1/*
2 * CDDL HEADER START
3 *
4 * The contents of this file are subject to the terms of the
5 * Common Development and Distribution License (the "License").
6 * You may not use this file except in compliance with the License.
7 *
8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9 * or http://www.opensolaris.org/os/licensing.
10 * See the License for the specific language governing permissions
11 * and limitations under the License.
12 *
13 * When distributing Covered Code, include this CDDL HEADER in each
14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15 * If applicable, add the following below this CDDL HEADER, with the
16 * fields enclosed by brackets "[]" replaced with your own identifying
17 * information: Portions Copyright [yyyy] [name of copyright owner]
18 *
19 * CDDL HEADER END
20 */
21/*
22 * Copyright 2010 Sun Microsystems, Inc.  All rights reserved.
23 * Use is subject to license terms.
24 */
25
26/*
27 *	Copyright (c) 1983,1984,1985,1986,1987,1988,1989 AT&T.
28 *	All rights reserved.
29 */
30
31#include <sys/param.h>
32#include <sys/types.h>
33#include <sys/systm.h>
34#include <sys/cred.h>
35#include <sys/time.h>
36#include <sys/vnode.h>
37#include <sys/vfs.h>
38#include <sys/vfs_opreg.h>
39#include <sys/file.h>
40#include <sys/filio.h>
41#include <sys/uio.h>
42#include <sys/buf.h>
43#include <sys/mman.h>
44#include <sys/pathname.h>
45#include <sys/dirent.h>
46#include <sys/debug.h>
47#include <sys/vmsystm.h>
48#include <sys/fcntl.h>
49#include <sys/flock.h>
50#include <sys/swap.h>
51#include <sys/errno.h>
52#include <sys/strsubr.h>
53#include <sys/sysmacros.h>
54#include <sys/kmem.h>
55#include <sys/cmn_err.h>
56#include <sys/pathconf.h>
57#include <sys/utsname.h>
58#include <sys/dnlc.h>
59#include <sys/acl.h>
60#include <sys/systeminfo.h>
61#include <sys/atomic.h>
62#include <sys/policy.h>
63#include <sys/sdt.h>
64#include <sys/zone.h>
65
66#include <rpc/types.h>
67#include <rpc/auth.h>
68#include <rpc/clnt.h>
69#include <rpc/rpc_rdma.h>
70
71#include <nfs/nfs.h>
72#include <nfs/nfs_clnt.h>
73#include <nfs/rnode.h>
74#include <nfs/nfs_acl.h>
75#include <nfs/lm.h>
76
77#include <vm/hat.h>
78#include <vm/as.h>
79#include <vm/page.h>
80#include <vm/pvn.h>
81#include <vm/seg.h>
82#include <vm/seg_map.h>
83#include <vm/seg_kpm.h>
84#include <vm/seg_vn.h>
85
86#include <fs/fs_subr.h>
87
88#include <sys/ddi.h>
89
90static int	nfs3_rdwrlbn(vnode_t *, page_t *, u_offset_t, size_t, int,
91			cred_t *);
92static int	nfs3write(vnode_t *, caddr_t, u_offset_t, int, cred_t *,
93			stable_how *);
94static int	nfs3read(vnode_t *, caddr_t, offset_t, int, size_t *, cred_t *);
95static int	nfs3setattr(vnode_t *, struct vattr *, int, cred_t *);
96static int	nfs3_accessx(void *, int, cred_t *);
97static int	nfs3lookup_dnlc(vnode_t *, char *, vnode_t **, cred_t *);
98static int	nfs3lookup_otw(vnode_t *, char *, vnode_t **, cred_t *, int);
99static int	nfs3create(vnode_t *, char *, struct vattr *, enum vcexcl,
100			int, vnode_t **, cred_t *, int);
101static int	nfs3excl_create_settimes(vnode_t *, struct vattr *, cred_t *);
102static int	nfs3mknod(vnode_t *, char *, struct vattr *, enum vcexcl,
103			int, vnode_t **, cred_t *);
104static int	nfs3rename(vnode_t *, char *, vnode_t *, char *, cred_t *,
105			caller_context_t *);
106static int	do_nfs3readdir(vnode_t *, rddir_cache *, cred_t *);
107static void	nfs3readdir(vnode_t *, rddir_cache *, cred_t *);
108static void	nfs3readdirplus(vnode_t *, rddir_cache *, cred_t *);
109static int	nfs3_bio(struct buf *, stable_how *, cred_t *);
110static int	nfs3_getapage(vnode_t *, u_offset_t, size_t, uint_t *,
111			page_t *[], size_t, struct seg *, caddr_t,
112			enum seg_rw, cred_t *);
113static void	nfs3_readahead(vnode_t *, u_offset_t, caddr_t, struct seg *,
114			cred_t *);
115static int	nfs3_sync_putapage(vnode_t *, page_t *, u_offset_t, size_t,
116			int, cred_t *);
117static int	nfs3_sync_pageio(vnode_t *, page_t *, u_offset_t, size_t,
118			int, cred_t *);
119static int	nfs3_commit(vnode_t *, offset3, count3, cred_t *);
120static void	nfs3_set_mod(vnode_t *);
121static void	nfs3_get_commit(vnode_t *);
122static void	nfs3_get_commit_range(vnode_t *, u_offset_t, size_t);
123static int	nfs3_putpage_commit(vnode_t *, offset_t, size_t, cred_t *);
124static int	nfs3_commit_vp(vnode_t *, u_offset_t, size_t,  cred_t *);
125static int	nfs3_sync_commit(vnode_t *, page_t *, offset3, count3,
126			cred_t *);
127static void	nfs3_async_commit(vnode_t *, page_t *, offset3, count3,
128			cred_t *);
129static void	nfs3_delmap_callback(struct as *, void *, uint_t);
130
131/*
132 * Error flags used to pass information about certain special errors
133 * which need to be handled specially.
134 */
135#define	NFS_EOF			-98
136#define	NFS_VERF_MISMATCH	-97
137
138/* ALIGN64 aligns the given buffer and adjust buffer size to 64 bit */
139#define	ALIGN64(x, ptr, sz)						\
140	x = ((uintptr_t)(ptr)) & (sizeof (uint64_t) - 1);		\
141	if (x) {							\
142		x = sizeof (uint64_t) - (x);				\
143		sz -= (x);						\
144		ptr += (x);						\
145	}
146
147/*
148 * These are the vnode ops routines which implement the vnode interface to
149 * the networked file system.  These routines just take their parameters,
150 * make them look networkish by putting the right info into interface structs,
151 * and then calling the appropriate remote routine(s) to do the work.
152 *
153 * Note on directory name lookup cacheing:  If we detect a stale fhandle,
154 * we purge the directory cache relative to that vnode.  This way, the
155 * user won't get burned by the cache repeatedly.  See <nfs/rnode.h> for
156 * more details on rnode locking.
157 */
158
159static int	nfs3_open(vnode_t **, int, cred_t *, caller_context_t *);
160static int	nfs3_close(vnode_t *, int, int, offset_t, cred_t *,
161			caller_context_t *);
162static int	nfs3_read(vnode_t *, struct uio *, int, cred_t *,
163			caller_context_t *);
164static int	nfs3_write(vnode_t *, struct uio *, int, cred_t *,
165			caller_context_t *);
166static int	nfs3_ioctl(vnode_t *, int, intptr_t, int, cred_t *, int *,
167			caller_context_t *);
168static int	nfs3_getattr(vnode_t *, struct vattr *, int, cred_t *,
169			caller_context_t *);
170static int	nfs3_setattr(vnode_t *, struct vattr *, int, cred_t *,
171			caller_context_t *);
172static int	nfs3_access(vnode_t *, int, int, cred_t *, caller_context_t *);
173static int	nfs3_readlink(vnode_t *, struct uio *, cred_t *,
174			caller_context_t *);
175static int	nfs3_fsync(vnode_t *, int, cred_t *, caller_context_t *);
176static void	nfs3_inactive(vnode_t *, cred_t *, caller_context_t *);
177static int	nfs3_lookup(vnode_t *, char *, vnode_t **,
178			struct pathname *, int, vnode_t *, cred_t *,
179			caller_context_t *, int *, pathname_t *);
180static int	nfs3_create(vnode_t *, char *, struct vattr *, enum vcexcl,
181			int, vnode_t **, cred_t *, int, caller_context_t *,
182			vsecattr_t *);
183static int	nfs3_remove(vnode_t *, char *, cred_t *, caller_context_t *,
184			int);
185static int	nfs3_link(vnode_t *, vnode_t *, char *, cred_t *,
186			caller_context_t *, int);
187static int	nfs3_rename(vnode_t *, char *, vnode_t *, char *, cred_t *,
188			caller_context_t *, int);
189static int	nfs3_mkdir(vnode_t *, char *, struct vattr *, vnode_t **,
190			cred_t *, caller_context_t *, int, vsecattr_t *);
191static int	nfs3_rmdir(vnode_t *, char *, vnode_t *, cred_t *,
192			caller_context_t *, int);
193static int	nfs3_symlink(vnode_t *, char *, struct vattr *, char *,
194			cred_t *, caller_context_t *, int);
195static int	nfs3_readdir(vnode_t *, struct uio *, cred_t *, int *,
196			caller_context_t *, int);
197static int	nfs3_fid(vnode_t *, fid_t *, caller_context_t *);
198static int	nfs3_rwlock(vnode_t *, int, caller_context_t *);
199static void	nfs3_rwunlock(vnode_t *, int, caller_context_t *);
200static int	nfs3_seek(vnode_t *, offset_t, offset_t *, caller_context_t *);
201static int	nfs3_getpage(vnode_t *, offset_t, size_t, uint_t *,
202			page_t *[], size_t, struct seg *, caddr_t,
203			enum seg_rw, cred_t *, caller_context_t *);
204static int	nfs3_putpage(vnode_t *, offset_t, size_t, int, cred_t *,
205			caller_context_t *);
206static int	nfs3_map(vnode_t *, offset_t, struct as *, caddr_t *, size_t,
207			uchar_t, uchar_t, uint_t, cred_t *, caller_context_t *);
208static int	nfs3_addmap(vnode_t *, offset_t, struct as *, caddr_t, size_t,
209			uchar_t, uchar_t, uint_t, cred_t *, caller_context_t *);
210static int	nfs3_frlock(vnode_t *, int, struct flock64 *, int, offset_t,
211			struct flk_callback *, cred_t *, caller_context_t *);
212static int	nfs3_space(vnode_t *, int, struct flock64 *, int, offset_t,
213			cred_t *, caller_context_t *);
214static int	nfs3_realvp(vnode_t *, vnode_t **, caller_context_t *);
215static int	nfs3_delmap(vnode_t *, offset_t, struct as *, caddr_t, size_t,
216			uint_t, uint_t, uint_t, cred_t *, caller_context_t *);
217static int	nfs3_pathconf(vnode_t *, int, ulong_t *, cred_t *,
218			caller_context_t *);
219static int	nfs3_pageio(vnode_t *, page_t *, u_offset_t, size_t, int,
220			cred_t *, caller_context_t *);
221static void	nfs3_dispose(vnode_t *, page_t *, int, int, cred_t *,
222			caller_context_t *);
223static int	nfs3_setsecattr(vnode_t *, vsecattr_t *, int, cred_t *,
224			caller_context_t *);
225static int	nfs3_getsecattr(vnode_t *, vsecattr_t *, int, cred_t *,
226			caller_context_t *);
227static int	nfs3_shrlock(vnode_t *, int, struct shrlock *, int, cred_t *,
228			caller_context_t *);
229
230struct vnodeops *nfs3_vnodeops;
231
232const fs_operation_def_t nfs3_vnodeops_template[] = {
233	VOPNAME_OPEN,		{ .vop_open = nfs3_open },
234	VOPNAME_CLOSE,		{ .vop_close = nfs3_close },
235	VOPNAME_READ,		{ .vop_read = nfs3_read },
236	VOPNAME_WRITE,		{ .vop_write = nfs3_write },
237	VOPNAME_IOCTL,		{ .vop_ioctl = nfs3_ioctl },
238	VOPNAME_GETATTR,	{ .vop_getattr = nfs3_getattr },
239	VOPNAME_SETATTR,	{ .vop_setattr = nfs3_setattr },
240	VOPNAME_ACCESS,		{ .vop_access = nfs3_access },
241	VOPNAME_LOOKUP,		{ .vop_lookup = nfs3_lookup },
242	VOPNAME_CREATE,		{ .vop_create = nfs3_create },
243	VOPNAME_REMOVE,		{ .vop_remove = nfs3_remove },
244	VOPNAME_LINK,		{ .vop_link = nfs3_link },
245	VOPNAME_RENAME,		{ .vop_rename = nfs3_rename },
246	VOPNAME_MKDIR,		{ .vop_mkdir = nfs3_mkdir },
247	VOPNAME_RMDIR,		{ .vop_rmdir = nfs3_rmdir },
248	VOPNAME_READDIR,	{ .vop_readdir = nfs3_readdir },
249	VOPNAME_SYMLINK,	{ .vop_symlink = nfs3_symlink },
250	VOPNAME_READLINK,	{ .vop_readlink = nfs3_readlink },
251	VOPNAME_FSYNC,		{ .vop_fsync = nfs3_fsync },
252	VOPNAME_INACTIVE,	{ .vop_inactive = nfs3_inactive },
253	VOPNAME_FID,		{ .vop_fid = nfs3_fid },
254	VOPNAME_RWLOCK,		{ .vop_rwlock = nfs3_rwlock },
255	VOPNAME_RWUNLOCK,	{ .vop_rwunlock = nfs3_rwunlock },
256	VOPNAME_SEEK,		{ .vop_seek = nfs3_seek },
257	VOPNAME_FRLOCK,		{ .vop_frlock = nfs3_frlock },
258	VOPNAME_SPACE,		{ .vop_space = nfs3_space },
259	VOPNAME_REALVP,		{ .vop_realvp = nfs3_realvp },
260	VOPNAME_GETPAGE,	{ .vop_getpage = nfs3_getpage },
261	VOPNAME_PUTPAGE,	{ .vop_putpage = nfs3_putpage },
262	VOPNAME_MAP,		{ .vop_map = nfs3_map },
263	VOPNAME_ADDMAP,		{ .vop_addmap = nfs3_addmap },
264	VOPNAME_DELMAP,		{ .vop_delmap = nfs3_delmap },
265	/* no separate nfs3_dump */
266	VOPNAME_DUMP,		{ .vop_dump = nfs_dump },
267	VOPNAME_PATHCONF,	{ .vop_pathconf = nfs3_pathconf },
268	VOPNAME_PAGEIO,		{ .vop_pageio = nfs3_pageio },
269	VOPNAME_DISPOSE,	{ .vop_dispose = nfs3_dispose },
270	VOPNAME_SETSECATTR,	{ .vop_setsecattr = nfs3_setsecattr },
271	VOPNAME_GETSECATTR,	{ .vop_getsecattr = nfs3_getsecattr },
272	VOPNAME_SHRLOCK,	{ .vop_shrlock = nfs3_shrlock },
273	VOPNAME_VNEVENT, 	{ .vop_vnevent = fs_vnevent_support },
274	NULL,			NULL
275};
276
277/*
278 * XXX:  This is referenced in modstubs.s
279 */
280struct vnodeops *
281nfs3_getvnodeops(void)
282{
283	return (nfs3_vnodeops);
284}
285
286/* ARGSUSED */
287static int
288nfs3_open(vnode_t **vpp, int flag, cred_t *cr, caller_context_t *ct)
289{
290	int error;
291	struct vattr va;
292	rnode_t *rp;
293	vnode_t *vp;
294
295	vp = *vpp;
296	if (nfs_zone() != VTOMI(vp)->mi_zone)
297		return (EIO);
298	rp = VTOR(vp);
299	mutex_enter(&rp->r_statelock);
300	if (rp->r_cred == NULL) {
301		crhold(cr);
302		rp->r_cred = cr;
303	}
304	mutex_exit(&rp->r_statelock);
305
306	/*
307	 * If there is no cached data or if close-to-open
308	 * consistency checking is turned off, we can avoid
309	 * the over the wire getattr.  Otherwise, if the
310	 * file system is mounted readonly, then just verify
311	 * the caches are up to date using the normal mechanism.
312	 * Else, if the file is not mmap'd, then just mark
313	 * the attributes as timed out.  They will be refreshed
314	 * and the caches validated prior to being used.
315	 * Else, the file system is mounted writeable so
316	 * force an over the wire GETATTR in order to ensure
317	 * that all cached data is valid.
318	 */
319	if (vp->v_count > 1 ||
320	    ((vn_has_cached_data(vp) || HAVE_RDDIR_CACHE(rp)) &&
321	    !(VTOMI(vp)->mi_flags & MI_NOCTO))) {
322		if (vn_is_readonly(vp))
323			error = nfs3_validate_caches(vp, cr);
324		else if (rp->r_mapcnt == 0 && vp->v_count == 1) {
325			PURGE_ATTRCACHE(vp);
326			error = 0;
327		} else {
328			va.va_mask = AT_ALL;
329			error = nfs3_getattr_otw(vp, &va, cr);
330		}
331	} else
332		error = 0;
333
334	return (error);
335}
336
337/* ARGSUSED */
338static int
339nfs3_close(vnode_t *vp, int flag, int count, offset_t offset, cred_t *cr,
340		caller_context_t *ct)
341{
342	rnode_t *rp;
343	int error;
344	struct vattr va;
345
346	/*
347	 * zone_enter(2) prevents processes from changing zones with NFS files
348	 * open; if we happen to get here from the wrong zone we can't do
349	 * anything over the wire.
350	 */
351	if (VTOMI(vp)->mi_zone != nfs_zone()) {
352		/*
353		 * We could attempt to clean up locks, except we're sure
354		 * that the current process didn't acquire any locks on
355		 * the file: any attempt to lock a file belong to another zone
356		 * will fail, and one can't lock an NFS file and then change
357		 * zones, as that fails too.
358		 *
359		 * Returning an error here is the sane thing to do.  A
360		 * subsequent call to VN_RELE() which translates to a
361		 * nfs3_inactive() will clean up state: if the zone of the
362		 * vnode's origin is still alive and kicking, an async worker
363		 * thread will handle the request (from the correct zone), and
364		 * everything (minus the commit and final nfs3_getattr_otw()
365		 * call) should be OK. If the zone is going away
366		 * nfs_async_inactive() will throw away cached pages inline.
367		 */
368		return (EIO);
369	}
370
371	/*
372	 * If we are using local locking for this filesystem, then
373	 * release all of the SYSV style record locks.  Otherwise,
374	 * we are doing network locking and we need to release all
375	 * of the network locks.  All of the locks held by this
376	 * process on this file are released no matter what the
377	 * incoming reference count is.
378	 */
379	if (VTOMI(vp)->mi_flags & MI_LLOCK) {
380		cleanlocks(vp, ttoproc(curthread)->p_pid, 0);
381		cleanshares(vp, ttoproc(curthread)->p_pid);
382	} else
383		nfs_lockrelease(vp, flag, offset, cr);
384
385	if (count > 1)
386		return (0);
387
388	/*
389	 * If the file has been `unlinked', then purge the
390	 * DNLC so that this vnode will get reycled quicker
391	 * and the .nfs* file on the server will get removed.
392	 */
393	rp = VTOR(vp);
394	if (rp->r_unldvp != NULL)
395		dnlc_purge_vp(vp);
396
397	/*
398	 * If the file was open for write and there are pages,
399	 * then if the file system was mounted using the "no-close-
400	 *	to-open" semantics, then start an asynchronous flush
401	 *	of the all of the pages in the file.
402	 * else the file system was not mounted using the "no-close-
403	 *	to-open" semantics, then do a synchronous flush and
404	 *	commit of all of the dirty and uncommitted pages.
405	 *
406	 * The asynchronous flush of the pages in the "nocto" path
407	 * mostly just associates a cred pointer with the rnode so
408	 * writes which happen later will have a better chance of
409	 * working.  It also starts the data being written to the
410	 * server, but without unnecessarily delaying the application.
411	 */
412	if ((flag & FWRITE) && vn_has_cached_data(vp)) {
413		if (VTOMI(vp)->mi_flags & MI_NOCTO) {
414			error = nfs3_putpage(vp, (offset_t)0, 0, B_ASYNC,
415			    cr, ct);
416			if (error == EAGAIN)
417				error = 0;
418		} else
419			error = nfs3_putpage_commit(vp, (offset_t)0, 0, cr);
420		if (!error) {
421			mutex_enter(&rp->r_statelock);
422			error = rp->r_error;
423			rp->r_error = 0;
424			mutex_exit(&rp->r_statelock);
425		}
426	} else {
427		mutex_enter(&rp->r_statelock);
428		error = rp->r_error;
429		rp->r_error = 0;
430		mutex_exit(&rp->r_statelock);
431	}
432
433	/*
434	 * If RWRITEATTR is set, then issue an over the wire GETATTR to
435	 * refresh the attribute cache with a set of attributes which
436	 * weren't returned from a WRITE.  This will enable the close-
437	 * to-open processing to work.
438	 */
439	if (rp->r_flags & RWRITEATTR)
440		(void) nfs3_getattr_otw(vp, &va, cr);
441
442	return (error);
443}
444
445/* ARGSUSED */
446static int
447nfs3_directio_read(vnode_t *vp, struct uio *uiop, cred_t *cr)
448{
449	mntinfo_t *mi;
450	READ3args args;
451	READ3uiores res;
452	int tsize;
453	offset_t offset;
454	ssize_t count;
455	int error;
456	int douprintf;
457	failinfo_t fi;
458	char *sv_hostname;
459
460	mi = VTOMI(vp);
461	ASSERT(nfs_zone() == VTOMI(vp)->mi_zone);
462	sv_hostname = VTOR(vp)->r_server->sv_hostname;
463
464	douprintf = 1;
465	args.file = *VTOFH3(vp);
466	fi.vp = vp;
467	fi.fhp = (caddr_t)&args.file;
468	fi.copyproc = nfs3copyfh;
469	fi.lookupproc = nfs3lookup;
470	fi.xattrdirproc = acl_getxattrdir3;
471
472	res.uiop = uiop;
473
474	res.wlist = NULL;
475
476	offset = uiop->uio_loffset;
477	count = uiop->uio_resid;
478
479	do {
480		if (mi->mi_io_kstats) {
481			mutex_enter(&mi->mi_lock);
482			kstat_runq_enter(KSTAT_IO_PTR(mi->mi_io_kstats));
483			mutex_exit(&mi->mi_lock);
484		}
485
486		do {
487			tsize = MIN(mi->mi_tsize, count);
488			args.offset = (offset3)offset;
489			args.count = (count3)tsize;
490			res.size = (uint_t)tsize;
491			args.res_uiop = uiop;
492			args.res_data_val_alt = NULL;
493
494			error = rfs3call(mi, NFSPROC3_READ,
495			    xdr_READ3args, (caddr_t)&args,
496			    xdr_READ3uiores, (caddr_t)&res, cr,
497			    &douprintf, &res.status, 0, &fi);
498		} while (error == ENFS_TRYAGAIN);
499
500		if (mi->mi_io_kstats) {
501			mutex_enter(&mi->mi_lock);
502			kstat_runq_exit(KSTAT_IO_PTR(mi->mi_io_kstats));
503			mutex_exit(&mi->mi_lock);
504		}
505
506		if (error)
507			return (error);
508
509		error = geterrno3(res.status);
510		if (error)
511			return (error);
512
513		if (res.count != res.size) {
514			zcmn_err(getzoneid(), CE_WARN,
515"nfs3_directio_read: server %s returned incorrect amount",
516			    sv_hostname);
517			return (EIO);
518		}
519		count -= res.count;
520		offset += res.count;
521		if (mi->mi_io_kstats) {
522			mutex_enter(&mi->mi_lock);
523			KSTAT_IO_PTR(mi->mi_io_kstats)->reads++;
524			KSTAT_IO_PTR(mi->mi_io_kstats)->nread += res.count;
525			mutex_exit(&mi->mi_lock);
526		}
527		lwp_stat_update(LWP_STAT_INBLK, 1);
528	} while (count && !res.eof);
529
530	return (0);
531}
532
533/* ARGSUSED */
534static int
535nfs3_read(vnode_t *vp, struct uio *uiop, int ioflag, cred_t *cr,
536	caller_context_t *ct)
537{
538	rnode_t *rp;
539	u_offset_t off;
540	offset_t diff;
541	int on;
542	size_t n;
543	caddr_t base;
544	uint_t flags;
545	int error = 0;
546	mntinfo_t *mi;
547
548	rp = VTOR(vp);
549	mi = VTOMI(vp);
550
551	ASSERT(nfs_rw_lock_held(&rp->r_rwlock, RW_READER));
552
553	if (nfs_zone() != mi->mi_zone)
554		return (EIO);
555
556	if (vp->v_type != VREG)
557		return (EISDIR);
558
559	if (uiop->uio_resid == 0)
560		return (0);
561
562	if (uiop->uio_loffset < 0 || uiop->uio_loffset + uiop->uio_resid < 0)
563		return (EINVAL);
564
565	/*
566	 * Bypass VM if caching has been disabled (e.g., locking) or if
567	 * using client-side direct I/O and the file is not mmap'd and
568	 * there are no cached pages.
569	 */
570	if ((vp->v_flag & VNOCACHE) ||
571	    (((rp->r_flags & RDIRECTIO) || (mi->mi_flags & MI_DIRECTIO)) &&
572	    rp->r_mapcnt == 0 && rp->r_inmap == 0 &&
573	    !vn_has_cached_data(vp))) {
574		return (nfs3_directio_read(vp, uiop, cr));
575	}
576
577	do {
578		off = uiop->uio_loffset & MAXBMASK; /* mapping offset */
579		on = uiop->uio_loffset & MAXBOFFSET; /* Relative offset */
580		n = MIN(MAXBSIZE - on, uiop->uio_resid);
581
582		error = nfs3_validate_caches(vp, cr);
583		if (error)
584			break;
585
586		mutex_enter(&rp->r_statelock);
587		while (rp->r_flags & RINCACHEPURGE) {
588			if (!cv_wait_sig(&rp->r_cv, &rp->r_statelock)) {
589				mutex_exit(&rp->r_statelock);
590				return (EINTR);
591			}
592		}
593		diff = rp->r_size - uiop->uio_loffset;
594		mutex_exit(&rp->r_statelock);
595		if (diff <= 0)
596			break;
597		if (diff < n)
598			n = (size_t)diff;
599
600		if (vpm_enable) {
601			/*
602			 * Copy data.
603			 */
604			error = vpm_data_copy(vp, off + on, n, uiop,
605			    1, NULL, 0, S_READ);
606		} else {
607			base = segmap_getmapflt(segkmap, vp, off + on, n, 1,
608			    S_READ);
609
610			error = uiomove(base + on, n, UIO_READ, uiop);
611		}
612
613		if (!error) {
614			/*
615			 * If read a whole block or read to eof,
616			 * won't need this buffer again soon.
617			 */
618			mutex_enter(&rp->r_statelock);
619			if (n + on == MAXBSIZE ||
620			    uiop->uio_loffset == rp->r_size)
621				flags = SM_DONTNEED;
622			else
623				flags = 0;
624			mutex_exit(&rp->r_statelock);
625			if (vpm_enable) {
626				error = vpm_sync_pages(vp, off, n, flags);
627			} else {
628				error = segmap_release(segkmap, base, flags);
629			}
630		} else {
631			if (vpm_enable) {
632				(void) vpm_sync_pages(vp, off, n, 0);
633			} else {
634				(void) segmap_release(segkmap, base, 0);
635			}
636		}
637	} while (!error && uiop->uio_resid > 0);
638
639	return (error);
640}
641
642/* ARGSUSED */
643static int
644nfs3_write(vnode_t *vp, struct uio *uiop, int ioflag, cred_t *cr,
645	caller_context_t *ct)
646{
647	rlim64_t limit = uiop->uio_llimit;
648	rnode_t *rp;
649	u_offset_t off;
650	caddr_t base;
651	uint_t flags;
652	int remainder;
653	size_t n;
654	int on;
655	int error;
656	int resid;
657	offset_t offset;
658	mntinfo_t *mi;
659	uint_t bsize;
660
661	rp = VTOR(vp);
662
663	if (vp->v_type != VREG)
664		return (EISDIR);
665
666	mi = VTOMI(vp);
667	if (nfs_zone() != mi->mi_zone)
668		return (EIO);
669	if (uiop->uio_resid == 0)
670		return (0);
671
672	if (ioflag & FAPPEND) {
673		struct vattr va;
674
675		/*
676		 * Must serialize if appending.
677		 */
678		if (nfs_rw_lock_held(&rp->r_rwlock, RW_READER)) {
679			nfs_rw_exit(&rp->r_rwlock);
680			if (nfs_rw_enter_sig(&rp->r_rwlock, RW_WRITER,
681			    INTR(vp)))
682				return (EINTR);
683		}
684
685		va.va_mask = AT_SIZE;
686		error = nfs3getattr(vp, &va, cr);
687		if (error)
688			return (error);
689		uiop->uio_loffset = va.va_size;
690	}
691
692	offset = uiop->uio_loffset + uiop->uio_resid;
693
694	if (uiop->uio_loffset < 0 || offset < 0)
695		return (EINVAL);
696
697	if (limit == RLIM64_INFINITY || limit > MAXOFFSET_T)
698		limit = MAXOFFSET_T;
699
700	/*
701	 * Check to make sure that the process will not exceed
702	 * its limit on file size.  It is okay to write up to
703	 * the limit, but not beyond.  Thus, the write which
704	 * reaches the limit will be short and the next write
705	 * will return an error.
706	 */
707	remainder = 0;
708	if (offset > limit) {
709		remainder = offset - limit;
710		uiop->uio_resid = limit - uiop->uio_loffset;
711		if (uiop->uio_resid <= 0) {
712			proc_t *p = ttoproc(curthread);
713
714			uiop->uio_resid += remainder;
715			mutex_enter(&p->p_lock);
716			(void) rctl_action(rctlproc_legacy[RLIMIT_FSIZE],
717			    p->p_rctls, p, RCA_UNSAFE_SIGINFO);
718			mutex_exit(&p->p_lock);
719			return (EFBIG);
720		}
721	}
722
723	if (nfs_rw_enter_sig(&rp->r_lkserlock, RW_READER, INTR(vp)))
724		return (EINTR);
725
726	/*
727	 * Bypass VM if caching has been disabled (e.g., locking) or if
728	 * using client-side direct I/O and the file is not mmap'd and
729	 * there are no cached pages.
730	 */
731	if ((vp->v_flag & VNOCACHE) ||
732	    (((rp->r_flags & RDIRECTIO) || (mi->mi_flags & MI_DIRECTIO)) &&
733	    rp->r_mapcnt == 0 && rp->r_inmap == 0 &&
734	    !vn_has_cached_data(vp))) {
735		size_t bufsize;
736		int count;
737		u_offset_t org_offset;
738		stable_how stab_comm;
739
740nfs3_fwrite:
741		if (rp->r_flags & RSTALE) {
742			resid = uiop->uio_resid;
743			offset = uiop->uio_loffset;
744			error = rp->r_error;
745			/*
746			 * A close may have cleared r_error, if so,
747			 * propagate ESTALE error return properly
748			 */
749			if (error == 0)
750				error = ESTALE;
751			goto bottom;
752		}
753		bufsize = MIN(uiop->uio_resid, mi->mi_stsize);
754		base = kmem_alloc(bufsize, KM_SLEEP);
755		do {
756			if (ioflag & FDSYNC)
757				stab_comm = DATA_SYNC;
758			else
759				stab_comm = FILE_SYNC;
760			resid = uiop->uio_resid;
761			offset = uiop->uio_loffset;
762			count = MIN(uiop->uio_resid, bufsize);
763			org_offset = uiop->uio_loffset;
764			error = uiomove(base, count, UIO_WRITE, uiop);
765			if (!error) {
766				error = nfs3write(vp, base, org_offset,
767				    count, cr, &stab_comm);
768			}
769		} while (!error && uiop->uio_resid > 0);
770		kmem_free(base, bufsize);
771		goto bottom;
772	}
773
774
775	bsize = vp->v_vfsp->vfs_bsize;
776
777	do {
778		off = uiop->uio_loffset & MAXBMASK; /* mapping offset */
779		on = uiop->uio_loffset & MAXBOFFSET; /* Relative offset */
780		n = MIN(MAXBSIZE - on, uiop->uio_resid);
781
782		resid = uiop->uio_resid;
783		offset = uiop->uio_loffset;
784
785		if (rp->r_flags & RSTALE) {
786			error = rp->r_error;
787			/*
788			 * A close may have cleared r_error, if so,
789			 * propagate ESTALE error return properly
790			 */
791			if (error == 0)
792				error = ESTALE;
793			break;
794		}
795
796		/*
797		 * Don't create dirty pages faster than they
798		 * can be cleaned so that the system doesn't
799		 * get imbalanced.  If the async queue is
800		 * maxed out, then wait for it to drain before
801		 * creating more dirty pages.  Also, wait for
802		 * any threads doing pagewalks in the vop_getattr
803		 * entry points so that they don't block for
804		 * long periods.
805		 */
806		mutex_enter(&rp->r_statelock);
807		while ((mi->mi_max_threads != 0 &&
808		    rp->r_awcount > 2 * mi->mi_max_threads) ||
809		    rp->r_gcount > 0) {
810			if (INTR(vp)) {
811				klwp_t *lwp = ttolwp(curthread);
812
813				if (lwp != NULL)
814					lwp->lwp_nostop++;
815				if (!cv_wait_sig(&rp->r_cv, &rp->r_statelock)) {
816					mutex_exit(&rp->r_statelock);
817					if (lwp != NULL)
818						lwp->lwp_nostop--;
819					error = EINTR;
820					goto bottom;
821				}
822				if (lwp != NULL)
823					lwp->lwp_nostop--;
824			} else
825				cv_wait(&rp->r_cv, &rp->r_statelock);
826		}
827		mutex_exit(&rp->r_statelock);
828
829		/*
830		 * Touch the page and fault it in if it is not in core
831		 * before segmap_getmapflt or vpm_data_copy can lock it.
832		 * This is to avoid the deadlock if the buffer is mapped
833		 * to the same file through mmap which we want to write.
834		 */
835		uio_prefaultpages((long)n, uiop);
836
837		if (vpm_enable) {
838			/*
839			 * It will use kpm mappings, so no need to
840			 * pass an address.
841			 */
842			error = writerp(rp, NULL, n, uiop, 0);
843		} else  {
844			if (segmap_kpm) {
845				int pon = uiop->uio_loffset & PAGEOFFSET;
846				size_t pn = MIN(PAGESIZE - pon,
847				    uiop->uio_resid);
848				int pagecreate;
849
850				mutex_enter(&rp->r_statelock);
851				pagecreate = (pon == 0) && (pn == PAGESIZE ||
852				    uiop->uio_loffset + pn >= rp->r_size);
853				mutex_exit(&rp->r_statelock);
854
855				base = segmap_getmapflt(segkmap, vp, off + on,
856				    pn, !pagecreate, S_WRITE);
857
858				error = writerp(rp, base + pon, n, uiop,
859				    pagecreate);
860
861			} else {
862				base = segmap_getmapflt(segkmap, vp, off + on,
863				    n, 0, S_READ);
864				error = writerp(rp, base + on, n, uiop, 0);
865			}
866		}
867
868		if (!error) {
869			if (mi->mi_flags & MI_NOAC)
870				flags = SM_WRITE;
871			else if ((uiop->uio_loffset % bsize) == 0 ||
872			    IS_SWAPVP(vp)) {
873				/*
874				 * Have written a whole block.
875				 * Start an asynchronous write
876				 * and mark the buffer to
877				 * indicate that it won't be
878				 * needed again soon.
879				 */
880				flags = SM_WRITE | SM_ASYNC | SM_DONTNEED;
881			} else
882				flags = 0;
883			if ((ioflag & (FSYNC|FDSYNC)) ||
884			    (rp->r_flags & ROUTOFSPACE)) {
885				flags &= ~SM_ASYNC;
886				flags |= SM_WRITE;
887			}
888			if (vpm_enable) {
889				error = vpm_sync_pages(vp, off, n, flags);
890			} else {
891				error = segmap_release(segkmap, base, flags);
892			}
893		} else {
894			if (vpm_enable) {
895				(void) vpm_sync_pages(vp, off, n, 0);
896			} else {
897				(void) segmap_release(segkmap, base, 0);
898			}
899			/*
900			 * In the event that we got an access error while
901			 * faulting in a page for a write-only file just
902			 * force a write.
903			 */
904			if (error == EACCES)
905				goto nfs3_fwrite;
906		}
907	} while (!error && uiop->uio_resid > 0);
908
909bottom:
910	if (error) {
911		uiop->uio_resid = resid + remainder;
912		uiop->uio_loffset = offset;
913	} else
914		uiop->uio_resid += remainder;
915
916	nfs_rw_exit(&rp->r_lkserlock);
917
918	return (error);
919}
920
921/*
922 * Flags are composed of {B_ASYNC, B_INVAL, B_FREE, B_DONTNEED}
923 */
924static int
925nfs3_rdwrlbn(vnode_t *vp, page_t *pp, u_offset_t off, size_t len,
926	int flags, cred_t *cr)
927{
928	struct buf *bp;
929	int error;
930	page_t *savepp;
931	uchar_t fsdata;
932	stable_how stab_comm;
933
934	ASSERT(nfs_zone() == VTOMI(vp)->mi_zone);
935	bp = pageio_setup(pp, len, vp, flags);
936	ASSERT(bp != NULL);
937
938	/*
939	 * pageio_setup should have set b_addr to 0.  This
940	 * is correct since we want to do I/O on a page
941	 * boundary.  bp_mapin will use this addr to calculate
942	 * an offset, and then set b_addr to the kernel virtual
943	 * address it allocated for us.
944	 */
945	ASSERT(bp->b_un.b_addr == 0);
946
947	bp->b_edev = 0;
948	bp->b_dev = 0;
949	bp->b_lblkno = lbtodb(off);
950	bp->b_file = vp;
951	bp->b_offset = (offset_t)off;
952	bp_mapin(bp);
953
954	/*
955	 * Calculate the desired level of stability to write data
956	 * on the server and then mark all of the pages to reflect
957	 * this.
958	 */
959	if ((flags & (B_WRITE|B_ASYNC)) == (B_WRITE|B_ASYNC) &&
960	    freemem > desfree) {
961		stab_comm = UNSTABLE;
962		fsdata = C_DELAYCOMMIT;
963	} else {
964		stab_comm = FILE_SYNC;
965		fsdata = C_NOCOMMIT;
966	}
967
968	savepp = pp;
969	do {
970		pp->p_fsdata = fsdata;
971	} while ((pp = pp->p_next) != savepp);
972
973	error = nfs3_bio(bp, &stab_comm, cr);
974
975	bp_mapout(bp);
976	pageio_done(bp);
977
978	/*
979	 * If the server wrote pages in a more stable fashion than
980	 * was requested, then clear all of the marks in the pages
981	 * indicating that COMMIT operations were required.
982	 */
983	if (stab_comm != UNSTABLE && fsdata == C_DELAYCOMMIT) {
984		do {
985			pp->p_fsdata = C_NOCOMMIT;
986		} while ((pp = pp->p_next) != savepp);
987	}
988
989	return (error);
990}
991
992/*
993 * Write to file.  Writes to remote server in largest size
994 * chunks that the server can handle.  Write is synchronous.
995 */
996static int
997nfs3write(vnode_t *vp, caddr_t base, u_offset_t offset, int count, cred_t *cr,
998	stable_how *stab_comm)
999{
1000	mntinfo_t *mi;
1001	WRITE3args args;
1002	WRITE3res res;
1003	int error;
1004	int tsize;
1005	rnode_t *rp;
1006	int douprintf;
1007
1008	rp = VTOR(vp);
1009	mi = VTOMI(vp);
1010
1011	ASSERT(nfs_zone() == mi->mi_zone);
1012
1013	args.file = *VTOFH3(vp);
1014	args.stable = *stab_comm;
1015
1016	*stab_comm = FILE_SYNC;
1017
1018	douprintf = 1;
1019
1020	do {
1021		if ((vp->v_flag & VNOCACHE) ||
1022		    (rp->r_flags & RDIRECTIO) ||
1023		    (mi->mi_flags & MI_DIRECTIO))
1024			tsize = MIN(mi->mi_stsize, count);
1025		else
1026			tsize = MIN(mi->mi_curwrite, count);
1027		args.offset = (offset3)offset;
1028		args.count = (count3)tsize;
1029		args.data.data_len = (uint_t)tsize;
1030		args.data.data_val = base;
1031
1032		if (mi->mi_io_kstats) {
1033			mutex_enter(&mi->mi_lock);
1034			kstat_runq_enter(KSTAT_IO_PTR(mi->mi_io_kstats));
1035			mutex_exit(&mi->mi_lock);
1036		}
1037		args.mblk = NULL;
1038		do {
1039			error = rfs3call(mi, NFSPROC3_WRITE,
1040			    xdr_WRITE3args, (caddr_t)&args,
1041			    xdr_WRITE3res, (caddr_t)&res, cr,
1042			    &douprintf, &res.status, 0, NULL);
1043		} while (error == ENFS_TRYAGAIN);
1044		if (mi->mi_io_kstats) {
1045			mutex_enter(&mi->mi_lock);
1046			kstat_runq_exit(KSTAT_IO_PTR(mi->mi_io_kstats));
1047			mutex_exit(&mi->mi_lock);
1048		}
1049
1050		if (error)
1051			return (error);
1052		error = geterrno3(res.status);
1053		if (!error) {
1054			if (res.resok.count > args.count) {
1055				zcmn_err(getzoneid(), CE_WARN,
1056				    "nfs3write: server %s wrote %u, "
1057				    "requested was %u",
1058				    rp->r_server->sv_hostname,
1059				    res.resok.count, args.count);
1060				return (EIO);
1061			}
1062			if (res.resok.committed == UNSTABLE) {
1063				*stab_comm = UNSTABLE;
1064				if (args.stable == DATA_SYNC ||
1065				    args.stable == FILE_SYNC) {
1066					zcmn_err(getzoneid(), CE_WARN,
1067			"nfs3write: server %s did not commit to stable storage",
1068					    rp->r_server->sv_hostname);
1069					return (EIO);
1070				}
1071			}
1072			tsize = (int)res.resok.count;
1073			count -= tsize;
1074			base += tsize;
1075			offset += tsize;
1076			if (mi->mi_io_kstats) {
1077				mutex_enter(&mi->mi_lock);
1078				KSTAT_IO_PTR(mi->mi_io_kstats)->writes++;
1079				KSTAT_IO_PTR(mi->mi_io_kstats)->nwritten +=
1080				    tsize;
1081				mutex_exit(&mi->mi_lock);
1082			}
1083			lwp_stat_update(LWP_STAT_OUBLK, 1);
1084			mutex_enter(&rp->r_statelock);
1085			if (rp->r_flags & RHAVEVERF) {
1086				if (rp->r_verf != res.resok.verf) {
1087					nfs3_set_mod(vp);
1088					rp->r_verf = res.resok.verf;
1089					/*
1090					 * If the data was written UNSTABLE,
1091					 * then might as well stop because
1092					 * the whole block will have to get
1093					 * rewritten anyway.
1094					 */
1095					if (*stab_comm == UNSTABLE) {
1096						mutex_exit(&rp->r_statelock);
1097						break;
1098					}
1099				}
1100			} else {
1101				rp->r_verf = res.resok.verf;
1102				rp->r_flags |= RHAVEVERF;
1103			}
1104			/*
1105			 * Mark the attribute cache as timed out and
1106			 * set RWRITEATTR to indicate that the file
1107			 * was modified with a WRITE operation and
1108			 * that the attributes can not be trusted.
1109			 */
1110			PURGE_ATTRCACHE_LOCKED(rp);
1111			rp->r_flags |= RWRITEATTR;
1112			mutex_exit(&rp->r_statelock);
1113		}
1114	} while (!error && count);
1115
1116	return (error);
1117}
1118
1119/*
1120 * Read from a file.  Reads data in largest chunks our interface can handle.
1121 */
1122static int
1123nfs3read(vnode_t *vp, caddr_t base, offset_t offset, int count,
1124	size_t *residp, cred_t *cr)
1125{
1126	mntinfo_t *mi;
1127	READ3args args;
1128	READ3vres res;
1129	int tsize;
1130	int error;
1131	int douprintf;
1132	failinfo_t fi;
1133	rnode_t *rp;
1134	struct vattr va;
1135	hrtime_t t;
1136
1137	rp = VTOR(vp);
1138	mi = VTOMI(vp);
1139	ASSERT(nfs_zone() == mi->mi_zone);
1140	douprintf = 1;
1141
1142	args.file = *VTOFH3(vp);
1143	fi.vp = vp;
1144	fi.fhp = (caddr_t)&args.file;
1145	fi.copyproc = nfs3copyfh;
1146	fi.lookupproc = nfs3lookup;
1147	fi.xattrdirproc = acl_getxattrdir3;
1148
1149	res.pov.fres.vp = vp;
1150	res.pov.fres.vap = &va;
1151
1152	res.wlist = NULL;
1153	*residp = count;
1154	do {
1155		if (mi->mi_io_kstats) {
1156			mutex_enter(&mi->mi_lock);
1157			kstat_runq_enter(KSTAT_IO_PTR(mi->mi_io_kstats));
1158			mutex_exit(&mi->mi_lock);
1159		}
1160
1161		do {
1162			if ((vp->v_flag & VNOCACHE) ||
1163			    (rp->r_flags & RDIRECTIO) ||
1164			    (mi->mi_flags & MI_DIRECTIO))
1165				tsize = MIN(mi->mi_tsize, count);
1166			else
1167				tsize = MIN(mi->mi_curread, count);
1168			res.data.data_val = base;
1169			res.data.data_len = tsize;
1170			args.offset = (offset3)offset;
1171			args.count = (count3)tsize;
1172			args.res_uiop = NULL;
1173			args.res_data_val_alt = base;
1174
1175			t = gethrtime();
1176			error = rfs3call(mi, NFSPROC3_READ,
1177			    xdr_READ3args, (caddr_t)&args,
1178			    xdr_READ3vres, (caddr_t)&res, cr,
1179			    &douprintf, &res.status, 0, &fi);
1180		} while (error == ENFS_TRYAGAIN);
1181
1182		if (mi->mi_io_kstats) {
1183			mutex_enter(&mi->mi_lock);
1184			kstat_runq_exit(KSTAT_IO_PTR(mi->mi_io_kstats));
1185			mutex_exit(&mi->mi_lock);
1186		}
1187
1188		if (error)
1189			return (error);
1190
1191		error = geterrno3(res.status);
1192		if (error)
1193			return (error);
1194
1195		if (res.count != res.data.data_len) {
1196			zcmn_err(getzoneid(), CE_WARN,
1197			    "nfs3read: server %s returned incorrect amount",
1198			    rp->r_server->sv_hostname);
1199			return (EIO);
1200		}
1201
1202		count -= res.count;
1203		*residp = count;
1204		base += res.count;
1205		offset += res.count;
1206		if (mi->mi_io_kstats) {
1207			mutex_enter(&mi->mi_lock);
1208			KSTAT_IO_PTR(mi->mi_io_kstats)->reads++;
1209			KSTAT_IO_PTR(mi->mi_io_kstats)->nread += res.count;
1210			mutex_exit(&mi->mi_lock);
1211		}
1212		lwp_stat_update(LWP_STAT_INBLK, 1);
1213	} while (count && !res.eof);
1214
1215	if (res.pov.attributes) {
1216		mutex_enter(&rp->r_statelock);
1217		if (!CACHE_VALID(rp, va.va_mtime, va.va_size)) {
1218			mutex_exit(&rp->r_statelock);
1219			PURGE_ATTRCACHE(vp);
1220		} else {
1221			if (rp->r_mtime <= t)
1222				nfs_attrcache_va(vp, &va);
1223			mutex_exit(&rp->r_statelock);
1224		}
1225	}
1226
1227	return (0);
1228}
1229
1230/* ARGSUSED */
1231static int
1232nfs3_ioctl(vnode_t *vp, int cmd, intptr_t arg, int flag, cred_t *cr, int *rvalp,
1233	caller_context_t *ct)
1234{
1235
1236	if (nfs_zone() != VTOMI(vp)->mi_zone)
1237		return (EIO);
1238	switch (cmd) {
1239		case _FIODIRECTIO:
1240			return (nfs_directio(vp, (int)arg, cr));
1241		default:
1242			return (ENOTTY);
1243	}
1244}
1245
1246/* ARGSUSED */
1247static int
1248nfs3_getattr(vnode_t *vp, struct vattr *vap, int flags, cred_t *cr,
1249	caller_context_t *ct)
1250{
1251	int error;
1252	rnode_t *rp;
1253
1254	if (nfs_zone() != VTOMI(vp)->mi_zone)
1255		return (EIO);
1256	/*
1257	 * If it has been specified that the return value will
1258	 * just be used as a hint, and we are only being asked
1259	 * for size, fsid or rdevid, then return the client's
1260	 * notion of these values without checking to make sure
1261	 * that the attribute cache is up to date.
1262	 * The whole point is to avoid an over the wire GETATTR
1263	 * call.
1264	 */
1265	rp = VTOR(vp);
1266	if (flags & ATTR_HINT) {
1267		if (vap->va_mask ==
1268		    (vap->va_mask & (AT_SIZE | AT_FSID | AT_RDEV))) {
1269			mutex_enter(&rp->r_statelock);
1270			if (vap->va_mask | AT_SIZE)
1271				vap->va_size = rp->r_size;
1272			if (vap->va_mask | AT_FSID)
1273				vap->va_fsid = rp->r_attr.va_fsid;
1274			if (vap->va_mask | AT_RDEV)
1275				vap->va_rdev = rp->r_attr.va_rdev;
1276			mutex_exit(&rp->r_statelock);
1277			return (0);
1278		}
1279	}
1280
1281	/*
1282	 * Only need to flush pages if asking for the mtime
1283	 * and if there any dirty pages or any outstanding
1284	 * asynchronous (write) requests for this file.
1285	 */
1286	if (vap->va_mask & AT_MTIME) {
1287		if (vn_has_cached_data(vp) &&
1288		    ((rp->r_flags & RDIRTY) || rp->r_awcount > 0)) {
1289			mutex_enter(&rp->r_statelock);
1290			rp->r_gcount++;
1291			mutex_exit(&rp->r_statelock);
1292			error = nfs3_putpage(vp, (offset_t)0, 0, 0, cr, ct);
1293			mutex_enter(&rp->r_statelock);
1294			if (error && (error == ENOSPC || error == EDQUOT)) {
1295				if (!rp->r_error)
1296					rp->r_error = error;
1297			}
1298			if (--rp->r_gcount == 0)
1299				cv_broadcast(&rp->r_cv);
1300			mutex_exit(&rp->r_statelock);
1301		}
1302	}
1303
1304	return (nfs3getattr(vp, vap, cr));
1305}
1306
1307/*ARGSUSED4*/
1308static int
1309nfs3_setattr(vnode_t *vp, struct vattr *vap, int flags, cred_t *cr,
1310		caller_context_t *ct)
1311{
1312	int error;
1313	struct vattr va;
1314
1315	if (vap->va_mask & AT_NOSET)
1316		return (EINVAL);
1317	if (nfs_zone() != VTOMI(vp)->mi_zone)
1318		return (EIO);
1319
1320	va.va_mask = AT_UID | AT_MODE;
1321	error = nfs3getattr(vp, &va, cr);
1322	if (error)
1323		return (error);
1324
1325	error = secpolicy_vnode_setattr(cr, vp, vap, &va, flags, nfs3_accessx,
1326	    vp);
1327	if (error)
1328		return (error);
1329
1330	return (nfs3setattr(vp, vap, flags, cr));
1331}
1332
1333static int
1334nfs3setattr(vnode_t *vp, struct vattr *vap, int flags, cred_t *cr)
1335{
1336	int error;
1337	uint_t mask;
1338	SETATTR3args args;
1339	SETATTR3res res;
1340	int douprintf;
1341	rnode_t *rp;
1342	struct vattr va;
1343	mode_t omode;
1344	vsecattr_t *vsp;
1345	hrtime_t t;
1346
1347	ASSERT(nfs_zone() == VTOMI(vp)->mi_zone);
1348	mask = vap->va_mask;
1349
1350	rp = VTOR(vp);
1351
1352	/*
1353	 * Only need to flush pages if there are any pages and
1354	 * if the file is marked as dirty in some fashion.  The
1355	 * file must be flushed so that we can accurately
1356	 * determine the size of the file and the cached data
1357	 * after the SETATTR returns.  A file is considered to
1358	 * be dirty if it is either marked with RDIRTY, has
1359	 * outstanding i/o's active, or is mmap'd.  In this
1360	 * last case, we can't tell whether there are dirty
1361	 * pages, so we flush just to be sure.
1362	 */
1363	if (vn_has_cached_data(vp) &&
1364	    ((rp->r_flags & RDIRTY) ||
1365	    rp->r_count > 0 ||
1366	    rp->r_mapcnt > 0)) {
1367		ASSERT(vp->v_type != VCHR);
1368		error = nfs3_putpage(vp, (offset_t)0, 0, 0, cr, NULL);
1369		if (error && (error == ENOSPC || error == EDQUOT)) {
1370			mutex_enter(&rp->r_statelock);
1371			if (!rp->r_error)
1372				rp->r_error = error;
1373			mutex_exit(&rp->r_statelock);
1374		}
1375	}
1376
1377	args.object = *RTOFH3(rp);
1378	/*
1379	 * If the intent is for the server to set the times,
1380	 * there is no point in have the mask indicating set mtime or
1381	 * atime, because the vap values may be junk, and so result
1382	 * in an overflow error. Remove these flags from the vap mask
1383	 * before calling in this case, and restore them afterwards.
1384	 */
1385	if ((mask & (AT_ATIME | AT_MTIME)) && !(flags & ATTR_UTIME)) {
1386		/* Use server times, so don't set the args time fields */
1387		vap->va_mask &= ~(AT_ATIME | AT_MTIME);
1388		error = vattr_to_sattr3(vap, &args.new_attributes);
1389		vap->va_mask |= (mask & (AT_ATIME | AT_MTIME));
1390		if (mask & AT_ATIME) {
1391			args.new_attributes.atime.set_it = SET_TO_SERVER_TIME;
1392		}
1393		if (mask & AT_MTIME) {
1394			args.new_attributes.mtime.set_it = SET_TO_SERVER_TIME;
1395		}
1396	} else {
1397		/* Either do not set times or use the client specified times */
1398		error = vattr_to_sattr3(vap, &args.new_attributes);
1399	}
1400
1401	if (error) {
1402		/* req time field(s) overflow - return immediately */
1403		return (error);
1404	}
1405
1406	va.va_mask = AT_MODE | AT_CTIME;
1407	error = nfs3getattr(vp, &va, cr);
1408	if (error)
1409		return (error);
1410	omode = va.va_mode;
1411
1412tryagain:
1413	if (mask & AT_SIZE) {
1414		args.guard.check = TRUE;
1415		args.guard.obj_ctime.seconds = va.va_ctime.tv_sec;
1416		args.guard.obj_ctime.nseconds = va.va_ctime.tv_nsec;
1417	} else
1418		args.guard.check = FALSE;
1419
1420	douprintf = 1;
1421
1422	t = gethrtime();
1423
1424	error = rfs3call(VTOMI(vp), NFSPROC3_SETATTR,
1425	    xdr_SETATTR3args, (caddr_t)&args,
1426	    xdr_SETATTR3res, (caddr_t)&res, cr,
1427	    &douprintf, &res.status, 0, NULL);
1428
1429	/*
1430	 * Purge the access cache and ACL cache if changing either the
1431	 * owner of the file, the group owner, or the mode.  These may
1432	 * change the access permissions of the file, so purge old
1433	 * information and start over again.
1434	 */
1435	if (mask & (AT_UID | AT_GID | AT_MODE)) {
1436		(void) nfs_access_purge_rp(rp);
1437		if (rp->r_secattr != NULL) {
1438			mutex_enter(&rp->r_statelock);
1439			vsp = rp->r_secattr;
1440			rp->r_secattr = NULL;
1441			mutex_exit(&rp->r_statelock);
1442			if (vsp != NULL)
1443				nfs_acl_free(vsp);
1444		}
1445	}
1446
1447	if (error) {
1448		PURGE_ATTRCACHE(vp);
1449		return (error);
1450	}
1451
1452	error = geterrno3(res.status);
1453	if (!error) {
1454		/*
1455		 * If changing the size of the file, invalidate
1456		 * any local cached data which is no longer part
1457		 * of the file.  We also possibly invalidate the
1458		 * last page in the file.  We could use
1459		 * pvn_vpzero(), but this would mark the page as
1460		 * modified and require it to be written back to
1461		 * the server for no particularly good reason.
1462		 * This way, if we access it, then we bring it
1463		 * back in.  A read should be cheaper than a
1464		 * write.
1465		 */
1466		if (mask & AT_SIZE) {
1467			nfs_invalidate_pages(vp,
1468			    (vap->va_size & PAGEMASK), cr);
1469		}
1470		nfs3_cache_wcc_data(vp, &res.resok.obj_wcc, t, cr);
1471		/*
1472		 * Some servers will change the mode to clear the setuid
1473		 * and setgid bits when changing the uid or gid.  The
1474		 * client needs to compensate appropriately.
1475		 */
1476		if (mask & (AT_UID | AT_GID)) {
1477			int terror;
1478
1479			va.va_mask = AT_MODE;
1480			terror = nfs3getattr(vp, &va, cr);
1481			if (!terror &&
1482			    (((mask & AT_MODE) && va.va_mode != vap->va_mode) ||
1483			    (!(mask & AT_MODE) && va.va_mode != omode))) {
1484				va.va_mask = AT_MODE;
1485				if (mask & AT_MODE)
1486					va.va_mode = vap->va_mode;
1487				else
1488					va.va_mode = omode;
1489				(void) nfs3setattr(vp, &va, 0, cr);
1490			}
1491		}
1492	} else {
1493		nfs3_cache_wcc_data(vp, &res.resfail.obj_wcc, t, cr);
1494		/*
1495		 * If we got back a "not synchronized" error, then
1496		 * we need to retry with a new guard value.  The
1497		 * guard value used is the change time.  If the
1498		 * server returned post_op_attr, then we can just
1499		 * retry because we have the latest attributes.
1500		 * Otherwise, we issue a GETATTR to get the latest
1501		 * attributes and then retry.  If we couldn't get
1502		 * the attributes this way either, then we give
1503		 * up because we can't complete the operation as
1504		 * required.
1505		 */
1506		if (res.status == NFS3ERR_NOT_SYNC) {
1507			va.va_mask = AT_CTIME;
1508			if (nfs3getattr(vp, &va, cr) == 0)
1509				goto tryagain;
1510		}
1511		PURGE_STALE_FH(error, vp, cr);
1512	}
1513
1514	return (error);
1515}
1516
1517static int
1518nfs3_accessx(void *vp, int mode, cred_t *cr)
1519{
1520	ASSERT(nfs_zone() == VTOMI((vnode_t *)vp)->mi_zone);
1521	return (nfs3_access(vp, mode, 0, cr, NULL));
1522}
1523
1524/* ARGSUSED */
1525static int
1526nfs3_access(vnode_t *vp, int mode, int flags, cred_t *cr, caller_context_t *ct)
1527{
1528	int error;
1529	ACCESS3args args;
1530	ACCESS3res res;
1531	int douprintf;
1532	uint32 acc;
1533	rnode_t *rp;
1534	cred_t *cred, *ncr, *ncrfree = NULL;
1535	failinfo_t fi;
1536	nfs_access_type_t cacc;
1537	hrtime_t t;
1538
1539	acc = 0;
1540	if (nfs_zone() != VTOMI(vp)->mi_zone)
1541		return (EIO);
1542	if (mode & VREAD)
1543		acc |= ACCESS3_READ;
1544	if (mode & VWRITE) {
1545		if (vn_is_readonly(vp) && !IS_DEVVP(vp))
1546			return (EROFS);
1547		if (vp->v_type == VDIR)
1548			acc |= ACCESS3_DELETE;
1549		acc |= ACCESS3_MODIFY | ACCESS3_EXTEND;
1550	}
1551	if (mode & VEXEC) {
1552		if (vp->v_type == VDIR)
1553			acc |= ACCESS3_LOOKUP;
1554		else
1555			acc |= ACCESS3_EXECUTE;
1556	}
1557
1558	rp = VTOR(vp);
1559	args.object = *VTOFH3(vp);
1560	if (vp->v_type == VDIR) {
1561		args.access = ACCESS3_READ | ACCESS3_DELETE | ACCESS3_MODIFY |
1562		    ACCESS3_EXTEND | ACCESS3_LOOKUP;
1563	} else {
1564		args.access = ACCESS3_READ | ACCESS3_MODIFY | ACCESS3_EXTEND |
1565		    ACCESS3_EXECUTE;
1566	}
1567	fi.vp = vp;
1568	fi.fhp = (caddr_t)&args.object;
1569	fi.copyproc = nfs3copyfh;
1570	fi.lookupproc = nfs3lookup;
1571	fi.xattrdirproc = acl_getxattrdir3;
1572
1573	cred = cr;
1574	/*
1575	 * ncr and ncrfree both initially
1576	 * point to the memory area returned
1577	 * by crnetadjust();
1578	 * ncrfree not NULL when exiting means
1579	 * that we need to release it
1580	 */
1581	ncr = crnetadjust(cred);
1582	ncrfree = ncr;
1583tryagain:
1584	if (rp->r_acache != NULL) {
1585		cacc = nfs_access_check(rp, acc, cred);
1586		if (cacc == NFS_ACCESS_ALLOWED) {
1587			if (ncrfree != NULL)
1588				crfree(ncrfree);
1589			return (0);
1590		}
1591		if (cacc == NFS_ACCESS_DENIED) {
1592			/*
1593			 * If the cred can be adjusted, try again
1594			 * with the new cred.
1595			 */
1596			if (ncr != NULL) {
1597				cred = ncr;
1598				ncr = NULL;
1599				goto tryagain;
1600			}
1601			if (ncrfree != NULL)
1602				crfree(ncrfree);
1603			return (EACCES);
1604		}
1605	}
1606
1607	douprintf = 1;
1608
1609	t = gethrtime();
1610
1611	error = rfs3call(VTOMI(vp), NFSPROC3_ACCESS,
1612	    xdr_ACCESS3args, (caddr_t)&args,
1613	    xdr_ACCESS3res, (caddr_t)&res, cred,
1614	    &douprintf, &res.status, 0, &fi);
1615
1616	if (error) {
1617		if (ncrfree != NULL)
1618			crfree(ncrfree);
1619		return (error);
1620	}
1621
1622	error = geterrno3(res.status);
1623	if (!error) {
1624		nfs3_cache_post_op_attr(vp, &res.resok.obj_attributes, t, cr);
1625		nfs_access_cache(rp, args.access, res.resok.access, cred);
1626		/*
1627		 * we just cached results with cred; if cred is the
1628		 * adjusted credentials from crnetadjust, we do not want
1629		 * to release them before exiting: hence setting ncrfree
1630		 * to NULL
1631		 */
1632		if (cred != cr)
1633			ncrfree = NULL;
1634		if ((acc & res.resok.access) != acc) {
1635			/*
1636			 * If the cred can be adjusted, try again
1637			 * with the new cred.
1638			 */
1639			if (ncr != NULL) {
1640				cred = ncr;
1641				ncr = NULL;
1642				goto tryagain;
1643			}
1644			error = EACCES;
1645		}
1646	} else {
1647		nfs3_cache_post_op_attr(vp, &res.resfail.obj_attributes, t, cr);
1648		PURGE_STALE_FH(error, vp, cr);
1649	}
1650
1651	if (ncrfree != NULL)
1652		crfree(ncrfree);
1653
1654	return (error);
1655}
1656
1657static int nfs3_do_symlink_cache = 1;
1658
1659/* ARGSUSED */
1660static int
1661nfs3_readlink(vnode_t *vp, struct uio *uiop, cred_t *cr, caller_context_t *ct)
1662{
1663	int error;
1664	READLINK3args args;
1665	READLINK3res res;
1666	nfspath3 resdata_backup;
1667	rnode_t *rp;
1668	int douprintf;
1669	int len;
1670	failinfo_t fi;
1671	hrtime_t t;
1672
1673	/*
1674	 * Can't readlink anything other than a symbolic link.
1675	 */
1676	if (vp->v_type != VLNK)
1677		return (EINVAL);
1678	if (nfs_zone() != VTOMI(vp)->mi_zone)
1679		return (EIO);
1680
1681	rp = VTOR(vp);
1682	if (nfs3_do_symlink_cache && rp->r_symlink.contents != NULL) {
1683		error = nfs3_validate_caches(vp, cr);
1684		if (error)
1685			return (error);
1686		mutex_enter(&rp->r_statelock);
1687		if (rp->r_symlink.contents != NULL) {
1688			error = uiomove(rp->r_symlink.contents,
1689			    rp->r_symlink.len, UIO_READ, uiop);
1690			mutex_exit(&rp->r_statelock);
1691			return (error);
1692		}
1693		mutex_exit(&rp->r_statelock);
1694	}
1695
1696	args.symlink = *VTOFH3(vp);
1697	fi.vp = vp;
1698	fi.fhp = (caddr_t)&args.symlink;
1699	fi.copyproc = nfs3copyfh;
1700	fi.lookupproc = nfs3lookup;
1701	fi.xattrdirproc = acl_getxattrdir3;
1702
1703	res.resok.data = kmem_alloc(MAXPATHLEN, KM_SLEEP);
1704
1705	resdata_backup = res.resok.data;
1706
1707	douprintf = 1;
1708
1709	t = gethrtime();
1710
1711	error = rfs3call(VTOMI(vp), NFSPROC3_READLINK,
1712	    xdr_READLINK3args, (caddr_t)&args,
1713	    xdr_READLINK3res, (caddr_t)&res, cr,
1714	    &douprintf, &res.status, 0, &fi);
1715
1716	if (res.resok.data == nfs3nametoolong)
1717		error = EINVAL;
1718
1719	if (error) {
1720		kmem_free(resdata_backup, MAXPATHLEN);
1721		return (error);
1722	}
1723
1724	error = geterrno3(res.status);
1725	if (!error) {
1726		nfs3_cache_post_op_attr(vp, &res.resok.symlink_attributes, t,
1727		    cr);
1728		len = strlen(res.resok.data);
1729		error = uiomove(res.resok.data, len, UIO_READ, uiop);
1730		if (nfs3_do_symlink_cache && rp->r_symlink.contents == NULL) {
1731			mutex_enter(&rp->r_statelock);
1732				if (rp->r_symlink.contents == NULL) {
1733				rp->r_symlink.contents = res.resok.data;
1734				rp->r_symlink.len = len;
1735				rp->r_symlink.size = MAXPATHLEN;
1736				mutex_exit(&rp->r_statelock);
1737			} else {
1738				mutex_exit(&rp->r_statelock);
1739
1740				kmem_free((void *)res.resok.data, MAXPATHLEN);
1741			}
1742		} else {
1743			kmem_free((void *)res.resok.data, MAXPATHLEN);
1744		}
1745	} else {
1746		nfs3_cache_post_op_attr(vp,
1747		    &res.resfail.symlink_attributes, t, cr);
1748		PURGE_STALE_FH(error, vp, cr);
1749
1750		kmem_free((void *)res.resok.data, MAXPATHLEN);
1751
1752	}
1753
1754	/*
1755	 * The over the wire error for attempting to readlink something
1756	 * other than a symbolic link is ENXIO.  However, we need to
1757	 * return EINVAL instead of ENXIO, so we map it here.
1758	 */
1759	return (error == ENXIO ? EINVAL : error);
1760}
1761
1762/*
1763 * Flush local dirty pages to stable storage on the server.
1764 *
1765 * If FNODSYNC is specified, then there is nothing to do because
1766 * metadata changes are not cached on the client before being
1767 * sent to the server.
1768 */
1769/* ARGSUSED */
1770static int
1771nfs3_fsync(vnode_t *vp, int syncflag, cred_t *cr, caller_context_t *ct)
1772{
1773	int error;
1774
1775	if ((syncflag & FNODSYNC) || IS_SWAPVP(vp))
1776		return (0);
1777	if (nfs_zone() != VTOMI(vp)->mi_zone)
1778		return (EIO);
1779
1780	error = nfs3_putpage_commit(vp, (offset_t)0, 0, cr);
1781	if (!error)
1782		error = VTOR(vp)->r_error;
1783	return (error);
1784}
1785
1786/*
1787 * Weirdness: if the file was removed or the target of a rename
1788 * operation while it was open, it got renamed instead.  Here we
1789 * remove the renamed file.
1790 */
1791/* ARGSUSED */
1792static void
1793nfs3_inactive(vnode_t *vp, cred_t *cr, caller_context_t *ct)
1794{
1795	rnode_t *rp;
1796
1797	ASSERT(vp != DNLC_NO_VNODE);
1798
1799	/*
1800	 * If this is coming from the wrong zone, we let someone in the right
1801	 * zone take care of it asynchronously.  We can get here due to
1802	 * VN_RELE() being called from pageout() or fsflush().  This call may
1803	 * potentially turn into an expensive no-op if, for instance, v_count
1804	 * gets incremented in the meantime, but it's still correct.
1805	 */
1806	if (nfs_zone() != VTOMI(vp)->mi_zone) {
1807		nfs_async_inactive(vp, cr, nfs3_inactive);
1808		return;
1809	}
1810
1811	rp = VTOR(vp);
1812redo:
1813	if (rp->r_unldvp != NULL) {
1814		/*
1815		 * Save the vnode pointer for the directory where the
1816		 * unlinked-open file got renamed, then set it to NULL
1817		 * to prevent another thread from getting here before
1818		 * we're done with the remove.  While we have the
1819		 * statelock, make local copies of the pertinent rnode
1820		 * fields.  If we weren't to do this in an atomic way, the
1821		 * the unl* fields could become inconsistent with respect
1822		 * to each other due to a race condition between this
1823		 * code and nfs_remove().  See bug report 1034328.
1824		 */
1825		mutex_enter(&rp->r_statelock);
1826		if (rp->r_unldvp != NULL) {
1827			vnode_t *unldvp;
1828			char *unlname;
1829			cred_t *unlcred;
1830			REMOVE3args args;
1831			REMOVE3res res;
1832			int douprintf;
1833			int error;
1834			hrtime_t t;
1835
1836			unldvp = rp->r_unldvp;
1837			rp->r_unldvp = NULL;
1838			unlname = rp->r_unlname;
1839			rp->r_unlname = NULL;
1840			unlcred = rp->r_unlcred;
1841			rp->r_unlcred = NULL;
1842			mutex_exit(&rp->r_statelock);
1843
1844			/*
1845			 * If there are any dirty pages left, then flush
1846			 * them.  This is unfortunate because they just
1847			 * may get thrown away during the remove operation,
1848			 * but we have to do this for correctness.
1849			 */
1850			if (vn_has_cached_data(vp) &&
1851			    ((rp->r_flags & RDIRTY) || rp->r_count > 0)) {
1852				ASSERT(vp->v_type != VCHR);
1853				error = nfs3_putpage(vp, (offset_t)0, 0, 0,
1854				    cr, ct);
1855				if (error) {
1856					mutex_enter(&rp->r_statelock);
1857					if (!rp->r_error)
1858						rp->r_error = error;
1859					mutex_exit(&rp->r_statelock);
1860				}
1861			}
1862
1863			/*
1864			 * Do the remove operation on the renamed file
1865			 */
1866			setdiropargs3(&args.object, unlname, unldvp);
1867
1868			douprintf = 1;
1869
1870			t = gethrtime();
1871
1872			error = rfs3call(VTOMI(unldvp), NFSPROC3_REMOVE,
1873			    xdr_diropargs3, (caddr_t)&args,
1874			    xdr_REMOVE3res, (caddr_t)&res, unlcred,
1875			    &douprintf, &res.status, 0, NULL);
1876
1877			if (error) {
1878				PURGE_ATTRCACHE(unldvp);
1879			} else {
1880				error = geterrno3(res.status);
1881				if (!error) {
1882					nfs3_cache_wcc_data(unldvp,
1883					    &res.resok.dir_wcc, t, cr);
1884					if (HAVE_RDDIR_CACHE(VTOR(unldvp)))
1885						nfs_purge_rddir_cache(unldvp);
1886				} else {
1887					nfs3_cache_wcc_data(unldvp,
1888					    &res.resfail.dir_wcc, t, cr);
1889					PURGE_STALE_FH(error, unldvp, cr);
1890				}
1891			}
1892
1893			/*
1894			 * Release stuff held for the remove
1895			 */
1896			VN_RELE(unldvp);
1897			kmem_free(unlname, MAXNAMELEN);
1898			crfree(unlcred);
1899			goto redo;
1900		}
1901		mutex_exit(&rp->r_statelock);
1902	}
1903
1904	rp_addfree(rp, cr);
1905}
1906
1907/*
1908 * Remote file system operations having to do with directory manipulation.
1909 */
1910
1911/* ARGSUSED */
1912static int
1913nfs3_lookup(vnode_t *dvp, char *nm, vnode_t **vpp, struct pathname *pnp,
1914	int flags, vnode_t *rdir, cred_t *cr, caller_context_t *ct,
1915	int *direntflags, pathname_t *realpnp)
1916{
1917	int error;
1918	vnode_t *vp;
1919	vnode_t *avp = NULL;
1920	rnode_t *drp;
1921
1922	if (nfs_zone() != VTOMI(dvp)->mi_zone)
1923		return (EPERM);
1924
1925	drp = VTOR(dvp);
1926
1927	/*
1928	 * Are we looking up extended attributes?  If so, "dvp" is
1929	 * the file or directory for which we want attributes, and
1930	 * we need a lookup of the hidden attribute directory
1931	 * before we lookup the rest of the path.
1932	 */
1933	if (flags & LOOKUP_XATTR) {
1934		bool_t cflag = ((flags & CREATE_XATTR_DIR) != 0);
1935		mntinfo_t *mi;
1936
1937		mi = VTOMI(dvp);
1938		if (!(mi->mi_flags & MI_EXTATTR))
1939			return (EINVAL);
1940
1941		if (nfs_rw_enter_sig(&drp->r_rwlock, RW_READER, INTR(dvp)))
1942			return (EINTR);
1943
1944		(void) nfs3lookup_dnlc(dvp, XATTR_DIR_NAME, &avp, cr);
1945		if (avp == NULL)
1946			error = acl_getxattrdir3(dvp, &avp, cflag, cr, 0);
1947		else
1948			error = 0;
1949
1950		nfs_rw_exit(&drp->r_rwlock);
1951
1952		if (error) {
1953			if (mi->mi_flags & MI_EXTATTR)
1954				return (error);
1955			return (EINVAL);
1956		}
1957		dvp = avp;
1958		drp = VTOR(dvp);
1959	}
1960
1961	if (nfs_rw_enter_sig(&drp->r_rwlock, RW_READER, INTR(dvp))) {
1962		error = EINTR;
1963		goto out;
1964	}
1965
1966	error = nfs3lookup(dvp, nm, vpp, pnp, flags, rdir, cr, 0);
1967
1968	nfs_rw_exit(&drp->r_rwlock);
1969
1970	/*
1971	 * If vnode is a device, create special vnode.
1972	 */
1973	if (!error && IS_DEVVP(*vpp)) {
1974		vp = *vpp;
1975		*vpp = specvp(vp, vp->v_rdev, vp->v_type, cr);
1976		VN_RELE(vp);
1977	}
1978
1979out:
1980	if (avp != NULL)
1981		VN_RELE(avp);
1982
1983	return (error);
1984}
1985
1986static int nfs3_lookup_neg_cache = 1;
1987
1988#ifdef DEBUG
1989static int nfs3_lookup_dnlc_hits = 0;
1990static int nfs3_lookup_dnlc_misses = 0;
1991static int nfs3_lookup_dnlc_neg_hits = 0;
1992static int nfs3_lookup_dnlc_disappears = 0;
1993static int nfs3_lookup_dnlc_lookups = 0;
1994#endif
1995
1996/* ARGSUSED */
1997int
1998nfs3lookup(vnode_t *dvp, char *nm, vnode_t **vpp, struct pathname *pnp,
1999	int flags, vnode_t *rdir, cred_t *cr, int rfscall_flags)
2000{
2001	int error;
2002	rnode_t *drp;
2003
2004	ASSERT(nfs_zone() == VTOMI(dvp)->mi_zone);
2005	/*
2006	 * If lookup is for "", just return dvp.  Don't need
2007	 * to send it over the wire, look it up in the dnlc,
2008	 * or perform any access checks.
2009	 */
2010	if (*nm == '\0') {
2011		VN_HOLD(dvp);
2012		*vpp = dvp;
2013		return (0);
2014	}
2015
2016	/*
2017	 * Can't do lookups in non-directories.
2018	 */
2019	if (dvp->v_type != VDIR)
2020		return (ENOTDIR);
2021
2022	/*
2023	 * If we're called with RFSCALL_SOFT, it's important that
2024	 * the only rfscall is one we make directly; if we permit
2025	 * an access call because we're looking up "." or validating
2026	 * a dnlc hit, we'll deadlock because that rfscall will not
2027	 * have the RFSCALL_SOFT set.
2028	 */
2029	if (rfscall_flags & RFSCALL_SOFT)
2030		goto callit;
2031
2032	/*
2033	 * If lookup is for ".", just return dvp.  Don't need
2034	 * to send it over the wire or look it up in the dnlc,
2035	 * just need to check access.
2036	 */
2037	if (strcmp(nm, ".") == 0) {
2038		error = nfs3_access(dvp, VEXEC, 0, cr, NULL);
2039		if (error)
2040			return (error);
2041		VN_HOLD(dvp);
2042		*vpp = dvp;
2043		return (0);
2044	}
2045
2046	drp = VTOR(dvp);
2047	if (!(drp->r_flags & RLOOKUP)) {
2048		mutex_enter(&drp->r_statelock);
2049		drp->r_flags |= RLOOKUP;
2050		mutex_exit(&drp->r_statelock);
2051	}
2052
2053	/*
2054	 * Lookup this name in the DNLC.  If there was a valid entry,
2055	 * then return the results of the lookup.
2056	 */
2057	error = nfs3lookup_dnlc(dvp, nm, vpp, cr);
2058	if (error || *vpp != NULL)
2059		return (error);
2060
2061callit:
2062	error = nfs3lookup_otw(dvp, nm, vpp, cr, rfscall_flags);
2063
2064	return (error);
2065}
2066
2067static int
2068nfs3lookup_dnlc(vnode_t *dvp, char *nm, vnode_t **vpp, cred_t *cr)
2069{
2070	int error;
2071	vnode_t *vp;
2072
2073	ASSERT(*nm != '\0');
2074	ASSERT(nfs_zone() == VTOMI(dvp)->mi_zone);
2075	/*
2076	 * Lookup this name in the DNLC.  If successful, then validate
2077	 * the caches and then recheck the DNLC.  The DNLC is rechecked
2078	 * just in case this entry got invalidated during the call
2079	 * to nfs3_validate_caches.
2080	 *
2081	 * An assumption is being made that it is safe to say that a
2082	 * file exists which may not on the server.  Any operations to
2083	 * the server will fail with ESTALE.
2084	 */
2085#ifdef DEBUG
2086	nfs3_lookup_dnlc_lookups++;
2087#endif
2088	vp = dnlc_lookup(dvp, nm);
2089	if (vp != NULL) {
2090		VN_RELE(vp);
2091		if (vp == DNLC_NO_VNODE && !vn_is_readonly(dvp)) {
2092			PURGE_ATTRCACHE(dvp);
2093		}
2094		error = nfs3_validate_caches(dvp, cr);
2095		if (error)
2096			return (error);
2097		vp = dnlc_lookup(dvp, nm);
2098		if (vp != NULL) {
2099			error = nfs3_access(dvp, VEXEC, 0, cr, NULL);
2100			if (error) {
2101				VN_RELE(vp);
2102				return (error);
2103			}
2104			if (vp == DNLC_NO_VNODE) {
2105				VN_RELE(vp);
2106#ifdef DEBUG
2107				nfs3_lookup_dnlc_neg_hits++;
2108#endif
2109				return (ENOENT);
2110			}
2111			*vpp = vp;
2112#ifdef DEBUG
2113			nfs3_lookup_dnlc_hits++;
2114#endif
2115			return (0);
2116		}
2117#ifdef DEBUG
2118		nfs3_lookup_dnlc_disappears++;
2119#endif
2120	}
2121#ifdef DEBUG
2122	else
2123		nfs3_lookup_dnlc_misses++;
2124#endif
2125
2126	*vpp = NULL;
2127
2128	return (0);
2129}
2130
2131static int
2132nfs3lookup_otw(vnode_t *dvp, char *nm, vnode_t **vpp, cred_t *cr,
2133	int rfscall_flags)
2134{
2135	int error;
2136	LOOKUP3args args;
2137	LOOKUP3vres res;
2138	int douprintf;
2139	struct vattr vattr;
2140	struct vattr dvattr;
2141	vnode_t *vp;
2142	failinfo_t fi;
2143	hrtime_t t;
2144
2145	ASSERT(*nm != '\0');
2146	ASSERT(dvp->v_type == VDIR);
2147	ASSERT(nfs_zone() == VTOMI(dvp)->mi_zone);
2148
2149	setdiropargs3(&args.what, nm, dvp);
2150
2151	fi.vp = dvp;
2152	fi.fhp = (caddr_t)&args.what.dir;
2153	fi.copyproc = nfs3copyfh;
2154	fi.lookupproc = nfs3lookup;
2155	fi.xattrdirproc = acl_getxattrdir3;
2156	res.obj_attributes.fres.vp = dvp;
2157	res.obj_attributes.fres.vap = &vattr;
2158	res.dir_attributes.fres.vp = dvp;
2159	res.dir_attributes.fres.vap = &dvattr;
2160
2161	douprintf = 1;
2162
2163	t = gethrtime();
2164
2165	error = rfs3call(VTOMI(dvp), NFSPROC3_LOOKUP,
2166	    xdr_diropargs3, (caddr_t)&args,
2167	    xdr_LOOKUP3vres, (caddr_t)&res, cr,
2168	    &douprintf, &res.status, rfscall_flags, &fi);
2169
2170	if (error)
2171		return (error);
2172
2173	nfs3_cache_post_op_vattr(dvp, &res.dir_attributes, t, cr);
2174
2175	error = geterrno3(res.status);
2176	if (error) {
2177		PURGE_STALE_FH(error, dvp, cr);
2178		if (error == ENOENT && nfs3_lookup_neg_cache)
2179			dnlc_enter(dvp, nm, DNLC_NO_VNODE);
2180		return (error);
2181	}
2182
2183	if (res.obj_attributes.attributes) {
2184		vp = makenfs3node_va(&res.object, res.obj_attributes.fres.vap,
2185		    dvp->v_vfsp, t, cr, VTOR(dvp)->r_path, nm);
2186	} else {
2187		vp = makenfs3node_va(&res.object, NULL,
2188		    dvp->v_vfsp, t, cr, VTOR(dvp)->r_path, nm);
2189		if (vp->v_type == VNON) {
2190			vattr.va_mask = AT_TYPE;
2191			error = nfs3getattr(vp, &vattr, cr);
2192			if (error) {
2193				VN_RELE(vp);
2194				return (error);
2195			}
2196			vp->v_type = vattr.va_type;
2197		}
2198	}
2199
2200	if (!(rfscall_flags & RFSCALL_SOFT))
2201		dnlc_update(dvp, nm, vp);
2202
2203	*vpp = vp;
2204
2205	return (error);
2206}
2207
2208#ifdef DEBUG
2209static int nfs3_create_misses = 0;
2210#endif
2211
2212/* ARGSUSED */
2213static int
2214nfs3_create(vnode_t *dvp, char *nm, struct vattr *va, enum vcexcl exclusive,
2215	int mode, vnode_t **vpp, cred_t *cr, int lfaware, caller_context_t *ct,
2216	vsecattr_t *vsecp)
2217{
2218	int error;
2219	vnode_t *vp;
2220	rnode_t *rp;
2221	struct vattr vattr;
2222	rnode_t *drp;
2223	vnode_t *tempvp;
2224
2225	drp = VTOR(dvp);
2226	if (nfs_zone() != VTOMI(dvp)->mi_zone)
2227		return (EPERM);
2228	if (nfs_rw_enter_sig(&drp->r_rwlock, RW_WRITER, INTR(dvp)))
2229		return (EINTR);
2230
2231top:
2232	/*
2233	 * We make a copy of the attributes because the caller does not
2234	 * expect us to change what va points to.
2235	 */
2236	vattr = *va;
2237
2238	/*
2239	 * If the pathname is "", just use dvp.  Don't need
2240	 * to send it over the wire, look it up in the dnlc,
2241	 * or perform any access checks.
2242	 */
2243	if (*nm == '\0') {
2244		error = 0;
2245		VN_HOLD(dvp);
2246		vp = dvp;
2247	/*
2248	 * If the pathname is ".", just use dvp.  Don't need
2249	 * to send it over the wire or look it up in the dnlc,
2250	 * just need to check access.
2251	 */
2252	} else if (strcmp(nm, ".") == 0) {
2253		error = nfs3_access(dvp, VEXEC, 0, cr, ct);
2254		if (error) {
2255			nfs_rw_exit(&drp->r_rwlock);
2256			return (error);
2257		}
2258		VN_HOLD(dvp);
2259		vp = dvp;
2260	/*
2261	 * We need to go over the wire, just to be sure whether the
2262	 * file exists or not.  Using the DNLC can be dangerous in
2263	 * this case when making a decision regarding existence.
2264	 */
2265	} else {
2266		error = nfs3lookup_otw(dvp, nm, &vp, cr, 0);
2267	}
2268	if (!error) {
2269		if (exclusive == EXCL)
2270			error = EEXIST;
2271		else if (vp->v_type == VDIR && (mode & VWRITE))
2272			error = EISDIR;
2273		else {
2274			/*
2275			 * If vnode is a device, create special vnode.
2276			 */
2277			if (IS_DEVVP(vp)) {
2278				tempvp = vp;
2279				vp = specvp(vp, vp->v_rdev, vp->v_type, cr);
2280				VN_RELE(tempvp);
2281			}
2282			if (!(error = VOP_ACCESS(vp, mode, 0, cr, ct))) {
2283				if ((vattr.va_mask & AT_SIZE) &&
2284				    vp->v_type == VREG) {
2285					rp = VTOR(vp);
2286					/*
2287					 * Check here for large file handled
2288					 * by LF-unaware process (as
2289					 * ufs_create() does)
2290					 */
2291					if (!(lfaware & FOFFMAX)) {
2292						mutex_enter(&rp->r_statelock);
2293						if (rp->r_size > MAXOFF32_T)
2294							error = EOVERFLOW;
2295						mutex_exit(&rp->r_statelock);
2296					}
2297					if (!error) {
2298						vattr.va_mask = AT_SIZE;
2299						error = nfs3setattr(vp,
2300						    &vattr, 0, cr);
2301					}
2302				}
2303			}
2304		}
2305		nfs_rw_exit(&drp->r_rwlock);
2306		if (error) {
2307			VN_RELE(vp);
2308		} else {
2309			/*
2310			 * existing file got truncated, notify.
2311			 */
2312			vnevent_create(vp, ct);
2313			*vpp = vp;
2314		}
2315		return (error);
2316	}
2317
2318	dnlc_remove(dvp, nm);
2319
2320	/*
2321	 * Decide what the group-id of the created file should be.
2322	 * Set it in attribute list as advisory...
2323	 */
2324	error = setdirgid(dvp, &vattr.va_gid, cr);
2325	if (error) {
2326		nfs_rw_exit(&drp->r_rwlock);
2327		return (error);
2328	}
2329	vattr.va_mask |= AT_GID;
2330
2331	ASSERT(vattr.va_mask & AT_TYPE);
2332	if (vattr.va_type == VREG) {
2333		ASSERT(vattr.va_mask & AT_MODE);
2334		if (MANDMODE(vattr.va_mode)) {
2335			nfs_rw_exit(&drp->r_rwlock);
2336			return (EACCES);
2337		}
2338		error = nfs3create(dvp, nm, &vattr, exclusive, mode, vpp, cr,
2339		    lfaware);
2340		/*
2341		 * If this is not an exclusive create, then the CREATE
2342		 * request will be made with the GUARDED mode set.  This
2343		 * means that the server will return EEXIST if the file
2344		 * exists.  The file could exist because of a retransmitted
2345		 * request.  In this case, we recover by starting over and
2346		 * checking to see whether the file exists.  This second
2347		 * time through it should and a CREATE request will not be
2348		 * sent.
2349		 *
2350		 * This handles the problem of a dangling CREATE request
2351		 * which contains attributes which indicate that the file
2352		 * should be truncated.  This retransmitted request could
2353		 * possibly truncate valid data in the file if not caught
2354		 * by the duplicate request mechanism on the server or if
2355		 * not caught by other means.  The scenario is:
2356		 *
2357		 * Client transmits CREATE request with size = 0
2358		 * Client times out, retransmits request.
2359		 * Response to the first request arrives from the server
2360		 *  and the client proceeds on.
2361		 * Client writes data to the file.
2362		 * The server now processes retransmitted CREATE request
2363		 *  and truncates file.
2364		 *
2365		 * The use of the GUARDED CREATE request prevents this from
2366		 * happening because the retransmitted CREATE would fail
2367		 * with EEXIST and would not truncate the file.
2368		 */
2369		if (error == EEXIST && exclusive == NONEXCL) {
2370#ifdef DEBUG
2371			nfs3_create_misses++;
2372#endif
2373			goto top;
2374		}
2375		nfs_rw_exit(&drp->r_rwlock);
2376		return (error);
2377	}
2378	error = nfs3mknod(dvp, nm, &vattr, exclusive, mode, vpp, cr);
2379	nfs_rw_exit(&drp->r_rwlock);
2380	return (error);
2381}
2382
2383/* ARGSUSED */
2384static int
2385nfs3create(vnode_t *dvp, char *nm, struct vattr *va, enum vcexcl exclusive,
2386	int mode, vnode_t **vpp, cred_t *cr, int lfaware)
2387{
2388	int error;
2389	CREATE3args args;
2390	CREATE3res res;
2391	int douprintf;
2392	vnode_t *vp;
2393	struct vattr vattr;
2394	nfstime3 *verfp;
2395	rnode_t *rp;
2396	timestruc_t now;
2397	hrtime_t t;
2398
2399	ASSERT(nfs_zone() == VTOMI(dvp)->mi_zone);
2400	setdiropargs3(&args.where, nm, dvp);
2401	if (exclusive == EXCL) {
2402		args.how.mode = EXCLUSIVE;
2403		/*
2404		 * Construct the create verifier.  This verifier needs
2405		 * to be unique between different clients.  It also needs
2406		 * to vary for each exclusive create request generated
2407		 * from the client to the server.
2408		 *
2409		 * The first attempt is made to use the hostid and a
2410		 * unique number on the client.  If the hostid has not
2411		 * been set, the high resolution time that the exclusive
2412		 * create request is being made is used.  This will work
2413		 * unless two different clients, both with the hostid
2414		 * not set, attempt an exclusive create request on the
2415		 * same file, at exactly the same clock time.  The
2416		 * chances of this happening seem small enough to be
2417		 * reasonable.
2418		 */
2419		verfp = (nfstime3 *)&args.how.createhow3_u.verf;
2420		verfp->seconds = zone_get_hostid(NULL);
2421		if (verfp->seconds != 0)
2422			verfp->nseconds = newnum();
2423		else {
2424			gethrestime(&now);
2425			verfp->seconds = now.tv_sec;
2426			verfp->nseconds = now.tv_nsec;
2427		}
2428		/*
2429		 * Since the server will use this value for the mtime,
2430		 * make sure that it can't overflow. Zero out the MSB.
2431		 * The actual value does not matter here, only its uniqeness.
2432		 */
2433		verfp->seconds %= INT32_MAX;
2434	} else {
2435		/*
2436		 * Issue the non-exclusive create in guarded mode.  This
2437		 * may result in some false EEXIST responses for
2438		 * retransmitted requests, but these will be handled at
2439		 * a higher level.  By using GUARDED, duplicate requests
2440		 * to do file truncation and possible access problems
2441		 * can be avoided.
2442		 */
2443		args.how.mode = GUARDED;
2444		error = vattr_to_sattr3(va,
2445		    &args.how.createhow3_u.obj_attributes);
2446		if (error) {
2447			/* req time field(s) overflow - return immediately */
2448			return (error);
2449		}
2450	}
2451
2452	douprintf = 1;
2453
2454	t = gethrtime();
2455
2456	error = rfs3call(VTOMI(dvp), NFSPROC3_CREATE,
2457	    xdr_CREATE3args, (caddr_t)&args,
2458	    xdr_CREATE3res, (caddr_t)&res, cr,
2459	    &douprintf, &res.status, 0, NULL);
2460
2461	if (error) {
2462		PURGE_ATTRCACHE(dvp);
2463		return (error);
2464	}
2465
2466	error = geterrno3(res.status);
2467	if (!error) {
2468		nfs3_cache_wcc_data(dvp, &res.resok.dir_wcc, t, cr);
2469		if (HAVE_RDDIR_CACHE(VTOR(dvp)))
2470			nfs_purge_rddir_cache(dvp);
2471
2472		/*
2473		 * On exclusive create the times need to be explicitly
2474		 * set to clear any potential verifier that may be stored
2475		 * in one of these fields (see comment below).  This
2476		 * is done here to cover the case where no post op attrs
2477		 * were returned or a 'invalid' time was returned in
2478		 * the attributes.
2479		 */
2480		if (exclusive == EXCL)
2481			va->va_mask |= (AT_MTIME | AT_ATIME);
2482
2483		if (!res.resok.obj.handle_follows) {
2484			error = nfs3lookup(dvp, nm, &vp, NULL, 0, NULL, cr, 0);
2485			if (error)
2486				return (error);
2487		} else {
2488			if (res.resok.obj_attributes.attributes) {
2489				vp = makenfs3node(&res.resok.obj.handle,
2490				    &res.resok.obj_attributes.attr,
2491				    dvp->v_vfsp, t, cr, NULL, NULL);
2492			} else {
2493				vp = makenfs3node(&res.resok.obj.handle, NULL,
2494				    dvp->v_vfsp, t, cr, NULL, NULL);
2495
2496				/*
2497				 * On an exclusive create, it is possible
2498				 * that attributes were returned but those
2499				 * postop attributes failed to decode
2500				 * properly.  If this is the case,
2501				 * then most likely the atime or mtime
2502				 * were invalid for our client; this
2503				 * is caused by the server storing the
2504				 * create verifier in one of the time
2505				 * fields(most likely mtime).
2506				 * So... we are going to setattr just the
2507				 * atime/mtime to clear things up.
2508				 */
2509				if (exclusive == EXCL) {
2510					if (error =
2511					    nfs3excl_create_settimes(vp,
2512					    va, cr)) {
2513						/*
2514						 * Setting the times failed.
2515						 * Remove the file and return
2516						 * the error.
2517						 */
2518						VN_RELE(vp);
2519						(void) nfs3_remove(dvp,
2520						    nm, cr, NULL, 0);
2521						return (error);
2522					}
2523				}
2524
2525				/*
2526				 * This handles the non-exclusive case
2527				 * and the exclusive case where no post op
2528				 * attrs were returned.
2529				 */
2530				if (vp->v_type == VNON) {
2531					vattr.va_mask = AT_TYPE;
2532					error = nfs3getattr(vp, &vattr, cr);
2533					if (error) {
2534						VN_RELE(vp);
2535						return (error);
2536					}
2537					vp->v_type = vattr.va_type;
2538				}
2539			}
2540			dnlc_update(dvp, nm, vp);
2541		}
2542
2543		rp = VTOR(vp);
2544
2545		/*
2546		 * Check here for large file handled by
2547		 * LF-unaware process (as ufs_create() does)
2548		 */
2549		if ((va->va_mask & AT_SIZE) && vp->v_type == VREG &&
2550		    !(lfaware & FOFFMAX)) {
2551			mutex_enter(&rp->r_statelock);
2552			if (rp->r_size > MAXOFF32_T) {
2553				mutex_exit(&rp->r_statelock);
2554				VN_RELE(vp);
2555				return (EOVERFLOW);
2556			}
2557			mutex_exit(&rp->r_statelock);
2558		}
2559
2560		if (exclusive == EXCL &&
2561		    (va->va_mask & ~(AT_GID | AT_SIZE))) {
2562			/*
2563			 * If doing an exclusive create, then generate
2564			 * a SETATTR to set the initial attributes.
2565			 * Try to set the mtime and the atime to the
2566			 * server's current time.  It is somewhat
2567			 * expected that these fields will be used to
2568			 * store the exclusive create cookie.  If not,
2569			 * server implementors will need to know that
2570			 * a SETATTR will follow an exclusive create
2571			 * and the cookie should be destroyed if
2572			 * appropriate. This work may have been done
2573			 * earlier in this function if post op attrs
2574			 * were not available.
2575			 *
2576			 * The AT_GID and AT_SIZE bits are turned off
2577			 * so that the SETATTR request will not attempt
2578			 * to process these.  The gid will be set
2579			 * separately if appropriate.  The size is turned
2580			 * off because it is assumed that a new file will
2581			 * be created empty and if the file wasn't empty,
2582			 * then the exclusive create will have failed
2583			 * because the file must have existed already.
2584			 * Therefore, no truncate operation is needed.
2585			 */
2586			va->va_mask &= ~(AT_GID | AT_SIZE);
2587			error = nfs3setattr(vp, va, 0, cr);
2588			if (error) {
2589				/*
2590				 * Couldn't correct the attributes of
2591				 * the newly created file and the
2592				 * attributes are wrong.  Remove the
2593				 * file and return an error to the
2594				 * application.
2595				 */
2596				VN_RELE(vp);
2597				(void) nfs3_remove(dvp, nm, cr, NULL, 0);
2598				return (error);
2599			}
2600		}
2601
2602		if (va->va_gid != rp->r_attr.va_gid) {
2603			/*
2604			 * If the gid on the file isn't right, then
2605			 * generate a SETATTR to attempt to change
2606			 * it.  This may or may not work, depending
2607			 * upon the server's semantics for allowing
2608			 * file ownership changes.
2609			 */
2610			va->va_mask = AT_GID;
2611			(void) nfs3setattr(vp, va, 0, cr);
2612		}
2613
2614		/*
2615		 * If vnode is a device create special vnode
2616		 */
2617		if (IS_DEVVP(vp)) {
2618			*vpp = specvp(vp, vp->v_rdev, vp->v_type, cr);
2619			VN_RELE(vp);
2620		} else
2621			*vpp = vp;
2622	} else {
2623		nfs3_cache_wcc_data(dvp, &res.resfail.dir_wcc, t, cr);
2624		PURGE_STALE_FH(error, dvp, cr);
2625	}
2626
2627	return (error);
2628}
2629
2630/*
2631 * Special setattr function to take care of rest of atime/mtime
2632 * after successful exclusive create.  This function exists to avoid
2633 * handling attributes from the server; exclusive the atime/mtime fields
2634 * may be 'invalid' in client's view and therefore can not be trusted.
2635 */
2636static int
2637nfs3excl_create_settimes(vnode_t *vp, struct vattr *vap, cred_t *cr)
2638{
2639	int error;
2640	uint_t mask;
2641	SETATTR3args args;
2642	SETATTR3res res;
2643	int douprintf;
2644	rnode_t *rp;
2645	hrtime_t t;
2646
2647	ASSERT(nfs_zone() == VTOMI(vp)->mi_zone);
2648	/* save the caller's mask so that it can be reset later */
2649	mask = vap->va_mask;
2650
2651	rp = VTOR(vp);
2652
2653	args.object = *RTOFH3(rp);
2654	args.guard.check = FALSE;
2655
2656	/* Use the mask to initialize the arguments */
2657	vap->va_mask = 0;
2658	error = vattr_to_sattr3(vap, &args.new_attributes);
2659
2660	/* We want to set just atime/mtime on this request */
2661	args.new_attributes.atime.set_it = SET_TO_SERVER_TIME;
2662	args.new_attributes.mtime.set_it = SET_TO_SERVER_TIME;
2663
2664	douprintf = 1;
2665
2666	t = gethrtime();
2667
2668	error = rfs3call(VTOMI(vp), NFSPROC3_SETATTR,
2669	    xdr_SETATTR3args, (caddr_t)&args,
2670	    xdr_SETATTR3res, (caddr_t)&res, cr,
2671	    &douprintf, &res.status, 0, NULL);
2672
2673	if (error) {
2674		vap->va_mask = mask;
2675		return (error);
2676	}
2677
2678	error = geterrno3(res.status);
2679	if (!error) {
2680		/*
2681		 * It is important to pick up the attributes.
2682		 * Since this is the exclusive create path, the
2683		 * attributes on the initial create were ignored
2684		 * and we need these to have the correct info.
2685		 */
2686		nfs3_cache_wcc_data(vp, &res.resok.obj_wcc, t, cr);
2687		/*
2688		 * No need to do the atime/mtime work again so clear
2689		 * the bits.
2690		 */
2691		mask &= ~(AT_ATIME | AT_MTIME);
2692	} else {
2693		nfs3_cache_wcc_data(vp, &res.resfail.obj_wcc, t, cr);
2694	}
2695
2696	vap->va_mask = mask;
2697
2698	return (error);
2699}
2700
2701/* ARGSUSED */
2702static int
2703nfs3mknod(vnode_t *dvp, char *nm, struct vattr *va, enum vcexcl exclusive,
2704	int mode, vnode_t **vpp, cred_t *cr)
2705{
2706	int error;
2707	MKNOD3args args;
2708	MKNOD3res res;
2709	int douprintf;
2710	vnode_t *vp;
2711	struct vattr vattr;
2712	hrtime_t t;
2713
2714	ASSERT(nfs_zone() == VTOMI(dvp)->mi_zone);
2715	switch (va->va_type) {
2716	case VCHR:
2717	case VBLK:
2718		setdiropargs3(&args.where, nm, dvp);
2719		args.what.type = (va->va_type == VCHR) ? NF3CHR : NF3BLK;
2720		error = vattr_to_sattr3(va,
2721		    &args.what.mknoddata3_u.device.dev_attributes);
2722		if (error) {
2723			/* req time field(s) overflow - return immediately */
2724			return (error);
2725		}
2726		args.what.mknoddata3_u.device.spec.specdata1 =
2727		    getmajor(va->va_rdev);
2728		args.what.mknoddata3_u.device.spec.specdata2 =
2729		    getminor(va->va_rdev);
2730		break;
2731
2732	case VFIFO:
2733	case VSOCK:
2734		setdiropargs3(&args.where, nm, dvp);
2735		args.what.type = (va->va_type == VFIFO) ? NF3FIFO : NF3SOCK;
2736		error = vattr_to_sattr3(va,
2737		    &args.what.mknoddata3_u.pipe_attributes);
2738		if (error) {
2739			/* req time field(s) overflow - return immediately */
2740			return (error);
2741		}
2742		break;
2743
2744	default:
2745		return (EINVAL);
2746	}
2747
2748	douprintf = 1;
2749
2750	t = gethrtime();
2751
2752	error = rfs3call(VTOMI(dvp), NFSPROC3_MKNOD,
2753	    xdr_MKNOD3args, (caddr_t)&args,
2754	    xdr_MKNOD3res, (caddr_t)&res, cr,
2755	    &douprintf, &res.status, 0, NULL);
2756
2757	if (error) {
2758		PURGE_ATTRCACHE(dvp);
2759		return (error);
2760	}
2761
2762	error = geterrno3(res.status);
2763	if (!error) {
2764		nfs3_cache_wcc_data(dvp, &res.resok.dir_wcc, t, cr);
2765		if (HAVE_RDDIR_CACHE(VTOR(dvp)))
2766			nfs_purge_rddir_cache(dvp);
2767
2768		if (!res.resok.obj.handle_follows) {
2769			error = nfs3lookup(dvp, nm, &vp, NULL, 0, NULL, cr, 0);
2770			if (error)
2771				return (error);
2772		} else {
2773			if (res.resok.obj_attributes.attributes) {
2774				vp = makenfs3node(&res.resok.obj.handle,
2775				    &res.resok.obj_attributes.attr,
2776				    dvp->v_vfsp, t, cr, NULL, NULL);
2777			} else {
2778				vp = makenfs3node(&res.resok.obj.handle, NULL,
2779				    dvp->v_vfsp, t, cr, NULL, NULL);
2780				if (vp->v_type == VNON) {
2781					vattr.va_mask = AT_TYPE;
2782					error = nfs3getattr(vp, &vattr, cr);
2783					if (error) {
2784						VN_RELE(vp);
2785						return (error);
2786					}
2787					vp->v_type = vattr.va_type;
2788				}
2789
2790			}
2791			dnlc_update(dvp, nm, vp);
2792		}
2793
2794		if (va->va_gid != VTOR(vp)->r_attr.va_gid) {
2795			va->va_mask = AT_GID;
2796			(void) nfs3setattr(vp, va, 0, cr);
2797		}
2798
2799		/*
2800		 * If vnode is a device create special vnode
2801		 */
2802		if (IS_DEVVP(vp)) {
2803			*vpp = specvp(vp, vp->v_rdev, vp->v_type, cr);
2804			VN_RELE(vp);
2805		} else
2806			*vpp = vp;
2807	} else {
2808		nfs3_cache_wcc_data(dvp, &res.resfail.dir_wcc, t, cr);
2809		PURGE_STALE_FH(error, dvp, cr);
2810	}
2811	return (error);
2812}
2813
2814/*
2815 * Weirdness: if the vnode to be removed is open
2816 * we rename it instead of removing it and nfs_inactive
2817 * will remove the new name.
2818 */
2819/* ARGSUSED */
2820static int
2821nfs3_remove(vnode_t *dvp, char *nm, cred_t *cr, caller_context_t *ct, int flags)
2822{
2823	int error;
2824	REMOVE3args args;
2825	REMOVE3res res;
2826	vnode_t *vp;
2827	char *tmpname;
2828	int douprintf;
2829	rnode_t *rp;
2830	rnode_t *drp;
2831	hrtime_t t;
2832
2833	if (nfs_zone() != VTOMI(dvp)->mi_zone)
2834		return (EPERM);
2835	drp = VTOR(dvp);
2836	if (nfs_rw_enter_sig(&drp->r_rwlock, RW_WRITER, INTR(dvp)))
2837		return (EINTR);
2838
2839	error = nfs3lookup(dvp, nm, &vp, NULL, 0, NULL, cr, 0);
2840	if (error) {
2841		nfs_rw_exit(&drp->r_rwlock);
2842		return (error);
2843	}
2844
2845	if (vp->v_type == VDIR && secpolicy_fs_linkdir(cr, dvp->v_vfsp)) {
2846		VN_RELE(vp);
2847		nfs_rw_exit(&drp->r_rwlock);
2848		return (EPERM);
2849	}
2850
2851	/*
2852	 * First just remove the entry from the name cache, as it
2853	 * is most likely the only entry for this vp.
2854	 */
2855	dnlc_remove(dvp, nm);
2856
2857	/*
2858	 * If the file has a v_count > 1 then there may be more than one
2859	 * entry in the name cache due multiple links or an open file,
2860	 * but we don't have the real reference count so flush all
2861	 * possible entries.
2862	 */
2863	if (vp->v_count > 1)
2864		dnlc_purge_vp(vp);
2865
2866	/*
2867	 * Now we have the real reference count on the vnode
2868	 */
2869	rp = VTOR(vp);
2870	mutex_enter(&rp->r_statelock);
2871	if (vp->v_count > 1 &&
2872	    (rp->r_unldvp == NULL || strcmp(nm, rp->r_unlname) == 0)) {
2873		mutex_exit(&rp->r_statelock);
2874		tmpname = newname();
2875		error = nfs3rename(dvp, nm, dvp, tmpname, cr, ct);
2876		if (error)
2877			kmem_free(tmpname, MAXNAMELEN);
2878		else {
2879			mutex_enter(&rp->r_statelock);
2880			if (rp->r_unldvp == NULL) {
2881				VN_HOLD(dvp);
2882				rp->r_unldvp = dvp;
2883				if (rp->r_unlcred != NULL)
2884					crfree(rp->r_unlcred);
2885				crhold(cr);
2886				rp->r_unlcred = cr;
2887				rp->r_unlname = tmpname;
2888			} else {
2889				kmem_free(rp->r_unlname, MAXNAMELEN);
2890				rp->r_unlname = tmpname;
2891			}
2892			mutex_exit(&rp->r_statelock);
2893		}
2894	} else {
2895		mutex_exit(&rp->r_statelock);
2896		/*
2897		 * We need to flush any dirty pages which happen to
2898		 * be hanging around before removing the file.  This
2899		 * shouldn't happen very often and mostly on file
2900		 * systems mounted "nocto".
2901		 */
2902		if (vn_has_cached_data(vp) &&
2903		    ((rp->r_flags & RDIRTY) || rp->r_count > 0)) {
2904			error = nfs3_putpage(vp, (offset_t)0, 0, 0, cr, ct);
2905			if (error && (error == ENOSPC || error == EDQUOT)) {
2906				mutex_enter(&rp->r_statelock);
2907				if (!rp->r_error)
2908					rp->r_error = error;
2909				mutex_exit(&rp->r_statelock);
2910			}
2911		}
2912
2913		setdiropargs3(&args.object, nm, dvp);
2914
2915		douprintf = 1;
2916
2917		t = gethrtime();
2918
2919		error = rfs3call(VTOMI(dvp), NFSPROC3_REMOVE,
2920		    xdr_diropargs3, (caddr_t)&args,
2921		    xdr_REMOVE3res, (caddr_t)&res, cr,
2922		    &douprintf, &res.status, 0, NULL);
2923
2924		/*
2925		 * The xattr dir may be gone after last attr is removed,
2926		 * so flush it from dnlc.
2927		 */
2928		if (dvp->v_flag & V_XATTRDIR)
2929			dnlc_purge_vp(dvp);
2930
2931		PURGE_ATTRCACHE(vp);
2932
2933		if (error) {
2934			PURGE_ATTRCACHE(dvp);
2935		} else {
2936			error = geterrno3(res.status);
2937			if (!error) {
2938				nfs3_cache_wcc_data(dvp, &res.resok.dir_wcc, t,
2939				    cr);
2940				if (HAVE_RDDIR_CACHE(drp))
2941					nfs_purge_rddir_cache(dvp);
2942			} else {
2943				nfs3_cache_wcc_data(dvp, &res.resfail.dir_wcc,
2944				    t, cr);
2945				PURGE_STALE_FH(error, dvp, cr);
2946			}
2947		}
2948	}
2949
2950	if (error == 0) {
2951		vnevent_remove(vp, dvp, nm, ct);
2952	}
2953	VN_RELE(vp);
2954
2955	nfs_rw_exit(&drp->r_rwlock);
2956
2957	return (error);
2958}
2959
2960/* ARGSUSED */
2961static int
2962nfs3_link(vnode_t *tdvp, vnode_t *svp, char *tnm, cred_t *cr,
2963	caller_context_t *ct, int flags)
2964{
2965	int error;
2966	LINK3args args;
2967	LINK3res res;
2968	vnode_t *realvp;
2969	int douprintf;
2970	mntinfo_t *mi;
2971	rnode_t *tdrp;
2972	hrtime_t t;
2973
2974	if (nfs_zone() != VTOMI(tdvp)->mi_zone)
2975		return (EPERM);
2976	if (VOP_REALVP(svp, &realvp, ct) == 0)
2977		svp = realvp;
2978
2979	mi = VTOMI(svp);
2980
2981	if (!(mi->mi_flags & MI_LINK))
2982		return (EOPNOTSUPP);
2983
2984	args.file = *VTOFH3(svp);
2985	setdiropargs3(&args.link, tnm, tdvp);
2986
2987	tdrp = VTOR(tdvp);
2988	if (nfs_rw_enter_sig(&tdrp->r_rwlock, RW_WRITER, INTR(tdvp)))
2989		return (EINTR);
2990
2991	dnlc_remove(tdvp, tnm);
2992
2993	douprintf = 1;
2994
2995	t = gethrtime();
2996
2997	error = rfs3call(mi, NFSPROC3_LINK,
2998	    xdr_LINK3args, (caddr_t)&args,
2999	    xdr_LINK3res, (caddr_t)&res, cr,
3000	    &douprintf, &res.status, 0, NULL);
3001
3002	if (error) {
3003		PURGE_ATTRCACHE(tdvp);
3004		PURGE_ATTRCACHE(svp);
3005		nfs_rw_exit(&tdrp->r_rwlock);
3006		return (error);
3007	}
3008
3009	error = geterrno3(res.status);
3010
3011	if (!error) {
3012		nfs3_cache_post_op_attr(svp, &res.resok.file_attributes, t, cr);
3013		nfs3_cache_wcc_data(tdvp, &res.resok.linkdir_wcc, t, cr);
3014		if (HAVE_RDDIR_CACHE(tdrp))
3015			nfs_purge_rddir_cache(tdvp);
3016		dnlc_update(tdvp, tnm, svp);
3017	} else {
3018		nfs3_cache_post_op_attr(svp, &res.resfail.file_attributes, t,
3019		    cr);
3020		nfs3_cache_wcc_data(tdvp, &res.resfail.linkdir_wcc, t, cr);
3021		if (error == EOPNOTSUPP) {
3022			mutex_enter(&mi->mi_lock);
3023			mi->mi_flags &= ~MI_LINK;
3024			mutex_exit(&mi->mi_lock);
3025		}
3026	}
3027
3028	nfs_rw_exit(&tdrp->r_rwlock);
3029
3030	if (!error) {
3031		/*
3032		 * Notify the source file of this link operation.
3033		 */
3034		vnevent_link(svp, ct);
3035	}
3036	return (error);
3037}
3038
3039/* ARGSUSED */
3040static int
3041nfs3_rename(vnode_t *odvp, char *onm, vnode_t *ndvp, char *nnm, cred_t *cr,
3042	caller_context_t *ct, int flags)
3043{
3044	vnode_t *realvp;
3045
3046	if (nfs_zone() != VTOMI(odvp)->mi_zone)
3047		return (EPERM);
3048	if (VOP_REALVP(ndvp, &realvp, ct) == 0)
3049		ndvp = realvp;
3050
3051	return (nfs3rename(odvp, onm, ndvp, nnm, cr, ct));
3052}
3053
3054/*
3055 * nfs3rename does the real work of renaming in NFS Version 3.
3056 */
3057static int
3058nfs3rename(vnode_t *odvp, char *onm, vnode_t *ndvp, char *nnm, cred_t *cr,
3059    caller_context_t *ct)
3060{
3061	int error;
3062	RENAME3args args;
3063	RENAME3res res;
3064	int douprintf;
3065	vnode_t *nvp = NULL;
3066	vnode_t *ovp = NULL;
3067	char *tmpname;
3068	rnode_t *rp;
3069	rnode_t *odrp;
3070	rnode_t *ndrp;
3071	hrtime_t t;
3072
3073	ASSERT(nfs_zone() == VTOMI(odvp)->mi_zone);
3074
3075	if (strcmp(onm, ".") == 0 || strcmp(onm, "..") == 0 ||
3076	    strcmp(nnm, ".") == 0 || strcmp(nnm, "..") == 0)
3077		return (EINVAL);
3078
3079	odrp = VTOR(odvp);
3080	ndrp = VTOR(ndvp);
3081	if ((intptr_t)odrp < (intptr_t)ndrp) {
3082		if (nfs_rw_enter_sig(&odrp->r_rwlock, RW_WRITER, INTR(odvp)))
3083			return (EINTR);
3084		if (nfs_rw_enter_sig(&ndrp->r_rwlock, RW_WRITER, INTR(ndvp))) {
3085			nfs_rw_exit(&odrp->r_rwlock);
3086			return (EINTR);
3087		}
3088	} else {
3089		if (nfs_rw_enter_sig(&ndrp->r_rwlock, RW_WRITER, INTR(ndvp)))
3090			return (EINTR);
3091		if (nfs_rw_enter_sig(&odrp->r_rwlock, RW_WRITER, INTR(odvp))) {
3092			nfs_rw_exit(&ndrp->r_rwlock);
3093			return (EINTR);
3094		}
3095	}
3096
3097	/*
3098	 * Lookup the target file.  If it exists, it needs to be
3099	 * checked to see whether it is a mount point and whether
3100	 * it is active (open).
3101	 */
3102	error = nfs3lookup(ndvp, nnm, &nvp, NULL, 0, NULL, cr, 0);
3103	if (!error) {
3104		/*
3105		 * If this file has been mounted on, then just
3106		 * return busy because renaming to it would remove
3107		 * the mounted file system from the name space.
3108		 */
3109		if (vn_mountedvfs(nvp) != NULL) {
3110			VN_RELE(nvp);
3111			nfs_rw_exit(&odrp->r_rwlock);
3112			nfs_rw_exit(&ndrp->r_rwlock);
3113			return (EBUSY);
3114		}
3115
3116		/*
3117		 * Purge the name cache of all references to this vnode
3118		 * so that we can check the reference count to infer
3119		 * whether it is active or not.
3120		 */
3121		/*
3122		 * First just remove the entry from the name cache, as it
3123		 * is most likely the only entry for this vp.
3124		 */
3125		dnlc_remove(ndvp, nnm);
3126		/*
3127		 * If the file has a v_count > 1 then there may be more
3128		 * than one entry in the name cache due multiple links
3129		 * or an open file, but we don't have the real reference
3130		 * count so flush all possible entries.
3131		 */
3132		if (nvp->v_count > 1)
3133			dnlc_purge_vp(nvp);
3134
3135		/*
3136		 * If the vnode is active and is not a directory,
3137		 * arrange to rename it to a
3138		 * temporary file so that it will continue to be
3139		 * accessible.  This implements the "unlink-open-file"
3140		 * semantics for the target of a rename operation.
3141		 * Before doing this though, make sure that the
3142		 * source and target files are not already the same.
3143		 */
3144		if (nvp->v_count > 1 && nvp->v_type != VDIR) {
3145			/*
3146			 * Lookup the source name.
3147			 */
3148			error = nfs3lookup(odvp, onm, &ovp, NULL, 0, NULL,
3149			    cr, 0);
3150
3151			/*
3152			 * The source name *should* already exist.
3153			 */
3154			if (error) {
3155				VN_RELE(nvp);
3156				nfs_rw_exit(&odrp->r_rwlock);
3157				nfs_rw_exit(&ndrp->r_rwlock);
3158				return (error);
3159			}
3160
3161			/*
3162			 * Compare the two vnodes.  If they are the same,
3163			 * just release all held vnodes and return success.
3164			 */
3165			if (ovp == nvp) {
3166				VN_RELE(ovp);
3167				VN_RELE(nvp);
3168				nfs_rw_exit(&odrp->r_rwlock);
3169				nfs_rw_exit(&ndrp->r_rwlock);
3170				return (0);
3171			}
3172
3173			/*
3174			 * Can't mix and match directories and non-
3175			 * directories in rename operations.  We already
3176			 * know that the target is not a directory.  If
3177			 * the source is a directory, return an error.
3178			 */
3179			if (ovp->v_type == VDIR) {
3180				VN_RELE(ovp);
3181				VN_RELE(nvp);
3182				nfs_rw_exit(&odrp->r_rwlock);
3183				nfs_rw_exit(&ndrp->r_rwlock);
3184				return (ENOTDIR);
3185			}
3186
3187			/*
3188			 * The target file exists, is not the same as
3189			 * the source file, and is active.  Link it
3190			 * to a temporary filename to avoid having
3191			 * the server removing the file completely.
3192			 */
3193			tmpname = newname();
3194			error = nfs3_link(ndvp, nvp, tmpname, cr, NULL, 0);
3195			if (error == EOPNOTSUPP) {
3196				error = nfs3_rename(ndvp, nnm, ndvp, tmpname,
3197				    cr, NULL, 0);
3198			}
3199			if (error) {
3200				kmem_free(tmpname, MAXNAMELEN);
3201				VN_RELE(ovp);
3202				VN_RELE(nvp);
3203				nfs_rw_exit(&odrp->r_rwlock);
3204				nfs_rw_exit(&ndrp->r_rwlock);
3205				return (error);
3206			}
3207			rp = VTOR(nvp);
3208			mutex_enter(&rp->r_statelock);
3209			if (rp->r_unldvp == NULL) {
3210				VN_HOLD(ndvp);
3211				rp->r_unldvp = ndvp;
3212				if (rp->r_unlcred != NULL)
3213					crfree(rp->r_unlcred);
3214				crhold(cr);
3215				rp->r_unlcred = cr;
3216				rp->r_unlname = tmpname;
3217			} else {
3218				kmem_free(rp->r_unlname, MAXNAMELEN);
3219				rp->r_unlname = tmpname;
3220			}
3221			mutex_exit(&rp->r_statelock);
3222		}
3223	}
3224
3225	if (ovp == NULL) {
3226		/*
3227		 * When renaming directories to be a subdirectory of a
3228		 * different parent, the dnlc entry for ".." will no
3229		 * longer be valid, so it must be removed.
3230		 *
3231		 * We do a lookup here to determine whether we are renaming
3232		 * a directory and we need to check if we are renaming
3233		 * an unlinked file.  This might have already been done
3234		 * in previous code, so we check ovp == NULL to avoid
3235		 * doing it twice.
3236		 */
3237
3238		error = nfs3lookup(odvp, onm, &ovp, NULL, 0, NULL, cr, 0);
3239		/*
3240		 * The source name *should* already exist.
3241		 */
3242		if (error) {
3243			nfs_rw_exit(&odrp->r_rwlock);
3244			nfs_rw_exit(&ndrp->r_rwlock);
3245			if (nvp) {
3246				VN_RELE(nvp);
3247			}
3248			return (error);
3249		}
3250		ASSERT(ovp != NULL);
3251	}
3252
3253	dnlc_remove(odvp, onm);
3254	dnlc_remove(ndvp, nnm);
3255
3256	setdiropargs3(&args.from, onm, odvp);
3257	setdiropargs3(&args.to, nnm, ndvp);
3258
3259	douprintf = 1;
3260
3261	t = gethrtime();
3262
3263	error = rfs3call(VTOMI(odvp), NFSPROC3_RENAME,
3264	    xdr_RENAME3args, (caddr_t)&args,
3265	    xdr_RENAME3res, (caddr_t)&res, cr,
3266	    &douprintf, &res.status, 0, NULL);
3267
3268	if (error) {
3269		PURGE_ATTRCACHE(odvp);
3270		PURGE_ATTRCACHE(ndvp);
3271		VN_RELE(ovp);
3272		nfs_rw_exit(&odrp->r_rwlock);
3273		nfs_rw_exit(&ndrp->r_rwlock);
3274		if (nvp) {
3275			VN_RELE(nvp);
3276		}
3277		return (error);
3278	}
3279
3280	error = geterrno3(res.status);
3281
3282	if (!error) {
3283		nfs3_cache_wcc_data(odvp, &res.resok.fromdir_wcc, t, cr);
3284		if (HAVE_RDDIR_CACHE(odrp))
3285			nfs_purge_rddir_cache(odvp);
3286		if (ndvp != odvp) {
3287			nfs3_cache_wcc_data(ndvp, &res.resok.todir_wcc, t, cr);
3288			if (HAVE_RDDIR_CACHE(ndrp))
3289				nfs_purge_rddir_cache(ndvp);
3290		}
3291		/*
3292		 * when renaming directories to be a subdirectory of a
3293		 * different parent, the dnlc entry for ".." will no
3294		 * longer be valid, so it must be removed
3295		 */
3296		rp = VTOR(ovp);
3297		if (ndvp != odvp) {
3298			if (ovp->v_type == VDIR) {
3299				dnlc_remove(ovp, "..");
3300				if (HAVE_RDDIR_CACHE(rp))
3301					nfs_purge_rddir_cache(ovp);
3302			}
3303		}
3304
3305		/*
3306		 * If we are renaming the unlinked file, update the
3307		 * r_unldvp and r_unlname as needed.
3308		 */
3309		mutex_enter(&rp->r_statelock);
3310		if (rp->r_unldvp != NULL) {
3311			if (strcmp(rp->r_unlname, onm) == 0) {
3312				(void) strncpy(rp->r_unlname, nnm, MAXNAMELEN);
3313				rp->r_unlname[MAXNAMELEN - 1] = '\0';
3314
3315				if (ndvp != rp->r_unldvp) {
3316					VN_RELE(rp->r_unldvp);
3317					rp->r_unldvp = ndvp;
3318					VN_HOLD(ndvp);
3319				}
3320			}
3321		}
3322		mutex_exit(&rp->r_statelock);
3323	} else {
3324		nfs3_cache_wcc_data(odvp, &res.resfail.fromdir_wcc, t, cr);
3325		if (ndvp != odvp) {
3326			nfs3_cache_wcc_data(ndvp, &res.resfail.todir_wcc, t,
3327			    cr);
3328		}
3329		/*
3330		 * System V defines rename to return EEXIST, not
3331		 * ENOTEMPTY if the target directory is not empty.
3332		 * Over the wire, the error is NFSERR_ENOTEMPTY
3333		 * which geterrno maps to ENOTEMPTY.
3334		 */
3335		if (error == ENOTEMPTY)
3336			error = EEXIST;
3337	}
3338
3339	if (error == 0) {
3340		if (nvp)
3341			vnevent_rename_dest(nvp, ndvp, nnm, ct);
3342
3343		if (odvp != ndvp)
3344			vnevent_rename_dest_dir(ndvp, ct);
3345		ASSERT(ovp != NULL);
3346		vnevent_rename_src(ovp, odvp, onm, ct);
3347	}
3348
3349	if (nvp) {
3350		VN_RELE(nvp);
3351	}
3352	VN_RELE(ovp);
3353
3354	nfs_rw_exit(&odrp->r_rwlock);
3355	nfs_rw_exit(&ndrp->r_rwlock);
3356
3357	return (error);
3358}
3359
3360/* ARGSUSED */
3361static int
3362nfs3_mkdir(vnode_t *dvp, char *nm, struct vattr *va, vnode_t **vpp, cred_t *cr,
3363	caller_context_t *ct, int flags, vsecattr_t *vsecp)
3364{
3365	int error;
3366	MKDIR3args args;
3367	MKDIR3res res;
3368	int douprintf;
3369	struct vattr vattr;
3370	vnode_t *vp;
3371	rnode_t *drp;
3372	hrtime_t t;
3373
3374	if (nfs_zone() != VTOMI(dvp)->mi_zone)
3375		return (EPERM);
3376	setdiropargs3(&args.where, nm, dvp);
3377
3378	/*
3379	 * Decide what the group-id and set-gid bit of the created directory
3380	 * should be.  May have to do a setattr to get the gid right.
3381	 */
3382	error = setdirgid(dvp, &va->va_gid, cr);
3383	if (error)
3384		return (error);
3385	error = setdirmode(dvp, &va->va_mode, cr);
3386	if (error)
3387		return (error);
3388	va->va_mask |= AT_MODE|AT_GID;
3389
3390	error = vattr_to_sattr3(va, &args.attributes);
3391	if (error) {
3392		/* req time field(s) overflow - return immediately */
3393		return (error);
3394	}
3395
3396	drp = VTOR(dvp);
3397	if (nfs_rw_enter_sig(&drp->r_rwlock, RW_WRITER, INTR(dvp)))
3398		return (EINTR);
3399
3400	dnlc_remove(dvp, nm);
3401
3402	douprintf = 1;
3403
3404	t = gethrtime();
3405
3406	error = rfs3call(VTOMI(dvp), NFSPROC3_MKDIR,
3407	    xdr_MKDIR3args, (caddr_t)&args,
3408	    xdr_MKDIR3res, (caddr_t)&res, cr,
3409	    &douprintf, &res.status, 0, NULL);
3410
3411	if (error) {
3412		PURGE_ATTRCACHE(dvp);
3413		nfs_rw_exit(&drp->r_rwlock);
3414		return (error);
3415	}
3416
3417	error = geterrno3(res.status);
3418	if (!error) {
3419		nfs3_cache_wcc_data(dvp, &res.resok.dir_wcc, t, cr);
3420		if (HAVE_RDDIR_CACHE(drp))
3421			nfs_purge_rddir_cache(dvp);
3422
3423		if (!res.resok.obj.handle_follows) {
3424			error = nfs3lookup(dvp, nm, &vp, NULL, 0, NULL, cr, 0);
3425			if (error) {
3426				nfs_rw_exit(&drp->r_rwlock);
3427				return (error);
3428			}
3429		} else {
3430			if (res.resok.obj_attributes.attributes) {
3431				vp = makenfs3node(&res.resok.obj.handle,
3432				    &res.resok.obj_attributes.attr,
3433				    dvp->v_vfsp, t, cr, NULL, NULL);
3434			} else {
3435				vp = makenfs3node(&res.resok.obj.handle, NULL,
3436				    dvp->v_vfsp, t, cr, NULL, NULL);
3437				if (vp->v_type == VNON) {
3438					vattr.va_mask = AT_TYPE;
3439					error = nfs3getattr(vp, &vattr, cr);
3440					if (error) {
3441						VN_RELE(vp);
3442						nfs_rw_exit(&drp->r_rwlock);
3443						return (error);
3444					}
3445					vp->v_type = vattr.va_type;
3446				}
3447			}
3448			dnlc_update(dvp, nm, vp);
3449		}
3450		if (va->va_gid != VTOR(vp)->r_attr.va_gid) {
3451			va->va_mask = AT_GID;
3452			(void) nfs3setattr(vp, va, 0, cr);
3453		}
3454		*vpp = vp;
3455	} else {
3456		nfs3_cache_wcc_data(dvp, &res.resfail.dir_wcc, t, cr);
3457		PURGE_STALE_FH(error, dvp, cr);
3458	}
3459
3460	nfs_rw_exit(&drp->r_rwlock);
3461
3462	return (error);
3463}
3464
3465/* ARGSUSED */
3466static int
3467nfs3_rmdir(vnode_t *dvp, char *nm, vnode_t *cdir, cred_t *cr,
3468	caller_context_t *ct, int flags)
3469{
3470	int error;
3471	RMDIR3args args;
3472	RMDIR3res res;
3473	vnode_t *vp;
3474	int douprintf;
3475	rnode_t *drp;
3476	hrtime_t t;
3477
3478	if (nfs_zone() != VTOMI(dvp)->mi_zone)
3479		return (EPERM);
3480	drp = VTOR(dvp);
3481	if (nfs_rw_enter_sig(&drp->r_rwlock, RW_WRITER, INTR(dvp)))
3482		return (EINTR);
3483
3484	/*
3485	 * Attempt to prevent a rmdir(".") from succeeding.
3486	 */
3487	error = nfs3lookup(dvp, nm, &vp, NULL, 0, NULL, cr, 0);
3488	if (error) {
3489		nfs_rw_exit(&drp->r_rwlock);
3490		return (error);
3491	}
3492
3493	if (vp == cdir) {
3494		VN_RELE(vp);
3495		nfs_rw_exit(&drp->r_rwlock);
3496		return (EINVAL);
3497	}
3498
3499	setdiropargs3(&args.object, nm, dvp);
3500
3501	/*
3502	 * First just remove the entry from the name cache, as it
3503	 * is most likely an entry for this vp.
3504	 */
3505	dnlc_remove(dvp, nm);
3506
3507	/*
3508	 * If there vnode reference count is greater than one, then
3509	 * there may be additional references in the DNLC which will
3510	 * need to be purged.  First, trying removing the entry for
3511	 * the parent directory and see if that removes the additional
3512	 * reference(s).  If that doesn't do it, then use dnlc_purge_vp
3513	 * to completely remove any references to the directory which
3514	 * might still exist in the DNLC.
3515	 */
3516	if (vp->v_count > 1) {
3517		dnlc_remove(vp, "..");
3518		if (vp->v_count > 1)
3519			dnlc_purge_vp(vp);
3520	}
3521
3522	douprintf = 1;
3523
3524	t = gethrtime();
3525
3526	error = rfs3call(VTOMI(dvp), NFSPROC3_RMDIR,
3527	    xdr_diropargs3, (caddr_t)&args,
3528	    xdr_RMDIR3res, (caddr_t)&res, cr,
3529	    &douprintf, &res.status, 0, NULL);
3530
3531	PURGE_ATTRCACHE(vp);
3532
3533	if (error) {
3534		PURGE_ATTRCACHE(dvp);
3535		VN_RELE(vp);
3536		nfs_rw_exit(&drp->r_rwlock);
3537		return (error);
3538	}
3539
3540	error = geterrno3(res.status);
3541	if (!error) {
3542		nfs3_cache_wcc_data(dvp, &res.resok.dir_wcc, t, cr);
3543		if (HAVE_RDDIR_CACHE(drp))
3544			nfs_purge_rddir_cache(dvp);
3545		if (HAVE_RDDIR_CACHE(VTOR(vp)))
3546			nfs_purge_rddir_cache(vp);
3547	} else {
3548		nfs3_cache_wcc_data(dvp, &res.resfail.dir_wcc, t, cr);
3549		PURGE_STALE_FH(error, dvp, cr);
3550		/*
3551		 * System V defines rmdir to return EEXIST, not
3552		 * ENOTEMPTY if the directory is not empty.  Over
3553		 * the wire, the error is NFSERR_ENOTEMPTY which
3554		 * geterrno maps to ENOTEMPTY.
3555		 */
3556		if (error == ENOTEMPTY)
3557			error = EEXIST;
3558	}
3559
3560	if (error == 0) {
3561		vnevent_rmdir(vp, dvp, nm, ct);
3562	}
3563	VN_RELE(vp);
3564
3565	nfs_rw_exit(&drp->r_rwlock);
3566
3567	return (error);
3568}
3569
3570/* ARGSUSED */
3571static int
3572nfs3_symlink(vnode_t *dvp, char *lnm, struct vattr *tva, char *tnm, cred_t *cr,
3573	caller_context_t *ct, int flags)
3574{
3575	int error;
3576	SYMLINK3args args;
3577	SYMLINK3res res;
3578	int douprintf;
3579	mntinfo_t *mi;
3580	vnode_t *vp;
3581	rnode_t *rp;
3582	char *contents;
3583	rnode_t *drp;
3584	hrtime_t t;
3585
3586	mi = VTOMI(dvp);
3587
3588	if (nfs_zone() != mi->mi_zone)
3589		return (EPERM);
3590	if (!(mi->mi_flags & MI_SYMLINK))
3591		return (EOPNOTSUPP);
3592
3593	setdiropargs3(&args.where, lnm, dvp);
3594	error = vattr_to_sattr3(tva, &args.symlink.symlink_attributes);
3595	if (error) {
3596		/* req time field(s) overflow - return immediately */
3597		return (error);
3598	}
3599	args.symlink.symlink_data = tnm;
3600
3601	drp = VTOR(dvp);
3602	if (nfs_rw_enter_sig(&drp->r_rwlock, RW_WRITER, INTR(dvp)))
3603		return (EINTR);
3604
3605	dnlc_remove(dvp, lnm);
3606
3607	douprintf = 1;
3608
3609	t = gethrtime();
3610
3611	error = rfs3call(mi, NFSPROC3_SYMLINK,
3612	    xdr_SYMLINK3args, (caddr_t)&args,
3613	    xdr_SYMLINK3res, (caddr_t)&res, cr,
3614	    &douprintf, &res.status, 0, NULL);
3615
3616	if (error) {
3617		PURGE_ATTRCACHE(dvp);
3618		nfs_rw_exit(&drp->r_rwlock);
3619		return (error);
3620	}
3621
3622	error = geterrno3(res.status);
3623	if (!error) {
3624		nfs3_cache_wcc_data(dvp, &res.resok.dir_wcc, t, cr);
3625		if (HAVE_RDDIR_CACHE(drp))
3626			nfs_purge_rddir_cache(dvp);
3627
3628		if (res.resok.obj.handle_follows) {
3629			if (res.resok.obj_attributes.attributes) {
3630				vp = makenfs3node(&res.resok.obj.handle,
3631				    &res.resok.obj_attributes.attr,
3632				    dvp->v_vfsp, t, cr, NULL, NULL);
3633			} else {
3634				vp = makenfs3node(&res.resok.obj.handle, NULL,
3635				    dvp->v_vfsp, t, cr, NULL, NULL);
3636				vp->v_type = VLNK;
3637				vp->v_rdev = 0;
3638			}
3639			dnlc_update(dvp, lnm, vp);
3640			rp = VTOR(vp);
3641			if (nfs3_do_symlink_cache &&
3642			    rp->r_symlink.contents == NULL) {
3643
3644				contents = kmem_alloc(MAXPATHLEN,
3645				    KM_NOSLEEP);
3646
3647				if (contents != NULL) {
3648					mutex_enter(&rp->r_statelock);
3649					if (rp->r_symlink.contents == NULL) {
3650						rp->r_symlink.len = strlen(tnm);
3651						bcopy(tnm, contents,
3652						    rp->r_symlink.len);
3653						rp->r_symlink.contents =
3654						    contents;
3655						rp->r_symlink.size = MAXPATHLEN;
3656						mutex_exit(&rp->r_statelock);
3657					} else {
3658						mutex_exit(&rp->r_statelock);
3659						kmem_free((void *)contents,
3660						    MAXPATHLEN);
3661					}
3662				}
3663			}
3664			VN_RELE(vp);
3665		}
3666	} else {
3667		nfs3_cache_wcc_data(dvp, &res.resfail.dir_wcc, t, cr);
3668		PURGE_STALE_FH(error, dvp, cr);
3669		if (error == EOPNOTSUPP) {
3670			mutex_enter(&mi->mi_lock);
3671			mi->mi_flags &= ~MI_SYMLINK;
3672			mutex_exit(&mi->mi_lock);
3673		}
3674	}
3675
3676	nfs_rw_exit(&drp->r_rwlock);
3677
3678	return (error);
3679}
3680
3681#ifdef DEBUG
3682static int nfs3_readdir_cache_hits = 0;
3683static int nfs3_readdir_cache_shorts = 0;
3684static int nfs3_readdir_cache_waits = 0;
3685static int nfs3_readdir_cache_misses = 0;
3686static int nfs3_readdir_readahead = 0;
3687#endif
3688
3689static int nfs3_shrinkreaddir = 0;
3690
3691/*
3692 * Read directory entries.
3693 * There are some weird things to look out for here.  The uio_loffset
3694 * field is either 0 or it is the offset returned from a previous
3695 * readdir.  It is an opaque value used by the server to find the
3696 * correct directory block to read. The count field is the number
3697 * of blocks to read on the server.  This is advisory only, the server
3698 * may return only one block's worth of entries.  Entries may be compressed
3699 * on the server.
3700 */
3701/* ARGSUSED */
3702static int
3703nfs3_readdir(vnode_t *vp, struct uio *uiop, cred_t *cr, int *eofp,
3704	caller_context_t *ct, int flags)
3705{
3706	int error;
3707	size_t count;
3708	rnode_t *rp;
3709	rddir_cache *rdc;
3710	rddir_cache *nrdc;
3711	rddir_cache *rrdc;
3712#ifdef DEBUG
3713	int missed;
3714#endif
3715	int doreadahead;
3716	rddir_cache srdc;
3717	avl_index_t where;
3718
3719	if (nfs_zone() != VTOMI(vp)->mi_zone)
3720		return (EIO);
3721	rp = VTOR(vp);
3722
3723	ASSERT(nfs_rw_lock_held(&rp->r_rwlock, RW_READER));
3724
3725	/*
3726	 * Make sure that the directory cache is valid.
3727	 */
3728	if (HAVE_RDDIR_CACHE(rp)) {
3729		if (nfs_disable_rddir_cache) {
3730			/*
3731			 * Setting nfs_disable_rddir_cache in /etc/system
3732			 * allows interoperability with servers that do not
3733			 * properly update the attributes of directories.
3734			 * Any cached information gets purged before an
3735			 * access is made to it.
3736			 */
3737			nfs_purge_rddir_cache(vp);
3738		} else {
3739			error = nfs3_validate_caches(vp, cr);
3740			if (error)
3741				return (error);
3742		}
3743	}
3744
3745	/*
3746	 * It is possible that some servers may not be able to correctly
3747	 * handle a large READDIR or READDIRPLUS request due to bugs in
3748	 * their implementation.  In order to continue to interoperate
3749	 * with them, this workaround is provided to limit the maximum
3750	 * size of a READDIRPLUS request to 1024.  In any case, the request
3751	 * size is limited to MAXBSIZE.
3752	 */
3753	count = MIN(uiop->uio_iov->iov_len,
3754	    nfs3_shrinkreaddir ? 1024 : MAXBSIZE);
3755
3756	nrdc = NULL;
3757#ifdef DEBUG
3758	missed = 0;
3759#endif
3760top:
3761	/*
3762	 * Short circuit last readdir which always returns 0 bytes.
3763	 * This can be done after the directory has been read through
3764	 * completely at least once.  This will set r_direof which
3765	 * can be used to find the value of the last cookie.
3766	 */
3767	mutex_enter(&rp->r_statelock);
3768	if (rp->r_direof != NULL &&
3769	    uiop->uio_loffset == rp->r_direof->nfs3_ncookie) {
3770		mutex_exit(&rp->r_statelock);
3771#ifdef DEBUG
3772		nfs3_readdir_cache_shorts++;
3773#endif
3774		if (eofp)
3775			*eofp = 1;
3776		if (nrdc != NULL)
3777			rddir_cache_rele(nrdc);
3778		return (0);
3779	}
3780	/*
3781	 * Look for a cache entry.  Cache entries are identified
3782	 * by the NFS cookie value and the byte count requested.
3783	 */
3784	srdc.nfs3_cookie = uiop->uio_loffset;
3785	srdc.buflen = count;
3786	rdc = avl_find(&rp->r_dir, &srdc, &where);
3787	if (rdc != NULL) {
3788		rddir_cache_hold(rdc);
3789		/*
3790		 * If the cache entry is in the process of being
3791		 * filled in, wait until this completes.  The
3792		 * RDDIRWAIT bit is set to indicate that someone
3793		 * is waiting and then the thread currently
3794		 * filling the entry is done, it should do a
3795		 * cv_broadcast to wakeup all of the threads
3796		 * waiting for it to finish.
3797		 */
3798		if (rdc->flags & RDDIR) {
3799			nfs_rw_exit(&rp->r_rwlock);
3800			rdc->flags |= RDDIRWAIT;
3801#ifdef DEBUG
3802			nfs3_readdir_cache_waits++;
3803#endif
3804			if (!cv_wait_sig(&rdc->cv, &rp->r_statelock)) {
3805				/*
3806				 * We got interrupted, probably
3807				 * the user typed ^C or an alarm
3808				 * fired.  We free the new entry
3809				 * if we allocated one.
3810				 */
3811				mutex_exit(&rp->r_statelock);
3812				(void) nfs_rw_enter_sig(&rp->r_rwlock,
3813				    RW_READER, FALSE);
3814				rddir_cache_rele(rdc);
3815				if (nrdc != NULL)
3816					rddir_cache_rele(nrdc);
3817				return (EINTR);
3818			}
3819			mutex_exit(&rp->r_statelock);
3820			(void) nfs_rw_enter_sig(&rp->r_rwlock,
3821			    RW_READER, FALSE);
3822			rddir_cache_rele(rdc);
3823			goto top;
3824		}
3825		/*
3826		 * Check to see if a readdir is required to
3827		 * fill the entry.  If so, mark this entry
3828		 * as being filled, remove our reference,
3829		 * and branch to the code to fill the entry.
3830		 */
3831		if (rdc->flags & RDDIRREQ) {
3832			rdc->flags &= ~RDDIRREQ;
3833			rdc->flags |= RDDIR;
3834			if (nrdc != NULL)
3835				rddir_cache_rele(nrdc);
3836			nrdc = rdc;
3837			mutex_exit(&rp->r_statelock);
3838			goto bottom;
3839		}
3840#ifdef DEBUG
3841		if (!missed)
3842			nfs3_readdir_cache_hits++;
3843#endif
3844		/*
3845		 * If an error occurred while attempting
3846		 * to fill the cache entry, just return it.
3847		 */
3848		if (rdc->error) {
3849			error = rdc->error;
3850			mutex_exit(&rp->r_statelock);
3851			rddir_cache_rele(rdc);
3852			if (nrdc != NULL)
3853				rddir_cache_rele(nrdc);
3854			return (error);
3855		}
3856
3857		/*
3858		 * The cache entry is complete and good,
3859		 * copyout the dirent structs to the calling
3860		 * thread.
3861		 */
3862		error = uiomove(rdc->entries, rdc->entlen, UIO_READ, uiop);
3863
3864		/*
3865		 * If no error occurred during the copyout,
3866		 * update the offset in the uio struct to
3867		 * contain the value of the next cookie
3868		 * and set the eof value appropriately.
3869		 */
3870		if (!error) {
3871			uiop->uio_loffset = rdc->nfs3_ncookie;
3872			if (eofp)
3873				*eofp = rdc->eof;
3874		}
3875
3876		/*
3877		 * Decide whether to do readahead.
3878		 *
3879		 * Don't if have already read to the end of
3880		 * directory.  There is nothing more to read.
3881		 *
3882		 * Don't if the application is not doing
3883		 * lookups in the directory.  The readahead
3884		 * is only effective if the application can
3885		 * be doing work while an async thread is
3886		 * handling the over the wire request.
3887		 */
3888		if (rdc->eof) {
3889			rp->r_direof = rdc;
3890			doreadahead = FALSE;
3891		} else if (!(rp->r_flags & RLOOKUP))
3892			doreadahead = FALSE;
3893		else
3894			doreadahead = TRUE;
3895
3896		if (!doreadahead) {
3897			mutex_exit(&rp->r_statelock);
3898			rddir_cache_rele(rdc);
3899			if (nrdc != NULL)
3900				rddir_cache_rele(nrdc);
3901			return (error);
3902		}
3903
3904		/*
3905		 * Check to see whether we found an entry
3906		 * for the readahead.  If so, we don't need
3907		 * to do anything further, so free the new
3908		 * entry if one was allocated.  Otherwise,
3909		 * allocate a new entry, add it to the cache,
3910		 * and then initiate an asynchronous readdir
3911		 * operation to fill it.
3912		 */
3913		srdc.nfs3_cookie = rdc->nfs3_ncookie;
3914		srdc.buflen = count;
3915		rrdc = avl_find(&rp->r_dir, &srdc, &where);
3916		if (rrdc != NULL) {
3917			if (nrdc != NULL)
3918				rddir_cache_rele(nrdc);
3919		} else {
3920			if (nrdc != NULL)
3921				rrdc = nrdc;
3922			else {
3923				rrdc = rddir_cache_alloc(KM_NOSLEEP);
3924			}
3925			if (rrdc != NULL) {
3926				rrdc->nfs3_cookie = rdc->nfs3_ncookie;
3927				rrdc->buflen = count;
3928				avl_insert(&rp->r_dir, rrdc, where);
3929				rddir_cache_hold(rrdc);
3930				mutex_exit(&rp->r_statelock);
3931				rddir_cache_rele(rdc);
3932#ifdef DEBUG
3933				nfs3_readdir_readahead++;
3934#endif
3935				nfs_async_readdir(vp, rrdc, cr, do_nfs3readdir);
3936				return (error);
3937			}
3938		}
3939
3940		mutex_exit(&rp->r_statelock);
3941		rddir_cache_rele(rdc);
3942		return (error);
3943	}
3944
3945	/*
3946	 * Didn't find an entry in the cache.  Construct a new empty
3947	 * entry and link it into the cache.  Other processes attempting
3948	 * to access this entry will need to wait until it is filled in.
3949	 *
3950	 * Since kmem_alloc may block, another pass through the cache
3951	 * will need to be taken to make sure that another process
3952	 * hasn't already added an entry to the cache for this request.
3953	 */
3954	if (nrdc == NULL) {
3955		mutex_exit(&rp->r_statelock);
3956		nrdc = rddir_cache_alloc(KM_SLEEP);
3957		nrdc->nfs3_cookie = uiop->uio_loffset;
3958		nrdc->buflen = count;
3959		goto top;
3960	}
3961
3962	/*
3963	 * Add this entry to the cache.
3964	 */
3965	avl_insert(&rp->r_dir, nrdc, where);
3966	rddir_cache_hold(nrdc);
3967	mutex_exit(&rp->r_statelock);
3968
3969bottom:
3970#ifdef DEBUG
3971	missed = 1;
3972	nfs3_readdir_cache_misses++;
3973#endif
3974	/*
3975	 * Do the readdir.  This routine decides whether to use
3976	 * READDIR or READDIRPLUS.
3977	 */
3978	error = do_nfs3readdir(vp, nrdc, cr);
3979
3980	/*
3981	 * If this operation failed, just return the error which occurred.
3982	 */
3983	if (error != 0)
3984		return (error);
3985
3986	/*
3987	 * Since the RPC operation will have taken sometime and blocked
3988	 * this process, another pass through the cache will need to be
3989	 * taken to find the correct cache entry.  It is possible that
3990	 * the correct cache entry will not be there (although one was
3991	 * added) because the directory changed during the RPC operation
3992	 * and the readdir cache was flushed.  In this case, just start
3993	 * over.  It is hoped that this will not happen too often... :-)
3994	 */
3995	nrdc = NULL;
3996	goto top;
3997	/* NOTREACHED */
3998}
3999
4000static int
4001do_nfs3readdir(vnode_t *vp, rddir_cache *rdc, cred_t *cr)
4002{
4003	int error;
4004	rnode_t *rp;
4005	mntinfo_t *mi;
4006
4007	rp = VTOR(vp);
4008	mi = VTOMI(vp);
4009	ASSERT(nfs_zone() == mi->mi_zone);
4010	/*
4011	 * Issue the proper request.
4012	 *
4013	 * If the server does not support READDIRPLUS, then use READDIR.
4014	 *
4015	 * Otherwise --
4016	 * Issue a READDIRPLUS if reading to fill an empty cache or if
4017	 * an application has performed a lookup in the directory which
4018	 * required an over the wire lookup.  The use of READDIRPLUS
4019	 * will help to (re)populate the DNLC.
4020	 */
4021	if (!(mi->mi_flags & MI_READDIRONLY) &&
4022	    (rp->r_flags & (RLOOKUP | RREADDIRPLUS))) {
4023		if (rp->r_flags & RREADDIRPLUS) {
4024			mutex_enter(&rp->r_statelock);
4025			rp->r_flags &= ~RREADDIRPLUS;
4026			mutex_exit(&rp->r_statelock);
4027		}
4028		nfs3readdirplus(vp, rdc, cr);
4029		if (rdc->error == EOPNOTSUPP)
4030			nfs3readdir(vp, rdc, cr);
4031	} else
4032		nfs3readdir(vp, rdc, cr);
4033
4034	mutex_enter(&rp->r_statelock);
4035	rdc->flags &= ~RDDIR;
4036	if (rdc->flags & RDDIRWAIT) {
4037		rdc->flags &= ~RDDIRWAIT;
4038		cv_broadcast(&rdc->cv);
4039	}
4040	error = rdc->error;
4041	if (error)
4042		rdc->flags |= RDDIRREQ;
4043	mutex_exit(&rp->r_statelock);
4044
4045	rddir_cache_rele(rdc);
4046
4047	return (error);
4048}
4049
4050static void
4051nfs3readdir(vnode_t *vp, rddir_cache *rdc, cred_t *cr)
4052{
4053	int error;
4054	READDIR3args args;
4055	READDIR3vres res;
4056	vattr_t dva;
4057	rnode_t *rp;
4058	int douprintf;
4059	failinfo_t fi, *fip = NULL;
4060	mntinfo_t *mi;
4061	hrtime_t t;
4062
4063	rp = VTOR(vp);
4064	mi = VTOMI(vp);
4065	ASSERT(nfs_zone() == mi->mi_zone);
4066
4067	args.dir = *RTOFH3(rp);
4068	args.cookie = (cookie3)rdc->nfs3_cookie;
4069	args.cookieverf = rp->r_cookieverf;
4070	args.count = rdc->buflen;
4071
4072	/*
4073	 * NFS client failover support
4074	 * suppress failover unless we have a zero cookie
4075	 */
4076	if (args.cookie == (cookie3) 0) {
4077		fi.vp = vp;
4078		fi.fhp = (caddr_t)&args.dir;
4079		fi.copyproc = nfs3copyfh;
4080		fi.lookupproc = nfs3lookup;
4081		fi.xattrdirproc = acl_getxattrdir3;
4082		fip = &fi;
4083	}
4084
4085#ifdef DEBUG
4086	rdc->entries = rddir_cache_buf_alloc(rdc->buflen, KM_SLEEP);
4087#else
4088	rdc->entries = kmem_alloc(rdc->buflen, KM_SLEEP);
4089#endif
4090
4091	res.entries = (dirent64_t *)rdc->entries;
4092	res.entries_size = rdc->buflen;
4093	res.dir_attributes.fres.vap = &dva;
4094	res.dir_attributes.fres.vp = vp;
4095	res.loff = rdc->nfs3_cookie;
4096
4097	douprintf = 1;
4098
4099	if (mi->mi_io_kstats) {
4100		mutex_enter(&mi->mi_lock);
4101		kstat_runq_enter(KSTAT_IO_PTR(mi->mi_io_kstats));
4102		mutex_exit(&mi->mi_lock);
4103	}
4104
4105	t = gethrtime();
4106
4107	error = rfs3call(VTOMI(vp), NFSPROC3_READDIR,
4108	    xdr_READDIR3args, (caddr_t)&args,
4109	    xdr_READDIR3vres, (caddr_t)&res, cr,
4110	    &douprintf, &res.status, 0, fip);
4111
4112	if (mi->mi_io_kstats) {
4113		mutex_enter(&mi->mi_lock);
4114		kstat_runq_exit(KSTAT_IO_PTR(mi->mi_io_kstats));
4115		mutex_exit(&mi->mi_lock);
4116	}
4117
4118	if (error)
4119		goto err;
4120
4121	nfs3_cache_post_op_vattr(vp, &res.dir_attributes, t, cr);
4122
4123	error = geterrno3(res.status);
4124	if (error) {
4125		PURGE_STALE_FH(error, vp, cr);
4126		goto err;
4127	}
4128
4129	if (mi->mi_io_kstats) {
4130		mutex_enter(&mi->mi_lock);
4131		KSTAT_IO_PTR(mi->mi_io_kstats)->reads++;
4132		KSTAT_IO_PTR(mi->mi_io_kstats)->nread += res.size;
4133		mutex_exit(&mi->mi_lock);
4134	}
4135
4136	rdc->nfs3_ncookie = res.loff;
4137	rp->r_cookieverf = res.cookieverf;
4138	rdc->eof = res.eof ? 1 : 0;
4139	rdc->entlen = res.size;
4140	ASSERT(rdc->entlen <= rdc->buflen);
4141	rdc->error = 0;
4142	return;
4143
4144err:
4145	kmem_free(rdc->entries, rdc->buflen);
4146	rdc->entries = NULL;
4147	rdc->error = error;
4148}
4149
4150/*
4151 * Read directory entries.
4152 * There are some weird things to look out for here.  The uio_loffset
4153 * field is either 0 or it is the offset returned from a previous
4154 * readdir.  It is an opaque value used by the server to find the
4155 * correct directory block to read. The count field is the number
4156 * of blocks to read on the server.  This is advisory only, the server
4157 * may return only one block's worth of entries.  Entries may be compressed
4158 * on the server.
4159 */
4160static void
4161nfs3readdirplus(vnode_t *vp, rddir_cache *rdc, cred_t *cr)
4162{
4163	int error;
4164	READDIRPLUS3args args;
4165	READDIRPLUS3vres res;
4166	vattr_t dva;
4167	rnode_t *rp;
4168	mntinfo_t *mi;
4169	int douprintf;
4170	failinfo_t fi, *fip = NULL;
4171
4172	rp = VTOR(vp);
4173	mi = VTOMI(vp);
4174	ASSERT(nfs_zone() == mi->mi_zone);
4175
4176	args.dir = *RTOFH3(rp);
4177	args.cookie = (cookie3)rdc->nfs3_cookie;
4178	args.cookieverf = rp->r_cookieverf;
4179	args.dircount = rdc->buflen;
4180	args.maxcount = mi->mi_tsize;
4181
4182	/*
4183	 * NFS client failover support
4184	 * suppress failover unless we have a zero cookie
4185	 */
4186	if (args.cookie == (cookie3)0) {
4187		fi.vp = vp;
4188		fi.fhp = (caddr_t)&args.dir;
4189		fi.copyproc = nfs3copyfh;
4190		fi.lookupproc = nfs3lookup;
4191		fi.xattrdirproc = acl_getxattrdir3;
4192		fip = &fi;
4193	}
4194
4195#ifdef DEBUG
4196	rdc->entries = rddir_cache_buf_alloc(rdc->buflen, KM_SLEEP);
4197#else
4198	rdc->entries = kmem_alloc(rdc->buflen, KM_SLEEP);
4199#endif
4200
4201	res.entries = (dirent64_t *)rdc->entries;
4202	res.entries_size = rdc->buflen;
4203	res.dir_attributes.fres.vap = &dva;
4204	res.dir_attributes.fres.vp = vp;
4205	res.loff = rdc->nfs3_cookie;
4206	res.credentials = cr;
4207
4208	douprintf = 1;
4209
4210	if (mi->mi_io_kstats) {
4211		mutex_enter(&mi->mi_lock);
4212		kstat_runq_enter(KSTAT_IO_PTR(mi->mi_io_kstats));
4213		mutex_exit(&mi->mi_lock);
4214	}
4215
4216	res.time = gethrtime();
4217
4218	error = rfs3call(mi, NFSPROC3_READDIRPLUS,
4219	    xdr_READDIRPLUS3args, (caddr_t)&args,
4220	    xdr_READDIRPLUS3vres, (caddr_t)&res, cr,
4221	    &douprintf, &res.status, 0, fip);
4222
4223	if (mi->mi_io_kstats) {
4224		mutex_enter(&mi->mi_lock);
4225		kstat_runq_exit(KSTAT_IO_PTR(mi->mi_io_kstats));
4226		mutex_exit(&mi->mi_lock);
4227	}
4228
4229	if (error) {
4230		goto err;
4231	}
4232
4233	nfs3_cache_post_op_vattr(vp, &res.dir_attributes, res.time, cr);
4234
4235	error = geterrno3(res.status);
4236	if (error) {
4237		PURGE_STALE_FH(error, vp, cr);
4238		if (error == EOPNOTSUPP) {
4239			mutex_enter(&mi->mi_lock);
4240			mi->mi_flags |= MI_READDIRONLY;
4241			mutex_exit(&mi->mi_lock);
4242		}
4243		goto err;
4244	}
4245
4246	if (mi->mi_io_kstats) {
4247		mutex_enter(&mi->mi_lock);
4248		KSTAT_IO_PTR(mi->mi_io_kstats)->reads++;
4249		KSTAT_IO_PTR(mi->mi_io_kstats)->nread += res.size;
4250		mutex_exit(&mi->mi_lock);
4251	}
4252
4253	rdc->nfs3_ncookie = res.loff;
4254	rp->r_cookieverf = res.cookieverf;
4255	rdc->eof = res.eof ? 1 : 0;
4256	rdc->entlen = res.size;
4257	ASSERT(rdc->entlen <= rdc->buflen);
4258	rdc->error = 0;
4259
4260	return;
4261
4262err:
4263	kmem_free(rdc->entries, rdc->buflen);
4264	rdc->entries = NULL;
4265	rdc->error = error;
4266}
4267
4268#ifdef DEBUG
4269static int nfs3_bio_do_stop = 0;
4270#endif
4271
4272static int
4273nfs3_bio(struct buf *bp, stable_how *stab_comm, cred_t *cr)
4274{
4275	rnode_t *rp = VTOR(bp->b_vp);
4276	int count;
4277	int error;
4278	cred_t *cred;
4279	offset_t offset;
4280
4281	ASSERT(nfs_zone() == VTOMI(bp->b_vp)->mi_zone);
4282	offset = ldbtob(bp->b_lblkno);
4283
4284	DTRACE_IO1(start, struct buf *, bp);
4285
4286	if (bp->b_flags & B_READ) {
4287		mutex_enter(&rp->r_statelock);
4288		if (rp->r_cred != NULL) {
4289			cred = rp->r_cred;
4290			crhold(cred);
4291		} else {
4292			rp->r_cred = cr;
4293			crhold(cr);
4294			cred = cr;
4295			crhold(cred);
4296		}
4297		mutex_exit(&rp->r_statelock);
4298	read_again:
4299		error = bp->b_error = nfs3read(bp->b_vp, bp->b_un.b_addr,
4300		    offset, bp->b_bcount, &bp->b_resid, cred);
4301		crfree(cred);
4302		if (!error) {
4303			if (bp->b_resid) {
4304				/*
4305				 * Didn't get it all because we hit EOF,
4306				 * zero all the memory beyond the EOF.
4307				 */
4308				/* bzero(rdaddr + */
4309				bzero(bp->b_un.b_addr +
4310				    bp->b_bcount - bp->b_resid, bp->b_resid);
4311			}
4312			mutex_enter(&rp->r_statelock);
4313			if (bp->b_resid == bp->b_bcount &&
4314			    offset >= rp->r_size) {
4315				/*
4316				 * We didn't read anything at all as we are
4317				 * past EOF.  Return an error indicator back
4318				 * but don't destroy the pages (yet).
4319				 */
4320				error = NFS_EOF;
4321			}
4322			mutex_exit(&rp->r_statelock);
4323		} else if (error == EACCES) {
4324			mutex_enter(&rp->r_statelock);
4325			if (cred != cr) {
4326				if (rp->r_cred != NULL)
4327					crfree(rp->r_cred);
4328				rp->r_cred = cr;
4329				crhold(cr);
4330				cred = cr;
4331				crhold(cred);
4332				mutex_exit(&rp->r_statelock);
4333				goto read_again;
4334			}
4335			mutex_exit(&rp->r_statelock);
4336		}
4337	} else {
4338		if (!(rp->r_flags & RSTALE)) {
4339			mutex_enter(&rp->r_statelock);
4340			if (rp->r_cred != NULL) {
4341				cred = rp->r_cred;
4342				crhold(cred);
4343			} else {
4344				rp->r_cred = cr;
4345				crhold(cr);
4346				cred = cr;
4347				crhold(cred);
4348			}
4349			mutex_exit(&rp->r_statelock);
4350		write_again:
4351			mutex_enter(&rp->r_statelock);
4352			count = MIN(bp->b_bcount, rp->r_size - offset);
4353			mutex_exit(&rp->r_statelock);
4354			if (count < 0)
4355				cmn_err(CE_PANIC, "nfs3_bio: write count < 0");
4356#ifdef DEBUG
4357			if (count == 0) {
4358				zcmn_err(getzoneid(), CE_WARN,
4359				    "nfs3_bio: zero length write at %lld",
4360				    offset);
4361				nfs_printfhandle(&rp->r_fh);
4362				if (nfs3_bio_do_stop)
4363					debug_enter("nfs3_bio");
4364			}
4365#endif
4366			error = nfs3write(bp->b_vp, bp->b_un.b_addr, offset,
4367			    count, cred, stab_comm);
4368			if (error == EACCES) {
4369				mutex_enter(&rp->r_statelock);
4370				if (cred != cr) {
4371					if (rp->r_cred != NULL)
4372						crfree(rp->r_cred);
4373					rp->r_cred = cr;
4374					crhold(cr);
4375					crfree(cred);
4376					cred = cr;
4377					crhold(cred);
4378					mutex_exit(&rp->r_statelock);
4379					goto write_again;
4380				}
4381				mutex_exit(&rp->r_statelock);
4382			}
4383			bp->b_error = error;
4384			if (error && error != EINTR) {
4385				/*
4386				 * Don't print EDQUOT errors on the console.
4387				 * Don't print asynchronous EACCES errors.
4388				 * Don't print EFBIG errors.
4389				 * Print all other write errors.
4390				 */
4391				if (error != EDQUOT && error != EFBIG &&
4392				    (error != EACCES ||
4393				    !(bp->b_flags & B_ASYNC)))
4394					nfs_write_error(bp->b_vp, error, cred);
4395				/*
4396				 * Update r_error and r_flags as appropriate.
4397				 * If the error was ESTALE, then mark the
4398				 * rnode as not being writeable and save
4399				 * the error status.  Otherwise, save any
4400				 * errors which occur from asynchronous
4401				 * page invalidations.  Any errors occurring
4402				 * from other operations should be saved
4403				 * by the caller.
4404				 */
4405				mutex_enter(&rp->r_statelock);
4406				if (error == ESTALE) {
4407					rp->r_flags |= RSTALE;
4408					if (!rp->r_error)
4409						rp->r_error = error;
4410				} else if (!rp->r_error &&
4411				    (bp->b_flags &
4412				    (B_INVAL|B_FORCE|B_ASYNC)) ==
4413				    (B_INVAL|B_FORCE|B_ASYNC)) {
4414					rp->r_error = error;
4415				}
4416				mutex_exit(&rp->r_statelock);
4417			}
4418			crfree(cred);
4419		} else {
4420			error = rp->r_error;
4421			/*
4422			 * A close may have cleared r_error, if so,
4423			 * propagate ESTALE error return properly
4424			 */
4425			if (error == 0)
4426				error = ESTALE;
4427		}
4428	}
4429
4430	if (error != 0 && error != NFS_EOF)
4431		bp->b_flags |= B_ERROR;
4432
4433	DTRACE_IO1(done, struct buf *, bp);
4434
4435	return (error);
4436}
4437
4438/* ARGSUSED */
4439static int
4440nfs3_fid(vnode_t *vp, fid_t *fidp, caller_context_t *ct)
4441{
4442	rnode_t *rp;
4443
4444	if (nfs_zone() != VTOMI(vp)->mi_zone)
4445		return (EIO);
4446	rp = VTOR(vp);
4447
4448	if (fidp->fid_len < (ushort_t)rp->r_fh.fh_len) {
4449		fidp->fid_len = rp->r_fh.fh_len;
4450		return (ENOSPC);
4451	}
4452	fidp->fid_len = rp->r_fh.fh_len;
4453	bcopy(rp->r_fh.fh_buf, fidp->fid_data, fidp->fid_len);
4454	return (0);
4455}
4456
4457/* ARGSUSED2 */
4458static int
4459nfs3_rwlock(vnode_t *vp, int write_lock, caller_context_t *ctp)
4460{
4461	rnode_t *rp = VTOR(vp);
4462
4463	if (!write_lock) {
4464		(void) nfs_rw_enter_sig(&rp->r_rwlock, RW_READER, FALSE);
4465		return (V_WRITELOCK_FALSE);
4466	}
4467
4468	if ((rp->r_flags & RDIRECTIO) || (VTOMI(vp)->mi_flags & MI_DIRECTIO)) {
4469		(void) nfs_rw_enter_sig(&rp->r_rwlock, RW_READER, FALSE);
4470		if (rp->r_mapcnt == 0 && !vn_has_cached_data(vp))
4471			return (V_WRITELOCK_FALSE);
4472		nfs_rw_exit(&rp->r_rwlock);
4473	}
4474
4475	(void) nfs_rw_enter_sig(&rp->r_rwlock, RW_WRITER, FALSE);
4476	return (V_WRITELOCK_TRUE);
4477}
4478
4479/* ARGSUSED */
4480static void
4481nfs3_rwunlock(vnode_t *vp, int write_lock, caller_context_t *ctp)
4482{
4483	rnode_t *rp = VTOR(vp);
4484
4485	nfs_rw_exit(&rp->r_rwlock);
4486}
4487
4488/* ARGSUSED */
4489static int
4490nfs3_seek(vnode_t *vp, offset_t ooff, offset_t *noffp, caller_context_t *ct)
4491{
4492
4493	/*
4494	 * Because we stuff the readdir cookie into the offset field
4495	 * someone may attempt to do an lseek with the cookie which
4496	 * we want to succeed.
4497	 */
4498	if (vp->v_type == VDIR)
4499		return (0);
4500	if (*noffp < 0)
4501		return (EINVAL);
4502	return (0);
4503}
4504
4505/*
4506 * number of nfs3_bsize blocks to read ahead.
4507 */
4508static int nfs3_nra = 4;
4509
4510#ifdef DEBUG
4511static int nfs3_lostpage = 0;	/* number of times we lost original page */
4512#endif
4513
4514/*
4515 * Return all the pages from [off..off+len) in file
4516 */
4517/* ARGSUSED */
4518static int
4519nfs3_getpage(vnode_t *vp, offset_t off, size_t len, uint_t *protp,
4520	page_t *pl[], size_t plsz, struct seg *seg, caddr_t addr,
4521	enum seg_rw rw, cred_t *cr, caller_context_t *ct)
4522{
4523	rnode_t *rp;
4524	int error;
4525	mntinfo_t *mi;
4526
4527	if (vp->v_flag & VNOMAP)
4528		return (ENOSYS);
4529
4530	if (nfs_zone() != VTOMI(vp)->mi_zone)
4531		return (EIO);
4532	if (protp != NULL)
4533		*protp = PROT_ALL;
4534
4535	/*
4536	 * Now valididate that the caches are up to date.
4537	 */
4538	error = nfs3_validate_caches(vp, cr);
4539	if (error)
4540		return (error);
4541
4542	rp = VTOR(vp);
4543	mi = VTOMI(vp);
4544retry:
4545	mutex_enter(&rp->r_statelock);
4546
4547	/*
4548	 * Don't create dirty pages faster than they
4549	 * can be cleaned so that the system doesn't
4550	 * get imbalanced.  If the async queue is
4551	 * maxed out, then wait for it to drain before
4552	 * creating more dirty pages.  Also, wait for
4553	 * any threads doing pagewalks in the vop_getattr
4554	 * entry points so that they don't block for
4555	 * long periods.
4556	 */
4557	if (rw == S_CREATE) {
4558		while ((mi->mi_max_threads != 0 &&
4559		    rp->r_awcount > 2 * mi->mi_max_threads) ||
4560		    rp->r_gcount > 0)
4561			cv_wait(&rp->r_cv, &rp->r_statelock);
4562	}
4563
4564	/*
4565	 * If we are getting called as a side effect of an nfs_write()
4566	 * operation the local file size might not be extended yet.
4567	 * In this case we want to be able to return pages of zeroes.
4568	 */
4569	if (off + len > rp->r_size + PAGEOFFSET && seg != segkmap) {
4570		mutex_exit(&rp->r_statelock);
4571		return (EFAULT);		/* beyond EOF */
4572	}
4573
4574	mutex_exit(&rp->r_statelock);
4575
4576	if (len <= PAGESIZE) {
4577		error = nfs3_getapage(vp, off, len, protp, pl, plsz,
4578		    seg, addr, rw, cr);
4579	} else {
4580		error = pvn_getpages(nfs3_getapage, vp, off, len, protp,
4581		    pl, plsz, seg, addr, rw, cr);
4582	}
4583
4584	switch (error) {
4585	case NFS_EOF:
4586		nfs_purge_caches(vp, NFS_NOPURGE_DNLC, cr);
4587		goto retry;
4588	case ESTALE:
4589		PURGE_STALE_FH(error, vp, cr);
4590	}
4591
4592	return (error);
4593}
4594
4595/*
4596 * Called from pvn_getpages or nfs3_getpage to get a particular page.
4597 */
4598/* ARGSUSED */
4599static int
4600nfs3_getapage(vnode_t *vp, u_offset_t off, size_t len, uint_t *protp,
4601	page_t *pl[], size_t plsz, struct seg *seg, caddr_t addr,
4602	enum seg_rw rw, cred_t *cr)
4603{
4604	rnode_t *rp;
4605	uint_t bsize;
4606	struct buf *bp;
4607	page_t *pp;
4608	u_offset_t lbn;
4609	u_offset_t io_off;
4610	u_offset_t blkoff;
4611	u_offset_t rablkoff;
4612	size_t io_len;
4613	uint_t blksize;
4614	int error;
4615	int readahead;
4616	int readahead_issued = 0;
4617	int ra_window; /* readahead window */
4618	page_t *pagefound;
4619	page_t *savepp;
4620
4621	if (nfs_zone() != VTOMI(vp)->mi_zone)
4622		return (EIO);
4623	rp = VTOR(vp);
4624	bsize = MAX(vp->v_vfsp->vfs_bsize, PAGESIZE);
4625
4626reread:
4627	bp = NULL;
4628	pp = NULL;
4629	pagefound = NULL;
4630
4631	if (pl != NULL)
4632		pl[0] = NULL;
4633
4634	error = 0;
4635	lbn = off / bsize;
4636	blkoff = lbn * bsize;
4637
4638	/*
4639	 * Queueing up the readahead before doing the synchronous read
4640	 * results in a significant increase in read throughput because
4641	 * of the increased parallelism between the async threads and
4642	 * the process context.
4643	 */
4644	if ((off & ((vp->v_vfsp->vfs_bsize) - 1)) == 0 &&
4645	    rw != S_CREATE &&
4646	    !(vp->v_flag & VNOCACHE)) {
4647		mutex_enter(&rp->r_statelock);
4648
4649		/*
4650		 * Calculate the number of readaheads to do.
4651		 * a) No readaheads at offset = 0.
4652		 * b) Do maximum(nfs3_nra) readaheads when the readahead
4653		 *    window is closed.
4654		 * c) Do readaheads between 1 to (nfs3_nra - 1) depending
4655		 *    upon how far the readahead window is open or close.
4656		 * d) No readaheads if rp->r_nextr is not within the scope
4657		 *    of the readahead window (random i/o).
4658		 */
4659
4660		if (off == 0)
4661			readahead = 0;
4662		else if (blkoff == rp->r_nextr)
4663			readahead = nfs3_nra;
4664		else if (rp->r_nextr > blkoff &&
4665		    ((ra_window = (rp->r_nextr - blkoff) / bsize)
4666		    <= (nfs3_nra - 1)))
4667			readahead = nfs3_nra - ra_window;
4668		else
4669			readahead = 0;
4670
4671		rablkoff = rp->r_nextr;
4672		while (readahead > 0 && rablkoff + bsize < rp->r_size) {
4673			mutex_exit(&rp->r_statelock);
4674			if (nfs_async_readahead(vp, rablkoff + bsize,
4675			    addr + (rablkoff + bsize - off), seg, cr,
4676			    nfs3_readahead) < 0) {
4677				mutex_enter(&rp->r_statelock);
4678				break;
4679			}
4680			readahead--;
4681			rablkoff += bsize;
4682			/*
4683			 * Indicate that we did a readahead so
4684			 * readahead offset is not updated
4685			 * by the synchronous read below.
4686			 */
4687			readahead_issued = 1;
4688			mutex_enter(&rp->r_statelock);
4689			/*
4690			 * set readahead offset to
4691			 * offset of last async readahead
4692			 * request.
4693			 */
4694			rp->r_nextr = rablkoff;
4695		}
4696		mutex_exit(&rp->r_statelock);
4697	}
4698
4699again:
4700	if ((pagefound = page_exists(vp, off)) == NULL) {
4701		if (pl == NULL) {
4702			(void) nfs_async_readahead(vp, blkoff, addr, seg, cr,
4703			    nfs3_readahead);
4704		} else if (rw == S_CREATE) {
4705			/*
4706			 * Block for this page is not allocated, or the offset
4707			 * is beyond the current allocation size, or we're
4708			 * allocating a swap slot and the page was not found,
4709			 * so allocate it and return a zero page.
4710			 */
4711			if ((pp = page_create_va(vp, off,
4712			    PAGESIZE, PG_WAIT, seg, addr)) == NULL)
4713				cmn_err(CE_PANIC, "nfs3_getapage: page_create");
4714			io_len = PAGESIZE;
4715			mutex_enter(&rp->r_statelock);
4716			rp->r_nextr = off + PAGESIZE;
4717			mutex_exit(&rp->r_statelock);
4718		} else {
4719			/*
4720			 * Need to go to server to get a BLOCK, exception to
4721			 * that being while reading at offset = 0 or doing
4722			 * random i/o, in that case read only a PAGE.
4723			 */
4724			mutex_enter(&rp->r_statelock);
4725			if (blkoff < rp->r_size &&
4726			    blkoff + bsize >= rp->r_size) {
4727				/*
4728				 * If only a block or less is left in
4729				 * the file, read all that is remaining.
4730				 */
4731				if (rp->r_size <= off) {
4732					/*
4733					 * Trying to access beyond EOF,
4734					 * set up to get at least one page.
4735					 */
4736					blksize = off + PAGESIZE - blkoff;
4737				} else
4738					blksize = rp->r_size - blkoff;
4739			} else if ((off == 0) ||
4740			    (off != rp->r_nextr && !readahead_issued)) {
4741				blksize = PAGESIZE;
4742				blkoff = off; /* block = page here */
4743			} else
4744				blksize = bsize;
4745			mutex_exit(&rp->r_statelock);
4746
4747			pp = pvn_read_kluster(vp, off, seg, addr, &io_off,
4748			    &io_len, blkoff, blksize, 0);
4749
4750			/*
4751			 * Some other thread has entered the page,
4752			 * so just use it.
4753			 */
4754			if (pp == NULL)
4755				goto again;
4756
4757			/*
4758			 * Now round the request size up to page boundaries.
4759			 * This ensures that the entire page will be
4760			 * initialized to zeroes if EOF is encountered.
4761			 */
4762			io_len = ptob(btopr(io_len));
4763
4764			bp = pageio_setup(pp, io_len, vp, B_READ);
4765			ASSERT(bp != NULL);
4766
4767			/*
4768			 * pageio_setup should have set b_addr to 0.  This
4769			 * is correct since we want to do I/O on a page
4770			 * boundary.  bp_mapin will use this addr to calculate
4771			 * an offset, and then set b_addr to the kernel virtual
4772			 * address it allocated for us.
4773			 */
4774			ASSERT(bp->b_un.b_addr == 0);
4775
4776			bp->b_edev = 0;
4777			bp->b_dev = 0;
4778			bp->b_lblkno = lbtodb(io_off);
4779			bp->b_file = vp;
4780			bp->b_offset = (offset_t)off;
4781			bp_mapin(bp);
4782
4783			/*
4784			 * If doing a write beyond what we believe is EOF,
4785			 * don't bother trying to read the pages from the
4786			 * server, we'll just zero the pages here.  We
4787			 * don't check that the rw flag is S_WRITE here
4788			 * because some implementations may attempt a
4789			 * read access to the buffer before copying data.
4790			 */
4791			mutex_enter(&rp->r_statelock);
4792			if (io_off >= rp->r_size && seg == segkmap) {
4793				mutex_exit(&rp->r_statelock);
4794				bzero(bp->b_un.b_addr, io_len);
4795			} else {
4796				mutex_exit(&rp->r_statelock);
4797				error = nfs3_bio(bp, NULL, cr);
4798			}
4799
4800			/*
4801			 * Unmap the buffer before freeing it.
4802			 */
4803			bp_mapout(bp);
4804			pageio_done(bp);
4805
4806			savepp = pp;
4807			do {
4808				pp->p_fsdata = C_NOCOMMIT;
4809			} while ((pp = pp->p_next) != savepp);
4810
4811			if (error == NFS_EOF) {
4812				/*
4813				 * If doing a write system call just return
4814				 * zeroed pages, else user tried to get pages
4815				 * beyond EOF, return error.  We don't check
4816				 * that the rw flag is S_WRITE here because
4817				 * some implementations may attempt a read
4818				 * access to the buffer before copying data.
4819				 */
4820				if (seg == segkmap)
4821					error = 0;
4822				else
4823					error = EFAULT;
4824			}
4825
4826			if (!readahead_issued && !error) {
4827				mutex_enter(&rp->r_statelock);
4828				rp->r_nextr = io_off + io_len;
4829				mutex_exit(&rp->r_statelock);
4830			}
4831		}
4832	}
4833
4834out:
4835	if (pl == NULL)
4836		return (error);
4837
4838	if (error) {
4839		if (pp != NULL)
4840			pvn_read_done(pp, B_ERROR);
4841		return (error);
4842	}
4843
4844	if (pagefound) {
4845		se_t se = (rw == S_CREATE ? SE_EXCL : SE_SHARED);
4846
4847		/*
4848		 * Page exists in the cache, acquire the appropriate lock.
4849		 * If this fails, start all over again.
4850		 */
4851		if ((pp = page_lookup(vp, off, se)) == NULL) {
4852#ifdef DEBUG
4853			nfs3_lostpage++;
4854#endif
4855			goto reread;
4856		}
4857		pl[0] = pp;
4858		pl[1] = NULL;
4859		return (0);
4860	}
4861
4862	if (pp != NULL)
4863		pvn_plist_init(pp, pl, plsz, off, io_len, rw);
4864
4865	return (error);
4866}
4867
4868static void
4869nfs3_readahead(vnode_t *vp, u_offset_t blkoff, caddr_t addr, struct seg *seg,
4870	cred_t *cr)
4871{
4872	int error;
4873	page_t *pp;
4874	u_offset_t io_off;
4875	size_t io_len;
4876	struct buf *bp;
4877	uint_t bsize, blksize;
4878	rnode_t *rp = VTOR(vp);
4879	page_t *savepp;
4880
4881	ASSERT(nfs_zone() == VTOMI(vp)->mi_zone);
4882	bsize = MAX(vp->v_vfsp->vfs_bsize, PAGESIZE);
4883
4884	mutex_enter(&rp->r_statelock);
4885	if (blkoff < rp->r_size && blkoff + bsize > rp->r_size) {
4886		/*
4887		 * If less than a block left in file read less
4888		 * than a block.
4889		 */
4890		blksize = rp->r_size - blkoff;
4891	} else
4892		blksize = bsize;
4893	mutex_exit(&rp->r_statelock);
4894
4895	pp = pvn_read_kluster(vp, blkoff, segkmap, addr,
4896	    &io_off, &io_len, blkoff, blksize, 1);
4897	/*
4898	 * The isra flag passed to the kluster function is 1, we may have
4899	 * gotten a return value of NULL for a variety of reasons (# of free
4900	 * pages < minfree, someone entered the page on the vnode etc). In all
4901	 * cases, we want to punt on the readahead.
4902	 */
4903	if (pp == NULL)
4904		return;
4905
4906	/*
4907	 * Now round the request size up to page boundaries.
4908	 * This ensures that the entire page will be
4909	 * initialized to zeroes if EOF is encountered.
4910	 */
4911	io_len = ptob(btopr(io_len));
4912
4913	bp = pageio_setup(pp, io_len, vp, B_READ);
4914	ASSERT(bp != NULL);
4915
4916	/*
4917	 * pageio_setup should have set b_addr to 0.  This is correct since
4918	 * we want to do I/O on a page boundary. bp_mapin() will use this addr
4919	 * to calculate an offset, and then set b_addr to the kernel virtual
4920	 * address it allocated for us.
4921	 */
4922	ASSERT(bp->b_un.b_addr == 0);
4923
4924	bp->b_edev = 0;
4925	bp->b_dev = 0;
4926	bp->b_lblkno = lbtodb(io_off);
4927	bp->b_file = vp;
4928	bp->b_offset = (offset_t)blkoff;
4929	bp_mapin(bp);
4930
4931	/*
4932	 * If doing a write beyond what we believe is EOF, don't bother trying
4933	 * to read the pages from the server, we'll just zero the pages here.
4934	 * We don't check that the rw flag is S_WRITE here because some
4935	 * implementations may attempt a read access to the buffer before
4936	 * copying data.
4937	 */
4938	mutex_enter(&rp->r_statelock);
4939	if (io_off >= rp->r_size && seg == segkmap) {
4940		mutex_exit(&rp->r_statelock);
4941		bzero(bp->b_un.b_addr, io_len);
4942		error = 0;
4943	} else {
4944		mutex_exit(&rp->r_statelock);
4945		error = nfs3_bio(bp, NULL, cr);
4946		if (error == NFS_EOF)
4947			error = 0;
4948	}
4949
4950	/*
4951	 * Unmap the buffer before freeing it.
4952	 */
4953	bp_mapout(bp);
4954	pageio_done(bp);
4955
4956	savepp = pp;
4957	do {
4958		pp->p_fsdata = C_NOCOMMIT;
4959	} while ((pp = pp->p_next) != savepp);
4960
4961	pvn_read_done(pp, error ? B_READ | B_ERROR : B_READ);
4962
4963	/*
4964	 * In case of error set readahead offset
4965	 * to the lowest offset.
4966	 * pvn_read_done() calls VN_DISPOSE to destroy the pages
4967	 */
4968	if (error && rp->r_nextr > io_off) {
4969		mutex_enter(&rp->r_statelock);
4970		if (rp->r_nextr > io_off)
4971			rp->r_nextr = io_off;
4972		mutex_exit(&rp->r_statelock);
4973	}
4974}
4975
4976/*
4977 * Flags are composed of {B_INVAL, B_FREE, B_DONTNEED, B_FORCE}
4978 * If len == 0, do from off to EOF.
4979 *
4980 * The normal cases should be len == 0 && off == 0 (entire vp list),
4981 * len == MAXBSIZE (from segmap_release actions), and len == PAGESIZE
4982 * (from pageout).
4983 */
4984/* ARGSUSED */
4985static int
4986nfs3_putpage(vnode_t *vp, offset_t off, size_t len, int flags, cred_t *cr,
4987	caller_context_t *ct)
4988{
4989	int error;
4990	rnode_t *rp;
4991
4992	ASSERT(cr != NULL);
4993
4994	/*
4995	 * XXX - Why should this check be made here?
4996	 */
4997	if (vp->v_flag & VNOMAP)
4998		return (ENOSYS);
4999	if (len == 0 && !(flags & B_INVAL) && vn_is_readonly(vp))
5000		return (0);
5001	if (!(flags & B_ASYNC) && nfs_zone() != VTOMI(vp)->mi_zone)
5002		return (EIO);
5003
5004	rp = VTOR(vp);
5005	mutex_enter(&rp->r_statelock);
5006	rp->r_count++;
5007	mutex_exit(&rp->r_statelock);
5008	error = nfs_putpages(vp, off, len, flags, cr);
5009	mutex_enter(&rp->r_statelock);
5010	rp->r_count--;
5011	cv_broadcast(&rp->r_cv);
5012	mutex_exit(&rp->r_statelock);
5013
5014	return (error);
5015}
5016
5017/*
5018 * Write out a single page, possibly klustering adjacent dirty pages.
5019 */
5020int
5021nfs3_putapage(vnode_t *vp, page_t *pp, u_offset_t *offp, size_t *lenp,
5022	int flags, cred_t *cr)
5023{
5024	u_offset_t io_off;
5025	u_offset_t lbn_off;
5026	u_offset_t lbn;
5027	size_t io_len;
5028	uint_t bsize;
5029	int error;
5030	rnode_t *rp;
5031
5032	ASSERT(!vn_is_readonly(vp));
5033	ASSERT(pp != NULL);
5034	ASSERT(cr != NULL);
5035	ASSERT((flags & B_ASYNC) || nfs_zone() == VTOMI(vp)->mi_zone);
5036
5037	rp = VTOR(vp);
5038	ASSERT(rp->r_count > 0);
5039
5040	bsize = MAX(vp->v_vfsp->vfs_bsize, PAGESIZE);
5041	lbn = pp->p_offset / bsize;
5042	lbn_off = lbn * bsize;
5043
5044	/*
5045	 * Find a kluster that fits in one block, or in
5046	 * one page if pages are bigger than blocks.  If
5047	 * there is less file space allocated than a whole
5048	 * page, we'll shorten the i/o request below.
5049	 */
5050	pp = pvn_write_kluster(vp, pp, &io_off, &io_len, lbn_off,
5051	    roundup(bsize, PAGESIZE), flags);
5052
5053	/*
5054	 * pvn_write_kluster shouldn't have returned a page with offset
5055	 * behind the original page we were given.  Verify that.
5056	 */
5057	ASSERT((pp->p_offset / bsize) >= lbn);
5058
5059	/*
5060	 * Now pp will have the list of kept dirty pages marked for
5061	 * write back.  It will also handle invalidation and freeing
5062	 * of pages that are not dirty.  Check for page length rounding
5063	 * problems.
5064	 */
5065	if (io_off + io_len > lbn_off + bsize) {
5066		ASSERT((io_off + io_len) - (lbn_off + bsize) < PAGESIZE);
5067		io_len = lbn_off + bsize - io_off;
5068	}
5069	/*
5070	 * The RMODINPROGRESS flag makes sure that nfs(3)_bio() sees a
5071	 * consistent value of r_size. RMODINPROGRESS is set in writerp().
5072	 * When RMODINPROGRESS is set it indicates that a uiomove() is in
5073	 * progress and the r_size has not been made consistent with the
5074	 * new size of the file. When the uiomove() completes the r_size is
5075	 * updated and the RMODINPROGRESS flag is cleared.
5076	 *
5077	 * The RMODINPROGRESS flag makes sure that nfs(3)_bio() sees a
5078	 * consistent value of r_size. Without this handshaking, it is
5079	 * possible that nfs(3)_bio() picks  up the old value of r_size
5080	 * before the uiomove() in writerp() completes. This will result
5081	 * in the write through nfs(3)_bio() being dropped.
5082	 *
5083	 * More precisely, there is a window between the time the uiomove()
5084	 * completes and the time the r_size is updated. If a VOP_PUTPAGE()
5085	 * operation intervenes in this window, the page will be picked up,
5086	 * because it is dirty (it will be unlocked, unless it was
5087	 * pagecreate'd). When the page is picked up as dirty, the dirty
5088	 * bit is reset (pvn_getdirty()). In nfs(3)write(), r_size is
5089	 * checked. This will still be the old size. Therefore the page will
5090	 * not be written out. When segmap_release() calls VOP_PUTPAGE(),
5091	 * the page will be found to be clean and the write will be dropped.
5092	 */
5093	if (rp->r_flags & RMODINPROGRESS) {
5094		mutex_enter(&rp->r_statelock);
5095		if ((rp->r_flags & RMODINPROGRESS) &&
5096		    rp->r_modaddr + MAXBSIZE > io_off &&
5097		    rp->r_modaddr < io_off + io_len) {
5098			page_t *plist;
5099			/*
5100			 * A write is in progress for this region of the file.
5101			 * If we did not detect RMODINPROGRESS here then this
5102			 * path through nfs_putapage() would eventually go to
5103			 * nfs(3)_bio() and may not write out all of the data
5104			 * in the pages. We end up losing data. So we decide
5105			 * to set the modified bit on each page in the page
5106			 * list and mark the rnode with RDIRTY. This write
5107			 * will be restarted at some later time.
5108			 */
5109			plist = pp;
5110			while (plist != NULL) {
5111				pp = plist;
5112				page_sub(&plist, pp);
5113				hat_setmod(pp);
5114				page_io_unlock(pp);
5115				page_unlock(pp);
5116			}
5117			rp->r_flags |= RDIRTY;
5118			mutex_exit(&rp->r_statelock);
5119			if (offp)
5120				*offp = io_off;
5121			if (lenp)
5122				*lenp = io_len;
5123			return (0);
5124		}
5125		mutex_exit(&rp->r_statelock);
5126	}
5127
5128	if (flags & B_ASYNC) {
5129		error = nfs_async_putapage(vp, pp, io_off, io_len, flags, cr,
5130		    nfs3_sync_putapage);
5131	} else
5132		error = nfs3_sync_putapage(vp, pp, io_off, io_len, flags, cr);
5133
5134	if (offp)
5135		*offp = io_off;
5136	if (lenp)
5137		*lenp = io_len;
5138	return (error);
5139}
5140
5141static int
5142nfs3_sync_putapage(vnode_t *vp, page_t *pp, u_offset_t io_off, size_t io_len,
5143	int flags, cred_t *cr)
5144{
5145	int error;
5146	rnode_t *rp;
5147
5148	ASSERT(nfs_zone() == VTOMI(vp)->mi_zone);
5149
5150	flags |= B_WRITE;
5151
5152	error = nfs3_rdwrlbn(vp, pp, io_off, io_len, flags, cr);
5153
5154	rp = VTOR(vp);
5155
5156	if ((error == ENOSPC || error == EDQUOT || error == EFBIG ||
5157	    error == EACCES) &&
5158	    (flags & (B_INVAL|B_FORCE)) != (B_INVAL|B_FORCE)) {
5159		if (!(rp->r_flags & ROUTOFSPACE)) {
5160			mutex_enter(&rp->r_statelock);
5161			rp->r_flags |= ROUTOFSPACE;
5162			mutex_exit(&rp->r_statelock);
5163		}
5164		flags |= B_ERROR;
5165		pvn_write_done(pp, flags);
5166		/*
5167		 * If this was not an async thread, then try again to
5168		 * write out the pages, but this time, also destroy
5169		 * them whether or not the write is successful.  This
5170		 * will prevent memory from filling up with these
5171		 * pages and destroying them is the only alternative
5172		 * if they can't be written out.
5173		 *
5174		 * Don't do this if this is an async thread because
5175		 * when the pages are unlocked in pvn_write_done,
5176		 * some other thread could have come along, locked
5177		 * them, and queued for an async thread.  It would be
5178		 * possible for all of the async threads to be tied
5179		 * up waiting to lock the pages again and they would
5180		 * all already be locked and waiting for an async
5181		 * thread to handle them.  Deadlock.
5182		 */
5183		if (!(flags & B_ASYNC)) {
5184			error = nfs3_putpage(vp, io_off, io_len,
5185			    B_INVAL | B_FORCE, cr, NULL);
5186		}
5187	} else {
5188		if (error)
5189			flags |= B_ERROR;
5190		else if (rp->r_flags & ROUTOFSPACE) {
5191			mutex_enter(&rp->r_statelock);
5192			rp->r_flags &= ~ROUTOFSPACE;
5193			mutex_exit(&rp->r_statelock);
5194		}
5195		pvn_write_done(pp, flags);
5196		if (freemem < desfree)
5197			(void) nfs3_commit_vp(vp, (u_offset_t)0, 0, cr);
5198	}
5199
5200	return (error);
5201}
5202
5203/* ARGSUSED */
5204static int
5205nfs3_map(vnode_t *vp, offset_t off, struct as *as, caddr_t *addrp,
5206	size_t len, uchar_t prot, uchar_t maxprot, uint_t flags,
5207	cred_t *cr, caller_context_t *ct)
5208{
5209	struct segvn_crargs vn_a;
5210	int error;
5211	rnode_t *rp;
5212	struct vattr va;
5213
5214	if (nfs_zone() != VTOMI(vp)->mi_zone)
5215		return (EIO);
5216
5217	if (vp->v_flag & VNOMAP)
5218		return (ENOSYS);
5219
5220	if (off < 0 || off + len < 0)
5221		return (ENXIO);
5222
5223	if (vp->v_type != VREG)
5224		return (ENODEV);
5225
5226	/*
5227	 * If there is cached data and if close-to-open consistency
5228	 * checking is not turned off and if the file system is not
5229	 * mounted readonly, then force an over the wire getattr.
5230	 * Otherwise, just invoke nfs3getattr to get a copy of the
5231	 * attributes.  The attribute cache will be used unless it
5232	 * is timed out and if it is, then an over the wire getattr
5233	 * will be issued.
5234	 */
5235	va.va_mask = AT_ALL;
5236	if (vn_has_cached_data(vp) &&
5237	    !(VTOMI(vp)->mi_flags & MI_NOCTO) && !vn_is_readonly(vp))
5238		error = nfs3_getattr_otw(vp, &va, cr);
5239	else
5240		error = nfs3getattr(vp, &va, cr);
5241	if (error)
5242		return (error);
5243
5244	/*
5245	 * Check to see if the vnode is currently marked as not cachable.
5246	 * This means portions of the file are locked (through VOP_FRLOCK).
5247	 * In this case the map request must be refused.  We use
5248	 * rp->r_lkserlock to avoid a race with concurrent lock requests.
5249	 */
5250	rp = VTOR(vp);
5251
5252	/*
5253	 * Atomically increment r_inmap after acquiring r_rwlock. The
5254	 * idea here is to acquire r_rwlock to block read/write and
5255	 * not to protect r_inmap. r_inmap will inform nfs3_read/write()
5256	 * that we are in nfs3_map(). Now, r_rwlock is acquired in order
5257	 * and we can prevent the deadlock that would have occurred
5258	 * when nfs3_addmap() would have acquired it out of order.
5259	 *
5260	 * Since we are not protecting r_inmap by any lock, we do not
5261	 * hold any lock when we decrement it. We atomically decrement
5262	 * r_inmap after we release r_lkserlock.
5263	 */
5264
5265	if (nfs_rw_enter_sig(&rp->r_rwlock, RW_WRITER, INTR(vp)))
5266		return (EINTR);
5267	atomic_add_int(&rp->r_inmap, 1);
5268	nfs_rw_exit(&rp->r_rwlock);
5269
5270	if (nfs_rw_enter_sig(&rp->r_lkserlock, RW_READER, INTR(vp))) {
5271		atomic_add_int(&rp->r_inmap, -1);
5272		return (EINTR);
5273	}
5274
5275	if (vp->v_flag & VNOCACHE) {
5276		error = EAGAIN;
5277		goto done;
5278	}
5279
5280	/*
5281	 * Don't allow concurrent locks and mapping if mandatory locking is
5282	 * enabled.
5283	 */
5284	if ((flk_has_remote_locks(vp) || lm_has_sleep(vp)) &&
5285	    MANDLOCK(vp, va.va_mode)) {
5286		error = EAGAIN;
5287		goto done;
5288	}
5289
5290	as_rangelock(as);
5291	error = choose_addr(as, addrp, len, off, ADDR_VACALIGN, flags);
5292	if (error != 0) {
5293		as_rangeunlock(as);
5294		goto done;
5295	}
5296
5297	vn_a.vp = vp;
5298	vn_a.offset = off;
5299	vn_a.type = (flags & MAP_TYPE);
5300	vn_a.prot = (uchar_t)prot;
5301	vn_a.maxprot = (uchar_t)maxprot;
5302	vn_a.flags = (flags & ~MAP_TYPE);
5303	vn_a.cred = cr;
5304	vn_a.amp = NULL;
5305	vn_a.szc = 0;
5306	vn_a.lgrp_mem_policy_flags = 0;
5307
5308	error = as_map(as, *addrp, len, segvn_create, &vn_a);
5309	as_rangeunlock(as);
5310
5311done:
5312	nfs_rw_exit(&rp->r_lkserlock);
5313	atomic_add_int(&rp->r_inmap, -1);
5314	return (error);
5315}
5316
5317/* ARGSUSED */
5318static int
5319nfs3_addmap(vnode_t *vp, offset_t off, struct as *as, caddr_t addr,
5320	size_t len, uchar_t prot, uchar_t maxprot, uint_t flags,
5321	cred_t *cr, caller_context_t *ct)
5322{
5323	rnode_t *rp;
5324
5325	if (vp->v_flag & VNOMAP)
5326		return (ENOSYS);
5327	if (nfs_zone() != VTOMI(vp)->mi_zone)
5328		return (EIO);
5329
5330	rp = VTOR(vp);
5331	atomic_add_long((ulong_t *)&rp->r_mapcnt, btopr(len));
5332
5333	return (0);
5334}
5335
5336/* ARGSUSED */
5337static int
5338nfs3_frlock(vnode_t *vp, int cmd, struct flock64 *bfp, int flag,
5339	offset_t offset, struct flk_callback *flk_cbp, cred_t *cr,
5340	caller_context_t *ct)
5341{
5342	netobj lm_fh3;
5343	int rc;
5344	u_offset_t start, end;
5345	rnode_t *rp;
5346	int error = 0, intr = INTR(vp);
5347
5348	if (nfs_zone() != VTOMI(vp)->mi_zone)
5349		return (EIO);
5350	/* check for valid cmd parameter */
5351	if (cmd != F_GETLK && cmd != F_SETLK && cmd != F_SETLKW)
5352		return (EINVAL);
5353
5354	/* Verify l_type. */
5355	switch (bfp->l_type) {
5356	case F_RDLCK:
5357		if (cmd != F_GETLK && !(flag & FREAD))
5358			return (EBADF);
5359		break;
5360	case F_WRLCK:
5361		if (cmd != F_GETLK && !(flag & FWRITE))
5362			return (EBADF);
5363		break;
5364	case F_UNLCK:
5365		intr = 0;
5366		break;
5367
5368	default:
5369		return (EINVAL);
5370	}
5371
5372	/* check the validity of the lock range */
5373	if (rc = flk_convert_lock_data(vp, bfp, &start, &end, offset))
5374		return (rc);
5375	if (rc = flk_check_lock_data(start, end, MAXEND))
5376		return (rc);
5377
5378	/*
5379	 * If the filesystem is mounted using local locking, pass the
5380	 * request off to the local locking code.
5381	 */
5382	if (VTOMI(vp)->mi_flags & MI_LLOCK) {
5383		if (cmd == F_SETLK || cmd == F_SETLKW) {
5384			/*
5385			 * For complete safety, we should be holding
5386			 * r_lkserlock.  However, we can't call
5387			 * lm_safelock and then fs_frlock while
5388			 * holding r_lkserlock, so just invoke
5389			 * lm_safelock and expect that this will
5390			 * catch enough of the cases.
5391			 */
5392			if (!lm_safelock(vp, bfp, cr))
5393				return (EAGAIN);
5394		}
5395		return (fs_frlock(vp, cmd, bfp, flag, offset, flk_cbp, cr, ct));
5396	}
5397
5398	rp = VTOR(vp);
5399
5400	/*
5401	 * Check whether the given lock request can proceed, given the
5402	 * current file mappings.
5403	 */
5404	if (nfs_rw_enter_sig(&rp->r_lkserlock, RW_WRITER, intr))
5405		return (EINTR);
5406	if (cmd == F_SETLK || cmd == F_SETLKW) {
5407		if (!lm_safelock(vp, bfp, cr)) {
5408			rc = EAGAIN;
5409			goto done;
5410		}
5411	}
5412
5413	/*
5414	 * Flush the cache after waiting for async I/O to finish.  For new
5415	 * locks, this is so that the process gets the latest bits from the
5416	 * server.  For unlocks, this is so that other clients see the
5417	 * latest bits once the file has been unlocked.  If currently dirty
5418	 * pages can't be flushed, then don't allow a lock to be set.  But
5419	 * allow unlocks to succeed, to avoid having orphan locks on the
5420	 * server.
5421	 */
5422	if (cmd != F_GETLK) {
5423		mutex_enter(&rp->r_statelock);
5424		while (rp->r_count > 0) {
5425			if (intr) {
5426				klwp_t *lwp = ttolwp(curthread);
5427
5428				if (lwp != NULL)
5429					lwp->lwp_nostop++;
5430				if (cv_wait_sig(&rp->r_cv,
5431				    &rp->r_statelock) == 0) {
5432					if (lwp != NULL)
5433						lwp->lwp_nostop--;
5434					rc = EINTR;
5435					break;
5436				}
5437				if (lwp != NULL)
5438					lwp->lwp_nostop--;
5439			} else
5440				cv_wait(&rp->r_cv, &rp->r_statelock);
5441		}
5442		mutex_exit(&rp->r_statelock);
5443		if (rc != 0)
5444			goto done;
5445		error = nfs3_putpage(vp, (offset_t)0, 0, B_INVAL, cr, ct);
5446		if (error) {
5447			if (error == ENOSPC || error == EDQUOT) {
5448				mutex_enter(&rp->r_statelock);
5449				if (!rp->r_error)
5450					rp->r_error = error;
5451				mutex_exit(&rp->r_statelock);
5452			}
5453			if (bfp->l_type != F_UNLCK) {
5454				rc = ENOLCK;
5455				goto done;
5456			}
5457		}
5458	}
5459
5460	lm_fh3.n_len = VTOFH3(vp)->fh3_length;
5461	lm_fh3.n_bytes = (char *)&(VTOFH3(vp)->fh3_u.data);
5462
5463	/*
5464	 * Call the lock manager to do the real work of contacting
5465	 * the server and obtaining the lock.
5466	 */
5467	rc = lm4_frlock(vp, cmd, bfp, flag, offset, cr, &lm_fh3, flk_cbp);
5468
5469	if (rc == 0)
5470		nfs_lockcompletion(vp, cmd);
5471
5472done:
5473	nfs_rw_exit(&rp->r_lkserlock);
5474	return (rc);
5475}
5476
5477/*
5478 * Free storage space associated with the specified vnode.  The portion
5479 * to be freed is specified by bfp->l_start and bfp->l_len (already
5480 * normalized to a "whence" of 0).
5481 *
5482 * This is an experimental facility whose continued existence is not
5483 * guaranteed.  Currently, we only support the special case
5484 * of l_len == 0, meaning free to end of file.
5485 */
5486/* ARGSUSED */
5487static int
5488nfs3_space(vnode_t *vp, int cmd, struct flock64 *bfp, int flag,
5489	offset_t offset, cred_t *cr, caller_context_t *ct)
5490{
5491	int error;
5492
5493	ASSERT(vp->v_type == VREG);
5494	if (cmd != F_FREESP)
5495		return (EINVAL);
5496	if (nfs_zone() != VTOMI(vp)->mi_zone)
5497		return (EIO);
5498
5499	error = convoff(vp, bfp, 0, offset);
5500	if (!error) {
5501		ASSERT(bfp->l_start >= 0);
5502		if (bfp->l_len == 0) {
5503			struct vattr va;
5504
5505			/*
5506			 * ftruncate should not change the ctime and
5507			 * mtime if we truncate the file to its
5508			 * previous size.
5509			 */
5510			va.va_mask = AT_SIZE;
5511			error = nfs3getattr(vp, &va, cr);
5512			if (error || va.va_size == bfp->l_start)
5513				return (error);
5514			va.va_mask = AT_SIZE;
5515			va.va_size = bfp->l_start;
5516			error = nfs3setattr(vp, &va, 0, cr);
5517		} else
5518			error = EINVAL;
5519	}
5520
5521	return (error);
5522}
5523
5524/* ARGSUSED */
5525static int
5526nfs3_realvp(vnode_t *vp, vnode_t **vpp, caller_context_t *ct)
5527{
5528
5529	return (EINVAL);
5530}
5531
5532/*
5533 * Setup and add an address space callback to do the work of the delmap call.
5534 * The callback will (and must be) deleted in the actual callback function.
5535 *
5536 * This is done in order to take care of the problem that we have with holding
5537 * the address space's a_lock for a long period of time (e.g. if the NFS server
5538 * is down).  Callbacks will be executed in the address space code while the
5539 * a_lock is not held.	Holding the address space's a_lock causes things such
5540 * as ps and fork to hang because they are trying to acquire this lock as well.
5541 */
5542/* ARGSUSED */
5543static int
5544nfs3_delmap(vnode_t *vp, offset_t off, struct as *as, caddr_t addr,
5545	size_t len, uint_t prot, uint_t maxprot, uint_t flags,
5546	cred_t *cr, caller_context_t *ct)
5547{
5548	int			caller_found;
5549	int			error;
5550	rnode_t			*rp;
5551	nfs_delmap_args_t	*dmapp;
5552	nfs_delmapcall_t	*delmap_call;
5553
5554	if (vp->v_flag & VNOMAP)
5555		return (ENOSYS);
5556	/*
5557	 * A process may not change zones if it has NFS pages mmap'ed
5558	 * in, so we can't legitimately get here from the wrong zone.
5559	 */
5560	ASSERT(nfs_zone() == VTOMI(vp)->mi_zone);
5561
5562	rp = VTOR(vp);
5563
5564	/*
5565	 * The way that the address space of this process deletes its mapping
5566	 * of this file is via the following call chains:
5567	 * - as_free()->SEGOP_UNMAP()/segvn_unmap()->VOP_DELMAP()/nfs3_delmap()
5568	 * - as_unmap()->SEGOP_UNMAP()/segvn_unmap()->VOP_DELMAP()/nfs3_delmap()
5569	 *
5570	 * With the use of address space callbacks we are allowed to drop the
5571	 * address space lock, a_lock, while executing the NFS operations that
5572	 * need to go over the wire.  Returning EAGAIN to the caller of this
5573	 * function is what drives the execution of the callback that we add
5574	 * below.  The callback will be executed by the address space code
5575	 * after dropping the a_lock.  When the callback is finished, since
5576	 * we dropped the a_lock, it must be re-acquired and segvn_unmap()
5577	 * is called again on the same segment to finish the rest of the work
5578	 * that needs to happen during unmapping.
5579	 *
5580	 * This action of calling back into the segment driver causes
5581	 * nfs3_delmap() to get called again, but since the callback was
5582	 * already executed at this point, it already did the work and there
5583	 * is nothing left for us to do.
5584	 *
5585	 * To Summarize:
5586	 * - The first time nfs3_delmap is called by the current thread is when
5587	 * we add the caller associated with this delmap to the delmap caller
5588	 * list, add the callback, and return EAGAIN.
5589	 * - The second time in this call chain when nfs3_delmap is called we
5590	 * will find this caller in the delmap caller list and realize there
5591	 * is no more work to do thus removing this caller from the list and
5592	 * returning the error that was set in the callback execution.
5593	 */
5594	caller_found = nfs_find_and_delete_delmapcall(rp, &error);
5595	if (caller_found) {
5596		/*
5597		 * 'error' is from the actual delmap operations.  To avoid
5598		 * hangs, we need to handle the return of EAGAIN differently
5599		 * since this is what drives the callback execution.
5600		 * In this case, we don't want to return EAGAIN and do the
5601		 * callback execution because there are none to execute.
5602		 */
5603		if (error == EAGAIN)
5604			return (0);
5605		else
5606			return (error);
5607	}
5608
5609	/* current caller was not in the list */
5610	delmap_call = nfs_init_delmapcall();
5611
5612	mutex_enter(&rp->r_statelock);
5613	list_insert_tail(&rp->r_indelmap, delmap_call);
5614	mutex_exit(&rp->r_statelock);
5615
5616	dmapp = kmem_alloc(sizeof (nfs_delmap_args_t), KM_SLEEP);
5617
5618	dmapp->vp = vp;
5619	dmapp->off = off;
5620	dmapp->addr = addr;
5621	dmapp->len = len;
5622	dmapp->prot = prot;
5623	dmapp->maxprot = maxprot;
5624	dmapp->flags = flags;
5625	dmapp->cr = cr;
5626	dmapp->caller = delmap_call;
5627
5628	error = as_add_callback(as, nfs3_delmap_callback, dmapp,
5629	    AS_UNMAP_EVENT, addr, len, KM_SLEEP);
5630
5631	return (error ? error : EAGAIN);
5632}
5633
5634/*
5635 * Remove some pages from an mmap'd vnode.  Just update the
5636 * count of pages.  If doing close-to-open, then flush and
5637 * commit all of the pages associated with this file.
5638 * Otherwise, start an asynchronous page flush to write out
5639 * any dirty pages.  This will also associate a credential
5640 * with the rnode which can be used to write the pages.
5641 */
5642/* ARGSUSED */
5643static void
5644nfs3_delmap_callback(struct as *as, void *arg, uint_t event)
5645{
5646	int			error;
5647	rnode_t			*rp;
5648	mntinfo_t		*mi;
5649	nfs_delmap_args_t	*dmapp = (nfs_delmap_args_t *)arg;
5650
5651	rp = VTOR(dmapp->vp);
5652	mi = VTOMI(dmapp->vp);
5653
5654	atomic_add_long((ulong_t *)&rp->r_mapcnt, -btopr(dmapp->len));
5655	ASSERT(rp->r_mapcnt >= 0);
5656
5657	/*
5658	 * Initiate a page flush and potential commit if there are
5659	 * pages, the file system was not mounted readonly, the segment
5660	 * was mapped shared, and the pages themselves were writeable.
5661	 */
5662	if (vn_has_cached_data(dmapp->vp) && !vn_is_readonly(dmapp->vp) &&
5663	    dmapp->flags == MAP_SHARED && (dmapp->maxprot & PROT_WRITE)) {
5664		mutex_enter(&rp->r_statelock);
5665		rp->r_flags |= RDIRTY;
5666		mutex_exit(&rp->r_statelock);
5667		/*
5668		 * If this is a cross-zone access a sync putpage won't work, so
5669		 * the best we can do is try an async putpage.  That seems
5670		 * better than something more draconian such as discarding the
5671		 * dirty pages.
5672		 */
5673		if ((mi->mi_flags & MI_NOCTO) ||
5674		    nfs_zone() != mi->mi_zone)
5675			error = nfs3_putpage(dmapp->vp, dmapp->off, dmapp->len,
5676			    B_ASYNC, dmapp->cr, NULL);
5677		else
5678			error = nfs3_putpage_commit(dmapp->vp, dmapp->off,
5679			    dmapp->len, dmapp->cr);
5680		if (!error) {
5681			mutex_enter(&rp->r_statelock);
5682			error = rp->r_error;
5683			rp->r_error = 0;
5684			mutex_exit(&rp->r_statelock);
5685		}
5686	} else
5687		error = 0;
5688
5689	if ((rp->r_flags & RDIRECTIO) || (mi->mi_flags & MI_DIRECTIO))
5690		(void) nfs3_putpage(dmapp->vp, dmapp->off, dmapp->len,
5691		    B_INVAL, dmapp->cr, NULL);
5692
5693	dmapp->caller->error = error;
5694	(void) as_delete_callback(as, arg);
5695	kmem_free(dmapp, sizeof (nfs_delmap_args_t));
5696}
5697
5698static int nfs3_pathconf_disable_cache = 0;
5699
5700#ifdef DEBUG
5701static int nfs3_pathconf_cache_hits = 0;
5702static int nfs3_pathconf_cache_misses = 0;
5703#endif
5704
5705/* ARGSUSED */
5706static int
5707nfs3_pathconf(vnode_t *vp, int cmd, ulong_t *valp, cred_t *cr,
5708	caller_context_t *ct)
5709{
5710	int error;
5711	PATHCONF3args args;
5712	PATHCONF3res res;
5713	int douprintf;
5714	failinfo_t fi;
5715	rnode_t *rp;
5716	hrtime_t t;
5717
5718	if (nfs_zone() != VTOMI(vp)->mi_zone)
5719		return (EIO);
5720	/*
5721	 * Large file spec - need to base answer on info stored
5722	 * on original FSINFO response.
5723	 */
5724	if (cmd == _PC_FILESIZEBITS) {
5725		unsigned long long ll;
5726		long l = 1;
5727
5728		ll = VTOMI(vp)->mi_maxfilesize;
5729
5730		if (ll == 0) {
5731			*valp = 0;
5732			return (0);
5733		}
5734
5735		if (ll & 0xffffffff00000000) {
5736			l += 32; ll >>= 32;
5737		}
5738		if (ll & 0xffff0000) {
5739			l += 16; ll >>= 16;
5740		}
5741		if (ll & 0xff00) {
5742			l += 8; ll >>= 8;
5743		}
5744		if (ll & 0xf0) {
5745			l += 4; ll >>= 4;
5746		}
5747		if (ll & 0xc) {
5748			l += 2; ll >>= 2;
5749		}
5750		if (ll & 0x2)
5751			l += 2;
5752		else if (ll & 0x1)
5753			l += 1;
5754		*valp = l;
5755		return (0);
5756	}
5757
5758	if (cmd == _PC_ACL_ENABLED) {
5759		*valp = _ACL_ACLENT_ENABLED;
5760		return (0);
5761	}
5762
5763	if (cmd == _PC_XATTR_EXISTS) {
5764		error = 0;
5765		*valp = 0;
5766		if (vp->v_vfsp->vfs_flag & VFS_XATTR) {
5767			vnode_t *avp;
5768			rnode_t *rp;
5769			int error = 0;
5770			mntinfo_t *mi = VTOMI(vp);
5771
5772			if (!(mi->mi_flags & MI_EXTATTR))
5773				return (0);
5774
5775			rp = VTOR(vp);
5776			if (nfs_rw_enter_sig(&rp->r_rwlock, RW_READER,
5777			    INTR(vp)))
5778				return (EINTR);
5779
5780			error = nfs3lookup_dnlc(vp, XATTR_DIR_NAME, &avp, cr);
5781			if (error || avp == NULL)
5782				error = acl_getxattrdir3(vp, &avp, 0, cr, 0);
5783
5784			nfs_rw_exit(&rp->r_rwlock);
5785
5786			if (error == 0 && avp != NULL) {
5787				error = do_xattr_exists_check(avp, valp, cr);
5788				VN_RELE(avp);
5789			} else if (error == ENOENT) {
5790				error = 0;
5791				*valp = 0;
5792			}
5793		}
5794		return (error);
5795	}
5796
5797	rp = VTOR(vp);
5798	if (rp->r_pathconf != NULL) {
5799		mutex_enter(&rp->r_statelock);
5800		if (rp->r_pathconf != NULL && nfs3_pathconf_disable_cache) {
5801			kmem_free(rp->r_pathconf, sizeof (*rp->r_pathconf));
5802			rp->r_pathconf = NULL;
5803		}
5804		if (rp->r_pathconf != NULL) {
5805			error = 0;
5806			switch (cmd) {
5807			case _PC_LINK_MAX:
5808				*valp = rp->r_pathconf->link_max;
5809				break;
5810			case _PC_NAME_MAX:
5811				*valp = rp->r_pathconf->name_max;
5812				break;
5813			case _PC_PATH_MAX:
5814			case _PC_SYMLINK_MAX:
5815				*valp = MAXPATHLEN;
5816				break;
5817			case _PC_CHOWN_RESTRICTED:
5818				*valp = rp->r_pathconf->chown_restricted;
5819				break;
5820			case _PC_NO_TRUNC:
5821				*valp = rp->r_pathconf->no_trunc;
5822				break;
5823			default:
5824				error = EINVAL;
5825				break;
5826			}
5827			mutex_exit(&rp->r_statelock);
5828#ifdef DEBUG
5829			nfs3_pathconf_cache_hits++;
5830#endif
5831			return (error);
5832		}
5833		mutex_exit(&rp->r_statelock);
5834	}
5835#ifdef DEBUG
5836	nfs3_pathconf_cache_misses++;
5837#endif
5838
5839	args.object = *VTOFH3(vp);
5840	fi.vp = vp;
5841	fi.fhp = (caddr_t)&args.object;
5842	fi.copyproc = nfs3copyfh;
5843	fi.lookupproc = nfs3lookup;
5844	fi.xattrdirproc = acl_getxattrdir3;
5845
5846	douprintf = 1;
5847
5848	t = gethrtime();
5849
5850	error = rfs3call(VTOMI(vp), NFSPROC3_PATHCONF,
5851	    xdr_nfs_fh3, (caddr_t)&args,
5852	    xdr_PATHCONF3res, (caddr_t)&res, cr,
5853	    &douprintf, &res.status, 0, &fi);
5854
5855	if (error)
5856		return (error);
5857
5858	error = geterrno3(res.status);
5859
5860	if (!error) {
5861		nfs3_cache_post_op_attr(vp, &res.resok.obj_attributes, t, cr);
5862		if (!nfs3_pathconf_disable_cache) {
5863			mutex_enter(&rp->r_statelock);
5864			if (rp->r_pathconf == NULL) {
5865				rp->r_pathconf = kmem_alloc(
5866				    sizeof (*rp->r_pathconf), KM_NOSLEEP);
5867				if (rp->r_pathconf != NULL)
5868					*rp->r_pathconf = res.resok.info;
5869			}
5870			mutex_exit(&rp->r_statelock);
5871		}
5872		switch (cmd) {
5873		case _PC_LINK_MAX:
5874			*valp = res.resok.info.link_max;
5875			break;
5876		case _PC_NAME_MAX:
5877			*valp = res.resok.info.name_max;
5878			break;
5879		case _PC_PATH_MAX:
5880		case _PC_SYMLINK_MAX:
5881			*valp = MAXPATHLEN;
5882			break;
5883		case _PC_CHOWN_RESTRICTED:
5884			*valp = res.resok.info.chown_restricted;
5885			break;
5886		case _PC_NO_TRUNC:
5887			*valp = res.resok.info.no_trunc;
5888			break;
5889		default:
5890			return (EINVAL);
5891		}
5892	} else {
5893		nfs3_cache_post_op_attr(vp, &res.resfail.obj_attributes, t, cr);
5894		PURGE_STALE_FH(error, vp, cr);
5895	}
5896
5897	return (error);
5898}
5899
5900/*
5901 * Called by async thread to do synchronous pageio. Do the i/o, wait
5902 * for it to complete, and cleanup the page list when done.
5903 */
5904static int
5905nfs3_sync_pageio(vnode_t *vp, page_t *pp, u_offset_t io_off, size_t io_len,
5906	int flags, cred_t *cr)
5907{
5908	int error;
5909
5910	ASSERT(nfs_zone() == VTOMI(vp)->mi_zone);
5911	error = nfs3_rdwrlbn(vp, pp, io_off, io_len, flags, cr);
5912	if (flags & B_READ)
5913		pvn_read_done(pp, (error ? B_ERROR : 0) | flags);
5914	else
5915		pvn_write_done(pp, (error ? B_ERROR : 0) | flags);
5916	return (error);
5917}
5918
5919/* ARGSUSED */
5920static int
5921nfs3_pageio(vnode_t *vp, page_t *pp, u_offset_t io_off, size_t io_len,
5922	int flags, cred_t *cr, caller_context_t *ct)
5923{
5924	int error;
5925	rnode_t *rp;
5926
5927	if (pp == NULL)
5928		return (EINVAL);
5929	if (!(flags & B_ASYNC) && nfs_zone() != VTOMI(vp)->mi_zone)
5930		return (EIO);
5931
5932	rp = VTOR(vp);
5933	mutex_enter(&rp->r_statelock);
5934	rp->r_count++;
5935	mutex_exit(&rp->r_statelock);
5936
5937	if (flags & B_ASYNC) {
5938		error = nfs_async_pageio(vp, pp, io_off, io_len, flags, cr,
5939		    nfs3_sync_pageio);
5940	} else
5941		error = nfs3_rdwrlbn(vp, pp, io_off, io_len, flags, cr);
5942	mutex_enter(&rp->r_statelock);
5943	rp->r_count--;
5944	cv_broadcast(&rp->r_cv);
5945	mutex_exit(&rp->r_statelock);
5946	return (error);
5947}
5948
5949/* ARGSUSED */
5950static void
5951nfs3_dispose(vnode_t *vp, page_t *pp, int fl, int dn, cred_t *cr,
5952	caller_context_t *ct)
5953{
5954	int error;
5955	rnode_t *rp;
5956	page_t *plist;
5957	page_t *pptr;
5958	offset3 offset;
5959	count3 len;
5960	k_sigset_t smask;
5961
5962	/*
5963	 * We should get called with fl equal to either B_FREE or
5964	 * B_INVAL.  Any other value is illegal.
5965	 *
5966	 * The page that we are either supposed to free or destroy
5967	 * should be exclusive locked and its io lock should not
5968	 * be held.
5969	 */
5970	ASSERT(fl == B_FREE || fl == B_INVAL);
5971	ASSERT((PAGE_EXCL(pp) && !page_iolock_assert(pp)) || panicstr);
5972	rp = VTOR(vp);
5973
5974	/*
5975	 * If the page doesn't need to be committed or we shouldn't
5976	 * even bother attempting to commit it, then just make sure
5977	 * that the p_fsdata byte is clear and then either free or
5978	 * destroy the page as appropriate.
5979	 */
5980	if (pp->p_fsdata == C_NOCOMMIT || (rp->r_flags & RSTALE)) {
5981		pp->p_fsdata = C_NOCOMMIT;
5982		if (fl == B_FREE)
5983			page_free(pp, dn);
5984		else
5985			page_destroy(pp, dn);
5986		return;
5987	}
5988
5989	/*
5990	 * If there is a page invalidation operation going on, then
5991	 * if this is one of the pages being destroyed, then just
5992	 * clear the p_fsdata byte and then either free or destroy
5993	 * the page as appropriate.
5994	 */
5995	mutex_enter(&rp->r_statelock);
5996	if ((rp->r_flags & RTRUNCATE) && pp->p_offset >= rp->r_truncaddr) {
5997		mutex_exit(&rp->r_statelock);
5998		pp->p_fsdata = C_NOCOMMIT;
5999		if (fl == B_FREE)
6000			page_free(pp, dn);
6001		else
6002			page_destroy(pp, dn);
6003		return;
6004	}
6005
6006	/*
6007	 * If we are freeing this page and someone else is already
6008	 * waiting to do a commit, then just unlock the page and
6009	 * return.  That other thread will take care of commiting
6010	 * this page.  The page can be freed sometime after the
6011	 * commit has finished.  Otherwise, if the page is marked
6012	 * as delay commit, then we may be getting called from
6013	 * pvn_write_done, one page at a time.   This could result
6014	 * in one commit per page, so we end up doing lots of small
6015	 * commits instead of fewer larger commits.  This is bad,
6016	 * we want do as few commits as possible.
6017	 */
6018	if (fl == B_FREE) {
6019		if (rp->r_flags & RCOMMITWAIT) {
6020			page_unlock(pp);
6021			mutex_exit(&rp->r_statelock);
6022			return;
6023		}
6024		if (pp->p_fsdata == C_DELAYCOMMIT) {
6025			pp->p_fsdata = C_COMMIT;
6026			page_unlock(pp);
6027			mutex_exit(&rp->r_statelock);
6028			return;
6029		}
6030	}
6031
6032	/*
6033	 * Check to see if there is a signal which would prevent an
6034	 * attempt to commit the pages from being successful.  If so,
6035	 * then don't bother with all of the work to gather pages and
6036	 * generate the unsuccessful RPC.  Just return from here and
6037	 * let the page be committed at some later time.
6038	 */
6039	sigintr(&smask, VTOMI(vp)->mi_flags & MI_INT);
6040	if (ttolwp(curthread) != NULL && ISSIG(curthread, JUSTLOOKING)) {
6041		sigunintr(&smask);
6042		page_unlock(pp);
6043		mutex_exit(&rp->r_statelock);
6044		return;
6045	}
6046	sigunintr(&smask);
6047
6048	/*
6049	 * We are starting to need to commit pages, so let's try
6050	 * to commit as many as possible at once to reduce the
6051	 * overhead.
6052	 *
6053	 * Set the `commit inprogress' state bit.  We must
6054	 * first wait until any current one finishes.  Then
6055	 * we initialize the c_pages list with this page.
6056	 */
6057	while (rp->r_flags & RCOMMIT) {
6058		rp->r_flags |= RCOMMITWAIT;
6059		cv_wait(&rp->r_commit.c_cv, &rp->r_statelock);
6060		rp->r_flags &= ~RCOMMITWAIT;
6061	}
6062	rp->r_flags |= RCOMMIT;
6063	mutex_exit(&rp->r_statelock);
6064	ASSERT(rp->r_commit.c_pages == NULL);
6065	rp->r_commit.c_pages = pp;
6066	rp->r_commit.c_commbase = (offset3)pp->p_offset;
6067	rp->r_commit.c_commlen = PAGESIZE;
6068
6069	/*
6070	 * Gather together all other pages which can be committed.
6071	 * They will all be chained off r_commit.c_pages.
6072	 */
6073	nfs3_get_commit(vp);
6074
6075	/*
6076	 * Clear the `commit inprogress' status and disconnect
6077	 * the list of pages to be committed from the rnode.
6078	 * At this same time, we also save the starting offset
6079	 * and length of data to be committed on the server.
6080	 */
6081	plist = rp->r_commit.c_pages;
6082	rp->r_commit.c_pages = NULL;
6083	offset = rp->r_commit.c_commbase;
6084	len = rp->r_commit.c_commlen;
6085	mutex_enter(&rp->r_statelock);
6086	rp->r_flags &= ~RCOMMIT;
6087	cv_broadcast(&rp->r_commit.c_cv);
6088	mutex_exit(&rp->r_statelock);
6089
6090	if (curproc == proc_pageout || curproc == proc_fsflush ||
6091	    nfs_zone() != VTOMI(vp)->mi_zone) {
6092		nfs_async_commit(vp, plist, offset, len, cr, nfs3_async_commit);
6093		return;
6094	}
6095
6096	/*
6097	 * Actually generate the COMMIT3 over the wire operation.
6098	 */
6099	error = nfs3_commit(vp, offset, len, cr);
6100
6101	/*
6102	 * If we got an error during the commit, just unlock all
6103	 * of the pages.  The pages will get retransmitted to the
6104	 * server during a putpage operation.
6105	 */
6106	if (error) {
6107		while (plist != NULL) {
6108			pptr = plist;
6109			page_sub(&plist, pptr);
6110			page_unlock(pptr);
6111		}
6112		return;
6113	}
6114
6115	/*
6116	 * We've tried as hard as we can to commit the data to stable
6117	 * storage on the server.  We release the rest of the pages
6118	 * and clear the commit required state.  They will be put
6119	 * onto the tail of the cachelist if they are nolonger
6120	 * mapped.
6121	 */
6122	while (plist != pp) {
6123		pptr = plist;
6124		page_sub(&plist, pptr);
6125		pptr->p_fsdata = C_NOCOMMIT;
6126		(void) page_release(pptr, 1);
6127	}
6128
6129	/*
6130	 * It is possible that nfs3_commit didn't return error but
6131	 * some other thread has modified the page we are going
6132	 * to free/destroy.
6133	 *    In this case we need to rewrite the page. Do an explicit check
6134	 * before attempting to free/destroy the page. If modified, needs to
6135	 * be rewritten so unlock the page and return.
6136	 */
6137	if (hat_ismod(pp)) {
6138		pp->p_fsdata = C_NOCOMMIT;
6139		page_unlock(pp);
6140		return;
6141	}
6142
6143	/*
6144	 * Now, as appropriate, either free or destroy the page
6145	 * that we were called with.
6146	 */
6147	pp->p_fsdata = C_NOCOMMIT;
6148	if (fl == B_FREE)
6149		page_free(pp, dn);
6150	else
6151		page_destroy(pp, dn);
6152}
6153
6154static int
6155nfs3_commit(vnode_t *vp, offset3 offset, count3 count, cred_t *cr)
6156{
6157	int error;
6158	rnode_t *rp;
6159	COMMIT3args args;
6160	COMMIT3res res;
6161	int douprintf;
6162	cred_t *cred;
6163
6164	rp = VTOR(vp);
6165	ASSERT(nfs_zone() == VTOMI(vp)->mi_zone);
6166
6167	mutex_enter(&rp->r_statelock);
6168	if (rp->r_cred != NULL) {
6169		cred = rp->r_cred;
6170		crhold(cred);
6171	} else {
6172		rp->r_cred = cr;
6173		crhold(cr);
6174		cred = cr;
6175		crhold(cred);
6176	}
6177	mutex_exit(&rp->r_statelock);
6178
6179	args.file = *VTOFH3(vp);
6180	args.offset = offset;
6181	args.count = count;
6182
6183doitagain:
6184	douprintf = 1;
6185	error = rfs3call(VTOMI(vp), NFSPROC3_COMMIT,
6186	    xdr_COMMIT3args, (caddr_t)&args,
6187	    xdr_COMMIT3res, (caddr_t)&res, cred,
6188	    &douprintf, &res.status, 0, NULL);
6189
6190	crfree(cred);
6191
6192	if (error)
6193		return (error);
6194
6195	error = geterrno3(res.status);
6196	if (!error) {
6197		ASSERT(rp->r_flags & RHAVEVERF);
6198		mutex_enter(&rp->r_statelock);
6199		if (rp->r_verf == res.resok.verf) {
6200			mutex_exit(&rp->r_statelock);
6201			return (0);
6202		}
6203		nfs3_set_mod(vp);
6204		rp->r_verf = res.resok.verf;
6205		mutex_exit(&rp->r_statelock);
6206		error = NFS_VERF_MISMATCH;
6207	} else {
6208		if (error == EACCES) {
6209			mutex_enter(&rp->r_statelock);
6210			if (cred != cr) {
6211				if (rp->r_cred != NULL)
6212					crfree(rp->r_cred);
6213				rp->r_cred = cr;
6214				crhold(cr);
6215				cred = cr;
6216				crhold(cred);
6217				mutex_exit(&rp->r_statelock);
6218				goto doitagain;
6219			}
6220			mutex_exit(&rp->r_statelock);
6221		}
6222		/*
6223		 * Can't do a PURGE_STALE_FH here because this
6224		 * can cause a deadlock.  nfs3_commit can
6225		 * be called from nfs3_dispose which can be called
6226		 * indirectly via pvn_vplist_dirty.  PURGE_STALE_FH
6227		 * can call back to pvn_vplist_dirty.
6228		 */
6229		if (error == ESTALE) {
6230			mutex_enter(&rp->r_statelock);
6231			rp->r_flags |= RSTALE;
6232			if (!rp->r_error)
6233				rp->r_error = error;
6234			mutex_exit(&rp->r_statelock);
6235			PURGE_ATTRCACHE(vp);
6236		} else {
6237			mutex_enter(&rp->r_statelock);
6238			if (!rp->r_error)
6239				rp->r_error = error;
6240			mutex_exit(&rp->r_statelock);
6241		}
6242	}
6243
6244	return (error);
6245}
6246
6247static void
6248nfs3_set_mod(vnode_t *vp)
6249{
6250	ASSERT(nfs_zone() == VTOMI(vp)->mi_zone);
6251
6252	pvn_vplist_setdirty(vp, nfs_setmod_check);
6253}
6254
6255/*
6256 * This routine is used to gather together a page list of the pages
6257 * which are to be committed on the server.  This routine must not
6258 * be called if the calling thread holds any locked pages.
6259 *
6260 * The calling thread must have set RCOMMIT.  This bit is used to
6261 * serialize access to the commit structure in the rnode.  As long
6262 * as the thread has set RCOMMIT, then it can manipulate the commit
6263 * structure without requiring any other locks.
6264 */
6265static void
6266nfs3_get_commit(vnode_t *vp)
6267{
6268	rnode_t *rp;
6269	page_t *pp;
6270	kmutex_t *vphm;
6271
6272	rp = VTOR(vp);
6273
6274	ASSERT(rp->r_flags & RCOMMIT);
6275
6276	vphm = page_vnode_mutex(vp);
6277	mutex_enter(vphm);
6278
6279	/*
6280	 * If there are no pages associated with this vnode, then
6281	 * just return.
6282	 */
6283	if ((pp = vp->v_pages) == NULL) {
6284		mutex_exit(vphm);
6285		return;
6286	}
6287
6288	/*
6289	 * Step through all of the pages associated with this vnode
6290	 * looking for pages which need to be committed.
6291	 */
6292	do {
6293		/* Skip marker pages. */
6294		if (pp->p_hash == PVN_VPLIST_HASH_TAG)
6295			continue;
6296
6297		/*
6298		 * If this page does not need to be committed or is
6299		 * modified, then just skip it.
6300		 */
6301		if (pp->p_fsdata == C_NOCOMMIT || hat_ismod(pp))
6302			continue;
6303
6304		/*
6305		 * Attempt to lock the page.  If we can't, then
6306		 * someone else is messing with it and we will
6307		 * just skip it.
6308		 */
6309		if (!page_trylock(pp, SE_EXCL))
6310			continue;
6311
6312		/*
6313		 * If this page does not need to be committed or is
6314		 * modified, then just skip it.  Recheck now that
6315		 * the page is locked.
6316		 */
6317		if (pp->p_fsdata == C_NOCOMMIT || hat_ismod(pp)) {
6318			page_unlock(pp);
6319			continue;
6320		}
6321
6322		if (PP_ISFREE(pp)) {
6323			cmn_err(CE_PANIC, "nfs3_get_commit: %p is free",
6324			    (void *)pp);
6325		}
6326
6327		/*
6328		 * The page needs to be committed and we locked it.
6329		 * Update the base and length parameters and add it
6330		 * to r_pages.
6331		 */
6332		if (rp->r_commit.c_pages == NULL) {
6333			rp->r_commit.c_commbase = (offset3)pp->p_offset;
6334			rp->r_commit.c_commlen = PAGESIZE;
6335		} else if (pp->p_offset < rp->r_commit.c_commbase) {
6336			rp->r_commit.c_commlen = rp->r_commit.c_commbase -
6337			    (offset3)pp->p_offset + rp->r_commit.c_commlen;
6338			rp->r_commit.c_commbase = (offset3)pp->p_offset;
6339		} else if ((rp->r_commit.c_commbase + rp->r_commit.c_commlen)
6340		    <= pp->p_offset) {
6341			rp->r_commit.c_commlen = (offset3)pp->p_offset -
6342			    rp->r_commit.c_commbase + PAGESIZE;
6343		}
6344		page_add(&rp->r_commit.c_pages, pp);
6345	} while ((pp = pp->p_vpnext) != vp->v_pages);
6346
6347	mutex_exit(vphm);
6348}
6349
6350/*
6351 * This routine is used to gather together a page list of the pages
6352 * which are to be committed on the server.  This routine must not
6353 * be called if the calling thread holds any locked pages.
6354 *
6355 * The calling thread must have set RCOMMIT.  This bit is used to
6356 * serialize access to the commit structure in the rnode.  As long
6357 * as the thread has set RCOMMIT, then it can manipulate the commit
6358 * structure without requiring any other locks.
6359 */
6360static void
6361nfs3_get_commit_range(vnode_t *vp, u_offset_t soff, size_t len)
6362{
6363
6364	rnode_t *rp;
6365	page_t *pp;
6366	u_offset_t end;
6367	u_offset_t off;
6368
6369	ASSERT(len != 0);
6370
6371	rp = VTOR(vp);
6372
6373	ASSERT(rp->r_flags & RCOMMIT);
6374	ASSERT(nfs_zone() == VTOMI(vp)->mi_zone);
6375
6376	/*
6377	 * If there are no pages associated with this vnode, then
6378	 * just return.
6379	 */
6380	if ((pp = vp->v_pages) == NULL)
6381		return;
6382
6383	/*
6384	 * Calculate the ending offset.
6385	 */
6386	end = soff + len;
6387
6388	for (off = soff; off < end; off += PAGESIZE) {
6389		/*
6390		 * Lookup each page by vp, offset.
6391		 */
6392		if ((pp = page_lookup_nowait(vp, off, SE_EXCL)) == NULL)
6393			continue;
6394
6395		/*
6396		 * If this page does not need to be committed or is
6397		 * modified, then just skip it.
6398		 */
6399		if (pp->p_fsdata == C_NOCOMMIT || hat_ismod(pp)) {
6400			page_unlock(pp);
6401			continue;
6402		}
6403
6404		ASSERT(PP_ISFREE(pp) == 0);
6405
6406		/*
6407		 * The page needs to be committed and we locked it.
6408		 * Update the base and length parameters and add it
6409		 * to r_pages.
6410		 */
6411		if (rp->r_commit.c_pages == NULL) {
6412			rp->r_commit.c_commbase = (offset3)pp->p_offset;
6413			rp->r_commit.c_commlen = PAGESIZE;
6414		} else {
6415			rp->r_commit.c_commlen = (offset3)pp->p_offset -
6416			    rp->r_commit.c_commbase + PAGESIZE;
6417		}
6418		page_add(&rp->r_commit.c_pages, pp);
6419	}
6420}
6421
6422static int
6423nfs3_putpage_commit(vnode_t *vp, offset_t poff, size_t plen, cred_t *cr)
6424{
6425	int error;
6426	writeverf3 write_verf;
6427	rnode_t *rp = VTOR(vp);
6428
6429	ASSERT(nfs_zone() == VTOMI(vp)->mi_zone);
6430	/*
6431	 * Flush the data portion of the file and then commit any
6432	 * portions which need to be committed.  This may need to
6433	 * be done twice if the server has changed state since
6434	 * data was last written.  The data will need to be
6435	 * rewritten to the server and then a new commit done.
6436	 *
6437	 * In fact, this may need to be done several times if the
6438	 * server is having problems and crashing while we are
6439	 * attempting to do this.
6440	 */
6441
6442top:
6443	/*
6444	 * Do a flush based on the poff and plen arguments.  This
6445	 * will asynchronously write out any modified pages in the
6446	 * range specified by (poff, plen).  This starts all of the
6447	 * i/o operations which will be waited for in the next
6448	 * call to nfs3_putpage
6449	 */
6450
6451	mutex_enter(&rp->r_statelock);
6452	write_verf = rp->r_verf;
6453	mutex_exit(&rp->r_statelock);
6454
6455	error = nfs3_putpage(vp, poff, plen, B_ASYNC, cr, NULL);
6456	if (error == EAGAIN)
6457		error = 0;
6458
6459	/*
6460	 * Do a flush based on the poff and plen arguments.  This
6461	 * will synchronously write out any modified pages in the
6462	 * range specified by (poff, plen) and wait until all of
6463	 * the asynchronous i/o's in that range are done as well.
6464	 */
6465	if (!error)
6466		error = nfs3_putpage(vp, poff, plen, 0, cr, NULL);
6467
6468	if (error)
6469		return (error);
6470
6471	mutex_enter(&rp->r_statelock);
6472	if (rp->r_verf != write_verf) {
6473		mutex_exit(&rp->r_statelock);
6474		goto top;
6475	}
6476	mutex_exit(&rp->r_statelock);
6477
6478	/*
6479	 * Now commit any pages which might need to be committed.
6480	 * If the error, NFS_VERF_MISMATCH, is returned, then
6481	 * start over with the flush operation.
6482	 */
6483
6484	error = nfs3_commit_vp(vp, poff, plen, cr);
6485
6486	if (error == NFS_VERF_MISMATCH)
6487		goto top;
6488
6489	return (error);
6490}
6491
6492static int
6493nfs3_commit_vp(vnode_t *vp, u_offset_t poff, size_t plen, cred_t *cr)
6494{
6495	rnode_t *rp;
6496	page_t *plist;
6497	offset3 offset;
6498	count3 len;
6499
6500
6501	rp = VTOR(vp);
6502
6503	if (nfs_zone() != VTOMI(vp)->mi_zone)
6504		return (EIO);
6505	/*
6506	 * Set the `commit inprogress' state bit.  We must
6507	 * first wait until any current one finishes.
6508	 */
6509	mutex_enter(&rp->r_statelock);
6510	while (rp->r_flags & RCOMMIT) {
6511		rp->r_flags |= RCOMMITWAIT;
6512		cv_wait(&rp->r_commit.c_cv, &rp->r_statelock);
6513		rp->r_flags &= ~RCOMMITWAIT;
6514	}
6515	rp->r_flags |= RCOMMIT;
6516	mutex_exit(&rp->r_statelock);
6517
6518	/*
6519	 * Gather together all of the pages which need to be
6520	 * committed.
6521	 */
6522	if (plen == 0)
6523		nfs3_get_commit(vp);
6524	else
6525		nfs3_get_commit_range(vp, poff, plen);
6526
6527	/*
6528	 * Clear the `commit inprogress' bit and disconnect the
6529	 * page list which was gathered together in nfs3_get_commit.
6530	 */
6531	plist = rp->r_commit.c_pages;
6532	rp->r_commit.c_pages = NULL;
6533	offset = rp->r_commit.c_commbase;
6534	len = rp->r_commit.c_commlen;
6535	mutex_enter(&rp->r_statelock);
6536	rp->r_flags &= ~RCOMMIT;
6537	cv_broadcast(&rp->r_commit.c_cv);
6538	mutex_exit(&rp->r_statelock);
6539
6540	/*
6541	 * If any pages need to be committed, commit them and
6542	 * then unlock them so that they can be freed some
6543	 * time later.
6544	 */
6545	if (plist != NULL) {
6546		/*
6547		 * No error occurred during the flush portion
6548		 * of this operation, so now attempt to commit
6549		 * the data to stable storage on the server.
6550		 *
6551		 * This will unlock all of the pages on the list.
6552		 */
6553		return (nfs3_sync_commit(vp, plist, offset, len, cr));
6554	}
6555	return (0);
6556}
6557
6558static int
6559nfs3_sync_commit(vnode_t *vp, page_t *plist, offset3 offset, count3 count,
6560	cred_t *cr)
6561{
6562	int error;
6563	page_t *pp;
6564
6565	ASSERT(nfs_zone() == VTOMI(vp)->mi_zone);
6566	error = nfs3_commit(vp, offset, count, cr);
6567
6568	/*
6569	 * If we got an error, then just unlock all of the pages
6570	 * on the list.
6571	 */
6572	if (error) {
6573		while (plist != NULL) {
6574			pp = plist;
6575			page_sub(&plist, pp);
6576			page_unlock(pp);
6577		}
6578		return (error);
6579	}
6580	/*
6581	 * We've tried as hard as we can to commit the data to stable
6582	 * storage on the server.  We just unlock the pages and clear
6583	 * the commit required state.  They will get freed later.
6584	 */
6585	while (plist != NULL) {
6586		pp = plist;
6587		page_sub(&plist, pp);
6588		pp->p_fsdata = C_NOCOMMIT;
6589		page_unlock(pp);
6590	}
6591
6592	return (error);
6593}
6594
6595static void
6596nfs3_async_commit(vnode_t *vp, page_t *plist, offset3 offset, count3 count,
6597	cred_t *cr)
6598{
6599	ASSERT(nfs_zone() == VTOMI(vp)->mi_zone);
6600	(void) nfs3_sync_commit(vp, plist, offset, count, cr);
6601}
6602
6603/* ARGSUSED */
6604static int
6605nfs3_setsecattr(vnode_t *vp, vsecattr_t *vsecattr, int flag, cred_t *cr,
6606	caller_context_t *ct)
6607{
6608	int error;
6609	mntinfo_t *mi;
6610
6611	mi = VTOMI(vp);
6612
6613	if (nfs_zone() != mi->mi_zone)
6614		return (EIO);
6615
6616	if (mi->mi_flags & MI_ACL) {
6617		error = acl_setacl3(vp, vsecattr, flag, cr);
6618		if (mi->mi_flags & MI_ACL)
6619			return (error);
6620	}
6621
6622	return (ENOSYS);
6623}
6624
6625/* ARGSUSED */
6626static int
6627nfs3_getsecattr(vnode_t *vp, vsecattr_t *vsecattr, int flag, cred_t *cr,
6628	caller_context_t *ct)
6629{
6630	int error;
6631	mntinfo_t *mi;
6632
6633	mi = VTOMI(vp);
6634
6635	if (nfs_zone() != mi->mi_zone)
6636		return (EIO);
6637
6638	if (mi->mi_flags & MI_ACL) {
6639		error = acl_getacl3(vp, vsecattr, flag, cr);
6640		if (mi->mi_flags & MI_ACL)
6641			return (error);
6642	}
6643
6644	return (fs_fab_acl(vp, vsecattr, flag, cr, ct));
6645}
6646
6647/* ARGSUSED */
6648static int
6649nfs3_shrlock(vnode_t *vp, int cmd, struct shrlock *shr, int flag, cred_t *cr,
6650	caller_context_t *ct)
6651{
6652	int error;
6653	struct shrlock nshr;
6654	struct nfs_owner nfs_owner;
6655	netobj lm_fh3;
6656
6657	if (nfs_zone() != VTOMI(vp)->mi_zone)
6658		return (EIO);
6659
6660	/*
6661	 * check for valid cmd parameter
6662	 */
6663	if (cmd != F_SHARE && cmd != F_UNSHARE && cmd != F_HASREMOTELOCKS)
6664		return (EINVAL);
6665
6666	/*
6667	 * Check access permissions
6668	 */
6669	if (cmd == F_SHARE &&
6670	    (((shr->s_access & F_RDACC) && !(flag & FREAD)) ||
6671	    ((shr->s_access & F_WRACC) && !(flag & FWRITE))))
6672		return (EBADF);
6673
6674	/*
6675	 * If the filesystem is mounted using local locking, pass the
6676	 * request off to the local share code.
6677	 */
6678	if (VTOMI(vp)->mi_flags & MI_LLOCK)
6679		return (fs_shrlock(vp, cmd, shr, flag, cr, ct));
6680
6681	switch (cmd) {
6682	case F_SHARE:
6683	case F_UNSHARE:
6684		lm_fh3.n_len = VTOFH3(vp)->fh3_length;
6685		lm_fh3.n_bytes = (char *)&(VTOFH3(vp)->fh3_u.data);
6686
6687		/*
6688		 * If passed an owner that is too large to fit in an
6689		 * nfs_owner it is likely a recursive call from the
6690		 * lock manager client and pass it straight through.  If
6691		 * it is not a nfs_owner then simply return an error.
6692		 */
6693		if (shr->s_own_len > sizeof (nfs_owner.lowner)) {
6694			if (((struct nfs_owner *)shr->s_owner)->magic !=
6695			    NFS_OWNER_MAGIC)
6696				return (EINVAL);
6697
6698			if (error = lm4_shrlock(vp, cmd, shr, flag, &lm_fh3)) {
6699				error = set_errno(error);
6700			}
6701			return (error);
6702		}
6703		/*
6704		 * Remote share reservations owner is a combination of
6705		 * a magic number, hostname, and the local owner
6706		 */
6707		bzero(&nfs_owner, sizeof (nfs_owner));
6708		nfs_owner.magic = NFS_OWNER_MAGIC;
6709		(void) strncpy(nfs_owner.hname, uts_nodename(),
6710		    sizeof (nfs_owner.hname));
6711		bcopy(shr->s_owner, nfs_owner.lowner, shr->s_own_len);
6712		nshr.s_access = shr->s_access;
6713		nshr.s_deny = shr->s_deny;
6714		nshr.s_sysid = 0;
6715		nshr.s_pid = ttoproc(curthread)->p_pid;
6716		nshr.s_own_len = sizeof (nfs_owner);
6717		nshr.s_owner = (caddr_t)&nfs_owner;
6718
6719		if (error = lm4_shrlock(vp, cmd, &nshr, flag, &lm_fh3)) {
6720			error = set_errno(error);
6721		}
6722
6723		break;
6724
6725	case F_HASREMOTELOCKS:
6726		/*
6727		 * NFS client can't store remote locks itself
6728		 */
6729		shr->s_access = 0;
6730		error = 0;
6731		break;
6732
6733	default:
6734		error = EINVAL;
6735		break;
6736	}
6737
6738	return (error);
6739}
6740