Home | History | Annotate | Download | only in nfs
      1 /*
      2  * CDDL HEADER START
      3  *
      4  * The contents of this file are subject to the terms of the
      5  * Common Development and Distribution License (the "License").
      6  * You may not use this file except in compliance with the License.
      7  *
      8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
      9  * or http://www.opensolaris.org/os/licensing.
     10  * See the License for the specific language governing permissions
     11  * and limitations under the License.
     12  *
     13  * When distributing Covered Code, include this CDDL HEADER in each
     14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
     15  * If applicable, add the following below this CDDL HEADER, with the
     16  * fields enclosed by brackets "[]" replaced with your own identifying
     17  * information: Portions Copyright [yyyy] [name of copyright owner]
     18  *
     19  * CDDL HEADER END
     20  */
     21 /*
     22  * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
     23  * Use is subject to license terms.
     24  */
     25 
     26 /*
     27  *	Copyright (c) 1983,1984,1985,1986,1987,1988,1989 AT&T.
     28  *	All rights reserved.
     29  */
     30 
     31 #include <sys/param.h>
     32 #include <sys/types.h>
     33 #include <sys/systm.h>
     34 #include <sys/cred.h>
     35 #include <sys/time.h>
     36 #include <sys/vnode.h>
     37 #include <sys/vfs.h>
     38 #include <sys/vfs_opreg.h>
     39 #include <sys/file.h>
     40 #include <sys/filio.h>
     41 #include <sys/uio.h>
     42 #include <sys/buf.h>
     43 #include <sys/mman.h>
     44 #include <sys/pathname.h>
     45 #include <sys/dirent.h>
     46 #include <sys/debug.h>
     47 #include <sys/vmsystm.h>
     48 #include <sys/fcntl.h>
     49 #include <sys/flock.h>
     50 #include <sys/swap.h>
     51 #include <sys/errno.h>
     52 #include <sys/strsubr.h>
     53 #include <sys/sysmacros.h>
     54 #include <sys/kmem.h>
     55 #include <sys/cmn_err.h>
     56 #include <sys/pathconf.h>
     57 #include <sys/utsname.h>
     58 #include <sys/dnlc.h>
     59 #include <sys/acl.h>
     60 #include <sys/systeminfo.h>
     61 #include <sys/atomic.h>
     62 #include <sys/policy.h>
     63 #include <sys/sdt.h>
     64 #include <sys/zone.h>
     65 
     66 #include <rpc/types.h>
     67 #include <rpc/auth.h>
     68 #include <rpc/clnt.h>
     69 #include <rpc/rpc_rdma.h>
     70 
     71 #include <nfs/nfs.h>
     72 #include <nfs/nfs_clnt.h>
     73 #include <nfs/rnode.h>
     74 #include <nfs/nfs_acl.h>
     75 #include <nfs/lm.h>
     76 
     77 #include <vm/hat.h>
     78 #include <vm/as.h>
     79 #include <vm/page.h>
     80 #include <vm/pvn.h>
     81 #include <vm/seg.h>
     82 #include <vm/seg_map.h>
     83 #include <vm/seg_kpm.h>
     84 #include <vm/seg_vn.h>
     85 
     86 #include <fs/fs_subr.h>
     87 
     88 #include <sys/ddi.h>
     89 
     90 static int	nfs3_rdwrlbn(vnode_t *, page_t *, u_offset_t, size_t, int,
     91 			cred_t *);
     92 static int	nfs3write(vnode_t *, caddr_t, u_offset_t, int, cred_t *,
     93 			stable_how *);
     94 static int	nfs3read(vnode_t *, caddr_t, offset_t, int, size_t *, cred_t *);
     95 static int	nfs3setattr(vnode_t *, struct vattr *, int, cred_t *);
     96 static int	nfs3_accessx(void *, int, cred_t *);
     97 static int	nfs3lookup_dnlc(vnode_t *, char *, vnode_t **, cred_t *);
     98 static int	nfs3lookup_otw(vnode_t *, char *, vnode_t **, cred_t *, int);
     99 static int	nfs3create(vnode_t *, char *, struct vattr *, enum vcexcl,
    100 			int, vnode_t **, cred_t *, int);
    101 static int	nfs3excl_create_settimes(vnode_t *, struct vattr *, cred_t *);
    102 static int	nfs3mknod(vnode_t *, char *, struct vattr *, enum vcexcl,
    103 			int, vnode_t **, cred_t *);
    104 static int	nfs3rename(vnode_t *, char *, vnode_t *, char *, cred_t *,
    105 			caller_context_t *);
    106 static int	do_nfs3readdir(vnode_t *, rddir_cache *, cred_t *);
    107 static void	nfs3readdir(vnode_t *, rddir_cache *, cred_t *);
    108 static void	nfs3readdirplus(vnode_t *, rddir_cache *, cred_t *);
    109 static int	nfs3_bio(struct buf *, stable_how *, cred_t *);
    110 static int	nfs3_getapage(vnode_t *, u_offset_t, size_t, uint_t *,
    111 			page_t *[], size_t, struct seg *, caddr_t,
    112 			enum seg_rw, cred_t *);
    113 static void	nfs3_readahead(vnode_t *, u_offset_t, caddr_t, struct seg *,
    114 			cred_t *);
    115 static int	nfs3_sync_putapage(vnode_t *, page_t *, u_offset_t, size_t,
    116 			int, cred_t *);
    117 static int	nfs3_sync_pageio(vnode_t *, page_t *, u_offset_t, size_t,
    118 			int, cred_t *);
    119 static int	nfs3_commit(vnode_t *, offset3, count3, cred_t *);
    120 static void	nfs3_set_mod(vnode_t *);
    121 static void	nfs3_get_commit(vnode_t *);
    122 static void	nfs3_get_commit_range(vnode_t *, u_offset_t, size_t);
    123 #if 0 /* unused */
    124 #ifdef DEBUG
    125 static int	nfs3_no_uncommitted_pages(vnode_t *);
    126 #endif
    127 #endif /* unused */
    128 static int	nfs3_putpage_commit(vnode_t *, offset_t, size_t, cred_t *);
    129 static int	nfs3_commit_vp(vnode_t *, u_offset_t, size_t,  cred_t *);
    130 static int	nfs3_sync_commit(vnode_t *, page_t *, offset3, count3,
    131 			cred_t *);
    132 static void	nfs3_async_commit(vnode_t *, page_t *, offset3, count3,
    133 			cred_t *);
    134 static void	nfs3_delmap_callback(struct as *, void *, uint_t);
    135 
    136 /*
    137  * Error flags used to pass information about certain special errors
    138  * which need to be handled specially.
    139  */
    140 #define	NFS_EOF			-98
    141 #define	NFS_VERF_MISMATCH	-97
    142 
    143 /* ALIGN64 aligns the given buffer and adjust buffer size to 64 bit */
    144 #define	ALIGN64(x, ptr, sz)						\
    145 	x = ((uintptr_t)(ptr)) & (sizeof (uint64_t) - 1);		\
    146 	if (x) {							\
    147 		x = sizeof (uint64_t) - (x);				\
    148 		sz -= (x);						\
    149 		ptr += (x);						\
    150 	}
    151 
    152 /*
    153  * These are the vnode ops routines which implement the vnode interface to
    154  * the networked file system.  These routines just take their parameters,
    155  * make them look networkish by putting the right info into interface structs,
    156  * and then calling the appropriate remote routine(s) to do the work.
    157  *
    158  * Note on directory name lookup cacheing:  If we detect a stale fhandle,
    159  * we purge the directory cache relative to that vnode.  This way, the
    160  * user won't get burned by the cache repeatedly.  See <nfs/rnode.h> for
    161  * more details on rnode locking.
    162  */
    163 
    164 static int	nfs3_open(vnode_t **, int, cred_t *, caller_context_t *);
    165 static int	nfs3_close(vnode_t *, int, int, offset_t, cred_t *,
    166 			caller_context_t *);
    167 static int	nfs3_read(vnode_t *, struct uio *, int, cred_t *,
    168 			caller_context_t *);
    169 static int	nfs3_write(vnode_t *, struct uio *, int, cred_t *,
    170 			caller_context_t *);
    171 static int	nfs3_ioctl(vnode_t *, int, intptr_t, int, cred_t *, int *,
    172 			caller_context_t *);
    173 static int	nfs3_getattr(vnode_t *, struct vattr *, int, cred_t *,
    174 			caller_context_t *);
    175 static int	nfs3_setattr(vnode_t *, struct vattr *, int, cred_t *,
    176 			caller_context_t *);
    177 static int	nfs3_access(vnode_t *, int, int, cred_t *, caller_context_t *);
    178 static int	nfs3_readlink(vnode_t *, struct uio *, cred_t *,
    179 			caller_context_t *);
    180 static int	nfs3_fsync(vnode_t *, int, cred_t *, caller_context_t *);
    181 static void	nfs3_inactive(vnode_t *, cred_t *, caller_context_t *);
    182 static int	nfs3_lookup(vnode_t *, char *, vnode_t **,
    183 			struct pathname *, int, vnode_t *, cred_t *,
    184 			caller_context_t *, int *, pathname_t *);
    185 static int	nfs3_create(vnode_t *, char *, struct vattr *, enum vcexcl,
    186 			int, vnode_t **, cred_t *, int, caller_context_t *,
    187 			vsecattr_t *);
    188 static int	nfs3_remove(vnode_t *, char *, cred_t *, caller_context_t *,
    189 			int);
    190 static int	nfs3_link(vnode_t *, vnode_t *, char *, cred_t *,
    191 			caller_context_t *, int);
    192 static int	nfs3_rename(vnode_t *, char *, vnode_t *, char *, cred_t *,
    193 			caller_context_t *, int);
    194 static int	nfs3_mkdir(vnode_t *, char *, struct vattr *, vnode_t **,
    195 			cred_t *, caller_context_t *, int, vsecattr_t *);
    196 static int	nfs3_rmdir(vnode_t *, char *, vnode_t *, cred_t *,
    197 			caller_context_t *, int);
    198 static int	nfs3_symlink(vnode_t *, char *, struct vattr *, char *,
    199 			cred_t *, caller_context_t *, int);
    200 static int	nfs3_readdir(vnode_t *, struct uio *, cred_t *, int *,
    201 			caller_context_t *, int);
    202 static int	nfs3_fid(vnode_t *, fid_t *, caller_context_t *);
    203 static int	nfs3_rwlock(vnode_t *, int, caller_context_t *);
    204 static void	nfs3_rwunlock(vnode_t *, int, caller_context_t *);
    205 static int	nfs3_seek(vnode_t *, offset_t, offset_t *, caller_context_t *);
    206 static int	nfs3_getpage(vnode_t *, offset_t, size_t, uint_t *,
    207 			page_t *[], size_t, struct seg *, caddr_t,
    208 			enum seg_rw, cred_t *, caller_context_t *);
    209 static int	nfs3_putpage(vnode_t *, offset_t, size_t, int, cred_t *,
    210 			caller_context_t *);
    211 static int	nfs3_map(vnode_t *, offset_t, struct as *, caddr_t *, size_t,
    212 			uchar_t, uchar_t, uint_t, cred_t *, caller_context_t *);
    213 static int	nfs3_addmap(vnode_t *, offset_t, struct as *, caddr_t, size_t,
    214 			uchar_t, uchar_t, uint_t, cred_t *, caller_context_t *);
    215 static int	nfs3_frlock(vnode_t *, int, struct flock64 *, int, offset_t,
    216 			struct flk_callback *, cred_t *, caller_context_t *);
    217 static int	nfs3_space(vnode_t *, int, struct flock64 *, int, offset_t,
    218 			cred_t *, caller_context_t *);
    219 static int	nfs3_realvp(vnode_t *, vnode_t **, caller_context_t *);
    220 static int	nfs3_delmap(vnode_t *, offset_t, struct as *, caddr_t, size_t,
    221 			uint_t, uint_t, uint_t, cred_t *, caller_context_t *);
    222 static int	nfs3_pathconf(vnode_t *, int, ulong_t *, cred_t *,
    223 			caller_context_t *);
    224 static int	nfs3_pageio(vnode_t *, page_t *, u_offset_t, size_t, int,
    225 			cred_t *, caller_context_t *);
    226 static void	nfs3_dispose(vnode_t *, page_t *, int, int, cred_t *,
    227 			caller_context_t *);
    228 static int	nfs3_setsecattr(vnode_t *, vsecattr_t *, int, cred_t *,
    229 			caller_context_t *);
    230 static int	nfs3_getsecattr(vnode_t *, vsecattr_t *, int, cred_t *,
    231 			caller_context_t *);
    232 static int	nfs3_shrlock(vnode_t *, int, struct shrlock *, int, cred_t *,
    233 			caller_context_t *);
    234 
    235 struct vnodeops *nfs3_vnodeops;
    236 
    237 const fs_operation_def_t nfs3_vnodeops_template[] = {
    238 	VOPNAME_OPEN,		{ .vop_open = nfs3_open },
    239 	VOPNAME_CLOSE,		{ .vop_close = nfs3_close },
    240 	VOPNAME_READ,		{ .vop_read = nfs3_read },
    241 	VOPNAME_WRITE,		{ .vop_write = nfs3_write },
    242 	VOPNAME_IOCTL,		{ .vop_ioctl = nfs3_ioctl },
    243 	VOPNAME_GETATTR,	{ .vop_getattr = nfs3_getattr },
    244 	VOPNAME_SETATTR,	{ .vop_setattr = nfs3_setattr },
    245 	VOPNAME_ACCESS,		{ .vop_access = nfs3_access },
    246 	VOPNAME_LOOKUP,		{ .vop_lookup = nfs3_lookup },
    247 	VOPNAME_CREATE,		{ .vop_create = nfs3_create },
    248 	VOPNAME_REMOVE,		{ .vop_remove = nfs3_remove },
    249 	VOPNAME_LINK,		{ .vop_link = nfs3_link },
    250 	VOPNAME_RENAME,		{ .vop_rename = nfs3_rename },
    251 	VOPNAME_MKDIR,		{ .vop_mkdir = nfs3_mkdir },
    252 	VOPNAME_RMDIR,		{ .vop_rmdir = nfs3_rmdir },
    253 	VOPNAME_READDIR,	{ .vop_readdir = nfs3_readdir },
    254 	VOPNAME_SYMLINK,	{ .vop_symlink = nfs3_symlink },
    255 	VOPNAME_READLINK,	{ .vop_readlink = nfs3_readlink },
    256 	VOPNAME_FSYNC,		{ .vop_fsync = nfs3_fsync },
    257 	VOPNAME_INACTIVE,	{ .vop_inactive = nfs3_inactive },
    258 	VOPNAME_FID,		{ .vop_fid = nfs3_fid },
    259 	VOPNAME_RWLOCK,		{ .vop_rwlock = nfs3_rwlock },
    260 	VOPNAME_RWUNLOCK,	{ .vop_rwunlock = nfs3_rwunlock },
    261 	VOPNAME_SEEK,		{ .vop_seek = nfs3_seek },
    262 	VOPNAME_FRLOCK,		{ .vop_frlock = nfs3_frlock },
    263 	VOPNAME_SPACE,		{ .vop_space = nfs3_space },
    264 	VOPNAME_REALVP,		{ .vop_realvp = nfs3_realvp },
    265 	VOPNAME_GETPAGE,	{ .vop_getpage = nfs3_getpage },
    266 	VOPNAME_PUTPAGE,	{ .vop_putpage = nfs3_putpage },
    267 	VOPNAME_MAP,		{ .vop_map = nfs3_map },
    268 	VOPNAME_ADDMAP,		{ .vop_addmap = nfs3_addmap },
    269 	VOPNAME_DELMAP,		{ .vop_delmap = nfs3_delmap },
    270 	/* no separate nfs3_dump */
    271 	VOPNAME_DUMP,		{ .vop_dump = nfs_dump },
    272 	VOPNAME_PATHCONF,	{ .vop_pathconf = nfs3_pathconf },
    273 	VOPNAME_PAGEIO,		{ .vop_pageio = nfs3_pageio },
    274 	VOPNAME_DISPOSE,	{ .vop_dispose = nfs3_dispose },
    275 	VOPNAME_SETSECATTR,	{ .vop_setsecattr = nfs3_setsecattr },
    276 	VOPNAME_GETSECATTR,	{ .vop_getsecattr = nfs3_getsecattr },
    277 	VOPNAME_SHRLOCK,	{ .vop_shrlock = nfs3_shrlock },
    278 	VOPNAME_VNEVENT, 	{ .vop_vnevent = fs_vnevent_support },
    279 	NULL,			NULL
    280 };
    281 
    282 /*
    283  * XXX:  This is referenced in modstubs.s
    284  */
    285 struct vnodeops *
    286 nfs3_getvnodeops(void)
    287 {
    288 	return (nfs3_vnodeops);
    289 }
    290 
    291 /* ARGSUSED */
    292 static int
    293 nfs3_open(vnode_t **vpp, int flag, cred_t *cr, caller_context_t *ct)
    294 {
    295 	int error;
    296 	struct vattr va;
    297 	rnode_t *rp;
    298 	vnode_t *vp;
    299 
    300 	vp = *vpp;
    301 	if (nfs_zone() != VTOMI(vp)->mi_zone)
    302 		return (EIO);
    303 	rp = VTOR(vp);
    304 	mutex_enter(&rp->r_statelock);
    305 	if (rp->r_cred == NULL) {
    306 		crhold(cr);
    307 		rp->r_cred = cr;
    308 	}
    309 	mutex_exit(&rp->r_statelock);
    310 
    311 	/*
    312 	 * If there is no cached data or if close-to-open
    313 	 * consistency checking is turned off, we can avoid
    314 	 * the over the wire getattr.  Otherwise, if the
    315 	 * file system is mounted readonly, then just verify
    316 	 * the caches are up to date using the normal mechanism.
    317 	 * Else, if the file is not mmap'd, then just mark
    318 	 * the attributes as timed out.  They will be refreshed
    319 	 * and the caches validated prior to being used.
    320 	 * Else, the file system is mounted writeable so
    321 	 * force an over the wire GETATTR in order to ensure
    322 	 * that all cached data is valid.
    323 	 */
    324 	if (vp->v_count > 1 ||
    325 	    ((vn_has_cached_data(vp) || HAVE_RDDIR_CACHE(rp)) &&
    326 	    !(VTOMI(vp)->mi_flags & MI_NOCTO))) {
    327 		if (vn_is_readonly(vp))
    328 			error = nfs3_validate_caches(vp, cr);
    329 		else if (rp->r_mapcnt == 0 && vp->v_count == 1) {
    330 			PURGE_ATTRCACHE(vp);
    331 			error = 0;
    332 		} else {
    333 			va.va_mask = AT_ALL;
    334 			error = nfs3_getattr_otw(vp, &va, cr);
    335 		}
    336 	} else
    337 		error = 0;
    338 
    339 	return (error);
    340 }
    341 
    342 /* ARGSUSED */
    343 static int
    344 nfs3_close(vnode_t *vp, int flag, int count, offset_t offset, cred_t *cr,
    345 		caller_context_t *ct)
    346 {
    347 	rnode_t *rp;
    348 	int error;
    349 	struct vattr va;
    350 
    351 	/*
    352 	 * zone_enter(2) prevents processes from changing zones with NFS files
    353 	 * open; if we happen to get here from the wrong zone we can't do
    354 	 * anything over the wire.
    355 	 */
    356 	if (VTOMI(vp)->mi_zone != nfs_zone()) {
    357 		/*
    358 		 * We could attempt to clean up locks, except we're sure
    359 		 * that the current process didn't acquire any locks on
    360 		 * the file: any attempt to lock a file belong to another zone
    361 		 * will fail, and one can't lock an NFS file and then change
    362 		 * zones, as that fails too.
    363 		 *
    364 		 * Returning an error here is the sane thing to do.  A
    365 		 * subsequent call to VN_RELE() which translates to a
    366 		 * nfs3_inactive() will clean up state: if the zone of the
    367 		 * vnode's origin is still alive and kicking, an async worker
    368 		 * thread will handle the request (from the correct zone), and
    369 		 * everything (minus the commit and final nfs3_getattr_otw()
    370 		 * call) should be OK. If the zone is going away
    371 		 * nfs_async_inactive() will throw away cached pages inline.
    372 		 */
    373 		return (EIO);
    374 	}
    375 
    376 	/*
    377 	 * If we are using local locking for this filesystem, then
    378 	 * release all of the SYSV style record locks.  Otherwise,
    379 	 * we are doing network locking and we need to release all
    380 	 * of the network locks.  All of the locks held by this
    381 	 * process on this file are released no matter what the
    382 	 * incoming reference count is.
    383 	 */
    384 	if (VTOMI(vp)->mi_flags & MI_LLOCK) {
    385 		cleanlocks(vp, ttoproc(curthread)->p_pid, 0);
    386 		cleanshares(vp, ttoproc(curthread)->p_pid);
    387 	} else
    388 		nfs_lockrelease(vp, flag, offset, cr);
    389 
    390 	if (count > 1)
    391 		return (0);
    392 
    393 	/*
    394 	 * If the file has been `unlinked', then purge the
    395 	 * DNLC so that this vnode will get reycled quicker
    396 	 * and the .nfs* file on the server will get removed.
    397 	 */
    398 	rp = VTOR(vp);
    399 	if (rp->r_unldvp != NULL)
    400 		dnlc_purge_vp(vp);
    401 
    402 	/*
    403 	 * If the file was open for write and there are pages,
    404 	 * then if the file system was mounted using the "no-close-
    405 	 *	to-open" semantics, then start an asynchronous flush
    406 	 *	of the all of the pages in the file.
    407 	 * else the file system was not mounted using the "no-close-
    408 	 *	to-open" semantics, then do a synchronous flush and
    409 	 *	commit of all of the dirty and uncommitted pages.
    410 	 *
    411 	 * The asynchronous flush of the pages in the "nocto" path
    412 	 * mostly just associates a cred pointer with the rnode so
    413 	 * writes which happen later will have a better chance of
    414 	 * working.  It also starts the data being written to the
    415 	 * server, but without unnecessarily delaying the application.
    416 	 */
    417 	if ((flag & FWRITE) && vn_has_cached_data(vp)) {
    418 		if (VTOMI(vp)->mi_flags & MI_NOCTO) {
    419 			error = nfs3_putpage(vp, (offset_t)0, 0, B_ASYNC,
    420 			    cr, ct);
    421 			if (error == EAGAIN)
    422 				error = 0;
    423 		} else
    424 			error = nfs3_putpage_commit(vp, (offset_t)0, 0, cr);
    425 		if (!error) {
    426 			mutex_enter(&rp->r_statelock);
    427 			error = rp->r_error;
    428 			rp->r_error = 0;
    429 			mutex_exit(&rp->r_statelock);
    430 		}
    431 	} else {
    432 		mutex_enter(&rp->r_statelock);
    433 		error = rp->r_error;
    434 		rp->r_error = 0;
    435 		mutex_exit(&rp->r_statelock);
    436 	}
    437 
    438 	/*
    439 	 * If RWRITEATTR is set, then issue an over the wire GETATTR to
    440 	 * refresh the attribute cache with a set of attributes which
    441 	 * weren't returned from a WRITE.  This will enable the close-
    442 	 * to-open processing to work.
    443 	 */
    444 	if (rp->r_flags & RWRITEATTR)
    445 		(void) nfs3_getattr_otw(vp, &va, cr);
    446 
    447 	return (error);
    448 }
    449 
    450 /* ARGSUSED */
    451 static int
    452 nfs3_directio_read(vnode_t *vp, struct uio *uiop, cred_t *cr)
    453 {
    454 	mntinfo_t *mi;
    455 	READ3args args;
    456 	READ3uiores res;
    457 	int tsize;
    458 	offset_t offset;
    459 	ssize_t count;
    460 	int error;
    461 	int douprintf;
    462 	failinfo_t fi;
    463 	char *sv_hostname;
    464 
    465 	mi = VTOMI(vp);
    466 	ASSERT(nfs_zone() == VTOMI(vp)->mi_zone);
    467 	sv_hostname = VTOR(vp)->r_server->sv_hostname;
    468 
    469 	douprintf = 1;
    470 	args.file = *VTOFH3(vp);
    471 	fi.vp = vp;
    472 	fi.fhp = (caddr_t)&args.file;
    473 	fi.copyproc = nfs3copyfh;
    474 	fi.lookupproc = nfs3lookup;
    475 	fi.xattrdirproc = acl_getxattrdir3;
    476 
    477 	res.uiop = uiop;
    478 
    479 	res.wlist = NULL;
    480 
    481 	offset = uiop->uio_loffset;
    482 	count = uiop->uio_resid;
    483 
    484 	do {
    485 		if (mi->mi_io_kstats) {
    486 			mutex_enter(&mi->mi_lock);
    487 			kstat_runq_enter(KSTAT_IO_PTR(mi->mi_io_kstats));
    488 			mutex_exit(&mi->mi_lock);
    489 		}
    490 
    491 		do {
    492 			tsize = MIN(mi->mi_tsize, count);
    493 			args.offset = (offset3)offset;
    494 			args.count = (count3)tsize;
    495 			res.size = (uint_t)tsize;
    496 			args.res_uiop = uiop;
    497 			args.res_data_val_alt = NULL;
    498 
    499 			error = rfs3call(mi, NFSPROC3_READ,
    500 			    xdr_READ3args, (caddr_t)&args,
    501 			    xdr_READ3uiores, (caddr_t)&res, cr,
    502 			    &douprintf, &res.status, 0, &fi);
    503 		} while (error == ENFS_TRYAGAIN);
    504 
    505 		if (mi->mi_io_kstats) {
    506 			mutex_enter(&mi->mi_lock);
    507 			kstat_runq_exit(KSTAT_IO_PTR(mi->mi_io_kstats));
    508 			mutex_exit(&mi->mi_lock);
    509 		}
    510 
    511 		if (error)
    512 			return (error);
    513 
    514 		error = geterrno3(res.status);
    515 		if (error)
    516 			return (error);
    517 
    518 		if (res.count != res.size) {
    519 			zcmn_err(getzoneid(), CE_WARN,
    520 "nfs3_directio_read: server %s returned incorrect amount",
    521 			    sv_hostname);
    522 			return (EIO);
    523 		}
    524 		count -= res.count;
    525 		offset += res.count;
    526 		if (mi->mi_io_kstats) {
    527 			mutex_enter(&mi->mi_lock);
    528 			KSTAT_IO_PTR(mi->mi_io_kstats)->reads++;
    529 			KSTAT_IO_PTR(mi->mi_io_kstats)->nread += res.count;
    530 			mutex_exit(&mi->mi_lock);
    531 		}
    532 		lwp_stat_update(LWP_STAT_INBLK, 1);
    533 	} while (count && !res.eof);
    534 
    535 	return (0);
    536 }
    537 
    538 /* ARGSUSED */
    539 static int
    540 nfs3_read(vnode_t *vp, struct uio *uiop, int ioflag, cred_t *cr,
    541 	caller_context_t *ct)
    542 {
    543 	rnode_t *rp;
    544 	u_offset_t off;
    545 	offset_t diff;
    546 	int on;
    547 	size_t n;
    548 	caddr_t base;
    549 	uint_t flags;
    550 	int error = 0;
    551 	mntinfo_t *mi;
    552 
    553 	rp = VTOR(vp);
    554 	mi = VTOMI(vp);
    555 
    556 	ASSERT(nfs_rw_lock_held(&rp->r_rwlock, RW_READER));
    557 
    558 	if (nfs_zone() != mi->mi_zone)
    559 		return (EIO);
    560 
    561 	if (vp->v_type != VREG)
    562 		return (EISDIR);
    563 
    564 	if (uiop->uio_resid == 0)
    565 		return (0);
    566 
    567 	if (uiop->uio_loffset < 0 || uiop->uio_loffset + uiop->uio_resid < 0)
    568 		return (EINVAL);
    569 
    570 	/*
    571 	 * Bypass VM if caching has been disabled (e.g., locking) or if
    572 	 * using client-side direct I/O and the file is not mmap'd and
    573 	 * there are no cached pages.
    574 	 */
    575 	if ((vp->v_flag & VNOCACHE) ||
    576 	    (((rp->r_flags & RDIRECTIO) || (mi->mi_flags & MI_DIRECTIO)) &&
    577 	    rp->r_mapcnt == 0 && rp->r_inmap == 0 &&
    578 	    !vn_has_cached_data(vp))) {
    579 		return (nfs3_directio_read(vp, uiop, cr));
    580 	}
    581 
    582 	do {
    583 		off = uiop->uio_loffset & MAXBMASK; /* mapping offset */
    584 		on = uiop->uio_loffset & MAXBOFFSET; /* Relative offset */
    585 		n = MIN(MAXBSIZE - on, uiop->uio_resid);
    586 
    587 		error = nfs3_validate_caches(vp, cr);
    588 		if (error)
    589 			break;
    590 
    591 		mutex_enter(&rp->r_statelock);
    592 		while (rp->r_flags & RINCACHEPURGE) {
    593 			if (!cv_wait_sig(&rp->r_cv, &rp->r_statelock)) {
    594 				mutex_exit(&rp->r_statelock);
    595 				return (EINTR);
    596 			}
    597 		}
    598 		diff = rp->r_size - uiop->uio_loffset;
    599 		mutex_exit(&rp->r_statelock);
    600 		if (diff <= 0)
    601 			break;
    602 		if (diff < n)
    603 			n = (size_t)diff;
    604 
    605 		if (vpm_enable) {
    606 			/*
    607 			 * Copy data.
    608 			 */
    609 			error = vpm_data_copy(vp, off + on, n, uiop,
    610 			    1, NULL, 0, S_READ);
    611 		} else {
    612 			base = segmap_getmapflt(segkmap, vp, off + on, n, 1,
    613 			    S_READ);
    614 
    615 			error = uiomove(base + on, n, UIO_READ, uiop);
    616 		}
    617 
    618 		if (!error) {
    619 			/*
    620 			 * If read a whole block or read to eof,
    621 			 * won't need this buffer again soon.
    622 			 */
    623 			mutex_enter(&rp->r_statelock);
    624 			if (n + on == MAXBSIZE ||
    625 			    uiop->uio_loffset == rp->r_size)
    626 				flags = SM_DONTNEED;
    627 			else
    628 				flags = 0;
    629 			mutex_exit(&rp->r_statelock);
    630 			if (vpm_enable) {
    631 				error = vpm_sync_pages(vp, off, n, flags);
    632 			} else {
    633 				error = segmap_release(segkmap, base, flags);
    634 			}
    635 		} else {
    636 			if (vpm_enable) {
    637 				(void) vpm_sync_pages(vp, off, n, 0);
    638 			} else {
    639 				(void) segmap_release(segkmap, base, 0);
    640 			}
    641 		}
    642 	} while (!error && uiop->uio_resid > 0);
    643 
    644 	return (error);
    645 }
    646 
    647 /* ARGSUSED */
    648 static int
    649 nfs3_write(vnode_t *vp, struct uio *uiop, int ioflag, cred_t *cr,
    650 	caller_context_t *ct)
    651 {
    652 	rlim64_t limit = uiop->uio_llimit;
    653 	rnode_t *rp;
    654 	u_offset_t off;
    655 	caddr_t base;
    656 	uint_t flags;
    657 	int remainder;
    658 	size_t n;
    659 	int on;
    660 	int error;
    661 	int resid;
    662 	offset_t offset;
    663 	mntinfo_t *mi;
    664 	uint_t bsize;
    665 
    666 	rp = VTOR(vp);
    667 
    668 	if (vp->v_type != VREG)
    669 		return (EISDIR);
    670 
    671 	mi = VTOMI(vp);
    672 	if (nfs_zone() != mi->mi_zone)
    673 		return (EIO);
    674 	if (uiop->uio_resid == 0)
    675 		return (0);
    676 
    677 	if (ioflag & FAPPEND) {
    678 		struct vattr va;
    679 
    680 		/*
    681 		 * Must serialize if appending.
    682 		 */
    683 		if (nfs_rw_lock_held(&rp->r_rwlock, RW_READER)) {
    684 			nfs_rw_exit(&rp->r_rwlock);
    685 			if (nfs_rw_enter_sig(&rp->r_rwlock, RW_WRITER,
    686 			    INTR(vp)))
    687 				return (EINTR);
    688 		}
    689 
    690 		va.va_mask = AT_SIZE;
    691 		error = nfs3getattr(vp, &va, cr);
    692 		if (error)
    693 			return (error);
    694 		uiop->uio_loffset = va.va_size;
    695 	}
    696 
    697 	offset = uiop->uio_loffset + uiop->uio_resid;
    698 
    699 	if (uiop->uio_loffset < 0 || offset < 0)
    700 		return (EINVAL);
    701 
    702 	if (limit == RLIM64_INFINITY || limit > MAXOFFSET_T)
    703 		limit = MAXOFFSET_T;
    704 
    705 	/*
    706 	 * Check to make sure that the process will not exceed
    707 	 * its limit on file size.  It is okay to write up to
    708 	 * the limit, but not beyond.  Thus, the write which
    709 	 * reaches the limit will be short and the next write
    710 	 * will return an error.
    711 	 */
    712 	remainder = 0;
    713 	if (offset > limit) {
    714 		remainder = offset - limit;
    715 		uiop->uio_resid = limit - uiop->uio_loffset;
    716 		if (uiop->uio_resid <= 0) {
    717 			proc_t *p = ttoproc(curthread);
    718 
    719 			uiop->uio_resid += remainder;
    720 			mutex_enter(&p->p_lock);
    721 			(void) rctl_action(rctlproc_legacy[RLIMIT_FSIZE],
    722 			    p->p_rctls, p, RCA_UNSAFE_SIGINFO);
    723 			mutex_exit(&p->p_lock);
    724 			return (EFBIG);
    725 		}
    726 	}
    727 
    728 	if (nfs_rw_enter_sig(&rp->r_lkserlock, RW_READER, INTR(vp)))
    729 		return (EINTR);
    730 
    731 	/*
    732 	 * Bypass VM if caching has been disabled (e.g., locking) or if
    733 	 * using client-side direct I/O and the file is not mmap'd and
    734 	 * there are no cached pages.
    735 	 */
    736 	if ((vp->v_flag & VNOCACHE) ||
    737 	    (((rp->r_flags & RDIRECTIO) || (mi->mi_flags & MI_DIRECTIO)) &&
    738 	    rp->r_mapcnt == 0 && rp->r_inmap == 0 &&
    739 	    !vn_has_cached_data(vp))) {
    740 		size_t bufsize;
    741 		int count;
    742 		u_offset_t org_offset;
    743 		stable_how stab_comm;
    744 
    745 nfs3_fwrite:
    746 		if (rp->r_flags & RSTALE) {
    747 			resid = uiop->uio_resid;
    748 			offset = uiop->uio_loffset;
    749 			error = rp->r_error;
    750 			/*
    751 			 * A close may have cleared r_error, if so,
    752 			 * propagate ESTALE error return properly
    753 			 */
    754 			if (error == 0)
    755 				error = ESTALE;
    756 			goto bottom;
    757 		}
    758 		bufsize = MIN(uiop->uio_resid, mi->mi_stsize);
    759 		base = kmem_alloc(bufsize, KM_SLEEP);
    760 		do {
    761 			if (ioflag & FDSYNC)
    762 				stab_comm = DATA_SYNC;
    763 			else
    764 				stab_comm = FILE_SYNC;
    765 			resid = uiop->uio_resid;
    766 			offset = uiop->uio_loffset;
    767 			count = MIN(uiop->uio_resid, bufsize);
    768 			org_offset = uiop->uio_loffset;
    769 			error = uiomove(base, count, UIO_WRITE, uiop);
    770 			if (!error) {
    771 				error = nfs3write(vp, base, org_offset,
    772 				    count, cr, &stab_comm);
    773 			}
    774 		} while (!error && uiop->uio_resid > 0);
    775 		kmem_free(base, bufsize);
    776 		goto bottom;
    777 	}
    778 
    779 
    780 	bsize = vp->v_vfsp->vfs_bsize;
    781 
    782 	do {
    783 		off = uiop->uio_loffset & MAXBMASK; /* mapping offset */
    784 		on = uiop->uio_loffset & MAXBOFFSET; /* Relative offset */
    785 		n = MIN(MAXBSIZE - on, uiop->uio_resid);
    786 
    787 		resid = uiop->uio_resid;
    788 		offset = uiop->uio_loffset;
    789 
    790 		if (rp->r_flags & RSTALE) {
    791 			error = rp->r_error;
    792 			/*
    793 			 * A close may have cleared r_error, if so,
    794 			 * propagate ESTALE error return properly
    795 			 */
    796 			if (error == 0)
    797 				error = ESTALE;
    798 			break;
    799 		}
    800 
    801 		/*
    802 		 * Don't create dirty pages faster than they
    803 		 * can be cleaned so that the system doesn't
    804 		 * get imbalanced.  If the async queue is
    805 		 * maxed out, then wait for it to drain before
    806 		 * creating more dirty pages.  Also, wait for
    807 		 * any threads doing pagewalks in the vop_getattr
    808 		 * entry points so that they don't block for
    809 		 * long periods.
    810 		 */
    811 		mutex_enter(&rp->r_statelock);
    812 		while ((mi->mi_max_threads != 0 &&
    813 		    rp->r_awcount > 2 * mi->mi_max_threads) ||
    814 		    rp->r_gcount > 0) {
    815 			if (INTR(vp)) {
    816 				klwp_t *lwp = ttolwp(curthread);
    817 
    818 				if (lwp != NULL)
    819 					lwp->lwp_nostop++;
    820 				if (!cv_wait_sig(&rp->r_cv, &rp->r_statelock)) {
    821 					mutex_exit(&rp->r_statelock);
    822 					if (lwp != NULL)
    823 						lwp->lwp_nostop--;
    824 					error = EINTR;
    825 					goto bottom;
    826 				}
    827 				if (lwp != NULL)
    828 					lwp->lwp_nostop--;
    829 			} else
    830 				cv_wait(&rp->r_cv, &rp->r_statelock);
    831 		}
    832 		mutex_exit(&rp->r_statelock);
    833 
    834 		/*
    835 		 * Touch the page and fault it in if it is not in core
    836 		 * before segmap_getmapflt or vpm_data_copy can lock it.
    837 		 * This is to avoid the deadlock if the buffer is mapped
    838 		 * to the same file through mmap which we want to write.
    839 		 */
    840 		uio_prefaultpages((long)n, uiop);
    841 
    842 		if (vpm_enable) {
    843 			/*
    844 			 * It will use kpm mappings, so no need to
    845 			 * pass an address.
    846 			 */
    847 			error = writerp(rp, NULL, n, uiop, 0);
    848 		} else  {
    849 			if (segmap_kpm) {
    850 				int pon = uiop->uio_loffset & PAGEOFFSET;
    851 				size_t pn = MIN(PAGESIZE - pon,
    852 				    uiop->uio_resid);
    853 				int pagecreate;
    854 
    855 				mutex_enter(&rp->r_statelock);
    856 				pagecreate = (pon == 0) && (pn == PAGESIZE ||
    857 				    uiop->uio_loffset + pn >= rp->r_size);
    858 				mutex_exit(&rp->r_statelock);
    859 
    860 				base = segmap_getmapflt(segkmap, vp, off + on,
    861 				    pn, !pagecreate, S_WRITE);
    862 
    863 				error = writerp(rp, base + pon, n, uiop,
    864 				    pagecreate);
    865 
    866 			} else {
    867 				base = segmap_getmapflt(segkmap, vp, off + on,
    868 				    n, 0, S_READ);
    869 				error = writerp(rp, base + on, n, uiop, 0);
    870 			}
    871 		}
    872 
    873 		if (!error) {
    874 			if (mi->mi_flags & MI_NOAC)
    875 				flags = SM_WRITE;
    876 			else if ((uiop->uio_loffset % bsize) == 0 ||
    877 			    IS_SWAPVP(vp)) {
    878 				/*
    879 				 * Have written a whole block.
    880 				 * Start an asynchronous write
    881 				 * and mark the buffer to
    882 				 * indicate that it won't be
    883 				 * needed again soon.
    884 				 */
    885 				flags = SM_WRITE | SM_ASYNC | SM_DONTNEED;
    886 			} else
    887 				flags = 0;
    888 			if ((ioflag & (FSYNC|FDSYNC)) ||
    889 			    (rp->r_flags & ROUTOFSPACE)) {
    890 				flags &= ~SM_ASYNC;
    891 				flags |= SM_WRITE;
    892 			}
    893 			if (vpm_enable) {
    894 				error = vpm_sync_pages(vp, off, n, flags);
    895 			} else {
    896 				error = segmap_release(segkmap, base, flags);
    897 			}
    898 		} else {
    899 			if (vpm_enable) {
    900 				(void) vpm_sync_pages(vp, off, n, 0);
    901 			} else {
    902 				(void) segmap_release(segkmap, base, 0);
    903 			}
    904 			/*
    905 			 * In the event that we got an access error while
    906 			 * faulting in a page for a write-only file just
    907 			 * force a write.
    908 			 */
    909 			if (error == EACCES)
    910 				goto nfs3_fwrite;
    911 		}
    912 	} while (!error && uiop->uio_resid > 0);
    913 
    914 bottom:
    915 	if (error) {
    916 		uiop->uio_resid = resid + remainder;
    917 		uiop->uio_loffset = offset;
    918 	} else
    919 		uiop->uio_resid += remainder;
    920 
    921 	nfs_rw_exit(&rp->r_lkserlock);
    922 
    923 	return (error);
    924 }
    925 
    926 /*
    927  * Flags are composed of {B_ASYNC, B_INVAL, B_FREE, B_DONTNEED}
    928  */
    929 static int
    930 nfs3_rdwrlbn(vnode_t *vp, page_t *pp, u_offset_t off, size_t len,
    931 	int flags, cred_t *cr)
    932 {
    933 	struct buf *bp;
    934 	int error;
    935 	page_t *savepp;
    936 	uchar_t fsdata;
    937 	stable_how stab_comm;
    938 
    939 	ASSERT(nfs_zone() == VTOMI(vp)->mi_zone);
    940 	bp = pageio_setup(pp, len, vp, flags);
    941 	ASSERT(bp != NULL);
    942 
    943 	/*
    944 	 * pageio_setup should have set b_addr to 0.  This
    945 	 * is correct since we want to do I/O on a page
    946 	 * boundary.  bp_mapin will use this addr to calculate
    947 	 * an offset, and then set b_addr to the kernel virtual
    948 	 * address it allocated for us.
    949 	 */
    950 	ASSERT(bp->b_un.b_addr == 0);
    951 
    952 	bp->b_edev = 0;
    953 	bp->b_dev = 0;
    954 	bp->b_lblkno = lbtodb(off);
    955 	bp->b_file = vp;
    956 	bp->b_offset = (offset_t)off;
    957 	bp_mapin(bp);
    958 
    959 	/*
    960 	 * Calculate the desired level of stability to write data
    961 	 * on the server and then mark all of the pages to reflect
    962 	 * this.
    963 	 */
    964 	if ((flags & (B_WRITE|B_ASYNC)) == (B_WRITE|B_ASYNC) &&
    965 	    freemem > desfree) {
    966 		stab_comm = UNSTABLE;
    967 		fsdata = C_DELAYCOMMIT;
    968 	} else {
    969 		stab_comm = FILE_SYNC;
    970 		fsdata = C_NOCOMMIT;
    971 	}
    972 
    973 	savepp = pp;
    974 	do {
    975 		pp->p_fsdata = fsdata;
    976 	} while ((pp = pp->p_next) != savepp);
    977 
    978 	error = nfs3_bio(bp, &stab_comm, cr);
    979 
    980 	bp_mapout(bp);
    981 	pageio_done(bp);
    982 
    983 	/*
    984 	 * If the server wrote pages in a more stable fashion than
    985 	 * was requested, then clear all of the marks in the pages
    986 	 * indicating that COMMIT operations were required.
    987 	 */
    988 	if (stab_comm != UNSTABLE && fsdata == C_DELAYCOMMIT) {
    989 		do {
    990 			pp->p_fsdata = C_NOCOMMIT;
    991 		} while ((pp = pp->p_next) != savepp);
    992 	}
    993 
    994 	return (error);
    995 }
    996 
    997 /*
    998  * Write to file.  Writes to remote server in largest size
    999  * chunks that the server can handle.  Write is synchronous.
   1000  */
   1001 static int
   1002 nfs3write(vnode_t *vp, caddr_t base, u_offset_t offset, int count, cred_t *cr,
   1003 	stable_how *stab_comm)
   1004 {
   1005 	mntinfo_t *mi;
   1006 	WRITE3args args;
   1007 	WRITE3res res;
   1008 	int error;
   1009 	int tsize;
   1010 	rnode_t *rp;
   1011 	int douprintf;
   1012 
   1013 	rp = VTOR(vp);
   1014 	mi = VTOMI(vp);
   1015 
   1016 	ASSERT(nfs_zone() == mi->mi_zone);
   1017 
   1018 	args.file = *VTOFH3(vp);
   1019 	args.stable = *stab_comm;
   1020 
   1021 	*stab_comm = FILE_SYNC;
   1022 
   1023 	douprintf = 1;
   1024 
   1025 	do {
   1026 		if ((vp->v_flag & VNOCACHE) ||
   1027 		    (rp->r_flags & RDIRECTIO) ||
   1028 		    (mi->mi_flags & MI_DIRECTIO))
   1029 			tsize = MIN(mi->mi_stsize, count);
   1030 		else
   1031 			tsize = MIN(mi->mi_curwrite, count);
   1032 		args.offset = (offset3)offset;
   1033 		args.count = (count3)tsize;
   1034 		args.data.data_len = (uint_t)tsize;
   1035 		args.data.data_val = base;
   1036 
   1037 		if (mi->mi_io_kstats) {
   1038 			mutex_enter(&mi->mi_lock);
   1039 			kstat_runq_enter(KSTAT_IO_PTR(mi->mi_io_kstats));
   1040 			mutex_exit(&mi->mi_lock);
   1041 		}
   1042 		args.mblk = NULL;
   1043 		do {
   1044 			error = rfs3call(mi, NFSPROC3_WRITE,
   1045 			    xdr_WRITE3args, (caddr_t)&args,
   1046 			    xdr_WRITE3res, (caddr_t)&res, cr,
   1047 			    &douprintf, &res.status, 0, NULL);
   1048 		} while (error == ENFS_TRYAGAIN);
   1049 		if (mi->mi_io_kstats) {
   1050 			mutex_enter(&mi->mi_lock);
   1051 			kstat_runq_exit(KSTAT_IO_PTR(mi->mi_io_kstats));
   1052 			mutex_exit(&mi->mi_lock);
   1053 		}
   1054 
   1055 		if (error)
   1056 			return (error);
   1057 		error = geterrno3(res.status);
   1058 		if (!error) {
   1059 			if (res.resok.count > args.count) {
   1060 				zcmn_err(getzoneid(), CE_WARN,
   1061 				    "nfs3write: server %s wrote %u, "
   1062 				    "requested was %u",
   1063 				    rp->r_server->sv_hostname,
   1064 				    res.resok.count, args.count);
   1065 				return (EIO);
   1066 			}
   1067 			if (res.resok.committed == UNSTABLE) {
   1068 				*stab_comm = UNSTABLE;
   1069 				if (args.stable == DATA_SYNC ||
   1070 				    args.stable == FILE_SYNC) {
   1071 					zcmn_err(getzoneid(), CE_WARN,
   1072 			"nfs3write: server %s did not commit to stable storage",
   1073 					    rp->r_server->sv_hostname);
   1074 					return (EIO);
   1075 				}
   1076 			}
   1077 			tsize = (int)res.resok.count;
   1078 			count -= tsize;
   1079 			base += tsize;
   1080 			offset += tsize;
   1081 			if (mi->mi_io_kstats) {
   1082 				mutex_enter(&mi->mi_lock);
   1083 				KSTAT_IO_PTR(mi->mi_io_kstats)->writes++;
   1084 				KSTAT_IO_PTR(mi->mi_io_kstats)->nwritten +=
   1085 				    tsize;
   1086 				mutex_exit(&mi->mi_lock);
   1087 			}
   1088 			lwp_stat_update(LWP_STAT_OUBLK, 1);
   1089 			mutex_enter(&rp->r_statelock);
   1090 			if (rp->r_flags & RHAVEVERF) {
   1091 				if (rp->r_verf != res.resok.verf) {
   1092 					nfs3_set_mod(vp);
   1093 					rp->r_verf = res.resok.verf;
   1094 					/*
   1095 					 * If the data was written UNSTABLE,
   1096 					 * then might as well stop because
   1097 					 * the whole block will have to get
   1098 					 * rewritten anyway.
   1099 					 */
   1100 					if (*stab_comm == UNSTABLE) {
   1101 						mutex_exit(&rp->r_statelock);
   1102 						break;
   1103 					}
   1104 				}
   1105 			} else {
   1106 				rp->r_verf = res.resok.verf;
   1107 				rp->r_flags |= RHAVEVERF;
   1108 			}
   1109 			/*
   1110 			 * Mark the attribute cache as timed out and
   1111 			 * set RWRITEATTR to indicate that the file
   1112 			 * was modified with a WRITE operation and
   1113 			 * that the attributes can not be trusted.
   1114 			 */
   1115 			PURGE_ATTRCACHE_LOCKED(rp);
   1116 			rp->r_flags |= RWRITEATTR;
   1117 			mutex_exit(&rp->r_statelock);
   1118 		}
   1119 	} while (!error && count);
   1120 
   1121 	return (error);
   1122 }
   1123 
   1124 /*
   1125  * Read from a file.  Reads data in largest chunks our interface can handle.
   1126  */
   1127 static int
   1128 nfs3read(vnode_t *vp, caddr_t base, offset_t offset, int count,
   1129 	size_t *residp, cred_t *cr)
   1130 {
   1131 	mntinfo_t *mi;
   1132 	READ3args args;
   1133 	READ3vres res;
   1134 	int tsize;
   1135 	int error;
   1136 	int douprintf;
   1137 	failinfo_t fi;
   1138 	rnode_t *rp;
   1139 	struct vattr va;
   1140 	hrtime_t t;
   1141 
   1142 	rp = VTOR(vp);
   1143 	mi = VTOMI(vp);
   1144 	ASSERT(nfs_zone() == mi->mi_zone);
   1145 	douprintf = 1;
   1146 
   1147 	args.file = *VTOFH3(vp);
   1148 	fi.vp = vp;
   1149 	fi.fhp = (caddr_t)&args.file;
   1150 	fi.copyproc = nfs3copyfh;
   1151 	fi.lookupproc = nfs3lookup;
   1152 	fi.xattrdirproc = acl_getxattrdir3;
   1153 
   1154 	res.pov.fres.vp = vp;
   1155 	res.pov.fres.vap = &va;
   1156 
   1157 	res.wlist = NULL;
   1158 	*residp = count;
   1159 	do {
   1160 		if (mi->mi_io_kstats) {
   1161 			mutex_enter(&mi->mi_lock);
   1162 			kstat_runq_enter(KSTAT_IO_PTR(mi->mi_io_kstats));
   1163 			mutex_exit(&mi->mi_lock);
   1164 		}
   1165 
   1166 		do {
   1167 			if ((vp->v_flag & VNOCACHE) ||
   1168 			    (rp->r_flags & RDIRECTIO) ||
   1169 			    (mi->mi_flags & MI_DIRECTIO))
   1170 				tsize = MIN(mi->mi_tsize, count);
   1171 			else
   1172 				tsize = MIN(mi->mi_curread, count);
   1173 			res.data.data_val = base;
   1174 			res.data.data_len = tsize;
   1175 			args.offset = (offset3)offset;
   1176 			args.count = (count3)tsize;
   1177 			args.res_uiop = NULL;
   1178 			args.res_data_val_alt = base;
   1179 
   1180 			t = gethrtime();
   1181 			error = rfs3call(mi, NFSPROC3_READ,
   1182 			    xdr_READ3args, (caddr_t)&args,
   1183 			    xdr_READ3vres, (caddr_t)&res, cr,
   1184 			    &douprintf, &res.status, 0, &fi);
   1185 		} while (error == ENFS_TRYAGAIN);
   1186 
   1187 		if (mi->mi_io_kstats) {
   1188 			mutex_enter(&mi->mi_lock);
   1189 			kstat_runq_exit(KSTAT_IO_PTR(mi->mi_io_kstats));
   1190 			mutex_exit(&mi->mi_lock);
   1191 		}
   1192 
   1193 		if (error)
   1194 			return (error);
   1195 
   1196 		error = geterrno3(res.status);
   1197 		if (error)
   1198 			return (error);
   1199 
   1200 		if (res.count != res.data.data_len) {
   1201 			zcmn_err(getzoneid(), CE_WARN,
   1202 			    "nfs3read: server %s returned incorrect amount",
   1203 			    rp->r_server->sv_hostname);
   1204 			return (EIO);
   1205 		}
   1206 
   1207 		count -= res.count;
   1208 		*residp = count;
   1209 		base += res.count;
   1210 		offset += res.count;
   1211 		if (mi->mi_io_kstats) {
   1212 			mutex_enter(&mi->mi_lock);
   1213 			KSTAT_IO_PTR(mi->mi_io_kstats)->reads++;
   1214 			KSTAT_IO_PTR(mi->mi_io_kstats)->nread += res.count;
   1215 			mutex_exit(&mi->mi_lock);
   1216 		}
   1217 		lwp_stat_update(LWP_STAT_INBLK, 1);
   1218 	} while (count && !res.eof);
   1219 
   1220 	if (res.pov.attributes) {
   1221 		mutex_enter(&rp->r_statelock);
   1222 		if (!CACHE_VALID(rp, va.va_mtime, va.va_size)) {
   1223 			mutex_exit(&rp->r_statelock);
   1224 			PURGE_ATTRCACHE(vp);
   1225 		} else {
   1226 			if (rp->r_mtime <= t)
   1227 				nfs_attrcache_va(vp, &va);
   1228 			mutex_exit(&rp->r_statelock);
   1229 		}
   1230 	}
   1231 
   1232 	return (0);
   1233 }
   1234 
   1235 /* ARGSUSED */
   1236 static int
   1237 nfs3_ioctl(vnode_t *vp, int cmd, intptr_t arg, int flag, cred_t *cr, int *rvalp,
   1238 	caller_context_t *ct)
   1239 {
   1240 
   1241 	if (nfs_zone() != VTOMI(vp)->mi_zone)
   1242 		return (EIO);
   1243 	switch (cmd) {
   1244 		case _FIODIRECTIO:
   1245 			return (nfs_directio(vp, (int)arg, cr));
   1246 		default:
   1247 			return (ENOTTY);
   1248 	}
   1249 }
   1250 
   1251 /* ARGSUSED */
   1252 static int
   1253 nfs3_getattr(vnode_t *vp, struct vattr *vap, int flags, cred_t *cr,
   1254 	caller_context_t *ct)
   1255 {
   1256 	int error;
   1257 	rnode_t *rp;
   1258 
   1259 	if (nfs_zone() != VTOMI(vp)->mi_zone)
   1260 		return (EIO);
   1261 	/*
   1262 	 * If it has been specified that the return value will
   1263 	 * just be used as a hint, and we are only being asked
   1264 	 * for size, fsid or rdevid, then return the client's
   1265 	 * notion of these values without checking to make sure
   1266 	 * that the attribute cache is up to date.
   1267 	 * The whole point is to avoid an over the wire GETATTR
   1268 	 * call.
   1269 	 */
   1270 	rp = VTOR(vp);
   1271 	if (flags & ATTR_HINT) {
   1272 		if (vap->va_mask ==
   1273 		    (vap->va_mask & (AT_SIZE | AT_FSID | AT_RDEV))) {
   1274 			mutex_enter(&rp->r_statelock);
   1275 			if (vap->va_mask | AT_SIZE)
   1276 				vap->va_size = rp->r_size;
   1277 			if (vap->va_mask | AT_FSID)
   1278 				vap->va_fsid = rp->r_attr.va_fsid;
   1279 			if (vap->va_mask | AT_RDEV)
   1280 				vap->va_rdev = rp->r_attr.va_rdev;
   1281 			mutex_exit(&rp->r_statelock);
   1282 			return (0);
   1283 		}
   1284 	}
   1285 
   1286 	/*
   1287 	 * Only need to flush pages if asking for the mtime
   1288 	 * and if there any dirty pages or any outstanding
   1289 	 * asynchronous (write) requests for this file.
   1290 	 */
   1291 	if (vap->va_mask & AT_MTIME) {
   1292 		if (vn_has_cached_data(vp) &&
   1293 		    ((rp->r_flags & RDIRTY) || rp->r_awcount > 0)) {
   1294 			mutex_enter(&rp->r_statelock);
   1295 			rp->r_gcount++;
   1296 			mutex_exit(&rp->r_statelock);
   1297 			error = nfs3_putpage(vp, (offset_t)0, 0, 0, cr, ct);
   1298 			mutex_enter(&rp->r_statelock);
   1299 			if (error && (error == ENOSPC || error == EDQUOT)) {
   1300 				if (!rp->r_error)
   1301 					rp->r_error = error;
   1302 			}
   1303 			if (--rp->r_gcount == 0)
   1304 				cv_broadcast(&rp->r_cv);
   1305 			mutex_exit(&rp->r_statelock);
   1306 		}
   1307 	}
   1308 
   1309 	return (nfs3getattr(vp, vap, cr));
   1310 }
   1311 
   1312 /*ARGSUSED4*/
   1313 static int
   1314 nfs3_setattr(vnode_t *vp, struct vattr *vap, int flags, cred_t *cr,
   1315 		caller_context_t *ct)
   1316 {
   1317 	int error;
   1318 	struct vattr va;
   1319 
   1320 	if (vap->va_mask & AT_NOSET)
   1321 		return (EINVAL);
   1322 	if (nfs_zone() != VTOMI(vp)->mi_zone)
   1323 		return (EIO);
   1324 
   1325 	va.va_mask = AT_UID | AT_MODE;
   1326 	error = nfs3getattr(vp, &va, cr);
   1327 	if (error)
   1328 		return (error);
   1329 
   1330 	error = secpolicy_vnode_setattr(cr, vp, vap, &va, flags, nfs3_accessx,
   1331 	    vp);
   1332 	if (error)
   1333 		return (error);
   1334 
   1335 	return (nfs3setattr(vp, vap, flags, cr));
   1336 }
   1337 
   1338 static int
   1339 nfs3setattr(vnode_t *vp, struct vattr *vap, int flags, cred_t *cr)
   1340 {
   1341 	int error;
   1342 	uint_t mask;
   1343 	SETATTR3args args;
   1344 	SETATTR3res res;
   1345 	int douprintf;
   1346 	rnode_t *rp;
   1347 	struct vattr va;
   1348 	mode_t omode;
   1349 	vsecattr_t *vsp;
   1350 	hrtime_t t;
   1351 
   1352 	ASSERT(nfs_zone() == VTOMI(vp)->mi_zone);
   1353 	mask = vap->va_mask;
   1354 
   1355 	rp = VTOR(vp);
   1356 
   1357 	/*
   1358 	 * Only need to flush pages if there are any pages and
   1359 	 * if the file is marked as dirty in some fashion.  The
   1360 	 * file must be flushed so that we can accurately
   1361 	 * determine the size of the file and the cached data
   1362 	 * after the SETATTR returns.  A file is considered to
   1363 	 * be dirty if it is either marked with RDIRTY, has
   1364 	 * outstanding i/o's active, or is mmap'd.  In this
   1365 	 * last case, we can't tell whether there are dirty
   1366 	 * pages, so we flush just to be sure.
   1367 	 */
   1368 	if (vn_has_cached_data(vp) &&
   1369 	    ((rp->r_flags & RDIRTY) ||
   1370 	    rp->r_count > 0 ||
   1371 	    rp->r_mapcnt > 0)) {
   1372 		ASSERT(vp->v_type != VCHR);
   1373 		error = nfs3_putpage(vp, (offset_t)0, 0, 0, cr, NULL);
   1374 		if (error && (error == ENOSPC || error == EDQUOT)) {
   1375 			mutex_enter(&rp->r_statelock);
   1376 			if (!rp->r_error)
   1377 				rp->r_error = error;
   1378 			mutex_exit(&rp->r_statelock);
   1379 		}
   1380 	}
   1381 
   1382 	args.object = *RTOFH3(rp);
   1383 	/*
   1384 	 * If the intent is for the server to set the times,
   1385 	 * there is no point in have the mask indicating set mtime or
   1386 	 * atime, because the vap values may be junk, and so result
   1387 	 * in an overflow error. Remove these flags from the vap mask
   1388 	 * before calling in this case, and restore them afterwards.
   1389 	 */
   1390 	if ((mask & (AT_ATIME | AT_MTIME)) && !(flags & ATTR_UTIME)) {
   1391 		/* Use server times, so don't set the args time fields */
   1392 		vap->va_mask &= ~(AT_ATIME | AT_MTIME);
   1393 		error = vattr_to_sattr3(vap, &args.new_attributes);
   1394 		vap->va_mask |= (mask & (AT_ATIME | AT_MTIME));
   1395 		if (mask & AT_ATIME) {
   1396 			args.new_attributes.atime.set_it = SET_TO_SERVER_TIME;
   1397 		}
   1398 		if (mask & AT_MTIME) {
   1399 			args.new_attributes.mtime.set_it = SET_TO_SERVER_TIME;
   1400 		}
   1401 	} else {
   1402 		/* Either do not set times or use the client specified times */
   1403 		error = vattr_to_sattr3(vap, &args.new_attributes);
   1404 	}
   1405 
   1406 	if (error) {
   1407 		/* req time field(s) overflow - return immediately */
   1408 		return (error);
   1409 	}
   1410 
   1411 	va.va_mask = AT_MODE | AT_CTIME;
   1412 	error = nfs3getattr(vp, &va, cr);
   1413 	if (error)
   1414 		return (error);
   1415 	omode = va.va_mode;
   1416 
   1417 tryagain:
   1418 	if (mask & AT_SIZE) {
   1419 		args.guard.check = TRUE;
   1420 		args.guard.obj_ctime.seconds = va.va_ctime.tv_sec;
   1421 		args.guard.obj_ctime.nseconds = va.va_ctime.tv_nsec;
   1422 	} else
   1423 		args.guard.check = FALSE;
   1424 
   1425 	douprintf = 1;
   1426 
   1427 	t = gethrtime();
   1428 
   1429 	error = rfs3call(VTOMI(vp), NFSPROC3_SETATTR,
   1430 	    xdr_SETATTR3args, (caddr_t)&args,
   1431 	    xdr_SETATTR3res, (caddr_t)&res, cr,
   1432 	    &douprintf, &res.status, 0, NULL);
   1433 
   1434 	/*
   1435 	 * Purge the access cache and ACL cache if changing either the
   1436 	 * owner of the file, the group owner, or the mode.  These may
   1437 	 * change the access permissions of the file, so purge old
   1438 	 * information and start over again.
   1439 	 */
   1440 	if (mask & (AT_UID | AT_GID | AT_MODE)) {
   1441 		(void) nfs_access_purge_rp(rp);
   1442 		if (rp->r_secattr != NULL) {
   1443 			mutex_enter(&rp->r_statelock);
   1444 			vsp = rp->r_secattr;
   1445 			rp->r_secattr = NULL;
   1446 			mutex_exit(&rp->r_statelock);
   1447 			if (vsp != NULL)
   1448 				nfs_acl_free(vsp);
   1449 		}
   1450 	}
   1451 
   1452 	if (error) {
   1453 		PURGE_ATTRCACHE(vp);
   1454 		return (error);
   1455 	}
   1456 
   1457 	error = geterrno3(res.status);
   1458 	if (!error) {
   1459 		/*
   1460 		 * If changing the size of the file, invalidate
   1461 		 * any local cached data which is no longer part
   1462 		 * of the file.  We also possibly invalidate the
   1463 		 * last page in the file.  We could use
   1464 		 * pvn_vpzero(), but this would mark the page as
   1465 		 * modified and require it to be written back to
   1466 		 * the server for no particularly good reason.
   1467 		 * This way, if we access it, then we bring it
   1468 		 * back in.  A read should be cheaper than a
   1469 		 * write.
   1470 		 */
   1471 		if (mask & AT_SIZE) {
   1472 			nfs_invalidate_pages(vp,
   1473 			    (vap->va_size & PAGEMASK), cr);
   1474 		}
   1475 		nfs3_cache_wcc_data(vp, &res.resok.obj_wcc, t, cr);
   1476 		/*
   1477 		 * Some servers will change the mode to clear the setuid
   1478 		 * and setgid bits when changing the uid or gid.  The
   1479 		 * client needs to compensate appropriately.
   1480 		 */
   1481 		if (mask & (AT_UID | AT_GID)) {
   1482 			int terror;
   1483 
   1484 			va.va_mask = AT_MODE;
   1485 			terror = nfs3getattr(vp, &va, cr);
   1486 			if (!terror &&
   1487 			    (((mask & AT_MODE) && va.va_mode != vap->va_mode) ||
   1488 			    (!(mask & AT_MODE) && va.va_mode != omode))) {
   1489 				va.va_mask = AT_MODE;
   1490 				if (mask & AT_MODE)
   1491 					va.va_mode = vap->va_mode;
   1492 				else
   1493 					va.va_mode = omode;
   1494 				(void) nfs3setattr(vp, &va, 0, cr);
   1495 			}
   1496 		}
   1497 	} else {
   1498 		nfs3_cache_wcc_data(vp, &res.resfail.obj_wcc, t, cr);
   1499 		/*
   1500 		 * If we got back a "not synchronized" error, then
   1501 		 * we need to retry with a new guard value.  The
   1502 		 * guard value used is the change time.  If the
   1503 		 * server returned post_op_attr, then we can just
   1504 		 * retry because we have the latest attributes.
   1505 		 * Otherwise, we issue a GETATTR to get the latest
   1506 		 * attributes and then retry.  If we couldn't get
   1507 		 * the attributes this way either, then we give
   1508 		 * up because we can't complete the operation as
   1509 		 * required.
   1510 		 */
   1511 		if (res.status == NFS3ERR_NOT_SYNC) {
   1512 			va.va_mask = AT_CTIME;
   1513 			if (nfs3getattr(vp, &va, cr) == 0)
   1514 				goto tryagain;
   1515 		}
   1516 		PURGE_STALE_FH(error, vp, cr);
   1517 	}
   1518 
   1519 	return (error);
   1520 }
   1521 
   1522 static int
   1523 nfs3_accessx(void *vp, int mode, cred_t *cr)
   1524 {
   1525 	ASSERT(nfs_zone() == VTOMI((vnode_t *)vp)->mi_zone);
   1526 	return (nfs3_access(vp, mode, 0, cr, NULL));
   1527 }
   1528 
   1529 /* ARGSUSED */
   1530 static int
   1531 nfs3_access(vnode_t *vp, int mode, int flags, cred_t *cr, caller_context_t *ct)
   1532 {
   1533 	int error;
   1534 	ACCESS3args args;
   1535 	ACCESS3res res;
   1536 	int douprintf;
   1537 	uint32 acc;
   1538 	rnode_t *rp;
   1539 	cred_t *cred, *ncr, *ncrfree = NULL;
   1540 	failinfo_t fi;
   1541 	nfs_access_type_t cacc;
   1542 	hrtime_t t;
   1543 
   1544 	acc = 0;
   1545 	if (nfs_zone() != VTOMI(vp)->mi_zone)
   1546 		return (EIO);
   1547 	if (mode & VREAD)
   1548 		acc |= ACCESS3_READ;
   1549 	if (mode & VWRITE) {
   1550 		if (vn_is_readonly(vp) && !IS_DEVVP(vp))
   1551 			return (EROFS);
   1552 		if (vp->v_type == VDIR)
   1553 			acc |= ACCESS3_DELETE;
   1554 		acc |= ACCESS3_MODIFY | ACCESS3_EXTEND;
   1555 	}
   1556 	if (mode & VEXEC) {
   1557 		if (vp->v_type == VDIR)
   1558 			acc |= ACCESS3_LOOKUP;
   1559 		else
   1560 			acc |= ACCESS3_EXECUTE;
   1561 	}
   1562 
   1563 	rp = VTOR(vp);
   1564 	args.object = *VTOFH3(vp);
   1565 	if (vp->v_type == VDIR) {
   1566 		args.access = ACCESS3_READ | ACCESS3_DELETE | ACCESS3_MODIFY |
   1567 		    ACCESS3_EXTEND | ACCESS3_LOOKUP;
   1568 	} else {
   1569 		args.access = ACCESS3_READ | ACCESS3_MODIFY | ACCESS3_EXTEND |
   1570 		    ACCESS3_EXECUTE;
   1571 	}
   1572 	fi.vp = vp;
   1573 	fi.fhp = (caddr_t)&args.object;
   1574 	fi.copyproc = nfs3copyfh;
   1575 	fi.lookupproc = nfs3lookup;
   1576 	fi.xattrdirproc = acl_getxattrdir3;
   1577 
   1578 	cred = cr;
   1579 	/*
   1580 	 * ncr and ncrfree both initially
   1581 	 * point to the memory area returned
   1582 	 * by crnetadjust();
   1583 	 * ncrfree not NULL when exiting means
   1584 	 * that we need to release it
   1585 	 */
   1586 	ncr = crnetadjust(cred);
   1587 	ncrfree = ncr;
   1588 tryagain:
   1589 	if (rp->r_acache != NULL) {
   1590 		cacc = nfs_access_check(rp, acc, cred);
   1591 		if (cacc == NFS_ACCESS_ALLOWED) {
   1592 			if (ncrfree != NULL)
   1593 				crfree(ncrfree);
   1594 			return (0);
   1595 		}
   1596 		if (cacc == NFS_ACCESS_DENIED) {
   1597 			/*
   1598 			 * If the cred can be adjusted, try again
   1599 			 * with the new cred.
   1600 			 */
   1601 			if (ncr != NULL) {
   1602 				cred = ncr;
   1603 				ncr = NULL;
   1604 				goto tryagain;
   1605 			}
   1606 			if (ncrfree != NULL)
   1607 				crfree(ncrfree);
   1608 			return (EACCES);
   1609 		}
   1610 	}
   1611 
   1612 	douprintf = 1;
   1613 
   1614 	t = gethrtime();
   1615 
   1616 	error = rfs3call(VTOMI(vp), NFSPROC3_ACCESS,
   1617 	    xdr_ACCESS3args, (caddr_t)&args,
   1618 	    xdr_ACCESS3res, (caddr_t)&res, cred,
   1619 	    &douprintf, &res.status, 0, &fi);
   1620 
   1621 	if (error) {
   1622 		if (ncrfree != NULL)
   1623 			crfree(ncrfree);
   1624 		return (error);
   1625 	}
   1626 
   1627 	error = geterrno3(res.status);
   1628 	if (!error) {
   1629 		nfs3_cache_post_op_attr(vp, &res.resok.obj_attributes, t, cr);
   1630 		nfs_access_cache(rp, args.access, res.resok.access, cred);
   1631 		/*
   1632 		 * we just cached results with cred; if cred is the
   1633 		 * adjusted credentials from crnetadjust, we do not want
   1634 		 * to release them before exiting: hence setting ncrfree
   1635 		 * to NULL
   1636 		 */
   1637 		if (cred != cr)
   1638 			ncrfree = NULL;
   1639 		if ((acc & res.resok.access) != acc) {
   1640 			/*
   1641 			 * If the cred can be adjusted, try again
   1642 			 * with the new cred.
   1643 			 */
   1644 			if (ncr != NULL) {
   1645 				cred = ncr;
   1646 				ncr = NULL;
   1647 				goto tryagain;
   1648 			}
   1649 			error = EACCES;
   1650 		}
   1651 	} else {
   1652 		nfs3_cache_post_op_attr(vp, &res.resfail.obj_attributes, t, cr);
   1653 		PURGE_STALE_FH(error, vp, cr);
   1654 	}
   1655 
   1656 	if (ncrfree != NULL)
   1657 		crfree(ncrfree);
   1658 
   1659 	return (error);
   1660 }
   1661 
   1662 static int nfs3_do_symlink_cache = 1;
   1663 
   1664 /* ARGSUSED */
   1665 static int
   1666 nfs3_readlink(vnode_t *vp, struct uio *uiop, cred_t *cr, caller_context_t *ct)
   1667 {
   1668 	int error;
   1669 	READLINK3args args;
   1670 	READLINK3res res;
   1671 	nfspath3 resdata_backup;
   1672 	rnode_t *rp;
   1673 	int douprintf;
   1674 	int len;
   1675 	failinfo_t fi;
   1676 	hrtime_t t;
   1677 
   1678 	/*
   1679 	 * Can't readlink anything other than a symbolic link.
   1680 	 */
   1681 	if (vp->v_type != VLNK)
   1682 		return (EINVAL);
   1683 	if (nfs_zone() != VTOMI(vp)->mi_zone)
   1684 		return (EIO);
   1685 
   1686 	rp = VTOR(vp);
   1687 	if (nfs3_do_symlink_cache && rp->r_symlink.contents != NULL) {
   1688 		error = nfs3_validate_caches(vp, cr);
   1689 		if (error)
   1690 			return (error);
   1691 		mutex_enter(&rp->r_statelock);
   1692 		if (rp->r_symlink.contents != NULL) {
   1693 			error = uiomove(rp->r_symlink.contents,
   1694 			    rp->r_symlink.len, UIO_READ, uiop);
   1695 			mutex_exit(&rp->r_statelock);
   1696 			return (error);
   1697 		}
   1698 		mutex_exit(&rp->r_statelock);
   1699 	}
   1700 
   1701 	args.symlink = *VTOFH3(vp);
   1702 	fi.vp = vp;
   1703 	fi.fhp = (caddr_t)&args.symlink;
   1704 	fi.copyproc = nfs3copyfh;
   1705 	fi.lookupproc = nfs3lookup;
   1706 	fi.xattrdirproc = acl_getxattrdir3;
   1707 
   1708 	res.resok.data = kmem_alloc(MAXPATHLEN, KM_SLEEP);
   1709 
   1710 	resdata_backup = res.resok.data;
   1711 
   1712 	douprintf = 1;
   1713 
   1714 	t = gethrtime();
   1715 
   1716 	error = rfs3call(VTOMI(vp), NFSPROC3_READLINK,
   1717 	    xdr_READLINK3args, (caddr_t)&args,
   1718 	    xdr_READLINK3res, (caddr_t)&res, cr,
   1719 	    &douprintf, &res.status, 0, &fi);
   1720 
   1721 	if (res.resok.data == nfs3nametoolong)
   1722 		error = EINVAL;
   1723 
   1724 	if (error) {
   1725 		kmem_free(resdata_backup, MAXPATHLEN);
   1726 		return (error);
   1727 	}
   1728 
   1729 	error = geterrno3(res.status);
   1730 	if (!error) {
   1731 		nfs3_cache_post_op_attr(vp, &res.resok.symlink_attributes, t,
   1732 		    cr);
   1733 		len = strlen(res.resok.data);
   1734 		error = uiomove(res.resok.data, len, UIO_READ, uiop);
   1735 		if (nfs3_do_symlink_cache && rp->r_symlink.contents == NULL) {
   1736 			mutex_enter(&rp->r_statelock);
   1737 				if (rp->r_symlink.contents == NULL) {
   1738 				rp->r_symlink.contents = res.resok.data;
   1739 				rp->r_symlink.len = len;
   1740 				rp->r_symlink.size = MAXPATHLEN;
   1741 				mutex_exit(&rp->r_statelock);
   1742 			} else {
   1743 				mutex_exit(&rp->r_statelock);
   1744 
   1745 				kmem_free((void *)res.resok.data, MAXPATHLEN);
   1746 			}
   1747 		} else {
   1748 			kmem_free((void *)res.resok.data, MAXPATHLEN);
   1749 		}
   1750 	} else {
   1751 		nfs3_cache_post_op_attr(vp,
   1752 		    &res.resfail.symlink_attributes, t, cr);
   1753 		PURGE_STALE_FH(error, vp, cr);
   1754 
   1755 		kmem_free((void *)res.resok.data, MAXPATHLEN);
   1756 
   1757 	}
   1758 
   1759 	/*
   1760 	 * The over the wire error for attempting to readlink something
   1761 	 * other than a symbolic link is ENXIO.  However, we need to
   1762 	 * return EINVAL instead of ENXIO, so we map it here.
   1763 	 */
   1764 	return (error == ENXIO ? EINVAL : error);
   1765 }
   1766 
   1767 /*
   1768  * Flush local dirty pages to stable storage on the server.
   1769  *
   1770  * If FNODSYNC is specified, then there is nothing to do because
   1771  * metadata changes are not cached on the client before being
   1772  * sent to the server.
   1773  */
   1774 /* ARGSUSED */
   1775 static int
   1776 nfs3_fsync(vnode_t *vp, int syncflag, cred_t *cr, caller_context_t *ct)
   1777 {
   1778 	int error;
   1779 
   1780 	if ((syncflag & FNODSYNC) || IS_SWAPVP(vp))
   1781 		return (0);
   1782 	if (nfs_zone() != VTOMI(vp)->mi_zone)
   1783 		return (EIO);
   1784 
   1785 	error = nfs3_putpage_commit(vp, (offset_t)0, 0, cr);
   1786 	if (!error)
   1787 		error = VTOR(vp)->r_error;
   1788 	return (error);
   1789 }
   1790 
   1791 /*
   1792  * Weirdness: if the file was removed or the target of a rename
   1793  * operation while it was open, it got renamed instead.  Here we
   1794  * remove the renamed file.
   1795  */
   1796 /* ARGSUSED */
   1797 static void
   1798 nfs3_inactive(vnode_t *vp, cred_t *cr, caller_context_t *ct)
   1799 {
   1800 	rnode_t *rp;
   1801 
   1802 	ASSERT(vp != DNLC_NO_VNODE);
   1803 
   1804 	/*
   1805 	 * If this is coming from the wrong zone, we let someone in the right
   1806 	 * zone take care of it asynchronously.  We can get here due to
   1807 	 * VN_RELE() being called from pageout() or fsflush().  This call may
   1808 	 * potentially turn into an expensive no-op if, for instance, v_count
   1809 	 * gets incremented in the meantime, but it's still correct.
   1810 	 */
   1811 	if (nfs_zone() != VTOMI(vp)->mi_zone) {
   1812 		nfs_async_inactive(vp, cr, nfs3_inactive);
   1813 		return;
   1814 	}
   1815 
   1816 	rp = VTOR(vp);
   1817 redo:
   1818 	if (rp->r_unldvp != NULL) {
   1819 		/*
   1820 		 * Save the vnode pointer for the directory where the
   1821 		 * unlinked-open file got renamed, then set it to NULL
   1822 		 * to prevent another thread from getting here before
   1823 		 * we're done with the remove.  While we have the
   1824 		 * statelock, make local copies of the pertinent rnode
   1825 		 * fields.  If we weren't to do this in an atomic way, the
   1826 		 * the unl* fields could become inconsistent with respect
   1827 		 * to each other due to a race condition between this
   1828 		 * code and nfs_remove().  See bug report 1034328.
   1829 		 */
   1830 		mutex_enter(&rp->r_statelock);
   1831 		if (rp->r_unldvp != NULL) {
   1832 			vnode_t *unldvp;
   1833 			char *unlname;
   1834 			cred_t *unlcred;
   1835 			REMOVE3args args;
   1836 			REMOVE3res res;
   1837 			int douprintf;
   1838 			int error;
   1839 			hrtime_t t;
   1840 
   1841 			unldvp = rp->r_unldvp;
   1842 			rp->r_unldvp = NULL;
   1843 			unlname = rp->r_unlname;
   1844 			rp->r_unlname = NULL;
   1845 			unlcred = rp->r_unlcred;
   1846 			rp->r_unlcred = NULL;
   1847 			mutex_exit(&rp->r_statelock);
   1848 
   1849 			/*
   1850 			 * If there are any dirty pages left, then flush
   1851 			 * them.  This is unfortunate because they just
   1852 			 * may get thrown away during the remove operation,
   1853 			 * but we have to do this for correctness.
   1854 			 */
   1855 			if (vn_has_cached_data(vp) &&
   1856 			    ((rp->r_flags & RDIRTY) || rp->r_count > 0)) {
   1857 				ASSERT(vp->v_type != VCHR);
   1858 				error = nfs3_putpage(vp, (offset_t)0, 0, 0,
   1859 				    cr, ct);
   1860 				if (error) {
   1861 					mutex_enter(&rp->r_statelock);
   1862 					if (!rp->r_error)
   1863 						rp->r_error = error;
   1864 					mutex_exit(&rp->r_statelock);
   1865 				}
   1866 			}
   1867 
   1868 			/*
   1869 			 * Do the remove operation on the renamed file
   1870 			 */
   1871 			setdiropargs3(&args.object, unlname, unldvp);
   1872 
   1873 			douprintf = 1;
   1874 
   1875 			t = gethrtime();
   1876 
   1877 			error = rfs3call(VTOMI(unldvp), NFSPROC3_REMOVE,
   1878 			    xdr_diropargs3, (caddr_t)&args,
   1879 			    xdr_REMOVE3res, (caddr_t)&res, unlcred,
   1880 			    &douprintf, &res.status, 0, NULL);
   1881 
   1882 			if (error) {
   1883 				PURGE_ATTRCACHE(unldvp);
   1884 			} else {
   1885 				error = geterrno3(res.status);
   1886 				if (!error) {
   1887 					nfs3_cache_wcc_data(unldvp,
   1888 					    &res.resok.dir_wcc, t, cr);
   1889 					if (HAVE_RDDIR_CACHE(VTOR(unldvp)))
   1890 						nfs_purge_rddir_cache(unldvp);
   1891 				} else {
   1892 					nfs3_cache_wcc_data(unldvp,
   1893 					    &res.resfail.dir_wcc, t, cr);
   1894 					PURGE_STALE_FH(error, unldvp, cr);
   1895 				}
   1896 			}
   1897 
   1898 			/*
   1899 			 * Release stuff held for the remove
   1900 			 */
   1901 			VN_RELE(unldvp);
   1902 			kmem_free(unlname, MAXNAMELEN);
   1903 			crfree(unlcred);
   1904 			goto redo;
   1905 		}
   1906 		mutex_exit(&rp->r_statelock);
   1907 	}
   1908 
   1909 	rp_addfree(rp, cr);
   1910 }
   1911 
   1912 /*
   1913  * Remote file system operations having to do with directory manipulation.
   1914  */
   1915 
   1916 /* ARGSUSED */
   1917 static int
   1918 nfs3_lookup(vnode_t *dvp, char *nm, vnode_t **vpp, struct pathname *pnp,
   1919 	int flags, vnode_t *rdir, cred_t *cr, caller_context_t *ct,
   1920 	int *direntflags, pathname_t *realpnp)
   1921 {
   1922 	int error;
   1923 	vnode_t *vp;
   1924 	vnode_t *avp = NULL;
   1925 	rnode_t *drp;
   1926 
   1927 	if (nfs_zone() != VTOMI(dvp)->mi_zone)
   1928 		return (EPERM);
   1929 
   1930 	drp = VTOR(dvp);
   1931 
   1932 	/*
   1933 	 * Are we looking up extended attributes?  If so, "dvp" is
   1934 	 * the file or directory for which we want attributes, and
   1935 	 * we need a lookup of the hidden attribute directory
   1936 	 * before we lookup the rest of the path.
   1937 	 */
   1938 	if (flags & LOOKUP_XATTR) {
   1939 		bool_t cflag = ((flags & CREATE_XATTR_DIR) != 0);
   1940 		mntinfo_t *mi;
   1941 
   1942 		mi = VTOMI(dvp);
   1943 		if (!(mi->mi_flags & MI_EXTATTR))
   1944 			return (EINVAL);
   1945 
   1946 		if (nfs_rw_enter_sig(&drp->r_rwlock, RW_READER, INTR(dvp)))
   1947 			return (EINTR);
   1948 
   1949 		(void) nfs3lookup_dnlc(dvp, XATTR_DIR_NAME, &avp, cr);
   1950 		if (avp == NULL)
   1951 			error = acl_getxattrdir3(dvp, &avp, cflag, cr, 0);
   1952 		else
   1953 			error = 0;
   1954 
   1955 		nfs_rw_exit(&drp->r_rwlock);
   1956 
   1957 		if (error) {
   1958 			if (mi->mi_flags & MI_EXTATTR)
   1959 				return (error);
   1960 			return (EINVAL);
   1961 		}
   1962 		dvp = avp;
   1963 		drp = VTOR(dvp);
   1964 	}
   1965 
   1966 	if (nfs_rw_enter_sig(&drp->r_rwlock, RW_READER, INTR(dvp))) {
   1967 		error = EINTR;
   1968 		goto out;
   1969 	}
   1970 
   1971 	error = nfs3lookup(dvp, nm, vpp, pnp, flags, rdir, cr, 0);
   1972 
   1973 	nfs_rw_exit(&drp->r_rwlock);
   1974 
   1975 	/*
   1976 	 * If vnode is a device, create special vnode.
   1977 	 */
   1978 	if (!error && IS_DEVVP(*vpp)) {
   1979 		vp = *vpp;
   1980 		*vpp = specvp(vp, vp->v_rdev, vp->v_type, cr);
   1981 		VN_RELE(vp);
   1982 	}
   1983 
   1984 out:
   1985 	if (avp != NULL)
   1986 		VN_RELE(avp);
   1987 
   1988 	return (error);
   1989 }
   1990 
   1991 static int nfs3_lookup_neg_cache = 1;
   1992 
   1993 #ifdef DEBUG
   1994 static int nfs3_lookup_dnlc_hits = 0;
   1995 static int nfs3_lookup_dnlc_misses = 0;
   1996 static int nfs3_lookup_dnlc_neg_hits = 0;
   1997 static int nfs3_lookup_dnlc_disappears = 0;
   1998 static int nfs3_lookup_dnlc_lookups = 0;
   1999 #endif
   2000 
   2001 /* ARGSUSED */
   2002 int
   2003 nfs3lookup(vnode_t *dvp, char *nm, vnode_t **vpp, struct pathname *pnp,
   2004 	int flags, vnode_t *rdir, cred_t *cr, int rfscall_flags)
   2005 {
   2006 	int error;
   2007 	rnode_t *drp;
   2008 
   2009 	ASSERT(nfs_zone() == VTOMI(dvp)->mi_zone);
   2010 	/*
   2011 	 * If lookup is for "", just return dvp.  Don't need
   2012 	 * to send it over the wire, look it up in the dnlc,
   2013 	 * or perform any access checks.
   2014 	 */
   2015 	if (*nm == '\0') {
   2016 		VN_HOLD(dvp);
   2017 		*vpp = dvp;
   2018 		return (0);
   2019 	}
   2020 
   2021 	/*
   2022 	 * Can't do lookups in non-directories.
   2023 	 */
   2024 	if (dvp->v_type != VDIR)
   2025 		return (ENOTDIR);
   2026 
   2027 	/*
   2028 	 * If we're called with RFSCALL_SOFT, it's important that
   2029 	 * the only rfscall is one we make directly; if we permit
   2030 	 * an access call because we're looking up "." or validating
   2031 	 * a dnlc hit, we'll deadlock because that rfscall will not
   2032 	 * have the RFSCALL_SOFT set.
   2033 	 */
   2034 	if (rfscall_flags & RFSCALL_SOFT)
   2035 		goto callit;
   2036 
   2037 	/*
   2038 	 * If lookup is for ".", just return dvp.  Don't need
   2039 	 * to send it over the wire or look it up in the dnlc,
   2040 	 * just need to check access.
   2041 	 */
   2042 	if (strcmp(nm, ".") == 0) {
   2043 		error = nfs3_access(dvp, VEXEC, 0, cr, NULL);
   2044 		if (error)
   2045 			return (error);
   2046 		VN_HOLD(dvp);
   2047 		*vpp = dvp;
   2048 		return (0);
   2049 	}
   2050 
   2051 	drp = VTOR(dvp);
   2052 	if (!(drp->r_flags & RLOOKUP)) {
   2053 		mutex_enter(&drp->r_statelock);
   2054 		drp->r_flags |= RLOOKUP;
   2055 		mutex_exit(&drp->r_statelock);
   2056 	}
   2057 
   2058 	/*
   2059 	 * Lookup this name in the DNLC.  If there was a valid entry,
   2060 	 * then return the results of the lookup.
   2061 	 */
   2062 	error = nfs3lookup_dnlc(dvp, nm, vpp, cr);
   2063 	if (error || *vpp != NULL)
   2064 		return (error);
   2065 
   2066 callit:
   2067 	error = nfs3lookup_otw(dvp, nm, vpp, cr, rfscall_flags);
   2068 
   2069 	return (error);
   2070 }
   2071 
   2072 static int
   2073 nfs3lookup_dnlc(vnode_t *dvp, char *nm, vnode_t **vpp, cred_t *cr)
   2074 {
   2075 	int error;
   2076 	vnode_t *vp;
   2077 
   2078 	ASSERT(*nm != '\0');
   2079 	ASSERT(nfs_zone() == VTOMI(dvp)->mi_zone);
   2080 	/*
   2081 	 * Lookup this name in the DNLC.  If successful, then validate
   2082 	 * the caches and then recheck the DNLC.  The DNLC is rechecked
   2083 	 * just in case this entry got invalidated during the call
   2084 	 * to nfs3_validate_caches.
   2085 	 *
   2086 	 * An assumption is being made that it is safe to say that a
   2087 	 * file exists which may not on the server.  Any operations to
   2088 	 * the server will fail with ESTALE.
   2089 	 */
   2090 #ifdef DEBUG
   2091 	nfs3_lookup_dnlc_lookups++;
   2092 #endif
   2093 	vp = dnlc_lookup(dvp, nm);
   2094 	if (vp != NULL) {
   2095 		VN_RELE(vp);
   2096 		if (vp == DNLC_NO_VNODE && !vn_is_readonly(dvp)) {
   2097 			PURGE_ATTRCACHE(dvp);
   2098 		}
   2099 		error = nfs3_validate_caches(dvp, cr);
   2100 		if (error)
   2101 			return (error);
   2102 		vp = dnlc_lookup(dvp, nm);
   2103 		if (vp != NULL) {
   2104 			error = nfs3_access(dvp, VEXEC, 0, cr, NULL);
   2105 			if (error) {
   2106 				VN_RELE(vp);
   2107 				return (error);
   2108 			}
   2109 			if (vp == DNLC_NO_VNODE) {
   2110 				VN_RELE(vp);
   2111 #ifdef DEBUG
   2112 				nfs3_lookup_dnlc_neg_hits++;
   2113 #endif
   2114 				return (ENOENT);
   2115 			}
   2116 			*vpp = vp;
   2117 #ifdef DEBUG
   2118 			nfs3_lookup_dnlc_hits++;
   2119 #endif
   2120 			return (0);
   2121 		}
   2122 #ifdef DEBUG
   2123 		nfs3_lookup_dnlc_disappears++;
   2124 #endif
   2125 	}
   2126 #ifdef DEBUG
   2127 	else
   2128 		nfs3_lookup_dnlc_misses++;
   2129 #endif
   2130 
   2131 	*vpp = NULL;
   2132 
   2133 	return (0);
   2134 }
   2135 
   2136 static int
   2137 nfs3lookup_otw(vnode_t *dvp, char *nm, vnode_t **vpp, cred_t *cr,
   2138 	int rfscall_flags)
   2139 {
   2140 	int error;
   2141 	LOOKUP3args args;
   2142 	LOOKUP3vres res;
   2143 	int douprintf;
   2144 	struct vattr vattr;
   2145 	struct vattr dvattr;
   2146 	vnode_t *vp;
   2147 	failinfo_t fi;
   2148 	hrtime_t t;
   2149 
   2150 	ASSERT(*nm != '\0');
   2151 	ASSERT(dvp->v_type == VDIR);
   2152 	ASSERT(nfs_zone() == VTOMI(dvp)->mi_zone);
   2153 
   2154 	setdiropargs3(&args.what, nm, dvp);
   2155 
   2156 	fi.vp = dvp;
   2157 	fi.fhp = (caddr_t)&args.what.dir;
   2158 	fi.copyproc = nfs3copyfh;
   2159 	fi.lookupproc = nfs3lookup;
   2160 	fi.xattrdirproc = acl_getxattrdir3;
   2161 	res.obj_attributes.fres.vp = dvp;
   2162 	res.obj_attributes.fres.vap = &vattr;
   2163 	res.dir_attributes.fres.vp = dvp;
   2164 	res.dir_attributes.fres.vap = &dvattr;
   2165 
   2166 	douprintf = 1;
   2167 
   2168 	t = gethrtime();
   2169 
   2170 	error = rfs3call(VTOMI(dvp), NFSPROC3_LOOKUP,
   2171 	    xdr_diropargs3, (caddr_t)&args,
   2172 	    xdr_LOOKUP3vres, (caddr_t)&res, cr,
   2173 	    &douprintf, &res.status, rfscall_flags, &fi);
   2174 
   2175 	if (error)
   2176 		return (error);
   2177 
   2178 	nfs3_cache_post_op_vattr(dvp, &res.dir_attributes, t, cr);
   2179 
   2180 	error = geterrno3(res.status);
   2181 	if (error) {
   2182 		PURGE_STALE_FH(error, dvp, cr);
   2183 		if (error == ENOENT && nfs3_lookup_neg_cache)
   2184 			dnlc_enter(dvp, nm, DNLC_NO_VNODE);
   2185 		return (error);
   2186 	}
   2187 
   2188 	if (res.obj_attributes.attributes) {
   2189 		vp = makenfs3node_va(&res.object, res.obj_attributes.fres.vap,
   2190 		    dvp->v_vfsp, t, cr, VTOR(dvp)->r_path, nm);
   2191 	} else {
   2192 		vp = makenfs3node_va(&res.object, NULL,
   2193 		    dvp->v_vfsp, t, cr, VTOR(dvp)->r_path, nm);
   2194 		if (vp->v_type == VNON) {
   2195 			vattr.va_mask = AT_TYPE;
   2196 			error = nfs3getattr(vp, &vattr, cr);
   2197 			if (error) {
   2198 				VN_RELE(vp);
   2199 				return (error);
   2200 			}
   2201 			vp->v_type = vattr.va_type;
   2202 		}
   2203 	}
   2204 
   2205 	if (!(rfscall_flags & RFSCALL_SOFT))
   2206 		dnlc_update(dvp, nm, vp);
   2207 
   2208 	*vpp = vp;
   2209 
   2210 	return (error);
   2211 }
   2212 
   2213 #ifdef DEBUG
   2214 static int nfs3_create_misses = 0;
   2215 #endif
   2216 
   2217 /* ARGSUSED */
   2218 static int
   2219 nfs3_create(vnode_t *dvp, char *nm, struct vattr *va, enum vcexcl exclusive,
   2220 	int mode, vnode_t **vpp, cred_t *cr, int lfaware, caller_context_t *ct,
   2221 	vsecattr_t *vsecp)
   2222 {
   2223 	int error;
   2224 	vnode_t *vp;
   2225 	rnode_t *rp;
   2226 	struct vattr vattr;
   2227 	rnode_t *drp;
   2228 	vnode_t *tempvp;
   2229 
   2230 	drp = VTOR(dvp);
   2231 	if (nfs_zone() != VTOMI(dvp)->mi_zone)
   2232 		return (EPERM);
   2233 	if (nfs_rw_enter_sig(&drp->r_rwlock, RW_WRITER, INTR(dvp)))
   2234 		return (EINTR);
   2235 
   2236 top:
   2237 	/*
   2238 	 * We make a copy of the attributes because the caller does not
   2239 	 * expect us to change what va points to.
   2240 	 */
   2241 	vattr = *va;
   2242 
   2243 	/*
   2244 	 * If the pathname is "", just use dvp.  Don't need
   2245 	 * to send it over the wire, look it up in the dnlc,
   2246 	 * or perform any access checks.
   2247 	 */
   2248 	if (*nm == '\0') {
   2249 		error = 0;
   2250 		VN_HOLD(dvp);
   2251 		vp = dvp;
   2252 	/*
   2253 	 * If the pathname is ".", just use dvp.  Don't need
   2254 	 * to send it over the wire or look it up in the dnlc,
   2255 	 * just need to check access.
   2256 	 */
   2257 	} else if (strcmp(nm, ".") == 0) {
   2258 		error = nfs3_access(dvp, VEXEC, 0, cr, ct);
   2259 		if (error) {
   2260 			nfs_rw_exit(&drp->r_rwlock);
   2261 			return (error);
   2262 		}
   2263 		VN_HOLD(dvp);
   2264 		vp = dvp;
   2265 	/*
   2266 	 * We need to go over the wire, just to be sure whether the
   2267 	 * file exists or not.  Using the DNLC can be dangerous in
   2268 	 * this case when making a decision regarding existence.
   2269 	 */
   2270 	} else {
   2271 		error = nfs3lookup_otw(dvp, nm, &vp, cr, 0);
   2272 	}
   2273 	if (!error) {
   2274 		if (exclusive == EXCL)
   2275 			error = EEXIST;
   2276 		else if (vp->v_type == VDIR && (mode & VWRITE))
   2277 			error = EISDIR;
   2278 		else {
   2279 			/*
   2280 			 * If vnode is a device, create special vnode.
   2281 			 */
   2282 			if (IS_DEVVP(vp)) {
   2283 				tempvp = vp;
   2284 				vp = specvp(vp, vp->v_rdev, vp->v_type, cr);
   2285 				VN_RELE(tempvp);
   2286 			}
   2287 			if (!(error = VOP_ACCESS(vp, mode, 0, cr, ct))) {
   2288 				if ((vattr.va_mask & AT_SIZE) &&
   2289 				    vp->v_type == VREG) {
   2290 					rp = VTOR(vp);
   2291 					/*
   2292 					 * Check here for large file handled
   2293 					 * by LF-unaware process (as
   2294 					 * ufs_create() does)
   2295 					 */
   2296 					if (!(lfaware & FOFFMAX)) {
   2297 						mutex_enter(&rp->r_statelock);
   2298 						if (rp->r_size > MAXOFF32_T)
   2299 							error = EOVERFLOW;
   2300 						mutex_exit(&rp->r_statelock);
   2301 					}
   2302 					if (!error) {
   2303 						vattr.va_mask = AT_SIZE;
   2304 						error = nfs3setattr(vp,
   2305 						    &vattr, 0, cr);
   2306 					}
   2307 				}
   2308 			}
   2309 		}
   2310 		nfs_rw_exit(&drp->r_rwlock);
   2311 		if (error) {
   2312 			VN_RELE(vp);
   2313 		} else {
   2314 			/*
   2315 			 * existing file got truncated, notify.
   2316 			 */
   2317 			vnevent_create(vp, ct);
   2318 			*vpp = vp;
   2319 		}
   2320 		return (error);
   2321 	}
   2322 
   2323 	dnlc_remove(dvp, nm);
   2324 
   2325 	/*
   2326 	 * Decide what the group-id of the created file should be.
   2327 	 * Set it in attribute list as advisory...
   2328 	 */
   2329 	error = setdirgid(dvp, &vattr.va_gid, cr);
   2330 	if (error) {
   2331 		nfs_rw_exit(&drp->r_rwlock);
   2332 		return (error);
   2333 	}
   2334 	vattr.va_mask |= AT_GID;
   2335 
   2336 	ASSERT(vattr.va_mask & AT_TYPE);
   2337 	if (vattr.va_type == VREG) {
   2338 		ASSERT(vattr.va_mask & AT_MODE);
   2339 		if (MANDMODE(vattr.va_mode)) {
   2340 			nfs_rw_exit(&drp->r_rwlock);
   2341 			return (EACCES);
   2342 		}
   2343 		error = nfs3create(dvp, nm, &vattr, exclusive, mode, vpp, cr,
   2344 		    lfaware);
   2345 		/*
   2346 		 * If this is not an exclusive create, then the CREATE
   2347 		 * request will be made with the GUARDED mode set.  This
   2348 		 * means that the server will return EEXIST if the file
   2349 		 * exists.  The file could exist because of a retransmitted
   2350 		 * request.  In this case, we recover by starting over and
   2351 		 * checking to see whether the file exists.  This second
   2352 		 * time through it should and a CREATE request will not be
   2353 		 * sent.
   2354 		 *
   2355 		 * This handles the problem of a dangling CREATE request
   2356 		 * which contains attributes which indicate that the file
   2357 		 * should be truncated.  This retransmitted request could
   2358 		 * possibly truncate valid data in the file if not caught
   2359 		 * by the duplicate request mechanism on the server or if
   2360 		 * not caught by other means.  The scenario is:
   2361 		 *
   2362 		 * Client transmits CREATE request with size = 0
   2363 		 * Client times out, retransmits request.
   2364 		 * Response to the first request arrives from the server
   2365 		 *  and the client proceeds on.
   2366 		 * Client writes data to the file.
   2367 		 * The server now processes retransmitted CREATE request
   2368 		 *  and truncates file.
   2369 		 *
   2370 		 * The use of the GUARDED CREATE request prevents this from
   2371 		 * happening because the retransmitted CREATE would fail
   2372 		 * with EEXIST and would not truncate the file.
   2373 		 */
   2374 		if (error == EEXIST && exclusive == NONEXCL) {
   2375 #ifdef DEBUG
   2376 			nfs3_create_misses++;
   2377 #endif
   2378 			goto top;
   2379 		}
   2380 		nfs_rw_exit(&drp->r_rwlock);
   2381 		return (error);
   2382 	}
   2383 	error = nfs3mknod(dvp, nm, &vattr, exclusive, mode, vpp, cr);
   2384 	nfs_rw_exit(&drp->r_rwlock);
   2385 	return (error);
   2386 }
   2387 
   2388 /* ARGSUSED */
   2389 static int
   2390 nfs3create(vnode_t *dvp, char *nm, struct vattr *va, enum vcexcl exclusive,
   2391 	int mode, vnode_t **vpp, cred_t *cr, int lfaware)
   2392 {
   2393 	int error;
   2394 	CREATE3args args;
   2395 	CREATE3res res;
   2396 	int douprintf;
   2397 	vnode_t *vp;
   2398 	struct vattr vattr;
   2399 	nfstime3 *verfp;
   2400 	rnode_t *rp;
   2401 	timestruc_t now;
   2402 	hrtime_t t;
   2403 
   2404 	ASSERT(nfs_zone() == VTOMI(dvp)->mi_zone);
   2405 	setdiropargs3(&args.where, nm, dvp);
   2406 	if (exclusive == EXCL) {
   2407 		args.how.mode = EXCLUSIVE;
   2408 		/*
   2409 		 * Construct the create verifier.  This verifier needs
   2410 		 * to be unique between different clients.  It also needs
   2411 		 * to vary for each exclusive create request generated
   2412 		 * from the client to the server.
   2413 		 *
   2414 		 * The first attempt is made to use the hostid and a
   2415 		 * unique number on the client.  If the hostid has not
   2416 		 * been set, the high resolution time that the exclusive
   2417 		 * create request is being made is used.  This will work
   2418 		 * unless two different clients, both with the hostid
   2419 		 * not set, attempt an exclusive create request on the
   2420 		 * same file, at exactly the same clock time.  The
   2421 		 * chances of this happening seem small enough to be
   2422 		 * reasonable.
   2423 		 */
   2424 		verfp = (nfstime3 *)&args.how.createhow3_u.verf;
   2425 		verfp->seconds = zone_get_hostid(NULL);
   2426 		if (verfp->seconds != 0)
   2427 			verfp->nseconds = newnum();
   2428 		else {
   2429 			gethrestime(&now);
   2430 			verfp->seconds = now.tv_sec;
   2431 			verfp->nseconds = now.tv_nsec;
   2432 		}
   2433 		/*
   2434 		 * Since the server will use this value for the mtime,
   2435 		 * make sure that it can't overflow. Zero out the MSB.
   2436 		 * The actual value does not matter here, only its uniqeness.
   2437 		 */
   2438 		verfp->seconds %= INT32_MAX;
   2439 	} else {
   2440 		/*
   2441 		 * Issue the non-exclusive create in guarded mode.  This
   2442 		 * may result in some false EEXIST responses for
   2443 		 * retransmitted requests, but these will be handled at
   2444 		 * a higher level.  By using GUARDED, duplicate requests
   2445 		 * to do file truncation and possible access problems
   2446 		 * can be avoided.
   2447 		 */
   2448 		args.how.mode = GUARDED;
   2449 		error = vattr_to_sattr3(va,
   2450 		    &args.how.createhow3_u.obj_attributes);
   2451 		if (error) {
   2452 			/* req time field(s) overflow - return immediately */
   2453 			return (error);
   2454 		}
   2455 	}
   2456 
   2457 	douprintf = 1;
   2458 
   2459 	t = gethrtime();
   2460 
   2461 	error = rfs3call(VTOMI(dvp), NFSPROC3_CREATE,
   2462 	    xdr_CREATE3args, (caddr_t)&args,
   2463 	    xdr_CREATE3res, (caddr_t)&res, cr,
   2464 	    &douprintf, &res.status, 0, NULL);
   2465 
   2466 	if (error) {
   2467 		PURGE_ATTRCACHE(dvp);
   2468 		return (error);
   2469 	}
   2470 
   2471 	error = geterrno3(res.status);
   2472 	if (!error) {
   2473 		nfs3_cache_wcc_data(dvp, &res.resok.dir_wcc, t, cr);
   2474 		if (HAVE_RDDIR_CACHE(VTOR(dvp)))
   2475 			nfs_purge_rddir_cache(dvp);
   2476 
   2477 		/*
   2478 		 * On exclusive create the times need to be explicitly
   2479 		 * set to clear any potential verifier that may be stored
   2480 		 * in one of these fields (see comment below).  This
   2481 		 * is done here to cover the case where no post op attrs
   2482 		 * were returned or a 'invalid' time was returned in
   2483 		 * the attributes.
   2484 		 */
   2485 		if (exclusive == EXCL)
   2486 			va->va_mask |= (AT_MTIME | AT_ATIME);
   2487 
   2488 		if (!res.resok.obj.handle_follows) {
   2489 			error = nfs3lookup(dvp, nm, &vp, NULL, 0, NULL, cr, 0);
   2490 			if (error)
   2491 				return (error);
   2492 		} else {
   2493 			if (res.resok.obj_attributes.attributes) {
   2494 				vp = makenfs3node(&res.resok.obj.handle,
   2495 				    &res.resok.obj_attributes.attr,
   2496 				    dvp->v_vfsp, t, cr, NULL, NULL);
   2497 			} else {
   2498 				vp = makenfs3node(&res.resok.obj.handle, NULL,
   2499 				    dvp->v_vfsp, t, cr, NULL, NULL);
   2500 
   2501 				/*
   2502 				 * On an exclusive create, it is possible
   2503 				 * that attributes were returned but those
   2504 				 * postop attributes failed to decode
   2505 				 * properly.  If this is the case,
   2506 				 * then most likely the atime or mtime
   2507 				 * were invalid for our client; this
   2508 				 * is caused by the server storing the
   2509 				 * create verifier in one of the time
   2510 				 * fields(most likely mtime).
   2511 				 * So... we are going to setattr just the
   2512 				 * atime/mtime to clear things up.
   2513 				 */
   2514 				if (exclusive == EXCL) {
   2515 					if (error =
   2516 					    nfs3excl_create_settimes(vp,
   2517 					    va, cr)) {
   2518 						/*
   2519 						 * Setting the times failed.
   2520 						 * Remove the file and return
   2521 						 * the error.
   2522 						 */
   2523 						VN_RELE(vp);
   2524 						(void) nfs3_remove(dvp,
   2525 						    nm, cr, NULL, 0);
   2526 						return (error);
   2527 					}
   2528 				}
   2529 
   2530 				/*
   2531 				 * This handles the non-exclusive case
   2532 				 * and the exclusive case where no post op
   2533 				 * attrs were returned.
   2534 				 */
   2535 				if (vp->v_type == VNON) {
   2536 					vattr.va_mask = AT_TYPE;
   2537 					error = nfs3getattr(vp, &vattr, cr);
   2538 					if (error) {
   2539 						VN_RELE(vp);
   2540 						return (error);
   2541 					}
   2542 					vp->v_type = vattr.va_type;
   2543 				}
   2544 			}
   2545 			dnlc_update(dvp, nm, vp);
   2546 		}
   2547 
   2548 		rp = VTOR(vp);
   2549 
   2550 		/*
   2551 		 * Check here for large file handled by
   2552 		 * LF-unaware process (as ufs_create() does)
   2553 		 */
   2554 		if ((va->va_mask & AT_SIZE) && vp->v_type == VREG &&
   2555 		    !(lfaware & FOFFMAX)) {
   2556 			mutex_enter(&rp->r_statelock);
   2557 			if (rp->r_size > MAXOFF32_T) {
   2558 				mutex_exit(&rp->r_statelock);
   2559 				VN_RELE(vp);
   2560 				return (EOVERFLOW);
   2561 			}
   2562 			mutex_exit(&rp->r_statelock);
   2563 		}
   2564 
   2565 		if (exclusive == EXCL &&
   2566 		    (va->va_mask & ~(AT_GID | AT_SIZE))) {
   2567 			/*
   2568 			 * If doing an exclusive create, then generate
   2569 			 * a SETATTR to set the initial attributes.
   2570 			 * Try to set the mtime and the atime to the
   2571 			 * server's current time.  It is somewhat
   2572 			 * expected that these fields will be used to
   2573 			 * store the exclusive create cookie.  If not,
   2574 			 * server implementors will need to know that
   2575 			 * a SETATTR will follow an exclusive create
   2576 			 * and the cookie should be destroyed if
   2577 			 * appropriate. This work may have been done
   2578 			 * earlier in this function if post op attrs
   2579 			 * were not available.
   2580 			 *
   2581 			 * The AT_GID and AT_SIZE bits are turned off
   2582 			 * so that the SETATTR request will not attempt
   2583 			 * to process these.  The gid will be set
   2584 			 * separately if appropriate.  The size is turned
   2585 			 * off because it is assumed that a new file will
   2586 			 * be created empty and if the file wasn't empty,
   2587 			 * then the exclusive create will have failed
   2588 			 * because the file must have existed already.
   2589 			 * Therefore, no truncate operation is needed.
   2590 			 */
   2591 			va->va_mask &= ~(AT_GID | AT_SIZE);
   2592 			error = nfs3setattr(vp, va, 0, cr);
   2593 			if (error) {
   2594 				/*
   2595 				 * Couldn't correct the attributes of
   2596 				 * the newly created file and the
   2597 				 * attributes are wrong.  Remove the
   2598 				 * file and return an error to the
   2599 				 * application.
   2600 				 */
   2601 				VN_RELE(vp);
   2602 				(void) nfs3_remove(dvp, nm, cr, NULL, 0);
   2603 				return (error);
   2604 			}
   2605 		}
   2606 
   2607 		if (va->va_gid != rp->r_attr.va_gid) {
   2608 			/*
   2609 			 * If the gid on the file isn't right, then
   2610 			 * generate a SETATTR to attempt to change
   2611 			 * it.  This may or may not work, depending
   2612 			 * upon the server's semantics for allowing
   2613 			 * file ownership changes.
   2614 			 */
   2615 			va->va_mask = AT_GID;
   2616 			(void) nfs3setattr(vp, va, 0, cr);
   2617 		}
   2618 
   2619 		/*
   2620 		 * If vnode is a device create special vnode
   2621 		 */
   2622 		if (IS_DEVVP(vp)) {
   2623 			*vpp = specvp(vp, vp->v_rdev, vp->v_type, cr);
   2624 			VN_RELE(vp);
   2625 		} else
   2626 			*vpp = vp;
   2627 	} else {
   2628 		nfs3_cache_wcc_data(dvp, &res.resfail.dir_wcc, t, cr);
   2629 		PURGE_STALE_FH(error, dvp, cr);
   2630 	}
   2631 
   2632 	return (error);
   2633 }
   2634 
   2635 /*
   2636  * Special setattr function to take care of rest of atime/mtime
   2637  * after successful exclusive create.  This function exists to avoid
   2638  * handling attributes from the server; exclusive the atime/mtime fields
   2639  * may be 'invalid' in client's view and therefore can not be trusted.
   2640  */
   2641 static int
   2642 nfs3excl_create_settimes(vnode_t *vp, struct vattr *vap, cred_t *cr)
   2643 {
   2644 	int error;
   2645 	uint_t mask;
   2646 	SETATTR3args args;
   2647 	SETATTR3res res;
   2648 	int douprintf;
   2649 	rnode_t *rp;
   2650 	hrtime_t t;
   2651 
   2652 	ASSERT(nfs_zone() == VTOMI(vp)->mi_zone);
   2653 	/* save the caller's mask so that it can be reset later */
   2654 	mask = vap->va_mask;
   2655 
   2656 	rp = VTOR(vp);
   2657 
   2658 	args.object = *RTOFH3(rp);
   2659 	args.guard.check = FALSE;
   2660 
   2661 	/* Use the mask to initialize the arguments */
   2662 	vap->va_mask = 0;
   2663 	error = vattr_to_sattr3(vap, &args.new_attributes);
   2664 
   2665 	/* We want to set just atime/mtime on this request */
   2666 	args.new_attributes.atime.set_it = SET_TO_SERVER_TIME;
   2667 	args.new_attributes.mtime.set_it = SET_TO_SERVER_TIME;
   2668 
   2669 	douprintf = 1;
   2670 
   2671 	t = gethrtime();
   2672 
   2673 	error = rfs3call(VTOMI(vp), NFSPROC3_SETATTR,
   2674 	    xdr_SETATTR3args, (caddr_t)&args,
   2675 	    xdr_SETATTR3res, (caddr_t)&res, cr,
   2676 	    &douprintf, &res.status, 0, NULL);
   2677 
   2678 	if (error) {
   2679 		vap->va_mask = mask;
   2680 		return (error);
   2681 	}
   2682 
   2683 	error = geterrno3(res.status);
   2684 	if (!error) {
   2685 		/*
   2686 		 * It is important to pick up the attributes.
   2687 		 * Since this is the exclusive create path, the
   2688 		 * attributes on the initial create were ignored
   2689 		 * and we need these to have the correct info.
   2690 		 */
   2691 		nfs3_cache_wcc_data(vp, &res.resok.obj_wcc, t, cr);
   2692 		/*
   2693 		 * No need to do the atime/mtime work again so clear
   2694 		 * the bits.
   2695 		 */
   2696 		mask &= ~(AT_ATIME | AT_MTIME);
   2697 	} else {
   2698 		nfs3_cache_wcc_data(vp, &res.resfail.obj_wcc, t, cr);
   2699 	}
   2700 
   2701 	vap->va_mask = mask;
   2702 
   2703 	return (error);
   2704 }
   2705 
   2706 /* ARGSUSED */
   2707 static int
   2708 nfs3mknod(vnode_t *dvp, char *nm, struct vattr *va, enum vcexcl exclusive,
   2709 	int mode, vnode_t **vpp, cred_t *cr)
   2710 {
   2711 	int error;
   2712 	MKNOD3args args;
   2713 	MKNOD3res res;
   2714 	int douprintf;
   2715 	vnode_t *vp;
   2716 	struct vattr vattr;
   2717 	hrtime_t t;
   2718 
   2719 	ASSERT(nfs_zone() == VTOMI(dvp)->mi_zone);
   2720 	switch (va->va_type) {
   2721 	case VCHR:
   2722 	case VBLK:
   2723 		setdiropargs3(&args.where, nm, dvp);
   2724 		args.what.type = (va->va_type == VCHR) ? NF3CHR : NF3BLK;
   2725 		error = vattr_to_sattr3(va,
   2726 		    &args.what.mknoddata3_u.device.dev_attributes);
   2727 		if (error) {
   2728 			/* req time field(s) overflow - return immediately */
   2729 			return (error);
   2730 		}
   2731 		args.what.mknoddata3_u.device.spec.specdata1 =
   2732 		    getmajor(va->va_rdev);
   2733 		args.what.mknoddata3_u.device.spec.specdata2 =
   2734 		    getminor(va->va_rdev);
   2735 		break;
   2736 
   2737 	case VFIFO:
   2738 	case VSOCK:
   2739 		setdiropargs3(&args.where, nm, dvp);
   2740 		args.what.type = (va->va_type == VFIFO) ? NF3FIFO : NF3SOCK;
   2741 		error = vattr_to_sattr3(va,
   2742 		    &args.what.mknoddata3_u.pipe_attributes);
   2743 		if (error) {
   2744 			/* req time field(s) overflow - return immediately */
   2745 			return (error);
   2746 		}
   2747 		break;
   2748 
   2749 	default:
   2750 		return (EINVAL);
   2751 	}
   2752 
   2753 	douprintf = 1;
   2754 
   2755 	t = gethrtime();
   2756 
   2757 	error = rfs3call(VTOMI(dvp), NFSPROC3_MKNOD,
   2758 	    xdr_MKNOD3args, (caddr_t)&args,
   2759 	    xdr_MKNOD3res, (caddr_t)&res, cr,
   2760 	    &douprintf, &res.status, 0, NULL);
   2761 
   2762 	if (error) {
   2763 		PURGE_ATTRCACHE(dvp);
   2764 		return (error);
   2765 	}
   2766 
   2767 	error = geterrno3(res.status);
   2768 	if (!error) {
   2769 		nfs3_cache_wcc_data(dvp, &res.resok.dir_wcc, t, cr);
   2770 		if (HAVE_RDDIR_CACHE(VTOR(dvp)))
   2771 			nfs_purge_rddir_cache(dvp);
   2772 
   2773 		if (!res.resok.obj.handle_follows) {
   2774 			error = nfs3lookup(dvp, nm, &vp, NULL, 0, NULL, cr, 0);
   2775 			if (error)
   2776 				return (error);
   2777 		} else {
   2778 			if (res.resok.obj_attributes.attributes) {
   2779 				vp = makenfs3node(&res.resok.obj.handle,
   2780 				    &res.resok.obj_attributes.attr,
   2781 				    dvp->v_vfsp, t, cr, NULL, NULL);
   2782 			} else {
   2783 				vp = makenfs3node(&res.resok.obj.handle, NULL,
   2784 				    dvp->v_vfsp, t, cr, NULL, NULL);
   2785 				if (vp->v_type == VNON) {
   2786 					vattr.va_mask = AT_TYPE;
   2787 					error = nfs3getattr(vp, &vattr, cr);
   2788 					if (error) {
   2789 						VN_RELE(vp);
   2790 						return (error);
   2791 					}
   2792 					vp->v_type = vattr.va_type;
   2793 				}
   2794 
   2795 			}
   2796 			dnlc_update(dvp, nm, vp);
   2797 		}
   2798 
   2799 		if (va->va_gid != VTOR(vp)->r_attr.va_gid) {
   2800 			va->va_mask = AT_GID;
   2801 			(void) nfs3setattr(vp, va, 0, cr);
   2802 		}
   2803 
   2804 		/*
   2805 		 * If vnode is a device create special vnode
   2806 		 */
   2807 		if (IS_DEVVP(vp)) {
   2808 			*vpp = specvp(vp, vp->v_rdev, vp->v_type, cr);
   2809 			VN_RELE(vp);
   2810 		} else
   2811 			*vpp = vp;
   2812 	} else {
   2813 		nfs3_cache_wcc_data(dvp, &res.resfail.dir_wcc, t, cr);
   2814 		PURGE_STALE_FH(error, dvp, cr);
   2815 	}
   2816 	return (error);
   2817 }
   2818 
   2819 /*
   2820  * Weirdness: if the vnode to be removed is open
   2821  * we rename it instead of removing it and nfs_inactive
   2822  * will remove the new name.
   2823  */
   2824 /* ARGSUSED */
   2825 static int
   2826 nfs3_remove(vnode_t *dvp, char *nm, cred_t *cr, caller_context_t *ct, int flags)
   2827 {
   2828 	int error;
   2829 	REMOVE3args args;
   2830 	REMOVE3res res;
   2831 	vnode_t *vp;
   2832 	char *tmpname;
   2833 	int douprintf;
   2834 	rnode_t *rp;
   2835 	rnode_t *drp;
   2836 	hrtime_t t;
   2837 
   2838 	if (nfs_zone() != VTOMI(dvp)->mi_zone)
   2839 		return (EPERM);
   2840 	drp = VTOR(dvp);
   2841 	if (nfs_rw_enter_sig(&drp->r_rwlock, RW_WRITER, INTR(dvp)))
   2842 		return (EINTR);
   2843 
   2844 	error = nfs3lookup(dvp, nm, &vp, NULL, 0, NULL, cr, 0);
   2845 	if (error) {
   2846 		nfs_rw_exit(&drp->r_rwlock);
   2847 		return (error);
   2848 	}
   2849 
   2850 	if (vp->v_type == VDIR && secpolicy_fs_linkdir(cr, dvp->v_vfsp)) {
   2851 		VN_RELE(vp);
   2852 		nfs_rw_exit(&drp->r_rwlock);
   2853 		return (EPERM);
   2854 	}
   2855 
   2856 	/*
   2857 	 * First just remove the entry from the name cache, as it
   2858 	 * is most likely the only entry for this vp.
   2859 	 */
   2860 	dnlc_remove(dvp, nm);
   2861 
   2862 	/*
   2863 	 * If the file has a v_count > 1 then there may be more than one
   2864 	 * entry in the name cache due multiple links or an open file,
   2865 	 * but we don't have the real reference count so flush all
   2866 	 * possible entries.
   2867 	 */
   2868 	if (vp->v_count > 1)
   2869 		dnlc_purge_vp(vp);
   2870 
   2871 	/*
   2872 	 * Now we have the real reference count on the vnode
   2873 	 */
   2874 	rp = VTOR(vp);
   2875 	mutex_enter(&rp->r_statelock);
   2876 	if (vp->v_count > 1 &&
   2877 	    (rp->r_unldvp == NULL || strcmp(nm, rp->r_unlname) == 0)) {
   2878 		mutex_exit(&rp->r_statelock);
   2879 		tmpname = newname();
   2880 		error = nfs3rename(dvp, nm, dvp, tmpname, cr, ct);
   2881 		if (error)
   2882 			kmem_free(tmpname, MAXNAMELEN);
   2883 		else {
   2884 			mutex_enter(&rp->r_statelock);
   2885 			if (rp->r_unldvp == NULL) {
   2886 				VN_HOLD(dvp);
   2887 				rp->r_unldvp = dvp;
   2888 				if (rp->r_unlcred != NULL)
   2889 					crfree(rp->r_unlcred);
   2890 				crhold(cr);
   2891 				rp->r_unlcred = cr;
   2892 				rp->r_unlname = tmpname;
   2893 			} else {
   2894 				kmem_free(rp->r_unlname, MAXNAMELEN);
   2895 				rp->r_unlname = tmpname;
   2896 			}
   2897 			mutex_exit(&rp->r_statelock);
   2898 		}
   2899 	} else {
   2900 		mutex_exit(&rp->r_statelock);
   2901 		/*
   2902 		 * We need to flush any dirty pages which happen to
   2903 		 * be hanging around before removing the file.  This
   2904 		 * shouldn't happen very often and mostly on file
   2905 		 * systems mounted "nocto".
   2906 		 */
   2907 		if (vn_has_cached_data(vp) &&
   2908 		    ((rp->r_flags & RDIRTY) || rp->r_count > 0)) {
   2909 			error = nfs3_putpage(vp, (offset_t)0, 0, 0, cr, ct);
   2910 			if (error && (error == ENOSPC || error == EDQUOT)) {
   2911 				mutex_enter(&rp->r_statelock);
   2912 				if (!rp->r_error)
   2913 					rp->r_error = error;
   2914 				mutex_exit(&rp->r_statelock);
   2915 			}
   2916 		}
   2917 
   2918 		setdiropargs3(&args.object, nm, dvp);
   2919 
   2920 		douprintf = 1;
   2921 
   2922 		t = gethrtime();
   2923 
   2924 		error = rfs3call(VTOMI(dvp), NFSPROC3_REMOVE,
   2925 		    xdr_diropargs3, (caddr_t)&args,
   2926 		    xdr_REMOVE3res, (caddr_t)&res, cr,
   2927 		    &douprintf, &res.status, 0, NULL);
   2928 
   2929 		/*
   2930 		 * The xattr dir may be gone after last attr is removed,
   2931 		 * so flush it from dnlc.
   2932 		 */
   2933 		if (dvp->v_flag & V_XATTRDIR)
   2934 			dnlc_purge_vp(dvp);
   2935 
   2936 		PURGE_ATTRCACHE(vp);
   2937 
   2938 		if (error) {
   2939 			PURGE_ATTRCACHE(dvp);
   2940 		} else {
   2941 			error = geterrno3(res.status);
   2942 			if (!error) {
   2943 				nfs3_cache_wcc_data(dvp, &res.resok.dir_wcc, t,
   2944 				    cr);
   2945 				if (HAVE_RDDIR_CACHE(drp))
   2946 					nfs_purge_rddir_cache(dvp);
   2947 			} else {
   2948 				nfs3_cache_wcc_data(dvp, &res.resfail.dir_wcc,
   2949 				    t, cr);
   2950 				PURGE_STALE_FH(error, dvp, cr);
   2951 			}
   2952 		}
   2953 	}
   2954 
   2955 	if (error == 0) {
   2956 		vnevent_remove(vp, dvp, nm, ct);
   2957 	}
   2958 	VN_RELE(vp);
   2959 
   2960 	nfs_rw_exit(&drp->r_rwlock);
   2961 
   2962 	return (error);
   2963 }
   2964 
   2965 /* ARGSUSED */
   2966 static int
   2967 nfs3_link(vnode_t *tdvp, vnode_t *svp, char *tnm, cred_t *cr,
   2968 	caller_context_t *ct, int flags)
   2969 {
   2970 	int error;
   2971 	LINK3args args;
   2972 	LINK3res res;
   2973 	vnode_t *realvp;
   2974 	int douprintf;
   2975 	mntinfo_t *mi;
   2976 	rnode_t *tdrp;
   2977 	hrtime_t t;
   2978 
   2979 	if (nfs_zone() != VTOMI(tdvp)->mi_zone)
   2980 		return (EPERM);
   2981 	if (VOP_REALVP(svp, &realvp, ct) == 0)
   2982 		svp = realvp;
   2983 
   2984 	mi = VTOMI(svp);
   2985 
   2986 	if (!(mi->mi_flags & MI_LINK))
   2987 		return (EOPNOTSUPP);
   2988 
   2989 	args.file = *VTOFH3(svp);
   2990 	setdiropargs3(&args.link, tnm, tdvp);
   2991 
   2992 	tdrp = VTOR(tdvp);
   2993 	if (nfs_rw_enter_sig(&tdrp->r_rwlock, RW_WRITER, INTR(tdvp)))
   2994 		return (EINTR);
   2995 
   2996 	dnlc_remove(tdvp, tnm);
   2997 
   2998 	douprintf = 1;
   2999 
   3000 	t = gethrtime();
   3001 
   3002 	error = rfs3call(mi, NFSPROC3_LINK,
   3003 	    xdr_LINK3args, (caddr_t)&args,
   3004 	    xdr_LINK3res, (caddr_t)&res, cr,
   3005 	    &douprintf, &res.status, 0, NULL);
   3006 
   3007 	if (error) {
   3008 		PURGE_ATTRCACHE(tdvp);
   3009 		PURGE_ATTRCACHE(svp);
   3010 		nfs_rw_exit(&tdrp->r_rwlock);
   3011 		return (error);
   3012 	}
   3013 
   3014 	error = geterrno3(res.status);
   3015 
   3016 	if (!error) {
   3017 		nfs3_cache_post_op_attr(svp, &res.resok.file_attributes, t, cr);
   3018 		nfs3_cache_wcc_data(tdvp, &res.resok.linkdir_wcc, t, cr);
   3019 		if (HAVE_RDDIR_CACHE(tdrp))
   3020 			nfs_purge_rddir_cache(tdvp);
   3021 		dnlc_update(tdvp, tnm, svp);
   3022 	} else {
   3023 		nfs3_cache_post_op_attr(svp, &res.resfail.file_attributes, t,
   3024 		    cr);
   3025 		nfs3_cache_wcc_data(tdvp, &res.resfail.linkdir_wcc, t, cr);
   3026 		if (error == EOPNOTSUPP) {
   3027 			mutex_enter(&mi->mi_lock);
   3028 			mi->mi_flags &= ~MI_LINK;
   3029 			mutex_exit(&mi->mi_lock);
   3030 		}
   3031 	}
   3032 
   3033 	nfs_rw_exit(&tdrp->r_rwlock);
   3034 
   3035 	if (!error) {
   3036 		/*
   3037 		 * Notify the source file of this link operation.
   3038 		 */
   3039 		vnevent_link(svp, ct);
   3040 	}
   3041 	return (error);
   3042 }
   3043 
   3044 /* ARGSUSED */
   3045 static int
   3046 nfs3_rename(vnode_t *odvp, char *onm, vnode_t *ndvp, char *nnm, cred_t *cr,
   3047 	caller_context_t *ct, int flags)
   3048 {
   3049 	vnode_t *realvp;
   3050 
   3051 	if (nfs_zone() != VTOMI(odvp)->mi_zone)
   3052 		return (EPERM);
   3053 	if (VOP_REALVP(ndvp, &realvp, ct) == 0)
   3054 		ndvp = realvp;
   3055 
   3056 	return (nfs3rename(odvp, onm, ndvp, nnm, cr, ct));
   3057 }
   3058 
   3059 /*
   3060  * nfs3rename does the real work of renaming in NFS Version 3.
   3061  */
   3062 static int
   3063 nfs3rename(vnode_t *odvp, char *onm, vnode_t *ndvp, char *nnm, cred_t *cr,
   3064     caller_context_t *ct)
   3065 {
   3066 	int error;
   3067 	RENAME3args args;
   3068 	RENAME3res res;
   3069 	int douprintf;
   3070 	vnode_t *nvp = NULL;
   3071 	vnode_t *ovp = NULL;
   3072 	char *tmpname;
   3073 	rnode_t *rp;
   3074 	rnode_t *odrp;
   3075 	rnode_t *ndrp;
   3076 	hrtime_t t;
   3077 
   3078 	ASSERT(nfs_zone() == VTOMI(odvp)->mi_zone);
   3079 
   3080 	if (strcmp(onm, ".") == 0 || strcmp(onm, "..") == 0 ||
   3081 	    strcmp(nnm, ".") == 0 || strcmp(nnm, "..") == 0)
   3082 		return (EINVAL);
   3083 
   3084 	odrp = VTOR(odvp);
   3085 	ndrp = VTOR(ndvp);
   3086 	if ((intptr_t)odrp < (intptr_t)ndrp) {
   3087 		if (nfs_rw_enter_sig(&odrp->r_rwlock, RW_WRITER, INTR(odvp)))
   3088 			return (EINTR);
   3089 		if (nfs_rw_enter_sig(&ndrp->r_rwlock, RW_WRITER, INTR(ndvp))) {
   3090 			nfs_rw_exit(&odrp->r_rwlock);
   3091 			return (EINTR);
   3092 		}
   3093 	} else {
   3094 		if (nfs_rw_enter_sig(&ndrp->r_rwlock, RW_WRITER, INTR(ndvp)))
   3095 			return (EINTR);
   3096 		if (nfs_rw_enter_sig(&odrp->r_rwlock, RW_WRITER, INTR(odvp))) {
   3097 			nfs_rw_exit(&ndrp->r_rwlock);
   3098 			return (EINTR);
   3099 		}
   3100 	}
   3101 
   3102 	/*
   3103 	 * Lookup the target file.  If it exists, it needs to be
   3104 	 * checked to see whether it is a mount point and whether
   3105 	 * it is active (open).
   3106 	 */
   3107 	error = nfs3lookup(ndvp, nnm, &nvp, NULL, 0, NULL, cr, 0);
   3108 	if (!error) {
   3109 		/*
   3110 		 * If this file has been mounted on, then just
   3111 		 * return busy because renaming to it would remove
   3112 		 * the mounted file system from the name space.
   3113 		 */
   3114 		if (vn_mountedvfs(nvp) != NULL) {
   3115 			VN_RELE(nvp);
   3116 			nfs_rw_exit(&odrp->r_rwlock);
   3117 			nfs_rw_exit(&ndrp->r_rwlock);
   3118 			return (EBUSY);
   3119 		}
   3120 
   3121 		/*
   3122 		 * Purge the name cache of all references to this vnode
   3123 		 * so that we can check the reference count to infer
   3124 		 * whether it is active or not.
   3125 		 */
   3126 		/*
   3127 		 * First just remove the entry from the name cache, as it
   3128 		 * is most likely the only entry for this vp.
   3129 		 */
   3130 		dnlc_remove(ndvp, nnm);
   3131 		/*
   3132 		 * If the file has a v_count > 1 then there may be more
   3133 		 * than one entry in the name cache due multiple links
   3134 		 * or an open file, but we don't have the real reference
   3135 		 * count so flush all possible entries.
   3136 		 */
   3137 		if (nvp->v_count > 1)
   3138 			dnlc_purge_vp(nvp);
   3139 
   3140 		/*
   3141 		 * If the vnode is active and is not a directory,
   3142 		 * arrange to rename it to a
   3143 		 * temporary file so that it will continue to be
   3144 		 * accessible.  This implements the "unlink-open-file"
   3145 		 * semantics for the target of a rename operation.
   3146 		 * Before doing this though, make sure that the
   3147 		 * source and target files are not already the same.
   3148 		 */
   3149 		if (nvp->v_count > 1 && nvp->v_type != VDIR) {
   3150 			/*
   3151 			 * Lookup the source name.
   3152 			 */
   3153 			error = nfs3lookup(odvp, onm, &ovp, NULL, 0, NULL,
   3154 			    cr, 0);
   3155 
   3156 			/*
   3157 			 * The source name *should* already exist.
   3158 			 */
   3159 			if (error) {
   3160 				VN_RELE(nvp);
   3161 				nfs_rw_exit(&odrp->r_rwlock);
   3162 				nfs_rw_exit(&ndrp->r_rwlock);
   3163 				return (error);
   3164 			}
   3165 
   3166 			/*
   3167 			 * Compare the two vnodes.  If they are the same,
   3168 			 * just release all held vnodes and return success.
   3169 			 */
   3170 			if (ovp == nvp) {
   3171 				VN_RELE(ovp);
   3172 				VN_RELE(nvp);
   3173 				nfs_rw_exit(&odrp->r_rwlock);
   3174 				nfs_rw_exit(&ndrp->r_rwlock);
   3175 				return (0);
   3176 			}
   3177 
   3178 			/*
   3179 			 * Can't mix and match directories and non-
   3180 			 * directories in rename operations.  We already
   3181 			 * know that the target is not a directory.  If
   3182 			 * the source is a directory, return an error.
   3183 			 */
   3184 			if (ovp->v_type == VDIR) {
   3185 				VN_RELE(ovp);
   3186 				VN_RELE(nvp);
   3187 				nfs_rw_exit(&odrp->r_rwlock);
   3188 				nfs_rw_exit(&ndrp->r_rwlock);
   3189 				return (ENOTDIR);
   3190 			}
   3191 
   3192 			/*
   3193 			 * The target file exists, is not the same as
   3194 			 * the source file, and is active.  Link it
   3195 			 * to a temporary filename to avoid having
   3196 			 * the server removing the file completely.
   3197 			 */
   3198 			tmpname = newname();
   3199 			error = nfs3_link(ndvp, nvp, tmpname, cr, NULL, 0);
   3200 			if (error == EOPNOTSUPP) {
   3201 				error = nfs3_rename(ndvp, nnm, ndvp, tmpname,
   3202 				    cr, NULL, 0);
   3203 			}
   3204 			if (error) {
   3205 				kmem_free(tmpname, MAXNAMELEN);
   3206 				VN_RELE(ovp);
   3207 				VN_RELE(nvp);
   3208 				nfs_rw_exit(&odrp->r_rwlock);
   3209 				nfs_rw_exit(&ndrp->r_rwlock);
   3210 				return (error);
   3211 			}
   3212 			rp = VTOR(nvp);
   3213 			mutex_enter(&rp->r_statelock);
   3214 			if (rp->r_unldvp == NULL) {
   3215 				VN_HOLD(ndvp);
   3216 				rp->r_unldvp = ndvp;
   3217 				if (rp->r_unlcred != NULL)
   3218 					crfree(rp->r_unlcred);
   3219 				crhold(cr);
   3220 				rp->r_unlcred = cr;
   3221 				rp->r_unlname = tmpname;
   3222 			} else {
   3223 				kmem_free(rp->r_unlname, MAXNAMELEN);
   3224 				rp->r_unlname = tmpname;
   3225 			}
   3226 			mutex_exit(&rp->r_statelock);
   3227 		}
   3228 	}
   3229 
   3230 	if (ovp == NULL) {
   3231 		/*
   3232 		 * When renaming directories to be a subdirectory of a
   3233 		 * different parent, the dnlc entry for ".." will no
   3234 		 * longer be valid, so it must be removed.
   3235 		 *
   3236 		 * We do a lookup here to determine whether we are renaming
   3237 		 * a directory and we need to check if we are renaming
   3238 		 * an unlinked file.  This might have already been done
   3239 		 * in previous code, so we check ovp == NULL to avoid
   3240 		 * doing it twice.
   3241 		 */
   3242 
   3243 		error = nfs3lookup(odvp, onm, &ovp, NULL, 0, NULL, cr, 0);
   3244 		/*
   3245 		 * The source name *should* already exist.
   3246 		 */
   3247 		if (error) {
   3248 			nfs_rw_exit(&odrp->r_rwlock);
   3249 			nfs_rw_exit(&ndrp->r_rwlock);
   3250 			if (nvp) {
   3251 				VN_RELE(nvp);
   3252 			}
   3253 			return (error);
   3254 		}
   3255 		ASSERT(ovp != NULL);
   3256 	}
   3257 
   3258 	dnlc_remove(odvp, onm);
   3259 	dnlc_remove(ndvp, nnm);
   3260 
   3261 	setdiropargs3(&args.from, onm, odvp);
   3262 	setdiropargs3(&args.to, nnm, ndvp);
   3263 
   3264 	douprintf = 1;
   3265 
   3266 	t = gethrtime();
   3267 
   3268 	error = rfs3call(VTOMI(odvp), NFSPROC3_RENAME,
   3269 	    xdr_RENAME3args, (caddr_t)&args,
   3270 	    xdr_RENAME3res, (caddr_t)&res, cr,
   3271 	    &douprintf, &res.status, 0, NULL);
   3272 
   3273 	if (error) {
   3274 		PURGE_ATTRCACHE(odvp);
   3275 		PURGE_ATTRCACHE(ndvp);
   3276 		VN_RELE(ovp);
   3277 		nfs_rw_exit(&odrp->r_rwlock);
   3278 		nfs_rw_exit(&ndrp->r_rwlock);
   3279 		if (nvp) {
   3280 			VN_RELE(nvp);
   3281 		}
   3282 		return (error);
   3283 	}
   3284 
   3285 	error = geterrno3(res.status);
   3286 
   3287 	if (!error) {
   3288 		nfs3_cache_wcc_data(odvp, &res.resok.fromdir_wcc, t, cr);
   3289 		if (HAVE_RDDIR_CACHE(odrp))
   3290 			nfs_purge_rddir_cache(odvp);
   3291 		if (ndvp != odvp) {
   3292 			nfs3_cache_wcc_data(ndvp, &res.resok.todir_wcc, t, cr);
   3293 			if (HAVE_RDDIR_CACHE(ndrp))
   3294 				nfs_purge_rddir_cache(ndvp);
   3295 		}
   3296 		/*
   3297 		 * when renaming directories to be a subdirectory of a
   3298 		 * different parent, the dnlc entry for ".." will no
   3299 		 * longer be valid, so it must be removed
   3300 		 */
   3301 		rp = VTOR(ovp);
   3302 		if (ndvp != odvp) {
   3303 			if (ovp->v_type == VDIR) {
   3304 				dnlc_remove(ovp, "..");
   3305 				if (HAVE_RDDIR_CACHE(rp))
   3306 					nfs_purge_rddir_cache(ovp);
   3307 			}
   3308 		}
   3309 
   3310 		/*
   3311 		 * If we are renaming the unlinked file, update the
   3312 		 * r_unldvp and r_unlname as needed.
   3313 		 */
   3314 		mutex_enter(&rp->r_statelock);
   3315 		if (rp->r_unldvp != NULL) {
   3316 			if (strcmp(rp->r_unlname, onm) == 0) {
   3317 				(void) strncpy(rp->r_unlname, nnm, MAXNAMELEN);
   3318 				rp->r_unlname[MAXNAMELEN - 1] = '\0';
   3319 
   3320 				if (ndvp != rp->r_unldvp) {
   3321 					VN_RELE(rp->r_unldvp);
   3322 					rp->r_unldvp = ndvp;
   3323 					VN_HOLD(ndvp);
   3324 				}
   3325 			}
   3326 		}
   3327 		mutex_exit(&rp->r_statelock);
   3328 	} else {
   3329 		nfs3_cache_wcc_data(odvp, &res.resfail.fromdir_wcc, t, cr);
   3330 		if (ndvp != odvp) {
   3331 			nfs3_cache_wcc_data(ndvp, &res.resfail.todir_wcc, t,
   3332 			    cr);
   3333 		}
   3334 		/*
   3335 		 * System V defines rename to return EEXIST, not
   3336 		 * ENOTEMPTY if the target directory is not empty.
   3337 		 * Over the wire, the error is NFSERR_ENOTEMPTY
   3338 		 * which geterrno maps to ENOTEMPTY.
   3339 		 */
   3340 		if (error == ENOTEMPTY)
   3341 			error = EEXIST;
   3342 	}
   3343 
   3344 	if (error == 0) {
   3345 		if (nvp)
   3346 			vnevent_rename_dest(nvp, ndvp, nnm, ct);
   3347 
   3348 		if (odvp != ndvp)
   3349 			vnevent_rename_dest_dir(ndvp, ct);
   3350 		ASSERT(ovp != NULL);
   3351 		vnevent_rename_src(ovp, odvp, onm, ct);
   3352 	}
   3353 
   3354 	if (nvp) {
   3355 		VN_RELE(nvp);
   3356 	}
   3357 	VN_RELE(ovp);
   3358 
   3359 	nfs_rw_exit(&odrp->r_rwlock);
   3360 	nfs_rw_exit(&ndrp->r_rwlock);
   3361 
   3362 	return (error);
   3363 }
   3364 
   3365 /* ARGSUSED */
   3366 static int
   3367 nfs3_mkdir(vnode_t *dvp, char *nm, struct vattr *va, vnode_t **vpp, cred_t *cr,
   3368 	caller_context_t *ct, int flags, vsecattr_t *vsecp)
   3369 {
   3370 	int error;
   3371 	MKDIR3args args;
   3372 	MKDIR3res res;
   3373 	int douprintf;
   3374 	struct vattr vattr;
   3375 	vnode_t *vp;
   3376 	rnode_t *drp;
   3377 	hrtime_t t;
   3378 
   3379 	if (nfs_zone() != VTOMI(dvp)->mi_zone)
   3380 		return (EPERM);
   3381 	setdiropargs3(&args.where, nm, dvp);
   3382 
   3383 	/*
   3384 	 * Decide what the group-id and set-gid bit of the created directory
   3385 	 * should be.  May have to do a setattr to get the gid right.
   3386 	 */
   3387 	error = setdirgid(dvp, &va->va_gid, cr);
   3388 	if (error)
   3389 		return (error);
   3390 	error = setdirmode(dvp, &va->va_mode, cr);
   3391 	if (error)
   3392 		return (error);
   3393 	va->va_mask |= AT_MODE|AT_GID;
   3394 
   3395 	error = vattr_to_sattr3(va, &args.attributes);
   3396 	if (error) {
   3397 		/* req time field(s) overflow - return immediately */
   3398 		return (error);
   3399 	}
   3400 
   3401 	drp = VTOR(dvp);
   3402 	if (nfs_rw_enter_sig(&drp->r_rwlock, RW_WRITER, INTR(dvp)))
   3403 		return (EINTR);
   3404 
   3405 	dnlc_remove(dvp, nm);
   3406 
   3407 	douprintf = 1;
   3408 
   3409 	t = gethrtime();
   3410 
   3411 	error = rfs3call(VTOMI(dvp), NFSPROC3_MKDIR,
   3412 	    xdr_MKDIR3args, (caddr_t)&args,
   3413 	    xdr_MKDIR3res, (caddr_t)&res, cr,
   3414 	    &douprintf, &res.status, 0, NULL);
   3415 
   3416 	if (error) {
   3417 		PURGE_ATTRCACHE(dvp);
   3418 		nfs_rw_exit(&drp->r_rwlock);
   3419 		return (error);
   3420 	}
   3421 
   3422 	error = geterrno3(res.status);
   3423 	if (!error) {
   3424 		nfs3_cache_wcc_data(dvp, &res.resok.dir_wcc, t, cr);
   3425 		if (HAVE_RDDIR_CACHE(drp))
   3426 			nfs_purge_rddir_cache(dvp);
   3427 
   3428 		if (!res.resok.obj.handle_follows) {
   3429 			error = nfs3lookup(dvp, nm, &vp, NULL, 0, NULL, cr, 0);
   3430 			if (error) {
   3431 				nfs_rw_exit(&drp->r_rwlock);
   3432 				return (error);
   3433 			}
   3434 		} else {
   3435 			if (res.resok.obj_attributes.attributes) {
   3436 				vp = makenfs3node(&res.resok.obj.handle,
   3437 				    &res.resok.obj_attributes.attr,
   3438 				    dvp->v_vfsp, t, cr, NULL, NULL);
   3439 			} else {
   3440 				vp = makenfs3node(&res.resok.obj.handle, NULL,
   3441 				    dvp->v_vfsp, t, cr, NULL, NULL);
   3442 				if (vp->v_type == VNON) {
   3443 					vattr.va_mask = AT_TYPE;
   3444 					error = nfs3getattr(vp, &vattr, cr);
   3445 					if (error) {
   3446 						VN_RELE(vp);
   3447 						nfs_rw_exit(&drp->r_rwlock);
   3448 						return (error);
   3449 					}
   3450 					vp->v_type = vattr.va_type;
   3451 				}
   3452 			}
   3453 			dnlc_update(dvp, nm, vp);
   3454 		}
   3455 		if (va->va_gid != VTOR(vp)->r_attr.va_gid) {
   3456 			va->va_mask = AT_GID;
   3457 			(void) nfs3setattr(vp, va, 0, cr);
   3458 		}
   3459 		*vpp = vp;
   3460 	} else {
   3461 		nfs3_cache_wcc_data(dvp, &res.resfail.dir_wcc, t, cr);
   3462 		PURGE_STALE_FH(error, dvp, cr);
   3463 	}
   3464 
   3465 	nfs_rw_exit(&drp->r_rwlock);
   3466 
   3467 	return (error);
   3468 }
   3469 
   3470 /* ARGSUSED */
   3471 static int
   3472 nfs3_rmdir(vnode_t *dvp, char *nm, vnode_t *cdir, cred_t *cr,
   3473 	caller_context_t *ct, int flags)
   3474 {
   3475 	int error;
   3476 	RMDIR3args args;
   3477 	RMDIR3res res;
   3478 	vnode_t *vp;
   3479 	int douprintf;
   3480 	rnode_t *drp;
   3481 	hrtime_t t;
   3482 
   3483 	if (nfs_zone() != VTOMI(dvp)->mi_zone)
   3484 		return (EPERM);
   3485 	drp = VTOR(dvp);
   3486 	if (nfs_rw_enter_sig(&drp->r_rwlock, RW_WRITER, INTR(dvp)))
   3487 		return (EINTR);
   3488 
   3489 	/*
   3490 	 * Attempt to prevent a rmdir(".") from succeeding.
   3491 	 */
   3492 	error = nfs3lookup(dvp, nm, &vp, NULL, 0, NULL, cr, 0);
   3493 	if (error) {
   3494 		nfs_rw_exit(&drp->r_rwlock);
   3495 		return (error);
   3496 	}
   3497 
   3498 	if (vp == cdir) {
   3499 		VN_RELE(vp);
   3500 		nfs_rw_exit(&drp->r_rwlock);
   3501 		return (EINVAL);
   3502 	}
   3503 
   3504 	setdiropargs3(&args.object, nm, dvp);
   3505 
   3506 	/*
   3507 	 * First just remove the entry from the name cache, as it
   3508 	 * is most likely an entry for this vp.
   3509 	 */
   3510 	dnlc_remove(dvp, nm);
   3511 
   3512 	/*
   3513 	 * If there vnode reference count is greater than one, then
   3514 	 * there may be additional references in the DNLC which will
   3515 	 * need to be purged.  First, trying removing the entry for
   3516 	 * the parent directory and see if that removes the additional
   3517 	 * reference(s).  If that doesn't do it, then use dnlc_purge_vp
   3518 	 * to completely remove any references to the directory which
   3519 	 * might still exist in the DNLC.
   3520 	 */
   3521 	if (vp->v_count > 1) {
   3522 		dnlc_remove(vp, "..");
   3523 		if (vp->v_count > 1)
   3524 			dnlc_purge_vp(vp);
   3525 	}
   3526 
   3527 	douprintf = 1;
   3528 
   3529 	t = gethrtime();
   3530 
   3531 	error = rfs3call(VTOMI(dvp), NFSPROC3_RMDIR,
   3532 	    xdr_diropargs3, (caddr_t)&args,
   3533 	    xdr_RMDIR3res, (caddr_t)&res, cr,
   3534 	    &douprintf, &res.status, 0, NULL);
   3535 
   3536 	PURGE_ATTRCACHE(vp);
   3537 
   3538 	if (error) {
   3539 		PURGE_ATTRCACHE(dvp);
   3540 		VN_RELE(vp);
   3541 		nfs_rw_exit(&drp->r_rwlock);
   3542 		return (error);
   3543 	}
   3544 
   3545 	error = geterrno3(res.status);
   3546 	if (!error) {
   3547 		nfs3_cache_wcc_data(dvp, &res.resok.dir_wcc, t, cr);
   3548 		if (HAVE_RDDIR_CACHE(drp))
   3549 			nfs_purge_rddir_cache(dvp);
   3550 		if (HAVE_RDDIR_CACHE(VTOR(vp)))
   3551 			nfs_purge_rddir_cache(vp);
   3552 	} else {
   3553 		nfs3_cache_wcc_data(dvp, &res.resfail.dir_wcc, t, cr);
   3554 		PURGE_STALE_FH(error, dvp, cr);
   3555 		/*
   3556 		 * System V defines rmdir to return EEXIST, not
   3557 		 * ENOTEMPTY if the directory is not empty.  Over
   3558 		 * the wire, the error is NFSERR_ENOTEMPTY which
   3559 		 * geterrno maps to ENOTEMPTY.
   3560 		 */
   3561 		if (error == ENOTEMPTY)
   3562 			error = EEXIST;
   3563 	}
   3564 
   3565 	if (error == 0) {
   3566 		vnevent_rmdir(vp, dvp, nm, ct);
   3567 	}
   3568 	VN_RELE(vp);
   3569 
   3570 	nfs_rw_exit(&drp->r_rwlock);
   3571 
   3572 	return (error);
   3573 }
   3574 
   3575 /* ARGSUSED */
   3576 static int
   3577 nfs3_symlink(vnode_t *dvp, char *lnm, struct vattr *tva, char *tnm, cred_t *cr,
   3578 	caller_context_t *ct, int flags)
   3579 {
   3580 	int error;
   3581 	SYMLINK3args args;
   3582 	SYMLINK3res res;
   3583 	int douprintf;
   3584 	mntinfo_t *mi;
   3585 	vnode_t *vp;
   3586 	rnode_t *rp;
   3587 	char *contents;
   3588 	rnode_t *drp;
   3589 	hrtime_t t;
   3590 
   3591 	mi = VTOMI(dvp);
   3592 
   3593 	if (nfs_zone() != mi->mi_zone)
   3594 		return (EPERM);
   3595 	if (!(mi->mi_flags & MI_SYMLINK))
   3596 		return (EOPNOTSUPP);
   3597 
   3598 	setdiropargs3(&args.where, lnm, dvp);
   3599 	error = vattr_to_sattr3(tva, &args.symlink.symlink_attributes);
   3600 	if (error) {
   3601 		/* req time field(s) overflow - return immediately */
   3602 		return (error);
   3603 	}
   3604 	args.symlink.symlink_data = tnm;
   3605 
   3606 	drp = VTOR(dvp);
   3607 	if (nfs_rw_enter_sig(&drp->r_rwlock, RW_WRITER, INTR(dvp)))
   3608 		return (EINTR);
   3609 
   3610 	dnlc_remove(dvp, lnm);
   3611 
   3612 	douprintf = 1;
   3613 
   3614 	t = gethrtime();
   3615 
   3616 	error = rfs3call(mi, NFSPROC3_SYMLINK,
   3617 	    xdr_SYMLINK3args, (caddr_t)&args,
   3618 	    xdr_SYMLINK3res, (caddr_t)&res, cr,
   3619 	    &douprintf, &res.status, 0, NULL);
   3620 
   3621 	if (error) {
   3622 		PURGE_ATTRCACHE(dvp);
   3623 		nfs_rw_exit(&drp->r_rwlock);
   3624 		return (error);
   3625 	}
   3626 
   3627 	error = geterrno3(res.status);
   3628 	if (!error) {
   3629 		nfs3_cache_wcc_data(dvp, &res.resok.dir_wcc, t, cr);
   3630 		if (HAVE_RDDIR_CACHE(drp))
   3631 			nfs_purge_rddir_cache(dvp);
   3632 
   3633 		if (res.resok.obj.handle_follows) {
   3634 			if (res.resok.obj_attributes.attributes) {
   3635 				vp = makenfs3node(&res.resok.obj.handle,
   3636 				    &res.resok.obj_attributes.attr,
   3637 				    dvp->v_vfsp, t, cr, NULL, NULL);
   3638 			} else {
   3639 				vp = makenfs3node(&res.resok.obj.handle, NULL,
   3640 				    dvp->v_vfsp, t, cr, NULL, NULL);
   3641 				vp->v_type = VLNK;
   3642 				vp->v_rdev = 0;
   3643 			}
   3644 			dnlc_update(dvp, lnm, vp);
   3645 			rp = VTOR(vp);
   3646 			if (nfs3_do_symlink_cache &&
   3647 			    rp->r_symlink.contents == NULL) {
   3648 
   3649 				contents = kmem_alloc(MAXPATHLEN,
   3650 				    KM_NOSLEEP);
   3651 
   3652 				if (contents != NULL) {
   3653 					mutex_enter(&rp->r_statelock);
   3654 					if (rp->r_symlink.contents == NULL) {
   3655 						rp->r_symlink.len = strlen(tnm);
   3656 						bcopy(tnm, contents,
   3657 						    rp->r_symlink.len);
   3658 						rp->r_symlink.contents =
   3659 						    contents;
   3660 						rp->r_symlink.size = MAXPATHLEN;
   3661 						mutex_exit(&rp->r_statelock);
   3662 					} else {
   3663 						mutex_exit(&rp->r_statelock);
   3664 						kmem_free((void *)contents,
   3665 						    MAXPATHLEN);
   3666 					}
   3667 				}
   3668 			}
   3669 			VN_RELE(vp);
   3670 		}
   3671 	} else {
   3672 		nfs3_cache_wcc_data(dvp, &res.resfail.dir_wcc, t, cr);
   3673 		PURGE_STALE_FH(error, dvp, cr);
   3674 		if (error == EOPNOTSUPP) {
   3675 			mutex_enter(&mi->mi_lock);
   3676 			mi->mi_flags &= ~MI_SYMLINK;
   3677 			mutex_exit(&mi->mi_lock);
   3678 		}
   3679 	}
   3680 
   3681 	nfs_rw_exit(&drp->r_rwlock);
   3682 
   3683 	return (error);
   3684 }
   3685 
   3686 #ifdef DEBUG
   3687 static int nfs3_readdir_cache_hits = 0;
   3688 static int nfs3_readdir_cache_shorts = 0;
   3689 static int nfs3_readdir_cache_waits = 0;
   3690 static int nfs3_readdir_cache_misses = 0;
   3691 static int nfs3_readdir_readahead = 0;
   3692 #endif
   3693 
   3694 static int nfs3_shrinkreaddir = 0;
   3695 
   3696 /*
   3697  * Read directory entries.
   3698  * There are some weird things to look out for here.  The uio_loffset
   3699  * field is either 0 or it is the offset returned from a previous
   3700  * readdir.  It is an opaque value used by the server to find the
   3701  * correct directory block to read. The count field is the number
   3702  * of blocks to read on the server.  This is advisory only, the server
   3703  * may return only one block's worth of entries.  Entries may be compressed
   3704  * on the server.
   3705  */
   3706 /* ARGSUSED */
   3707 static int
   3708 nfs3_readdir(vnode_t *vp, struct uio *uiop, cred_t *cr, int *eofp,
   3709 	caller_context_t *ct, int flags)
   3710 {
   3711 	int error;
   3712 	size_t count;
   3713 	rnode_t *rp;
   3714 	rddir_cache *rdc;
   3715 	rddir_cache *nrdc;
   3716 	rddir_cache *rrdc;
   3717 #ifdef DEBUG
   3718 	int missed;
   3719 #endif
   3720 	int doreadahead;
   3721 	rddir_cache srdc;
   3722 	avl_index_t where;
   3723 
   3724 	if (nfs_zone() != VTOMI(vp)->mi_zone)
   3725 		return (EIO);
   3726 	rp = VTOR(vp);
   3727 
   3728 	ASSERT(nfs_rw_lock_held(&rp->r_rwlock, RW_READER));
   3729 
   3730 	/*
   3731 	 * Make sure that the directory cache is valid.
   3732 	 */
   3733 	if (HAVE_RDDIR_CACHE(rp)) {
   3734 		if (nfs_disable_rddir_cache) {
   3735 			/*
   3736 			 * Setting nfs_disable_rddir_cache in /etc/system
   3737 			 * allows interoperability with servers that do not
   3738 			 * properly update the attributes of directories.
   3739 			 * Any cached information gets purged before an
   3740 			 * access is made to it.
   3741 			 */
   3742 			nfs_purge_rddir_cache(vp);
   3743 		} else {
   3744 			error = nfs3_validate_caches(vp, cr);
   3745 			if (error)
   3746 				return (error);
   3747 		}
   3748 	}
   3749 
   3750 	/*
   3751 	 * It is possible that some servers may not be able to correctly
   3752 	 * handle a large READDIR or READDIRPLUS request due to bugs in
   3753 	 * their implementation.  In order to continue to interoperate
   3754 	 * with them, this workaround is provided to limit the maximum
   3755 	 * size of a READDIRPLUS request to 1024.  In any case, the request
   3756 	 * size is limited to MAXBSIZE.
   3757 	 */
   3758 	count = MIN(uiop->uio_iov->iov_len,
   3759 	    nfs3_shrinkreaddir ? 1024 : MAXBSIZE);
   3760 
   3761 	nrdc = NULL;
   3762 #ifdef DEBUG
   3763 	missed = 0;
   3764 #endif
   3765 top:
   3766 	/*
   3767 	 * Short circuit last readdir which always returns 0 bytes.
   3768 	 * This can be done after the directory has been read through
   3769 	 * completely at least once.  This will set r_direof which
   3770 	 * can be used to find the value of the last cookie.
   3771 	 */
   3772 	mutex_enter(&rp->r_statelock);
   3773 	if (rp->r_direof != NULL &&
   3774 	    uiop->uio_loffset == rp->r_direof->nfs3_ncookie) {
   3775 		mutex_exit(&rp->r_statelock);
   3776 #ifdef DEBUG
   3777 		nfs3_readdir_cache_shorts++;
   3778 #endif
   3779 		if (eofp)
   3780 			*eofp = 1;
   3781 		if (nrdc != NULL)
   3782 			rddir_cache_rele(nrdc);
   3783 		return (0);
   3784 	}
   3785 	/*
   3786 	 * Look for a cache entry.  Cache entries are identified
   3787 	 * by the NFS cookie value and the byte count requested.
   3788 	 */
   3789 	srdc.nfs3_cookie = uiop->uio_loffset;
   3790 	srdc.buflen = count;
   3791 	rdc = avl_find(&rp->r_dir, &srdc, &where);
   3792 	if (rdc != NULL) {
   3793 		rddir_cache_hold(rdc);
   3794 		/*
   3795 		 * If the cache entry is in the process of being
   3796 		 * filled in, wait until this completes.  The
   3797 		 * RDDIRWAIT bit is set to indicate that someone
   3798 		 * is waiting and then the thread currently
   3799 		 * filling the entry is done, it should do a
   3800 		 * cv_broadcast to wakeup all of the threads
   3801 		 * waiting for it to finish.
   3802 		 */
   3803 		if (rdc->flags & RDDIR) {
   3804 			nfs_rw_exit(&rp->r_rwlock);
   3805 			rdc->flags |= RDDIRWAIT;
   3806 #ifdef DEBUG
   3807 			nfs3_readdir_cache_waits++;
   3808 #endif
   3809 			if (!cv_wait_sig(&rdc->cv, &rp->r_statelock)) {
   3810 				/*
   3811 				 * We got interrupted, probably
   3812 				 * the user typed ^C or an alarm
   3813 				 * fired.  We free the new entry
   3814 				 * if we allocated one.
   3815 				 */
   3816 				mutex_exit(&rp->r_statelock);
   3817 				(void) nfs_rw_enter_sig(&rp->r_rwlock,
   3818 				    RW_READER, FALSE);
   3819 				rddir_cache_rele(rdc);
   3820 				if (nrdc != NULL)
   3821 					rddir_cache_rele(nrdc);
   3822 				return (EINTR);
   3823 			}
   3824 			mutex_exit(&rp->r_statelock);
   3825 			(void) nfs_rw_enter_sig(&rp->r_rwlock,
   3826 			    RW_READER, FALSE);
   3827 			rddir_cache_rele(rdc);
   3828 			goto top;
   3829 		}
   3830 		/*
   3831 		 * Check to see if a readdir is required to
   3832 		 * fill the entry.  If so, mark this entry
   3833 		 * as being filled, remove our reference,
   3834 		 * and branch to the code to fill the entry.
   3835 		 */
   3836 		if (rdc->flags & RDDIRREQ) {
   3837 			rdc->flags &= ~RDDIRREQ;
   3838 			rdc->flags |= RDDIR;
   3839 			if (nrdc != NULL)
   3840 				rddir_cache_rele(nrdc);
   3841 			nrdc = rdc;
   3842 			mutex_exit(&rp->r_statelock);
   3843 			goto bottom;
   3844 		}
   3845 #ifdef DEBUG
   3846 		if (!missed)
   3847 			nfs3_readdir_cache_hits++;
   3848 #endif
   3849 		/*
   3850 		 * If an error occurred while attempting
   3851 		 * to fill the cache entry, just return it.
   3852 		 */
   3853 		if (rdc->error) {
   3854 			error = rdc->error;
   3855 			mutex_exit(&rp->r_statelock);
   3856 			rddir_cache_rele(rdc);
   3857 			if (nrdc != NULL)
   3858 				rddir_cache_rele(nrdc);
   3859 			return (error);
   3860 		}
   3861 
   3862 		/*
   3863 		 * The cache entry is complete and good,
   3864 		 * copyout the dirent structs to the calling
   3865 		 * thread.
   3866 		 */
   3867 		error = uiomove(rdc->entries, rdc->entlen, UIO_READ, uiop);
   3868 
   3869 		/*
   3870 		 * If no error occurred during the copyout,
   3871 		 * update the offset in the uio struct to
   3872 		 * contain the value of the next cookie
   3873 		 * and set the eof value appropriately.
   3874 		 */
   3875 		if (!error) {
   3876 			uiop->uio_loffset = rdc->nfs3_ncookie;
   3877 			if (eofp)
   3878 				*eofp = rdc->eof;
   3879 		}
   3880 
   3881 		/*
   3882 		 * Decide whether to do readahead.
   3883 		 *
   3884 		 * Don't if have already read to the end of
   3885 		 * directory.  There is nothing more to read.
   3886 		 *
   3887 		 * Don't if the application is not doing
   3888 		 * lookups in the directory.  The readahead
   3889 		 * is only effective if the application can
   3890 		 * be doing work while an async thread is
   3891 		 * handling the over the wire request.
   3892 		 */
   3893 		if (rdc->eof) {
   3894 			rp->r_direof = rdc;
   3895 			doreadahead = FALSE;
   3896 		} else if (!(rp->r_flags & RLOOKUP))
   3897 			doreadahead = FALSE;
   3898 		else
   3899 			doreadahead = TRUE;
   3900 
   3901 		if (!doreadahead) {
   3902 			mutex_exit(&rp->r_statelock);
   3903 			rddir_cache_rele(rdc);
   3904 			if (nrdc != NULL)
   3905 				rddir_cache_rele(nrdc);
   3906 			return (error);
   3907 		}
   3908 
   3909 		/*
   3910 		 * Check to see whether we found an entry
   3911 		 * for the readahead.  If so, we don't need
   3912 		 * to do anything further, so free the new
   3913 		 * entry if one was allocated.  Otherwise,
   3914 		 * allocate a new entry, add it to the cache,
   3915 		 * and then initiate an asynchronous readdir
   3916 		 * operation to fill it.
   3917 		 */
   3918 		srdc.nfs3_cookie = rdc->nfs3_ncookie;
   3919 		srdc.buflen = count;
   3920 		rrdc = avl_find(&rp->r_dir, &srdc, &where);
   3921 		if (rrdc != NULL) {
   3922 			if (nrdc != NULL)
   3923 				rddir_cache_rele(nrdc);
   3924 		} else {
   3925 			if (nrdc != NULL)
   3926 				rrdc = nrdc;
   3927 			else {
   3928 				rrdc = rddir_cache_alloc(KM_NOSLEEP);
   3929 			}
   3930 			if (rrdc != NULL) {
   3931 				rrdc->nfs3_cookie = rdc->nfs3_ncookie;
   3932 				rrdc->buflen = count;
   3933 				avl_insert(&rp->r_dir, rrdc, where);
   3934 				rddir_cache_hold(rrdc);
   3935 				mutex_exit(&rp->r_statelock);
   3936 				rddir_cache_rele(rdc);
   3937 #ifdef DEBUG
   3938 				nfs3_readdir_readahead++;
   3939 #endif
   3940 				nfs_async_readdir(vp, rrdc, cr, do_nfs3readdir);
   3941 				return (error);
   3942 			}
   3943 		}
   3944 
   3945 		mutex_exit(&rp->r_statelock);
   3946 		rddir_cache_rele(rdc);
   3947 		return (error);
   3948 	}
   3949 
   3950 	/*
   3951 	 * Didn't find an entry in the cache.  Construct a new empty
   3952 	 * entry and link it into the cache.  Other processes attempting
   3953 	 * to access this entry will need to wait until it is filled in.
   3954 	 *
   3955 	 * Since kmem_alloc may block, another pass through the cache
   3956 	 * will need to be taken to make sure that another process
   3957 	 * hasn't already added an entry to the cache for this request.
   3958 	 */
   3959 	if (nrdc == NULL) {
   3960 		mutex_exit(&rp->r_statelock);
   3961 		nrdc = rddir_cache_alloc(KM_SLEEP);
   3962 		nrdc->nfs3_cookie = uiop->uio_loffset;
   3963 		nrdc->buflen = count;
   3964 		goto top;
   3965 	}
   3966 
   3967 	/*
   3968 	 * Add this entry to the cache.
   3969 	 */
   3970 	avl_insert(&rp->r_dir, nrdc, where);
   3971 	rddir_cache_hold(nrdc);
   3972 	mutex_exit(&rp->r_statelock);
   3973 
   3974 bottom:
   3975 #ifdef DEBUG
   3976 	missed = 1;
   3977 	nfs3_readdir_cache_misses++;
   3978 #endif
   3979 	/*
   3980 	 * Do the readdir.  This routine decides whether to use
   3981 	 * READDIR or READDIRPLUS.
   3982 	 */
   3983 	error = do_nfs3readdir(vp, nrdc, cr);
   3984 
   3985 	/*
   3986 	 * If this operation failed, just return the error which occurred.
   3987 	 */
   3988 	if (error != 0)
   3989 		return (error);
   3990 
   3991 	/*
   3992 	 * Since the RPC operation will have taken sometime and blocked
   3993 	 * this process, another pass through the cache will need to be
   3994 	 * taken to find the correct cache entry.  It is possible that
   3995 	 * the correct cache entry will not be there (although one was
   3996 	 * added) because the directory changed during the RPC operation
   3997 	 * and the readdir cache was flushed.  In this case, just start
   3998 	 * over.  It is hoped that this will not happen too often... :-)
   3999 	 */
   4000 	nrdc = NULL;
   4001 	goto top;
   4002 	/* NOTREACHED */
   4003 }
   4004 
   4005 static int
   4006 do_nfs3readdir(vnode_t *vp, rddir_cache *rdc, cred_t *cr)
   4007 {
   4008 	int error;
   4009 	rnode_t *rp;
   4010 	mntinfo_t *mi;
   4011 
   4012 	rp = VTOR(vp);
   4013 	mi = VTOMI(vp);
   4014 	ASSERT(nfs_zone() == mi->mi_zone);
   4015 	/*
   4016 	 * Issue the proper request.
   4017 	 *
   4018 	 * If the server does not support READDIRPLUS, then use READDIR.
   4019 	 *
   4020 	 * Otherwise --
   4021 	 * Issue a READDIRPLUS if reading to fill an empty cache or if
   4022 	 * an application has performed a lookup in the directory which
   4023 	 * required an over the wire lookup.  The use of READDIRPLUS
   4024 	 * will help to (re)populate the DNLC.
   4025 	 */
   4026 	if (!(mi->mi_flags & MI_READDIRONLY) &&
   4027 	    (rp->r_flags & (RLOOKUP | RREADDIRPLUS))) {
   4028 		if (rp->r_flags & RREADDIRPLUS) {
   4029 			mutex_enter(&rp->r_statelock);
   4030 			rp->r_flags &= ~RREADDIRPLUS;
   4031 			mutex_exit(&rp->r_statelock);
   4032 		}
   4033 		nfs3readdirplus(vp, rdc, cr);
   4034 		if (rdc->error == EOPNOTSUPP)
   4035 			nfs3readdir(vp, rdc, cr);
   4036 	} else
   4037 		nfs3readdir(vp, rdc, cr);
   4038 
   4039 	mutex_enter(&rp->r_statelock);
   4040 	rdc->flags &= ~RDDIR;
   4041 	if (rdc->flags & RDDIRWAIT) {
   4042 		rdc->flags &= ~RDDIRWAIT;
   4043 		cv_broadcast(&rdc->cv);
   4044 	}
   4045 	error = rdc->error;
   4046 	if (error)
   4047 		rdc->flags |= RDDIRREQ;
   4048 	mutex_exit(&rp->r_statelock);
   4049 
   4050 	rddir_cache_rele(rdc);
   4051 
   4052 	return (error);
   4053 }
   4054 
   4055 static void
   4056 nfs3readdir(vnode_t *vp, rddir_cache *rdc, cred_t *cr)
   4057 {
   4058 	int error;
   4059 	READDIR3args args;
   4060 	READDIR3vres res;
   4061 	vattr_t dva;
   4062 	rnode_t *rp;
   4063 	int douprintf;
   4064 	failinfo_t fi, *fip = NULL;
   4065 	mntinfo_t *mi;
   4066 	hrtime_t t;
   4067 
   4068 	rp = VTOR(vp);
   4069 	mi = VTOMI(vp);
   4070 	ASSERT(nfs_zone() == mi->mi_zone);
   4071 
   4072 	args.dir = *RTOFH3(rp);
   4073 	args.cookie = (cookie3)rdc->nfs3_cookie;
   4074 	args.cookieverf = rp->r_cookieverf;
   4075 	args.count = rdc->buflen;
   4076 
   4077 	/*
   4078 	 * NFS client failover support
   4079 	 * suppress failover unless we have a zero cookie
   4080 	 */
   4081 	if (args.cookie == (cookie3) 0) {
   4082 		fi.vp = vp;
   4083 		fi.fhp = (caddr_t)&args.dir;
   4084 		fi.copyproc = nfs3copyfh;
   4085 		fi.lookupproc = nfs3lookup;
   4086 		fi.xattrdirproc = acl_getxattrdir3;
   4087 		fip = &fi;
   4088 	}
   4089 
   4090 #ifdef DEBUG
   4091 	rdc->entries = rddir_cache_buf_alloc(rdc->buflen, KM_SLEEP);
   4092 #else
   4093 	rdc->entries = kmem_alloc(rdc->buflen, KM_SLEEP);
   4094 #endif
   4095 
   4096 	res.entries = (dirent64_t *)rdc->entries;
   4097 	res.entries_size = rdc->buflen;
   4098 	res.dir_attributes.fres.vap = &dva;
   4099 	res.dir_attributes.fres.vp = vp;
   4100 	res.loff = rdc->nfs3_cookie;
   4101 
   4102 	douprintf = 1;
   4103 
   4104 	if (mi->mi_io_kstats) {
   4105 		mutex_enter(&mi->mi_lock);
   4106 		kstat_runq_enter(KSTAT_IO_PTR(mi->mi_io_kstats));
   4107 		mutex_exit(&mi->mi_lock);
   4108 	}
   4109 
   4110 	t = gethrtime();
   4111 
   4112 	error = rfs3call(VTOMI(vp), NFSPROC3_READDIR,
   4113 	    xdr_READDIR3args, (caddr_t)&args,
   4114 	    xdr_READDIR3vres, (caddr_t)&res, cr,
   4115 	    &douprintf, &res.status, 0, fip);
   4116 
   4117 	if (mi->mi_io_kstats) {
   4118 		mutex_enter(&mi->mi_lock);
   4119 		kstat_runq_exit(KSTAT_IO_PTR(mi->mi_io_kstats));
   4120 		mutex_exit(&mi->mi_lock);
   4121 	}
   4122 
   4123 	if (error)
   4124 		goto err;
   4125 
   4126 	nfs3_cache_post_op_vattr(vp, &res.dir_attributes, t, cr);
   4127 
   4128 	error = geterrno3(res.status);
   4129 	if (error) {
   4130 		PURGE_STALE_FH(error, vp, cr);
   4131 		goto err;
   4132 	}
   4133 
   4134 	if (mi->mi_io_kstats) {
   4135 		mutex_enter(&mi->mi_lock);
   4136 		KSTAT_IO_PTR(mi->mi_io_kstats)->reads++;
   4137 		KSTAT_IO_PTR(mi->mi_io_kstats)->nread += res.size;
   4138 		mutex_exit(&mi->mi_lock);
   4139 	}
   4140 
   4141 	rdc->nfs3_ncookie = res.loff;
   4142 	rp->r_cookieverf = res.cookieverf;
   4143 	rdc->eof = res.eof ? 1 : 0;
   4144 	rdc->entlen = res.size;
   4145 	ASSERT(rdc->entlen <= rdc->buflen);
   4146 	rdc->error = 0;
   4147 	return;
   4148 
   4149 err:
   4150 	kmem_free(rdc->entries, rdc->buflen);
   4151 	rdc->entries = NULL;
   4152 	rdc->error = error;
   4153 }
   4154 
   4155 /*
   4156  * Read directory entries.
   4157  * There are some weird things to look out for here.  The uio_loffset
   4158  * field is either 0 or it is the offset returned from a previous
   4159  * readdir.  It is an opaque value used by the server to find the
   4160  * correct directory block to read. The count field is the number
   4161  * of blocks to read on the server.  This is advisory only, the server
   4162  * may return only one block's worth of entries.  Entries may be compressed
   4163  * on the server.
   4164  */
   4165 static void
   4166 nfs3readdirplus(vnode_t *vp, rddir_cache *rdc, cred_t *cr)
   4167 {
   4168 	int error;
   4169 	READDIRPLUS3args args;
   4170 	READDIRPLUS3vres res;
   4171 	vattr_t dva;
   4172 	rnode_t *rp;
   4173 	mntinfo_t *mi;
   4174 	int douprintf;
   4175 	failinfo_t fi, *fip = NULL;
   4176 
   4177 	rp = VTOR(vp);
   4178 	mi = VTOMI(vp);
   4179 	ASSERT(nfs_zone() == mi->mi_zone);
   4180 
   4181 	args.dir = *RTOFH3(rp);
   4182 	args.cookie = (cookie3)rdc->nfs3_cookie;
   4183 	args.cookieverf = rp->r_cookieverf;
   4184 	args.dircount = rdc->buflen;
   4185 	args.maxcount = mi->mi_tsize;
   4186 
   4187 	/*
   4188 	 * NFS client failover support
   4189 	 * suppress failover unless we have a zero cookie
   4190 	 */
   4191 	if (args.cookie == (cookie3)0) {
   4192 		fi.vp = vp;
   4193 		fi.fhp = (caddr_t)&args.dir;
   4194 		fi.copyproc = nfs3copyfh;
   4195 		fi.lookupproc = nfs3lookup;
   4196 		fi.xattrdirproc = acl_getxattrdir3;
   4197 		fip = &fi;
   4198 	}
   4199 
   4200 #ifdef DEBUG
   4201 	rdc->entries = rddir_cache_buf_alloc(rdc->buflen, KM_SLEEP);
   4202 #else
   4203 	rdc->entries = kmem_alloc(rdc->buflen, KM_SLEEP);
   4204 #endif
   4205 
   4206 	res.entries = (dirent64_t *)rdc->entries;
   4207 	res.entries_size = rdc->buflen;
   4208 	res.dir_attributes.fres.vap = &dva;
   4209 	res.dir_attributes.fres.vp = vp;
   4210 	res.loff = rdc->nfs3_cookie;
   4211 	res.credentials = cr;
   4212 
   4213 	douprintf = 1;
   4214 
   4215 	if (mi->mi_io_kstats) {
   4216 		mutex_enter(&mi->mi_lock);
   4217 		kstat_runq_enter(KSTAT_IO_PTR(mi->mi_io_kstats));
   4218 		mutex_exit(&mi->mi_lock);
   4219 	}
   4220 
   4221 	res.time = gethrtime();
   4222 
   4223 	error = rfs3call(mi, NFSPROC3_READDIRPLUS,
   4224 	    xdr_READDIRPLUS3args, (caddr_t)&args,
   4225 	    xdr_READDIRPLUS3vres, (caddr_t)&res, cr,
   4226 	    &douprintf, &res.status, 0, fip);
   4227 
   4228 	if (mi->mi_io_kstats) {
   4229 		mutex_enter(&mi->mi_lock);
   4230 		kstat_runq_exit(KSTAT_IO_PTR(mi->mi_io_kstats));
   4231 		mutex_exit(&mi->mi_lock);
   4232 	}
   4233 
   4234 	if (error) {
   4235 		goto err;
   4236 	}
   4237 
   4238 	nfs3_cache_post_op_vattr(vp, &res.dir_attributes, res.time, cr);
   4239 
   4240 	error = geterrno3(res.status);
   4241 	if (error) {
   4242 		PURGE_STALE_FH(error, vp, cr);
   4243 		if (error == EOPNOTSUPP) {
   4244 			mutex_enter(&mi->mi_lock);
   4245 			mi->mi_flags |= MI_READDIRONLY;
   4246 			mutex_exit(&mi->mi_lock);
   4247 		}
   4248 		goto err;
   4249 	}
   4250 
   4251 	if (mi->mi_io_kstats) {
   4252 		mutex_enter(&mi->mi_lock);
   4253 		KSTAT_IO_PTR(mi->mi_io_kstats)->reads++;
   4254 		KSTAT_IO_PTR(mi->mi_io_kstats)->nread += res.size;
   4255 		mutex_exit(&mi->mi_lock);
   4256 	}
   4257 
   4258 	rdc->nfs3_ncookie = res.loff;
   4259 	rp->r_cookieverf = res.cookieverf;
   4260 	rdc->eof = res.eof ? 1 : 0;
   4261 	rdc->entlen = res.size;
   4262 	ASSERT(rdc->entlen <= rdc->buflen);
   4263 	rdc->error = 0;
   4264 
   4265 	return;
   4266 
   4267 err:
   4268 	kmem_free(rdc->entries, rdc->buflen);
   4269 	rdc->entries = NULL;
   4270 	rdc->error = error;
   4271 }
   4272 
   4273 #ifdef DEBUG
   4274 static int nfs3_bio_do_stop = 0;
   4275 #endif
   4276 
   4277 static int
   4278 nfs3_bio(struct buf *bp, stable_how *stab_comm, cred_t *cr)
   4279 {
   4280 	rnode_t *rp = VTOR(bp->b_vp);
   4281 	int count;
   4282 	int error;
   4283 	cred_t *cred;
   4284 	offset_t offset;
   4285 
   4286 	ASSERT(nfs_zone() == VTOMI(bp->b_vp)->mi_zone);
   4287 	offset = ldbtob(bp->b_lblkno);
   4288 
   4289 	DTRACE_IO1(start, struct buf *, bp);
   4290 
   4291 	if (bp->b_flags & B_READ) {
   4292 		mutex_enter(&rp->r_statelock);
   4293 		if (rp->r_cred != NULL) {
   4294 			cred = rp->r_cred;
   4295 			crhold(cred);
   4296 		} else {
   4297 			rp->r_cred = cr;
   4298 			crhold(cr);
   4299 			cred = cr;
   4300 			crhold(cred);
   4301 		}
   4302 		mutex_exit(&rp->r_statelock);
   4303 	read_again:
   4304 		error = bp->b_error = nfs3read(bp->b_vp, bp->b_un.b_addr,
   4305 		    offset, bp->b_bcount, &bp->b_resid, cred);
   4306 		crfree(cred);
   4307 		if (!error) {
   4308 			if (bp->b_resid) {
   4309 				/*
   4310 				 * Didn't get it all because we hit EOF,
   4311 				 * zero all the memory beyond the EOF.
   4312 				 */
   4313 				/* bzero(rdaddr + */
   4314 				bzero(bp->b_un.b_addr +
   4315 				    bp->b_bcount - bp->b_resid, bp->b_resid);
   4316 			}
   4317 			mutex_enter(&rp->r_statelock);
   4318 			if (bp->b_resid == bp->b_bcount &&
   4319 			    offset >= rp->r_size) {
   4320 				/*
   4321 				 * We didn't read anything at all as we are
   4322 				 * past EOF.  Return an error indicator back
   4323 				 * but don't destroy the pages (yet).
   4324 				 */
   4325 				error = NFS_EOF;
   4326 			}
   4327 			mutex_exit(&rp->r_statelock);
   4328 		} else if (error == EACCES) {
   4329 			mutex_enter(&rp->r_statelock);
   4330 			if (cred != cr) {
   4331 				if (rp->r_cred != NULL)
   4332 					crfree(rp->r_cred);
   4333 				rp->r_cred = cr;
   4334 				crhold(cr);
   4335 				cred = cr;
   4336 				crhold(cred);
   4337 				mutex_exit(&rp->r_statelock);
   4338 				goto read_again;
   4339 			}
   4340 			mutex_exit(&rp->r_statelock);
   4341 		}
   4342 	} else {
   4343 		if (!(rp->r_flags & RSTALE)) {
   4344 			mutex_enter(&rp->r_statelock);
   4345 			if (rp->r_cred != NULL) {
   4346 				cred = rp->r_cred;
   4347 				crhold(cred);
   4348 			} else {
   4349 				rp->r_cred = cr;
   4350 				crhold(cr);
   4351 				cred = cr;
   4352 				crhold(cred);
   4353 			}
   4354 			mutex_exit(&rp->r_statelock);
   4355 		write_again:
   4356 			mutex_enter(&rp->r_statelock);
   4357 			count = MIN(bp->b_bcount, rp->r_size - offset);
   4358 			mutex_exit(&rp->r_statelock);
   4359 			if (count < 0)
   4360 				cmn_err(CE_PANIC, "nfs3_bio: write count < 0");
   4361 #ifdef DEBUG
   4362 			if (count == 0) {
   4363 				zcmn_err(getzoneid(), CE_WARN,
   4364 				    "nfs3_bio: zero length write at %lld",
   4365 				    offset);
   4366 				nfs_printfhandle(&rp->r_fh);
   4367 				if (nfs3_bio_do_stop)
   4368 					debug_enter("nfs3_bio");
   4369 			}
   4370 #endif
   4371 			error = nfs3write(bp->b_vp, bp->b_un.b_addr, offset,
   4372 			    count, cred, stab_comm);
   4373 			if (error == EACCES) {
   4374 				mutex_enter(&rp->r_statelock);
   4375 				if (cred != cr) {
   4376 					if (rp->r_cred != NULL)
   4377 						crfree(rp->r_cred);
   4378 					rp->r_cred = cr;
   4379 					crhold(cr);
   4380 					crfree(cred);
   4381 					cred = cr;
   4382 					crhold(cred);
   4383 					mutex_exit(&rp->r_statelock);
   4384 					goto write_again;
   4385 				}
   4386 				mutex_exit(&rp->r_statelock);
   4387 			}
   4388 			bp->b_error = error;
   4389 			if (error && error != EINTR) {
   4390 				/*
   4391 				 * Don't print EDQUOT errors on the console.
   4392 				 * Don't print asynchronous EACCES errors.
   4393 				 * Don't print EFBIG errors.
   4394 				 * Print all other write errors.
   4395 				 */
   4396 				if (error != EDQUOT && error != EFBIG &&
   4397 				    (error != EACCES ||
   4398 				    !(bp->b_flags & B_ASYNC)))
   4399 					nfs_write_error(bp->b_vp, error, cred);
   4400 				/*
   4401 				 * Update r_error and r_flags as appropriate.
   4402 				 * If the error was ESTALE, then mark the
   4403 				 * rnode as not being writeable and save
   4404 				 * the error status.  Otherwise, save any
   4405 				 * errors which occur from asynchronous
   4406 				 * page invalidations.  Any errors occurring
   4407 				 * from other operations should be saved
   4408 				 * by the caller.
   4409 				 */
   4410 				mutex_enter(&rp->r_statelock);
   4411 				if (error == ESTALE) {
   4412 					rp->r_flags |= RSTALE;
   4413 					if (!rp->r_error)
   4414 						rp->r_error = error;
   4415 				} else if (!rp->r_error &&
   4416 				    (bp->b_flags &
   4417 				    (B_INVAL|B_FORCE|B_ASYNC)) ==
   4418 				    (B_INVAL|B_FORCE|B_ASYNC)) {
   4419 					rp->r_error = error;
   4420 				}
   4421 				mutex_exit(&rp->r_statelock);
   4422 			}
   4423 			crfree(cred);
   4424 		} else {
   4425 			error = rp->r_error;
   4426 			/*
   4427 			 * A close may have cleared r_error, if so,
   4428 			 * propagate ESTALE error return properly
   4429 			 */
   4430 			if (error == 0)
   4431 				error = ESTALE;
   4432 		}
   4433 	}
   4434 
   4435 	if (error != 0 && error != NFS_EOF)
   4436 		bp->b_flags |= B_ERROR;
   4437 
   4438 	DTRACE_IO1(done, struct buf *, bp);
   4439 
   4440 	return (error);
   4441 }
   4442 
   4443 /* ARGSUSED */
   4444 static int
   4445 nfs3_fid(vnode_t *vp, fid_t *fidp, caller_context_t *ct)
   4446 {
   4447 	rnode_t *rp;
   4448 
   4449 	if (nfs_zone() != VTOMI(vp)->mi_zone)
   4450 		return (EIO);
   4451 	rp = VTOR(vp);
   4452 
   4453 	if (fidp->fid_len < (ushort_t)rp->r_fh.fh_len) {
   4454 		fidp->fid_len = rp->r_fh.fh_len;
   4455 		return (ENOSPC);
   4456 	}
   4457 	fidp->fid_len = rp->r_fh.fh_len;
   4458 	bcopy(rp->r_fh.fh_buf, fidp->fid_data, fidp->fid_len);
   4459 	return (0);
   4460 }
   4461 
   4462 /* ARGSUSED2 */
   4463 static int
   4464 nfs3_rwlock(vnode_t *vp, int write_lock, caller_context_t *ctp)
   4465 {
   4466 	rnode_t *rp = VTOR(vp);
   4467 
   4468 	if (!write_lock) {
   4469 		(void) nfs_rw_enter_sig(&rp->r_rwlock, RW_READER, FALSE);
   4470 		return (V_WRITELOCK_FALSE);
   4471 	}
   4472 
   4473 	if ((rp->r_flags & RDIRECTIO) || (VTOMI(vp)->mi_flags & MI_DIRECTIO)) {
   4474 		(void) nfs_rw_enter_sig(&rp->r_rwlock, RW_READER, FALSE);
   4475 		if (rp->r_mapcnt == 0 && !vn_has_cached_data(vp))
   4476 			return (V_WRITELOCK_FALSE);
   4477 		nfs_rw_exit(&rp->r_rwlock);
   4478 	}
   4479 
   4480 	(void) nfs_rw_enter_sig(&rp->r_rwlock, RW_WRITER, FALSE);
   4481 	return (V_WRITELOCK_TRUE);
   4482 }
   4483 
   4484 /* ARGSUSED */
   4485 static void
   4486 nfs3_rwunlock(vnode_t *vp, int write_lock, caller_context_t *ctp)
   4487 {
   4488 	rnode_t *rp = VTOR(vp);
   4489 
   4490 	nfs_rw_exit(&rp->r_rwlock);
   4491 }
   4492 
   4493 /* ARGSUSED */
   4494 static int
   4495 nfs3_seek(vnode_t *vp, offset_t ooff, offset_t *noffp, caller_context_t *ct)
   4496 {
   4497 
   4498 	/*
   4499 	 * Because we stuff the readdir cookie into the offset field
   4500 	 * someone may attempt to do an lseek with the cookie which
   4501 	 * we want to succeed.
   4502 	 */
   4503 	if (vp->v_type == VDIR)
   4504 		return (0);
   4505 	if (*noffp < 0)
   4506 		return (EINVAL);
   4507 	return (0);
   4508 }
   4509 
   4510 /*
   4511  * number of nfs3_bsize blocks to read ahead.
   4512  */
   4513 static int nfs3_nra = 4;
   4514 
   4515 #ifdef DEBUG
   4516 static int nfs3_lostpage = 0;	/* number of times we lost original page */
   4517 #endif
   4518 
   4519 /*
   4520  * Return all the pages from [off..off+len) in file
   4521  */
   4522 /* ARGSUSED */
   4523 static int
   4524 nfs3_getpage(vnode_t *vp, offset_t off, size_t len, uint_t *protp,
   4525 	page_t *pl[], size_t plsz, struct seg *seg, caddr_t addr,
   4526 	enum seg_rw rw, cred_t *cr, caller_context_t *ct)
   4527 {
   4528 	rnode_t *rp;
   4529 	int error;
   4530 	mntinfo_t *mi;
   4531 
   4532 	if (vp->v_flag & VNOMAP)
   4533 		return (ENOSYS);
   4534 
   4535 	if (nfs_zone() != VTOMI(vp)->mi_zone)
   4536 		return (EIO);
   4537 	if (protp != NULL)
   4538 		*protp = PROT_ALL;
   4539 
   4540 	/*
   4541 	 * Now valididate that the caches are up to date.
   4542 	 */
   4543 	error = nfs3_validate_caches(vp, cr);
   4544 	if (error)
   4545 		return (error);
   4546 
   4547 	rp = VTOR(vp);
   4548 	mi = VTOMI(vp);
   4549 retry:
   4550 	mutex_enter(&rp->r_statelock);
   4551 
   4552 	/*
   4553 	 * Don't create dirty pages faster than they
   4554 	 * can be cleaned so that the system doesn't
   4555 	 * get imbalanced.  If the async queue is
   4556 	 * maxed out, then wait for it to drain before
   4557 	 * creating more dirty pages.  Also, wait for
   4558 	 * any threads doing pagewalks in the vop_getattr
   4559 	 * entry points so that they don't block for
   4560 	 * long periods.
   4561 	 */
   4562 	if (rw == S_CREATE) {
   4563 		while ((mi->mi_max_threads != 0 &&
   4564 		    rp->r_awcount > 2 * mi->mi_max_threads) ||
   4565 		    rp->r_gcount > 0)
   4566 			cv_wait(&rp->r_cv, &rp->r_statelock);
   4567 	}
   4568 
   4569 	/*
   4570 	 * If we are getting called as a side effect of an nfs_write()
   4571 	 * operation the local file size might not be extended yet.
   4572 	 * In this case we want to be able to return pages of zeroes.
   4573 	 */
   4574 	if (off + len > rp->r_size + PAGEOFFSET && seg != segkmap) {
   4575 		mutex_exit(&rp->r_statelock);
   4576 		return (EFAULT);		/* beyond EOF */
   4577 	}
   4578 
   4579 	mutex_exit(&rp->r_statelock);
   4580 
   4581 	if (len <= PAGESIZE) {
   4582 		error = nfs3_getapage(vp, off, len, protp, pl, plsz,
   4583 		    seg, addr, rw, cr);
   4584 	} else {
   4585 		error = pvn_getpages(nfs3_getapage, vp, off, len, protp,
   4586 		    pl, plsz, seg, addr, rw, cr);
   4587 	}
   4588 
   4589 	switch (error) {
   4590 	case NFS_EOF:
   4591 		nfs_purge_caches(vp, NFS_NOPURGE_DNLC, cr);
   4592 		goto retry;
   4593 	case ESTALE:
   4594 		PURGE_STALE_FH(error, vp, cr);
   4595 	}
   4596 
   4597 	return (error);
   4598 }
   4599 
   4600 /*
   4601  * Called from pvn_getpages or nfs3_getpage to get a particular page.
   4602  */
   4603 /* ARGSUSED */
   4604 static int
   4605 nfs3_getapage(vnode_t *vp, u_offset_t off, size_t len, uint_t *protp,
   4606 	page_t *pl[], size_t plsz, struct seg *seg, caddr_t addr,
   4607 	enum seg_rw rw, cred_t *cr)
   4608 {
   4609 	rnode_t *rp;
   4610 	uint_t bsize;
   4611 	struct buf *bp;
   4612 	page_t *pp;
   4613 	u_offset_t lbn;
   4614 	u_offset_t io_off;
   4615 	u_offset_t blkoff;
   4616 	u_offset_t rablkoff;
   4617 	size_t io_len;
   4618 	uint_t blksize;
   4619 	int error;
   4620 	int readahead;
   4621 	int readahead_issued = 0;
   4622 	int ra_window; /* readahead window */
   4623 	page_t *pagefound;
   4624 	page_t *savepp;
   4625 
   4626 	if (nfs_zone() != VTOMI(vp)->mi_zone)
   4627 		return (EIO);
   4628 	rp = VTOR(vp);
   4629 	bsize = MAX(vp->v_vfsp->vfs_bsize, PAGESIZE);
   4630 
   4631 reread:
   4632 	bp = NULL;
   4633 	pp = NULL;
   4634 	pagefound = NULL;
   4635 
   4636 	if (pl != NULL)
   4637 		pl[0] = NULL;
   4638 
   4639 	error = 0;
   4640 	lbn = off / bsize;
   4641 	blkoff = lbn * bsize;
   4642 
   4643 	/*
   4644 	 * Queueing up the readahead before doing the synchronous read
   4645 	 * results in a significant increase in read throughput because
   4646 	 * of the increased parallelism between the async threads and
   4647 	 * the process context.
   4648 	 */
   4649 	if ((off & ((vp->v_vfsp->vfs_bsize) - 1)) == 0 &&
   4650 	    rw != S_CREATE &&
   4651 	    !(vp->v_flag & VNOCACHE)) {
   4652 		mutex_enter(&rp->r_statelock);
   4653 
   4654 		/*
   4655 		 * Calculate the number of readaheads to do.
   4656 		 * a) No readaheads at offset = 0.
   4657 		 * b) Do maximum(nfs3_nra) readaheads when the readahead
   4658 		 *    window is closed.
   4659 		 * c) Do readaheads between 1 to (nfs3_nra - 1) depending
   4660 		 *    upon how far the readahead window is open or close.
   4661 		 * d) No readaheads if rp->r_nextr is not within the scope
   4662 		 *    of the readahead window (random i/o).
   4663 		 */
   4664 
   4665 		if (off == 0)
   4666 			readahead = 0;
   4667 		else if (blkoff == rp->r_nextr)
   4668 			readahead = nfs3_nra;
   4669 		else if (rp->r_nextr > blkoff &&
   4670 		    ((ra_window = (rp->r_nextr - blkoff) / bsize)
   4671 		    <= (nfs3_nra - 1)))
   4672 			readahead = nfs3_nra - ra_window;
   4673 		else
   4674 			readahead = 0;
   4675 
   4676 		rablkoff = rp->r_nextr;
   4677 		while (readahead > 0 && rablkoff + bsize < rp->r_size) {
   4678 			mutex_exit(&rp->r_statelock);
   4679 			if (nfs_async_readahead(vp, rablkoff + bsize,
   4680 			    addr + (rablkoff + bsize - off), seg, cr,
   4681 			    nfs3_readahead) < 0) {
   4682 				mutex_enter(&rp->r_statelock);
   4683 				break;
   4684 			}
   4685 			readahead--;
   4686 			rablkoff += bsize;
   4687 			/*
   4688 			 * Indicate that we did a readahead so
   4689 			 * readahead offset is not updated
   4690 			 * by the synchronous read below.
   4691 			 */
   4692 			readahead_issued = 1;
   4693 			mutex_enter(&rp->r_statelock);
   4694 			/*
   4695 			 * set readahead offset to
   4696 			 * offset of last async readahead
   4697 			 * request.
   4698 			 */
   4699 			rp->r_nextr = rablkoff;
   4700 		}
   4701 		mutex_exit(&rp->r_statelock);
   4702 	}
   4703 
   4704 again:
   4705 	if ((pagefound = page_exists(vp, off)) == NULL) {
   4706 		if (pl == NULL) {
   4707 			(void) nfs_async_readahead(vp, blkoff, addr, seg, cr,
   4708 			    nfs3_readahead);
   4709 		} else if (rw == S_CREATE) {
   4710 			/*
   4711 			 * Block for this page is not allocated, or the offset
   4712 			 * is beyond the current allocation size, or we're
   4713 			 * allocating a swap slot and the page was not found,
   4714 			 * so allocate it and return a zero page.
   4715 			 */
   4716 			if ((pp = page_create_va(vp, off,
   4717 			    PAGESIZE, PG_WAIT, seg, addr)) == NULL)
   4718 				cmn_err(CE_PANIC, "nfs3_getapage: page_create");
   4719 			io_len = PAGESIZE;
   4720 			mutex_enter(&rp->r_statelock);
   4721 			rp->r_nextr = off + PAGESIZE;
   4722 			mutex_exit(&rp->r_statelock);
   4723 		} else {
   4724 			/*
   4725 			 * Need to go to server to get a BLOCK, exception to
   4726 			 * that being while reading at offset = 0 or doing
   4727 			 * random i/o, in that case read only a PAGE.
   4728 			 */
   4729 			mutex_enter(&rp->r_statelock);
   4730 			if (blkoff < rp->r_size &&
   4731 			    blkoff + bsize >= rp->r_size) {
   4732 				/*
   4733 				 * If only a block or less is left in
   4734 				 * the file, read all that is remaining.
   4735 				 */
   4736 				if (rp->r_size <= off) {
   4737 					/*
   4738 					 * Trying to access beyond EOF,
   4739 					 * set up to get at least one page.
   4740 					 */
   4741 					blksize = off + PAGESIZE - blkoff;
   4742 				} else
   4743 					blksize = rp->r_size - blkoff;
   4744 			} else if ((off == 0) ||
   4745 			    (off != rp->r_nextr && !readahead_issued)) {
   4746 				blksize = PAGESIZE;
   4747 				blkoff = off; /* block = page here */
   4748 			} else
   4749 				blksize = bsize;
   4750 			mutex_exit(&rp->r_statelock);
   4751 
   4752 			pp = pvn_read_kluster(vp, off, seg, addr, &io_off,
   4753 			    &io_len, blkoff, blksize, 0);
   4754 
   4755 			/*
   4756 			 * Some other thread has entered the page,
   4757 			 * so just use it.
   4758 			 */
   4759 			if (pp == NULL)
   4760 				goto again;
   4761 
   4762 			/*
   4763 			 * Now round the request size up to page boundaries.
   4764 			 * This ensures that the entire page will be
   4765 			 * initialized to zeroes if EOF is encountered.
   4766 			 */
   4767 			io_len = ptob(btopr(io_len));
   4768 
   4769 			bp = pageio_setup(pp, io_len, vp, B_READ);
   4770 			ASSERT(bp != NULL);
   4771 
   4772 			/*
   4773 			 * pageio_setup should have set b_addr to 0.  This
   4774 			 * is correct since we want to do I/O on a page
   4775 			 * boundary.  bp_mapin will use this addr to calculate
   4776 			 * an offset, and then set b_addr to the kernel virtual
   4777 			 * address it allocated for us.
   4778 			 */
   4779 			ASSERT(bp->b_un.b_addr == 0);
   4780 
   4781 			bp->b_edev = 0;
   4782 			bp->b_dev = 0;
   4783 			bp->b_lblkno = lbtodb(io_off);
   4784 			bp->b_file = vp;
   4785 			bp->b_offset = (offset_t)off;
   4786 			bp_mapin(bp);
   4787 
   4788 			/*
   4789 			 * If doing a write beyond what we believe is EOF,
   4790 			 * don't bother trying to read the pages from the
   4791 			 * server, we'll just zero the pages here.  We
   4792 			 * don't check that the rw flag is S_WRITE here
   4793 			 * because some implementations may attempt a
   4794 			 * read access to the buffer before copying data.
   4795 			 */
   4796 			mutex_enter(&rp->r_statelock);
   4797 			if (io_off >= rp->r_size && seg == segkmap) {
   4798 				mutex_exit(&rp->r_statelock);
   4799 				bzero(bp->b_un.b_addr, io_len);
   4800 			} else {
   4801 				mutex_exit(&rp->r_statelock);
   4802 				error = nfs3_bio(bp, NULL, cr);
   4803 			}
   4804 
   4805 			/*
   4806 			 * Unmap the buffer before freeing it.
   4807 			 */
   4808 			bp_mapout(bp);
   4809 			pageio_done(bp);
   4810 
   4811 			savepp = pp;
   4812 			do {
   4813 				pp->p_fsdata = C_NOCOMMIT;
   4814 			} while ((pp = pp->p_next) != savepp);
   4815 
   4816 			if (error == NFS_EOF) {
   4817 				/*
   4818 				 * If doing a write system call just return
   4819 				 * zeroed pages, else user tried to get pages
   4820 				 * beyond EOF, return error.  We don't check
   4821 				 * that the rw flag is S_WRITE here because
   4822 				 * some implementations may attempt a read
   4823 				 * access to the buffer before copying data.
   4824 				 */
   4825 				if (seg == segkmap)
   4826 					error = 0;
   4827 				else
   4828 					error = EFAULT;
   4829 			}
   4830 
   4831 			if (!readahead_issued && !error) {
   4832 				mutex_enter(&rp->r_statelock);
   4833 				rp->r_nextr = io_off + io_len;
   4834 				mutex_exit(&rp->r_statelock);
   4835 			}
   4836 		}
   4837 	}
   4838 
   4839 out:
   4840 	if (pl == NULL)
   4841 		return (error);
   4842 
   4843 	if (error) {
   4844 		if (pp != NULL)
   4845 			pvn_read_done(pp, B_ERROR);
   4846 		return (error);
   4847 	}
   4848 
   4849 	if (pagefound) {
   4850 		se_t se = (rw == S_CREATE ? SE_EXCL : SE_SHARED);
   4851 
   4852 		/*
   4853 		 * Page exists in the cache, acquire the appropriate lock.
   4854 		 * If this fails, start all over again.
   4855 		 */
   4856 		if ((pp = page_lookup(vp, off, se)) == NULL) {
   4857 #ifdef DEBUG
   4858 			nfs3_lostpage++;
   4859 #endif
   4860 			goto reread;
   4861 		}
   4862 		pl[0] = pp;
   4863 		pl[1] = NULL;
   4864 		return (0);
   4865 	}
   4866 
   4867 	if (pp != NULL)
   4868 		pvn_plist_init(pp, pl, plsz, off, io_len, rw);
   4869 
   4870 	return (error);
   4871 }
   4872 
   4873 static void
   4874 nfs3_readahead(vnode_t *vp, u_offset_t blkoff, caddr_t addr, struct seg *seg,
   4875 	cred_t *cr)
   4876 {
   4877 	int error;
   4878 	page_t *pp;
   4879 	u_offset_t io_off;
   4880 	size_t io_len;
   4881 	struct buf *bp;
   4882 	uint_t bsize, blksize;
   4883 	rnode_t *rp = VTOR(vp);
   4884 	page_t *savepp;
   4885 
   4886 	ASSERT(nfs_zone() == VTOMI(vp)->mi_zone);
   4887 	bsize = MAX(vp->v_vfsp->vfs_bsize, PAGESIZE);
   4888 
   4889 	mutex_enter(&rp->r_statelock);
   4890 	if (blkoff < rp->r_size && blkoff + bsize > rp->r_size) {
   4891 		/*
   4892 		 * If less than a block left in file read less
   4893 		 * than a block.
   4894 		 */
   4895 		blksize = rp->r_size - blkoff;
   4896 	} else
   4897 		blksize = bsize;
   4898 	mutex_exit(&rp->r_statelock);
   4899 
   4900 	pp = pvn_read_kluster(vp, blkoff, segkmap, addr,
   4901 	    &io_off, &io_len, blkoff, blksize, 1);
   4902 	/*
   4903 	 * The isra flag passed to the kluster function is 1, we may have
   4904 	 * gotten a return value of NULL for a variety of reasons (# of free
   4905 	 * pages < minfree, someone entered the page on the vnode etc). In all
   4906 	 * cases, we want to punt on the readahead.
   4907 	 */
   4908 	if (pp == NULL)
   4909 		return;
   4910 
   4911 	/*
   4912 	 * Now round the request size up to page boundaries.
   4913 	 * This ensures that the entire page will be
   4914 	 * initialized to zeroes if EOF is encountered.
   4915 	 */
   4916 	io_len = ptob(btopr(io_len));
   4917 
   4918 	bp = pageio_setup(pp, io_len, vp, B_READ);
   4919 	ASSERT(bp != NULL);
   4920 
   4921 	/*
   4922 	 * pageio_setup should have set b_addr to 0.  This is correct since
   4923 	 * we want to do I/O on a page boundary. bp_mapin() will use this addr
   4924 	 * to calculate an offset, and then set b_addr to the kernel virtual
   4925 	 * address it allocated for us.
   4926 	 */
   4927 	ASSERT(bp->b_un.b_addr == 0);
   4928 
   4929 	bp->b_edev = 0;
   4930 	bp->b_dev = 0;
   4931 	bp->b_lblkno = lbtodb(io_off);
   4932 	bp->b_file = vp;
   4933 	bp->b_offset = (offset_t)blkoff;
   4934 	bp_mapin(bp);
   4935 
   4936 	/*
   4937 	 * If doing a write beyond what we believe is EOF, don't bother trying
   4938 	 * to read the pages from the server, we'll just zero the pages here.
   4939 	 * We don't check that the rw flag is S_WRITE here because some
   4940 	 * implementations may attempt a read access to the buffer before
   4941 	 * copying data.
   4942 	 */
   4943 	mutex_enter(&rp->r_statelock);
   4944 	if (io_off >= rp->r_size && seg == segkmap) {
   4945 		mutex_exit(&rp->r_statelock);
   4946 		bzero(bp->b_un.b_addr, io_len);
   4947 		error = 0;
   4948 	} else {
   4949 		mutex_exit(&rp->r_statelock);
   4950 		error = nfs3_bio(bp, NULL, cr);
   4951 		if (error == NFS_EOF)
   4952 			error = 0;
   4953 	}
   4954 
   4955 	/*
   4956 	 * Unmap the buffer before freeing it.
   4957 	 */
   4958 	bp_mapout(bp);
   4959 	pageio_done(bp);
   4960 
   4961 	savepp = pp;
   4962 	do {
   4963 		pp->p_fsdata = C_NOCOMMIT;
   4964 	} while ((pp = pp->p_next) != savepp);
   4965 
   4966 	pvn_read_done(pp, error ? B_READ | B_ERROR : B_READ);
   4967 
   4968 	/*
   4969 	 * In case of error set readahead offset
   4970 	 * to the lowest offset.
   4971 	 * pvn_read_done() calls VN_DISPOSE to destroy the pages
   4972 	 */
   4973 	if (error && rp->r_nextr > io_off) {
   4974 		mutex_enter(&rp->r_statelock);
   4975 		if (rp->r_nextr > io_off)
   4976 			rp->r_nextr = io_off;
   4977 		mutex_exit(&rp->r_statelock);
   4978 	}
   4979 }
   4980 
   4981 /*
   4982  * Flags are composed of {B_INVAL, B_FREE, B_DONTNEED, B_FORCE}
   4983  * If len == 0, do from off to EOF.
   4984  *
   4985  * The normal cases should be len == 0 && off == 0 (entire vp list),
   4986  * len == MAXBSIZE (from segmap_release actions), and len == PAGESIZE
   4987  * (from pageout).
   4988  */
   4989 /* ARGSUSED */
   4990 static int
   4991 nfs3_putpage(vnode_t *vp, offset_t off, size_t len, int flags, cred_t *cr,
   4992 	caller_context_t *ct)
   4993 {
   4994 	int error;
   4995 	rnode_t *rp;
   4996 
   4997 	ASSERT(cr != NULL);
   4998 
   4999 	/*
   5000 	 * XXX - Why should this check be made here?
   5001 	 */
   5002 	if (vp->v_flag & VNOMAP)
   5003 		return (ENOSYS);
   5004 	if (len == 0 && !(flags & B_INVAL) && vn_is_readonly(vp))
   5005 		return (0);
   5006 	if (!(flags & B_ASYNC) && nfs_zone() != VTOMI(vp)->mi_zone)
   5007 		return (EIO);
   5008 
   5009 	rp = VTOR(vp);
   5010 	mutex_enter(&rp->r_statelock);
   5011 	rp->r_count++;
   5012 	mutex_exit(&rp->r_statelock);
   5013 	error = nfs_putpages(vp, off, len, flags, cr);
   5014 	mutex_enter(&rp->r_statelock);
   5015 	rp->r_count--;
   5016 	cv_broadcast(&rp->r_cv);
   5017 	mutex_exit(&rp->r_statelock);
   5018 
   5019 	return (error);
   5020 }
   5021 
   5022 /*
   5023  * Write out a single page, possibly klustering adjacent dirty pages.
   5024  */
   5025 int
   5026 nfs3_putapage(vnode_t *vp, page_t *pp, u_offset_t *offp, size_t *lenp,
   5027 	int flags, cred_t *cr)
   5028 {
   5029 	u_offset_t io_off;
   5030 	u_offset_t lbn_off;
   5031 	u_offset_t lbn;
   5032 	size_t io_len;
   5033 	uint_t bsize;
   5034 	int error;
   5035 	rnode_t *rp;
   5036 
   5037 	ASSERT(!vn_is_readonly(vp));
   5038 	ASSERT(pp != NULL);
   5039 	ASSERT(cr != NULL);
   5040 	ASSERT((flags & B_ASYNC) || nfs_zone() == VTOMI(vp)->mi_zone);
   5041 
   5042 	rp = VTOR(vp);
   5043 	ASSERT(rp->r_count > 0);
   5044 
   5045 	bsize = MAX(vp->v_vfsp->vfs_bsize, PAGESIZE);
   5046 	lbn = pp->p_offset / bsize;
   5047 	lbn_off = lbn * bsize;
   5048 
   5049 	/*
   5050 	 * Find a kluster that fits in one block, or in
   5051 	 * one page if pages are bigger than blocks.  If
   5052 	 * there is less file space allocated than a whole
   5053 	 * page, we'll shorten the i/o request below.
   5054 	 */
   5055 	pp = pvn_write_kluster(vp, pp, &io_off, &io_len, lbn_off,
   5056 	    roundup(bsize, PAGESIZE), flags);
   5057 
   5058 	/*
   5059 	 * pvn_write_kluster shouldn't have returned a page with offset
   5060 	 * behind the original page we were given.  Verify that.
   5061 	 */
   5062 	ASSERT((pp->p_offset / bsize) >= lbn);
   5063 
   5064 	/*
   5065 	 * Now pp will have the list of kept dirty pages marked for
   5066 	 * write back.  It will also handle invalidation and freeing
   5067 	 * of pages that are not dirty.  Check for page length rounding
   5068 	 * problems.
   5069 	 */
   5070 	if (io_off + io_len > lbn_off + bsize) {
   5071 		ASSERT((io_off + io_len) - (lbn_off + bsize) < PAGESIZE);
   5072 		io_len = lbn_off + bsize - io_off;
   5073 	}
   5074 	/*
   5075 	 * The RMODINPROGRESS flag makes sure that nfs(3)_bio() sees a
   5076 	 * consistent value of r_size. RMODINPROGRESS is set in writerp().
   5077 	 * When RMODINPROGRESS is set it indicates that a uiomove() is in
   5078 	 * progress and the r_size has not been made consistent with the
   5079 	 * new size of the file. When the uiomove() completes the r_size is
   5080 	 * updated and the RMODINPROGRESS flag is cleared.
   5081 	 *
   5082 	 * The RMODINPROGRESS flag makes sure that nfs(3)_bio() sees a
   5083 	 * consistent value of r_size. Without this handshaking, it is
   5084 	 * possible that nfs(3)_bio() picks  up the old value of r_size
   5085 	 * before the uiomove() in writerp() completes. This will result
   5086 	 * in the write through nfs(3)_bio() being dropped.
   5087 	 *
   5088 	 * More precisely, there is a window between the time the uiomove()
   5089 	 * completes and the time the r_size is updated. If a VOP_PUTPAGE()
   5090 	 * operation intervenes in this window, the page will be picked up,
   5091 	 * because it is dirty (it will be unlocked, unless it was
   5092 	 * pagecreate'd). When the page is picked up as dirty, the dirty
   5093 	 * bit is reset (pvn_getdirty()). In nfs(3)write(), r_size is
   5094 	 * checked. This will still be the old size. Therefore the page will
   5095 	 * not be written out. When segmap_release() calls VOP_PUTPAGE(),
   5096 	 * the page will be found to be clean and the write will be dropped.
   5097 	 */
   5098 	if (rp->r_flags & RMODINPROGRESS) {
   5099 		mutex_enter(&rp->r_statelock);
   5100 		if ((rp->r_flags & RMODINPROGRESS) &&
   5101 		    rp->r_modaddr + MAXBSIZE > io_off &&
   5102 		    rp->r_modaddr < io_off + io_len) {
   5103 			page_t *plist;
   5104 			/*
   5105 			 * A write is in progress for this region of the file.
   5106 			 * If we did not detect RMODINPROGRESS here then this
   5107 			 * path through nfs_putapage() would eventually go to
   5108 			 * nfs(3)_bio() and may not write out all of the data
   5109 			 * in the pages. We end up losing data. So we decide
   5110 			 * to set the modified bit on each page in the page
   5111 			 * list and mark the rnode with RDIRTY. This write
   5112 			 * will be restarted at some later time.
   5113 			 */
   5114 			plist = pp;
   5115 			while (plist != NULL) {
   5116 				pp = plist;
   5117 				page_sub(&plist, pp);
   5118 				hat_setmod(pp);
   5119 				page_io_unlock(pp);
   5120 				page_unlock(pp);
   5121 			}
   5122 			rp->r_flags |= RDIRTY;
   5123 			mutex_exit(&rp->r_statelock);
   5124 			if (offp)
   5125 				*offp = io_off;
   5126 			if (lenp)
   5127 				*lenp = io_len;
   5128 			return (0);
   5129 		}
   5130 		mutex_exit(&rp->r_statelock);
   5131 	}
   5132 
   5133 	if (flags & B_ASYNC) {
   5134 		error = nfs_async_putapage(vp, pp, io_off, io_len, flags, cr,
   5135 		    nfs3_sync_putapage);
   5136 	} else
   5137 		error = nfs3_sync_putapage(vp, pp, io_off, io_len, flags, cr);
   5138 
   5139 	if (offp)
   5140 		*offp = io_off;
   5141 	if (lenp)
   5142 		*lenp = io_len;
   5143 	return (error);
   5144 }
   5145 
   5146 static int
   5147 nfs3_sync_putapage(vnode_t *vp, page_t *pp, u_offset_t io_off, size_t io_len,
   5148 	int flags, cred_t *cr)
   5149 {
   5150 	int error;
   5151 	rnode_t *rp;
   5152 
   5153 	ASSERT(nfs_zone() == VTOMI(vp)->mi_zone);
   5154 
   5155 	flags |= B_WRITE;
   5156 
   5157 	error = nfs3_rdwrlbn(vp, pp, io_off, io_len, flags, cr);
   5158 
   5159 	rp = VTOR(vp);
   5160 
   5161 	if ((error == ENOSPC || error == EDQUOT || error == EFBIG ||
   5162 	    error == EACCES) &&
   5163 	    (flags & (B_INVAL|B_FORCE)) != (B_INVAL|B_FORCE)) {
   5164 		if (!(rp->r_flags & ROUTOFSPACE)) {
   5165 			mutex_enter(&rp->r_statelock);
   5166 			rp->r_flags |= ROUTOFSPACE;
   5167 			mutex_exit(&rp->r_statelock);
   5168 		}
   5169 		flags |= B_ERROR;
   5170 		pvn_write_done(pp, flags);
   5171 		/*
   5172 		 * If this was not an async thread, then try again to
   5173 		 * write out the pages, but this time, also destroy
   5174 		 * them whether or not the write is successful.  This
   5175 		 * will prevent memory from filling up with these
   5176 		 * pages and destroying them is the only alternative
   5177 		 * if they can't be written out.
   5178 		 *
   5179 		 * Don't do this if this is an async thread because
   5180 		 * when the pages are unlocked in pvn_write_done,
   5181 		 * some other thread could have come along, locked
   5182 		 * them, and queued for an async thread.  It would be
   5183 		 * possible for all of the async threads to be tied
   5184 		 * up waiting to lock the pages again and they would
   5185 		 * all already be locked and waiting for an async
   5186 		 * thread to handle them.  Deadlock.
   5187 		 */
   5188 		if (!(flags & B_ASYNC)) {
   5189 			error = nfs3_putpage(vp, io_off, io_len,
   5190 			    B_INVAL | B_FORCE, cr, NULL);
   5191 		}
   5192 	} else {
   5193 		if (error)
   5194 			flags |= B_ERROR;
   5195 		else if (rp->r_flags & ROUTOFSPACE) {
   5196 			mutex_enter(&rp->r_statelock);
   5197 			rp->r_flags &= ~ROUTOFSPACE;
   5198 			mutex_exit(&rp->r_statelock);
   5199 		}
   5200 		pvn_write_done(pp, flags);
   5201 		if (freemem < desfree)
   5202 			(void) nfs3_commit_vp(vp, (u_offset_t)0, 0, cr);
   5203 	}
   5204 
   5205 	return (error);
   5206 }
   5207 
   5208 /* ARGSUSED */
   5209 static int
   5210 nfs3_map(vnode_t *vp, offset_t off, struct as *as, caddr_t *addrp,
   5211 	size_t len, uchar_t prot, uchar_t maxprot, uint_t flags,
   5212 	cred_t *cr, caller_context_t *ct)
   5213 {
   5214 	struct segvn_crargs vn_a;
   5215 	int error;
   5216 	rnode_t *rp;
   5217 	struct vattr va;
   5218 
   5219 	if (nfs_zone() != VTOMI(vp)->mi_zone)
   5220 		return (EIO);
   5221 
   5222 	if (vp->v_flag & VNOMAP)
   5223 		return (ENOSYS);
   5224 
   5225 	if (off < 0 || off + len < 0)
   5226 		return (ENXIO);
   5227 
   5228 	if (vp->v_type != VREG)
   5229 		return (ENODEV);
   5230 
   5231 	/*
   5232 	 * If there is cached data and if close-to-open consistency
   5233 	 * checking is not turned off and if the file system is not
   5234 	 * mounted readonly, then force an over the wire getattr.
   5235 	 * Otherwise, just invoke nfs3getattr to get a copy of the
   5236 	 * attributes.  The attribute cache will be used unless it
   5237 	 * is timed out and if it is, then an over the wire getattr
   5238 	 * will be issued.
   5239 	 */
   5240 	va.va_mask = AT_ALL;
   5241 	if (vn_has_cached_data(vp) &&
   5242 	    !(VTOMI(vp)->mi_flags & MI_NOCTO) && !vn_is_readonly(vp))
   5243 		error = nfs3_getattr_otw(vp, &va, cr);
   5244 	else
   5245 		error = nfs3getattr(vp, &va, cr);
   5246 	if (error)
   5247 		return (error);
   5248 
   5249 	/*
   5250 	 * Check to see if the vnode is currently marked as not cachable.
   5251 	 * This means portions of the file are locked (through VOP_FRLOCK).
   5252 	 * In this case the map request must be refused.  We use
   5253 	 * rp->r_lkserlock to avoid a race with concurrent lock requests.
   5254 	 */
   5255 	rp = VTOR(vp);
   5256 
   5257 	/*
   5258 	 * Atomically increment r_inmap after acquiring r_rwlock. The
   5259 	 * idea here is to acquire r_rwlock to block read/write and
   5260 	 * not to protect r_inmap. r_inmap will inform nfs3_read/write()
   5261 	 * that we are in nfs3_map(). Now, r_rwlock is acquired in order
   5262 	 * and we can prevent the deadlock that would have occurred
   5263 	 * when nfs3_addmap() would have acquired it out of order.
   5264 	 *
   5265 	 * Since we are not protecting r_inmap by any lock, we do not
   5266 	 * hold any lock when we decrement it. We atomically decrement
   5267 	 * r_inmap after we release r_lkserlock.
   5268 	 */
   5269 
   5270 	if (nfs_rw_enter_sig(&rp->r_rwlock, RW_WRITER, INTR(vp)))
   5271 		return (EINTR);
   5272 	atomic_add_int(&rp->r_inmap, 1);
   5273 	nfs_rw_exit(&rp->r_rwlock);
   5274 
   5275 	if (nfs_rw_enter_sig(&rp->r_lkserlock, RW_READER, INTR(vp))) {
   5276 		atomic_add_int(&rp->r_inmap, -1);
   5277 		return (EINTR);
   5278 	}
   5279 
   5280 	if (vp->v_flag & VNOCACHE) {
   5281 		error = EAGAIN;
   5282 		goto done;
   5283 	}
   5284 
   5285 	/*
   5286 	 * Don't allow concurrent locks and mapping if mandatory locking is
   5287 	 * enabled.
   5288 	 */
   5289 	if ((flk_has_remote_locks(vp) || lm_has_sleep(vp)) &&
   5290 	    MANDLOCK(vp, va.va_mode)) {
   5291 		error = EAGAIN;
   5292 		goto done;
   5293 	}
   5294 
   5295 	as_rangelock(as);
   5296 	error = choose_addr(as, addrp, len, off, ADDR_VACALIGN, flags);
   5297 	if (error != 0) {
   5298 		as_rangeunlock(as);
   5299 		goto done;
   5300 	}
   5301 
   5302 	vn_a.vp = vp;
   5303 	vn_a.offset = off;
   5304 	vn_a.type = (flags & MAP_TYPE);
   5305 	vn_a.prot = (uchar_t)prot;
   5306 	vn_a.maxprot = (uchar_t)maxprot;
   5307 	vn_a.flags = (flags & ~MAP_TYPE);
   5308 	vn_a.cred = cr;
   5309 	vn_a.amp = NULL;
   5310 	vn_a.szc = 0;
   5311 	vn_a.lgrp_mem_policy_flags = 0;
   5312 
   5313 	error = as_map(as, *addrp, len, segvn_create, &vn_a);
   5314 	as_rangeunlock(as);
   5315 
   5316 done:
   5317 	nfs_rw_exit(&rp->r_lkserlock);
   5318 	atomic_add_int(&rp->r_inmap, -1);
   5319 	return (error);
   5320 }
   5321 
   5322 /* ARGSUSED */
   5323 static int
   5324 nfs3_addmap(vnode_t *vp, offset_t off, struct as *as, caddr_t addr,
   5325 	size_t len, uchar_t prot, uchar_t maxprot, uint_t flags,
   5326 	cred_t *cr, caller_context_t *ct)
   5327 {
   5328 	rnode_t *rp;
   5329 
   5330 	if (vp->v_flag & VNOMAP)
   5331 		return (ENOSYS);
   5332 	if (nfs_zone() != VTOMI(vp)->mi_zone)
   5333 		return (EIO);
   5334 
   5335 	rp = VTOR(vp);
   5336 	atomic_add_long((ulong_t *)&rp->r_mapcnt, btopr(len));
   5337 
   5338 	return (0);
   5339 }
   5340 
   5341 /* ARGSUSED */
   5342 static int
   5343 nfs3_frlock(vnode_t *vp, int cmd, struct flock64 *bfp, int flag,
   5344 	offset_t offset, struct flk_callback *flk_cbp, cred_t *cr,
   5345 	caller_context_t *ct)
   5346 {
   5347 	netobj lm_fh3;
   5348 	int rc;
   5349 	u_offset_t start, end;
   5350 	rnode_t *rp;
   5351 	int error = 0, intr = INTR(vp);
   5352 
   5353 	if (nfs_zone() != VTOMI(vp)->mi_zone)
   5354 		return (EIO);
   5355 	/* check for valid cmd parameter */
   5356 	if (cmd != F_GETLK && cmd != F_SETLK && cmd != F_SETLKW)
   5357 		return (EINVAL);
   5358 
   5359 	/* Verify l_type. */
   5360 	switch (bfp->l_type) {
   5361 	case F_RDLCK:
   5362 		if (cmd != F_GETLK && !(flag & FREAD))
   5363 			return (EBADF);
   5364 		break;
   5365 	case F_WRLCK:
   5366 		if (cmd != F_GETLK && !(flag & FWRITE))
   5367 			return (EBADF);
   5368 		break;
   5369 	case F_UNLCK:
   5370 		intr = 0;
   5371 		break;
   5372 
   5373 	default:
   5374 		return (EINVAL);
   5375 	}
   5376 
   5377 	/* check the validity of the lock range */
   5378 	if (rc = flk_convert_lock_data(vp, bfp, &start, &end, offset))
   5379 		return (rc);
   5380 	if (rc = flk_check_lock_data(start, end, MAXEND))
   5381 		return (rc);
   5382 
   5383 	/*
   5384 	 * If the filesystem is mounted using local locking, pass the
   5385 	 * request off to the local locking code.
   5386 	 */
   5387 	if (VTOMI(vp)->mi_flags & MI_LLOCK) {
   5388 		if (cmd == F_SETLK || cmd == F_SETLKW) {
   5389 			/*
   5390 			 * For complete safety, we should be holding
   5391 			 * r_lkserlock.  However, we can't call
   5392 			 * lm_safelock and then fs_frlock while
   5393 			 * holding r_lkserlock, so just invoke
   5394 			 * lm_safelock and expect that this will
   5395 			 * catch enough of the cases.
   5396 			 */
   5397 			if (!lm_safelock(vp, bfp, cr))
   5398 				return (EAGAIN);
   5399 		}
   5400 		return (fs_frlock(vp, cmd, bfp, flag, offset, flk_cbp, cr, ct));
   5401 	}
   5402 
   5403 	rp = VTOR(vp);
   5404 
   5405 	/*
   5406 	 * Check whether the given lock request can proceed, given the
   5407 	 * current file mappings.
   5408 	 */
   5409 	if (nfs_rw_enter_sig(&rp->r_lkserlock, RW_WRITER, intr))
   5410 		return (EINTR);
   5411 	if (cmd == F_SETLK || cmd == F_SETLKW) {
   5412 		if (!lm_safelock(vp, bfp, cr)) {
   5413 			rc = EAGAIN;
   5414 			goto done;
   5415 		}
   5416 	}
   5417 
   5418 	/*
   5419 	 * Flush the cache after waiting for async I/O to finish.  For new
   5420 	 * locks, this is so that the process gets the latest bits from the
   5421 	 * server.  For unlocks, this is so that other clients see the
   5422 	 * latest bits once the file has been unlocked.  If currently dirty
   5423 	 * pages can't be flushed, then don't allow a lock to be set.  But
   5424 	 * allow unlocks to succeed, to avoid having orphan locks on the
   5425 	 * server.
   5426 	 */
   5427 	if (cmd != F_GETLK) {
   5428 		mutex_enter(&rp->r_statelock);
   5429 		while (rp->r_count > 0) {
   5430 			if (intr) {
   5431 				klwp_t *lwp = ttolwp(curthread);
   5432 
   5433 				if (lwp != NULL)
   5434 					lwp->lwp_nostop++;
   5435 				if (cv_wait_sig(&rp->r_cv,
   5436 				    &rp->r_statelock) == 0) {
   5437 					if (lwp != NULL)
   5438 						lwp->lwp_nostop--;
   5439 					rc = EINTR;
   5440 					break;
   5441 				}
   5442 				if (lwp != NULL)
   5443 					lwp->lwp_nostop--;
   5444 			} else
   5445 				cv_wait(&rp->r_cv, &rp->r_statelock);
   5446 		}
   5447 		mutex_exit(&rp->r_statelock);
   5448 		if (rc != 0)
   5449 			goto done;
   5450 		error = nfs3_putpage(vp, (offset_t)0, 0, B_INVAL, cr, ct);
   5451 		if (error) {
   5452 			if (error == ENOSPC || error == EDQUOT) {
   5453 				mutex_enter(&rp->r_statelock);
   5454 				if (!rp->r_error)
   5455 					rp->r_error = error;
   5456 				mutex_exit(&rp->r_statelock);
   5457 			}
   5458 			if (bfp->l_type != F_UNLCK) {
   5459 				rc = ENOLCK;
   5460 				goto done;
   5461 			}
   5462 		}
   5463 	}
   5464 
   5465 	lm_fh3.n_len = VTOFH3(vp)->fh3_length;
   5466 	lm_fh3.n_bytes = (char *)&(VTOFH3(vp)->fh3_u.data);
   5467 
   5468 	/*
   5469 	 * Call the lock manager to do the real work of contacting
   5470 	 * the server and obtaining the lock.
   5471 	 */
   5472 	rc = lm4_frlock(vp, cmd, bfp, flag, offset, cr, &lm_fh3, flk_cbp);
   5473 
   5474 	if (rc == 0)
   5475 		nfs_lockcompletion(vp, cmd);
   5476 
   5477 done:
   5478 	nfs_rw_exit(&rp->r_lkserlock);
   5479 	return (rc);
   5480 }
   5481 
   5482 /*
   5483  * Free storage space associated with the specified vnode.  The portion
   5484  * to be freed is specified by bfp->l_start and bfp->l_len (already
   5485  * normalized to a "whence" of 0).
   5486  *
   5487  * This is an experimental facility whose continued existence is not
   5488  * guaranteed.  Currently, we only support the special case
   5489  * of l_len == 0, meaning free to end of file.
   5490  */
   5491 /* ARGSUSED */
   5492 static int
   5493 nfs3_space(vnode_t *vp, int cmd, struct flock64 *bfp, int flag,
   5494 	offset_t offset, cred_t *cr, caller_context_t *ct)
   5495 {
   5496 	int error;
   5497 
   5498 	ASSERT(vp->v_type == VREG);
   5499 	if (cmd != F_FREESP)
   5500 		return (EINVAL);
   5501 	if (nfs_zone() != VTOMI(vp)->mi_zone)
   5502 		return (EIO);
   5503 
   5504 	error = convoff(vp, bfp, 0, offset);
   5505 	if (!error) {
   5506 		ASSERT(bfp->l_start >= 0);
   5507 		if (bfp->l_len == 0) {
   5508 			struct vattr va;
   5509 
   5510 			/*
   5511 			 * ftruncate should not change the ctime and
   5512 			 * mtime if we truncate the file to its
   5513 			 * previous size.
   5514 			 */
   5515 			va.va_mask = AT_SIZE;
   5516 			error = nfs3getattr(vp, &va, cr);
   5517 			if (error || va.va_size == bfp->l_start)
   5518 				return (error);
   5519 			va.va_mask = AT_SIZE;
   5520 			va.va_size = bfp->l_start;
   5521 			error = nfs3setattr(vp, &va, 0, cr);
   5522 		} else
   5523 			error = EINVAL;
   5524 	}
   5525 
   5526 	return (error);
   5527 }
   5528 
   5529 /* ARGSUSED */
   5530 static int
   5531 nfs3_realvp(vnode_t *vp, vnode_t **vpp, caller_context_t *ct)
   5532 {
   5533 
   5534 	return (EINVAL);
   5535 }
   5536 
   5537 /*
   5538  * Setup and add an address space callback to do the work of the delmap call.
   5539  * The callback will (and must be) deleted in the actual callback function.
   5540  *
   5541  * This is done in order to take care of the problem that we have with holding
   5542  * the address space's a_lock for a long period of time (e.g. if the NFS server
   5543  * is down).  Callbacks will be executed in the address space code while the
   5544  * a_lock is not held.	Holding the address space's a_lock causes things such
   5545  * as ps and fork to hang because they are trying to acquire this lock as well.
   5546  */
   5547 /* ARGSUSED */
   5548 static int
   5549 nfs3_delmap(vnode_t *vp, offset_t off, struct as *as, caddr_t addr,
   5550 	size_t len, uint_t prot, uint_t maxprot, uint_t flags,
   5551 	cred_t *cr, caller_context_t *ct)
   5552 {
   5553 	int			caller_found;
   5554 	int			error;
   5555 	rnode_t			*rp;
   5556 	nfs_delmap_args_t	*dmapp;
   5557 	nfs_delmapcall_t	*delmap_call;
   5558 
   5559 	if (vp->v_flag & VNOMAP)
   5560 		return (ENOSYS);
   5561 	/*
   5562 	 * A process may not change zones if it has NFS pages mmap'ed
   5563 	 * in, so we can't legitimately get here from the wrong zone.
   5564 	 */
   5565 	ASSERT(nfs_zone() == VTOMI(vp)->mi_zone);
   5566 
   5567 	rp = VTOR(vp);
   5568 
   5569 	/*
   5570 	 * The way that the address space of this process deletes its mapping
   5571 	 * of this file is via the following call chains:
   5572 	 * - as_free()->SEGOP_UNMAP()/segvn_unmap()->VOP_DELMAP()/nfs3_delmap()
   5573 	 * - as_unmap()->SEGOP_UNMAP()/segvn_unmap()->VOP_DELMAP()/nfs3_delmap()
   5574 	 *
   5575 	 * With the use of address space callbacks we are allowed to drop the
   5576 	 * address space lock, a_lock, while executing the NFS operations that
   5577 	 * need to go over the wire.  Returning EAGAIN to the caller of this
   5578 	 * function is what drives the execution of the callback that we add
   5579 	 * below.  The callback will be executed by the address space code
   5580 	 * after dropping the a_lock.  When the callback is finished, since
   5581 	 * we dropped the a_lock, it must be re-acquired and segvn_unmap()
   5582 	 * is called again on the same segment to finish the rest of the work
   5583 	 * that needs to happen during unmapping.
   5584 	 *
   5585 	 * This action of calling back into the segment driver causes
   5586 	 * nfs3_delmap() to get called again, but since the callback was
   5587 	 * already executed at this point, it already did the work and there
   5588 	 * is nothing left for us to do.
   5589 	 *
   5590 	 * To Summarize:
   5591 	 * - The first time nfs3_delmap is called by the current thread is when
   5592 	 * we add the caller associated with this delmap to the delmap caller
   5593 	 * list, add the callback, and return EAGAIN.
   5594 	 * - The second time in this call chain when nfs3_delmap is called we
   5595 	 * will find this caller in the delmap caller list and realize there
   5596 	 * is no more work to do thus removing this caller from the list and
   5597 	 * returning the error that was set in the callback execution.
   5598 	 */
   5599 	caller_found = nfs_find_and_delete_delmapcall(rp, &error);
   5600 	if (caller_found) {
   5601 		/*
   5602 		 * 'error' is from the actual delmap operations.  To avoid
   5603 		 * hangs, we need to handle the return of EAGAIN differently
   5604 		 * since this is what drives the callback execution.
   5605 		 * In this case, we don't want to return EAGAIN and do the
   5606 		 * callback execution because there are none to execute.
   5607 		 */
   5608 		if (error == EAGAIN)
   5609 			return (0);
   5610 		else
   5611 			return (error);
   5612 	}
   5613 
   5614 	/* current caller was not in the list */
   5615 	delmap_call = nfs_init_delmapcall();
   5616 
   5617 	mutex_enter(&rp->r_statelock);
   5618 	list_insert_tail(&rp->r_indelmap, delmap_call);
   5619 	mutex_exit(&rp->r_statelock);
   5620 
   5621 	dmapp = kmem_alloc(sizeof (nfs_delmap_args_t), KM_SLEEP);
   5622 
   5623 	dmapp->vp = vp;
   5624 	dmapp->off = off;
   5625 	dmapp->addr = addr;
   5626 	dmapp->len = len;
   5627 	dmapp->prot = prot;
   5628 	dmapp->maxprot = maxprot;
   5629 	dmapp->flags = flags;
   5630 	dmapp->cr = cr;
   5631 	dmapp->caller = delmap_call;
   5632 
   5633 	error = as_add_callback(as, nfs3_delmap_callback, dmapp,
   5634 	    AS_UNMAP_EVENT, addr, len, KM_SLEEP);
   5635 
   5636 	return (error ? error : EAGAIN);
   5637 }
   5638 
   5639 /*
   5640  * Remove some pages from an mmap'd vnode.  Just update the
   5641  * count of pages.  If doing close-to-open, then flush and
   5642  * commit all of the pages associated with this file.
   5643  * Otherwise, start an asynchronous page flush to write out
   5644  * any dirty pages.  This will also associate a credential
   5645  * with the rnode which can be used to write the pages.
   5646  */
   5647 /* ARGSUSED */
   5648 static void
   5649 nfs3_delmap_callback(struct as *as, void *arg, uint_t event)
   5650 {
   5651 	int			error;
   5652 	rnode_t			*rp;
   5653 	mntinfo_t		*mi;
   5654 	nfs_delmap_args_t	*dmapp = (nfs_delmap_args_t *)arg;
   5655 
   5656 	rp = VTOR(dmapp->vp);
   5657 	mi = VTOMI(dmapp->vp);
   5658 
   5659 	atomic_add_long((ulong_t *)&rp->r_mapcnt, -btopr(dmapp->len));
   5660 	ASSERT(rp->r_mapcnt >= 0);
   5661 
   5662 	/*
   5663 	 * Initiate a page flush and potential commit if there are
   5664 	 * pages, the file system was not mounted readonly, the segment
   5665 	 * was mapped shared, and the pages themselves were writeable.
   5666 	 */
   5667 	if (vn_has_cached_data(dmapp->vp) && !vn_is_readonly(dmapp->vp) &&
   5668 	    dmapp->flags == MAP_SHARED && (dmapp->maxprot & PROT_WRITE)) {
   5669 		mutex_enter(&rp->r_statelock);
   5670 		rp->r_flags |= RDIRTY;
   5671 		mutex_exit(&rp->r_statelock);
   5672 		/*
   5673 		 * If this is a cross-zone access a sync putpage won't work, so
   5674 		 * the best we can do is try an async putpage.  That seems
   5675 		 * better than something more draconian such as discarding the
   5676 		 * dirty pages.
   5677 		 */
   5678 		if ((mi->mi_flags & MI_NOCTO) ||
   5679 		    nfs_zone() != mi->mi_zone)
   5680 			error = nfs3_putpage(dmapp->vp, dmapp->off, dmapp->len,
   5681 			    B_ASYNC, dmapp->cr, NULL);
   5682 		else
   5683 			error = nfs3_putpage_commit(dmapp->vp, dmapp->off,
   5684 			    dmapp->len, dmapp->cr);
   5685 		if (!error) {
   5686 			mutex_enter(&rp->r_statelock);
   5687 			error = rp->r_error;
   5688 			rp->r_error = 0;
   5689 			mutex_exit(&rp->r_statelock);
   5690 		}
   5691 	} else
   5692 		error = 0;
   5693 
   5694 	if ((rp->r_flags & RDIRECTIO) || (mi->mi_flags & MI_DIRECTIO))
   5695 		(void) nfs3_putpage(dmapp->vp, dmapp->off, dmapp->len,
   5696 		    B_INVAL, dmapp->cr, NULL);
   5697 
   5698 	dmapp->caller->error = error;
   5699 	(void) as_delete_callback(as, arg);
   5700 	kmem_free(dmapp, sizeof (nfs_delmap_args_t));
   5701 }
   5702 
   5703 static int nfs3_pathconf_disable_cache = 0;
   5704 
   5705 #ifdef DEBUG
   5706 static int nfs3_pathconf_cache_hits = 0;
   5707 static int nfs3_pathconf_cache_misses = 0;
   5708 #endif
   5709 
   5710 /* ARGSUSED */
   5711 static int
   5712 nfs3_pathconf(vnode_t *vp, int cmd, ulong_t *valp, cred_t *cr,
   5713 	caller_context_t *ct)
   5714 {
   5715 	int error;
   5716 	PATHCONF3args args;
   5717 	PATHCONF3res res;
   5718 	int douprintf;
   5719 	failinfo_t fi;
   5720 	rnode_t *rp;
   5721 	hrtime_t t;
   5722 
   5723 	if (nfs_zone() != VTOMI(vp)->mi_zone)
   5724 		return (EIO);
   5725 	/*
   5726 	 * Large file spec - need to base answer on info stored
   5727 	 * on original FSINFO response.
   5728 	 */
   5729 	if (cmd == _PC_FILESIZEBITS) {
   5730 		unsigned long long ll;
   5731 		long l = 1;
   5732 
   5733 		ll = VTOMI(vp)->mi_maxfilesize;
   5734 
   5735 		if (ll == 0) {
   5736 			*valp = 0;
   5737 			return (0);
   5738 		}
   5739 
   5740 		if (ll & 0xffffffff00000000) {
   5741 			l += 32; ll >>= 32;
   5742 		}
   5743 		if (ll & 0xffff0000) {
   5744 			l += 16; ll >>= 16;
   5745 		}
   5746 		if (ll & 0xff00) {
   5747 			l += 8; ll >>= 8;
   5748 		}
   5749 		if (ll & 0xf0) {
   5750 			l += 4; ll >>= 4;
   5751 		}
   5752 		if (ll & 0xc) {
   5753 			l += 2; ll >>= 2;
   5754 		}
   5755 		if (ll & 0x2)
   5756 			l += 2;
   5757 		else if (ll & 0x1)
   5758 			l += 1;
   5759 		*valp = l;
   5760 		return (0);
   5761 	}
   5762 
   5763 	if (cmd == _PC_ACL_ENABLED) {
   5764 		*valp = _ACL_ACLENT_ENABLED;
   5765 		return (0);
   5766 	}
   5767 
   5768 	if (cmd == _PC_XATTR_EXISTS) {
   5769 		error = 0;
   5770 		*valp = 0;
   5771 		if (vp->v_vfsp->vfs_flag & VFS_XATTR) {
   5772 			vnode_t *avp;
   5773 			rnode_t *rp;
   5774 			int error = 0;
   5775 			mntinfo_t *mi = VTOMI(vp);
   5776 
   5777 			if (!(mi->mi_flags & MI_EXTATTR))
   5778 				return (0);
   5779 
   5780 			rp = VTOR(vp);
   5781 			if (nfs_rw_enter_sig(&rp->r_rwlock, RW_READER,
   5782 			    INTR(vp)))
   5783 				return (EINTR);
   5784 
   5785 			error = nfs3lookup_dnlc(vp, XATTR_DIR_NAME, &avp, cr);
   5786 			if (error || avp == NULL)
   5787 				error = acl_getxattrdir3(vp, &avp, 0, cr, 0);
   5788 
   5789 			nfs_rw_exit(&rp->r_rwlock);
   5790 
   5791 			if (error == 0 && avp != NULL) {
   5792 				error = do_xattr_exists_check(avp, valp, cr);
   5793 				VN_RELE(avp);
   5794 			} else if (error == ENOENT) {
   5795 				error = 0;
   5796 				*valp = 0;
   5797 			}
   5798 		}
   5799 		return (error);
   5800 	}
   5801 
   5802 	rp = VTOR(vp);
   5803 	if (rp->r_pathconf != NULL) {
   5804 		mutex_enter(&rp->r_statelock);
   5805 		if (rp->r_pathconf != NULL && nfs3_pathconf_disable_cache) {
   5806 			kmem_free(rp->r_pathconf, sizeof (*rp->r_pathconf));
   5807 			rp->r_pathconf = NULL;
   5808 		}
   5809 		if (rp->r_pathconf != NULL) {
   5810 			error = 0;
   5811 			switch (cmd) {
   5812 			case _PC_LINK_MAX:
   5813 				*valp = rp->r_pathconf->link_max;
   5814 				break;
   5815 			case _PC_NAME_MAX:
   5816 				*valp = rp->r_pathconf->name_max;
   5817 				break;
   5818 			case _PC_PATH_MAX:
   5819 			case _PC_SYMLINK_MAX:
   5820 				*valp = MAXPATHLEN;
   5821 				break;
   5822 			case _PC_CHOWN_RESTRICTED:
   5823 				*valp = rp->r_pathconf->chown_restricted;
   5824 				break;
   5825 			case _PC_NO_TRUNC:
   5826 				*valp = rp->r_pathconf->no_trunc;
   5827 				break;
   5828 			default:
   5829 				error = EINVAL;
   5830 				break;
   5831 			}
   5832 			mutex_exit(&rp->r_statelock);
   5833 #ifdef DEBUG
   5834 			nfs3_pathconf_cache_hits++;
   5835 #endif
   5836 			return (error);
   5837 		}
   5838 		mutex_exit(&rp->r_statelock);
   5839 	}
   5840 #ifdef DEBUG
   5841 	nfs3_pathconf_cache_misses++;
   5842 #endif
   5843 
   5844 	args.object = *VTOFH3(vp);
   5845 	fi.vp = vp;
   5846 	fi.fhp = (caddr_t)&args.object;
   5847 	fi.copyproc = nfs3copyfh;
   5848 	fi.lookupproc = nfs3lookup;
   5849 	fi.xattrdirproc = acl_getxattrdir3;
   5850 
   5851 	douprintf = 1;
   5852 
   5853 	t = gethrtime();
   5854 
   5855 	error = rfs3call(VTOMI(vp), NFSPROC3_PATHCONF,
   5856 	    xdr_nfs_fh3, (caddr_t)&args,
   5857 	    xdr_PATHCONF3res, (caddr_t)&res, cr,
   5858 	    &douprintf, &res.status, 0, &fi);
   5859 
   5860 	if (error)
   5861 		return (error);
   5862 
   5863 	error = geterrno3(res.status);
   5864 
   5865 	if (!error) {
   5866 		nfs3_cache_post_op_attr(vp, &res.resok.obj_attributes, t, cr);
   5867 		if (!nfs3_pathconf_disable_cache) {
   5868 			mutex_enter(&rp->r_statelock);
   5869 			if (rp->r_pathconf == NULL) {
   5870 				rp->r_pathconf = kmem_alloc(
   5871 				    sizeof (*rp->r_pathconf), KM_NOSLEEP);
   5872 				if (rp->r_pathconf != NULL)
   5873 					*rp->r_pathconf = res.resok.info;
   5874 			}
   5875 			mutex_exit(&rp->r_statelock);
   5876 		}
   5877 		switch (cmd) {
   5878 		case _PC_LINK_MAX:
   5879 			*valp = res.resok.info.link_max;
   5880 			break;
   5881 		case _PC_NAME_MAX:
   5882 			*valp = res.resok.info.name_max;
   5883 			break;
   5884 		case _PC_PATH_MAX:
   5885 		case _PC_SYMLINK_MAX:
   5886 			*valp = MAXPATHLEN;
   5887 			break;
   5888 		case _PC_CHOWN_RESTRICTED:
   5889 			*valp = res.resok.info.chown_restricted;
   5890 			break;
   5891 		case _PC_NO_TRUNC:
   5892 			*valp = res.resok.info.no_trunc;
   5893 			break;
   5894 		default:
   5895 			return (EINVAL);
   5896 		}
   5897 	} else {
   5898 		nfs3_cache_post_op_attr(vp, &res.resfail.obj_attributes, t, cr);
   5899 		PURGE_STALE_FH(error, vp, cr);
   5900 	}
   5901 
   5902 	return (error);
   5903 }
   5904 
   5905 /*
   5906  * Called by async thread to do synchronous pageio. Do the i/o, wait
   5907  * for it to complete, and cleanup the page list when done.
   5908  */
   5909 static int
   5910 nfs3_sync_pageio(vnode_t *vp, page_t *pp, u_offset_t io_off, size_t io_len,
   5911 	int flags, cred_t *cr)
   5912 {
   5913 	int error;
   5914 
   5915 	ASSERT(nfs_zone() == VTOMI(vp)->mi_zone);
   5916 	error = nfs3_rdwrlbn(vp, pp, io_off, io_len, flags, cr);
   5917 	if (flags & B_READ)
   5918 		pvn_read_done(pp, (error ? B_ERROR : 0) | flags);
   5919 	else
   5920 		pvn_write_done(pp, (error ? B_ERROR : 0) | flags);
   5921 	return (error);
   5922 }
   5923 
   5924 /* ARGSUSED */
   5925 static int
   5926 nfs3_pageio(vnode_t *vp, page_t *pp, u_offset_t io_off, size_t io_len,
   5927 	int flags, cred_t *cr, caller_context_t *ct)
   5928 {
   5929 	int error;
   5930 	rnode_t *rp;
   5931 
   5932 	if (pp == NULL)
   5933 		return (EINVAL);
   5934 	if (!(flags & B_ASYNC) && nfs_zone() != VTOMI(vp)->mi_zone)
   5935 		return (EIO);
   5936 
   5937 	rp = VTOR(vp);
   5938 	mutex_enter(&rp->r_statelock);
   5939 	rp->r_count++;
   5940 	mutex_exit(&rp->r_statelock);
   5941 
   5942 	if (flags & B_ASYNC) {
   5943 		error = nfs_async_pageio(vp, pp, io_off, io_len, flags, cr,
   5944 		    nfs3_sync_pageio);
   5945 	} else
   5946 		error = nfs3_rdwrlbn(vp, pp, io_off, io_len, flags, cr);
   5947 	mutex_enter(&rp->r_statelock);
   5948 	rp->r_count--;
   5949 	cv_broadcast(&rp->r_cv);
   5950 	mutex_exit(&rp->r_statelock);
   5951 	return (error);
   5952 }
   5953 
   5954 /* ARGSUSED */
   5955 static void
   5956 nfs3_dispose(vnode_t *vp, page_t *pp, int fl, int dn, cred_t *cr,
   5957 	caller_context_t *ct)
   5958 {
   5959 	int error;
   5960 	rnode_t *rp;
   5961 	page_t *plist;
   5962 	page_t *pptr;
   5963 	offset3 offset;
   5964 	count3 len;
   5965 	k_sigset_t smask;
   5966 
   5967 	/*
   5968 	 * We should get called with fl equal to either B_FREE or
   5969 	 * B_INVAL.  Any other value is illegal.
   5970 	 *
   5971 	 * The page that we are either supposed to free or destroy
   5972 	 * should be exclusive locked and its io lock should not
   5973 	 * be held.
   5974 	 */
   5975 	ASSERT(fl == B_FREE || fl == B_INVAL);
   5976 	ASSERT((PAGE_EXCL(pp) && !page_iolock_assert(pp)) || panicstr);
   5977 	rp = VTOR(vp);
   5978 
   5979 	/*
   5980 	 * If the page doesn't need to be committed or we shouldn't
   5981 	 * even bother attempting to commit it, then just make sure
   5982 	 * that the p_fsdata byte is clear and then either free or
   5983 	 * destroy the page as appropriate.
   5984 	 */
   5985 	if (pp->p_fsdata == C_NOCOMMIT || (rp->r_flags & RSTALE)) {
   5986 		pp->p_fsdata = C_NOCOMMIT;
   5987 		if (fl == B_FREE)
   5988 			page_free(pp, dn);
   5989 		else
   5990 			page_destroy(pp, dn);
   5991 		return;
   5992 	}
   5993 
   5994 	/*
   5995 	 * If there is a page invalidation operation going on, then
   5996 	 * if this is one of the pages being destroyed, then just
   5997 	 * clear the p_fsdata byte and then either free or destroy
   5998 	 * the page as appropriate.
   5999 	 */
   6000 	mutex_enter(&rp->r_statelock);
   6001 	if ((rp->r_flags & RTRUNCATE) && pp->p_offset >= rp->r_truncaddr) {
   6002 		mutex_exit(&rp->r_statelock);
   6003 		pp->p_fsdata = C_NOCOMMIT;
   6004 		if (fl == B_FREE)
   6005 			page_free(pp, dn);
   6006 		else
   6007 			page_destroy(pp, dn);
   6008 		return;
   6009 	}
   6010 
   6011 	/*
   6012 	 * If we are freeing this page and someone else is already
   6013 	 * waiting to do a commit, then just unlock the page and
   6014 	 * return.  That other thread will take care of commiting
   6015 	 * this page.  The page can be freed sometime after the
   6016 	 * commit has finished.  Otherwise, if the page is marked
   6017 	 * as delay commit, then we may be getting called from
   6018 	 * pvn_write_done, one page at a time.   This could result
   6019 	 * in one commit per page, so we end up doing lots of small
   6020 	 * commits instead of fewer larger commits.  This is bad,
   6021 	 * we want do as few commits as possible.
   6022 	 */
   6023 	if (fl == B_FREE) {
   6024 		if (rp->r_flags & RCOMMITWAIT) {
   6025 			page_unlock(pp);
   6026 			mutex_exit(&rp->r_statelock);
   6027 			return;
   6028 		}
   6029 		if (pp->p_fsdata == C_DELAYCOMMIT) {
   6030 			pp->p_fsdata = C_COMMIT;
   6031 			page_unlock(pp);
   6032 			mutex_exit(&rp->r_statelock);
   6033 			return;
   6034 		}
   6035 	}
   6036 
   6037 	/*
   6038 	 * Check to see if there is a signal which would prevent an
   6039 	 * attempt to commit the pages from being successful.  If so,
   6040 	 * then don't bother with all of the work to gather pages and
   6041 	 * generate the unsuccessful RPC.  Just return from here and
   6042 	 * let the page be committed at some later time.
   6043 	 */
   6044 	sigintr(&smask, VTOMI(vp)->mi_flags & MI_INT);
   6045 	if (ttolwp(curthread) != NULL && ISSIG(curthread, JUSTLOOKING)) {
   6046 		sigunintr(&smask);
   6047 		page_unlock(pp);
   6048 		mutex_exit(&rp->r_statelock);
   6049 		return;
   6050 	}
   6051 	sigunintr(&smask);
   6052 
   6053 	/*
   6054 	 * We are starting to need to commit pages, so let's try
   6055 	 * to commit as many as possible at once to reduce the
   6056 	 * overhead.
   6057 	 *
   6058 	 * Set the `commit inprogress' state bit.  We must
   6059 	 * first wait until any current one finishes.  Then
   6060 	 * we initialize the c_pages list with this page.
   6061 	 */
   6062 	while (rp->r_flags & RCOMMIT) {
   6063 		rp->r_flags |= RCOMMITWAIT;
   6064 		cv_wait(&rp->r_commit.c_cv, &rp->r_statelock);
   6065 		rp->r_flags &= ~RCOMMITWAIT;
   6066 	}
   6067 	rp->r_flags |= RCOMMIT;
   6068 	mutex_exit(&rp->r_statelock);
   6069 	ASSERT(rp->r_commit.c_pages == NULL);
   6070 	rp->r_commit.c_pages = pp;
   6071 	rp->r_commit.c_commbase = (offset3)pp->p_offset;
   6072 	rp->r_commit.c_commlen = PAGESIZE;
   6073 
   6074 	/*
   6075 	 * Gather together all other pages which can be committed.
   6076 	 * They will all be chained off r_commit.c_pages.
   6077 	 */
   6078 	nfs3_get_commit(vp);
   6079 
   6080 	/*
   6081 	 * Clear the `commit inprogress' status and disconnect
   6082 	 * the list of pages to be committed from the rnode.
   6083 	 * At this same time, we also save the starting offset
   6084 	 * and length of data to be committed on the server.
   6085 	 */
   6086 	plist = rp->r_commit.c_pages;
   6087 	rp->r_commit.c_pages = NULL;
   6088 	offset = rp->r_commit.c_commbase;
   6089 	len = rp->r_commit.c_commlen;
   6090 	mutex_enter(&rp->r_statelock);
   6091 	rp->r_flags &= ~RCOMMIT;
   6092 	cv_broadcast(&rp->r_commit.c_cv);
   6093 	mutex_exit(&rp->r_statelock);
   6094 
   6095 	if (curproc == proc_pageout || curproc == proc_fsflush ||
   6096 	    nfs_zone() != VTOMI(vp)->mi_zone) {
   6097 		nfs_async_commit(vp, plist, offset, len, cr, nfs3_async_commit);
   6098 		return;
   6099 	}
   6100 
   6101 	/*
   6102 	 * Actually generate the COMMIT3 over the wire operation.
   6103 	 */
   6104 	error = nfs3_commit(vp, offset, len, cr);
   6105 
   6106 	/*
   6107 	 * If we got an error during the commit, just unlock all
   6108 	 * of the pages.  The pages will get retransmitted to the
   6109 	 * server during a putpage operation.
   6110 	 */
   6111 	if (error) {
   6112 		while (plist != NULL) {
   6113 			pptr = plist;
   6114 			page_sub(&plist, pptr);
   6115 			page_unlock(pptr);
   6116 		}
   6117 		return;
   6118 	}
   6119 
   6120 	/*
   6121 	 * We've tried as hard as we can to commit the data to stable
   6122 	 * storage on the server.  We release the rest of the pages
   6123 	 * and clear the commit required state.  They will be put
   6124 	 * onto the tail of the cachelist if they are nolonger
   6125 	 * mapped.
   6126 	 */
   6127 	while (plist != pp) {
   6128 		pptr = plist;
   6129 		page_sub(&plist, pptr);
   6130 		pptr->p_fsdata = C_NOCOMMIT;
   6131 		(void) page_release(pptr, 1);
   6132 	}
   6133 
   6134 	/*
   6135 	 * It is possible that nfs3_commit didn't return error but
   6136 	 * some other thread has modified the page we are going
   6137 	 * to free/destroy.
   6138 	 *    In this case we need to rewrite the page. Do an explicit check
   6139 	 * before attempting to free/destroy the page. If modified, needs to
   6140 	 * be rewritten so unlock the page and return.
   6141 	 */
   6142 	if (hat_ismod(pp)) {
   6143 		pp->p_fsdata = C_NOCOMMIT;
   6144 		page_unlock(pp);
   6145 		return;
   6146 	}
   6147 
   6148 	/*
   6149 	 * Now, as appropriate, either free or destroy the page
   6150 	 * that we were called with.
   6151 	 */
   6152 	pp->p_fsdata = C_NOCOMMIT;
   6153 	if (fl == B_FREE)
   6154 		page_free(pp, dn);
   6155 	else
   6156 		page_destroy(pp, dn);
   6157 }
   6158 
   6159 static int
   6160 nfs3_commit(vnode_t *vp, offset3 offset, count3 count, cred_t *cr)
   6161 {
   6162 	int error;
   6163 	rnode_t *rp;
   6164 	COMMIT3args args;
   6165 	COMMIT3res res;
   6166 	int douprintf;
   6167 	cred_t *cred;
   6168 
   6169 	rp = VTOR(vp);
   6170 	ASSERT(nfs_zone() == VTOMI(vp)->mi_zone);
   6171 
   6172 	mutex_enter(&rp->r_statelock);
   6173 	if (rp->r_cred != NULL) {
   6174 		cred = rp->r_cred;
   6175 		crhold(cred);
   6176 	} else {
   6177 		rp->r_cred = cr;
   6178 		crhold(cr);
   6179 		cred = cr;
   6180 		crhold(cred);
   6181 	}
   6182 	mutex_exit(&rp->r_statelock);
   6183 
   6184 	args.file = *VTOFH3(vp);
   6185 	args.offset = offset;
   6186 	args.count = count;
   6187 
   6188 doitagain:
   6189 	douprintf = 1;
   6190 	error = rfs3call(VTOMI(vp), NFSPROC3_COMMIT,
   6191 	    xdr_COMMIT3args, (caddr_t)&args,
   6192 	    xdr_COMMIT3res, (caddr_t)&res, cred,
   6193 	    &douprintf, &res.status, 0, NULL);
   6194 
   6195 	crfree(cred);
   6196 
   6197 	if (error)
   6198 		return (error);
   6199 
   6200 	error = geterrno3(res.status);
   6201 	if (!error) {
   6202 		ASSERT(rp->r_flags & RHAVEVERF);
   6203 		mutex_enter(&rp->r_statelock);
   6204 		if (rp->r_verf == res.resok.verf) {
   6205 			mutex_exit(&rp->r_statelock);
   6206 			return (0);
   6207 		}
   6208 		nfs3_set_mod(vp);
   6209 		rp->r_verf = res.resok.verf;
   6210 		mutex_exit(&rp->r_statelock);
   6211 		error = NFS_VERF_MISMATCH;
   6212 	} else {
   6213 		if (error == EACCES) {
   6214 			mutex_enter(&rp->r_statelock);
   6215 			if (cred != cr) {
   6216 				if (rp->r_cred != NULL)
   6217 					crfree(rp->r_cred);
   6218 				rp->r_cred = cr;
   6219 				crhold(cr);
   6220 				cred = cr;
   6221 				crhold(cred);
   6222 				mutex_exit(&rp->r_statelock);
   6223 				goto doitagain;
   6224 			}
   6225 			mutex_exit(&rp->r_statelock);
   6226 		}
   6227 		/*
   6228 		 * Can't do a PURGE_STALE_FH here because this
   6229 		 * can cause a deadlock.  nfs3_commit can
   6230 		 * be called from nfs3_dispose which can be called
   6231 		 * indirectly via pvn_vplist_dirty.  PURGE_STALE_FH
   6232 		 * can call back to pvn_vplist_dirty.
   6233 		 */
   6234 		if (error == ESTALE) {
   6235 			mutex_enter(&rp->r_statelock);
   6236 			rp->r_flags |= RSTALE;
   6237 			if (!rp->r_error)
   6238 				rp->r_error = error;
   6239 			mutex_exit(&rp->r_statelock);
   6240 			PURGE_ATTRCACHE(vp);
   6241 		} else {
   6242 			mutex_enter(&rp->r_statelock);
   6243 			if (!rp->r_error)
   6244 				rp->r_error = error;
   6245 			mutex_exit(&rp->r_statelock);
   6246 		}
   6247 	}
   6248 
   6249 	return (error);
   6250 }
   6251 
   6252 static void
   6253 nfs3_set_mod(vnode_t *vp)
   6254 {
   6255 	page_t *pp;
   6256 	kmutex_t *vphm;
   6257 
   6258 	ASSERT(nfs_zone() == VTOMI(vp)->mi_zone);
   6259 	vphm = page_vnode_mutex(vp);
   6260 	mutex_enter(vphm);
   6261 	if ((pp = vp->v_pages) != NULL) {
   6262 		do {
   6263 			if (pp->p_fsdata != C_NOCOMMIT) {
   6264 				hat_setmod(pp);
   6265 				pp->p_fsdata = C_NOCOMMIT;
   6266 			}
   6267 		} while ((pp = pp->p_vpnext) != vp->v_pages);
   6268 	}
   6269 	mutex_exit(vphm);
   6270 }
   6271 
   6272 
   6273 /*
   6274  * This routine is used to gather together a page list of the pages
   6275  * which are to be committed on the server.  This routine must not
   6276  * be called if the calling thread holds any locked pages.
   6277  *
   6278  * The calling thread must have set RCOMMIT.  This bit is used to
   6279  * serialize access to the commit structure in the rnode.  As long
   6280  * as the thread has set RCOMMIT, then it can manipulate the commit
   6281  * structure without requiring any other locks.
   6282  */
   6283 static void
   6284 nfs3_get_commit(vnode_t *vp)
   6285 {
   6286 	rnode_t *rp;
   6287 	page_t *pp;
   6288 	kmutex_t *vphm;
   6289 
   6290 	rp = VTOR(vp);
   6291 
   6292 	ASSERT(rp->r_flags & RCOMMIT);
   6293 
   6294 	vphm = page_vnode_mutex(vp);
   6295 	mutex_enter(vphm);
   6296 
   6297 	/*
   6298 	 * If there are no pages associated with this vnode, then
   6299 	 * just return.
   6300 	 */
   6301 	if ((pp = vp->v_pages) == NULL) {
   6302 		mutex_exit(vphm);
   6303 		return;
   6304 	}
   6305 
   6306 	/*
   6307 	 * Step through all of the pages associated with this vnode
   6308 	 * looking for pages which need to be committed.
   6309 	 */
   6310 	do {
   6311 		/*
   6312 		 * If this page does not need to be committed or is
   6313 		 * modified, then just skip it.
   6314 		 */
   6315 		if (pp->p_fsdata == C_NOCOMMIT || hat_ismod(pp))
   6316 			continue;
   6317 
   6318 		/*
   6319 		 * Attempt to lock the page.  If we can't, then
   6320 		 * someone else is messing with it and we will
   6321 		 * just skip it.
   6322 		 */
   6323 		if (!page_trylock(pp, SE_EXCL))
   6324 			continue;
   6325 
   6326 		/*
   6327 		 * If this page does not need to be committed or is
   6328 		 * modified, then just skip it.  Recheck now that
   6329 		 * the page is locked.
   6330 		 */
   6331 		if (pp->p_fsdata == C_NOCOMMIT || hat_ismod(pp)) {
   6332 			page_unlock(pp);
   6333 			continue;
   6334 		}
   6335 
   6336 		if (PP_ISFREE(pp)) {
   6337 			cmn_err(CE_PANIC, "nfs3_get_commit: %p is free",
   6338 			    (void *)pp);
   6339 		}
   6340 
   6341 		/*
   6342 		 * The page needs to be committed and we locked it.
   6343 		 * Update the base and length parameters and add it
   6344 		 * to r_pages.
   6345 		 */
   6346 		if (rp->r_commit.c_pages == NULL) {
   6347 			rp->r_commit.c_commbase = (offset3)pp->p_offset;
   6348 			rp->r_commit.c_commlen = PAGESIZE;
   6349 		} else if (pp->p_offset < rp->r_commit.c_commbase) {
   6350 			rp->r_commit.c_commlen = rp->r_commit.c_commbase -
   6351 			    (offset3)pp->p_offset + rp->r_commit.c_commlen;
   6352 			rp->r_commit.c_commbase = (offset3)pp->p_offset;
   6353 		} else if ((rp->r_commit.c_commbase + rp->r_commit.c_commlen)
   6354 		    <= pp->p_offset) {
   6355 			rp->r_commit.c_commlen = (offset3)pp->p_offset -
   6356 			    rp->r_commit.c_commbase + PAGESIZE;
   6357 		}
   6358 		page_add(&rp->r_commit.c_pages, pp);
   6359 	} while ((pp = pp->p_vpnext) != vp->v_pages);
   6360 
   6361 	mutex_exit(vphm);
   6362 }
   6363 
   6364 /*
   6365  * This routine is used to gather together a page list of the pages
   6366  * which are to be committed on the server.  This routine must not
   6367  * be called if the calling thread holds any locked pages.
   6368  *
   6369  * The calling thread must have set RCOMMIT.  This bit is used to
   6370  * serialize access to the commit structure in the rnode.  As long
   6371  * as the thread has set RCOMMIT, then it can manipulate the commit
   6372  * structure without requiring any other locks.
   6373  */
   6374 static void
   6375 nfs3_get_commit_range(vnode_t *vp, u_offset_t soff, size_t len)
   6376 {
   6377 
   6378 	rnode_t *rp;
   6379 	page_t *pp;
   6380 	u_offset_t end;
   6381 	u_offset_t off;
   6382 
   6383 	ASSERT(len != 0);
   6384 
   6385 	rp = VTOR(vp);
   6386 
   6387 	ASSERT(rp->r_flags & RCOMMIT);
   6388 	ASSERT(nfs_zone() == VTOMI(vp)->mi_zone);
   6389 
   6390 	/*
   6391 	 * If there are no pages associated with this vnode, then
   6392 	 * just return.
   6393 	 */
   6394 	if ((pp = vp->v_pages) == NULL)
   6395 		return;
   6396 
   6397 	/*
   6398 	 * Calculate the ending offset.
   6399 	 */
   6400 	end = soff + len;
   6401 
   6402 	for (off = soff; off < end; off += PAGESIZE) {
   6403 		/*
   6404 		 * Lookup each page by vp, offset.
   6405 		 */
   6406 		if ((pp = page_lookup_nowait(vp, off, SE_EXCL)) == NULL)
   6407 			continue;
   6408 
   6409 		/*
   6410 		 * If this page does not need to be committed or is
   6411 		 * modified, then just skip it.
   6412 		 */
   6413 		if (pp->p_fsdata == C_NOCOMMIT || hat_ismod(pp)) {
   6414 			page_unlock(pp);
   6415 			continue;
   6416 		}
   6417 
   6418 		ASSERT(PP_ISFREE(pp) == 0);
   6419 
   6420 		/*
   6421 		 * The page needs to be committed and we locked it.
   6422 		 * Update the base and length parameters and add it
   6423 		 * to r_pages.
   6424 		 */
   6425 		if (rp->r_commit.c_pages == NULL) {
   6426 			rp->r_commit.c_commbase = (offset3)pp->p_offset;
   6427 			rp->r_commit.c_commlen = PAGESIZE;
   6428 		} else {
   6429 			rp->r_commit.c_commlen = (offset3)pp->p_offset -
   6430 			    rp->r_commit.c_commbase + PAGESIZE;
   6431 		}
   6432 		page_add(&rp->r_commit.c_pages, pp);
   6433 	}
   6434 }
   6435 
   6436 #if 0	/* unused */
   6437 #ifdef DEBUG
   6438 static int
   6439 nfs3_no_uncommitted_pages(vnode_t *vp)
   6440 {
   6441 	page_t *pp;
   6442 	kmutex_t *vphm;
   6443 
   6444 	vphm = page_vnode_mutex(vp);
   6445 	mutex_enter(vphm);
   6446 	if ((pp = vp->v_pages) != NULL) {
   6447 		do {
   6448 			if (pp->p_fsdata != C_NOCOMMIT) {
   6449 				mutex_exit(vphm);
   6450 				return (0);
   6451 			}
   6452 		} while ((pp = pp->p_vpnext) != vp->v_pages);
   6453 	}
   6454 	mutex_exit(vphm);
   6455 
   6456 	return (1);
   6457 }
   6458 #endif
   6459 #endif
   6460 
   6461 static int
   6462 nfs3_putpage_commit(vnode_t *vp, offset_t poff, size_t plen, cred_t *cr)
   6463 {
   6464 	int error;
   6465 	writeverf3 write_verf;
   6466 	rnode_t *rp = VTOR(vp);
   6467 
   6468 	ASSERT(nfs_zone() == VTOMI(vp)->mi_zone);
   6469 	/*
   6470 	 * Flush the data portion of the file and then commit any
   6471 	 * portions which need to be committed.  This may need to
   6472 	 * be done twice if the server has changed state since
   6473 	 * data was last written.  The data will need to be
   6474 	 * rewritten to the server and then a new commit done.
   6475 	 *
   6476 	 * In fact, this may need to be done several times if the
   6477 	 * server is having problems and crashing while we are
   6478 	 * attempting to do this.
   6479 	 */
   6480 
   6481 top:
   6482 	/*
   6483 	 * Do a flush based on the poff and plen arguments.  This
   6484 	 * will asynchronously write out any modified pages in the
   6485 	 * range specified by (poff, plen).  This starts all of the
   6486 	 * i/o operations which will be waited for in the next
   6487 	 * call to nfs3_putpage
   6488 	 */
   6489 
   6490 	mutex_enter(&rp->r_statelock);
   6491 	write_verf = rp->r_verf;
   6492 	mutex_exit(&rp->r_statelock);
   6493 
   6494 	error = nfs3_putpage(vp, poff, plen, B_ASYNC, cr, NULL);
   6495 	if (error == EAGAIN)
   6496 		error = 0;
   6497 
   6498 	/*
   6499 	 * Do a flush based on the poff and plen arguments.  This
   6500 	 * will synchronously write out any modified pages in the
   6501 	 * range specified by (poff, plen) and wait until all of
   6502 	 * the asynchronous i/o's in that range are done as well.
   6503 	 */
   6504 	if (!error)
   6505 		error = nfs3_putpage(vp, poff, plen, 0, cr, NULL);
   6506 
   6507 	if (error)
   6508 		return (error);
   6509 
   6510 	mutex_enter(&rp->r_statelock);
   6511 	if (rp->r_verf != write_verf) {
   6512 		mutex_exit(&rp->r_statelock);
   6513 		goto top;
   6514 	}
   6515 	mutex_exit(&rp->r_statelock);
   6516 
   6517 	/*
   6518 	 * Now commit any pages which might need to be committed.
   6519 	 * If the error, NFS_VERF_MISMATCH, is returned, then
   6520 	 * start over with the flush operation.
   6521 	 */
   6522 
   6523 	error = nfs3_commit_vp(vp, poff, plen, cr);
   6524 
   6525 	if (error == NFS_VERF_MISMATCH)
   6526 		goto top;
   6527 
   6528 	return (error);
   6529 }
   6530 
   6531 static int
   6532 nfs3_commit_vp(vnode_t *vp, u_offset_t poff, size_t plen, cred_t *cr)
   6533 {
   6534 	rnode_t *rp;
   6535 	page_t *plist;
   6536 	offset3 offset;
   6537 	count3 len;
   6538 
   6539 
   6540 	rp = VTOR(vp);
   6541 
   6542 	if (nfs_zone() != VTOMI(vp)->mi_zone)
   6543 		return (EIO);
   6544 	/*
   6545 	 * Set the `commit inprogress' state bit.  We must
   6546 	 * first wait until any current one finishes.
   6547 	 */
   6548 	mutex_enter(&rp->r_statelock);
   6549 	while (rp->r_flags & RCOMMIT) {
   6550 		rp->r_flags |= RCOMMITWAIT;
   6551 		cv_wait(&rp->r_commit.c_cv, &rp->r_statelock);
   6552 		rp->r_flags &= ~RCOMMITWAIT;
   6553 	}
   6554 	rp->r_flags |= RCOMMIT;
   6555 	mutex_exit(&rp->r_statelock);
   6556 
   6557 	/*
   6558 	 * Gather together all of the pages which need to be
   6559 	 * committed.
   6560 	 */
   6561 	if (plen == 0)
   6562 		nfs3_get_commit(vp);
   6563 	else
   6564 		nfs3_get_commit_range(vp, poff, plen);
   6565 
   6566 	/*
   6567 	 * Clear the `commit inprogress' bit and disconnect the
   6568 	 * page list which was gathered together in nfs3_get_commit.
   6569 	 */
   6570 	plist = rp->r_commit.c_pages;
   6571 	rp->r_commit.c_pages = NULL;
   6572 	offset = rp->r_commit.c_commbase;
   6573 	len = rp->r_commit.c_commlen;
   6574 	mutex_enter(&rp->r_statelock);
   6575 	rp->r_flags &= ~RCOMMIT;
   6576 	cv_broadcast(&rp->r_commit.c_cv);
   6577 	mutex_exit(&rp->r_statelock);
   6578 
   6579 	/*
   6580 	 * If any pages need to be committed, commit them and
   6581 	 * then unlock them so that they can be freed some
   6582 	 * time later.
   6583 	 */
   6584 	if (plist != NULL) {
   6585 		/*
   6586 		 * No error occurred during the flush portion
   6587 		 * of this operation, so now attempt to commit
   6588 		 * the data to stable storage on the server.
   6589 		 *
   6590 		 * This will unlock all of the pages on the list.
   6591 		 */
   6592 		return (nfs3_sync_commit(vp, plist, offset, len, cr));
   6593 	}
   6594 	return (0);
   6595 }
   6596 
   6597 static int
   6598 nfs3_sync_commit(vnode_t *vp, page_t *plist, offset3 offset, count3 count,
   6599 	cred_t *cr)
   6600 {
   6601 	int error;
   6602 	page_t *pp;
   6603 
   6604 	ASSERT(nfs_zone() == VTOMI(vp)->mi_zone);
   6605 	error = nfs3_commit(vp, offset, count, cr);
   6606 
   6607 	/*
   6608 	 * If we got an error, then just unlock all of the pages
   6609 	 * on the list.
   6610 	 */
   6611 	if (error) {
   6612 		while (plist != NULL) {
   6613 			pp = plist;
   6614 			page_sub(&plist, pp);
   6615 			page_unlock(pp);
   6616 		}
   6617 		return (error);
   6618 	}
   6619 	/*
   6620 	 * We've tried as hard as we can to commit the data to stable
   6621 	 * storage on the server.  We just unlock the pages and clear
   6622 	 * the commit required state.  They will get freed later.
   6623 	 */
   6624 	while (plist != NULL) {
   6625 		pp = plist;
   6626 		page_sub(&plist, pp);
   6627 		pp->p_fsdata = C_NOCOMMIT;
   6628 		page_unlock(pp);
   6629 	}
   6630 
   6631 	return (error);
   6632 }
   6633 
   6634 static void
   6635 nfs3_async_commit(vnode_t *vp, page_t *plist, offset3 offset, count3 count,
   6636 	cred_t *cr)
   6637 {
   6638 	ASSERT(nfs_zone() == VTOMI(vp)->mi_zone);
   6639 	(void) nfs3_sync_commit(vp, plist, offset, count, cr);
   6640 }
   6641 
   6642 /* ARGSUSED */
   6643 static int
   6644 nfs3_setsecattr(vnode_t *vp, vsecattr_t *vsecattr, int flag, cred_t *cr,
   6645 	caller_context_t *ct)
   6646 {
   6647 	int error;
   6648 	mntinfo_t *mi;
   6649 
   6650 	mi = VTOMI(vp);
   6651 
   6652 	if (nfs_zone() != mi->mi_zone)
   6653 		return (EIO);
   6654 
   6655 	if (mi->mi_flags & MI_ACL) {
   6656 		error = acl_setacl3(vp, vsecattr, flag, cr);
   6657 		if (mi->mi_flags & MI_ACL)
   6658 			return (error);
   6659 	}
   6660 
   6661 	return (ENOSYS);
   6662 }
   6663 
   6664 /* ARGSUSED */
   6665 static int
   6666 nfs3_getsecattr(vnode_t *vp, vsecattr_t *vsecattr, int flag, cred_t *cr,
   6667 	caller_context_t *ct)
   6668 {
   6669 	int error;
   6670 	mntinfo_t *mi;
   6671 
   6672 	mi = VTOMI(vp);
   6673 
   6674 	if (nfs_zone() != mi->mi_zone)
   6675 		return (EIO);
   6676 
   6677 	if (mi->mi_flags & MI_ACL) {
   6678 		error = acl_getacl3(vp, vsecattr, flag, cr);
   6679 		if (mi->mi_flags & MI_ACL)
   6680 			return (error);
   6681 	}
   6682 
   6683 	return (fs_fab_acl(vp, vsecattr, flag, cr, ct));
   6684 }
   6685 
   6686 /* ARGSUSED */
   6687 static int
   6688 nfs3_shrlock(vnode_t *vp, int cmd, struct shrlock *shr, int flag, cred_t *cr,
   6689 	caller_context_t *ct)
   6690 {
   6691 	int error;
   6692 	struct shrlock nshr;
   6693 	struct nfs_owner nfs_owner;
   6694 	netobj lm_fh3;
   6695 
   6696 	if (nfs_zone() != VTOMI(vp)->mi_zone)
   6697 		return (EIO);
   6698 
   6699 	/*
   6700 	 * check for valid cmd parameter
   6701 	 */
   6702 	if (cmd != F_SHARE && cmd != F_UNSHARE && cmd != F_HASREMOTELOCKS)
   6703 		return (EINVAL);
   6704 
   6705 	/*
   6706 	 * Check access permissions
   6707 	 */
   6708 	if (cmd == F_SHARE &&
   6709 	    (((shr->s_access & F_RDACC) && !(flag & FREAD)) ||
   6710 	    ((shr->s_access & F_WRACC) && !(flag & FWRITE))))
   6711 		return (EBADF);
   6712 
   6713 	/*
   6714 	 * If the filesystem is mounted using local locking, pass the
   6715 	 * request off to the local share code.
   6716 	 */
   6717 	if (VTOMI(vp)->mi_flags & MI_LLOCK)
   6718 		return (fs_shrlock(vp, cmd, shr, flag, cr, ct));
   6719 
   6720 	switch (cmd) {
   6721 	case F_SHARE:
   6722 	case F_UNSHARE:
   6723 		lm_fh3.n_len = VTOFH3(vp)->fh3_length;
   6724 		lm_fh3.n_bytes = (char *)&(VTOFH3(vp)->fh3_u.data);
   6725 
   6726 		/*
   6727 		 * If passed an owner that is too large to fit in an
   6728 		 * nfs_owner it is likely a recursive call from the
   6729 		 * lock manager client and pass it straight through.  If
   6730 		 * it is not a nfs_owner then simply return an error.
   6731 		 */
   6732 		if (shr->s_own_len > sizeof (nfs_owner.lowner)) {
   6733 			if (((struct nfs_owner *)shr->s_owner)->magic !=
   6734 			    NFS_OWNER_MAGIC)
   6735 				return (EINVAL);
   6736 
   6737 			if (error = lm4_shrlock(vp, cmd, shr, flag, &lm_fh3)) {
   6738 				error = set_errno(error);
   6739 			}
   6740 			return (error);
   6741 		}
   6742 		/*
   6743 		 * Remote share reservations owner is a combination of
   6744 		 * a magic number, hostname, and the local owner
   6745 		 */
   6746 		bzero(&nfs_owner, sizeof (nfs_owner));
   6747 		nfs_owner.magic = NFS_OWNER_MAGIC;
   6748 		(void) strncpy(nfs_owner.hname, uts_nodename(),
   6749 		    sizeof (nfs_owner.hname));
   6750 		bcopy(shr->s_owner, nfs_owner.lowner, shr->s_own_len);
   6751 		nshr.s_access = shr->s_access;
   6752 		nshr.s_deny = shr->s_deny;
   6753 		nshr.s_sysid = 0;
   6754 		nshr.s_pid = ttoproc(curthread)->p_pid;
   6755 		nshr.s_own_len = sizeof (nfs_owner);
   6756 		nshr.s_owner = (caddr_t)&nfs_owner;
   6757 
   6758 		if (error = lm4_shrlock(vp, cmd, &nshr, flag, &lm_fh3)) {
   6759 			error = set_errno(error);
   6760 		}
   6761 
   6762 		break;
   6763 
   6764 	case F_HASREMOTELOCKS:
   6765 		/*
   6766 		 * NFS client can't store remote locks itself
   6767 		 */
   6768 		shr->s_access = 0;
   6769 		error = 0;
   6770 		break;
   6771 
   6772 	default:
   6773 		error = EINVAL;
   6774 		break;
   6775 	}
   6776 
   6777 	return (error);
   6778 }
   6779