1 /*
   2  * CDDL HEADER START
   3  *
   4  * The contents of this file are subject to the terms of the
   5  * Common Development and Distribution License (the "License").
   6  * You may not use this file except in compliance with the License.
   7  *
   8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
   9  * or http://www.opensolaris.org/os/licensing.
  10  * See the License for the specific language governing permissions
  11  * and limitations under the License.
  12  *
  13  * When distributing Covered Code, include this CDDL HEADER in each
  14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
  15  * If applicable, add the following below this CDDL HEADER, with the
  16  * fields enclosed by brackets "[]" replaced with your own identifying
  17  * information: Portions Copyright [yyyy] [name of copyright owner]
  18  *
  19  * CDDL HEADER END
  20  */
  21 /*
  22  * Copyright 2010 Sun Microsystems, Inc.  All rights reserved.
  23  * Use is subject to license terms.
  24  */
  25 
  26 /*
  27  *      Copyright (c) 1983,1984,1985,1986,1987,1988,1989 AT&T.
  28  *      All rights reserved.
  29  */
  30 
  31 #include <sys/param.h>
  32 #include <sys/types.h>
  33 #include <sys/systm.h>
  34 #include <sys/cred.h>
  35 #include <sys/time.h>
  36 #include <sys/vnode.h>
  37 #include <sys/vfs.h>
  38 #include <sys/vfs_opreg.h>
  39 #include <sys/file.h>
  40 #include <sys/filio.h>
  41 #include <sys/uio.h>
  42 #include <sys/buf.h>
  43 #include <sys/mman.h>
  44 #include <sys/pathname.h>
  45 #include <sys/dirent.h>
  46 #include <sys/debug.h>
  47 #include <sys/vmsystm.h>
  48 #include <sys/fcntl.h>
  49 #include <sys/flock.h>
  50 #include <sys/swap.h>
  51 #include <sys/errno.h>
  52 #include <sys/strsubr.h>
  53 #include <sys/sysmacros.h>
  54 #include <sys/kmem.h>
  55 #include <sys/cmn_err.h>
  56 #include <sys/pathconf.h>
  57 #include <sys/utsname.h>
  58 #include <sys/dnlc.h>
  59 #include <sys/acl.h>
  60 #include <sys/systeminfo.h>
  61 #include <sys/atomic.h>
  62 #include <sys/policy.h>
  63 #include <sys/sdt.h>
  64 #include <sys/zone.h>
  65 
  66 #include <rpc/types.h>
  67 #include <rpc/auth.h>
  68 #include <rpc/clnt.h>
  69 #include <rpc/rpc_rdma.h>
  70 
  71 #include <nfs/nfs.h>
  72 #include <nfs/nfs_clnt.h>
  73 #include <nfs/rnode.h>
  74 #include <nfs/nfs_acl.h>
  75 #include <nfs/lm.h>
  76 
  77 #include <vm/hat.h>
  78 #include <vm/as.h>
  79 #include <vm/page.h>
  80 #include <vm/pvn.h>
  81 #include <vm/seg.h>
  82 #include <vm/seg_map.h>
  83 #include <vm/seg_kpm.h>
  84 #include <vm/seg_vn.h>
  85 
  86 #include <fs/fs_subr.h>
  87 
  88 #include <sys/ddi.h>
  89 
  90 static int      nfs3_rdwrlbn(vnode_t *, page_t *, u_offset_t, size_t, int,
  91                         cred_t *);
  92 static int      nfs3write(vnode_t *, caddr_t, u_offset_t, int, cred_t *,
  93                         stable_how *);
  94 static int      nfs3read(vnode_t *, caddr_t, offset_t, int, size_t *, cred_t *);
  95 static int      nfs3setattr(vnode_t *, struct vattr *, int, cred_t *);
  96 static int      nfs3_accessx(void *, int, cred_t *);
  97 static int      nfs3lookup_dnlc(vnode_t *, char *, vnode_t **, cred_t *);
  98 static int      nfs3lookup_otw(vnode_t *, char *, vnode_t **, cred_t *, int);
  99 static int      nfs3create(vnode_t *, char *, struct vattr *, enum vcexcl,
 100                         int, vnode_t **, cred_t *, int);
 101 static int      nfs3excl_create_settimes(vnode_t *, struct vattr *, cred_t *);
 102 static int      nfs3mknod(vnode_t *, char *, struct vattr *, enum vcexcl,
 103                         int, vnode_t **, cred_t *);
 104 static int      nfs3rename(vnode_t *, char *, vnode_t *, char *, cred_t *,
 105                         caller_context_t *);
 106 static int      do_nfs3readdir(vnode_t *, rddir_cache *, cred_t *);
 107 static void     nfs3readdir(vnode_t *, rddir_cache *, cred_t *);
 108 static void     nfs3readdirplus(vnode_t *, rddir_cache *, cred_t *);
 109 static int      nfs3_bio(struct buf *, stable_how *, cred_t *);
 110 static int      nfs3_getapage(vnode_t *, u_offset_t, size_t, uint_t *,
 111                         page_t *[], size_t, struct seg *, caddr_t,
 112                         enum seg_rw, cred_t *);
 113 static void     nfs3_readahead(vnode_t *, u_offset_t, caddr_t, struct seg *,
 114                         cred_t *);
 115 static int      nfs3_sync_putapage(vnode_t *, page_t *, u_offset_t, size_t,
 116                         int, cred_t *);
 117 static int      nfs3_sync_pageio(vnode_t *, page_t *, u_offset_t, size_t,
 118                         int, cred_t *);
 119 static int      nfs3_commit(vnode_t *, offset3, count3, cred_t *);
 120 static void     nfs3_set_mod(vnode_t *);
 121 static void     nfs3_get_commit(vnode_t *);
 122 static void     nfs3_get_commit_range(vnode_t *, u_offset_t, size_t);
 123 static int      nfs3_putpage_commit(vnode_t *, offset_t, size_t, cred_t *);
 124 static int      nfs3_commit_vp(vnode_t *, u_offset_t, size_t,  cred_t *);
 125 static int      nfs3_sync_commit(vnode_t *, page_t *, offset3, count3,
 126                         cred_t *);
 127 static void     nfs3_async_commit(vnode_t *, page_t *, offset3, count3,
 128                         cred_t *);
 129 static void     nfs3_delmap_callback(struct as *, void *, uint_t);
 130 
 131 /*
 132  * Error flags used to pass information about certain special errors
 133  * which need to be handled specially.
 134  */
 135 #define NFS_EOF                 -98
 136 #define NFS_VERF_MISMATCH       -97
 137 
 138 /* ALIGN64 aligns the given buffer and adjust buffer size to 64 bit */
 139 #define ALIGN64(x, ptr, sz)                                             \
 140         x = ((uintptr_t)(ptr)) & (sizeof (uint64_t) - 1);           \
 141         if (x) {                                                        \
 142                 x = sizeof (uint64_t) - (x);                            \
 143                 sz -= (x);                                              \
 144                 ptr += (x);                                             \
 145         }
 146 
 147 /*
 148  * These are the vnode ops routines which implement the vnode interface to
 149  * the networked file system.  These routines just take their parameters,
 150  * make them look networkish by putting the right info into interface structs,
 151  * and then calling the appropriate remote routine(s) to do the work.
 152  *
 153  * Note on directory name lookup cacheing:  If we detect a stale fhandle,
 154  * we purge the directory cache relative to that vnode.  This way, the
 155  * user won't get burned by the cache repeatedly.  See <nfs/rnode.h> for
 156  * more details on rnode locking.
 157  */
 158 
 159 static int      nfs3_open(vnode_t **, int, cred_t *, caller_context_t *);
 160 static int      nfs3_close(vnode_t *, int, int, offset_t, cred_t *,
 161                         caller_context_t *);
 162 static int      nfs3_read(vnode_t *, struct uio *, int, cred_t *,
 163                         caller_context_t *);
 164 static int      nfs3_write(vnode_t *, struct uio *, int, cred_t *,
 165                         caller_context_t *);
 166 static int      nfs3_ioctl(vnode_t *, int, intptr_t, int, cred_t *, int *,
 167                         caller_context_t *);
 168 static int      nfs3_getattr(vnode_t *, struct vattr *, int, cred_t *,
 169                         caller_context_t *);
 170 static int      nfs3_setattr(vnode_t *, struct vattr *, int, cred_t *,
 171                         caller_context_t *);
 172 static int      nfs3_access(vnode_t *, int, int, cred_t *, caller_context_t *);
 173 static int      nfs3_readlink(vnode_t *, struct uio *, cred_t *,
 174                         caller_context_t *);
 175 static int      nfs3_fsync(vnode_t *, int, cred_t *, caller_context_t *);
 176 static void     nfs3_inactive(vnode_t *, cred_t *, caller_context_t *);
 177 static int      nfs3_lookup(vnode_t *, char *, vnode_t **,
 178                         struct pathname *, int, vnode_t *, cred_t *,
 179                         caller_context_t *, int *, pathname_t *);
 180 static int      nfs3_create(vnode_t *, char *, struct vattr *, enum vcexcl,
 181                         int, vnode_t **, cred_t *, int, caller_context_t *,
 182                         vsecattr_t *);
 183 static int      nfs3_remove(vnode_t *, char *, cred_t *, caller_context_t *,
 184                         int);
 185 static int      nfs3_link(vnode_t *, vnode_t *, char *, cred_t *,
 186                         caller_context_t *, int);
 187 static int      nfs3_rename(vnode_t *, char *, vnode_t *, char *, cred_t *,
 188                         caller_context_t *, int);
 189 static int      nfs3_mkdir(vnode_t *, char *, struct vattr *, vnode_t **,
 190                         cred_t *, caller_context_t *, int, vsecattr_t *);
 191 static int      nfs3_rmdir(vnode_t *, char *, vnode_t *, cred_t *,
 192                         caller_context_t *, int);
 193 static int      nfs3_symlink(vnode_t *, char *, struct vattr *, char *,
 194                         cred_t *, caller_context_t *, int);
 195 static int      nfs3_readdir(vnode_t *, struct uio *, cred_t *, int *,
 196                         caller_context_t *, int);
 197 static int      nfs3_fid(vnode_t *, fid_t *, caller_context_t *);
 198 static int      nfs3_rwlock(vnode_t *, int, caller_context_t *);
 199 static void     nfs3_rwunlock(vnode_t *, int, caller_context_t *);
 200 static int      nfs3_seek(vnode_t *, offset_t, offset_t *, caller_context_t *);
 201 static int      nfs3_getpage(vnode_t *, offset_t, size_t, uint_t *,
 202                         page_t *[], size_t, struct seg *, caddr_t,
 203                         enum seg_rw, cred_t *, caller_context_t *);
 204 static int      nfs3_putpage(vnode_t *, offset_t, size_t, int, cred_t *,
 205                         caller_context_t *);
 206 static int      nfs3_map(vnode_t *, offset_t, struct as *, caddr_t *, size_t,
 207                         uchar_t, uchar_t, uint_t, cred_t *, caller_context_t *);
 208 static int      nfs3_addmap(vnode_t *, offset_t, struct as *, caddr_t, size_t,
 209                         uchar_t, uchar_t, uint_t, cred_t *, caller_context_t *);
 210 static int      nfs3_frlock(vnode_t *, int, struct flock64 *, int, offset_t,
 211                         struct flk_callback *, cred_t *, caller_context_t *);
 212 static int      nfs3_space(vnode_t *, int, struct flock64 *, int, offset_t,
 213                         cred_t *, caller_context_t *);
 214 static int      nfs3_realvp(vnode_t *, vnode_t **, caller_context_t *);
 215 static int      nfs3_delmap(vnode_t *, offset_t, struct as *, caddr_t, size_t,
 216                         uint_t, uint_t, uint_t, cred_t *, caller_context_t *);
 217 static int      nfs3_pathconf(vnode_t *, int, ulong_t *, cred_t *,
 218                         caller_context_t *);
 219 static int      nfs3_pageio(vnode_t *, page_t *, u_offset_t, size_t, int,
 220                         cred_t *, caller_context_t *);
 221 static void     nfs3_dispose(vnode_t *, page_t *, int, int, cred_t *,
 222                         caller_context_t *);
 223 static int      nfs3_setsecattr(vnode_t *, vsecattr_t *, int, cred_t *,
 224                         caller_context_t *);
 225 static int      nfs3_getsecattr(vnode_t *, vsecattr_t *, int, cred_t *,
 226                         caller_context_t *);
 227 static int      nfs3_shrlock(vnode_t *, int, struct shrlock *, int, cred_t *,
 228                         caller_context_t *);
 229 
 230 struct vnodeops *nfs3_vnodeops;
 231 
 232 const fs_operation_def_t nfs3_vnodeops_template[] = {
 233         VOPNAME_OPEN,           { .vop_open = nfs3_open },
 234         VOPNAME_CLOSE,          { .vop_close = nfs3_close },
 235         VOPNAME_READ,           { .vop_read = nfs3_read },
 236         VOPNAME_WRITE,          { .vop_write = nfs3_write },
 237         VOPNAME_IOCTL,          { .vop_ioctl = nfs3_ioctl },
 238         VOPNAME_GETATTR,        { .vop_getattr = nfs3_getattr },
 239         VOPNAME_SETATTR,        { .vop_setattr = nfs3_setattr },
 240         VOPNAME_ACCESS,         { .vop_access = nfs3_access },
 241         VOPNAME_LOOKUP,         { .vop_lookup = nfs3_lookup },
 242         VOPNAME_CREATE,         { .vop_create = nfs3_create },
 243         VOPNAME_REMOVE,         { .vop_remove = nfs3_remove },
 244         VOPNAME_LINK,           { .vop_link = nfs3_link },
 245         VOPNAME_RENAME,         { .vop_rename = nfs3_rename },
 246         VOPNAME_MKDIR,          { .vop_mkdir = nfs3_mkdir },
 247         VOPNAME_RMDIR,          { .vop_rmdir = nfs3_rmdir },
 248         VOPNAME_READDIR,        { .vop_readdir = nfs3_readdir },
 249         VOPNAME_SYMLINK,        { .vop_symlink = nfs3_symlink },
 250         VOPNAME_READLINK,       { .vop_readlink = nfs3_readlink },
 251         VOPNAME_FSYNC,          { .vop_fsync = nfs3_fsync },
 252         VOPNAME_INACTIVE,       { .vop_inactive = nfs3_inactive },
 253         VOPNAME_FID,            { .vop_fid = nfs3_fid },
 254         VOPNAME_RWLOCK,         { .vop_rwlock = nfs3_rwlock },
 255         VOPNAME_RWUNLOCK,       { .vop_rwunlock = nfs3_rwunlock },
 256         VOPNAME_SEEK,           { .vop_seek = nfs3_seek },
 257         VOPNAME_FRLOCK,         { .vop_frlock = nfs3_frlock },
 258         VOPNAME_SPACE,          { .vop_space = nfs3_space },
 259         VOPNAME_REALVP,         { .vop_realvp = nfs3_realvp },
 260         VOPNAME_GETPAGE,        { .vop_getpage = nfs3_getpage },
 261         VOPNAME_PUTPAGE,        { .vop_putpage = nfs3_putpage },
 262         VOPNAME_MAP,            { .vop_map = nfs3_map },
 263         VOPNAME_ADDMAP,         { .vop_addmap = nfs3_addmap },
 264         VOPNAME_DELMAP,         { .vop_delmap = nfs3_delmap },
 265         /* no separate nfs3_dump */
 266         VOPNAME_DUMP,           { .vop_dump = nfs_dump },
 267         VOPNAME_PATHCONF,       { .vop_pathconf = nfs3_pathconf },
 268         VOPNAME_PAGEIO,         { .vop_pageio = nfs3_pageio },
 269         VOPNAME_DISPOSE,        { .vop_dispose = nfs3_dispose },
 270         VOPNAME_SETSECATTR,     { .vop_setsecattr = nfs3_setsecattr },
 271         VOPNAME_GETSECATTR,     { .vop_getsecattr = nfs3_getsecattr },
 272         VOPNAME_SHRLOCK,        { .vop_shrlock = nfs3_shrlock },
 273         VOPNAME_VNEVENT,        { .vop_vnevent = fs_vnevent_support },
 274         NULL,                   NULL
 275 };
 276 
 277 /*
 278  * XXX:  This is referenced in modstubs.s
 279  */
 280 struct vnodeops *
 281 nfs3_getvnodeops(void)
 282 {
 283         return (nfs3_vnodeops);
 284 }
 285 
 286 /* ARGSUSED */
 287 static int
 288 nfs3_open(vnode_t **vpp, int flag, cred_t *cr, caller_context_t *ct)
 289 {
 290         int error;
 291         struct vattr va;
 292         rnode_t *rp;
 293         vnode_t *vp;
 294 
 295         vp = *vpp;
 296         if (nfs_zone() != VTOMI(vp)->mi_zone)
 297                 return (EIO);
 298         rp = VTOR(vp);
 299         mutex_enter(&rp->r_statelock);
 300         if (rp->r_cred == NULL) {
 301                 crhold(cr);
 302                 rp->r_cred = cr;
 303         }
 304         mutex_exit(&rp->r_statelock);
 305 
 306         /*
 307          * If there is no cached data or if close-to-open
 308          * consistency checking is turned off, we can avoid
 309          * the over the wire getattr.  Otherwise, if the
 310          * file system is mounted readonly, then just verify
 311          * the caches are up to date using the normal mechanism.
 312          * Else, if the file is not mmap'd, then just mark
 313          * the attributes as timed out.  They will be refreshed
 314          * and the caches validated prior to being used.
 315          * Else, the file system is mounted writeable so
 316          * force an over the wire GETATTR in order to ensure
 317          * that all cached data is valid.
 318          */
 319         if (vp->v_count > 1 ||
 320             ((vn_has_cached_data(vp) || HAVE_RDDIR_CACHE(rp)) &&
 321             !(VTOMI(vp)->mi_flags & MI_NOCTO))) {
 322                 if (vn_is_readonly(vp))
 323                         error = nfs3_validate_caches(vp, cr);
 324                 else if (rp->r_mapcnt == 0 && vp->v_count == 1) {
 325                         PURGE_ATTRCACHE(vp);
 326                         error = 0;
 327                 } else {
 328                         va.va_mask = AT_ALL;
 329                         error = nfs3_getattr_otw(vp, &va, cr);
 330                 }
 331         } else
 332                 error = 0;
 333 
 334         return (error);
 335 }
 336 
 337 /* ARGSUSED */
 338 static int
 339 nfs3_close(vnode_t *vp, int flag, int count, offset_t offset, cred_t *cr,
 340                 caller_context_t *ct)
 341 {
 342         rnode_t *rp;
 343         int error;
 344         struct vattr va;
 345 
 346         /*
 347          * zone_enter(2) prevents processes from changing zones with NFS files
 348          * open; if we happen to get here from the wrong zone we can't do
 349          * anything over the wire.
 350          */
 351         if (VTOMI(vp)->mi_zone != nfs_zone()) {
 352                 /*
 353                  * We could attempt to clean up locks, except we're sure
 354                  * that the current process didn't acquire any locks on
 355                  * the file: any attempt to lock a file belong to another zone
 356                  * will fail, and one can't lock an NFS file and then change
 357                  * zones, as that fails too.
 358                  *
 359                  * Returning an error here is the sane thing to do.  A
 360                  * subsequent call to VN_RELE() which translates to a
 361                  * nfs3_inactive() will clean up state: if the zone of the
 362                  * vnode's origin is still alive and kicking, an async worker
 363                  * thread will handle the request (from the correct zone), and
 364                  * everything (minus the commit and final nfs3_getattr_otw()
 365                  * call) should be OK. If the zone is going away
 366                  * nfs_async_inactive() will throw away cached pages inline.
 367                  */
 368                 return (EIO);
 369         }
 370 
 371         /*
 372          * If we are using local locking for this filesystem, then
 373          * release all of the SYSV style record locks.  Otherwise,
 374          * we are doing network locking and we need to release all
 375          * of the network locks.  All of the locks held by this
 376          * process on this file are released no matter what the
 377          * incoming reference count is.
 378          */
 379         if (VTOMI(vp)->mi_flags & MI_LLOCK) {
 380                 cleanlocks(vp, ttoproc(curthread)->p_pid, 0);
 381                 cleanshares(vp, ttoproc(curthread)->p_pid);
 382         } else
 383                 nfs_lockrelease(vp, flag, offset, cr);
 384 
 385         if (count > 1)
 386                 return (0);
 387 
 388         /*
 389          * If the file has been `unlinked', then purge the
 390          * DNLC so that this vnode will get reycled quicker
 391          * and the .nfs* file on the server will get removed.
 392          */
 393         rp = VTOR(vp);
 394         if (rp->r_unldvp != NULL)
 395                 dnlc_purge_vp(vp);
 396 
 397         /*
 398          * If the file was open for write and there are pages,
 399          * then if the file system was mounted using the "no-close-
 400          *      to-open" semantics, then start an asynchronous flush
 401          *      of the all of the pages in the file.
 402          * else the file system was not mounted using the "no-close-
 403          *      to-open" semantics, then do a synchronous flush and
 404          *      commit of all of the dirty and uncommitted pages.
 405          *
 406          * The asynchronous flush of the pages in the "nocto" path
 407          * mostly just associates a cred pointer with the rnode so
 408          * writes which happen later will have a better chance of
 409          * working.  It also starts the data being written to the
 410          * server, but without unnecessarily delaying the application.
 411          */
 412         if ((flag & FWRITE) && vn_has_cached_data(vp)) {
 413                 if (VTOMI(vp)->mi_flags & MI_NOCTO) {
 414                         error = nfs3_putpage(vp, (offset_t)0, 0, B_ASYNC,
 415                             cr, ct);
 416                         if (error == EAGAIN)
 417                                 error = 0;
 418                 } else
 419                         error = nfs3_putpage_commit(vp, (offset_t)0, 0, cr);
 420                 if (!error) {
 421                         mutex_enter(&rp->r_statelock);
 422                         error = rp->r_error;
 423                         rp->r_error = 0;
 424                         mutex_exit(&rp->r_statelock);
 425                 }
 426         } else {
 427                 mutex_enter(&rp->r_statelock);
 428                 error = rp->r_error;
 429                 rp->r_error = 0;
 430                 mutex_exit(&rp->r_statelock);
 431         }
 432 
 433         /*
 434          * If RWRITEATTR is set, then issue an over the wire GETATTR to
 435          * refresh the attribute cache with a set of attributes which
 436          * weren't returned from a WRITE.  This will enable the close-
 437          * to-open processing to work.
 438          */
 439         if (rp->r_flags & RWRITEATTR)
 440                 (void) nfs3_getattr_otw(vp, &va, cr);
 441 
 442         return (error);
 443 }
 444 
 445 /* ARGSUSED */
 446 static int
 447 nfs3_directio_read(vnode_t *vp, struct uio *uiop, cred_t *cr)
 448 {
 449         mntinfo_t *mi;
 450         READ3args args;
 451         READ3uiores res;
 452         int tsize;
 453         offset_t offset;
 454         ssize_t count;
 455         int error;
 456         int douprintf;
 457         failinfo_t fi;
 458         char *sv_hostname;
 459 
 460         mi = VTOMI(vp);
 461         ASSERT(nfs_zone() == VTOMI(vp)->mi_zone);
 462         sv_hostname = VTOR(vp)->r_server->sv_hostname;
 463 
 464         douprintf = 1;
 465         args.file = *VTOFH3(vp);
 466         fi.vp = vp;
 467         fi.fhp = (caddr_t)&args.file;
 468         fi.copyproc = nfs3copyfh;
 469         fi.lookupproc = nfs3lookup;
 470         fi.xattrdirproc = acl_getxattrdir3;
 471 
 472         res.uiop = uiop;
 473 
 474         res.wlist = NULL;
 475 
 476         offset = uiop->uio_loffset;
 477         count = uiop->uio_resid;
 478 
 479         do {
 480                 if (mi->mi_io_kstats) {
 481                         mutex_enter(&mi->mi_lock);
 482                         kstat_runq_enter(KSTAT_IO_PTR(mi->mi_io_kstats));
 483                         mutex_exit(&mi->mi_lock);
 484                 }
 485 
 486                 do {
 487                         tsize = MIN(mi->mi_tsize, count);
 488                         args.offset = (offset3)offset;
 489                         args.count = (count3)tsize;
 490                         res.size = (uint_t)tsize;
 491                         args.res_uiop = uiop;
 492                         args.res_data_val_alt = NULL;
 493 
 494                         error = rfs3call(mi, NFSPROC3_READ,
 495                             xdr_READ3args, (caddr_t)&args,
 496                             xdr_READ3uiores, (caddr_t)&res, cr,
 497                             &douprintf, &res.status, 0, &fi);
 498                 } while (error == ENFS_TRYAGAIN);
 499 
 500                 if (mi->mi_io_kstats) {
 501                         mutex_enter(&mi->mi_lock);
 502                         kstat_runq_exit(KSTAT_IO_PTR(mi->mi_io_kstats));
 503                         mutex_exit(&mi->mi_lock);
 504                 }
 505 
 506                 if (error)
 507                         return (error);
 508 
 509                 error = geterrno3(res.status);
 510                 if (error)
 511                         return (error);
 512 
 513                 if (res.count != res.size) {
 514                         zcmn_err(getzoneid(), CE_WARN,
 515 "nfs3_directio_read: server %s returned incorrect amount",
 516                             sv_hostname);
 517                         return (EIO);
 518                 }
 519                 count -= res.count;
 520                 offset += res.count;
 521                 if (mi->mi_io_kstats) {
 522                         mutex_enter(&mi->mi_lock);
 523                         KSTAT_IO_PTR(mi->mi_io_kstats)->reads++;
 524                         KSTAT_IO_PTR(mi->mi_io_kstats)->nread += res.count;
 525                         mutex_exit(&mi->mi_lock);
 526                 }
 527                 lwp_stat_update(LWP_STAT_INBLK, 1);
 528         } while (count && !res.eof);
 529 
 530         return (0);
 531 }
 532 
 533 /* ARGSUSED */
 534 static int
 535 nfs3_read(vnode_t *vp, struct uio *uiop, int ioflag, cred_t *cr,
 536         caller_context_t *ct)
 537 {
 538         rnode_t *rp;
 539         u_offset_t off;
 540         offset_t diff;
 541         int on;
 542         size_t n;
 543         caddr_t base;
 544         uint_t flags;
 545         int error = 0;
 546         mntinfo_t *mi;
 547 
 548         rp = VTOR(vp);
 549         mi = VTOMI(vp);
 550 
 551         ASSERT(nfs_rw_lock_held(&rp->r_rwlock, RW_READER));
 552 
 553         if (nfs_zone() != mi->mi_zone)
 554                 return (EIO);
 555 
 556         if (vp->v_type != VREG)
 557                 return (EISDIR);
 558 
 559         if (uiop->uio_resid == 0)
 560                 return (0);
 561 
 562         if (uiop->uio_loffset < 0 || uiop->uio_loffset + uiop->uio_resid < 0)
 563                 return (EINVAL);
 564 
 565         /*
 566          * Bypass VM if caching has been disabled (e.g., locking) or if
 567          * using client-side direct I/O and the file is not mmap'd and
 568          * there are no cached pages.
 569          */
 570         if ((vp->v_flag & VNOCACHE) ||
 571             (((rp->r_flags & RDIRECTIO) || (mi->mi_flags & MI_DIRECTIO)) &&
 572             rp->r_mapcnt == 0 && rp->r_inmap == 0 &&
 573             !vn_has_cached_data(vp))) {
 574                 return (nfs3_directio_read(vp, uiop, cr));
 575         }
 576 
 577         do {
 578                 off = uiop->uio_loffset & MAXBMASK; /* mapping offset */
 579                 on = uiop->uio_loffset & MAXBOFFSET; /* Relative offset */
 580                 n = MIN(MAXBSIZE - on, uiop->uio_resid);
 581 
 582                 error = nfs3_validate_caches(vp, cr);
 583                 if (error)
 584                         break;
 585 
 586                 mutex_enter(&rp->r_statelock);
 587                 while (rp->r_flags & RINCACHEPURGE) {
 588                         if (!cv_wait_sig(&rp->r_cv, &rp->r_statelock)) {
 589                                 mutex_exit(&rp->r_statelock);
 590                                 return (EINTR);
 591                         }
 592                 }
 593                 diff = rp->r_size - uiop->uio_loffset;
 594                 mutex_exit(&rp->r_statelock);
 595                 if (diff <= 0)
 596                         break;
 597                 if (diff < n)
 598                         n = (size_t)diff;
 599 
 600                 if (vpm_enable) {
 601                         /*
 602                          * Copy data.
 603                          */
 604                         error = vpm_data_copy(vp, off + on, n, uiop,
 605                             1, NULL, 0, S_READ);
 606                 } else {
 607                         base = segmap_getmapflt(segkmap, vp, off + on, n, 1,
 608                             S_READ);
 609 
 610                         error = uiomove(base + on, n, UIO_READ, uiop);
 611                 }
 612 
 613                 if (!error) {
 614                         /*
 615                          * If read a whole block or read to eof,
 616                          * won't need this buffer again soon.
 617                          */
 618                         mutex_enter(&rp->r_statelock);
 619                         if (n + on == MAXBSIZE ||
 620                             uiop->uio_loffset == rp->r_size)
 621                                 flags = SM_DONTNEED;
 622                         else
 623                                 flags = 0;
 624                         mutex_exit(&rp->r_statelock);
 625                         if (vpm_enable) {
 626                                 error = vpm_sync_pages(vp, off, n, flags);
 627                         } else {
 628                                 error = segmap_release(segkmap, base, flags);
 629                         }
 630                 } else {
 631                         if (vpm_enable) {
 632                                 (void) vpm_sync_pages(vp, off, n, 0);
 633                         } else {
 634                                 (void) segmap_release(segkmap, base, 0);
 635                         }
 636                 }
 637         } while (!error && uiop->uio_resid > 0);
 638 
 639         return (error);
 640 }
 641 
 642 /* ARGSUSED */
 643 static int
 644 nfs3_write(vnode_t *vp, struct uio *uiop, int ioflag, cred_t *cr,
 645         caller_context_t *ct)
 646 {
 647         rlim64_t limit = uiop->uio_llimit;
 648         rnode_t *rp;
 649         u_offset_t off;
 650         caddr_t base;
 651         uint_t flags;
 652         int remainder;
 653         size_t n;
 654         int on;
 655         int error;
 656         int resid;
 657         offset_t offset;
 658         mntinfo_t *mi;
 659         uint_t bsize;
 660 
 661         rp = VTOR(vp);
 662 
 663         if (vp->v_type != VREG)
 664                 return (EISDIR);
 665 
 666         mi = VTOMI(vp);
 667         if (nfs_zone() != mi->mi_zone)
 668                 return (EIO);
 669         if (uiop->uio_resid == 0)
 670                 return (0);
 671 
 672         if (ioflag & FAPPEND) {
 673                 struct vattr va;
 674 
 675                 /*
 676                  * Must serialize if appending.
 677                  */
 678                 if (nfs_rw_lock_held(&rp->r_rwlock, RW_READER)) {
 679                         nfs_rw_exit(&rp->r_rwlock);
 680                         if (nfs_rw_enter_sig(&rp->r_rwlock, RW_WRITER,
 681                             INTR(vp)))
 682                                 return (EINTR);
 683                 }
 684 
 685                 va.va_mask = AT_SIZE;
 686                 error = nfs3getattr(vp, &va, cr);
 687                 if (error)
 688                         return (error);
 689                 uiop->uio_loffset = va.va_size;
 690         }
 691 
 692         offset = uiop->uio_loffset + uiop->uio_resid;
 693 
 694         if (uiop->uio_loffset < 0 || offset < 0)
 695                 return (EINVAL);
 696 
 697         if (limit == RLIM64_INFINITY || limit > MAXOFFSET_T)
 698                 limit = MAXOFFSET_T;
 699 
 700         /*
 701          * Check to make sure that the process will not exceed
 702          * its limit on file size.  It is okay to write up to
 703          * the limit, but not beyond.  Thus, the write which
 704          * reaches the limit will be short and the next write
 705          * will return an error.
 706          */
 707         remainder = 0;
 708         if (offset > limit) {
 709                 remainder = offset - limit;
 710                 uiop->uio_resid = limit - uiop->uio_loffset;
 711                 if (uiop->uio_resid <= 0) {
 712                         proc_t *p = ttoproc(curthread);
 713 
 714                         uiop->uio_resid += remainder;
 715                         mutex_enter(&p->p_lock);
 716                         (void) rctl_action(rctlproc_legacy[RLIMIT_FSIZE],
 717                             p->p_rctls, p, RCA_UNSAFE_SIGINFO);
 718                         mutex_exit(&p->p_lock);
 719                         return (EFBIG);
 720                 }
 721         }
 722 
 723         if (nfs_rw_enter_sig(&rp->r_lkserlock, RW_READER, INTR(vp)))
 724                 return (EINTR);
 725 
 726         /*
 727          * Bypass VM if caching has been disabled (e.g., locking) or if
 728          * using client-side direct I/O and the file is not mmap'd and
 729          * there are no cached pages.
 730          */
 731         if ((vp->v_flag & VNOCACHE) ||
 732             (((rp->r_flags & RDIRECTIO) || (mi->mi_flags & MI_DIRECTIO)) &&
 733             rp->r_mapcnt == 0 && rp->r_inmap == 0 &&
 734             !vn_has_cached_data(vp))) {
 735                 size_t bufsize;
 736                 int count;
 737                 u_offset_t org_offset;
 738                 stable_how stab_comm;
 739 
 740 nfs3_fwrite:
 741                 if (rp->r_flags & RSTALE) {
 742                         resid = uiop->uio_resid;
 743                         offset = uiop->uio_loffset;
 744                         error = rp->r_error;
 745                         /*
 746                          * A close may have cleared r_error, if so,
 747                          * propagate ESTALE error return properly
 748                          */
 749                         if (error == 0)
 750                                 error = ESTALE;
 751                         goto bottom;
 752                 }
 753                 bufsize = MIN(uiop->uio_resid, mi->mi_stsize);
 754                 base = kmem_alloc(bufsize, KM_SLEEP);
 755                 do {
 756                         if (ioflag & FDSYNC)
 757                                 stab_comm = DATA_SYNC;
 758                         else
 759                                 stab_comm = FILE_SYNC;
 760                         resid = uiop->uio_resid;
 761                         offset = uiop->uio_loffset;
 762                         count = MIN(uiop->uio_resid, bufsize);
 763                         org_offset = uiop->uio_loffset;
 764                         error = uiomove(base, count, UIO_WRITE, uiop);
 765                         if (!error) {
 766                                 error = nfs3write(vp, base, org_offset,
 767                                     count, cr, &stab_comm);
 768                         }
 769                 } while (!error && uiop->uio_resid > 0);
 770                 kmem_free(base, bufsize);
 771                 goto bottom;
 772         }
 773 
 774 
 775         bsize = vp->v_vfsp->vfs_bsize;
 776 
 777         do {
 778                 off = uiop->uio_loffset & MAXBMASK; /* mapping offset */
 779                 on = uiop->uio_loffset & MAXBOFFSET; /* Relative offset */
 780                 n = MIN(MAXBSIZE - on, uiop->uio_resid);
 781 
 782                 resid = uiop->uio_resid;
 783                 offset = uiop->uio_loffset;
 784 
 785                 if (rp->r_flags & RSTALE) {
 786                         error = rp->r_error;
 787                         /*
 788                          * A close may have cleared r_error, if so,
 789                          * propagate ESTALE error return properly
 790                          */
 791                         if (error == 0)
 792                                 error = ESTALE;
 793                         break;
 794                 }
 795 
 796                 /*
 797                  * Don't create dirty pages faster than they
 798                  * can be cleaned so that the system doesn't
 799                  * get imbalanced.  If the async queue is
 800                  * maxed out, then wait for it to drain before
 801                  * creating more dirty pages.  Also, wait for
 802                  * any threads doing pagewalks in the vop_getattr
 803                  * entry points so that they don't block for
 804                  * long periods.
 805                  */
 806                 mutex_enter(&rp->r_statelock);
 807                 while ((mi->mi_max_threads != 0 &&
 808                     rp->r_awcount > 2 * mi->mi_max_threads) ||
 809                     rp->r_gcount > 0) {
 810                         if (INTR(vp)) {
 811                                 klwp_t *lwp = ttolwp(curthread);
 812 
 813                                 if (lwp != NULL)
 814                                         lwp->lwp_nostop++;
 815                                 if (!cv_wait_sig(&rp->r_cv, &rp->r_statelock)) {
 816                                         mutex_exit(&rp->r_statelock);
 817                                         if (lwp != NULL)
 818                                                 lwp->lwp_nostop--;
 819                                         error = EINTR;
 820                                         goto bottom;
 821                                 }
 822                                 if (lwp != NULL)
 823                                         lwp->lwp_nostop--;
 824                         } else
 825                                 cv_wait(&rp->r_cv, &rp->r_statelock);
 826                 }
 827                 mutex_exit(&rp->r_statelock);
 828 
 829                 /*
 830                  * Touch the page and fault it in if it is not in core
 831                  * before segmap_getmapflt or vpm_data_copy can lock it.
 832                  * This is to avoid the deadlock if the buffer is mapped
 833                  * to the same file through mmap which we want to write.
 834                  */
 835                 uio_prefaultpages((long)n, uiop);
 836 
 837                 if (vpm_enable) {
 838                         /*
 839                          * It will use kpm mappings, so no need to
 840                          * pass an address.
 841                          */
 842                         error = writerp(rp, NULL, n, uiop, 0);
 843                 } else  {
 844                         if (segmap_kpm) {
 845                                 int pon = uiop->uio_loffset & PAGEOFFSET;
 846                                 size_t pn = MIN(PAGESIZE - pon,
 847                                     uiop->uio_resid);
 848                                 int pagecreate;
 849 
 850                                 mutex_enter(&rp->r_statelock);
 851                                 pagecreate = (pon == 0) && (pn == PAGESIZE ||
 852                                     uiop->uio_loffset + pn >= rp->r_size);
 853                                 mutex_exit(&rp->r_statelock);
 854 
 855                                 base = segmap_getmapflt(segkmap, vp, off + on,
 856                                     pn, !pagecreate, S_WRITE);
 857 
 858                                 error = writerp(rp, base + pon, n, uiop,
 859                                     pagecreate);
 860 
 861                         } else {
 862                                 base = segmap_getmapflt(segkmap, vp, off + on,
 863                                     n, 0, S_READ);
 864                                 error = writerp(rp, base + on, n, uiop, 0);
 865                         }
 866                 }
 867 
 868                 if (!error) {
 869                         if (mi->mi_flags & MI_NOAC)
 870                                 flags = SM_WRITE;
 871                         else if ((uiop->uio_loffset % bsize) == 0 ||
 872                             IS_SWAPVP(vp)) {
 873                                 /*
 874                                  * Have written a whole block.
 875                                  * Start an asynchronous write
 876                                  * and mark the buffer to
 877                                  * indicate that it won't be
 878                                  * needed again soon.
 879                                  */
 880                                 flags = SM_WRITE | SM_ASYNC | SM_DONTNEED;
 881                         } else
 882                                 flags = 0;
 883                         if ((ioflag & (FSYNC|FDSYNC)) ||
 884                             (rp->r_flags & ROUTOFSPACE)) {
 885                                 flags &= ~SM_ASYNC;
 886                                 flags |= SM_WRITE;
 887                         }
 888                         if (vpm_enable) {
 889                                 error = vpm_sync_pages(vp, off, n, flags);
 890                         } else {
 891                                 error = segmap_release(segkmap, base, flags);
 892                         }
 893                 } else {
 894                         if (vpm_enable) {
 895                                 (void) vpm_sync_pages(vp, off, n, 0);
 896                         } else {
 897                                 (void) segmap_release(segkmap, base, 0);
 898                         }
 899                         /*
 900                          * In the event that we got an access error while
 901                          * faulting in a page for a write-only file just
 902                          * force a write.
 903                          */
 904                         if (error == EACCES)
 905                                 goto nfs3_fwrite;
 906                 }
 907         } while (!error && uiop->uio_resid > 0);
 908 
 909 bottom:
 910         if (error) {
 911                 uiop->uio_resid = resid + remainder;
 912                 uiop->uio_loffset = offset;
 913         } else
 914                 uiop->uio_resid += remainder;
 915 
 916         nfs_rw_exit(&rp->r_lkserlock);
 917 
 918         return (error);
 919 }
 920 
 921 /*
 922  * Flags are composed of {B_ASYNC, B_INVAL, B_FREE, B_DONTNEED}
 923  */
 924 static int
 925 nfs3_rdwrlbn(vnode_t *vp, page_t *pp, u_offset_t off, size_t len,
 926         int flags, cred_t *cr)
 927 {
 928         struct buf *bp;
 929         int error;
 930         page_t *savepp;
 931         uchar_t fsdata;
 932         stable_how stab_comm;
 933 
 934         ASSERT(nfs_zone() == VTOMI(vp)->mi_zone);
 935         bp = pageio_setup(pp, len, vp, flags);
 936         ASSERT(bp != NULL);
 937 
 938         /*
 939          * pageio_setup should have set b_addr to 0.  This
 940          * is correct since we want to do I/O on a page
 941          * boundary.  bp_mapin will use this addr to calculate
 942          * an offset, and then set b_addr to the kernel virtual
 943          * address it allocated for us.
 944          */
 945         ASSERT(bp->b_un.b_addr == 0);
 946 
 947         bp->b_edev = 0;
 948         bp->b_dev = 0;
 949         bp->b_lblkno = lbtodb(off);
 950         bp->b_file = vp;
 951         bp->b_offset = (offset_t)off;
 952         bp_mapin(bp);
 953 
 954         /*
 955          * Calculate the desired level of stability to write data
 956          * on the server and then mark all of the pages to reflect
 957          * this.
 958          */
 959         if ((flags & (B_WRITE|B_ASYNC)) == (B_WRITE|B_ASYNC) &&
 960             freemem > desfree) {
 961                 stab_comm = UNSTABLE;
 962                 fsdata = C_DELAYCOMMIT;
 963         } else {
 964                 stab_comm = FILE_SYNC;
 965                 fsdata = C_NOCOMMIT;
 966         }
 967 
 968         savepp = pp;
 969         do {
 970                 pp->p_fsdata = fsdata;
 971         } while ((pp = pp->p_next) != savepp);
 972 
 973         error = nfs3_bio(bp, &stab_comm, cr);
 974 
 975         bp_mapout(bp);
 976         pageio_done(bp);
 977 
 978         /*
 979          * If the server wrote pages in a more stable fashion than
 980          * was requested, then clear all of the marks in the pages
 981          * indicating that COMMIT operations were required.
 982          */
 983         if (stab_comm != UNSTABLE && fsdata == C_DELAYCOMMIT) {
 984                 do {
 985                         pp->p_fsdata = C_NOCOMMIT;
 986                 } while ((pp = pp->p_next) != savepp);
 987         }
 988 
 989         return (error);
 990 }
 991 
 992 /*
 993  * Write to file.  Writes to remote server in largest size
 994  * chunks that the server can handle.  Write is synchronous.
 995  */
 996 static int
 997 nfs3write(vnode_t *vp, caddr_t base, u_offset_t offset, int count, cred_t *cr,
 998         stable_how *stab_comm)
 999 {
1000         mntinfo_t *mi;
1001         WRITE3args args;
1002         WRITE3res res;
1003         int error;
1004         int tsize;
1005         rnode_t *rp;
1006         int douprintf;
1007 
1008         rp = VTOR(vp);
1009         mi = VTOMI(vp);
1010 
1011         ASSERT(nfs_zone() == mi->mi_zone);
1012 
1013         args.file = *VTOFH3(vp);
1014         args.stable = *stab_comm;
1015 
1016         *stab_comm = FILE_SYNC;
1017 
1018         douprintf = 1;
1019 
1020         do {
1021                 if ((vp->v_flag & VNOCACHE) ||
1022                     (rp->r_flags & RDIRECTIO) ||
1023                     (mi->mi_flags & MI_DIRECTIO))
1024                         tsize = MIN(mi->mi_stsize, count);
1025                 else
1026                         tsize = MIN(mi->mi_curwrite, count);
1027                 args.offset = (offset3)offset;
1028                 args.count = (count3)tsize;
1029                 args.data.data_len = (uint_t)tsize;
1030                 args.data.data_val = base;
1031 
1032                 if (mi->mi_io_kstats) {
1033                         mutex_enter(&mi->mi_lock);
1034                         kstat_runq_enter(KSTAT_IO_PTR(mi->mi_io_kstats));
1035                         mutex_exit(&mi->mi_lock);
1036                 }
1037                 args.mblk = NULL;
1038                 do {
1039                         error = rfs3call(mi, NFSPROC3_WRITE,
1040                             xdr_WRITE3args, (caddr_t)&args,
1041                             xdr_WRITE3res, (caddr_t)&res, cr,
1042                             &douprintf, &res.status, 0, NULL);
1043                 } while (error == ENFS_TRYAGAIN);
1044                 if (mi->mi_io_kstats) {
1045                         mutex_enter(&mi->mi_lock);
1046                         kstat_runq_exit(KSTAT_IO_PTR(mi->mi_io_kstats));
1047                         mutex_exit(&mi->mi_lock);
1048                 }
1049 
1050                 if (error)
1051                         return (error);
1052                 error = geterrno3(res.status);
1053                 if (!error) {
1054                         if (res.resok.count > args.count) {
1055                                 zcmn_err(getzoneid(), CE_WARN,
1056                                     "nfs3write: server %s wrote %u, "
1057                                     "requested was %u",
1058                                     rp->r_server->sv_hostname,
1059                                     res.resok.count, args.count);
1060                                 return (EIO);
1061                         }
1062                         if (res.resok.committed == UNSTABLE) {
1063                                 *stab_comm = UNSTABLE;
1064                                 if (args.stable == DATA_SYNC ||
1065                                     args.stable == FILE_SYNC) {
1066                                         zcmn_err(getzoneid(), CE_WARN,
1067                         "nfs3write: server %s did not commit to stable storage",
1068                                             rp->r_server->sv_hostname);
1069                                         return (EIO);
1070                                 }
1071                         }
1072                         tsize = (int)res.resok.count;
1073                         count -= tsize;
1074                         base += tsize;
1075                         offset += tsize;
1076                         if (mi->mi_io_kstats) {
1077                                 mutex_enter(&mi->mi_lock);
1078                                 KSTAT_IO_PTR(mi->mi_io_kstats)->writes++;
1079                                 KSTAT_IO_PTR(mi->mi_io_kstats)->nwritten +=
1080                                     tsize;
1081                                 mutex_exit(&mi->mi_lock);
1082                         }
1083                         lwp_stat_update(LWP_STAT_OUBLK, 1);
1084                         mutex_enter(&rp->r_statelock);
1085                         if (rp->r_flags & RHAVEVERF) {
1086                                 if (rp->r_verf != res.resok.verf) {
1087                                         nfs3_set_mod(vp);
1088                                         rp->r_verf = res.resok.verf;
1089                                         /*
1090                                          * If the data was written UNSTABLE,
1091                                          * then might as well stop because
1092                                          * the whole block will have to get
1093                                          * rewritten anyway.
1094                                          */
1095                                         if (*stab_comm == UNSTABLE) {
1096                                                 mutex_exit(&rp->r_statelock);
1097                                                 break;
1098                                         }
1099                                 }
1100                         } else {
1101                                 rp->r_verf = res.resok.verf;
1102                                 rp->r_flags |= RHAVEVERF;
1103                         }
1104                         /*
1105                          * Mark the attribute cache as timed out and
1106                          * set RWRITEATTR to indicate that the file
1107                          * was modified with a WRITE operation and
1108                          * that the attributes can not be trusted.
1109                          */
1110                         PURGE_ATTRCACHE_LOCKED(rp);
1111                         rp->r_flags |= RWRITEATTR;
1112                         mutex_exit(&rp->r_statelock);
1113                 }
1114         } while (!error && count);
1115 
1116         return (error);
1117 }
1118 
1119 /*
1120  * Read from a file.  Reads data in largest chunks our interface can handle.
1121  */
1122 static int
1123 nfs3read(vnode_t *vp, caddr_t base, offset_t offset, int count,
1124         size_t *residp, cred_t *cr)
1125 {
1126         mntinfo_t *mi;
1127         READ3args args;
1128         READ3vres res;
1129         int tsize;
1130         int error;
1131         int douprintf;
1132         failinfo_t fi;
1133         rnode_t *rp;
1134         struct vattr va;
1135         hrtime_t t;
1136 
1137         rp = VTOR(vp);
1138         mi = VTOMI(vp);
1139         ASSERT(nfs_zone() == mi->mi_zone);
1140         douprintf = 1;
1141 
1142         args.file = *VTOFH3(vp);
1143         fi.vp = vp;
1144         fi.fhp = (caddr_t)&args.file;
1145         fi.copyproc = nfs3copyfh;
1146         fi.lookupproc = nfs3lookup;
1147         fi.xattrdirproc = acl_getxattrdir3;
1148 
1149         res.pov.fres.vp = vp;
1150         res.pov.fres.vap = &va;
1151 
1152         res.wlist = NULL;
1153         *residp = count;
1154         do {
1155                 if (mi->mi_io_kstats) {
1156                         mutex_enter(&mi->mi_lock);
1157                         kstat_runq_enter(KSTAT_IO_PTR(mi->mi_io_kstats));
1158                         mutex_exit(&mi->mi_lock);
1159                 }
1160 
1161                 do {
1162                         if ((vp->v_flag & VNOCACHE) ||
1163                             (rp->r_flags & RDIRECTIO) ||
1164                             (mi->mi_flags & MI_DIRECTIO))
1165                                 tsize = MIN(mi->mi_tsize, count);
1166                         else
1167                                 tsize = MIN(mi->mi_curread, count);
1168                         res.data.data_val = base;
1169                         res.data.data_len = tsize;
1170                         args.offset = (offset3)offset;
1171                         args.count = (count3)tsize;
1172                         args.res_uiop = NULL;
1173                         args.res_data_val_alt = base;
1174 
1175                         t = gethrtime();
1176                         error = rfs3call(mi, NFSPROC3_READ,
1177                             xdr_READ3args, (caddr_t)&args,
1178                             xdr_READ3vres, (caddr_t)&res, cr,
1179                             &douprintf, &res.status, 0, &fi);
1180                 } while (error == ENFS_TRYAGAIN);
1181 
1182                 if (mi->mi_io_kstats) {
1183                         mutex_enter(&mi->mi_lock);
1184                         kstat_runq_exit(KSTAT_IO_PTR(mi->mi_io_kstats));
1185                         mutex_exit(&mi->mi_lock);
1186                 }
1187 
1188                 if (error)
1189                         return (error);
1190 
1191                 error = geterrno3(res.status);
1192                 if (error)
1193                         return (error);
1194 
1195                 if (res.count != res.data.data_len) {
1196                         zcmn_err(getzoneid(), CE_WARN,
1197                             "nfs3read: server %s returned incorrect amount",
1198                             rp->r_server->sv_hostname);
1199                         return (EIO);
1200                 }
1201 
1202                 count -= res.count;
1203                 *residp = count;
1204                 base += res.count;
1205                 offset += res.count;
1206                 if (mi->mi_io_kstats) {
1207                         mutex_enter(&mi->mi_lock);
1208                         KSTAT_IO_PTR(mi->mi_io_kstats)->reads++;
1209                         KSTAT_IO_PTR(mi->mi_io_kstats)->nread += res.count;
1210                         mutex_exit(&mi->mi_lock);
1211                 }
1212                 lwp_stat_update(LWP_STAT_INBLK, 1);
1213         } while (count && !res.eof);
1214 
1215         if (res.pov.attributes) {
1216                 mutex_enter(&rp->r_statelock);
1217                 if (!CACHE_VALID(rp, va.va_mtime, va.va_size)) {
1218                         mutex_exit(&rp->r_statelock);
1219                         PURGE_ATTRCACHE(vp);
1220                 } else {
1221                         if (rp->r_mtime <= t)
1222                                 nfs_attrcache_va(vp, &va);
1223                         mutex_exit(&rp->r_statelock);
1224                 }
1225         }
1226 
1227         return (0);
1228 }
1229 
1230 /* ARGSUSED */
1231 static int
1232 nfs3_ioctl(vnode_t *vp, int cmd, intptr_t arg, int flag, cred_t *cr, int *rvalp,
1233         caller_context_t *ct)
1234 {
1235 
1236         if (nfs_zone() != VTOMI(vp)->mi_zone)
1237                 return (EIO);
1238         switch (cmd) {
1239                 case _FIODIRECTIO:
1240                         return (nfs_directio(vp, (int)arg, cr));
1241                 default:
1242                         return (ENOTTY);
1243         }
1244 }
1245 
1246 /* ARGSUSED */
1247 static int
1248 nfs3_getattr(vnode_t *vp, struct vattr *vap, int flags, cred_t *cr,
1249         caller_context_t *ct)
1250 {
1251         int error;
1252         rnode_t *rp;
1253 
1254         if (nfs_zone() != VTOMI(vp)->mi_zone)
1255                 return (EIO);
1256         /*
1257          * If it has been specified that the return value will
1258          * just be used as a hint, and we are only being asked
1259          * for size, fsid or rdevid, then return the client's
1260          * notion of these values without checking to make sure
1261          * that the attribute cache is up to date.
1262          * The whole point is to avoid an over the wire GETATTR
1263          * call.
1264          */
1265         rp = VTOR(vp);
1266         if (flags & ATTR_HINT) {
1267                 if (vap->va_mask ==
1268                     (vap->va_mask & (AT_SIZE | AT_FSID | AT_RDEV))) {
1269                         mutex_enter(&rp->r_statelock);
1270                         if (vap->va_mask | AT_SIZE)
1271                                 vap->va_size = rp->r_size;
1272                         if (vap->va_mask | AT_FSID)
1273                                 vap->va_fsid = rp->r_attr.va_fsid;
1274                         if (vap->va_mask | AT_RDEV)
1275                                 vap->va_rdev = rp->r_attr.va_rdev;
1276                         mutex_exit(&rp->r_statelock);
1277                         return (0);
1278                 }
1279         }
1280 
1281         /*
1282          * Only need to flush pages if asking for the mtime
1283          * and if there any dirty pages or any outstanding
1284          * asynchronous (write) requests for this file.
1285          */
1286         if (vap->va_mask & AT_MTIME) {
1287                 if (vn_has_cached_data(vp) &&
1288                     ((rp->r_flags & RDIRTY) || rp->r_awcount > 0)) {
1289                         mutex_enter(&rp->r_statelock);
1290                         rp->r_gcount++;
1291                         mutex_exit(&rp->r_statelock);
1292                         error = nfs3_putpage(vp, (offset_t)0, 0, 0, cr, ct);
1293                         mutex_enter(&rp->r_statelock);
1294                         if (error && (error == ENOSPC || error == EDQUOT)) {
1295                                 if (!rp->r_error)
1296                                         rp->r_error = error;
1297                         }
1298                         if (--rp->r_gcount == 0)
1299                                 cv_broadcast(&rp->r_cv);
1300                         mutex_exit(&rp->r_statelock);
1301                 }
1302         }
1303 
1304         return (nfs3getattr(vp, vap, cr));
1305 }
1306 
1307 /*ARGSUSED4*/
1308 static int
1309 nfs3_setattr(vnode_t *vp, struct vattr *vap, int flags, cred_t *cr,
1310                 caller_context_t *ct)
1311 {
1312         int error;
1313         struct vattr va;
1314 
1315         if (vap->va_mask & AT_NOSET)
1316                 return (EINVAL);
1317         if (nfs_zone() != VTOMI(vp)->mi_zone)
1318                 return (EIO);
1319 
1320         va.va_mask = AT_UID | AT_MODE;
1321         error = nfs3getattr(vp, &va, cr);
1322         if (error)
1323                 return (error);
1324 
1325         error = secpolicy_vnode_setattr(cr, vp, vap, &va, flags, nfs3_accessx,
1326             vp);
1327         if (error)
1328                 return (error);
1329 
1330         return (nfs3setattr(vp, vap, flags, cr));
1331 }
1332 
1333 static int
1334 nfs3setattr(vnode_t *vp, struct vattr *vap, int flags, cred_t *cr)
1335 {
1336         int error;
1337         uint_t mask;
1338         SETATTR3args args;
1339         SETATTR3res res;
1340         int douprintf;
1341         rnode_t *rp;
1342         struct vattr va;
1343         mode_t omode;
1344         vsecattr_t *vsp;
1345         hrtime_t t;
1346 
1347         ASSERT(nfs_zone() == VTOMI(vp)->mi_zone);
1348         mask = vap->va_mask;
1349 
1350         rp = VTOR(vp);
1351 
1352         /*
1353          * Only need to flush pages if there are any pages and
1354          * if the file is marked as dirty in some fashion.  The
1355          * file must be flushed so that we can accurately
1356          * determine the size of the file and the cached data
1357          * after the SETATTR returns.  A file is considered to
1358          * be dirty if it is either marked with RDIRTY, has
1359          * outstanding i/o's active, or is mmap'd.  In this
1360          * last case, we can't tell whether there are dirty
1361          * pages, so we flush just to be sure.
1362          */
1363         if (vn_has_cached_data(vp) &&
1364             ((rp->r_flags & RDIRTY) ||
1365             rp->r_count > 0 ||
1366             rp->r_mapcnt > 0)) {
1367                 ASSERT(vp->v_type != VCHR);
1368                 error = nfs3_putpage(vp, (offset_t)0, 0, 0, cr, NULL);
1369                 if (error && (error == ENOSPC || error == EDQUOT)) {
1370                         mutex_enter(&rp->r_statelock);
1371                         if (!rp->r_error)
1372                                 rp->r_error = error;
1373                         mutex_exit(&rp->r_statelock);
1374                 }
1375         }
1376 
1377         args.object = *RTOFH3(rp);
1378         /*
1379          * If the intent is for the server to set the times,
1380          * there is no point in have the mask indicating set mtime or
1381          * atime, because the vap values may be junk, and so result
1382          * in an overflow error. Remove these flags from the vap mask
1383          * before calling in this case, and restore them afterwards.
1384          */
1385         if ((mask & (AT_ATIME | AT_MTIME)) && !(flags & ATTR_UTIME)) {
1386                 /* Use server times, so don't set the args time fields */
1387                 vap->va_mask &= ~(AT_ATIME | AT_MTIME);
1388                 error = vattr_to_sattr3(vap, &args.new_attributes);
1389                 vap->va_mask |= (mask & (AT_ATIME | AT_MTIME));
1390                 if (mask & AT_ATIME) {
1391                         args.new_attributes.atime.set_it = SET_TO_SERVER_TIME;
1392                 }
1393                 if (mask & AT_MTIME) {
1394                         args.new_attributes.mtime.set_it = SET_TO_SERVER_TIME;
1395                 }
1396         } else {
1397                 /* Either do not set times or use the client specified times */
1398                 error = vattr_to_sattr3(vap, &args.new_attributes);
1399         }
1400 
1401         if (error) {
1402                 /* req time field(s) overflow - return immediately */
1403                 return (error);
1404         }
1405 
1406         va.va_mask = AT_MODE | AT_CTIME;
1407         error = nfs3getattr(vp, &va, cr);
1408         if (error)
1409                 return (error);
1410         omode = va.va_mode;
1411 
1412 tryagain:
1413         if (mask & AT_SIZE) {
1414                 args.guard.check = TRUE;
1415                 args.guard.obj_ctime.seconds = va.va_ctime.tv_sec;
1416                 args.guard.obj_ctime.nseconds = va.va_ctime.tv_nsec;
1417         } else
1418                 args.guard.check = FALSE;
1419 
1420         douprintf = 1;
1421 
1422         t = gethrtime();
1423 
1424         error = rfs3call(VTOMI(vp), NFSPROC3_SETATTR,
1425             xdr_SETATTR3args, (caddr_t)&args,
1426             xdr_SETATTR3res, (caddr_t)&res, cr,
1427             &douprintf, &res.status, 0, NULL);
1428 
1429         /*
1430          * Purge the access cache and ACL cache if changing either the
1431          * owner of the file, the group owner, or the mode.  These may
1432          * change the access permissions of the file, so purge old
1433          * information and start over again.
1434          */
1435         if (mask & (AT_UID | AT_GID | AT_MODE)) {
1436                 (void) nfs_access_purge_rp(rp);
1437                 if (rp->r_secattr != NULL) {
1438                         mutex_enter(&rp->r_statelock);
1439                         vsp = rp->r_secattr;
1440                         rp->r_secattr = NULL;
1441                         mutex_exit(&rp->r_statelock);
1442                         if (vsp != NULL)
1443                                 nfs_acl_free(vsp);
1444                 }
1445         }
1446 
1447         if (error) {
1448                 PURGE_ATTRCACHE(vp);
1449                 return (error);
1450         }
1451 
1452         error = geterrno3(res.status);
1453         if (!error) {
1454                 /*
1455                  * If changing the size of the file, invalidate
1456                  * any local cached data which is no longer part
1457                  * of the file.  We also possibly invalidate the
1458                  * last page in the file.  We could use
1459                  * pvn_vpzero(), but this would mark the page as
1460                  * modified and require it to be written back to
1461                  * the server for no particularly good reason.
1462                  * This way, if we access it, then we bring it
1463                  * back in.  A read should be cheaper than a
1464                  * write.
1465                  */
1466                 if (mask & AT_SIZE) {
1467                         nfs_invalidate_pages(vp,
1468                             (vap->va_size & PAGEMASK), cr);
1469                 }
1470                 nfs3_cache_wcc_data(vp, &res.resok.obj_wcc, t, cr);
1471                 /*
1472                  * Some servers will change the mode to clear the setuid
1473                  * and setgid bits when changing the uid or gid.  The
1474                  * client needs to compensate appropriately.
1475                  */
1476                 if (mask & (AT_UID | AT_GID)) {
1477                         int terror;
1478 
1479                         va.va_mask = AT_MODE;
1480                         terror = nfs3getattr(vp, &va, cr);
1481                         if (!terror &&
1482                             (((mask & AT_MODE) && va.va_mode != vap->va_mode) ||
1483                             (!(mask & AT_MODE) && va.va_mode != omode))) {
1484                                 va.va_mask = AT_MODE;
1485                                 if (mask & AT_MODE)
1486                                         va.va_mode = vap->va_mode;
1487                                 else
1488                                         va.va_mode = omode;
1489                                 (void) nfs3setattr(vp, &va, 0, cr);
1490                         }
1491                 }
1492         } else {
1493                 nfs3_cache_wcc_data(vp, &res.resfail.obj_wcc, t, cr);
1494                 /*
1495                  * If we got back a "not synchronized" error, then
1496                  * we need to retry with a new guard value.  The
1497                  * guard value used is the change time.  If the
1498                  * server returned post_op_attr, then we can just
1499                  * retry because we have the latest attributes.
1500                  * Otherwise, we issue a GETATTR to get the latest
1501                  * attributes and then retry.  If we couldn't get
1502                  * the attributes this way either, then we give
1503                  * up because we can't complete the operation as
1504                  * required.
1505                  */
1506                 if (res.status == NFS3ERR_NOT_SYNC) {
1507                         va.va_mask = AT_CTIME;
1508                         if (nfs3getattr(vp, &va, cr) == 0)
1509                                 goto tryagain;
1510                 }
1511                 PURGE_STALE_FH(error, vp, cr);
1512         }
1513 
1514         return (error);
1515 }
1516 
1517 static int
1518 nfs3_accessx(void *vp, int mode, cred_t *cr)
1519 {
1520         ASSERT(nfs_zone() == VTOMI((vnode_t *)vp)->mi_zone);
1521         return (nfs3_access(vp, mode, 0, cr, NULL));
1522 }
1523 
1524 /* ARGSUSED */
1525 static int
1526 nfs3_access(vnode_t *vp, int mode, int flags, cred_t *cr, caller_context_t *ct)
1527 {
1528         int error;
1529         ACCESS3args args;
1530         ACCESS3res res;
1531         int douprintf;
1532         uint32 acc;
1533         rnode_t *rp;
1534         cred_t *cred, *ncr, *ncrfree = NULL;
1535         failinfo_t fi;
1536         nfs_access_type_t cacc;
1537         hrtime_t t;
1538 
1539         acc = 0;
1540         if (nfs_zone() != VTOMI(vp)->mi_zone)
1541                 return (EIO);
1542         if (mode & VREAD)
1543                 acc |= ACCESS3_READ;
1544         if (mode & VWRITE) {
1545                 if (vn_is_readonly(vp) && !IS_DEVVP(vp))
1546                         return (EROFS);
1547                 if (vp->v_type == VDIR)
1548                         acc |= ACCESS3_DELETE;
1549                 acc |= ACCESS3_MODIFY | ACCESS3_EXTEND;
1550         }
1551         if (mode & VEXEC) {
1552                 if (vp->v_type == VDIR)
1553                         acc |= ACCESS3_LOOKUP;
1554                 else
1555                         acc |= ACCESS3_EXECUTE;
1556         }
1557 
1558         rp = VTOR(vp);
1559         args.object = *VTOFH3(vp);
1560         if (vp->v_type == VDIR) {
1561                 args.access = ACCESS3_READ | ACCESS3_DELETE | ACCESS3_MODIFY |
1562                     ACCESS3_EXTEND | ACCESS3_LOOKUP;
1563         } else {
1564                 args.access = ACCESS3_READ | ACCESS3_MODIFY | ACCESS3_EXTEND |
1565                     ACCESS3_EXECUTE;
1566         }
1567         fi.vp = vp;
1568         fi.fhp = (caddr_t)&args.object;
1569         fi.copyproc = nfs3copyfh;
1570         fi.lookupproc = nfs3lookup;
1571         fi.xattrdirproc = acl_getxattrdir3;
1572 
1573         cred = cr;
1574         /*
1575          * ncr and ncrfree both initially
1576          * point to the memory area returned
1577          * by crnetadjust();
1578          * ncrfree not NULL when exiting means
1579          * that we need to release it
1580          */
1581         ncr = crnetadjust(cred);
1582         ncrfree = ncr;
1583 tryagain:
1584         if (rp->r_acache != NULL) {
1585                 cacc = nfs_access_check(rp, acc, cred);
1586                 if (cacc == NFS_ACCESS_ALLOWED) {
1587                         if (ncrfree != NULL)
1588                                 crfree(ncrfree);
1589                         return (0);
1590                 }
1591                 if (cacc == NFS_ACCESS_DENIED) {
1592                         /*
1593                          * If the cred can be adjusted, try again
1594                          * with the new cred.
1595                          */
1596                         if (ncr != NULL) {
1597                                 cred = ncr;
1598                                 ncr = NULL;
1599                                 goto tryagain;
1600                         }
1601                         if (ncrfree != NULL)
1602                                 crfree(ncrfree);
1603                         return (EACCES);
1604                 }
1605         }
1606 
1607         douprintf = 1;
1608 
1609         t = gethrtime();
1610 
1611         error = rfs3call(VTOMI(vp), NFSPROC3_ACCESS,
1612             xdr_ACCESS3args, (caddr_t)&args,
1613             xdr_ACCESS3res, (caddr_t)&res, cred,
1614             &douprintf, &res.status, 0, &fi);
1615 
1616         if (error) {
1617                 if (ncrfree != NULL)
1618                         crfree(ncrfree);
1619                 return (error);
1620         }
1621 
1622         error = geterrno3(res.status);
1623         if (!error) {
1624                 nfs3_cache_post_op_attr(vp, &res.resok.obj_attributes, t, cr);
1625                 nfs_access_cache(rp, args.access, res.resok.access, cred);
1626                 /*
1627                  * we just cached results with cred; if cred is the
1628                  * adjusted credentials from crnetadjust, we do not want
1629                  * to release them before exiting: hence setting ncrfree
1630                  * to NULL
1631                  */
1632                 if (cred != cr)
1633                         ncrfree = NULL;
1634                 if ((acc & res.resok.access) != acc) {
1635                         /*
1636                          * If the cred can be adjusted, try again
1637                          * with the new cred.
1638                          */
1639                         if (ncr != NULL) {
1640                                 cred = ncr;
1641                                 ncr = NULL;
1642                                 goto tryagain;
1643                         }
1644                         error = EACCES;
1645                 }
1646         } else {
1647                 nfs3_cache_post_op_attr(vp, &res.resfail.obj_attributes, t, cr);
1648                 PURGE_STALE_FH(error, vp, cr);
1649         }
1650 
1651         if (ncrfree != NULL)
1652                 crfree(ncrfree);
1653 
1654         return (error);
1655 }
1656 
1657 static int nfs3_do_symlink_cache = 1;
1658 
1659 /* ARGSUSED */
1660 static int
1661 nfs3_readlink(vnode_t *vp, struct uio *uiop, cred_t *cr, caller_context_t *ct)
1662 {
1663         int error;
1664         READLINK3args args;
1665         READLINK3res res;
1666         nfspath3 resdata_backup;
1667         rnode_t *rp;
1668         int douprintf;
1669         int len;
1670         failinfo_t fi;
1671         hrtime_t t;
1672 
1673         /*
1674          * Can't readlink anything other than a symbolic link.
1675          */
1676         if (vp->v_type != VLNK)
1677                 return (EINVAL);
1678         if (nfs_zone() != VTOMI(vp)->mi_zone)
1679                 return (EIO);
1680 
1681         rp = VTOR(vp);
1682         if (nfs3_do_symlink_cache && rp->r_symlink.contents != NULL) {
1683                 error = nfs3_validate_caches(vp, cr);
1684                 if (error)
1685                         return (error);
1686                 mutex_enter(&rp->r_statelock);
1687                 if (rp->r_symlink.contents != NULL) {
1688                         error = uiomove(rp->r_symlink.contents,
1689                             rp->r_symlink.len, UIO_READ, uiop);
1690                         mutex_exit(&rp->r_statelock);
1691                         return (error);
1692                 }
1693                 mutex_exit(&rp->r_statelock);
1694         }
1695 
1696         args.symlink = *VTOFH3(vp);
1697         fi.vp = vp;
1698         fi.fhp = (caddr_t)&args.symlink;
1699         fi.copyproc = nfs3copyfh;
1700         fi.lookupproc = nfs3lookup;
1701         fi.xattrdirproc = acl_getxattrdir3;
1702 
1703         res.resok.data = kmem_alloc(MAXPATHLEN, KM_SLEEP);
1704 
1705         resdata_backup = res.resok.data;
1706 
1707         douprintf = 1;
1708 
1709         t = gethrtime();
1710 
1711         error = rfs3call(VTOMI(vp), NFSPROC3_READLINK,
1712             xdr_READLINK3args, (caddr_t)&args,
1713             xdr_READLINK3res, (caddr_t)&res, cr,
1714             &douprintf, &res.status, 0, &fi);
1715 
1716         if (res.resok.data == nfs3nametoolong)
1717                 error = EINVAL;
1718 
1719         if (error) {
1720                 kmem_free(resdata_backup, MAXPATHLEN);
1721                 return (error);
1722         }
1723 
1724         error = geterrno3(res.status);
1725         if (!error) {
1726                 nfs3_cache_post_op_attr(vp, &res.resok.symlink_attributes, t,
1727                     cr);
1728                 len = strlen(res.resok.data);
1729                 error = uiomove(res.resok.data, len, UIO_READ, uiop);
1730                 if (nfs3_do_symlink_cache && rp->r_symlink.contents == NULL) {
1731                         mutex_enter(&rp->r_statelock);
1732                                 if (rp->r_symlink.contents == NULL) {
1733                                 rp->r_symlink.contents = res.resok.data;
1734                                 rp->r_symlink.len = len;
1735                                 rp->r_symlink.size = MAXPATHLEN;
1736                                 mutex_exit(&rp->r_statelock);
1737                         } else {
1738                                 mutex_exit(&rp->r_statelock);
1739 
1740                                 kmem_free((void *)res.resok.data, MAXPATHLEN);
1741                         }
1742                 } else {
1743                         kmem_free((void *)res.resok.data, MAXPATHLEN);
1744                 }
1745         } else {
1746                 nfs3_cache_post_op_attr(vp,
1747                     &res.resfail.symlink_attributes, t, cr);
1748                 PURGE_STALE_FH(error, vp, cr);
1749 
1750                 kmem_free((void *)res.resok.data, MAXPATHLEN);
1751 
1752         }
1753 
1754         /*
1755          * The over the wire error for attempting to readlink something
1756          * other than a symbolic link is ENXIO.  However, we need to
1757          * return EINVAL instead of ENXIO, so we map it here.
1758          */
1759         return (error == ENXIO ? EINVAL : error);
1760 }
1761 
1762 /*
1763  * Flush local dirty pages to stable storage on the server.
1764  *
1765  * If FNODSYNC is specified, then there is nothing to do because
1766  * metadata changes are not cached on the client before being
1767  * sent to the server.
1768  */
1769 /* ARGSUSED */
1770 static int
1771 nfs3_fsync(vnode_t *vp, int syncflag, cred_t *cr, caller_context_t *ct)
1772 {
1773         int error;
1774 
1775         if ((syncflag & FNODSYNC) || IS_SWAPVP(vp))
1776                 return (0);
1777         if (nfs_zone() != VTOMI(vp)->mi_zone)
1778                 return (EIO);
1779 
1780         error = nfs3_putpage_commit(vp, (offset_t)0, 0, cr);
1781         if (!error)
1782                 error = VTOR(vp)->r_error;
1783         return (error);
1784 }
1785 
1786 /*
1787  * Weirdness: if the file was removed or the target of a rename
1788  * operation while it was open, it got renamed instead.  Here we
1789  * remove the renamed file.
1790  */
1791 /* ARGSUSED */
1792 static void
1793 nfs3_inactive(vnode_t *vp, cred_t *cr, caller_context_t *ct)
1794 {
1795         rnode_t *rp;
1796 
1797         ASSERT(vp != DNLC_NO_VNODE);
1798 
1799         /*
1800          * If this is coming from the wrong zone, we let someone in the right
1801          * zone take care of it asynchronously.  We can get here due to
1802          * VN_RELE() being called from pageout() or fsflush().  This call may
1803          * potentially turn into an expensive no-op if, for instance, v_count
1804          * gets incremented in the meantime, but it's still correct.
1805          */
1806         if (nfs_zone() != VTOMI(vp)->mi_zone) {
1807                 nfs_async_inactive(vp, cr, nfs3_inactive);
1808                 return;
1809         }
1810 
1811         rp = VTOR(vp);
1812 redo:
1813         if (rp->r_unldvp != NULL) {
1814                 /*
1815                  * Save the vnode pointer for the directory where the
1816                  * unlinked-open file got renamed, then set it to NULL
1817                  * to prevent another thread from getting here before
1818                  * we're done with the remove.  While we have the
1819                  * statelock, make local copies of the pertinent rnode
1820                  * fields.  If we weren't to do this in an atomic way, the
1821                  * the unl* fields could become inconsistent with respect
1822                  * to each other due to a race condition between this
1823                  * code and nfs_remove().  See bug report 1034328.
1824                  */
1825                 mutex_enter(&rp->r_statelock);
1826                 if (rp->r_unldvp != NULL) {
1827                         vnode_t *unldvp;
1828                         char *unlname;
1829                         cred_t *unlcred;
1830                         REMOVE3args args;
1831                         REMOVE3res res;
1832                         int douprintf;
1833                         int error;
1834                         hrtime_t t;
1835 
1836                         unldvp = rp->r_unldvp;
1837                         rp->r_unldvp = NULL;
1838                         unlname = rp->r_unlname;
1839                         rp->r_unlname = NULL;
1840                         unlcred = rp->r_unlcred;
1841                         rp->r_unlcred = NULL;
1842                         mutex_exit(&rp->r_statelock);
1843 
1844                         /*
1845                          * If there are any dirty pages left, then flush
1846                          * them.  This is unfortunate because they just
1847                          * may get thrown away during the remove operation,
1848                          * but we have to do this for correctness.
1849                          */
1850                         if (vn_has_cached_data(vp) &&
1851                             ((rp->r_flags & RDIRTY) || rp->r_count > 0)) {
1852                                 ASSERT(vp->v_type != VCHR);
1853                                 error = nfs3_putpage(vp, (offset_t)0, 0, 0,
1854                                     cr, ct);
1855                                 if (error) {
1856                                         mutex_enter(&rp->r_statelock);
1857                                         if (!rp->r_error)
1858                                                 rp->r_error = error;
1859                                         mutex_exit(&rp->r_statelock);
1860                                 }
1861                         }
1862 
1863                         /*
1864                          * Do the remove operation on the renamed file
1865                          */
1866                         setdiropargs3(&args.object, unlname, unldvp);
1867 
1868                         douprintf = 1;
1869 
1870                         t = gethrtime();
1871 
1872                         error = rfs3call(VTOMI(unldvp), NFSPROC3_REMOVE,
1873                             xdr_diropargs3, (caddr_t)&args,
1874                             xdr_REMOVE3res, (caddr_t)&res, unlcred,
1875                             &douprintf, &res.status, 0, NULL);
1876 
1877                         if (error) {
1878                                 PURGE_ATTRCACHE(unldvp);
1879                         } else {
1880                                 error = geterrno3(res.status);
1881                                 if (!error) {
1882                                         nfs3_cache_wcc_data(unldvp,
1883                                             &res.resok.dir_wcc, t, cr);
1884                                         if (HAVE_RDDIR_CACHE(VTOR(unldvp)))
1885                                                 nfs_purge_rddir_cache(unldvp);
1886                                 } else {
1887                                         nfs3_cache_wcc_data(unldvp,
1888                                             &res.resfail.dir_wcc, t, cr);
1889                                         PURGE_STALE_FH(error, unldvp, cr);
1890                                 }
1891                         }
1892 
1893                         /*
1894                          * Release stuff held for the remove
1895                          */
1896                         VN_RELE(unldvp);
1897                         kmem_free(unlname, MAXNAMELEN);
1898                         crfree(unlcred);
1899                         goto redo;
1900                 }
1901                 mutex_exit(&rp->r_statelock);
1902         }
1903 
1904         rp_addfree(rp, cr);
1905 }
1906 
1907 /*
1908  * Remote file system operations having to do with directory manipulation.
1909  */
1910 
1911 /* ARGSUSED */
1912 static int
1913 nfs3_lookup(vnode_t *dvp, char *nm, vnode_t **vpp, struct pathname *pnp,
1914         int flags, vnode_t *rdir, cred_t *cr, caller_context_t *ct,
1915         int *direntflags, pathname_t *realpnp)
1916 {
1917         int error;
1918         vnode_t *vp;
1919         vnode_t *avp = NULL;
1920         rnode_t *drp;
1921 
1922         if (nfs_zone() != VTOMI(dvp)->mi_zone)
1923                 return (EPERM);
1924 
1925         drp = VTOR(dvp);
1926 
1927         /*
1928          * Are we looking up extended attributes?  If so, "dvp" is
1929          * the file or directory for which we want attributes, and
1930          * we need a lookup of the hidden attribute directory
1931          * before we lookup the rest of the path.
1932          */
1933         if (flags & LOOKUP_XATTR) {
1934                 bool_t cflag = ((flags & CREATE_XATTR_DIR) != 0);
1935                 mntinfo_t *mi;
1936 
1937                 mi = VTOMI(dvp);
1938                 if (!(mi->mi_flags & MI_EXTATTR))
1939                         return (EINVAL);
1940 
1941                 if (nfs_rw_enter_sig(&drp->r_rwlock, RW_READER, INTR(dvp)))
1942                         return (EINTR);
1943 
1944                 (void) nfs3lookup_dnlc(dvp, XATTR_DIR_NAME, &avp, cr);
1945                 if (avp == NULL)
1946                         error = acl_getxattrdir3(dvp, &avp, cflag, cr, 0);
1947                 else
1948                         error = 0;
1949 
1950                 nfs_rw_exit(&drp->r_rwlock);
1951 
1952                 if (error) {
1953                         if (mi->mi_flags & MI_EXTATTR)
1954                                 return (error);
1955                         return (EINVAL);
1956                 }
1957                 dvp = avp;
1958                 drp = VTOR(dvp);
1959         }
1960 
1961         if (nfs_rw_enter_sig(&drp->r_rwlock, RW_READER, INTR(dvp))) {
1962                 error = EINTR;
1963                 goto out;
1964         }
1965 
1966         error = nfs3lookup(dvp, nm, vpp, pnp, flags, rdir, cr, 0);
1967 
1968         nfs_rw_exit(&drp->r_rwlock);
1969 
1970         /*
1971          * If vnode is a device, create special vnode.
1972          */
1973         if (!error && IS_DEVVP(*vpp)) {
1974                 vp = *vpp;
1975                 *vpp = specvp(vp, vp->v_rdev, vp->v_type, cr);
1976                 VN_RELE(vp);
1977         }
1978 
1979 out:
1980         if (avp != NULL)
1981                 VN_RELE(avp);
1982 
1983         return (error);
1984 }
1985 
1986 static int nfs3_lookup_neg_cache = 1;
1987 
1988 #ifdef DEBUG
1989 static int nfs3_lookup_dnlc_hits = 0;
1990 static int nfs3_lookup_dnlc_misses = 0;
1991 static int nfs3_lookup_dnlc_neg_hits = 0;
1992 static int nfs3_lookup_dnlc_disappears = 0;
1993 static int nfs3_lookup_dnlc_lookups = 0;
1994 #endif
1995 
1996 /* ARGSUSED */
1997 int
1998 nfs3lookup(vnode_t *dvp, char *nm, vnode_t **vpp, struct pathname *pnp,
1999         int flags, vnode_t *rdir, cred_t *cr, int rfscall_flags)
2000 {
2001         int error;
2002         rnode_t *drp;
2003 
2004         ASSERT(nfs_zone() == VTOMI(dvp)->mi_zone);
2005         /*
2006          * If lookup is for "", just return dvp.  Don't need
2007          * to send it over the wire, look it up in the dnlc,
2008          * or perform any access checks.
2009          */
2010         if (*nm == '\0') {
2011                 VN_HOLD(dvp);
2012                 *vpp = dvp;
2013                 return (0);
2014         }
2015 
2016         /*
2017          * Can't do lookups in non-directories.
2018          */
2019         if (dvp->v_type != VDIR)
2020                 return (ENOTDIR);
2021 
2022         /*
2023          * If we're called with RFSCALL_SOFT, it's important that
2024          * the only rfscall is one we make directly; if we permit
2025          * an access call because we're looking up "." or validating
2026          * a dnlc hit, we'll deadlock because that rfscall will not
2027          * have the RFSCALL_SOFT set.
2028          */
2029         if (rfscall_flags & RFSCALL_SOFT)
2030                 goto callit;
2031 
2032         /*
2033          * If lookup is for ".", just return dvp.  Don't need
2034          * to send it over the wire or look it up in the dnlc,
2035          * just need to check access.
2036          */
2037         if (strcmp(nm, ".") == 0) {
2038                 error = nfs3_access(dvp, VEXEC, 0, cr, NULL);
2039                 if (error)
2040                         return (error);
2041                 VN_HOLD(dvp);
2042                 *vpp = dvp;
2043                 return (0);
2044         }
2045 
2046         drp = VTOR(dvp);
2047         if (!(drp->r_flags & RLOOKUP)) {
2048                 mutex_enter(&drp->r_statelock);
2049                 drp->r_flags |= RLOOKUP;
2050                 mutex_exit(&drp->r_statelock);
2051         }
2052 
2053         /*
2054          * Lookup this name in the DNLC.  If there was a valid entry,
2055          * then return the results of the lookup.
2056          */
2057         error = nfs3lookup_dnlc(dvp, nm, vpp, cr);
2058         if (error || *vpp != NULL)
2059                 return (error);
2060 
2061 callit:
2062         error = nfs3lookup_otw(dvp, nm, vpp, cr, rfscall_flags);
2063 
2064         return (error);
2065 }
2066 
2067 static int
2068 nfs3lookup_dnlc(vnode_t *dvp, char *nm, vnode_t **vpp, cred_t *cr)
2069 {
2070         int error;
2071         vnode_t *vp;
2072 
2073         ASSERT(*nm != '\0');
2074         ASSERT(nfs_zone() == VTOMI(dvp)->mi_zone);
2075         /*
2076          * Lookup this name in the DNLC.  If successful, then validate
2077          * the caches and then recheck the DNLC.  The DNLC is rechecked
2078          * just in case this entry got invalidated during the call
2079          * to nfs3_validate_caches.
2080          *
2081          * An assumption is being made that it is safe to say that a
2082          * file exists which may not on the server.  Any operations to
2083          * the server will fail with ESTALE.
2084          */
2085 #ifdef DEBUG
2086         nfs3_lookup_dnlc_lookups++;
2087 #endif
2088         vp = dnlc_lookup(dvp, nm);
2089         if (vp != NULL) {
2090                 VN_RELE(vp);
2091                 if (vp == DNLC_NO_VNODE && !vn_is_readonly(dvp)) {
2092                         PURGE_ATTRCACHE(dvp);
2093                 }
2094                 error = nfs3_validate_caches(dvp, cr);
2095                 if (error)
2096                         return (error);
2097                 vp = dnlc_lookup(dvp, nm);
2098                 if (vp != NULL) {
2099                         error = nfs3_access(dvp, VEXEC, 0, cr, NULL);
2100                         if (error) {
2101                                 VN_RELE(vp);
2102                                 return (error);
2103                         }
2104                         if (vp == DNLC_NO_VNODE) {
2105                                 VN_RELE(vp);
2106 #ifdef DEBUG
2107                                 nfs3_lookup_dnlc_neg_hits++;
2108 #endif
2109                                 return (ENOENT);
2110                         }
2111                         *vpp = vp;
2112 #ifdef DEBUG
2113                         nfs3_lookup_dnlc_hits++;
2114 #endif
2115                         return (0);
2116                 }
2117 #ifdef DEBUG
2118                 nfs3_lookup_dnlc_disappears++;
2119 #endif
2120         }
2121 #ifdef DEBUG
2122         else
2123                 nfs3_lookup_dnlc_misses++;
2124 #endif
2125 
2126         *vpp = NULL;
2127 
2128         return (0);
2129 }
2130 
2131 static int
2132 nfs3lookup_otw(vnode_t *dvp, char *nm, vnode_t **vpp, cred_t *cr,
2133         int rfscall_flags)
2134 {
2135         int error;
2136         LOOKUP3args args;
2137         LOOKUP3vres res;
2138         int douprintf;
2139         struct vattr vattr;
2140         struct vattr dvattr;
2141         vnode_t *vp;
2142         failinfo_t fi;
2143         hrtime_t t;
2144 
2145         ASSERT(*nm != '\0');
2146         ASSERT(dvp->v_type == VDIR);
2147         ASSERT(nfs_zone() == VTOMI(dvp)->mi_zone);
2148 
2149         setdiropargs3(&args.what, nm, dvp);
2150 
2151         fi.vp = dvp;
2152         fi.fhp = (caddr_t)&args.what.dir;
2153         fi.copyproc = nfs3copyfh;
2154         fi.lookupproc = nfs3lookup;
2155         fi.xattrdirproc = acl_getxattrdir3;
2156         res.obj_attributes.fres.vp = dvp;
2157         res.obj_attributes.fres.vap = &vattr;
2158         res.dir_attributes.fres.vp = dvp;
2159         res.dir_attributes.fres.vap = &dvattr;
2160 
2161         douprintf = 1;
2162 
2163         t = gethrtime();
2164 
2165         error = rfs3call(VTOMI(dvp), NFSPROC3_LOOKUP,
2166             xdr_diropargs3, (caddr_t)&args,
2167             xdr_LOOKUP3vres, (caddr_t)&res, cr,
2168             &douprintf, &res.status, rfscall_flags, &fi);
2169 
2170         if (error)
2171                 return (error);
2172 
2173         nfs3_cache_post_op_vattr(dvp, &res.dir_attributes, t, cr);
2174 
2175         error = geterrno3(res.status);
2176         if (error) {
2177                 PURGE_STALE_FH(error, dvp, cr);
2178                 if (error == ENOENT && nfs3_lookup_neg_cache)
2179                         dnlc_enter(dvp, nm, DNLC_NO_VNODE);
2180                 return (error);
2181         }
2182 
2183         if (res.obj_attributes.attributes) {
2184                 vp = makenfs3node_va(&res.object, res.obj_attributes.fres.vap,
2185                     dvp->v_vfsp, t, cr, VTOR(dvp)->r_path, nm);
2186         } else {
2187                 vp = makenfs3node_va(&res.object, NULL,
2188                     dvp->v_vfsp, t, cr, VTOR(dvp)->r_path, nm);
2189                 if (vp->v_type == VNON) {
2190                         vattr.va_mask = AT_TYPE;
2191                         error = nfs3getattr(vp, &vattr, cr);
2192                         if (error) {
2193                                 VN_RELE(vp);
2194                                 return (error);
2195                         }
2196                         vp->v_type = vattr.va_type;
2197                 }
2198         }
2199 
2200         if (!(rfscall_flags & RFSCALL_SOFT))
2201                 dnlc_update(dvp, nm, vp);
2202 
2203         *vpp = vp;
2204 
2205         return (error);
2206 }
2207 
2208 #ifdef DEBUG
2209 static int nfs3_create_misses = 0;
2210 #endif
2211 
2212 /* ARGSUSED */
2213 static int
2214 nfs3_create(vnode_t *dvp, char *nm, struct vattr *va, enum vcexcl exclusive,
2215         int mode, vnode_t **vpp, cred_t *cr, int lfaware, caller_context_t *ct,
2216         vsecattr_t *vsecp)
2217 {
2218         int error;
2219         vnode_t *vp;
2220         rnode_t *rp;
2221         struct vattr vattr;
2222         rnode_t *drp;
2223         vnode_t *tempvp;
2224 
2225         drp = VTOR(dvp);
2226         if (nfs_zone() != VTOMI(dvp)->mi_zone)
2227                 return (EPERM);
2228         if (nfs_rw_enter_sig(&drp->r_rwlock, RW_WRITER, INTR(dvp)))
2229                 return (EINTR);
2230 
2231 top:
2232         /*
2233          * We make a copy of the attributes because the caller does not
2234          * expect us to change what va points to.
2235          */
2236         vattr = *va;
2237 
2238         /*
2239          * If the pathname is "", just use dvp.  Don't need
2240          * to send it over the wire, look it up in the dnlc,
2241          * or perform any access checks.
2242          */
2243         if (*nm == '\0') {
2244                 error = 0;
2245                 VN_HOLD(dvp);
2246                 vp = dvp;
2247         /*
2248          * If the pathname is ".", just use dvp.  Don't need
2249          * to send it over the wire or look it up in the dnlc,
2250          * just need to check access.
2251          */
2252         } else if (strcmp(nm, ".") == 0) {
2253                 error = nfs3_access(dvp, VEXEC, 0, cr, ct);
2254                 if (error) {
2255                         nfs_rw_exit(&drp->r_rwlock);
2256                         return (error);
2257                 }
2258                 VN_HOLD(dvp);
2259                 vp = dvp;
2260         /*
2261          * We need to go over the wire, just to be sure whether the
2262          * file exists or not.  Using the DNLC can be dangerous in
2263          * this case when making a decision regarding existence.
2264          */
2265         } else {
2266                 error = nfs3lookup_otw(dvp, nm, &vp, cr, 0);
2267         }
2268         if (!error) {
2269                 if (exclusive == EXCL)
2270                         error = EEXIST;
2271                 else if (vp->v_type == VDIR && (mode & VWRITE))
2272                         error = EISDIR;
2273                 else {
2274                         /*
2275                          * If vnode is a device, create special vnode.
2276                          */
2277                         if (IS_DEVVP(vp)) {
2278                                 tempvp = vp;
2279                                 vp = specvp(vp, vp->v_rdev, vp->v_type, cr);
2280                                 VN_RELE(tempvp);
2281                         }
2282                         if (!(error = VOP_ACCESS(vp, mode, 0, cr, ct))) {
2283                                 if ((vattr.va_mask & AT_SIZE) &&
2284                                     vp->v_type == VREG) {
2285                                         rp = VTOR(vp);
2286                                         /*
2287                                          * Check here for large file handled
2288                                          * by LF-unaware process (as
2289                                          * ufs_create() does)
2290                                          */
2291                                         if (!(lfaware & FOFFMAX)) {
2292                                                 mutex_enter(&rp->r_statelock);
2293                                                 if (rp->r_size > MAXOFF32_T)
2294                                                         error = EOVERFLOW;
2295                                                 mutex_exit(&rp->r_statelock);
2296                                         }
2297                                         if (!error) {
2298                                                 vattr.va_mask = AT_SIZE;
2299                                                 error = nfs3setattr(vp,
2300                                                     &vattr, 0, cr);
2301                                         }
2302                                 }
2303                         }
2304                 }
2305                 nfs_rw_exit(&drp->r_rwlock);
2306                 if (error) {
2307                         VN_RELE(vp);
2308                 } else {
2309                         /*
2310                          * existing file got truncated, notify.
2311                          */
2312                         vnevent_create(vp, ct);
2313                         *vpp = vp;
2314                 }
2315                 return (error);
2316         }
2317 
2318         dnlc_remove(dvp, nm);
2319 
2320         /*
2321          * Decide what the group-id of the created file should be.
2322          * Set it in attribute list as advisory...
2323          */
2324         error = setdirgid(dvp, &vattr.va_gid, cr);
2325         if (error) {
2326                 nfs_rw_exit(&drp->r_rwlock);
2327                 return (error);
2328         }
2329         vattr.va_mask |= AT_GID;
2330 
2331         ASSERT(vattr.va_mask & AT_TYPE);
2332         if (vattr.va_type == VREG) {
2333                 ASSERT(vattr.va_mask & AT_MODE);
2334                 if (MANDMODE(vattr.va_mode)) {
2335                         nfs_rw_exit(&drp->r_rwlock);
2336                         return (EACCES);
2337                 }
2338                 error = nfs3create(dvp, nm, &vattr, exclusive, mode, vpp, cr,
2339                     lfaware);
2340                 /*
2341                  * If this is not an exclusive create, then the CREATE
2342                  * request will be made with the GUARDED mode set.  This
2343                  * means that the server will return EEXIST if the file
2344                  * exists.  The file could exist because of a retransmitted
2345                  * request.  In this case, we recover by starting over and
2346                  * checking to see whether the file exists.  This second
2347                  * time through it should and a CREATE request will not be
2348                  * sent.
2349                  *
2350                  * This handles the problem of a dangling CREATE request
2351                  * which contains attributes which indicate that the file
2352                  * should be truncated.  This retransmitted request could
2353                  * possibly truncate valid data in the file if not caught
2354                  * by the duplicate request mechanism on the server or if
2355                  * not caught by other means.  The scenario is:
2356                  *
2357                  * Client transmits CREATE request with size = 0
2358                  * Client times out, retransmits request.
2359                  * Response to the first request arrives from the server
2360                  *  and the client proceeds on.
2361                  * Client writes data to the file.
2362                  * The server now processes retransmitted CREATE request
2363                  *  and truncates file.
2364                  *
2365                  * The use of the GUARDED CREATE request prevents this from
2366                  * happening because the retransmitted CREATE would fail
2367                  * with EEXIST and would not truncate the file.
2368                  */
2369                 if (error == EEXIST && exclusive == NONEXCL) {
2370 #ifdef DEBUG
2371                         nfs3_create_misses++;
2372 #endif
2373                         goto top;
2374                 }
2375                 nfs_rw_exit(&drp->r_rwlock);
2376                 return (error);
2377         }
2378         error = nfs3mknod(dvp, nm, &vattr, exclusive, mode, vpp, cr);
2379         nfs_rw_exit(&drp->r_rwlock);
2380         return (error);
2381 }
2382 
2383 /* ARGSUSED */
2384 static int
2385 nfs3create(vnode_t *dvp, char *nm, struct vattr *va, enum vcexcl exclusive,
2386         int mode, vnode_t **vpp, cred_t *cr, int lfaware)
2387 {
2388         int error;
2389         CREATE3args args;
2390         CREATE3res res;
2391         int douprintf;
2392         vnode_t *vp;
2393         struct vattr vattr;
2394         nfstime3 *verfp;
2395         rnode_t *rp;
2396         timestruc_t now;
2397         hrtime_t t;
2398 
2399         ASSERT(nfs_zone() == VTOMI(dvp)->mi_zone);
2400         setdiropargs3(&args.where, nm, dvp);
2401         if (exclusive == EXCL) {
2402                 args.how.mode = EXCLUSIVE;
2403                 /*
2404                  * Construct the create verifier.  This verifier needs
2405                  * to be unique between different clients.  It also needs
2406                  * to vary for each exclusive create request generated
2407                  * from the client to the server.
2408                  *
2409                  * The first attempt is made to use the hostid and a
2410                  * unique number on the client.  If the hostid has not
2411                  * been set, the high resolution time that the exclusive
2412                  * create request is being made is used.  This will work
2413                  * unless two different clients, both with the hostid
2414                  * not set, attempt an exclusive create request on the
2415                  * same file, at exactly the same clock time.  The
2416                  * chances of this happening seem small enough to be
2417                  * reasonable.
2418                  */
2419                 verfp = (nfstime3 *)&args.how.createhow3_u.verf;
2420                 verfp->seconds = zone_get_hostid(NULL);
2421                 if (verfp->seconds != 0)
2422                         verfp->nseconds = newnum();
2423                 else {
2424                         gethrestime(&now);
2425                         verfp->seconds = now.tv_sec;
2426                         verfp->nseconds = now.tv_nsec;
2427                 }
2428                 /*
2429                  * Since the server will use this value for the mtime,
2430                  * make sure that it can't overflow. Zero out the MSB.
2431                  * The actual value does not matter here, only its uniqeness.
2432                  */
2433                 verfp->seconds %= INT32_MAX;
2434         } else {
2435                 /*
2436                  * Issue the non-exclusive create in guarded mode.  This
2437                  * may result in some false EEXIST responses for
2438                  * retransmitted requests, but these will be handled at
2439                  * a higher level.  By using GUARDED, duplicate requests
2440                  * to do file truncation and possible access problems
2441                  * can be avoided.
2442                  */
2443                 args.how.mode = GUARDED;
2444                 error = vattr_to_sattr3(va,
2445                     &args.how.createhow3_u.obj_attributes);
2446                 if (error) {
2447                         /* req time field(s) overflow - return immediately */
2448                         return (error);
2449                 }
2450         }
2451 
2452         douprintf = 1;
2453 
2454         t = gethrtime();
2455 
2456         error = rfs3call(VTOMI(dvp), NFSPROC3_CREATE,
2457             xdr_CREATE3args, (caddr_t)&args,
2458             xdr_CREATE3res, (caddr_t)&res, cr,
2459             &douprintf, &res.status, 0, NULL);
2460 
2461         if (error) {
2462                 PURGE_ATTRCACHE(dvp);
2463                 return (error);
2464         }
2465 
2466         error = geterrno3(res.status);
2467         if (!error) {
2468                 nfs3_cache_wcc_data(dvp, &res.resok.dir_wcc, t, cr);
2469                 if (HAVE_RDDIR_CACHE(VTOR(dvp)))
2470                         nfs_purge_rddir_cache(dvp);
2471 
2472                 /*
2473                  * On exclusive create the times need to be explicitly
2474                  * set to clear any potential verifier that may be stored
2475                  * in one of these fields (see comment below).  This
2476                  * is done here to cover the case where no post op attrs
2477                  * were returned or a 'invalid' time was returned in
2478                  * the attributes.
2479                  */
2480                 if (exclusive == EXCL)
2481                         va->va_mask |= (AT_MTIME | AT_ATIME);
2482 
2483                 if (!res.resok.obj.handle_follows) {
2484                         error = nfs3lookup(dvp, nm, &vp, NULL, 0, NULL, cr, 0);
2485                         if (error)
2486                                 return (error);
2487                 } else {
2488                         if (res.resok.obj_attributes.attributes) {
2489                                 vp = makenfs3node(&res.resok.obj.handle,
2490                                     &res.resok.obj_attributes.attr,
2491                                     dvp->v_vfsp, t, cr, NULL, NULL);
2492                         } else {
2493                                 vp = makenfs3node(&res.resok.obj.handle, NULL,
2494                                     dvp->v_vfsp, t, cr, NULL, NULL);
2495 
2496                                 /*
2497                                  * On an exclusive create, it is possible
2498                                  * that attributes were returned but those
2499                                  * postop attributes failed to decode
2500                                  * properly.  If this is the case,
2501                                  * then most likely the atime or mtime
2502                                  * were invalid for our client; this
2503                                  * is caused by the server storing the
2504                                  * create verifier in one of the time
2505                                  * fields(most likely mtime).
2506                                  * So... we are going to setattr just the
2507                                  * atime/mtime to clear things up.
2508                                  */
2509                                 if (exclusive == EXCL) {
2510                                         if (error =
2511                                             nfs3excl_create_settimes(vp,
2512                                             va, cr)) {
2513                                                 /*
2514                                                  * Setting the times failed.
2515                                                  * Remove the file and return
2516                                                  * the error.
2517                                                  */
2518                                                 VN_RELE(vp);
2519                                                 (void) nfs3_remove(dvp,
2520                                                     nm, cr, NULL, 0);
2521                                                 return (error);
2522                                         }
2523                                 }
2524 
2525                                 /*
2526                                  * This handles the non-exclusive case
2527                                  * and the exclusive case where no post op
2528                                  * attrs were returned.
2529                                  */
2530                                 if (vp->v_type == VNON) {
2531                                         vattr.va_mask = AT_TYPE;
2532                                         error = nfs3getattr(vp, &vattr, cr);
2533                                         if (error) {
2534                                                 VN_RELE(vp);
2535                                                 return (error);
2536                                         }
2537                                         vp->v_type = vattr.va_type;
2538                                 }
2539                         }
2540                         dnlc_update(dvp, nm, vp);
2541                 }
2542 
2543                 rp = VTOR(vp);
2544 
2545                 /*
2546                  * Check here for large file handled by
2547                  * LF-unaware process (as ufs_create() does)
2548                  */
2549                 if ((va->va_mask & AT_SIZE) && vp->v_type == VREG &&
2550                     !(lfaware & FOFFMAX)) {
2551                         mutex_enter(&rp->r_statelock);
2552                         if (rp->r_size > MAXOFF32_T) {
2553                                 mutex_exit(&rp->r_statelock);
2554                                 VN_RELE(vp);
2555                                 return (EOVERFLOW);
2556                         }
2557                         mutex_exit(&rp->r_statelock);
2558                 }
2559 
2560                 if (exclusive == EXCL &&
2561                     (va->va_mask & ~(AT_GID | AT_SIZE))) {
2562                         /*
2563                          * If doing an exclusive create, then generate
2564                          * a SETATTR to set the initial attributes.
2565                          * Try to set the mtime and the atime to the
2566                          * server's current time.  It is somewhat
2567                          * expected that these fields will be used to
2568                          * store the exclusive create cookie.  If not,
2569                          * server implementors will need to know that
2570                          * a SETATTR will follow an exclusive create
2571                          * and the cookie should be destroyed if
2572                          * appropriate. This work may have been done
2573                          * earlier in this function if post op attrs
2574                          * were not available.
2575                          *
2576                          * The AT_GID and AT_SIZE bits are turned off
2577                          * so that the SETATTR request will not attempt
2578                          * to process these.  The gid will be set
2579                          * separately if appropriate.  The size is turned
2580                          * off because it is assumed that a new file will
2581                          * be created empty and if the file wasn't empty,
2582                          * then the exclusive create will have failed
2583                          * because the file must have existed already.
2584                          * Therefore, no truncate operation is needed.
2585                          */
2586                         va->va_mask &= ~(AT_GID | AT_SIZE);
2587                         error = nfs3setattr(vp, va, 0, cr);
2588                         if (error) {
2589                                 /*
2590                                  * Couldn't correct the attributes of
2591                                  * the newly created file and the
2592                                  * attributes are wrong.  Remove the
2593                                  * file and return an error to the
2594                                  * application.
2595                                  */
2596                                 VN_RELE(vp);
2597                                 (void) nfs3_remove(dvp, nm, cr, NULL, 0);
2598                                 return (error);
2599                         }
2600                 }
2601 
2602                 if (va->va_gid != rp->r_attr.va_gid) {
2603                         /*
2604                          * If the gid on the file isn't right, then
2605                          * generate a SETATTR to attempt to change
2606                          * it.  This may or may not work, depending
2607                          * upon the server's semantics for allowing
2608                          * file ownership changes.
2609                          */
2610                         va->va_mask = AT_GID;
2611                         (void) nfs3setattr(vp, va, 0, cr);
2612                 }
2613 
2614                 /*
2615                  * If vnode is a device create special vnode
2616                  */
2617                 if (IS_DEVVP(vp)) {
2618                         *vpp = specvp(vp, vp->v_rdev, vp->v_type, cr);
2619                         VN_RELE(vp);
2620                 } else
2621                         *vpp = vp;
2622         } else {
2623                 nfs3_cache_wcc_data(dvp, &res.resfail.dir_wcc, t, cr);
2624                 PURGE_STALE_FH(error, dvp, cr);
2625         }
2626 
2627         return (error);
2628 }
2629 
2630 /*
2631  * Special setattr function to take care of rest of atime/mtime
2632  * after successful exclusive create.  This function exists to avoid
2633  * handling attributes from the server; exclusive the atime/mtime fields
2634  * may be 'invalid' in client's view and therefore can not be trusted.
2635  */
2636 static int
2637 nfs3excl_create_settimes(vnode_t *vp, struct vattr *vap, cred_t *cr)
2638 {
2639         int error;
2640         uint_t mask;
2641         SETATTR3args args;
2642         SETATTR3res res;
2643         int douprintf;
2644         rnode_t *rp;
2645         hrtime_t t;
2646 
2647         ASSERT(nfs_zone() == VTOMI(vp)->mi_zone);
2648         /* save the caller's mask so that it can be reset later */
2649         mask = vap->va_mask;
2650 
2651         rp = VTOR(vp);
2652 
2653         args.object = *RTOFH3(rp);
2654         args.guard.check = FALSE;
2655 
2656         /* Use the mask to initialize the arguments */
2657         vap->va_mask = 0;
2658         error = vattr_to_sattr3(vap, &args.new_attributes);
2659 
2660         /* We want to set just atime/mtime on this request */
2661         args.new_attributes.atime.set_it = SET_TO_SERVER_TIME;
2662         args.new_attributes.mtime.set_it = SET_TO_SERVER_TIME;
2663 
2664         douprintf = 1;
2665 
2666         t = gethrtime();
2667 
2668         error = rfs3call(VTOMI(vp), NFSPROC3_SETATTR,
2669             xdr_SETATTR3args, (caddr_t)&args,
2670             xdr_SETATTR3res, (caddr_t)&res, cr,
2671             &douprintf, &res.status, 0, NULL);
2672 
2673         if (error) {
2674                 vap->va_mask = mask;
2675                 return (error);
2676         }
2677 
2678         error = geterrno3(res.status);
2679         if (!error) {
2680                 /*
2681                  * It is important to pick up the attributes.
2682                  * Since this is the exclusive create path, the
2683                  * attributes on the initial create were ignored
2684                  * and we need these to have the correct info.
2685                  */
2686                 nfs3_cache_wcc_data(vp, &res.resok.obj_wcc, t, cr);
2687                 /*
2688                  * No need to do the atime/mtime work again so clear
2689                  * the bits.
2690                  */
2691                 mask &= ~(AT_ATIME | AT_MTIME);
2692         } else {
2693                 nfs3_cache_wcc_data(vp, &res.resfail.obj_wcc, t, cr);
2694         }
2695 
2696         vap->va_mask = mask;
2697 
2698         return (error);
2699 }
2700 
2701 /* ARGSUSED */
2702 static int
2703 nfs3mknod(vnode_t *dvp, char *nm, struct vattr *va, enum vcexcl exclusive,
2704         int mode, vnode_t **vpp, cred_t *cr)
2705 {
2706         int error;
2707         MKNOD3args args;
2708         MKNOD3res res;
2709         int douprintf;
2710         vnode_t *vp;
2711         struct vattr vattr;
2712         hrtime_t t;
2713 
2714         ASSERT(nfs_zone() == VTOMI(dvp)->mi_zone);
2715         switch (va->va_type) {
2716         case VCHR:
2717         case VBLK:
2718                 setdiropargs3(&args.where, nm, dvp);
2719                 args.what.type = (va->va_type == VCHR) ? NF3CHR : NF3BLK;
2720                 error = vattr_to_sattr3(va,
2721                     &args.what.mknoddata3_u.device.dev_attributes);
2722                 if (error) {
2723                         /* req time field(s) overflow - return immediately */
2724                         return (error);
2725                 }
2726                 args.what.mknoddata3_u.device.spec.specdata1 =
2727                     getmajor(va->va_rdev);
2728                 args.what.mknoddata3_u.device.spec.specdata2 =
2729                     getminor(va->va_rdev);
2730                 break;
2731 
2732         case VFIFO:
2733         case VSOCK:
2734                 setdiropargs3(&args.where, nm, dvp);
2735                 args.what.type = (va->va_type == VFIFO) ? NF3FIFO : NF3SOCK;
2736                 error = vattr_to_sattr3(va,
2737                     &args.what.mknoddata3_u.pipe_attributes);
2738                 if (error) {
2739                         /* req time field(s) overflow - return immediately */
2740                         return (error);
2741                 }
2742                 break;
2743 
2744         default:
2745                 return (EINVAL);
2746         }
2747 
2748         douprintf = 1;
2749 
2750         t = gethrtime();
2751 
2752         error = rfs3call(VTOMI(dvp), NFSPROC3_MKNOD,
2753             xdr_MKNOD3args, (caddr_t)&args,
2754             xdr_MKNOD3res, (caddr_t)&res, cr,
2755             &douprintf, &res.status, 0, NULL);
2756 
2757         if (error) {
2758                 PURGE_ATTRCACHE(dvp);
2759                 return (error);
2760         }
2761 
2762         error = geterrno3(res.status);
2763         if (!error) {
2764                 nfs3_cache_wcc_data(dvp, &res.resok.dir_wcc, t, cr);
2765                 if (HAVE_RDDIR_CACHE(VTOR(dvp)))
2766                         nfs_purge_rddir_cache(dvp);
2767 
2768                 if (!res.resok.obj.handle_follows) {
2769                         error = nfs3lookup(dvp, nm, &vp, NULL, 0, NULL, cr, 0);
2770                         if (error)
2771                                 return (error);
2772                 } else {
2773                         if (res.resok.obj_attributes.attributes) {
2774                                 vp = makenfs3node(&res.resok.obj.handle,
2775                                     &res.resok.obj_attributes.attr,
2776                                     dvp->v_vfsp, t, cr, NULL, NULL);
2777                         } else {
2778                                 vp = makenfs3node(&res.resok.obj.handle, NULL,
2779                                     dvp->v_vfsp, t, cr, NULL, NULL);
2780                                 if (vp->v_type == VNON) {
2781                                         vattr.va_mask = AT_TYPE;
2782                                         error = nfs3getattr(vp, &vattr, cr);
2783                                         if (error) {
2784                                                 VN_RELE(vp);
2785                                                 return (error);
2786                                         }
2787                                         vp->v_type = vattr.va_type;
2788                                 }
2789 
2790                         }
2791                         dnlc_update(dvp, nm, vp);
2792                 }
2793 
2794                 if (va->va_gid != VTOR(vp)->r_attr.va_gid) {
2795                         va->va_mask = AT_GID;
2796                         (void) nfs3setattr(vp, va, 0, cr);
2797                 }
2798 
2799                 /*
2800                  * If vnode is a device create special vnode
2801                  */
2802                 if (IS_DEVVP(vp)) {
2803                         *vpp = specvp(vp, vp->v_rdev, vp->v_type, cr);
2804                         VN_RELE(vp);
2805                 } else
2806                         *vpp = vp;
2807         } else {
2808                 nfs3_cache_wcc_data(dvp, &res.resfail.dir_wcc, t, cr);
2809                 PURGE_STALE_FH(error, dvp, cr);
2810         }
2811         return (error);
2812 }
2813 
2814 /*
2815  * Weirdness: if the vnode to be removed is open
2816  * we rename it instead of removing it and nfs_inactive
2817  * will remove the new name.
2818  */
2819 /* ARGSUSED */
2820 static int
2821 nfs3_remove(vnode_t *dvp, char *nm, cred_t *cr, caller_context_t *ct, int flags)
2822 {
2823         int error;
2824         REMOVE3args args;
2825         REMOVE3res res;
2826         vnode_t *vp;
2827         char *tmpname;
2828         int douprintf;
2829         rnode_t *rp;
2830         rnode_t *drp;
2831         hrtime_t t;
2832 
2833         if (nfs_zone() != VTOMI(dvp)->mi_zone)
2834                 return (EPERM);
2835         drp = VTOR(dvp);
2836         if (nfs_rw_enter_sig(&drp->r_rwlock, RW_WRITER, INTR(dvp)))
2837                 return (EINTR);
2838 
2839         error = nfs3lookup(dvp, nm, &vp, NULL, 0, NULL, cr, 0);
2840         if (error) {
2841                 nfs_rw_exit(&drp->r_rwlock);
2842                 return (error);
2843         }
2844 
2845         if (vp->v_type == VDIR && secpolicy_fs_linkdir(cr, dvp->v_vfsp)) {
2846                 VN_RELE(vp);
2847                 nfs_rw_exit(&drp->r_rwlock);
2848                 return (EPERM);
2849         }
2850 
2851         /*
2852          * First just remove the entry from the name cache, as it
2853          * is most likely the only entry for this vp.
2854          */
2855         dnlc_remove(dvp, nm);
2856 
2857         /*
2858          * If the file has a v_count > 1 then there may be more than one
2859          * entry in the name cache due multiple links or an open file,
2860          * but we don't have the real reference count so flush all
2861          * possible entries.
2862          */
2863         if (vp->v_count > 1)
2864                 dnlc_purge_vp(vp);
2865 
2866         /*
2867          * Now we have the real reference count on the vnode
2868          */
2869         rp = VTOR(vp);
2870         mutex_enter(&rp->r_statelock);
2871         if (vp->v_count > 1 &&
2872             (rp->r_unldvp == NULL || strcmp(nm, rp->r_unlname) == 0)) {
2873                 mutex_exit(&rp->r_statelock);
2874                 tmpname = newname();
2875                 error = nfs3rename(dvp, nm, dvp, tmpname, cr, ct);
2876                 if (error)
2877                         kmem_free(tmpname, MAXNAMELEN);
2878                 else {
2879                         mutex_enter(&rp->r_statelock);
2880                         if (rp->r_unldvp == NULL) {
2881                                 VN_HOLD(dvp);
2882                                 rp->r_unldvp = dvp;
2883                                 if (rp->r_unlcred != NULL)
2884                                         crfree(rp->r_unlcred);
2885                                 crhold(cr);
2886                                 rp->r_unlcred = cr;
2887                                 rp->r_unlname = tmpname;
2888                         } else {
2889                                 kmem_free(rp->r_unlname, MAXNAMELEN);
2890                                 rp->r_unlname = tmpname;
2891                         }
2892                         mutex_exit(&rp->r_statelock);
2893                 }
2894         } else {
2895                 mutex_exit(&rp->r_statelock);
2896                 /*
2897                  * We need to flush any dirty pages which happen to
2898                  * be hanging around before removing the file.  This
2899                  * shouldn't happen very often and mostly on file
2900                  * systems mounted "nocto".
2901                  */
2902                 if (vn_has_cached_data(vp) &&
2903                     ((rp->r_flags & RDIRTY) || rp->r_count > 0)) {
2904                         error = nfs3_putpage(vp, (offset_t)0, 0, 0, cr, ct);
2905                         if (error && (error == ENOSPC || error == EDQUOT)) {
2906                                 mutex_enter(&rp->r_statelock);
2907                                 if (!rp->r_error)
2908                                         rp->r_error = error;
2909                                 mutex_exit(&rp->r_statelock);
2910                         }
2911                 }
2912 
2913                 setdiropargs3(&args.object, nm, dvp);
2914 
2915                 douprintf = 1;
2916 
2917                 t = gethrtime();
2918 
2919                 error = rfs3call(VTOMI(dvp), NFSPROC3_REMOVE,
2920                     xdr_diropargs3, (caddr_t)&args,
2921                     xdr_REMOVE3res, (caddr_t)&res, cr,
2922                     &douprintf, &res.status, 0, NULL);
2923 
2924                 /*
2925                  * The xattr dir may be gone after last attr is removed,
2926                  * so flush it from dnlc.
2927                  */
2928                 if (dvp->v_flag & V_XATTRDIR)
2929                         dnlc_purge_vp(dvp);
2930 
2931                 PURGE_ATTRCACHE(vp);
2932 
2933                 if (error) {
2934                         PURGE_ATTRCACHE(dvp);
2935                 } else {
2936                         error = geterrno3(res.status);
2937                         if (!error) {
2938                                 nfs3_cache_wcc_data(dvp, &res.resok.dir_wcc, t,
2939                                     cr);
2940                                 if (HAVE_RDDIR_CACHE(drp))
2941                                         nfs_purge_rddir_cache(dvp);
2942                         } else {
2943                                 nfs3_cache_wcc_data(dvp, &res.resfail.dir_wcc,
2944                                     t, cr);
2945                                 PURGE_STALE_FH(error, dvp, cr);
2946                         }
2947                 }
2948         }
2949 
2950         if (error == 0) {
2951                 vnevent_remove(vp, dvp, nm, ct);
2952         }
2953         VN_RELE(vp);
2954 
2955         nfs_rw_exit(&drp->r_rwlock);
2956 
2957         return (error);
2958 }
2959 
2960 /* ARGSUSED */
2961 static int
2962 nfs3_link(vnode_t *tdvp, vnode_t *svp, char *tnm, cred_t *cr,
2963         caller_context_t *ct, int flags)
2964 {
2965         int error;
2966         LINK3args args;
2967         LINK3res res;
2968         vnode_t *realvp;
2969         int douprintf;
2970         mntinfo_t *mi;
2971         rnode_t *tdrp;
2972         hrtime_t t;
2973 
2974         if (nfs_zone() != VTOMI(tdvp)->mi_zone)
2975                 return (EPERM);
2976         if (VOP_REALVP(svp, &realvp, ct) == 0)
2977                 svp = realvp;
2978 
2979         mi = VTOMI(svp);
2980 
2981         if (!(mi->mi_flags & MI_LINK))
2982                 return (EOPNOTSUPP);
2983 
2984         args.file = *VTOFH3(svp);
2985         setdiropargs3(&args.link, tnm, tdvp);
2986 
2987         tdrp = VTOR(tdvp);
2988         if (nfs_rw_enter_sig(&tdrp->r_rwlock, RW_WRITER, INTR(tdvp)))
2989                 return (EINTR);
2990 
2991         dnlc_remove(tdvp, tnm);
2992 
2993         douprintf = 1;
2994 
2995         t = gethrtime();
2996 
2997         error = rfs3call(mi, NFSPROC3_LINK,
2998             xdr_LINK3args, (caddr_t)&args,
2999             xdr_LINK3res, (caddr_t)&res, cr,
3000             &douprintf, &res.status, 0, NULL);
3001 
3002         if (error) {
3003                 PURGE_ATTRCACHE(tdvp);
3004                 PURGE_ATTRCACHE(svp);
3005                 nfs_rw_exit(&tdrp->r_rwlock);
3006                 return (error);
3007         }
3008 
3009         error = geterrno3(res.status);
3010 
3011         if (!error) {
3012                 nfs3_cache_post_op_attr(svp, &res.resok.file_attributes, t, cr);
3013                 nfs3_cache_wcc_data(tdvp, &res.resok.linkdir_wcc, t, cr);
3014                 if (HAVE_RDDIR_CACHE(tdrp))
3015                         nfs_purge_rddir_cache(tdvp);
3016                 dnlc_update(tdvp, tnm, svp);
3017         } else {
3018                 nfs3_cache_post_op_attr(svp, &res.resfail.file_attributes, t,
3019                     cr);
3020                 nfs3_cache_wcc_data(tdvp, &res.resfail.linkdir_wcc, t, cr);
3021                 if (error == EOPNOTSUPP) {
3022                         mutex_enter(&mi->mi_lock);
3023                         mi->mi_flags &= ~MI_LINK;
3024                         mutex_exit(&mi->mi_lock);
3025                 }
3026         }
3027 
3028         nfs_rw_exit(&tdrp->r_rwlock);
3029 
3030         if (!error) {
3031                 /*
3032                  * Notify the source file of this link operation.
3033                  */
3034                 vnevent_link(svp, ct);
3035         }
3036         return (error);
3037 }
3038 
3039 /* ARGSUSED */
3040 static int
3041 nfs3_rename(vnode_t *odvp, char *onm, vnode_t *ndvp, char *nnm, cred_t *cr,
3042         caller_context_t *ct, int flags)
3043 {
3044         vnode_t *realvp;
3045 
3046         if (nfs_zone() != VTOMI(odvp)->mi_zone)
3047                 return (EPERM);
3048         if (VOP_REALVP(ndvp, &realvp, ct) == 0)
3049                 ndvp = realvp;
3050 
3051         return (nfs3rename(odvp, onm, ndvp, nnm, cr, ct));
3052 }
3053 
3054 /*
3055  * nfs3rename does the real work of renaming in NFS Version 3.
3056  */
3057 static int
3058 nfs3rename(vnode_t *odvp, char *onm, vnode_t *ndvp, char *nnm, cred_t *cr,
3059     caller_context_t *ct)
3060 {
3061         int error;
3062         RENAME3args args;
3063         RENAME3res res;
3064         int douprintf;
3065         vnode_t *nvp = NULL;
3066         vnode_t *ovp = NULL;
3067         char *tmpname;
3068         rnode_t *rp;
3069         rnode_t *odrp;
3070         rnode_t *ndrp;
3071         hrtime_t t;
3072 
3073         ASSERT(nfs_zone() == VTOMI(odvp)->mi_zone);
3074 
3075         if (strcmp(onm, ".") == 0 || strcmp(onm, "..") == 0 ||
3076             strcmp(nnm, ".") == 0 || strcmp(nnm, "..") == 0)
3077                 return (EINVAL);
3078 
3079         odrp = VTOR(odvp);
3080         ndrp = VTOR(ndvp);
3081         if ((intptr_t)odrp < (intptr_t)ndrp) {
3082                 if (nfs_rw_enter_sig(&odrp->r_rwlock, RW_WRITER, INTR(odvp)))
3083                         return (EINTR);
3084                 if (nfs_rw_enter_sig(&ndrp->r_rwlock, RW_WRITER, INTR(ndvp))) {
3085                         nfs_rw_exit(&odrp->r_rwlock);
3086                         return (EINTR);
3087                 }
3088         } else {
3089                 if (nfs_rw_enter_sig(&ndrp->r_rwlock, RW_WRITER, INTR(ndvp)))
3090                         return (EINTR);
3091                 if (nfs_rw_enter_sig(&odrp->r_rwlock, RW_WRITER, INTR(odvp))) {
3092                         nfs_rw_exit(&ndrp->r_rwlock);
3093                         return (EINTR);
3094                 }
3095         }
3096 
3097         /*
3098          * Lookup the target file.  If it exists, it needs to be
3099          * checked to see whether it is a mount point and whether
3100          * it is active (open).
3101          */
3102         error = nfs3lookup(ndvp, nnm, &nvp, NULL, 0, NULL, cr, 0);
3103         if (!error) {
3104                 /*
3105                  * If this file has been mounted on, then just
3106                  * return busy because renaming to it would remove
3107                  * the mounted file system from the name space.
3108                  */
3109                 if (vn_mountedvfs(nvp) != NULL) {
3110                         VN_RELE(nvp);
3111                         nfs_rw_exit(&odrp->r_rwlock);
3112                         nfs_rw_exit(&ndrp->r_rwlock);
3113                         return (EBUSY);
3114                 }
3115 
3116                 /*
3117                  * Purge the name cache of all references to this vnode
3118                  * so that we can check the reference count to infer
3119                  * whether it is active or not.
3120                  */
3121                 /*
3122                  * First just remove the entry from the name cache, as it
3123                  * is most likely the only entry for this vp.
3124                  */
3125                 dnlc_remove(ndvp, nnm);
3126                 /*
3127                  * If the file has a v_count > 1 then there may be more
3128                  * than one entry in the name cache due multiple links
3129                  * or an open file, but we don't have the real reference
3130                  * count so flush all possible entries.
3131                  */
3132                 if (nvp->v_count > 1)
3133                         dnlc_purge_vp(nvp);
3134 
3135                 /*
3136                  * If the vnode is active and is not a directory,
3137                  * arrange to rename it to a
3138                  * temporary file so that it will continue to be
3139                  * accessible.  This implements the "unlink-open-file"
3140                  * semantics for the target of a rename operation.
3141                  * Before doing this though, make sure that the
3142                  * source and target files are not already the same.
3143                  */
3144                 if (nvp->v_count > 1 && nvp->v_type != VDIR) {
3145                         /*
3146                          * Lookup the source name.
3147                          */
3148                         error = nfs3lookup(odvp, onm, &ovp, NULL, 0, NULL,
3149                             cr, 0);
3150 
3151                         /*
3152                          * The source name *should* already exist.
3153                          */
3154                         if (error) {
3155                                 VN_RELE(nvp);
3156                                 nfs_rw_exit(&odrp->r_rwlock);
3157                                 nfs_rw_exit(&ndrp->r_rwlock);
3158                                 return (error);
3159                         }
3160 
3161                         /*
3162                          * Compare the two vnodes.  If they are the same,
3163                          * just release all held vnodes and return success.
3164                          */
3165                         if (ovp == nvp) {
3166                                 VN_RELE(ovp);
3167                                 VN_RELE(nvp);
3168                                 nfs_rw_exit(&odrp->r_rwlock);
3169                                 nfs_rw_exit(&ndrp->r_rwlock);
3170                                 return (0);
3171                         }
3172 
3173                         /*
3174                          * Can't mix and match directories and non-
3175                          * directories in rename operations.  We already
3176                          * know that the target is not a directory.  If
3177                          * the source is a directory, return an error.
3178                          */
3179                         if (ovp->v_type == VDIR) {
3180                                 VN_RELE(ovp);
3181                                 VN_RELE(nvp);
3182                                 nfs_rw_exit(&odrp->r_rwlock);
3183                                 nfs_rw_exit(&ndrp->r_rwlock);
3184                                 return (ENOTDIR);
3185                         }
3186 
3187                         /*
3188                          * The target file exists, is not the same as
3189                          * the source file, and is active.  Link it
3190                          * to a temporary filename to avoid having
3191                          * the server removing the file completely.
3192                          */
3193                         tmpname = newname();
3194                         error = nfs3_link(ndvp, nvp, tmpname, cr, NULL, 0);
3195                         if (error == EOPNOTSUPP) {
3196                                 error = nfs3_rename(ndvp, nnm, ndvp, tmpname,
3197                                     cr, NULL, 0);
3198                         }
3199                         if (error) {
3200                                 kmem_free(tmpname, MAXNAMELEN);
3201                                 VN_RELE(ovp);
3202                                 VN_RELE(nvp);
3203                                 nfs_rw_exit(&odrp->r_rwlock);
3204                                 nfs_rw_exit(&ndrp->r_rwlock);
3205                                 return (error);
3206                         }
3207                         rp = VTOR(nvp);
3208                         mutex_enter(&rp->r_statelock);
3209                         if (rp->r_unldvp == NULL) {
3210                                 VN_HOLD(ndvp);
3211                                 rp->r_unldvp = ndvp;
3212                                 if (rp->r_unlcred != NULL)
3213                                         crfree(rp->r_unlcred);
3214                                 crhold(cr);
3215                                 rp->r_unlcred = cr;
3216                                 rp->r_unlname = tmpname;
3217                         } else {
3218                                 kmem_free(rp->r_unlname, MAXNAMELEN);
3219                                 rp->r_unlname = tmpname;
3220                         }
3221                         mutex_exit(&rp->r_statelock);
3222                 }
3223         }
3224 
3225         if (ovp == NULL) {
3226                 /*
3227                  * When renaming directories to be a subdirectory of a
3228                  * different parent, the dnlc entry for ".." will no
3229                  * longer be valid, so it must be removed.
3230                  *
3231                  * We do a lookup here to determine whether we are renaming
3232                  * a directory and we need to check if we are renaming
3233                  * an unlinked file.  This might have already been done
3234                  * in previous code, so we check ovp == NULL to avoid
3235                  * doing it twice.
3236                  */
3237 
3238                 error = nfs3lookup(odvp, onm, &ovp, NULL, 0, NULL, cr, 0);
3239                 /*
3240                  * The source name *should* already exist.
3241                  */
3242                 if (error) {
3243                         nfs_rw_exit(&odrp->r_rwlock);
3244                         nfs_rw_exit(&ndrp->r_rwlock);
3245                         if (nvp) {
3246                                 VN_RELE(nvp);
3247                         }
3248                         return (error);
3249                 }
3250                 ASSERT(ovp != NULL);
3251         }
3252 
3253         dnlc_remove(odvp, onm);
3254         dnlc_remove(ndvp, nnm);
3255 
3256         setdiropargs3(&args.from, onm, odvp);
3257         setdiropargs3(&args.to, nnm, ndvp);
3258 
3259         douprintf = 1;
3260 
3261         t = gethrtime();
3262 
3263         error = rfs3call(VTOMI(odvp), NFSPROC3_RENAME,
3264             xdr_RENAME3args, (caddr_t)&args,
3265             xdr_RENAME3res, (caddr_t)&res, cr,
3266             &douprintf, &res.status, 0, NULL);
3267 
3268         if (error) {
3269                 PURGE_ATTRCACHE(odvp);
3270                 PURGE_ATTRCACHE(ndvp);
3271                 VN_RELE(ovp);
3272                 nfs_rw_exit(&odrp->r_rwlock);
3273                 nfs_rw_exit(&ndrp->r_rwlock);
3274                 if (nvp) {
3275                         VN_RELE(nvp);
3276                 }
3277                 return (error);
3278         }
3279 
3280         error = geterrno3(res.status);
3281 
3282         if (!error) {
3283                 nfs3_cache_wcc_data(odvp, &res.resok.fromdir_wcc, t, cr);
3284                 if (HAVE_RDDIR_CACHE(odrp))
3285                         nfs_purge_rddir_cache(odvp);
3286                 if (ndvp != odvp) {
3287                         nfs3_cache_wcc_data(ndvp, &res.resok.todir_wcc, t, cr);
3288                         if (HAVE_RDDIR_CACHE(ndrp))
3289                                 nfs_purge_rddir_cache(ndvp);
3290                 }
3291                 /*
3292                  * when renaming directories to be a subdirectory of a
3293                  * different parent, the dnlc entry for ".." will no
3294                  * longer be valid, so it must be removed
3295                  */
3296                 rp = VTOR(ovp);
3297                 if (ndvp != odvp) {
3298                         if (ovp->v_type == VDIR) {
3299                                 dnlc_remove(ovp, "..");
3300                                 if (HAVE_RDDIR_CACHE(rp))
3301                                         nfs_purge_rddir_cache(ovp);
3302                         }
3303                 }
3304 
3305                 /*
3306                  * If we are renaming the unlinked file, update the
3307                  * r_unldvp and r_unlname as needed.
3308                  */
3309                 mutex_enter(&rp->r_statelock);
3310                 if (rp->r_unldvp != NULL) {
3311                         if (strcmp(rp->r_unlname, onm) == 0) {
3312                                 (void) strncpy(rp->r_unlname, nnm, MAXNAMELEN);
3313                                 rp->r_unlname[MAXNAMELEN - 1] = '\0';
3314 
3315                                 if (ndvp != rp->r_unldvp) {
3316                                         VN_RELE(rp->r_unldvp);
3317                                         rp->r_unldvp = ndvp;
3318                                         VN_HOLD(ndvp);
3319                                 }
3320                         }
3321                 }
3322                 mutex_exit(&rp->r_statelock);
3323         } else {
3324                 nfs3_cache_wcc_data(odvp, &res.resfail.fromdir_wcc, t, cr);
3325                 if (ndvp != odvp) {
3326                         nfs3_cache_wcc_data(ndvp, &res.resfail.todir_wcc, t,
3327                             cr);
3328                 }
3329                 /*
3330                  * System V defines rename to return EEXIST, not
3331                  * ENOTEMPTY if the target directory is not empty.
3332                  * Over the wire, the error is NFSERR_ENOTEMPTY
3333                  * which geterrno maps to ENOTEMPTY.
3334                  */
3335                 if (error == ENOTEMPTY)
3336                         error = EEXIST;
3337         }
3338 
3339         if (error == 0) {
3340                 if (nvp)
3341                         vnevent_rename_dest(nvp, ndvp, nnm, ct);
3342 
3343                 if (odvp != ndvp)
3344                         vnevent_rename_dest_dir(ndvp, ct);
3345                 ASSERT(ovp != NULL);
3346                 vnevent_rename_src(ovp, odvp, onm, ct);
3347         }
3348 
3349         if (nvp) {
3350                 VN_RELE(nvp);
3351         }
3352         VN_RELE(ovp);
3353 
3354         nfs_rw_exit(&odrp->r_rwlock);
3355         nfs_rw_exit(&ndrp->r_rwlock);
3356 
3357         return (error);
3358 }
3359 
3360 /* ARGSUSED */
3361 static int
3362 nfs3_mkdir(vnode_t *dvp, char *nm, struct vattr *va, vnode_t **vpp, cred_t *cr,
3363         caller_context_t *ct, int flags, vsecattr_t *vsecp)
3364 {
3365         int error;
3366         MKDIR3args args;
3367         MKDIR3res res;
3368         int douprintf;
3369         struct vattr vattr;
3370         vnode_t *vp;
3371         rnode_t *drp;
3372         hrtime_t t;
3373 
3374         if (nfs_zone() != VTOMI(dvp)->mi_zone)
3375                 return (EPERM);
3376         setdiropargs3(&args.where, nm, dvp);
3377 
3378         /*
3379          * Decide what the group-id and set-gid bit of the created directory
3380          * should be.  May have to do a setattr to get the gid right.
3381          */
3382         error = setdirgid(dvp, &va->va_gid, cr);
3383         if (error)
3384                 return (error);
3385         error = setdirmode(dvp, &va->va_mode, cr);
3386         if (error)
3387                 return (error);
3388         va->va_mask |= AT_MODE|AT_GID;
3389 
3390         error = vattr_to_sattr3(va, &args.attributes);
3391         if (error) {
3392                 /* req time field(s) overflow - return immediately */
3393                 return (error);
3394         }
3395 
3396         drp = VTOR(dvp);
3397         if (nfs_rw_enter_sig(&drp->r_rwlock, RW_WRITER, INTR(dvp)))
3398                 return (EINTR);
3399 
3400         dnlc_remove(dvp, nm);
3401 
3402         douprintf = 1;
3403 
3404         t = gethrtime();
3405 
3406         error = rfs3call(VTOMI(dvp), NFSPROC3_MKDIR,
3407             xdr_MKDIR3args, (caddr_t)&args,
3408             xdr_MKDIR3res, (caddr_t)&res, cr,
3409             &douprintf, &res.status, 0, NULL);
3410 
3411         if (error) {
3412                 PURGE_ATTRCACHE(dvp);
3413                 nfs_rw_exit(&drp->r_rwlock);
3414                 return (error);
3415         }
3416 
3417         error = geterrno3(res.status);
3418         if (!error) {
3419                 nfs3_cache_wcc_data(dvp, &res.resok.dir_wcc, t, cr);
3420                 if (HAVE_RDDIR_CACHE(drp))
3421                         nfs_purge_rddir_cache(dvp);
3422 
3423                 if (!res.resok.obj.handle_follows) {
3424                         error = nfs3lookup(dvp, nm, &vp, NULL, 0, NULL, cr, 0);
3425                         if (error) {
3426                                 nfs_rw_exit(&drp->r_rwlock);
3427                                 return (error);
3428                         }
3429                 } else {
3430                         if (res.resok.obj_attributes.attributes) {
3431                                 vp = makenfs3node(&res.resok.obj.handle,
3432                                     &res.resok.obj_attributes.attr,
3433                                     dvp->v_vfsp, t, cr, NULL, NULL);
3434                         } else {
3435                                 vp = makenfs3node(&res.resok.obj.handle, NULL,
3436                                     dvp->v_vfsp, t, cr, NULL, NULL);
3437                                 if (vp->v_type == VNON) {
3438                                         vattr.va_mask = AT_TYPE;
3439                                         error = nfs3getattr(vp, &vattr, cr);
3440                                         if (error) {
3441                                                 VN_RELE(vp);
3442                                                 nfs_rw_exit(&drp->r_rwlock);
3443                                                 return (error);
3444                                         }
3445                                         vp->v_type = vattr.va_type;
3446                                 }
3447                         }
3448                         dnlc_update(dvp, nm, vp);
3449                 }
3450                 if (va->va_gid != VTOR(vp)->r_attr.va_gid) {
3451                         va->va_mask = AT_GID;
3452                         (void) nfs3setattr(vp, va, 0, cr);
3453                 }
3454                 *vpp = vp;
3455         } else {
3456                 nfs3_cache_wcc_data(dvp, &res.resfail.dir_wcc, t, cr);
3457                 PURGE_STALE_FH(error, dvp, cr);
3458         }
3459 
3460         nfs_rw_exit(&drp->r_rwlock);
3461 
3462         return (error);
3463 }
3464 
3465 /* ARGSUSED */
3466 static int
3467 nfs3_rmdir(vnode_t *dvp, char *nm, vnode_t *cdir, cred_t *cr,
3468         caller_context_t *ct, int flags)
3469 {
3470         int error;
3471         RMDIR3args args;
3472         RMDIR3res res;
3473         vnode_t *vp;
3474         int douprintf;
3475         rnode_t *drp;
3476         hrtime_t t;
3477 
3478         if (nfs_zone() != VTOMI(dvp)->mi_zone)
3479                 return (EPERM);
3480         drp = VTOR(dvp);
3481         if (nfs_rw_enter_sig(&drp->r_rwlock, RW_WRITER, INTR(dvp)))
3482                 return (EINTR);
3483 
3484         /*
3485          * Attempt to prevent a rmdir(".") from succeeding.
3486          */
3487         error = nfs3lookup(dvp, nm, &vp, NULL, 0, NULL, cr, 0);
3488         if (error) {
3489                 nfs_rw_exit(&drp->r_rwlock);
3490                 return (error);
3491         }
3492 
3493         if (vp == cdir) {
3494                 VN_RELE(vp);
3495                 nfs_rw_exit(&drp->r_rwlock);
3496                 return (EINVAL);
3497         }
3498 
3499         setdiropargs3(&args.object, nm, dvp);
3500 
3501         /*
3502          * First just remove the entry from the name cache, as it
3503          * is most likely an entry for this vp.
3504          */
3505         dnlc_remove(dvp, nm);
3506 
3507         /*
3508          * If there vnode reference count is greater than one, then
3509          * there may be additional references in the DNLC which will
3510          * need to be purged.  First, trying removing the entry for
3511          * the parent directory and see if that removes the additional
3512          * reference(s).  If that doesn't do it, then use dnlc_purge_vp
3513          * to completely remove any references to the directory which
3514          * might still exist in the DNLC.
3515          */
3516         if (vp->v_count > 1) {
3517                 dnlc_remove(vp, "..");
3518                 if (vp->v_count > 1)
3519                         dnlc_purge_vp(vp);
3520         }
3521 
3522         douprintf = 1;
3523 
3524         t = gethrtime();
3525 
3526         error = rfs3call(VTOMI(dvp), NFSPROC3_RMDIR,
3527             xdr_diropargs3, (caddr_t)&args,
3528             xdr_RMDIR3res, (caddr_t)&res, cr,
3529             &douprintf, &res.status, 0, NULL);
3530 
3531         PURGE_ATTRCACHE(vp);
3532 
3533         if (error) {
3534                 PURGE_ATTRCACHE(dvp);
3535                 VN_RELE(vp);
3536                 nfs_rw_exit(&drp->r_rwlock);
3537                 return (error);
3538         }
3539 
3540         error = geterrno3(res.status);
3541         if (!error) {
3542                 nfs3_cache_wcc_data(dvp, &res.resok.dir_wcc, t, cr);
3543                 if (HAVE_RDDIR_CACHE(drp))
3544                         nfs_purge_rddir_cache(dvp);
3545                 if (HAVE_RDDIR_CACHE(VTOR(vp)))
3546                         nfs_purge_rddir_cache(vp);
3547         } else {
3548                 nfs3_cache_wcc_data(dvp, &res.resfail.dir_wcc, t, cr);
3549                 PURGE_STALE_FH(error, dvp, cr);
3550                 /*
3551                  * System V defines rmdir to return EEXIST, not
3552                  * ENOTEMPTY if the directory is not empty.  Over
3553                  * the wire, the error is NFSERR_ENOTEMPTY which
3554                  * geterrno maps to ENOTEMPTY.
3555                  */
3556                 if (error == ENOTEMPTY)
3557                         error = EEXIST;
3558         }
3559 
3560         if (error == 0) {
3561                 vnevent_rmdir(vp, dvp, nm, ct);
3562         }
3563         VN_RELE(vp);
3564 
3565         nfs_rw_exit(&drp->r_rwlock);
3566 
3567         return (error);
3568 }
3569 
3570 /* ARGSUSED */
3571 static int
3572 nfs3_symlink(vnode_t *dvp, char *lnm, struct vattr *tva, char *tnm, cred_t *cr,
3573         caller_context_t *ct, int flags)
3574 {
3575         int error;
3576         SYMLINK3args args;
3577         SYMLINK3res res;
3578         int douprintf;
3579         mntinfo_t *mi;
3580         vnode_t *vp;
3581         rnode_t *rp;
3582         char *contents;
3583         rnode_t *drp;
3584         hrtime_t t;
3585 
3586         mi = VTOMI(dvp);
3587 
3588         if (nfs_zone() != mi->mi_zone)
3589                 return (EPERM);
3590         if (!(mi->mi_flags & MI_SYMLINK))
3591                 return (EOPNOTSUPP);
3592 
3593         setdiropargs3(&args.where, lnm, dvp);
3594         error = vattr_to_sattr3(tva, &args.symlink.symlink_attributes);
3595         if (error) {
3596                 /* req time field(s) overflow - return immediately */
3597                 return (error);
3598         }
3599         args.symlink.symlink_data = tnm;
3600 
3601         drp = VTOR(dvp);
3602         if (nfs_rw_enter_sig(&drp->r_rwlock, RW_WRITER, INTR(dvp)))
3603                 return (EINTR);
3604 
3605         dnlc_remove(dvp, lnm);
3606 
3607         douprintf = 1;
3608 
3609         t = gethrtime();
3610 
3611         error = rfs3call(mi, NFSPROC3_SYMLINK,
3612             xdr_SYMLINK3args, (caddr_t)&args,
3613             xdr_SYMLINK3res, (caddr_t)&res, cr,
3614             &douprintf, &res.status, 0, NULL);
3615 
3616         if (error) {
3617                 PURGE_ATTRCACHE(dvp);
3618                 nfs_rw_exit(&drp->r_rwlock);
3619                 return (error);
3620         }
3621 
3622         error = geterrno3(res.status);
3623         if (!error) {
3624                 nfs3_cache_wcc_data(dvp, &res.resok.dir_wcc, t, cr);
3625                 if (HAVE_RDDIR_CACHE(drp))
3626                         nfs_purge_rddir_cache(dvp);
3627 
3628                 if (res.resok.obj.handle_follows) {
3629                         if (res.resok.obj_attributes.attributes) {
3630                                 vp = makenfs3node(&res.resok.obj.handle,
3631                                     &res.resok.obj_attributes.attr,
3632                                     dvp->v_vfsp, t, cr, NULL, NULL);
3633                         } else {
3634                                 vp = makenfs3node(&res.resok.obj.handle, NULL,
3635                                     dvp->v_vfsp, t, cr, NULL, NULL);
3636                                 vp->v_type = VLNK;
3637                                 vp->v_rdev = 0;
3638                         }
3639                         dnlc_update(dvp, lnm, vp);
3640                         rp = VTOR(vp);
3641                         if (nfs3_do_symlink_cache &&
3642                             rp->r_symlink.contents == NULL) {
3643 
3644                                 contents = kmem_alloc(MAXPATHLEN,
3645                                     KM_NOSLEEP);
3646 
3647                                 if (contents != NULL) {
3648                                         mutex_enter(&rp->r_statelock);
3649                                         if (rp->r_symlink.contents == NULL) {
3650                                                 rp->r_symlink.len = strlen(tnm);
3651                                                 bcopy(tnm, contents,
3652                                                     rp->r_symlink.len);
3653                                                 rp->r_symlink.contents =
3654                                                     contents;
3655                                                 rp->r_symlink.size = MAXPATHLEN;
3656                                                 mutex_exit(&rp->r_statelock);
3657                                         } else {
3658                                                 mutex_exit(&rp->r_statelock);
3659                                                 kmem_free((void *)contents,
3660                                                     MAXPATHLEN);
3661                                         }
3662                                 }
3663                         }
3664                         VN_RELE(vp);
3665                 }
3666         } else {
3667                 nfs3_cache_wcc_data(dvp, &res.resfail.dir_wcc, t, cr);
3668                 PURGE_STALE_FH(error, dvp, cr);
3669                 if (error == EOPNOTSUPP) {
3670                         mutex_enter(&mi->mi_lock);
3671                         mi->mi_flags &= ~MI_SYMLINK;
3672                         mutex_exit(&mi->mi_lock);
3673                 }
3674         }
3675 
3676         nfs_rw_exit(&drp->r_rwlock);
3677 
3678         return (error);
3679 }
3680 
3681 #ifdef DEBUG
3682 static int nfs3_readdir_cache_hits = 0;
3683 static int nfs3_readdir_cache_shorts = 0;
3684 static int nfs3_readdir_cache_waits = 0;
3685 static int nfs3_readdir_cache_misses = 0;
3686 static int nfs3_readdir_readahead = 0;
3687 #endif
3688 
3689 static int nfs3_shrinkreaddir = 0;
3690 
3691 /*
3692  * Read directory entries.
3693  * There are some weird things to look out for here.  The uio_loffset
3694  * field is either 0 or it is the offset returned from a previous
3695  * readdir.  It is an opaque value used by the server to find the
3696  * correct directory block to read. The count field is the number
3697  * of blocks to read on the server.  This is advisory only, the server
3698  * may return only one block's worth of entries.  Entries may be compressed
3699  * on the server.
3700  */
3701 /* ARGSUSED */
3702 static int
3703 nfs3_readdir(vnode_t *vp, struct uio *uiop, cred_t *cr, int *eofp,
3704         caller_context_t *ct, int flags)
3705 {
3706         int error;
3707         size_t count;
3708         rnode_t *rp;
3709         rddir_cache *rdc;
3710         rddir_cache *nrdc;
3711         rddir_cache *rrdc;
3712 #ifdef DEBUG
3713         int missed;
3714 #endif
3715         int doreadahead;
3716         rddir_cache srdc;
3717         avl_index_t where;
3718 
3719         if (nfs_zone() != VTOMI(vp)->mi_zone)
3720                 return (EIO);
3721         rp = VTOR(vp);
3722 
3723         ASSERT(nfs_rw_lock_held(&rp->r_rwlock, RW_READER));
3724 
3725         /*
3726          * Make sure that the directory cache is valid.
3727          */
3728         if (HAVE_RDDIR_CACHE(rp)) {
3729                 if (nfs_disable_rddir_cache) {
3730                         /*
3731                          * Setting nfs_disable_rddir_cache in /etc/system
3732                          * allows interoperability with servers that do not
3733                          * properly update the attributes of directories.
3734                          * Any cached information gets purged before an
3735                          * access is made to it.
3736                          */
3737                         nfs_purge_rddir_cache(vp);
3738                 } else {
3739                         error = nfs3_validate_caches(vp, cr);
3740                         if (error)
3741                                 return (error);
3742                 }
3743         }
3744 
3745         /*
3746          * It is possible that some servers may not be able to correctly
3747          * handle a large READDIR or READDIRPLUS request due to bugs in
3748          * their implementation.  In order to continue to interoperate
3749          * with them, this workaround is provided to limit the maximum
3750          * size of a READDIRPLUS request to 1024.  In any case, the request
3751          * size is limited to MAXBSIZE.
3752          */
3753         count = MIN(uiop->uio_iov->iov_len,
3754             nfs3_shrinkreaddir ? 1024 : MAXBSIZE);
3755 
3756         nrdc = NULL;
3757 #ifdef DEBUG
3758         missed = 0;
3759 #endif
3760 top:
3761         /*
3762          * Short circuit last readdir which always returns 0 bytes.
3763          * This can be done after the directory has been read through
3764          * completely at least once.  This will set r_direof which
3765          * can be used to find the value of the last cookie.
3766          */
3767         mutex_enter(&rp->r_statelock);
3768         if (rp->r_direof != NULL &&
3769             uiop->uio_loffset == rp->r_direof->nfs3_ncookie) {
3770                 mutex_exit(&rp->r_statelock);
3771 #ifdef DEBUG
3772                 nfs3_readdir_cache_shorts++;
3773 #endif
3774                 if (eofp)
3775                         *eofp = 1;
3776                 if (nrdc != NULL)
3777                         rddir_cache_rele(nrdc);
3778                 return (0);
3779         }
3780         /*
3781          * Look for a cache entry.  Cache entries are identified
3782          * by the NFS cookie value and the byte count requested.
3783          */
3784         srdc.nfs3_cookie = uiop->uio_loffset;
3785         srdc.buflen = count;
3786         rdc = avl_find(&rp->r_dir, &srdc, &where);
3787         if (rdc != NULL) {
3788                 rddir_cache_hold(rdc);
3789                 /*
3790                  * If the cache entry is in the process of being
3791                  * filled in, wait until this completes.  The
3792                  * RDDIRWAIT bit is set to indicate that someone
3793                  * is waiting and then the thread currently
3794                  * filling the entry is done, it should do a
3795                  * cv_broadcast to wakeup all of the threads
3796                  * waiting for it to finish.
3797                  */
3798                 if (rdc->flags & RDDIR) {
3799                         nfs_rw_exit(&rp->r_rwlock);
3800                         rdc->flags |= RDDIRWAIT;
3801 #ifdef DEBUG
3802                         nfs3_readdir_cache_waits++;
3803 #endif
3804                         if (!cv_wait_sig(&rdc->cv, &rp->r_statelock)) {
3805                                 /*
3806                                  * We got interrupted, probably
3807                                  * the user typed ^C or an alarm
3808                                  * fired.  We free the new entry
3809                                  * if we allocated one.
3810                                  */
3811                                 mutex_exit(&rp->r_statelock);
3812                                 (void) nfs_rw_enter_sig(&rp->r_rwlock,
3813                                     RW_READER, FALSE);
3814                                 rddir_cache_rele(rdc);
3815                                 if (nrdc != NULL)
3816                                         rddir_cache_rele(nrdc);
3817                                 return (EINTR);
3818                         }
3819                         mutex_exit(&rp->r_statelock);
3820                         (void) nfs_rw_enter_sig(&rp->r_rwlock,
3821                             RW_READER, FALSE);
3822                         rddir_cache_rele(rdc);
3823                         goto top;
3824                 }
3825                 /*
3826                  * Check to see if a readdir is required to
3827                  * fill the entry.  If so, mark this entry
3828                  * as being filled, remove our reference,
3829                  * and branch to the code to fill the entry.
3830                  */
3831                 if (rdc->flags & RDDIRREQ) {
3832                         rdc->flags &= ~RDDIRREQ;
3833                         rdc->flags |= RDDIR;
3834                         if (nrdc != NULL)
3835                                 rddir_cache_rele(nrdc);
3836                         nrdc = rdc;
3837                         mutex_exit(&rp->r_statelock);
3838                         goto bottom;
3839                 }
3840 #ifdef DEBUG
3841                 if (!missed)
3842                         nfs3_readdir_cache_hits++;
3843 #endif
3844                 /*
3845                  * If an error occurred while attempting
3846                  * to fill the cache entry, just return it.
3847                  */
3848                 if (rdc->error) {
3849                         error = rdc->error;
3850                         mutex_exit(&rp->r_statelock);
3851                         rddir_cache_rele(rdc);
3852                         if (nrdc != NULL)
3853                                 rddir_cache_rele(nrdc);
3854                         return (error);
3855                 }
3856 
3857                 /*
3858                  * The cache entry is complete and good,
3859                  * copyout the dirent structs to the calling
3860                  * thread.
3861                  */
3862                 error = uiomove(rdc->entries, rdc->entlen, UIO_READ, uiop);
3863 
3864                 /*
3865                  * If no error occurred during the copyout,
3866                  * update the offset in the uio struct to
3867                  * contain the value of the next cookie
3868                  * and set the eof value appropriately.
3869                  */
3870                 if (!error) {
3871                         uiop->uio_loffset = rdc->nfs3_ncookie;
3872                         if (eofp)
3873                                 *eofp = rdc->eof;
3874                 }
3875 
3876                 /*
3877                  * Decide whether to do readahead.
3878                  *
3879                  * Don't if have already read to the end of
3880                  * directory.  There is nothing more to read.
3881                  *
3882                  * Don't if the application is not doing
3883                  * lookups in the directory.  The readahead
3884                  * is only effective if the application can
3885                  * be doing work while an async thread is
3886                  * handling the over the wire request.
3887                  */
3888                 if (rdc->eof) {
3889                         rp->r_direof = rdc;
3890                         doreadahead = FALSE;
3891                 } else if (!(rp->r_flags & RLOOKUP))
3892                         doreadahead = FALSE;
3893                 else
3894                         doreadahead = TRUE;
3895 
3896                 if (!doreadahead) {
3897                         mutex_exit(&rp->r_statelock);
3898                         rddir_cache_rele(rdc);
3899                         if (nrdc != NULL)
3900                                 rddir_cache_rele(nrdc);
3901                         return (error);
3902                 }
3903 
3904                 /*
3905                  * Check to see whether we found an entry
3906                  * for the readahead.  If so, we don't need
3907                  * to do anything further, so free the new
3908                  * entry if one was allocated.  Otherwise,
3909                  * allocate a new entry, add it to the cache,
3910                  * and then initiate an asynchronous readdir
3911                  * operation to fill it.
3912                  */
3913                 srdc.nfs3_cookie = rdc->nfs3_ncookie;
3914                 srdc.buflen = count;
3915                 rrdc = avl_find(&rp->r_dir, &srdc, &where);
3916                 if (rrdc != NULL) {
3917                         if (nrdc != NULL)
3918                                 rddir_cache_rele(nrdc);
3919                 } else {
3920                         if (nrdc != NULL)
3921                                 rrdc = nrdc;
3922                         else {
3923                                 rrdc = rddir_cache_alloc(KM_NOSLEEP);
3924                         }
3925                         if (rrdc != NULL) {
3926                                 rrdc->nfs3_cookie = rdc->nfs3_ncookie;
3927                                 rrdc->buflen = count;
3928                                 avl_insert(&rp->r_dir, rrdc, where);
3929                                 rddir_cache_hold(rrdc);
3930                                 mutex_exit(&rp->r_statelock);
3931                                 rddir_cache_rele(rdc);
3932 #ifdef DEBUG
3933                                 nfs3_readdir_readahead++;
3934 #endif
3935                                 nfs_async_readdir(vp, rrdc, cr, do_nfs3readdir);
3936                                 return (error);
3937                         }
3938                 }
3939 
3940                 mutex_exit(&rp->r_statelock);
3941                 rddir_cache_rele(rdc);
3942                 return (error);
3943         }
3944 
3945         /*
3946          * Didn't find an entry in the cache.  Construct a new empty
3947          * entry and link it into the cache.  Other processes attempting
3948          * to access this entry will need to wait until it is filled in.
3949          *
3950          * Since kmem_alloc may block, another pass through the cache
3951          * will need to be taken to make sure that another process
3952          * hasn't already added an entry to the cache for this request.
3953          */
3954         if (nrdc == NULL) {
3955                 mutex_exit(&rp->r_statelock);
3956                 nrdc = rddir_cache_alloc(KM_SLEEP);
3957                 nrdc->nfs3_cookie = uiop->uio_loffset;
3958                 nrdc->buflen = count;
3959                 goto top;
3960         }
3961 
3962         /*
3963          * Add this entry to the cache.
3964          */
3965         avl_insert(&rp->r_dir, nrdc, where);
3966         rddir_cache_hold(nrdc);
3967         mutex_exit(&rp->r_statelock);
3968 
3969 bottom:
3970 #ifdef DEBUG
3971         missed = 1;
3972         nfs3_readdir_cache_misses++;
3973 #endif
3974         /*
3975          * Do the readdir.  This routine decides whether to use
3976          * READDIR or READDIRPLUS.
3977          */
3978         error = do_nfs3readdir(vp, nrdc, cr);
3979 
3980         /*
3981          * If this operation failed, just return the error which occurred.
3982          */
3983         if (error != 0)
3984                 return (error);
3985 
3986         /*
3987          * Since the RPC operation will have taken sometime and blocked
3988          * this process, another pass through the cache will need to be
3989          * taken to find the correct cache entry.  It is possible that
3990          * the correct cache entry will not be there (although one was
3991          * added) because the directory changed during the RPC operation
3992          * and the readdir cache was flushed.  In this case, just start
3993          * over.  It is hoped that this will not happen too often... :-)
3994          */
3995         nrdc = NULL;
3996         goto top;
3997         /* NOTREACHED */
3998 }
3999 
4000 static int
4001 do_nfs3readdir(vnode_t *vp, rddir_cache *rdc, cred_t *cr)
4002 {
4003         int error;
4004         rnode_t *rp;
4005         mntinfo_t *mi;
4006 
4007         rp = VTOR(vp);
4008         mi = VTOMI(vp);
4009         ASSERT(nfs_zone() == mi->mi_zone);
4010         /*
4011          * Issue the proper request.
4012          *
4013          * If the server does not support READDIRPLUS, then use READDIR.
4014          *
4015          * Otherwise --
4016          * Issue a READDIRPLUS if reading to fill an empty cache or if
4017          * an application has performed a lookup in the directory which
4018          * required an over the wire lookup.  The use of READDIRPLUS
4019          * will help to (re)populate the DNLC.
4020          */
4021         if (!(mi->mi_flags & MI_READDIRONLY) &&
4022             (rp->r_flags & (RLOOKUP | RREADDIRPLUS))) {
4023                 if (rp->r_flags & RREADDIRPLUS) {
4024                         mutex_enter(&rp->r_statelock);
4025                         rp->r_flags &= ~RREADDIRPLUS;
4026                         mutex_exit(&rp->r_statelock);
4027                 }
4028                 nfs3readdirplus(vp, rdc, cr);
4029                 if (rdc->error == EOPNOTSUPP)
4030                         nfs3readdir(vp, rdc, cr);
4031         } else
4032                 nfs3readdir(vp, rdc, cr);
4033 
4034         mutex_enter(&rp->r_statelock);
4035         rdc->flags &= ~RDDIR;
4036         if (rdc->flags & RDDIRWAIT) {
4037                 rdc->flags &= ~RDDIRWAIT;
4038                 cv_broadcast(&rdc->cv);
4039         }
4040         error = rdc->error;
4041         if (error)
4042                 rdc->flags |= RDDIRREQ;
4043         mutex_exit(&rp->r_statelock);
4044 
4045         rddir_cache_rele(rdc);
4046 
4047         return (error);
4048 }
4049 
4050 static void
4051 nfs3readdir(vnode_t *vp, rddir_cache *rdc, cred_t *cr)
4052 {
4053         int error;
4054         READDIR3args args;
4055         READDIR3vres res;
4056         vattr_t dva;
4057         rnode_t *rp;
4058         int douprintf;
4059         failinfo_t fi, *fip = NULL;
4060         mntinfo_t *mi;
4061         hrtime_t t;
4062 
4063         rp = VTOR(vp);
4064         mi = VTOMI(vp);
4065         ASSERT(nfs_zone() == mi->mi_zone);
4066 
4067         args.dir = *RTOFH3(rp);
4068         args.cookie = (cookie3)rdc->nfs3_cookie;
4069         args.cookieverf = rp->r_cookieverf;
4070         args.count = rdc->buflen;
4071 
4072         /*
4073          * NFS client failover support
4074          * suppress failover unless we have a zero cookie
4075          */
4076         if (args.cookie == (cookie3) 0) {
4077                 fi.vp = vp;
4078                 fi.fhp = (caddr_t)&args.dir;
4079                 fi.copyproc = nfs3copyfh;
4080                 fi.lookupproc = nfs3lookup;
4081                 fi.xattrdirproc = acl_getxattrdir3;
4082                 fip = &fi;
4083         }
4084 
4085 #ifdef DEBUG
4086         rdc->entries = rddir_cache_buf_alloc(rdc->buflen, KM_SLEEP);
4087 #else
4088         rdc->entries = kmem_alloc(rdc->buflen, KM_SLEEP);
4089 #endif
4090 
4091         res.entries = (dirent64_t *)rdc->entries;
4092         res.entries_size = rdc->buflen;
4093         res.dir_attributes.fres.vap = &dva;
4094         res.dir_attributes.fres.vp = vp;
4095         res.loff = rdc->nfs3_cookie;
4096 
4097         douprintf = 1;
4098 
4099         if (mi->mi_io_kstats) {
4100                 mutex_enter(&mi->mi_lock);
4101                 kstat_runq_enter(KSTAT_IO_PTR(mi->mi_io_kstats));
4102                 mutex_exit(&mi->mi_lock);
4103         }
4104 
4105         t = gethrtime();
4106 
4107         error = rfs3call(VTOMI(vp), NFSPROC3_READDIR,
4108             xdr_READDIR3args, (caddr_t)&args,
4109             xdr_READDIR3vres, (caddr_t)&res, cr,
4110             &douprintf, &res.status, 0, fip);
4111 
4112         if (mi->mi_io_kstats) {
4113                 mutex_enter(&mi->mi_lock);
4114                 kstat_runq_exit(KSTAT_IO_PTR(mi->mi_io_kstats));
4115                 mutex_exit(&mi->mi_lock);
4116         }
4117 
4118         if (error)
4119                 goto err;
4120 
4121         nfs3_cache_post_op_vattr(vp, &res.dir_attributes, t, cr);
4122 
4123         error = geterrno3(res.status);
4124         if (error) {
4125                 PURGE_STALE_FH(error, vp, cr);
4126                 goto err;
4127         }
4128 
4129         if (mi->mi_io_kstats) {
4130                 mutex_enter(&mi->mi_lock);
4131                 KSTAT_IO_PTR(mi->mi_io_kstats)->reads++;
4132                 KSTAT_IO_PTR(mi->mi_io_kstats)->nread += res.size;
4133                 mutex_exit(&mi->mi_lock);
4134         }
4135 
4136         rdc->nfs3_ncookie = res.loff;
4137         rp->r_cookieverf = res.cookieverf;
4138         rdc->eof = res.eof ? 1 : 0;
4139         rdc->entlen = res.size;
4140         ASSERT(rdc->entlen <= rdc->buflen);
4141         rdc->error = 0;
4142         return;
4143 
4144 err:
4145         kmem_free(rdc->entries, rdc->buflen);
4146         rdc->entries = NULL;
4147         rdc->error = error;
4148 }
4149 
4150 /*
4151  * Read directory entries.
4152  * There are some weird things to look out for here.  The uio_loffset
4153  * field is either 0 or it is the offset returned from a previous
4154  * readdir.  It is an opaque value used by the server to find the
4155  * correct directory block to read. The count field is the number
4156  * of blocks to read on the server.  This is advisory only, the server
4157  * may return only one block's worth of entries.  Entries may be compressed
4158  * on the server.
4159  */
4160 static void
4161 nfs3readdirplus(vnode_t *vp, rddir_cache *rdc, cred_t *cr)
4162 {
4163         int error;
4164         READDIRPLUS3args args;
4165         READDIRPLUS3vres res;
4166         vattr_t dva;
4167         rnode_t *rp;
4168         mntinfo_t *mi;
4169         int douprintf;
4170         failinfo_t fi, *fip = NULL;
4171 
4172         rp = VTOR(vp);
4173         mi = VTOMI(vp);
4174         ASSERT(nfs_zone() == mi->mi_zone);
4175 
4176         args.dir = *RTOFH3(rp);
4177         args.cookie = (cookie3)rdc->nfs3_cookie;
4178         args.cookieverf = rp->r_cookieverf;
4179         args.dircount = rdc->buflen;
4180         args.maxcount = mi->mi_tsize;
4181 
4182         /*
4183          * NFS client failover support
4184          * suppress failover unless we have a zero cookie
4185          */
4186         if (args.cookie == (cookie3)0) {
4187                 fi.vp = vp;
4188                 fi.fhp = (caddr_t)&args.dir;
4189                 fi.copyproc = nfs3copyfh;
4190                 fi.lookupproc = nfs3lookup;
4191                 fi.xattrdirproc = acl_getxattrdir3;
4192                 fip = &fi;
4193         }
4194 
4195 #ifdef DEBUG
4196         rdc->entries = rddir_cache_buf_alloc(rdc->buflen, KM_SLEEP);
4197 #else
4198         rdc->entries = kmem_alloc(rdc->buflen, KM_SLEEP);
4199 #endif
4200 
4201         res.entries = (dirent64_t *)rdc->entries;
4202         res.entries_size = rdc->buflen;
4203         res.dir_attributes.fres.vap = &dva;
4204         res.dir_attributes.fres.vp = vp;
4205         res.loff = rdc->nfs3_cookie;
4206         res.credentials = cr;
4207 
4208         douprintf = 1;
4209 
4210         if (mi->mi_io_kstats) {
4211                 mutex_enter(&mi->mi_lock);
4212                 kstat_runq_enter(KSTAT_IO_PTR(mi->mi_io_kstats));
4213                 mutex_exit(&mi->mi_lock);
4214         }
4215 
4216         res.time = gethrtime();
4217 
4218         error = rfs3call(mi, NFSPROC3_READDIRPLUS,
4219             xdr_READDIRPLUS3args, (caddr_t)&args,
4220             xdr_READDIRPLUS3vres, (caddr_t)&res, cr,
4221             &douprintf, &res.status, 0, fip);
4222 
4223         if (mi->mi_io_kstats) {
4224                 mutex_enter(&mi->mi_lock);
4225                 kstat_runq_exit(KSTAT_IO_PTR(mi->mi_io_kstats));
4226                 mutex_exit(&mi->mi_lock);
4227         }
4228 
4229         if (error) {
4230                 goto err;
4231         }
4232 
4233         nfs3_cache_post_op_vattr(vp, &res.dir_attributes, res.time, cr);
4234 
4235         error = geterrno3(res.status);
4236         if (error) {
4237                 PURGE_STALE_FH(error, vp, cr);
4238                 if (error == EOPNOTSUPP) {
4239                         mutex_enter(&mi->mi_lock);
4240                         mi->mi_flags |= MI_READDIRONLY;
4241                         mutex_exit(&mi->mi_lock);
4242                 }
4243                 goto err;
4244         }
4245 
4246         if (mi->mi_io_kstats) {
4247                 mutex_enter(&mi->mi_lock);
4248                 KSTAT_IO_PTR(mi->mi_io_kstats)->reads++;
4249                 KSTAT_IO_PTR(mi->mi_io_kstats)->nread += res.size;
4250                 mutex_exit(&mi->mi_lock);
4251         }
4252 
4253         rdc->nfs3_ncookie = res.loff;
4254         rp->r_cookieverf = res.cookieverf;
4255         rdc->eof = res.eof ? 1 : 0;
4256         rdc->entlen = res.size;
4257         ASSERT(rdc->entlen <= rdc->buflen);
4258         rdc->error = 0;
4259 
4260         return;
4261 
4262 err:
4263         kmem_free(rdc->entries, rdc->buflen);
4264         rdc->entries = NULL;
4265         rdc->error = error;
4266 }
4267 
4268 #ifdef DEBUG
4269 static int nfs3_bio_do_stop = 0;
4270 #endif
4271 
4272 static int
4273 nfs3_bio(struct buf *bp, stable_how *stab_comm, cred_t *cr)
4274 {
4275         rnode_t *rp = VTOR(bp->b_vp);
4276         int count;
4277         int error;
4278         cred_t *cred;
4279         offset_t offset;
4280 
4281         ASSERT(nfs_zone() == VTOMI(bp->b_vp)->mi_zone);
4282         offset = ldbtob(bp->b_lblkno);
4283 
4284         DTRACE_IO1(start, struct buf *, bp);
4285 
4286         if (bp->b_flags & B_READ) {
4287                 mutex_enter(&rp->r_statelock);
4288                 if (rp->r_cred != NULL) {
4289                         cred = rp->r_cred;
4290                         crhold(cred);
4291                 } else {
4292                         rp->r_cred = cr;
4293                         crhold(cr);
4294                         cred = cr;
4295                         crhold(cred);
4296                 }
4297                 mutex_exit(&rp->r_statelock);
4298         read_again:
4299                 error = bp->b_error = nfs3read(bp->b_vp, bp->b_un.b_addr,
4300                     offset, bp->b_bcount, &bp->b_resid, cred);
4301                 crfree(cred);
4302                 if (!error) {
4303                         if (bp->b_resid) {
4304                                 /*
4305                                  * Didn't get it all because we hit EOF,
4306                                  * zero all the memory beyond the EOF.
4307                                  */
4308                                 /* bzero(rdaddr + */
4309                                 bzero(bp->b_un.b_addr +
4310                                     bp->b_bcount - bp->b_resid, bp->b_resid);
4311                         }
4312                         mutex_enter(&rp->r_statelock);
4313                         if (bp->b_resid == bp->b_bcount &&
4314                             offset >= rp->r_size) {
4315                                 /*
4316                                  * We didn't read anything at all as we are
4317                                  * past EOF.  Return an error indicator back
4318                                  * but don't destroy the pages (yet).
4319                                  */
4320                                 error = NFS_EOF;
4321                         }
4322                         mutex_exit(&rp->r_statelock);
4323                 } else if (error == EACCES) {
4324                         mutex_enter(&rp->r_statelock);
4325                         if (cred != cr) {
4326                                 if (rp->r_cred != NULL)
4327                                         crfree(rp->r_cred);
4328                                 rp->r_cred = cr;
4329                                 crhold(cr);
4330                                 cred = cr;
4331                                 crhold(cred);
4332                                 mutex_exit(&rp->r_statelock);
4333                                 goto read_again;
4334                         }
4335                         mutex_exit(&rp->r_statelock);
4336                 }
4337         } else {
4338                 if (!(rp->r_flags & RSTALE)) {
4339                         mutex_enter(&rp->r_statelock);
4340                         if (rp->r_cred != NULL) {
4341                                 cred = rp->r_cred;
4342                                 crhold(cred);
4343                         } else {
4344                                 rp->r_cred = cr;
4345                                 crhold(cr);
4346                                 cred = cr;
4347                                 crhold(cred);
4348                         }
4349                         mutex_exit(&rp->r_statelock);
4350                 write_again:
4351                         mutex_enter(&rp->r_statelock);
4352                         count = MIN(bp->b_bcount, rp->r_size - offset);
4353                         mutex_exit(&rp->r_statelock);
4354                         if (count < 0)
4355                                 cmn_err(CE_PANIC, "nfs3_bio: write count < 0");
4356 #ifdef DEBUG
4357                         if (count == 0) {
4358                                 zcmn_err(getzoneid(), CE_WARN,
4359                                     "nfs3_bio: zero length write at %lld",
4360                                     offset);
4361                                 nfs_printfhandle(&rp->r_fh);
4362                                 if (nfs3_bio_do_stop)
4363                                         debug_enter("nfs3_bio");
4364                         }
4365 #endif
4366                         error = nfs3write(bp->b_vp, bp->b_un.b_addr, offset,
4367                             count, cred, stab_comm);
4368                         if (error == EACCES) {
4369                                 mutex_enter(&rp->r_statelock);
4370                                 if (cred != cr) {
4371                                         if (rp->r_cred != NULL)
4372                                                 crfree(rp->r_cred);
4373                                         rp->r_cred = cr;
4374                                         crhold(cr);
4375                                         crfree(cred);
4376                                         cred = cr;
4377                                         crhold(cred);
4378                                         mutex_exit(&rp->r_statelock);
4379                                         goto write_again;
4380                                 }
4381                                 mutex_exit(&rp->r_statelock);
4382                         }
4383                         bp->b_error = error;
4384                         if (error && error != EINTR) {
4385                                 /*
4386                                  * Don't print EDQUOT errors on the console.
4387                                  * Don't print asynchronous EACCES errors.
4388                                  * Don't print EFBIG errors.
4389                                  * Print all other write errors.
4390                                  */
4391                                 if (error != EDQUOT && error != EFBIG &&
4392                                     (error != EACCES ||
4393                                     !(bp->b_flags & B_ASYNC)))
4394                                         nfs_write_error(bp->b_vp, error, cred);
4395                                 /*
4396                                  * Update r_error and r_flags as appropriate.
4397                                  * If the error was ESTALE, then mark the
4398                                  * rnode as not being writeable and save
4399                                  * the error status.  Otherwise, save any
4400                                  * errors which occur from asynchronous
4401                                  * page invalidations.  Any errors occurring
4402                                  * from other operations should be saved
4403                                  * by the caller.
4404                                  */
4405                                 mutex_enter(&rp->r_statelock);
4406                                 if (error == ESTALE) {
4407                                         rp->r_flags |= RSTALE;
4408                                         if (!rp->r_error)
4409                                                 rp->r_error = error;
4410                                 } else if (!rp->r_error &&
4411                                     (bp->b_flags &
4412                                     (B_INVAL|B_FORCE|B_ASYNC)) ==
4413                                     (B_INVAL|B_FORCE|B_ASYNC)) {
4414                                         rp->r_error = error;
4415                                 }
4416                                 mutex_exit(&rp->r_statelock);
4417                         }
4418                         crfree(cred);
4419                 } else {
4420                         error = rp->r_error;
4421                         /*
4422                          * A close may have cleared r_error, if so,
4423                          * propagate ESTALE error return properly
4424                          */
4425                         if (error == 0)
4426                                 error = ESTALE;
4427                 }
4428         }
4429 
4430         if (error != 0 && error != NFS_EOF)
4431                 bp->b_flags |= B_ERROR;
4432 
4433         DTRACE_IO1(done, struct buf *, bp);
4434 
4435         return (error);
4436 }
4437 
4438 /* ARGSUSED */
4439 static int
4440 nfs3_fid(vnode_t *vp, fid_t *fidp, caller_context_t *ct)
4441 {
4442         rnode_t *rp;
4443 
4444         if (nfs_zone() != VTOMI(vp)->mi_zone)
4445                 return (EIO);
4446         rp = VTOR(vp);
4447 
4448         if (fidp->fid_len < (ushort_t)rp->r_fh.fh_len) {
4449                 fidp->fid_len = rp->r_fh.fh_len;
4450                 return (ENOSPC);
4451         }
4452         fidp->fid_len = rp->r_fh.fh_len;
4453         bcopy(rp->r_fh.fh_buf, fidp->fid_data, fidp->fid_len);
4454         return (0);
4455 }
4456 
4457 /* ARGSUSED2 */
4458 static int
4459 nfs3_rwlock(vnode_t *vp, int write_lock, caller_context_t *ctp)
4460 {
4461         rnode_t *rp = VTOR(vp);
4462 
4463         if (!write_lock) {
4464                 (void) nfs_rw_enter_sig(&rp->r_rwlock, RW_READER, FALSE);
4465                 return (V_WRITELOCK_FALSE);
4466         }
4467 
4468         if ((rp->r_flags & RDIRECTIO) || (VTOMI(vp)->mi_flags & MI_DIRECTIO)) {
4469                 (void) nfs_rw_enter_sig(&rp->r_rwlock, RW_READER, FALSE);
4470                 if (rp->r_mapcnt == 0 && !vn_has_cached_data(vp))
4471                         return (V_WRITELOCK_FALSE);
4472                 nfs_rw_exit(&rp->r_rwlock);
4473         }
4474 
4475         (void) nfs_rw_enter_sig(&rp->r_rwlock, RW_WRITER, FALSE);
4476         return (V_WRITELOCK_TRUE);
4477 }
4478 
4479 /* ARGSUSED */
4480 static void
4481 nfs3_rwunlock(vnode_t *vp, int write_lock, caller_context_t *ctp)
4482 {
4483         rnode_t *rp = VTOR(vp);
4484 
4485         nfs_rw_exit(&rp->r_rwlock);
4486 }
4487 
4488 /* ARGSUSED */
4489 static int
4490 nfs3_seek(vnode_t *vp, offset_t ooff, offset_t *noffp, caller_context_t *ct)
4491 {
4492 
4493         /*
4494          * Because we stuff the readdir cookie into the offset field
4495          * someone may attempt to do an lseek with the cookie which
4496          * we want to succeed.
4497          */
4498         if (vp->v_type == VDIR)
4499                 return (0);
4500         if (*noffp < 0)
4501                 return (EINVAL);
4502         return (0);
4503 }
4504 
4505 /*
4506  * number of nfs3_bsize blocks to read ahead.
4507  */
4508 static int nfs3_nra = 4;
4509 
4510 #ifdef DEBUG
4511 static int nfs3_lostpage = 0;   /* number of times we lost original page */
4512 #endif
4513 
4514 /*
4515  * Return all the pages from [off..off+len) in file
4516  */
4517 /* ARGSUSED */
4518 static int
4519 nfs3_getpage(vnode_t *vp, offset_t off, size_t len, uint_t *protp,
4520         page_t *pl[], size_t plsz, struct seg *seg, caddr_t addr,
4521         enum seg_rw rw, cred_t *cr, caller_context_t *ct)
4522 {
4523         rnode_t *rp;
4524         int error;
4525         mntinfo_t *mi;
4526 
4527         if (vp->v_flag & VNOMAP)
4528                 return (ENOSYS);
4529 
4530         if (nfs_zone() != VTOMI(vp)->mi_zone)
4531                 return (EIO);
4532         if (protp != NULL)
4533                 *protp = PROT_ALL;
4534 
4535         /*
4536          * Now valididate that the caches are up to date.
4537          */
4538         error = nfs3_validate_caches(vp, cr);
4539         if (error)
4540                 return (error);
4541 
4542         rp = VTOR(vp);
4543         mi = VTOMI(vp);
4544 retry:
4545         mutex_enter(&rp->r_statelock);
4546 
4547         /*
4548          * Don't create dirty pages faster than they
4549          * can be cleaned so that the system doesn't
4550          * get imbalanced.  If the async queue is
4551          * maxed out, then wait for it to drain before
4552          * creating more dirty pages.  Also, wait for
4553          * any threads doing pagewalks in the vop_getattr
4554          * entry points so that they don't block for
4555          * long periods.
4556          */
4557         if (rw == S_CREATE) {
4558                 while ((mi->mi_max_threads != 0 &&
4559                     rp->r_awcount > 2 * mi->mi_max_threads) ||
4560                     rp->r_gcount > 0)
4561                         cv_wait(&rp->r_cv, &rp->r_statelock);
4562         }
4563 
4564         /*
4565          * If we are getting called as a side effect of an nfs_write()
4566          * operation the local file size might not be extended yet.
4567          * In this case we want to be able to return pages of zeroes.
4568          */
4569         if (off + len > rp->r_size + PAGEOFFSET && seg != segkmap) {
4570                 mutex_exit(&rp->r_statelock);
4571                 return (EFAULT);                /* beyond EOF */
4572         }
4573 
4574         mutex_exit(&rp->r_statelock);
4575 
4576         if (len <= PAGESIZE) {
4577                 error = nfs3_getapage(vp, off, len, protp, pl, plsz,
4578                     seg, addr, rw, cr);
4579         } else {
4580                 error = pvn_getpages(nfs3_getapage, vp, off, len, protp,
4581                     pl, plsz, seg, addr, rw, cr);
4582         }
4583 
4584         switch (error) {
4585         case NFS_EOF:
4586                 nfs_purge_caches(vp, NFS_NOPURGE_DNLC, cr);
4587                 goto retry;
4588         case ESTALE:
4589                 PURGE_STALE_FH(error, vp, cr);
4590         }
4591 
4592         return (error);
4593 }
4594 
4595 /*
4596  * Called from pvn_getpages or nfs3_getpage to get a particular page.
4597  */
4598 /* ARGSUSED */
4599 static int
4600 nfs3_getapage(vnode_t *vp, u_offset_t off, size_t len, uint_t *protp,
4601         page_t *pl[], size_t plsz, struct seg *seg, caddr_t addr,
4602         enum seg_rw rw, cred_t *cr)
4603 {
4604         rnode_t *rp;
4605         uint_t bsize;
4606         struct buf *bp;
4607         page_t *pp;
4608         u_offset_t lbn;
4609         u_offset_t io_off;
4610         u_offset_t blkoff;
4611         u_offset_t rablkoff;
4612         size_t io_len;
4613         uint_t blksize;
4614         int error;
4615         int readahead;
4616         int readahead_issued = 0;
4617         int ra_window; /* readahead window */
4618         page_t *pagefound;
4619         page_t *savepp;
4620 
4621         if (nfs_zone() != VTOMI(vp)->mi_zone)
4622                 return (EIO);
4623         rp = VTOR(vp);
4624         bsize = MAX(vp->v_vfsp->vfs_bsize, PAGESIZE);
4625 
4626 reread:
4627         bp = NULL;
4628         pp = NULL;
4629         pagefound = NULL;
4630 
4631         if (pl != NULL)
4632                 pl[0] = NULL;
4633 
4634         error = 0;
4635         lbn = off / bsize;
4636         blkoff = lbn * bsize;
4637 
4638         /*
4639          * Queueing up the readahead before doing the synchronous read
4640          * results in a significant increase in read throughput because
4641          * of the increased parallelism between the async threads and
4642          * the process context.
4643          */
4644         if ((off & ((vp->v_vfsp->vfs_bsize) - 1)) == 0 &&
4645             rw != S_CREATE &&
4646             !(vp->v_flag & VNOCACHE)) {
4647                 mutex_enter(&rp->r_statelock);
4648 
4649                 /*
4650                  * Calculate the number of readaheads to do.
4651                  * a) No readaheads at offset = 0.
4652                  * b) Do maximum(nfs3_nra) readaheads when the readahead
4653                  *    window is closed.
4654                  * c) Do readaheads between 1 to (nfs3_nra - 1) depending
4655                  *    upon how far the readahead window is open or close.
4656                  * d) No readaheads if rp->r_nextr is not within the scope
4657                  *    of the readahead window (random i/o).
4658                  */
4659 
4660                 if (off == 0)
4661                         readahead = 0;
4662                 else if (blkoff == rp->r_nextr)
4663                         readahead = nfs3_nra;
4664                 else if (rp->r_nextr > blkoff &&
4665                     ((ra_window = (rp->r_nextr - blkoff) / bsize)
4666                     <= (nfs3_nra - 1)))
4667                         readahead = nfs3_nra - ra_window;
4668                 else
4669                         readahead = 0;
4670 
4671                 rablkoff = rp->r_nextr;
4672                 while (readahead > 0 && rablkoff + bsize < rp->r_size) {
4673                         mutex_exit(&rp->r_statelock);
4674                         if (nfs_async_readahead(vp, rablkoff + bsize,
4675                             addr + (rablkoff + bsize - off), seg, cr,
4676                             nfs3_readahead) < 0) {
4677                                 mutex_enter(&rp->r_statelock);
4678                                 break;
4679                         }
4680                         readahead--;
4681                         rablkoff += bsize;
4682                         /*
4683                          * Indicate that we did a readahead so
4684                          * readahead offset is not updated
4685                          * by the synchronous read below.
4686                          */
4687                         readahead_issued = 1;
4688                         mutex_enter(&rp->r_statelock);
4689                         /*
4690                          * set readahead offset to
4691                          * offset of last async readahead
4692                          * request.
4693                          */
4694                         rp->r_nextr = rablkoff;
4695                 }
4696                 mutex_exit(&rp->r_statelock);
4697         }
4698 
4699 again:
4700         if ((pagefound = page_exists(vp, off)) == NULL) {
4701                 if (pl == NULL) {
4702                         (void) nfs_async_readahead(vp, blkoff, addr, seg, cr,
4703                             nfs3_readahead);
4704                 } else if (rw == S_CREATE) {
4705                         /*
4706                          * Block for this page is not allocated, or the offset
4707                          * is beyond the current allocation size, or we're
4708                          * allocating a swap slot and the page was not found,
4709                          * so allocate it and return a zero page.
4710                          */
4711                         if ((pp = page_create_va(vp, off,
4712                             PAGESIZE, PG_WAIT, seg, addr)) == NULL)
4713                                 cmn_err(CE_PANIC, "nfs3_getapage: page_create");
4714                         io_len = PAGESIZE;
4715                         mutex_enter(&rp->r_statelock);
4716                         rp->r_nextr = off + PAGESIZE;
4717                         mutex_exit(&rp->r_statelock);
4718                 } else {
4719                         /*
4720                          * Need to go to server to get a BLOCK, exception to
4721                          * that being while reading at offset = 0 or doing
4722                          * random i/o, in that case read only a PAGE.
4723                          */
4724                         mutex_enter(&rp->r_statelock);
4725                         if (blkoff < rp->r_size &&
4726                             blkoff + bsize >= rp->r_size) {
4727                                 /*
4728                                  * If only a block or less is left in
4729                                  * the file, read all that is remaining.
4730                                  */
4731                                 if (rp->r_size <= off) {
4732                                         /*
4733                                          * Trying to access beyond EOF,
4734                                          * set up to get at least one page.
4735                                          */
4736                                         blksize = off + PAGESIZE - blkoff;
4737                                 } else
4738                                         blksize = rp->r_size - blkoff;
4739                         } else if ((off == 0) ||
4740                             (off != rp->r_nextr && !readahead_issued)) {
4741                                 blksize = PAGESIZE;
4742                                 blkoff = off; /* block = page here */
4743                         } else
4744                                 blksize = bsize;
4745                         mutex_exit(&rp->r_statelock);
4746 
4747                         pp = pvn_read_kluster(vp, off, seg, addr, &io_off,
4748                             &io_len, blkoff, blksize, 0);
4749 
4750                         /*
4751                          * Some other thread has entered the page,
4752                          * so just use it.
4753                          */
4754                         if (pp == NULL)
4755                                 goto again;
4756 
4757                         /*
4758                          * Now round the request size up to page boundaries.
4759                          * This ensures that the entire page will be
4760                          * initialized to zeroes if EOF is encountered.
4761                          */
4762                         io_len = ptob(btopr(io_len));
4763 
4764                         bp = pageio_setup(pp, io_len, vp, B_READ);
4765                         ASSERT(bp != NULL);
4766 
4767                         /*
4768                          * pageio_setup should have set b_addr to 0.  This
4769                          * is correct since we want to do I/O on a page
4770                          * boundary.  bp_mapin will use this addr to calculate
4771                          * an offset, and then set b_addr to the kernel virtual
4772                          * address it allocated for us.
4773                          */
4774                         ASSERT(bp->b_un.b_addr == 0);
4775 
4776                         bp->b_edev = 0;
4777                         bp->b_dev = 0;
4778                         bp->b_lblkno = lbtodb(io_off);
4779                         bp->b_file = vp;
4780                         bp->b_offset = (offset_t)off;
4781                         bp_mapin(bp);
4782 
4783                         /*
4784                          * If doing a write beyond what we believe is EOF,
4785                          * don't bother trying to read the pages from the
4786                          * server, we'll just zero the pages here.  We
4787                          * don't check that the rw flag is S_WRITE here
4788                          * because some implementations may attempt a
4789                          * read access to the buffer before copying data.
4790                          */
4791                         mutex_enter(&rp->r_statelock);
4792                         if (io_off >= rp->r_size && seg == segkmap) {
4793                                 mutex_exit(&rp->r_statelock);
4794                                 bzero(bp->b_un.b_addr, io_len);
4795                         } else {
4796                                 mutex_exit(&rp->r_statelock);
4797                                 error = nfs3_bio(bp, NULL, cr);
4798                         }
4799 
4800                         /*
4801                          * Unmap the buffer before freeing it.
4802                          */
4803                         bp_mapout(bp);
4804                         pageio_done(bp);
4805 
4806                         savepp = pp;
4807                         do {
4808                                 pp->p_fsdata = C_NOCOMMIT;
4809                         } while ((pp = pp->p_next) != savepp);
4810 
4811                         if (error == NFS_EOF) {
4812                                 /*
4813                                  * If doing a write system call just return
4814                                  * zeroed pages, else user tried to get pages
4815                                  * beyond EOF, return error.  We don't check
4816                                  * that the rw flag is S_WRITE here because
4817                                  * some implementations may attempt a read
4818                                  * access to the buffer before copying data.
4819                                  */
4820                                 if (seg == segkmap)
4821                                         error = 0;
4822                                 else
4823                                         error = EFAULT;
4824                         }
4825 
4826                         if (!readahead_issued && !error) {
4827                                 mutex_enter(&rp->r_statelock);
4828                                 rp->r_nextr = io_off + io_len;
4829                                 mutex_exit(&rp->r_statelock);
4830                         }
4831                 }
4832         }
4833 
4834 out:
4835         if (pl == NULL)
4836                 return (error);
4837 
4838         if (error) {
4839                 if (pp != NULL)
4840                         pvn_read_done(pp, B_ERROR);
4841                 return (error);
4842         }
4843 
4844         if (pagefound) {
4845                 se_t se = (rw == S_CREATE ? SE_EXCL : SE_SHARED);
4846 
4847                 /*
4848                  * Page exists in the cache, acquire the appropriate lock.
4849                  * If this fails, start all over again.
4850                  */
4851                 if ((pp = page_lookup(vp, off, se)) == NULL) {
4852 #ifdef DEBUG
4853                         nfs3_lostpage++;
4854 #endif
4855                         goto reread;
4856                 }
4857                 pl[0] = pp;
4858                 pl[1] = NULL;
4859                 return (0);
4860         }
4861 
4862         if (pp != NULL)
4863                 pvn_plist_init(pp, pl, plsz, off, io_len, rw);
4864 
4865         return (error);
4866 }
4867 
4868 static void
4869 nfs3_readahead(vnode_t *vp, u_offset_t blkoff, caddr_t addr, struct seg *seg,
4870         cred_t *cr)
4871 {
4872         int error;
4873         page_t *pp;
4874         u_offset_t io_off;
4875         size_t io_len;
4876         struct buf *bp;
4877         uint_t bsize, blksize;
4878         rnode_t *rp = VTOR(vp);
4879         page_t *savepp;
4880 
4881         ASSERT(nfs_zone() == VTOMI(vp)->mi_zone);
4882         bsize = MAX(vp->v_vfsp->vfs_bsize, PAGESIZE);
4883 
4884         mutex_enter(&rp->r_statelock);
4885         if (blkoff < rp->r_size && blkoff + bsize > rp->r_size) {
4886                 /*
4887                  * If less than a block left in file read less
4888                  * than a block.
4889                  */
4890                 blksize = rp->r_size - blkoff;
4891         } else
4892                 blksize = bsize;
4893         mutex_exit(&rp->r_statelock);
4894 
4895         pp = pvn_read_kluster(vp, blkoff, segkmap, addr,
4896             &io_off, &io_len, blkoff, blksize, 1);
4897         /*
4898          * The isra flag passed to the kluster function is 1, we may have
4899          * gotten a return value of NULL for a variety of reasons (# of free
4900          * pages < minfree, someone entered the page on the vnode etc). In all
4901          * cases, we want to punt on the readahead.
4902          */
4903         if (pp == NULL)
4904                 return;
4905 
4906         /*
4907          * Now round the request size up to page boundaries.
4908          * This ensures that the entire page will be
4909          * initialized to zeroes if EOF is encountered.
4910          */
4911         io_len = ptob(btopr(io_len));
4912 
4913         bp = pageio_setup(pp, io_len, vp, B_READ);
4914         ASSERT(bp != NULL);
4915 
4916         /*
4917          * pageio_setup should have set b_addr to 0.  This is correct since
4918          * we want to do I/O on a page boundary. bp_mapin() will use this addr
4919          * to calculate an offset, and then set b_addr to the kernel virtual
4920          * address it allocated for us.
4921          */
4922         ASSERT(bp->b_un.b_addr == 0);
4923 
4924         bp->b_edev = 0;
4925         bp->b_dev = 0;
4926         bp->b_lblkno = lbtodb(io_off);
4927         bp->b_file = vp;
4928         bp->b_offset = (offset_t)blkoff;
4929         bp_mapin(bp);
4930 
4931         /*
4932          * If doing a write beyond what we believe is EOF, don't bother trying
4933          * to read the pages from the server, we'll just zero the pages here.
4934          * We don't check that the rw flag is S_WRITE here because some
4935          * implementations may attempt a read access to the buffer before
4936          * copying data.
4937          */
4938         mutex_enter(&rp->r_statelock);
4939         if (io_off >= rp->r_size && seg == segkmap) {
4940                 mutex_exit(&rp->r_statelock);
4941                 bzero(bp->b_un.b_addr, io_len);
4942                 error = 0;
4943         } else {
4944                 mutex_exit(&rp->r_statelock);
4945                 error = nfs3_bio(bp, NULL, cr);
4946                 if (error == NFS_EOF)
4947                         error = 0;
4948         }
4949 
4950         /*
4951          * Unmap the buffer before freeing it.
4952          */
4953         bp_mapout(bp);
4954         pageio_done(bp);
4955 
4956         savepp = pp;
4957         do {
4958                 pp->p_fsdata = C_NOCOMMIT;
4959         } while ((pp = pp->p_next) != savepp);
4960 
4961         pvn_read_done(pp, error ? B_READ | B_ERROR : B_READ);
4962 
4963         /*
4964          * In case of error set readahead offset
4965          * to the lowest offset.
4966          * pvn_read_done() calls VN_DISPOSE to destroy the pages
4967          */
4968         if (error && rp->r_nextr > io_off) {
4969                 mutex_enter(&rp->r_statelock);
4970                 if (rp->r_nextr > io_off)
4971                         rp->r_nextr = io_off;
4972                 mutex_exit(&rp->r_statelock);
4973         }
4974 }
4975 
4976 /*
4977  * Flags are composed of {B_INVAL, B_FREE, B_DONTNEED, B_FORCE}
4978  * If len == 0, do from off to EOF.
4979  *
4980  * The normal cases should be len == 0 && off == 0 (entire vp list),
4981  * len == MAXBSIZE (from segmap_release actions), and len == PAGESIZE
4982  * (from pageout).
4983  */
4984 /* ARGSUSED */
4985 static int
4986 nfs3_putpage(vnode_t *vp, offset_t off, size_t len, int flags, cred_t *cr,
4987         caller_context_t *ct)
4988 {
4989         int error;
4990         rnode_t *rp;
4991 
4992         ASSERT(cr != NULL);
4993 
4994         /*
4995          * XXX - Why should this check be made here?
4996          */
4997         if (vp->v_flag & VNOMAP)
4998                 return (ENOSYS);
4999         if (len == 0 && !(flags & B_INVAL) && vn_is_readonly(vp))
5000                 return (0);
5001         if (!(flags & B_ASYNC) && nfs_zone() != VTOMI(vp)->mi_zone)
5002                 return (EIO);
5003 
5004         rp = VTOR(vp);
5005         mutex_enter(&rp->r_statelock);
5006         rp->r_count++;
5007         mutex_exit(&rp->r_statelock);
5008         error = nfs_putpages(vp, off, len, flags, cr);
5009         mutex_enter(&rp->r_statelock);
5010         rp->r_count--;
5011         cv_broadcast(&rp->r_cv);
5012         mutex_exit(&rp->r_statelock);
5013 
5014         return (error);
5015 }
5016 
5017 /*
5018  * Write out a single page, possibly klustering adjacent dirty pages.
5019  */
5020 int
5021 nfs3_putapage(vnode_t *vp, page_t *pp, u_offset_t *offp, size_t *lenp,
5022         int flags, cred_t *cr)
5023 {
5024         u_offset_t io_off;
5025         u_offset_t lbn_off;
5026         u_offset_t lbn;
5027         size_t io_len;
5028         uint_t bsize;
5029         int error;
5030         rnode_t *rp;
5031 
5032         ASSERT(!vn_is_readonly(vp));
5033         ASSERT(pp != NULL);
5034         ASSERT(cr != NULL);
5035         ASSERT((flags & B_ASYNC) || nfs_zone() == VTOMI(vp)->mi_zone);
5036 
5037         rp = VTOR(vp);
5038         ASSERT(rp->r_count > 0);
5039 
5040         bsize = MAX(vp->v_vfsp->vfs_bsize, PAGESIZE);
5041         lbn = pp->p_offset / bsize;
5042         lbn_off = lbn * bsize;
5043 
5044         /*
5045          * Find a kluster that fits in one block, or in
5046          * one page if pages are bigger than blocks.  If
5047          * there is less file space allocated than a whole
5048          * page, we'll shorten the i/o request below.
5049          */
5050         pp = pvn_write_kluster(vp, pp, &io_off, &io_len, lbn_off,
5051             roundup(bsize, PAGESIZE), flags);
5052 
5053         /*
5054          * pvn_write_kluster shouldn't have returned a page with offset
5055          * behind the original page we were given.  Verify that.
5056          */
5057         ASSERT((pp->p_offset / bsize) >= lbn);
5058 
5059         /*
5060          * Now pp will have the list of kept dirty pages marked for
5061          * write back.  It will also handle invalidation and freeing
5062          * of pages that are not dirty.  Check for page length rounding
5063          * problems.
5064          */
5065         if (io_off + io_len > lbn_off + bsize) {
5066                 ASSERT((io_off + io_len) - (lbn_off + bsize) < PAGESIZE);
5067                 io_len = lbn_off + bsize - io_off;
5068         }
5069         /*
5070          * The RMODINPROGRESS flag makes sure that nfs(3)_bio() sees a
5071          * consistent value of r_size. RMODINPROGRESS is set in writerp().
5072          * When RMODINPROGRESS is set it indicates that a uiomove() is in
5073          * progress and the r_size has not been made consistent with the
5074          * new size of the file. When the uiomove() completes the r_size is
5075          * updated and the RMODINPROGRESS flag is cleared.
5076          *
5077          * The RMODINPROGRESS flag makes sure that nfs(3)_bio() sees a
5078          * consistent value of r_size. Without this handshaking, it is
5079          * possible that nfs(3)_bio() picks  up the old value of r_size
5080          * before the uiomove() in writerp() completes. This will result
5081          * in the write through nfs(3)_bio() being dropped.
5082          *
5083          * More precisely, there is a window between the time the uiomove()
5084          * completes and the time the r_size is updated. If a VOP_PUTPAGE()
5085          * operation intervenes in this window, the page will be picked up,
5086          * because it is dirty (it will be unlocked, unless it was
5087          * pagecreate'd). When the page is picked up as dirty, the dirty
5088          * bit is reset (pvn_getdirty()). In nfs(3)write(), r_size is
5089          * checked. This will still be the old size. Therefore the page will
5090          * not be written out. When segmap_release() calls VOP_PUTPAGE(),
5091          * the page will be found to be clean and the write will be dropped.
5092          */
5093         if (rp->r_flags & RMODINPROGRESS) {
5094                 mutex_enter(&rp->r_statelock);
5095                 if ((rp->r_flags & RMODINPROGRESS) &&
5096                     rp->r_modaddr + MAXBSIZE > io_off &&
5097                     rp->r_modaddr < io_off + io_len) {
5098                         page_t *plist;
5099                         /*
5100                          * A write is in progress for this region of the file.
5101                          * If we did not detect RMODINPROGRESS here then this
5102                          * path through nfs_putapage() would eventually go to
5103                          * nfs(3)_bio() and may not write out all of the data
5104                          * in the pages. We end up losing data. So we decide
5105                          * to set the modified bit on each page in the page
5106                          * list and mark the rnode with RDIRTY. This write
5107                          * will be restarted at some later time.
5108                          */
5109                         plist = pp;
5110                         while (plist != NULL) {
5111                                 pp = plist;
5112                                 page_sub(&plist, pp);
5113                                 hat_setmod(pp);
5114                                 page_io_unlock(pp);
5115                                 page_unlock(pp);
5116                         }
5117                         rp->r_flags |= RDIRTY;
5118                         mutex_exit(&rp->r_statelock);
5119                         if (offp)
5120                                 *offp = io_off;
5121                         if (lenp)
5122                                 *lenp = io_len;
5123                         return (0);
5124                 }
5125                 mutex_exit(&rp->r_statelock);
5126         }
5127 
5128         if (flags & B_ASYNC) {
5129                 error = nfs_async_putapage(vp, pp, io_off, io_len, flags, cr,
5130                     nfs3_sync_putapage);
5131         } else
5132                 error = nfs3_sync_putapage(vp, pp, io_off, io_len, flags, cr);
5133 
5134         if (offp)
5135                 *offp = io_off;
5136         if (lenp)
5137                 *lenp = io_len;
5138         return (error);
5139 }
5140 
5141 static int
5142 nfs3_sync_putapage(vnode_t *vp, page_t *pp, u_offset_t io_off, size_t io_len,
5143         int flags, cred_t *cr)
5144 {
5145         int error;
5146         rnode_t *rp;
5147 
5148         ASSERT(nfs_zone() == VTOMI(vp)->mi_zone);
5149 
5150         flags |= B_WRITE;
5151 
5152         error = nfs3_rdwrlbn(vp, pp, io_off, io_len, flags, cr);
5153 
5154         rp = VTOR(vp);
5155 
5156         if ((error == ENOSPC || error == EDQUOT || error == EFBIG ||
5157             error == EACCES) &&
5158             (flags & (B_INVAL|B_FORCE)) != (B_INVAL|B_FORCE)) {
5159                 if (!(rp->r_flags & ROUTOFSPACE)) {
5160                         mutex_enter(&rp->r_statelock);
5161                         rp->r_flags |= ROUTOFSPACE;
5162                         mutex_exit(&rp->r_statelock);
5163                 }
5164                 flags |= B_ERROR;
5165                 pvn_write_done(pp, flags);
5166                 /*
5167                  * If this was not an async thread, then try again to
5168                  * write out the pages, but this time, also destroy
5169                  * them whether or not the write is successful.  This
5170                  * will prevent memory from filling up with these
5171                  * pages and destroying them is the only alternative
5172                  * if they can't be written out.
5173                  *
5174                  * Don't do this if this is an async thread because
5175                  * when the pages are unlocked in pvn_write_done,
5176                  * some other thread could have come along, locked
5177                  * them, and queued for an async thread.  It would be
5178                  * possible for all of the async threads to be tied
5179                  * up waiting to lock the pages again and they would
5180                  * all already be locked and waiting for an async
5181                  * thread to handle them.  Deadlock.
5182                  */
5183                 if (!(flags & B_ASYNC)) {
5184                         error = nfs3_putpage(vp, io_off, io_len,
5185                             B_INVAL | B_FORCE, cr, NULL);
5186                 }
5187         } else {
5188                 if (error)
5189                         flags |= B_ERROR;
5190                 else if (rp->r_flags & ROUTOFSPACE) {
5191                         mutex_enter(&rp->r_statelock);
5192                         rp->r_flags &= ~ROUTOFSPACE;
5193                         mutex_exit(&rp->r_statelock);
5194                 }
5195                 pvn_write_done(pp, flags);
5196                 if (freemem < desfree)
5197                         (void) nfs3_commit_vp(vp, (u_offset_t)0, 0, cr);
5198         }
5199 
5200         return (error);
5201 }
5202 
5203 /* ARGSUSED */
5204 static int
5205 nfs3_map(vnode_t *vp, offset_t off, struct as *as, caddr_t *addrp,
5206         size_t len, uchar_t prot, uchar_t maxprot, uint_t flags,
5207         cred_t *cr, caller_context_t *ct)
5208 {
5209         struct segvn_crargs vn_a;
5210         int error;
5211         rnode_t *rp;
5212         struct vattr va;
5213 
5214         if (nfs_zone() != VTOMI(vp)->mi_zone)
5215                 return (EIO);
5216 
5217         if (vp->v_flag & VNOMAP)
5218                 return (ENOSYS);
5219 
5220         if (off < 0 || off + len < 0)
5221                 return (ENXIO);
5222 
5223         if (vp->v_type != VREG)
5224                 return (ENODEV);
5225 
5226         /*
5227          * If there is cached data and if close-to-open consistency
5228          * checking is not turned off and if the file system is not
5229          * mounted readonly, then force an over the wire getattr.
5230          * Otherwise, just invoke nfs3getattr to get a copy of the
5231          * attributes.  The attribute cache will be used unless it
5232          * is timed out and if it is, then an over the wire getattr
5233          * will be issued.
5234          */
5235         va.va_mask = AT_ALL;
5236         if (vn_has_cached_data(vp) &&
5237             !(VTOMI(vp)->mi_flags & MI_NOCTO) && !vn_is_readonly(vp))
5238                 error = nfs3_getattr_otw(vp, &va, cr);
5239         else
5240                 error = nfs3getattr(vp, &va, cr);
5241         if (error)
5242                 return (error);
5243 
5244         /*
5245          * Check to see if the vnode is currently marked as not cachable.
5246          * This means portions of the file are locked (through VOP_FRLOCK).
5247          * In this case the map request must be refused.  We use
5248          * rp->r_lkserlock to avoid a race with concurrent lock requests.
5249          */
5250         rp = VTOR(vp);
5251 
5252         /*
5253          * Atomically increment r_inmap after acquiring r_rwlock. The
5254          * idea here is to acquire r_rwlock to block read/write and
5255          * not to protect r_inmap. r_inmap will inform nfs3_read/write()
5256          * that we are in nfs3_map(). Now, r_rwlock is acquired in order
5257          * and we can prevent the deadlock that would have occurred
5258          * when nfs3_addmap() would have acquired it out of order.
5259          *
5260          * Since we are not protecting r_inmap by any lock, we do not
5261          * hold any lock when we decrement it. We atomically decrement
5262          * r_inmap after we release r_lkserlock.
5263          */
5264 
5265         if (nfs_rw_enter_sig(&rp->r_rwlock, RW_WRITER, INTR(vp)))
5266                 return (EINTR);
5267         atomic_add_int(&rp->r_inmap, 1);
5268         nfs_rw_exit(&rp->r_rwlock);
5269 
5270         if (nfs_rw_enter_sig(&rp->r_lkserlock, RW_READER, INTR(vp))) {
5271                 atomic_add_int(&rp->r_inmap, -1);
5272                 return (EINTR);
5273         }
5274 
5275         if (vp->v_flag & VNOCACHE) {
5276                 error = EAGAIN;
5277                 goto done;
5278         }
5279 
5280         /*
5281          * Don't allow concurrent locks and mapping if mandatory locking is
5282          * enabled.
5283          */
5284         if ((flk_has_remote_locks(vp) || lm_has_sleep(vp)) &&
5285             MANDLOCK(vp, va.va_mode)) {
5286                 error = EAGAIN;
5287                 goto done;
5288         }
5289 
5290         as_rangelock(as);
5291         error = choose_addr(as, addrp, len, off, ADDR_VACALIGN, flags);
5292         if (error != 0) {
5293                 as_rangeunlock(as);
5294                 goto done;
5295         }
5296 
5297         vn_a.vp = vp;
5298         vn_a.offset = off;
5299         vn_a.type = (flags & MAP_TYPE);
5300         vn_a.prot = (uchar_t)prot;
5301         vn_a.maxprot = (uchar_t)maxprot;
5302         vn_a.flags = (flags & ~MAP_TYPE);
5303         vn_a.cred = cr;
5304         vn_a.amp = NULL;
5305         vn_a.szc = 0;
5306         vn_a.lgrp_mem_policy_flags = 0;
5307 
5308         error = as_map(as, *addrp, len, segvn_create, &vn_a);
5309         as_rangeunlock(as);
5310 
5311 done:
5312         nfs_rw_exit(&rp->r_lkserlock);
5313         atomic_add_int(&rp->r_inmap, -1);
5314         return (error);
5315 }
5316 
5317 /* ARGSUSED */
5318 static int
5319 nfs3_addmap(vnode_t *vp, offset_t off, struct as *as, caddr_t addr,
5320         size_t len, uchar_t prot, uchar_t maxprot, uint_t flags,
5321         cred_t *cr, caller_context_t *ct)
5322 {
5323         rnode_t *rp;
5324 
5325         if (vp->v_flag & VNOMAP)
5326                 return (ENOSYS);
5327         if (nfs_zone() != VTOMI(vp)->mi_zone)
5328                 return (EIO);
5329 
5330         rp = VTOR(vp);
5331         atomic_add_long((ulong_t *)&rp->r_mapcnt, btopr(len));
5332 
5333         return (0);
5334 }
5335 
5336 /* ARGSUSED */
5337 static int
5338 nfs3_frlock(vnode_t *vp, int cmd, struct flock64 *bfp, int flag,
5339         offset_t offset, struct flk_callback *flk_cbp, cred_t *cr,
5340         caller_context_t *ct)
5341 {
5342         netobj lm_fh3;
5343         int rc;
5344         u_offset_t start, end;
5345         rnode_t *rp;
5346         int error = 0, intr = INTR(vp);
5347 
5348         if (nfs_zone() != VTOMI(vp)->mi_zone)
5349                 return (EIO);
5350         /* check for valid cmd parameter */
5351         if (cmd != F_GETLK && cmd != F_SETLK && cmd != F_SETLKW)
5352                 return (EINVAL);
5353 
5354         /* Verify l_type. */
5355         switch (bfp->l_type) {
5356         case F_RDLCK:
5357                 if (cmd != F_GETLK && !(flag & FREAD))
5358                         return (EBADF);
5359                 break;
5360         case F_WRLCK:
5361                 if (cmd != F_GETLK && !(flag & FWRITE))
5362                         return (EBADF);
5363                 break;
5364         case F_UNLCK:
5365                 intr = 0;
5366                 break;
5367 
5368         default:
5369                 return (EINVAL);
5370         }
5371 
5372         /* check the validity of the lock range */
5373         if (rc = flk_convert_lock_data(vp, bfp, &start, &end, offset))
5374                 return (rc);
5375         if (rc = flk_check_lock_data(start, end, MAXEND))
5376                 return (rc);
5377 
5378         /*
5379          * If the filesystem is mounted using local locking, pass the
5380          * request off to the local locking code.
5381          */
5382         if (VTOMI(vp)->mi_flags & MI_LLOCK) {
5383                 if (cmd == F_SETLK || cmd == F_SETLKW) {
5384                         /*
5385                          * For complete safety, we should be holding
5386                          * r_lkserlock.  However, we can't call
5387                          * lm_safelock and then fs_frlock while
5388                          * holding r_lkserlock, so just invoke
5389                          * lm_safelock and expect that this will
5390                          * catch enough of the cases.
5391                          */
5392                         if (!lm_safelock(vp, bfp, cr))
5393                                 return (EAGAIN);
5394                 }
5395                 return (fs_frlock(vp, cmd, bfp, flag, offset, flk_cbp, cr, ct));
5396         }
5397 
5398         rp = VTOR(vp);
5399 
5400         /*
5401          * Check whether the given lock request can proceed, given the
5402          * current file mappings.
5403          */
5404         if (nfs_rw_enter_sig(&rp->r_lkserlock, RW_WRITER, intr))
5405                 return (EINTR);
5406         if (cmd == F_SETLK || cmd == F_SETLKW) {
5407                 if (!lm_safelock(vp, bfp, cr)) {
5408                         rc = EAGAIN;
5409                         goto done;
5410                 }
5411         }
5412 
5413         /*
5414          * Flush the cache after waiting for async I/O to finish.  For new
5415          * locks, this is so that the process gets the latest bits from the
5416          * server.  For unlocks, this is so that other clients see the
5417          * latest bits once the file has been unlocked.  If currently dirty
5418          * pages can't be flushed, then don't allow a lock to be set.  But
5419          * allow unlocks to succeed, to avoid having orphan locks on the
5420          * server.
5421          */
5422         if (cmd != F_GETLK) {
5423                 mutex_enter(&rp->r_statelock);
5424                 while (rp->r_count > 0) {
5425                         if (intr) {
5426                                 klwp_t *lwp = ttolwp(curthread);
5427 
5428                                 if (lwp != NULL)
5429                                         lwp->lwp_nostop++;
5430                                 if (cv_wait_sig(&rp->r_cv,
5431                                     &rp->r_statelock) == 0) {
5432                                         if (lwp != NULL)
5433                                                 lwp->lwp_nostop--;
5434                                         rc = EINTR;
5435                                         break;
5436                                 }
5437                                 if (lwp != NULL)
5438                                         lwp->lwp_nostop--;
5439                         } else
5440                                 cv_wait(&rp->r_cv, &rp->r_statelock);
5441                 }
5442                 mutex_exit(&rp->r_statelock);
5443                 if (rc != 0)
5444                         goto done;
5445                 error = nfs3_putpage(vp, (offset_t)0, 0, B_INVAL, cr, ct);
5446                 if (error) {
5447                         if (error == ENOSPC || error == EDQUOT) {
5448                                 mutex_enter(&rp->r_statelock);
5449                                 if (!rp->r_error)
5450                                         rp->r_error = error;
5451                                 mutex_exit(&rp->r_statelock);
5452                         }
5453                         if (bfp->l_type != F_UNLCK) {
5454                                 rc = ENOLCK;
5455                                 goto done;
5456                         }
5457                 }
5458         }
5459 
5460         lm_fh3.n_len = VTOFH3(vp)->fh3_length;
5461         lm_fh3.n_bytes = (char *)&(VTOFH3(vp)->fh3_u.data);
5462 
5463         /*
5464          * Call the lock manager to do the real work of contacting
5465          * the server and obtaining the lock.
5466          */
5467         rc = lm4_frlock(vp, cmd, bfp, flag, offset, cr, &lm_fh3, flk_cbp);
5468 
5469         if (rc == 0)
5470                 nfs_lockcompletion(vp, cmd);
5471 
5472 done:
5473         nfs_rw_exit(&rp->r_lkserlock);
5474         return (rc);
5475 }
5476 
5477 /*
5478  * Free storage space associated with the specified vnode.  The portion
5479  * to be freed is specified by bfp->l_start and bfp->l_len (already
5480  * normalized to a "whence" of 0).
5481  *
5482  * This is an experimental facility whose continued existence is not
5483  * guaranteed.  Currently, we only support the special case
5484  * of l_len == 0, meaning free to end of file.
5485  */
5486 /* ARGSUSED */
5487 static int
5488 nfs3_space(vnode_t *vp, int cmd, struct flock64 *bfp, int flag,
5489         offset_t offset, cred_t *cr, caller_context_t *ct)
5490 {
5491         int error;
5492 
5493         ASSERT(vp->v_type == VREG);
5494         if (cmd != F_FREESP)
5495                 return (EINVAL);
5496         if (nfs_zone() != VTOMI(vp)->mi_zone)
5497                 return (EIO);
5498 
5499         error = convoff(vp, bfp, 0, offset);
5500         if (!error) {
5501                 ASSERT(bfp->l_start >= 0);
5502                 if (bfp->l_len == 0) {
5503                         struct vattr va;
5504 
5505                         /*
5506                          * ftruncate should not change the ctime and
5507                          * mtime if we truncate the file to its
5508                          * previous size.
5509                          */
5510                         va.va_mask = AT_SIZE;
5511                         error = nfs3getattr(vp, &va, cr);
5512                         if (error || va.va_size == bfp->l_start)
5513                                 return (error);
5514                         va.va_mask = AT_SIZE;
5515                         va.va_size = bfp->l_start;
5516                         error = nfs3setattr(vp, &va, 0, cr);
5517                 } else
5518                         error = EINVAL;
5519         }
5520 
5521         return (error);
5522 }
5523 
5524 /* ARGSUSED */
5525 static int
5526 nfs3_realvp(vnode_t *vp, vnode_t **vpp, caller_context_t *ct)
5527 {
5528 
5529         return (EINVAL);
5530 }
5531 
5532 /*
5533  * Setup and add an address space callback to do the work of the delmap call.
5534  * The callback will (and must be) deleted in the actual callback function.
5535  *
5536  * This is done in order to take care of the problem that we have with holding
5537  * the address space's a_lock for a long period of time (e.g. if the NFS server
5538  * is down).  Callbacks will be executed in the address space code while the
5539  * a_lock is not held.  Holding the address space's a_lock causes things such
5540  * as ps and fork to hang because they are trying to acquire this lock as well.
5541  */
5542 /* ARGSUSED */
5543 static int
5544 nfs3_delmap(vnode_t *vp, offset_t off, struct as *as, caddr_t addr,
5545         size_t len, uint_t prot, uint_t maxprot, uint_t flags,
5546         cred_t *cr, caller_context_t *ct)
5547 {
5548         int                     caller_found;
5549         int                     error;
5550         rnode_t                 *rp;
5551         nfs_delmap_args_t       *dmapp;
5552         nfs_delmapcall_t        *delmap_call;
5553 
5554         if (vp->v_flag & VNOMAP)
5555                 return (ENOSYS);
5556         /*
5557          * A process may not change zones if it has NFS pages mmap'ed
5558          * in, so we can't legitimately get here from the wrong zone.
5559          */
5560         ASSERT(nfs_zone() == VTOMI(vp)->mi_zone);
5561 
5562         rp = VTOR(vp);
5563 
5564         /*
5565          * The way that the address space of this process deletes its mapping
5566          * of this file is via the following call chains:
5567          * - as_free()->SEGOP_UNMAP()/segvn_unmap()->VOP_DELMAP()/nfs3_delmap()
5568          * - as_unmap()->SEGOP_UNMAP()/segvn_unmap()->VOP_DELMAP()/nfs3_delmap()
5569          *
5570          * With the use of address space callbacks we are allowed to drop the
5571          * address space lock, a_lock, while executing the NFS operations that
5572          * need to go over the wire.  Returning EAGAIN to the caller of this
5573          * function is what drives the execution of the callback that we add
5574          * below.  The callback will be executed by the address space code
5575          * after dropping the a_lock.  When the callback is finished, since
5576          * we dropped the a_lock, it must be re-acquired and segvn_unmap()
5577          * is called again on the same segment to finish the rest of the work
5578          * that needs to happen during unmapping.
5579          *
5580          * This action of calling back into the segment driver causes
5581          * nfs3_delmap() to get called again, but since the callback was
5582          * already executed at this point, it already did the work and there
5583          * is nothing left for us to do.
5584          *
5585          * To Summarize:
5586          * - The first time nfs3_delmap is called by the current thread is when
5587          * we add the caller associated with this delmap to the delmap caller
5588          * list, add the callback, and return EAGAIN.
5589          * - The second time in this call chain when nfs3_delmap is called we
5590          * will find this caller in the delmap caller list and realize there
5591          * is no more work to do thus removing this caller from the list and
5592          * returning the error that was set in the callback execution.
5593          */
5594         caller_found = nfs_find_and_delete_delmapcall(rp, &error);
5595         if (caller_found) {
5596                 /*
5597                  * 'error' is from the actual delmap operations.  To avoid
5598                  * hangs, we need to handle the return of EAGAIN differently
5599                  * since this is what drives the callback execution.
5600                  * In this case, we don't want to return EAGAIN and do the
5601                  * callback execution because there are none to execute.
5602                  */
5603                 if (error == EAGAIN)
5604                         return (0);
5605                 else
5606                         return (error);
5607         }
5608 
5609         /* current caller was not in the list */
5610         delmap_call = nfs_init_delmapcall();
5611 
5612         mutex_enter(&rp->r_statelock);
5613         list_insert_tail(&rp->r_indelmap, delmap_call);
5614         mutex_exit(&rp->r_statelock);
5615 
5616         dmapp = kmem_alloc(sizeof (nfs_delmap_args_t), KM_SLEEP);
5617 
5618         dmapp->vp = vp;
5619         dmapp->off = off;
5620         dmapp->addr = addr;
5621         dmapp->len = len;
5622         dmapp->prot = prot;
5623         dmapp->maxprot = maxprot;
5624         dmapp->flags = flags;
5625         dmapp->cr = cr;
5626         dmapp->caller = delmap_call;
5627 
5628         error = as_add_callback(as, nfs3_delmap_callback, dmapp,
5629             AS_UNMAP_EVENT, addr, len, KM_SLEEP);
5630 
5631         return (error ? error : EAGAIN);
5632 }
5633 
5634 /*
5635  * Remove some pages from an mmap'd vnode.  Just update the
5636  * count of pages.  If doing close-to-open, then flush and
5637  * commit all of the pages associated with this file.
5638  * Otherwise, start an asynchronous page flush to write out
5639  * any dirty pages.  This will also associate a credential
5640  * with the rnode which can be used to write the pages.
5641  */
5642 /* ARGSUSED */
5643 static void
5644 nfs3_delmap_callback(struct as *as, void *arg, uint_t event)
5645 {
5646         int                     error;
5647         rnode_t                 *rp;
5648         mntinfo_t               *mi;
5649         nfs_delmap_args_t       *dmapp = (nfs_delmap_args_t *)arg;
5650 
5651         rp = VTOR(dmapp->vp);
5652         mi = VTOMI(dmapp->vp);
5653 
5654         atomic_add_long((ulong_t *)&rp->r_mapcnt, -btopr(dmapp->len));
5655         ASSERT(rp->r_mapcnt >= 0);
5656 
5657         /*
5658          * Initiate a page flush and potential commit if there are
5659          * pages, the file system was not mounted readonly, the segment
5660          * was mapped shared, and the pages themselves were writeable.
5661          */
5662         if (vn_has_cached_data(dmapp->vp) && !vn_is_readonly(dmapp->vp) &&
5663             dmapp->flags == MAP_SHARED && (dmapp->maxprot & PROT_WRITE)) {
5664                 mutex_enter(&rp->r_statelock);
5665                 rp->r_flags |= RDIRTY;
5666                 mutex_exit(&rp->r_statelock);
5667                 /*
5668                  * If this is a cross-zone access a sync putpage won't work, so
5669                  * the best we can do is try an async putpage.  That seems
5670                  * better than something more draconian such as discarding the
5671                  * dirty pages.
5672                  */
5673                 if ((mi->mi_flags & MI_NOCTO) ||
5674                     nfs_zone() != mi->mi_zone)
5675                         error = nfs3_putpage(dmapp->vp, dmapp->off, dmapp->len,
5676                             B_ASYNC, dmapp->cr, NULL);
5677                 else
5678                         error = nfs3_putpage_commit(dmapp->vp, dmapp->off,
5679                             dmapp->len, dmapp->cr);
5680                 if (!error) {
5681                         mutex_enter(&rp->r_statelock);
5682                         error = rp->r_error;
5683                         rp->r_error = 0;
5684                         mutex_exit(&rp->r_statelock);
5685                 }
5686         } else
5687                 error = 0;
5688 
5689         if ((rp->r_flags & RDIRECTIO) || (mi->mi_flags & MI_DIRECTIO))
5690                 (void) nfs3_putpage(dmapp->vp, dmapp->off, dmapp->len,
5691                     B_INVAL, dmapp->cr, NULL);
5692 
5693         dmapp->caller->error = error;
5694         (void) as_delete_callback(as, arg);
5695         kmem_free(dmapp, sizeof (nfs_delmap_args_t));
5696 }
5697 
5698 static int nfs3_pathconf_disable_cache = 0;
5699 
5700 #ifdef DEBUG
5701 static int nfs3_pathconf_cache_hits = 0;
5702 static int nfs3_pathconf_cache_misses = 0;
5703 #endif
5704 
5705 /* ARGSUSED */
5706 static int
5707 nfs3_pathconf(vnode_t *vp, int cmd, ulong_t *valp, cred_t *cr,
5708         caller_context_t *ct)
5709 {
5710         int error;
5711         PATHCONF3args args;
5712         PATHCONF3res res;
5713         int douprintf;
5714         failinfo_t fi;
5715         rnode_t *rp;
5716         hrtime_t t;
5717 
5718         if (nfs_zone() != VTOMI(vp)->mi_zone)
5719                 return (EIO);
5720         /*
5721          * Large file spec - need to base answer on info stored
5722          * on original FSINFO response.
5723          */
5724         if (cmd == _PC_FILESIZEBITS) {
5725                 unsigned long long ll;
5726                 long l = 1;
5727 
5728                 ll = VTOMI(vp)->mi_maxfilesize;
5729 
5730                 if (ll == 0) {
5731                         *valp = 0;
5732                         return (0);
5733                 }
5734 
5735                 if (ll & 0xffffffff00000000) {
5736                         l += 32; ll >>= 32;
5737                 }
5738                 if (ll & 0xffff0000) {
5739                         l += 16; ll >>= 16;
5740                 }
5741                 if (ll & 0xff00) {
5742                         l += 8; ll >>= 8;
5743                 }
5744                 if (ll & 0xf0) {
5745                         l += 4; ll >>= 4;
5746                 }
5747                 if (ll & 0xc) {
5748                         l += 2; ll >>= 2;
5749                 }
5750                 if (ll & 0x2)
5751                         l += 2;
5752                 else if (ll & 0x1)
5753                         l += 1;
5754                 *valp = l;
5755                 return (0);
5756         }
5757 
5758         if (cmd == _PC_ACL_ENABLED) {
5759                 *valp = _ACL_ACLENT_ENABLED;
5760                 return (0);
5761         }
5762 
5763         if (cmd == _PC_XATTR_EXISTS) {
5764                 error = 0;
5765                 *valp = 0;
5766                 if (vp->v_vfsp->vfs_flag & VFS_XATTR) {
5767                         vnode_t *avp;
5768                         rnode_t *rp;
5769                         int error = 0;
5770                         mntinfo_t *mi = VTOMI(vp);
5771 
5772                         if (!(mi->mi_flags & MI_EXTATTR))
5773                                 return (0);
5774 
5775                         rp = VTOR(vp);
5776                         if (nfs_rw_enter_sig(&rp->r_rwlock, RW_READER,
5777                             INTR(vp)))
5778                                 return (EINTR);
5779 
5780                         error = nfs3lookup_dnlc(vp, XATTR_DIR_NAME, &avp, cr);
5781                         if (error || avp == NULL)
5782                                 error = acl_getxattrdir3(vp, &avp, 0, cr, 0);
5783 
5784                         nfs_rw_exit(&rp->r_rwlock);
5785 
5786                         if (error == 0 && avp != NULL) {
5787                                 error = do_xattr_exists_check(avp, valp, cr);
5788                                 VN_RELE(avp);
5789                         } else if (error == ENOENT) {
5790                                 error = 0;
5791                                 *valp = 0;
5792                         }
5793                 }
5794                 return (error);
5795         }
5796 
5797         rp = VTOR(vp);
5798         if (rp->r_pathconf != NULL) {
5799                 mutex_enter(&rp->r_statelock);
5800                 if (rp->r_pathconf != NULL && nfs3_pathconf_disable_cache) {
5801                         kmem_free(rp->r_pathconf, sizeof (*rp->r_pathconf));
5802                         rp->r_pathconf = NULL;
5803                 }
5804                 if (rp->r_pathconf != NULL) {
5805                         error = 0;
5806                         switch (cmd) {
5807                         case _PC_LINK_MAX:
5808                                 *valp = rp->r_pathconf->link_max;
5809                                 break;
5810                         case _PC_NAME_MAX:
5811                                 *valp = rp->r_pathconf->name_max;
5812                                 break;
5813                         case _PC_PATH_MAX:
5814                         case _PC_SYMLINK_MAX:
5815                                 *valp = MAXPATHLEN;
5816                                 break;
5817                         case _PC_CHOWN_RESTRICTED:
5818                                 *valp = rp->r_pathconf->chown_restricted;
5819                                 break;
5820                         case _PC_NO_TRUNC:
5821                                 *valp = rp->r_pathconf->no_trunc;
5822                                 break;
5823                         default:
5824                                 error = EINVAL;
5825                                 break;
5826                         }
5827                         mutex_exit(&rp->r_statelock);
5828 #ifdef DEBUG
5829                         nfs3_pathconf_cache_hits++;
5830 #endif
5831                         return (error);
5832                 }
5833                 mutex_exit(&rp->r_statelock);
5834         }
5835 #ifdef DEBUG
5836         nfs3_pathconf_cache_misses++;
5837 #endif
5838 
5839         args.object = *VTOFH3(vp);
5840         fi.vp = vp;
5841         fi.fhp = (caddr_t)&args.object;
5842         fi.copyproc = nfs3copyfh;
5843         fi.lookupproc = nfs3lookup;
5844         fi.xattrdirproc = acl_getxattrdir3;
5845 
5846         douprintf = 1;
5847 
5848         t = gethrtime();
5849 
5850         error = rfs3call(VTOMI(vp), NFSPROC3_PATHCONF,
5851             xdr_nfs_fh3, (caddr_t)&args,
5852             xdr_PATHCONF3res, (caddr_t)&res, cr,
5853             &douprintf, &res.status, 0, &fi);
5854 
5855         if (error)
5856                 return (error);
5857 
5858         error = geterrno3(res.status);
5859 
5860         if (!error) {
5861                 nfs3_cache_post_op_attr(vp, &res.resok.obj_attributes, t, cr);
5862                 if (!nfs3_pathconf_disable_cache) {
5863                         mutex_enter(&rp->r_statelock);
5864                         if (rp->r_pathconf == NULL) {
5865                                 rp->r_pathconf = kmem_alloc(
5866                                     sizeof (*rp->r_pathconf), KM_NOSLEEP);
5867                                 if (rp->r_pathconf != NULL)
5868                                         *rp->r_pathconf = res.resok.info;
5869                         }
5870                         mutex_exit(&rp->r_statelock);
5871                 }
5872                 switch (cmd) {
5873                 case _PC_LINK_MAX:
5874                         *valp = res.resok.info.link_max;
5875                         break;
5876                 case _PC_NAME_MAX:
5877                         *valp = res.resok.info.name_max;
5878                         break;
5879                 case _PC_PATH_MAX:
5880                 case _PC_SYMLINK_MAX:
5881                         *valp = MAXPATHLEN;
5882                         break;
5883                 case _PC_CHOWN_RESTRICTED:
5884                         *valp = res.resok.info.chown_restricted;
5885                         break;
5886                 case _PC_NO_TRUNC:
5887                         *valp = res.resok.info.no_trunc;
5888                         break;
5889                 default:
5890                         return (EINVAL);
5891                 }
5892         } else {
5893                 nfs3_cache_post_op_attr(vp, &res.resfail.obj_attributes, t, cr);
5894                 PURGE_STALE_FH(error, vp, cr);
5895         }
5896 
5897         return (error);
5898 }
5899 
5900 /*
5901  * Called by async thread to do synchronous pageio. Do the i/o, wait
5902  * for it to complete, and cleanup the page list when done.
5903  */
5904 static int
5905 nfs3_sync_pageio(vnode_t *vp, page_t *pp, u_offset_t io_off, size_t io_len,
5906         int flags, cred_t *cr)
5907 {
5908         int error;
5909 
5910         ASSERT(nfs_zone() == VTOMI(vp)->mi_zone);
5911         error = nfs3_rdwrlbn(vp, pp, io_off, io_len, flags, cr);
5912         if (flags & B_READ)
5913                 pvn_read_done(pp, (error ? B_ERROR : 0) | flags);
5914         else
5915                 pvn_write_done(pp, (error ? B_ERROR : 0) | flags);
5916         return (error);
5917 }
5918 
5919 /* ARGSUSED */
5920 static int
5921 nfs3_pageio(vnode_t *vp, page_t *pp, u_offset_t io_off, size_t io_len,
5922         int flags, cred_t *cr, caller_context_t *ct)
5923 {
5924         int error;
5925         rnode_t *rp;
5926 
5927         if (pp == NULL)
5928                 return (EINVAL);
5929         if (!(flags & B_ASYNC) && nfs_zone() != VTOMI(vp)->mi_zone)
5930                 return (EIO);
5931 
5932         rp = VTOR(vp);
5933         mutex_enter(&rp->r_statelock);
5934         rp->r_count++;
5935         mutex_exit(&rp->r_statelock);
5936 
5937         if (flags & B_ASYNC) {
5938                 error = nfs_async_pageio(vp, pp, io_off, io_len, flags, cr,
5939                     nfs3_sync_pageio);
5940         } else
5941                 error = nfs3_rdwrlbn(vp, pp, io_off, io_len, flags, cr);
5942         mutex_enter(&rp->r_statelock);
5943         rp->r_count--;
5944         cv_broadcast(&rp->r_cv);
5945         mutex_exit(&rp->r_statelock);
5946         return (error);
5947 }
5948 
5949 /* ARGSUSED */
5950 static void
5951 nfs3_dispose(vnode_t *vp, page_t *pp, int fl, int dn, cred_t *cr,
5952         caller_context_t *ct)
5953 {
5954         int error;
5955         rnode_t *rp;
5956         page_t *plist;
5957         page_t *pptr;
5958         offset3 offset;
5959         count3 len;
5960         k_sigset_t smask;
5961 
5962         /*
5963          * We should get called with fl equal to either B_FREE or
5964          * B_INVAL.  Any other value is illegal.
5965          *
5966          * The page that we are either supposed to free or destroy
5967          * should be exclusive locked and its io lock should not
5968          * be held.
5969          */
5970         ASSERT(fl == B_FREE || fl == B_INVAL);
5971         ASSERT((PAGE_EXCL(pp) && !page_iolock_assert(pp)) || panicstr);
5972         rp = VTOR(vp);
5973 
5974         /*
5975          * If the page doesn't need to be committed or we shouldn't
5976          * even bother attempting to commit it, then just make sure
5977          * that the p_fsdata byte is clear and then either free or
5978          * destroy the page as appropriate.
5979          */
5980         if (pp->p_fsdata == C_NOCOMMIT || (rp->r_flags & RSTALE)) {
5981                 pp->p_fsdata = C_NOCOMMIT;
5982                 if (fl == B_FREE)
5983                         page_free(pp, dn);
5984                 else
5985                         page_destroy(pp, dn);
5986                 return;
5987         }
5988 
5989         /*
5990          * If there is a page invalidation operation going on, then
5991          * if this is one of the pages being destroyed, then just
5992          * clear the p_fsdata byte and then either free or destroy
5993          * the page as appropriate.
5994          */
5995         mutex_enter(&rp->r_statelock);
5996         if ((rp->r_flags & RTRUNCATE) && pp->p_offset >= rp->r_truncaddr) {
5997                 mutex_exit(&rp->r_statelock);
5998                 pp->p_fsdata = C_NOCOMMIT;
5999                 if (fl == B_FREE)
6000                         page_free(pp, dn);
6001                 else
6002                         page_destroy(pp, dn);
6003                 return;
6004         }
6005 
6006         /*
6007          * If we are freeing this page and someone else is already
6008          * waiting to do a commit, then just unlock the page and
6009          * return.  That other thread will take care of commiting
6010          * this page.  The page can be freed sometime after the
6011          * commit has finished.  Otherwise, if the page is marked
6012          * as delay commit, then we may be getting called from
6013          * pvn_write_done, one page at a time.   This could result
6014          * in one commit per page, so we end up doing lots of small
6015          * commits instead of fewer larger commits.  This is bad,
6016          * we want do as few commits as possible.
6017          */
6018         if (fl == B_FREE) {
6019                 if (rp->r_flags & RCOMMITWAIT) {
6020                         page_unlock(pp);
6021                         mutex_exit(&rp->r_statelock);
6022                         return;
6023                 }
6024                 if (pp->p_fsdata == C_DELAYCOMMIT) {
6025                         pp->p_fsdata = C_COMMIT;
6026                         page_unlock(pp);
6027                         mutex_exit(&rp->r_statelock);
6028                         return;
6029                 }
6030         }
6031 
6032         /*
6033          * Check to see if there is a signal which would prevent an
6034          * attempt to commit the pages from being successful.  If so,
6035          * then don't bother with all of the work to gather pages and
6036          * generate the unsuccessful RPC.  Just return from here and
6037          * let the page be committed at some later time.
6038          */
6039         sigintr(&smask, VTOMI(vp)->mi_flags & MI_INT);
6040         if (ttolwp(curthread) != NULL && ISSIG(curthread, JUSTLOOKING)) {
6041                 sigunintr(&smask);
6042                 page_unlock(pp);
6043                 mutex_exit(&rp->r_statelock);
6044                 return;
6045         }
6046         sigunintr(&smask);
6047 
6048         /*
6049          * We are starting to need to commit pages, so let's try
6050          * to commit as many as possible at once to reduce the
6051          * overhead.
6052          *
6053          * Set the `commit inprogress' state bit.  We must
6054          * first wait until any current one finishes.  Then
6055          * we initialize the c_pages list with this page.
6056          */
6057         while (rp->r_flags & RCOMMIT) {
6058                 rp->r_flags |= RCOMMITWAIT;
6059                 cv_wait(&rp->r_commit.c_cv, &rp->r_statelock);
6060                 rp->r_flags &= ~RCOMMITWAIT;
6061         }
6062         rp->r_flags |= RCOMMIT;
6063         mutex_exit(&rp->r_statelock);
6064         ASSERT(rp->r_commit.c_pages == NULL);
6065         rp->r_commit.c_pages = pp;
6066         rp->r_commit.c_commbase = (offset3)pp->p_offset;
6067         rp->r_commit.c_commlen = PAGESIZE;
6068 
6069         /*
6070          * Gather together all other pages which can be committed.
6071          * They will all be chained off r_commit.c_pages.
6072          */
6073         nfs3_get_commit(vp);
6074 
6075         /*
6076          * Clear the `commit inprogress' status and disconnect
6077          * the list of pages to be committed from the rnode.
6078          * At this same time, we also save the starting offset
6079          * and length of data to be committed on the server.
6080          */
6081         plist = rp->r_commit.c_pages;
6082         rp->r_commit.c_pages = NULL;
6083         offset = rp->r_commit.c_commbase;
6084         len = rp->r_commit.c_commlen;
6085         mutex_enter(&rp->r_statelock);
6086         rp->r_flags &= ~RCOMMIT;
6087         cv_broadcast(&rp->r_commit.c_cv);
6088         mutex_exit(&rp->r_statelock);
6089 
6090         if (curproc == proc_pageout || curproc == proc_fsflush ||
6091             nfs_zone() != VTOMI(vp)->mi_zone) {
6092                 nfs_async_commit(vp, plist, offset, len, cr, nfs3_async_commit);
6093                 return;
6094         }
6095 
6096         /*
6097          * Actually generate the COMMIT3 over the wire operation.
6098          */
6099         error = nfs3_commit(vp, offset, len, cr);
6100 
6101         /*
6102          * If we got an error during the commit, just unlock all
6103          * of the pages.  The pages will get retransmitted to the
6104          * server during a putpage operation.
6105          */
6106         if (error) {
6107                 while (plist != NULL) {
6108                         pptr = plist;
6109                         page_sub(&plist, pptr);
6110                         page_unlock(pptr);
6111                 }
6112                 return;
6113         }
6114 
6115         /*
6116          * We've tried as hard as we can to commit the data to stable
6117          * storage on the server.  We release the rest of the pages
6118          * and clear the commit required state.  They will be put
6119          * onto the tail of the cachelist if they are nolonger
6120          * mapped.
6121          */
6122         while (plist != pp) {
6123                 pptr = plist;
6124                 page_sub(&plist, pptr);
6125                 pptr->p_fsdata = C_NOCOMMIT;
6126                 (void) page_release(pptr, 1);
6127         }
6128 
6129         /*
6130          * It is possible that nfs3_commit didn't return error but
6131          * some other thread has modified the page we are going
6132          * to free/destroy.
6133          *    In this case we need to rewrite the page. Do an explicit check
6134          * before attempting to free/destroy the page. If modified, needs to
6135          * be rewritten so unlock the page and return.
6136          */
6137         if (hat_ismod(pp)) {
6138                 pp->p_fsdata = C_NOCOMMIT;
6139                 page_unlock(pp);
6140                 return;
6141         }
6142 
6143         /*
6144          * Now, as appropriate, either free or destroy the page
6145          * that we were called with.
6146          */
6147         pp->p_fsdata = C_NOCOMMIT;
6148         if (fl == B_FREE)
6149                 page_free(pp, dn);
6150         else
6151                 page_destroy(pp, dn);
6152 }
6153 
6154 static int
6155 nfs3_commit(vnode_t *vp, offset3 offset, count3 count, cred_t *cr)
6156 {
6157         int error;
6158         rnode_t *rp;
6159         COMMIT3args args;
6160         COMMIT3res res;
6161         int douprintf;
6162         cred_t *cred;
6163 
6164         rp = VTOR(vp);
6165         ASSERT(nfs_zone() == VTOMI(vp)->mi_zone);
6166 
6167         mutex_enter(&rp->r_statelock);
6168         if (rp->r_cred != NULL) {
6169                 cred = rp->r_cred;
6170                 crhold(cred);
6171         } else {
6172                 rp->r_cred = cr;
6173                 crhold(cr);
6174                 cred = cr;
6175                 crhold(cred);
6176         }
6177         mutex_exit(&rp->r_statelock);
6178 
6179         args.file = *VTOFH3(vp);
6180         args.offset = offset;
6181         args.count = count;
6182 
6183 doitagain:
6184         douprintf = 1;
6185         error = rfs3call(VTOMI(vp), NFSPROC3_COMMIT,
6186             xdr_COMMIT3args, (caddr_t)&args,
6187             xdr_COMMIT3res, (caddr_t)&res, cred,
6188             &douprintf, &res.status, 0, NULL);
6189 
6190         crfree(cred);
6191 
6192         if (error)
6193                 return (error);
6194 
6195         error = geterrno3(res.status);
6196         if (!error) {
6197                 ASSERT(rp->r_flags & RHAVEVERF);
6198                 mutex_enter(&rp->r_statelock);
6199                 if (rp->r_verf == res.resok.verf) {
6200                         mutex_exit(&rp->r_statelock);
6201                         return (0);
6202                 }
6203                 nfs3_set_mod(vp);
6204                 rp->r_verf = res.resok.verf;
6205                 mutex_exit(&rp->r_statelock);
6206                 error = NFS_VERF_MISMATCH;
6207         } else {
6208                 if (error == EACCES) {
6209                         mutex_enter(&rp->r_statelock);
6210                         if (cred != cr) {
6211                                 if (rp->r_cred != NULL)
6212                                         crfree(rp->r_cred);
6213                                 rp->r_cred = cr;
6214                                 crhold(cr);
6215                                 cred = cr;
6216                                 crhold(cred);
6217                                 mutex_exit(&rp->r_statelock);
6218                                 goto doitagain;
6219                         }
6220                         mutex_exit(&rp->r_statelock);
6221                 }
6222                 /*
6223                  * Can't do a PURGE_STALE_FH here because this
6224                  * can cause a deadlock.  nfs3_commit can
6225                  * be called from nfs3_dispose which can be called
6226                  * indirectly via pvn_vplist_dirty.  PURGE_STALE_FH
6227                  * can call back to pvn_vplist_dirty.
6228                  */
6229                 if (error == ESTALE) {
6230                         mutex_enter(&rp->r_statelock);
6231                         rp->r_flags |= RSTALE;
6232                         if (!rp->r_error)
6233                                 rp->r_error = error;
6234                         mutex_exit(&rp->r_statelock);
6235                         PURGE_ATTRCACHE(vp);
6236                 } else {
6237                         mutex_enter(&rp->r_statelock);
6238                         if (!rp->r_error)
6239                                 rp->r_error = error;
6240                         mutex_exit(&rp->r_statelock);
6241                 }
6242         }
6243 
6244         return (error);
6245 }
6246 
6247 static void
6248 nfs3_set_mod(vnode_t *vp)
6249 {
6250         ASSERT(nfs_zone() == VTOMI(vp)->mi_zone);
6251 
6252         pvn_vplist_setdirty(vp, nfs_setmod_check);
6253 }
6254 
6255 /*
6256  * This routine is used to gather together a page list of the pages
6257  * which are to be committed on the server.  This routine must not
6258  * be called if the calling thread holds any locked pages.
6259  *
6260  * The calling thread must have set RCOMMIT.  This bit is used to
6261  * serialize access to the commit structure in the rnode.  As long
6262  * as the thread has set RCOMMIT, then it can manipulate the commit
6263  * structure without requiring any other locks.
6264  */
6265 static void
6266 nfs3_get_commit(vnode_t *vp)
6267 {
6268         rnode_t *rp;
6269         page_t *pp;
6270         kmutex_t *vphm;
6271 
6272         rp = VTOR(vp);
6273 
6274         ASSERT(rp->r_flags & RCOMMIT);
6275 
6276         vphm = page_vnode_mutex(vp);
6277         mutex_enter(vphm);
6278 
6279         /*
6280          * If there are no pages associated with this vnode, then
6281          * just return.
6282          */
6283         if ((pp = vp->v_pages) == NULL) {
6284                 mutex_exit(vphm);
6285                 return;
6286         }
6287 
6288         /*
6289          * Step through all of the pages associated with this vnode
6290          * looking for pages which need to be committed.
6291          */
6292         do {
6293                 /* Skip marker pages. */
6294                 if (pp->p_hash == PVN_VPLIST_HASH_TAG)
6295                         continue;
6296 
6297                 /*
6298                  * If this page does not need to be committed or is
6299                  * modified, then just skip it.
6300                  */
6301                 if (pp->p_fsdata == C_NOCOMMIT || hat_ismod(pp))
6302                         continue;
6303 
6304                 /*
6305                  * Attempt to lock the page.  If we can't, then
6306                  * someone else is messing with it and we will
6307                  * just skip it.
6308                  */
6309                 if (!page_trylock(pp, SE_EXCL))
6310                         continue;
6311 
6312                 /*
6313                  * If this page does not need to be committed or is
6314                  * modified, then just skip it.  Recheck now that
6315                  * the page is locked.
6316                  */
6317                 if (pp->p_fsdata == C_NOCOMMIT || hat_ismod(pp)) {
6318                         page_unlock(pp);
6319                         continue;
6320                 }
6321 
6322                 if (PP_ISFREE(pp)) {
6323                         cmn_err(CE_PANIC, "nfs3_get_commit: %p is free",
6324                             (void *)pp);
6325                 }
6326 
6327                 /*
6328                  * The page needs to be committed and we locked it.
6329                  * Update the base and length parameters and add it
6330                  * to r_pages.
6331                  */
6332                 if (rp->r_commit.c_pages == NULL) {
6333                         rp->r_commit.c_commbase = (offset3)pp->p_offset;
6334                         rp->r_commit.c_commlen = PAGESIZE;
6335                 } else if (pp->p_offset < rp->r_commit.c_commbase) {
6336                         rp->r_commit.c_commlen = rp->r_commit.c_commbase -
6337                             (offset3)pp->p_offset + rp->r_commit.c_commlen;
6338                         rp->r_commit.c_commbase = (offset3)pp->p_offset;
6339                 } else if ((rp->r_commit.c_commbase + rp->r_commit.c_commlen)
6340                     <= pp->p_offset) {
6341                         rp->r_commit.c_commlen = (offset3)pp->p_offset -
6342                             rp->r_commit.c_commbase + PAGESIZE;
6343                 }
6344                 page_add(&rp->r_commit.c_pages, pp);
6345         } while ((pp = pp->p_vpnext) != vp->v_pages);
6346 
6347         mutex_exit(vphm);
6348 }
6349 
6350 /*
6351  * This routine is used to gather together a page list of the pages
6352  * which are to be committed on the server.  This routine must not
6353  * be called if the calling thread holds any locked pages.
6354  *
6355  * The calling thread must have set RCOMMIT.  This bit is used to
6356  * serialize access to the commit structure in the rnode.  As long
6357  * as the thread has set RCOMMIT, then it can manipulate the commit
6358  * structure without requiring any other locks.
6359  */
6360 static void
6361 nfs3_get_commit_range(vnode_t *vp, u_offset_t soff, size_t len)
6362 {
6363 
6364         rnode_t *rp;
6365         page_t *pp;
6366         u_offset_t end;
6367         u_offset_t off;
6368 
6369         ASSERT(len != 0);
6370 
6371         rp = VTOR(vp);
6372 
6373         ASSERT(rp->r_flags & RCOMMIT);
6374         ASSERT(nfs_zone() == VTOMI(vp)->mi_zone);
6375 
6376         /*
6377          * If there are no pages associated with this vnode, then
6378          * just return.
6379          */
6380         if ((pp = vp->v_pages) == NULL)
6381                 return;
6382 
6383         /*
6384          * Calculate the ending offset.
6385          */
6386         end = soff + len;
6387 
6388         for (off = soff; off < end; off += PAGESIZE) {
6389                 /*
6390                  * Lookup each page by vp, offset.
6391                  */
6392                 if ((pp = page_lookup_nowait(vp, off, SE_EXCL)) == NULL)
6393                         continue;
6394 
6395                 /*
6396                  * If this page does not need to be committed or is
6397                  * modified, then just skip it.
6398                  */
6399                 if (pp->p_fsdata == C_NOCOMMIT || hat_ismod(pp)) {
6400                         page_unlock(pp);
6401                         continue;
6402                 }
6403 
6404                 ASSERT(PP_ISFREE(pp) == 0);
6405 
6406                 /*
6407                  * The page needs to be committed and we locked it.
6408                  * Update the base and length parameters and add it
6409                  * to r_pages.
6410                  */
6411                 if (rp->r_commit.c_pages == NULL) {
6412                         rp->r_commit.c_commbase = (offset3)pp->p_offset;
6413                         rp->r_commit.c_commlen = PAGESIZE;
6414                 } else {
6415                         rp->r_commit.c_commlen = (offset3)pp->p_offset -
6416                             rp->r_commit.c_commbase + PAGESIZE;
6417                 }
6418                 page_add(&rp->r_commit.c_pages, pp);
6419         }
6420 }
6421 
6422 static int
6423 nfs3_putpage_commit(vnode_t *vp, offset_t poff, size_t plen, cred_t *cr)
6424 {
6425         int error;
6426         writeverf3 write_verf;
6427         rnode_t *rp = VTOR(vp);
6428 
6429         ASSERT(nfs_zone() == VTOMI(vp)->mi_zone);
6430         /*
6431          * Flush the data portion of the file and then commit any
6432          * portions which need to be committed.  This may need to
6433          * be done twice if the server has changed state since
6434          * data was last written.  The data will need to be
6435          * rewritten to the server and then a new commit done.
6436          *
6437          * In fact, this may need to be done several times if the
6438          * server is having problems and crashing while we are
6439          * attempting to do this.
6440          */
6441 
6442 top:
6443         /*
6444          * Do a flush based on the poff and plen arguments.  This
6445          * will asynchronously write out any modified pages in the
6446          * range specified by (poff, plen).  This starts all of the
6447          * i/o operations which will be waited for in the next
6448          * call to nfs3_putpage
6449          */
6450 
6451         mutex_enter(&rp->r_statelock);
6452         write_verf = rp->r_verf;
6453         mutex_exit(&rp->r_statelock);
6454 
6455         error = nfs3_putpage(vp, poff, plen, B_ASYNC, cr, NULL);
6456         if (error == EAGAIN)
6457                 error = 0;
6458 
6459         /*
6460          * Do a flush based on the poff and plen arguments.  This
6461          * will synchronously write out any modified pages in the
6462          * range specified by (poff, plen) and wait until all of
6463          * the asynchronous i/o's in that range are done as well.
6464          */
6465         if (!error)
6466                 error = nfs3_putpage(vp, poff, plen, 0, cr, NULL);
6467 
6468         if (error)
6469                 return (error);
6470 
6471         mutex_enter(&rp->r_statelock);
6472         if (rp->r_verf != write_verf) {
6473                 mutex_exit(&rp->r_statelock);
6474                 goto top;
6475         }
6476         mutex_exit(&rp->r_statelock);
6477 
6478         /*
6479          * Now commit any pages which might need to be committed.
6480          * If the error, NFS_VERF_MISMATCH, is returned, then
6481          * start over with the flush operation.
6482          */
6483 
6484         error = nfs3_commit_vp(vp, poff, plen, cr);
6485 
6486         if (error == NFS_VERF_MISMATCH)
6487                 goto top;
6488 
6489         return (error);
6490 }
6491 
6492 static int
6493 nfs3_commit_vp(vnode_t *vp, u_offset_t poff, size_t plen, cred_t *cr)
6494 {
6495         rnode_t *rp;
6496         page_t *plist;
6497         offset3 offset;
6498         count3 len;
6499 
6500 
6501         rp = VTOR(vp);
6502 
6503         if (nfs_zone() != VTOMI(vp)->mi_zone)
6504                 return (EIO);
6505         /*
6506          * Set the `commit inprogress' state bit.  We must
6507          * first wait until any current one finishes.
6508          */
6509         mutex_enter(&rp->r_statelock);
6510         while (rp->r_flags & RCOMMIT) {
6511                 rp->r_flags |= RCOMMITWAIT;
6512                 cv_wait(&rp->r_commit.c_cv, &rp->r_statelock);
6513                 rp->r_flags &= ~RCOMMITWAIT;
6514         }
6515         rp->r_flags |= RCOMMIT;
6516         mutex_exit(&rp->r_statelock);
6517 
6518         /*
6519          * Gather together all of the pages which need to be
6520          * committed.
6521          */
6522         if (plen == 0)
6523                 nfs3_get_commit(vp);
6524         else
6525                 nfs3_get_commit_range(vp, poff, plen);
6526 
6527         /*
6528          * Clear the `commit inprogress' bit and disconnect the
6529          * page list which was gathered together in nfs3_get_commit.
6530          */
6531         plist = rp->r_commit.c_pages;
6532         rp->r_commit.c_pages = NULL;
6533         offset = rp->r_commit.c_commbase;
6534         len = rp->r_commit.c_commlen;
6535         mutex_enter(&rp->r_statelock);
6536         rp->r_flags &= ~RCOMMIT;
6537         cv_broadcast(&rp->r_commit.c_cv);
6538         mutex_exit(&rp->r_statelock);
6539 
6540         /*
6541          * If any pages need to be committed, commit them and
6542          * then unlock them so that they can be freed some
6543          * time later.
6544          */
6545         if (plist != NULL) {
6546                 /*
6547                  * No error occurred during the flush portion
6548                  * of this operation, so now attempt to commit
6549                  * the data to stable storage on the server.
6550                  *
6551                  * This will unlock all of the pages on the list.
6552                  */
6553                 return (nfs3_sync_commit(vp, plist, offset, len, cr));
6554         }
6555         return (0);
6556 }
6557 
6558 static int
6559 nfs3_sync_commit(vnode_t *vp, page_t *plist, offset3 offset, count3 count,
6560         cred_t *cr)
6561 {
6562         int error;
6563         page_t *pp;
6564 
6565         ASSERT(nfs_zone() == VTOMI(vp)->mi_zone);
6566         error = nfs3_commit(vp, offset, count, cr);
6567 
6568         /*
6569          * If we got an error, then just unlock all of the pages
6570          * on the list.
6571          */
6572         if (error) {
6573                 while (plist != NULL) {
6574                         pp = plist;
6575                         page_sub(&plist, pp);
6576                         page_unlock(pp);
6577                 }
6578                 return (error);
6579         }
6580         /*
6581          * We've tried as hard as we can to commit the data to stable
6582          * storage on the server.  We just unlock the pages and clear
6583          * the commit required state.  They will get freed later.
6584          */
6585         while (plist != NULL) {
6586                 pp = plist;
6587                 page_sub(&plist, pp);
6588                 pp->p_fsdata = C_NOCOMMIT;
6589                 page_unlock(pp);
6590         }
6591 
6592         return (error);
6593 }
6594 
6595 static void
6596 nfs3_async_commit(vnode_t *vp, page_t *plist, offset3 offset, count3 count,
6597         cred_t *cr)
6598 {
6599         ASSERT(nfs_zone() == VTOMI(vp)->mi_zone);
6600         (void) nfs3_sync_commit(vp, plist, offset, count, cr);
6601 }
6602 
6603 /* ARGSUSED */
6604 static int
6605 nfs3_setsecattr(vnode_t *vp, vsecattr_t *vsecattr, int flag, cred_t *cr,
6606         caller_context_t *ct)
6607 {
6608         int error;
6609         mntinfo_t *mi;
6610 
6611         mi = VTOMI(vp);
6612 
6613         if (nfs_zone() != mi->mi_zone)
6614                 return (EIO);
6615 
6616         if (mi->mi_flags & MI_ACL) {
6617                 error = acl_setacl3(vp, vsecattr, flag, cr);
6618                 if (mi->mi_flags & MI_ACL)
6619                         return (error);
6620         }
6621 
6622         return (ENOSYS);
6623 }
6624 
6625 /* ARGSUSED */
6626 static int
6627 nfs3_getsecattr(vnode_t *vp, vsecattr_t *vsecattr, int flag, cred_t *cr,
6628         caller_context_t *ct)
6629 {
6630         int error;
6631         mntinfo_t *mi;
6632 
6633         mi = VTOMI(vp);
6634 
6635         if (nfs_zone() != mi->mi_zone)
6636                 return (EIO);
6637 
6638         if (mi->mi_flags & MI_ACL) {
6639                 error = acl_getacl3(vp, vsecattr, flag, cr);
6640                 if (mi->mi_flags & MI_ACL)
6641                         return (error);
6642         }
6643 
6644         return (fs_fab_acl(vp, vsecattr, flag, cr, ct));
6645 }
6646 
6647 /* ARGSUSED */
6648 static int
6649 nfs3_shrlock(vnode_t *vp, int cmd, struct shrlock *shr, int flag, cred_t *cr,
6650         caller_context_t *ct)
6651 {
6652         int error;
6653         struct shrlock nshr;
6654         struct nfs_owner nfs_owner;
6655         netobj lm_fh3;
6656 
6657         if (nfs_zone() != VTOMI(vp)->mi_zone)
6658                 return (EIO);
6659 
6660         /*
6661          * check for valid cmd parameter
6662          */
6663         if (cmd != F_SHARE && cmd != F_UNSHARE && cmd != F_HASREMOTELOCKS)
6664                 return (EINVAL);
6665 
6666         /*
6667          * Check access permissions
6668          */
6669         if (cmd == F_SHARE &&
6670             (((shr->s_access & F_RDACC) && !(flag & FREAD)) ||
6671             ((shr->s_access & F_WRACC) && !(flag & FWRITE))))
6672                 return (EBADF);
6673 
6674         /*
6675          * If the filesystem is mounted using local locking, pass the
6676          * request off to the local share code.
6677          */
6678         if (VTOMI(vp)->mi_flags & MI_LLOCK)
6679                 return (fs_shrlock(vp, cmd, shr, flag, cr, ct));
6680 
6681         switch (cmd) {
6682         case F_SHARE:
6683         case F_UNSHARE:
6684                 lm_fh3.n_len = VTOFH3(vp)->fh3_length;
6685                 lm_fh3.n_bytes = (char *)&(VTOFH3(vp)->fh3_u.data);
6686 
6687                 /*
6688                  * If passed an owner that is too large to fit in an
6689                  * nfs_owner it is likely a recursive call from the
6690                  * lock manager client and pass it straight through.  If
6691                  * it is not a nfs_owner then simply return an error.
6692                  */
6693                 if (shr->s_own_len > sizeof (nfs_owner.lowner)) {
6694                         if (((struct nfs_owner *)shr->s_owner)->magic !=
6695                             NFS_OWNER_MAGIC)
6696                                 return (EINVAL);
6697 
6698                         if (error = lm4_shrlock(vp, cmd, shr, flag, &lm_fh3)) {
6699                                 error = set_errno(error);
6700                         }
6701                         return (error);
6702                 }
6703                 /*
6704                  * Remote share reservations owner is a combination of
6705                  * a magic number, hostname, and the local owner
6706                  */
6707                 bzero(&nfs_owner, sizeof (nfs_owner));
6708                 nfs_owner.magic = NFS_OWNER_MAGIC;
6709                 (void) strncpy(nfs_owner.hname, uts_nodename(),
6710                     sizeof (nfs_owner.hname));
6711                 bcopy(shr->s_owner, nfs_owner.lowner, shr->s_own_len);
6712                 nshr.s_access = shr->s_access;
6713                 nshr.s_deny = shr->s_deny;
6714                 nshr.s_sysid = 0;
6715                 nshr.s_pid = ttoproc(curthread)->p_pid;
6716                 nshr.s_own_len = sizeof (nfs_owner);
6717                 nshr.s_owner = (caddr_t)&nfs_owner;
6718 
6719                 if (error = lm4_shrlock(vp, cmd, &nshr, flag, &lm_fh3)) {
6720                         error = set_errno(error);
6721                 }
6722 
6723                 break;
6724 
6725         case F_HASREMOTELOCKS:
6726                 /*
6727                  * NFS client can't store remote locks itself
6728                  */
6729                 shr->s_access = 0;
6730                 error = 0;
6731                 break;
6732 
6733         default:
6734                 error = EINVAL;
6735                 break;
6736         }
6737 
6738         return (error);
6739 }