1 /*
   2  * CDDL HEADER START
   3  *
   4  * The contents of this file are subject to the terms of the
   5  * Common Development and Distribution License (the "License").
   6  * You may not use this file except in compliance with the License.
   7  *
   8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
   9  * or http://www.opensolaris.org/os/licensing.
  10  * See the License for the specific language governing permissions
  11  * and limitations under the License.
  12  *
  13  * When distributing Covered Code, include this CDDL HEADER in each
  14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
  15  * If applicable, add the following below this CDDL HEADER, with the
  16  * fields enclosed by brackets "[]" replaced with your own identifying
  17  * information: Portions Copyright [yyyy] [name of copyright owner]
  18  *
  19  * CDDL HEADER END
  20  */
  21 
  22 /*
  23  * Copyright 2015 Nexenta Systems, Inc.  All rights reserved.
  24  */
  25 
  26 /*
  27  * Copyright 2010 Sun Microsystems, Inc.  All rights reserved.
  28  * Use is subject to license terms.
  29  */
  30 
  31 /*
  32  *      Copyright 1983,1984,1985,1986,1987,1988,1989 AT&T.
  33  *      All Rights Reserved
  34  */
  35 
  36 /*
  37  * Copyright (c) 2013, Joyent, Inc. All rights reserved.
  38  */
  39 
  40 #include <sys/param.h>
  41 #include <sys/types.h>
  42 #include <sys/systm.h>
  43 #include <sys/cred.h>
  44 #include <sys/time.h>
  45 #include <sys/vnode.h>
  46 #include <sys/vfs.h>
  47 #include <sys/vfs_opreg.h>
  48 #include <sys/file.h>
  49 #include <sys/filio.h>
  50 #include <sys/uio.h>
  51 #include <sys/buf.h>
  52 #include <sys/mman.h>
  53 #include <sys/pathname.h>
  54 #include <sys/dirent.h>
  55 #include <sys/debug.h>
  56 #include <sys/vmsystm.h>
  57 #include <sys/fcntl.h>
  58 #include <sys/flock.h>
  59 #include <sys/swap.h>
  60 #include <sys/errno.h>
  61 #include <sys/strsubr.h>
  62 #include <sys/sysmacros.h>
  63 #include <sys/kmem.h>
  64 #include <sys/cmn_err.h>
  65 #include <sys/pathconf.h>
  66 #include <sys/utsname.h>
  67 #include <sys/dnlc.h>
  68 #include <sys/acl.h>
  69 #include <sys/systeminfo.h>
  70 #include <sys/policy.h>
  71 #include <sys/sdt.h>
  72 #include <sys/list.h>
  73 #include <sys/stat.h>
  74 #include <sys/zone.h>
  75 
  76 #include <rpc/types.h>
  77 #include <rpc/auth.h>
  78 #include <rpc/clnt.h>
  79 
  80 #include <nfs/nfs.h>
  81 #include <nfs/nfs_clnt.h>
  82 #include <nfs/nfs_acl.h>
  83 #include <nfs/lm.h>
  84 #include <nfs/nfs4.h>
  85 #include <nfs/nfs4_kprot.h>
  86 #include <nfs/rnode4.h>
  87 #include <nfs/nfs4_clnt.h>
  88 
  89 #include <vm/hat.h>
  90 #include <vm/as.h>
  91 #include <vm/page.h>
  92 #include <vm/pvn.h>
  93 #include <vm/seg.h>
  94 #include <vm/seg_map.h>
  95 #include <vm/seg_kpm.h>
  96 #include <vm/seg_vn.h>
  97 
  98 #include <fs/fs_subr.h>
  99 
 100 #include <sys/ddi.h>
 101 #include <sys/int_fmtio.h>
 102 #include <sys/fs/autofs.h>
 103 
 104 typedef struct {
 105         nfs4_ga_res_t   *di_garp;
 106         cred_t          *di_cred;
 107         hrtime_t        di_time_call;
 108 } dirattr_info_t;
 109 
 110 typedef enum nfs4_acl_op {
 111         NFS4_ACL_GET,
 112         NFS4_ACL_SET
 113 } nfs4_acl_op_t;
 114 
 115 static struct lm_sysid *nfs4_find_sysid(mntinfo4_t *mi);
 116 
 117 static void     nfs4_update_dircaches(change_info4 *, vnode_t *, vnode_t *,
 118                         char *, dirattr_info_t *);
 119 
 120 static void     nfs4close_otw(rnode4_t *, cred_t *, nfs4_open_owner_t *,
 121                     nfs4_open_stream_t *, int *, int *, nfs4_close_type_t,
 122                     nfs4_error_t *, int *);
 123 static int      nfs4_rdwrlbn(vnode_t *, page_t *, u_offset_t, size_t, int,
 124                         cred_t *);
 125 static int      nfs4write(vnode_t *, caddr_t, u_offset_t, int, cred_t *,
 126                         stable_how4 *);
 127 static int      nfs4read(vnode_t *, caddr_t, offset_t, int, size_t *,
 128                         cred_t *, bool_t, struct uio *);
 129 static int      nfs4setattr(vnode_t *, struct vattr *, int, cred_t *,
 130                         vsecattr_t *);
 131 static int      nfs4openattr(vnode_t *, vnode_t **, int, cred_t *);
 132 static int      nfs4lookup(vnode_t *, char *, vnode_t **, cred_t *, int);
 133 static int      nfs4lookup_xattr(vnode_t *, char *, vnode_t **, int, cred_t *);
 134 static int      nfs4lookupvalidate_otw(vnode_t *, char *, vnode_t **, cred_t *);
 135 static int      nfs4lookupnew_otw(vnode_t *, char *, vnode_t **, cred_t *);
 136 static int      nfs4mknod(vnode_t *, char *, struct vattr *, enum vcexcl,
 137                         int, vnode_t **, cred_t *);
 138 static int      nfs4open_otw(vnode_t *, char *, struct vattr *, vnode_t **,
 139                         cred_t *, int, int, enum createmode4, int);
 140 static int      nfs4rename(vnode_t *, char *, vnode_t *, char *, cred_t *,
 141                         caller_context_t *);
 142 static int      nfs4rename_persistent_fh(vnode_t *, char *, vnode_t *,
 143                         vnode_t *, char *, cred_t *, nfsstat4 *);
 144 static int      nfs4rename_volatile_fh(vnode_t *, char *, vnode_t *,
 145                         vnode_t *, char *, cred_t *, nfsstat4 *);
 146 static int      do_nfs4readdir(vnode_t *, rddir4_cache *, cred_t *);
 147 static void     nfs4readdir(vnode_t *, rddir4_cache *, cred_t *);
 148 static int      nfs4_bio(struct buf *, stable_how4 *, cred_t *, bool_t);
 149 static int      nfs4_getapage(vnode_t *, u_offset_t, size_t, uint_t *,
 150                         page_t *[], size_t, struct seg *, caddr_t,
 151                         enum seg_rw, cred_t *);
 152 static void     nfs4_readahead(vnode_t *, u_offset_t, caddr_t, struct seg *,
 153                         cred_t *);
 154 static int      nfs4_sync_putapage(vnode_t *, page_t *, u_offset_t, size_t,
 155                         int, cred_t *);
 156 static int      nfs4_sync_pageio(vnode_t *, page_t *, u_offset_t, size_t,
 157                         int, cred_t *);
 158 static int      nfs4_commit(vnode_t *, offset4, count4, cred_t *);
 159 static void     nfs4_set_mod(vnode_t *);
 160 static void     nfs4_get_commit(vnode_t *);
 161 static void     nfs4_get_commit_range(vnode_t *, u_offset_t, size_t);
 162 static int      nfs4_putpage_commit(vnode_t *, offset_t, size_t, cred_t *);
 163 static int      nfs4_commit_vp(vnode_t *, u_offset_t, size_t, cred_t *, int);
 164 static int      nfs4_sync_commit(vnode_t *, page_t *, offset3, count3,
 165                         cred_t *);
 166 static void     do_nfs4_async_commit(vnode_t *, page_t *, offset3, count3,
 167                         cred_t *);
 168 static int      nfs4_update_attrcache(nfsstat4, nfs4_ga_res_t *,
 169                         hrtime_t, vnode_t *, cred_t *);
 170 static int      nfs4_open_non_reg_file(vnode_t **, int, cred_t *);
 171 static int      nfs4_safelock(vnode_t *, const struct flock64 *, cred_t *);
 172 static void     nfs4_register_lock_locally(vnode_t *, struct flock64 *, int,
 173                         u_offset_t);
 174 static int      nfs4_lockrelease(vnode_t *, int, offset_t, cred_t *);
 175 static int      nfs4_block_and_wait(clock_t *, rnode4_t *);
 176 static cred_t  *state_to_cred(nfs4_open_stream_t *);
 177 static void     denied_to_flk(LOCK4denied *, flock64_t *, LOCKT4args *);
 178 static pid_t    lo_to_pid(lock_owner4 *);
 179 static void     nfs4_reinstitute_local_lock_state(vnode_t *, flock64_t *,
 180                         cred_t *, nfs4_lock_owner_t *);
 181 static void     push_reinstate(vnode_t *, int, flock64_t *, cred_t *,
 182                         nfs4_lock_owner_t *);
 183 static int      open_and_get_osp(vnode_t *, cred_t *, nfs4_open_stream_t **);
 184 static void     nfs4_delmap_callback(struct as *, void *, uint_t);
 185 static void     nfs4_free_delmapcall(nfs4_delmapcall_t *);
 186 static nfs4_delmapcall_t        *nfs4_init_delmapcall();
 187 static int      nfs4_find_and_delete_delmapcall(rnode4_t *, int *);
 188 static int      nfs4_is_acl_mask_valid(uint_t, nfs4_acl_op_t);
 189 static int      nfs4_create_getsecattr_return(vsecattr_t *, vsecattr_t *,
 190                         uid_t, gid_t, int);
 191 
 192 /*
 193  * Routines that implement the setting of v4 args for the misc. ops
 194  */
 195 static void     nfs4args_lock_free(nfs_argop4 *);
 196 static void     nfs4args_lockt_free(nfs_argop4 *);
 197 static void     nfs4args_setattr(nfs_argop4 *, vattr_t *, vsecattr_t *,
 198                         int, rnode4_t *, cred_t *, bitmap4, int *,
 199                         nfs4_stateid_types_t *);
 200 static void     nfs4args_setattr_free(nfs_argop4 *);
 201 static int      nfs4args_verify(nfs_argop4 *, vattr_t *, enum nfs_opnum4,
 202                         bitmap4);
 203 static void     nfs4args_verify_free(nfs_argop4 *);
 204 static void     nfs4args_write(nfs_argop4 *, stable_how4, rnode4_t *, cred_t *,
 205                         WRITE4args **, nfs4_stateid_types_t *);
 206 
 207 /*
 208  * These are the vnode ops functions that implement the vnode interface to
 209  * the networked file system.  See more comments below at nfs4_vnodeops.
 210  */
 211 static int      nfs4_open(vnode_t **, int, cred_t *, caller_context_t *);
 212 static int      nfs4_close(vnode_t *, int, int, offset_t, cred_t *,
 213                         caller_context_t *);
 214 static int      nfs4_read(vnode_t *, struct uio *, int, cred_t *,
 215                         caller_context_t *);
 216 static int      nfs4_write(vnode_t *, struct uio *, int, cred_t *,
 217                         caller_context_t *);
 218 static int      nfs4_ioctl(vnode_t *, int, intptr_t, int, cred_t *, int *,
 219                         caller_context_t *);
 220 static int      nfs4_setattr(vnode_t *, struct vattr *, int, cred_t *,
 221                         caller_context_t *);
 222 static int      nfs4_access(vnode_t *, int, int, cred_t *, caller_context_t *);
 223 static int      nfs4_readlink(vnode_t *, struct uio *, cred_t *,
 224                         caller_context_t *);
 225 static int      nfs4_fsync(vnode_t *, int, cred_t *, caller_context_t *);
 226 static int      nfs4_create(vnode_t *, char *, struct vattr *, enum vcexcl,
 227                         int, vnode_t **, cred_t *, int, caller_context_t *,
 228                         vsecattr_t *);
 229 static int      nfs4_remove(vnode_t *, char *, cred_t *, caller_context_t *,
 230                         int);
 231 static int      nfs4_link(vnode_t *, vnode_t *, char *, cred_t *,
 232                         caller_context_t *, int);
 233 static int      nfs4_rename(vnode_t *, char *, vnode_t *, char *, cred_t *,
 234                         caller_context_t *, int);
 235 static int      nfs4_mkdir(vnode_t *, char *, struct vattr *, vnode_t **,
 236                         cred_t *, caller_context_t *, int, vsecattr_t *);
 237 static int      nfs4_rmdir(vnode_t *, char *, vnode_t *, cred_t *,
 238                         caller_context_t *, int);
 239 static int      nfs4_symlink(vnode_t *, char *, struct vattr *, char *,
 240                         cred_t *, caller_context_t *, int);
 241 static int      nfs4_readdir(vnode_t *, struct uio *, cred_t *, int *,
 242                         caller_context_t *, int);
 243 static int      nfs4_seek(vnode_t *, offset_t, offset_t *, caller_context_t *);
 244 static int      nfs4_getpage(vnode_t *, offset_t, size_t, uint_t *,
 245                         page_t *[], size_t, struct seg *, caddr_t,
 246                         enum seg_rw, cred_t *, caller_context_t *);
 247 static int      nfs4_putpage(vnode_t *, offset_t, size_t, int, cred_t *,
 248                         caller_context_t *);
 249 static int      nfs4_map(vnode_t *, offset_t, struct as *, caddr_t *, size_t,
 250                         uchar_t, uchar_t, uint_t, cred_t *, caller_context_t *);
 251 static int      nfs4_addmap(vnode_t *, offset_t, struct as *, caddr_t, size_t,
 252                         uchar_t, uchar_t, uint_t, cred_t *, caller_context_t *);
 253 static int      nfs4_cmp(vnode_t *, vnode_t *, caller_context_t *);
 254 static int      nfs4_frlock(vnode_t *, int, struct flock64 *, int, offset_t,
 255                         struct flk_callback *, cred_t *, caller_context_t *);
 256 static int      nfs4_space(vnode_t *, int, struct flock64 *, int, offset_t,
 257                         cred_t *, caller_context_t *);
 258 static int      nfs4_delmap(vnode_t *, offset_t, struct as *, caddr_t, size_t,
 259                         uint_t, uint_t, uint_t, cred_t *, caller_context_t *);
 260 static int      nfs4_pageio(vnode_t *, page_t *, u_offset_t, size_t, int,
 261                         cred_t *, caller_context_t *);
 262 static void     nfs4_dispose(vnode_t *, page_t *, int, int, cred_t *,
 263                         caller_context_t *);
 264 static int      nfs4_setsecattr(vnode_t *, vsecattr_t *, int, cred_t *,
 265                         caller_context_t *);
 266 /*
 267  * These vnode ops are required to be called from outside this source file,
 268  * e.g. by ephemeral mount stub vnode ops, and so may not be declared
 269  * as static.
 270  */
 271 int     nfs4_getattr(vnode_t *, struct vattr *, int, cred_t *,
 272             caller_context_t *);
 273 void    nfs4_inactive(vnode_t *, cred_t *, caller_context_t *);
 274 int     nfs4_lookup(vnode_t *, char *, vnode_t **,
 275             struct pathname *, int, vnode_t *, cred_t *,
 276             caller_context_t *, int *, pathname_t *);
 277 int     nfs4_fid(vnode_t *, fid_t *, caller_context_t *);
 278 int     nfs4_rwlock(vnode_t *, int, caller_context_t *);
 279 void    nfs4_rwunlock(vnode_t *, int, caller_context_t *);
 280 int     nfs4_realvp(vnode_t *, vnode_t **, caller_context_t *);
 281 int     nfs4_pathconf(vnode_t *, int, ulong_t *, cred_t *,
 282             caller_context_t *);
 283 int     nfs4_getsecattr(vnode_t *, vsecattr_t *, int, cred_t *,
 284             caller_context_t *);
 285 int     nfs4_shrlock(vnode_t *, int, struct shrlock *, int, cred_t *,
 286             caller_context_t *);
 287 
 288 /*
 289  * Used for nfs4_commit_vp() to indicate if we should
 290  * wait on pending writes.
 291  */
 292 #define NFS4_WRITE_NOWAIT       0
 293 #define NFS4_WRITE_WAIT         1
 294 
 295 #define NFS4_BASE_WAIT_TIME 1   /* 1 second */
 296 
 297 /*
 298  * Error flags used to pass information about certain special errors
 299  * which need to be handled specially.
 300  */
 301 #define NFS_EOF                 -98
 302 #define NFS_VERF_MISMATCH       -97
 303 
 304 /*
 305  * Flags used to differentiate between which operation drove the
 306  * potential CLOSE OTW. (see nfs4_close_otw_if_necessary)
 307  */
 308 #define NFS4_CLOSE_OP           0x1
 309 #define NFS4_DELMAP_OP          0x2
 310 #define NFS4_INACTIVE_OP        0x3
 311 
 312 #define ISVDEV(t) ((t == VBLK) || (t == VCHR) || (t == VFIFO))
 313 
 314 /* ALIGN64 aligns the given buffer and adjust buffer size to 64 bit */
 315 #define ALIGN64(x, ptr, sz)                                             \
 316         x = ((uintptr_t)(ptr)) & (sizeof (uint64_t) - 1);           \
 317         if (x) {                                                        \
 318                 x = sizeof (uint64_t) - (x);                            \
 319                 sz -= (x);                                              \
 320                 ptr += (x);                                             \
 321         }
 322 
 323 #ifdef DEBUG
 324 int nfs4_client_attr_debug = 0;
 325 int nfs4_client_state_debug = 0;
 326 int nfs4_client_shadow_debug = 0;
 327 int nfs4_client_lock_debug = 0;
 328 int nfs4_seqid_sync = 0;
 329 int nfs4_client_map_debug = 0;
 330 static int nfs4_pageio_debug = 0;
 331 int nfs4_client_inactive_debug = 0;
 332 int nfs4_client_recov_debug = 0;
 333 int nfs4_client_failover_debug = 0;
 334 int nfs4_client_call_debug = 0;
 335 int nfs4_client_lookup_debug = 0;
 336 int nfs4_client_zone_debug = 0;
 337 int nfs4_lost_rqst_debug = 0;
 338 int nfs4_rdattrerr_debug = 0;
 339 int nfs4_open_stream_debug = 0;
 340 
 341 int nfs4read_error_inject;
 342 
 343 static int nfs4_create_misses = 0;
 344 
 345 static int nfs4_readdir_cache_shorts = 0;
 346 static int nfs4_readdir_readahead = 0;
 347 
 348 static int nfs4_bio_do_stop = 0;
 349 
 350 static int nfs4_lostpage = 0;   /* number of times we lost original page */
 351 
 352 int nfs4_mmap_debug = 0;
 353 
 354 static int nfs4_pathconf_cache_hits = 0;
 355 static int nfs4_pathconf_cache_misses = 0;
 356 
 357 int nfs4close_all_cnt;
 358 int nfs4close_one_debug = 0;
 359 int nfs4close_notw_debug = 0;
 360 
 361 int denied_to_flk_debug = 0;
 362 void *lockt_denied_debug;
 363 
 364 #endif
 365 
 366 /*
 367  * How long to wait before trying again if OPEN_CONFIRM gets ETIMEDOUT
 368  * or NFS4ERR_RESOURCE.
 369  */
 370 static int confirm_retry_sec = 30;
 371 
 372 static int nfs4_lookup_neg_cache = 1;
 373 
 374 /*
 375  * number of pages to read ahead
 376  * optimized for 100 base-T.
 377  */
 378 static int nfs4_nra = 4;
 379 
 380 static int nfs4_do_symlink_cache = 1;
 381 
 382 static int nfs4_pathconf_disable_cache = 0;
 383 
 384 /*
 385  * These are the vnode ops routines which implement the vnode interface to
 386  * the networked file system.  These routines just take their parameters,
 387  * make them look networkish by putting the right info into interface structs,
 388  * and then calling the appropriate remote routine(s) to do the work.
 389  *
 390  * Note on directory name lookup cacheing:  If we detect a stale fhandle,
 391  * we purge the directory cache relative to that vnode.  This way, the
 392  * user won't get burned by the cache repeatedly.  See <nfs/rnode4.h> for
 393  * more details on rnode locking.
 394  */
 395 
 396 struct vnodeops *nfs4_vnodeops;
 397 
 398 const fs_operation_def_t nfs4_vnodeops_template[] = {
 399         { VOPNAME_OPEN,         { .vop_open = nfs4_open } },
 400         { VOPNAME_CLOSE,        { .vop_close = nfs4_close } },
 401         { VOPNAME_READ,         { .vop_read = nfs4_read } },
 402         { VOPNAME_WRITE,        { .vop_write = nfs4_write } },
 403         { VOPNAME_IOCTL,        { .vop_ioctl = nfs4_ioctl } },
 404         { VOPNAME_GETATTR,      { .vop_getattr = nfs4_getattr } },
 405         { VOPNAME_SETATTR,      { .vop_setattr = nfs4_setattr } },
 406         { VOPNAME_ACCESS,       { .vop_access = nfs4_access } },
 407         { VOPNAME_LOOKUP,       { .vop_lookup = nfs4_lookup } },
 408         { VOPNAME_CREATE,       { .vop_create = nfs4_create } },
 409         { VOPNAME_REMOVE,       { .vop_remove = nfs4_remove } },
 410         { VOPNAME_LINK,         { .vop_link = nfs4_link } },
 411         { VOPNAME_RENAME,       { .vop_rename = nfs4_rename } },
 412         { VOPNAME_MKDIR,        { .vop_mkdir = nfs4_mkdir } },
 413         { VOPNAME_RMDIR,        { .vop_rmdir = nfs4_rmdir } },
 414         { VOPNAME_READDIR,      { .vop_readdir = nfs4_readdir } },
 415         { VOPNAME_SYMLINK,      { .vop_symlink = nfs4_symlink } },
 416         { VOPNAME_READLINK,     { .vop_readlink = nfs4_readlink } },
 417         { VOPNAME_FSYNC,        { .vop_fsync = nfs4_fsync } },
 418         { VOPNAME_INACTIVE,     { .vop_inactive = nfs4_inactive } },
 419         { VOPNAME_FID,          { .vop_fid = nfs4_fid } },
 420         { VOPNAME_RWLOCK,       { .vop_rwlock = nfs4_rwlock } },
 421         { VOPNAME_RWUNLOCK,     { .vop_rwunlock = nfs4_rwunlock } },
 422         { VOPNAME_SEEK,         { .vop_seek = nfs4_seek } },
 423         { VOPNAME_FRLOCK,       { .vop_frlock = nfs4_frlock } },
 424         { VOPNAME_SPACE,        { .vop_space = nfs4_space } },
 425         { VOPNAME_REALVP,       { .vop_realvp = nfs4_realvp } },
 426         { VOPNAME_GETPAGE,      { .vop_getpage = nfs4_getpage } },
 427         { VOPNAME_PUTPAGE,      { .vop_putpage = nfs4_putpage } },
 428         { VOPNAME_MAP,          { .vop_map = nfs4_map } },
 429         { VOPNAME_ADDMAP,       { .vop_addmap = nfs4_addmap } },
 430         { VOPNAME_DELMAP,       { .vop_delmap = nfs4_delmap } },
 431         /* no separate nfs4_dump */
 432         { VOPNAME_DUMP,         { .vop_dump = nfs_dump } },
 433         { VOPNAME_PATHCONF,     { .vop_pathconf = nfs4_pathconf } },
 434         { VOPNAME_PAGEIO,       { .vop_pageio = nfs4_pageio } },
 435         { VOPNAME_DISPOSE,      { .vop_dispose = nfs4_dispose } },
 436         { VOPNAME_SETSECATTR,   { .vop_setsecattr = nfs4_setsecattr } },
 437         { VOPNAME_GETSECATTR,   { .vop_getsecattr = nfs4_getsecattr } },
 438         { VOPNAME_SHRLOCK,      { .vop_shrlock = nfs4_shrlock } },
 439         { VOPNAME_VNEVENT,      { .vop_vnevent = fs_vnevent_support } },
 440         { NULL,                 { NULL } }
 441 };
 442 
 443 /*
 444  * The following are subroutines and definitions to set args or get res
 445  * for the different nfsv4 ops
 446  */
 447 
 448 void
 449 nfs4args_lookup_free(nfs_argop4 *argop, int arglen)
 450 {
 451         int             i;
 452 
 453         for (i = 0; i < arglen; i++) {
 454                 if (argop[i].argop == OP_LOOKUP) {
 455                         kmem_free(
 456                             argop[i].nfs_argop4_u.oplookup.
 457                             objname.utf8string_val,
 458                             argop[i].nfs_argop4_u.oplookup.
 459                             objname.utf8string_len);
 460                 }
 461         }
 462 }
 463 
 464 static void
 465 nfs4args_lock_free(nfs_argop4 *argop)
 466 {
 467         locker4 *locker = &argop->nfs_argop4_u.oplock.locker;
 468 
 469         if (locker->new_lock_owner == TRUE) {
 470                 open_to_lock_owner4 *open_owner;
 471 
 472                 open_owner = &locker->locker4_u.open_owner;
 473                 if (open_owner->lock_owner.owner_val != NULL) {
 474                         kmem_free(open_owner->lock_owner.owner_val,
 475                             open_owner->lock_owner.owner_len);
 476                 }
 477         }
 478 }
 479 
 480 static void
 481 nfs4args_lockt_free(nfs_argop4 *argop)
 482 {
 483         lock_owner4 *lowner = &argop->nfs_argop4_u.oplockt.owner;
 484 
 485         if (lowner->owner_val != NULL) {
 486                 kmem_free(lowner->owner_val, lowner->owner_len);
 487         }
 488 }
 489 
 490 static void
 491 nfs4args_setattr(nfs_argop4 *argop, vattr_t *vap, vsecattr_t *vsap, int flags,
 492     rnode4_t *rp, cred_t *cr, bitmap4 supp, int *error,
 493     nfs4_stateid_types_t *sid_types)
 494 {
 495         fattr4          *attr = &argop->nfs_argop4_u.opsetattr.obj_attributes;
 496         mntinfo4_t      *mi;
 497 
 498         argop->argop = OP_SETATTR;
 499         /*
 500          * The stateid is set to 0 if client is not modifying the size
 501          * and otherwise to whatever nfs4_get_stateid() returns.
 502          *
 503          * XXX Note: nfs4_get_stateid() returns 0 if no lockowner and/or no
 504          * state struct could be found for the process/file pair.  We may
 505          * want to change this in the future (by OPENing the file).  See
 506          * bug # 4474852.
 507          */
 508         if (vap->va_mask & AT_SIZE) {
 509 
 510                 ASSERT(rp != NULL);
 511                 mi = VTOMI4(RTOV4(rp));
 512 
 513                 argop->nfs_argop4_u.opsetattr.stateid =
 514                     nfs4_get_stateid(cr, rp, curproc->p_pidp->pid_id, mi,
 515                     OP_SETATTR, sid_types, FALSE);
 516         } else {
 517                 bzero(&argop->nfs_argop4_u.opsetattr.stateid,
 518                     sizeof (stateid4));
 519         }
 520 
 521         *error = vattr_to_fattr4(vap, vsap, attr, flags, OP_SETATTR, supp);
 522         if (*error)
 523                 bzero(attr, sizeof (*attr));
 524 }
 525 
 526 static void
 527 nfs4args_setattr_free(nfs_argop4 *argop)
 528 {
 529         nfs4_fattr4_free(&argop->nfs_argop4_u.opsetattr.obj_attributes);
 530 }
 531 
 532 static int
 533 nfs4args_verify(nfs_argop4 *argop, vattr_t *vap, enum nfs_opnum4 op,
 534     bitmap4 supp)
 535 {
 536         fattr4 *attr;
 537         int error = 0;
 538 
 539         argop->argop = op;
 540         switch (op) {
 541         case OP_VERIFY:
 542                 attr = &argop->nfs_argop4_u.opverify.obj_attributes;
 543                 break;
 544         case OP_NVERIFY:
 545                 attr = &argop->nfs_argop4_u.opnverify.obj_attributes;
 546                 break;
 547         default:
 548                 return (EINVAL);
 549         }
 550         if (!error)
 551                 error = vattr_to_fattr4(vap, NULL, attr, 0, op, supp);
 552         if (error)
 553                 bzero(attr, sizeof (*attr));
 554         return (error);
 555 }
 556 
 557 static void
 558 nfs4args_verify_free(nfs_argop4 *argop)
 559 {
 560         switch (argop->argop) {
 561         case OP_VERIFY:
 562                 nfs4_fattr4_free(&argop->nfs_argop4_u.opverify.obj_attributes);
 563                 break;
 564         case OP_NVERIFY:
 565                 nfs4_fattr4_free(&argop->nfs_argop4_u.opnverify.obj_attributes);
 566                 break;
 567         default:
 568                 break;
 569         }
 570 }
 571 
 572 static void
 573 nfs4args_write(nfs_argop4 *argop, stable_how4 stable, rnode4_t *rp, cred_t *cr,
 574     WRITE4args **wargs_pp, nfs4_stateid_types_t *sid_tp)
 575 {
 576         WRITE4args *wargs = &argop->nfs_argop4_u.opwrite;
 577         mntinfo4_t *mi = VTOMI4(RTOV4(rp));
 578 
 579         argop->argop = OP_WRITE;
 580         wargs->stable = stable;
 581         wargs->stateid = nfs4_get_w_stateid(cr, rp, curproc->p_pidp->pid_id,
 582             mi, OP_WRITE, sid_tp);
 583         wargs->mblk = NULL;
 584         *wargs_pp = wargs;
 585 }
 586 
 587 void
 588 nfs4args_copen_free(OPEN4cargs *open_args)
 589 {
 590         if (open_args->owner.owner_val) {
 591                 kmem_free(open_args->owner.owner_val,
 592                     open_args->owner.owner_len);
 593         }
 594         if ((open_args->opentype == OPEN4_CREATE) &&
 595             (open_args->mode != EXCLUSIVE4)) {
 596                 nfs4_fattr4_free(&open_args->createhow4_u.createattrs);
 597         }
 598 }
 599 
 600 /*
 601  * XXX:  This is referenced in modstubs.s
 602  */
 603 struct vnodeops *
 604 nfs4_getvnodeops(void)
 605 {
 606         return (nfs4_vnodeops);
 607 }
 608 
 609 /*
 610  * The OPEN operation opens a regular file.
 611  */
 612 /*ARGSUSED3*/
 613 static int
 614 nfs4_open(vnode_t **vpp, int flag, cred_t *cr, caller_context_t *ct)
 615 {
 616         vnode_t *dvp = NULL;
 617         rnode4_t *rp, *drp;
 618         int error;
 619         int just_been_created;
 620         char fn[MAXNAMELEN];
 621 
 622         NFS4_DEBUG(nfs4_client_state_debug, (CE_NOTE, "nfs4_open: "));
 623         if (nfs_zone() != VTOMI4(*vpp)->mi_zone)
 624                 return (EIO);
 625         rp = VTOR4(*vpp);
 626 
 627         /*
 628          * Check to see if opening something besides a regular file;
 629          * if so skip the OTW call
 630          */
 631         if ((*vpp)->v_type != VREG) {
 632                 error = nfs4_open_non_reg_file(vpp, flag, cr);
 633                 return (error);
 634         }
 635 
 636         /*
 637          * XXX - would like a check right here to know if the file is
 638          * executable or not, so as to skip OTW
 639          */
 640 
 641         if ((error = vtodv(*vpp, &dvp, cr, TRUE)) != 0)
 642                 return (error);
 643 
 644         drp = VTOR4(dvp);
 645         if (nfs_rw_enter_sig(&drp->r_rwlock, RW_READER, INTR4(dvp)))
 646                 return (EINTR);
 647 
 648         if ((error = vtoname(*vpp, fn, MAXNAMELEN)) != 0) {
 649                 nfs_rw_exit(&drp->r_rwlock);
 650                 return (error);
 651         }
 652 
 653         /*
 654          * See if this file has just been CREATEd.
 655          * If so, clear the flag and update the dnlc, which was previously
 656          * skipped in nfs4_create.
 657          * XXX need better serilization on this.
 658          * XXX move this into the nf4open_otw call, after we have
 659          * XXX acquired the open owner seqid sync.
 660          */
 661         mutex_enter(&rp->r_statev4_lock);
 662         if (rp->created_v4) {
 663                 rp->created_v4 = 0;
 664                 mutex_exit(&rp->r_statev4_lock);
 665 
 666                 dnlc_update(dvp, fn, *vpp);
 667                 /* This is needed so we don't bump the open ref count */
 668                 just_been_created = 1;
 669         } else {
 670                 mutex_exit(&rp->r_statev4_lock);
 671                 just_been_created = 0;
 672         }
 673 
 674         /*
 675          * If caller specified O_TRUNC/FTRUNC, then be sure to set
 676          * FWRITE (to drive successful setattr(size=0) after open)
 677          */
 678         if (flag & FTRUNC)
 679                 flag |= FWRITE;
 680 
 681         error = nfs4open_otw(dvp, fn, NULL, vpp, cr, 0, flag, 0,
 682             just_been_created);
 683 
 684         if (!error && !((*vpp)->v_flag & VROOT))
 685                 dnlc_update(dvp, fn, *vpp);
 686 
 687         nfs_rw_exit(&drp->r_rwlock);
 688 
 689         /* release the hold from vtodv */
 690         VN_RELE(dvp);
 691 
 692         /* exchange the shadow for the master vnode, if needed */
 693 
 694         if (error == 0 && IS_SHADOW(*vpp, rp))
 695                 sv_exchange(vpp);
 696 
 697         return (error);
 698 }
 699 
 700 /*
 701  * See if there's a "lost open" request to be saved and recovered.
 702  */
 703 static void
 704 nfs4open_save_lost_rqst(int error, nfs4_lost_rqst_t *lost_rqstp,
 705     nfs4_open_owner_t *oop, cred_t *cr, vnode_t *vp,
 706     vnode_t *dvp, OPEN4cargs *open_args)
 707 {
 708         vfs_t *vfsp;
 709         char *srccfp;
 710 
 711         vfsp = (dvp ? dvp->v_vfsp : vp->v_vfsp);
 712 
 713         if (error != ETIMEDOUT && error != EINTR &&
 714             !NFS4_FRC_UNMT_ERR(error, vfsp)) {
 715                 lost_rqstp->lr_op = 0;
 716                 return;
 717         }
 718 
 719         NFS4_DEBUG(nfs4_lost_rqst_debug, (CE_NOTE,
 720             "nfs4open_save_lost_rqst: error %d", error));
 721 
 722         lost_rqstp->lr_op = OP_OPEN;
 723 
 724         /*
 725          * The vp (if it is not NULL) and dvp are held and rele'd via
 726          * the recovery code.  See nfs4_save_lost_rqst.
 727          */
 728         lost_rqstp->lr_vp = vp;
 729         lost_rqstp->lr_dvp = dvp;
 730         lost_rqstp->lr_oop = oop;
 731         lost_rqstp->lr_osp = NULL;
 732         lost_rqstp->lr_lop = NULL;
 733         lost_rqstp->lr_cr = cr;
 734         lost_rqstp->lr_flk = NULL;
 735         lost_rqstp->lr_oacc = open_args->share_access;
 736         lost_rqstp->lr_odeny = open_args->share_deny;
 737         lost_rqstp->lr_oclaim = open_args->claim;
 738         if (open_args->claim == CLAIM_DELEGATE_CUR) {
 739                 lost_rqstp->lr_ostateid =
 740                     open_args->open_claim4_u.delegate_cur_info.delegate_stateid;
 741                 srccfp = open_args->open_claim4_u.delegate_cur_info.cfile;
 742         } else {
 743                 srccfp = open_args->open_claim4_u.cfile;
 744         }
 745         lost_rqstp->lr_ofile.utf8string_len = 0;
 746         lost_rqstp->lr_ofile.utf8string_val = NULL;
 747         (void) str_to_utf8(srccfp, &lost_rqstp->lr_ofile);
 748         lost_rqstp->lr_putfirst = FALSE;
 749 }
 750 
 751 struct nfs4_excl_time {
 752         uint32 seconds;
 753         uint32 nseconds;
 754 };
 755 
 756 /*
 757  * The OPEN operation creates and/or opens a regular file
 758  *
 759  * ARGSUSED
 760  */
 761 static int
 762 nfs4open_otw(vnode_t *dvp, char *file_name, struct vattr *in_va,
 763     vnode_t **vpp, cred_t *cr, int create_flag, int open_flag,
 764     enum createmode4 createmode, int file_just_been_created)
 765 {
 766         rnode4_t *rp;
 767         rnode4_t *drp = VTOR4(dvp);
 768         vnode_t *vp = NULL;
 769         vnode_t *vpi = *vpp;
 770         bool_t needrecov = FALSE;
 771 
 772         int doqueue = 1;
 773 
 774         COMPOUND4args_clnt args;
 775         COMPOUND4res_clnt res;
 776         nfs_argop4 *argop;
 777         nfs_resop4 *resop;
 778         int argoplist_size;
 779         int idx_open, idx_fattr;
 780 
 781         GETFH4res *gf_res = NULL;
 782         OPEN4res *op_res = NULL;
 783         nfs4_ga_res_t *garp;
 784         fattr4 *attr = NULL;
 785         struct nfs4_excl_time verf;
 786         bool_t did_excl_setup = FALSE;
 787         int created_osp;
 788 
 789         OPEN4cargs *open_args;
 790         nfs4_open_owner_t       *oop = NULL;
 791         nfs4_open_stream_t      *osp = NULL;
 792         seqid4 seqid = 0;
 793         bool_t retry_open = FALSE;
 794         nfs4_recov_state_t recov_state;
 795         nfs4_lost_rqst_t lost_rqst;
 796         nfs4_error_t e = { 0, NFS4_OK, RPC_SUCCESS };
 797         hrtime_t t;
 798         int acc = 0;
 799         cred_t *cred_otw = NULL;        /* cred used to do the RPC call */
 800         cred_t *ncr = NULL;
 801 
 802         nfs4_sharedfh_t *otw_sfh;
 803         nfs4_sharedfh_t *orig_sfh;
 804         int fh_differs = 0;
 805         int numops, setgid_flag;
 806         int num_bseqid_retry = NFS4_NUM_RETRY_BAD_SEQID + 1;
 807 
 808         /*
 809          * Make sure we properly deal with setting the right gid on
 810          * a newly created file to reflect the parent's setgid bit
 811          */
 812         setgid_flag = 0;
 813         if (create_flag && in_va) {
 814 
 815                 /*
 816                  * If there is grpid mount flag used or
 817                  * the parent's directory has the setgid bit set
 818                  * _and_ the client was able to get a valid mapping
 819                  * for the parent dir's owner_group, we want to
 820                  * append NVERIFY(owner_group == dva.va_gid) and
 821                  * SETATTR to the CREATE compound.
 822                  */
 823                 mutex_enter(&drp->r_statelock);
 824                 if ((VTOMI4(dvp)->mi_flags & MI4_GRPID ||
 825                     drp->r_attr.va_mode & VSGID) &&
 826                     drp->r_attr.va_gid != GID_NOBODY) {
 827                         in_va->va_mask |= AT_GID;
 828                         in_va->va_gid = drp->r_attr.va_gid;
 829                         setgid_flag = 1;
 830                 }
 831                 mutex_exit(&drp->r_statelock);
 832         }
 833 
 834         /*
 835          * Normal/non-create compound:
 836          * PUTFH(dfh) + OPEN(create) + GETFH + GETATTR(new)
 837          *
 838          * Open(create) compound no setgid:
 839          * PUTFH(dfh) + SAVEFH + OPEN(create) + GETFH + GETATTR(new) +
 840          * RESTOREFH + GETATTR
 841          *
 842          * Open(create) setgid:
 843          * PUTFH(dfh) + OPEN(create) + GETFH + GETATTR(new) +
 844          * SAVEFH + PUTFH(dfh) + GETATTR(dvp) + RESTOREFH +
 845          * NVERIFY(grp) + SETATTR
 846          */
 847         if (setgid_flag) {
 848                 numops = 10;
 849                 idx_open = 1;
 850                 idx_fattr = 3;
 851         } else if (create_flag) {
 852                 numops = 7;
 853                 idx_open = 2;
 854                 idx_fattr = 4;
 855         } else {
 856                 numops = 4;
 857                 idx_open = 1;
 858                 idx_fattr = 3;
 859         }
 860 
 861         args.array_len = numops;
 862         argoplist_size = numops * sizeof (nfs_argop4);
 863         argop = kmem_alloc(argoplist_size, KM_SLEEP);
 864 
 865         NFS4_DEBUG(nfs4_client_state_debug, (CE_NOTE, "nfs4open_otw: "
 866             "open %s open flag 0x%x cred %p", file_name, open_flag,
 867             (void *)cr));
 868 
 869         ASSERT(nfs_zone() == VTOMI4(dvp)->mi_zone);
 870         if (create_flag) {
 871                 /*
 872                  * We are to create a file.  Initialize the passed in vnode
 873                  * pointer.
 874                  */
 875                 vpi = NULL;
 876         } else {
 877                 /*
 878                  * Check to see if the client owns a read delegation and is
 879                  * trying to open for write.  If so, then return the delegation
 880                  * to avoid the server doing a cb_recall and returning DELAY.
 881                  * NB - we don't use the statev4_lock here because we'd have
 882                  * to drop the lock anyway and the result would be stale.
 883                  */
 884                 if ((open_flag & FWRITE) &&
 885                     VTOR4(vpi)->r_deleg_type == OPEN_DELEGATE_READ)
 886                         (void) nfs4delegreturn(VTOR4(vpi), NFS4_DR_REOPEN);
 887 
 888                 /*
 889                  * If the file has a delegation, then do an access check up
 890                  * front.  This avoids having to an access check later after
 891                  * we've already done start_op, which could deadlock.
 892                  */
 893                 if (VTOR4(vpi)->r_deleg_type != OPEN_DELEGATE_NONE) {
 894                         if (open_flag & FREAD &&
 895                             nfs4_access(vpi, VREAD, 0, cr, NULL) == 0)
 896                                 acc |= VREAD;
 897                         if (open_flag & FWRITE &&
 898                             nfs4_access(vpi, VWRITE, 0, cr, NULL) == 0)
 899                                 acc |= VWRITE;
 900                 }
 901         }
 902 
 903         drp = VTOR4(dvp);
 904 
 905         recov_state.rs_flags = 0;
 906         recov_state.rs_num_retry_despite_err = 0;
 907         cred_otw = cr;
 908 
 909 recov_retry:
 910         fh_differs = 0;
 911         nfs4_error_zinit(&e);
 912 
 913         e.error = nfs4_start_op(VTOMI4(dvp), dvp, vpi, &recov_state);
 914         if (e.error) {
 915                 if (ncr != NULL)
 916                         crfree(ncr);
 917                 kmem_free(argop, argoplist_size);
 918                 return (e.error);
 919         }
 920 
 921         args.ctag = TAG_OPEN;
 922         args.array_len = numops;
 923         args.array = argop;
 924 
 925         /* putfh directory fh */
 926         argop[0].argop = OP_CPUTFH;
 927         argop[0].nfs_argop4_u.opcputfh.sfh = drp->r_fh;
 928 
 929         /* OPEN: either op 1 or op 2 depending upon create/setgid flags */
 930         argop[idx_open].argop = OP_COPEN;
 931         open_args = &argop[idx_open].nfs_argop4_u.opcopen;
 932         open_args->claim = CLAIM_NULL;
 933 
 934         /* name of file */
 935         open_args->open_claim4_u.cfile = file_name;
 936         open_args->owner.owner_len = 0;
 937         open_args->owner.owner_val = NULL;
 938 
 939         if (create_flag) {
 940                 /* CREATE a file */
 941                 open_args->opentype = OPEN4_CREATE;
 942                 open_args->mode = createmode;
 943                 if (createmode == EXCLUSIVE4) {
 944                         if (did_excl_setup == FALSE) {
 945                                 verf.seconds = zone_get_hostid(NULL);
 946                                 if (verf.seconds != 0)
 947                                         verf.nseconds = newnum();
 948                                 else {
 949                                         timestruc_t now;
 950 
 951                                         gethrestime(&now);
 952                                         verf.seconds = now.tv_sec;
 953                                         verf.nseconds = now.tv_nsec;
 954                                 }
 955                                 /*
 956                                  * Since the server will use this value for the
 957                                  * mtime, make sure that it can't overflow. Zero
 958                                  * out the MSB. The actual value does not matter
 959                                  * here, only its uniqeness.
 960                                  */
 961                                 verf.seconds &= INT32_MAX;
 962                                 did_excl_setup = TRUE;
 963                         }
 964 
 965                         /* Now copy over verifier to OPEN4args. */
 966                         open_args->createhow4_u.createverf = *(uint64_t *)&verf;
 967                 } else {
 968                         int v_error;
 969                         bitmap4 supp_attrs;
 970                         servinfo4_t *svp;
 971 
 972                         attr = &open_args->createhow4_u.createattrs;
 973 
 974                         svp = drp->r_server;
 975                         (void) nfs_rw_enter_sig(&svp->sv_lock, RW_READER, 0);
 976                         supp_attrs = svp->sv_supp_attrs;
 977                         nfs_rw_exit(&svp->sv_lock);
 978 
 979                         /* GUARDED4 or UNCHECKED4 */
 980                         v_error = vattr_to_fattr4(in_va, NULL, attr, 0, OP_OPEN,
 981                             supp_attrs);
 982                         if (v_error) {
 983                                 bzero(attr, sizeof (*attr));
 984                                 nfs4args_copen_free(open_args);
 985                                 nfs4_end_op(VTOMI4(dvp), dvp, vpi,
 986                                     &recov_state, FALSE);
 987                                 if (ncr != NULL)
 988                                         crfree(ncr);
 989                                 kmem_free(argop, argoplist_size);
 990                                 return (v_error);
 991                         }
 992                 }
 993         } else {
 994                 /* NO CREATE */
 995                 open_args->opentype = OPEN4_NOCREATE;
 996         }
 997 
 998         if (recov_state.rs_sp != NULL) {
 999                 mutex_enter(&recov_state.rs_sp->s_lock);
1000                 open_args->owner.clientid = recov_state.rs_sp->clientid;
1001                 mutex_exit(&recov_state.rs_sp->s_lock);
1002         } else {
1003                 /* XXX should we just fail here? */
1004                 open_args->owner.clientid = 0;
1005         }
1006 
1007         /*
1008          * This increments oop's ref count or creates a temporary 'just_created'
1009          * open owner that will become valid when this OPEN/OPEN_CONFIRM call
1010          * completes.
1011          */
1012         mutex_enter(&VTOMI4(dvp)->mi_lock);
1013 
1014         /* See if a permanent or just created open owner exists */
1015         oop = find_open_owner_nolock(cr, NFS4_JUST_CREATED, VTOMI4(dvp));
1016         if (!oop) {
1017                 /*
1018                  * This open owner does not exist so create a temporary
1019                  * just created one.
1020                  */
1021                 oop = create_open_owner(cr, VTOMI4(dvp));
1022                 ASSERT(oop != NULL);
1023         }
1024         mutex_exit(&VTOMI4(dvp)->mi_lock);
1025 
1026         /* this length never changes, do alloc before seqid sync */
1027         open_args->owner.owner_len = sizeof (oop->oo_name);
1028         open_args->owner.owner_val =
1029             kmem_alloc(open_args->owner.owner_len, KM_SLEEP);
1030 
1031         e.error = nfs4_start_open_seqid_sync(oop, VTOMI4(dvp));
1032         if (e.error == EAGAIN) {
1033                 open_owner_rele(oop);
1034                 nfs4args_copen_free(open_args);
1035                 nfs4_end_op(VTOMI4(dvp), dvp, vpi, &recov_state, TRUE);
1036                 if (ncr != NULL) {
1037                         crfree(ncr);
1038                         ncr = NULL;
1039                 }
1040                 goto recov_retry;
1041         }
1042 
1043         /* Check to see if we need to do the OTW call */
1044         if (!create_flag) {
1045                 if (!nfs4_is_otw_open_necessary(oop, open_flag, vpi,
1046                     file_just_been_created, &e.error, acc, &recov_state)) {
1047 
1048                         /*
1049                          * The OTW open is not necessary.  Either
1050                          * the open can succeed without it (eg.
1051                          * delegation, error == 0) or the open
1052                          * must fail due to an access failure
1053                          * (error != 0).  In either case, tidy
1054                          * up and return.
1055                          */
1056 
1057                         nfs4_end_open_seqid_sync(oop);
1058                         open_owner_rele(oop);
1059                         nfs4args_copen_free(open_args);
1060                         nfs4_end_op(VTOMI4(dvp), dvp, vpi, &recov_state, FALSE);
1061                         if (ncr != NULL)
1062                                 crfree(ncr);
1063                         kmem_free(argop, argoplist_size);
1064                         return (e.error);
1065                 }
1066         }
1067 
1068         bcopy(&oop->oo_name, open_args->owner.owner_val,
1069             open_args->owner.owner_len);
1070 
1071         seqid = nfs4_get_open_seqid(oop) + 1;
1072         open_args->seqid = seqid;
1073         open_args->share_access = 0;
1074         if (open_flag & FREAD)
1075                 open_args->share_access |= OPEN4_SHARE_ACCESS_READ;
1076         if (open_flag & FWRITE)
1077                 open_args->share_access |= OPEN4_SHARE_ACCESS_WRITE;
1078         open_args->share_deny = OPEN4_SHARE_DENY_NONE;
1079 
1080 
1081 
1082         /*
1083          * getfh w/sanity check for idx_open/idx_fattr
1084          */
1085         ASSERT((idx_open + 1) == (idx_fattr - 1));
1086         argop[idx_open + 1].argop = OP_GETFH;
1087 
1088         /* getattr */
1089         argop[idx_fattr].argop = OP_GETATTR;
1090         argop[idx_fattr].nfs_argop4_u.opgetattr.attr_request = NFS4_VATTR_MASK;
1091         argop[idx_fattr].nfs_argop4_u.opgetattr.mi = VTOMI4(dvp);
1092 
1093         if (setgid_flag) {
1094                 vattr_t _v;
1095                 servinfo4_t *svp;
1096                 bitmap4 supp_attrs;
1097 
1098                 svp = drp->r_server;
1099                 (void) nfs_rw_enter_sig(&svp->sv_lock, RW_READER, 0);
1100                 supp_attrs = svp->sv_supp_attrs;
1101                 nfs_rw_exit(&svp->sv_lock);
1102 
1103                 /*
1104                  * For setgid case, we need to:
1105                  * 4:savefh(new) 5:putfh(dir) 6:getattr(dir) 7:restorefh(new)
1106                  */
1107                 argop[4].argop = OP_SAVEFH;
1108 
1109                 argop[5].argop = OP_CPUTFH;
1110                 argop[5].nfs_argop4_u.opcputfh.sfh = drp->r_fh;
1111 
1112                 argop[6].argop = OP_GETATTR;
1113                 argop[6].nfs_argop4_u.opgetattr.attr_request = NFS4_VATTR_MASK;
1114                 argop[6].nfs_argop4_u.opgetattr.mi = VTOMI4(dvp);
1115 
1116                 argop[7].argop = OP_RESTOREFH;
1117 
1118                 /*
1119                  * nverify
1120                  */
1121                 _v.va_mask = AT_GID;
1122                 _v.va_gid = in_va->va_gid;
1123                 if (!(e.error = nfs4args_verify(&argop[8], &_v, OP_NVERIFY,
1124                     supp_attrs))) {
1125 
1126                         /*
1127                          * setattr
1128                          *
1129                          * We _know_ we're not messing with AT_SIZE or
1130                          * AT_XTIME, so no need for stateid or flags.
1131                          * Also we specify NULL rp since we're only
1132                          * interested in setting owner_group attributes.
1133                          */
1134                         nfs4args_setattr(&argop[9], &_v, NULL, 0, NULL, cr,
1135                             supp_attrs, &e.error, 0);
1136                         if (e.error)
1137                                 nfs4args_verify_free(&argop[8]);
1138                 }
1139 
1140                 if (e.error) {
1141                         /*
1142                          * XXX - Revisit the last argument to nfs4_end_op()
1143                          *       once 5020486 is fixed.
1144                          */
1145                         nfs4_end_open_seqid_sync(oop);
1146                         open_owner_rele(oop);
1147                         nfs4args_copen_free(open_args);
1148                         nfs4_end_op(VTOMI4(dvp), dvp, vpi, &recov_state, TRUE);
1149                         if (ncr != NULL)
1150                                 crfree(ncr);
1151                         kmem_free(argop, argoplist_size);
1152                         return (e.error);
1153                 }
1154         } else if (create_flag) {
1155                 argop[1].argop = OP_SAVEFH;
1156 
1157                 argop[5].argop = OP_RESTOREFH;
1158 
1159                 argop[6].argop = OP_GETATTR;
1160                 argop[6].nfs_argop4_u.opgetattr.attr_request = NFS4_VATTR_MASK;
1161                 argop[6].nfs_argop4_u.opgetattr.mi = VTOMI4(dvp);
1162         }
1163 
1164         NFS4_DEBUG(nfs4_client_call_debug, (CE_NOTE,
1165             "nfs4open_otw: %s call, nm %s, rp %s",
1166             needrecov ? "recov" : "first", file_name,
1167             rnode4info(VTOR4(dvp))));
1168 
1169         t = gethrtime();
1170 
1171         rfs4call(VTOMI4(dvp), &args, &res, cred_otw, &doqueue, 0, &e);
1172 
1173         if (!e.error && nfs4_need_to_bump_seqid(&res))
1174                 nfs4_set_open_seqid(seqid, oop, args.ctag);
1175 
1176         needrecov = nfs4_needs_recovery(&e, TRUE, dvp->v_vfsp);
1177 
1178         if (e.error || needrecov) {
1179                 bool_t abort = FALSE;
1180 
1181                 if (needrecov) {
1182                         nfs4_bseqid_entry_t *bsep = NULL;
1183 
1184                         nfs4open_save_lost_rqst(e.error, &lost_rqst, oop,
1185                             cred_otw, vpi, dvp, open_args);
1186 
1187                         if (!e.error && res.status == NFS4ERR_BAD_SEQID) {
1188                                 bsep = nfs4_create_bseqid_entry(oop, NULL,
1189                                     vpi, 0, args.ctag, open_args->seqid);
1190                                 num_bseqid_retry--;
1191                         }
1192 
1193                         abort = nfs4_start_recovery(&e, VTOMI4(dvp), dvp, vpi,
1194                             NULL, lost_rqst.lr_op == OP_OPEN ?
1195                             &lost_rqst : NULL, OP_OPEN, bsep, NULL, NULL);
1196 
1197                         if (bsep)
1198                                 kmem_free(bsep, sizeof (*bsep));
1199                         /* give up if we keep getting BAD_SEQID */
1200                         if (num_bseqid_retry == 0)
1201                                 abort = TRUE;
1202                         if (abort == TRUE && e.error == 0)
1203                                 e.error = geterrno4(res.status);
1204                 }
1205                 nfs4_end_open_seqid_sync(oop);
1206                 open_owner_rele(oop);
1207                 nfs4_end_op(VTOMI4(dvp), dvp, vpi, &recov_state, needrecov);
1208                 nfs4args_copen_free(open_args);
1209                 if (setgid_flag) {
1210                         nfs4args_verify_free(&argop[8]);
1211                         nfs4args_setattr_free(&argop[9]);
1212                 }
1213                 if (!e.error)
1214                         (void) xdr_free(xdr_COMPOUND4res_clnt, (caddr_t)&res);
1215                 if (ncr != NULL) {
1216                         crfree(ncr);
1217                         ncr = NULL;
1218                 }
1219                 if (!needrecov || abort == TRUE || e.error == EINTR ||
1220                     NFS4_FRC_UNMT_ERR(e.error, dvp->v_vfsp)) {
1221                         kmem_free(argop, argoplist_size);
1222                         return (e.error);
1223                 }
1224                 goto recov_retry;
1225         }
1226 
1227         /*
1228          * Will check and update lease after checking the rflag for
1229          * OPEN_CONFIRM in the successful OPEN call.
1230          */
1231         if (res.status != NFS4_OK && res.array_len <= idx_fattr + 1) {
1232 
1233                 /*
1234                  * XXX what if we're crossing mount points from server1:/drp
1235                  * to server2:/drp/rp.
1236                  */
1237 
1238                 /* Signal our end of use of the open seqid */
1239                 nfs4_end_open_seqid_sync(oop);
1240 
1241                 /*
1242                  * This will destroy the open owner if it was just created,
1243                  * and no one else has put a reference on it.
1244                  */
1245                 open_owner_rele(oop);
1246                 if (create_flag && (createmode != EXCLUSIVE4) &&
1247                     res.status == NFS4ERR_BADOWNER)
1248                         nfs4_log_badowner(VTOMI4(dvp), OP_OPEN);
1249 
1250                 e.error = geterrno4(res.status);
1251                 nfs4args_copen_free(open_args);
1252                 if (setgid_flag) {
1253                         nfs4args_verify_free(&argop[8]);
1254                         nfs4args_setattr_free(&argop[9]);
1255                 }
1256                 (void) xdr_free(xdr_COMPOUND4res_clnt, (caddr_t)&res);
1257                 nfs4_end_op(VTOMI4(dvp), dvp, vpi, &recov_state, needrecov);
1258                 /*
1259                  * If the reply is NFS4ERR_ACCESS, it may be because
1260                  * we are root (no root net access).  If the real uid
1261                  * is not root, then retry with the real uid instead.
1262                  */
1263                 if (ncr != NULL) {
1264                         crfree(ncr);
1265                         ncr = NULL;
1266                 }
1267                 if (res.status == NFS4ERR_ACCESS &&
1268                     (ncr = crnetadjust(cred_otw)) != NULL) {
1269                         cred_otw = ncr;
1270                         goto recov_retry;
1271                 }
1272                 kmem_free(argop, argoplist_size);
1273                 return (e.error);
1274         }
1275 
1276         resop = &res.array[idx_open];  /* open res */
1277         op_res = &resop->nfs_resop4_u.opopen;
1278 
1279 #ifdef DEBUG
1280         /*
1281          * verify attrset bitmap
1282          */
1283         if (create_flag &&
1284             (createmode == UNCHECKED4 || createmode == GUARDED4)) {
1285                 /* make sure attrset returned is what we asked for */
1286                 /* XXX Ignore this 'error' for now */
1287                 if (attr->attrmask != op_res->attrset)
1288                         /* EMPTY */;
1289         }
1290 #endif
1291 
1292         if (op_res->rflags & OPEN4_RESULT_LOCKTYPE_POSIX) {
1293                 mutex_enter(&VTOMI4(dvp)->mi_lock);
1294                 VTOMI4(dvp)->mi_flags |= MI4_POSIX_LOCK;
1295                 mutex_exit(&VTOMI4(dvp)->mi_lock);
1296         }
1297 
1298         resop = &res.array[idx_open + 1];  /* getfh res */
1299         gf_res = &resop->nfs_resop4_u.opgetfh;
1300 
1301         otw_sfh = sfh4_get(&gf_res->object, VTOMI4(dvp));
1302 
1303         /*
1304          * The open stateid has been updated on the server but not
1305          * on the client yet.  There is a path: makenfs4node->nfs4_attr_cache->
1306          * flush_pages->VOP_PUTPAGE->...->nfs4write where we will issue an OTW
1307          * WRITE call.  That, however, will use the old stateid, so go ahead
1308          * and upate the open stateid now, before any call to makenfs4node.
1309          */
1310         if (vpi) {
1311                 nfs4_open_stream_t      *tmp_osp;
1312                 rnode4_t                *tmp_rp = VTOR4(vpi);
1313 
1314                 tmp_osp = find_open_stream(oop, tmp_rp);
1315                 if (tmp_osp) {
1316                         tmp_osp->open_stateid = op_res->stateid;
1317                         mutex_exit(&tmp_osp->os_sync_lock);
1318                         open_stream_rele(tmp_osp, tmp_rp);
1319                 }
1320 
1321                 /*
1322                  * We must determine if the file handle given by the otw open
1323                  * is the same as the file handle which was passed in with
1324                  * *vpp.  This case can be reached if the file we are trying
1325                  * to open has been removed and another file has been created
1326                  * having the same file name.  The passed in vnode is released
1327                  * later.
1328                  */
1329                 orig_sfh = VTOR4(vpi)->r_fh;
1330                 fh_differs = nfs4cmpfh(&orig_sfh->sfh_fh, &otw_sfh->sfh_fh);
1331         }
1332 
1333         garp = &res.array[idx_fattr].nfs_resop4_u.opgetattr.ga_res;
1334 
1335         if (create_flag || fh_differs) {
1336                 int rnode_err = 0;
1337 
1338                 vp = makenfs4node(otw_sfh, garp, dvp->v_vfsp, t, cr,
1339                     dvp, fn_get(VTOSV(dvp)->sv_name, file_name, otw_sfh));
1340 
1341                 if (e.error)
1342                         PURGE_ATTRCACHE4(vp);
1343                 /*
1344                  * For the newly created vp case, make sure the rnode
1345                  * isn't bad before using it.
1346                  */
1347                 mutex_enter(&(VTOR4(vp))->r_statelock);
1348                 if (VTOR4(vp)->r_flags & R4RECOVERR)
1349                         rnode_err = EIO;
1350                 mutex_exit(&(VTOR4(vp))->r_statelock);
1351 
1352                 if (rnode_err) {
1353                         nfs4_end_open_seqid_sync(oop);
1354                         nfs4args_copen_free(open_args);
1355                         if (setgid_flag) {
1356                                 nfs4args_verify_free(&argop[8]);
1357                                 nfs4args_setattr_free(&argop[9]);
1358                         }
1359                         (void) xdr_free(xdr_COMPOUND4res_clnt, (caddr_t)&res);
1360                         nfs4_end_op(VTOMI4(dvp), dvp, vpi, &recov_state,
1361                             needrecov);
1362                         open_owner_rele(oop);
1363                         VN_RELE(vp);
1364                         if (ncr != NULL)
1365                                 crfree(ncr);
1366                         sfh4_rele(&otw_sfh);
1367                         kmem_free(argop, argoplist_size);
1368                         return (EIO);
1369                 }
1370         } else {
1371                 vp = vpi;
1372         }
1373         sfh4_rele(&otw_sfh);
1374 
1375         /*
1376          * It seems odd to get a full set of attrs and then not update
1377          * the object's attrcache in the non-create case.  Create case uses
1378          * the attrs since makenfs4node checks to see if the attrs need to
1379          * be updated (and then updates them).  The non-create case should
1380          * update attrs also.
1381          */
1382         if (! create_flag && ! fh_differs && !e.error) {
1383                 nfs4_attr_cache(vp, garp, t, cr, TRUE, NULL);
1384         }
1385 
1386         nfs4_error_zinit(&e);
1387         if (op_res->rflags & OPEN4_RESULT_CONFIRM) {
1388                 /* This does not do recovery for vp explicitly. */
1389                 nfs4open_confirm(vp, &seqid, &op_res->stateid, cred_otw, FALSE,
1390                     &retry_open, oop, FALSE, &e, &num_bseqid_retry);
1391 
1392                 if (e.error || e.stat) {
1393                         nfs4_end_open_seqid_sync(oop);
1394                         nfs4args_copen_free(open_args);
1395                         if (setgid_flag) {
1396                                 nfs4args_verify_free(&argop[8]);
1397                                 nfs4args_setattr_free(&argop[9]);
1398                         }
1399                         (void) xdr_free(xdr_COMPOUND4res_clnt, (caddr_t)&res);
1400                         nfs4_end_op(VTOMI4(dvp), dvp, vpi, &recov_state,
1401                             needrecov);
1402                         open_owner_rele(oop);
1403                         if (create_flag || fh_differs) {
1404                                 /* rele the makenfs4node */
1405                                 VN_RELE(vp);
1406                         }
1407                         if (ncr != NULL) {
1408                                 crfree(ncr);
1409                                 ncr = NULL;
1410                         }
1411                         if (retry_open == TRUE) {
1412                                 NFS4_DEBUG(nfs4_client_recov_debug, (CE_NOTE,
1413                                     "nfs4open_otw: retry the open since OPEN "
1414                                     "CONFIRM failed with error %d stat %d",
1415                                     e.error, e.stat));
1416                                 if (create_flag && createmode == GUARDED4) {
1417                                         NFS4_DEBUG(nfs4_client_recov_debug,
1418                                             (CE_NOTE, "nfs4open_otw: switch "
1419                                             "createmode from GUARDED4 to "
1420                                             "UNCHECKED4"));
1421                                         createmode = UNCHECKED4;
1422                                 }
1423                                 goto recov_retry;
1424                         }
1425                         if (!e.error) {
1426                                 if (create_flag && (createmode != EXCLUSIVE4) &&
1427                                     e.stat == NFS4ERR_BADOWNER)
1428                                         nfs4_log_badowner(VTOMI4(dvp), OP_OPEN);
1429 
1430                                 e.error = geterrno4(e.stat);
1431                         }
1432                         kmem_free(argop, argoplist_size);
1433                         return (e.error);
1434                 }
1435         }
1436 
1437         rp = VTOR4(vp);
1438 
1439         mutex_enter(&rp->r_statev4_lock);
1440         if (create_flag)
1441                 rp->created_v4 = 1;
1442         mutex_exit(&rp->r_statev4_lock);
1443 
1444         mutex_enter(&oop->oo_lock);
1445         /* Doesn't matter if 'oo_just_created' already was set as this */
1446         oop->oo_just_created = NFS4_PERM_CREATED;
1447         if (oop->oo_cred_otw)
1448                 crfree(oop->oo_cred_otw);
1449         oop->oo_cred_otw = cred_otw;
1450         crhold(oop->oo_cred_otw);
1451         mutex_exit(&oop->oo_lock);
1452 
1453         /* returns with 'os_sync_lock' held */
1454         osp = find_or_create_open_stream(oop, rp, &created_osp);
1455         if (!osp) {
1456                 NFS4_DEBUG(nfs4_client_state_debug, (CE_NOTE,
1457                     "nfs4open_otw: failed to create an open stream"));
1458                 NFS4_DEBUG(nfs4_seqid_sync, (CE_NOTE, "nfs4open_otw: "
1459                     "signal our end of use of the open seqid"));
1460 
1461                 nfs4_end_open_seqid_sync(oop);
1462                 open_owner_rele(oop);
1463                 nfs4args_copen_free(open_args);
1464                 if (setgid_flag) {
1465                         nfs4args_verify_free(&argop[8]);
1466                         nfs4args_setattr_free(&argop[9]);
1467                 }
1468                 (void) xdr_free(xdr_COMPOUND4res_clnt, (caddr_t)&res);
1469                 nfs4_end_op(VTOMI4(dvp), dvp, vpi, &recov_state, needrecov);
1470                 if (create_flag || fh_differs)
1471                         VN_RELE(vp);
1472                 if (ncr != NULL)
1473                         crfree(ncr);
1474 
1475                 kmem_free(argop, argoplist_size);
1476                 return (EINVAL);
1477 
1478         }
1479 
1480         osp->open_stateid = op_res->stateid;
1481 
1482         if (open_flag & FREAD)
1483                 osp->os_share_acc_read++;
1484         if (open_flag & FWRITE)
1485                 osp->os_share_acc_write++;
1486         osp->os_share_deny_none++;
1487 
1488         /*
1489          * Need to reset this bitfield for the possible case where we were
1490          * going to OTW CLOSE the file, got a non-recoverable error, and before
1491          * we could retry the CLOSE, OPENed the file again.
1492          */
1493         ASSERT(osp->os_open_owner->oo_seqid_inuse);
1494         osp->os_final_close = 0;
1495         osp->os_force_close = 0;
1496 #ifdef DEBUG
1497         if (osp->os_failed_reopen)
1498                 NFS4_DEBUG(nfs4_open_stream_debug, (CE_NOTE, "nfs4open_otw:"
1499                     " clearing os_failed_reopen for osp %p, cr %p, rp %s",
1500                     (void *)osp, (void *)cr, rnode4info(rp)));
1501 #endif
1502         osp->os_failed_reopen = 0;
1503 
1504         mutex_exit(&osp->os_sync_lock);
1505 
1506         nfs4_end_open_seqid_sync(oop);
1507 
1508         if (created_osp && recov_state.rs_sp != NULL) {
1509                 mutex_enter(&recov_state.rs_sp->s_lock);
1510                 nfs4_inc_state_ref_count_nolock(recov_state.rs_sp, VTOMI4(dvp));
1511                 mutex_exit(&recov_state.rs_sp->s_lock);
1512         }
1513 
1514         /* get rid of our reference to find oop */
1515         open_owner_rele(oop);
1516 
1517         open_stream_rele(osp, rp);
1518 
1519         /* accept delegation, if any */
1520         nfs4_delegation_accept(rp, CLAIM_NULL, op_res, garp, cred_otw);
1521 
1522         nfs4_end_op(VTOMI4(dvp), dvp, vpi, &recov_state, needrecov);
1523 
1524         if (createmode == EXCLUSIVE4 &&
1525             (in_va->va_mask & ~(AT_GID | AT_SIZE))) {
1526                 NFS4_DEBUG(nfs4_client_state_debug, (CE_NOTE, "nfs4open_otw:"
1527                     " EXCLUSIVE4: sending a SETATTR"));
1528                 /*
1529                  * If doing an exclusive create, then generate
1530                  * a SETATTR to set the initial attributes.
1531                  * Try to set the mtime and the atime to the
1532                  * server's current time.  It is somewhat
1533                  * expected that these fields will be used to
1534                  * store the exclusive create cookie.  If not,
1535                  * server implementors will need to know that
1536                  * a SETATTR will follow an exclusive create
1537                  * and the cookie should be destroyed if
1538                  * appropriate.
1539                  *
1540                  * The AT_GID and AT_SIZE bits are turned off
1541                  * so that the SETATTR request will not attempt
1542                  * to process these.  The gid will be set
1543                  * separately if appropriate.  The size is turned
1544                  * off because it is assumed that a new file will
1545                  * be created empty and if the file wasn't empty,
1546                  * then the exclusive create will have failed
1547                  * because the file must have existed already.
1548                  * Therefore, no truncate operation is needed.
1549                  */
1550                 in_va->va_mask &= ~(AT_GID | AT_SIZE);
1551                 in_va->va_mask |= (AT_MTIME | AT_ATIME);
1552 
1553                 e.error = nfs4setattr(vp, in_va, 0, cr, NULL);
1554                 if (e.error) {
1555                         /*
1556                          * Couldn't correct the attributes of
1557                          * the newly created file and the
1558                          * attributes are wrong.  Remove the
1559                          * file and return an error to the
1560                          * application.
1561                          */
1562                         /* XXX will this take care of client state ? */
1563                         NFS4_DEBUG(nfs4_client_state_debug, (CE_NOTE,
1564                             "nfs4open_otw: EXCLUSIVE4: error %d on SETATTR:"
1565                             " remove file", e.error));
1566                         VN_RELE(vp);
1567                         (void) nfs4_remove(dvp, file_name, cr, NULL, 0);
1568                         /*
1569                          * Since we've reled the vnode and removed
1570                          * the file we now need to return the error.
1571                          * At this point we don't want to update the
1572                          * dircaches, call nfs4_waitfor_purge_complete
1573                          * or set vpp to vp so we need to skip these
1574                          * as well.
1575                          */
1576                         goto skip_update_dircaches;
1577                 }
1578         }
1579 
1580         /*
1581          * If we created or found the correct vnode, due to create_flag or
1582          * fh_differs being set, then update directory cache attribute, readdir
1583          * and dnlc caches.
1584          */
1585         if (create_flag || fh_differs) {
1586                 dirattr_info_t dinfo, *dinfop;
1587 
1588                 /*
1589                  * Make sure getattr succeeded before using results.
1590                  * note: op 7 is getattr(dir) for both flavors of
1591                  * open(create).
1592                  */
1593                 if (create_flag && res.status == NFS4_OK) {
1594                         dinfo.di_time_call = t;
1595                         dinfo.di_cred = cr;
1596                         dinfo.di_garp =
1597                             &res.array[6].nfs_resop4_u.opgetattr.ga_res;
1598                         dinfop = &dinfo;
1599                 } else {
1600                         dinfop = NULL;
1601                 }
1602 
1603                 nfs4_update_dircaches(&op_res->cinfo, dvp, vp, file_name,
1604                     dinfop);
1605         }
1606 
1607         /*
1608          * If the page cache for this file was flushed from actions
1609          * above, it was done asynchronously and if that is true,
1610          * there is a need to wait here for it to complete.  This must
1611          * be done outside of start_fop/end_fop.
1612          */
1613         (void) nfs4_waitfor_purge_complete(vp);
1614 
1615         /*
1616          * It is implicit that we are in the open case (create_flag == 0) since
1617          * fh_differs can only be set to a non-zero value in the open case.
1618          */
1619         if (fh_differs != 0 && vpi != NULL)
1620                 VN_RELE(vpi);
1621 
1622         /*
1623          * Be sure to set *vpp to the correct value before returning.
1624          */
1625         *vpp = vp;
1626 
1627 skip_update_dircaches:
1628 
1629         nfs4args_copen_free(open_args);
1630         if (setgid_flag) {
1631                 nfs4args_verify_free(&argop[8]);
1632                 nfs4args_setattr_free(&argop[9]);
1633         }
1634         (void) xdr_free(xdr_COMPOUND4res_clnt, (caddr_t)&res);
1635 
1636         if (ncr)
1637                 crfree(ncr);
1638         kmem_free(argop, argoplist_size);
1639         return (e.error);
1640 }
1641 
1642 /*
1643  * Reopen an open instance.  cf. nfs4open_otw().
1644  *
1645  * Errors are returned by the nfs4_error_t parameter.
1646  * - ep->error contains an errno value or zero.
1647  * - if it is zero, ep->stat is set to an NFS status code, if any.
1648  *   If the file could not be reopened, but the caller should continue, the
1649  *   file is marked dead and no error values are returned.  If the caller
1650  *   should stop recovering open files and start over, either the ep->error
1651  *   value or ep->stat will indicate an error (either something that requires
1652  *   recovery or EAGAIN).  Note that some recovery (e.g., expired volatile
1653  *   filehandles) may be handled silently by this routine.
1654  * - if it is EINTR, ETIMEDOUT, or NFS4_FRC_UNMT_ERR, recovery for lost state
1655  *   will be started, so the caller should not do it.
1656  *
1657  * Gotos:
1658  * - kill_file : reopen failed in such a fashion to constitute marking the
1659  *    file dead and setting the open stream's 'os_failed_reopen' as 1.  This
1660  *   is for cases where recovery is not possible.
1661  * - failed_reopen : same as above, except that the file has already been
1662  *   marked dead, so no need to do it again.
1663  * - bailout : reopen failed but we are able to recover and retry the reopen -
1664  *   either within this function immediately or via the calling function.
1665  */
1666 
1667 void
1668 nfs4_reopen(vnode_t *vp, nfs4_open_stream_t *osp, nfs4_error_t *ep,
1669     open_claim_type4 claim, bool_t frc_use_claim_previous,
1670     bool_t is_recov)
1671 {
1672         COMPOUND4args_clnt args;
1673         COMPOUND4res_clnt res;
1674         nfs_argop4 argop[4];
1675         nfs_resop4 *resop;
1676         OPEN4res *op_res = NULL;
1677         OPEN4cargs *open_args;
1678         GETFH4res *gf_res;
1679         rnode4_t *rp = VTOR4(vp);
1680         int doqueue = 1;
1681         cred_t *cr = NULL, *cred_otw = NULL;
1682         nfs4_open_owner_t *oop = NULL;
1683         seqid4 seqid;
1684         nfs4_ga_res_t *garp;
1685         char fn[MAXNAMELEN];
1686         nfs4_recov_state_t recov = {NULL, 0};
1687         nfs4_lost_rqst_t lost_rqst;
1688         mntinfo4_t *mi = VTOMI4(vp);
1689         bool_t abort;
1690         char *failed_msg = "";
1691         int fh_different;
1692         hrtime_t t;
1693         nfs4_bseqid_entry_t *bsep = NULL;
1694 
1695         ASSERT(nfs4_consistent_type(vp));
1696         ASSERT(nfs_zone() == mi->mi_zone);
1697 
1698         nfs4_error_zinit(ep);
1699 
1700         /* this is the cred used to find the open owner */
1701         cr = state_to_cred(osp);
1702         if (cr == NULL) {
1703                 failed_msg = "Couldn't reopen: no cred";
1704                 goto kill_file;
1705         }
1706         /* use this cred for OTW operations */
1707         cred_otw = nfs4_get_otw_cred(cr, mi, osp->os_open_owner);
1708 
1709 top:
1710         nfs4_error_zinit(ep);
1711 
1712         if (mi->mi_vfsp->vfs_flag & VFS_UNMOUNTED) {
1713                 /* File system has been unmounted, quit */
1714                 ep->error = EIO;
1715                 failed_msg = "Couldn't reopen: file system has been unmounted";
1716                 goto kill_file;
1717         }
1718 
1719         oop = osp->os_open_owner;
1720 
1721         ASSERT(oop != NULL);
1722         if (oop == NULL) {      /* be defensive in non-DEBUG */
1723                 failed_msg = "can't reopen: no open owner";
1724                 goto kill_file;
1725         }
1726         open_owner_hold(oop);
1727 
1728         ep->error = nfs4_start_open_seqid_sync(oop, mi);
1729         if (ep->error) {
1730                 open_owner_rele(oop);
1731                 oop = NULL;
1732                 goto bailout;
1733         }
1734 
1735         /*
1736          * If the rnode has a delegation and the delegation has been
1737          * recovered and the server didn't request a recall and the caller
1738          * didn't specifically ask for CLAIM_PREVIOUS (nfs4frlock during
1739          * recovery) and the rnode hasn't been marked dead, then install
1740          * the delegation stateid in the open stream.  Otherwise, proceed
1741          * with a CLAIM_PREVIOUS or CLAIM_NULL OPEN.
1742          */
1743         mutex_enter(&rp->r_statev4_lock);
1744         if (rp->r_deleg_type != OPEN_DELEGATE_NONE &&
1745             !rp->r_deleg_return_pending &&
1746             (rp->r_deleg_needs_recovery == OPEN_DELEGATE_NONE) &&
1747             !rp->r_deleg_needs_recall &&
1748             claim != CLAIM_DELEGATE_CUR && !frc_use_claim_previous &&
1749             !(rp->r_flags & R4RECOVERR)) {
1750                 mutex_enter(&osp->os_sync_lock);
1751                 osp->os_delegation = 1;
1752                 osp->open_stateid = rp->r_deleg_stateid;
1753                 mutex_exit(&osp->os_sync_lock);
1754                 mutex_exit(&rp->r_statev4_lock);
1755                 goto bailout;
1756         }
1757         mutex_exit(&rp->r_statev4_lock);
1758 
1759         /*
1760          * If the file failed recovery, just quit.  This failure need not
1761          * affect other reopens, so don't return an error.
1762          */
1763         mutex_enter(&rp->r_statelock);
1764         if (rp->r_flags & R4RECOVERR) {
1765                 mutex_exit(&rp->r_statelock);
1766                 ep->error = 0;
1767                 goto failed_reopen;
1768         }
1769         mutex_exit(&rp->r_statelock);
1770 
1771         /*
1772          * argop is empty here
1773          *
1774          * PUTFH, OPEN, GETATTR
1775          */
1776         args.ctag = TAG_REOPEN;
1777         args.array_len = 4;
1778         args.array = argop;
1779 
1780         NFS4_DEBUG(nfs4_client_failover_debug, (CE_NOTE,
1781             "nfs4_reopen: file is type %d, id %s",
1782             vp->v_type, rnode4info(VTOR4(vp))));
1783 
1784         argop[0].argop = OP_CPUTFH;
1785 
1786         if (claim != CLAIM_PREVIOUS) {
1787                 /*
1788                  * if this is a file mount then
1789                  * use the mntinfo parentfh
1790                  */
1791                 argop[0].nfs_argop4_u.opcputfh.sfh =
1792                     (vp->v_flag & VROOT) ? mi->mi_srvparentfh :
1793                     VTOSV(vp)->sv_dfh;
1794         } else {
1795                 /* putfh fh to reopen */
1796                 argop[0].nfs_argop4_u.opcputfh.sfh = rp->r_fh;
1797         }
1798 
1799         argop[1].argop = OP_COPEN;
1800         open_args = &argop[1].nfs_argop4_u.opcopen;
1801         open_args->claim = claim;
1802 
1803         if (claim == CLAIM_NULL) {
1804 
1805                 if ((ep->error = vtoname(vp, fn, MAXNAMELEN)) != 0) {
1806                         nfs_cmn_err(ep->error, CE_WARN, "nfs4_reopen: vtoname "
1807                             "failed for vp 0x%p for CLAIM_NULL with %m",
1808                             (void *)vp);
1809                         failed_msg = "Couldn't reopen: vtoname failed for "
1810                             "CLAIM_NULL";
1811                         /* nothing allocated yet */
1812                         goto kill_file;
1813                 }
1814 
1815                 open_args->open_claim4_u.cfile = fn;
1816         } else if (claim == CLAIM_PREVIOUS) {
1817 
1818                 /*
1819                  * We have two cases to deal with here:
1820                  * 1) We're being called to reopen files in order to satisfy
1821                  *    a lock operation request which requires us to explicitly
1822                  *    reopen files which were opened under a delegation.  If
1823                  *    we're in recovery, we *must* use CLAIM_PREVIOUS.  In
1824                  *    that case, frc_use_claim_previous is TRUE and we must
1825                  *    use the rnode's current delegation type (r_deleg_type).
1826                  * 2) We're reopening files during some form of recovery.
1827                  *    In this case, frc_use_claim_previous is FALSE and we
1828                  *    use the delegation type appropriate for recovery
1829                  *    (r_deleg_needs_recovery).
1830                  */
1831                 mutex_enter(&rp->r_statev4_lock);
1832                 open_args->open_claim4_u.delegate_type =
1833                     frc_use_claim_previous ?
1834                     rp->r_deleg_type :
1835                     rp->r_deleg_needs_recovery;
1836                 mutex_exit(&rp->r_statev4_lock);
1837 
1838         } else if (claim == CLAIM_DELEGATE_CUR) {
1839 
1840                 if ((ep->error = vtoname(vp, fn, MAXNAMELEN)) != 0) {
1841                         nfs_cmn_err(ep->error, CE_WARN, "nfs4_reopen: vtoname "
1842                             "failed for vp 0x%p for CLAIM_DELEGATE_CUR "
1843                             "with %m", (void *)vp);
1844                         failed_msg = "Couldn't reopen: vtoname failed for "
1845                             "CLAIM_DELEGATE_CUR";
1846                         /* nothing allocated yet */
1847                         goto kill_file;
1848                 }
1849 
1850                 mutex_enter(&rp->r_statev4_lock);
1851                 open_args->open_claim4_u.delegate_cur_info.delegate_stateid =
1852                     rp->r_deleg_stateid;
1853                 mutex_exit(&rp->r_statev4_lock);
1854 
1855                 open_args->open_claim4_u.delegate_cur_info.cfile = fn;
1856         }
1857         open_args->opentype = OPEN4_NOCREATE;
1858         open_args->owner.clientid = mi2clientid(mi);
1859         open_args->owner.owner_len = sizeof (oop->oo_name);
1860         open_args->owner.owner_val =
1861             kmem_alloc(open_args->owner.owner_len, KM_SLEEP);
1862         bcopy(&oop->oo_name, open_args->owner.owner_val,
1863             open_args->owner.owner_len);
1864         open_args->share_access = 0;
1865         open_args->share_deny = 0;
1866 
1867         mutex_enter(&osp->os_sync_lock);
1868         NFS4_DEBUG(nfs4_client_recov_debug, (CE_NOTE, "nfs4_reopen: osp %p rp "
1869             "%p: read acc %"PRIu64" write acc %"PRIu64": open ref count %d: "
1870             "mmap read %"PRIu64" mmap write %"PRIu64" claim %d ",
1871             (void *)osp, (void *)rp, osp->os_share_acc_read,
1872             osp->os_share_acc_write, osp->os_open_ref_count,
1873             osp->os_mmap_read, osp->os_mmap_write, claim));
1874 
1875         if (osp->os_share_acc_read || osp->os_mmap_read)
1876                 open_args->share_access |= OPEN4_SHARE_ACCESS_READ;
1877         if (osp->os_share_acc_write || osp->os_mmap_write)
1878                 open_args->share_access |= OPEN4_SHARE_ACCESS_WRITE;
1879         if (osp->os_share_deny_read)
1880                 open_args->share_deny |= OPEN4_SHARE_DENY_READ;
1881         if (osp->os_share_deny_write)
1882                 open_args->share_deny |= OPEN4_SHARE_DENY_WRITE;
1883         mutex_exit(&osp->os_sync_lock);
1884 
1885         seqid = nfs4_get_open_seqid(oop) + 1;
1886         open_args->seqid = seqid;
1887 
1888         /* Construct the getfh part of the compound */
1889         argop[2].argop = OP_GETFH;
1890 
1891         /* Construct the getattr part of the compound */
1892         argop[3].argop = OP_GETATTR;
1893         argop[3].nfs_argop4_u.opgetattr.attr_request = NFS4_VATTR_MASK;
1894         argop[3].nfs_argop4_u.opgetattr.mi = mi;
1895 
1896         t = gethrtime();
1897 
1898         rfs4call(mi, &args, &res, cred_otw, &doqueue, 0, ep);
1899 
1900         if (ep->error) {
1901                 if (!is_recov && !frc_use_claim_previous &&
1902                     (ep->error == EINTR || ep->error == ETIMEDOUT ||
1903                     NFS4_FRC_UNMT_ERR(ep->error, vp->v_vfsp))) {
1904                         nfs4open_save_lost_rqst(ep->error, &lost_rqst, oop,
1905                             cred_otw, vp, NULL, open_args);
1906                         abort = nfs4_start_recovery(ep,
1907                             VTOMI4(vp), vp, NULL, NULL,
1908                             lost_rqst.lr_op == OP_OPEN ?
1909                             &lost_rqst : NULL, OP_OPEN, NULL, NULL, NULL);
1910                         nfs4args_copen_free(open_args);
1911                         goto bailout;
1912                 }
1913 
1914                 nfs4args_copen_free(open_args);
1915 
1916                 if (ep->error == EACCES && cred_otw != cr) {
1917                         crfree(cred_otw);
1918                         cred_otw = cr;
1919                         crhold(cred_otw);
1920                         nfs4_end_open_seqid_sync(oop);
1921                         open_owner_rele(oop);
1922                         oop = NULL;
1923                         goto top;
1924                 }
1925                 if (ep->error == ETIMEDOUT)
1926                         goto bailout;
1927                 failed_msg = "Couldn't reopen: rpc error";
1928                 goto kill_file;
1929         }
1930 
1931         if (nfs4_need_to_bump_seqid(&res))
1932                 nfs4_set_open_seqid(seqid, oop, args.ctag);
1933 
1934         switch (res.status) {
1935         case NFS4_OK:
1936                 if (recov.rs_flags & NFS4_RS_DELAY_MSG) {
1937                         mutex_enter(&rp->r_statelock);
1938                         rp->r_delay_interval = 0;
1939                         mutex_exit(&rp->r_statelock);
1940                 }
1941                 break;
1942         case NFS4ERR_BAD_SEQID:
1943                 bsep = nfs4_create_bseqid_entry(oop, NULL, vp, 0,
1944                     args.ctag, open_args->seqid);
1945 
1946                 abort = nfs4_start_recovery(ep, VTOMI4(vp), vp, NULL,
1947                     NULL, lost_rqst.lr_op == OP_OPEN ? &lost_rqst :
1948                     NULL, OP_OPEN, bsep, NULL, NULL);
1949 
1950                 nfs4args_copen_free(open_args);
1951                 (void) xdr_free(xdr_COMPOUND4res_clnt, (caddr_t)&res);
1952                 nfs4_end_open_seqid_sync(oop);
1953                 open_owner_rele(oop);
1954                 oop = NULL;
1955                 kmem_free(bsep, sizeof (*bsep));
1956 
1957                 goto kill_file;
1958         case NFS4ERR_NO_GRACE:
1959                 nfs4args_copen_free(open_args);
1960                 (void) xdr_free(xdr_COMPOUND4res_clnt, (caddr_t)&res);
1961                 nfs4_end_open_seqid_sync(oop);
1962                 open_owner_rele(oop);
1963                 oop = NULL;
1964                 if (claim == CLAIM_PREVIOUS) {
1965                         /*
1966                          * Retry as a plain open. We don't need to worry about
1967                          * checking the changeinfo: it is acceptable for a
1968                          * client to re-open a file and continue processing
1969                          * (in the absence of locks).
1970                          */
1971                         NFS4_DEBUG(nfs4_client_recov_debug, (CE_NOTE,
1972                             "nfs4_reopen: CLAIM_PREVIOUS: NFS4ERR_NO_GRACE; "
1973                             "will retry as CLAIM_NULL"));
1974                         claim = CLAIM_NULL;
1975                         nfs4_mi_kstat_inc_no_grace(mi);
1976                         goto top;
1977                 }
1978                 failed_msg =
1979                     "Couldn't reopen: tried reclaim outside grace period. ";
1980                 goto kill_file;
1981         case NFS4ERR_GRACE:
1982                 nfs4_set_grace_wait(mi);
1983                 nfs4args_copen_free(open_args);
1984                 (void) xdr_free(xdr_COMPOUND4res_clnt, (caddr_t)&res);
1985                 nfs4_end_open_seqid_sync(oop);
1986                 open_owner_rele(oop);
1987                 oop = NULL;
1988                 ep->error = nfs4_wait_for_grace(mi, &recov);
1989                 if (ep->error != 0)
1990                         goto bailout;
1991                 goto top;
1992         case NFS4ERR_DELAY:
1993                 nfs4_set_delay_wait(vp);
1994                 nfs4args_copen_free(open_args);
1995                 (void) xdr_free(xdr_COMPOUND4res_clnt, (caddr_t)&res);
1996                 nfs4_end_open_seqid_sync(oop);
1997                 open_owner_rele(oop);
1998                 oop = NULL;
1999                 ep->error = nfs4_wait_for_delay(vp, &recov);
2000                 nfs4_mi_kstat_inc_delay(mi);
2001                 if (ep->error != 0)
2002                         goto bailout;
2003                 goto top;
2004         case NFS4ERR_FHEXPIRED:
2005                 /* recover filehandle and retry */
2006                 abort = nfs4_start_recovery(ep,
2007                     mi, vp, NULL, NULL, NULL, OP_OPEN, NULL, NULL, NULL);
2008                 nfs4args_copen_free(open_args);
2009                 (void) xdr_free(xdr_COMPOUND4res_clnt, (caddr_t)&res);
2010                 nfs4_end_open_seqid_sync(oop);
2011                 open_owner_rele(oop);
2012                 oop = NULL;
2013                 if (abort == FALSE)
2014                         goto top;
2015                 failed_msg = "Couldn't reopen: recovery aborted";
2016                 goto kill_file;
2017         case NFS4ERR_RESOURCE:
2018         case NFS4ERR_STALE_CLIENTID:
2019         case NFS4ERR_WRONGSEC:
2020         case NFS4ERR_EXPIRED:
2021                 /*
2022                  * Do not mark the file dead and let the calling
2023                  * function initiate recovery.
2024                  */
2025                 nfs4args_copen_free(open_args);
2026                 (void) xdr_free(xdr_COMPOUND4res_clnt, (caddr_t)&res);
2027                 nfs4_end_open_seqid_sync(oop);
2028                 open_owner_rele(oop);
2029                 oop = NULL;
2030                 goto bailout;
2031         case NFS4ERR_ACCESS:
2032                 if (cred_otw != cr) {
2033                         crfree(cred_otw);
2034                         cred_otw = cr;
2035                         crhold(cred_otw);
2036                         nfs4args_copen_free(open_args);
2037                         (void) xdr_free(xdr_COMPOUND4res_clnt, (caddr_t)&res);
2038                         nfs4_end_open_seqid_sync(oop);
2039                         open_owner_rele(oop);
2040                         oop = NULL;
2041                         goto top;
2042                 }
2043                 /* fall through */
2044         default:
2045                 NFS4_DEBUG(nfs4_client_failover_debug, (CE_NOTE,
2046                     "nfs4_reopen: r_server 0x%p, mi_curr_serv 0x%p, rnode %s",
2047                     (void*)VTOR4(vp)->r_server, (void*)mi->mi_curr_serv,
2048                     rnode4info(VTOR4(vp))));
2049                 failed_msg = "Couldn't reopen: NFSv4 error";
2050                 nfs4args_copen_free(open_args);
2051                 (void) xdr_free(xdr_COMPOUND4res_clnt, (caddr_t)&res);
2052                 goto kill_file;
2053         }
2054 
2055         resop = &res.array[1];  /* open res */
2056         op_res = &resop->nfs_resop4_u.opopen;
2057 
2058         garp = &res.array[3].nfs_resop4_u.opgetattr.ga_res;
2059 
2060         /*
2061          * Check if the path we reopened really is the same
2062          * file. We could end up in a situation where the file
2063          * was removed and a new file created with the same name.
2064          */
2065         resop = &res.array[2];
2066         gf_res = &resop->nfs_resop4_u.opgetfh;
2067         (void) nfs_rw_enter_sig(&mi->mi_fh_lock, RW_READER, 0);
2068         fh_different = (nfs4cmpfh(&rp->r_fh->sfh_fh, &gf_res->object) != 0);
2069         if (fh_different) {
2070                 if (mi->mi_fh_expire_type == FH4_PERSISTENT ||
2071                     mi->mi_fh_expire_type & FH4_NOEXPIRE_WITH_OPEN) {
2072                         /* Oops, we don't have the same file */
2073                         if (mi->mi_fh_expire_type == FH4_PERSISTENT)
2074                                 failed_msg = "Couldn't reopen: Persistent "
2075                                     "file handle changed";
2076                         else
2077                                 failed_msg = "Couldn't reopen: Volatile "
2078                                     "(no expire on open) file handle changed";
2079 
2080                         nfs4args_copen_free(open_args);
2081                         (void) xdr_free(xdr_COMPOUND4res_clnt, (caddr_t)&res);
2082                         nfs_rw_exit(&mi->mi_fh_lock);
2083                         goto kill_file;
2084 
2085                 } else {
2086                         /*
2087                          * We have volatile file handles that don't compare.
2088                          * If the fids are the same then we assume that the
2089                          * file handle expired but the rnode still refers to
2090                          * the same file object.
2091                          *
2092                          * First check that we have fids or not.
2093                          * If we don't we have a dumb server so we will
2094                          * just assume every thing is ok for now.
2095                          */
2096                         if (!ep->error && garp->n4g_va.va_mask & AT_NODEID &&
2097                             rp->r_attr.va_mask & AT_NODEID &&
2098                             rp->r_attr.va_nodeid != garp->n4g_va.va_nodeid) {
2099                                 /*
2100                                  * We have fids, but they don't
2101                                  * compare. So kill the file.
2102                                  */
2103                                 failed_msg =
2104                                     "Couldn't reopen: file handle changed"
2105                                     " due to mismatched fids";
2106                                 nfs4args_copen_free(open_args);
2107                                 (void) xdr_free(xdr_COMPOUND4res_clnt,
2108                                     (caddr_t)&res);
2109                                 nfs_rw_exit(&mi->mi_fh_lock);
2110                                 goto kill_file;
2111                         } else {
2112                                 /*
2113                                  * We have volatile file handles that refers
2114                                  * to the same file (at least they have the
2115                                  * same fid) or we don't have fids so we
2116                                  * can't tell. :(. We'll be a kind and accepting
2117                                  * client so we'll update the rnode's file
2118                                  * handle with the otw handle.
2119                                  *
2120                                  * We need to drop mi->mi_fh_lock since
2121                                  * sh4_update acquires it. Since there is
2122                                  * only one recovery thread there is no
2123                                  * race.
2124                                  */
2125                                 nfs_rw_exit(&mi->mi_fh_lock);
2126                                 sfh4_update(rp->r_fh, &gf_res->object);
2127                         }
2128                 }
2129         } else {
2130                 nfs_rw_exit(&mi->mi_fh_lock);
2131         }
2132 
2133         ASSERT(nfs4_consistent_type(vp));
2134 
2135         /*
2136          * If the server wanted an OPEN_CONFIRM but that fails, just start
2137          * over.  Presumably if there is a persistent error it will show up
2138          * when we resend the OPEN.
2139          */
2140         if (op_res->rflags & OPEN4_RESULT_CONFIRM) {
2141                 bool_t retry_open = FALSE;
2142 
2143                 nfs4open_confirm(vp, &seqid, &op_res->stateid,
2144                     cred_otw, is_recov, &retry_open,
2145                     oop, FALSE, ep, NULL);
2146                 if (ep->error || ep->stat) {
2147                         nfs4args_copen_free(open_args);
2148                         (void) xdr_free(xdr_COMPOUND4res_clnt, (caddr_t)&res);
2149                         nfs4_end_open_seqid_sync(oop);
2150                         open_owner_rele(oop);
2151                         oop = NULL;
2152                         goto top;
2153                 }
2154         }
2155 
2156         mutex_enter(&osp->os_sync_lock);
2157         osp->open_stateid = op_res->stateid;
2158         osp->os_delegation = 0;
2159         /*
2160          * Need to reset this bitfield for the possible case where we were
2161          * going to OTW CLOSE the file, got a non-recoverable error, and before
2162          * we could retry the CLOSE, OPENed the file again.
2163          */
2164         ASSERT(osp->os_open_owner->oo_seqid_inuse);
2165         osp->os_final_close = 0;
2166         osp->os_force_close = 0;
2167         if (claim == CLAIM_DELEGATE_CUR || claim == CLAIM_PREVIOUS)
2168                 osp->os_dc_openacc = open_args->share_access;
2169         mutex_exit(&osp->os_sync_lock);
2170 
2171         nfs4_end_open_seqid_sync(oop);
2172 
2173         /* accept delegation, if any */
2174         nfs4_delegation_accept(rp, claim, op_res, garp, cred_otw);
2175 
2176         nfs4args_copen_free(open_args);
2177 
2178         nfs4_attr_cache(vp, garp, t, cr, TRUE, NULL);
2179 
2180         (void) xdr_free(xdr_COMPOUND4res_clnt, (caddr_t)&res);
2181 
2182         ASSERT(nfs4_consistent_type(vp));
2183 
2184         open_owner_rele(oop);
2185         crfree(cr);
2186         crfree(cred_otw);
2187         return;
2188 
2189 kill_file:
2190         nfs4_fail_recov(vp, failed_msg, ep->error, ep->stat);
2191 failed_reopen:
2192         NFS4_DEBUG(nfs4_open_stream_debug, (CE_NOTE,
2193             "nfs4_reopen: setting os_failed_reopen for osp %p, cr %p, rp %s",
2194             (void *)osp, (void *)cr, rnode4info(rp)));
2195         mutex_enter(&osp->os_sync_lock);
2196         osp->os_failed_reopen = 1;
2197         mutex_exit(&osp->os_sync_lock);
2198 bailout:
2199         if (oop != NULL) {
2200                 nfs4_end_open_seqid_sync(oop);
2201                 open_owner_rele(oop);
2202         }
2203         if (cr != NULL)
2204                 crfree(cr);
2205         if (cred_otw != NULL)
2206                 crfree(cred_otw);
2207 }
2208 
2209 /* for . and .. OPENs */
2210 /* ARGSUSED */
2211 static int
2212 nfs4_open_non_reg_file(vnode_t **vpp, int flag, cred_t *cr)
2213 {
2214         rnode4_t *rp;
2215         nfs4_ga_res_t gar;
2216 
2217         ASSERT(nfs_zone() == VTOMI4(*vpp)->mi_zone);
2218 
2219         /*
2220          * If close-to-open consistency checking is turned off or
2221          * if there is no cached data, we can avoid
2222          * the over the wire getattr.  Otherwise, force a
2223          * call to the server to get fresh attributes and to
2224          * check caches. This is required for close-to-open
2225          * consistency.
2226          */
2227         rp = VTOR4(*vpp);
2228         if (VTOMI4(*vpp)->mi_flags & MI4_NOCTO ||
2229             (rp->r_dir == NULL && !nfs4_has_pages(*vpp)))
2230                 return (0);
2231 
2232         gar.n4g_va.va_mask = AT_ALL;
2233         return (nfs4_getattr_otw(*vpp, &gar, cr, 0));
2234 }
2235 
2236 /*
2237  * CLOSE a file
2238  */
2239 /* ARGSUSED */
2240 static int
2241 nfs4_close(vnode_t *vp, int flag, int count, offset_t offset, cred_t *cr,
2242         caller_context_t *ct)
2243 {
2244         rnode4_t        *rp;
2245         int              error = 0;
2246         int              r_error = 0;
2247         int              n4error = 0;
2248         nfs4_error_t     e = { 0, NFS4_OK, RPC_SUCCESS };
2249 
2250         /*
2251          * Remove client state for this (lockowner, file) pair.
2252          * Issue otw v4 call to have the server do the same.
2253          */
2254 
2255         rp = VTOR4(vp);
2256 
2257         /*
2258          * zone_enter(2) prevents processes from changing zones with NFS files
2259          * open; if we happen to get here from the wrong zone we can't do
2260          * anything over the wire.
2261          */
2262         if (VTOMI4(vp)->mi_zone != nfs_zone()) {
2263                 /*
2264                  * We could attempt to clean up locks, except we're sure
2265                  * that the current process didn't acquire any locks on
2266                  * the file: any attempt to lock a file belong to another zone
2267                  * will fail, and one can't lock an NFS file and then change
2268                  * zones, as that fails too.
2269                  *
2270                  * Returning an error here is the sane thing to do.  A
2271                  * subsequent call to VN_RELE() which translates to a
2272                  * nfs4_inactive() will clean up state: if the zone of the
2273                  * vnode's origin is still alive and kicking, the inactive
2274                  * thread will handle the request (from the correct zone), and
2275                  * everything (minus the OTW close call) should be OK.  If the
2276                  * zone is going away nfs4_async_inactive() will throw away
2277                  * delegations, open streams and cached pages inline.
2278                  */
2279                 return (EIO);
2280         }
2281 
2282         /*
2283          * If we are using local locking for this filesystem, then
2284          * release all of the SYSV style record locks.  Otherwise,
2285          * we are doing network locking and we need to release all
2286          * of the network locks.  All of the locks held by this
2287          * process on this file are released no matter what the
2288          * incoming reference count is.
2289          */
2290         if (VTOMI4(vp)->mi_flags & MI4_LLOCK) {
2291                 cleanlocks(vp, ttoproc(curthread)->p_pid, 0);
2292                 cleanshares(vp, ttoproc(curthread)->p_pid);
2293         } else
2294                 e.error = nfs4_lockrelease(vp, flag, offset, cr);
2295 
2296         if (e.error) {
2297                 struct lm_sysid *lmsid;
2298                 lmsid = nfs4_find_sysid(VTOMI4(vp));
2299                 if (lmsid == NULL) {
2300                         DTRACE_PROBE2(unknown__sysid, int, e.error,
2301                             vnode_t *, vp);
2302                 } else {
2303                         cleanlocks(vp, ttoproc(curthread)->p_pid,
2304                             (lm_sysidt(lmsid) | LM_SYSID_CLIENT));
2305                 }
2306                 return (e.error);
2307         }
2308 
2309         if (count > 1)
2310                 return (0);
2311 
2312         /*
2313          * If the file has been `unlinked', then purge the
2314          * DNLC so that this vnode will get reycled quicker
2315          * and the .nfs* file on the server will get removed.
2316          */
2317         if (rp->r_unldvp != NULL)
2318                 dnlc_purge_vp(vp);
2319 
2320         /*
2321          * If the file was open for write and there are pages,
2322          * do a synchronous flush and commit of all of the
2323          * dirty and uncommitted pages.
2324          */
2325         ASSERT(!e.error);
2326         if ((flag & FWRITE) && nfs4_has_pages(vp))
2327                 error = nfs4_putpage_commit(vp, 0, 0, cr);
2328 
2329         mutex_enter(&rp->r_statelock);
2330         r_error = rp->r_error;
2331         rp->r_error = 0;
2332         mutex_exit(&rp->r_statelock);
2333 
2334         /*
2335          * If this file type is one for which no explicit 'open' was
2336          * done, then bail now (ie. no need for protocol 'close'). If
2337          * there was an error w/the vm subsystem, return _that_ error,
2338          * otherwise, return any errors that may've been reported via
2339          * the rnode.
2340          */
2341         if (vp->v_type != VREG)
2342                 return (error ? error : r_error);
2343 
2344         /*
2345          * The sync putpage commit may have failed above, but since
2346          * we're working w/a regular file, we need to do the protocol
2347          * 'close' (nfs4close_one will figure out if an otw close is
2348          * needed or not). Report any errors _after_ doing the protocol
2349          * 'close'.
2350          */
2351         nfs4close_one(vp, NULL, cr, flag, NULL, &e, CLOSE_NORM, 0, 0, 0);
2352         n4error = e.error ? e.error : geterrno4(e.stat);
2353 
2354         /*
2355          * Error reporting prio (Hi -> Lo)
2356          *
2357          *   i) nfs4_putpage_commit (error)
2358          *  ii) rnode's (r_error)
2359          * iii) nfs4close_one (n4error)
2360          */
2361         return (error ? error : (r_error ? r_error : n4error));
2362 }
2363 
2364 /*
2365  * Initialize *lost_rqstp.
2366  */
2367 
2368 static void
2369 nfs4close_save_lost_rqst(int error, nfs4_lost_rqst_t *lost_rqstp,
2370     nfs4_open_owner_t *oop, nfs4_open_stream_t *osp, cred_t *cr,
2371     vnode_t *vp)
2372 {
2373         if (error != ETIMEDOUT && error != EINTR &&
2374             !NFS4_FRC_UNMT_ERR(error, vp->v_vfsp)) {
2375                 lost_rqstp->lr_op = 0;
2376                 return;
2377         }
2378 
2379         NFS4_DEBUG(nfs4_lost_rqst_debug, (CE_NOTE,
2380             "nfs4close_save_lost_rqst: error %d", error));
2381 
2382         lost_rqstp->lr_op = OP_CLOSE;
2383         /*
2384          * The vp is held and rele'd via the recovery code.
2385          * See nfs4_save_lost_rqst.
2386          */
2387         lost_rqstp->lr_vp = vp;
2388         lost_rqstp->lr_dvp = NULL;
2389         lost_rqstp->lr_oop = oop;
2390         lost_rqstp->lr_osp = osp;
2391         ASSERT(osp != NULL);
2392         ASSERT(mutex_owned(&osp->os_sync_lock));
2393         osp->os_pending_close = 1;
2394         lost_rqstp->lr_lop = NULL;
2395         lost_rqstp->lr_cr = cr;
2396         lost_rqstp->lr_flk = NULL;
2397         lost_rqstp->lr_putfirst = FALSE;
2398 }
2399 
2400 /*
2401  * Assumes you already have the open seqid sync grabbed as well as the
2402  * 'os_sync_lock'.  Note: this will release the open seqid sync and
2403  * 'os_sync_lock' if client recovery starts.  Calling functions have to
2404  * be prepared to handle this.
2405  *
2406  * 'recov' is returned as 1 if the CLOSE operation detected client recovery
2407  * was needed and was started, and that the calling function should retry
2408  * this function; otherwise it is returned as 0.
2409  *
2410  * Errors are returned via the nfs4_error_t parameter.
2411  */
2412 static void
2413 nfs4close_otw(rnode4_t *rp, cred_t *cred_otw, nfs4_open_owner_t *oop,
2414     nfs4_open_stream_t *osp, int *recov, int *did_start_seqid_syncp,
2415     nfs4_close_type_t close_type, nfs4_error_t *ep, int *have_sync_lockp)
2416 {
2417         COMPOUND4args_clnt args;
2418         COMPOUND4res_clnt res;
2419         CLOSE4args *close_args;
2420         nfs_resop4 *resop;
2421         nfs_argop4 argop[3];
2422         int doqueue = 1;
2423         mntinfo4_t *mi;
2424         seqid4 seqid;
2425         vnode_t *vp;
2426         bool_t needrecov = FALSE;
2427         nfs4_lost_rqst_t lost_rqst;
2428         hrtime_t t;
2429 
2430         ASSERT(nfs_zone() == VTOMI4(RTOV4(rp))->mi_zone);
2431 
2432         ASSERT(MUTEX_HELD(&osp->os_sync_lock));
2433 
2434         NFS4_DEBUG(nfs4_client_state_debug, (CE_NOTE, "nfs4close_otw"));
2435 
2436         /* Only set this to 1 if recovery is started */
2437         *recov = 0;
2438 
2439         /* do the OTW call to close the file */
2440 
2441         if (close_type == CLOSE_RESEND)
2442                 args.ctag = TAG_CLOSE_LOST;
2443         else if (close_type == CLOSE_AFTER_RESEND)
2444                 args.ctag = TAG_CLOSE_UNDO;
2445         else
2446                 args.ctag = TAG_CLOSE;
2447 
2448         args.array_len = 3;
2449         args.array = argop;
2450 
2451         vp = RTOV4(rp);
2452 
2453         mi = VTOMI4(vp);
2454 
2455         /* putfh target fh */
2456         argop[0].argop = OP_CPUTFH;
2457         argop[0].nfs_argop4_u.opcputfh.sfh = rp->r_fh;
2458 
2459         argop[1].argop = OP_GETATTR;
2460         argop[1].nfs_argop4_u.opgetattr.attr_request = NFS4_VATTR_MASK;
2461         argop[1].nfs_argop4_u.opgetattr.mi = mi;
2462 
2463         argop[2].argop = OP_CLOSE;
2464         close_args = &argop[2].nfs_argop4_u.opclose;
2465 
2466         seqid = nfs4_get_open_seqid(oop) + 1;
2467 
2468         close_args->seqid = seqid;
2469         close_args->open_stateid = osp->open_stateid;
2470 
2471         NFS4_DEBUG(nfs4_client_call_debug, (CE_NOTE,
2472             "nfs4close_otw: %s call, rp %s", needrecov ? "recov" : "first",
2473             rnode4info(rp)));
2474 
2475         t = gethrtime();
2476 
2477         rfs4call(mi, &args, &res, cred_otw, &doqueue, 0, ep);
2478 
2479         if (!ep->error && nfs4_need_to_bump_seqid(&res)) {
2480                 nfs4_set_open_seqid(seqid, oop, args.ctag);
2481         }
2482 
2483         needrecov = nfs4_needs_recovery(ep, TRUE, mi->mi_vfsp);
2484         if (ep->error && !needrecov) {
2485                 /*
2486                  * if there was an error and no recovery is to be done
2487                  * then then set up the file to flush its cache if
2488                  * needed for the next caller.
2489                  */
2490                 mutex_enter(&rp->r_statelock);
2491                 PURGE_ATTRCACHE4_LOCKED(rp);
2492                 rp->r_flags &= ~R4WRITEMODIFIED;
2493                 mutex_exit(&rp->r_statelock);
2494                 return;
2495         }
2496 
2497         if (needrecov) {
2498                 bool_t abort;
2499                 nfs4_bseqid_entry_t *bsep = NULL;
2500 
2501                 if (close_type != CLOSE_RESEND)
2502                         nfs4close_save_lost_rqst(ep->error, &lost_rqst, oop,
2503                             osp, cred_otw, vp);
2504 
2505                 if (!ep->error && res.status == NFS4ERR_BAD_SEQID)
2506                         bsep = nfs4_create_bseqid_entry(oop, NULL, vp,
2507                             0, args.ctag, close_args->seqid);
2508 
2509                 NFS4_DEBUG(nfs4_client_recov_debug, (CE_NOTE,
2510                     "nfs4close_otw: initiating recovery. error %d "
2511                     "res.status %d", ep->error, res.status));
2512 
2513                 /*
2514                  * Drop the 'os_sync_lock' here so we don't hit
2515                  * a potential recursive mutex_enter via an
2516                  * 'open_stream_hold()'.
2517                  */
2518                 mutex_exit(&osp->os_sync_lock);
2519                 *have_sync_lockp = 0;
2520                 abort = nfs4_start_recovery(ep, VTOMI4(vp), vp, NULL, NULL,
2521                     (close_type != CLOSE_RESEND &&
2522                     lost_rqst.lr_op == OP_CLOSE) ? &lost_rqst : NULL,
2523                     OP_CLOSE, bsep, NULL, NULL);
2524 
2525                 /* drop open seq sync, and let the calling function regrab it */
2526                 nfs4_end_open_seqid_sync(oop);
2527                 *did_start_seqid_syncp = 0;
2528 
2529                 if (bsep)
2530                         kmem_free(bsep, sizeof (*bsep));
2531                 /*
2532                  * For signals, the caller wants to quit, so don't say to
2533                  * retry.  For forced unmount, if it's a user thread, it
2534                  * wants to quit.  If it's a recovery thread, the retry
2535                  * will happen higher-up on the call stack.  Either way,
2536                  * don't say to retry.
2537                  */
2538                 if (abort == FALSE && ep->error != EINTR &&
2539                     !NFS4_FRC_UNMT_ERR(ep->error, mi->mi_vfsp) &&
2540                     close_type != CLOSE_RESEND &&
2541                     close_type != CLOSE_AFTER_RESEND)
2542                         *recov = 1;
2543                 else
2544                         *recov = 0;
2545 
2546                 if (!ep->error)
2547                         (void) xdr_free(xdr_COMPOUND4res_clnt, (caddr_t)&res);
2548                 return;
2549         }
2550 
2551         if (res.status) {
2552                 (void) xdr_free(xdr_COMPOUND4res_clnt, (caddr_t)&res);
2553                 return;
2554         }
2555 
2556         mutex_enter(&rp->r_statev4_lock);
2557         rp->created_v4 = 0;
2558         mutex_exit(&rp->r_statev4_lock);
2559 
2560         resop = &res.array[2];
2561         osp->open_stateid = resop->nfs_resop4_u.opclose.open_stateid;
2562         osp->os_valid = 0;
2563 
2564         /*
2565          * This removes the reference obtained at OPEN; ie, when the
2566          * open stream structure was created.
2567          *
2568          * We don't have to worry about calling 'open_stream_rele'
2569          * since we our currently holding a reference to the open
2570          * stream which means the count cannot go to 0 with this
2571          * decrement.
2572          */
2573         ASSERT(osp->os_ref_count >= 2);
2574         osp->os_ref_count--;
2575 
2576         if (!ep->error)
2577                 nfs4_attr_cache(vp,
2578                     &res.array[1].nfs_resop4_u.opgetattr.ga_res,
2579                     t, cred_otw, TRUE, NULL);
2580 
2581         NFS4_DEBUG(nfs4_client_state_debug, (CE_NOTE, "nfs4close_otw:"
2582             " returning %d", ep->error));
2583 
2584         (void) xdr_free(xdr_COMPOUND4res_clnt, (caddr_t)&res);
2585 }
2586 
2587 /* ARGSUSED */
2588 static int
2589 nfs4_read(vnode_t *vp, struct uio *uiop, int ioflag, cred_t *cr,
2590     caller_context_t *ct)
2591 {
2592         rnode4_t *rp;
2593         u_offset_t off;
2594         offset_t diff;
2595         uint_t on;
2596         uint_t n;
2597         caddr_t base;
2598         uint_t flags;
2599         int error;
2600         mntinfo4_t *mi;
2601 
2602         rp = VTOR4(vp);
2603 
2604         ASSERT(nfs_rw_lock_held(&rp->r_rwlock, RW_READER));
2605 
2606         if (IS_SHADOW(vp, rp))
2607                 vp = RTOV4(rp);
2608 
2609         if (vp->v_type != VREG)
2610                 return (EISDIR);
2611 
2612         mi = VTOMI4(vp);
2613 
2614         if (nfs_zone() != mi->mi_zone)
2615                 return (EIO);
2616 
2617         if (uiop->uio_resid == 0)
2618                 return (0);
2619 
2620         if (uiop->uio_loffset < 0 || uiop->uio_loffset + uiop->uio_resid < 0)
2621                 return (EINVAL);
2622 
2623         mutex_enter(&rp->r_statelock);
2624         if (rp->r_flags & R4RECOVERRP)
2625                 error = (rp->r_error ? rp->r_error : EIO);
2626         else
2627                 error = 0;
2628         mutex_exit(&rp->r_statelock);
2629         if (error)
2630                 return (error);
2631 
2632         /*
2633          * Bypass VM if caching has been disabled (e.g., locking) or if
2634          * using client-side direct I/O and the file is not mmap'd and
2635          * there are no cached pages.
2636          */
2637         if ((vp->v_flag & VNOCACHE) ||
2638             (((rp->r_flags & R4DIRECTIO) || (mi->mi_flags & MI4_DIRECTIO)) &&
2639             rp->r_mapcnt == 0 && rp->r_inmap == 0 && !nfs4_has_pages(vp))) {
2640                 size_t resid = 0;
2641 
2642                 return (nfs4read(vp, NULL, uiop->uio_loffset,
2643                     uiop->uio_resid, &resid, cr, FALSE, uiop));
2644         }
2645 
2646         error = 0;
2647 
2648         do {
2649                 off = uiop->uio_loffset & MAXBMASK; /* mapping offset */
2650                 on = uiop->uio_loffset & MAXBOFFSET; /* Relative offset */
2651                 n = MIN(MAXBSIZE - on, uiop->uio_resid);
2652 
2653                 if (error = nfs4_validate_caches(vp, cr))
2654                         break;
2655 
2656                 mutex_enter(&rp->r_statelock);
2657                 while (rp->r_flags & R4INCACHEPURGE) {
2658                         if (!cv_wait_sig(&rp->r_cv, &rp->r_statelock)) {
2659                                 mutex_exit(&rp->r_statelock);
2660                                 return (EINTR);
2661                         }
2662                 }
2663                 diff = rp->r_size - uiop->uio_loffset;
2664                 mutex_exit(&rp->r_statelock);
2665                 if (diff <= 0)
2666                         break;
2667                 if (diff < n)
2668                         n = (uint_t)diff;
2669 
2670                 if (vpm_enable) {
2671                         /*
2672                          * Copy data.
2673                          */
2674                         error = vpm_data_copy(vp, off + on, n, uiop,
2675                             1, NULL, 0, S_READ);
2676                 } else {
2677                         base = segmap_getmapflt(segkmap, vp, off + on, n, 1,
2678                             S_READ);
2679 
2680                         error = uiomove(base + on, n, UIO_READ, uiop);
2681                 }
2682 
2683                 if (!error) {
2684                         /*
2685                          * If read a whole block or read to eof,
2686                          * won't need this buffer again soon.
2687                          */
2688                         mutex_enter(&rp->r_statelock);
2689                         if (n + on == MAXBSIZE ||
2690                             uiop->uio_loffset == rp->r_size)
2691                                 flags = SM_DONTNEED;
2692                         else
2693                                 flags = 0;
2694                         mutex_exit(&rp->r_statelock);
2695                         if (vpm_enable) {
2696                                 error = vpm_sync_pages(vp, off, n, flags);
2697                         } else {
2698                                 error = segmap_release(segkmap, base, flags);
2699                         }
2700                 } else {
2701                         if (vpm_enable) {
2702                                 (void) vpm_sync_pages(vp, off, n, 0);
2703                         } else {
2704                                 (void) segmap_release(segkmap, base, 0);
2705                         }
2706                 }
2707         } while (!error && uiop->uio_resid > 0);
2708 
2709         return (error);
2710 }
2711 
2712 /* ARGSUSED */
2713 static int
2714 nfs4_write(vnode_t *vp, struct uio *uiop, int ioflag, cred_t *cr,
2715     caller_context_t *ct)
2716 {
2717         rlim64_t limit = uiop->uio_llimit;
2718         rnode4_t *rp;
2719         u_offset_t off;
2720         caddr_t base;
2721         uint_t flags;
2722         int remainder;
2723         size_t n;
2724         int on;
2725         int error;
2726         int resid;
2727         u_offset_t offset;
2728         mntinfo4_t *mi;
2729         uint_t bsize;
2730 
2731         rp = VTOR4(vp);
2732 
2733         if (IS_SHADOW(vp, rp))
2734                 vp = RTOV4(rp);
2735 
2736         if (vp->v_type != VREG)
2737                 return (EISDIR);
2738 
2739         mi = VTOMI4(vp);
2740 
2741         if (nfs_zone() != mi->mi_zone)
2742                 return (EIO);
2743 
2744         if (uiop->uio_resid == 0)
2745                 return (0);
2746 
2747         mutex_enter(&rp->r_statelock);
2748         if (rp->r_flags & R4RECOVERRP)
2749                 error = (rp->r_error ? rp->r_error : EIO);
2750         else
2751                 error = 0;
2752         mutex_exit(&rp->r_statelock);
2753         if (error)
2754                 return (error);
2755 
2756         if (ioflag & FAPPEND) {
2757                 struct vattr va;
2758 
2759                 /*
2760                  * Must serialize if appending.
2761                  */
2762                 if (nfs_rw_lock_held(&rp->r_rwlock, RW_READER)) {
2763                         nfs_rw_exit(&rp->r_rwlock);
2764                         if (nfs_rw_enter_sig(&rp->r_rwlock, RW_WRITER,
2765                             INTR4(vp)))
2766                                 return (EINTR);
2767                 }
2768 
2769                 va.va_mask = AT_SIZE;
2770                 error = nfs4getattr(vp, &va, cr);
2771                 if (error)
2772                         return (error);
2773                 uiop->uio_loffset = va.va_size;
2774         }
2775 
2776         offset = uiop->uio_loffset + uiop->uio_resid;
2777 
2778         if (uiop->uio_loffset < (offset_t)0 || offset < 0)
2779                 return (EINVAL);
2780 
2781         if (limit == RLIM64_INFINITY || limit > MAXOFFSET_T)
2782                 limit = MAXOFFSET_T;
2783 
2784         /*
2785          * Check to make sure that the process will not exceed
2786          * its limit on file size.  It is okay to write up to
2787          * the limit, but not beyond.  Thus, the write which
2788          * reaches the limit will be short and the next write
2789          * will return an error.
2790          */
2791         remainder = 0;
2792         if (offset > uiop->uio_llimit) {
2793                 remainder = offset - uiop->uio_llimit;
2794                 uiop->uio_resid = uiop->uio_llimit - uiop->uio_loffset;
2795                 if (uiop->uio_resid <= 0) {
2796                         proc_t *p = ttoproc(curthread);
2797 
2798                         uiop->uio_resid += remainder;
2799                         mutex_enter(&p->p_lock);
2800                         (void) rctl_action(rctlproc_legacy[RLIMIT_FSIZE],
2801                             p->p_rctls, p, RCA_UNSAFE_SIGINFO);
2802                         mutex_exit(&p->p_lock);
2803                         return (EFBIG);
2804                 }
2805         }
2806 
2807         /* update the change attribute, if we have a write delegation */
2808 
2809         mutex_enter(&rp->r_statev4_lock);
2810         if (rp->r_deleg_type == OPEN_DELEGATE_WRITE)
2811                 rp->r_deleg_change++;
2812 
2813         mutex_exit(&rp->r_statev4_lock);
2814 
2815         if (nfs_rw_enter_sig(&rp->r_lkserlock, RW_READER, INTR4(vp)))
2816                 return (EINTR);
2817 
2818         /*
2819          * Bypass VM if caching has been disabled (e.g., locking) or if
2820          * using client-side direct I/O and the file is not mmap'd and
2821          * there are no cached pages.
2822          */
2823         if ((vp->v_flag & VNOCACHE) ||
2824             (((rp->r_flags & R4DIRECTIO) || (mi->mi_flags & MI4_DIRECTIO)) &&
2825             rp->r_mapcnt == 0 && rp->r_inmap == 0 && !nfs4_has_pages(vp))) {
2826                 size_t bufsize;
2827                 int count;
2828                 u_offset_t org_offset;
2829                 stable_how4 stab_comm;
2830 nfs4_fwrite:
2831                 if (rp->r_flags & R4STALE) {
2832                         resid = uiop->uio_resid;
2833                         offset = uiop->uio_loffset;
2834                         error = rp->r_error;
2835                         /*
2836                          * A close may have cleared r_error, if so,
2837                          * propagate ESTALE error return properly
2838                          */
2839                         if (error == 0)
2840                                 error = ESTALE;
2841                         goto bottom;
2842                 }
2843 
2844                 bufsize = MIN(uiop->uio_resid, mi->mi_stsize);
2845                 base = kmem_alloc(bufsize, KM_SLEEP);
2846                 do {
2847                         if (ioflag & FDSYNC)
2848                                 stab_comm = DATA_SYNC4;
2849                         else
2850                                 stab_comm = FILE_SYNC4;
2851                         resid = uiop->uio_resid;
2852                         offset = uiop->uio_loffset;
2853                         count = MIN(uiop->uio_resid, bufsize);
2854                         org_offset = uiop->uio_loffset;
2855                         error = uiomove(base, count, UIO_WRITE, uiop);
2856                         if (!error) {
2857                                 error = nfs4write(vp, base, org_offset,
2858                                     count, cr, &stab_comm);
2859                                 if (!error) {
2860                                         mutex_enter(&rp->r_statelock);
2861                                         if (rp->r_size < uiop->uio_loffset)
2862                                                 rp->r_size = uiop->uio_loffset;
2863                                         mutex_exit(&rp->r_statelock);
2864                                 }
2865                         }
2866                 } while (!error && uiop->uio_resid > 0);
2867                 kmem_free(base, bufsize);
2868                 goto bottom;
2869         }
2870 
2871         bsize = vp->v_vfsp->vfs_bsize;
2872 
2873         do {
2874                 off = uiop->uio_loffset & MAXBMASK; /* mapping offset */
2875                 on = uiop->uio_loffset & MAXBOFFSET; /* Relative offset */
2876                 n = MIN(MAXBSIZE - on, uiop->uio_resid);
2877 
2878                 resid = uiop->uio_resid;
2879                 offset = uiop->uio_loffset;
2880 
2881                 if (rp->r_flags & R4STALE) {
2882                         error = rp->r_error;
2883                         /*
2884                          * A close may have cleared r_error, if so,
2885                          * propagate ESTALE error return properly
2886                          */
2887                         if (error == 0)
2888                                 error = ESTALE;
2889                         break;
2890                 }
2891 
2892                 /*
2893                  * Don't create dirty pages faster than they
2894                  * can be cleaned so that the system doesn't
2895                  * get imbalanced.  If the async queue is
2896                  * maxed out, then wait for it to drain before
2897                  * creating more dirty pages.  Also, wait for
2898                  * any threads doing pagewalks in the vop_getattr
2899                  * entry points so that they don't block for
2900                  * long periods.
2901                  */
2902                 mutex_enter(&rp->r_statelock);
2903                 while ((mi->mi_max_threads != 0 &&
2904                     rp->r_awcount > 2 * mi->mi_max_threads) ||
2905                     rp->r_gcount > 0) {
2906                         if (INTR4(vp)) {
2907                                 klwp_t *lwp = ttolwp(curthread);
2908 
2909                                 if (lwp != NULL)
2910                                         lwp->lwp_nostop++;
2911                                 if (!cv_wait_sig(&rp->r_cv, &rp->r_statelock)) {
2912                                         mutex_exit(&rp->r_statelock);
2913                                         if (lwp != NULL)
2914                                                 lwp->lwp_nostop--;
2915                                         error = EINTR;
2916                                         goto bottom;
2917                                 }
2918                                 if (lwp != NULL)
2919                                         lwp->lwp_nostop--;
2920                         } else
2921                                 cv_wait(&rp->r_cv, &rp->r_statelock);
2922                 }
2923                 mutex_exit(&rp->r_statelock);
2924 
2925                 /*
2926                  * Touch the page and fault it in if it is not in core
2927                  * before segmap_getmapflt or vpm_data_copy can lock it.
2928                  * This is to avoid the deadlock if the buffer is mapped
2929                  * to the same file through mmap which we want to write.
2930                  */
2931                 uio_prefaultpages((long)n, uiop);
2932 
2933                 if (vpm_enable) {
2934                         /*
2935                          * It will use kpm mappings, so no need to
2936                          * pass an address.
2937                          */
2938                         error = writerp4(rp, NULL, n, uiop, 0);
2939                 } else  {
2940                         if (segmap_kpm) {
2941                                 int pon = uiop->uio_loffset & PAGEOFFSET;
2942                                 size_t pn = MIN(PAGESIZE - pon,
2943                                     uiop->uio_resid);
2944                                 int pagecreate;
2945 
2946                                 mutex_enter(&rp->r_statelock);
2947                                 pagecreate = (pon == 0) && (pn == PAGESIZE ||
2948                                     uiop->uio_loffset + pn >= rp->r_size);
2949                                 mutex_exit(&rp->r_statelock);
2950 
2951                                 base = segmap_getmapflt(segkmap, vp, off + on,
2952                                     pn, !pagecreate, S_WRITE);
2953 
2954                                 error = writerp4(rp, base + pon, n, uiop,
2955                                     pagecreate);
2956 
2957                         } else {
2958                                 base = segmap_getmapflt(segkmap, vp, off + on,
2959                                     n, 0, S_READ);
2960                                 error = writerp4(rp, base + on, n, uiop, 0);
2961                         }
2962                 }
2963 
2964                 if (!error) {
2965                         if (mi->mi_flags & MI4_NOAC)
2966                                 flags = SM_WRITE;
2967                         else if ((uiop->uio_loffset % bsize) == 0 ||
2968                             IS_SWAPVP(vp)) {
2969                                 /*
2970                                  * Have written a whole block.
2971                                  * Start an asynchronous write
2972                                  * and mark the buffer to
2973                                  * indicate that it won't be
2974                                  * needed again soon.
2975                                  */
2976                                 flags = SM_WRITE | SM_ASYNC | SM_DONTNEED;
2977                         } else
2978                                 flags = 0;
2979                         if ((ioflag & (FSYNC|FDSYNC)) ||
2980                             (rp->r_flags & R4OUTOFSPACE)) {
2981                                 flags &= ~SM_ASYNC;
2982                                 flags |= SM_WRITE;
2983                         }
2984                         if (vpm_enable) {
2985                                 error = vpm_sync_pages(vp, off, n, flags);
2986                         } else {
2987                                 error = segmap_release(segkmap, base, flags);
2988                         }
2989                 } else {
2990                         if (vpm_enable) {
2991                                 (void) vpm_sync_pages(vp, off, n, 0);
2992                         } else {
2993                                 (void) segmap_release(segkmap, base, 0);
2994                         }
2995                         /*
2996                          * In the event that we got an access error while
2997                          * faulting in a page for a write-only file just
2998                          * force a write.
2999                          */
3000                         if (error == EACCES)
3001                                 goto nfs4_fwrite;
3002                 }
3003         } while (!error && uiop->uio_resid > 0);
3004 
3005 bottom:
3006         if (error) {
3007                 uiop->uio_resid = resid + remainder;
3008                 uiop->uio_loffset = offset;
3009         } else {
3010                 uiop->uio_resid += remainder;
3011 
3012                 mutex_enter(&rp->r_statev4_lock);
3013                 if (rp->r_deleg_type == OPEN_DELEGATE_WRITE) {
3014                         gethrestime(&rp->r_attr.va_mtime);
3015                         rp->r_attr.va_ctime = rp->r_attr.va_mtime;
3016                 }
3017                 mutex_exit(&rp->r_statev4_lock);
3018         }
3019 
3020         nfs_rw_exit(&rp->r_lkserlock);
3021 
3022         return (error);
3023 }
3024 
3025 /*
3026  * Flags are composed of {B_ASYNC, B_INVAL, B_FREE, B_DONTNEED}
3027  */
3028 static int
3029 nfs4_rdwrlbn(vnode_t *vp, page_t *pp, u_offset_t off, size_t len,
3030     int flags, cred_t *cr)
3031 {
3032         struct buf *bp;
3033         int error;
3034         page_t *savepp;
3035         uchar_t fsdata;
3036         stable_how4 stab_comm;
3037 
3038         ASSERT(nfs_zone() == VTOMI4(vp)->mi_zone);
3039         bp = pageio_setup(pp, len, vp, flags);
3040         ASSERT(bp != NULL);
3041 
3042         /*
3043          * pageio_setup should have set b_addr to 0.  This
3044          * is correct since we want to do I/O on a page
3045          * boundary.  bp_mapin will use this addr to calculate
3046          * an offset, and then set b_addr to the kernel virtual
3047          * address it allocated for us.
3048          */
3049         ASSERT(bp->b_un.b_addr == 0);
3050 
3051         bp->b_edev = 0;
3052         bp->b_dev = 0;
3053         bp->b_lblkno = lbtodb(off);
3054         bp->b_file = vp;
3055         bp->b_offset = (offset_t)off;
3056         bp_mapin(bp);
3057 
3058         if ((flags & (B_WRITE|B_ASYNC)) == (B_WRITE|B_ASYNC) &&
3059             freemem > desfree)
3060                 stab_comm = UNSTABLE4;
3061         else
3062                 stab_comm = FILE_SYNC4;
3063 
3064         error = nfs4_bio(bp, &stab_comm, cr, FALSE);
3065 
3066         bp_mapout(bp);
3067         pageio_done(bp);
3068 
3069         if (stab_comm == UNSTABLE4)
3070                 fsdata = C_DELAYCOMMIT;
3071         else
3072                 fsdata = C_NOCOMMIT;
3073 
3074         savepp = pp;
3075         do {
3076                 pp->p_fsdata = fsdata;
3077         } while ((pp = pp->p_next) != savepp);
3078 
3079         return (error);
3080 }
3081 
3082 /*
3083  */
3084 static int
3085 nfs4rdwr_check_osid(vnode_t *vp, nfs4_error_t *ep, cred_t *cr)
3086 {
3087         nfs4_open_owner_t       *oop;
3088         nfs4_open_stream_t      *osp;
3089         rnode4_t                *rp = VTOR4(vp);
3090         mntinfo4_t              *mi = VTOMI4(vp);
3091         int                     reopen_needed;
3092 
3093         ASSERT(nfs_zone() == mi->mi_zone);
3094 
3095 
3096         oop = find_open_owner(cr, NFS4_PERM_CREATED, mi);
3097         if (!oop)
3098                 return (EIO);
3099 
3100         /* returns with 'os_sync_lock' held */
3101         osp = find_open_stream(oop, rp);
3102         if (!osp) {
3103                 open_owner_rele(oop);
3104                 return (EIO);
3105         }
3106 
3107         if (osp->os_failed_reopen) {
3108                 mutex_exit(&osp->os_sync_lock);
3109                 open_stream_rele(osp, rp);
3110                 open_owner_rele(oop);
3111                 return (EIO);
3112         }
3113 
3114         /*
3115          * Determine whether a reopen is needed.  If this
3116          * is a delegation open stream, then the os_delegation bit
3117          * should be set.
3118          */
3119 
3120         reopen_needed = osp->os_delegation;
3121 
3122         mutex_exit(&osp->os_sync_lock);
3123         open_owner_rele(oop);
3124 
3125         if (reopen_needed) {
3126                 nfs4_error_zinit(ep);
3127                 nfs4_reopen(vp, osp, ep, CLAIM_NULL, FALSE, FALSE);
3128                 mutex_enter(&osp->os_sync_lock);
3129                 if (ep->error || ep->stat || osp->os_failed_reopen) {
3130                         mutex_exit(&osp->os_sync_lock);
3131                         open_stream_rele(osp, rp);
3132                         return (EIO);
3133                 }
3134                 mutex_exit(&osp->os_sync_lock);
3135         }
3136         open_stream_rele(osp, rp);
3137 
3138         return (0);
3139 }
3140 
3141 /*
3142  * Write to file.  Writes to remote server in largest size
3143  * chunks that the server can handle.  Write is synchronous.
3144  */
3145 static int
3146 nfs4write(vnode_t *vp, caddr_t base, u_offset_t offset, int count, cred_t *cr,
3147     stable_how4 *stab_comm)
3148 {
3149         mntinfo4_t *mi;
3150         COMPOUND4args_clnt args;
3151         COMPOUND4res_clnt res;
3152         WRITE4args *wargs;
3153         WRITE4res *wres;
3154         nfs_argop4 argop[2];
3155         nfs_resop4 *resop;
3156         int tsize;
3157         stable_how4 stable;
3158         rnode4_t *rp;
3159         int doqueue = 1;
3160         bool_t needrecov;
3161         nfs4_recov_state_t recov_state;
3162         nfs4_stateid_types_t sid_types;
3163         nfs4_error_t e = { 0, NFS4_OK, RPC_SUCCESS };
3164         int recov;
3165 
3166         rp = VTOR4(vp);
3167         mi = VTOMI4(vp);
3168 
3169         ASSERT(nfs_zone() == mi->mi_zone);
3170 
3171         stable = *stab_comm;
3172         *stab_comm = FILE_SYNC4;
3173 
3174         needrecov = FALSE;
3175         recov_state.rs_flags = 0;
3176         recov_state.rs_num_retry_despite_err = 0;
3177         nfs4_init_stateid_types(&sid_types);
3178 
3179         /* Is curthread the recovery thread? */
3180         mutex_enter(&mi->mi_lock);
3181         recov = (mi->mi_recovthread == curthread);
3182         mutex_exit(&mi->mi_lock);
3183 
3184 recov_retry:
3185         args.ctag = TAG_WRITE;
3186         args.array_len = 2;
3187         args.array = argop;
3188 
3189         if (!recov) {
3190                 e.error = nfs4_start_fop(VTOMI4(vp), vp, NULL, OH_WRITE,
3191                     &recov_state, NULL);
3192                 if (e.error)
3193                         return (e.error);
3194         }
3195 
3196         /* 0. putfh target fh */
3197         argop[0].argop = OP_CPUTFH;
3198         argop[0].nfs_argop4_u.opcputfh.sfh = rp->r_fh;
3199 
3200         /* 1. write */
3201         nfs4args_write(&argop[1], stable, rp, cr, &wargs, &sid_types);
3202 
3203         do {
3204 
3205                 wargs->offset = (offset4)offset;
3206                 wargs->data_val = base;
3207 
3208                 if (mi->mi_io_kstats) {
3209                         mutex_enter(&mi->mi_lock);
3210                         kstat_runq_enter(KSTAT_IO_PTR(mi->mi_io_kstats));
3211                         mutex_exit(&mi->mi_lock);
3212                 }
3213 
3214                 if ((vp->v_flag & VNOCACHE) ||
3215                     (rp->r_flags & R4DIRECTIO) ||
3216                     (mi->mi_flags & MI4_DIRECTIO))
3217                         tsize = MIN(mi->mi_stsize, count);
3218                 else
3219                         tsize = MIN(mi->mi_curwrite, count);
3220                 wargs->data_len = (uint_t)tsize;
3221                 rfs4call(mi, &args, &res, cr, &doqueue, 0, &e);
3222 
3223                 if (mi->mi_io_kstats) {
3224                         mutex_enter(&mi->mi_lock);
3225                         kstat_runq_exit(KSTAT_IO_PTR(mi->mi_io_kstats));
3226                         mutex_exit(&mi->mi_lock);
3227                 }
3228 
3229                 if (!recov) {
3230                         needrecov = nfs4_needs_recovery(&e, FALSE, mi->mi_vfsp);
3231                         if (e.error && !needrecov) {
3232                                 nfs4_end_fop(VTOMI4(vp), vp, NULL, OH_WRITE,
3233                                     &recov_state, needrecov);
3234                                 return (e.error);
3235                         }
3236                 } else {
3237                         if (e.error)
3238                                 return (e.error);
3239                 }
3240 
3241                 /*
3242                  * Do handling of OLD_STATEID outside
3243                  * of the normal recovery framework.
3244                  *
3245                  * If write receives a BAD stateid error while using a
3246                  * delegation stateid, retry using the open stateid (if it
3247                  * exists).  If it doesn't have an open stateid, reopen the
3248                  * file first, then retry.
3249                  */
3250                 if (!e.error && res.status == NFS4ERR_OLD_STATEID &&
3251                     sid_types.cur_sid_type != SPEC_SID) {
3252                         nfs4_save_stateid(&wargs->stateid, &sid_types);
3253                         if (!recov)
3254                                 nfs4_end_fop(VTOMI4(vp), vp, NULL, OH_WRITE,
3255                                     &recov_state, needrecov);
3256                         (void) xdr_free(xdr_COMPOUND4res_clnt, (caddr_t)&res);
3257                         goto recov_retry;
3258                 } else if (e.error == 0 && res.status == NFS4ERR_BAD_STATEID &&
3259                     sid_types.cur_sid_type == DEL_SID) {
3260                         nfs4_save_stateid(&wargs->stateid, &sid_types);
3261                         mutex_enter(&rp->r_statev4_lock);
3262                         rp->r_deleg_return_pending = TRUE;
3263                         mutex_exit(&rp->r_statev4_lock);
3264                         if (nfs4rdwr_check_osid(vp, &e, cr)) {
3265                                 if (!recov)
3266                                         nfs4_end_fop(mi, vp, NULL, OH_WRITE,
3267                                             &recov_state, needrecov);
3268                                 (void) xdr_free(xdr_COMPOUND4res_clnt,
3269                                     (caddr_t)&res);
3270                                 return (EIO);
3271                         }
3272                         if (!recov)
3273                                 nfs4_end_fop(mi, vp, NULL, OH_WRITE,
3274                                     &recov_state, needrecov);
3275                         /* hold needed for nfs4delegreturn_thread */
3276                         VN_HOLD(vp);
3277                         nfs4delegreturn_async(rp, (NFS4_DR_PUSH|NFS4_DR_REOPEN|
3278                             NFS4_DR_DISCARD), FALSE);
3279                         (void) xdr_free(xdr_COMPOUND4res_clnt, (caddr_t)&res);
3280                         goto recov_retry;
3281                 }
3282 
3283                 if (needrecov) {
3284                         bool_t abort;
3285 
3286                         NFS4_DEBUG(nfs4_client_recov_debug, (CE_NOTE,
3287                             "nfs4write: client got error %d, res.status %d"
3288                             ", so start recovery", e.error, res.status));
3289 
3290                         abort = nfs4_start_recovery(&e,
3291                             VTOMI4(vp), vp, NULL, &wargs->stateid,
3292                             NULL, OP_WRITE, NULL, NULL, NULL);
3293                         if (!e.error) {
3294                                 e.error = geterrno4(res.status);
3295                                 (void) xdr_free(xdr_COMPOUND4res_clnt,
3296                                     (caddr_t)&res);
3297                         }
3298                         nfs4_end_fop(VTOMI4(vp), vp, NULL, OH_WRITE,
3299                             &recov_state, needrecov);
3300                         if (abort == FALSE)
3301                                 goto recov_retry;
3302                         return (e.error);
3303                 }
3304 
3305                 if (res.status) {
3306                         e.error = geterrno4(res.status);
3307                         (void) xdr_free(xdr_COMPOUND4res_clnt, (caddr_t)&res);
3308                         if (!recov)
3309                                 nfs4_end_fop(VTOMI4(vp), vp, NULL, OH_WRITE,
3310                                     &recov_state, needrecov);
3311                         return (e.error);
3312                 }
3313 
3314                 resop = &res.array[1];      /* write res */
3315                 wres = &resop->nfs_resop4_u.opwrite;
3316 
3317                 if ((int)wres->count > tsize) {
3318                         (void) xdr_free(xdr_COMPOUND4res_clnt, (caddr_t)&res);
3319 
3320                         zcmn_err(getzoneid(), CE_WARN,
3321                             "nfs4write: server wrote %u, requested was %u",
3322                             (int)wres->count, tsize);
3323                         if (!recov)
3324                                 nfs4_end_fop(VTOMI4(vp), vp, NULL, OH_WRITE,
3325                                     &recov_state, needrecov);
3326                         return (EIO);
3327                 }
3328                 if (wres->committed == UNSTABLE4) {
3329                         *stab_comm = UNSTABLE4;
3330                         if (wargs->stable == DATA_SYNC4 ||
3331                             wargs->stable == FILE_SYNC4) {
3332                                 (void) xdr_free(xdr_COMPOUND4res_clnt,
3333                                     (caddr_t)&res);
3334                                 zcmn_err(getzoneid(), CE_WARN,
3335                                     "nfs4write: server %s did not commit "
3336                                     "to stable storage",
3337                                     rp->r_server->sv_hostname);
3338                                 if (!recov)
3339                                         nfs4_end_fop(VTOMI4(vp), vp, NULL,
3340                                             OH_WRITE, &recov_state, needrecov);
3341                                 return (EIO);
3342                         }
3343                 }
3344 
3345                 tsize = (int)wres->count;
3346                 count -= tsize;
3347                 base += tsize;
3348                 offset += tsize;
3349                 if (mi->mi_io_kstats) {
3350                         mutex_enter(&mi->mi_lock);
3351                         KSTAT_IO_PTR(mi->mi_io_kstats)->writes++;
3352                         KSTAT_IO_PTR(mi->mi_io_kstats)->nwritten +=
3353                             tsize;
3354                         mutex_exit(&mi->mi_lock);
3355                 }
3356                 lwp_stat_update(LWP_STAT_OUBLK, 1);
3357                 mutex_enter(&rp->r_statelock);
3358                 if (rp->r_flags & R4HAVEVERF) {
3359                         if (rp->r_writeverf != wres->writeverf) {
3360                                 nfs4_set_mod(vp);
3361                                 rp->r_writeverf = wres->writeverf;
3362                         }
3363                 } else {
3364                         rp->r_writeverf = wres->writeverf;
3365                         rp->r_flags |= R4HAVEVERF;
3366                 }
3367                 PURGE_ATTRCACHE4_LOCKED(rp);
3368                 rp->r_flags |= R4WRITEMODIFIED;
3369                 gethrestime(&rp->r_attr.va_mtime);
3370                 rp->r_attr.va_ctime = rp->r_attr.va_mtime;
3371                 mutex_exit(&rp->r_statelock);
3372                 (void) xdr_free(xdr_COMPOUND4res_clnt, (caddr_t)&res);
3373         } while (count);
3374 
3375         if (!recov)
3376                 nfs4_end_fop(VTOMI4(vp), vp, NULL, OH_WRITE, &recov_state,
3377                     needrecov);
3378 
3379         return (e.error);
3380 }
3381 
3382 /*
3383  * Read from a file.  Reads data in largest chunks our interface can handle.
3384  */
3385 static int
3386 nfs4read(vnode_t *vp, caddr_t base, offset_t offset, int count,
3387     size_t *residp, cred_t *cr, bool_t async, struct uio *uiop)
3388 {
3389         mntinfo4_t *mi;
3390         COMPOUND4args_clnt args;
3391         COMPOUND4res_clnt res;
3392         READ4args *rargs;
3393         nfs_argop4 argop[2];
3394         int tsize;
3395         int doqueue;
3396         rnode4_t *rp;
3397         int data_len;
3398         bool_t is_eof;
3399         bool_t needrecov = FALSE;
3400         nfs4_recov_state_t recov_state;
3401         nfs4_stateid_types_t sid_types;
3402         nfs4_error_t e = { 0, NFS4_OK, RPC_SUCCESS };
3403 
3404         rp = VTOR4(vp);
3405         mi = VTOMI4(vp);
3406         doqueue = 1;
3407 
3408         ASSERT(nfs_zone() == mi->mi_zone);
3409 
3410         args.ctag = async ? TAG_READAHEAD : TAG_READ;
3411 
3412         args.array_len = 2;
3413         args.array = argop;
3414 
3415         nfs4_init_stateid_types(&sid_types);
3416 
3417         recov_state.rs_flags = 0;
3418         recov_state.rs_num_retry_despite_err = 0;
3419 
3420 recov_retry:
3421         e.error = nfs4_start_fop(mi, vp, NULL, OH_READ,
3422             &recov_state, NULL);
3423         if (e.error)
3424                 return (e.error);
3425 
3426         /* putfh target fh */
3427         argop[0].argop = OP_CPUTFH;
3428         argop[0].nfs_argop4_u.opcputfh.sfh = rp->r_fh;
3429 
3430         /* read */
3431         argop[1].argop = OP_READ;
3432         rargs = &argop[1].nfs_argop4_u.opread;
3433         rargs->stateid = nfs4_get_stateid(cr, rp, curproc->p_pidp->pid_id, mi,
3434             OP_READ, &sid_types, async);
3435 
3436         do {
3437                 if (mi->mi_io_kstats) {
3438                         mutex_enter(&mi->mi_lock);
3439                         kstat_runq_enter(KSTAT_IO_PTR(mi->mi_io_kstats));
3440                         mutex_exit(&mi->mi_lock);
3441                 }
3442 
3443                 NFS4_DEBUG(nfs4_client_call_debug, (CE_NOTE,
3444                     "nfs4read: %s call, rp %s",
3445                     needrecov ? "recov" : "first",
3446                     rnode4info(rp)));
3447 
3448                 if ((vp->v_flag & VNOCACHE) ||
3449                     (rp->r_flags & R4DIRECTIO) ||
3450                     (mi->mi_flags & MI4_DIRECTIO))
3451                         tsize = MIN(mi->mi_tsize, count);
3452                 else
3453                         tsize = MIN(mi->mi_curread, count);
3454 
3455                 rargs->offset = (offset4)offset;
3456                 rargs->count = (count4)tsize;
3457                 rargs->res_data_val_alt = NULL;
3458                 rargs->res_mblk = NULL;
3459                 rargs->res_uiop = NULL;
3460                 rargs->res_maxsize = 0;
3461                 rargs->wlist = NULL;
3462 
3463                 if (uiop)
3464                         rargs->res_uiop = uiop;
3465                 else
3466                         rargs->res_data_val_alt = base;
3467                 rargs->res_maxsize = tsize;
3468 
3469                 rfs4call(mi, &args, &res, cr, &doqueue, 0, &e);
3470 #ifdef  DEBUG
3471                 if (nfs4read_error_inject) {
3472                         res.status = nfs4read_error_inject;
3473                         nfs4read_error_inject = 0;
3474                 }
3475 #endif
3476 
3477                 if (mi->mi_io_kstats) {
3478                         mutex_enter(&mi->mi_lock);
3479                         kstat_runq_exit(KSTAT_IO_PTR(mi->mi_io_kstats));
3480                         mutex_exit(&mi->mi_lock);
3481                 }
3482 
3483                 needrecov = nfs4_needs_recovery(&e, FALSE, mi->mi_vfsp);
3484                 if (e.error != 0 && !needrecov) {
3485                         nfs4_end_fop(mi, vp, NULL, OH_READ,
3486                             &recov_state, needrecov);
3487                         return (e.error);
3488                 }
3489 
3490                 /*
3491                  * Do proper retry for OLD and BAD stateid errors outside
3492                  * of the normal recovery framework.  There are two differences
3493                  * between async and sync reads.  The first is that we allow
3494                  * retry on BAD_STATEID for async reads, but not sync reads.
3495                  * The second is that we mark the file dead for a failed
3496                  * attempt with a special stateid for sync reads, but just
3497                  * return EIO for async reads.
3498                  *
3499                  * If a sync read receives a BAD stateid error while using a
3500                  * delegation stateid, retry using the open stateid (if it
3501                  * exists).  If it doesn't have an open stateid, reopen the
3502                  * file first, then retry.
3503                  */
3504                 if (e.error == 0 && (res.status == NFS4ERR_OLD_STATEID ||
3505                     res.status == NFS4ERR_BAD_STATEID) && async) {
3506                         nfs4_end_fop(mi, vp, NULL, OH_READ,
3507                             &recov_state, needrecov);
3508                         if (sid_types.cur_sid_type == SPEC_SID) {
3509                                 (void) xdr_free(xdr_COMPOUND4res_clnt,
3510                                     (caddr_t)&res);
3511                                 return (EIO);
3512                         }
3513                         nfs4_save_stateid(&rargs->stateid, &sid_types);
3514                         (void) xdr_free(xdr_COMPOUND4res_clnt, (caddr_t)&res);
3515                         goto recov_retry;
3516                 } else if (e.error == 0 && res.status == NFS4ERR_OLD_STATEID &&
3517                     !async && sid_types.cur_sid_type != SPEC_SID) {
3518                         nfs4_save_stateid(&rargs->stateid, &sid_types);
3519                         nfs4_end_fop(mi, vp, NULL, OH_READ,
3520                             &recov_state, needrecov);
3521                         (void) xdr_free(xdr_COMPOUND4res_clnt, (caddr_t)&res);
3522                         goto recov_retry;
3523                 } else if (e.error == 0 && res.status == NFS4ERR_BAD_STATEID &&
3524                     sid_types.cur_sid_type == DEL_SID) {
3525                         nfs4_save_stateid(&rargs->stateid, &sid_types);
3526                         mutex_enter(&rp->r_statev4_lock);
3527                         rp->r_deleg_return_pending = TRUE;
3528                         mutex_exit(&rp->r_statev4_lock);
3529                         if (nfs4rdwr_check_osid(vp, &e, cr)) {
3530                                 nfs4_end_fop(mi, vp, NULL, OH_READ,
3531                                     &recov_state, needrecov);
3532                                 (void) xdr_free(xdr_COMPOUND4res_clnt,
3533                                     (caddr_t)&res);
3534                                 return (EIO);
3535                         }
3536                         nfs4_end_fop(mi, vp, NULL, OH_READ,
3537                             &recov_state, needrecov);
3538                         /* hold needed for nfs4delegreturn_thread */
3539                         VN_HOLD(vp);
3540                         nfs4delegreturn_async(rp, (NFS4_DR_PUSH|NFS4_DR_REOPEN|
3541                             NFS4_DR_DISCARD), FALSE);
3542                         (void) xdr_free(xdr_COMPOUND4res_clnt, (caddr_t)&res);
3543                         goto recov_retry;
3544                 }
3545                 if (needrecov) {
3546                         bool_t abort;
3547 
3548                         NFS4_DEBUG(nfs4_client_recov_debug, (CE_NOTE,
3549                             "nfs4read: initiating recovery\n"));
3550                         abort = nfs4_start_recovery(&e,
3551                             mi, vp, NULL, &rargs->stateid,
3552                             NULL, OP_READ, NULL, NULL, NULL);
3553                         nfs4_end_fop(mi, vp, NULL, OH_READ,
3554                             &recov_state, needrecov);
3555                         /*
3556                          * Do not retry if we got OLD_STATEID using a special
3557                          * stateid.  This avoids looping with a broken server.
3558                          */
3559                         if (e.error == 0 && res.status == NFS4ERR_OLD_STATEID &&
3560                             sid_types.cur_sid_type == SPEC_SID)
3561                                 abort = TRUE;
3562 
3563                         if (abort == FALSE) {
3564                                 /*
3565                                  * Need to retry all possible stateids in
3566                                  * case the recovery error wasn't stateid
3567                                  * related or the stateids have become
3568                                  * stale (server reboot).
3569                                  */
3570                                 nfs4_init_stateid_types(&sid_types);
3571                                 (void) xdr_free(xdr_COMPOUND4res_clnt,
3572                                     (caddr_t)&res);
3573                                 goto recov_retry;
3574                         }
3575 
3576                         if (!e.error) {
3577                                 e.error = geterrno4(res.status);
3578                                 (void) xdr_free(xdr_COMPOUND4res_clnt,
3579                                     (caddr_t)&res);
3580                         }
3581                         return (e.error);
3582                 }
3583 
3584                 if (res.status) {
3585                         e.error = geterrno4(res.status);
3586                         nfs4_end_fop(mi, vp, NULL, OH_READ,
3587                             &recov_state, needrecov);
3588                         (void) xdr_free(xdr_COMPOUND4res_clnt, (caddr_t)&res);
3589                         return (e.error);
3590                 }
3591 
3592                 data_len = res.array[1].nfs_resop4_u.opread.data_len;
3593                 count -= data_len;
3594                 if (base)
3595                         base += data_len;
3596                 offset += data_len;
3597                 if (mi->mi_io_kstats) {
3598                         mutex_enter(&mi->mi_lock);
3599                         KSTAT_IO_PTR(mi->mi_io_kstats)->reads++;
3600                         KSTAT_IO_PTR(mi->mi_io_kstats)->nread += data_len;
3601                         mutex_exit(&mi->mi_lock);
3602                 }
3603                 lwp_stat_update(LWP_STAT_INBLK, 1);
3604                 is_eof = res.array[1].nfs_resop4_u.opread.eof;
3605                 (void) xdr_free(xdr_COMPOUND4res_clnt, (caddr_t)&res);
3606 
3607         } while (count && !is_eof);
3608 
3609         *residp = count;
3610 
3611         nfs4_end_fop(mi, vp, NULL, OH_READ, &recov_state, needrecov);
3612 
3613         return (e.error);
3614 }
3615 
3616 /* ARGSUSED */
3617 static int
3618 nfs4_ioctl(vnode_t *vp, int cmd, intptr_t arg, int flag, cred_t *cr, int *rvalp,
3619         caller_context_t *ct)
3620 {
3621         if (nfs_zone() != VTOMI4(vp)->mi_zone)
3622                 return (EIO);
3623         switch (cmd) {
3624                 case _FIODIRECTIO:
3625                         return (nfs4_directio(vp, (int)arg, cr));
3626                 default:
3627                         return (ENOTTY);
3628         }
3629 }
3630 
3631 /* ARGSUSED */
3632 int
3633 nfs4_getattr(vnode_t *vp, struct vattr *vap, int flags, cred_t *cr,
3634     caller_context_t *ct)
3635 {
3636         int error;
3637         rnode4_t *rp = VTOR4(vp);
3638 
3639         if (nfs_zone() != VTOMI4(vp)->mi_zone)
3640                 return (EIO);
3641         /*
3642          * If it has been specified that the return value will
3643          * just be used as a hint, and we are only being asked
3644          * for size, fsid or rdevid, then return the client's
3645          * notion of these values without checking to make sure
3646          * that the attribute cache is up to date.
3647          * The whole point is to avoid an over the wire GETATTR
3648          * call.
3649          */
3650         if (flags & ATTR_HINT) {
3651                 if (!(vap->va_mask & ~(AT_SIZE | AT_FSID | AT_RDEV))) {
3652                         mutex_enter(&rp->r_statelock);
3653                         if (vap->va_mask & AT_SIZE)
3654                                 vap->va_size = rp->r_size;
3655                         if (vap->va_mask & AT_FSID)
3656                                 vap->va_fsid = rp->r_attr.va_fsid;
3657                         if (vap->va_mask & AT_RDEV)
3658                                 vap->va_rdev = rp->r_attr.va_rdev;
3659                         mutex_exit(&rp->r_statelock);
3660                         return (0);
3661                 }
3662         }
3663 
3664         /*
3665          * Only need to flush pages if asking for the mtime
3666          * and if there any dirty pages or any outstanding
3667          * asynchronous (write) requests for this file.
3668          */
3669         if (vap->va_mask & AT_MTIME) {
3670                 rp = VTOR4(vp);
3671                 if (nfs4_has_pages(vp)) {
3672                         mutex_enter(&rp->r_statev4_lock);
3673                         if (rp->r_deleg_type != OPEN_DELEGATE_WRITE) {
3674                                 mutex_exit(&rp->r_statev4_lock);
3675                                 if (rp->r_flags & R4DIRTY ||
3676                                     rp->r_awcount > 0) {
3677                                         mutex_enter(&rp->r_statelock);
3678                                         rp->r_gcount++;
3679                                         mutex_exit(&rp->r_statelock);
3680                                         error =
3681                                             nfs4_putpage(vp, (u_offset_t)0,
3682                                             0, 0, cr, NULL);
3683                                         mutex_enter(&rp->r_statelock);
3684                                         if (error && (error == ENOSPC ||
3685                                             error == EDQUOT)) {
3686                                                 if (!rp->r_error)
3687                                                         rp->r_error = error;
3688                                         }
3689                                         if (--rp->r_gcount == 0)
3690                                                 cv_broadcast(&rp->r_cv);
3691                                         mutex_exit(&rp->r_statelock);
3692                                 }
3693                         } else {
3694                                 mutex_exit(&rp->r_statev4_lock);
3695                         }
3696                 }
3697         }
3698         return (nfs4getattr(vp, vap, cr));
3699 }
3700 
3701 int
3702 nfs4_compare_modes(mode_t from_server, mode_t on_client)
3703 {
3704         /*
3705          * If these are the only two bits cleared
3706          * on the server then return 0 (OK) else
3707          * return 1 (BAD).
3708          */
3709         on_client &= ~(S_ISUID|S_ISGID);
3710         if (on_client == from_server)
3711                 return (0);
3712         else
3713                 return (1);
3714 }
3715 
3716 /*ARGSUSED4*/
3717 static int
3718 nfs4_setattr(vnode_t *vp, struct vattr *vap, int flags, cred_t *cr,
3719     caller_context_t *ct)
3720 {
3721         int error;
3722 
3723         if (vap->va_mask & AT_NOSET)
3724                 return (EINVAL);
3725 
3726         if (nfs_zone() != VTOMI4(vp)->mi_zone)
3727                 return (EIO);
3728 
3729         /*
3730          * Don't call secpolicy_vnode_setattr, the client cannot
3731          * use its cached attributes to make security decisions
3732          * as the server may be faking mode bits or mapping uid/gid.
3733          * Always just let the server to the checking.
3734          * If we provide the ability to remove basic priviledges
3735          * to setattr (e.g. basic without chmod) then we will
3736          * need to add a check here before calling the server.
3737          */
3738         error = nfs4setattr(vp, vap, flags, cr, NULL);
3739 
3740         if (error == 0 && (vap->va_mask & AT_SIZE) && vap->va_size == 0)
3741                 vnevent_truncate(vp, ct);
3742 
3743         return (error);
3744 }
3745 
3746 /*
3747  * To replace the "guarded" version 3 setattr, we use two types of compound
3748  * setattr requests:
3749  * 1. The "normal" setattr, used when the size of the file isn't being
3750  *    changed - { Putfh <fh>; Setattr; Getattr }/
3751  * 2. If the size is changed, precede Setattr with: Getattr; Verify
3752  *    with only ctime as the argument. If the server ctime differs from
3753  *    what is cached on the client, the verify will fail, but we would
3754  *    already have the ctime from the preceding getattr, so just set it
3755  *    and retry. Thus the compound here is - { Putfh <fh>; Getattr; Verify;
3756  *      Setattr; Getattr }.
3757  *
3758  * The vsecattr_t * input parameter will be non-NULL if ACLs are being set in
3759  * this setattr and NULL if they are not.
3760  */
3761 static int
3762 nfs4setattr(vnode_t *vp, struct vattr *vap, int flags, cred_t *cr,
3763     vsecattr_t *vsap)
3764 {
3765         COMPOUND4args_clnt args;
3766         COMPOUND4res_clnt res, *resp = NULL;
3767         nfs4_ga_res_t *garp = NULL;
3768         int numops = 3;                 /* { Putfh; Setattr; Getattr } */
3769         nfs_argop4 argop[5];
3770         int verify_argop = -1;
3771         int setattr_argop = 1;
3772         nfs_resop4 *resop;
3773         vattr_t va;
3774         rnode4_t *rp;
3775         int doqueue = 1;
3776         uint_t mask = vap->va_mask;
3777         mode_t omode;
3778         vsecattr_t *vsp;
3779         timestruc_t ctime;
3780         bool_t needrecov = FALSE;
3781         nfs4_recov_state_t recov_state;
3782         nfs4_stateid_types_t sid_types;
3783         stateid4 stateid;
3784         hrtime_t t;
3785         nfs4_error_t e = { 0, NFS4_OK, RPC_SUCCESS };
3786         servinfo4_t *svp;
3787         bitmap4 supp_attrs;
3788 
3789         ASSERT(nfs_zone() == VTOMI4(vp)->mi_zone);
3790         rp = VTOR4(vp);
3791         nfs4_init_stateid_types(&sid_types);
3792 
3793         /*
3794          * Only need to flush pages if there are any pages and
3795          * if the file is marked as dirty in some fashion.  The
3796          * file must be flushed so that we can accurately
3797          * determine the size of the file and the cached data
3798          * after the SETATTR returns.  A file is considered to
3799          * be dirty if it is either marked with R4DIRTY, has
3800          * outstanding i/o's active, or is mmap'd.  In this
3801          * last case, we can't tell whether there are dirty
3802          * pages, so we flush just to be sure.
3803          */
3804         if (nfs4_has_pages(vp) &&
3805             ((rp->r_flags & R4DIRTY) ||
3806             rp->r_count > 0 ||
3807             rp->r_mapcnt > 0)) {
3808                 ASSERT(vp->v_type != VCHR);
3809                 e.error = nfs4_putpage(vp, (offset_t)0, 0, 0, cr, NULL);
3810                 if (e.error && (e.error == ENOSPC || e.error == EDQUOT)) {
3811                         mutex_enter(&rp->r_statelock);
3812                         if (!rp->r_error)
3813                                 rp->r_error = e.error;
3814                         mutex_exit(&rp->r_statelock);
3815                 }
3816         }
3817 
3818         if (mask & AT_SIZE) {
3819                 /*
3820                  * Verification setattr compound for non-deleg AT_SIZE:
3821                  *      { Putfh; Getattr; Verify; Setattr; Getattr }
3822                  * Set ctime local here (outside the do_again label)
3823                  * so that subsequent retries (after failed VERIFY)
3824                  * will use ctime from GETATTR results (from failed
3825                  * verify compound) as VERIFY arg.
3826                  * If file has delegation, then VERIFY(time_metadata)
3827                  * is of little added value, so don't bother.
3828                  */
3829                 mutex_enter(&rp->r_statev4_lock);
3830                 if (rp->r_deleg_type == OPEN_DELEGATE_NONE ||
3831                     rp->r_deleg_return_pending) {
3832                         numops = 5;
3833                         ctime = rp->r_attr.va_ctime;
3834                 }
3835                 mutex_exit(&rp->r_statev4_lock);
3836         }
3837 
3838         recov_state.rs_flags = 0;
3839         recov_state.rs_num_retry_despite_err = 0;
3840 
3841         args.ctag = TAG_SETATTR;
3842 do_again:
3843 recov_retry:
3844         setattr_argop = numops - 2;
3845 
3846         args.array = argop;
3847         args.array_len = numops;
3848 
3849         e.error = nfs4_start_op(VTOMI4(vp), vp, NULL, &recov_state);
3850         if (e.error)
3851                 return (e.error);
3852 
3853 
3854         /* putfh target fh */
3855         argop[0].argop = OP_CPUTFH;
3856         argop[0].nfs_argop4_u.opcputfh.sfh = rp->r_fh;
3857 
3858         if (numops == 5) {
3859                 /*
3860                  * We only care about the ctime, but need to get mtime
3861                  * and size for proper cache update.
3862                  */
3863                 /* getattr */
3864                 argop[1].argop = OP_GETATTR;
3865                 argop[1].nfs_argop4_u.opgetattr.attr_request = NFS4_VATTR_MASK;
3866                 argop[1].nfs_argop4_u.opgetattr.mi = VTOMI4(vp);
3867 
3868                 /* verify - set later in loop */
3869                 verify_argop = 2;
3870         }
3871 
3872         /* setattr */
3873         svp = rp->r_server;
3874         (void) nfs_rw_enter_sig(&svp->sv_lock, RW_READER, 0);
3875         supp_attrs = svp->sv_supp_attrs;
3876         nfs_rw_exit(&svp->sv_lock);
3877 
3878         nfs4args_setattr(&argop[setattr_argop], vap, vsap, flags, rp, cr,
3879             supp_attrs, &e.error, &sid_types);
3880         stateid = argop[setattr_argop].nfs_argop4_u.opsetattr.stateid;
3881         if (e.error) {
3882                 /* req time field(s) overflow - return immediately */
3883                 nfs4_end_op(VTOMI4(vp), vp, NULL, &recov_state, needrecov);
3884                 nfs4_fattr4_free(&argop[setattr_argop].nfs_argop4_u.
3885                     opsetattr.obj_attributes);
3886                 return (e.error);
3887         }
3888         omode = rp->r_attr.va_mode;
3889 
3890         /* getattr */
3891         argop[numops-1].argop = OP_GETATTR;
3892         argop[numops-1].nfs_argop4_u.opgetattr.attr_request = NFS4_VATTR_MASK;
3893         /*
3894          * If we are setting the ACL (indicated only by vsap != NULL), request
3895          * the ACL in this getattr.  The ACL returned from this getattr will be
3896          * used in updating the ACL cache.
3897          */
3898         if (vsap != NULL)
3899                 argop[numops-1].nfs_argop4_u.opgetattr.attr_request |=
3900                     FATTR4_ACL_MASK;
3901         argop[numops-1].nfs_argop4_u.opgetattr.mi = VTOMI4(vp);
3902 
3903         /*
3904          * setattr iterates if the object size is set and the cached ctime
3905          * does not match the file ctime. In that case, verify the ctime first.
3906          */
3907 
3908         do {
3909                 if (verify_argop != -1) {
3910                         /*
3911                          * Verify that the ctime match before doing setattr.
3912                          */
3913                         va.va_mask = AT_CTIME;
3914                         va.va_ctime = ctime;
3915                         svp = rp->r_server;
3916                         (void) nfs_rw_enter_sig(&svp->sv_lock, RW_READER, 0);
3917                         supp_attrs = svp->sv_supp_attrs;
3918                         nfs_rw_exit(&svp->sv_lock);
3919                         e.error = nfs4args_verify(&argop[verify_argop], &va,
3920                             OP_VERIFY, supp_attrs);
3921                         if (e.error) {
3922                                 /* req time field(s) overflow - return */
3923                                 nfs4_end_op(VTOMI4(vp), vp, NULL, &recov_state,
3924                                     needrecov);
3925                                 break;
3926                         }
3927                 }
3928 
3929                 doqueue = 1;
3930 
3931                 t = gethrtime();
3932 
3933                 rfs4call(VTOMI4(vp), &args, &res, cr, &doqueue, 0, &e);
3934 
3935                 /*
3936                  * Purge the access cache and ACL cache if changing either the
3937                  * owner of the file, the group owner, or the mode.  These may
3938                  * change the access permissions of the file, so purge old
3939                  * information and start over again.
3940                  */
3941                 if (mask & (AT_UID | AT_GID | AT_MODE)) {
3942                         (void) nfs4_access_purge_rp(rp);
3943                         if (rp->r_secattr != NULL) {
3944                                 mutex_enter(&rp->r_statelock);
3945                                 vsp = rp->r_secattr;
3946                                 rp->r_secattr = NULL;
3947                                 mutex_exit(&rp->r_statelock);
3948                                 if (vsp != NULL)
3949                                         nfs4_acl_free_cache(vsp);
3950                         }
3951                 }
3952 
3953                 /*
3954                  * If res.array_len == numops, then everything succeeded,
3955                  * except for possibly the final getattr.  If only the
3956                  * last getattr failed, give up, and don't try recovery.
3957                  */
3958                 if (res.array_len == numops) {
3959                         nfs4_end_op(VTOMI4(vp), vp, NULL, &recov_state,
3960                             needrecov);
3961                         if (! e.error)
3962                                 resp = &res;
3963                         break;
3964                 }
3965 
3966                 /*
3967                  * if either rpc call failed or completely succeeded - done
3968                  */
3969                 needrecov = nfs4_needs_recovery(&e, FALSE, vp->v_vfsp);
3970                 if (e.error) {
3971                         PURGE_ATTRCACHE4(vp);
3972                         if (!needrecov) {
3973                                 nfs4_end_op(VTOMI4(vp), vp, NULL, &recov_state,
3974                                     needrecov);
3975                                 break;
3976                         }
3977                 }
3978 
3979                 /*
3980                  * Do proper retry for OLD_STATEID outside of the normal
3981                  * recovery framework.
3982                  */
3983                 if (e.error == 0 && res.status == NFS4ERR_OLD_STATEID &&
3984                     sid_types.cur_sid_type != SPEC_SID &&
3985                     sid_types.cur_sid_type != NO_SID) {
3986                         nfs4_end_op(VTOMI4(vp), vp, NULL, &recov_state,
3987                             needrecov);
3988                         nfs4_save_stateid(&stateid, &sid_types);
3989                         nfs4_fattr4_free(&argop[setattr_argop].nfs_argop4_u.
3990                             opsetattr.obj_attributes);
3991                         if (verify_argop != -1) {
3992                                 nfs4args_verify_free(&argop[verify_argop]);
3993                                 verify_argop = -1;
3994                         }
3995                         (void) xdr_free(xdr_COMPOUND4res_clnt, (caddr_t)&res);
3996                         goto recov_retry;
3997                 }
3998 
3999                 if (needrecov) {
4000                         bool_t abort;
4001 
4002                         abort = nfs4_start_recovery(&e,
4003                             VTOMI4(vp), vp, NULL, NULL, NULL,
4004                             OP_SETATTR, NULL, NULL, NULL);
4005                         nfs4_end_op(VTOMI4(vp), vp, NULL, &recov_state,
4006                             needrecov);
4007                         /*
4008                          * Do not retry if we failed with OLD_STATEID using
4009                          * a special stateid.  This is done to avoid looping
4010                          * with a broken server.
4011                          */
4012                         if (e.error == 0 && res.status == NFS4ERR_OLD_STATEID &&
4013                             (sid_types.cur_sid_type == SPEC_SID ||
4014                             sid_types.cur_sid_type == NO_SID))
4015                                 abort = TRUE;
4016                         if (!e.error) {
4017                                 if (res.status == NFS4ERR_BADOWNER)
4018                                         nfs4_log_badowner(VTOMI4(vp),
4019                                             OP_SETATTR);
4020 
4021                                 e.error = geterrno4(res.status);
4022                                 (void) xdr_free(xdr_COMPOUND4res_clnt,
4023                                     (caddr_t)&res);
4024                         }
4025                         nfs4_fattr4_free(&argop[setattr_argop].nfs_argop4_u.
4026                             opsetattr.obj_attributes);
4027                         if (verify_argop != -1) {
4028                                 nfs4args_verify_free(&argop[verify_argop]);
4029                                 verify_argop = -1;
4030                         }
4031                         if (abort == FALSE) {
4032                                 /*
4033                                  * Need to retry all possible stateids in
4034                                  * case the recovery error wasn't stateid
4035                                  * related or the stateids have become
4036                                  * stale (server reboot).
4037                                  */
4038                                 nfs4_init_stateid_types(&sid_types);
4039                                 goto recov_retry;
4040                         }
4041                         return (e.error);
4042                 }
4043 
4044                 /*
4045                  * Need to call nfs4_end_op before nfs4getattr to
4046                  * avoid potential nfs4_start_op deadlock. See RFE
4047                  * 4777612.  Calls to nfs4_invalidate_pages() and
4048                  * nfs4_purge_stale_fh() might also generate over the
4049                  * wire calls which my cause nfs4_start_op() deadlock.
4050                  */
4051                 nfs4_end_op(VTOMI4(vp), vp, NULL, &recov_state, needrecov);
4052 
4053                 /*
4054                  * Check to update lease.
4055                  */
4056                 resp = &res;
4057                 if (res.status == NFS4_OK) {
4058                         break;
4059                 }
4060 
4061                 /*
4062                  * Check if verify failed to see if try again
4063                  */
4064                 if ((verify_argop == -1) || (res.array_len != 3)) {
4065                         /*
4066                          * can't continue...
4067                          */
4068                         if (res.status == NFS4ERR_BADOWNER)
4069                                 nfs4_log_badowner(VTOMI4(vp), OP_SETATTR);
4070 
4071                         e.error = geterrno4(res.status);
4072                 } else {
4073                         /*
4074                          * When the verify request fails, the client ctime is
4075                          * not in sync with the server. This is the same as
4076                          * the version 3 "not synchronized" error, and we
4077                          * handle it in a similar manner (XXX do we need to???).
4078                          * Use the ctime returned in the first getattr for
4079                          * the input to the next verify.
4080                          * If we couldn't get the attributes, then we give up
4081                          * because we can't complete the operation as required.
4082                          */
4083                         garp = &res.array[1].nfs_resop4_u.opgetattr.ga_res;
4084                 }
4085                 if (e.error) {
4086                         PURGE_ATTRCACHE4(vp);
4087                         nfs4_purge_stale_fh(e.error, vp, cr);
4088                 } else {
4089                         /*
4090                          * retry with a new verify value
4091                          */
4092                         ctime = garp->n4g_va.va_ctime;
4093                         (void) xdr_free(xdr_COMPOUND4res_clnt, (caddr_t)&res);
4094                         resp = NULL;
4095                 }
4096                 if (!e.error) {
4097                         nfs4_fattr4_free(&argop[setattr_argop].nfs_argop4_u.
4098                             opsetattr.obj_attributes);
4099                         if (verify_argop != -1) {
4100                                 nfs4args_verify_free(&argop[verify_argop]);
4101                                 verify_argop = -1;
4102                         }
4103                         (void) xdr_free(xdr_COMPOUND4res_clnt, (caddr_t)&res);
4104                         goto do_again;
4105                 }
4106         } while (!e.error);
4107 
4108         if (e.error) {
4109                 /*
4110                  * If we are here, rfs4call has an irrecoverable error - return
4111                  */
4112                 nfs4_fattr4_free(&argop[setattr_argop].nfs_argop4_u.
4113                     opsetattr.obj_attributes);
4114                 if (verify_argop != -1) {
4115                         nfs4args_verify_free(&argop[verify_argop]);
4116                         verify_argop = -1;
4117                 }
4118                 if (resp)
4119                         (void) xdr_free(xdr_COMPOUND4res_clnt, (caddr_t)resp);
4120                 return (e.error);
4121         }
4122 
4123 
4124 
4125         /*
4126          * If changing the size of the file, invalidate
4127          * any local cached data which is no longer part
4128          * of the file.  We also possibly invalidate the
4129          * last page in the file.  We could use
4130          * pvn_vpzero(), but this would mark the page as
4131          * modified and require it to be written back to
4132          * the server for no particularly good reason.
4133          * This way, if we access it, then we bring it
4134          * back in.  A read should be cheaper than a
4135          * write.
4136          */
4137         if (mask & AT_SIZE) {
4138                 nfs4_invalidate_pages(vp, (vap->va_size & PAGEMASK), cr);
4139         }
4140 
4141         /* either no error or one of the postop getattr failed */
4142 
4143         /*
4144          * XXX Perform a simplified version of wcc checking. Instead of
4145          * have another getattr to get pre-op, just purge cache if
4146          * any of the ops prior to and including the getattr failed.
4147          * If the getattr succeeded then update the attrcache accordingly.
4148          */
4149 
4150         garp = NULL;
4151         if (res.status == NFS4_OK) {
4152                 /*
4153                  * Last getattr
4154                  */
4155                 resop = &res.array[numops - 1];
4156                 garp = &resop->nfs_resop4_u.opgetattr.ga_res;
4157         }
4158         /*
4159          * In certain cases, nfs4_update_attrcache() will purge the attrcache,
4160          * rather than filling it.  See the function itself for details.
4161          */
4162         e.error = nfs4_update_attrcache(res.status, garp, t, vp, cr);
4163         if (garp != NULL) {
4164                 if (garp->n4g_resbmap & FATTR4_ACL_MASK) {
4165                         nfs4_acl_fill_cache(rp, &garp->n4g_vsa);
4166                         vs_ace4_destroy(&garp->n4g_vsa);
4167                 } else {
4168                         if (vsap != NULL) {
4169                                 /*
4170                                  * The ACL was supposed to be set and to be
4171                                  * returned in the last getattr of this
4172                                  * compound, but for some reason the getattr
4173                                  * result doesn't contain the ACL.  In this
4174                                  * case, purge the ACL cache.
4175                                  */
4176                                 if (rp->r_secattr != NULL) {
4177                                         mutex_enter(&rp->r_statelock);
4178                                         vsp = rp->r_secattr;
4179                                         rp->r_secattr = NULL;
4180                                         mutex_exit(&rp->r_statelock);
4181                                         if (vsp != NULL)
4182                                                 nfs4_acl_free_cache(vsp);
4183                                 }
4184                         }
4185                 }
4186         }
4187 
4188         if (res.status == NFS4_OK && (mask & AT_SIZE)) {
4189                 /*
4190                  * Set the size, rather than relying on getting it updated
4191                  * via a GETATTR.  With delegations the client tries to
4192                  * suppress GETATTR calls.
4193                  */
4194                 mutex_enter(&rp->r_statelock);
4195                 rp->r_size = vap->va_size;
4196                 mutex_exit(&rp->r_statelock);
4197         }
4198 
4199         /*
4200          * Can free up request args and res
4201          */
4202         nfs4_fattr4_free(&argop[setattr_argop].nfs_argop4_u.
4203             opsetattr.obj_attributes);
4204         if (verify_argop != -1) {
4205                 nfs4args_verify_free(&argop[verify_argop]);
4206                 verify_argop = -1;
4207         }
4208         (void) xdr_free(xdr_COMPOUND4res_clnt, (caddr_t)&res);
4209 
4210         /*
4211          * Some servers will change the mode to clear the setuid
4212          * and setgid bits when changing the uid or gid.  The
4213          * client needs to compensate appropriately.
4214          */
4215         if (mask & (AT_UID | AT_GID)) {
4216                 int terror, do_setattr;
4217 
4218                 do_setattr = 0;
4219                 va.va_mask = AT_MODE;
4220                 terror = nfs4getattr(vp, &va, cr);
4221                 if (!terror &&
4222                     (((mask & AT_MODE) && va.va_mode != vap->va_mode) ||
4223                     (!(mask & AT_MODE) && va.va_mode != omode))) {
4224                         va.va_mask = AT_MODE;
4225                         if (mask & AT_MODE) {
4226                                 /*
4227                                  * We asked the mode to be changed and what
4228                                  * we just got from the server in getattr is
4229                                  * not what we wanted it to be, so set it now.
4230                                  */
4231                                 va.va_mode = vap->va_mode;
4232                                 do_setattr = 1;
4233                         } else {
4234                                 /*
4235                                  * We did not ask the mode to be changed,
4236                                  * Check to see that the server just cleared
4237                                  * I_SUID and I_GUID from it. If not then
4238                                  * set mode to omode with UID/GID cleared.
4239                                  */
4240                                 if (nfs4_compare_modes(va.va_mode, omode)) {
4241                                         omode &= ~(S_ISUID|S_ISGID);
4242                                         va.va_mode = omode;
4243                                         do_setattr = 1;
4244                                 }
4245                         }
4246 
4247                         if (do_setattr)
4248                                 (void) nfs4setattr(vp, &va, 0, cr, NULL);
4249                 }
4250         }
4251 
4252         return (e.error);
4253 }
4254 
4255 /* ARGSUSED */
4256 static int
4257 nfs4_access(vnode_t *vp, int mode, int flags, cred_t *cr, caller_context_t *ct)
4258 {
4259         COMPOUND4args_clnt args;
4260         COMPOUND4res_clnt res;
4261         int doqueue;
4262         uint32_t acc, resacc, argacc;
4263         rnode4_t *rp;
4264         cred_t *cred, *ncr, *ncrfree = NULL;
4265         nfs4_access_type_t cacc;
4266         int num_ops;
4267         nfs_argop4 argop[3];
4268         nfs_resop4 *resop;
4269         bool_t needrecov = FALSE, do_getattr;
4270         nfs4_recov_state_t recov_state;
4271         int rpc_error;
4272         hrtime_t t;
4273         nfs4_error_t e = { 0, NFS4_OK, RPC_SUCCESS };
4274         mntinfo4_t *mi = VTOMI4(vp);
4275 
4276         if (nfs_zone() != mi->mi_zone)
4277                 return (EIO);
4278 
4279         acc = 0;
4280         if (mode & VREAD)
4281                 acc |= ACCESS4_READ;
4282         if (mode & VWRITE) {
4283                 if ((vp->v_vfsp->vfs_flag & VFS_RDONLY) && !ISVDEV(vp->v_type))
4284                         return (EROFS);
4285                 if (vp->v_type == VDIR)
4286                         acc |= ACCESS4_DELETE;
4287                 acc |= ACCESS4_MODIFY | ACCESS4_EXTEND;
4288         }
4289         if (mode & VEXEC) {
4290                 if (vp->v_type == VDIR)
4291                         acc |= ACCESS4_LOOKUP;
4292                 else
4293                         acc |= ACCESS4_EXECUTE;
4294         }
4295 
4296         if (VTOR4(vp)->r_acache != NULL) {
4297                 e.error = nfs4_validate_caches(vp, cr);
4298                 if (e.error)
4299                         return (e.error);
4300         }
4301 
4302         rp = VTOR4(vp);
4303         if (vp->v_type == VDIR)
4304                 argacc = ACCESS4_READ | ACCESS4_DELETE | ACCESS4_MODIFY |
4305                     ACCESS4_EXTEND | ACCESS4_LOOKUP;
4306         else
4307                 argacc = ACCESS4_READ | ACCESS4_MODIFY | ACCESS4_EXTEND |
4308                     ACCESS4_EXECUTE;
4309         recov_state.rs_flags = 0;
4310         recov_state.rs_num_retry_despite_err = 0;
4311 
4312         cred = cr;
4313         /*
4314          * ncr and ncrfree both initially
4315          * point to the memory area returned
4316          * by crnetadjust();
4317          * ncrfree not NULL when exiting means
4318          * that we need to release it
4319          */
4320         ncr = crnetadjust(cred);
4321         ncrfree = ncr;
4322 
4323 tryagain:
4324         cacc = nfs4_access_check(rp, acc, cred);
4325         if (cacc == NFS4_ACCESS_ALLOWED) {
4326                 if (ncrfree != NULL)
4327                         crfree(ncrfree);
4328                 return (0);
4329         }
4330         if (cacc == NFS4_ACCESS_DENIED) {
4331                 /*
4332                  * If the cred can be adjusted, try again
4333                  * with the new cred.
4334                  */
4335                 if (ncr != NULL) {
4336                         cred = ncr;
4337                         ncr = NULL;
4338                         goto tryagain;
4339                 }
4340                 if (ncrfree != NULL)
4341                         crfree(ncrfree);
4342                 return (EACCES);
4343         }
4344 
4345 recov_retry:
4346         /*
4347          * Don't take with r_statev4_lock here. r_deleg_type could
4348          * change as soon as lock is released.  Since it is an int,
4349          * there is no atomicity issue.
4350          */
4351         do_getattr = (rp->r_deleg_type == OPEN_DELEGATE_NONE);
4352         num_ops = do_getattr ? 3 : 2;
4353 
4354         args.ctag = TAG_ACCESS;
4355 
4356         args.array_len = num_ops;
4357         args.array = argop;
4358 
4359         if (e.error = nfs4_start_fop(mi, vp, NULL, OH_ACCESS,
4360             &recov_state, NULL)) {
4361                 if (ncrfree != NULL)
4362                         crfree(ncrfree);
4363                 return (e.error);
4364         }
4365 
4366         /* putfh target fh */
4367         argop[0].argop = OP_CPUTFH;
4368         argop[0].nfs_argop4_u.opcputfh.sfh = VTOR4(vp)->r_fh;
4369 
4370         /* access */
4371         argop[1].argop = OP_ACCESS;
4372         argop[1].nfs_argop4_u.opaccess.access = argacc;
4373 
4374         /* getattr */
4375         if (do_getattr) {
4376                 argop[2].argop = OP_GETATTR;
4377                 argop[2].nfs_argop4_u.opgetattr.attr_request = NFS4_VATTR_MASK;
4378                 argop[2].nfs_argop4_u.opgetattr.mi = mi;
4379         }
4380 
4381         NFS4_DEBUG(nfs4_client_call_debug, (CE_NOTE,
4382             "nfs4_access: %s call, rp %s", needrecov ? "recov" : "first",
4383             rnode4info(VTOR4(vp))));
4384 
4385         doqueue = 1;
4386         t = gethrtime();
4387         rfs4call(VTOMI4(vp), &args, &res, cred, &doqueue, 0, &e);
4388         rpc_error = e.error;
4389 
4390         needrecov = nfs4_needs_recovery(&e, FALSE, vp->v_vfsp);
4391         if (needrecov) {
4392                 NFS4_DEBUG(nfs4_client_recov_debug, (CE_NOTE,
4393                     "nfs4_access: initiating recovery\n"));
4394 
4395                 if (nfs4_start_recovery(&e, VTOMI4(vp), vp, NULL, NULL,
4396                     NULL, OP_ACCESS, NULL, NULL, NULL) == FALSE) {
4397                         nfs4_end_fop(VTOMI4(vp), vp, NULL, OH_ACCESS,
4398                             &recov_state, needrecov);
4399                         if (!e.error)
4400                                 (void) xdr_free(xdr_COMPOUND4res_clnt,
4401                                     (caddr_t)&res);
4402                         goto recov_retry;
4403                 }
4404         }
4405         nfs4_end_fop(mi, vp, NULL, OH_ACCESS, &recov_state, needrecov);
4406 
4407         if (e.error)
4408                 goto out;
4409 
4410         if (res.status) {
4411                 e.error = geterrno4(res.status);
4412                 /*
4413                  * This might generate over the wire calls throught
4414                  * nfs4_invalidate_pages. Hence we need to call nfs4_end_op()
4415                  * here to avoid a deadlock.
4416                  */
4417                 nfs4_purge_stale_fh(e.error, vp, cr);
4418                 goto out;
4419         }
4420         resop = &res.array[1];      /* access res */
4421 
4422         resacc = resop->nfs_resop4_u.opaccess.access;
4423 
4424         if (do_getattr) {
4425                 resop++;        /* getattr res */
4426                 nfs4_attr_cache(vp, &resop->nfs_resop4_u.opgetattr.ga_res,
4427                     t, cr, FALSE, NULL);
4428         }
4429 
4430         if (!e.error) {
4431                 nfs4_access_cache(rp, argacc, resacc, cred);
4432                 /*
4433                  * we just cached results with cred; if cred is the
4434                  * adjusted credentials from crnetadjust, we do not want
4435                  * to release them before exiting: hence setting ncrfree
4436                  * to NULL
4437                  */
4438                 if (cred != cr)
4439                         ncrfree = NULL;
4440                 /* XXX check the supported bits too? */
4441                 if ((acc & resacc) != acc) {
4442                         /*
4443                          * The following code implements the semantic
4444                          * that a setuid root program has *at least* the
4445                          * permissions of the user that is running the
4446                          * program.  See rfs3call() for more portions
4447                          * of the implementation of this functionality.
4448                          */
4449                         /* XXX-LP */
4450                         if (ncr != NULL) {
4451                                 (void) xdr_free(xdr_COMPOUND4res_clnt,
4452                                     (caddr_t)&res);
4453                                 cred = ncr;
4454                                 ncr = NULL;
4455                                 goto tryagain;
4456                         }
4457                         e.error = EACCES;
4458                 }
4459         }
4460 
4461 out:
4462         if (!rpc_error)
4463                 (void) xdr_free(xdr_COMPOUND4res_clnt, (caddr_t)&res);
4464 
4465         if (ncrfree != NULL)
4466                 crfree(ncrfree);
4467 
4468         return (e.error);
4469 }
4470 
4471 /* ARGSUSED */
4472 static int
4473 nfs4_readlink(vnode_t *vp, struct uio *uiop, cred_t *cr, caller_context_t *ct)
4474 {
4475         COMPOUND4args_clnt args;
4476         COMPOUND4res_clnt res;
4477         int doqueue;
4478         rnode4_t *rp;
4479         nfs_argop4 argop[3];
4480         nfs_resop4 *resop;
4481         READLINK4res *lr_res;
4482         nfs4_ga_res_t *garp;
4483         uint_t len;
4484         char *linkdata;
4485         bool_t needrecov = FALSE;
4486         nfs4_recov_state_t recov_state;
4487         hrtime_t t;
4488         nfs4_error_t e = { 0, NFS4_OK, RPC_SUCCESS };
4489 
4490         if (nfs_zone() != VTOMI4(vp)->mi_zone)
4491                 return (EIO);
4492         /*
4493          * Can't readlink anything other than a symbolic link.
4494          */
4495         if (vp->v_type != VLNK)
4496                 return (EINVAL);
4497 
4498         rp = VTOR4(vp);
4499         if (nfs4_do_symlink_cache && rp->r_symlink.contents != NULL) {
4500                 e.error = nfs4_validate_caches(vp, cr);
4501                 if (e.error)
4502                         return (e.error);
4503                 mutex_enter(&rp->r_statelock);
4504                 if (rp->r_symlink.contents != NULL) {
4505                         e.error = uiomove(rp->r_symlink.contents,
4506                             rp->r_symlink.len, UIO_READ, uiop);
4507                         mutex_exit(&rp->r_statelock);
4508                         return (e.error);
4509                 }
4510                 mutex_exit(&rp->r_statelock);
4511         }
4512         recov_state.rs_flags = 0;
4513         recov_state.rs_num_retry_despite_err = 0;
4514 
4515 recov_retry:
4516         args.array_len = 3;
4517         args.array = argop;
4518         args.ctag = TAG_READLINK;
4519 
4520         e.error = nfs4_start_op(VTOMI4(vp), vp, NULL, &recov_state);
4521         if (e.error) {
4522                 return (e.error);
4523         }
4524 
4525         /* 0. putfh symlink fh */
4526         argop[0].argop = OP_CPUTFH;
4527         argop[0].nfs_argop4_u.opcputfh.sfh = VTOR4(vp)->r_fh;
4528 
4529         /* 1. readlink */
4530         argop[1].argop = OP_READLINK;
4531 
4532         /* 2. getattr */
4533         argop[2].argop = OP_GETATTR;
4534         argop[2].nfs_argop4_u.opgetattr.attr_request = NFS4_VATTR_MASK;
4535         argop[2].nfs_argop4_u.opgetattr.mi = VTOMI4(vp);
4536 
4537         doqueue = 1;
4538 
4539         NFS4_DEBUG(nfs4_client_call_debug, (CE_NOTE,
4540             "nfs4_readlink: %s call, rp %s", needrecov ? "recov" : "first",
4541             rnode4info(VTOR4(vp))));
4542 
4543         t = gethrtime();
4544 
4545         rfs4call(VTOMI4(vp), &args, &res, cr, &doqueue, 0, &e);
4546 
4547         needrecov = nfs4_needs_recovery(&e, FALSE, vp->v_vfsp);
4548         if (needrecov) {
4549                 NFS4_DEBUG(nfs4_client_recov_debug, (CE_NOTE,
4550                     "nfs4_readlink: initiating recovery\n"));
4551 
4552                 if (nfs4_start_recovery(&e, VTOMI4(vp), vp, NULL, NULL,
4553                     NULL, OP_READLINK, NULL, NULL, NULL) == FALSE) {
4554                         if (!e.error)
4555                                 (void) xdr_free(xdr_COMPOUND4res_clnt,
4556                                     (caddr_t)&res);
4557 
4558                         nfs4_end_op(VTOMI4(vp), vp, NULL, &recov_state,
4559                             needrecov);
4560                         goto recov_retry;
4561                 }
4562         }
4563 
4564         nfs4_end_op(VTOMI4(vp), vp, NULL, &recov_state, needrecov);
4565 
4566         if (e.error)
4567                 return (e.error);
4568 
4569         /*
4570          * There is an path in the code below which calls
4571          * nfs4_purge_stale_fh(), which may generate otw calls through
4572          * nfs4_invalidate_pages. Hence we need to call nfs4_end_op()
4573          * here to avoid nfs4_start_op() deadlock.
4574          */
4575 
4576         if (res.status && (res.array_len < args.array_len)) {
4577                 /*
4578                  * either Putfh or Link failed
4579                  */
4580                 e.error = geterrno4(res.status);
4581                 nfs4_purge_stale_fh(e.error, vp, cr);
4582                 (void) xdr_free(xdr_COMPOUND4res_clnt, (caddr_t)&res);
4583                 return (e.error);
4584         }
4585 
4586         resop = &res.array[1];      /* readlink res */
4587         lr_res = &resop->nfs_resop4_u.opreadlink;
4588 
4589         /*
4590          * treat symlink names as data
4591          */
4592         linkdata = utf8_to_str((utf8string *)&lr_res->link, &len, NULL);
4593         if (linkdata != NULL) {
4594                 int uio_len = len - 1;
4595                 /* len includes null byte, which we won't uiomove */
4596                 e.error = uiomove(linkdata, uio_len, UIO_READ, uiop);
4597                 if (nfs4_do_symlink_cache && rp->r_symlink.contents == NULL) {
4598                         mutex_enter(&rp->r_statelock);
4599                         if (rp->r_symlink.contents == NULL) {
4600                                 rp->r_symlink.contents = linkdata;
4601                                 rp->r_symlink.len = uio_len;
4602                                 rp->r_symlink.size = len;
4603                                 mutex_exit(&rp->r_statelock);
4604                         } else {
4605                                 mutex_exit(&rp->r_statelock);
4606                                 kmem_free(linkdata, len);
4607                         }
4608                 } else {
4609                         kmem_free(linkdata, len);
4610                 }
4611         }
4612         if (res.status == NFS4_OK) {
4613                 resop++;        /* getattr res */
4614                 garp = &resop->nfs_resop4_u.opgetattr.ga_res;
4615         }
4616         e.error = nfs4_update_attrcache(res.status, garp, t, vp, cr);
4617 
4618         (void) xdr_free(xdr_COMPOUND4res_clnt, (caddr_t)&res);
4619 
4620         /*
4621          * The over the wire error for attempting to readlink something
4622          * other than a symbolic link is ENXIO.  However, we need to
4623          * return EINVAL instead of ENXIO, so we map it here.
4624          */
4625         return (e.error == ENXIO ? EINVAL : e.error);
4626 }
4627 
4628 /*
4629  * Flush local dirty pages to stable storage on the server.
4630  *
4631  * If FNODSYNC is specified, then there is nothing to do because
4632  * metadata changes are not cached on the client before being
4633  * sent to the server.
4634  */
4635 /* ARGSUSED */
4636 static int
4637 nfs4_fsync(vnode_t *vp, int syncflag, cred_t *cr, caller_context_t *ct)
4638 {
4639         int error;
4640 
4641         if ((syncflag & FNODSYNC) || IS_SWAPVP(vp))
4642                 return (0);
4643         if (nfs_zone() != VTOMI4(vp)->mi_zone)
4644                 return (EIO);
4645         error = nfs4_putpage_commit(vp, (offset_t)0, 0, cr);
4646         if (!error)
4647                 error = VTOR4(vp)->r_error;
4648         return (error);
4649 }
4650 
4651 /*
4652  * Weirdness: if the file was removed or the target of a rename
4653  * operation while it was open, it got renamed instead.  Here we
4654  * remove the renamed file.
4655  */
4656 /* ARGSUSED */
4657 void
4658 nfs4_inactive(vnode_t *vp, cred_t *cr, caller_context_t *ct)
4659 {
4660         rnode4_t *rp;
4661 
4662         ASSERT(vp != DNLC_NO_VNODE);
4663 
4664         rp = VTOR4(vp);
4665 
4666         if (IS_SHADOW(vp, rp)) {
4667                 sv_inactive(vp);
4668                 return;
4669         }
4670 
4671         /*
4672          * If this is coming from the wrong zone, we let someone in the right
4673          * zone take care of it asynchronously.  We can get here due to
4674          * VN_RELE() being called from pageout() or fsflush().  This call may
4675          * potentially turn into an expensive no-op if, for instance, v_count
4676          * gets incremented in the meantime, but it's still correct.
4677          */
4678         if (nfs_zone() != VTOMI4(vp)->mi_zone) {
4679                 nfs4_async_inactive(vp, cr);
4680                 return;
4681         }
4682 
4683         /*
4684          * Some of the cleanup steps might require over-the-wire
4685          * operations.  Since VOP_INACTIVE can get called as a result of
4686          * other over-the-wire operations (e.g., an attribute cache update
4687          * can lead to a DNLC purge), doing those steps now would lead to a
4688          * nested call to the recovery framework, which can deadlock.  So
4689          * do any over-the-wire cleanups asynchronously, in a separate
4690          * thread.
4691          */
4692 
4693         mutex_enter(&rp->r_os_lock);
4694         mutex_enter(&rp->r_statelock);
4695         mutex_enter(&rp->r_statev4_lock);
4696 
4697         if (vp->v_type == VREG && list_head(&rp->r_open_streams) != NULL) {
4698                 mutex_exit(&rp->r_statev4_lock);
4699                 mutex_exit(&rp->r_statelock);
4700                 mutex_exit(&rp->r_os_lock);
4701                 nfs4_async_inactive(vp, cr);
4702                 return;
4703         }
4704 
4705         if (rp->r_deleg_type == OPEN_DELEGATE_READ ||
4706             rp->r_deleg_type == OPEN_DELEGATE_WRITE) {
4707                 mutex_exit(&rp->r_statev4_lock);
4708                 mutex_exit(&rp->r_statelock);
4709                 mutex_exit(&rp->r_os_lock);
4710                 nfs4_async_inactive(vp, cr);
4711                 return;
4712         }
4713 
4714         if (rp->r_unldvp != NULL) {
4715                 mutex_exit(&rp->r_statev4_lock);
4716                 mutex_exit(&rp->r_statelock);
4717                 mutex_exit(&rp->r_os_lock);
4718                 nfs4_async_inactive(vp, cr);
4719                 return;
4720         }
4721         mutex_exit(&rp->r_statev4_lock);
4722         mutex_exit(&rp->r_statelock);
4723         mutex_exit(&rp->r_os_lock);
4724 
4725         rp4_addfree(rp, cr);
4726 }
4727 
4728 /*
4729  * nfs4_inactive_otw - nfs4_inactive, plus over-the-wire calls to free up
4730  * various bits of state.  The caller must not refer to vp after this call.
4731  */
4732 
4733 void
4734 nfs4_inactive_otw(vnode_t *vp, cred_t *cr)
4735 {
4736         rnode4_t *rp = VTOR4(vp);
4737         nfs4_recov_state_t recov_state;
4738         nfs4_error_t e = { 0, NFS4_OK, RPC_SUCCESS };
4739         vnode_t *unldvp;
4740         char *unlname;
4741         cred_t *unlcred;
4742         COMPOUND4args_clnt args;
4743         COMPOUND4res_clnt res, *resp;
4744         nfs_argop4 argop[2];
4745         int doqueue;
4746 #ifdef DEBUG
4747         char *name;
4748 #endif
4749 
4750         ASSERT(nfs_zone() == VTOMI4(vp)->mi_zone);
4751         ASSERT(!IS_SHADOW(vp, rp));
4752 
4753 #ifdef DEBUG
4754         name = fn_name(VTOSV(vp)->sv_name);
4755         NFS4_DEBUG(nfs4_client_inactive_debug, (CE_NOTE, "nfs4_inactive_otw: "
4756             "release vnode %s", name));
4757         kmem_free(name, MAXNAMELEN);
4758 #endif
4759 
4760         if (vp->v_type == VREG) {
4761                 bool_t recov_failed = FALSE;
4762 
4763                 e.error = nfs4close_all(vp, cr);
4764                 if (e.error) {
4765                         /* Check to see if recovery failed */
4766                         mutex_enter(&(VTOMI4(vp)->mi_lock));
4767                         if (VTOMI4(vp)->mi_flags & MI4_RECOV_FAIL)
4768                                 recov_failed = TRUE;
4769                         mutex_exit(&(VTOMI4(vp)->mi_lock));
4770                         if (!recov_failed) {
4771                                 mutex_enter(&rp->r_statelock);
4772                                 if (rp->r_flags & R4RECOVERR)
4773                                         recov_failed = TRUE;
4774                                 mutex_exit(&rp->r_statelock);
4775                         }
4776                         if (recov_failed) {
4777                                 NFS4_DEBUG(nfs4_client_recov_debug,
4778                                     (CE_NOTE, "nfs4_inactive_otw: "
4779                                     "close failed (recovery failure)"));
4780                         }
4781                 }
4782         }
4783 
4784 redo:
4785         if (rp->r_unldvp == NULL) {
4786                 rp4_addfree(rp, cr);
4787                 return;
4788         }
4789 
4790         /*
4791          * Save the vnode pointer for the directory where the
4792          * unlinked-open file got renamed, then set it to NULL
4793          * to prevent another thread from getting here before
4794          * we're done with the remove.  While we have the
4795          * statelock, make local copies of the pertinent rnode
4796          * fields.  If we weren't to do this in an atomic way, the
4797          * the unl* fields could become inconsistent with respect
4798          * to each other due to a race condition between this
4799          * code and nfs_remove().  See bug report 1034328.
4800          */
4801         mutex_enter(&rp->r_statelock);
4802         if (rp->r_unldvp == NULL) {
4803                 mutex_exit(&rp->r_statelock);
4804                 rp4_addfree(rp, cr);
4805                 return;
4806         }
4807 
4808         unldvp = rp->r_unldvp;
4809         rp->r_unldvp = NULL;
4810         unlname = rp->r_unlname;
4811         rp->r_unlname = NULL;
4812         unlcred = rp->r_unlcred;
4813         rp->r_unlcred = NULL;
4814         mutex_exit(&rp->r_statelock);
4815 
4816         /*
4817          * If there are any dirty pages left, then flush
4818          * them.  This is unfortunate because they just
4819          * may get thrown away during the remove operation,
4820          * but we have to do this for correctness.
4821          */
4822         if (nfs4_has_pages(vp) &&
4823             ((rp->r_flags & R4DIRTY) || rp->r_count > 0)) {
4824                 ASSERT(vp->v_type != VCHR);
4825                 e.error = nfs4_putpage(vp, (u_offset_t)0, 0, 0, cr, NULL);
4826                 if (e.error) {
4827                         mutex_enter(&rp->r_statelock);
4828                         if (!rp->r_error)
4829                                 rp->r_error = e.error;
4830                         mutex_exit(&rp->r_statelock);
4831                 }
4832         }
4833 
4834         recov_state.rs_flags = 0;
4835         recov_state.rs_num_retry_despite_err = 0;
4836 recov_retry_remove:
4837         /*
4838          * Do the remove operation on the renamed file
4839          */
4840         args.ctag = TAG_INACTIVE;
4841 
4842         /*
4843          * Remove ops: putfh dir; remove
4844          */
4845         args.array_len = 2;
4846         args.array = argop;
4847 
4848         e.error = nfs4_start_op(VTOMI4(unldvp), unldvp, NULL, &recov_state);
4849         if (e.error) {
4850                 kmem_free(unlname, MAXNAMELEN);
4851                 crfree(unlcred);
4852                 VN_RELE(unldvp);
4853                 /*
4854                  * Try again; this time around r_unldvp will be NULL, so we'll
4855                  * just call rp4_addfree() and return.
4856                  */
4857                 goto redo;
4858         }
4859 
4860         /* putfh directory */
4861         argop[0].argop = OP_CPUTFH;
4862         argop[0].nfs_argop4_u.opcputfh.sfh = VTOR4(unldvp)->r_fh;
4863 
4864         /* remove */
4865         argop[1].argop = OP_CREMOVE;
4866         argop[1].nfs_argop4_u.opcremove.ctarget = unlname;
4867 
4868         doqueue = 1;
4869         resp = &res;
4870 
4871 #if 0 /* notyet */
4872         /*
4873          * Can't do this yet.  We may be being called from
4874          * dnlc_purge_XXX while that routine is holding a
4875          * mutex lock to the nc_rele list.  The calls to
4876          * nfs3_cache_wcc_data may result in calls to
4877          * dnlc_purge_XXX.  This will result in a deadlock.
4878          */
4879         rfs4call(VTOMI4(unldvp), &args, &res, unlcred, &doqueue, 0, &e);
4880         if (e.error) {
4881                 PURGE_ATTRCACHE4(unldvp);
4882                 resp = NULL;
4883         } else if (res.status) {
4884                 e.error = geterrno4(res.status);
4885                 PURGE_ATTRCACHE4(unldvp);
4886                 /*
4887                  * This code is inactive right now
4888                  * but if made active there should
4889                  * be a nfs4_end_op() call before
4890                  * nfs4_purge_stale_fh to avoid start_op()
4891                  * deadlock. See BugId: 4948726
4892                  */
4893                 nfs4_purge_stale_fh(error, unldvp, cr);
4894         } else {
4895                 nfs_resop4 *resop;
4896                 REMOVE4res *rm_res;
4897 
4898                 resop = &res.array[1];
4899                 rm_res = &resop->nfs_resop4_u.opremove;
4900                 /*
4901                  * Update directory cache attribute,
4902                  * readdir and dnlc caches.
4903                  */
4904                 nfs4_update_dircaches(&rm_res->cinfo, unldvp, NULL, NULL, NULL);
4905         }
4906 #else
4907         rfs4call(VTOMI4(unldvp), &args, &res, unlcred, &doqueue, 0, &e);
4908 
4909         PURGE_ATTRCACHE4(unldvp);
4910 #endif
4911 
4912         if (nfs4_needs_recovery(&e, FALSE, unldvp->v_vfsp)) {
4913                 if (nfs4_start_recovery(&e, VTOMI4(unldvp), unldvp, NULL,
4914                     NULL, NULL, OP_REMOVE, NULL, NULL, NULL) == FALSE) {
4915                         if (!e.error)
4916                                 (void) xdr_free(xdr_COMPOUND4res_clnt,
4917                                     (caddr_t)&res);
4918                         nfs4_end_op(VTOMI4(unldvp), unldvp, NULL,
4919                             &recov_state, TRUE);
4920                         goto recov_retry_remove;
4921                 }
4922         }
4923         nfs4_end_op(VTOMI4(unldvp), unldvp, NULL, &recov_state, FALSE);
4924 
4925         /*
4926          * Release stuff held for the remove
4927          */
4928         VN_RELE(unldvp);
4929         if (!e.error && resp)
4930                 (void) xdr_free(xdr_COMPOUND4res_clnt, (caddr_t)resp);
4931 
4932         kmem_free(unlname, MAXNAMELEN);
4933         crfree(unlcred);
4934         goto redo;
4935 }
4936 
4937 /*
4938  * Remote file system operations having to do with directory manipulation.
4939  */
4940 /* ARGSUSED3 */
4941 int
4942 nfs4_lookup(vnode_t *dvp, char *nm, vnode_t **vpp, struct pathname *pnp,
4943     int flags, vnode_t *rdir, cred_t *cr, caller_context_t *ct,
4944     int *direntflags, pathname_t *realpnp)
4945 {
4946         int error;
4947         vnode_t *vp, *avp = NULL;
4948         rnode4_t *drp;
4949 
4950         *vpp = NULL;
4951         if (nfs_zone() != VTOMI4(dvp)->mi_zone)
4952                 return (EPERM);
4953         /*
4954          * if LOOKUP_XATTR, must replace dvp (object) with
4955          * object's attrdir before continuing with lookup
4956          */
4957         if (flags & LOOKUP_XATTR) {
4958                 error = nfs4lookup_xattr(dvp, nm, &avp, flags, cr);
4959                 if (error)
4960                         return (error);
4961 
4962                 dvp = avp;
4963 
4964                 /*
4965                  * If lookup is for "", just return dvp now.  The attrdir
4966                  * has already been activated (from nfs4lookup_xattr), and
4967                  * the caller will RELE the original dvp -- not
4968                  * the attrdir.  So, set vpp and return.
4969                  * Currently, when the LOOKUP_XATTR flag is
4970                  * passed to VOP_LOOKUP, the name is always empty, and
4971                  * shortcircuiting here avoids 3 unneeded lock/unlock
4972                  * pairs.
4973                  *
4974                  * If a non-empty name was provided, then it is the
4975                  * attribute name, and it will be looked up below.
4976                  */
4977                 if (*nm == '\0') {
4978                         *vpp = dvp;
4979                         return (0);
4980                 }
4981 
4982                 /*
4983                  * The vfs layer never sends a name when asking for the
4984                  * attrdir, so we should never get here (unless of course
4985                  * name is passed at some time in future -- at which time
4986                  * we'll blow up here).
4987                  */
4988                 ASSERT(0);
4989         }
4990 
4991         drp = VTOR4(dvp);
4992         if (nfs_rw_enter_sig(&drp->r_rwlock, RW_READER, INTR4(dvp)))
4993                 return (EINTR);
4994 
4995         error = nfs4lookup(dvp, nm, vpp, cr, 0);
4996         nfs_rw_exit(&drp->r_rwlock);
4997 
4998         /*
4999          * If vnode is a device, create special vnode.
5000          */
5001         if (!error && ISVDEV((*vpp)->v_type)) {
5002                 vp = *vpp;
5003                 *vpp = specvp(vp, vp->v_rdev, vp->v_type, cr);
5004                 VN_RELE(vp);
5005         }
5006 
5007         return (error);
5008 }
5009 
5010 /* ARGSUSED */
5011 static int
5012 nfs4lookup_xattr(vnode_t *dvp, char *nm, vnode_t **vpp, int flags, cred_t *cr)
5013 {
5014         int error;
5015         rnode4_t *drp;
5016         int cflag = ((flags & CREATE_XATTR_DIR) != 0);
5017         mntinfo4_t *mi;
5018 
5019         mi = VTOMI4(dvp);
5020         if (!(mi->mi_vfsp->vfs_flag & VFS_XATTR) &&
5021             !vfs_has_feature(mi->mi_vfsp, VFSFT_SYSATTR_VIEWS))
5022                 return (EINVAL);
5023 
5024         drp = VTOR4(dvp);
5025         if (nfs_rw_enter_sig(&drp->r_rwlock, RW_READER, INTR4(dvp)))
5026                 return (EINTR);
5027 
5028         mutex_enter(&drp->r_statelock);
5029         /*
5030          * If the server doesn't support xattrs just return EINVAL
5031          */
5032         if (drp->r_xattr_dir == NFS4_XATTR_DIR_NOTSUPP) {
5033                 mutex_exit(&drp->r_statelock);
5034                 nfs_rw_exit(&drp->r_rwlock);
5035                 return (EINVAL);
5036         }
5037 
5038         /*
5039          * If there is a cached xattr directory entry,
5040          * use it as long as the attributes are valid. If the
5041          * attributes are not valid, take the simple approach and
5042          * free the cached value and re-fetch a new value.
5043          *
5044          * We don't negative entry cache for now, if we did we
5045          * would need to check if the file has changed on every
5046          * lookup. But xattrs don't exist very often and failing
5047          * an openattr is not much more expensive than and NVERIFY or GETATTR
5048          * so do an openattr over the wire for now.
5049          */
5050         if (drp->r_xattr_dir != NULL) {
5051                 if (ATTRCACHE4_VALID(dvp)) {
5052                         VN_HOLD(drp->r_xattr_dir);
5053                         *vpp = drp->r_xattr_dir;
5054                         mutex_exit(&drp->r_statelock);
5055                         nfs_rw_exit(&drp->r_rwlock);
5056                         return (0);
5057                 }
5058                 VN_RELE(drp->r_xattr_dir);
5059                 drp->r_xattr_dir = NULL;
5060         }
5061         mutex_exit(&drp->r_statelock);
5062 
5063         error = nfs4openattr(dvp, vpp, cflag, cr);
5064 
5065         nfs_rw_exit(&drp->r_rwlock);
5066 
5067         return (error);
5068 }
5069 
5070 static int
5071 nfs4lookup(vnode_t *dvp, char *nm, vnode_t **vpp, cred_t *cr, int skipdnlc)
5072 {
5073         int error;
5074         rnode4_t *drp;
5075 
5076         ASSERT(nfs_zone() == VTOMI4(dvp)->mi_zone);
5077 
5078         /*
5079          * If lookup is for "", just return dvp.  Don't need
5080          * to send it over the wire, look it up in the dnlc,
5081          * or perform any access checks.
5082          */
5083         if (*nm == '\0') {
5084                 VN_HOLD(dvp);
5085                 *vpp = dvp;
5086                 return (0);
5087         }
5088 
5089         /*
5090          * Can't do lookups in non-directories.
5091          */
5092         if (dvp->v_type != VDIR)
5093                 return (ENOTDIR);
5094 
5095         /*
5096          * If lookup is for ".", just return dvp.  Don't need
5097          * to send it over the wire or look it up in the dnlc,
5098          * just need to check access.
5099          */
5100         if (nm[0] == '.' && nm[1] == '\0') {
5101                 error = nfs4_access(dvp, VEXEC, 0, cr, NULL);
5102                 if (error)
5103                         return (error);
5104                 VN_HOLD(dvp);
5105                 *vpp = dvp;
5106                 return (0);
5107         }
5108 
5109         drp = VTOR4(dvp);
5110         if (!(drp->r_flags & R4LOOKUP)) {
5111                 mutex_enter(&drp->r_statelock);
5112                 drp->r_flags |= R4LOOKUP;
5113                 mutex_exit(&drp->r_statelock);
5114         }
5115 
5116         *vpp = NULL;
5117         /*
5118          * Lookup this name in the DNLC.  If there is no entry
5119          * lookup over the wire.
5120          */
5121         if (!skipdnlc)
5122                 *vpp = dnlc_lookup(dvp, nm);
5123         if (*vpp == NULL) {
5124                 /*
5125                  * We need to go over the wire to lookup the name.
5126                  */
5127                 return (nfs4lookupnew_otw(dvp, nm, vpp, cr));
5128         }
5129 
5130         /*
5131          * We hit on the dnlc
5132          */
5133         if (*vpp != DNLC_NO_VNODE ||
5134             (dvp->v_vfsp->vfs_flag & VFS_RDONLY)) {
5135                 /*
5136                  * But our attrs may not be valid.
5137                  */
5138                 if (ATTRCACHE4_VALID(dvp)) {
5139                         error = nfs4_waitfor_purge_complete(dvp);
5140                         if (error) {
5141                                 VN_RELE(*vpp);
5142                                 *vpp = NULL;
5143                                 return (error);
5144                         }
5145 
5146                         /*
5147                          * If after the purge completes, check to make sure
5148                          * our attrs are still valid.
5149                          */
5150                         if (ATTRCACHE4_VALID(dvp)) {
5151                                 /*
5152                                  * If we waited for a purge we may have
5153                                  * lost our vnode so look it up again.
5154                                  */
5155                                 VN_RELE(*vpp);
5156                                 *vpp = dnlc_lookup(dvp, nm);
5157                                 if (*vpp == NULL)
5158                                         return (nfs4lookupnew_otw(dvp,
5159                                             nm, vpp, cr));
5160 
5161                                 /*
5162                                  * The access cache should almost always hit
5163                                  */
5164                                 error = nfs4_access(dvp, VEXEC, 0, cr, NULL);
5165 
5166                                 if (error) {
5167                                         VN_RELE(*vpp);
5168                                         *vpp = NULL;
5169                                         return (error);
5170                                 }
5171                                 if (*vpp == DNLC_NO_VNODE) {
5172                                         VN_RELE(*vpp);
5173                                         *vpp = NULL;
5174                                         return (ENOENT);
5175                                 }
5176                                 return (0);
5177                         }
5178                 }
5179         }
5180 
5181         ASSERT(*vpp != NULL);
5182 
5183         /*
5184          * We may have gotten here we have one of the following cases:
5185          *      1) vpp != DNLC_NO_VNODE, our attrs have timed out so we
5186          *              need to validate them.
5187          *      2) vpp == DNLC_NO_VNODE, a negative entry that we always
5188          *              must validate.
5189          *
5190          * Go to the server and check if the directory has changed, if
5191          * it hasn't we are done and can use the dnlc entry.
5192          */
5193         return (nfs4lookupvalidate_otw(dvp, nm, vpp, cr));
5194 }
5195 
5196 /*
5197  * Go to the server and check if the directory has changed, if
5198  * it hasn't we are done and can use the dnlc entry.  If it
5199  * has changed we get a new copy of its attributes and check
5200  * the access for VEXEC, then relookup the filename and
5201  * get its filehandle and attributes.
5202  *
5203  * PUTFH dfh NVERIFY GETATTR ACCESS LOOKUP GETFH GETATTR
5204  *      if the NVERIFY failed we must
5205  *              purge the caches
5206  *              cache new attributes (will set r_time_attr_inval)
5207  *              cache new access
5208  *              recheck VEXEC access
5209  *              add name to dnlc, possibly negative
5210  *              if LOOKUP succeeded
5211  *                      cache new attributes
5212  *      else
5213  *              set a new r_time_attr_inval for dvp
5214  *              check to make sure we have access
5215  *
5216  * The vpp returned is the vnode passed in if the directory is valid,
5217  * a new vnode if successful lookup, or NULL on error.
5218  */
5219 static int
5220 nfs4lookupvalidate_otw(vnode_t *dvp, char *nm, vnode_t **vpp, cred_t *cr)
5221 {
5222         COMPOUND4args_clnt args;
5223         COMPOUND4res_clnt res;
5224         fattr4 *ver_fattr;
5225         fattr4_change dchange;
5226         int32_t *ptr;
5227         int argoplist_size  = 7 * sizeof (nfs_argop4);
5228         nfs_argop4 *argop;
5229         int doqueue;
5230         mntinfo4_t *mi;
5231         nfs4_recov_state_t recov_state;
5232         hrtime_t t;
5233         int isdotdot;
5234         vnode_t *nvp;
5235         nfs_fh4 *fhp;
5236         nfs4_sharedfh_t *sfhp;
5237         nfs4_access_type_t cacc;
5238         rnode4_t *nrp;
5239         rnode4_t *drp = VTOR4(dvp);
5240         nfs4_ga_res_t *garp = NULL;
5241         nfs4_error_t e = { 0, NFS4_OK, RPC_SUCCESS };
5242 
5243         ASSERT(nfs_zone() == VTOMI4(dvp)->mi_zone);
5244         ASSERT(nm != NULL);
5245         ASSERT(nm[0] != '\0');
5246         ASSERT(dvp->v_type == VDIR);
5247         ASSERT(nm[0] != '.' || nm[1] != '\0');
5248         ASSERT(*vpp != NULL);
5249 
5250         if (nm[0] == '.' && nm[1] == '.' && nm[2] == '\0') {
5251                 isdotdot = 1;
5252                 args.ctag = TAG_LOOKUP_VPARENT;
5253         } else {
5254                 /*
5255                  * If dvp were a stub, it should have triggered and caused
5256                  * a mount for us to get this far.
5257                  */
5258                 ASSERT(!RP_ISSTUB(VTOR4(dvp)));
5259 
5260                 isdotdot = 0;
5261                 args.ctag = TAG_LOOKUP_VALID;
5262         }
5263 
5264         mi = VTOMI4(dvp);
5265         recov_state.rs_flags = 0;
5266         recov_state.rs_num_retry_despite_err = 0;
5267 
5268         nvp = NULL;
5269 
5270         /* Save the original mount point security information */
5271         (void) save_mnt_secinfo(mi->mi_curr_serv);
5272 
5273 recov_retry:
5274         e.error = nfs4_start_fop(mi, dvp, NULL, OH_LOOKUP,
5275             &recov_state, NULL);
5276         if (e.error) {
5277                 (void) check_mnt_secinfo(mi->mi_curr_serv, nvp);
5278                 VN_RELE(*vpp);
5279                 *vpp = NULL;
5280                 return (e.error);
5281         }
5282 
5283         argop = kmem_alloc(argoplist_size, KM_SLEEP);
5284 
5285         /* PUTFH dfh NVERIFY GETATTR ACCESS LOOKUP GETFH GETATTR */
5286         args.array_len = 7;
5287         args.array = argop;
5288 
5289         /* 0. putfh file */
5290         argop[0].argop = OP_CPUTFH;
5291         argop[0].nfs_argop4_u.opcputfh.sfh = VTOR4(dvp)->r_fh;
5292 
5293         /* 1. nverify the change info */
5294         argop[1].argop = OP_NVERIFY;
5295         ver_fattr = &argop[1].nfs_argop4_u.opnverify.obj_attributes;
5296         ver_fattr->attrmask = FATTR4_CHANGE_MASK;
5297         ver_fattr->attrlist4 = (char *)&dchange;
5298         ptr = (int32_t *)&dchange;
5299         IXDR_PUT_HYPER(ptr, VTOR4(dvp)->r_change);
5300         ver_fattr->attrlist4_len = sizeof (fattr4_change);
5301 
5302         /* 2. getattr directory */
5303         argop[2].argop = OP_GETATTR;
5304         argop[2].nfs_argop4_u.opgetattr.attr_request = NFS4_VATTR_MASK;
5305         argop[2].nfs_argop4_u.opgetattr.mi = VTOMI4(dvp);
5306 
5307         /* 3. access directory */
5308         argop[3].argop = OP_ACCESS;
5309         argop[3].nfs_argop4_u.opaccess.access = ACCESS4_READ | ACCESS4_DELETE |
5310             ACCESS4_MODIFY | ACCESS4_EXTEND | ACCESS4_LOOKUP;
5311 
5312         /* 4. lookup name */
5313         if (isdotdot) {
5314                 argop[4].argop = OP_LOOKUPP;
5315         } else {
5316                 argop[4].argop = OP_CLOOKUP;
5317                 argop[4].nfs_argop4_u.opclookup.cname = nm;
5318         }
5319 
5320         /* 5. resulting file handle */
5321         argop[5].argop = OP_GETFH;
5322 
5323         /* 6. resulting file attributes */
5324         argop[6].argop = OP_GETATTR;
5325         argop[6].nfs_argop4_u.opgetattr.attr_request = NFS4_VATTR_MASK;
5326         argop[6].nfs_argop4_u.opgetattr.mi = VTOMI4(dvp);
5327 
5328         doqueue = 1;
5329         t = gethrtime();
5330 
5331         rfs4call(VTOMI4(dvp), &args, &res, cr, &doqueue, 0, &e);
5332 
5333         if (!isdotdot && res.status == NFS4ERR_MOVED) {
5334                 e.error = nfs4_setup_referral(dvp, nm, vpp, cr);
5335                 if (e.error != 0 && *vpp != NULL)
5336                         VN_RELE(*vpp);
5337                 nfs4_end_fop(mi, dvp, NULL, OH_LOOKUP,
5338                     &recov_state, FALSE);
5339                 (void) xdr_free(xdr_COMPOUND4res_clnt, (caddr_t)&res);
5340                 kmem_free(argop, argoplist_size);
5341                 return (e.error);
5342         }
5343 
5344         if (nfs4_needs_recovery(&e, FALSE, dvp->v_vfsp)) {
5345                 /*
5346                  * For WRONGSEC of a non-dotdot case, send secinfo directly
5347                  * from this thread, do not go thru the recovery thread since
5348                  * we need the nm information.
5349                  *
5350                  * Not doing dotdot case because there is no specification
5351                  * for (PUTFH, SECINFO "..") yet.
5352                  */
5353                 if (!isdotdot && res.status == NFS4ERR_WRONGSEC) {
5354                         if ((e.error = nfs4_secinfo_vnode_otw(dvp, nm, cr)))
5355                                 nfs4_end_fop(mi, dvp, NULL, OH_LOOKUP,
5356                                     &recov_state, FALSE);
5357                         else
5358                                 nfs4_end_fop(mi, dvp, NULL, OH_LOOKUP,
5359                                     &recov_state, TRUE);
5360                         (void) xdr_free(xdr_COMPOUND4res_clnt, (caddr_t)&res);
5361                         kmem_free(argop, argoplist_size);
5362                         if (!e.error)
5363                                 goto recov_retry;
5364                         (void) check_mnt_secinfo(mi->mi_curr_serv, nvp);
5365                         VN_RELE(*vpp);
5366                         *vpp = NULL;
5367                         return (e.error);
5368                 }
5369 
5370                 if (nfs4_start_recovery(&e, mi, dvp, NULL, NULL, NULL,
5371                     OP_LOOKUP, NULL, NULL, NULL) == FALSE) {
5372                         nfs4_end_fop(mi, dvp, NULL, OH_LOOKUP,
5373                             &recov_state, TRUE);
5374 
5375                         (void) xdr_free(xdr_COMPOUND4res_clnt, (caddr_t)&res);
5376                         kmem_free(argop, argoplist_size);
5377                         goto recov_retry;
5378                 }
5379         }
5380 
5381         nfs4_end_fop(mi, dvp, NULL, OH_LOOKUP, &recov_state, FALSE);
5382 
5383         if (e.error || res.array_len == 0) {
5384                 /*
5385                  * If e.error isn't set, then reply has no ops (or we couldn't
5386                  * be here).  The only legal way to reply without an op array
5387                  * is via NFS4ERR_MINOR_VERS_MISMATCH.  An ops array should
5388                  * be in the reply for all other status values.
5389                  *
5390                  * For valid replies without an ops array, return ENOTSUP
5391                  * (geterrno4 xlation of VERS_MISMATCH).  For illegal replies,
5392                  * return EIO -- don't trust status.
5393                  */
5394                 if (e.error == 0)
5395                         e.error = (res.status == NFS4ERR_MINOR_VERS_MISMATCH) ?
5396                             ENOTSUP : EIO;
5397                 VN_RELE(*vpp);
5398                 *vpp = NULL;
5399                 kmem_free(argop, argoplist_size);
5400                 (void) check_mnt_secinfo(mi->mi_curr_serv, nvp);
5401                 return (e.error);
5402         }
5403 
5404         if (res.status != NFS4ERR_SAME) {
5405                 e.error = geterrno4(res.status);
5406 
5407                 /*
5408                  * The NVERIFY "failed" so the directory has changed
5409                  * First make sure PUTFH succeeded and NVERIFY "failed"
5410                  * cleanly.
5411                  */
5412                 if ((res.array[0].nfs_resop4_u.opputfh.status != NFS4_OK) ||
5413                     (res.array[1].nfs_resop4_u.opnverify.status != NFS4_OK)) {
5414                         nfs4_purge_stale_fh(e.error, dvp, cr);
5415                         VN_RELE(*vpp);
5416                         *vpp = NULL;
5417                         goto exit;
5418                 }
5419 
5420                 /*
5421                  * We know the NVERIFY "failed" so we must:
5422                  *      purge the caches (access and indirectly dnlc if needed)
5423                  */
5424                 nfs4_purge_caches(dvp, NFS4_NOPURGE_DNLC, cr, TRUE);
5425 
5426                 if (res.array[2].nfs_resop4_u.opgetattr.status != NFS4_OK) {
5427                         nfs4_purge_stale_fh(e.error, dvp, cr);
5428                         VN_RELE(*vpp);
5429                         *vpp = NULL;
5430                         goto exit;
5431                 }
5432 
5433                 /*
5434                  * Install new cached attributes for the directory
5435                  */
5436                 nfs4_attr_cache(dvp,
5437                     &res.array[2].nfs_resop4_u.opgetattr.ga_res,
5438                     t, cr, FALSE, NULL);
5439 
5440                 if (res.array[3].nfs_resop4_u.opaccess.status != NFS4_OK) {
5441                         nfs4_purge_stale_fh(e.error, dvp, cr);
5442                         VN_RELE(*vpp);
5443                         *vpp = NULL;
5444                         e.error = geterrno4(res.status);
5445                         goto exit;
5446                 }
5447 
5448                 /*
5449                  * Now we know the directory is valid,
5450                  * cache new directory access
5451                  */
5452                 nfs4_access_cache(drp,
5453                     args.array[3].nfs_argop4_u.opaccess.access,
5454                     res.array[3].nfs_resop4_u.opaccess.access, cr);
5455 
5456                 /*
5457                  * recheck VEXEC access
5458                  */
5459                 cacc = nfs4_access_check(drp, ACCESS4_LOOKUP, cr);
5460                 if (cacc != NFS4_ACCESS_ALLOWED) {
5461                         /*
5462                          * Directory permissions might have been revoked
5463                          */
5464                         if (cacc == NFS4_ACCESS_DENIED) {
5465                                 e.error = EACCES;
5466                                 VN_RELE(*vpp);
5467                                 *vpp = NULL;
5468                                 goto exit;
5469                         }
5470 
5471                         /*
5472                          * Somehow we must not have asked for enough
5473                          * so try a singleton ACCESS, should never happen.
5474                          */
5475                         e.error = nfs4_access(dvp, VEXEC, 0, cr, NULL);
5476                         if (e.error) {
5477                                 VN_RELE(*vpp);
5478                                 *vpp = NULL;
5479                                 goto exit;
5480                         }
5481                 }
5482 
5483                 e.error = geterrno4(res.status);
5484                 if (res.array[4].nfs_resop4_u.oplookup.status != NFS4_OK) {
5485                         /*
5486                          * The lookup failed, probably no entry
5487                          */
5488                         if (e.error == ENOENT && nfs4_lookup_neg_cache) {
5489                                 dnlc_update(dvp, nm, DNLC_NO_VNODE);
5490                         } else {
5491                                 /*
5492                                  * Might be some other error, so remove
5493                                  * the dnlc entry to make sure we start all
5494                                  * over again, next time.
5495                                  */
5496                                 dnlc_remove(dvp, nm);
5497                         }
5498                         VN_RELE(*vpp);
5499                         *vpp = NULL;
5500                         goto exit;
5501                 }
5502 
5503                 if (res.array[5].nfs_resop4_u.opgetfh.status != NFS4_OK) {
5504                         /*
5505                          * The file exists but we can't get its fh for
5506                          * some unknown reason.  Remove it from the dnlc
5507                          * and error out to be safe.
5508                          */
5509                         dnlc_remove(dvp, nm);
5510                         VN_RELE(*vpp);
5511                         *vpp = NULL;
5512                         goto exit;
5513                 }
5514                 fhp = &res.array[5].nfs_resop4_u.opgetfh.object;
5515                 if (fhp->nfs_fh4_len == 0) {
5516                         /*
5517                          * The file exists but a bogus fh
5518                          * some unknown reason.  Remove it from the dnlc
5519                          * and error out to be safe.
5520                          */
5521                         e.error = ENOENT;
5522                         dnlc_remove(dvp, nm);
5523                         VN_RELE(*vpp);
5524                         *vpp = NULL;
5525                         goto exit;
5526                 }
5527                 sfhp = sfh4_get(fhp, mi);
5528 
5529                 if (res.array[6].nfs_resop4_u.opgetattr.status == NFS4_OK)
5530                         garp = &res.array[6].nfs_resop4_u.opgetattr.ga_res;
5531 
5532                 /*
5533                  * Make the new rnode
5534                  */
5535                 if (isdotdot) {
5536                         e.error = nfs4_make_dotdot(sfhp, t, dvp, cr, &nvp, 1);
5537                         if (e.error) {
5538                                 sfh4_rele(&sfhp);
5539                                 VN_RELE(*vpp);
5540                                 *vpp = NULL;
5541                                 goto exit;
5542                         }
5543                         /*
5544                          * XXX if nfs4_make_dotdot uses an existing rnode
5545                          * XXX it doesn't update the attributes.
5546                          * XXX for now just save them again to save an OTW
5547                          */
5548                         nfs4_attr_cache(nvp, garp, t, cr, FALSE, NULL);
5549                 } else {
5550                         nvp = makenfs4node(sfhp, garp, dvp->v_vfsp, t, cr,
5551                             dvp, fn_get(VTOSV(dvp)->sv_name, nm, sfhp));
5552                         /*
5553                          * If v_type == VNON, then garp was NULL because
5554                          * the last op in the compound failed and makenfs4node
5555                          * could not find the vnode for sfhp. It created
5556                          * a new vnode, so we have nothing to purge here.
5557                          */
5558                         if (nvp->v_type == VNON) {
5559                                 vattr_t vattr;
5560 
5561                                 vattr.va_mask = AT_TYPE;
5562                                 /*
5563                                  * N.B. We've already called nfs4_end_fop above.
5564                                  */
5565                                 e.error = nfs4getattr(nvp, &vattr, cr);
5566                                 if (e.error) {
5567                                         sfh4_rele(&sfhp);
5568                                         VN_RELE(*vpp);
5569                                         *vpp = NULL;
5570                                         VN_RELE(nvp);
5571                                         goto exit;
5572                                 }
5573                                 nvp->v_type = vattr.va_type;
5574                         }
5575                 }
5576                 sfh4_rele(&sfhp);
5577 
5578                 nrp = VTOR4(nvp);
5579                 mutex_enter(&nrp->r_statev4_lock);
5580                 if (!nrp->created_v4) {
5581                         mutex_exit(&nrp->r_statev4_lock);
5582                         dnlc_update(dvp, nm, nvp);
5583                 } else
5584                         mutex_exit(&nrp->r_statev4_lock);
5585 
5586                 VN_RELE(*vpp);
5587                 *vpp = nvp;
5588         } else {
5589                 hrtime_t now;
5590                 hrtime_t delta = 0;
5591 
5592                 e.error = 0;
5593 
5594                 /*
5595                  * Because the NVERIFY "succeeded" we know that the
5596                  * directory attributes are still valid
5597                  * so update r_time_attr_inval
5598                  */
5599                 now = gethrtime();
5600                 mutex_enter(&drp->r_statelock);
5601                 if (!(mi->mi_flags & MI4_NOAC) && !(dvp->v_flag & VNOCACHE)) {
5602                         delta = now - drp->r_time_attr_saved;
5603                         if (delta < mi->mi_acdirmin)
5604                                 delta = mi->mi_acdirmin;
5605                         else if (delta > mi->mi_acdirmax)
5606                                 delta = mi->mi_acdirmax;
5607                 }
5608                 drp->r_time_attr_inval = now + delta;
5609                 mutex_exit(&drp->r_statelock);
5610                 dnlc_update(dvp, nm, *vpp);
5611 
5612                 /*
5613                  * Even though we have a valid directory attr cache
5614                  * and dnlc entry, we may not have access.
5615                  * This should almost always hit the cache.
5616                  */
5617                 e.error = nfs4_access(dvp, VEXEC, 0, cr, NULL);
5618                 if (e.error) {
5619                         VN_RELE(*vpp);
5620                         *vpp = NULL;
5621                 }
5622 
5623                 if (*vpp == DNLC_NO_VNODE) {
5624                         VN_RELE(*vpp);
5625                         *vpp = NULL;
5626                         e.error = ENOENT;
5627                 }
5628         }
5629 
5630 exit:
5631         (void) xdr_free(xdr_COMPOUND4res_clnt, (caddr_t)&res);
5632         kmem_free(argop, argoplist_size);
5633         (void) check_mnt_secinfo(mi->mi_curr_serv, nvp);
5634         return (e.error);
5635 }
5636 
5637 /*
5638  * We need to go over the wire to lookup the name, but
5639  * while we are there verify the directory has not
5640  * changed but if it has, get new attributes and check access
5641  *
5642  * PUTFH dfh SAVEFH LOOKUP nm GETFH GETATTR RESTOREFH
5643  *                                      NVERIFY GETATTR ACCESS
5644  *
5645  * With the results:
5646  *      if the NVERIFY failed we must purge the caches, add new attributes,
5647  *              and cache new access.
5648  *      set a new r_time_attr_inval
5649  *      add name to dnlc, possibly negative
5650  *      if LOOKUP succeeded
5651  *              cache new attributes
5652  */
5653 static int
5654 nfs4lookupnew_otw(vnode_t *dvp, char *nm, vnode_t **vpp, cred_t *cr)
5655 {
5656         COMPOUND4args_clnt args;
5657         COMPOUND4res_clnt res;
5658         fattr4 *ver_fattr;
5659         fattr4_change dchange;
5660         int32_t *ptr;
5661         nfs4_ga_res_t *garp = NULL;
5662         int argoplist_size  = 9 * sizeof (nfs_argop4);
5663         nfs_argop4 *argop;
5664         int doqueue;
5665         mntinfo4_t *mi;
5666         nfs4_recov_state_t recov_state;
5667         hrtime_t t;
5668         int isdotdot;
5669         vnode_t *nvp;
5670         nfs_fh4 *fhp;
5671         nfs4_sharedfh_t *sfhp;
5672         nfs4_access_type_t cacc;
5673         rnode4_t *nrp;
5674         rnode4_t *drp = VTOR4(dvp);
5675         nfs4_error_t e = { 0, NFS4_OK, RPC_SUCCESS };
5676 
5677         ASSERT(nfs_zone() == VTOMI4(dvp)->mi_zone);
5678         ASSERT(nm != NULL);
5679         ASSERT(nm[0] != '\0');
5680         ASSERT(dvp->v_type == VDIR);
5681         ASSERT(nm[0] != '.' || nm[1] != '\0');
5682         ASSERT(*vpp == NULL);
5683 
5684         if (nm[0] == '.' && nm[1] == '.' && nm[2] == '\0') {
5685                 isdotdot = 1;
5686                 args.ctag = TAG_LOOKUP_PARENT;
5687         } else {
5688                 /*
5689                  * If dvp were a stub, it should have triggered and caused
5690                  * a mount for us to get this far.
5691                  */
5692                 ASSERT(!RP_ISSTUB(VTOR4(dvp)));
5693 
5694                 isdotdot = 0;
5695                 args.ctag = TAG_LOOKUP;
5696         }
5697 
5698         mi = VTOMI4(dvp);
5699         recov_state.rs_flags = 0;
5700         recov_state.rs_num_retry_despite_err = 0;
5701 
5702         nvp = NULL;
5703 
5704         /* Save the original mount point security information */
5705         (void) save_mnt_secinfo(mi->mi_curr_serv);
5706 
5707 recov_retry:
5708         e.error = nfs4_start_fop(mi, dvp, NULL, OH_LOOKUP,
5709             &recov_state, NULL);
5710         if (e.error) {
5711                 (void) check_mnt_secinfo(mi->mi_curr_serv, nvp);
5712                 return (e.error);
5713         }
5714 
5715         argop = kmem_alloc(argoplist_size, KM_SLEEP);
5716 
5717         /* PUTFH SAVEFH LOOKUP GETFH GETATTR RESTOREFH NVERIFY GETATTR ACCESS */
5718         args.array_len = 9;
5719         args.array = argop;
5720 
5721         /* 0. putfh file */
5722         argop[0].argop = OP_CPUTFH;
5723         argop[0].nfs_argop4_u.opcputfh.sfh = VTOR4(dvp)->r_fh;
5724 
5725         /* 1. savefh for the nverify */
5726         argop[1].argop = OP_SAVEFH;
5727 
5728         /* 2. lookup name */
5729         if (isdotdot) {
5730                 argop[2].argop = OP_LOOKUPP;
5731         } else {
5732                 argop[2].argop = OP_CLOOKUP;
5733                 argop[2].nfs_argop4_u.opclookup.cname = nm;
5734         }
5735 
5736         /* 3. resulting file handle */
5737         argop[3].argop = OP_GETFH;
5738 
5739         /* 4. resulting file attributes */
5740         argop[4].argop = OP_GETATTR;
5741         argop[4].nfs_argop4_u.opgetattr.attr_request = NFS4_VATTR_MASK;
5742         argop[4].nfs_argop4_u.opgetattr.mi = VTOMI4(dvp);
5743 
5744         /* 5. restorefh back the directory for the nverify */
5745         argop[5].argop = OP_RESTOREFH;
5746 
5747         /* 6. nverify the change info */
5748         argop[6].argop = OP_NVERIFY;
5749         ver_fattr = &argop[6].nfs_argop4_u.opnverify.obj_attributes;
5750         ver_fattr->attrmask = FATTR4_CHANGE_MASK;
5751         ver_fattr->attrlist4 = (char *)&dchange;
5752         ptr = (int32_t *)&dchange;
5753         IXDR_PUT_HYPER(ptr, VTOR4(dvp)->r_change);
5754         ver_fattr->attrlist4_len = sizeof (fattr4_change);
5755 
5756         /* 7. getattr directory */
5757         argop[7].argop = OP_GETATTR;
5758         argop[7].nfs_argop4_u.opgetattr.attr_request = NFS4_VATTR_MASK;
5759         argop[7].nfs_argop4_u.opgetattr.mi = VTOMI4(dvp);
5760 
5761         /* 8. access directory */
5762         argop[8].argop = OP_ACCESS;
5763         argop[8].nfs_argop4_u.opaccess.access = ACCESS4_READ | ACCESS4_DELETE |
5764             ACCESS4_MODIFY | ACCESS4_EXTEND | ACCESS4_LOOKUP;
5765 
5766         doqueue = 1;
5767         t = gethrtime();
5768 
5769         rfs4call(VTOMI4(dvp), &args, &res, cr, &doqueue, 0, &e);
5770 
5771         if (!isdotdot && res.status == NFS4ERR_MOVED) {
5772                 e.error = nfs4_setup_referral(dvp, nm, vpp, cr);
5773                 if (e.error != 0 && *vpp != NULL)
5774                         VN_RELE(*vpp);
5775                 nfs4_end_fop(mi, dvp, NULL, OH_LOOKUP,
5776                     &recov_state, FALSE);
5777                 (void) xdr_free(xdr_COMPOUND4res_clnt, (caddr_t)&res);
5778                 kmem_free(argop, argoplist_size);
5779                 return (e.error);
5780         }
5781 
5782         if (nfs4_needs_recovery(&e, FALSE, dvp->v_vfsp)) {
5783                 /*
5784                  * For WRONGSEC of a non-dotdot case, send secinfo directly
5785                  * from this thread, do not go thru the recovery thread since
5786                  * we need the nm information.
5787                  *
5788                  * Not doing dotdot case because there is no specification
5789                  * for (PUTFH, SECINFO "..") yet.
5790                  */
5791                 if (!isdotdot && res.status == NFS4ERR_WRONGSEC) {
5792                         if ((e.error = nfs4_secinfo_vnode_otw(dvp, nm, cr)))
5793                                 nfs4_end_fop(mi, dvp, NULL, OH_LOOKUP,
5794                                     &recov_state, FALSE);
5795                         else
5796                                 nfs4_end_fop(mi, dvp, NULL, OH_LOOKUP,
5797                                     &recov_state, TRUE);
5798                         (void) xdr_free(xdr_COMPOUND4res_clnt, (caddr_t)&res);
5799                         kmem_free(argop, argoplist_size);
5800                         if (!e.error)
5801                                 goto recov_retry;
5802                         (void) check_mnt_secinfo(mi->mi_curr_serv, nvp);
5803                         return (e.error);
5804                 }
5805 
5806                 if (nfs4_start_recovery(&e, mi, dvp, NULL, NULL, NULL,
5807                     OP_LOOKUP, NULL, NULL, NULL) == FALSE) {
5808                         nfs4_end_fop(mi, dvp, NULL, OH_LOOKUP,
5809                             &recov_state, TRUE);
5810 
5811                         (void) xdr_free(xdr_COMPOUND4res_clnt, (caddr_t)&res);
5812                         kmem_free(argop, argoplist_size);
5813                         goto recov_retry;
5814                 }
5815         }
5816 
5817         nfs4_end_fop(mi, dvp, NULL, OH_LOOKUP, &recov_state, FALSE);
5818 
5819         if (e.error || res.array_len == 0) {
5820                 /*
5821                  * If e.error isn't set, then reply has no ops (or we couldn't
5822                  * be here).  The only legal way to reply without an op array
5823                  * is via NFS4ERR_MINOR_VERS_MISMATCH.  An ops array should
5824                  * be in the reply for all other status values.
5825                  *
5826                  * For valid replies without an ops array, return ENOTSUP
5827                  * (geterrno4 xlation of VERS_MISMATCH).  For illegal replies,
5828                  * return EIO -- don't trust status.
5829                  */
5830                 if (e.error == 0)
5831                         e.error = (res.status == NFS4ERR_MINOR_VERS_MISMATCH) ?
5832                             ENOTSUP : EIO;
5833 
5834                 kmem_free(argop, argoplist_size);
5835                 (void) check_mnt_secinfo(mi->mi_curr_serv, nvp);
5836                 return (e.error);
5837         }
5838 
5839         e.error = geterrno4(res.status);
5840 
5841         /*
5842          * The PUTFH and SAVEFH may have failed.
5843          */
5844         if ((res.array[0].nfs_resop4_u.opputfh.status != NFS4_OK) ||
5845             (res.array[1].nfs_resop4_u.opsavefh.status != NFS4_OK)) {
5846                 nfs4_purge_stale_fh(e.error, dvp, cr);
5847                 goto exit;
5848         }
5849 
5850         /*
5851          * Check if the file exists, if it does delay entering
5852          * into the dnlc until after we update the directory
5853          * attributes so we don't cause it to get purged immediately.
5854          */
5855         if (res.array[2].nfs_resop4_u.oplookup.status != NFS4_OK) {
5856                 /*
5857                  * The lookup failed, probably no entry
5858                  */
5859                 if (e.error == ENOENT && nfs4_lookup_neg_cache)
5860                         dnlc_update(dvp, nm, DNLC_NO_VNODE);
5861                 goto exit;
5862         }
5863 
5864         if (res.array[3].nfs_resop4_u.opgetfh.status != NFS4_OK) {
5865                 /*
5866                  * The file exists but we can't get its fh for
5867                  * some unknown reason. Error out to be safe.
5868                  */
5869                 goto exit;
5870         }
5871 
5872         fhp = &res.array[3].nfs_resop4_u.opgetfh.object;
5873         if (fhp->nfs_fh4_len == 0) {
5874                 /*
5875                  * The file exists but a bogus fh
5876                  * some unknown reason.  Error out to be safe.
5877                  */
5878                 e.error = EIO;
5879                 goto exit;
5880         }
5881         sfhp = sfh4_get(fhp, mi);
5882 
5883         if (res.array[4].nfs_resop4_u.opgetattr.status != NFS4_OK) {
5884                 sfh4_rele(&sfhp);
5885                 goto exit;
5886         }
5887         garp = &res.array[4].nfs_resop4_u.opgetattr.ga_res;
5888 
5889         /*
5890          * The RESTOREFH may have failed
5891          */
5892         if (res.array[5].nfs_resop4_u.oprestorefh.status != NFS4_OK) {
5893                 sfh4_rele(&sfhp);
5894                 e.error = EIO;
5895                 goto exit;
5896         }
5897 
5898         if (res.array[6].nfs_resop4_u.opnverify.status != NFS4ERR_SAME) {
5899                 /*
5900                  * First make sure the NVERIFY failed as we expected,
5901                  * if it didn't then be conservative and error out
5902                  * as we can't trust the directory.
5903                  */
5904                 if (res.array[6].nfs_resop4_u.opnverify.status != NFS4_OK) {
5905                         sfh4_rele(&sfhp);
5906                         e.error = EIO;
5907                         goto exit;
5908                 }
5909 
5910                 /*
5911                  * We know the NVERIFY "failed" so the directory has changed,
5912                  * so we must:
5913                  *      purge the caches (access and indirectly dnlc if needed)
5914                  */
5915                 nfs4_purge_caches(dvp, NFS4_NOPURGE_DNLC, cr, TRUE);
5916 
5917                 if (res.array[7].nfs_resop4_u.opgetattr.status != NFS4_OK) {
5918                         sfh4_rele(&sfhp);
5919                         goto exit;
5920                 }
5921                 nfs4_attr_cache(dvp,
5922                     &res.array[7].nfs_resop4_u.opgetattr.ga_res,
5923                     t, cr, FALSE, NULL);
5924 
5925                 if (res.array[8].nfs_resop4_u.opaccess.status != NFS4_OK) {
5926                         nfs4_purge_stale_fh(e.error, dvp, cr);
5927                         sfh4_rele(&sfhp);
5928                         e.error = geterrno4(res.status);
5929                         goto exit;
5930                 }
5931 
5932                 /*
5933                  * Now we know the directory is valid,
5934                  * cache new directory access
5935                  */
5936                 nfs4_access_cache(drp,
5937                     args.array[8].nfs_argop4_u.opaccess.access,
5938                     res.array[8].nfs_resop4_u.opaccess.access, cr);
5939 
5940                 /*
5941                  * recheck VEXEC access
5942                  */
5943                 cacc = nfs4_access_check(drp, ACCESS4_LOOKUP, cr);
5944                 if (cacc != NFS4_ACCESS_ALLOWED) {
5945                         /*
5946                          * Directory permissions might have been revoked
5947                          */
5948                         if (cacc == NFS4_ACCESS_DENIED) {
5949                                 sfh4_rele(&sfhp);
5950                                 e.error = EACCES;
5951                                 goto exit;
5952                         }
5953 
5954                         /*
5955                          * Somehow we must not have asked for enough
5956                          * so try a singleton ACCESS should never happen
5957                          */
5958                         e.error = nfs4_access(dvp, VEXEC, 0, cr, NULL);
5959                         if (e.error) {
5960                                 sfh4_rele(&sfhp);
5961                                 goto exit;
5962                         }
5963                 }
5964 
5965                 e.error = geterrno4(res.status);
5966         } else {
5967                 hrtime_t now;
5968                 hrtime_t delta = 0;
5969 
5970                 e.error = 0;
5971 
5972                 /*
5973                  * Because the NVERIFY "succeeded" we know that the
5974                  * directory attributes are still valid
5975                  * so update r_time_attr_inval
5976                  */
5977                 now = gethrtime();
5978                 mutex_enter(&drp->r_statelock);
5979                 if (!(mi->mi_flags & MI4_NOAC) && !(dvp->v_flag & VNOCACHE)) {
5980                         delta = now - drp->r_time_attr_saved;
5981                         if (delta < mi->mi_acdirmin)
5982                                 delta = mi->mi_acdirmin;
5983                         else if (delta > mi->mi_acdirmax)
5984                                 delta = mi->mi_acdirmax;
5985                 }
5986                 drp->r_time_attr_inval = now + delta;
5987                 mutex_exit(&drp->r_statelock);
5988 
5989                 /*
5990                  * Even though we have a valid directory attr cache,
5991                  * we may not have access.
5992                  * This should almost always hit the cache.
5993                  */
5994                 e.error = nfs4_access(dvp, VEXEC, 0, cr, NULL);
5995                 if (e.error) {
5996                         sfh4_rele(&sfhp);
5997                         goto exit;
5998                 }
5999         }
6000 
6001         /*
6002          * Now we have successfully completed the lookup, if the
6003          * directory has changed we now have the valid attributes.
6004          * We also know we have directory access.
6005          * Create the new rnode and insert it in the dnlc.
6006          */
6007         if (isdotdot) {
6008                 e.error = nfs4_make_dotdot(sfhp, t, dvp, cr, &nvp, 1);
6009                 if (e.error) {
6010                         sfh4_rele(&sfhp);
6011                         goto exit;
6012                 }
6013                 /*
6014                  * XXX if nfs4_make_dotdot uses an existing rnode
6015                  * XXX it doesn't update the attributes.
6016                  * XXX for now just save them again to save an OTW
6017                  */
6018                 nfs4_attr_cache(nvp, garp, t, cr, FALSE, NULL);
6019         } else {
6020                 nvp = makenfs4node(sfhp, garp, dvp->v_vfsp, t, cr,
6021                     dvp, fn_get(VTOSV(dvp)->sv_name, nm, sfhp));
6022         }
6023         sfh4_rele(&sfhp);
6024 
6025         nrp = VTOR4(nvp);
6026         mutex_enter(&nrp->r_statev4_lock);
6027         if (!nrp->created_v4) {
6028                 mutex_exit(&nrp->r_statev4_lock);
6029                 dnlc_update(dvp, nm, nvp);
6030         } else
6031                 mutex_exit(&nrp->r_statev4_lock);
6032 
6033         *vpp = nvp;
6034 
6035 exit:
6036         (void) xdr_free(xdr_COMPOUND4res_clnt, (caddr_t)&res);
6037         kmem_free(argop, argoplist_size);
6038         (void) check_mnt_secinfo(mi->mi_curr_serv, nvp);
6039         return (e.error);
6040 }
6041 
6042 #ifdef DEBUG
6043 void
6044 nfs4lookup_dump_compound(char *where, nfs_argop4 *argbase, int argcnt)
6045 {
6046         uint_t i, len;
6047         zoneid_t zoneid = getzoneid();
6048         char *s;
6049 
6050         zcmn_err(zoneid, CE_NOTE, "%s: dumping cmpd", where);
6051         for (i = 0; i < argcnt; i++) {
6052                 nfs_argop4 *op = &argbase[i];
6053                 switch (op->argop) {
6054                 case OP_CPUTFH:
6055                 case OP_PUTFH:
6056                         zcmn_err(zoneid, CE_NOTE, "\t op %d, putfh", i);
6057                         break;
6058                 case OP_PUTROOTFH:
6059                         zcmn_err(zoneid, CE_NOTE, "\t op %d, putrootfh", i);
6060                         break;
6061                 case OP_CLOOKUP:
6062                         s = op->nfs_argop4_u.opclookup.cname;
6063                         zcmn_err(zoneid, CE_NOTE, "\t op %d, lookup %s", i, s);
6064                         break;
6065                 case OP_LOOKUP:
6066                         s = utf8_to_str(&op->nfs_argop4_u.oplookup.objname,
6067                             &len, NULL);
6068                         zcmn_err(zoneid, CE_NOTE, "\t op %d, lookup %s", i, s);
6069                         kmem_free(s, len);
6070                         break;
6071                 case OP_LOOKUPP:
6072                         zcmn_err(zoneid, CE_NOTE, "\t op %d, lookupp ..", i);
6073                         break;
6074                 case OP_GETFH:
6075                         zcmn_err(zoneid, CE_NOTE, "\t op %d, getfh", i);
6076                         break;
6077                 case OP_GETATTR:
6078                         zcmn_err(zoneid, CE_NOTE, "\t op %d, getattr", i);
6079                         break;
6080                 case OP_OPENATTR:
6081                         zcmn_err(zoneid, CE_NOTE, "\t op %d, openattr", i);
6082                         break;
6083                 default:
6084                         zcmn_err(zoneid, CE_NOTE, "\t op %d, opcode %d", i,
6085                             op->argop);
6086                         break;
6087                 }
6088         }
6089 }
6090 #endif
6091 
6092 /*
6093  * nfs4lookup_setup - constructs a multi-lookup compound request.
6094  *
6095  * Given the path "nm1/nm2/.../nmn", the following compound requests
6096  * may be created:
6097  *
6098  * Note: Getfh is not be needed because filehandle attr is mandatory, but it
6099  * is faster, for now.
6100  *
6101  * l4_getattrs indicates the type of compound requested.
6102  *
6103  * LKP4_NO_ATTRIBUTE - no attributes (used by secinfo):
6104  *
6105  *      compound { Put*fh; Lookup {nm1}; Lookup {nm2}; ...  Lookup {nmn} }
6106  *
6107  *   total number of ops is n + 1.
6108  *
6109  * LKP4_LAST_NAMED_ATTR - multi-component path for a named
6110  *      attribute: create lookups plus one OPENATTR/GETFH/GETATTR
6111  *      before the last component, and only get attributes
6112  *      for the last component.  Note that the second-to-last
6113  *      pathname component is XATTR_RPATH, which does NOT go
6114  *      over-the-wire as a lookup.
6115  *
6116  *      compound { Put*fh; Lookup {nm1}; Lookup {nm2}; ... Lookup {nmn-2};
6117  *              Openattr; Getfh; Getattr; Lookup {nmn}; Getfh; Getattr }
6118  *
6119  *   and total number of ops is n + 5.
6120  *
6121  * LKP4_LAST_ATTRDIR - multi-component path for the hidden named
6122  *      attribute directory: create lookups plus an OPENATTR
6123  *      replacing the last lookup.  Note that the last pathname
6124  *      component is XATTR_RPATH, which does NOT go over-the-wire
6125  *      as a lookup.
6126  *
6127  *      compound { Put*fh; Lookup {nm1}; Lookup {nm2}; ... Getfh; Getattr;
6128  *              Openattr; Getfh; Getattr }
6129  *
6130  *   and total number of ops is n + 5.
6131  *
6132  * LKP4_ALL_ATTRIBUTES - create lookups and get attributes for intermediate
6133  *      nodes too.
6134  *
6135  *      compound { Put*fh; Lookup {nm1}; Getfh; Getattr;
6136  *              Lookup {nm2}; ...  Lookup {nmn}; Getfh; Getattr }
6137  *
6138  *   and total number of ops is 3*n + 1.
6139  *
6140  * All cases: returns the index in the arg array of the final LOOKUP op, or
6141  * -1 if no LOOKUPs were used.
6142  */
6143 int
6144 nfs4lookup_setup(char *nm, lookup4_param_t *lookupargp, int needgetfh)
6145 {
6146         enum lkp4_attr_setup l4_getattrs = lookupargp->l4_getattrs;
6147         nfs_argop4 *argbase, *argop;
6148         int arglen, argcnt;
6149         int n = 1;      /* number of components */
6150         int nga = 1;    /* number of Getattr's in request */
6151         char c = '\0', *s, *p;
6152         int lookup_idx = -1;
6153         int argoplist_size;
6154 
6155         /* set lookuparg response result to 0 */
6156         lookupargp->resp->status = NFS4_OK;
6157 
6158         /* skip leading "/" or "." e.g. ".//./" if there is */
6159         for (; ; nm++) {
6160                 if (*nm != '/' && *nm != '.')
6161                         break;
6162 
6163                 /* ".." is counted as 1 component */
6164                 if (*nm == '.' && *(nm + 1) != '/')
6165                         break;
6166         }
6167 
6168         /*
6169          * Find n = number of components - nm must be null terminated
6170          * Skip "." components.
6171          */
6172         if (*nm != '\0')
6173                 for (n = 1, s = nm; *s != '\0'; s++) {
6174                         if ((*s == '/') && (*(s + 1) != '/') &&
6175                             (*(s + 1) != '\0') &&
6176                             !(*(s + 1) == '.' && (*(s + 2) == '/' ||
6177                             *(s + 2) == '\0')))
6178                                 n++;
6179                 }
6180         else
6181                 n = 0;
6182 
6183         /*
6184          * nga is number of components that need Getfh+Getattr
6185          */
6186         switch (l4_getattrs) {
6187         case LKP4_NO_ATTRIBUTES:
6188                 nga = 0;
6189                 break;
6190         case LKP4_ALL_ATTRIBUTES:
6191                 nga = n;
6192                 /*
6193                  * Always have at least 1 getfh, getattr pair
6194                  */
6195                 if (nga == 0)
6196                         nga++;
6197                 break;
6198         case LKP4_LAST_ATTRDIR:
6199         case LKP4_LAST_NAMED_ATTR:
6200                 nga = n+1;
6201                 break;
6202         }
6203 
6204         /*
6205          * If change to use the filehandle attr instead of getfh
6206          * the following line can be deleted.
6207          */
6208         nga *= 2;
6209 
6210         /*
6211          * calculate number of ops in request as
6212          * header + trailer + lookups + getattrs
6213          */
6214         arglen = lookupargp->header_len + lookupargp->trailer_len + n + nga;
6215 
6216         argoplist_size = arglen * sizeof (nfs_argop4);
6217         argop = argbase = kmem_alloc(argoplist_size, KM_SLEEP);
6218         lookupargp->argsp->array = argop;
6219 
6220         argcnt = lookupargp->header_len;
6221         argop += argcnt;
6222 
6223         /*
6224          * loop and create a lookup op and possibly getattr/getfh for
6225          * each component. Skip "." components.
6226          */
6227         for (s = nm; *s != '\0'; s = p) {
6228                 /*
6229                  * Set up a pathname struct for each component if needed
6230                  */
6231                 while (*s == '/')
6232                         s++;
6233                 if (*s == '\0')
6234                         break;
6235 
6236                 for (p = s; (*p != '/') && (*p != '\0'); p++)
6237                         ;
6238                 c = *p;
6239                 *p = '\0';
6240 
6241                 if (s[0] == '.' && s[1] == '\0') {
6242                         *p = c;
6243                         continue;
6244                 }
6245                 if (l4_getattrs == LKP4_LAST_ATTRDIR &&
6246                     strcmp(s, XATTR_RPATH) == 0) {
6247                         /* getfh XXX may not be needed in future */
6248                         argop->argop = OP_GETFH;
6249                         argop++;
6250                         argcnt++;
6251 
6252                         /* getattr */
6253                         argop->argop = OP_GETATTR;
6254                         argop->nfs_argop4_u.opgetattr.attr_request =
6255                             lookupargp->ga_bits;
6256                         argop->nfs_argop4_u.opgetattr.mi =
6257                             lookupargp->mi;
6258                         argop++;
6259                         argcnt++;
6260 
6261                         /* openattr */
6262                         argop->argop = OP_OPENATTR;
6263                 } else if (l4_getattrs == LKP4_LAST_NAMED_ATTR &&
6264                     strcmp(s, XATTR_RPATH) == 0) {
6265                         /* openattr */
6266                         argop->argop = OP_OPENATTR;
6267                         argop++;
6268                         argcnt++;
6269 
6270                         /* getfh XXX may not be needed in future */
6271                         argop->argop = OP_GETFH;
6272                         argop++;
6273                         argcnt++;
6274 
6275                         /* getattr */
6276                         argop->argop = OP_GETATTR;
6277                         argop->nfs_argop4_u.opgetattr.attr_request =
6278                             lookupargp->ga_bits;
6279                         argop->nfs_argop4_u.opgetattr.mi =
6280                             lookupargp->mi;
6281                         argop++;
6282                         argcnt++;
6283                         *p = c;
6284                         continue;
6285                 } else if (s[0] == '.' && s[1] == '.' && s[2] == '\0') {
6286                         /* lookupp */
6287                         argop->argop = OP_LOOKUPP;
6288                 } else {
6289                         /* lookup */
6290                         argop->argop = OP_LOOKUP;
6291                         (void) str_to_utf8(s,
6292                             &argop->nfs_argop4_u.oplookup.objname);
6293                 }
6294                 lookup_idx = argcnt;
6295                 argop++;
6296                 argcnt++;
6297 
6298                 *p = c;
6299 
6300                 if (l4_getattrs == LKP4_ALL_ATTRIBUTES) {
6301                         /* getfh XXX may not be needed in future */
6302                         argop->argop = OP_GETFH;
6303                         argop++;
6304                         argcnt++;
6305 
6306                         /* getattr */
6307                         argop->argop = OP_GETATTR;
6308                         argop->nfs_argop4_u.opgetattr.attr_request =
6309                             lookupargp->ga_bits;
6310                         argop->nfs_argop4_u.opgetattr.mi =
6311                             lookupargp->mi;
6312                         argop++;
6313                         argcnt++;
6314                 }
6315         }
6316 
6317         if ((l4_getattrs != LKP4_NO_ATTRIBUTES) &&
6318             ((l4_getattrs != LKP4_ALL_ATTRIBUTES) || (lookup_idx < 0))) {
6319                 if (needgetfh) {
6320                         /* stick in a post-lookup getfh */
6321                         argop->argop = OP_GETFH;
6322                         argcnt++;
6323                         argop++;
6324                 }
6325                 /* post-lookup getattr */
6326                 argop->argop = OP_GETATTR;
6327                 argop->nfs_argop4_u.opgetattr.attr_request =
6328                     lookupargp->ga_bits;
6329                 argop->nfs_argop4_u.opgetattr.mi = lookupargp->mi;
6330                 argcnt++;
6331         }
6332         argcnt += lookupargp->trailer_len;   /* actual op count */
6333         lookupargp->argsp->array_len = argcnt;
6334         lookupargp->arglen = arglen;
6335 
6336 #ifdef DEBUG
6337         if (nfs4_client_lookup_debug)
6338                 nfs4lookup_dump_compound("nfs4lookup_setup", argbase, argcnt);
6339 #endif
6340 
6341         return (lookup_idx);
6342 }
6343 
6344 static int
6345 nfs4openattr(vnode_t *dvp, vnode_t **avp, int cflag, cred_t *cr)
6346 {
6347         COMPOUND4args_clnt      args;
6348         COMPOUND4res_clnt       res;
6349         GETFH4res       *gf_res = NULL;
6350         nfs_argop4      argop[4];
6351         nfs_resop4      *resop = NULL;
6352         nfs4_sharedfh_t *sfhp;
6353         hrtime_t t;
6354         nfs4_error_t    e;
6355 
6356         rnode4_t        *drp;
6357         int             doqueue = 1;
6358         vnode_t         *vp;
6359         int             needrecov = 0;
6360         nfs4_recov_state_t recov_state;
6361 
6362         ASSERT(nfs_zone() == VTOMI4(dvp)->mi_zone);
6363 
6364         *avp = NULL;
6365         recov_state.rs_flags = 0;
6366         recov_state.rs_num_retry_despite_err = 0;
6367 
6368 recov_retry:
6369         /* COMPOUND: putfh, openattr, getfh, getattr */
6370         args.array_len = 4;
6371         args.array = argop;
6372         args.ctag = TAG_OPENATTR;
6373 
6374         e.error = nfs4_start_op(VTOMI4(dvp), dvp, NULL, &recov_state);
6375         if (e.error)
6376                 return (e.error);
6377 
6378         drp = VTOR4(dvp);
6379 
6380         /* putfh */
6381         argop[0].argop = OP_CPUTFH;
6382         argop[0].nfs_argop4_u.opcputfh.sfh = drp->r_fh;
6383 
6384         /* openattr */
6385         argop[1].argop = OP_OPENATTR;
6386         argop[1].nfs_argop4_u.opopenattr.createdir = (cflag ? TRUE : FALSE);
6387 
6388         /* getfh */
6389         argop[2].argop = OP_GETFH;
6390 
6391         /* getattr */
6392         argop[3].argop = OP_GETATTR;
6393         argop[3].nfs_argop4_u.opgetattr.attr_request = NFS4_VATTR_MASK;
6394         argop[3].nfs_argop4_u.opgetattr.mi = VTOMI4(dvp);
6395 
6396         NFS4_DEBUG(nfs4_client_call_debug, (CE_NOTE,
6397             "nfs4openattr: %s call, drp %s", needrecov ? "recov" : "first",
6398             rnode4info(drp)));
6399 
6400         t = gethrtime();
6401 
6402         rfs4call(VTOMI4(dvp), &args, &res, cr, &doqueue, 0, &e);
6403 
6404         needrecov = nfs4_needs_recovery(&e, FALSE, dvp->v_vfsp);
6405         if (needrecov) {
6406                 bool_t abort;
6407 
6408                 NFS4_DEBUG(nfs4_client_recov_debug, (CE_NOTE,
6409                     "nfs4openattr: initiating recovery\n"));
6410 
6411                 abort = nfs4_start_recovery(&e,
6412                     VTOMI4(dvp), dvp, NULL, NULL, NULL,
6413                     OP_OPENATTR, NULL, NULL, NULL);
6414                 nfs4_end_op(VTOMI4(dvp), dvp, NULL, &recov_state, needrecov);
6415                 if (!e.error) {
6416                         e.error = geterrno4(res.status);
6417                         (void) xdr_free(xdr_COMPOUND4res_clnt, (caddr_t)&res);
6418                 }
6419                 if (abort == FALSE)
6420                         goto recov_retry;
6421                 return (e.error);
6422         }
6423 
6424         if (e.error) {
6425                 nfs4_end_op(VTOMI4(dvp), dvp, NULL, &recov_state, needrecov);
6426                 return (e.error);
6427         }
6428 
6429         if (res.status) {
6430                 /*
6431                  * If OTW errro is NOTSUPP, then it should be
6432                  * translated to EINVAL.  All Solaris file system
6433                  * implementations return EINVAL to the syscall layer
6434                  * when the attrdir cannot be created due to an
6435                  * implementation restriction or noxattr mount option.
6436                  */
6437                 if (res.status == NFS4ERR_NOTSUPP) {
6438                         mutex_enter(&drp->r_statelock);
6439                         if (drp->r_xattr_dir)
6440                                 VN_RELE(drp->r_xattr_dir);
6441                         VN_HOLD(NFS4_XATTR_DIR_NOTSUPP);
6442                         drp->r_xattr_dir = NFS4_XATTR_DIR_NOTSUPP;
6443                         mutex_exit(&drp->r_statelock);
6444 
6445                         e.error = EINVAL;
6446                 } else {
6447                         e.error = geterrno4(res.status);
6448                 }
6449 
6450                 if (e.error) {
6451                         (void) xdr_free(xdr_COMPOUND4res_clnt, (caddr_t)&res);
6452                         nfs4_end_op(VTOMI4(dvp), dvp, NULL, &recov_state,
6453                             needrecov);
6454                         return (e.error);
6455                 }
6456         }
6457 
6458         resop = &res.array[0];  /* putfh res */
6459         ASSERT(resop->nfs_resop4_u.opgetfh.status == NFS4_OK);
6460 
6461         resop = &res.array[1];  /* openattr res */
6462         ASSERT(resop->nfs_resop4_u.opopenattr.status == NFS4_OK);
6463 
6464         resop = &res.array[2];  /* getfh res */
6465         gf_res = &resop->nfs_resop4_u.opgetfh;
6466         if (gf_res->object.nfs_fh4_len == 0) {
6467                 *avp = NULL;
6468                 (void) xdr_free(xdr_COMPOUND4res_clnt, (caddr_t)&res);
6469                 nfs4_end_op(VTOMI4(dvp), dvp, NULL, &recov_state, needrecov);
6470                 return (ENOENT);
6471         }
6472 
6473         sfhp = sfh4_get(&gf_res->object, VTOMI4(dvp));
6474         vp = makenfs4node(sfhp, &res.array[3].nfs_resop4_u.opgetattr.ga_res,
6475             dvp->v_vfsp, t, cr, dvp,
6476             fn_get(VTOSV(dvp)->sv_name, XATTR_RPATH, sfhp));
6477         sfh4_rele(&sfhp);
6478 
6479         if (e.error)
6480                 PURGE_ATTRCACHE4(vp);
6481 
6482         mutex_enter(&vp->v_lock);
6483         vp->v_flag |= V_XATTRDIR;
6484         mutex_exit(&vp->v_lock);
6485 
6486         *avp = vp;
6487 
6488         mutex_enter(&drp->r_statelock);
6489         if (drp->r_xattr_dir)
6490                 VN_RELE(drp->r_xattr_dir);
6491         VN_HOLD(vp);
6492         drp->r_xattr_dir = vp;
6493 
6494         /*
6495          * Invalidate pathconf4 cache because r_xattr_dir is no longer
6496          * NULL.  xattrs could be created at any time, and we have no
6497          * way to update pc4_xattr_exists in the base object if/when
6498          * it happens.
6499          */
6500         drp->r_pathconf.pc4_xattr_valid = 0;
6501 
6502         mutex_exit(&drp->r_statelock);
6503 
6504         nfs4_end_op(VTOMI4(dvp), dvp, NULL, &recov_state, needrecov);
6505 
6506         (void) xdr_free(xdr_COMPOUND4res_clnt, (caddr_t)&res);
6507 
6508         return (0);
6509 }
6510 
6511 /* ARGSUSED */
6512 static int
6513 nfs4_create(vnode_t *dvp, char *nm, struct vattr *va, enum vcexcl exclusive,
6514         int mode, vnode_t **vpp, cred_t *cr, int flags, caller_context_t *ct,
6515         vsecattr_t *vsecp)
6516 {
6517         int error;
6518         vnode_t *vp = NULL;
6519         rnode4_t *rp;
6520         struct vattr vattr;
6521         rnode4_t *drp;
6522         vnode_t *tempvp;
6523         enum createmode4 createmode;
6524         bool_t must_trunc = FALSE;
6525         int     truncating = 0;
6526 
6527         if (nfs_zone() != VTOMI4(dvp)->mi_zone)
6528                 return (EPERM);
6529         if (exclusive == EXCL && (dvp->v_flag & V_XATTRDIR)) {
6530                 return (EINVAL);
6531         }
6532 
6533         /* . and .. have special meaning in the protocol, reject them. */
6534 
6535         if (nm[0] == '.' && (nm[1] == '\0' || (nm[1] == '.' && nm[2] == '\0')))
6536                 return (EISDIR);
6537 
6538         drp = VTOR4(dvp);
6539 
6540         if (nfs_rw_enter_sig(&drp->r_rwlock, RW_WRITER, INTR4(dvp)))
6541                 return (EINTR);
6542 
6543 top:
6544         /*
6545          * We make a copy of the attributes because the caller does not
6546          * expect us to change what va points to.
6547          */
6548         vattr = *va;
6549 
6550         /*
6551          * If the pathname is "", then dvp is the root vnode of
6552          * a remote file mounted over a local directory.
6553          * All that needs to be done is access
6554          * checking and truncation.  Note that we avoid doing
6555          * open w/ create because the parent directory might
6556          * be in pseudo-fs and the open would fail.
6557          */
6558         if (*nm == '\0') {
6559                 error = 0;
6560                 VN_HOLD(dvp);
6561                 vp = dvp;
6562                 must_trunc = TRUE;
6563         } else {
6564                 /*
6565                  * We need to go over the wire, just to be sure whether the
6566                  * file exists or not.  Using the DNLC can be dangerous in
6567                  * this case when making a decision regarding existence.
6568                  */
6569                 error = nfs4lookup(dvp, nm, &vp, cr, 1);
6570         }
6571 
6572         if (exclusive)
6573                 createmode = EXCLUSIVE4;
6574         else
6575                 createmode = GUARDED4;
6576 
6577         /*
6578          * error would be set if the file does not exist on the
6579          * server, so lets go create it.
6580          */
6581         if (error) {
6582                 goto create_otw;
6583         }
6584 
6585         /*
6586          * File does exist on the server
6587          */
6588         if (exclusive == EXCL)
6589                 error = EEXIST;
6590         else if (vp->v_type == VDIR && (mode & VWRITE))
6591                 error = EISDIR;
6592         else {
6593                 /*
6594                  * If vnode is a device, create special vnode.
6595                  */
6596                 if (ISVDEV(vp->v_type)) {
6597                         tempvp = vp;
6598                         vp = specvp(vp, vp->v_rdev, vp->v_type, cr);
6599                         VN_RELE(tempvp);
6600                 }
6601                 if (!(error = VOP_ACCESS(vp, mode, 0, cr, ct))) {
6602                         if ((vattr.va_mask & AT_SIZE) &&
6603                             vp->v_type == VREG) {
6604                                 rp = VTOR4(vp);
6605                                 /*
6606                                  * Check here for large file handled
6607                                  * by LF-unaware process (as
6608                                  * ufs_create() does)
6609                                  */
6610                                 if (!(flags & FOFFMAX)) {
6611                                         mutex_enter(&rp->r_statelock);
6612                                         if (rp->r_size > MAXOFF32_T)
6613                                                 error = EOVERFLOW;
6614                                         mutex_exit(&rp->r_statelock);
6615                                 }
6616 
6617                                 /* if error is set then we need to return */
6618                                 if (error) {
6619                                         nfs_rw_exit(&drp->r_rwlock);
6620                                         VN_RELE(vp);
6621                                         return (error);
6622                                 }
6623 
6624                                 if (must_trunc) {
6625                                         vattr.va_mask = AT_SIZE;
6626                                         error = nfs4setattr(vp, &vattr, 0, cr,
6627                                             NULL);
6628                                 } else {
6629                                 /*
6630                                  * we know we have a regular file that already
6631                                  * exists and we may end up truncating the file
6632                                  * as a result of the open_otw, so flush out
6633                                  * any dirty pages for this file first.
6634                                  */
6635                                         if (nfs4_has_pages(vp) &&
6636                                             ((rp->r_flags & R4DIRTY) ||
6637                                             rp->r_count > 0 ||
6638                                             rp->r_mapcnt > 0)) {
6639                                                 error = nfs4_putpage(vp,
6640                                                     (offset_t)0, 0, 0, cr, ct);
6641                                                 if (error && (error == ENOSPC ||
6642                                                     error == EDQUOT)) {
6643                                                         mutex_enter(
6644                                                             &rp->r_statelock);
6645                                                         if (!rp->r_error)
6646                                                                 rp->r_error =
6647                                                                     error;
6648                                                         mutex_exit(
6649                                                             &rp->r_statelock);
6650                                                 }
6651                                         }
6652                                         vattr.va_mask = (AT_SIZE |
6653                                             AT_TYPE | AT_MODE);
6654                                         vattr.va_type = VREG;
6655                                         createmode = UNCHECKED4;
6656                                         truncating = 1;
6657                                         goto create_otw;
6658                                 }
6659                         }
6660                 }
6661         }
6662         nfs_rw_exit(&drp->r_rwlock);
6663         if (error) {
6664                 VN_RELE(vp);
6665         } else {
6666                 vnode_t *tvp;
6667                 rnode4_t *trp;
6668                 tvp = vp;
6669                 if (vp->v_type == VREG) {
6670                         trp = VTOR4(vp);
6671                         if (IS_SHADOW(vp, trp))
6672                                 tvp = RTOV4(trp);
6673                 }
6674 
6675                 if (must_trunc) {
6676                         /*
6677                          * existing file got truncated, notify.
6678                          */
6679                         vnevent_create(tvp, ct);
6680                 }
6681 
6682                 *vpp = vp;
6683         }
6684         return (error);
6685 
6686 create_otw:
6687         dnlc_remove(dvp, nm);
6688 
6689         ASSERT(vattr.va_mask & AT_TYPE);
6690 
6691         /*
6692          * If not a regular file let nfs4mknod() handle it.
6693          */
6694         if (vattr.va_type != VREG) {
6695                 error = nfs4mknod(dvp, nm, &vattr, exclusive, mode, vpp, cr);
6696                 nfs_rw_exit(&drp->r_rwlock);
6697                 return (error);
6698         }
6699 
6700         /*
6701          * It _is_ a regular file.
6702          */
6703         ASSERT(vattr.va_mask & AT_MODE);
6704         if (MANDMODE(vattr.va_mode)) {
6705                 nfs_rw_exit(&drp->r_rwlock);
6706                 return (EACCES);
6707         }
6708 
6709         /*
6710          * If this happens to be a mknod of a regular file, then flags will
6711          * have neither FREAD or FWRITE.  However, we must set at least one
6712          * for the call to nfs4open_otw.  If it's open(O_CREAT) driving
6713          * nfs4_create, then either FREAD, FWRITE, or FRDWR has already been
6714          * set (based on openmode specified by app).
6715          */
6716         if ((flags & (FREAD|FWRITE)) == 0)
6717                 flags |= (FREAD|FWRITE);
6718 
6719         error = nfs4open_otw(dvp, nm, &vattr, vpp, cr, 1, flags, createmode, 0);
6720 
6721         if (vp != NULL) {
6722                 /* if create was successful, throw away the file's pages */
6723                 if (!error && (vattr.va_mask & AT_SIZE))
6724                         nfs4_invalidate_pages(vp, (vattr.va_size & PAGEMASK),
6725                             cr);
6726                 /* release the lookup hold */
6727                 VN_RELE(vp);
6728                 vp = NULL;
6729         }
6730 
6731         /*
6732          * validate that we opened a regular file. This handles a misbehaving
6733          * server that returns an incorrect FH.
6734          */
6735         if ((error == 0) && *vpp && (*vpp)->v_type != VREG) {
6736                 error = EISDIR;
6737                 VN_RELE(*vpp);
6738         }
6739 
6740         /*
6741          * If this is not an exclusive create, then the CREATE
6742          * request will be made with the GUARDED mode set.  This
6743          * means that the server will return EEXIST if the file
6744          * exists.  The file could exist because of a retransmitted
6745          * request.  In this case, we recover by starting over and
6746          * checking to see whether the file exists.  This second
6747          * time through it should and a CREATE request will not be
6748          * sent.
6749          *
6750          * This handles the problem of a dangling CREATE request
6751          * which contains attributes which indicate that the file
6752          * should be truncated.  This retransmitted request could
6753          * possibly truncate valid data in the file if not caught
6754          * by the duplicate request mechanism on the server or if
6755          * not caught by other means.  The scenario is:
6756          *
6757          * Client transmits CREATE request with size = 0
6758          * Client times out, retransmits request.
6759          * Response to the first request arrives from the server
6760          *  and the client proceeds on.
6761          * Client writes data to the file.
6762          * The server now processes retransmitted CREATE request
6763          *  and truncates file.
6764          *
6765          * The use of the GUARDED CREATE request prevents this from
6766          * happening because the retransmitted CREATE would fail
6767          * with EEXIST and would not truncate the file.
6768          */
6769         if (error == EEXIST && exclusive == NONEXCL) {
6770 #ifdef DEBUG
6771                 nfs4_create_misses++;
6772 #endif
6773                 goto top;
6774         }
6775         nfs_rw_exit(&drp->r_rwlock);
6776         if (truncating && !error && *vpp) {
6777                 vnode_t *tvp;
6778                 rnode4_t *trp;
6779                 /*
6780                  * existing file got truncated, notify.
6781                  */
6782                 tvp = *vpp;
6783                 trp = VTOR4(tvp);
6784                 if (IS_SHADOW(tvp, trp))
6785                         tvp = RTOV4(trp);
6786                 vnevent_create(tvp, ct);
6787         }
6788         return (error);
6789 }
6790 
6791 /*
6792  * Create compound (for mkdir, mknod, symlink):
6793  * { Putfh <dfh>; Create; Getfh; Getattr }
6794  * It's okay if setattr failed to set gid - this is not considered
6795  * an error, but purge attrs in that case.
6796  */
6797 static int
6798 call_nfs4_create_req(vnode_t *dvp, char *nm, void *data, struct vattr *va,
6799     vnode_t **vpp, cred_t *cr, nfs_ftype4 type)
6800 {
6801         int need_end_op = FALSE;
6802         COMPOUND4args_clnt args;
6803         COMPOUND4res_clnt res, *resp = NULL;
6804         nfs_argop4 *argop;
6805         nfs_resop4 *resop;
6806         int doqueue;
6807         mntinfo4_t *mi;
6808         rnode4_t *drp = VTOR4(dvp);
6809         change_info4 *cinfo;
6810         GETFH4res *gf_res;
6811         struct vattr vattr;
6812         vnode_t *vp;
6813         fattr4 *crattr;
6814         bool_t needrecov = FALSE;
6815         nfs4_recov_state_t recov_state;
6816         nfs4_sharedfh_t *sfhp = NULL;
6817         hrtime_t t;
6818         nfs4_error_t e = { 0, NFS4_OK, RPC_SUCCESS };
6819         int numops, argoplist_size, setgid_flag, idx_create, idx_fattr;
6820         dirattr_info_t dinfo, *dinfop;
6821         servinfo4_t *svp;
6822         bitmap4 supp_attrs;
6823 
6824         ASSERT(type == NF4DIR || type == NF4LNK || type == NF4BLK ||
6825             type == NF4CHR || type == NF4SOCK || type == NF4FIFO);
6826 
6827         mi = VTOMI4(dvp);
6828 
6829         /*
6830          * Make sure we properly deal with setting the right gid
6831          * on a new directory to reflect the parent's setgid bit
6832          */
6833         setgid_flag = 0;
6834         if (type == NF4DIR) {
6835                 struct vattr dva;
6836 
6837                 va->va_mode &= ~VSGID;
6838                 dva.va_mask = AT_MODE | AT_GID;
6839                 if (VOP_GETATTR(dvp, &dva, 0, cr, NULL) == 0) {
6840 
6841                         /*
6842                          * If the parent's directory has the setgid bit set
6843                          * _and_ the client was able to get a valid mapping
6844                          * for the parent dir's owner_group, we want to
6845                          * append NVERIFY(owner_group == dva.va_gid) and
6846                          * SETTATTR to the CREATE compound.
6847                          */
6848                         if (mi->mi_flags & MI4_GRPID || dva.va_mode & VSGID) {
6849                                 setgid_flag = 1;
6850                                 va->va_mode |= VSGID;
6851                                 if (dva.va_gid != GID_NOBODY) {
6852                                         va->va_mask |= AT_GID;
6853                                         va->va_gid = dva.va_gid;
6854                                 }
6855                         }
6856                 }
6857         }
6858 
6859         /*
6860          * Create ops:
6861          *      0:putfh(dir) 1:savefh(dir) 2:create 3:getfh(new) 4:getattr(new)
6862          *      5:restorefh(dir) 6:getattr(dir)
6863          *
6864          * if (setgid)
6865          *      0:putfh(dir) 1:create 2:getfh(new) 3:getattr(new)
6866          *      4:savefh(new) 5:putfh(dir) 6:getattr(dir) 7:restorefh(new)
6867          *      8:nverify 9:setattr
6868          */
6869         if (setgid_flag) {
6870                 numops = 10;
6871                 idx_create = 1;
6872                 idx_fattr = 3;
6873         } else {
6874                 numops = 7;
6875                 idx_create = 2;
6876                 idx_fattr = 4;
6877         }
6878 
6879         ASSERT(nfs_zone() == mi->mi_zone);
6880         if (nfs_rw_enter_sig(&drp->r_rwlock, RW_WRITER, INTR4(dvp))) {
6881                 return (EINTR);
6882         }
6883         recov_state.rs_flags = 0;
6884         recov_state.rs_num_retry_despite_err = 0;
6885 
6886         argoplist_size = numops * sizeof (nfs_argop4);
6887         argop = kmem_alloc(argoplist_size, KM_SLEEP);
6888 
6889 recov_retry:
6890         if (type == NF4LNK)
6891                 args.ctag = TAG_SYMLINK;
6892         else if (type == NF4DIR)
6893                 args.ctag = TAG_MKDIR;
6894         else
6895                 args.ctag = TAG_MKNOD;
6896 
6897         args.array_len = numops;
6898         args.array = argop;
6899 
6900         if (e.error = nfs4_start_op(mi, dvp, NULL, &recov_state)) {
6901                 nfs_rw_exit(&drp->r_rwlock);
6902                 kmem_free(argop, argoplist_size);
6903                 return (e.error);
6904         }
6905         need_end_op = TRUE;
6906 
6907 
6908         /* 0: putfh directory */
6909         argop[0].argop = OP_CPUTFH;
6910         argop[0].nfs_argop4_u.opcputfh.sfh = drp->r_fh;
6911 
6912         /* 1/2: Create object */
6913         argop[idx_create].argop = OP_CCREATE;
6914         argop[idx_create].nfs_argop4_u.opccreate.cname = nm;
6915         argop[idx_create].nfs_argop4_u.opccreate.type = type;
6916         if (type == NF4LNK) {
6917                 /*
6918                  * symlink, treat name as data
6919                  */
6920                 ASSERT(data != NULL);
6921                 argop[idx_create].nfs_argop4_u.opccreate.ftype4_u.clinkdata =
6922                     (char *)data;
6923         }
6924         if (type == NF4BLK || type == NF4CHR) {
6925                 ASSERT(data != NULL);
6926                 argop[idx_create].nfs_argop4_u.opccreate.ftype4_u.devdata =
6927                     *((specdata4 *)data);
6928         }
6929 
6930         crattr = &argop[idx_create].nfs_argop4_u.opccreate.createattrs;
6931 
6932         svp = drp->r_server;
6933         (void) nfs_rw_enter_sig(&svp->sv_lock, RW_READER, 0);
6934         supp_attrs = svp->sv_supp_attrs;
6935         nfs_rw_exit(&svp->sv_lock);
6936 
6937         if (vattr_to_fattr4(va, NULL, crattr, 0, OP_CREATE, supp_attrs)) {
6938                 nfs_rw_exit(&drp->r_rwlock);
6939                 nfs4_end_op(mi, dvp, NULL, &recov_state, needrecov);
6940                 e.error = EINVAL;
6941                 kmem_free(argop, argoplist_size);
6942                 return (e.error);
6943         }
6944 
6945         /* 2/3: getfh fh of created object */
6946         ASSERT(idx_create + 1 == idx_fattr - 1);
6947         argop[idx_create + 1].argop = OP_GETFH;
6948 
6949         /* 3/4: getattr of new object */
6950         argop[idx_fattr].argop = OP_GETATTR;
6951         argop[idx_fattr].nfs_argop4_u.opgetattr.attr_request = NFS4_VATTR_MASK;
6952         argop[idx_fattr].nfs_argop4_u.opgetattr.mi = mi;
6953 
6954         if (setgid_flag) {
6955                 vattr_t _v;
6956 
6957                 argop[4].argop = OP_SAVEFH;
6958 
6959                 argop[5].argop = OP_CPUTFH;
6960                 argop[5].nfs_argop4_u.opcputfh.sfh = drp->r_fh;
6961 
6962                 argop[6].argop = OP_GETATTR;
6963                 argop[6].nfs_argop4_u.opgetattr.attr_request = NFS4_VATTR_MASK;
6964                 argop[6].nfs_argop4_u.opgetattr.mi = mi;
6965 
6966                 argop[7].argop = OP_RESTOREFH;
6967 
6968                 /*
6969                  * nverify
6970                  *
6971                  * XXX - Revisit the last argument to nfs4_end_op()
6972                  *       once 5020486 is fixed.
6973                  */
6974                 _v.va_mask = AT_GID;
6975                 _v.va_gid = va->va_gid;
6976                 if (e.error = nfs4args_verify(&argop[8], &_v, OP_NVERIFY,
6977                     supp_attrs)) {
6978                         nfs4_end_op(mi, dvp, *vpp, &recov_state, TRUE);
6979                         nfs_rw_exit(&drp->r_rwlock);
6980                         nfs4_fattr4_free(crattr);
6981                         kmem_free(argop, argoplist_size);
6982                         return (e.error);
6983                 }
6984 
6985                 /*
6986                  * setattr
6987                  *
6988                  * We _know_ we're not messing with AT_SIZE or AT_XTIME,
6989                  * so no need for stateid or flags. Also we specify NULL
6990                  * rp since we're only interested in setting owner_group
6991                  * attributes.
6992                  */
6993                 nfs4args_setattr(&argop[9], &_v, NULL, 0, NULL, cr, supp_attrs,
6994                     &e.error, 0);
6995 
6996                 if (e.error) {
6997                         nfs4_end_op(mi, dvp, *vpp, &recov_state, TRUE);
6998                         nfs_rw_exit(&drp->r_rwlock);
6999                         nfs4_fattr4_free(crattr);
7000                         nfs4args_verify_free(&argop[8]);
7001                         kmem_free(argop, argoplist_size);
7002                         return (e.error);
7003                 }
7004         } else {
7005                 argop[1].argop = OP_SAVEFH;
7006 
7007                 argop[5].argop = OP_RESTOREFH;
7008 
7009                 argop[6].argop = OP_GETATTR;
7010                 argop[6].nfs_argop4_u.opgetattr.attr_request = NFS4_VATTR_MASK;
7011                 argop[6].nfs_argop4_u.opgetattr.mi = mi;
7012         }
7013 
7014         dnlc_remove(dvp, nm);
7015 
7016         doqueue = 1;
7017         t = gethrtime();
7018         rfs4call(mi, &args, &res, cr, &doqueue, 0, &e);
7019 
7020         needrecov = nfs4_needs_recovery(&e, FALSE, mi->mi_vfsp);
7021         if (e.error) {
7022                 PURGE_ATTRCACHE4(dvp);
7023                 if (!needrecov)
7024                         goto out;
7025         }
7026 
7027         if (needrecov) {
7028                 if (nfs4_start_recovery(&e, mi, dvp, NULL, NULL, NULL,
7029                     OP_CREATE, NULL, NULL, NULL) == FALSE) {
7030                         nfs4_end_op(mi, dvp, NULL, &recov_state,
7031                             needrecov);
7032                         need_end_op = FALSE;
7033                         nfs4_fattr4_free(crattr);
7034                         if (setgid_flag) {
7035                                 nfs4args_verify_free(&argop[8]);
7036                                 nfs4args_setattr_free(&argop[9]);
7037                         }
7038                         (void) xdr_free(xdr_COMPOUND4res_clnt, (caddr_t)&res);
7039                         goto recov_retry;
7040                 }
7041         }
7042 
7043         resp = &res;
7044 
7045         if (res.status != NFS4_OK && res.array_len <= idx_fattr + 1) {
7046 
7047                 if (res.status == NFS4ERR_BADOWNER)
7048                         nfs4_log_badowner(mi, OP_CREATE);
7049 
7050                 e.error = geterrno4(res.status);
7051 
7052                 /*
7053                  * This check is left over from when create was implemented
7054                  * using a setattr op (instead of createattrs).  If the
7055                  * putfh/create/getfh failed, the error was returned.  If
7056                  * setattr/getattr failed, we keep going.
7057                  *
7058                  * It might be better to get rid of the GETFH also, and just
7059                  * do PUTFH/CREATE/GETATTR since the FH attr is mandatory.
7060                  * Then if any of the operations failed, we could return the
7061                  * error now, and remove much of the error code below.
7062                  */
7063                 if (res.array_len <= idx_fattr) {
7064                         /*
7065                          * Either Putfh, Create or Getfh failed.
7066                          */
7067                         PURGE_ATTRCACHE4(dvp);
7068                         /*
7069                          * nfs4_purge_stale_fh() may generate otw calls through
7070                          * nfs4_invalidate_pages. Hence the need to call
7071                          * nfs4_end_op() here to avoid nfs4_start_op() deadlock.
7072                          */
7073                         nfs4_end_op(mi, dvp, NULL, &recov_state,
7074                             needrecov);
7075                         need_end_op = FALSE;
7076                         nfs4_purge_stale_fh(e.error, dvp, cr);
7077                         goto out;
7078                 }
7079         }
7080 
7081         resop = &res.array[idx_create];     /* create res */
7082         cinfo = &resop->nfs_resop4_u.opcreate.cinfo;
7083 
7084         resop = &res.array[idx_create + 1]; /* getfh res */
7085         gf_res = &resop->nfs_resop4_u.opgetfh;
7086 
7087         sfhp = sfh4_get(&gf_res->object, mi);
7088         if (e.error) {
7089                 *vpp = vp = makenfs4node(sfhp, NULL, dvp->v_vfsp, t, cr, dvp,
7090                     fn_get(VTOSV(dvp)->sv_name, nm, sfhp));
7091                 if (vp->v_type == VNON) {
7092                         vattr.va_mask = AT_TYPE;
7093                         /*
7094                          * Need to call nfs4_end_op before nfs4getattr to avoid
7095                          * potential nfs4_start_op deadlock. See RFE 4777612.
7096                          */
7097                         nfs4_end_op(mi, dvp, NULL, &recov_state,
7098                             needrecov);
7099                         need_end_op = FALSE;
7100                         e.error = nfs4getattr(vp, &vattr, cr);
7101                         if (e.error) {
7102                                 VN_RELE(vp);
7103                                 *vpp = NULL;
7104                                 goto out;
7105                         }
7106                         vp->v_type = vattr.va_type;
7107                 }
7108                 e.error = 0;
7109         } else {
7110                 *vpp = vp = makenfs4node(sfhp,
7111                     &res.array[idx_fattr].nfs_resop4_u.opgetattr.ga_res,
7112                     dvp->v_vfsp, t, cr,
7113                     dvp, fn_get(VTOSV(dvp)->sv_name, nm, sfhp));
7114         }
7115 
7116         /*
7117          * If compound succeeded, then update dir attrs
7118          */
7119         if (res.status == NFS4_OK) {
7120                 dinfo.di_garp = &res.array[6].nfs_resop4_u.opgetattr.ga_res;
7121                 dinfo.di_cred = cr;
7122                 dinfo.di_time_call = t;
7123                 dinfop = &dinfo;
7124         } else
7125                 dinfop = NULL;
7126 
7127         /* Update directory cache attribute, readdir and dnlc caches */
7128         nfs4_update_dircaches(cinfo, dvp, vp, nm, dinfop);
7129 
7130 out:
7131         if (sfhp != NULL)
7132                 sfh4_rele(&sfhp);
7133         nfs_rw_exit(&drp->r_rwlock);
7134         nfs4_fattr4_free(crattr);
7135         if (setgid_flag) {
7136                 nfs4args_verify_free(&argop[8]);
7137                 nfs4args_setattr_free(&argop[9]);
7138         }
7139         if (resp)
7140                 (void) xdr_free(xdr_COMPOUND4res_clnt, (caddr_t)resp);
7141         if (need_end_op)
7142                 nfs4_end_op(mi, dvp, NULL, &recov_state, needrecov);
7143 
7144         kmem_free(argop, argoplist_size);
7145         return (e.error);
7146 }
7147 
7148 /* ARGSUSED */
7149 static int
7150 nfs4mknod(vnode_t *dvp, char *nm, struct vattr *va, enum vcexcl exclusive,
7151     int mode, vnode_t **vpp, cred_t *cr)
7152 {
7153         int error;
7154         vnode_t *vp;
7155         nfs_ftype4 type;
7156         specdata4 spec, *specp = NULL;
7157 
7158         ASSERT(nfs_zone() == VTOMI4(dvp)->mi_zone);
7159 
7160         switch (va->va_type) {
7161         case VCHR:
7162         case VBLK:
7163                 type = (va->va_type == VCHR) ? NF4CHR : NF4BLK;
7164                 spec.specdata1 = getmajor(va->va_rdev);
7165                 spec.specdata2 = getminor(va->va_rdev);
7166                 specp = &spec;
7167                 break;
7168 
7169         case VFIFO:
7170                 type = NF4FIFO;
7171                 break;
7172         case VSOCK:
7173                 type = NF4SOCK;
7174                 break;
7175 
7176         default:
7177                 return (EINVAL);
7178         }
7179 
7180         error = call_nfs4_create_req(dvp, nm, specp, va, &vp, cr, type);
7181         if (error) {
7182                 return (error);
7183         }
7184 
7185         /*
7186          * This might not be needed any more; special case to deal
7187          * with problematic v2/v3 servers.  Since create was unable
7188          * to set group correctly, not sure what hope setattr has.
7189          */
7190         if (va->va_gid != VTOR4(vp)->r_attr.va_gid) {
7191                 va->va_mask = AT_GID;
7192                 (void) nfs4setattr(vp, va, 0, cr, NULL);
7193         }
7194 
7195         /*
7196          * If vnode is a device create special vnode
7197          */
7198         if (ISVDEV(vp->v_type)) {
7199                 *vpp = specvp(vp, vp->v_rdev, vp->v_type, cr);
7200                 VN_RELE(vp);
7201         } else {
7202                 *vpp = vp;
7203         }
7204         return (error);
7205 }
7206 
7207 /*
7208  * Remove requires that the current fh be the target directory.
7209  * After the operation, the current fh is unchanged.
7210  * The compound op structure is:
7211  *      PUTFH(targetdir), REMOVE
7212  *
7213  * Weirdness: if the vnode to be removed is open
7214  * we rename it instead of removing it and nfs_inactive
7215  * will remove the new name.
7216  */
7217 /* ARGSUSED */
7218 static int
7219 nfs4_remove(vnode_t *dvp, char *nm, cred_t *cr, caller_context_t *ct, int flags)
7220 {
7221         COMPOUND4args_clnt args;
7222         COMPOUND4res_clnt res, *resp = NULL;
7223         REMOVE4res *rm_res;
7224         nfs_argop4 argop[3];
7225         nfs_resop4 *resop;
7226         vnode_t *vp;
7227         char *tmpname;
7228         int doqueue;
7229         mntinfo4_t *mi;
7230         rnode4_t *rp;
7231         rnode4_t *drp;
7232         int needrecov = 0;
7233         nfs4_recov_state_t recov_state;
7234         int isopen;
7235         nfs4_error_t e = { 0, NFS4_OK, RPC_SUCCESS };
7236         dirattr_info_t dinfo;
7237 
7238         if (nfs_zone() != VTOMI4(dvp)->mi_zone)
7239                 return (EPERM);
7240         drp = VTOR4(dvp);
7241         if (nfs_rw_enter_sig(&drp->r_rwlock, RW_WRITER, INTR4(dvp)))
7242                 return (EINTR);
7243 
7244         e.error = nfs4lookup(dvp, nm, &vp, cr, 0);
7245         if (e.error) {
7246                 nfs_rw_exit(&drp->r_rwlock);
7247                 return (e.error);
7248         }
7249 
7250         if (vp->v_type == VDIR) {
7251                 VN_RELE(vp);
7252                 nfs_rw_exit(&drp->r_rwlock);
7253                 return (EISDIR);
7254         }
7255 
7256         /*
7257          * First just remove the entry from the name cache, as it
7258          * is most likely the only entry for this vp.
7259          */
7260         dnlc_remove(dvp, nm);
7261 
7262         rp = VTOR4(vp);
7263 
7264         /*
7265          * For regular file types, check to see if the file is open by looking
7266          * at the open streams.
7267          * For all other types, check the reference count on the vnode.  Since
7268          * they are not opened OTW they never have an open stream.
7269          *
7270          * If the file is open, rename it to .nfsXXXX.
7271          */
7272         if (vp->v_type != VREG) {
7273                 /*
7274                  * If the file has a v_count > 1 then there may be more than one
7275                  * entry in the name cache due multiple links or an open file,
7276                  * but we don't have the real reference count so flush all
7277                  * possible entries.
7278                  */
7279                 if (vp->v_count > 1)
7280                         dnlc_purge_vp(vp);
7281 
7282                 /*
7283                  * Now we have the real reference count.
7284                  */
7285                 isopen = vp->v_count > 1;
7286         } else {
7287                 mutex_enter(&rp->r_os_lock);
7288                 isopen = list_head(&rp->r_open_streams) != NULL;
7289                 mutex_exit(&rp->r_os_lock);
7290         }
7291 
7292         mutex_enter(&rp->r_statelock);
7293         if (isopen &&
7294             (rp->r_unldvp == NULL || strcmp(nm, rp->r_unlname) == 0)) {
7295                 mutex_exit(&rp->r_statelock);
7296                 tmpname = newname();
7297                 e.error = nfs4rename(dvp, nm, dvp, tmpname, cr, ct);
7298                 if (e.error)
7299                         kmem_free(tmpname, MAXNAMELEN);
7300                 else {
7301                         mutex_enter(&rp->r_statelock);
7302                         if (rp->r_unldvp == NULL) {
7303                                 VN_HOLD(dvp);
7304                                 rp->r_unldvp = dvp;
7305                                 if (rp->r_unlcred != NULL)
7306                                         crfree(rp->r_unlcred);
7307                                 crhold(cr);
7308                                 rp->r_unlcred = cr;
7309                                 rp->r_unlname = tmpname;
7310                         } else {
7311                                 kmem_free(rp->r_unlname, MAXNAMELEN);
7312                                 rp->r_unlname = tmpname;
7313                         }
7314                         mutex_exit(&rp->r_statelock);
7315                 }
7316                 VN_RELE(vp);
7317                 nfs_rw_exit(&drp->r_rwlock);
7318                 return (e.error);
7319         }
7320         /*
7321          * Actually remove the file/dir
7322          */
7323         mutex_exit(&rp->r_statelock);
7324 
7325         /*
7326          * We need to flush any dirty pages which happen to
7327          * be hanging around before removing the file.
7328          * This shouldn't happen very often since in NFSv4
7329          * we should be close to open consistent.
7330          */
7331         if (nfs4_has_pages(vp) &&
7332             ((rp->r_flags & R4DIRTY) || rp->r_count > 0)) {
7333                 e.error = nfs4_putpage(vp, (u_offset_t)0, 0, 0, cr, ct);
7334                 if (e.error && (e.error == ENOSPC || e.error == EDQUOT)) {
7335                         mutex_enter(&rp->r_statelock);
7336                         if (!rp->r_error)
7337                                 rp->r_error = e.error;
7338                         mutex_exit(&rp->r_statelock);
7339                 }
7340         }
7341 
7342         mi = VTOMI4(dvp);
7343 
7344         (void) nfs4delegreturn(rp, NFS4_DR_REOPEN);
7345         recov_state.rs_flags = 0;
7346         recov_state.rs_num_retry_despite_err = 0;
7347 
7348 recov_retry:
7349         /*
7350          * Remove ops: putfh dir; remove
7351          */
7352         args.ctag = TAG_REMOVE;
7353         args.array_len = 3;
7354         args.array = argop;
7355 
7356         e.error = nfs4_start_op(VTOMI4(dvp), dvp, NULL, &recov_state);
7357         if (e.error) {
7358                 nfs_rw_exit(&drp->r_rwlock);
7359                 VN_RELE(vp);
7360                 return (e.error);
7361         }
7362 
7363         /* putfh directory */
7364         argop[0].argop = OP_CPUTFH;
7365         argop[0].nfs_argop4_u.opcputfh.sfh = drp->r_fh;
7366 
7367         /* remove */
7368         argop[1].argop = OP_CREMOVE;
7369         argop[1].nfs_argop4_u.opcremove.ctarget = nm;
7370 
7371         /* getattr dir */
7372         argop[2].argop = OP_GETATTR;
7373         argop[2].nfs_argop4_u.opgetattr.attr_request = NFS4_VATTR_MASK;
7374         argop[2].nfs_argop4_u.opgetattr.mi = mi;
7375 
7376         doqueue = 1;
7377         dinfo.di_time_call = gethrtime();
7378         rfs4call(mi, &args, &res, cr, &doqueue, 0, &e);
7379 
7380         PURGE_ATTRCACHE4(vp);
7381 
7382         needrecov = nfs4_needs_recovery(&e, FALSE, mi->mi_vfsp);
7383         if (e.error)
7384                 PURGE_ATTRCACHE4(dvp);
7385 
7386         if (needrecov) {
7387                 if (nfs4_start_recovery(&e, VTOMI4(dvp), dvp,
7388                     NULL, NULL, NULL, OP_REMOVE, NULL, NULL, NULL) == FALSE) {
7389                         if (!e.error)
7390                                 (void) xdr_free(xdr_COMPOUND4res_clnt,
7391                                     (caddr_t)&res);
7392                         nfs4_end_op(VTOMI4(dvp), dvp, NULL, &recov_state,
7393                             needrecov);
7394                         goto recov_retry;
7395                 }
7396         }
7397 
7398         /*
7399          * Matching nfs4_end_op() for start_op() above.
7400          * There is a path in the code below which calls
7401          * nfs4_purge_stale_fh(), which may generate otw calls through
7402          * nfs4_invalidate_pages. Hence we need to call nfs4_end_op()
7403          * here to avoid nfs4_start_op() deadlock.
7404          */
7405         nfs4_end_op(VTOMI4(dvp), dvp, NULL, &recov_state, needrecov);
7406 
7407         if (!e.error) {
7408                 resp = &res;
7409 
7410                 if (res.status) {
7411                         e.error = geterrno4(res.status);
7412                         PURGE_ATTRCACHE4(dvp);
7413                         nfs4_purge_stale_fh(e.error, dvp, cr);
7414                 } else {
7415                         resop = &res.array[1];      /* remove res */
7416                         rm_res = &resop->nfs_resop4_u.opremove;
7417 
7418                         dinfo.di_garp =
7419                             &res.array[2].nfs_resop4_u.opgetattr.ga_res;
7420                         dinfo.di_cred = cr;
7421 
7422                         /* Update directory attr, readdir and dnlc caches */
7423                         nfs4_update_dircaches(&rm_res->cinfo, dvp, NULL, NULL,
7424                             &dinfo);
7425                 }
7426         }
7427         nfs_rw_exit(&drp->r_rwlock);
7428         if (resp)
7429                 (void) xdr_free(xdr_COMPOUND4res_clnt, (caddr_t)resp);
7430 
7431         if (e.error == 0) {
7432                 vnode_t *tvp;
7433                 rnode4_t *trp;
7434                 trp = VTOR4(vp);
7435                 tvp = vp;
7436                 if (IS_SHADOW(vp, trp))
7437                         tvp = RTOV4(trp);
7438                 vnevent_remove(tvp, dvp, nm, ct);
7439         }
7440         VN_RELE(vp);
7441         return (e.error);
7442 }
7443 
7444 /*
7445  * Link requires that the current fh be the target directory and the
7446  * saved fh be the source fh. After the operation, the current fh is unchanged.
7447  * Thus the compound op structure is:
7448  *      PUTFH(file), SAVEFH, PUTFH(targetdir), LINK, RESTOREFH,
7449  *      GETATTR(file)
7450  */
7451 /* ARGSUSED */
7452 static int
7453 nfs4_link(vnode_t *tdvp, vnode_t *svp, char *tnm, cred_t *cr,
7454     caller_context_t *ct, int flags)
7455 {
7456         COMPOUND4args_clnt args;
7457         COMPOUND4res_clnt res, *resp = NULL;
7458         LINK4res *ln_res;
7459         int argoplist_size  = 7 * sizeof (nfs_argop4);
7460         nfs_argop4 *argop;
7461         nfs_resop4 *resop;
7462         vnode_t *realvp, *nvp;
7463         int doqueue;
7464         mntinfo4_t *mi;
7465         rnode4_t *tdrp;
7466         bool_t needrecov = FALSE;
7467         nfs4_recov_state_t recov_state;
7468         hrtime_t t;
7469         nfs4_error_t e = { 0, NFS4_OK, RPC_SUCCESS };
7470         dirattr_info_t dinfo;
7471 
7472         ASSERT(*tnm != '\0');
7473         ASSERT(tdvp->v_type == VDIR);
7474         ASSERT(nfs4_consistent_type(tdvp));
7475         ASSERT(nfs4_consistent_type(svp));
7476 
7477         if (nfs_zone() != VTOMI4(tdvp)->mi_zone)
7478                 return (EPERM);
7479         if (VOP_REALVP(svp, &realvp, ct) == 0) {
7480                 svp = realvp;
7481                 ASSERT(nfs4_consistent_type(svp));
7482         }
7483 
7484         tdrp = VTOR4(tdvp);
7485         mi = VTOMI4(svp);
7486 
7487         if (!(mi->mi_flags & MI4_LINK)) {
7488                 return (EOPNOTSUPP);
7489         }
7490         recov_state.rs_flags = 0;
7491         recov_state.rs_num_retry_despite_err = 0;
7492 
7493         if (nfs_rw_enter_sig(&tdrp->r_rwlock, RW_WRITER, INTR4(tdvp)))
7494                 return (EINTR);
7495 
7496 recov_retry:
7497         argop = kmem_alloc(argoplist_size, KM_SLEEP);
7498 
7499         args.ctag = TAG_LINK;
7500 
7501         /*
7502          * Link ops: putfh fl; savefh; putfh tdir; link; getattr(dir);
7503          * restorefh; getattr(fl)
7504          */
7505         args.array_len = 7;
7506         args.array = argop;
7507 
7508         e.error = nfs4_start_op(VTOMI4(svp), svp, tdvp, &recov_state);
7509         if (e.error) {
7510                 kmem_free(argop, argoplist_size);
7511                 nfs_rw_exit(&tdrp->r_rwlock);
7512                 return (e.error);
7513         }
7514 
7515         /* 0. putfh file */
7516         argop[0].argop = OP_CPUTFH;
7517         argop[0].nfs_argop4_u.opcputfh.sfh = VTOR4(svp)->r_fh;
7518 
7519         /* 1. save current fh to free up the space for the dir */
7520         argop[1].argop = OP_SAVEFH;
7521 
7522         /* 2. putfh targetdir */
7523         argop[2].argop = OP_CPUTFH;
7524         argop[2].nfs_argop4_u.opcputfh.sfh = tdrp->r_fh;
7525 
7526         /* 3. link: current_fh is targetdir, saved_fh is source */
7527         argop[3].argop = OP_CLINK;
7528         argop[3].nfs_argop4_u.opclink.cnewname = tnm;
7529 
7530         /* 4. Get attributes of dir */
7531         argop[4].argop = OP_GETATTR;
7532         argop[4].nfs_argop4_u.opgetattr.attr_request = NFS4_VATTR_MASK;
7533         argop[4].nfs_argop4_u.opgetattr.mi = mi;
7534 
7535         /* 5. If link was successful, restore current vp to file */
7536         argop[5].argop = OP_RESTOREFH;
7537 
7538         /* 6. Get attributes of linked object */
7539         argop[6].argop = OP_GETATTR;
7540         argop[6].nfs_argop4_u.opgetattr.attr_request = NFS4_VATTR_MASK;
7541         argop[6].nfs_argop4_u.opgetattr.mi = mi;
7542 
7543         dnlc_remove(tdvp, tnm);
7544 
7545         doqueue = 1;
7546         t = gethrtime();
7547 
7548         rfs4call(VTOMI4(svp), &args, &res, cr, &doqueue, 0, &e);
7549 
7550         needrecov = nfs4_needs_recovery(&e, FALSE, svp->v_vfsp);
7551         if (e.error != 0 && !needrecov) {
7552                 PURGE_ATTRCACHE4(tdvp);
7553                 PURGE_ATTRCACHE4(svp);
7554                 nfs4_end_op(VTOMI4(svp), svp, tdvp, &recov_state, needrecov);
7555                 goto out;
7556         }
7557 
7558         if (needrecov) {
7559                 bool_t abort;
7560 
7561                 abort = nfs4_start_recovery(&e, VTOMI4(svp), svp, tdvp,
7562                     NULL, NULL, OP_LINK, NULL, NULL, NULL);
7563                 if (abort == FALSE) {
7564                         nfs4_end_op(VTOMI4(svp), svp, tdvp, &recov_state,
7565                             needrecov);
7566                         kmem_free(argop, argoplist_size);
7567                         if (!e.error)
7568                                 (void) xdr_free(xdr_COMPOUND4res_clnt,
7569                                     (caddr_t)&res);
7570                         goto recov_retry;
7571                 } else {
7572                         if (e.error != 0) {
7573                                 PURGE_ATTRCACHE4(tdvp);
7574                                 PURGE_ATTRCACHE4(svp);
7575                                 nfs4_end_op(VTOMI4(svp), svp, tdvp,
7576                                     &recov_state, needrecov);
7577                                 goto out;
7578                         }
7579                         /* fall through for res.status case */
7580                 }
7581         }
7582 
7583         nfs4_end_op(VTOMI4(svp), svp, tdvp, &recov_state, needrecov);
7584 
7585         resp = &res;
7586         if (res.status) {
7587                 /* If link succeeded, then don't return error */
7588                 e.error = geterrno4(res.status);
7589                 if (res.array_len <= 4) {
7590                         /*
7591                          * Either Putfh, Savefh, Putfh dir, or Link failed
7592                          */
7593                         PURGE_ATTRCACHE4(svp);
7594                         PURGE_ATTRCACHE4(tdvp);
7595                         if (e.error == EOPNOTSUPP) {
7596                                 mutex_enter(&mi->mi_lock);
7597                                 mi->mi_flags &= ~MI4_LINK;
7598                                 mutex_exit(&mi->mi_lock);
7599                         }
7600                         /* Remap EISDIR to EPERM for non-root user for SVVS */
7601                         /* XXX-LP */
7602                         if (e.error == EISDIR && crgetuid(cr) != 0)
7603                                 e.error = EPERM;
7604                         goto out;
7605                 }
7606         }
7607 
7608         /* either no error or one of the postop getattr failed */
7609 
7610         /*
7611          * XXX - if LINK succeeded, but no attrs were returned for link
7612          * file, purge its cache.
7613          *
7614          * XXX Perform a simplified version of wcc checking. Instead of
7615          * have another getattr to get pre-op, just purge cache if
7616          * any of the ops prior to and including the getattr failed.
7617          * If the getattr succeeded then update the attrcache accordingly.
7618          */
7619 
7620         /*
7621          * update cache with link file postattrs.
7622          * Note: at this point resop points to link res.
7623          */
7624         resop = &res.array[3];      /* link res */
7625         ln_res = &resop->nfs_resop4_u.oplink;
7626         if (res.status == NFS4_OK)
7627                 e.error = nfs4_update_attrcache(res.status,
7628                     &res.array[6].nfs_resop4_u.opgetattr.ga_res,
7629                     t, svp, cr);
7630 
7631         /*
7632          * Call makenfs4node to create the new shadow vp for tnm.
7633          * We pass NULL attrs because we just cached attrs for
7634          * the src object.  All we're trying to accomplish is to
7635          * to create the new shadow vnode.
7636          */
7637         nvp = makenfs4node(VTOR4(svp)->r_fh, NULL, tdvp->v_vfsp, t, cr,
7638             tdvp, fn_get(VTOSV(tdvp)->sv_name, tnm, VTOR4(svp)->r_fh));
7639 
7640         /* Update target cache attribute, readdir and dnlc caches */
7641         dinfo.di_garp = &res.array[4].nfs_resop4_u.opgetattr.ga_res;
7642         dinfo.di_time_call = t;
7643         dinfo.di_cred = cr;
7644 
7645         nfs4_update_dircaches(&ln_res->cinfo, tdvp, nvp, tnm, &dinfo);
7646         ASSERT(nfs4_consistent_type(tdvp));
7647         ASSERT(nfs4_consistent_type(svp));
7648         ASSERT(nfs4_consistent_type(nvp));
7649         VN_RELE(nvp);
7650 
7651         if (!e.error) {
7652                 vnode_t *tvp;
7653                 rnode4_t *trp;
7654                 /*
7655                  * Notify the source file of this link operation.
7656                  */
7657                 trp = VTOR4(svp);
7658                 tvp = svp;
7659                 if (IS_SHADOW(svp, trp))
7660                         tvp = RTOV4(trp);
7661                 vnevent_link(tvp, ct);
7662         }
7663 out:
7664         kmem_free(argop, argoplist_size);
7665         if (resp)
7666                 (void) xdr_free(xdr_COMPOUND4res_clnt, (caddr_t)resp);
7667 
7668         nfs_rw_exit(&tdrp->r_rwlock);
7669 
7670         return (e.error);
7671 }
7672 
7673 /* ARGSUSED */
7674 static int
7675 nfs4_rename(vnode_t *odvp, char *onm, vnode_t *ndvp, char *nnm, cred_t *cr,
7676     caller_context_t *ct, int flags)
7677 {
7678         vnode_t *realvp;
7679 
7680         if (nfs_zone() != VTOMI4(odvp)->mi_zone)
7681                 return (EPERM);
7682         if (VOP_REALVP(ndvp, &realvp, ct) == 0)
7683                 ndvp = realvp;
7684 
7685         return (nfs4rename(odvp, onm, ndvp, nnm, cr, ct));
7686 }
7687 
7688 /*
7689  * nfs4rename does the real work of renaming in NFS Version 4.
7690  *
7691  * A file handle is considered volatile for renaming purposes if either
7692  * of the volatile bits are turned on. However, the compound may differ
7693  * based on the likelihood of the filehandle to change during rename.
7694  */
7695 static int
7696 nfs4rename(vnode_t *odvp, char *onm, vnode_t *ndvp, char *nnm, cred_t *cr,
7697     caller_context_t *ct)
7698 {
7699         int error;
7700         mntinfo4_t *mi;
7701         vnode_t *nvp = NULL;
7702         vnode_t *ovp = NULL;
7703         char *tmpname = NULL;
7704         rnode4_t *rp;
7705         rnode4_t *odrp;
7706         rnode4_t *ndrp;
7707         int did_link = 0;
7708         int do_link = 1;
7709         nfsstat4 stat = NFS4_OK;
7710 
7711         ASSERT(nfs_zone() == VTOMI4(odvp)->mi_zone);
7712         ASSERT(nfs4_consistent_type(odvp));
7713         ASSERT(nfs4_consistent_type(ndvp));
7714 
7715         if (onm[0] == '.' && (onm[1] == '\0' ||
7716             (onm[1] == '.' && onm[2] == '\0')))
7717                 return (EINVAL);
7718 
7719         if (nnm[0] == '.' && (nnm[1] == '\0' ||
7720             (nnm[1] == '.' && nnm[2] == '\0')))
7721                 return (EINVAL);
7722 
7723         odrp = VTOR4(odvp);
7724         ndrp = VTOR4(ndvp);
7725         if ((intptr_t)odrp < (intptr_t)ndrp) {
7726                 if (nfs_rw_enter_sig(&odrp->r_rwlock, RW_WRITER, INTR4(odvp)))
7727                         return (EINTR);
7728                 if (nfs_rw_enter_sig(&ndrp->r_rwlock, RW_WRITER, INTR4(ndvp))) {
7729                         nfs_rw_exit(&odrp->r_rwlock);
7730                         return (EINTR);
7731                 }
7732         } else {
7733                 if (nfs_rw_enter_sig(&ndrp->r_rwlock, RW_WRITER, INTR4(ndvp)))
7734                         return (EINTR);
7735                 if (nfs_rw_enter_sig(&odrp->r_rwlock, RW_WRITER, INTR4(odvp))) {
7736                         nfs_rw_exit(&ndrp->r_rwlock);
7737                         return (EINTR);
7738                 }
7739         }
7740 
7741         /*
7742          * Lookup the target file.  If it exists, it needs to be
7743          * checked to see whether it is a mount point and whether
7744          * it is active (open).
7745          */
7746         error = nfs4lookup(ndvp, nnm, &nvp, cr, 0);
7747         if (!error) {
7748                 int     isactive;
7749 
7750                 ASSERT(nfs4_consistent_type(nvp));
7751                 /*
7752                  * If this file has been mounted on, then just
7753                  * return busy because renaming to it would remove
7754                  * the mounted file system from the name space.
7755                  */
7756                 if (vn_ismntpt(nvp)) {
7757                         VN_RELE(nvp);
7758                         nfs_rw_exit(&odrp->r_rwlock);
7759                         nfs_rw_exit(&ndrp->r_rwlock);
7760                         return (EBUSY);
7761                 }
7762 
7763                 /*
7764                  * First just remove the entry from the name cache, as it
7765                  * is most likely the only entry for this vp.
7766                  */
7767                 dnlc_remove(ndvp, nnm);
7768 
7769                 rp = VTOR4(nvp);
7770 
7771                 if (nvp->v_type != VREG) {
7772                         /*
7773                          * Purge the name cache of all references to this vnode
7774                          * so that we can check the reference count to infer
7775                          * whether it is active or not.
7776                          */
7777                         if (nvp->v_count > 1)
7778                                 dnlc_purge_vp(nvp);
7779 
7780                         isactive = nvp->v_count > 1;
7781                 } else {
7782                         mutex_enter(&rp->r_os_lock);
7783                         isactive = list_head(&rp->r_open_streams) != NULL;
7784                         mutex_exit(&rp->r_os_lock);
7785                 }
7786 
7787                 /*
7788                  * If the vnode is active and is not a directory,
7789                  * arrange to rename it to a
7790                  * temporary file so that it will continue to be
7791                  * accessible.  This implements the "unlink-open-file"
7792                  * semantics for the target of a rename operation.
7793                  * Before doing this though, make sure that the
7794                  * source and target files are not already the same.
7795                  */
7796                 if (isactive && nvp->v_type != VDIR) {
7797                         /*
7798                          * Lookup the source name.
7799                          */
7800                         error = nfs4lookup(odvp, onm, &ovp, cr, 0);
7801 
7802                         /*
7803                          * The source name *should* already exist.
7804                          */
7805                         if (error) {
7806                                 VN_RELE(nvp);
7807                                 nfs_rw_exit(&odrp->r_rwlock);
7808                                 nfs_rw_exit(&ndrp->r_rwlock);
7809                                 return (error);
7810                         }
7811 
7812                         ASSERT(nfs4_consistent_type(ovp));
7813 
7814                         /*
7815                          * Compare the two vnodes.  If they are the same,
7816                          * just release all held vnodes and return success.
7817                          */
7818                         if (VN_CMP(ovp, nvp)) {
7819                                 VN_RELE(ovp);
7820                                 VN_RELE(nvp);
7821                                 nfs_rw_exit(&odrp->r_rwlock);
7822                                 nfs_rw_exit(&ndrp->r_rwlock);
7823                                 return (0);
7824                         }
7825 
7826                         /*
7827                          * Can't mix and match directories and non-
7828                          * directories in rename operations.  We already
7829                          * know that the target is not a directory.  If
7830                          * the source is a directory, return an error.
7831                          */
7832                         if (ovp->v_type == VDIR) {
7833                                 VN_RELE(ovp);
7834                                 VN_RELE(nvp);
7835                                 nfs_rw_exit(&odrp->r_rwlock);
7836                                 nfs_rw_exit(&ndrp->r_rwlock);
7837                                 return (ENOTDIR);
7838                         }
7839 link_call:
7840                         /*
7841                          * The target file exists, is not the same as
7842                          * the source file, and is active.  We first
7843                          * try to Link it to a temporary filename to
7844                          * avoid having the server removing the file
7845                          * completely (which could cause data loss to
7846                          * the user's POV in the event the Rename fails
7847                          * -- see bug 1165874).
7848                          */
7849                         /*
7850                          * The do_link and did_link booleans are
7851                          * introduced in the event we get NFS4ERR_FILE_OPEN
7852                          * returned for the Rename.  Some servers can
7853                          * not Rename over an Open file, so they return
7854                          * this error.  The client needs to Remove the
7855                          * newly created Link and do two Renames, just
7856                          * as if the server didn't support LINK.
7857                          */
7858                         tmpname = newname();
7859                         error = 0;
7860 
7861                         if (do_link) {
7862                                 error = nfs4_link(ndvp, nvp, tmpname, cr,
7863                                     NULL, 0);
7864                         }
7865                         if (error == EOPNOTSUPP || !do_link) {
7866                                 error = nfs4_rename(ndvp, nnm, ndvp, tmpname,
7867                                     cr, NULL, 0);
7868                                 did_link = 0;
7869                         } else {
7870                                 did_link = 1;
7871                         }
7872                         if (error) {
7873                                 kmem_free(tmpname, MAXNAMELEN);
7874                                 VN_RELE(ovp);
7875                                 VN_RELE(nvp);
7876                                 nfs_rw_exit(&odrp->r_rwlock);
7877                                 nfs_rw_exit(&ndrp->r_rwlock);
7878                                 return (error);
7879                         }
7880 
7881                         mutex_enter(&rp->r_statelock);
7882                         if (rp->r_unldvp == NULL) {
7883                                 VN_HOLD(ndvp);
7884                                 rp->r_unldvp = ndvp;
7885                                 if (rp->r_unlcred != NULL)
7886                                         crfree(rp->r_unlcred);
7887                                 crhold(cr);
7888                                 rp->r_unlcred = cr;
7889                                 rp->r_unlname = tmpname;
7890                         } else {
7891                                 if (rp->r_unlname)
7892                                         kmem_free(rp->r_unlname, MAXNAMELEN);
7893                                 rp->r_unlname = tmpname;
7894                         }
7895                         mutex_exit(&rp->r_statelock);
7896                 }
7897 
7898                 (void) nfs4delegreturn(VTOR4(nvp), NFS4_DR_PUSH|NFS4_DR_REOPEN);
7899 
7900                 ASSERT(nfs4_consistent_type(nvp));
7901         }
7902 
7903         if (ovp == NULL) {
7904                 /*
7905                  * When renaming directories to be a subdirectory of a
7906                  * different parent, the dnlc entry for ".." will no
7907                  * longer be valid, so it must be removed.
7908                  *
7909                  * We do a lookup here to determine whether we are renaming
7910                  * a directory and we need to check if we are renaming
7911                  * an unlinked file.  This might have already been done
7912                  * in previous code, so we check ovp == NULL to avoid
7913                  * doing it twice.
7914                  */
7915                 error = nfs4lookup(odvp, onm, &ovp, cr, 0);
7916                 /*
7917                  * The source name *should* already exist.
7918                  */
7919                 if (error) {
7920                         nfs_rw_exit(&odrp->r_rwlock);
7921                         nfs_rw_exit(&ndrp->r_rwlock);
7922                         if (nvp) {
7923                                 VN_RELE(nvp);
7924                         }
7925                         return (error);
7926                 }
7927                 ASSERT(ovp != NULL);
7928                 ASSERT(nfs4_consistent_type(ovp));
7929         }
7930 
7931         /*
7932          * Is the object being renamed a dir, and if so, is
7933          * it being renamed to a child of itself?  The underlying
7934          * fs should ultimately return EINVAL for this case;
7935          * however, buggy beta non-Solaris NFSv4 servers at
7936          * interop testing events have allowed this behavior,
7937          * and it caused our client to panic due to a recursive
7938          * mutex_enter in fn_move.
7939          *
7940          * The tedious locking in fn_move could be changed to
7941          * deal with this case, and the client could avoid the
7942          * panic; however, the client would just confuse itself
7943          * later and misbehave.  A better way to handle the broken
7944          * server is to detect this condition and return EINVAL
7945          * without ever sending the the bogus rename to the server.
7946          * We know the rename is invalid -- just fail it now.
7947          */
7948         if (ovp->v_type == VDIR && VN_CMP(ndvp, ovp)) {
7949                 VN_RELE(ovp);
7950                 nfs_rw_exit(&odrp->r_rwlock);
7951                 nfs_rw_exit(&ndrp->r_rwlock);
7952                 if (nvp) {
7953                         VN_RELE(nvp);
7954                 }
7955                 return (EINVAL);
7956         }
7957 
7958         (void) nfs4delegreturn(VTOR4(ovp), NFS4_DR_PUSH|NFS4_DR_REOPEN);
7959 
7960         /*
7961          * If FH4_VOL_RENAME or FH4_VOLATILE_ANY bits are set, it is
7962          * possible for the filehandle to change due to the rename.
7963          * If neither of these bits is set, but FH4_VOL_MIGRATION is set,
7964          * the fh will not change because of the rename, but we still need
7965          * to update its rnode entry with the new name for
7966          * an eventual fh change due to migration. The FH4_NOEXPIRE_ON_OPEN
7967          * has no effect on these for now, but for future improvements,
7968          * we might want to use it too to simplify handling of files
7969          * that are open with that flag on. (XXX)
7970          */
7971         mi = VTOMI4(odvp);
7972         if (NFS4_VOLATILE_FH(mi))
7973                 error = nfs4rename_volatile_fh(odvp, onm, ovp, ndvp, nnm, cr,
7974                     &stat);
7975         else
7976                 error = nfs4rename_persistent_fh(odvp, onm, ovp, ndvp, nnm, cr,
7977                     &stat);
7978 
7979         ASSERT(nfs4_consistent_type(odvp));
7980         ASSERT(nfs4_consistent_type(ndvp));
7981         ASSERT(nfs4_consistent_type(ovp));
7982 
7983         if (stat == NFS4ERR_FILE_OPEN && did_link) {
7984                 do_link = 0;
7985                 /*
7986                  * Before the 'link_call' code, we did a nfs4_lookup
7987                  * that puts a VN_HOLD on nvp.  After the nfs4_link
7988                  * call we call VN_RELE to match that hold.  We need
7989                  * to place an additional VN_HOLD here since we will
7990                  * be hitting that VN_RELE again.
7991                  */
7992                 VN_HOLD(nvp);
7993 
7994                 (void) nfs4_remove(ndvp, tmpname, cr, NULL, 0);
7995 
7996                 /* Undo the unlinked file naming stuff we just did */
7997                 mutex_enter(&rp->r_statelock);
7998                 if (rp->r_unldvp) {
7999                         VN_RELE(ndvp);
8000                         rp->r_unldvp = NULL;
8001                         if (rp->r_unlcred != NULL)
8002                                 crfree(rp->r_unlcred);
8003                         rp->r_unlcred = NULL;
8004                         /* rp->r_unlanme points to tmpname */
8005                         if (rp->r_unlname)
8006                                 kmem_free(rp->r_unlname, MAXNAMELEN);
8007                         rp->r_unlname = NULL;
8008                 }
8009                 mutex_exit(&rp->r_statelock);
8010 
8011                 if (nvp) {
8012                         VN_RELE(nvp);
8013                 }
8014                 goto link_call;
8015         }
8016 
8017         if (error) {
8018                 VN_RELE(ovp);
8019                 nfs_rw_exit(&odrp->r_rwlock);
8020                 nfs_rw_exit(&ndrp->r_rwlock);
8021                 if (nvp) {
8022                         VN_RELE(nvp);
8023                 }
8024                 return (error);
8025         }
8026 
8027         /*
8028          * when renaming directories to be a subdirectory of a
8029          * different parent, the dnlc entry for ".." will no
8030          * longer be valid, so it must be removed
8031          */
8032         rp = VTOR4(ovp);
8033         if (ndvp != odvp) {
8034                 if (ovp->v_type == VDIR) {
8035                         dnlc_remove(ovp, "..");
8036                         if (rp->r_dir != NULL)
8037                                 nfs4_purge_rddir_cache(ovp);
8038                 }
8039         }
8040 
8041         /*
8042          * If we are renaming the unlinked file, update the
8043          * r_unldvp and r_unlname as needed.
8044          */
8045         mutex_enter(&rp->r_statelock);
8046         if (rp->r_unldvp != NULL) {
8047                 if (strcmp(rp->r_unlname, onm) == 0) {
8048                         (void) strncpy(rp->r_unlname, nnm, MAXNAMELEN);
8049                         rp->r_unlname[MAXNAMELEN - 1] = '\0';
8050                         if (ndvp != rp->r_unldvp) {
8051                                 VN_RELE(rp->r_unldvp);
8052                                 rp->r_unldvp = ndvp;
8053                                 VN_HOLD(ndvp);
8054                         }
8055                 }
8056         }
8057         mutex_exit(&rp->r_statelock);
8058 
8059         /*
8060          * Notify the rename vnevents to source vnode, and to the target
8061          * vnode if it already existed.
8062          */
8063         if (error == 0) {
8064                 vnode_t *tvp;
8065                 rnode4_t *trp;
8066                 /*
8067                  * Notify the vnode. Each links is represented by
8068                  * a different vnode, in nfsv4.
8069                  */
8070                 if (nvp) {
8071                         trp = VTOR4(nvp);
8072                         tvp = nvp;
8073                         if (IS_SHADOW(nvp, trp))
8074                                 tvp = RTOV4(trp);
8075                         vnevent_rename_dest(tvp, ndvp, nnm, ct);
8076                 }
8077 
8078                 /*
8079                  * if the source and destination directory are not the
8080                  * same notify the destination directory.
8081                  */
8082                 if (VTOR4(odvp) != VTOR4(ndvp)) {
8083                         trp = VTOR4(ndvp);
8084                         tvp = ndvp;
8085                         if (IS_SHADOW(ndvp, trp))
8086                                 tvp = RTOV4(trp);
8087                         vnevent_rename_dest_dir(tvp, ct);
8088                 }
8089 
8090                 trp = VTOR4(ovp);
8091                 tvp = ovp;
8092                 if (IS_SHADOW(ovp, trp))
8093                         tvp = RTOV4(trp);
8094                 vnevent_rename_src(tvp, odvp, onm, ct);
8095         }
8096 
8097         if (nvp) {
8098                 VN_RELE(nvp);
8099         }
8100         VN_RELE(ovp);
8101 
8102         nfs_rw_exit(&odrp->r_rwlock);
8103         nfs_rw_exit(&ndrp->r_rwlock);
8104 
8105         return (error);
8106 }
8107 
8108 /*
8109  * When the parent directory has changed, sv_dfh must be updated
8110  */
8111 static void
8112 update_parentdir_sfh(vnode_t *vp, vnode_t *ndvp)
8113 {
8114         svnode_t *sv = VTOSV(vp);
8115         nfs4_sharedfh_t *old_dfh = sv->sv_dfh;
8116         nfs4_sharedfh_t *new_dfh = VTOR4(ndvp)->r_fh;
8117 
8118         sfh4_hold(new_dfh);
8119         sv->sv_dfh = new_dfh;
8120         sfh4_rele(&old_dfh);
8121 }
8122 
8123 /*
8124  * nfs4rename_persistent does the otw portion of renaming in NFS Version 4,
8125  * when it is known that the filehandle is persistent through rename.
8126  *
8127  * Rename requires that the current fh be the target directory and the
8128  * saved fh be the source directory. After the operation, the current fh
8129  * is unchanged.
8130  * The compound op structure for persistent fh rename is:
8131  *      PUTFH(sourcdir), SAVEFH, PUTFH(targetdir), RENAME
8132  * Rather than bother with the directory postop args, we'll simply
8133  * update that a change occurred in the cache, so no post-op getattrs.
8134  */
8135 static int
8136 nfs4rename_persistent_fh(vnode_t *odvp, char *onm, vnode_t *renvp,
8137     vnode_t *ndvp, char *nnm, cred_t *cr, nfsstat4 *statp)
8138 {
8139         COMPOUND4args_clnt args;
8140         COMPOUND4res_clnt res, *resp = NULL;
8141         nfs_argop4 *argop;
8142         nfs_resop4 *resop;
8143         int doqueue, argoplist_size;
8144         mntinfo4_t *mi;
8145         rnode4_t *odrp = VTOR4(odvp);
8146         rnode4_t *ndrp = VTOR4(ndvp);
8147         RENAME4res *rn_res;
8148         bool_t needrecov;
8149         nfs4_recov_state_t recov_state;
8150         nfs4_error_t e = { 0, NFS4_OK, RPC_SUCCESS };
8151         dirattr_info_t dinfo, *dinfop;
8152 
8153         ASSERT(nfs_zone() == VTOMI4(odvp)->mi_zone);
8154 
8155         recov_state.rs_flags = 0;
8156         recov_state.rs_num_retry_despite_err = 0;
8157 
8158         /*
8159          * Rename ops: putfh sdir; savefh; putfh tdir; rename; getattr tdir
8160          *
8161          * If source/target are different dirs, then append putfh(src); getattr
8162          */
8163         args.array_len = (odvp == ndvp) ? 5 : 7;
8164         argoplist_size = args.array_len * sizeof (nfs_argop4);
8165         args.array = argop = kmem_alloc(argoplist_size, KM_SLEEP);
8166 
8167 recov_retry:
8168         *statp = NFS4_OK;
8169 
8170         /* No need to Lookup the file, persistent fh */
8171         args.ctag = TAG_RENAME;
8172 
8173         mi = VTOMI4(odvp);
8174         e.error = nfs4_start_op(mi, odvp, ndvp, &recov_state);
8175         if (e.error) {
8176                 kmem_free(argop, argoplist_size);
8177                 return (e.error);
8178         }
8179 
8180         /* 0: putfh source directory */
8181         argop[0].argop = OP_CPUTFH;
8182         argop[0].nfs_argop4_u.opcputfh.sfh = odrp->r_fh;
8183 
8184         /* 1: Save source fh to free up current for target */
8185         argop[1].argop = OP_SAVEFH;
8186 
8187         /* 2: putfh targetdir */
8188         argop[2].argop = OP_CPUTFH;
8189         argop[2].nfs_argop4_u.opcputfh.sfh = ndrp->r_fh;
8190 
8191         /* 3: current_fh is targetdir, saved_fh is sourcedir */
8192         argop[3].argop = OP_CRENAME;
8193         argop[3].nfs_argop4_u.opcrename.coldname = onm;
8194         argop[3].nfs_argop4_u.opcrename.cnewname = nnm;
8195 
8196         /* 4: getattr (targetdir) */
8197         argop[4].argop = OP_GETATTR;
8198         argop[4].nfs_argop4_u.opgetattr.attr_request = NFS4_VATTR_MASK;
8199         argop[4].nfs_argop4_u.opgetattr.mi = mi;
8200 
8201         if (ndvp != odvp) {
8202 
8203                 /* 5: putfh (sourcedir) */
8204                 argop[5].argop = OP_CPUTFH;
8205                 argop[5].nfs_argop4_u.opcputfh.sfh = ndrp->r_fh;
8206 
8207                 /* 6: getattr (sourcedir) */
8208                 argop[6].argop = OP_GETATTR;
8209                 argop[6].nfs_argop4_u.opgetattr.attr_request = NFS4_VATTR_MASK;
8210                 argop[6].nfs_argop4_u.opgetattr.mi = mi;
8211         }
8212 
8213         dnlc_remove(odvp, onm);
8214         dnlc_remove(ndvp, nnm);
8215 
8216         doqueue = 1;
8217         dinfo.di_time_call = gethrtime();
8218         rfs4call(mi, &args, &res, cr, &doqueue, 0, &e);
8219 
8220         needrecov = nfs4_needs_recovery(&e, FALSE, mi->mi_vfsp);
8221         if (e.error) {
8222                 PURGE_ATTRCACHE4(odvp);
8223                 PURGE_ATTRCACHE4(ndvp);
8224         } else {
8225                 *statp = res.status;
8226         }
8227 
8228         if (needrecov) {
8229                 if (nfs4_start_recovery(&e, mi, odvp, ndvp, NULL, NULL,
8230                     OP_RENAME, NULL, NULL, NULL) == FALSE) {
8231                         nfs4_end_op(mi, odvp, ndvp, &recov_state, needrecov);
8232                         if (!e.error)
8233                                 (void) xdr_free(xdr_COMPOUND4res_clnt,
8234                                     (caddr_t)&res);
8235                         goto recov_retry;
8236                 }
8237         }
8238 
8239         if (!e.error) {
8240                 resp = &res;
8241                 /*
8242                  * as long as OP_RENAME
8243                  */
8244                 if (res.status != NFS4_OK && res.array_len <= 4) {
8245                         e.error = geterrno4(res.status);
8246                         PURGE_ATTRCACHE4(odvp);
8247                         PURGE_ATTRCACHE4(ndvp);
8248                         /*
8249                          * System V defines rename to return EEXIST, not
8250                          * ENOTEMPTY if the target directory is not empty.
8251                          * Over the wire, the error is NFSERR_ENOTEMPTY
8252                          * which geterrno4 maps to ENOTEMPTY.
8253                          */
8254                         if (e.error == ENOTEMPTY)
8255                                 e.error = EEXIST;
8256                 } else {
8257 
8258                         resop = &res.array[3];      /* rename res */
8259                         rn_res = &resop->nfs_resop4_u.oprename;
8260 
8261                         if (res.status == NFS4_OK) {
8262                                 /*
8263                                  * Update target attribute, readdir and dnlc
8264                                  * caches.
8265                                  */
8266                                 dinfo.di_garp =
8267                                     &res.array[4].nfs_resop4_u.opgetattr.ga_res;
8268                                 dinfo.di_cred = cr;
8269                                 dinfop = &dinfo;
8270                         } else
8271                                 dinfop = NULL;
8272 
8273                         nfs4_update_dircaches(&rn_res->target_cinfo,
8274                             ndvp, NULL, NULL, dinfop);
8275 
8276                         /*
8277                          * Update source attribute, readdir and dnlc caches
8278                          *
8279                          */
8280                         if (ndvp != odvp) {
8281                                 update_parentdir_sfh(renvp, ndvp);
8282 
8283                                 if (dinfop)
8284                                         dinfo.di_garp =
8285                                             &(res.array[6].nfs_resop4_u.
8286                                             opgetattr.ga_res);
8287 
8288                                 nfs4_update_dircaches(&rn_res->source_cinfo,
8289                                     odvp, NULL, NULL, dinfop);
8290                         }
8291 
8292                         fn_move(VTOSV(renvp)->sv_name, VTOSV(ndvp)->sv_name,
8293                             nnm);
8294                 }
8295         }
8296 
8297         if (resp)
8298                 (void) xdr_free(xdr_COMPOUND4res_clnt, (caddr_t)resp);
8299         nfs4_end_op(mi, odvp, ndvp, &recov_state, needrecov);
8300         kmem_free(argop, argoplist_size);
8301 
8302         return (e.error);
8303 }
8304 
8305 /*
8306  * nfs4rename_volatile_fh does the otw part of renaming in NFS Version 4, when
8307  * it is possible for the filehandle to change due to the rename.
8308  *
8309  * The compound req in this case includes a post-rename lookup and getattr
8310  * to ensure that we have the correct fh and attributes for the object.
8311  *
8312  * Rename requires that the current fh be the target directory and the
8313  * saved fh be the source directory. After the operation, the current fh
8314  * is unchanged.
8315  *
8316  * We need the new filehandle (hence a LOOKUP and GETFH) so that we can
8317  * update the filehandle for the renamed object.  We also get the old
8318  * filehandle for historical reasons; this should be taken out sometime.
8319  * This results in a rather cumbersome compound...
8320  *
8321  *    PUTFH(sourcdir), SAVEFH, LOOKUP(src), GETFH(old),
8322  *    PUTFH(targetdir), RENAME, LOOKUP(trgt), GETFH(new), GETATTR
8323  *
8324  */
8325 static int
8326 nfs4rename_volatile_fh(vnode_t *odvp, char *onm, vnode_t *ovp,
8327     vnode_t *ndvp, char *nnm, cred_t *cr, nfsstat4 *statp)
8328 {
8329         COMPOUND4args_clnt args;
8330         COMPOUND4res_clnt res, *resp = NULL;
8331         int argoplist_size;
8332         nfs_argop4 *argop;
8333         nfs_resop4 *resop;
8334         int doqueue;
8335         mntinfo4_t *mi;
8336         rnode4_t *odrp = VTOR4(odvp);   /* old directory */
8337         rnode4_t *ndrp = VTOR4(ndvp);   /* new directory */
8338         rnode4_t *orp = VTOR4(ovp);     /* object being renamed */
8339         RENAME4res *rn_res;
8340         GETFH4res *ngf_res;
8341         bool_t needrecov;
8342         nfs4_recov_state_t recov_state;
8343         hrtime_t t;
8344         nfs4_error_t e = { 0, NFS4_OK, RPC_SUCCESS };
8345         dirattr_info_t dinfo, *dinfop = &dinfo;
8346 
8347         ASSERT(nfs_zone() == VTOMI4(odvp)->mi_zone);
8348 
8349         recov_state.rs_flags = 0;
8350         recov_state.rs_num_retry_despite_err = 0;
8351 
8352 recov_retry:
8353         *statp = NFS4_OK;
8354 
8355         /*
8356          * There is a window between the RPC and updating the path and
8357          * filehandle stored in the rnode.  Lock out the FHEXPIRED recovery
8358          * code, so that it doesn't try to use the old path during that
8359          * window.
8360          */
8361         mutex_enter(&orp->r_statelock);
8362         while (orp->r_flags & R4RECEXPFH) {
8363                 klwp_t *lwp = ttolwp(curthread);
8364 
8365                 if (lwp != NULL)
8366                         lwp->lwp_nostop++;
8367                 if (cv_wait_sig(&orp->r_cv, &orp->r_statelock) == 0) {
8368                         mutex_exit(&orp->r_statelock);
8369                         if (lwp != NULL)
8370                                 lwp->lwp_nostop--;
8371                         return (EINTR);
8372                 }
8373                 if (lwp != NULL)
8374                         lwp->lwp_nostop--;
8375         }
8376         orp->r_flags |= R4RECEXPFH;
8377         mutex_exit(&orp->r_statelock);
8378 
8379         mi = VTOMI4(odvp);
8380 
8381         args.ctag = TAG_RENAME_VFH;
8382         args.array_len = (odvp == ndvp) ? 10 : 12;
8383         argoplist_size  = args.array_len * sizeof (nfs_argop4);
8384         argop = kmem_alloc(argoplist_size, KM_SLEEP);
8385 
8386         /*
8387          * Rename ops:
8388          *    PUTFH(sourcdir), SAVEFH, LOOKUP(src), GETFH(old),
8389          *    PUTFH(targetdir), RENAME, GETATTR(targetdir)
8390          *    LOOKUP(trgt), GETFH(new), GETATTR,
8391          *
8392          *    if (odvp != ndvp)
8393          *      add putfh(sourcedir), getattr(sourcedir) }
8394          */
8395         args.array = argop;
8396 
8397         e.error = nfs4_start_fop(mi, odvp, ndvp, OH_VFH_RENAME,
8398             &recov_state, NULL);
8399         if (e.error) {
8400                 kmem_free(argop, argoplist_size);
8401                 mutex_enter(&orp->r_statelock);
8402                 orp->r_flags &= ~R4RECEXPFH;
8403                 cv_broadcast(&orp->r_cv);
8404                 mutex_exit(&orp->r_statelock);
8405                 return (e.error);
8406         }
8407 
8408         /* 0: putfh source directory */
8409         argop[0].argop = OP_CPUTFH;
8410         argop[0].nfs_argop4_u.opcputfh.sfh = odrp->r_fh;
8411 
8412         /* 1: Save source fh to free up current for target */
8413         argop[1].argop = OP_SAVEFH;
8414 
8415         /* 2: Lookup pre-rename fh of renamed object */
8416         argop[2].argop = OP_CLOOKUP;
8417         argop[2].nfs_argop4_u.opclookup.cname = onm;
8418 
8419         /* 3: getfh fh of renamed object (before rename) */
8420         argop[3].argop = OP_GETFH;
8421 
8422         /* 4: putfh targetdir */
8423         argop[4].argop = OP_CPUTFH;
8424         argop[4].nfs_argop4_u.opcputfh.sfh = ndrp->r_fh;
8425 
8426         /* 5: current_fh is targetdir, saved_fh is sourcedir */
8427         argop[5].argop = OP_CRENAME;
8428         argop[5].nfs_argop4_u.opcrename.coldname = onm;
8429         argop[5].nfs_argop4_u.opcrename.cnewname = nnm;
8430 
8431         /* 6: getattr of target dir (post op attrs) */
8432         argop[6].argop = OP_GETATTR;
8433         argop[6].nfs_argop4_u.opgetattr.attr_request = NFS4_VATTR_MASK;
8434         argop[6].nfs_argop4_u.opgetattr.mi = mi;
8435 
8436         /* 7: Lookup post-rename fh of renamed object */
8437         argop[7].argop = OP_CLOOKUP;
8438         argop[7].nfs_argop4_u.opclookup.cname = nnm;
8439 
8440         /* 8: getfh fh of renamed object (after rename) */
8441         argop[8].argop = OP_GETFH;
8442 
8443         /* 9: getattr of renamed object */
8444         argop[9].argop = OP_GETATTR;
8445         argop[9].nfs_argop4_u.opgetattr.attr_request = NFS4_VATTR_MASK;
8446         argop[9].nfs_argop4_u.opgetattr.mi = mi;
8447 
8448         /*
8449          * If source/target dirs are different, then get new post-op
8450          * attrs for source dir also.
8451          */
8452         if (ndvp != odvp) {
8453                 /* 10: putfh (sourcedir) */
8454                 argop[10].argop = OP_CPUTFH;
8455                 argop[10].nfs_argop4_u.opcputfh.sfh = ndrp->r_fh;
8456 
8457                 /* 11: getattr (sourcedir) */
8458                 argop[11].argop = OP_GETATTR;
8459                 argop[11].nfs_argop4_u.opgetattr.attr_request = NFS4_VATTR_MASK;
8460                 argop[11].nfs_argop4_u.opgetattr.mi = mi;
8461         }
8462 
8463         dnlc_remove(odvp, onm);
8464         dnlc_remove(ndvp, nnm);
8465 
8466         doqueue = 1;
8467         t = gethrtime();
8468         rfs4call(mi, &args, &res, cr, &doqueue, 0, &e);
8469 
8470         needrecov = nfs4_needs_recovery(&e, FALSE, mi->mi_vfsp);
8471         if (e.error) {
8472                 PURGE_ATTRCACHE4(odvp);
8473                 PURGE_ATTRCACHE4(ndvp);
8474                 if (!needrecov) {
8475                         nfs4_end_fop(mi, odvp, ndvp, OH_VFH_RENAME,
8476                             &recov_state, needrecov);
8477                         goto out;
8478                 }
8479         } else {
8480                 *statp = res.status;
8481         }
8482 
8483         if (needrecov) {
8484                 bool_t abort;
8485 
8486                 abort = nfs4_start_recovery(&e, mi, odvp, ndvp, NULL, NULL,
8487                     OP_RENAME, NULL, NULL, NULL);
8488                 if (abort == FALSE) {
8489                         nfs4_end_fop(mi, odvp, ndvp, OH_VFH_RENAME,
8490                             &recov_state, needrecov);
8491                         kmem_free(argop, argoplist_size);
8492                         if (!e.error)
8493                                 (void) xdr_free(xdr_COMPOUND4res_clnt,
8494                                     (caddr_t)&res);
8495                         mutex_enter(&orp->r_statelock);
8496                         orp->r_flags &= ~R4RECEXPFH;
8497                         cv_broadcast(&orp->r_cv);
8498                         mutex_exit(&orp->r_statelock);
8499                         goto recov_retry;
8500                 } else {
8501                         if (e.error != 0) {
8502                                 nfs4_end_fop(mi, odvp, ndvp, OH_VFH_RENAME,
8503                                     &recov_state, needrecov);
8504                                 goto out;
8505                         }
8506                         /* fall through for res.status case */
8507                 }
8508         }
8509 
8510         resp = &res;
8511         /*
8512          * If OP_RENAME (or any prev op) failed, then return an error.
8513          * OP_RENAME is index 5, so if array len <= 6 we return an error.
8514          */
8515         if ((res.status != NFS4_OK) && (res.array_len <= 6)) {
8516                 /*
8517                  * Error in an op other than last Getattr
8518                  */
8519                 e.error = geterrno4(res.status);
8520                 PURGE_ATTRCACHE4(odvp);
8521                 PURGE_ATTRCACHE4(ndvp);
8522                 /*
8523                  * System V defines rename to return EEXIST, not
8524                  * ENOTEMPTY if the target directory is not empty.
8525                  * Over the wire, the error is NFSERR_ENOTEMPTY
8526                  * which geterrno4 maps to ENOTEMPTY.
8527                  */
8528                 if (e.error == ENOTEMPTY)
8529                         e.error = EEXIST;
8530                 nfs4_end_fop(mi, odvp, ndvp, OH_VFH_RENAME, &recov_state,
8531                     needrecov);
8532                 goto out;
8533         }
8534 
8535         /* rename results */
8536         rn_res = &res.array[5].nfs_resop4_u.oprename;
8537 
8538         if (res.status == NFS4_OK) {
8539                 /* Update target attribute, readdir and dnlc caches */
8540                 dinfo.di_garp =
8541                     &res.array[6].nfs_resop4_u.opgetattr.ga_res;
8542                 dinfo.di_cred = cr;
8543                 dinfo.di_time_call = t;
8544         } else
8545                 dinfop = NULL;
8546 
8547         /* Update source cache attribute, readdir and dnlc caches */
8548         nfs4_update_dircaches(&rn_res->target_cinfo, ndvp, NULL, NULL, dinfop);
8549 
8550         /* Update source cache attribute, readdir and dnlc caches */
8551         if (ndvp != odvp) {
8552                 update_parentdir_sfh(ovp, ndvp);
8553 
8554                 /*
8555                  * If dinfop is non-NULL, then compound succeded, so
8556                  * set di_garp to attrs for source dir.  dinfop is only
8557                  * set to NULL when compound fails.
8558                  */
8559                 if (dinfop)
8560                         dinfo.di_garp =
8561                             &res.array[11].nfs_resop4_u.opgetattr.ga_res;
8562                 nfs4_update_dircaches(&rn_res->source_cinfo, odvp, NULL, NULL,
8563                     dinfop);
8564         }
8565 
8566         /*
8567          * Update the rnode with the new component name and args,
8568          * and if the file handle changed, also update it with the new fh.
8569          * This is only necessary if the target object has an rnode
8570          * entry and there is no need to create one for it.
8571          */
8572         resop = &res.array[8];      /* getfh new res */
8573         ngf_res = &resop->nfs_resop4_u.opgetfh;
8574 
8575         /*
8576          * Update the path and filehandle for the renamed object.
8577          */
8578         nfs4rename_update(ovp, ndvp, &ngf_res->object, nnm);
8579 
8580         nfs4_end_fop(mi, odvp, ndvp, OH_VFH_RENAME, &recov_state, needrecov);
8581 
8582         if (res.status == NFS4_OK) {
8583                 resop++;        /* getattr res */
8584                 e.error = nfs4_update_attrcache(res.status,
8585                     &resop->nfs_resop4_u.opgetattr.ga_res,
8586                     t, ovp, cr);
8587         }
8588 
8589 out:
8590         kmem_free(argop, argoplist_size);
8591         if (resp)
8592                 (void) xdr_free(xdr_COMPOUND4res_clnt, (caddr_t)resp);
8593         mutex_enter(&orp->r_statelock);
8594         orp->r_flags &= ~R4RECEXPFH;
8595         cv_broadcast(&orp->r_cv);
8596         mutex_exit(&orp->r_statelock);
8597 
8598         return (e.error);
8599 }
8600 
8601 /* ARGSUSED */
8602 static int
8603 nfs4_mkdir(vnode_t *dvp, char *nm, struct vattr *va, vnode_t **vpp, cred_t *cr,
8604     caller_context_t *ct, int flags, vsecattr_t *vsecp)
8605 {
8606         int error;
8607         vnode_t *vp;
8608 
8609         if (nfs_zone() != VTOMI4(dvp)->mi_zone)
8610                 return (EPERM);
8611         /*
8612          * As ".." has special meaning and rather than send a mkdir
8613          * over the wire to just let the server freak out, we just
8614          * short circuit it here and return EEXIST
8615          */
8616         if (nm[0] == '.' && nm[1] == '.' && nm[2] == '\0')
8617                 return (EEXIST);
8618 
8619         /*
8620          * Decision to get the right gid and setgid bit of the
8621          * new directory is now made in call_nfs4_create_req.
8622          */
8623         va->va_mask |= AT_MODE;
8624         error = call_nfs4_create_req(dvp, nm, NULL, va, &vp, cr, NF4DIR);
8625         if (error)
8626                 return (error);
8627 
8628         *vpp = vp;
8629         return (0);
8630 }
8631 
8632 
8633 /*
8634  * rmdir is using the same remove v4 op as does remove.
8635  * Remove requires that the current fh be the target directory.
8636  * After the operation, the current fh is unchanged.
8637  * The compound op structure is:
8638  *      PUTFH(targetdir), REMOVE
8639  */
8640 /*ARGSUSED4*/
8641 static int
8642 nfs4_rmdir(vnode_t *dvp, char *nm, vnode_t *cdir, cred_t *cr,
8643     caller_context_t *ct, int flags)
8644 {
8645         int need_end_op = FALSE;
8646         COMPOUND4args_clnt args;
8647         COMPOUND4res_clnt res, *resp = NULL;
8648         REMOVE4res *rm_res;
8649         nfs_argop4 argop[3];
8650         nfs_resop4 *resop;
8651         vnode_t *vp;
8652         int doqueue;
8653         mntinfo4_t *mi;
8654         rnode4_t *drp;
8655         bool_t needrecov = FALSE;
8656         nfs4_recov_state_t recov_state;
8657         nfs4_error_t e = { 0, NFS4_OK, RPC_SUCCESS };
8658         dirattr_info_t dinfo, *dinfop;
8659 
8660         if (nfs_zone() != VTOMI4(dvp)->mi_zone)
8661                 return (EPERM);
8662         /*
8663          * As ".." has special meaning and rather than send a rmdir
8664          * over the wire to just let the server freak out, we just
8665          * short circuit it here and return EEXIST
8666          */
8667         if (nm[0] == '.' && nm[1] == '.' && nm[2] == '\0')
8668                 return (EEXIST);
8669 
8670         drp = VTOR4(dvp);
8671         if (nfs_rw_enter_sig(&drp->r_rwlock, RW_WRITER, INTR4(dvp)))
8672                 return (EINTR);
8673 
8674         /*
8675          * Attempt to prevent a rmdir(".") from succeeding.
8676          */
8677         e.error = nfs4lookup(dvp, nm, &vp, cr, 0);
8678         if (e.error) {
8679                 nfs_rw_exit(&drp->r_rwlock);
8680                 return (e.error);
8681         }
8682         if (vp == cdir) {
8683                 VN_RELE(vp);
8684                 nfs_rw_exit(&drp->r_rwlock);
8685                 return (EINVAL);
8686         }
8687 
8688         /*
8689          * Since nfsv4 remove op works on both files and directories,
8690          * check that the removed object is indeed a directory.
8691          */
8692         if (vp->v_type != VDIR) {
8693                 VN_RELE(vp);
8694                 nfs_rw_exit(&drp->r_rwlock);
8695                 return (ENOTDIR);
8696         }
8697 
8698         /*
8699          * First just remove the entry from the name cache, as it
8700          * is most likely an entry for this vp.
8701          */
8702         dnlc_remove(dvp, nm);
8703 
8704         /*
8705          * If there vnode reference count is greater than one, then
8706          * there may be additional references in the DNLC which will
8707          * need to be purged.  First, trying removing the entry for
8708          * the parent directory and see if that removes the additional
8709          * reference(s).  If that doesn't do it, then use dnlc_purge_vp
8710          * to completely remove any references to the directory which
8711          * might still exist in the DNLC.
8712          */
8713         if (vp->v_count > 1) {
8714                 dnlc_remove(vp, "..");
8715                 if (vp->v_count > 1)
8716                         dnlc_purge_vp(vp);
8717         }
8718 
8719         mi = VTOMI4(dvp);
8720         recov_state.rs_flags = 0;
8721         recov_state.rs_num_retry_despite_err = 0;
8722 
8723 recov_retry:
8724         args.ctag = TAG_RMDIR;
8725 
8726         /*
8727          * Rmdir ops: putfh dir; remove
8728          */
8729         args.array_len = 3;
8730         args.array = argop;
8731 
8732         e.error = nfs4_start_op(VTOMI4(dvp), dvp, NULL, &recov_state);
8733         if (e.error) {
8734                 nfs_rw_exit(&drp->r_rwlock);
8735                 return (e.error);
8736         }
8737         need_end_op = TRUE;
8738 
8739         /* putfh directory */
8740         argop[0].argop = OP_CPUTFH;
8741         argop[0].nfs_argop4_u.opcputfh.sfh = drp->r_fh;
8742 
8743         /* remove */
8744         argop[1].argop = OP_CREMOVE;
8745         argop[1].nfs_argop4_u.opcremove.ctarget = nm;
8746 
8747         /* getattr (postop attrs for dir that contained removed dir) */
8748         argop[2].argop = OP_GETATTR;
8749         argop[2].nfs_argop4_u.opgetattr.attr_request = NFS4_VATTR_MASK;
8750         argop[2].nfs_argop4_u.opgetattr.mi = mi;
8751 
8752         dinfo.di_time_call = gethrtime();
8753         doqueue = 1;
8754         rfs4call(mi, &args, &res, cr, &doqueue, 0, &e);
8755 
8756         PURGE_ATTRCACHE4(vp);
8757 
8758         needrecov = nfs4_needs_recovery(&e, FALSE, mi->mi_vfsp);
8759         if (e.error) {
8760                 PURGE_ATTRCACHE4(dvp);
8761         }
8762 
8763         if (needrecov) {
8764                 if (nfs4_start_recovery(&e, VTOMI4(dvp), dvp, NULL, NULL,
8765                     NULL, OP_REMOVE, NULL, NULL, NULL) == FALSE) {
8766                         if (!e.error)
8767                                 (void) xdr_free(xdr_COMPOUND4res_clnt,
8768                                     (caddr_t)&res);
8769 
8770                         nfs4_end_op(VTOMI4(dvp), dvp, NULL, &recov_state,
8771                             needrecov);
8772                         need_end_op = FALSE;
8773                         goto recov_retry;
8774                 }
8775         }
8776 
8777         if (!e.error) {
8778                 resp = &res;
8779 
8780                 /*
8781                  * Only return error if first 2 ops (OP_REMOVE or earlier)
8782                  * failed.
8783                  */
8784                 if (res.status != NFS4_OK && res.array_len <= 2) {
8785                         e.error = geterrno4(res.status);
8786                         PURGE_ATTRCACHE4(dvp);
8787                         nfs4_end_op(VTOMI4(dvp), dvp, NULL,
8788                             &recov_state, needrecov);
8789                         need_end_op = FALSE;
8790                         nfs4_purge_stale_fh(e.error, dvp, cr);
8791                         /*
8792                          * System V defines rmdir to return EEXIST, not
8793                          * ENOTEMPTY if the directory is not empty.  Over
8794                          * the wire, the error is NFSERR_ENOTEMPTY which
8795                          * geterrno4 maps to ENOTEMPTY.
8796                          */
8797                         if (e.error == ENOTEMPTY)
8798                                 e.error = EEXIST;
8799                 } else {
8800                         resop = &res.array[1];      /* remove res */
8801                         rm_res = &resop->nfs_resop4_u.opremove;
8802 
8803                         if (res.status == NFS4_OK) {
8804                                 resop = &res.array[2];      /* dir attrs */
8805                                 dinfo.di_garp =
8806                                     &resop->nfs_resop4_u.opgetattr.ga_res;
8807                                 dinfo.di_cred = cr;
8808                                 dinfop = &dinfo;
8809                         } else
8810                                 dinfop = NULL;
8811 
8812                         /* Update dir attribute, readdir and dnlc caches */
8813                         nfs4_update_dircaches(&rm_res->cinfo, dvp, NULL, NULL,
8814                             dinfop);
8815 
8816                         /* destroy rddir cache for dir that was removed */
8817                         if (VTOR4(vp)->r_dir != NULL)
8818                                 nfs4_purge_rddir_cache(vp);
8819                 }
8820         }
8821 
8822         if (need_end_op)
8823                 nfs4_end_op(VTOMI4(dvp), dvp, NULL, &recov_state, needrecov);
8824 
8825         nfs_rw_exit(&drp->r_rwlock);
8826 
8827         if (resp)
8828                 (void) xdr_free(xdr_COMPOUND4res_clnt, (caddr_t)resp);
8829 
8830         if (e.error == 0) {
8831                 vnode_t *tvp;
8832                 rnode4_t *trp;
8833                 trp = VTOR4(vp);
8834                 tvp = vp;
8835                 if (IS_SHADOW(vp, trp))
8836                         tvp = RTOV4(trp);
8837                 vnevent_rmdir(tvp, dvp, nm, ct);
8838         }
8839 
8840         VN_RELE(vp);
8841 
8842         return (e.error);
8843 }
8844 
8845 /* ARGSUSED */
8846 static int
8847 nfs4_symlink(vnode_t *dvp, char *lnm, struct vattr *tva, char *tnm, cred_t *cr,
8848     caller_context_t *ct, int flags)
8849 {
8850         int error;
8851         vnode_t *vp;
8852         rnode4_t *rp;
8853         char *contents;
8854         mntinfo4_t *mi = VTOMI4(dvp);
8855 
8856         if (nfs_zone() != mi->mi_zone)
8857                 return (EPERM);
8858         if (!(mi->mi_flags & MI4_SYMLINK))
8859                 return (EOPNOTSUPP);
8860 
8861         error = call_nfs4_create_req(dvp, lnm, tnm, tva, &vp, cr, NF4LNK);
8862         if (error)
8863                 return (error);
8864 
8865         ASSERT(nfs4_consistent_type(vp));
8866         rp = VTOR4(vp);
8867         if (nfs4_do_symlink_cache && rp->r_symlink.contents == NULL) {
8868 
8869                 contents = kmem_alloc(MAXPATHLEN, KM_SLEEP);
8870 
8871                 if (contents != NULL) {
8872                         mutex_enter(&rp->r_statelock);
8873                         if (rp->r_symlink.contents == NULL) {
8874                                 rp->r_symlink.len = strlen(tnm);
8875                                 bcopy(tnm, contents, rp->r_symlink.len);
8876                                 rp->r_symlink.contents = contents;
8877                                 rp->r_symlink.size = MAXPATHLEN;
8878                                 mutex_exit(&rp->r_statelock);
8879                         } else {
8880                                 mutex_exit(&rp->r_statelock);
8881                                 kmem_free((void *)contents, MAXPATHLEN);
8882                         }
8883                 }
8884         }
8885         VN_RELE(vp);
8886 
8887         return (error);
8888 }
8889 
8890 
8891 /*
8892  * Read directory entries.
8893  * There are some weird things to look out for here.  The uio_loffset
8894  * field is either 0 or it is the offset returned from a previous
8895  * readdir.  It is an opaque value used by the server to find the
8896  * correct directory block to read. The count field is the number
8897  * of blocks to read on the server.  This is advisory only, the server
8898  * may return only one block's worth of entries.  Entries may be compressed
8899  * on the server.
8900  */
8901 /* ARGSUSED */
8902 static int
8903 nfs4_readdir(vnode_t *vp, struct uio *uiop, cred_t *cr, int *eofp,
8904         caller_context_t *ct, int flags)
8905 {
8906         int error;
8907         uint_t count;
8908         rnode4_t *rp;
8909         rddir4_cache *rdc;
8910         rddir4_cache *rrdc;
8911 
8912         if (nfs_zone() != VTOMI4(vp)->mi_zone)
8913                 return (EIO);
8914         rp = VTOR4(vp);
8915 
8916         ASSERT(nfs_rw_lock_held(&rp->r_rwlock, RW_READER));
8917 
8918         /*
8919          * Make sure that the directory cache is valid.
8920          */
8921         if (rp->r_dir != NULL) {
8922                 if (nfs_disable_rddir_cache != 0) {
8923                         /*
8924                          * Setting nfs_disable_rddir_cache in /etc/system
8925                          * allows interoperability with servers that do not
8926                          * properly update the attributes of directories.
8927                          * Any cached information gets purged before an
8928                          * access is made to it.
8929                          */
8930                         nfs4_purge_rddir_cache(vp);
8931                 }
8932 
8933                 error = nfs4_validate_caches(vp, cr);
8934                 if (error)
8935                         return (error);
8936         }
8937 
8938         count = MIN(uiop->uio_iov->iov_len, MAXBSIZE);
8939 
8940         /*
8941          * Short circuit last readdir which always returns 0 bytes.
8942          * This can be done after the directory has been read through
8943          * completely at least once.  This will set r_direof which
8944          * can be used to find the value of the last cookie.
8945          */
8946         mutex_enter(&rp->r_statelock);
8947         if (rp->r_direof != NULL &&
8948             uiop->uio_loffset == rp->r_direof->nfs4_ncookie) {
8949                 mutex_exit(&rp->r_statelock);
8950 #ifdef DEBUG
8951                 nfs4_readdir_cache_shorts++;
8952 #endif
8953                 if (eofp)
8954                         *eofp = 1;
8955                 return (0);
8956         }
8957 
8958         /*
8959          * Look for a cache entry.  Cache entries are identified
8960          * by the NFS cookie value and the byte count requested.
8961          */
8962         rdc = rddir4_cache_lookup(rp, uiop->uio_loffset, count);
8963 
8964         /*
8965          * If rdc is NULL then the lookup resulted in an unrecoverable error.
8966          */
8967         if (rdc == NULL) {
8968                 mutex_exit(&rp->r_statelock);
8969                 return (EINTR);
8970         }
8971 
8972         /*
8973          * Check to see if we need to fill this entry in.
8974          */
8975         if (rdc->flags & RDDIRREQ) {
8976                 rdc->flags &= ~RDDIRREQ;
8977                 rdc->flags |= RDDIR;
8978                 mutex_exit(&rp->r_statelock);
8979 
8980                 /*
8981                  * Do the readdir.
8982                  */
8983                 nfs4readdir(vp, rdc, cr);
8984 
8985                 /*
8986                  * Reacquire the lock, so that we can continue
8987                  */
8988                 mutex_enter(&rp->r_statelock);
8989                 /*
8990                  * The entry is now complete
8991                  */
8992                 rdc->flags &= ~RDDIR;
8993         }
8994 
8995         ASSERT(!(rdc->flags & RDDIR));
8996 
8997         /*
8998          * If an error occurred while attempting
8999          * to fill the cache entry, mark the entry invalid and
9000          * just return the error.
9001          */
9002         if (rdc->error) {
9003                 error = rdc->error;
9004                 rdc->flags |= RDDIRREQ;
9005                 rddir4_cache_rele(rp, rdc);
9006                 mutex_exit(&rp->r_statelock);
9007                 return (error);
9008         }
9009 
9010         /*
9011          * The cache entry is complete and good,
9012          * copyout the dirent structs to the calling
9013          * thread.
9014          */
9015         error = uiomove(rdc->entries, rdc->actlen, UIO_READ, uiop);
9016 
9017         /*
9018          * If no error occurred during the copyout,
9019          * update the offset in the uio struct to
9020          * contain the value of the next NFS 4 cookie
9021          * and set the eof value appropriately.
9022          */
9023         if (!error) {
9024                 uiop->uio_loffset = rdc->nfs4_ncookie;
9025                 if (eofp)
9026                         *eofp = rdc->eof;
9027         }
9028 
9029         /*
9030          * Decide whether to do readahead.  Don't if we
9031          * have already read to the end of directory.
9032          */
9033         if (rdc->eof) {
9034                 /*
9035                  * Make the entry the direof only if it is cached
9036                  */
9037                 if (rdc->flags & RDDIRCACHED)
9038                         rp->r_direof = rdc;
9039                 rddir4_cache_rele(rp, rdc);
9040                 mutex_exit(&rp->r_statelock);
9041                 return (error);
9042         }
9043 
9044         /* Determine if a readdir readahead should be done */
9045         if (!(rp->r_flags & R4LOOKUP)) {
9046                 rddir4_cache_rele(rp, rdc);
9047                 mutex_exit(&rp->r_statelock);
9048                 return (error);
9049         }
9050 
9051         /*
9052          * Now look for a readahead entry.
9053          *
9054          * Check to see whether we found an entry for the readahead.
9055          * If so, we don't need to do anything further, so free the new
9056          * entry if one was allocated.  Otherwise, allocate a new entry, add
9057          * it to the cache, and then initiate an asynchronous readdir
9058          * operation to fill it.
9059          */
9060         rrdc = rddir4_cache_lookup(rp, rdc->nfs4_ncookie, count);
9061 
9062         /*
9063          * A readdir cache entry could not be obtained for the readahead.  In
9064          * this case we skip the readahead and return.
9065          */
9066         if (rrdc == NULL) {
9067                 rddir4_cache_rele(rp, rdc);
9068                 mutex_exit(&rp->r_statelock);
9069                 return (error);
9070         }
9071 
9072         /*
9073          * Check to see if we need to fill this entry in.
9074          */
9075         if (rrdc->flags & RDDIRREQ) {
9076                 rrdc->flags &= ~RDDIRREQ;
9077                 rrdc->flags |= RDDIR;
9078                 rddir4_cache_rele(rp, rdc);
9079                 mutex_exit(&rp->r_statelock);
9080 #ifdef DEBUG
9081                 nfs4_readdir_readahead++;
9082 #endif
9083                 /*
9084                  * Do the readdir.
9085                  */
9086                 nfs4_async_readdir(vp, rrdc, cr, do_nfs4readdir);
9087                 return (error);
9088         }
9089 
9090         rddir4_cache_rele(rp, rrdc);
9091         rddir4_cache_rele(rp, rdc);
9092         mutex_exit(&rp->r_statelock);
9093         return (error);
9094 }
9095 
9096 static int
9097 do_nfs4readdir(vnode_t *vp, rddir4_cache *rdc, cred_t *cr)
9098 {
9099         int error;
9100         rnode4_t *rp;
9101 
9102         ASSERT(nfs_zone() == VTOMI4(vp)->mi_zone);
9103 
9104         rp = VTOR4(vp);
9105 
9106         /*
9107          * Obtain the readdir results for the caller.
9108          */
9109         nfs4readdir(vp, rdc, cr);
9110 
9111         mutex_enter(&rp->r_statelock);
9112         /*
9113          * The entry is now complete
9114          */
9115         rdc->flags &= ~RDDIR;
9116 
9117         error = rdc->error;
9118         if (error)
9119                 rdc->flags |= RDDIRREQ;
9120         rddir4_cache_rele(rp, rdc);
9121         mutex_exit(&rp->r_statelock);
9122 
9123         return (error);
9124 }
9125 
9126 /*
9127  * Read directory entries.
9128  * There are some weird things to look out for here.  The uio_loffset
9129  * field is either 0 or it is the offset returned from a previous
9130  * readdir.  It is an opaque value used by the server to find the
9131  * correct directory block to read. The count field is the number
9132  * of blocks to read on the server.  This is advisory only, the server
9133  * may return only one block's worth of entries.  Entries may be compressed
9134  * on the server.
9135  *
9136  * Generates the following compound request:
9137  * 1. If readdir offset is zero and no dnlc entry for parent exists,
9138  *    must include a Lookupp as well. In this case, send:
9139  *    { Putfh <fh>; Readdir; Lookupp; Getfh; Getattr }
9140  * 2. Otherwise just do: { Putfh <fh>; Readdir }
9141  *
9142  * Get complete attributes and filehandles for entries if this is the
9143  * first read of the directory. Otherwise, just get fileid's.
9144  */
9145 static void
9146 nfs4readdir(vnode_t *vp, rddir4_cache *rdc, cred_t *cr)
9147 {
9148         COMPOUND4args_clnt args;
9149         COMPOUND4res_clnt res;
9150         READDIR4args *rargs;
9151         READDIR4res_clnt *rd_res;
9152         bitmap4 rd_bitsval;
9153         nfs_argop4 argop[5];
9154         nfs_resop4 *resop;
9155         rnode4_t *rp = VTOR4(vp);
9156         mntinfo4_t *mi = VTOMI4(vp);
9157         int doqueue;
9158         u_longlong_t nodeid, pnodeid;   /* id's of dir and its parents */
9159         vnode_t *dvp;
9160         nfs_cookie4 cookie = (nfs_cookie4)rdc->nfs4_cookie;
9161         int num_ops, res_opcnt;
9162         bool_t needrecov = FALSE;
9163         nfs4_recov_state_t recov_state;
9164         hrtime_t t;
9165         nfs4_error_t e = { 0, NFS4_OK, RPC_SUCCESS };
9166 
9167         ASSERT(nfs_zone() == mi->mi_zone);
9168         ASSERT(rdc->flags & RDDIR);
9169         ASSERT(rdc->entries == NULL);
9170 
9171         /*
9172          * If rp were a stub, it should have triggered and caused
9173          * a mount for us to get this far.
9174          */
9175         ASSERT(!RP_ISSTUB(rp));
9176 
9177         num_ops = 2;
9178         if (cookie == (nfs_cookie4)0 || cookie == (nfs_cookie4)1) {
9179                 /*
9180                  * Since nfsv4 readdir may not return entries for "." and "..",
9181                  * the client must recreate them:
9182                  * To find the correct nodeid, do the following:
9183                  * For current node, get nodeid from dnlc.
9184                  * - if current node is rootvp, set pnodeid to nodeid.
9185                  * - else if parent is in the dnlc, get its nodeid from there.
9186                  * - else add LOOKUPP+GETATTR to compound.
9187                  */
9188                 nodeid = rp->r_attr.va_nodeid;
9189                 if (vp->v_flag & VROOT) {
9190                         pnodeid = nodeid;       /* root of mount point */
9191                 } else {
9192                         dvp = dnlc_lookup(vp, "..");
9193                         if (dvp != NULL && dvp != DNLC_NO_VNODE) {
9194                                 /* parent in dnlc cache - no need for otw */
9195                                 pnodeid = VTOR4(dvp)->r_attr.va_nodeid;
9196                         } else {
9197                                 /*
9198                                  * parent not in dnlc cache,
9199                                  * do lookupp to get its id
9200                                  */
9201                                 num_ops = 5;
9202                                 pnodeid = 0; /* set later by getattr parent */
9203                         }
9204                         if (dvp)
9205                                 VN_RELE(dvp);
9206                 }
9207         }
9208         recov_state.rs_flags = 0;
9209         recov_state.rs_num_retry_despite_err = 0;
9210 
9211         /* Save the original mount point security flavor */
9212         (void) save_mnt_secinfo(mi->mi_curr_serv);
9213 
9214 recov_retry:
9215         args.ctag = TAG_READDIR;
9216 
9217         args.array = argop;
9218         args.array_len = num_ops;
9219 
9220         if (e.error = nfs4_start_fop(VTOMI4(vp), vp, NULL, OH_READDIR,
9221             &recov_state, NULL)) {
9222                 /*
9223                  * If readdir a node that is a stub for a crossed mount point,
9224                  * keep the original secinfo flavor for the current file
9225                  * system, not the crossed one.
9226                  */
9227                 (void) check_mnt_secinfo(mi->mi_curr_serv, vp);
9228                 rdc->error = e.error;
9229                 return;
9230         }
9231 
9232         /*
9233          * Determine which attrs to request for dirents.  This code
9234          * must be protected by nfs4_start/end_fop because of r_server
9235          * (which will change during failover recovery).
9236          *
9237          */
9238         if (rp->r_flags & (R4LOOKUP | R4READDIRWATTR)) {
9239                 /*
9240                  * Get all vattr attrs plus filehandle and rdattr_error
9241                  */
9242                 rd_bitsval = NFS4_VATTR_MASK |
9243                     FATTR4_RDATTR_ERROR_MASK |
9244                     FATTR4_FILEHANDLE_MASK;
9245 
9246                 if (rp->r_flags & R4READDIRWATTR) {
9247                         mutex_enter(&rp->r_statelock);
9248                         rp->r_flags &= ~R4READDIRWATTR;
9249                         mutex_exit(&rp->r_statelock);
9250                 }
9251         } else {
9252                 servinfo4_t *svp = rp->r_server;
9253 
9254                 /*
9255                  * Already read directory. Use readdir with
9256                  * no attrs (except for mounted_on_fileid) for updates.
9257                  */
9258                 rd_bitsval = FATTR4_RDATTR_ERROR_MASK;
9259 
9260                 /*
9261                  * request mounted on fileid if supported, else request
9262                  * fileid.  maybe we should verify that fileid is supported
9263                  * and request something else if not.
9264                  */
9265                 (void) nfs_rw_enter_sig(&svp->sv_lock, RW_READER, 0);
9266                 if (svp->sv_supp_attrs & FATTR4_MOUNTED_ON_FILEID_MASK)
9267                         rd_bitsval |= FATTR4_MOUNTED_ON_FILEID_MASK;
9268                 nfs_rw_exit(&svp->sv_lock);
9269         }
9270 
9271         /* putfh directory fh */
9272         argop[0].argop = OP_CPUTFH;
9273         argop[0].nfs_argop4_u.opcputfh.sfh = rp->r_fh;
9274 
9275         argop[1].argop = OP_READDIR;
9276         rargs = &argop[1].nfs_argop4_u.opreaddir;
9277         /*
9278          * 1 and 2 are reserved for client "." and ".." entry offset.
9279          * cookie 0 should be used over-the-wire to start reading at
9280          * the beginning of the directory excluding "." and "..".
9281          */
9282         if (rdc->nfs4_cookie == 0 ||
9283             rdc->nfs4_cookie == 1 ||
9284             rdc->nfs4_cookie == 2) {
9285                 rargs->cookie = (nfs_cookie4)0;
9286                 rargs->cookieverf = 0;
9287         } else {
9288                 rargs->cookie = (nfs_cookie4)rdc->nfs4_cookie;
9289                 mutex_enter(&rp->r_statelock);
9290                 rargs->cookieverf = rp->r_cookieverf4;
9291                 mutex_exit(&rp->r_statelock);
9292         }
9293         rargs->dircount = MIN(rdc->buflen, mi->mi_tsize);
9294         rargs->maxcount = mi->mi_tsize;
9295         rargs->attr_request = rd_bitsval;
9296         rargs->rdc = rdc;
9297         rargs->dvp = vp;
9298         rargs->mi = mi;
9299         rargs->cr = cr;
9300 
9301 
9302         /*
9303          * If count < than the minimum required, we return no entries
9304          * and fail with EINVAL
9305          */
9306         if (rargs->dircount < (DIRENT64_RECLEN(1) + DIRENT64_RECLEN(2))) {
9307                 rdc->error = EINVAL;
9308                 goto out;
9309         }
9310 
9311         if (args.array_len == 5) {
9312                 /*
9313                  * Add lookupp and getattr for parent nodeid.
9314                  */
9315                 argop[2].argop = OP_LOOKUPP;
9316 
9317                 argop[3].argop = OP_GETFH;
9318 
9319                 /* getattr parent */
9320                 argop[4].argop = OP_GETATTR;
9321                 argop[4].nfs_argop4_u.opgetattr.attr_request = NFS4_VATTR_MASK;
9322                 argop[4].nfs_argop4_u.opgetattr.mi = mi;
9323         }
9324 
9325         doqueue = 1;
9326 
9327         if (mi->mi_io_kstats) {
9328                 mutex_enter(&mi->mi_lock);
9329                 kstat_runq_enter(KSTAT_IO_PTR(mi->mi_io_kstats));
9330                 mutex_exit(&mi->mi_lock);
9331         }
9332 
9333         /* capture the time of this call */
9334         rargs->t = t = gethrtime();
9335 
9336         rfs4call(mi, &args, &res, cr, &doqueue, 0, &e);
9337 
9338         if (mi->mi_io_kstats) {
9339                 mutex_enter(&mi->mi_lock);
9340                 kstat_runq_exit(KSTAT_IO_PTR(mi->mi_io_kstats));
9341                 mutex_exit(&mi->mi_lock);
9342         }
9343 
9344         needrecov = nfs4_needs_recovery(&e, FALSE, mi->mi_vfsp);
9345 
9346         /*
9347          * If RPC error occurred and it isn't an error that
9348          * triggers recovery, then go ahead and fail now.
9349          */
9350         if (e.error != 0 && !needrecov) {
9351                 rdc->error = e.error;
9352                 goto out;
9353         }
9354 
9355         if (needrecov) {
9356                 bool_t abort;
9357 
9358                 NFS4_DEBUG(nfs4_client_recov_debug, (CE_NOTE,
9359                     "nfs4readdir: initiating recovery.\n"));
9360 
9361                 abort = nfs4_start_recovery(&e, VTOMI4(vp), vp, NULL, NULL,
9362                     NULL, OP_READDIR, NULL, NULL, NULL);
9363                 if (abort == FALSE) {
9364                         nfs4_end_fop(VTOMI4(vp), vp, NULL, OH_READDIR,
9365                             &recov_state, needrecov);
9366                         if (!e.error)
9367                                 (void) xdr_free(xdr_COMPOUND4res_clnt,
9368                                     (caddr_t)&res);
9369                         if (rdc->entries != NULL) {
9370                                 kmem_free(rdc->entries, rdc->entlen);
9371                                 rdc->entries = NULL;
9372                         }
9373                         goto recov_retry;
9374                 }
9375 
9376                 if (e.error != 0) {
9377                         rdc->error = e.error;
9378                         goto out;
9379                 }
9380 
9381                 /* fall through for res.status case */
9382         }
9383 
9384         res_opcnt = res.array_len;
9385 
9386         /*
9387          * If compound failed first 2 ops (PUTFH+READDIR), then return
9388          * failure here.  Subsequent ops are for filling out dot-dot
9389          * dirent, and if they fail, we still want to give the caller
9390          * the dirents returned by (the successful) READDIR op, so we need
9391          * to silently ignore failure for subsequent ops (LOOKUPP+GETATTR).
9392          *
9393          * One example where PUTFH+READDIR ops would succeed but
9394          * LOOKUPP+GETATTR would fail would be a dir that has r perm
9395          * but lacks x.  In this case, a POSIX server's VOP_READDIR
9396          * would succeed; however, VOP_LOOKUP(..) would fail since no
9397          * x perm.  We need to come up with a non-vendor-specific way
9398          * for a POSIX server to return d_ino from dotdot's dirent if
9399          * client only requests mounted_on_fileid, and just say the
9400          * LOOKUPP succeeded and fill out the GETATTR.  However, if
9401          * client requested any mandatory attrs, server would be required
9402          * to fail the GETATTR op because it can't call VOP_LOOKUP+VOP_GETATTR
9403          * for dotdot.
9404          */
9405 
9406         if (res.status) {
9407                 if (res_opcnt <= 2) {
9408                         e.error = geterrno4(res.status);
9409                         nfs4_end_fop(VTOMI4(vp), vp, NULL, OH_READDIR,
9410                             &recov_state, needrecov);
9411                         nfs4_purge_stale_fh(e.error, vp, cr);
9412                         rdc->error = e.error;
9413                         (void) xdr_free(xdr_COMPOUND4res_clnt, (caddr_t)&res);
9414                         if (rdc->entries != NULL) {
9415                                 kmem_free(rdc->entries, rdc->entlen);
9416                                 rdc->entries = NULL;
9417                         }
9418                         /*
9419                          * If readdir a node that is a stub for a
9420                          * crossed mount point, keep the original
9421                          * secinfo flavor for the current file system,
9422                          * not the crossed one.
9423                          */
9424                         (void) check_mnt_secinfo(mi->mi_curr_serv, vp);
9425                         return;
9426                 }
9427         }
9428 
9429         resop = &res.array[1];      /* readdir res */
9430         rd_res = &resop->nfs_resop4_u.opreaddirclnt;
9431 
9432         mutex_enter(&rp->r_statelock);
9433         rp->r_cookieverf4 = rd_res->cookieverf;
9434         mutex_exit(&rp->r_statelock);
9435 
9436         /*
9437          * For "." and ".." entries
9438          * e.g.
9439          *      seek(cookie=0) -> "." entry with d_off = 1
9440          *      seek(cookie=1) -> ".." entry with d_off = 2
9441          */
9442         if (cookie == (nfs_cookie4) 0) {
9443                 if (rd_res->dotp)
9444                         rd_res->dotp->d_ino = nodeid;
9445                 if (rd_res->dotdotp)
9446                         rd_res->dotdotp->d_ino = pnodeid;
9447         }
9448         if (cookie == (nfs_cookie4) 1) {
9449                 if (rd_res->dotdotp)
9450                         rd_res->dotdotp->d_ino = pnodeid;
9451         }
9452 
9453 
9454         /* LOOKUPP+GETATTR attemped */
9455         if (args.array_len == 5 && rd_res->dotdotp) {
9456                 if (res.status == NFS4_OK && res_opcnt == 5) {
9457                         nfs_fh4 *fhp;
9458                         nfs4_sharedfh_t *sfhp;
9459                         vnode_t *pvp;
9460                         nfs4_ga_res_t *garp;
9461 
9462                         resop++;        /* lookupp */
9463                         resop++;        /* getfh   */
9464                         fhp = &resop->nfs_resop4_u.opgetfh.object;
9465 
9466                         resop++;        /* getattr of parent */
9467 
9468                         /*
9469                          * First, take care of finishing the
9470                          * readdir results.
9471                          */
9472                         garp = &resop->nfs_resop4_u.opgetattr.ga_res;
9473                         /*
9474                          * The d_ino of .. must be the inode number
9475                          * of the mounted filesystem.
9476                          */
9477                         if (garp->n4g_va.va_mask & AT_NODEID)
9478                                 rd_res->dotdotp->d_ino =
9479                                     garp->n4g_va.va_nodeid;
9480 
9481 
9482                         /*
9483                          * Next, create the ".." dnlc entry
9484                          */
9485                         sfhp = sfh4_get(fhp, mi);
9486                         if (!nfs4_make_dotdot(sfhp, t, vp, cr, &pvp, 0)) {
9487                                 dnlc_update(vp, "..", pvp);
9488                                 VN_RELE(pvp);
9489                         }
9490                         sfh4_rele(&sfhp);
9491                 }
9492         }
9493 
9494         if (mi->mi_io_kstats) {
9495                 mutex_enter(&mi->mi_lock);
9496                 KSTAT_IO_PTR(mi->mi_io_kstats)->reads++;
9497                 KSTAT_IO_PTR(mi->mi_io_kstats)->nread += rdc->actlen;
9498                 mutex_exit(&mi->mi_lock);
9499         }
9500 
9501         (void) xdr_free(xdr_COMPOUND4res_clnt, (caddr_t)&res);
9502 
9503 out:
9504         /*
9505          * If readdir a node that is a stub for a crossed mount point,
9506          * keep the original secinfo flavor for the current file system,
9507          * not the crossed one.
9508          */
9509         (void) check_mnt_secinfo(mi->mi_curr_serv, vp);
9510 
9511         nfs4_end_fop(mi, vp, NULL, OH_READDIR, &recov_state, needrecov);
9512 }
9513 
9514 
9515 static int
9516 nfs4_bio(struct buf *bp, stable_how4 *stab_comm, cred_t *cr, bool_t readahead)
9517 {
9518         rnode4_t *rp = VTOR4(bp->b_vp);
9519         int count;
9520         int error;
9521         cred_t *cred_otw = NULL;
9522         offset_t offset;
9523         nfs4_open_stream_t *osp = NULL;
9524         bool_t first_time = TRUE;       /* first time getting otw cred */
9525         bool_t last_time = FALSE;       /* last time getting otw cred */
9526 
9527         ASSERT(nfs_zone() == VTOMI4(bp->b_vp)->mi_zone);
9528 
9529         DTRACE_IO1(start, struct buf *, bp);
9530         offset = ldbtob(bp->b_lblkno);
9531 
9532         if (bp->b_flags & B_READ) {
9533         read_again:
9534                 /*
9535                  * Releases the osp, if it is provided.
9536                  * Puts a hold on the cred_otw and the new osp (if found).
9537                  */
9538                 cred_otw = nfs4_get_otw_cred_by_osp(rp, cr, &osp,
9539                     &first_time, &last_time);
9540                 error = bp->b_error = nfs4read(bp->b_vp, bp->b_un.b_addr,
9541                     offset, bp->b_bcount, &bp->b_resid, cred_otw,
9542                     readahead, NULL);
9543                 crfree(cred_otw);
9544                 if (!error) {
9545                         if (bp->b_resid) {
9546                                 /*
9547                                  * Didn't get it all because we hit EOF,
9548                                  * zero all the memory beyond the EOF.
9549                                  */
9550                                 /* bzero(rdaddr + */
9551                                 bzero(bp->b_un.b_addr +
9552                                     bp->b_bcount - bp->b_resid, bp->b_resid);
9553                         }
9554                         mutex_enter(&rp->r_statelock);
9555                         if (bp->b_resid == bp->b_bcount &&
9556                             offset >= rp->r_size) {
9557                                 /*
9558                                  * We didn't read anything at all as we are
9559                                  * past EOF.  Return an error indicator back
9560                                  * but don't destroy the pages (yet).
9561                                  */
9562                                 error = NFS_EOF;
9563                         }
9564                         mutex_exit(&rp->r_statelock);
9565                 } else if (error == EACCES && last_time == FALSE) {
9566                                 goto read_again;
9567                 }
9568         } else {
9569                 if (!(rp->r_flags & R4STALE)) {
9570 write_again:
9571                         /*
9572                          * Releases the osp, if it is provided.
9573                          * Puts a hold on the cred_otw and the new
9574                          * osp (if found).
9575                          */
9576                         cred_otw = nfs4_get_otw_cred_by_osp(rp, cr, &osp,
9577                             &first_time, &last_time);
9578                         mutex_enter(&rp->r_statelock);
9579                         count = MIN(bp->b_bcount, rp->r_size - offset);
9580                         mutex_exit(&rp->r_statelock);
9581                         if (count < 0)
9582                                 cmn_err(CE_PANIC, "nfs4_bio: write count < 0");
9583 #ifdef DEBUG
9584                         if (count == 0) {
9585                                 zoneid_t zoneid = getzoneid();
9586 
9587                                 zcmn_err(zoneid, CE_WARN,
9588                                     "nfs4_bio: zero length write at %lld",
9589                                     offset);
9590                                 zcmn_err(zoneid, CE_CONT, "flags=0x%x, "
9591                                     "b_bcount=%ld, file size=%lld",
9592                                     rp->r_flags, (long)bp->b_bcount,
9593                                     rp->r_size);
9594                                 sfh4_printfhandle(VTOR4(bp->b_vp)->r_fh);
9595                                 if (nfs4_bio_do_stop)
9596                                         debug_enter("nfs4_bio");
9597                         }
9598 #endif
9599                         error = nfs4write(bp->b_vp, bp->b_un.b_addr, offset,
9600                             count, cred_otw, stab_comm);
9601                         if (error == EACCES && last_time == FALSE) {
9602                                 crfree(cred_otw);
9603                                 goto write_again;
9604                         }
9605                         bp->b_error = error;
9606                         if (error && error != EINTR &&
9607                             !(bp->b_vp->v_vfsp->vfs_flag & VFS_UNMOUNTED)) {
9608                                 /*
9609                                  * Don't print EDQUOT errors on the console.
9610                                  * Don't print asynchronous EACCES errors.
9611                                  * Don't print EFBIG errors.
9612                                  * Print all other write errors.
9613                                  */
9614                                 if (error != EDQUOT && error != EFBIG &&
9615                                     (error != EACCES ||
9616                                     !(bp->b_flags & B_ASYNC)))
9617                                         nfs4_write_error(bp->b_vp,
9618                                             error, cred_otw);
9619                                 /*
9620                                  * Update r_error and r_flags as appropriate.
9621                                  * If the error was ESTALE, then mark the
9622                                  * rnode as not being writeable and save
9623                                  * the error status.  Otherwise, save any
9624                                  * errors which occur from asynchronous
9625                                  * page invalidations.  Any errors occurring
9626                                  * from other operations should be saved
9627                                  * by the caller.
9628                                  */
9629                                 mutex_enter(&rp->r_statelock);
9630                                 if (error == ESTALE) {
9631                                         rp->r_flags |= R4STALE;
9632                                         if (!rp->r_error)
9633                                                 rp->r_error = error;
9634                                 } else if (!rp->r_error &&
9635                                     (bp->b_flags &
9636                                     (B_INVAL|B_FORCE|B_ASYNC)) ==
9637                                     (B_INVAL|B_FORCE|B_ASYNC)) {
9638                                         rp->r_error = error;
9639                                 }
9640                                 mutex_exit(&rp->r_statelock);
9641                         }
9642                         crfree(cred_otw);
9643                 } else {
9644                         error = rp->r_error;
9645                         /*
9646                          * A close may have cleared r_error, if so,
9647                          * propagate ESTALE error return properly
9648                          */
9649                         if (error == 0)
9650                                 error = ESTALE;
9651                 }
9652         }
9653 
9654         if (error != 0 && error != NFS_EOF)
9655                 bp->b_flags |= B_ERROR;
9656 
9657         if (osp)
9658                 open_stream_rele(osp, rp);
9659 
9660         DTRACE_IO1(done, struct buf *, bp);
9661 
9662         return (error);
9663 }
9664 
9665 /* ARGSUSED */
9666 int
9667 nfs4_fid(vnode_t *vp, fid_t *fidp, caller_context_t *ct)
9668 {
9669         return (EREMOTE);
9670 }
9671 
9672 /* ARGSUSED2 */
9673 int
9674 nfs4_rwlock(vnode_t *vp, int write_lock, caller_context_t *ctp)
9675 {
9676         rnode4_t *rp = VTOR4(vp);
9677 
9678         if (!write_lock) {
9679                 (void) nfs_rw_enter_sig(&rp->r_rwlock, RW_READER, FALSE);
9680                 return (V_WRITELOCK_FALSE);
9681         }
9682 
9683         if ((rp->r_flags & R4DIRECTIO) ||
9684             (VTOMI4(vp)->mi_flags & MI4_DIRECTIO)) {
9685                 (void) nfs_rw_enter_sig(&rp->r_rwlock, RW_READER, FALSE);
9686                 if (rp->r_mapcnt == 0 && !nfs4_has_pages(vp))
9687                         return (V_WRITELOCK_FALSE);
9688                 nfs_rw_exit(&rp->r_rwlock);
9689         }
9690 
9691         (void) nfs_rw_enter_sig(&rp->r_rwlock, RW_WRITER, FALSE);
9692         return (V_WRITELOCK_TRUE);
9693 }
9694 
9695 /* ARGSUSED */
9696 void
9697 nfs4_rwunlock(vnode_t *vp, int write_lock, caller_context_t *ctp)
9698 {
9699         rnode4_t *rp = VTOR4(vp);
9700 
9701         nfs_rw_exit(&rp->r_rwlock);
9702 }
9703 
9704 /* ARGSUSED */
9705 static int
9706 nfs4_seek(vnode_t *vp, offset_t ooff, offset_t *noffp, caller_context_t *ct)
9707 {
9708         if (nfs_zone() != VTOMI4(vp)->mi_zone)
9709                 return (EIO);
9710 
9711         /*
9712          * Because we stuff the readdir cookie into the offset field
9713          * someone may attempt to do an lseek with the cookie which
9714          * we want to succeed.
9715          */
9716         if (vp->v_type == VDIR)
9717                 return (0);
9718         if (*noffp < 0)
9719                 return (EINVAL);
9720         return (0);
9721 }
9722 
9723 
9724 /*
9725  * Return all the pages from [off..off+len) in file
9726  */
9727 /* ARGSUSED */
9728 static int
9729 nfs4_getpage(vnode_t *vp, offset_t off, size_t len, uint_t *protp,
9730     page_t *pl[], size_t plsz, struct seg *seg, caddr_t addr,
9731         enum seg_rw rw, cred_t *cr, caller_context_t *ct)
9732 {
9733         rnode4_t *rp;
9734         int error;
9735         mntinfo4_t *mi;
9736 
9737         if (nfs_zone() != VTOMI4(vp)->mi_zone)
9738                 return (EIO);
9739         rp = VTOR4(vp);
9740         if (IS_SHADOW(vp, rp))
9741                 vp = RTOV4(rp);
9742 
9743         if (vp->v_flag & VNOMAP)
9744                 return (ENOSYS);
9745 
9746         if (protp != NULL)
9747                 *protp = PROT_ALL;
9748 
9749         /*
9750          * Now validate that the caches are up to date.
9751          */
9752         if (error = nfs4_validate_caches(vp, cr))
9753                 return (error);
9754 
9755         mi = VTOMI4(vp);
9756 retry:
9757         mutex_enter(&rp->r_statelock);
9758 
9759         /*
9760          * Don't create dirty pages faster than they
9761          * can be cleaned so that the system doesn't
9762          * get imbalanced.  If the async queue is
9763          * maxed out, then wait for it to drain before
9764          * creating more dirty pages.  Also, wait for
9765          * any threads doing pagewalks in the vop_getattr
9766          * entry points so that they don't block for
9767          * long periods.
9768          */
9769         if (rw == S_CREATE) {
9770                 while ((mi->mi_max_threads != 0 &&
9771                     rp->r_awcount > 2 * mi->mi_max_threads) ||
9772                     rp->r_gcount > 0)
9773                         cv_wait(&rp->r_cv, &rp->r_statelock);
9774         }
9775 
9776         /*
9777          * If we are getting called as a side effect of an nfs_write()
9778          * operation the local file size might not be extended yet.
9779          * In this case we want to be able to return pages of zeroes.
9780          */
9781         if (off + len > rp->r_size + PAGEOFFSET && seg != segkmap) {
9782                 NFS4_DEBUG(nfs4_pageio_debug,
9783                     (CE_NOTE, "getpage beyond EOF: off=%lld, "
9784                     "len=%llu, size=%llu, attrsize =%llu", off,
9785                     (u_longlong_t)len, rp->r_size, rp->r_attr.va_size));
9786                 mutex_exit(&rp->r_statelock);
9787                 return (EFAULT);                /* beyond EOF */
9788         }
9789 
9790         mutex_exit(&rp->r_statelock);
9791 
9792         error = pvn_getpages(nfs4_getapage, vp, off, len, protp,
9793             pl, plsz, seg, addr, rw, cr);
9794         NFS4_DEBUG(nfs4_pageio_debug && error,
9795             (CE_NOTE, "getpages error %d; off=%lld, len=%lld",
9796             error, off, (u_longlong_t)len));
9797 
9798         switch (error) {
9799         case NFS_EOF:
9800                 nfs4_purge_caches(vp, NFS4_NOPURGE_DNLC, cr, FALSE);
9801                 goto retry;
9802         case ESTALE:
9803                 nfs4_purge_stale_fh(error, vp, cr);
9804         }
9805 
9806         return (error);
9807 }
9808 
9809 /*
9810  * Called from pvn_getpages to get a particular page.
9811  */
9812 /* ARGSUSED */
9813 static int
9814 nfs4_getapage(vnode_t *vp, u_offset_t off, size_t len, uint_t *protp,
9815     page_t *pl[], size_t plsz, struct seg *seg, caddr_t addr,
9816     enum seg_rw rw, cred_t *cr)
9817 {
9818         rnode4_t *rp;
9819         uint_t bsize;
9820         struct buf *bp;
9821         page_t *pp;
9822         u_offset_t lbn;
9823         u_offset_t io_off;
9824         u_offset_t blkoff;
9825         u_offset_t rablkoff;
9826         size_t io_len;
9827         uint_t blksize;
9828         int error;
9829         int readahead;
9830         int readahead_issued = 0;
9831         int ra_window; /* readahead window */
9832         page_t *pagefound;
9833         page_t *savepp;
9834 
9835         if (nfs_zone() != VTOMI4(vp)->mi_zone)
9836                 return (EIO);
9837 
9838         rp = VTOR4(vp);
9839         ASSERT(!IS_SHADOW(vp, rp));
9840         bsize = MAX(vp->v_vfsp->vfs_bsize, PAGESIZE);
9841 
9842 reread:
9843         bp = NULL;
9844         pp = NULL;
9845         pagefound = NULL;
9846 
9847         if (pl != NULL)
9848                 pl[0] = NULL;
9849 
9850         error = 0;
9851         lbn = off / bsize;
9852         blkoff = lbn * bsize;
9853 
9854         /*
9855          * Queueing up the readahead before doing the synchronous read
9856          * results in a significant increase in read throughput because
9857          * of the increased parallelism between the async threads and
9858          * the process context.
9859          */
9860         if ((off & ((vp->v_vfsp->vfs_bsize) - 1)) == 0 &&
9861             rw != S_CREATE &&
9862             !(vp->v_flag & VNOCACHE)) {
9863                 mutex_enter(&rp->r_statelock);
9864 
9865                 /*
9866                  * Calculate the number of readaheads to do.
9867                  * a) No readaheads at offset = 0.
9868                  * b) Do maximum(nfs4_nra) readaheads when the readahead
9869                  *    window is closed.
9870                  * c) Do readaheads between 1 to (nfs4_nra - 1) depending
9871                  *    upon how far the readahead window is open or close.
9872                  * d) No readaheads if rp->r_nextr is not within the scope
9873                  *    of the readahead window (random i/o).
9874                  */
9875 
9876                 if (off == 0)
9877                         readahead = 0;
9878                 else if (blkoff == rp->r_nextr)
9879                         readahead = nfs4_nra;
9880                 else if (rp->r_nextr > blkoff &&
9881                     ((ra_window = (rp->r_nextr - blkoff) / bsize)
9882                     <= (nfs4_nra - 1)))
9883                         readahead = nfs4_nra - ra_window;
9884                 else
9885                         readahead = 0;
9886 
9887                 rablkoff = rp->r_nextr;
9888                 while (readahead > 0 && rablkoff + bsize < rp->r_size) {
9889                         mutex_exit(&rp->r_statelock);
9890                         if (nfs4_async_readahead(vp, rablkoff + bsize,
9891                             addr + (rablkoff + bsize - off),
9892                             seg, cr, nfs4_readahead) < 0) {
9893                                 mutex_enter(&rp->r_statelock);
9894                                 break;
9895                         }
9896                         readahead--;
9897                         rablkoff += bsize;
9898                         /*
9899                          * Indicate that we did a readahead so
9900                          * readahead offset is not updated
9901                          * by the synchronous read below.
9902                          */
9903                         readahead_issued = 1;
9904                         mutex_enter(&rp->r_statelock);
9905                         /*
9906                          * set readahead offset to
9907                          * offset of last async readahead
9908                          * request.
9909                          */
9910                         rp->r_nextr = rablkoff;
9911                 }
9912                 mutex_exit(&rp->r_statelock);
9913         }
9914 
9915 again:
9916         if ((pagefound = page_exists(vp, off)) == NULL) {
9917                 if (pl == NULL) {
9918                         (void) nfs4_async_readahead(vp, blkoff, addr, seg, cr,
9919                             nfs4_readahead);
9920                 } else if (rw == S_CREATE) {
9921                         /*
9922                          * Block for this page is not allocated, or the offset
9923                          * is beyond the current allocation size, or we're
9924                          * allocating a swap slot and the page was not found,
9925                          * so allocate it and return a zero page.
9926                          */
9927                         if ((pp = page_create_va(vp, off,
9928                             PAGESIZE, PG_WAIT, seg, addr)) == NULL)
9929                                 cmn_err(CE_PANIC, "nfs4_getapage: page_create");
9930                         io_len = PAGESIZE;
9931                         mutex_enter(&rp->r_statelock);
9932                         rp->r_nextr = off + PAGESIZE;
9933                         mutex_exit(&rp->r_statelock);
9934                 } else {
9935                         /*
9936                          * Need to go to server to get a block
9937                          */
9938                         mutex_enter(&rp->r_statelock);
9939                         if (blkoff < rp->r_size &&
9940                             blkoff + bsize > rp->r_size) {
9941                                 /*
9942                                  * If less than a block left in
9943                                  * file read less than a block.
9944                                  */
9945                                 if (rp->r_size <= off) {
9946                                         /*
9947                                          * Trying to access beyond EOF,
9948                                          * set up to get at least one page.
9949                                          */
9950                                         blksize = off + PAGESIZE - blkoff;
9951                                 } else
9952                                         blksize = rp->r_size - blkoff;
9953                         } else if ((off == 0) ||
9954                             (off != rp->r_nextr && !readahead_issued)) {
9955                                 blksize = PAGESIZE;
9956                                 blkoff = off; /* block = page here */
9957                         } else
9958                                 blksize = bsize;
9959                         mutex_exit(&rp->r_statelock);
9960 
9961                         pp = pvn_read_kluster(vp, off, seg, addr, &io_off,
9962                             &io_len, blkoff, blksize, 0);
9963 
9964                         /*
9965                          * Some other thread has entered the page,
9966                          * so just use it.
9967                          */
9968                         if (pp == NULL)
9969                                 goto again;
9970 
9971                         /*
9972                          * Now round the request size up to page boundaries.
9973                          * This ensures that the entire page will be
9974                          * initialized to zeroes if EOF is encountered.
9975                          */
9976                         io_len = ptob(btopr(io_len));
9977 
9978                         bp = pageio_setup(pp, io_len, vp, B_READ);
9979                         ASSERT(bp != NULL);
9980 
9981                         /*
9982                          * pageio_setup should have set b_addr to 0.  This
9983                          * is correct since we want to do I/O on a page
9984                          * boundary.  bp_mapin will use this addr to calculate
9985                          * an offset, and then set b_addr to the kernel virtual
9986                          * address it allocated for us.
9987                          */
9988                         ASSERT(bp->b_un.b_addr == 0);
9989 
9990                         bp->b_edev = 0;
9991                         bp->b_dev = 0;
9992                         bp->b_lblkno = lbtodb(io_off);
9993                         bp->b_file = vp;
9994                         bp->b_offset = (offset_t)off;
9995                         bp_mapin(bp);
9996 
9997                         /*
9998                          * If doing a write beyond what we believe is EOF,
9999                          * don't bother trying to read the pages from the
10000                          * server, we'll just zero the pages here.  We
10001                          * don't check that the rw flag is S_WRITE here
10002                          * because some implementations may attempt a
10003                          * read access to the buffer before copying data.
10004                          */
10005                         mutex_enter(&rp->r_statelock);
10006                         if (io_off >= rp->r_size && seg == segkmap) {
10007                                 mutex_exit(&rp->r_statelock);
10008                                 bzero(bp->b_un.b_addr, io_len);
10009                         } else {
10010                                 mutex_exit(&rp->r_statelock);
10011                                 error = nfs4_bio(bp, NULL, cr, FALSE);
10012                         }
10013 
10014                         /*
10015                          * Unmap the buffer before freeing it.
10016                          */
10017                         bp_mapout(bp);
10018                         pageio_done(bp);
10019 
10020                         savepp = pp;
10021                         do {
10022                                 pp->p_fsdata = C_NOCOMMIT;
10023                         } while ((pp = pp->p_next) != savepp);
10024 
10025                         if (error == NFS_EOF) {
10026                                 /*
10027                                  * If doing a write system call just return
10028                                  * zeroed pages, else user tried to get pages
10029                                  * beyond EOF, return error.  We don't check
10030                                  * that the rw flag is S_WRITE here because
10031                                  * some implementations may attempt a read
10032                                  * access to the buffer before copying data.
10033                                  */
10034                                 if (seg == segkmap)
10035                                         error = 0;
10036                                 else
10037                                         error = EFAULT;
10038                         }
10039 
10040                         if (!readahead_issued && !error) {
10041                                 mutex_enter(&rp->r_statelock);
10042                                 rp->r_nextr = io_off + io_len;
10043                                 mutex_exit(&rp->r_statelock);
10044                         }
10045                 }
10046         }
10047 
10048 out:
10049         if (pl == NULL)
10050                 return (error);
10051 
10052         if (error) {
10053                 if (pp != NULL)
10054                         pvn_read_done(pp, B_ERROR);
10055                 return (error);
10056         }
10057 
10058         if (pagefound) {
10059                 se_t se = (rw == S_CREATE ? SE_EXCL : SE_SHARED);
10060 
10061                 /*
10062                  * Page exists in the cache, acquire the appropriate lock.
10063                  * If this fails, start all over again.
10064                  */
10065                 if ((pp = page_lookup(vp, off, se)) == NULL) {
10066 #ifdef DEBUG
10067                         nfs4_lostpage++;
10068 #endif
10069                         goto reread;
10070                 }
10071                 pl[0] = pp;
10072                 pl[1] = NULL;
10073                 return (0);
10074         }
10075 
10076         if (pp != NULL)
10077                 pvn_plist_init(pp, pl, plsz, off, io_len, rw);
10078 
10079         return (error);
10080 }
10081 
10082 static void
10083 nfs4_readahead(vnode_t *vp, u_offset_t blkoff, caddr_t addr, struct seg *seg,
10084     cred_t *cr)
10085 {
10086         int error;
10087         page_t *pp;
10088         u_offset_t io_off;
10089         size_t io_len;
10090         struct buf *bp;
10091         uint_t bsize, blksize;
10092         rnode4_t *rp = VTOR4(vp);
10093         page_t *savepp;
10094 
10095         ASSERT(nfs_zone() == VTOMI4(vp)->mi_zone);
10096 
10097         bsize = MAX(vp->v_vfsp->vfs_bsize, PAGESIZE);
10098 
10099         mutex_enter(&rp->r_statelock);
10100         if (blkoff < rp->r_size && blkoff + bsize > rp->r_size) {
10101                 /*
10102                  * If less than a block left in file read less
10103                  * than a block.
10104                  */
10105                 blksize = rp->r_size - blkoff;
10106         } else
10107                 blksize = bsize;
10108         mutex_exit(&rp->r_statelock);
10109 
10110         pp = pvn_read_kluster(vp, blkoff, segkmap, addr,
10111             &io_off, &io_len, blkoff, blksize, 1);
10112         /*
10113          * The isra flag passed to the kluster function is 1, we may have
10114          * gotten a return value of NULL for a variety of reasons (# of free
10115          * pages < minfree, someone entered the page on the vnode etc). In all
10116          * cases, we want to punt on the readahead.
10117          */
10118         if (pp == NULL)
10119                 return;
10120 
10121         /*
10122          * Now round the request size up to page boundaries.
10123          * This ensures that the entire page will be
10124          * initialized to zeroes if EOF is encountered.
10125          */
10126         io_len = ptob(btopr(io_len));
10127 
10128         bp = pageio_setup(pp, io_len, vp, B_READ);
10129         ASSERT(bp != NULL);
10130 
10131         /*
10132          * pageio_setup should have set b_addr to 0.  This is correct since
10133          * we want to do I/O on a page boundary. bp_mapin() will use this addr
10134          * to calculate an offset, and then set b_addr to the kernel virtual
10135          * address it allocated for us.
10136          */
10137         ASSERT(bp->b_un.b_addr == 0);
10138 
10139         bp->b_edev = 0;
10140         bp->b_dev = 0;
10141         bp->b_lblkno = lbtodb(io_off);
10142         bp->b_file = vp;
10143         bp->b_offset = (offset_t)blkoff;
10144         bp_mapin(bp);
10145 
10146         /*
10147          * If doing a write beyond what we believe is EOF, don't bother trying
10148          * to read the pages from the server, we'll just zero the pages here.
10149          * We don't check that the rw flag is S_WRITE here because some
10150          * implementations may attempt a read access to the buffer before
10151          * copying data.
10152          */
10153         mutex_enter(&rp->r_statelock);
10154         if (io_off >= rp->r_size && seg == segkmap) {
10155                 mutex_exit(&rp->r_statelock);
10156                 bzero(bp->b_un.b_addr, io_len);
10157                 error = 0;
10158         } else {
10159                 mutex_exit(&rp->r_statelock);
10160                 error = nfs4_bio(bp, NULL, cr, TRUE);
10161                 if (error == NFS_EOF)
10162                         error = 0;
10163         }
10164 
10165         /*
10166          * Unmap the buffer before freeing it.
10167          */
10168         bp_mapout(bp);
10169         pageio_done(bp);
10170 
10171         savepp = pp;
10172         do {
10173                 pp->p_fsdata = C_NOCOMMIT;
10174         } while ((pp = pp->p_next) != savepp);
10175 
10176         pvn_read_done(pp, error ? B_READ | B_ERROR : B_READ);
10177 
10178         /*
10179          * In case of error set readahead offset
10180          * to the lowest offset.
10181          * pvn_read_done() calls VN_DISPOSE to destroy the pages
10182          */
10183         if (error && rp->r_nextr > io_off) {
10184                 mutex_enter(&rp->r_statelock);
10185                 if (rp->r_nextr > io_off)
10186                         rp->r_nextr = io_off;
10187                 mutex_exit(&rp->r_statelock);
10188         }
10189 }
10190 
10191 /*
10192  * Flags are composed of {B_INVAL, B_FREE, B_DONTNEED, B_FORCE}
10193  * If len == 0, do from off to EOF.
10194  *
10195  * The normal cases should be len == 0 && off == 0 (entire vp list) or
10196  * len == MAXBSIZE (from segmap_release actions), and len == PAGESIZE
10197  * (from pageout).
10198  */
10199 /* ARGSUSED */
10200 static int
10201 nfs4_putpage(vnode_t *vp, offset_t off, size_t len, int flags, cred_t *cr,
10202         caller_context_t *ct)
10203 {
10204         int error;
10205         rnode4_t *rp;
10206 
10207         ASSERT(cr != NULL);
10208 
10209         if (!(flags & B_ASYNC) && nfs_zone() != VTOMI4(vp)->mi_zone)
10210                 return (EIO);
10211 
10212         rp = VTOR4(vp);
10213         if (IS_SHADOW(vp, rp))
10214                 vp = RTOV4(rp);
10215 
10216         /*
10217          * XXX - Why should this check be made here?
10218          */
10219         if (vp->v_flag & VNOMAP)
10220                 return (ENOSYS);
10221 
10222         if (len == 0 && !(flags & B_INVAL) &&
10223             (vp->v_vfsp->vfs_flag & VFS_RDONLY))
10224                 return (0);
10225 
10226         mutex_enter(&rp->r_statelock);
10227         rp->r_count++;
10228         mutex_exit(&rp->r_statelock);
10229         error = nfs4_putpages(vp, off, len, flags, cr);
10230         mutex_enter(&rp->r_statelock);
10231         rp->r_count--;
10232         cv_broadcast(&rp->r_cv);
10233         mutex_exit(&rp->r_statelock);
10234 
10235         return (error);
10236 }
10237 
10238 /*
10239  * Write out a single page, possibly klustering adjacent dirty pages.
10240  */
10241 int
10242 nfs4_putapage(vnode_t *vp, page_t *pp, u_offset_t *offp, size_t *lenp,
10243     int flags, cred_t *cr)
10244 {
10245         u_offset_t io_off;
10246         u_offset_t lbn_off;
10247         u_offset_t lbn;
10248         size_t io_len;
10249         uint_t bsize;
10250         int error;
10251         rnode4_t *rp;
10252 
10253         ASSERT(!(vp->v_vfsp->vfs_flag & VFS_RDONLY));
10254         ASSERT(pp != NULL);
10255         ASSERT(cr != NULL);
10256         ASSERT((flags & B_ASYNC) || nfs_zone() == VTOMI4(vp)->mi_zone);
10257 
10258         rp = VTOR4(vp);
10259         ASSERT(rp->r_count > 0);
10260         ASSERT(!IS_SHADOW(vp, rp));
10261 
10262         bsize = MAX(vp->v_vfsp->vfs_bsize, PAGESIZE);
10263         lbn = pp->p_offset / bsize;
10264         lbn_off = lbn * bsize;
10265 
10266         /*
10267          * Find a kluster that fits in one block, or in
10268          * one page if pages are bigger than blocks.  If
10269          * there is less file space allocated than a whole
10270          * page, we'll shorten the i/o request below.
10271          */
10272         pp = pvn_write_kluster(vp, pp, &io_off, &io_len, lbn_off,
10273             roundup(bsize, PAGESIZE), flags);
10274 
10275         /*
10276          * pvn_write_kluster shouldn't have returned a page with offset
10277          * behind the original page we were given.  Verify that.
10278          */
10279         ASSERT((pp->p_offset / bsize) >= lbn);
10280 
10281         /*
10282          * Now pp will have the list of kept dirty pages marked for
10283          * write back.  It will also handle invalidation and freeing
10284          * of pages that are not dirty.  Check for page length rounding
10285          * problems.
10286          */
10287         if (io_off + io_len > lbn_off + bsize) {
10288                 ASSERT((io_off + io_len) - (lbn_off + bsize) < PAGESIZE);
10289                 io_len = lbn_off + bsize - io_off;
10290         }
10291         /*
10292          * The R4MODINPROGRESS flag makes sure that nfs4_bio() sees a
10293          * consistent value of r_size. R4MODINPROGRESS is set in writerp4().
10294          * When R4MODINPROGRESS is set it indicates that a uiomove() is in
10295          * progress and the r_size has not been made consistent with the
10296          * new size of the file. When the uiomove() completes the r_size is
10297          * updated and the R4MODINPROGRESS flag is cleared.
10298          *
10299          * The R4MODINPROGRESS flag makes sure that nfs4_bio() sees a
10300          * consistent value of r_size. Without this handshaking, it is
10301          * possible that nfs4_bio() picks  up the old value of r_size
10302          * before the uiomove() in writerp4() completes. This will result
10303          * in the write through nfs4_bio() being dropped.
10304          *
10305          * More precisely, there is a window between the time the uiomove()
10306          * completes and the time the r_size is updated. If a VOP_PUTPAGE()
10307          * operation intervenes in this window, the page will be picked up,
10308          * because it is dirty (it will be unlocked, unless it was
10309          * pagecreate'd). When the page is picked up as dirty, the dirty
10310          * bit is reset (pvn_getdirty()). In nfs4write(), r_size is
10311          * checked. This will still be the old size. Therefore the page will
10312          * not be written out. When segmap_release() calls VOP_PUTPAGE(),
10313          * the page will be found to be clean and the write will be dropped.
10314          */
10315         if (rp->r_flags & R4MODINPROGRESS) {
10316                 mutex_enter(&rp->r_statelock);
10317                 if ((rp->r_flags & R4MODINPROGRESS) &&
10318                     rp->r_modaddr + MAXBSIZE > io_off &&
10319                     rp->r_modaddr < io_off + io_len) {
10320                         page_t *plist;
10321                         /*
10322                          * A write is in progress for this region of the file.
10323                          * If we did not detect R4MODINPROGRESS here then this
10324                          * path through nfs_putapage() would eventually go to
10325                          * nfs4_bio() and may not write out all of the data
10326                          * in the pages. We end up losing data. So we decide
10327                          * to set the modified bit on each page in the page
10328                          * list and mark the rnode with R4DIRTY. This write
10329                          * will be restarted at some later time.
10330                          */
10331                         plist = pp;
10332                         while (plist != NULL) {
10333                                 pp = plist;
10334                                 page_sub(&plist, pp);
10335                                 hat_setmod(pp);
10336                                 page_io_unlock(pp);
10337                                 page_unlock(pp);
10338                         }
10339                         rp->r_flags |= R4DIRTY;
10340                         mutex_exit(&rp->r_statelock);
10341                         if (offp)
10342                                 *offp = io_off;
10343                         if (lenp)
10344                                 *lenp = io_len;
10345                         return (0);
10346                 }
10347                 mutex_exit(&rp->r_statelock);
10348         }
10349 
10350         if (flags & B_ASYNC) {
10351                 error = nfs4_async_putapage(vp, pp, io_off, io_len, flags, cr,
10352                     nfs4_sync_putapage);
10353         } else
10354                 error = nfs4_sync_putapage(vp, pp, io_off, io_len, flags, cr);
10355 
10356         if (offp)
10357                 *offp = io_off;
10358         if (lenp)
10359                 *lenp = io_len;
10360         return (error);
10361 }
10362 
10363 static int
10364 nfs4_sync_putapage(vnode_t *vp, page_t *pp, u_offset_t io_off, size_t io_len,
10365     int flags, cred_t *cr)
10366 {
10367         int error;
10368         rnode4_t *rp;
10369 
10370         ASSERT(nfs_zone() == VTOMI4(vp)->mi_zone);
10371 
10372         flags |= B_WRITE;
10373 
10374         error = nfs4_rdwrlbn(vp, pp, io_off, io_len, flags, cr);
10375 
10376         rp = VTOR4(vp);
10377 
10378         if ((error == ENOSPC || error == EDQUOT || error == EFBIG ||
10379             error == EACCES) &&
10380             (flags & (B_INVAL|B_FORCE)) != (B_INVAL|B_FORCE)) {
10381                 if (!(rp->r_flags & R4OUTOFSPACE)) {
10382                         mutex_enter(&rp->r_statelock);
10383                         rp->r_flags |= R4OUTOFSPACE;
10384                         mutex_exit(&rp->r_statelock);
10385                 }
10386                 flags |= B_ERROR;
10387                 pvn_write_done(pp, flags);
10388                 /*
10389                  * If this was not an async thread, then try again to
10390                  * write out the pages, but this time, also destroy
10391                  * them whether or not the write is successful.  This
10392                  * will prevent memory from filling up with these
10393                  * pages and destroying them is the only alternative
10394                  * if they can't be written out.
10395                  *
10396                  * Don't do this if this is an async thread because
10397                  * when the pages are unlocked in pvn_write_done,
10398                  * some other thread could have come along, locked
10399                  * them, and queued for an async thread.  It would be
10400                  * possible for all of the async threads to be tied
10401                  * up waiting to lock the pages again and they would
10402                  * all already be locked and waiting for an async
10403                  * thread to handle them.  Deadlock.
10404                  */
10405                 if (!(flags & B_ASYNC)) {
10406                         error = nfs4_putpage(vp, io_off, io_len,
10407                             B_INVAL | B_FORCE, cr, NULL);
10408                 }
10409         } else {
10410                 if (error)
10411                         flags |= B_ERROR;
10412                 else if (rp->r_flags & R4OUTOFSPACE) {
10413                         mutex_enter(&rp->r_statelock);
10414                         rp->r_flags &= ~R4OUTOFSPACE;
10415                         mutex_exit(&rp->r_statelock);
10416                 }
10417                 pvn_write_done(pp, flags);
10418                 if (freemem < desfree)
10419                         (void) nfs4_commit_vp(vp, (u_offset_t)0, 0, cr,
10420                             NFS4_WRITE_NOWAIT);
10421         }
10422 
10423         return (error);
10424 }
10425 
10426 #ifdef DEBUG
10427 int nfs4_force_open_before_mmap = 0;
10428 #endif
10429 
10430 /* ARGSUSED */
10431 static int
10432 nfs4_map(vnode_t *vp, offset_t off, struct as *as, caddr_t *addrp,
10433     size_t len, uchar_t prot, uchar_t maxprot, uint_t flags, cred_t *cr,
10434     caller_context_t *ct)
10435 {
10436         struct segvn_crargs vn_a;
10437         int error = 0;
10438         rnode4_t *rp = VTOR4(vp);
10439         mntinfo4_t *mi = VTOMI4(vp);
10440 
10441         if (nfs_zone() != VTOMI4(vp)->mi_zone)
10442                 return (EIO);
10443 
10444         if (vp->v_flag & VNOMAP)
10445                 return (ENOSYS);
10446 
10447         if (off < 0 || (off + len) < 0)
10448                 return (ENXIO);
10449 
10450         if (vp->v_type != VREG)
10451                 return (ENODEV);
10452 
10453         /*
10454          * If the file is delegated to the client don't do anything.
10455          * If the file is not delegated, then validate the data cache.
10456          */
10457         mutex_enter(&rp->r_statev4_lock);
10458         if (rp->r_deleg_type == OPEN_DELEGATE_NONE) {
10459                 mutex_exit(&rp->r_statev4_lock);
10460                 error = nfs4_validate_caches(vp, cr);
10461                 if (error)
10462                         return (error);
10463         } else {
10464                 mutex_exit(&rp->r_statev4_lock);
10465         }
10466 
10467         /*
10468          * Check to see if the vnode is currently marked as not cachable.
10469          * This means portions of the file are locked (through VOP_FRLOCK).
10470          * In this case the map request must be refused.  We use
10471          * rp->r_lkserlock to avoid a race with concurrent lock requests.
10472          *
10473          * Atomically increment r_inmap after acquiring r_rwlock. The
10474          * idea here is to acquire r_rwlock to block read/write and
10475          * not to protect r_inmap. r_inmap will inform nfs4_read/write()
10476          * that we are in nfs4_map(). Now, r_rwlock is acquired in order
10477          * and we can prevent the deadlock that would have occurred
10478          * when nfs4_addmap() would have acquired it out of order.
10479          *
10480          * Since we are not protecting r_inmap by any lock, we do not
10481          * hold any lock when we decrement it. We atomically decrement
10482          * r_inmap after we release r_lkserlock.
10483          */
10484 
10485         if (nfs_rw_enter_sig(&rp->r_rwlock, RW_WRITER, INTR4(vp)))
10486                 return (EINTR);
10487         atomic_inc_uint(&rp->r_inmap);
10488         nfs_rw_exit(&rp->r_rwlock);
10489 
10490         if (nfs_rw_enter_sig(&rp->r_lkserlock, RW_READER, INTR4(vp))) {
10491                 atomic_dec_uint(&rp->r_inmap);
10492                 return (EINTR);
10493         }
10494 
10495 
10496         if (vp->v_flag & VNOCACHE) {
10497                 error = EAGAIN;
10498                 goto done;
10499         }
10500 
10501         /*
10502          * Don't allow concurrent locks and mapping if mandatory locking is
10503          * enabled.
10504          */
10505         if (flk_has_remote_locks(vp)) {
10506                 struct vattr va;
10507                 va.va_mask = AT_MODE;
10508                 error = nfs4getattr(vp, &va, cr);
10509                 if (error != 0)
10510                         goto done;
10511                 if (MANDLOCK(vp, va.va_mode)) {
10512                         error = EAGAIN;
10513                         goto done;
10514                 }
10515         }
10516 
10517         /*
10518          * It is possible that the rnode has a lost lock request that we
10519          * are still trying to recover, and that the request conflicts with
10520          * this map request.
10521          *
10522          * An alternative approach would be for nfs4_safemap() to consider
10523          * queued lock requests when deciding whether to set or clear
10524          * VNOCACHE.  This would require the frlock code path to call
10525          * nfs4_safemap() after enqueing a lost request.
10526          */
10527         if (nfs4_map_lost_lock_conflict(vp)) {
10528                 error = EAGAIN;
10529                 goto done;
10530         }
10531 
10532         as_rangelock(as);
10533         error = choose_addr(as, addrp, len, off, ADDR_VACALIGN, flags);
10534         if (error != 0) {
10535                 as_rangeunlock(as);
10536                 goto done;
10537         }
10538 
10539         if (vp->v_type == VREG) {
10540                 /*
10541                  * We need to retrieve the open stream
10542                  */
10543                 nfs4_open_stream_t      *osp = NULL;
10544                 nfs4_open_owner_t       *oop = NULL;
10545 
10546                 oop = find_open_owner(cr, NFS4_PERM_CREATED, mi);
10547                 if (oop != NULL) {
10548                         /* returns with 'os_sync_lock' held */
10549                         osp = find_open_stream(oop, rp);
10550                         open_owner_rele(oop);
10551                 }
10552                 if (osp == NULL) {
10553 #ifdef DEBUG
10554                         if (nfs4_force_open_before_mmap) {
10555                                 error = EIO;
10556                                 goto done;
10557                         }
10558 #endif
10559                         /* returns with 'os_sync_lock' held */
10560                         error = open_and_get_osp(vp, cr, &osp);
10561                         if (osp == NULL) {
10562                                 NFS4_DEBUG(nfs4_mmap_debug, (CE_NOTE,
10563                                     "nfs4_map: we tried to OPEN the file "
10564                                     "but again no osp, so fail with EIO"));
10565                                 goto done;
10566                         }
10567                 }
10568 
10569                 if (osp->os_failed_reopen) {
10570                         mutex_exit(&osp->os_sync_lock);
10571                         open_stream_rele(osp, rp);
10572                         NFS4_DEBUG(nfs4_open_stream_debug, (CE_NOTE,
10573                             "nfs4_map: os_failed_reopen set on "
10574                             "osp %p, cr %p, rp %s", (void *)osp,
10575                             (void *)cr, rnode4info(rp)));
10576                         error = EIO;
10577                         goto done;
10578                 }
10579                 mutex_exit(&osp->os_sync_lock);
10580                 open_stream_rele(osp, rp);
10581         }
10582 
10583         vn_a.vp = vp;
10584         vn_a.offset = off;
10585         vn_a.type = (flags & MAP_TYPE);
10586         vn_a.prot = (uchar_t)prot;
10587         vn_a.maxprot = (uchar_t)maxprot;
10588         vn_a.flags = (flags & ~MAP_TYPE);
10589         vn_a.cred = cr;
10590         vn_a.amp = NULL;
10591         vn_a.szc = 0;
10592         vn_a.lgrp_mem_policy_flags = 0;
10593 
10594         error = as_map(as, *addrp, len, segvn_create, &vn_a);
10595         as_rangeunlock(as);
10596 
10597 done:
10598         nfs_rw_exit(&rp->r_lkserlock);
10599         atomic_dec_uint(&rp->r_inmap);
10600         return (error);
10601 }
10602 
10603 /*
10604  * We're most likely dealing with a kernel module that likes to READ
10605  * and mmap without OPENing the file (ie: lookup/read/mmap), so lets
10606  * officially OPEN the file to create the necessary client state
10607  * for bookkeeping of os_mmap_read/write counts.
10608  *
10609  * Since VOP_MAP only passes in a pointer to the vnode rather than
10610  * a double pointer, we can't handle the case where nfs4open_otw()
10611  * returns a different vnode than the one passed into VOP_MAP (since
10612  * VOP_DELMAP will not see the vnode nfs4open_otw used).  In this case,
10613  * we return NULL and let nfs4_map() fail.  Note: the only case where
10614  * this should happen is if the file got removed and replaced with the
10615  * same name on the server (in addition to the fact that we're trying
10616  * to VOP_MAP withouth VOP_OPENing the file in the first place).
10617  */
10618 static int
10619 open_and_get_osp(vnode_t *map_vp, cred_t *cr, nfs4_open_stream_t **ospp)
10620 {
10621         rnode4_t                *rp, *drp;
10622         vnode_t                 *dvp, *open_vp;
10623         char                    file_name[MAXNAMELEN];
10624         int                     just_created;
10625         nfs4_open_stream_t      *osp;
10626         nfs4_open_owner_t       *oop;
10627         int                     error;
10628 
10629         *ospp = NULL;
10630         open_vp = map_vp;
10631 
10632         rp = VTOR4(open_vp);
10633         if ((error = vtodv(open_vp, &dvp, cr, TRUE)) != 0)
10634                 return (error);
10635         drp = VTOR4(dvp);
10636 
10637         if (nfs_rw_enter_sig(&drp->r_rwlock, RW_READER, INTR4(dvp))) {
10638                 VN_RELE(dvp);
10639                 return (EINTR);
10640         }
10641 
10642         if ((error = vtoname(open_vp, file_name, MAXNAMELEN)) != 0) {
10643                 nfs_rw_exit(&drp->r_rwlock);
10644                 VN_RELE(dvp);
10645                 return (error);
10646         }
10647 
10648         mutex_enter(&rp->r_statev4_lock);
10649         if (rp->created_v4) {
10650                 rp->created_v4 = 0;
10651                 mutex_exit(&rp->r_statev4_lock);
10652 
10653                 dnlc_update(dvp, file_name, open_vp);
10654                 /* This is needed so we don't bump the open ref count */
10655                 just_created = 1;
10656         } else {
10657                 mutex_exit(&rp->r_statev4_lock);
10658                 just_created = 0;
10659         }
10660 
10661         VN_HOLD(map_vp);
10662 
10663         error = nfs4open_otw(dvp, file_name, NULL, &open_vp, cr, 0, FREAD, 0,
10664             just_created);
10665         if (error) {
10666                 nfs_rw_exit(&drp->r_rwlock);
10667                 VN_RELE(dvp);
10668                 VN_RELE(map_vp);
10669                 return (error);
10670         }
10671 
10672         nfs_rw_exit(&drp->r_rwlock);
10673         VN_RELE(dvp);
10674 
10675         /*
10676          * If nfs4open_otw() returned a different vnode then "undo"
10677          * the open and return failure to the caller.
10678          */
10679         if (!VN_CMP(open_vp, map_vp)) {
10680                 nfs4_error_t e;
10681 
10682                 NFS4_DEBUG(nfs4_mmap_debug, (CE_NOTE, "open_and_get_osp: "
10683                     "open returned a different vnode"));
10684                 /*
10685                  * If there's an error, ignore it,
10686                  * and let VOP_INACTIVE handle it.
10687                  */
10688                 (void) nfs4close_one(open_vp, NULL, cr, FREAD, NULL, &e,
10689                     CLOSE_NORM, 0, 0, 0);
10690                 VN_RELE(map_vp);
10691                 return (EIO);
10692         }
10693 
10694         VN_RELE(map_vp);
10695 
10696         oop = find_open_owner(cr, NFS4_PERM_CREATED, VTOMI4(open_vp));
10697         if (!oop) {
10698                 nfs4_error_t e;
10699 
10700                 NFS4_DEBUG(nfs4_mmap_debug, (CE_NOTE, "open_and_get_osp: "
10701                     "no open owner"));
10702                 /*
10703                  * If there's an error, ignore it,
10704                  * and let VOP_INACTIVE handle it.
10705                  */
10706                 (void) nfs4close_one(open_vp, NULL, cr, FREAD, NULL, &e,
10707                     CLOSE_NORM, 0, 0, 0);
10708                 return (EIO);
10709         }
10710         osp = find_open_stream(oop, rp);
10711         open_owner_rele(oop);
10712         *ospp = osp;
10713         return (0);
10714 }
10715 
10716 /*
10717  * Please be aware that when this function is called, the address space write
10718  * a_lock is held.  Do not put over the wire calls in this function.
10719  */
10720 /* ARGSUSED */
10721 static int
10722 nfs4_addmap(vnode_t *vp, offset_t off, struct as *as, caddr_t addr,
10723     size_t len, uchar_t prot, uchar_t maxprot, uint_t flags, cred_t *cr,
10724     caller_context_t *ct)
10725 {
10726         rnode4_t                *rp;
10727         int                     error = 0;
10728         mntinfo4_t              *mi;
10729 
10730         mi = VTOMI4(vp);
10731         rp = VTOR4(vp);
10732 
10733         if (nfs_zone() != mi->mi_zone)
10734                 return (EIO);
10735         if (vp->v_flag & VNOMAP)
10736                 return (ENOSYS);
10737 
10738         /*
10739          * Don't need to update the open stream first, since this
10740          * mmap can't add any additional share access that isn't
10741          * already contained in the open stream (for the case where we
10742          * open/mmap/only update rp->r_mapcnt/server reboots/reopen doesn't
10743          * take into account os_mmap_read[write] counts).
10744          */
10745         atomic_add_long((ulong_t *)&rp->r_mapcnt, btopr(len));
10746 
10747         if (vp->v_type == VREG) {
10748                 /*
10749                  * We need to retrieve the open stream and update the counts.
10750                  * If there is no open stream here, something is wrong.
10751                  */
10752                 nfs4_open_stream_t      *osp = NULL;
10753                 nfs4_open_owner_t       *oop = NULL;
10754 
10755                 oop = find_open_owner(cr, NFS4_PERM_CREATED, mi);
10756                 if (oop != NULL) {
10757                         /* returns with 'os_sync_lock' held */
10758                         osp = find_open_stream(oop, rp);
10759                         open_owner_rele(oop);
10760                 }
10761                 if (osp == NULL) {
10762                         NFS4_DEBUG(nfs4_mmap_debug, (CE_NOTE,
10763                             "nfs4_addmap: we should have an osp"
10764                             "but we don't, so fail with EIO"));
10765                         error = EIO;
10766                         goto out;
10767                 }
10768 
10769                 NFS4_DEBUG(nfs4_mmap_debug, (CE_NOTE, "nfs4_addmap: osp %p,"
10770                     " pages %ld, prot 0x%x", (void *)osp, btopr(len), prot));
10771 
10772                 /*
10773                  * Update the map count in the open stream.
10774                  * This is necessary in the case where we
10775                  * open/mmap/close/, then the server reboots, and we
10776                  * attempt to reopen.  If the mmap doesn't add share
10777                  * access then we send an invalid reopen with
10778                  * access = NONE.
10779                  *
10780                  * We need to specifically check each PROT_* so a mmap
10781                  * call of (PROT_WRITE | PROT_EXEC) will ensure us both
10782                  * read and write access.  A simple comparison of prot
10783                  * to ~PROT_WRITE to determine read access is insufficient
10784                  * since prot can be |= with PROT_USER, etc.
10785                  */
10786 
10787                 /*
10788                  * Unless we're MAP_SHARED, no sense in adding os_mmap_write
10789                  */
10790                 if ((flags & MAP_SHARED) && (maxprot & PROT_WRITE))
10791                         osp->os_mmap_write += btopr(len);
10792                 if (maxprot & PROT_READ)
10793                         osp->os_mmap_read += btopr(len);
10794                 if (maxprot & PROT_EXEC)
10795                         osp->os_mmap_read += btopr(len);
10796                 /*
10797                  * Ensure that os_mmap_read gets incremented, even if
10798                  * maxprot were to look like PROT_NONE.
10799                  */
10800                 if (!(maxprot & PROT_READ) && !(maxprot & PROT_WRITE) &&
10801                     !(maxprot & PROT_EXEC))
10802                         osp->os_mmap_read += btopr(len);
10803                 osp->os_mapcnt += btopr(len);
10804                 mutex_exit(&osp->os_sync_lock);
10805                 open_stream_rele(osp, rp);
10806         }
10807 
10808 out:
10809         /*
10810          * If we got an error, then undo our
10811          * incrementing of 'r_mapcnt'.
10812          */
10813 
10814         if (error) {
10815                 atomic_add_long((ulong_t *)&rp->r_mapcnt, -btopr(len));
10816                 ASSERT(rp->r_mapcnt >= 0);
10817         }
10818         return (error);
10819 }
10820 
10821 /* ARGSUSED */
10822 static int
10823 nfs4_cmp(vnode_t *vp1, vnode_t *vp2, caller_context_t *ct)
10824 {
10825 
10826         return (VTOR4(vp1) == VTOR4(vp2));
10827 }
10828 
10829 /* ARGSUSED */
10830 static int
10831 nfs4_frlock(vnode_t *vp, int cmd, struct flock64 *bfp, int flag,
10832     offset_t offset, struct flk_callback *flk_cbp, cred_t *cr,
10833     caller_context_t *ct)
10834 {
10835         int rc;
10836         u_offset_t start, end;
10837         rnode4_t *rp;
10838         int error = 0, intr = INTR4(vp);
10839         nfs4_error_t e;
10840 
10841         if (nfs_zone() != VTOMI4(vp)->mi_zone)
10842                 return (EIO);
10843 
10844         /* check for valid cmd parameter */
10845         if (cmd != F_GETLK && cmd != F_SETLK && cmd != F_SETLKW)
10846                 return (EINVAL);
10847 
10848         /* Verify l_type. */
10849         switch (bfp->l_type) {
10850         case F_RDLCK:
10851                 if (cmd != F_GETLK && !(flag & FREAD))
10852                         return (EBADF);
10853                 break;
10854         case F_WRLCK:
10855                 if (cmd != F_GETLK && !(flag & FWRITE))
10856                         return (EBADF);
10857                 break;
10858         case F_UNLCK:
10859                 intr = 0;
10860                 break;
10861 
10862         default:
10863                 return (EINVAL);
10864         }
10865 
10866         /* check the validity of the lock range */
10867         if (rc = flk_convert_lock_data(vp, bfp, &start, &end, offset))
10868                 return (rc);
10869         if (rc = flk_check_lock_data(start, end, MAXEND))
10870                 return (rc);
10871 
10872         /*
10873          * If the filesystem is mounted using local locking, pass the
10874          * request off to the local locking code.
10875          */
10876         if (VTOMI4(vp)->mi_flags & MI4_LLOCK || vp->v_type != VREG) {
10877                 if (cmd == F_SETLK || cmd == F_SETLKW) {
10878                         /*
10879                          * For complete safety, we should be holding
10880                          * r_lkserlock.  However, we can't call
10881                          * nfs4_safelock and then fs_frlock while
10882                          * holding r_lkserlock, so just invoke
10883                          * nfs4_safelock and expect that this will
10884                          * catch enough of the cases.
10885                          */
10886                         if (!nfs4_safelock(vp, bfp, cr))
10887                                 return (EAGAIN);
10888                 }
10889                 return (fs_frlock(vp, cmd, bfp, flag, offset, flk_cbp, cr, ct));
10890         }
10891 
10892         rp = VTOR4(vp);
10893 
10894         /*
10895          * Check whether the given lock request can proceed, given the
10896          * current file mappings.
10897          */
10898         if (nfs_rw_enter_sig(&rp->r_lkserlock, RW_WRITER, intr))
10899                 return (EINTR);
10900         if (cmd == F_SETLK || cmd == F_SETLKW) {
10901                 if (!nfs4_safelock(vp, bfp, cr)) {
10902                         rc = EAGAIN;
10903                         goto done;
10904                 }
10905         }
10906 
10907         /*
10908          * Flush the cache after waiting for async I/O to finish.  For new
10909          * locks, this is so that the process gets the latest bits from the
10910          * server.  For unlocks, this is so that other clients see the
10911          * latest bits once the file has been unlocked.  If currently dirty
10912          * pages can't be flushed, then don't allow a lock to be set.  But
10913          * allow unlocks to succeed, to avoid having orphan locks on the
10914          * server.
10915          */
10916         if (cmd != F_GETLK) {
10917                 mutex_enter(&rp->r_statelock);
10918                 while (rp->r_count > 0) {
10919                         if (intr) {
10920                                 klwp_t *lwp = ttolwp(curthread);
10921 
10922                                 if (lwp != NULL)
10923                                         lwp->lwp_nostop++;
10924                                 if (cv_wait_sig(&rp->r_cv,
10925                                     &rp->r_statelock) == 0) {
10926                                         if (lwp != NULL)
10927                                                 lwp->lwp_nostop--;
10928                                         rc = EINTR;
10929                                         break;
10930                                 }
10931                                 if (lwp != NULL)
10932                                         lwp->lwp_nostop--;
10933                                 } else
10934                                         cv_wait(&rp->r_cv, &rp->r_statelock);
10935                 }
10936                 mutex_exit(&rp->r_statelock);
10937                 if (rc != 0)
10938                         goto done;
10939                 error = nfs4_putpage(vp, (offset_t)0, 0, B_INVAL, cr, ct);
10940                 if (error) {
10941                         if (error == ENOSPC || error == EDQUOT) {
10942                                 mutex_enter(&rp->r_statelock);
10943                                 if (!rp->r_error)
10944                                         rp->r_error = error;
10945                                 mutex_exit(&rp->r_statelock);
10946                         }
10947                         if (bfp->l_type != F_UNLCK) {
10948                                 rc = ENOLCK;
10949                                 goto done;
10950                         }
10951                 }
10952         }
10953 
10954         /*
10955          * Call the lock manager to do the real work of contacting
10956          * the server and obtaining the lock.
10957          */
10958         nfs4frlock(NFS4_LCK_CTYPE_NORM, vp, cmd, bfp, flag, offset,
10959             cr, &e, NULL, NULL);
10960         rc = e.error;
10961 
10962         if (rc == 0)
10963                 nfs4_lockcompletion(vp, cmd);
10964 
10965 done:
10966         nfs_rw_exit(&rp->r_lkserlock);
10967 
10968         return (rc);
10969 }
10970 
10971 /*
10972  * Free storage space associated with the specified vnode.  The portion
10973  * to be freed is specified by bfp->l_start and bfp->l_len (already
10974  * normalized to a "whence" of 0).
10975  *
10976  * This is an experimental facility whose continued existence is not
10977  * guaranteed.  Currently, we only support the special case
10978  * of l_len == 0, meaning free to end of file.
10979  */
10980 /* ARGSUSED */
10981 static int
10982 nfs4_space(vnode_t *vp, int cmd, struct flock64 *bfp, int flag,
10983     offset_t offset, cred_t *cr, caller_context_t *ct)
10984 {
10985         int error;
10986 
10987         if (nfs_zone() != VTOMI4(vp)->mi_zone)
10988                 return (EIO);
10989         ASSERT(vp->v_type == VREG);
10990         if (cmd != F_FREESP)
10991                 return (EINVAL);
10992 
10993         error = convoff(vp, bfp, 0, offset);
10994         if (!error) {
10995                 ASSERT(bfp->l_start >= 0);
10996                 if (bfp->l_len == 0) {
10997                         struct vattr va;
10998 
10999                         va.va_mask = AT_SIZE;
11000                         va.va_size = bfp->l_start;
11001                         error = nfs4setattr(vp, &va, 0, cr, NULL);
11002 
11003                         if (error == 0 && bfp->l_start == 0)
11004                                 vnevent_truncate(vp, ct);
11005                 } else
11006                         error = EINVAL;
11007         }
11008 
11009         return (error);
11010 }
11011 
11012 /* ARGSUSED */
11013 int
11014 nfs4_realvp(vnode_t *vp, vnode_t **vpp, caller_context_t *ct)
11015 {
11016         rnode4_t *rp;
11017         rp = VTOR4(vp);
11018 
11019         if (vp->v_type == VREG && IS_SHADOW(vp, rp)) {
11020                 vp = RTOV4(rp);
11021         }
11022         *vpp = vp;
11023         return (0);
11024 }
11025 
11026 /*
11027  * Setup and add an address space callback to do the work of the delmap call.
11028  * The callback will (and must be) deleted in the actual callback function.
11029  *
11030  * This is done in order to take care of the problem that we have with holding
11031  * the address space's a_lock for a long period of time (e.g. if the NFS server
11032  * is down).  Callbacks will be executed in the address space code while the
11033  * a_lock is not held.  Holding the address space's a_lock causes things such
11034  * as ps and fork to hang because they are trying to acquire this lock as well.
11035  */
11036 /* ARGSUSED */
11037 static int
11038 nfs4_delmap(vnode_t *vp, offset_t off, struct as *as, caddr_t addr,
11039     size_t len, uint_t prot, uint_t maxprot, uint_t flags, cred_t *cr,
11040     caller_context_t *ct)
11041 {
11042         int                     caller_found;
11043         int                     error;
11044         rnode4_t                *rp;
11045         nfs4_delmap_args_t      *dmapp;
11046         nfs4_delmapcall_t       *delmap_call;
11047 
11048         if (vp->v_flag & VNOMAP)
11049                 return (ENOSYS);
11050 
11051         /*
11052          * A process may not change zones if it has NFS pages mmap'ed
11053          * in, so we can't legitimately get here from the wrong zone.
11054          */
11055         ASSERT(nfs_zone() == VTOMI4(vp)->mi_zone);
11056 
11057         rp = VTOR4(vp);
11058 
11059         /*
11060          * The way that the address space of this process deletes its mapping
11061          * of this file is via the following call chains:
11062          * - as_free()->SEGOP_UNMAP()/segvn_unmap()->VOP_DELMAP()/nfs4_delmap()
11063          * - as_unmap()->SEGOP_UNMAP()/segvn_unmap()->VOP_DELMAP()/nfs4_delmap()
11064          *
11065          * With the use of address space callbacks we are allowed to drop the
11066          * address space lock, a_lock, while executing the NFS operations that
11067          * need to go over the wire.  Returning EAGAIN to the caller of this
11068          * function is what drives the execution of the callback that we add
11069          * below.  The callback will be executed by the address space code
11070          * after dropping the a_lock.  When the callback is finished, since
11071          * we dropped the a_lock, it must be re-acquired and segvn_unmap()
11072          * is called again on the same segment to finish the rest of the work
11073          * that needs to happen during unmapping.
11074          *
11075          * This action of calling back into the segment driver causes
11076          * nfs4_delmap() to get called again, but since the callback was
11077          * already executed at this point, it already did the work and there
11078          * is nothing left for us to do.
11079          *
11080          * To Summarize:
11081          * - The first time nfs4_delmap is called by the current thread is when
11082          * we add the caller associated with this delmap to the delmap caller
11083          * list, add the callback, and return EAGAIN.
11084          * - The second time in this call chain when nfs4_delmap is called we
11085          * will find this caller in the delmap caller list and realize there
11086          * is no more work to do thus removing this caller from the list and
11087          * returning the error that was set in the callback execution.
11088          */
11089         caller_found = nfs4_find_and_delete_delmapcall(rp, &error);
11090         if (caller_found) {
11091                 /*
11092                  * 'error' is from the actual delmap operations.  To avoid
11093                  * hangs, we need to handle the return of EAGAIN differently
11094                  * since this is what drives the callback execution.
11095                  * In this case, we don't want to return EAGAIN and do the
11096                  * callback execution because there are none to execute.
11097                  */
11098                 if (error == EAGAIN)
11099                         return (0);
11100                 else
11101                         return (error);
11102         }
11103 
11104         /* current caller was not in the list */
11105         delmap_call = nfs4_init_delmapcall();
11106 
11107         mutex_enter(&rp->r_statelock);
11108         list_insert_tail(&rp->r_indelmap, delmap_call);
11109         mutex_exit(&rp->r_statelock);
11110 
11111         dmapp = kmem_alloc(sizeof (nfs4_delmap_args_t), KM_SLEEP);
11112 
11113         dmapp->vp = vp;
11114         dmapp->off = off;
11115         dmapp->addr = addr;
11116         dmapp->len = len;
11117         dmapp->prot = prot;
11118         dmapp->maxprot = maxprot;
11119         dmapp->flags = flags;
11120         dmapp->cr = cr;
11121         dmapp->caller = delmap_call;
11122 
11123         error = as_add_callback(as, nfs4_delmap_callback, dmapp,
11124             AS_UNMAP_EVENT, addr, len, KM_SLEEP);
11125 
11126         return (error ? error : EAGAIN);
11127 }
11128 
11129 static nfs4_delmapcall_t *
11130 nfs4_init_delmapcall()
11131 {
11132         nfs4_delmapcall_t       *delmap_call;
11133 
11134         delmap_call = kmem_alloc(sizeof (nfs4_delmapcall_t), KM_SLEEP);
11135         delmap_call->call_id = curthread;
11136         delmap_call->error = 0;
11137 
11138         return (delmap_call);
11139 }
11140 
11141 static void
11142 nfs4_free_delmapcall(nfs4_delmapcall_t *delmap_call)
11143 {
11144         kmem_free(delmap_call, sizeof (nfs4_delmapcall_t));
11145 }
11146 
11147 /*
11148  * Searches for the current delmap caller (based on curthread) in the list of
11149  * callers.  If it is found, we remove it and free the delmap caller.
11150  * Returns:
11151  *      0 if the caller wasn't found
11152  *      1 if the caller was found, removed and freed.  *errp will be set
11153  *      to what the result of the delmap was.
11154  */
11155 static int
11156 nfs4_find_and_delete_delmapcall(rnode4_t *rp, int *errp)
11157 {
11158         nfs4_delmapcall_t       *delmap_call;
11159 
11160         /*
11161          * If the list doesn't exist yet, we create it and return
11162          * that the caller wasn't found.  No list = no callers.
11163          */
11164         mutex_enter(&rp->r_statelock);
11165         if (!(rp->r_flags & R4DELMAPLIST)) {
11166                 /* The list does not exist */
11167                 list_create(&rp->r_indelmap, sizeof (nfs4_delmapcall_t),
11168                     offsetof(nfs4_delmapcall_t, call_node));
11169                 rp->r_flags |= R4DELMAPLIST;
11170                 mutex_exit(&rp->r_statelock);
11171                 return (0);
11172         } else {
11173                 /* The list exists so search it */
11174                 for (delmap_call = list_head(&rp->r_indelmap);
11175                     delmap_call != NULL;
11176                     delmap_call = list_next(&rp->r_indelmap, delmap_call)) {
11177                         if (delmap_call->call_id == curthread) {
11178                                 /* current caller is in the list */
11179                                 *errp = delmap_call->error;
11180                                 list_remove(&rp->r_indelmap, delmap_call);
11181                                 mutex_exit(&rp->r_statelock);
11182                                 nfs4_free_delmapcall(delmap_call);
11183                                 return (1);
11184                         }
11185                 }
11186         }
11187         mutex_exit(&rp->r_statelock);
11188         return (0);
11189 }
11190 
11191 /*
11192  * Remove some pages from an mmap'd vnode.  Just update the
11193  * count of pages.  If doing close-to-open, then flush and
11194  * commit all of the pages associated with this file.
11195  * Otherwise, start an asynchronous page flush to write out
11196  * any dirty pages.  This will also associate a credential
11197  * with the rnode which can be used to write the pages.
11198  */
11199 /* ARGSUSED */
11200 static void
11201 nfs4_delmap_callback(struct as *as, void *arg, uint_t event)
11202 {
11203         nfs4_error_t            e = { 0, NFS4_OK, RPC_SUCCESS };
11204         rnode4_t                *rp;
11205         mntinfo4_t              *mi;
11206         nfs4_delmap_args_t      *dmapp = (nfs4_delmap_args_t *)arg;
11207 
11208         rp = VTOR4(dmapp->vp);
11209         mi = VTOMI4(dmapp->vp);
11210 
11211         atomic_add_long((ulong_t *)&rp->r_mapcnt, -btopr(dmapp->len));
11212         ASSERT(rp->r_mapcnt >= 0);
11213 
11214         /*
11215          * Initiate a page flush and potential commit if there are
11216          * pages, the file system was not mounted readonly, the segment
11217          * was mapped shared, and the pages themselves were writeable.
11218          */
11219         if (nfs4_has_pages(dmapp->vp) &&
11220             !(dmapp->vp->v_vfsp->vfs_flag & VFS_RDONLY) &&
11221             dmapp->flags == MAP_SHARED && (dmapp->maxprot & PROT_WRITE)) {
11222                 mutex_enter(&rp->r_statelock);
11223                 rp->r_flags |= R4DIRTY;
11224                 mutex_exit(&rp->r_statelock);
11225                 e.error = nfs4_putpage_commit(dmapp->vp, dmapp->off,
11226                     dmapp->len, dmapp->cr);
11227                 if (!e.error) {
11228                         mutex_enter(&rp->r_statelock);
11229                         e.error = rp->r_error;
11230                         rp->r_error = 0;
11231                         mutex_exit(&rp->r_statelock);
11232                 }
11233         } else
11234                 e.error = 0;
11235 
11236         if ((rp->r_flags & R4DIRECTIO) || (mi->mi_flags & MI4_DIRECTIO))
11237                 (void) nfs4_putpage(dmapp->vp, dmapp->off, dmapp->len,
11238                     B_INVAL, dmapp->cr, NULL);
11239 
11240         if (e.error) {
11241                 e.stat = puterrno4(e.error);
11242                 nfs4_queue_fact(RF_DELMAP_CB_ERR, mi, e.stat, 0,
11243                     OP_COMMIT, FALSE, NULL, 0, dmapp->vp);
11244                 dmapp->caller->error = e.error;
11245         }
11246 
11247         /* Check to see if we need to close the file */
11248 
11249         if (dmapp->vp->v_type == VREG) {
11250                 nfs4close_one(dmapp->vp, NULL, dmapp->cr, 0, NULL, &e,
11251                     CLOSE_DELMAP, dmapp->len, dmapp->maxprot, dmapp->flags);
11252 
11253                 if (e.error != 0 || e.stat != NFS4_OK) {
11254                         /*
11255                          * Since it is possible that e.error == 0 and
11256                          * e.stat != NFS4_OK (and vice versa),
11257                          * we do the proper checking in order to get both
11258                          * e.error and e.stat reporting the correct info.
11259                          */
11260                         if (e.stat == NFS4_OK)
11261                                 e.stat = puterrno4(e.error);
11262                         if (e.error == 0)
11263                                 e.error = geterrno4(e.stat);
11264 
11265                         nfs4_queue_fact(RF_DELMAP_CB_ERR, mi, e.stat, 0,
11266                             OP_CLOSE, FALSE, NULL, 0, dmapp->vp);
11267                         dmapp->caller->error = e.error;
11268                 }
11269         }
11270 
11271         (void) as_delete_callback(as, arg);
11272         kmem_free(dmapp, sizeof (nfs4_delmap_args_t));
11273 }
11274 
11275 
11276 static uint_t
11277 fattr4_maxfilesize_to_bits(uint64_t ll)
11278 {
11279         uint_t l = 1;
11280 
11281         if (ll == 0) {
11282                 return (0);
11283         }
11284 
11285         if (ll & 0xffffffff00000000) {
11286                 l += 32; ll >>= 32;
11287         }
11288         if (ll & 0xffff0000) {
11289                 l += 16; ll >>= 16;
11290         }
11291         if (ll & 0xff00) {
11292                 l += 8; ll >>= 8;
11293         }
11294         if (ll & 0xf0) {
11295                 l += 4; ll >>= 4;
11296         }
11297         if (ll & 0xc) {
11298                 l += 2; ll >>= 2;
11299         }
11300         if (ll & 0x2) {
11301                 l += 1;
11302         }
11303         return (l);
11304 }
11305 
11306 static int
11307 nfs4_have_xattrs(vnode_t *vp, ulong_t *valp, cred_t *cr)
11308 {
11309         vnode_t *avp = NULL;
11310         int error;
11311 
11312         if ((error = nfs4lookup_xattr(vp, "", &avp,
11313             LOOKUP_XATTR, cr)) == 0)
11314                 error = do_xattr_exists_check(avp, valp, cr);
11315         if (avp)
11316                 VN_RELE(avp);
11317 
11318         return (error);
11319 }
11320 
11321 /* ARGSUSED */
11322 int
11323 nfs4_pathconf(vnode_t *vp, int cmd, ulong_t *valp, cred_t *cr,
11324         caller_context_t *ct)
11325 {
11326         int error;
11327         hrtime_t t;
11328         rnode4_t *rp;
11329         nfs4_ga_res_t gar;
11330         nfs4_ga_ext_res_t ger;
11331 
11332         gar.n4g_ext_res = &ger;
11333 
11334         if (nfs_zone() != VTOMI4(vp)->mi_zone)
11335                 return (EIO);
11336         if (cmd == _PC_PATH_MAX || cmd == _PC_SYMLINK_MAX) {
11337                 *valp = MAXPATHLEN;
11338                 return (0);
11339         }
11340         if (cmd == _PC_ACL_ENABLED) {
11341                 *valp = _ACL_ACE_ENABLED;
11342                 return (0);
11343         }
11344 
11345         rp = VTOR4(vp);
11346         if (cmd == _PC_XATTR_EXISTS) {
11347                 /*
11348                  * The existence of the xattr directory is not sufficient
11349                  * for determining whether generic user attributes exists.
11350                  * The attribute directory could only be a transient directory
11351                  * used for Solaris sysattr support.  Do a small readdir
11352                  * to verify if the only entries are sysattrs or not.
11353                  *
11354                  * pc4_xattr_valid can be only be trusted when r_xattr_dir
11355                  * is NULL.  Once the xadir vp exists, we can create xattrs,
11356                  * and we don't have any way to update the "base" object's
11357                  * pc4_xattr_exists from the xattr or xadir.  Maybe FEM
11358                  * could help out.
11359                  */
11360                 if (ATTRCACHE4_VALID(vp) && rp->r_pathconf.pc4_xattr_valid &&
11361                     rp->r_xattr_dir == NULL) {
11362                         return (nfs4_have_xattrs(vp, valp, cr));
11363                 }
11364         } else {  /* OLD CODE */
11365                 if (ATTRCACHE4_VALID(vp)) {
11366                         mutex_enter(&rp->r_statelock);
11367                         if (rp->r_pathconf.pc4_cache_valid) {
11368                                 error = 0;
11369                                 switch (cmd) {
11370                                 case _PC_FILESIZEBITS:
11371                                         *valp =
11372                                             rp->r_pathconf.pc4_filesizebits;
11373                                         break;
11374                                 case _PC_LINK_MAX:
11375                                         *valp =
11376                                             rp->r_pathconf.pc4_link_max;
11377                                         break;
11378                                 case _PC_NAME_MAX:
11379                                         *valp =
11380                                             rp->r_pathconf.pc4_name_max;
11381                                         break;
11382                                 case _PC_CHOWN_RESTRICTED:
11383                                         *valp =
11384                                             rp->r_pathconf.pc4_chown_restricted;
11385                                         break;
11386                                 case _PC_NO_TRUNC:
11387                                         *valp =
11388                                             rp->r_pathconf.pc4_no_trunc;
11389                                         break;
11390                                 default:
11391                                         error = EINVAL;
11392                                         break;
11393                                 }
11394                                 mutex_exit(&rp->r_statelock);
11395 #ifdef DEBUG
11396                                 nfs4_pathconf_cache_hits++;
11397 #endif
11398                                 return (error);
11399                         }
11400                         mutex_exit(&rp->r_statelock);
11401                 }
11402         }
11403 #ifdef DEBUG
11404         nfs4_pathconf_cache_misses++;
11405 #endif
11406 
11407         t = gethrtime();
11408 
11409         error = nfs4_attr_otw(vp, TAG_PATHCONF, &gar, NFS4_PATHCONF_MASK, cr);
11410 
11411         if (error) {
11412                 mutex_enter(&rp->r_statelock);
11413                 rp->r_pathconf.pc4_cache_valid = FALSE;
11414                 rp->r_pathconf.pc4_xattr_valid = FALSE;
11415                 mutex_exit(&rp->r_statelock);
11416                 return (error);
11417         }
11418 
11419         /* interpret the max filesize */
11420         gar.n4g_ext_res->n4g_pc4.pc4_filesizebits =
11421             fattr4_maxfilesize_to_bits(gar.n4g_ext_res->n4g_maxfilesize);
11422 
11423         /* Store the attributes we just received */
11424         nfs4_attr_cache(vp, &gar, t, cr, TRUE, NULL);
11425 
11426         switch (cmd) {
11427         case _PC_FILESIZEBITS:
11428                 *valp = gar.n4g_ext_res->n4g_pc4.pc4_filesizebits;
11429                 break;
11430         case _PC_LINK_MAX:
11431                 *valp = gar.n4g_ext_res->n4g_pc4.pc4_link_max;
11432                 break;
11433         case _PC_NAME_MAX:
11434                 *valp = gar.n4g_ext_res->n4g_pc4.pc4_name_max;
11435                 break;
11436         case _PC_CHOWN_RESTRICTED:
11437                 *valp = gar.n4g_ext_res->n4g_pc4.pc4_chown_restricted;
11438                 break;
11439         case _PC_NO_TRUNC:
11440                 *valp = gar.n4g_ext_res->n4g_pc4.pc4_no_trunc;
11441                 break;
11442         case _PC_XATTR_EXISTS:
11443                 if (gar.n4g_ext_res->n4g_pc4.pc4_xattr_exists) {
11444                         if (error = nfs4_have_xattrs(vp, valp, cr))
11445                                 return (error);
11446                 }
11447                 break;
11448         default:
11449                 return (EINVAL);
11450         }
11451 
11452         return (0);
11453 }
11454 
11455 /*
11456  * Called by async thread to do synchronous pageio. Do the i/o, wait
11457  * for it to complete, and cleanup the page list when done.
11458  */
11459 static int
11460 nfs4_sync_pageio(vnode_t *vp, page_t *pp, u_offset_t io_off, size_t io_len,
11461     int flags, cred_t *cr)
11462 {
11463         int error;
11464 
11465         ASSERT(nfs_zone() == VTOMI4(vp)->mi_zone);
11466 
11467         error = nfs4_rdwrlbn(vp, pp, io_off, io_len, flags, cr);
11468         if (flags & B_READ)
11469                 pvn_read_done(pp, (error ? B_ERROR : 0) | flags);
11470         else
11471                 pvn_write_done(pp, (error ? B_ERROR : 0) | flags);
11472         return (error);
11473 }
11474 
11475 /* ARGSUSED */
11476 static int
11477 nfs4_pageio(vnode_t *vp, page_t *pp, u_offset_t io_off, size_t io_len,
11478         int flags, cred_t *cr, caller_context_t *ct)
11479 {
11480         int error;
11481         rnode4_t *rp;
11482 
11483         if (!(flags & B_ASYNC) && nfs_zone() != VTOMI4(vp)->mi_zone)
11484                 return (EIO);
11485 
11486         if (pp == NULL)
11487                 return (EINVAL);
11488 
11489         rp = VTOR4(vp);
11490         mutex_enter(&rp->r_statelock);
11491         rp->r_count++;
11492         mutex_exit(&rp->r_statelock);
11493 
11494         if (flags & B_ASYNC) {
11495                 error = nfs4_async_pageio(vp, pp, io_off, io_len, flags, cr,
11496                     nfs4_sync_pageio);
11497         } else
11498                 error = nfs4_rdwrlbn(vp, pp, io_off, io_len, flags, cr);
11499         mutex_enter(&rp->r_statelock);
11500         rp->r_count--;
11501         cv_broadcast(&rp->r_cv);
11502         mutex_exit(&rp->r_statelock);
11503         return (error);
11504 }
11505 
11506 /* ARGSUSED */
11507 static void
11508 nfs4_dispose(vnode_t *vp, page_t *pp, int fl, int dn, cred_t *cr,
11509         caller_context_t *ct)
11510 {
11511         int error;
11512         rnode4_t *rp;
11513         page_t *plist;
11514         page_t *pptr;
11515         offset3 offset;
11516         count3 len;
11517         k_sigset_t smask;
11518 
11519         /*
11520          * We should get called with fl equal to either B_FREE or
11521          * B_INVAL.  Any other value is illegal.
11522          *
11523          * The page that we are either supposed to free or destroy
11524          * should be exclusive locked and its io lock should not
11525          * be held.
11526          */
11527         ASSERT(fl == B_FREE || fl == B_INVAL);
11528         ASSERT((PAGE_EXCL(pp) && !page_iolock_assert(pp)) || panicstr);
11529 
11530         rp = VTOR4(vp);
11531 
11532         /*
11533          * If the page doesn't need to be committed or we shouldn't
11534          * even bother attempting to commit it, then just make sure
11535          * that the p_fsdata byte is clear and then either free or
11536          * destroy the page as appropriate.
11537          */
11538         if (pp->p_fsdata == C_NOCOMMIT || (rp->r_flags & R4STALE)) {
11539                 pp->p_fsdata = C_NOCOMMIT;
11540                 if (fl == B_FREE)
11541                         page_free(pp, dn);
11542                 else
11543                         page_destroy(pp, dn);
11544                 return;
11545         }
11546 
11547         /*
11548          * If there is a page invalidation operation going on, then
11549          * if this is one of the pages being destroyed, then just
11550          * clear the p_fsdata byte and then either free or destroy
11551          * the page as appropriate.
11552          */
11553         mutex_enter(&rp->r_statelock);
11554         if ((rp->r_flags & R4TRUNCATE) && pp->p_offset >= rp->r_truncaddr) {
11555                 mutex_exit(&rp->r_statelock);
11556                 pp->p_fsdata = C_NOCOMMIT;
11557                 if (fl == B_FREE)
11558                         page_free(pp, dn);
11559                 else
11560                         page_destroy(pp, dn);
11561                 return;
11562         }
11563 
11564         /*
11565          * If we are freeing this page and someone else is already
11566          * waiting to do a commit, then just unlock the page and
11567          * return.  That other thread will take care of commiting
11568          * this page.  The page can be freed sometime after the
11569          * commit has finished.  Otherwise, if the page is marked
11570          * as delay commit, then we may be getting called from
11571          * pvn_write_done, one page at a time.   This could result
11572          * in one commit per page, so we end up doing lots of small
11573          * commits instead of fewer larger commits.  This is bad,
11574          * we want do as few commits as possible.
11575          */
11576         if (fl == B_FREE) {
11577                 if (rp->r_flags & R4COMMITWAIT) {
11578                         page_unlock(pp);
11579                         mutex_exit(&rp->r_statelock);
11580                         return;
11581                 }
11582                 if (pp->p_fsdata == C_DELAYCOMMIT) {
11583                         pp->p_fsdata = C_COMMIT;
11584                         page_unlock(pp);
11585                         mutex_exit(&rp->r_statelock);
11586                         return;
11587                 }
11588         }
11589 
11590         /*
11591          * Check to see if there is a signal which would prevent an
11592          * attempt to commit the pages from being successful.  If so,
11593          * then don't bother with all of the work to gather pages and
11594          * generate the unsuccessful RPC.  Just return from here and
11595          * let the page be committed at some later time.
11596          */
11597         sigintr(&smask, VTOMI4(vp)->mi_flags & MI4_INT);
11598         if (ttolwp(curthread) != NULL && ISSIG(curthread, JUSTLOOKING)) {
11599                 sigunintr(&smask);
11600                 page_unlock(pp);
11601                 mutex_exit(&rp->r_statelock);
11602                 return;
11603         }
11604         sigunintr(&smask);
11605 
11606         /*
11607          * We are starting to need to commit pages, so let's try
11608          * to commit as many as possible at once to reduce the
11609          * overhead.
11610          *
11611          * Set the `commit inprogress' state bit.  We must
11612          * first wait until any current one finishes.  Then
11613          * we initialize the c_pages list with this page.
11614          */
11615         while (rp->r_flags & R4COMMIT) {
11616                 rp->r_flags |= R4COMMITWAIT;
11617                 cv_wait(&rp->r_commit.c_cv, &rp->r_statelock);
11618                 rp->r_flags &= ~R4COMMITWAIT;
11619         }
11620         rp->r_flags |= R4COMMIT;
11621         mutex_exit(&rp->r_statelock);
11622         ASSERT(rp->r_commit.c_pages == NULL);
11623         rp->r_commit.c_pages = pp;
11624         rp->r_commit.c_commbase = (offset3)pp->p_offset;
11625         rp->r_commit.c_commlen = PAGESIZE;
11626 
11627         /*
11628          * Gather together all other pages which can be committed.
11629          * They will all be chained off r_commit.c_pages.
11630          */
11631         nfs4_get_commit(vp);
11632 
11633         /*
11634          * Clear the `commit inprogress' status and disconnect
11635          * the list of pages to be committed from the rnode.
11636          * At this same time, we also save the starting offset
11637          * and length of data to be committed on the server.
11638          */
11639         plist = rp->r_commit.c_pages;
11640         rp->r_commit.c_pages = NULL;
11641         offset = rp->r_commit.c_commbase;
11642         len = rp->r_commit.c_commlen;
11643         mutex_enter(&rp->r_statelock);
11644         rp->r_flags &= ~R4COMMIT;
11645         cv_broadcast(&rp->r_commit.c_cv);
11646         mutex_exit(&rp->r_statelock);
11647 
11648         if (curproc == proc_pageout || curproc == proc_fsflush ||
11649             nfs_zone() != VTOMI4(vp)->mi_zone) {
11650                 nfs4_async_commit(vp, plist, offset, len,
11651                     cr, do_nfs4_async_commit);
11652                 return;
11653         }
11654 
11655         /*
11656          * Actually generate the COMMIT op over the wire operation.
11657          */
11658         error = nfs4_commit(vp, (offset4)offset, (count4)len, cr);
11659 
11660         /*
11661          * If we got an error during the commit, just unlock all
11662          * of the pages.  The pages will get retransmitted to the
11663          * server during a putpage operation.
11664          */
11665         if (error) {
11666                 while (plist != NULL) {
11667                         pptr = plist;
11668                         page_sub(&plist, pptr);
11669                         page_unlock(pptr);
11670                 }
11671                 return;
11672         }
11673 
11674         /*
11675          * We've tried as hard as we can to commit the data to stable
11676          * storage on the server.  We just unlock the rest of the pages
11677          * and clear the commit required state.  They will be put
11678          * onto the tail of the cachelist if they are nolonger
11679          * mapped.
11680          */
11681         while (plist != pp) {
11682                 pptr = plist;
11683                 page_sub(&plist, pptr);
11684                 pptr->p_fsdata = C_NOCOMMIT;
11685                 page_unlock(pptr);
11686         }
11687 
11688         /*
11689          * It is possible that nfs4_commit didn't return error but
11690          * some other thread has modified the page we are going
11691          * to free/destroy.
11692          *    In this case we need to rewrite the page. Do an explicit check
11693          * before attempting to free/destroy the page. If modified, needs to
11694          * be rewritten so unlock the page and return.
11695          */
11696         if (hat_ismod(pp)) {
11697                 pp->p_fsdata = C_NOCOMMIT;
11698                 page_unlock(pp);
11699                 return;
11700         }
11701 
11702         /*
11703          * Now, as appropriate, either free or destroy the page
11704          * that we were called with.
11705          */
11706         pp->p_fsdata = C_NOCOMMIT;
11707         if (fl == B_FREE)
11708                 page_free(pp, dn);
11709         else
11710                 page_destroy(pp, dn);
11711 }
11712 
11713 /*
11714  * Commit requires that the current fh be the file written to.
11715  * The compound op structure is:
11716  *      PUTFH(file), COMMIT
11717  */
11718 static int
11719 nfs4_commit(vnode_t *vp, offset4 offset, count4 count, cred_t *cr)
11720 {
11721         COMPOUND4args_clnt args;
11722         COMPOUND4res_clnt res;
11723         COMMIT4res *cm_res;
11724         nfs_argop4 argop[2];
11725         nfs_resop4 *resop;
11726         int doqueue;
11727         mntinfo4_t *mi;
11728         rnode4_t *rp;
11729         cred_t *cred_otw = NULL;
11730         bool_t needrecov = FALSE;
11731         nfs4_recov_state_t recov_state;
11732         nfs4_open_stream_t *osp = NULL;
11733         bool_t first_time = TRUE;       /* first time getting OTW cred */
11734         bool_t last_time = FALSE;       /* last time getting OTW cred */
11735         nfs4_error_t e = { 0, NFS4_OK, RPC_SUCCESS };
11736 
11737         ASSERT(nfs_zone() == VTOMI4(vp)->mi_zone);
11738 
11739         rp = VTOR4(vp);
11740 
11741         mi = VTOMI4(vp);
11742         recov_state.rs_flags = 0;
11743         recov_state.rs_num_retry_despite_err = 0;
11744 get_commit_cred:
11745         /*
11746          * Releases the osp, if a valid open stream is provided.
11747          * Puts a hold on the cred_otw and the new osp (if found).
11748          */
11749         cred_otw = nfs4_get_otw_cred_by_osp(rp, cr, &osp,
11750             &first_time, &last_time);
11751         args.ctag = TAG_COMMIT;
11752 recov_retry:
11753         /*
11754          * Commit ops: putfh file; commit
11755          */
11756         args.array_len = 2;
11757         args.array = argop;
11758 
11759         e.error = nfs4_start_fop(VTOMI4(vp), vp, NULL, OH_COMMIT,
11760             &recov_state, NULL);
11761         if (e.error) {
11762                 crfree(cred_otw);
11763                 if (osp != NULL)
11764                         open_stream_rele(osp, rp);
11765                 return (e.error);
11766         }
11767 
11768         /* putfh directory */
11769         argop[0].argop = OP_CPUTFH;
11770         argop[0].nfs_argop4_u.opcputfh.sfh = rp->r_fh;
11771 
11772         /* commit */
11773         argop[1].argop = OP_COMMIT;
11774         argop[1].nfs_argop4_u.opcommit.offset = offset;
11775         argop[1].nfs_argop4_u.opcommit.count = count;
11776 
11777         doqueue = 1;
11778         rfs4call(mi, &args, &res, cred_otw, &doqueue, 0, &e);
11779 
11780         needrecov = nfs4_needs_recovery(&e, FALSE, mi->mi_vfsp);
11781         if (!needrecov && e.error) {
11782                 nfs4_end_fop(VTOMI4(vp), vp, NULL, OH_COMMIT, &recov_state,
11783                     needrecov);
11784                 crfree(cred_otw);
11785                 if (e.error == EACCES && last_time == FALSE)
11786                         goto get_commit_cred;
11787                 if (osp != NULL)
11788                         open_stream_rele(osp, rp);
11789                 return (e.error);
11790         }
11791 
11792         if (needrecov) {
11793                 if (nfs4_start_recovery(&e, VTOMI4(vp), vp, NULL, NULL,
11794                     NULL, OP_COMMIT, NULL, NULL, NULL) == FALSE) {
11795                         nfs4_end_fop(VTOMI4(vp), vp, NULL, OH_COMMIT,
11796                             &recov_state, needrecov);
11797                         if (!e.error)
11798                                 (void) xdr_free(xdr_COMPOUND4res_clnt,
11799                                     (caddr_t)&res);
11800                         goto recov_retry;
11801                 }
11802                 if (e.error) {
11803                         nfs4_end_fop(VTOMI4(vp), vp, NULL, OH_COMMIT,
11804                             &recov_state, needrecov);
11805                         crfree(cred_otw);
11806                         if (osp != NULL)
11807                                 open_stream_rele(osp, rp);
11808                         return (e.error);
11809                 }
11810                 /* fall through for res.status case */
11811         }
11812 
11813         if (res.status) {
11814                 e.error = geterrno4(res.status);
11815                 if (e.error == EACCES && last_time == FALSE) {
11816                         crfree(cred_otw);
11817                         nfs4_end_fop(VTOMI4(vp), vp, NULL, OH_COMMIT,
11818                             &recov_state, needrecov);
11819                         (void) xdr_free(xdr_COMPOUND4res_clnt, (caddr_t)&res);
11820                         goto get_commit_cred;
11821                 }
11822                 /*
11823                  * Can't do a nfs4_purge_stale_fh here because this
11824                  * can cause a deadlock.  nfs4_commit can
11825                  * be called from nfs4_dispose which can be called
11826                  * indirectly via pvn_vplist_dirty.  nfs4_purge_stale_fh
11827                  * can call back to pvn_vplist_dirty.
11828                  */
11829                 if (e.error == ESTALE) {
11830                         mutex_enter(&rp->r_statelock);
11831                         rp->r_flags |= R4STALE;
11832                         if (!rp->r_error)
11833                                 rp->r_error = e.error;
11834                         mutex_exit(&rp->r_statelock);
11835                         PURGE_ATTRCACHE4(vp);
11836                 } else {
11837                         mutex_enter(&rp->r_statelock);
11838                         if (!rp->r_error)
11839                                 rp->r_error = e.error;
11840                         mutex_exit(&rp->r_statelock);
11841                 }
11842         } else {
11843                 ASSERT(rp->r_flags & R4HAVEVERF);
11844                 resop = &res.array[1];      /* commit res */
11845                 cm_res = &resop->nfs_resop4_u.opcommit;
11846                 mutex_enter(&rp->r_statelock);
11847                 if (cm_res->writeverf == rp->r_writeverf) {
11848                         mutex_exit(&rp->r_statelock);
11849                         (void) xdr_free(xdr_COMPOUND4res_clnt, (caddr_t)&res);
11850                         nfs4_end_fop(VTOMI4(vp), vp, NULL, OH_COMMIT,
11851                             &recov_state, needrecov);
11852                         crfree(cred_otw);
11853                         if (osp != NULL)
11854                                 open_stream_rele(osp, rp);
11855                         return (0);
11856                 }
11857                 nfs4_set_mod(vp);
11858                 rp->r_writeverf = cm_res->writeverf;
11859                 mutex_exit(&rp->r_statelock);
11860                 e.error = NFS_VERF_MISMATCH;
11861         }
11862 
11863         (void) xdr_free(xdr_COMPOUND4res_clnt, (caddr_t)&res);
11864         nfs4_end_fop(VTOMI4(vp), vp, NULL, OH_COMMIT, &recov_state, needrecov);
11865         crfree(cred_otw);
11866         if (osp != NULL)
11867                 open_stream_rele(osp, rp);
11868 
11869         return (e.error);
11870 }
11871 
11872 static void
11873 nfs4_set_mod(vnode_t *vp)
11874 {
11875         ASSERT(nfs_zone() == VTOMI4(vp)->mi_zone);
11876 
11877         /* make sure we're looking at the master vnode, not a shadow */
11878         pvn_vplist_setdirty(RTOV4(VTOR4(vp)), nfs_setmod_check);
11879 }
11880 
11881 /*
11882  * This function is used to gather a page list of the pages which
11883  * can be committed on the server.
11884  *
11885  * The calling thread must have set R4COMMIT.  This bit is used to
11886  * serialize access to the commit structure in the rnode.  As long
11887  * as the thread has set R4COMMIT, then it can manipulate the commit
11888  * structure without requiring any other locks.
11889  *
11890  * When this function is called from nfs4_dispose() the page passed
11891  * into nfs4_dispose() will be SE_EXCL locked, and so this function
11892  * will skip it. This is not a problem since we initially add the
11893  * page to the r_commit page list.
11894  *
11895  */
11896 static void
11897 nfs4_get_commit(vnode_t *vp)
11898 {
11899         rnode4_t *rp;
11900         page_t *pp;
11901         kmutex_t *vphm;
11902 
11903         rp = VTOR4(vp);
11904 
11905         ASSERT(rp->r_flags & R4COMMIT);
11906 
11907         /* make sure we're looking at the master vnode, not a shadow */
11908 
11909         if (IS_SHADOW(vp, rp))
11910                 vp = RTOV4(rp);
11911 
11912         vphm = page_vnode_mutex(vp);
11913         mutex_enter(vphm);
11914 
11915         /*
11916          * If there are no pages associated with this vnode, then
11917          * just return.
11918          */
11919         if ((pp = vp->v_pages) == NULL) {
11920                 mutex_exit(vphm);
11921                 return;
11922         }
11923 
11924         /*
11925          * Step through all of the pages associated with this vnode
11926          * looking for pages which need to be committed.
11927          */
11928         do {
11929                 /* Skip marker pages. */
11930                 if (pp->p_hash == PVN_VPLIST_HASH_TAG)
11931                         continue;
11932 
11933                 /*
11934                  * First short-cut everything (without the page_lock)
11935                  * and see if this page does not need to be committed
11936                  * or is modified if so then we'll just skip it.
11937                  */
11938                 if (pp->p_fsdata == C_NOCOMMIT || hat_ismod(pp))
11939                         continue;
11940 
11941                 /*
11942                  * Attempt to lock the page.  If we can't, then
11943                  * someone else is messing with it or we have been
11944                  * called from nfs4_dispose and this is the page that
11945                  * nfs4_dispose was called with.. anyway just skip it.
11946                  */
11947                 if (!page_trylock(pp, SE_EXCL))
11948                         continue;
11949 
11950                 /*
11951                  * Lets check again now that we have the page lock.
11952                  */
11953                 if (pp->p_fsdata == C_NOCOMMIT || hat_ismod(pp)) {
11954                         page_unlock(pp);
11955                         continue;
11956                 }
11957 
11958                 /* this had better not be a free page */
11959                 ASSERT(PP_ISFREE(pp) == 0);
11960 
11961                 /*
11962                  * The page needs to be committed and we locked it.
11963                  * Update the base and length parameters and add it
11964                  * to r_pages.
11965                  */
11966                 if (rp->r_commit.c_pages == NULL) {
11967                         rp->r_commit.c_commbase = (offset3)pp->p_offset;
11968                         rp->r_commit.c_commlen = PAGESIZE;
11969                 } else if (pp->p_offset < rp->r_commit.c_commbase) {
11970                         rp->r_commit.c_commlen = rp->r_commit.c_commbase -
11971                             (offset3)pp->p_offset + rp->r_commit.c_commlen;
11972                         rp->r_commit.c_commbase = (offset3)pp->p_offset;
11973                 } else if ((rp->r_commit.c_commbase + rp->r_commit.c_commlen)
11974                     <= pp->p_offset) {
11975                         rp->r_commit.c_commlen = (offset3)pp->p_offset -
11976                             rp->r_commit.c_commbase + PAGESIZE;
11977                 }
11978                 page_add(&rp->r_commit.c_pages, pp);
11979         } while ((pp = pp->p_vpnext) != vp->v_pages);
11980 
11981         mutex_exit(vphm);
11982 }
11983 
11984 /*
11985  * This routine is used to gather together a page list of the pages
11986  * which are to be committed on the server.  This routine must not
11987  * be called if the calling thread holds any locked pages.
11988  *
11989  * The calling thread must have set R4COMMIT.  This bit is used to
11990  * serialize access to the commit structure in the rnode.  As long
11991  * as the thread has set R4COMMIT, then it can manipulate the commit
11992  * structure without requiring any other locks.
11993  */
11994 static void
11995 nfs4_get_commit_range(vnode_t *vp, u_offset_t soff, size_t len)
11996 {
11997 
11998         rnode4_t *rp;
11999         page_t *pp;
12000         u_offset_t end;
12001         u_offset_t off;
12002         ASSERT(len != 0);
12003         rp = VTOR4(vp);
12004         ASSERT(rp->r_flags & R4COMMIT);
12005 
12006         ASSERT(nfs_zone() == VTOMI4(vp)->mi_zone);
12007 
12008         /* make sure we're looking at the master vnode, not a shadow */
12009 
12010         if (IS_SHADOW(vp, rp))
12011                 vp = RTOV4(rp);
12012 
12013         /*
12014          * If there are no pages associated with this vnode, then
12015          * just return.
12016          */
12017         if ((pp = vp->v_pages) == NULL)
12018                 return;
12019         /*
12020          * Calculate the ending offset.
12021          */
12022         end = soff + len;
12023         for (off = soff; off < end; off += PAGESIZE) {
12024                 /*
12025                  * Lookup each page by vp, offset.
12026                  */
12027                 if ((pp = page_lookup_nowait(vp, off, SE_EXCL)) == NULL)
12028                         continue;
12029                 /*
12030                  * If this page does not need to be committed or is
12031                  * modified, then just skip it.
12032                  */
12033                 if (pp->p_fsdata == C_NOCOMMIT || hat_ismod(pp)) {
12034                         page_unlock(pp);
12035                         continue;
12036                 }
12037 
12038                 ASSERT(PP_ISFREE(pp) == 0);
12039                 /*
12040                  * The page needs to be committed and we locked it.
12041                  * Update the base and length parameters and add it
12042                  * to r_pages.
12043                  */
12044                 if (rp->r_commit.c_pages == NULL) {
12045                         rp->r_commit.c_commbase = (offset3)pp->p_offset;
12046                         rp->r_commit.c_commlen = PAGESIZE;
12047                 } else {
12048                         rp->r_commit.c_commlen = (offset3)pp->p_offset -
12049                             rp->r_commit.c_commbase + PAGESIZE;
12050                 }
12051                 page_add(&rp->r_commit.c_pages, pp);
12052         }
12053 }
12054 
12055 /*
12056  * Called from nfs4_close(), nfs4_fsync() and nfs4_delmap().
12057  * Flushes and commits data to the server.
12058  */
12059 static int
12060 nfs4_putpage_commit(vnode_t *vp, offset_t poff, size_t plen, cred_t *cr)
12061 {
12062         int error;
12063         verifier4 write_verf;
12064         rnode4_t *rp = VTOR4(vp);
12065 
12066         ASSERT(nfs_zone() == VTOMI4(vp)->mi_zone);
12067 
12068         /*
12069          * Flush the data portion of the file and then commit any
12070          * portions which need to be committed.  This may need to
12071          * be done twice if the server has changed state since
12072          * data was last written.  The data will need to be
12073          * rewritten to the server and then a new commit done.
12074          *
12075          * In fact, this may need to be done several times if the
12076          * server is having problems and crashing while we are
12077          * attempting to do this.
12078          */
12079 
12080 top:
12081         /*
12082          * Do a flush based on the poff and plen arguments.  This
12083          * will synchronously write out any modified pages in the
12084          * range specified by (poff, plen). This starts all of the
12085          * i/o operations which will be waited for in the next
12086          * call to nfs4_putpage
12087          */
12088 
12089         mutex_enter(&rp->r_statelock);
12090         write_verf = rp->r_writeverf;
12091         mutex_exit(&rp->r_statelock);
12092 
12093         error = nfs4_putpage(vp, poff, plen, B_ASYNC, cr, NULL);
12094         if (error == EAGAIN)
12095                 error = 0;
12096 
12097         /*
12098          * Do a flush based on the poff and plen arguments.  This
12099          * will synchronously write out any modified pages in the
12100          * range specified by (poff, plen) and wait until all of
12101          * the asynchronous i/o's in that range are done as well.
12102          */
12103         if (!error)
12104                 error = nfs4_putpage(vp, poff, plen, 0, cr, NULL);
12105 
12106         if (error)
12107                 return (error);
12108 
12109         mutex_enter(&rp->r_statelock);
12110         if (rp->r_writeverf != write_verf) {
12111                 mutex_exit(&rp->r_statelock);
12112                 goto top;
12113         }
12114         mutex_exit(&rp->r_statelock);
12115 
12116         /*
12117          * Now commit any pages which might need to be committed.
12118          * If the error, NFS_VERF_MISMATCH, is returned, then
12119          * start over with the flush operation.
12120          */
12121         error = nfs4_commit_vp(vp, poff, plen, cr, NFS4_WRITE_WAIT);
12122 
12123         if (error == NFS_VERF_MISMATCH)
12124                 goto top;
12125 
12126         return (error);
12127 }
12128 
12129 /*
12130  * nfs4_commit_vp()  will wait for other pending commits and
12131  * will either commit the whole file or a range, plen dictates
12132  * if we commit whole file. a value of zero indicates the whole
12133  * file. Called from nfs4_putpage_commit() or nfs4_sync_putapage()
12134  */
12135 static int
12136 nfs4_commit_vp(vnode_t *vp, u_offset_t poff, size_t plen,
12137     cred_t *cr, int wait_on_writes)
12138 {
12139         rnode4_t *rp;
12140         page_t *plist;
12141         offset3 offset;
12142         count3 len;
12143 
12144         ASSERT(nfs_zone() == VTOMI4(vp)->mi_zone);
12145 
12146         rp = VTOR4(vp);
12147 
12148         /*
12149          *  before we gather commitable pages make
12150          *  sure there are no outstanding async writes
12151          */
12152         if (rp->r_count && wait_on_writes == NFS4_WRITE_WAIT) {
12153                 mutex_enter(&rp->r_statelock);
12154                 while (rp->r_count > 0) {
12155                         cv_wait(&rp->r_cv, &rp->r_statelock);
12156                 }
12157                 mutex_exit(&rp->r_statelock);
12158         }
12159 
12160         /*
12161          * Set the `commit inprogress' state bit.  We must
12162          * first wait until any current one finishes.
12163          */
12164         mutex_enter(&rp->r_statelock);
12165         while (rp->r_flags & R4COMMIT) {
12166                 rp->r_flags |= R4COMMITWAIT;
12167                 cv_wait(&rp->r_commit.c_cv, &rp->r_statelock);
12168                 rp->r_flags &= ~R4COMMITWAIT;
12169         }
12170         rp->r_flags |= R4COMMIT;
12171         mutex_exit(&rp->r_statelock);
12172 
12173         /*
12174          * Gather all of the pages which need to be
12175          * committed.
12176          */
12177         if (plen == 0)
12178                 nfs4_get_commit(vp);
12179         else
12180                 nfs4_get_commit_range(vp, poff, plen);
12181 
12182         /*
12183          * Clear the `commit inprogress' bit and disconnect the
12184          * page list which was gathered by nfs4_get_commit.
12185          */
12186         plist = rp->r_commit.c_pages;
12187         rp->r_commit.c_pages = NULL;
12188         offset = rp->r_commit.c_commbase;
12189         len = rp->r_commit.c_commlen;
12190         mutex_enter(&rp->r_statelock);
12191         rp->r_flags &= ~R4COMMIT;
12192         cv_broadcast(&rp->r_commit.c_cv);
12193         mutex_exit(&rp->r_statelock);
12194 
12195         /*
12196          * If any pages need to be committed, commit them and
12197          * then unlock them so that they can be freed some
12198          * time later.
12199          */
12200         if (plist == NULL)
12201                 return (0);
12202 
12203         /*
12204          * No error occurred during the flush portion
12205          * of this operation, so now attempt to commit
12206          * the data to stable storage on the server.
12207          *
12208          * This will unlock all of the pages on the list.
12209          */
12210         return (nfs4_sync_commit(vp, plist, offset, len, cr));
12211 }
12212 
12213 static int
12214 nfs4_sync_commit(vnode_t *vp, page_t *plist, offset3 offset, count3 count,
12215     cred_t *cr)
12216 {
12217         int error;
12218         page_t *pp;
12219 
12220         ASSERT(nfs_zone() == VTOMI4(vp)->mi_zone);
12221 
12222         error = nfs4_commit(vp, (offset4)offset, (count3)count, cr);
12223 
12224         /*
12225          * If we got an error, then just unlock all of the pages
12226          * on the list.
12227          */
12228         if (error) {
12229                 while (plist != NULL) {
12230                         pp = plist;
12231                         page_sub(&plist, pp);
12232                         page_unlock(pp);
12233                 }
12234                 return (error);
12235         }
12236         /*
12237          * We've tried as hard as we can to commit the data to stable
12238          * storage on the server.  We just unlock the pages and clear
12239          * the commit required state.  They will get freed later.
12240          */
12241         while (plist != NULL) {
12242                 pp = plist;
12243                 page_sub(&plist, pp);
12244                 pp->p_fsdata = C_NOCOMMIT;
12245                 page_unlock(pp);
12246         }
12247 
12248         return (error);
12249 }
12250 
12251 static void
12252 do_nfs4_async_commit(vnode_t *vp, page_t *plist, offset3 offset, count3 count,
12253     cred_t *cr)
12254 {
12255 
12256         (void) nfs4_sync_commit(vp, plist, offset, count, cr);
12257 }
12258 
12259 /*ARGSUSED*/
12260 static int
12261 nfs4_setsecattr(vnode_t *vp, vsecattr_t *vsecattr, int flag, cred_t *cr,
12262         caller_context_t *ct)
12263 {
12264         int             error = 0;
12265         mntinfo4_t      *mi;
12266         vattr_t         va;
12267         vsecattr_t      nfsace4_vsap;
12268 
12269         mi = VTOMI4(vp);
12270         if (nfs_zone() != mi->mi_zone)
12271                 return (EIO);
12272         if (mi->mi_flags & MI4_ACL) {
12273                 /* if we have a delegation, return it */
12274                 if (VTOR4(vp)->r_deleg_type != OPEN_DELEGATE_NONE)
12275                         (void) nfs4delegreturn(VTOR4(vp),
12276                             NFS4_DR_REOPEN|NFS4_DR_PUSH);
12277 
12278                 error = nfs4_is_acl_mask_valid(vsecattr->vsa_mask,
12279                     NFS4_ACL_SET);
12280                 if (error) /* EINVAL */
12281                         return (error);
12282 
12283                 if (vsecattr->vsa_mask & (VSA_ACL | VSA_DFACL)) {
12284                         /*
12285                          * These are aclent_t type entries.
12286                          */
12287                         error = vs_aent_to_ace4(vsecattr, &nfsace4_vsap,
12288                             vp->v_type == VDIR, FALSE);
12289                         if (error)
12290                                 return (error);
12291                 } else {
12292                         /*
12293                          * These are ace_t type entries.
12294                          */
12295                         error = vs_acet_to_ace4(vsecattr, &nfsace4_vsap,
12296                             FALSE);
12297                         if (error)
12298                                 return (error);
12299                 }
12300                 bzero(&va, sizeof (va));
12301                 error = nfs4setattr(vp, &va, flag, cr, &nfsace4_vsap);
12302                 vs_ace4_destroy(&nfsace4_vsap);
12303                 return (error);
12304         }
12305         return (ENOSYS);
12306 }
12307 
12308 /* ARGSUSED */
12309 int
12310 nfs4_getsecattr(vnode_t *vp, vsecattr_t *vsecattr, int flag, cred_t *cr,
12311         caller_context_t *ct)
12312 {
12313         int             error;
12314         mntinfo4_t      *mi;
12315         nfs4_ga_res_t   gar;
12316         rnode4_t        *rp = VTOR4(vp);
12317 
12318         mi = VTOMI4(vp);
12319         if (nfs_zone() != mi->mi_zone)
12320                 return (EIO);
12321 
12322         bzero(&gar, sizeof (gar));
12323         gar.n4g_vsa.vsa_mask = vsecattr->vsa_mask;
12324 
12325         /*
12326          * vsecattr->vsa_mask holds the original acl request mask.
12327          * This is needed when determining what to return.
12328          * (See: nfs4_create_getsecattr_return())
12329          */
12330         error = nfs4_is_acl_mask_valid(vsecattr->vsa_mask, NFS4_ACL_GET);
12331         if (error) /* EINVAL */
12332                 return (error);
12333 
12334         /*
12335          * If this is a referral stub, don't try to go OTW for an ACL
12336          */
12337         if (RP_ISSTUB_REFERRAL(VTOR4(vp)))
12338                 return (fs_fab_acl(vp, vsecattr, flag, cr, ct));
12339 
12340         if (mi->mi_flags & MI4_ACL) {
12341                 /*
12342                  * Check if the data is cached and the cache is valid.  If it
12343                  * is we don't go over the wire.
12344                  */
12345                 if (rp->r_secattr != NULL && ATTRCACHE4_VALID(vp)) {
12346                         mutex_enter(&rp->r_statelock);
12347                         if (rp->r_secattr != NULL) {
12348                                 error = nfs4_create_getsecattr_return(
12349                                     rp->r_secattr, vsecattr, rp->r_attr.va_uid,
12350                                     rp->r_attr.va_gid,
12351                                     vp->v_type == VDIR);
12352                                 if (!error) { /* error == 0 - Success! */
12353                                         mutex_exit(&rp->r_statelock);
12354                                         return (error);
12355                                 }
12356                         }
12357                         mutex_exit(&rp->r_statelock);
12358                 }
12359 
12360                 /*
12361                  * The getattr otw call will always get both the acl, in
12362                  * the form of a list of nfsace4's, and the number of acl
12363                  * entries; independent of the value of gar.n4g_vsa.vsa_mask.
12364                  */
12365                 gar.n4g_va.va_mask = AT_ALL;
12366                 error =  nfs4_getattr_otw(vp, &gar, cr, 1);
12367                 if (error) {
12368                         vs_ace4_destroy(&gar.n4g_vsa);
12369                         if (error == ENOTSUP || error == EOPNOTSUPP)
12370                                 error = fs_fab_acl(vp, vsecattr, flag, cr, ct);
12371                         return (error);
12372                 }
12373 
12374                 if (!(gar.n4g_resbmap & FATTR4_ACL_MASK)) {
12375                         /*
12376                          * No error was returned, but according to the response
12377                          * bitmap, neither was an acl.
12378                          */
12379                         vs_ace4_destroy(&gar.n4g_vsa);
12380                         error = fs_fab_acl(vp, vsecattr, flag, cr, ct);
12381                         return (error);
12382                 }
12383 
12384                 /*
12385                  * Update the cache with the ACL.
12386                  */
12387                 nfs4_acl_fill_cache(rp, &gar.n4g_vsa);
12388 
12389                 error = nfs4_create_getsecattr_return(&gar.n4g_vsa,
12390                     vsecattr, gar.n4g_va.va_uid, gar.n4g_va.va_gid,
12391                     vp->v_type == VDIR);
12392                 vs_ace4_destroy(&gar.n4g_vsa);
12393                 if ((error) && (vsecattr->vsa_mask &
12394                     (VSA_ACL | VSA_ACLCNT | VSA_DFACL | VSA_DFACLCNT)) &&
12395                     (error != EACCES)) {
12396                         error = fs_fab_acl(vp, vsecattr, flag, cr, ct);
12397                 }
12398                 return (error);
12399         }
12400         error = fs_fab_acl(vp, vsecattr, flag, cr, ct);
12401         return (error);
12402 }
12403 
12404 /*
12405  * The function returns:
12406  *      - 0 (zero) if the passed in "acl_mask" is a valid request.
12407  *      - EINVAL if the passed in "acl_mask" is an invalid request.
12408  *
12409  * In the case of getting an acl (op == NFS4_ACL_GET) the mask is invalid if:
12410  * - We have a mixture of ACE and ACL requests (e.g. VSA_ACL | VSA_ACE)
12411  *
12412  * In the case of setting an acl (op == NFS4_ACL_SET) the mask is invalid if:
12413  * - We have a mixture of ACE and ACL requests (e.g. VSA_ACL | VSA_ACE)
12414  * - We have a count field set without the corresponding acl field set. (e.g. -
12415  * VSA_ACECNT is set, but VSA_ACE is not)
12416  */
12417 static int
12418 nfs4_is_acl_mask_valid(uint_t acl_mask, nfs4_acl_op_t op)
12419 {
12420         /* Shortcut the masks that are always valid. */
12421         if (acl_mask == (VSA_ACE | VSA_ACECNT))
12422                 return (0);
12423         if (acl_mask == (VSA_ACL | VSA_ACLCNT | VSA_DFACL | VSA_DFACLCNT))
12424                 return (0);
12425 
12426         if (acl_mask & (VSA_ACE | VSA_ACECNT)) {
12427                 /*
12428                  * We can't have any VSA_ACL type stuff in the mask now.
12429                  */
12430                 if (acl_mask & (VSA_ACL | VSA_ACLCNT | VSA_DFACL |
12431                     VSA_DFACLCNT))
12432                         return (EINVAL);
12433 
12434                 if (op == NFS4_ACL_SET) {
12435                         if ((acl_mask & VSA_ACECNT) && !(acl_mask & VSA_ACE))
12436                                 return (EINVAL);
12437                 }
12438         }
12439 
12440         if (acl_mask & (VSA_ACL | VSA_ACLCNT | VSA_DFACL | VSA_DFACLCNT)) {
12441                 /*
12442                  * We can't have any VSA_ACE type stuff in the mask now.
12443                  */
12444                 if (acl_mask & (VSA_ACE | VSA_ACECNT))
12445                         return (EINVAL);
12446 
12447                 if (op == NFS4_ACL_SET) {
12448                         if ((acl_mask & VSA_ACLCNT) && !(acl_mask & VSA_ACL))
12449                                 return (EINVAL);
12450 
12451                         if ((acl_mask & VSA_DFACLCNT) &&
12452                             !(acl_mask & VSA_DFACL))
12453                                 return (EINVAL);
12454                 }
12455         }
12456         return (0);
12457 }
12458 
12459 /*
12460  * The theory behind creating the correct getsecattr return is simply this:
12461  * "Don't return anything that the caller is not expecting to have to free."
12462  */
12463 static int
12464 nfs4_create_getsecattr_return(vsecattr_t *filled_vsap, vsecattr_t *vsap,
12465     uid_t uid, gid_t gid, int isdir)
12466 {
12467         int error = 0;
12468         /* Save the mask since the translators modify it. */
12469         uint_t  orig_mask = vsap->vsa_mask;
12470 
12471         if (orig_mask & (VSA_ACE | VSA_ACECNT)) {
12472                 error = vs_ace4_to_acet(filled_vsap, vsap, uid, gid, FALSE);
12473 
12474                 if (error)
12475                         return (error);
12476 
12477                 /*
12478                  * If the caller only asked for the ace count (VSA_ACECNT)
12479                  * don't give them the full acl (VSA_ACE), free it.
12480                  */
12481                 if (!orig_mask & VSA_ACE) {
12482                         if (vsap->vsa_aclentp != NULL) {
12483                                 kmem_free(vsap->vsa_aclentp,
12484                                     vsap->vsa_aclcnt * sizeof (ace_t));
12485                                 vsap->vsa_aclentp = NULL;
12486                         }
12487                 }
12488                 vsap->vsa_mask = orig_mask;
12489 
12490         } else if (orig_mask & (VSA_ACL | VSA_ACLCNT | VSA_DFACL |
12491             VSA_DFACLCNT)) {
12492                 error = vs_ace4_to_aent(filled_vsap, vsap, uid, gid,
12493                     isdir, FALSE);
12494 
12495                 if (error)
12496                         return (error);
12497 
12498                 /*
12499                  * If the caller only asked for the acl count (VSA_ACLCNT)
12500                  * and/or the default acl count (VSA_DFACLCNT) don't give them
12501                  * the acl (VSA_ACL) or default acl (VSA_DFACL), free it.
12502                  */
12503                 if (!orig_mask & VSA_ACL) {
12504                         if (vsap->vsa_aclentp != NULL) {
12505                                 kmem_free(vsap->vsa_aclentp,
12506                                     vsap->vsa_aclcnt * sizeof (aclent_t));
12507                                 vsap->vsa_aclentp = NULL;
12508                         }
12509                 }
12510 
12511                 if (!orig_mask & VSA_DFACL) {
12512                         if (vsap->vsa_dfaclentp != NULL) {
12513                                 kmem_free(vsap->vsa_dfaclentp,
12514                                     vsap->vsa_dfaclcnt * sizeof (aclent_t));
12515                                 vsap->vsa_dfaclentp = NULL;
12516                         }
12517                 }
12518                 vsap->vsa_mask = orig_mask;
12519         }
12520         return (0);
12521 }
12522 
12523 /* ARGSUSED */
12524 int
12525 nfs4_shrlock(vnode_t *vp, int cmd, struct shrlock *shr, int flag, cred_t *cr,
12526     caller_context_t *ct)
12527 {
12528         int error;
12529 
12530         if (nfs_zone() != VTOMI4(vp)->mi_zone)
12531                 return (EIO);
12532         /*
12533          * check for valid cmd parameter
12534          */
12535         if (cmd != F_SHARE && cmd != F_UNSHARE && cmd != F_HASREMOTELOCKS)
12536                 return (EINVAL);
12537 
12538         /*
12539          * Check access permissions
12540          */
12541         if ((cmd & F_SHARE) &&
12542             (((shr->s_access & F_RDACC) && (flag & FREAD) == 0) ||
12543             (shr->s_access == F_WRACC && (flag & FWRITE) == 0)))
12544                 return (EBADF);
12545 
12546         /*
12547          * If the filesystem is mounted using local locking, pass the
12548          * request off to the local share code.
12549          */
12550         if (VTOMI4(vp)->mi_flags & MI4_LLOCK)
12551                 return (fs_shrlock(vp, cmd, shr, flag, cr, ct));
12552 
12553         switch (cmd) {
12554         case F_SHARE:
12555         case F_UNSHARE:
12556                 /*
12557                  * This will be properly implemented later,
12558                  * see RFE: 4823948 .
12559                  */
12560                 error = EAGAIN;
12561                 break;
12562 
12563         case F_HASREMOTELOCKS:
12564                 /*
12565                  * NFS client can't store remote locks itself
12566                  */
12567                 shr->s_access = 0;
12568                 error = 0;
12569                 break;
12570 
12571         default:
12572                 error = EINVAL;
12573                 break;
12574         }
12575 
12576         return (error);
12577 }
12578 
12579 /*
12580  * Common code called by directory ops to update the attrcache
12581  */
12582 static int
12583 nfs4_update_attrcache(nfsstat4 status, nfs4_ga_res_t *garp,
12584     hrtime_t t, vnode_t *vp, cred_t *cr)
12585 {
12586         int error = 0;
12587 
12588         ASSERT(nfs_zone() == VTOMI4(vp)->mi_zone);
12589 
12590         if (status != NFS4_OK) {
12591                 /* getattr not done or failed */
12592                 PURGE_ATTRCACHE4(vp);
12593                 return (error);
12594         }
12595 
12596         if (garp) {
12597                 nfs4_attr_cache(vp, garp, t, cr, FALSE, NULL);
12598         } else {
12599                 PURGE_ATTRCACHE4(vp);
12600         }
12601         return (error);
12602 }
12603 
12604 /*
12605  * Update directory caches for directory modification ops (link, rename, etc.)
12606  * When dinfo is NULL, manage dircaches in the old way.
12607  */
12608 static void
12609 nfs4_update_dircaches(change_info4 *cinfo, vnode_t *dvp, vnode_t *vp, char *nm,
12610     dirattr_info_t *dinfo)
12611 {
12612         rnode4_t        *drp = VTOR4(dvp);
12613 
12614         ASSERT(nfs_zone() == VTOMI4(dvp)->mi_zone);
12615 
12616         /* Purge rddir cache for dir since it changed */
12617         if (drp->r_dir != NULL)
12618                 nfs4_purge_rddir_cache(dvp);
12619 
12620         /*
12621          * If caller provided dinfo, then use it to manage dir caches.
12622          */
12623         if (dinfo != NULL) {
12624                 if (vp != NULL) {
12625                         mutex_enter(&VTOR4(vp)->r_statev4_lock);
12626                         if (!VTOR4(vp)->created_v4) {
12627                                 mutex_exit(&VTOR4(vp)->r_statev4_lock);
12628                                 dnlc_update(dvp, nm, vp);
12629                         } else {
12630                                 /*
12631                                  * XXX don't update if the created_v4 flag is
12632                                  * set
12633                                  */
12634                                 mutex_exit(&VTOR4(vp)->r_statev4_lock);
12635                                 NFS4_DEBUG(nfs4_client_state_debug,
12636                                     (CE_NOTE, "nfs4_update_dircaches: "
12637                                     "don't update dnlc: created_v4 flag"));
12638                         }
12639                 }
12640 
12641                 nfs4_attr_cache(dvp, dinfo->di_garp, dinfo->di_time_call,
12642                     dinfo->di_cred, FALSE, cinfo);
12643 
12644                 return;
12645         }
12646 
12647         /*
12648          * Caller didn't provide dinfo, then check change_info4 to update DNLC.
12649          * Since caller modified dir but didn't receive post-dirmod-op dir
12650          * attrs, the dir's attrs must be purged.
12651          *
12652          * XXX this check and dnlc update/purge should really be atomic,
12653          * XXX but can't use rnode statelock because it'll deadlock in
12654          * XXX dnlc_purge_vp, however, the risk is minimal even if a race
12655          * XXX does occur.
12656          *
12657          * XXX We also may want to check that atomic is true in the
12658          * XXX change_info struct. If it is not, the change_info may
12659          * XXX reflect changes by more than one clients which means that
12660          * XXX our cache may not be valid.
12661          */
12662         PURGE_ATTRCACHE4(dvp);
12663         if (drp->r_change == cinfo->before) {
12664                 /* no changes took place in the directory prior to our link */
12665                 if (vp != NULL) {
12666                         mutex_enter(&VTOR4(vp)->r_statev4_lock);
12667                         if (!VTOR4(vp)->created_v4) {
12668                                 mutex_exit(&VTOR4(vp)->r_statev4_lock);
12669                                 dnlc_update(dvp, nm, vp);
12670                         } else {
12671                                 /*
12672                                  * XXX dont' update if the created_v4 flag
12673                                  * is set
12674                                  */
12675                                 mutex_exit(&VTOR4(vp)->r_statev4_lock);
12676                                 NFS4_DEBUG(nfs4_client_state_debug, (CE_NOTE,
12677                                     "nfs4_update_dircaches: don't"
12678                                     " update dnlc: created_v4 flag"));
12679                         }
12680                 }
12681         } else {
12682                 /* Another client modified directory - purge its dnlc cache */
12683                 dnlc_purge_vp(dvp);
12684         }
12685 }
12686 
12687 /*
12688  * The OPEN_CONFIRM operation confirms the sequence number used in OPENing a
12689  * file.
12690  *
12691  * The 'reopening_file' boolean should be set to TRUE if we are reopening this
12692  * file (ie: client recovery) and otherwise set to FALSE.
12693  *
12694  * 'nfs4_start/end_op' should have been called by the proper (ie: not recovery
12695  * initiated) calling functions.
12696  *
12697  * 'resend' is set to TRUE if this is a OPEN_CONFIRM issued as a result
12698  * of resending a 'lost' open request.
12699  *
12700  * 'num_bseqid_retryp' makes sure we don't loop forever on a broken
12701  * server that hands out BAD_SEQID on open confirm.
12702  *
12703  * Errors are returned via the nfs4_error_t parameter.
12704  */
12705 void
12706 nfs4open_confirm(vnode_t *vp, seqid4 *seqid, stateid4 *stateid, cred_t *cr,
12707     bool_t reopening_file, bool_t *retry_open, nfs4_open_owner_t *oop,
12708     bool_t resend, nfs4_error_t *ep, int *num_bseqid_retryp)
12709 {
12710         COMPOUND4args_clnt args;
12711         COMPOUND4res_clnt res;
12712         nfs_argop4 argop[2];
12713         nfs_resop4 *resop;
12714         int doqueue = 1;
12715         mntinfo4_t *mi;
12716         OPEN_CONFIRM4args *open_confirm_args;
12717         int needrecov;
12718 
12719         ASSERT(nfs_zone() == VTOMI4(vp)->mi_zone);
12720 #if DEBUG
12721         mutex_enter(&oop->oo_lock);
12722         ASSERT(oop->oo_seqid_inuse);
12723         mutex_exit(&oop->oo_lock);
12724 #endif
12725 
12726 recov_retry_confirm:
12727         nfs4_error_zinit(ep);
12728         *retry_open = FALSE;
12729 
12730         if (resend)
12731                 args.ctag = TAG_OPEN_CONFIRM_LOST;
12732         else
12733                 args.ctag = TAG_OPEN_CONFIRM;
12734 
12735         args.array_len = 2;
12736         args.array = argop;
12737 
12738         /* putfh target fh */
12739         argop[0].argop = OP_CPUTFH;
12740         argop[0].nfs_argop4_u.opcputfh.sfh = VTOR4(vp)->r_fh;
12741 
12742         argop[1].argop = OP_OPEN_CONFIRM;
12743         open_confirm_args = &argop[1].nfs_argop4_u.opopen_confirm;
12744 
12745         (*seqid) += 1;
12746         open_confirm_args->seqid = *seqid;
12747         open_confirm_args->open_stateid = *stateid;
12748 
12749         mi = VTOMI4(vp);
12750 
12751         rfs4call(mi, &args, &res, cr, &doqueue, 0, ep);
12752 
12753         if (!ep->error && nfs4_need_to_bump_seqid(&res)) {
12754                 nfs4_set_open_seqid((*seqid), oop, args.ctag);
12755         }
12756 
12757         needrecov = nfs4_needs_recovery(ep, FALSE, mi->mi_vfsp);
12758         if (!needrecov && ep->error)
12759                 return;
12760 
12761         if (needrecov) {
12762                 bool_t abort = FALSE;
12763 
12764                 if (reopening_file == FALSE) {
12765                         nfs4_bseqid_entry_t *bsep = NULL;
12766 
12767                         if (!ep->error && res.status == NFS4ERR_BAD_SEQID)
12768                                 bsep = nfs4_create_bseqid_entry(oop, NULL,
12769                                     vp, 0, args.ctag,
12770                                     open_confirm_args->seqid);
12771 
12772                         abort = nfs4_start_recovery(ep, VTOMI4(vp), vp, NULL,
12773                             NULL, NULL, OP_OPEN_CONFIRM, bsep, NULL, NULL);
12774                         if (bsep) {
12775                                 kmem_free(bsep, sizeof (*bsep));
12776                                 if (num_bseqid_retryp &&
12777                                     --(*num_bseqid_retryp) == 0)
12778                                         abort = TRUE;
12779                         }
12780                 }
12781                 if ((ep->error == ETIMEDOUT ||
12782                     res.status == NFS4ERR_RESOURCE) &&
12783                     abort == FALSE && resend == FALSE) {
12784                         if (!ep->error)
12785                                 (void) xdr_free(xdr_COMPOUND4res_clnt,
12786                                     (caddr_t)&res);
12787 
12788                         delay(SEC_TO_TICK(confirm_retry_sec));
12789                         goto recov_retry_confirm;
12790                 }
12791                 /* State may have changed so retry the entire OPEN op */
12792                 if (abort == FALSE)
12793                         *retry_open = TRUE;
12794                 else
12795                         *retry_open = FALSE;
12796                 if (!ep->error)
12797                         (void) xdr_free(xdr_COMPOUND4res_clnt, (caddr_t)&res);
12798                 return;
12799         }
12800 
12801         if (res.status) {
12802                 (void) xdr_free(xdr_COMPOUND4res_clnt, (caddr_t)&res);
12803                 return;
12804         }
12805 
12806         resop = &res.array[1];  /* open confirm res */
12807         bcopy(&resop->nfs_resop4_u.opopen_confirm.open_stateid,
12808             stateid, sizeof (*stateid));
12809 
12810         (void) xdr_free(xdr_COMPOUND4res_clnt, (caddr_t)&res);
12811 }
12812 
12813 /*
12814  * Return the credentials associated with a client state object.  The
12815  * caller is responsible for freeing the credentials.
12816  */
12817 
12818 static cred_t *
12819 state_to_cred(nfs4_open_stream_t *osp)
12820 {
12821         cred_t *cr;
12822 
12823         /*
12824          * It's ok to not lock the open stream and open owner to get
12825          * the oo_cred since this is only written once (upon creation)
12826          * and will not change.
12827          */
12828         cr = osp->os_open_owner->oo_cred;
12829         crhold(cr);
12830 
12831         return (cr);
12832 }
12833 
12834 /*
12835  * nfs4_find_sysid
12836  *
12837  * Find the sysid for the knetconfig associated with the given mi.
12838  */
12839 static struct lm_sysid *
12840 nfs4_find_sysid(mntinfo4_t *mi)
12841 {
12842         ASSERT(nfs_zone() == mi->mi_zone);
12843 
12844         /*
12845          * Switch from RDMA knconf to original mount knconf
12846          */
12847         return (lm_get_sysid(ORIG_KNCONF(mi), &mi->mi_curr_serv->sv_addr,
12848             mi->mi_curr_serv->sv_hostname, NULL));
12849 }
12850 
12851 #ifdef DEBUG
12852 /*
12853  * Return a string version of the call type for easy reading.
12854  */
12855 static char *
12856 nfs4frlock_get_call_type(nfs4_lock_call_type_t ctype)
12857 {
12858         switch (ctype) {
12859         case NFS4_LCK_CTYPE_NORM:
12860                 return ("NORMAL");
12861         case NFS4_LCK_CTYPE_RECLAIM:
12862                 return ("RECLAIM");
12863         case NFS4_LCK_CTYPE_RESEND:
12864                 return ("RESEND");
12865         case NFS4_LCK_CTYPE_REINSTATE:
12866                 return ("REINSTATE");
12867         default:
12868                 cmn_err(CE_PANIC, "nfs4frlock_get_call_type: got illegal "
12869                     "type %d", ctype);
12870                 return ("");
12871         }
12872 }
12873 #endif
12874 
12875 /*
12876  * Map the frlock cmd and lock type to the NFSv4 over-the-wire lock type
12877  * Unlock requests don't have an over-the-wire locktype, so we just return
12878  * something non-threatening.
12879  */
12880 
12881 static nfs_lock_type4
12882 flk_to_locktype(int cmd, int l_type)
12883 {
12884         ASSERT(l_type == F_RDLCK || l_type == F_WRLCK || l_type == F_UNLCK);
12885 
12886         switch (l_type) {
12887         case F_UNLCK:
12888                 return (READ_LT);
12889         case F_RDLCK:
12890                 if (cmd == F_SETLK)
12891                         return (READ_LT);
12892                 else
12893                         return (READW_LT);
12894         case F_WRLCK:
12895                 if (cmd == F_SETLK)
12896                         return (WRITE_LT);
12897                 else
12898                         return (WRITEW_LT);
12899         }
12900         panic("flk_to_locktype");
12901         /*NOTREACHED*/
12902 }
12903 
12904 /*
12905  * Do some preliminary checks for nfs4frlock.
12906  */
12907 static int
12908 nfs4frlock_validate_args(int cmd, flock64_t *flk, int flag, vnode_t *vp,
12909     u_offset_t offset)
12910 {
12911         int error = 0;
12912 
12913         /*
12914          * If we are setting a lock, check that the file is opened
12915          * with the correct mode.
12916          */
12917         if (cmd == F_SETLK || cmd == F_SETLKW) {
12918                 if ((flk->l_type == F_RDLCK && (flag & FREAD) == 0) ||
12919                     (flk->l_type == F_WRLCK && (flag & FWRITE) == 0)) {
12920                         NFS4_DEBUG(nfs4_client_lock_debug, (CE_NOTE,
12921                             "nfs4frlock_validate_args: file was opened with "
12922                             "incorrect mode"));
12923                         return (EBADF);
12924                 }
12925         }
12926 
12927         /* Convert the offset. It may need to be restored before returning. */
12928         if (error = convoff(vp, flk, 0, offset)) {
12929                 NFS4_DEBUG(nfs4_client_lock_debug, (CE_NOTE,
12930                     "nfs4frlock_validate_args: convoff  =>  error= %d\n",
12931                     error));
12932                 return (error);
12933         }
12934 
12935         return (error);
12936 }
12937 
12938 /*
12939  * Set the flock64's lm_sysid for nfs4frlock.
12940  */
12941 static int
12942 nfs4frlock_get_sysid(struct lm_sysid **lspp, vnode_t *vp, flock64_t *flk)
12943 {
12944         ASSERT(nfs_zone() == VTOMI4(vp)->mi_zone);
12945 
12946         /* Find the lm_sysid */
12947         *lspp = nfs4_find_sysid(VTOMI4(vp));
12948 
12949         if (*lspp == NULL) {
12950                 NFS4_DEBUG(nfs4_client_lock_debug, (CE_NOTE,
12951                     "nfs4frlock_get_sysid: no sysid, return ENOLCK"));
12952                 return (ENOLCK);
12953         }
12954 
12955         flk->l_sysid = lm_sysidt(*lspp);
12956 
12957         return (0);
12958 }
12959 
12960 /*
12961  * Do the remaining preliminary setup for nfs4frlock.
12962  */
12963 static void
12964 nfs4frlock_pre_setup(clock_t *tick_delayp, nfs4_recov_state_t *recov_statep,
12965     flock64_t *flk, short *whencep, vnode_t *vp, cred_t *search_cr,
12966     cred_t **cred_otw)
12967 {
12968         /*
12969          * set tick_delay to the base delay time.
12970          * (NFS4_BASE_WAIT_TIME is in secs)
12971          */
12972 
12973         *tick_delayp = drv_usectohz(NFS4_BASE_WAIT_TIME * 1000 * 1000);
12974 
12975         /*
12976          * If lock is relative to EOF, we need the newest length of the
12977          * file. Therefore invalidate the ATTR_CACHE.
12978          */
12979 
12980         *whencep = flk->l_whence;
12981 
12982         if (*whencep == 2)              /* SEEK_END */
12983                 PURGE_ATTRCACHE4(vp);
12984 
12985         recov_statep->rs_flags = 0;
12986         recov_statep->rs_num_retry_despite_err = 0;
12987         *cred_otw = nfs4_get_otw_cred(search_cr, VTOMI4(vp), NULL);
12988 }
12989 
12990 /*
12991  * Initialize and allocate the data structures necessary for
12992  * the nfs4frlock call.
12993  * Allocates argsp's op array, frees up the saved_rqstpp if there is one.
12994  */
12995 static void
12996 nfs4frlock_call_init(COMPOUND4args_clnt *argsp, COMPOUND4args_clnt **argspp,
12997     nfs_argop4 **argopp, nfs4_op_hint_t *op_hintp, flock64_t *flk, int cmd,
12998     bool_t *retry, bool_t *did_start_fop, COMPOUND4res_clnt **respp,
12999     bool_t *skip_get_err, nfs4_lost_rqst_t *lost_rqstp)
13000 {
13001         int             argoplist_size;
13002         int             num_ops = 2;
13003 
13004         *retry = FALSE;
13005         *did_start_fop = FALSE;
13006         *skip_get_err = FALSE;
13007         lost_rqstp->lr_op = 0;
13008         argoplist_size  = num_ops * sizeof (nfs_argop4);
13009         /* fill array with zero */
13010         *argopp = kmem_zalloc(argoplist_size, KM_SLEEP);
13011 
13012         *argspp = argsp;
13013         *respp = NULL;
13014 
13015         argsp->array_len = num_ops;
13016         argsp->array = *argopp;
13017 
13018         /* initialize in case of error; will get real value down below */
13019         argsp->ctag = TAG_NONE;
13020 
13021         if ((cmd == F_SETLK || cmd == F_SETLKW) && flk->l_type == F_UNLCK)
13022                 *op_hintp = OH_LOCKU;
13023         else
13024                 *op_hintp = OH_OTHER;
13025 }
13026 
13027 /*
13028  * Call the nfs4_start_fop() for nfs4frlock, if necessary.  Assign
13029  * the proper nfs4_server_t for this instance of nfs4frlock.
13030  * Returns 0 (success) or an errno value.
13031  */
13032 static int
13033 nfs4frlock_start_call(nfs4_lock_call_type_t ctype, vnode_t *vp,
13034     nfs4_op_hint_t op_hint, nfs4_recov_state_t *recov_statep,
13035     bool_t *did_start_fop, bool_t *startrecovp)
13036 {
13037         int error = 0;
13038         rnode4_t *rp;
13039 
13040         ASSERT(nfs_zone() == VTOMI4(vp)->mi_zone);
13041 
13042         if (ctype == NFS4_LCK_CTYPE_NORM) {
13043                 error = nfs4_start_fop(VTOMI4(vp), vp, NULL, op_hint,
13044                     recov_statep, startrecovp);
13045                 if (error)
13046                         return (error);
13047                 *did_start_fop = TRUE;
13048         } else {
13049                 *did_start_fop = FALSE;
13050                 *startrecovp = FALSE;
13051         }
13052 
13053         if (!error) {
13054                 rp = VTOR4(vp);
13055 
13056                 /* If the file failed recovery, just quit. */
13057                 mutex_enter(&rp->r_statelock);
13058                 if (rp->r_flags & R4RECOVERR) {
13059                         error = EIO;
13060                 }
13061                 mutex_exit(&rp->r_statelock);
13062         }
13063 
13064         return (error);
13065 }
13066 
13067 /*
13068  * Setup the LOCK4/LOCKU4 arguments for resending a lost lock request.  A
13069  * resend nfs4frlock call is initiated by the recovery framework.
13070  * Acquires the lop and oop seqid synchronization.
13071  */
13072 static void
13073 nfs4frlock_setup_resend_lock_args(nfs4_lost_rqst_t *resend_rqstp,
13074     COMPOUND4args_clnt *argsp, nfs_argop4 *argop, nfs4_lock_owner_t **lopp,
13075     nfs4_open_owner_t **oopp, nfs4_open_stream_t **ospp,
13076     LOCK4args **lock_argsp, LOCKU4args **locku_argsp)
13077 {
13078         mntinfo4_t *mi = VTOMI4(resend_rqstp->lr_vp);
13079         int error;
13080 
13081         NFS4_DEBUG((nfs4_lost_rqst_debug || nfs4_client_lock_debug),
13082             (CE_NOTE,
13083             "nfs4frlock_setup_resend_lock_args: have lost lock to resend"));
13084         ASSERT(resend_rqstp != NULL);
13085         ASSERT(resend_rqstp->lr_op == OP_LOCK ||
13086             resend_rqstp->lr_op == OP_LOCKU);
13087 
13088         *oopp = resend_rqstp->lr_oop;
13089         if (resend_rqstp->lr_oop) {
13090                 open_owner_hold(resend_rqstp->lr_oop);
13091                 error = nfs4_start_open_seqid_sync(resend_rqstp->lr_oop, mi);
13092                 ASSERT(error == 0);     /* recov thread always succeeds */
13093         }
13094 
13095         /* Must resend this lost lock/locku request. */
13096         ASSERT(resend_rqstp->lr_lop != NULL);
13097         *lopp = resend_rqstp->lr_lop;
13098         lock_owner_hold(resend_rqstp->lr_lop);
13099         error = nfs4_start_lock_seqid_sync(resend_rqstp->lr_lop, mi);
13100         ASSERT(error == 0);     /* recov thread always succeeds */
13101 
13102         *ospp = resend_rqstp->lr_osp;
13103         if (*ospp)
13104                 open_stream_hold(resend_rqstp->lr_osp);
13105 
13106         if (resend_rqstp->lr_op == OP_LOCK) {
13107                 LOCK4args *lock_args;
13108 
13109                 argop->argop = OP_LOCK;
13110                 *lock_argsp = lock_args = &argop->nfs_argop4_u.oplock;
13111                 lock_args->locktype = resend_rqstp->lr_locktype;
13112                 lock_args->reclaim =
13113                     (resend_rqstp->lr_ctype == NFS4_LCK_CTYPE_RECLAIM);
13114                 lock_args->offset = resend_rqstp->lr_flk->l_start;
13115                 lock_args->length = resend_rqstp->lr_flk->l_len;
13116                 if (lock_args->length == 0)
13117                         lock_args->length = ~lock_args->length;
13118                 nfs4_setup_lock_args(*lopp, *oopp, *ospp,
13119                     mi2clientid(mi), &lock_args->locker);
13120 
13121                 switch (resend_rqstp->lr_ctype) {
13122                 case NFS4_LCK_CTYPE_RESEND:
13123                         argsp->ctag = TAG_LOCK_RESEND;
13124                         break;
13125                 case NFS4_LCK_CTYPE_REINSTATE:
13126                         argsp->ctag = TAG_LOCK_REINSTATE;
13127                         break;
13128                 case NFS4_LCK_CTYPE_RECLAIM:
13129                         argsp->ctag = TAG_LOCK_RECLAIM;
13130                         break;
13131                 default:
13132                         argsp->ctag = TAG_LOCK_UNKNOWN;
13133                         break;
13134                 }
13135         } else {
13136                 LOCKU4args *locku_args;
13137                 nfs4_lock_owner_t *lop = resend_rqstp->lr_lop;
13138 
13139                 argop->argop = OP_LOCKU;
13140                 *locku_argsp = locku_args = &argop->nfs_argop4_u.oplocku;
13141                 locku_args->locktype = READ_LT;
13142                 locku_args->seqid = lop->lock_seqid + 1;
13143                 mutex_enter(&lop->lo_lock);
13144                 locku_args->lock_stateid = lop->lock_stateid;
13145                 mutex_exit(&lop->lo_lock);
13146                 locku_args->offset = resend_rqstp->lr_flk->l_start;
13147                 locku_args->length = resend_rqstp->lr_flk->l_len;
13148                 if (locku_args->length == 0)
13149                         locku_args->length = ~locku_args->length;
13150 
13151                 switch (resend_rqstp->lr_ctype) {
13152                 case NFS4_LCK_CTYPE_RESEND:
13153                         argsp->ctag = TAG_LOCKU_RESEND;
13154                         break;
13155                 case NFS4_LCK_CTYPE_REINSTATE:
13156                         argsp->ctag = TAG_LOCKU_REINSTATE;
13157                         break;
13158                 default:
13159                         argsp->ctag = TAG_LOCK_UNKNOWN;
13160                         break;
13161                 }
13162         }
13163 }
13164 
13165 /*
13166  * Setup the LOCKT4 arguments.
13167  */
13168 static void
13169 nfs4frlock_setup_lockt_args(nfs4_lock_call_type_t ctype, nfs_argop4 *argop,
13170     LOCKT4args **lockt_argsp, COMPOUND4args_clnt *argsp, flock64_t *flk,
13171     rnode4_t *rp)
13172 {
13173         LOCKT4args *lockt_args;
13174 
13175         ASSERT(nfs_zone() == VTOMI4(RTOV4(rp))->mi_zone);
13176         ASSERT(ctype == NFS4_LCK_CTYPE_NORM);
13177         argop->argop = OP_LOCKT;
13178         argsp->ctag = TAG_LOCKT;
13179         lockt_args = &argop->nfs_argop4_u.oplockt;
13180 
13181         /*
13182          * The locktype will be READ_LT unless it's
13183          * a write lock. We do this because the Solaris
13184          * system call allows the combination of
13185          * F_UNLCK and F_GETLK* and so in that case the
13186          * unlock is mapped to a read.
13187          */
13188         if (flk->l_type == F_WRLCK)
13189                 lockt_args->locktype = WRITE_LT;
13190         else
13191                 lockt_args->locktype = READ_LT;
13192 
13193         lockt_args->owner.clientid = mi2clientid(VTOMI4(RTOV4(rp)));
13194         /* set the lock owner4 args */
13195         nfs4_setlockowner_args(&lockt_args->owner, rp,
13196             ctype == NFS4_LCK_CTYPE_NORM ? curproc->p_pidp->pid_id :
13197             flk->l_pid);
13198         lockt_args->offset = flk->l_start;
13199         lockt_args->length = flk->l_len;
13200         if (flk->l_len == 0)
13201                 lockt_args->length = ~lockt_args->length;
13202 
13203         *lockt_argsp = lockt_args;
13204 }
13205 
13206 /*
13207  * If the client is holding a delegation, and the open stream to be used
13208  * with this lock request is a delegation open stream, then re-open the stream.
13209  * Sets the nfs4_error_t to all zeros unless the open stream has already
13210  * failed a reopen or we couldn't find the open stream.  NFS4ERR_DELAY
13211  * means the caller should retry (like a recovery retry).
13212  */
13213 static void
13214 nfs4frlock_check_deleg(vnode_t *vp, nfs4_error_t *ep, cred_t *cr, int lt)
13215 {
13216         open_delegation_type4   dt;
13217         bool_t                  reopen_needed, force;
13218         nfs4_open_stream_t      *osp;
13219         open_claim_type4        oclaim;
13220         rnode4_t                *rp = VTOR4(vp);
13221         mntinfo4_t              *mi = VTOMI4(vp);
13222 
13223         ASSERT(nfs_zone() == mi->mi_zone);
13224 
13225         nfs4_error_zinit(ep);
13226 
13227         mutex_enter(&rp->r_statev4_lock);
13228         dt = rp->r_deleg_type;
13229         mutex_exit(&rp->r_statev4_lock);
13230 
13231         if (dt != OPEN_DELEGATE_NONE) {
13232                 nfs4_open_owner_t       *oop;
13233 
13234                 oop = find_open_owner(cr, NFS4_PERM_CREATED, mi);
13235                 if (!oop) {
13236                         ep->stat = NFS4ERR_IO;
13237                         return;
13238                 }
13239                 /* returns with 'os_sync_lock' held */
13240                 osp = find_open_stream(oop, rp);
13241                 if (!osp) {
13242                         open_owner_rele(oop);
13243                         ep->stat = NFS4ERR_IO;
13244                         return;
13245                 }
13246 
13247                 if (osp->os_failed_reopen) {
13248                         NFS4_DEBUG((nfs4_open_stream_debug ||
13249                             nfs4_client_lock_debug), (CE_NOTE,
13250                             "nfs4frlock_check_deleg: os_failed_reopen set "
13251                             "for osp %p, cr %p, rp %s", (void *)osp,
13252                             (void *)cr, rnode4info(rp)));
13253                         mutex_exit(&osp->os_sync_lock);
13254                         open_stream_rele(osp, rp);
13255                         open_owner_rele(oop);
13256                         ep->stat = NFS4ERR_IO;
13257                         return;
13258                 }
13259 
13260                 /*
13261                  * Determine whether a reopen is needed.  If this
13262                  * is a delegation open stream, then send the open
13263                  * to the server to give visibility to the open owner.
13264                  * Even if it isn't a delegation open stream, we need
13265                  * to check if the previous open CLAIM_DELEGATE_CUR
13266                  * was sufficient.
13267                  */
13268 
13269                 reopen_needed = osp->os_delegation ||
13270                     ((lt == F_RDLCK &&
13271                     !(osp->os_dc_openacc & OPEN4_SHARE_ACCESS_READ)) ||
13272                     (lt == F_WRLCK &&
13273                     !(osp->os_dc_openacc & OPEN4_SHARE_ACCESS_WRITE)));
13274 
13275                 mutex_exit(&osp->os_sync_lock);
13276                 open_owner_rele(oop);
13277 
13278                 if (reopen_needed) {
13279                         /*
13280                          * Always use CLAIM_PREVIOUS after server reboot.
13281                          * The server will reject CLAIM_DELEGATE_CUR if
13282                          * it is used during the grace period.
13283                          */
13284                         mutex_enter(&mi->mi_lock);
13285                         if (mi->mi_recovflags & MI4R_SRV_REBOOT) {
13286                                 oclaim = CLAIM_PREVIOUS;
13287                                 force = TRUE;
13288                         } else {
13289                                 oclaim = CLAIM_DELEGATE_CUR;
13290                                 force = FALSE;
13291                         }
13292                         mutex_exit(&mi->mi_lock);
13293 
13294                         nfs4_reopen(vp, osp, ep, oclaim, force, FALSE);
13295                         if (ep->error == EAGAIN) {
13296                                 nfs4_error_zinit(ep);
13297                                 ep->stat = NFS4ERR_DELAY;
13298                         }
13299                 }
13300                 open_stream_rele(osp, rp);
13301                 osp = NULL;
13302         }
13303 }
13304 
13305 /*
13306  * Setup the LOCKU4 arguments.
13307  * Returns errors via the nfs4_error_t.
13308  * NFS4_OK              no problems.  *go_otwp is TRUE if call should go
13309  *                      over-the-wire.  The caller must release the
13310  *                      reference on *lopp.
13311  * NFS4ERR_DELAY        caller should retry (like recovery retry)
13312  * (other)              unrecoverable error.
13313  */
13314 static void
13315 nfs4frlock_setup_locku_args(nfs4_lock_call_type_t ctype, nfs_argop4 *argop,
13316     LOCKU4args **locku_argsp, flock64_t *flk,
13317     nfs4_lock_owner_t **lopp, nfs4_error_t *ep, COMPOUND4args_clnt *argsp,
13318     vnode_t *vp, int flag, u_offset_t offset, cred_t *cr,
13319     bool_t *skip_get_err, bool_t *go_otwp)
13320 {
13321         nfs4_lock_owner_t       *lop = NULL;
13322         LOCKU4args              *locku_args;
13323         pid_t                   pid;
13324         bool_t                  is_spec = FALSE;
13325         rnode4_t                *rp = VTOR4(vp);
13326 
13327         ASSERT(nfs_zone() == VTOMI4(vp)->mi_zone);
13328         ASSERT(ctype == NFS4_LCK_CTYPE_NORM);
13329 
13330         nfs4frlock_check_deleg(vp, ep, cr, F_UNLCK);
13331         if (ep->error || ep->stat)
13332                 return;
13333 
13334         argop->argop = OP_LOCKU;
13335         if (ctype == NFS4_LCK_CTYPE_REINSTATE)
13336                 argsp->ctag = TAG_LOCKU_REINSTATE;
13337         else
13338                 argsp->ctag = TAG_LOCKU;
13339         locku_args = &argop->nfs_argop4_u.oplocku;
13340         *locku_argsp = locku_args;
13341 
13342         /*
13343          * XXX what should locku_args->locktype be?
13344          * setting to ALWAYS be READ_LT so at least
13345          * it is a valid locktype.
13346          */
13347 
13348         locku_args->locktype = READ_LT;
13349 
13350         pid = ctype == NFS4_LCK_CTYPE_NORM ? curproc->p_pidp->pid_id :
13351             flk->l_pid;
13352 
13353         /*
13354          * Get the lock owner stateid.  If no lock owner
13355          * exists, return success.
13356          */
13357         lop = find_lock_owner(rp, pid, LOWN_ANY);
13358         *lopp = lop;
13359         if (lop && CLNT_ISSPECIAL(&lop->lock_stateid))
13360                 is_spec = TRUE;
13361         if (!lop || is_spec) {
13362                 /*
13363                  * No lock owner so no locks to unlock.
13364                  * Return success.  If there was a failed
13365                  * reclaim earlier, the lock might still be
13366                  * registered with the local locking code,
13367                  * so notify it of the unlock.
13368                  *
13369                  * If the lockowner is using a special stateid,
13370                  * then the original lock request (that created
13371                  * this lockowner) was never successful, so we
13372                  * have no lock to undo OTW.
13373                  */
13374                 NFS4_DEBUG(nfs4_client_lock_debug, (CE_NOTE,
13375                     "nfs4frlock_setup_locku_args: LOCKU: no lock owner "
13376                     "(%ld) so return success", (long)pid));
13377 
13378                 if (ctype == NFS4_LCK_CTYPE_NORM)
13379                         flk->l_pid = curproc->p_pid;
13380                 nfs4_register_lock_locally(vp, flk, flag, offset);
13381                 /*
13382                  * Release our hold and NULL out so final_cleanup
13383                  * doesn't try to end a lock seqid sync we
13384                  * never started.
13385                  */
13386                 if (is_spec) {
13387                         lock_owner_rele(lop);
13388                         *lopp = NULL;
13389                 }
13390                 *skip_get_err = TRUE;
13391                 *go_otwp = FALSE;
13392                 return;
13393         }
13394 
13395         ep->error = nfs4_start_lock_seqid_sync(lop, VTOMI4(vp));
13396         if (ep->error == EAGAIN) {
13397                 lock_owner_rele(lop);
13398                 *lopp = NULL;
13399                 return;
13400         }
13401 
13402         mutex_enter(&lop->lo_lock);
13403         locku_args->lock_stateid = lop->lock_stateid;
13404         mutex_exit(&lop->lo_lock);
13405         locku_args->seqid = lop->lock_seqid + 1;
13406 
13407         /* leave the ref count on lop, rele after RPC call */
13408 
13409         locku_args->offset = flk->l_start;
13410         locku_args->length = flk->l_len;
13411         if (flk->l_len == 0)
13412                 locku_args->length = ~locku_args->length;
13413 
13414         *go_otwp = TRUE;
13415 }
13416 
13417 /*
13418  * Setup the LOCK4 arguments.
13419  *
13420  * Returns errors via the nfs4_error_t.
13421  * NFS4_OK              no problems
13422  * NFS4ERR_DELAY        caller should retry (like recovery retry)
13423  * (other)              unrecoverable error
13424  */
13425 static void
13426 nfs4frlock_setup_lock_args(nfs4_lock_call_type_t ctype, LOCK4args **lock_argsp,
13427     nfs4_open_owner_t **oopp, nfs4_open_stream_t **ospp,
13428     nfs4_lock_owner_t **lopp, nfs_argop4 *argop, COMPOUND4args_clnt *argsp,
13429     flock64_t *flk, int cmd, vnode_t *vp, cred_t *cr, nfs4_error_t *ep)
13430 {
13431         LOCK4args               *lock_args;
13432         nfs4_open_owner_t       *oop = NULL;
13433         nfs4_open_stream_t      *osp = NULL;
13434         nfs4_lock_owner_t       *lop = NULL;
13435         pid_t                   pid;
13436         rnode4_t                *rp = VTOR4(vp);
13437 
13438         ASSERT(nfs_zone() == VTOMI4(vp)->mi_zone);
13439 
13440         nfs4frlock_check_deleg(vp, ep, cr, flk->l_type);
13441         if (ep->error || ep->stat != NFS4_OK)
13442                 return;
13443 
13444         argop->argop = OP_LOCK;
13445         if (ctype == NFS4_LCK_CTYPE_NORM)
13446                 argsp->ctag = TAG_LOCK;
13447         else if (ctype == NFS4_LCK_CTYPE_RECLAIM)
13448                 argsp->ctag = TAG_RELOCK;
13449         else
13450                 argsp->ctag = TAG_LOCK_REINSTATE;
13451         lock_args = &argop->nfs_argop4_u.oplock;
13452         lock_args->locktype = flk_to_locktype(cmd, flk->l_type);
13453         lock_args->reclaim = ctype == NFS4_LCK_CTYPE_RECLAIM ? 1 : 0;
13454         /*
13455          * Get the lock owner.  If no lock owner exists,
13456          * create a 'temporary' one and grab the open seqid
13457          * synchronization (which puts a hold on the open
13458          * owner and open stream).
13459          * This also grabs the lock seqid synchronization.
13460          */
13461         pid = ctype == NFS4_LCK_CTYPE_NORM ? curproc->p_pid : flk->l_pid;
13462         ep->stat =
13463             nfs4_find_or_create_lock_owner(pid, rp, cr, &oop, &osp, &lop);
13464 
13465         if (ep->stat != NFS4_OK)
13466                 goto out;
13467 
13468         nfs4_setup_lock_args(lop, oop, osp, mi2clientid(VTOMI4(vp)),
13469             &lock_args->locker);
13470 
13471         lock_args->offset = flk->l_start;
13472         lock_args->length = flk->l_len;
13473         if (flk->l_len == 0)
13474                 lock_args->length = ~lock_args->length;
13475         *lock_argsp = lock_args;
13476 out:
13477         *oopp = oop;
13478         *ospp = osp;
13479         *lopp = lop;
13480 }
13481 
13482 /*
13483  * After we get the reply from the server, record the proper information
13484  * for possible resend lock requests.
13485  *
13486  * Allocates memory for the saved_rqstp if we have a lost lock to save.
13487  */
13488 static void
13489 nfs4frlock_save_lost_rqst(nfs4_lock_call_type_t ctype, int error,
13490     nfs_lock_type4 locktype, nfs4_open_owner_t *oop,
13491     nfs4_open_stream_t *osp, nfs4_lock_owner_t *lop, flock64_t *flk,
13492     nfs4_lost_rqst_t *lost_rqstp, cred_t *cr, vnode_t *vp)
13493 {
13494         bool_t unlock = (flk->l_type == F_UNLCK);
13495 
13496         ASSERT(nfs_zone() == VTOMI4(vp)->mi_zone);
13497         ASSERT(ctype == NFS4_LCK_CTYPE_NORM ||
13498             ctype == NFS4_LCK_CTYPE_REINSTATE);
13499 
13500         if (error != 0 && !unlock) {
13501                 NFS4_DEBUG((nfs4_lost_rqst_debug ||
13502                     nfs4_client_lock_debug), (CE_NOTE,
13503                     "nfs4frlock_save_lost_rqst: set lo_pending_rqsts to 1 "
13504                     " for lop %p", (void *)lop));
13505                 ASSERT(lop != NULL);
13506                 mutex_enter(&lop->lo_lock);
13507                 lop->lo_pending_rqsts = 1;
13508                 mutex_exit(&lop->lo_lock);
13509         }
13510 
13511         lost_rqstp->lr_putfirst = FALSE;
13512         lost_rqstp->lr_op = 0;
13513 
13514         /*
13515          * For lock/locku requests, we treat EINTR as ETIMEDOUT for
13516          * recovery purposes so that the lock request that was sent
13517          * can be saved and re-issued later.  Ditto for EIO from a forced
13518          * unmount.  This is done to have the client's local locking state
13519          * match the v4 server's state; that is, the request was
13520          * potentially received and accepted by the server but the client
13521          * thinks it was not.
13522          */
13523         if (error == ETIMEDOUT || error == EINTR ||
13524             NFS4_FRC_UNMT_ERR(error, vp->v_vfsp)) {
13525                 NFS4_DEBUG((nfs4_lost_rqst_debug ||
13526                     nfs4_client_lock_debug), (CE_NOTE,
13527                     "nfs4frlock_save_lost_rqst: got a lost %s lock for "
13528                     "lop %p oop %p osp %p", unlock ? "LOCKU" : "LOCK",
13529                     (void *)lop, (void *)oop, (void *)osp));
13530                 if (unlock)
13531                         lost_rqstp->lr_op = OP_LOCKU;
13532                 else {
13533                         lost_rqstp->lr_op = OP_LOCK;
13534                         lost_rqstp->lr_locktype = locktype;
13535                 }
13536                 /*
13537                  * Objects are held and rele'd via the recovery code.
13538                  * See nfs4_save_lost_rqst.
13539                  */
13540                 lost_rqstp->lr_vp = vp;
13541                 lost_rqstp->lr_dvp = NULL;
13542                 lost_rqstp->lr_oop = oop;
13543                 lost_rqstp->lr_osp = osp;
13544                 lost_rqstp->lr_lop = lop;
13545                 lost_rqstp->lr_cr = cr;
13546                 switch (ctype) {
13547                 case NFS4_LCK_CTYPE_NORM:
13548                         flk->l_pid = ttoproc(curthread)->p_pid;
13549                         lost_rqstp->lr_ctype = NFS4_LCK_CTYPE_RESEND;
13550                         break;
13551                 case NFS4_LCK_CTYPE_REINSTATE:
13552                         lost_rqstp->lr_putfirst = TRUE;
13553                         lost_rqstp->lr_ctype = ctype;
13554                         break;
13555                 default:
13556                         break;
13557                 }
13558                 lost_rqstp->lr_flk = flk;
13559         }
13560 }
13561 
13562 /*
13563  * Update lop's seqid.  Also update the seqid stored in a resend request,
13564  * if any.  (Some recovery errors increment the seqid, and we may have to
13565  * send the resend request again.)
13566  */
13567 
13568 static void
13569 nfs4frlock_bump_seqid(LOCK4args *lock_args, LOCKU4args *locku_args,
13570     nfs4_open_owner_t *oop, nfs4_lock_owner_t *lop, nfs4_tag_type_t tag_type)
13571 {
13572         if (lock_args) {
13573                 if (lock_args->locker.new_lock_owner == TRUE)
13574                         nfs4_get_and_set_next_open_seqid(oop, tag_type);
13575                 else {
13576                         ASSERT(lop->lo_flags & NFS4_LOCK_SEQID_INUSE);
13577                         nfs4_set_lock_seqid(lop->lock_seqid + 1, lop);
13578                 }
13579         } else if (locku_args) {
13580                 ASSERT(lop->lo_flags & NFS4_LOCK_SEQID_INUSE);
13581                 nfs4_set_lock_seqid(lop->lock_seqid +1, lop);
13582         }
13583 }
13584 
13585 /*
13586  * Calls nfs4_end_fop, drops the seqid syncs, and frees up the
13587  * COMPOUND4 args/res for calls that need to retry.
13588  * Switches the *cred_otwp to base_cr.
13589  */
13590 static void
13591 nfs4frlock_check_access(vnode_t *vp, nfs4_op_hint_t op_hint,
13592     nfs4_recov_state_t *recov_statep, int needrecov, bool_t *did_start_fop,
13593     COMPOUND4args_clnt **argspp, COMPOUND4res_clnt **respp, int error,
13594     nfs4_lock_owner_t **lopp, nfs4_open_owner_t **oopp,
13595     nfs4_open_stream_t **ospp, cred_t *base_cr, cred_t **cred_otwp)
13596 {
13597         nfs4_open_owner_t       *oop = *oopp;
13598         nfs4_open_stream_t      *osp = *ospp;
13599         nfs4_lock_owner_t       *lop = *lopp;
13600         nfs_argop4              *argop = (*argspp)->array;
13601 
13602         if (*did_start_fop) {
13603                 nfs4_end_fop(VTOMI4(vp), vp, NULL, op_hint, recov_statep,
13604                     needrecov);
13605                 *did_start_fop = FALSE;
13606         }
13607         ASSERT((*argspp)->array_len == 2);
13608         if (argop[1].argop == OP_LOCK)
13609                 nfs4args_lock_free(&argop[1]);
13610         else if (argop[1].argop == OP_LOCKT)
13611                 nfs4args_lockt_free(&argop[1]);
13612         kmem_free(argop, 2 * sizeof (nfs_argop4));
13613         if (!error)
13614                 (void) xdr_free(xdr_COMPOUND4res_clnt, (caddr_t)*respp);
13615         *argspp = NULL;
13616         *respp = NULL;
13617 
13618         if (lop) {
13619                 nfs4_end_lock_seqid_sync(lop);
13620                 lock_owner_rele(lop);
13621                 *lopp = NULL;
13622         }
13623 
13624         /* need to free up the reference on osp for lock args */
13625         if (osp != NULL) {
13626                 open_stream_rele(osp, VTOR4(vp));
13627                 *ospp = NULL;
13628         }
13629 
13630         /* need to free up the reference on oop for lock args */
13631         if (oop != NULL) {
13632                 nfs4_end_open_seqid_sync(oop);
13633                 open_owner_rele(oop);
13634                 *oopp = NULL;
13635         }
13636 
13637         crfree(*cred_otwp);
13638         *cred_otwp = base_cr;
13639         crhold(*cred_otwp);
13640 }
13641 
13642 /*
13643  * Function to process the client's recovery for nfs4frlock.
13644  * Returns TRUE if we should retry the lock request; FALSE otherwise.
13645  *
13646  * Calls nfs4_end_fop, drops the seqid syncs, and frees up the
13647  * COMPOUND4 args/res for calls that need to retry.
13648  *
13649  * Note: the rp's r_lkserlock is *not* dropped during this path.
13650  */
13651 static bool_t
13652 nfs4frlock_recovery(int needrecov, nfs4_error_t *ep,
13653     COMPOUND4args_clnt **argspp, COMPOUND4res_clnt **respp,
13654     LOCK4args *lock_args, LOCKU4args *locku_args,
13655     nfs4_open_owner_t **oopp, nfs4_open_stream_t **ospp,
13656     nfs4_lock_owner_t **lopp, rnode4_t *rp, vnode_t *vp,
13657     nfs4_recov_state_t *recov_statep, nfs4_op_hint_t op_hint,
13658     bool_t *did_start_fop, nfs4_lost_rqst_t *lost_rqstp, flock64_t *flk)
13659 {
13660         nfs4_open_owner_t       *oop = *oopp;
13661         nfs4_open_stream_t      *osp = *ospp;
13662         nfs4_lock_owner_t       *lop = *lopp;
13663 
13664         bool_t abort, retry;
13665 
13666         ASSERT(nfs_zone() == VTOMI4(vp)->mi_zone);
13667         ASSERT((*argspp) != NULL);
13668         ASSERT((*respp) != NULL);
13669         if (lock_args || locku_args)
13670                 ASSERT(lop != NULL);
13671 
13672         NFS4_DEBUG((nfs4_client_lock_debug || nfs4_client_recov_debug),
13673             (CE_NOTE, "nfs4frlock_recovery: initiating recovery\n"));
13674 
13675         retry = TRUE;
13676         abort = FALSE;
13677         if (needrecov) {
13678                 nfs4_bseqid_entry_t *bsep = NULL;
13679                 nfs_opnum4 op;
13680 
13681                 op = lock_args ? OP_LOCK : locku_args ? OP_LOCKU : OP_LOCKT;
13682 
13683                 if (!ep->error && ep->stat == NFS4ERR_BAD_SEQID) {
13684                         seqid4 seqid;
13685 
13686                         if (lock_args) {
13687                                 if (lock_args->locker.new_lock_owner == TRUE)
13688                                         seqid = lock_args->locker.locker4_u.
13689                                             open_owner.open_seqid;
13690                                 else
13691                                         seqid = lock_args->locker.locker4_u.
13692                                             lock_owner.lock_seqid;
13693                         } else if (locku_args) {
13694                                 seqid = locku_args->seqid;
13695                         } else {
13696                                 seqid = 0;
13697                         }
13698 
13699                         bsep = nfs4_create_bseqid_entry(oop, lop, vp,
13700                             flk->l_pid, (*argspp)->ctag, seqid);
13701                 }
13702 
13703                 abort = nfs4_start_recovery(ep, VTOMI4(vp), vp, NULL, NULL,
13704                     (lost_rqstp && (lost_rqstp->lr_op == OP_LOCK ||
13705                     lost_rqstp->lr_op == OP_LOCKU)) ? lost_rqstp :
13706                     NULL, op, bsep, NULL, NULL);
13707 
13708                 if (bsep)
13709                         kmem_free(bsep, sizeof (*bsep));
13710         }
13711 
13712         /*
13713          * Return that we do not want to retry the request for 3 cases:
13714          * 1. If we received EINTR or are bailing out because of a forced
13715          *    unmount, we came into this code path just for the sake of
13716          *    initiating recovery, we now need to return the error.
13717          * 2. If we have aborted recovery.
13718          * 3. We received NFS4ERR_BAD_SEQID.
13719          */
13720         if (ep->error == EINTR || NFS4_FRC_UNMT_ERR(ep->error, vp->v_vfsp) ||
13721             abort == TRUE || (ep->error == 0 && ep->stat == NFS4ERR_BAD_SEQID))
13722                 retry = FALSE;
13723 
13724         if (*did_start_fop == TRUE) {
13725                 nfs4_end_fop(VTOMI4(vp), vp, NULL, op_hint, recov_statep,
13726                     needrecov);
13727                 *did_start_fop = FALSE;
13728         }
13729 
13730         if (retry == TRUE) {
13731                 nfs_argop4      *argop;
13732 
13733                 argop = (*argspp)->array;
13734                 ASSERT((*argspp)->array_len == 2);
13735 
13736                 if (argop[1].argop == OP_LOCK)
13737                         nfs4args_lock_free(&argop[1]);
13738                 else if (argop[1].argop == OP_LOCKT)
13739                         nfs4args_lockt_free(&argop[1]);
13740                 kmem_free(argop, 2 * sizeof (nfs_argop4));
13741                 if (!ep->error)
13742                         (void) xdr_free(xdr_COMPOUND4res_clnt, (caddr_t)*respp);
13743                 *respp = NULL;
13744                 *argspp = NULL;
13745         }
13746 
13747         if (lop != NULL) {
13748                 nfs4_end_lock_seqid_sync(lop);
13749                 lock_owner_rele(lop);
13750         }
13751 
13752         *lopp = NULL;
13753 
13754         /* need to free up the reference on osp for lock args */
13755         if (osp != NULL) {
13756                 open_stream_rele(osp, rp);
13757                 *ospp = NULL;
13758         }
13759 
13760         /* need to free up the reference on oop for lock args */
13761         if (oop != NULL) {
13762                 nfs4_end_open_seqid_sync(oop);
13763                 open_owner_rele(oop);
13764                 *oopp = NULL;
13765         }
13766 
13767         return (retry);
13768 }
13769 
13770 /*
13771  * Handles the successful reply from the server for nfs4frlock.
13772  */
13773 static void
13774 nfs4frlock_results_ok(nfs4_lock_call_type_t ctype, int cmd, flock64_t *flk,
13775     vnode_t *vp, int flag, u_offset_t offset,
13776     nfs4_lost_rqst_t *resend_rqstp)
13777 {
13778         ASSERT(nfs_zone() == VTOMI4(vp)->mi_zone);
13779         if ((cmd == F_SETLK || cmd == F_SETLKW) &&
13780             (flk->l_type == F_RDLCK || flk->l_type == F_WRLCK)) {
13781                 if (ctype == NFS4_LCK_CTYPE_NORM) {
13782                         flk->l_pid = ttoproc(curthread)->p_pid;
13783                         /*
13784                          * We do not register lost locks locally in
13785                          * the 'resend' case since the user/application
13786                          * doesn't think we have the lock.
13787                          */
13788                         ASSERT(!resend_rqstp);
13789                         nfs4_register_lock_locally(vp, flk, flag, offset);
13790                 }
13791         }
13792 }
13793 
13794 /*
13795  * Handle the DENIED reply from the server for nfs4frlock.
13796  * Returns TRUE if we should retry the request; FALSE otherwise.
13797  *
13798  * Calls nfs4_end_fop, drops the seqid syncs, and frees up the
13799  * COMPOUND4 args/res for calls that need to retry.  Can also
13800  * drop and regrab the r_lkserlock.
13801  */
13802 static bool_t
13803 nfs4frlock_results_denied(nfs4_lock_call_type_t ctype, LOCK4args *lock_args,
13804     LOCKT4args *lockt_args, nfs4_open_owner_t **oopp,
13805     nfs4_open_stream_t **ospp, nfs4_lock_owner_t **lopp, int cmd,
13806     vnode_t *vp, flock64_t *flk, nfs4_op_hint_t op_hint,
13807     nfs4_recov_state_t *recov_statep, int needrecov,
13808     COMPOUND4args_clnt **argspp, COMPOUND4res_clnt **respp,
13809     clock_t *tick_delayp, short *whencep, int *errorp,
13810     nfs_resop4 *resop, cred_t *cr, bool_t *did_start_fop,
13811     bool_t *skip_get_err)
13812 {
13813         ASSERT(nfs_zone() == VTOMI4(vp)->mi_zone);
13814 
13815         if (lock_args) {
13816                 nfs4_open_owner_t       *oop = *oopp;
13817                 nfs4_open_stream_t      *osp = *ospp;
13818                 nfs4_lock_owner_t       *lop = *lopp;
13819                 int                     intr;
13820 
13821                 /*
13822                  * Blocking lock needs to sleep and retry from the request.
13823                  *
13824                  * Do not block and wait for 'resend' or 'reinstate'
13825                  * lock requests, just return the error.
13826                  *
13827                  * Note: reclaim requests have cmd == F_SETLK, not F_SETLKW.
13828                  */
13829                 if (cmd == F_SETLKW) {
13830                         rnode4_t *rp = VTOR4(vp);
13831                         nfs_argop4 *argop = (*argspp)->array;
13832 
13833                         ASSERT(ctype == NFS4_LCK_CTYPE_NORM);
13834 
13835                         nfs4_end_fop(VTOMI4(vp), vp, NULL, op_hint,
13836                             recov_statep, needrecov);
13837                         *did_start_fop = FALSE;
13838                         ASSERT((*argspp)->array_len == 2);
13839                         if (argop[1].argop == OP_LOCK)
13840                                 nfs4args_lock_free(&argop[1]);
13841                         else if (argop[1].argop == OP_LOCKT)
13842                                 nfs4args_lockt_free(&argop[1]);
13843                         kmem_free(argop, 2 * sizeof (nfs_argop4));
13844                         if (*respp)
13845                                 (void) xdr_free(xdr_COMPOUND4res_clnt,
13846                                     (caddr_t)*respp);
13847                         *argspp = NULL;
13848                         *respp = NULL;
13849                         nfs4_end_lock_seqid_sync(lop);
13850                         lock_owner_rele(lop);
13851                         *lopp = NULL;
13852                         if (osp != NULL) {
13853                                 open_stream_rele(osp, rp);
13854                                 *ospp = NULL;
13855                         }
13856                         if (oop != NULL) {
13857                                 nfs4_end_open_seqid_sync(oop);
13858                                 open_owner_rele(oop);
13859                                 *oopp = NULL;
13860                         }
13861 
13862                         nfs_rw_exit(&rp->r_lkserlock);
13863 
13864                         intr = nfs4_block_and_wait(tick_delayp, rp);
13865 
13866                         if (intr) {
13867                                 (void) nfs_rw_enter_sig(&rp->r_lkserlock,
13868                                     RW_WRITER, FALSE);
13869                                 *errorp = EINTR;
13870                                 return (FALSE);
13871                         }
13872 
13873                         (void) nfs_rw_enter_sig(&rp->r_lkserlock,
13874                             RW_WRITER, FALSE);
13875 
13876                         /*
13877                          * Make sure we are still safe to lock with
13878                          * regards to mmapping.
13879                          */
13880                         if (!nfs4_safelock(vp, flk, cr)) {
13881                                 *errorp = EAGAIN;
13882                                 return (FALSE);
13883                         }
13884 
13885                         return (TRUE);
13886                 }
13887                 if (ctype == NFS4_LCK_CTYPE_NORM)
13888                         *errorp = EAGAIN;
13889                 *skip_get_err = TRUE;
13890                 flk->l_whence = 0;
13891                 *whencep = 0;
13892                 return (FALSE);
13893         } else if (lockt_args) {
13894                 NFS4_DEBUG(nfs4_client_lock_debug, (CE_NOTE,
13895                     "nfs4frlock_results_denied: OP_LOCKT DENIED"));
13896 
13897                 denied_to_flk(&resop->nfs_resop4_u.oplockt.denied,
13898                     flk, lockt_args);
13899 
13900                 /* according to NLM code */
13901                 *errorp = 0;
13902                 *whencep = 0;
13903                 *skip_get_err = TRUE;
13904                 return (FALSE);
13905         }
13906         return (FALSE);
13907 }
13908 
13909 /*
13910  * Handles all NFS4 errors besides NFS4_OK and NFS4ERR_DENIED for nfs4frlock.
13911  */
13912 static void
13913 nfs4frlock_results_default(COMPOUND4res_clnt *resp, int *errorp)
13914 {
13915         switch (resp->status) {
13916         case NFS4ERR_ACCESS:
13917         case NFS4ERR_ADMIN_REVOKED:
13918         case NFS4ERR_BADHANDLE:
13919         case NFS4ERR_BAD_RANGE:
13920         case NFS4ERR_BAD_SEQID:
13921         case NFS4ERR_BAD_STATEID:
13922         case NFS4ERR_BADXDR:
13923         case NFS4ERR_DEADLOCK:
13924         case NFS4ERR_DELAY:
13925         case NFS4ERR_EXPIRED:
13926         case NFS4ERR_FHEXPIRED:
13927         case NFS4ERR_GRACE:
13928         case NFS4ERR_INVAL:
13929         case NFS4ERR_ISDIR:
13930         case NFS4ERR_LEASE_MOVED:
13931         case NFS4ERR_LOCK_NOTSUPP:
13932         case NFS4ERR_LOCK_RANGE:
13933         case NFS4ERR_MOVED:
13934         case NFS4ERR_NOFILEHANDLE:
13935         case NFS4ERR_NO_GRACE:
13936         case NFS4ERR_OLD_STATEID:
13937         case NFS4ERR_OPENMODE:
13938         case NFS4ERR_RECLAIM_BAD:
13939         case NFS4ERR_RECLAIM_CONFLICT:
13940         case NFS4ERR_RESOURCE:
13941         case NFS4ERR_SERVERFAULT:
13942         case NFS4ERR_STALE:
13943         case NFS4ERR_STALE_CLIENTID:
13944         case NFS4ERR_STALE_STATEID:
13945                 return;
13946         default:
13947                 NFS4_DEBUG(nfs4_client_lock_debug, (CE_NOTE,
13948                     "nfs4frlock_results_default: got unrecognizable "
13949                     "res.status %d", resp->status));
13950                 *errorp = NFS4ERR_INVAL;
13951         }
13952 }
13953 
13954 /*
13955  * The lock request was successful, so update the client's state.
13956  */
13957 static void
13958 nfs4frlock_update_state(LOCK4args *lock_args, LOCKU4args *locku_args,
13959     LOCKT4args *lockt_args, nfs_resop4 *resop, nfs4_lock_owner_t *lop,
13960     vnode_t *vp, flock64_t *flk, cred_t *cr,
13961     nfs4_lost_rqst_t *resend_rqstp)
13962 {
13963         ASSERT(nfs_zone() == VTOMI4(vp)->mi_zone);
13964 
13965         if (lock_args) {
13966                 LOCK4res *lock_res;
13967 
13968                 lock_res = &resop->nfs_resop4_u.oplock;
13969                 /* update the stateid with server's response */
13970 
13971                 if (lock_args->locker.new_lock_owner == TRUE) {
13972                         mutex_enter(&lop->lo_lock);
13973                         lop->lo_just_created = NFS4_PERM_CREATED;
13974                         mutex_exit(&lop->lo_lock);
13975                 }
13976 
13977                 nfs4_set_lock_stateid(lop, lock_res->LOCK4res_u.lock_stateid);
13978 
13979                 /*
13980                  * If the lock was the result of a resending a lost
13981                  * request, we've synched up the stateid and seqid
13982                  * with the server, but now the server might be out of sync
13983                  * with what the application thinks it has for locks.
13984                  * Clean that up here.  It's unclear whether we should do
13985                  * this even if the filesystem has been forcibly unmounted.
13986                  * For most servers, it's probably wasted effort, but
13987                  * RFC3530 lets servers require that unlocks exactly match
13988                  * the locks that are held.
13989                  */
13990                 if (resend_rqstp != NULL &&
13991                     resend_rqstp->lr_ctype != NFS4_LCK_CTYPE_REINSTATE) {
13992                         nfs4_reinstitute_local_lock_state(vp, flk, cr, lop);
13993                 } else {
13994                         flk->l_whence = 0;
13995                 }
13996         } else if (locku_args) {
13997                 LOCKU4res *locku_res;
13998 
13999                 locku_res = &resop->nfs_resop4_u.oplocku;
14000 
14001                 /* Update the stateid with the server's response */
14002                 nfs4_set_lock_stateid(lop, locku_res->lock_stateid);
14003         } else if (lockt_args) {
14004                 /* Switch the lock type to express success, see fcntl */
14005                 flk->l_type = F_UNLCK;
14006                 flk->l_whence = 0;
14007         }
14008 }
14009 
14010 /*
14011  * Do final cleanup before exiting nfs4frlock.
14012  * Calls nfs4_end_fop, drops the seqid syncs, and frees up the
14013  * COMPOUND4 args/res for calls that haven't already.
14014  */
14015 static void
14016 nfs4frlock_final_cleanup(nfs4_lock_call_type_t ctype, COMPOUND4args_clnt *argsp,
14017     COMPOUND4res_clnt *resp, vnode_t *vp, nfs4_op_hint_t op_hint,
14018     nfs4_recov_state_t *recov_statep, int needrecov, nfs4_open_owner_t *oop,
14019     nfs4_open_stream_t *osp, nfs4_lock_owner_t *lop, flock64_t *flk,
14020     short whence, u_offset_t offset, struct lm_sysid *ls,
14021     int *errorp, LOCK4args *lock_args, LOCKU4args *locku_args,
14022     bool_t did_start_fop, bool_t skip_get_err,
14023     cred_t *cred_otw, cred_t *cred)
14024 {
14025         mntinfo4_t      *mi = VTOMI4(vp);
14026         rnode4_t        *rp = VTOR4(vp);
14027         int             error = *errorp;
14028         nfs_argop4      *argop;
14029         int     do_flush_pages = 0;
14030 
14031         ASSERT(nfs_zone() == mi->mi_zone);
14032         /*
14033          * The client recovery code wants the raw status information,
14034          * so don't map the NFS status code to an errno value for
14035          * non-normal call types.
14036          */
14037         if (ctype == NFS4_LCK_CTYPE_NORM) {
14038                 if (*errorp == 0 && resp != NULL && skip_get_err == FALSE)
14039                         *errorp = geterrno4(resp->status);
14040                 if (did_start_fop == TRUE)
14041                         nfs4_end_fop(mi, vp, NULL, op_hint, recov_statep,
14042                             needrecov);
14043 
14044                 /*
14045                  * We've established a new lock on the server, so invalidate
14046                  * the pages associated with the vnode to get the most up to
14047                  * date pages from the server after acquiring the lock. We
14048                  * want to be sure that the read operation gets the newest data.
14049                  * N.B.
14050                  * We used to do this in nfs4frlock_results_ok but that doesn't
14051                  * work since VOP_PUTPAGE can call nfs4_commit which calls
14052                  * nfs4_start_fop. We flush the pages below after calling
14053                  * nfs4_end_fop above
14054                  * The flush of the page cache must be done after
14055                  * nfs4_end_open_seqid_sync() to avoid a 4-way hang.
14056                  */
14057                 if (!error && resp && resp->status == NFS4_OK)
14058                         do_flush_pages = 1;
14059         }
14060         if (argsp) {
14061                 ASSERT(argsp->array_len == 2);
14062                 argop = argsp->array;
14063                 if (argop[1].argop == OP_LOCK)
14064                         nfs4args_lock_free(&argop[1]);
14065                 else if (argop[1].argop == OP_LOCKT)
14066                         nfs4args_lockt_free(&argop[1]);
14067                 kmem_free(argop, 2 * sizeof (nfs_argop4));
14068                 if (resp)
14069                         (void) xdr_free(xdr_COMPOUND4res_clnt, (caddr_t)resp);
14070         }
14071 
14072         /* free the reference on the lock owner */
14073         if (lop != NULL) {
14074                 nfs4_end_lock_seqid_sync(lop);
14075                 lock_owner_rele(lop);
14076         }
14077 
14078         /* need to free up the reference on osp for lock args */
14079         if (osp != NULL)
14080                 open_stream_rele(osp, rp);
14081 
14082         /* need to free up the reference on oop for lock args */
14083         if (oop != NULL) {
14084                 nfs4_end_open_seqid_sync(oop);
14085                 open_owner_rele(oop);
14086         }
14087 
14088         if (do_flush_pages)
14089                 nfs4_flush_pages(vp, cred);
14090 
14091         (void) convoff(vp, flk, whence, offset);
14092 
14093         lm_rel_sysid(ls);
14094 
14095         /*
14096          * Record debug information in the event we get EINVAL.
14097          */
14098         mutex_enter(&mi->mi_lock);
14099         if (*errorp == EINVAL && (lock_args || locku_args) &&
14100             (!(mi->mi_flags & MI4_POSIX_LOCK))) {
14101                 if (!(mi->mi_flags & MI4_LOCK_DEBUG)) {
14102                         zcmn_err(getzoneid(), CE_NOTE,
14103                             "%s operation failed with "
14104                             "EINVAL probably since the server, %s,"
14105                             " doesn't support POSIX style locking",
14106                             lock_args ? "LOCK" : "LOCKU",
14107                             mi->mi_curr_serv->sv_hostname);
14108                         mi->mi_flags |= MI4_LOCK_DEBUG;
14109                 }
14110         }
14111         mutex_exit(&mi->mi_lock);
14112 
14113         if (cred_otw)
14114                 crfree(cred_otw);
14115 }
14116 
14117 /*
14118  * This calls the server and the local locking code.
14119  *
14120  * Client locks are registerred locally by oring the sysid with
14121  * LM_SYSID_CLIENT. The server registers locks locally using just the sysid.
14122  * We need to distinguish between the two to avoid collision in case one
14123  * machine is used as both client and server.
14124  *
14125  * Blocking lock requests will continually retry to acquire the lock
14126  * forever.
14127  *
14128  * The ctype is defined as follows:
14129  * NFS4_LCK_CTYPE_NORM: normal lock request.
14130  *
14131  * NFS4_LCK_CTYPE_RECLAIM:  bypass the usual calls for synchronizing with client
14132  * recovery, get the pid from flk instead of curproc, and don't reregister
14133  * the lock locally.
14134  *
14135  * NFS4_LCK_CTYPE_RESEND: same as NFS4_LCK_CTYPE_RECLAIM, with the addition
14136  * that we will use the information passed in via resend_rqstp to setup the
14137  * lock/locku request.  This resend is the exact same request as the 'lost
14138  * lock', and is initiated by the recovery framework. A successful resend
14139  * request can initiate one or more reinstate requests.
14140  *
14141  * NFS4_LCK_CTYPE_REINSTATE: same as NFS4_LCK_CTYPE_RESEND, except that it
14142  * does not trigger additional reinstate requests.  This lock call type is
14143  * set for setting the v4 server's locking state back to match what the
14144  * client's local locking state is in the event of a received 'lost lock'.
14145  *
14146  * Errors are returned via the nfs4_error_t parameter.
14147  */
14148 void
14149 nfs4frlock(nfs4_lock_call_type_t ctype, vnode_t *vp, int cmd, flock64_t *flk,
14150     int flag, u_offset_t offset, cred_t *cr, nfs4_error_t *ep,
14151     nfs4_lost_rqst_t *resend_rqstp, int *did_reclaimp)
14152 {
14153         COMPOUND4args_clnt      args, *argsp = NULL;
14154         COMPOUND4res_clnt       res, *resp = NULL;
14155         nfs_argop4      *argop;
14156         nfs_resop4      *resop;
14157         rnode4_t        *rp;
14158         int             doqueue = 1;
14159         clock_t         tick_delay;  /* delay in clock ticks */
14160         struct lm_sysid *ls;
14161         LOCK4args       *lock_args = NULL;
14162         LOCKU4args      *locku_args = NULL;
14163         LOCKT4args      *lockt_args = NULL;
14164         nfs4_open_owner_t *oop = NULL;
14165         nfs4_open_stream_t *osp = NULL;
14166         nfs4_lock_owner_t *lop = NULL;
14167         bool_t          needrecov = FALSE;
14168         nfs4_recov_state_t recov_state;
14169         short           whence;
14170         nfs4_op_hint_t  op_hint;
14171         nfs4_lost_rqst_t lost_rqst;
14172         bool_t          retry = FALSE;
14173         bool_t          did_start_fop = FALSE;
14174         bool_t          skip_get_err = FALSE;
14175         cred_t          *cred_otw = NULL;
14176         bool_t          recovonly;      /* just queue request */
14177         int             frc_no_reclaim = 0;
14178 #ifdef DEBUG
14179         char *name;
14180 #endif
14181 
14182         ASSERT(nfs_zone() == VTOMI4(vp)->mi_zone);
14183 
14184 #ifdef DEBUG
14185         name = fn_name(VTOSV(vp)->sv_name);
14186         NFS4_DEBUG(nfs4_client_lock_debug, (CE_NOTE, "nfs4frlock: "
14187             "%s: cmd %d, type %d, offset %llu, start %"PRIx64", "
14188             "length %"PRIu64", pid %d, sysid %d, call type %s, "
14189             "resend request %s", name, cmd, flk->l_type, offset, flk->l_start,
14190             flk->l_len, ctype == NFS4_LCK_CTYPE_NORM ? curproc->p_pid :
14191             flk->l_pid, flk->l_sysid, nfs4frlock_get_call_type(ctype),
14192             resend_rqstp ? "TRUE" : "FALSE"));
14193         kmem_free(name, MAXNAMELEN);
14194 #endif
14195 
14196         nfs4_error_zinit(ep);
14197         ep->error = nfs4frlock_validate_args(cmd, flk, flag, vp, offset);
14198         if (ep->error)
14199                 return;
14200         ep->error = nfs4frlock_get_sysid(&ls, vp, flk);
14201         if (ep->error)
14202                 return;
14203         nfs4frlock_pre_setup(&tick_delay, &recov_state, flk, &whence,
14204             vp, cr, &cred_otw);
14205 
14206 recov_retry:
14207         nfs4frlock_call_init(&args, &argsp, &argop, &op_hint, flk, cmd,
14208             &retry, &did_start_fop, &resp, &skip_get_err, &lost_rqst);
14209         rp = VTOR4(vp);
14210 
14211         ep->error = nfs4frlock_start_call(ctype, vp, op_hint, &recov_state,
14212             &did_start_fop, &recovonly);
14213 
14214         if (ep->error)
14215                 goto out;
14216 
14217         if (recovonly) {
14218                 /*
14219                  * Leave the request for the recovery system to deal with.
14220                  */
14221                 ASSERT(ctype == NFS4_LCK_CTYPE_NORM);
14222                 ASSERT(cmd != F_GETLK);
14223                 ASSERT(flk->l_type == F_UNLCK);
14224 
14225                 nfs4_error_init(ep, EINTR);
14226                 needrecov = TRUE;
14227                 lop = find_lock_owner(rp, curproc->p_pid, LOWN_ANY);
14228                 if (lop != NULL) {
14229                         nfs4frlock_save_lost_rqst(ctype, ep->error, READ_LT,
14230                             NULL, NULL, lop, flk, &lost_rqst, cr, vp);
14231                         (void) nfs4_start_recovery(ep,
14232                             VTOMI4(vp), vp, NULL, NULL,
14233                             (lost_rqst.lr_op == OP_LOCK ||
14234                             lost_rqst.lr_op == OP_LOCKU) ?
14235                             &lost_rqst : NULL, OP_LOCKU, NULL, NULL, NULL);
14236                         lock_owner_rele(lop);
14237                         lop = NULL;
14238                 }
14239                 flk->l_pid = curproc->p_pid;
14240                 nfs4_register_lock_locally(vp, flk, flag, offset);
14241                 goto out;
14242         }
14243 
14244         /* putfh directory fh */
14245         argop[0].argop = OP_CPUTFH;
14246         argop[0].nfs_argop4_u.opcputfh.sfh = rp->r_fh;
14247 
14248         /*
14249          * Set up the over-the-wire arguments and get references to the
14250          * open owner, etc.
14251          */
14252 
14253         if (ctype == NFS4_LCK_CTYPE_RESEND ||
14254             ctype == NFS4_LCK_CTYPE_REINSTATE) {
14255                 nfs4frlock_setup_resend_lock_args(resend_rqstp, argsp,
14256                     &argop[1], &lop, &oop, &osp, &lock_args, &locku_args);
14257         } else {
14258                 bool_t go_otw = TRUE;
14259 
14260                 ASSERT(resend_rqstp == NULL);
14261 
14262                 switch (cmd) {
14263                 case F_GETLK:
14264                 case F_O_GETLK:
14265                         nfs4frlock_setup_lockt_args(ctype, &argop[1],
14266                             &lockt_args, argsp, flk, rp);
14267                         break;
14268                 case F_SETLKW:
14269                 case F_SETLK:
14270                         if (flk->l_type == F_UNLCK)
14271                                 nfs4frlock_setup_locku_args(ctype,
14272                                     &argop[1], &locku_args, flk,
14273                                     &lop, ep, argsp,
14274                                     vp, flag, offset, cr,
14275                                     &skip_get_err, &go_otw);
14276                         else
14277                                 nfs4frlock_setup_lock_args(ctype,
14278                                     &lock_args, &oop, &osp, &lop, &argop[1],
14279                                     argsp, flk, cmd, vp, cr, ep);
14280 
14281                         if (ep->error)
14282                                 goto out;
14283 
14284                         switch (ep->stat) {
14285                         case NFS4_OK:
14286                                 break;
14287                         case NFS4ERR_DELAY:
14288                                 /* recov thread never gets this error */
14289                                 ASSERT(resend_rqstp == NULL);
14290                                 ASSERT(did_start_fop);
14291 
14292                                 nfs4_end_fop(VTOMI4(vp), vp, NULL, op_hint,
14293                                     &recov_state, TRUE);
14294                                 did_start_fop = FALSE;
14295                                 if (argop[1].argop == OP_LOCK)
14296                                         nfs4args_lock_free(&argop[1]);
14297                                 else if (argop[1].argop == OP_LOCKT)
14298                                         nfs4args_lockt_free(&argop[1]);
14299                                 kmem_free(argop, 2 * sizeof (nfs_argop4));
14300                                 argsp = NULL;
14301                                 goto recov_retry;
14302                         default:
14303                                 ep->error = EIO;
14304                                 goto out;
14305                         }
14306                         break;
14307                 default:
14308                         NFS4_DEBUG(nfs4_client_lock_debug, (CE_NOTE,
14309                             "nfs4_frlock: invalid cmd %d", cmd));
14310                         ep->error = EINVAL;
14311                         goto out;
14312                 }
14313 
14314                 if (!go_otw)
14315                         goto out;
14316         }
14317 
14318         /* XXX should we use the local reclock as a cache ? */
14319         /*
14320          * Unregister the lock with the local locking code before
14321          * contacting the server.  This avoids a potential race where
14322          * another process gets notified that it has been granted a lock
14323          * before we can unregister ourselves locally.
14324          */
14325         if ((cmd == F_SETLK || cmd == F_SETLKW) && flk->l_type == F_UNLCK) {
14326                 if (ctype == NFS4_LCK_CTYPE_NORM)
14327                         flk->l_pid = ttoproc(curthread)->p_pid;
14328                 nfs4_register_lock_locally(vp, flk, flag, offset);
14329         }
14330 
14331         /*
14332          * Send the server the lock request.  Continually loop with a delay
14333          * if get error NFS4ERR_DENIED (for blocking locks) or NFS4ERR_GRACE.
14334          */
14335         resp = &res;
14336 
14337         NFS4_DEBUG((nfs4_client_call_debug || nfs4_client_lock_debug),
14338             (CE_NOTE,
14339             "nfs4frlock: %s call, rp %s", needrecov ? "recov" : "first",
14340             rnode4info(rp)));
14341 
14342         if (lock_args && frc_no_reclaim) {
14343                 ASSERT(ctype == NFS4_LCK_CTYPE_RECLAIM);
14344                 NFS4_DEBUG(nfs4_client_lock_debug, (CE_NOTE,
14345                     "nfs4frlock: frc_no_reclaim: clearing reclaim"));
14346                 lock_args->reclaim = FALSE;
14347                 if (did_reclaimp)
14348                         *did_reclaimp = 0;
14349         }
14350 
14351         /*
14352          * Do the OTW call.
14353          */
14354         rfs4call(VTOMI4(vp), argsp, resp, cred_otw, &doqueue, 0, ep);
14355 
14356         NFS4_DEBUG(nfs4_client_lock_debug, (CE_NOTE,
14357             "nfs4frlock: error %d, status %d", ep->error, resp->status));
14358 
14359         needrecov = nfs4_needs_recovery(ep, TRUE, vp->v_vfsp);
14360         NFS4_DEBUG(nfs4_client_lock_debug, (CE_NOTE,
14361             "nfs4frlock: needrecov %d", needrecov));
14362 
14363         if (ep->error == 0 && nfs4_need_to_bump_seqid(resp))
14364                 nfs4frlock_bump_seqid(lock_args, locku_args, oop, lop,
14365                     args.ctag);
14366 
14367         /*
14368          * Check if one of these mutually exclusive error cases has
14369          * happened:
14370          *   need to swap credentials due to access error
14371          *   recovery is needed
14372          *   different error (only known case is missing Kerberos ticket)
14373          */
14374 
14375         if ((ep->error == EACCES ||
14376             (ep->error == 0 && resp->status == NFS4ERR_ACCESS)) &&
14377             cred_otw != cr) {
14378                 nfs4frlock_check_access(vp, op_hint, &recov_state, needrecov,
14379                     &did_start_fop, &argsp, &resp, ep->error, &lop, &oop, &osp,
14380                     cr, &cred_otw);
14381                 goto recov_retry;
14382         }
14383 
14384         if (needrecov) {
14385                 /*
14386                  * LOCKT requests don't need to recover from lost
14387                  * requests since they don't create/modify state.
14388                  */
14389                 if ((ep->error == EINTR ||
14390                     NFS4_FRC_UNMT_ERR(ep->error, vp->v_vfsp)) &&
14391                     lockt_args)
14392                         goto out;
14393                 /*
14394                  * Do not attempt recovery for requests initiated by
14395                  * the recovery framework.  Let the framework redrive them.
14396                  */
14397                 if (ctype != NFS4_LCK_CTYPE_NORM)
14398                         goto out;
14399                 else {
14400                         ASSERT(resend_rqstp == NULL);
14401                 }
14402 
14403                 nfs4frlock_save_lost_rqst(ctype, ep->error,
14404                     flk_to_locktype(cmd, flk->l_type),
14405                     oop, osp, lop, flk, &lost_rqst, cred_otw, vp);
14406 
14407                 retry = nfs4frlock_recovery(needrecov, ep, &argsp,
14408                     &resp, lock_args, locku_args, &oop, &osp, &lop,
14409                     rp, vp, &recov_state, op_hint, &did_start_fop,
14410                     cmd != F_GETLK ? &lost_rqst : NULL, flk);
14411 
14412                 if (retry) {
14413                         ASSERT(oop == NULL);
14414                         ASSERT(osp == NULL);
14415                         ASSERT(lop == NULL);
14416                         goto recov_retry;
14417                 }
14418                 goto out;
14419         }
14420 
14421         /*
14422          * Bail out if have reached this point with ep->error set. Can
14423          * happen if (ep->error == EACCES && !needrecov && cred_otw == cr).
14424          * This happens if Kerberos ticket has expired or has been
14425          * destroyed.
14426          */
14427         if (ep->error != 0)
14428                 goto out;
14429 
14430         /*
14431          * Process the reply.
14432          */
14433         switch (resp->status) {
14434         case NFS4_OK:
14435                 resop = &resp->array[1];
14436                 nfs4frlock_results_ok(ctype, cmd, flk, vp, flag, offset,
14437                     resend_rqstp);
14438                 /*
14439                  * Have a successful lock operation, now update state.
14440                  */
14441                 nfs4frlock_update_state(lock_args, locku_args, lockt_args,
14442                     resop, lop, vp, flk, cr, resend_rqstp);
14443                 break;
14444 
14445         case NFS4ERR_DENIED:
14446                 resop = &resp->array[1];
14447                 retry = nfs4frlock_results_denied(ctype, lock_args, lockt_args,
14448                     &oop, &osp, &lop, cmd, vp, flk, op_hint,
14449                     &recov_state, needrecov, &argsp, &resp,
14450                     &tick_delay, &whence, &ep->error, resop, cr,
14451                     &did_start_fop, &skip_get_err);
14452 
14453                 if (retry) {
14454                         ASSERT(oop == NULL);
14455                         ASSERT(osp == NULL);
14456                         ASSERT(lop == NULL);
14457                         goto recov_retry;
14458                 }
14459                 break;
14460         /*
14461          * If the server won't let us reclaim, fall-back to trying to lock
14462          * the file from scratch. Code elsewhere will check the changeinfo
14463          * to ensure the file hasn't been changed.
14464          */
14465         case NFS4ERR_NO_GRACE:
14466                 if (lock_args && lock_args->reclaim == TRUE) {
14467                         ASSERT(ctype == NFS4_LCK_CTYPE_RECLAIM);
14468                         NFS4_DEBUG(nfs4_client_lock_debug, (CE_NOTE,
14469                             "nfs4frlock: reclaim: NFS4ERR_NO_GRACE"));
14470                         frc_no_reclaim = 1;
14471                         /* clean up before retrying */
14472                         needrecov = 0;
14473                         (void) nfs4frlock_recovery(needrecov, ep, &argsp, &resp,
14474                             lock_args, locku_args, &oop, &osp, &lop, rp, vp,
14475                             &recov_state, op_hint, &did_start_fop, NULL, flk);
14476                         goto recov_retry;
14477                 }
14478                 /* FALLTHROUGH */
14479 
14480         default:
14481                 nfs4frlock_results_default(resp, &ep->error);
14482                 break;
14483         }
14484 out:
14485         /*
14486          * Process and cleanup from error.  Make interrupted unlock
14487          * requests look successful, since they will be handled by the
14488          * client recovery code.
14489          */
14490         nfs4frlock_final_cleanup(ctype, argsp, resp, vp, op_hint, &recov_state,
14491             needrecov, oop, osp, lop, flk, whence, offset, ls, &ep->error,
14492             lock_args, locku_args, did_start_fop,
14493             skip_get_err, cred_otw, cr);
14494 
14495         if (ep->error == EINTR && flk->l_type == F_UNLCK &&
14496             (cmd == F_SETLK || cmd == F_SETLKW))
14497                 ep->error = 0;
14498 }
14499 
14500 /*
14501  * nfs4_safelock:
14502  *
14503  * Return non-zero if the given lock request can be handled without
14504  * violating the constraints on concurrent mapping and locking.
14505  */
14506 
14507 static int
14508 nfs4_safelock(vnode_t *vp, const struct flock64 *bfp, cred_t *cr)
14509 {
14510         rnode4_t *rp = VTOR4(vp);
14511         struct vattr va;
14512         int error;
14513 
14514         ASSERT(nfs_zone() == VTOMI4(vp)->mi_zone);
14515         ASSERT(rp->r_mapcnt >= 0);
14516         NFS4_DEBUG(nfs4_client_lock_debug, (CE_NOTE, "nfs4_safelock %s: "
14517             "(%"PRIx64", %"PRIx64"); mapcnt = %ld", bfp->l_type == F_WRLCK ?
14518             "write" : bfp->l_type == F_RDLCK ? "read" : "unlock",
14519             bfp->l_start, bfp->l_len, rp->r_mapcnt));
14520 
14521         if (rp->r_mapcnt == 0)
14522                 return (1);             /* always safe if not mapped */
14523 
14524         /*
14525          * If the file is already mapped and there are locks, then they
14526          * should be all safe locks.  So adding or removing a lock is safe
14527          * as long as the new request is safe (i.e., whole-file, meaning
14528          * length and starting offset are both zero).
14529          */
14530 
14531         if (bfp->l_start != 0 || bfp->l_len != 0) {
14532                 NFS4_DEBUG(nfs4_client_lock_debug, (CE_NOTE, "nfs4_safelock: "
14533                     "cannot lock a memory mapped file unless locking the "
14534                     "entire file: start %"PRIx64", len %"PRIx64,
14535                     bfp->l_start, bfp->l_len));
14536                 return (0);
14537         }
14538 
14539         /* mandatory locking and mapping don't mix */
14540         va.va_mask = AT_MODE;
14541         error = VOP_GETATTR(vp, &va, 0, cr, NULL);
14542         if (error != 0) {
14543                 NFS4_DEBUG(nfs4_client_lock_debug, (CE_NOTE, "nfs4_safelock: "
14544                     "getattr error %d", error));
14545                 return (0);             /* treat errors conservatively */
14546         }
14547         if (MANDLOCK(vp, va.va_mode)) {
14548                 NFS4_DEBUG(nfs4_client_lock_debug, (CE_NOTE, "nfs4_safelock: "
14549                     "cannot mandatory lock and mmap a file"));
14550                 return (0);
14551         }
14552 
14553         return (1);
14554 }
14555 
14556 
14557 /*
14558  * Register the lock locally within Solaris.
14559  * As the client, we "or" the sysid with LM_SYSID_CLIENT when
14560  * recording locks locally.
14561  *
14562  * This should handle conflicts/cooperation with NFS v2/v3 since all locks
14563  * are registered locally.
14564  */
14565 void
14566 nfs4_register_lock_locally(vnode_t *vp, struct flock64 *flk, int flag,
14567     u_offset_t offset)
14568 {
14569         int oldsysid;
14570         int error;
14571 #ifdef DEBUG
14572         char *name;
14573 #endif
14574 
14575         ASSERT(nfs_zone() == VTOMI4(vp)->mi_zone);
14576 
14577 #ifdef DEBUG
14578         name = fn_name(VTOSV(vp)->sv_name);
14579         NFS4_DEBUG(nfs4_client_lock_debug,
14580             (CE_NOTE, "nfs4_register_lock_locally: %s: type %d, "
14581             "start %"PRIx64", length %"PRIx64", pid %ld, sysid %d",
14582             name, flk->l_type, flk->l_start, flk->l_len, (long)flk->l_pid,
14583             flk->l_sysid));
14584         kmem_free(name, MAXNAMELEN);
14585 #endif
14586 
14587         /* register the lock with local locking */
14588         oldsysid = flk->l_sysid;
14589         flk->l_sysid |= LM_SYSID_CLIENT;
14590         error = reclock(vp, flk, SETFLCK, flag, offset, NULL);
14591 #ifdef DEBUG
14592         if (error != 0) {
14593                 NFS4_DEBUG(nfs4_client_lock_debug, (CE_NOTE,
14594                     "nfs4_register_lock_locally: could not register with"
14595                     " local locking"));
14596                 NFS4_DEBUG(nfs4_client_lock_debug, (CE_CONT,
14597                     "error %d, vp 0x%p, pid %d, sysid 0x%x",
14598                     error, (void *)vp, flk->l_pid, flk->l_sysid));
14599                 NFS4_DEBUG(nfs4_client_lock_debug, (CE_CONT,
14600                     "type %d off 0x%" PRIx64 " len 0x%" PRIx64,
14601                     flk->l_type, flk->l_start, flk->l_len));
14602                 (void) reclock(vp, flk, 0, flag, offset, NULL);
14603                 NFS4_DEBUG(nfs4_client_lock_debug, (CE_CONT,
14604                     "blocked by pid %d sysid 0x%x type %d "
14605                     "off 0x%" PRIx64 " len 0x%" PRIx64,
14606                     flk->l_pid, flk->l_sysid, flk->l_type, flk->l_start,
14607                     flk->l_len));
14608         }
14609 #endif
14610         flk->l_sysid = oldsysid;
14611 }
14612 
14613 /*
14614  * nfs4_lockrelease:
14615  *
14616  * Release any locks on the given vnode that are held by the current
14617  * process.  Also removes the lock owner (if one exists) from the rnode's
14618  * list.
14619  */
14620 static int
14621 nfs4_lockrelease(vnode_t *vp, int flag, offset_t offset, cred_t *cr)
14622 {
14623         flock64_t ld;
14624         int ret, error;
14625         rnode4_t *rp;
14626         nfs4_lock_owner_t *lop;
14627         nfs4_recov_state_t recov_state;
14628         mntinfo4_t *mi;
14629         bool_t possible_orphan = FALSE;
14630         bool_t recovonly;
14631 
14632         ASSERT((uintptr_t)vp > KERNELBASE);
14633         ASSERT(nfs_zone() == VTOMI4(vp)->mi_zone);
14634 
14635         rp = VTOR4(vp);
14636         mi = VTOMI4(vp);
14637 
14638         /*
14639          * If we have not locked anything then we can
14640          * just return since we have no work to do.
14641          */
14642         if (rp->r_lo_head.lo_next_rnode == &rp->r_lo_head) {
14643                 return (0);
14644         }
14645 
14646         /*
14647          * We need to comprehend that another thread may
14648          * kick off recovery and the lock_owner we have stashed
14649          * in lop might be invalid so we should NOT cache it
14650          * locally!
14651          */
14652         recov_state.rs_flags = 0;
14653         recov_state.rs_num_retry_despite_err = 0;
14654         error = nfs4_start_fop(mi, vp, NULL, OH_LOCKU, &recov_state,
14655             &recovonly);
14656         if (error) {
14657                 mutex_enter(&rp->r_statelock);
14658                 rp->r_flags |= R4LODANGLERS;
14659                 mutex_exit(&rp->r_statelock);
14660                 return (error);
14661         }
14662 
14663         lop = find_lock_owner(rp, curproc->p_pid, LOWN_ANY);
14664 
14665         /*
14666          * Check if the lock owner might have a lock (request was sent but
14667          * no response was received).  Also check if there are any remote
14668          * locks on the file.  (In theory we shouldn't have to make this
14669          * second check if there's no lock owner, but for now we'll be
14670          * conservative and do it anyway.)  If either condition is true,
14671          * send an unlock for the entire file to the server.
14672          *
14673          * Note that no explicit synchronization is needed here.  At worst,
14674          * flk_has_remote_locks() will return a false positive, in which case
14675          * the unlock call wastes time but doesn't harm correctness.
14676          */
14677 
14678         if (lop) {
14679                 mutex_enter(&lop->lo_lock);
14680                 possible_orphan = lop->lo_pending_rqsts;
14681                 mutex_exit(&lop->lo_lock);
14682                 lock_owner_rele(lop);
14683         }
14684 
14685         nfs4_end_fop(mi, vp, NULL, OH_LOCKU, &recov_state, 0);
14686 
14687         NFS4_DEBUG(nfs4_client_lock_debug, (CE_NOTE,
14688             "nfs4_lockrelease: possible orphan %d, remote locks %d, for "
14689             "lop %p.", possible_orphan, flk_has_remote_locks(vp),
14690             (void *)lop));
14691 
14692         if (possible_orphan || flk_has_remote_locks(vp)) {
14693                 ld.l_type = F_UNLCK;    /* set to unlock entire file */
14694                 ld.l_whence = 0;        /* unlock from start of file */
14695                 ld.l_start = 0;
14696                 ld.l_len = 0;           /* do entire file */
14697 
14698                 ret = VOP_FRLOCK(vp, F_SETLK, &ld, flag, offset, NULL,
14699                     cr, NULL);
14700 
14701                 if (ret != 0) {
14702                         /*
14703                          * If VOP_FRLOCK fails, make sure we unregister
14704                          * local locks before we continue.
14705                          */
14706                         ld.l_pid = ttoproc(curthread)->p_pid;
14707                         nfs4_register_lock_locally(vp, &ld, flag, offset);
14708                         NFS4_DEBUG(nfs4_client_lock_debug, (CE_NOTE,
14709                             "nfs4_lockrelease: lock release error on vp"
14710                             " %p: error %d.\n", (void *)vp, ret));
14711                 }
14712         }
14713 
14714         recov_state.rs_flags = 0;
14715         recov_state.rs_num_retry_despite_err = 0;
14716         error = nfs4_start_fop(mi, vp, NULL, OH_LOCKU, &recov_state,
14717             &recovonly);
14718         if (error) {
14719                 mutex_enter(&rp->r_statelock);
14720                 rp->r_flags |= R4LODANGLERS;
14721                 mutex_exit(&rp->r_statelock);
14722                 return (error);
14723         }
14724 
14725         /*
14726          * So, here we're going to need to retrieve the lock-owner
14727          * again (in case recovery has done a switch-a-roo) and
14728          * remove it because we can.
14729          */
14730         lop = find_lock_owner(rp, curproc->p_pid, LOWN_ANY);
14731 
14732         if (lop) {
14733                 nfs4_rnode_remove_lock_owner(rp, lop);
14734                 lock_owner_rele(lop);
14735         }
14736 
14737         nfs4_end_fop(mi, vp, NULL, OH_LOCKU, &recov_state, 0);
14738         return (0);
14739 }
14740 
14741 /*
14742  * Wait for 'tick_delay' clock ticks.
14743  * Implement exponential backoff until hit the lease_time of this nfs4_server.
14744  * NOTE: lock_lease_time is in seconds.
14745  *
14746  * XXX For future improvements, should implement a waiting queue scheme.
14747  */
14748 static int
14749 nfs4_block_and_wait(clock_t *tick_delay, rnode4_t *rp)
14750 {
14751         long milliseconds_delay;
14752         time_t lock_lease_time;
14753 
14754         /* wait tick_delay clock ticks or siginteruptus */
14755         if (delay_sig(*tick_delay)) {
14756                 return (EINTR);
14757         }
14758         NFS4_DEBUG(nfs4_client_lock_debug, (CE_NOTE, "nfs4_block_and_wait: "
14759             "reissue the lock request: blocked for %ld clock ticks: %ld "
14760             "milliseconds", *tick_delay, drv_hztousec(*tick_delay) / 1000));
14761 
14762         /* get the lease time */
14763         lock_lease_time = r2lease_time(rp);
14764 
14765         /* drv_hztousec converts ticks to microseconds */
14766         milliseconds_delay = drv_hztousec(*tick_delay) / 1000;
14767         if (milliseconds_delay < lock_lease_time * 1000) {
14768                 *tick_delay = 2 * *tick_delay;
14769                 if (drv_hztousec(*tick_delay) > lock_lease_time * 1000 * 1000)
14770                         *tick_delay = drv_usectohz(lock_lease_time*1000*1000);
14771         }
14772         return (0);
14773 }
14774 
14775 
14776 void
14777 nfs4_vnops_init(void)
14778 {
14779 }
14780 
14781 void
14782 nfs4_vnops_fini(void)
14783 {
14784 }
14785 
14786 /*
14787  * Return a reference to the directory (parent) vnode for a given vnode,
14788  * using the saved pathname information and the directory file handle.  The
14789  * caller is responsible for disposing of the reference.
14790  * Returns zero or an errno value.
14791  *
14792  * Caller should set need_start_op to FALSE if it is the recovery
14793  * thread, or if a start_fop has already been done.  Otherwise, TRUE.
14794  */
14795 int
14796 vtodv(vnode_t *vp, vnode_t **dvpp, cred_t *cr, bool_t need_start_op)
14797 {
14798         svnode_t *svnp;
14799         vnode_t *dvp = NULL;
14800         servinfo4_t *svp;
14801         nfs4_fname_t *mfname;
14802         int error;
14803 
14804         ASSERT(nfs_zone() == VTOMI4(vp)->mi_zone);
14805 
14806         if (vp->v_flag & VROOT) {
14807                 nfs4_sharedfh_t *sfh;
14808                 nfs_fh4 fh;
14809                 mntinfo4_t *mi;
14810 
14811                 ASSERT(vp->v_type == VREG);
14812 
14813                 mi = VTOMI4(vp);
14814                 svp = mi->mi_curr_serv;
14815                 (void) nfs_rw_enter_sig(&svp->sv_lock, RW_READER, 0);
14816                 fh.nfs_fh4_len = svp->sv_pfhandle.fh_len;
14817                 fh.nfs_fh4_val = svp->sv_pfhandle.fh_buf;
14818                 sfh = sfh4_get(&fh, VTOMI4(vp));
14819                 nfs_rw_exit(&svp->sv_lock);
14820                 mfname = mi->mi_fname;
14821                 fn_hold(mfname);
14822                 dvp = makenfs4node_by_fh(sfh, NULL, &mfname, NULL, mi, cr, 0);
14823                 sfh4_rele(&sfh);
14824 
14825                 if (dvp->v_type == VNON)
14826                         dvp->v_type = VDIR;
14827                 *dvpp = dvp;
14828                 return (0);
14829         }
14830 
14831         svnp = VTOSV(vp);
14832 
14833         if (svnp == NULL) {
14834                 NFS4_DEBUG(nfs4_client_shadow_debug, (CE_NOTE, "vtodv: "
14835                     "shadow node is NULL"));
14836                 return (EINVAL);
14837         }
14838 
14839         if (svnp->sv_name == NULL || svnp->sv_dfh == NULL) {
14840                 NFS4_DEBUG(nfs4_client_shadow_debug, (CE_NOTE, "vtodv: "
14841                     "shadow node name or dfh val == NULL"));
14842                 return (EINVAL);
14843         }
14844 
14845         error = nfs4_make_dotdot(svnp->sv_dfh, 0, vp, cr, &dvp,
14846             (int)need_start_op);
14847         if (error != 0) {
14848                 NFS4_DEBUG(nfs4_client_shadow_debug, (CE_NOTE, "vtodv: "
14849                     "nfs4_make_dotdot returned %d", error));
14850                 return (error);
14851         }
14852         if (!dvp) {
14853                 NFS4_DEBUG(nfs4_client_shadow_debug, (CE_NOTE, "vtodv: "
14854                     "nfs4_make_dotdot returned a NULL dvp"));
14855                 return (EIO);
14856         }
14857         if (dvp->v_type == VNON)
14858                 dvp->v_type = VDIR;
14859         ASSERT(dvp->v_type == VDIR);
14860         if (VTOR4(vp)->r_flags & R4ISXATTR) {
14861                 mutex_enter(&dvp->v_lock);
14862                 dvp->v_flag |= V_XATTRDIR;
14863                 mutex_exit(&dvp->v_lock);
14864         }
14865         *dvpp = dvp;
14866         return (0);
14867 }
14868 
14869 /*
14870  * Copy the (final) component name of vp to fnamep.  maxlen is the maximum
14871  * length that fnamep can accept, including the trailing null.
14872  * Returns 0 if okay, returns an errno value if there was a problem.
14873  */
14874 
14875 int
14876 vtoname(vnode_t *vp, char *fnamep, ssize_t maxlen)
14877 {
14878         char *fn;
14879         int err = 0;
14880         servinfo4_t *svp;
14881         svnode_t *shvp;
14882 
14883         /*
14884          * If the file being opened has VROOT set, then this is
14885          * a "file" mount.  sv_name will not be interesting, so
14886          * go back to the servinfo4 to get the original mount
14887          * path and strip off all but the final edge.  Otherwise
14888          * just return the name from the shadow vnode.
14889          */
14890 
14891         if (vp->v_flag & VROOT) {
14892 
14893                 svp = VTOMI4(vp)->mi_curr_serv;
14894                 (void) nfs_rw_enter_sig(&svp->sv_lock, RW_READER, 0);
14895 
14896                 fn = strrchr(svp->sv_path, '/');
14897                 if (fn == NULL)
14898                         err = EINVAL;
14899                 else
14900                         fn++;
14901         } else {
14902                 shvp = VTOSV(vp);
14903                 fn = fn_name(shvp->sv_name);
14904         }
14905 
14906         if (err == 0)
14907                 if (strlen(fn) < maxlen)
14908                         (void) strcpy(fnamep, fn);
14909                 else
14910                         err = ENAMETOOLONG;
14911 
14912         if (vp->v_flag & VROOT)
14913                 nfs_rw_exit(&svp->sv_lock);
14914         else
14915                 kmem_free(fn, MAXNAMELEN);
14916 
14917         return (err);
14918 }
14919 
14920 /*
14921  * Bookkeeping for a close that doesn't need to go over the wire.
14922  * *have_lockp is set to 0 if 'os_sync_lock' is released; otherwise
14923  * it is left at 1.
14924  */
14925 void
14926 nfs4close_notw(vnode_t *vp, nfs4_open_stream_t *osp, int *have_lockp)
14927 {
14928         rnode4_t                *rp;
14929         mntinfo4_t              *mi;
14930 
14931         mi = VTOMI4(vp);
14932         rp = VTOR4(vp);
14933 
14934         NFS4_DEBUG(nfs4close_notw_debug, (CE_NOTE, "nfs4close_notw: "
14935             "rp=%p osp=%p", (void *)rp, (void *)osp));
14936         ASSERT(nfs_zone() == mi->mi_zone);
14937         ASSERT(mutex_owned(&osp->os_sync_lock));
14938         ASSERT(*have_lockp);
14939 
14940         if (!osp->os_valid ||
14941             osp->os_open_ref_count > 0 || osp->os_mapcnt > 0) {
14942                 return;
14943         }
14944 
14945         /*
14946          * This removes the reference obtained at OPEN; ie,
14947          * when the open stream structure was created.
14948          *
14949          * We don't have to worry about calling 'open_stream_rele'
14950          * since we our currently holding a reference to this
14951          * open stream which means the count can not go to 0 with
14952          * this decrement.
14953          */
14954         ASSERT(osp->os_ref_count >= 2);
14955         osp->os_ref_count--;
14956         osp->os_valid = 0;
14957         mutex_exit(&osp->os_sync_lock);
14958         *have_lockp = 0;
14959 
14960         nfs4_dec_state_ref_count(mi);
14961 }
14962 
14963 /*
14964  * Close all remaining open streams on the rnode.  These open streams
14965  * could be here because:
14966  * - The close attempted at either close or delmap failed
14967  * - Some kernel entity did VOP_OPEN but never did VOP_CLOSE
14968  * - Someone did mknod on a regular file but never opened it
14969  */
14970 int
14971 nfs4close_all(vnode_t *vp, cred_t *cr)
14972 {
14973         nfs4_open_stream_t *osp;
14974         int error;
14975         nfs4_error_t e = { 0, NFS4_OK, RPC_SUCCESS };
14976         rnode4_t *rp;
14977 
14978         ASSERT(nfs_zone() == VTOMI4(vp)->mi_zone);
14979 
14980         error = 0;
14981         rp = VTOR4(vp);
14982 
14983         /*
14984          * At this point, all we know is that the last time
14985          * someone called vn_rele, the count was 1.  Since then,
14986          * the vnode could have been re-activated.  We want to
14987          * loop through the open streams and close each one, but
14988          * we have to be careful since once we release the rnode
14989          * hash bucket lock, someone else is free to come in and
14990          * re-activate the rnode and add new open streams.  The
14991          * strategy is take the rnode hash bucket lock, verify that
14992          * the count is still 1, grab the open stream off the
14993          * head of the list and mark it invalid, then release the
14994          * rnode hash bucket lock and proceed with that open stream.
14995          * This is ok because nfs4close_one() will acquire the proper
14996          * open/create to close/destroy synchronization for open
14997          * streams, and will ensure that if someone has reopened
14998          * the open stream after we've dropped the hash bucket lock
14999          * then we'll just simply return without destroying the
15000          * open stream.
15001          * Repeat until the list is empty.
15002          */
15003 
15004         for (;;) {
15005 
15006                 /* make sure vnode hasn't been reactivated */
15007                 rw_enter(&rp->r_hashq->r_lock, RW_READER);
15008                 mutex_enter(&vp->v_lock);
15009                 if (vp->v_count > 1) {
15010                         mutex_exit(&vp->v_lock);
15011                         rw_exit(&rp->r_hashq->r_lock);
15012                         break;
15013                 }
15014                 /*
15015                  * Grabbing r_os_lock before releasing v_lock prevents
15016                  * a window where the rnode/open stream could get
15017                  * reactivated (and os_force_close set to 0) before we
15018                  * had a chance to set os_force_close to 1.
15019                  */
15020                 mutex_enter(&rp->r_os_lock);
15021                 mutex_exit(&vp->v_lock);
15022 
15023                 osp = list_head(&rp->r_open_streams);
15024                 if (!osp) {
15025                         /* nothing left to CLOSE OTW, so return */
15026                         mutex_exit(&rp->r_os_lock);
15027                         rw_exit(&rp->r_hashq->r_lock);
15028                         break;
15029                 }
15030 
15031                 mutex_enter(&rp->r_statev4_lock);
15032                 /* the file can't still be mem mapped */
15033                 ASSERT(rp->r_mapcnt == 0);
15034                 if (rp->created_v4)
15035                         rp->created_v4 = 0;
15036                 mutex_exit(&rp->r_statev4_lock);
15037 
15038                 /*
15039                  * Grab a ref on this open stream; nfs4close_one
15040                  * will mark it as invalid
15041                  */
15042                 mutex_enter(&osp->os_sync_lock);
15043                 osp->os_ref_count++;
15044                 osp->os_force_close = 1;
15045                 mutex_exit(&osp->os_sync_lock);
15046                 mutex_exit(&rp->r_os_lock);
15047                 rw_exit(&rp->r_hashq->r_lock);
15048 
15049                 nfs4close_one(vp, osp, cr, 0, NULL, &e, CLOSE_FORCE, 0, 0, 0);
15050 
15051                 /* Update error if it isn't already non-zero */
15052                 if (error == 0) {
15053                         if (e.error)
15054                                 error = e.error;
15055                         else if (e.stat)
15056                                 error = geterrno4(e.stat);
15057                 }
15058 
15059 #ifdef  DEBUG
15060                 nfs4close_all_cnt++;
15061 #endif
15062                 /* Release the ref on osp acquired above. */
15063                 open_stream_rele(osp, rp);
15064 
15065                 /* Proceed to the next open stream, if any */
15066         }
15067         return (error);
15068 }
15069 
15070 /*
15071  * nfs4close_one - close one open stream for a file if needed.
15072  *
15073  * "close_type" indicates which close path this is:
15074  * CLOSE_NORM: close initiated via VOP_CLOSE.
15075  * CLOSE_DELMAP: close initiated via VOP_DELMAP.
15076  * CLOSE_FORCE: close initiated via VOP_INACTIVE.  This path forces
15077  *      the close and release of client state for this open stream
15078  *      (unless someone else has the open stream open).
15079  * CLOSE_RESEND: indicates the request is a replay of an earlier request
15080  *      (e.g., due to abort because of a signal).
15081  * CLOSE_AFTER_RESEND: close initiated to "undo" a successful resent OPEN.
15082  *
15083  * CLOSE_RESEND and CLOSE_AFTER_RESEND will not attempt to retry after client
15084  * recovery.  Instead, the caller is expected to deal with retries.
15085  *
15086  * The caller can either pass in the osp ('provided_osp') or not.
15087  *
15088  * 'access_bits' represents the access we are closing/downgrading.
15089  *
15090  * 'len', 'prot', and 'mmap_flags' are used for CLOSE_DELMAP.  'len' is the
15091  * number of bytes we are unmapping, 'maxprot' is the mmap protection, and
15092  * 'mmap_flags' tells us the type of sharing (MAP_PRIVATE or MAP_SHARED).
15093  *
15094  * Errors are returned via the nfs4_error_t.
15095  */
15096 void
15097 nfs4close_one(vnode_t *vp, nfs4_open_stream_t *provided_osp, cred_t *cr,
15098     int access_bits, nfs4_lost_rqst_t *lrp, nfs4_error_t *ep,
15099     nfs4_close_type_t close_type, size_t len, uint_t maxprot,
15100     uint_t mmap_flags)
15101 {
15102         nfs4_open_owner_t *oop;
15103         nfs4_open_stream_t *osp = NULL;
15104         int retry = 0;
15105         int num_retries = NFS4_NUM_RECOV_RETRIES;
15106         rnode4_t *rp;
15107         mntinfo4_t *mi;
15108         nfs4_recov_state_t recov_state;
15109         cred_t *cred_otw = NULL;
15110         bool_t recovonly = FALSE;
15111         int isrecov;
15112         int force_close;
15113         int close_failed = 0;
15114         int did_dec_count = 0;
15115         int did_start_op = 0;
15116         int did_force_recovlock = 0;
15117         int did_start_seqid_sync = 0;
15118         int have_sync_lock = 0;
15119 
15120         ASSERT(nfs_zone() == VTOMI4(vp)->mi_zone);
15121 
15122         NFS4_DEBUG(nfs4close_one_debug, (CE_NOTE, "closing vp %p osp %p, "
15123             "lrp %p, close type %d len %ld prot %x mmap flags %x bits %x",
15124             (void *)vp, (void *)provided_osp, (void *)lrp, close_type,
15125             len, maxprot, mmap_flags, access_bits));
15126 
15127         nfs4_error_zinit(ep);
15128         rp = VTOR4(vp);
15129         mi = VTOMI4(vp);
15130         isrecov = (close_type == CLOSE_RESEND ||
15131             close_type == CLOSE_AFTER_RESEND);
15132 
15133         /*
15134          * First get the open owner.
15135          */
15136         if (!provided_osp) {
15137                 oop = find_open_owner(cr, NFS4_PERM_CREATED, mi);
15138         } else {
15139                 oop = provided_osp->os_open_owner;
15140                 ASSERT(oop != NULL);
15141                 open_owner_hold(oop);
15142         }
15143 
15144         if (!oop) {
15145                 NFS4_DEBUG(nfs4_client_recov_debug, (CE_NOTE,
15146                     "nfs4close_one: no oop, rp %p, mi %p, cr %p, osp %p, "
15147                     "close type %d", (void *)rp, (void *)mi, (void *)cr,
15148                     (void *)provided_osp, close_type));
15149                 ep->error = EIO;
15150                 goto out;
15151         }
15152 
15153         cred_otw = nfs4_get_otw_cred(cr, mi, oop);
15154 recov_retry:
15155         osp = NULL;
15156         close_failed = 0;
15157         force_close = (close_type == CLOSE_FORCE);
15158         retry = 0;
15159         did_start_op = 0;
15160         did_force_recovlock = 0;
15161         did_start_seqid_sync = 0;
15162         have_sync_lock = 0;
15163         recovonly = FALSE;
15164         recov_state.rs_flags = 0;
15165         recov_state.rs_num_retry_despite_err = 0;
15166 
15167         /*
15168          * Second synchronize with recovery.
15169          */
15170         if (!isrecov) {
15171                 ep->error = nfs4_start_fop(mi, vp, NULL, OH_CLOSE,
15172                     &recov_state, &recovonly);
15173                 if (!ep->error) {
15174                         did_start_op = 1;
15175                 } else {
15176                         close_failed = 1;
15177                         /*
15178                          * If we couldn't get start_fop, but have to
15179                          * cleanup state, then at least acquire the
15180                          * mi_recovlock so we can synchronize with
15181                          * recovery.
15182                          */
15183                         if (close_type == CLOSE_FORCE) {
15184                                 (void) nfs_rw_enter_sig(&mi->mi_recovlock,
15185                                     RW_READER, FALSE);
15186                                 did_force_recovlock = 1;
15187                         } else
15188                                 goto out;
15189                 }
15190         }
15191 
15192         /*
15193          * We cannot attempt to get the open seqid sync if nfs4_start_fop
15194          * set 'recovonly' to TRUE since most likely this is due to
15195          * reovery being active (MI4_RECOV_ACTIV).  If recovery is active,
15196          * nfs4_start_open_seqid_sync() will fail with EAGAIN asking us
15197          * to retry, causing us to loop until recovery finishes.  Plus we
15198          * don't need protection over the open seqid since we're not going
15199          * OTW, hence don't need to use the seqid.
15200          */
15201         if (recovonly == FALSE) {
15202                 /* need to grab the open owner sync before 'os_sync_lock' */
15203                 ep->error = nfs4_start_open_seqid_sync(oop, mi);
15204                 if (ep->error == EAGAIN) {
15205                         ASSERT(!isrecov);
15206                         if (did_start_op)
15207                                 nfs4_end_fop(mi, vp, NULL, OH_CLOSE,
15208                                     &recov_state, TRUE);
15209                         if (did_force_recovlock)
15210                                 nfs_rw_exit(&mi->mi_recovlock);
15211                         goto recov_retry;
15212                 }
15213                 did_start_seqid_sync = 1;
15214         }
15215 
15216         /*
15217          * Third get an open stream and acquire 'os_sync_lock' to
15218          * sychronize the opening/creating of an open stream with the
15219          * closing/destroying of an open stream.
15220          */
15221         if (!provided_osp) {
15222                 /* returns with 'os_sync_lock' held */
15223                 osp = find_open_stream(oop, rp);
15224                 if (!osp) {
15225                         ep->error = EIO;
15226                         goto out;
15227                 }
15228         } else {
15229                 osp = provided_osp;
15230                 open_stream_hold(osp);
15231                 mutex_enter(&osp->os_sync_lock);
15232         }
15233         have_sync_lock = 1;
15234 
15235         ASSERT(oop == osp->os_open_owner);
15236 
15237         /*
15238          * Fourth, do any special pre-OTW CLOSE processing
15239          * based on the specific close type.
15240          */
15241         if ((close_type == CLOSE_NORM || close_type == CLOSE_AFTER_RESEND) &&
15242             !did_dec_count) {
15243                 ASSERT(osp->os_open_ref_count > 0);
15244                 osp->os_open_ref_count--;
15245                 did_dec_count = 1;
15246                 if (osp->os_open_ref_count == 0)
15247                         osp->os_final_close = 1;
15248         }
15249 
15250         if (close_type == CLOSE_FORCE) {
15251                 /* see if somebody reopened the open stream. */
15252                 if (!osp->os_force_close) {
15253                         NFS4_DEBUG(nfs4close_one_debug, (CE_NOTE,
15254                             "nfs4close_one: skip CLOSE_FORCE as osp %p "
15255                             "was reopened, vp %p", (void *)osp, (void *)vp));
15256                         ep->error = 0;
15257                         ep->stat = NFS4_OK;
15258                         goto out;
15259                 }
15260 
15261                 if (!osp->os_final_close && !did_dec_count) {
15262                         osp->os_open_ref_count--;
15263                         did_dec_count = 1;
15264                 }
15265 
15266                 /*
15267                  * We can't depend on os_open_ref_count being 0 due to the
15268                  * way executables are opened (VN_RELE to match a VOP_OPEN).
15269                  */
15270 #ifdef  NOTYET
15271                 ASSERT(osp->os_open_ref_count == 0);
15272 #endif
15273                 if (osp->os_open_ref_count != 0) {
15274                         NFS4_DEBUG(nfs4close_one_debug, (CE_NOTE,
15275                             "nfs4close_one: should panic here on an "
15276                             "ASSERT(osp->os_open_ref_count == 0). Ignoring "
15277                             "since this is probably the exec problem."));
15278 
15279                         osp->os_open_ref_count = 0;
15280                 }
15281 
15282                 /*
15283                  * There is the possibility that nfs4close_one()
15284                  * for close_type == CLOSE_DELMAP couldn't find the
15285                  * open stream, thus couldn't decrement its os_mapcnt;
15286                  * therefore we can't use this ASSERT yet.
15287                  */
15288 #ifdef  NOTYET
15289                 ASSERT(osp->os_mapcnt == 0);
15290 #endif
15291                 osp->os_mapcnt = 0;
15292         }
15293 
15294         if (close_type == CLOSE_DELMAP && !did_dec_count) {
15295                 ASSERT(osp->os_mapcnt >= btopr(len));
15296 
15297                 if ((mmap_flags & MAP_SHARED) && (maxprot & PROT_WRITE))
15298                         osp->os_mmap_write -= btopr(len);
15299                 if (maxprot & PROT_READ)
15300                         osp->os_mmap_read -= btopr(len);
15301                 if (maxprot & PROT_EXEC)
15302                         osp->os_mmap_read -= btopr(len);
15303                 /* mirror the PROT_NONE check in nfs4_addmap() */
15304                 if (!(maxprot & PROT_READ) && !(maxprot & PROT_WRITE) &&
15305                     !(maxprot & PROT_EXEC))
15306                         osp->os_mmap_read -= btopr(len);
15307                 osp->os_mapcnt -= btopr(len);
15308                 did_dec_count = 1;
15309         }
15310 
15311         if (recovonly) {
15312                 nfs4_lost_rqst_t lost_rqst;
15313 
15314                 /* request should not already be in recovery queue */
15315                 ASSERT(lrp == NULL);
15316                 nfs4_error_init(ep, EINTR);
15317                 nfs4close_save_lost_rqst(ep->error, &lost_rqst, oop,
15318                     osp, cred_otw, vp);
15319                 mutex_exit(&osp->os_sync_lock);
15320                 have_sync_lock = 0;
15321                 (void) nfs4_start_recovery(ep, mi, vp, NULL, NULL,
15322                     lost_rqst.lr_op == OP_CLOSE ?
15323                     &lost_rqst : NULL, OP_CLOSE, NULL, NULL, NULL);
15324                 close_failed = 1;
15325                 force_close = 0;
15326                 goto close_cleanup;
15327         }
15328 
15329         /*
15330          * If a previous OTW call got NFS4ERR_BAD_SEQID, then
15331          * we stopped operating on the open owner's <old oo_name, old seqid>
15332          * space, which means we stopped operating on the open stream
15333          * too.  So don't go OTW (as the seqid is likely bad, and the
15334          * stateid could be stale, potentially triggering a false
15335          * setclientid), and just clean up the client's internal state.
15336          */
15337         if (osp->os_orig_oo_name != oop->oo_name) {
15338                 NFS4_DEBUG(nfs4close_one_debug || nfs4_client_recov_debug,
15339                     (CE_NOTE, "nfs4close_one: skip OTW close for osp %p "
15340                     "oop %p due to bad seqid (orig oo_name %" PRIx64 " current "
15341                     "oo_name %" PRIx64")",
15342                     (void *)osp, (void *)oop, osp->os_orig_oo_name,
15343                     oop->oo_name));
15344                 close_failed = 1;
15345         }
15346 
15347         /* If the file failed recovery, just quit. */
15348         mutex_enter(&rp->r_statelock);
15349         if (rp->r_flags & R4RECOVERR) {
15350                 close_failed = 1;
15351         }
15352         mutex_exit(&rp->r_statelock);
15353 
15354         /*
15355          * If the force close path failed to obtain start_fop
15356          * then skip the OTW close and just remove the state.
15357          */
15358         if (close_failed)
15359                 goto close_cleanup;
15360 
15361         /*
15362          * Fifth, check to see if there are still mapped pages or other
15363          * opens using this open stream.  If there are then we can't
15364          * close yet but we can see if an OPEN_DOWNGRADE is necessary.
15365          */
15366         if (osp->os_open_ref_count > 0 || osp->os_mapcnt > 0) {
15367                 nfs4_lost_rqst_t        new_lost_rqst;
15368                 bool_t                  needrecov = FALSE;
15369                 cred_t                  *odg_cred_otw = NULL;
15370                 seqid4                  open_dg_seqid = 0;
15371 
15372                 if (osp->os_delegation) {
15373                         /*
15374                          * If this open stream was never OPENed OTW then we
15375                          * surely can't DOWNGRADE it (especially since the
15376                          * osp->open_stateid is really a delegation stateid
15377                          * when os_delegation is 1).
15378                          */
15379                         if (access_bits & FREAD)
15380                                 osp->os_share_acc_read--;
15381                         if (access_bits & FWRITE)
15382                                 osp->os_share_acc_write--;
15383                         osp->os_share_deny_none--;
15384                         nfs4_error_zinit(ep);
15385                         goto out;
15386                 }
15387                 nfs4_open_downgrade(access_bits, 0, oop, osp, vp, cr,
15388                     lrp, ep, &odg_cred_otw, &open_dg_seqid);
15389                 needrecov = nfs4_needs_recovery(ep, TRUE, mi->mi_vfsp);
15390                 if (needrecov && !isrecov) {
15391                         bool_t abort;
15392                         nfs4_bseqid_entry_t *bsep = NULL;
15393 
15394                         if (!ep->error && ep->stat == NFS4ERR_BAD_SEQID)
15395                                 bsep = nfs4_create_bseqid_entry(oop, NULL,
15396                                     vp, 0,
15397                                     lrp ? TAG_OPEN_DG_LOST : TAG_OPEN_DG,
15398                                     open_dg_seqid);
15399 
15400                         nfs4open_dg_save_lost_rqst(ep->error, &new_lost_rqst,
15401                             oop, osp, odg_cred_otw, vp, access_bits, 0);
15402                         mutex_exit(&osp->os_sync_lock);
15403                         have_sync_lock = 0;
15404                         abort = nfs4_start_recovery(ep, mi, vp, NULL, NULL,
15405                             new_lost_rqst.lr_op == OP_OPEN_DOWNGRADE ?
15406                             &new_lost_rqst : NULL, OP_OPEN_DOWNGRADE,
15407                             bsep, NULL, NULL);
15408                         if (odg_cred_otw)
15409                                 crfree(odg_cred_otw);
15410                         if (bsep)
15411                                 kmem_free(bsep, sizeof (*bsep));
15412 
15413                         if (abort == TRUE)
15414                                 goto out;
15415 
15416                         if (did_start_seqid_sync) {
15417                                 nfs4_end_open_seqid_sync(oop);
15418                                 did_start_seqid_sync = 0;
15419                         }
15420                         open_stream_rele(osp, rp);
15421 
15422                         if (did_start_op)
15423                                 nfs4_end_fop(mi, vp, NULL, OH_CLOSE,
15424                                     &recov_state, FALSE);
15425                         if (did_force_recovlock)
15426                                 nfs_rw_exit(&mi->mi_recovlock);
15427 
15428                         goto recov_retry;
15429                 } else {
15430                         if (odg_cred_otw)
15431                                 crfree(odg_cred_otw);
15432                 }
15433                 goto out;
15434         }
15435 
15436         /*
15437          * If this open stream was created as the results of an open
15438          * while holding a delegation, then just release it; no need
15439          * to do an OTW close.  Otherwise do a "normal" OTW close.
15440          */
15441         if (osp->os_delegation) {
15442                 nfs4close_notw(vp, osp, &have_sync_lock);
15443                 nfs4_error_zinit(ep);
15444                 goto out;
15445         }
15446 
15447         /*
15448          * If this stream is not valid, we're done.
15449          */
15450         if (!osp->os_valid) {
15451                 nfs4_error_zinit(ep);
15452                 goto out;
15453         }
15454 
15455         /*
15456          * Last open or mmap ref has vanished, need to do an OTW close.
15457          * First check to see if a close is still necessary.
15458          */
15459         if (osp->os_failed_reopen) {
15460                 NFS4_DEBUG(nfs4_client_recov_debug, (CE_NOTE,
15461                     "don't close OTW osp %p since reopen failed.",
15462                     (void *)osp));
15463                 /*
15464                  * Reopen of the open stream failed, hence the
15465                  * stateid of the open stream is invalid/stale, and
15466                  * sending this OTW would incorrectly cause another
15467                  * round of recovery.  In this case, we need to set
15468                  * the 'os_valid' bit to 0 so another thread doesn't
15469                  * come in and re-open this open stream before
15470                  * this "closing" thread cleans up state (decrementing
15471                  * the nfs4_server_t's state_ref_count and decrementing
15472                  * the os_ref_count).
15473                  */
15474                 osp->os_valid = 0;
15475                 /*
15476                  * This removes the reference obtained at OPEN; ie,
15477                  * when the open stream structure was created.
15478                  *
15479                  * We don't have to worry about calling 'open_stream_rele'
15480                  * since we our currently holding a reference to this
15481                  * open stream which means the count can not go to 0 with
15482                  * this decrement.
15483                  */
15484                 ASSERT(osp->os_ref_count >= 2);
15485                 osp->os_ref_count--;
15486                 nfs4_error_zinit(ep);
15487                 close_failed = 0;
15488                 goto close_cleanup;
15489         }
15490 
15491         ASSERT(osp->os_ref_count > 1);
15492 
15493         /*
15494          * Sixth, try the CLOSE OTW.
15495          */
15496         nfs4close_otw(rp, cred_otw, oop, osp, &retry, &did_start_seqid_sync,
15497             close_type, ep, &have_sync_lock);
15498 
15499         if (ep->error == EINTR || NFS4_FRC_UNMT_ERR(ep->error, vp->v_vfsp)) {
15500                 /*
15501                  * Let the recovery thread be responsible for
15502                  * removing the state for CLOSE.
15503                  */
15504                 close_failed = 1;
15505                 force_close = 0;
15506                 retry = 0;
15507         }
15508 
15509         /* See if we need to retry with a different cred */
15510         if ((ep->error == EACCES ||
15511             (ep->error == 0 && ep->stat == NFS4ERR_ACCESS)) &&
15512             cred_otw != cr) {
15513                 crfree(cred_otw);
15514                 cred_otw = cr;
15515                 crhold(cred_otw);
15516                 retry = 1;
15517         }
15518 
15519         if (ep->error || ep->stat)
15520                 close_failed = 1;
15521 
15522         if (retry && !isrecov && num_retries-- > 0) {
15523                 if (have_sync_lock) {
15524                         mutex_exit(&osp->os_sync_lock);
15525                         have_sync_lock = 0;
15526                 }
15527                 if (did_start_seqid_sync) {
15528                         nfs4_end_open_seqid_sync(oop);
15529                         did_start_seqid_sync = 0;
15530                 }
15531                 open_stream_rele(osp, rp);
15532 
15533                 if (did_start_op)
15534                         nfs4_end_fop(mi, vp, NULL, OH_CLOSE,
15535                             &recov_state, FALSE);
15536                 if (did_force_recovlock)
15537                         nfs_rw_exit(&mi->mi_recovlock);
15538                 NFS4_DEBUG(nfs4_client_recov_debug, (CE_NOTE,
15539                     "nfs4close_one: need to retry the close "
15540                     "operation"));
15541                 goto recov_retry;
15542         }
15543 close_cleanup:
15544         /*
15545          * Seventh and lastly, process our results.
15546          */
15547         if (close_failed && force_close) {
15548                 /*
15549                  * It's ok to drop and regrab the 'os_sync_lock' since
15550                  * nfs4close_notw() will recheck to make sure the
15551                  * "close"/removal of state should happen.
15552                  */
15553                 if (!have_sync_lock) {
15554                         mutex_enter(&osp->os_sync_lock);
15555                         have_sync_lock = 1;
15556                 }
15557                 /*
15558                  * This is last call, remove the ref on the open
15559                  * stream created by open and clean everything up.
15560                  */
15561                 osp->os_pending_close = 0;
15562                 nfs4close_notw(vp, osp, &have_sync_lock);
15563                 nfs4_error_zinit(ep);
15564         }
15565 
15566         if (!close_failed) {
15567                 if (have_sync_lock) {
15568                         osp->os_pending_close = 0;
15569                         mutex_exit(&osp->os_sync_lock);
15570                         have_sync_lock = 0;
15571                 } else {
15572                         mutex_enter(&osp->os_sync_lock);
15573                         osp->os_pending_close = 0;
15574                         mutex_exit(&osp->os_sync_lock);
15575                 }
15576                 if (did_start_op && recov_state.rs_sp != NULL) {
15577                         mutex_enter(&recov_state.rs_sp->s_lock);
15578                         nfs4_dec_state_ref_count_nolock(recov_state.rs_sp, mi);
15579                         mutex_exit(&recov_state.rs_sp->s_lock);
15580                 } else {
15581                         nfs4_dec_state_ref_count(mi);
15582                 }
15583                 nfs4_error_zinit(ep);
15584         }
15585 
15586 out:
15587         if (have_sync_lock)
15588                 mutex_exit(&osp->os_sync_lock);
15589         if (did_start_op)
15590                 nfs4_end_fop(mi, vp, NULL, OH_CLOSE, &recov_state,
15591                     recovonly ? TRUE : FALSE);
15592         if (did_force_recovlock)
15593                 nfs_rw_exit(&mi->mi_recovlock);
15594         if (cred_otw)
15595                 crfree(cred_otw);
15596         if (osp)
15597                 open_stream_rele(osp, rp);
15598         if (oop) {
15599                 if (did_start_seqid_sync)
15600                         nfs4_end_open_seqid_sync(oop);
15601                 open_owner_rele(oop);
15602         }
15603 }
15604 
15605 /*
15606  * Convert information returned by the server in the LOCK4denied
15607  * structure to the form required by fcntl.
15608  */
15609 static void
15610 denied_to_flk(LOCK4denied *lockt_denied, flock64_t *flk, LOCKT4args *lockt_args)
15611 {
15612         nfs4_lo_name_t *lo;
15613 
15614 #ifdef  DEBUG
15615         if (denied_to_flk_debug) {
15616                 lockt_denied_debug = lockt_denied;
15617                 debug_enter("lockt_denied");
15618         }
15619 #endif
15620 
15621         flk->l_type = lockt_denied->locktype == READ_LT ? F_RDLCK : F_WRLCK;
15622         flk->l_whence = 0;   /* aka SEEK_SET */
15623         flk->l_start = lockt_denied->offset;
15624         flk->l_len = lockt_denied->length;
15625 
15626         /*
15627          * If the blocking clientid matches our client id, then we can
15628          * interpret the lockowner (since we built it).  If not, then
15629          * fabricate a sysid and pid.  Note that the l_sysid field
15630          * in *flk already has the local sysid.
15631          */
15632 
15633         if (lockt_denied->owner.clientid == lockt_args->owner.clientid) {
15634 
15635                 if (lockt_denied->owner.owner_len == sizeof (*lo)) {
15636                         lo = (nfs4_lo_name_t *)
15637                             lockt_denied->owner.owner_val;
15638 
15639                         flk->l_pid = lo->ln_pid;
15640                 } else {
15641                         NFS4_DEBUG(nfs4_client_lock_debug, (CE_NOTE,
15642                             "denied_to_flk: bad lock owner length\n"));
15643 
15644                         flk->l_pid = lo_to_pid(&lockt_denied->owner);
15645                 }
15646         } else {
15647                 NFS4_DEBUG(nfs4_client_lock_debug, (CE_NOTE,
15648                 "denied_to_flk: foreign clientid\n"));
15649 
15650                 /*
15651                  * Construct a new sysid which should be different from
15652                  * sysids of other systems.
15653                  */
15654 
15655                 flk->l_sysid++;
15656                 flk->l_pid = lo_to_pid(&lockt_denied->owner);
15657         }
15658 }
15659 
15660 static pid_t
15661 lo_to_pid(lock_owner4 *lop)
15662 {
15663         pid_t pid = 0;
15664         uchar_t *cp;
15665         int i;
15666 
15667         cp = (uchar_t *)&lop->clientid;
15668 
15669         for (i = 0; i < sizeof (lop->clientid); i++)
15670                 pid += (pid_t)*cp++;
15671 
15672         cp = (uchar_t *)lop->owner_val;
15673 
15674         for (i = 0; i < lop->owner_len; i++)
15675                 pid += (pid_t)*cp++;
15676 
15677         return (pid);
15678 }
15679 
15680 /*
15681  * Given a lock pointer, returns the length of that lock.
15682  * "end" is the last locked offset the "l_len" covers from
15683  * the start of the lock.
15684  */
15685 static off64_t
15686 lock_to_end(flock64_t *lock)
15687 {
15688         off64_t lock_end;
15689 
15690         if (lock->l_len == 0)
15691                 lock_end = (off64_t)MAXEND;
15692         else
15693                 lock_end = lock->l_start + lock->l_len - 1;
15694 
15695         return (lock_end);
15696 }
15697 
15698 /*
15699  * Given the end of a lock, it will return you the length "l_len" for that lock.
15700  */
15701 static off64_t
15702 end_to_len(off64_t start, off64_t end)
15703 {
15704         off64_t lock_len;
15705 
15706         ASSERT(end >= start);
15707         if (end == MAXEND)
15708                 lock_len = 0;
15709         else
15710                 lock_len = end - start + 1;
15711 
15712         return (lock_len);
15713 }
15714 
15715 /*
15716  * On given end for a lock it determines if it is the last locked offset
15717  * or not, if so keeps it as is, else adds one to return the length for
15718  * valid start.
15719  */
15720 static off64_t
15721 start_check(off64_t x)
15722 {
15723         if (x == MAXEND)
15724                 return (x);
15725         else
15726                 return (x + 1);
15727 }
15728 
15729 /*
15730  * See if these two locks overlap, and if so return 1;
15731  * otherwise, return 0.
15732  */
15733 static int
15734 locks_intersect(flock64_t *llfp, flock64_t *curfp)
15735 {
15736         off64_t llfp_end, curfp_end;
15737 
15738         llfp_end = lock_to_end(llfp);
15739         curfp_end = lock_to_end(curfp);
15740 
15741         if (((llfp_end >= curfp->l_start) &&
15742             (llfp->l_start <= curfp->l_start)) ||
15743             ((curfp->l_start <= llfp->l_start) && (curfp_end >= llfp->l_start)))
15744                 return (1);
15745         return (0);
15746 }
15747 
15748 /*
15749  * Determine what the intersecting lock region is, and add that to the
15750  * 'nl_llpp' locklist in increasing order (by l_start).
15751  */
15752 static void
15753 nfs4_add_lock_range(flock64_t *lost_flp, flock64_t *local_flp,
15754     locklist_t **nl_llpp, vnode_t *vp)
15755 {
15756         locklist_t *intersect_llp, *tmp_fllp, *cur_fllp;
15757         off64_t lost_flp_end, local_flp_end, len, start;
15758 
15759         NFS4_DEBUG(nfs4_lost_rqst_debug, (CE_NOTE, "nfs4_add_lock_range:"));
15760 
15761         if (!locks_intersect(lost_flp, local_flp))
15762                 return;
15763 
15764         NFS4_DEBUG(nfs4_lost_rqst_debug, (CE_NOTE, "nfs4_add_lock_range: "
15765             "locks intersect"));
15766 
15767         lost_flp_end = lock_to_end(lost_flp);
15768         local_flp_end = lock_to_end(local_flp);
15769 
15770         /* Find the starting point of the intersecting region */
15771         if (local_flp->l_start > lost_flp->l_start)
15772                 start = local_flp->l_start;
15773         else
15774                 start = lost_flp->l_start;
15775 
15776         /* Find the lenght of the intersecting region */
15777         if (lost_flp_end < local_flp_end)
15778                 len = end_to_len(start, lost_flp_end);
15779         else
15780                 len = end_to_len(start, local_flp_end);
15781 
15782         /*
15783          * Prepare the flock structure for the intersection found and insert
15784          * it into the new list in increasing l_start order. This list contains
15785          * intersections of locks registered by the client with the local host
15786          * and the lost lock.
15787          * The lock type of this lock is the same as that of the local_flp.
15788          */
15789         intersect_llp = (locklist_t *)kmem_alloc(sizeof (locklist_t), KM_SLEEP);
15790         intersect_llp->ll_flock.l_start = start;
15791         intersect_llp->ll_flock.l_len = len;
15792         intersect_llp->ll_flock.l_type = local_flp->l_type;
15793         intersect_llp->ll_flock.l_pid = local_flp->l_pid;
15794         intersect_llp->ll_flock.l_sysid = local_flp->l_sysid;
15795         intersect_llp->ll_flock.l_whence = 0;        /* aka SEEK_SET */
15796         intersect_llp->ll_vp = vp;
15797 
15798         tmp_fllp = *nl_llpp;
15799         cur_fllp = NULL;
15800         while (tmp_fllp != NULL && tmp_fllp->ll_flock.l_start <
15801             intersect_llp->ll_flock.l_start) {
15802                         cur_fllp = tmp_fllp;
15803                         tmp_fllp = tmp_fllp->ll_next;
15804         }
15805         if (cur_fllp == NULL) {
15806                 /* first on the list */
15807                 intersect_llp->ll_next = *nl_llpp;
15808                 *nl_llpp = intersect_llp;
15809         } else {
15810                 intersect_llp->ll_next = cur_fllp->ll_next;
15811                 cur_fllp->ll_next = intersect_llp;
15812         }
15813 
15814         NFS4_DEBUG(nfs4_lost_rqst_debug, (CE_NOTE, "nfs4_add_lock_range: "
15815             "created lock region: start %"PRIx64" end %"PRIx64" : %s\n",
15816             intersect_llp->ll_flock.l_start,
15817             intersect_llp->ll_flock.l_start + intersect_llp->ll_flock.l_len,
15818             intersect_llp->ll_flock.l_type == F_RDLCK ? "READ" : "WRITE"));
15819 }
15820 
15821 /*
15822  * Our local locking current state is potentially different than
15823  * what the NFSv4 server thinks we have due to a lost lock that was
15824  * resent and then received.  We need to reset our "NFSv4" locking
15825  * state to match the current local locking state for this pid since
15826  * that is what the user/application sees as what the world is.
15827  *
15828  * We cannot afford to drop the open/lock seqid sync since then we can
15829  * get confused about what the current local locking state "is" versus
15830  * "was".
15831  *
15832  * If we are unable to fix up the locks, we send SIGLOST to the affected
15833  * process.  This is not done if the filesystem has been forcibly
15834  * unmounted, in case the process has already exited and a new process
15835  * exists with the same pid.
15836  */
15837 static void
15838 nfs4_reinstitute_local_lock_state(vnode_t *vp, flock64_t *lost_flp, cred_t *cr,
15839     nfs4_lock_owner_t *lop)
15840 {
15841         locklist_t *locks, *llp, *ri_llp, *tmp_llp;
15842         mntinfo4_t *mi = VTOMI4(vp);
15843         const int cmd = F_SETLK;
15844         off64_t cur_start, llp_ll_flock_end, lost_flp_end;
15845         flock64_t ul_fl;
15846 
15847         NFS4_DEBUG(nfs4_lost_rqst_debug, (CE_NOTE,
15848             "nfs4_reinstitute_local_lock_state"));
15849 
15850         /*
15851          * Find active locks for this vp from the local locking code.
15852          * Scan through this list and find out the locks that intersect with
15853          * the lost lock. Once we find the lock that intersects, add the
15854          * intersection area as a new lock to a new list "ri_llp". The lock
15855          * type of the intersection region lock added to ri_llp is the same
15856          * as that found in the active lock list, "list". The intersecting
15857          * region locks are added to ri_llp in increasing l_start order.
15858          */
15859         ASSERT(nfs_zone() == mi->mi_zone);
15860 
15861         locks = flk_active_locks_for_vp(vp);
15862         ri_llp = NULL;
15863 
15864         for (llp = locks; llp != NULL; llp = llp->ll_next) {
15865                 ASSERT(llp->ll_vp == vp);
15866                 /*
15867                  * Pick locks that belong to this pid/lockowner
15868                  */
15869                 if (llp->ll_flock.l_pid != lost_flp->l_pid)
15870                         continue;
15871 
15872                 nfs4_add_lock_range(lost_flp, &llp->ll_flock, &ri_llp, vp);
15873         }
15874 
15875         /*
15876          * Now we have the list of intersections with the lost lock. These are
15877          * the locks that were/are active before the server replied to the
15878          * last/lost lock. Issue these locks to the server here. Playing these
15879          * locks to the server will re-establish aur current local locking state
15880          * with the v4 server.
15881          * If we get an error, send SIGLOST to the application for that lock.
15882          */
15883 
15884         for (llp = ri_llp; llp != NULL; llp = llp->ll_next) {
15885                 NFS4_DEBUG(nfs4_lost_rqst_debug, (CE_NOTE,
15886                     "nfs4_reinstitute_local_lock_state: need to issue "
15887                     "flock: [%"PRIx64" - %"PRIx64"] : %s",
15888                     llp->ll_flock.l_start,
15889                     llp->ll_flock.l_start + llp->ll_flock.l_len,
15890                     llp->ll_flock.l_type == F_RDLCK ? "READ" :
15891                     llp->ll_flock.l_type == F_WRLCK ? "WRITE" : "INVALID"));
15892                 /*
15893                  * No need to relock what we already have
15894                  */
15895                 if (llp->ll_flock.l_type == lost_flp->l_type)
15896                         continue;
15897 
15898                 push_reinstate(vp, cmd, &llp->ll_flock, cr, lop);
15899         }
15900 
15901         /*
15902          * Now keeping the start of the lost lock as our reference parse the
15903          * newly created ri_llp locklist to find the ranges that we have locked
15904          * with the v4 server but not in the current local locking. We need
15905          * to unlock these ranges.
15906          * These ranges can also be reffered to as those ranges, where the lost
15907          * lock does not overlap with the locks in the ri_llp but are locked
15908          * since the server replied to the lost lock.
15909          */
15910         cur_start = lost_flp->l_start;
15911         lost_flp_end = lock_to_end(lost_flp);
15912 
15913         ul_fl.l_type = F_UNLCK;
15914         ul_fl.l_whence = 0;     /* aka SEEK_SET */
15915         ul_fl.l_sysid = lost_flp->l_sysid;
15916         ul_fl.l_pid = lost_flp->l_pid;
15917 
15918         for (llp = ri_llp; llp != NULL; llp = llp->ll_next) {
15919                 llp_ll_flock_end = lock_to_end(&llp->ll_flock);
15920 
15921                 if (llp->ll_flock.l_start <= cur_start) {
15922                         cur_start = start_check(llp_ll_flock_end);
15923                         continue;
15924                 }
15925                 NFS4_DEBUG(nfs4_lost_rqst_debug, (CE_NOTE,
15926                     "nfs4_reinstitute_local_lock_state: "
15927                     "UNLOCK [%"PRIx64" - %"PRIx64"]",
15928                     cur_start, llp->ll_flock.l_start));
15929 
15930                 ul_fl.l_start = cur_start;
15931                 ul_fl.l_len = end_to_len(cur_start,
15932                     (llp->ll_flock.l_start - 1));
15933 
15934                 push_reinstate(vp, cmd, &ul_fl, cr, lop);
15935                 cur_start = start_check(llp_ll_flock_end);
15936         }
15937 
15938         /*
15939          * In the case where the lost lock ends after all intersecting locks,
15940          * unlock the last part of the lost lock range.
15941          */
15942         if (cur_start != start_check(lost_flp_end)) {
15943                 NFS4_DEBUG(nfs4_lost_rqst_debug, (CE_NOTE,
15944                     "nfs4_reinstitute_local_lock_state: UNLOCK end of the "
15945                     "lost lock region [%"PRIx64" - %"PRIx64"]",
15946                     cur_start, lost_flp->l_start + lost_flp->l_len));
15947 
15948                 ul_fl.l_start = cur_start;
15949                 /*
15950                  * Is it an to-EOF lock? if so unlock till the end
15951                  */
15952                 if (lost_flp->l_len == 0)
15953                         ul_fl.l_len = 0;
15954                 else
15955                         ul_fl.l_len = start_check(lost_flp_end) - cur_start;
15956 
15957                 push_reinstate(vp, cmd, &ul_fl, cr, lop);
15958         }
15959 
15960         if (locks != NULL)
15961                 flk_free_locklist(locks);
15962 
15963         /* Free up our newly created locklist */
15964         for (llp = ri_llp; llp != NULL; ) {
15965                 tmp_llp = llp->ll_next;
15966                 kmem_free(llp, sizeof (locklist_t));
15967                 llp = tmp_llp;
15968         }
15969 
15970         /*
15971          * Now return back to the original calling nfs4frlock()
15972          * and let us naturally drop our seqid syncs.
15973          */
15974 }
15975 
15976 /*
15977  * Create a lost state record for the given lock reinstantiation request
15978  * and push it onto the lost state queue.
15979  */
15980 static void
15981 push_reinstate(vnode_t *vp, int cmd, flock64_t *flk, cred_t *cr,
15982     nfs4_lock_owner_t *lop)
15983 {
15984         nfs4_lost_rqst_t req;
15985         nfs_lock_type4 locktype;
15986         nfs4_error_t e = { EINTR, NFS4_OK, RPC_SUCCESS };
15987 
15988         ASSERT(nfs_zone() == VTOMI4(vp)->mi_zone);
15989 
15990         locktype = flk_to_locktype(cmd, flk->l_type);
15991         nfs4frlock_save_lost_rqst(NFS4_LCK_CTYPE_REINSTATE, EINTR, locktype,
15992             NULL, NULL, lop, flk, &req, cr, vp);
15993         (void) nfs4_start_recovery(&e, VTOMI4(vp), vp, NULL, NULL,
15994             (req.lr_op == OP_LOCK || req.lr_op == OP_LOCKU) ?
15995             &req : NULL, flk->l_type == F_UNLCK ? OP_LOCKU : OP_LOCK,
15996             NULL, NULL, NULL);
15997 }