_SETSECATTR,	{ .vop_setsecattr = nfs3_setsecattr },
276 	VOPNAME_GETSECATTR,	{ .vop_getsecattr = nfs3_getsecattr },
277 	VOPNAME_SHRLOCK,	{ .vop_shrlock = nfs3_shrlock },
278 	VOPNAME_VNEVENT, 	{ .vop_vnevent = fs_vnevent_support },
279 	NULL,			NULL
280 };
281 
282 /*
283  * XXX:  This is referenced in modstubs.s
284  */
285 struct vnodeops *
286 nfs3_getvnodeops(void)
287 {
288 	return (nfs3_vnodeops);
289 }
290 
291 /* ARGSUSED */
292 static int
293 nfs3_open(vnode_t **vpp, int flag, cred_t *cr, caller_context_t *ct)
294 {
295 	int error;
296 	struct vattr va;
297 	rnode_t *rp;
298 	vnode_t *vp;
299 
300 	vp = *vpp;
301 	if (nfs_zone() != VTOMI(vp)->mi_zone)
302 		return (EIO);
303 	rp = VTOR(vp);
304 	mutex_enter(&rp->r_statelock);
305 	if (rp->r_cred == NULL) {
306 		crhold(cr);
307 		rp->r_cred = cr;
308 	}
309 	mutex_exit(&rp->r_statelock);
310 
311 	/*
312 	 * If there is no cached data or if close-to-open
313 	 * consistency checking is turned off, we can avoid
314 	 * the over the wire getattr.  Otherwise, if the
315 	 * file system is mounted readonly, then just verify
316 	 * the caches are up to date using the normal mechanism.
317 	 * Else, if the file is not mmap'd, then just mark
318 	 * the attributes as timed out.  They will be refreshed
319 	 * and the caches validated prior to being used.
320 	 * Else, the file system is mounted writeable so
321 	 * force an over the wire GETATTR in order to ensure
322 	 * that all cached data is valid.
323 	 */
324 	if (vp->v_count > 1 ||
325 	    ((vn_has_cached_data(vp) || HAVE_RDDIR_CACHE(rp)) &&
326 	    !(VTOMI(vp)->mi_flags & MI_NOCTO))) {
327 		if (vn_is_readonly(vp))
328 			error = nfs3_validate_caches(vp, cr);
329 		else if (rp->r_mapcnt == 0 && vp->v_count == 1) {
330 			PURGE_ATTRCACHE(vp);
331 			error = 0;
332 		} else {
333 			va.va_mask = AT_ALL;
334 			error = nfs3_getattr_otw(vp, &va, cr);
335 		}
336 	} else
337 		error = 0;
338 
339 	return (error);
340 }
341 
342 /* ARGSUSED */
343 static int
344 nfs3_close(vnode_t *vp, int flag, int count, offset_t offset, cred_t *cr,
345 		caller_context_t *ct)
346 {
347 	rnode_t *rp;
348 	int error;
349 	struct vattr va;
350 
351 	/*
352 	 * zone_enter(2) prevents processes from changing zones with NFS files
353 	 * open; if we happen to get here from the wrong zone we can't do
354 	 * anything over the wire.
355 	 */
356 	if (VTOMI(vp)->mi_zone != nfs_zone()) {
357 		/*
358 		 * We could attempt to clean up locks, except we're sure
359 		 * that the current process didn't acquire any locks on
360 		 * the file: any attempt to lock a file belong to another zone
361 		 * will fail, and one can't lock an NFS file and then change
362 		 * zones, as that fails too.
363 		 *
364 		 * Returning an error here is the sane thing to do.  A
365 		 * subsequent call to VN_RELE() which translates to a
366 		 * nfs3_inactive() will clean up state: if the zone of the
367 		 * vnode's origin is still alive and kicking, an async worker
368 		 * thread will handle the request (from the correct zone), and
369 		 * everything (minus the commit and final nfs3_getattr_otw()
370 		 * call) should be OK. If the zone is going away
371 		 * nfs_async_inactive() will throw away cached pages inline.
372 		 */
373 		return (EIO);
374 	}
375 
376 	/*
377 	 * If we are using local locking for this filesystem, then
378 	 * release all of the SYSV style record locks.  Otherwise,
379 	 * we are doing network locking and we need to release all
380 	 * of the network locks.  All of the locks held by this
381 	 * process on this file are released no matter what the
382 	 * incoming reference count is.
383 	 */
384 	if (VTOMI(vp)->mi_flags & MI_LLOCK) {
385 		cleanlocks(vp, ttoproc(curthread)->p_pid, 0);
386 		cleanshares(vp, ttoproc(curthread)->p_pid);
387 	} else
388 		nfs_lockrelease(vp, flag, offset, cr);
389 
390 	if (count > 1)
391 		return (0);
392 
393 	/*
394 	 * If the file has been `unlinked', then purge the
395 	 * DNLC so that this vnode will get reycled quicker
396 	 * and the .nfs* file on the server will get removed.
397 	 */
398 	rp = VTOR(vp);
399 	if (rp->r_unldvp != NULL)
400 		dnlc_purge_vp(vp);
401 
402 	/*
403 	 * If the file was open for write and there are pages,
404 	 * then if the file system was mounted using the "no-close-
405 	 *	to-open" semantics, then start an asynchronous flush
406 	 *	of the all of the pages in the file.
407 	 * else the file system was not mounted using the "no-close-
408 	 *	to-open" semantics, then do a synchronous flush and
409 	 *	commit of all of the dirty and uncommitted pages.
410 	 *
411 	 * The asynchronous flush of the pages in the "nocto" path
412 	 * mostly just associates a cred pointer with the rnode so
413 	 * writes which happen later will have a better chance of
414 	 * working.  It also starts the data being written to the
415 	 * server, but without unnecessarily delaying the application.
416 	 */
417 	if ((flag & FWRITE) && vn_has_cached_data(vp)) {
418 		if (VTOMI(vp)->mi_flags & MI_NOCTO) {
419 			error = nfs3_putpage(vp, (offset_t)0, 0, B_ASYNC,
420 					cr, ct);
421 			if (error == EAGAIN)
422 				error = 0;
423 		} else
424 			error = nfs3_putpage_commit(vp, (offset_t)0, 0, cr);
425 		if (!error) {
426 			mutex_enter(&rp->r_statelock);
427 			error = rp->r_error;
428 			rp->r_error = 0;
429 			mutex_exit(&rp->r_statelock);
430 		}
431 	} else {
432 		mutex_enter(&rp->r_statelock);
433 		error = rp->r_error;
434 		rp->r_error = 0;
435 		mutex_exit(&rp->r_statelock);
436 	}
437 
438 	/*
439 	 * If RWRITEATTR is set, then issue an over the wire GETATTR to
440 	 * refresh the attribute cache with a set of attributes which
441 	 * weren't returned from a WRITE.  This will enable the close-
442 	 * to-open processing to work.
443 	 */
444 	if (rp->r_flags & RWRITEATTR)
445 		(void) nfs3_getattr_otw(vp, &va, cr);
446 
447 	return (error);
448 }
449 
450 /* ARGSUSED */
451 static int
452 nfs3_directio_read(vnode_t *vp, struct uio *uiop, cred_t *cr)
453 {
454 	mntinfo_t *mi;
455 	READ3args args;
456 	READ3uiores res;
457 	int tsize;
458 	offset_t offset;
459 	ssize_t count;
460 	int error;
461 	int douprintf;
462 	failinfo_t fi;
463 	char *sv_hostname;
464 
465 	mi = VTOMI(vp);
466 	ASSERT(nfs_zone() == VTOMI(vp)->mi_zone);
467 	sv_hostname = VTOR(vp)->r_server->sv_hostname;
468 
469 	douprintf = 1;
470 	args.file = *VTOFH3(vp);
471 	fi.vp = vp;
472 	fi.fhp = (caddr_t)&args.file;
473 	fi.copyproc = nfs3copyfh;
474 	fi.lookupproc = nfs3lookup;
475 	fi.xattrdirproc = acl_getxattrdir3;
476 
477 	res.uiop = uiop;
478 
479 	offset = uiop->uio_loffset;
480 	count = uiop->uio_resid;
481 
482 	do {
483 		if (mi->mi_io_kstats) {
484 			mutex_enter(&mi->mi_lock);
485 			kstat_runq_enter(KSTAT_IO_PTR(mi->mi_io_kstats));
486 			mutex_exit(&mi->mi_lock);
487 		}
488 
489 		do {
490 			tsize = MIN(mi->mi_tsize, count);
491 			args.offset = (offset3)offset;
492 			args.count = (count3)tsize;
493 			res.size = (uint_t)tsize;
494 			error = rfs3call(mi, NFSPROC3_READ,
495 				    xdr_READ3args, (caddr_t)&args,
496 				    xdr_READ3uiores, (caddr_t)&res, cr,
497 				    &douprintf, &res.status, 0, &fi);
498 		} while (error == ENFS_TRYAGAIN);
499 
500 		if (mi->mi_io_kstats) {
501 			mutex_enter(&mi->mi_lock);
502 			kstat_runq_exit(KSTAT_IO_PTR(mi->mi_io_kstats));
503 			mutex_exit(&mi->mi_lock);
504 		}
505 
506 		if (error)
507 			return (error);
508 
509 		error = geterrno3(res.status);
510 		if (error)
511 			return (error);
512 
513 		if (res.count != res.size) {
514 			zcmn_err(getzoneid(), CE_WARN,
515 "nfs3_directio_read: server %s returned incorrect amount",
516 					sv_hostname);
517 			return (EIO);
518 		}
519 		count -= res.count;
520 		offset += res.count;
521 		if (mi->mi_io_kstats) {
522 			mutex_enter(&mi->mi_lock);
523 			KSTAT_IO_PTR(mi->mi_io_kstats)->reads++;
524 			KSTAT_IO_PTR(mi->mi_io_kstats)->nread += res.count;
525 			mutex_exit(&mi->mi_lock);
526 		}
527 		lwp_stat_update(LWP_STAT_INBLK, 1);
528 	} while (count && !res.eof);
529 
530 	return (0);
531 }
532 
533 /* ARGSUSED */
534 static int
535 nfs3_read(vnode_t *vp, struct uio *uiop, int ioflag, cred_t *cr,
536 	caller_context_t *ct)
537 {
538 	rnode_t *rp;
539 	u_offset_t off;
540 	offset_t diff;
541 	int on;
542 	size_t n;
543 	caddr_t base;
544 	uint_t flags;
545 	int error = 0;
546 	mntinfo_t *mi;
547 
548 	rp = VTOR(vp);
549 	mi = VTOMI(vp);
550 
551 	ASSERT(nfs_rw_lock_held(&rp->r_rwlock, RW_READER));
552 
553 	if (nfs_zone() != mi->mi_zone)
554 		return (EIO);
555 
556 	if (vp->v_type != VREG)
557 		return (EISDIR);
558 
559 	if (uiop->uio_resid == 0)
560 		return (0);
561 
562 	if (uiop->uio_loffset < 0 || uiop->uio_loffset + uiop->uio_resid < 0)
563 		return (EINVAL);
564 
565 	/*
566 	 * Bypass VM if caching has been disabled (e.g., locking) or if
567 	 * using client-side direct I/O and the file is not mmap'd and
568 	 * there are no cached pages.
569 	 */
570 	if ((vp->v_flag & VNOCACHE) ||
571 	    (((rp->r_flags & RDIRECTIO) || (mi->mi_flags & MI_DIRECTIO)) &&
572 	    rp->r_mapcnt == 0 && !vn_has_cached_data(vp))) {
573 		return (nfs3_directio_read(vp, uiop, cr));
574 	}
575 
576 	do {
577 		off = uiop->uio_loffset & MAXBMASK; /* mapping offset */
578 		on = uiop->uio_loffset & MAXBOFFSET; /* Relative offset */
579 		n = MIN(MAXBSIZE - on, uiop->uio_resid);
580 
581 		error = nfs3_validate_caches(vp, cr);
582 		if (error)
583 			break;
584 
585 		mutex_enter(&rp->r_statelock);
586 		while (rp->r_flags & RINCACHEPURGE) {
587 			if (!cv_wait_sig(&rp->r_cv, &rp->r_statelock)) {
588 				mutex_exit(&rp->r_statelock);
589 				return (EINTR);
590 			}
591 		}
592 		diff = rp->r_size - uiop->uio_loffset;
593 		mutex_exit(&rp->r_statelock);
594 		if (diff <= 0)
595 			break;
596 		if (diff < n)
597 			n = (size_t)diff;
598 
599 		if (vpm_enable) {
600 			/*
601 			 * Copy data.
602 			 */
603 			error = vpm_data_copy(vp, off + on, n, uiop,
604 						1, NULL, 0, S_READ);
605 		} else {
606 			base = segmap_getmapflt(segkmap, vp, off + on, n, 1,
607 							S_READ);
608 
609 			error = uiomove(base + on, n, UIO_READ, uiop);
610 		}
611 
612 		if (!error) {
613 			/*
614 			 * If read a whole block or read to eof,
615 			 * won't need this buffer again soon.
616 			 */
617 			mutex_enter(&rp->r_statelock);
618 			if (n + on == MAXBSIZE ||
619 			    uiop->uio_loffset == rp->r_size)
620 				flags = SM_DONTNEED;
621 			else
622 				flags = 0;
623 			mutex_exit(&rp->r_statelock);
624 			if (vpm_enable) {
625 				error = vpm_sync_pages(vp, off, n, flags);
626 			} else {
627 				error = segmap_release(segkmap, base, flags);
628 			}
629 		} else {
630 			if (vpm_enable) {
631 				(void) vpm_sync_pages(vp, off, n, 0);
632 			} else {
633 				(void) segmap_release(segkmap, base, 0);
634 			}
635 		}
636 	} while (!error && uiop->uio_resid > 0);
637 
638 	return (error);
639 }
640 
641 /* ARGSUSED */
642 static int
643 nfs3_write(vnode_t *vp, struct uio *uiop, int ioflag, cred_t *cr,
644 	caller_context_t *ct)
645 {
646 	rlim64_t limit = uiop->uio_llimit;
647 	rnode_t *rp;
648 	u_offset_t off;
649 	caddr_t base;
650 	uint_t flags;
651 	int remainder;
652 	size_t n;
653 	int on;
654 	int error;
655 	int resid;
656 	offset_t offset;
657 	mntinfo_t *mi;
658 	uint_t bsize;
659 
660 	rp = VTOR(vp);
661 
662 	if (vp->v_type != VREG)
663 		return (EISDIR);
664 
665 	mi = VTOMI(vp);
666 	if (nfs_zone() != mi->mi_zone)
667 		return (EIO);
668 	if (uiop->uio_resid == 0)
669 		return (0);
670 
671 	if (ioflag & FAPPEND) {
672 		struct vattr va;
673 
674 		/*
675 		 * Must serialize if appending.
676 		 */
677 		if (nfs_rw_lock_held(&rp->r_rwlock, RW_READER)) {
678 			nfs_rw_exit(&rp->r_rwlock);
679 			if (nfs_rw_enter_sig(&rp->r_rwlock, RW_WRITER,
680 			    INTR(vp)))
681 				return (EINTR);
682 		}
683 
684 		va.va_mask = AT_SIZE;
685 		error = nfs3getattr(vp, &va, cr);
686 		if (error)
687 			return (error);
688 		uiop->uio_loffset = va.va_size;
689 	}
690 
691 	offset = uiop->uio_loffset + uiop->uio_resid;
692 
693 	if (uiop->uio_loffset < 0 || offset < 0)
694 		return (EINVAL);
695 
696 	if (limit == RLIM64_INFINITY || limit > MAXOFFSET_T)
697 		limit = MAXOFFSET_T;
698 
699 	/*
700 	 * Check to make sure that the process will not exceed
701 	 * its limit on file size.  It is okay to write up to
702 	 * the limit, but not beyond.  Thus, the write which
703 	 * reaches the limit will be short and the next write
704 	 * will return an error.
705 	 */
706 	remainder = 0;
707 	if (offset > limit) {
708 		remainder = offset - limit;
709 		uiop->uio_resid = limit - uiop->uio_loffset;
710 		if (uiop->uio_resid <= 0) {
711 			proc_t *p = ttoproc(curthread);
712 
713 			uiop->uio_resid += remainder;
714 			mutex_enter(&p->p_lock);
715 			(void) rctl_action(rctlproc_legacy[RLIMIT_FSIZE],
716 			    p->p_rctls, p, RCA_UNSAFE_SIGINFO);
717 			mutex_exit(&p->p_lock);
718 			return (EFBIG);
719 		}
720 	}
721 
722 	if (nfs_rw_enter_sig(&rp->r_lkserlock, RW_READER, INTR(vp)))
723 		return (EINTR);
724 
725 	/*
726 	 * Bypass VM if caching has been disabled (e.g., locking) or if
727 	 * using client-side direct I/O and the file is not mmap'd and
728 	 * there are no cached pages.
729 	 */
730 	if ((vp->v_flag & VNOCACHE) ||
731 	    (((rp->r_flags & RDIRECTIO) || (mi->mi_flags & MI_DIRECTIO)) &&
732 	    rp->r_mapcnt == 0 && !vn_has_cached_data(vp))) {
733 		size_t bufsize;
734 		int count;
735 		u_offset_t org_offset;
736 		stable_how stab_comm;
737 
738 nfs3_fwrite:
739 		if (rp->r_flags & RSTALE) {
740 			resid = uiop->uio_resid;
741 			offset = uiop->uio_loffset;
742 			error = rp->r_error;
743 			goto bottom;
744 		}
745 		bufsize = MIN(uiop->uio_resid, mi->mi_stsize);
746 		base = kmem_alloc(bufsize, KM_SLEEP);
747 		do {
748 			if (ioflag & FDSYNC)
749 				stab_comm = DATA_SYNC;
750 			else
751 				stab_comm = FILE_SYNC;
752 			resid = uiop->uio_resid;
753 			offset = uiop->uio_loffset;
754 			count = MIN(uiop->uio_resid, bufsize);
755 			org_offset = uiop->uio_loffset;
756 			error = uiomove(base, count, UIO_WRITE, uiop);
757 			if (!error) {
758 				error = nfs3write(vp, base, org_offset,
759 				    count, cr, &stab_comm);
760 			}
761 		} while (!error && uiop->uio_resid > 0);
762 		kmem_free(base, bufsize);
763 		goto bottom;
764 	}
765 
766 
767 	bsize = vp->v_vfsp->vfs_bsize;
768 
769 	do {
770 		off = uiop->uio_loffset & MAXBMASK; /* mapping offset */
771 		on = uiop->uio_loffset & MAXBOFFSET; /* Relative offset */
772 		n = MIN(MAXBSIZE - on, uiop->uio_resid);
773 
774 		resid = uiop->uio_resid;
775 		offset = uiop->uio_loffset;
776 
777 		if (rp->r_flags & RSTALE) {
778 			error = rp->r_error;
779 			break;
780 		}
781 
782 		/*
783 		 * Don't create dirty pages faster than they
784 		 * can be cleaned so that the system doesn't
785 		 * get imbalanced.  If the async queue is
786 		 * maxed out, then wait for it to drain before
787 		 * creating more dirty pages.  Also, wait for
788 		 * any threads doing pagewalks in the vop_getattr
789 		 * entry points so that they don't block for
790 		 * long periods.
791 		 */
792 		mutex_enter(&rp->r_statelock);
793 		while ((mi->mi_max_threads != 0 &&
794 		    rp->r_awcount > 2 * mi->mi_max_threads) ||
795 		    rp->r_gcount > 0)
796 			cv_wait(&rp->r_cv, &rp->r_statelock);
797 		mutex_exit(&rp->r_statelock);
798 
799 		if (vpm_enable) {
800 			/*
801 			 * It will use kpm mappings, so no need to
802 			 * pass an address.
803 			 */
804 			error = writerp(rp, NULL, n, uiop, 0);
805 		} else  {
806 			if (segmap_kpm) {
807 				int pon = uiop->uio_loffset & PAGEOFFSET;
808 				size_t pn = MIN(PAGESIZE - pon,
809 							uiop->uio_resid);
810 				int pagecreate;
811 
812 				mutex_enter(&rp->r_statelock);
813 				pagecreate = (pon == 0) && (pn == PAGESIZE ||
814 					uiop->uio_loffset + pn >= rp->r_size);
815 				mutex_exit(&rp->r_statelock);
816 
817 				base = segmap_getmapflt(segkmap, vp, off + on,
818 						pn, !pagecreate, S_WRITE);
819 
820 				error = writerp(rp, base + pon, n, uiop,
821 								pagecreate);
822 
823 			} else {
824 				base = segmap_getmapflt(segkmap, vp, off + on,
825 							n, 0, S_READ);
826 				error = writerp(rp, base + on, n, uiop, 0);
827 			}
828 		}
829 
830 		if (!error) {
831 			if (mi->mi_flags & MI_NOAC)
832 				flags = SM_WRITE;
833 			else if ((uiop->uio_loffset % bsize) == 0 ||
834 			    IS_SWAPVP(vp)) {
835 				/*
836 				 * Have written a whole block.
837 				 * Start an asynchronous write
838 				 * and mark the buffer to
839 				 * indicate that it won't be
840 				 * needed again soon.
841 				 */
842 				flags = SM_WRITE | SM_ASYNC | SM_DONTNEED;
843 			} else
844 				flags = 0;
845 			if ((ioflag & (FSYNC|FDSYNC)) ||
846 			    (rp->r_flags & ROUTOFSPACE)) {
847 				flags &= ~SM_ASYNC;
848 				flags |= SM_WRITE;
849 			}
850 			if (vpm_enable) {
851 				error = vpm_sync_pages(vp, off, n, flags);
852 			} else {
853 				error = segmap_release(segkmap, base, flags);
854 			}
855 		} else {
856 			if (vpm_enable) {
857 				(void) vpm_sync_pages(vp, off, n, 0);
858 			} else {
859 				(void) segmap_release(segkmap, base, 0);
860 			}
861 			/*
862 			 * In the event that we got an access error while
863 			 * faulting in a page for a write-only file just
864 			 * force a write.
865 			 */
866 			if (error == EACCES)
867 				goto nfs3_fwrite;
868 		}
869 	} while (!error && uiop->uio_resid > 0);
870 
871 bottom:
872 	if (error) {
873 		uiop->uio_resid = resid + remainder;
874 		uiop->uio_loffset = offset;
875 	} else
876 		uiop->uio_resid += remainder;
877 
878 	nfs_rw_exit(&rp->r_lkserlock);
879 
880 	return (error);
881 }
882 
883 /*
884  * Flags are composed of {B_ASYNC, B_INVAL, B_FREE, B_DONTNEED}
885  */
886 static int
887 nfs3_rdwrlbn(vnode_t *vp, page_t *pp, u_offset_t off, size_t len,
888 	int flags, cred_t *cr)
889 {
890 	struct buf *bp;
891 	int error;
892 	page_t *savepp;
893 	uchar_t fsdata;
894 	stable_how stab_comm;
895 
896 	ASSERT(nfs_zone() == VTOMI(vp)->mi_zone);
897 	bp = pageio_setup(pp, len, vp, flags);
898 	ASSERT(bp != NULL);
899 
900 	/*
901 	 * pageio_setup should have set b_addr to 0.  This
902 	 * is correct since we want to do I/O on a page
903 	 * boundary.  bp_mapin will use this addr to calculate
904 	 * an offset, and then set b_addr to the kernel virtual
905 	 * address it allocated for us.
906 	 */
907 	ASSERT(bp->b_un.b_addr == 0);
908 
909 	bp->b_edev = 0;
910 	bp->b_dev = 0;
911 	bp->b_lblkno = lbtodb(off);
912 	bp->b_file = vp;
913 	bp->b_offset = (offset_t)off;
914 	bp_mapin(bp);
915 
916 	/*
917 	 * Calculate the desired level of stability to write data
918 	 * on the server and then mark all of the pages to reflect
919 	 * this.
920 	 */
921 	if ((flags & (B_WRITE|B_ASYNC)) == (B_WRITE|B_ASYNC) &&
922 	    freemem > desfree) {
923 		stab_comm = UNSTABLE;
924 		fsdata = C_DELAYCOMMIT;
925 	} else {
926 		stab_comm = FILE_SYNC;
927 		fsdata = C_NOCOMMIT;
928 	}
929 
930 	savepp = pp;
931 	do {
932 		pp->p_fsdata = fsdata;
933 	} while ((pp = pp->p_next) != savepp);
934 
935 	error = nfs3_bio(bp, &stab_comm, cr);
936 
937 	bp_mapout(bp);
938 	pageio_done(bp);
939 
940 	/*
941 	 * If the server wrote pages in a more stable fashion than
942 	 * was requested, then clear all of the marks in the pages
943 	 * indicating that COMMIT operations were required.
944 	 */
945 	if (stab_comm != UNSTABLE && fsdata == C_DELAYCOMMIT) {
946 		do {
947 			pp->p_fsdata = C_NOCOMMIT;
948 		} while ((pp = pp->p_next) != savepp);
949 	}
950 
951 	return (error);
952 }
953 
954 /*
955  * Write to file.  Writes to remote server in largest size
956  * chunks that the server can handle.  Write is synchronous.
957  */
958 static int
959 nfs3write(vnode_t *vp, caddr_t base, u_offset_t offset, int count, cred_t *cr,
960 	stable_how *stab_comm)
961 {
962 	mntinfo_t *mi;
963 	WRITE3args args;
964 	WRITE3res res;
965 	int error;
966 	int tsize;
967 	rnode_t *rp;
968 	int douprintf;
969 
970 	rp = VTOR(vp);
971 	mi = VTOMI(vp);
972 
973 	ASSERT(nfs_zone() == mi->mi_zone);
974 
975 	args.file = *VTOFH3(vp);
976 	args.stable = *stab_comm;
977 
978 	*stab_comm = FILE_SYNC;
979 
980 	douprintf = 1;
981 
982 	do {
983 		if ((vp->v_flag & VNOCACHE) ||
984 		    (rp->r_flags & RDIRECTIO) ||
985 		    (mi->mi_flags & MI_DIRECTIO))
986 			tsize = MIN(mi->mi_stsize, count);
987 		else
988 			tsize = MIN(mi->mi_curwrite, count);
989 		args.offset = (offset3)offset;
990 		args.count = (count3)tsize;
991 		args.data.data_len = (uint_t)tsize;
992 		args.data.data_val = base;
993 
994 		if (mi->mi_io_kstats) {
995 			mutex_enter(&mi->mi_lock);
996 			kstat_runq_enter(KSTAT_IO_PTR(mi->mi_io_kstats));
997 			mutex_exit(&mi->mi_lock);
998 		}
999 		args.mblk = NULL;
1000 		do {
1001 			error = rfs3call(mi, NFSPROC3_WRITE,
1002 			    xdr_WRITE3args, (caddr_t)&args,
1003 			    xdr_WRITE3res, (caddr_t)&res, cr,
1004 			    &douprintf, &res.status, 0, NULL);
1005 		} while (error == ENFS_TRYAGAIN);
1006 		if (mi->mi_io_kstats) {
1007 			mutex_enter(&mi->mi_lock);
1008 			kstat_runq_exit(KSTAT_IO_PTR(mi->mi_io_kstats));
1009 			mutex_exit(&mi->mi_lock);
1010 		}
1011 
1012 		if (error)
1013 			return (error);
1014 		error = geterrno3(res.status);
1015 		if (!error) {
1016 			if (res.resok.count > args.count) {
1017 				zcmn_err(getzoneid(), CE_WARN,
1018 				    "nfs3write: server %s wrote %u, "
1019 				    "requested was %u",
1020 				    rp->r_server->sv_hostname,
1021 				    res.resok.count, args.count);
1022 				return (EIO);
1023 			}
1024 			if (res.resok.committed == UNSTABLE) {
1025 				*stab_comm = UNSTABLE;
1026 				if (args.stable == DATA_SYNC ||
1027 				    args.stable == FILE_SYNC) {
1028 					zcmn_err(getzoneid(), CE_WARN,
1029 			"nfs3write: server %s did not commit to stable storage",
1030 					    rp->r_server->sv_hostname);
1031 					return (EIO);
1032 				}
1033 			}
1034 			tsize = (int)res.resok.count;
1035 			count -= tsize;
1036 			base += tsize;
1037 			offset += tsize;
1038 			if (mi->mi_io_kstats) {
1039 				mutex_enter(&mi->mi_lock);
1040 				KSTAT_IO_PTR(mi->mi_io_kstats)->writes++;
1041 				KSTAT_IO_PTR(mi->mi_io_kstats)->nwritten +=
1042 				    tsize;
1043 				mutex_exit(&mi->mi_lock);
1044 			}
1045 			lwp_stat_update(LWP_STAT_OUBLK, 1);
1046 			mutex_enter(&rp->r_statelock);
1047 			if (rp->r_flags & RHAVEVERF) {
1048 				if (rp->r_verf != res.resok.verf) {
1049 					nfs3_set_mod(vp);
1050 					rp->r_verf = res.resok.verf;
1051 					/*
1052 					 * If the data was written UNSTABLE,
1053 					 * then might as well stop because
1054 					 * the whole block will have to get
1055 					 * rewritten anyway.
1056 					 */
1057 					if (*stab_comm == UNSTABLE) {
1058 						mutex_exit(&rp->r_statelock);
1059 						break;
1060 					}
1061 				}
1062 			} else {
1063 				rp->r_verf = res.resok.verf;
1064 				rp->r_flags |= RHAVEVERF;
1065 			}
1066 			/*
1067 			 * Mark the attribute cache as timed out and
1068 			 * set RWRITEATTR to indicate that the file
1069 			 * was modified with a WRITE operation and
1070 			 * that the attributes can not be trusted.
1071 			 */
1072 			PURGE_ATTRCACHE_LOCKED(rp);
1073 			rp->r_flags |= RWRITEATTR;
1074 			mutex_exit(&rp->r_statelock);
1075 		}
1076 	} while (!error && count);
1077 
1078 	return (error);
1079 }
1080 
1081 /*
1082  * Read from a file.  Reads data in largest chunks our interface can handle.
1083  */
1084 static int
1085 nfs3read(vnode_t *vp, caddr_t base, offset_t offset, int count,
1086 	size_t *residp, cred_t *cr)
1087 {
1088 	mntinfo_t *mi;
1089 	READ3args args;
1090 	READ3vres res;
1091 	int tsize;
1092 	int error;
1093 	int douprintf;
1094 	failinfo_t fi;
1095 	rnode_t *rp;
1096 	struct vattr va;
1097 	hrtime_t t;
1098 
1099 	rp = VTOR(vp);
1100 	mi = VTOMI(vp);
1101 	ASSERT(nfs_zone() == mi->mi_zone);
1102 	douprintf = 1;
1103 
1104 	args.file = *VTOFH3(vp);
1105 	fi.vp = vp;
1106 	fi.fhp = (caddr_t)&args.file;
1107 	fi.copyproc = nfs3copyfh;
1108 	fi.lookupproc = nfs3lookup;
1109 	fi.xattrdirproc = acl_getxattrdir3;
1110 
1111 	res.pov.fres.vp = vp;
1112 	res.pov.fres.vap = &va;
1113 
1114 	*residp = count;
1115 	do {
1116 		if (mi->mi_io_kstats) {
1117 			mutex_enter(&mi->mi_lock);
1118 			kstat_runq_enter(KSTAT_IO_PTR(mi->mi_io_kstats));
1119 			mutex_exit(&mi->mi_lock);
1120 		}
1121 
1122 		do {
1123 			if ((vp->v_flag & VNOCACHE) ||
1124 			    (rp->r_flags & RDIRECTIO) ||
1125 			    (mi->mi_flags & MI_DIRECTIO))
1126 				tsize = MIN(mi->mi_tsize, count);
1127 			else
1128 				tsize = MIN(mi->mi_curread, count);
1129 			res.data.data_val = base;
1130 			res.data.data_len = tsize;
1131 			args.offset = (offset3)offset;
1132 			args.count = (count3)tsize;
1133 			t = gethrtime();
1134 			error = rfs3call(mi, NFSPROC3_READ,
1135 			    xdr_READ3args, (caddr_t)&args,
1136 			    xdr_READ3vres, (caddr_t)&res, cr,
1137 			    &douprintf, &res.status, 0, &fi);
1138 		} while (error == ENFS_TRYAGAIN);
1139 
1140 		if (mi->mi_io_kstats) {
1141 			mutex_enter(&mi->mi_lock);
1142 			kstat_runq_exit(KSTAT_IO_PTR(mi->mi_io_kstats));
1143 			mutex_exit(&mi->mi_lock);
1144 		}
1145 
1146 		if (error)
1147 			return (error);
1148 
1149 		error = geterrno3(res.status);
1150 		if (error)
1151 			return (error);
1152 
1153 		if (res.count != res.data.data_len) {
1154 			zcmn_err(getzoneid(), CE_WARN,
1155 				"nfs3read: server %s returned incorrect amount",
1156 				rp->r_server->sv_hostname);
1157 			return (EIO);
1158 		}
1159 
1160 		count -= res.count;
1161 		*residp = count;
1162 		base += res.count;
1163 		offset += res.count;
1164 		if (mi->mi_io_kstats) {
1165 			mutex_enter(&mi->mi_lock);
1166 			KSTAT_IO_PTR(mi->mi_io_kstats)->reads++;
1167 			KSTAT_IO_PTR(mi->mi_io_kstats)->nread += res.count;
1168 			mutex_exit(&mi->mi_lock);
1169 		}
1170 		lwp_stat_update(LWP_STAT_INBLK, 1);
1171 	} while (count && !res.eof);
1172 
1173 	if (res.pov.attributes) {
1174 		mutex_enter(&rp->r_statelock);
1175 		if (!CACHE_VALID(rp, va.va_mtime, va.va_size)) {
1176 			mutex_exit(&rp->r_statelock);
1177 			PURGE_ATTRCACHE(vp);
1178 		} else {
1179 			if (rp->r_mtime <= t)
1180 				nfs_attrcache_va(vp, &va);
1181 			mutex_exit(&rp->r_statelock);
1182 		}
1183 	}
1184 
1185 	return (0);
1186 }
1187 
1188 /* ARGSUSED */
1189 static int
1190 nfs3_ioctl(vnode_t *vp, int cmd, intptr_t arg, int flag, cred_t *cr, int *rvalp,
1191 	caller_context_t *ct)
1192 {
1193 
1194 	if (nfs_zone() != VTOMI(vp)->mi_zone)
1195 		return (EIO);
1196 	switch (cmd) {
1197 		case _FIODIRECTIO:
1198 			return (nfs_directio(vp, (int)arg, cr));
1199 		default:
1200 			return (ENOTTY);
1201 	}
1202 }
1203 
1204 /* ARGSUSED */
1205 static int
1206 nfs3_getattr(vnode_t *vp, struct vattr *vap, int flags, cred_t *cr,
1207 	caller_context_t *ct)
1208 {
1209 	int error;
1210 	rnode_t *rp;
1211 
1212 	if (nfs_zone() != VTOMI(vp)->mi_zone)
1213 		return (EIO);
1214 	/*
1215 	 * If it has been specified that the return value will
1216 	 * just be used as a hint, and we are only being asked
1217 	 * for size, fsid or rdevid, then return the client's
1218 	 * notion of these values without checking to make sure
1219 	 * that the attribute cache is up to date.
1220 	 * The whole point is to avoid an over the wire GETATTR
1221 	 * call.
1222 	 */
1223 	rp = VTOR(vp);
1224 	if (flags & ATTR_HINT) {
1225 		if (vap->va_mask ==
1226 		    (vap->va_mask & (AT_SIZE | AT_FSID | AT_RDEV))) {
1227 			mutex_enter(&rp->r_statelock);
1228 			if (vap->va_mask | AT_SIZE)
1229 				vap->va_size = rp->r_size;
1230 			if (vap->va_mask | AT_FSID)
1231 				vap->va_fsid = rp->r_attr.va_fsid;
1232 			if (vap->va_mask | AT_RDEV)
1233 				vap->va_rdev = rp->r_attr.va_rdev;
1234 			mutex_exit(&rp->r_statelock);
1235 			return (0);
1236 		}
1237 	}
1238 
1239 	/*
1240 	 * Only need to flush pages if asking for the mtime
1241 	 * and if there any dirty pages or any outstanding
1242 	 * asynchronous (write) requests for this file.
1243 	 */
1244 	if (vap->va_mask & AT_MTIME) {
1245 		if (vn_has_cached_data(vp) &&
1246 		    ((rp->r_flags & RDIRTY) || rp->r_awcount > 0)) {
1247 			mutex_enter(&rp->r_statelock);
1248 			rp->r_gcount++;
1249 			mutex_exit(&rp->r_statelock);
1250 			error = nfs3_putpage(vp, (offset_t)0, 0, 0, cr, ct);
1251 			mutex_enter(&rp->r_statelock);
1252 			if (error && (error == ENOSPC || error == EDQUOT)) {
1253 				if (!rp->r_error)
1254 					rp->r_error = error;
1255 			}
1256 			if (--rp->r_gcount == 0)
1257 				cv_broadcast(&rp->r_cv);
1258 			mutex_exit(&rp->r_statelock);
1259 		}
1260 	}
1261 
1262 	return (nfs3getattr(vp, vap, cr));
1263 }
1264 
1265 /*ARGSUSED4*/
1266 static int
1267 nfs3_setattr(vnode_t *vp, struct vattr *vap, int flags, cred_t *cr,
1268 		caller_context_t *ct)
1269 {
1270 	int error;
1271 	struct vattr va;
1272 
1273 	if (vap->va_mask & AT_NOSET)
1274 		return (EINVAL);
1275 	if (nfs_zone() != VTOMI(vp)->mi_zone)
1276 		return (EIO);
1277 
1278 	va.va_mask = AT_UID | AT_MODE;
1279 	error = nfs3getattr(vp, &va, cr);
1280 	if (error)
1281 		return (error);
1282 
1283 	error = secpolicy_vnode_setattr(cr, vp, vap, &va, flags, nfs3_accessx,
1284 		vp);
1285 	if (error)
1286 		return (error);
1287 
1288 	return (nfs3setattr(vp, vap, flags, cr));
1289 }
1290 
1291 static int
1292 nfs3setattr(vnode_t *vp, struct vattr *vap, int flags, cred_t *cr)
1293 {
1294 	int error;
1295 	uint_t mask;
1296 	SETATTR3args args;
1297 	SETATTR3res res;
1298 	int douprintf;
1299 	rnode_t *rp;
1300 	struct vattr va;
1301 	mode_t omode;
1302 	vsecattr_t *vsp;
1303 	hrtime_t t;
1304 
1305 	ASSERT(nfs_zone() == VTOMI(vp)->mi_zone);
1306 	mask = vap->va_mask;
1307 
1308 	rp = VTOR(vp);
1309 
1310 	/*
1311 	 * Only need to flush pages if there are any pages and
1312 	 * if the file is marked as dirty in some fashion.  The
1313 	 * file must be flushed so that we can accurately
1314 	 * determine the size of the file and the cached data
1315 	 * after the SETATTR returns.  A file is considered to
1316 	 * be dirty if it is either marked with RDIRTY, has
1317 	 * outstanding i/o's active, or is mmap'd.  In this
1318 	 * last case, we can't tell whether there are dirty
1319 	 * pages, so we flush just to be sure.
1320 	 */
1321 	if (vn_has_cached_data(vp) &&
1322 	    ((rp->r_flags & RDIRTY) ||
1323 	    rp->r_count > 0 ||
1324 	    rp->r_mapcnt > 0)) {
1325 		ASSERT(vp->v_type != VCHR);
1326 		error = nfs3_putpage(vp, (offset_t)0, 0, 0, cr, NULL);
1327 		if (error && (error == ENOSPC || error == EDQUOT)) {
1328 			mutex_enter(&rp->r_statelock);
1329 			if (!rp->r_error)
1330 				rp->r_error = error;
1331 			mutex_exit(&rp->r_statelock);
1332 		}
1333 	}
1334 
1335 	args.object = *RTOFH3(rp);
1336 	/*
1337 	 * If the intent is for the server to set the times,
1338 	 * there is no point in have the mask indicating set mtime or
1339 	 * atime, because the vap values may be junk, and so result
1340 	 * in an overflow error. Remove these flags from the vap mask
1341 	 * before calling in this case, and restore them afterwards.
1342 	 */
1343 	if ((mask & (AT_ATIME | AT_MTIME)) && !(flags & ATTR_UTIME)) {
1344 		/* Use server times, so don't set the args time fields */
1345 		vap->va_mask &= ~(AT_ATIME | AT_MTIME);
1346 		error = vattr_to_sattr3(vap, &args.new_attributes);
1347 		vap->va_mask |= (mask & (AT_ATIME | AT_MTIME));
1348 		if (mask & AT_ATIME) {
1349 			args.new_attributes.atime.set_it = SET_TO_SERVER_TIME;
1350 		}
1351 		if (mask & AT_MTIME) {
1352 			args.new_attributes.mtime.set_it = SET_TO_SERVER_TIME;
1353 		}
1354 	} else {
1355 		/* Either do not set times or use the client specified times */
1356 		error = vattr_to_sattr3(vap, &args.new_attributes);
1357 	}
1358 
1359 	if (error) {
1360 		/* req time field(s) overflow - return immediately */
1361 		return (error);
1362 	}
1363 
1364 	va.va_mask = AT_MODE | AT_CTIME;
1365 	error = nfs3getattr(vp, &va, cr);
1366 	if (error)
1367 		return (error);
1368 	omode = va.va_mode;
1369 
1370 tryagain:
1371 	if (mask & AT_SIZE) {
1372 		args.guard.check = TRUE;
1373 		args.guard.obj_ctime.seconds = va.va_ctime.tv_sec;
1374 		args.guard.obj_ctime.nseconds = va.va_ctime.tv_nsec;
1375 	} else
1376 		args.guard.check = FALSE;
1377 
1378 	douprintf = 1;
1379 
1380 	t = gethrtime();
1381 
1382 	error = rfs3call(VTOMI(vp), NFSPROC3_SETATTR,
1383 	    xdr_SETATTR3args, (caddr_t)&args,
1384 	    xdr_SETATTR3res, (caddr_t)&res, cr,
1385 	    &douprintf, &res.status, 0, NULL);
1386 
1387 	/*
1388 	 * Purge the access cache and ACL cache if changing either the
1389 	 * owner of the file, the group owner, or the mode.  These may
1390 	 * change the access permissions of the file, so purge old
1391 	 * information and start over again.
1392 	 */
1393 	if (mask & (AT_UID | AT_GID | AT_MODE)) {
1394 		(void) nfs_access_purge_rp(rp);
1395 		if (rp->r_secattr != NULL) {
1396 			mutex_enter(&rp->r_statelock);
1397 			vsp = rp->r_secattr;
1398 			rp->r_secattr = NULL;
1399 			mutex_exit(&rp->r_statelock);
1400 			if (vsp != NULL)
1401 				nfs_acl_free(vsp);
1402 		}
1403 	}
1404 
1405 	if (error) {
1406 		PURGE_ATTRCACHE(vp);
1407 		return (error);
1408 	}
1409 
1410 	error = geterrno3(res.status);
1411 	if (!error) {
1412 		/*
1413 		 * If changing the size of the file, invalidate
1414 		 * any local cached data which is no longer part
1415 		 * of the file.  We also possibly invalidate the
1416 		 * last page in the file.  We could use
1417 		 * pvn_vpzero(), but this would mark the page as
1418 		 * modified and require it to be written back to
1419 		 * the server for no particularly good reason.
1420 		 * This way, if we access it, then we bring it
1421 		 * back in.  A read should be cheaper than a
1422 		 * write.
1423 		 */
1424 		if (mask & AT_SIZE) {
1425 			nfs_invalidate_pages(vp,
1426 			    (vap->va_size & PAGEMASK), cr);
1427 		}
1428 		nfs3_cache_wcc_data(vp, &res.resok.obj_wcc, t, cr);
1429 		/*
1430 		 * Some servers will change the mode to clear the setuid
1431 		 * and setgid bits when changing the uid or gid.  The
1432 		 * client needs to compensate appropriately.
1433 		 */
1434 		if (mask & (AT_UID | AT_GID)) {
1435 			int terror;
1436 
1437 			va.va_mask = AT_MODE;
1438 			terror = nfs3getattr(vp, &va, cr);
1439 			if (!terror &&
1440 			    (((mask & AT_MODE) && va.va_mode != vap->va_mode) ||
1441 			    (!(mask & AT_MODE) && va.va_mode != omode))) {
1442 				va.va_mask = AT_MODE;
1443 				if (mask & AT_MODE)
1444 					va.va_mode = vap->va_mode;
1445 				else
1446 					va.va_mode = omode;
1447 				(void) nfs3setattr(vp, &va, 0, cr);
1448 			}
1449 		}
1450 	} else {
1451 		nfs3_cache_wcc_data(vp, &res.resfail.obj_wcc, t, cr);
1452 		/*
1453 		 * If we got back a "not synchronized" error, then
1454 		 * we need to retry with a new guard value.  The
1455 		 * guard value used is the change time.  If the
1456 		 * server returned post_op_attr, then we can just
1457 		 * retry because we have the latest attributes.
1458 		 * Otherwise, we issue a GETATTR to get the latest
1459 		 * attributes and then retry.  If we couldn't get
1460 		 * the attributes this way either, then we give
1461 		 * up because we can't complete the operation as
1462 		 * required.
1463 		 */
1464 		if (res.status == NFS3ERR_NOT_SYNC) {
1465 			va.va_mask = AT_CTIME;
1466 			if (nfs3getattr(vp, &va, cr) == 0)
1467 				goto tryagain;
1468 		}
1469 		PURGE_STALE_FH(error, vp, cr);
1470 	}
1471 
1472 	return (error);
1473 }
1474 
1475 static int
1476 nfs3_accessx(void *vp, int mode, cred_t *cr)
1477 {
1478 	ASSERT(nfs_zone() == VTOMI((vnode_t *)vp)->mi_zone);
1479 	return (nfs3_access(vp, mode, 0, cr, NULL));
1480 }
1481 
1482 /* ARGSUSED */
1483 static int
1484 nfs3_access(vnode_t *vp, int mode, int flags, cred_t *cr, caller_context_t *ct)
1485 {
1486 	int error;
1487 	ACCESS3args args;
1488 	ACCESS3res res;
1489 	int douprintf;
1490 	uint32 acc;
1491 	rnode_t *rp;
1492 	cred_t *cred, *ncr, *ncrfree = NULL;
1493 	failinfo_t fi;
1494 	nfs_access_type_t cacc;
1495 	hrtime_t t;
1496 
1497 	acc = 0;
1498 	if (nfs_zone() != VTOMI(vp)->mi_zone)
1499 		return (EIO);
1500 	if (mode & VREAD)
1501 		acc |= ACCESS3_READ;
1502 	if (mode & VWRITE) {
1503 		if (vn_is_readonly(vp) && !IS_DEVVP(vp))
1504 			return (EROFS);
1505 		if (vp->v_type == VDIR)
1506 			acc |= ACCESS3_DELETE;
1507 		acc |= ACCESS3_MODIFY | ACCESS3_EXTEND;
1508 	}
1509 	if (mode & VEXEC) {
1510 		if (vp->v_type == VDIR)
1511 			acc |= ACCESS3_LOOKUP;
1512 		else
1513 			acc |= ACCESS3_EXECUTE;
1514 	}
1515 
1516 	rp = VTOR(vp);
1517 	args.object = *VTOFH3(vp);
1518 	if (vp->v_type == VDIR) {
1519 		args.access = ACCESS3_READ | ACCESS3_DELETE | ACCESS3_MODIFY |
1520 		    ACCESS3_EXTEND | ACCESS3_LOOKUP;
1521 	} else {
1522 		args.access = ACCESS3_READ | ACCESS3_MODIFY | ACCESS3_EXTEND |
1523 		    ACCESS3_EXECUTE;
1524 	}
1525 	fi.vp = vp;
1526 	fi.fhp = (caddr_t)&args.object;
1527 	fi.copyproc = nfs3copyfh;
1528 	fi.lookupproc = nfs3lookup;
1529 	fi.xattrdirproc = acl_getxattrdir3;
1530 
1531 	cred = cr;
1532 	/*
1533 	 * ncr and ncrfree both initially
1534 	 * point to the memory area returned
1535 	 * by crnetadjust();
1536 	 * ncrfree not NULL when exiting means
1537 	 * that we need to release it
1538 	 */
1539 	ncr = crnetadjust(cred);
1540 	ncrfree = ncr;
1541 tryagain:
1542 	if (rp->r_acache != NULL) {
1543 		cacc = nfs_access_check(rp, acc, cred);
1544 		if (cacc == NFS_ACCESS_ALLOWED) {
1545 			if (ncrfree != NULL)
1546 				crfree(ncrfree);
1547 			return (0);
1548 		}
1549 		if (cacc == NFS_ACCESS_DENIED) {
1550 			/*
1551 			 * If the cred can be adjusted, try again
1552 			 * with the new cred.
1553 			 */
1554 			if (ncr != NULL) {
1555 				cred = ncr;
1556 				ncr = NULL;
1557 				goto tryagain;
1558 			}
1559 			if (ncrfree != NULL)
1560 				crfree(ncrfree);
1561 			return (EACCES);
1562 		}
1563 	}
1564 
1565 	douprintf = 1;
1566 
1567 	t = gethrtime();
1568 
1569 	error = rfs3call(VTOMI(vp), NFSPROC3_ACCESS,
1570 	    xdr_ACCESS3args, (caddr_t)&args,
1571 	    xdr_ACCESS3res, (caddr_t)&res, cred,
1572 	    &douprintf, &res.status, 0, &fi);
1573 
1574 	if (error) {
1575 		if (ncrfree != NULL)
1576 			crfree(ncrfree);
1577 		return (error);
1578 	}
1579 
1580 	error = geterrno3(res.status);
1581 	if (!error) {
1582 		nfs3_cache_post_op_attr(vp, &res.resok.obj_attributes, t, cr);
1583 		nfs_access_cache(rp, args.access, res.resok.access, cred);
1584 		/*
1585 		 * we just cached results with cred; if cred is the
1586 		 * adjusted credentials from crnetadjust, we do not want
1587 		 * to release them before exiting: hence setting ncrfree
1588 		 * to NULL
1589 		 */
1590 		if (cred != cr)
1591 			ncrfree = NULL;
1592 		if ((acc & res.resok.access) != acc) {
1593 			/*
1594 			 * If the cred can be adjusted, try again
1595 			 * with the new cred.
1596 			 */
1597 			if (ncr != NULL) {
1598 				cred = ncr;
1599 				ncr = NULL;
1600 				goto tryagain;
1601 			}
1602 			error = EACCES;
1603 		}
1604 	} else {
1605 		nfs3_cache_post_op_attr(vp, &res.resfail.obj_attributes, t, cr);
1606 		PURGE_STALE_FH(error, vp, cr);
1607 	}
1608 
1609 	if (ncrfree != NULL)
1610 		crfree(ncrfree);
1611 
1612 	return (error);
1613 }
1614 
1615 static int nfs3_do_symlink_cache = 1;
1616 
1617 /* ARGSUSED */
1618 static int
1619 nfs3_readlink(vnode_t *vp, struct uio *uiop, cred_t *cr, caller_context_t *ct)
1620 {
1621 	int error;
1622 	READLINK3args args;
1623 	READLINK3res res;
1624 	nfspath3 resdata_backup;
1625 	rnode_t *rp;
1626 	int douprintf;
1627 	int len;
1628 	failinfo_t fi;
1629 	hrtime_t t;
1630 
1631 	/*
1632 	 * Can't readlink anything other than a symbolic link.
1633 	 */
1634 	if (vp->v_type != VLNK)
1635 		return (EINVAL);
1636 	if (nfs_zone() != VTOMI(vp)->mi_zone)
1637 		return (EIO);
1638 
1639 	rp = VTOR(vp);
1640 	if (nfs3_do_symlink_cache && rp->r_symlink.contents != NULL) {
1641 		error = nfs3_validate_caches(vp, cr);
1642 		if (error)
1643 			return (error);
1644 		mutex_enter(&rp->r_statelock);
1645 		if (rp->r_symlink.contents != NULL) {
1646 			error = uiomove(rp->r_symlink.contents,
1647 			    rp->r_symlink.len, UIO_READ, uiop);
1648 			mutex_exit(&rp->r_statelock);
1649 			return (error);
1650 		}
1651 		mutex_exit(&rp->r_statelock);
1652 	}
1653 
1654 	args.symlink = *VTOFH3(vp);
1655 	fi.vp = vp;
1656 	fi.fhp = (caddr_t)&args.symlink;
1657 	fi.copyproc = nfs3copyfh;
1658 	fi.lookupproc = nfs3lookup;
1659 	fi.xattrdirproc = acl_getxattrdir3;
1660 
1661 	res.resok.data = kmem_alloc(MAXPATHLEN, KM_SLEEP);
1662 
1663 	resdata_backup = res.resok.data;
1664 
1665 	douprintf = 1;
1666 
1667 	t = gethrtime();
1668 
1669 	error = rfs3call(VTOMI(vp), NFSPROC3_READLINK,
1670 	    xdr_nfs_fh3, (caddr_t)&args,
1671 	    xdr_READLINK3res, (caddr_t)&res, cr,
1672 	    &douprintf, &res.status, 0, &fi);
1673 
1674 	if (res.resok.data == nfs3nametoolong)
1675 		error = EINVAL;
1676 
1677 	if (error) {
1678 		kmem_free(resdata_backup, MAXPATHLEN);
1679 		return (error);
1680 	}
1681 
1682 	error = geterrno3(res.status);
1683 	if (!error) {
1684 		nfs3_cache_post_op_attr(vp, &res.resok.symlink_attributes, t,
1685 		    cr);
1686 		len = strlen(res.resok.data);
1687 		error = uiomove(res.resok.data, len, UIO_READ, uiop);
1688 		if (nfs3_do_symlink_cache && rp->r_symlink.contents == NULL) {
1689 			mutex_enter(&rp->r_statelock);
1690 				if (rp->r_symlink.contents == NULL) {
1691 				rp->r_symlink.contents = res.resok.data;
1692 				rp->r_symlink.len = len;
1693 				rp->r_symlink.size = MAXPATHLEN;
1694 				mutex_exit(&rp->r_statelock);
1695 			} else {
1696 				mutex_exit(&rp->r_statelock);
1697 
1698 				kmem_free((void *)res.resok.data, MAXPATHLEN);
1699 			}
1700 		} else {
1701 			kmem_free((void *)res.resok.data, MAXPATHLEN);
1702 		}
1703 	} else {
1704 		nfs3_cache_post_op_attr(vp,
1705 		    &res.resfail.symlink_attributes, t, cr);
1706 		PURGE_STALE_FH(error, vp, cr);
1707 
1708 		kmem_free((void *)res.resok.data, MAXPATHLEN);
1709 
1710 	}
1711 
1712 	/*
1713 	 * The over the wire error for attempting to readlink something
1714 	 * other than a symbolic link is ENXIO.  However, we need to
1715 	 * return EINVAL instead of ENXIO, so we map it here.
1716 	 */
1717 	return (error == ENXIO ? EINVAL : error);
1718 }
1719 
1720 /*
1721  * Flush local dirty pages to stable storage on the server.
1722  *
1723  * If FNODSYNC is specified, then there is nothing to do because
1724  * metadata changes are not cached on the client before being
1725  * sent to the server.
1726  */
1727 /* ARGSUSED */
1728 static int
1729 nfs3_fsync(vnode_t *vp, int syncflag, cred_t *cr, caller_context_t *ct)
1730 {
1731 	int error;
1732 
1733 	if ((syncflag & FNODSYNC) || IS_SWAPVP(vp))
1734 		return (0);
1735 	if (nfs_zone() != VTOMI(vp)->mi_zone)
1736 		return (EIO);
1737 
1738 	error = nfs3_putpage_commit(vp, (offset_t)0, 0, cr);
1739 	if (!error)
1740 		error = VTOR(vp)->r_error;
1741 	return (error);
1742 }
1743 
1744 /*
1745  * Weirdness: if the file was removed or the target of a rename
1746  * operation while it was open, it got renamed instead.  Here we
1747  * remove the renamed file.
1748  */
1749 /* ARGSUSED */
1750 static void
1751 nfs3_inactive(vnode_t *vp, cred_t *cr, caller_context_t *ct)
1752 {
1753 	rnode_t *rp;
1754 
1755 	ASSERT(vp != DNLC_NO_VNODE);
1756 
1757 	/*
1758 	 * If this is coming from the wrong zone, we let someone in the right
1759 	 * zone take care of it asynchronously.  We can get here due to
1760 	 * VN_RELE() being called from pageout() or fsflush().  This call may
1761 	 * potentially turn into an expensive no-op if, for instance, v_count
1762 	 * gets incremented in the meantime, but it's still correct.
1763 	 */
1764 	if (nfs_zone() != VTOMI(vp)->mi_zone) {
1765 		nfs_async_inactive(vp, cr, nfs3_inactive);
1766 		return;
1767 	}
1768 
1769 	rp = VTOR(vp);
1770 redo:
1771 	if (rp->r_unldvp != NULL) {
1772 		/*
1773 		 * Save the vnode pointer for the directory where the
1774 		 * unlinked-open file got renamed, then set it to NULL
1775 		 * to prevent another thread from getting here before
1776 		 * we're done with the remove.  While we have the
1777 		 * statelock, make local copies of the pertinent rnode
1778 		 * fields.  If we weren't to do this in an atomic way, the
1779 		 * the unl* fields could become inconsistent with respect
1780 		 * to each other due to a race condition between this
1781 		 * code and nfs_remove().  See bug report 1034328.
1782 		 */
1783 		mutex_enter(&rp->r_statelock);
1784 		if (rp->r_unldvp != NULL) {
1785 			vnode_t *unldvp;
1786 			char *unlname;
1787 			cred_t *unlcred;
1788 			REMOVE3args args;
1789 			REMOVE3res res;
1790 			int douprintf;
1791 			int error;
1792 			hrtime_t t;
1793 
1794 			unldvp = rp->r_unldvp;
1795 			rp->r_unldvp = NULL;
1796 			unlname = rp->r_unlname;
1797 			rp->r_unlname = NULL;
1798 			unlcred = rp->r_unlcred;
1799 			rp->r_unlcred = NULL;
1800 			mutex_exit(&rp->r_statelock);
1801 
1802 			/*
1803 			 * If there are any dirty pages left, then flush
1804 			 * them.  This is unfortunate because they just
1805 			 * may get thrown away during the remove operation,
1806 			 * but we have to do this for correctness.
1807 			 */
1808 			if (vn_has_cached_data(vp) &&
1809 			    ((rp->r_flags & RDIRTY) || rp->r_count > 0)) {
1810 				ASSERT(vp->v_type != VCHR);
1811 				error = nfs3_putpage(vp, (offset_t)0, 0, 0,
1812 						cr, ct);
1813 				if (error) {
1814 					mutex_enter(&rp->r_statelock);
1815 					if (!rp->r_error)
1816 						rp->r_error = error;
1817 					mutex_exit(&rp->r_statelock);
1818 				}
1819 			}
1820 
1821 			/*
1822 			 * Do the remove operation on the renamed file
1823 			 */
1824 			setdiropargs3(&args.object, unlname, unldvp);
1825 
1826 			douprintf = 1;
1827 
1828 			t = gethrtime();
1829 
1830 			error = rfs3call(VTOMI(unldvp), NFSPROC3_REMOVE,
1831 			    xdr_diropargs3, (caddr_t)&args,
1832 			    xdr_REMOVE3res, (caddr_t)&res, unlcred,
1833 			    &douprintf, &res.status, 0, NULL);
1834 
1835 			if (error) {
1836 				PURGE_ATTRCACHE(unldvp);
1837 			} else {
1838 				error = geterrno3(res.status);
1839 				if (!error) {
1840 					nfs3_cache_wcc_data(unldvp,
1841 					    &res.resok.dir_wcc, t, cr);
1842 					if (HAVE_RDDIR_CACHE(VTOR(unldvp)))
1843 						nfs_purge_rddir_cache(unldvp);
1844 				} else {
1845 					nfs3_cache_wcc_data(unldvp,
1846 					    &res.resfail.dir_wcc, t, cr);
1847 					PURGE_STALE_FH(error, unldvp, cr);
1848 				}
1849 			}
1850 
1851 			/*
1852 			 * Release stuff held for the remove
1853 			 */
1854 			VN_RELE(unldvp);
1855 			kmem_free(unlname, MAXNAMELEN);
1856 			crfree(unlcred);
1857 			goto redo;
1858 		}
1859 		mutex_exit(&rp->r_statelock);
1860 	}
1861 
1862 	rp_addfree(rp, cr);
1863 }
1864 
1865 /*
1866  * Remote file system operations having to do with directory manipulation.
1867  */
1868 
1869 /* ARGSUSED */
1870 static int
1871 nfs3_lookup(vnode_t *dvp, char *nm, vnode_t **vpp, struct pathname *pnp,
1872 	int flags, vnode_t *rdir, cred_t *cr, caller_context_t *ct,
1873 	int *direntflags, pathname_t *realpnp)
1874 {
1875 	int error;
1876 	vnode_t *vp;
1877 	vnode_t *avp = NULL;
1878 	rnode_t *drp;
1879 
1880 	if (nfs_zone() != VTOMI(dvp)->mi_zone)
1881 		return (EPERM);
1882 
1883 	drp = VTOR(dvp);
1884 
1885 	/*
1886 	 * Are we looking up extended attributes?  If so, "dvp" is
1887 	 * the file or directory for which we want attributes, and
1888 	 * we need a lookup of the hidden attribute directory
1889 	 * before we lookup the rest of the path.
1890 	 */
1891 	if (flags & LOOKUP_XATTR) {
1892 		bool_t cflag = ((flags & CREATE_XATTR_DIR) != 0);
1893 		mntinfo_t *mi;
1894 
1895 		mi = VTOMI(dvp);
1896 		if (!(mi->mi_flags & MI_EXTATTR))
1897 			return (EINVAL);
1898 
1899 		if (nfs_rw_enter_sig(&drp->r_rwlock, RW_READER, INTR(dvp)))
1900 			return (EINTR);
1901 
1902 		(void) nfs3lookup_dnlc(dvp, XATTR_DIR_NAME, &avp, cr);
1903 		if (avp == NULL)
1904 			error = acl_getxattrdir3(dvp, &avp, cflag, cr, 0);
1905 		else
1906 			error = 0;
1907 
1908 		nfs_rw_exit(&drp->r_rwlock);
1909 
1910 		if (error) {
1911 			if (mi->mi_flags & MI_EXTATTR)
1912 				return (error);
1913 			return (EINVAL);
1914 		}
1915 		dvp = avp;
1916 		drp = VTOR(dvp);
1917 	}
1918 
1919 	if (nfs_rw_enter_sig(&drp->r_rwlock, RW_READER, INTR(dvp))) {
1920 		error = EINTR;
1921 		goto out;
1922 	}
1923 
1924 	error = nfs3lookup(dvp, nm, vpp, pnp, flags, rdir, cr, 0);
1925 
1926 	nfs_rw_exit(&drp->r_rwlock);
1927 
1928 	/*
1929 	 * If vnode is a device, create special vnode.
1930 	 */
1931 	if (!error && IS_DEVVP(*vpp)) {
1932 		vp = *vpp;
1933 		*vpp = specvp(vp, vp->v_rdev, vp->v_type, cr);
1934 		VN_RELE(vp);
1935 	}
1936 
1937 out:
1938 	if (avp != NULL)
1939 		VN_RELE(avp);
1940 
1941 	return (error);
1942 }
1943 
1944 static int nfs3_lookup_neg_cache = 1;
1945 
1946 #ifdef DEBUG
1947 static int nfs3_lookup_dnlc_hits = 0;
1948 static int nfs3_lookup_dnlc_misses = 0;
1949 static int nfs3_lookup_dnlc_neg_hits = 0;
1950 static int nfs3_lookup_dnlc_disappears = 0;
1951 static int nfs3_lookup_dnlc_lookups = 0;
1952 #endif
1953 
1954 /* ARGSUSED */
1955 int
1956 nfs3lookup(vnode_t *dvp, char *nm, vnode_t **vpp, struct pathname *pnp,
1957 	int flags, vnode_t *rdir, cred_t *cr, int rfscall_flags)
1958 {
1959 	int error;
1960 	rnode_t *drp;
1961 
1962 	ASSERT(nfs_zone() == VTOMI(dvp)->mi_zone);
1963 	/*
1964 	 * If lookup is for "", just return dvp.  Don't need
1965 	 * to send it over the wire, look it up in the dnlc,
1966 	 * or perform any access checks.
1967 	 */
1968 	if (*nm == '\0') {
1969 		VN_HOLD(dvp);
1970 		*vpp = dvp;
1971 		return (0);
1972 	}
1973 
1974 	/*
1975 	 * Can't do lookups in non-directories.
1976 	 */
1977 	if (dvp->v_type != VDIR)
1978 		return (ENOTDIR);
1979 
1980 	/*
1981 	 * If we're called with RFSCALL_SOFT, it's important that
1982 	 * the only rfscall is one we make directly; if we permit
1983 	 * an access call because we're looking up "." or validating
1984 	 * a dnlc hit, we'll deadlock because that rfscall will not
1985 	 * have the RFSCALL_SOFT set.
1986 	 */
1987 	if (rfscall_flags & RFSCALL_SOFT)
1988 		goto callit;
1989 
1990 	/*
1991 	 * If lookup is for ".", just return dvp.  Don't need
1992 	 * to send it over the wire or look it up in the dnlc,
1993 	 * just need to check access.
1994 	 */
1995 	if (strcmp(nm, ".") == 0) {
1996 		error = nfs3_access(dvp, VEXEC, 0, cr, NULL);
1997 		if (error)
1998 			return (error);
1999 		VN_HOLD(dvp);
2000 		*vpp = dvp;
2001 		return (0);
2002 	}
2003 
2004 	drp = VTOR(dvp);
2005 	if (!(drp->r_flags & RLOOKUP)) {
2006 		mutex_enter(&drp->r_statelock);
2007 		drp->r_flags |= RLOOKUP;
2008 		mutex_exit(&drp->r_statelock);
2009 	}
2010 
2011 	/*
2012 	 * Lookup this name in the DNLC.  If there was a valid entry,
2013 	 * then return the results of the lookup.
2014 	 */
2015 	error = nfs3lookup_dnlc(dvp, nm, vpp, cr);
2016 	if (error || *vpp != NULL)
2017 		return (error);
2018 
2019 callit:
2020 	error = nfs3lookup_otw(dvp, nm, vpp, cr, rfscall_flags);
2021 
2022 	return (error);
2023 }
2024 
2025 static int
2026 nfs3lookup_dnlc(vnode_t *dvp, char *nm, vnode_t **vpp, cred_t *cr)
2027 {
2028 	int error;
2029 	vnode_t *vp;
2030 
2031 	ASSERT(*nm != '\0');
2032 	ASSERT(nfs_zone() == VTOMI(dvp)->mi_zone);
2033 	/*
2034 	 * Lookup this name in the DNLC.  If successful, then validate
2035 	 * the caches and then recheck the DNLC.  The DNLC is rechecked
2036 	 * just in case this entry got invalidated during the call
2037 	 * to nfs3_validate_caches.
2038 	 *
2039 	 * An assumption is being made that it is safe to say that a
2040 	 * file exists which may not on the server.  Any operations to
2041 	 * the server will fail with ESTALE.
2042 	 */
2043 #ifdef DEBUG
2044 	nfs3_lookup_dnlc_lookups++;
2045 #endif
2046 	vp = dnlc_lookup(dvp, nm);
2047 	if (vp != NULL) {
2048 		VN_RELE(vp);
2049 		if (vp == DNLC_NO_VNODE && !vn_is_readonly(dvp)) {
2050 			PURGE_ATTRCACHE(dvp);
2051 		}
2052 		error = nfs3_validate_caches(dvp, cr);
2053 		if (error)
2054 			return (error);
2055 		vp = dnlc_lookup(dvp, nm);
2056 		if (vp != NULL) {
2057 			error = nfs3_access(dvp, VEXEC, 0, cr, NULL);
2058 			if (error) {
2059 				VN_RELE(vp);
2060 				return (error);
2061 			}
2062 			if (vp == DNLC_NO_VNODE) {
2063 				VN_RELE(vp);
2064 #ifdef DEBUG
2065 				nfs3_lookup_dnlc_neg_hits++;
2066 #endif
2067 				return (ENOENT);
2068 			}
2069 			*vpp = vp;
2070 #ifdef DEBUG
2071 			nfs3_lookup_dnlc_hits++;
2072 #endif
2073 			return (0);
2074 		}
2075 #ifdef DEBUG
2076 		nfs3_lookup_dnlc_disappears++;
2077 #endif
2078 	}
2079 #ifdef DEBUG
2080 	else
2081 		nfs3_lookup_dnlc_misses++;
2082 #endif
2083 
2084 	*vpp = NULL;
2085 
2086 	return (0);
2087 }
2088 
2089 static int
2090 nfs3lookup_otw(vnode_t *dvp, char *nm, vnode_t **vpp, cred_t *cr,
2091 	int rfscall_flags)
2092 {
2093 	int error;
2094 	LOOKUP3args args;
2095 	LOOKUP3vres res;
2096 	int douprintf;
2097 	struct vattr vattr;
2098 	struct vattr dvattr;
2099 	vnode_t *vp;
2100 	failinfo_t fi;
2101 	hrtime_t t;
2102 
2103 	ASSERT(*nm != '\0');
2104 	ASSERT(dvp->v_type == VDIR);
2105 	ASSERT(nfs_zone() == VTOMI(dvp)->mi_zone);
2106 
2107 	setdiropargs3(&args.what, nm, dvp);
2108 
2109 	fi.vp = dvp;
2110 	fi.fhp = (caddr_t)&args.what.dir;
2111 	fi.copyproc = nfs3copyfh;
2112 	fi.lookupproc = nfs3lookup;
2113 	fi.xattrdirproc = acl_getxattrdir3;
2114 	res.obj_attributes.fres.vp = dvp;
2115 	res.obj_attributes.fres.vap = &vattr;
2116 	res.dir_attributes.fres.vp = dvp;
2117 	res.dir_attributes.fres.vap = &dvattr;
2118 
2119 	douprintf = 1;
2120 
2121 	t = gethrtime();
2122 
2123 	error = rfs3call(VTOMI(dvp), NFSPROC3_LOOKUP,
2124 	    xdr_diropargs3, (caddr_t)&args,
2125 	    xdr_LOOKUP3vres, (caddr_t)&res, cr,
2126 	    &douprintf, &res.status, rfscall_flags, &fi);
2127 
2128 	if (error)
2129 		return (error);
2130 
2131 	nfs3_cache_post_op_vattr(dvp, &res.dir_attributes, t, cr);
2132 
2133 	error = geterrno3(res.status);
2134 	if (error) {
2135 		PURGE_STALE_FH(error, dvp, cr);
2136 		if (error == ENOENT && nfs3_lookup_neg_cache)
2137 			dnlc_enter(dvp, nm, DNLC_NO_VNODE);
2138 		return (error);
2139 	}
2140 
2141 	if (res.obj_attributes.attributes) {
2142 		vp = makenfs3node_va(&res.object, res.obj_attributes.fres.vap,
2143 				dvp->v_vfsp, t, cr, VTOR(dvp)->r_path, nm);
2144 	} else {
2145 		vp = makenfs3node_va(&res.object, NULL,
2146 				dvp->v_vfsp, t, cr, VTOR(dvp)->r_path, nm);
2147 		if (vp->v_type == VNON) {
2148 			vattr.va_mask = AT_TYPE;
2149 			error = nfs3getattr(vp, &vattr, cr);
2150 			if (error) {
2151 				VN_RELE(vp);
2152 				return (error);
2153 			}
2154 			vp->v_type = vattr.va_type;
2155 		}
2156 	}
2157 
2158 	if (!(rfscall_flags & RFSCALL_SOFT))
2159 		dnlc_update(dvp, nm, vp);
2160 
2161 	*vpp = vp;
2162 
2163 	return (error);
2164 }
2165 
2166 #ifdef DEBUG
2167 static int nfs3_create_misses = 0;
2168 #endif
2169 
2170 /* ARGSUSED */
2171 static int
2172 nfs3_create(vnode_t *dvp, char *nm, struct vattr *va, enum vcexcl exclusive,
2173 	int mode, vnode_t **vpp, cred_t *cr, int lfaware, caller_context_t *ct,
2174 	vsecattr_t *vsecp)
2175 {
2176 	int error;
2177 	vnode_t *vp;
2178 	rnode_t *rp;
2179 	struct vattr vattr;
2180 	rnode_t *drp;
2181 	vnode_t *tempvp;
2182 
2183 	drp = VTOR(dvp);
2184 	if (nfs_zone() != VTOMI(dvp)->mi_zone)
2185 		return (EPERM);
2186 	if (nfs_rw_enter_sig(&drp->r_rwlock, RW_WRITER, INTR(dvp)))
2187 		return (EINTR);
2188 
2189 top:
2190 	/*
2191 	 * We make a copy of the attributes because the caller does not
2192 	 * expect us to change what va points to.
2193 	 */
2194 	vattr = *va;
2195 
2196 	/*
2197 	 * If the pathname is "", just use dvp.  Don't need
2198 	 * to send it over the wire, look it up in the dnlc,
2199 	 * or perform any access checks.
2200 	 */
2201 	if (*nm == '\0') {
2202 		error = 0;
2203 		VN_HOLD(dvp);
2204 		vp = dvp;
2205 	/*
2206 	 * If the pathname is ".", just use dvp.  Don't need
2207 	 * to send it over the wire or look it up in the dnlc,
2208 	 * just need to check access.
2209 	 */
2210 	} else if (strcmp(nm, ".") == 0) {
2211 		error = nfs3_access(dvp, VEXEC, 0, cr, ct);
2212 		if (error) {
2213 			nfs_rw_exit(&drp->r_rwlock);
2214 			return (error);
2215 		}
2216 		VN_HOLD(dvp);
2217 		vp = dvp;
2218 	/*
2219 	 * We need to go over the wire, just to be sure whether the
2220 	 * file exists or not.  Using the DNLC can be dangerous in
2221 	 * this case when making a decision regarding existence.
2222 	 */
2223 	} else {
2224 		error = nfs3lookup_otw(dvp, nm, &vp, cr, 0);
2225 	}
2226 	if (!error) {
2227 		if (exclusive == EXCL)
2228 			error = EEXIST;
2229 		else if (vp->v_type == VDIR && (mode & VWRITE))
2230 			error = EISDIR;
2231 		else {
2232 			/*
2233 			 * If vnode is a device, create special vnode.
2234 			 */
2235 			if (IS_DEVVP(vp)) {
2236 				tempvp = vp;
2237 				vp = specvp(vp, vp->v_rdev, vp->v_type, cr);
2238 				VN_RELE(tempvp);
2239 			}
2240 			if (!(error = VOP_ACCESS(vp, mode, 0, cr, ct))) {
2241 				if ((vattr.va_mask & AT_SIZE) &&
2242 				    vp->v_type == VREG) {
2243 					rp = VTOR(vp);
2244 					/*
2245 					 * Check here for large file handled
2246 					 * by LF-unaware process (as
2247 					 * ufs_create() does)
2248 					 */
2249 					if (!(lfaware & FOFFMAX)) {
2250 						mutex_enter(&rp->r_statelock);
2251 						if (rp->r_size > MAXOFF32_T)
2252 							error = EOVERFLOW;
2253 						mutex_exit(&rp->r_statelock);
2254 					}
2255 					if (!error) {
2256 						vattr.va_mask = AT_SIZE;
2257 						error = nfs3setattr(vp,
2258 						    &vattr, 0, cr);
2259 					}
2260 				}
2261 			}
2262 		}
2263 		nfs_rw_exit(&drp->r_rwlock);
2264 		if (error) {
2265 			VN_RELE(vp);
2266 		} else {
2267 			/*
2268 			 * existing file got truncated, notify.
2269 			 */
2270 			vnevent_create(vp, ct);
2271 			*vpp = vp;
2272 		}
2273 		return (error);
2274 	}
2275 
2276 	dnlc_remove(dvp, nm);
2277 
2278 	/*
2279 	 * Decide what the group-id of the created file should be.
2280 	 * Set it in attribute list as advisory...
2281 	 */
2282 	error = setdirgid(dvp, &vattr.va_gid, cr);
2283 	if (error) {
2284 		nfs_rw_exit(&drp->r_rwlock);
2285 		return (error);
2286 	}
2287 	vattr.va_mask |= AT_GID;
2288 
2289 	ASSERT(vattr.va_mask & AT_TYPE);
2290 	if (vattr.va_type == VREG) {
2291 		ASSERT(vattr.va_mask & AT_MODE);
2292 		if (MANDMODE(vattr.va_mode)) {
2293 			nfs_rw_exit(&drp->r_rwlock);
2294 			return (EACCES);
2295 		}
2296 		error = nfs3create(dvp, nm, &vattr, exclusive, mode, vpp, cr,
2297 		    lfaware);
2298 		/*
2299 		 * If this is not an exclusive create, then the CREATE
2300 		 * request will be made with the GUARDED mode set.  This
2301 		 * means that the server will return EEXIST if the file
2302 		 * exists.  The file could exist because of a retransmitted
2303 		 * request.  In this case, we recover by starting over and
2304 		 * checking to see whether the file exists.  This second
2305 		 * time through it should and a CREATE request will not be
2306 		 * sent.
2307 		 *
2308 		 * This handles the problem of a dangling CREATE request
2309 		 * which contains attributes which indicate that the file
2310 		 * should be truncated.  This retransmitted request could
2311 		 * possibly truncate valid data in the file if not caught
2312 		 * by the duplicate request mechanism on the server or if
2313 		 * not caught by other means.  The scenario is:
2314 		 *
2315 		 * Client transmits CREATE request with size = 0
2316 		 * Client times out, retransmits request.
2317 		 * Response to the first request arrives from the server
2318 		 *  and the client proceeds on.
2319 		 * Client writes data to the file.
2320 		 * The server now processes retransmitted CREATE request
2321 		 *  and truncates file.
2322 		 *
2323 		 * The use of the GUARDED CREATE request prevents this from
2324 		 * happening because the retransmitted CREATE would fail
2325 		 * with EEXIST and would not truncate the file.
2326 		 */
2327 		if (error == EEXIST && exclusive == NONEXCL) {
2328 #ifdef DEBUG
2329 			nfs3_create_misses++;
2330 #endif
2331 			goto top;
2332 		}
2333 		nfs_rw_exit(&drp->r_rwlock);
2334 		return (error);
2335 	}
2336 	error = nfs3mknod(dvp, nm, &vattr, exclusive, mode, vpp, cr);
2337 	nfs_rw_exit(&drp->r_rwlock);
2338 	return (error);
2339 }
2340 
2341 /* ARGSUSED */
2342 static int
2343 nfs3create(vnode_t *dvp, char *nm, struct vattr *va, enum vcexcl exclusive,
2344 	int mode, vnode_t **vpp, cred_t *cr, int lfaware)
2345 {
2346 	int error;
2347 	CREATE3args args;
2348 	CREATE3res res;
2349 	int douprintf;
2350 	vnode_t *vp;
2351 	struct vattr vattr;
2352 	nfstime3 *verfp;
2353 	rnode_t *rp;
2354 	timestruc_t now;
2355 	hrtime_t t;
2356 
2357 	ASSERT(nfs_zone() == VTOMI(dvp)->mi_zone);
2358 	setdiropargs3(&args.where, nm, dvp);
2359 	if (exclusive == EXCL) {
2360 		args.how.mode = EXCLUSIVE;
2361 		/*
2362 		 * Construct the create verifier.  This verifier needs
2363 		 * to be unique between different clients.  It also needs
2364 		 * to vary for each exclusive create request generated
2365 		 * from the client to the server.
2366 		 *
2367 		 * The first attempt is made to use the hostid and a
2368 		 * unique number on the client.  If the hostid has not
2369 		 * been set, the high resolution time that the exclusive
2370 		 * create request is being made is used.  This will work
2371 		 * unless two different clients, both with the hostid
2372 		 * not set, attempt an exclusive create request on the
2373 		 * same file, at exactly the same clock time.  The
2374 		 * chances of this happening seem small enough to be
2375 		 * reasonable.
2376 		 */
2377 		verfp = (nfstime3 *)&args.how.createhow3_u.verf;
2378 		verfp->seconds = nfs_atoi(hw_serial);
2379 		if (verfp->seconds != 0)
2380 			verfp->nseconds = newnum();
2381 		else {
2382 			gethrestime(&now);
2383 			verfp->seconds = now.tv_sec;
2384 			verfp->nseconds = now.tv_nsec;
2385 		}
2386 		/*
2387 		 * Since the server will use this value for the mtime,
2388 		 * make sure that it can't overflow. Zero out the MSB.
2389 		 * The actual value does not matter here, only its uniqeness.
2390 		 */
2391 		verfp->seconds %= INT32_MAX;
2392 	} else {
2393 		/*
2394 		 * Issue the non-exclusive create in guarded mode.  This
2395 		 * may result in some false EEXIST responses for
2396 		 * retransmitted requests, but these will be handled at
2397 		 * a higher level.  By using GUARDED, duplicate requests
2398 		 * to do file truncation and possible access problems
2399 		 * can be avoided.
2400 		 */
2401 		args.how.mode = GUARDED;
2402 		error = vattr_to_sattr3(va,
2403 				&args.how.createhow3_u.obj_attributes);
2404 		if (error) {
2405 			/* req time field(s) overflow - return immediately */
2406 			return (error);
2407 		}
2408 	}
2409 
2410 	douprintf = 1;
2411 
2412 	t = gethrtime();
2413 
2414 	error = rfs3call(VTOMI(dvp), NFSPROC3_CREATE,
2415 	    xdr_CREATE3args, (caddr_t)&args,
2416 	    xdr_CREATE3res, (caddr_t)&res, cr,
2417 	    &douprintf, &res.status, 0, NULL);
2418 
2419 	if (error) {
2420 		PURGE_ATTRCACHE(dvp);
2421 		return (error);
2422 	}
2423 
2424 	error = geterrno3(res.status);
2425 	if (!error) {
2426 		nfs3_cache_wcc_data(dvp, &res.resok.dir_wcc, t, cr);
2427 		if (HAVE_RDDIR_CACHE(VTOR(dvp)))
2428 			nfs_purge_rddir_cache(dvp);
2429 
2430 		/*
2431 		 * On exclusive create the times need to be explicitly
2432 		 * set to clear any potential verifier that may be stored
2433 		 * in one of these fields (see comment below).  This
2434 		 * is done here to cover the case where no post op attrs
2435 		 * were returned or a 'invalid' time was returned in
2436 		 * the attributes.
2437 		 */
2438 		if (exclusive == EXCL)
2439 			va->va_mask |= (AT_MTIME | AT_ATIME);
2440 
2441 		if (!res.resok.obj.handle_follows) {
2442 			error = nfs3lookup(dvp, nm, &vp, NULL, 0, NULL, cr, 0);
2443 			if (error)
2444 				return (error);
2445 		} else {
2446 			if (res.resok.obj_attributes.attributes) {
2447 				vp = makenfs3node(&res.resok.obj.handle,
2448 				    &res.resok.obj_attributes.attr,
2449 				    dvp->v_vfsp, t, cr, NULL, NULL);
2450 			} else {
2451 				vp = makenfs3node(&res.resok.obj.handle, NULL,
2452 				    dvp->v_vfsp, t, cr, NULL, NULL);
2453 
2454 				/*
2455 				 * On an exclusive create, it is possible
2456 				 * that attributes were returned but those
2457 				 * postop attributes failed to decode
2458 				 * properly.  If this is the case,
2459 				 * then most likely the atime or mtime
2460 				 * were invalid for our client; this
2461 				 * is caused by the server storing the
2462 				 * create verifier in one of the time
2463 				 * fields(most likely mtime).
2464 				 * So... we are going to setattr just the
2465 				 * atime/mtime to clear things up.
2466 				 */
2467 				if (exclusive == EXCL) {
2468 					if (error =
2469 						nfs3excl_create_settimes(vp,
2470 							va, cr)) {
2471 						/*
2472 						 * Setting the times failed.
2473 						 * Remove the file and return
2474 						 * the error.
2475 						 */
2476 						VN_RELE(vp);
2477 						(void) nfs3_remove(dvp,
2478 							nm, cr, NULL, 0);
2479 						return (error);
2480 					}
2481 				}
2482 
2483 				/*
2484 				 * This handles the non-exclusive case
2485 				 * and the exclusive case where no post op
2486 				 * attrs were returned.
2487 				 */
2488 				if (vp->v_type == VNON) {
2489 					vattr.va_mask = AT_TYPE;
2490 					error = nfs3getattr(vp, &vattr, cr);
2491 					if (error) {
2492 						VN_RELE(vp);
2493 						return (error);
2494 					}
2495 					vp->v_type = vattr.va_type;
2496 				}
2497 			}
2498 			dnlc_update(dvp, nm, vp);
2499 		}
2500 
2501 		rp = VTOR(vp);
2502 
2503 		/*
2504 		 * Check here for large file handled by
2505 		 * LF-unaware process (as ufs_create() does)
2506 		 */
2507 		if ((va->va_mask & AT_SIZE) && vp->v_type == VREG &&
2508 		    !(lfaware & FOFFMAX)) {
2509 			mutex_enter(&rp->r_statelock);
2510 			if (rp->r_size > MAXOFF32_T) {
2511 				mutex_exit(&rp->r_statelock);
2512 				VN_RELE(vp);
2513 				return (EOVERFLOW);
2514 			}
2515 			mutex_exit(&rp->r_statelock);
2516 		}
2517 
2518 		if (exclusive == EXCL &&
2519 			(va->va_mask & ~(AT_GID | AT_SIZE))) {
2520 			/*
2521 			 * If doing an exclusive create, then generate
2522 			 * a SETATTR to set the initial attributes.
2523 			 * Try to set the mtime and the atime to the
2524 			 * server's current time.  It is somewhat
2525 			 * expected that these fields will be used to
2526 			 * store the exclusive create cookie.  If not,
2527 			 * server implementors will need to know that
2528 			 * a SETATTR will follow an exclusive create
2529 			 * and the cookie should be destroyed if
2530 			 * appropriate. This work may have been done
2531 			 * earlier in this function if post op attrs
2532 			 * were not available.
2533 			 *
2534 			 * The AT_GID and AT_SIZE bits are turned off
2535 			 * so that the SETATTR request will not attempt
2536 			 * to process these.  The gid will be set
2537 			 * separately if appropriate.  The size is turned
2538 			 * off because it is assumed that a new file will
2539 			 * be created empty and if the file wasn't empty,
2540 			 * then the exclusive create will have failed
2541 			 * because the file must have existed already.
2542 			 * Therefore, no truncate operation is needed.
2543 			 */
2544 			va->va_mask &= ~(AT_GID | AT_SIZE);
2545 			error = nfs3setattr(vp, va, 0, cr);
2546 			if (error) {
2547 				/*
2548 				 * Couldn't correct the attributes of
2549 				 * the newly created file and the
2550 				 * attributes are wrong.  Remove the
2551 				 * file and return an error to the
2552 				 * application.
2553 				 */
2554 				VN_RELE(vp);
2555 				(void) nfs3_remove(dvp, nm, cr, NULL, 0);
2556 				return (error);
2557 			}
2558 		}
2559 
2560 		if (va->va_gid != rp->r_attr.va_gid) {
2561 			/*
2562 			 * If the gid on the file isn't right, then
2563 			 * generate a SETATTR to attempt to change
2564 			 * it.  This may or may not work, depending
2565 			 * upon the server's semantics for allowing
2566 			 * file ownership changes.
2567 			 */
2568 			va->va_mask = AT_GID;
2569 			(void) nfs3setattr(vp, va, 0, cr);
2570 		}
2571 
2572 		/*
2573 		 * If vnode is a device create special vnode
2574 		 */
2575 		if (IS_DEVVP(vp)) {
2576 			*vpp = specvp(vp, vp->v_rdev, vp->v_type, cr);
2577 			VN_RELE(vp);
2578 		} else
2579 			*vpp = vp;
2580 	} else {
2581 		nfs3_cache_wcc_data(dvp, &res.resfail.dir_wcc, t, cr);
2582 		PURGE_STALE_FH(error, dvp, cr);
2583 	}
2584 
2585 	return (error);
2586 }
2587 
2588 /*
2589  * Special setattr function to take care of rest of atime/mtime
2590  * after successful exclusive create.  This function exists to avoid
2591  * handling attributes from the server; exclusive the atime/mtime fields
2592  * may be 'invalid' in client's view and therefore can not be trusted.
2593  */
2594 static int
2595 nfs3excl_create_settimes(vnode_t *vp, struct vattr *vap, cred_t *cr)
2596 {
2597 	int error;
2598 	uint_t mask;
2599 	SETATTR3args args;
2600 	SETATTR3res res;
2601 	int douprintf;
2602 	rnode_t *rp;
2603 	hrtime_t t;
2604 
2605 	ASSERT(nfs_zone() == VTOMI(vp)->mi_zone);
2606 	/* save the caller's mask so that it can be reset later */
2607 	mask = vap->va_mask;
2608 
2609 	rp = VTOR(vp);
2610 
2611 	args.object = *RTOFH3(rp);
2612 	args.guard.check = FALSE;
2613 
2614 	/* Use the mask to initialize the arguments */
2615 	vap->va_mask = 0;
2616 	error = vattr_to_sattr3(vap, &args.new_attributes);
2617 
2618 	/* We want to set just atime/mtime on this request */
2619 	args.new_attributes.atime.set_it = SET_TO_SERVER_TIME;
2620 	args.new_attributes.mtime.set_it = SET_TO_SERVER_TIME;
2621 
2622 	douprintf = 1;
2623 
2624 	t = gethrtime();
2625 
2626 	error = rfs3call(VTOMI(vp), NFSPROC3_SETATTR,
2627 	    xdr_SETATTR3args, (caddr_t)&args,
2628 	    xdr_SETATTR3res, (caddr_t)&res, cr,
2629 	    &douprintf, &res.status, 0, NULL);
2630 
2631 	if (error) {
2632 		vap->va_mask = mask;
2633 		return (error);
2634 	}
2635 
2636 	error = geterrno3(res.status);
2637 	if (!error) {
2638 		/*
2639 		 * It is important to pick up the attributes.
2640 		 * Since this is the exclusive create path, the
2641 		 * attributes on the initial create were ignored
2642 		 * and we need these to have the correct info.
2643 		 */
2644 		nfs3_cache_wcc_data(vp, &res.resok.obj_wcc, t, cr);
2645 		/*
2646 		 * No need to do the atime/mtime work again so clear
2647 		 * the bits.
2648 		 */
2649 		mask &= ~(AT_ATIME | AT_MTIME);
2650 	} else {
2651 		nfs3_cache_wcc_data(vp, &res.resfail.obj_wcc, t, cr);
2652 	}
2653 
2654 	vap->va_mask = mask;
2655 
2656 	return (error);
2657 }
2658 
2659 /* ARGSUSED */
2660 static int
2661 nfs3mknod(vnode_t *dvp, char *nm, struct vattr *va, enum vcexcl exclusive,
2662 	int mode, vnode_t **vpp, cred_t *cr)
2663 {
2664 	int error;
2665 	MKNOD3args args;
2666 	MKNOD3res res;
2667 	int douprintf;
2668 	vnode_t *vp;
2669 	struct vattr vattr;
2670 	hrtime_t t;
2671 
2672 	ASSERT(nfs_zone() == VTOMI(dvp)->mi_zone);
2673 	switch (va->va_type) {
2674 	case VCHR:
2675 	case VBLK:
2676 		setdiropargs3(&args.where, nm, dvp);
2677 		args.what.type = (va->va_type == VCHR) ? NF3CHR : NF3BLK;
2678 		error = vattr_to_sattr3(va,
2679 		    &args.what.mknoddata3_u.device.dev_attributes);
2680 		if (error) {
2681 			/* req time field(s) overflow - return immediately */
2682 			return (error);
2683 		}
2684 		args.what.mknoddata3_u.device.spec.specdata1 =
2685 		    getmajor(va->va_rdev);
2686 		args.what.mknoddata3_u.device.spec.specdata2 =
2687 		    getminor(va->va_rdev);
2688 		break;
2689 
2690 	case VFIFO:
2691 	case VSOCK:
2692 		setdiropargs3(&args.where, nm, dvp);
2693 		args.what.type = (va->va_type == VFIFO) ? NF3FIFO : NF3SOCK;
2694 		error = vattr_to_sattr3(va,
2695 				&args.what.mknoddata3_u.pipe_attributes);
2696 		if (error) {
2697 			/* req time field(s) overflow - return immediately */
2698 			return (error);
2699 		}
2700 		break;
2701 
2702 	default:
2703 		return (EINVAL);
2704 	}
2705 
2706 	douprintf = 1;
2707 
2708 	t = gethrtime();
2709 
2710 	error = rfs3call(VTOMI(dvp), NFSPROC3_MKNOD,
2711 	    xdr_MKNOD3args, (caddr_t)&args,
2712 	    xdr_MKNOD3res, (caddr_t)&res, cr,
2713 	    &douprintf, &res.status, 0, NULL);
2714 
2715 	if (error) {
2716 		PURGE_ATTRCACHE(dvp);
2717 		return (error);
2718 	}
2719 
2720 	error = geterrno3(res.status);
2721 	if (!error) {
2722 		nfs3_cache_wcc_data(dvp, &res.resok.dir_wcc, t, cr);
2723 		if (HAVE_RDDIR_CACHE(VTOR(dvp)))
2724 			nfs_purge_rddir_cache(dvp);
2725 
2726 		if (!res.resok.obj.handle_follows) {
2727 			error = nfs3lookup(dvp, nm, &vp, NULL, 0, NULL, cr, 0);
2728 			if (error)
2729 				return (error);
2730 		} else {
2731 			if (res.resok.obj_attributes.attributes) {
2732 				vp = makenfs3node(&res.resok.obj.handle,
2733 				    &res.resok.obj_attributes.attr,
2734 				    dvp->v_vfsp, t, cr, NULL, NULL);
2735 			} else {
2736 				vp = makenfs3node(&res.resok.obj.handle, NULL,
2737 				    dvp->v_vfsp, t, cr, NULL, NULL);
2738 				if (vp->v_type == VNON) {
2739 					vattr.va_mask = AT_TYPE;
2740 					error = nfs3getattr(vp, &vattr, cr);
2741 					if (error) {
2742 						VN_RELE(vp);
2743 						return (error);
2744 					}
2745 					vp->v_type = vattr.va_type;
2746 				}
2747 
2748 			}
2749 			dnlc_update(dvp, nm, vp);
2750 		}
2751 
2752 		if (va->va_gid != VTOR(vp)->r_attr.va_gid) {
2753 			va->va_mask = AT_GID;
2754 			(void) nfs3setattr(vp, va, 0, cr);
2755 		}
2756 
2757 		/*
2758 		 * If vnode is a device create special vnode
2759 		 */
2760 		if (IS_DEVVP(vp)) {
2761 			*vpp = specvp(vp, vp->v_rdev, vp->v_type, cr);
2762 			VN_RELE(vp);
2763 		} else
2764 			*vpp = vp;
2765 	} else {
2766 		nfs3_cache_wcc_data(dvp, &res.resfail.dir_wcc, t, cr);
2767 		PURGE_STALE_FH(error, dvp, cr);
2768 	}
2769 	return (error);
2770 }
2771 
2772 /*
2773  * Weirdness: if the vnode to be removed is open
2774  * we rename it instead of removing it and nfs_inactive
2775  * will remove the new name.
2776  */
2777 /* ARGSUSED */
2778 static int
2779 nfs3_remove(vnode_t *dvp, char *nm, cred_t *cr, caller_context_t *ct, int flags)
2780 {
2781 	int error;
2782 	REMOVE3args args;
2783 	REMOVE3res res;
2784 	vnode_t *vp;
2785 	char *tmpname;
2786 	int douprintf;
2787 	rnode_t *rp;
2788 	rnode_t *drp;
2789 	hrtime_t t;
2790 
2791 	if (nfs_zone() != VTOMI(dvp)->mi_zone)
2792 		return (EPERM);
2793 	drp = VTOR(dvp);
2794 	if (nfs_rw_enter_sig(&drp->r_rwlock, RW_WRITER, INTR(dvp)))
2795 		return (EINTR);
2796 
2797 	error = nfs3lookup(dvp, nm, &vp, NULL, 0, NULL, cr, 0);
2798 	if (error) {
2799 		nfs_rw_exit(&drp->r_rwlock);
2800 		return (error);
2801 	}
2802 
2803 	if (vp->v_type == VDIR && secpolicy_fs_linkdir(cr, dvp->v_vfsp)) {
2804 		VN_RELE(vp);
2805 		nfs_rw_exit(&drp->r_rwlock);
2806 		return (EPERM);
2807 	}
2808 
2809 	/*
2810 	 * First just remove the entry from the name cache, as it
2811 	 * is most likely the only entry for this vp.
2812 	 */
2813 	dnlc_remove(dvp, nm);
2814 
2815 	/*
2816 	 * If the file has a v_count > 1 then there may be more than one
2817 	 * entry in the name cache due multiple links or an open file,
2818 	 * but we don't have the real reference count so flush all
2819 	 * possible entries.
2820 	 */
2821 	if (vp->v_count > 1)
2822 		dnlc_purge_vp(vp);
2823 
2824 	/*
2825 	 * Now we have the real reference count on the vnode
2826 	 */
2827 	rp = VTOR(vp);
2828 	mutex_enter(&rp->r_statelock);
2829 	if (vp->v_count > 1 &&
2830 	    (rp->r_unldvp == NULL || strcmp(nm, rp->r_unlname) == 0)) {
2831 		mutex_exit(&rp->r_statelock);
2832 		tmpname = newname();
2833 		error = nfs3rename(dvp, nm, dvp, tmpname, cr, ct);
2834 		if (error)
2835 			kmem_free(tmpname, MAXNAMELEN);
2836 		else {
2837 			mutex_enter(&rp->r_statelock);
2838 			if (rp->r_unldvp == NULL) {
2839 				VN_HOLD(dvp);
2840 				rp->r_unldvp = dvp;
2841 				if (rp->r_unlcred != NULL)
2842 					crfree(rp->r_unlcred);
2843 				crhold(cr);
2844 				rp->r_unlcred = cr;
2845 				rp->r_unlname = tmpname;
2846 			} else {
2847 				kmem_free(rp->r_unlname, MAXNAMELEN);
2848 				rp->r_unlname = tmpname;
2849 			}
2850 			mutex_exit(&rp->r_statelock);
2851 		}
2852 	} else {
2853 		mutex_exit(&rp->r_statelock);
2854 		/*
2855 		 * We need to flush any dirty pages which happen to
2856 		 * be hanging around before removing the file.  This
2857 		 * shouldn't happen very often and mostly on file
2858 		 * systems mounted "nocto".
2859 		 */
2860 		if (vn_has_cached_data(vp) &&
2861 		    ((rp->r_flags & RDIRTY) || rp->r_count > 0)) {
2862 			error = nfs3_putpage(vp, (offset_t)0, 0, 0, cr, ct);
2863 			if (error && (error == ENOSPC || error == EDQUOT)) {
2864 				mutex_enter(&rp->r_statelock);
2865 				if (!rp->r_error)
2866 					rp->r_error = error;
2867 				mutex_exit(&rp->r_statelock);
2868 			}
2869 		}
2870 
2871 		setdiropargs3(&args.object, nm, dvp);
2872 
2873 		douprintf = 1;
2874 
2875 		t = gethrtime();
2876 
2877 		error = rfs3call(VTOMI(dvp), NFSPROC3_REMOVE,
2878 		    xdr_diropargs3, (caddr_t)&args,
2879 		    xdr_REMOVE3res, (caddr_t)&res, cr,
2880 		    &douprintf, &res.status, 0, NULL);
2881 
2882 		/*
2883 		 * The xattr dir may be gone after last attr is removed,
2884 		 * so flush it from dnlc.
2885 		 */
2886 		if (dvp->v_flag & V_XATTRDIR)
2887 			dnlc_purge_vp(dvp);
2888 
2889 		PURGE_ATTRCACHE(vp);
2890 
2891 		if (error) {
2892 			PURGE_ATTRCACHE(dvp);
2893 		} else {
2894 			error = geterrno3(res.status);
2895 			if (!error) {
2896 				nfs3_cache_wcc_data(dvp, &res.resok.dir_wcc, t,
2897 				    cr);
2898 				if (HAVE_RDDIR_CACHE(drp))
2899 					nfs_purge_rddir_cache(dvp);
2900 			} else {
2901 				nfs3_cache_wcc_data(dvp, &res.resfail.dir_wcc,
2902 				    t, cr);
2903 				PURGE_STALE_FH(error, dvp, cr);
2904 			}
2905 		}
2906 	}
2907 
2908 	if (error == 0) {
2909 		vnevent_remove(vp, dvp, nm, ct);
2910 	}
2911 	VN_RELE(vp);
2912 
2913 	nfs_rw_exit(&drp->r_rwlock);
2914 
2915 	return (error);
2916 }
2917 
2918 /* ARGSUSED */
2919 static int
2920 nfs3_link(vnode_t *tdvp, vnode_t *svp, char *tnm, cred_t *cr,
2921 	caller_context_t *ct, int flags)
2922 {
2923 	int error;
2924 	LINK3args args;
2925 	LINK3res res;
2926 	vnode_t *realvp;
2927 	int douprintf;
2928 	mntinfo_t *mi;
2929 	rnode_t *tdrp;
2930 	hrtime_t t;
2931 
2932 	if (nfs_zone() != VTOMI(tdvp)->mi_zone)
2933 		return (EPERM);
2934 	if (VOP_REALVP(svp, &realvp, ct) == 0)
2935 		svp = realvp;
2936 
2937 	mi = VTOMI(svp);
2938 
2939 	if (!(mi->mi_flags & MI_LINK))
2940 		return (EOPNOTSUPP);
2941 
2942 	args.file = *VTOFH3(svp);
2943 	setdiropargs3(&args.link, tnm, tdvp);
2944 
2945 	tdrp = VTOR(tdvp);
2946 	if (nfs_rw_enter_sig(&tdrp->r_rwlock, RW_WRITER, INTR(tdvp)))
2947 		return (EINTR);
2948 
2949 	dnlc_remove(tdvp, tnm);
2950 
2951 	douprintf = 1;
2952 
2953 	t = gethrtime();
2954 
2955 	error = rfs3call(mi, NFSPROC3_LINK,
2956 	    xdr_LINK3args, (caddr_t)&args,
2957 	    xdr_LINK3res, (caddr_t)&res, cr,
2958 	    &douprintf, &res.status, 0, NULL);
2959 
2960 	if (error) {
2961 		PURGE_ATTRCACHE(tdvp);
2962 		PURGE_ATTRCACHE(svp);
2963 		nfs_rw_exit(&tdrp->r_rwlock);
2964 		return (error);
2965 	}
2966 
2967 	error = geterrno3(res.status);
2968 
2969 	if (!error) {
2970 		nfs3_cache_post_op_attr(svp, &res.resok.file_attributes, t, cr);
2971 		nfs3_cache_wcc_data(tdvp, &res.resok.linkdir_wcc, t, cr);
2972 		if (HAVE_RDDIR_CACHE(tdrp))
2973 			nfs_purge_rddir_cache(tdvp);
2974 		dnlc_update(tdvp, tnm, svp);
2975 	} else {
2976 		nfs3_cache_post_op_attr(svp, &res.resfail.file_attributes, t,
2977 		    cr);
2978 		nfs3_cache_wcc_data(tdvp, &res.resfail.linkdir_wcc, t, cr);
2979 		if (error == EOPNOTSUPP) {
2980 			mutex_enter(&mi->mi_lock);
2981 			mi->mi_flags &= ~MI_LINK;
2982 			mutex_exit(&mi->mi_lock);
2983 		}
2984 	}
2985 
2986 	nfs_rw_exit(&tdrp->r_rwlock);
2987 
2988 	if (!error) {
2989 		/*
2990 		 * Notify the source file of this link operation.
2991 		 */
2992 		vnevent_link(svp, ct);
2993 	}
2994 	return (error);
2995 }
2996 
2997 /* ARGSUSED */
2998 static int
2999 nfs3_rename(vnode_t *odvp, char *onm, vnode_t *ndvp, char *nnm, cred_t *cr,
3000 	caller_context_t *ct, int flags)
3001 {
3002 	vnode_t *realvp;
3003 
3004 	if (nfs_zone() != VTOMI(odvp)->mi_zone)
3005 		return (EPERM);
3006 	if (VOP_REALVP(ndvp, &realvp, ct) == 0)
3007 		ndvp = realvp;
3008 
3009 	return (nfs3rename(odvp, onm, ndvp, nnm, cr, ct));
3010 }
3011 
3012 /*
3013  * nfs3rename does the real work of renaming in NFS Version 3.
3014  */
3015 static int
3016 nfs3rename(vnode_t *odvp, char *onm, vnode_t *ndvp, char *nnm, cred_t *cr,
3017     caller_context_t *ct)
3018 {
3019 	int error;
3020 	RENAME3args args;
3021 	RENAME3res res;
3022 	int douprintf;
3023 	vnode_t *nvp = NULL;
3024 	vnode_t *ovp = NULL;
3025 	char *tmpname;
3026 	rnode_t *rp;
3027 	rnode_t *odrp;
3028 	rnode_t *ndrp;
3029 	hrtime_t t;
3030 
3031 	ASSERT(nfs_zone() == VTOMI(odvp)->mi_zone);
3032 
3033 	if (strcmp(onm, ".") == 0 || strcmp(onm, "..") == 0 ||
3034 	    strcmp(nnm, ".") == 0 || strcmp(nnm, "..") == 0)
3035 		return (EINVAL);
3036 
3037 	odrp = VTOR(odvp);
3038 	ndrp = VTOR(ndvp);
3039 	if ((intptr_t)odrp < (intptr_t)ndrp) {
3040 		if (nfs_rw_enter_sig(&odrp->r_rwlock, RW_WRITER, INTR(odvp)))
3041 			return (EINTR);
3042 		if (nfs_rw_enter_sig(&ndrp->r_rwlock, RW_WRITER, INTR(ndvp))) {
3043 			nfs_rw_exit(&odrp->r_rwlock);
3044 			return (EINTR);
3045 		}
3046 	} else {
3047 		if (nfs_rw_enter_sig(&ndrp->r_rwlock, RW_WRITER, INTR(ndvp)))
3048 			return (EINTR);
3049 		if (nfs_rw_enter_sig(&odrp->r_rwlock, RW_WRITER, INTR(odvp))) {
3050 			nfs_rw_exit(&ndrp->r_rwlock);
3051 			return (EINTR);
3052 		}
3053 	}
3054 
3055 	/*
3056 	 * Lookup the target file.  If it exists, it needs to be
3057 	 * checked to see whether it is a mount point and whether
3058 	 * it is active (open).
3059 	 */
3060 	error = nfs3lookup(ndvp, nnm, &nvp, NULL, 0, NULL, cr, 0);
3061 	if (!error) {
3062 		/*
3063 		 * If this file has been mounted on, then just
3064 		 * return busy because renaming to it would remove
3065 		 * the mounted file system from the name space.
3066 		 */
3067 		if (vn_mountedvfs(nvp) != NULL) {
3068 			VN_RELE(nvp);
3069 			nfs_rw_exit(&odrp->r_rwlock);
3070 			nfs_rw_exit(&ndrp->r_rwlock);
3071 			return (EBUSY);
3072 		}
3073 
3074 		/*
3075 		 * Purge the name cache of all references to this vnode
3076 		 * so that we can check the reference count to infer
3077 		 * whether it is active or not.
3078 		 */
3079 		/*
3080 		 * First just remove the entry from the name cache, as it
3081 		 * is most likely the only entry for this vp.
3082 		 */
3083 		dnlc_remove(ndvp, nnm);
3084 		/*
3085 		 * If the file has a v_count > 1 then there may be more
3086 		 * than one entry in the name cache due multiple links
3087 		 * or an open file, but we don't have the real reference
3088 		 * count so flush all possible entries.
3089 		 */
3090 		if (nvp->v_count > 1)
3091 			dnlc_purge_vp(nvp);
3092 
3093 		/*
3094 		 * If the vnode is active and is not a directory,
3095 		 * arrange to rename it to a
3096 		 * temporary file so that it will continue to be
3097 		 * accessible.  This implements the "unlink-open-file"
3098 		 * semantics for the target of a rename operation.
3099 		 * Before doing this though, make sure that the
3100 		 * source and target files are not already the same.
3101 		 */
3102 		if (nvp->v_count > 1 && nvp->v_type != VDIR) {
3103 			/*
3104 			 * Lookup the source name.
3105 			 */
3106 			error = nfs3lookup(odvp, onm, &ovp, NULL, 0, NULL,
3107 			    cr, 0);
3108 
3109 			/*
3110 			 * The source name *should* already exist.
3111 			 */
3112 			if (error) {
3113 				VN_RELE(nvp);
3114 				nfs_rw_exit(&odrp->r_rwlock);
3115 				nfs_rw_exit(&ndrp->r_rwlock);
3116 				return (error);
3117 			}
3118 
3119 			/*
3120 			 * Compare the two vnodes.  If they are the same,
3121 			 * just release all held vnodes and return success.
3122 			 */
3123 			if (ovp == nvp) {
3124 				VN_RELE(ovp);
3125 				VN_RELE(nvp);
3126 				nfs_rw_exit(&odrp->r_rwlock);
3127 				nfs_rw_exit(&ndrp->r_rwlock);
3128 				return (0);
3129 			}
3130 
3131 			/*
3132 			 * Can't mix and match directories and non-
3133 			 * directories in rename operations.  We already
3134 			 * know that the target is not a directory.  If
3135 			 * the source is a directory, return an error.
3136 			 */
3137 			if (ovp->v_type == VDIR) {
3138 				VN_RELE(ovp);
3139 				VN_RELE(nvp);
3140 				nfs_rw_exit(&odrp->r_rwlock);
3141 				nfs_rw_exit(&ndrp->r_rwlock);
3142 				return (ENOTDIR);
3143 			}
3144 
3145 			/*
3146 			 * The target file exists, is not the same as
3147 			 * the source file, and is active.  Link it
3148 			 * to a temporary filename to avoid having
3149 			 * the server removing the file completely.
3150 			 */
3151 			tmpname = newname();
3152 			error = nfs3_link(ndvp, nvp, tmpname, cr, NULL, 0);
3153 			if (error == EOPNOTSUPP) {
3154 				error = nfs3_rename(ndvp, nnm, ndvp, tmpname,
3155 				    cr, NULL, 0);
3156 			}
3157 			if (error) {
3158 				kmem_free(tmpname, MAXNAMELEN);
3159 				VN_RELE(ovp);
3160 				VN_RELE(nvp);
3161 				nfs_rw_exit(&odrp->r_rwlock);
3162 				nfs_rw_exit(&ndrp->r_rwlock);
3163 				return (error);
3164 			}
3165 			rp = VTOR(nvp);
3166 			mutex_enter(&rp->r_statelock);
3167 			if (rp->r_unldvp == NULL) {
3168 				VN_HOLD(ndvp);
3169 				rp->r_unldvp = ndvp;
3170 				if (rp->r_unlcred != NULL)
3171 					crfree(rp->r_unlcred);
3172 				crhold(cr);
3173 				rp->r_unlcred = cr;
3174 				rp->r_unlname = tmpname;
3175 			} else {
3176 				kmem_free(rp->r_unlname, MAXNAMELEN);
3177 				rp->r_unlname = tmpname;
3178 			}
3179 			mutex_exit(&rp->r_statelock);
3180 		}
3181 	}
3182 
3183 	if (ovp == NULL) {
3184 		/*
3185 		 * When renaming directories to be a subdirectory of a
3186 		 * different parent, the dnlc entry for ".." will no
3187 		 * longer be valid, so it must be removed.
3188 		 *
3189 		 * We do a lookup here to determine whether we are renaming
3190 		 * a directory and we need to check if we are renaming
3191 		 * an unlinked file.  This might have already been done
3192 		 * in previous code, so we check ovp == NULL to avoid
3193 		 * doing it twice.
3194 		 */
3195 
3196 		error = nfs3lookup(odvp, onm, &ovp, NULL, 0, NULL, cr, 0);
3197 		/*
3198 		 * The source name *should* already exist.
3199 		 */
3200 		if (error) {
3201 			nfs_rw_exit(&odrp->r_rwlock);
3202 			nfs_rw_exit(&ndrp->r_rwlock);
3203 			if (nvp) {
3204 				VN_RELE(nvp);
3205 			}
3206 			return (error);
3207 		}
3208 		ASSERT(ovp != NULL);
3209 	}
3210 
3211 	dnlc_remove(odvp, onm);
3212 	dnlc_remove(ndvp, nnm);
3213 
3214 	setdiropargs3(&args.from, onm, odvp);
3215 	setdiropargs3(&args.to, nnm, ndvp);
3216 
3217 	douprintf = 1;
3218 
3219 	t = gethrtime();
3220 
3221 	error = rfs3call(VTOMI(odvp), NFSPROC3_RENAME,
3222 	    xdr_RENAME3args, (caddr_t)&args,
3223 	    xdr_RENAME3res, (caddr_t)&res, cr,
3224 	    &douprintf, &res.status, 0, NULL);
3225 
3226 	if (error) {
3227 		PURGE_ATTRCACHE(odvp);
3228 		PURGE_ATTRCACHE(ndvp);
3229 		VN_RELE(ovp);
3230 		nfs_rw_exit(&odrp->r_rwlock);
3231 		nfs_rw_exit(&ndrp->r_rwlock);
3232 		if (nvp) {
3233 			VN_RELE(nvp);
3234 		}
3235 		return (error);
3236 	}
3237 
3238 	error = geterrno3(res.status);
3239 
3240 	if (!error) {
3241 		nfs3_cache_wcc_data(odvp, &res.resok.fromdir_wcc, t, cr);
3242 		if (HAVE_RDDIR_CACHE(odrp))
3243 			nfs_purge_rddir_cache(odvp);
3244 		if (ndvp != odvp) {
3245 			nfs3_cache_wcc_data(ndvp, &res.resok.todir_wcc, t, cr);
3246 			if (HAVE_RDDIR_CACHE(ndrp))
3247 				nfs_purge_rddir_cache(ndvp);
3248 		}
3249 		/*
3250 		 * when renaming directories to be a subdirectory of a
3251 		 * different parent, the dnlc entry for ".." will no
3252 		 * longer be valid, so it must be removed
3253 		 */
3254 		rp = VTOR(ovp);
3255 		if (ndvp != odvp) {
3256 			if (ovp->v_type == VDIR) {
3257 				dnlc_remove(ovp, "..");
3258 				if (HAVE_RDDIR_CACHE(rp))
3259 					nfs_purge_rddir_cache(ovp);
3260 			}
3261 		}
3262 
3263 		/*
3264 		 * If we are renaming the unlinked file, update the
3265 		 * r_unldvp and r_unlname as needed.
3266 		 */
3267 		mutex_enter(&rp->r_statelock);
3268 		if (rp->r_unldvp != NULL) {
3269 			if (strcmp(rp->r_unlname, onm) == 0) {
3270 				(void) strncpy(rp->r_unlname, nnm, MAXNAMELEN);
3271 				rp->r_unlname[MAXNAMELEN - 1] = '\0';
3272 
3273 				if (ndvp != rp->r_unldvp) {
3274 					VN_RELE(rp->r_unldvp);
3275 					rp->r_unldvp = ndvp;
3276 					VN_HOLD(ndvp);
3277 				}
3278 			}
3279 		}
3280 		mutex_exit(&rp->r_statelock);
3281 	} else {
3282 		nfs3_cache_wcc_data(odvp, &res.resfail.fromdir_wcc, t, cr);
3283 		if (ndvp != odvp) {
3284 			nfs3_cache_wcc_data(ndvp, &res.resfail.todir_wcc, t,
3285 			    cr);
3286 		}
3287 		/*
3288 		 * System V defines rename to return EEXIST, not
3289 		 * ENOTEMPTY if the target directory is not empty.
3290 		 * Over the wire, the error is NFSERR_ENOTEMPTY
3291 		 * which geterrno maps to ENOTEMPTY.
3292 		 */
3293 		if (error == ENOTEMPTY)
3294 			error = EEXIST;
3295 	}
3296 
3297 	if (error == 0) {
3298 		if (nvp)
3299 			vnevent_rename_dest(nvp, ndvp, nnm, ct);
3300 
3301 		if (odvp != ndvp)
3302 			vnevent_rename_dest_dir(ndvp, ct);
3303 		ASSERT(ovp != NULL);
3304 		vnevent_rename_src(ovp, odvp, onm, ct);
3305 	}
3306 
3307 	if (nvp) {
3308 		VN_RELE(nvp);
3309 	}
3310 	VN_RELE(ovp);
3311 
3312 	nfs_rw_exit(&odrp->r_rwlock);
3313 	nfs_rw_exit(&ndrp->r_rwlock);
3314 
3315 	return (error);
3316 }
3317 
3318 /* ARGSUSED */
3319 static int
3320 nfs3_mkdir(vnode_t *dvp, char *nm, struct vattr *va, vnode_t **vpp, cred_t *cr,
3321 	caller_context_t *ct, int flags, vsecattr_t *vsecp)
3322 {
3323 	int error;
3324 	MKDIR3args args;
3325 	MKDIR3res res;
3326 	int douprintf;
3327 	struct vattr vattr;
3328 	vnode_t *vp;
3329 	rnode_t *drp;
3330 	hrtime_t t;
3331 
3332 	if (nfs_zone() != VTOMI(dvp)->mi_zone)
3333 		return (EPERM);
3334 	setdiropargs3(&args.where, nm, dvp);
3335 
3336 	/*
3337 	 * Decide what the group-id and set-gid bit of the created directory
3338 	 * should be.  May have to do a setattr to get the gid right.
3339 	 */
3340 	error = setdirgid(dvp, &va->va_gid, cr);
3341 	if (error)
3342 		return (error);
3343 	error = setdirmode(dvp, &va->va_mode, cr);
3344 	if (error)
3345 		return (error);
3346 	va->va_mask |= AT_MODE|AT_GID;
3347 
3348 	error = vattr_to_sattr3(va, &args.attributes);
3349 	if (error) {
3350 		/* req time field(s) overflow - return immediately */
3351 		return (error);
3352 	}
3353 
3354 	drp = VTOR(dvp);
3355 	if (nfs_rw_enter_sig(&drp->r_rwlock, RW_WRITER, INTR(dvp)))
3356 		return (EINTR);
3357 
3358 	dnlc_remove(dvp, nm);
3359 
3360 	douprintf = 1;
3361 
3362 	t = gethrtime();
3363 
3364 	error = rfs3call(VTOMI(dvp), NFSPROC3_MKDIR,
3365 	    xdr_MKDIR3args, (caddr_t)&args,
3366 	    xdr_MKDIR3res, (caddr_t)&res, cr,
3367 	    &douprintf, &res.status, 0, NULL);
3368 
3369 	if (error) {
3370 		PURGE_ATTRCACHE(dvp);
3371 		nfs_rw_exit(&drp->r_rwlock);
3372 		return (error);
3373 	}
3374 
3375 	error = geterrno3(res.status);
3376 	if (!error) {
3377 		nfs3_cache_wcc_data(dvp, &res.resok.dir_wcc, t, cr);
3378 		if (HAVE_RDDIR_CACHE(drp))
3379 			nfs_purge_rddir_cache(dvp);
3380 
3381 		if (!res.resok.obj.handle_follows) {
3382 			error = nfs3lookup(dvp, nm, &vp, NULL, 0, NULL, cr, 0);
3383 			if (error) {
3384 				nfs_rw_exit(&drp->r_rwlock);
3385 				return (error);
3386 			}
3387 		} else {
3388 			if (res.resok.obj_attributes.attributes) {
3389 				vp = makenfs3node(&res.resok.obj.handle,
3390 				    &res.resok.obj_attributes.attr,
3391 				    dvp->v_vfsp, t, cr, NULL, NULL);
3392 			} else {
3393 				vp = makenfs3node(&res.resok.obj.handle, NULL,
3394 				    dvp->v_vfsp, t, cr, NULL, NULL);
3395 				if (vp->v_type == VNON) {
3396 					vattr.va_mask = AT_TYPE;
3397 					error = nfs3getattr(vp, &vattr, cr);
3398 					if (error) {
3399 						VN_RELE(vp);
3400 						nfs_rw_exit(&drp->r_rwlock);
3401 						return (error);
3402 					}
3403 					vp->v_type = vattr.va_type;
3404 				}
3405 			}
3406 			dnlc_update(dvp, nm, vp);
3407 		}
3408 		if (va->va_gid != VTOR(vp)->r_attr.va_gid) {
3409 			va->va_mask = AT_GID;
3410 			(void) nfs3setattr(vp, va, 0, cr);
3411 		}
3412 		*vpp = vp;
3413 	} else {
3414 		nfs3_cache_wcc_data(dvp, &res.resfail.dir_wcc, t, cr);
3415 		PURGE_STALE_FH(error, dvp, cr);
3416 	}
3417 
3418 	nfs_rw_exit(&drp->r_rwlock);
3419 
3420 	return (error);
3421 }
3422 
3423 /* ARGSUSED */
3424 static int
3425 nfs3_rmdir(vnode_t *dvp, char *nm, vnode_t *cdir, cred_t *cr,
3426 	caller_context_t *ct, int flags)
3427 {
3428 	int error;
3429 	RMDIR3args args;
3430 	RMDIR3res res;
3431 	vnode_t *vp;
3432 	int douprintf;
3433 	rnode_t *drp;
3434 	hrtime_t t;
3435 
3436 	if (nfs_zone() != VTOMI(dvp)->mi_zone)
3437 		return (EPERM);
3438 	drp = VTOR(dvp);
3439 	if (nfs_rw_enter_sig(&drp->r_rwlock, RW_WRITER, INTR(dvp)))
3440 		return (EINTR);
3441 
3442 	/*
3443 	 * Attempt to prevent a rmdir(".") from succeeding.
3444 	 */
3445 	error = nfs3lookup(dvp, nm, &vp, NULL, 0, NULL, cr, 0);
3446 	if (error) {
3447 		nfs_rw_exit(&drp->r_rwlock);
3448 		return (error);
3449 	}
3450 
3451 	if (vp == cdir) {
3452 		VN_RELE(vp);
3453 		nfs_rw_exit(&drp->r_rwlock);
3454 		return (EINVAL);
3455 	}
3456 
3457 	setdiropargs3(&args.object, nm, dvp);
3458 
3459 	/*
3460 	 * First just remove the entry from the name cache, as it
3461 	 * is most likely an entry for this vp.
3462 	 */
3463 	dnlc_remove(dvp, nm);
3464 
3465 	/*
3466 	 * If there vnode reference count is greater than one, then
3467 	 * there may be additional references in the DNLC which will
3468 	 * need to be purged.  First, trying removing the entry for
3469 	 * the parent directory and see if that removes the additional
3470 	 * reference(s).  If that doesn't do it, then use dnlc_purge_vp
3471 	 * to completely remove any references to the directory which
3472 	 * might still exist in the DNLC.
3473 	 */
3474 	if (vp->v_count > 1) {
3475 		dnlc_remove(vp, "..");
3476 		if (vp->v_count > 1)
3477 			dnlc_purge_vp(vp);
3478 	}
3479 
3480 	douprintf = 1;
3481 
3482 	t = gethrtime();
3483 
3484 	error = rfs3call(VTOMI(dvp), NFSPROC3_RMDIR,
3485 	    xdr_diropargs3, (caddr_t)&args,
3486 	    xdr_RMDIR3res, (caddr_t)&res, cr,
3487 	    &douprintf, &res.status, 0, NULL);
3488 
3489 	PURGE_ATTRCACHE(vp);
3490 
3491 	if (error) {
3492 		PURGE_ATTRCACHE(dvp);
3493 		VN_RELE(vp);
3494 		nfs_rw_exit(&drp->r_rwlock);
3495 		return (error);
3496 	}
3497 
3498 	error = geterrno3(res.status);
3499 	if (!error) {
3500 		nfs3_cache_wcc_data(dvp, &res.resok.dir_wcc, t, cr);
3501 		if (HAVE_RDDIR_CACHE(drp))
3502 			nfs_purge_rddir_cache(dvp);
3503 		if (HAVE_RDDIR_CACHE(VTOR(vp)))
3504 			nfs_purge_rddir_cache(vp);
3505 	} else {
3506 		nfs3_cache_wcc_data(dvp, &res.resfail.dir_wcc, t, cr);
3507 		PURGE_STALE_FH(error, dvp, cr);
3508 		/*
3509 		 * System V defines rmdir to return EEXIST, not
3510 		 * ENOTEMPTY if the directory is not empty.  Over
3511 		 * the wire, the error is NFSERR_ENOTEMPTY which
3512 		 * geterrno maps to ENOTEMPTY.
3513 		 */
3514 		if (error == ENOTEMPTY)
3515 			error = EEXIST;
3516 	}
3517 
3518 	if (error == 0) {
3519 		vnevent_rmdir(vp, dvp, nm, ct);
3520 	}
3521 	VN_RELE(vp);
3522 
3523 	nfs_rw_exit(&drp->r_rwlock);
3524 
3525 	return (error);
3526 }
3527 
3528 /* ARGSUSED */
3529 static int
3530 nfs3_symlink(vnode_t *dvp, char *lnm, struct vattr *tva, char *tnm, cred_t *cr,
3531 	caller_context_t *ct, int flags)
3532 {
3533 	int error;
3534 	SYMLINK3args args;
3535 	SYMLINK3res res;
3536 	int douprintf;
3537 	mntinfo_t *mi;
3538 	vnode_t *vp;
3539 	rnode_t *rp;
3540 	char *contents;
3541 	rnode_t *drp;
3542 	hrtime_t t;
3543 
3544 	mi = VTOMI(dvp);
3545 
3546 	if (nfs_zone() != mi->mi_zone)
3547 		return (EPERM);
3548 	if (!(mi->mi_flags & MI_SYMLINK))
3549 		return (EOPNOTSUPP);
3550 
3551 	setdiropargs3(&args.where, lnm, dvp);
3552 	error = vattr_to_sattr3(tva, &args.symlink.symlink_attributes);
3553 	if (error) {
3554 		/* req time field(s) overflow - return immediately */
3555 		return (error);
3556 	}
3557 	args.symlink.symlink_data = tnm;
3558 
3559 	drp = VTOR(dvp);
3560 	if (nfs_rw_enter_sig(&drp->r_rwlock, RW_WRITER, INTR(dvp)))
3561 		return (EINTR);
3562 
3563 	dnlc_remove(dvp, lnm);
3564 
3565 	douprintf = 1;
3566 
3567 	t = gethrtime();
3568 
3569 	error = rfs3call(mi, NFSPROC3_SYMLINK,
3570 	    xdr_SYMLINK3args, (caddr_t)&args,
3571 	    xdr_SYMLINK3res, (caddr_t)&res, cr,
3572 	    &douprintf, &res.status, 0, NULL);
3573 
3574 	if (error) {
3575 		PURGE_ATTRCACHE(dvp);
3576 		nfs_rw_exit(&drp->r_rwlock);
3577 		return (error);
3578 	}
3579 
3580 	error = geterrno3(res.status);
3581 	if (!error) {
3582 		nfs3_cache_wcc_data(dvp, &res.resok.dir_wcc, t, cr);
3583 		if (HAVE_RDDIR_CACHE(drp))
3584 			nfs_purge_rddir_cache(dvp);
3585 
3586 		if (res.resok.obj.handle_follows) {
3587 			if (res.resok.obj_attributes.attributes) {
3588 				vp = makenfs3node(&res.resok.obj.handle,
3589 				    &res.resok.obj_attributes.attr,
3590 				    dvp->v_vfsp, t, cr, NULL, NULL);
3591 			} else {
3592 				vp = makenfs3node(&res.resok.obj.handle, NULL,
3593 				    dvp->v_vfsp, t, cr, NULL, NULL);
3594 				vp->v_type = VLNK;
3595 				vp->v_rdev = 0;
3596 			}
3597 			dnlc_update(dvp, lnm, vp);
3598 			rp = VTOR(vp);
3599 			if (nfs3_do_symlink_cache &&
3600 			    rp->r_symlink.contents == NULL) {
3601 
3602 				contents = kmem_alloc(MAXPATHLEN,
3603 				    KM_NOSLEEP);
3604 
3605 				if (contents != NULL) {
3606 					mutex_enter(&rp->r_statelock);
3607 					if (rp->r_symlink.contents == NULL) {
3608 						rp->r_symlink.len = strlen(tnm);
3609 						bcopy(tnm, contents,
3610 						    rp->r_symlink.len);
3611 						rp->r_symlink.contents =
3612 						    contents;
3613 						rp->r_symlink.size = MAXPATHLEN;
3614 						mutex_exit(&rp->r_statelock);
3615 					} else {
3616 						mutex_exit(&rp->r_statelock);
3617 						kmem_free((void *)contents,
3618 							    MAXPATHLEN);
3619 					}
3620 				}
3621 			}
3622 			VN_RELE(vp);
3623 		}
3624 	} else {
3625 		nfs3_cache_wcc_data(dvp, &res.resfail.dir_wcc, t, cr);
3626 		PURGE_STALE_FH(error, dvp, cr);
3627 		if (error == EOPNOTSUPP) {
3628 			mutex_enter(&mi->mi_lock);
3629 			mi->mi_flags &= ~MI_SYMLINK;
3630 			mutex_exit(&mi->mi_lock);
3631 		}
3632 	}
3633 
3634 	nfs_rw_exit(&drp->r_rwlock);
3635 
3636 	return (error);
3637 }
3638 
3639 #ifdef DEBUG
3640 static int nfs3_readdir_cache_hits = 0;
3641 static int nfs3_readdir_cache_shorts = 0;
3642 static int nfs3_readdir_cache_waits = 0;
3643 static int nfs3_readdir_cache_misses = 0;
3644 static int nfs3_readdir_readahead = 0;
3645 #endif
3646 
3647 static int nfs3_shrinkreaddir = 0;
3648 
3649 /*
3650  * Read directory entries.
3651  * There are some weird things to look out for here.  The uio_loffset
3652  * field is either 0 or it is the offset returned from a previous
3653  * readdir.  It is an opaque value used by the server to find the
3654  * correct directory block to read. The count field is the number
3655  * of blocks to read on the server.  This is advisory only, the server
3656  * may return only one block's worth of entries.  Entries may be compressed
3657  * on the server.
3658  */
3659 /* ARGSUSED */
3660 static int
3661 nfs3_readdir(vnode_t *vp, struct uio *uiop, cred_t *cr, int *eofp,
3662 	caller_context_t *ct, int flags)
3663 {
3664 	int error;
3665 	size_t count;
3666 	rnode_t *rp;
3667 	rddir_cache *rdc;
3668 	rddir_cache *nrdc;
3669 	rddir_cache *rrdc;
3670 #ifdef DEBUG
3671 	int missed;
3672 #endif
3673 	int doreadahead;
3674 	rddir_cache srdc;
3675 	avl_index_t where;
3676 
3677 	if (nfs_zone() != VTOMI(vp)->mi_zone)
3678 		return (EIO);
3679 	rp = VTOR(vp);
3680 
3681 	ASSERT(nfs_rw_lock_held(&rp->r_rwlock, RW_READER));
3682 
3683 	/*
3684 	 * Make sure that the directory cache is valid.
3685 	 */
3686 	if (HAVE_RDDIR_CACHE(rp)) {
3687 		if (nfs_disable_rddir_cache) {
3688 			/*
3689 			 * Setting nfs_disable_rddir_cache in /etc/system
3690 			 * allows interoperability with servers that do not
3691 			 * properly update the attributes of directories.
3692 			 * Any cached information gets purged before an
3693 			 * access is made to it.
3694 			 */
3695 			nfs_purge_rddir_cache(vp);
3696 		} else {
3697 			error = nfs3_validate_caches(vp, cr);
3698 			if (error)
3699 				return (error);
3700 		}
3701 	}
3702 
3703 	/*
3704 	 * It is possible that some servers may not be able to correctly
3705 	 * handle a large READDIR or READDIRPLUS request due to bugs in
3706 	 * their implementation.  In order to continue to interoperate
3707 	 * with them, this workaround is provided to limit the maximum
3708 	 * size of a READDIRPLUS request to 1024.  In any case, the request
3709 	 * size is limited to MAXBSIZE.
3710 	 */
3711 	count = MIN(uiop->uio_iov->iov_len,
3712 	    nfs3_shrinkreaddir ? 1024 : MAXBSIZE);
3713 
3714 	nrdc = NULL;
3715 #ifdef DEBUG
3716 	missed = 0;
3717 #endif
3718 top:
3719 	/*
3720 	 * Short circuit last readdir which always returns 0 bytes.
3721 	 * This can be done after the directory has been read through
3722 	 * completely at least once.  This will set r_direof which
3723 	 * can be used to find the value of the last cookie.
3724 	 */
3725 	mutex_enter(&rp->r_statelock);
3726 	if (rp->r_direof != NULL &&
3727 	    uiop->uio_loffset == rp->r_direof->nfs3_ncookie) {
3728 		mutex_exit(&rp->r_statelock);
3729 #ifdef DEBUG
3730 		nfs3_readdir_cache_shorts++;
3731 #endif
3732 		if (eofp)
3733 			*eofp = 1;
3734 		if (nrdc != NULL)
3735 			rddir_cache_rele(nrdc);
3736 		return (0);
3737 	}
3738 	/*
3739 	 * Look for a cache entry.  Cache entries are identified
3740 	 * by the NFS cookie value and the byte count requested.
3741 	 */
3742 	srdc.nfs3_cookie = uiop->uio_loffset;
3743 	srdc.buflen = count;
3744 	rdc = avl_find(&rp->r_dir, &srdc, &where);
3745 	if (rdc != NULL) {
3746 		rddir_cache_hold(rdc);
3747 		/*
3748 		 * If the cache entry is in the process of being
3749 		 * filled in, wait until this completes.  The
3750 		 * RDDIRWAIT bit is set to indicate that someone
3751 		 * is waiting and then the thread currently
3752 		 * filling the entry is done, it should do a
3753 		 * cv_broadcast to wakeup all of the threads
3754 		 * waiting for it to finish.
3755 		 */
3756 		if (rdc->flags & RDDIR) {
3757 			nfs_rw_exit(&rp->r_rwlock);
3758 			rdc->flags |= RDDIRWAIT;
3759 #ifdef DEBUG
3760 			nfs3_readdir_cache_waits++;
3761 #endif
3762 			if (!cv_wait_sig(&rdc->cv, &rp->r_statelock)) {
3763 				/*
3764 				 * We got interrupted, probably
3765 				 * the user typed ^C or an alarm
3766 				 * fired.  We free the new entry
3767 				 * if we allocated one.
3768 				 */
3769 				mutex_exit(&rp->r_statelock);
3770 				(void) nfs_rw_enter_sig(&rp->r_rwlock,
3771 					RW_READER, FALSE);
3772 				rddir_cache_rele(rdc);
3773 				if (nrdc != NULL)
3774 					rddir_cache_rele(nrdc);
3775 				return (EINTR);
3776 			}
3777 			mutex_exit(&rp->r_statelock);
3778 			(void) nfs_rw_enter_sig(&rp->r_rwlock,
3779 				RW_READER, FALSE);
3780 			rddir_cache_rele(rdc);
3781 			goto top;
3782 		}
3783 		/*
3784 		 * Check to see if a readdir is required to
3785 		 * fill the entry.  If so, mark this entry
3786 		 * as being filled, remove our reference,
3787 		 * and branch to the code to fill the entry.
3788 		 */
3789 		if (rdc->flags & RDDIRREQ) {
3790 			rdc->flags &= ~RDDIRREQ;
3791 			rdc->flags |= RDDIR;
3792 			if (nrdc != NULL)
3793 				rddir_cache_rele(nrdc);
3794 			nrdc = rdc;
3795 			mutex_exit(&rp->r_statelock);
3796 			goto bottom;
3797 		}
3798 #ifdef DEBUG
3799 		if (!missed)
3800 			nfs3_readdir_cache_hits++;
3801 #endif
3802 		/*
3803 		 * If an error occurred while attempting
3804 		 * to fill the cache entry, just return it.
3805 		 */
3806 		if (rdc->error) {
3807 			error = rdc->error;
3808 			mutex_exit(&rp->r_statelock);
3809 			rddir_cache_rele(rdc);
3810 			if (nrdc != NULL)
3811 				rddir_cache_rele(nrdc);
3812 			return (error);
3813 		}
3814 
3815 		/*
3816 		 * The cache entry is complete and good,
3817 		 * copyout the dirent structs to the calling
3818 		 * thread.
3819 		 */
3820 		error = uiomove(rdc->entries, rdc->entlen, UIO_READ, uiop);
3821 
3822 		/*
3823 		 * If no error occurred during the copyout,
3824 		 * update the offset in the uio struct to
3825 		 * contain the value of the next cookie
3826 		 * and set the eof value appropriately.
3827 		 */
3828 		if (!error) {
3829 			uiop->uio_loffset = rdc->nfs3_ncookie;
3830 			if (eofp)
3831 				*eofp = rdc->eof;
3832 		}
3833 
3834 		/*
3835 		 * Decide whether to do readahead.
3836 		 *
3837 		 * Don't if have already read to the end of
3838 		 * directory.  There is nothing more to read.
3839 		 *
3840 		 * Don't if the application is not doing
3841 		 * lookups in the directory.  The readahead
3842 		 * is only effective if the application can
3843 		 * be doing work while an async thread is
3844 		 * handling the over the wire request.
3845 		 */
3846 		if (rdc->eof) {
3847 			rp->r_direof = rdc;
3848 			doreadahead = FALSE;
3849 		} else if (!(rp->r_flags & RLOOKUP))
3850 			doreadahead = FALSE;
3851 		else
3852 			doreadahead = TRUE;
3853 
3854 		if (!doreadahead) {
3855 			mutex_exit(&rp->r_statelock);
3856 			rddir_cache_rele(rdc);
3857 			if (nrdc != NULL)
3858 				rddir_cache_rele(nrdc);
3859 			return (error);
3860 		}
3861 
3862 		/*
3863 		 * Check to see whether we found an entry
3864 		 * for the readahead.  If so, we don't need
3865 		 * to do anything further, so free the new
3866 		 * entry if one was allocated.  Otherwise,
3867 		 * allocate a new entry, add it to the cache,
3868 		 * and then initiate an asynchronous readdir
3869 		 * operation to fill it.
3870 		 */
3871 		srdc.nfs3_cookie = rdc->nfs3_ncookie;
3872 		srdc.buflen = count;
3873 		rrdc = avl_find(&rp->r_dir, &srdc, &where);
3874 		if (rrdc != NULL) {
3875 			if (nrdc != NULL)
3876 				rddir_cache_rele(nrdc);
3877 		} else {
3878 			if (nrdc != NULL)
3879 				rrdc = nrdc;
3880 			else {
3881 				rrdc = rddir_cache_alloc(KM_NOSLEEP);
3882 			}
3883 			if (rrdc != NULL) {
3884 				rrdc->nfs3_cookie = rdc->nfs3_ncookie;
3885 				rrdc->buflen = count;
3886 				avl_insert(&rp->r_dir, rrdc, where);
3887 				rddir_cache_hold(rrdc);
3888 				mutex_exit(&rp->r_statelock);
3889 				rddir_cache_rele(rdc);
3890 #ifdef DEBUG
3891 				nfs3_readdir_readahead++;
3892 #endif
3893 				nfs_async_readdir(vp, rrdc, cr, do_nfs3readdir);
3894 				return (error);
3895 			}
3896 		}
3897 
3898 		mutex_exit(&rp->r_statelock);
3899 		rddir_cache_rele(rdc);
3900 		return (error);
3901 	}
3902 
3903 	/*
3904 	 * Didn't find an entry in the cache.  Construct a new empty
3905 	 * entry and link it into the cache.  Other processes attempting
3906 	 * to access this entry will need to wait until it is filled in.
3907 	 *
3908 	 * Since kmem_alloc may block, another pass through the cache
3909 	 * will need to be taken to make sure that another process
3910 	 * hasn't already added an entry to the cache for this request.
3911 	 */
3912 	if (nrdc == NULL) {
3913 		mutex_exit(&rp->r_statelock);
3914 		nrdc = rddir_cache_alloc(KM_SLEEP);
3915 		nrdc->nfs3_cookie = uiop->uio_loffset;
3916 		nrdc->buflen = count;
3917 		goto top;
3918 	}
3919 
3920 	/*
3921 	 * Add this entry to the cache.
3922 	 */
3923 	avl_insert(&rp->r_dir, nrdc, where);
3924 	rddir_cache_hold(nrdc);
3925 	mutex_exit(&rp->r_statelock);
3926 
3927 bottom:
3928 #ifdef DEBUG
3929 	missed = 1;
3930 	nfs3_readdir_cache_misses++;
3931 #endif
3932 	/*
3933 	 * Do the readdir.  This routine decides whether to use
3934 	 * READDIR or READDIRPLUS.
3935 	 */
3936 	error = do_nfs3readdir(vp, nrdc, cr);
3937 
3938 	/*
3939 	 * If this operation failed, just return the error which occurred.
3940 	 */
3941 	if (error != 0)
3942 		return (error);
3943 
3944 	/*
3945 	 * Since the RPC operation will have taken sometime and blocked
3946 	 * this process, another pass through the cache will need to be
3947 	 * taken to find the correct cache entry.  It is possible that
3948 	 * the correct cache entry will not be there (although one was
3949 	 * added) because the directory changed during the RPC operation
3950 	 * and the readdir cache was flushed.  In this case, just start
3951 	 * over.  It is hoped that this will not happen too often... :-)
3952 	 */
3953 	nrdc = NULL;
3954 	goto top;
3955 	/* NOTREACHED */
3956 }
3957 
3958 static int
3959 do_nfs3readdir(vnode_t *vp, rddir_cache *rdc, cred_t *cr)
3960 {
3961 	int error;
3962 	rnode_t *rp;
3963 	mntinfo_t *mi;
3964 
3965 	rp = VTOR(vp);
3966 	mi = VTOMI(vp);
3967 	ASSERT(nfs_zone() == mi->mi_zone);
3968 	/*
3969 	 * Issue the proper request.
3970 	 *
3971 	 * If the server does not support READDIRPLUS, then use READDIR.
3972 	 *
3973 	 * Otherwise --
3974 	 * Issue a READDIRPLUS if reading to fill an empty cache or if
3975 	 * an application has performed a lookup in the directory which
3976 	 * required an over the wire lookup.  The use of READDIRPLUS
3977 	 * will help to (re)populate the DNLC.
3978 	 */
3979 	if (!(mi->mi_flags & MI_READDIRONLY) &&
3980 	    (rp->r_flags & (RLOOKUP | RREADDIRPLUS))) {
3981 		if (rp->r_flags & RREADDIRPLUS) {
3982 			mutex_enter(&rp->r_statelock);
3983 			rp->r_flags &= ~RREADDIRPLUS;
3984 			mutex_exit(&rp->r_statelock);
3985 		}
3986 		nfs3readdirplus(vp, rdc, cr);
3987 		if (rdc->error == EOPNOTSUPP)
3988 			nfs3readdir(vp, rdc, cr);
3989 	} else
3990 		nfs3readdir(vp, rdc, cr);
3991 
3992 	mutex_enter(&rp->r_statelock);
3993 	rdc->flags &= ~RDDIR;
3994 	if (rdc->flags & RDDIRWAIT) {
3995 		rdc->flags &= ~RDDIRWAIT;
3996 		cv_broadcast(&rdc->cv);
3997 	}
3998 	error = rdc->error;
3999 	if (error)
4000 		rdc->flags |= RDDIRREQ;
4001 	mutex_exit(&rp->r_statelock);
4002 
4003 	rddir_cache_rele(rdc);
4004 
4005 	return (error);
4006 }
4007 
4008 static void
4009 nfs3readdir(vnode_t *vp, rddir_cache *rdc, cred_t *cr)
4010 {
4011 	int error;
4012 	READDIR3args args;
4013 	READDIR3vres res;
4014 	vattr_t dva;
4015 	rnode_t *rp;
4016 	int douprintf;
4017 	failinfo_t fi, *fip = NULL;
4018 	mntinfo_t *mi;
4019 	hrtime_t t;
4020 
4021 	rp = VTOR(vp);
4022 	mi = VTOMI(vp);
4023 	ASSERT(nfs_zone() == mi->mi_zone);
4024 
4025 	args.dir = *RTOFH3(rp);
4026 	args.cookie = (cookie3)rdc->nfs3_cookie;
4027 	args.cookieverf = rp->r_cookieverf;
4028 	args.count = rdc->buflen;
4029 
4030 	/*
4031 	 * NFS client failover support
4032 	 * suppress failover unless we have a zero cookie
4033 	 */
4034 	if (args.cookie == (cookie3) 0) {
4035 		fi.vp = vp;
4036 		fi.fhp = (caddr_t)&args.dir;
4037 		fi.copyproc = nfs3copyfh;
4038 		fi.lookupproc = nfs3lookup;
4039 		fi.xattrdirproc = acl_getxattrdir3;
4040 		fip = &fi;
4041 	}
4042 
4043 #ifdef DEBUG
4044 	rdc->entries = rddir_cache_buf_alloc(rdc->buflen, KM_SLEEP);
4045 #else
4046 	rdc->entries = kmem_alloc(rdc->buflen, KM_SLEEP);
4047 #endif
4048 
4049 	res.entries = (dirent64_t *)rdc->entries;
4050 	res.entries_size = rdc->buflen;
4051 	res.dir_attributes.fres.vap = &dva;
4052 	res.dir_attributes.fres.vp = vp;
4053 	res.loff = rdc->nfs3_cookie;
4054 
4055 	douprintf = 1;
4056 
4057 	if (mi->mi_io_kstats) {
4058 		mutex_enter(&mi->mi_lock);
4059 		kstat_runq_enter(KSTAT_IO_PTR(mi->mi_io_kstats));
4060 		mutex_exit(&mi->mi_lock);
4061 	}
4062 
4063 	t = gethrtime();
4064 
4065 	error = rfs3call(VTOMI(vp), NFSPROC3_READDIR,
4066 	    xdr_READDIR3args, (caddr_t)&args,
4067 	    xdr_READDIR3vres, (caddr_t)&res, cr,
4068 	    &douprintf, &res.status, 0, fip);
4069 
4070 	if (mi->mi_io_kstats) {
4071 		mutex_enter(&mi->mi_lock);
4072 		kstat_runq_exit(KSTAT_IO_PTR(mi->mi_io_kstats));
4073 		mutex_exit(&mi->mi_lock);
4074 	}
4075 
4076 	if (error)
4077 		goto err;
4078 
4079 	nfs3_cache_post_op_vattr(vp, &res.dir_attributes, t, cr);
4080 
4081 	error = geterrno3(res.status);
4082 	if (error) {
4083 		PURGE_STALE_FH(error, vp, cr);
4084 		goto err;
4085 	}
4086 
4087 	if (mi->mi_io_kstats) {
4088 		mutex_enter(&mi->mi_lock);
4089 		KSTAT_IO_PTR(mi->mi_io_kstats)->reads++;
4090 		KSTAT_IO_PTR(mi->mi_io_kstats)->nread += res.size;
4091 		mutex_exit(&mi->mi_lock);
4092 	}
4093 
4094 	rdc->nfs3_ncookie = res.loff;
4095 	rp->r_cookieverf = res.cookieverf;
4096 	rdc->eof = res.eof ? 1 : 0;
4097 	rdc->entlen = res.size;
4098 	ASSERT(rdc->entlen <= rdc->buflen);
4099 	rdc->error = 0;
4100 	return;
4101 
4102 err:
4103 	kmem_free(rdc->entries, rdc->buflen);
4104 	rdc->entries = NULL;
4105 	rdc->error = error;
4106 }
4107 
4108 /*
4109  * Read directory entries.
4110  * There are some weird things to look out for here.  The uio_loffset
4111  * field is either 0 or it is the offset returned from a previous
4112  * readdir.  It is an opaque value used by the server to find the
4113  * correct directory block to read. The count field is the number
4114  * of blocks to read on the server.  This is advisory only, the server
4115  * may return only one block's worth of entries.  Entries may be compressed
4116  * on the server.
4117  */
4118 static void
4119 nfs3readdirplus(vnode_t *vp, rddir_cache *rdc, cred_t *cr)
4120 {
4121 	int error;
4122 	READDIRPLUS3args args;
4123 	READDIRPLUS3vres res;
4124 	vattr_t dva;
4125 	rnode_t *rp;
4126 	mntinfo_t *mi;
4127 	int douprintf;
4128 	failinfo_t fi, *fip = NULL;
4129 
4130 	rp = VTOR(vp);
4131 	mi = VTOMI(vp);
4132 	ASSERT(nfs_zone() == mi->mi_zone);
4133 
4134 	args.dir = *RTOFH3(rp);
4135 	args.cookie = (cookie3)rdc->nfs3_cookie;
4136 	args.cookieverf = rp->r_cookieverf;
4137 	args.dircount = rdc->buflen;
4138 	args.maxcount = mi->mi_tsize;
4139 
4140 	/*
4141 	 * NFS client failover support
4142 	 * suppress failover unless we have a zero cookie
4143 	 */
4144 	if (args.cookie == (cookie3)0) {
4145 		fi.vp = vp;
4146 		fi.fhp = (caddr_t)&args.dir;
4147 		fi.copyproc = nfs3copyfh;
4148 		fi.lookupproc = nfs3lookup;
4149 		fi.xattrdirproc = acl_getxattrdir3;
4150 		fip = &fi;
4151 	}
4152 
4153 #ifdef DEBUG
4154 	rdc->entries = rddir_cache_buf_alloc(rdc->buflen, KM_SLEEP);
4155 #else
4156 	rdc->entries = kmem_alloc(rdc->buflen, KM_SLEEP);
4157 #endif
4158 
4159 	res.entries = (dirent64_t *)rdc->entries;
4160 	res.entries_size = rdc->buflen;
4161 	res.dir_attributes.fres.vap = &dva;
4162 	res.dir_attributes.fres.vp = vp;
4163 	res.loff = rdc->nfs3_cookie;
4164 	res.credentials = cr;
4165 
4166 	douprintf = 1;
4167 
4168 	if (mi->mi_io_kstats) {
4169 		mutex_enter(&mi->mi_lock);
4170 		kstat_runq_enter(KSTAT_IO_PTR(mi->mi_io_kstats));
4171 		mutex_exit(&mi->mi_lock);
4172 	}
4173 
4174 	res.time = gethrtime();
4175 
4176 	error = rfs3call(mi, NFSPROC3_READDIRPLUS,
4177 	    xdr_READDIRPLUS3args, (caddr_t)&args,
4178 	    xdr_READDIRPLUS3vres, (caddr_t)&res, cr,
4179 	    &douprintf, &res.status, 0, fip);
4180 
4181 	if (mi->mi_io_kstats) {
4182 		mutex_enter(&mi->mi_lock);
4183 		kstat_runq_exit(KSTAT_IO_PTR(mi->mi_io_kstats));
4184 		mutex_exit(&mi->mi_lock);
4185 	}
4186 
4187 	if (error) {
4188 		goto err;
4189 	}
4190 
4191 	nfs3_cache_post_op_vattr(vp, &res.dir_attributes, res.time, cr);
4192 
4193 	error = geterrno3(res.status);
4194 	if (error) {
4195 		PURGE_STALE_FH(error, vp, cr);
4196 		if (error == EOPNOTSUPP) {
4197 			mutex_enter(&mi->mi_lock);
4198 			mi->mi_flags |= MI_READDIRONLY;
4199 			mutex_exit(&mi->mi_lock);
4200 		}
4201 		goto err;
4202 	}
4203 
4204 	if (mi->mi_io_kstats) {
4205 		mutex_enter(&mi->mi_lock);
4206 		KSTAT_IO_PTR(mi->mi_io_kstats)->reads++;
4207 		KSTAT_IO_PTR(mi->mi_io_kstats)->nread += res.size;
4208 		mutex_exit(&mi->mi_lock);
4209 	}
4210 
4211 	rdc->nfs3_ncookie = res.loff;
4212 	rp->r_cookieverf = res.cookieverf;
4213 	rdc->eof = res.eof ? 1 : 0;
4214 	rdc->entlen = res.size;
4215 	ASSERT(rdc->entlen <= rdc->buflen);
4216 	rdc->error = 0;
4217 
4218 	return;
4219 
4220 err:
4221 	kmem_free(rdc->entries, rdc->buflen);
4222 	rdc->entries = NULL;
4223 	rdc->error = error;
4224 }
4225 
4226 #ifdef DEBUG
4227 static int nfs3_bio_do_stop = 0;
4228 #endif
4229 
4230 static int
4231 nfs3_bio(struct buf *bp, stable_how *stab_comm, cred_t *cr)
4232 {
4233 	rnode_t *rp = VTOR(bp->b_vp);
4234 	int count;
4235 	int error;
4236 	cred_t *cred;
4237 	offset_t offset;
4238 
4239 	ASSERT(nfs_zone() == VTOMI(bp->b_vp)->mi_zone);
4240 	offset = ldbtob(bp->b_lblkno);
4241 
4242 	DTRACE_IO1(start, struct buf *, bp);
4243 
4244 	if (bp->b_flags & B_READ) {
4245 		mutex_enter(&rp->r_statelock);
4246 		if (rp->r_cred != NULL) {
4247 			cred = rp->r_cred;
4248 			crhold(cred);
4249 		} else {
4250 			rp->r_cred = cr;
4251 			crhold(cr);
4252 			cred = cr;
4253 			crhold(cred);
4254 		}
4255 		mutex_exit(&rp->r_statelock);
4256 	read_again:
4257 		error = bp->b_error = nfs3read(bp->b_vp, bp->b_un.b_addr,
4258 		    offset, bp->b_bcount, &bp->b_resid, cred);
4259 		crfree(cred);
4260 		if (!error) {
4261 			if (bp->b_resid) {
4262 				/*
4263 				 * Didn't get it all because we hit EOF,
4264 				 * zero all the memory beyond the EOF.
4265 				 */
4266 				/* bzero(rdaddr + */
4267 				bzero(bp->b_un.b_addr +
4268 				    bp->b_bcount - bp->b_resid, bp->b_resid);
4269 			}
4270 			mutex_enter(&rp->r_statelock);
4271 			if (bp->b_resid == bp->b_bcount &&
4272 			    offset >= rp->r_size) {
4273 				/*
4274 				 * We didn't read anything at all as we are
4275 				 * past EOF.  Return an error indicator back
4276 				 * but don't destroy the pages (yet).
4277 				 */
4278 				error = NFS_EOF;
4279 			}
4280 			mutex_exit(&rp->r_statelock);
4281 		} else if (error == EACCES) {
4282 			mutex_enter(&rp->r_statelock);
4283 			if (cred != cr) {
4284 				if (rp->r_cred != NULL)
4285 					crfree(rp->r_cred);
4286 				rp->r_cred = cr;
4287 				crhold(cr);
4288 				cred = cr;
4289 				crhold(cred);
4290 				mutex_exit(&rp->r_statelock);
4291 				goto read_again;
4292 			}
4293 			mutex_exit(&rp->r_statelock);
4294 		}
4295 	} else {
4296 		if (!(rp->r_flags & RSTALE)) {
4297 			mutex_enter(&rp->r_statelock);
4298 			if (rp->r_cred != NULL) {
4299 				cred = rp->r_cred;
4300 				crhold(cred);
4301 			} else {
4302 				rp->r_cred = cr;
4303 				crhold(cr);
4304 				cred = cr;
4305 				crhold(cred);
4306 			}
4307 			mutex_exit(&rp->r_statelock);
4308 		write_again:
4309 			mutex_enter(&rp->r_statelock);
4310 			count = MIN(bp->b_bcount, rp->r_size - offset);
4311 			mutex_exit(&rp->r_statelock);
4312 			if (count < 0)
4313 				cmn_err(CE_PANIC, "nfs3_bio: write count < 0");
4314 #ifdef DEBUG
4315 			if (count == 0) {
4316 				zcmn_err(getzoneid(), CE_WARN,
4317 				    "nfs3_bio: zero length write at %lld",
4318 				    offset);
4319 				nfs_printfhandle(&rp->r_fh);
4320 				if (nfs3_bio_do_stop)
4321 					debug_enter("nfs3_bio");
4322 			}
4323 #endif
4324 			error = nfs3write(bp->b_vp, bp->b_un.b_addr, offset,
4325 			    count, cred, stab_comm);
4326 			if (error == EACCES) {
4327 				mutex_enter(&rp->r_statelock);
4328 				if (cred != cr) {
4329 					if (rp->r_cred != NULL)
4330 						crfree(rp->r_cred);
4331 					rp->r_cred = cr;
4332 					crhold(cr);
4333 					crfree(cred);
4334 					cred = cr;
4335 					crhold(cred);
4336 					mutex_exit(&rp->r_statelock);
4337 					goto write_again;
4338 				}
4339 				mutex_exit(&rp->r_statelock);
4340 			}
4341 			bp->b_error = error;
4342 			if (error && error != EINTR) {
4343 				/*
4344 				 * Don't print EDQUOT errors on the console.
4345 				 * Don't print asynchronous EACCES errors.
4346 				 * Don't print EFBIG errors.
4347 				 * Print all other write errors.
4348 				 */
4349 				if (error != EDQUOT && error != EFBIG &&
4350 				    (error != EACCES ||
4351 				    !(bp->b_flags & B_ASYNC)))
4352 					nfs_write_error(bp->b_vp, error, cred);
4353 				/*
4354 				 * Update r_error and r_flags as appropriate.
4355 				 * If the error was ESTALE, then mark the
4356 				 * rnode as not being writeable and save
4357 				 * the error status.  Otherwise, save any
4358 				 * errors which occur from asynchronous
4359 				 * page invalidations.  Any errors occurring
4360 				 * from other operations should be saved
4361 				 * by the caller.
4362 				 */
4363 				mutex_enter(&rp->r_statelock);
4364 				if (error == ESTALE) {
4365 					rp->r_flags |= RSTALE;
4366 					if (!rp->r_error)
4367 						rp->r_error = error;
4368 				} else if (!rp->r_error &&
4369 				    (bp->b_flags &
4370 				    (B_INVAL|B_FORCE|B_ASYNC)) ==
4371 				    (B_INVAL|B_FORCE|B_ASYNC)) {
4372 					rp->r_error = error;
4373 				}
4374 				mutex_exit(&rp->r_statelock);
4375 			}
4376 			crfree(cred);
4377 		} else
4378 			error = rp->r_error;
4379 	}
4380 
4381 	if (error != 0 && error != NFS_EOF)
4382 		bp->b_flags |= B_ERROR;
4383 
4384 	DTRACE_IO1(done, struct buf *, bp);
4385 
4386 	return (error);
4387 }
4388 
4389 /* ARGSUSED */
4390 static int
4391 nfs3_fid(vnode_t *vp, fid_t *fidp, caller_context_t *ct)
4392 {
4393 	rnode_t *rp;
4394 
4395 	if (nfs_zone() != VTOMI(vp)->mi_zone)
4396 		return (EIO);
4397 	rp = VTOR(vp);
4398 
4399 	if (fidp->fid_len < (ushort_t)rp->r_fh.fh_len) {
4400 		fidp->fid_len = rp->r_fh.fh_len;
4401 		return (ENOSPC);
4402 	}
4403 	fidp->fid_len = rp->r_fh.fh_len;
4404 	bcopy(rp->r_fh.fh_buf, fidp->fid_data, fidp->fid_len);
4405 	return (0);
4406 }
4407 
4408 /* ARGSUSED2 */
4409 static int
4410 nfs3_rwlock(vnode_t *vp, int write_lock, caller_context_t *ctp)
4411 {
4412 	rnode_t *rp = VTOR(vp);
4413 
4414 	if (!write_lock) {
4415 		(void) nfs_rw_enter_sig(&rp->r_rwlock, RW_READER, FALSE);
4416 		return (V_WRITELOCK_FALSE);
4417 	}
4418 
4419 	if ((rp->r_flags & RDIRECTIO) || (VTOMI(vp)->mi_flags & MI_DIRECTIO)) {
4420 		(void) nfs_rw_enter_sig(&rp->r_rwlock, RW_READER, FALSE);
4421 		if (rp->r_mapcnt == 0 && !vn_has_cached_data(vp))
4422 			return (V_WRITELOCK_FALSE);
4423 		nfs_rw_exit(&rp->r_rwlock);
4424 	}
4425 
4426 	(void) nfs_rw_enter_sig(&rp->r_rwlock, RW_WRITER, FALSE);
4427 	return (V_WRITELOCK_TRUE);
4428 }
4429 
4430 /* ARGSUSED */
4431 static void
4432 nfs3_rwunlock(vnode_t *vp, int write_lock, caller_context_t *ctp)
4433 {
4434 	rnode_t *rp = VTOR(vp);
4435 
4436 	nfs_rw_exit(&rp->r_rwlock);
4437 }
4438 
4439 /* ARGSUSED */
4440 static int
4441 nfs3_seek(vnode_t *vp, offset_t ooff, offset_t *noffp, caller_context_t *ct)
4442 {
4443 
4444 	/*
4445 	 * Because we stuff the readdir cookie into the offset field
4446 	 * someone may attempt to do an lseek with the cookie which
4447 	 * we want to succeed.
4448 	 */
4449 	if (vp->v_type == VDIR)
4450 		return (0);
4451 	if (*noffp < 0)
4452 		return (EINVAL);
4453 	return (0);
4454 }
4455 
4456 /*
4457  * number of nfs3_bsize blocks to read ahead.
4458  */
4459 static int nfs3_nra = 4;
4460 
4461 #ifdef DEBUG
4462 static int nfs3_lostpage = 0;	/* number of times we lost original page */
4463 #endif
4464 
4465 /*
4466  * Return all the pages from [off..off+len) in file
4467  */
4468 /* ARGSUSED */
4469 static int
4470 nfs3_getpage(vnode_t *vp, offset_t off, size_t len, uint_t *protp,
4471 	page_t *pl[], size_t plsz, struct seg *seg, caddr_t addr,
4472 	enum seg_rw rw, cred_t *cr, caller_context_t *ct)
4473 {
4474 	rnode_t *rp;
4475 	int error;
4476 	mntinfo_t *mi;
4477 
4478 	if (vp->v_flag & VNOMAP)
4479 		return (ENOSYS);
4480 
4481 	if (nfs_zone() != VTOMI(vp)->mi_zone)
4482 		return (EIO);
4483 	if (protp != NULL)
4484 		*protp = PROT_ALL;
4485 
4486 	/*
4487 	 * Now valididate that the caches are up to date.
4488 	 */
4489 	error = nfs3_validate_caches(vp, cr);
4490 	if (error)
4491 		return (error);
4492 
4493 	rp = VTOR(vp);
4494 	mi = VTOMI(vp);
4495 retry:
4496 	mutex_enter(&rp->r_statelock);
4497 
4498 	/*
4499 	 * Don't create dirty pages faster than they
4500 	 * can be cleaned so that the system doesn't
4501 	 * get imbalanced.  If the async queue is
4502 	 * maxed out, then wait for it to drain before
4503 	 * creating more dirty pages.  Also, wait for
4504 	 * any threads doing pagewalks in the vop_getattr
4505 	 * entry points so that they don't block for
4506 	 * long periods.
4507 	 */
4508 	if (rw == S_CREATE) {
4509 		while ((mi->mi_max_threads != 0 &&
4510 		    rp->r_awcount > 2 * mi->mi_max_threads) ||
4511 		    rp->r_gcount > 0)
4512 			cv_wait(&rp->r_cv, &rp->r_statelock);
4513 	}
4514 
4515 	/*
4516 	 * If we are getting called as a side effect of an nfs_write()
4517 	 * operation the local file size might not be extended yet.
4518 	 * In this case we want to be able to return pages of zeroes.
4519 	 */
4520 	if (off + len > rp->r_size + PAGEOFFSET && seg != segkmap) {
4521 		mutex_exit(&rp->r_statelock);
4522 		return (EFAULT);		/* beyond EOF */
4523 	}
4524 
4525 	mutex_exit(&rp->r_statelock);
4526 
4527 	if (len <= PAGESIZE) {
4528 		error = nfs3_getapage(vp, off, len, protp, pl, plsz,
4529 		    seg, addr, rw, cr);
4530 	} else {
4531 		error = pvn_getpages(nfs3_getapage, vp, off, len, protp,
4532 		    pl, plsz, seg, addr, rw, cr);
4533 	}
4534 
4535 	switch (error) {
4536 	case NFS_EOF:
4537 		nfs_purge_caches(vp, NFS_NOPURGE_DNLC, cr);
4538 		goto retry;
4539 	case ESTALE:
4540 		PURGE_STALE_FH(error, vp, cr);
4541 	}
4542 
4543 	return (error);
4544 }
4545 
4546 /*
4547  * Called from pvn_getpages or nfs3_getpage to get a particular page.
4548  */
4549 /* ARGSUSED */
4550 static int
4551 nfs3_getapage(vnode_t *vp, u_offset_t off, size_t len, uint_t *protp,
4552 	page_t *pl[], size_t plsz, struct seg *seg, caddr_t addr,
4553 	enum seg_rw rw, cred_t *cr)
4554 {
4555 	rnode_t *rp;
4556 	uint_t bsize;
4557 	struct buf *bp;
4558 	page_t *pp;
4559 	u_offset_t lbn;
4560 	u_offset_t io_off;
4561 	u_offset_t blkoff;
4562 	u_offset_t rablkoff;
4563 	size_t io_len;
4564 	uint_t blksize;
4565 	int error;
4566 	int readahead;
4567 	int readahead_issued = 0;
4568 	int ra_window; /* readahead window */
4569 	page_t *pagefound;
4570 	page_t *savepp;
4571 
4572 	if (nfs_zone() != VTOMI(vp)->mi_zone)
4573 		return (EIO);
4574 	rp = VTOR(vp);
4575 	bsize = MAX(vp->v_vfsp->vfs_bsize, PAGESIZE);
4576 
4577 reread:
4578 	bp = NULL;
4579 	pp = NULL;
4580 	pagefound = NULL;
4581 
4582 	if (pl != NULL)
4583 		pl[0] = NULL;
4584 
4585 	error = 0;
4586 	lbn = off / bsize;
4587 	blkoff = lbn * bsize;
4588 
4589 	/*
4590 	 * Queueing up the readahead before doing the synchronous read
4591 	 * results in a significant increase in read throughput because
4592 	 * of the increased parallelism between the async threads and
4593 	 * the process context.
4594 	 */
4595 	if ((off & ((vp->v_vfsp->vfs_bsize) - 1)) == 0 &&
4596 	    rw != S_CREATE &&
4597 	    !(vp->v_flag & VNOCACHE)) {
4598 		mutex_enter(&rp->r_statelock);
4599 
4600 		/*
4601 		 * Calculate the number of readaheads to do.
4602 		 * a) No readaheads at offset = 0.
4603 		 * b) Do maximum(nfs3_nra) readaheads when the readahead
4604 		 *    window is closed.
4605 		 * c) Do readaheads between 1 to (nfs3_nra - 1) depending
4606 		 *    upon how far the readahead window is open or close.
4607 		 * d) No readaheads if rp->r_nextr is not within the scope
4608 		 *    of the readahead window (random i/o).
4609 		 */
4610 
4611 		if (off == 0)
4612 			readahead = 0;
4613 		else if (blkoff == rp->r_nextr)
4614 			readahead = nfs3_nra;
4615 		else if (rp->r_nextr > blkoff &&
4616 				((ra_window = (rp->r_nextr - blkoff) / bsize)
4617 					<= (nfs3_nra - 1)))
4618 			readahead = nfs3_nra - ra_window;
4619 		else
4620 			readahead = 0;
4621 
4622 		rablkoff = rp->r_nextr;
4623 		while (readahead > 0 && rablkoff + bsize < rp->r_size) {
4624 			mutex_exit(&rp->r_statelock);
4625 			if (nfs_async_readahead(vp, rablkoff + bsize,
4626 			    addr + (rablkoff + bsize - off), seg, cr,
4627 			    nfs3_readahead) < 0) {
4628 				mutex_enter(&rp->r_statelock);
4629 				break;
4630 			}
4631 			readahead--;
4632 			rablkoff += bsize;
4633 			/*
4634 			 * Indicate that we did a readahead so
4635 			 * readahead offset is not updated
4636 			 * by the synchronous read below.
4637 			 */
4638 			readahead_issued = 1;
4639 			mutex_enter(&rp->r_statelock);
4640 			/*
4641 			 * set readahead offset to
4642 			 * offset of last async readahead
4643 			 * request.
4644 			 */
4645 			rp->r_nextr = rablkoff;
4646 		}
4647 		mutex_exit(&rp->r_statelock);
4648 	}
4649 
4650 again:
4651 	if ((pagefound = page_exists(vp, off)) == NULL) {
4652 		if (pl == NULL) {
4653 			(void) nfs_async_readahead(vp, blkoff, addr, seg, cr,
4654 			    nfs3_readahead);
4655 		} else if (rw == S_CREATE) {
4656 			/*
4657 			 * Block for this page is not allocated, or the offset
4658 			 * is beyond the current allocation size, or we're
4659 			 * allocating a swap slot and the page was not found,
4660 			 * so allocate it and return a zero page.
4661 			 */
4662 			if ((pp = page_create_va(vp, off,
4663 			    PAGESIZE, PG_WAIT, seg, addr)) == NULL)
4664 				cmn_err(CE_PANIC, "nfs3_getapage: page_create");
4665 			io_len = PAGESIZE;
4666 			mutex_enter(&rp->r_statelock);
4667 			rp->r_nextr = off + PAGESIZE;
4668 			mutex_exit(&rp->r_statelock);
4669 		} else {
4670 			/*
4671 			 * Need to go to server to get a BLOCK, exception to
4672 			 * that being while reading at offset = 0 or doing
4673 			 * random i/o, in that case read only a PAGE.
4674 			 */
4675 			mutex_enter(&rp->r_statelock);
4676 			if (blkoff < rp->r_size &&
4677 			    blkoff + bsize >= rp->r_size) {
4678 				/*
4679 				 * If only a block or less is left in
4680 				 * the file, read all that is remaining.
4681 				 */
4682 				if (rp->r_size <= off) {
4683 					/*
4684 					 * Trying to access beyond EOF,
4685 					 * set up to get at least one page.
4686 					 */
4687 					blksize = off + PAGESIZE - blkoff;
4688 				} else
4689 					blksize = rp->r_size - blkoff;
4690 			} else if ((off == 0) ||
4691 				(off != rp->r_nextr && !readahead_issued)) {
4692 				blksize = PAGESIZE;
4693 				blkoff = off; /* block = page here */
4694 			} else
4695 				blksize = bsize;
4696 			mutex_exit(&rp->r_statelock);
4697 
4698 			pp = pvn_read_kluster(vp, off, seg, addr, &io_off,
4699 			    &io_len, blkoff, blksize, 0);
4700 
4701 			/*
4702 			 * Some other thread has entered the page,
4703 			 * so just use it.
4704 			 */
4705 			if (pp == NULL)
4706 				goto again;
4707 
4708 			/*
4709 			 * Now round the request size up to page boundaries.
4710 			 * This ensures that the entire page will be
4711 			 * initialized to zeroes if EOF is encountered.
4712 			 */
4713 			io_len = ptob(btopr(io_len));
4714 
4715 			bp = pageio_setup(pp, io_len, vp, B_READ);
4716 			ASSERT(bp != NULL);
4717 
4718 			/*
4719 			 * pageio_setup should have set b_addr to 0.  This
4720 			 * is correct since we want to do I/O on a page
4721 			 * boundary.  bp_mapin will use this addr to calculate
4722 			 * an offset, and then set b_addr to the kernel virtual
4723 			 * address it allocated for us.
4724 			 */
4725 			ASSERT(bp->b_un.b_addr == 0);
4726 
4727 			bp->b_edev = 0;
4728 			bp->b_dev = 0;
4729 			bp->b_lblkno = lbtodb(io_off);
4730 			bp->b_file = vp;
4731 			bp->b_offset = (offset_t)off;
4732 			bp_mapin(bp);
4733 
4734 			/*
4735 			 * If doing a write beyond what we believe is EOF,
4736 			 * don't bother trying to read the pages from the
4737 			 * server, we'll just zero the pages here.  We
4738 			 * don't check that the rw flag is S_WRITE here
4739 			 * because some implementations may attempt a
4740 			 * read access to the buffer before copying data.
4741 			 */
4742 			mutex_enter(&rp->r_statelock);
4743 			if (io_off >= rp->r_size && seg == segkmap) {
4744 				mutex_exit(&rp->r_statelock);
4745 				bzero(bp->b_un.b_addr, io_len);
4746 			} else {
4747 				mutex_exit(&rp->r_statelock);
4748 				error = nfs3_bio(bp, NULL, cr);
4749 			}
4750 
4751 			/*
4752 			 * Unmap the buffer before freeing it.
4753 			 */
4754 			bp_mapout(bp);
4755 			pageio_done(bp);
4756 
4757 			savepp = pp;
4758 			do {
4759 				pp->p_fsdata = C_NOCOMMIT;
4760 			} while ((pp = pp->p_next) != savepp);
4761 
4762 			if (error == NFS_EOF) {
4763 				/*
4764 				 * If doing a write system call just return
4765 				 * zeroed pages, else user tried to get pages
4766 				 * beyond EOF, return error.  We don't check
4767 				 * that the rw flag is S_WRITE here because
4768 				 * some implementations may attempt a read
4769 				 * access to the buffer before copying data.
4770 				 */
4771 				if (seg == segkmap)
4772 					error = 0;
4773 				else
4774 					error = EFAULT;
4775 			}
4776 
4777 			if (!readahead_issued && !error) {
4778 				mutex_enter(&rp->r_statelock);
4779 				rp->r_nextr = io_off + io_len;
4780 				mutex_exit(&rp->r_statelock);
4781 			}
4782 		}
4783 	}
4784 
4785 out:
4786 	if (pl == NULL)
4787 		return (error);
4788 
4789 	if (error) {
4790 		if (pp != NULL)
4791 			pvn_read_done(pp, B_ERROR);
4792 		return (error);
4793 	}
4794 
4795 	if (pagefound) {
4796 		se_t se = (rw == S_CREATE ? SE_EXCL : SE_SHARED);
4797 
4798 		/*
4799 		 * Page exists in the cache, acquire the appropriate lock.
4800 		 * If this fails, start all over again.
4801 		 */
4802 		if ((pp = page_lookup(vp, off, se)) == NULL) {
4803 #ifdef DEBUG
4804 			nfs3_lostpage++;
4805 #endif
4806 			goto reread;
4807 		}
4808 		pl[0] = pp;
4809 		pl[1] = NULL;
4810 		return (0);
4811 	}
4812 
4813 	if (pp != NULL)
4814 		pvn_plist_init(pp, pl, plsz, off, io_len, rw);
4815 
4816 	return (error);
4817 }
4818 
4819 static void
4820 nfs3_readahead(vnode_t *vp, u_offset_t blkoff, caddr_t addr, struct seg *seg,
4821 	cred_t *cr)
4822 {
4823 	int error;
4824 	page_t *pp;
4825 	u_offset_t io_off;
4826 	size_t io_len;
4827 	struct buf *bp;
4828 	uint_t bsize, blksize;
4829 	rnode_t *rp = VTOR(vp);
4830 	page_t *savepp;
4831 
4832 	ASSERT(nfs_zone() == VTOMI(vp)->mi_zone);
4833 	bsize = MAX(vp->v_vfsp->vfs_bsize, PAGESIZE);
4834 
4835 	mutex_enter(&rp->r_statelock);
4836 	if (blkoff < rp->r_size && blkoff + bsize > rp->r_size) {
4837 		/*
4838 		 * If less than a block left in file read less
4839 		 * than a block.
4840 		 */
4841 		blksize = rp->r_size - blkoff;
4842 	} else
4843 		blksize = bsize;
4844 	mutex_exit(&rp->r_statelock);
4845 
4846 	pp = pvn_read_kluster(vp, blkoff, segkmap, addr,
4847 	    &io_off, &io_len, blkoff, blksize, 1);
4848 	/*
4849 	 * The isra flag passed to the kluster function is 1, we may have
4850 	 * gotten a return value of NULL for a variety of reasons (# of free
4851 	 * pages < minfree, someone entered the page on the vnode etc). In all
4852 	 * cases, we want to punt on the readahead.
4853 	 */
4854 	if (pp == NULL)
4855 		return;
4856 
4857 	/*
4858 	 * Now round the request size up to page boundaries.
4859 	 * This ensures that the entire page will be
4860 	 * initialized to zeroes if EOF is encountered.
4861 	 */
4862 	io_len = ptob(btopr(io_len));
4863 
4864 	bp = pageio_setup(pp, io_len, vp, B_READ);
4865 	ASSERT(bp != NULL);
4866 
4867 	/*
4868 	 * pageio_setup should have set b_addr to 0.  This is correct since
4869 	 * we want to do I/O on a page boundary. bp_mapin() will use this addr
4870 	 * to calculate an offset, and then set b_addr to the kernel virtual
4871 	 * address it allocated for us.
4872 	 */
4873 	ASSERT(bp->b_un.b_addr == 0);
4874 
4875 	bp->b_edev = 0;
4876 	bp->b_dev = 0;
4877 	bp->b_lblkno = lbtodb(io_off);
4878 	bp->b_file = vp;
4879 	bp->b_offset = (offset_t)blkoff;
4880 	bp_mapin(bp);
4881 
4882 	/*
4883 	 * If doing a write beyond what we believe is EOF, don't bother trying
4884 	 * to read the pages from the server, we'll just zero the pages here.
4885 	 * We don't check that the rw flag is S_WRITE here because some
4886 	 * implementations may attempt a read access to the buffer before
4887 	 * copying data.
4888 	 */
4889 	mutex_enter(&rp->r_statelock);
4890 	if (io_off >= rp->r_size && seg == segkmap) {
4891 		mutex_exit(&rp->r_statelock);
4892 		bzero(bp->b_un.b_addr, io_len);
4893 		error = 0;
4894 	} else {
4895 		mutex_exit(&rp->r_statelock);
4896 		error = nfs3_bio(bp, NULL, cr);
4897 		if (error == NFS_EOF)
4898 			error = 0;
4899 	}
4900 
4901 	/*
4902 	 * Unmap the buffer before freeing it.
4903 	 */
4904 	bp_mapout(bp);
4905 	pageio_done(bp);
4906 
4907 	savepp = pp;
4908 	do {
4909 		pp->p_fsdata = C_NOCOMMIT;
4910 	} while ((pp = pp->p_next) != savepp);
4911 
4912 	pvn_read_done(pp, error ? B_READ | B_ERROR : B_READ);
4913 
4914 	/*
4915 	 * In case of error set readahead offset
4916 	 * to the lowest offset.
4917 	 * pvn_read_done() calls VN_DISPOSE to destroy the pages
4918 	 */
4919 	if (error && rp->r_nextr > io_off) {
4920 		mutex_enter(&rp->r_statelock);
4921 		if (rp->r_nextr > io_off)
4922 			rp->r_nextr = io_off;
4923 		mutex_exit(&rp->r_statelock);
4924 	}
4925 }
4926 
4927 /*
4928  * Flags are composed of {B_INVAL, B_FREE, B_DONTNEED, B_FORCE}
4929  * If len == 0, do from off to EOF.
4930  *
4931  * The normal cases should be len == 0 && off == 0 (entire vp list),
4932  * len == MAXBSIZE (from segmap_release actions), and len == PAGESIZE
4933  * (from pageout).
4934  */
4935 /* ARGSUSED */
4936 static int
4937 nfs3_putpage(vnode_t *vp, offset_t off, size_t len, int flags, cred_t *cr,
4938 	caller_context_t *ct)
4939 {
4940 	int error;
4941 	rnode_t *rp;
4942 
4943 	ASSERT(cr != NULL);
4944 
4945 	/*
4946 	 * XXX - Why should this check be made here?
4947 	 */
4948 	if (vp->v_flag & VNOMAP)
4949 		return (ENOSYS);
4950 	if (len == 0 && !(flags & B_INVAL) && vn_is_readonly(vp))
4951 		return (0);
4952 	if (!(flags & B_ASYNC) && nfs_zone() != VTOMI(vp)->mi_zone)
4953 		return (EIO);
4954 
4955 	rp = VTOR(vp);
4956 	mutex_enter(&rp->r_statelock);
4957 	rp->r_count++;
4958 	mutex_exit(&rp->r_statelock);
4959 	error = nfs_putpages(vp, off, len, flags, cr);
4960 	mutex_enter(&rp->r_statelock);
4961 	rp->r_count--;
4962 	cv_broadcast(&rp->r_cv);
4963 	mutex_exit(&rp->r_statelock);
4964 
4965 	return (error);
4966 }
4967 
4968 /*
4969  * Write out a single page, possibly klustering adjacent dirty pages.
4970  */
4971 int
4972 nfs3_putapage(vnode_t *vp, page_t *pp, u_offset_t *offp, size_t *lenp,
4973 	int flags, cred_t *cr)
4974 {
4975 	u_offset_t io_off;
4976 	u_offset_t lbn_off;
4977 	u_offset_t lbn;
4978 	size_t io_len;
4979 	uint_t bsize;
4980 	int error;
4981 	rnode_t *rp;
4982 
4983 	ASSERT(!vn_is_readonly(vp));
4984 	ASSERT(pp != NULL);
4985 	ASSERT(cr != NULL);
4986 	ASSERT((flags & B_ASYNC) || nfs_zone() == VTOMI(vp)->mi_zone);
4987 
4988 	rp = VTOR(vp);
4989 	ASSERT(rp->r_count > 0);
4990 
4991 	bsize = MAX(vp->v_vfsp->vfs_bsize, PAGESIZE);
4992 	lbn = pp->p_offset / bsize;
4993 	lbn_off = lbn * bsize;
4994 
4995 	/*
4996 	 * Find a kluster that fits in one block, or in
4997 	 * one page if pages are bigger than blocks.  If
4998 	 * there is less file space allocated than a whole
4999 	 * page, we'll shorten the i/o request below.
5000 	 */
5001 	pp = pvn_write_kluster(vp, pp, &io_off, &io_len, lbn_off,
5002 	    roundup(bsize, PAGESIZE), flags);
5003 
5004 	/*
5005 	 * pvn_write_kluster shouldn't have returned a page with offset
5006 	 * behind the original page we were given.  Verify that.
5007 	 */
5008 	ASSERT((pp->p_offset / bsize) >= lbn);
5009 
5010 	/*
5011 	 * Now pp will have the list of kept dirty pages marked for
5012 	 * write back.  It will also handle invalidation and freeing
5013 	 * of pages that are not dirty.  Check for page length rounding
5014 	 * problems.
5015 	 */
5016 	if (io_off + io_len > lbn_off + bsize) {
5017 		ASSERT((io_off + io_len) - (lbn_off + bsize) < PAGESIZE);
5018 		io_len = lbn_off + bsize - io_off;
5019 	}
5020 	/*
5021 	 * The RMODINPROGRESS flag makes sure that nfs(3)_bio() sees a
5022 	 * consistent value of r_size. RMODINPROGRESS is set in writerp().
5023 	 * When RMODINPROGRESS is set it indicates that a uiomove() is in
5024 	 * progress and the r_size has not been made consistent with the
5025 	 * new size of the file. When the uiomove() completes the r_size is
5026 	 * updated and the RMODINPROGRESS flag is cleared.
5027 	 *
5028 	 * The RMODINPROGRESS flag makes sure that nfs(3)_bio() sees a
5029 	 * consistent value of r_size. Without this handshaking, it is
5030 	 * possible that nfs(3)_bio() picks  up the old value of r_size
5031 	 * before the uiomove() in writerp() completes. This will result
5032 	 * in the write through nfs(3)_bio() being dropped.
5033 	 *
5034 	 * More precisely, there is a window between the time the uiomove()
5035 	 * completes and the time the r_size is updated. If a VOP_PUTPAGE()
5036 	 * operation intervenes in this window, the page will be picked up,
5037 	 * because it is dirty (it will be unlocked, unless it was
5038 	 * pagecreate'd). When the page is picked up as dirty, the dirty
5039 	 * bit is reset (pvn_getdirty()). In nfs(3)write(), r_size is
5040 	 * checked. This will still be the old size. Therefore the page will
5041 	 * not be written out. When segmap_release() calls VOP_PUTPAGE(),
5042 	 * the page will be found to be clean and the write will be dropped.
5043 	 */
5044 	if (rp->r_flags & RMODINPROGRESS) {
5045 		mutex_enter(&rp->r_statelock);
5046 		if ((rp->r_flags & RMODINPROGRESS) &&
5047 		    rp->r_modaddr + MAXBSIZE > io_off &&
5048 		    rp->r_modaddr < io_off + io_len) {
5049 			page_t *plist;
5050 			/*
5051 			 * A write is in progress for this region of the file.
5052 			 * If we did not detect RMODINPROGRESS here then this
5053 			 * path through nfs_putapage() would eventually go to
5054 			 * nfs(3)_bio() and may not write out all of the data
5055 			 * in the pages. We end up losing data. So we decide
5056 			 * to set the modified bit on each page in the page
5057 			 * list and mark the rnode with RDIRTY. This write
5058 			 * will be restarted at some later time.
5059 			 */
5060 			plist = pp;
5061 			while (plist != NULL) {
5062 				pp = plist;
5063 				page_sub(&plist, pp);
5064 				hat_setmod(pp);
5065 				page_io_unlock(pp);
5066 				page_unlock(pp);
5067 			}
5068 			rp->r_flags |= RDIRTY;
5069 			mutex_exit(&rp->r_statelock);
5070 			if (offp)
5071 				*offp = io_off;
5072 			if (lenp)
5073 				*lenp = io_len;
5074 			return (0);
5075 		}
5076 		mutex_exit(&rp->r_statelock);
5077 	}
5078 
5079 	if (flags & B_ASYNC) {
5080 		error = nfs_async_putapage(vp, pp, io_off, io_len, flags, cr,
5081 		    nfs3_sync_putapage);
5082 	} else
5083 		error = nfs3_sync_putapage(vp, pp, io_off, io_len, flags, cr);
5084 
5085 	if (offp)
5086 		*offp = io_off;
5087 	if (lenp)
5088 		*lenp = io_len;
5089 	return (error);
5090 }
5091 
5092 static int
5093 nfs3_sync_putapage(vnode_t *vp, page_t *pp, u_offset_t io_off, size_t io_len,
5094 	int flags, cred_t *cr)
5095 {
5096 	int error;
5097 	rnode_t *rp;
5098 
5099 	ASSERT(nfs_zone() == VTOMI(vp)->mi_zone);
5100 
5101 	flags |= B_WRITE;
5102 
5103 	error = nfs3_rdwrlbn(vp, pp, io_off, io_len, flags, cr);
5104 
5105 	rp = VTOR(vp);
5106 
5107 	if ((error == ENOSPC || error == EDQUOT || error == EFBIG ||
5108 	    error == EACCES) &&
5109 	    (flags & (B_INVAL|B_FORCE)) != (B_INVAL|B_FORCE)) {
5110 		if (!(rp->r_flags & ROUTOFSPACE)) {
5111 			mutex_enter(&rp->r_statelock);
5112 			rp->r_flags |= ROUTOFSPACE;
5113 			mutex_exit(&rp->r_statelock);
5114 		}
5115 		flags |= B_ERROR;
5116 		pvn_write_done(pp, flags);
5117 		/*
5118 		 * If this was not an async thread, then try again to
5119 		 * write out the pages, but this time, also destroy
5120 		 * them whether or not the write is successful.  This
5121 		 * will prevent memory from filling up with these
5122 		 * pages and destroying them is the only alternative
5123 		 * if they can't be written out.
5124 		 *
5125 		 * Don't do this if this is an async thread because
5126 		 * when the pages are unlocked in pvn_write_done,
5127 		 * some other thread could have come along, locked
5128 		 * them, and queued for an async thread.  It would be
5129 		 * possible for all of the async threads to be tied
5130 		 * up waiting to lock the pages again and they would
5131 		 * all already be locked and waiting for an async
5132 		 * thread to handle them.  Deadlock.
5133 		 */
5134 		if (!(flags & B_ASYNC)) {
5135 			error = nfs3_putpage(vp, io_off, io_len,
5136 			    B_INVAL | B_FORCE, cr, NULL);
5137 		}
5138 	} else {
5139 		if (error)
5140 			flags |= B_ERROR;
5141 		else if (rp->r_flags & ROUTOFSPACE) {
5142 			mutex_enter(&rp->r_statelock);
5143 			rp->r_flags &= ~ROUTOFSPACE;
5144 			mutex_exit(&rp->r_statelock);
5145 		}
5146 		pvn_write_done(pp, flags);
5147 		if (freemem < desfree)
5148 			(void) nfs3_commit_vp(vp, (u_offset_t)0, 0, cr);
5149 	}
5150 
5151 	return (error);
5152 }
5153 
5154 /* ARGSUSED */
5155 static int
5156 nfs3_map(vnode_t *vp, offset_t off, struct as *as, caddr_t *addrp,
5157 	size_t len, uchar_t prot, uchar_t maxprot, uint_t flags,
5158 	cred_t *cr, caller_context_t *ct)
5159 {
5160 	struct segvn_crargs vn_a;
5161 	int error;
5162 	rnode_t *rp;
5163 	struct vattr va;
5164 
5165 	if (nfs_zone() != VTOMI(vp)->mi_zone)
5166 		return (EIO);
5167 
5168 	if (vp->v_flag & VNOMAP)
5169 		return (ENOSYS);
5170 
5171 	if (off < 0 || off + len < 0)
5172 		return (ENXIO);
5173 
5174 	if (vp->v_type != VREG)
5175 		return (ENODEV);
5176 
5177 	/*
5178 	 * If there is cached data and if close-to-open consistency
5179 	 * checking is not turned off and if the file system is not
5180 	 * mounted readonly, then force an over the wire getattr.
5181 	 * Otherwise, just invoke nfs3getattr to get a copy of the
5182 	 * attributes.  The attribute cache will be used unless it
5183 	 * is timed out and if it is, then an over the wire getattr
5184 	 * will be issued.
5185 	 */
5186 	va.va_mask = AT_ALL;
5187 	if (vn_has_cached_data(vp) &&
5188 	    !(VTOMI(vp)->mi_flags & MI_NOCTO) && !vn_is_readonly(vp))
5189 		error = nfs3_getattr_otw(vp, &va, cr);
5190 	else
5191 		error = nfs3getattr(vp, &va, cr);
5192 	if (error)
5193 		return (error);
5194 
5195 	/*
5196 	 * Check to see if the vnode is currently marked as not cachable.
5197 	 * This means portions of the file are locked (through VOP_FRLOCK).
5198 	 * In this case the map request must be refused.  We use
5199 	 * rp->r_lkserlock to avoid a race with concurrent lock requests.
5200 	 */
5201 	rp = VTOR(vp);
5202 	if (nfs_rw_enter_sig(&rp->r_lkserlock, RW_READER, INTR(vp)))
5203 		return (EINTR);
5204 
5205 	if (vp->v_flag & VNOCACHE) {
5206 		error = EAGAIN;
5207 		goto done;
5208 	}
5209 
5210 	/*
5211 	 * Don't allow concurrent locks and mapping if mandatory locking is
5212 	 * enabled.
5213 	 */
5214 	if ((flk_has_remote_locks(vp) || lm_has_sleep(vp)) &&
5215 	    MANDLOCK(vp, va.va_mode)) {
5216 		error = EAGAIN;
5217 		goto done;
5218 	}
5219 
5220 	as_rangelock(as);
5221 	if (!(flags & MAP_FIXED)) {
5222 		map_addr(addrp, len, off, 1, flags);
5223 		if (*addrp == NULL) {
5224 			as_rangeunlock(as);
5225 			error = ENOMEM;
5226 			goto done;
5227 		}
5228 	} else {
5229 		/*
5230 		 * User specified address - blow away any previous mappings
5231 		 */
5232 		(void) as_unmap(as, *addrp, len);
5233 	}
5234 
5235 	vn_a.vp = vp;
5236 	vn_a.offset = off;
5237 	vn_a.type = (flags & MAP_TYPE);
5238 	vn_a.prot = (uchar_t)prot;
5239 	vn_a.maxprot = (uchar_t)maxprot;
5240 	vn_a.flags = (flags & ~MAP_TYPE);
5241 	vn_a.cred = cr;
5242 	vn_a.amp = NULL;
5243 	vn_a.szc = 0;
5244 	vn_a.lgrp_mem_policy_flags = 0;
5245 
5246 	error = as_map(as, *addrp, len, segvn_create, &vn_a);
5247 	as_rangeunlock(as);
5248 
5249 done:
5250 	nfs_rw_exit(&rp->r_lkserlock);
5251 	return (error);
5252 }
5253 
5254 /* ARGSUSED */
5255 static int
5256 nfs3_addmap(vnode_t *vp, offset_t off, struct as *as, caddr_t addr,
5257 	size_t len, uchar_t prot, uchar_t maxprot, uint_t flags,
5258 	cred_t *cr, caller_context_t *ct)
5259 {
5260 	rnode_t *rp;
5261 
5262 	if (vp->v_flag & VNOMAP)
5263 		return (ENOSYS);
5264 	if (nfs_zone() != VTOMI(vp)->mi_zone)
5265 		return (EIO);
5266 
5267 	/*
5268 	 * Need to hold rwlock while incrementing the mapcnt so that
5269 	 * mmap'ing can be serialized with writes so that the caching
5270 	 * can be handled correctly.
5271 	 */
5272 	rp = VTOR(vp);
5273 	if (nfs_rw_enter_sig(&rp->r_rwlock, RW_WRITER, INTR(vp)))
5274 		return (EINTR);
5275 	atomic_add_long((ulong_t *)&rp->r_mapcnt, btopr(len));
5276 	nfs_rw_exit(&rp->r_rwlock);
5277 
5278 	return (0);
5279 }
5280 
5281 /* ARGSUSED */
5282 static int
5283 nfs3_frlock(vnode_t *vp, int cmd, struct flock64 *bfp, int flag,
5284 	offset_t offset, struct flk_callback *flk_cbp, cred_t *cr,
5285 	caller_context_t *ct)
5286 {
5287 	netobj lm_fh3;
5288 	int rc;
5289 	u_offset_t start, end;
5290 	rnode_t *rp;
5291 	int error = 0, intr = INTR(vp);
5292 
5293 	if (nfs_zone() != VTOMI(vp)->mi_zone)
5294 		return (EIO);
5295 	/* check for valid cmd parameter */
5296 	if (cmd != F_GETLK && cmd != F_SETLK && cmd != F_SETLKW)
5297 		return (EINVAL);
5298 
5299 	/* Verify l_type. */
5300 	switch (bfp->l_type) {
5301 	case F_RDLCK:
5302 		if (cmd != F_GETLK && !(flag & FREAD))
5303 			return (EBADF);
5304 		break;
5305 	case F_WRLCK:
5306 		if (cmd != F_GETLK && !(flag & FWRITE))
5307 			return (EBADF);
5308 		break;
5309 	case F_UNLCK:
5310 		intr = 0;
5311 		break;
5312 
5313 	default:
5314 		return (EINVAL);
5315 	}
5316 
5317 	/* check the validity of the lock range */
5318 	if (rc = flk_convert_lock_data(vp, bfp, &start, &end, offset))
5319 		return (rc);
5320 	if (rc = flk_check_lock_data(start, end, MAXEND))
5321 		return (rc);
5322 
5323 	/*
5324 	 * If the filesystem is mounted using local locking, pass the
5325 	 * request off to the local locking code.
5326 	 */
5327 	if (VTOMI(vp)->mi_flags & MI_LLOCK) {
5328 		if (cmd == F_SETLK || cmd == F_SETLKW) {
5329 			/*
5330 			 * For complete safety, we should be holding
5331 			 * r_lkserlock.  However, we can't call
5332 			 * lm_safelock and then fs_frlock while
5333 			 * holding r_lkserlock, so just invoke
5334 			 * lm_safelock and expect that this will
5335 			 * catch enough of the cases.
5336 			 */
5337 			if (!lm_safelock(vp, bfp, cr))
5338 				return (EAGAIN);
5339 		}
5340 		return (fs_frlock(vp, cmd, bfp, flag, offset, flk_cbp, cr, ct));
5341 	}
5342 
5343 	rp = VTOR(vp);
5344 
5345 	/*
5346 	 * Check whether the given lock request can proceed, given the
5347 	 * current file mappings.
5348 	 */
5349 	if (nfs_rw_enter_sig(&rp->r_lkserlock, RW_WRITER, intr))
5350 		return (EINTR);
5351 	if (cmd == F_SETLK || cmd == F_SETLKW) {
5352 		if (!lm_safelock(vp, bfp, cr)) {
5353 			rc = EAGAIN;
5354 			goto done;
5355 		}
5356 	}
5357 
5358 	/*
5359 	 * Flush the cache after waiting for async I/O to finish.  For new
5360 	 * locks, this is so that the process gets the latest bits from the
5361 	 * server.  For unlocks, this is so that other clients see the
5362 	 * latest bits once the file has been unlocked.  If currently dirty
5363 	 * pages can't be flushed, then don't allow a lock to be set.  But
5364 	 * allow unlocks to succeed, to avoid having orphan locks on the
5365 	 * server.
5366 	 */
5367 	if (cmd != F_GETLK) {
5368 		mutex_enter(&rp->r_statelock);
5369 		while (rp->r_count > 0) {
5370 		    if (intr) {
5371 			klwp_t *lwp = ttolwp(curthread);
5372 
5373 			if (lwp != NULL)
5374 				lwp->lwp_nostop++;
5375 			if (cv_wait_sig(&rp->r_cv, &rp->r_statelock) == 0) {
5376 				if (lwp != NULL)
5377 					lwp->lwp_nostop--;
5378 				rc = EINTR;
5379 				break;
5380 			}
5381 			if (lwp != NULL)
5382 				lwp->lwp_nostop--;
5383 		    } else
5384 			cv_wait(&rp->r_cv, &rp->r_statelock);
5385 		}
5386 		mutex_exit(&rp->r_statelock);
5387 		if (rc != 0)
5388 			goto done;
5389 		error = nfs3_putpage(vp, (offset_t)0, 0, B_INVAL, cr, ct);
5390 		if (error) {
5391 			if (error == ENOSPC || error == EDQUOT) {
5392 				mutex_enter(&rp->r_statelock);
5393 				if (!rp->r_error)
5394 					rp->r_error = error;
5395 				mutex_exit(&rp->r_statelock);
5396 			}
5397 			if (bfp->l_type != F_UNLCK) {
5398 				rc = ENOLCK;
5399 				goto done;
5400 			}
5401 		}
5402 	}
5403 
5404 	lm_fh3.n_len = VTOFH3(vp)->fh3_length;
5405 	lm_fh3.n_bytes = (char *)&(VTOFH3(vp)->fh3_u.data);
5406 
5407 	/*
5408 	 * Call the lock manager to do the real work of contacting
5409 	 * the server and obtaining the lock.
5410 	 */
5411 	rc = lm4_frlock(vp, cmd, bfp, flag, offset, cr, &lm_fh3, flk_cbp);
5412 
5413 	if (rc == 0)
5414 		nfs_lockcompletion(vp, cmd);
5415 
5416 done:
5417 	nfs_rw_exit(&rp->r_lkserlock);
5418 	return (rc);
5419 }
5420 
5421 /*
5422  * Free storage space associated with the specified vnode.  The portion
5423  * to be freed is specified by bfp->l_start and bfp->l_len (already
5424  * normalized to a "whence" of 0).
5425  *
5426  * This is an experimental facility whose continued existence is not
5427  * guaranteed.  Currently, we only support the special case
5428  * of l_len == 0, meaning free to end of file.
5429  */
5430 /* ARGSUSED */
5431 static int
5432 nfs3_space(vnode_t *vp, int cmd, struct flock64 *bfp, int flag,
5433 	offset_t offset, cred_t *cr, caller_context_t *ct)
5434 {
5435 	int error;
5436 
5437 	ASSERT(vp->v_type == VREG);
5438 	if (cmd != F_FREESP)
5439 		return (EINVAL);
5440 	if (nfs_zone() != VTOMI(vp)->mi_zone)
5441 		return (EIO);
5442 
5443 	error = convoff(vp, bfp, 0, offset);
5444 	if (!error) {
5445 		ASSERT(bfp->l_start >= 0);
5446 		if (bfp->l_len == 0) {
5447 			struct vattr va;
5448 
5449 			/*
5450 			 * ftruncate should not change the ctime and
5451 			 * mtime if we truncate the file to its
5452 			 * previous size.
5453 			 */
5454 			va.va_mask = AT_SIZE;
5455 			error = nfs3getattr(vp, &va, cr);
5456 			if (error || va.va_size == bfp->l_start)
5457 				return (error);
5458 			va.va_mask = AT_SIZE;
5459 			va.va_size = bfp->l_start;
5460 			error = nfs3setattr(vp, &va, 0, cr);
5461 		} else
5462 			error = EINVAL;
5463 	}
5464 
5465 	return (error);
5466 }
5467 
5468 /* ARGSUSED */
5469 static int
5470 nfs3_realvp(vnode_t *vp, vnode_t **vpp, caller_context_t *ct)
5471 {
5472 
5473 	return (EINVAL);
5474 }
5475 
5476 /*
5477  * Setup and add an address space callback to do the work of the delmap call.
5478  * The callback will (and must be) deleted in the actual callback function.
5479  *
5480  * This is done in order to take care of the problem that we have with holding
5481  * the address space's a_lock for a long period of time (e.g. if the NFS server
5482  * is down).  Callbacks will be executed in the address space code while the
5483  * a_lock is not held.	Holding the address space's a_lock causes things such
5484  * as ps and fork to hang because they are trying to acquire this lock as well.
5485  */
5486 /* ARGSUSED */
5487 static int
5488 nfs3_delmap(vnode_t *vp, offset_t off, struct as *as, caddr_t addr,
5489 	size_t len, uint_t prot, uint_t maxprot, uint_t flags,
5490 	cred_t *cr, caller_context_t *ct)
5491 {
5492 	int			caller_found;
5493 	int			error;
5494 	rnode_t			*rp;
5495 	nfs_delmap_args_t	*dmapp;
5496 	nfs_delmapcall_t	*delmap_call;
5497 
5498 	if (vp->v_flag & VNOMAP)
5499 		return (ENOSYS);
5500 	/*
5501 	 * A process may not change zones if it has NFS pages mmap'ed
5502 	 * in, so we can't legitimately get here from the wrong zone.
5503 	 */
5504 	ASSERT(nfs_zone() == VTOMI(vp)->mi_zone);
5505 
5506 	rp = VTOR(vp);
5507 
5508 	/*
5509 	 * The way that the address space of this process deletes its mapping
5510 	 * of this file is via the following call chains:
5511 	 * - as_free()->SEGOP_UNMAP()/segvn_unmap()->VOP_DELMAP()/nfs3_delmap()
5512 	 * - as_unmap()->SEGOP_UNMAP()/segvn_unmap()->VOP_DELMAP()/nfs3_delmap()
5513 	 *
5514 	 * With the use of address space callbacks we are allowed to drop the
5515 	 * address space lock, a_lock, while executing the NFS operations that
5516 	 * need to go over the wire.  Returning EAGAIN to the caller of this
5517 	 * function is what drives the execution of the callback that we add
5518 	 * below.  The callback will be executed by the address space code
5519 	 * after dropping the a_lock.  When the callback is finished, since
5520 	 * we dropped the a_lock, it must be re-acquired and segvn_unmap()
5521 	 * is called again on the same segment to finish the rest of the work
5522 	 * that needs to happen during unmapping.
5523 	 *
5524 	 * This action of calling back into the segment driver causes
5525 	 * nfs3_delmap() to get called again, but since the callback was
5526 	 * already executed at this point, it already did the work and there
5527 	 * is nothing left for us to do.
5528 	 *
5529 	 * To Summarize:
5530 	 * - The first time nfs3_delmap is called by the current thread is when
5531 	 * we add the caller associated with this delmap to the delmap caller
5532 	 * list, add the callback, and return EAGAIN.
5533 	 * - The second time in this call chain when nfs3_delmap is called we
5534 	 * will find this caller in the delmap caller list and realize there
5535 	 * is no more work to do thus removing this caller from the list and
5536 	 * returning the error that was set in the callback execution.
5537 	 */
5538 	caller_found = nfs_find_and_delete_delmapcall(rp, &error);
5539 	if (caller_found) {
5540 		/*
5541 		 * 'error' is from the actual delmap operations.  To avoid
5542 		 * hangs, we need to handle the return of EAGAIN differently
5543 		 * since this is what drives the callback execution.
5544 		 * In this case, we don't want to return EAGAIN and do the
5545 		 * callback execution because there are none to execute.
5546 		 */
5547 		if (error == EAGAIN)
5548 			return (0);
5549 		else
5550 			return (error);
5551 	}
5552 
5553 	/* current caller was not in the list */
5554 	delmap_call = nfs_init_delmapcall();
5555 
5556 	mutex_enter(&rp->r_statelock);
5557 	list_insert_tail(&rp->r_indelmap, delmap_call);
5558 	mutex_exit(&rp->r_statelock);
5559 
5560 	dmapp = kmem_alloc(sizeof (nfs_delmap_args_t), KM_SLEEP);
5561 
5562 	dmapp->vp = vp;
5563 	dmapp->off = off;
5564 	dmapp->addr = addr;
5565 	dmapp->len = len;
5566 	dmapp->prot = prot;
5567 	dmapp->maxprot = maxprot;
5568 	dmapp->flags = flags;
5569 	dmapp->cr = cr;
5570 	dmapp->caller = delmap_call;
5571 
5572 	error = as_add_callback(as, nfs3_delmap_callback, dmapp,
5573 	AS_UNMAP_EVENT, addr, len, KM_SLEEP);
5574 
5575 	return (error ? error : EAGAIN);
5576 }
5577 
5578 /*
5579  * Remove some pages from an mmap'd vnode.  Just update the
5580  * count of pages.  If doing close-to-open, then flush and
5581  * commit all of the pages associated with this file.
5582  * Otherwise, start an asynchronous page flush to write out
5583  * any dirty pages.  This will also associate a credential
5584  * with the rnode which can be used to write the pages.
5585  */
5586 /* ARGSUSED */
5587 static void
5588 nfs3_delmap_callback(struct as *as, void *arg, uint_t event)
5589 {
5590 	int			error;
5591 	rnode_t			*rp;
5592 	mntinfo_t		*mi;
5593 	nfs_delmap_args_t	*dmapp = (nfs_delmap_args_t *)arg;
5594 
5595 	rp = VTOR(dmapp->vp);
5596 	mi = VTOMI(dmapp->vp);
5597 
5598 	atomic_add_long((ulong_t *)&rp->r_mapcnt, -btopr(dmapp->len));
5599 	ASSERT(rp->r_mapcnt >= 0);
5600 
5601 	/*
5602 	 * Initiate a page flush and potential commit if there are
5603 	 * pages, the file system was not mounted readonly, the segment
5604 	 * was mapped shared, and the pages themselves were writeable.
5605 	 */
5606 	if (vn_has_cached_data(dmapp->vp) && !vn_is_readonly(dmapp->vp) &&
5607 	    dmapp->flags == MAP_SHARED && (dmapp->maxprot & PROT_WRITE)) {
5608 		mutex_enter(&rp->r_statelock);
5609 		rp->r_flags |= RDIRTY;
5610 		mutex_exit(&rp->r_statelock);
5611 		/*
5612 		 * If this is a cross-zone access a sync putpage won't work, so
5613 		 * the best we can do is try an async putpage.  That seems
5614 		 * better than something more draconian such as discarding the
5615 		 * dirty pages.
5616 		 */
5617 		if ((mi->mi_flags & MI_NOCTO) ||
5618 		    nfs_zone() != mi->mi_zone)
5619 			error = nfs3_putpage(dmapp->vp, dmapp->off, dmapp->len,
5620 			    B_ASYNC, dmapp->cr, NULL);
5621 		else
5622 			error = nfs3_putpage_commit(dmapp->vp, dmapp->off,
5623 			    dmapp->len, dmapp->cr);
5624 		if (!error) {
5625 			mutex_enter(&rp->r_statelock);
5626 			error = rp->r_error;
5627 			rp->r_error = 0;
5628 			mutex_exit(&rp->r_statelock);
5629 		}
5630 	} else
5631 		error = 0;
5632 
5633 	if ((rp->r_flags & RDIRECTIO) || (mi->mi_flags & MI_DIRECTIO))
5634 		(void) nfs3_putpage(dmapp->vp, dmapp->off, dmapp->len,
5635 		    B_INVAL, dmapp->cr, NULL);
5636 
5637 	dmapp->caller->error = error;
5638 	(void) as_delete_callback(as, arg);
5639 	kmem_free(dmapp, sizeof (nfs_delmap_args_t));
5640 }
5641 
5642 static int nfs3_pathconf_disable_cache = 0;
5643 
5644 #ifdef DEBUG
5645 static int nfs3_pathconf_cache_hits = 0;
5646 static int nfs3_pathconf_cache_misses = 0;
5647 #endif
5648 
5649 /* ARGSUSED */
5650 static int
5651 nfs3_pathconf(vnode_t *vp, int cmd, ulong_t *valp, cred_t *cr,
5652 	caller_context_t *ct)
5653 {
5654 	int error;
5655 	PATHCONF3args args;
5656 	PATHCONF3res res;
5657 	int douprintf;
5658 	failinfo_t fi;
5659 	rnode_t *rp;
5660 	hrtime_t t;
5661 
5662 	if (nfs_zone() != VTOMI(vp)->mi_zone)
5663 		return (EIO);
5664 	/*
5665 	 * Large file spec - need to base answer on info stored
5666 	 * on original FSINFO response.
5667 	 */
5668 	if (cmd == _PC_FILESIZEBITS) {
5669 		unsigned long long ll;
5670 		long l = 1;
5671 
5672 		ll = VTOMI(vp)->mi_maxfilesize;
5673 
5674 		if (ll == 0) {
5675 			*valp = 0;
5676 			return (0);
5677 		}
5678 
5679 		if (ll & 0xffffffff00000000) {
5680 			l += 32; ll >>= 32;
5681 		}
5682 		if (ll & 0xffff0000) {
5683 			l += 16; ll >>= 16;
5684 		}
5685 		if (ll & 0xff00) {
5686 			l += 8; ll >>= 8;
5687 		}
5688 		if (ll & 0xf0) {
5689 			l += 4; ll >>= 4;
5690 		}
5691 		if (ll & 0xc) {
5692 			l += 2; ll >>= 2;
5693 		}
5694 		if (ll & 0x2)
5695 			l += 2;
5696 		else if (ll & 0x1)
5697 			l += 1;
5698 		*valp = l;
5699 		return (0);
5700 	}
5701 
5702 	if (cmd == _PC_ACL_ENABLED) {
5703 		*valp = _ACL_ACLENT_ENABLED;
5704 		return (0);
5705 	}
5706 
5707 	if (cmd == _PC_XATTR_EXISTS) {
5708 		error = 0;
5709 		*valp = 0;
5710 		if (vp->v_vfsp->vfs_flag & VFS_XATTR) {
5711 			vnode_t *avp;
5712 			rnode_t *rp;
5713 			int error = 0;
5714 			mntinfo_t *mi = VTOMI(vp);
5715 
5716 			if (!(mi->mi_flags & MI_EXTATTR))
5717 				return (0);
5718 
5719 			rp = VTOR(vp);
5720 			if (nfs_rw_enter_sig(&rp->r_rwlock, RW_READER,
5721 			    INTR(vp)))
5722 				return (EINTR);
5723 
5724 			error = nfs3lookup_dnlc(vp, XATTR_DIR_NAME, &avp, cr);
5725 			if (error || avp == NULL)
5726 				error = acl_getxattrdir3(vp, &avp, 0, cr, 0);
5727 
5728 			nfs_rw_exit(&rp->r_rwlock);
5729 
5730 			if (error == 0 && avp != NULL) {
5731 				VN_RELE(avp);
5732 				*valp = 1;
5733 			} else if (error == ENOENT)
5734 				error = 0;
5735 		}
5736 		return (error);
5737 	}
5738 
5739 	rp = VTOR(vp);
5740 	if (rp->r_pathconf != NULL) {
5741 		mutex_enter(&rp->r_statelock);
5742 		if (rp->r_pathconf != NULL && nfs3_pathconf_disable_cache) {
5743 			kmem_free(rp->r_pathconf, sizeof (*rp->r_pathconf));
5744 			rp->r_pathconf = NULL;
5745 		}
5746 		if (rp->r_pathconf != NULL) {
5747 			error = 0;
5748 			switch (cmd) {
5749 			case _PC_LINK_MAX:
5750 				*valp = rp->r_pathconf->link_max;
5751 				break;
5752 			case _PC_NAME_MAX:
5753 				*valp = rp->r_pathconf->name_max;
5754 				break;
5755 			case _PC_PATH_MAX:
5756 			case _PC_SYMLINK_MAX:
5757 				*valp = MAXPATHLEN;
5758 				break;
5759 			case _PC_CHOWN_RESTRICTED:
5760 				*valp = rp->r_pathconf->chown_restricted;
5761 				break;
5762 			case _PC_NO_TRUNC:
5763 				*valp = rp->r_pathconf->no_trunc;
5764 				break;
5765 			default:
5766 				error = EINVAL;
5767 				break;
5768 			}
5769 			mutex_exit(&rp->r_statelock);
5770 #ifdef DEBUG
5771 			nfs3_pathconf_cache_hits++;
5772 #endif
5773 			return (error);
5774 		}
5775 		mutex_exit(&rp->r_statelock);
5776 	}
5777 #ifdef DEBUG
5778 	nfs3_pathconf_cache_misses++;
5779 #endif
5780 
5781 	args.object = *VTOFH3(vp);
5782 	fi.vp = vp;
5783 	fi.fhp = (caddr_t)&args.object;
5784 	fi.copyproc = nfs3copyfh;
5785 	fi.lookupproc = nfs3lookup;
5786 	fi.xattrdirproc = acl_getxattrdir3;
5787 
5788 	douprintf = 1;
5789 
5790 	t = gethrtime();
5791 
5792 	error = rfs3call(VTOMI(vp), NFSPROC3_PATHCONF,
5793 	    xdr_nfs_fh3, (caddr_t)&args,
5794 	    xdr_PATHCONF3res, (caddr_t)&res, cr,
5795 	    &douprintf, &res.status, 0, &fi);
5796 
5797 	if (error)
5798 		return (error);
5799 
5800 	error = geterrno3(res.status);
5801 
5802 	if (!error) {
5803 		nfs3_cache_post_op_attr(vp, &res.resok.obj_attributes, t, cr);
5804 		if (!nfs3_pathconf_disable_cache) {
5805 			mutex_enter(&rp->r_statelock);
5806 			if (rp->r_pathconf == NULL) {
5807 				rp->r_pathconf = kmem_alloc(
5808 				    sizeof (*rp->r_pathconf), KM_NOSLEEP);
5809 				if (rp->r_pathconf != NULL)
5810 					*rp->r_pathconf = res.resok.info;
5811 			}
5812 			mutex_exit(&rp->r_statelock);
5813 		}
5814 		switch (cmd) {
5815 		case _PC_LINK_MAX:
5816 			*valp = res.resok.info.link_max;
5817 			break;
5818 		case _PC_NAME_MAX:
5819 			*valp = res.resok.info.name_max;
5820 			break;
5821 		case _PC_PATH_MAX:
5822 		case _PC_SYMLINK_MAX:
5823 			*valp = MAXPATHLEN;
5824 			break;
5825 		case _PC_CHOWN_RESTRICTED:
5826 			*valp = res.resok.info.chown_restricted;
5827 			break;
5828 		case _PC_NO_TRUNC:
5829 			*valp = res.resok.info.no_trunc;
5830 			break;
5831 		default:
5832 			return (EINVAL);
5833 		}
5834 	} else {
5835 		nfs3_cache_post_op_attr(vp, &res.resfail.obj_attributes, t, cr);
5836 		PURGE_STALE_FH(error, vp, cr);
5837 	}
5838 
5839 	return (error);
5840 }
5841 
5842 /*
5843  * Called by async thread to do synchronous pageio. Do the i/o, wait
5844  * for it to complete, and cleanup the page list when done.
5845  */
5846 static int
5847 nfs3_sync_pageio(vnode_t *vp, page_t *pp, u_offset_t io_off, size_t io_len,
5848 	int flags, cred_t *cr)
5849 {
5850 	int error;
5851 
5852 	ASSERT(nfs_zone() == VTOMI(vp)->mi_zone);
5853 	error = nfs3_rdwrlbn(vp, pp, io_off, io_len, flags, cr);
5854 	if (flags & B_READ)
5855 		pvn_read_done(pp, (error ? B_ERROR : 0) | flags);
5856 	else
5857 		pvn_write_done(pp, (error ? B_ERROR : 0) | flags);
5858 	return (error);
5859 }
5860 
5861 /* ARGSUSED */
5862 static int
5863 nfs3_pageio(vnode_t *vp, page_t *pp, u_offset_t io_off, size_t io_len,
5864 	int flags, cred_t *cr, caller_context_t *ct)
5865 {
5866 	int error;
5867 	rnode_t *rp;
5868 
5869 	if (pp == NULL)
5870 		return (EINVAL);
5871 	if (!(flags & B_ASYNC) && nfs_zone() != VTOMI(vp)->mi_zone)
5872 		return (EIO);
5873 
5874 	rp = VTOR(vp);
5875 	mutex_enter(&rp->r_statelock);
5876 	rp->r_count++;
5877 	mutex_exit(&rp->r_statelock);
5878 
5879 	if (flags & B_ASYNC) {
5880 		error = nfs_async_pageio(vp, pp, io_off, io_len, flags, cr,
5881 		    nfs3_sync_pageio);
5882 	} else
5883 		error = nfs3_rdwrlbn(vp, pp, io_off, io_len, flags, cr);
5884 	mutex_enter(&rp->r_statelock);
5885 	rp->r_count--;
5886 	cv_broadcast(&rp->r_cv);
5887 	mutex_exit(&rp->r_statelock);
5888 	return (error);
5889 }
5890 
5891 /* ARGSUSED */
5892 static void
5893 nfs3_dispose(vnode_t *vp, page_t *pp, int fl, int dn, cred_t *cr,
5894 	caller_context_t *ct)
5895 {
5896 	int error;
5897 	rnode_t *rp;
5898 	page_t *plist;
5899 	page_t *pptr;
5900 	offset3 offset;
5901 	count3 len;
5902 	k_sigset_t smask;
5903 
5904 	/*
5905 	 * We should get called with fl equal to either B_FREE or
5906 	 * B_INVAL.  Any other value is illegal.
5907 	 *
5908 	 * The page that we are either supposed to free or destroy
5909 	 * should be exclusive locked and its io lock should not
5910 	 * be held.
5911 	 */
5912 	ASSERT(fl == B_FREE || fl == B_INVAL);
5913 	ASSERT((PAGE_EXCL(pp) && !page_iolock_assert(pp)) || panicstr);
5914 	rp = VTOR(vp);
5915 
5916 	/*
5917 	 * If the page doesn't need to be committed or we shouldn't
5918 	 * even bother attempting to commit it, then just make sure
5919 	 * that the p_fsdata byte is clear and then either free or
5920 	 * destroy the page as appropriate.
5921 	 */
5922 	if (pp->p_fsdata == C_NOCOMMIT || (rp->r_flags & RSTALE)) {
5923 		pp->p_fsdata = C_NOCOMMIT;
5924 		if (fl == B_FREE)
5925 			page_free(pp, dn);
5926 		else
5927 			page_destroy(pp, dn);
5928 		return;
5929 	}
5930 
5931 	/*
5932 	 * If there is a page invalidation operation going on, then
5933 	 * if this is one of the pages being destroyed, then just
5934 	 * clear the p_fsdata byte and then either free or destroy
5935 	 * the page as appropriate.
5936 	 */
5937 	mutex_enter(&rp->r_statelock);
5938 	if ((rp->r_flags & RTRUNCATE) && pp->p_offset >= rp->r_truncaddr) {
5939 		mutex_exit(&rp->r_statelock);
5940 		pp->p_fsdata = C_NOCOMMIT;
5941 		if (fl == B_FREE)
5942 			page_free(pp, dn);
5943 		else
5944 			page_destroy(pp, dn);
5945 		return;
5946 	}
5947 
5948 	/*
5949 	 * If we are freeing this page and someone else is already
5950 	 * waiting to do a commit, then just unlock the page and
5951 	 * return.  That other thread will take care of commiting
5952 	 * this page.  The page can be freed sometime after the
5953 	 * commit has finished.  Otherwise, if the page is marked
5954 	 * as delay commit, then we may be getting called from
5955 	 * pvn_write_done, one page at a time.   This could result
5956 	 * in one commit per page, so we end up doing lots of small
5957 	 * commits instead of fewer larger commits.  This is bad,
5958 	 * we want do as few commits as possible.
5959 	 */
5960 	if (fl == B_FREE) {
5961 		if (rp->r_flags & RCOMMITWAIT) {
5962 			page_unlock(pp);
5963 			mutex_exit(&rp->r_statelock);
5964 			return;
5965 		}
5966 		if (pp->p_fsdata == C_DELAYCOMMIT) {
5967 			pp->p_fsdata = C_COMMIT;
5968 			page_unlock(pp);
5969 			mutex_exit(&rp->r_statelock);
5970 			return;
5971 		}
5972 	}
5973 
5974 	/*
5975 	 * Check to see if there is a signal which would prevent an
5976 	 * attempt to commit the pages from being successful.  If so,
5977 	 * then don't bother with all of the work to gather pages and
5978 	 * generate the unsuccessful RPC.  Just return from here and
5979 	 * let the page be committed at some later time.
5980 	 */
5981 	sigintr(&smask, VTOMI(vp)->mi_flags & MI_INT);
5982 	if (ttolwp(curthread) != NULL && ISSIG(curthread, JUSTLOOKING)) {
5983 		sigunintr(&smask);
5984 		page_unlock(pp);
5985 		mutex_exit(&rp->r_statelock);
5986 		return;
5987 	}
5988 	sigunintr(&smask);
5989 
5990 	/*
5991 	 * We are starting to need to commit pages, so let's try
5992 	 * to commit as many as possible at once to reduce the
5993 	 * overhead.
5994 	 *
5995 	 * Set the `commit inprogress' state bit.  We must
5996 	 * first wait until any current one finishes.  Then
5997 	 * we initialize the c_pages list with this page.
5998 	 */
5999 	while (rp->r_flags & RCOMMIT) {
6000 		rp->r_flags |= RCOMMITWAIT;
6001 		cv_wait(&rp->r_commit.c_cv, &rp->r_statelock);
6002 		rp->r_flags &= ~RCOMMITWAIT;
6003 	}
6004 	rp->r_flags |= RCOMMIT;
6005 	mutex_exit(&rp->r_statelock);
6006 	ASSERT(rp->r_commit.c_pages == NULL);
6007 	rp->r_commit.c_pages = pp;
6008 	rp->r_commit.c_commbase = (offset3)pp->p_offset;
6009 	rp->r_commit.c_commlen = PAGESIZE;
6010 
6011 	/*
6012 	 * Gather together all other pages which can be committed.
6013 	 * They will all be chained off r_commit.c_pages.
6014 	 */
6015 	nfs3_get_commit(vp);
6016 
6017 	/*
6018 	 * Clear the `commit inprogress' status and disconnect
6019 	 * the list of pages to be committed from the rnode.
6020 	 * At this same time, we also save the starting offset
6021 	 * and length of data to be committed on the server.
6022 	 */
6023 	plist = rp->r_commit.c_pages;
6024 	rp->r_commit.c_pages = NULL;
6025 	offset = rp->r_commit.c_commbase;
6026 	len = rp->r_commit.c_commlen;
6027 	mutex_enter(&rp->r_statelock);
6028 	rp->r_flags &= ~RCOMMIT;
6029 	cv_broadcast(&rp->r_commit.c_cv);
6030 	mutex_exit(&rp->r_statelock);
6031 
6032 	if (curproc == proc_pageout || curproc == proc_fsflush ||
6033 	    nfs_zone() != VTOMI(vp)->mi_zone) {
6034 		nfs_async_commit(vp, plist, offset, len, cr, nfs3_async_commit);
6035 		return;
6036 	}
6037 
6038 	/*
6039 	 * Actually generate the COMMIT3 over the wire operation.
6040 	 */
6041 	error = nfs3_commit(vp, offset, len, cr);
6042 
6043 	/*
6044 	 * If we got an error during the commit, just unlock all
6045 	 * of the pages.  The pages will get retransmitted to the
6046 	 * server during a putpage operation.
6047 	 */
6048 	if (error) {
6049 		while (plist != NULL) {
6050 			pptr = plist;
6051 			page_sub(&plist, pptr);
6052 			page_unlock(pptr);
6053 		}
6054 		return;
6055 	}
6056 
6057 	/*
6058 	 * We've tried as hard as we can to commit the data to stable
6059 	 * storage on the server.  We release the rest of the pages
6060 	 * and clear the commit required state.  They will be put
6061 	 * onto the tail of the cachelist if they are nolonger
6062 	 * mapped.
6063 	 */
6064 	while (plist != pp) {
6065 		pptr = plist;
6066 		page_sub(&plist, pptr);
6067 		pptr->p_fsdata = C_NOCOMMIT;
6068 		(void) page_release(pptr, 1);
6069 	}
6070 
6071 	/*
6072 	 * It is possible that nfs3_commit didn't return error but
6073 	 * some other thread has modified the page we are going
6074 	 * to free/destroy.
6075 	 *    In this case we need to rewrite the page. Do an explicit check
6076 	 * before attempting to free/destroy the page. If modified, needs to
6077 	 * be rewritten so unlock the page and return.
6078 	 */
6079 	if (hat_ismod(pp)) {
6080 		pp->p_fsdata = C_NOCOMMIT;
6081 		page_unlock(pp);
6082 		return;
6083 	}
6084 
6085 	/*
6086 	 * Now, as appropriate, either free or destroy the page
6087 	 * that we were called with.
6088 	 */
6089 	pp->p_fsdata = C_NOCOMMIT;
6090 	if (fl == B_FREE)
6091 		page_free(pp, dn);
6092 	else
6093 		page_destroy(pp, dn);
6094 }
6095 
6096 static int
6097 nfs3_commit(vnode_t *vp, offset3 offset, count3 count, cred_t *cr)
6098 {
6099 	int error;
6100 	rnode_t *rp;
6101 	COMMIT3args args;
6102 	COMMIT3res res;
6103 	int douprintf;
6104 	cred_t *cred;
6105 
6106 	rp = VTOR(vp);
6107 	ASSERT(nfs_zone() == VTOMI(vp)->mi_zone);
6108 
6109 	mutex_enter(&rp->r_statelock);
6110 	if (rp->r_cred != NULL) {
6111 		cred = rp->r_cred;
6112 		crhold(cred);
6113 	} else {
6114 		rp->r_cred = cr;
6115 		crhold(cr);
6116 		cred = cr;
6117 		crhold(cred);
6118 	}
6119 	mutex_exit(&rp->r_statelock);
6120 
6121 	args.file = *VTOFH3(vp);
6122 	args.offset = offset;
6123 	args.count = count;
6124 
6125 doitagain:
6126 	douprintf = 1;
6127 	error = rfs3call(VTOMI(vp), NFSPROC3_COMMIT,
6128 	    xdr_COMMIT3args, (caddr_t)&args,
6129 	    xdr_COMMIT3res, (caddr_t)&res, cred,
6130 	    &douprintf, &res.status, 0, NULL);
6131 
6132 	crfree(cred);
6133 
6134 	if (error)
6135 		return (error);
6136 
6137 	error = geterrno3(res.status);
6138 	if (!error) {
6139 		ASSERT(rp->r_flags & RHAVEVERF);
6140 		mutex_enter(&rp->r_statelock);
6141 		if (rp->r_verf == res.resok.verf) {
6142 			mutex_exit(&rp->r_statelock);
6143 			return (0);
6144 		}
6145 		nfs3_set_mod(vp);
6146 		rp->r_verf = res.resok.verf;
6147 		mutex_exit(&rp->r_statelock);
6148 		error = NFS_VERF_MISMATCH;
6149 	} else {
6150 		if (error == EACCES) {
6151 			mutex_enter(&rp->r_statelock);
6152 			if (cred != cr) {
6153 				if (rp->r_cred != NULL)
6154 					crfree(rp->r_cred);
6155 				rp->r_cred = cr;
6156 				crhold(cr);
6157 				cred = cr;
6158 				crhold(cred);
6159 				mutex_exit(&rp->r_statelock);
6160 				goto doitagain;
6161 			}
6162 			mutex_exit(&rp->r_statelock);
6163 		}
6164 		/*
6165 		 * Can't do a PURGE_STALE_FH here because this
6166 		 * can cause a deadlock.  nfs3_commit can
6167 		 * be called from nfs3_dispose which can be called
6168 		 * indirectly via pvn_vplist_dirty.  PURGE_STALE_FH
6169 		 * can call back to pvn_vplist_dirty.
6170 		 */
6171 		if (error == ESTALE) {
6172 			mutex_enter(&rp->r_statelock);
6173 			rp->r_flags |= RSTALE;
6174 			if (!rp->r_error)
6175 				rp->r_error = error;
6176 			mutex_exit(&rp->r_statelock);
6177 			PURGE_ATTRCACHE(vp);
6178 		} else {
6179 			mutex_enter(&rp->r_statelock);
6180 			if (!rp->r_error)
6181 				rp->r_error = error;
6182 			mutex_exit(&rp->r_statelock);
6183 		}
6184 	}
6185 
6186 	return (error);
6187 }
6188 
6189 static void
6190 nfs3_set_mod(vnode_t *vp)
6191 {
6192 	page_t *pp;
6193 	kmutex_t *vphm;
6194 
6195 	ASSERT(nfs_zone() == VTOMI(vp)->mi_zone);
6196 	vphm = page_vnode_mutex(vp);
6197 	mutex_enter(vphm);
6198 	if ((pp = vp->v_pages) != NULL) {
6199 		do {
6200 			if (pp->p_fsdata != C_NOCOMMIT) {
6201 				hat_setmod(pp);
6202 				pp->p_fsdata = C_NOCOMMIT;
6203 			}
6204 		} while ((pp = pp->p_vpnext) != vp->v_pages);
6205 	}
6206 	mutex_exit(vphm);
6207 }
6208 
6209 
6210 /*
6211  * This routine is used to gather together a page list of the pages
6212  * which are to be committed on the server.  This routine must not
6213  * be called if the calling thread holds any locked pages.
6214  *
6215  * The calling thread must have set RCOMMIT.  This bit is used to
6216  * serialize access to the commit structure in the rnode.  As long
6217  * as the thread has set RCOMMIT, then it can manipulate the commit
6218  * structure without requiring any other locks.
6219  */
6220 static void
6221 nfs3_get_commit(vnode_t *vp)
6222 {
6223 	rnode_t *rp;
6224 	page_t *pp;
6225 	kmutex_t *vphm;
6226 
6227 	rp = VTOR(vp);
6228 
6229 	ASSERT(rp->r_flags & RCOMMIT);
6230 
6231 	vphm = page_vnode_mutex(vp);
6232 	mutex_enter(vphm);
6233 
6234 	/*
6235 	 * If there are no pages associated with this vnode, then
6236 	 * just return.
6237 	 */
6238 	if ((pp = vp->v_pages) == NULL) {
6239 		mutex_exit(vphm);
6240 		return;
6241 	}
6242 
6243 	/*
6244 	 * Step through all of the pages associated with this vnode
6245 	 * looking for pages which need to be committed.
6246 	 */
6247 	do {
6248 		/*
6249 		 * If this page does not need to be committed or is
6250 		 * modified, then just skip it.
6251 		 */
6252 		if (pp->p_fsdata == C_NOCOMMIT || hat_ismod(pp))
6253 			continue;
6254 
6255 		/*
6256 		 * Attempt to lock the page.  If we can't, then
6257 		 * someone else is messing with it and we will
6258 		 * just skip it.
6259 		 */
6260 		if (!page_trylock(pp, SE_EXCL))
6261 			continue;
6262 
6263 		/*
6264 		 * If this page does not need to be committed or is
6265 		 * modified, then just skip it.  Recheck now that
6266 		 * the page is locked.
6267 		 */
6268 		if (pp->p_fsdata == C_NOCOMMIT || hat_ismod(pp)) {
6269 			page_unlock(pp);
6270 			continue;
6271 		}
6272 
6273 		if (PP_ISFREE(pp)) {
6274 			cmn_err(CE_PANIC, "nfs3_get_commit: %p is free",
6275 			    (void *)pp);
6276 		}
6277 
6278 		/*
6279 		 * The page needs to be committed and we locked it.
6280 		 * Update the base and length parameters and add it
6281 		 * to r_pages.
6282 		 */
6283 		if (rp->r_commit.c_pages == NULL) {
6284 			rp->r_commit.c_commbase = (offset3)pp->p_offset;
6285 			rp->r_commit.c_commlen = PAGESIZE;
6286 		} else if (pp->p_offset < rp->r_commit.c_commbase) {
6287 			rp->r_commit.c_commlen = rp->r_commit.c_commbase -
6288 			    (offset3)pp->p_offset + rp->r_commit.c_commlen;
6289 			rp->r_commit.c_commbase = (offset3)pp->p_offset;
6290 		} else if ((rp->r_commit.c_commbase + rp->r_commit.c_commlen)
6291 			    <= pp->p_offset) {
6292 			rp->r_commit.c_commlen = (offset3)pp->p_offset -
6293 			    rp->r_commit.c_commbase + PAGESIZE;
6294 		}
6295 		page_add(&rp->r_commit.c_pages, pp);
6296 	} while ((pp = pp->p_vpnext) != vp->v_pages);
6297 
6298 	mutex_exit(vphm);
6299 }
6300 
6301 /*
6302  * This routine is used to gather together a page list of the pages
6303  * which are to be committed on the server.  This routine must not
6304  * be called if the calling thread holds any locked pages.
6305  *
6306  * The calling thread must have set RCOMMIT.  This bit is used to
6307  * serialize access to the commit structure in the rnode.  As long
6308  * as the thread has set RCOMMIT, then it can manipulate the commit
6309  * structure without requiring any other locks.
6310  */
6311 static void
6312 nfs3_get_commit_range(vnode_t *vp, u_offset_t soff, size_t len)
6313 {
6314 
6315 	rnode_t *rp;
6316 	page_t *pp;
6317 	u_offset_t end;
6318 	u_offset_t off;
6319 
6320 	ASSERT(len != 0);
6321 
6322 	rp = VTOR(vp);
6323 
6324 	ASSERT(rp->r_flags & RCOMMIT);
6325 	ASSERT(nfs_zone() == VTOMI(vp)->mi_zone);
6326 
6327 	/*
6328 	 * If there are no pages associated with this vnode, then
6329 	 * just return.
6330 	 */
6331 	if ((pp = vp->v_pages) == NULL)
6332 		return;
6333 
6334 	/*
6335 	 * Calculate the ending offset.
6336 	 */
6337 	end = soff + len;
6338 
6339 	for (off = soff; off < end; off += PAGESIZE) {
6340 		/*
6341 		 * Lookup each page by vp, offset.
6342 		 */
6343 		if ((pp = page_lookup_nowait(vp, off, SE_EXCL)) == NULL)
6344 			continue;
6345 
6346 		/*
6347 		 * If this page does not need to be committed or is
6348 		 * modified, then just skip it.
6349 		 */
6350 		if (pp->p_fsdata == C_NOCOMMIT || hat_ismod(pp)) {
6351 			page_unlock(pp);
6352 			continue;
6353 		}
6354 
6355 		ASSERT(PP_ISFREE(pp) == 0);
6356 
6357 		/*
6358 		 * The page needs to be committed and we locked it.
6359 		 * Update the base and length parameters and add it
6360 		 * to r_pages.
6361 		 */
6362 		if (rp->r_commit.c_pages == NULL) {
6363 			rp->r_commit.c_commbase = (offset3)pp->p_offset;
6364 			rp->r_commit.c_commlen = PAGESIZE;
6365 		} else {
6366 			rp->r_commit.c_commlen = (offset3)pp->p_offset -
6367 					rp->r_commit.c_commbase + PAGESIZE;
6368 		}
6369 		page_add(&rp->r_commit.c_pages, pp);
6370 	}
6371 }
6372 
6373 #if 0	/* unused */
6374 #ifdef DEBUG
6375 static int
6376 nfs3_no_uncommitted_pages(vnode_t *vp)
6377 {
6378 	page_t *pp;
6379 	kmutex_t *vphm;
6380 
6381 	vphm = page_vnode_mutex(vp);
6382 	mutex_enter(vphm);
6383 	if ((pp = vp->v_pages) != NULL) {
6384 		do {
6385 			if (pp->p_fsdata != C_NOCOMMIT) {
6386 				mutex_exit(vphm);
6387 				return (0);
6388 			}
6389 		} while ((pp = pp->p_vpnext) != vp->v_pages);
6390 	}
6391 	mutex_exit(vphm);
6392 
6393 	return (1);
6394 }
6395 #endif
6396 #endif
6397 
6398 static int
6399 nfs3_putpage_commit(vnode_t *vp, offset_t poff, size_t plen, cred_t *cr)
6400 {
6401 	int error;
6402 	writeverf3 write_verf;
6403 	rnode_t *rp = VTOR(vp);
6404 
6405 	ASSERT(nfs_zone() == VTOMI(vp)->mi_zone);
6406 	/*
6407 	 * Flush the data portion of the file and then commit any
6408 	 * portions which need to be committed.  This may need to
6409 	 * be done twice if the server has changed state since
6410 	 * data was last written.  The data will need to be
6411 	 * rewritten to the server and then a new commit done.
6412 	 *
6413 	 * In fact, this may need to be done several times if the
6414 	 * server is having problems and crashing while we are
6415 	 * attempting to do this.
6416 	 */
6417 
6418 top:
6419 	/*
6420 	 * Do a flush based on the poff and plen arguments.  This
6421 	 * will asynchronously write out any modified pages in the
6422 	 * range specified by (poff, plen).  This starts all of the
6423 	 * i/o operations which will be waited for in the next
6424 	 * call to nfs3_putpage
6425 	 */
6426 
6427 	mutex_enter(&rp->r_statelock);
6428 	write_verf = rp->r_verf;
6429 	mutex_exit(&rp->r_statelock);
6430 
6431 	error = nfs3_putpage(vp, poff, plen, B_ASYNC, cr, NULL);
6432 	if (error == EAGAIN)
6433 		error = 0;
6434 
6435 	/*
6436 	 * Do a flush based on the poff and plen arguments.  This
6437 	 * will synchronously write out any modified pages in the
6438 	 * range specified by (poff, plen) and wait until all of
6439 	 * the asynchronous i/o's in that range are done as well.
6440 	 */
6441 	if (!error)
6442 		error = nfs3_putpage(vp, poff, plen, 0, cr, NULL);
6443 
6444 	if (error)
6445 		return (error);
6446 
6447 	mutex_enter(&rp->r_statelock);
6448 	if (rp->r_verf != write_verf) {
6449 		mutex_exit(&rp->r_statelock);
6450 		goto top;
6451 	}
6452 	mutex_exit(&rp->r_statelock);
6453 
6454 	/*
6455 	 * Now commit any pages which might need to be committed.
6456 	 * If the error, NFS_VERF_MISMATCH, is returned, then
6457 	 * start over with the flush operation.
6458 	 */
6459 
6460 	error = nfs3_commit_vp(vp, poff, plen, cr);
6461 
6462 	if (error == NFS_VERF_MISMATCH)
6463 		goto top;
6464 
6465 	return (error);
6466 }
6467 
6468 static int
6469 nfs3_commit_vp(vnode_t *vp, u_offset_t poff, size_t plen, cred_t *cr)
6470 {
6471 	rnode_t *rp;
6472 	page_t *plist;
6473 	offset3 offset;
6474 	count3 len;
6475 
6476 
6477 	rp = VTOR(vp);
6478 
6479 	if (nfs_zone() != VTOMI(vp)->mi_zone)
6480 		return (EIO);
6481 	/*
6482 	 * Set the `commit inprogress' state bit.  We must
6483 	 * first wait until any current one finishes.
6484 	 */
6485 	mutex_enter(&rp->r_statelock);
6486 	while (rp->r_flags & RCOMMIT) {
6487 		rp->r_flags |= RCOMMITWAIT;
6488 		cv_wait(&rp->r_commit.c_cv, &rp->r_statelock);
6489 		rp->r_flags &= ~RCOMMITWAIT;
6490 	}
6491 	rp->r_flags |= RCOMMIT;
6492 	mutex_exit(&rp->r_statelock);
6493 
6494 	/*
6495 	 * Gather together all of the pages which need to be
6496 	 * committed.
6497 	 */
6498 	if (plen == 0)
6499 		nfs3_get_commit(vp);
6500 	else
6501 		nfs3_get_commit_range(vp, poff, plen);
6502 
6503 	/*
6504 	 * Clear the `commit inprogress' bit and disconnect the
6505 	 * page list which was gathered together in nfs3_get_commit.
6506 	 */
6507 	plist = rp->r_commit.c_pages;
6508 	rp->r_commit.c_pages = NULL;
6509 	offset = rp->r_commit.c_commbase;
6510 	len = rp->r_commit.c_commlen;
6511 	mutex_enter(&rp->r_statelock);
6512 	rp->r_flags &= ~RCOMMIT;
6513 	cv_broadcast(&rp->r_commit.c_cv);
6514 	mutex_exit(&rp->r_statelock);
6515 
6516 	/*
6517 	 * If any pages need to be committed, commit them and
6518 	 * then unlock them so that they can be freed some
6519 	 * time later.
6520 	 */
6521 	if (plist != NULL) {
6522 		/*
6523 		 * No error occurred during the flush portion
6524 		 * of this operation, so now attempt to commit
6525 		 * the data to stable storage on the server.
6526 		 *
6527 		 * This will unlock all of the pages on the list.
6528 		 */
6529 		return (nfs3_sync_commit(vp, plist, offset, len, cr));
6530 	}
6531 	return (0);
6532 }
6533 
6534 static int
6535 nfs3_sync_commit(vnode_t *vp, page_t *plist, offset3 offset, count3 count,
6536 	cred_t *cr)
6537 {
6538 	int error;
6539 	page_t *pp;
6540 
6541 	ASSERT(nfs_zone() == VTOMI(vp)->mi_zone);
6542 	error = nfs3_commit(vp, offset, count, cr);
6543 
6544 	/*
6545 	 * If we got an error, then just unlock all of the pages
6546 	 * on the list.
6547 	 */
6548 	if (error) {
6549 		while (plist != NULL) {
6550 			pp = plist;
6551 			page_sub(&plist, pp);
6552 			page_unlock(pp);
6553 		}
6554 		return (error);
6555 	}
6556 	/*
6557 	 * We've tried as hard as we can to commit the data to stable
6558 	 * storage on the server.  We just unlock the pages and clear
6559 	 * the commit required state.  They will get freed later.
6560 	 */
6561 	while (plist != NULL) {
6562 		pp = plist;
6563 		page_sub(&plist, pp);
6564 		pp->p_fsdata = C_NOCOMMIT;
6565 		page_unlock(pp);
6566 	}
6567 
6568 	return (error);
6569 }
6570 
6571 static void
6572 nfs3_async_commit(vnode_t *vp, page_t *plist, offset3 offset, count3 count,
6573 	cred_t *cr)
6574 {
6575 	ASSERT(nfs_zone() == VTOMI(vp)->mi_zone);
6576 	(void) nfs3_sync_commit(vp, plist, offset, count, cr);
6577 }
6578 
6579 /* ARGSUSED */
6580 static int
6581 nfs3_setsecattr(vnode_t *vp, vsecattr_t *vsecattr, int flag, cred_t *cr,
6582 	caller_context_t *ct)
6583 {
6584 	int error;
6585 	mntinfo_t *mi;
6586 
6587 	mi = VTOMI(vp);
6588 
6589 	if (nfs_zone() != mi->mi_zone)
6590 		return (EIO);
6591 
6592 	if (mi->mi_flags & MI_ACL) {
6593 		error = acl_setacl3(vp, vsecattr, flag, cr);
6594 		if (mi->mi_flags & MI_ACL)
6595 			return (error);
6596 	}
6597 
6598 	return (ENOSYS);
6599 }
6600 
6601 /* ARGSUSED */
6602 static int
6603 nfs3_getsecattr(vnode_t *vp, vsecattr_t *vsecattr, int flag, cred_t *cr,
6604 	caller_context_t *ct)
6605 {
6606 	int error;
6607 	mntinfo_t *mi;
6608 
6609 	mi = VTOMI(vp);
6610 
6611 	if (nfs_zone() != mi->mi_zone)
6612 		return (EIO);
6613 
6614 	if (mi->mi_flags & MI_ACL) {
6615 		error = acl_getacl3(vp, vsecattr, flag, cr);
6616 		if (mi->mi_flags & MI_ACL)
6617 			return (error);
6618 	}
6619 
6620 	return (fs_fab_acl(vp, vsecattr, flag, cr, ct));
6621 }
6622 
6623 /* ARGSUSED */
6624 static int
6625 nfs3_shrlock(vnode_t *vp, int cmd, struct shrlock *shr, int flag, cred_t *cr,
6626 	caller_context_t *ct)
6627 {
6628 	int error;
6629 	struct shrlock nshr;
6630 	struct nfs_owner nfs_owner;
6631 	netobj lm_fh3;
6632 
6633 	if (nfs_zone() != VTOMI(vp)->mi_zone)
6634 		return (EIO);
6635 
6636 	/*
6637 	 * check for valid cmd parameter
6638 	 */
6639 	if (cmd != F_SHARE && cmd != F_UNSHARE && cmd != F_HASREMOTELOCKS)
6640 		return (EINVAL);
6641 
6642 	/*
6643 	 * Check access permissions
6644 	 */
6645 	if (cmd == F_SHARE &&
6646 	    (((shr->s_access & F_RDACC) && !(flag & FREAD)) ||
6647 	    ((shr->s_access & F_WRACC) && !(flag & FWRITE))))
6648 		return (EBADF);
6649 
6650 	/*
6651 	 * If the filesystem is mounted using local locking, pass the
6652 	 * request off to the local share code.
6653 	 */
6654 	if (VTOMI(vp)->mi_flags & MI_LLOCK)
6655 		return (fs_shrlock(vp, cmd, shr, flag, cr, ct));
6656 
6657 	switch (cmd) {
6658 	case F_SHARE:
6659 	case F_UNSHARE:
6660 		lm_fh3.n_len = VTOFH3(vp)->fh3_length;
6661 		lm_fh3.n_bytes = (char *)&(VTOFH3(vp)->fh3_u.data);
6662 
6663 		/*
6664 		 * If passed an owner that is too large to fit in an
6665 		 * nfs_owner it is likely a recursive call from the
6666 		 * lock manager client and pass it straight through.  If
6667 		 * it is not a nfs_owner then simply return an error.
6668 		 */
6669 		if (shr->s_own_len > sizeof (nfs_owner.lowner)) {
6670 			if (((struct nfs_owner *)shr->s_owner)->magic !=
6671 			    NFS_OWNER_MAGIC)
6672 				return (EINVAL);
6673 
6674 			if (error = lm4_shrlock(vp, cmd, shr, flag, &lm_fh3)) {
6675 				error = set_errno(error);
6676 			}
6677 			return (error);
6678 		}
6679 		/*
6680 		 * Remote share reservations owner is a combination of
6681 		 * a magic number, hostname, and the local owner
6682 		 */
6683 		bzero(&nfs_owner, sizeof (nfs_owner));
6684 		nfs_owner.magic = NFS_OWNER_MAGIC;
6685 		(void) strncpy(nfs_owner.hname, uts_nodename(),
6686 		    sizeof (nfs_owner.hname));
6687 		bcopy(shr->s_owner, nfs_owner.lowner, shr->s_own_len);
6688 		nshr.s_access = shr->s_access;
6689 		nshr.s_deny = shr->s_deny;
6690 		nshr.s_sysid = 0;
6691 		nshr.s_pid = ttoproc(curthread)->p_pid;
6692 		nshr.s_own_len = sizeof (nfs_owner);
6693 		nshr.s_owner = (caddr_t)&nfs_owner;
6694 
6695 		if (error = lm4_shrlock(vp, cmd, &nshr, flag, &lm_fh3)) {
6696 			error = set_errno(error);
6697 		}
6698 
6699 		break;
6700 
6701 	case F_HASREMOTELOCKS:
6702 		/*
6703 		 * NFS client can't store remote locks itself
6704 		 */
6705 		shr->s_access = 0;
6706 		error = 0;
6707 		break;
6708 
6709 	default:
6710 		error = EINVAL;
6711 		break;
6712 	}
6713 
6714 	return (error);
6715 }
6716