1 /*
   2  * CDDL HEADER START
   3  *
   4  * The contents of this file are subject to the terms of the
   5  * Common Development and Distribution License (the "License").
   6  * You may not use this file except in compliance with the License.
   7  *
   8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
   9  * or http://www.opensolaris.org/os/licensing.
  10  * See the License for the specific language governing permissions
  11  * and limitations under the License.
  12  *
  13  * When distributing Covered Code, include this CDDL HEADER in each
  14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
  15  * If applicable, add the following below this CDDL HEADER, with the
  16  * fields enclosed by brackets "[]" replaced with your own identifying
  17  * information: Portions Copyright [yyyy] [name of copyright owner]
  18  *
  19  * CDDL HEADER END
  20  */
  21 /*
  22  * Copyright 2010 Sun Microsystems, Inc.  All rights reserved.
  23  * Use is subject to license terms.
  24  */
  25 /*
  26  * Copyright 2013 Nexenta Systems, Inc.  All rights reserved.
  27  */
  28 
  29 /*
  30  *      Copyright (c) 1983,1984,1985,1986,1987,1988,1989 AT&T.
  31  *      All rights reserved.
  32  */
  33 
  34 /*
  35  * Copyright (c) 2013, Joyent, Inc. All rights reserved.
  36  * Copyright 2015 Nexenta Systems, Inc.  All rights reserved.
  37  */
  38 
  39 #include <sys/param.h>
  40 #include <sys/types.h>
  41 #include <sys/systm.h>
  42 #include <sys/cred.h>
  43 #include <sys/time.h>
  44 #include <sys/vnode.h>
  45 #include <sys/vfs.h>
  46 #include <sys/vfs_opreg.h>
  47 #include <sys/file.h>
  48 #include <sys/filio.h>
  49 #include <sys/uio.h>
  50 #include <sys/buf.h>
  51 #include <sys/mman.h>
  52 #include <sys/pathname.h>
  53 #include <sys/dirent.h>
  54 #include <sys/debug.h>
  55 #include <sys/vmsystm.h>
  56 #include <sys/fcntl.h>
  57 #include <sys/flock.h>
  58 #include <sys/swap.h>
  59 #include <sys/errno.h>
  60 #include <sys/strsubr.h>
  61 #include <sys/sysmacros.h>
  62 #include <sys/kmem.h>
  63 #include <sys/cmn_err.h>
  64 #include <sys/pathconf.h>
  65 #include <sys/utsname.h>
  66 #include <sys/dnlc.h>
  67 #include <sys/acl.h>
  68 #include <sys/systeminfo.h>
  69 #include <sys/atomic.h>
  70 #include <sys/policy.h>
  71 #include <sys/sdt.h>
  72 #include <sys/zone.h>
  73 
  74 #include <rpc/types.h>
  75 #include <rpc/auth.h>
  76 #include <rpc/clnt.h>
  77 #include <rpc/rpc_rdma.h>
  78 
  79 #include <nfs/nfs.h>
  80 #include <nfs/nfs_clnt.h>
  81 #include <nfs/rnode.h>
  82 #include <nfs/nfs_acl.h>
  83 #include <nfs/lm.h>
  84 
  85 #include <vm/hat.h>
  86 #include <vm/as.h>
  87 #include <vm/page.h>
  88 #include <vm/pvn.h>
  89 #include <vm/seg.h>
  90 #include <vm/seg_map.h>
  91 #include <vm/seg_kpm.h>
  92 #include <vm/seg_vn.h>
  93 
  94 #include <fs/fs_subr.h>
  95 
  96 #include <sys/ddi.h>
  97 
  98 static int      nfs3_rdwrlbn(vnode_t *, page_t *, u_offset_t, size_t, int,
  99                         cred_t *);
 100 static int      nfs3write(vnode_t *, caddr_t, u_offset_t, int, cred_t *,
 101                         stable_how *);
 102 static int      nfs3read(vnode_t *, caddr_t, offset_t, int, size_t *, cred_t *);
 103 static int      nfs3setattr(vnode_t *, struct vattr *, int, cred_t *);
 104 static int      nfs3_accessx(void *, int, cred_t *);
 105 static int      nfs3lookup_dnlc(vnode_t *, char *, vnode_t **, cred_t *);
 106 static int      nfs3lookup_otw(vnode_t *, char *, vnode_t **, cred_t *, int);
 107 static int      nfs3create(vnode_t *, char *, struct vattr *, enum vcexcl,
 108                         int, vnode_t **, cred_t *, int);
 109 static int      nfs3excl_create_settimes(vnode_t *, struct vattr *, cred_t *);
 110 static int      nfs3mknod(vnode_t *, char *, struct vattr *, enum vcexcl,
 111                         int, vnode_t **, cred_t *);
 112 static int      nfs3rename(vnode_t *, char *, vnode_t *, char *, cred_t *,
 113                         caller_context_t *);
 114 static int      do_nfs3readdir(vnode_t *, rddir_cache *, cred_t *);
 115 static void     nfs3readdir(vnode_t *, rddir_cache *, cred_t *);
 116 static void     nfs3readdirplus(vnode_t *, rddir_cache *, cred_t *);
 117 static int      nfs3_bio(struct buf *, stable_how *, cred_t *);
 118 static int      nfs3_getapage(vnode_t *, u_offset_t, size_t, uint_t *,
 119                         page_t *[], size_t, struct seg *, caddr_t,
 120                         enum seg_rw, cred_t *);
 121 static void     nfs3_readahead(vnode_t *, u_offset_t, caddr_t, struct seg *,
 122                         cred_t *);
 123 static int      nfs3_sync_putapage(vnode_t *, page_t *, u_offset_t, size_t,
 124                         int, cred_t *);
 125 static int      nfs3_sync_pageio(vnode_t *, page_t *, u_offset_t, size_t,
 126                         int, cred_t *);
 127 static int      nfs3_commit(vnode_t *, offset3, count3, cred_t *);
 128 static void     nfs3_set_mod(vnode_t *);
 129 static void     nfs3_get_commit(vnode_t *);
 130 static void     nfs3_get_commit_range(vnode_t *, u_offset_t, size_t);
 131 static int      nfs3_putpage_commit(vnode_t *, offset_t, size_t, cred_t *);
 132 static int      nfs3_commit_vp(vnode_t *, u_offset_t, size_t,  cred_t *);
 133 static int      nfs3_sync_commit(vnode_t *, page_t *, offset3, count3,
 134                         cred_t *);
 135 static void     nfs3_async_commit(vnode_t *, page_t *, offset3, count3,
 136                         cred_t *);
 137 static void     nfs3_delmap_callback(struct as *, void *, uint_t);
 138 
 139 /*
 140  * Error flags used to pass information about certain special errors
 141  * which need to be handled specially.
 142  */
 143 #define NFS_EOF                 -98
 144 #define NFS_VERF_MISMATCH       -97
 145 
 146 /* ALIGN64 aligns the given buffer and adjust buffer size to 64 bit */
 147 #define ALIGN64(x, ptr, sz)                                             \
 148         x = ((uintptr_t)(ptr)) & (sizeof (uint64_t) - 1);           \
 149         if (x) {                                                        \
 150                 x = sizeof (uint64_t) - (x);                            \
 151                 sz -= (x);                                              \
 152                 ptr += (x);                                             \
 153         }
 154 
 155 /*
 156  * These are the vnode ops routines which implement the vnode interface to
 157  * the networked file system.  These routines just take their parameters,
 158  * make them look networkish by putting the right info into interface structs,
 159  * and then calling the appropriate remote routine(s) to do the work.
 160  *
 161  * Note on directory name lookup cacheing:  If we detect a stale fhandle,
 162  * we purge the directory cache relative to that vnode.  This way, the
 163  * user won't get burned by the cache repeatedly.  See <nfs/rnode.h> for
 164  * more details on rnode locking.
 165  */
 166 
 167 static int      nfs3_open(vnode_t **, int, cred_t *, caller_context_t *);
 168 static int      nfs3_close(vnode_t *, int, int, offset_t, cred_t *,
 169                         caller_context_t *);
 170 static int      nfs3_read(vnode_t *, struct uio *, int, cred_t *,
 171                         caller_context_t *);
 172 static int      nfs3_write(vnode_t *, struct uio *, int, cred_t *,
 173                         caller_context_t *);
 174 static int      nfs3_ioctl(vnode_t *, int, intptr_t, int, cred_t *, int *,
 175                         caller_context_t *);
 176 static int      nfs3_getattr(vnode_t *, struct vattr *, int, cred_t *,
 177                         caller_context_t *);
 178 static int      nfs3_setattr(vnode_t *, struct vattr *, int, cred_t *,
 179                         caller_context_t *);
 180 static int      nfs3_access(vnode_t *, int, int, cred_t *, caller_context_t *);
 181 static int      nfs3_readlink(vnode_t *, struct uio *, cred_t *,
 182                         caller_context_t *);
 183 static int      nfs3_fsync(vnode_t *, int, cred_t *, caller_context_t *);
 184 static void     nfs3_inactive(vnode_t *, cred_t *, caller_context_t *);
 185 static int      nfs3_lookup(vnode_t *, char *, vnode_t **,
 186                         struct pathname *, int, vnode_t *, cred_t *,
 187                         caller_context_t *, int *, pathname_t *);
 188 static int      nfs3_create(vnode_t *, char *, struct vattr *, enum vcexcl,
 189                         int, vnode_t **, cred_t *, int, caller_context_t *,
 190                         vsecattr_t *);
 191 static int      nfs3_remove(vnode_t *, char *, cred_t *, caller_context_t *,
 192                         int);
 193 static int      nfs3_link(vnode_t *, vnode_t *, char *, cred_t *,
 194                         caller_context_t *, int);
 195 static int      nfs3_rename(vnode_t *, char *, vnode_t *, char *, cred_t *,
 196                         caller_context_t *, int);
 197 static int      nfs3_mkdir(vnode_t *, char *, struct vattr *, vnode_t **,
 198                         cred_t *, caller_context_t *, int, vsecattr_t *);
 199 static int      nfs3_rmdir(vnode_t *, char *, vnode_t *, cred_t *,
 200                         caller_context_t *, int);
 201 static int      nfs3_symlink(vnode_t *, char *, struct vattr *, char *,
 202                         cred_t *, caller_context_t *, int);
 203 static int      nfs3_readdir(vnode_t *, struct uio *, cred_t *, int *,
 204                         caller_context_t *, int);
 205 static int      nfs3_fid(vnode_t *, fid_t *, caller_context_t *);
 206 static int      nfs3_rwlock(vnode_t *, int, caller_context_t *);
 207 static void     nfs3_rwunlock(vnode_t *, int, caller_context_t *);
 208 static int      nfs3_seek(vnode_t *, offset_t, offset_t *, caller_context_t *);
 209 static int      nfs3_getpage(vnode_t *, offset_t, size_t, uint_t *,
 210                         page_t *[], size_t, struct seg *, caddr_t,
 211                         enum seg_rw, cred_t *, caller_context_t *);
 212 static int      nfs3_putpage(vnode_t *, offset_t, size_t, int, cred_t *,
 213                         caller_context_t *);
 214 static int      nfs3_map(vnode_t *, offset_t, struct as *, caddr_t *, size_t,
 215                         uchar_t, uchar_t, uint_t, cred_t *, caller_context_t *);
 216 static int      nfs3_addmap(vnode_t *, offset_t, struct as *, caddr_t, size_t,
 217                         uchar_t, uchar_t, uint_t, cred_t *, caller_context_t *);
 218 static int      nfs3_frlock(vnode_t *, int, struct flock64 *, int, offset_t,
 219                         struct flk_callback *, cred_t *, caller_context_t *);
 220 static int      nfs3_space(vnode_t *, int, struct flock64 *, int, offset_t,
 221                         cred_t *, caller_context_t *);
 222 static int      nfs3_realvp(vnode_t *, vnode_t **, caller_context_t *);
 223 static int      nfs3_delmap(vnode_t *, offset_t, struct as *, caddr_t, size_t,
 224                         uint_t, uint_t, uint_t, cred_t *, caller_context_t *);
 225 static int      nfs3_pathconf(vnode_t *, int, ulong_t *, cred_t *,
 226                         caller_context_t *);
 227 static int      nfs3_pageio(vnode_t *, page_t *, u_offset_t, size_t, int,
 228                         cred_t *, caller_context_t *);
 229 static void     nfs3_dispose(vnode_t *, page_t *, int, int, cred_t *,
 230                         caller_context_t *);
 231 static int      nfs3_setsecattr(vnode_t *, vsecattr_t *, int, cred_t *,
 232                         caller_context_t *);
 233 static int      nfs3_getsecattr(vnode_t *, vsecattr_t *, int, cred_t *,
 234                         caller_context_t *);
 235 static int      nfs3_shrlock(vnode_t *, int, struct shrlock *, int, cred_t *,
 236                         caller_context_t *);
 237 
 238 struct vnodeops *nfs3_vnodeops;
 239 
 240 const fs_operation_def_t nfs3_vnodeops_template[] = {
 241         VOPNAME_OPEN,           { .vop_open = nfs3_open },
 242         VOPNAME_CLOSE,          { .vop_close = nfs3_close },
 243         VOPNAME_READ,           { .vop_read = nfs3_read },
 244         VOPNAME_WRITE,          { .vop_write = nfs3_write },
 245         VOPNAME_IOCTL,          { .vop_ioctl = nfs3_ioctl },
 246         VOPNAME_GETATTR,        { .vop_getattr = nfs3_getattr },
 247         VOPNAME_SETATTR,        { .vop_setattr = nfs3_setattr },
 248         VOPNAME_ACCESS,         { .vop_access = nfs3_access },
 249         VOPNAME_LOOKUP,         { .vop_lookup = nfs3_lookup },
 250         VOPNAME_CREATE,         { .vop_create = nfs3_create },
 251         VOPNAME_REMOVE,         { .vop_remove = nfs3_remove },
 252         VOPNAME_LINK,           { .vop_link = nfs3_link },
 253         VOPNAME_RENAME,         { .vop_rename = nfs3_rename },
 254         VOPNAME_MKDIR,          { .vop_mkdir = nfs3_mkdir },
 255         VOPNAME_RMDIR,          { .vop_rmdir = nfs3_rmdir },
 256         VOPNAME_READDIR,        { .vop_readdir = nfs3_readdir },
 257         VOPNAME_SYMLINK,        { .vop_symlink = nfs3_symlink },
 258         VOPNAME_READLINK,       { .vop_readlink = nfs3_readlink },
 259         VOPNAME_FSYNC,          { .vop_fsync = nfs3_fsync },
 260         VOPNAME_INACTIVE,       { .vop_inactive = nfs3_inactive },
 261         VOPNAME_FID,            { .vop_fid = nfs3_fid },
 262         VOPNAME_RWLOCK,         { .vop_rwlock = nfs3_rwlock },
 263         VOPNAME_RWUNLOCK,       { .vop_rwunlock = nfs3_rwunlock },
 264         VOPNAME_SEEK,           { .vop_seek = nfs3_seek },
 265         VOPNAME_FRLOCK,         { .vop_frlock = nfs3_frlock },
 266         VOPNAME_SPACE,          { .vop_space = nfs3_space },
 267         VOPNAME_REALVP,         { .vop_realvp = nfs3_realvp },
 268         VOPNAME_GETPAGE,        { .vop_getpage = nfs3_getpage },
 269         VOPNAME_PUTPAGE,        { .vop_putpage = nfs3_putpage },
 270         VOPNAME_MAP,            { .vop_map = nfs3_map },
 271         VOPNAME_ADDMAP,         { .vop_addmap = nfs3_addmap },
 272         VOPNAME_DELMAP,         { .vop_delmap = nfs3_delmap },
 273         /* no separate nfs3_dump */
 274         VOPNAME_DUMP,           { .vop_dump = nfs_dump },
 275         VOPNAME_PATHCONF,       { .vop_pathconf = nfs3_pathconf },
 276         VOPNAME_PAGEIO,         { .vop_pageio = nfs3_pageio },
 277         VOPNAME_DISPOSE,        { .vop_dispose = nfs3_dispose },
 278         VOPNAME_SETSECATTR,     { .vop_setsecattr = nfs3_setsecattr },
 279         VOPNAME_GETSECATTR,     { .vop_getsecattr = nfs3_getsecattr },
 280         VOPNAME_SHRLOCK,        { .vop_shrlock = nfs3_shrlock },
 281         VOPNAME_VNEVENT,        { .vop_vnevent = fs_vnevent_support },
 282         NULL,                   NULL
 283 };
 284 
 285 /*
 286  * XXX:  This is referenced in modstubs.s
 287  */
 288 struct vnodeops *
 289 nfs3_getvnodeops(void)
 290 {
 291         return (nfs3_vnodeops);
 292 }
 293 
 294 /* ARGSUSED */
 295 static int
 296 nfs3_open(vnode_t **vpp, int flag, cred_t *cr, caller_context_t *ct)
 297 {
 298         int error;
 299         struct vattr va;
 300         rnode_t *rp;
 301         vnode_t *vp;
 302 
 303         vp = *vpp;
 304         if (nfs_zone() != VTOMI(vp)->mi_zone)
 305                 return (EIO);
 306         rp = VTOR(vp);
 307         mutex_enter(&rp->r_statelock);
 308         if (rp->r_cred == NULL) {
 309                 crhold(cr);
 310                 rp->r_cred = cr;
 311         }
 312         mutex_exit(&rp->r_statelock);
 313 
 314         /*
 315          * If there is no cached data or if close-to-open
 316          * consistency checking is turned off, we can avoid
 317          * the over the wire getattr.  Otherwise, if the
 318          * file system is mounted readonly, then just verify
 319          * the caches are up to date using the normal mechanism.
 320          * Else, if the file is not mmap'd, then just mark
 321          * the attributes as timed out.  They will be refreshed
 322          * and the caches validated prior to being used.
 323          * Else, the file system is mounted writeable so
 324          * force an over the wire GETATTR in order to ensure
 325          * that all cached data is valid.
 326          */
 327         if (vp->v_count > 1 ||
 328             ((vn_has_cached_data(vp) || HAVE_RDDIR_CACHE(rp)) &&
 329             !(VTOMI(vp)->mi_flags & MI_NOCTO))) {
 330                 if (vn_is_readonly(vp))
 331                         error = nfs3_validate_caches(vp, cr);
 332                 else if (rp->r_mapcnt == 0 && vp->v_count == 1) {
 333                         PURGE_ATTRCACHE(vp);
 334                         error = 0;
 335                 } else {
 336                         va.va_mask = AT_ALL;
 337                         error = nfs3_getattr_otw(vp, &va, cr);
 338                 }
 339         } else
 340                 error = 0;
 341 
 342         return (error);
 343 }
 344 
 345 /* ARGSUSED */
 346 static int
 347 nfs3_close(vnode_t *vp, int flag, int count, offset_t offset, cred_t *cr,
 348                 caller_context_t *ct)
 349 {
 350         rnode_t *rp;
 351         int error;
 352         struct vattr va;
 353 
 354         /*
 355          * zone_enter(2) prevents processes from changing zones with NFS files
 356          * open; if we happen to get here from the wrong zone we can't do
 357          * anything over the wire.
 358          */
 359         if (VTOMI(vp)->mi_zone != nfs_zone()) {
 360                 /*
 361                  * We could attempt to clean up locks, except we're sure
 362                  * that the current process didn't acquire any locks on
 363                  * the file: any attempt to lock a file belong to another zone
 364                  * will fail, and one can't lock an NFS file and then change
 365                  * zones, as that fails too.
 366                  *
 367                  * Returning an error here is the sane thing to do.  A
 368                  * subsequent call to VN_RELE() which translates to a
 369                  * nfs3_inactive() will clean up state: if the zone of the
 370                  * vnode's origin is still alive and kicking, an async worker
 371                  * thread will handle the request (from the correct zone), and
 372                  * everything (minus the commit and final nfs3_getattr_otw()
 373                  * call) should be OK. If the zone is going away
 374                  * nfs_async_inactive() will throw away cached pages inline.
 375                  */
 376                 return (EIO);
 377         }
 378 
 379         /*
 380          * If we are using local locking for this filesystem, then
 381          * release all of the SYSV style record locks.  Otherwise,
 382          * we are doing network locking and we need to release all
 383          * of the network locks.  All of the locks held by this
 384          * process on this file are released no matter what the
 385          * incoming reference count is.
 386          */
 387         if (VTOMI(vp)->mi_flags & MI_LLOCK) {
 388                 cleanlocks(vp, ttoproc(curthread)->p_pid, 0);
 389                 cleanshares(vp, ttoproc(curthread)->p_pid);
 390         } else
 391                 nfs_lockrelease(vp, flag, offset, cr);
 392 
 393         if (count > 1)
 394                 return (0);
 395 
 396         /*
 397          * If the file has been `unlinked', then purge the
 398          * DNLC so that this vnode will get reycled quicker
 399          * and the .nfs* file on the server will get removed.
 400          */
 401         rp = VTOR(vp);
 402         if (rp->r_unldvp != NULL)
 403                 dnlc_purge_vp(vp);
 404 
 405         /*
 406          * If the file was open for write and there are pages,
 407          * then if the file system was mounted using the "no-close-
 408          *      to-open" semantics, then start an asynchronous flush
 409          *      of the all of the pages in the file.
 410          * else the file system was not mounted using the "no-close-
 411          *      to-open" semantics, then do a synchronous flush and
 412          *      commit of all of the dirty and uncommitted pages.
 413          *
 414          * The asynchronous flush of the pages in the "nocto" path
 415          * mostly just associates a cred pointer with the rnode so
 416          * writes which happen later will have a better chance of
 417          * working.  It also starts the data being written to the
 418          * server, but without unnecessarily delaying the application.
 419          */
 420         if ((flag & FWRITE) && vn_has_cached_data(vp)) {
 421                 if (VTOMI(vp)->mi_flags & MI_NOCTO) {
 422                         error = nfs3_putpage(vp, (offset_t)0, 0, B_ASYNC,
 423                             cr, ct);
 424                         if (error == EAGAIN)
 425                                 error = 0;
 426                 } else
 427                         error = nfs3_putpage_commit(vp, (offset_t)0, 0, cr);
 428                 if (!error) {
 429                         mutex_enter(&rp->r_statelock);
 430                         error = rp->r_error;
 431                         rp->r_error = 0;
 432                         mutex_exit(&rp->r_statelock);
 433                 }
 434         } else {
 435                 mutex_enter(&rp->r_statelock);
 436                 error = rp->r_error;
 437                 rp->r_error = 0;
 438                 mutex_exit(&rp->r_statelock);
 439         }
 440 
 441         /*
 442          * If RWRITEATTR is set, then issue an over the wire GETATTR to
 443          * refresh the attribute cache with a set of attributes which
 444          * weren't returned from a WRITE.  This will enable the close-
 445          * to-open processing to work.
 446          */
 447         if (rp->r_flags & RWRITEATTR)
 448                 (void) nfs3_getattr_otw(vp, &va, cr);
 449 
 450         return (error);
 451 }
 452 
 453 /* ARGSUSED */
 454 static int
 455 nfs3_directio_read(vnode_t *vp, struct uio *uiop, cred_t *cr)
 456 {
 457         mntinfo_t *mi;
 458         READ3args args;
 459         READ3uiores res;
 460         int tsize;
 461         offset_t offset;
 462         ssize_t count;
 463         int error;
 464         int douprintf;
 465         failinfo_t fi;
 466         char *sv_hostname;
 467 
 468         mi = VTOMI(vp);
 469         ASSERT(nfs_zone() == VTOMI(vp)->mi_zone);
 470         sv_hostname = VTOR(vp)->r_server->sv_hostname;
 471 
 472         douprintf = 1;
 473         args.file = *VTOFH3(vp);
 474         fi.vp = vp;
 475         fi.fhp = (caddr_t)&args.file;
 476         fi.copyproc = nfs3copyfh;
 477         fi.lookupproc = nfs3lookup;
 478         fi.xattrdirproc = acl_getxattrdir3;
 479 
 480         res.uiop = uiop;
 481 
 482         res.wlist = NULL;
 483 
 484         offset = uiop->uio_loffset;
 485         count = uiop->uio_resid;
 486 
 487         do {
 488                 if (mi->mi_io_kstats) {
 489                         mutex_enter(&mi->mi_lock);
 490                         kstat_runq_enter(KSTAT_IO_PTR(mi->mi_io_kstats));
 491                         mutex_exit(&mi->mi_lock);
 492                 }
 493 
 494                 do {
 495                         tsize = MIN(mi->mi_tsize, count);
 496                         args.offset = (offset3)offset;
 497                         args.count = (count3)tsize;
 498                         res.size = (uint_t)tsize;
 499                         args.res_uiop = uiop;
 500                         args.res_data_val_alt = NULL;
 501 
 502                         error = rfs3call(mi, NFSPROC3_READ,
 503                             xdr_READ3args, (caddr_t)&args,
 504                             xdr_READ3uiores, (caddr_t)&res, cr,
 505                             &douprintf, &res.status, 0, &fi);
 506                 } while (error == ENFS_TRYAGAIN);
 507 
 508                 if (mi->mi_io_kstats) {
 509                         mutex_enter(&mi->mi_lock);
 510                         kstat_runq_exit(KSTAT_IO_PTR(mi->mi_io_kstats));
 511                         mutex_exit(&mi->mi_lock);
 512                 }
 513 
 514                 if (error)
 515                         return (error);
 516 
 517                 error = geterrno3(res.status);
 518                 if (error)
 519                         return (error);
 520 
 521                 if (res.count != res.size) {
 522                         zcmn_err(getzoneid(), CE_WARN,
 523 "nfs3_directio_read: server %s returned incorrect amount",
 524                             sv_hostname);
 525                         return (EIO);
 526                 }
 527                 count -= res.count;
 528                 offset += res.count;
 529                 if (mi->mi_io_kstats) {
 530                         mutex_enter(&mi->mi_lock);
 531                         KSTAT_IO_PTR(mi->mi_io_kstats)->reads++;
 532                         KSTAT_IO_PTR(mi->mi_io_kstats)->nread += res.count;
 533                         mutex_exit(&mi->mi_lock);
 534                 }
 535                 lwp_stat_update(LWP_STAT_INBLK, 1);
 536         } while (count && !res.eof);
 537 
 538         return (0);
 539 }
 540 
 541 /* ARGSUSED */
 542 static int
 543 nfs3_read(vnode_t *vp, struct uio *uiop, int ioflag, cred_t *cr,
 544         caller_context_t *ct)
 545 {
 546         rnode_t *rp;
 547         u_offset_t off;
 548         offset_t diff;
 549         int on;
 550         size_t n;
 551         caddr_t base;
 552         uint_t flags;
 553         int error = 0;
 554         mntinfo_t *mi;
 555 
 556         rp = VTOR(vp);
 557         mi = VTOMI(vp);
 558 
 559         ASSERT(nfs_rw_lock_held(&rp->r_rwlock, RW_READER));
 560 
 561         if (nfs_zone() != mi->mi_zone)
 562                 return (EIO);
 563 
 564         if (vp->v_type != VREG)
 565                 return (EISDIR);
 566 
 567         if (uiop->uio_resid == 0)
 568                 return (0);
 569 
 570         if (uiop->uio_loffset < 0 || uiop->uio_loffset + uiop->uio_resid < 0)
 571                 return (EINVAL);
 572 
 573         /*
 574          * Bypass VM if caching has been disabled (e.g., locking) or if
 575          * using client-side direct I/O and the file is not mmap'd and
 576          * there are no cached pages.
 577          */
 578         if ((vp->v_flag & VNOCACHE) ||
 579             (((rp->r_flags & RDIRECTIO) || (mi->mi_flags & MI_DIRECTIO)) &&
 580             rp->r_mapcnt == 0 && rp->r_inmap == 0 &&
 581             !vn_has_cached_data(vp))) {
 582                 return (nfs3_directio_read(vp, uiop, cr));
 583         }
 584 
 585         do {
 586                 off = uiop->uio_loffset & MAXBMASK; /* mapping offset */
 587                 on = uiop->uio_loffset & MAXBOFFSET; /* Relative offset */
 588                 n = MIN(MAXBSIZE - on, uiop->uio_resid);
 589 
 590                 error = nfs3_validate_caches(vp, cr);
 591                 if (error)
 592                         break;
 593 
 594                 mutex_enter(&rp->r_statelock);
 595                 while (rp->r_flags & RINCACHEPURGE) {
 596                         if (!cv_wait_sig(&rp->r_cv, &rp->r_statelock)) {
 597                                 mutex_exit(&rp->r_statelock);
 598                                 return (EINTR);
 599                         }
 600                 }
 601                 diff = rp->r_size - uiop->uio_loffset;
 602                 mutex_exit(&rp->r_statelock);
 603                 if (diff <= 0)
 604                         break;
 605                 if (diff < n)
 606                         n = (size_t)diff;
 607 
 608                 if (vpm_enable) {
 609                         /*
 610                          * Copy data.
 611                          */
 612                         error = vpm_data_copy(vp, off + on, n, uiop,
 613                             1, NULL, 0, S_READ);
 614                 } else {
 615                         base = segmap_getmapflt(segkmap, vp, off + on, n, 1,
 616                             S_READ);
 617 
 618                         error = uiomove(base + on, n, UIO_READ, uiop);
 619                 }
 620 
 621                 if (!error) {
 622                         /*
 623                          * If read a whole block or read to eof,
 624                          * won't need this buffer again soon.
 625                          */
 626                         mutex_enter(&rp->r_statelock);
 627                         if (n + on == MAXBSIZE ||
 628                             uiop->uio_loffset == rp->r_size)
 629                                 flags = SM_DONTNEED;
 630                         else
 631                                 flags = 0;
 632                         mutex_exit(&rp->r_statelock);
 633                         if (vpm_enable) {
 634                                 error = vpm_sync_pages(vp, off, n, flags);
 635                         } else {
 636                                 error = segmap_release(segkmap, base, flags);
 637                         }
 638                 } else {
 639                         if (vpm_enable) {
 640                                 (void) vpm_sync_pages(vp, off, n, 0);
 641                         } else {
 642                                 (void) segmap_release(segkmap, base, 0);
 643                         }
 644                 }
 645         } while (!error && uiop->uio_resid > 0);
 646 
 647         return (error);
 648 }
 649 
 650 /* ARGSUSED */
 651 static int
 652 nfs3_write(vnode_t *vp, struct uio *uiop, int ioflag, cred_t *cr,
 653         caller_context_t *ct)
 654 {
 655         rlim64_t limit = uiop->uio_llimit;
 656         rnode_t *rp;
 657         u_offset_t off;
 658         caddr_t base;
 659         uint_t flags;
 660         int remainder;
 661         size_t n;
 662         int on;
 663         int error;
 664         int resid;
 665         offset_t offset;
 666         mntinfo_t *mi;
 667         uint_t bsize;
 668 
 669         rp = VTOR(vp);
 670 
 671         if (vp->v_type != VREG)
 672                 return (EISDIR);
 673 
 674         mi = VTOMI(vp);
 675         if (nfs_zone() != mi->mi_zone)
 676                 return (EIO);
 677         if (uiop->uio_resid == 0)
 678                 return (0);
 679 
 680         if (ioflag & FAPPEND) {
 681                 struct vattr va;
 682 
 683                 /*
 684                  * Must serialize if appending.
 685                  */
 686                 if (nfs_rw_lock_held(&rp->r_rwlock, RW_READER)) {
 687                         nfs_rw_exit(&rp->r_rwlock);
 688                         if (nfs_rw_enter_sig(&rp->r_rwlock, RW_WRITER,
 689                             INTR(vp)))
 690                                 return (EINTR);
 691                 }
 692 
 693                 va.va_mask = AT_SIZE;
 694                 error = nfs3getattr(vp, &va, cr);
 695                 if (error)
 696                         return (error);
 697                 uiop->uio_loffset = va.va_size;
 698         }
 699 
 700         offset = uiop->uio_loffset + uiop->uio_resid;
 701 
 702         if (uiop->uio_loffset < 0 || offset < 0)
 703                 return (EINVAL);
 704 
 705         if (limit == RLIM64_INFINITY || limit > MAXOFFSET_T)
 706                 limit = MAXOFFSET_T;
 707 
 708         /*
 709          * Check to make sure that the process will not exceed
 710          * its limit on file size.  It is okay to write up to
 711          * the limit, but not beyond.  Thus, the write which
 712          * reaches the limit will be short and the next write
 713          * will return an error.
 714          */
 715         remainder = 0;
 716         if (offset > limit) {
 717                 remainder = offset - limit;
 718                 uiop->uio_resid = limit - uiop->uio_loffset;
 719                 if (uiop->uio_resid <= 0) {
 720                         proc_t *p = ttoproc(curthread);
 721 
 722                         uiop->uio_resid += remainder;
 723                         mutex_enter(&p->p_lock);
 724                         (void) rctl_action(rctlproc_legacy[RLIMIT_FSIZE],
 725                             p->p_rctls, p, RCA_UNSAFE_SIGINFO);
 726                         mutex_exit(&p->p_lock);
 727                         return (EFBIG);
 728                 }
 729         }
 730 
 731         if (nfs_rw_enter_sig(&rp->r_lkserlock, RW_READER, INTR(vp)))
 732                 return (EINTR);
 733 
 734         /*
 735          * Bypass VM if caching has been disabled (e.g., locking) or if
 736          * using client-side direct I/O and the file is not mmap'd and
 737          * there are no cached pages.
 738          */
 739         if ((vp->v_flag & VNOCACHE) ||
 740             (((rp->r_flags & RDIRECTIO) || (mi->mi_flags & MI_DIRECTIO)) &&
 741             rp->r_mapcnt == 0 && rp->r_inmap == 0 &&
 742             !vn_has_cached_data(vp))) {
 743                 size_t bufsize;
 744                 int count;
 745                 u_offset_t org_offset;
 746                 stable_how stab_comm;
 747 
 748 nfs3_fwrite:
 749                 if (rp->r_flags & RSTALE) {
 750                         resid = uiop->uio_resid;
 751                         offset = uiop->uio_loffset;
 752                         error = rp->r_error;
 753                         /*
 754                          * A close may have cleared r_error, if so,
 755                          * propagate ESTALE error return properly
 756                          */
 757                         if (error == 0)
 758                                 error = ESTALE;
 759                         goto bottom;
 760                 }
 761                 bufsize = MIN(uiop->uio_resid, mi->mi_stsize);
 762                 base = kmem_alloc(bufsize, KM_SLEEP);
 763                 do {
 764                         if (ioflag & FDSYNC)
 765                                 stab_comm = DATA_SYNC;
 766                         else
 767                                 stab_comm = FILE_SYNC;
 768                         resid = uiop->uio_resid;
 769                         offset = uiop->uio_loffset;
 770                         count = MIN(uiop->uio_resid, bufsize);
 771                         org_offset = uiop->uio_loffset;
 772                         error = uiomove(base, count, UIO_WRITE, uiop);
 773                         if (!error) {
 774                                 error = nfs3write(vp, base, org_offset,
 775                                     count, cr, &stab_comm);
 776                         }
 777                 } while (!error && uiop->uio_resid > 0);
 778                 kmem_free(base, bufsize);
 779                 goto bottom;
 780         }
 781 
 782 
 783         bsize = vp->v_vfsp->vfs_bsize;
 784 
 785         do {
 786                 off = uiop->uio_loffset & MAXBMASK; /* mapping offset */
 787                 on = uiop->uio_loffset & MAXBOFFSET; /* Relative offset */
 788                 n = MIN(MAXBSIZE - on, uiop->uio_resid);
 789 
 790                 resid = uiop->uio_resid;
 791                 offset = uiop->uio_loffset;
 792 
 793                 if (rp->r_flags & RSTALE) {
 794                         error = rp->r_error;
 795                         /*
 796                          * A close may have cleared r_error, if so,
 797                          * propagate ESTALE error return properly
 798                          */
 799                         if (error == 0)
 800                                 error = ESTALE;
 801                         break;
 802                 }
 803 
 804                 /*
 805                  * Don't create dirty pages faster than they
 806                  * can be cleaned so that the system doesn't
 807                  * get imbalanced.  If the async queue is
 808                  * maxed out, then wait for it to drain before
 809                  * creating more dirty pages.  Also, wait for
 810                  * any threads doing pagewalks in the vop_getattr
 811                  * entry points so that they don't block for
 812                  * long periods.
 813                  */
 814                 mutex_enter(&rp->r_statelock);
 815                 while ((mi->mi_max_threads != 0 &&
 816                     rp->r_awcount > 2 * mi->mi_max_threads) ||
 817                     rp->r_gcount > 0) {
 818                         if (INTR(vp)) {
 819                                 klwp_t *lwp = ttolwp(curthread);
 820 
 821                                 if (lwp != NULL)
 822                                         lwp->lwp_nostop++;
 823                                 if (!cv_wait_sig(&rp->r_cv, &rp->r_statelock)) {
 824                                         mutex_exit(&rp->r_statelock);
 825                                         if (lwp != NULL)
 826                                                 lwp->lwp_nostop--;
 827                                         error = EINTR;
 828                                         goto bottom;
 829                                 }
 830                                 if (lwp != NULL)
 831                                         lwp->lwp_nostop--;
 832                         } else
 833                                 cv_wait(&rp->r_cv, &rp->r_statelock);
 834                 }
 835                 mutex_exit(&rp->r_statelock);
 836 
 837                 /*
 838                  * Touch the page and fault it in if it is not in core
 839                  * before segmap_getmapflt or vpm_data_copy can lock it.
 840                  * This is to avoid the deadlock if the buffer is mapped
 841                  * to the same file through mmap which we want to write.
 842                  */
 843                 uio_prefaultpages((long)n, uiop);
 844 
 845                 if (vpm_enable) {
 846                         /*
 847                          * It will use kpm mappings, so no need to
 848                          * pass an address.
 849                          */
 850                         error = writerp(rp, NULL, n, uiop, 0);
 851                 } else  {
 852                         if (segmap_kpm) {
 853                                 int pon = uiop->uio_loffset & PAGEOFFSET;
 854                                 size_t pn = MIN(PAGESIZE - pon,
 855                                     uiop->uio_resid);
 856                                 int pagecreate;
 857 
 858                                 mutex_enter(&rp->r_statelock);
 859                                 pagecreate = (pon == 0) && (pn == PAGESIZE ||
 860                                     uiop->uio_loffset + pn >= rp->r_size);
 861                                 mutex_exit(&rp->r_statelock);
 862 
 863                                 base = segmap_getmapflt(segkmap, vp, off + on,
 864                                     pn, !pagecreate, S_WRITE);
 865 
 866                                 error = writerp(rp, base + pon, n, uiop,
 867                                     pagecreate);
 868 
 869                         } else {
 870                                 base = segmap_getmapflt(segkmap, vp, off + on,
 871                                     n, 0, S_READ);
 872                                 error = writerp(rp, base + on, n, uiop, 0);
 873                         }
 874                 }
 875 
 876                 if (!error) {
 877                         if (mi->mi_flags & MI_NOAC)
 878                                 flags = SM_WRITE;
 879                         else if ((uiop->uio_loffset % bsize) == 0 ||
 880                             IS_SWAPVP(vp)) {
 881                                 /*
 882                                  * Have written a whole block.
 883                                  * Start an asynchronous write
 884                                  * and mark the buffer to
 885                                  * indicate that it won't be
 886                                  * needed again soon.
 887                                  */
 888                                 flags = SM_WRITE | SM_ASYNC | SM_DONTNEED;
 889                         } else
 890                                 flags = 0;
 891                         if ((ioflag & (FSYNC|FDSYNC)) ||
 892                             (rp->r_flags & ROUTOFSPACE)) {
 893                                 flags &= ~SM_ASYNC;
 894                                 flags |= SM_WRITE;
 895                         }
 896                         if (vpm_enable) {
 897                                 error = vpm_sync_pages(vp, off, n, flags);
 898                         } else {
 899                                 error = segmap_release(segkmap, base, flags);
 900                         }
 901                 } else {
 902                         if (vpm_enable) {
 903                                 (void) vpm_sync_pages(vp, off, n, 0);
 904                         } else {
 905                                 (void) segmap_release(segkmap, base, 0);
 906                         }
 907                         /*
 908                          * In the event that we got an access error while
 909                          * faulting in a page for a write-only file just
 910                          * force a write.
 911                          */
 912                         if (error == EACCES)
 913                                 goto nfs3_fwrite;
 914                 }
 915         } while (!error && uiop->uio_resid > 0);
 916 
 917 bottom:
 918         if (error) {
 919                 uiop->uio_resid = resid + remainder;
 920                 uiop->uio_loffset = offset;
 921         } else
 922                 uiop->uio_resid += remainder;
 923 
 924         nfs_rw_exit(&rp->r_lkserlock);
 925 
 926         return (error);
 927 }
 928 
 929 /*
 930  * Flags are composed of {B_ASYNC, B_INVAL, B_FREE, B_DONTNEED}
 931  */
 932 static int
 933 nfs3_rdwrlbn(vnode_t *vp, page_t *pp, u_offset_t off, size_t len,
 934         int flags, cred_t *cr)
 935 {
 936         struct buf *bp;
 937         int error;
 938         page_t *savepp;
 939         uchar_t fsdata;
 940         stable_how stab_comm;
 941 
 942         ASSERT(nfs_zone() == VTOMI(vp)->mi_zone);
 943         bp = pageio_setup(pp, len, vp, flags);
 944         ASSERT(bp != NULL);
 945 
 946         /*
 947          * pageio_setup should have set b_addr to 0.  This
 948          * is correct since we want to do I/O on a page
 949          * boundary.  bp_mapin will use this addr to calculate
 950          * an offset, and then set b_addr to the kernel virtual
 951          * address it allocated for us.
 952          */
 953         ASSERT(bp->b_un.b_addr == 0);
 954 
 955         bp->b_edev = 0;
 956         bp->b_dev = 0;
 957         bp->b_lblkno = lbtodb(off);
 958         bp->b_file = vp;
 959         bp->b_offset = (offset_t)off;
 960         bp_mapin(bp);
 961 
 962         /*
 963          * Calculate the desired level of stability to write data
 964          * on the server and then mark all of the pages to reflect
 965          * this.
 966          */
 967         if ((flags & (B_WRITE|B_ASYNC)) == (B_WRITE|B_ASYNC) &&
 968             freemem > desfree) {
 969                 stab_comm = UNSTABLE;
 970                 fsdata = C_DELAYCOMMIT;
 971         } else {
 972                 stab_comm = FILE_SYNC;
 973                 fsdata = C_NOCOMMIT;
 974         }
 975 
 976         savepp = pp;
 977         do {
 978                 pp->p_fsdata = fsdata;
 979         } while ((pp = pp->p_next) != savepp);
 980 
 981         error = nfs3_bio(bp, &stab_comm, cr);
 982 
 983         bp_mapout(bp);
 984         pageio_done(bp);
 985 
 986         /*
 987          * If the server wrote pages in a more stable fashion than
 988          * was requested, then clear all of the marks in the pages
 989          * indicating that COMMIT operations were required.
 990          */
 991         if (stab_comm != UNSTABLE && fsdata == C_DELAYCOMMIT) {
 992                 do {
 993                         pp->p_fsdata = C_NOCOMMIT;
 994                 } while ((pp = pp->p_next) != savepp);
 995         }
 996 
 997         return (error);
 998 }
 999 
1000 /*
1001  * Write to file.  Writes to remote server in largest size
1002  * chunks that the server can handle.  Write is synchronous.
1003  */
1004 static int
1005 nfs3write(vnode_t *vp, caddr_t base, u_offset_t offset, int count, cred_t *cr,
1006         stable_how *stab_comm)
1007 {
1008         mntinfo_t *mi;
1009         WRITE3args args;
1010         WRITE3res res;
1011         int error;
1012         int tsize;
1013         rnode_t *rp;
1014         int douprintf;
1015 
1016         rp = VTOR(vp);
1017         mi = VTOMI(vp);
1018 
1019         ASSERT(nfs_zone() == mi->mi_zone);
1020 
1021         args.file = *VTOFH3(vp);
1022         args.stable = *stab_comm;
1023 
1024         *stab_comm = FILE_SYNC;
1025 
1026         douprintf = 1;
1027 
1028         do {
1029                 if ((vp->v_flag & VNOCACHE) ||
1030                     (rp->r_flags & RDIRECTIO) ||
1031                     (mi->mi_flags & MI_DIRECTIO))
1032                         tsize = MIN(mi->mi_stsize, count);
1033                 else
1034                         tsize = MIN(mi->mi_curwrite, count);
1035                 args.offset = (offset3)offset;
1036                 args.count = (count3)tsize;
1037                 args.data.data_len = (uint_t)tsize;
1038                 args.data.data_val = base;
1039 
1040                 if (mi->mi_io_kstats) {
1041                         mutex_enter(&mi->mi_lock);
1042                         kstat_runq_enter(KSTAT_IO_PTR(mi->mi_io_kstats));
1043                         mutex_exit(&mi->mi_lock);
1044                 }
1045                 args.mblk = NULL;
1046                 do {
1047                         error = rfs3call(mi, NFSPROC3_WRITE,
1048                             xdr_WRITE3args, (caddr_t)&args,
1049                             xdr_WRITE3res, (caddr_t)&res, cr,
1050                             &douprintf, &res.status, 0, NULL);
1051                 } while (error == ENFS_TRYAGAIN);
1052                 if (mi->mi_io_kstats) {
1053                         mutex_enter(&mi->mi_lock);
1054                         kstat_runq_exit(KSTAT_IO_PTR(mi->mi_io_kstats));
1055                         mutex_exit(&mi->mi_lock);
1056                 }
1057 
1058                 if (error)
1059                         return (error);
1060                 error = geterrno3(res.status);
1061                 if (!error) {
1062                         if (res.resok.count > args.count) {
1063                                 zcmn_err(getzoneid(), CE_WARN,
1064                                     "nfs3write: server %s wrote %u, "
1065                                     "requested was %u",
1066                                     rp->r_server->sv_hostname,
1067                                     res.resok.count, args.count);
1068                                 return (EIO);
1069                         }
1070                         if (res.resok.committed == UNSTABLE) {
1071                                 *stab_comm = UNSTABLE;
1072                                 if (args.stable == DATA_SYNC ||
1073                                     args.stable == FILE_SYNC) {
1074                                         zcmn_err(getzoneid(), CE_WARN,
1075                         "nfs3write: server %s did not commit to stable storage",
1076                                             rp->r_server->sv_hostname);
1077                                         return (EIO);
1078                                 }
1079                         }
1080                         tsize = (int)res.resok.count;
1081                         count -= tsize;
1082                         base += tsize;
1083                         offset += tsize;
1084                         if (mi->mi_io_kstats) {
1085                                 mutex_enter(&mi->mi_lock);
1086                                 KSTAT_IO_PTR(mi->mi_io_kstats)->writes++;
1087                                 KSTAT_IO_PTR(mi->mi_io_kstats)->nwritten +=
1088                                     tsize;
1089                                 mutex_exit(&mi->mi_lock);
1090                         }
1091                         lwp_stat_update(LWP_STAT_OUBLK, 1);
1092                         mutex_enter(&rp->r_statelock);
1093                         if (rp->r_flags & RHAVEVERF) {
1094                                 if (rp->r_verf != res.resok.verf) {
1095                                         nfs3_set_mod(vp);
1096                                         rp->r_verf = res.resok.verf;
1097                                         /*
1098                                          * If the data was written UNSTABLE,
1099                                          * then might as well stop because
1100                                          * the whole block will have to get
1101                                          * rewritten anyway.
1102                                          */
1103                                         if (*stab_comm == UNSTABLE) {
1104                                                 mutex_exit(&rp->r_statelock);
1105                                                 break;
1106                                         }
1107                                 }
1108                         } else {
1109                                 rp->r_verf = res.resok.verf;
1110                                 rp->r_flags |= RHAVEVERF;
1111                         }
1112                         /*
1113                          * Mark the attribute cache as timed out and
1114                          * set RWRITEATTR to indicate that the file
1115                          * was modified with a WRITE operation and
1116                          * that the attributes can not be trusted.
1117                          */
1118                         PURGE_ATTRCACHE_LOCKED(rp);
1119                         rp->r_flags |= RWRITEATTR;
1120                         mutex_exit(&rp->r_statelock);
1121                 }
1122         } while (!error && count);
1123 
1124         return (error);
1125 }
1126 
1127 /*
1128  * Read from a file.  Reads data in largest chunks our interface can handle.
1129  */
1130 static int
1131 nfs3read(vnode_t *vp, caddr_t base, offset_t offset, int count,
1132         size_t *residp, cred_t *cr)
1133 {
1134         mntinfo_t *mi;
1135         READ3args args;
1136         READ3vres res;
1137         int tsize;
1138         int error;
1139         int douprintf;
1140         failinfo_t fi;
1141         rnode_t *rp;
1142         struct vattr va;
1143         hrtime_t t;
1144 
1145         rp = VTOR(vp);
1146         mi = VTOMI(vp);
1147         ASSERT(nfs_zone() == mi->mi_zone);
1148         douprintf = 1;
1149 
1150         args.file = *VTOFH3(vp);
1151         fi.vp = vp;
1152         fi.fhp = (caddr_t)&args.file;
1153         fi.copyproc = nfs3copyfh;
1154         fi.lookupproc = nfs3lookup;
1155         fi.xattrdirproc = acl_getxattrdir3;
1156 
1157         res.pov.fres.vp = vp;
1158         res.pov.fres.vap = &va;
1159 
1160         res.wlist = NULL;
1161         *residp = count;
1162         do {
1163                 if (mi->mi_io_kstats) {
1164                         mutex_enter(&mi->mi_lock);
1165                         kstat_runq_enter(KSTAT_IO_PTR(mi->mi_io_kstats));
1166                         mutex_exit(&mi->mi_lock);
1167                 }
1168 
1169                 do {
1170                         if ((vp->v_flag & VNOCACHE) ||
1171                             (rp->r_flags & RDIRECTIO) ||
1172                             (mi->mi_flags & MI_DIRECTIO))
1173                                 tsize = MIN(mi->mi_tsize, count);
1174                         else
1175                                 tsize = MIN(mi->mi_curread, count);
1176                         res.data.data_val = base;
1177                         res.data.data_len = tsize;
1178                         args.offset = (offset3)offset;
1179                         args.count = (count3)tsize;
1180                         args.res_uiop = NULL;
1181                         args.res_data_val_alt = base;
1182 
1183                         t = gethrtime();
1184                         error = rfs3call(mi, NFSPROC3_READ,
1185                             xdr_READ3args, (caddr_t)&args,
1186                             xdr_READ3vres, (caddr_t)&res, cr,
1187                             &douprintf, &res.status, 0, &fi);
1188                 } while (error == ENFS_TRYAGAIN);
1189 
1190                 if (mi->mi_io_kstats) {
1191                         mutex_enter(&mi->mi_lock);
1192                         kstat_runq_exit(KSTAT_IO_PTR(mi->mi_io_kstats));
1193                         mutex_exit(&mi->mi_lock);
1194                 }
1195 
1196                 if (error)
1197                         return (error);
1198 
1199                 error = geterrno3(res.status);
1200                 if (error)
1201                         return (error);
1202 
1203                 if (res.count != res.data.data_len) {
1204                         zcmn_err(getzoneid(), CE_WARN,
1205                             "nfs3read: server %s returned incorrect amount",
1206                             rp->r_server->sv_hostname);
1207                         return (EIO);
1208                 }
1209 
1210                 count -= res.count;
1211                 *residp = count;
1212                 base += res.count;
1213                 offset += res.count;
1214                 if (mi->mi_io_kstats) {
1215                         mutex_enter(&mi->mi_lock);
1216                         KSTAT_IO_PTR(mi->mi_io_kstats)->reads++;
1217                         KSTAT_IO_PTR(mi->mi_io_kstats)->nread += res.count;
1218                         mutex_exit(&mi->mi_lock);
1219                 }
1220                 lwp_stat_update(LWP_STAT_INBLK, 1);
1221         } while (count && !res.eof);
1222 
1223         if (res.pov.attributes) {
1224                 mutex_enter(&rp->r_statelock);
1225                 if (!CACHE_VALID(rp, va.va_mtime, va.va_size)) {
1226                         mutex_exit(&rp->r_statelock);
1227                         PURGE_ATTRCACHE(vp);
1228                 } else {
1229                         if (rp->r_mtime <= t)
1230                                 nfs_attrcache_va(vp, &va);
1231                         mutex_exit(&rp->r_statelock);
1232                 }
1233         }
1234 
1235         return (0);
1236 }
1237 
1238 /* ARGSUSED */
1239 static int
1240 nfs3_ioctl(vnode_t *vp, int cmd, intptr_t arg, int flag, cred_t *cr, int *rvalp,
1241         caller_context_t *ct)
1242 {
1243 
1244         if (nfs_zone() != VTOMI(vp)->mi_zone)
1245                 return (EIO);
1246         switch (cmd) {
1247                 case _FIODIRECTIO:
1248                         return (nfs_directio(vp, (int)arg, cr));
1249                 default:
1250                         return (ENOTTY);
1251         }
1252 }
1253 
1254 /* ARGSUSED */
1255 static int
1256 nfs3_getattr(vnode_t *vp, struct vattr *vap, int flags, cred_t *cr,
1257         caller_context_t *ct)
1258 {
1259         int error;
1260         rnode_t *rp;
1261 
1262         if (nfs_zone() != VTOMI(vp)->mi_zone)
1263                 return (EIO);
1264         /*
1265          * If it has been specified that the return value will
1266          * just be used as a hint, and we are only being asked
1267          * for size, fsid or rdevid, then return the client's
1268          * notion of these values without checking to make sure
1269          * that the attribute cache is up to date.
1270          * The whole point is to avoid an over the wire GETATTR
1271          * call.
1272          */
1273         rp = VTOR(vp);
1274         if (flags & ATTR_HINT) {
1275                 if (vap->va_mask ==
1276                     (vap->va_mask & (AT_SIZE | AT_FSID | AT_RDEV))) {
1277                         mutex_enter(&rp->r_statelock);
1278                         if (vap->va_mask | AT_SIZE)
1279                                 vap->va_size = rp->r_size;
1280                         if (vap->va_mask | AT_FSID)
1281                                 vap->va_fsid = rp->r_attr.va_fsid;
1282                         if (vap->va_mask | AT_RDEV)
1283                                 vap->va_rdev = rp->r_attr.va_rdev;
1284                         mutex_exit(&rp->r_statelock);
1285                         return (0);
1286                 }
1287         }
1288 
1289         /*
1290          * Only need to flush pages if asking for the mtime
1291          * and if there any dirty pages or any outstanding
1292          * asynchronous (write) requests for this file.
1293          */
1294         if (vap->va_mask & AT_MTIME) {
1295                 if (vn_has_cached_data(vp) &&
1296                     ((rp->r_flags & RDIRTY) || rp->r_awcount > 0)) {
1297                         mutex_enter(&rp->r_statelock);
1298                         rp->r_gcount++;
1299                         mutex_exit(&rp->r_statelock);
1300                         error = nfs3_putpage(vp, (offset_t)0, 0, 0, cr, ct);
1301                         mutex_enter(&rp->r_statelock);
1302                         if (error && (error == ENOSPC || error == EDQUOT)) {
1303                                 if (!rp->r_error)
1304                                         rp->r_error = error;
1305                         }
1306                         if (--rp->r_gcount == 0)
1307                                 cv_broadcast(&rp->r_cv);
1308                         mutex_exit(&rp->r_statelock);
1309                 }
1310         }
1311 
1312         return (nfs3getattr(vp, vap, cr));
1313 }
1314 
1315 /*ARGSUSED4*/
1316 static int
1317 nfs3_setattr(vnode_t *vp, struct vattr *vap, int flags, cred_t *cr,
1318                 caller_context_t *ct)
1319 {
1320         int error;
1321         struct vattr va;
1322 
1323         if (vap->va_mask & AT_NOSET)
1324                 return (EINVAL);
1325         if (nfs_zone() != VTOMI(vp)->mi_zone)
1326                 return (EIO);
1327 
1328         va.va_mask = AT_UID | AT_MODE;
1329         error = nfs3getattr(vp, &va, cr);
1330         if (error)
1331                 return (error);
1332 
1333         error = secpolicy_vnode_setattr(cr, vp, vap, &va, flags, nfs3_accessx,
1334             vp);
1335         if (error)
1336                 return (error);
1337 
1338         error = nfs3setattr(vp, vap, flags, cr);
1339 
1340         if (error == 0 && (vap->va_mask & AT_SIZE) && vap->va_size == 0)
1341                 vnevent_truncate(vp, ct);
1342 
1343         return (error);
1344 }
1345 
1346 static int
1347 nfs3setattr(vnode_t *vp, struct vattr *vap, int flags, cred_t *cr)
1348 {
1349         int error;
1350         uint_t mask;
1351         SETATTR3args args;
1352         SETATTR3res res;
1353         int douprintf;
1354         rnode_t *rp;
1355         struct vattr va;
1356         mode_t omode;
1357         vsecattr_t *vsp;
1358         hrtime_t t;
1359 
1360         ASSERT(nfs_zone() == VTOMI(vp)->mi_zone);
1361         mask = vap->va_mask;
1362 
1363         rp = VTOR(vp);
1364 
1365         /*
1366          * Only need to flush pages if there are any pages and
1367          * if the file is marked as dirty in some fashion.  The
1368          * file must be flushed so that we can accurately
1369          * determine the size of the file and the cached data
1370          * after the SETATTR returns.  A file is considered to
1371          * be dirty if it is either marked with RDIRTY, has
1372          * outstanding i/o's active, or is mmap'd.  In this
1373          * last case, we can't tell whether there are dirty
1374          * pages, so we flush just to be sure.
1375          */
1376         if (vn_has_cached_data(vp) &&
1377             ((rp->r_flags & RDIRTY) ||
1378             rp->r_count > 0 ||
1379             rp->r_mapcnt > 0)) {
1380                 ASSERT(vp->v_type != VCHR);
1381                 error = nfs3_putpage(vp, (offset_t)0, 0, 0, cr, NULL);
1382                 if (error && (error == ENOSPC || error == EDQUOT)) {
1383                         mutex_enter(&rp->r_statelock);
1384                         if (!rp->r_error)
1385                                 rp->r_error = error;
1386                         mutex_exit(&rp->r_statelock);
1387                 }
1388         }
1389 
1390         args.object = *RTOFH3(rp);
1391         /*
1392          * If the intent is for the server to set the times,
1393          * there is no point in have the mask indicating set mtime or
1394          * atime, because the vap values may be junk, and so result
1395          * in an overflow error. Remove these flags from the vap mask
1396          * before calling in this case, and restore them afterwards.
1397          */
1398         if ((mask & (AT_ATIME | AT_MTIME)) && !(flags & ATTR_UTIME)) {
1399                 /* Use server times, so don't set the args time fields */
1400                 vap->va_mask &= ~(AT_ATIME | AT_MTIME);
1401                 error = vattr_to_sattr3(vap, &args.new_attributes);
1402                 vap->va_mask |= (mask & (AT_ATIME | AT_MTIME));
1403                 if (mask & AT_ATIME) {
1404                         args.new_attributes.atime.set_it = SET_TO_SERVER_TIME;
1405                 }
1406                 if (mask & AT_MTIME) {
1407                         args.new_attributes.mtime.set_it = SET_TO_SERVER_TIME;
1408                 }
1409         } else {
1410                 /* Either do not set times or use the client specified times */
1411                 error = vattr_to_sattr3(vap, &args.new_attributes);
1412         }
1413 
1414         if (error) {
1415                 /* req time field(s) overflow - return immediately */
1416                 return (error);
1417         }
1418 
1419         va.va_mask = AT_MODE | AT_CTIME;
1420         error = nfs3getattr(vp, &va, cr);
1421         if (error)
1422                 return (error);
1423         omode = va.va_mode;
1424 
1425 tryagain:
1426         if (mask & AT_SIZE) {
1427                 args.guard.check = TRUE;
1428                 args.guard.obj_ctime.seconds = va.va_ctime.tv_sec;
1429                 args.guard.obj_ctime.nseconds = va.va_ctime.tv_nsec;
1430         } else
1431                 args.guard.check = FALSE;
1432 
1433         douprintf = 1;
1434 
1435         t = gethrtime();
1436 
1437         error = rfs3call(VTOMI(vp), NFSPROC3_SETATTR,
1438             xdr_SETATTR3args, (caddr_t)&args,
1439             xdr_SETATTR3res, (caddr_t)&res, cr,
1440             &douprintf, &res.status, 0, NULL);
1441 
1442         /*
1443          * Purge the access cache and ACL cache if changing either the
1444          * owner of the file, the group owner, or the mode.  These may
1445          * change the access permissions of the file, so purge old
1446          * information and start over again.
1447          */
1448         if (mask & (AT_UID | AT_GID | AT_MODE)) {
1449                 (void) nfs_access_purge_rp(rp);
1450                 if (rp->r_secattr != NULL) {
1451                         mutex_enter(&rp->r_statelock);
1452                         vsp = rp->r_secattr;
1453                         rp->r_secattr = NULL;
1454                         mutex_exit(&rp->r_statelock);
1455                         if (vsp != NULL)
1456                                 nfs_acl_free(vsp);
1457                 }
1458         }
1459 
1460         if (error) {
1461                 PURGE_ATTRCACHE(vp);
1462                 return (error);
1463         }
1464 
1465         error = geterrno3(res.status);
1466         if (!error) {
1467                 /*
1468                  * If changing the size of the file, invalidate
1469                  * any local cached data which is no longer part
1470                  * of the file.  We also possibly invalidate the
1471                  * last page in the file.  We could use
1472                  * pvn_vpzero(), but this would mark the page as
1473                  * modified and require it to be written back to
1474                  * the server for no particularly good reason.
1475                  * This way, if we access it, then we bring it
1476                  * back in.  A read should be cheaper than a
1477                  * write.
1478                  */
1479                 if (mask & AT_SIZE) {
1480                         nfs_invalidate_pages(vp,
1481                             (vap->va_size & PAGEMASK), cr);
1482                 }
1483                 nfs3_cache_wcc_data(vp, &res.resok.obj_wcc, t, cr);
1484                 /*
1485                  * Some servers will change the mode to clear the setuid
1486                  * and setgid bits when changing the uid or gid.  The
1487                  * client needs to compensate appropriately.
1488                  */
1489                 if (mask & (AT_UID | AT_GID)) {
1490                         int terror;
1491 
1492                         va.va_mask = AT_MODE;
1493                         terror = nfs3getattr(vp, &va, cr);
1494                         if (!terror &&
1495                             (((mask & AT_MODE) && va.va_mode != vap->va_mode) ||
1496                             (!(mask & AT_MODE) && va.va_mode != omode))) {
1497                                 va.va_mask = AT_MODE;
1498                                 if (mask & AT_MODE)
1499                                         va.va_mode = vap->va_mode;
1500                                 else
1501                                         va.va_mode = omode;
1502                                 (void) nfs3setattr(vp, &va, 0, cr);
1503                         }
1504                 }
1505         } else {
1506                 nfs3_cache_wcc_data(vp, &res.resfail.obj_wcc, t, cr);
1507                 /*
1508                  * If we got back a "not synchronized" error, then
1509                  * we need to retry with a new guard value.  The
1510                  * guard value used is the change time.  If the
1511                  * server returned post_op_attr, then we can just
1512                  * retry because we have the latest attributes.
1513                  * Otherwise, we issue a GETATTR to get the latest
1514                  * attributes and then retry.  If we couldn't get
1515                  * the attributes this way either, then we give
1516                  * up because we can't complete the operation as
1517                  * required.
1518                  */
1519                 if (res.status == NFS3ERR_NOT_SYNC) {
1520                         va.va_mask = AT_CTIME;
1521                         if (nfs3getattr(vp, &va, cr) == 0)
1522                                 goto tryagain;
1523                 }
1524                 PURGE_STALE_FH(error, vp, cr);
1525         }
1526 
1527         return (error);
1528 }
1529 
1530 static int
1531 nfs3_accessx(void *vp, int mode, cred_t *cr)
1532 {
1533         ASSERT(nfs_zone() == VTOMI((vnode_t *)vp)->mi_zone);
1534         return (nfs3_access(vp, mode, 0, cr, NULL));
1535 }
1536 
1537 /* ARGSUSED */
1538 static int
1539 nfs3_access(vnode_t *vp, int mode, int flags, cred_t *cr, caller_context_t *ct)
1540 {
1541         int error;
1542         ACCESS3args args;
1543         ACCESS3res res;
1544         int douprintf;
1545         uint32 acc;
1546         rnode_t *rp;
1547         cred_t *cred, *ncr, *ncrfree = NULL;
1548         failinfo_t fi;
1549         nfs_access_type_t cacc;
1550         hrtime_t t;
1551 
1552         acc = 0;
1553         if (nfs_zone() != VTOMI(vp)->mi_zone)
1554                 return (EIO);
1555         if (mode & VREAD)
1556                 acc |= ACCESS3_READ;
1557         if (mode & VWRITE) {
1558                 if (vn_is_readonly(vp) && !IS_DEVVP(vp))
1559                         return (EROFS);
1560                 if (vp->v_type == VDIR)
1561                         acc |= ACCESS3_DELETE;
1562                 acc |= ACCESS3_MODIFY | ACCESS3_EXTEND;
1563         }
1564         if (mode & VEXEC) {
1565                 if (vp->v_type == VDIR)
1566                         acc |= ACCESS3_LOOKUP;
1567                 else
1568                         acc |= ACCESS3_EXECUTE;
1569         }
1570 
1571         rp = VTOR(vp);
1572         args.object = *VTOFH3(vp);
1573         if (vp->v_type == VDIR) {
1574                 args.access = ACCESS3_READ | ACCESS3_DELETE | ACCESS3_MODIFY |
1575                     ACCESS3_EXTEND | ACCESS3_LOOKUP;
1576         } else {
1577                 args.access = ACCESS3_READ | ACCESS3_MODIFY | ACCESS3_EXTEND |
1578                     ACCESS3_EXECUTE;
1579         }
1580         fi.vp = vp;
1581         fi.fhp = (caddr_t)&args.object;
1582         fi.copyproc = nfs3copyfh;
1583         fi.lookupproc = nfs3lookup;
1584         fi.xattrdirproc = acl_getxattrdir3;
1585 
1586         cred = cr;
1587         /*
1588          * ncr and ncrfree both initially
1589          * point to the memory area returned
1590          * by crnetadjust();
1591          * ncrfree not NULL when exiting means
1592          * that we need to release it
1593          */
1594         ncr = crnetadjust(cred);
1595         ncrfree = ncr;
1596 tryagain:
1597         if (rp->r_acache != NULL) {
1598                 cacc = nfs_access_check(rp, acc, cred);
1599                 if (cacc == NFS_ACCESS_ALLOWED) {
1600                         if (ncrfree != NULL)
1601                                 crfree(ncrfree);
1602                         return (0);
1603                 }
1604                 if (cacc == NFS_ACCESS_DENIED) {
1605                         /*
1606                          * If the cred can be adjusted, try again
1607                          * with the new cred.
1608                          */
1609                         if (ncr != NULL) {
1610                                 cred = ncr;
1611                                 ncr = NULL;
1612                                 goto tryagain;
1613                         }
1614                         if (ncrfree != NULL)
1615                                 crfree(ncrfree);
1616                         return (EACCES);
1617                 }
1618         }
1619 
1620         douprintf = 1;
1621 
1622         t = gethrtime();
1623 
1624         error = rfs3call(VTOMI(vp), NFSPROC3_ACCESS,
1625             xdr_ACCESS3args, (caddr_t)&args,
1626             xdr_ACCESS3res, (caddr_t)&res, cred,
1627             &douprintf, &res.status, 0, &fi);
1628 
1629         if (error) {
1630                 if (ncrfree != NULL)
1631                         crfree(ncrfree);
1632                 return (error);
1633         }
1634 
1635         error = geterrno3(res.status);
1636         if (!error) {
1637                 nfs3_cache_post_op_attr(vp, &res.resok.obj_attributes, t, cr);
1638                 nfs_access_cache(rp, args.access, res.resok.access, cred);
1639                 /*
1640                  * we just cached results with cred; if cred is the
1641                  * adjusted credentials from crnetadjust, we do not want
1642                  * to release them before exiting: hence setting ncrfree
1643                  * to NULL
1644                  */
1645                 if (cred != cr)
1646                         ncrfree = NULL;
1647                 if ((acc & res.resok.access) != acc) {
1648                         /*
1649                          * If the cred can be adjusted, try again
1650                          * with the new cred.
1651                          */
1652                         if (ncr != NULL) {
1653                                 cred = ncr;
1654                                 ncr = NULL;
1655                                 goto tryagain;
1656                         }
1657                         error = EACCES;
1658                 }
1659         } else {
1660                 nfs3_cache_post_op_attr(vp, &res.resfail.obj_attributes, t, cr);
1661                 PURGE_STALE_FH(error, vp, cr);
1662         }
1663 
1664         if (ncrfree != NULL)
1665                 crfree(ncrfree);
1666 
1667         return (error);
1668 }
1669 
1670 volatile int nfs3_do_symlink_cache = 1;
1671 
1672 /* ARGSUSED */
1673 static int
1674 nfs3_readlink(vnode_t *vp, struct uio *uiop, cred_t *cr, caller_context_t *ct)
1675 {
1676         int error;
1677         READLINK3args args;
1678         READLINK3res res;
1679         nfspath3 resdata_backup;
1680         rnode_t *rp;
1681         int douprintf;
1682         int len;
1683         failinfo_t fi;
1684         hrtime_t t;
1685 
1686         /*
1687          * Can't readlink anything other than a symbolic link.
1688          */
1689         if (vp->v_type != VLNK)
1690                 return (EINVAL);
1691         if (nfs_zone() != VTOMI(vp)->mi_zone)
1692                 return (EIO);
1693 
1694         rp = VTOR(vp);
1695         if (nfs3_do_symlink_cache && rp->r_symlink.contents != NULL) {
1696                 error = nfs3_validate_caches(vp, cr);
1697                 if (error)
1698                         return (error);
1699                 mutex_enter(&rp->r_statelock);
1700                 if (rp->r_symlink.contents != NULL) {
1701                         error = uiomove(rp->r_symlink.contents,
1702                             rp->r_symlink.len, UIO_READ, uiop);
1703                         mutex_exit(&rp->r_statelock);
1704                         return (error);
1705                 }
1706                 mutex_exit(&rp->r_statelock);
1707         }
1708 
1709         args.symlink = *VTOFH3(vp);
1710         fi.vp = vp;
1711         fi.fhp = (caddr_t)&args.symlink;
1712         fi.copyproc = nfs3copyfh;
1713         fi.lookupproc = nfs3lookup;
1714         fi.xattrdirproc = acl_getxattrdir3;
1715 
1716         res.resok.data = kmem_alloc(MAXPATHLEN, KM_SLEEP);
1717 
1718         resdata_backup = res.resok.data;
1719 
1720         douprintf = 1;
1721 
1722         t = gethrtime();
1723 
1724         error = rfs3call(VTOMI(vp), NFSPROC3_READLINK,
1725             xdr_READLINK3args, (caddr_t)&args,
1726             xdr_READLINK3res, (caddr_t)&res, cr,
1727             &douprintf, &res.status, 0, &fi);
1728 
1729         if (res.resok.data == nfs3nametoolong)
1730                 error = EINVAL;
1731 
1732         if (error) {
1733                 kmem_free(resdata_backup, MAXPATHLEN);
1734                 return (error);
1735         }
1736 
1737         error = geterrno3(res.status);
1738         if (!error) {
1739                 nfs3_cache_post_op_attr(vp, &res.resok.symlink_attributes, t,
1740                     cr);
1741                 len = strlen(res.resok.data);
1742                 error = uiomove(res.resok.data, len, UIO_READ, uiop);
1743                 if (nfs3_do_symlink_cache && rp->r_symlink.contents == NULL) {
1744                         mutex_enter(&rp->r_statelock);
1745                                 if (rp->r_symlink.contents == NULL) {
1746                                 rp->r_symlink.contents = res.resok.data;
1747                                 rp->r_symlink.len = len;
1748                                 rp->r_symlink.size = MAXPATHLEN;
1749                                 mutex_exit(&rp->r_statelock);
1750                         } else {
1751                                 mutex_exit(&rp->r_statelock);
1752 
1753                                 kmem_free((void *)res.resok.data, MAXPATHLEN);
1754                         }
1755                 } else {
1756                         kmem_free((void *)res.resok.data, MAXPATHLEN);
1757                 }
1758         } else {
1759                 nfs3_cache_post_op_attr(vp,
1760                     &res.resfail.symlink_attributes, t, cr);
1761                 PURGE_STALE_FH(error, vp, cr);
1762 
1763                 kmem_free((void *)res.resok.data, MAXPATHLEN);
1764 
1765         }
1766 
1767         /*
1768          * The over the wire error for attempting to readlink something
1769          * other than a symbolic link is ENXIO.  However, we need to
1770          * return EINVAL instead of ENXIO, so we map it here.
1771          */
1772         return (error == ENXIO ? EINVAL : error);
1773 }
1774 
1775 /*
1776  * Flush local dirty pages to stable storage on the server.
1777  *
1778  * If FNODSYNC is specified, then there is nothing to do because
1779  * metadata changes are not cached on the client before being
1780  * sent to the server.
1781  */
1782 /* ARGSUSED */
1783 static int
1784 nfs3_fsync(vnode_t *vp, int syncflag, cred_t *cr, caller_context_t *ct)
1785 {
1786         int error;
1787 
1788         if ((syncflag & FNODSYNC) || IS_SWAPVP(vp))
1789                 return (0);
1790         if (nfs_zone() != VTOMI(vp)->mi_zone)
1791                 return (EIO);
1792 
1793         error = nfs3_putpage_commit(vp, (offset_t)0, 0, cr);
1794         if (!error)
1795                 error = VTOR(vp)->r_error;
1796         return (error);
1797 }
1798 
1799 /*
1800  * Weirdness: if the file was removed or the target of a rename
1801  * operation while it was open, it got renamed instead.  Here we
1802  * remove the renamed file.
1803  */
1804 /* ARGSUSED */
1805 static void
1806 nfs3_inactive(vnode_t *vp, cred_t *cr, caller_context_t *ct)
1807 {
1808         rnode_t *rp;
1809 
1810         ASSERT(vp != DNLC_NO_VNODE);
1811 
1812         /*
1813          * If this is coming from the wrong zone, we let someone in the right
1814          * zone take care of it asynchronously.  We can get here due to
1815          * VN_RELE() being called from pageout() or fsflush().  This call may
1816          * potentially turn into an expensive no-op if, for instance, v_count
1817          * gets incremented in the meantime, but it's still correct.
1818          */
1819         if (nfs_zone() != VTOMI(vp)->mi_zone) {
1820                 nfs_async_inactive(vp, cr, nfs3_inactive);
1821                 return;
1822         }
1823 
1824         rp = VTOR(vp);
1825 redo:
1826         if (rp->r_unldvp != NULL) {
1827                 /*
1828                  * Save the vnode pointer for the directory where the
1829                  * unlinked-open file got renamed, then set it to NULL
1830                  * to prevent another thread from getting here before
1831                  * we're done with the remove.  While we have the
1832                  * statelock, make local copies of the pertinent rnode
1833                  * fields.  If we weren't to do this in an atomic way, the
1834                  * the unl* fields could become inconsistent with respect
1835                  * to each other due to a race condition between this
1836                  * code and nfs_remove().  See bug report 1034328.
1837                  */
1838                 mutex_enter(&rp->r_statelock);
1839                 if (rp->r_unldvp != NULL) {
1840                         vnode_t *unldvp;
1841                         char *unlname;
1842                         cred_t *unlcred;
1843                         REMOVE3args args;
1844                         REMOVE3res res;
1845                         int douprintf;
1846                         int error;
1847                         hrtime_t t;
1848 
1849                         unldvp = rp->r_unldvp;
1850                         rp->r_unldvp = NULL;
1851                         unlname = rp->r_unlname;
1852                         rp->r_unlname = NULL;
1853                         unlcred = rp->r_unlcred;
1854                         rp->r_unlcred = NULL;
1855                         mutex_exit(&rp->r_statelock);
1856 
1857                         /*
1858                          * If there are any dirty pages left, then flush
1859                          * them.  This is unfortunate because they just
1860                          * may get thrown away during the remove operation,
1861                          * but we have to do this for correctness.
1862                          */
1863                         if (vn_has_cached_data(vp) &&
1864                             ((rp->r_flags & RDIRTY) || rp->r_count > 0)) {
1865                                 ASSERT(vp->v_type != VCHR);
1866                                 error = nfs3_putpage(vp, (offset_t)0, 0, 0,
1867                                     cr, ct);
1868                                 if (error) {
1869                                         mutex_enter(&rp->r_statelock);
1870                                         if (!rp->r_error)
1871                                                 rp->r_error = error;
1872                                         mutex_exit(&rp->r_statelock);
1873                                 }
1874                         }
1875 
1876                         /*
1877                          * Do the remove operation on the renamed file
1878                          */
1879                         setdiropargs3(&args.object, unlname, unldvp);
1880 
1881                         douprintf = 1;
1882 
1883                         t = gethrtime();
1884 
1885                         error = rfs3call(VTOMI(unldvp), NFSPROC3_REMOVE,
1886                             xdr_diropargs3, (caddr_t)&args,
1887                             xdr_REMOVE3res, (caddr_t)&res, unlcred,
1888                             &douprintf, &res.status, 0, NULL);
1889 
1890                         if (error) {
1891                                 PURGE_ATTRCACHE(unldvp);
1892                         } else {
1893                                 error = geterrno3(res.status);
1894                                 if (!error) {
1895                                         nfs3_cache_wcc_data(unldvp,
1896                                             &res.resok.dir_wcc, t, cr);
1897                                         if (HAVE_RDDIR_CACHE(VTOR(unldvp)))
1898                                                 nfs_purge_rddir_cache(unldvp);
1899                                 } else {
1900                                         nfs3_cache_wcc_data(unldvp,
1901                                             &res.resfail.dir_wcc, t, cr);
1902                                         PURGE_STALE_FH(error, unldvp, cr);
1903                                 }
1904                         }
1905 
1906                         /*
1907                          * Release stuff held for the remove
1908                          */
1909                         VN_RELE(unldvp);
1910                         kmem_free(unlname, MAXNAMELEN);
1911                         crfree(unlcred);
1912                         goto redo;
1913                 }
1914                 mutex_exit(&rp->r_statelock);
1915         }
1916 
1917         rp_addfree(rp, cr);
1918 }
1919 
1920 /*
1921  * Remote file system operations having to do with directory manipulation.
1922  */
1923 
1924 /* ARGSUSED */
1925 static int
1926 nfs3_lookup(vnode_t *dvp, char *nm, vnode_t **vpp, struct pathname *pnp,
1927         int flags, vnode_t *rdir, cred_t *cr, caller_context_t *ct,
1928         int *direntflags, pathname_t *realpnp)
1929 {
1930         int error;
1931         vnode_t *vp;
1932         vnode_t *avp = NULL;
1933         rnode_t *drp;
1934 
1935         if (nfs_zone() != VTOMI(dvp)->mi_zone)
1936                 return (EPERM);
1937 
1938         drp = VTOR(dvp);
1939 
1940         /*
1941          * Are we looking up extended attributes?  If so, "dvp" is
1942          * the file or directory for which we want attributes, and
1943          * we need a lookup of the hidden attribute directory
1944          * before we lookup the rest of the path.
1945          */
1946         if (flags & LOOKUP_XATTR) {
1947                 bool_t cflag = ((flags & CREATE_XATTR_DIR) != 0);
1948                 mntinfo_t *mi;
1949 
1950                 mi = VTOMI(dvp);
1951                 if (!(mi->mi_flags & MI_EXTATTR))
1952                         return (EINVAL);
1953 
1954                 if (nfs_rw_enter_sig(&drp->r_rwlock, RW_READER, INTR(dvp)))
1955                         return (EINTR);
1956 
1957                 (void) nfs3lookup_dnlc(dvp, XATTR_DIR_NAME, &avp, cr);
1958                 if (avp == NULL)
1959                         error = acl_getxattrdir3(dvp, &avp, cflag, cr, 0);
1960                 else
1961                         error = 0;
1962 
1963                 nfs_rw_exit(&drp->r_rwlock);
1964 
1965                 if (error) {
1966                         if (mi->mi_flags & MI_EXTATTR)
1967                                 return (error);
1968                         return (EINVAL);
1969                 }
1970                 dvp = avp;
1971                 drp = VTOR(dvp);
1972         }
1973 
1974         if (nfs_rw_enter_sig(&drp->r_rwlock, RW_READER, INTR(dvp))) {
1975                 error = EINTR;
1976                 goto out;
1977         }
1978 
1979         error = nfs3lookup(dvp, nm, vpp, pnp, flags, rdir, cr, 0);
1980 
1981         nfs_rw_exit(&drp->r_rwlock);
1982 
1983         /*
1984          * If vnode is a device, create special vnode.
1985          */
1986         if (!error && IS_DEVVP(*vpp)) {
1987                 vp = *vpp;
1988                 *vpp = specvp(vp, vp->v_rdev, vp->v_type, cr);
1989                 VN_RELE(vp);
1990         }
1991 
1992 out:
1993         if (avp != NULL)
1994                 VN_RELE(avp);
1995 
1996         return (error);
1997 }
1998 
1999 volatile int nfs3_lookup_neg_cache = 1;
2000 
2001 #ifdef DEBUG
2002 static int nfs3_lookup_dnlc_hits = 0;
2003 static int nfs3_lookup_dnlc_misses = 0;
2004 static int nfs3_lookup_dnlc_neg_hits = 0;
2005 static int nfs3_lookup_dnlc_disappears = 0;
2006 static int nfs3_lookup_dnlc_lookups = 0;
2007 #endif
2008 
2009 /* ARGSUSED */
2010 int
2011 nfs3lookup(vnode_t *dvp, char *nm, vnode_t **vpp, struct pathname *pnp,
2012         int flags, vnode_t *rdir, cred_t *cr, int rfscall_flags)
2013 {
2014         int error;
2015         rnode_t *drp;
2016 
2017         ASSERT(nfs_zone() == VTOMI(dvp)->mi_zone);
2018         /*
2019          * If lookup is for "", just return dvp.  Don't need
2020          * to send it over the wire, look it up in the dnlc,
2021          * or perform any access checks.
2022          */
2023         if (*nm == '\0') {
2024                 VN_HOLD(dvp);
2025                 *vpp = dvp;
2026                 return (0);
2027         }
2028 
2029         /*
2030          * Can't do lookups in non-directories.
2031          */
2032         if (dvp->v_type != VDIR)
2033                 return (ENOTDIR);
2034 
2035         /*
2036          * If we're called with RFSCALL_SOFT, it's important that
2037          * the only rfscall is one we make directly; if we permit
2038          * an access call because we're looking up "." or validating
2039          * a dnlc hit, we'll deadlock because that rfscall will not
2040          * have the RFSCALL_SOFT set.
2041          */
2042         if (rfscall_flags & RFSCALL_SOFT)
2043                 goto callit;
2044 
2045         /*
2046          * If lookup is for ".", just return dvp.  Don't need
2047          * to send it over the wire or look it up in the dnlc,
2048          * just need to check access.
2049          */
2050         if (strcmp(nm, ".") == 0) {
2051                 error = nfs3_access(dvp, VEXEC, 0, cr, NULL);
2052                 if (error)
2053                         return (error);
2054                 VN_HOLD(dvp);
2055                 *vpp = dvp;
2056                 return (0);
2057         }
2058 
2059         drp = VTOR(dvp);
2060         if (!(drp->r_flags & RLOOKUP)) {
2061                 mutex_enter(&drp->r_statelock);
2062                 drp->r_flags |= RLOOKUP;
2063                 mutex_exit(&drp->r_statelock);
2064         }
2065 
2066         /*
2067          * Lookup this name in the DNLC.  If there was a valid entry,
2068          * then return the results of the lookup.
2069          */
2070         error = nfs3lookup_dnlc(dvp, nm, vpp, cr);
2071         if (error || *vpp != NULL)
2072                 return (error);
2073 
2074 callit:
2075         error = nfs3lookup_otw(dvp, nm, vpp, cr, rfscall_flags);
2076 
2077         return (error);
2078 }
2079 
2080 static int
2081 nfs3lookup_dnlc(vnode_t *dvp, char *nm, vnode_t **vpp, cred_t *cr)
2082 {
2083         int error;
2084         vnode_t *vp;
2085 
2086         ASSERT(*nm != '\0');
2087         ASSERT(nfs_zone() == VTOMI(dvp)->mi_zone);
2088         /*
2089          * Lookup this name in the DNLC.  If successful, then validate
2090          * the caches and then recheck the DNLC.  The DNLC is rechecked
2091          * just in case this entry got invalidated during the call
2092          * to nfs3_validate_caches.
2093          *
2094          * An assumption is being made that it is safe to say that a
2095          * file exists which may not on the server.  Any operations to
2096          * the server will fail with ESTALE.
2097          */
2098 #ifdef DEBUG
2099         nfs3_lookup_dnlc_lookups++;
2100 #endif
2101         vp = dnlc_lookup(dvp, nm);
2102         if (vp != NULL) {
2103                 VN_RELE(vp);
2104                 if (vp == DNLC_NO_VNODE && !vn_is_readonly(dvp)) {
2105                         PURGE_ATTRCACHE(dvp);
2106                 }
2107                 error = nfs3_validate_caches(dvp, cr);
2108                 if (error)
2109                         return (error);
2110                 vp = dnlc_lookup(dvp, nm);
2111                 if (vp != NULL) {
2112                         error = nfs3_access(dvp, VEXEC, 0, cr, NULL);
2113                         if (error) {
2114                                 VN_RELE(vp);
2115                                 return (error);
2116                         }
2117                         if (vp == DNLC_NO_VNODE) {
2118                                 VN_RELE(vp);
2119 #ifdef DEBUG
2120                                 nfs3_lookup_dnlc_neg_hits++;
2121 #endif
2122                                 return (ENOENT);
2123                         }
2124                         *vpp = vp;
2125 #ifdef DEBUG
2126                         nfs3_lookup_dnlc_hits++;
2127 #endif
2128                         return (0);
2129                 }
2130 #ifdef DEBUG
2131                 nfs3_lookup_dnlc_disappears++;
2132 #endif
2133         }
2134 #ifdef DEBUG
2135         else
2136                 nfs3_lookup_dnlc_misses++;
2137 #endif
2138 
2139         *vpp = NULL;
2140 
2141         return (0);
2142 }
2143 
2144 static int
2145 nfs3lookup_otw(vnode_t *dvp, char *nm, vnode_t **vpp, cred_t *cr,
2146         int rfscall_flags)
2147 {
2148         int error;
2149         LOOKUP3args args;
2150         LOOKUP3vres res;
2151         int douprintf;
2152         struct vattr vattr;
2153         struct vattr dvattr;
2154         vnode_t *vp;
2155         failinfo_t fi;
2156         hrtime_t t;
2157 
2158         ASSERT(*nm != '\0');
2159         ASSERT(dvp->v_type == VDIR);
2160         ASSERT(nfs_zone() == VTOMI(dvp)->mi_zone);
2161 
2162         setdiropargs3(&args.what, nm, dvp);
2163 
2164         fi.vp = dvp;
2165         fi.fhp = (caddr_t)&args.what.dir;
2166         fi.copyproc = nfs3copyfh;
2167         fi.lookupproc = nfs3lookup;
2168         fi.xattrdirproc = acl_getxattrdir3;
2169         res.obj_attributes.fres.vp = dvp;
2170         res.obj_attributes.fres.vap = &vattr;
2171         res.dir_attributes.fres.vp = dvp;
2172         res.dir_attributes.fres.vap = &dvattr;
2173 
2174         douprintf = 1;
2175 
2176         t = gethrtime();
2177 
2178         error = rfs3call(VTOMI(dvp), NFSPROC3_LOOKUP,
2179             xdr_diropargs3, (caddr_t)&args,
2180             xdr_LOOKUP3vres, (caddr_t)&res, cr,
2181             &douprintf, &res.status, rfscall_flags, &fi);
2182 
2183         if (error)
2184                 return (error);
2185 
2186         nfs3_cache_post_op_vattr(dvp, &res.dir_attributes, t, cr);
2187 
2188         error = geterrno3(res.status);
2189         if (error) {
2190                 PURGE_STALE_FH(error, dvp, cr);
2191                 if (error == ENOENT && nfs3_lookup_neg_cache)
2192                         dnlc_enter(dvp, nm, DNLC_NO_VNODE);
2193                 return (error);
2194         }
2195 
2196         if (res.obj_attributes.attributes) {
2197                 vp = makenfs3node_va(&res.object, res.obj_attributes.fres.vap,
2198                     dvp->v_vfsp, t, cr, VTOR(dvp)->r_path, nm);
2199         } else {
2200                 vp = makenfs3node_va(&res.object, NULL,
2201                     dvp->v_vfsp, t, cr, VTOR(dvp)->r_path, nm);
2202                 if (vp->v_type == VNON) {
2203                         vattr.va_mask = AT_TYPE;
2204                         error = nfs3getattr(vp, &vattr, cr);
2205                         if (error) {
2206                                 VN_RELE(vp);
2207                                 return (error);
2208                         }
2209                         vp->v_type = vattr.va_type;
2210                 }
2211         }
2212 
2213         if (!(rfscall_flags & RFSCALL_SOFT))
2214                 dnlc_update(dvp, nm, vp);
2215 
2216         *vpp = vp;
2217 
2218         return (error);
2219 }
2220 
2221 #ifdef DEBUG
2222 static int nfs3_create_misses = 0;
2223 #endif
2224 
2225 /* ARGSUSED */
2226 static int
2227 nfs3_create(vnode_t *dvp, char *nm, struct vattr *va, enum vcexcl exclusive,
2228         int mode, vnode_t **vpp, cred_t *cr, int lfaware, caller_context_t *ct,
2229         vsecattr_t *vsecp)
2230 {
2231         int error;
2232         vnode_t *vp;
2233         rnode_t *rp;
2234         struct vattr vattr;
2235         rnode_t *drp;
2236         vnode_t *tempvp;
2237 
2238         drp = VTOR(dvp);
2239         if (nfs_zone() != VTOMI(dvp)->mi_zone)
2240                 return (EPERM);
2241         if (nfs_rw_enter_sig(&drp->r_rwlock, RW_WRITER, INTR(dvp)))
2242                 return (EINTR);
2243 
2244 top:
2245         /*
2246          * We make a copy of the attributes because the caller does not
2247          * expect us to change what va points to.
2248          */
2249         vattr = *va;
2250 
2251         /*
2252          * If the pathname is "", just use dvp.  Don't need
2253          * to send it over the wire, look it up in the dnlc,
2254          * or perform any access checks.
2255          */
2256         if (*nm == '\0') {
2257                 error = 0;
2258                 VN_HOLD(dvp);
2259                 vp = dvp;
2260         /*
2261          * If the pathname is ".", just use dvp.  Don't need
2262          * to send it over the wire or look it up in the dnlc,
2263          * just need to check access.
2264          */
2265         } else if (strcmp(nm, ".") == 0) {
2266                 error = nfs3_access(dvp, VEXEC, 0, cr, ct);
2267                 if (error) {
2268                         nfs_rw_exit(&drp->r_rwlock);
2269                         return (error);
2270                 }
2271                 VN_HOLD(dvp);
2272                 vp = dvp;
2273         /*
2274          * We need to go over the wire, just to be sure whether the
2275          * file exists or not.  Using the DNLC can be dangerous in
2276          * this case when making a decision regarding existence.
2277          */
2278         } else {
2279                 error = nfs3lookup_otw(dvp, nm, &vp, cr, 0);
2280         }
2281         if (!error) {
2282                 if (exclusive == EXCL)
2283                         error = EEXIST;
2284                 else if (vp->v_type == VDIR && (mode & VWRITE))
2285                         error = EISDIR;
2286                 else {
2287                         /*
2288                          * If vnode is a device, create special vnode.
2289                          */
2290                         if (IS_DEVVP(vp)) {
2291                                 tempvp = vp;
2292                                 vp = specvp(vp, vp->v_rdev, vp->v_type, cr);
2293                                 VN_RELE(tempvp);
2294                         }
2295                         if (!(error = VOP_ACCESS(vp, mode, 0, cr, ct))) {
2296                                 if ((vattr.va_mask & AT_SIZE) &&
2297                                     vp->v_type == VREG) {
2298                                         rp = VTOR(vp);
2299                                         /*
2300                                          * Check here for large file handled
2301                                          * by LF-unaware process (as
2302                                          * ufs_create() does)
2303                                          */
2304                                         if (!(lfaware & FOFFMAX)) {
2305                                                 mutex_enter(&rp->r_statelock);
2306                                                 if (rp->r_size > MAXOFF32_T)
2307                                                         error = EOVERFLOW;
2308                                                 mutex_exit(&rp->r_statelock);
2309                                         }
2310                                         if (!error) {
2311                                                 vattr.va_mask = AT_SIZE;
2312                                                 error = nfs3setattr(vp,
2313                                                     &vattr, 0, cr);
2314 
2315                                                 /*
2316                                                  * Existing file was truncated;
2317                                                  * emit a create event.
2318                                                  */
2319                                                 vnevent_create(vp, ct);
2320                                         }
2321                                 }
2322                         }
2323                 }
2324                 nfs_rw_exit(&drp->r_rwlock);
2325                 if (error) {
2326                         VN_RELE(vp);
2327                 } else {
2328                         *vpp = vp;
2329                 }
2330 
2331                 return (error);
2332         }
2333 
2334         dnlc_remove(dvp, nm);
2335 
2336         /*
2337          * Decide what the group-id of the created file should be.
2338          * Set it in attribute list as advisory...
2339          */
2340         error = setdirgid(dvp, &vattr.va_gid, cr);
2341         if (error) {
2342                 nfs_rw_exit(&drp->r_rwlock);
2343                 return (error);
2344         }
2345         vattr.va_mask |= AT_GID;
2346 
2347         ASSERT(vattr.va_mask & AT_TYPE);
2348         if (vattr.va_type == VREG) {
2349                 ASSERT(vattr.va_mask & AT_MODE);
2350                 if (MANDMODE(vattr.va_mode)) {
2351                         nfs_rw_exit(&drp->r_rwlock);
2352                         return (EACCES);
2353                 }
2354                 error = nfs3create(dvp, nm, &vattr, exclusive, mode, vpp, cr,
2355                     lfaware);
2356                 /*
2357                  * If this is not an exclusive create, then the CREATE
2358                  * request will be made with the GUARDED mode set.  This
2359                  * means that the server will return EEXIST if the file
2360                  * exists.  The file could exist because of a retransmitted
2361                  * request.  In this case, we recover by starting over and
2362                  * checking to see whether the file exists.  This second
2363                  * time through it should and a CREATE request will not be
2364                  * sent.
2365                  *
2366                  * This handles the problem of a dangling CREATE request
2367                  * which contains attributes which indicate that the file
2368                  * should be truncated.  This retransmitted request could
2369                  * possibly truncate valid data in the file if not caught
2370                  * by the duplicate request mechanism on the server or if
2371                  * not caught by other means.  The scenario is:
2372                  *
2373                  * Client transmits CREATE request with size = 0
2374                  * Client times out, retransmits request.
2375                  * Response to the first request arrives from the server
2376                  *  and the client proceeds on.
2377                  * Client writes data to the file.
2378                  * The server now processes retransmitted CREATE request
2379                  *  and truncates file.
2380                  *
2381                  * The use of the GUARDED CREATE request prevents this from
2382                  * happening because the retransmitted CREATE would fail
2383                  * with EEXIST and would not truncate the file.
2384                  */
2385                 if (error == EEXIST && exclusive == NONEXCL) {
2386 #ifdef DEBUG
2387                         nfs3_create_misses++;
2388 #endif
2389                         goto top;
2390                 }
2391                 nfs_rw_exit(&drp->r_rwlock);
2392                 return (error);
2393         }
2394         error = nfs3mknod(dvp, nm, &vattr, exclusive, mode, vpp, cr);
2395         nfs_rw_exit(&drp->r_rwlock);
2396         return (error);
2397 }
2398 
2399 /* ARGSUSED */
2400 static int
2401 nfs3create(vnode_t *dvp, char *nm, struct vattr *va, enum vcexcl exclusive,
2402         int mode, vnode_t **vpp, cred_t *cr, int lfaware)
2403 {
2404         int error;
2405         CREATE3args args;
2406         CREATE3res res;
2407         int douprintf;
2408         vnode_t *vp;
2409         struct vattr vattr;
2410         nfstime3 *verfp;
2411         rnode_t *rp;
2412         timestruc_t now;
2413         hrtime_t t;
2414 
2415         ASSERT(nfs_zone() == VTOMI(dvp)->mi_zone);
2416         setdiropargs3(&args.where, nm, dvp);
2417         if (exclusive == EXCL) {
2418                 args.how.mode = EXCLUSIVE;
2419                 /*
2420                  * Construct the create verifier.  This verifier needs
2421                  * to be unique between different clients.  It also needs
2422                  * to vary for each exclusive create request generated
2423                  * from the client to the server.
2424                  *
2425                  * The first attempt is made to use the hostid and a
2426                  * unique number on the client.  If the hostid has not
2427                  * been set, the high resolution time that the exclusive
2428                  * create request is being made is used.  This will work
2429                  * unless two different clients, both with the hostid
2430                  * not set, attempt an exclusive create request on the
2431                  * same file, at exactly the same clock time.  The
2432                  * chances of this happening seem small enough to be
2433                  * reasonable.
2434                  */
2435                 verfp = (nfstime3 *)&args.how.createhow3_u.verf;
2436                 verfp->seconds = zone_get_hostid(NULL);
2437                 if (verfp->seconds != 0)
2438                         verfp->nseconds = newnum();
2439                 else {
2440                         gethrestime(&now);
2441                         verfp->seconds = now.tv_sec;
2442                         verfp->nseconds = now.tv_nsec;
2443                 }
2444                 /*
2445                  * Since the server will use this value for the mtime,
2446                  * make sure that it can't overflow. Zero out the MSB.
2447                  * The actual value does not matter here, only its uniqeness.
2448                  */
2449                 verfp->seconds %= INT32_MAX;
2450         } else {
2451                 /*
2452                  * Issue the non-exclusive create in guarded mode.  This
2453                  * may result in some false EEXIST responses for
2454                  * retransmitted requests, but these will be handled at
2455                  * a higher level.  By using GUARDED, duplicate requests
2456                  * to do file truncation and possible access problems
2457                  * can be avoided.
2458                  */
2459                 args.how.mode = GUARDED;
2460                 error = vattr_to_sattr3(va,
2461                     &args.how.createhow3_u.obj_attributes);
2462                 if (error) {
2463                         /* req time field(s) overflow - return immediately */
2464                         return (error);
2465                 }
2466         }
2467 
2468         douprintf = 1;
2469 
2470         t = gethrtime();
2471 
2472         error = rfs3call(VTOMI(dvp), NFSPROC3_CREATE,
2473             xdr_CREATE3args, (caddr_t)&args,
2474             xdr_CREATE3res, (caddr_t)&res, cr,
2475             &douprintf, &res.status, 0, NULL);
2476 
2477         if (error) {
2478                 PURGE_ATTRCACHE(dvp);
2479                 return (error);
2480         }
2481 
2482         error = geterrno3(res.status);
2483         if (!error) {
2484                 nfs3_cache_wcc_data(dvp, &res.resok.dir_wcc, t, cr);
2485                 if (HAVE_RDDIR_CACHE(VTOR(dvp)))
2486                         nfs_purge_rddir_cache(dvp);
2487 
2488                 /*
2489                  * On exclusive create the times need to be explicitly
2490                  * set to clear any potential verifier that may be stored
2491                  * in one of these fields (see comment below).  This
2492                  * is done here to cover the case where no post op attrs
2493                  * were returned or a 'invalid' time was returned in
2494                  * the attributes.
2495                  */
2496                 if (exclusive == EXCL)
2497                         va->va_mask |= (AT_MTIME | AT_ATIME);
2498 
2499                 if (!res.resok.obj.handle_follows) {
2500                         error = nfs3lookup(dvp, nm, &vp, NULL, 0, NULL, cr, 0);
2501                         if (error)
2502                                 return (error);
2503                 } else {
2504                         if (res.resok.obj_attributes.attributes) {
2505                                 vp = makenfs3node(&res.resok.obj.handle,
2506                                     &res.resok.obj_attributes.attr,
2507                                     dvp->v_vfsp, t, cr, NULL, NULL);
2508                         } else {
2509                                 vp = makenfs3node(&res.resok.obj.handle, NULL,
2510                                     dvp->v_vfsp, t, cr, NULL, NULL);
2511 
2512                                 /*
2513                                  * On an exclusive create, it is possible
2514                                  * that attributes were returned but those
2515                                  * postop attributes failed to decode
2516                                  * properly.  If this is the case,
2517                                  * then most likely the atime or mtime
2518                                  * were invalid for our client; this
2519                                  * is caused by the server storing the
2520                                  * create verifier in one of the time
2521                                  * fields(most likely mtime).
2522                                  * So... we are going to setattr just the
2523                                  * atime/mtime to clear things up.
2524                                  */
2525                                 if (exclusive == EXCL) {
2526                                         if (error =
2527                                             nfs3excl_create_settimes(vp,
2528                                             va, cr)) {
2529                                                 /*
2530                                                  * Setting the times failed.
2531                                                  * Remove the file and return
2532                                                  * the error.
2533                                                  */
2534                                                 VN_RELE(vp);
2535                                                 (void) nfs3_remove(dvp,
2536                                                     nm, cr, NULL, 0);
2537                                                 return (error);
2538                                         }
2539                                 }
2540 
2541                                 /*
2542                                  * This handles the non-exclusive case
2543                                  * and the exclusive case where no post op
2544                                  * attrs were returned.
2545                                  */
2546                                 if (vp->v_type == VNON) {
2547                                         vattr.va_mask = AT_TYPE;
2548                                         error = nfs3getattr(vp, &vattr, cr);
2549                                         if (error) {
2550                                                 VN_RELE(vp);
2551                                                 return (error);
2552                                         }
2553                                         vp->v_type = vattr.va_type;
2554                                 }
2555                         }
2556                         dnlc_update(dvp, nm, vp);
2557                 }
2558 
2559                 rp = VTOR(vp);
2560 
2561                 /*
2562                  * Check here for large file handled by
2563                  * LF-unaware process (as ufs_create() does)
2564                  */
2565                 if ((va->va_mask & AT_SIZE) && vp->v_type == VREG &&
2566                     !(lfaware & FOFFMAX)) {
2567                         mutex_enter(&rp->r_statelock);
2568                         if (rp->r_size > MAXOFF32_T) {
2569                                 mutex_exit(&rp->r_statelock);
2570                                 VN_RELE(vp);
2571                                 return (EOVERFLOW);
2572                         }
2573                         mutex_exit(&rp->r_statelock);
2574                 }
2575 
2576                 if (exclusive == EXCL &&
2577                     (va->va_mask & ~(AT_GID | AT_SIZE))) {
2578                         /*
2579                          * If doing an exclusive create, then generate
2580                          * a SETATTR to set the initial attributes.
2581                          * Try to set the mtime and the atime to the
2582                          * server's current time.  It is somewhat
2583                          * expected that these fields will be used to
2584                          * store the exclusive create cookie.  If not,
2585                          * server implementors will need to know that
2586                          * a SETATTR will follow an exclusive create
2587                          * and the cookie should be destroyed if
2588                          * appropriate. This work may have been done
2589                          * earlier in this function if post op attrs
2590                          * were not available.
2591                          *
2592                          * The AT_GID and AT_SIZE bits are turned off
2593                          * so that the SETATTR request will not attempt
2594                          * to process these.  The gid will be set
2595                          * separately if appropriate.  The size is turned
2596                          * off because it is assumed that a new file will
2597                          * be created empty and if the file wasn't empty,
2598                          * then the exclusive create will have failed
2599                          * because the file must have existed already.
2600                          * Therefore, no truncate operation is needed.
2601                          */
2602                         va->va_mask &= ~(AT_GID | AT_SIZE);
2603                         error = nfs3setattr(vp, va, 0, cr);
2604                         if (error) {
2605                                 /*
2606                                  * Couldn't correct the attributes of
2607                                  * the newly created file and the
2608                                  * attributes are wrong.  Remove the
2609                                  * file and return an error to the
2610                                  * application.
2611                                  */
2612                                 VN_RELE(vp);
2613                                 (void) nfs3_remove(dvp, nm, cr, NULL, 0);
2614                                 return (error);
2615                         }
2616                 }
2617 
2618                 if (va->va_gid != rp->r_attr.va_gid) {
2619                         /*
2620                          * If the gid on the file isn't right, then
2621                          * generate a SETATTR to attempt to change
2622                          * it.  This may or may not work, depending
2623                          * upon the server's semantics for allowing
2624                          * file ownership changes.
2625                          */
2626                         va->va_mask = AT_GID;
2627                         (void) nfs3setattr(vp, va, 0, cr);
2628                 }
2629 
2630                 /*
2631                  * If vnode is a device create special vnode
2632                  */
2633                 if (IS_DEVVP(vp)) {
2634                         *vpp = specvp(vp, vp->v_rdev, vp->v_type, cr);
2635                         VN_RELE(vp);
2636                 } else
2637                         *vpp = vp;
2638         } else {
2639                 nfs3_cache_wcc_data(dvp, &res.resfail.dir_wcc, t, cr);
2640                 PURGE_STALE_FH(error, dvp, cr);
2641         }
2642 
2643         return (error);
2644 }
2645 
2646 /*
2647  * Special setattr function to take care of rest of atime/mtime
2648  * after successful exclusive create.  This function exists to avoid
2649  * handling attributes from the server; exclusive the atime/mtime fields
2650  * may be 'invalid' in client's view and therefore can not be trusted.
2651  */
2652 static int
2653 nfs3excl_create_settimes(vnode_t *vp, struct vattr *vap, cred_t *cr)
2654 {
2655         int error;
2656         uint_t mask;
2657         SETATTR3args args;
2658         SETATTR3res res;
2659         int douprintf;
2660         rnode_t *rp;
2661         hrtime_t t;
2662 
2663         ASSERT(nfs_zone() == VTOMI(vp)->mi_zone);
2664         /* save the caller's mask so that it can be reset later */
2665         mask = vap->va_mask;
2666 
2667         rp = VTOR(vp);
2668 
2669         args.object = *RTOFH3(rp);
2670         args.guard.check = FALSE;
2671 
2672         /* Use the mask to initialize the arguments */
2673         vap->va_mask = 0;
2674         error = vattr_to_sattr3(vap, &args.new_attributes);
2675 
2676         /* We want to set just atime/mtime on this request */
2677         args.new_attributes.atime.set_it = SET_TO_SERVER_TIME;
2678         args.new_attributes.mtime.set_it = SET_TO_SERVER_TIME;
2679 
2680         douprintf = 1;
2681 
2682         t = gethrtime();
2683 
2684         error = rfs3call(VTOMI(vp), NFSPROC3_SETATTR,
2685             xdr_SETATTR3args, (caddr_t)&args,
2686             xdr_SETATTR3res, (caddr_t)&res, cr,
2687             &douprintf, &res.status, 0, NULL);
2688 
2689         if (error) {
2690                 vap->va_mask = mask;
2691                 return (error);
2692         }
2693 
2694         error = geterrno3(res.status);
2695         if (!error) {
2696                 /*
2697                  * It is important to pick up the attributes.
2698                  * Since this is the exclusive create path, the
2699                  * attributes on the initial create were ignored
2700                  * and we need these to have the correct info.
2701                  */
2702                 nfs3_cache_wcc_data(vp, &res.resok.obj_wcc, t, cr);
2703                 /*
2704                  * No need to do the atime/mtime work again so clear
2705                  * the bits.
2706                  */
2707                 mask &= ~(AT_ATIME | AT_MTIME);
2708         } else {
2709                 nfs3_cache_wcc_data(vp, &res.resfail.obj_wcc, t, cr);
2710         }
2711 
2712         vap->va_mask = mask;
2713 
2714         return (error);
2715 }
2716 
2717 /* ARGSUSED */
2718 static int
2719 nfs3mknod(vnode_t *dvp, char *nm, struct vattr *va, enum vcexcl exclusive,
2720         int mode, vnode_t **vpp, cred_t *cr)
2721 {
2722         int error;
2723         MKNOD3args args;
2724         MKNOD3res res;
2725         int douprintf;
2726         vnode_t *vp;
2727         struct vattr vattr;
2728         hrtime_t t;
2729 
2730         ASSERT(nfs_zone() == VTOMI(dvp)->mi_zone);
2731         switch (va->va_type) {
2732         case VCHR:
2733         case VBLK:
2734                 setdiropargs3(&args.where, nm, dvp);
2735                 args.what.type = (va->va_type == VCHR) ? NF3CHR : NF3BLK;
2736                 error = vattr_to_sattr3(va,
2737                     &args.what.mknoddata3_u.device.dev_attributes);
2738                 if (error) {
2739                         /* req time field(s) overflow - return immediately */
2740                         return (error);
2741                 }
2742                 args.what.mknoddata3_u.device.spec.specdata1 =
2743                     getmajor(va->va_rdev);
2744                 args.what.mknoddata3_u.device.spec.specdata2 =
2745                     getminor(va->va_rdev);
2746                 break;
2747 
2748         case VFIFO:
2749         case VSOCK:
2750                 setdiropargs3(&args.where, nm, dvp);
2751                 args.what.type = (va->va_type == VFIFO) ? NF3FIFO : NF3SOCK;
2752                 error = vattr_to_sattr3(va,
2753                     &args.what.mknoddata3_u.pipe_attributes);
2754                 if (error) {
2755                         /* req time field(s) overflow - return immediately */
2756                         return (error);
2757                 }
2758                 break;
2759 
2760         default:
2761                 return (EINVAL);
2762         }
2763 
2764         douprintf = 1;
2765 
2766         t = gethrtime();
2767 
2768         error = rfs3call(VTOMI(dvp), NFSPROC3_MKNOD,
2769             xdr_MKNOD3args, (caddr_t)&args,
2770             xdr_MKNOD3res, (caddr_t)&res, cr,
2771             &douprintf, &res.status, 0, NULL);
2772 
2773         if (error) {
2774                 PURGE_ATTRCACHE(dvp);
2775                 return (error);
2776         }
2777 
2778         error = geterrno3(res.status);
2779         if (!error) {
2780                 nfs3_cache_wcc_data(dvp, &res.resok.dir_wcc, t, cr);
2781                 if (HAVE_RDDIR_CACHE(VTOR(dvp)))
2782                         nfs_purge_rddir_cache(dvp);
2783 
2784                 if (!res.resok.obj.handle_follows) {
2785                         error = nfs3lookup(dvp, nm, &vp, NULL, 0, NULL, cr, 0);
2786                         if (error)
2787                                 return (error);
2788                 } else {
2789                         if (res.resok.obj_attributes.attributes) {
2790                                 vp = makenfs3node(&res.resok.obj.handle,
2791                                     &res.resok.obj_attributes.attr,
2792                                     dvp->v_vfsp, t, cr, NULL, NULL);
2793                         } else {
2794                                 vp = makenfs3node(&res.resok.obj.handle, NULL,
2795                                     dvp->v_vfsp, t, cr, NULL, NULL);
2796                                 if (vp->v_type == VNON) {
2797                                         vattr.va_mask = AT_TYPE;
2798                                         error = nfs3getattr(vp, &vattr, cr);
2799                                         if (error) {
2800                                                 VN_RELE(vp);
2801                                                 return (error);
2802                                         }
2803                                         vp->v_type = vattr.va_type;
2804                                 }
2805 
2806                         }
2807                         dnlc_update(dvp, nm, vp);
2808                 }
2809 
2810                 if (va->va_gid != VTOR(vp)->r_attr.va_gid) {
2811                         va->va_mask = AT_GID;
2812                         (void) nfs3setattr(vp, va, 0, cr);
2813                 }
2814 
2815                 /*
2816                  * If vnode is a device create special vnode
2817                  */
2818                 if (IS_DEVVP(vp)) {
2819                         *vpp = specvp(vp, vp->v_rdev, vp->v_type, cr);
2820                         VN_RELE(vp);
2821                 } else
2822                         *vpp = vp;
2823         } else {
2824                 nfs3_cache_wcc_data(dvp, &res.resfail.dir_wcc, t, cr);
2825                 PURGE_STALE_FH(error, dvp, cr);
2826         }
2827         return (error);
2828 }
2829 
2830 /*
2831  * Weirdness: if the vnode to be removed is open
2832  * we rename it instead of removing it and nfs_inactive
2833  * will remove the new name.
2834  */
2835 /* ARGSUSED */
2836 static int
2837 nfs3_remove(vnode_t *dvp, char *nm, cred_t *cr, caller_context_t *ct, int flags)
2838 {
2839         int error;
2840         REMOVE3args args;
2841         REMOVE3res res;
2842         vnode_t *vp;
2843         char *tmpname;
2844         int douprintf;
2845         rnode_t *rp;
2846         rnode_t *drp;
2847         hrtime_t t;
2848 
2849         if (nfs_zone() != VTOMI(dvp)->mi_zone)
2850                 return (EPERM);
2851         drp = VTOR(dvp);
2852         if (nfs_rw_enter_sig(&drp->r_rwlock, RW_WRITER, INTR(dvp)))
2853                 return (EINTR);
2854 
2855         error = nfs3lookup(dvp, nm, &vp, NULL, 0, NULL, cr, 0);
2856         if (error) {
2857                 nfs_rw_exit(&drp->r_rwlock);
2858                 return (error);
2859         }
2860 
2861         if (vp->v_type == VDIR && secpolicy_fs_linkdir(cr, dvp->v_vfsp)) {
2862                 VN_RELE(vp);
2863                 nfs_rw_exit(&drp->r_rwlock);
2864                 return (EPERM);
2865         }
2866 
2867         /*
2868          * First just remove the entry from the name cache, as it
2869          * is most likely the only entry for this vp.
2870          */
2871         dnlc_remove(dvp, nm);
2872 
2873         /*
2874          * If the file has a v_count > 1 then there may be more than one
2875          * entry in the name cache due multiple links or an open file,
2876          * but we don't have the real reference count so flush all
2877          * possible entries.
2878          */
2879         if (vp->v_count > 1)
2880                 dnlc_purge_vp(vp);
2881 
2882         /*
2883          * Now we have the real reference count on the vnode
2884          */
2885         rp = VTOR(vp);
2886         mutex_enter(&rp->r_statelock);
2887         if (vp->v_count > 1 &&
2888             (rp->r_unldvp == NULL || strcmp(nm, rp->r_unlname) == 0)) {
2889                 mutex_exit(&rp->r_statelock);
2890                 tmpname = newname();
2891                 error = nfs3rename(dvp, nm, dvp, tmpname, cr, ct);
2892                 if (error)
2893                         kmem_free(tmpname, MAXNAMELEN);
2894                 else {
2895                         mutex_enter(&rp->r_statelock);
2896                         if (rp->r_unldvp == NULL) {
2897                                 VN_HOLD(dvp);
2898                                 rp->r_unldvp = dvp;
2899                                 if (rp->r_unlcred != NULL)
2900                                         crfree(rp->r_unlcred);
2901                                 crhold(cr);
2902                                 rp->r_unlcred = cr;
2903                                 rp->r_unlname = tmpname;
2904                         } else {
2905                                 kmem_free(rp->r_unlname, MAXNAMELEN);
2906                                 rp->r_unlname = tmpname;
2907                         }
2908                         mutex_exit(&rp->r_statelock);
2909                 }
2910         } else {
2911                 mutex_exit(&rp->r_statelock);
2912                 /*
2913                  * We need to flush any dirty pages which happen to
2914                  * be hanging around before removing the file.  This
2915                  * shouldn't happen very often and mostly on file
2916                  * systems mounted "nocto".
2917                  */
2918                 if (vn_has_cached_data(vp) &&
2919                     ((rp->r_flags & RDIRTY) || rp->r_count > 0)) {
2920                         error = nfs3_putpage(vp, (offset_t)0, 0, 0, cr, ct);
2921                         if (error && (error == ENOSPC || error == EDQUOT)) {
2922                                 mutex_enter(&rp->r_statelock);
2923                                 if (!rp->r_error)
2924                                         rp->r_error = error;
2925                                 mutex_exit(&rp->r_statelock);
2926                         }
2927                 }
2928 
2929                 setdiropargs3(&args.object, nm, dvp);
2930 
2931                 douprintf = 1;
2932 
2933                 t = gethrtime();
2934 
2935                 error = rfs3call(VTOMI(dvp), NFSPROC3_REMOVE,
2936                     xdr_diropargs3, (caddr_t)&args,
2937                     xdr_REMOVE3res, (caddr_t)&res, cr,
2938                     &douprintf, &res.status, 0, NULL);
2939 
2940                 /*
2941                  * The xattr dir may be gone after last attr is removed,
2942                  * so flush it from dnlc.
2943                  */
2944                 if (dvp->v_flag & V_XATTRDIR)
2945                         dnlc_purge_vp(dvp);
2946 
2947                 PURGE_ATTRCACHE(vp);
2948 
2949                 if (error) {
2950                         PURGE_ATTRCACHE(dvp);
2951                 } else {
2952                         error = geterrno3(res.status);
2953                         if (!error) {
2954                                 nfs3_cache_wcc_data(dvp, &res.resok.dir_wcc, t,
2955                                     cr);
2956                                 if (HAVE_RDDIR_CACHE(drp))
2957                                         nfs_purge_rddir_cache(dvp);
2958                         } else {
2959                                 nfs3_cache_wcc_data(dvp, &res.resfail.dir_wcc,
2960                                     t, cr);
2961                                 PURGE_STALE_FH(error, dvp, cr);
2962                         }
2963                 }
2964         }
2965 
2966         if (error == 0) {
2967                 vnevent_remove(vp, dvp, nm, ct);
2968         }
2969         VN_RELE(vp);
2970 
2971         nfs_rw_exit(&drp->r_rwlock);
2972 
2973         return (error);
2974 }
2975 
2976 /* ARGSUSED */
2977 static int
2978 nfs3_link(vnode_t *tdvp, vnode_t *svp, char *tnm, cred_t *cr,
2979         caller_context_t *ct, int flags)
2980 {
2981         int error;
2982         LINK3args args;
2983         LINK3res res;
2984         vnode_t *realvp;
2985         int douprintf;
2986         mntinfo_t *mi;
2987         rnode_t *tdrp;
2988         hrtime_t t;
2989 
2990         if (nfs_zone() != VTOMI(tdvp)->mi_zone)
2991                 return (EPERM);
2992         if (VOP_REALVP(svp, &realvp, ct) == 0)
2993                 svp = realvp;
2994 
2995         mi = VTOMI(svp);
2996 
2997         if (!(mi->mi_flags & MI_LINK))
2998                 return (EOPNOTSUPP);
2999 
3000         args.file = *VTOFH3(svp);
3001         setdiropargs3(&args.link, tnm, tdvp);
3002 
3003         tdrp = VTOR(tdvp);
3004         if (nfs_rw_enter_sig(&tdrp->r_rwlock, RW_WRITER, INTR(tdvp)))
3005                 return (EINTR);
3006 
3007         dnlc_remove(tdvp, tnm);
3008 
3009         douprintf = 1;
3010 
3011         t = gethrtime();
3012 
3013         error = rfs3call(mi, NFSPROC3_LINK,
3014             xdr_LINK3args, (caddr_t)&args,
3015             xdr_LINK3res, (caddr_t)&res, cr,
3016             &douprintf, &res.status, 0, NULL);
3017 
3018         if (error) {
3019                 PURGE_ATTRCACHE(tdvp);
3020                 PURGE_ATTRCACHE(svp);
3021                 nfs_rw_exit(&tdrp->r_rwlock);
3022                 return (error);
3023         }
3024 
3025         error = geterrno3(res.status);
3026 
3027         if (!error) {
3028                 nfs3_cache_post_op_attr(svp, &res.resok.file_attributes, t, cr);
3029                 nfs3_cache_wcc_data(tdvp, &res.resok.linkdir_wcc, t, cr);
3030                 if (HAVE_RDDIR_CACHE(tdrp))
3031                         nfs_purge_rddir_cache(tdvp);
3032                 dnlc_update(tdvp, tnm, svp);
3033         } else {
3034                 nfs3_cache_post_op_attr(svp, &res.resfail.file_attributes, t,
3035                     cr);
3036                 nfs3_cache_wcc_data(tdvp, &res.resfail.linkdir_wcc, t, cr);
3037                 if (error == EOPNOTSUPP) {
3038                         mutex_enter(&mi->mi_lock);
3039                         mi->mi_flags &= ~MI_LINK;
3040                         mutex_exit(&mi->mi_lock);
3041                 }
3042         }
3043 
3044         nfs_rw_exit(&tdrp->r_rwlock);
3045 
3046         if (!error) {
3047                 /*
3048                  * Notify the source file of this link operation.
3049                  */
3050                 vnevent_link(svp, ct);
3051         }
3052         return (error);
3053 }
3054 
3055 /* ARGSUSED */
3056 static int
3057 nfs3_rename(vnode_t *odvp, char *onm, vnode_t *ndvp, char *nnm, cred_t *cr,
3058         caller_context_t *ct, int flags)
3059 {
3060         vnode_t *realvp;
3061 
3062         if (nfs_zone() != VTOMI(odvp)->mi_zone)
3063                 return (EPERM);
3064         if (VOP_REALVP(ndvp, &realvp, ct) == 0)
3065                 ndvp = realvp;
3066 
3067         return (nfs3rename(odvp, onm, ndvp, nnm, cr, ct));
3068 }
3069 
3070 /*
3071  * nfs3rename does the real work of renaming in NFS Version 3.
3072  */
3073 static int
3074 nfs3rename(vnode_t *odvp, char *onm, vnode_t *ndvp, char *nnm, cred_t *cr,
3075     caller_context_t *ct)
3076 {
3077         int error;
3078         RENAME3args args;
3079         RENAME3res res;
3080         int douprintf;
3081         vnode_t *nvp = NULL;
3082         vnode_t *ovp = NULL;
3083         char *tmpname;
3084         rnode_t *rp;
3085         rnode_t *odrp;
3086         rnode_t *ndrp;
3087         hrtime_t t;
3088 
3089         ASSERT(nfs_zone() == VTOMI(odvp)->mi_zone);
3090 
3091         if (strcmp(onm, ".") == 0 || strcmp(onm, "..") == 0 ||
3092             strcmp(nnm, ".") == 0 || strcmp(nnm, "..") == 0)
3093                 return (EINVAL);
3094 
3095         odrp = VTOR(odvp);
3096         ndrp = VTOR(ndvp);
3097         if ((intptr_t)odrp < (intptr_t)ndrp) {
3098                 if (nfs_rw_enter_sig(&odrp->r_rwlock, RW_WRITER, INTR(odvp)))
3099                         return (EINTR);
3100                 if (nfs_rw_enter_sig(&ndrp->r_rwlock, RW_WRITER, INTR(ndvp))) {
3101                         nfs_rw_exit(&odrp->r_rwlock);
3102                         return (EINTR);
3103                 }
3104         } else {
3105                 if (nfs_rw_enter_sig(&ndrp->r_rwlock, RW_WRITER, INTR(ndvp)))
3106                         return (EINTR);
3107                 if (nfs_rw_enter_sig(&odrp->r_rwlock, RW_WRITER, INTR(odvp))) {
3108                         nfs_rw_exit(&ndrp->r_rwlock);
3109                         return (EINTR);
3110                 }
3111         }
3112 
3113         /*
3114          * Lookup the target file.  If it exists, it needs to be
3115          * checked to see whether it is a mount point and whether
3116          * it is active (open).
3117          */
3118         error = nfs3lookup(ndvp, nnm, &nvp, NULL, 0, NULL, cr, 0);
3119         if (!error) {
3120                 /*
3121                  * If this file has been mounted on, then just
3122                  * return busy because renaming to it would remove
3123                  * the mounted file system from the name space.
3124                  */
3125                 if (vn_mountedvfs(nvp) != NULL) {
3126                         VN_RELE(nvp);
3127                         nfs_rw_exit(&odrp->r_rwlock);
3128                         nfs_rw_exit(&ndrp->r_rwlock);
3129                         return (EBUSY);
3130                 }
3131 
3132                 /*
3133                  * Purge the name cache of all references to this vnode
3134                  * so that we can check the reference count to infer
3135                  * whether it is active or not.
3136                  */
3137                 /*
3138                  * First just remove the entry from the name cache, as it
3139                  * is most likely the only entry for this vp.
3140                  */
3141                 dnlc_remove(ndvp, nnm);
3142                 /*
3143                  * If the file has a v_count > 1 then there may be more
3144                  * than one entry in the name cache due multiple links
3145                  * or an open file, but we don't have the real reference
3146                  * count so flush all possible entries.
3147                  */
3148                 if (nvp->v_count > 1)
3149                         dnlc_purge_vp(nvp);
3150 
3151                 /*
3152                  * If the vnode is active and is not a directory,
3153                  * arrange to rename it to a
3154                  * temporary file so that it will continue to be
3155                  * accessible.  This implements the "unlink-open-file"
3156                  * semantics for the target of a rename operation.
3157                  * Before doing this though, make sure that the
3158                  * source and target files are not already the same.
3159                  */
3160                 if (nvp->v_count > 1 && nvp->v_type != VDIR) {
3161                         /*
3162                          * Lookup the source name.
3163                          */
3164                         error = nfs3lookup(odvp, onm, &ovp, NULL, 0, NULL,
3165                             cr, 0);
3166 
3167                         /*
3168                          * The source name *should* already exist.
3169                          */
3170                         if (error) {
3171                                 VN_RELE(nvp);
3172                                 nfs_rw_exit(&odrp->r_rwlock);
3173                                 nfs_rw_exit(&ndrp->r_rwlock);
3174                                 return (error);
3175                         }
3176 
3177                         /*
3178                          * Compare the two vnodes.  If they are the same,
3179                          * just release all held vnodes and return success.
3180                          */
3181                         if (ovp == nvp) {
3182                                 VN_RELE(ovp);
3183                                 VN_RELE(nvp);
3184                                 nfs_rw_exit(&odrp->r_rwlock);
3185                                 nfs_rw_exit(&ndrp->r_rwlock);
3186                                 return (0);
3187                         }
3188 
3189                         /*
3190                          * Can't mix and match directories and non-
3191                          * directories in rename operations.  We already
3192                          * know that the target is not a directory.  If
3193                          * the source is a directory, return an error.
3194                          */
3195                         if (ovp->v_type == VDIR) {
3196                                 VN_RELE(ovp);
3197                                 VN_RELE(nvp);
3198                                 nfs_rw_exit(&odrp->r_rwlock);
3199                                 nfs_rw_exit(&ndrp->r_rwlock);
3200                                 return (ENOTDIR);
3201                         }
3202 
3203                         /*
3204                          * The target file exists, is not the same as
3205                          * the source file, and is active.  Link it
3206                          * to a temporary filename to avoid having
3207                          * the server removing the file completely.
3208                          */
3209                         tmpname = newname();
3210                         error = nfs3_link(ndvp, nvp, tmpname, cr, NULL, 0);
3211                         if (error == EOPNOTSUPP) {
3212                                 error = nfs3_rename(ndvp, nnm, ndvp, tmpname,
3213                                     cr, NULL, 0);
3214                         }
3215                         if (error) {
3216                                 kmem_free(tmpname, MAXNAMELEN);
3217                                 VN_RELE(ovp);
3218                                 VN_RELE(nvp);
3219                                 nfs_rw_exit(&odrp->r_rwlock);
3220                                 nfs_rw_exit(&ndrp->r_rwlock);
3221                                 return (error);
3222                         }
3223                         rp = VTOR(nvp);
3224                         mutex_enter(&rp->r_statelock);
3225                         if (rp->r_unldvp == NULL) {
3226                                 VN_HOLD(ndvp);
3227                                 rp->r_unldvp = ndvp;
3228                                 if (rp->r_unlcred != NULL)
3229                                         crfree(rp->r_unlcred);
3230                                 crhold(cr);
3231                                 rp->r_unlcred = cr;
3232                                 rp->r_unlname = tmpname;
3233                         } else {
3234                                 kmem_free(rp->r_unlname, MAXNAMELEN);
3235                                 rp->r_unlname = tmpname;
3236                         }
3237                         mutex_exit(&rp->r_statelock);
3238                 }
3239         }
3240 
3241         if (ovp == NULL) {
3242                 /*
3243                  * When renaming directories to be a subdirectory of a
3244                  * different parent, the dnlc entry for ".." will no
3245                  * longer be valid, so it must be removed.
3246                  *
3247                  * We do a lookup here to determine whether we are renaming
3248                  * a directory and we need to check if we are renaming
3249                  * an unlinked file.  This might have already been done
3250                  * in previous code, so we check ovp == NULL to avoid
3251                  * doing it twice.
3252                  */
3253 
3254                 error = nfs3lookup(odvp, onm, &ovp, NULL, 0, NULL, cr, 0);
3255                 /*
3256                  * The source name *should* already exist.
3257                  */
3258                 if (error) {
3259                         nfs_rw_exit(&odrp->r_rwlock);
3260                         nfs_rw_exit(&ndrp->r_rwlock);
3261                         if (nvp) {
3262                                 VN_RELE(nvp);
3263                         }
3264                         return (error);
3265                 }
3266                 ASSERT(ovp != NULL);
3267         }
3268 
3269         dnlc_remove(odvp, onm);
3270         dnlc_remove(ndvp, nnm);
3271 
3272         setdiropargs3(&args.from, onm, odvp);
3273         setdiropargs3(&args.to, nnm, ndvp);
3274 
3275         douprintf = 1;
3276 
3277         t = gethrtime();
3278 
3279         error = rfs3call(VTOMI(odvp), NFSPROC3_RENAME,
3280             xdr_RENAME3args, (caddr_t)&args,
3281             xdr_RENAME3res, (caddr_t)&res, cr,
3282             &douprintf, &res.status, 0, NULL);
3283 
3284         if (error) {
3285                 PURGE_ATTRCACHE(odvp);
3286                 PURGE_ATTRCACHE(ndvp);
3287                 VN_RELE(ovp);
3288                 nfs_rw_exit(&odrp->r_rwlock);
3289                 nfs_rw_exit(&ndrp->r_rwlock);
3290                 if (nvp) {
3291                         VN_RELE(nvp);
3292                 }
3293                 return (error);
3294         }
3295 
3296         error = geterrno3(res.status);
3297 
3298         if (!error) {
3299                 nfs3_cache_wcc_data(odvp, &res.resok.fromdir_wcc, t, cr);
3300                 if (HAVE_RDDIR_CACHE(odrp))
3301                         nfs_purge_rddir_cache(odvp);
3302                 if (ndvp != odvp) {
3303                         nfs3_cache_wcc_data(ndvp, &res.resok.todir_wcc, t, cr);
3304                         if (HAVE_RDDIR_CACHE(ndrp))
3305                                 nfs_purge_rddir_cache(ndvp);
3306                 }
3307                 /*
3308                  * when renaming directories to be a subdirectory of a
3309                  * different parent, the dnlc entry for ".." will no
3310                  * longer be valid, so it must be removed
3311                  */
3312                 rp = VTOR(ovp);
3313                 if (ndvp != odvp) {
3314                         if (ovp->v_type == VDIR) {
3315                                 dnlc_remove(ovp, "..");
3316                                 if (HAVE_RDDIR_CACHE(rp))
3317                                         nfs_purge_rddir_cache(ovp);
3318                         }
3319                 }
3320 
3321                 /*
3322                  * If we are renaming the unlinked file, update the
3323                  * r_unldvp and r_unlname as needed.
3324                  */
3325                 mutex_enter(&rp->r_statelock);
3326                 if (rp->r_unldvp != NULL) {
3327                         if (strcmp(rp->r_unlname, onm) == 0) {
3328                                 (void) strncpy(rp->r_unlname, nnm, MAXNAMELEN);
3329                                 rp->r_unlname[MAXNAMELEN - 1] = '\0';
3330 
3331                                 if (ndvp != rp->r_unldvp) {
3332                                         VN_RELE(rp->r_unldvp);
3333                                         rp->r_unldvp = ndvp;
3334                                         VN_HOLD(ndvp);
3335                                 }
3336                         }
3337                 }
3338                 mutex_exit(&rp->r_statelock);
3339         } else {
3340                 nfs3_cache_wcc_data(odvp, &res.resfail.fromdir_wcc, t, cr);
3341                 if (ndvp != odvp) {
3342                         nfs3_cache_wcc_data(ndvp, &res.resfail.todir_wcc, t,
3343                             cr);
3344                 }
3345                 /*
3346                  * System V defines rename to return EEXIST, not
3347                  * ENOTEMPTY if the target directory is not empty.
3348                  * Over the wire, the error is NFSERR_ENOTEMPTY
3349                  * which geterrno maps to ENOTEMPTY.
3350                  */
3351                 if (error == ENOTEMPTY)
3352                         error = EEXIST;
3353         }
3354 
3355         if (error == 0) {
3356                 if (nvp)
3357                         vnevent_rename_dest(nvp, ndvp, nnm, ct);
3358 
3359                 if (odvp != ndvp)
3360                         vnevent_rename_dest_dir(ndvp, ct);
3361                 ASSERT(ovp != NULL);
3362                 vnevent_rename_src(ovp, odvp, onm, ct);
3363         }
3364 
3365         if (nvp) {
3366                 VN_RELE(nvp);
3367         }
3368         VN_RELE(ovp);
3369 
3370         nfs_rw_exit(&odrp->r_rwlock);
3371         nfs_rw_exit(&ndrp->r_rwlock);
3372 
3373         return (error);
3374 }
3375 
3376 /* ARGSUSED */
3377 static int
3378 nfs3_mkdir(vnode_t *dvp, char *nm, struct vattr *va, vnode_t **vpp, cred_t *cr,
3379         caller_context_t *ct, int flags, vsecattr_t *vsecp)
3380 {
3381         int error;
3382         MKDIR3args args;
3383         MKDIR3res res;
3384         int douprintf;
3385         struct vattr vattr;
3386         vnode_t *vp;
3387         rnode_t *drp;
3388         hrtime_t t;
3389 
3390         if (nfs_zone() != VTOMI(dvp)->mi_zone)
3391                 return (EPERM);
3392         setdiropargs3(&args.where, nm, dvp);
3393 
3394         /*
3395          * Decide what the group-id and set-gid bit of the created directory
3396          * should be.  May have to do a setattr to get the gid right.
3397          */
3398         error = setdirgid(dvp, &va->va_gid, cr);
3399         if (error)
3400                 return (error);
3401         error = setdirmode(dvp, &va->va_mode, cr);
3402         if (error)
3403                 return (error);
3404         va->va_mask |= AT_MODE|AT_GID;
3405 
3406         error = vattr_to_sattr3(va, &args.attributes);
3407         if (error) {
3408                 /* req time field(s) overflow - return immediately */
3409                 return (error);
3410         }
3411 
3412         drp = VTOR(dvp);
3413         if (nfs_rw_enter_sig(&drp->r_rwlock, RW_WRITER, INTR(dvp)))
3414                 return (EINTR);
3415 
3416         dnlc_remove(dvp, nm);
3417 
3418         douprintf = 1;
3419 
3420         t = gethrtime();
3421 
3422         error = rfs3call(VTOMI(dvp), NFSPROC3_MKDIR,
3423             xdr_MKDIR3args, (caddr_t)&args,
3424             xdr_MKDIR3res, (caddr_t)&res, cr,
3425             &douprintf, &res.status, 0, NULL);
3426 
3427         if (error) {
3428                 PURGE_ATTRCACHE(dvp);
3429                 nfs_rw_exit(&drp->r_rwlock);
3430                 return (error);
3431         }
3432 
3433         error = geterrno3(res.status);
3434         if (!error) {
3435                 nfs3_cache_wcc_data(dvp, &res.resok.dir_wcc, t, cr);
3436                 if (HAVE_RDDIR_CACHE(drp))
3437                         nfs_purge_rddir_cache(dvp);
3438 
3439                 if (!res.resok.obj.handle_follows) {
3440                         error = nfs3lookup(dvp, nm, &vp, NULL, 0, NULL, cr, 0);
3441                         if (error) {
3442                                 nfs_rw_exit(&drp->r_rwlock);
3443                                 return (error);
3444                         }
3445                 } else {
3446                         if (res.resok.obj_attributes.attributes) {
3447                                 vp = makenfs3node(&res.resok.obj.handle,
3448                                     &res.resok.obj_attributes.attr,
3449                                     dvp->v_vfsp, t, cr, NULL, NULL);
3450                         } else {
3451                                 vp = makenfs3node(&res.resok.obj.handle, NULL,
3452                                     dvp->v_vfsp, t, cr, NULL, NULL);
3453                                 if (vp->v_type == VNON) {
3454                                         vattr.va_mask = AT_TYPE;
3455                                         error = nfs3getattr(vp, &vattr, cr);
3456                                         if (error) {
3457                                                 VN_RELE(vp);
3458                                                 nfs_rw_exit(&drp->r_rwlock);
3459                                                 return (error);
3460                                         }
3461                                         vp->v_type = vattr.va_type;
3462                                 }
3463                         }
3464                         dnlc_update(dvp, nm, vp);
3465                 }
3466                 if (va->va_gid != VTOR(vp)->r_attr.va_gid) {
3467                         va->va_mask = AT_GID;
3468                         (void) nfs3setattr(vp, va, 0, cr);
3469                 }
3470                 *vpp = vp;
3471         } else {
3472                 nfs3_cache_wcc_data(dvp, &res.resfail.dir_wcc, t, cr);
3473                 PURGE_STALE_FH(error, dvp, cr);
3474         }
3475 
3476         nfs_rw_exit(&drp->r_rwlock);
3477 
3478         return (error);
3479 }
3480 
3481 /* ARGSUSED */
3482 static int
3483 nfs3_rmdir(vnode_t *dvp, char *nm, vnode_t *cdir, cred_t *cr,
3484         caller_context_t *ct, int flags)
3485 {
3486         int error;
3487         RMDIR3args args;
3488         RMDIR3res res;
3489         vnode_t *vp;
3490         int douprintf;
3491         rnode_t *drp;
3492         hrtime_t t;
3493 
3494         if (nfs_zone() != VTOMI(dvp)->mi_zone)
3495                 return (EPERM);
3496         drp = VTOR(dvp);
3497         if (nfs_rw_enter_sig(&drp->r_rwlock, RW_WRITER, INTR(dvp)))
3498                 return (EINTR);
3499 
3500         /*
3501          * Attempt to prevent a rmdir(".") from succeeding.
3502          */
3503         error = nfs3lookup(dvp, nm, &vp, NULL, 0, NULL, cr, 0);
3504         if (error) {
3505                 nfs_rw_exit(&drp->r_rwlock);
3506                 return (error);
3507         }
3508 
3509         if (vp == cdir) {
3510                 VN_RELE(vp);
3511                 nfs_rw_exit(&drp->r_rwlock);
3512                 return (EINVAL);
3513         }
3514 
3515         setdiropargs3(&args.object, nm, dvp);
3516 
3517         /*
3518          * First just remove the entry from the name cache, as it
3519          * is most likely an entry for this vp.
3520          */
3521         dnlc_remove(dvp, nm);
3522 
3523         /*
3524          * If there vnode reference count is greater than one, then
3525          * there may be additional references in the DNLC which will
3526          * need to be purged.  First, trying removing the entry for
3527          * the parent directory and see if that removes the additional
3528          * reference(s).  If that doesn't do it, then use dnlc_purge_vp
3529          * to completely remove any references to the directory which
3530          * might still exist in the DNLC.
3531          */
3532         if (vp->v_count > 1) {
3533                 dnlc_remove(vp, "..");
3534                 if (vp->v_count > 1)
3535                         dnlc_purge_vp(vp);
3536         }
3537 
3538         douprintf = 1;
3539 
3540         t = gethrtime();
3541 
3542         error = rfs3call(VTOMI(dvp), NFSPROC3_RMDIR,
3543             xdr_diropargs3, (caddr_t)&args,
3544             xdr_RMDIR3res, (caddr_t)&res, cr,
3545             &douprintf, &res.status, 0, NULL);
3546 
3547         PURGE_ATTRCACHE(vp);
3548 
3549         if (error) {
3550                 PURGE_ATTRCACHE(dvp);
3551                 VN_RELE(vp);
3552                 nfs_rw_exit(&drp->r_rwlock);
3553                 return (error);
3554         }
3555 
3556         error = geterrno3(res.status);
3557         if (!error) {
3558                 nfs3_cache_wcc_data(dvp, &res.resok.dir_wcc, t, cr);
3559                 if (HAVE_RDDIR_CACHE(drp))
3560                         nfs_purge_rddir_cache(dvp);
3561                 if (HAVE_RDDIR_CACHE(VTOR(vp)))
3562                         nfs_purge_rddir_cache(vp);
3563         } else {
3564                 nfs3_cache_wcc_data(dvp, &res.resfail.dir_wcc, t, cr);
3565                 PURGE_STALE_FH(error, dvp, cr);
3566                 /*
3567                  * System V defines rmdir to return EEXIST, not
3568                  * ENOTEMPTY if the directory is not empty.  Over
3569                  * the wire, the error is NFSERR_ENOTEMPTY which
3570                  * geterrno maps to ENOTEMPTY.
3571                  */
3572                 if (error == ENOTEMPTY)
3573                         error = EEXIST;
3574         }
3575 
3576         if (error == 0) {
3577                 vnevent_rmdir(vp, dvp, nm, ct);
3578         }
3579         VN_RELE(vp);
3580 
3581         nfs_rw_exit(&drp->r_rwlock);
3582 
3583         return (error);
3584 }
3585 
3586 /* ARGSUSED */
3587 static int
3588 nfs3_symlink(vnode_t *dvp, char *lnm, struct vattr *tva, char *tnm, cred_t *cr,
3589         caller_context_t *ct, int flags)
3590 {
3591         int error;
3592         SYMLINK3args args;
3593         SYMLINK3res res;
3594         int douprintf;
3595         mntinfo_t *mi;
3596         vnode_t *vp;
3597         rnode_t *rp;
3598         char *contents;
3599         rnode_t *drp;
3600         hrtime_t t;
3601 
3602         mi = VTOMI(dvp);
3603 
3604         if (nfs_zone() != mi->mi_zone)
3605                 return (EPERM);
3606         if (!(mi->mi_flags & MI_SYMLINK))
3607                 return (EOPNOTSUPP);
3608 
3609         setdiropargs3(&args.where, lnm, dvp);
3610         error = vattr_to_sattr3(tva, &args.symlink.symlink_attributes);
3611         if (error) {
3612                 /* req time field(s) overflow - return immediately */
3613                 return (error);
3614         }
3615         args.symlink.symlink_data = tnm;
3616 
3617         drp = VTOR(dvp);
3618         if (nfs_rw_enter_sig(&drp->r_rwlock, RW_WRITER, INTR(dvp)))
3619                 return (EINTR);
3620 
3621         dnlc_remove(dvp, lnm);
3622 
3623         douprintf = 1;
3624 
3625         t = gethrtime();
3626 
3627         error = rfs3call(mi, NFSPROC3_SYMLINK,
3628             xdr_SYMLINK3args, (caddr_t)&args,
3629             xdr_SYMLINK3res, (caddr_t)&res, cr,
3630             &douprintf, &res.status, 0, NULL);
3631 
3632         if (error) {
3633                 PURGE_ATTRCACHE(dvp);
3634                 nfs_rw_exit(&drp->r_rwlock);
3635                 return (error);
3636         }
3637 
3638         error = geterrno3(res.status);
3639         if (!error) {
3640                 nfs3_cache_wcc_data(dvp, &res.resok.dir_wcc, t, cr);
3641                 if (HAVE_RDDIR_CACHE(drp))
3642                         nfs_purge_rddir_cache(dvp);
3643 
3644                 if (res.resok.obj.handle_follows) {
3645                         if (res.resok.obj_attributes.attributes) {
3646                                 vp = makenfs3node(&res.resok.obj.handle,
3647                                     &res.resok.obj_attributes.attr,
3648                                     dvp->v_vfsp, t, cr, NULL, NULL);
3649                         } else {
3650                                 vp = makenfs3node(&res.resok.obj.handle, NULL,
3651                                     dvp->v_vfsp, t, cr, NULL, NULL);
3652                                 vp->v_type = VLNK;
3653                                 vp->v_rdev = 0;
3654                         }
3655                         dnlc_update(dvp, lnm, vp);
3656                         rp = VTOR(vp);
3657                         if (nfs3_do_symlink_cache &&
3658                             rp->r_symlink.contents == NULL) {
3659 
3660                                 contents = kmem_alloc(MAXPATHLEN,
3661                                     KM_NOSLEEP);
3662 
3663                                 if (contents != NULL) {
3664                                         mutex_enter(&rp->r_statelock);
3665                                         if (rp->r_symlink.contents == NULL) {
3666                                                 rp->r_symlink.len = strlen(tnm);
3667                                                 bcopy(tnm, contents,
3668                                                     rp->r_symlink.len);
3669                                                 rp->r_symlink.contents =
3670                                                     contents;
3671                                                 rp->r_symlink.size = MAXPATHLEN;
3672                                                 mutex_exit(&rp->r_statelock);
3673                                         } else {
3674                                                 mutex_exit(&rp->r_statelock);
3675                                                 kmem_free((void *)contents,
3676                                                     MAXPATHLEN);
3677                                         }
3678                                 }
3679                         }
3680                         VN_RELE(vp);
3681                 }
3682         } else {
3683                 nfs3_cache_wcc_data(dvp, &res.resfail.dir_wcc, t, cr);
3684                 PURGE_STALE_FH(error, dvp, cr);
3685                 if (error == EOPNOTSUPP) {
3686                         mutex_enter(&mi->mi_lock);
3687                         mi->mi_flags &= ~MI_SYMLINK;
3688                         mutex_exit(&mi->mi_lock);
3689                 }
3690         }
3691 
3692         nfs_rw_exit(&drp->r_rwlock);
3693 
3694         return (error);
3695 }
3696 
3697 #ifdef DEBUG
3698 static int nfs3_readdir_cache_hits = 0;
3699 static int nfs3_readdir_cache_shorts = 0;
3700 static int nfs3_readdir_cache_waits = 0;
3701 static int nfs3_readdir_cache_misses = 0;
3702 static int nfs3_readdir_readahead = 0;
3703 #endif
3704 
3705 volatile int nfs3_shrinkreaddir = 0;
3706 
3707 /*
3708  * Read directory entries.
3709  * There are some weird things to look out for here.  The uio_loffset
3710  * field is either 0 or it is the offset returned from a previous
3711  * readdir.  It is an opaque value used by the server to find the
3712  * correct directory block to read. The count field is the number
3713  * of blocks to read on the server.  This is advisory only, the server
3714  * may return only one block's worth of entries.  Entries may be compressed
3715  * on the server.
3716  */
3717 /* ARGSUSED */
3718 static int
3719 nfs3_readdir(vnode_t *vp, struct uio *uiop, cred_t *cr, int *eofp,
3720         caller_context_t *ct, int flags)
3721 {
3722         int error;
3723         size_t count;
3724         rnode_t *rp;
3725         rddir_cache *rdc;
3726         rddir_cache *nrdc;
3727         rddir_cache *rrdc;
3728 #ifdef DEBUG
3729         int missed;
3730 #endif
3731         int doreadahead;
3732         rddir_cache srdc;
3733         avl_index_t where;
3734 
3735         if (nfs_zone() != VTOMI(vp)->mi_zone)
3736                 return (EIO);
3737         rp = VTOR(vp);
3738 
3739         ASSERT(nfs_rw_lock_held(&rp->r_rwlock, RW_READER));
3740 
3741         /*
3742          * Make sure that the directory cache is valid.
3743          */
3744         if (HAVE_RDDIR_CACHE(rp)) {
3745                 if (nfs_disable_rddir_cache) {
3746                         /*
3747                          * Setting nfs_disable_rddir_cache in /etc/system
3748                          * allows interoperability with servers that do not
3749                          * properly update the attributes of directories.
3750                          * Any cached information gets purged before an
3751                          * access is made to it.
3752                          */
3753                         nfs_purge_rddir_cache(vp);
3754                 } else {
3755                         error = nfs3_validate_caches(vp, cr);
3756                         if (error)
3757                                 return (error);
3758                 }
3759         }
3760 
3761         /*
3762          * It is possible that some servers may not be able to correctly
3763          * handle a large READDIR or READDIRPLUS request due to bugs in
3764          * their implementation.  In order to continue to interoperate
3765          * with them, this workaround is provided to limit the maximum
3766          * size of a READDIRPLUS request to 1024.  In any case, the request
3767          * size is limited to MAXBSIZE.
3768          */
3769         count = MIN(uiop->uio_iov->iov_len,
3770             nfs3_shrinkreaddir ? 1024 : MAXBSIZE);
3771 
3772         nrdc = NULL;
3773 #ifdef DEBUG
3774         missed = 0;
3775 #endif
3776 top:
3777         /*
3778          * Short circuit last readdir which always returns 0 bytes.
3779          * This can be done after the directory has been read through
3780          * completely at least once.  This will set r_direof which
3781          * can be used to find the value of the last cookie.
3782          */
3783         mutex_enter(&rp->r_statelock);
3784         if (rp->r_direof != NULL &&
3785             uiop->uio_loffset == rp->r_direof->nfs3_ncookie) {
3786                 mutex_exit(&rp->r_statelock);
3787 #ifdef DEBUG
3788                 nfs3_readdir_cache_shorts++;
3789 #endif
3790                 if (eofp)
3791                         *eofp = 1;
3792                 if (nrdc != NULL)
3793                         rddir_cache_rele(nrdc);
3794                 return (0);
3795         }
3796         /*
3797          * Look for a cache entry.  Cache entries are identified
3798          * by the NFS cookie value and the byte count requested.
3799          */
3800         srdc.nfs3_cookie = uiop->uio_loffset;
3801         srdc.buflen = count;
3802         rdc = avl_find(&rp->r_dir, &srdc, &where);
3803         if (rdc != NULL) {
3804                 rddir_cache_hold(rdc);
3805                 /*
3806                  * If the cache entry is in the process of being
3807                  * filled in, wait until this completes.  The
3808                  * RDDIRWAIT bit is set to indicate that someone
3809                  * is waiting and then the thread currently
3810                  * filling the entry is done, it should do a
3811                  * cv_broadcast to wakeup all of the threads
3812                  * waiting for it to finish.
3813                  */
3814                 if (rdc->flags & RDDIR) {
3815                         nfs_rw_exit(&rp->r_rwlock);
3816                         rdc->flags |= RDDIRWAIT;
3817 #ifdef DEBUG
3818                         nfs3_readdir_cache_waits++;
3819 #endif
3820                         if (!cv_wait_sig(&rdc->cv, &rp->r_statelock)) {
3821                                 /*
3822                                  * We got interrupted, probably
3823                                  * the user typed ^C or an alarm
3824                                  * fired.  We free the new entry
3825                                  * if we allocated one.
3826                                  */
3827                                 mutex_exit(&rp->r_statelock);
3828                                 (void) nfs_rw_enter_sig(&rp->r_rwlock,
3829                                     RW_READER, FALSE);
3830                                 rddir_cache_rele(rdc);
3831                                 if (nrdc != NULL)
3832                                         rddir_cache_rele(nrdc);
3833                                 return (EINTR);
3834                         }
3835                         mutex_exit(&rp->r_statelock);
3836                         (void) nfs_rw_enter_sig(&rp->r_rwlock,
3837                             RW_READER, FALSE);
3838                         rddir_cache_rele(rdc);
3839                         goto top;
3840                 }
3841                 /*
3842                  * Check to see if a readdir is required to
3843                  * fill the entry.  If so, mark this entry
3844                  * as being filled, remove our reference,
3845                  * and branch to the code to fill the entry.
3846                  */
3847                 if (rdc->flags & RDDIRREQ) {
3848                         rdc->flags &= ~RDDIRREQ;
3849                         rdc->flags |= RDDIR;
3850                         if (nrdc != NULL)
3851                                 rddir_cache_rele(nrdc);
3852                         nrdc = rdc;
3853                         mutex_exit(&rp->r_statelock);
3854                         goto bottom;
3855                 }
3856 #ifdef DEBUG
3857                 if (!missed)
3858                         nfs3_readdir_cache_hits++;
3859 #endif
3860                 /*
3861                  * If an error occurred while attempting
3862                  * to fill the cache entry, just return it.
3863                  */
3864                 if (rdc->error) {
3865                         error = rdc->error;
3866                         mutex_exit(&rp->r_statelock);
3867                         rddir_cache_rele(rdc);
3868                         if (nrdc != NULL)
3869                                 rddir_cache_rele(nrdc);
3870                         return (error);
3871                 }
3872 
3873                 /*
3874                  * The cache entry is complete and good,
3875                  * copyout the dirent structs to the calling
3876                  * thread.
3877                  */
3878                 error = uiomove(rdc->entries, rdc->entlen, UIO_READ, uiop);
3879 
3880                 /*
3881                  * If no error occurred during the copyout,
3882                  * update the offset in the uio struct to
3883                  * contain the value of the next cookie
3884                  * and set the eof value appropriately.
3885                  */
3886                 if (!error) {
3887                         uiop->uio_loffset = rdc->nfs3_ncookie;
3888                         if (eofp)
3889                                 *eofp = rdc->eof;
3890                 }
3891 
3892                 /*
3893                  * Decide whether to do readahead.
3894                  *
3895                  * Don't if have already read to the end of
3896                  * directory.  There is nothing more to read.
3897                  *
3898                  * Don't if the application is not doing
3899                  * lookups in the directory.  The readahead
3900                  * is only effective if the application can
3901                  * be doing work while an async thread is
3902                  * handling the over the wire request.
3903                  */
3904                 if (rdc->eof) {
3905                         rp->r_direof = rdc;
3906                         doreadahead = FALSE;
3907                 } else if (!(rp->r_flags & RLOOKUP))
3908                         doreadahead = FALSE;
3909                 else
3910                         doreadahead = TRUE;
3911 
3912                 if (!doreadahead) {
3913                         mutex_exit(&rp->r_statelock);
3914                         rddir_cache_rele(rdc);
3915                         if (nrdc != NULL)
3916                                 rddir_cache_rele(nrdc);
3917                         return (error);
3918                 }
3919 
3920                 /*
3921                  * Check to see whether we found an entry
3922                  * for the readahead.  If so, we don't need
3923                  * to do anything further, so free the new
3924                  * entry if one was allocated.  Otherwise,
3925                  * allocate a new entry, add it to the cache,
3926                  * and then initiate an asynchronous readdir
3927                  * operation to fill it.
3928                  */
3929                 srdc.nfs3_cookie = rdc->nfs3_ncookie;
3930                 srdc.buflen = count;
3931                 rrdc = avl_find(&rp->r_dir, &srdc, &where);
3932                 if (rrdc != NULL) {
3933                         if (nrdc != NULL)
3934                                 rddir_cache_rele(nrdc);
3935                 } else {
3936                         if (nrdc != NULL)
3937                                 rrdc = nrdc;
3938                         else {
3939                                 rrdc = rddir_cache_alloc(KM_NOSLEEP);
3940                         }
3941                         if (rrdc != NULL) {
3942                                 rrdc->nfs3_cookie = rdc->nfs3_ncookie;
3943                                 rrdc->buflen = count;
3944                                 avl_insert(&rp->r_dir, rrdc, where);
3945                                 rddir_cache_hold(rrdc);
3946                                 mutex_exit(&rp->r_statelock);
3947                                 rddir_cache_rele(rdc);
3948 #ifdef DEBUG
3949                                 nfs3_readdir_readahead++;
3950 #endif
3951                                 nfs_async_readdir(vp, rrdc, cr, do_nfs3readdir);
3952                                 return (error);
3953                         }
3954                 }
3955 
3956                 mutex_exit(&rp->r_statelock);
3957                 rddir_cache_rele(rdc);
3958                 return (error);
3959         }
3960 
3961         /*
3962          * Didn't find an entry in the cache.  Construct a new empty
3963          * entry and link it into the cache.  Other processes attempting
3964          * to access this entry will need to wait until it is filled in.
3965          *
3966          * Since kmem_alloc may block, another pass through the cache
3967          * will need to be taken to make sure that another process
3968          * hasn't already added an entry to the cache for this request.
3969          */
3970         if (nrdc == NULL) {
3971                 mutex_exit(&rp->r_statelock);
3972                 nrdc = rddir_cache_alloc(KM_SLEEP);
3973                 nrdc->nfs3_cookie = uiop->uio_loffset;
3974                 nrdc->buflen = count;
3975                 goto top;
3976         }
3977 
3978         /*
3979          * Add this entry to the cache.
3980          */
3981         avl_insert(&rp->r_dir, nrdc, where);
3982         rddir_cache_hold(nrdc);
3983         mutex_exit(&rp->r_statelock);
3984 
3985 bottom:
3986 #ifdef DEBUG
3987         missed = 1;
3988         nfs3_readdir_cache_misses++;
3989 #endif
3990         /*
3991          * Do the readdir.  This routine decides whether to use
3992          * READDIR or READDIRPLUS.
3993          */
3994         error = do_nfs3readdir(vp, nrdc, cr);
3995 
3996         /*
3997          * If this operation failed, just return the error which occurred.
3998          */
3999         if (error != 0)
4000                 return (error);
4001 
4002         /*
4003          * Since the RPC operation will have taken sometime and blocked
4004          * this process, another pass through the cache will need to be
4005          * taken to find the correct cache entry.  It is possible that
4006          * the correct cache entry will not be there (although one was
4007          * added) because the directory changed during the RPC operation
4008          * and the readdir cache was flushed.  In this case, just start
4009          * over.  It is hoped that this will not happen too often... :-)
4010          */
4011         nrdc = NULL;
4012         goto top;
4013         /* NOTREACHED */
4014 }
4015 
4016 static int
4017 do_nfs3readdir(vnode_t *vp, rddir_cache *rdc, cred_t *cr)
4018 {
4019         int error;
4020         rnode_t *rp;
4021         mntinfo_t *mi;
4022 
4023         rp = VTOR(vp);
4024         mi = VTOMI(vp);
4025         ASSERT(nfs_zone() == mi->mi_zone);
4026         /*
4027          * Issue the proper request.
4028          *
4029          * If the server does not support READDIRPLUS, then use READDIR.
4030          *
4031          * Otherwise --
4032          * Issue a READDIRPLUS if reading to fill an empty cache or if
4033          * an application has performed a lookup in the directory which
4034          * required an over the wire lookup.  The use of READDIRPLUS
4035          * will help to (re)populate the DNLC.
4036          */
4037         if (!(mi->mi_flags & MI_READDIRONLY) &&
4038             (rp->r_flags & (RLOOKUP | RREADDIRPLUS))) {
4039                 if (rp->r_flags & RREADDIRPLUS) {
4040                         mutex_enter(&rp->r_statelock);
4041                         rp->r_flags &= ~RREADDIRPLUS;
4042                         mutex_exit(&rp->r_statelock);
4043                 }
4044                 nfs3readdirplus(vp, rdc, cr);
4045                 if (rdc->error == EOPNOTSUPP)
4046                         nfs3readdir(vp, rdc, cr);
4047         } else
4048                 nfs3readdir(vp, rdc, cr);
4049 
4050         mutex_enter(&rp->r_statelock);
4051         rdc->flags &= ~RDDIR;
4052         if (rdc->flags & RDDIRWAIT) {
4053                 rdc->flags &= ~RDDIRWAIT;
4054                 cv_broadcast(&rdc->cv);
4055         }
4056         error = rdc->error;
4057         if (error)
4058                 rdc->flags |= RDDIRREQ;
4059         mutex_exit(&rp->r_statelock);
4060 
4061         rddir_cache_rele(rdc);
4062 
4063         return (error);
4064 }
4065 
4066 static void
4067 nfs3readdir(vnode_t *vp, rddir_cache *rdc, cred_t *cr)
4068 {
4069         int error;
4070         READDIR3args args;
4071         READDIR3vres res;
4072         vattr_t dva;
4073         rnode_t *rp;
4074         int douprintf;
4075         failinfo_t fi, *fip = NULL;
4076         mntinfo_t *mi;
4077         hrtime_t t;
4078 
4079         rp = VTOR(vp);
4080         mi = VTOMI(vp);
4081         ASSERT(nfs_zone() == mi->mi_zone);
4082 
4083         args.dir = *RTOFH3(rp);
4084         args.cookie = (cookie3)rdc->nfs3_cookie;
4085         args.cookieverf = rp->r_cookieverf;
4086         args.count = rdc->buflen;
4087 
4088         /*
4089          * NFS client failover support
4090          * suppress failover unless we have a zero cookie
4091          */
4092         if (args.cookie == (cookie3) 0) {
4093                 fi.vp = vp;
4094                 fi.fhp = (caddr_t)&args.dir;
4095                 fi.copyproc = nfs3copyfh;
4096                 fi.lookupproc = nfs3lookup;
4097                 fi.xattrdirproc = acl_getxattrdir3;
4098                 fip = &fi;
4099         }
4100 
4101 #ifdef DEBUG
4102         rdc->entries = rddir_cache_buf_alloc(rdc->buflen, KM_SLEEP);
4103 #else
4104         rdc->entries = kmem_alloc(rdc->buflen, KM_SLEEP);
4105 #endif
4106 
4107         res.entries = (dirent64_t *)rdc->entries;
4108         res.entries_size = rdc->buflen;
4109         res.dir_attributes.fres.vap = &dva;
4110         res.dir_attributes.fres.vp = vp;
4111         res.loff = rdc->nfs3_cookie;
4112 
4113         douprintf = 1;
4114 
4115         if (mi->mi_io_kstats) {
4116                 mutex_enter(&mi->mi_lock);
4117                 kstat_runq_enter(KSTAT_IO_PTR(mi->mi_io_kstats));
4118                 mutex_exit(&mi->mi_lock);
4119         }
4120 
4121         t = gethrtime();
4122 
4123         error = rfs3call(VTOMI(vp), NFSPROC3_READDIR,
4124             xdr_READDIR3args, (caddr_t)&args,
4125             xdr_READDIR3vres, (caddr_t)&res, cr,
4126             &douprintf, &res.status, 0, fip);
4127 
4128         if (mi->mi_io_kstats) {
4129                 mutex_enter(&mi->mi_lock);
4130                 kstat_runq_exit(KSTAT_IO_PTR(mi->mi_io_kstats));
4131                 mutex_exit(&mi->mi_lock);
4132         }
4133 
4134         if (error)
4135                 goto err;
4136 
4137         nfs3_cache_post_op_vattr(vp, &res.dir_attributes, t, cr);
4138 
4139         error = geterrno3(res.status);
4140         if (error) {
4141                 PURGE_STALE_FH(error, vp, cr);
4142                 goto err;
4143         }
4144 
4145         if (mi->mi_io_kstats) {
4146                 mutex_enter(&mi->mi_lock);
4147                 KSTAT_IO_PTR(mi->mi_io_kstats)->reads++;
4148                 KSTAT_IO_PTR(mi->mi_io_kstats)->nread += res.size;
4149                 mutex_exit(&mi->mi_lock);
4150         }
4151 
4152         rdc->nfs3_ncookie = res.loff;
4153         rp->r_cookieverf = res.cookieverf;
4154         rdc->eof = res.eof ? 1 : 0;
4155         rdc->entlen = res.size;
4156         ASSERT(rdc->entlen <= rdc->buflen);
4157         rdc->error = 0;
4158         return;
4159 
4160 err:
4161         kmem_free(rdc->entries, rdc->buflen);
4162         rdc->entries = NULL;
4163         rdc->error = error;
4164 }
4165 
4166 /*
4167  * Read directory entries.
4168  * There are some weird things to look out for here.  The uio_loffset
4169  * field is either 0 or it is the offset returned from a previous
4170  * readdir.  It is an opaque value used by the server to find the
4171  * correct directory block to read. The count field is the number
4172  * of blocks to read on the server.  This is advisory only, the server
4173  * may return only one block's worth of entries.  Entries may be compressed
4174  * on the server.
4175  */
4176 static void
4177 nfs3readdirplus(vnode_t *vp, rddir_cache *rdc, cred_t *cr)
4178 {
4179         int error;
4180         READDIRPLUS3args args;
4181         READDIRPLUS3vres res;
4182         vattr_t dva;
4183         rnode_t *rp;
4184         mntinfo_t *mi;
4185         int douprintf;
4186         failinfo_t fi, *fip = NULL;
4187 
4188         rp = VTOR(vp);
4189         mi = VTOMI(vp);
4190         ASSERT(nfs_zone() == mi->mi_zone);
4191 
4192         args.dir = *RTOFH3(rp);
4193         args.cookie = (cookie3)rdc->nfs3_cookie;
4194         args.cookieverf = rp->r_cookieverf;
4195         args.dircount = rdc->buflen;
4196         args.maxcount = mi->mi_tsize;
4197 
4198         /*
4199          * NFS client failover support
4200          * suppress failover unless we have a zero cookie
4201          */
4202         if (args.cookie == (cookie3)0) {
4203                 fi.vp = vp;
4204                 fi.fhp = (caddr_t)&args.dir;
4205                 fi.copyproc = nfs3copyfh;
4206                 fi.lookupproc = nfs3lookup;
4207                 fi.xattrdirproc = acl_getxattrdir3;
4208                 fip = &fi;
4209         }
4210 
4211 #ifdef DEBUG
4212         rdc->entries = rddir_cache_buf_alloc(rdc->buflen, KM_SLEEP);
4213 #else
4214         rdc->entries = kmem_alloc(rdc->buflen, KM_SLEEP);
4215 #endif
4216 
4217         res.entries = (dirent64_t *)rdc->entries;
4218         res.entries_size = rdc->buflen;
4219         res.dir_attributes.fres.vap = &dva;
4220         res.dir_attributes.fres.vp = vp;
4221         res.loff = rdc->nfs3_cookie;
4222         res.credentials = cr;
4223 
4224         douprintf = 1;
4225 
4226         if (mi->mi_io_kstats) {
4227                 mutex_enter(&mi->mi_lock);
4228                 kstat_runq_enter(KSTAT_IO_PTR(mi->mi_io_kstats));
4229                 mutex_exit(&mi->mi_lock);
4230         }
4231 
4232         res.time = gethrtime();
4233 
4234         error = rfs3call(mi, NFSPROC3_READDIRPLUS,
4235             xdr_READDIRPLUS3args, (caddr_t)&args,
4236             xdr_READDIRPLUS3vres, (caddr_t)&res, cr,
4237             &douprintf, &res.status, 0, fip);
4238 
4239         if (mi->mi_io_kstats) {
4240                 mutex_enter(&mi->mi_lock);
4241                 kstat_runq_exit(KSTAT_IO_PTR(mi->mi_io_kstats));
4242                 mutex_exit(&mi->mi_lock);
4243         }
4244 
4245         if (error) {
4246                 goto err;
4247         }
4248 
4249         nfs3_cache_post_op_vattr(vp, &res.dir_attributes, res.time, cr);
4250 
4251         error = geterrno3(res.status);
4252         if (error) {
4253                 PURGE_STALE_FH(error, vp, cr);
4254                 if (error == EOPNOTSUPP) {
4255                         mutex_enter(&mi->mi_lock);
4256                         mi->mi_flags |= MI_READDIRONLY;
4257                         mutex_exit(&mi->mi_lock);
4258                 }
4259                 goto err;
4260         }
4261 
4262         if (mi->mi_io_kstats) {
4263                 mutex_enter(&mi->mi_lock);
4264                 KSTAT_IO_PTR(mi->mi_io_kstats)->reads++;
4265                 KSTAT_IO_PTR(mi->mi_io_kstats)->nread += res.size;
4266                 mutex_exit(&mi->mi_lock);
4267         }
4268 
4269         rdc->nfs3_ncookie = res.loff;
4270         rp->r_cookieverf = res.cookieverf;
4271         rdc->eof = res.eof ? 1 : 0;
4272         rdc->entlen = res.size;
4273         ASSERT(rdc->entlen <= rdc->buflen);
4274         rdc->error = 0;
4275 
4276         return;
4277 
4278 err:
4279         kmem_free(rdc->entries, rdc->buflen);
4280         rdc->entries = NULL;
4281         rdc->error = error;
4282 }
4283 
4284 #ifdef DEBUG
4285 static int nfs3_bio_do_stop = 0;
4286 #endif
4287 
4288 static int
4289 nfs3_bio(struct buf *bp, stable_how *stab_comm, cred_t *cr)
4290 {
4291         rnode_t *rp = VTOR(bp->b_vp);
4292         int count;
4293         int error;
4294         cred_t *cred;
4295         offset_t offset;
4296 
4297         ASSERT(nfs_zone() == VTOMI(bp->b_vp)->mi_zone);
4298         offset = ldbtob(bp->b_lblkno);
4299 
4300         DTRACE_IO1(start, struct buf *, bp);
4301 
4302         if (bp->b_flags & B_READ) {
4303                 mutex_enter(&rp->r_statelock);
4304                 if (rp->r_cred != NULL) {
4305                         cred = rp->r_cred;
4306                         crhold(cred);
4307                 } else {
4308                         rp->r_cred = cr;
4309                         crhold(cr);
4310                         cred = cr;
4311                         crhold(cred);
4312                 }
4313                 mutex_exit(&rp->r_statelock);
4314         read_again:
4315                 error = bp->b_error = nfs3read(bp->b_vp, bp->b_un.b_addr,
4316                     offset, bp->b_bcount, &bp->b_resid, cred);
4317                 crfree(cred);
4318                 if (!error) {
4319                         if (bp->b_resid) {
4320                                 /*
4321                                  * Didn't get it all because we hit EOF,
4322                                  * zero all the memory beyond the EOF.
4323                                  */
4324                                 /* bzero(rdaddr + */
4325                                 bzero(bp->b_un.b_addr +
4326                                     bp->b_bcount - bp->b_resid, bp->b_resid);
4327                         }
4328                         mutex_enter(&rp->r_statelock);
4329                         if (bp->b_resid == bp->b_bcount &&
4330                             offset >= rp->r_size) {
4331                                 /*
4332                                  * We didn't read anything at all as we are
4333                                  * past EOF.  Return an error indicator back
4334                                  * but don't destroy the pages (yet).
4335                                  */
4336                                 error = NFS_EOF;
4337                         }
4338                         mutex_exit(&rp->r_statelock);
4339                 } else if (error == EACCES) {
4340                         mutex_enter(&rp->r_statelock);
4341                         if (cred != cr) {
4342                                 if (rp->r_cred != NULL)
4343                                         crfree(rp->r_cred);
4344                                 rp->r_cred = cr;
4345                                 crhold(cr);
4346                                 cred = cr;
4347                                 crhold(cred);
4348                                 mutex_exit(&rp->r_statelock);
4349                                 goto read_again;
4350                         }
4351                         mutex_exit(&rp->r_statelock);
4352                 }
4353         } else {
4354                 if (!(rp->r_flags & RSTALE)) {
4355                         mutex_enter(&rp->r_statelock);
4356                         if (rp->r_cred != NULL) {
4357                                 cred = rp->r_cred;
4358                                 crhold(cred);
4359                         } else {
4360                                 rp->r_cred = cr;
4361                                 crhold(cr);
4362                                 cred = cr;
4363                                 crhold(cred);
4364                         }
4365                         mutex_exit(&rp->r_statelock);
4366                 write_again:
4367                         mutex_enter(&rp->r_statelock);
4368                         count = MIN(bp->b_bcount, rp->r_size - offset);
4369                         mutex_exit(&rp->r_statelock);
4370                         if (count < 0)
4371                                 cmn_err(CE_PANIC, "nfs3_bio: write count < 0");
4372 #ifdef DEBUG
4373                         if (count == 0) {
4374                                 zcmn_err(getzoneid(), CE_WARN,
4375                                     "nfs3_bio: zero length write at %lld",
4376                                     offset);
4377                                 nfs_printfhandle(&rp->r_fh);
4378                                 if (nfs3_bio_do_stop)
4379                                         debug_enter("nfs3_bio");
4380                         }
4381 #endif
4382                         error = nfs3write(bp->b_vp, bp->b_un.b_addr, offset,
4383                             count, cred, stab_comm);
4384                         if (error == EACCES) {
4385                                 mutex_enter(&rp->r_statelock);
4386                                 if (cred != cr) {
4387                                         if (rp->r_cred != NULL)
4388                                                 crfree(rp->r_cred);
4389                                         rp->r_cred = cr;
4390                                         crhold(cr);
4391                                         crfree(cred);
4392                                         cred = cr;
4393                                         crhold(cred);
4394                                         mutex_exit(&rp->r_statelock);
4395                                         goto write_again;
4396                                 }
4397                                 mutex_exit(&rp->r_statelock);
4398                         }
4399                         bp->b_error = error;
4400                         if (error && error != EINTR) {
4401                                 /*
4402                                  * Don't print EDQUOT errors on the console.
4403                                  * Don't print asynchronous EACCES errors.
4404                                  * Don't print EFBIG errors.
4405                                  * Print all other write errors.
4406                                  */
4407                                 if (error != EDQUOT && error != EFBIG &&
4408                                     (error != EACCES ||
4409                                     !(bp->b_flags & B_ASYNC)))
4410                                         nfs_write_error(bp->b_vp, error, cred);
4411                                 /*
4412                                  * Update r_error and r_flags as appropriate.
4413                                  * If the error was ESTALE, then mark the
4414                                  * rnode as not being writeable and save
4415                                  * the error status.  Otherwise, save any
4416                                  * errors which occur from asynchronous
4417                                  * page invalidations.  Any errors occurring
4418                                  * from other operations should be saved
4419                                  * by the caller.
4420                                  */
4421                                 mutex_enter(&rp->r_statelock);
4422                                 if (error == ESTALE) {
4423                                         rp->r_flags |= RSTALE;
4424                                         if (!rp->r_error)
4425                                                 rp->r_error = error;
4426                                 } else if (!rp->r_error &&
4427                                     (bp->b_flags &
4428                                     (B_INVAL|B_FORCE|B_ASYNC)) ==
4429                                     (B_INVAL|B_FORCE|B_ASYNC)) {
4430                                         rp->r_error = error;
4431                                 }
4432                                 mutex_exit(&rp->r_statelock);
4433                         }
4434                         crfree(cred);
4435                 } else {
4436                         error = rp->r_error;
4437                         /*
4438                          * A close may have cleared r_error, if so,
4439                          * propagate ESTALE error return properly
4440                          */
4441                         if (error == 0)
4442                                 error = ESTALE;
4443                 }
4444         }
4445 
4446         if (error != 0 && error != NFS_EOF)
4447                 bp->b_flags |= B_ERROR;
4448 
4449         DTRACE_IO1(done, struct buf *, bp);
4450 
4451         return (error);
4452 }
4453 
4454 /* ARGSUSED */
4455 static int
4456 nfs3_fid(vnode_t *vp, fid_t *fidp, caller_context_t *ct)
4457 {
4458         rnode_t *rp;
4459 
4460         if (nfs_zone() != VTOMI(vp)->mi_zone)
4461                 return (EIO);
4462         rp = VTOR(vp);
4463 
4464         if (fidp->fid_len < (ushort_t)rp->r_fh.fh_len) {
4465                 fidp->fid_len = rp->r_fh.fh_len;
4466                 return (ENOSPC);
4467         }
4468         fidp->fid_len = rp->r_fh.fh_len;
4469         bcopy(rp->r_fh.fh_buf, fidp->fid_data, fidp->fid_len);
4470         return (0);
4471 }
4472 
4473 /* ARGSUSED2 */
4474 static int
4475 nfs3_rwlock(vnode_t *vp, int write_lock, caller_context_t *ctp)
4476 {
4477         rnode_t *rp = VTOR(vp);
4478 
4479         if (!write_lock) {
4480                 (void) nfs_rw_enter_sig(&rp->r_rwlock, RW_READER, FALSE);
4481                 return (V_WRITELOCK_FALSE);
4482         }
4483 
4484         if ((rp->r_flags & RDIRECTIO) || (VTOMI(vp)->mi_flags & MI_DIRECTIO)) {
4485                 (void) nfs_rw_enter_sig(&rp->r_rwlock, RW_READER, FALSE);
4486                 if (rp->r_mapcnt == 0 && !vn_has_cached_data(vp))
4487                         return (V_WRITELOCK_FALSE);
4488                 nfs_rw_exit(&rp->r_rwlock);
4489         }
4490 
4491         (void) nfs_rw_enter_sig(&rp->r_rwlock, RW_WRITER, FALSE);
4492         return (V_WRITELOCK_TRUE);
4493 }
4494 
4495 /* ARGSUSED */
4496 static void
4497 nfs3_rwunlock(vnode_t *vp, int write_lock, caller_context_t *ctp)
4498 {
4499         rnode_t *rp = VTOR(vp);
4500 
4501         nfs_rw_exit(&rp->r_rwlock);
4502 }
4503 
4504 /* ARGSUSED */
4505 static int
4506 nfs3_seek(vnode_t *vp, offset_t ooff, offset_t *noffp, caller_context_t *ct)
4507 {
4508 
4509         /*
4510          * Because we stuff the readdir cookie into the offset field
4511          * someone may attempt to do an lseek with the cookie which
4512          * we want to succeed.
4513          */
4514         if (vp->v_type == VDIR)
4515                 return (0);
4516         if (*noffp < 0)
4517                 return (EINVAL);
4518         return (0);
4519 }
4520 
4521 /*
4522  * number of nfs3_bsize blocks to read ahead.
4523  */
4524 volatile int nfs3_nra = 4;
4525 
4526 #ifdef DEBUG
4527 static int nfs3_lostpage = 0;   /* number of times we lost original page */
4528 #endif
4529 
4530 /*
4531  * Return all the pages from [off..off+len) in file
4532  */
4533 /* ARGSUSED */
4534 static int
4535 nfs3_getpage(vnode_t *vp, offset_t off, size_t len, uint_t *protp,
4536         page_t *pl[], size_t plsz, struct seg *seg, caddr_t addr,
4537         enum seg_rw rw, cred_t *cr, caller_context_t *ct)
4538 {
4539         rnode_t *rp;
4540         int error;
4541         mntinfo_t *mi;
4542 
4543         if (vp->v_flag & VNOMAP)
4544                 return (ENOSYS);
4545 
4546         if (nfs_zone() != VTOMI(vp)->mi_zone)
4547                 return (EIO);
4548         if (protp != NULL)
4549                 *protp = PROT_ALL;
4550 
4551         /*
4552          * Now valididate that the caches are up to date.
4553          */
4554         error = nfs3_validate_caches(vp, cr);
4555         if (error)
4556                 return (error);
4557 
4558         rp = VTOR(vp);
4559         mi = VTOMI(vp);
4560 retry:
4561         mutex_enter(&rp->r_statelock);
4562 
4563         /*
4564          * Don't create dirty pages faster than they
4565          * can be cleaned so that the system doesn't
4566          * get imbalanced.  If the async queue is
4567          * maxed out, then wait for it to drain before
4568          * creating more dirty pages.  Also, wait for
4569          * any threads doing pagewalks in the vop_getattr
4570          * entry points so that they don't block for
4571          * long periods.
4572          */
4573         if (rw == S_CREATE) {
4574                 while ((mi->mi_max_threads != 0 &&
4575                     rp->r_awcount > 2 * mi->mi_max_threads) ||
4576                     rp->r_gcount > 0)
4577                         cv_wait(&rp->r_cv, &rp->r_statelock);
4578         }
4579 
4580         /*
4581          * If we are getting called as a side effect of an nfs_write()
4582          * operation the local file size might not be extended yet.
4583          * In this case we want to be able to return pages of zeroes.
4584          */
4585         if (off + len > rp->r_size + PAGEOFFSET && seg != segkmap) {
4586                 mutex_exit(&rp->r_statelock);
4587                 return (EFAULT);                /* beyond EOF */
4588         }
4589 
4590         mutex_exit(&rp->r_statelock);
4591 
4592         error = pvn_getpages(nfs3_getapage, vp, off, len, protp,
4593             pl, plsz, seg, addr, rw, cr);
4594 
4595         switch (error) {
4596         case NFS_EOF:
4597                 nfs_purge_caches(vp, NFS_NOPURGE_DNLC, cr);
4598                 goto retry;
4599         case ESTALE:
4600                 PURGE_STALE_FH(error, vp, cr);
4601         }
4602 
4603         return (error);
4604 }
4605 
4606 /*
4607  * Called from pvn_getpages to get a particular page.
4608  */
4609 /* ARGSUSED */
4610 static int
4611 nfs3_getapage(vnode_t *vp, u_offset_t off, size_t len, uint_t *protp,
4612         page_t *pl[], size_t plsz, struct seg *seg, caddr_t addr,
4613         enum seg_rw rw, cred_t *cr)
4614 {
4615         rnode_t *rp;
4616         uint_t bsize;
4617         struct buf *bp;
4618         page_t *pp;
4619         u_offset_t lbn;
4620         u_offset_t io_off;
4621         u_offset_t blkoff;
4622         u_offset_t rablkoff;
4623         size_t io_len;
4624         uint_t blksize;
4625         int error;
4626         int readahead;
4627         int readahead_issued = 0;
4628         int ra_window; /* readahead window */
4629         page_t *pagefound;
4630         page_t *savepp;
4631 
4632         if (nfs_zone() != VTOMI(vp)->mi_zone)
4633                 return (EIO);
4634         rp = VTOR(vp);
4635         bsize = MAX(vp->v_vfsp->vfs_bsize, PAGESIZE);
4636 
4637 reread:
4638         bp = NULL;
4639         pp = NULL;
4640         pagefound = NULL;
4641 
4642         if (pl != NULL)
4643                 pl[0] = NULL;
4644 
4645         error = 0;
4646         lbn = off / bsize;
4647         blkoff = lbn * bsize;
4648 
4649         /*
4650          * Queueing up the readahead before doing the synchronous read
4651          * results in a significant increase in read throughput because
4652          * of the increased parallelism between the async threads and
4653          * the process context.
4654          */
4655         if ((off & ((vp->v_vfsp->vfs_bsize) - 1)) == 0 &&
4656             rw != S_CREATE &&
4657             !(vp->v_flag & VNOCACHE)) {
4658                 mutex_enter(&rp->r_statelock);
4659 
4660                 /*
4661                  * Calculate the number of readaheads to do.
4662                  * a) No readaheads at offset = 0.
4663                  * b) Do maximum(nfs3_nra) readaheads when the readahead
4664                  *    window is closed.
4665                  * c) Do readaheads between 1 to (nfs3_nra - 1) depending
4666                  *    upon how far the readahead window is open or close.
4667                  * d) No readaheads if rp->r_nextr is not within the scope
4668                  *    of the readahead window (random i/o).
4669                  */
4670 
4671                 if (off == 0)
4672                         readahead = 0;
4673                 else if (blkoff == rp->r_nextr)
4674                         readahead = nfs3_nra;
4675                 else if (rp->r_nextr > blkoff &&
4676                     ((ra_window = (rp->r_nextr - blkoff) / bsize)
4677                     <= (nfs3_nra - 1)))
4678                         readahead = nfs3_nra - ra_window;
4679                 else
4680                         readahead = 0;
4681 
4682                 rablkoff = rp->r_nextr;
4683                 while (readahead > 0 && rablkoff + bsize < rp->r_size) {
4684                         mutex_exit(&rp->r_statelock);
4685                         if (nfs_async_readahead(vp, rablkoff + bsize,
4686                             addr + (rablkoff + bsize - off), seg, cr,
4687                             nfs3_readahead) < 0) {
4688                                 mutex_enter(&rp->r_statelock);
4689                                 break;
4690                         }
4691                         readahead--;
4692                         rablkoff += bsize;
4693                         /*
4694                          * Indicate that we did a readahead so
4695                          * readahead offset is not updated
4696                          * by the synchronous read below.
4697                          */
4698                         readahead_issued = 1;
4699                         mutex_enter(&rp->r_statelock);
4700                         /*
4701                          * set readahead offset to
4702                          * offset of last async readahead
4703                          * request.
4704                          */
4705                         rp->r_nextr = rablkoff;
4706                 }
4707                 mutex_exit(&rp->r_statelock);
4708         }
4709 
4710 again:
4711         if ((pagefound = page_exists(vp, off)) == NULL) {
4712                 if (pl == NULL) {
4713                         (void) nfs_async_readahead(vp, blkoff, addr, seg, cr,
4714                             nfs3_readahead);
4715                 } else if (rw == S_CREATE) {
4716                         /*
4717                          * Block for this page is not allocated, or the offset
4718                          * is beyond the current allocation size, or we're
4719                          * allocating a swap slot and the page was not found,
4720                          * so allocate it and return a zero page.
4721                          */
4722                         if ((pp = page_create_va(vp, off,
4723                             PAGESIZE, PG_WAIT, seg, addr)) == NULL)
4724                                 cmn_err(CE_PANIC, "nfs3_getapage: page_create");
4725                         io_len = PAGESIZE;
4726                         mutex_enter(&rp->r_statelock);
4727                         rp->r_nextr = off + PAGESIZE;
4728                         mutex_exit(&rp->r_statelock);
4729                 } else {
4730                         /*
4731                          * Need to go to server to get a BLOCK, exception to
4732                          * that being while reading at offset = 0 or doing
4733                          * random i/o, in that case read only a PAGE.
4734                          */
4735                         mutex_enter(&rp->r_statelock);
4736                         if (blkoff < rp->r_size &&
4737                             blkoff + bsize >= rp->r_size) {
4738                                 /*
4739                                  * If only a block or less is left in
4740                                  * the file, read all that is remaining.
4741                                  */
4742                                 if (rp->r_size <= off) {
4743                                         /*
4744                                          * Trying to access beyond EOF,
4745                                          * set up to get at least one page.
4746                                          */
4747                                         blksize = off + PAGESIZE - blkoff;
4748                                 } else
4749                                         blksize = rp->r_size - blkoff;
4750                         } else if ((off == 0) ||
4751                             (off != rp->r_nextr && !readahead_issued)) {
4752                                 blksize = PAGESIZE;
4753                                 blkoff = off; /* block = page here */
4754                         } else
4755                                 blksize = bsize;
4756                         mutex_exit(&rp->r_statelock);
4757 
4758                         pp = pvn_read_kluster(vp, off, seg, addr, &io_off,
4759                             &io_len, blkoff, blksize, 0);
4760 
4761                         /*
4762                          * Some other thread has entered the page,
4763                          * so just use it.
4764                          */
4765                         if (pp == NULL)
4766                                 goto again;
4767 
4768                         /*
4769                          * Now round the request size up to page boundaries.
4770                          * This ensures that the entire page will be
4771                          * initialized to zeroes if EOF is encountered.
4772                          */
4773                         io_len = ptob(btopr(io_len));
4774 
4775                         bp = pageio_setup(pp, io_len, vp, B_READ);
4776                         ASSERT(bp != NULL);
4777 
4778                         /*
4779                          * pageio_setup should have set b_addr to 0.  This
4780                          * is correct since we want to do I/O on a page
4781                          * boundary.  bp_mapin will use this addr to calculate
4782                          * an offset, and then set b_addr to the kernel virtual
4783                          * address it allocated for us.
4784                          */
4785                         ASSERT(bp->b_un.b_addr == 0);
4786 
4787                         bp->b_edev = 0;
4788                         bp->b_dev = 0;
4789                         bp->b_lblkno = lbtodb(io_off);
4790                         bp->b_file = vp;
4791                         bp->b_offset = (offset_t)off;
4792                         bp_mapin(bp);
4793 
4794                         /*
4795                          * If doing a write beyond what we believe is EOF,
4796                          * don't bother trying to read the pages from the
4797                          * server, we'll just zero the pages here.  We
4798                          * don't check that the rw flag is S_WRITE here
4799                          * because some implementations may attempt a
4800                          * read access to the buffer before copying data.
4801                          */
4802                         mutex_enter(&rp->r_statelock);
4803                         if (io_off >= rp->r_size && seg == segkmap) {
4804                                 mutex_exit(&rp->r_statelock);
4805                                 bzero(bp->b_un.b_addr, io_len);
4806                         } else {
4807                                 mutex_exit(&rp->r_statelock);
4808                                 error = nfs3_bio(bp, NULL, cr);
4809                         }
4810 
4811                         /*
4812                          * Unmap the buffer before freeing it.
4813                          */
4814                         bp_mapout(bp);
4815                         pageio_done(bp);
4816 
4817                         savepp = pp;
4818                         do {
4819                                 pp->p_fsdata = C_NOCOMMIT;
4820                         } while ((pp = pp->p_next) != savepp);
4821 
4822                         if (error == NFS_EOF) {
4823                                 /*
4824                                  * If doing a write system call just return
4825                                  * zeroed pages, else user tried to get pages
4826                                  * beyond EOF, return error.  We don't check
4827                                  * that the rw flag is S_WRITE here because
4828                                  * some implementations may attempt a read
4829                                  * access to the buffer before copying data.
4830                                  */
4831                                 if (seg == segkmap)
4832                                         error = 0;
4833                                 else
4834                                         error = EFAULT;
4835                         }
4836 
4837                         if (!readahead_issued && !error) {
4838                                 mutex_enter(&rp->r_statelock);
4839                                 rp->r_nextr = io_off + io_len;
4840                                 mutex_exit(&rp->r_statelock);
4841                         }
4842                 }
4843         }
4844 
4845 out:
4846         if (pl == NULL)
4847                 return (error);
4848 
4849         if (error) {
4850                 if (pp != NULL)
4851                         pvn_read_done(pp, B_ERROR);
4852                 return (error);
4853         }
4854 
4855         if (pagefound) {
4856                 se_t se = (rw == S_CREATE ? SE_EXCL : SE_SHARED);
4857 
4858                 /*
4859                  * Page exists in the cache, acquire the appropriate lock.
4860                  * If this fails, start all over again.
4861                  */
4862                 if ((pp = page_lookup(vp, off, se)) == NULL) {
4863 #ifdef DEBUG
4864                         nfs3_lostpage++;
4865 #endif
4866                         goto reread;
4867                 }
4868                 pl[0] = pp;
4869                 pl[1] = NULL;
4870                 return (0);
4871         }
4872 
4873         if (pp != NULL)
4874                 pvn_plist_init(pp, pl, plsz, off, io_len, rw);
4875 
4876         return (error);
4877 }
4878 
4879 static void
4880 nfs3_readahead(vnode_t *vp, u_offset_t blkoff, caddr_t addr, struct seg *seg,
4881         cred_t *cr)
4882 {
4883         int error;
4884         page_t *pp;
4885         u_offset_t io_off;
4886         size_t io_len;
4887         struct buf *bp;
4888         uint_t bsize, blksize;
4889         rnode_t *rp = VTOR(vp);
4890         page_t *savepp;
4891 
4892         ASSERT(nfs_zone() == VTOMI(vp)->mi_zone);
4893         bsize = MAX(vp->v_vfsp->vfs_bsize, PAGESIZE);
4894 
4895         mutex_enter(&rp->r_statelock);
4896         if (blkoff < rp->r_size && blkoff + bsize > rp->r_size) {
4897                 /*
4898                  * If less than a block left in file read less
4899                  * than a block.
4900                  */
4901                 blksize = rp->r_size - blkoff;
4902         } else
4903                 blksize = bsize;
4904         mutex_exit(&rp->r_statelock);
4905 
4906         pp = pvn_read_kluster(vp, blkoff, segkmap, addr,
4907             &io_off, &io_len, blkoff, blksize, 1);
4908         /*
4909          * The isra flag passed to the kluster function is 1, we may have
4910          * gotten a return value of NULL for a variety of reasons (# of free
4911          * pages < minfree, someone entered the page on the vnode etc). In all
4912          * cases, we want to punt on the readahead.
4913          */
4914         if (pp == NULL)
4915                 return;
4916 
4917         /*
4918          * Now round the request size up to page boundaries.
4919          * This ensures that the entire page will be
4920          * initialized to zeroes if EOF is encountered.
4921          */
4922         io_len = ptob(btopr(io_len));
4923 
4924         bp = pageio_setup(pp, io_len, vp, B_READ);
4925         ASSERT(bp != NULL);
4926 
4927         /*
4928          * pageio_setup should have set b_addr to 0.  This is correct since
4929          * we want to do I/O on a page boundary. bp_mapin() will use this addr
4930          * to calculate an offset, and then set b_addr to the kernel virtual
4931          * address it allocated for us.
4932          */
4933         ASSERT(bp->b_un.b_addr == 0);
4934 
4935         bp->b_edev = 0;
4936         bp->b_dev = 0;
4937         bp->b_lblkno = lbtodb(io_off);
4938         bp->b_file = vp;
4939         bp->b_offset = (offset_t)blkoff;
4940         bp_mapin(bp);
4941 
4942         /*
4943          * If doing a write beyond what we believe is EOF, don't bother trying
4944          * to read the pages from the server, we'll just zero the pages here.
4945          * We don't check that the rw flag is S_WRITE here because some
4946          * implementations may attempt a read access to the buffer before
4947          * copying data.
4948          */
4949         mutex_enter(&rp->r_statelock);
4950         if (io_off >= rp->r_size && seg == segkmap) {
4951                 mutex_exit(&rp->r_statelock);
4952                 bzero(bp->b_un.b_addr, io_len);
4953                 error = 0;
4954         } else {
4955                 mutex_exit(&rp->r_statelock);
4956                 error = nfs3_bio(bp, NULL, cr);
4957                 if (error == NFS_EOF)
4958                         error = 0;
4959         }
4960 
4961         /*
4962          * Unmap the buffer before freeing it.
4963          */
4964         bp_mapout(bp);
4965         pageio_done(bp);
4966 
4967         savepp = pp;
4968         do {
4969                 pp->p_fsdata = C_NOCOMMIT;
4970         } while ((pp = pp->p_next) != savepp);
4971 
4972         pvn_read_done(pp, error ? B_READ | B_ERROR : B_READ);
4973 
4974         /*
4975          * In case of error set readahead offset
4976          * to the lowest offset.
4977          * pvn_read_done() calls VN_DISPOSE to destroy the pages
4978          */
4979         if (error && rp->r_nextr > io_off) {
4980                 mutex_enter(&rp->r_statelock);
4981                 if (rp->r_nextr > io_off)
4982                         rp->r_nextr = io_off;
4983                 mutex_exit(&rp->r_statelock);
4984         }
4985 }
4986 
4987 /*
4988  * Flags are composed of {B_INVAL, B_FREE, B_DONTNEED, B_FORCE}
4989  * If len == 0, do from off to EOF.
4990  *
4991  * The normal cases should be len == 0 && off == 0 (entire vp list),
4992  * len == MAXBSIZE (from segmap_release actions), and len == PAGESIZE
4993  * (from pageout).
4994  */
4995 /* ARGSUSED */
4996 static int
4997 nfs3_putpage(vnode_t *vp, offset_t off, size_t len, int flags, cred_t *cr,
4998         caller_context_t *ct)
4999 {
5000         int error;
5001         rnode_t *rp;
5002 
5003         ASSERT(cr != NULL);
5004 
5005         /*
5006          * XXX - Why should this check be made here?
5007          */
5008         if (vp->v_flag & VNOMAP)
5009                 return (ENOSYS);
5010         if (len == 0 && !(flags & B_INVAL) && vn_is_readonly(vp))
5011                 return (0);
5012         if (!(flags & B_ASYNC) && nfs_zone() != VTOMI(vp)->mi_zone)
5013                 return (EIO);
5014 
5015         rp = VTOR(vp);
5016         mutex_enter(&rp->r_statelock);
5017         rp->r_count++;
5018         mutex_exit(&rp->r_statelock);
5019         error = nfs_putpages(vp, off, len, flags, cr);
5020         mutex_enter(&rp->r_statelock);
5021         rp->r_count--;
5022         cv_broadcast(&rp->r_cv);
5023         mutex_exit(&rp->r_statelock);
5024 
5025         return (error);
5026 }
5027 
5028 /*
5029  * Write out a single page, possibly klustering adjacent dirty pages.
5030  */
5031 int
5032 nfs3_putapage(vnode_t *vp, page_t *pp, u_offset_t *offp, size_t *lenp,
5033         int flags, cred_t *cr)
5034 {
5035         u_offset_t io_off;
5036         u_offset_t lbn_off;
5037         u_offset_t lbn;
5038         size_t io_len;
5039         uint_t bsize;
5040         int error;
5041         rnode_t *rp;
5042 
5043         ASSERT(!vn_is_readonly(vp));
5044         ASSERT(pp != NULL);
5045         ASSERT(cr != NULL);
5046         ASSERT((flags & B_ASYNC) || nfs_zone() == VTOMI(vp)->mi_zone);
5047 
5048         rp = VTOR(vp);
5049         ASSERT(rp->r_count > 0);
5050 
5051         bsize = MAX(vp->v_vfsp->vfs_bsize, PAGESIZE);
5052         lbn = pp->p_offset / bsize;
5053         lbn_off = lbn * bsize;
5054 
5055         /*
5056          * Find a kluster that fits in one block, or in
5057          * one page if pages are bigger than blocks.  If
5058          * there is less file space allocated than a whole
5059          * page, we'll shorten the i/o request below.
5060          */
5061         pp = pvn_write_kluster(vp, pp, &io_off, &io_len, lbn_off,
5062             roundup(bsize, PAGESIZE), flags);
5063 
5064         /*
5065          * pvn_write_kluster shouldn't have returned a page with offset
5066          * behind the original page we were given.  Verify that.
5067          */
5068         ASSERT((pp->p_offset / bsize) >= lbn);
5069 
5070         /*
5071          * Now pp will have the list of kept dirty pages marked for
5072          * write back.  It will also handle invalidation and freeing
5073          * of pages that are not dirty.  Check for page length rounding
5074          * problems.
5075          */
5076         if (io_off + io_len > lbn_off + bsize) {
5077                 ASSERT((io_off + io_len) - (lbn_off + bsize) < PAGESIZE);
5078                 io_len = lbn_off + bsize - io_off;
5079         }
5080         /*
5081          * The RMODINPROGRESS flag makes sure that nfs(3)_bio() sees a
5082          * consistent value of r_size. RMODINPROGRESS is set in writerp().
5083          * When RMODINPROGRESS is set it indicates that a uiomove() is in
5084          * progress and the r_size has not been made consistent with the
5085          * new size of the file. When the uiomove() completes the r_size is
5086          * updated and the RMODINPROGRESS flag is cleared.
5087          *
5088          * The RMODINPROGRESS flag makes sure that nfs(3)_bio() sees a
5089          * consistent value of r_size. Without this handshaking, it is
5090          * possible that nfs(3)_bio() picks  up the old value of r_size
5091          * before the uiomove() in writerp() completes. This will result
5092          * in the write through nfs(3)_bio() being dropped.
5093          *
5094          * More precisely, there is a window between the time the uiomove()
5095          * completes and the time the r_size is updated. If a VOP_PUTPAGE()
5096          * operation intervenes in this window, the page will be picked up,
5097          * because it is dirty (it will be unlocked, unless it was
5098          * pagecreate'd). When the page is picked up as dirty, the dirty
5099          * bit is reset (pvn_getdirty()). In nfs(3)write(), r_size is
5100          * checked. This will still be the old size. Therefore the page will
5101          * not be written out. When segmap_release() calls VOP_PUTPAGE(),
5102          * the page will be found to be clean and the write will be dropped.
5103          */
5104         if (rp->r_flags & RMODINPROGRESS) {
5105                 mutex_enter(&rp->r_statelock);
5106                 if ((rp->r_flags & RMODINPROGRESS) &&
5107                     rp->r_modaddr + MAXBSIZE > io_off &&
5108                     rp->r_modaddr < io_off + io_len) {
5109                         page_t *plist;
5110                         /*
5111                          * A write is in progress for this region of the file.
5112                          * If we did not detect RMODINPROGRESS here then this
5113                          * path through nfs_putapage() would eventually go to
5114                          * nfs(3)_bio() and may not write out all of the data
5115                          * in the pages. We end up losing data. So we decide
5116                          * to set the modified bit on each page in the page
5117                          * list and mark the rnode with RDIRTY. This write
5118                          * will be restarted at some later time.
5119                          */
5120                         plist = pp;
5121                         while (plist != NULL) {
5122                                 pp = plist;
5123                                 page_sub(&plist, pp);
5124                                 hat_setmod(pp);
5125                                 page_io_unlock(pp);
5126                                 page_unlock(pp);
5127                         }
5128                         rp->r_flags |= RDIRTY;
5129                         mutex_exit(&rp->r_statelock);
5130                         if (offp)
5131                                 *offp = io_off;
5132                         if (lenp)
5133                                 *lenp = io_len;
5134                         return (0);
5135                 }
5136                 mutex_exit(&rp->r_statelock);
5137         }
5138 
5139         if (flags & B_ASYNC) {
5140                 error = nfs_async_putapage(vp, pp, io_off, io_len, flags, cr,
5141                     nfs3_sync_putapage);
5142         } else
5143                 error = nfs3_sync_putapage(vp, pp, io_off, io_len, flags, cr);
5144 
5145         if (offp)
5146                 *offp = io_off;
5147         if (lenp)
5148                 *lenp = io_len;
5149         return (error);
5150 }
5151 
5152 static int
5153 nfs3_sync_putapage(vnode_t *vp, page_t *pp, u_offset_t io_off, size_t io_len,
5154         int flags, cred_t *cr)
5155 {
5156         int error;
5157         rnode_t *rp;
5158 
5159         ASSERT(nfs_zone() == VTOMI(vp)->mi_zone);
5160 
5161         flags |= B_WRITE;
5162 
5163         error = nfs3_rdwrlbn(vp, pp, io_off, io_len, flags, cr);
5164 
5165         rp = VTOR(vp);
5166 
5167         if ((error == ENOSPC || error == EDQUOT || error == EFBIG ||
5168             error == EACCES) &&
5169             (flags & (B_INVAL|B_FORCE)) != (B_INVAL|B_FORCE)) {
5170                 if (!(rp->r_flags & ROUTOFSPACE)) {
5171                         mutex_enter(&rp->r_statelock);
5172                         rp->r_flags |= ROUTOFSPACE;
5173                         mutex_exit(&rp->r_statelock);
5174                 }
5175                 flags |= B_ERROR;
5176                 pvn_write_done(pp, flags);
5177                 /*
5178                  * If this was not an async thread, then try again to
5179                  * write out the pages, but this time, also destroy
5180                  * them whether or not the write is successful.  This
5181                  * will prevent memory from filling up with these
5182                  * pages and destroying them is the only alternative
5183                  * if they can't be written out.
5184                  *
5185                  * Don't do this if this is an async thread because
5186                  * when the pages are unlocked in pvn_write_done,
5187                  * some other thread could have come along, locked
5188                  * them, and queued for an async thread.  It would be
5189                  * possible for all of the async threads to be tied
5190                  * up waiting to lock the pages again and they would
5191                  * all already be locked and waiting for an async
5192                  * thread to handle them.  Deadlock.
5193                  */
5194                 if (!(flags & B_ASYNC)) {
5195                         error = nfs3_putpage(vp, io_off, io_len,
5196                             B_INVAL | B_FORCE, cr, NULL);
5197                 }
5198         } else {
5199                 if (error)
5200                         flags |= B_ERROR;
5201                 else if (rp->r_flags & ROUTOFSPACE) {
5202                         mutex_enter(&rp->r_statelock);
5203                         rp->r_flags &= ~ROUTOFSPACE;
5204                         mutex_exit(&rp->r_statelock);
5205                 }
5206                 pvn_write_done(pp, flags);
5207                 if (freemem < desfree)
5208                         (void) nfs3_commit_vp(vp, (u_offset_t)0, 0, cr);
5209         }
5210 
5211         return (error);
5212 }
5213 
5214 /* ARGSUSED */
5215 static int
5216 nfs3_map(vnode_t *vp, offset_t off, struct as *as, caddr_t *addrp,
5217         size_t len, uchar_t prot, uchar_t maxprot, uint_t flags,
5218         cred_t *cr, caller_context_t *ct)
5219 {
5220         struct segvn_crargs vn_a;
5221         int error;
5222         rnode_t *rp;
5223         struct vattr va;
5224 
5225         if (nfs_zone() != VTOMI(vp)->mi_zone)
5226                 return (EIO);
5227 
5228         if (vp->v_flag & VNOMAP)
5229                 return (ENOSYS);
5230 
5231         if (off < 0 || off + len < 0)
5232                 return (ENXIO);
5233 
5234         if (vp->v_type != VREG)
5235                 return (ENODEV);
5236 
5237         /*
5238          * If there is cached data and if close-to-open consistency
5239          * checking is not turned off and if the file system is not
5240          * mounted readonly, then force an over the wire getattr.
5241          * Otherwise, just invoke nfs3getattr to get a copy of the
5242          * attributes.  The attribute cache will be used unless it
5243          * is timed out and if it is, then an over the wire getattr
5244          * will be issued.
5245          */
5246         va.va_mask = AT_ALL;
5247         if (vn_has_cached_data(vp) &&
5248             !(VTOMI(vp)->mi_flags & MI_NOCTO) && !vn_is_readonly(vp))
5249                 error = nfs3_getattr_otw(vp, &va, cr);
5250         else
5251                 error = nfs3getattr(vp, &va, cr);
5252         if (error)
5253                 return (error);
5254 
5255         /*
5256          * Check to see if the vnode is currently marked as not cachable.
5257          * This means portions of the file are locked (through VOP_FRLOCK).
5258          * In this case the map request must be refused.  We use
5259          * rp->r_lkserlock to avoid a race with concurrent lock requests.
5260          */
5261         rp = VTOR(vp);
5262 
5263         /*
5264          * Atomically increment r_inmap after acquiring r_rwlock. The
5265          * idea here is to acquire r_rwlock to block read/write and
5266          * not to protect r_inmap. r_inmap will inform nfs3_read/write()
5267          * that we are in nfs3_map(). Now, r_rwlock is acquired in order
5268          * and we can prevent the deadlock that would have occurred
5269          * when nfs3_addmap() would have acquired it out of order.
5270          *
5271          * Since we are not protecting r_inmap by any lock, we do not
5272          * hold any lock when we decrement it. We atomically decrement
5273          * r_inmap after we release r_lkserlock.
5274          */
5275 
5276         if (nfs_rw_enter_sig(&rp->r_rwlock, RW_WRITER, INTR(vp)))
5277                 return (EINTR);
5278         atomic_inc_uint(&rp->r_inmap);
5279         nfs_rw_exit(&rp->r_rwlock);
5280 
5281         if (nfs_rw_enter_sig(&rp->r_lkserlock, RW_READER, INTR(vp))) {
5282                 atomic_dec_uint(&rp->r_inmap);
5283                 return (EINTR);
5284         }
5285 
5286         if (vp->v_flag & VNOCACHE) {
5287                 error = EAGAIN;
5288                 goto done;
5289         }
5290 
5291         /*
5292          * Don't allow concurrent locks and mapping if mandatory locking is
5293          * enabled.
5294          */
5295         if ((flk_has_remote_locks(vp) || lm_has_sleep(vp)) &&
5296             MANDLOCK(vp, va.va_mode)) {
5297                 error = EAGAIN;
5298                 goto done;
5299         }
5300 
5301         as_rangelock(as);
5302         error = choose_addr(as, addrp, len, off, ADDR_VACALIGN, flags);
5303         if (error != 0) {
5304                 as_rangeunlock(as);
5305                 goto done;
5306         }
5307 
5308         vn_a.vp = vp;
5309         vn_a.offset = off;
5310         vn_a.type = (flags & MAP_TYPE);
5311         vn_a.prot = (uchar_t)prot;
5312         vn_a.maxprot = (uchar_t)maxprot;
5313         vn_a.flags = (flags & ~MAP_TYPE);
5314         vn_a.cred = cr;
5315         vn_a.amp = NULL;
5316         vn_a.szc = 0;
5317         vn_a.lgrp_mem_policy_flags = 0;
5318 
5319         error = as_map(as, *addrp, len, segvn_create, &vn_a);
5320         as_rangeunlock(as);
5321 
5322 done:
5323         nfs_rw_exit(&rp->r_lkserlock);
5324         atomic_dec_uint(&rp->r_inmap);
5325         return (error);
5326 }
5327 
5328 /* ARGSUSED */
5329 static int
5330 nfs3_addmap(vnode_t *vp, offset_t off, struct as *as, caddr_t addr,
5331         size_t len, uchar_t prot, uchar_t maxprot, uint_t flags,
5332         cred_t *cr, caller_context_t *ct)
5333 {
5334         rnode_t *rp;
5335 
5336         if (vp->v_flag & VNOMAP)
5337                 return (ENOSYS);
5338         if (nfs_zone() != VTOMI(vp)->mi_zone)
5339                 return (EIO);
5340 
5341         rp = VTOR(vp);
5342         atomic_add_long((ulong_t *)&rp->r_mapcnt, btopr(len));
5343 
5344         return (0);
5345 }
5346 
5347 /* ARGSUSED */
5348 static int
5349 nfs3_frlock(vnode_t *vp, int cmd, struct flock64 *bfp, int flag,
5350         offset_t offset, struct flk_callback *flk_cbp, cred_t *cr,
5351         caller_context_t *ct)
5352 {
5353         netobj lm_fh3;
5354         int rc;
5355         u_offset_t start, end;
5356         rnode_t *rp;
5357         int error = 0, intr = INTR(vp);
5358 
5359         if (nfs_zone() != VTOMI(vp)->mi_zone)
5360                 return (EIO);
5361         /* check for valid cmd parameter */
5362         if (cmd != F_GETLK && cmd != F_SETLK && cmd != F_SETLKW)
5363                 return (EINVAL);
5364 
5365         /* Verify l_type. */
5366         switch (bfp->l_type) {
5367         case F_RDLCK:
5368                 if (cmd != F_GETLK && !(flag & FREAD))
5369                         return (EBADF);
5370                 break;
5371         case F_WRLCK:
5372                 if (cmd != F_GETLK && !(flag & FWRITE))
5373                         return (EBADF);
5374                 break;
5375         case F_UNLCK:
5376                 intr = 0;
5377                 break;
5378 
5379         default:
5380                 return (EINVAL);
5381         }
5382 
5383         /* check the validity of the lock range */
5384         if (rc = flk_convert_lock_data(vp, bfp, &start, &end, offset))
5385                 return (rc);
5386         if (rc = flk_check_lock_data(start, end, MAXEND))
5387                 return (rc);
5388 
5389         /*
5390          * If the filesystem is mounted using local locking, pass the
5391          * request off to the local locking code.
5392          */
5393         if (VTOMI(vp)->mi_flags & MI_LLOCK) {
5394                 if (cmd == F_SETLK || cmd == F_SETLKW) {
5395                         /*
5396                          * For complete safety, we should be holding
5397                          * r_lkserlock.  However, we can't call
5398                          * lm_safelock and then fs_frlock while
5399                          * holding r_lkserlock, so just invoke
5400                          * lm_safelock and expect that this will
5401                          * catch enough of the cases.
5402                          */
5403                         if (!lm_safelock(vp, bfp, cr))
5404                                 return (EAGAIN);
5405                 }
5406                 return (fs_frlock(vp, cmd, bfp, flag, offset, flk_cbp, cr, ct));
5407         }
5408 
5409         rp = VTOR(vp);
5410 
5411         /*
5412          * Check whether the given lock request can proceed, given the
5413          * current file mappings.
5414          */
5415         if (nfs_rw_enter_sig(&rp->r_lkserlock, RW_WRITER, intr))
5416                 return (EINTR);
5417         if (cmd == F_SETLK || cmd == F_SETLKW) {
5418                 if (!lm_safelock(vp, bfp, cr)) {
5419                         rc = EAGAIN;
5420                         goto done;
5421                 }
5422         }
5423 
5424         /*
5425          * Flush the cache after waiting for async I/O to finish.  For new
5426          * locks, this is so that the process gets the latest bits from the
5427          * server.  For unlocks, this is so that other clients see the
5428          * latest bits once the file has been unlocked.  If currently dirty
5429          * pages can't be flushed, then don't allow a lock to be set.  But
5430          * allow unlocks to succeed, to avoid having orphan locks on the
5431          * server.
5432          */
5433         if (cmd != F_GETLK) {
5434                 mutex_enter(&rp->r_statelock);
5435                 while (rp->r_count > 0) {
5436                         if (intr) {
5437                                 klwp_t *lwp = ttolwp(curthread);
5438 
5439                                 if (lwp != NULL)
5440                                         lwp->lwp_nostop++;
5441                                 if (cv_wait_sig(&rp->r_cv,
5442                                     &rp->r_statelock) == 0) {
5443                                         if (lwp != NULL)
5444                                                 lwp->lwp_nostop--;
5445                                         rc = EINTR;
5446                                         break;
5447                                 }
5448                                 if (lwp != NULL)
5449                                         lwp->lwp_nostop--;
5450                         } else
5451                                 cv_wait(&rp->r_cv, &rp->r_statelock);
5452                 }
5453                 mutex_exit(&rp->r_statelock);
5454                 if (rc != 0)
5455                         goto done;
5456                 error = nfs3_putpage(vp, (offset_t)0, 0, B_INVAL, cr, ct);
5457                 if (error) {
5458                         if (error == ENOSPC || error == EDQUOT) {
5459                                 mutex_enter(&rp->r_statelock);
5460                                 if (!rp->r_error)
5461                                         rp->r_error = error;
5462                                 mutex_exit(&rp->r_statelock);
5463                         }
5464                         if (bfp->l_type != F_UNLCK) {
5465                                 rc = ENOLCK;
5466                                 goto done;
5467                         }
5468                 }
5469         }
5470 
5471         lm_fh3.n_len = VTOFH3(vp)->fh3_length;
5472         lm_fh3.n_bytes = (char *)&(VTOFH3(vp)->fh3_u.data);
5473 
5474         /*
5475          * Call the lock manager to do the real work of contacting
5476          * the server and obtaining the lock.
5477          */
5478         rc = lm4_frlock(vp, cmd, bfp, flag, offset, cr, &lm_fh3, flk_cbp);
5479 
5480         if (rc == 0)
5481                 nfs_lockcompletion(vp, cmd);
5482 
5483 done:
5484         nfs_rw_exit(&rp->r_lkserlock);
5485         return (rc);
5486 }
5487 
5488 /*
5489  * Free storage space associated with the specified vnode.  The portion
5490  * to be freed is specified by bfp->l_start and bfp->l_len (already
5491  * normalized to a "whence" of 0).
5492  *
5493  * This is an experimental facility whose continued existence is not
5494  * guaranteed.  Currently, we only support the special case
5495  * of l_len == 0, meaning free to end of file.
5496  */
5497 /* ARGSUSED */
5498 static int
5499 nfs3_space(vnode_t *vp, int cmd, struct flock64 *bfp, int flag,
5500         offset_t offset, cred_t *cr, caller_context_t *ct)
5501 {
5502         int error;
5503 
5504         ASSERT(vp->v_type == VREG);
5505         if (cmd != F_FREESP)
5506                 return (EINVAL);
5507         if (nfs_zone() != VTOMI(vp)->mi_zone)
5508                 return (EIO);
5509 
5510         error = convoff(vp, bfp, 0, offset);
5511         if (!error) {
5512                 ASSERT(bfp->l_start >= 0);
5513                 if (bfp->l_len == 0) {
5514                         struct vattr va;
5515 
5516                         /*
5517                          * ftruncate should not change the ctime and
5518                          * mtime if we truncate the file to its
5519                          * previous size.
5520                          */
5521                         va.va_mask = AT_SIZE;
5522                         error = nfs3getattr(vp, &va, cr);
5523                         if (error || va.va_size == bfp->l_start)
5524                                 return (error);
5525                         va.va_mask = AT_SIZE;
5526                         va.va_size = bfp->l_start;
5527                         error = nfs3setattr(vp, &va, 0, cr);
5528 
5529                         if (error == 0 && bfp->l_start == 0)
5530                                 vnevent_truncate(vp, ct);
5531                 } else
5532                         error = EINVAL;
5533         }
5534 
5535         return (error);
5536 }
5537 
5538 /* ARGSUSED */
5539 static int
5540 nfs3_realvp(vnode_t *vp, vnode_t **vpp, caller_context_t *ct)
5541 {
5542 
5543         return (EINVAL);
5544 }
5545 
5546 /*
5547  * Setup and add an address space callback to do the work of the delmap call.
5548  * The callback will (and must be) deleted in the actual callback function.
5549  *
5550  * This is done in order to take care of the problem that we have with holding
5551  * the address space's a_lock for a long period of time (e.g. if the NFS server
5552  * is down).  Callbacks will be executed in the address space code while the
5553  * a_lock is not held.  Holding the address space's a_lock causes things such
5554  * as ps and fork to hang because they are trying to acquire this lock as well.
5555  */
5556 /* ARGSUSED */
5557 static int
5558 nfs3_delmap(vnode_t *vp, offset_t off, struct as *as, caddr_t addr,
5559         size_t len, uint_t prot, uint_t maxprot, uint_t flags,
5560         cred_t *cr, caller_context_t *ct)
5561 {
5562         int                     caller_found;
5563         int                     error;
5564         rnode_t                 *rp;
5565         nfs_delmap_args_t       *dmapp;
5566         nfs_delmapcall_t        *delmap_call;
5567 
5568         if (vp->v_flag & VNOMAP)
5569                 return (ENOSYS);
5570         /*
5571          * A process may not change zones if it has NFS pages mmap'ed
5572          * in, so we can't legitimately get here from the wrong zone.
5573          */
5574         ASSERT(nfs_zone() == VTOMI(vp)->mi_zone);
5575 
5576         rp = VTOR(vp);
5577 
5578         /*
5579          * The way that the address space of this process deletes its mapping
5580          * of this file is via the following call chains:
5581          * - as_free()->SEGOP_UNMAP()/segvn_unmap()->VOP_DELMAP()/nfs3_delmap()
5582          * - as_unmap()->SEGOP_UNMAP()/segvn_unmap()->VOP_DELMAP()/nfs3_delmap()
5583          *
5584          * With the use of address space callbacks we are allowed to drop the
5585          * address space lock, a_lock, while executing the NFS operations that
5586          * need to go over the wire.  Returning EAGAIN to the caller of this
5587          * function is what drives the execution of the callback that we add
5588          * below.  The callback will be executed by the address space code
5589          * after dropping the a_lock.  When the callback is finished, since
5590          * we dropped the a_lock, it must be re-acquired and segvn_unmap()
5591          * is called again on the same segment to finish the rest of the work
5592          * that needs to happen during unmapping.
5593          *
5594          * This action of calling back into the segment driver causes
5595          * nfs3_delmap() to get called again, but since the callback was
5596          * already executed at this point, it already did the work and there
5597          * is nothing left for us to do.
5598          *
5599          * To Summarize:
5600          * - The first time nfs3_delmap is called by the current thread is when
5601          * we add the caller associated with this delmap to the delmap caller
5602          * list, add the callback, and return EAGAIN.
5603          * - The second time in this call chain when nfs3_delmap is called we
5604          * will find this caller in the delmap caller list and realize there
5605          * is no more work to do thus removing this caller from the list and
5606          * returning the error that was set in the callback execution.
5607          */
5608         caller_found = nfs_find_and_delete_delmapcall(rp, &error);
5609         if (caller_found) {
5610                 /*
5611                  * 'error' is from the actual delmap operations.  To avoid
5612                  * hangs, we need to handle the return of EAGAIN differently
5613                  * since this is what drives the callback execution.
5614                  * In this case, we don't want to return EAGAIN and do the
5615                  * callback execution because there are none to execute.
5616                  */
5617                 if (error == EAGAIN)
5618                         return (0);
5619                 else
5620                         return (error);
5621         }
5622 
5623         /* current caller was not in the list */
5624         delmap_call = nfs_init_delmapcall();
5625 
5626         mutex_enter(&rp->r_statelock);
5627         list_insert_tail(&rp->r_indelmap, delmap_call);
5628         mutex_exit(&rp->r_statelock);
5629 
5630         dmapp = kmem_alloc(sizeof (nfs_delmap_args_t), KM_SLEEP);
5631 
5632         dmapp->vp = vp;
5633         dmapp->off = off;
5634         dmapp->addr = addr;
5635         dmapp->len = len;
5636         dmapp->prot = prot;
5637         dmapp->maxprot = maxprot;
5638         dmapp->flags = flags;
5639         dmapp->cr = cr;
5640         dmapp->caller = delmap_call;
5641 
5642         error = as_add_callback(as, nfs3_delmap_callback, dmapp,
5643             AS_UNMAP_EVENT, addr, len, KM_SLEEP);
5644 
5645         return (error ? error : EAGAIN);
5646 }
5647 
5648 /*
5649  * Remove some pages from an mmap'd vnode.  Just update the
5650  * count of pages.  If doing close-to-open, then flush and
5651  * commit all of the pages associated with this file.
5652  * Otherwise, start an asynchronous page flush to write out
5653  * any dirty pages.  This will also associate a credential
5654  * with the rnode which can be used to write the pages.
5655  */
5656 /* ARGSUSED */
5657 static void
5658 nfs3_delmap_callback(struct as *as, void *arg, uint_t event)
5659 {
5660         int                     error;
5661         rnode_t                 *rp;
5662         mntinfo_t               *mi;
5663         nfs_delmap_args_t       *dmapp = (nfs_delmap_args_t *)arg;
5664 
5665         rp = VTOR(dmapp->vp);
5666         mi = VTOMI(dmapp->vp);
5667 
5668         atomic_add_long((ulong_t *)&rp->r_mapcnt, -btopr(dmapp->len));
5669         ASSERT(rp->r_mapcnt >= 0);
5670 
5671         /*
5672          * Initiate a page flush and potential commit if there are
5673          * pages, the file system was not mounted readonly, the segment
5674          * was mapped shared, and the pages themselves were writeable.
5675          */
5676         if (vn_has_cached_data(dmapp->vp) && !vn_is_readonly(dmapp->vp) &&
5677             dmapp->flags == MAP_SHARED && (dmapp->maxprot & PROT_WRITE)) {
5678                 mutex_enter(&rp->r_statelock);
5679                 rp->r_flags |= RDIRTY;
5680                 mutex_exit(&rp->r_statelock);
5681                 /*
5682                  * If this is a cross-zone access a sync putpage won't work, so
5683                  * the best we can do is try an async putpage.  That seems
5684                  * better than something more draconian such as discarding the
5685                  * dirty pages.
5686                  */
5687                 if ((mi->mi_flags & MI_NOCTO) ||
5688                     nfs_zone() != mi->mi_zone)
5689                         error = nfs3_putpage(dmapp->vp, dmapp->off, dmapp->len,
5690                             B_ASYNC, dmapp->cr, NULL);
5691                 else
5692                         error = nfs3_putpage_commit(dmapp->vp, dmapp->off,
5693                             dmapp->len, dmapp->cr);
5694                 if (!error) {
5695                         mutex_enter(&rp->r_statelock);
5696                         error = rp->r_error;
5697                         rp->r_error = 0;
5698                         mutex_exit(&rp->r_statelock);
5699                 }
5700         } else
5701                 error = 0;
5702 
5703         if ((rp->r_flags & RDIRECTIO) || (mi->mi_flags & MI_DIRECTIO))
5704                 (void) nfs3_putpage(dmapp->vp, dmapp->off, dmapp->len,
5705                     B_INVAL, dmapp->cr, NULL);
5706 
5707         dmapp->caller->error = error;
5708         (void) as_delete_callback(as, arg);
5709         kmem_free(dmapp, sizeof (nfs_delmap_args_t));
5710 }
5711 
5712 volatile int nfs3_pathconf_disable_cache = 0;
5713 
5714 #ifdef DEBUG
5715 static int nfs3_pathconf_cache_hits = 0;
5716 static int nfs3_pathconf_cache_misses = 0;
5717 #endif
5718 
5719 /* ARGSUSED */
5720 static int
5721 nfs3_pathconf(vnode_t *vp, int cmd, ulong_t *valp, cred_t *cr,
5722         caller_context_t *ct)
5723 {
5724         int error;
5725         PATHCONF3args args;
5726         PATHCONF3res res;
5727         int douprintf;
5728         failinfo_t fi;
5729         rnode_t *rp;
5730         hrtime_t t;
5731 
5732         if (nfs_zone() != VTOMI(vp)->mi_zone)
5733                 return (EIO);
5734         /*
5735          * Large file spec - need to base answer on info stored
5736          * on original FSINFO response.
5737          */
5738         if (cmd == _PC_FILESIZEBITS) {
5739                 unsigned long long ll;
5740                 long l = 1;
5741 
5742                 ll = VTOMI(vp)->mi_maxfilesize;
5743 
5744                 if (ll == 0) {
5745                         *valp = 0;
5746                         return (0);
5747                 }
5748 
5749                 if (ll & 0xffffffff00000000) {
5750                         l += 32; ll >>= 32;
5751                 }
5752                 if (ll & 0xffff0000) {
5753                         l += 16; ll >>= 16;
5754                 }
5755                 if (ll & 0xff00) {
5756                         l += 8; ll >>= 8;
5757                 }
5758                 if (ll & 0xf0) {
5759                         l += 4; ll >>= 4;
5760                 }
5761                 if (ll & 0xc) {
5762                         l += 2; ll >>= 2;
5763                 }
5764                 if (ll & 0x2)
5765                         l += 2;
5766                 else if (ll & 0x1)
5767                         l += 1;
5768                 *valp = l;
5769                 return (0);
5770         }
5771 
5772         if (cmd == _PC_ACL_ENABLED) {
5773                 *valp = _ACL_ACLENT_ENABLED;
5774                 return (0);
5775         }
5776 
5777         if (cmd == _PC_XATTR_EXISTS) {
5778                 error = 0;
5779                 *valp = 0;
5780                 if (vp->v_vfsp->vfs_flag & VFS_XATTR) {
5781                         vnode_t *avp;
5782                         rnode_t *rp;
5783                         int error = 0;
5784                         mntinfo_t *mi = VTOMI(vp);
5785 
5786                         if (!(mi->mi_flags & MI_EXTATTR))
5787                                 return (0);
5788 
5789                         rp = VTOR(vp);
5790                         if (nfs_rw_enter_sig(&rp->r_rwlock, RW_READER,
5791                             INTR(vp)))
5792                                 return (EINTR);
5793 
5794                         error = nfs3lookup_dnlc(vp, XATTR_DIR_NAME, &avp, cr);
5795                         if (error || avp == NULL)
5796                                 error = acl_getxattrdir3(vp, &avp, 0, cr, 0);
5797 
5798                         nfs_rw_exit(&rp->r_rwlock);
5799 
5800                         if (error == 0 && avp != NULL) {
5801                                 error = do_xattr_exists_check(avp, valp, cr);
5802                                 VN_RELE(avp);
5803                         } else if (error == ENOENT) {
5804                                 error = 0;
5805                                 *valp = 0;
5806                         }
5807                 }
5808                 return (error);
5809         }
5810 
5811         rp = VTOR(vp);
5812         if (rp->r_pathconf != NULL) {
5813                 mutex_enter(&rp->r_statelock);
5814                 if (rp->r_pathconf != NULL && nfs3_pathconf_disable_cache) {
5815                         kmem_free(rp->r_pathconf, sizeof (*rp->r_pathconf));
5816                         rp->r_pathconf = NULL;
5817                 }
5818                 if (rp->r_pathconf != NULL) {
5819                         error = 0;
5820                         switch (cmd) {
5821                         case _PC_LINK_MAX:
5822                                 *valp = rp->r_pathconf->link_max;
5823                                 break;
5824                         case _PC_NAME_MAX:
5825                                 *valp = rp->r_pathconf->name_max;
5826                                 break;
5827                         case _PC_PATH_MAX:
5828                         case _PC_SYMLINK_MAX:
5829                                 *valp = MAXPATHLEN;
5830                                 break;
5831                         case _PC_CHOWN_RESTRICTED:
5832                                 *valp = rp->r_pathconf->chown_restricted;
5833                                 break;
5834                         case _PC_NO_TRUNC:
5835                                 *valp = rp->r_pathconf->no_trunc;
5836                                 break;
5837                         default:
5838                                 error = EINVAL;
5839                                 break;
5840                         }
5841                         mutex_exit(&rp->r_statelock);
5842 #ifdef DEBUG
5843                         nfs3_pathconf_cache_hits++;
5844 #endif
5845                         return (error);
5846                 }
5847                 mutex_exit(&rp->r_statelock);
5848         }
5849 #ifdef DEBUG
5850         nfs3_pathconf_cache_misses++;
5851 #endif
5852 
5853         args.object = *VTOFH3(vp);
5854         fi.vp = vp;
5855         fi.fhp = (caddr_t)&args.object;
5856         fi.copyproc = nfs3copyfh;
5857         fi.lookupproc = nfs3lookup;
5858         fi.xattrdirproc = acl_getxattrdir3;
5859 
5860         douprintf = 1;
5861 
5862         t = gethrtime();
5863 
5864         error = rfs3call(VTOMI(vp), NFSPROC3_PATHCONF,
5865             xdr_nfs_fh3, (caddr_t)&args,
5866             xdr_PATHCONF3res, (caddr_t)&res, cr,
5867             &douprintf, &res.status, 0, &fi);
5868 
5869         if (error)
5870                 return (error);
5871 
5872         error = geterrno3(res.status);
5873 
5874         if (!error) {
5875                 nfs3_cache_post_op_attr(vp, &res.resok.obj_attributes, t, cr);
5876                 if (!nfs3_pathconf_disable_cache) {
5877                         mutex_enter(&rp->r_statelock);
5878                         if (rp->r_pathconf == NULL) {
5879                                 rp->r_pathconf = kmem_alloc(
5880                                     sizeof (*rp->r_pathconf), KM_NOSLEEP);
5881                                 if (rp->r_pathconf != NULL)
5882                                         *rp->r_pathconf = res.resok.info;
5883                         }
5884                         mutex_exit(&rp->r_statelock);
5885                 }
5886                 switch (cmd) {
5887                 case _PC_LINK_MAX:
5888                         *valp = res.resok.info.link_max;
5889                         break;
5890                 case _PC_NAME_MAX:
5891                         *valp = res.resok.info.name_max;
5892                         break;
5893                 case _PC_PATH_MAX:
5894                 case _PC_SYMLINK_MAX:
5895                         *valp = MAXPATHLEN;
5896                         break;
5897                 case _PC_CHOWN_RESTRICTED:
5898                         *valp = res.resok.info.chown_restricted;
5899                         break;
5900                 case _PC_NO_TRUNC:
5901                         *valp = res.resok.info.no_trunc;
5902                         break;
5903                 default:
5904                         return (EINVAL);
5905                 }
5906         } else {
5907                 nfs3_cache_post_op_attr(vp, &res.resfail.obj_attributes, t, cr);
5908                 PURGE_STALE_FH(error, vp, cr);
5909         }
5910 
5911         return (error);
5912 }
5913 
5914 /*
5915  * Called by async thread to do synchronous pageio. Do the i/o, wait
5916  * for it to complete, and cleanup the page list when done.
5917  */
5918 static int
5919 nfs3_sync_pageio(vnode_t *vp, page_t *pp, u_offset_t io_off, size_t io_len,
5920         int flags, cred_t *cr)
5921 {
5922         int error;
5923 
5924         ASSERT(nfs_zone() == VTOMI(vp)->mi_zone);
5925         error = nfs3_rdwrlbn(vp, pp, io_off, io_len, flags, cr);
5926         if (flags & B_READ)
5927                 pvn_read_done(pp, (error ? B_ERROR : 0) | flags);
5928         else
5929                 pvn_write_done(pp, (error ? B_ERROR : 0) | flags);
5930         return (error);
5931 }
5932 
5933 /* ARGSUSED */
5934 static int
5935 nfs3_pageio(vnode_t *vp, page_t *pp, u_offset_t io_off, size_t io_len,
5936         int flags, cred_t *cr, caller_context_t *ct)
5937 {
5938         int error;
5939         rnode_t *rp;
5940 
5941         if (pp == NULL)
5942                 return (EINVAL);
5943         if (!(flags & B_ASYNC) && nfs_zone() != VTOMI(vp)->mi_zone)
5944                 return (EIO);
5945 
5946         rp = VTOR(vp);
5947         mutex_enter(&rp->r_statelock);
5948         rp->r_count++;
5949         mutex_exit(&rp->r_statelock);
5950 
5951         if (flags & B_ASYNC) {
5952                 error = nfs_async_pageio(vp, pp, io_off, io_len, flags, cr,
5953                     nfs3_sync_pageio);
5954         } else
5955                 error = nfs3_rdwrlbn(vp, pp, io_off, io_len, flags, cr);
5956         mutex_enter(&rp->r_statelock);
5957         rp->r_count--;
5958         cv_broadcast(&rp->r_cv);
5959         mutex_exit(&rp->r_statelock);
5960         return (error);
5961 }
5962 
5963 /* ARGSUSED */
5964 static void
5965 nfs3_dispose(vnode_t *vp, page_t *pp, int fl, int dn, cred_t *cr,
5966         caller_context_t *ct)
5967 {
5968         int error;
5969         rnode_t *rp;
5970         page_t *plist;
5971         page_t *pptr;
5972         offset3 offset;
5973         count3 len;
5974         k_sigset_t smask;
5975 
5976         /*
5977          * We should get called with fl equal to either B_FREE or
5978          * B_INVAL.  Any other value is illegal.
5979          *
5980          * The page that we are either supposed to free or destroy
5981          * should be exclusive locked and its io lock should not
5982          * be held.
5983          */
5984         ASSERT(fl == B_FREE || fl == B_INVAL);
5985         ASSERT((PAGE_EXCL(pp) && !page_iolock_assert(pp)) || panicstr);
5986         rp = VTOR(vp);
5987 
5988         /*
5989          * If the page doesn't need to be committed or we shouldn't
5990          * even bother attempting to commit it, then just make sure
5991          * that the p_fsdata byte is clear and then either free or
5992          * destroy the page as appropriate.
5993          */
5994         if (pp->p_fsdata == C_NOCOMMIT || (rp->r_flags & RSTALE)) {
5995                 pp->p_fsdata = C_NOCOMMIT;
5996                 if (fl == B_FREE)
5997                         page_free(pp, dn);
5998                 else
5999                         page_destroy(pp, dn);
6000                 return;
6001         }
6002 
6003         /*
6004          * If there is a page invalidation operation going on, then
6005          * if this is one of the pages being destroyed, then just
6006          * clear the p_fsdata byte and then either free or destroy
6007          * the page as appropriate.
6008          */
6009         mutex_enter(&rp->r_statelock);
6010         if ((rp->r_flags & RTRUNCATE) && pp->p_offset >= rp->r_truncaddr) {
6011                 mutex_exit(&rp->r_statelock);
6012                 pp->p_fsdata = C_NOCOMMIT;
6013                 if (fl == B_FREE)
6014                         page_free(pp, dn);
6015                 else
6016                         page_destroy(pp, dn);
6017                 return;
6018         }
6019 
6020         /*
6021          * If we are freeing this page and someone else is already
6022          * waiting to do a commit, then just unlock the page and
6023          * return.  That other thread will take care of commiting
6024          * this page.  The page can be freed sometime after the
6025          * commit has finished.  Otherwise, if the page is marked
6026          * as delay commit, then we may be getting called from
6027          * pvn_write_done, one page at a time.   This could result
6028          * in one commit per page, so we end up doing lots of small
6029          * commits instead of fewer larger commits.  This is bad,
6030          * we want do as few commits as possible.
6031          */
6032         if (fl == B_FREE) {
6033                 if (rp->r_flags & RCOMMITWAIT) {
6034                         page_unlock(pp);
6035                         mutex_exit(&rp->r_statelock);
6036                         return;
6037                 }
6038                 if (pp->p_fsdata == C_DELAYCOMMIT) {
6039                         pp->p_fsdata = C_COMMIT;
6040                         page_unlock(pp);
6041                         mutex_exit(&rp->r_statelock);
6042                         return;
6043                 }
6044         }
6045 
6046         /*
6047          * Check to see if there is a signal which would prevent an
6048          * attempt to commit the pages from being successful.  If so,
6049          * then don't bother with all of the work to gather pages and
6050          * generate the unsuccessful RPC.  Just return from here and
6051          * let the page be committed at some later time.
6052          */
6053         sigintr(&smask, VTOMI(vp)->mi_flags & MI_INT);
6054         if (ttolwp(curthread) != NULL && ISSIG(curthread, JUSTLOOKING)) {
6055                 sigunintr(&smask);
6056                 page_unlock(pp);
6057                 mutex_exit(&rp->r_statelock);
6058                 return;
6059         }
6060         sigunintr(&smask);
6061 
6062         /*
6063          * We are starting to need to commit pages, so let's try
6064          * to commit as many as possible at once to reduce the
6065          * overhead.
6066          *
6067          * Set the `commit inprogress' state bit.  We must
6068          * first wait until any current one finishes.  Then
6069          * we initialize the c_pages list with this page.
6070          */
6071         while (rp->r_flags & RCOMMIT) {
6072                 rp->r_flags |= RCOMMITWAIT;
6073                 cv_wait(&rp->r_commit.c_cv, &rp->r_statelock);
6074                 rp->r_flags &= ~RCOMMITWAIT;
6075         }
6076         rp->r_flags |= RCOMMIT;
6077         mutex_exit(&rp->r_statelock);
6078         ASSERT(rp->r_commit.c_pages == NULL);
6079         rp->r_commit.c_pages = pp;
6080         rp->r_commit.c_commbase = (offset3)pp->p_offset;
6081         rp->r_commit.c_commlen = PAGESIZE;
6082 
6083         /*
6084          * Gather together all other pages which can be committed.
6085          * They will all be chained off r_commit.c_pages.
6086          */
6087         nfs3_get_commit(vp);
6088 
6089         /*
6090          * Clear the `commit inprogress' status and disconnect
6091          * the list of pages to be committed from the rnode.
6092          * At this same time, we also save the starting offset
6093          * and length of data to be committed on the server.
6094          */
6095         plist = rp->r_commit.c_pages;
6096         rp->r_commit.c_pages = NULL;
6097         offset = rp->r_commit.c_commbase;
6098         len = rp->r_commit.c_commlen;
6099         mutex_enter(&rp->r_statelock);
6100         rp->r_flags &= ~RCOMMIT;
6101         cv_broadcast(&rp->r_commit.c_cv);
6102         mutex_exit(&rp->r_statelock);
6103 
6104         if (curproc == proc_pageout || curproc == proc_fsflush ||
6105             nfs_zone() != VTOMI(vp)->mi_zone) {
6106                 nfs_async_commit(vp, plist, offset, len, cr, nfs3_async_commit);
6107                 return;
6108         }
6109 
6110         /*
6111          * Actually generate the COMMIT3 over the wire operation.
6112          */
6113         error = nfs3_commit(vp, offset, len, cr);
6114 
6115         /*
6116          * If we got an error during the commit, just unlock all
6117          * of the pages.  The pages will get retransmitted to the
6118          * server during a putpage operation.
6119          */
6120         if (error) {
6121                 while (plist != NULL) {
6122                         pptr = plist;
6123                         page_sub(&plist, pptr);
6124                         page_unlock(pptr);
6125                 }
6126                 return;
6127         }
6128 
6129         /*
6130          * We've tried as hard as we can to commit the data to stable
6131          * storage on the server.  We release the rest of the pages
6132          * and clear the commit required state.  They will be put
6133          * onto the tail of the cachelist if they are nolonger
6134          * mapped.
6135          */
6136         while (plist != pp) {
6137                 pptr = plist;
6138                 page_sub(&plist, pptr);
6139                 pptr->p_fsdata = C_NOCOMMIT;
6140                 (void) page_release(pptr, 1);
6141         }
6142 
6143         /*
6144          * It is possible that nfs3_commit didn't return error but
6145          * some other thread has modified the page we are going
6146          * to free/destroy.
6147          *    In this case we need to rewrite the page. Do an explicit check
6148          * before attempting to free/destroy the page. If modified, needs to
6149          * be rewritten so unlock the page and return.
6150          */
6151         if (hat_ismod(pp)) {
6152                 pp->p_fsdata = C_NOCOMMIT;
6153                 page_unlock(pp);
6154                 return;
6155         }
6156 
6157         /*
6158          * Now, as appropriate, either free or destroy the page
6159          * that we were called with.
6160          */
6161         pp->p_fsdata = C_NOCOMMIT;
6162         if (fl == B_FREE)
6163                 page_free(pp, dn);
6164         else
6165                 page_destroy(pp, dn);
6166 }
6167 
6168 static int
6169 nfs3_commit(vnode_t *vp, offset3 offset, count3 count, cred_t *cr)
6170 {
6171         int error;
6172         rnode_t *rp;
6173         COMMIT3args args;
6174         COMMIT3res res;
6175         int douprintf;
6176         cred_t *cred;
6177 
6178         rp = VTOR(vp);
6179         ASSERT(nfs_zone() == VTOMI(vp)->mi_zone);
6180 
6181         mutex_enter(&rp->r_statelock);
6182         if (rp->r_cred != NULL) {
6183                 cred = rp->r_cred;
6184                 crhold(cred);
6185         } else {
6186                 rp->r_cred = cr;
6187                 crhold(cr);
6188                 cred = cr;
6189                 crhold(cred);
6190         }
6191         mutex_exit(&rp->r_statelock);
6192 
6193         args.file = *VTOFH3(vp);
6194         args.offset = offset;
6195         args.count = count;
6196 
6197 doitagain:
6198         douprintf = 1;
6199         error = rfs3call(VTOMI(vp), NFSPROC3_COMMIT,
6200             xdr_COMMIT3args, (caddr_t)&args,
6201             xdr_COMMIT3res, (caddr_t)&res, cred,
6202             &douprintf, &res.status, 0, NULL);
6203 
6204         crfree(cred);
6205 
6206         if (error)
6207                 return (error);
6208 
6209         error = geterrno3(res.status);
6210         if (!error) {
6211                 ASSERT(rp->r_flags & RHAVEVERF);
6212                 mutex_enter(&rp->r_statelock);
6213                 if (rp->r_verf == res.resok.verf) {
6214                         mutex_exit(&rp->r_statelock);
6215                         return (0);
6216                 }
6217                 nfs3_set_mod(vp);
6218                 rp->r_verf = res.resok.verf;
6219                 mutex_exit(&rp->r_statelock);
6220                 error = NFS_VERF_MISMATCH;
6221         } else {
6222                 if (error == EACCES) {
6223                         mutex_enter(&rp->r_statelock);
6224                         if (cred != cr) {
6225                                 if (rp->r_cred != NULL)
6226                                         crfree(rp->r_cred);
6227                                 rp->r_cred = cr;
6228                                 crhold(cr);
6229                                 cred = cr;
6230                                 crhold(cred);
6231                                 mutex_exit(&rp->r_statelock);
6232                                 goto doitagain;
6233                         }
6234                         mutex_exit(&rp->r_statelock);
6235                 }
6236                 /*
6237                  * Can't do a PURGE_STALE_FH here because this
6238                  * can cause a deadlock.  nfs3_commit can
6239                  * be called from nfs3_dispose which can be called
6240                  * indirectly via pvn_vplist_dirty.  PURGE_STALE_FH
6241                  * can call back to pvn_vplist_dirty.
6242                  */
6243                 if (error == ESTALE) {
6244                         mutex_enter(&rp->r_statelock);
6245                         rp->r_flags |= RSTALE;
6246                         if (!rp->r_error)
6247                                 rp->r_error = error;
6248                         mutex_exit(&rp->r_statelock);
6249                         PURGE_ATTRCACHE(vp);
6250                 } else {
6251                         mutex_enter(&rp->r_statelock);
6252                         if (!rp->r_error)
6253                                 rp->r_error = error;
6254                         mutex_exit(&rp->r_statelock);
6255                 }
6256         }
6257 
6258         return (error);
6259 }
6260 
6261 static void
6262 nfs3_set_mod(vnode_t *vp)
6263 {
6264         ASSERT(nfs_zone() == VTOMI(vp)->mi_zone);
6265 
6266         pvn_vplist_setdirty(vp, nfs_setmod_check);
6267 }
6268 
6269 /*
6270  * This routine is used to gather together a page list of the pages
6271  * which are to be committed on the server.  This routine must not
6272  * be called if the calling thread holds any locked pages.
6273  *
6274  * The calling thread must have set RCOMMIT.  This bit is used to
6275  * serialize access to the commit structure in the rnode.  As long
6276  * as the thread has set RCOMMIT, then it can manipulate the commit
6277  * structure without requiring any other locks.
6278  */
6279 static void
6280 nfs3_get_commit(vnode_t *vp)
6281 {
6282         rnode_t *rp;
6283         page_t *pp;
6284         kmutex_t *vphm;
6285 
6286         rp = VTOR(vp);
6287 
6288         ASSERT(rp->r_flags & RCOMMIT);
6289 
6290         vphm = page_vnode_mutex(vp);
6291         mutex_enter(vphm);
6292 
6293         /*
6294          * If there are no pages associated with this vnode, then
6295          * just return.
6296          */
6297         if ((pp = vp->v_pages) == NULL) {
6298                 mutex_exit(vphm);
6299                 return;
6300         }
6301 
6302         /*
6303          * Step through all of the pages associated with this vnode
6304          * looking for pages which need to be committed.
6305          */
6306         do {
6307                 /* Skip marker pages. */
6308                 if (pp->p_hash == PVN_VPLIST_HASH_TAG)
6309                         continue;
6310 
6311                 /*
6312                  * If this page does not need to be committed or is
6313                  * modified, then just skip it.
6314                  */
6315                 if (pp->p_fsdata == C_NOCOMMIT || hat_ismod(pp))
6316                         continue;
6317 
6318                 /*
6319                  * Attempt to lock the page.  If we can't, then
6320                  * someone else is messing with it and we will
6321                  * just skip it.
6322                  */
6323                 if (!page_trylock(pp, SE_EXCL))
6324                         continue;
6325 
6326                 /*
6327                  * If this page does not need to be committed or is
6328                  * modified, then just skip it.  Recheck now that
6329                  * the page is locked.
6330                  */
6331                 if (pp->p_fsdata == C_NOCOMMIT || hat_ismod(pp)) {
6332                         page_unlock(pp);
6333                         continue;
6334                 }
6335 
6336                 if (PP_ISFREE(pp)) {
6337                         cmn_err(CE_PANIC, "nfs3_get_commit: %p is free",
6338                             (void *)pp);
6339                 }
6340 
6341                 /*
6342                  * The page needs to be committed and we locked it.
6343                  * Update the base and length parameters and add it
6344                  * to r_pages.
6345                  */
6346                 if (rp->r_commit.c_pages == NULL) {
6347                         rp->r_commit.c_commbase = (offset3)pp->p_offset;
6348                         rp->r_commit.c_commlen = PAGESIZE;
6349                 } else if (pp->p_offset < rp->r_commit.c_commbase) {
6350                         rp->r_commit.c_commlen = rp->r_commit.c_commbase -
6351                             (offset3)pp->p_offset + rp->r_commit.c_commlen;
6352                         rp->r_commit.c_commbase = (offset3)pp->p_offset;
6353                 } else if ((rp->r_commit.c_commbase + rp->r_commit.c_commlen)
6354                     <= pp->p_offset) {
6355                         rp->r_commit.c_commlen = (offset3)pp->p_offset -
6356                             rp->r_commit.c_commbase + PAGESIZE;
6357                 }
6358                 page_add(&rp->r_commit.c_pages, pp);
6359         } while ((pp = pp->p_vpnext) != vp->v_pages);
6360 
6361         mutex_exit(vphm);
6362 }
6363 
6364 /*
6365  * This routine is used to gather together a page list of the pages
6366  * which are to be committed on the server.  This routine must not
6367  * be called if the calling thread holds any locked pages.
6368  *
6369  * The calling thread must have set RCOMMIT.  This bit is used to
6370  * serialize access to the commit structure in the rnode.  As long
6371  * as the thread has set RCOMMIT, then it can manipulate the commit
6372  * structure without requiring any other locks.
6373  */
6374 static void
6375 nfs3_get_commit_range(vnode_t *vp, u_offset_t soff, size_t len)
6376 {
6377 
6378         rnode_t *rp;
6379         page_t *pp;
6380         u_offset_t end;
6381         u_offset_t off;
6382 
6383         ASSERT(len != 0);
6384 
6385         rp = VTOR(vp);
6386 
6387         ASSERT(rp->r_flags & RCOMMIT);
6388         ASSERT(nfs_zone() == VTOMI(vp)->mi_zone);
6389 
6390         /*
6391          * If there are no pages associated with this vnode, then
6392          * just return.
6393          */
6394         if ((pp = vp->v_pages) == NULL)
6395                 return;
6396 
6397         /*
6398          * Calculate the ending offset.
6399          */
6400         end = soff + len;
6401 
6402         for (off = soff; off < end; off += PAGESIZE) {
6403                 /*
6404                  * Lookup each page by vp, offset.
6405                  */
6406                 if ((pp = page_lookup_nowait(vp, off, SE_EXCL)) == NULL)
6407                         continue;
6408 
6409                 /*
6410                  * If this page does not need to be committed or is
6411                  * modified, then just skip it.
6412                  */
6413                 if (pp->p_fsdata == C_NOCOMMIT || hat_ismod(pp)) {
6414                         page_unlock(pp);
6415                         continue;
6416                 }
6417 
6418                 ASSERT(PP_ISFREE(pp) == 0);
6419 
6420                 /*
6421                  * The page needs to be committed and we locked it.
6422                  * Update the base and length parameters and add it
6423                  * to r_pages.
6424                  */
6425                 if (rp->r_commit.c_pages == NULL) {
6426                         rp->r_commit.c_commbase = (offset3)pp->p_offset;
6427                         rp->r_commit.c_commlen = PAGESIZE;
6428                 } else {
6429                         rp->r_commit.c_commlen = (offset3)pp->p_offset -
6430                             rp->r_commit.c_commbase + PAGESIZE;
6431                 }
6432                 page_add(&rp->r_commit.c_pages, pp);
6433         }
6434 }
6435 
6436 static int
6437 nfs3_putpage_commit(vnode_t *vp, offset_t poff, size_t plen, cred_t *cr)
6438 {
6439         int error;
6440         writeverf3 write_verf;
6441         rnode_t *rp = VTOR(vp);
6442 
6443         ASSERT(nfs_zone() == VTOMI(vp)->mi_zone);
6444         /*
6445          * Flush the data portion of the file and then commit any
6446          * portions which need to be committed.  This may need to
6447          * be done twice if the server has changed state since
6448          * data was last written.  The data will need to be
6449          * rewritten to the server and then a new commit done.
6450          *
6451          * In fact, this may need to be done several times if the
6452          * server is having problems and crashing while we are
6453          * attempting to do this.
6454          */
6455 
6456 top:
6457         /*
6458          * Do a flush based on the poff and plen arguments.  This
6459          * will asynchronously write out any modified pages in the
6460          * range specified by (poff, plen).  This starts all of the
6461          * i/o operations which will be waited for in the next
6462          * call to nfs3_putpage
6463          */
6464 
6465         mutex_enter(&rp->r_statelock);
6466         write_verf = rp->r_verf;
6467         mutex_exit(&rp->r_statelock);
6468 
6469         error = nfs3_putpage(vp, poff, plen, B_ASYNC, cr, NULL);
6470         if (error == EAGAIN)
6471                 error = 0;
6472 
6473         /*
6474          * Do a flush based on the poff and plen arguments.  This
6475          * will synchronously write out any modified pages in the
6476          * range specified by (poff, plen) and wait until all of
6477          * the asynchronous i/o's in that range are done as well.
6478          */
6479         if (!error)
6480                 error = nfs3_putpage(vp, poff, plen, 0, cr, NULL);
6481 
6482         if (error)
6483                 return (error);
6484 
6485         mutex_enter(&rp->r_statelock);
6486         if (rp->r_verf != write_verf) {
6487                 mutex_exit(&rp->r_statelock);
6488                 goto top;
6489         }
6490         mutex_exit(&rp->r_statelock);
6491 
6492         /*
6493          * Now commit any pages which might need to be committed.
6494          * If the error, NFS_VERF_MISMATCH, is returned, then
6495          * start over with the flush operation.
6496          */
6497 
6498         error = nfs3_commit_vp(vp, poff, plen, cr);
6499 
6500         if (error == NFS_VERF_MISMATCH)
6501                 goto top;
6502 
6503         return (error);
6504 }
6505 
6506 static int
6507 nfs3_commit_vp(vnode_t *vp, u_offset_t poff, size_t plen, cred_t *cr)
6508 {
6509         rnode_t *rp;
6510         page_t *plist;
6511         offset3 offset;
6512         count3 len;
6513 
6514 
6515         rp = VTOR(vp);
6516 
6517         if (nfs_zone() != VTOMI(vp)->mi_zone)
6518                 return (EIO);
6519         /*
6520          * Set the `commit inprogress' state bit.  We must
6521          * first wait until any current one finishes.
6522          */
6523         mutex_enter(&rp->r_statelock);
6524         while (rp->r_flags & RCOMMIT) {
6525                 rp->r_flags |= RCOMMITWAIT;
6526                 cv_wait(&rp->r_commit.c_cv, &rp->r_statelock);
6527                 rp->r_flags &= ~RCOMMITWAIT;
6528         }
6529         rp->r_flags |= RCOMMIT;
6530         mutex_exit(&rp->r_statelock);
6531 
6532         /*
6533          * Gather together all of the pages which need to be
6534          * committed.
6535          */
6536         if (plen == 0)
6537                 nfs3_get_commit(vp);
6538         else
6539                 nfs3_get_commit_range(vp, poff, plen);
6540 
6541         /*
6542          * Clear the `commit inprogress' bit and disconnect the
6543          * page list which was gathered together in nfs3_get_commit.
6544          */
6545         plist = rp->r_commit.c_pages;
6546         rp->r_commit.c_pages = NULL;
6547         offset = rp->r_commit.c_commbase;
6548         len = rp->r_commit.c_commlen;
6549         mutex_enter(&rp->r_statelock);
6550         rp->r_flags &= ~RCOMMIT;
6551         cv_broadcast(&rp->r_commit.c_cv);
6552         mutex_exit(&rp->r_statelock);
6553 
6554         /*
6555          * If any pages need to be committed, commit them and
6556          * then unlock them so that they can be freed some
6557          * time later.
6558          */
6559         if (plist != NULL) {
6560                 /*
6561                  * No error occurred during the flush portion
6562                  * of this operation, so now attempt to commit
6563                  * the data to stable storage on the server.
6564                  *
6565                  * This will unlock all of the pages on the list.
6566                  */
6567                 return (nfs3_sync_commit(vp, plist, offset, len, cr));
6568         }
6569         return (0);
6570 }
6571 
6572 static int
6573 nfs3_sync_commit(vnode_t *vp, page_t *plist, offset3 offset, count3 count,
6574         cred_t *cr)
6575 {
6576         int error;
6577         page_t *pp;
6578 
6579         ASSERT(nfs_zone() == VTOMI(vp)->mi_zone);
6580         error = nfs3_commit(vp, offset, count, cr);
6581 
6582         /*
6583          * If we got an error, then just unlock all of the pages
6584          * on the list.
6585          */
6586         if (error) {
6587                 while (plist != NULL) {
6588                         pp = plist;
6589                         page_sub(&plist, pp);
6590                         page_unlock(pp);
6591                 }
6592                 return (error);
6593         }
6594         /*
6595          * We've tried as hard as we can to commit the data to stable
6596          * storage on the server.  We just unlock the pages and clear
6597          * the commit required state.  They will get freed later.
6598          */
6599         while (plist != NULL) {
6600                 pp = plist;
6601                 page_sub(&plist, pp);
6602                 pp->p_fsdata = C_NOCOMMIT;
6603                 page_unlock(pp);
6604         }
6605 
6606         return (error);
6607 }
6608 
6609 static void
6610 nfs3_async_commit(vnode_t *vp, page_t *plist, offset3 offset, count3 count,
6611         cred_t *cr)
6612 {
6613         ASSERT(nfs_zone() == VTOMI(vp)->mi_zone);
6614         (void) nfs3_sync_commit(vp, plist, offset, count, cr);
6615 }
6616 
6617 /* ARGSUSED */
6618 static int
6619 nfs3_setsecattr(vnode_t *vp, vsecattr_t *vsecattr, int flag, cred_t *cr,
6620         caller_context_t *ct)
6621 {
6622         int error;
6623         mntinfo_t *mi;
6624 
6625         mi = VTOMI(vp);
6626 
6627         if (nfs_zone() != mi->mi_zone)
6628                 return (EIO);
6629 
6630         if (mi->mi_flags & MI_ACL) {
6631                 error = acl_setacl3(vp, vsecattr, flag, cr);
6632                 if (mi->mi_flags & MI_ACL)
6633                         return (error);
6634         }
6635 
6636         return (ENOSYS);
6637 }
6638 
6639 /* ARGSUSED */
6640 static int
6641 nfs3_getsecattr(vnode_t *vp, vsecattr_t *vsecattr, int flag, cred_t *cr,
6642         caller_context_t *ct)
6643 {
6644         int error;
6645         mntinfo_t *mi;
6646 
6647         mi = VTOMI(vp);
6648 
6649         if (nfs_zone() != mi->mi_zone)
6650                 return (EIO);
6651 
6652         if (mi->mi_flags & MI_ACL) {
6653                 error = acl_getacl3(vp, vsecattr, flag, cr);
6654                 if (mi->mi_flags & MI_ACL)
6655                         return (error);
6656         }
6657 
6658         return (fs_fab_acl(vp, vsecattr, flag, cr, ct));
6659 }
6660 
6661 /* ARGSUSED */
6662 static int
6663 nfs3_shrlock(vnode_t *vp, int cmd, struct shrlock *shr, int flag, cred_t *cr,
6664         caller_context_t *ct)
6665 {
6666         int error;
6667         struct shrlock nshr;
6668         struct nfs_owner nfs_owner;
6669         netobj lm_fh3;
6670 
6671         if (nfs_zone() != VTOMI(vp)->mi_zone)
6672                 return (EIO);
6673 
6674         /*
6675          * check for valid cmd parameter
6676          */
6677         if (cmd != F_SHARE && cmd != F_UNSHARE && cmd != F_HASREMOTELOCKS)
6678                 return (EINVAL);
6679 
6680         /*
6681          * Check access permissions
6682          */
6683         if (cmd == F_SHARE &&
6684             (((shr->s_access & F_RDACC) && !(flag & FREAD)) ||
6685             ((shr->s_access & F_WRACC) && !(flag & FWRITE))))
6686                 return (EBADF);
6687 
6688         /*
6689          * If the filesystem is mounted using local locking, pass the
6690          * request off to the local share code.
6691          */
6692         if (VTOMI(vp)->mi_flags & MI_LLOCK)
6693                 return (fs_shrlock(vp, cmd, shr, flag, cr, ct));
6694 
6695         switch (cmd) {
6696         case F_SHARE:
6697         case F_UNSHARE:
6698                 lm_fh3.n_len = VTOFH3(vp)->fh3_length;
6699                 lm_fh3.n_bytes = (char *)&(VTOFH3(vp)->fh3_u.data);
6700 
6701                 /*
6702                  * If passed an owner that is too large to fit in an
6703                  * nfs_owner it is likely a recursive call from the
6704                  * lock manager client and pass it straight through.  If
6705                  * it is not a nfs_owner then simply return an error.
6706                  */
6707                 if (shr->s_own_len > sizeof (nfs_owner.lowner)) {
6708                         if (((struct nfs_owner *)shr->s_owner)->magic !=
6709                             NFS_OWNER_MAGIC)
6710                                 return (EINVAL);
6711 
6712                         if (error = lm4_shrlock(vp, cmd, shr, flag, &lm_fh3)) {
6713                                 error = set_errno(error);
6714                         }
6715                         return (error);
6716                 }
6717                 /*
6718                  * Remote share reservations owner is a combination of
6719                  * a magic number, hostname, and the local owner
6720                  */
6721                 bzero(&nfs_owner, sizeof (nfs_owner));
6722                 nfs_owner.magic = NFS_OWNER_MAGIC;
6723                 (void) strncpy(nfs_owner.hname, uts_nodename(),
6724                     sizeof (nfs_owner.hname));
6725                 bcopy(shr->s_owner, nfs_owner.lowner, shr->s_own_len);
6726                 nshr.s_access = shr->s_access;
6727                 nshr.s_deny = shr->s_deny;
6728                 nshr.s_sysid = 0;
6729                 nshr.s_pid = ttoproc(curthread)->p_pid;
6730                 nshr.s_own_len = sizeof (nfs_owner);
6731                 nshr.s_owner = (caddr_t)&nfs_owner;
6732 
6733                 if (error = lm4_shrlock(vp, cmd, &nshr, flag, &lm_fh3)) {
6734                         error = set_errno(error);
6735                 }
6736 
6737                 break;
6738 
6739         case F_HASREMOTELOCKS:
6740                 /*
6741                  * NFS client can't store remote locks itself
6742                  */
6743                 shr->s_access = 0;
6744                 error = 0;
6745                 break;
6746 
6747         default:
6748                 error = EINVAL;
6749                 break;
6750         }
6751 
6752         return (error);
6753 }