1 /*
   2  * CDDL HEADER START
   3  *
   4  * The contents of this file are subject to the terms of the
   5  * Common Development and Distribution License (the "License").
   6  * You may not use this file except in compliance with the License.
   7  *
   8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
   9  * or http://www.opensolaris.org/os/licensing.
  10  * See the License for the specific language governing permissions
  11  * and limitations under the License.
  12  *
  13  * When distributing Covered Code, include this CDDL HEADER in each
  14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
  15  * If applicable, add the following below this CDDL HEADER, with the
  16  * fields enclosed by brackets "[]" replaced with your own identifying
  17  * information: Portions Copyright [yyyy] [name of copyright owner]
  18  *
  19  * CDDL HEADER END
  20  */
  21 /*
  22  * Copyright 2010 Sun Microsystems, Inc.  All rights reserved.
  23  * Use is subject to license terms.
  24  */
  25 /*
  26  * Copyright 2012 Nexenta Systems, Inc. All rights reserved.
  27  */
  28 
  29 /*
  30  *      Copyright 1983,1984,1985,1986,1987,1988,1989 AT&T.
  31  *      All Rights Reserved
  32  */
  33 
  34 /*
  35  * Copyright (c) 2013, Joyent, Inc. All rights reserved.
  36  */
  37 
  38 #include <sys/param.h>
  39 #include <sys/types.h>
  40 #include <sys/systm.h>
  41 #include <sys/cred.h>
  42 #include <sys/time.h>
  43 #include <sys/vnode.h>
  44 #include <sys/vfs.h>
  45 #include <sys/vfs_opreg.h>
  46 #include <sys/file.h>
  47 #include <sys/filio.h>
  48 #include <sys/uio.h>
  49 #include <sys/buf.h>
  50 #include <sys/mman.h>
  51 #include <sys/pathname.h>
  52 #include <sys/dirent.h>
  53 #include <sys/debug.h>
  54 #include <sys/vmsystm.h>
  55 #include <sys/fcntl.h>
  56 #include <sys/flock.h>
  57 #include <sys/swap.h>
  58 #include <sys/errno.h>
  59 #include <sys/strsubr.h>
  60 #include <sys/sysmacros.h>
  61 #include <sys/kmem.h>
  62 #include <sys/cmn_err.h>
  63 #include <sys/pathconf.h>
  64 #include <sys/utsname.h>
  65 #include <sys/dnlc.h>
  66 #include <sys/acl.h>
  67 #include <sys/systeminfo.h>
  68 #include <sys/policy.h>
  69 #include <sys/sdt.h>
  70 #include <sys/list.h>
  71 #include <sys/stat.h>
  72 #include <sys/zone.h>
  73 
  74 #include <rpc/types.h>
  75 #include <rpc/auth.h>
  76 #include <rpc/clnt.h>
  77 
  78 #include <nfs/nfs.h>
  79 #include <nfs/nfs_clnt.h>
  80 #include <nfs/nfs_acl.h>
  81 #include <nfs/lm.h>
  82 #include <nfs/nfs4.h>
  83 #include <nfs/nfs4_kprot.h>
  84 #include <nfs/rnode4.h>
  85 #include <nfs/nfs4_clnt.h>
  86 
  87 #include <vm/hat.h>
  88 #include <vm/as.h>
  89 #include <vm/page.h>
  90 #include <vm/pvn.h>
  91 #include <vm/seg.h>
  92 #include <vm/seg_map.h>
  93 #include <vm/seg_kpm.h>
  94 #include <vm/seg_vn.h>
  95 
  96 #include <fs/fs_subr.h>
  97 
  98 #include <sys/ddi.h>
  99 #include <sys/int_fmtio.h>
 100 #include <sys/fs/autofs.h>
 101 
 102 typedef struct {
 103         nfs4_ga_res_t   *di_garp;
 104         cred_t          *di_cred;
 105         hrtime_t        di_time_call;
 106 } dirattr_info_t;
 107 
 108 typedef enum nfs4_acl_op {
 109         NFS4_ACL_GET,
 110         NFS4_ACL_SET
 111 } nfs4_acl_op_t;
 112 
 113 static struct lm_sysid *nfs4_find_sysid(mntinfo4_t *mi);
 114 
 115 static void     nfs4_update_dircaches(change_info4 *, vnode_t *, vnode_t *,
 116                         char *, dirattr_info_t *);
 117 
 118 static void     nfs4close_otw(rnode4_t *, cred_t *, nfs4_open_owner_t *,
 119                     nfs4_open_stream_t *, int *, int *, nfs4_close_type_t,
 120                     nfs4_error_t *, int *);
 121 static int      nfs4_rdwrlbn(vnode_t *, page_t *, u_offset_t, size_t, int,
 122                         cred_t *);
 123 static int      nfs4write(vnode_t *, caddr_t, u_offset_t, int, cred_t *,
 124                         stable_how4 *);
 125 static int      nfs4read(vnode_t *, caddr_t, offset_t, int, size_t *,
 126                         cred_t *, bool_t, struct uio *);
 127 static int      nfs4setattr(vnode_t *, struct vattr *, int, cred_t *,
 128                         vsecattr_t *);
 129 static int      nfs4openattr(vnode_t *, vnode_t **, int, cred_t *);
 130 static int      nfs4lookup(vnode_t *, char *, vnode_t **, cred_t *, int);
 131 static int      nfs4lookup_xattr(vnode_t *, char *, vnode_t **, int, cred_t *);
 132 static int      nfs4lookupvalidate_otw(vnode_t *, char *, vnode_t **, cred_t *);
 133 static int      nfs4lookupnew_otw(vnode_t *, char *, vnode_t **, cred_t *);
 134 static int      nfs4mknod(vnode_t *, char *, struct vattr *, enum vcexcl,
 135                         int, vnode_t **, cred_t *);
 136 static int      nfs4open_otw(vnode_t *, char *, struct vattr *, vnode_t **,
 137                         cred_t *, int, int, enum createmode4, int);
 138 static int      nfs4rename(vnode_t *, char *, vnode_t *, char *, cred_t *,
 139                         caller_context_t *);
 140 static int      nfs4rename_persistent_fh(vnode_t *, char *, vnode_t *,
 141                         vnode_t *, char *, cred_t *, nfsstat4 *);
 142 static int      nfs4rename_volatile_fh(vnode_t *, char *, vnode_t *,
 143                         vnode_t *, char *, cred_t *, nfsstat4 *);
 144 static int      do_nfs4readdir(vnode_t *, rddir4_cache *, cred_t *);
 145 static void     nfs4readdir(vnode_t *, rddir4_cache *, cred_t *);
 146 static int      nfs4_bio(struct buf *, stable_how4 *, cred_t *, bool_t);
 147 static int      nfs4_getapage(vnode_t *, u_offset_t, size_t, uint_t *,
 148                         page_t *[], size_t, struct seg *, caddr_t,
 149                         enum seg_rw, cred_t *);
 150 static void     nfs4_readahead(vnode_t *, u_offset_t, caddr_t, struct seg *,
 151                         cred_t *);
 152 static int      nfs4_sync_putapage(vnode_t *, page_t *, u_offset_t, size_t,
 153                         int, cred_t *);
 154 static int      nfs4_sync_pageio(vnode_t *, page_t *, u_offset_t, size_t,
 155                         int, cred_t *);
 156 static int      nfs4_commit(vnode_t *, offset4, count4, cred_t *);
 157 static void     nfs4_set_mod(vnode_t *);
 158 static void     nfs4_get_commit(vnode_t *);
 159 static void     nfs4_get_commit_range(vnode_t *, u_offset_t, size_t);
 160 static int      nfs4_putpage_commit(vnode_t *, offset_t, size_t, cred_t *);
 161 static int      nfs4_commit_vp(vnode_t *, u_offset_t, size_t, cred_t *, int);
 162 static int      nfs4_sync_commit(vnode_t *, page_t *, offset3, count3,
 163                         cred_t *);
 164 static void     do_nfs4_async_commit(vnode_t *, page_t *, offset3, count3,
 165                         cred_t *);
 166 static int      nfs4_update_attrcache(nfsstat4, nfs4_ga_res_t *,
 167                         hrtime_t, vnode_t *, cred_t *);
 168 static int      nfs4_open_non_reg_file(vnode_t **, int, cred_t *);
 169 static int      nfs4_safelock(vnode_t *, const struct flock64 *, cred_t *);
 170 static void     nfs4_register_lock_locally(vnode_t *, struct flock64 *, int,
 171                         u_offset_t);
 172 static int      nfs4_lockrelease(vnode_t *, int, offset_t, cred_t *);
 173 static int      nfs4_block_and_wait(clock_t *, rnode4_t *);
 174 static cred_t  *state_to_cred(nfs4_open_stream_t *);
 175 static void     denied_to_flk(LOCK4denied *, flock64_t *, LOCKT4args *);
 176 static pid_t    lo_to_pid(lock_owner4 *);
 177 static void     nfs4_reinstitute_local_lock_state(vnode_t *, flock64_t *,
 178                         cred_t *, nfs4_lock_owner_t *);
 179 static void     push_reinstate(vnode_t *, int, flock64_t *, cred_t *,
 180                         nfs4_lock_owner_t *);
 181 static int      open_and_get_osp(vnode_t *, cred_t *, nfs4_open_stream_t **);
 182 static void     nfs4_delmap_callback(struct as *, void *, uint_t);
 183 static void     nfs4_free_delmapcall(nfs4_delmapcall_t *);
 184 static nfs4_delmapcall_t        *nfs4_init_delmapcall();
 185 static int      nfs4_find_and_delete_delmapcall(rnode4_t *, int *);
 186 static int      nfs4_is_acl_mask_valid(uint_t, nfs4_acl_op_t);
 187 static int      nfs4_create_getsecattr_return(vsecattr_t *, vsecattr_t *,
 188                         uid_t, gid_t, int);
 189 
 190 /*
 191  * Routines that implement the setting of v4 args for the misc. ops
 192  */
 193 static void     nfs4args_lock_free(nfs_argop4 *);
 194 static void     nfs4args_lockt_free(nfs_argop4 *);
 195 static void     nfs4args_setattr(nfs_argop4 *, vattr_t *, vsecattr_t *,
 196                         int, rnode4_t *, cred_t *, bitmap4, int *,
 197                         nfs4_stateid_types_t *);
 198 static void     nfs4args_setattr_free(nfs_argop4 *);
 199 static int      nfs4args_verify(nfs_argop4 *, vattr_t *, enum nfs_opnum4,
 200                         bitmap4);
 201 static void     nfs4args_verify_free(nfs_argop4 *);
 202 static void     nfs4args_write(nfs_argop4 *, stable_how4, rnode4_t *, cred_t *,
 203                         WRITE4args **, nfs4_stateid_types_t *);
 204 
 205 /*
 206  * These are the vnode ops functions that implement the vnode interface to
 207  * the networked file system.  See more comments below at nfs4_vnodeops.
 208  */
 209 static int      nfs4_open(vnode_t **, int, cred_t *, caller_context_t *);
 210 static int      nfs4_close(vnode_t *, int, int, offset_t, cred_t *,
 211                         caller_context_t *);
 212 static int      nfs4_read(vnode_t *, struct uio *, int, cred_t *,
 213                         caller_context_t *);
 214 static int      nfs4_write(vnode_t *, struct uio *, int, cred_t *,
 215                         caller_context_t *);
 216 static int      nfs4_ioctl(vnode_t *, int, intptr_t, int, cred_t *, int *,
 217                         caller_context_t *);
 218 static int      nfs4_setattr(vnode_t *, struct vattr *, int, cred_t *,
 219                         caller_context_t *);
 220 static int      nfs4_access(vnode_t *, int, int, cred_t *, caller_context_t *);
 221 static int      nfs4_readlink(vnode_t *, struct uio *, cred_t *,
 222                         caller_context_t *);
 223 static int      nfs4_fsync(vnode_t *, int, cred_t *, caller_context_t *);
 224 static int      nfs4_create(vnode_t *, char *, struct vattr *, enum vcexcl,
 225                         int, vnode_t **, cred_t *, int, caller_context_t *,
 226                         vsecattr_t *);
 227 static int      nfs4_remove(vnode_t *, char *, cred_t *, caller_context_t *,
 228                         int);
 229 static int      nfs4_link(vnode_t *, vnode_t *, char *, cred_t *,
 230                         caller_context_t *, int);
 231 static int      nfs4_rename(vnode_t *, char *, vnode_t *, char *, cred_t *,
 232                         caller_context_t *, int);
 233 static int      nfs4_mkdir(vnode_t *, char *, struct vattr *, vnode_t **,
 234                         cred_t *, caller_context_t *, int, vsecattr_t *);
 235 static int      nfs4_rmdir(vnode_t *, char *, vnode_t *, cred_t *,
 236                         caller_context_t *, int);
 237 static int      nfs4_symlink(vnode_t *, char *, struct vattr *, char *,
 238                         cred_t *, caller_context_t *, int);
 239 static int      nfs4_readdir(vnode_t *, struct uio *, cred_t *, int *,
 240                         caller_context_t *, int);
 241 static int      nfs4_seek(vnode_t *, offset_t, offset_t *, caller_context_t *);
 242 static int      nfs4_getpage(vnode_t *, offset_t, size_t, uint_t *,
 243                         page_t *[], size_t, struct seg *, caddr_t,
 244                         enum seg_rw, cred_t *, caller_context_t *);
 245 static int      nfs4_putpage(vnode_t *, offset_t, size_t, int, cred_t *,
 246                         caller_context_t *);
 247 static int      nfs4_map(vnode_t *, offset_t, struct as *, caddr_t *, size_t,
 248                         uchar_t, uchar_t, uint_t, cred_t *, caller_context_t *);
 249 static int      nfs4_addmap(vnode_t *, offset_t, struct as *, caddr_t, size_t,
 250                         uchar_t, uchar_t, uint_t, cred_t *, caller_context_t *);
 251 static int      nfs4_cmp(vnode_t *, vnode_t *, caller_context_t *);
 252 static int      nfs4_frlock(vnode_t *, int, struct flock64 *, int, offset_t,
 253                         struct flk_callback *, cred_t *, caller_context_t *);
 254 static int      nfs4_space(vnode_t *, int, struct flock64 *, int, offset_t,
 255                         cred_t *, caller_context_t *);
 256 static int      nfs4_delmap(vnode_t *, offset_t, struct as *, caddr_t, size_t,
 257                         uint_t, uint_t, uint_t, cred_t *, caller_context_t *);
 258 static int      nfs4_pageio(vnode_t *, page_t *, u_offset_t, size_t, int,
 259                         cred_t *, caller_context_t *);
 260 static void     nfs4_dispose(vnode_t *, page_t *, int, int, cred_t *,
 261                         caller_context_t *);
 262 static int      nfs4_setsecattr(vnode_t *, vsecattr_t *, int, cred_t *,
 263                         caller_context_t *);
 264 /*
 265  * These vnode ops are required to be called from outside this source file,
 266  * e.g. by ephemeral mount stub vnode ops, and so may not be declared
 267  * as static.
 268  */
 269 int     nfs4_getattr(vnode_t *, struct vattr *, int, cred_t *,
 270             caller_context_t *);
 271 void    nfs4_inactive(vnode_t *, cred_t *, caller_context_t *);
 272 int     nfs4_lookup(vnode_t *, char *, vnode_t **,
 273             struct pathname *, int, vnode_t *, cred_t *,
 274             caller_context_t *, int *, pathname_t *);
 275 int     nfs4_fid(vnode_t *, fid_t *, caller_context_t *);
 276 int     nfs4_rwlock(vnode_t *, int, caller_context_t *);
 277 void    nfs4_rwunlock(vnode_t *, int, caller_context_t *);
 278 int     nfs4_realvp(vnode_t *, vnode_t **, caller_context_t *);
 279 int     nfs4_pathconf(vnode_t *, int, ulong_t *, cred_t *,
 280             caller_context_t *);
 281 int     nfs4_getsecattr(vnode_t *, vsecattr_t *, int, cred_t *,
 282             caller_context_t *);
 283 int     nfs4_shrlock(vnode_t *, int, struct shrlock *, int, cred_t *,
 284             caller_context_t *);
 285 
 286 /*
 287  * Used for nfs4_commit_vp() to indicate if we should
 288  * wait on pending writes.
 289  */
 290 #define NFS4_WRITE_NOWAIT       0
 291 #define NFS4_WRITE_WAIT         1
 292 
 293 #define NFS4_BASE_WAIT_TIME 1   /* 1 second */
 294 
 295 /*
 296  * Error flags used to pass information about certain special errors
 297  * which need to be handled specially.
 298  */
 299 #define NFS_EOF                 -98
 300 #define NFS_VERF_MISMATCH       -97
 301 
 302 /*
 303  * Flags used to differentiate between which operation drove the
 304  * potential CLOSE OTW. (see nfs4_close_otw_if_necessary)
 305  */
 306 #define NFS4_CLOSE_OP           0x1
 307 #define NFS4_DELMAP_OP          0x2
 308 #define NFS4_INACTIVE_OP        0x3
 309 
 310 #define ISVDEV(t) ((t == VBLK) || (t == VCHR) || (t == VFIFO))
 311 
 312 /* ALIGN64 aligns the given buffer and adjust buffer size to 64 bit */
 313 #define ALIGN64(x, ptr, sz)                                             \
 314         x = ((uintptr_t)(ptr)) & (sizeof (uint64_t) - 1);           \
 315         if (x) {                                                        \
 316                 x = sizeof (uint64_t) - (x);                            \
 317                 sz -= (x);                                              \
 318                 ptr += (x);                                             \
 319         }
 320 
 321 #ifdef DEBUG
 322 int nfs4_client_attr_debug = 0;
 323 int nfs4_client_state_debug = 0;
 324 int nfs4_client_shadow_debug = 0;
 325 int nfs4_client_lock_debug = 0;
 326 int nfs4_seqid_sync = 0;
 327 int nfs4_client_map_debug = 0;
 328 static int nfs4_pageio_debug = 0;
 329 int nfs4_client_inactive_debug = 0;
 330 int nfs4_client_recov_debug = 0;
 331 int nfs4_client_failover_debug = 0;
 332 int nfs4_client_call_debug = 0;
 333 int nfs4_client_lookup_debug = 0;
 334 int nfs4_client_zone_debug = 0;
 335 int nfs4_lost_rqst_debug = 0;
 336 int nfs4_rdattrerr_debug = 0;
 337 int nfs4_open_stream_debug = 0;
 338 
 339 int nfs4read_error_inject;
 340 
 341 static int nfs4_create_misses = 0;
 342 
 343 static int nfs4_readdir_cache_shorts = 0;
 344 static int nfs4_readdir_readahead = 0;
 345 
 346 static int nfs4_bio_do_stop = 0;
 347 
 348 static int nfs4_lostpage = 0;   /* number of times we lost original page */
 349 
 350 int nfs4_mmap_debug = 0;
 351 
 352 static int nfs4_pathconf_cache_hits = 0;
 353 static int nfs4_pathconf_cache_misses = 0;
 354 
 355 int nfs4close_all_cnt;
 356 int nfs4close_one_debug = 0;
 357 int nfs4close_notw_debug = 0;
 358 
 359 int denied_to_flk_debug = 0;
 360 void *lockt_denied_debug;
 361 
 362 #endif
 363 
 364 /*
 365  * How long to wait before trying again if OPEN_CONFIRM gets ETIMEDOUT
 366  * or NFS4ERR_RESOURCE.
 367  */
 368 static int confirm_retry_sec = 30;
 369 
 370 static int nfs4_lookup_neg_cache = 1;
 371 
 372 /*
 373  * number of pages to read ahead
 374  * optimized for 100 base-T.
 375  */
 376 static int nfs4_nra = 4;
 377 
 378 static int nfs4_do_symlink_cache = 1;
 379 
 380 static int nfs4_pathconf_disable_cache = 0;
 381 
 382 /*
 383  * These are the vnode ops routines which implement the vnode interface to
 384  * the networked file system.  These routines just take their parameters,
 385  * make them look networkish by putting the right info into interface structs,
 386  * and then calling the appropriate remote routine(s) to do the work.
 387  *
 388  * Note on directory name lookup cacheing:  If we detect a stale fhandle,
 389  * we purge the directory cache relative to that vnode.  This way, the
 390  * user won't get burned by the cache repeatedly.  See <nfs/rnode4.h> for
 391  * more details on rnode locking.
 392  */
 393 
 394 struct vnodeops *nfs4_vnodeops;
 395 
 396 const fs_operation_def_t nfs4_vnodeops_template[] = {
 397         VOPNAME_OPEN,           { .vop_open = nfs4_open },
 398         VOPNAME_CLOSE,          { .vop_close = nfs4_close },
 399         VOPNAME_READ,           { .vop_read = nfs4_read },
 400         VOPNAME_WRITE,          { .vop_write = nfs4_write },
 401         VOPNAME_IOCTL,          { .vop_ioctl = nfs4_ioctl },
 402         VOPNAME_GETATTR,        { .vop_getattr = nfs4_getattr },
 403         VOPNAME_SETATTR,        { .vop_setattr = nfs4_setattr },
 404         VOPNAME_ACCESS,         { .vop_access = nfs4_access },
 405         VOPNAME_LOOKUP,         { .vop_lookup = nfs4_lookup },
 406         VOPNAME_CREATE,         { .vop_create = nfs4_create },
 407         VOPNAME_REMOVE,         { .vop_remove = nfs4_remove },
 408         VOPNAME_LINK,           { .vop_link = nfs4_link },
 409         VOPNAME_RENAME,         { .vop_rename = nfs4_rename },
 410         VOPNAME_MKDIR,          { .vop_mkdir = nfs4_mkdir },
 411         VOPNAME_RMDIR,          { .vop_rmdir = nfs4_rmdir },
 412         VOPNAME_READDIR,        { .vop_readdir = nfs4_readdir },
 413         VOPNAME_SYMLINK,        { .vop_symlink = nfs4_symlink },
 414         VOPNAME_READLINK,       { .vop_readlink = nfs4_readlink },
 415         VOPNAME_FSYNC,          { .vop_fsync = nfs4_fsync },
 416         VOPNAME_INACTIVE,       { .vop_inactive = nfs4_inactive },
 417         VOPNAME_FID,            { .vop_fid = nfs4_fid },
 418         VOPNAME_RWLOCK,         { .vop_rwlock = nfs4_rwlock },
 419         VOPNAME_RWUNLOCK,       { .vop_rwunlock = nfs4_rwunlock },
 420         VOPNAME_SEEK,           { .vop_seek = nfs4_seek },
 421         VOPNAME_FRLOCK,         { .vop_frlock = nfs4_frlock },
 422         VOPNAME_SPACE,          { .vop_space = nfs4_space },
 423         VOPNAME_REALVP,         { .vop_realvp = nfs4_realvp },
 424         VOPNAME_GETPAGE,        { .vop_getpage = nfs4_getpage },
 425         VOPNAME_PUTPAGE,        { .vop_putpage = nfs4_putpage },
 426         VOPNAME_MAP,            { .vop_map = nfs4_map },
 427         VOPNAME_ADDMAP,         { .vop_addmap = nfs4_addmap },
 428         VOPNAME_DELMAP,         { .vop_delmap = nfs4_delmap },
 429         /* no separate nfs4_dump */
 430         VOPNAME_DUMP,           { .vop_dump = nfs_dump },
 431         VOPNAME_PATHCONF,       { .vop_pathconf = nfs4_pathconf },
 432         VOPNAME_PAGEIO,         { .vop_pageio = nfs4_pageio },
 433         VOPNAME_DISPOSE,        { .vop_dispose = nfs4_dispose },
 434         VOPNAME_SETSECATTR,     { .vop_setsecattr = nfs4_setsecattr },
 435         VOPNAME_GETSECATTR,     { .vop_getsecattr = nfs4_getsecattr },
 436         VOPNAME_SHRLOCK,        { .vop_shrlock = nfs4_shrlock },
 437         VOPNAME_VNEVENT,        { .vop_vnevent = fs_vnevent_support },
 438         NULL,                   NULL
 439 };
 440 
 441 /*
 442  * The following are subroutines and definitions to set args or get res
 443  * for the different nfsv4 ops
 444  */
 445 
 446 void
 447 nfs4args_lookup_free(nfs_argop4 *argop, int arglen)
 448 {
 449         int             i;
 450 
 451         for (i = 0; i < arglen; i++) {
 452                 if (argop[i].argop == OP_LOOKUP) {
 453                         kmem_free(
 454                             argop[i].nfs_argop4_u.oplookup.
 455                             objname.utf8string_val,
 456                             argop[i].nfs_argop4_u.oplookup.
 457                             objname.utf8string_len);
 458                 }
 459         }
 460 }
 461 
 462 static void
 463 nfs4args_lock_free(nfs_argop4 *argop)
 464 {
 465         locker4 *locker = &argop->nfs_argop4_u.oplock.locker;
 466 
 467         if (locker->new_lock_owner == TRUE) {
 468                 open_to_lock_owner4 *open_owner;
 469 
 470                 open_owner = &locker->locker4_u.open_owner;
 471                 if (open_owner->lock_owner.owner_val != NULL) {
 472                         kmem_free(open_owner->lock_owner.owner_val,
 473                             open_owner->lock_owner.owner_len);
 474                 }
 475         }
 476 }
 477 
 478 static void
 479 nfs4args_lockt_free(nfs_argop4 *argop)
 480 {
 481         lock_owner4 *lowner = &argop->nfs_argop4_u.oplockt.owner;
 482 
 483         if (lowner->owner_val != NULL) {
 484                 kmem_free(lowner->owner_val, lowner->owner_len);
 485         }
 486 }
 487 
 488 static void
 489 nfs4args_setattr(nfs_argop4 *argop, vattr_t *vap, vsecattr_t *vsap, int flags,
 490     rnode4_t *rp, cred_t *cr, bitmap4 supp, int *error,
 491     nfs4_stateid_types_t *sid_types)
 492 {
 493         fattr4          *attr = &argop->nfs_argop4_u.opsetattr.obj_attributes;
 494         mntinfo4_t      *mi;
 495 
 496         argop->argop = OP_SETATTR;
 497         /*
 498          * The stateid is set to 0 if client is not modifying the size
 499          * and otherwise to whatever nfs4_get_stateid() returns.
 500          *
 501          * XXX Note: nfs4_get_stateid() returns 0 if no lockowner and/or no
 502          * state struct could be found for the process/file pair.  We may
 503          * want to change this in the future (by OPENing the file).  See
 504          * bug # 4474852.
 505          */
 506         if (vap->va_mask & AT_SIZE) {
 507 
 508                 ASSERT(rp != NULL);
 509                 mi = VTOMI4(RTOV4(rp));
 510 
 511                 argop->nfs_argop4_u.opsetattr.stateid =
 512                     nfs4_get_stateid(cr, rp, curproc->p_pidp->pid_id, mi,
 513                     OP_SETATTR, sid_types, FALSE);
 514         } else {
 515                 bzero(&argop->nfs_argop4_u.opsetattr.stateid,
 516                     sizeof (stateid4));
 517         }
 518 
 519         *error = vattr_to_fattr4(vap, vsap, attr, flags, OP_SETATTR, supp);
 520         if (*error)
 521                 bzero(attr, sizeof (*attr));
 522 }
 523 
 524 static void
 525 nfs4args_setattr_free(nfs_argop4 *argop)
 526 {
 527         nfs4_fattr4_free(&argop->nfs_argop4_u.opsetattr.obj_attributes);
 528 }
 529 
 530 static int
 531 nfs4args_verify(nfs_argop4 *argop, vattr_t *vap, enum nfs_opnum4 op,
 532     bitmap4 supp)
 533 {
 534         fattr4 *attr;
 535         int error = 0;
 536 
 537         argop->argop = op;
 538         switch (op) {
 539         case OP_VERIFY:
 540                 attr = &argop->nfs_argop4_u.opverify.obj_attributes;
 541                 break;
 542         case OP_NVERIFY:
 543                 attr = &argop->nfs_argop4_u.opnverify.obj_attributes;
 544                 break;
 545         default:
 546                 return (EINVAL);
 547         }
 548         if (!error)
 549                 error = vattr_to_fattr4(vap, NULL, attr, 0, op, supp);
 550         if (error)
 551                 bzero(attr, sizeof (*attr));
 552         return (error);
 553 }
 554 
 555 static void
 556 nfs4args_verify_free(nfs_argop4 *argop)
 557 {
 558         switch (argop->argop) {
 559         case OP_VERIFY:
 560                 nfs4_fattr4_free(&argop->nfs_argop4_u.opverify.obj_attributes);
 561                 break;
 562         case OP_NVERIFY:
 563                 nfs4_fattr4_free(&argop->nfs_argop4_u.opnverify.obj_attributes);
 564                 break;
 565         default:
 566                 break;
 567         }
 568 }
 569 
 570 static void
 571 nfs4args_write(nfs_argop4 *argop, stable_how4 stable, rnode4_t *rp, cred_t *cr,
 572     WRITE4args **wargs_pp, nfs4_stateid_types_t *sid_tp)
 573 {
 574         WRITE4args *wargs = &argop->nfs_argop4_u.opwrite;
 575         mntinfo4_t *mi = VTOMI4(RTOV4(rp));
 576 
 577         argop->argop = OP_WRITE;
 578         wargs->stable = stable;
 579         wargs->stateid = nfs4_get_w_stateid(cr, rp, curproc->p_pidp->pid_id,
 580             mi, OP_WRITE, sid_tp);
 581         wargs->mblk = NULL;
 582         *wargs_pp = wargs;
 583 }
 584 
 585 void
 586 nfs4args_copen_free(OPEN4cargs *open_args)
 587 {
 588         if (open_args->owner.owner_val) {
 589                 kmem_free(open_args->owner.owner_val,
 590                     open_args->owner.owner_len);
 591         }
 592         if ((open_args->opentype == OPEN4_CREATE) &&
 593             (open_args->mode != EXCLUSIVE4)) {
 594                 nfs4_fattr4_free(&open_args->createhow4_u.createattrs);
 595         }
 596 }
 597 
 598 /*
 599  * XXX:  This is referenced in modstubs.s
 600  */
 601 struct vnodeops *
 602 nfs4_getvnodeops(void)
 603 {
 604         return (nfs4_vnodeops);
 605 }
 606 
 607 /*
 608  * The OPEN operation opens a regular file.
 609  */
 610 /*ARGSUSED3*/
 611 static int
 612 nfs4_open(vnode_t **vpp, int flag, cred_t *cr, caller_context_t *ct)
 613 {
 614         vnode_t *dvp = NULL;
 615         rnode4_t *rp, *drp;
 616         int error;
 617         int just_been_created;
 618         char fn[MAXNAMELEN];
 619 
 620         NFS4_DEBUG(nfs4_client_state_debug, (CE_NOTE, "nfs4_open: "));
 621         if (nfs_zone() != VTOMI4(*vpp)->mi_zone)
 622                 return (EIO);
 623         rp = VTOR4(*vpp);
 624 
 625         /*
 626          * Check to see if opening something besides a regular file;
 627          * if so skip the OTW call
 628          */
 629         if ((*vpp)->v_type != VREG) {
 630                 error = nfs4_open_non_reg_file(vpp, flag, cr);
 631                 return (error);
 632         }
 633 
 634         /*
 635          * XXX - would like a check right here to know if the file is
 636          * executable or not, so as to skip OTW
 637          */
 638 
 639         if ((error = vtodv(*vpp, &dvp, cr, TRUE)) != 0)
 640                 return (error);
 641 
 642         drp = VTOR4(dvp);
 643         if (nfs_rw_enter_sig(&drp->r_rwlock, RW_READER, INTR4(dvp)))
 644                 return (EINTR);
 645 
 646         if ((error = vtoname(*vpp, fn, MAXNAMELEN)) != 0) {
 647                 nfs_rw_exit(&drp->r_rwlock);
 648                 return (error);
 649         }
 650 
 651         /*
 652          * See if this file has just been CREATEd.
 653          * If so, clear the flag and update the dnlc, which was previously
 654          * skipped in nfs4_create.
 655          * XXX need better serilization on this.
 656          * XXX move this into the nf4open_otw call, after we have
 657          * XXX acquired the open owner seqid sync.
 658          */
 659         mutex_enter(&rp->r_statev4_lock);
 660         if (rp->created_v4) {
 661                 rp->created_v4 = 0;
 662                 mutex_exit(&rp->r_statev4_lock);
 663 
 664                 dnlc_update(dvp, fn, *vpp);
 665                 /* This is needed so we don't bump the open ref count */
 666                 just_been_created = 1;
 667         } else {
 668                 mutex_exit(&rp->r_statev4_lock);
 669                 just_been_created = 0;
 670         }
 671 
 672         /*
 673          * If caller specified O_TRUNC/FTRUNC, then be sure to set
 674          * FWRITE (to drive successful setattr(size=0) after open)
 675          */
 676         if (flag & FTRUNC)
 677                 flag |= FWRITE;
 678 
 679         error = nfs4open_otw(dvp, fn, NULL, vpp, cr, 0, flag, 0,
 680             just_been_created);
 681 
 682         if (!error && !((*vpp)->v_flag & VROOT))
 683                 dnlc_update(dvp, fn, *vpp);
 684 
 685         nfs_rw_exit(&drp->r_rwlock);
 686 
 687         /* release the hold from vtodv */
 688         VN_RELE(dvp);
 689 
 690         /* exchange the shadow for the master vnode, if needed */
 691 
 692         if (error == 0 && IS_SHADOW(*vpp, rp))
 693                 sv_exchange(vpp);
 694 
 695         return (error);
 696 }
 697 
 698 /*
 699  * See if there's a "lost open" request to be saved and recovered.
 700  */
 701 static void
 702 nfs4open_save_lost_rqst(int error, nfs4_lost_rqst_t *lost_rqstp,
 703     nfs4_open_owner_t *oop, cred_t *cr, vnode_t *vp,
 704     vnode_t *dvp, OPEN4cargs *open_args)
 705 {
 706         vfs_t *vfsp;
 707         char *srccfp;
 708 
 709         vfsp = (dvp ? dvp->v_vfsp : vp->v_vfsp);
 710 
 711         if (error != ETIMEDOUT && error != EINTR &&
 712             !NFS4_FRC_UNMT_ERR(error, vfsp)) {
 713                 lost_rqstp->lr_op = 0;
 714                 return;
 715         }
 716 
 717         NFS4_DEBUG(nfs4_lost_rqst_debug, (CE_NOTE,
 718             "nfs4open_save_lost_rqst: error %d", error));
 719 
 720         lost_rqstp->lr_op = OP_OPEN;
 721 
 722         /*
 723          * The vp (if it is not NULL) and dvp are held and rele'd via
 724          * the recovery code.  See nfs4_save_lost_rqst.
 725          */
 726         lost_rqstp->lr_vp = vp;
 727         lost_rqstp->lr_dvp = dvp;
 728         lost_rqstp->lr_oop = oop;
 729         lost_rqstp->lr_osp = NULL;
 730         lost_rqstp->lr_lop = NULL;
 731         lost_rqstp->lr_cr = cr;
 732         lost_rqstp->lr_flk = NULL;
 733         lost_rqstp->lr_oacc = open_args->share_access;
 734         lost_rqstp->lr_odeny = open_args->share_deny;
 735         lost_rqstp->lr_oclaim = open_args->claim;
 736         if (open_args->claim == CLAIM_DELEGATE_CUR) {
 737                 lost_rqstp->lr_ostateid =
 738                     open_args->open_claim4_u.delegate_cur_info.delegate_stateid;
 739                 srccfp = open_args->open_claim4_u.delegate_cur_info.cfile;
 740         } else {
 741                 srccfp = open_args->open_claim4_u.cfile;
 742         }
 743         lost_rqstp->lr_ofile.utf8string_len = 0;
 744         lost_rqstp->lr_ofile.utf8string_val = NULL;
 745         (void) str_to_utf8(srccfp, &lost_rqstp->lr_ofile);
 746         lost_rqstp->lr_putfirst = FALSE;
 747 }
 748 
 749 struct nfs4_excl_time {
 750         uint32 seconds;
 751         uint32 nseconds;
 752 };
 753 
 754 /*
 755  * The OPEN operation creates and/or opens a regular file
 756  *
 757  * ARGSUSED
 758  */
 759 static int
 760 nfs4open_otw(vnode_t *dvp, char *file_name, struct vattr *in_va,
 761     vnode_t **vpp, cred_t *cr, int create_flag, int open_flag,
 762     enum createmode4 createmode, int file_just_been_created)
 763 {
 764         rnode4_t *rp;
 765         rnode4_t *drp = VTOR4(dvp);
 766         vnode_t *vp = NULL;
 767         vnode_t *vpi = *vpp;
 768         bool_t needrecov = FALSE;
 769 
 770         int doqueue = 1;
 771 
 772         COMPOUND4args_clnt args;
 773         COMPOUND4res_clnt res;
 774         nfs_argop4 *argop;
 775         nfs_resop4 *resop;
 776         int argoplist_size;
 777         int idx_open, idx_fattr;
 778 
 779         GETFH4res *gf_res = NULL;
 780         OPEN4res *op_res = NULL;
 781         nfs4_ga_res_t *garp;
 782         fattr4 *attr = NULL;
 783         struct nfs4_excl_time verf;
 784         bool_t did_excl_setup = FALSE;
 785         int created_osp;
 786 
 787         OPEN4cargs *open_args;
 788         nfs4_open_owner_t       *oop = NULL;
 789         nfs4_open_stream_t      *osp = NULL;
 790         seqid4 seqid = 0;
 791         bool_t retry_open = FALSE;
 792         nfs4_recov_state_t recov_state;
 793         nfs4_lost_rqst_t lost_rqst;
 794         nfs4_error_t e = { 0, NFS4_OK, RPC_SUCCESS };
 795         hrtime_t t;
 796         int acc = 0;
 797         cred_t *cred_otw = NULL;        /* cred used to do the RPC call */
 798         cred_t *ncr = NULL;
 799 
 800         nfs4_sharedfh_t *otw_sfh;
 801         nfs4_sharedfh_t *orig_sfh;
 802         int fh_differs = 0;
 803         int numops, setgid_flag;
 804         int num_bseqid_retry = NFS4_NUM_RETRY_BAD_SEQID + 1;
 805 
 806         /*
 807          * Make sure we properly deal with setting the right gid on
 808          * a newly created file to reflect the parent's setgid bit
 809          */
 810         setgid_flag = 0;
 811         if (create_flag && in_va) {
 812 
 813                 /*
 814                  * If there is grpid mount flag used or
 815                  * the parent's directory has the setgid bit set
 816                  * _and_ the client was able to get a valid mapping
 817                  * for the parent dir's owner_group, we want to
 818                  * append NVERIFY(owner_group == dva.va_gid) and
 819                  * SETATTR to the CREATE compound.
 820                  */
 821                 mutex_enter(&drp->r_statelock);
 822                 if ((VTOMI4(dvp)->mi_flags & MI4_GRPID ||
 823                     drp->r_attr.va_mode & VSGID) &&
 824                     drp->r_attr.va_gid != GID_NOBODY) {
 825                         in_va->va_mask |= AT_GID;
 826                         in_va->va_gid = drp->r_attr.va_gid;
 827                         setgid_flag = 1;
 828                 }
 829                 mutex_exit(&drp->r_statelock);
 830         }
 831 
 832         /*
 833          * Normal/non-create compound:
 834          * PUTFH(dfh) + OPEN(create) + GETFH + GETATTR(new)
 835          *
 836          * Open(create) compound no setgid:
 837          * PUTFH(dfh) + SAVEFH + OPEN(create) + GETFH + GETATTR(new) +
 838          * RESTOREFH + GETATTR
 839          *
 840          * Open(create) setgid:
 841          * PUTFH(dfh) + OPEN(create) + GETFH + GETATTR(new) +
 842          * SAVEFH + PUTFH(dfh) + GETATTR(dvp) + RESTOREFH +
 843          * NVERIFY(grp) + SETATTR
 844          */
 845         if (setgid_flag) {
 846                 numops = 10;
 847                 idx_open = 1;
 848                 idx_fattr = 3;
 849         } else if (create_flag) {
 850                 numops = 7;
 851                 idx_open = 2;
 852                 idx_fattr = 4;
 853         } else {
 854                 numops = 4;
 855                 idx_open = 1;
 856                 idx_fattr = 3;
 857         }
 858 
 859         args.array_len = numops;
 860         argoplist_size = numops * sizeof (nfs_argop4);
 861         argop = kmem_alloc(argoplist_size, KM_SLEEP);
 862 
 863         NFS4_DEBUG(nfs4_client_state_debug, (CE_NOTE, "nfs4open_otw: "
 864             "open %s open flag 0x%x cred %p", file_name, open_flag,
 865             (void *)cr));
 866 
 867         ASSERT(nfs_zone() == VTOMI4(dvp)->mi_zone);
 868         if (create_flag) {
 869                 /*
 870                  * We are to create a file.  Initialize the passed in vnode
 871                  * pointer.
 872                  */
 873                 vpi = NULL;
 874         } else {
 875                 /*
 876                  * Check to see if the client owns a read delegation and is
 877                  * trying to open for write.  If so, then return the delegation
 878                  * to avoid the server doing a cb_recall and returning DELAY.
 879                  * NB - we don't use the statev4_lock here because we'd have
 880                  * to drop the lock anyway and the result would be stale.
 881                  */
 882                 if ((open_flag & FWRITE) &&
 883                     VTOR4(vpi)->r_deleg_type == OPEN_DELEGATE_READ)
 884                         (void) nfs4delegreturn(VTOR4(vpi), NFS4_DR_REOPEN);
 885 
 886                 /*
 887                  * If the file has a delegation, then do an access check up
 888                  * front.  This avoids having to an access check later after
 889                  * we've already done start_op, which could deadlock.
 890                  */
 891                 if (VTOR4(vpi)->r_deleg_type != OPEN_DELEGATE_NONE) {
 892                         if (open_flag & FREAD &&
 893                             nfs4_access(vpi, VREAD, 0, cr, NULL) == 0)
 894                                 acc |= VREAD;
 895                         if (open_flag & FWRITE &&
 896                             nfs4_access(vpi, VWRITE, 0, cr, NULL) == 0)
 897                                 acc |= VWRITE;
 898                 }
 899         }
 900 
 901         drp = VTOR4(dvp);
 902 
 903         recov_state.rs_flags = 0;
 904         recov_state.rs_num_retry_despite_err = 0;
 905         cred_otw = cr;
 906 
 907 recov_retry:
 908         fh_differs = 0;
 909         nfs4_error_zinit(&e);
 910 
 911         e.error = nfs4_start_op(VTOMI4(dvp), dvp, vpi, &recov_state);
 912         if (e.error) {
 913                 if (ncr != NULL)
 914                         crfree(ncr);
 915                 kmem_free(argop, argoplist_size);
 916                 return (e.error);
 917         }
 918 
 919         args.ctag = TAG_OPEN;
 920         args.array_len = numops;
 921         args.array = argop;
 922 
 923         /* putfh directory fh */
 924         argop[0].argop = OP_CPUTFH;
 925         argop[0].nfs_argop4_u.opcputfh.sfh = drp->r_fh;
 926 
 927         /* OPEN: either op 1 or op 2 depending upon create/setgid flags */
 928         argop[idx_open].argop = OP_COPEN;
 929         open_args = &argop[idx_open].nfs_argop4_u.opcopen;
 930         open_args->claim = CLAIM_NULL;
 931 
 932         /* name of file */
 933         open_args->open_claim4_u.cfile = file_name;
 934         open_args->owner.owner_len = 0;
 935         open_args->owner.owner_val = NULL;
 936 
 937         if (create_flag) {
 938                 /* CREATE a file */
 939                 open_args->opentype = OPEN4_CREATE;
 940                 open_args->mode = createmode;
 941                 if (createmode == EXCLUSIVE4) {
 942                         if (did_excl_setup == FALSE) {
 943                                 verf.seconds = zone_get_hostid(NULL);
 944                                 if (verf.seconds != 0)
 945                                         verf.nseconds = newnum();
 946                                 else {
 947                                         timestruc_t now;
 948 
 949                                         gethrestime(&now);
 950                                         verf.seconds = now.tv_sec;
 951                                         verf.nseconds = now.tv_nsec;
 952                                 }
 953                                 /*
 954                                  * Since the server will use this value for the
 955                                  * mtime, make sure that it can't overflow. Zero
 956                                  * out the MSB. The actual value does not matter
 957                                  * here, only its uniqeness.
 958                                  */
 959                                 verf.seconds &= INT32_MAX;
 960                                 did_excl_setup = TRUE;
 961                         }
 962 
 963                         /* Now copy over verifier to OPEN4args. */
 964                         open_args->createhow4_u.createverf = *(uint64_t *)&verf;
 965                 } else {
 966                         int v_error;
 967                         bitmap4 supp_attrs;
 968                         servinfo4_t *svp;
 969 
 970                         attr = &open_args->createhow4_u.createattrs;
 971 
 972                         svp = drp->r_server;
 973                         (void) nfs_rw_enter_sig(&svp->sv_lock, RW_READER, 0);
 974                         supp_attrs = svp->sv_supp_attrs;
 975                         nfs_rw_exit(&svp->sv_lock);
 976 
 977                         /* GUARDED4 or UNCHECKED4 */
 978                         v_error = vattr_to_fattr4(in_va, NULL, attr, 0, OP_OPEN,
 979                             supp_attrs);
 980                         if (v_error) {
 981                                 bzero(attr, sizeof (*attr));
 982                                 nfs4args_copen_free(open_args);
 983                                 nfs4_end_op(VTOMI4(dvp), dvp, vpi,
 984                                     &recov_state, FALSE);
 985                                 if (ncr != NULL)
 986                                         crfree(ncr);
 987                                 kmem_free(argop, argoplist_size);
 988                                 return (v_error);
 989                         }
 990                 }
 991         } else {
 992                 /* NO CREATE */
 993                 open_args->opentype = OPEN4_NOCREATE;
 994         }
 995 
 996         if (recov_state.rs_sp != NULL) {
 997                 mutex_enter(&recov_state.rs_sp->s_lock);
 998                 open_args->owner.clientid = recov_state.rs_sp->clientid;
 999                 mutex_exit(&recov_state.rs_sp->s_lock);
1000         } else {
1001                 /* XXX should we just fail here? */
1002                 open_args->owner.clientid = 0;
1003         }
1004 
1005         /*
1006          * This increments oop's ref count or creates a temporary 'just_created'
1007          * open owner that will become valid when this OPEN/OPEN_CONFIRM call
1008          * completes.
1009          */
1010         mutex_enter(&VTOMI4(dvp)->mi_lock);
1011 
1012         /* See if a permanent or just created open owner exists */
1013         oop = find_open_owner_nolock(cr, NFS4_JUST_CREATED, VTOMI4(dvp));
1014         if (!oop) {
1015                 /*
1016                  * This open owner does not exist so create a temporary
1017                  * just created one.
1018                  */
1019                 oop = create_open_owner(cr, VTOMI4(dvp));
1020                 ASSERT(oop != NULL);
1021         }
1022         mutex_exit(&VTOMI4(dvp)->mi_lock);
1023 
1024         /* this length never changes, do alloc before seqid sync */
1025         open_args->owner.owner_len = sizeof (oop->oo_name);
1026         open_args->owner.owner_val =
1027             kmem_alloc(open_args->owner.owner_len, KM_SLEEP);
1028 
1029         e.error = nfs4_start_open_seqid_sync(oop, VTOMI4(dvp));
1030         if (e.error == EAGAIN) {
1031                 open_owner_rele(oop);
1032                 nfs4args_copen_free(open_args);
1033                 nfs4_end_op(VTOMI4(dvp), dvp, vpi, &recov_state, TRUE);
1034                 if (ncr != NULL) {
1035                         crfree(ncr);
1036                         ncr = NULL;
1037                 }
1038                 goto recov_retry;
1039         }
1040 
1041         /* Check to see if we need to do the OTW call */
1042         if (!create_flag) {
1043                 if (!nfs4_is_otw_open_necessary(oop, open_flag, vpi,
1044                     file_just_been_created, &e.error, acc, &recov_state)) {
1045 
1046                         /*
1047                          * The OTW open is not necessary.  Either
1048                          * the open can succeed without it (eg.
1049                          * delegation, error == 0) or the open
1050                          * must fail due to an access failure
1051                          * (error != 0).  In either case, tidy
1052                          * up and return.
1053                          */
1054 
1055                         nfs4_end_open_seqid_sync(oop);
1056                         open_owner_rele(oop);
1057                         nfs4args_copen_free(open_args);
1058                         nfs4_end_op(VTOMI4(dvp), dvp, vpi, &recov_state, FALSE);
1059                         if (ncr != NULL)
1060                                 crfree(ncr);
1061                         kmem_free(argop, argoplist_size);
1062                         return (e.error);
1063                 }
1064         }
1065 
1066         bcopy(&oop->oo_name, open_args->owner.owner_val,
1067             open_args->owner.owner_len);
1068 
1069         seqid = nfs4_get_open_seqid(oop) + 1;
1070         open_args->seqid = seqid;
1071         open_args->share_access = 0;
1072         if (open_flag & FREAD)
1073                 open_args->share_access |= OPEN4_SHARE_ACCESS_READ;
1074         if (open_flag & FWRITE)
1075                 open_args->share_access |= OPEN4_SHARE_ACCESS_WRITE;
1076         open_args->share_deny = OPEN4_SHARE_DENY_NONE;
1077 
1078 
1079 
1080         /*
1081          * getfh w/sanity check for idx_open/idx_fattr
1082          */
1083         ASSERT((idx_open + 1) == (idx_fattr - 1));
1084         argop[idx_open + 1].argop = OP_GETFH;
1085 
1086         /* getattr */
1087         argop[idx_fattr].argop = OP_GETATTR;
1088         argop[idx_fattr].nfs_argop4_u.opgetattr.attr_request = NFS4_VATTR_MASK;
1089         argop[idx_fattr].nfs_argop4_u.opgetattr.mi = VTOMI4(dvp);
1090 
1091         if (setgid_flag) {
1092                 vattr_t _v;
1093                 servinfo4_t *svp;
1094                 bitmap4 supp_attrs;
1095 
1096                 svp = drp->r_server;
1097                 (void) nfs_rw_enter_sig(&svp->sv_lock, RW_READER, 0);
1098                 supp_attrs = svp->sv_supp_attrs;
1099                 nfs_rw_exit(&svp->sv_lock);
1100 
1101                 /*
1102                  * For setgid case, we need to:
1103                  * 4:savefh(new) 5:putfh(dir) 6:getattr(dir) 7:restorefh(new)
1104                  */
1105                 argop[4].argop = OP_SAVEFH;
1106 
1107                 argop[5].argop = OP_CPUTFH;
1108                 argop[5].nfs_argop4_u.opcputfh.sfh = drp->r_fh;
1109 
1110                 argop[6].argop = OP_GETATTR;
1111                 argop[6].nfs_argop4_u.opgetattr.attr_request = NFS4_VATTR_MASK;
1112                 argop[6].nfs_argop4_u.opgetattr.mi = VTOMI4(dvp);
1113 
1114                 argop[7].argop = OP_RESTOREFH;
1115 
1116                 /*
1117                  * nverify
1118                  */
1119                 _v.va_mask = AT_GID;
1120                 _v.va_gid = in_va->va_gid;
1121                 if (!(e.error = nfs4args_verify(&argop[8], &_v, OP_NVERIFY,
1122                     supp_attrs))) {
1123 
1124                         /*
1125                          * setattr
1126                          *
1127                          * We _know_ we're not messing with AT_SIZE or
1128                          * AT_XTIME, so no need for stateid or flags.
1129                          * Also we specify NULL rp since we're only
1130                          * interested in setting owner_group attributes.
1131                          */
1132                         nfs4args_setattr(&argop[9], &_v, NULL, 0, NULL, cr,
1133                             supp_attrs, &e.error, 0);
1134                         if (e.error)
1135                                 nfs4args_verify_free(&argop[8]);
1136                 }
1137 
1138                 if (e.error) {
1139                         /*
1140                          * XXX - Revisit the last argument to nfs4_end_op()
1141                          *       once 5020486 is fixed.
1142                          */
1143                         nfs4_end_open_seqid_sync(oop);
1144                         open_owner_rele(oop);
1145                         nfs4args_copen_free(open_args);
1146                         nfs4_end_op(VTOMI4(dvp), dvp, vpi, &recov_state, TRUE);
1147                         if (ncr != NULL)
1148                                 crfree(ncr);
1149                         kmem_free(argop, argoplist_size);
1150                         return (e.error);
1151                 }
1152         } else if (create_flag) {
1153                 argop[1].argop = OP_SAVEFH;
1154 
1155                 argop[5].argop = OP_RESTOREFH;
1156 
1157                 argop[6].argop = OP_GETATTR;
1158                 argop[6].nfs_argop4_u.opgetattr.attr_request = NFS4_VATTR_MASK;
1159                 argop[6].nfs_argop4_u.opgetattr.mi = VTOMI4(dvp);
1160         }
1161 
1162         NFS4_DEBUG(nfs4_client_call_debug, (CE_NOTE,
1163             "nfs4open_otw: %s call, nm %s, rp %s",
1164             needrecov ? "recov" : "first", file_name,
1165             rnode4info(VTOR4(dvp))));
1166 
1167         t = gethrtime();
1168 
1169         rfs4call(VTOMI4(dvp), &args, &res, cred_otw, &doqueue, 0, &e);
1170 
1171         if (!e.error && nfs4_need_to_bump_seqid(&res))
1172                 nfs4_set_open_seqid(seqid, oop, args.ctag);
1173 
1174         needrecov = nfs4_needs_recovery(&e, TRUE, dvp->v_vfsp);
1175 
1176         if (e.error || needrecov) {
1177                 bool_t abort = FALSE;
1178 
1179                 if (needrecov) {
1180                         nfs4_bseqid_entry_t *bsep = NULL;
1181 
1182                         nfs4open_save_lost_rqst(e.error, &lost_rqst, oop,
1183                             cred_otw, vpi, dvp, open_args);
1184 
1185                         if (!e.error && res.status == NFS4ERR_BAD_SEQID) {
1186                                 bsep = nfs4_create_bseqid_entry(oop, NULL,
1187                                     vpi, 0, args.ctag, open_args->seqid);
1188                                 num_bseqid_retry--;
1189                         }
1190 
1191                         abort = nfs4_start_recovery(&e, VTOMI4(dvp), dvp, vpi,
1192                             NULL, lost_rqst.lr_op == OP_OPEN ?
1193                             &lost_rqst : NULL, OP_OPEN, bsep, NULL, NULL);
1194 
1195                         if (bsep)
1196                                 kmem_free(bsep, sizeof (*bsep));
1197                         /* give up if we keep getting BAD_SEQID */
1198                         if (num_bseqid_retry == 0)
1199                                 abort = TRUE;
1200                         if (abort == TRUE && e.error == 0)
1201                                 e.error = geterrno4(res.status);
1202                 }
1203                 nfs4_end_open_seqid_sync(oop);
1204                 open_owner_rele(oop);
1205                 nfs4_end_op(VTOMI4(dvp), dvp, vpi, &recov_state, needrecov);
1206                 nfs4args_copen_free(open_args);
1207                 if (setgid_flag) {
1208                         nfs4args_verify_free(&argop[8]);
1209                         nfs4args_setattr_free(&argop[9]);
1210                 }
1211                 if (!e.error)
1212                         (void) xdr_free(xdr_COMPOUND4res_clnt, (caddr_t)&res);
1213                 if (ncr != NULL) {
1214                         crfree(ncr);
1215                         ncr = NULL;
1216                 }
1217                 if (!needrecov || abort == TRUE || e.error == EINTR ||
1218                     NFS4_FRC_UNMT_ERR(e.error, dvp->v_vfsp)) {
1219                         kmem_free(argop, argoplist_size);
1220                         return (e.error);
1221                 }
1222                 goto recov_retry;
1223         }
1224 
1225         /*
1226          * Will check and update lease after checking the rflag for
1227          * OPEN_CONFIRM in the successful OPEN call.
1228          */
1229         if (res.status != NFS4_OK && res.array_len <= idx_fattr + 1) {
1230 
1231                 /*
1232                  * XXX what if we're crossing mount points from server1:/drp
1233                  * to server2:/drp/rp.
1234                  */
1235 
1236                 /* Signal our end of use of the open seqid */
1237                 nfs4_end_open_seqid_sync(oop);
1238 
1239                 /*
1240                  * This will destroy the open owner if it was just created,
1241                  * and no one else has put a reference on it.
1242                  */
1243                 open_owner_rele(oop);
1244                 if (create_flag && (createmode != EXCLUSIVE4) &&
1245                     res.status == NFS4ERR_BADOWNER)
1246                         nfs4_log_badowner(VTOMI4(dvp), OP_OPEN);
1247 
1248                 e.error = geterrno4(res.status);
1249                 nfs4args_copen_free(open_args);
1250                 if (setgid_flag) {
1251                         nfs4args_verify_free(&argop[8]);
1252                         nfs4args_setattr_free(&argop[9]);
1253                 }
1254                 (void) xdr_free(xdr_COMPOUND4res_clnt, (caddr_t)&res);
1255                 nfs4_end_op(VTOMI4(dvp), dvp, vpi, &recov_state, needrecov);
1256                 /*
1257                  * If the reply is NFS4ERR_ACCESS, it may be because
1258                  * we are root (no root net access).  If the real uid
1259                  * is not root, then retry with the real uid instead.
1260                  */
1261                 if (ncr != NULL) {
1262                         crfree(ncr);
1263                         ncr = NULL;
1264                 }
1265                 if (res.status == NFS4ERR_ACCESS &&
1266                     (ncr = crnetadjust(cred_otw)) != NULL) {
1267                         cred_otw = ncr;
1268                         goto recov_retry;
1269                 }
1270                 kmem_free(argop, argoplist_size);
1271                 return (e.error);
1272         }
1273 
1274         resop = &res.array[idx_open];  /* open res */
1275         op_res = &resop->nfs_resop4_u.opopen;
1276 
1277 #ifdef DEBUG
1278         /*
1279          * verify attrset bitmap
1280          */
1281         if (create_flag &&
1282             (createmode == UNCHECKED4 || createmode == GUARDED4)) {
1283                 /* make sure attrset returned is what we asked for */
1284                 /* XXX Ignore this 'error' for now */
1285                 if (attr->attrmask != op_res->attrset)
1286                         /* EMPTY */;
1287         }
1288 #endif
1289 
1290         if (op_res->rflags & OPEN4_RESULT_LOCKTYPE_POSIX) {
1291                 mutex_enter(&VTOMI4(dvp)->mi_lock);
1292                 VTOMI4(dvp)->mi_flags |= MI4_POSIX_LOCK;
1293                 mutex_exit(&VTOMI4(dvp)->mi_lock);
1294         }
1295 
1296         resop = &res.array[idx_open + 1];  /* getfh res */
1297         gf_res = &resop->nfs_resop4_u.opgetfh;
1298 
1299         otw_sfh = sfh4_get(&gf_res->object, VTOMI4(dvp));
1300 
1301         /*
1302          * The open stateid has been updated on the server but not
1303          * on the client yet.  There is a path: makenfs4node->nfs4_attr_cache->
1304          * flush_pages->VOP_PUTPAGE->...->nfs4write where we will issue an OTW
1305          * WRITE call.  That, however, will use the old stateid, so go ahead
1306          * and upate the open stateid now, before any call to makenfs4node.
1307          */
1308         if (vpi) {
1309                 nfs4_open_stream_t      *tmp_osp;
1310                 rnode4_t                *tmp_rp = VTOR4(vpi);
1311 
1312                 tmp_osp = find_open_stream(oop, tmp_rp);
1313                 if (tmp_osp) {
1314                         tmp_osp->open_stateid = op_res->stateid;
1315                         mutex_exit(&tmp_osp->os_sync_lock);
1316                         open_stream_rele(tmp_osp, tmp_rp);
1317                 }
1318 
1319                 /*
1320                  * We must determine if the file handle given by the otw open
1321                  * is the same as the file handle which was passed in with
1322                  * *vpp.  This case can be reached if the file we are trying
1323                  * to open has been removed and another file has been created
1324                  * having the same file name.  The passed in vnode is released
1325                  * later.
1326                  */
1327                 orig_sfh = VTOR4(vpi)->r_fh;
1328                 fh_differs = nfs4cmpfh(&orig_sfh->sfh_fh, &otw_sfh->sfh_fh);
1329         }
1330 
1331         garp = &res.array[idx_fattr].nfs_resop4_u.opgetattr.ga_res;
1332 
1333         if (create_flag || fh_differs) {
1334                 int rnode_err = 0;
1335 
1336                 vp = makenfs4node(otw_sfh, garp, dvp->v_vfsp, t, cr,
1337                     dvp, fn_get(VTOSV(dvp)->sv_name, file_name, otw_sfh));
1338 
1339                 if (e.error)
1340                         PURGE_ATTRCACHE4(vp);
1341                 /*
1342                  * For the newly created vp case, make sure the rnode
1343                  * isn't bad before using it.
1344                  */
1345                 mutex_enter(&(VTOR4(vp))->r_statelock);
1346                 if (VTOR4(vp)->r_flags & R4RECOVERR)
1347                         rnode_err = EIO;
1348                 mutex_exit(&(VTOR4(vp))->r_statelock);
1349 
1350                 if (rnode_err) {
1351                         nfs4_end_open_seqid_sync(oop);
1352                         nfs4args_copen_free(open_args);
1353                         if (setgid_flag) {
1354                                 nfs4args_verify_free(&argop[8]);
1355                                 nfs4args_setattr_free(&argop[9]);
1356                         }
1357                         (void) xdr_free(xdr_COMPOUND4res_clnt, (caddr_t)&res);
1358                         nfs4_end_op(VTOMI4(dvp), dvp, vpi, &recov_state,
1359                             needrecov);
1360                         open_owner_rele(oop);
1361                         VN_RELE(vp);
1362                         if (ncr != NULL)
1363                                 crfree(ncr);
1364                         sfh4_rele(&otw_sfh);
1365                         kmem_free(argop, argoplist_size);
1366                         return (EIO);
1367                 }
1368         } else {
1369                 vp = vpi;
1370         }
1371         sfh4_rele(&otw_sfh);
1372 
1373         /*
1374          * It seems odd to get a full set of attrs and then not update
1375          * the object's attrcache in the non-create case.  Create case uses
1376          * the attrs since makenfs4node checks to see if the attrs need to
1377          * be updated (and then updates them).  The non-create case should
1378          * update attrs also.
1379          */
1380         if (! create_flag && ! fh_differs && !e.error) {
1381                 nfs4_attr_cache(vp, garp, t, cr, TRUE, NULL);
1382         }
1383 
1384         nfs4_error_zinit(&e);
1385         if (op_res->rflags & OPEN4_RESULT_CONFIRM) {
1386                 /* This does not do recovery for vp explicitly. */
1387                 nfs4open_confirm(vp, &seqid, &op_res->stateid, cred_otw, FALSE,
1388                     &retry_open, oop, FALSE, &e, &num_bseqid_retry);
1389 
1390                 if (e.error || e.stat) {
1391                         nfs4_end_open_seqid_sync(oop);
1392                         nfs4args_copen_free(open_args);
1393                         if (setgid_flag) {
1394                                 nfs4args_verify_free(&argop[8]);
1395                                 nfs4args_setattr_free(&argop[9]);
1396                         }
1397                         (void) xdr_free(xdr_COMPOUND4res_clnt, (caddr_t)&res);
1398                         nfs4_end_op(VTOMI4(dvp), dvp, vpi, &recov_state,
1399                             needrecov);
1400                         open_owner_rele(oop);
1401                         if (create_flag || fh_differs) {
1402                                 /* rele the makenfs4node */
1403                                 VN_RELE(vp);
1404                         }
1405                         if (ncr != NULL) {
1406                                 crfree(ncr);
1407                                 ncr = NULL;
1408                         }
1409                         if (retry_open == TRUE) {
1410                                 NFS4_DEBUG(nfs4_client_recov_debug, (CE_NOTE,
1411                                     "nfs4open_otw: retry the open since OPEN "
1412                                     "CONFIRM failed with error %d stat %d",
1413                                     e.error, e.stat));
1414                                 if (create_flag && createmode == GUARDED4) {
1415                                         NFS4_DEBUG(nfs4_client_recov_debug,
1416                                             (CE_NOTE, "nfs4open_otw: switch "
1417                                             "createmode from GUARDED4 to "
1418                                             "UNCHECKED4"));
1419                                         createmode = UNCHECKED4;
1420                                 }
1421                                 goto recov_retry;
1422                         }
1423                         if (!e.error) {
1424                                 if (create_flag && (createmode != EXCLUSIVE4) &&
1425                                     e.stat == NFS4ERR_BADOWNER)
1426                                         nfs4_log_badowner(VTOMI4(dvp), OP_OPEN);
1427 
1428                                 e.error = geterrno4(e.stat);
1429                         }
1430                         kmem_free(argop, argoplist_size);
1431                         return (e.error);
1432                 }
1433         }
1434 
1435         rp = VTOR4(vp);
1436 
1437         mutex_enter(&rp->r_statev4_lock);
1438         if (create_flag)
1439                 rp->created_v4 = 1;
1440         mutex_exit(&rp->r_statev4_lock);
1441 
1442         mutex_enter(&oop->oo_lock);
1443         /* Doesn't matter if 'oo_just_created' already was set as this */
1444         oop->oo_just_created = NFS4_PERM_CREATED;
1445         if (oop->oo_cred_otw)
1446                 crfree(oop->oo_cred_otw);
1447         oop->oo_cred_otw = cred_otw;
1448         crhold(oop->oo_cred_otw);
1449         mutex_exit(&oop->oo_lock);
1450 
1451         /* returns with 'os_sync_lock' held */
1452         osp = find_or_create_open_stream(oop, rp, &created_osp);
1453         if (!osp) {
1454                 NFS4_DEBUG(nfs4_client_state_debug, (CE_NOTE,
1455                     "nfs4open_otw: failed to create an open stream"));
1456                 NFS4_DEBUG(nfs4_seqid_sync, (CE_NOTE, "nfs4open_otw: "
1457                     "signal our end of use of the open seqid"));
1458 
1459                 nfs4_end_open_seqid_sync(oop);
1460                 open_owner_rele(oop);
1461                 nfs4args_copen_free(open_args);
1462                 if (setgid_flag) {
1463                         nfs4args_verify_free(&argop[8]);
1464                         nfs4args_setattr_free(&argop[9]);
1465                 }
1466                 (void) xdr_free(xdr_COMPOUND4res_clnt, (caddr_t)&res);
1467                 nfs4_end_op(VTOMI4(dvp), dvp, vpi, &recov_state, needrecov);
1468                 if (create_flag || fh_differs)
1469                         VN_RELE(vp);
1470                 if (ncr != NULL)
1471                         crfree(ncr);
1472 
1473                 kmem_free(argop, argoplist_size);
1474                 return (EINVAL);
1475 
1476         }
1477 
1478         osp->open_stateid = op_res->stateid;
1479 
1480         if (open_flag & FREAD)
1481                 osp->os_share_acc_read++;
1482         if (open_flag & FWRITE)
1483                 osp->os_share_acc_write++;
1484         osp->os_share_deny_none++;
1485 
1486         /*
1487          * Need to reset this bitfield for the possible case where we were
1488          * going to OTW CLOSE the file, got a non-recoverable error, and before
1489          * we could retry the CLOSE, OPENed the file again.
1490          */
1491         ASSERT(osp->os_open_owner->oo_seqid_inuse);
1492         osp->os_final_close = 0;
1493         osp->os_force_close = 0;
1494 #ifdef DEBUG
1495         if (osp->os_failed_reopen)
1496                 NFS4_DEBUG(nfs4_open_stream_debug, (CE_NOTE, "nfs4open_otw:"
1497                     " clearing os_failed_reopen for osp %p, cr %p, rp %s",
1498                     (void *)osp, (void *)cr, rnode4info(rp)));
1499 #endif
1500         osp->os_failed_reopen = 0;
1501 
1502         mutex_exit(&osp->os_sync_lock);
1503 
1504         nfs4_end_open_seqid_sync(oop);
1505 
1506         if (created_osp && recov_state.rs_sp != NULL) {
1507                 mutex_enter(&recov_state.rs_sp->s_lock);
1508                 nfs4_inc_state_ref_count_nolock(recov_state.rs_sp, VTOMI4(dvp));
1509                 mutex_exit(&recov_state.rs_sp->s_lock);
1510         }
1511 
1512         /* get rid of our reference to find oop */
1513         open_owner_rele(oop);
1514 
1515         open_stream_rele(osp, rp);
1516 
1517         /* accept delegation, if any */
1518         nfs4_delegation_accept(rp, CLAIM_NULL, op_res, garp, cred_otw);
1519 
1520         nfs4_end_op(VTOMI4(dvp), dvp, vpi, &recov_state, needrecov);
1521 
1522         if (createmode == EXCLUSIVE4 &&
1523             (in_va->va_mask & ~(AT_GID | AT_SIZE))) {
1524                 NFS4_DEBUG(nfs4_client_state_debug, (CE_NOTE, "nfs4open_otw:"
1525                     " EXCLUSIVE4: sending a SETATTR"));
1526                 /*
1527                  * If doing an exclusive create, then generate
1528                  * a SETATTR to set the initial attributes.
1529                  * Try to set the mtime and the atime to the
1530                  * server's current time.  It is somewhat
1531                  * expected that these fields will be used to
1532                  * store the exclusive create cookie.  If not,
1533                  * server implementors will need to know that
1534                  * a SETATTR will follow an exclusive create
1535                  * and the cookie should be destroyed if
1536                  * appropriate.
1537                  *
1538                  * The AT_GID and AT_SIZE bits are turned off
1539                  * so that the SETATTR request will not attempt
1540                  * to process these.  The gid will be set
1541                  * separately if appropriate.  The size is turned
1542                  * off because it is assumed that a new file will
1543                  * be created empty and if the file wasn't empty,
1544                  * then the exclusive create will have failed
1545                  * because the file must have existed already.
1546                  * Therefore, no truncate operation is needed.
1547                  */
1548                 in_va->va_mask &= ~(AT_GID | AT_SIZE);
1549                 in_va->va_mask |= (AT_MTIME | AT_ATIME);
1550 
1551                 e.error = nfs4setattr(vp, in_va, 0, cr, NULL);
1552                 if (e.error) {
1553                         /*
1554                          * Couldn't correct the attributes of
1555                          * the newly created file and the
1556                          * attributes are wrong.  Remove the
1557                          * file and return an error to the
1558                          * application.
1559                          */
1560                         /* XXX will this take care of client state ? */
1561                         NFS4_DEBUG(nfs4_client_state_debug, (CE_NOTE,
1562                             "nfs4open_otw: EXCLUSIVE4: error %d on SETATTR:"
1563                             " remove file", e.error));
1564                         VN_RELE(vp);
1565                         (void) nfs4_remove(dvp, file_name, cr, NULL, 0);
1566                         /*
1567                          * Since we've reled the vnode and removed
1568                          * the file we now need to return the error.
1569                          * At this point we don't want to update the
1570                          * dircaches, call nfs4_waitfor_purge_complete
1571                          * or set vpp to vp so we need to skip these
1572                          * as well.
1573                          */
1574                         goto skip_update_dircaches;
1575                 }
1576         }
1577 
1578         /*
1579          * If we created or found the correct vnode, due to create_flag or
1580          * fh_differs being set, then update directory cache attribute, readdir
1581          * and dnlc caches.
1582          */
1583         if (create_flag || fh_differs) {
1584                 dirattr_info_t dinfo, *dinfop;
1585 
1586                 /*
1587                  * Make sure getattr succeeded before using results.
1588                  * note: op 7 is getattr(dir) for both flavors of
1589                  * open(create).
1590                  */
1591                 if (create_flag && res.status == NFS4_OK) {
1592                         dinfo.di_time_call = t;
1593                         dinfo.di_cred = cr;
1594                         dinfo.di_garp =
1595                             &res.array[6].nfs_resop4_u.opgetattr.ga_res;
1596                         dinfop = &dinfo;
1597                 } else {
1598                         dinfop = NULL;
1599                 }
1600 
1601                 nfs4_update_dircaches(&op_res->cinfo, dvp, vp, file_name,
1602                     dinfop);
1603         }
1604 
1605         /*
1606          * If the page cache for this file was flushed from actions
1607          * above, it was done asynchronously and if that is true,
1608          * there is a need to wait here for it to complete.  This must
1609          * be done outside of start_fop/end_fop.
1610          */
1611         (void) nfs4_waitfor_purge_complete(vp);
1612 
1613         /*
1614          * It is implicit that we are in the open case (create_flag == 0) since
1615          * fh_differs can only be set to a non-zero value in the open case.
1616          */
1617         if (fh_differs != 0 && vpi != NULL)
1618                 VN_RELE(vpi);
1619 
1620         /*
1621          * Be sure to set *vpp to the correct value before returning.
1622          */
1623         *vpp = vp;
1624 
1625 skip_update_dircaches:
1626 
1627         nfs4args_copen_free(open_args);
1628         if (setgid_flag) {
1629                 nfs4args_verify_free(&argop[8]);
1630                 nfs4args_setattr_free(&argop[9]);
1631         }
1632         (void) xdr_free(xdr_COMPOUND4res_clnt, (caddr_t)&res);
1633 
1634         if (ncr)
1635                 crfree(ncr);
1636         kmem_free(argop, argoplist_size);
1637         return (e.error);
1638 }
1639 
1640 /*
1641  * Reopen an open instance.  cf. nfs4open_otw().
1642  *
1643  * Errors are returned by the nfs4_error_t parameter.
1644  * - ep->error contains an errno value or zero.
1645  * - if it is zero, ep->stat is set to an NFS status code, if any.
1646  *   If the file could not be reopened, but the caller should continue, the
1647  *   file is marked dead and no error values are returned.  If the caller
1648  *   should stop recovering open files and start over, either the ep->error
1649  *   value or ep->stat will indicate an error (either something that requires
1650  *   recovery or EAGAIN).  Note that some recovery (e.g., expired volatile
1651  *   filehandles) may be handled silently by this routine.
1652  * - if it is EINTR, ETIMEDOUT, or NFS4_FRC_UNMT_ERR, recovery for lost state
1653  *   will be started, so the caller should not do it.
1654  *
1655  * Gotos:
1656  * - kill_file : reopen failed in such a fashion to constitute marking the
1657  *    file dead and setting the open stream's 'os_failed_reopen' as 1.  This
1658  *   is for cases where recovery is not possible.
1659  * - failed_reopen : same as above, except that the file has already been
1660  *   marked dead, so no need to do it again.
1661  * - bailout : reopen failed but we are able to recover and retry the reopen -
1662  *   either within this function immediately or via the calling function.
1663  */
1664 
1665 void
1666 nfs4_reopen(vnode_t *vp, nfs4_open_stream_t *osp, nfs4_error_t *ep,
1667     open_claim_type4 claim, bool_t frc_use_claim_previous,
1668     bool_t is_recov)
1669 {
1670         COMPOUND4args_clnt args;
1671         COMPOUND4res_clnt res;
1672         nfs_argop4 argop[4];
1673         nfs_resop4 *resop;
1674         OPEN4res *op_res = NULL;
1675         OPEN4cargs *open_args;
1676         GETFH4res *gf_res;
1677         rnode4_t *rp = VTOR4(vp);
1678         int doqueue = 1;
1679         cred_t *cr = NULL, *cred_otw = NULL;
1680         nfs4_open_owner_t *oop = NULL;
1681         seqid4 seqid;
1682         nfs4_ga_res_t *garp;
1683         char fn[MAXNAMELEN];
1684         nfs4_recov_state_t recov = {NULL, 0};
1685         nfs4_lost_rqst_t lost_rqst;
1686         mntinfo4_t *mi = VTOMI4(vp);
1687         bool_t abort;
1688         char *failed_msg = "";
1689         int fh_different;
1690         hrtime_t t;
1691         nfs4_bseqid_entry_t *bsep = NULL;
1692 
1693         ASSERT(nfs4_consistent_type(vp));
1694         ASSERT(nfs_zone() == mi->mi_zone);
1695 
1696         nfs4_error_zinit(ep);
1697 
1698         /* this is the cred used to find the open owner */
1699         cr = state_to_cred(osp);
1700         if (cr == NULL) {
1701                 failed_msg = "Couldn't reopen: no cred";
1702                 goto kill_file;
1703         }
1704         /* use this cred for OTW operations */
1705         cred_otw = nfs4_get_otw_cred(cr, mi, osp->os_open_owner);
1706 
1707 top:
1708         nfs4_error_zinit(ep);
1709 
1710         if (mi->mi_vfsp->vfs_flag & VFS_UNMOUNTED) {
1711                 /* File system has been unmounted, quit */
1712                 ep->error = EIO;
1713                 failed_msg = "Couldn't reopen: file system has been unmounted";
1714                 goto kill_file;
1715         }
1716 
1717         oop = osp->os_open_owner;
1718 
1719         ASSERT(oop != NULL);
1720         if (oop == NULL) {      /* be defensive in non-DEBUG */
1721                 failed_msg = "can't reopen: no open owner";
1722                 goto kill_file;
1723         }
1724         open_owner_hold(oop);
1725 
1726         ep->error = nfs4_start_open_seqid_sync(oop, mi);
1727         if (ep->error) {
1728                 open_owner_rele(oop);
1729                 oop = NULL;
1730                 goto bailout;
1731         }
1732 
1733         /*
1734          * If the rnode has a delegation and the delegation has been
1735          * recovered and the server didn't request a recall and the caller
1736          * didn't specifically ask for CLAIM_PREVIOUS (nfs4frlock during
1737          * recovery) and the rnode hasn't been marked dead, then install
1738          * the delegation stateid in the open stream.  Otherwise, proceed
1739          * with a CLAIM_PREVIOUS or CLAIM_NULL OPEN.
1740          */
1741         mutex_enter(&rp->r_statev4_lock);
1742         if (rp->r_deleg_type != OPEN_DELEGATE_NONE &&
1743             !rp->r_deleg_return_pending &&
1744             (rp->r_deleg_needs_recovery == OPEN_DELEGATE_NONE) &&
1745             !rp->r_deleg_needs_recall &&
1746             claim != CLAIM_DELEGATE_CUR && !frc_use_claim_previous &&
1747             !(rp->r_flags & R4RECOVERR)) {
1748                 mutex_enter(&osp->os_sync_lock);
1749                 osp->os_delegation = 1;
1750                 osp->open_stateid = rp->r_deleg_stateid;
1751                 mutex_exit(&osp->os_sync_lock);
1752                 mutex_exit(&rp->r_statev4_lock);
1753                 goto bailout;
1754         }
1755         mutex_exit(&rp->r_statev4_lock);
1756 
1757         /*
1758          * If the file failed recovery, just quit.  This failure need not
1759          * affect other reopens, so don't return an error.
1760          */
1761         mutex_enter(&rp->r_statelock);
1762         if (rp->r_flags & R4RECOVERR) {
1763                 mutex_exit(&rp->r_statelock);
1764                 ep->error = 0;
1765                 goto failed_reopen;
1766         }
1767         mutex_exit(&rp->r_statelock);
1768 
1769         /*
1770          * argop is empty here
1771          *
1772          * PUTFH, OPEN, GETATTR
1773          */
1774         args.ctag = TAG_REOPEN;
1775         args.array_len = 4;
1776         args.array = argop;
1777 
1778         NFS4_DEBUG(nfs4_client_failover_debug, (CE_NOTE,
1779             "nfs4_reopen: file is type %d, id %s",
1780             vp->v_type, rnode4info(VTOR4(vp))));
1781 
1782         argop[0].argop = OP_CPUTFH;
1783 
1784         if (claim != CLAIM_PREVIOUS) {
1785                 /*
1786                  * if this is a file mount then
1787                  * use the mntinfo parentfh
1788                  */
1789                 argop[0].nfs_argop4_u.opcputfh.sfh =
1790                     (vp->v_flag & VROOT) ? mi->mi_srvparentfh :
1791                     VTOSV(vp)->sv_dfh;
1792         } else {
1793                 /* putfh fh to reopen */
1794                 argop[0].nfs_argop4_u.opcputfh.sfh = rp->r_fh;
1795         }
1796 
1797         argop[1].argop = OP_COPEN;
1798         open_args = &argop[1].nfs_argop4_u.opcopen;
1799         open_args->claim = claim;
1800 
1801         if (claim == CLAIM_NULL) {
1802 
1803                 if ((ep->error = vtoname(vp, fn, MAXNAMELEN)) != 0) {
1804                         nfs_cmn_err(ep->error, CE_WARN, "nfs4_reopen: vtoname "
1805                             "failed for vp 0x%p for CLAIM_NULL with %m",
1806                             (void *)vp);
1807                         failed_msg = "Couldn't reopen: vtoname failed for "
1808                             "CLAIM_NULL";
1809                         /* nothing allocated yet */
1810                         goto kill_file;
1811                 }
1812 
1813                 open_args->open_claim4_u.cfile = fn;
1814         } else if (claim == CLAIM_PREVIOUS) {
1815 
1816                 /*
1817                  * We have two cases to deal with here:
1818                  * 1) We're being called to reopen files in order to satisfy
1819                  *    a lock operation request which requires us to explicitly
1820                  *    reopen files which were opened under a delegation.  If
1821                  *    we're in recovery, we *must* use CLAIM_PREVIOUS.  In
1822                  *    that case, frc_use_claim_previous is TRUE and we must
1823                  *    use the rnode's current delegation type (r_deleg_type).
1824                  * 2) We're reopening files during some form of recovery.
1825                  *    In this case, frc_use_claim_previous is FALSE and we
1826                  *    use the delegation type appropriate for recovery
1827                  *    (r_deleg_needs_recovery).
1828                  */
1829                 mutex_enter(&rp->r_statev4_lock);
1830                 open_args->open_claim4_u.delegate_type =
1831                     frc_use_claim_previous ?
1832                     rp->r_deleg_type :
1833                     rp->r_deleg_needs_recovery;
1834                 mutex_exit(&rp->r_statev4_lock);
1835 
1836         } else if (claim == CLAIM_DELEGATE_CUR) {
1837 
1838                 if ((ep->error = vtoname(vp, fn, MAXNAMELEN)) != 0) {
1839                         nfs_cmn_err(ep->error, CE_WARN, "nfs4_reopen: vtoname "
1840                             "failed for vp 0x%p for CLAIM_DELEGATE_CUR "
1841                             "with %m", (void *)vp);
1842                         failed_msg = "Couldn't reopen: vtoname failed for "
1843                             "CLAIM_DELEGATE_CUR";
1844                         /* nothing allocated yet */
1845                         goto kill_file;
1846                 }
1847 
1848                 mutex_enter(&rp->r_statev4_lock);
1849                 open_args->open_claim4_u.delegate_cur_info.delegate_stateid =
1850                     rp->r_deleg_stateid;
1851                 mutex_exit(&rp->r_statev4_lock);
1852 
1853                 open_args->open_claim4_u.delegate_cur_info.cfile = fn;
1854         }
1855         open_args->opentype = OPEN4_NOCREATE;
1856         open_args->owner.clientid = mi2clientid(mi);
1857         open_args->owner.owner_len = sizeof (oop->oo_name);
1858         open_args->owner.owner_val =
1859             kmem_alloc(open_args->owner.owner_len, KM_SLEEP);
1860         bcopy(&oop->oo_name, open_args->owner.owner_val,
1861             open_args->owner.owner_len);
1862         open_args->share_access = 0;
1863         open_args->share_deny = 0;
1864 
1865         mutex_enter(&osp->os_sync_lock);
1866         NFS4_DEBUG(nfs4_client_recov_debug, (CE_NOTE, "nfs4_reopen: osp %p rp "
1867             "%p: read acc %"PRIu64" write acc %"PRIu64": open ref count %d: "
1868             "mmap read %"PRIu64" mmap write %"PRIu64" claim %d ",
1869             (void *)osp, (void *)rp, osp->os_share_acc_read,
1870             osp->os_share_acc_write, osp->os_open_ref_count,
1871             osp->os_mmap_read, osp->os_mmap_write, claim));
1872 
1873         if (osp->os_share_acc_read || osp->os_mmap_read)
1874                 open_args->share_access |= OPEN4_SHARE_ACCESS_READ;
1875         if (osp->os_share_acc_write || osp->os_mmap_write)
1876                 open_args->share_access |= OPEN4_SHARE_ACCESS_WRITE;
1877         if (osp->os_share_deny_read)
1878                 open_args->share_deny |= OPEN4_SHARE_DENY_READ;
1879         if (osp->os_share_deny_write)
1880                 open_args->share_deny |= OPEN4_SHARE_DENY_WRITE;
1881         mutex_exit(&osp->os_sync_lock);
1882 
1883         seqid = nfs4_get_open_seqid(oop) + 1;
1884         open_args->seqid = seqid;
1885 
1886         /* Construct the getfh part of the compound */
1887         argop[2].argop = OP_GETFH;
1888 
1889         /* Construct the getattr part of the compound */
1890         argop[3].argop = OP_GETATTR;
1891         argop[3].nfs_argop4_u.opgetattr.attr_request = NFS4_VATTR_MASK;
1892         argop[3].nfs_argop4_u.opgetattr.mi = mi;
1893 
1894         t = gethrtime();
1895 
1896         rfs4call(mi, &args, &res, cred_otw, &doqueue, 0, ep);
1897 
1898         if (ep->error) {
1899                 if (!is_recov && !frc_use_claim_previous &&
1900                     (ep->error == EINTR || ep->error == ETIMEDOUT ||
1901                     NFS4_FRC_UNMT_ERR(ep->error, vp->v_vfsp))) {
1902                         nfs4open_save_lost_rqst(ep->error, &lost_rqst, oop,
1903                             cred_otw, vp, NULL, open_args);
1904                         abort = nfs4_start_recovery(ep,
1905                             VTOMI4(vp), vp, NULL, NULL,
1906                             lost_rqst.lr_op == OP_OPEN ?
1907                             &lost_rqst : NULL, OP_OPEN, NULL, NULL, NULL);
1908                         nfs4args_copen_free(open_args);
1909                         goto bailout;
1910                 }
1911 
1912                 nfs4args_copen_free(open_args);
1913 
1914                 if (ep->error == EACCES && cred_otw != cr) {
1915                         crfree(cred_otw);
1916                         cred_otw = cr;
1917                         crhold(cred_otw);
1918                         nfs4_end_open_seqid_sync(oop);
1919                         open_owner_rele(oop);
1920                         oop = NULL;
1921                         goto top;
1922                 }
1923                 if (ep->error == ETIMEDOUT)
1924                         goto bailout;
1925                 failed_msg = "Couldn't reopen: rpc error";
1926                 goto kill_file;
1927         }
1928 
1929         if (nfs4_need_to_bump_seqid(&res))
1930                 nfs4_set_open_seqid(seqid, oop, args.ctag);
1931 
1932         switch (res.status) {
1933         case NFS4_OK:
1934                 if (recov.rs_flags & NFS4_RS_DELAY_MSG) {
1935                         mutex_enter(&rp->r_statelock);
1936                         rp->r_delay_interval = 0;
1937                         mutex_exit(&rp->r_statelock);
1938                 }
1939                 break;
1940         case NFS4ERR_BAD_SEQID:
1941                 bsep = nfs4_create_bseqid_entry(oop, NULL, vp, 0,
1942                     args.ctag, open_args->seqid);
1943 
1944                 abort = nfs4_start_recovery(ep, VTOMI4(vp), vp, NULL,
1945                     NULL, lost_rqst.lr_op == OP_OPEN ? &lost_rqst :
1946                     NULL, OP_OPEN, bsep, NULL, NULL);
1947 
1948                 nfs4args_copen_free(open_args);
1949                 (void) xdr_free(xdr_COMPOUND4res_clnt, (caddr_t)&res);
1950                 nfs4_end_open_seqid_sync(oop);
1951                 open_owner_rele(oop);
1952                 oop = NULL;
1953                 kmem_free(bsep, sizeof (*bsep));
1954 
1955                 goto kill_file;
1956         case NFS4ERR_NO_GRACE:
1957                 nfs4args_copen_free(open_args);
1958                 (void) xdr_free(xdr_COMPOUND4res_clnt, (caddr_t)&res);
1959                 nfs4_end_open_seqid_sync(oop);
1960                 open_owner_rele(oop);
1961                 oop = NULL;
1962                 if (claim == CLAIM_PREVIOUS) {
1963                         /*
1964                          * Retry as a plain open. We don't need to worry about
1965                          * checking the changeinfo: it is acceptable for a
1966                          * client to re-open a file and continue processing
1967                          * (in the absence of locks).
1968                          */
1969                         NFS4_DEBUG(nfs4_client_recov_debug, (CE_NOTE,
1970                             "nfs4_reopen: CLAIM_PREVIOUS: NFS4ERR_NO_GRACE; "
1971                             "will retry as CLAIM_NULL"));
1972                         claim = CLAIM_NULL;
1973                         nfs4_mi_kstat_inc_no_grace(mi);
1974                         goto top;
1975                 }
1976                 failed_msg =
1977                     "Couldn't reopen: tried reclaim outside grace period. ";
1978                 goto kill_file;
1979         case NFS4ERR_GRACE:
1980                 nfs4_set_grace_wait(mi);
1981                 nfs4args_copen_free(open_args);
1982                 (void) xdr_free(xdr_COMPOUND4res_clnt, (caddr_t)&res);
1983                 nfs4_end_open_seqid_sync(oop);
1984                 open_owner_rele(oop);
1985                 oop = NULL;
1986                 ep->error = nfs4_wait_for_grace(mi, &recov);
1987                 if (ep->error != 0)
1988                         goto bailout;
1989                 goto top;
1990         case NFS4ERR_DELAY:
1991                 nfs4_set_delay_wait(vp);
1992                 nfs4args_copen_free(open_args);
1993                 (void) xdr_free(xdr_COMPOUND4res_clnt, (caddr_t)&res);
1994                 nfs4_end_open_seqid_sync(oop);
1995                 open_owner_rele(oop);
1996                 oop = NULL;
1997                 ep->error = nfs4_wait_for_delay(vp, &recov);
1998                 nfs4_mi_kstat_inc_delay(mi);
1999                 if (ep->error != 0)
2000                         goto bailout;
2001                 goto top;
2002         case NFS4ERR_FHEXPIRED:
2003                 /* recover filehandle and retry */
2004                 abort = nfs4_start_recovery(ep,
2005                     mi, vp, NULL, NULL, NULL, OP_OPEN, NULL, NULL, NULL);
2006                 nfs4args_copen_free(open_args);
2007                 (void) xdr_free(xdr_COMPOUND4res_clnt, (caddr_t)&res);
2008                 nfs4_end_open_seqid_sync(oop);
2009                 open_owner_rele(oop);
2010                 oop = NULL;
2011                 if (abort == FALSE)
2012                         goto top;
2013                 failed_msg = "Couldn't reopen: recovery aborted";
2014                 goto kill_file;
2015         case NFS4ERR_RESOURCE:
2016         case NFS4ERR_STALE_CLIENTID:
2017         case NFS4ERR_WRONGSEC:
2018         case NFS4ERR_EXPIRED:
2019                 /*
2020                  * Do not mark the file dead and let the calling
2021                  * function initiate recovery.
2022                  */
2023                 nfs4args_copen_free(open_args);
2024                 (void) xdr_free(xdr_COMPOUND4res_clnt, (caddr_t)&res);
2025                 nfs4_end_open_seqid_sync(oop);
2026                 open_owner_rele(oop);
2027                 oop = NULL;
2028                 goto bailout;
2029         case NFS4ERR_ACCESS:
2030                 if (cred_otw != cr) {
2031                         crfree(cred_otw);
2032                         cred_otw = cr;
2033                         crhold(cred_otw);
2034                         nfs4args_copen_free(open_args);
2035                         (void) xdr_free(xdr_COMPOUND4res_clnt, (caddr_t)&res);
2036                         nfs4_end_open_seqid_sync(oop);
2037                         open_owner_rele(oop);
2038                         oop = NULL;
2039                         goto top;
2040                 }
2041                 /* fall through */
2042         default:
2043                 NFS4_DEBUG(nfs4_client_failover_debug, (CE_NOTE,
2044                     "nfs4_reopen: r_server 0x%p, mi_curr_serv 0x%p, rnode %s",
2045                     (void*)VTOR4(vp)->r_server, (void*)mi->mi_curr_serv,
2046                     rnode4info(VTOR4(vp))));
2047                 failed_msg = "Couldn't reopen: NFSv4 error";
2048                 nfs4args_copen_free(open_args);
2049                 (void) xdr_free(xdr_COMPOUND4res_clnt, (caddr_t)&res);
2050                 goto kill_file;
2051         }
2052 
2053         resop = &res.array[1];  /* open res */
2054         op_res = &resop->nfs_resop4_u.opopen;
2055 
2056         garp = &res.array[3].nfs_resop4_u.opgetattr.ga_res;
2057 
2058         /*
2059          * Check if the path we reopened really is the same
2060          * file. We could end up in a situation where the file
2061          * was removed and a new file created with the same name.
2062          */
2063         resop = &res.array[2];
2064         gf_res = &resop->nfs_resop4_u.opgetfh;
2065         (void) nfs_rw_enter_sig(&mi->mi_fh_lock, RW_READER, 0);
2066         fh_different = (nfs4cmpfh(&rp->r_fh->sfh_fh, &gf_res->object) != 0);
2067         if (fh_different) {
2068                 if (mi->mi_fh_expire_type == FH4_PERSISTENT ||
2069                     mi->mi_fh_expire_type & FH4_NOEXPIRE_WITH_OPEN) {
2070                         /* Oops, we don't have the same file */
2071                         if (mi->mi_fh_expire_type == FH4_PERSISTENT)
2072                                 failed_msg = "Couldn't reopen: Persistent "
2073                                     "file handle changed";
2074                         else
2075                                 failed_msg = "Couldn't reopen: Volatile "
2076                                     "(no expire on open) file handle changed";
2077 
2078                         nfs4args_copen_free(open_args);
2079                         (void) xdr_free(xdr_COMPOUND4res_clnt, (caddr_t)&res);
2080                         nfs_rw_exit(&mi->mi_fh_lock);
2081                         goto kill_file;
2082 
2083                 } else {
2084                         /*
2085                          * We have volatile file handles that don't compare.
2086                          * If the fids are the same then we assume that the
2087                          * file handle expired but the rnode still refers to
2088                          * the same file object.
2089                          *
2090                          * First check that we have fids or not.
2091                          * If we don't we have a dumb server so we will
2092                          * just assume every thing is ok for now.
2093                          */
2094                         if (!ep->error && garp->n4g_va.va_mask & AT_NODEID &&
2095                             rp->r_attr.va_mask & AT_NODEID &&
2096                             rp->r_attr.va_nodeid != garp->n4g_va.va_nodeid) {
2097                                 /*
2098                                  * We have fids, but they don't
2099                                  * compare. So kill the file.
2100                                  */
2101                                 failed_msg =
2102                                     "Couldn't reopen: file handle changed"
2103                                     " due to mismatched fids";
2104                                 nfs4args_copen_free(open_args);
2105                                 (void) xdr_free(xdr_COMPOUND4res_clnt,
2106                                     (caddr_t)&res);
2107                                 nfs_rw_exit(&mi->mi_fh_lock);
2108                                 goto kill_file;
2109                         } else {
2110                                 /*
2111                                  * We have volatile file handles that refers
2112                                  * to the same file (at least they have the
2113                                  * same fid) or we don't have fids so we
2114                                  * can't tell. :(. We'll be a kind and accepting
2115                                  * client so we'll update the rnode's file
2116                                  * handle with the otw handle.
2117                                  *
2118                                  * We need to drop mi->mi_fh_lock since
2119                                  * sh4_update acquires it. Since there is
2120                                  * only one recovery thread there is no
2121                                  * race.
2122                                  */
2123                                 nfs_rw_exit(&mi->mi_fh_lock);
2124                                 sfh4_update(rp->r_fh, &gf_res->object);
2125                         }
2126                 }
2127         } else {
2128                 nfs_rw_exit(&mi->mi_fh_lock);
2129         }
2130 
2131         ASSERT(nfs4_consistent_type(vp));
2132 
2133         /*
2134          * If the server wanted an OPEN_CONFIRM but that fails, just start
2135          * over.  Presumably if there is a persistent error it will show up
2136          * when we resend the OPEN.
2137          */
2138         if (op_res->rflags & OPEN4_RESULT_CONFIRM) {
2139                 bool_t retry_open = FALSE;
2140 
2141                 nfs4open_confirm(vp, &seqid, &op_res->stateid,
2142                     cred_otw, is_recov, &retry_open,
2143                     oop, FALSE, ep, NULL);
2144                 if (ep->error || ep->stat) {
2145                         nfs4args_copen_free(open_args);
2146                         (void) xdr_free(xdr_COMPOUND4res_clnt, (caddr_t)&res);
2147                         nfs4_end_open_seqid_sync(oop);
2148                         open_owner_rele(oop);
2149                         oop = NULL;
2150                         goto top;
2151                 }
2152         }
2153 
2154         mutex_enter(&osp->os_sync_lock);
2155         osp->open_stateid = op_res->stateid;
2156         osp->os_delegation = 0;
2157         /*
2158          * Need to reset this bitfield for the possible case where we were
2159          * going to OTW CLOSE the file, got a non-recoverable error, and before
2160          * we could retry the CLOSE, OPENed the file again.
2161          */
2162         ASSERT(osp->os_open_owner->oo_seqid_inuse);
2163         osp->os_final_close = 0;
2164         osp->os_force_close = 0;
2165         if (claim == CLAIM_DELEGATE_CUR || claim == CLAIM_PREVIOUS)
2166                 osp->os_dc_openacc = open_args->share_access;
2167         mutex_exit(&osp->os_sync_lock);
2168 
2169         nfs4_end_open_seqid_sync(oop);
2170 
2171         /* accept delegation, if any */
2172         nfs4_delegation_accept(rp, claim, op_res, garp, cred_otw);
2173 
2174         nfs4args_copen_free(open_args);
2175 
2176         nfs4_attr_cache(vp, garp, t, cr, TRUE, NULL);
2177 
2178         (void) xdr_free(xdr_COMPOUND4res_clnt, (caddr_t)&res);
2179 
2180         ASSERT(nfs4_consistent_type(vp));
2181 
2182         open_owner_rele(oop);
2183         crfree(cr);
2184         crfree(cred_otw);
2185         return;
2186 
2187 kill_file:
2188         nfs4_fail_recov(vp, failed_msg, ep->error, ep->stat);
2189 failed_reopen:
2190         NFS4_DEBUG(nfs4_open_stream_debug, (CE_NOTE,
2191             "nfs4_reopen: setting os_failed_reopen for osp %p, cr %p, rp %s",
2192             (void *)osp, (void *)cr, rnode4info(rp)));
2193         mutex_enter(&osp->os_sync_lock);
2194         osp->os_failed_reopen = 1;
2195         mutex_exit(&osp->os_sync_lock);
2196 bailout:
2197         if (oop != NULL) {
2198                 nfs4_end_open_seqid_sync(oop);
2199                 open_owner_rele(oop);
2200         }
2201         if (cr != NULL)
2202                 crfree(cr);
2203         if (cred_otw != NULL)
2204                 crfree(cred_otw);
2205 }
2206 
2207 /* for . and .. OPENs */
2208 /* ARGSUSED */
2209 static int
2210 nfs4_open_non_reg_file(vnode_t **vpp, int flag, cred_t *cr)
2211 {
2212         rnode4_t *rp;
2213         nfs4_ga_res_t gar;
2214 
2215         ASSERT(nfs_zone() == VTOMI4(*vpp)->mi_zone);
2216 
2217         /*
2218          * If close-to-open consistency checking is turned off or
2219          * if there is no cached data, we can avoid
2220          * the over the wire getattr.  Otherwise, force a
2221          * call to the server to get fresh attributes and to
2222          * check caches. This is required for close-to-open
2223          * consistency.
2224          */
2225         rp = VTOR4(*vpp);
2226         if (VTOMI4(*vpp)->mi_flags & MI4_NOCTO ||
2227             (rp->r_dir == NULL && !nfs4_has_pages(*vpp)))
2228                 return (0);
2229 
2230         gar.n4g_va.va_mask = AT_ALL;
2231         return (nfs4_getattr_otw(*vpp, &gar, cr, 0));
2232 }
2233 
2234 /*
2235  * CLOSE a file
2236  */
2237 /* ARGSUSED */
2238 static int
2239 nfs4_close(vnode_t *vp, int flag, int count, offset_t offset, cred_t *cr,
2240         caller_context_t *ct)
2241 {
2242         rnode4_t        *rp;
2243         int              error = 0;
2244         int              r_error = 0;
2245         int              n4error = 0;
2246         nfs4_error_t     e = { 0, NFS4_OK, RPC_SUCCESS };
2247 
2248         /*
2249          * Remove client state for this (lockowner, file) pair.
2250          * Issue otw v4 call to have the server do the same.
2251          */
2252 
2253         rp = VTOR4(vp);
2254 
2255         /*
2256          * zone_enter(2) prevents processes from changing zones with NFS files
2257          * open; if we happen to get here from the wrong zone we can't do
2258          * anything over the wire.
2259          */
2260         if (VTOMI4(vp)->mi_zone != nfs_zone()) {
2261                 /*
2262                  * We could attempt to clean up locks, except we're sure
2263                  * that the current process didn't acquire any locks on
2264                  * the file: any attempt to lock a file belong to another zone
2265                  * will fail, and one can't lock an NFS file and then change
2266                  * zones, as that fails too.
2267                  *
2268                  * Returning an error here is the sane thing to do.  A
2269                  * subsequent call to VN_RELE() which translates to a
2270                  * nfs4_inactive() will clean up state: if the zone of the
2271                  * vnode's origin is still alive and kicking, the inactive
2272                  * thread will handle the request (from the correct zone), and
2273                  * everything (minus the OTW close call) should be OK.  If the
2274                  * zone is going away nfs4_async_inactive() will throw away
2275                  * delegations, open streams and cached pages inline.
2276                  */
2277                 return (EIO);
2278         }
2279 
2280         /*
2281          * If we are using local locking for this filesystem, then
2282          * release all of the SYSV style record locks.  Otherwise,
2283          * we are doing network locking and we need to release all
2284          * of the network locks.  All of the locks held by this
2285          * process on this file are released no matter what the
2286          * incoming reference count is.
2287          */
2288         if (VTOMI4(vp)->mi_flags & MI4_LLOCK) {
2289                 cleanlocks(vp, ttoproc(curthread)->p_pid, 0);
2290                 cleanshares(vp, ttoproc(curthread)->p_pid);
2291         } else
2292                 e.error = nfs4_lockrelease(vp, flag, offset, cr);
2293 
2294         if (e.error) {
2295                 struct lm_sysid *lmsid;
2296                 lmsid = nfs4_find_sysid(VTOMI4(vp));
2297                 if (lmsid == NULL) {
2298                         DTRACE_PROBE2(unknown__sysid, int, e.error,
2299                             vnode_t *, vp);
2300                 } else {
2301                         cleanlocks(vp, ttoproc(curthread)->p_pid,
2302                             (lm_sysidt(lmsid) | LM_SYSID_CLIENT));
2303                 }
2304                 return (e.error);
2305         }
2306 
2307         if (count > 1)
2308                 return (0);
2309 
2310         /*
2311          * If the file has been `unlinked', then purge the
2312          * DNLC so that this vnode will get reycled quicker
2313          * and the .nfs* file on the server will get removed.
2314          */
2315         if (rp->r_unldvp != NULL)
2316                 dnlc_purge_vp(vp);
2317 
2318         /*
2319          * If the file was open for write and there are pages,
2320          * do a synchronous flush and commit of all of the
2321          * dirty and uncommitted pages.
2322          */
2323         ASSERT(!e.error);
2324         if ((flag & FWRITE) && nfs4_has_pages(vp))
2325                 error = nfs4_putpage_commit(vp, 0, 0, cr);
2326 
2327         mutex_enter(&rp->r_statelock);
2328         r_error = rp->r_error;
2329         rp->r_error = 0;
2330         mutex_exit(&rp->r_statelock);
2331 
2332         /*
2333          * If this file type is one for which no explicit 'open' was
2334          * done, then bail now (ie. no need for protocol 'close'). If
2335          * there was an error w/the vm subsystem, return _that_ error,
2336          * otherwise, return any errors that may've been reported via
2337          * the rnode.
2338          */
2339         if (vp->v_type != VREG)
2340                 return (error ? error : r_error);
2341 
2342         /*
2343          * The sync putpage commit may have failed above, but since
2344          * we're working w/a regular file, we need to do the protocol
2345          * 'close' (nfs4close_one will figure out if an otw close is
2346          * needed or not). Report any errors _after_ doing the protocol
2347          * 'close'.
2348          */
2349         nfs4close_one(vp, NULL, cr, flag, NULL, &e, CLOSE_NORM, 0, 0, 0);
2350         n4error = e.error ? e.error : geterrno4(e.stat);
2351 
2352         /*
2353          * Error reporting prio (Hi -> Lo)
2354          *
2355          *   i) nfs4_putpage_commit (error)
2356          *  ii) rnode's (r_error)
2357          * iii) nfs4close_one (n4error)
2358          */
2359         return (error ? error : (r_error ? r_error : n4error));
2360 }
2361 
2362 /*
2363  * Initialize *lost_rqstp.
2364  */
2365 
2366 static void
2367 nfs4close_save_lost_rqst(int error, nfs4_lost_rqst_t *lost_rqstp,
2368     nfs4_open_owner_t *oop, nfs4_open_stream_t *osp, cred_t *cr,
2369     vnode_t *vp)
2370 {
2371         if (error != ETIMEDOUT && error != EINTR &&
2372             !NFS4_FRC_UNMT_ERR(error, vp->v_vfsp)) {
2373                 lost_rqstp->lr_op = 0;
2374                 return;
2375         }
2376 
2377         NFS4_DEBUG(nfs4_lost_rqst_debug, (CE_NOTE,
2378             "nfs4close_save_lost_rqst: error %d", error));
2379 
2380         lost_rqstp->lr_op = OP_CLOSE;
2381         /*
2382          * The vp is held and rele'd via the recovery code.
2383          * See nfs4_save_lost_rqst.
2384          */
2385         lost_rqstp->lr_vp = vp;
2386         lost_rqstp->lr_dvp = NULL;
2387         lost_rqstp->lr_oop = oop;
2388         lost_rqstp->lr_osp = osp;
2389         ASSERT(osp != NULL);
2390         ASSERT(mutex_owned(&osp->os_sync_lock));
2391         osp->os_pending_close = 1;
2392         lost_rqstp->lr_lop = NULL;
2393         lost_rqstp->lr_cr = cr;
2394         lost_rqstp->lr_flk = NULL;
2395         lost_rqstp->lr_putfirst = FALSE;
2396 }
2397 
2398 /*
2399  * Assumes you already have the open seqid sync grabbed as well as the
2400  * 'os_sync_lock'.  Note: this will release the open seqid sync and
2401  * 'os_sync_lock' if client recovery starts.  Calling functions have to
2402  * be prepared to handle this.
2403  *
2404  * 'recov' is returned as 1 if the CLOSE operation detected client recovery
2405  * was needed and was started, and that the calling function should retry
2406  * this function; otherwise it is returned as 0.
2407  *
2408  * Errors are returned via the nfs4_error_t parameter.
2409  */
2410 static void
2411 nfs4close_otw(rnode4_t *rp, cred_t *cred_otw, nfs4_open_owner_t *oop,
2412     nfs4_open_stream_t *osp, int *recov, int *did_start_seqid_syncp,
2413     nfs4_close_type_t close_type, nfs4_error_t *ep, int *have_sync_lockp)
2414 {
2415         COMPOUND4args_clnt args;
2416         COMPOUND4res_clnt res;
2417         CLOSE4args *close_args;
2418         nfs_resop4 *resop;
2419         nfs_argop4 argop[3];
2420         int doqueue = 1;
2421         mntinfo4_t *mi;
2422         seqid4 seqid;
2423         vnode_t *vp;
2424         bool_t needrecov = FALSE;
2425         nfs4_lost_rqst_t lost_rqst;
2426         hrtime_t t;
2427 
2428         ASSERT(nfs_zone() == VTOMI4(RTOV4(rp))->mi_zone);
2429 
2430         ASSERT(MUTEX_HELD(&osp->os_sync_lock));
2431 
2432         NFS4_DEBUG(nfs4_client_state_debug, (CE_NOTE, "nfs4close_otw"));
2433 
2434         /* Only set this to 1 if recovery is started */
2435         *recov = 0;
2436 
2437         /* do the OTW call to close the file */
2438 
2439         if (close_type == CLOSE_RESEND)
2440                 args.ctag = TAG_CLOSE_LOST;
2441         else if (close_type == CLOSE_AFTER_RESEND)
2442                 args.ctag = TAG_CLOSE_UNDO;
2443         else
2444                 args.ctag = TAG_CLOSE;
2445 
2446         args.array_len = 3;
2447         args.array = argop;
2448 
2449         vp = RTOV4(rp);
2450 
2451         mi = VTOMI4(vp);
2452 
2453         /* putfh target fh */
2454         argop[0].argop = OP_CPUTFH;
2455         argop[0].nfs_argop4_u.opcputfh.sfh = rp->r_fh;
2456 
2457         argop[1].argop = OP_GETATTR;
2458         argop[1].nfs_argop4_u.opgetattr.attr_request = NFS4_VATTR_MASK;
2459         argop[1].nfs_argop4_u.opgetattr.mi = mi;
2460 
2461         argop[2].argop = OP_CLOSE;
2462         close_args = &argop[2].nfs_argop4_u.opclose;
2463 
2464         seqid = nfs4_get_open_seqid(oop) + 1;
2465 
2466         close_args->seqid = seqid;
2467         close_args->open_stateid = osp->open_stateid;
2468 
2469         NFS4_DEBUG(nfs4_client_call_debug, (CE_NOTE,
2470             "nfs4close_otw: %s call, rp %s", needrecov ? "recov" : "first",
2471             rnode4info(rp)));
2472 
2473         t = gethrtime();
2474 
2475         rfs4call(mi, &args, &res, cred_otw, &doqueue, 0, ep);
2476 
2477         if (!ep->error && nfs4_need_to_bump_seqid(&res)) {
2478                 nfs4_set_open_seqid(seqid, oop, args.ctag);
2479         }
2480 
2481         needrecov = nfs4_needs_recovery(ep, TRUE, mi->mi_vfsp);
2482         if (ep->error && !needrecov) {
2483                 /*
2484                  * if there was an error and no recovery is to be done
2485                  * then then set up the file to flush its cache if
2486                  * needed for the next caller.
2487                  */
2488                 mutex_enter(&rp->r_statelock);
2489                 PURGE_ATTRCACHE4_LOCKED(rp);
2490                 rp->r_flags &= ~R4WRITEMODIFIED;
2491                 mutex_exit(&rp->r_statelock);
2492                 return;
2493         }
2494 
2495         if (needrecov) {
2496                 bool_t abort;
2497                 nfs4_bseqid_entry_t *bsep = NULL;
2498 
2499                 if (close_type != CLOSE_RESEND)
2500                         nfs4close_save_lost_rqst(ep->error, &lost_rqst, oop,
2501                             osp, cred_otw, vp);
2502 
2503                 if (!ep->error && res.status == NFS4ERR_BAD_SEQID)
2504                         bsep = nfs4_create_bseqid_entry(oop, NULL, vp,
2505                             0, args.ctag, close_args->seqid);
2506 
2507                 NFS4_DEBUG(nfs4_client_recov_debug, (CE_NOTE,
2508                     "nfs4close_otw: initiating recovery. error %d "
2509                     "res.status %d", ep->error, res.status));
2510 
2511                 /*
2512                  * Drop the 'os_sync_lock' here so we don't hit
2513                  * a potential recursive mutex_enter via an
2514                  * 'open_stream_hold()'.
2515                  */
2516                 mutex_exit(&osp->os_sync_lock);
2517                 *have_sync_lockp = 0;
2518                 abort = nfs4_start_recovery(ep, VTOMI4(vp), vp, NULL, NULL,
2519                     (close_type != CLOSE_RESEND &&
2520                     lost_rqst.lr_op == OP_CLOSE) ? &lost_rqst : NULL,
2521                     OP_CLOSE, bsep, NULL, NULL);
2522 
2523                 /* drop open seq sync, and let the calling function regrab it */
2524                 nfs4_end_open_seqid_sync(oop);
2525                 *did_start_seqid_syncp = 0;
2526 
2527                 if (bsep)
2528                         kmem_free(bsep, sizeof (*bsep));
2529                 /*
2530                  * For signals, the caller wants to quit, so don't say to
2531                  * retry.  For forced unmount, if it's a user thread, it
2532                  * wants to quit.  If it's a recovery thread, the retry
2533                  * will happen higher-up on the call stack.  Either way,
2534                  * don't say to retry.
2535                  */
2536                 if (abort == FALSE && ep->error != EINTR &&
2537                     !NFS4_FRC_UNMT_ERR(ep->error, mi->mi_vfsp) &&
2538                     close_type != CLOSE_RESEND &&
2539                     close_type != CLOSE_AFTER_RESEND)
2540                         *recov = 1;
2541                 else
2542                         *recov = 0;
2543 
2544                 if (!ep->error)
2545                         (void) xdr_free(xdr_COMPOUND4res_clnt, (caddr_t)&res);
2546                 return;
2547         }
2548 
2549         if (res.status) {
2550                 (void) xdr_free(xdr_COMPOUND4res_clnt, (caddr_t)&res);
2551                 return;
2552         }
2553 
2554         mutex_enter(&rp->r_statev4_lock);
2555         rp->created_v4 = 0;
2556         mutex_exit(&rp->r_statev4_lock);
2557 
2558         resop = &res.array[2];
2559         osp->open_stateid = resop->nfs_resop4_u.opclose.open_stateid;
2560         osp->os_valid = 0;
2561 
2562         /*
2563          * This removes the reference obtained at OPEN; ie, when the
2564          * open stream structure was created.
2565          *
2566          * We don't have to worry about calling 'open_stream_rele'
2567          * since we our currently holding a reference to the open
2568          * stream which means the count cannot go to 0 with this
2569          * decrement.
2570          */
2571         ASSERT(osp->os_ref_count >= 2);
2572         osp->os_ref_count--;
2573 
2574         if (!ep->error)
2575                 nfs4_attr_cache(vp,
2576                     &res.array[1].nfs_resop4_u.opgetattr.ga_res,
2577                     t, cred_otw, TRUE, NULL);
2578 
2579         NFS4_DEBUG(nfs4_client_state_debug, (CE_NOTE, "nfs4close_otw:"
2580             " returning %d", ep->error));
2581 
2582         (void) xdr_free(xdr_COMPOUND4res_clnt, (caddr_t)&res);
2583 }
2584 
2585 /* ARGSUSED */
2586 static int
2587 nfs4_read(vnode_t *vp, struct uio *uiop, int ioflag, cred_t *cr,
2588     caller_context_t *ct)
2589 {
2590         rnode4_t *rp;
2591         u_offset_t off;
2592         offset_t diff;
2593         uint_t on;
2594         uint_t n;
2595         caddr_t base;
2596         uint_t flags;
2597         int error;
2598         mntinfo4_t *mi;
2599 
2600         rp = VTOR4(vp);
2601 
2602         ASSERT(nfs_rw_lock_held(&rp->r_rwlock, RW_READER));
2603 
2604         if (IS_SHADOW(vp, rp))
2605                 vp = RTOV4(rp);
2606 
2607         if (vp->v_type != VREG)
2608                 return (EISDIR);
2609 
2610         mi = VTOMI4(vp);
2611 
2612         if (nfs_zone() != mi->mi_zone)
2613                 return (EIO);
2614 
2615         if (uiop->uio_resid == 0)
2616                 return (0);
2617 
2618         if (uiop->uio_loffset < 0 || uiop->uio_loffset + uiop->uio_resid < 0)
2619                 return (EINVAL);
2620 
2621         mutex_enter(&rp->r_statelock);
2622         if (rp->r_flags & R4RECOVERRP)
2623                 error = (rp->r_error ? rp->r_error : EIO);
2624         else
2625                 error = 0;
2626         mutex_exit(&rp->r_statelock);
2627         if (error)
2628                 return (error);
2629 
2630         /*
2631          * Bypass VM if caching has been disabled (e.g., locking) or if
2632          * using client-side direct I/O and the file is not mmap'd and
2633          * there are no cached pages.
2634          */
2635         if ((vp->v_flag & VNOCACHE) ||
2636             (((rp->r_flags & R4DIRECTIO) || (mi->mi_flags & MI4_DIRECTIO)) &&
2637             rp->r_mapcnt == 0 && rp->r_inmap == 0 && !nfs4_has_pages(vp))) {
2638                 size_t resid = 0;
2639 
2640                 return (nfs4read(vp, NULL, uiop->uio_loffset,
2641                     uiop->uio_resid, &resid, cr, FALSE, uiop));
2642         }
2643 
2644         error = 0;
2645 
2646         do {
2647                 off = uiop->uio_loffset & MAXBMASK; /* mapping offset */
2648                 on = uiop->uio_loffset & MAXBOFFSET; /* Relative offset */
2649                 n = MIN(MAXBSIZE - on, uiop->uio_resid);
2650 
2651                 if (error = nfs4_validate_caches(vp, cr))
2652                         break;
2653 
2654                 mutex_enter(&rp->r_statelock);
2655                 while (rp->r_flags & R4INCACHEPURGE) {
2656                         if (!cv_wait_sig(&rp->r_cv, &rp->r_statelock)) {
2657                                 mutex_exit(&rp->r_statelock);
2658                                 return (EINTR);
2659                         }
2660                 }
2661                 diff = rp->r_size - uiop->uio_loffset;
2662                 mutex_exit(&rp->r_statelock);
2663                 if (diff <= 0)
2664                         break;
2665                 if (diff < n)
2666                         n = (uint_t)diff;
2667 
2668                 if (vpm_enable) {
2669                         /*
2670                          * Copy data.
2671                          */
2672                         error = vpm_data_copy(vp, off + on, n, uiop,
2673                             1, NULL, 0, S_READ);
2674                 } else {
2675                         base = segmap_getmapflt(segkmap, vp, off + on, n, 1,
2676                             S_READ);
2677 
2678                         error = uiomove(base + on, n, UIO_READ, uiop);
2679                 }
2680 
2681                 if (!error) {
2682                         /*
2683                          * If read a whole block or read to eof,
2684                          * won't need this buffer again soon.
2685                          */
2686                         mutex_enter(&rp->r_statelock);
2687                         if (n + on == MAXBSIZE ||
2688                             uiop->uio_loffset == rp->r_size)
2689                                 flags = SM_DONTNEED;
2690                         else
2691                                 flags = 0;
2692                         mutex_exit(&rp->r_statelock);
2693                         if (vpm_enable) {
2694                                 error = vpm_sync_pages(vp, off, n, flags);
2695                         } else {
2696                                 error = segmap_release(segkmap, base, flags);
2697                         }
2698                 } else {
2699                         if (vpm_enable) {
2700                                 (void) vpm_sync_pages(vp, off, n, 0);
2701                         } else {
2702                                 (void) segmap_release(segkmap, base, 0);
2703                         }
2704                 }
2705         } while (!error && uiop->uio_resid > 0);
2706 
2707         return (error);
2708 }
2709 
2710 /* ARGSUSED */
2711 static int
2712 nfs4_write(vnode_t *vp, struct uio *uiop, int ioflag, cred_t *cr,
2713     caller_context_t *ct)
2714 {
2715         rlim64_t limit = uiop->uio_llimit;
2716         rnode4_t *rp;
2717         u_offset_t off;
2718         caddr_t base;
2719         uint_t flags;
2720         int remainder;
2721         size_t n;
2722         int on;
2723         int error;
2724         int resid;
2725         u_offset_t offset;
2726         mntinfo4_t *mi;
2727         uint_t bsize;
2728 
2729         rp = VTOR4(vp);
2730 
2731         if (IS_SHADOW(vp, rp))
2732                 vp = RTOV4(rp);
2733 
2734         if (vp->v_type != VREG)
2735                 return (EISDIR);
2736 
2737         mi = VTOMI4(vp);
2738 
2739         if (nfs_zone() != mi->mi_zone)
2740                 return (EIO);
2741 
2742         if (uiop->uio_resid == 0)
2743                 return (0);
2744 
2745         mutex_enter(&rp->r_statelock);
2746         if (rp->r_flags & R4RECOVERRP)
2747                 error = (rp->r_error ? rp->r_error : EIO);
2748         else
2749                 error = 0;
2750         mutex_exit(&rp->r_statelock);
2751         if (error)
2752                 return (error);
2753 
2754         if (ioflag & FAPPEND) {
2755                 struct vattr va;
2756 
2757                 /*
2758                  * Must serialize if appending.
2759                  */
2760                 if (nfs_rw_lock_held(&rp->r_rwlock, RW_READER)) {
2761                         nfs_rw_exit(&rp->r_rwlock);
2762                         if (nfs_rw_enter_sig(&rp->r_rwlock, RW_WRITER,
2763                             INTR4(vp)))
2764                                 return (EINTR);
2765                 }
2766 
2767                 va.va_mask = AT_SIZE;
2768                 error = nfs4getattr(vp, &va, cr);
2769                 if (error)
2770                         return (error);
2771                 uiop->uio_loffset = va.va_size;
2772         }
2773 
2774         offset = uiop->uio_loffset + uiop->uio_resid;
2775 
2776         if (uiop->uio_loffset < (offset_t)0 || offset < 0)
2777                 return (EINVAL);
2778 
2779         if (limit == RLIM64_INFINITY || limit > MAXOFFSET_T)
2780                 limit = MAXOFFSET_T;
2781 
2782         /*
2783          * Check to make sure that the process will not exceed
2784          * its limit on file size.  It is okay to write up to
2785          * the limit, but not beyond.  Thus, the write which
2786          * reaches the limit will be short and the next write
2787          * will return an error.
2788          */
2789         remainder = 0;
2790         if (offset > uiop->uio_llimit) {
2791                 remainder = offset - uiop->uio_llimit;
2792                 uiop->uio_resid = uiop->uio_llimit - uiop->uio_loffset;
2793                 if (uiop->uio_resid <= 0) {
2794                         proc_t *p = ttoproc(curthread);
2795 
2796                         uiop->uio_resid += remainder;
2797                         mutex_enter(&p->p_lock);
2798                         (void) rctl_action(rctlproc_legacy[RLIMIT_FSIZE],
2799                             p->p_rctls, p, RCA_UNSAFE_SIGINFO);
2800                         mutex_exit(&p->p_lock);
2801                         return (EFBIG);
2802                 }
2803         }
2804 
2805         /* update the change attribute, if we have a write delegation */
2806 
2807         mutex_enter(&rp->r_statev4_lock);
2808         if (rp->r_deleg_type == OPEN_DELEGATE_WRITE)
2809                 rp->r_deleg_change++;
2810 
2811         mutex_exit(&rp->r_statev4_lock);
2812 
2813         if (nfs_rw_enter_sig(&rp->r_lkserlock, RW_READER, INTR4(vp)))
2814                 return (EINTR);
2815 
2816         /*
2817          * Bypass VM if caching has been disabled (e.g., locking) or if
2818          * using client-side direct I/O and the file is not mmap'd and
2819          * there are no cached pages.
2820          */
2821         if ((vp->v_flag & VNOCACHE) ||
2822             (((rp->r_flags & R4DIRECTIO) || (mi->mi_flags & MI4_DIRECTIO)) &&
2823             rp->r_mapcnt == 0 && rp->r_inmap == 0 && !nfs4_has_pages(vp))) {
2824                 size_t bufsize;
2825                 int count;
2826                 u_offset_t org_offset;
2827                 stable_how4 stab_comm;
2828 nfs4_fwrite:
2829                 if (rp->r_flags & R4STALE) {
2830                         resid = uiop->uio_resid;
2831                         offset = uiop->uio_loffset;
2832                         error = rp->r_error;
2833                         /*
2834                          * A close may have cleared r_error, if so,
2835                          * propagate ESTALE error return properly
2836                          */
2837                         if (error == 0)
2838                                 error = ESTALE;
2839                         goto bottom;
2840                 }
2841 
2842                 bufsize = MIN(uiop->uio_resid, mi->mi_stsize);
2843                 base = kmem_alloc(bufsize, KM_SLEEP);
2844                 do {
2845                         if (ioflag & FDSYNC)
2846                                 stab_comm = DATA_SYNC4;
2847                         else
2848                                 stab_comm = FILE_SYNC4;
2849                         resid = uiop->uio_resid;
2850                         offset = uiop->uio_loffset;
2851                         count = MIN(uiop->uio_resid, bufsize);
2852                         org_offset = uiop->uio_loffset;
2853                         error = uiomove(base, count, UIO_WRITE, uiop);
2854                         if (!error) {
2855                                 error = nfs4write(vp, base, org_offset,
2856                                     count, cr, &stab_comm);
2857                                 if (!error) {
2858                                         mutex_enter(&rp->r_statelock);
2859                                         if (rp->r_size < uiop->uio_loffset)
2860                                                 rp->r_size = uiop->uio_loffset;
2861                                         mutex_exit(&rp->r_statelock);
2862                                 }
2863                         }
2864                 } while (!error && uiop->uio_resid > 0);
2865                 kmem_free(base, bufsize);
2866                 goto bottom;
2867         }
2868 
2869         bsize = vp->v_vfsp->vfs_bsize;
2870 
2871         do {
2872                 off = uiop->uio_loffset & MAXBMASK; /* mapping offset */
2873                 on = uiop->uio_loffset & MAXBOFFSET; /* Relative offset */
2874                 n = MIN(MAXBSIZE - on, uiop->uio_resid);
2875 
2876                 resid = uiop->uio_resid;
2877                 offset = uiop->uio_loffset;
2878 
2879                 if (rp->r_flags & R4STALE) {
2880                         error = rp->r_error;
2881                         /*
2882                          * A close may have cleared r_error, if so,
2883                          * propagate ESTALE error return properly
2884                          */
2885                         if (error == 0)
2886                                 error = ESTALE;
2887                         break;
2888                 }
2889 
2890                 /*
2891                  * Don't create dirty pages faster than they
2892                  * can be cleaned so that the system doesn't
2893                  * get imbalanced.  If the async queue is
2894                  * maxed out, then wait for it to drain before
2895                  * creating more dirty pages.  Also, wait for
2896                  * any threads doing pagewalks in the vop_getattr
2897                  * entry points so that they don't block for
2898                  * long periods.
2899                  */
2900                 mutex_enter(&rp->r_statelock);
2901                 while ((mi->mi_max_threads != 0 &&
2902                     rp->r_awcount > 2 * mi->mi_max_threads) ||
2903                     rp->r_gcount > 0) {
2904                         if (INTR4(vp)) {
2905                                 klwp_t *lwp = ttolwp(curthread);
2906 
2907                                 if (lwp != NULL)
2908                                         lwp->lwp_nostop++;
2909                                 if (!cv_wait_sig(&rp->r_cv, &rp->r_statelock)) {
2910                                         mutex_exit(&rp->r_statelock);
2911                                         if (lwp != NULL)
2912                                                 lwp->lwp_nostop--;
2913                                         error = EINTR;
2914                                         goto bottom;
2915                                 }
2916                                 if (lwp != NULL)
2917                                         lwp->lwp_nostop--;
2918                         } else
2919                                 cv_wait(&rp->r_cv, &rp->r_statelock);
2920                 }
2921                 mutex_exit(&rp->r_statelock);
2922 
2923                 /*
2924                  * Touch the page and fault it in if it is not in core
2925                  * before segmap_getmapflt or vpm_data_copy can lock it.
2926                  * This is to avoid the deadlock if the buffer is mapped
2927                  * to the same file through mmap which we want to write.
2928                  */
2929                 uio_prefaultpages((long)n, uiop);
2930 
2931                 if (vpm_enable) {
2932                         /*
2933                          * It will use kpm mappings, so no need to
2934                          * pass an address.
2935                          */
2936                         error = writerp4(rp, NULL, n, uiop, 0);
2937                 } else  {
2938                         if (segmap_kpm) {
2939                                 int pon = uiop->uio_loffset & PAGEOFFSET;
2940                                 size_t pn = MIN(PAGESIZE - pon,
2941                                     uiop->uio_resid);
2942                                 int pagecreate;
2943 
2944                                 mutex_enter(&rp->r_statelock);
2945                                 pagecreate = (pon == 0) && (pn == PAGESIZE ||
2946                                     uiop->uio_loffset + pn >= rp->r_size);
2947                                 mutex_exit(&rp->r_statelock);
2948 
2949                                 base = segmap_getmapflt(segkmap, vp, off + on,
2950                                     pn, !pagecreate, S_WRITE);
2951 
2952                                 error = writerp4(rp, base + pon, n, uiop,
2953                                     pagecreate);
2954 
2955                         } else {
2956                                 base = segmap_getmapflt(segkmap, vp, off + on,
2957                                     n, 0, S_READ);
2958                                 error = writerp4(rp, base + on, n, uiop, 0);
2959                         }
2960                 }
2961 
2962                 if (!error) {
2963                         if (mi->mi_flags & MI4_NOAC)
2964                                 flags = SM_WRITE;
2965                         else if ((uiop->uio_loffset % bsize) == 0 ||
2966                             IS_SWAPVP(vp)) {
2967                                 /*
2968                                  * Have written a whole block.
2969                                  * Start an asynchronous write
2970                                  * and mark the buffer to
2971                                  * indicate that it won't be
2972                                  * needed again soon.
2973                                  */
2974                                 flags = SM_WRITE | SM_ASYNC | SM_DONTNEED;
2975                         } else
2976                                 flags = 0;
2977                         if ((ioflag & (FSYNC|FDSYNC)) ||
2978                             (rp->r_flags & R4OUTOFSPACE)) {
2979                                 flags &= ~SM_ASYNC;
2980                                 flags |= SM_WRITE;
2981                         }
2982                         if (vpm_enable) {
2983                                 error = vpm_sync_pages(vp, off, n, flags);
2984                         } else {
2985                                 error = segmap_release(segkmap, base, flags);
2986                         }
2987                 } else {
2988                         if (vpm_enable) {
2989                                 (void) vpm_sync_pages(vp, off, n, 0);
2990                         } else {
2991                                 (void) segmap_release(segkmap, base, 0);
2992                         }
2993                         /*
2994                          * In the event that we got an access error while
2995                          * faulting in a page for a write-only file just
2996                          * force a write.
2997                          */
2998                         if (error == EACCES)
2999                                 goto nfs4_fwrite;
3000                 }
3001         } while (!error && uiop->uio_resid > 0);
3002 
3003 bottom:
3004         if (error) {
3005                 uiop->uio_resid = resid + remainder;
3006                 uiop->uio_loffset = offset;
3007         } else {
3008                 uiop->uio_resid += remainder;
3009 
3010                 mutex_enter(&rp->r_statev4_lock);
3011                 if (rp->r_deleg_type == OPEN_DELEGATE_WRITE) {
3012                         gethrestime(&rp->r_attr.va_mtime);
3013                         rp->r_attr.va_ctime = rp->r_attr.va_mtime;
3014                 }
3015                 mutex_exit(&rp->r_statev4_lock);
3016         }
3017 
3018         nfs_rw_exit(&rp->r_lkserlock);
3019 
3020         return (error);
3021 }
3022 
3023 /*
3024  * Flags are composed of {B_ASYNC, B_INVAL, B_FREE, B_DONTNEED}
3025  */
3026 static int
3027 nfs4_rdwrlbn(vnode_t *vp, page_t *pp, u_offset_t off, size_t len,
3028     int flags, cred_t *cr)
3029 {
3030         struct buf *bp;
3031         int error;
3032         page_t *savepp;
3033         uchar_t fsdata;
3034         stable_how4 stab_comm;
3035 
3036         ASSERT(nfs_zone() == VTOMI4(vp)->mi_zone);
3037         bp = pageio_setup(pp, len, vp, flags);
3038         ASSERT(bp != NULL);
3039 
3040         /*
3041          * pageio_setup should have set b_addr to 0.  This
3042          * is correct since we want to do I/O on a page
3043          * boundary.  bp_mapin will use this addr to calculate
3044          * an offset, and then set b_addr to the kernel virtual
3045          * address it allocated for us.
3046          */
3047         ASSERT(bp->b_un.b_addr == 0);
3048 
3049         bp->b_edev = 0;
3050         bp->b_dev = 0;
3051         bp->b_lblkno = lbtodb(off);
3052         bp->b_file = vp;
3053         bp->b_offset = (offset_t)off;
3054         bp_mapin(bp);
3055 
3056         if ((flags & (B_WRITE|B_ASYNC)) == (B_WRITE|B_ASYNC) &&
3057             freemem > desfree)
3058                 stab_comm = UNSTABLE4;
3059         else
3060                 stab_comm = FILE_SYNC4;
3061 
3062         error = nfs4_bio(bp, &stab_comm, cr, FALSE);
3063 
3064         bp_mapout(bp);
3065         pageio_done(bp);
3066 
3067         if (stab_comm == UNSTABLE4)
3068                 fsdata = C_DELAYCOMMIT;
3069         else
3070                 fsdata = C_NOCOMMIT;
3071 
3072         savepp = pp;
3073         do {
3074                 pp->p_fsdata = fsdata;
3075         } while ((pp = pp->p_next) != savepp);
3076 
3077         return (error);
3078 }
3079 
3080 /*
3081  */
3082 static int
3083 nfs4rdwr_check_osid(vnode_t *vp, nfs4_error_t *ep, cred_t *cr)
3084 {
3085         nfs4_open_owner_t       *oop;
3086         nfs4_open_stream_t      *osp;
3087         rnode4_t                *rp = VTOR4(vp);
3088         mntinfo4_t              *mi = VTOMI4(vp);
3089         int                     reopen_needed;
3090 
3091         ASSERT(nfs_zone() == mi->mi_zone);
3092 
3093 
3094         oop = find_open_owner(cr, NFS4_PERM_CREATED, mi);
3095         if (!oop)
3096                 return (EIO);
3097 
3098         /* returns with 'os_sync_lock' held */
3099         osp = find_open_stream(oop, rp);
3100         if (!osp) {
3101                 open_owner_rele(oop);
3102                 return (EIO);
3103         }
3104 
3105         if (osp->os_failed_reopen) {
3106                 mutex_exit(&osp->os_sync_lock);
3107                 open_stream_rele(osp, rp);
3108                 open_owner_rele(oop);
3109                 return (EIO);
3110         }
3111 
3112         /*
3113          * Determine whether a reopen is needed.  If this
3114          * is a delegation open stream, then the os_delegation bit
3115          * should be set.
3116          */
3117 
3118         reopen_needed = osp->os_delegation;
3119 
3120         mutex_exit(&osp->os_sync_lock);
3121         open_owner_rele(oop);
3122 
3123         if (reopen_needed) {
3124                 nfs4_error_zinit(ep);
3125                 nfs4_reopen(vp, osp, ep, CLAIM_NULL, FALSE, FALSE);
3126                 mutex_enter(&osp->os_sync_lock);
3127                 if (ep->error || ep->stat || osp->os_failed_reopen) {
3128                         mutex_exit(&osp->os_sync_lock);
3129                         open_stream_rele(osp, rp);
3130                         return (EIO);
3131                 }
3132                 mutex_exit(&osp->os_sync_lock);
3133         }
3134         open_stream_rele(osp, rp);
3135 
3136         return (0);
3137 }
3138 
3139 /*
3140  * Write to file.  Writes to remote server in largest size
3141  * chunks that the server can handle.  Write is synchronous.
3142  */
3143 static int
3144 nfs4write(vnode_t *vp, caddr_t base, u_offset_t offset, int count, cred_t *cr,
3145     stable_how4 *stab_comm)
3146 {
3147         mntinfo4_t *mi;
3148         COMPOUND4args_clnt args;
3149         COMPOUND4res_clnt res;
3150         WRITE4args *wargs;
3151         WRITE4res *wres;
3152         nfs_argop4 argop[2];
3153         nfs_resop4 *resop;
3154         int tsize;
3155         stable_how4 stable;
3156         rnode4_t *rp;
3157         int doqueue = 1;
3158         bool_t needrecov;
3159         nfs4_recov_state_t recov_state;
3160         nfs4_stateid_types_t sid_types;
3161         nfs4_error_t e = { 0, NFS4_OK, RPC_SUCCESS };
3162         int recov;
3163 
3164         rp = VTOR4(vp);
3165         mi = VTOMI4(vp);
3166 
3167         ASSERT(nfs_zone() == mi->mi_zone);
3168 
3169         stable = *stab_comm;
3170         *stab_comm = FILE_SYNC4;
3171 
3172         needrecov = FALSE;
3173         recov_state.rs_flags = 0;
3174         recov_state.rs_num_retry_despite_err = 0;
3175         nfs4_init_stateid_types(&sid_types);
3176 
3177         /* Is curthread the recovery thread? */
3178         mutex_enter(&mi->mi_lock);
3179         recov = (mi->mi_recovthread == curthread);
3180         mutex_exit(&mi->mi_lock);
3181 
3182 recov_retry:
3183         args.ctag = TAG_WRITE;
3184         args.array_len = 2;
3185         args.array = argop;
3186 
3187         if (!recov) {
3188                 e.error = nfs4_start_fop(VTOMI4(vp), vp, NULL, OH_WRITE,
3189                     &recov_state, NULL);
3190                 if (e.error)
3191                         return (e.error);
3192         }
3193 
3194         /* 0. putfh target fh */
3195         argop[0].argop = OP_CPUTFH;
3196         argop[0].nfs_argop4_u.opcputfh.sfh = rp->r_fh;
3197 
3198         /* 1. write */
3199         nfs4args_write(&argop[1], stable, rp, cr, &wargs, &sid_types);
3200 
3201         do {
3202 
3203                 wargs->offset = (offset4)offset;
3204                 wargs->data_val = base;
3205 
3206                 if (mi->mi_io_kstats) {
3207                         mutex_enter(&mi->mi_lock);
3208                         kstat_runq_enter(KSTAT_IO_PTR(mi->mi_io_kstats));
3209                         mutex_exit(&mi->mi_lock);
3210                 }
3211 
3212                 if ((vp->v_flag & VNOCACHE) ||
3213                     (rp->r_flags & R4DIRECTIO) ||
3214                     (mi->mi_flags & MI4_DIRECTIO))
3215                         tsize = MIN(mi->mi_stsize, count);
3216                 else
3217                         tsize = MIN(mi->mi_curwrite, count);
3218                 wargs->data_len = (uint_t)tsize;
3219                 rfs4call(mi, &args, &res, cr, &doqueue, 0, &e);
3220 
3221                 if (mi->mi_io_kstats) {
3222                         mutex_enter(&mi->mi_lock);
3223                         kstat_runq_exit(KSTAT_IO_PTR(mi->mi_io_kstats));
3224                         mutex_exit(&mi->mi_lock);
3225                 }
3226 
3227                 if (!recov) {
3228                         needrecov = nfs4_needs_recovery(&e, FALSE, mi->mi_vfsp);
3229                         if (e.error && !needrecov) {
3230                                 nfs4_end_fop(VTOMI4(vp), vp, NULL, OH_WRITE,
3231                                     &recov_state, needrecov);
3232                                 return (e.error);
3233                         }
3234                 } else {
3235                         if (e.error)
3236                                 return (e.error);
3237                 }
3238 
3239                 /*
3240                  * Do handling of OLD_STATEID outside
3241                  * of the normal recovery framework.
3242                  *
3243                  * If write receives a BAD stateid error while using a
3244                  * delegation stateid, retry using the open stateid (if it
3245                  * exists).  If it doesn't have an open stateid, reopen the
3246                  * file first, then retry.
3247                  */
3248                 if (!e.error && res.status == NFS4ERR_OLD_STATEID &&
3249                     sid_types.cur_sid_type != SPEC_SID) {
3250                         nfs4_save_stateid(&wargs->stateid, &sid_types);
3251                         if (!recov)
3252                                 nfs4_end_fop(VTOMI4(vp), vp, NULL, OH_WRITE,
3253                                     &recov_state, needrecov);
3254                         (void) xdr_free(xdr_COMPOUND4res_clnt, (caddr_t)&res);
3255                         goto recov_retry;
3256                 } else if (e.error == 0 && res.status == NFS4ERR_BAD_STATEID &&
3257                     sid_types.cur_sid_type == DEL_SID) {
3258                         nfs4_save_stateid(&wargs->stateid, &sid_types);
3259                         mutex_enter(&rp->r_statev4_lock);
3260                         rp->r_deleg_return_pending = TRUE;
3261                         mutex_exit(&rp->r_statev4_lock);
3262                         if (nfs4rdwr_check_osid(vp, &e, cr)) {
3263                                 if (!recov)
3264                                         nfs4_end_fop(mi, vp, NULL, OH_WRITE,
3265                                             &recov_state, needrecov);
3266                                 (void) xdr_free(xdr_COMPOUND4res_clnt,
3267                                     (caddr_t)&res);
3268                                 return (EIO);
3269                         }
3270                         if (!recov)
3271                                 nfs4_end_fop(mi, vp, NULL, OH_WRITE,
3272                                     &recov_state, needrecov);
3273                         /* hold needed for nfs4delegreturn_thread */
3274                         VN_HOLD(vp);
3275                         nfs4delegreturn_async(rp, (NFS4_DR_PUSH|NFS4_DR_REOPEN|
3276                             NFS4_DR_DISCARD), FALSE);
3277                         (void) xdr_free(xdr_COMPOUND4res_clnt, (caddr_t)&res);
3278                         goto recov_retry;
3279                 }
3280 
3281                 if (needrecov) {
3282                         bool_t abort;
3283 
3284                         NFS4_DEBUG(nfs4_client_recov_debug, (CE_NOTE,
3285                             "nfs4write: client got error %d, res.status %d"
3286                             ", so start recovery", e.error, res.status));
3287 
3288                         abort = nfs4_start_recovery(&e,
3289                             VTOMI4(vp), vp, NULL, &wargs->stateid,
3290                             NULL, OP_WRITE, NULL, NULL, NULL);
3291                         if (!e.error) {
3292                                 e.error = geterrno4(res.status);
3293                                 (void) xdr_free(xdr_COMPOUND4res_clnt,
3294                                     (caddr_t)&res);
3295                         }
3296                         nfs4_end_fop(VTOMI4(vp), vp, NULL, OH_WRITE,
3297                             &recov_state, needrecov);
3298                         if (abort == FALSE)
3299                                 goto recov_retry;
3300                         return (e.error);
3301                 }
3302 
3303                 if (res.status) {
3304                         e.error = geterrno4(res.status);
3305                         (void) xdr_free(xdr_COMPOUND4res_clnt, (caddr_t)&res);
3306                         if (!recov)
3307                                 nfs4_end_fop(VTOMI4(vp), vp, NULL, OH_WRITE,
3308                                     &recov_state, needrecov);
3309                         return (e.error);
3310                 }
3311 
3312                 resop = &res.array[1];      /* write res */
3313                 wres = &resop->nfs_resop4_u.opwrite;
3314 
3315                 if ((int)wres->count > tsize) {
3316                         (void) xdr_free(xdr_COMPOUND4res_clnt, (caddr_t)&res);
3317 
3318                         zcmn_err(getzoneid(), CE_WARN,
3319                             "nfs4write: server wrote %u, requested was %u",
3320                             (int)wres->count, tsize);
3321                         if (!recov)
3322                                 nfs4_end_fop(VTOMI4(vp), vp, NULL, OH_WRITE,
3323                                     &recov_state, needrecov);
3324                         return (EIO);
3325                 }
3326                 if (wres->committed == UNSTABLE4) {
3327                         *stab_comm = UNSTABLE4;
3328                         if (wargs->stable == DATA_SYNC4 ||
3329                             wargs->stable == FILE_SYNC4) {
3330                                 (void) xdr_free(xdr_COMPOUND4res_clnt,
3331                                     (caddr_t)&res);
3332                                 zcmn_err(getzoneid(), CE_WARN,
3333                                     "nfs4write: server %s did not commit "
3334                                     "to stable storage",
3335                                     rp->r_server->sv_hostname);
3336                                 if (!recov)
3337                                         nfs4_end_fop(VTOMI4(vp), vp, NULL,
3338                                             OH_WRITE, &recov_state, needrecov);
3339                                 return (EIO);
3340                         }
3341                 }
3342 
3343                 tsize = (int)wres->count;
3344                 count -= tsize;
3345                 base += tsize;
3346                 offset += tsize;
3347                 if (mi->mi_io_kstats) {
3348                         mutex_enter(&mi->mi_lock);
3349                         KSTAT_IO_PTR(mi->mi_io_kstats)->writes++;
3350                         KSTAT_IO_PTR(mi->mi_io_kstats)->nwritten +=
3351                             tsize;
3352                         mutex_exit(&mi->mi_lock);
3353                 }
3354                 lwp_stat_update(LWP_STAT_OUBLK, 1);
3355                 mutex_enter(&rp->r_statelock);
3356                 if (rp->r_flags & R4HAVEVERF) {
3357                         if (rp->r_writeverf != wres->writeverf) {
3358                                 nfs4_set_mod(vp);
3359                                 rp->r_writeverf = wres->writeverf;
3360                         }
3361                 } else {
3362                         rp->r_writeverf = wres->writeverf;
3363                         rp->r_flags |= R4HAVEVERF;
3364                 }
3365                 PURGE_ATTRCACHE4_LOCKED(rp);
3366                 rp->r_flags |= R4WRITEMODIFIED;
3367                 gethrestime(&rp->r_attr.va_mtime);
3368                 rp->r_attr.va_ctime = rp->r_attr.va_mtime;
3369                 mutex_exit(&rp->r_statelock);
3370                 (void) xdr_free(xdr_COMPOUND4res_clnt, (caddr_t)&res);
3371         } while (count);
3372 
3373         if (!recov)
3374                 nfs4_end_fop(VTOMI4(vp), vp, NULL, OH_WRITE, &recov_state,
3375                     needrecov);
3376 
3377         return (e.error);
3378 }
3379 
3380 /*
3381  * Read from a file.  Reads data in largest chunks our interface can handle.
3382  */
3383 static int
3384 nfs4read(vnode_t *vp, caddr_t base, offset_t offset, int count,
3385     size_t *residp, cred_t *cr, bool_t async, struct uio *uiop)
3386 {
3387         mntinfo4_t *mi;
3388         COMPOUND4args_clnt args;
3389         COMPOUND4res_clnt res;
3390         READ4args *rargs;
3391         nfs_argop4 argop[2];
3392         int tsize;
3393         int doqueue;
3394         rnode4_t *rp;
3395         int data_len;
3396         bool_t is_eof;
3397         bool_t needrecov = FALSE;
3398         nfs4_recov_state_t recov_state;
3399         nfs4_stateid_types_t sid_types;
3400         nfs4_error_t e = { 0, NFS4_OK, RPC_SUCCESS };
3401 
3402         rp = VTOR4(vp);
3403         mi = VTOMI4(vp);
3404         doqueue = 1;
3405 
3406         ASSERT(nfs_zone() == mi->mi_zone);
3407 
3408         args.ctag = async ? TAG_READAHEAD : TAG_READ;
3409 
3410         args.array_len = 2;
3411         args.array = argop;
3412 
3413         nfs4_init_stateid_types(&sid_types);
3414 
3415         recov_state.rs_flags = 0;
3416         recov_state.rs_num_retry_despite_err = 0;
3417 
3418 recov_retry:
3419         e.error = nfs4_start_fop(mi, vp, NULL, OH_READ,
3420             &recov_state, NULL);
3421         if (e.error)
3422                 return (e.error);
3423 
3424         /* putfh target fh */
3425         argop[0].argop = OP_CPUTFH;
3426         argop[0].nfs_argop4_u.opcputfh.sfh = rp->r_fh;
3427 
3428         /* read */
3429         argop[1].argop = OP_READ;
3430         rargs = &argop[1].nfs_argop4_u.opread;
3431         rargs->stateid = nfs4_get_stateid(cr, rp, curproc->p_pidp->pid_id, mi,
3432             OP_READ, &sid_types, async);
3433 
3434         do {
3435                 if (mi->mi_io_kstats) {
3436                         mutex_enter(&mi->mi_lock);
3437                         kstat_runq_enter(KSTAT_IO_PTR(mi->mi_io_kstats));
3438                         mutex_exit(&mi->mi_lock);
3439                 }
3440 
3441                 NFS4_DEBUG(nfs4_client_call_debug, (CE_NOTE,
3442                     "nfs4read: %s call, rp %s",
3443                     needrecov ? "recov" : "first",
3444                     rnode4info(rp)));
3445 
3446                 if ((vp->v_flag & VNOCACHE) ||
3447                     (rp->r_flags & R4DIRECTIO) ||
3448                     (mi->mi_flags & MI4_DIRECTIO))
3449                         tsize = MIN(mi->mi_tsize, count);
3450                 else
3451                         tsize = MIN(mi->mi_curread, count);
3452 
3453                 rargs->offset = (offset4)offset;
3454                 rargs->count = (count4)tsize;
3455                 rargs->res_data_val_alt = NULL;
3456                 rargs->res_mblk = NULL;
3457                 rargs->res_uiop = NULL;
3458                 rargs->res_maxsize = 0;
3459                 rargs->wlist = NULL;
3460 
3461                 if (uiop)
3462                         rargs->res_uiop = uiop;
3463                 else
3464                         rargs->res_data_val_alt = base;
3465                 rargs->res_maxsize = tsize;
3466 
3467                 rfs4call(mi, &args, &res, cr, &doqueue, 0, &e);
3468 #ifdef  DEBUG
3469                 if (nfs4read_error_inject) {
3470                         res.status = nfs4read_error_inject;
3471                         nfs4read_error_inject = 0;
3472                 }
3473 #endif
3474 
3475                 if (mi->mi_io_kstats) {
3476                         mutex_enter(&mi->mi_lock);
3477                         kstat_runq_exit(KSTAT_IO_PTR(mi->mi_io_kstats));
3478                         mutex_exit(&mi->mi_lock);
3479                 }
3480 
3481                 needrecov = nfs4_needs_recovery(&e, FALSE, mi->mi_vfsp);
3482                 if (e.error != 0 && !needrecov) {
3483                         nfs4_end_fop(mi, vp, NULL, OH_READ,
3484                             &recov_state, needrecov);
3485                         return (e.error);
3486                 }
3487 
3488                 /*
3489                  * Do proper retry for OLD and BAD stateid errors outside
3490                  * of the normal recovery framework.  There are two differences
3491                  * between async and sync reads.  The first is that we allow
3492                  * retry on BAD_STATEID for async reads, but not sync reads.
3493                  * The second is that we mark the file dead for a failed
3494                  * attempt with a special stateid for sync reads, but just
3495                  * return EIO for async reads.
3496                  *
3497                  * If a sync read receives a BAD stateid error while using a
3498                  * delegation stateid, retry using the open stateid (if it
3499                  * exists).  If it doesn't have an open stateid, reopen the
3500                  * file first, then retry.
3501                  */
3502                 if (e.error == 0 && (res.status == NFS4ERR_OLD_STATEID ||
3503                     res.status == NFS4ERR_BAD_STATEID) && async) {
3504                         nfs4_end_fop(mi, vp, NULL, OH_READ,
3505                             &recov_state, needrecov);
3506                         if (sid_types.cur_sid_type == SPEC_SID) {
3507                                 (void) xdr_free(xdr_COMPOUND4res_clnt,
3508                                     (caddr_t)&res);
3509                                 return (EIO);
3510                         }
3511                         nfs4_save_stateid(&rargs->stateid, &sid_types);
3512                         (void) xdr_free(xdr_COMPOUND4res_clnt, (caddr_t)&res);
3513                         goto recov_retry;
3514                 } else if (e.error == 0 && res.status == NFS4ERR_OLD_STATEID &&
3515                     !async && sid_types.cur_sid_type != SPEC_SID) {
3516                         nfs4_save_stateid(&rargs->stateid, &sid_types);
3517                         nfs4_end_fop(mi, vp, NULL, OH_READ,
3518                             &recov_state, needrecov);
3519                         (void) xdr_free(xdr_COMPOUND4res_clnt, (caddr_t)&res);
3520                         goto recov_retry;
3521                 } else if (e.error == 0 && res.status == NFS4ERR_BAD_STATEID &&
3522                     sid_types.cur_sid_type == DEL_SID) {
3523                         nfs4_save_stateid(&rargs->stateid, &sid_types);
3524                         mutex_enter(&rp->r_statev4_lock);
3525                         rp->r_deleg_return_pending = TRUE;
3526                         mutex_exit(&rp->r_statev4_lock);
3527                         if (nfs4rdwr_check_osid(vp, &e, cr)) {
3528                                 nfs4_end_fop(mi, vp, NULL, OH_READ,
3529                                     &recov_state, needrecov);
3530                                 (void) xdr_free(xdr_COMPOUND4res_clnt,
3531                                     (caddr_t)&res);
3532                                 return (EIO);
3533                         }
3534                         nfs4_end_fop(mi, vp, NULL, OH_READ,
3535                             &recov_state, needrecov);
3536                         /* hold needed for nfs4delegreturn_thread */
3537                         VN_HOLD(vp);
3538                         nfs4delegreturn_async(rp, (NFS4_DR_PUSH|NFS4_DR_REOPEN|
3539                             NFS4_DR_DISCARD), FALSE);
3540                         (void) xdr_free(xdr_COMPOUND4res_clnt, (caddr_t)&res);
3541                         goto recov_retry;
3542                 }
3543                 if (needrecov) {
3544                         bool_t abort;
3545 
3546                         NFS4_DEBUG(nfs4_client_recov_debug, (CE_NOTE,
3547                             "nfs4read: initiating recovery\n"));
3548                         abort = nfs4_start_recovery(&e,
3549                             mi, vp, NULL, &rargs->stateid,
3550                             NULL, OP_READ, NULL, NULL, NULL);
3551                         nfs4_end_fop(mi, vp, NULL, OH_READ,
3552                             &recov_state, needrecov);
3553                         /*
3554                          * Do not retry if we got OLD_STATEID using a special
3555                          * stateid.  This avoids looping with a broken server.
3556                          */
3557                         if (e.error == 0 && res.status == NFS4ERR_OLD_STATEID &&
3558                             sid_types.cur_sid_type == SPEC_SID)
3559                                 abort = TRUE;
3560 
3561                         if (abort == FALSE) {
3562                                 /*
3563                                  * Need to retry all possible stateids in
3564                                  * case the recovery error wasn't stateid
3565                                  * related or the stateids have become
3566                                  * stale (server reboot).
3567                                  */
3568                                 nfs4_init_stateid_types(&sid_types);
3569                                 (void) xdr_free(xdr_COMPOUND4res_clnt,
3570                                     (caddr_t)&res);
3571                                 goto recov_retry;
3572                         }
3573 
3574                         if (!e.error) {
3575                                 e.error = geterrno4(res.status);
3576                                 (void) xdr_free(xdr_COMPOUND4res_clnt,
3577                                     (caddr_t)&res);
3578                         }
3579                         return (e.error);
3580                 }
3581 
3582                 if (res.status) {
3583                         e.error = geterrno4(res.status);
3584                         nfs4_end_fop(mi, vp, NULL, OH_READ,
3585                             &recov_state, needrecov);
3586                         (void) xdr_free(xdr_COMPOUND4res_clnt, (caddr_t)&res);
3587                         return (e.error);
3588                 }
3589 
3590                 data_len = res.array[1].nfs_resop4_u.opread.data_len;
3591                 count -= data_len;
3592                 if (base)
3593                         base += data_len;
3594                 offset += data_len;
3595                 if (mi->mi_io_kstats) {
3596                         mutex_enter(&mi->mi_lock);
3597                         KSTAT_IO_PTR(mi->mi_io_kstats)->reads++;
3598                         KSTAT_IO_PTR(mi->mi_io_kstats)->nread += data_len;
3599                         mutex_exit(&mi->mi_lock);
3600                 }
3601                 lwp_stat_update(LWP_STAT_INBLK, 1);
3602                 is_eof = res.array[1].nfs_resop4_u.opread.eof;
3603                 (void) xdr_free(xdr_COMPOUND4res_clnt, (caddr_t)&res);
3604 
3605         } while (count && !is_eof);
3606 
3607         *residp = count;
3608 
3609         nfs4_end_fop(mi, vp, NULL, OH_READ, &recov_state, needrecov);
3610 
3611         return (e.error);
3612 }
3613 
3614 /* ARGSUSED */
3615 static int
3616 nfs4_ioctl(vnode_t *vp, int cmd, intptr_t arg, int flag, cred_t *cr, int *rvalp,
3617         caller_context_t *ct)
3618 {
3619         if (nfs_zone() != VTOMI4(vp)->mi_zone)
3620                 return (EIO);
3621         switch (cmd) {
3622                 case _FIODIRECTIO:
3623                         return (nfs4_directio(vp, (int)arg, cr));
3624                 default:
3625                         return (ENOTTY);
3626         }
3627 }
3628 
3629 /* ARGSUSED */
3630 int
3631 nfs4_getattr(vnode_t *vp, struct vattr *vap, int flags, cred_t *cr,
3632     caller_context_t *ct)
3633 {
3634         int error;
3635         rnode4_t *rp = VTOR4(vp);
3636 
3637         if (nfs_zone() != VTOMI4(vp)->mi_zone)
3638                 return (EIO);
3639         /*
3640          * If it has been specified that the return value will
3641          * just be used as a hint, and we are only being asked
3642          * for size, fsid or rdevid, then return the client's
3643          * notion of these values without checking to make sure
3644          * that the attribute cache is up to date.
3645          * The whole point is to avoid an over the wire GETATTR
3646          * call.
3647          */
3648         if (flags & ATTR_HINT) {
3649                 if (!(vap->va_mask & ~(AT_SIZE | AT_FSID | AT_RDEV))) {
3650                         mutex_enter(&rp->r_statelock);
3651                         if (vap->va_mask & AT_SIZE)
3652                                 vap->va_size = rp->r_size;
3653                         if (vap->va_mask & AT_FSID)
3654                                 vap->va_fsid = rp->r_attr.va_fsid;
3655                         if (vap->va_mask & AT_RDEV)
3656                                 vap->va_rdev = rp->r_attr.va_rdev;
3657                         mutex_exit(&rp->r_statelock);
3658                         return (0);
3659                 }
3660         }
3661 
3662         /*
3663          * Only need to flush pages if asking for the mtime
3664          * and if there any dirty pages or any outstanding
3665          * asynchronous (write) requests for this file.
3666          */
3667         if (vap->va_mask & AT_MTIME) {
3668                 rp = VTOR4(vp);
3669                 if (nfs4_has_pages(vp)) {
3670                         mutex_enter(&rp->r_statev4_lock);
3671                         if (rp->r_deleg_type != OPEN_DELEGATE_WRITE) {
3672                                 mutex_exit(&rp->r_statev4_lock);
3673                                 if (rp->r_flags & R4DIRTY ||
3674                                     rp->r_awcount > 0) {
3675                                         mutex_enter(&rp->r_statelock);
3676                                         rp->r_gcount++;
3677                                         mutex_exit(&rp->r_statelock);
3678                                         error =
3679                                             nfs4_putpage(vp, (u_offset_t)0,
3680                                             0, 0, cr, NULL);
3681                                         mutex_enter(&rp->r_statelock);
3682                                         if (error && (error == ENOSPC ||
3683                                             error == EDQUOT)) {
3684                                                 if (!rp->r_error)
3685                                                         rp->r_error = error;
3686                                         }
3687                                         if (--rp->r_gcount == 0)
3688                                                 cv_broadcast(&rp->r_cv);
3689                                         mutex_exit(&rp->r_statelock);
3690                                 }
3691                         } else {
3692                                 mutex_exit(&rp->r_statev4_lock);
3693                         }
3694                 }
3695         }
3696         return (nfs4getattr(vp, vap, cr));
3697 }
3698 
3699 int
3700 nfs4_compare_modes(mode_t from_server, mode_t on_client)
3701 {
3702         /*
3703          * If these are the only two bits cleared
3704          * on the server then return 0 (OK) else
3705          * return 1 (BAD).
3706          */
3707         on_client &= ~(S_ISUID|S_ISGID);
3708         if (on_client == from_server)
3709                 return (0);
3710         else
3711                 return (1);
3712 }
3713 
3714 /*ARGSUSED4*/
3715 static int
3716 nfs4_setattr(vnode_t *vp, struct vattr *vap, int flags, cred_t *cr,
3717     caller_context_t *ct)
3718 {
3719         int error;
3720 
3721         if (vap->va_mask & AT_NOSET)
3722                 return (EINVAL);
3723 
3724         if (nfs_zone() != VTOMI4(vp)->mi_zone)
3725                 return (EIO);
3726 
3727         /*
3728          * Don't call secpolicy_vnode_setattr, the client cannot
3729          * use its cached attributes to make security decisions
3730          * as the server may be faking mode bits or mapping uid/gid.
3731          * Always just let the server to the checking.
3732          * If we provide the ability to remove basic priviledges
3733          * to setattr (e.g. basic without chmod) then we will
3734          * need to add a check here before calling the server.
3735          */
3736         error = nfs4setattr(vp, vap, flags, cr, NULL);
3737 
3738         if (error == 0 && (vap->va_mask & AT_SIZE) && vap->va_size == 0)
3739                 vnevent_truncate(vp, ct);
3740 
3741         return (error);
3742 }
3743 
3744 /*
3745  * To replace the "guarded" version 3 setattr, we use two types of compound
3746  * setattr requests:
3747  * 1. The "normal" setattr, used when the size of the file isn't being
3748  *    changed - { Putfh <fh>; Setattr; Getattr }/
3749  * 2. If the size is changed, precede Setattr with: Getattr; Verify
3750  *    with only ctime as the argument. If the server ctime differs from
3751  *    what is cached on the client, the verify will fail, but we would
3752  *    already have the ctime from the preceding getattr, so just set it
3753  *    and retry. Thus the compound here is - { Putfh <fh>; Getattr; Verify;
3754  *      Setattr; Getattr }.
3755  *
3756  * The vsecattr_t * input parameter will be non-NULL if ACLs are being set in
3757  * this setattr and NULL if they are not.
3758  */
3759 static int
3760 nfs4setattr(vnode_t *vp, struct vattr *vap, int flags, cred_t *cr,
3761     vsecattr_t *vsap)
3762 {
3763         COMPOUND4args_clnt args;
3764         COMPOUND4res_clnt res, *resp = NULL;
3765         nfs4_ga_res_t *garp = NULL;
3766         int numops = 3;                 /* { Putfh; Setattr; Getattr } */
3767         nfs_argop4 argop[5];
3768         int verify_argop = -1;
3769         int setattr_argop = 1;
3770         nfs_resop4 *resop;
3771         vattr_t va;
3772         rnode4_t *rp;
3773         int doqueue = 1;
3774         uint_t mask = vap->va_mask;
3775         mode_t omode;
3776         vsecattr_t *vsp;
3777         timestruc_t ctime;
3778         bool_t needrecov = FALSE;
3779         nfs4_recov_state_t recov_state;
3780         nfs4_stateid_types_t sid_types;
3781         stateid4 stateid;
3782         hrtime_t t;
3783         nfs4_error_t e = { 0, NFS4_OK, RPC_SUCCESS };
3784         servinfo4_t *svp;
3785         bitmap4 supp_attrs;
3786 
3787         ASSERT(nfs_zone() == VTOMI4(vp)->mi_zone);
3788         rp = VTOR4(vp);
3789         nfs4_init_stateid_types(&sid_types);
3790 
3791         /*
3792          * Only need to flush pages if there are any pages and
3793          * if the file is marked as dirty in some fashion.  The
3794          * file must be flushed so that we can accurately
3795          * determine the size of the file and the cached data
3796          * after the SETATTR returns.  A file is considered to
3797          * be dirty if it is either marked with R4DIRTY, has
3798          * outstanding i/o's active, or is mmap'd.  In this
3799          * last case, we can't tell whether there are dirty
3800          * pages, so we flush just to be sure.
3801          */
3802         if (nfs4_has_pages(vp) &&
3803             ((rp->r_flags & R4DIRTY) ||
3804             rp->r_count > 0 ||
3805             rp->r_mapcnt > 0)) {
3806                 ASSERT(vp->v_type != VCHR);
3807                 e.error = nfs4_putpage(vp, (offset_t)0, 0, 0, cr, NULL);
3808                 if (e.error && (e.error == ENOSPC || e.error == EDQUOT)) {
3809                         mutex_enter(&rp->r_statelock);
3810                         if (!rp->r_error)
3811                                 rp->r_error = e.error;
3812                         mutex_exit(&rp->r_statelock);
3813                 }
3814         }
3815 
3816         if (mask & AT_SIZE) {
3817                 /*
3818                  * Verification setattr compound for non-deleg AT_SIZE:
3819                  *      { Putfh; Getattr; Verify; Setattr; Getattr }
3820                  * Set ctime local here (outside the do_again label)
3821                  * so that subsequent retries (after failed VERIFY)
3822                  * will use ctime from GETATTR results (from failed
3823                  * verify compound) as VERIFY arg.
3824                  * If file has delegation, then VERIFY(time_metadata)
3825                  * is of little added value, so don't bother.
3826                  */
3827                 mutex_enter(&rp->r_statev4_lock);
3828                 if (rp->r_deleg_type == OPEN_DELEGATE_NONE ||
3829                     rp->r_deleg_return_pending) {
3830                         numops = 5;
3831                         ctime = rp->r_attr.va_ctime;
3832                 }
3833                 mutex_exit(&rp->r_statev4_lock);
3834         }
3835 
3836         recov_state.rs_flags = 0;
3837         recov_state.rs_num_retry_despite_err = 0;
3838 
3839         args.ctag = TAG_SETATTR;
3840 do_again:
3841 recov_retry:
3842         setattr_argop = numops - 2;
3843 
3844         args.array = argop;
3845         args.array_len = numops;
3846 
3847         e.error = nfs4_start_op(VTOMI4(vp), vp, NULL, &recov_state);
3848         if (e.error)
3849                 return (e.error);
3850 
3851 
3852         /* putfh target fh */
3853         argop[0].argop = OP_CPUTFH;
3854         argop[0].nfs_argop4_u.opcputfh.sfh = rp->r_fh;
3855 
3856         if (numops == 5) {
3857                 /*
3858                  * We only care about the ctime, but need to get mtime
3859                  * and size for proper cache update.
3860                  */
3861                 /* getattr */
3862                 argop[1].argop = OP_GETATTR;
3863                 argop[1].nfs_argop4_u.opgetattr.attr_request = NFS4_VATTR_MASK;
3864                 argop[1].nfs_argop4_u.opgetattr.mi = VTOMI4(vp);
3865 
3866                 /* verify - set later in loop */
3867                 verify_argop = 2;
3868         }
3869 
3870         /* setattr */
3871         svp = rp->r_server;
3872         (void) nfs_rw_enter_sig(&svp->sv_lock, RW_READER, 0);
3873         supp_attrs = svp->sv_supp_attrs;
3874         nfs_rw_exit(&svp->sv_lock);
3875 
3876         nfs4args_setattr(&argop[setattr_argop], vap, vsap, flags, rp, cr,
3877             supp_attrs, &e.error, &sid_types);
3878         stateid = argop[setattr_argop].nfs_argop4_u.opsetattr.stateid;
3879         if (e.error) {
3880                 /* req time field(s) overflow - return immediately */
3881                 nfs4_end_op(VTOMI4(vp), vp, NULL, &recov_state, needrecov);
3882                 nfs4_fattr4_free(&argop[setattr_argop].nfs_argop4_u.
3883                     opsetattr.obj_attributes);
3884                 return (e.error);
3885         }
3886         omode = rp->r_attr.va_mode;
3887 
3888         /* getattr */
3889         argop[numops-1].argop = OP_GETATTR;
3890         argop[numops-1].nfs_argop4_u.opgetattr.attr_request = NFS4_VATTR_MASK;
3891         /*
3892          * If we are setting the ACL (indicated only by vsap != NULL), request
3893          * the ACL in this getattr.  The ACL returned from this getattr will be
3894          * used in updating the ACL cache.
3895          */
3896         if (vsap != NULL)
3897                 argop[numops-1].nfs_argop4_u.opgetattr.attr_request |=
3898                     FATTR4_ACL_MASK;
3899         argop[numops-1].nfs_argop4_u.opgetattr.mi = VTOMI4(vp);
3900 
3901         /*
3902          * setattr iterates if the object size is set and the cached ctime
3903          * does not match the file ctime. In that case, verify the ctime first.
3904          */
3905 
3906         do {
3907                 if (verify_argop != -1) {
3908                         /*
3909                          * Verify that the ctime match before doing setattr.
3910                          */
3911                         va.va_mask = AT_CTIME;
3912                         va.va_ctime = ctime;
3913                         svp = rp->r_server;
3914                         (void) nfs_rw_enter_sig(&svp->sv_lock, RW_READER, 0);
3915                         supp_attrs = svp->sv_supp_attrs;
3916                         nfs_rw_exit(&svp->sv_lock);
3917                         e.error = nfs4args_verify(&argop[verify_argop], &va,
3918                             OP_VERIFY, supp_attrs);
3919                         if (e.error) {
3920                                 /* req time field(s) overflow - return */
3921                                 nfs4_end_op(VTOMI4(vp), vp, NULL, &recov_state,
3922                                     needrecov);
3923                                 break;
3924                         }
3925                 }
3926 
3927                 doqueue = 1;
3928 
3929                 t = gethrtime();
3930 
3931                 rfs4call(VTOMI4(vp), &args, &res, cr, &doqueue, 0, &e);
3932 
3933                 /*
3934                  * Purge the access cache and ACL cache if changing either the
3935                  * owner of the file, the group owner, or the mode.  These may
3936                  * change the access permissions of the file, so purge old
3937                  * information and start over again.
3938                  */
3939                 if (mask & (AT_UID | AT_GID | AT_MODE)) {
3940                         (void) nfs4_access_purge_rp(rp);
3941                         if (rp->r_secattr != NULL) {
3942                                 mutex_enter(&rp->r_statelock);
3943                                 vsp = rp->r_secattr;
3944                                 rp->r_secattr = NULL;
3945                                 mutex_exit(&rp->r_statelock);
3946                                 if (vsp != NULL)
3947                                         nfs4_acl_free_cache(vsp);
3948                         }
3949                 }
3950 
3951                 /*
3952                  * If res.array_len == numops, then everything succeeded,
3953                  * except for possibly the final getattr.  If only the
3954                  * last getattr failed, give up, and don't try recovery.
3955                  */
3956                 if (res.array_len == numops) {
3957                         nfs4_end_op(VTOMI4(vp), vp, NULL, &recov_state,
3958                             needrecov);
3959                         if (! e.error)
3960                                 resp = &res;
3961                         break;
3962                 }
3963 
3964                 /*
3965                  * if either rpc call failed or completely succeeded - done
3966                  */
3967                 needrecov = nfs4_needs_recovery(&e, FALSE, vp->v_vfsp);
3968                 if (e.error) {
3969                         PURGE_ATTRCACHE4(vp);
3970                         if (!needrecov) {
3971                                 nfs4_end_op(VTOMI4(vp), vp, NULL, &recov_state,
3972                                     needrecov);
3973                                 break;
3974                         }
3975                 }
3976 
3977                 /*
3978                  * Do proper retry for OLD_STATEID outside of the normal
3979                  * recovery framework.
3980                  */
3981                 if (e.error == 0 && res.status == NFS4ERR_OLD_STATEID &&
3982                     sid_types.cur_sid_type != SPEC_SID &&
3983                     sid_types.cur_sid_type != NO_SID) {
3984                         nfs4_end_op(VTOMI4(vp), vp, NULL, &recov_state,
3985                             needrecov);
3986                         nfs4_save_stateid(&stateid, &sid_types);
3987                         nfs4_fattr4_free(&argop[setattr_argop].nfs_argop4_u.
3988                             opsetattr.obj_attributes);
3989                         if (verify_argop != -1) {
3990                                 nfs4args_verify_free(&argop[verify_argop]);
3991                                 verify_argop = -1;
3992                         }
3993                         (void) xdr_free(xdr_COMPOUND4res_clnt, (caddr_t)&res);
3994                         goto recov_retry;
3995                 }
3996 
3997                 if (needrecov) {
3998                         bool_t abort;
3999 
4000                         abort = nfs4_start_recovery(&e,
4001                             VTOMI4(vp), vp, NULL, NULL, NULL,
4002                             OP_SETATTR, NULL, NULL, NULL);
4003                         nfs4_end_op(VTOMI4(vp), vp, NULL, &recov_state,
4004                             needrecov);
4005                         /*
4006                          * Do not retry if we failed with OLD_STATEID using
4007                          * a special stateid.  This is done to avoid looping
4008                          * with a broken server.
4009                          */
4010                         if (e.error == 0 && res.status == NFS4ERR_OLD_STATEID &&
4011                             (sid_types.cur_sid_type == SPEC_SID ||
4012                             sid_types.cur_sid_type == NO_SID))
4013                                 abort = TRUE;
4014                         if (!e.error) {
4015                                 if (res.status == NFS4ERR_BADOWNER)
4016                                         nfs4_log_badowner(VTOMI4(vp),
4017                                             OP_SETATTR);
4018 
4019                                 e.error = geterrno4(res.status);
4020                                 (void) xdr_free(xdr_COMPOUND4res_clnt,
4021                                     (caddr_t)&res);
4022                         }
4023                         nfs4_fattr4_free(&argop[setattr_argop].nfs_argop4_u.
4024                             opsetattr.obj_attributes);
4025                         if (verify_argop != -1) {
4026                                 nfs4args_verify_free(&argop[verify_argop]);
4027                                 verify_argop = -1;
4028                         }
4029                         if (abort == FALSE) {
4030                                 /*
4031                                  * Need to retry all possible stateids in
4032                                  * case the recovery error wasn't stateid
4033                                  * related or the stateids have become
4034                                  * stale (server reboot).
4035                                  */
4036                                 nfs4_init_stateid_types(&sid_types);
4037                                 goto recov_retry;
4038                         }
4039                         return (e.error);
4040                 }
4041 
4042                 /*
4043                  * Need to call nfs4_end_op before nfs4getattr to
4044                  * avoid potential nfs4_start_op deadlock. See RFE
4045                  * 4777612.  Calls to nfs4_invalidate_pages() and
4046                  * nfs4_purge_stale_fh() might also generate over the
4047                  * wire calls which my cause nfs4_start_op() deadlock.
4048                  */
4049                 nfs4_end_op(VTOMI4(vp), vp, NULL, &recov_state, needrecov);
4050 
4051                 /*
4052                  * Check to update lease.
4053                  */
4054                 resp = &res;
4055                 if (res.status == NFS4_OK) {
4056                         break;
4057                 }
4058 
4059                 /*
4060                  * Check if verify failed to see if try again
4061                  */
4062                 if ((verify_argop == -1) || (res.array_len != 3)) {
4063                         /*
4064                          * can't continue...
4065                          */
4066                         if (res.status == NFS4ERR_BADOWNER)
4067                                 nfs4_log_badowner(VTOMI4(vp), OP_SETATTR);
4068 
4069                         e.error = geterrno4(res.status);
4070                 } else {
4071                         /*
4072                          * When the verify request fails, the client ctime is
4073                          * not in sync with the server. This is the same as
4074                          * the version 3 "not synchronized" error, and we
4075                          * handle it in a similar manner (XXX do we need to???).
4076                          * Use the ctime returned in the first getattr for
4077                          * the input to the next verify.
4078                          * If we couldn't get the attributes, then we give up
4079                          * because we can't complete the operation as required.
4080                          */
4081                         garp = &res.array[1].nfs_resop4_u.opgetattr.ga_res;
4082                 }
4083                 if (e.error) {
4084                         PURGE_ATTRCACHE4(vp);
4085                         nfs4_purge_stale_fh(e.error, vp, cr);
4086                 } else {
4087                         /*
4088                          * retry with a new verify value
4089                          */
4090                         ctime = garp->n4g_va.va_ctime;
4091                         (void) xdr_free(xdr_COMPOUND4res_clnt, (caddr_t)&res);
4092                         resp = NULL;
4093                 }
4094                 if (!e.error) {
4095                         nfs4_fattr4_free(&argop[setattr_argop].nfs_argop4_u.
4096                             opsetattr.obj_attributes);
4097                         if (verify_argop != -1) {
4098                                 nfs4args_verify_free(&argop[verify_argop]);
4099                                 verify_argop = -1;
4100                         }
4101                         (void) xdr_free(xdr_COMPOUND4res_clnt, (caddr_t)&res);
4102                         goto do_again;
4103                 }
4104         } while (!e.error);
4105 
4106         if (e.error) {
4107                 /*
4108                  * If we are here, rfs4call has an irrecoverable error - return
4109                  */
4110                 nfs4_fattr4_free(&argop[setattr_argop].nfs_argop4_u.
4111                     opsetattr.obj_attributes);
4112                 if (verify_argop != -1) {
4113                         nfs4args_verify_free(&argop[verify_argop]);
4114                         verify_argop = -1;
4115                 }
4116                 if (resp)
4117                         (void) xdr_free(xdr_COMPOUND4res_clnt, (caddr_t)resp);
4118                 return (e.error);
4119         }
4120 
4121 
4122 
4123         /*
4124          * If changing the size of the file, invalidate
4125          * any local cached data which is no longer part
4126          * of the file.  We also possibly invalidate the
4127          * last page in the file.  We could use
4128          * pvn_vpzero(), but this would mark the page as
4129          * modified and require it to be written back to
4130          * the server for no particularly good reason.
4131          * This way, if we access it, then we bring it
4132          * back in.  A read should be cheaper than a
4133          * write.
4134          */
4135         if (mask & AT_SIZE) {
4136                 nfs4_invalidate_pages(vp, (vap->va_size & PAGEMASK), cr);
4137         }
4138 
4139         /* either no error or one of the postop getattr failed */
4140 
4141         /*
4142          * XXX Perform a simplified version of wcc checking. Instead of
4143          * have another getattr to get pre-op, just purge cache if
4144          * any of the ops prior to and including the getattr failed.
4145          * If the getattr succeeded then update the attrcache accordingly.
4146          */
4147 
4148         garp = NULL;
4149         if (res.status == NFS4_OK) {
4150                 /*
4151                  * Last getattr
4152                  */
4153                 resop = &res.array[numops - 1];
4154                 garp = &resop->nfs_resop4_u.opgetattr.ga_res;
4155         }
4156         /*
4157          * In certain cases, nfs4_update_attrcache() will purge the attrcache,
4158          * rather than filling it.  See the function itself for details.
4159          */
4160         e.error = nfs4_update_attrcache(res.status, garp, t, vp, cr);
4161         if (garp != NULL) {
4162                 if (garp->n4g_resbmap & FATTR4_ACL_MASK) {
4163                         nfs4_acl_fill_cache(rp, &garp->n4g_vsa);
4164                         vs_ace4_destroy(&garp->n4g_vsa);
4165                 } else {
4166                         if (vsap != NULL) {
4167                                 /*
4168                                  * The ACL was supposed to be set and to be
4169                                  * returned in the last getattr of this
4170                                  * compound, but for some reason the getattr
4171                                  * result doesn't contain the ACL.  In this
4172                                  * case, purge the ACL cache.
4173                                  */
4174                                 if (rp->r_secattr != NULL) {
4175                                         mutex_enter(&rp->r_statelock);
4176                                         vsp = rp->r_secattr;
4177                                         rp->r_secattr = NULL;
4178                                         mutex_exit(&rp->r_statelock);
4179                                         if (vsp != NULL)
4180                                                 nfs4_acl_free_cache(vsp);
4181                                 }
4182                         }
4183                 }
4184         }
4185 
4186         if (res.status == NFS4_OK && (mask & AT_SIZE)) {
4187                 /*
4188                  * Set the size, rather than relying on getting it updated
4189                  * via a GETATTR.  With delegations the client tries to
4190                  * suppress GETATTR calls.
4191                  */
4192                 mutex_enter(&rp->r_statelock);
4193                 rp->r_size = vap->va_size;
4194                 mutex_exit(&rp->r_statelock);
4195         }
4196 
4197         /*
4198          * Can free up request args and res
4199          */
4200         nfs4_fattr4_free(&argop[setattr_argop].nfs_argop4_u.
4201             opsetattr.obj_attributes);
4202         if (verify_argop != -1) {
4203                 nfs4args_verify_free(&argop[verify_argop]);
4204                 verify_argop = -1;
4205         }
4206         (void) xdr_free(xdr_COMPOUND4res_clnt, (caddr_t)&res);
4207 
4208         /*
4209          * Some servers will change the mode to clear the setuid
4210          * and setgid bits when changing the uid or gid.  The
4211          * client needs to compensate appropriately.
4212          */
4213         if (mask & (AT_UID | AT_GID)) {
4214                 int terror, do_setattr;
4215 
4216                 do_setattr = 0;
4217                 va.va_mask = AT_MODE;
4218                 terror = nfs4getattr(vp, &va, cr);
4219                 if (!terror &&
4220                     (((mask & AT_MODE) && va.va_mode != vap->va_mode) ||
4221                     (!(mask & AT_MODE) && va.va_mode != omode))) {
4222                         va.va_mask = AT_MODE;
4223                         if (mask & AT_MODE) {
4224                                 /*
4225                                  * We asked the mode to be changed and what
4226                                  * we just got from the server in getattr is
4227                                  * not what we wanted it to be, so set it now.
4228                                  */
4229                                 va.va_mode = vap->va_mode;
4230                                 do_setattr = 1;
4231                         } else {
4232                                 /*
4233                                  * We did not ask the mode to be changed,
4234                                  * Check to see that the server just cleared
4235                                  * I_SUID and I_GUID from it. If not then
4236                                  * set mode to omode with UID/GID cleared.
4237                                  */
4238                                 if (nfs4_compare_modes(va.va_mode, omode)) {
4239                                         omode &= ~(S_ISUID|S_ISGID);
4240                                         va.va_mode = omode;
4241                                         do_setattr = 1;
4242                                 }
4243                         }
4244 
4245                         if (do_setattr)
4246                                 (void) nfs4setattr(vp, &va, 0, cr, NULL);
4247                 }
4248         }
4249 
4250         return (e.error);
4251 }
4252 
4253 /* ARGSUSED */
4254 static int
4255 nfs4_access(vnode_t *vp, int mode, int flags, cred_t *cr, caller_context_t *ct)
4256 {
4257         COMPOUND4args_clnt args;
4258         COMPOUND4res_clnt res;
4259         int doqueue;
4260         uint32_t acc, resacc, argacc;
4261         rnode4_t *rp;
4262         cred_t *cred, *ncr, *ncrfree = NULL;
4263         nfs4_access_type_t cacc;
4264         int num_ops;
4265         nfs_argop4 argop[3];
4266         nfs_resop4 *resop;
4267         bool_t needrecov = FALSE, do_getattr;
4268         nfs4_recov_state_t recov_state;
4269         int rpc_error;
4270         hrtime_t t;
4271         nfs4_error_t e = { 0, NFS4_OK, RPC_SUCCESS };
4272         mntinfo4_t *mi = VTOMI4(vp);
4273 
4274         if (nfs_zone() != mi->mi_zone)
4275                 return (EIO);
4276 
4277         acc = 0;
4278         if (mode & VREAD)
4279                 acc |= ACCESS4_READ;
4280         if (mode & VWRITE) {
4281                 if ((vp->v_vfsp->vfs_flag & VFS_RDONLY) && !ISVDEV(vp->v_type))
4282                         return (EROFS);
4283                 if (vp->v_type == VDIR)
4284                         acc |= ACCESS4_DELETE;
4285                 acc |= ACCESS4_MODIFY | ACCESS4_EXTEND;
4286         }
4287         if (mode & VEXEC) {
4288                 if (vp->v_type == VDIR)
4289                         acc |= ACCESS4_LOOKUP;
4290                 else
4291                         acc |= ACCESS4_EXECUTE;
4292         }
4293 
4294         if (VTOR4(vp)->r_acache != NULL) {
4295                 e.error = nfs4_validate_caches(vp, cr);
4296                 if (e.error)
4297                         return (e.error);
4298         }
4299 
4300         rp = VTOR4(vp);
4301         if (vp->v_type == VDIR)
4302                 argacc = ACCESS4_READ | ACCESS4_DELETE | ACCESS4_MODIFY |
4303                     ACCESS4_EXTEND | ACCESS4_LOOKUP;
4304         else
4305                 argacc = ACCESS4_READ | ACCESS4_MODIFY | ACCESS4_EXTEND |
4306                     ACCESS4_EXECUTE;
4307         recov_state.rs_flags = 0;
4308         recov_state.rs_num_retry_despite_err = 0;
4309 
4310         cred = cr;
4311         /*
4312          * ncr and ncrfree both initially
4313          * point to the memory area returned
4314          * by crnetadjust();
4315          * ncrfree not NULL when exiting means
4316          * that we need to release it
4317          */
4318         ncr = crnetadjust(cred);
4319         ncrfree = ncr;
4320 
4321 tryagain:
4322         cacc = nfs4_access_check(rp, acc, cred);
4323         if (cacc == NFS4_ACCESS_ALLOWED) {
4324                 if (ncrfree != NULL)
4325                         crfree(ncrfree);
4326                 return (0);
4327         }
4328         if (cacc == NFS4_ACCESS_DENIED) {
4329                 /*
4330                  * If the cred can be adjusted, try again
4331                  * with the new cred.
4332                  */
4333                 if (ncr != NULL) {
4334                         cred = ncr;
4335                         ncr = NULL;
4336                         goto tryagain;
4337                 }
4338                 if (ncrfree != NULL)
4339                         crfree(ncrfree);
4340                 return (EACCES);
4341         }
4342 
4343 recov_retry:
4344         /*
4345          * Don't take with r_statev4_lock here. r_deleg_type could
4346          * change as soon as lock is released.  Since it is an int,
4347          * there is no atomicity issue.
4348          */
4349         do_getattr = (rp->r_deleg_type == OPEN_DELEGATE_NONE);
4350         num_ops = do_getattr ? 3 : 2;
4351 
4352         args.ctag = TAG_ACCESS;
4353 
4354         args.array_len = num_ops;
4355         args.array = argop;
4356 
4357         if (e.error = nfs4_start_fop(mi, vp, NULL, OH_ACCESS,
4358             &recov_state, NULL)) {
4359                 if (ncrfree != NULL)
4360                         crfree(ncrfree);
4361                 return (e.error);
4362         }
4363 
4364         /* putfh target fh */
4365         argop[0].argop = OP_CPUTFH;
4366         argop[0].nfs_argop4_u.opcputfh.sfh = VTOR4(vp)->r_fh;
4367 
4368         /* access */
4369         argop[1].argop = OP_ACCESS;
4370         argop[1].nfs_argop4_u.opaccess.access = argacc;
4371 
4372         /* getattr */
4373         if (do_getattr) {
4374                 argop[2].argop = OP_GETATTR;
4375                 argop[2].nfs_argop4_u.opgetattr.attr_request = NFS4_VATTR_MASK;
4376                 argop[2].nfs_argop4_u.opgetattr.mi = mi;
4377         }
4378 
4379         NFS4_DEBUG(nfs4_client_call_debug, (CE_NOTE,
4380             "nfs4_access: %s call, rp %s", needrecov ? "recov" : "first",
4381             rnode4info(VTOR4(vp))));
4382 
4383         doqueue = 1;
4384         t = gethrtime();
4385         rfs4call(VTOMI4(vp), &args, &res, cred, &doqueue, 0, &e);
4386         rpc_error = e.error;
4387 
4388         needrecov = nfs4_needs_recovery(&e, FALSE, vp->v_vfsp);
4389         if (needrecov) {
4390                 NFS4_DEBUG(nfs4_client_recov_debug, (CE_NOTE,
4391                     "nfs4_access: initiating recovery\n"));
4392 
4393                 if (nfs4_start_recovery(&e, VTOMI4(vp), vp, NULL, NULL,
4394                     NULL, OP_ACCESS, NULL, NULL, NULL) == FALSE) {
4395                         nfs4_end_fop(VTOMI4(vp), vp, NULL, OH_ACCESS,
4396                             &recov_state, needrecov);
4397                         if (!e.error)
4398                                 (void) xdr_free(xdr_COMPOUND4res_clnt,
4399                                     (caddr_t)&res);
4400                         goto recov_retry;
4401                 }
4402         }
4403         nfs4_end_fop(mi, vp, NULL, OH_ACCESS, &recov_state, needrecov);
4404 
4405         if (e.error)
4406                 goto out;
4407 
4408         if (res.status) {
4409                 e.error = geterrno4(res.status);
4410                 /*
4411                  * This might generate over the wire calls throught
4412                  * nfs4_invalidate_pages. Hence we need to call nfs4_end_op()
4413                  * here to avoid a deadlock.
4414                  */
4415                 nfs4_purge_stale_fh(e.error, vp, cr);
4416                 goto out;
4417         }
4418         resop = &res.array[1];      /* access res */
4419 
4420         resacc = resop->nfs_resop4_u.opaccess.access;
4421 
4422         if (do_getattr) {
4423                 resop++;        /* getattr res */
4424                 nfs4_attr_cache(vp, &resop->nfs_resop4_u.opgetattr.ga_res,
4425                     t, cr, FALSE, NULL);
4426         }
4427 
4428         if (!e.error) {
4429                 nfs4_access_cache(rp, argacc, resacc, cred);
4430                 /*
4431                  * we just cached results with cred; if cred is the
4432                  * adjusted credentials from crnetadjust, we do not want
4433                  * to release them before exiting: hence setting ncrfree
4434                  * to NULL
4435                  */
4436                 if (cred != cr)
4437                         ncrfree = NULL;
4438                 /* XXX check the supported bits too? */
4439                 if ((acc & resacc) != acc) {
4440                         /*
4441                          * The following code implements the semantic
4442                          * that a setuid root program has *at least* the
4443                          * permissions of the user that is running the
4444                          * program.  See rfs3call() for more portions
4445                          * of the implementation of this functionality.
4446                          */
4447                         /* XXX-LP */
4448                         if (ncr != NULL) {
4449                                 (void) xdr_free(xdr_COMPOUND4res_clnt,
4450                                     (caddr_t)&res);
4451                                 cred = ncr;
4452                                 ncr = NULL;
4453                                 goto tryagain;
4454                         }
4455                         e.error = EACCES;
4456                 }
4457         }
4458 
4459 out:
4460         if (!rpc_error)
4461                 (void) xdr_free(xdr_COMPOUND4res_clnt, (caddr_t)&res);
4462 
4463         if (ncrfree != NULL)
4464                 crfree(ncrfree);
4465 
4466         return (e.error);
4467 }
4468 
4469 /* ARGSUSED */
4470 static int
4471 nfs4_readlink(vnode_t *vp, struct uio *uiop, cred_t *cr, caller_context_t *ct)
4472 {
4473         COMPOUND4args_clnt args;
4474         COMPOUND4res_clnt res;
4475         int doqueue;
4476         rnode4_t *rp;
4477         nfs_argop4 argop[3];
4478         nfs_resop4 *resop;
4479         READLINK4res *lr_res;
4480         nfs4_ga_res_t *garp;
4481         uint_t len;
4482         char *linkdata;
4483         bool_t needrecov = FALSE;
4484         nfs4_recov_state_t recov_state;
4485         hrtime_t t;
4486         nfs4_error_t e = { 0, NFS4_OK, RPC_SUCCESS };
4487 
4488         if (nfs_zone() != VTOMI4(vp)->mi_zone)
4489                 return (EIO);
4490         /*
4491          * Can't readlink anything other than a symbolic link.
4492          */
4493         if (vp->v_type != VLNK)
4494                 return (EINVAL);
4495 
4496         rp = VTOR4(vp);
4497         if (nfs4_do_symlink_cache && rp->r_symlink.contents != NULL) {
4498                 e.error = nfs4_validate_caches(vp, cr);
4499                 if (e.error)
4500                         return (e.error);
4501                 mutex_enter(&rp->r_statelock);
4502                 if (rp->r_symlink.contents != NULL) {
4503                         e.error = uiomove(rp->r_symlink.contents,
4504                             rp->r_symlink.len, UIO_READ, uiop);
4505                         mutex_exit(&rp->r_statelock);
4506                         return (e.error);
4507                 }
4508                 mutex_exit(&rp->r_statelock);
4509         }
4510         recov_state.rs_flags = 0;
4511         recov_state.rs_num_retry_despite_err = 0;
4512 
4513 recov_retry:
4514         args.array_len = 3;
4515         args.array = argop;
4516         args.ctag = TAG_READLINK;
4517 
4518         e.error = nfs4_start_op(VTOMI4(vp), vp, NULL, &recov_state);
4519         if (e.error) {
4520                 return (e.error);
4521         }
4522 
4523         /* 0. putfh symlink fh */
4524         argop[0].argop = OP_CPUTFH;
4525         argop[0].nfs_argop4_u.opcputfh.sfh = VTOR4(vp)->r_fh;
4526 
4527         /* 1. readlink */
4528         argop[1].argop = OP_READLINK;
4529 
4530         /* 2. getattr */
4531         argop[2].argop = OP_GETATTR;
4532         argop[2].nfs_argop4_u.opgetattr.attr_request = NFS4_VATTR_MASK;
4533         argop[2].nfs_argop4_u.opgetattr.mi = VTOMI4(vp);
4534 
4535         doqueue = 1;
4536 
4537         NFS4_DEBUG(nfs4_client_call_debug, (CE_NOTE,
4538             "nfs4_readlink: %s call, rp %s", needrecov ? "recov" : "first",
4539             rnode4info(VTOR4(vp))));
4540 
4541         t = gethrtime();
4542 
4543         rfs4call(VTOMI4(vp), &args, &res, cr, &doqueue, 0, &e);
4544 
4545         needrecov = nfs4_needs_recovery(&e, FALSE, vp->v_vfsp);
4546         if (needrecov) {
4547                 NFS4_DEBUG(nfs4_client_recov_debug, (CE_NOTE,
4548                     "nfs4_readlink: initiating recovery\n"));
4549 
4550                 if (nfs4_start_recovery(&e, VTOMI4(vp), vp, NULL, NULL,
4551                     NULL, OP_READLINK, NULL, NULL, NULL) == FALSE) {
4552                         if (!e.error)
4553                                 (void) xdr_free(xdr_COMPOUND4res_clnt,
4554                                     (caddr_t)&res);
4555 
4556                         nfs4_end_op(VTOMI4(vp), vp, NULL, &recov_state,
4557                             needrecov);
4558                         goto recov_retry;
4559                 }
4560         }
4561 
4562         nfs4_end_op(VTOMI4(vp), vp, NULL, &recov_state, needrecov);
4563 
4564         if (e.error)
4565                 return (e.error);
4566 
4567         /*
4568          * There is an path in the code below which calls
4569          * nfs4_purge_stale_fh(), which may generate otw calls through
4570          * nfs4_invalidate_pages. Hence we need to call nfs4_end_op()
4571          * here to avoid nfs4_start_op() deadlock.
4572          */
4573 
4574         if (res.status && (res.array_len < args.array_len)) {
4575                 /*
4576                  * either Putfh or Link failed
4577                  */
4578                 e.error = geterrno4(res.status);
4579                 nfs4_purge_stale_fh(e.error, vp, cr);
4580                 (void) xdr_free(xdr_COMPOUND4res_clnt, (caddr_t)&res);
4581                 return (e.error);
4582         }
4583 
4584         resop = &res.array[1];      /* readlink res */
4585         lr_res = &resop->nfs_resop4_u.opreadlink;
4586 
4587         /*
4588          * treat symlink names as data
4589          */
4590         linkdata = utf8_to_str(&lr_res->link, &len, NULL);
4591         if (linkdata != NULL) {
4592                 int uio_len = len - 1;
4593                 /* len includes null byte, which we won't uiomove */
4594                 e.error = uiomove(linkdata, uio_len, UIO_READ, uiop);
4595                 if (nfs4_do_symlink_cache && rp->r_symlink.contents == NULL) {
4596                         mutex_enter(&rp->r_statelock);
4597                         if (rp->r_symlink.contents == NULL) {
4598                                 rp->r_symlink.contents = linkdata;
4599                                 rp->r_symlink.len = uio_len;
4600                                 rp->r_symlink.size = len;
4601                                 mutex_exit(&rp->r_statelock);
4602                         } else {
4603                                 mutex_exit(&rp->r_statelock);
4604                                 kmem_free(linkdata, len);
4605                         }
4606                 } else {
4607                         kmem_free(linkdata, len);
4608                 }
4609         }
4610         if (res.status == NFS4_OK) {
4611                 resop++;        /* getattr res */
4612                 garp = &resop->nfs_resop4_u.opgetattr.ga_res;
4613         }
4614         e.error = nfs4_update_attrcache(res.status, garp, t, vp, cr);
4615 
4616         (void) xdr_free(xdr_COMPOUND4res_clnt, (caddr_t)&res);
4617 
4618         /*
4619          * The over the wire error for attempting to readlink something
4620          * other than a symbolic link is ENXIO.  However, we need to
4621          * return EINVAL instead of ENXIO, so we map it here.
4622          */
4623         return (e.error == ENXIO ? EINVAL : e.error);
4624 }
4625 
4626 /*
4627  * Flush local dirty pages to stable storage on the server.
4628  *
4629  * If FNODSYNC is specified, then there is nothing to do because
4630  * metadata changes are not cached on the client before being
4631  * sent to the server.
4632  */
4633 /* ARGSUSED */
4634 static int
4635 nfs4_fsync(vnode_t *vp, int syncflag, cred_t *cr, caller_context_t *ct)
4636 {
4637         int error;
4638 
4639         if ((syncflag & FNODSYNC) || IS_SWAPVP(vp))
4640                 return (0);
4641         if (nfs_zone() != VTOMI4(vp)->mi_zone)
4642                 return (EIO);
4643         error = nfs4_putpage_commit(vp, (offset_t)0, 0, cr);
4644         if (!error)
4645                 error = VTOR4(vp)->r_error;
4646         return (error);
4647 }
4648 
4649 /*
4650  * Weirdness: if the file was removed or the target of a rename
4651  * operation while it was open, it got renamed instead.  Here we
4652  * remove the renamed file.
4653  */
4654 /* ARGSUSED */
4655 void
4656 nfs4_inactive(vnode_t *vp, cred_t *cr, caller_context_t *ct)
4657 {
4658         rnode4_t *rp;
4659 
4660         ASSERT(vp != DNLC_NO_VNODE);
4661 
4662         rp = VTOR4(vp);
4663 
4664         if (IS_SHADOW(vp, rp)) {
4665                 sv_inactive(vp);
4666                 return;
4667         }
4668 
4669         /*
4670          * If this is coming from the wrong zone, we let someone in the right
4671          * zone take care of it asynchronously.  We can get here due to
4672          * VN_RELE() being called from pageout() or fsflush().  This call may
4673          * potentially turn into an expensive no-op if, for instance, v_count
4674          * gets incremented in the meantime, but it's still correct.
4675          */
4676         if (nfs_zone() != VTOMI4(vp)->mi_zone) {
4677                 nfs4_async_inactive(vp, cr);
4678                 return;
4679         }
4680 
4681         /*
4682          * Some of the cleanup steps might require over-the-wire
4683          * operations.  Since VOP_INACTIVE can get called as a result of
4684          * other over-the-wire operations (e.g., an attribute cache update
4685          * can lead to a DNLC purge), doing those steps now would lead to a
4686          * nested call to the recovery framework, which can deadlock.  So
4687          * do any over-the-wire cleanups asynchronously, in a separate
4688          * thread.
4689          */
4690 
4691         mutex_enter(&rp->r_os_lock);
4692         mutex_enter(&rp->r_statelock);
4693         mutex_enter(&rp->r_statev4_lock);
4694 
4695         if (vp->v_type == VREG && list_head(&rp->r_open_streams) != NULL) {
4696                 mutex_exit(&rp->r_statev4_lock);
4697                 mutex_exit(&rp->r_statelock);
4698                 mutex_exit(&rp->r_os_lock);
4699                 nfs4_async_inactive(vp, cr);
4700                 return;
4701         }
4702 
4703         if (rp->r_deleg_type == OPEN_DELEGATE_READ ||
4704             rp->r_deleg_type == OPEN_DELEGATE_WRITE) {
4705                 mutex_exit(&rp->r_statev4_lock);
4706                 mutex_exit(&rp->r_statelock);
4707                 mutex_exit(&rp->r_os_lock);
4708                 nfs4_async_inactive(vp, cr);
4709                 return;
4710         }
4711 
4712         if (rp->r_unldvp != NULL) {
4713                 mutex_exit(&rp->r_statev4_lock);
4714                 mutex_exit(&rp->r_statelock);
4715                 mutex_exit(&rp->r_os_lock);
4716                 nfs4_async_inactive(vp, cr);
4717                 return;
4718         }
4719         mutex_exit(&rp->r_statev4_lock);
4720         mutex_exit(&rp->r_statelock);
4721         mutex_exit(&rp->r_os_lock);
4722 
4723         rp4_addfree(rp, cr);
4724 }
4725 
4726 /*
4727  * nfs4_inactive_otw - nfs4_inactive, plus over-the-wire calls to free up
4728  * various bits of state.  The caller must not refer to vp after this call.
4729  */
4730 
4731 void
4732 nfs4_inactive_otw(vnode_t *vp, cred_t *cr)
4733 {
4734         rnode4_t *rp = VTOR4(vp);
4735         nfs4_recov_state_t recov_state;
4736         nfs4_error_t e = { 0, NFS4_OK, RPC_SUCCESS };
4737         vnode_t *unldvp;
4738         char *unlname;
4739         cred_t *unlcred;
4740         COMPOUND4args_clnt args;
4741         COMPOUND4res_clnt res, *resp;
4742         nfs_argop4 argop[2];
4743         int doqueue;
4744 #ifdef DEBUG
4745         char *name;
4746 #endif
4747 
4748         ASSERT(nfs_zone() == VTOMI4(vp)->mi_zone);
4749         ASSERT(!IS_SHADOW(vp, rp));
4750 
4751 #ifdef DEBUG
4752         name = fn_name(VTOSV(vp)->sv_name);
4753         NFS4_DEBUG(nfs4_client_inactive_debug, (CE_NOTE, "nfs4_inactive_otw: "
4754             "release vnode %s", name));
4755         kmem_free(name, MAXNAMELEN);
4756 #endif
4757 
4758         if (vp->v_type == VREG) {
4759                 bool_t recov_failed = FALSE;
4760 
4761                 e.error = nfs4close_all(vp, cr);
4762                 if (e.error) {
4763                         /* Check to see if recovery failed */
4764                         mutex_enter(&(VTOMI4(vp)->mi_lock));
4765                         if (VTOMI4(vp)->mi_flags & MI4_RECOV_FAIL)
4766                                 recov_failed = TRUE;
4767                         mutex_exit(&(VTOMI4(vp)->mi_lock));
4768                         if (!recov_failed) {
4769                                 mutex_enter(&rp->r_statelock);
4770                                 if (rp->r_flags & R4RECOVERR)
4771                                         recov_failed = TRUE;
4772                                 mutex_exit(&rp->r_statelock);
4773                         }
4774                         if (recov_failed) {
4775                                 NFS4_DEBUG(nfs4_client_recov_debug,
4776                                     (CE_NOTE, "nfs4_inactive_otw: "
4777                                     "close failed (recovery failure)"));
4778                         }
4779                 }
4780         }
4781 
4782 redo:
4783         if (rp->r_unldvp == NULL) {
4784                 rp4_addfree(rp, cr);
4785                 return;
4786         }
4787 
4788         /*
4789          * Save the vnode pointer for the directory where the
4790          * unlinked-open file got renamed, then set it to NULL
4791          * to prevent another thread from getting here before
4792          * we're done with the remove.  While we have the
4793          * statelock, make local copies of the pertinent rnode
4794          * fields.  If we weren't to do this in an atomic way, the
4795          * the unl* fields could become inconsistent with respect
4796          * to each other due to a race condition between this
4797          * code and nfs_remove().  See bug report 1034328.
4798          */
4799         mutex_enter(&rp->r_statelock);
4800         if (rp->r_unldvp == NULL) {
4801                 mutex_exit(&rp->r_statelock);
4802                 rp4_addfree(rp, cr);
4803                 return;
4804         }
4805 
4806         unldvp = rp->r_unldvp;
4807         rp->r_unldvp = NULL;
4808         unlname = rp->r_unlname;
4809         rp->r_unlname = NULL;
4810         unlcred = rp->r_unlcred;
4811         rp->r_unlcred = NULL;
4812         mutex_exit(&rp->r_statelock);
4813 
4814         /*
4815          * If there are any dirty pages left, then flush
4816          * them.  This is unfortunate because they just
4817          * may get thrown away during the remove operation,
4818          * but we have to do this for correctness.
4819          */
4820         if (nfs4_has_pages(vp) &&
4821             ((rp->r_flags & R4DIRTY) || rp->r_count > 0)) {
4822                 ASSERT(vp->v_type != VCHR);
4823                 e.error = nfs4_putpage(vp, (u_offset_t)0, 0, 0, cr, NULL);
4824                 if (e.error) {
4825                         mutex_enter(&rp->r_statelock);
4826                         if (!rp->r_error)
4827                                 rp->r_error = e.error;
4828                         mutex_exit(&rp->r_statelock);
4829                 }
4830         }
4831 
4832         recov_state.rs_flags = 0;
4833         recov_state.rs_num_retry_despite_err = 0;
4834 recov_retry_remove:
4835         /*
4836          * Do the remove operation on the renamed file
4837          */
4838         args.ctag = TAG_INACTIVE;
4839 
4840         /*
4841          * Remove ops: putfh dir; remove
4842          */
4843         args.array_len = 2;
4844         args.array = argop;
4845 
4846         e.error = nfs4_start_op(VTOMI4(unldvp), unldvp, NULL, &recov_state);
4847         if (e.error) {
4848                 kmem_free(unlname, MAXNAMELEN);
4849                 crfree(unlcred);
4850                 VN_RELE(unldvp);
4851                 /*
4852                  * Try again; this time around r_unldvp will be NULL, so we'll
4853                  * just call rp4_addfree() and return.
4854                  */
4855                 goto redo;
4856         }
4857 
4858         /* putfh directory */
4859         argop[0].argop = OP_CPUTFH;
4860         argop[0].nfs_argop4_u.opcputfh.sfh = VTOR4(unldvp)->r_fh;
4861 
4862         /* remove */
4863         argop[1].argop = OP_CREMOVE;
4864         argop[1].nfs_argop4_u.opcremove.ctarget = unlname;
4865 
4866         doqueue = 1;
4867         resp = &res;
4868 
4869 #if 0 /* notyet */
4870         /*
4871          * Can't do this yet.  We may be being called from
4872          * dnlc_purge_XXX while that routine is holding a
4873          * mutex lock to the nc_rele list.  The calls to
4874          * nfs3_cache_wcc_data may result in calls to
4875          * dnlc_purge_XXX.  This will result in a deadlock.
4876          */
4877         rfs4call(VTOMI4(unldvp), &args, &res, unlcred, &doqueue, 0, &e);
4878         if (e.error) {
4879                 PURGE_ATTRCACHE4(unldvp);
4880                 resp = NULL;
4881         } else if (res.status) {
4882                 e.error = geterrno4(res.status);
4883                 PURGE_ATTRCACHE4(unldvp);
4884                 /*
4885                  * This code is inactive right now
4886                  * but if made active there should
4887                  * be a nfs4_end_op() call before
4888                  * nfs4_purge_stale_fh to avoid start_op()
4889                  * deadlock. See BugId: 4948726
4890                  */
4891                 nfs4_purge_stale_fh(error, unldvp, cr);
4892         } else {
4893                 nfs_resop4 *resop;
4894                 REMOVE4res *rm_res;
4895 
4896                 resop = &res.array[1];
4897                 rm_res = &resop->nfs_resop4_u.opremove;
4898                 /*
4899                  * Update directory cache attribute,
4900                  * readdir and dnlc caches.
4901                  */
4902                 nfs4_update_dircaches(&rm_res->cinfo, unldvp, NULL, NULL, NULL);
4903         }
4904 #else
4905         rfs4call(VTOMI4(unldvp), &args, &res, unlcred, &doqueue, 0, &e);
4906 
4907         PURGE_ATTRCACHE4(unldvp);
4908 #endif
4909 
4910         if (nfs4_needs_recovery(&e, FALSE, unldvp->v_vfsp)) {
4911                 if (nfs4_start_recovery(&e, VTOMI4(unldvp), unldvp, NULL,
4912                     NULL, NULL, OP_REMOVE, NULL, NULL, NULL) == FALSE) {
4913                         if (!e.error)
4914                                 (void) xdr_free(xdr_COMPOUND4res_clnt,
4915                                     (caddr_t)&res);
4916                         nfs4_end_op(VTOMI4(unldvp), unldvp, NULL,
4917                             &recov_state, TRUE);
4918                         goto recov_retry_remove;
4919                 }
4920         }
4921         nfs4_end_op(VTOMI4(unldvp), unldvp, NULL, &recov_state, FALSE);
4922 
4923         /*
4924          * Release stuff held for the remove
4925          */
4926         VN_RELE(unldvp);
4927         if (!e.error && resp)
4928                 (void) xdr_free(xdr_COMPOUND4res_clnt, (caddr_t)resp);
4929 
4930         kmem_free(unlname, MAXNAMELEN);
4931         crfree(unlcred);
4932         goto redo;
4933 }
4934 
4935 /*
4936  * Remote file system operations having to do with directory manipulation.
4937  */
4938 /* ARGSUSED3 */
4939 int
4940 nfs4_lookup(vnode_t *dvp, char *nm, vnode_t **vpp, struct pathname *pnp,
4941     int flags, vnode_t *rdir, cred_t *cr, caller_context_t *ct,
4942     int *direntflags, pathname_t *realpnp)
4943 {
4944         int error;
4945         vnode_t *vp, *avp = NULL;
4946         rnode4_t *drp;
4947 
4948         *vpp = NULL;
4949         if (nfs_zone() != VTOMI4(dvp)->mi_zone)
4950                 return (EPERM);
4951         /*
4952          * if LOOKUP_XATTR, must replace dvp (object) with
4953          * object's attrdir before continuing with lookup
4954          */
4955         if (flags & LOOKUP_XATTR) {
4956                 error = nfs4lookup_xattr(dvp, nm, &avp, flags, cr);
4957                 if (error)
4958                         return (error);
4959 
4960                 dvp = avp;
4961 
4962                 /*
4963                  * If lookup is for "", just return dvp now.  The attrdir
4964                  * has already been activated (from nfs4lookup_xattr), and
4965                  * the caller will RELE the original dvp -- not
4966                  * the attrdir.  So, set vpp and return.
4967                  * Currently, when the LOOKUP_XATTR flag is
4968                  * passed to VOP_LOOKUP, the name is always empty, and
4969                  * shortcircuiting here avoids 3 unneeded lock/unlock
4970                  * pairs.
4971                  *
4972                  * If a non-empty name was provided, then it is the
4973                  * attribute name, and it will be looked up below.
4974                  */
4975                 if (*nm == '\0') {
4976                         *vpp = dvp;
4977                         return (0);
4978                 }
4979 
4980                 /*
4981                  * The vfs layer never sends a name when asking for the
4982                  * attrdir, so we should never get here (unless of course
4983                  * name is passed at some time in future -- at which time
4984                  * we'll blow up here).
4985                  */
4986                 ASSERT(0);
4987         }
4988 
4989         drp = VTOR4(dvp);
4990         if (nfs_rw_enter_sig(&drp->r_rwlock, RW_READER, INTR4(dvp)))
4991                 return (EINTR);
4992 
4993         error = nfs4lookup(dvp, nm, vpp, cr, 0);
4994         nfs_rw_exit(&drp->r_rwlock);
4995 
4996         /*
4997          * If vnode is a device, create special vnode.
4998          */
4999         if (!error && ISVDEV((*vpp)->v_type)) {
5000                 vp = *vpp;
5001                 *vpp = specvp(vp, vp->v_rdev, vp->v_type, cr);
5002                 VN_RELE(vp);
5003         }
5004 
5005         return (error);
5006 }
5007 
5008 /* ARGSUSED */
5009 static int
5010 nfs4lookup_xattr(vnode_t *dvp, char *nm, vnode_t **vpp, int flags, cred_t *cr)
5011 {
5012         int error;
5013         rnode4_t *drp;
5014         int cflag = ((flags & CREATE_XATTR_DIR) != 0);
5015         mntinfo4_t *mi;
5016 
5017         mi = VTOMI4(dvp);
5018         if (!(mi->mi_vfsp->vfs_flag & VFS_XATTR) &&
5019             !vfs_has_feature(mi->mi_vfsp, VFSFT_SYSATTR_VIEWS))
5020                 return (EINVAL);
5021 
5022         drp = VTOR4(dvp);
5023         if (nfs_rw_enter_sig(&drp->r_rwlock, RW_READER, INTR4(dvp)))
5024                 return (EINTR);
5025 
5026         mutex_enter(&drp->r_statelock);
5027         /*
5028          * If the server doesn't support xattrs just return EINVAL
5029          */
5030         if (drp->r_xattr_dir == NFS4_XATTR_DIR_NOTSUPP) {
5031                 mutex_exit(&drp->r_statelock);
5032                 nfs_rw_exit(&drp->r_rwlock);
5033                 return (EINVAL);
5034         }
5035 
5036         /*
5037          * If there is a cached xattr directory entry,
5038          * use it as long as the attributes are valid. If the
5039          * attributes are not valid, take the simple approach and
5040          * free the cached value and re-fetch a new value.
5041          *
5042          * We don't negative entry cache for now, if we did we
5043          * would need to check if the file has changed on every
5044          * lookup. But xattrs don't exist very often and failing
5045          * an openattr is not much more expensive than and NVERIFY or GETATTR
5046          * so do an openattr over the wire for now.
5047          */
5048         if (drp->r_xattr_dir != NULL) {
5049                 if (ATTRCACHE4_VALID(dvp)) {
5050                         VN_HOLD(drp->r_xattr_dir);
5051                         *vpp = drp->r_xattr_dir;
5052                         mutex_exit(&drp->r_statelock);
5053                         nfs_rw_exit(&drp->r_rwlock);
5054                         return (0);
5055                 }
5056                 VN_RELE(drp->r_xattr_dir);
5057                 drp->r_xattr_dir = NULL;
5058         }
5059         mutex_exit(&drp->r_statelock);
5060 
5061         error = nfs4openattr(dvp, vpp, cflag, cr);
5062 
5063         nfs_rw_exit(&drp->r_rwlock);
5064 
5065         return (error);
5066 }
5067 
5068 static int
5069 nfs4lookup(vnode_t *dvp, char *nm, vnode_t **vpp, cred_t *cr, int skipdnlc)
5070 {
5071         int error;
5072         rnode4_t *drp;
5073 
5074         ASSERT(nfs_zone() == VTOMI4(dvp)->mi_zone);
5075 
5076         /*
5077          * If lookup is for "", just return dvp.  Don't need
5078          * to send it over the wire, look it up in the dnlc,
5079          * or perform any access checks.
5080          */
5081         if (*nm == '\0') {
5082                 VN_HOLD(dvp);
5083                 *vpp = dvp;
5084                 return (0);
5085         }
5086 
5087         /*
5088          * Can't do lookups in non-directories.
5089          */
5090         if (dvp->v_type != VDIR)
5091                 return (ENOTDIR);
5092 
5093         /*
5094          * If lookup is for ".", just return dvp.  Don't need
5095          * to send it over the wire or look it up in the dnlc,
5096          * just need to check access.
5097          */
5098         if (nm[0] == '.' && nm[1] == '\0') {
5099                 error = nfs4_access(dvp, VEXEC, 0, cr, NULL);
5100                 if (error)
5101                         return (error);
5102                 VN_HOLD(dvp);
5103                 *vpp = dvp;
5104                 return (0);
5105         }
5106 
5107         drp = VTOR4(dvp);
5108         if (!(drp->r_flags & R4LOOKUP)) {
5109                 mutex_enter(&drp->r_statelock);
5110                 drp->r_flags |= R4LOOKUP;
5111                 mutex_exit(&drp->r_statelock);
5112         }
5113 
5114         *vpp = NULL;
5115         /*
5116          * Lookup this name in the DNLC.  If there is no entry
5117          * lookup over the wire.
5118          */
5119         if (!skipdnlc)
5120                 *vpp = dnlc_lookup(dvp, nm);
5121         if (*vpp == NULL) {
5122                 /*
5123                  * We need to go over the wire to lookup the name.
5124                  */
5125                 return (nfs4lookupnew_otw(dvp, nm, vpp, cr));
5126         }
5127 
5128         /*
5129          * We hit on the dnlc
5130          */
5131         if (*vpp != DNLC_NO_VNODE ||
5132             (dvp->v_vfsp->vfs_flag & VFS_RDONLY)) {
5133                 /*
5134                  * But our attrs may not be valid.
5135                  */
5136                 if (ATTRCACHE4_VALID(dvp)) {
5137                         error = nfs4_waitfor_purge_complete(dvp);
5138                         if (error) {
5139                                 VN_RELE(*vpp);
5140                                 *vpp = NULL;
5141                                 return (error);
5142                         }
5143 
5144                         /*
5145                          * If after the purge completes, check to make sure
5146                          * our attrs are still valid.
5147                          */
5148                         if (ATTRCACHE4_VALID(dvp)) {
5149                                 /*
5150                                  * If we waited for a purge we may have
5151                                  * lost our vnode so look it up again.
5152                                  */
5153                                 VN_RELE(*vpp);
5154                                 *vpp = dnlc_lookup(dvp, nm);
5155                                 if (*vpp == NULL)
5156                                         return (nfs4lookupnew_otw(dvp,
5157                                             nm, vpp, cr));
5158 
5159                                 /*
5160                                  * The access cache should almost always hit
5161                                  */
5162                                 error = nfs4_access(dvp, VEXEC, 0, cr, NULL);
5163 
5164                                 if (error) {
5165                                         VN_RELE(*vpp);
5166                                         *vpp = NULL;
5167                                         return (error);
5168                                 }
5169                                 if (*vpp == DNLC_NO_VNODE) {
5170                                         VN_RELE(*vpp);
5171                                         *vpp = NULL;
5172                                         return (ENOENT);
5173                                 }
5174                                 return (0);
5175                         }
5176                 }
5177         }
5178 
5179         ASSERT(*vpp != NULL);
5180 
5181         /*
5182          * We may have gotten here we have one of the following cases:
5183          *      1) vpp != DNLC_NO_VNODE, our attrs have timed out so we
5184          *              need to validate them.
5185          *      2) vpp == DNLC_NO_VNODE, a negative entry that we always
5186          *              must validate.
5187          *
5188          * Go to the server and check if the directory has changed, if
5189          * it hasn't we are done and can use the dnlc entry.
5190          */
5191         return (nfs4lookupvalidate_otw(dvp, nm, vpp, cr));
5192 }
5193 
5194 /*
5195  * Go to the server and check if the directory has changed, if
5196  * it hasn't we are done and can use the dnlc entry.  If it
5197  * has changed we get a new copy of its attributes and check
5198  * the access for VEXEC, then relookup the filename and
5199  * get its filehandle and attributes.
5200  *
5201  * PUTFH dfh NVERIFY GETATTR ACCESS LOOKUP GETFH GETATTR
5202  *      if the NVERIFY failed we must
5203  *              purge the caches
5204  *              cache new attributes (will set r_time_attr_inval)
5205  *              cache new access
5206  *              recheck VEXEC access
5207  *              add name to dnlc, possibly negative
5208  *              if LOOKUP succeeded
5209  *                      cache new attributes
5210  *      else
5211  *              set a new r_time_attr_inval for dvp
5212  *              check to make sure we have access
5213  *
5214  * The vpp returned is the vnode passed in if the directory is valid,
5215  * a new vnode if successful lookup, or NULL on error.
5216  */
5217 static int
5218 nfs4lookupvalidate_otw(vnode_t *dvp, char *nm, vnode_t **vpp, cred_t *cr)
5219 {
5220         COMPOUND4args_clnt args;
5221         COMPOUND4res_clnt res;
5222         fattr4 *ver_fattr;
5223         fattr4_change dchange;
5224         int32_t *ptr;
5225         int argoplist_size  = 7 * sizeof (nfs_argop4);
5226         nfs_argop4 *argop;
5227         int doqueue;
5228         mntinfo4_t *mi;
5229         nfs4_recov_state_t recov_state;
5230         hrtime_t t;
5231         int isdotdot;
5232         vnode_t *nvp;
5233         nfs_fh4 *fhp;
5234         nfs4_sharedfh_t *sfhp;
5235         nfs4_access_type_t cacc;
5236         rnode4_t *nrp;
5237         rnode4_t *drp = VTOR4(dvp);
5238         nfs4_ga_res_t *garp = NULL;
5239         nfs4_error_t e = { 0, NFS4_OK, RPC_SUCCESS };
5240 
5241         ASSERT(nfs_zone() == VTOMI4(dvp)->mi_zone);
5242         ASSERT(nm != NULL);
5243         ASSERT(nm[0] != '\0');
5244         ASSERT(dvp->v_type == VDIR);
5245         ASSERT(nm[0] != '.' || nm[1] != '\0');
5246         ASSERT(*vpp != NULL);
5247 
5248         if (nm[0] == '.' && nm[1] == '.' && nm[2] == '\0') {
5249                 isdotdot = 1;
5250                 args.ctag = TAG_LOOKUP_VPARENT;
5251         } else {
5252                 /*
5253                  * If dvp were a stub, it should have triggered and caused
5254                  * a mount for us to get this far.
5255                  */
5256                 ASSERT(!RP_ISSTUB(VTOR4(dvp)));
5257 
5258                 isdotdot = 0;
5259                 args.ctag = TAG_LOOKUP_VALID;
5260         }
5261 
5262         mi = VTOMI4(dvp);
5263         recov_state.rs_flags = 0;
5264         recov_state.rs_num_retry_despite_err = 0;
5265 
5266         nvp = NULL;
5267 
5268         /* Save the original mount point security information */
5269         (void) save_mnt_secinfo(mi->mi_curr_serv);
5270 
5271 recov_retry:
5272         e.error = nfs4_start_fop(mi, dvp, NULL, OH_LOOKUP,
5273             &recov_state, NULL);
5274         if (e.error) {
5275                 (void) check_mnt_secinfo(mi->mi_curr_serv, nvp);
5276                 VN_RELE(*vpp);
5277                 *vpp = NULL;
5278                 return (e.error);
5279         }
5280 
5281         argop = kmem_alloc(argoplist_size, KM_SLEEP);
5282 
5283         /* PUTFH dfh NVERIFY GETATTR ACCESS LOOKUP GETFH GETATTR */
5284         args.array_len = 7;
5285         args.array = argop;
5286 
5287         /* 0. putfh file */
5288         argop[0].argop = OP_CPUTFH;
5289         argop[0].nfs_argop4_u.opcputfh.sfh = VTOR4(dvp)->r_fh;
5290 
5291         /* 1. nverify the change info */
5292         argop[1].argop = OP_NVERIFY;
5293         ver_fattr = &argop[1].nfs_argop4_u.opnverify.obj_attributes;
5294         ver_fattr->attrmask = FATTR4_CHANGE_MASK;
5295         ver_fattr->attrlist4 = (char *)&dchange;
5296         ptr = (int32_t *)&dchange;
5297         IXDR_PUT_HYPER(ptr, VTOR4(dvp)->r_change);
5298         ver_fattr->attrlist4_len = sizeof (fattr4_change);
5299 
5300         /* 2. getattr directory */
5301         argop[2].argop = OP_GETATTR;
5302         argop[2].nfs_argop4_u.opgetattr.attr_request = NFS4_VATTR_MASK;
5303         argop[2].nfs_argop4_u.opgetattr.mi = VTOMI4(dvp);
5304 
5305         /* 3. access directory */
5306         argop[3].argop = OP_ACCESS;
5307         argop[3].nfs_argop4_u.opaccess.access = ACCESS4_READ | ACCESS4_DELETE |
5308             ACCESS4_MODIFY | ACCESS4_EXTEND | ACCESS4_LOOKUP;
5309 
5310         /* 4. lookup name */
5311         if (isdotdot) {
5312                 argop[4].argop = OP_LOOKUPP;
5313         } else {
5314                 argop[4].argop = OP_CLOOKUP;
5315                 argop[4].nfs_argop4_u.opclookup.cname = nm;
5316         }
5317 
5318         /* 5. resulting file handle */
5319         argop[5].argop = OP_GETFH;
5320 
5321         /* 6. resulting file attributes */
5322         argop[6].argop = OP_GETATTR;
5323         argop[6].nfs_argop4_u.opgetattr.attr_request = NFS4_VATTR_MASK;
5324         argop[6].nfs_argop4_u.opgetattr.mi = VTOMI4(dvp);
5325 
5326         doqueue = 1;
5327         t = gethrtime();
5328 
5329         rfs4call(VTOMI4(dvp), &args, &res, cr, &doqueue, 0, &e);
5330 
5331         if (!isdotdot && res.status == NFS4ERR_MOVED) {
5332                 e.error = nfs4_setup_referral(dvp, nm, vpp, cr);
5333                 if (e.error != 0 && *vpp != NULL)
5334                         VN_RELE(*vpp);
5335                 nfs4_end_fop(mi, dvp, NULL, OH_LOOKUP,
5336                     &recov_state, FALSE);
5337                 (void) xdr_free(xdr_COMPOUND4res_clnt, (caddr_t)&res);
5338                 kmem_free(argop, argoplist_size);
5339                 return (e.error);
5340         }
5341 
5342         if (nfs4_needs_recovery(&e, FALSE, dvp->v_vfsp)) {
5343                 /*
5344                  * For WRONGSEC of a non-dotdot case, send secinfo directly
5345                  * from this thread, do not go thru the recovery thread since
5346                  * we need the nm information.
5347                  *
5348                  * Not doing dotdot case because there is no specification
5349                  * for (PUTFH, SECINFO "..") yet.
5350                  */
5351                 if (!isdotdot && res.status == NFS4ERR_WRONGSEC) {
5352                         if ((e.error = nfs4_secinfo_vnode_otw(dvp, nm, cr)))
5353                                 nfs4_end_fop(mi, dvp, NULL, OH_LOOKUP,
5354                                     &recov_state, FALSE);
5355                         else
5356                                 nfs4_end_fop(mi, dvp, NULL, OH_LOOKUP,
5357                                     &recov_state, TRUE);
5358                         (void) xdr_free(xdr_COMPOUND4res_clnt, (caddr_t)&res);
5359                         kmem_free(argop, argoplist_size);
5360                         if (!e.error)
5361                                 goto recov_retry;
5362                         (void) check_mnt_secinfo(mi->mi_curr_serv, nvp);
5363                         VN_RELE(*vpp);
5364                         *vpp = NULL;
5365                         return (e.error);
5366                 }
5367 
5368                 if (nfs4_start_recovery(&e, mi, dvp, NULL, NULL, NULL,
5369                     OP_LOOKUP, NULL, NULL, NULL) == FALSE) {
5370                         nfs4_end_fop(mi, dvp, NULL, OH_LOOKUP,
5371                             &recov_state, TRUE);
5372 
5373                         (void) xdr_free(xdr_COMPOUND4res_clnt, (caddr_t)&res);
5374                         kmem_free(argop, argoplist_size);
5375                         goto recov_retry;
5376                 }
5377         }
5378 
5379         nfs4_end_fop(mi, dvp, NULL, OH_LOOKUP, &recov_state, FALSE);
5380 
5381         if (e.error || res.array_len == 0) {
5382                 /*
5383                  * If e.error isn't set, then reply has no ops (or we couldn't
5384                  * be here).  The only legal way to reply without an op array
5385                  * is via NFS4ERR_MINOR_VERS_MISMATCH.  An ops array should
5386                  * be in the reply for all other status values.
5387                  *
5388                  * For valid replies without an ops array, return ENOTSUP
5389                  * (geterrno4 xlation of VERS_MISMATCH).  For illegal replies,
5390                  * return EIO -- don't trust status.
5391                  */
5392                 if (e.error == 0)
5393                         e.error = (res.status == NFS4ERR_MINOR_VERS_MISMATCH) ?
5394                             ENOTSUP : EIO;
5395                 VN_RELE(*vpp);
5396                 *vpp = NULL;
5397                 kmem_free(argop, argoplist_size);
5398                 (void) check_mnt_secinfo(mi->mi_curr_serv, nvp);
5399                 return (e.error);
5400         }
5401 
5402         if (res.status != NFS4ERR_SAME) {
5403                 e.error = geterrno4(res.status);
5404 
5405                 /*
5406                  * The NVERIFY "failed" so the directory has changed
5407                  * First make sure PUTFH succeeded and NVERIFY "failed"
5408                  * cleanly.
5409                  */
5410                 if ((res.array[0].nfs_resop4_u.opputfh.status != NFS4_OK) ||
5411                     (res.array[1].nfs_resop4_u.opnverify.status != NFS4_OK)) {
5412                         nfs4_purge_stale_fh(e.error, dvp, cr);
5413                         VN_RELE(*vpp);
5414                         *vpp = NULL;
5415                         goto exit;
5416                 }
5417 
5418                 /*
5419                  * We know the NVERIFY "failed" so we must:
5420                  *      purge the caches (access and indirectly dnlc if needed)
5421                  */
5422                 nfs4_purge_caches(dvp, NFS4_NOPURGE_DNLC, cr, TRUE);
5423 
5424                 if (res.array[2].nfs_resop4_u.opgetattr.status != NFS4_OK) {
5425                         nfs4_purge_stale_fh(e.error, dvp, cr);
5426                         VN_RELE(*vpp);
5427                         *vpp = NULL;
5428                         goto exit;
5429                 }
5430 
5431                 /*
5432                  * Install new cached attributes for the directory
5433                  */
5434                 nfs4_attr_cache(dvp,
5435                     &res.array[2].nfs_resop4_u.opgetattr.ga_res,
5436                     t, cr, FALSE, NULL);
5437 
5438                 if (res.array[3].nfs_resop4_u.opaccess.status != NFS4_OK) {
5439                         nfs4_purge_stale_fh(e.error, dvp, cr);
5440                         VN_RELE(*vpp);
5441                         *vpp = NULL;
5442                         e.error = geterrno4(res.status);
5443                         goto exit;
5444                 }
5445 
5446                 /*
5447                  * Now we know the directory is valid,
5448                  * cache new directory access
5449                  */
5450                 nfs4_access_cache(drp,
5451                     args.array[3].nfs_argop4_u.opaccess.access,
5452                     res.array[3].nfs_resop4_u.opaccess.access, cr);
5453 
5454                 /*
5455                  * recheck VEXEC access
5456                  */
5457                 cacc = nfs4_access_check(drp, ACCESS4_LOOKUP, cr);
5458                 if (cacc != NFS4_ACCESS_ALLOWED) {
5459                         /*
5460                          * Directory permissions might have been revoked
5461                          */
5462                         if (cacc == NFS4_ACCESS_DENIED) {
5463                                 e.error = EACCES;
5464                                 VN_RELE(*vpp);
5465                                 *vpp = NULL;
5466                                 goto exit;
5467                         }
5468 
5469                         /*
5470                          * Somehow we must not have asked for enough
5471                          * so try a singleton ACCESS, should never happen.
5472                          */
5473                         e.error = nfs4_access(dvp, VEXEC, 0, cr, NULL);
5474                         if (e.error) {
5475                                 VN_RELE(*vpp);
5476                                 *vpp = NULL;
5477                                 goto exit;
5478                         }
5479                 }
5480 
5481                 e.error = geterrno4(res.status);
5482                 if (res.array[4].nfs_resop4_u.oplookup.status != NFS4_OK) {
5483                         /*
5484                          * The lookup failed, probably no entry
5485                          */
5486                         if (e.error == ENOENT && nfs4_lookup_neg_cache) {
5487                                 dnlc_update(dvp, nm, DNLC_NO_VNODE);
5488                         } else {
5489                                 /*
5490                                  * Might be some other error, so remove
5491                                  * the dnlc entry to make sure we start all
5492                                  * over again, next time.
5493                                  */
5494                                 dnlc_remove(dvp, nm);
5495                         }
5496                         VN_RELE(*vpp);
5497                         *vpp = NULL;
5498                         goto exit;
5499                 }
5500 
5501                 if (res.array[5].nfs_resop4_u.opgetfh.status != NFS4_OK) {
5502                         /*
5503                          * The file exists but we can't get its fh for
5504                          * some unknown reason.  Remove it from the dnlc
5505                          * and error out to be safe.
5506                          */
5507                         dnlc_remove(dvp, nm);
5508                         VN_RELE(*vpp);
5509                         *vpp = NULL;
5510                         goto exit;
5511                 }
5512                 fhp = &res.array[5].nfs_resop4_u.opgetfh.object;
5513                 if (fhp->nfs_fh4_len == 0) {
5514                         /*
5515                          * The file exists but a bogus fh
5516                          * some unknown reason.  Remove it from the dnlc
5517                          * and error out to be safe.
5518                          */
5519                         e.error = ENOENT;
5520                         dnlc_remove(dvp, nm);
5521                         VN_RELE(*vpp);
5522                         *vpp = NULL;
5523                         goto exit;
5524                 }
5525                 sfhp = sfh4_get(fhp, mi);
5526 
5527                 if (res.array[6].nfs_resop4_u.opgetattr.status == NFS4_OK)
5528                         garp = &res.array[6].nfs_resop4_u.opgetattr.ga_res;
5529 
5530                 /*
5531                  * Make the new rnode
5532                  */
5533                 if (isdotdot) {
5534                         e.error = nfs4_make_dotdot(sfhp, t, dvp, cr, &nvp, 1);
5535                         if (e.error) {
5536                                 sfh4_rele(&sfhp);
5537                                 VN_RELE(*vpp);
5538                                 *vpp = NULL;
5539                                 goto exit;
5540                         }
5541                         /*
5542                          * XXX if nfs4_make_dotdot uses an existing rnode
5543                          * XXX it doesn't update the attributes.
5544                          * XXX for now just save them again to save an OTW
5545                          */
5546                         nfs4_attr_cache(nvp, garp, t, cr, FALSE, NULL);
5547                 } else {
5548                         nvp = makenfs4node(sfhp, garp, dvp->v_vfsp, t, cr,
5549                             dvp, fn_get(VTOSV(dvp)->sv_name, nm, sfhp));
5550                         /*
5551                          * If v_type == VNON, then garp was NULL because
5552                          * the last op in the compound failed and makenfs4node
5553                          * could not find the vnode for sfhp. It created
5554                          * a new vnode, so we have nothing to purge here.
5555                          */
5556                         if (nvp->v_type == VNON) {
5557                                 vattr_t vattr;
5558 
5559                                 vattr.va_mask = AT_TYPE;
5560                                 /*
5561                                  * N.B. We've already called nfs4_end_fop above.
5562                                  */
5563                                 e.error = nfs4getattr(nvp, &vattr, cr);
5564                                 if (e.error) {
5565                                         sfh4_rele(&sfhp);
5566                                         VN_RELE(*vpp);
5567                                         *vpp = NULL;
5568                                         VN_RELE(nvp);
5569                                         goto exit;
5570                                 }
5571                                 nvp->v_type = vattr.va_type;
5572                         }
5573                 }
5574                 sfh4_rele(&sfhp);
5575 
5576                 nrp = VTOR4(nvp);
5577                 mutex_enter(&nrp->r_statev4_lock);
5578                 if (!nrp->created_v4) {
5579                         mutex_exit(&nrp->r_statev4_lock);
5580                         dnlc_update(dvp, nm, nvp);
5581                 } else
5582                         mutex_exit(&nrp->r_statev4_lock);
5583 
5584                 VN_RELE(*vpp);
5585                 *vpp = nvp;
5586         } else {
5587                 hrtime_t now;
5588                 hrtime_t delta = 0;
5589 
5590                 e.error = 0;
5591 
5592                 /*
5593                  * Because the NVERIFY "succeeded" we know that the
5594                  * directory attributes are still valid
5595                  * so update r_time_attr_inval
5596                  */
5597                 now = gethrtime();
5598                 mutex_enter(&drp->r_statelock);
5599                 if (!(mi->mi_flags & MI4_NOAC) && !(dvp->v_flag & VNOCACHE)) {
5600                         delta = now - drp->r_time_attr_saved;
5601                         if (delta < mi->mi_acdirmin)
5602                                 delta = mi->mi_acdirmin;
5603                         else if (delta > mi->mi_acdirmax)
5604                                 delta = mi->mi_acdirmax;
5605                 }
5606                 drp->r_time_attr_inval = now + delta;
5607                 mutex_exit(&drp->r_statelock);
5608                 dnlc_update(dvp, nm, *vpp);
5609 
5610                 /*
5611                  * Even though we have a valid directory attr cache
5612                  * and dnlc entry, we may not have access.
5613                  * This should almost always hit the cache.
5614                  */
5615                 e.error = nfs4_access(dvp, VEXEC, 0, cr, NULL);
5616                 if (e.error) {
5617                         VN_RELE(*vpp);
5618                         *vpp = NULL;
5619                 }
5620 
5621                 if (*vpp == DNLC_NO_VNODE) {
5622                         VN_RELE(*vpp);
5623                         *vpp = NULL;
5624                         e.error = ENOENT;
5625                 }
5626         }
5627 
5628 exit:
5629         (void) xdr_free(xdr_COMPOUND4res_clnt, (caddr_t)&res);
5630         kmem_free(argop, argoplist_size);
5631         (void) check_mnt_secinfo(mi->mi_curr_serv, nvp);
5632         return (e.error);
5633 }
5634 
5635 /*
5636  * We need to go over the wire to lookup the name, but
5637  * while we are there verify the directory has not
5638  * changed but if it has, get new attributes and check access
5639  *
5640  * PUTFH dfh SAVEFH LOOKUP nm GETFH GETATTR RESTOREFH
5641  *                                      NVERIFY GETATTR ACCESS
5642  *
5643  * With the results:
5644  *      if the NVERIFY failed we must purge the caches, add new attributes,
5645  *              and cache new access.
5646  *      set a new r_time_attr_inval
5647  *      add name to dnlc, possibly negative
5648  *      if LOOKUP succeeded
5649  *              cache new attributes
5650  */
5651 static int
5652 nfs4lookupnew_otw(vnode_t *dvp, char *nm, vnode_t **vpp, cred_t *cr)
5653 {
5654         COMPOUND4args_clnt args;
5655         COMPOUND4res_clnt res;
5656         fattr4 *ver_fattr;
5657         fattr4_change dchange;
5658         int32_t *ptr;
5659         nfs4_ga_res_t *garp = NULL;
5660         int argoplist_size  = 9 * sizeof (nfs_argop4);
5661         nfs_argop4 *argop;
5662         int doqueue;
5663         mntinfo4_t *mi;
5664         nfs4_recov_state_t recov_state;
5665         hrtime_t t;
5666         int isdotdot;
5667         vnode_t *nvp;
5668         nfs_fh4 *fhp;
5669         nfs4_sharedfh_t *sfhp;
5670         nfs4_access_type_t cacc;
5671         rnode4_t *nrp;
5672         rnode4_t *drp = VTOR4(dvp);
5673         nfs4_error_t e = { 0, NFS4_OK, RPC_SUCCESS };
5674 
5675         ASSERT(nfs_zone() == VTOMI4(dvp)->mi_zone);
5676         ASSERT(nm != NULL);
5677         ASSERT(nm[0] != '\0');
5678         ASSERT(dvp->v_type == VDIR);
5679         ASSERT(nm[0] != '.' || nm[1] != '\0');
5680         ASSERT(*vpp == NULL);
5681 
5682         if (nm[0] == '.' && nm[1] == '.' && nm[2] == '\0') {
5683                 isdotdot = 1;
5684                 args.ctag = TAG_LOOKUP_PARENT;
5685         } else {
5686                 /*
5687                  * If dvp were a stub, it should have triggered and caused
5688                  * a mount for us to get this far.
5689                  */
5690                 ASSERT(!RP_ISSTUB(VTOR4(dvp)));
5691 
5692                 isdotdot = 0;
5693                 args.ctag = TAG_LOOKUP;
5694         }
5695 
5696         mi = VTOMI4(dvp);
5697         recov_state.rs_flags = 0;
5698         recov_state.rs_num_retry_despite_err = 0;
5699 
5700         nvp = NULL;
5701 
5702         /* Save the original mount point security information */
5703         (void) save_mnt_secinfo(mi->mi_curr_serv);
5704 
5705 recov_retry:
5706         e.error = nfs4_start_fop(mi, dvp, NULL, OH_LOOKUP,
5707             &recov_state, NULL);
5708         if (e.error) {
5709                 (void) check_mnt_secinfo(mi->mi_curr_serv, nvp);
5710                 return (e.error);
5711         }
5712 
5713         argop = kmem_alloc(argoplist_size, KM_SLEEP);
5714 
5715         /* PUTFH SAVEFH LOOKUP GETFH GETATTR RESTOREFH NVERIFY GETATTR ACCESS */
5716         args.array_len = 9;
5717         args.array = argop;
5718 
5719         /* 0. putfh file */
5720         argop[0].argop = OP_CPUTFH;
5721         argop[0].nfs_argop4_u.opcputfh.sfh = VTOR4(dvp)->r_fh;
5722 
5723         /* 1. savefh for the nverify */
5724         argop[1].argop = OP_SAVEFH;
5725 
5726         /* 2. lookup name */
5727         if (isdotdot) {
5728                 argop[2].argop = OP_LOOKUPP;
5729         } else {
5730                 argop[2].argop = OP_CLOOKUP;
5731                 argop[2].nfs_argop4_u.opclookup.cname = nm;
5732         }
5733 
5734         /* 3. resulting file handle */
5735         argop[3].argop = OP_GETFH;
5736 
5737         /* 4. resulting file attributes */
5738         argop[4].argop = OP_GETATTR;
5739         argop[4].nfs_argop4_u.opgetattr.attr_request = NFS4_VATTR_MASK;
5740         argop[4].nfs_argop4_u.opgetattr.mi = VTOMI4(dvp);
5741 
5742         /* 5. restorefh back the directory for the nverify */
5743         argop[5].argop = OP_RESTOREFH;
5744 
5745         /* 6. nverify the change info */
5746         argop[6].argop = OP_NVERIFY;
5747         ver_fattr = &argop[6].nfs_argop4_u.opnverify.obj_attributes;
5748         ver_fattr->attrmask = FATTR4_CHANGE_MASK;
5749         ver_fattr->attrlist4 = (char *)&dchange;
5750         ptr = (int32_t *)&dchange;
5751         IXDR_PUT_HYPER(ptr, VTOR4(dvp)->r_change);
5752         ver_fattr->attrlist4_len = sizeof (fattr4_change);
5753 
5754         /* 7. getattr directory */
5755         argop[7].argop = OP_GETATTR;
5756         argop[7].nfs_argop4_u.opgetattr.attr_request = NFS4_VATTR_MASK;
5757         argop[7].nfs_argop4_u.opgetattr.mi = VTOMI4(dvp);
5758 
5759         /* 8. access directory */
5760         argop[8].argop = OP_ACCESS;
5761         argop[8].nfs_argop4_u.opaccess.access = ACCESS4_READ | ACCESS4_DELETE |
5762             ACCESS4_MODIFY | ACCESS4_EXTEND | ACCESS4_LOOKUP;
5763 
5764         doqueue = 1;
5765         t = gethrtime();
5766 
5767         rfs4call(VTOMI4(dvp), &args, &res, cr, &doqueue, 0, &e);
5768 
5769         if (!isdotdot && res.status == NFS4ERR_MOVED) {
5770                 e.error = nfs4_setup_referral(dvp, nm, vpp, cr);
5771                 if (e.error != 0 && *vpp != NULL)
5772                         VN_RELE(*vpp);
5773                 nfs4_end_fop(mi, dvp, NULL, OH_LOOKUP,
5774                     &recov_state, FALSE);
5775                 (void) xdr_free(xdr_COMPOUND4res_clnt, (caddr_t)&res);
5776                 kmem_free(argop, argoplist_size);
5777                 return (e.error);
5778         }
5779 
5780         if (nfs4_needs_recovery(&e, FALSE, dvp->v_vfsp)) {
5781                 /*
5782                  * For WRONGSEC of a non-dotdot case, send secinfo directly
5783                  * from this thread, do not go thru the recovery thread since
5784                  * we need the nm information.
5785                  *
5786                  * Not doing dotdot case because there is no specification
5787                  * for (PUTFH, SECINFO "..") yet.
5788                  */
5789                 if (!isdotdot && res.status == NFS4ERR_WRONGSEC) {
5790                         if ((e.error = nfs4_secinfo_vnode_otw(dvp, nm, cr)))
5791                                 nfs4_end_fop(mi, dvp, NULL, OH_LOOKUP,
5792                                     &recov_state, FALSE);
5793                         else
5794                                 nfs4_end_fop(mi, dvp, NULL, OH_LOOKUP,
5795                                     &recov_state, TRUE);
5796                         (void) xdr_free(xdr_COMPOUND4res_clnt, (caddr_t)&res);
5797                         kmem_free(argop, argoplist_size);
5798                         if (!e.error)
5799                                 goto recov_retry;
5800                         (void) check_mnt_secinfo(mi->mi_curr_serv, nvp);
5801                         return (e.error);
5802                 }
5803 
5804                 if (nfs4_start_recovery(&e, mi, dvp, NULL, NULL, NULL,
5805                     OP_LOOKUP, NULL, NULL, NULL) == FALSE) {
5806                         nfs4_end_fop(mi, dvp, NULL, OH_LOOKUP,
5807                             &recov_state, TRUE);
5808 
5809                         (void) xdr_free(xdr_COMPOUND4res_clnt, (caddr_t)&res);
5810                         kmem_free(argop, argoplist_size);
5811                         goto recov_retry;
5812                 }
5813         }
5814 
5815         nfs4_end_fop(mi, dvp, NULL, OH_LOOKUP, &recov_state, FALSE);
5816 
5817         if (e.error || res.array_len == 0) {
5818                 /*
5819                  * If e.error isn't set, then reply has no ops (or we couldn't
5820                  * be here).  The only legal way to reply without an op array
5821                  * is via NFS4ERR_MINOR_VERS_MISMATCH.  An ops array should
5822                  * be in the reply for all other status values.
5823                  *
5824                  * For valid replies without an ops array, return ENOTSUP
5825                  * (geterrno4 xlation of VERS_MISMATCH).  For illegal replies,
5826                  * return EIO -- don't trust status.
5827                  */
5828                 if (e.error == 0)
5829                         e.error = (res.status == NFS4ERR_MINOR_VERS_MISMATCH) ?
5830                             ENOTSUP : EIO;
5831 
5832                 kmem_free(argop, argoplist_size);
5833                 (void) check_mnt_secinfo(mi->mi_curr_serv, nvp);
5834                 return (e.error);
5835         }
5836 
5837         e.error = geterrno4(res.status);
5838 
5839         /*
5840          * The PUTFH and SAVEFH may have failed.
5841          */
5842         if ((res.array[0].nfs_resop4_u.opputfh.status != NFS4_OK) ||
5843             (res.array[1].nfs_resop4_u.opsavefh.status != NFS4_OK)) {
5844                 nfs4_purge_stale_fh(e.error, dvp, cr);
5845                 goto exit;
5846         }
5847 
5848         /*
5849          * Check if the file exists, if it does delay entering
5850          * into the dnlc until after we update the directory
5851          * attributes so we don't cause it to get purged immediately.
5852          */
5853         if (res.array[2].nfs_resop4_u.oplookup.status != NFS4_OK) {
5854                 /*
5855                  * The lookup failed, probably no entry
5856                  */
5857                 if (e.error == ENOENT && nfs4_lookup_neg_cache)
5858                         dnlc_update(dvp, nm, DNLC_NO_VNODE);
5859                 goto exit;
5860         }
5861 
5862         if (res.array[3].nfs_resop4_u.opgetfh.status != NFS4_OK) {
5863                 /*
5864                  * The file exists but we can't get its fh for
5865                  * some unknown reason. Error out to be safe.
5866                  */
5867                 goto exit;
5868         }
5869 
5870         fhp = &res.array[3].nfs_resop4_u.opgetfh.object;
5871         if (fhp->nfs_fh4_len == 0) {
5872                 /*
5873                  * The file exists but a bogus fh
5874                  * some unknown reason.  Error out to be safe.
5875                  */
5876                 e.error = EIO;
5877                 goto exit;
5878         }
5879         sfhp = sfh4_get(fhp, mi);
5880 
5881         if (res.array[4].nfs_resop4_u.opgetattr.status != NFS4_OK) {
5882                 sfh4_rele(&sfhp);
5883                 goto exit;
5884         }
5885         garp = &res.array[4].nfs_resop4_u.opgetattr.ga_res;
5886 
5887         /*
5888          * The RESTOREFH may have failed
5889          */
5890         if (res.array[5].nfs_resop4_u.oprestorefh.status != NFS4_OK) {
5891                 sfh4_rele(&sfhp);
5892                 e.error = EIO;
5893                 goto exit;
5894         }
5895 
5896         if (res.array[6].nfs_resop4_u.opnverify.status != NFS4ERR_SAME) {
5897                 /*
5898                  * First make sure the NVERIFY failed as we expected,
5899                  * if it didn't then be conservative and error out
5900                  * as we can't trust the directory.
5901                  */
5902                 if (res.array[6].nfs_resop4_u.opnverify.status != NFS4_OK) {
5903                         sfh4_rele(&sfhp);
5904                         e.error = EIO;
5905                         goto exit;
5906                 }
5907 
5908                 /*
5909                  * We know the NVERIFY "failed" so the directory has changed,
5910                  * so we must:
5911                  *      purge the caches (access and indirectly dnlc if needed)
5912                  */
5913                 nfs4_purge_caches(dvp, NFS4_NOPURGE_DNLC, cr, TRUE);
5914 
5915                 if (res.array[7].nfs_resop4_u.opgetattr.status != NFS4_OK) {
5916                         sfh4_rele(&sfhp);
5917                         goto exit;
5918                 }
5919                 nfs4_attr_cache(dvp,
5920                     &res.array[7].nfs_resop4_u.opgetattr.ga_res,
5921                     t, cr, FALSE, NULL);
5922 
5923                 if (res.array[8].nfs_resop4_u.opaccess.status != NFS4_OK) {
5924                         nfs4_purge_stale_fh(e.error, dvp, cr);
5925                         sfh4_rele(&sfhp);
5926                         e.error = geterrno4(res.status);
5927                         goto exit;
5928                 }
5929 
5930                 /*
5931                  * Now we know the directory is valid,
5932                  * cache new directory access
5933                  */
5934                 nfs4_access_cache(drp,
5935                     args.array[8].nfs_argop4_u.opaccess.access,
5936                     res.array[8].nfs_resop4_u.opaccess.access, cr);
5937 
5938                 /*
5939                  * recheck VEXEC access
5940                  */
5941                 cacc = nfs4_access_check(drp, ACCESS4_LOOKUP, cr);
5942                 if (cacc != NFS4_ACCESS_ALLOWED) {
5943                         /*
5944                          * Directory permissions might have been revoked
5945                          */
5946                         if (cacc == NFS4_ACCESS_DENIED) {
5947                                 sfh4_rele(&sfhp);
5948                                 e.error = EACCES;
5949                                 goto exit;
5950                         }
5951 
5952                         /*
5953                          * Somehow we must not have asked for enough
5954                          * so try a singleton ACCESS should never happen
5955                          */
5956                         e.error = nfs4_access(dvp, VEXEC, 0, cr, NULL);
5957                         if (e.error) {
5958                                 sfh4_rele(&sfhp);
5959                                 goto exit;
5960                         }
5961                 }
5962 
5963                 e.error = geterrno4(res.status);
5964         } else {
5965                 hrtime_t now;
5966                 hrtime_t delta = 0;
5967 
5968                 e.error = 0;
5969 
5970                 /*
5971                  * Because the NVERIFY "succeeded" we know that the
5972                  * directory attributes are still valid
5973                  * so update r_time_attr_inval
5974                  */
5975                 now = gethrtime();
5976                 mutex_enter(&drp->r_statelock);
5977                 if (!(mi->mi_flags & MI4_NOAC) && !(dvp->v_flag & VNOCACHE)) {
5978                         delta = now - drp->r_time_attr_saved;
5979                         if (delta < mi->mi_acdirmin)
5980                                 delta = mi->mi_acdirmin;
5981                         else if (delta > mi->mi_acdirmax)
5982                                 delta = mi->mi_acdirmax;
5983                 }
5984                 drp->r_time_attr_inval = now + delta;
5985                 mutex_exit(&drp->r_statelock);
5986 
5987                 /*
5988                  * Even though we have a valid directory attr cache,
5989                  * we may not have access.
5990                  * This should almost always hit the cache.
5991                  */
5992                 e.error = nfs4_access(dvp, VEXEC, 0, cr, NULL);
5993                 if (e.error) {
5994                         sfh4_rele(&sfhp);
5995                         goto exit;
5996                 }
5997         }
5998 
5999         /*
6000          * Now we have successfully completed the lookup, if the
6001          * directory has changed we now have the valid attributes.
6002          * We also know we have directory access.
6003          * Create the new rnode and insert it in the dnlc.
6004          */
6005         if (isdotdot) {
6006                 e.error = nfs4_make_dotdot(sfhp, t, dvp, cr, &nvp, 1);
6007                 if (e.error) {
6008                         sfh4_rele(&sfhp);
6009                         goto exit;
6010                 }
6011                 /*
6012                  * XXX if nfs4_make_dotdot uses an existing rnode
6013                  * XXX it doesn't update the attributes.
6014                  * XXX for now just save them again to save an OTW
6015                  */
6016                 nfs4_attr_cache(nvp, garp, t, cr, FALSE, NULL);
6017         } else {
6018                 nvp = makenfs4node(sfhp, garp, dvp->v_vfsp, t, cr,
6019                     dvp, fn_get(VTOSV(dvp)->sv_name, nm, sfhp));
6020         }
6021         sfh4_rele(&sfhp);
6022 
6023         nrp = VTOR4(nvp);
6024         mutex_enter(&nrp->r_statev4_lock);
6025         if (!nrp->created_v4) {
6026                 mutex_exit(&nrp->r_statev4_lock);
6027                 dnlc_update(dvp, nm, nvp);
6028         } else
6029                 mutex_exit(&nrp->r_statev4_lock);
6030 
6031         *vpp = nvp;
6032 
6033 exit:
6034         (void) xdr_free(xdr_COMPOUND4res_clnt, (caddr_t)&res);
6035         kmem_free(argop, argoplist_size);
6036         (void) check_mnt_secinfo(mi->mi_curr_serv, nvp);
6037         return (e.error);
6038 }
6039 
6040 #ifdef DEBUG
6041 void
6042 nfs4lookup_dump_compound(char *where, nfs_argop4 *argbase, int argcnt)
6043 {
6044         uint_t i, len;
6045         zoneid_t zoneid = getzoneid();
6046         char *s;
6047 
6048         zcmn_err(zoneid, CE_NOTE, "%s: dumping cmpd", where);
6049         for (i = 0; i < argcnt; i++) {
6050                 nfs_argop4 *op = &argbase[i];
6051                 switch (op->argop) {
6052                 case OP_CPUTFH:
6053                 case OP_PUTFH:
6054                         zcmn_err(zoneid, CE_NOTE, "\t op %d, putfh", i);
6055                         break;
6056                 case OP_PUTROOTFH:
6057                         zcmn_err(zoneid, CE_NOTE, "\t op %d, putrootfh", i);
6058                         break;
6059                 case OP_CLOOKUP:
6060                         s = op->nfs_argop4_u.opclookup.cname;
6061                         zcmn_err(zoneid, CE_NOTE, "\t op %d, lookup %s", i, s);
6062                         break;
6063                 case OP_LOOKUP:
6064                         s = utf8_to_str(&op->nfs_argop4_u.oplookup.objname,
6065                             &len, NULL);
6066                         zcmn_err(zoneid, CE_NOTE, "\t op %d, lookup %s", i, s);
6067                         kmem_free(s, len);
6068                         break;
6069                 case OP_LOOKUPP:
6070                         zcmn_err(zoneid, CE_NOTE, "\t op %d, lookupp ..", i);
6071                         break;
6072                 case OP_GETFH:
6073                         zcmn_err(zoneid, CE_NOTE, "\t op %d, getfh", i);
6074                         break;
6075                 case OP_GETATTR:
6076                         zcmn_err(zoneid, CE_NOTE, "\t op %d, getattr", i);
6077                         break;
6078                 case OP_OPENATTR:
6079                         zcmn_err(zoneid, CE_NOTE, "\t op %d, openattr", i);
6080                         break;
6081                 default:
6082                         zcmn_err(zoneid, CE_NOTE, "\t op %d, opcode %d", i,
6083                             op->argop);
6084                         break;
6085                 }
6086         }
6087 }
6088 #endif
6089 
6090 /*
6091  * nfs4lookup_setup - constructs a multi-lookup compound request.
6092  *
6093  * Given the path "nm1/nm2/.../nmn", the following compound requests
6094  * may be created:
6095  *
6096  * Note: Getfh is not be needed because filehandle attr is mandatory, but it
6097  * is faster, for now.
6098  *
6099  * l4_getattrs indicates the type of compound requested.
6100  *
6101  * LKP4_NO_ATTRIBUTE - no attributes (used by secinfo):
6102  *
6103  *      compound { Put*fh; Lookup {nm1}; Lookup {nm2}; ...  Lookup {nmn} }
6104  *
6105  *   total number of ops is n + 1.
6106  *
6107  * LKP4_LAST_NAMED_ATTR - multi-component path for a named
6108  *      attribute: create lookups plus one OPENATTR/GETFH/GETATTR
6109  *      before the last component, and only get attributes
6110  *      for the last component.  Note that the second-to-last
6111  *      pathname component is XATTR_RPATH, which does NOT go
6112  *      over-the-wire as a lookup.
6113  *
6114  *      compound { Put*fh; Lookup {nm1}; Lookup {nm2}; ... Lookup {nmn-2};
6115  *              Openattr; Getfh; Getattr; Lookup {nmn}; Getfh; Getattr }
6116  *
6117  *   and total number of ops is n + 5.
6118  *
6119  * LKP4_LAST_ATTRDIR - multi-component path for the hidden named
6120  *      attribute directory: create lookups plus an OPENATTR
6121  *      replacing the last lookup.  Note that the last pathname
6122  *      component is XATTR_RPATH, which does NOT go over-the-wire
6123  *      as a lookup.
6124  *
6125  *      compound { Put*fh; Lookup {nm1}; Lookup {nm2}; ... Getfh; Getattr;
6126  *              Openattr; Getfh; Getattr }
6127  *
6128  *   and total number of ops is n + 5.
6129  *
6130  * LKP4_ALL_ATTRIBUTES - create lookups and get attributes for intermediate
6131  *      nodes too.
6132  *
6133  *      compound { Put*fh; Lookup {nm1}; Getfh; Getattr;
6134  *              Lookup {nm2}; ...  Lookup {nmn}; Getfh; Getattr }
6135  *
6136  *   and total number of ops is 3*n + 1.
6137  *
6138  * All cases: returns the index in the arg array of the final LOOKUP op, or
6139  * -1 if no LOOKUPs were used.
6140  */
6141 int
6142 nfs4lookup_setup(char *nm, lookup4_param_t *lookupargp, int needgetfh)
6143 {
6144         enum lkp4_attr_setup l4_getattrs = lookupargp->l4_getattrs;
6145         nfs_argop4 *argbase, *argop;
6146         int arglen, argcnt;
6147         int n = 1;      /* number of components */
6148         int nga = 1;    /* number of Getattr's in request */
6149         char c = '\0', *s, *p;
6150         int lookup_idx = -1;
6151         int argoplist_size;
6152 
6153         /* set lookuparg response result to 0 */
6154         lookupargp->resp->status = NFS4_OK;
6155 
6156         /* skip leading "/" or "." e.g. ".//./" if there is */
6157         for (; ; nm++) {
6158                 if (*nm != '/' && *nm != '.')
6159                         break;
6160 
6161                 /* ".." is counted as 1 component */
6162                 if (*nm == '.' && *(nm + 1) != '/')
6163                         break;
6164         }
6165 
6166         /*
6167          * Find n = number of components - nm must be null terminated
6168          * Skip "." components.
6169          */
6170         if (*nm != '\0')
6171                 for (n = 1, s = nm; *s != '\0'; s++) {
6172                         if ((*s == '/') && (*(s + 1) != '/') &&
6173                             (*(s + 1) != '\0') &&
6174                             !(*(s + 1) == '.' && (*(s + 2) == '/' ||
6175                             *(s + 2) == '\0')))
6176                                 n++;
6177                 }
6178         else
6179                 n = 0;
6180 
6181         /*
6182          * nga is number of components that need Getfh+Getattr
6183          */
6184         switch (l4_getattrs) {
6185         case LKP4_NO_ATTRIBUTES:
6186                 nga = 0;
6187                 break;
6188         case LKP4_ALL_ATTRIBUTES:
6189                 nga = n;
6190                 /*
6191                  * Always have at least 1 getfh, getattr pair
6192                  */
6193                 if (nga == 0)
6194                         nga++;
6195                 break;
6196         case LKP4_LAST_ATTRDIR:
6197         case LKP4_LAST_NAMED_ATTR:
6198                 nga = n+1;
6199                 break;
6200         }
6201 
6202         /*
6203          * If change to use the filehandle attr instead of getfh
6204          * the following line can be deleted.
6205          */
6206         nga *= 2;
6207 
6208         /*
6209          * calculate number of ops in request as
6210          * header + trailer + lookups + getattrs
6211          */
6212         arglen = lookupargp->header_len + lookupargp->trailer_len + n + nga;
6213 
6214         argoplist_size = arglen * sizeof (nfs_argop4);
6215         argop = argbase = kmem_alloc(argoplist_size, KM_SLEEP);
6216         lookupargp->argsp->array = argop;
6217 
6218         argcnt = lookupargp->header_len;
6219         argop += argcnt;
6220 
6221         /*
6222          * loop and create a lookup op and possibly getattr/getfh for
6223          * each component. Skip "." components.
6224          */
6225         for (s = nm; *s != '\0'; s = p) {
6226                 /*
6227                  * Set up a pathname struct for each component if needed
6228                  */
6229                 while (*s == '/')
6230                         s++;
6231                 if (*s == '\0')
6232                         break;
6233 
6234                 for (p = s; (*p != '/') && (*p != '\0'); p++)
6235                         ;
6236                 c = *p;
6237                 *p = '\0';
6238 
6239                 if (s[0] == '.' && s[1] == '\0') {
6240                         *p = c;
6241                         continue;
6242                 }
6243                 if (l4_getattrs == LKP4_LAST_ATTRDIR &&
6244                     strcmp(s, XATTR_RPATH) == 0) {
6245                         /* getfh XXX may not be needed in future */
6246                         argop->argop = OP_GETFH;
6247                         argop++;
6248                         argcnt++;
6249 
6250                         /* getattr */
6251                         argop->argop = OP_GETATTR;
6252                         argop->nfs_argop4_u.opgetattr.attr_request =
6253                             lookupargp->ga_bits;
6254                         argop->nfs_argop4_u.opgetattr.mi =
6255                             lookupargp->mi;
6256                         argop++;
6257                         argcnt++;
6258 
6259                         /* openattr */
6260                         argop->argop = OP_OPENATTR;
6261                 } else if (l4_getattrs == LKP4_LAST_NAMED_ATTR &&
6262                     strcmp(s, XATTR_RPATH) == 0) {
6263                         /* openattr */
6264                         argop->argop = OP_OPENATTR;
6265                         argop++;
6266                         argcnt++;
6267 
6268                         /* getfh XXX may not be needed in future */
6269                         argop->argop = OP_GETFH;
6270                         argop++;
6271                         argcnt++;
6272 
6273                         /* getattr */
6274                         argop->argop = OP_GETATTR;
6275                         argop->nfs_argop4_u.opgetattr.attr_request =
6276                             lookupargp->ga_bits;
6277                         argop->nfs_argop4_u.opgetattr.mi =
6278                             lookupargp->mi;
6279                         argop++;
6280                         argcnt++;
6281                         *p = c;
6282                         continue;
6283                 } else if (s[0] == '.' && s[1] == '.' && s[2] == '\0') {
6284                         /* lookupp */
6285                         argop->argop = OP_LOOKUPP;
6286                 } else {
6287                         /* lookup */
6288                         argop->argop = OP_LOOKUP;
6289                         (void) str_to_utf8(s,
6290                             &argop->nfs_argop4_u.oplookup.objname);
6291                 }
6292                 lookup_idx = argcnt;
6293                 argop++;
6294                 argcnt++;
6295 
6296                 *p = c;
6297 
6298                 if (l4_getattrs == LKP4_ALL_ATTRIBUTES) {
6299                         /* getfh XXX may not be needed in future */
6300                         argop->argop = OP_GETFH;
6301                         argop++;
6302                         argcnt++;
6303 
6304                         /* getattr */
6305                         argop->argop = OP_GETATTR;
6306                         argop->nfs_argop4_u.opgetattr.attr_request =
6307                             lookupargp->ga_bits;
6308                         argop->nfs_argop4_u.opgetattr.mi =
6309                             lookupargp->mi;
6310                         argop++;
6311                         argcnt++;
6312                 }
6313         }
6314 
6315         if ((l4_getattrs != LKP4_NO_ATTRIBUTES) &&
6316             ((l4_getattrs != LKP4_ALL_ATTRIBUTES) || (lookup_idx < 0))) {
6317                 if (needgetfh) {
6318                         /* stick in a post-lookup getfh */
6319                         argop->argop = OP_GETFH;
6320                         argcnt++;
6321                         argop++;
6322                 }
6323                 /* post-lookup getattr */
6324                 argop->argop = OP_GETATTR;
6325                 argop->nfs_argop4_u.opgetattr.attr_request =
6326                     lookupargp->ga_bits;
6327                 argop->nfs_argop4_u.opgetattr.mi = lookupargp->mi;
6328                 argcnt++;
6329         }
6330         argcnt += lookupargp->trailer_len;   /* actual op count */
6331         lookupargp->argsp->array_len = argcnt;
6332         lookupargp->arglen = arglen;
6333 
6334 #ifdef DEBUG
6335         if (nfs4_client_lookup_debug)
6336                 nfs4lookup_dump_compound("nfs4lookup_setup", argbase, argcnt);
6337 #endif
6338 
6339         return (lookup_idx);
6340 }
6341 
6342 static int
6343 nfs4openattr(vnode_t *dvp, vnode_t **avp, int cflag, cred_t *cr)
6344 {
6345         COMPOUND4args_clnt      args;
6346         COMPOUND4res_clnt       res;
6347         GETFH4res       *gf_res = NULL;
6348         nfs_argop4      argop[4];
6349         nfs_resop4      *resop = NULL;
6350         nfs4_sharedfh_t *sfhp;
6351         hrtime_t t;
6352         nfs4_error_t    e;
6353 
6354         rnode4_t        *drp;
6355         int             doqueue = 1;
6356         vnode_t         *vp;
6357         int             needrecov = 0;
6358         nfs4_recov_state_t recov_state;
6359 
6360         ASSERT(nfs_zone() == VTOMI4(dvp)->mi_zone);
6361 
6362         *avp = NULL;
6363         recov_state.rs_flags = 0;
6364         recov_state.rs_num_retry_despite_err = 0;
6365 
6366 recov_retry:
6367         /* COMPOUND: putfh, openattr, getfh, getattr */
6368         args.array_len = 4;
6369         args.array = argop;
6370         args.ctag = TAG_OPENATTR;
6371 
6372         e.error = nfs4_start_op(VTOMI4(dvp), dvp, NULL, &recov_state);
6373         if (e.error)
6374                 return (e.error);
6375 
6376         drp = VTOR4(dvp);
6377 
6378         /* putfh */
6379         argop[0].argop = OP_CPUTFH;
6380         argop[0].nfs_argop4_u.opcputfh.sfh = drp->r_fh;
6381 
6382         /* openattr */
6383         argop[1].argop = OP_OPENATTR;
6384         argop[1].nfs_argop4_u.opopenattr.createdir = (cflag ? TRUE : FALSE);
6385 
6386         /* getfh */
6387         argop[2].argop = OP_GETFH;
6388 
6389         /* getattr */
6390         argop[3].argop = OP_GETATTR;
6391         argop[3].nfs_argop4_u.opgetattr.attr_request = NFS4_VATTR_MASK;
6392         argop[3].nfs_argop4_u.opgetattr.mi = VTOMI4(dvp);
6393 
6394         NFS4_DEBUG(nfs4_client_call_debug, (CE_NOTE,
6395             "nfs4openattr: %s call, drp %s", needrecov ? "recov" : "first",
6396             rnode4info(drp)));
6397 
6398         t = gethrtime();
6399 
6400         rfs4call(VTOMI4(dvp), &args, &res, cr, &doqueue, 0, &e);
6401 
6402         needrecov = nfs4_needs_recovery(&e, FALSE, dvp->v_vfsp);
6403         if (needrecov) {
6404                 bool_t abort;
6405 
6406                 NFS4_DEBUG(nfs4_client_recov_debug, (CE_NOTE,
6407                     "nfs4openattr: initiating recovery\n"));
6408 
6409                 abort = nfs4_start_recovery(&e,
6410                     VTOMI4(dvp), dvp, NULL, NULL, NULL,
6411                     OP_OPENATTR, NULL, NULL, NULL);
6412                 nfs4_end_op(VTOMI4(dvp), dvp, NULL, &recov_state, needrecov);
6413                 if (!e.error) {
6414                         e.error = geterrno4(res.status);
6415                         (void) xdr_free(xdr_COMPOUND4res_clnt, (caddr_t)&res);
6416                 }
6417                 if (abort == FALSE)
6418                         goto recov_retry;
6419                 return (e.error);
6420         }
6421 
6422         if (e.error) {
6423                 nfs4_end_op(VTOMI4(dvp), dvp, NULL, &recov_state, needrecov);
6424                 return (e.error);
6425         }
6426 
6427         if (res.status) {
6428                 /*
6429                  * If OTW errro is NOTSUPP, then it should be
6430                  * translated to EINVAL.  All Solaris file system
6431                  * implementations return EINVAL to the syscall layer
6432                  * when the attrdir cannot be created due to an
6433                  * implementation restriction or noxattr mount option.
6434                  */
6435                 if (res.status == NFS4ERR_NOTSUPP) {
6436                         mutex_enter(&drp->r_statelock);
6437                         if (drp->r_xattr_dir)
6438                                 VN_RELE(drp->r_xattr_dir);
6439                         VN_HOLD(NFS4_XATTR_DIR_NOTSUPP);
6440                         drp->r_xattr_dir = NFS4_XATTR_DIR_NOTSUPP;
6441                         mutex_exit(&drp->r_statelock);
6442 
6443                         e.error = EINVAL;
6444                 } else {
6445                         e.error = geterrno4(res.status);
6446                 }
6447 
6448                 if (e.error) {
6449                         (void) xdr_free(xdr_COMPOUND4res_clnt, (caddr_t)&res);
6450                         nfs4_end_op(VTOMI4(dvp), dvp, NULL, &recov_state,
6451                             needrecov);
6452                         return (e.error);
6453                 }
6454         }
6455 
6456         resop = &res.array[0];  /* putfh res */
6457         ASSERT(resop->nfs_resop4_u.opgetfh.status == NFS4_OK);
6458 
6459         resop = &res.array[1];  /* openattr res */
6460         ASSERT(resop->nfs_resop4_u.opopenattr.status == NFS4_OK);
6461 
6462         resop = &res.array[2];  /* getfh res */
6463         gf_res = &resop->nfs_resop4_u.opgetfh;
6464         if (gf_res->object.nfs_fh4_len == 0) {
6465                 *avp = NULL;
6466                 (void) xdr_free(xdr_COMPOUND4res_clnt, (caddr_t)&res);
6467                 nfs4_end_op(VTOMI4(dvp), dvp, NULL, &recov_state, needrecov);
6468                 return (ENOENT);
6469         }
6470 
6471         sfhp = sfh4_get(&gf_res->object, VTOMI4(dvp));
6472         vp = makenfs4node(sfhp, &res.array[3].nfs_resop4_u.opgetattr.ga_res,
6473             dvp->v_vfsp, t, cr, dvp,
6474             fn_get(VTOSV(dvp)->sv_name, XATTR_RPATH, sfhp));
6475         sfh4_rele(&sfhp);
6476 
6477         if (e.error)
6478                 PURGE_ATTRCACHE4(vp);
6479 
6480         mutex_enter(&vp->v_lock);
6481         vp->v_flag |= V_XATTRDIR;
6482         mutex_exit(&vp->v_lock);
6483 
6484         *avp = vp;
6485 
6486         mutex_enter(&drp->r_statelock);
6487         if (drp->r_xattr_dir)
6488                 VN_RELE(drp->r_xattr_dir);
6489         VN_HOLD(vp);
6490         drp->r_xattr_dir = vp;
6491 
6492         /*
6493          * Invalidate pathconf4 cache because r_xattr_dir is no longer
6494          * NULL.  xattrs could be created at any time, and we have no
6495          * way to update pc4_xattr_exists in the base object if/when
6496          * it happens.
6497          */
6498         drp->r_pathconf.pc4_xattr_valid = 0;
6499 
6500         mutex_exit(&drp->r_statelock);
6501 
6502         nfs4_end_op(VTOMI4(dvp), dvp, NULL, &recov_state, needrecov);
6503 
6504         (void) xdr_free(xdr_COMPOUND4res_clnt, (caddr_t)&res);
6505 
6506         return (0);
6507 }
6508 
6509 /* ARGSUSED */
6510 static int
6511 nfs4_create(vnode_t *dvp, char *nm, struct vattr *va, enum vcexcl exclusive,
6512         int mode, vnode_t **vpp, cred_t *cr, int flags, caller_context_t *ct,
6513         vsecattr_t *vsecp)
6514 {
6515         int error;
6516         vnode_t *vp = NULL;
6517         rnode4_t *rp;
6518         struct vattr vattr;
6519         rnode4_t *drp;
6520         vnode_t *tempvp;
6521         enum createmode4 createmode;
6522         bool_t must_trunc = FALSE;
6523         int     truncating = 0;
6524 
6525         if (nfs_zone() != VTOMI4(dvp)->mi_zone)
6526                 return (EPERM);
6527         if (exclusive == EXCL && (dvp->v_flag & V_XATTRDIR)) {
6528                 return (EINVAL);
6529         }
6530 
6531         /* . and .. have special meaning in the protocol, reject them. */
6532 
6533         if (nm[0] == '.' && (nm[1] == '\0' || (nm[1] == '.' && nm[2] == '\0')))
6534                 return (EISDIR);
6535 
6536         drp = VTOR4(dvp);
6537 
6538         if (nfs_rw_enter_sig(&drp->r_rwlock, RW_WRITER, INTR4(dvp)))
6539                 return (EINTR);
6540 
6541 top:
6542         /*
6543          * We make a copy of the attributes because the caller does not
6544          * expect us to change what va points to.
6545          */
6546         vattr = *va;
6547 
6548         /*
6549          * If the pathname is "", then dvp is the root vnode of
6550          * a remote file mounted over a local directory.
6551          * All that needs to be done is access
6552          * checking and truncation.  Note that we avoid doing
6553          * open w/ create because the parent directory might
6554          * be in pseudo-fs and the open would fail.
6555          */
6556         if (*nm == '\0') {
6557                 error = 0;
6558                 VN_HOLD(dvp);
6559                 vp = dvp;
6560                 must_trunc = TRUE;
6561         } else {
6562                 /*
6563                  * We need to go over the wire, just to be sure whether the
6564                  * file exists or not.  Using the DNLC can be dangerous in
6565                  * this case when making a decision regarding existence.
6566                  */
6567                 error = nfs4lookup(dvp, nm, &vp, cr, 1);
6568         }
6569 
6570         if (exclusive)
6571                 createmode = EXCLUSIVE4;
6572         else
6573                 createmode = GUARDED4;
6574 
6575         /*
6576          * error would be set if the file does not exist on the
6577          * server, so lets go create it.
6578          */
6579         if (error) {
6580                 goto create_otw;
6581         }
6582 
6583         /*
6584          * File does exist on the server
6585          */
6586         if (exclusive == EXCL)
6587                 error = EEXIST;
6588         else if (vp->v_type == VDIR && (mode & VWRITE))
6589                 error = EISDIR;
6590         else {
6591                 /*
6592                  * If vnode is a device, create special vnode.
6593                  */
6594                 if (ISVDEV(vp->v_type)) {
6595                         tempvp = vp;
6596                         vp = specvp(vp, vp->v_rdev, vp->v_type, cr);
6597                         VN_RELE(tempvp);
6598                 }
6599                 if (!(error = VOP_ACCESS(vp, mode, 0, cr, ct))) {
6600                         if ((vattr.va_mask & AT_SIZE) &&
6601                             vp->v_type == VREG) {
6602                                 rp = VTOR4(vp);
6603                                 /*
6604                                  * Check here for large file handled
6605                                  * by LF-unaware process (as
6606                                  * ufs_create() does)
6607                                  */
6608                                 if (!(flags & FOFFMAX)) {
6609                                         mutex_enter(&rp->r_statelock);
6610                                         if (rp->r_size > MAXOFF32_T)
6611                                                 error = EOVERFLOW;
6612                                         mutex_exit(&rp->r_statelock);
6613                                 }
6614 
6615                                 /* if error is set then we need to return */
6616                                 if (error) {
6617                                         nfs_rw_exit(&drp->r_rwlock);
6618                                         VN_RELE(vp);
6619                                         return (error);
6620                                 }
6621 
6622                                 if (must_trunc) {
6623                                         vattr.va_mask = AT_SIZE;
6624                                         error = nfs4setattr(vp, &vattr, 0, cr,
6625                                             NULL);
6626                                 } else {
6627                                 /*
6628                                  * we know we have a regular file that already
6629                                  * exists and we may end up truncating the file
6630                                  * as a result of the open_otw, so flush out
6631                                  * any dirty pages for this file first.
6632                                  */
6633                                         if (nfs4_has_pages(vp) &&
6634                                             ((rp->r_flags & R4DIRTY) ||
6635                                             rp->r_count > 0 ||
6636                                             rp->r_mapcnt > 0)) {
6637                                                 error = nfs4_putpage(vp,
6638                                                     (offset_t)0, 0, 0, cr, ct);
6639                                                 if (error && (error == ENOSPC ||
6640                                                     error == EDQUOT)) {
6641                                                         mutex_enter(
6642                                                             &rp->r_statelock);
6643                                                         if (!rp->r_error)
6644                                                                 rp->r_error =
6645                                                                     error;
6646                                                         mutex_exit(
6647                                                             &rp->r_statelock);
6648                                                 }
6649                                         }
6650                                         vattr.va_mask = (AT_SIZE |
6651                                             AT_TYPE | AT_MODE);
6652                                         vattr.va_type = VREG;
6653                                         createmode = UNCHECKED4;
6654                                         truncating = 1;
6655                                         goto create_otw;
6656                                 }
6657                         }
6658                 }
6659         }
6660         nfs_rw_exit(&drp->r_rwlock);
6661         if (error) {
6662                 VN_RELE(vp);
6663         } else {
6664                 vnode_t *tvp;
6665                 rnode4_t *trp;
6666                 tvp = vp;
6667                 if (vp->v_type == VREG) {
6668                         trp = VTOR4(vp);
6669                         if (IS_SHADOW(vp, trp))
6670                                 tvp = RTOV4(trp);
6671                 }
6672 
6673                 if (must_trunc) {
6674                         /*
6675                          * existing file got truncated, notify.
6676                          */
6677                         vnevent_create(tvp, ct);
6678                 }
6679 
6680                 *vpp = vp;
6681         }
6682         return (error);
6683 
6684 create_otw:
6685         dnlc_remove(dvp, nm);
6686 
6687         ASSERT(vattr.va_mask & AT_TYPE);
6688 
6689         /*
6690          * If not a regular file let nfs4mknod() handle it.
6691          */
6692         if (vattr.va_type != VREG) {
6693                 error = nfs4mknod(dvp, nm, &vattr, exclusive, mode, vpp, cr);
6694                 nfs_rw_exit(&drp->r_rwlock);
6695                 return (error);
6696         }
6697 
6698         /*
6699          * It _is_ a regular file.
6700          */
6701         ASSERT(vattr.va_mask & AT_MODE);
6702         if (MANDMODE(vattr.va_mode)) {
6703                 nfs_rw_exit(&drp->r_rwlock);
6704                 return (EACCES);
6705         }
6706 
6707         /*
6708          * If this happens to be a mknod of a regular file, then flags will
6709          * have neither FREAD or FWRITE.  However, we must set at least one
6710          * for the call to nfs4open_otw.  If it's open(O_CREAT) driving
6711          * nfs4_create, then either FREAD, FWRITE, or FRDWR has already been
6712          * set (based on openmode specified by app).
6713          */
6714         if ((flags & (FREAD|FWRITE)) == 0)
6715                 flags |= (FREAD|FWRITE);
6716 
6717         error = nfs4open_otw(dvp, nm, &vattr, vpp, cr, 1, flags, createmode, 0);
6718 
6719         if (vp != NULL) {
6720                 /* if create was successful, throw away the file's pages */
6721                 if (!error && (vattr.va_mask & AT_SIZE))
6722                         nfs4_invalidate_pages(vp, (vattr.va_size & PAGEMASK),
6723                             cr);
6724                 /* release the lookup hold */
6725                 VN_RELE(vp);
6726                 vp = NULL;
6727         }
6728 
6729         /*
6730          * validate that we opened a regular file. This handles a misbehaving
6731          * server that returns an incorrect FH.
6732          */
6733         if ((error == 0) && *vpp && (*vpp)->v_type != VREG) {
6734                 error = EISDIR;
6735                 VN_RELE(*vpp);
6736         }
6737 
6738         /*
6739          * If this is not an exclusive create, then the CREATE
6740          * request will be made with the GUARDED mode set.  This
6741          * means that the server will return EEXIST if the file
6742          * exists.  The file could exist because of a retransmitted
6743          * request.  In this case, we recover by starting over and
6744          * checking to see whether the file exists.  This second
6745          * time through it should and a CREATE request will not be
6746          * sent.
6747          *
6748          * This handles the problem of a dangling CREATE request
6749          * which contains attributes which indicate that the file
6750          * should be truncated.  This retransmitted request could
6751          * possibly truncate valid data in the file if not caught
6752          * by the duplicate request mechanism on the server or if
6753          * not caught by other means.  The scenario is:
6754          *
6755          * Client transmits CREATE request with size = 0
6756          * Client times out, retransmits request.
6757          * Response to the first request arrives from the server
6758          *  and the client proceeds on.
6759          * Client writes data to the file.
6760          * The server now processes retransmitted CREATE request
6761          *  and truncates file.
6762          *
6763          * The use of the GUARDED CREATE request prevents this from
6764          * happening because the retransmitted CREATE would fail
6765          * with EEXIST and would not truncate the file.
6766          */
6767         if (error == EEXIST && exclusive == NONEXCL) {
6768 #ifdef DEBUG
6769                 nfs4_create_misses++;
6770 #endif
6771                 goto top;
6772         }
6773         nfs_rw_exit(&drp->r_rwlock);
6774         if (truncating && !error && *vpp) {
6775                 vnode_t *tvp;
6776                 rnode4_t *trp;
6777                 /*
6778                  * existing file got truncated, notify.
6779                  */
6780                 tvp = *vpp;
6781                 trp = VTOR4(tvp);
6782                 if (IS_SHADOW(tvp, trp))
6783                         tvp = RTOV4(trp);
6784                 vnevent_create(tvp, ct);
6785         }
6786         return (error);
6787 }
6788 
6789 /*
6790  * Create compound (for mkdir, mknod, symlink):
6791  * { Putfh <dfh>; Create; Getfh; Getattr }
6792  * It's okay if setattr failed to set gid - this is not considered
6793  * an error, but purge attrs in that case.
6794  */
6795 static int
6796 call_nfs4_create_req(vnode_t *dvp, char *nm, void *data, struct vattr *va,
6797     vnode_t **vpp, cred_t *cr, nfs_ftype4 type)
6798 {
6799         int need_end_op = FALSE;
6800         COMPOUND4args_clnt args;
6801         COMPOUND4res_clnt res, *resp = NULL;
6802         nfs_argop4 *argop;
6803         nfs_resop4 *resop;
6804         int doqueue;
6805         mntinfo4_t *mi;
6806         rnode4_t *drp = VTOR4(dvp);
6807         change_info4 *cinfo;
6808         GETFH4res *gf_res;
6809         struct vattr vattr;
6810         vnode_t *vp;
6811         fattr4 *crattr;
6812         bool_t needrecov = FALSE;
6813         nfs4_recov_state_t recov_state;
6814         nfs4_sharedfh_t *sfhp = NULL;
6815         hrtime_t t;
6816         nfs4_error_t e = { 0, NFS4_OK, RPC_SUCCESS };
6817         int numops, argoplist_size, setgid_flag, idx_create, idx_fattr;
6818         dirattr_info_t dinfo, *dinfop;
6819         servinfo4_t *svp;
6820         bitmap4 supp_attrs;
6821 
6822         ASSERT(type == NF4DIR || type == NF4LNK || type == NF4BLK ||
6823             type == NF4CHR || type == NF4SOCK || type == NF4FIFO);
6824 
6825         mi = VTOMI4(dvp);
6826 
6827         /*
6828          * Make sure we properly deal with setting the right gid
6829          * on a new directory to reflect the parent's setgid bit
6830          */
6831         setgid_flag = 0;
6832         if (type == NF4DIR) {
6833                 struct vattr dva;
6834 
6835                 va->va_mode &= ~VSGID;
6836                 dva.va_mask = AT_MODE | AT_GID;
6837                 if (VOP_GETATTR(dvp, &dva, 0, cr, NULL) == 0) {
6838 
6839                         /*
6840                          * If the parent's directory has the setgid bit set
6841                          * _and_ the client was able to get a valid mapping
6842                          * for the parent dir's owner_group, we want to
6843                          * append NVERIFY(owner_group == dva.va_gid) and
6844                          * SETTATTR to the CREATE compound.
6845                          */
6846                         if (mi->mi_flags & MI4_GRPID || dva.va_mode & VSGID) {
6847                                 setgid_flag = 1;
6848                                 va->va_mode |= VSGID;
6849                                 if (dva.va_gid != GID_NOBODY) {
6850                                         va->va_mask |= AT_GID;
6851                                         va->va_gid = dva.va_gid;
6852                                 }
6853                         }
6854                 }
6855         }
6856 
6857         /*
6858          * Create ops:
6859          *      0:putfh(dir) 1:savefh(dir) 2:create 3:getfh(new) 4:getattr(new)
6860          *      5:restorefh(dir) 6:getattr(dir)
6861          *
6862          * if (setgid)
6863          *      0:putfh(dir) 1:create 2:getfh(new) 3:getattr(new)
6864          *      4:savefh(new) 5:putfh(dir) 6:getattr(dir) 7:restorefh(new)
6865          *      8:nverify 9:setattr
6866          */
6867         if (setgid_flag) {
6868                 numops = 10;
6869                 idx_create = 1;
6870                 idx_fattr = 3;
6871         } else {
6872                 numops = 7;
6873                 idx_create = 2;
6874                 idx_fattr = 4;
6875         }
6876 
6877         ASSERT(nfs_zone() == mi->mi_zone);
6878         if (nfs_rw_enter_sig(&drp->r_rwlock, RW_WRITER, INTR4(dvp))) {
6879                 return (EINTR);
6880         }
6881         recov_state.rs_flags = 0;
6882         recov_state.rs_num_retry_despite_err = 0;
6883 
6884         argoplist_size = numops * sizeof (nfs_argop4);
6885         argop = kmem_alloc(argoplist_size, KM_SLEEP);
6886 
6887 recov_retry:
6888         if (type == NF4LNK)
6889                 args.ctag = TAG_SYMLINK;
6890         else if (type == NF4DIR)
6891                 args.ctag = TAG_MKDIR;
6892         else
6893                 args.ctag = TAG_MKNOD;
6894 
6895         args.array_len = numops;
6896         args.array = argop;
6897 
6898         if (e.error = nfs4_start_op(mi, dvp, NULL, &recov_state)) {
6899                 nfs_rw_exit(&drp->r_rwlock);
6900                 kmem_free(argop, argoplist_size);
6901                 return (e.error);
6902         }
6903         need_end_op = TRUE;
6904 
6905 
6906         /* 0: putfh directory */
6907         argop[0].argop = OP_CPUTFH;
6908         argop[0].nfs_argop4_u.opcputfh.sfh = drp->r_fh;
6909 
6910         /* 1/2: Create object */
6911         argop[idx_create].argop = OP_CCREATE;
6912         argop[idx_create].nfs_argop4_u.opccreate.cname = nm;
6913         argop[idx_create].nfs_argop4_u.opccreate.type = type;
6914         if (type == NF4LNK) {
6915                 /*
6916                  * symlink, treat name as data
6917                  */
6918                 ASSERT(data != NULL);
6919                 argop[idx_create].nfs_argop4_u.opccreate.ftype4_u.clinkdata =
6920                     (char *)data;
6921         }
6922         if (type == NF4BLK || type == NF4CHR) {
6923                 ASSERT(data != NULL);
6924                 argop[idx_create].nfs_argop4_u.opccreate.ftype4_u.devdata =
6925                     *((specdata4 *)data);
6926         }
6927 
6928         crattr = &argop[idx_create].nfs_argop4_u.opccreate.createattrs;
6929 
6930         svp = drp->r_server;
6931         (void) nfs_rw_enter_sig(&svp->sv_lock, RW_READER, 0);
6932         supp_attrs = svp->sv_supp_attrs;
6933         nfs_rw_exit(&svp->sv_lock);
6934 
6935         if (vattr_to_fattr4(va, NULL, crattr, 0, OP_CREATE, supp_attrs)) {
6936                 nfs_rw_exit(&drp->r_rwlock);
6937                 nfs4_end_op(mi, dvp, NULL, &recov_state, needrecov);
6938                 e.error = EINVAL;
6939                 kmem_free(argop, argoplist_size);
6940                 return (e.error);
6941         }
6942 
6943         /* 2/3: getfh fh of created object */
6944         ASSERT(idx_create + 1 == idx_fattr - 1);
6945         argop[idx_create + 1].argop = OP_GETFH;
6946 
6947         /* 3/4: getattr of new object */
6948         argop[idx_fattr].argop = OP_GETATTR;
6949         argop[idx_fattr].nfs_argop4_u.opgetattr.attr_request = NFS4_VATTR_MASK;
6950         argop[idx_fattr].nfs_argop4_u.opgetattr.mi = mi;
6951 
6952         if (setgid_flag) {
6953                 vattr_t _v;
6954 
6955                 argop[4].argop = OP_SAVEFH;
6956 
6957                 argop[5].argop = OP_CPUTFH;
6958                 argop[5].nfs_argop4_u.opcputfh.sfh = drp->r_fh;
6959 
6960                 argop[6].argop = OP_GETATTR;
6961                 argop[6].nfs_argop4_u.opgetattr.attr_request = NFS4_VATTR_MASK;
6962                 argop[6].nfs_argop4_u.opgetattr.mi = mi;
6963 
6964                 argop[7].argop = OP_RESTOREFH;
6965 
6966                 /*
6967                  * nverify
6968                  *
6969                  * XXX - Revisit the last argument to nfs4_end_op()
6970                  *       once 5020486 is fixed.
6971                  */
6972                 _v.va_mask = AT_GID;
6973                 _v.va_gid = va->va_gid;
6974                 if (e.error = nfs4args_verify(&argop[8], &_v, OP_NVERIFY,
6975                     supp_attrs)) {
6976                         nfs4_end_op(mi, dvp, *vpp, &recov_state, TRUE);
6977                         nfs_rw_exit(&drp->r_rwlock);
6978                         nfs4_fattr4_free(crattr);
6979                         kmem_free(argop, argoplist_size);
6980                         return (e.error);
6981                 }
6982 
6983                 /*
6984                  * setattr
6985                  *
6986                  * We _know_ we're not messing with AT_SIZE or AT_XTIME,
6987                  * so no need for stateid or flags. Also we specify NULL
6988                  * rp since we're only interested in setting owner_group
6989                  * attributes.
6990                  */
6991                 nfs4args_setattr(&argop[9], &_v, NULL, 0, NULL, cr, supp_attrs,
6992                     &e.error, 0);
6993 
6994                 if (e.error) {
6995                         nfs4_end_op(mi, dvp, *vpp, &recov_state, TRUE);
6996                         nfs_rw_exit(&drp->r_rwlock);
6997                         nfs4_fattr4_free(crattr);
6998                         nfs4args_verify_free(&argop[8]);
6999                         kmem_free(argop, argoplist_size);
7000                         return (e.error);
7001                 }
7002         } else {
7003                 argop[1].argop = OP_SAVEFH;
7004 
7005                 argop[5].argop = OP_RESTOREFH;
7006 
7007                 argop[6].argop = OP_GETATTR;
7008                 argop[6].nfs_argop4_u.opgetattr.attr_request = NFS4_VATTR_MASK;
7009                 argop[6].nfs_argop4_u.opgetattr.mi = mi;
7010         }
7011 
7012         dnlc_remove(dvp, nm);
7013 
7014         doqueue = 1;
7015         t = gethrtime();
7016         rfs4call(mi, &args, &res, cr, &doqueue, 0, &e);
7017 
7018         needrecov = nfs4_needs_recovery(&e, FALSE, mi->mi_vfsp);
7019         if (e.error) {
7020                 PURGE_ATTRCACHE4(dvp);
7021                 if (!needrecov)
7022                         goto out;
7023         }
7024 
7025         if (needrecov) {
7026                 if (nfs4_start_recovery(&e, mi, dvp, NULL, NULL, NULL,
7027                     OP_CREATE, NULL, NULL, NULL) == FALSE) {
7028                         nfs4_end_op(mi, dvp, NULL, &recov_state,
7029                             needrecov);
7030                         need_end_op = FALSE;
7031                         nfs4_fattr4_free(crattr);
7032                         if (setgid_flag) {
7033                                 nfs4args_verify_free(&argop[8]);
7034                                 nfs4args_setattr_free(&argop[9]);
7035                         }
7036                         (void) xdr_free(xdr_COMPOUND4res_clnt, (caddr_t)&res);
7037                         goto recov_retry;
7038                 }
7039         }
7040 
7041         resp = &res;
7042 
7043         if (res.status != NFS4_OK && res.array_len <= idx_fattr + 1) {
7044 
7045                 if (res.status == NFS4ERR_BADOWNER)
7046                         nfs4_log_badowner(mi, OP_CREATE);
7047 
7048                 e.error = geterrno4(res.status);
7049 
7050                 /*
7051                  * This check is left over from when create was implemented
7052                  * using a setattr op (instead of createattrs).  If the
7053                  * putfh/create/getfh failed, the error was returned.  If
7054                  * setattr/getattr failed, we keep going.
7055                  *
7056                  * It might be better to get rid of the GETFH also, and just
7057                  * do PUTFH/CREATE/GETATTR since the FH attr is mandatory.
7058                  * Then if any of the operations failed, we could return the
7059                  * error now, and remove much of the error code below.
7060                  */
7061                 if (res.array_len <= idx_fattr) {
7062                         /*
7063                          * Either Putfh, Create or Getfh failed.
7064                          */
7065                         PURGE_ATTRCACHE4(dvp);
7066                         /*
7067                          * nfs4_purge_stale_fh() may generate otw calls through
7068                          * nfs4_invalidate_pages. Hence the need to call
7069                          * nfs4_end_op() here to avoid nfs4_start_op() deadlock.
7070                          */
7071                         nfs4_end_op(mi, dvp, NULL, &recov_state,
7072                             needrecov);
7073                         need_end_op = FALSE;
7074                         nfs4_purge_stale_fh(e.error, dvp, cr);
7075                         goto out;
7076                 }
7077         }
7078 
7079         resop = &res.array[idx_create];     /* create res */
7080         cinfo = &resop->nfs_resop4_u.opcreate.cinfo;
7081 
7082         resop = &res.array[idx_create + 1]; /* getfh res */
7083         gf_res = &resop->nfs_resop4_u.opgetfh;
7084 
7085         sfhp = sfh4_get(&gf_res->object, mi);
7086         if (e.error) {
7087                 *vpp = vp = makenfs4node(sfhp, NULL, dvp->v_vfsp, t, cr, dvp,
7088                     fn_get(VTOSV(dvp)->sv_name, nm, sfhp));
7089                 if (vp->v_type == VNON) {
7090                         vattr.va_mask = AT_TYPE;
7091                         /*
7092                          * Need to call nfs4_end_op before nfs4getattr to avoid
7093                          * potential nfs4_start_op deadlock. See RFE 4777612.
7094                          */
7095                         nfs4_end_op(mi, dvp, NULL, &recov_state,
7096                             needrecov);
7097                         need_end_op = FALSE;
7098                         e.error = nfs4getattr(vp, &vattr, cr);
7099                         if (e.error) {
7100                                 VN_RELE(vp);
7101                                 *vpp = NULL;
7102                                 goto out;
7103                         }
7104                         vp->v_type = vattr.va_type;
7105                 }
7106                 e.error = 0;
7107         } else {
7108                 *vpp = vp = makenfs4node(sfhp,
7109                     &res.array[idx_fattr].nfs_resop4_u.opgetattr.ga_res,
7110                     dvp->v_vfsp, t, cr,
7111                     dvp, fn_get(VTOSV(dvp)->sv_name, nm, sfhp));
7112         }
7113 
7114         /*
7115          * If compound succeeded, then update dir attrs
7116          */
7117         if (res.status == NFS4_OK) {
7118                 dinfo.di_garp = &res.array[6].nfs_resop4_u.opgetattr.ga_res;
7119                 dinfo.di_cred = cr;
7120                 dinfo.di_time_call = t;
7121                 dinfop = &dinfo;
7122         } else
7123                 dinfop = NULL;
7124 
7125         /* Update directory cache attribute, readdir and dnlc caches */
7126         nfs4_update_dircaches(cinfo, dvp, vp, nm, dinfop);
7127 
7128 out:
7129         if (sfhp != NULL)
7130                 sfh4_rele(&sfhp);
7131         nfs_rw_exit(&drp->r_rwlock);
7132         nfs4_fattr4_free(crattr);
7133         if (setgid_flag) {
7134                 nfs4args_verify_free(&argop[8]);
7135                 nfs4args_setattr_free(&argop[9]);
7136         }
7137         if (resp)
7138                 (void) xdr_free(xdr_COMPOUND4res_clnt, (caddr_t)resp);
7139         if (need_end_op)
7140                 nfs4_end_op(mi, dvp, NULL, &recov_state, needrecov);
7141 
7142         kmem_free(argop, argoplist_size);
7143         return (e.error);
7144 }
7145 
7146 /* ARGSUSED */
7147 static int
7148 nfs4mknod(vnode_t *dvp, char *nm, struct vattr *va, enum vcexcl exclusive,
7149     int mode, vnode_t **vpp, cred_t *cr)
7150 {
7151         int error;
7152         vnode_t *vp;
7153         nfs_ftype4 type;
7154         specdata4 spec, *specp = NULL;
7155 
7156         ASSERT(nfs_zone() == VTOMI4(dvp)->mi_zone);
7157 
7158         switch (va->va_type) {
7159         case VCHR:
7160         case VBLK:
7161                 type = (va->va_type == VCHR) ? NF4CHR : NF4BLK;
7162                 spec.specdata1 = getmajor(va->va_rdev);
7163                 spec.specdata2 = getminor(va->va_rdev);
7164                 specp = &spec;
7165                 break;
7166 
7167         case VFIFO:
7168                 type = NF4FIFO;
7169                 break;
7170         case VSOCK:
7171                 type = NF4SOCK;
7172                 break;
7173 
7174         default:
7175                 return (EINVAL);
7176         }
7177 
7178         error = call_nfs4_create_req(dvp, nm, specp, va, &vp, cr, type);
7179         if (error) {
7180                 return (error);
7181         }
7182 
7183         /*
7184          * This might not be needed any more; special case to deal
7185          * with problematic v2/v3 servers.  Since create was unable
7186          * to set group correctly, not sure what hope setattr has.
7187          */
7188         if (va->va_gid != VTOR4(vp)->r_attr.va_gid) {
7189                 va->va_mask = AT_GID;
7190                 (void) nfs4setattr(vp, va, 0, cr, NULL);
7191         }
7192 
7193         /*
7194          * If vnode is a device create special vnode
7195          */
7196         if (ISVDEV(vp->v_type)) {
7197                 *vpp = specvp(vp, vp->v_rdev, vp->v_type, cr);
7198                 VN_RELE(vp);
7199         } else {
7200                 *vpp = vp;
7201         }
7202         return (error);
7203 }
7204 
7205 /*
7206  * Remove requires that the current fh be the target directory.
7207  * After the operation, the current fh is unchanged.
7208  * The compound op structure is:
7209  *      PUTFH(targetdir), REMOVE
7210  *
7211  * Weirdness: if the vnode to be removed is open
7212  * we rename it instead of removing it and nfs_inactive
7213  * will remove the new name.
7214  */
7215 /* ARGSUSED */
7216 static int
7217 nfs4_remove(vnode_t *dvp, char *nm, cred_t *cr, caller_context_t *ct, int flags)
7218 {
7219         COMPOUND4args_clnt args;
7220         COMPOUND4res_clnt res, *resp = NULL;
7221         REMOVE4res *rm_res;
7222         nfs_argop4 argop[3];
7223         nfs_resop4 *resop;
7224         vnode_t *vp;
7225         char *tmpname;
7226         int doqueue;
7227         mntinfo4_t *mi;
7228         rnode4_t *rp;
7229         rnode4_t *drp;
7230         int needrecov = 0;
7231         nfs4_recov_state_t recov_state;
7232         int isopen;
7233         nfs4_error_t e = { 0, NFS4_OK, RPC_SUCCESS };
7234         dirattr_info_t dinfo;
7235 
7236         if (nfs_zone() != VTOMI4(dvp)->mi_zone)
7237                 return (EPERM);
7238         drp = VTOR4(dvp);
7239         if (nfs_rw_enter_sig(&drp->r_rwlock, RW_WRITER, INTR4(dvp)))
7240                 return (EINTR);
7241 
7242         e.error = nfs4lookup(dvp, nm, &vp, cr, 0);
7243         if (e.error) {
7244                 nfs_rw_exit(&drp->r_rwlock);
7245                 return (e.error);
7246         }
7247 
7248         if (vp->v_type == VDIR) {
7249                 VN_RELE(vp);
7250                 nfs_rw_exit(&drp->r_rwlock);
7251                 return (EISDIR);
7252         }
7253 
7254         /*
7255          * First just remove the entry from the name cache, as it
7256          * is most likely the only entry for this vp.
7257          */
7258         dnlc_remove(dvp, nm);
7259 
7260         rp = VTOR4(vp);
7261 
7262         /*
7263          * For regular file types, check to see if the file is open by looking
7264          * at the open streams.
7265          * For all other types, check the reference count on the vnode.  Since
7266          * they are not opened OTW they never have an open stream.
7267          *
7268          * If the file is open, rename it to .nfsXXXX.
7269          */
7270         if (vp->v_type != VREG) {
7271                 /*
7272                  * If the file has a v_count > 1 then there may be more than one
7273                  * entry in the name cache due multiple links or an open file,
7274                  * but we don't have the real reference count so flush all
7275                  * possible entries.
7276                  */
7277                 if (vp->v_count > 1)
7278                         dnlc_purge_vp(vp);
7279 
7280                 /*
7281                  * Now we have the real reference count.
7282                  */
7283                 isopen = vp->v_count > 1;
7284         } else {
7285                 mutex_enter(&rp->r_os_lock);
7286                 isopen = list_head(&rp->r_open_streams) != NULL;
7287                 mutex_exit(&rp->r_os_lock);
7288         }
7289 
7290         mutex_enter(&rp->r_statelock);
7291         if (isopen &&
7292             (rp->r_unldvp == NULL || strcmp(nm, rp->r_unlname) == 0)) {
7293                 mutex_exit(&rp->r_statelock);
7294                 tmpname = newname();
7295                 e.error = nfs4rename(dvp, nm, dvp, tmpname, cr, ct);
7296                 if (e.error)
7297                         kmem_free(tmpname, MAXNAMELEN);
7298                 else {
7299                         mutex_enter(&rp->r_statelock);
7300                         if (rp->r_unldvp == NULL) {
7301                                 VN_HOLD(dvp);
7302                                 rp->r_unldvp = dvp;
7303                                 if (rp->r_unlcred != NULL)
7304                                         crfree(rp->r_unlcred);
7305                                 crhold(cr);
7306                                 rp->r_unlcred = cr;
7307                                 rp->r_unlname = tmpname;
7308                         } else {
7309                                 kmem_free(rp->r_unlname, MAXNAMELEN);
7310                                 rp->r_unlname = tmpname;
7311                         }
7312                         mutex_exit(&rp->r_statelock);
7313                 }
7314                 VN_RELE(vp);
7315                 nfs_rw_exit(&drp->r_rwlock);
7316                 return (e.error);
7317         }
7318         /*
7319          * Actually remove the file/dir
7320          */
7321         mutex_exit(&rp->r_statelock);
7322 
7323         /*
7324          * We need to flush any dirty pages which happen to
7325          * be hanging around before removing the file.
7326          * This shouldn't happen very often since in NFSv4
7327          * we should be close to open consistent.
7328          */
7329         if (nfs4_has_pages(vp) &&
7330             ((rp->r_flags & R4DIRTY) || rp->r_count > 0)) {
7331                 e.error = nfs4_putpage(vp, (u_offset_t)0, 0, 0, cr, ct);
7332                 if (e.error && (e.error == ENOSPC || e.error == EDQUOT)) {
7333                         mutex_enter(&rp->r_statelock);
7334                         if (!rp->r_error)
7335                                 rp->r_error = e.error;
7336                         mutex_exit(&rp->r_statelock);
7337                 }
7338         }
7339 
7340         mi = VTOMI4(dvp);
7341 
7342         (void) nfs4delegreturn(rp, NFS4_DR_REOPEN);
7343         recov_state.rs_flags = 0;
7344         recov_state.rs_num_retry_despite_err = 0;
7345 
7346 recov_retry:
7347         /*
7348          * Remove ops: putfh dir; remove
7349          */
7350         args.ctag = TAG_REMOVE;
7351         args.array_len = 3;
7352         args.array = argop;
7353 
7354         e.error = nfs4_start_op(VTOMI4(dvp), dvp, NULL, &recov_state);
7355         if (e.error) {
7356                 nfs_rw_exit(&drp->r_rwlock);
7357                 VN_RELE(vp);
7358                 return (e.error);
7359         }
7360 
7361         /* putfh directory */
7362         argop[0].argop = OP_CPUTFH;
7363         argop[0].nfs_argop4_u.opcputfh.sfh = drp->r_fh;
7364 
7365         /* remove */
7366         argop[1].argop = OP_CREMOVE;
7367         argop[1].nfs_argop4_u.opcremove.ctarget = nm;
7368 
7369         /* getattr dir */
7370         argop[2].argop = OP_GETATTR;
7371         argop[2].nfs_argop4_u.opgetattr.attr_request = NFS4_VATTR_MASK;
7372         argop[2].nfs_argop4_u.opgetattr.mi = mi;
7373 
7374         doqueue = 1;
7375         dinfo.di_time_call = gethrtime();
7376         rfs4call(mi, &args, &res, cr, &doqueue, 0, &e);
7377 
7378         PURGE_ATTRCACHE4(vp);
7379 
7380         needrecov = nfs4_needs_recovery(&e, FALSE, mi->mi_vfsp);
7381         if (e.error)
7382                 PURGE_ATTRCACHE4(dvp);
7383 
7384         if (needrecov) {
7385                 if (nfs4_start_recovery(&e, VTOMI4(dvp), dvp,
7386                     NULL, NULL, NULL, OP_REMOVE, NULL, NULL, NULL) == FALSE) {
7387                         if (!e.error)
7388                                 (void) xdr_free(xdr_COMPOUND4res_clnt,
7389                                     (caddr_t)&res);
7390                         nfs4_end_op(VTOMI4(dvp), dvp, NULL, &recov_state,
7391                             needrecov);
7392                         goto recov_retry;
7393                 }
7394         }
7395 
7396         /*
7397          * Matching nfs4_end_op() for start_op() above.
7398          * There is a path in the code below which calls
7399          * nfs4_purge_stale_fh(), which may generate otw calls through
7400          * nfs4_invalidate_pages. Hence we need to call nfs4_end_op()
7401          * here to avoid nfs4_start_op() deadlock.
7402          */
7403         nfs4_end_op(VTOMI4(dvp), dvp, NULL, &recov_state, needrecov);
7404 
7405         if (!e.error) {
7406                 resp = &res;
7407 
7408                 if (res.status) {
7409                         e.error = geterrno4(res.status);
7410                         PURGE_ATTRCACHE4(dvp);
7411                         nfs4_purge_stale_fh(e.error, dvp, cr);
7412                 } else {
7413                         resop = &res.array[1];      /* remove res */
7414                         rm_res = &resop->nfs_resop4_u.opremove;
7415 
7416                         dinfo.di_garp =
7417                             &res.array[2].nfs_resop4_u.opgetattr.ga_res;
7418                         dinfo.di_cred = cr;
7419 
7420                         /* Update directory attr, readdir and dnlc caches */
7421                         nfs4_update_dircaches(&rm_res->cinfo, dvp, NULL, NULL,
7422                             &dinfo);
7423                 }
7424         }
7425         nfs_rw_exit(&drp->r_rwlock);
7426         if (resp)
7427                 (void) xdr_free(xdr_COMPOUND4res_clnt, (caddr_t)resp);
7428 
7429         if (e.error == 0) {
7430                 vnode_t *tvp;
7431                 rnode4_t *trp;
7432                 trp = VTOR4(vp);
7433                 tvp = vp;
7434                 if (IS_SHADOW(vp, trp))
7435                         tvp = RTOV4(trp);
7436                 vnevent_remove(tvp, dvp, nm, ct);
7437         }
7438         VN_RELE(vp);
7439         return (e.error);
7440 }
7441 
7442 /*
7443  * Link requires that the current fh be the target directory and the
7444  * saved fh be the source fh. After the operation, the current fh is unchanged.
7445  * Thus the compound op structure is:
7446  *      PUTFH(file), SAVEFH, PUTFH(targetdir), LINK, RESTOREFH,
7447  *      GETATTR(file)
7448  */
7449 /* ARGSUSED */
7450 static int
7451 nfs4_link(vnode_t *tdvp, vnode_t *svp, char *tnm, cred_t *cr,
7452     caller_context_t *ct, int flags)
7453 {
7454         COMPOUND4args_clnt args;
7455         COMPOUND4res_clnt res, *resp = NULL;
7456         LINK4res *ln_res;
7457         int argoplist_size  = 7 * sizeof (nfs_argop4);
7458         nfs_argop4 *argop;
7459         nfs_resop4 *resop;
7460         vnode_t *realvp, *nvp;
7461         int doqueue;
7462         mntinfo4_t *mi;
7463         rnode4_t *tdrp;
7464         bool_t needrecov = FALSE;
7465         nfs4_recov_state_t recov_state;
7466         hrtime_t t;
7467         nfs4_error_t e = { 0, NFS4_OK, RPC_SUCCESS };
7468         dirattr_info_t dinfo;
7469 
7470         ASSERT(*tnm != '\0');
7471         ASSERT(tdvp->v_type == VDIR);
7472         ASSERT(nfs4_consistent_type(tdvp));
7473         ASSERT(nfs4_consistent_type(svp));
7474 
7475         if (nfs_zone() != VTOMI4(tdvp)->mi_zone)
7476                 return (EPERM);
7477         if (VOP_REALVP(svp, &realvp, ct) == 0) {
7478                 svp = realvp;
7479                 ASSERT(nfs4_consistent_type(svp));
7480         }
7481 
7482         tdrp = VTOR4(tdvp);
7483         mi = VTOMI4(svp);
7484 
7485         if (!(mi->mi_flags & MI4_LINK)) {
7486                 return (EOPNOTSUPP);
7487         }
7488         recov_state.rs_flags = 0;
7489         recov_state.rs_num_retry_despite_err = 0;
7490 
7491         if (nfs_rw_enter_sig(&tdrp->r_rwlock, RW_WRITER, INTR4(tdvp)))
7492                 return (EINTR);
7493 
7494 recov_retry:
7495         argop = kmem_alloc(argoplist_size, KM_SLEEP);
7496 
7497         args.ctag = TAG_LINK;
7498 
7499         /*
7500          * Link ops: putfh fl; savefh; putfh tdir; link; getattr(dir);
7501          * restorefh; getattr(fl)
7502          */
7503         args.array_len = 7;
7504         args.array = argop;
7505 
7506         e.error = nfs4_start_op(VTOMI4(svp), svp, tdvp, &recov_state);
7507         if (e.error) {
7508                 kmem_free(argop, argoplist_size);
7509                 nfs_rw_exit(&tdrp->r_rwlock);
7510                 return (e.error);
7511         }
7512 
7513         /* 0. putfh file */
7514         argop[0].argop = OP_CPUTFH;
7515         argop[0].nfs_argop4_u.opcputfh.sfh = VTOR4(svp)->r_fh;
7516 
7517         /* 1. save current fh to free up the space for the dir */
7518         argop[1].argop = OP_SAVEFH;
7519 
7520         /* 2. putfh targetdir */
7521         argop[2].argop = OP_CPUTFH;
7522         argop[2].nfs_argop4_u.opcputfh.sfh = tdrp->r_fh;
7523 
7524         /* 3. link: current_fh is targetdir, saved_fh is source */
7525         argop[3].argop = OP_CLINK;
7526         argop[3].nfs_argop4_u.opclink.cnewname = tnm;
7527 
7528         /* 4. Get attributes of dir */
7529         argop[4].argop = OP_GETATTR;
7530         argop[4].nfs_argop4_u.opgetattr.attr_request = NFS4_VATTR_MASK;
7531         argop[4].nfs_argop4_u.opgetattr.mi = mi;
7532 
7533         /* 5. If link was successful, restore current vp to file */
7534         argop[5].argop = OP_RESTOREFH;
7535 
7536         /* 6. Get attributes of linked object */
7537         argop[6].argop = OP_GETATTR;
7538         argop[6].nfs_argop4_u.opgetattr.attr_request = NFS4_VATTR_MASK;
7539         argop[6].nfs_argop4_u.opgetattr.mi = mi;
7540 
7541         dnlc_remove(tdvp, tnm);
7542 
7543         doqueue = 1;
7544         t = gethrtime();
7545 
7546         rfs4call(VTOMI4(svp), &args, &res, cr, &doqueue, 0, &e);
7547 
7548         needrecov = nfs4_needs_recovery(&e, FALSE, svp->v_vfsp);
7549         if (e.error != 0 && !needrecov) {
7550                 PURGE_ATTRCACHE4(tdvp);
7551                 PURGE_ATTRCACHE4(svp);
7552                 nfs4_end_op(VTOMI4(svp), svp, tdvp, &recov_state, needrecov);
7553                 goto out;
7554         }
7555 
7556         if (needrecov) {
7557                 bool_t abort;
7558 
7559                 abort = nfs4_start_recovery(&e, VTOMI4(svp), svp, tdvp,
7560                     NULL, NULL, OP_LINK, NULL, NULL, NULL);
7561                 if (abort == FALSE) {
7562                         nfs4_end_op(VTOMI4(svp), svp, tdvp, &recov_state,
7563                             needrecov);
7564                         kmem_free(argop, argoplist_size);
7565                         if (!e.error)
7566                                 (void) xdr_free(xdr_COMPOUND4res_clnt,
7567                                     (caddr_t)&res);
7568                         goto recov_retry;
7569                 } else {
7570                         if (e.error != 0) {
7571                                 PURGE_ATTRCACHE4(tdvp);
7572                                 PURGE_ATTRCACHE4(svp);
7573                                 nfs4_end_op(VTOMI4(svp), svp, tdvp,
7574                                     &recov_state, needrecov);
7575                                 goto out;
7576                         }
7577                         /* fall through for res.status case */
7578                 }
7579         }
7580 
7581         nfs4_end_op(VTOMI4(svp), svp, tdvp, &recov_state, needrecov);
7582 
7583         resp = &res;
7584         if (res.status) {
7585                 /* If link succeeded, then don't return error */
7586                 e.error = geterrno4(res.status);
7587                 if (res.array_len <= 4) {
7588                         /*
7589                          * Either Putfh, Savefh, Putfh dir, or Link failed
7590                          */
7591                         PURGE_ATTRCACHE4(svp);
7592                         PURGE_ATTRCACHE4(tdvp);
7593                         if (e.error == EOPNOTSUPP) {
7594                                 mutex_enter(&mi->mi_lock);
7595                                 mi->mi_flags &= ~MI4_LINK;
7596                                 mutex_exit(&mi->mi_lock);
7597                         }
7598                         /* Remap EISDIR to EPERM for non-root user for SVVS */
7599                         /* XXX-LP */
7600                         if (e.error == EISDIR && crgetuid(cr) != 0)
7601                                 e.error = EPERM;
7602                         goto out;
7603                 }
7604         }
7605 
7606         /* either no error or one of the postop getattr failed */
7607 
7608         /*
7609          * XXX - if LINK succeeded, but no attrs were returned for link
7610          * file, purge its cache.
7611          *
7612          * XXX Perform a simplified version of wcc checking. Instead of
7613          * have another getattr to get pre-op, just purge cache if
7614          * any of the ops prior to and including the getattr failed.
7615          * If the getattr succeeded then update the attrcache accordingly.
7616          */
7617 
7618         /*
7619          * update cache with link file postattrs.
7620          * Note: at this point resop points to link res.
7621          */
7622         resop = &res.array[3];      /* link res */
7623         ln_res = &resop->nfs_resop4_u.oplink;
7624         if (res.status == NFS4_OK)
7625                 e.error = nfs4_update_attrcache(res.status,
7626                     &res.array[6].nfs_resop4_u.opgetattr.ga_res,
7627                     t, svp, cr);
7628 
7629         /*
7630          * Call makenfs4node to create the new shadow vp for tnm.
7631          * We pass NULL attrs because we just cached attrs for
7632          * the src object.  All we're trying to accomplish is to
7633          * to create the new shadow vnode.
7634          */
7635         nvp = makenfs4node(VTOR4(svp)->r_fh, NULL, tdvp->v_vfsp, t, cr,
7636             tdvp, fn_get(VTOSV(tdvp)->sv_name, tnm, VTOR4(svp)->r_fh));
7637 
7638         /* Update target cache attribute, readdir and dnlc caches */
7639         dinfo.di_garp = &res.array[4].nfs_resop4_u.opgetattr.ga_res;
7640         dinfo.di_time_call = t;
7641         dinfo.di_cred = cr;
7642 
7643         nfs4_update_dircaches(&ln_res->cinfo, tdvp, nvp, tnm, &dinfo);
7644         ASSERT(nfs4_consistent_type(tdvp));
7645         ASSERT(nfs4_consistent_type(svp));
7646         ASSERT(nfs4_consistent_type(nvp));
7647         VN_RELE(nvp);
7648 
7649         if (!e.error) {
7650                 vnode_t *tvp;
7651                 rnode4_t *trp;
7652                 /*
7653                  * Notify the source file of this link operation.
7654                  */
7655                 trp = VTOR4(svp);
7656                 tvp = svp;
7657                 if (IS_SHADOW(svp, trp))
7658                         tvp = RTOV4(trp);
7659                 vnevent_link(tvp, ct);
7660         }
7661 out:
7662         kmem_free(argop, argoplist_size);
7663         if (resp)
7664                 (void) xdr_free(xdr_COMPOUND4res_clnt, (caddr_t)resp);
7665 
7666         nfs_rw_exit(&tdrp->r_rwlock);
7667 
7668         return (e.error);
7669 }
7670 
7671 /* ARGSUSED */
7672 static int
7673 nfs4_rename(vnode_t *odvp, char *onm, vnode_t *ndvp, char *nnm, cred_t *cr,
7674     caller_context_t *ct, int flags)
7675 {
7676         vnode_t *realvp;
7677 
7678         if (nfs_zone() != VTOMI4(odvp)->mi_zone)
7679                 return (EPERM);
7680         if (VOP_REALVP(ndvp, &realvp, ct) == 0)
7681                 ndvp = realvp;
7682 
7683         return (nfs4rename(odvp, onm, ndvp, nnm, cr, ct));
7684 }
7685 
7686 /*
7687  * nfs4rename does the real work of renaming in NFS Version 4.
7688  *
7689  * A file handle is considered volatile for renaming purposes if either
7690  * of the volatile bits are turned on. However, the compound may differ
7691  * based on the likelihood of the filehandle to change during rename.
7692  */
7693 static int
7694 nfs4rename(vnode_t *odvp, char *onm, vnode_t *ndvp, char *nnm, cred_t *cr,
7695     caller_context_t *ct)
7696 {
7697         int error;
7698         mntinfo4_t *mi;
7699         vnode_t *nvp = NULL;
7700         vnode_t *ovp = NULL;
7701         char *tmpname = NULL;
7702         rnode4_t *rp;
7703         rnode4_t *odrp;
7704         rnode4_t *ndrp;
7705         int did_link = 0;
7706         int do_link = 1;
7707         nfsstat4 stat = NFS4_OK;
7708 
7709         ASSERT(nfs_zone() == VTOMI4(odvp)->mi_zone);
7710         ASSERT(nfs4_consistent_type(odvp));
7711         ASSERT(nfs4_consistent_type(ndvp));
7712 
7713         if (onm[0] == '.' && (onm[1] == '\0' ||
7714             (onm[1] == '.' && onm[2] == '\0')))
7715                 return (EINVAL);
7716 
7717         if (nnm[0] == '.' && (nnm[1] == '\0' ||
7718             (nnm[1] == '.' && nnm[2] == '\0')))
7719                 return (EINVAL);
7720 
7721         odrp = VTOR4(odvp);
7722         ndrp = VTOR4(ndvp);
7723         if ((intptr_t)odrp < (intptr_t)ndrp) {
7724                 if (nfs_rw_enter_sig(&odrp->r_rwlock, RW_WRITER, INTR4(odvp)))
7725                         return (EINTR);
7726                 if (nfs_rw_enter_sig(&ndrp->r_rwlock, RW_WRITER, INTR4(ndvp))) {
7727                         nfs_rw_exit(&odrp->r_rwlock);
7728                         return (EINTR);
7729                 }
7730         } else {
7731                 if (nfs_rw_enter_sig(&ndrp->r_rwlock, RW_WRITER, INTR4(ndvp)))
7732                         return (EINTR);
7733                 if (nfs_rw_enter_sig(&odrp->r_rwlock, RW_WRITER, INTR4(odvp))) {
7734                         nfs_rw_exit(&ndrp->r_rwlock);
7735                         return (EINTR);
7736                 }
7737         }
7738 
7739         /*
7740          * Lookup the target file.  If it exists, it needs to be
7741          * checked to see whether it is a mount point and whether
7742          * it is active (open).
7743          */
7744         error = nfs4lookup(ndvp, nnm, &nvp, cr, 0);
7745         if (!error) {
7746                 int     isactive;
7747 
7748                 ASSERT(nfs4_consistent_type(nvp));
7749                 /*
7750                  * If this file has been mounted on, then just
7751                  * return busy because renaming to it would remove
7752                  * the mounted file system from the name space.
7753                  */
7754                 if (vn_ismntpt(nvp)) {
7755                         VN_RELE(nvp);
7756                         nfs_rw_exit(&odrp->r_rwlock);
7757                         nfs_rw_exit(&ndrp->r_rwlock);
7758                         return (EBUSY);
7759                 }
7760 
7761                 /*
7762                  * First just remove the entry from the name cache, as it
7763                  * is most likely the only entry for this vp.
7764                  */
7765                 dnlc_remove(ndvp, nnm);
7766 
7767                 rp = VTOR4(nvp);
7768 
7769                 if (nvp->v_type != VREG) {
7770                         /*
7771                          * Purge the name cache of all references to this vnode
7772                          * so that we can check the reference count to infer
7773                          * whether it is active or not.
7774                          */
7775                         if (nvp->v_count > 1)
7776                                 dnlc_purge_vp(nvp);
7777 
7778                         isactive = nvp->v_count > 1;
7779                 } else {
7780                         mutex_enter(&rp->r_os_lock);
7781                         isactive = list_head(&rp->r_open_streams) != NULL;
7782                         mutex_exit(&rp->r_os_lock);
7783                 }
7784 
7785                 /*
7786                  * If the vnode is active and is not a directory,
7787                  * arrange to rename it to a
7788                  * temporary file so that it will continue to be
7789                  * accessible.  This implements the "unlink-open-file"
7790                  * semantics for the target of a rename operation.
7791                  * Before doing this though, make sure that the
7792                  * source and target files are not already the same.
7793                  */
7794                 if (isactive && nvp->v_type != VDIR) {
7795                         /*
7796                          * Lookup the source name.
7797                          */
7798                         error = nfs4lookup(odvp, onm, &ovp, cr, 0);
7799 
7800                         /*
7801                          * The source name *should* already exist.
7802                          */
7803                         if (error) {
7804                                 VN_RELE(nvp);
7805                                 nfs_rw_exit(&odrp->r_rwlock);
7806                                 nfs_rw_exit(&ndrp->r_rwlock);
7807                                 return (error);
7808                         }
7809 
7810                         ASSERT(nfs4_consistent_type(ovp));
7811 
7812                         /*
7813                          * Compare the two vnodes.  If they are the same,
7814                          * just release all held vnodes and return success.
7815                          */
7816                         if (VN_CMP(ovp, nvp)) {
7817                                 VN_RELE(ovp);
7818                                 VN_RELE(nvp);
7819                                 nfs_rw_exit(&odrp->r_rwlock);
7820                                 nfs_rw_exit(&ndrp->r_rwlock);
7821                                 return (0);
7822                         }
7823 
7824                         /*
7825                          * Can't mix and match directories and non-
7826                          * directories in rename operations.  We already
7827                          * know that the target is not a directory.  If
7828                          * the source is a directory, return an error.
7829                          */
7830                         if (ovp->v_type == VDIR) {
7831                                 VN_RELE(ovp);
7832                                 VN_RELE(nvp);
7833                                 nfs_rw_exit(&odrp->r_rwlock);
7834                                 nfs_rw_exit(&ndrp->r_rwlock);
7835                                 return (ENOTDIR);
7836                         }
7837 link_call:
7838                         /*
7839                          * The target file exists, is not the same as
7840                          * the source file, and is active.  We first
7841                          * try to Link it to a temporary filename to
7842                          * avoid having the server removing the file
7843                          * completely (which could cause data loss to
7844                          * the user's POV in the event the Rename fails
7845                          * -- see bug 1165874).
7846                          */
7847                         /*
7848                          * The do_link and did_link booleans are
7849                          * introduced in the event we get NFS4ERR_FILE_OPEN
7850                          * returned for the Rename.  Some servers can
7851                          * not Rename over an Open file, so they return
7852                          * this error.  The client needs to Remove the
7853                          * newly created Link and do two Renames, just
7854                          * as if the server didn't support LINK.
7855                          */
7856                         tmpname = newname();
7857                         error = 0;
7858 
7859                         if (do_link) {
7860                                 error = nfs4_link(ndvp, nvp, tmpname, cr,
7861                                     NULL, 0);
7862                         }
7863                         if (error == EOPNOTSUPP || !do_link) {
7864                                 error = nfs4_rename(ndvp, nnm, ndvp, tmpname,
7865                                     cr, NULL, 0);
7866                                 did_link = 0;
7867                         } else {
7868                                 did_link = 1;
7869                         }
7870                         if (error) {
7871                                 kmem_free(tmpname, MAXNAMELEN);
7872                                 VN_RELE(ovp);
7873                                 VN_RELE(nvp);
7874                                 nfs_rw_exit(&odrp->r_rwlock);
7875                                 nfs_rw_exit(&ndrp->r_rwlock);
7876                                 return (error);
7877                         }
7878 
7879                         mutex_enter(&rp->r_statelock);
7880                         if (rp->r_unldvp == NULL) {
7881                                 VN_HOLD(ndvp);
7882                                 rp->r_unldvp = ndvp;
7883                                 if (rp->r_unlcred != NULL)
7884                                         crfree(rp->r_unlcred);
7885                                 crhold(cr);
7886                                 rp->r_unlcred = cr;
7887                                 rp->r_unlname = tmpname;
7888                         } else {
7889                                 if (rp->r_unlname)
7890                                         kmem_free(rp->r_unlname, MAXNAMELEN);
7891                                 rp->r_unlname = tmpname;
7892                         }
7893                         mutex_exit(&rp->r_statelock);
7894                 }
7895 
7896                 (void) nfs4delegreturn(VTOR4(nvp), NFS4_DR_PUSH|NFS4_DR_REOPEN);
7897 
7898                 ASSERT(nfs4_consistent_type(nvp));
7899         }
7900 
7901         if (ovp == NULL) {
7902                 /*
7903                  * When renaming directories to be a subdirectory of a
7904                  * different parent, the dnlc entry for ".." will no
7905                  * longer be valid, so it must be removed.
7906                  *
7907                  * We do a lookup here to determine whether we are renaming
7908                  * a directory and we need to check if we are renaming
7909                  * an unlinked file.  This might have already been done
7910                  * in previous code, so we check ovp == NULL to avoid
7911                  * doing it twice.
7912                  */
7913                 error = nfs4lookup(odvp, onm, &ovp, cr, 0);
7914                 /*
7915                  * The source name *should* already exist.
7916                  */
7917                 if (error) {
7918                         nfs_rw_exit(&odrp->r_rwlock);
7919                         nfs_rw_exit(&ndrp->r_rwlock);
7920                         if (nvp) {
7921                                 VN_RELE(nvp);
7922                         }
7923                         return (error);
7924                 }
7925                 ASSERT(ovp != NULL);
7926                 ASSERT(nfs4_consistent_type(ovp));
7927         }
7928 
7929         /*
7930          * Is the object being renamed a dir, and if so, is
7931          * it being renamed to a child of itself?  The underlying
7932          * fs should ultimately return EINVAL for this case;
7933          * however, buggy beta non-Solaris NFSv4 servers at
7934          * interop testing events have allowed this behavior,
7935          * and it caused our client to panic due to a recursive
7936          * mutex_enter in fn_move.
7937          *
7938          * The tedious locking in fn_move could be changed to
7939          * deal with this case, and the client could avoid the
7940          * panic; however, the client would just confuse itself
7941          * later and misbehave.  A better way to handle the broken
7942          * server is to detect this condition and return EINVAL
7943          * without ever sending the the bogus rename to the server.
7944          * We know the rename is invalid -- just fail it now.
7945          */
7946         if (ovp->v_type == VDIR && VN_CMP(ndvp, ovp)) {
7947                 VN_RELE(ovp);
7948                 nfs_rw_exit(&odrp->r_rwlock);
7949                 nfs_rw_exit(&ndrp->r_rwlock);
7950                 if (nvp) {
7951                         VN_RELE(nvp);
7952                 }
7953                 return (EINVAL);
7954         }
7955 
7956         (void) nfs4delegreturn(VTOR4(ovp), NFS4_DR_PUSH|NFS4_DR_REOPEN);
7957 
7958         /*
7959          * If FH4_VOL_RENAME or FH4_VOLATILE_ANY bits are set, it is
7960          * possible for the filehandle to change due to the rename.
7961          * If neither of these bits is set, but FH4_VOL_MIGRATION is set,
7962          * the fh will not change because of the rename, but we still need
7963          * to update its rnode entry with the new name for
7964          * an eventual fh change due to migration. The FH4_NOEXPIRE_ON_OPEN
7965          * has no effect on these for now, but for future improvements,
7966          * we might want to use it too to simplify handling of files
7967          * that are open with that flag on. (XXX)
7968          */
7969         mi = VTOMI4(odvp);
7970         if (NFS4_VOLATILE_FH(mi))
7971                 error = nfs4rename_volatile_fh(odvp, onm, ovp, ndvp, nnm, cr,
7972                     &stat);
7973         else
7974                 error = nfs4rename_persistent_fh(odvp, onm, ovp, ndvp, nnm, cr,
7975                     &stat);
7976 
7977         ASSERT(nfs4_consistent_type(odvp));
7978         ASSERT(nfs4_consistent_type(ndvp));
7979         ASSERT(nfs4_consistent_type(ovp));
7980 
7981         if (stat == NFS4ERR_FILE_OPEN && did_link) {
7982                 do_link = 0;
7983                 /*
7984                  * Before the 'link_call' code, we did a nfs4_lookup
7985                  * that puts a VN_HOLD on nvp.  After the nfs4_link
7986                  * call we call VN_RELE to match that hold.  We need
7987                  * to place an additional VN_HOLD here since we will
7988                  * be hitting that VN_RELE again.
7989                  */
7990                 VN_HOLD(nvp);
7991 
7992                 (void) nfs4_remove(ndvp, tmpname, cr, NULL, 0);
7993 
7994                 /* Undo the unlinked file naming stuff we just did */
7995                 mutex_enter(&rp->r_statelock);
7996                 if (rp->r_unldvp) {
7997                         VN_RELE(ndvp);
7998                         rp->r_unldvp = NULL;
7999                         if (rp->r_unlcred != NULL)
8000                                 crfree(rp->r_unlcred);
8001                         rp->r_unlcred = NULL;
8002                         /* rp->r_unlanme points to tmpname */
8003                         if (rp->r_unlname)
8004                                 kmem_free(rp->r_unlname, MAXNAMELEN);
8005                         rp->r_unlname = NULL;
8006                 }
8007                 mutex_exit(&rp->r_statelock);
8008 
8009                 if (nvp) {
8010                         VN_RELE(nvp);
8011                 }
8012                 goto link_call;
8013         }
8014 
8015         if (error) {
8016                 VN_RELE(ovp);
8017                 nfs_rw_exit(&odrp->r_rwlock);
8018                 nfs_rw_exit(&ndrp->r_rwlock);
8019                 if (nvp) {
8020                         VN_RELE(nvp);
8021                 }
8022                 return (error);
8023         }
8024 
8025         /*
8026          * when renaming directories to be a subdirectory of a
8027          * different parent, the dnlc entry for ".." will no
8028          * longer be valid, so it must be removed
8029          */
8030         rp = VTOR4(ovp);
8031         if (ndvp != odvp) {
8032                 if (ovp->v_type == VDIR) {
8033                         dnlc_remove(ovp, "..");
8034                         if (rp->r_dir != NULL)
8035                                 nfs4_purge_rddir_cache(ovp);
8036                 }
8037         }
8038 
8039         /*
8040          * If we are renaming the unlinked file, update the
8041          * r_unldvp and r_unlname as needed.
8042          */
8043         mutex_enter(&rp->r_statelock);
8044         if (rp->r_unldvp != NULL) {
8045                 if (strcmp(rp->r_unlname, onm) == 0) {
8046                         (void) strncpy(rp->r_unlname, nnm, MAXNAMELEN);
8047                         rp->r_unlname[MAXNAMELEN - 1] = '\0';
8048                         if (ndvp != rp->r_unldvp) {
8049                                 VN_RELE(rp->r_unldvp);
8050                                 rp->r_unldvp = ndvp;
8051                                 VN_HOLD(ndvp);
8052                         }
8053                 }
8054         }
8055         mutex_exit(&rp->r_statelock);
8056 
8057         /*
8058          * Notify the rename vnevents to source vnode, and to the target
8059          * vnode if it already existed.
8060          */
8061         if (error == 0) {
8062                 vnode_t *tvp;
8063                 rnode4_t *trp;
8064                 /*
8065                  * Notify the vnode. Each links is represented by
8066                  * a different vnode, in nfsv4.
8067                  */
8068                 if (nvp) {
8069                         trp = VTOR4(nvp);
8070                         tvp = nvp;
8071                         if (IS_SHADOW(nvp, trp))
8072                                 tvp = RTOV4(trp);
8073                         vnevent_rename_dest(tvp, ndvp, nnm, ct);
8074                 }
8075 
8076                 /*
8077                  * if the source and destination directory are not the
8078                  * same notify the destination directory.
8079                  */
8080                 if (VTOR4(odvp) != VTOR4(ndvp)) {
8081                         trp = VTOR4(ndvp);
8082                         tvp = ndvp;
8083                         if (IS_SHADOW(ndvp, trp))
8084                                 tvp = RTOV4(trp);
8085                         vnevent_rename_dest_dir(tvp, ct);
8086                 }
8087 
8088                 trp = VTOR4(ovp);
8089                 tvp = ovp;
8090                 if (IS_SHADOW(ovp, trp))
8091                         tvp = RTOV4(trp);
8092                 vnevent_rename_src(tvp, odvp, onm, ct);
8093         }
8094 
8095         if (nvp) {
8096                 VN_RELE(nvp);
8097         }
8098         VN_RELE(ovp);
8099 
8100         nfs_rw_exit(&odrp->r_rwlock);
8101         nfs_rw_exit(&ndrp->r_rwlock);
8102 
8103         return (error);
8104 }
8105 
8106 /*
8107  * When the parent directory has changed, sv_dfh must be updated
8108  */
8109 static void
8110 update_parentdir_sfh(vnode_t *vp, vnode_t *ndvp)
8111 {
8112         svnode_t *sv = VTOSV(vp);
8113         nfs4_sharedfh_t *old_dfh = sv->sv_dfh;
8114         nfs4_sharedfh_t *new_dfh = VTOR4(ndvp)->r_fh;
8115 
8116         sfh4_hold(new_dfh);
8117         sv->sv_dfh = new_dfh;
8118         sfh4_rele(&old_dfh);
8119 }
8120 
8121 /*
8122  * nfs4rename_persistent does the otw portion of renaming in NFS Version 4,
8123  * when it is known that the filehandle is persistent through rename.
8124  *
8125  * Rename requires that the current fh be the target directory and the
8126  * saved fh be the source directory. After the operation, the current fh
8127  * is unchanged.
8128  * The compound op structure for persistent fh rename is:
8129  *      PUTFH(sourcdir), SAVEFH, PUTFH(targetdir), RENAME
8130  * Rather than bother with the directory postop args, we'll simply
8131  * update that a change occurred in the cache, so no post-op getattrs.
8132  */
8133 static int
8134 nfs4rename_persistent_fh(vnode_t *odvp, char *onm, vnode_t *renvp,
8135     vnode_t *ndvp, char *nnm, cred_t *cr, nfsstat4 *statp)
8136 {
8137         COMPOUND4args_clnt args;
8138         COMPOUND4res_clnt res, *resp = NULL;
8139         nfs_argop4 *argop;
8140         nfs_resop4 *resop;
8141         int doqueue, argoplist_size;
8142         mntinfo4_t *mi;
8143         rnode4_t *odrp = VTOR4(odvp);
8144         rnode4_t *ndrp = VTOR4(ndvp);
8145         RENAME4res *rn_res;
8146         bool_t needrecov;
8147         nfs4_recov_state_t recov_state;
8148         nfs4_error_t e = { 0, NFS4_OK, RPC_SUCCESS };
8149         dirattr_info_t dinfo, *dinfop;
8150 
8151         ASSERT(nfs_zone() == VTOMI4(odvp)->mi_zone);
8152 
8153         recov_state.rs_flags = 0;
8154         recov_state.rs_num_retry_despite_err = 0;
8155 
8156         /*
8157          * Rename ops: putfh sdir; savefh; putfh tdir; rename; getattr tdir
8158          *
8159          * If source/target are different dirs, then append putfh(src); getattr
8160          */
8161         args.array_len = (odvp == ndvp) ? 5 : 7;
8162         argoplist_size = args.array_len * sizeof (nfs_argop4);
8163         args.array = argop = kmem_alloc(argoplist_size, KM_SLEEP);
8164 
8165 recov_retry:
8166         *statp = NFS4_OK;
8167 
8168         /* No need to Lookup the file, persistent fh */
8169         args.ctag = TAG_RENAME;
8170 
8171         mi = VTOMI4(odvp);
8172         e.error = nfs4_start_op(mi, odvp, ndvp, &recov_state);
8173         if (e.error) {
8174                 kmem_free(argop, argoplist_size);
8175                 return (e.error);
8176         }
8177 
8178         /* 0: putfh source directory */
8179         argop[0].argop = OP_CPUTFH;
8180         argop[0].nfs_argop4_u.opcputfh.sfh = odrp->r_fh;
8181 
8182         /* 1: Save source fh to free up current for target */
8183         argop[1].argop = OP_SAVEFH;
8184 
8185         /* 2: putfh targetdir */
8186         argop[2].argop = OP_CPUTFH;
8187         argop[2].nfs_argop4_u.opcputfh.sfh = ndrp->r_fh;
8188 
8189         /* 3: current_fh is targetdir, saved_fh is sourcedir */
8190         argop[3].argop = OP_CRENAME;
8191         argop[3].nfs_argop4_u.opcrename.coldname = onm;
8192         argop[3].nfs_argop4_u.opcrename.cnewname = nnm;
8193 
8194         /* 4: getattr (targetdir) */
8195         argop[4].argop = OP_GETATTR;
8196         argop[4].nfs_argop4_u.opgetattr.attr_request = NFS4_VATTR_MASK;
8197         argop[4].nfs_argop4_u.opgetattr.mi = mi;
8198 
8199         if (ndvp != odvp) {
8200 
8201                 /* 5: putfh (sourcedir) */
8202                 argop[5].argop = OP_CPUTFH;
8203                 argop[5].nfs_argop4_u.opcputfh.sfh = ndrp->r_fh;
8204 
8205                 /* 6: getattr (sourcedir) */
8206                 argop[6].argop = OP_GETATTR;
8207                 argop[6].nfs_argop4_u.opgetattr.attr_request = NFS4_VATTR_MASK;
8208                 argop[6].nfs_argop4_u.opgetattr.mi = mi;
8209         }
8210 
8211         dnlc_remove(odvp, onm);
8212         dnlc_remove(ndvp, nnm);
8213 
8214         doqueue = 1;
8215         dinfo.di_time_call = gethrtime();
8216         rfs4call(mi, &args, &res, cr, &doqueue, 0, &e);
8217 
8218         needrecov = nfs4_needs_recovery(&e, FALSE, mi->mi_vfsp);
8219         if (e.error) {
8220                 PURGE_ATTRCACHE4(odvp);
8221                 PURGE_ATTRCACHE4(ndvp);
8222         } else {
8223                 *statp = res.status;
8224         }
8225 
8226         if (needrecov) {
8227                 if (nfs4_start_recovery(&e, mi, odvp, ndvp, NULL, NULL,
8228                     OP_RENAME, NULL, NULL, NULL) == FALSE) {
8229                         nfs4_end_op(mi, odvp, ndvp, &recov_state, needrecov);
8230                         if (!e.error)
8231                                 (void) xdr_free(xdr_COMPOUND4res_clnt,
8232                                     (caddr_t)&res);
8233                         goto recov_retry;
8234                 }
8235         }
8236 
8237         if (!e.error) {
8238                 resp = &res;
8239                 /*
8240                  * as long as OP_RENAME
8241                  */
8242                 if (res.status != NFS4_OK && res.array_len <= 4) {
8243                         e.error = geterrno4(res.status);
8244                         PURGE_ATTRCACHE4(odvp);
8245                         PURGE_ATTRCACHE4(ndvp);
8246                         /*
8247                          * System V defines rename to return EEXIST, not
8248                          * ENOTEMPTY if the target directory is not empty.
8249                          * Over the wire, the error is NFSERR_ENOTEMPTY
8250                          * which geterrno4 maps to ENOTEMPTY.
8251                          */
8252                         if (e.error == ENOTEMPTY)
8253                                 e.error = EEXIST;
8254                 } else {
8255 
8256                         resop = &res.array[3];      /* rename res */
8257                         rn_res = &resop->nfs_resop4_u.oprename;
8258 
8259                         if (res.status == NFS4_OK) {
8260                                 /*
8261                                  * Update target attribute, readdir and dnlc
8262                                  * caches.
8263                                  */
8264                                 dinfo.di_garp =
8265                                     &res.array[4].nfs_resop4_u.opgetattr.ga_res;
8266                                 dinfo.di_cred = cr;
8267                                 dinfop = &dinfo;
8268                         } else
8269                                 dinfop = NULL;
8270 
8271                         nfs4_update_dircaches(&rn_res->target_cinfo,
8272                             ndvp, NULL, NULL, dinfop);
8273 
8274                         /*
8275                          * Update source attribute, readdir and dnlc caches
8276                          *
8277                          */
8278                         if (ndvp != odvp) {
8279                                 update_parentdir_sfh(renvp, ndvp);
8280 
8281                                 if (dinfop)
8282                                         dinfo.di_garp =
8283                                             &(res.array[6].nfs_resop4_u.
8284                                             opgetattr.ga_res);
8285 
8286                                 nfs4_update_dircaches(&rn_res->source_cinfo,
8287                                     odvp, NULL, NULL, dinfop);
8288                         }
8289 
8290                         fn_move(VTOSV(renvp)->sv_name, VTOSV(ndvp)->sv_name,
8291                             nnm);
8292                 }
8293         }
8294 
8295         if (resp)
8296                 (void) xdr_free(xdr_COMPOUND4res_clnt, (caddr_t)resp);
8297         nfs4_end_op(mi, odvp, ndvp, &recov_state, needrecov);
8298         kmem_free(argop, argoplist_size);
8299 
8300         return (e.error);
8301 }
8302 
8303 /*
8304  * nfs4rename_volatile_fh does the otw part of renaming in NFS Version 4, when
8305  * it is possible for the filehandle to change due to the rename.
8306  *
8307  * The compound req in this case includes a post-rename lookup and getattr
8308  * to ensure that we have the correct fh and attributes for the object.
8309  *
8310  * Rename requires that the current fh be the target directory and the
8311  * saved fh be the source directory. After the operation, the current fh
8312  * is unchanged.
8313  *
8314  * We need the new filehandle (hence a LOOKUP and GETFH) so that we can
8315  * update the filehandle for the renamed object.  We also get the old
8316  * filehandle for historical reasons; this should be taken out sometime.
8317  * This results in a rather cumbersome compound...
8318  *
8319  *    PUTFH(sourcdir), SAVEFH, LOOKUP(src), GETFH(old),
8320  *    PUTFH(targetdir), RENAME, LOOKUP(trgt), GETFH(new), GETATTR
8321  *
8322  */
8323 static int
8324 nfs4rename_volatile_fh(vnode_t *odvp, char *onm, vnode_t *ovp,
8325     vnode_t *ndvp, char *nnm, cred_t *cr, nfsstat4 *statp)
8326 {
8327         COMPOUND4args_clnt args;
8328         COMPOUND4res_clnt res, *resp = NULL;
8329         int argoplist_size;
8330         nfs_argop4 *argop;
8331         nfs_resop4 *resop;
8332         int doqueue;
8333         mntinfo4_t *mi;
8334         rnode4_t *odrp = VTOR4(odvp);   /* old directory */
8335         rnode4_t *ndrp = VTOR4(ndvp);   /* new directory */
8336         rnode4_t *orp = VTOR4(ovp);     /* object being renamed */
8337         RENAME4res *rn_res;
8338         GETFH4res *ngf_res;
8339         bool_t needrecov;
8340         nfs4_recov_state_t recov_state;
8341         hrtime_t t;
8342         nfs4_error_t e = { 0, NFS4_OK, RPC_SUCCESS };
8343         dirattr_info_t dinfo, *dinfop = &dinfo;
8344 
8345         ASSERT(nfs_zone() == VTOMI4(odvp)->mi_zone);
8346 
8347         recov_state.rs_flags = 0;
8348         recov_state.rs_num_retry_despite_err = 0;
8349 
8350 recov_retry:
8351         *statp = NFS4_OK;
8352 
8353         /*
8354          * There is a window between the RPC and updating the path and
8355          * filehandle stored in the rnode.  Lock out the FHEXPIRED recovery
8356          * code, so that it doesn't try to use the old path during that
8357          * window.
8358          */
8359         mutex_enter(&orp->r_statelock);
8360         while (orp->r_flags & R4RECEXPFH) {
8361                 klwp_t *lwp = ttolwp(curthread);
8362 
8363                 if (lwp != NULL)
8364                         lwp->lwp_nostop++;
8365                 if (cv_wait_sig(&orp->r_cv, &orp->r_statelock) == 0) {
8366                         mutex_exit(&orp->r_statelock);
8367                         if (lwp != NULL)
8368                                 lwp->lwp_nostop--;
8369                         return (EINTR);
8370                 }
8371                 if (lwp != NULL)
8372                         lwp->lwp_nostop--;
8373         }
8374         orp->r_flags |= R4RECEXPFH;
8375         mutex_exit(&orp->r_statelock);
8376 
8377         mi = VTOMI4(odvp);
8378 
8379         args.ctag = TAG_RENAME_VFH;
8380         args.array_len = (odvp == ndvp) ? 10 : 12;
8381         argoplist_size  = args.array_len * sizeof (nfs_argop4);
8382         argop = kmem_alloc(argoplist_size, KM_SLEEP);
8383 
8384         /*
8385          * Rename ops:
8386          *    PUTFH(sourcdir), SAVEFH, LOOKUP(src), GETFH(old),
8387          *    PUTFH(targetdir), RENAME, GETATTR(targetdir)
8388          *    LOOKUP(trgt), GETFH(new), GETATTR,
8389          *
8390          *    if (odvp != ndvp)
8391          *      add putfh(sourcedir), getattr(sourcedir) }
8392          */
8393         args.array = argop;
8394 
8395         e.error = nfs4_start_fop(mi, odvp, ndvp, OH_VFH_RENAME,
8396             &recov_state, NULL);
8397         if (e.error) {
8398                 kmem_free(argop, argoplist_size);
8399                 mutex_enter(&orp->r_statelock);
8400                 orp->r_flags &= ~R4RECEXPFH;
8401                 cv_broadcast(&orp->r_cv);
8402                 mutex_exit(&orp->r_statelock);
8403                 return (e.error);
8404         }
8405 
8406         /* 0: putfh source directory */
8407         argop[0].argop = OP_CPUTFH;
8408         argop[0].nfs_argop4_u.opcputfh.sfh = odrp->r_fh;
8409 
8410         /* 1: Save source fh to free up current for target */
8411         argop[1].argop = OP_SAVEFH;
8412 
8413         /* 2: Lookup pre-rename fh of renamed object */
8414         argop[2].argop = OP_CLOOKUP;
8415         argop[2].nfs_argop4_u.opclookup.cname = onm;
8416 
8417         /* 3: getfh fh of renamed object (before rename) */
8418         argop[3].argop = OP_GETFH;
8419 
8420         /* 4: putfh targetdir */
8421         argop[4].argop = OP_CPUTFH;
8422         argop[4].nfs_argop4_u.opcputfh.sfh = ndrp->r_fh;
8423 
8424         /* 5: current_fh is targetdir, saved_fh is sourcedir */
8425         argop[5].argop = OP_CRENAME;
8426         argop[5].nfs_argop4_u.opcrename.coldname = onm;
8427         argop[5].nfs_argop4_u.opcrename.cnewname = nnm;
8428 
8429         /* 6: getattr of target dir (post op attrs) */
8430         argop[6].argop = OP_GETATTR;
8431         argop[6].nfs_argop4_u.opgetattr.attr_request = NFS4_VATTR_MASK;
8432         argop[6].nfs_argop4_u.opgetattr.mi = mi;
8433 
8434         /* 7: Lookup post-rename fh of renamed object */
8435         argop[7].argop = OP_CLOOKUP;
8436         argop[7].nfs_argop4_u.opclookup.cname = nnm;
8437 
8438         /* 8: getfh fh of renamed object (after rename) */
8439         argop[8].argop = OP_GETFH;
8440 
8441         /* 9: getattr of renamed object */
8442         argop[9].argop = OP_GETATTR;
8443         argop[9].nfs_argop4_u.opgetattr.attr_request = NFS4_VATTR_MASK;
8444         argop[9].nfs_argop4_u.opgetattr.mi = mi;
8445 
8446         /*
8447          * If source/target dirs are different, then get new post-op
8448          * attrs for source dir also.
8449          */
8450         if (ndvp != odvp) {
8451                 /* 10: putfh (sourcedir) */
8452                 argop[10].argop = OP_CPUTFH;
8453                 argop[10].nfs_argop4_u.opcputfh.sfh = ndrp->r_fh;
8454 
8455                 /* 11: getattr (sourcedir) */
8456                 argop[11].argop = OP_GETATTR;
8457                 argop[11].nfs_argop4_u.opgetattr.attr_request = NFS4_VATTR_MASK;
8458                 argop[11].nfs_argop4_u.opgetattr.mi = mi;
8459         }
8460 
8461         dnlc_remove(odvp, onm);
8462         dnlc_remove(ndvp, nnm);
8463 
8464         doqueue = 1;
8465         t = gethrtime();
8466         rfs4call(mi, &args, &res, cr, &doqueue, 0, &e);
8467 
8468         needrecov = nfs4_needs_recovery(&e, FALSE, mi->mi_vfsp);
8469         if (e.error) {
8470                 PURGE_ATTRCACHE4(odvp);
8471                 PURGE_ATTRCACHE4(ndvp);
8472                 if (!needrecov) {
8473                         nfs4_end_fop(mi, odvp, ndvp, OH_VFH_RENAME,
8474                             &recov_state, needrecov);
8475                         goto out;
8476                 }
8477         } else {
8478                 *statp = res.status;
8479         }
8480 
8481         if (needrecov) {
8482                 bool_t abort;
8483 
8484                 abort = nfs4_start_recovery(&e, mi, odvp, ndvp, NULL, NULL,
8485                     OP_RENAME, NULL, NULL, NULL);
8486                 if (abort == FALSE) {
8487                         nfs4_end_fop(mi, odvp, ndvp, OH_VFH_RENAME,
8488                             &recov_state, needrecov);
8489                         kmem_free(argop, argoplist_size);
8490                         if (!e.error)
8491                                 (void) xdr_free(xdr_COMPOUND4res_clnt,
8492                                     (caddr_t)&res);
8493                         mutex_enter(&orp->r_statelock);
8494                         orp->r_flags &= ~R4RECEXPFH;
8495                         cv_broadcast(&orp->r_cv);
8496                         mutex_exit(&orp->r_statelock);
8497                         goto recov_retry;
8498                 } else {
8499                         if (e.error != 0) {
8500                                 nfs4_end_fop(mi, odvp, ndvp, OH_VFH_RENAME,
8501                                     &recov_state, needrecov);
8502                                 goto out;
8503                         }
8504                         /* fall through for res.status case */
8505                 }
8506         }
8507 
8508         resp = &res;
8509         /*
8510          * If OP_RENAME (or any prev op) failed, then return an error.
8511          * OP_RENAME is index 5, so if array len <= 6 we return an error.
8512          */
8513         if ((res.status != NFS4_OK) && (res.array_len <= 6)) {
8514                 /*
8515                  * Error in an op other than last Getattr
8516                  */
8517                 e.error = geterrno4(res.status);
8518                 PURGE_ATTRCACHE4(odvp);
8519                 PURGE_ATTRCACHE4(ndvp);
8520                 /*
8521                  * System V defines rename to return EEXIST, not
8522                  * ENOTEMPTY if the target directory is not empty.
8523                  * Over the wire, the error is NFSERR_ENOTEMPTY
8524                  * which geterrno4 maps to ENOTEMPTY.
8525                  */
8526                 if (e.error == ENOTEMPTY)
8527                         e.error = EEXIST;
8528                 nfs4_end_fop(mi, odvp, ndvp, OH_VFH_RENAME, &recov_state,
8529                     needrecov);
8530                 goto out;
8531         }
8532 
8533         /* rename results */
8534         rn_res = &res.array[5].nfs_resop4_u.oprename;
8535 
8536         if (res.status == NFS4_OK) {
8537                 /* Update target attribute, readdir and dnlc caches */
8538                 dinfo.di_garp =
8539                     &res.array[6].nfs_resop4_u.opgetattr.ga_res;
8540                 dinfo.di_cred = cr;
8541                 dinfo.di_time_call = t;
8542         } else
8543                 dinfop = NULL;
8544 
8545         /* Update source cache attribute, readdir and dnlc caches */
8546         nfs4_update_dircaches(&rn_res->target_cinfo, ndvp, NULL, NULL, dinfop);
8547 
8548         /* Update source cache attribute, readdir and dnlc caches */
8549         if (ndvp != odvp) {
8550                 update_parentdir_sfh(ovp, ndvp);
8551 
8552                 /*
8553                  * If dinfop is non-NULL, then compound succeded, so
8554                  * set di_garp to attrs for source dir.  dinfop is only
8555                  * set to NULL when compound fails.
8556                  */
8557                 if (dinfop)
8558                         dinfo.di_garp =
8559                             &res.array[11].nfs_resop4_u.opgetattr.ga_res;
8560                 nfs4_update_dircaches(&rn_res->source_cinfo, odvp, NULL, NULL,
8561                     dinfop);
8562         }
8563 
8564         /*
8565          * Update the rnode with the new component name and args,
8566          * and if the file handle changed, also update it with the new fh.
8567          * This is only necessary if the target object has an rnode
8568          * entry and there is no need to create one for it.
8569          */
8570         resop = &res.array[8];      /* getfh new res */
8571         ngf_res = &resop->nfs_resop4_u.opgetfh;
8572 
8573         /*
8574          * Update the path and filehandle for the renamed object.
8575          */
8576         nfs4rename_update(ovp, ndvp, &ngf_res->object, nnm);
8577 
8578         nfs4_end_fop(mi, odvp, ndvp, OH_VFH_RENAME, &recov_state, needrecov);
8579 
8580         if (res.status == NFS4_OK) {
8581                 resop++;        /* getattr res */
8582                 e.error = nfs4_update_attrcache(res.status,
8583                     &resop->nfs_resop4_u.opgetattr.ga_res,
8584                     t, ovp, cr);
8585         }
8586 
8587 out:
8588         kmem_free(argop, argoplist_size);
8589         if (resp)
8590                 (void) xdr_free(xdr_COMPOUND4res_clnt, (caddr_t)resp);
8591         mutex_enter(&orp->r_statelock);
8592         orp->r_flags &= ~R4RECEXPFH;
8593         cv_broadcast(&orp->r_cv);
8594         mutex_exit(&orp->r_statelock);
8595 
8596         return (e.error);
8597 }
8598 
8599 /* ARGSUSED */
8600 static int
8601 nfs4_mkdir(vnode_t *dvp, char *nm, struct vattr *va, vnode_t **vpp, cred_t *cr,
8602     caller_context_t *ct, int flags, vsecattr_t *vsecp)
8603 {
8604         int error;
8605         vnode_t *vp;
8606 
8607         if (nfs_zone() != VTOMI4(dvp)->mi_zone)
8608                 return (EPERM);
8609         /*
8610          * As ".." has special meaning and rather than send a mkdir
8611          * over the wire to just let the server freak out, we just
8612          * short circuit it here and return EEXIST
8613          */
8614         if (nm[0] == '.' && nm[1] == '.' && nm[2] == '\0')
8615                 return (EEXIST);
8616 
8617         /*
8618          * Decision to get the right gid and setgid bit of the
8619          * new directory is now made in call_nfs4_create_req.
8620          */
8621         va->va_mask |= AT_MODE;
8622         error = call_nfs4_create_req(dvp, nm, NULL, va, &vp, cr, NF4DIR);
8623         if (error)
8624                 return (error);
8625 
8626         *vpp = vp;
8627         return (0);
8628 }
8629 
8630 
8631 /*
8632  * rmdir is using the same remove v4 op as does remove.
8633  * Remove requires that the current fh be the target directory.
8634  * After the operation, the current fh is unchanged.
8635  * The compound op structure is:
8636  *      PUTFH(targetdir), REMOVE
8637  */
8638 /*ARGSUSED4*/
8639 static int
8640 nfs4_rmdir(vnode_t *dvp, char *nm, vnode_t *cdir, cred_t *cr,
8641     caller_context_t *ct, int flags)
8642 {
8643         int need_end_op = FALSE;
8644         COMPOUND4args_clnt args;
8645         COMPOUND4res_clnt res, *resp = NULL;
8646         REMOVE4res *rm_res;
8647         nfs_argop4 argop[3];
8648         nfs_resop4 *resop;
8649         vnode_t *vp;
8650         int doqueue;
8651         mntinfo4_t *mi;
8652         rnode4_t *drp;
8653         bool_t needrecov = FALSE;
8654         nfs4_recov_state_t recov_state;
8655         nfs4_error_t e = { 0, NFS4_OK, RPC_SUCCESS };
8656         dirattr_info_t dinfo, *dinfop;
8657 
8658         if (nfs_zone() != VTOMI4(dvp)->mi_zone)
8659                 return (EPERM);
8660         /*
8661          * As ".." has special meaning and rather than send a rmdir
8662          * over the wire to just let the server freak out, we just
8663          * short circuit it here and return EEXIST
8664          */
8665         if (nm[0] == '.' && nm[1] == '.' && nm[2] == '\0')
8666                 return (EEXIST);
8667 
8668         drp = VTOR4(dvp);
8669         if (nfs_rw_enter_sig(&drp->r_rwlock, RW_WRITER, INTR4(dvp)))
8670                 return (EINTR);
8671 
8672         /*
8673          * Attempt to prevent a rmdir(".") from succeeding.
8674          */
8675         e.error = nfs4lookup(dvp, nm, &vp, cr, 0);
8676         if (e.error) {
8677                 nfs_rw_exit(&drp->r_rwlock);
8678                 return (e.error);
8679         }
8680         if (vp == cdir) {
8681                 VN_RELE(vp);
8682                 nfs_rw_exit(&drp->r_rwlock);
8683                 return (EINVAL);
8684         }
8685 
8686         /*
8687          * Since nfsv4 remove op works on both files and directories,
8688          * check that the removed object is indeed a directory.
8689          */
8690         if (vp->v_type != VDIR) {
8691                 VN_RELE(vp);
8692                 nfs_rw_exit(&drp->r_rwlock);
8693                 return (ENOTDIR);
8694         }
8695 
8696         /*
8697          * First just remove the entry from the name cache, as it
8698          * is most likely an entry for this vp.
8699          */
8700         dnlc_remove(dvp, nm);
8701 
8702         /*
8703          * If there vnode reference count is greater than one, then
8704          * there may be additional references in the DNLC which will
8705          * need to be purged.  First, trying removing the entry for
8706          * the parent directory and see if that removes the additional
8707          * reference(s).  If that doesn't do it, then use dnlc_purge_vp
8708          * to completely remove any references to the directory which
8709          * might still exist in the DNLC.
8710          */
8711         if (vp->v_count > 1) {
8712                 dnlc_remove(vp, "..");
8713                 if (vp->v_count > 1)
8714                         dnlc_purge_vp(vp);
8715         }
8716 
8717         mi = VTOMI4(dvp);
8718         recov_state.rs_flags = 0;
8719         recov_state.rs_num_retry_despite_err = 0;
8720 
8721 recov_retry:
8722         args.ctag = TAG_RMDIR;
8723 
8724         /*
8725          * Rmdir ops: putfh dir; remove
8726          */
8727         args.array_len = 3;
8728         args.array = argop;
8729 
8730         e.error = nfs4_start_op(VTOMI4(dvp), dvp, NULL, &recov_state);
8731         if (e.error) {
8732                 nfs_rw_exit(&drp->r_rwlock);
8733                 return (e.error);
8734         }
8735         need_end_op = TRUE;
8736 
8737         /* putfh directory */
8738         argop[0].argop = OP_CPUTFH;
8739         argop[0].nfs_argop4_u.opcputfh.sfh = drp->r_fh;
8740 
8741         /* remove */
8742         argop[1].argop = OP_CREMOVE;
8743         argop[1].nfs_argop4_u.opcremove.ctarget = nm;
8744 
8745         /* getattr (postop attrs for dir that contained removed dir) */
8746         argop[2].argop = OP_GETATTR;
8747         argop[2].nfs_argop4_u.opgetattr.attr_request = NFS4_VATTR_MASK;
8748         argop[2].nfs_argop4_u.opgetattr.mi = mi;
8749 
8750         dinfo.di_time_call = gethrtime();
8751         doqueue = 1;
8752         rfs4call(mi, &args, &res, cr, &doqueue, 0, &e);
8753 
8754         PURGE_ATTRCACHE4(vp);
8755 
8756         needrecov = nfs4_needs_recovery(&e, FALSE, mi->mi_vfsp);
8757         if (e.error) {
8758                 PURGE_ATTRCACHE4(dvp);
8759         }
8760 
8761         if (needrecov) {
8762                 if (nfs4_start_recovery(&e, VTOMI4(dvp), dvp, NULL, NULL,
8763                     NULL, OP_REMOVE, NULL, NULL, NULL) == FALSE) {
8764                         if (!e.error)
8765                                 (void) xdr_free(xdr_COMPOUND4res_clnt,
8766                                     (caddr_t)&res);
8767 
8768                         nfs4_end_op(VTOMI4(dvp), dvp, NULL, &recov_state,
8769                             needrecov);
8770                         need_end_op = FALSE;
8771                         goto recov_retry;
8772                 }
8773         }
8774 
8775         if (!e.error) {
8776                 resp = &res;
8777 
8778                 /*
8779                  * Only return error if first 2 ops (OP_REMOVE or earlier)
8780                  * failed.
8781                  */
8782                 if (res.status != NFS4_OK && res.array_len <= 2) {
8783                         e.error = geterrno4(res.status);
8784                         PURGE_ATTRCACHE4(dvp);
8785                         nfs4_end_op(VTOMI4(dvp), dvp, NULL,
8786                             &recov_state, needrecov);
8787                         need_end_op = FALSE;
8788                         nfs4_purge_stale_fh(e.error, dvp, cr);
8789                         /*
8790                          * System V defines rmdir to return EEXIST, not
8791                          * ENOTEMPTY if the directory is not empty.  Over
8792                          * the wire, the error is NFSERR_ENOTEMPTY which
8793                          * geterrno4 maps to ENOTEMPTY.
8794                          */
8795                         if (e.error == ENOTEMPTY)
8796                                 e.error = EEXIST;
8797                 } else {
8798                         resop = &res.array[1];      /* remove res */
8799                         rm_res = &resop->nfs_resop4_u.opremove;
8800 
8801                         if (res.status == NFS4_OK) {
8802                                 resop = &res.array[2];      /* dir attrs */
8803                                 dinfo.di_garp =
8804                                     &resop->nfs_resop4_u.opgetattr.ga_res;
8805                                 dinfo.di_cred = cr;
8806                                 dinfop = &dinfo;
8807                         } else
8808                                 dinfop = NULL;
8809 
8810                         /* Update dir attribute, readdir and dnlc caches */
8811                         nfs4_update_dircaches(&rm_res->cinfo, dvp, NULL, NULL,
8812                             dinfop);
8813 
8814                         /* destroy rddir cache for dir that was removed */
8815                         if (VTOR4(vp)->r_dir != NULL)
8816                                 nfs4_purge_rddir_cache(vp);
8817                 }
8818         }
8819 
8820         if (need_end_op)
8821                 nfs4_end_op(VTOMI4(dvp), dvp, NULL, &recov_state, needrecov);
8822 
8823         nfs_rw_exit(&drp->r_rwlock);
8824 
8825         if (resp)
8826                 (void) xdr_free(xdr_COMPOUND4res_clnt, (caddr_t)resp);
8827 
8828         if (e.error == 0) {
8829                 vnode_t *tvp;
8830                 rnode4_t *trp;
8831                 trp = VTOR4(vp);
8832                 tvp = vp;
8833                 if (IS_SHADOW(vp, trp))
8834                         tvp = RTOV4(trp);
8835                 vnevent_rmdir(tvp, dvp, nm, ct);
8836         }
8837 
8838         VN_RELE(vp);
8839 
8840         return (e.error);
8841 }
8842 
8843 /* ARGSUSED */
8844 static int
8845 nfs4_symlink(vnode_t *dvp, char *lnm, struct vattr *tva, char *tnm, cred_t *cr,
8846     caller_context_t *ct, int flags)
8847 {
8848         int error;
8849         vnode_t *vp;
8850         rnode4_t *rp;
8851         char *contents;
8852         mntinfo4_t *mi = VTOMI4(dvp);
8853 
8854         if (nfs_zone() != mi->mi_zone)
8855                 return (EPERM);
8856         if (!(mi->mi_flags & MI4_SYMLINK))
8857                 return (EOPNOTSUPP);
8858 
8859         error = call_nfs4_create_req(dvp, lnm, tnm, tva, &vp, cr, NF4LNK);
8860         if (error)
8861                 return (error);
8862 
8863         ASSERT(nfs4_consistent_type(vp));
8864         rp = VTOR4(vp);
8865         if (nfs4_do_symlink_cache && rp->r_symlink.contents == NULL) {
8866 
8867                 contents = kmem_alloc(MAXPATHLEN, KM_SLEEP);
8868 
8869                 if (contents != NULL) {
8870                         mutex_enter(&rp->r_statelock);
8871                         if (rp->r_symlink.contents == NULL) {
8872                                 rp->r_symlink.len = strlen(tnm);
8873                                 bcopy(tnm, contents, rp->r_symlink.len);
8874                                 rp->r_symlink.contents = contents;
8875                                 rp->r_symlink.size = MAXPATHLEN;
8876                                 mutex_exit(&rp->r_statelock);
8877                         } else {
8878                                 mutex_exit(&rp->r_statelock);
8879                                 kmem_free((void *)contents, MAXPATHLEN);
8880                         }
8881                 }
8882         }
8883         VN_RELE(vp);
8884 
8885         return (error);
8886 }
8887 
8888 
8889 /*
8890  * Read directory entries.
8891  * There are some weird things to look out for here.  The uio_loffset
8892  * field is either 0 or it is the offset returned from a previous
8893  * readdir.  It is an opaque value used by the server to find the
8894  * correct directory block to read. The count field is the number
8895  * of blocks to read on the server.  This is advisory only, the server
8896  * may return only one block's worth of entries.  Entries may be compressed
8897  * on the server.
8898  */
8899 /* ARGSUSED */
8900 static int
8901 nfs4_readdir(vnode_t *vp, struct uio *uiop, cred_t *cr, int *eofp,
8902         caller_context_t *ct, int flags)
8903 {
8904         int error;
8905         uint_t count;
8906         rnode4_t *rp;
8907         rddir4_cache *rdc;
8908         rddir4_cache *rrdc;
8909 
8910         if (nfs_zone() != VTOMI4(vp)->mi_zone)
8911                 return (EIO);
8912         rp = VTOR4(vp);
8913 
8914         ASSERT(nfs_rw_lock_held(&rp->r_rwlock, RW_READER));
8915 
8916         /*
8917          * Make sure that the directory cache is valid.
8918          */
8919         if (rp->r_dir != NULL) {
8920                 if (nfs_disable_rddir_cache != 0) {
8921                         /*
8922                          * Setting nfs_disable_rddir_cache in /etc/system
8923                          * allows interoperability with servers that do not
8924                          * properly update the attributes of directories.
8925                          * Any cached information gets purged before an
8926                          * access is made to it.
8927                          */
8928                         nfs4_purge_rddir_cache(vp);
8929                 }
8930 
8931                 error = nfs4_validate_caches(vp, cr);
8932                 if (error)
8933                         return (error);
8934         }
8935 
8936         count = MIN(uiop->uio_iov->iov_len, MAXBSIZE);
8937 
8938         /*
8939          * Short circuit last readdir which always returns 0 bytes.
8940          * This can be done after the directory has been read through
8941          * completely at least once.  This will set r_direof which
8942          * can be used to find the value of the last cookie.
8943          */
8944         mutex_enter(&rp->r_statelock);
8945         if (rp->r_direof != NULL &&
8946             uiop->uio_loffset == rp->r_direof->nfs4_ncookie) {
8947                 mutex_exit(&rp->r_statelock);
8948 #ifdef DEBUG
8949                 nfs4_readdir_cache_shorts++;
8950 #endif
8951                 if (eofp)
8952                         *eofp = 1;
8953                 return (0);
8954         }
8955 
8956         /*
8957          * Look for a cache entry.  Cache entries are identified
8958          * by the NFS cookie value and the byte count requested.
8959          */
8960         rdc = rddir4_cache_lookup(rp, uiop->uio_loffset, count);
8961 
8962         /*
8963          * If rdc is NULL then the lookup resulted in an unrecoverable error.
8964          */
8965         if (rdc == NULL) {
8966                 mutex_exit(&rp->r_statelock);
8967                 return (EINTR);
8968         }
8969 
8970         /*
8971          * Check to see if we need to fill this entry in.
8972          */
8973         if (rdc->flags & RDDIRREQ) {
8974                 rdc->flags &= ~RDDIRREQ;
8975                 rdc->flags |= RDDIR;
8976                 mutex_exit(&rp->r_statelock);
8977 
8978                 /*
8979                  * Do the readdir.
8980                  */
8981                 nfs4readdir(vp, rdc, cr);
8982 
8983                 /*
8984                  * Reacquire the lock, so that we can continue
8985                  */
8986                 mutex_enter(&rp->r_statelock);
8987                 /*
8988                  * The entry is now complete
8989                  */
8990                 rdc->flags &= ~RDDIR;
8991         }
8992 
8993         ASSERT(!(rdc->flags & RDDIR));
8994 
8995         /*
8996          * If an error occurred while attempting
8997          * to fill the cache entry, mark the entry invalid and
8998          * just return the error.
8999          */
9000         if (rdc->error) {
9001                 error = rdc->error;
9002                 rdc->flags |= RDDIRREQ;
9003                 rddir4_cache_rele(rp, rdc);
9004                 mutex_exit(&rp->r_statelock);
9005                 return (error);
9006         }
9007 
9008         /*
9009          * The cache entry is complete and good,
9010          * copyout the dirent structs to the calling
9011          * thread.
9012          */
9013         error = uiomove(rdc->entries, rdc->actlen, UIO_READ, uiop);
9014 
9015         /*
9016          * If no error occurred during the copyout,
9017          * update the offset in the uio struct to
9018          * contain the value of the next NFS 4 cookie
9019          * and set the eof value appropriately.
9020          */
9021         if (!error) {
9022                 uiop->uio_loffset = rdc->nfs4_ncookie;
9023                 if (eofp)
9024                         *eofp = rdc->eof;
9025         }
9026 
9027         /*
9028          * Decide whether to do readahead.  Don't if we
9029          * have already read to the end of directory.
9030          */
9031         if (rdc->eof) {
9032                 /*
9033                  * Make the entry the direof only if it is cached
9034                  */
9035                 if (rdc->flags & RDDIRCACHED)
9036                         rp->r_direof = rdc;
9037                 rddir4_cache_rele(rp, rdc);
9038                 mutex_exit(&rp->r_statelock);
9039                 return (error);
9040         }
9041 
9042         /* Determine if a readdir readahead should be done */
9043         if (!(rp->r_flags & R4LOOKUP)) {
9044                 rddir4_cache_rele(rp, rdc);
9045                 mutex_exit(&rp->r_statelock);
9046                 return (error);
9047         }
9048 
9049         /*
9050          * Now look for a readahead entry.
9051          *
9052          * Check to see whether we found an entry for the readahead.
9053          * If so, we don't need to do anything further, so free the new
9054          * entry if one was allocated.  Otherwise, allocate a new entry, add
9055          * it to the cache, and then initiate an asynchronous readdir
9056          * operation to fill it.
9057          */
9058         rrdc = rddir4_cache_lookup(rp, rdc->nfs4_ncookie, count);
9059 
9060         /*
9061          * A readdir cache entry could not be obtained for the readahead.  In
9062          * this case we skip the readahead and return.
9063          */
9064         if (rrdc == NULL) {
9065                 rddir4_cache_rele(rp, rdc);
9066                 mutex_exit(&rp->r_statelock);
9067                 return (error);
9068         }
9069 
9070         /*
9071          * Check to see if we need to fill this entry in.
9072          */
9073         if (rrdc->flags & RDDIRREQ) {
9074                 rrdc->flags &= ~RDDIRREQ;
9075                 rrdc->flags |= RDDIR;
9076                 rddir4_cache_rele(rp, rdc);
9077                 mutex_exit(&rp->r_statelock);
9078 #ifdef DEBUG
9079                 nfs4_readdir_readahead++;
9080 #endif
9081                 /*
9082                  * Do the readdir.
9083                  */
9084                 nfs4_async_readdir(vp, rrdc, cr, do_nfs4readdir);
9085                 return (error);
9086         }
9087 
9088         rddir4_cache_rele(rp, rrdc);
9089         rddir4_cache_rele(rp, rdc);
9090         mutex_exit(&rp->r_statelock);
9091         return (error);
9092 }
9093 
9094 static int
9095 do_nfs4readdir(vnode_t *vp, rddir4_cache *rdc, cred_t *cr)
9096 {
9097         int error;
9098         rnode4_t *rp;
9099 
9100         ASSERT(nfs_zone() == VTOMI4(vp)->mi_zone);
9101 
9102         rp = VTOR4(vp);
9103 
9104         /*
9105          * Obtain the readdir results for the caller.
9106          */
9107         nfs4readdir(vp, rdc, cr);
9108 
9109         mutex_enter(&rp->r_statelock);
9110         /*
9111          * The entry is now complete
9112          */
9113         rdc->flags &= ~RDDIR;
9114 
9115         error = rdc->error;
9116         if (error)
9117                 rdc->flags |= RDDIRREQ;
9118         rddir4_cache_rele(rp, rdc);
9119         mutex_exit(&rp->r_statelock);
9120 
9121         return (error);
9122 }
9123 
9124 /*
9125  * Read directory entries.
9126  * There are some weird things to look out for here.  The uio_loffset
9127  * field is either 0 or it is the offset returned from a previous
9128  * readdir.  It is an opaque value used by the server to find the
9129  * correct directory block to read. The count field is the number
9130  * of blocks to read on the server.  This is advisory only, the server
9131  * may return only one block's worth of entries.  Entries may be compressed
9132  * on the server.
9133  *
9134  * Generates the following compound request:
9135  * 1. If readdir offset is zero and no dnlc entry for parent exists,
9136  *    must include a Lookupp as well. In this case, send:
9137  *    { Putfh <fh>; Readdir; Lookupp; Getfh; Getattr }
9138  * 2. Otherwise just do: { Putfh <fh>; Readdir }
9139  *
9140  * Get complete attributes and filehandles for entries if this is the
9141  * first read of the directory. Otherwise, just get fileid's.
9142  */
9143 static void
9144 nfs4readdir(vnode_t *vp, rddir4_cache *rdc, cred_t *cr)
9145 {
9146         COMPOUND4args_clnt args;
9147         COMPOUND4res_clnt res;
9148         READDIR4args *rargs;
9149         READDIR4res_clnt *rd_res;
9150         bitmap4 rd_bitsval;
9151         nfs_argop4 argop[5];
9152         nfs_resop4 *resop;
9153         rnode4_t *rp = VTOR4(vp);
9154         mntinfo4_t *mi = VTOMI4(vp);
9155         int doqueue;
9156         u_longlong_t nodeid, pnodeid;   /* id's of dir and its parents */
9157         vnode_t *dvp;
9158         nfs_cookie4 cookie = (nfs_cookie4)rdc->nfs4_cookie;
9159         int num_ops, res_opcnt;
9160         bool_t needrecov = FALSE;
9161         nfs4_recov_state_t recov_state;
9162         hrtime_t t;
9163         nfs4_error_t e = { 0, NFS4_OK, RPC_SUCCESS };
9164 
9165         ASSERT(nfs_zone() == mi->mi_zone);
9166         ASSERT(rdc->flags & RDDIR);
9167         ASSERT(rdc->entries == NULL);
9168 
9169         /*
9170          * If rp were a stub, it should have triggered and caused
9171          * a mount for us to get this far.
9172          */
9173         ASSERT(!RP_ISSTUB(rp));
9174 
9175         num_ops = 2;
9176         if (cookie == (nfs_cookie4)0 || cookie == (nfs_cookie4)1) {
9177                 /*
9178                  * Since nfsv4 readdir may not return entries for "." and "..",
9179                  * the client must recreate them:
9180                  * To find the correct nodeid, do the following:
9181                  * For current node, get nodeid from dnlc.
9182                  * - if current node is rootvp, set pnodeid to nodeid.
9183                  * - else if parent is in the dnlc, get its nodeid from there.
9184                  * - else add LOOKUPP+GETATTR to compound.
9185                  */
9186                 nodeid = rp->r_attr.va_nodeid;
9187                 if (vp->v_flag & VROOT) {
9188                         pnodeid = nodeid;       /* root of mount point */
9189                 } else {
9190                         dvp = dnlc_lookup(vp, "..");
9191                         if (dvp != NULL && dvp != DNLC_NO_VNODE) {
9192                                 /* parent in dnlc cache - no need for otw */
9193                                 pnodeid = VTOR4(dvp)->r_attr.va_nodeid;
9194                         } else {
9195                                 /*
9196                                  * parent not in dnlc cache,
9197                                  * do lookupp to get its id
9198                                  */
9199                                 num_ops = 5;
9200                                 pnodeid = 0; /* set later by getattr parent */
9201                         }
9202                         if (dvp)
9203                                 VN_RELE(dvp);
9204                 }
9205         }
9206         recov_state.rs_flags = 0;
9207         recov_state.rs_num_retry_despite_err = 0;
9208 
9209         /* Save the original mount point security flavor */
9210         (void) save_mnt_secinfo(mi->mi_curr_serv);
9211 
9212 recov_retry:
9213         args.ctag = TAG_READDIR;
9214 
9215         args.array = argop;
9216         args.array_len = num_ops;
9217 
9218         if (e.error = nfs4_start_fop(VTOMI4(vp), vp, NULL, OH_READDIR,
9219             &recov_state, NULL)) {
9220                 /*
9221                  * If readdir a node that is a stub for a crossed mount point,
9222                  * keep the original secinfo flavor for the current file
9223                  * system, not the crossed one.
9224                  */
9225                 (void) check_mnt_secinfo(mi->mi_curr_serv, vp);
9226                 rdc->error = e.error;
9227                 return;
9228         }
9229 
9230         /*
9231          * Determine which attrs to request for dirents.  This code
9232          * must be protected by nfs4_start/end_fop because of r_server
9233          * (which will change during failover recovery).
9234          *
9235          */
9236         if (rp->r_flags & (R4LOOKUP | R4READDIRWATTR)) {
9237                 /*
9238                  * Get all vattr attrs plus filehandle and rdattr_error
9239                  */
9240                 rd_bitsval = NFS4_VATTR_MASK |
9241                     FATTR4_RDATTR_ERROR_MASK |
9242                     FATTR4_FILEHANDLE_MASK;
9243 
9244                 if (rp->r_flags & R4READDIRWATTR) {
9245                         mutex_enter(&rp->r_statelock);
9246                         rp->r_flags &= ~R4READDIRWATTR;
9247                         mutex_exit(&rp->r_statelock);
9248                 }
9249         } else {
9250                 servinfo4_t *svp = rp->r_server;
9251 
9252                 /*
9253                  * Already read directory. Use readdir with
9254                  * no attrs (except for mounted_on_fileid) for updates.
9255                  */
9256                 rd_bitsval = FATTR4_RDATTR_ERROR_MASK;
9257 
9258                 /*
9259                  * request mounted on fileid if supported, else request
9260                  * fileid.  maybe we should verify that fileid is supported
9261                  * and request something else if not.
9262                  */
9263                 (void) nfs_rw_enter_sig(&svp->sv_lock, RW_READER, 0);
9264                 if (svp->sv_supp_attrs & FATTR4_MOUNTED_ON_FILEID_MASK)
9265                         rd_bitsval |= FATTR4_MOUNTED_ON_FILEID_MASK;
9266                 nfs_rw_exit(&svp->sv_lock);
9267         }
9268 
9269         /* putfh directory fh */
9270         argop[0].argop = OP_CPUTFH;
9271         argop[0].nfs_argop4_u.opcputfh.sfh = rp->r_fh;
9272 
9273         argop[1].argop = OP_READDIR;
9274         rargs = &argop[1].nfs_argop4_u.opreaddir;
9275         /*
9276          * 1 and 2 are reserved for client "." and ".." entry offset.
9277          * cookie 0 should be used over-the-wire to start reading at
9278          * the beginning of the directory excluding "." and "..".
9279          */
9280         if (rdc->nfs4_cookie == 0 ||
9281             rdc->nfs4_cookie == 1 ||
9282             rdc->nfs4_cookie == 2) {
9283                 rargs->cookie = (nfs_cookie4)0;
9284                 rargs->cookieverf = 0;
9285         } else {
9286                 rargs->cookie = (nfs_cookie4)rdc->nfs4_cookie;
9287                 mutex_enter(&rp->r_statelock);
9288                 rargs->cookieverf = rp->r_cookieverf4;
9289                 mutex_exit(&rp->r_statelock);
9290         }
9291         rargs->dircount = MIN(rdc->buflen, mi->mi_tsize);
9292         rargs->maxcount = mi->mi_tsize;
9293         rargs->attr_request = rd_bitsval;
9294         rargs->rdc = rdc;
9295         rargs->dvp = vp;
9296         rargs->mi = mi;
9297         rargs->cr = cr;
9298 
9299 
9300         /*
9301          * If count < than the minimum required, we return no entries
9302          * and fail with EINVAL
9303          */
9304         if (rargs->dircount < (DIRENT64_RECLEN(1) + DIRENT64_RECLEN(2))) {
9305                 rdc->error = EINVAL;
9306                 goto out;
9307         }
9308 
9309         if (args.array_len == 5) {
9310                 /*
9311                  * Add lookupp and getattr for parent nodeid.
9312                  */
9313                 argop[2].argop = OP_LOOKUPP;
9314 
9315                 argop[3].argop = OP_GETFH;
9316 
9317                 /* getattr parent */
9318                 argop[4].argop = OP_GETATTR;
9319                 argop[4].nfs_argop4_u.opgetattr.attr_request = NFS4_VATTR_MASK;
9320                 argop[4].nfs_argop4_u.opgetattr.mi = mi;
9321         }
9322 
9323         doqueue = 1;
9324 
9325         if (mi->mi_io_kstats) {
9326                 mutex_enter(&mi->mi_lock);
9327                 kstat_runq_enter(KSTAT_IO_PTR(mi->mi_io_kstats));
9328                 mutex_exit(&mi->mi_lock);
9329         }
9330 
9331         /* capture the time of this call */
9332         rargs->t = t = gethrtime();
9333 
9334         rfs4call(mi, &args, &res, cr, &doqueue, 0, &e);
9335 
9336         if (mi->mi_io_kstats) {
9337                 mutex_enter(&mi->mi_lock);
9338                 kstat_runq_exit(KSTAT_IO_PTR(mi->mi_io_kstats));
9339                 mutex_exit(&mi->mi_lock);
9340         }
9341 
9342         needrecov = nfs4_needs_recovery(&e, FALSE, mi->mi_vfsp);
9343 
9344         /*
9345          * If RPC error occurred and it isn't an error that
9346          * triggers recovery, then go ahead and fail now.
9347          */
9348         if (e.error != 0 && !needrecov) {
9349                 rdc->error = e.error;
9350                 goto out;
9351         }
9352 
9353         if (needrecov) {
9354                 bool_t abort;
9355 
9356                 NFS4_DEBUG(nfs4_client_recov_debug, (CE_NOTE,
9357                     "nfs4readdir: initiating recovery.\n"));
9358 
9359                 abort = nfs4_start_recovery(&e, VTOMI4(vp), vp, NULL, NULL,
9360                     NULL, OP_READDIR, NULL, NULL, NULL);
9361                 if (abort == FALSE) {
9362                         nfs4_end_fop(VTOMI4(vp), vp, NULL, OH_READDIR,
9363                             &recov_state, needrecov);
9364                         if (!e.error)
9365                                 (void) xdr_free(xdr_COMPOUND4res_clnt,
9366                                     (caddr_t)&res);
9367                         if (rdc->entries != NULL) {
9368                                 kmem_free(rdc->entries, rdc->entlen);
9369                                 rdc->entries = NULL;
9370                         }
9371                         goto recov_retry;
9372                 }
9373 
9374                 if (e.error != 0) {
9375                         rdc->error = e.error;
9376                         goto out;
9377                 }
9378 
9379                 /* fall through for res.status case */
9380         }
9381 
9382         res_opcnt = res.array_len;
9383 
9384         /*
9385          * If compound failed first 2 ops (PUTFH+READDIR), then return
9386          * failure here.  Subsequent ops are for filling out dot-dot
9387          * dirent, and if they fail, we still want to give the caller
9388          * the dirents returned by (the successful) READDIR op, so we need
9389          * to silently ignore failure for subsequent ops (LOOKUPP+GETATTR).
9390          *
9391          * One example where PUTFH+READDIR ops would succeed but
9392          * LOOKUPP+GETATTR would fail would be a dir that has r perm
9393          * but lacks x.  In this case, a POSIX server's VOP_READDIR
9394          * would succeed; however, VOP_LOOKUP(..) would fail since no
9395          * x perm.  We need to come up with a non-vendor-specific way
9396          * for a POSIX server to return d_ino from dotdot's dirent if
9397          * client only requests mounted_on_fileid, and just say the
9398          * LOOKUPP succeeded and fill out the GETATTR.  However, if
9399          * client requested any mandatory attrs, server would be required
9400          * to fail the GETATTR op because it can't call VOP_LOOKUP+VOP_GETATTR
9401          * for dotdot.
9402          */
9403 
9404         if (res.status) {
9405                 if (res_opcnt <= 2) {
9406                         e.error = geterrno4(res.status);
9407                         nfs4_end_fop(VTOMI4(vp), vp, NULL, OH_READDIR,
9408                             &recov_state, needrecov);
9409                         nfs4_purge_stale_fh(e.error, vp, cr);
9410                         rdc->error = e.error;
9411                         (void) xdr_free(xdr_COMPOUND4res_clnt, (caddr_t)&res);
9412                         if (rdc->entries != NULL) {
9413                                 kmem_free(rdc->entries, rdc->entlen);
9414                                 rdc->entries = NULL;
9415                         }
9416                         /*
9417                          * If readdir a node that is a stub for a
9418                          * crossed mount point, keep the original
9419                          * secinfo flavor for the current file system,
9420                          * not the crossed one.
9421                          */
9422                         (void) check_mnt_secinfo(mi->mi_curr_serv, vp);
9423                         return;
9424                 }
9425         }
9426 
9427         resop = &res.array[1];      /* readdir res */
9428         rd_res = &resop->nfs_resop4_u.opreaddirclnt;
9429 
9430         mutex_enter(&rp->r_statelock);
9431         rp->r_cookieverf4 = rd_res->cookieverf;
9432         mutex_exit(&rp->r_statelock);
9433 
9434         /*
9435          * For "." and ".." entries
9436          * e.g.
9437          *      seek(cookie=0) -> "." entry with d_off = 1
9438          *      seek(cookie=1) -> ".." entry with d_off = 2
9439          */
9440         if (cookie == (nfs_cookie4) 0) {
9441                 if (rd_res->dotp)
9442                         rd_res->dotp->d_ino = nodeid;
9443                 if (rd_res->dotdotp)
9444                         rd_res->dotdotp->d_ino = pnodeid;
9445         }
9446         if (cookie == (nfs_cookie4) 1) {
9447                 if (rd_res->dotdotp)
9448                         rd_res->dotdotp->d_ino = pnodeid;
9449         }
9450 
9451 
9452         /* LOOKUPP+GETATTR attemped */
9453         if (args.array_len == 5 && rd_res->dotdotp) {
9454                 if (res.status == NFS4_OK && res_opcnt == 5) {
9455                         nfs_fh4 *fhp;
9456                         nfs4_sharedfh_t *sfhp;
9457                         vnode_t *pvp;
9458                         nfs4_ga_res_t *garp;
9459 
9460                         resop++;        /* lookupp */
9461                         resop++;        /* getfh   */
9462                         fhp = &resop->nfs_resop4_u.opgetfh.object;
9463 
9464                         resop++;        /* getattr of parent */
9465 
9466                         /*
9467                          * First, take care of finishing the
9468                          * readdir results.
9469                          */
9470                         garp = &resop->nfs_resop4_u.opgetattr.ga_res;
9471                         /*
9472                          * The d_ino of .. must be the inode number
9473                          * of the mounted filesystem.
9474                          */
9475                         if (garp->n4g_va.va_mask & AT_NODEID)
9476                                 rd_res->dotdotp->d_ino =
9477                                     garp->n4g_va.va_nodeid;
9478 
9479 
9480                         /*
9481                          * Next, create the ".." dnlc entry
9482                          */
9483                         sfhp = sfh4_get(fhp, mi);
9484                         if (!nfs4_make_dotdot(sfhp, t, vp, cr, &pvp, 0)) {
9485                                 dnlc_update(vp, "..", pvp);
9486                                 VN_RELE(pvp);
9487                         }
9488                         sfh4_rele(&sfhp);
9489                 }
9490         }
9491 
9492         if (mi->mi_io_kstats) {
9493                 mutex_enter(&mi->mi_lock);
9494                 KSTAT_IO_PTR(mi->mi_io_kstats)->reads++;
9495                 KSTAT_IO_PTR(mi->mi_io_kstats)->nread += rdc->actlen;
9496                 mutex_exit(&mi->mi_lock);
9497         }
9498 
9499         (void) xdr_free(xdr_COMPOUND4res_clnt, (caddr_t)&res);
9500 
9501 out:
9502         /*
9503          * If readdir a node that is a stub for a crossed mount point,
9504          * keep the original secinfo flavor for the current file system,
9505          * not the crossed one.
9506          */
9507         (void) check_mnt_secinfo(mi->mi_curr_serv, vp);
9508 
9509         nfs4_end_fop(mi, vp, NULL, OH_READDIR, &recov_state, needrecov);
9510 }
9511 
9512 
9513 static int
9514 nfs4_bio(struct buf *bp, stable_how4 *stab_comm, cred_t *cr, bool_t readahead)
9515 {
9516         rnode4_t *rp = VTOR4(bp->b_vp);
9517         int count;
9518         int error;
9519         cred_t *cred_otw = NULL;
9520         offset_t offset;
9521         nfs4_open_stream_t *osp = NULL;
9522         bool_t first_time = TRUE;       /* first time getting otw cred */
9523         bool_t last_time = FALSE;       /* last time getting otw cred */
9524 
9525         ASSERT(nfs_zone() == VTOMI4(bp->b_vp)->mi_zone);
9526 
9527         DTRACE_IO1(start, struct buf *, bp);
9528         offset = ldbtob(bp->b_lblkno);
9529 
9530         if (bp->b_flags & B_READ) {
9531         read_again:
9532                 /*
9533                  * Releases the osp, if it is provided.
9534                  * Puts a hold on the cred_otw and the new osp (if found).
9535                  */
9536                 cred_otw = nfs4_get_otw_cred_by_osp(rp, cr, &osp,
9537                     &first_time, &last_time);
9538                 error = bp->b_error = nfs4read(bp->b_vp, bp->b_un.b_addr,
9539                     offset, bp->b_bcount, &bp->b_resid, cred_otw,
9540                     readahead, NULL);
9541                 crfree(cred_otw);
9542                 if (!error) {
9543                         if (bp->b_resid) {
9544                                 /*
9545                                  * Didn't get it all because we hit EOF,
9546                                  * zero all the memory beyond the EOF.
9547                                  */
9548                                 /* bzero(rdaddr + */
9549                                 bzero(bp->b_un.b_addr +
9550                                     bp->b_bcount - bp->b_resid, bp->b_resid);
9551                         }
9552                         mutex_enter(&rp->r_statelock);
9553                         if (bp->b_resid == bp->b_bcount &&
9554                             offset >= rp->r_size) {
9555                                 /*
9556                                  * We didn't read anything at all as we are
9557                                  * past EOF.  Return an error indicator back
9558                                  * but don't destroy the pages (yet).
9559                                  */
9560                                 error = NFS_EOF;
9561                         }
9562                         mutex_exit(&rp->r_statelock);
9563                 } else if (error == EACCES && last_time == FALSE) {
9564                                 goto read_again;
9565                 }
9566         } else {
9567                 if (!(rp->r_flags & R4STALE)) {
9568 write_again:
9569                         /*
9570                          * Releases the osp, if it is provided.
9571                          * Puts a hold on the cred_otw and the new
9572                          * osp (if found).
9573                          */
9574                         cred_otw = nfs4_get_otw_cred_by_osp(rp, cr, &osp,
9575                             &first_time, &last_time);
9576                         mutex_enter(&rp->r_statelock);
9577                         count = MIN(bp->b_bcount, rp->r_size - offset);
9578                         mutex_exit(&rp->r_statelock);
9579                         if (count < 0)
9580                                 cmn_err(CE_PANIC, "nfs4_bio: write count < 0");
9581 #ifdef DEBUG
9582                         if (count == 0) {
9583                                 zoneid_t zoneid = getzoneid();
9584 
9585                                 zcmn_err(zoneid, CE_WARN,
9586                                     "nfs4_bio: zero length write at %lld",
9587                                     offset);
9588                                 zcmn_err(zoneid, CE_CONT, "flags=0x%x, "
9589                                     "b_bcount=%ld, file size=%lld",
9590                                     rp->r_flags, (long)bp->b_bcount,
9591                                     rp->r_size);
9592                                 sfh4_printfhandle(VTOR4(bp->b_vp)->r_fh);
9593                                 if (nfs4_bio_do_stop)
9594                                         debug_enter("nfs4_bio");
9595                         }
9596 #endif
9597                         error = nfs4write(bp->b_vp, bp->b_un.b_addr, offset,
9598                             count, cred_otw, stab_comm);
9599                         if (error == EACCES && last_time == FALSE) {
9600                                 crfree(cred_otw);
9601                                 goto write_again;
9602                         }
9603                         bp->b_error = error;
9604                         if (error && error != EINTR &&
9605                             !(bp->b_vp->v_vfsp->vfs_flag & VFS_UNMOUNTED)) {
9606                                 /*
9607                                  * Don't print EDQUOT errors on the console.
9608                                  * Don't print asynchronous EACCES errors.
9609                                  * Don't print EFBIG errors.
9610                                  * Print all other write errors.
9611                                  */
9612                                 if (error != EDQUOT && error != EFBIG &&
9613                                     (error != EACCES ||
9614                                     !(bp->b_flags & B_ASYNC)))
9615                                         nfs4_write_error(bp->b_vp,
9616                                             error, cred_otw);
9617                                 /*
9618                                  * Update r_error and r_flags as appropriate.
9619                                  * If the error was ESTALE, then mark the
9620                                  * rnode as not being writeable and save
9621                                  * the error status.  Otherwise, save any
9622                                  * errors which occur from asynchronous
9623                                  * page invalidations.  Any errors occurring
9624                                  * from other operations should be saved
9625                                  * by the caller.
9626                                  */
9627                                 mutex_enter(&rp->r_statelock);
9628                                 if (error == ESTALE) {
9629                                         rp->r_flags |= R4STALE;
9630                                         if (!rp->r_error)
9631                                                 rp->r_error = error;
9632                                 } else if (!rp->r_error &&
9633                                     (bp->b_flags &
9634                                     (B_INVAL|B_FORCE|B_ASYNC)) ==
9635                                     (B_INVAL|B_FORCE|B_ASYNC)) {
9636                                         rp->r_error = error;
9637                                 }
9638                                 mutex_exit(&rp->r_statelock);
9639                         }
9640                         crfree(cred_otw);
9641                 } else {
9642                         error = rp->r_error;
9643                         /*
9644                          * A close may have cleared r_error, if so,
9645                          * propagate ESTALE error return properly
9646                          */
9647                         if (error == 0)
9648                                 error = ESTALE;
9649                 }
9650         }
9651 
9652         if (error != 0 && error != NFS_EOF)
9653                 bp->b_flags |= B_ERROR;
9654 
9655         if (osp)
9656                 open_stream_rele(osp, rp);
9657 
9658         DTRACE_IO1(done, struct buf *, bp);
9659 
9660         return (error);
9661 }
9662 
9663 /* ARGSUSED */
9664 int
9665 nfs4_fid(vnode_t *vp, fid_t *fidp, caller_context_t *ct)
9666 {
9667         return (EREMOTE);
9668 }
9669 
9670 /* ARGSUSED2 */
9671 int
9672 nfs4_rwlock(vnode_t *vp, int write_lock, caller_context_t *ctp)
9673 {
9674         rnode4_t *rp = VTOR4(vp);
9675 
9676         if (!write_lock) {
9677                 (void) nfs_rw_enter_sig(&rp->r_rwlock, RW_READER, FALSE);
9678                 return (V_WRITELOCK_FALSE);
9679         }
9680 
9681         if ((rp->r_flags & R4DIRECTIO) ||
9682             (VTOMI4(vp)->mi_flags & MI4_DIRECTIO)) {
9683                 (void) nfs_rw_enter_sig(&rp->r_rwlock, RW_READER, FALSE);
9684                 if (rp->r_mapcnt == 0 && !nfs4_has_pages(vp))
9685                         return (V_WRITELOCK_FALSE);
9686                 nfs_rw_exit(&rp->r_rwlock);
9687         }
9688 
9689         (void) nfs_rw_enter_sig(&rp->r_rwlock, RW_WRITER, FALSE);
9690         return (V_WRITELOCK_TRUE);
9691 }
9692 
9693 /* ARGSUSED */
9694 void
9695 nfs4_rwunlock(vnode_t *vp, int write_lock, caller_context_t *ctp)
9696 {
9697         rnode4_t *rp = VTOR4(vp);
9698 
9699         nfs_rw_exit(&rp->r_rwlock);
9700 }
9701 
9702 /* ARGSUSED */
9703 static int
9704 nfs4_seek(vnode_t *vp, offset_t ooff, offset_t *noffp, caller_context_t *ct)
9705 {
9706         if (nfs_zone() != VTOMI4(vp)->mi_zone)
9707                 return (EIO);
9708 
9709         /*
9710          * Because we stuff the readdir cookie into the offset field
9711          * someone may attempt to do an lseek with the cookie which
9712          * we want to succeed.
9713          */
9714         if (vp->v_type == VDIR)
9715                 return (0);
9716         if (*noffp < 0)
9717                 return (EINVAL);
9718         return (0);
9719 }
9720 
9721 
9722 /*
9723  * Return all the pages from [off..off+len) in file
9724  */
9725 /* ARGSUSED */
9726 static int
9727 nfs4_getpage(vnode_t *vp, offset_t off, size_t len, uint_t *protp,
9728     page_t *pl[], size_t plsz, struct seg *seg, caddr_t addr,
9729         enum seg_rw rw, cred_t *cr, caller_context_t *ct)
9730 {
9731         rnode4_t *rp;
9732         int error;
9733         mntinfo4_t *mi;
9734 
9735         if (nfs_zone() != VTOMI4(vp)->mi_zone)
9736                 return (EIO);
9737         rp = VTOR4(vp);
9738         if (IS_SHADOW(vp, rp))
9739                 vp = RTOV4(rp);
9740 
9741         if (vp->v_flag & VNOMAP)
9742                 return (ENOSYS);
9743 
9744         if (protp != NULL)
9745                 *protp = PROT_ALL;
9746 
9747         /*
9748          * Now validate that the caches are up to date.
9749          */
9750         if (error = nfs4_validate_caches(vp, cr))
9751                 return (error);
9752 
9753         mi = VTOMI4(vp);
9754 retry:
9755         mutex_enter(&rp->r_statelock);
9756 
9757         /*
9758          * Don't create dirty pages faster than they
9759          * can be cleaned so that the system doesn't
9760          * get imbalanced.  If the async queue is
9761          * maxed out, then wait for it to drain before
9762          * creating more dirty pages.  Also, wait for
9763          * any threads doing pagewalks in the vop_getattr
9764          * entry points so that they don't block for
9765          * long periods.
9766          */
9767         if (rw == S_CREATE) {
9768                 while ((mi->mi_max_threads != 0 &&
9769                     rp->r_awcount > 2 * mi->mi_max_threads) ||
9770                     rp->r_gcount > 0)
9771                         cv_wait(&rp->r_cv, &rp->r_statelock);
9772         }
9773 
9774         /*
9775          * If we are getting called as a side effect of an nfs_write()
9776          * operation the local file size might not be extended yet.
9777          * In this case we want to be able to return pages of zeroes.
9778          */
9779         if (off + len > rp->r_size + PAGEOFFSET && seg != segkmap) {
9780                 NFS4_DEBUG(nfs4_pageio_debug,
9781                     (CE_NOTE, "getpage beyond EOF: off=%lld, "
9782                     "len=%llu, size=%llu, attrsize =%llu", off,
9783                     (u_longlong_t)len, rp->r_size, rp->r_attr.va_size));
9784                 mutex_exit(&rp->r_statelock);
9785                 return (EFAULT);                /* beyond EOF */
9786         }
9787 
9788         mutex_exit(&rp->r_statelock);
9789 
9790         if (len <= PAGESIZE) {
9791                 error = nfs4_getapage(vp, off, len, protp, pl, plsz,
9792                     seg, addr, rw, cr);
9793                 NFS4_DEBUG(nfs4_pageio_debug && error,
9794                     (CE_NOTE, "getpage error %d; off=%lld, "
9795                     "len=%lld", error, off, (u_longlong_t)len));
9796         } else {
9797                 error = pvn_getpages(nfs4_getapage, vp, off, len, protp,
9798                     pl, plsz, seg, addr, rw, cr);
9799                 NFS4_DEBUG(nfs4_pageio_debug && error,
9800                     (CE_NOTE, "getpages error %d; off=%lld, "
9801                     "len=%lld", error, off, (u_longlong_t)len));
9802         }
9803 
9804         switch (error) {
9805         case NFS_EOF:
9806                 nfs4_purge_caches(vp, NFS4_NOPURGE_DNLC, cr, FALSE);
9807                 goto retry;
9808         case ESTALE:
9809                 nfs4_purge_stale_fh(error, vp, cr);
9810         }
9811 
9812         return (error);
9813 }
9814 
9815 /*
9816  * Called from pvn_getpages or nfs4_getpage to get a particular page.
9817  */
9818 /* ARGSUSED */
9819 static int
9820 nfs4_getapage(vnode_t *vp, u_offset_t off, size_t len, uint_t *protp,
9821     page_t *pl[], size_t plsz, struct seg *seg, caddr_t addr,
9822     enum seg_rw rw, cred_t *cr)
9823 {
9824         rnode4_t *rp;
9825         uint_t bsize;
9826         struct buf *bp;
9827         page_t *pp;
9828         u_offset_t lbn;
9829         u_offset_t io_off;
9830         u_offset_t blkoff;
9831         u_offset_t rablkoff;
9832         size_t io_len;
9833         uint_t blksize;
9834         int error;
9835         int readahead;
9836         int readahead_issued = 0;
9837         int ra_window; /* readahead window */
9838         page_t *pagefound;
9839         page_t *savepp;
9840 
9841         if (nfs_zone() != VTOMI4(vp)->mi_zone)
9842                 return (EIO);
9843 
9844         rp = VTOR4(vp);
9845         ASSERT(!IS_SHADOW(vp, rp));
9846         bsize = MAX(vp->v_vfsp->vfs_bsize, PAGESIZE);
9847 
9848 reread:
9849         bp = NULL;
9850         pp = NULL;
9851         pagefound = NULL;
9852 
9853         if (pl != NULL)
9854                 pl[0] = NULL;
9855 
9856         error = 0;
9857         lbn = off / bsize;
9858         blkoff = lbn * bsize;
9859 
9860         /*
9861          * Queueing up the readahead before doing the synchronous read
9862          * results in a significant increase in read throughput because
9863          * of the increased parallelism between the async threads and
9864          * the process context.
9865          */
9866         if ((off & ((vp->v_vfsp->vfs_bsize) - 1)) == 0 &&
9867             rw != S_CREATE &&
9868             !(vp->v_flag & VNOCACHE)) {
9869                 mutex_enter(&rp->r_statelock);
9870 
9871                 /*
9872                  * Calculate the number of readaheads to do.
9873                  * a) No readaheads at offset = 0.
9874                  * b) Do maximum(nfs4_nra) readaheads when the readahead
9875                  *    window is closed.
9876                  * c) Do readaheads between 1 to (nfs4_nra - 1) depending
9877                  *    upon how far the readahead window is open or close.
9878                  * d) No readaheads if rp->r_nextr is not within the scope
9879                  *    of the readahead window (random i/o).
9880                  */
9881 
9882                 if (off == 0)
9883                         readahead = 0;
9884                 else if (blkoff == rp->r_nextr)
9885                         readahead = nfs4_nra;
9886                 else if (rp->r_nextr > blkoff &&
9887                     ((ra_window = (rp->r_nextr - blkoff) / bsize)
9888                     <= (nfs4_nra - 1)))
9889                         readahead = nfs4_nra - ra_window;
9890                 else
9891                         readahead = 0;
9892 
9893                 rablkoff = rp->r_nextr;
9894                 while (readahead > 0 && rablkoff + bsize < rp->r_size) {
9895                         mutex_exit(&rp->r_statelock);
9896                         if (nfs4_async_readahead(vp, rablkoff + bsize,
9897                             addr + (rablkoff + bsize - off),
9898                             seg, cr, nfs4_readahead) < 0) {
9899                                 mutex_enter(&rp->r_statelock);
9900                                 break;
9901                         }
9902                         readahead--;
9903                         rablkoff += bsize;
9904                         /*
9905                          * Indicate that we did a readahead so
9906                          * readahead offset is not updated
9907                          * by the synchronous read below.
9908                          */
9909                         readahead_issued = 1;
9910                         mutex_enter(&rp->r_statelock);
9911                         /*
9912                          * set readahead offset to
9913                          * offset of last async readahead
9914                          * request.
9915                          */
9916                         rp->r_nextr = rablkoff;
9917                 }
9918                 mutex_exit(&rp->r_statelock);
9919         }
9920 
9921 again:
9922         if ((pagefound = page_exists(vp, off)) == NULL) {
9923                 if (pl == NULL) {
9924                         (void) nfs4_async_readahead(vp, blkoff, addr, seg, cr,
9925                             nfs4_readahead);
9926                 } else if (rw == S_CREATE) {
9927                         /*
9928                          * Block for this page is not allocated, or the offset
9929                          * is beyond the current allocation size, or we're
9930                          * allocating a swap slot and the page was not found,
9931                          * so allocate it and return a zero page.
9932                          */
9933                         if ((pp = page_create_va(vp, off,
9934                             PAGESIZE, PG_WAIT, seg, addr)) == NULL)
9935                                 cmn_err(CE_PANIC, "nfs4_getapage: page_create");
9936                         io_len = PAGESIZE;
9937                         mutex_enter(&rp->r_statelock);
9938                         rp->r_nextr = off + PAGESIZE;
9939                         mutex_exit(&rp->r_statelock);
9940                 } else {
9941                         /*
9942                          * Need to go to server to get a block
9943                          */
9944                         mutex_enter(&rp->r_statelock);
9945                         if (blkoff < rp->r_size &&
9946                             blkoff + bsize > rp->r_size) {
9947                                 /*
9948                                  * If less than a block left in
9949                                  * file read less than a block.
9950                                  */
9951                                 if (rp->r_size <= off) {
9952                                         /*
9953                                          * Trying to access beyond EOF,
9954                                          * set up to get at least one page.
9955                                          */
9956                                         blksize = off + PAGESIZE - blkoff;
9957                                 } else
9958                                         blksize = rp->r_size - blkoff;
9959                         } else if ((off == 0) ||
9960                             (off != rp->r_nextr && !readahead_issued)) {
9961                                 blksize = PAGESIZE;
9962                                 blkoff = off; /* block = page here */
9963                         } else
9964                                 blksize = bsize;
9965                         mutex_exit(&rp->r_statelock);
9966 
9967                         pp = pvn_read_kluster(vp, off, seg, addr, &io_off,
9968                             &io_len, blkoff, blksize, 0);
9969 
9970                         /*
9971                          * Some other thread has entered the page,
9972                          * so just use it.
9973                          */
9974                         if (pp == NULL)
9975                                 goto again;
9976 
9977                         /*
9978                          * Now round the request size up to page boundaries.
9979                          * This ensures that the entire page will be
9980                          * initialized to zeroes if EOF is encountered.
9981                          */
9982                         io_len = ptob(btopr(io_len));
9983 
9984                         bp = pageio_setup(pp, io_len, vp, B_READ);
9985                         ASSERT(bp != NULL);
9986 
9987                         /*
9988                          * pageio_setup should have set b_addr to 0.  This
9989                          * is correct since we want to do I/O on a page
9990                          * boundary.  bp_mapin will use this addr to calculate
9991                          * an offset, and then set b_addr to the kernel virtual
9992                          * address it allocated for us.
9993                          */
9994                         ASSERT(bp->b_un.b_addr == 0);
9995 
9996                         bp->b_edev = 0;
9997                         bp->b_dev = 0;
9998                         bp->b_lblkno = lbtodb(io_off);
9999                         bp->b_file = vp;
10000                         bp->b_offset = (offset_t)off;
10001                         bp_mapin(bp);
10002 
10003                         /*
10004                          * If doing a write beyond what we believe is EOF,
10005                          * don't bother trying to read the pages from the
10006                          * server, we'll just zero the pages here.  We
10007                          * don't check that the rw flag is S_WRITE here
10008                          * because some implementations may attempt a
10009                          * read access to the buffer before copying data.
10010                          */
10011                         mutex_enter(&rp->r_statelock);
10012                         if (io_off >= rp->r_size && seg == segkmap) {
10013                                 mutex_exit(&rp->r_statelock);
10014                                 bzero(bp->b_un.b_addr, io_len);
10015                         } else {
10016                                 mutex_exit(&rp->r_statelock);
10017                                 error = nfs4_bio(bp, NULL, cr, FALSE);
10018                         }
10019 
10020                         /*
10021                          * Unmap the buffer before freeing it.
10022                          */
10023                         bp_mapout(bp);
10024                         pageio_done(bp);
10025 
10026                         savepp = pp;
10027                         do {
10028                                 pp->p_fsdata = C_NOCOMMIT;
10029                         } while ((pp = pp->p_next) != savepp);
10030 
10031                         if (error == NFS_EOF) {
10032                                 /*
10033                                  * If doing a write system call just return
10034                                  * zeroed pages, else user tried to get pages
10035                                  * beyond EOF, return error.  We don't check
10036                                  * that the rw flag is S_WRITE here because
10037                                  * some implementations may attempt a read
10038                                  * access to the buffer before copying data.
10039                                  */
10040                                 if (seg == segkmap)
10041                                         error = 0;
10042                                 else
10043                                         error = EFAULT;
10044                         }
10045 
10046                         if (!readahead_issued && !error) {
10047                                 mutex_enter(&rp->r_statelock);
10048                                 rp->r_nextr = io_off + io_len;
10049                                 mutex_exit(&rp->r_statelock);
10050                         }
10051                 }
10052         }
10053 
10054 out:
10055         if (pl == NULL)
10056                 return (error);
10057 
10058         if (error) {
10059                 if (pp != NULL)
10060                         pvn_read_done(pp, B_ERROR);
10061                 return (error);
10062         }
10063 
10064         if (pagefound) {
10065                 se_t se = (rw == S_CREATE ? SE_EXCL : SE_SHARED);
10066 
10067                 /*
10068                  * Page exists in the cache, acquire the appropriate lock.
10069                  * If this fails, start all over again.
10070                  */
10071                 if ((pp = page_lookup(vp, off, se)) == NULL) {
10072 #ifdef DEBUG
10073                         nfs4_lostpage++;
10074 #endif
10075                         goto reread;
10076                 }
10077                 pl[0] = pp;
10078                 pl[1] = NULL;
10079                 return (0);
10080         }
10081 
10082         if (pp != NULL)
10083                 pvn_plist_init(pp, pl, plsz, off, io_len, rw);
10084 
10085         return (error);
10086 }
10087 
10088 static void
10089 nfs4_readahead(vnode_t *vp, u_offset_t blkoff, caddr_t addr, struct seg *seg,
10090     cred_t *cr)
10091 {
10092         int error;
10093         page_t *pp;
10094         u_offset_t io_off;
10095         size_t io_len;
10096         struct buf *bp;
10097         uint_t bsize, blksize;
10098         rnode4_t *rp = VTOR4(vp);
10099         page_t *savepp;
10100 
10101         ASSERT(nfs_zone() == VTOMI4(vp)->mi_zone);
10102 
10103         bsize = MAX(vp->v_vfsp->vfs_bsize, PAGESIZE);
10104 
10105         mutex_enter(&rp->r_statelock);
10106         if (blkoff < rp->r_size && blkoff + bsize > rp->r_size) {
10107                 /*
10108                  * If less than a block left in file read less
10109                  * than a block.
10110                  */
10111                 blksize = rp->r_size - blkoff;
10112         } else
10113                 blksize = bsize;
10114         mutex_exit(&rp->r_statelock);
10115 
10116         pp = pvn_read_kluster(vp, blkoff, segkmap, addr,
10117             &io_off, &io_len, blkoff, blksize, 1);
10118         /*
10119          * The isra flag passed to the kluster function is 1, we may have
10120          * gotten a return value of NULL for a variety of reasons (# of free
10121          * pages < minfree, someone entered the page on the vnode etc). In all
10122          * cases, we want to punt on the readahead.
10123          */
10124         if (pp == NULL)
10125                 return;
10126 
10127         /*
10128          * Now round the request size up to page boundaries.
10129          * This ensures that the entire page will be
10130          * initialized to zeroes if EOF is encountered.
10131          */
10132         io_len = ptob(btopr(io_len));
10133 
10134         bp = pageio_setup(pp, io_len, vp, B_READ);
10135         ASSERT(bp != NULL);
10136 
10137         /*
10138          * pageio_setup should have set b_addr to 0.  This is correct since
10139          * we want to do I/O on a page boundary. bp_mapin() will use this addr
10140          * to calculate an offset, and then set b_addr to the kernel virtual
10141          * address it allocated for us.
10142          */
10143         ASSERT(bp->b_un.b_addr == 0);
10144 
10145         bp->b_edev = 0;
10146         bp->b_dev = 0;
10147         bp->b_lblkno = lbtodb(io_off);
10148         bp->b_file = vp;
10149         bp->b_offset = (offset_t)blkoff;
10150         bp_mapin(bp);
10151 
10152         /*
10153          * If doing a write beyond what we believe is EOF, don't bother trying
10154          * to read the pages from the server, we'll just zero the pages here.
10155          * We don't check that the rw flag is S_WRITE here because some
10156          * implementations may attempt a read access to the buffer before
10157          * copying data.
10158          */
10159         mutex_enter(&rp->r_statelock);
10160         if (io_off >= rp->r_size && seg == segkmap) {
10161                 mutex_exit(&rp->r_statelock);
10162                 bzero(bp->b_un.b_addr, io_len);
10163                 error = 0;
10164         } else {
10165                 mutex_exit(&rp->r_statelock);
10166                 error = nfs4_bio(bp, NULL, cr, TRUE);
10167                 if (error == NFS_EOF)
10168                         error = 0;
10169         }
10170 
10171         /*
10172          * Unmap the buffer before freeing it.
10173          */
10174         bp_mapout(bp);
10175         pageio_done(bp);
10176 
10177         savepp = pp;
10178         do {
10179                 pp->p_fsdata = C_NOCOMMIT;
10180         } while ((pp = pp->p_next) != savepp);
10181 
10182         pvn_read_done(pp, error ? B_READ | B_ERROR : B_READ);
10183 
10184         /*
10185          * In case of error set readahead offset
10186          * to the lowest offset.
10187          * pvn_read_done() calls VN_DISPOSE to destroy the pages
10188          */
10189         if (error && rp->r_nextr > io_off) {
10190                 mutex_enter(&rp->r_statelock);
10191                 if (rp->r_nextr > io_off)
10192                         rp->r_nextr = io_off;
10193                 mutex_exit(&rp->r_statelock);
10194         }
10195 }
10196 
10197 /*
10198  * Flags are composed of {B_INVAL, B_FREE, B_DONTNEED, B_FORCE}
10199  * If len == 0, do from off to EOF.
10200  *
10201  * The normal cases should be len == 0 && off == 0 (entire vp list) or
10202  * len == MAXBSIZE (from segmap_release actions), and len == PAGESIZE
10203  * (from pageout).
10204  */
10205 /* ARGSUSED */
10206 static int
10207 nfs4_putpage(vnode_t *vp, offset_t off, size_t len, int flags, cred_t *cr,
10208         caller_context_t *ct)
10209 {
10210         int error;
10211         rnode4_t *rp;
10212 
10213         ASSERT(cr != NULL);
10214 
10215         if (!(flags & B_ASYNC) && nfs_zone() != VTOMI4(vp)->mi_zone)
10216                 return (EIO);
10217 
10218         rp = VTOR4(vp);
10219         if (IS_SHADOW(vp, rp))
10220                 vp = RTOV4(rp);
10221 
10222         /*
10223          * XXX - Why should this check be made here?
10224          */
10225         if (vp->v_flag & VNOMAP)
10226                 return (ENOSYS);
10227 
10228         if (len == 0 && !(flags & B_INVAL) &&
10229             (vp->v_vfsp->vfs_flag & VFS_RDONLY))
10230                 return (0);
10231 
10232         mutex_enter(&rp->r_statelock);
10233         rp->r_count++;
10234         mutex_exit(&rp->r_statelock);
10235         error = nfs4_putpages(vp, off, len, flags, cr);
10236         mutex_enter(&rp->r_statelock);
10237         rp->r_count--;
10238         cv_broadcast(&rp->r_cv);
10239         mutex_exit(&rp->r_statelock);
10240 
10241         return (error);
10242 }
10243 
10244 /*
10245  * Write out a single page, possibly klustering adjacent dirty pages.
10246  */
10247 int
10248 nfs4_putapage(vnode_t *vp, page_t *pp, u_offset_t *offp, size_t *lenp,
10249     int flags, cred_t *cr)
10250 {
10251         u_offset_t io_off;
10252         u_offset_t lbn_off;
10253         u_offset_t lbn;
10254         size_t io_len;
10255         uint_t bsize;
10256         int error;
10257         rnode4_t *rp;
10258 
10259         ASSERT(!(vp->v_vfsp->vfs_flag & VFS_RDONLY));
10260         ASSERT(pp != NULL);
10261         ASSERT(cr != NULL);
10262         ASSERT((flags & B_ASYNC) || nfs_zone() == VTOMI4(vp)->mi_zone);
10263 
10264         rp = VTOR4(vp);
10265         ASSERT(rp->r_count > 0);
10266         ASSERT(!IS_SHADOW(vp, rp));
10267 
10268         bsize = MAX(vp->v_vfsp->vfs_bsize, PAGESIZE);
10269         lbn = pp->p_offset / bsize;
10270         lbn_off = lbn * bsize;
10271 
10272         /*
10273          * Find a kluster that fits in one block, or in
10274          * one page if pages are bigger than blocks.  If
10275          * there is less file space allocated than a whole
10276          * page, we'll shorten the i/o request below.
10277          */
10278         pp = pvn_write_kluster(vp, pp, &io_off, &io_len, lbn_off,
10279             roundup(bsize, PAGESIZE), flags);
10280 
10281         /*
10282          * pvn_write_kluster shouldn't have returned a page with offset
10283          * behind the original page we were given.  Verify that.
10284          */
10285         ASSERT((pp->p_offset / bsize) >= lbn);
10286 
10287         /*
10288          * Now pp will have the list of kept dirty pages marked for
10289          * write back.  It will also handle invalidation and freeing
10290          * of pages that are not dirty.  Check for page length rounding
10291          * problems.
10292          */
10293         if (io_off + io_len > lbn_off + bsize) {
10294                 ASSERT((io_off + io_len) - (lbn_off + bsize) < PAGESIZE);
10295                 io_len = lbn_off + bsize - io_off;
10296         }
10297         /*
10298          * The R4MODINPROGRESS flag makes sure that nfs4_bio() sees a
10299          * consistent value of r_size. R4MODINPROGRESS is set in writerp4().
10300          * When R4MODINPROGRESS is set it indicates that a uiomove() is in
10301          * progress and the r_size has not been made consistent with the
10302          * new size of the file. When the uiomove() completes the r_size is
10303          * updated and the R4MODINPROGRESS flag is cleared.
10304          *
10305          * The R4MODINPROGRESS flag makes sure that nfs4_bio() sees a
10306          * consistent value of r_size. Without this handshaking, it is
10307          * possible that nfs4_bio() picks  up the old value of r_size
10308          * before the uiomove() in writerp4() completes. This will result
10309          * in the write through nfs4_bio() being dropped.
10310          *
10311          * More precisely, there is a window between the time the uiomove()
10312          * completes and the time the r_size is updated. If a VOP_PUTPAGE()
10313          * operation intervenes in this window, the page will be picked up,
10314          * because it is dirty (it will be unlocked, unless it was
10315          * pagecreate'd). When the page is picked up as dirty, the dirty
10316          * bit is reset (pvn_getdirty()). In nfs4write(), r_size is
10317          * checked. This will still be the old size. Therefore the page will
10318          * not be written out. When segmap_release() calls VOP_PUTPAGE(),
10319          * the page will be found to be clean and the write will be dropped.
10320          */
10321         if (rp->r_flags & R4MODINPROGRESS) {
10322                 mutex_enter(&rp->r_statelock);
10323                 if ((rp->r_flags & R4MODINPROGRESS) &&
10324                     rp->r_modaddr + MAXBSIZE > io_off &&
10325                     rp->r_modaddr < io_off + io_len) {
10326                         page_t *plist;
10327                         /*
10328                          * A write is in progress for this region of the file.
10329                          * If we did not detect R4MODINPROGRESS here then this
10330                          * path through nfs_putapage() would eventually go to
10331                          * nfs4_bio() and may not write out all of the data
10332                          * in the pages. We end up losing data. So we decide
10333                          * to set the modified bit on each page in the page
10334                          * list and mark the rnode with R4DIRTY. This write
10335                          * will be restarted at some later time.
10336                          */
10337                         plist = pp;
10338                         while (plist != NULL) {
10339                                 pp = plist;
10340                                 page_sub(&plist, pp);
10341                                 hat_setmod(pp);
10342                                 page_io_unlock(pp);
10343                                 page_unlock(pp);
10344                         }
10345                         rp->r_flags |= R4DIRTY;
10346                         mutex_exit(&rp->r_statelock);
10347                         if (offp)
10348                                 *offp = io_off;
10349                         if (lenp)
10350                                 *lenp = io_len;
10351                         return (0);
10352                 }
10353                 mutex_exit(&rp->r_statelock);
10354         }
10355 
10356         if (flags & B_ASYNC) {
10357                 error = nfs4_async_putapage(vp, pp, io_off, io_len, flags, cr,
10358                     nfs4_sync_putapage);
10359         } else
10360                 error = nfs4_sync_putapage(vp, pp, io_off, io_len, flags, cr);
10361 
10362         if (offp)
10363                 *offp = io_off;
10364         if (lenp)
10365                 *lenp = io_len;
10366         return (error);
10367 }
10368 
10369 static int
10370 nfs4_sync_putapage(vnode_t *vp, page_t *pp, u_offset_t io_off, size_t io_len,
10371     int flags, cred_t *cr)
10372 {
10373         int error;
10374         rnode4_t *rp;
10375 
10376         ASSERT(nfs_zone() == VTOMI4(vp)->mi_zone);
10377 
10378         flags |= B_WRITE;
10379 
10380         error = nfs4_rdwrlbn(vp, pp, io_off, io_len, flags, cr);
10381 
10382         rp = VTOR4(vp);
10383 
10384         if ((error == ENOSPC || error == EDQUOT || error == EFBIG ||
10385             error == EACCES) &&
10386             (flags & (B_INVAL|B_FORCE)) != (B_INVAL|B_FORCE)) {
10387                 if (!(rp->r_flags & R4OUTOFSPACE)) {
10388                         mutex_enter(&rp->r_statelock);
10389                         rp->r_flags |= R4OUTOFSPACE;
10390                         mutex_exit(&rp->r_statelock);
10391                 }
10392                 flags |= B_ERROR;
10393                 pvn_write_done(pp, flags);
10394                 /*
10395                  * If this was not an async thread, then try again to
10396                  * write out the pages, but this time, also destroy
10397                  * them whether or not the write is successful.  This
10398                  * will prevent memory from filling up with these
10399                  * pages and destroying them is the only alternative
10400                  * if they can't be written out.
10401                  *
10402                  * Don't do this if this is an async thread because
10403                  * when the pages are unlocked in pvn_write_done,
10404                  * some other thread could have come along, locked
10405                  * them, and queued for an async thread.  It would be
10406                  * possible for all of the async threads to be tied
10407                  * up waiting to lock the pages again and they would
10408                  * all already be locked and waiting for an async
10409                  * thread to handle them.  Deadlock.
10410                  */
10411                 if (!(flags & B_ASYNC)) {
10412                         error = nfs4_putpage(vp, io_off, io_len,
10413                             B_INVAL | B_FORCE, cr, NULL);
10414                 }
10415         } else {
10416                 if (error)
10417                         flags |= B_ERROR;
10418                 else if (rp->r_flags & R4OUTOFSPACE) {
10419                         mutex_enter(&rp->r_statelock);
10420                         rp->r_flags &= ~R4OUTOFSPACE;
10421                         mutex_exit(&rp->r_statelock);
10422                 }
10423                 pvn_write_done(pp, flags);
10424                 if (freemem < desfree)
10425                         (void) nfs4_commit_vp(vp, (u_offset_t)0, 0, cr,
10426                             NFS4_WRITE_NOWAIT);
10427         }
10428 
10429         return (error);
10430 }
10431 
10432 #ifdef DEBUG
10433 int nfs4_force_open_before_mmap = 0;
10434 #endif
10435 
10436 /* ARGSUSED */
10437 static int
10438 nfs4_map(vnode_t *vp, offset_t off, struct as *as, caddr_t *addrp,
10439     size_t len, uchar_t prot, uchar_t maxprot, uint_t flags, cred_t *cr,
10440     caller_context_t *ct)
10441 {
10442         struct segvn_crargs vn_a;
10443         int error = 0;
10444         rnode4_t *rp = VTOR4(vp);
10445         mntinfo4_t *mi = VTOMI4(vp);
10446 
10447         if (nfs_zone() != VTOMI4(vp)->mi_zone)
10448                 return (EIO);
10449 
10450         if (vp->v_flag & VNOMAP)
10451                 return (ENOSYS);
10452 
10453         if (off < 0 || (off + len) < 0)
10454                 return (ENXIO);
10455 
10456         if (vp->v_type != VREG)
10457                 return (ENODEV);
10458 
10459         /*
10460          * If the file is delegated to the client don't do anything.
10461          * If the file is not delegated, then validate the data cache.
10462          */
10463         mutex_enter(&rp->r_statev4_lock);
10464         if (rp->r_deleg_type == OPEN_DELEGATE_NONE) {
10465                 mutex_exit(&rp->r_statev4_lock);
10466                 error = nfs4_validate_caches(vp, cr);
10467                 if (error)
10468                         return (error);
10469         } else {
10470                 mutex_exit(&rp->r_statev4_lock);
10471         }
10472 
10473         /*
10474          * Check to see if the vnode is currently marked as not cachable.
10475          * This means portions of the file are locked (through VOP_FRLOCK).
10476          * In this case the map request must be refused.  We use
10477          * rp->r_lkserlock to avoid a race with concurrent lock requests.
10478          *
10479          * Atomically increment r_inmap after acquiring r_rwlock. The
10480          * idea here is to acquire r_rwlock to block read/write and
10481          * not to protect r_inmap. r_inmap will inform nfs4_read/write()
10482          * that we are in nfs4_map(). Now, r_rwlock is acquired in order
10483          * and we can prevent the deadlock that would have occurred
10484          * when nfs4_addmap() would have acquired it out of order.
10485          *
10486          * Since we are not protecting r_inmap by any lock, we do not
10487          * hold any lock when we decrement it. We atomically decrement
10488          * r_inmap after we release r_lkserlock.
10489          */
10490 
10491         if (nfs_rw_enter_sig(&rp->r_rwlock, RW_WRITER, INTR4(vp)))
10492                 return (EINTR);
10493         atomic_add_int(&rp->r_inmap, 1);
10494         nfs_rw_exit(&rp->r_rwlock);
10495 
10496         if (nfs_rw_enter_sig(&rp->r_lkserlock, RW_READER, INTR4(vp))) {
10497                 atomic_add_int(&rp->r_inmap, -1);
10498                 return (EINTR);
10499         }
10500 
10501 
10502         if (vp->v_flag & VNOCACHE) {
10503                 error = EAGAIN;
10504                 goto done;
10505         }
10506 
10507         /*
10508          * Don't allow concurrent locks and mapping if mandatory locking is
10509          * enabled.
10510          */
10511         if (flk_has_remote_locks(vp)) {
10512                 struct vattr va;
10513                 va.va_mask = AT_MODE;
10514                 error = nfs4getattr(vp, &va, cr);
10515                 if (error != 0)
10516                         goto done;
10517                 if (MANDLOCK(vp, va.va_mode)) {
10518                         error = EAGAIN;
10519                         goto done;
10520                 }
10521         }
10522 
10523         /*
10524          * It is possible that the rnode has a lost lock request that we
10525          * are still trying to recover, and that the request conflicts with
10526          * this map request.
10527          *
10528          * An alternative approach would be for nfs4_safemap() to consider
10529          * queued lock requests when deciding whether to set or clear
10530          * VNOCACHE.  This would require the frlock code path to call
10531          * nfs4_safemap() after enqueing a lost request.
10532          */
10533         if (nfs4_map_lost_lock_conflict(vp)) {
10534                 error = EAGAIN;
10535                 goto done;
10536         }
10537 
10538         as_rangelock(as);
10539         error = choose_addr(as, addrp, len, off, ADDR_VACALIGN, flags);
10540         if (error != 0) {
10541                 as_rangeunlock(as);
10542                 goto done;
10543         }
10544 
10545         if (vp->v_type == VREG) {
10546                 /*
10547                  * We need to retrieve the open stream
10548                  */
10549                 nfs4_open_stream_t      *osp = NULL;
10550                 nfs4_open_owner_t       *oop = NULL;
10551 
10552                 oop = find_open_owner(cr, NFS4_PERM_CREATED, mi);
10553                 if (oop != NULL) {
10554                         /* returns with 'os_sync_lock' held */
10555                         osp = find_open_stream(oop, rp);
10556                         open_owner_rele(oop);
10557                 }
10558                 if (osp == NULL) {
10559 #ifdef DEBUG
10560                         if (nfs4_force_open_before_mmap) {
10561                                 error = EIO;
10562                                 goto done;
10563                         }
10564 #endif
10565                         /* returns with 'os_sync_lock' held */
10566                         error = open_and_get_osp(vp, cr, &osp);
10567                         if (osp == NULL) {
10568                                 NFS4_DEBUG(nfs4_mmap_debug, (CE_NOTE,
10569                                     "nfs4_map: we tried to OPEN the file "
10570                                     "but again no osp, so fail with EIO"));
10571                                 goto done;
10572                         }
10573                 }
10574 
10575                 if (osp->os_failed_reopen) {
10576                         mutex_exit(&osp->os_sync_lock);
10577                         open_stream_rele(osp, rp);
10578                         NFS4_DEBUG(nfs4_open_stream_debug, (CE_NOTE,
10579                             "nfs4_map: os_failed_reopen set on "
10580                             "osp %p, cr %p, rp %s", (void *)osp,
10581                             (void *)cr, rnode4info(rp)));
10582                         error = EIO;
10583                         goto done;
10584                 }
10585                 mutex_exit(&osp->os_sync_lock);
10586                 open_stream_rele(osp, rp);
10587         }
10588 
10589         vn_a.vp = vp;
10590         vn_a.offset = off;
10591         vn_a.type = (flags & MAP_TYPE);
10592         vn_a.prot = (uchar_t)prot;
10593         vn_a.maxprot = (uchar_t)maxprot;
10594         vn_a.flags = (flags & ~MAP_TYPE);
10595         vn_a.cred = cr;
10596         vn_a.amp = NULL;
10597         vn_a.szc = 0;
10598         vn_a.lgrp_mem_policy_flags = 0;
10599 
10600         error = as_map(as, *addrp, len, segvn_create, &vn_a);
10601         as_rangeunlock(as);
10602 
10603 done:
10604         nfs_rw_exit(&rp->r_lkserlock);
10605         atomic_add_int(&rp->r_inmap, -1);
10606         return (error);
10607 }
10608 
10609 /*
10610  * We're most likely dealing with a kernel module that likes to READ
10611  * and mmap without OPENing the file (ie: lookup/read/mmap), so lets
10612  * officially OPEN the file to create the necessary client state
10613  * for bookkeeping of os_mmap_read/write counts.
10614  *
10615  * Since VOP_MAP only passes in a pointer to the vnode rather than
10616  * a double pointer, we can't handle the case where nfs4open_otw()
10617  * returns a different vnode than the one passed into VOP_MAP (since
10618  * VOP_DELMAP will not see the vnode nfs4open_otw used).  In this case,
10619  * we return NULL and let nfs4_map() fail.  Note: the only case where
10620  * this should happen is if the file got removed and replaced with the
10621  * same name on the server (in addition to the fact that we're trying
10622  * to VOP_MAP withouth VOP_OPENing the file in the first place).
10623  */
10624 static int
10625 open_and_get_osp(vnode_t *map_vp, cred_t *cr, nfs4_open_stream_t **ospp)
10626 {
10627         rnode4_t                *rp, *drp;
10628         vnode_t                 *dvp, *open_vp;
10629         char                    file_name[MAXNAMELEN];
10630         int                     just_created;
10631         nfs4_open_stream_t      *osp;
10632         nfs4_open_owner_t       *oop;
10633         int                     error;
10634 
10635         *ospp = NULL;
10636         open_vp = map_vp;
10637 
10638         rp = VTOR4(open_vp);
10639         if ((error = vtodv(open_vp, &dvp, cr, TRUE)) != 0)
10640                 return (error);
10641         drp = VTOR4(dvp);
10642 
10643         if (nfs_rw_enter_sig(&drp->r_rwlock, RW_READER, INTR4(dvp))) {
10644                 VN_RELE(dvp);
10645                 return (EINTR);
10646         }
10647 
10648         if ((error = vtoname(open_vp, file_name, MAXNAMELEN)) != 0) {
10649                 nfs_rw_exit(&drp->r_rwlock);
10650                 VN_RELE(dvp);
10651                 return (error);
10652         }
10653 
10654         mutex_enter(&rp->r_statev4_lock);
10655         if (rp->created_v4) {
10656                 rp->created_v4 = 0;
10657                 mutex_exit(&rp->r_statev4_lock);
10658 
10659                 dnlc_update(dvp, file_name, open_vp);
10660                 /* This is needed so we don't bump the open ref count */
10661                 just_created = 1;
10662         } else {
10663                 mutex_exit(&rp->r_statev4_lock);
10664                 just_created = 0;
10665         }
10666 
10667         VN_HOLD(map_vp);
10668 
10669         error = nfs4open_otw(dvp, file_name, NULL, &open_vp, cr, 0, FREAD, 0,
10670             just_created);
10671         if (error) {
10672                 nfs_rw_exit(&drp->r_rwlock);
10673                 VN_RELE(dvp);
10674                 VN_RELE(map_vp);
10675                 return (error);
10676         }
10677 
10678         nfs_rw_exit(&drp->r_rwlock);
10679         VN_RELE(dvp);
10680 
10681         /*
10682          * If nfs4open_otw() returned a different vnode then "undo"
10683          * the open and return failure to the caller.
10684          */
10685         if (!VN_CMP(open_vp, map_vp)) {
10686                 nfs4_error_t e;
10687 
10688                 NFS4_DEBUG(nfs4_mmap_debug, (CE_NOTE, "open_and_get_osp: "
10689                     "open returned a different vnode"));
10690                 /*
10691                  * If there's an error, ignore it,
10692                  * and let VOP_INACTIVE handle it.
10693                  */
10694                 (void) nfs4close_one(open_vp, NULL, cr, FREAD, NULL, &e,
10695                     CLOSE_NORM, 0, 0, 0);
10696                 VN_RELE(map_vp);
10697                 return (EIO);
10698         }
10699 
10700         VN_RELE(map_vp);
10701 
10702         oop = find_open_owner(cr, NFS4_PERM_CREATED, VTOMI4(open_vp));
10703         if (!oop) {
10704                 nfs4_error_t e;
10705 
10706                 NFS4_DEBUG(nfs4_mmap_debug, (CE_NOTE, "open_and_get_osp: "
10707                     "no open owner"));
10708                 /*
10709                  * If there's an error, ignore it,
10710                  * and let VOP_INACTIVE handle it.
10711                  */
10712                 (void) nfs4close_one(open_vp, NULL, cr, FREAD, NULL, &e,
10713                     CLOSE_NORM, 0, 0, 0);
10714                 return (EIO);
10715         }
10716         osp = find_open_stream(oop, rp);
10717         open_owner_rele(oop);
10718         *ospp = osp;
10719         return (0);
10720 }
10721 
10722 /*
10723  * Please be aware that when this function is called, the address space write
10724  * a_lock is held.  Do not put over the wire calls in this function.
10725  */
10726 /* ARGSUSED */
10727 static int
10728 nfs4_addmap(vnode_t *vp, offset_t off, struct as *as, caddr_t addr,
10729     size_t len, uchar_t prot, uchar_t maxprot, uint_t flags, cred_t *cr,
10730     caller_context_t *ct)
10731 {
10732         rnode4_t                *rp;
10733         int                     error = 0;
10734         mntinfo4_t              *mi;
10735 
10736         mi = VTOMI4(vp);
10737         rp = VTOR4(vp);
10738 
10739         if (nfs_zone() != mi->mi_zone)
10740                 return (EIO);
10741         if (vp->v_flag & VNOMAP)
10742                 return (ENOSYS);
10743 
10744         /*
10745          * Don't need to update the open stream first, since this
10746          * mmap can't add any additional share access that isn't
10747          * already contained in the open stream (for the case where we
10748          * open/mmap/only update rp->r_mapcnt/server reboots/reopen doesn't
10749          * take into account os_mmap_read[write] counts).
10750          */
10751         atomic_add_long((ulong_t *)&rp->r_mapcnt, btopr(len));
10752 
10753         if (vp->v_type == VREG) {
10754                 /*
10755                  * We need to retrieve the open stream and update the counts.
10756                  * If there is no open stream here, something is wrong.
10757                  */
10758                 nfs4_open_stream_t      *osp = NULL;
10759                 nfs4_open_owner_t       *oop = NULL;
10760 
10761                 oop = find_open_owner(cr, NFS4_PERM_CREATED, mi);
10762                 if (oop != NULL) {
10763                         /* returns with 'os_sync_lock' held */
10764                         osp = find_open_stream(oop, rp);
10765                         open_owner_rele(oop);
10766                 }
10767                 if (osp == NULL) {
10768                         NFS4_DEBUG(nfs4_mmap_debug, (CE_NOTE,
10769                             "nfs4_addmap: we should have an osp"
10770                             "but we don't, so fail with EIO"));
10771                         error = EIO;
10772                         goto out;
10773                 }
10774 
10775                 NFS4_DEBUG(nfs4_mmap_debug, (CE_NOTE, "nfs4_addmap: osp %p,"
10776                     " pages %ld, prot 0x%x", (void *)osp, btopr(len), prot));
10777 
10778                 /*
10779                  * Update the map count in the open stream.
10780                  * This is necessary in the case where we
10781                  * open/mmap/close/, then the server reboots, and we
10782                  * attempt to reopen.  If the mmap doesn't add share
10783                  * access then we send an invalid reopen with
10784                  * access = NONE.
10785                  *
10786                  * We need to specifically check each PROT_* so a mmap
10787                  * call of (PROT_WRITE | PROT_EXEC) will ensure us both
10788                  * read and write access.  A simple comparison of prot
10789                  * to ~PROT_WRITE to determine read access is insufficient
10790                  * since prot can be |= with PROT_USER, etc.
10791                  */
10792 
10793                 /*
10794                  * Unless we're MAP_SHARED, no sense in adding os_mmap_write
10795                  */
10796                 if ((flags & MAP_SHARED) && (maxprot & PROT_WRITE))
10797                         osp->os_mmap_write += btopr(len);
10798                 if (maxprot & PROT_READ)
10799                         osp->os_mmap_read += btopr(len);
10800                 if (maxprot & PROT_EXEC)
10801                         osp->os_mmap_read += btopr(len);
10802                 /*
10803                  * Ensure that os_mmap_read gets incremented, even if
10804                  * maxprot were to look like PROT_NONE.
10805                  */
10806                 if (!(maxprot & PROT_READ) && !(maxprot & PROT_WRITE) &&
10807                     !(maxprot & PROT_EXEC))
10808                         osp->os_mmap_read += btopr(len);
10809                 osp->os_mapcnt += btopr(len);
10810                 mutex_exit(&osp->os_sync_lock);
10811                 open_stream_rele(osp, rp);
10812         }
10813 
10814 out:
10815         /*
10816          * If we got an error, then undo our
10817          * incrementing of 'r_mapcnt'.
10818          */
10819 
10820         if (error) {
10821                 atomic_add_long((ulong_t *)&rp->r_mapcnt, -btopr(len));
10822                 ASSERT(rp->r_mapcnt >= 0);
10823         }
10824         return (error);
10825 }
10826 
10827 /* ARGSUSED */
10828 static int
10829 nfs4_cmp(vnode_t *vp1, vnode_t *vp2, caller_context_t *ct)
10830 {
10831 
10832         return (VTOR4(vp1) == VTOR4(vp2));
10833 }
10834 
10835 /* ARGSUSED */
10836 static int
10837 nfs4_frlock(vnode_t *vp, int cmd, struct flock64 *bfp, int flag,
10838     offset_t offset, struct flk_callback *flk_cbp, cred_t *cr,
10839     caller_context_t *ct)
10840 {
10841         int rc;
10842         u_offset_t start, end;
10843         rnode4_t *rp;
10844         int error = 0, intr = INTR4(vp);
10845         nfs4_error_t e;
10846 
10847         if (nfs_zone() != VTOMI4(vp)->mi_zone)
10848                 return (EIO);
10849 
10850         /* check for valid cmd parameter */
10851         if (cmd != F_GETLK && cmd != F_SETLK && cmd != F_SETLKW)
10852                 return (EINVAL);
10853 
10854         /* Verify l_type. */
10855         switch (bfp->l_type) {
10856         case F_RDLCK:
10857                 if (cmd != F_GETLK && !(flag & FREAD))
10858                         return (EBADF);
10859                 break;
10860         case F_WRLCK:
10861                 if (cmd != F_GETLK && !(flag & FWRITE))
10862                         return (EBADF);
10863                 break;
10864         case F_UNLCK:
10865                 intr = 0;
10866                 break;
10867 
10868         default:
10869                 return (EINVAL);
10870         }
10871 
10872         /* check the validity of the lock range */
10873         if (rc = flk_convert_lock_data(vp, bfp, &start, &end, offset))
10874                 return (rc);
10875         if (rc = flk_check_lock_data(start, end, MAXEND))
10876                 return (rc);
10877 
10878         /*
10879          * If the filesystem is mounted using local locking, pass the
10880          * request off to the local locking code.
10881          */
10882         if (VTOMI4(vp)->mi_flags & MI4_LLOCK || vp->v_type != VREG) {
10883                 if (cmd == F_SETLK || cmd == F_SETLKW) {
10884                         /*
10885                          * For complete safety, we should be holding
10886                          * r_lkserlock.  However, we can't call
10887                          * nfs4_safelock and then fs_frlock while
10888                          * holding r_lkserlock, so just invoke
10889                          * nfs4_safelock and expect that this will
10890                          * catch enough of the cases.
10891                          */
10892                         if (!nfs4_safelock(vp, bfp, cr))
10893                                 return (EAGAIN);
10894                 }
10895                 return (fs_frlock(vp, cmd, bfp, flag, offset, flk_cbp, cr, ct));
10896         }
10897 
10898         rp = VTOR4(vp);
10899 
10900         /*
10901          * Check whether the given lock request can proceed, given the
10902          * current file mappings.
10903          */
10904         if (nfs_rw_enter_sig(&rp->r_lkserlock, RW_WRITER, intr))
10905                 return (EINTR);
10906         if (cmd == F_SETLK || cmd == F_SETLKW) {
10907                 if (!nfs4_safelock(vp, bfp, cr)) {
10908                         rc = EAGAIN;
10909                         goto done;
10910                 }
10911         }
10912 
10913         /*
10914          * Flush the cache after waiting for async I/O to finish.  For new
10915          * locks, this is so that the process gets the latest bits from the
10916          * server.  For unlocks, this is so that other clients see the
10917          * latest bits once the file has been unlocked.  If currently dirty
10918          * pages can't be flushed, then don't allow a lock to be set.  But
10919          * allow unlocks to succeed, to avoid having orphan locks on the
10920          * server.
10921          */
10922         if (cmd != F_GETLK) {
10923                 mutex_enter(&rp->r_statelock);
10924                 while (rp->r_count > 0) {
10925                         if (intr) {
10926                                 klwp_t *lwp = ttolwp(curthread);
10927 
10928                                 if (lwp != NULL)
10929                                         lwp->lwp_nostop++;
10930                                 if (cv_wait_sig(&rp->r_cv,
10931                                     &rp->r_statelock) == 0) {
10932                                         if (lwp != NULL)
10933                                                 lwp->lwp_nostop--;
10934                                         rc = EINTR;
10935                                         break;
10936                                 }
10937                                 if (lwp != NULL)
10938                                         lwp->lwp_nostop--;
10939                                 } else
10940                                         cv_wait(&rp->r_cv, &rp->r_statelock);
10941                 }
10942                 mutex_exit(&rp->r_statelock);
10943                 if (rc != 0)
10944                         goto done;
10945                 error = nfs4_putpage(vp, (offset_t)0, 0, B_INVAL, cr, ct);
10946                 if (error) {
10947                         if (error == ENOSPC || error == EDQUOT) {
10948                                 mutex_enter(&rp->r_statelock);
10949                                 if (!rp->r_error)
10950                                         rp->r_error = error;
10951                                 mutex_exit(&rp->r_statelock);
10952                         }
10953                         if (bfp->l_type != F_UNLCK) {
10954                                 rc = ENOLCK;
10955                                 goto done;
10956                         }
10957                 }
10958         }
10959 
10960         /*
10961          * Call the lock manager to do the real work of contacting
10962          * the server and obtaining the lock.
10963          */
10964         nfs4frlock(NFS4_LCK_CTYPE_NORM, vp, cmd, bfp, flag, offset,
10965             cr, &e, NULL, NULL);
10966         rc = e.error;
10967 
10968         if (rc == 0)
10969                 nfs4_lockcompletion(vp, cmd);
10970 
10971 done:
10972         nfs_rw_exit(&rp->r_lkserlock);
10973 
10974         return (rc);
10975 }
10976 
10977 /*
10978  * Free storage space associated with the specified vnode.  The portion
10979  * to be freed is specified by bfp->l_start and bfp->l_len (already
10980  * normalized to a "whence" of 0).
10981  *
10982  * This is an experimental facility whose continued existence is not
10983  * guaranteed.  Currently, we only support the special case
10984  * of l_len == 0, meaning free to end of file.
10985  */
10986 /* ARGSUSED */
10987 static int
10988 nfs4_space(vnode_t *vp, int cmd, struct flock64 *bfp, int flag,
10989     offset_t offset, cred_t *cr, caller_context_t *ct)
10990 {
10991         int error;
10992 
10993         if (nfs_zone() != VTOMI4(vp)->mi_zone)
10994                 return (EIO);
10995         ASSERT(vp->v_type == VREG);
10996         if (cmd != F_FREESP)
10997                 return (EINVAL);
10998 
10999         error = convoff(vp, bfp, 0, offset);
11000         if (!error) {
11001                 ASSERT(bfp->l_start >= 0);
11002                 if (bfp->l_len == 0) {
11003                         struct vattr va;
11004 
11005                         va.va_mask = AT_SIZE;
11006                         va.va_size = bfp->l_start;
11007                         error = nfs4setattr(vp, &va, 0, cr, NULL);
11008 
11009                         if (error == 0 && bfp->l_start == 0)
11010                                 vnevent_truncate(vp, ct);
11011                 } else
11012                         error = EINVAL;
11013         }
11014 
11015         return (error);
11016 }
11017 
11018 /* ARGSUSED */
11019 int
11020 nfs4_realvp(vnode_t *vp, vnode_t **vpp, caller_context_t *ct)
11021 {
11022         rnode4_t *rp;
11023         rp = VTOR4(vp);
11024 
11025         if (vp->v_type == VREG && IS_SHADOW(vp, rp)) {
11026                 vp = RTOV4(rp);
11027         }
11028         *vpp = vp;
11029         return (0);
11030 }
11031 
11032 /*
11033  * Setup and add an address space callback to do the work of the delmap call.
11034  * The callback will (and must be) deleted in the actual callback function.
11035  *
11036  * This is done in order to take care of the problem that we have with holding
11037  * the address space's a_lock for a long period of time (e.g. if the NFS server
11038  * is down).  Callbacks will be executed in the address space code while the
11039  * a_lock is not held.  Holding the address space's a_lock causes things such
11040  * as ps and fork to hang because they are trying to acquire this lock as well.
11041  */
11042 /* ARGSUSED */
11043 static int
11044 nfs4_delmap(vnode_t *vp, offset_t off, struct as *as, caddr_t addr,
11045     size_t len, uint_t prot, uint_t maxprot, uint_t flags, cred_t *cr,
11046     caller_context_t *ct)
11047 {
11048         int                     caller_found;
11049         int                     error;
11050         rnode4_t                *rp;
11051         nfs4_delmap_args_t      *dmapp;
11052         nfs4_delmapcall_t       *delmap_call;
11053 
11054         if (vp->v_flag & VNOMAP)
11055                 return (ENOSYS);
11056 
11057         /*
11058          * A process may not change zones if it has NFS pages mmap'ed
11059          * in, so we can't legitimately get here from the wrong zone.
11060          */
11061         ASSERT(nfs_zone() == VTOMI4(vp)->mi_zone);
11062 
11063         rp = VTOR4(vp);
11064 
11065         /*
11066          * The way that the address space of this process deletes its mapping
11067          * of this file is via the following call chains:
11068          * - as_free()->SEGOP_UNMAP()/segvn_unmap()->VOP_DELMAP()/nfs4_delmap()
11069          * - as_unmap()->SEGOP_UNMAP()/segvn_unmap()->VOP_DELMAP()/nfs4_delmap()
11070          *
11071          * With the use of address space callbacks we are allowed to drop the
11072          * address space lock, a_lock, while executing the NFS operations that
11073          * need to go over the wire.  Returning EAGAIN to the caller of this
11074          * function is what drives the execution of the callback that we add
11075          * below.  The callback will be executed by the address space code
11076          * after dropping the a_lock.  When the callback is finished, since
11077          * we dropped the a_lock, it must be re-acquired and segvn_unmap()
11078          * is called again on the same segment to finish the rest of the work
11079          * that needs to happen during unmapping.
11080          *
11081          * This action of calling back into the segment driver causes
11082          * nfs4_delmap() to get called again, but since the callback was
11083          * already executed at this point, it already did the work and there
11084          * is nothing left for us to do.
11085          *
11086          * To Summarize:
11087          * - The first time nfs4_delmap is called by the current thread is when
11088          * we add the caller associated with this delmap to the delmap caller
11089          * list, add the callback, and return EAGAIN.
11090          * - The second time in this call chain when nfs4_delmap is called we
11091          * will find this caller in the delmap caller list and realize there
11092          * is no more work to do thus removing this caller from the list and
11093          * returning the error that was set in the callback execution.
11094          */
11095         caller_found = nfs4_find_and_delete_delmapcall(rp, &error);
11096         if (caller_found) {
11097                 /*
11098                  * 'error' is from the actual delmap operations.  To avoid
11099                  * hangs, we need to handle the return of EAGAIN differently
11100                  * since this is what drives the callback execution.
11101                  * In this case, we don't want to return EAGAIN and do the
11102                  * callback execution because there are none to execute.
11103                  */
11104                 if (error == EAGAIN)
11105                         return (0);
11106                 else
11107                         return (error);
11108         }
11109 
11110         /* current caller was not in the list */
11111         delmap_call = nfs4_init_delmapcall();
11112 
11113         mutex_enter(&rp->r_statelock);
11114         list_insert_tail(&rp->r_indelmap, delmap_call);
11115         mutex_exit(&rp->r_statelock);
11116 
11117         dmapp = kmem_alloc(sizeof (nfs4_delmap_args_t), KM_SLEEP);
11118 
11119         dmapp->vp = vp;
11120         dmapp->off = off;
11121         dmapp->addr = addr;
11122         dmapp->len = len;
11123         dmapp->prot = prot;
11124         dmapp->maxprot = maxprot;
11125         dmapp->flags = flags;
11126         dmapp->cr = cr;
11127         dmapp->caller = delmap_call;
11128 
11129         error = as_add_callback(as, nfs4_delmap_callback, dmapp,
11130             AS_UNMAP_EVENT, addr, len, KM_SLEEP);
11131 
11132         return (error ? error : EAGAIN);
11133 }
11134 
11135 static nfs4_delmapcall_t *
11136 nfs4_init_delmapcall()
11137 {
11138         nfs4_delmapcall_t       *delmap_call;
11139 
11140         delmap_call = kmem_alloc(sizeof (nfs4_delmapcall_t), KM_SLEEP);
11141         delmap_call->call_id = curthread;
11142         delmap_call->error = 0;
11143 
11144         return (delmap_call);
11145 }
11146 
11147 static void
11148 nfs4_free_delmapcall(nfs4_delmapcall_t *delmap_call)
11149 {
11150         kmem_free(delmap_call, sizeof (nfs4_delmapcall_t));
11151 }
11152 
11153 /*
11154  * Searches for the current delmap caller (based on curthread) in the list of
11155  * callers.  If it is found, we remove it and free the delmap caller.
11156  * Returns:
11157  *      0 if the caller wasn't found
11158  *      1 if the caller was found, removed and freed.  *errp will be set
11159  *      to what the result of the delmap was.
11160  */
11161 static int
11162 nfs4_find_and_delete_delmapcall(rnode4_t *rp, int *errp)
11163 {
11164         nfs4_delmapcall_t       *delmap_call;
11165 
11166         /*
11167          * If the list doesn't exist yet, we create it and return
11168          * that the caller wasn't found.  No list = no callers.
11169          */
11170         mutex_enter(&rp->r_statelock);
11171         if (!(rp->r_flags & R4DELMAPLIST)) {
11172                 /* The list does not exist */
11173                 list_create(&rp->r_indelmap, sizeof (nfs4_delmapcall_t),
11174                     offsetof(nfs4_delmapcall_t, call_node));
11175                 rp->r_flags |= R4DELMAPLIST;
11176                 mutex_exit(&rp->r_statelock);
11177                 return (0);
11178         } else {
11179                 /* The list exists so search it */
11180                 for (delmap_call = list_head(&rp->r_indelmap);
11181                     delmap_call != NULL;
11182                     delmap_call = list_next(&rp->r_indelmap, delmap_call)) {
11183                         if (delmap_call->call_id == curthread) {
11184                                 /* current caller is in the list */
11185                                 *errp = delmap_call->error;
11186                                 list_remove(&rp->r_indelmap, delmap_call);
11187                                 mutex_exit(&rp->r_statelock);
11188                                 nfs4_free_delmapcall(delmap_call);
11189                                 return (1);
11190                         }
11191                 }
11192         }
11193         mutex_exit(&rp->r_statelock);
11194         return (0);
11195 }
11196 
11197 /*
11198  * Remove some pages from an mmap'd vnode.  Just update the
11199  * count of pages.  If doing close-to-open, then flush and
11200  * commit all of the pages associated with this file.
11201  * Otherwise, start an asynchronous page flush to write out
11202  * any dirty pages.  This will also associate a credential
11203  * with the rnode which can be used to write the pages.
11204  */
11205 /* ARGSUSED */
11206 static void
11207 nfs4_delmap_callback(struct as *as, void *arg, uint_t event)
11208 {
11209         nfs4_error_t            e = { 0, NFS4_OK, RPC_SUCCESS };
11210         rnode4_t                *rp;
11211         mntinfo4_t              *mi;
11212         nfs4_delmap_args_t      *dmapp = (nfs4_delmap_args_t *)arg;
11213 
11214         rp = VTOR4(dmapp->vp);
11215         mi = VTOMI4(dmapp->vp);
11216 
11217         atomic_add_long((ulong_t *)&rp->r_mapcnt, -btopr(dmapp->len));
11218         ASSERT(rp->r_mapcnt >= 0);
11219 
11220         /*
11221          * Initiate a page flush and potential commit if there are
11222          * pages, the file system was not mounted readonly, the segment
11223          * was mapped shared, and the pages themselves were writeable.
11224          */
11225         if (nfs4_has_pages(dmapp->vp) &&
11226             !(dmapp->vp->v_vfsp->vfs_flag & VFS_RDONLY) &&
11227             dmapp->flags == MAP_SHARED && (dmapp->maxprot & PROT_WRITE)) {
11228                 mutex_enter(&rp->r_statelock);
11229                 rp->r_flags |= R4DIRTY;
11230                 mutex_exit(&rp->r_statelock);
11231                 e.error = nfs4_putpage_commit(dmapp->vp, dmapp->off,
11232                     dmapp->len, dmapp->cr);
11233                 if (!e.error) {
11234                         mutex_enter(&rp->r_statelock);
11235                         e.error = rp->r_error;
11236                         rp->r_error = 0;
11237                         mutex_exit(&rp->r_statelock);
11238                 }
11239         } else
11240                 e.error = 0;
11241 
11242         if ((rp->r_flags & R4DIRECTIO) || (mi->mi_flags & MI4_DIRECTIO))
11243                 (void) nfs4_putpage(dmapp->vp, dmapp->off, dmapp->len,
11244                     B_INVAL, dmapp->cr, NULL);
11245 
11246         if (e.error) {
11247                 e.stat = puterrno4(e.error);
11248                 nfs4_queue_fact(RF_DELMAP_CB_ERR, mi, e.stat, 0,
11249                     OP_COMMIT, FALSE, NULL, 0, dmapp->vp);
11250                 dmapp->caller->error = e.error;
11251         }
11252 
11253         /* Check to see if we need to close the file */
11254 
11255         if (dmapp->vp->v_type == VREG) {
11256                 nfs4close_one(dmapp->vp, NULL, dmapp->cr, 0, NULL, &e,
11257                     CLOSE_DELMAP, dmapp->len, dmapp->maxprot, dmapp->flags);
11258 
11259                 if (e.error != 0 || e.stat != NFS4_OK) {
11260                         /*
11261                          * Since it is possible that e.error == 0 and
11262                          * e.stat != NFS4_OK (and vice versa),
11263                          * we do the proper checking in order to get both
11264                          * e.error and e.stat reporting the correct info.
11265                          */
11266                         if (e.stat == NFS4_OK)
11267                                 e.stat = puterrno4(e.error);
11268                         if (e.error == 0)
11269                                 e.error = geterrno4(e.stat);
11270 
11271                         nfs4_queue_fact(RF_DELMAP_CB_ERR, mi, e.stat, 0,
11272                             OP_CLOSE, FALSE, NULL, 0, dmapp->vp);
11273                         dmapp->caller->error = e.error;
11274                 }
11275         }
11276 
11277         (void) as_delete_callback(as, arg);
11278         kmem_free(dmapp, sizeof (nfs4_delmap_args_t));
11279 }
11280 
11281 
11282 static uint_t
11283 fattr4_maxfilesize_to_bits(uint64_t ll)
11284 {
11285         uint_t l = 1;
11286 
11287         if (ll == 0) {
11288                 return (0);
11289         }
11290 
11291         if (ll & 0xffffffff00000000) {
11292                 l += 32; ll >>= 32;
11293         }
11294         if (ll & 0xffff0000) {
11295                 l += 16; ll >>= 16;
11296         }
11297         if (ll & 0xff00) {
11298                 l += 8; ll >>= 8;
11299         }
11300         if (ll & 0xf0) {
11301                 l += 4; ll >>= 4;
11302         }
11303         if (ll & 0xc) {
11304                 l += 2; ll >>= 2;
11305         }
11306         if (ll & 0x2) {
11307                 l += 1;
11308         }
11309         return (l);
11310 }
11311 
11312 static int
11313 nfs4_have_xattrs(vnode_t *vp, ulong_t *valp, cred_t *cr)
11314 {
11315         vnode_t *avp = NULL;
11316         int error;
11317 
11318         if ((error = nfs4lookup_xattr(vp, "", &avp,
11319             LOOKUP_XATTR, cr)) == 0)
11320                 error = do_xattr_exists_check(avp, valp, cr);
11321         if (avp)
11322                 VN_RELE(avp);
11323 
11324         return (error);
11325 }
11326 
11327 /* ARGSUSED */
11328 int
11329 nfs4_pathconf(vnode_t *vp, int cmd, ulong_t *valp, cred_t *cr,
11330         caller_context_t *ct)
11331 {
11332         int error;
11333         hrtime_t t;
11334         rnode4_t *rp;
11335         nfs4_ga_res_t gar;
11336         nfs4_ga_ext_res_t ger;
11337 
11338         gar.n4g_ext_res = &ger;
11339 
11340         if (nfs_zone() != VTOMI4(vp)->mi_zone)
11341                 return (EIO);
11342         if (cmd == _PC_PATH_MAX || cmd == _PC_SYMLINK_MAX) {
11343                 *valp = MAXPATHLEN;
11344                 return (0);
11345         }
11346         if (cmd == _PC_ACL_ENABLED) {
11347                 *valp = _ACL_ACE_ENABLED;
11348                 return (0);
11349         }
11350 
11351         rp = VTOR4(vp);
11352         if (cmd == _PC_XATTR_EXISTS) {
11353                 /*
11354                  * The existence of the xattr directory is not sufficient
11355                  * for determining whether generic user attributes exists.
11356                  * The attribute directory could only be a transient directory
11357                  * used for Solaris sysattr support.  Do a small readdir
11358                  * to verify if the only entries are sysattrs or not.
11359                  *
11360                  * pc4_xattr_valid can be only be trusted when r_xattr_dir
11361                  * is NULL.  Once the xadir vp exists, we can create xattrs,
11362                  * and we don't have any way to update the "base" object's
11363                  * pc4_xattr_exists from the xattr or xadir.  Maybe FEM
11364                  * could help out.
11365                  */
11366                 if (ATTRCACHE4_VALID(vp) && rp->r_pathconf.pc4_xattr_valid &&
11367                     rp->r_xattr_dir == NULL) {
11368                         return (nfs4_have_xattrs(vp, valp, cr));
11369                 }
11370         } else {  /* OLD CODE */
11371                 if (ATTRCACHE4_VALID(vp)) {
11372                         mutex_enter(&rp->r_statelock);
11373                         if (rp->r_pathconf.pc4_cache_valid) {
11374                                 error = 0;
11375                                 switch (cmd) {
11376                                 case _PC_FILESIZEBITS:
11377                                         *valp =
11378                                             rp->r_pathconf.pc4_filesizebits;
11379                                         break;
11380                                 case _PC_LINK_MAX:
11381                                         *valp =
11382                                             rp->r_pathconf.pc4_link_max;
11383                                         break;
11384                                 case _PC_NAME_MAX:
11385                                         *valp =
11386                                             rp->r_pathconf.pc4_name_max;
11387                                         break;
11388                                 case _PC_CHOWN_RESTRICTED:
11389                                         *valp =
11390                                             rp->r_pathconf.pc4_chown_restricted;
11391                                         break;
11392                                 case _PC_NO_TRUNC:
11393                                         *valp =
11394                                             rp->r_pathconf.pc4_no_trunc;
11395                                         break;
11396                                 default:
11397                                         error = EINVAL;
11398                                         break;
11399                                 }
11400                                 mutex_exit(&rp->r_statelock);
11401 #ifdef DEBUG
11402                                 nfs4_pathconf_cache_hits++;
11403 #endif
11404                                 return (error);
11405                         }
11406                         mutex_exit(&rp->r_statelock);
11407                 }
11408         }
11409 #ifdef DEBUG
11410         nfs4_pathconf_cache_misses++;
11411 #endif
11412 
11413         t = gethrtime();
11414 
11415         error = nfs4_attr_otw(vp, TAG_PATHCONF, &gar, NFS4_PATHCONF_MASK, cr);
11416 
11417         if (error) {
11418                 mutex_enter(&rp->r_statelock);
11419                 rp->r_pathconf.pc4_cache_valid = FALSE;
11420                 rp->r_pathconf.pc4_xattr_valid = FALSE;
11421                 mutex_exit(&rp->r_statelock);
11422                 return (error);
11423         }
11424 
11425         /* interpret the max filesize */
11426         gar.n4g_ext_res->n4g_pc4.pc4_filesizebits =
11427             fattr4_maxfilesize_to_bits(gar.n4g_ext_res->n4g_maxfilesize);
11428 
11429         /* Store the attributes we just received */
11430         nfs4_attr_cache(vp, &gar, t, cr, TRUE, NULL);
11431 
11432         switch (cmd) {
11433         case _PC_FILESIZEBITS:
11434                 *valp = gar.n4g_ext_res->n4g_pc4.pc4_filesizebits;
11435                 break;
11436         case _PC_LINK_MAX:
11437                 *valp = gar.n4g_ext_res->n4g_pc4.pc4_link_max;
11438                 break;
11439         case _PC_NAME_MAX:
11440                 *valp = gar.n4g_ext_res->n4g_pc4.pc4_name_max;
11441                 break;
11442         case _PC_CHOWN_RESTRICTED:
11443                 *valp = gar.n4g_ext_res->n4g_pc4.pc4_chown_restricted;
11444                 break;
11445         case _PC_NO_TRUNC:
11446                 *valp = gar.n4g_ext_res->n4g_pc4.pc4_no_trunc;
11447                 break;
11448         case _PC_XATTR_EXISTS:
11449                 if (gar.n4g_ext_res->n4g_pc4.pc4_xattr_exists) {
11450                         if (error = nfs4_have_xattrs(vp, valp, cr))
11451                                 return (error);
11452                 }
11453                 break;
11454         default:
11455                 return (EINVAL);
11456         }
11457 
11458         return (0);
11459 }
11460 
11461 /*
11462  * Called by async thread to do synchronous pageio. Do the i/o, wait
11463  * for it to complete, and cleanup the page list when done.
11464  */
11465 static int
11466 nfs4_sync_pageio(vnode_t *vp, page_t *pp, u_offset_t io_off, size_t io_len,
11467     int flags, cred_t *cr)
11468 {
11469         int error;
11470 
11471         ASSERT(nfs_zone() == VTOMI4(vp)->mi_zone);
11472 
11473         error = nfs4_rdwrlbn(vp, pp, io_off, io_len, flags, cr);
11474         if (flags & B_READ)
11475                 pvn_read_done(pp, (error ? B_ERROR : 0) | flags);
11476         else
11477                 pvn_write_done(pp, (error ? B_ERROR : 0) | flags);
11478         return (error);
11479 }
11480 
11481 /* ARGSUSED */
11482 static int
11483 nfs4_pageio(vnode_t *vp, page_t *pp, u_offset_t io_off, size_t io_len,
11484         int flags, cred_t *cr, caller_context_t *ct)
11485 {
11486         int error;
11487         rnode4_t *rp;
11488 
11489         if (!(flags & B_ASYNC) && nfs_zone() != VTOMI4(vp)->mi_zone)
11490                 return (EIO);
11491 
11492         if (pp == NULL)
11493                 return (EINVAL);
11494 
11495         rp = VTOR4(vp);
11496         mutex_enter(&rp->r_statelock);
11497         rp->r_count++;
11498         mutex_exit(&rp->r_statelock);
11499 
11500         if (flags & B_ASYNC) {
11501                 error = nfs4_async_pageio(vp, pp, io_off, io_len, flags, cr,
11502                     nfs4_sync_pageio);
11503         } else
11504                 error = nfs4_rdwrlbn(vp, pp, io_off, io_len, flags, cr);
11505         mutex_enter(&rp->r_statelock);
11506         rp->r_count--;
11507         cv_broadcast(&rp->r_cv);
11508         mutex_exit(&rp->r_statelock);
11509         return (error);
11510 }
11511 
11512 /* ARGSUSED */
11513 static void
11514 nfs4_dispose(vnode_t *vp, page_t *pp, int fl, int dn, cred_t *cr,
11515         caller_context_t *ct)
11516 {
11517         int error;
11518         rnode4_t *rp;
11519         page_t *plist;
11520         page_t *pptr;
11521         offset3 offset;
11522         count3 len;
11523         k_sigset_t smask;
11524 
11525         /*
11526          * We should get called with fl equal to either B_FREE or
11527          * B_INVAL.  Any other value is illegal.
11528          *
11529          * The page that we are either supposed to free or destroy
11530          * should be exclusive locked and its io lock should not
11531          * be held.
11532          */
11533         ASSERT(fl == B_FREE || fl == B_INVAL);
11534         ASSERT((PAGE_EXCL(pp) && !page_iolock_assert(pp)) || panicstr);
11535 
11536         rp = VTOR4(vp);
11537 
11538         /*
11539          * If the page doesn't need to be committed or we shouldn't
11540          * even bother attempting to commit it, then just make sure
11541          * that the p_fsdata byte is clear and then either free or
11542          * destroy the page as appropriate.
11543          */
11544         if (pp->p_fsdata == C_NOCOMMIT || (rp->r_flags & R4STALE)) {
11545                 pp->p_fsdata = C_NOCOMMIT;
11546                 if (fl == B_FREE)
11547                         page_free(pp, dn);
11548                 else
11549                         page_destroy(pp, dn);
11550                 return;
11551         }
11552 
11553         /*
11554          * If there is a page invalidation operation going on, then
11555          * if this is one of the pages being destroyed, then just
11556          * clear the p_fsdata byte and then either free or destroy
11557          * the page as appropriate.
11558          */
11559         mutex_enter(&rp->r_statelock);
11560         if ((rp->r_flags & R4TRUNCATE) && pp->p_offset >= rp->r_truncaddr) {
11561                 mutex_exit(&rp->r_statelock);
11562                 pp->p_fsdata = C_NOCOMMIT;
11563                 if (fl == B_FREE)
11564                         page_free(pp, dn);
11565                 else
11566                         page_destroy(pp, dn);
11567                 return;
11568         }
11569 
11570         /*
11571          * If we are freeing this page and someone else is already
11572          * waiting to do a commit, then just unlock the page and
11573          * return.  That other thread will take care of commiting
11574          * this page.  The page can be freed sometime after the
11575          * commit has finished.  Otherwise, if the page is marked
11576          * as delay commit, then we may be getting called from
11577          * pvn_write_done, one page at a time.   This could result
11578          * in one commit per page, so we end up doing lots of small
11579          * commits instead of fewer larger commits.  This is bad,
11580          * we want do as few commits as possible.
11581          */
11582         if (fl == B_FREE) {
11583                 if (rp->r_flags & R4COMMITWAIT) {
11584                         page_unlock(pp);
11585                         mutex_exit(&rp->r_statelock);
11586                         return;
11587                 }
11588                 if (pp->p_fsdata == C_DELAYCOMMIT) {
11589                         pp->p_fsdata = C_COMMIT;
11590                         page_unlock(pp);
11591                         mutex_exit(&rp->r_statelock);
11592                         return;
11593                 }
11594         }
11595 
11596         /*
11597          * Check to see if there is a signal which would prevent an
11598          * attempt to commit the pages from being successful.  If so,
11599          * then don't bother with all of the work to gather pages and
11600          * generate the unsuccessful RPC.  Just return from here and
11601          * let the page be committed at some later time.
11602          */
11603         sigintr(&smask, VTOMI4(vp)->mi_flags & MI4_INT);
11604         if (ttolwp(curthread) != NULL && ISSIG(curthread, JUSTLOOKING)) {
11605                 sigunintr(&smask);
11606                 page_unlock(pp);
11607                 mutex_exit(&rp->r_statelock);
11608                 return;
11609         }
11610         sigunintr(&smask);
11611 
11612         /*
11613          * We are starting to need to commit pages, so let's try
11614          * to commit as many as possible at once to reduce the
11615          * overhead.
11616          *
11617          * Set the `commit inprogress' state bit.  We must
11618          * first wait until any current one finishes.  Then
11619          * we initialize the c_pages list with this page.
11620          */
11621         while (rp->r_flags & R4COMMIT) {
11622                 rp->r_flags |= R4COMMITWAIT;
11623                 cv_wait(&rp->r_commit.c_cv, &rp->r_statelock);
11624                 rp->r_flags &= ~R4COMMITWAIT;
11625         }
11626         rp->r_flags |= R4COMMIT;
11627         mutex_exit(&rp->r_statelock);
11628         ASSERT(rp->r_commit.c_pages == NULL);
11629         rp->r_commit.c_pages = pp;
11630         rp->r_commit.c_commbase = (offset3)pp->p_offset;
11631         rp->r_commit.c_commlen = PAGESIZE;
11632 
11633         /*
11634          * Gather together all other pages which can be committed.
11635          * They will all be chained off r_commit.c_pages.
11636          */
11637         nfs4_get_commit(vp);
11638 
11639         /*
11640          * Clear the `commit inprogress' status and disconnect
11641          * the list of pages to be committed from the rnode.
11642          * At this same time, we also save the starting offset
11643          * and length of data to be committed on the server.
11644          */
11645         plist = rp->r_commit.c_pages;
11646         rp->r_commit.c_pages = NULL;
11647         offset = rp->r_commit.c_commbase;
11648         len = rp->r_commit.c_commlen;
11649         mutex_enter(&rp->r_statelock);
11650         rp->r_flags &= ~R4COMMIT;
11651         cv_broadcast(&rp->r_commit.c_cv);
11652         mutex_exit(&rp->r_statelock);
11653 
11654         if (curproc == proc_pageout || curproc == proc_fsflush ||
11655             nfs_zone() != VTOMI4(vp)->mi_zone) {
11656                 nfs4_async_commit(vp, plist, offset, len,
11657                     cr, do_nfs4_async_commit);
11658                 return;
11659         }
11660 
11661         /*
11662          * Actually generate the COMMIT op over the wire operation.
11663          */
11664         error = nfs4_commit(vp, (offset4)offset, (count4)len, cr);
11665 
11666         /*
11667          * If we got an error during the commit, just unlock all
11668          * of the pages.  The pages will get retransmitted to the
11669          * server during a putpage operation.
11670          */
11671         if (error) {
11672                 while (plist != NULL) {
11673                         pptr = plist;
11674                         page_sub(&plist, pptr);
11675                         page_unlock(pptr);
11676                 }
11677                 return;
11678         }
11679 
11680         /*
11681          * We've tried as hard as we can to commit the data to stable
11682          * storage on the server.  We just unlock the rest of the pages
11683          * and clear the commit required state.  They will be put
11684          * onto the tail of the cachelist if they are nolonger
11685          * mapped.
11686          */
11687         while (plist != pp) {
11688                 pptr = plist;
11689                 page_sub(&plist, pptr);
11690                 pptr->p_fsdata = C_NOCOMMIT;
11691                 page_unlock(pptr);
11692         }
11693 
11694         /*
11695          * It is possible that nfs4_commit didn't return error but
11696          * some other thread has modified the page we are going
11697          * to free/destroy.
11698          *    In this case we need to rewrite the page. Do an explicit check
11699          * before attempting to free/destroy the page. If modified, needs to
11700          * be rewritten so unlock the page and return.
11701          */
11702         if (hat_ismod(pp)) {
11703                 pp->p_fsdata = C_NOCOMMIT;
11704                 page_unlock(pp);
11705                 return;
11706         }
11707 
11708         /*
11709          * Now, as appropriate, either free or destroy the page
11710          * that we were called with.
11711          */
11712         pp->p_fsdata = C_NOCOMMIT;
11713         if (fl == B_FREE)
11714                 page_free(pp, dn);
11715         else
11716                 page_destroy(pp, dn);
11717 }
11718 
11719 /*
11720  * Commit requires that the current fh be the file written to.
11721  * The compound op structure is:
11722  *      PUTFH(file), COMMIT
11723  */
11724 static int
11725 nfs4_commit(vnode_t *vp, offset4 offset, count4 count, cred_t *cr)
11726 {
11727         COMPOUND4args_clnt args;
11728         COMPOUND4res_clnt res;
11729         COMMIT4res *cm_res;
11730         nfs_argop4 argop[2];
11731         nfs_resop4 *resop;
11732         int doqueue;
11733         mntinfo4_t *mi;
11734         rnode4_t *rp;
11735         cred_t *cred_otw = NULL;
11736         bool_t needrecov = FALSE;
11737         nfs4_recov_state_t recov_state;
11738         nfs4_open_stream_t *osp = NULL;
11739         bool_t first_time = TRUE;       /* first time getting OTW cred */
11740         bool_t last_time = FALSE;       /* last time getting OTW cred */
11741         nfs4_error_t e = { 0, NFS4_OK, RPC_SUCCESS };
11742 
11743         ASSERT(nfs_zone() == VTOMI4(vp)->mi_zone);
11744 
11745         rp = VTOR4(vp);
11746 
11747         mi = VTOMI4(vp);
11748         recov_state.rs_flags = 0;
11749         recov_state.rs_num_retry_despite_err = 0;
11750 get_commit_cred:
11751         /*
11752          * Releases the osp, if a valid open stream is provided.
11753          * Puts a hold on the cred_otw and the new osp (if found).
11754          */
11755         cred_otw = nfs4_get_otw_cred_by_osp(rp, cr, &osp,
11756             &first_time, &last_time);
11757         args.ctag = TAG_COMMIT;
11758 recov_retry:
11759         /*
11760          * Commit ops: putfh file; commit
11761          */
11762         args.array_len = 2;
11763         args.array = argop;
11764 
11765         e.error = nfs4_start_fop(VTOMI4(vp), vp, NULL, OH_COMMIT,
11766             &recov_state, NULL);
11767         if (e.error) {
11768                 crfree(cred_otw);
11769                 if (osp != NULL)
11770                         open_stream_rele(osp, rp);
11771                 return (e.error);
11772         }
11773 
11774         /* putfh directory */
11775         argop[0].argop = OP_CPUTFH;
11776         argop[0].nfs_argop4_u.opcputfh.sfh = rp->r_fh;
11777 
11778         /* commit */
11779         argop[1].argop = OP_COMMIT;
11780         argop[1].nfs_argop4_u.opcommit.offset = offset;
11781         argop[1].nfs_argop4_u.opcommit.count = count;
11782 
11783         doqueue = 1;
11784         rfs4call(mi, &args, &res, cred_otw, &doqueue, 0, &e);
11785 
11786         needrecov = nfs4_needs_recovery(&e, FALSE, mi->mi_vfsp);
11787         if (!needrecov && e.error) {
11788                 nfs4_end_fop(VTOMI4(vp), vp, NULL, OH_COMMIT, &recov_state,
11789                     needrecov);
11790                 crfree(cred_otw);
11791                 if (e.error == EACCES && last_time == FALSE)
11792                         goto get_commit_cred;
11793                 if (osp != NULL)
11794                         open_stream_rele(osp, rp);
11795                 return (e.error);
11796         }
11797 
11798         if (needrecov) {
11799                 if (nfs4_start_recovery(&e, VTOMI4(vp), vp, NULL, NULL,
11800                     NULL, OP_COMMIT, NULL, NULL, NULL) == FALSE) {
11801                         nfs4_end_fop(VTOMI4(vp), vp, NULL, OH_COMMIT,
11802                             &recov_state, needrecov);
11803                         if (!e.error)
11804                                 (void) xdr_free(xdr_COMPOUND4res_clnt,
11805                                     (caddr_t)&res);
11806                         goto recov_retry;
11807                 }
11808                 if (e.error) {
11809                         nfs4_end_fop(VTOMI4(vp), vp, NULL, OH_COMMIT,
11810                             &recov_state, needrecov);
11811                         crfree(cred_otw);
11812                         if (osp != NULL)
11813                                 open_stream_rele(osp, rp);
11814                         return (e.error);
11815                 }
11816                 /* fall through for res.status case */
11817         }
11818 
11819         if (res.status) {
11820                 e.error = geterrno4(res.status);
11821                 if (e.error == EACCES && last_time == FALSE) {
11822                         crfree(cred_otw);
11823                         nfs4_end_fop(VTOMI4(vp), vp, NULL, OH_COMMIT,
11824                             &recov_state, needrecov);
11825                         (void) xdr_free(xdr_COMPOUND4res_clnt, (caddr_t)&res);
11826                         goto get_commit_cred;
11827                 }
11828                 /*
11829                  * Can't do a nfs4_purge_stale_fh here because this
11830                  * can cause a deadlock.  nfs4_commit can
11831                  * be called from nfs4_dispose which can be called
11832                  * indirectly via pvn_vplist_dirty.  nfs4_purge_stale_fh
11833                  * can call back to pvn_vplist_dirty.
11834                  */
11835                 if (e.error == ESTALE) {
11836                         mutex_enter(&rp->r_statelock);
11837                         rp->r_flags |= R4STALE;
11838                         if (!rp->r_error)
11839                                 rp->r_error = e.error;
11840                         mutex_exit(&rp->r_statelock);
11841                         PURGE_ATTRCACHE4(vp);
11842                 } else {
11843                         mutex_enter(&rp->r_statelock);
11844                         if (!rp->r_error)
11845                                 rp->r_error = e.error;
11846                         mutex_exit(&rp->r_statelock);
11847                 }
11848         } else {
11849                 ASSERT(rp->r_flags & R4HAVEVERF);
11850                 resop = &res.array[1];      /* commit res */
11851                 cm_res = &resop->nfs_resop4_u.opcommit;
11852                 mutex_enter(&rp->r_statelock);
11853                 if (cm_res->writeverf == rp->r_writeverf) {
11854                         mutex_exit(&rp->r_statelock);
11855                         (void) xdr_free(xdr_COMPOUND4res_clnt, (caddr_t)&res);
11856                         nfs4_end_fop(VTOMI4(vp), vp, NULL, OH_COMMIT,
11857                             &recov_state, needrecov);
11858                         crfree(cred_otw);
11859                         if (osp != NULL)
11860                                 open_stream_rele(osp, rp);
11861                         return (0);
11862                 }
11863                 nfs4_set_mod(vp);
11864                 rp->r_writeverf = cm_res->writeverf;
11865                 mutex_exit(&rp->r_statelock);
11866                 e.error = NFS_VERF_MISMATCH;
11867         }
11868 
11869         (void) xdr_free(xdr_COMPOUND4res_clnt, (caddr_t)&res);
11870         nfs4_end_fop(VTOMI4(vp), vp, NULL, OH_COMMIT, &recov_state, needrecov);
11871         crfree(cred_otw);
11872         if (osp != NULL)
11873                 open_stream_rele(osp, rp);
11874 
11875         return (e.error);
11876 }
11877 
11878 static void
11879 nfs4_set_mod(vnode_t *vp)
11880 {
11881         ASSERT(nfs_zone() == VTOMI4(vp)->mi_zone);
11882 
11883         /* make sure we're looking at the master vnode, not a shadow */
11884         pvn_vplist_setdirty(RTOV4(VTOR4(vp)), nfs_setmod_check);
11885 }
11886 
11887 /*
11888  * This function is used to gather a page list of the pages which
11889  * can be committed on the server.
11890  *
11891  * The calling thread must have set R4COMMIT.  This bit is used to
11892  * serialize access to the commit structure in the rnode.  As long
11893  * as the thread has set R4COMMIT, then it can manipulate the commit
11894  * structure without requiring any other locks.
11895  *
11896  * When this function is called from nfs4_dispose() the page passed
11897  * into nfs4_dispose() will be SE_EXCL locked, and so this function
11898  * will skip it. This is not a problem since we initially add the
11899  * page to the r_commit page list.
11900  *
11901  */
11902 static void
11903 nfs4_get_commit(vnode_t *vp)
11904 {
11905         rnode4_t *rp;
11906         page_t *pp;
11907         kmutex_t *vphm;
11908 
11909         rp = VTOR4(vp);
11910 
11911         ASSERT(rp->r_flags & R4COMMIT);
11912 
11913         /* make sure we're looking at the master vnode, not a shadow */
11914 
11915         if (IS_SHADOW(vp, rp))
11916                 vp = RTOV4(rp);
11917 
11918         vphm = page_vnode_mutex(vp);
11919         mutex_enter(vphm);
11920 
11921         /*
11922          * If there are no pages associated with this vnode, then
11923          * just return.
11924          */
11925         if ((pp = vp->v_pages) == NULL) {
11926                 mutex_exit(vphm);
11927                 return;
11928         }
11929 
11930         /*
11931          * Step through all of the pages associated with this vnode
11932          * looking for pages which need to be committed.
11933          */
11934         do {
11935                 /* Skip marker pages. */
11936                 if (pp->p_hash == PVN_VPLIST_HASH_TAG)
11937                         continue;
11938 
11939                 /*
11940                  * First short-cut everything (without the page_lock)
11941                  * and see if this page does not need to be committed
11942                  * or is modified if so then we'll just skip it.
11943                  */
11944                 if (pp->p_fsdata == C_NOCOMMIT || hat_ismod(pp))
11945                         continue;
11946 
11947                 /*
11948                  * Attempt to lock the page.  If we can't, then
11949                  * someone else is messing with it or we have been
11950                  * called from nfs4_dispose and this is the page that
11951                  * nfs4_dispose was called with.. anyway just skip it.
11952                  */
11953                 if (!page_trylock(pp, SE_EXCL))
11954                         continue;
11955 
11956                 /*
11957                  * Lets check again now that we have the page lock.
11958                  */
11959                 if (pp->p_fsdata == C_NOCOMMIT || hat_ismod(pp)) {
11960                         page_unlock(pp);
11961                         continue;
11962                 }
11963 
11964                 /* this had better not be a free page */
11965                 ASSERT(PP_ISFREE(pp) == 0);
11966 
11967                 /*
11968                  * The page needs to be committed and we locked it.
11969                  * Update the base and length parameters and add it
11970                  * to r_pages.
11971                  */
11972                 if (rp->r_commit.c_pages == NULL) {
11973                         rp->r_commit.c_commbase = (offset3)pp->p_offset;
11974                         rp->r_commit.c_commlen = PAGESIZE;
11975                 } else if (pp->p_offset < rp->r_commit.c_commbase) {
11976                         rp->r_commit.c_commlen = rp->r_commit.c_commbase -
11977                             (offset3)pp->p_offset + rp->r_commit.c_commlen;
11978                         rp->r_commit.c_commbase = (offset3)pp->p_offset;
11979                 } else if ((rp->r_commit.c_commbase + rp->r_commit.c_commlen)
11980                     <= pp->p_offset) {
11981                         rp->r_commit.c_commlen = (offset3)pp->p_offset -
11982                             rp->r_commit.c_commbase + PAGESIZE;
11983                 }
11984                 page_add(&rp->r_commit.c_pages, pp);
11985         } while ((pp = pp->p_vpnext) != vp->v_pages);
11986 
11987         mutex_exit(vphm);
11988 }
11989 
11990 /*
11991  * This routine is used to gather together a page list of the pages
11992  * which are to be committed on the server.  This routine must not
11993  * be called if the calling thread holds any locked pages.
11994  *
11995  * The calling thread must have set R4COMMIT.  This bit is used to
11996  * serialize access to the commit structure in the rnode.  As long
11997  * as the thread has set R4COMMIT, then it can manipulate the commit
11998  * structure without requiring any other locks.
11999  */
12000 static void
12001 nfs4_get_commit_range(vnode_t *vp, u_offset_t soff, size_t len)
12002 {
12003 
12004         rnode4_t *rp;
12005         page_t *pp;
12006         u_offset_t end;
12007         u_offset_t off;
12008         ASSERT(len != 0);
12009         rp = VTOR4(vp);
12010         ASSERT(rp->r_flags & R4COMMIT);
12011 
12012         ASSERT(nfs_zone() == VTOMI4(vp)->mi_zone);
12013 
12014         /* make sure we're looking at the master vnode, not a shadow */
12015 
12016         if (IS_SHADOW(vp, rp))
12017                 vp = RTOV4(rp);
12018 
12019         /*
12020          * If there are no pages associated with this vnode, then
12021          * just return.
12022          */
12023         if ((pp = vp->v_pages) == NULL)
12024                 return;
12025         /*
12026          * Calculate the ending offset.
12027          */
12028         end = soff + len;
12029         for (off = soff; off < end; off += PAGESIZE) {
12030                 /*
12031                  * Lookup each page by vp, offset.
12032                  */
12033                 if ((pp = page_lookup_nowait(vp, off, SE_EXCL)) == NULL)
12034                         continue;
12035                 /*
12036                  * If this page does not need to be committed or is
12037                  * modified, then just skip it.
12038                  */
12039                 if (pp->p_fsdata == C_NOCOMMIT || hat_ismod(pp)) {
12040                         page_unlock(pp);
12041                         continue;
12042                 }
12043 
12044                 ASSERT(PP_ISFREE(pp) == 0);
12045                 /*
12046                  * The page needs to be committed and we locked it.
12047                  * Update the base and length parameters and add it
12048                  * to r_pages.
12049                  */
12050                 if (rp->r_commit.c_pages == NULL) {
12051                         rp->r_commit.c_commbase = (offset3)pp->p_offset;
12052                         rp->r_commit.c_commlen = PAGESIZE;
12053                 } else {
12054                         rp->r_commit.c_commlen = (offset3)pp->p_offset -
12055                             rp->r_commit.c_commbase + PAGESIZE;
12056                 }
12057                 page_add(&rp->r_commit.c_pages, pp);
12058         }
12059 }
12060 
12061 /*
12062  * Called from nfs4_close(), nfs4_fsync() and nfs4_delmap().
12063  * Flushes and commits data to the server.
12064  */
12065 static int
12066 nfs4_putpage_commit(vnode_t *vp, offset_t poff, size_t plen, cred_t *cr)
12067 {
12068         int error;
12069         verifier4 write_verf;
12070         rnode4_t *rp = VTOR4(vp);
12071 
12072         ASSERT(nfs_zone() == VTOMI4(vp)->mi_zone);
12073 
12074         /*
12075          * Flush the data portion of the file and then commit any
12076          * portions which need to be committed.  This may need to
12077          * be done twice if the server has changed state since
12078          * data was last written.  The data will need to be
12079          * rewritten to the server and then a new commit done.
12080          *
12081          * In fact, this may need to be done several times if the
12082          * server is having problems and crashing while we are
12083          * attempting to do this.
12084          */
12085 
12086 top:
12087         /*
12088          * Do a flush based on the poff and plen arguments.  This
12089          * will synchronously write out any modified pages in the
12090          * range specified by (poff, plen). This starts all of the
12091          * i/o operations which will be waited for in the next
12092          * call to nfs4_putpage
12093          */
12094 
12095         mutex_enter(&rp->r_statelock);
12096         write_verf = rp->r_writeverf;
12097         mutex_exit(&rp->r_statelock);
12098 
12099         error = nfs4_putpage(vp, poff, plen, B_ASYNC, cr, NULL);
12100         if (error == EAGAIN)
12101                 error = 0;
12102 
12103         /*
12104          * Do a flush based on the poff and plen arguments.  This
12105          * will synchronously write out any modified pages in the
12106          * range specified by (poff, plen) and wait until all of
12107          * the asynchronous i/o's in that range are done as well.
12108          */
12109         if (!error)
12110                 error = nfs4_putpage(vp, poff, plen, 0, cr, NULL);
12111 
12112         if (error)
12113                 return (error);
12114 
12115         mutex_enter(&rp->r_statelock);
12116         if (rp->r_writeverf != write_verf) {
12117                 mutex_exit(&rp->r_statelock);
12118                 goto top;
12119         }
12120         mutex_exit(&rp->r_statelock);
12121 
12122         /*
12123          * Now commit any pages which might need to be committed.
12124          * If the error, NFS_VERF_MISMATCH, is returned, then
12125          * start over with the flush operation.
12126          */
12127         error = nfs4_commit_vp(vp, poff, plen, cr, NFS4_WRITE_WAIT);
12128 
12129         if (error == NFS_VERF_MISMATCH)
12130                 goto top;
12131 
12132         return (error);
12133 }
12134 
12135 /*
12136  * nfs4_commit_vp()  will wait for other pending commits and
12137  * will either commit the whole file or a range, plen dictates
12138  * if we commit whole file. a value of zero indicates the whole
12139  * file. Called from nfs4_putpage_commit() or nfs4_sync_putapage()
12140  */
12141 static int
12142 nfs4_commit_vp(vnode_t *vp, u_offset_t poff, size_t plen,
12143     cred_t *cr, int wait_on_writes)
12144 {
12145         rnode4_t *rp;
12146         page_t *plist;
12147         offset3 offset;
12148         count3 len;
12149 
12150         ASSERT(nfs_zone() == VTOMI4(vp)->mi_zone);
12151 
12152         rp = VTOR4(vp);
12153 
12154         /*
12155          *  before we gather commitable pages make
12156          *  sure there are no outstanding async writes
12157          */
12158         if (rp->r_count && wait_on_writes == NFS4_WRITE_WAIT) {
12159                 mutex_enter(&rp->r_statelock);
12160                 while (rp->r_count > 0) {
12161                         cv_wait(&rp->r_cv, &rp->r_statelock);
12162                 }
12163                 mutex_exit(&rp->r_statelock);
12164         }
12165 
12166         /*
12167          * Set the `commit inprogress' state bit.  We must
12168          * first wait until any current one finishes.
12169          */
12170         mutex_enter(&rp->r_statelock);
12171         while (rp->r_flags & R4COMMIT) {
12172                 rp->r_flags |= R4COMMITWAIT;
12173                 cv_wait(&rp->r_commit.c_cv, &rp->r_statelock);
12174                 rp->r_flags &= ~R4COMMITWAIT;
12175         }
12176         rp->r_flags |= R4COMMIT;
12177         mutex_exit(&rp->r_statelock);
12178 
12179         /*
12180          * Gather all of the pages which need to be
12181          * committed.
12182          */
12183         if (plen == 0)
12184                 nfs4_get_commit(vp);
12185         else
12186                 nfs4_get_commit_range(vp, poff, plen);
12187 
12188         /*
12189          * Clear the `commit inprogress' bit and disconnect the
12190          * page list which was gathered by nfs4_get_commit.
12191          */
12192         plist = rp->r_commit.c_pages;
12193         rp->r_commit.c_pages = NULL;
12194         offset = rp->r_commit.c_commbase;
12195         len = rp->r_commit.c_commlen;
12196         mutex_enter(&rp->r_statelock);
12197         rp->r_flags &= ~R4COMMIT;
12198         cv_broadcast(&rp->r_commit.c_cv);
12199         mutex_exit(&rp->r_statelock);
12200 
12201         /*
12202          * If any pages need to be committed, commit them and
12203          * then unlock them so that they can be freed some
12204          * time later.
12205          */
12206         if (plist == NULL)
12207                 return (0);
12208 
12209         /*
12210          * No error occurred during the flush portion
12211          * of this operation, so now attempt to commit
12212          * the data to stable storage on the server.
12213          *
12214          * This will unlock all of the pages on the list.
12215          */
12216         return (nfs4_sync_commit(vp, plist, offset, len, cr));
12217 }
12218 
12219 static int
12220 nfs4_sync_commit(vnode_t *vp, page_t *plist, offset3 offset, count3 count,
12221     cred_t *cr)
12222 {
12223         int error;
12224         page_t *pp;
12225 
12226         ASSERT(nfs_zone() == VTOMI4(vp)->mi_zone);
12227 
12228         error = nfs4_commit(vp, (offset4)offset, (count3)count, cr);
12229 
12230         /*
12231          * If we got an error, then just unlock all of the pages
12232          * on the list.
12233          */
12234         if (error) {
12235                 while (plist != NULL) {
12236                         pp = plist;
12237                         page_sub(&plist, pp);
12238                         page_unlock(pp);
12239                 }
12240                 return (error);
12241         }
12242         /*
12243          * We've tried as hard as we can to commit the data to stable
12244          * storage on the server.  We just unlock the pages and clear
12245          * the commit required state.  They will get freed later.
12246          */
12247         while (plist != NULL) {
12248                 pp = plist;
12249                 page_sub(&plist, pp);
12250                 pp->p_fsdata = C_NOCOMMIT;
12251                 page_unlock(pp);
12252         }
12253 
12254         return (error);
12255 }
12256 
12257 static void
12258 do_nfs4_async_commit(vnode_t *vp, page_t *plist, offset3 offset, count3 count,
12259     cred_t *cr)
12260 {
12261 
12262         (void) nfs4_sync_commit(vp, plist, offset, count, cr);
12263 }
12264 
12265 /*ARGSUSED*/
12266 static int
12267 nfs4_setsecattr(vnode_t *vp, vsecattr_t *vsecattr, int flag, cred_t *cr,
12268         caller_context_t *ct)
12269 {
12270         int             error = 0;
12271         mntinfo4_t      *mi;
12272         vattr_t         va;
12273         vsecattr_t      nfsace4_vsap;
12274 
12275         mi = VTOMI4(vp);
12276         if (nfs_zone() != mi->mi_zone)
12277                 return (EIO);
12278         if (mi->mi_flags & MI4_ACL) {
12279                 /* if we have a delegation, return it */
12280                 if (VTOR4(vp)->r_deleg_type != OPEN_DELEGATE_NONE)
12281                         (void) nfs4delegreturn(VTOR4(vp),
12282                             NFS4_DR_REOPEN|NFS4_DR_PUSH);
12283 
12284                 error = nfs4_is_acl_mask_valid(vsecattr->vsa_mask,
12285                     NFS4_ACL_SET);
12286                 if (error) /* EINVAL */
12287                         return (error);
12288 
12289                 if (vsecattr->vsa_mask & (VSA_ACL | VSA_DFACL)) {
12290                         /*
12291                          * These are aclent_t type entries.
12292                          */
12293                         error = vs_aent_to_ace4(vsecattr, &nfsace4_vsap,
12294                             vp->v_type == VDIR, FALSE);
12295                         if (error)
12296                                 return (error);
12297                 } else {
12298                         /*
12299                          * These are ace_t type entries.
12300                          */
12301                         error = vs_acet_to_ace4(vsecattr, &nfsace4_vsap,
12302                             FALSE);
12303                         if (error)
12304                                 return (error);
12305                 }
12306                 bzero(&va, sizeof (va));
12307                 error = nfs4setattr(vp, &va, flag, cr, &nfsace4_vsap);
12308                 vs_ace4_destroy(&nfsace4_vsap);
12309                 return (error);
12310         }
12311         return (ENOSYS);
12312 }
12313 
12314 /* ARGSUSED */
12315 int
12316 nfs4_getsecattr(vnode_t *vp, vsecattr_t *vsecattr, int flag, cred_t *cr,
12317         caller_context_t *ct)
12318 {
12319         int             error;
12320         mntinfo4_t      *mi;
12321         nfs4_ga_res_t   gar;
12322         rnode4_t        *rp = VTOR4(vp);
12323 
12324         mi = VTOMI4(vp);
12325         if (nfs_zone() != mi->mi_zone)
12326                 return (EIO);
12327 
12328         bzero(&gar, sizeof (gar));
12329         gar.n4g_vsa.vsa_mask = vsecattr->vsa_mask;
12330 
12331         /*
12332          * vsecattr->vsa_mask holds the original acl request mask.
12333          * This is needed when determining what to return.
12334          * (See: nfs4_create_getsecattr_return())
12335          */
12336         error = nfs4_is_acl_mask_valid(vsecattr->vsa_mask, NFS4_ACL_GET);
12337         if (error) /* EINVAL */
12338                 return (error);
12339 
12340         /*
12341          * If this is a referral stub, don't try to go OTW for an ACL
12342          */
12343         if (RP_ISSTUB_REFERRAL(VTOR4(vp)))
12344                 return (fs_fab_acl(vp, vsecattr, flag, cr, ct));
12345 
12346         if (mi->mi_flags & MI4_ACL) {
12347                 /*
12348                  * Check if the data is cached and the cache is valid.  If it
12349                  * is we don't go over the wire.
12350                  */
12351                 if (rp->r_secattr != NULL && ATTRCACHE4_VALID(vp)) {
12352                         mutex_enter(&rp->r_statelock);
12353                         if (rp->r_secattr != NULL) {
12354                                 error = nfs4_create_getsecattr_return(
12355                                     rp->r_secattr, vsecattr, rp->r_attr.va_uid,
12356                                     rp->r_attr.va_gid,
12357                                     vp->v_type == VDIR);
12358                                 if (!error) { /* error == 0 - Success! */
12359                                         mutex_exit(&rp->r_statelock);
12360                                         return (error);
12361                                 }
12362                         }
12363                         mutex_exit(&rp->r_statelock);
12364                 }
12365 
12366                 /*
12367                  * The getattr otw call will always get both the acl, in
12368                  * the form of a list of nfsace4's, and the number of acl
12369                  * entries; independent of the value of gar.n4g_vsa.vsa_mask.
12370                  */
12371                 gar.n4g_va.va_mask = AT_ALL;
12372                 error =  nfs4_getattr_otw(vp, &gar, cr, 1);
12373                 if (error) {
12374                         vs_ace4_destroy(&gar.n4g_vsa);
12375                         if (error == ENOTSUP || error == EOPNOTSUPP)
12376                                 error = fs_fab_acl(vp, vsecattr, flag, cr, ct);
12377                         return (error);
12378                 }
12379 
12380                 if (!(gar.n4g_resbmap & FATTR4_ACL_MASK)) {
12381                         /*
12382                          * No error was returned, but according to the response
12383                          * bitmap, neither was an acl.
12384                          */
12385                         vs_ace4_destroy(&gar.n4g_vsa);
12386                         error = fs_fab_acl(vp, vsecattr, flag, cr, ct);
12387                         return (error);
12388                 }
12389 
12390                 /*
12391                  * Update the cache with the ACL.
12392                  */
12393                 nfs4_acl_fill_cache(rp, &gar.n4g_vsa);
12394 
12395                 error = nfs4_create_getsecattr_return(&gar.n4g_vsa,
12396                     vsecattr, gar.n4g_va.va_uid, gar.n4g_va.va_gid,
12397                     vp->v_type == VDIR);
12398                 vs_ace4_destroy(&gar.n4g_vsa);
12399                 if ((error) && (vsecattr->vsa_mask &
12400                     (VSA_ACL | VSA_ACLCNT | VSA_DFACL | VSA_DFACLCNT)) &&
12401                     (error != EACCES)) {
12402                         error = fs_fab_acl(vp, vsecattr, flag, cr, ct);
12403                 }
12404                 return (error);
12405         }
12406         error = fs_fab_acl(vp, vsecattr, flag, cr, ct);
12407         return (error);
12408 }
12409 
12410 /*
12411  * The function returns:
12412  *      - 0 (zero) if the passed in "acl_mask" is a valid request.
12413  *      - EINVAL if the passed in "acl_mask" is an invalid request.
12414  *
12415  * In the case of getting an acl (op == NFS4_ACL_GET) the mask is invalid if:
12416  * - We have a mixture of ACE and ACL requests (e.g. VSA_ACL | VSA_ACE)
12417  *
12418  * In the case of setting an acl (op == NFS4_ACL_SET) the mask is invalid if:
12419  * - We have a mixture of ACE and ACL requests (e.g. VSA_ACL | VSA_ACE)
12420  * - We have a count field set without the corresponding acl field set. (e.g. -
12421  * VSA_ACECNT is set, but VSA_ACE is not)
12422  */
12423 static int
12424 nfs4_is_acl_mask_valid(uint_t acl_mask, nfs4_acl_op_t op)
12425 {
12426         /* Shortcut the masks that are always valid. */
12427         if (acl_mask == (VSA_ACE | VSA_ACECNT))
12428                 return (0);
12429         if (acl_mask == (VSA_ACL | VSA_ACLCNT | VSA_DFACL | VSA_DFACLCNT))
12430                 return (0);
12431 
12432         if (acl_mask & (VSA_ACE | VSA_ACECNT)) {
12433                 /*
12434                  * We can't have any VSA_ACL type stuff in the mask now.
12435                  */
12436                 if (acl_mask & (VSA_ACL | VSA_ACLCNT | VSA_DFACL |
12437                     VSA_DFACLCNT))
12438                         return (EINVAL);
12439 
12440                 if (op == NFS4_ACL_SET) {
12441                         if ((acl_mask & VSA_ACECNT) && !(acl_mask & VSA_ACE))
12442                                 return (EINVAL);
12443                 }
12444         }
12445 
12446         if (acl_mask & (VSA_ACL | VSA_ACLCNT | VSA_DFACL | VSA_DFACLCNT)) {
12447                 /*
12448                  * We can't have any VSA_ACE type stuff in the mask now.
12449                  */
12450                 if (acl_mask & (VSA_ACE | VSA_ACECNT))
12451                         return (EINVAL);
12452 
12453                 if (op == NFS4_ACL_SET) {
12454                         if ((acl_mask & VSA_ACLCNT) && !(acl_mask & VSA_ACL))
12455                                 return (EINVAL);
12456 
12457                         if ((acl_mask & VSA_DFACLCNT) &&
12458                             !(acl_mask & VSA_DFACL))
12459                                 return (EINVAL);
12460                 }
12461         }
12462         return (0);
12463 }
12464 
12465 /*
12466  * The theory behind creating the correct getsecattr return is simply this:
12467  * "Don't return anything that the caller is not expecting to have to free."
12468  */
12469 static int
12470 nfs4_create_getsecattr_return(vsecattr_t *filled_vsap, vsecattr_t *vsap,
12471     uid_t uid, gid_t gid, int isdir)
12472 {
12473         int error = 0;
12474         /* Save the mask since the translators modify it. */
12475         uint_t  orig_mask = vsap->vsa_mask;
12476 
12477         if (orig_mask & (VSA_ACE | VSA_ACECNT)) {
12478                 error = vs_ace4_to_acet(filled_vsap, vsap, uid, gid, FALSE);
12479 
12480                 if (error)
12481                         return (error);
12482 
12483                 /*
12484                  * If the caller only asked for the ace count (VSA_ACECNT)
12485                  * don't give them the full acl (VSA_ACE), free it.
12486                  */
12487                 if (!orig_mask & VSA_ACE) {
12488                         if (vsap->vsa_aclentp != NULL) {
12489                                 kmem_free(vsap->vsa_aclentp,
12490                                     vsap->vsa_aclcnt * sizeof (ace_t));
12491                                 vsap->vsa_aclentp = NULL;
12492                         }
12493                 }
12494                 vsap->vsa_mask = orig_mask;
12495 
12496         } else if (orig_mask & (VSA_ACL | VSA_ACLCNT | VSA_DFACL |
12497             VSA_DFACLCNT)) {
12498                 error = vs_ace4_to_aent(filled_vsap, vsap, uid, gid,
12499                     isdir, FALSE);
12500 
12501                 if (error)
12502                         return (error);
12503 
12504                 /*
12505                  * If the caller only asked for the acl count (VSA_ACLCNT)
12506                  * and/or the default acl count (VSA_DFACLCNT) don't give them
12507                  * the acl (VSA_ACL) or default acl (VSA_DFACL), free it.
12508                  */
12509                 if (!orig_mask & VSA_ACL) {
12510                         if (vsap->vsa_aclentp != NULL) {
12511                                 kmem_free(vsap->vsa_aclentp,
12512                                     vsap->vsa_aclcnt * sizeof (aclent_t));
12513                                 vsap->vsa_aclentp = NULL;
12514                         }
12515                 }
12516 
12517                 if (!orig_mask & VSA_DFACL) {
12518                         if (vsap->vsa_dfaclentp != NULL) {
12519                                 kmem_free(vsap->vsa_dfaclentp,
12520                                     vsap->vsa_dfaclcnt * sizeof (aclent_t));
12521                                 vsap->vsa_dfaclentp = NULL;
12522                         }
12523                 }
12524                 vsap->vsa_mask = orig_mask;
12525         }
12526         return (0);
12527 }
12528 
12529 /* ARGSUSED */
12530 int
12531 nfs4_shrlock(vnode_t *vp, int cmd, struct shrlock *shr, int flag, cred_t *cr,
12532     caller_context_t *ct)
12533 {
12534         int error;
12535 
12536         if (nfs_zone() != VTOMI4(vp)->mi_zone)
12537                 return (EIO);
12538         /*
12539          * check for valid cmd parameter
12540          */
12541         if (cmd != F_SHARE && cmd != F_UNSHARE && cmd != F_HASREMOTELOCKS)
12542                 return (EINVAL);
12543 
12544         /*
12545          * Check access permissions
12546          */
12547         if ((cmd & F_SHARE) &&
12548             (((shr->s_access & F_RDACC) && (flag & FREAD) == 0) ||
12549             (shr->s_access == F_WRACC && (flag & FWRITE) == 0)))
12550                 return (EBADF);
12551 
12552         /*
12553          * If the filesystem is mounted using local locking, pass the
12554          * request off to the local share code.
12555          */
12556         if (VTOMI4(vp)->mi_flags & MI4_LLOCK)
12557                 return (fs_shrlock(vp, cmd, shr, flag, cr, ct));
12558 
12559         switch (cmd) {
12560         case F_SHARE:
12561         case F_UNSHARE:
12562                 /*
12563                  * This will be properly implemented later,
12564                  * see RFE: 4823948 .
12565                  */
12566                 error = EAGAIN;
12567                 break;
12568 
12569         case F_HASREMOTELOCKS:
12570                 /*
12571                  * NFS client can't store remote locks itself
12572                  */
12573                 shr->s_access = 0;
12574                 error = 0;
12575                 break;
12576 
12577         default:
12578                 error = EINVAL;
12579                 break;
12580         }
12581 
12582         return (error);
12583 }
12584 
12585 /*
12586  * Common code called by directory ops to update the attrcache
12587  */
12588 static int
12589 nfs4_update_attrcache(nfsstat4 status, nfs4_ga_res_t *garp,
12590     hrtime_t t, vnode_t *vp, cred_t *cr)
12591 {
12592         int error = 0;
12593 
12594         ASSERT(nfs_zone() == VTOMI4(vp)->mi_zone);
12595 
12596         if (status != NFS4_OK) {
12597                 /* getattr not done or failed */
12598                 PURGE_ATTRCACHE4(vp);
12599                 return (error);
12600         }
12601 
12602         if (garp) {
12603                 nfs4_attr_cache(vp, garp, t, cr, FALSE, NULL);
12604         } else {
12605                 PURGE_ATTRCACHE4(vp);
12606         }
12607         return (error);
12608 }
12609 
12610 /*
12611  * Update directory caches for directory modification ops (link, rename, etc.)
12612  * When dinfo is NULL, manage dircaches in the old way.
12613  */
12614 static void
12615 nfs4_update_dircaches(change_info4 *cinfo, vnode_t *dvp, vnode_t *vp, char *nm,
12616     dirattr_info_t *dinfo)
12617 {
12618         rnode4_t        *drp = VTOR4(dvp);
12619 
12620         ASSERT(nfs_zone() == VTOMI4(dvp)->mi_zone);
12621 
12622         /* Purge rddir cache for dir since it changed */
12623         if (drp->r_dir != NULL)
12624                 nfs4_purge_rddir_cache(dvp);
12625 
12626         /*
12627          * If caller provided dinfo, then use it to manage dir caches.
12628          */
12629         if (dinfo != NULL) {
12630                 if (vp != NULL) {
12631                         mutex_enter(&VTOR4(vp)->r_statev4_lock);
12632                         if (!VTOR4(vp)->created_v4) {
12633                                 mutex_exit(&VTOR4(vp)->r_statev4_lock);
12634                                 dnlc_update(dvp, nm, vp);
12635                         } else {
12636                                 /*
12637                                  * XXX don't update if the created_v4 flag is
12638                                  * set
12639                                  */
12640                                 mutex_exit(&VTOR4(vp)->r_statev4_lock);
12641                                 NFS4_DEBUG(nfs4_client_state_debug,
12642                                     (CE_NOTE, "nfs4_update_dircaches: "
12643                                     "don't update dnlc: created_v4 flag"));
12644                         }
12645                 }
12646 
12647                 nfs4_attr_cache(dvp, dinfo->di_garp, dinfo->di_time_call,
12648                     dinfo->di_cred, FALSE, cinfo);
12649 
12650                 return;
12651         }
12652 
12653         /*
12654          * Caller didn't provide dinfo, then check change_info4 to update DNLC.
12655          * Since caller modified dir but didn't receive post-dirmod-op dir
12656          * attrs, the dir's attrs must be purged.
12657          *
12658          * XXX this check and dnlc update/purge should really be atomic,
12659          * XXX but can't use rnode statelock because it'll deadlock in
12660          * XXX dnlc_purge_vp, however, the risk is minimal even if a race
12661          * XXX does occur.
12662          *
12663          * XXX We also may want to check that atomic is true in the
12664          * XXX change_info struct. If it is not, the change_info may
12665          * XXX reflect changes by more than one clients which means that
12666          * XXX our cache may not be valid.
12667          */
12668         PURGE_ATTRCACHE4(dvp);
12669         if (drp->r_change == cinfo->before) {
12670                 /* no changes took place in the directory prior to our link */
12671                 if (vp != NULL) {
12672                         mutex_enter(&VTOR4(vp)->r_statev4_lock);
12673                         if (!VTOR4(vp)->created_v4) {
12674                                 mutex_exit(&VTOR4(vp)->r_statev4_lock);
12675                                 dnlc_update(dvp, nm, vp);
12676                         } else {
12677                                 /*
12678                                  * XXX dont' update if the created_v4 flag
12679                                  * is set
12680                                  */
12681                                 mutex_exit(&VTOR4(vp)->r_statev4_lock);
12682                                 NFS4_DEBUG(nfs4_client_state_debug, (CE_NOTE,
12683                                     "nfs4_update_dircaches: don't"
12684                                     " update dnlc: created_v4 flag"));
12685                         }
12686                 }
12687         } else {
12688                 /* Another client modified directory - purge its dnlc cache */
12689                 dnlc_purge_vp(dvp);
12690         }
12691 }
12692 
12693 /*
12694  * The OPEN_CONFIRM operation confirms the sequence number used in OPENing a
12695  * file.
12696  *
12697  * The 'reopening_file' boolean should be set to TRUE if we are reopening this
12698  * file (ie: client recovery) and otherwise set to FALSE.
12699  *
12700  * 'nfs4_start/end_op' should have been called by the proper (ie: not recovery
12701  * initiated) calling functions.
12702  *
12703  * 'resend' is set to TRUE if this is a OPEN_CONFIRM issued as a result
12704  * of resending a 'lost' open request.
12705  *
12706  * 'num_bseqid_retryp' makes sure we don't loop forever on a broken
12707  * server that hands out BAD_SEQID on open confirm.
12708  *
12709  * Errors are returned via the nfs4_error_t parameter.
12710  */
12711 void
12712 nfs4open_confirm(vnode_t *vp, seqid4 *seqid, stateid4 *stateid, cred_t *cr,
12713     bool_t reopening_file, bool_t *retry_open, nfs4_open_owner_t *oop,
12714     bool_t resend, nfs4_error_t *ep, int *num_bseqid_retryp)
12715 {
12716         COMPOUND4args_clnt args;
12717         COMPOUND4res_clnt res;
12718         nfs_argop4 argop[2];
12719         nfs_resop4 *resop;
12720         int doqueue = 1;
12721         mntinfo4_t *mi;
12722         OPEN_CONFIRM4args *open_confirm_args;
12723         int needrecov;
12724 
12725         ASSERT(nfs_zone() == VTOMI4(vp)->mi_zone);
12726 #if DEBUG
12727         mutex_enter(&oop->oo_lock);
12728         ASSERT(oop->oo_seqid_inuse);
12729         mutex_exit(&oop->oo_lock);
12730 #endif
12731 
12732 recov_retry_confirm:
12733         nfs4_error_zinit(ep);
12734         *retry_open = FALSE;
12735 
12736         if (resend)
12737                 args.ctag = TAG_OPEN_CONFIRM_LOST;
12738         else
12739                 args.ctag = TAG_OPEN_CONFIRM;
12740 
12741         args.array_len = 2;
12742         args.array = argop;
12743 
12744         /* putfh target fh */
12745         argop[0].argop = OP_CPUTFH;
12746         argop[0].nfs_argop4_u.opcputfh.sfh = VTOR4(vp)->r_fh;
12747 
12748         argop[1].argop = OP_OPEN_CONFIRM;
12749         open_confirm_args = &argop[1].nfs_argop4_u.opopen_confirm;
12750 
12751         (*seqid) += 1;
12752         open_confirm_args->seqid = *seqid;
12753         open_confirm_args->open_stateid = *stateid;
12754 
12755         mi = VTOMI4(vp);
12756 
12757         rfs4call(mi, &args, &res, cr, &doqueue, 0, ep);
12758 
12759         if (!ep->error && nfs4_need_to_bump_seqid(&res)) {
12760                 nfs4_set_open_seqid((*seqid), oop, args.ctag);
12761         }
12762 
12763         needrecov = nfs4_needs_recovery(ep, FALSE, mi->mi_vfsp);
12764         if (!needrecov && ep->error)
12765                 return;
12766 
12767         if (needrecov) {
12768                 bool_t abort = FALSE;
12769 
12770                 if (reopening_file == FALSE) {
12771                         nfs4_bseqid_entry_t *bsep = NULL;
12772 
12773                         if (!ep->error && res.status == NFS4ERR_BAD_SEQID)
12774                                 bsep = nfs4_create_bseqid_entry(oop, NULL,
12775                                     vp, 0, args.ctag,
12776                                     open_confirm_args->seqid);
12777 
12778                         abort = nfs4_start_recovery(ep, VTOMI4(vp), vp, NULL,
12779                             NULL, NULL, OP_OPEN_CONFIRM, bsep, NULL, NULL);
12780                         if (bsep) {
12781                                 kmem_free(bsep, sizeof (*bsep));
12782                                 if (num_bseqid_retryp &&
12783                                     --(*num_bseqid_retryp) == 0)
12784                                         abort = TRUE;
12785                         }
12786                 }
12787                 if ((ep->error == ETIMEDOUT ||
12788                     res.status == NFS4ERR_RESOURCE) &&
12789                     abort == FALSE && resend == FALSE) {
12790                         if (!ep->error)
12791                                 (void) xdr_free(xdr_COMPOUND4res_clnt,
12792                                     (caddr_t)&res);
12793 
12794                         delay(SEC_TO_TICK(confirm_retry_sec));
12795                         goto recov_retry_confirm;
12796                 }
12797                 /* State may have changed so retry the entire OPEN op */
12798                 if (abort == FALSE)
12799                         *retry_open = TRUE;
12800                 else
12801                         *retry_open = FALSE;
12802                 if (!ep->error)
12803                         (void) xdr_free(xdr_COMPOUND4res_clnt, (caddr_t)&res);
12804                 return;
12805         }
12806 
12807         if (res.status) {
12808                 (void) xdr_free(xdr_COMPOUND4res_clnt, (caddr_t)&res);
12809                 return;
12810         }
12811 
12812         resop = &res.array[1];  /* open confirm res */
12813         bcopy(&resop->nfs_resop4_u.opopen_confirm.open_stateid,
12814             stateid, sizeof (*stateid));
12815 
12816         (void) xdr_free(xdr_COMPOUND4res_clnt, (caddr_t)&res);
12817 }
12818 
12819 /*
12820  * Return the credentials associated with a client state object.  The
12821  * caller is responsible for freeing the credentials.
12822  */
12823 
12824 static cred_t *
12825 state_to_cred(nfs4_open_stream_t *osp)
12826 {
12827         cred_t *cr;
12828 
12829         /*
12830          * It's ok to not lock the open stream and open owner to get
12831          * the oo_cred since this is only written once (upon creation)
12832          * and will not change.
12833          */
12834         cr = osp->os_open_owner->oo_cred;
12835         crhold(cr);
12836 
12837         return (cr);
12838 }
12839 
12840 /*
12841  * nfs4_find_sysid
12842  *
12843  * Find the sysid for the knetconfig associated with the given mi.
12844  */
12845 static struct lm_sysid *
12846 nfs4_find_sysid(mntinfo4_t *mi)
12847 {
12848         ASSERT(nfs_zone() == mi->mi_zone);
12849 
12850         /*
12851          * Switch from RDMA knconf to original mount knconf
12852          */
12853         return (lm_get_sysid(ORIG_KNCONF(mi), &mi->mi_curr_serv->sv_addr,
12854             mi->mi_curr_serv->sv_hostname, NULL));
12855 }
12856 
12857 #ifdef DEBUG
12858 /*
12859  * Return a string version of the call type for easy reading.
12860  */
12861 static char *
12862 nfs4frlock_get_call_type(nfs4_lock_call_type_t ctype)
12863 {
12864         switch (ctype) {
12865         case NFS4_LCK_CTYPE_NORM:
12866                 return ("NORMAL");
12867         case NFS4_LCK_CTYPE_RECLAIM:
12868                 return ("RECLAIM");
12869         case NFS4_LCK_CTYPE_RESEND:
12870                 return ("RESEND");
12871         case NFS4_LCK_CTYPE_REINSTATE:
12872                 return ("REINSTATE");
12873         default:
12874                 cmn_err(CE_PANIC, "nfs4frlock_get_call_type: got illegal "
12875                     "type %d", ctype);
12876                 return ("");
12877         }
12878 }
12879 #endif
12880 
12881 /*
12882  * Map the frlock cmd and lock type to the NFSv4 over-the-wire lock type
12883  * Unlock requests don't have an over-the-wire locktype, so we just return
12884  * something non-threatening.
12885  */
12886 
12887 static nfs_lock_type4
12888 flk_to_locktype(int cmd, int l_type)
12889 {
12890         ASSERT(l_type == F_RDLCK || l_type == F_WRLCK || l_type == F_UNLCK);
12891 
12892         switch (l_type) {
12893         case F_UNLCK:
12894                 return (READ_LT);
12895         case F_RDLCK:
12896                 if (cmd == F_SETLK)
12897                         return (READ_LT);
12898                 else
12899                         return (READW_LT);
12900         case F_WRLCK:
12901                 if (cmd == F_SETLK)
12902                         return (WRITE_LT);
12903                 else
12904                         return (WRITEW_LT);
12905         }
12906         panic("flk_to_locktype");
12907         /*NOTREACHED*/
12908 }
12909 
12910 /*
12911  * Do some preliminary checks for nfs4frlock.
12912  */
12913 static int
12914 nfs4frlock_validate_args(int cmd, flock64_t *flk, int flag, vnode_t *vp,
12915     u_offset_t offset)
12916 {
12917         int error = 0;
12918 
12919         /*
12920          * If we are setting a lock, check that the file is opened
12921          * with the correct mode.
12922          */
12923         if (cmd == F_SETLK || cmd == F_SETLKW) {
12924                 if ((flk->l_type == F_RDLCK && (flag & FREAD) == 0) ||
12925                     (flk->l_type == F_WRLCK && (flag & FWRITE) == 0)) {
12926                         NFS4_DEBUG(nfs4_client_lock_debug, (CE_NOTE,
12927                             "nfs4frlock_validate_args: file was opened with "
12928                             "incorrect mode"));
12929                         return (EBADF);
12930                 }
12931         }
12932 
12933         /* Convert the offset. It may need to be restored before returning. */
12934         if (error = convoff(vp, flk, 0, offset)) {
12935                 NFS4_DEBUG(nfs4_client_lock_debug, (CE_NOTE,
12936                     "nfs4frlock_validate_args: convoff  =>  error= %d\n",
12937                     error));
12938                 return (error);
12939         }
12940 
12941         return (error);
12942 }
12943 
12944 /*
12945  * Set the flock64's lm_sysid for nfs4frlock.
12946  */
12947 static int
12948 nfs4frlock_get_sysid(struct lm_sysid **lspp, vnode_t *vp, flock64_t *flk)
12949 {
12950         ASSERT(nfs_zone() == VTOMI4(vp)->mi_zone);
12951 
12952         /* Find the lm_sysid */
12953         *lspp = nfs4_find_sysid(VTOMI4(vp));
12954 
12955         if (*lspp == NULL) {
12956                 NFS4_DEBUG(nfs4_client_lock_debug, (CE_NOTE,
12957                     "nfs4frlock_get_sysid: no sysid, return ENOLCK"));
12958                 return (ENOLCK);
12959         }
12960 
12961         flk->l_sysid = lm_sysidt(*lspp);
12962 
12963         return (0);
12964 }
12965 
12966 /*
12967  * Do the remaining preliminary setup for nfs4frlock.
12968  */
12969 static void
12970 nfs4frlock_pre_setup(clock_t *tick_delayp, nfs4_recov_state_t *recov_statep,
12971     flock64_t *flk, short *whencep, vnode_t *vp, cred_t *search_cr,
12972     cred_t **cred_otw)
12973 {
12974         /*
12975          * set tick_delay to the base delay time.
12976          * (NFS4_BASE_WAIT_TIME is in secs)
12977          */
12978 
12979         *tick_delayp = drv_usectohz(NFS4_BASE_WAIT_TIME * 1000 * 1000);
12980 
12981         /*
12982          * If lock is relative to EOF, we need the newest length of the
12983          * file. Therefore invalidate the ATTR_CACHE.
12984          */
12985 
12986         *whencep = flk->l_whence;
12987 
12988         if (*whencep == 2)              /* SEEK_END */
12989                 PURGE_ATTRCACHE4(vp);
12990 
12991         recov_statep->rs_flags = 0;
12992         recov_statep->rs_num_retry_despite_err = 0;
12993         *cred_otw = nfs4_get_otw_cred(search_cr, VTOMI4(vp), NULL);
12994 }
12995 
12996 /*
12997  * Initialize and allocate the data structures necessary for
12998  * the nfs4frlock call.
12999  * Allocates argsp's op array, frees up the saved_rqstpp if there is one.
13000  */
13001 static void
13002 nfs4frlock_call_init(COMPOUND4args_clnt *argsp, COMPOUND4args_clnt **argspp,
13003     nfs_argop4 **argopp, nfs4_op_hint_t *op_hintp, flock64_t *flk, int cmd,
13004     bool_t *retry, bool_t *did_start_fop, COMPOUND4res_clnt **respp,
13005     bool_t *skip_get_err, nfs4_lost_rqst_t *lost_rqstp)
13006 {
13007         int             argoplist_size;
13008         int             num_ops = 2;
13009 
13010         *retry = FALSE;
13011         *did_start_fop = FALSE;
13012         *skip_get_err = FALSE;
13013         lost_rqstp->lr_op = 0;
13014         argoplist_size  = num_ops * sizeof (nfs_argop4);
13015         /* fill array with zero */
13016         *argopp = kmem_zalloc(argoplist_size, KM_SLEEP);
13017 
13018         *argspp = argsp;
13019         *respp = NULL;
13020 
13021         argsp->array_len = num_ops;
13022         argsp->array = *argopp;
13023 
13024         /* initialize in case of error; will get real value down below */
13025         argsp->ctag = TAG_NONE;
13026 
13027         if ((cmd == F_SETLK || cmd == F_SETLKW) && flk->l_type == F_UNLCK)
13028                 *op_hintp = OH_LOCKU;
13029         else
13030                 *op_hintp = OH_OTHER;
13031 }
13032 
13033 /*
13034  * Call the nfs4_start_fop() for nfs4frlock, if necessary.  Assign
13035  * the proper nfs4_server_t for this instance of nfs4frlock.
13036  * Returns 0 (success) or an errno value.
13037  */
13038 static int
13039 nfs4frlock_start_call(nfs4_lock_call_type_t ctype, vnode_t *vp,
13040     nfs4_op_hint_t op_hint, nfs4_recov_state_t *recov_statep,
13041     bool_t *did_start_fop, bool_t *startrecovp)
13042 {
13043         int error = 0;
13044         rnode4_t *rp;
13045 
13046         ASSERT(nfs_zone() == VTOMI4(vp)->mi_zone);
13047 
13048         if (ctype == NFS4_LCK_CTYPE_NORM) {
13049                 error = nfs4_start_fop(VTOMI4(vp), vp, NULL, op_hint,
13050                     recov_statep, startrecovp);
13051                 if (error)
13052                         return (error);
13053                 *did_start_fop = TRUE;
13054         } else {
13055                 *did_start_fop = FALSE;
13056                 *startrecovp = FALSE;
13057         }
13058 
13059         if (!error) {
13060                 rp = VTOR4(vp);
13061 
13062                 /* If the file failed recovery, just quit. */
13063                 mutex_enter(&rp->r_statelock);
13064                 if (rp->r_flags & R4RECOVERR) {
13065                         error = EIO;
13066                 }
13067                 mutex_exit(&rp->r_statelock);
13068         }
13069 
13070         return (error);
13071 }
13072 
13073 /*
13074  * Setup the LOCK4/LOCKU4 arguments for resending a lost lock request.  A
13075  * resend nfs4frlock call is initiated by the recovery framework.
13076  * Acquires the lop and oop seqid synchronization.
13077  */
13078 static void
13079 nfs4frlock_setup_resend_lock_args(nfs4_lost_rqst_t *resend_rqstp,
13080     COMPOUND4args_clnt *argsp, nfs_argop4 *argop, nfs4_lock_owner_t **lopp,
13081     nfs4_open_owner_t **oopp, nfs4_open_stream_t **ospp,
13082     LOCK4args **lock_argsp, LOCKU4args **locku_argsp)
13083 {
13084         mntinfo4_t *mi = VTOMI4(resend_rqstp->lr_vp);
13085         int error;
13086 
13087         NFS4_DEBUG((nfs4_lost_rqst_debug || nfs4_client_lock_debug),
13088             (CE_NOTE,
13089             "nfs4frlock_setup_resend_lock_args: have lost lock to resend"));
13090         ASSERT(resend_rqstp != NULL);
13091         ASSERT(resend_rqstp->lr_op == OP_LOCK ||
13092             resend_rqstp->lr_op == OP_LOCKU);
13093 
13094         *oopp = resend_rqstp->lr_oop;
13095         if (resend_rqstp->lr_oop) {
13096                 open_owner_hold(resend_rqstp->lr_oop);
13097                 error = nfs4_start_open_seqid_sync(resend_rqstp->lr_oop, mi);
13098                 ASSERT(error == 0);     /* recov thread always succeeds */
13099         }
13100 
13101         /* Must resend this lost lock/locku request. */
13102         ASSERT(resend_rqstp->lr_lop != NULL);
13103         *lopp = resend_rqstp->lr_lop;
13104         lock_owner_hold(resend_rqstp->lr_lop);
13105         error = nfs4_start_lock_seqid_sync(resend_rqstp->lr_lop, mi);
13106         ASSERT(error == 0);     /* recov thread always succeeds */
13107 
13108         *ospp = resend_rqstp->lr_osp;
13109         if (*ospp)
13110                 open_stream_hold(resend_rqstp->lr_osp);
13111 
13112         if (resend_rqstp->lr_op == OP_LOCK) {
13113                 LOCK4args *lock_args;
13114 
13115                 argop->argop = OP_LOCK;
13116                 *lock_argsp = lock_args = &argop->nfs_argop4_u.oplock;
13117                 lock_args->locktype = resend_rqstp->lr_locktype;
13118                 lock_args->reclaim =
13119                     (resend_rqstp->lr_ctype == NFS4_LCK_CTYPE_RECLAIM);
13120                 lock_args->offset = resend_rqstp->lr_flk->l_start;
13121                 lock_args->length = resend_rqstp->lr_flk->l_len;
13122                 if (lock_args->length == 0)
13123                         lock_args->length = ~lock_args->length;
13124                 nfs4_setup_lock_args(*lopp, *oopp, *ospp,
13125                     mi2clientid(mi), &lock_args->locker);
13126 
13127                 switch (resend_rqstp->lr_ctype) {
13128                 case NFS4_LCK_CTYPE_RESEND:
13129                         argsp->ctag = TAG_LOCK_RESEND;
13130                         break;
13131                 case NFS4_LCK_CTYPE_REINSTATE:
13132                         argsp->ctag = TAG_LOCK_REINSTATE;
13133                         break;
13134                 case NFS4_LCK_CTYPE_RECLAIM:
13135                         argsp->ctag = TAG_LOCK_RECLAIM;
13136                         break;
13137                 default:
13138                         argsp->ctag = TAG_LOCK_UNKNOWN;
13139                         break;
13140                 }
13141         } else {
13142                 LOCKU4args *locku_args;
13143                 nfs4_lock_owner_t *lop = resend_rqstp->lr_lop;
13144 
13145                 argop->argop = OP_LOCKU;
13146                 *locku_argsp = locku_args = &argop->nfs_argop4_u.oplocku;
13147                 locku_args->locktype = READ_LT;
13148                 locku_args->seqid = lop->lock_seqid + 1;
13149                 mutex_enter(&lop->lo_lock);
13150                 locku_args->lock_stateid = lop->lock_stateid;
13151                 mutex_exit(&lop->lo_lock);
13152                 locku_args->offset = resend_rqstp->lr_flk->l_start;
13153                 locku_args->length = resend_rqstp->lr_flk->l_len;
13154                 if (locku_args->length == 0)
13155                         locku_args->length = ~locku_args->length;
13156 
13157                 switch (resend_rqstp->lr_ctype) {
13158                 case NFS4_LCK_CTYPE_RESEND:
13159                         argsp->ctag = TAG_LOCKU_RESEND;
13160                         break;
13161                 case NFS4_LCK_CTYPE_REINSTATE:
13162                         argsp->ctag = TAG_LOCKU_REINSTATE;
13163                         break;
13164                 default:
13165                         argsp->ctag = TAG_LOCK_UNKNOWN;
13166                         break;
13167                 }
13168         }
13169 }
13170 
13171 /*
13172  * Setup the LOCKT4 arguments.
13173  */
13174 static void
13175 nfs4frlock_setup_lockt_args(nfs4_lock_call_type_t ctype, nfs_argop4 *argop,
13176     LOCKT4args **lockt_argsp, COMPOUND4args_clnt *argsp, flock64_t *flk,
13177     rnode4_t *rp)
13178 {
13179         LOCKT4args *lockt_args;
13180 
13181         ASSERT(nfs_zone() == VTOMI4(RTOV4(rp))->mi_zone);
13182         ASSERT(ctype == NFS4_LCK_CTYPE_NORM);
13183         argop->argop = OP_LOCKT;
13184         argsp->ctag = TAG_LOCKT;
13185         lockt_args = &argop->nfs_argop4_u.oplockt;
13186 
13187         /*
13188          * The locktype will be READ_LT unless it's
13189          * a write lock. We do this because the Solaris
13190          * system call allows the combination of
13191          * F_UNLCK and F_GETLK* and so in that case the
13192          * unlock is mapped to a read.
13193          */
13194         if (flk->l_type == F_WRLCK)
13195                 lockt_args->locktype = WRITE_LT;
13196         else
13197                 lockt_args->locktype = READ_LT;
13198 
13199         lockt_args->owner.clientid = mi2clientid(VTOMI4(RTOV4(rp)));
13200         /* set the lock owner4 args */
13201         nfs4_setlockowner_args(&lockt_args->owner, rp,
13202             ctype == NFS4_LCK_CTYPE_NORM ? curproc->p_pidp->pid_id :
13203             flk->l_pid);
13204         lockt_args->offset = flk->l_start;
13205         lockt_args->length = flk->l_len;
13206         if (flk->l_len == 0)
13207                 lockt_args->length = ~lockt_args->length;
13208 
13209         *lockt_argsp = lockt_args;
13210 }
13211 
13212 /*
13213  * If the client is holding a delegation, and the open stream to be used
13214  * with this lock request is a delegation open stream, then re-open the stream.
13215  * Sets the nfs4_error_t to all zeros unless the open stream has already
13216  * failed a reopen or we couldn't find the open stream.  NFS4ERR_DELAY
13217  * means the caller should retry (like a recovery retry).
13218  */
13219 static void
13220 nfs4frlock_check_deleg(vnode_t *vp, nfs4_error_t *ep, cred_t *cr, int lt)
13221 {
13222         open_delegation_type4   dt;
13223         bool_t                  reopen_needed, force;
13224         nfs4_open_stream_t      *osp;
13225         open_claim_type4        oclaim;
13226         rnode4_t                *rp = VTOR4(vp);
13227         mntinfo4_t              *mi = VTOMI4(vp);
13228 
13229         ASSERT(nfs_zone() == mi->mi_zone);
13230 
13231         nfs4_error_zinit(ep);
13232 
13233         mutex_enter(&rp->r_statev4_lock);
13234         dt = rp->r_deleg_type;
13235         mutex_exit(&rp->r_statev4_lock);
13236 
13237         if (dt != OPEN_DELEGATE_NONE) {
13238                 nfs4_open_owner_t       *oop;
13239 
13240                 oop = find_open_owner(cr, NFS4_PERM_CREATED, mi);
13241                 if (!oop) {
13242                         ep->stat = NFS4ERR_IO;
13243                         return;
13244                 }
13245                 /* returns with 'os_sync_lock' held */
13246                 osp = find_open_stream(oop, rp);
13247                 if (!osp) {
13248                         open_owner_rele(oop);
13249                         ep->stat = NFS4ERR_IO;
13250                         return;
13251                 }
13252 
13253                 if (osp->os_failed_reopen) {
13254                         NFS4_DEBUG((nfs4_open_stream_debug ||
13255                             nfs4_client_lock_debug), (CE_NOTE,
13256                             "nfs4frlock_check_deleg: os_failed_reopen set "
13257                             "for osp %p, cr %p, rp %s", (void *)osp,
13258                             (void *)cr, rnode4info(rp)));
13259                         mutex_exit(&osp->os_sync_lock);
13260                         open_stream_rele(osp, rp);
13261                         open_owner_rele(oop);
13262                         ep->stat = NFS4ERR_IO;
13263                         return;
13264                 }
13265 
13266                 /*
13267                  * Determine whether a reopen is needed.  If this
13268                  * is a delegation open stream, then send the open
13269                  * to the server to give visibility to the open owner.
13270                  * Even if it isn't a delegation open stream, we need
13271                  * to check if the previous open CLAIM_DELEGATE_CUR
13272                  * was sufficient.
13273                  */
13274 
13275                 reopen_needed = osp->os_delegation ||
13276                     ((lt == F_RDLCK &&
13277                     !(osp->os_dc_openacc & OPEN4_SHARE_ACCESS_READ)) ||
13278                     (lt == F_WRLCK &&
13279                     !(osp->os_dc_openacc & OPEN4_SHARE_ACCESS_WRITE)));
13280 
13281                 mutex_exit(&osp->os_sync_lock);
13282                 open_owner_rele(oop);
13283 
13284                 if (reopen_needed) {
13285                         /*
13286                          * Always use CLAIM_PREVIOUS after server reboot.
13287                          * The server will reject CLAIM_DELEGATE_CUR if
13288                          * it is used during the grace period.
13289                          */
13290                         mutex_enter(&mi->mi_lock);
13291                         if (mi->mi_recovflags & MI4R_SRV_REBOOT) {
13292                                 oclaim = CLAIM_PREVIOUS;
13293                                 force = TRUE;
13294                         } else {
13295                                 oclaim = CLAIM_DELEGATE_CUR;
13296                                 force = FALSE;
13297                         }
13298                         mutex_exit(&mi->mi_lock);
13299 
13300                         nfs4_reopen(vp, osp, ep, oclaim, force, FALSE);
13301                         if (ep->error == EAGAIN) {
13302                                 nfs4_error_zinit(ep);
13303                                 ep->stat = NFS4ERR_DELAY;
13304                         }
13305                 }
13306                 open_stream_rele(osp, rp);
13307                 osp = NULL;
13308         }
13309 }
13310 
13311 /*
13312  * Setup the LOCKU4 arguments.
13313  * Returns errors via the nfs4_error_t.
13314  * NFS4_OK              no problems.  *go_otwp is TRUE if call should go
13315  *                      over-the-wire.  The caller must release the
13316  *                      reference on *lopp.
13317  * NFS4ERR_DELAY        caller should retry (like recovery retry)
13318  * (other)              unrecoverable error.
13319  */
13320 static void
13321 nfs4frlock_setup_locku_args(nfs4_lock_call_type_t ctype, nfs_argop4 *argop,
13322     LOCKU4args **locku_argsp, flock64_t *flk,
13323     nfs4_lock_owner_t **lopp, nfs4_error_t *ep, COMPOUND4args_clnt *argsp,
13324     vnode_t *vp, int flag, u_offset_t offset, cred_t *cr,
13325     bool_t *skip_get_err, bool_t *go_otwp)
13326 {
13327         nfs4_lock_owner_t       *lop = NULL;
13328         LOCKU4args              *locku_args;
13329         pid_t                   pid;
13330         bool_t                  is_spec = FALSE;
13331         rnode4_t                *rp = VTOR4(vp);
13332 
13333         ASSERT(nfs_zone() == VTOMI4(vp)->mi_zone);
13334         ASSERT(ctype == NFS4_LCK_CTYPE_NORM);
13335 
13336         nfs4frlock_check_deleg(vp, ep, cr, F_UNLCK);
13337         if (ep->error || ep->stat)
13338                 return;
13339 
13340         argop->argop = OP_LOCKU;
13341         if (ctype == NFS4_LCK_CTYPE_REINSTATE)
13342                 argsp->ctag = TAG_LOCKU_REINSTATE;
13343         else
13344                 argsp->ctag = TAG_LOCKU;
13345         locku_args = &argop->nfs_argop4_u.oplocku;
13346         *locku_argsp = locku_args;
13347 
13348         /*
13349          * XXX what should locku_args->locktype be?
13350          * setting to ALWAYS be READ_LT so at least
13351          * it is a valid locktype.
13352          */
13353 
13354         locku_args->locktype = READ_LT;
13355 
13356         pid = ctype == NFS4_LCK_CTYPE_NORM ? curproc->p_pidp->pid_id :
13357             flk->l_pid;
13358 
13359         /*
13360          * Get the lock owner stateid.  If no lock owner
13361          * exists, return success.
13362          */
13363         lop = find_lock_owner(rp, pid, LOWN_ANY);
13364         *lopp = lop;
13365         if (lop && CLNT_ISSPECIAL(&lop->lock_stateid))
13366                 is_spec = TRUE;
13367         if (!lop || is_spec) {
13368                 /*
13369                  * No lock owner so no locks to unlock.
13370                  * Return success.  If there was a failed
13371                  * reclaim earlier, the lock might still be
13372                  * registered with the local locking code,
13373                  * so notify it of the unlock.
13374                  *
13375                  * If the lockowner is using a special stateid,
13376                  * then the original lock request (that created
13377                  * this lockowner) was never successful, so we
13378                  * have no lock to undo OTW.
13379                  */
13380                 NFS4_DEBUG(nfs4_client_lock_debug, (CE_NOTE,
13381                     "nfs4frlock_setup_locku_args: LOCKU: no lock owner "
13382                     "(%ld) so return success", (long)pid));
13383 
13384                 if (ctype == NFS4_LCK_CTYPE_NORM)
13385                         flk->l_pid = curproc->p_pid;
13386                 nfs4_register_lock_locally(vp, flk, flag, offset);
13387                 /*
13388                  * Release our hold and NULL out so final_cleanup
13389                  * doesn't try to end a lock seqid sync we
13390                  * never started.
13391                  */
13392                 if (is_spec) {
13393                         lock_owner_rele(lop);
13394                         *lopp = NULL;
13395                 }
13396                 *skip_get_err = TRUE;
13397                 *go_otwp = FALSE;
13398                 return;
13399         }
13400 
13401         ep->error = nfs4_start_lock_seqid_sync(lop, VTOMI4(vp));
13402         if (ep->error == EAGAIN) {
13403                 lock_owner_rele(lop);
13404                 *lopp = NULL;
13405                 return;
13406         }
13407 
13408         mutex_enter(&lop->lo_lock);
13409         locku_args->lock_stateid = lop->lock_stateid;
13410         mutex_exit(&lop->lo_lock);
13411         locku_args->seqid = lop->lock_seqid + 1;
13412 
13413         /* leave the ref count on lop, rele after RPC call */
13414 
13415         locku_args->offset = flk->l_start;
13416         locku_args->length = flk->l_len;
13417         if (flk->l_len == 0)
13418                 locku_args->length = ~locku_args->length;
13419 
13420         *go_otwp = TRUE;
13421 }
13422 
13423 /*
13424  * Setup the LOCK4 arguments.
13425  *
13426  * Returns errors via the nfs4_error_t.
13427  * NFS4_OK              no problems
13428  * NFS4ERR_DELAY        caller should retry (like recovery retry)
13429  * (other)              unrecoverable error
13430  */
13431 static void
13432 nfs4frlock_setup_lock_args(nfs4_lock_call_type_t ctype, LOCK4args **lock_argsp,
13433     nfs4_open_owner_t **oopp, nfs4_open_stream_t **ospp,
13434     nfs4_lock_owner_t **lopp, nfs_argop4 *argop, COMPOUND4args_clnt *argsp,
13435     flock64_t *flk, int cmd, vnode_t *vp, cred_t *cr, nfs4_error_t *ep)
13436 {
13437         LOCK4args               *lock_args;
13438         nfs4_open_owner_t       *oop = NULL;
13439         nfs4_open_stream_t      *osp = NULL;
13440         nfs4_lock_owner_t       *lop = NULL;
13441         pid_t                   pid;
13442         rnode4_t                *rp = VTOR4(vp);
13443 
13444         ASSERT(nfs_zone() == VTOMI4(vp)->mi_zone);
13445 
13446         nfs4frlock_check_deleg(vp, ep, cr, flk->l_type);
13447         if (ep->error || ep->stat != NFS4_OK)
13448                 return;
13449 
13450         argop->argop = OP_LOCK;
13451         if (ctype == NFS4_LCK_CTYPE_NORM)
13452                 argsp->ctag = TAG_LOCK;
13453         else if (ctype == NFS4_LCK_CTYPE_RECLAIM)
13454                 argsp->ctag = TAG_RELOCK;
13455         else
13456                 argsp->ctag = TAG_LOCK_REINSTATE;
13457         lock_args = &argop->nfs_argop4_u.oplock;
13458         lock_args->locktype = flk_to_locktype(cmd, flk->l_type);
13459         lock_args->reclaim = ctype == NFS4_LCK_CTYPE_RECLAIM ? 1 : 0;
13460         /*
13461          * Get the lock owner.  If no lock owner exists,
13462          * create a 'temporary' one and grab the open seqid
13463          * synchronization (which puts a hold on the open
13464          * owner and open stream).
13465          * This also grabs the lock seqid synchronization.
13466          */
13467         pid = ctype == NFS4_LCK_CTYPE_NORM ? curproc->p_pid : flk->l_pid;
13468         ep->stat =
13469             nfs4_find_or_create_lock_owner(pid, rp, cr, &oop, &osp, &lop);
13470 
13471         if (ep->stat != NFS4_OK)
13472                 goto out;
13473 
13474         nfs4_setup_lock_args(lop, oop, osp, mi2clientid(VTOMI4(vp)),
13475             &lock_args->locker);
13476 
13477         lock_args->offset = flk->l_start;
13478         lock_args->length = flk->l_len;
13479         if (flk->l_len == 0)
13480                 lock_args->length = ~lock_args->length;
13481         *lock_argsp = lock_args;
13482 out:
13483         *oopp = oop;
13484         *ospp = osp;
13485         *lopp = lop;
13486 }
13487 
13488 /*
13489  * After we get the reply from the server, record the proper information
13490  * for possible resend lock requests.
13491  *
13492  * Allocates memory for the saved_rqstp if we have a lost lock to save.
13493  */
13494 static void
13495 nfs4frlock_save_lost_rqst(nfs4_lock_call_type_t ctype, int error,
13496     nfs_lock_type4 locktype, nfs4_open_owner_t *oop,
13497     nfs4_open_stream_t *osp, nfs4_lock_owner_t *lop, flock64_t *flk,
13498     nfs4_lost_rqst_t *lost_rqstp, cred_t *cr, vnode_t *vp)
13499 {
13500         bool_t unlock = (flk->l_type == F_UNLCK);
13501 
13502         ASSERT(nfs_zone() == VTOMI4(vp)->mi_zone);
13503         ASSERT(ctype == NFS4_LCK_CTYPE_NORM ||
13504             ctype == NFS4_LCK_CTYPE_REINSTATE);
13505 
13506         if (error != 0 && !unlock) {
13507                 NFS4_DEBUG((nfs4_lost_rqst_debug ||
13508                     nfs4_client_lock_debug), (CE_NOTE,
13509                     "nfs4frlock_save_lost_rqst: set lo_pending_rqsts to 1 "
13510                     " for lop %p", (void *)lop));
13511                 ASSERT(lop != NULL);
13512                 mutex_enter(&lop->lo_lock);
13513                 lop->lo_pending_rqsts = 1;
13514                 mutex_exit(&lop->lo_lock);
13515         }
13516 
13517         lost_rqstp->lr_putfirst = FALSE;
13518         lost_rqstp->lr_op = 0;
13519 
13520         /*
13521          * For lock/locku requests, we treat EINTR as ETIMEDOUT for
13522          * recovery purposes so that the lock request that was sent
13523          * can be saved and re-issued later.  Ditto for EIO from a forced
13524          * unmount.  This is done to have the client's local locking state
13525          * match the v4 server's state; that is, the request was
13526          * potentially received and accepted by the server but the client
13527          * thinks it was not.
13528          */
13529         if (error == ETIMEDOUT || error == EINTR ||
13530             NFS4_FRC_UNMT_ERR(error, vp->v_vfsp)) {
13531                 NFS4_DEBUG((nfs4_lost_rqst_debug ||
13532                     nfs4_client_lock_debug), (CE_NOTE,
13533                     "nfs4frlock_save_lost_rqst: got a lost %s lock for "
13534                     "lop %p oop %p osp %p", unlock ? "LOCKU" : "LOCK",
13535                     (void *)lop, (void *)oop, (void *)osp));
13536                 if (unlock)
13537                         lost_rqstp->lr_op = OP_LOCKU;
13538                 else {
13539                         lost_rqstp->lr_op = OP_LOCK;
13540                         lost_rqstp->lr_locktype = locktype;
13541                 }
13542                 /*
13543                  * Objects are held and rele'd via the recovery code.
13544                  * See nfs4_save_lost_rqst.
13545                  */
13546                 lost_rqstp->lr_vp = vp;
13547                 lost_rqstp->lr_dvp = NULL;
13548                 lost_rqstp->lr_oop = oop;
13549                 lost_rqstp->lr_osp = osp;
13550                 lost_rqstp->lr_lop = lop;
13551                 lost_rqstp->lr_cr = cr;
13552                 switch (ctype) {
13553                 case NFS4_LCK_CTYPE_NORM:
13554                         flk->l_pid = ttoproc(curthread)->p_pid;
13555                         lost_rqstp->lr_ctype = NFS4_LCK_CTYPE_RESEND;
13556                         break;
13557                 case NFS4_LCK_CTYPE_REINSTATE:
13558                         lost_rqstp->lr_putfirst = TRUE;
13559                         lost_rqstp->lr_ctype = ctype;
13560                         break;
13561                 default:
13562                         break;
13563                 }
13564                 lost_rqstp->lr_flk = flk;
13565         }
13566 }
13567 
13568 /*
13569  * Update lop's seqid.  Also update the seqid stored in a resend request,
13570  * if any.  (Some recovery errors increment the seqid, and we may have to
13571  * send the resend request again.)
13572  */
13573 
13574 static void
13575 nfs4frlock_bump_seqid(LOCK4args *lock_args, LOCKU4args *locku_args,
13576     nfs4_open_owner_t *oop, nfs4_lock_owner_t *lop, nfs4_tag_type_t tag_type)
13577 {
13578         if (lock_args) {
13579                 if (lock_args->locker.new_lock_owner == TRUE)
13580                         nfs4_get_and_set_next_open_seqid(oop, tag_type);
13581                 else {
13582                         ASSERT(lop->lo_flags & NFS4_LOCK_SEQID_INUSE);
13583                         nfs4_set_lock_seqid(lop->lock_seqid + 1, lop);
13584                 }
13585         } else if (locku_args) {
13586                 ASSERT(lop->lo_flags & NFS4_LOCK_SEQID_INUSE);
13587                 nfs4_set_lock_seqid(lop->lock_seqid +1, lop);
13588         }
13589 }
13590 
13591 /*
13592  * Calls nfs4_end_fop, drops the seqid syncs, and frees up the
13593  * COMPOUND4 args/res for calls that need to retry.
13594  * Switches the *cred_otwp to base_cr.
13595  */
13596 static void
13597 nfs4frlock_check_access(vnode_t *vp, nfs4_op_hint_t op_hint,
13598     nfs4_recov_state_t *recov_statep, int needrecov, bool_t *did_start_fop,
13599     COMPOUND4args_clnt **argspp, COMPOUND4res_clnt **respp, int error,
13600     nfs4_lock_owner_t **lopp, nfs4_open_owner_t **oopp,
13601     nfs4_open_stream_t **ospp, cred_t *base_cr, cred_t **cred_otwp)
13602 {
13603         nfs4_open_owner_t       *oop = *oopp;
13604         nfs4_open_stream_t      *osp = *ospp;
13605         nfs4_lock_owner_t       *lop = *lopp;
13606         nfs_argop4              *argop = (*argspp)->array;
13607 
13608         if (*did_start_fop) {
13609                 nfs4_end_fop(VTOMI4(vp), vp, NULL, op_hint, recov_statep,
13610                     needrecov);
13611                 *did_start_fop = FALSE;
13612         }
13613         ASSERT((*argspp)->array_len == 2);
13614         if (argop[1].argop == OP_LOCK)
13615                 nfs4args_lock_free(&argop[1]);
13616         else if (argop[1].argop == OP_LOCKT)
13617                 nfs4args_lockt_free(&argop[1]);
13618         kmem_free(argop, 2 * sizeof (nfs_argop4));
13619         if (!error)
13620                 (void) xdr_free(xdr_COMPOUND4res_clnt, (caddr_t)*respp);
13621         *argspp = NULL;
13622         *respp = NULL;
13623 
13624         if (lop) {
13625                 nfs4_end_lock_seqid_sync(lop);
13626                 lock_owner_rele(lop);
13627                 *lopp = NULL;
13628         }
13629 
13630         /* need to free up the reference on osp for lock args */
13631         if (osp != NULL) {
13632                 open_stream_rele(osp, VTOR4(vp));
13633                 *ospp = NULL;
13634         }
13635 
13636         /* need to free up the reference on oop for lock args */
13637         if (oop != NULL) {
13638                 nfs4_end_open_seqid_sync(oop);
13639                 open_owner_rele(oop);
13640                 *oopp = NULL;
13641         }
13642 
13643         crfree(*cred_otwp);
13644         *cred_otwp = base_cr;
13645         crhold(*cred_otwp);
13646 }
13647 
13648 /*
13649  * Function to process the client's recovery for nfs4frlock.
13650  * Returns TRUE if we should retry the lock request; FALSE otherwise.
13651  *
13652  * Calls nfs4_end_fop, drops the seqid syncs, and frees up the
13653  * COMPOUND4 args/res for calls that need to retry.
13654  *
13655  * Note: the rp's r_lkserlock is *not* dropped during this path.
13656  */
13657 static bool_t
13658 nfs4frlock_recovery(int needrecov, nfs4_error_t *ep,
13659     COMPOUND4args_clnt **argspp, COMPOUND4res_clnt **respp,
13660     LOCK4args *lock_args, LOCKU4args *locku_args,
13661     nfs4_open_owner_t **oopp, nfs4_open_stream_t **ospp,
13662     nfs4_lock_owner_t **lopp, rnode4_t *rp, vnode_t *vp,
13663     nfs4_recov_state_t *recov_statep, nfs4_op_hint_t op_hint,
13664     bool_t *did_start_fop, nfs4_lost_rqst_t *lost_rqstp, flock64_t *flk)
13665 {
13666         nfs4_open_owner_t       *oop = *oopp;
13667         nfs4_open_stream_t      *osp = *ospp;
13668         nfs4_lock_owner_t       *lop = *lopp;
13669 
13670         bool_t abort, retry;
13671 
13672         ASSERT(nfs_zone() == VTOMI4(vp)->mi_zone);
13673         ASSERT((*argspp) != NULL);
13674         ASSERT((*respp) != NULL);
13675         if (lock_args || locku_args)
13676                 ASSERT(lop != NULL);
13677 
13678         NFS4_DEBUG((nfs4_client_lock_debug || nfs4_client_recov_debug),
13679             (CE_NOTE, "nfs4frlock_recovery: initiating recovery\n"));
13680 
13681         retry = TRUE;
13682         abort = FALSE;
13683         if (needrecov) {
13684                 nfs4_bseqid_entry_t *bsep = NULL;
13685                 nfs_opnum4 op;
13686 
13687                 op = lock_args ? OP_LOCK : locku_args ? OP_LOCKU : OP_LOCKT;
13688 
13689                 if (!ep->error && ep->stat == NFS4ERR_BAD_SEQID) {
13690                         seqid4 seqid;
13691 
13692                         if (lock_args) {
13693                                 if (lock_args->locker.new_lock_owner == TRUE)
13694                                         seqid = lock_args->locker.locker4_u.
13695                                             open_owner.open_seqid;
13696                                 else
13697                                         seqid = lock_args->locker.locker4_u.
13698                                             lock_owner.lock_seqid;
13699                         } else if (locku_args) {
13700                                 seqid = locku_args->seqid;
13701                         } else {
13702                                 seqid = 0;
13703                         }
13704 
13705                         bsep = nfs4_create_bseqid_entry(oop, lop, vp,
13706                             flk->l_pid, (*argspp)->ctag, seqid);
13707                 }
13708 
13709                 abort = nfs4_start_recovery(ep, VTOMI4(vp), vp, NULL, NULL,
13710                     (lost_rqstp && (lost_rqstp->lr_op == OP_LOCK ||
13711                     lost_rqstp->lr_op == OP_LOCKU)) ? lost_rqstp :
13712                     NULL, op, bsep, NULL, NULL);
13713 
13714                 if (bsep)
13715                         kmem_free(bsep, sizeof (*bsep));
13716         }
13717 
13718         /*
13719          * Return that we do not want to retry the request for 3 cases:
13720          * 1. If we received EINTR or are bailing out because of a forced
13721          *    unmount, we came into this code path just for the sake of
13722          *    initiating recovery, we now need to return the error.
13723          * 2. If we have aborted recovery.
13724          * 3. We received NFS4ERR_BAD_SEQID.
13725          */
13726         if (ep->error == EINTR || NFS4_FRC_UNMT_ERR(ep->error, vp->v_vfsp) ||
13727             abort == TRUE || (ep->error == 0 && ep->stat == NFS4ERR_BAD_SEQID))
13728                 retry = FALSE;
13729 
13730         if (*did_start_fop == TRUE) {
13731                 nfs4_end_fop(VTOMI4(vp), vp, NULL, op_hint, recov_statep,
13732                     needrecov);
13733                 *did_start_fop = FALSE;
13734         }
13735 
13736         if (retry == TRUE) {
13737                 nfs_argop4      *argop;
13738 
13739                 argop = (*argspp)->array;
13740                 ASSERT((*argspp)->array_len == 2);
13741 
13742                 if (argop[1].argop == OP_LOCK)
13743                         nfs4args_lock_free(&argop[1]);
13744                 else if (argop[1].argop == OP_LOCKT)
13745                         nfs4args_lockt_free(&argop[1]);
13746                 kmem_free(argop, 2 * sizeof (nfs_argop4));
13747                 if (!ep->error)
13748                         (void) xdr_free(xdr_COMPOUND4res_clnt, (caddr_t)*respp);
13749                 *respp = NULL;
13750                 *argspp = NULL;
13751         }
13752 
13753         if (lop != NULL) {
13754                 nfs4_end_lock_seqid_sync(lop);
13755                 lock_owner_rele(lop);
13756         }
13757 
13758         *lopp = NULL;
13759 
13760         /* need to free up the reference on osp for lock args */
13761         if (osp != NULL) {
13762                 open_stream_rele(osp, rp);
13763                 *ospp = NULL;
13764         }
13765 
13766         /* need to free up the reference on oop for lock args */
13767         if (oop != NULL) {
13768                 nfs4_end_open_seqid_sync(oop);
13769                 open_owner_rele(oop);
13770                 *oopp = NULL;
13771         }
13772 
13773         return (retry);
13774 }
13775 
13776 /*
13777  * Handles the successful reply from the server for nfs4frlock.
13778  */
13779 static void
13780 nfs4frlock_results_ok(nfs4_lock_call_type_t ctype, int cmd, flock64_t *flk,
13781     vnode_t *vp, int flag, u_offset_t offset,
13782     nfs4_lost_rqst_t *resend_rqstp)
13783 {
13784         ASSERT(nfs_zone() == VTOMI4(vp)->mi_zone);
13785         if ((cmd == F_SETLK || cmd == F_SETLKW) &&
13786             (flk->l_type == F_RDLCK || flk->l_type == F_WRLCK)) {
13787                 if (ctype == NFS4_LCK_CTYPE_NORM) {
13788                         flk->l_pid = ttoproc(curthread)->p_pid;
13789                         /*
13790                          * We do not register lost locks locally in
13791                          * the 'resend' case since the user/application
13792                          * doesn't think we have the lock.
13793                          */
13794                         ASSERT(!resend_rqstp);
13795                         nfs4_register_lock_locally(vp, flk, flag, offset);
13796                 }
13797         }
13798 }
13799 
13800 /*
13801  * Handle the DENIED reply from the server for nfs4frlock.
13802  * Returns TRUE if we should retry the request; FALSE otherwise.
13803  *
13804  * Calls nfs4_end_fop, drops the seqid syncs, and frees up the
13805  * COMPOUND4 args/res for calls that need to retry.  Can also
13806  * drop and regrab the r_lkserlock.
13807  */
13808 static bool_t
13809 nfs4frlock_results_denied(nfs4_lock_call_type_t ctype, LOCK4args *lock_args,
13810     LOCKT4args *lockt_args, nfs4_open_owner_t **oopp,
13811     nfs4_open_stream_t **ospp, nfs4_lock_owner_t **lopp, int cmd,
13812     vnode_t *vp, flock64_t *flk, nfs4_op_hint_t op_hint,
13813     nfs4_recov_state_t *recov_statep, int needrecov,
13814     COMPOUND4args_clnt **argspp, COMPOUND4res_clnt **respp,
13815     clock_t *tick_delayp, short *whencep, int *errorp,
13816     nfs_resop4 *resop, cred_t *cr, bool_t *did_start_fop,
13817     bool_t *skip_get_err)
13818 {
13819         ASSERT(nfs_zone() == VTOMI4(vp)->mi_zone);
13820 
13821         if (lock_args) {
13822                 nfs4_open_owner_t       *oop = *oopp;
13823                 nfs4_open_stream_t      *osp = *ospp;
13824                 nfs4_lock_owner_t       *lop = *lopp;
13825                 int                     intr;
13826 
13827                 /*
13828                  * Blocking lock needs to sleep and retry from the request.
13829                  *
13830                  * Do not block and wait for 'resend' or 'reinstate'
13831                  * lock requests, just return the error.
13832                  *
13833                  * Note: reclaim requests have cmd == F_SETLK, not F_SETLKW.
13834                  */
13835                 if (cmd == F_SETLKW) {
13836                         rnode4_t *rp = VTOR4(vp);
13837                         nfs_argop4 *argop = (*argspp)->array;
13838 
13839                         ASSERT(ctype == NFS4_LCK_CTYPE_NORM);
13840 
13841                         nfs4_end_fop(VTOMI4(vp), vp, NULL, op_hint,
13842                             recov_statep, needrecov);
13843                         *did_start_fop = FALSE;
13844                         ASSERT((*argspp)->array_len == 2);
13845                         if (argop[1].argop == OP_LOCK)
13846                                 nfs4args_lock_free(&argop[1]);
13847                         else if (argop[1].argop == OP_LOCKT)
13848                                 nfs4args_lockt_free(&argop[1]);
13849                         kmem_free(argop, 2 * sizeof (nfs_argop4));
13850                         if (*respp)
13851                                 (void) xdr_free(xdr_COMPOUND4res_clnt,
13852                                     (caddr_t)*respp);
13853                         *argspp = NULL;
13854                         *respp = NULL;
13855                         nfs4_end_lock_seqid_sync(lop);
13856                         lock_owner_rele(lop);
13857                         *lopp = NULL;
13858                         if (osp != NULL) {
13859                                 open_stream_rele(osp, rp);
13860                                 *ospp = NULL;
13861                         }
13862                         if (oop != NULL) {
13863                                 nfs4_end_open_seqid_sync(oop);
13864                                 open_owner_rele(oop);
13865                                 *oopp = NULL;
13866                         }
13867 
13868                         nfs_rw_exit(&rp->r_lkserlock);
13869 
13870                         intr = nfs4_block_and_wait(tick_delayp, rp);
13871 
13872                         if (intr) {
13873                                 (void) nfs_rw_enter_sig(&rp->r_lkserlock,
13874                                     RW_WRITER, FALSE);
13875                                 *errorp = EINTR;
13876                                 return (FALSE);
13877                         }
13878 
13879                         (void) nfs_rw_enter_sig(&rp->r_lkserlock,
13880                             RW_WRITER, FALSE);
13881 
13882                         /*
13883                          * Make sure we are still safe to lock with
13884                          * regards to mmapping.
13885                          */
13886                         if (!nfs4_safelock(vp, flk, cr)) {
13887                                 *errorp = EAGAIN;
13888                                 return (FALSE);
13889                         }
13890 
13891                         return (TRUE);
13892                 }
13893                 if (ctype == NFS4_LCK_CTYPE_NORM)
13894                         *errorp = EAGAIN;
13895                 *skip_get_err = TRUE;
13896                 flk->l_whence = 0;
13897                 *whencep = 0;
13898                 return (FALSE);
13899         } else if (lockt_args) {
13900                 NFS4_DEBUG(nfs4_client_lock_debug, (CE_NOTE,
13901                     "nfs4frlock_results_denied: OP_LOCKT DENIED"));
13902 
13903                 denied_to_flk(&resop->nfs_resop4_u.oplockt.denied,
13904                     flk, lockt_args);
13905 
13906                 /* according to NLM code */
13907                 *errorp = 0;
13908                 *whencep = 0;
13909                 *skip_get_err = TRUE;
13910                 return (FALSE);
13911         }
13912         return (FALSE);
13913 }
13914 
13915 /*
13916  * Handles all NFS4 errors besides NFS4_OK and NFS4ERR_DENIED for nfs4frlock.
13917  */
13918 static void
13919 nfs4frlock_results_default(COMPOUND4res_clnt *resp, int *errorp)
13920 {
13921         switch (resp->status) {
13922         case NFS4ERR_ACCESS:
13923         case NFS4ERR_ADMIN_REVOKED:
13924         case NFS4ERR_BADHANDLE:
13925         case NFS4ERR_BAD_RANGE:
13926         case NFS4ERR_BAD_SEQID:
13927         case NFS4ERR_BAD_STATEID:
13928         case NFS4ERR_BADXDR:
13929         case NFS4ERR_DEADLOCK:
13930         case NFS4ERR_DELAY:
13931         case NFS4ERR_EXPIRED:
13932         case NFS4ERR_FHEXPIRED:
13933         case NFS4ERR_GRACE:
13934         case NFS4ERR_INVAL:
13935         case NFS4ERR_ISDIR:
13936         case NFS4ERR_LEASE_MOVED:
13937         case NFS4ERR_LOCK_NOTSUPP:
13938         case NFS4ERR_LOCK_RANGE:
13939         case NFS4ERR_MOVED:
13940         case NFS4ERR_NOFILEHANDLE:
13941         case NFS4ERR_NO_GRACE:
13942         case NFS4ERR_OLD_STATEID:
13943         case NFS4ERR_OPENMODE:
13944         case NFS4ERR_RECLAIM_BAD:
13945         case NFS4ERR_RECLAIM_CONFLICT:
13946         case NFS4ERR_RESOURCE:
13947         case NFS4ERR_SERVERFAULT:
13948         case NFS4ERR_STALE:
13949         case NFS4ERR_STALE_CLIENTID:
13950         case NFS4ERR_STALE_STATEID:
13951                 return;
13952         default:
13953                 NFS4_DEBUG(nfs4_client_lock_debug, (CE_NOTE,
13954                     "nfs4frlock_results_default: got unrecognizable "
13955                     "res.status %d", resp->status));
13956                 *errorp = NFS4ERR_INVAL;
13957         }
13958 }
13959 
13960 /*
13961  * The lock request was successful, so update the client's state.
13962  */
13963 static void
13964 nfs4frlock_update_state(LOCK4args *lock_args, LOCKU4args *locku_args,
13965     LOCKT4args *lockt_args, nfs_resop4 *resop, nfs4_lock_owner_t *lop,
13966     vnode_t *vp, flock64_t *flk, cred_t *cr,
13967     nfs4_lost_rqst_t *resend_rqstp)
13968 {
13969         ASSERT(nfs_zone() == VTOMI4(vp)->mi_zone);
13970 
13971         if (lock_args) {
13972                 LOCK4res *lock_res;
13973 
13974                 lock_res = &resop->nfs_resop4_u.oplock;
13975                 /* update the stateid with server's response */
13976 
13977                 if (lock_args->locker.new_lock_owner == TRUE) {
13978                         mutex_enter(&lop->lo_lock);
13979                         lop->lo_just_created = NFS4_PERM_CREATED;
13980                         mutex_exit(&lop->lo_lock);
13981                 }
13982 
13983                 nfs4_set_lock_stateid(lop, lock_res->LOCK4res_u.lock_stateid);
13984 
13985                 /*
13986                  * If the lock was the result of a resending a lost
13987                  * request, we've synched up the stateid and seqid
13988                  * with the server, but now the server might be out of sync
13989                  * with what the application thinks it has for locks.
13990                  * Clean that up here.  It's unclear whether we should do
13991                  * this even if the filesystem has been forcibly unmounted.
13992                  * For most servers, it's probably wasted effort, but
13993                  * RFC3530 lets servers require that unlocks exactly match
13994                  * the locks that are held.
13995                  */
13996                 if (resend_rqstp != NULL &&
13997                     resend_rqstp->lr_ctype != NFS4_LCK_CTYPE_REINSTATE) {
13998                         nfs4_reinstitute_local_lock_state(vp, flk, cr, lop);
13999                 } else {
14000                         flk->l_whence = 0;
14001                 }
14002         } else if (locku_args) {
14003                 LOCKU4res *locku_res;
14004 
14005                 locku_res = &resop->nfs_resop4_u.oplocku;
14006 
14007                 /* Update the stateid with the server's response */
14008                 nfs4_set_lock_stateid(lop, locku_res->lock_stateid);
14009         } else if (lockt_args) {
14010                 /* Switch the lock type to express success, see fcntl */
14011                 flk->l_type = F_UNLCK;
14012                 flk->l_whence = 0;
14013         }
14014 }
14015 
14016 /*
14017  * Do final cleanup before exiting nfs4frlock.
14018  * Calls nfs4_end_fop, drops the seqid syncs, and frees up the
14019  * COMPOUND4 args/res for calls that haven't already.
14020  */
14021 static void
14022 nfs4frlock_final_cleanup(nfs4_lock_call_type_t ctype, COMPOUND4args_clnt *argsp,
14023     COMPOUND4res_clnt *resp, vnode_t *vp, nfs4_op_hint_t op_hint,
14024     nfs4_recov_state_t *recov_statep, int needrecov, nfs4_open_owner_t *oop,
14025     nfs4_open_stream_t *osp, nfs4_lock_owner_t *lop, flock64_t *flk,
14026     short whence, u_offset_t offset, struct lm_sysid *ls,
14027     int *errorp, LOCK4args *lock_args, LOCKU4args *locku_args,
14028     bool_t did_start_fop, bool_t skip_get_err,
14029     cred_t *cred_otw, cred_t *cred)
14030 {
14031         mntinfo4_t      *mi = VTOMI4(vp);
14032         rnode4_t        *rp = VTOR4(vp);
14033         int             error = *errorp;
14034         nfs_argop4      *argop;
14035         int     do_flush_pages = 0;
14036 
14037         ASSERT(nfs_zone() == mi->mi_zone);
14038         /*
14039          * The client recovery code wants the raw status information,
14040          * so don't map the NFS status code to an errno value for
14041          * non-normal call types.
14042          */
14043         if (ctype == NFS4_LCK_CTYPE_NORM) {
14044                 if (*errorp == 0 && resp != NULL && skip_get_err == FALSE)
14045                         *errorp = geterrno4(resp->status);
14046                 if (did_start_fop == TRUE)
14047                         nfs4_end_fop(mi, vp, NULL, op_hint, recov_statep,
14048                             needrecov);
14049 
14050                 /*
14051                  * We've established a new lock on the server, so invalidate
14052                  * the pages associated with the vnode to get the most up to
14053                  * date pages from the server after acquiring the lock. We
14054                  * want to be sure that the read operation gets the newest data.
14055                  * N.B.
14056                  * We used to do this in nfs4frlock_results_ok but that doesn't
14057                  * work since VOP_PUTPAGE can call nfs4_commit which calls
14058                  * nfs4_start_fop. We flush the pages below after calling
14059                  * nfs4_end_fop above
14060                  * The flush of the page cache must be done after
14061                  * nfs4_end_open_seqid_sync() to avoid a 4-way hang.
14062                  */
14063                 if (!error && resp && resp->status == NFS4_OK)
14064                         do_flush_pages = 1;
14065         }
14066         if (argsp) {
14067                 ASSERT(argsp->array_len == 2);
14068                 argop = argsp->array;
14069                 if (argop[1].argop == OP_LOCK)
14070                         nfs4args_lock_free(&argop[1]);
14071                 else if (argop[1].argop == OP_LOCKT)
14072                         nfs4args_lockt_free(&argop[1]);
14073                 kmem_free(argop, 2 * sizeof (nfs_argop4));
14074                 if (resp)
14075                         (void) xdr_free(xdr_COMPOUND4res_clnt, (caddr_t)resp);
14076         }
14077 
14078         /* free the reference on the lock owner */
14079         if (lop != NULL) {
14080                 nfs4_end_lock_seqid_sync(lop);
14081                 lock_owner_rele(lop);
14082         }
14083 
14084         /* need to free up the reference on osp for lock args */
14085         if (osp != NULL)
14086                 open_stream_rele(osp, rp);
14087 
14088         /* need to free up the reference on oop for lock args */
14089         if (oop != NULL) {
14090                 nfs4_end_open_seqid_sync(oop);
14091                 open_owner_rele(oop);
14092         }
14093 
14094         if (do_flush_pages)
14095                 nfs4_flush_pages(vp, cred);
14096 
14097         (void) convoff(vp, flk, whence, offset);
14098 
14099         lm_rel_sysid(ls);
14100 
14101         /*
14102          * Record debug information in the event we get EINVAL.
14103          */
14104         mutex_enter(&mi->mi_lock);
14105         if (*errorp == EINVAL && (lock_args || locku_args) &&
14106             (!(mi->mi_flags & MI4_POSIX_LOCK))) {
14107                 if (!(mi->mi_flags & MI4_LOCK_DEBUG)) {
14108                         zcmn_err(getzoneid(), CE_NOTE,
14109                             "%s operation failed with "
14110                             "EINVAL probably since the server, %s,"
14111                             " doesn't support POSIX style locking",
14112                             lock_args ? "LOCK" : "LOCKU",
14113                             mi->mi_curr_serv->sv_hostname);
14114                         mi->mi_flags |= MI4_LOCK_DEBUG;
14115                 }
14116         }
14117         mutex_exit(&mi->mi_lock);
14118 
14119         if (cred_otw)
14120                 crfree(cred_otw);
14121 }
14122 
14123 /*
14124  * This calls the server and the local locking code.
14125  *
14126  * Client locks are registerred locally by oring the sysid with
14127  * LM_SYSID_CLIENT. The server registers locks locally using just the sysid.
14128  * We need to distinguish between the two to avoid collision in case one
14129  * machine is used as both client and server.
14130  *
14131  * Blocking lock requests will continually retry to acquire the lock
14132  * forever.
14133  *
14134  * The ctype is defined as follows:
14135  * NFS4_LCK_CTYPE_NORM: normal lock request.
14136  *
14137  * NFS4_LCK_CTYPE_RECLAIM:  bypass the usual calls for synchronizing with client
14138  * recovery, get the pid from flk instead of curproc, and don't reregister
14139  * the lock locally.
14140  *
14141  * NFS4_LCK_CTYPE_RESEND: same as NFS4_LCK_CTYPE_RECLAIM, with the addition
14142  * that we will use the information passed in via resend_rqstp to setup the
14143  * lock/locku request.  This resend is the exact same request as the 'lost
14144  * lock', and is initiated by the recovery framework. A successful resend
14145  * request can initiate one or more reinstate requests.
14146  *
14147  * NFS4_LCK_CTYPE_REINSTATE: same as NFS4_LCK_CTYPE_RESEND, except that it
14148  * does not trigger additional reinstate requests.  This lock call type is
14149  * set for setting the v4 server's locking state back to match what the
14150  * client's local locking state is in the event of a received 'lost lock'.
14151  *
14152  * Errors are returned via the nfs4_error_t parameter.
14153  */
14154 void
14155 nfs4frlock(nfs4_lock_call_type_t ctype, vnode_t *vp, int cmd, flock64_t *flk,
14156     int flag, u_offset_t offset, cred_t *cr, nfs4_error_t *ep,
14157     nfs4_lost_rqst_t *resend_rqstp, int *did_reclaimp)
14158 {
14159         COMPOUND4args_clnt      args, *argsp = NULL;
14160         COMPOUND4res_clnt       res, *resp = NULL;
14161         nfs_argop4      *argop;
14162         nfs_resop4      *resop;
14163         rnode4_t        *rp;
14164         int             doqueue = 1;
14165         clock_t         tick_delay;  /* delay in clock ticks */
14166         struct lm_sysid *ls;
14167         LOCK4args       *lock_args = NULL;
14168         LOCKU4args      *locku_args = NULL;
14169         LOCKT4args      *lockt_args = NULL;
14170         nfs4_open_owner_t *oop = NULL;
14171         nfs4_open_stream_t *osp = NULL;
14172         nfs4_lock_owner_t *lop = NULL;
14173         bool_t          needrecov = FALSE;
14174         nfs4_recov_state_t recov_state;
14175         short           whence;
14176         nfs4_op_hint_t  op_hint;
14177         nfs4_lost_rqst_t lost_rqst;
14178         bool_t          retry = FALSE;
14179         bool_t          did_start_fop = FALSE;
14180         bool_t          skip_get_err = FALSE;
14181         cred_t          *cred_otw = NULL;
14182         bool_t          recovonly;      /* just queue request */
14183         int             frc_no_reclaim = 0;
14184 #ifdef DEBUG
14185         char *name;
14186 #endif
14187 
14188         ASSERT(nfs_zone() == VTOMI4(vp)->mi_zone);
14189 
14190 #ifdef DEBUG
14191         name = fn_name(VTOSV(vp)->sv_name);
14192         NFS4_DEBUG(nfs4_client_lock_debug, (CE_NOTE, "nfs4frlock: "
14193             "%s: cmd %d, type %d, offset %llu, start %"PRIx64", "
14194             "length %"PRIu64", pid %d, sysid %d, call type %s, "
14195             "resend request %s", name, cmd, flk->l_type, offset, flk->l_start,
14196             flk->l_len, ctype == NFS4_LCK_CTYPE_NORM ? curproc->p_pid :
14197             flk->l_pid, flk->l_sysid, nfs4frlock_get_call_type(ctype),
14198             resend_rqstp ? "TRUE" : "FALSE"));
14199         kmem_free(name, MAXNAMELEN);
14200 #endif
14201 
14202         nfs4_error_zinit(ep);
14203         ep->error = nfs4frlock_validate_args(cmd, flk, flag, vp, offset);
14204         if (ep->error)
14205                 return;
14206         ep->error = nfs4frlock_get_sysid(&ls, vp, flk);
14207         if (ep->error)
14208                 return;
14209         nfs4frlock_pre_setup(&tick_delay, &recov_state, flk, &whence,
14210             vp, cr, &cred_otw);
14211 
14212 recov_retry:
14213         nfs4frlock_call_init(&args, &argsp, &argop, &op_hint, flk, cmd,
14214             &retry, &did_start_fop, &resp, &skip_get_err, &lost_rqst);
14215         rp = VTOR4(vp);
14216 
14217         ep->error = nfs4frlock_start_call(ctype, vp, op_hint, &recov_state,
14218             &did_start_fop, &recovonly);
14219 
14220         if (ep->error)
14221                 goto out;
14222 
14223         if (recovonly) {
14224                 /*
14225                  * Leave the request for the recovery system to deal with.
14226                  */
14227                 ASSERT(ctype == NFS4_LCK_CTYPE_NORM);
14228                 ASSERT(cmd != F_GETLK);
14229                 ASSERT(flk->l_type == F_UNLCK);
14230 
14231                 nfs4_error_init(ep, EINTR);
14232                 needrecov = TRUE;
14233                 lop = find_lock_owner(rp, curproc->p_pid, LOWN_ANY);
14234                 if (lop != NULL) {
14235                         nfs4frlock_save_lost_rqst(ctype, ep->error, READ_LT,
14236                             NULL, NULL, lop, flk, &lost_rqst, cr, vp);
14237                         (void) nfs4_start_recovery(ep,
14238                             VTOMI4(vp), vp, NULL, NULL,
14239                             (lost_rqst.lr_op == OP_LOCK ||
14240                             lost_rqst.lr_op == OP_LOCKU) ?
14241                             &lost_rqst : NULL, OP_LOCKU, NULL, NULL, NULL);
14242                         lock_owner_rele(lop);
14243                         lop = NULL;
14244                 }
14245                 flk->l_pid = curproc->p_pid;
14246                 nfs4_register_lock_locally(vp, flk, flag, offset);
14247                 goto out;
14248         }
14249 
14250         /* putfh directory fh */
14251         argop[0].argop = OP_CPUTFH;
14252         argop[0].nfs_argop4_u.opcputfh.sfh = rp->r_fh;
14253 
14254         /*
14255          * Set up the over-the-wire arguments and get references to the
14256          * open owner, etc.
14257          */
14258 
14259         if (ctype == NFS4_LCK_CTYPE_RESEND ||
14260             ctype == NFS4_LCK_CTYPE_REINSTATE) {
14261                 nfs4frlock_setup_resend_lock_args(resend_rqstp, argsp,
14262                     &argop[1], &lop, &oop, &osp, &lock_args, &locku_args);
14263         } else {
14264                 bool_t go_otw = TRUE;
14265 
14266                 ASSERT(resend_rqstp == NULL);
14267 
14268                 switch (cmd) {
14269                 case F_GETLK:
14270                 case F_O_GETLK:
14271                         nfs4frlock_setup_lockt_args(ctype, &argop[1],
14272                             &lockt_args, argsp, flk, rp);
14273                         break;
14274                 case F_SETLKW:
14275                 case F_SETLK:
14276                         if (flk->l_type == F_UNLCK)
14277                                 nfs4frlock_setup_locku_args(ctype,
14278                                     &argop[1], &locku_args, flk,
14279                                     &lop, ep, argsp,
14280                                     vp, flag, offset, cr,
14281                                     &skip_get_err, &go_otw);
14282                         else
14283                                 nfs4frlock_setup_lock_args(ctype,
14284                                     &lock_args, &oop, &osp, &lop, &argop[1],
14285                                     argsp, flk, cmd, vp, cr, ep);
14286 
14287                         if (ep->error)
14288                                 goto out;
14289 
14290                         switch (ep->stat) {
14291                         case NFS4_OK:
14292                                 break;
14293                         case NFS4ERR_DELAY:
14294                                 /* recov thread never gets this error */
14295                                 ASSERT(resend_rqstp == NULL);
14296                                 ASSERT(did_start_fop);
14297 
14298                                 nfs4_end_fop(VTOMI4(vp), vp, NULL, op_hint,
14299                                     &recov_state, TRUE);
14300                                 did_start_fop = FALSE;
14301                                 if (argop[1].argop == OP_LOCK)
14302                                         nfs4args_lock_free(&argop[1]);
14303                                 else if (argop[1].argop == OP_LOCKT)
14304                                         nfs4args_lockt_free(&argop[1]);
14305                                 kmem_free(argop, 2 * sizeof (nfs_argop4));
14306                                 argsp = NULL;
14307                                 goto recov_retry;
14308                         default:
14309                                 ep->error = EIO;
14310                                 goto out;
14311                         }
14312                         break;
14313                 default:
14314                         NFS4_DEBUG(nfs4_client_lock_debug, (CE_NOTE,
14315                             "nfs4_frlock: invalid cmd %d", cmd));
14316                         ep->error = EINVAL;
14317                         goto out;
14318                 }
14319 
14320                 if (!go_otw)
14321                         goto out;
14322         }
14323 
14324         /* XXX should we use the local reclock as a cache ? */
14325         /*
14326          * Unregister the lock with the local locking code before
14327          * contacting the server.  This avoids a potential race where
14328          * another process gets notified that it has been granted a lock
14329          * before we can unregister ourselves locally.
14330          */
14331         if ((cmd == F_SETLK || cmd == F_SETLKW) && flk->l_type == F_UNLCK) {
14332                 if (ctype == NFS4_LCK_CTYPE_NORM)
14333                         flk->l_pid = ttoproc(curthread)->p_pid;
14334                 nfs4_register_lock_locally(vp, flk, flag, offset);
14335         }
14336 
14337         /*
14338          * Send the server the lock request.  Continually loop with a delay
14339          * if get error NFS4ERR_DENIED (for blocking locks) or NFS4ERR_GRACE.
14340          */
14341         resp = &res;
14342 
14343         NFS4_DEBUG((nfs4_client_call_debug || nfs4_client_lock_debug),
14344             (CE_NOTE,
14345             "nfs4frlock: %s call, rp %s", needrecov ? "recov" : "first",
14346             rnode4info(rp)));
14347 
14348         if (lock_args && frc_no_reclaim) {
14349                 ASSERT(ctype == NFS4_LCK_CTYPE_RECLAIM);
14350                 NFS4_DEBUG(nfs4_client_lock_debug, (CE_NOTE,
14351                     "nfs4frlock: frc_no_reclaim: clearing reclaim"));
14352                 lock_args->reclaim = FALSE;
14353                 if (did_reclaimp)
14354                         *did_reclaimp = 0;
14355         }
14356 
14357         /*
14358          * Do the OTW call.
14359          */
14360         rfs4call(VTOMI4(vp), argsp, resp, cred_otw, &doqueue, 0, ep);
14361 
14362         NFS4_DEBUG(nfs4_client_lock_debug, (CE_NOTE,
14363             "nfs4frlock: error %d, status %d", ep->error, resp->status));
14364 
14365         needrecov = nfs4_needs_recovery(ep, TRUE, vp->v_vfsp);
14366         NFS4_DEBUG(nfs4_client_lock_debug, (CE_NOTE,
14367             "nfs4frlock: needrecov %d", needrecov));
14368 
14369         if (ep->error == 0 && nfs4_need_to_bump_seqid(resp))
14370                 nfs4frlock_bump_seqid(lock_args, locku_args, oop, lop,
14371                     args.ctag);
14372 
14373         /*
14374          * Check if one of these mutually exclusive error cases has
14375          * happened:
14376          *   need to swap credentials due to access error
14377          *   recovery is needed
14378          *   different error (only known case is missing Kerberos ticket)
14379          */
14380 
14381         if ((ep->error == EACCES ||
14382             (ep->error == 0 && resp->status == NFS4ERR_ACCESS)) &&
14383             cred_otw != cr) {
14384                 nfs4frlock_check_access(vp, op_hint, &recov_state, needrecov,
14385                     &did_start_fop, &argsp, &resp, ep->error, &lop, &oop, &osp,
14386                     cr, &cred_otw);
14387                 goto recov_retry;
14388         }
14389 
14390         if (needrecov) {
14391                 /*
14392                  * LOCKT requests don't need to recover from lost
14393                  * requests since they don't create/modify state.
14394                  */
14395                 if ((ep->error == EINTR ||
14396                     NFS4_FRC_UNMT_ERR(ep->error, vp->v_vfsp)) &&
14397                     lockt_args)
14398                         goto out;
14399                 /*
14400                  * Do not attempt recovery for requests initiated by
14401                  * the recovery framework.  Let the framework redrive them.
14402                  */
14403                 if (ctype != NFS4_LCK_CTYPE_NORM)
14404                         goto out;
14405                 else {
14406                         ASSERT(resend_rqstp == NULL);
14407                 }
14408 
14409                 nfs4frlock_save_lost_rqst(ctype, ep->error,
14410                     flk_to_locktype(cmd, flk->l_type),
14411                     oop, osp, lop, flk, &lost_rqst, cred_otw, vp);
14412 
14413                 retry = nfs4frlock_recovery(needrecov, ep, &argsp,
14414                     &resp, lock_args, locku_args, &oop, &osp, &lop,
14415                     rp, vp, &recov_state, op_hint, &did_start_fop,
14416                     cmd != F_GETLK ? &lost_rqst : NULL, flk);
14417 
14418                 if (retry) {
14419                         ASSERT(oop == NULL);
14420                         ASSERT(osp == NULL);
14421                         ASSERT(lop == NULL);
14422                         goto recov_retry;
14423                 }
14424                 goto out;
14425         }
14426 
14427         /*
14428          * Bail out if have reached this point with ep->error set. Can
14429          * happen if (ep->error == EACCES && !needrecov && cred_otw == cr).
14430          * This happens if Kerberos ticket has expired or has been
14431          * destroyed.
14432          */
14433         if (ep->error != 0)
14434                 goto out;
14435 
14436         /*
14437          * Process the reply.
14438          */
14439         switch (resp->status) {
14440         case NFS4_OK:
14441                 resop = &resp->array[1];
14442                 nfs4frlock_results_ok(ctype, cmd, flk, vp, flag, offset,
14443                     resend_rqstp);
14444                 /*
14445                  * Have a successful lock operation, now update state.
14446                  */
14447                 nfs4frlock_update_state(lock_args, locku_args, lockt_args,
14448                     resop, lop, vp, flk, cr, resend_rqstp);
14449                 break;
14450 
14451         case NFS4ERR_DENIED:
14452                 resop = &resp->array[1];
14453                 retry = nfs4frlock_results_denied(ctype, lock_args, lockt_args,
14454                     &oop, &osp, &lop, cmd, vp, flk, op_hint,
14455                     &recov_state, needrecov, &argsp, &resp,
14456                     &tick_delay, &whence, &ep->error, resop, cr,
14457                     &did_start_fop, &skip_get_err);
14458 
14459                 if (retry) {
14460                         ASSERT(oop == NULL);
14461                         ASSERT(osp == NULL);
14462                         ASSERT(lop == NULL);
14463                         goto recov_retry;
14464                 }
14465                 break;
14466         /*
14467          * If the server won't let us reclaim, fall-back to trying to lock
14468          * the file from scratch. Code elsewhere will check the changeinfo
14469          * to ensure the file hasn't been changed.
14470          */
14471         case NFS4ERR_NO_GRACE:
14472                 if (lock_args && lock_args->reclaim == TRUE) {
14473                         ASSERT(ctype == NFS4_LCK_CTYPE_RECLAIM);
14474                         NFS4_DEBUG(nfs4_client_lock_debug, (CE_NOTE,
14475                             "nfs4frlock: reclaim: NFS4ERR_NO_GRACE"));
14476                         frc_no_reclaim = 1;
14477                         /* clean up before retrying */
14478                         needrecov = 0;
14479                         (void) nfs4frlock_recovery(needrecov, ep, &argsp, &resp,
14480                             lock_args, locku_args, &oop, &osp, &lop, rp, vp,
14481                             &recov_state, op_hint, &did_start_fop, NULL, flk);
14482                         goto recov_retry;
14483                 }
14484                 /* FALLTHROUGH */
14485 
14486         default:
14487                 nfs4frlock_results_default(resp, &ep->error);
14488                 break;
14489         }
14490 out:
14491         /*
14492          * Process and cleanup from error.  Make interrupted unlock
14493          * requests look successful, since they will be handled by the
14494          * client recovery code.
14495          */
14496         nfs4frlock_final_cleanup(ctype, argsp, resp, vp, op_hint, &recov_state,
14497             needrecov, oop, osp, lop, flk, whence, offset, ls, &ep->error,
14498             lock_args, locku_args, did_start_fop,
14499             skip_get_err, cred_otw, cr);
14500 
14501         if (ep->error == EINTR && flk->l_type == F_UNLCK &&
14502             (cmd == F_SETLK || cmd == F_SETLKW))
14503                 ep->error = 0;
14504 }
14505 
14506 /*
14507  * nfs4_safelock:
14508  *
14509  * Return non-zero if the given lock request can be handled without
14510  * violating the constraints on concurrent mapping and locking.
14511  */
14512 
14513 static int
14514 nfs4_safelock(vnode_t *vp, const struct flock64 *bfp, cred_t *cr)
14515 {
14516         rnode4_t *rp = VTOR4(vp);
14517         struct vattr va;
14518         int error;
14519 
14520         ASSERT(nfs_zone() == VTOMI4(vp)->mi_zone);
14521         ASSERT(rp->r_mapcnt >= 0);
14522         NFS4_DEBUG(nfs4_client_lock_debug, (CE_NOTE, "nfs4_safelock %s: "
14523             "(%"PRIx64", %"PRIx64"); mapcnt = %ld", bfp->l_type == F_WRLCK ?
14524             "write" : bfp->l_type == F_RDLCK ? "read" : "unlock",
14525             bfp->l_start, bfp->l_len, rp->r_mapcnt));
14526 
14527         if (rp->r_mapcnt == 0)
14528                 return (1);             /* always safe if not mapped */
14529 
14530         /*
14531          * If the file is already mapped and there are locks, then they
14532          * should be all safe locks.  So adding or removing a lock is safe
14533          * as long as the new request is safe (i.e., whole-file, meaning
14534          * length and starting offset are both zero).
14535          */
14536 
14537         if (bfp->l_start != 0 || bfp->l_len != 0) {
14538                 NFS4_DEBUG(nfs4_client_lock_debug, (CE_NOTE, "nfs4_safelock: "
14539                     "cannot lock a memory mapped file unless locking the "
14540                     "entire file: start %"PRIx64", len %"PRIx64,
14541                     bfp->l_start, bfp->l_len));
14542                 return (0);
14543         }
14544 
14545         /* mandatory locking and mapping don't mix */
14546         va.va_mask = AT_MODE;
14547         error = VOP_GETATTR(vp, &va, 0, cr, NULL);
14548         if (error != 0) {
14549                 NFS4_DEBUG(nfs4_client_lock_debug, (CE_NOTE, "nfs4_safelock: "
14550                     "getattr error %d", error));
14551                 return (0);             /* treat errors conservatively */
14552         }
14553         if (MANDLOCK(vp, va.va_mode)) {
14554                 NFS4_DEBUG(nfs4_client_lock_debug, (CE_NOTE, "nfs4_safelock: "
14555                     "cannot mandatory lock and mmap a file"));
14556                 return (0);
14557         }
14558 
14559         return (1);
14560 }
14561 
14562 
14563 /*
14564  * Register the lock locally within Solaris.
14565  * As the client, we "or" the sysid with LM_SYSID_CLIENT when
14566  * recording locks locally.
14567  *
14568  * This should handle conflicts/cooperation with NFS v2/v3 since all locks
14569  * are registered locally.
14570  */
14571 void
14572 nfs4_register_lock_locally(vnode_t *vp, struct flock64 *flk, int flag,
14573     u_offset_t offset)
14574 {
14575         int oldsysid;
14576         int error;
14577 #ifdef DEBUG
14578         char *name;
14579 #endif
14580 
14581         ASSERT(nfs_zone() == VTOMI4(vp)->mi_zone);
14582 
14583 #ifdef DEBUG
14584         name = fn_name(VTOSV(vp)->sv_name);
14585         NFS4_DEBUG(nfs4_client_lock_debug,
14586             (CE_NOTE, "nfs4_register_lock_locally: %s: type %d, "
14587             "start %"PRIx64", length %"PRIx64", pid %ld, sysid %d",
14588             name, flk->l_type, flk->l_start, flk->l_len, (long)flk->l_pid,
14589             flk->l_sysid));
14590         kmem_free(name, MAXNAMELEN);
14591 #endif
14592 
14593         /* register the lock with local locking */
14594         oldsysid = flk->l_sysid;
14595         flk->l_sysid |= LM_SYSID_CLIENT;
14596         error = reclock(vp, flk, SETFLCK, flag, offset, NULL);
14597 #ifdef DEBUG
14598         if (error != 0) {
14599                 NFS4_DEBUG(nfs4_client_lock_debug, (CE_NOTE,
14600                     "nfs4_register_lock_locally: could not register with"
14601                     " local locking"));
14602                 NFS4_DEBUG(nfs4_client_lock_debug, (CE_CONT,
14603                     "error %d, vp 0x%p, pid %d, sysid 0x%x",
14604                     error, (void *)vp, flk->l_pid, flk->l_sysid));
14605                 NFS4_DEBUG(nfs4_client_lock_debug, (CE_CONT,
14606                     "type %d off 0x%" PRIx64 " len 0x%" PRIx64,
14607                     flk->l_type, flk->l_start, flk->l_len));
14608                 (void) reclock(vp, flk, 0, flag, offset, NULL);
14609                 NFS4_DEBUG(nfs4_client_lock_debug, (CE_CONT,
14610                     "blocked by pid %d sysid 0x%x type %d "
14611                     "off 0x%" PRIx64 " len 0x%" PRIx64,
14612                     flk->l_pid, flk->l_sysid, flk->l_type, flk->l_start,
14613                     flk->l_len));
14614         }
14615 #endif
14616         flk->l_sysid = oldsysid;
14617 }
14618 
14619 /*
14620  * nfs4_lockrelease:
14621  *
14622  * Release any locks on the given vnode that are held by the current
14623  * process.  Also removes the lock owner (if one exists) from the rnode's
14624  * list.
14625  */
14626 static int
14627 nfs4_lockrelease(vnode_t *vp, int flag, offset_t offset, cred_t *cr)
14628 {
14629         flock64_t ld;
14630         int ret, error;
14631         rnode4_t *rp;
14632         nfs4_lock_owner_t *lop;
14633         nfs4_recov_state_t recov_state;
14634         mntinfo4_t *mi;
14635         bool_t possible_orphan = FALSE;
14636         bool_t recovonly;
14637 
14638         ASSERT((uintptr_t)vp > KERNELBASE);
14639         ASSERT(nfs_zone() == VTOMI4(vp)->mi_zone);
14640 
14641         rp = VTOR4(vp);
14642         mi = VTOMI4(vp);
14643 
14644         /*
14645          * If we have not locked anything then we can
14646          * just return since we have no work to do.
14647          */
14648         if (rp->r_lo_head.lo_next_rnode == &rp->r_lo_head) {
14649                 return (0);
14650         }
14651 
14652         /*
14653          * We need to comprehend that another thread may
14654          * kick off recovery and the lock_owner we have stashed
14655          * in lop might be invalid so we should NOT cache it
14656          * locally!
14657          */
14658         recov_state.rs_flags = 0;
14659         recov_state.rs_num_retry_despite_err = 0;
14660         error = nfs4_start_fop(mi, vp, NULL, OH_LOCKU, &recov_state,
14661             &recovonly);
14662         if (error) {
14663                 mutex_enter(&rp->r_statelock);
14664                 rp->r_flags |= R4LODANGLERS;
14665                 mutex_exit(&rp->r_statelock);
14666                 return (error);
14667         }
14668 
14669         lop = find_lock_owner(rp, curproc->p_pid, LOWN_ANY);
14670 
14671         /*
14672          * Check if the lock owner might have a lock (request was sent but
14673          * no response was received).  Also check if there are any remote
14674          * locks on the file.  (In theory we shouldn't have to make this
14675          * second check if there's no lock owner, but for now we'll be
14676          * conservative and do it anyway.)  If either condition is true,
14677          * send an unlock for the entire file to the server.
14678          *
14679          * Note that no explicit synchronization is needed here.  At worst,
14680          * flk_has_remote_locks() will return a false positive, in which case
14681          * the unlock call wastes time but doesn't harm correctness.
14682          */
14683 
14684         if (lop) {
14685                 mutex_enter(&lop->lo_lock);
14686                 possible_orphan = lop->lo_pending_rqsts;
14687                 mutex_exit(&lop->lo_lock);
14688                 lock_owner_rele(lop);
14689         }
14690 
14691         nfs4_end_fop(mi, vp, NULL, OH_LOCKU, &recov_state, 0);
14692 
14693         NFS4_DEBUG(nfs4_client_lock_debug, (CE_NOTE,
14694             "nfs4_lockrelease: possible orphan %d, remote locks %d, for "
14695             "lop %p.", possible_orphan, flk_has_remote_locks(vp),
14696             (void *)lop));
14697 
14698         if (possible_orphan || flk_has_remote_locks(vp)) {
14699                 ld.l_type = F_UNLCK;    /* set to unlock entire file */
14700                 ld.l_whence = 0;        /* unlock from start of file */
14701                 ld.l_start = 0;
14702                 ld.l_len = 0;           /* do entire file */
14703 
14704                 ret = VOP_FRLOCK(vp, F_SETLK, &ld, flag, offset, NULL,
14705                     cr, NULL);
14706 
14707                 if (ret != 0) {
14708                         /*
14709                          * If VOP_FRLOCK fails, make sure we unregister
14710                          * local locks before we continue.
14711                          */
14712                         ld.l_pid = ttoproc(curthread)->p_pid;
14713                         nfs4_register_lock_locally(vp, &ld, flag, offset);
14714                         NFS4_DEBUG(nfs4_client_lock_debug, (CE_NOTE,
14715                             "nfs4_lockrelease: lock release error on vp"
14716                             " %p: error %d.\n", (void *)vp, ret));
14717                 }
14718         }
14719 
14720         recov_state.rs_flags = 0;
14721         recov_state.rs_num_retry_despite_err = 0;
14722         error = nfs4_start_fop(mi, vp, NULL, OH_LOCKU, &recov_state,
14723             &recovonly);
14724         if (error) {
14725                 mutex_enter(&rp->r_statelock);
14726                 rp->r_flags |= R4LODANGLERS;
14727                 mutex_exit(&rp->r_statelock);
14728                 return (error);
14729         }
14730 
14731         /*
14732          * So, here we're going to need to retrieve the lock-owner
14733          * again (in case recovery has done a switch-a-roo) and
14734          * remove it because we can.
14735          */
14736         lop = find_lock_owner(rp, curproc->p_pid, LOWN_ANY);
14737 
14738         if (lop) {
14739                 nfs4_rnode_remove_lock_owner(rp, lop);
14740                 lock_owner_rele(lop);
14741         }
14742 
14743         nfs4_end_fop(mi, vp, NULL, OH_LOCKU, &recov_state, 0);
14744         return (0);
14745 }
14746 
14747 /*
14748  * Wait for 'tick_delay' clock ticks.
14749  * Implement exponential backoff until hit the lease_time of this nfs4_server.
14750  * NOTE: lock_lease_time is in seconds.
14751  *
14752  * XXX For future improvements, should implement a waiting queue scheme.
14753  */
14754 static int
14755 nfs4_block_and_wait(clock_t *tick_delay, rnode4_t *rp)
14756 {
14757         long milliseconds_delay;
14758         time_t lock_lease_time;
14759 
14760         /* wait tick_delay clock ticks or siginteruptus */
14761         if (delay_sig(*tick_delay)) {
14762                 return (EINTR);
14763         }
14764         NFS4_DEBUG(nfs4_client_lock_debug, (CE_NOTE, "nfs4_block_and_wait: "
14765             "reissue the lock request: blocked for %ld clock ticks: %ld "
14766             "milliseconds", *tick_delay, drv_hztousec(*tick_delay) / 1000));
14767 
14768         /* get the lease time */
14769         lock_lease_time = r2lease_time(rp);
14770 
14771         /* drv_hztousec converts ticks to microseconds */
14772         milliseconds_delay = drv_hztousec(*tick_delay) / 1000;
14773         if (milliseconds_delay < lock_lease_time * 1000) {
14774                 *tick_delay = 2 * *tick_delay;
14775                 if (drv_hztousec(*tick_delay) > lock_lease_time * 1000 * 1000)
14776                         *tick_delay = drv_usectohz(lock_lease_time*1000*1000);
14777         }
14778         return (0);
14779 }
14780 
14781 
14782 void
14783 nfs4_vnops_init(void)
14784 {
14785 }
14786 
14787 void
14788 nfs4_vnops_fini(void)
14789 {
14790 }
14791 
14792 /*
14793  * Return a reference to the directory (parent) vnode for a given vnode,
14794  * using the saved pathname information and the directory file handle.  The
14795  * caller is responsible for disposing of the reference.
14796  * Returns zero or an errno value.
14797  *
14798  * Caller should set need_start_op to FALSE if it is the recovery
14799  * thread, or if a start_fop has already been done.  Otherwise, TRUE.
14800  */
14801 int
14802 vtodv(vnode_t *vp, vnode_t **dvpp, cred_t *cr, bool_t need_start_op)
14803 {
14804         svnode_t *svnp;
14805         vnode_t *dvp = NULL;
14806         servinfo4_t *svp;
14807         nfs4_fname_t *mfname;
14808         int error;
14809 
14810         ASSERT(nfs_zone() == VTOMI4(vp)->mi_zone);
14811 
14812         if (vp->v_flag & VROOT) {
14813                 nfs4_sharedfh_t *sfh;
14814                 nfs_fh4 fh;
14815                 mntinfo4_t *mi;
14816 
14817                 ASSERT(vp->v_type == VREG);
14818 
14819                 mi = VTOMI4(vp);
14820                 svp = mi->mi_curr_serv;
14821                 (void) nfs_rw_enter_sig(&svp->sv_lock, RW_READER, 0);
14822                 fh.nfs_fh4_len = svp->sv_pfhandle.fh_len;
14823                 fh.nfs_fh4_val = svp->sv_pfhandle.fh_buf;
14824                 sfh = sfh4_get(&fh, VTOMI4(vp));
14825                 nfs_rw_exit(&svp->sv_lock);
14826                 mfname = mi->mi_fname;
14827                 fn_hold(mfname);
14828                 dvp = makenfs4node_by_fh(sfh, NULL, &mfname, NULL, mi, cr, 0);
14829                 sfh4_rele(&sfh);
14830 
14831                 if (dvp->v_type == VNON)
14832                         dvp->v_type = VDIR;
14833                 *dvpp = dvp;
14834                 return (0);
14835         }
14836 
14837         svnp = VTOSV(vp);
14838 
14839         if (svnp == NULL) {
14840                 NFS4_DEBUG(nfs4_client_shadow_debug, (CE_NOTE, "vtodv: "
14841                     "shadow node is NULL"));
14842                 return (EINVAL);
14843         }
14844 
14845         if (svnp->sv_name == NULL || svnp->sv_dfh == NULL) {
14846                 NFS4_DEBUG(nfs4_client_shadow_debug, (CE_NOTE, "vtodv: "
14847                     "shadow node name or dfh val == NULL"));
14848                 return (EINVAL);
14849         }
14850 
14851         error = nfs4_make_dotdot(svnp->sv_dfh, 0, vp, cr, &dvp,
14852             (int)need_start_op);
14853         if (error != 0) {
14854                 NFS4_DEBUG(nfs4_client_shadow_debug, (CE_NOTE, "vtodv: "
14855                     "nfs4_make_dotdot returned %d", error));
14856                 return (error);
14857         }
14858         if (!dvp) {
14859                 NFS4_DEBUG(nfs4_client_shadow_debug, (CE_NOTE, "vtodv: "
14860                     "nfs4_make_dotdot returned a NULL dvp"));
14861                 return (EIO);
14862         }
14863         if (dvp->v_type == VNON)
14864                 dvp->v_type = VDIR;
14865         ASSERT(dvp->v_type == VDIR);
14866         if (VTOR4(vp)->r_flags & R4ISXATTR) {
14867                 mutex_enter(&dvp->v_lock);
14868                 dvp->v_flag |= V_XATTRDIR;
14869                 mutex_exit(&dvp->v_lock);
14870         }
14871         *dvpp = dvp;
14872         return (0);
14873 }
14874 
14875 /*
14876  * Copy the (final) component name of vp to fnamep.  maxlen is the maximum
14877  * length that fnamep can accept, including the trailing null.
14878  * Returns 0 if okay, returns an errno value if there was a problem.
14879  */
14880 
14881 int
14882 vtoname(vnode_t *vp, char *fnamep, ssize_t maxlen)
14883 {
14884         char *fn;
14885         int err = 0;
14886         servinfo4_t *svp;
14887         svnode_t *shvp;
14888 
14889         /*
14890          * If the file being opened has VROOT set, then this is
14891          * a "file" mount.  sv_name will not be interesting, so
14892          * go back to the servinfo4 to get the original mount
14893          * path and strip off all but the final edge.  Otherwise
14894          * just return the name from the shadow vnode.
14895          */
14896 
14897         if (vp->v_flag & VROOT) {
14898 
14899                 svp = VTOMI4(vp)->mi_curr_serv;
14900                 (void) nfs_rw_enter_sig(&svp->sv_lock, RW_READER, 0);
14901 
14902                 fn = strrchr(svp->sv_path, '/');
14903                 if (fn == NULL)
14904                         err = EINVAL;
14905                 else
14906                         fn++;
14907         } else {
14908                 shvp = VTOSV(vp);
14909                 fn = fn_name(shvp->sv_name);
14910         }
14911 
14912         if (err == 0)
14913                 if (strlen(fn) < maxlen)
14914                         (void) strcpy(fnamep, fn);
14915                 else
14916                         err = ENAMETOOLONG;
14917 
14918         if (vp->v_flag & VROOT)
14919                 nfs_rw_exit(&svp->sv_lock);
14920         else
14921                 kmem_free(fn, MAXNAMELEN);
14922 
14923         return (err);
14924 }
14925 
14926 /*
14927  * Bookkeeping for a close that doesn't need to go over the wire.
14928  * *have_lockp is set to 0 if 'os_sync_lock' is released; otherwise
14929  * it is left at 1.
14930  */
14931 void
14932 nfs4close_notw(vnode_t *vp, nfs4_open_stream_t *osp, int *have_lockp)
14933 {
14934         rnode4_t                *rp;
14935         mntinfo4_t              *mi;
14936 
14937         mi = VTOMI4(vp);
14938         rp = VTOR4(vp);
14939 
14940         NFS4_DEBUG(nfs4close_notw_debug, (CE_NOTE, "nfs4close_notw: "
14941             "rp=%p osp=%p", (void *)rp, (void *)osp));
14942         ASSERT(nfs_zone() == mi->mi_zone);
14943         ASSERT(mutex_owned(&osp->os_sync_lock));
14944         ASSERT(*have_lockp);
14945 
14946         if (!osp->os_valid ||
14947             osp->os_open_ref_count > 0 || osp->os_mapcnt > 0) {
14948                 return;
14949         }
14950 
14951         /*
14952          * This removes the reference obtained at OPEN; ie,
14953          * when the open stream structure was created.
14954          *
14955          * We don't have to worry about calling 'open_stream_rele'
14956          * since we our currently holding a reference to this
14957          * open stream which means the count can not go to 0 with
14958          * this decrement.
14959          */
14960         ASSERT(osp->os_ref_count >= 2);
14961         osp->os_ref_count--;
14962         osp->os_valid = 0;
14963         mutex_exit(&osp->os_sync_lock);
14964         *have_lockp = 0;
14965 
14966         nfs4_dec_state_ref_count(mi);
14967 }
14968 
14969 /*
14970  * Close all remaining open streams on the rnode.  These open streams
14971  * could be here because:
14972  * - The close attempted at either close or delmap failed
14973  * - Some kernel entity did VOP_OPEN but never did VOP_CLOSE
14974  * - Someone did mknod on a regular file but never opened it
14975  */
14976 int
14977 nfs4close_all(vnode_t *vp, cred_t *cr)
14978 {
14979         nfs4_open_stream_t *osp;
14980         int error;
14981         nfs4_error_t e = { 0, NFS4_OK, RPC_SUCCESS };
14982         rnode4_t *rp;
14983 
14984         ASSERT(nfs_zone() == VTOMI4(vp)->mi_zone);
14985 
14986         error = 0;
14987         rp = VTOR4(vp);
14988 
14989         /*
14990          * At this point, all we know is that the last time
14991          * someone called vn_rele, the count was 1.  Since then,
14992          * the vnode could have been re-activated.  We want to
14993          * loop through the open streams and close each one, but
14994          * we have to be careful since once we release the rnode
14995          * hash bucket lock, someone else is free to come in and
14996          * re-activate the rnode and add new open streams.  The
14997          * strategy is take the rnode hash bucket lock, verify that
14998          * the count is still 1, grab the open stream off the
14999          * head of the list and mark it invalid, then release the
15000          * rnode hash bucket lock and proceed with that open stream.
15001          * This is ok because nfs4close_one() will acquire the proper
15002          * open/create to close/destroy synchronization for open
15003          * streams, and will ensure that if someone has reopened
15004          * the open stream after we've dropped the hash bucket lock
15005          * then we'll just simply return without destroying the
15006          * open stream.
15007          * Repeat until the list is empty.
15008          */
15009 
15010         for (;;) {
15011 
15012                 /* make sure vnode hasn't been reactivated */
15013                 rw_enter(&rp->r_hashq->r_lock, RW_READER);
15014                 mutex_enter(&vp->v_lock);
15015                 if (vp->v_count > 1) {
15016                         mutex_exit(&vp->v_lock);
15017                         rw_exit(&rp->r_hashq->r_lock);
15018                         break;
15019                 }
15020                 /*
15021                  * Grabbing r_os_lock before releasing v_lock prevents
15022                  * a window where the rnode/open stream could get
15023                  * reactivated (and os_force_close set to 0) before we
15024                  * had a chance to set os_force_close to 1.
15025                  */
15026                 mutex_enter(&rp->r_os_lock);
15027                 mutex_exit(&vp->v_lock);
15028 
15029                 osp = list_head(&rp->r_open_streams);
15030                 if (!osp) {
15031                         /* nothing left to CLOSE OTW, so return */
15032                         mutex_exit(&rp->r_os_lock);
15033                         rw_exit(&rp->r_hashq->r_lock);
15034                         break;
15035                 }
15036 
15037                 mutex_enter(&rp->r_statev4_lock);
15038                 /* the file can't still be mem mapped */
15039                 ASSERT(rp->r_mapcnt == 0);
15040                 if (rp->created_v4)
15041                         rp->created_v4 = 0;
15042                 mutex_exit(&rp->r_statev4_lock);
15043 
15044                 /*
15045                  * Grab a ref on this open stream; nfs4close_one
15046                  * will mark it as invalid
15047                  */
15048                 mutex_enter(&osp->os_sync_lock);
15049                 osp->os_ref_count++;
15050                 osp->os_force_close = 1;
15051                 mutex_exit(&osp->os_sync_lock);
15052                 mutex_exit(&rp->r_os_lock);
15053                 rw_exit(&rp->r_hashq->r_lock);
15054 
15055                 nfs4close_one(vp, osp, cr, 0, NULL, &e, CLOSE_FORCE, 0, 0, 0);
15056 
15057                 /* Update error if it isn't already non-zero */
15058                 if (error == 0) {
15059                         if (e.error)
15060                                 error = e.error;
15061                         else if (e.stat)
15062                                 error = geterrno4(e.stat);
15063                 }
15064 
15065 #ifdef  DEBUG
15066                 nfs4close_all_cnt++;
15067 #endif
15068                 /* Release the ref on osp acquired above. */
15069                 open_stream_rele(osp, rp);
15070 
15071                 /* Proceed to the next open stream, if any */
15072         }
15073         return (error);
15074 }
15075 
15076 /*
15077  * nfs4close_one - close one open stream for a file if needed.
15078  *
15079  * "close_type" indicates which close path this is:
15080  * CLOSE_NORM: close initiated via VOP_CLOSE.
15081  * CLOSE_DELMAP: close initiated via VOP_DELMAP.
15082  * CLOSE_FORCE: close initiated via VOP_INACTIVE.  This path forces
15083  *      the close and release of client state for this open stream
15084  *      (unless someone else has the open stream open).
15085  * CLOSE_RESEND: indicates the request is a replay of an earlier request
15086  *      (e.g., due to abort because of a signal).
15087  * CLOSE_AFTER_RESEND: close initiated to "undo" a successful resent OPEN.
15088  *
15089  * CLOSE_RESEND and CLOSE_AFTER_RESEND will not attempt to retry after client
15090  * recovery.  Instead, the caller is expected to deal with retries.
15091  *
15092  * The caller can either pass in the osp ('provided_osp') or not.
15093  *
15094  * 'access_bits' represents the access we are closing/downgrading.
15095  *
15096  * 'len', 'prot', and 'mmap_flags' are used for CLOSE_DELMAP.  'len' is the
15097  * number of bytes we are unmapping, 'maxprot' is the mmap protection, and
15098  * 'mmap_flags' tells us the type of sharing (MAP_PRIVATE or MAP_SHARED).
15099  *
15100  * Errors are returned via the nfs4_error_t.
15101  */
15102 void
15103 nfs4close_one(vnode_t *vp, nfs4_open_stream_t *provided_osp, cred_t *cr,
15104     int access_bits, nfs4_lost_rqst_t *lrp, nfs4_error_t *ep,
15105     nfs4_close_type_t close_type, size_t len, uint_t maxprot,
15106     uint_t mmap_flags)
15107 {
15108         nfs4_open_owner_t *oop;
15109         nfs4_open_stream_t *osp = NULL;
15110         int retry = 0;
15111         int num_retries = NFS4_NUM_RECOV_RETRIES;
15112         rnode4_t *rp;
15113         mntinfo4_t *mi;
15114         nfs4_recov_state_t recov_state;
15115         cred_t *cred_otw = NULL;
15116         bool_t recovonly = FALSE;
15117         int isrecov;
15118         int force_close;
15119         int close_failed = 0;
15120         int did_dec_count = 0;
15121         int did_start_op = 0;
15122         int did_force_recovlock = 0;
15123         int did_start_seqid_sync = 0;
15124         int have_sync_lock = 0;
15125 
15126         ASSERT(nfs_zone() == VTOMI4(vp)->mi_zone);
15127 
15128         NFS4_DEBUG(nfs4close_one_debug, (CE_NOTE, "closing vp %p osp %p, "
15129             "lrp %p, close type %d len %ld prot %x mmap flags %x bits %x",
15130             (void *)vp, (void *)provided_osp, (void *)lrp, close_type,
15131             len, maxprot, mmap_flags, access_bits));
15132 
15133         nfs4_error_zinit(ep);
15134         rp = VTOR4(vp);
15135         mi = VTOMI4(vp);
15136         isrecov = (close_type == CLOSE_RESEND ||
15137             close_type == CLOSE_AFTER_RESEND);
15138 
15139         /*
15140          * First get the open owner.
15141          */
15142         if (!provided_osp) {
15143                 oop = find_open_owner(cr, NFS4_PERM_CREATED, mi);
15144         } else {
15145                 oop = provided_osp->os_open_owner;
15146                 ASSERT(oop != NULL);
15147                 open_owner_hold(oop);
15148         }
15149 
15150         if (!oop) {
15151                 NFS4_DEBUG(nfs4_client_recov_debug, (CE_NOTE,
15152                     "nfs4close_one: no oop, rp %p, mi %p, cr %p, osp %p, "
15153                     "close type %d", (void *)rp, (void *)mi, (void *)cr,
15154                     (void *)provided_osp, close_type));
15155                 ep->error = EIO;
15156                 goto out;
15157         }
15158 
15159         cred_otw = nfs4_get_otw_cred(cr, mi, oop);
15160 recov_retry:
15161         osp = NULL;
15162         close_failed = 0;
15163         force_close = (close_type == CLOSE_FORCE);
15164         retry = 0;
15165         did_start_op = 0;
15166         did_force_recovlock = 0;
15167         did_start_seqid_sync = 0;
15168         have_sync_lock = 0;
15169         recovonly = FALSE;
15170         recov_state.rs_flags = 0;
15171         recov_state.rs_num_retry_despite_err = 0;
15172 
15173         /*
15174          * Second synchronize with recovery.
15175          */
15176         if (!isrecov) {
15177                 ep->error = nfs4_start_fop(mi, vp, NULL, OH_CLOSE,
15178                     &recov_state, &recovonly);
15179                 if (!ep->error) {
15180                         did_start_op = 1;
15181                 } else {
15182                         close_failed = 1;
15183                         /*
15184                          * If we couldn't get start_fop, but have to
15185                          * cleanup state, then at least acquire the
15186                          * mi_recovlock so we can synchronize with
15187                          * recovery.
15188                          */
15189                         if (close_type == CLOSE_FORCE) {
15190                                 (void) nfs_rw_enter_sig(&mi->mi_recovlock,
15191                                     RW_READER, FALSE);
15192                                 did_force_recovlock = 1;
15193                         } else
15194                                 goto out;
15195                 }
15196         }
15197 
15198         /*
15199          * We cannot attempt to get the open seqid sync if nfs4_start_fop
15200          * set 'recovonly' to TRUE since most likely this is due to
15201          * reovery being active (MI4_RECOV_ACTIV).  If recovery is active,
15202          * nfs4_start_open_seqid_sync() will fail with EAGAIN asking us
15203          * to retry, causing us to loop until recovery finishes.  Plus we
15204          * don't need protection over the open seqid since we're not going
15205          * OTW, hence don't need to use the seqid.
15206          */
15207         if (recovonly == FALSE) {
15208                 /* need to grab the open owner sync before 'os_sync_lock' */
15209                 ep->error = nfs4_start_open_seqid_sync(oop, mi);
15210                 if (ep->error == EAGAIN) {
15211                         ASSERT(!isrecov);
15212                         if (did_start_op)
15213                                 nfs4_end_fop(mi, vp, NULL, OH_CLOSE,
15214                                     &recov_state, TRUE);
15215                         if (did_force_recovlock)
15216                                 nfs_rw_exit(&mi->mi_recovlock);
15217                         goto recov_retry;
15218                 }
15219                 did_start_seqid_sync = 1;
15220         }
15221 
15222         /*
15223          * Third get an open stream and acquire 'os_sync_lock' to
15224          * sychronize the opening/creating of an open stream with the
15225          * closing/destroying of an open stream.
15226          */
15227         if (!provided_osp) {
15228                 /* returns with 'os_sync_lock' held */
15229                 osp = find_open_stream(oop, rp);
15230                 if (!osp) {
15231                         ep->error = EIO;
15232                         goto out;
15233                 }
15234         } else {
15235                 osp = provided_osp;
15236                 open_stream_hold(osp);
15237                 mutex_enter(&osp->os_sync_lock);
15238         }
15239         have_sync_lock = 1;
15240 
15241         ASSERT(oop == osp->os_open_owner);
15242 
15243         /*
15244          * Fourth, do any special pre-OTW CLOSE processing
15245          * based on the specific close type.
15246          */
15247         if ((close_type == CLOSE_NORM || close_type == CLOSE_AFTER_RESEND) &&
15248             !did_dec_count) {
15249                 ASSERT(osp->os_open_ref_count > 0);
15250                 osp->os_open_ref_count--;
15251                 did_dec_count = 1;
15252                 if (osp->os_open_ref_count == 0)
15253                         osp->os_final_close = 1;
15254         }
15255 
15256         if (close_type == CLOSE_FORCE) {
15257                 /* see if somebody reopened the open stream. */
15258                 if (!osp->os_force_close) {
15259                         NFS4_DEBUG(nfs4close_one_debug, (CE_NOTE,
15260                             "nfs4close_one: skip CLOSE_FORCE as osp %p "
15261                             "was reopened, vp %p", (void *)osp, (void *)vp));
15262                         ep->error = 0;
15263                         ep->stat = NFS4_OK;
15264                         goto out;
15265                 }
15266 
15267                 if (!osp->os_final_close && !did_dec_count) {
15268                         osp->os_open_ref_count--;
15269                         did_dec_count = 1;
15270                 }
15271 
15272                 /*
15273                  * We can't depend on os_open_ref_count being 0 due to the
15274                  * way executables are opened (VN_RELE to match a VOP_OPEN).
15275                  */
15276 #ifdef  NOTYET
15277                 ASSERT(osp->os_open_ref_count == 0);
15278 #endif
15279                 if (osp->os_open_ref_count != 0) {
15280                         NFS4_DEBUG(nfs4close_one_debug, (CE_NOTE,
15281                             "nfs4close_one: should panic here on an "
15282                             "ASSERT(osp->os_open_ref_count == 0). Ignoring "
15283                             "since this is probably the exec problem."));
15284 
15285                         osp->os_open_ref_count = 0;
15286                 }
15287 
15288                 /*
15289                  * There is the possibility that nfs4close_one()
15290                  * for close_type == CLOSE_DELMAP couldn't find the
15291                  * open stream, thus couldn't decrement its os_mapcnt;
15292                  * therefore we can't use this ASSERT yet.
15293                  */
15294 #ifdef  NOTYET
15295                 ASSERT(osp->os_mapcnt == 0);
15296 #endif
15297                 osp->os_mapcnt = 0;
15298         }
15299 
15300         if (close_type == CLOSE_DELMAP && !did_dec_count) {
15301                 ASSERT(osp->os_mapcnt >= btopr(len));
15302 
15303                 if ((mmap_flags & MAP_SHARED) && (maxprot & PROT_WRITE))
15304                         osp->os_mmap_write -= btopr(len);
15305                 if (maxprot & PROT_READ)
15306                         osp->os_mmap_read -= btopr(len);
15307                 if (maxprot & PROT_EXEC)
15308                         osp->os_mmap_read -= btopr(len);
15309                 /* mirror the PROT_NONE check in nfs4_addmap() */
15310                 if (!(maxprot & PROT_READ) && !(maxprot & PROT_WRITE) &&
15311                     !(maxprot & PROT_EXEC))
15312                         osp->os_mmap_read -= btopr(len);
15313                 osp->os_mapcnt -= btopr(len);
15314                 did_dec_count = 1;
15315         }
15316 
15317         if (recovonly) {
15318                 nfs4_lost_rqst_t lost_rqst;
15319 
15320                 /* request should not already be in recovery queue */
15321                 ASSERT(lrp == NULL);
15322                 nfs4_error_init(ep, EINTR);
15323                 nfs4close_save_lost_rqst(ep->error, &lost_rqst, oop,
15324                     osp, cred_otw, vp);
15325                 mutex_exit(&osp->os_sync_lock);
15326                 have_sync_lock = 0;
15327                 (void) nfs4_start_recovery(ep, mi, vp, NULL, NULL,
15328                     lost_rqst.lr_op == OP_CLOSE ?
15329                     &lost_rqst : NULL, OP_CLOSE, NULL, NULL, NULL);
15330                 close_failed = 1;
15331                 force_close = 0;
15332                 goto close_cleanup;
15333         }
15334 
15335         /*
15336          * If a previous OTW call got NFS4ERR_BAD_SEQID, then
15337          * we stopped operating on the open owner's <old oo_name, old seqid>
15338          * space, which means we stopped operating on the open stream
15339          * too.  So don't go OTW (as the seqid is likely bad, and the
15340          * stateid could be stale, potentially triggering a false
15341          * setclientid), and just clean up the client's internal state.
15342          */
15343         if (osp->os_orig_oo_name != oop->oo_name) {
15344                 NFS4_DEBUG(nfs4close_one_debug || nfs4_client_recov_debug,
15345                     (CE_NOTE, "nfs4close_one: skip OTW close for osp %p "
15346                     "oop %p due to bad seqid (orig oo_name %" PRIx64 " current "
15347                     "oo_name %" PRIx64")",
15348                     (void *)osp, (void *)oop, osp->os_orig_oo_name,
15349                     oop->oo_name));
15350                 close_failed = 1;
15351         }
15352 
15353         /* If the file failed recovery, just quit. */
15354         mutex_enter(&rp->r_statelock);
15355         if (rp->r_flags & R4RECOVERR) {
15356                 close_failed = 1;
15357         }
15358         mutex_exit(&rp->r_statelock);
15359 
15360         /*
15361          * If the force close path failed to obtain start_fop
15362          * then skip the OTW close and just remove the state.
15363          */
15364         if (close_failed)
15365                 goto close_cleanup;
15366 
15367         /*
15368          * Fifth, check to see if there are still mapped pages or other
15369          * opens using this open stream.  If there are then we can't
15370          * close yet but we can see if an OPEN_DOWNGRADE is necessary.
15371          */
15372         if (osp->os_open_ref_count > 0 || osp->os_mapcnt > 0) {
15373                 nfs4_lost_rqst_t        new_lost_rqst;
15374                 bool_t                  needrecov = FALSE;
15375                 cred_t                  *odg_cred_otw = NULL;
15376                 seqid4                  open_dg_seqid = 0;
15377 
15378                 if (osp->os_delegation) {
15379                         /*
15380                          * If this open stream was never OPENed OTW then we
15381                          * surely can't DOWNGRADE it (especially since the
15382                          * osp->open_stateid is really a delegation stateid
15383                          * when os_delegation is 1).
15384                          */
15385                         if (access_bits & FREAD)
15386                                 osp->os_share_acc_read--;
15387                         if (access_bits & FWRITE)
15388                                 osp->os_share_acc_write--;
15389                         osp->os_share_deny_none--;
15390                         nfs4_error_zinit(ep);
15391                         goto out;
15392                 }
15393                 nfs4_open_downgrade(access_bits, 0, oop, osp, vp, cr,
15394                     lrp, ep, &odg_cred_otw, &open_dg_seqid);
15395                 needrecov = nfs4_needs_recovery(ep, TRUE, mi->mi_vfsp);
15396                 if (needrecov && !isrecov) {
15397                         bool_t abort;
15398                         nfs4_bseqid_entry_t *bsep = NULL;
15399 
15400                         if (!ep->error && ep->stat == NFS4ERR_BAD_SEQID)
15401                                 bsep = nfs4_create_bseqid_entry(oop, NULL,
15402                                     vp, 0,
15403                                     lrp ? TAG_OPEN_DG_LOST : TAG_OPEN_DG,
15404                                     open_dg_seqid);
15405 
15406                         nfs4open_dg_save_lost_rqst(ep->error, &new_lost_rqst,
15407                             oop, osp, odg_cred_otw, vp, access_bits, 0);
15408                         mutex_exit(&osp->os_sync_lock);
15409                         have_sync_lock = 0;
15410                         abort = nfs4_start_recovery(ep, mi, vp, NULL, NULL,
15411                             new_lost_rqst.lr_op == OP_OPEN_DOWNGRADE ?
15412                             &new_lost_rqst : NULL, OP_OPEN_DOWNGRADE,
15413                             bsep, NULL, NULL);
15414                         if (odg_cred_otw)
15415                                 crfree(odg_cred_otw);
15416                         if (bsep)
15417                                 kmem_free(bsep, sizeof (*bsep));
15418 
15419                         if (abort == TRUE)
15420                                 goto out;
15421 
15422                         if (did_start_seqid_sync) {
15423                                 nfs4_end_open_seqid_sync(oop);
15424                                 did_start_seqid_sync = 0;
15425                         }
15426                         open_stream_rele(osp, rp);
15427 
15428                         if (did_start_op)
15429                                 nfs4_end_fop(mi, vp, NULL, OH_CLOSE,
15430                                     &recov_state, FALSE);
15431                         if (did_force_recovlock)
15432                                 nfs_rw_exit(&mi->mi_recovlock);
15433 
15434                         goto recov_retry;
15435                 } else {
15436                         if (odg_cred_otw)
15437                                 crfree(odg_cred_otw);
15438                 }
15439                 goto out;
15440         }
15441 
15442         /*
15443          * If this open stream was created as the results of an open
15444          * while holding a delegation, then just release it; no need
15445          * to do an OTW close.  Otherwise do a "normal" OTW close.
15446          */
15447         if (osp->os_delegation) {
15448                 nfs4close_notw(vp, osp, &have_sync_lock);
15449                 nfs4_error_zinit(ep);
15450                 goto out;
15451         }
15452 
15453         /*
15454          * If this stream is not valid, we're done.
15455          */
15456         if (!osp->os_valid) {
15457                 nfs4_error_zinit(ep);
15458                 goto out;
15459         }
15460 
15461         /*
15462          * Last open or mmap ref has vanished, need to do an OTW close.
15463          * First check to see if a close is still necessary.
15464          */
15465         if (osp->os_failed_reopen) {
15466                 NFS4_DEBUG(nfs4_client_recov_debug, (CE_NOTE,
15467                     "don't close OTW osp %p since reopen failed.",
15468                     (void *)osp));
15469                 /*
15470                  * Reopen of the open stream failed, hence the
15471                  * stateid of the open stream is invalid/stale, and
15472                  * sending this OTW would incorrectly cause another
15473                  * round of recovery.  In this case, we need to set
15474                  * the 'os_valid' bit to 0 so another thread doesn't
15475                  * come in and re-open this open stream before
15476                  * this "closing" thread cleans up state (decrementing
15477                  * the nfs4_server_t's state_ref_count and decrementing
15478                  * the os_ref_count).
15479                  */
15480                 osp->os_valid = 0;
15481                 /*
15482                  * This removes the reference obtained at OPEN; ie,
15483                  * when the open stream structure was created.
15484                  *
15485                  * We don't have to worry about calling 'open_stream_rele'
15486                  * since we our currently holding a reference to this
15487                  * open stream which means the count can not go to 0 with
15488                  * this decrement.
15489                  */
15490                 ASSERT(osp->os_ref_count >= 2);
15491                 osp->os_ref_count--;
15492                 nfs4_error_zinit(ep);
15493                 close_failed = 0;
15494                 goto close_cleanup;
15495         }
15496 
15497         ASSERT(osp->os_ref_count > 1);
15498 
15499         /*
15500          * Sixth, try the CLOSE OTW.
15501          */
15502         nfs4close_otw(rp, cred_otw, oop, osp, &retry, &did_start_seqid_sync,
15503             close_type, ep, &have_sync_lock);
15504 
15505         if (ep->error == EINTR || NFS4_FRC_UNMT_ERR(ep->error, vp->v_vfsp)) {
15506                 /*
15507                  * Let the recovery thread be responsible for
15508                  * removing the state for CLOSE.
15509                  */
15510                 close_failed = 1;
15511                 force_close = 0;
15512                 retry = 0;
15513         }
15514 
15515         /* See if we need to retry with a different cred */
15516         if ((ep->error == EACCES ||
15517             (ep->error == 0 && ep->stat == NFS4ERR_ACCESS)) &&
15518             cred_otw != cr) {
15519                 crfree(cred_otw);
15520                 cred_otw = cr;
15521                 crhold(cred_otw);
15522                 retry = 1;
15523         }
15524 
15525         if (ep->error || ep->stat)
15526                 close_failed = 1;
15527 
15528         if (retry && !isrecov && num_retries-- > 0) {
15529                 if (have_sync_lock) {
15530                         mutex_exit(&osp->os_sync_lock);
15531                         have_sync_lock = 0;
15532                 }
15533                 if (did_start_seqid_sync) {
15534                         nfs4_end_open_seqid_sync(oop);
15535                         did_start_seqid_sync = 0;
15536                 }
15537                 open_stream_rele(osp, rp);
15538 
15539                 if (did_start_op)
15540                         nfs4_end_fop(mi, vp, NULL, OH_CLOSE,
15541                             &recov_state, FALSE);
15542                 if (did_force_recovlock)
15543                         nfs_rw_exit(&mi->mi_recovlock);
15544                 NFS4_DEBUG(nfs4_client_recov_debug, (CE_NOTE,
15545                     "nfs4close_one: need to retry the close "
15546                     "operation"));
15547                 goto recov_retry;
15548         }
15549 close_cleanup:
15550         /*
15551          * Seventh and lastly, process our results.
15552          */
15553         if (close_failed && force_close) {
15554                 /*
15555                  * It's ok to drop and regrab the 'os_sync_lock' since
15556                  * nfs4close_notw() will recheck to make sure the
15557                  * "close"/removal of state should happen.
15558                  */
15559                 if (!have_sync_lock) {
15560                         mutex_enter(&osp->os_sync_lock);
15561                         have_sync_lock = 1;
15562                 }
15563                 /*
15564                  * This is last call, remove the ref on the open
15565                  * stream created by open and clean everything up.
15566                  */
15567                 osp->os_pending_close = 0;
15568                 nfs4close_notw(vp, osp, &have_sync_lock);
15569                 nfs4_error_zinit(ep);
15570         }
15571 
15572         if (!close_failed) {
15573                 if (have_sync_lock) {
15574                         osp->os_pending_close = 0;
15575                         mutex_exit(&osp->os_sync_lock);
15576                         have_sync_lock = 0;
15577                 } else {
15578                         mutex_enter(&osp->os_sync_lock);
15579                         osp->os_pending_close = 0;
15580                         mutex_exit(&osp->os_sync_lock);
15581                 }
15582                 if (did_start_op && recov_state.rs_sp != NULL) {
15583                         mutex_enter(&recov_state.rs_sp->s_lock);
15584                         nfs4_dec_state_ref_count_nolock(recov_state.rs_sp, mi);
15585                         mutex_exit(&recov_state.rs_sp->s_lock);
15586                 } else {
15587                         nfs4_dec_state_ref_count(mi);
15588                 }
15589                 nfs4_error_zinit(ep);
15590         }
15591 
15592 out:
15593         if (have_sync_lock)
15594                 mutex_exit(&osp->os_sync_lock);
15595         if (did_start_op)
15596                 nfs4_end_fop(mi, vp, NULL, OH_CLOSE, &recov_state,
15597                     recovonly ? TRUE : FALSE);
15598         if (did_force_recovlock)
15599                 nfs_rw_exit(&mi->mi_recovlock);
15600         if (cred_otw)
15601                 crfree(cred_otw);
15602         if (osp)
15603                 open_stream_rele(osp, rp);
15604         if (oop) {
15605                 if (did_start_seqid_sync)
15606                         nfs4_end_open_seqid_sync(oop);
15607                 open_owner_rele(oop);
15608         }
15609 }
15610 
15611 /*
15612  * Convert information returned by the server in the LOCK4denied
15613  * structure to the form required by fcntl.
15614  */
15615 static void
15616 denied_to_flk(LOCK4denied *lockt_denied, flock64_t *flk, LOCKT4args *lockt_args)
15617 {
15618         nfs4_lo_name_t *lo;
15619 
15620 #ifdef  DEBUG
15621         if (denied_to_flk_debug) {
15622                 lockt_denied_debug = lockt_denied;
15623                 debug_enter("lockt_denied");
15624         }
15625 #endif
15626 
15627         flk->l_type = lockt_denied->locktype == READ_LT ? F_RDLCK : F_WRLCK;
15628         flk->l_whence = 0;   /* aka SEEK_SET */
15629         flk->l_start = lockt_denied->offset;
15630         flk->l_len = lockt_denied->length;
15631 
15632         /*
15633          * If the blocking clientid matches our client id, then we can
15634          * interpret the lockowner (since we built it).  If not, then
15635          * fabricate a sysid and pid.  Note that the l_sysid field
15636          * in *flk already has the local sysid.
15637          */
15638 
15639         if (lockt_denied->owner.clientid == lockt_args->owner.clientid) {
15640 
15641                 if (lockt_denied->owner.owner_len == sizeof (*lo)) {
15642                         lo = (nfs4_lo_name_t *)
15643                             lockt_denied->owner.owner_val;
15644 
15645                         flk->l_pid = lo->ln_pid;
15646                 } else {
15647                         NFS4_DEBUG(nfs4_client_lock_debug, (CE_NOTE,
15648                             "denied_to_flk: bad lock owner length\n"));
15649 
15650                         flk->l_pid = lo_to_pid(&lockt_denied->owner);
15651                 }
15652         } else {
15653                 NFS4_DEBUG(nfs4_client_lock_debug, (CE_NOTE,
15654                 "denied_to_flk: foreign clientid\n"));
15655 
15656                 /*
15657                  * Construct a new sysid which should be different from
15658                  * sysids of other systems.
15659                  */
15660 
15661                 flk->l_sysid++;
15662                 flk->l_pid = lo_to_pid(&lockt_denied->owner);
15663         }
15664 }
15665 
15666 static pid_t
15667 lo_to_pid(lock_owner4 *lop)
15668 {
15669         pid_t pid = 0;
15670         uchar_t *cp;
15671         int i;
15672 
15673         cp = (uchar_t *)&lop->clientid;
15674 
15675         for (i = 0; i < sizeof (lop->clientid); i++)
15676                 pid += (pid_t)*cp++;
15677 
15678         cp = (uchar_t *)lop->owner_val;
15679 
15680         for (i = 0; i < lop->owner_len; i++)
15681                 pid += (pid_t)*cp++;
15682 
15683         return (pid);
15684 }
15685 
15686 /*
15687  * Given a lock pointer, returns the length of that lock.
15688  * "end" is the last locked offset the "l_len" covers from
15689  * the start of the lock.
15690  */
15691 static off64_t
15692 lock_to_end(flock64_t *lock)
15693 {
15694         off64_t lock_end;
15695 
15696         if (lock->l_len == 0)
15697                 lock_end = (off64_t)MAXEND;
15698         else
15699                 lock_end = lock->l_start + lock->l_len - 1;
15700 
15701         return (lock_end);
15702 }
15703 
15704 /*
15705  * Given the end of a lock, it will return you the length "l_len" for that lock.
15706  */
15707 static off64_t
15708 end_to_len(off64_t start, off64_t end)
15709 {
15710         off64_t lock_len;
15711 
15712         ASSERT(end >= start);
15713         if (end == MAXEND)
15714                 lock_len = 0;
15715         else
15716                 lock_len = end - start + 1;
15717 
15718         return (lock_len);
15719 }
15720 
15721 /*
15722  * On given end for a lock it determines if it is the last locked offset
15723  * or not, if so keeps it as is, else adds one to return the length for
15724  * valid start.
15725  */
15726 static off64_t
15727 start_check(off64_t x)
15728 {
15729         if (x == MAXEND)
15730                 return (x);
15731         else
15732                 return (x + 1);
15733 }
15734 
15735 /*
15736  * See if these two locks overlap, and if so return 1;
15737  * otherwise, return 0.
15738  */
15739 static int
15740 locks_intersect(flock64_t *llfp, flock64_t *curfp)
15741 {
15742         off64_t llfp_end, curfp_end;
15743 
15744         llfp_end = lock_to_end(llfp);
15745         curfp_end = lock_to_end(curfp);
15746 
15747         if (((llfp_end >= curfp->l_start) &&
15748             (llfp->l_start <= curfp->l_start)) ||
15749             ((curfp->l_start <= llfp->l_start) && (curfp_end >= llfp->l_start)))
15750                 return (1);
15751         return (0);
15752 }
15753 
15754 /*
15755  * Determine what the intersecting lock region is, and add that to the
15756  * 'nl_llpp' locklist in increasing order (by l_start).
15757  */
15758 static void
15759 nfs4_add_lock_range(flock64_t *lost_flp, flock64_t *local_flp,
15760     locklist_t **nl_llpp, vnode_t *vp)
15761 {
15762         locklist_t *intersect_llp, *tmp_fllp, *cur_fllp;
15763         off64_t lost_flp_end, local_flp_end, len, start;
15764 
15765         NFS4_DEBUG(nfs4_lost_rqst_debug, (CE_NOTE, "nfs4_add_lock_range:"));
15766 
15767         if (!locks_intersect(lost_flp, local_flp))
15768                 return;
15769 
15770         NFS4_DEBUG(nfs4_lost_rqst_debug, (CE_NOTE, "nfs4_add_lock_range: "
15771             "locks intersect"));
15772 
15773         lost_flp_end = lock_to_end(lost_flp);
15774         local_flp_end = lock_to_end(local_flp);
15775 
15776         /* Find the starting point of the intersecting region */
15777         if (local_flp->l_start > lost_flp->l_start)
15778                 start = local_flp->l_start;
15779         else
15780                 start = lost_flp->l_start;
15781 
15782         /* Find the lenght of the intersecting region */
15783         if (lost_flp_end < local_flp_end)
15784                 len = end_to_len(start, lost_flp_end);
15785         else
15786                 len = end_to_len(start, local_flp_end);
15787 
15788         /*
15789          * Prepare the flock structure for the intersection found and insert
15790          * it into the new list in increasing l_start order. This list contains
15791          * intersections of locks registered by the client with the local host
15792          * and the lost lock.
15793          * The lock type of this lock is the same as that of the local_flp.
15794          */
15795         intersect_llp = (locklist_t *)kmem_alloc(sizeof (locklist_t), KM_SLEEP);
15796         intersect_llp->ll_flock.l_start = start;
15797         intersect_llp->ll_flock.l_len = len;
15798         intersect_llp->ll_flock.l_type = local_flp->l_type;
15799         intersect_llp->ll_flock.l_pid = local_flp->l_pid;
15800         intersect_llp->ll_flock.l_sysid = local_flp->l_sysid;
15801         intersect_llp->ll_flock.l_whence = 0;        /* aka SEEK_SET */
15802         intersect_llp->ll_vp = vp;
15803 
15804         tmp_fllp = *nl_llpp;
15805         cur_fllp = NULL;
15806         while (tmp_fllp != NULL && tmp_fllp->ll_flock.l_start <
15807             intersect_llp->ll_flock.l_start) {
15808                         cur_fllp = tmp_fllp;
15809                         tmp_fllp = tmp_fllp->ll_next;
15810         }
15811         if (cur_fllp == NULL) {
15812                 /* first on the list */
15813                 intersect_llp->ll_next = *nl_llpp;
15814                 *nl_llpp = intersect_llp;
15815         } else {
15816                 intersect_llp->ll_next = cur_fllp->ll_next;
15817                 cur_fllp->ll_next = intersect_llp;
15818         }
15819 
15820         NFS4_DEBUG(nfs4_lost_rqst_debug, (CE_NOTE, "nfs4_add_lock_range: "
15821             "created lock region: start %"PRIx64" end %"PRIx64" : %s\n",
15822             intersect_llp->ll_flock.l_start,
15823             intersect_llp->ll_flock.l_start + intersect_llp->ll_flock.l_len,
15824             intersect_llp->ll_flock.l_type == F_RDLCK ? "READ" : "WRITE"));
15825 }
15826 
15827 /*
15828  * Our local locking current state is potentially different than
15829  * what the NFSv4 server thinks we have due to a lost lock that was
15830  * resent and then received.  We need to reset our "NFSv4" locking
15831  * state to match the current local locking state for this pid since
15832  * that is what the user/application sees as what the world is.
15833  *
15834  * We cannot afford to drop the open/lock seqid sync since then we can
15835  * get confused about what the current local locking state "is" versus
15836  * "was".
15837  *
15838  * If we are unable to fix up the locks, we send SIGLOST to the affected
15839  * process.  This is not done if the filesystem has been forcibly
15840  * unmounted, in case the process has already exited and a new process
15841  * exists with the same pid.
15842  */
15843 static void
15844 nfs4_reinstitute_local_lock_state(vnode_t *vp, flock64_t *lost_flp, cred_t *cr,
15845     nfs4_lock_owner_t *lop)
15846 {
15847         locklist_t *locks, *llp, *ri_llp, *tmp_llp;
15848         mntinfo4_t *mi = VTOMI4(vp);
15849         const int cmd = F_SETLK;
15850         off64_t cur_start, llp_ll_flock_end, lost_flp_end;
15851         flock64_t ul_fl;
15852 
15853         NFS4_DEBUG(nfs4_lost_rqst_debug, (CE_NOTE,
15854             "nfs4_reinstitute_local_lock_state"));
15855 
15856         /*
15857          * Find active locks for this vp from the local locking code.
15858          * Scan through this list and find out the locks that intersect with
15859          * the lost lock. Once we find the lock that intersects, add the
15860          * intersection area as a new lock to a new list "ri_llp". The lock
15861          * type of the intersection region lock added to ri_llp is the same
15862          * as that found in the active lock list, "list". The intersecting
15863          * region locks are added to ri_llp in increasing l_start order.
15864          */
15865         ASSERT(nfs_zone() == mi->mi_zone);
15866 
15867         locks = flk_active_locks_for_vp(vp);
15868         ri_llp = NULL;
15869 
15870         for (llp = locks; llp != NULL; llp = llp->ll_next) {
15871                 ASSERT(llp->ll_vp == vp);
15872                 /*
15873                  * Pick locks that belong to this pid/lockowner
15874                  */
15875                 if (llp->ll_flock.l_pid != lost_flp->l_pid)
15876                         continue;
15877 
15878                 nfs4_add_lock_range(lost_flp, &llp->ll_flock, &ri_llp, vp);
15879         }
15880 
15881         /*
15882          * Now we have the list of intersections with the lost lock. These are
15883          * the locks that were/are active before the server replied to the
15884          * last/lost lock. Issue these locks to the server here. Playing these
15885          * locks to the server will re-establish aur current local locking state
15886          * with the v4 server.
15887          * If we get an error, send SIGLOST to the application for that lock.
15888          */
15889 
15890         for (llp = ri_llp; llp != NULL; llp = llp->ll_next) {
15891                 NFS4_DEBUG(nfs4_lost_rqst_debug, (CE_NOTE,
15892                     "nfs4_reinstitute_local_lock_state: need to issue "
15893                     "flock: [%"PRIx64" - %"PRIx64"] : %s",
15894                     llp->ll_flock.l_start,
15895                     llp->ll_flock.l_start + llp->ll_flock.l_len,
15896                     llp->ll_flock.l_type == F_RDLCK ? "READ" :
15897                     llp->ll_flock.l_type == F_WRLCK ? "WRITE" : "INVALID"));
15898                 /*
15899                  * No need to relock what we already have
15900                  */
15901                 if (llp->ll_flock.l_type == lost_flp->l_type)
15902                         continue;
15903 
15904                 push_reinstate(vp, cmd, &llp->ll_flock, cr, lop);
15905         }
15906 
15907         /*
15908          * Now keeping the start of the lost lock as our reference parse the
15909          * newly created ri_llp locklist to find the ranges that we have locked
15910          * with the v4 server but not in the current local locking. We need
15911          * to unlock these ranges.
15912          * These ranges can also be reffered to as those ranges, where the lost
15913          * lock does not overlap with the locks in the ri_llp but are locked
15914          * since the server replied to the lost lock.
15915          */
15916         cur_start = lost_flp->l_start;
15917         lost_flp_end = lock_to_end(lost_flp);
15918 
15919         ul_fl.l_type = F_UNLCK;
15920         ul_fl.l_whence = 0;     /* aka SEEK_SET */
15921         ul_fl.l_sysid = lost_flp->l_sysid;
15922         ul_fl.l_pid = lost_flp->l_pid;
15923 
15924         for (llp = ri_llp; llp != NULL; llp = llp->ll_next) {
15925                 llp_ll_flock_end = lock_to_end(&llp->ll_flock);
15926 
15927                 if (llp->ll_flock.l_start <= cur_start) {
15928                         cur_start = start_check(llp_ll_flock_end);
15929                         continue;
15930                 }
15931                 NFS4_DEBUG(nfs4_lost_rqst_debug, (CE_NOTE,
15932                     "nfs4_reinstitute_local_lock_state: "
15933                     "UNLOCK [%"PRIx64" - %"PRIx64"]",
15934                     cur_start, llp->ll_flock.l_start));
15935 
15936                 ul_fl.l_start = cur_start;
15937                 ul_fl.l_len = end_to_len(cur_start,
15938                     (llp->ll_flock.l_start - 1));
15939 
15940                 push_reinstate(vp, cmd, &ul_fl, cr, lop);
15941                 cur_start = start_check(llp_ll_flock_end);
15942         }
15943 
15944         /*
15945          * In the case where the lost lock ends after all intersecting locks,
15946          * unlock the last part of the lost lock range.
15947          */
15948         if (cur_start != start_check(lost_flp_end)) {
15949                 NFS4_DEBUG(nfs4_lost_rqst_debug, (CE_NOTE,
15950                     "nfs4_reinstitute_local_lock_state: UNLOCK end of the "
15951                     "lost lock region [%"PRIx64" - %"PRIx64"]",
15952                     cur_start, lost_flp->l_start + lost_flp->l_len));
15953 
15954                 ul_fl.l_start = cur_start;
15955                 /*
15956                  * Is it an to-EOF lock? if so unlock till the end
15957                  */
15958                 if (lost_flp->l_len == 0)
15959                         ul_fl.l_len = 0;
15960                 else
15961                         ul_fl.l_len = start_check(lost_flp_end) - cur_start;
15962 
15963                 push_reinstate(vp, cmd, &ul_fl, cr, lop);
15964         }
15965 
15966         if (locks != NULL)
15967                 flk_free_locklist(locks);
15968 
15969         /* Free up our newly created locklist */
15970         for (llp = ri_llp; llp != NULL; ) {
15971                 tmp_llp = llp->ll_next;
15972                 kmem_free(llp, sizeof (locklist_t));
15973                 llp = tmp_llp;
15974         }
15975 
15976         /*
15977          * Now return back to the original calling nfs4frlock()
15978          * and let us naturally drop our seqid syncs.
15979          */
15980 }
15981 
15982 /*
15983  * Create a lost state record for the given lock reinstantiation request
15984  * and push it onto the lost state queue.
15985  */
15986 static void
15987 push_reinstate(vnode_t *vp, int cmd, flock64_t *flk, cred_t *cr,
15988     nfs4_lock_owner_t *lop)
15989 {
15990         nfs4_lost_rqst_t req;
15991         nfs_lock_type4 locktype;
15992         nfs4_error_t e = { EINTR, NFS4_OK, RPC_SUCCESS };
15993 
15994         ASSERT(nfs_zone() == VTOMI4(vp)->mi_zone);
15995 
15996         locktype = flk_to_locktype(cmd, flk->l_type);
15997         nfs4frlock_save_lost_rqst(NFS4_LCK_CTYPE_REINSTATE, EINTR, locktype,
15998             NULL, NULL, lop, flk, &req, cr, vp);
15999         (void) nfs4_start_recovery(&e, VTOMI4(vp), vp, NULL, NULL,
16000             (req.lr_op == OP_LOCK || req.lr_op == OP_LOCKU) ?
16001             &req : NULL, flk->l_type == F_UNLCK ? OP_LOCKU : OP_LOCK,
16002             NULL, NULL, NULL);
16003 }